commit 5908e6b738e3357af42c10e1183753c70a0117a9 Author: Linus Torvalds Date: Sun Feb 24 16:46:45 2019 -0800 Linux 5.0-rc8 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c3619a482e15d98e1d2eb6b32952e753077e7545 Merge: c4eb1e1852df de3ccd26fafc Author: Linus Torvalds Date: Sun Feb 24 09:47:07 2019 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM fixes from Paolo Bonzini: "Bug fixes" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: MMU: record maximum physical address width in kvm_mmu_extended_role kvm: x86: Return LA57 feature based on hardware capability x86/kvm/mmu: fix switch between root and guest MMUs s390: vsie: Use effective CRYCBD.31 to check CRYCBD validity commit c4eb1e1852df60d61e04a6b580a0490460c9e31b Merge: e60b5f79bd75 4c8e0459b585 Author: Linus Torvalds Date: Sun Feb 24 09:28:26 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: "Hopefully the last pull request for this release. Fingers crossed: 1) Only refcount ESP stats on full sockets, from Martin Willi. 2) Missing barriers in AF_UNIX, from Al Viro. 3) RCU protection fixes in ipv6 route code, from Paolo Abeni. 4) Avoid false positives in untrusted GSO validation, from Willem de Bruijn. 5) Forwarded mesh packets in mac80211 need more tailroom allocated, from Felix Fietkau. 6) Use operstate consistently for linkup in team driver, from George Wilkie. 7) ThunderX bug fixes from Vadim Lomovtsev. Mostly races between VF and PF code paths. 8) Purge ipv6 exceptions during netdevice removal, from Paolo Abeni. 9) nfp eBPF code gen fixes from Jiong Wang. 10) bnxt_en firmware timeout fix from Michael Chan. 11) Use after free in udp/udpv6 error handlers, from Paolo Abeni. 12) Fix a race in x25_bind triggerable by syzbot, from Eric Dumazet" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (65 commits) net: phy: realtek: Dummy IRQ calls for RTL8366RB tcp: repaired skbs must init their tso_segs net/x25: fix a race in x25_bind() net: dsa: Remove documentation for port_fdb_prepare Revert "bridge: do not add port to router list when receives query with source 0.0.0.0" selftests: fib_tests: sleep after changing carrier. again. net: set static variable an initial value in atl2_probe() net: phy: marvell10g: Fix Multi-G advertisement to only advertise 10G bpf, doc: add bpf list as secondary entry to maintainers file udp: fix possible user after free in error handler udpv6: fix possible user after free in error handler fou6: fix proto error handler argument type udpv6: add the required annotation to mib type mdio_bus: Fix use-after-free on device_register fails net: Set rtm_table to RT_TABLE_COMPAT for ipv6 for tables > 255 bnxt_en: Wait longer for the firmware message response to complete. bnxt_en: Fix typo in firmware message timeout logic. nfp: bpf: fix ALU32 high bits clearance bug nfp: bpf: fix code-gen bug on BPF_ALU | BPF_XOR | BPF_K Documentation: networking: switchdev: Update port parent ID section ... commit 4c8e0459b585e2a7b367545be3e102737f1e489f Author: Linus Walleij Date: Sun Feb 24 01:11:15 2019 +0100 net: phy: realtek: Dummy IRQ calls for RTL8366RB This fixes a regression introduced by commit 0d2e778e38e0ddffab4bb2b0e9ed2ad5165c4bf7 "net: phy: replace PHY_HAS_INTERRUPT with a check for config_intr and ack_interrupt". This assumes that a PHY cannot trigger interrupt unless it has .config_intr() or .ack_interrupt() implemented. A later patch makes the code assume both need to be implemented for interrupts to be present. But this PHY (which is inside a DSA) will happily fire interrupts without either callback. Implement dummy callbacks for .config_intr() and .ack_interrupt() in the phy header to fix this. Tested on the RTL8366RB on D-Link DIR-685. Fixes: 0d2e778e38e0 ("net: phy: replace PHY_HAS_INTERRUPT with a check for config_intr and ack_interrupt") Cc: Heiner Kallweit Signed-off-by: Linus Walleij Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/phy/realtek.c | 7 +++++++ include/linux/phy.h | 8 ++++++++ 2 files changed, 15 insertions(+) commit bf50b606cfd85ac8d3d0adb711f3e22204059848 Author: Eric Dumazet Date: Sat Feb 23 15:51:51 2019 -0800 tcp: repaired skbs must init their tso_segs syzbot reported a WARN_ON(!tcp_skb_pcount(skb)) in tcp_send_loss_probe() [1] This was caused by TCP_REPAIR sent skbs that inadvertenly were missing a call to tcp_init_tso_segs() [1] WARNING: CPU: 1 PID: 0 at net/ipv4/tcp_output.c:2534 tcp_send_loss_probe+0x771/0x8a0 net/ipv4/tcp_output.c:2534 Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.0.0-rc7+ #77 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x172/0x1f0 lib/dump_stack.c:113 panic+0x2cb/0x65c kernel/panic.c:214 __warn.cold+0x20/0x45 kernel/panic.c:571 report_bug+0x263/0x2b0 lib/bug.c:186 fixup_bug arch/x86/kernel/traps.c:178 [inline] fixup_bug arch/x86/kernel/traps.c:173 [inline] do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:271 do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:290 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:973 RIP: 0010:tcp_send_loss_probe+0x771/0x8a0 net/ipv4/tcp_output.c:2534 Code: 88 fc ff ff 4c 89 ef e8 ed 75 c8 fb e9 c8 fc ff ff e8 43 76 c8 fb e9 63 fd ff ff e8 d9 75 c8 fb e9 94 f9 ff ff e8 bf 03 91 fb <0f> 0b e9 7d fa ff ff e8 b3 03 91 fb 0f b6 1d 37 43 7a 03 31 ff 89 RSP: 0018:ffff8880ae907c60 EFLAGS: 00010206 RAX: ffff8880a989c340 RBX: 0000000000000000 RCX: ffffffff85dedbdb RDX: 0000000000000100 RSI: ffffffff85dee0b1 RDI: 0000000000000005 RBP: ffff8880ae907c90 R08: ffff8880a989c340 R09: ffffed10147d1ae1 R10: ffffed10147d1ae0 R11: ffff8880a3e8d703 R12: ffff888091b90040 R13: ffff8880a3e8d540 R14: 0000000000008000 R15: ffff888091b90860 tcp_write_timer_handler+0x5c0/0x8a0 net/ipv4/tcp_timer.c:583 tcp_write_timer+0x10e/0x1d0 net/ipv4/tcp_timer.c:607 call_timer_fn+0x190/0x720 kernel/time/timer.c:1325 expire_timers kernel/time/timer.c:1362 [inline] __run_timers kernel/time/timer.c:1681 [inline] __run_timers kernel/time/timer.c:1649 [inline] run_timer_softirq+0x652/0x1700 kernel/time/timer.c:1694 __do_softirq+0x266/0x95a kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x180/0x1d0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x14a/0x570 arch/x86/kernel/apic/apic.c:1062 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807 RIP: 0010:native_safe_halt+0x2/0x10 arch/x86/include/asm/irqflags.h:58 Code: ff ff ff 48 89 c7 48 89 45 d8 e8 59 0c a1 fa 48 8b 45 d8 e9 ce fe ff ff 48 89 df e8 48 0c a1 fa eb 82 90 90 90 90 90 90 fb f4 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 f4 c3 90 90 90 90 90 90 RSP: 0018:ffff8880a98afd78 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13 RAX: 1ffffffff1125061 RBX: ffff8880a989c340 RCX: 0000000000000000 RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffff8880a989cbbc RBP: ffff8880a98afda8 R08: ffff8880a989c340 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 R13: ffffffff889282f8 R14: 0000000000000001 R15: 0000000000000000 arch_cpu_idle+0x10/0x20 arch/x86/kernel/process.c:555 default_idle_call+0x36/0x90 kernel/sched/idle.c:93 cpuidle_idle_call kernel/sched/idle.c:153 [inline] do_idle+0x386/0x570 kernel/sched/idle.c:262 cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:353 start_secondary+0x404/0x5c0 arch/x86/kernel/smpboot.c:271 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243 Kernel Offset: disabled Rebooting in 86400 seconds.. Fixes: 79861919b889 ("tcp: fix TCP_REPAIR xmit queue setup") Signed-off-by: Eric Dumazet Reported-by: syzbot Cc: Andrey Vagin Cc: Soheil Hassas Yeganeh Cc: Neal Cardwell Acked-by: Soheil Hassas Yeganeh Acked-by: Neal Cardwell Signed-off-by: David S. Miller net/ipv4/tcp_output.c | 1 + 1 file changed, 1 insertion(+) commit 797a22bd5298c2674d927893f46cadf619dad11d Author: Eric Dumazet Date: Sat Feb 23 13:24:59 2019 -0800 net/x25: fix a race in x25_bind() syzbot was able to trigger another soft lockup [1] I first thought it was the O(N^2) issue I mentioned in my prior fix (f657d22ee1f "net/x25: do not hold the cpu too long in x25_new_lci()"), but I eventually found that x25_bind() was not checking SOCK_ZAPPED state under socket lock protection. This means that multiple threads can end up calling x25_insert_socket() for the same socket, and corrupt x25_list [1] watchdog: BUG: soft lockup - CPU#0 stuck for 123s! [syz-executor.2:10492] Modules linked in: irq event stamp: 27515 hardirqs last enabled at (27514): [] trace_hardirqs_on_thunk+0x1a/0x1c hardirqs last disabled at (27515): [] trace_hardirqs_off_thunk+0x1a/0x1c softirqs last enabled at (32): [] x25_get_neigh+0xa3/0xd0 net/x25/x25_link.c:336 softirqs last disabled at (34): [] x25_find_socket+0x23/0x140 net/x25/af_x25.c:341 CPU: 0 PID: 10492 Comm: syz-executor.2 Not tainted 5.0.0-rc7+ #88 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__sanitizer_cov_trace_pc+0x4/0x50 kernel/kcov.c:97 Code: f4 ff ff ff e8 11 9f ea ff 48 c7 05 12 fb e5 08 00 00 00 00 e9 c8 e9 ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 55 48 89 e5 <48> 8b 75 08 65 48 8b 04 25 40 ee 01 00 65 8b 15 38 0c 92 7e 81 e2 RSP: 0018:ffff88806e94fc48 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13 RAX: 1ffff1100d84dac5 RBX: 0000000000000001 RCX: ffffc90006197000 RDX: 0000000000040000 RSI: ffffffff86324bf3 RDI: ffff88806c26d628 RBP: ffff88806e94fc48 R08: ffff88806c1c6500 R09: fffffbfff1282561 R10: fffffbfff1282560 R11: ffffffff89412b03 R12: ffff88806c26d628 R13: ffff888090455200 R14: dffffc0000000000 R15: 0000000000000000 FS: 00007f3a107e4700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f3a107e3db8 CR3: 00000000a5544000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __x25_find_socket net/x25/af_x25.c:327 [inline] x25_find_socket+0x7d/0x140 net/x25/af_x25.c:342 x25_new_lci net/x25/af_x25.c:355 [inline] x25_connect+0x380/0xde0 net/x25/af_x25.c:784 __sys_connect+0x266/0x330 net/socket.c:1662 __do_sys_connect net/socket.c:1673 [inline] __se_sys_connect net/socket.c:1670 [inline] __x64_sys_connect+0x73/0xb0 net/socket.c:1670 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457e29 Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f3a107e3c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457e29 RDX: 0000000000000012 RSI: 0000000020000200 RDI: 0000000000000005 RBP: 000000000073c040 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f3a107e46d4 R13: 00000000004be362 R14: 00000000004ceb98 R15: 00000000ffffffff Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 10493 Comm: syz-executor.3 Not tainted 5.0.0-rc7+ #88 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__read_once_size include/linux/compiler.h:193 [inline] RIP: 0010:queued_write_lock_slowpath+0x143/0x290 kernel/locking/qrwlock.c:86 Code: 4c 8d 2c 01 41 83 c7 03 41 0f b6 45 00 41 38 c7 7c 08 84 c0 0f 85 0c 01 00 00 8b 03 3d 00 01 00 00 74 1a f3 90 41 0f b6 55 00 <41> 38 d7 7c eb 84 d2 74 e7 48 89 df e8 cc aa 4e 00 eb dd be 04 00 RSP: 0018:ffff888085c47bd8 EFLAGS: 00000206 RAX: 0000000000000300 RBX: ffffffff89412b00 RCX: 1ffffffff1282560 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff89412b00 RBP: ffff888085c47c70 R08: 1ffffffff1282560 R09: fffffbfff1282561 R10: fffffbfff1282560 R11: ffffffff89412b03 R12: 00000000000000ff R13: fffffbfff1282560 R14: 1ffff11010b88f7d R15: 0000000000000003 FS: 00007fdd04086700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fdd04064db8 CR3: 0000000090be0000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: queued_write_lock include/asm-generic/qrwlock.h:104 [inline] do_raw_write_lock+0x1d6/0x290 kernel/locking/spinlock_debug.c:203 __raw_write_lock_bh include/linux/rwlock_api_smp.h:204 [inline] _raw_write_lock_bh+0x3b/0x50 kernel/locking/spinlock.c:312 x25_insert_socket+0x21/0xe0 net/x25/af_x25.c:267 x25_bind+0x273/0x340 net/x25/af_x25.c:703 __sys_bind+0x23f/0x290 net/socket.c:1481 __do_sys_bind net/socket.c:1492 [inline] __se_sys_bind net/socket.c:1490 [inline] __x64_sys_bind+0x73/0xb0 net/socket.c:1490 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457e29 Fixes: 90c27297a9bf ("X.25 remove bkl in bind") Signed-off-by: Eric Dumazet Cc: andrew hendry Signed-off-by: David S. Miller net/x25/af_x25.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) commit 99407d8fa3abfe41b04d9321a9df0a0e30a57fae Author: Hauke Mehrtens Date: Fri Feb 22 20:07:45 2019 +0100 net: dsa: Remove documentation for port_fdb_prepare This callback was removed some time ago, also remove the documentation. Fixes: 1b6dd556c304 ("net: dsa: Remove prepare phase for FDB") Signed-off-by: Hauke Mehrtens Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller Documentation/networking/dsa/dsa.txt | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) commit 278e2148c07559dd4ad8602f22366d61eb2ee7b7 Author: Hangbin Liu Date: Fri Feb 22 21:22:32 2019 +0800 Revert "bridge: do not add port to router list when receives query with source 0.0.0.0" This reverts commit 5a2de63fd1a5 ("bridge: do not add port to router list when receives query with source 0.0.0.0") and commit 0fe5119e267f ("net: bridge: remove ipv6 zero address check in mcast queries") The reason is RFC 4541 is not a standard but suggestive. Currently we will elect 0.0.0.0 as Querier if there is no ip address configured on bridge. If we do not add the port which recives query with source 0.0.0.0 to router list, the IGMP reports will not be about to forward to Querier, IGMP data will also not be able to forward to dest. As Nikolay suggested, revert this change first and add a boolopt api to disable none-zero election in future if needed. Reported-by: Linus Lüssing Reported-by: Sebastian Gottschall Fixes: 5a2de63fd1a5 ("bridge: do not add port to router list when receives query with source 0.0.0.0") Fixes: 0fe5119e267f ("net: bridge: remove ipv6 zero address check in mcast queries") Signed-off-by: Hangbin Liu Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller net/bridge/br_multicast.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) commit af548a27b158d548d41e56255e6eaca1658cc3be Author: Thadeu Lima de Souza Cascardo Date: Fri Feb 22 07:27:41 2019 -0300 selftests: fib_tests: sleep after changing carrier. again. Just like commit e2ba732a1681 ("selftests: fib_tests: sleep after changing carrier"), wait one second to allow linkwatch to propagate the carrier change to the stack. There are two sets of carrier tests. The first slept after the carrier was set to off, and when the second set ran, it was likely that the linkwatch would be able to run again without much delay, reducing the likelihood of a race. However, if you run 'fib_tests.sh -t carrier' on a loop, you will quickly notice the failures. Sleeping on the second set of tests make the failures go away. Cc: David Ahern Signed-off-by: Thadeu Lima de Souza Cascardo Reviewed-by: David Ahern Signed-off-by: David S. Miller tools/testing/selftests/net/fib_tests.sh | 1 + 1 file changed, 1 insertion(+) commit 4593403fa516a5a4cffe6883c5062d60932cbfbe Author: Mao Wenan Date: Fri Feb 22 14:57:23 2019 +0800 net: set static variable an initial value in atl2_probe() cards_found is a static variable, but when it enters atl2_probe(), cards_found is set to zero, the value is not consistent with last probe, so next behavior is not our expect. Signed-off-by: Mao Wenan Signed-off-by: David S. Miller drivers/net/ethernet/atheros/atlx/atl2.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 61a65d32fe91c2b6ea3aed47c5f1efc7acd89ba2 Author: Maxime Chevallier Date: Thu Feb 21 17:54:11 2019 +0100 net: phy: marvell10g: Fix Multi-G advertisement to only advertise 10G Some Marvell Alaska PHYs support 2.5G, 5G and 10G BaseT links. Their default behaviour is to advertise all of these modes, but at the moment, only 10GBaseT is supported. To prevent link partners from establishing link at that speed, clear these modes upon configuring aneg parameters. Fixes: 20b2af32ff3f ("net: phy: add Marvell Alaska X 88X3310 10Gigabit PHY support") Signed-off-by: Maxime Chevallier Reported-by: Russell King Signed-off-by: David S. Miller drivers/net/phy/marvell10g.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit e60b5f79bd7529e76b13cf1e85823abbd0e33634 Merge: 6089a91fc02e 8f5b27347e88 Author: Linus Torvalds Date: Sat Feb 23 11:13:50 2019 -0800 Merge tag 'powerpc-5.0-6' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fix from Michael Ellerman: "One fix for an oops when using SRIOV, introduced by the recent changes to support compound IOMMU groups. Thanks to Alexey Kardashevskiy" * tag 'powerpc-5.0-6' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/powernv/sriov: Register IOMMU groups for VFs commit 6089a91fc02e0a4f8962f0df1be236c44248d7ea Merge: cb268d806972 4a067cf823d9 Author: Linus Torvalds Date: Sat Feb 23 09:48:01 2019 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Four small fixes: three in drivers and one in the core. The core fix is also minor in scope since the bug it fixes is only known to affect systems using SCSI reservations. Of the driver bugs, the libsas one is the most major because it can lead to multiple disks on the same expander not being exposed" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: core: reset host byte in DID_NEXUS_FAILURE case scsi: libsas: Fix rphy phy_identifier for PHYs with end devices attached scsi: sd_zbc: Fix sd_zbc_report_zones() buffer allocation scsi: libiscsi: Fix race between iscsi_xmit_task and iscsi_complete_task commit ea34a003645c25e15892fe1e268f8faf5a335533 Merge: 40e8f0b42fec b4b8bb69c104 Author: David S. Miller Date: Fri Feb 22 20:45:38 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2019-02-23 The following pull-request contains BPF updates for your *net* tree. The main changes are: 1) Fix a bug in BPF's LPM deletion logic to match correct prefix length, from Alban. 2) Fix AF_XDP teardown by not destroying umem prematurely as it is still needed till all outstanding skbs are freed, from Björn. 3) Fix unkillable BPF_PROG_TEST_RUN under preempt kernel by checking signal_pending() outside need_resched() condition which is never triggered there, from Stanislav. 4) Fix two nfp JIT bugs, one in code emission for K-based xor, and another one to explicitly clear upper bits in alu32, from Jiong. 5) Add bpf list address to maintainers file, from Daniel. ==================== Signed-off-by: David S. Miller commit cb268d806972c76c34e5d74343fb6064cd722c7c Merge: ef4edb3ed830 ede0fa98a900 Author: Linus Torvalds Date: Fri Feb 22 17:48:50 2019 -0800 Merge branch 'fixes-v5.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security Pull keys fixes from James Morris: "Two fixes from Eric Biggers" * 'fixes-v5.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: KEYS: always initialize keyring_index_key::desc_len KEYS: user: Align the payload buffer commit ef4edb3ed830cbbb443de9906b8cf16dc0653a74 Merge: 9053d2db8b04 5b317cbf2bcb Author: Linus Torvalds Date: Fri Feb 22 17:46:30 2019 -0800 Merge tag 'pm-5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix a regression in the PM-runtime framework introduced by the recent switch-over of it to using hrtimers and a use-after-free introduced by one of the recent changes in the scmi-cpufreq driver. Specifics: - Use hrtimer_try_to_cancel() instead of hrtimer_cancel() in the PM-runtime framework to avoid a possible timer-related deadlock introduced recently (Vincent Guittot). - Reorder the scmi-cpufreq driver code to avoid accessing memory that has just been freed (Yangtao Li)" * tag 'pm-5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM-runtime: Fix deadlock when canceling hrtimer cpufreq: scmi: Fix use-after-free in scmi_cpufreq_exit() commit 9053d2db8b04a468ce1ab92693b940b046ea392c Merge: 2cc63b390039 2f8b1ce19ebd Author: Linus Torvalds Date: Fri Feb 22 16:48:37 2019 -0800 Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Arnd Bergmann: "Only a handful of device tree fixes, all simple enough: NVIDIA Tegra: - Fix a regression for booting on chromebooks TI OMAP: - Two fixes PHY mode on am335x reference boards Marvell mvebu: - A regression fix for Armada XP NAND flash controllers - An incorrect reset signal on the clearfog board" * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: ARM: tegra: Restore DT ABI on Tegra124 Chromebooks ARM: dts: am335x-evm: Fix PHY mode for ethernet ARM: dts: am335x-evmsk: Fix PHY mode for ethernet arm64: dts: clearfog-gt-8k: fix SGMII PHY reset signal ARM: dts: armada-xp: fix Armada XP boards NAND description commit 2cc63b39003913fdf564cde5c646ac8f174e3ac7 Merge: 8456e98e18f3 7b2e932f633b Author: Linus Torvalds Date: Fri Feb 22 16:31:26 2019 -0800 Merge tag 'arc-5.0-final' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc Pull ARC fixes from Vineet Gupta: "Fixes for ARC for 5.0, bunch of those are stable fodder anyways so sooner the better. - Fix memcpy to prevent prefetchw beyond end of buffer [Eugeniy] - Enable unaligned access early to prevent exceptions given newer gcc code gen [Eugeniy] - Tighten up uboot arg checking to prevent false negatives and also allow both jtag and bootloading to coexist w/o config option as needed by kernelCi folks [Eugeniy] - Set slab alignment to 8 for ARC to avoid the atomic64_t unalign [Alexey] - Disable regfile auto save on interrupts on HSDK platform due to a silicon issue [Vineet] - Avoid HS38x boot printing crash by not reading HS48x only reg [Vineet]" * tag 'arc-5.0-final' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc: ARCv2: don't assume core 0x54 has dual issue ARC: define ARCH_SLAB_MINALIGN = 8 ARC: enable uboot support unconditionally ARC: U-boot: check arguments paranoidly ARCv2: support manual regfile save on interrupts ARC: uacces: remove lp_start, lp_end from clobber list ARC: fix actionpoints configuration detection ARCv2: lib: memcpy: fix doing prefetchw outside of buffer ARCv2: Enable unaligned access in early ASM code commit b4b8bb69c104a9345c528692cde5aa520d885360 Author: Daniel Borkmann Date: Sat Feb 23 00:03:44 2019 +0100 bpf, doc: add bpf list as secondary entry to maintainers file We recently created a bpf@vger.kernel.org list (https://lore.kernel.org/bpf/) for BPF related discussions, originally in context of BPF track at LSF/MM for topic discussions. It's *optional* but *desirable* to keep it in Cc for BPF related kernel/loader/llvm/tooling threads, meaning also infrastructure like llvm that sits on top of kernel but is crucial to BPF. In any case, netdev with it's bpf delegate is *as-is* today primary list for patches, so nothing changes in the workflow. Main purpose is to have some more awareness for the bpf@vger.kernel.org list that folks can Cc for BPF specific topics. Acked-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann MAINTAINERS | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) commit 8456e98e18f35f4d4376e8ff3110a3342f81ce9b Merge: 77dc1181d896 71d73a0b43c2 Author: Linus Torvalds Date: Fri Feb 22 16:12:01 2019 -0800 Merge branch 'parisc-5.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc fixes from Helge Deller: "Fix ptrace syscall number modification which has been broken since kernel v4.5 and provide alternative email addresses for the remaining users of the retired parisc-linux.org email domain" * 'parisc-5.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: CREDITS/MAINTAINERS: Retire parisc-linux.org email domain parisc: Fix ptrace syscall number modification commit 77dc1181d896c5c3f8e131e341993aef41e16505 Merge: 6ee2846cb4e7 207a369e3c08 Author: Linus Torvalds Date: Fri Feb 22 16:09:55 2019 -0800 Merge tag 'kbuild-fixes-v5.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull more Kbuild fixes from Masahiro Yamada: - fix scripts/kallsyms.c to correctly check too long symbol names - fix sh build error for the combination of CONFIG_OF_EARLY_FLATTREE=y and CONFIG_USE_BUILTIN_DTB=n * tag 'kbuild-fixes-v5.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: sh: fix build error for invisible CONFIG_BUILTIN_DTB_SOURCE kallsyms: Handle too long symbols in kallsyms.c commit 40e8f0b42fec9cc21f60de2982fd90620359c5d8 Merge: 6ff7b060535e 92b95364235b Author: David S. Miller Date: Fri Feb 22 16:05:12 2019 -0800 Merge branch 'udp-a-few-fixes' Paolo Abeni says: ==================== udp: a few fixes This series includes some UDP-related fixlet. All this stuff has been pointed out by the sparse tool. The first two patches are just annotation related, while the last 2 cover some very unlikely races. ==================== Signed-off-by: David S. Miller commit 92b95364235b6441a36861ff0ca4541a13351d60 Author: Paolo Abeni Date: Thu Feb 21 17:44:00 2019 +0100 udp: fix possible user after free in error handler Similar to the previous commit, this addresses the same issue for ipv4: use a single fetch operation and use the correct rcu annotation. Fixes: e7cc082455cb ("udp: Support for error handlers of tunnels with arbitrary destination port") Signed-off-by: Paolo Abeni Acked-by: Stefano Brivio Signed-off-by: David S. Miller net/ipv4/udp.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 424a7cd078401591fc45587ffb2c012d7f402fb7 Author: Paolo Abeni Date: Thu Feb 21 17:43:59 2019 +0100 udpv6: fix possible user after free in error handler Before derefencing the encap pointer, commit e7cc082455cb ("udp: Support for error handlers of tunnels with arbitrary destination port") checks for a NULL value, but the two fetch operation can race with removal. Fix the above using a single access. Also fix a couple of type annotations, to make sparse happy. Fixes: e7cc082455cb ("udp: Support for error handlers of tunnels with arbitrary destination port") Signed-off-by: Paolo Abeni Acked-by: Stefano Brivio Signed-off-by: David S. Miller net/ipv6/udp.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit 5de362df44d71fc8f6b153ae4eaa2a1284c84490 Author: Paolo Abeni Date: Thu Feb 21 17:43:58 2019 +0100 fou6: fix proto error handler argument type Last argument of gue6_err_proto_handler() has a wrong type annotation, fix it and make sparse happy again. Fixes: b8a51b38e4d4 ("fou, fou6: ICMP error handlers for FoU and GUE") Signed-off-by: Paolo Abeni Acked-by: Stefano Brivio Signed-off-by: David S. Miller net/ipv6/fou6.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 543fc3fb41834a7f2e4cfa1dcf8aa9c472a52e9a Author: Paolo Abeni Date: Thu Feb 21 17:43:57 2019 +0100 udpv6: add the required annotation to mib type In commit 029a37434880 ("udp6: cleanup stats accounting in recvmsg()") I forgot to add the percpu annotation for the mib pointer. Add it, and make sparse happy. Fixes: 029a37434880 ("udp6: cleanup stats accounting in recvmsg()") Signed-off-by: Paolo Abeni Signed-off-by: David S. Miller net/ipv6/udp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6ff7b060535e87c2ae14dd8548512abfdda528fb Author: YueHaibing Date: Thu Feb 21 22:42:01 2019 +0800 mdio_bus: Fix use-after-free on device_register fails KASAN has found use-after-free in fixed_mdio_bus_init, commit 0c692d07842a ("drivers/net/phy/mdio_bus.c: call put_device on device_register() failure") call put_device() while device_register() fails,give up the last reference to the device and allow mdiobus_release to be executed ,kfreeing the bus. However in most drives, mdiobus_free be called to free the bus while mdiobus_register fails. use-after-free occurs when access bus again, this patch revert it to let mdiobus_free free the bus. KASAN report details as below: BUG: KASAN: use-after-free in mdiobus_free+0x85/0x90 drivers/net/phy/mdio_bus.c:482 Read of size 4 at addr ffff8881dc824d78 by task syz-executor.0/3524 CPU: 1 PID: 3524 Comm: syz-executor.0 Not tainted 5.0.0-rc7+ #45 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xfa/0x1ce lib/dump_stack.c:113 print_address_description+0x65/0x270 mm/kasan/report.c:187 kasan_report+0x149/0x18d mm/kasan/report.c:317 mdiobus_free+0x85/0x90 drivers/net/phy/mdio_bus.c:482 fixed_mdio_bus_init+0x283/0x1000 [fixed_phy] ? 0xffffffffc0e40000 ? 0xffffffffc0e40000 ? 0xffffffffc0e40000 do_one_initcall+0xfa/0x5ca init/main.c:887 do_init_module+0x204/0x5f6 kernel/module.c:3460 load_module+0x66b2/0x8570 kernel/module.c:3808 __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902 do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x462e99 Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f6215c19c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462e99 RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000003 RBP: 00007f6215c19c70 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6215c1a6bc R13: 00000000004bcefb R14: 00000000006f7030 R15: 0000000000000004 Allocated by task 3524: set_track mm/kasan/common.c:85 [inline] __kasan_kmalloc.constprop.3+0xa0/0xd0 mm/kasan/common.c:496 kmalloc include/linux/slab.h:545 [inline] kzalloc include/linux/slab.h:740 [inline] mdiobus_alloc_size+0x54/0x1b0 drivers/net/phy/mdio_bus.c:143 fixed_mdio_bus_init+0x163/0x1000 [fixed_phy] do_one_initcall+0xfa/0x5ca init/main.c:887 do_init_module+0x204/0x5f6 kernel/module.c:3460 load_module+0x66b2/0x8570 kernel/module.c:3808 __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902 do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 3524: set_track mm/kasan/common.c:85 [inline] __kasan_slab_free+0x130/0x180 mm/kasan/common.c:458 slab_free_hook mm/slub.c:1409 [inline] slab_free_freelist_hook mm/slub.c:1436 [inline] slab_free mm/slub.c:2986 [inline] kfree+0xe1/0x270 mm/slub.c:3938 device_release+0x78/0x200 drivers/base/core.c:919 kobject_cleanup lib/kobject.c:662 [inline] kobject_release lib/kobject.c:691 [inline] kref_put include/linux/kref.h:67 [inline] kobject_put+0x146/0x240 lib/kobject.c:708 put_device+0x1c/0x30 drivers/base/core.c:2060 __mdiobus_register+0x483/0x560 drivers/net/phy/mdio_bus.c:382 fixed_mdio_bus_init+0x26b/0x1000 [fixed_phy] do_one_initcall+0xfa/0x5ca init/main.c:887 do_init_module+0x204/0x5f6 kernel/module.c:3460 load_module+0x66b2/0x8570 kernel/module.c:3808 __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902 do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff8881dc824c80 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 248 bytes inside of 2048-byte region [ffff8881dc824c80, ffff8881dc825480) The buggy address belongs to the page: page:ffffea0007720800 count:1 mapcount:0 mapping:ffff8881f6c02800 index:0x0 compound_mapcount: 0 flags: 0x2fffc0000010200(slab|head) raw: 02fffc0000010200 0000000000000000 0000000500000001 ffff8881f6c02800 raw: 0000000000000000 00000000800f000f 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881dc824c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8881dc824c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8881dc824d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8881dc824d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881dc824e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb Fixes: 0c692d07842a ("drivers/net/phy/mdio_bus.c: call put_device on device_register() failure") Signed-off-by: YueHaibing Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/phy/mdio_bus.c | 1 - 1 file changed, 1 deletion(-) commit 97f0082a0592212fc15d4680f5a4d80f79a1687c Author: Kalash Nainwal Date: Wed Feb 20 16:23:04 2019 -0800 net: Set rtm_table to RT_TABLE_COMPAT for ipv6 for tables > 255 Set rtm_table to RT_TABLE_COMPAT for ipv6 for tables > 255 to keep legacy software happy. This is similar to what was done for ipv4 in commit 709772e6e065 ("net: Fix routing tables with id > 255 for legacy software"). Signed-off-by: Kalash Nainwal Signed-off-by: David S. Miller net/ipv6/route.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a11f5756a336567d361124bda1456e88e2a516e4 Merge: ab01f251c9da 0000b81a063b Author: David S. Miller Date: Fri Feb 22 15:16:56 2019 -0800 Merge branch 'bnxt_en-firmware-message-delay-fixes' Michael Chan says: ==================== bnxt_en: firmware message delay fixes. We were seeing some intermittent firmware message timeouts in our lab and these 2 small patches fix them. Please apply to stable as well. Thanks. ==================== Signed-off-by: David S. Miller commit 0000b81a063b5f3ab82fa18041c28327ce72c312 Author: Michael Chan Date: Wed Feb 20 19:07:32 2019 -0500 bnxt_en: Wait longer for the firmware message response to complete. The code waits up to 20 usec for the firmware response to complete once we've seen the valid response header in the buffer. It turns out that in some scenarios, this wait time is not long enough. Extend it to 150 usec and use usleep_range() instead of udelay(). Fixes: 9751e8e71487 ("bnxt_en: reduce timeout on initial HWRM calls") Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 67681d02aaa1db9044a16df4ca9c77cde1221a3e Author: Michael Chan Date: Wed Feb 20 19:07:31 2019 -0500 bnxt_en: Fix typo in firmware message timeout logic. The logic that polls for the firmware message response uses a shorter sleep interval for the first few passes. But there was a typo so it was using the wrong counter (larger counter) for these short sleep passes. The result is a slightly shorter timeout period for these firmware messages than intended. Fix it by using the proper counter. Fixes: 9751e8e71487 ("bnxt_en: reduce timeout on initial HWRM calls") Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7d466e5fb13bed595b3a13a8ad054914d56744bf Merge: 7c0cdf0b3940 f036ebd9bfbe Author: Daniel Borkmann Date: Sat Feb 23 00:07:48 2019 +0100 Merge branch 'bpf-nfp-codegen-fixes' Jiong Wang says: ==================== Code-gen for BPF_ALU | BPF_XOR | BPF_K is wrong when imm is -1, also high 32-bit of 64-bit register should always be cleared. This set fixed both bugs. ==================== Signed-off-by: Daniel Borkmann commit f036ebd9bfbe1e91a3d855e85e05fc5ff156b641 Author: Jiong Wang Date: Fri Feb 22 22:36:04 2019 +0000 nfp: bpf: fix ALU32 high bits clearance bug NFP BPF JIT compiler is doing a couple of small optimizations when jitting ALU imm instructions, some of these optimizations could save code-gen, for example: A & -1 = A A | 0 = A A ^ 0 = A However, for ALU32, high 32-bit of the 64-bit register should still be cleared according to ISA semantics. Fixes: cd7df56ed3e6 ("nfp: add BPF to NFP code translator") Reviewed-by: Jakub Kicinski Signed-off-by: Jiong Wang Signed-off-by: Daniel Borkmann drivers/net/ethernet/netronome/nfp/bpf/jit.c | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-) commit 71c190249f0ced5b26377ea6bf829ab3af77a40c Author: Jiong Wang Date: Fri Feb 22 22:36:03 2019 +0000 nfp: bpf: fix code-gen bug on BPF_ALU | BPF_XOR | BPF_K The intended optimization should be A ^ 0 = A, not A ^ -1 = A. Fixes: cd7df56ed3e6 ("nfp: add BPF to NFP code translator") Reviewed-by: Jakub Kicinski Signed-off-by: Jiong Wang Signed-off-by: Daniel Borkmann drivers/net/ethernet/netronome/nfp/bpf/jit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ab01f251c9da8dc5ae70041ae6a2a50e8b94c079 Merge: 80d79ad224ba 51d0af222f6f Author: David S. Miller Date: Fri Feb 22 12:51:21 2019 -0800 Merge tag 'mac80211-for-davem-2019-02-22' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== Three more fixes: * mac80211 mesh code wasn't allocating SKB tailroom properly in some cases * tx_sk_pacing_shift should be 7 for better performance * mac80211_hwsim wasn't propagating genlmsg_reply() errors ==================== Signed-off-by: David S. Miller commit 80d79ad224ba22381e8d26b54674a86433e75d18 Author: Florian Fainelli Date: Wed Feb 20 14:58:50 2019 -0800 Documentation: networking: switchdev: Update port parent ID section Update the section about switchdev drivers having to implement a switchdev_port_attr_get() function to return SWITCHDEV_ATTR_ID_PORT_PARENT_ID since that is no longer valid after commit bccb30254a4a ("net: Get rid of SWITCHDEV_ATTR_ID_PORT_PARENT_ID"). Fixes: bccb30254a4a ("net: Get rid of SWITCHDEV_ATTR_ID_PORT_PARENT_ID") Reviewed-by: Ido Schimmel Acked-by: Jiri Pirko Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller Documentation/networking/switchdev.txt | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 52baf9878b65872a7fc735d7fae3350ea9f30646 Author: Jann Horn Date: Wed Feb 20 22:34:54 2019 +0100 net: socket: add check for negative optlen in compat setsockopt __sys_setsockopt() already checks for `optlen < 0`. Add an equivalent check to the compat path for robustness. This has to be `> INT_MAX` instead of `< 0` because the signedness of `optlen` is different here. Signed-off-by: Jann Horn Signed-off-by: David S. Miller net/compat.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit f5b51fe804ec2a6edce0f8f6b11ea57283f5857b Author: Paolo Abeni Date: Wed Feb 20 18:18:12 2019 +0100 ipv6: route: purge exception on removal When a netdevice is unregistered, we flush the relevant exception via rt6_sync_down_dev() -> fib6_ifdown() -> fib6_del() -> fib6_del_route(). Finally, we end-up calling rt6_remove_exception(), where we release the relevant dst, while we keep the references to the related fib6_info and dev. Such references should be released later when the dst will be destroyed. There are a number of caches that can keep the exception around for an unlimited amount of time - namely dst_cache, possibly even socket cache. As a result device registration may hang, as demonstrated by this script: ip netns add cl ip netns add rt ip netns add srv ip netns exec rt sysctl -w net.ipv6.conf.all.forwarding=1 ip link add name cl_veth type veth peer name cl_rt_veth ip link set dev cl_veth netns cl ip -n cl link set dev cl_veth up ip -n cl addr add dev cl_veth 2001::2/64 ip -n cl route add default via 2001::1 ip -n cl link add tunv6 type ip6tnl mode ip6ip6 local 2001::2 remote 2002::1 hoplimit 64 dev cl_veth ip -n cl link set tunv6 up ip -n cl addr add 2013::2/64 dev tunv6 ip link set dev cl_rt_veth netns rt ip -n rt link set dev cl_rt_veth up ip -n rt addr add dev cl_rt_veth 2001::1/64 ip link add name rt_srv_veth type veth peer name srv_veth ip link set dev srv_veth netns srv ip -n srv link set dev srv_veth up ip -n srv addr add dev srv_veth 2002::1/64 ip -n srv route add default via 2002::2 ip -n srv link add tunv6 type ip6tnl mode ip6ip6 local 2002::1 remote 2001::2 hoplimit 64 dev srv_veth ip -n srv link set tunv6 up ip -n srv addr add 2013::1/64 dev tunv6 ip link set dev rt_srv_veth netns rt ip -n rt link set dev rt_srv_veth up ip -n rt addr add dev rt_srv_veth 2002::2/64 ip netns exec srv netserver & sleep 0.1 ip netns exec cl ping6 -c 4 2013::1 ip netns exec cl netperf -H 2013::1 -t TCP_STREAM -l 3 & sleep 1 ip -n rt link set dev rt_srv_veth mtu 1400 wait %2 ip -n cl link del cl_veth This commit addresses the issue purging all the references held by the exception at time, as we currently do for e.g. ipv6 pcpu dst entries. v1 -> v2: - re-order the code to avoid accessing dst and net after dst_dev_put() Fixes: 93531c674315 ("net/ipv6: separate handling of FIB entries from dst based routes") Signed-off-by: Paolo Abeni Reviewed-by: David Ahern Signed-off-by: David S. Miller net/ipv6/route.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) commit aaaf59851abba6900d37bd6e8be9968e72a0a187 Merge: efcc9bcaf77c 2e1c3fff5e49 Author: David S. Miller Date: Fri Feb 22 11:43:45 2019 -0800 Merge branch 'nic-thunderx-fix-communication-races-between-VF-PF' Vadim Lomovtsev says: ==================== nic: thunderx: fix communication races between VF & PF The ThunderX CN88XX NIC Virtual Function driver uses mailbox interface to communicate to physical function driver. Each of VF has it's own pair of mailbox registers to read from and write to. The mailbox registers has no protection from possible races, so it has to be implemented at software side. After long term testing by loop of 'ip link set up/down' command it was found that there are two possible scenarios when race condition appears: 1. VF receives link change message from PF and VF send RX mode configuration message to PF in the same time from separate thread. 2. PF receives RX mode configuration from VF and in the same time, in separate thread PF detects link status change and sends appropriate message to particular VF. Both cases leads to mailbox data to be rewritten, NIC VF messaging control data to be updated incorrectly and communication sequence gets broken. This patch series is to address race condition with VF & PF communication. Changes: v1 -> v2 - 0000: correct typo in cover letter subject: 'betwen' -> 'between'; - move link state polling request task from pf to vf instead of cheking status of mailbox irq; v2 -> v3 - 0003: change return type of nicvf_send_cfg_done() function from int to void; - 0007: update subject and remove unused variable 'netdev' from nicvf_link_status_check_task() function; ==================== Signed-off-by: David S. Miller commit 2e1c3fff5e496621ccbb1a207b775c1dd1d524ac Author: Vadim Lomovtsev Date: Wed Feb 20 11:02:45 2019 +0000 net: thunderx: remove link change polling code and info from nicpf Since link change polling routine was moved to nicvf side, we don't need anymore polling function at nicpf side along with link status info for all enabled Vfs as at VF side this info is already tracked. This commit is to remove unnecessary code & fields from nicpf structure. Signed-off-by: Vadim Lomovtsev Signed-off-by: David S. Miller drivers/net/ethernet/cavium/thunder/nic_main.c | 114 +++---------------------- 1 file changed, 12 insertions(+), 102 deletions(-) commit 2c632ad8bc744d2ad59dd381ce56fae143cf1e0a Author: Vadim Lomovtsev Date: Wed Feb 20 11:02:45 2019 +0000 net: thunderx: move link state polling function to VF Move the link change polling task to VF side in order to prevent races between VF and PF while sending link change message(s). This commit is to implement link change request to be initiated by VF. Signed-off-by: Vadim Lomovtsev Signed-off-by: David S. Miller drivers/net/ethernet/cavium/thunder/nic.h | 2 +- drivers/net/ethernet/cavium/thunder/nic_main.c | 39 ++++++++++++++++-- drivers/net/ethernet/cavium/thunder/nicvf_main.c | 52 +++++++++++++++++------- 3 files changed, 74 insertions(+), 19 deletions(-) commit 609ea65c65a0f801c285abf524d36d1f4635d942 Author: Vadim Lomovtsev Date: Wed Feb 20 11:02:44 2019 +0000 net: thunderx: add mutex to protect mailbox from concurrent calls for same VF In some cases it could happen that nicvf_send_msg_to_pf() could be called concurrently for the same NIC VF, and thus re-writing mailbox contents and breaking messaging sequence with PF by re-writing NICVF data. This commit is to implement mutex for NICVF to protect mailbox registers and NICVF messaging control data from concurrent access. Signed-off-by: Vadim Lomovtsev Signed-off-by: David S. Miller drivers/net/ethernet/cavium/thunder/nic.h | 2 ++ drivers/net/ethernet/cavium/thunder/nicvf_main.c | 13 ++++++++++--- 2 files changed, 12 insertions(+), 3 deletions(-) commit 5354439612894033e3f3b934f0bc03afb5f4ddc5 Author: Vadim Lomovtsev Date: Wed Feb 20 11:02:44 2019 +0000 net: thunderx: rework xcast message structure to make it fit into 64 bit To communicate to PF each of ThunderX NIC VF uses mailbox which is pair of 64 bit registers available to both VFn and PF. This commit is to change the xcast message structure in order to fit it into 64 bit. Signed-off-by: Vadim Lomovtsev Signed-off-by: David S. Miller drivers/net/ethernet/cavium/thunder/nic.h | 6 ++---- drivers/net/ethernet/cavium/thunder/nic_main.c | 4 ++-- drivers/net/ethernet/cavium/thunder/nicvf_main.c | 6 +++--- 3 files changed, 7 insertions(+), 9 deletions(-) commit 7db730d9d2f7b6af6aeac621b1890ea477a0cb8d Author: Vadim Lomovtsev Date: Wed Feb 20 11:02:44 2019 +0000 net: thunderx: add nicvf_send_msg_to_pf result check for set_rx_mode_task The rx_set_mode invokes number of messages to be send to PF for receive mode configuration. In case if there any issues we need to stop sending messages and release allocated memory. This commit is to implement check of nicvf_msg_send_to_pf() result. Signed-off-by: Vadim Lomovtsev Signed-off-by: David S. Miller drivers/net/ethernet/cavium/thunder/nicvf_main.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) commit 0dd563b9a62c4cbabf5d4fd6596440c2491e72b1 Author: Vadim Lomovtsev Date: Wed Feb 20 11:02:43 2019 +0000 net: thunderx: make CFG_DONE message to run through generic send-ack sequence At the end of NIC VF initialization VF sends CFG_DONE message to PF without using nicvf_msg_send_to_pf routine. This potentially could re-write data in mailbox. This commit is to implement common way of sending CFG_DONE message by the same way with other configuration messages by using nicvf_send_msg_to_pf() routine. Signed-off-by: Vadim Lomovtsev Signed-off-by: David S. Miller drivers/net/ethernet/cavium/thunder/nic_main.c | 2 +- drivers/net/ethernet/cavium/thunder/nicvf_main.c | 15 ++++++++++++--- 2 files changed, 13 insertions(+), 4 deletions(-) commit 2ecbe4f4a027890a5d74a5100075aa6a373bea2c Author: Vadim Lomovtsev Date: Wed Feb 20 11:02:43 2019 +0000 net: thunderx: replace global nicvf_rx_mode_wq work queue for all VFs to private for each of them. Having one work queue for receive mode configuration ndo_set_rx_mode() call for all VFs results in making each of them wait till the set_rx_mode() call completes for another VF if any of close, set receive mode and change flags calls being already invoked. Potentially this could cause device state change before appropriate call of receive mode configuration completes, so the call itself became meaningless, corrupt data or break configuration sequence. We don't need any delays in NIC VF configuration sequence so having delayed work call with 0 delay has no sense. This commit is to implement one work queue for each NIC VF for set_rx_mode task and to let them work independently and replacing delayed_work with work_struct. Signed-off-by: Vadim Lomovtsev Signed-off-by: David S. Miller drivers/net/ethernet/cavium/thunder/nic.h | 4 +++- drivers/net/ethernet/cavium/thunder/nicvf_main.c | 30 +++++++++++++----------- 2 files changed, 19 insertions(+), 15 deletions(-) commit f6d25aca1ba3f46b76dabf6023a0dc2062dc792e Author: Vadim Lomovtsev Date: Wed Feb 20 11:02:43 2019 +0000 net: thunderx: correct typo in macro name Correct STREERING to STEERING at macro name for BGX steering register. Signed-off-by: Vadim Lomovtsev Signed-off-by: David S. Miller drivers/net/ethernet/cavium/thunder/thunder_bgx.c | 2 +- drivers/net/ethernet/cavium/thunder/thunder_bgx.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit efcc9bcaf77c07df01371a7c34e50424c291f3ac Author: Lorenzo Bianconi Date: Wed Feb 20 09:23:03 2019 +0100 net: ip6_gre: fix possible NULL pointer dereference in ip6erspan_set_version Fix a possible NULL pointer dereference in ip6erspan_set_version checking nlattr data pointer kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 7549 Comm: syz-executor432 Not tainted 5.0.0-rc6-next-20190218 #37 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:ip6erspan_set_version+0x5c/0x350 net/ipv6/ip6_gre.c:1726 Code: 07 38 d0 7f 08 84 c0 0f 85 9f 02 00 00 49 8d bc 24 b0 00 00 00 c6 43 54 01 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 9a 02 00 00 4d 8b ac 24 b0 00 00 00 4d 85 ed 0f RSP: 0018:ffff888089ed7168 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffff8880869d6e58 RCX: 0000000000000000 RDX: 0000000000000016 RSI: ffffffff862736b4 RDI: 00000000000000b0 RBP: ffff888089ed7180 R08: 1ffff11010d3adcb R09: ffff8880869d6e58 R10: ffffed1010d3add5 R11: ffff8880869d6eaf R12: 0000000000000000 R13: ffffffff8931f8c0 R14: ffffffff862825d0 R15: ffff8880869d6e58 FS: 0000000000b3d880(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000184 CR3: 0000000092cc5000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ip6erspan_newlink+0x66/0x7b0 net/ipv6/ip6_gre.c:2210 __rtnl_newlink+0x107b/0x16c0 net/core/rtnetlink.c:3176 rtnl_newlink+0x69/0xa0 net/core/rtnetlink.c:3234 rtnetlink_rcv_msg+0x465/0xb00 net/core/rtnetlink.c:5192 netlink_rcv_skb+0x17a/0x460 net/netlink/af_netlink.c:2485 rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5210 netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline] netlink_unicast+0x536/0x720 net/netlink/af_netlink.c:1336 netlink_sendmsg+0x8ae/0xd70 net/netlink/af_netlink.c:1925 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg+0xdd/0x130 net/socket.c:631 ___sys_sendmsg+0x806/0x930 net/socket.c:2136 __sys_sendmsg+0x105/0x1d0 net/socket.c:2174 __do_sys_sendmsg net/socket.c:2183 [inline] __se_sys_sendmsg net/socket.c:2181 [inline] __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2181 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x440159 Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fffa69156e8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440159 RDX: 0000000000000000 RSI: 0000000020001340 RDI: 0000000000000003 RBP: 00000000006ca018 R08: 0000000000000001 R09: 00000000004002c8 R10: 0000000000000011 R11: 0000000000000246 R12: 00000000004019e0 R13: 0000000000401a70 R14: 0000000000000000 R15: 0000000000000000 Modules linked in: ---[ end trace 09f8a7d13b4faaa1 ]--- RIP: 0010:ip6erspan_set_version+0x5c/0x350 net/ipv6/ip6_gre.c:1726 Code: 07 38 d0 7f 08 84 c0 0f 85 9f 02 00 00 49 8d bc 24 b0 00 00 00 c6 43 54 01 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 9a 02 00 00 4d 8b ac 24 b0 00 00 00 4d 85 ed 0f RSP: 0018:ffff888089ed7168 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: ffff8880869d6e58 RCX: 0000000000000000 RDX: 0000000000000016 RSI: ffffffff862736b4 RDI: 00000000000000b0 RBP: ffff888089ed7180 R08: 1ffff11010d3adcb R09: ffff8880869d6e58 R10: ffffed1010d3add5 R11: ffff8880869d6eaf R12: 0000000000000000 R13: ffffffff8931f8c0 R14: ffffffff862825d0 R15: ffff8880869d6e58 FS: 0000000000b3d880(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000184 CR3: 0000000092cc5000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Fixes: 4974d5f678ab ("net: ip6_gre: initialize erspan_ver just for erspan tunnels") Reported-and-tested-by: syzbot+30191cf1057abd3064af@syzkaller.appspotmail.com Signed-off-by: Lorenzo Bianconi Reviewed-by: Greg Rose Signed-off-by: David S. Miller net/ipv6/ip6_gre.c | 3 +++ 1 file changed, 3 insertions(+) commit 8c7a77267eec81dd81af8412f29e50c0b1082548 Author: George Wilkie Date: Wed Feb 20 08:19:11 2019 +0000 team: use operstate consistently for linkup When a port is added to a team, its initial state is derived from netif_carrier_ok rather than netif_oper_up. If it is carrier up but operationally down at the time of being added, the port state.linkup will be set prematurely. port state.linkup should be set consistently using netif_oper_up rather than netif_carrier_ok. Fixes: f1d22a1e0595 ("team: account for oper state") Signed-off-by: George Wilkie Acked-by: Jiri Pirko Signed-off-by: David S. Miller drivers/net/team/team.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit c286909fe5458f69e533c845b757fd2c35064d26 Author: David Chen Date: Wed Feb 20 13:47:19 2019 +0800 r8152: Fix an error on RTL8153-BD MAC Address Passthrough support RTL8153-BD is used in Dell DA300 type-C dongle. Added RTL8153-BD support to activate MAC address pass through on DA300. Apply correction on previously submitted patch in net.git tree. Signed-off-by: David Chen Signed-off-by: David S. Miller drivers/net/usb/r8152.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7cc9f7003a969d359f608ebb701d42cafe75b84a Author: Daniel Borkmann Date: Wed Feb 20 00:15:30 2019 +0100 ipvlan: disallow userns cap_net_admin to change global mode/flags When running Docker with userns isolation e.g. --userns-remap="default" and spawning up some containers with CAP_NET_ADMIN under this realm, I noticed that link changes on ipvlan slave device inside that container can affect all devices from this ipvlan group which are in other net namespaces where the container should have no permission to make changes to, such as the init netns, for example. This effectively allows to undo ipvlan private mode and switch globally to bridge mode where slaves can communicate directly without going through hostns, or it allows to switch between global operation mode (l2/l3/l3s) for everyone bound to the given ipvlan master device. libnetwork plugin here is creating an ipvlan master and ipvlan slave in hostns and a slave each that is moved into the container's netns upon creation event. * In hostns: # ip -d a [...] 8: cilium_host@bond0: mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000 link/ether 0c:c4:7a:e1:3d:cc brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535 ipvlan mode l3 bridge numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535 inet 10.41.0.1/32 scope link cilium_host valid_lft forever preferred_lft forever [...] * Spawn container & change ipvlan mode setting inside of it: # docker run -dt --cap-add=NET_ADMIN --network cilium-net --name client -l app=test cilium/netperf 9fff485d69dcb5ce37c9e33ca20a11ccafc236d690105aadbfb77e4f4170879c # docker exec -ti client ip -d a [...] 10: cilium0@if4: mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000 link/ether 0c:c4:7a:e1:3d:cc brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535 ipvlan mode l3 bridge numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535 inet 10.41.197.43/32 brd 10.41.197.43 scope global cilium0 valid_lft forever preferred_lft forever # docker exec -ti client ip link change link cilium0 name cilium0 type ipvlan mode l2 # docker exec -ti client ip -d a [...] 10: cilium0@if4: mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000 link/ether 0c:c4:7a:e1:3d:cc brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535 ipvlan mode l2 bridge numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535 inet 10.41.197.43/32 brd 10.41.197.43 scope global cilium0 valid_lft forever preferred_lft forever * In hostns (mode switched to l2): # ip -d a [...] 8: cilium_host@bond0: mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000 link/ether 0c:c4:7a:e1:3d:cc brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535 ipvlan mode l2 bridge numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535 inet 10.41.0.1/32 scope link cilium_host valid_lft forever preferred_lft forever [...] Same l3 -> l2 switch would also happen by creating another slave inside the container's network namespace when specifying the existing cilium0 link to derive the actual (bond0) master: # docker exec -ti client ip link add link cilium0 name cilium1 type ipvlan mode l2 # docker exec -ti client ip -d a [...] 2: cilium1@if4: mtu 1500 qdisc noop state DOWN group default qlen 1000 link/ether 0c:c4:7a:e1:3d:cc brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535 ipvlan mode l2 bridge numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535 10: cilium0@if4: mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000 link/ether 0c:c4:7a:e1:3d:cc brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535 ipvlan mode l2 bridge numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535 inet 10.41.197.43/32 brd 10.41.197.43 scope global cilium0 valid_lft forever preferred_lft forever * In hostns: # ip -d a [...] 8: cilium_host@bond0: mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000 link/ether 0c:c4:7a:e1:3d:cc brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535 ipvlan mode l2 bridge numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535 inet 10.41.0.1/32 scope link cilium_host valid_lft forever preferred_lft forever [...] One way to mitigate it is to check CAP_NET_ADMIN permissions of the ipvlan master device's ns, and only then allow to change mode or flags for all devices bound to it. Above two cases are then disallowed after the patch. Signed-off-by: Daniel Borkmann Acked-by: Mahesh Bandewar Signed-off-by: David S. Miller drivers/net/ipvlan/ipvlan_main.c | 4 ++++ 1 file changed, 4 insertions(+) commit d1f20c03f48102e52eb98b8651d129b83134cae4 Author: Maciej Kwiecien Date: Fri Feb 22 09:45:26 2019 +0100 sctp: don't compare hb_timer expire date before starting it hb_timer might not start at all for a particular transport because its start is conditional. In a result a node is not sending heartbeats. Function sctp_transport_reset_hb_timer has two roles: - initial start of hb_timer for a given transport, - update expire date of hb_timer for a given transport. The function is optimized to update timer's expire only if it is before a new calculated one but this comparison is invalid for a timer which has not yet started. Such a timer has expire == 0 and if a new expire value is bigger than (MAX_JIFFIES / 2 + 2) then "time_before" macro will fail and timer will not start resulting in no heartbeat packets send by the node. This was found when association was initialized within first 5 mins after system boot due to jiffies init value which is near to MAX_JIFFIES. Test kernel version: 4.9.154 (ARCH=arm) hb_timer.expire = 0; //initialized, not started timer new_expire = MAX_JIFFIES / 2 + 2; //or more time_before(hb_timer.expire, new_expire) == false Fixes: ba6f5e33bdbb ("sctp: avoid refreshing heartbeat timer too often") Reported-by: Marcin Stojek Tested-by: Marcin Stojek Signed-off-by: Maciej Kwiecien Reviewed-by: Alexander Sverdlin Acked-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller net/sctp/transport.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 6ee2846cb4e7c6e8acdcb265299ad1c6de42b437 Merge: 168bd29830e8 019276ed65f3 Author: Linus Torvalds Date: Fri Feb 22 10:35:06 2019 -0800 Merge tag 'drm-fixes-2019-02-22' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "This contains a single i915 tiled display fix, and a set of amdgpu/radeon fixes. i915: - tiled display fix amdgpu/radeon: - runtime PM fix - bulk moves disable (fix is too large for 5.0) - a set of display fixes that are all cc'ed stable so we didn't want to leave them until -next" * tag 'drm-fixes-2019-02-22' of git://anongit.freedesktop.org/drm/drm: drm/amdgpu: disable bulk moves for now drm/amd/display: set clocks to 0 on suspend on dce80 drm/amd/display: fix optimize_bandwidth func pointer for dce80 drm/amd/display: Fix negative cursor pos programming drm/i915/fbdev: Actually configure untiled displays drm/amd/display: Raise dispclk value for dce11 drm/amd/display: Fix MST reboot/poweroff sequence drm/amdgpu: Update sdma golden setting for vega20 drm/amdgpu: Set DPM_FLAG_NEVER_SKIP when enabling PM-runtime gpu: drm: radeon: Set DPM_FLAG_NEVER_SKIP when enabling PM-runtime commit 168bd29830e8ebbffcd70d2af50249dca088e1a8 Merge: a3504f7a3823 f09ef134a7ca Author: Linus Torvalds Date: Fri Feb 22 10:32:26 2019 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: "Small set of three regression fixing patches, things are looking pretty good here. - Fix cxgb4 to work again with non-4k page sizes - NULL pointer oops in SRP during sg_reset" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: iw_cxgb4: cq/qp mask depends on bar2 pages in a host page cxgb4: Export sge_host_page_size to ulds RDMA/srp: Rework SCSI device reset handling commit de3ccd26fafc707b09792d9b633c8b5b48865315 Author: Yu Zhang Date: Fri Feb 1 00:09:23 2019 +0800 KVM: MMU: record maximum physical address width in kvm_mmu_extended_role Previously, commit 7dcd57552008 ("x86/kvm/mmu: check if tdp/shadow MMU reconfiguration is needed") offered some optimization to avoid the unnecessary reconfiguration. Yet one scenario is broken - when cpuid changes VM's maximum physical address width, reconfiguration is needed to reset the reserved bits. Also, the TDP may need to reset its shadow_root_level when this value is changed. To fix this, a new field, maxphyaddr, is introduced in the extended role structure to keep track of the configured guest physical address width. Signed-off-by: Yu Zhang Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini arch/x86/include/asm/kvm_host.h | 1 + arch/x86/kvm/mmu.c | 1 + 2 files changed, 2 insertions(+) commit 511da98d207d5c0675a10351b01e37cbe50a79e5 Author: Yu Zhang Date: Fri Feb 1 00:09:43 2019 +0800 kvm: x86: Return LA57 feature based on hardware capability Previously, 'commit 372fddf70904 ("x86/mm: Introduce the 'no5lvl' kernel parameter")' cleared X86_FEATURE_LA57 in boot_cpu_data, if Linux chooses to not run in 5-level paging mode. Yet boot_cpu_data is queried by do_cpuid_ent() as the host capability later when creating vcpus, and Qemu will not be able to detect this feature and create VMs with LA57 feature. As discussed earlier, VMs can still benefit from extended linear address width, e.g. to enhance features like ASLR. So we would like to fix this, by return the true hardware capability when Qemu queries. Signed-off-by: Yu Zhang Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini arch/x86/kvm/cpuid.c | 4 ++++ 1 file changed, 4 insertions(+) commit ad7dc69aeb23138cc23c406cac25003b97e8ee17 Author: Vitaly Kuznetsov Date: Fri Feb 22 17:45:01 2019 +0100 x86/kvm/mmu: fix switch between root and guest MMUs Commit 14c07ad89f4d ("x86/kvm/mmu: introduce guest_mmu") brought one subtle change: previously, when switching back from L2 to L1, we were resetting MMU hooks (like mmu->get_cr3()) in kvm_init_mmu() called from nested_vmx_load_cr3() and now we do that in nested_ept_uninit_mmu_context() when we re-target vcpu->arch.mmu pointer. The change itself looks logical: if nested_ept_init_mmu_context() changes something than nested_ept_uninit_mmu_context() restores it back. There is, however, one thing: the following call chain: nested_vmx_load_cr3() kvm_mmu_new_cr3() __kvm_mmu_new_cr3() fast_cr3_switch() cached_root_available() now happens with MMU hooks pointing to the new MMU (root MMU in our case) while previously it was happening with the old one. cached_root_available() tries to stash current root but it is incorrect to read current CR3 with mmu->get_cr3(), we need to use old_mmu->get_cr3() which in case we're switching from L2 to L1 is guest_mmu. (BTW, in shadow page tables case this is a non-issue because we don't switch MMU). While we could've tried to guess that we're switching between MMUs and call the right ->get_cr3() from cached_root_available() this seems to be overly complicated. Instead, just stash the corresponding CR3 when setting root_hpa and make cached_root_available() use the stashed value. Fixes: 14c07ad89f4d ("x86/kvm/mmu: introduce guest_mmu") Signed-off-by: Vitaly Kuznetsov Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini arch/x86/include/asm/kvm_host.h | 1 + arch/x86/kvm/mmu.c | 17 +++++++++++++---- 2 files changed, 14 insertions(+), 4 deletions(-) commit ede0fa98a900e657d1fcd80b50920efc896c1a4c Author: Eric Biggers Date: Fri Feb 22 15:36:18 2019 +0000 KEYS: always initialize keyring_index_key::desc_len syzbot hit the 'BUG_ON(index_key->desc_len == 0);' in __key_link_begin() called from construct_alloc_key() during sys_request_key(), because the length of the key description was never calculated. The problem is that we rely on ->desc_len being initialized by search_process_keyrings(), specifically by search_nested_keyrings(). But, if the process isn't subscribed to any keyrings that never happens. Fix it by always initializing keyring_index_key::desc_len as soon as the description is set, like we already do in some places. The following program reproduces the BUG_ON() when it's run as root and no session keyring has been installed. If it doesn't work, try removing pam_keyinit.so from /etc/pam.d/login and rebooting. #include #include #include int main(void) { int id = add_key("keyring", "syz", NULL, 0, KEY_SPEC_USER_KEYRING); keyctl_setperm(id, KEY_OTH_WRITE); setreuid(5000, 5000); request_key("user", "desc", "", id); } Reported-by: syzbot+ec24e95ea483de0a24da@syzkaller.appspotmail.com Fixes: b2a4df200d57 ("KEYS: Expand the capacity of a keyring") Signed-off-by: Eric Biggers Signed-off-by: David Howells Cc: stable@vger.kernel.org Signed-off-by: James Morris security/keys/keyring.c | 4 +--- security/keys/proc.c | 3 +-- security/keys/request_key.c | 1 + security/keys/request_key_auth.c | 2 +- 4 files changed, 4 insertions(+), 6 deletions(-) commit cc1780fc42c76c705dd07ea123f1143dc5057630 Author: Eric Biggers Date: Wed Feb 20 13:32:11 2019 +0000 KEYS: user: Align the payload buffer Align the payload of "user" and "logon" keys so that users of the keyrings service can access it as a struct that requires more than 2-byte alignment. fscrypt currently does this which results in the read of fscrypt_key::size being misaligned as it needs 4-byte alignment. Align to __alignof__(u64) rather than __alignof__(long) since in the future it's conceivable that people would use structs beginning with u64, which on some platforms would require more than 'long' alignment. Reported-by: Aaro Koskinen Fixes: 2aa349f6e37c ("[PATCH] Keys: Export user-defined keyring operations") Fixes: 88bd6ccdcdd6 ("ext4 crypto: add encryption key management facilities") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Tested-by: Aaro Koskinen Signed-off-by: David Howells Signed-off-by: James Morris include/keys/user-type.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a3504f7a38233030def726fcfe692e786ab162df Merge: 8a61716ff2ab 65a91e2e597d Author: Linus Torvalds Date: Fri Feb 22 09:20:49 2019 -0800 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "A few more fixes for clk drivers causing regressions this release. Two Allwinner index fixes for A31 and V3 and two Microchip AT91 fixes for an incorrect clk parent linkage and a miscalculated number of clks" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: at91: fix masterck name clk: at91: fix at91sam9x5 peripheral clock number clk: sunxi: A31: Fix wrong AHB gate number clk: sunxi-ng: v3s: Fix TCON reset de-assert bit commit 7c0cdf0b3940f63d9777c3fcf250a2f83859ca54 Author: Alban Crequy Date: Fri Feb 22 14:19:08 2019 +0100 bpf, lpm: fix lookup bug in map_delete_elem trie_delete_elem() was deleting an entry even though it was not matching if the prefixlen was correct. This patch adds a check on matchlen. Reproducer: $ sudo bpftool map create /sys/fs/bpf/mylpm type lpm_trie key 8 value 1 entries 128 name mylpm flags 1 $ sudo bpftool map update pinned /sys/fs/bpf/mylpm key hex 10 00 00 00 aa bb cc dd value hex 01 $ sudo bpftool map dump pinned /sys/fs/bpf/mylpm key: 10 00 00 00 aa bb cc dd value: 01 Found 1 element $ sudo bpftool map delete pinned /sys/fs/bpf/mylpm key hex 10 00 00 00 ff ff ff ff $ echo $? 0 $ sudo bpftool map dump pinned /sys/fs/bpf/mylpm Found 0 elements A similar reproducer is added in the selftests. Without the patch: $ sudo ./tools/testing/selftests/bpf/test_lpm_map test_lpm_map: test_lpm_map.c:485: test_lpm_delete: Assertion `bpf_map_delete_elem(map_fd, key) == -1 && errno == ENOENT' failed. Aborted With the patch: test_lpm_map runs without errors. Fixes: e454cf595853 ("bpf: Implement map_delete_elem for BPF_MAP_TYPE_LPM_TRIE") Cc: Craig Gallek Signed-off-by: Alban Crequy Acked-by: Craig Gallek Signed-off-by: Daniel Borkmann kernel/bpf/lpm_trie.c | 1 + tools/testing/selftests/bpf/test_lpm_map.c | 10 ++++++++++ 2 files changed, 11 insertions(+) commit 2f8b1ce19ebdaffa0f3f11d178b387b60e29c0fc Merge: 3858bfca2b78 bdd22a41d55b Author: Arnd Bergmann Date: Fri Feb 22 14:57:27 2019 +0100 Merge tag 'mvebu-fixes-5.0-2' of git://git.infradead.org/linux-mvebu into arm/fixes mvebu fixes for 5.0 (part 2) Fix PHY reset signal on clearfog gt 8K (Armada 8040 based) Fix NAND description on Armada XP boards which was broken since a few release * tag 'mvebu-fixes-5.0-2' of git://git.infradead.org/linux-mvebu: arm64: dts: clearfog-gt-8k: fix SGMII PHY reset signal ARM: dts: armada-xp: fix Armada XP boards NAND description Signed-off-by: Arnd Bergmann commit 3858bfca2b7811d97121910a87dc42f33498f2fe Merge: 94d9b9337d09 0661465ec86e Author: Arnd Bergmann Date: Fri Feb 22 14:53:48 2019 +0100 Merge tag 'omap-for-v5.0/fixes-rc7-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into arm/fixes Two am335x ethernet phy mode fixes for v5.0-rc cycle Recent changes with commit cd28d1d6e52e: ("net: phy: at803x: Disable phy delay for RGMII mode") broke Ethernet on am335x-evmsk, and turns out some device driver fixes are needed. Even without the driver fixes, am335x needs to run in rgmii-id mode instead rgmii-txid mode. Things have been working based on luck as the broken driver has been configuring rgmii-id mode. Let's fix that as that way things work as they're supposed to work from hardware wiring point of view. * tag 'omap-for-v5.0/fixes-rc7-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: ARM: dts: am335x-evm: Fix PHY mode for ethernet ARM: dts: am335x-evmsk: Fix PHY mode for ethernet Signed-off-by: Arnd Bergmann commit 51d0af222f6fa43134c6187ab4f374630f6e0d96 Author: Felix Fietkau Date: Fri Feb 22 13:21:15 2019 +0100 mac80211: allocate tailroom for forwarded mesh packets Forwarded packets enter the tx path through ieee80211_add_pending_skb, which skips the ieee80211_skb_resize call. Fixes WARN_ON in ccmp_encrypt_skb and resulting packet loss. Cc: stable@vger.kernel.org Signed-off-by: Felix Fietkau Signed-off-by: Johannes Berg net/mac80211/rx.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 5c14a4d05f68415af9e41a4e667d1748d41d1baf Author: Toke Høiland-Jørgensen Date: Thu Feb 21 18:29:36 2019 +0100 mac80211: Change default tx_sk_pacing_shift to 7 When we did the original tests for the optimal value of sk_pacing_shift, we came up with 6 ms of buffering as the default. Sadly, 6 is not a power of two, so when picking the shift value I erred on the size of less buffering and picked 4 ms instead of 8. This was probably wrong; those 2 ms of extra buffering makes a larger difference than I thought. So, change the default pacing shift to 7, which corresponds to 8 ms of buffering. The point of diminishing returns really kicks in after 8 ms, and so having this as a default should cut down on the need for extensive per-device testing and overrides needed in the drivers. Cc: stable@vger.kernel.org Signed-off-by: Toke Høiland-Jørgensen Signed-off-by: Johannes Berg net/mac80211/main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 17407715240456448e4989bee46ffc93991add83 Author: Li RongQing Date: Tue Feb 19 13:12:40 2019 +0800 mac80211_hwsim: propagate genlmsg_reply return code genlmsg_reply can fail, so propagate its return code Signed-off-by: Li RongQing Signed-off-by: Johannes Berg drivers/net/wireless/mac80211_hwsim.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5b317cbf2bcb85a1e96ce87717cb991ecab1dd4d Merge: 74fb44863084 8cbd468bdeb5 Author: Rafael J. Wysocki Date: Fri Feb 22 10:17:11 2019 +0100 Merge branch 'pm-cpufreq-fixes' * pm-cpufreq-fixes: cpufreq: scmi: Fix use-after-free in scmi_cpufreq_exit() commit 6321aa197547da397753757bd84c6ce64b3e3d89 Author: Arnd Bergmann Date: Tue Feb 19 22:53:50 2019 +0100 phonet: fix building with clang clang warns about overflowing the data[] member in the struct pnpipehdr: net/phonet/pep.c:295:8: warning: array index 4 is past the end of the array (which contains 1 element) [-Warray-bounds] if (hdr->data[4] == PEP_IND_READY) ^ ~ include/net/phonet/pep.h:66:3: note: array 'data' declared here u8 data[1]; Using a flexible array member at the end of the struct avoids the warning, but since we cannot have a flexible array member inside of the union, each index now has to be moved back by one, which makes it a little uglier. Signed-off-by: Arnd Bergmann Acked-by: Rémi Denis-Courmont Signed-off-by: David S. Miller include/net/phonet/pep.h | 5 +++-- net/phonet/pep.c | 32 ++++++++++++++++---------------- 2 files changed, 19 insertions(+), 18 deletions(-) commit b35560e485cb3a10bfe631732bcb75fe1a568da7 Merge: 31088cb5ca6e 660899ddf06a Author: David S. Miller Date: Thu Feb 21 16:08:52 2019 -0800 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2019-02-21 1) Don't do TX bytes accounting for the esp trailer when sending from a request socket as this will result in an out of bounds memory write. From Martin Willi. 2) Destroy xfrm_state synchronously on net exit path to avoid nested gc flush callbacks that may trigger a warning in xfrm6_tunnel_net_exit(). From Cong Wang. 3) Do an unconditionally clone in pfkey_broadcast_one() to avoid a race when freeing the skb. From Sean Tranchetti. 4) Fix inbound traffic via XFRM interfaces across network namespaces. We did the lookup for interfaces and policies in the wrong namespace. From Tobias Brunner. Please pull or let me know if there are problems. ==================== Signed-off-by: David S. Miller commit 31088cb5ca6e4b8fda36f8686d15f037bd039f2a Merge: 9e8db5913264 103d0244d29f Author: David S. Miller Date: Thu Feb 21 16:02:10 2019 -0800 Merge branch 'report-erspan-version-field-just-for-erspan-tunnels' Lorenzo Bianconi says: ==================== report erspan version field just for erspan tunnels Do not report erspan_version to userpsace for non erspan tunnels. Report IFLA_GRE_ERSPAN_INDEX only for erspan version 1 in ip6gre_fill_info ==================== Signed-off-by: David S. Miller commit 103d0244d29fcaf38f1339d4538919bbbc051490 Author: Lorenzo Bianconi Date: Tue Feb 19 17:42:06 2019 +0100 net: ip6_gre: do not report erspan_ver for ip6gre or ip6gretap Report erspan version field to userspace in ip6gre_fill_info just for erspan_v6 tunnels. Moreover report IFLA_GRE_ERSPAN_INDEX only for erspan version 1. The issue can be triggered with the following reproducer: $ip link add name gre6 type ip6gre local 2001::1 remote 2002::2 $ip link set gre6 up $ip -d link sh gre6 14: grep6@NONE: mtu 1448 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000 link/gre6 2001::1 peer 2002::2 promiscuity 0 minmtu 0 maxmtu 0 ip6gre remote 2002::2 local 2001::1 hoplimit 64 encaplimit 4 tclass 0x00 flowlabel 0x00000 erspan_index 0 erspan_ver 0 addrgenmode eui64 Fixes: 94d7d8f29287 ("ip6_gre: add erspan v2 support") Signed-off-by: Lorenzo Bianconi Signed-off-by: David S. Miller net/ipv6/ip6_gre.c | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) commit 2bdf700e538828d6456150b9319e5f689b062d54 Author: Lorenzo Bianconi Date: Tue Feb 19 17:42:05 2019 +0100 net: ip_gre: do not report erspan_ver for gre or gretap Report erspan version field to userspace in ipgre_fill_info just for erspan tunnels. The issue can be triggered with the following reproducer: $ip link add name gre1 type gre local 192.168.0.1 remote 192.168.1.1 $ip link set dev gre1 up $ip -d link sh gre1 13: gre1@NONE: mtu 1476 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000 link/gre 192.168.0.1 peer 192.168.1.1 promiscuity 0 minmtu 0 maxmtu 0 gre remote 192.168.1.1 local 192.168.0.1 ttl inherit erspan_ver 0 addrgenmode eui64 numtxqueues 1 numrxqueues 1 Fixes: f551c91de262 ("net: erspan: introduce erspan v2 for ip_gre") Signed-off-by: Lorenzo Bianconi Signed-off-by: David S. Miller net/ipv4/ip_gre.c | 33 +++++++++++++++++---------------- 1 file changed, 17 insertions(+), 16 deletions(-) commit 019276ed65f364de27b929da4e083bb86ce7d1ef Merge: 9c526fed6a57 a213c2c7e235 Author: Dave Airlie Date: Thu Feb 21 12:52:38 2019 +1000 Merge branch 'drm-fixes-5.0' of git://people.freedesktop.org/~agd5f/linux into drm-fixes A bit bigger than normal for this week due to fixes for some long standing display issues that are bound for stable. These changes would be going to stable anyway, so I figured it was better via 5.0 than 5.1. - Several display fixes - Fix PX systems due to core changes in runtime pm - Disable bulk moves. They are fixed in 5.1, but fix is too invasive for 5.0 Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20190220225715.3240-1-alexander.deucher@amd.com commit 7b2e932f633bcb7b190fc7031ce6dac75f8c3472 Author: Vineet Gupta Date: Thu Feb 21 13:44:49 2019 -0800 ARCv2: don't assume core 0x54 has dual issue The first release of core4 (0x54) was dual issue only (HS4x). Newer releases allow hardware to be configured as single issue (HS3x) or dual issue. Prevent accessing a HS4x only aux register in HS3x, which otherwise leads to illegal instruction exceptions Signed-off-by: Vineet Gupta arch/arc/include/asm/arcregs.h | 8 ++++++++ arch/arc/kernel/setup.c | 26 +++++++++++++++++++++----- 2 files changed, 29 insertions(+), 5 deletions(-) commit 9e8db5913264d3967b93c765a6a9e464d9c473db Author: Willem de Bruijn Date: Mon Feb 18 23:37:12 2019 -0500 net: avoid false positives in untrusted gso validation GSO packets with vnet_hdr must conform to a small set of gso_types. The below commit uses flow dissection to drop packets that do not. But it has false positives when the skb is not fully initialized. Dissection needs skb->protocol and skb->network_header. Infer skb->protocol from gso_type as the two must agree. SKB_GSO_UDP can use both ipv4 and ipv6, so try both. Exclude callers for which network header offset is not known. Fixes: d5be7f632bad ("net: validate untrusted gso packets without csum offload") Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller include/linux/virtio_net.h | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) commit 06cd1702eeb0a79de03f3088ccf4c65f6dfeeaf5 Merge: 3c963a3306ea 48766a583c79 Author: David S. Miller Date: Thu Feb 21 13:58:05 2019 -0800 Merge branch 'tipc-improvement-for-wait-and-wakeup' Tung Nguyen says: ==================== tipc: improvement for wait and wakeup Some improvements for tipc_wait_for_xzy(). ==================== Signed-off-by: David S. Miller commit 48766a583c7961af080de2df692f476624a9a21a Author: Tung Nguyen Date: Tue Feb 19 11:20:48 2019 +0700 tipc: improve function tipc_wait_for_rcvmsg() This commit replaces schedule_timeout() with wait_woken() in function tipc_wait_for_rcvmsg(). wait_woken() uses memory barriers in its implementation to avoid potential race condition when putting a process into sleeping state and then waking it up. Acked-by: Ying Xue Acked-by: Jon Maloy Signed-off-by: Tung Nguyen Signed-off-by: David S. Miller net/tipc/socket.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 223b7329ec6a0dae1b7f7db7b770e93f4a069ef9 Author: Tung Nguyen Date: Tue Feb 19 11:20:47 2019 +0700 tipc: improve function tipc_wait_for_cond() Commit 844cf763fba6 ("tipc: make macro tipc_wait_for_cond() smp safe") replaced finish_wait() with remove_wait_queue() but still used prepare_to_wait(). This causes unnecessary conditional checking before adding to wait queue in prepare_to_wait(). This commit replaces prepare_to_wait() with add_wait_queue() as the pair function with remove_wait_queue(). Acked-by: Ying Xue Acked-by: Jon Maloy Signed-off-by: Tung Nguyen Signed-off-by: David S. Miller net/tipc/socket.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3c963a3306eada999be5ebf4f293dfa3d3945487 Author: Michal Soltys Date: Mon Feb 18 17:55:28 2019 +0100 bonding: fix PACKET_ORIGDEV regression This patch fixes a subtle PACKET_ORIGDEV regression which was a side effect of fixes introduced by: 6a9e461f6fe4 bonding: pass link-local packets to bonding master also. ... to: b89f04c61efe bonding: deliver link-local packets with skb->dev set to link that packets arrived on While 6a9e461f6fe4 restored pre-b89f04c61efe presence of link-local packets on bonding masters (which is required e.g. by linux bridges participating in spanning tree or needed for lab-like setups created with group_fwd_mask) it also caused the originating device information to be lost due to cloning. Maciej Żenczykowski proposed another solution that doesn't require packet cloning and retains original device information - instead of returning RX_HANDLER_PASS for all link-local packets it's now limited only to packets from inactive slaves. At the same time, packets passed to bonding masters retain correct information about the originating device and PACKET_ORIGDEV can be used to determine it. This elegantly solves all issues so far: - link-local packets that were removed from bonding masters - LLDP daemons being forced to explicitly bind to slave interfaces - PACKET_ORIGDEV having no effect on bond interfaces Fixes: 6a9e461f6fe4 (bonding: pass link-local packets to bonding master also.) Reported-by: Vincent Bernat Signed-off-by: Michal Soltys Signed-off-by: Maciej Żenczykowski Signed-off-by: David S. Miller drivers/net/bonding/bond_main.c | 35 ++++++++++++++--------------------- 1 file changed, 14 insertions(+), 21 deletions(-) commit ad49bc6361ca29e3318b6f71a6fc361d2a8c9f26 Author: Hangbin Liu Date: Mon Feb 18 17:14:25 2019 +0800 net: vrf: remove MTU limits for vrf device Similiar to commit e94cd8113ce63 ("net: remove MTU limits for dummy and ifb device"), MTU is irrelevant for VRF device. We init it as 64K while limit it to [68, 1500] may make users feel confused. Reported-by: Jianlin Shi Signed-off-by: Hangbin Liu Reviewed-by: David Ahern Signed-off-by: David S. Miller drivers/net/vrf.c | 3 +++ 1 file changed, 3 insertions(+) commit 18de100ed6f0d3bf74036de9fd4528f208d585e6 Author: Jann Horn Date: Thu Feb 21 20:58:16 2019 +0100 MAINTAINERS: mark CAIF as orphan The listed address for the CAIF maintainer bounces with "553 5.3.0 ... No such user here", and the only existing email address of the maintainer in git history hasn't responded in a week. Therefore, remove the listed maintainer and mark CAIF as orphan. Signed-off-by: Jann Horn Signed-off-by: David S. Miller MAINTAINERS | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 033575ecfc695e353ebad136acf64e1beda4fa5f Merge: d7cf4a3bf3a8 c685c69fba71 Author: David S. Miller Date: Thu Feb 21 12:21:37 2019 -0800 Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-queue Jeff Kirsher says: ==================== Intel Wired LAN Driver Fixes 2019-02-21 This series contains fixes to ixgbe and i40e. Majority of the fixes are to resolve XDP issues found in both drivers, there is only one fix which is not XDP related. That one fix resolves an issue seen on older 10GbE devices, where UDP traffic was either being dropped or being transmitted out of order when the bit to enable L3/L4 filtering for transmit switched packets is enabled on older devices that did not support this option. Magnus fixes an XDP issue for both ixgbe and i40e, where receive rings are created but no buffers are allocated for AF_XDP in zero-copy mode, so no packets can be received and no interrupts will be generated so that NAPI poll function that allocates buffers to the rings will never get executed. Björn fixes a race in XDP xmit ring cleanup for i40e, where ndo_xdp_xmit() must be taken into consideration. Added a synchronize_rcu() to wait for napi(s) before clearing the queue. Jan fixes a ixgbe AF_XDP zero-copy transmit issue which can cause a reset to be triggered, so add a check to ensure that netif carrier is 'ok' before trying to transmit packets. ==================== Signed-off-by: David S. Miller commit 71d73a0b43c2b101a960c624290c8a053d174cac Author: Helge Deller Date: Thu Feb 21 20:16:10 2019 +0100 CREDITS/MAINTAINERS: Retire parisc-linux.org email domain Retire the parisc-linux.org email domain and provide alternative email addresses for the remaining users, as agreed upon with them. Signed-off-by: Helge Deller CREDITS | 20 +++++++++----------- MAINTAINERS | 5 ++--- 2 files changed, 11 insertions(+), 14 deletions(-) commit c685c69fba71462c3f9f6a1fb6151cded6c74d42 Author: Jan Sokolowski Date: Wed Feb 20 15:20:14 2019 +0000 ixgbe: don't do any AF_XDP zero-copy transmit if netif is not OK An issue has been found while testing zero-copy XDP that causes a reset to be triggered. As it takes some time to turn the carrier on after setting zc, and we already start trying to transmit some packets, watchdog considers this as an erroneous state and triggers a reset. Don't do any work if netif carrier is not OK. Fixes: 8221c5eba8c13 (ixgbe: add AF_XDP zero-copy Tx support) Signed-off-by: Jan Sokolowski Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit b7dc5a071ddf69c0350396b203cba32fe5bab510 Author: Dmitry V. Levin Date: Sat Feb 16 16:10:39 2019 +0300 parisc: Fix ptrace syscall number modification Commit 910cd32e552e ("parisc: Fix and enable seccomp filter support") introduced a regression in ptrace-based syscall tampering: when tracer changes syscall number to -1, the kernel fails to initialize %r28 with -ENOSYS and subsequently fails to return the error code of the failed syscall to userspace. This erroneous behaviour could be observed with a simple strace syscall fault injection command which is expected to print something like this: $ strace -a0 -ewrite -einject=write:error=enospc echo hello write(1, "hello\n", 6) = -1 ENOSPC (No space left on device) (INJECTED) write(2, "echo: ", 6) = -1 ENOSPC (No space left on device) (INJECTED) write(2, "write error", 11) = -1 ENOSPC (No space left on device) (INJECTED) write(2, "\n", 1) = -1 ENOSPC (No space left on device) (INJECTED) +++ exited with 1 +++ After commit 910cd32e552ea09caa89cdbe328e468979b030dd it loops printing something like this instead: write(1, "hello\n", 6../strace: Failed to tamper with process 12345: unexpectedly got no error (return value 0, error 0) ) = 0 (INJECTED) This bug was found by strace test suite. Fixes: 910cd32e552e ("parisc: Fix and enable seccomp filter support") Cc: stable@vger.kernel.org # v4.5+ Signed-off-by: Dmitry V. Levin Tested-by: Helge Deller Signed-off-by: Helge Deller arch/parisc/kernel/ptrace.c | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-) commit 59eb2a884f5380011179acc4662fc2cc2d850454 Author: Björn Töpel Date: Thu Feb 14 14:03:02 2019 +0100 i40e: fix XDP_REDIRECT/XDP xmit ring cleanup race When the driver clears the XDP xmit ring due to re-configuration or teardown, in-progress ndo_xdp_xmit must be taken into consideration. The ndo_xdp_xmit function is typically called from a NAPI context that the driver does not control. Therefore, we must be careful not to clear the XDP ring, while the call is on-going. This patch adds a synchronize_rcu() to wait for napi(s) (preempt-disable regions and softirqs), prior clearing the queue. Further, the __I40E_CONFIG_BUSY flag is checked in the ndo_xdp_xmit implementation to avoid touching the XDP xmit queue during re-configuration. Fixes: d9314c474d4f ("i40e: add support for XDP_REDIRECT") Fixes: 123cecd427b6 ("i40e: added queue pair disable/enable functions") Reported-by: Maciej Fijalkowski Signed-off-by: Björn Töpel Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/i40e/i40e_main.c | 14 ++++++++++++-- drivers/net/ethernet/intel/i40e/i40e_txrx.c | 4 +++- 2 files changed, 15 insertions(+), 3 deletions(-) commit b6835ea77729e7faf4656ca637ba53f42b8ee3fd Author: Alexey Brodkin Date: Fri Feb 8 13:55:19 2019 +0300 ARC: define ARCH_SLAB_MINALIGN = 8 The default value of ARCH_SLAB_MINALIGN in "include/linux/slab.h" is "__alignof__(unsigned long long)" which for ARC unexpectedly turns out to be 4. This is not a compiler bug, but as defined by ARC ABI [1] Thus slab allocator would allocate a struct which is 32-bit aligned, which is generally OK even if struct has long long members. There was however potetial problem when it had any atomic64_t which use LLOCKD/SCONDD instructions which are required by ISA to take 64-bit addresses. This is the problem we ran into [ 4.015732] EXT4-fs (mmcblk0p2): re-mounted. Opts: (null) [ 4.167881] Misaligned Access [ 4.172356] Path: /bin/busybox.nosuid [ 4.176004] CPU: 2 PID: 171 Comm: rm Not tainted 4.19.14-yocto-standard #1 [ 4.182851] [ 4.182851] [ECR ]: 0x000d0000 => Check Programmer's Manual [ 4.190061] [EFA ]: 0xbeaec3fc [ 4.190061] [BLINK ]: ext4_delete_entry+0x210/0x234 [ 4.190061] [ERET ]: ext4_delete_entry+0x13e/0x234 [ 4.202985] [STAT32]: 0x80080002 : IE K [ 4.207236] BTA: 0x9009329c SP: 0xbe5b1ec4 FP: 0x00000000 [ 4.212790] LPS: 0x9074b118 LPE: 0x9074b120 LPC: 0x00000000 [ 4.218348] r00: 0x00000040 r01: 0x00000021 r02: 0x00000001 ... ... [ 4.270510] Stack Trace: [ 4.274510] ext4_delete_entry+0x13e/0x234 [ 4.278695] ext4_rmdir+0xe0/0x238 [ 4.282187] vfs_rmdir+0x50/0xf0 [ 4.285492] do_rmdir+0x9e/0x154 [ 4.288802] EV_Trap+0x110/0x114 The fix is to make sure slab allocations are 64-bit aligned. Do note that atomic64_t is __attribute__((aligned(8)) which means gcc does generate 64-bit aligned references, relative to beginning of container struct. However the issue is if the container itself is not 64-bit aligned, atomic64_t ends up unaligned which is what this patch ensures. [1] https://github.com/foss-for-synopsys-dwc-arc-processors/toolchain/wiki/files/ARCv2_ABI.pdf Signed-off-by: Alexey Brodkin Cc: # 4.8+ Signed-off-by: Vineet Gupta [vgupta: reworked changelog, added dependency on LL64+LLSC] arch/arc/include/asm/cache.h | 11 +++++++++++ 1 file changed, 11 insertions(+) commit 493a2f812446e92bcb1e69a77381b4d39808d730 Author: Eugeniy Paltsev Date: Thu Feb 14 18:07:45 2019 +0300 ARC: enable uboot support unconditionally After reworking U-boot args handling code and adding paranoid arguments check we can eliminate CONFIG_ARC_UBOOT_SUPPORT and enable uboot support unconditionally. For JTAG case we can assume that core registers will come up reset value of 0 or in worst case we rely on user passing '-on=clear_regs' to Metaware debugger. Cc: stable@vger.kernel.org Tested-by: Corentin LABBE Signed-off-by: Eugeniy Paltsev Signed-off-by: Vineet Gupta arch/arc/Kconfig | 12 ------------ arch/arc/configs/nps_defconfig | 1 - arch/arc/configs/vdk_hs38_defconfig | 1 - arch/arc/configs/vdk_hs38_smp_defconfig | 2 -- arch/arc/kernel/head.S | 2 -- arch/arc/kernel/setup.c | 2 -- 6 files changed, 20 deletions(-) commit a66f2e57bd566240d8b3884eedf503928fbbe557 Author: Eugeniy Paltsev Date: Thu Feb 14 18:07:44 2019 +0300 ARC: U-boot: check arguments paranoidly Handle U-boot arguments paranoidly: * don't allow to pass unknown tag. * try to use external device tree blob only if corresponding tag (TAG_DTB) is set. * don't check uboot_tag if kernel build with no ARC_UBOOT_SUPPORT. NOTE: If U-boot args are invalid we skip them and try to use embedded device tree blob. We can't panic on invalid U-boot args as we really pass invalid args due to bug in U-boot code. This happens if we don't provide external DTB to U-boot and don't set 'bootargs' U-boot environment variable (which is default case at least for HSDK board) In that case we will pass {r0 = 1 (bootargs in r2); r1 = 0; r2 = 0;} to linux which is invalid. While I'm at it refactor U-boot arguments handling code. Cc: stable@vger.kernel.org Tested-by: Corentin LABBE Signed-off-by: Eugeniy Paltsev Signed-off-by: Vineet Gupta arch/arc/kernel/head.S | 4 +-- arch/arc/kernel/setup.c | 87 +++++++++++++++++++++++++++++++++++-------------- 2 files changed, 64 insertions(+), 27 deletions(-) commit e494239a007e601448110ac304fe055951f9de3b Author: Vineet Gupta Date: Wed Jun 6 10:20:37 2018 -0700 ARCv2: support manual regfile save on interrupts There's a hardware bug which affects the HSDK platform, triggered by micro-ops for auto-saving regfile on taken interrupt. The workaround is to inhibit autosave. Signed-off-by: Vineet Gupta arch/arc/Kconfig | 8 ++++++ arch/arc/include/asm/entry-arcv2.h | 54 ++++++++++++++++++++++++++++++++++++++ arch/arc/kernel/entry-arcv2.S | 4 ++- arch/arc/kernel/intc-arcv2.c | 2 ++ arch/arc/plat-hsdk/Kconfig | 1 + 5 files changed, 68 insertions(+), 1 deletion(-) commit d5e3c55e01d8b1774b37b4647c30fb22f1d39077 Author: Vineet Gupta Date: Tue Feb 5 10:07:07 2019 -0800 ARC: uacces: remove lp_start, lp_end from clobber list Newer ARC gcc handles lp_start, lp_end in a different way and doesn't like them in the clobber list. Signed-off-by: Vineet Gupta arch/arc/include/asm/uaccess.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit cdf92962adb0cb23efc3c8bcf6465d16ab7c3a81 Author: Eugeniy Paltsev Date: Mon Feb 4 21:41:51 2019 +0300 ARC: fix actionpoints configuration detection Fix reversed logic while actionpoints configuration (full/min) detection. Fixies: 7dd380c338f1e ("ARC: boot log: print Action point details") Signed-off-by: Eugeniy Paltsev Signed-off-by: Vineet Gupta arch/arc/kernel/setup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f8a15f97664178f27dfbf86a38f780a532cb6df0 Author: Eugeniy Paltsev Date: Wed Jan 30 19:32:40 2019 +0300 ARCv2: lib: memcpy: fix doing prefetchw outside of buffer ARCv2 optimized memcpy uses PREFETCHW instruction for prefetching the next cache line but doesn't ensure that the line is not past the end of the buffer. PRETECHW changes the line ownership and marks it dirty, which can cause data corruption if this area is used for DMA IO. Fix the issue by avoiding the PREFETCHW. This leads to performance degradation but it is OK as we'll introduce new memcpy implementation optimized for unaligned memory access using. We also cut off all PREFETCH instructions at they are quite useless here: * we call PREFETCH right before LOAD instruction call. * we copy 16 or 32 bytes of data (depending on CONFIG_ARC_HAS_LL64) in a main logical loop. so we call PREFETCH 4 times (or 2 times) for each L1 cache line (in case of 64B L1 cache Line which is default case). Obviously this is not optimal. Signed-off-by: Eugeniy Paltsev Signed-off-by: Vineet Gupta arch/arc/lib/memcpy-archs.S | 14 -------------- 1 file changed, 14 deletions(-) commit 252f6e8eae909bc075a1b1e3b9efb095ae4c0b56 Author: Eugeniy Paltsev Date: Wed Jan 16 14:29:50 2019 +0300 ARCv2: Enable unaligned access in early ASM code It is currently done in arc_init_IRQ() which might be too late considering gcc 7.3.1 onwards (GNU 2018.03) generates unaligned memory accesses by default Cc: stable@vger.kernel.org #4.4+ Signed-off-by: Eugeniy Paltsev Signed-off-by: Vineet Gupta [vgupta: rewrote changelog] arch/arc/kernel/head.S | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 4a9b32f30f805ca596d76605903a48eab58e0b88 Author: Magnus Karlsson Date: Tue Jan 29 15:03:50 2019 +0100 ixgbe: fix potential RX buffer starvation for AF_XDP When the RX rings are created they are also populated with buffers so that packets can be received. Usually these are kernel buffers, but for AF_XDP in zero-copy mode, these are user-space buffers and in this case the application might not have sent down any buffers to the driver at this point. And if no buffers are allocated at ring creation time, no packets can be received and no interrupts will be generated so the NAPI poll function that allocates buffers to the rings will never get executed. To rectify this, we kick the NAPI context of any queue with an attached AF_XDP zero-copy socket in two places in the code. Once after an XDP program has loaded and once after the umem is registered. This take care of both cases: XDP program gets loaded first then AF_XDP socket is created, and the reverse, AF_XDP socket is created first, then XDP program is loaded. Fixes: d0bcacd0a130 ("ixgbe: add AF_XDP zero-copy Rx support") Signed-off-by: Magnus Karlsson Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 12 +++++++++++- drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c | 12 ++++++++++-- 2 files changed, 21 insertions(+), 3 deletions(-) commit 14ffeb52f3693ae0b674e59453452a2365ae9fd9 Author: Magnus Karlsson Date: Tue Jan 29 15:03:17 2019 +0100 i40e: fix potential RX buffer starvation for AF_XDP When the RX rings are created they are also populated with buffers so that packets can be received. Usually these are kernel buffers, but for AF_XDP in zero-copy mode, these are user-space buffers and in this case the application might not have sent down any buffers to the driver at this point. And if no buffers are allocated at ring creation time, no packets can be received and no interrupts will be generated so the NAPI poll function that allocates buffers to the rings will never get executed. To rectify this, we kick the NAPI context of any queue with an attached AF_XDP zero-copy socket in two places in the code. Once after an XDP program has loaded and once after the umem is registered. This take care of both cases: XDP program gets loaded first then AF_XDP socket is created, and the reverse, AF_XDP socket is created first, then XDP program is loaded. Fixes: 0a714186d3c0 ("i40e: add AF_XDP zero-copy Rx support") Signed-off-by: Magnus Karlsson Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/i40e/i40e_main.c | 13 ++++++++++++- drivers/net/ethernet/intel/i40e/i40e_xsk.c | 5 +++++ 2 files changed, 17 insertions(+), 1 deletion(-) commit 156a67a9065e3339be85f811d1b13b920e50d73b Author: Jeff Kirsher Date: Mon Jan 28 09:45:01 2019 -0800 ixgbe: fix older devices that do not support IXGBE_MRQC_L3L4TXSWEN The enabling L3/L4 filtering for transmit switched packets for all devices caused unforeseen issue on older devices when trying to send UDP traffic in an ordered sequence. This bit was originally intended for X550 devices, which supported this feature, so limit the scope of this bit to only X550 devices. Signed-off-by: Jeff Kirsher Tested-by: Andrew Bowers drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit d7cf4a3bf3a83c977a29055e1c4ffada7697b31f Author: Ursula Braun Date: Thu Feb 21 12:56:54 2019 +0100 net/smc: fix smc_poll in SMC_INIT state smc_poll() returns with mask bit EPOLLPRI if the connection urg_state is SMC_URG_VALID. Since SMC_URG_VALID is zero, smc_poll signals EPOLLPRI errorneously if called in state SMC_INIT before the connection is created, for instance in a non-blocking connect scenario. This patch switches to non-zero values for the urg states. Reviewed-by: Karsten Graul Fixes: de8474eb9d50 ("net/smc: urgent data support") Signed-off-by: Ursula Braun Signed-off-by: David S. Miller net/smc/smc.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 64cc41e62a316b059b4f8eedc6bd5e35315c35f9 Merge: ae3b564179bf bf1dc8bad1d4 Author: David S. Miller Date: Thu Feb 21 09:54:35 2019 -0800 Merge branch 'ipv6-route-rcu' Paolo Abeni says: ==================== ipv6: route: enforce RCU protection for fib6_info->from This series addresses a couple of RCU left-over dating back to rt6_info->from conversion to RCU v1 -> v2: - fix a possible race in patch 1 ==================== Signed-off-by: David S. Miller commit bf1dc8bad1d42287164d216d8efb51c5cd381b18 Author: Paolo Abeni Date: Thu Feb 21 11:19:42 2019 +0100 ipv6: route: enforce RCU protection in ip6_route_check_nh_onlink() We need a RCU critical section around rt6_info->from deference, and proper annotation. Fixes: 4ed591c8ab44 ("net/ipv6: Allow onlink routes to have a device mismatch if it is the default route") Signed-off-by: Paolo Abeni Reviewed-by: David Ahern Signed-off-by: David S. Miller net/ipv6/route.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 193f3685d0546b0cea20c99894aadb70098e47bf Author: Paolo Abeni Date: Thu Feb 21 11:19:41 2019 +0100 ipv6: route: enforce RCU protection in rt6_update_exception_stamp_rt() We must access rt6_info->from under RCU read lock: move the dereference under such lock, with proper annotation. v1 -> v2: - avoid using multiple, racy, fetch operations for rt->from Fixes: a68886a69180 ("net/ipv6: Make from in rt6_info rcu protected") Signed-off-by: Paolo Abeni Reviewed-by: David Ahern Signed-off-by: David S. Miller net/ipv6/route.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) commit 8a61716ff2ab23eddd1f7a05a075a374e4d0c3d4 Merge: d6622d913a63 04242ff3ac0a Author: Linus Torvalds Date: Thu Feb 21 09:43:37 2019 -0800 Merge tag 'ceph-for-5.0-rc8' of git://github.com/ceph/ceph-client Pull ceph fixes from Ilya Dryomov: "Two bug fixes for old issues, both marked for stable" * tag 'ceph-for-5.0-rc8' of git://github.com/ceph/ceph-client: ceph: avoid repeatedly adding inode to mdsc->snap_flush_list libceph: handle an empty authorize reply commit d6622d913a637bce224f74425a9dfe734f946358 Merge: 7c90325390c9 74698f6971f2 Author: Linus Torvalds Date: Thu Feb 21 09:11:36 2019 -0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull late arm64 fixes from Will Deacon: "Three small arm64 fixes for 5.0. They fix a build breakage with clang introduced in 4.20, an oversight in our sigframe restoration relating to the SSBS bit and a boot fix for systems with newer revisions of our interrupt controller. Summary: - Fix handling of PSTATE.SSBS bit in sigreturn() - Fix version checking of the GIC during early boot - Fix clang builds failing due to use of NEON in the crypto code" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: Relax GIC version check during early boot arm64/neon: Disable -Wincompatible-pointer-types when building with Clang arm64: fix SSBS sanitization commit 7c90325390c9220afdee54e13424d2fb709f120a Merge: f6163d67cc31 891cb2a72d82 Author: Linus Torvalds Date: Thu Feb 21 09:05:04 2019 -0800 Merge branch 'akpm' (patches from Andrew) Merge misc fixes from Andrew Morton: "23 fixes" * emailed patches from Andrew Morton : (23 commits) mm, memory_hotplug: fix off-by-one in is_pageblock_removable mm: don't let userspace spam allocations warnings slub: fix a crash with SLUB_DEBUG + KASAN_SW_TAGS kasan, slab: remove redundant kasan_slab_alloc hooks kasan, slab: make freelist stored without tags kasan, slab: fix conflicts with CONFIG_HARDENED_USERCOPY kasan: prevent tracing of tags.c kasan: fix random seed generation for tag-based mode tmpfs: fix link accounting when a tmpfile is linked in psi: avoid divide-by-zero crash inside virtual machines mm: handle lru_add_drain_all for UP properly mm, page_alloc: fix a division by zero error when boosting watermarks v2 mm/debug.c: fix __dump_page() for poisoned pages proc, oom: do not report alien mms when setting oom_score_adj slub: fix SLAB_CONSISTENCY_CHECKS + KASAN_SW_TAGS kasan, slub: fix more conflicts with CONFIG_SLAB_FREELIST_HARDENED kasan, slub: fix conflicts with CONFIG_SLAB_FREELIST_HARDENED kasan, slub: move kasan_poison_slab hook before page_address kmemleak: account for tagged pointers when calculating pointer range kasan, kmemleak: pass tagged pointers to kmemleak ... commit 891cb2a72d821f930a39d5900cb7a3aa752c1d5b Author: Michal Hocko Date: Wed Feb 20 22:20:46 2019 -0800 mm, memory_hotplug: fix off-by-one in is_pageblock_removable Rong Chen has reported the following boot crash: PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 239 Comm: udevd Not tainted 5.0.0-rc4-00149-gefad4e4 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 RIP: 0010:page_mapping+0x12/0x80 Code: 5d c3 48 89 df e8 0e ad 02 00 85 c0 75 da 89 e8 5b 5d c3 0f 1f 44 00 00 53 48 89 fb 48 8b 43 08 48 8d 50 ff a8 01 48 0f 45 da <48> 8b 53 08 48 8d 42 ff 83 e2 01 48 0f 44 c3 48 83 38 ff 74 2f 48 RSP: 0018:ffff88801fa87cd8 EFLAGS: 00010202 RAX: ffffffffffffffff RBX: fffffffffffffffe RCX: 000000000000000a RDX: fffffffffffffffe RSI: ffffffff820b9a20 RDI: ffff88801e5c0000 RBP: 6db6db6db6db6db7 R08: ffff88801e8bb000 R09: 0000000001b64d13 R10: ffff88801fa87cf8 R11: 0000000000000001 R12: ffff88801e640000 R13: ffffffff820b9a20 R14: ffff88801f145258 R15: 0000000000000001 FS: 00007fb2079817c0(0000) GS:ffff88801dd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000006 CR3: 000000001fa82000 CR4: 00000000000006a0 Call Trace: __dump_page+0x14/0x2c0 is_mem_section_removable+0x24c/0x2c0 removable_show+0x87/0xa0 dev_attr_show+0x25/0x60 sysfs_kf_seq_show+0xba/0x110 seq_read+0x196/0x3f0 __vfs_read+0x34/0x180 vfs_read+0xa0/0x150 ksys_read+0x44/0xb0 do_syscall_64+0x5e/0x4a0 entry_SYSCALL_64_after_hwframe+0x49/0xbe and bisected it down to commit efad4e475c31 ("mm, memory_hotplug: is_mem_section_removable do not pass the end of a zone"). The reason for the crash is that the mapping is garbage for poisoned (uninitialized) page. This shouldn't happen as all pages in the zone's boundary should be initialized. Later debugging revealed that the actual problem is an off-by-one when evaluating the end_page. 'start_pfn + nr_pages' resp 'zone_end_pfn' refers to a pfn after the range and as such it might belong to a differen memory section. This along with CONFIG_SPARSEMEM then makes the loop condition completely bogus because a pointer arithmetic doesn't work for pages from two different sections in that memory model. Fix the issue by reworking is_pageblock_removable to be pfn based and only use struct page where necessary. This makes the code slightly easier to follow and we will remove the problematic pointer arithmetic completely. Link: http://lkml.kernel.org/r/20190218181544.14616-1-mhocko@kernel.org Fixes: efad4e475c31 ("mm, memory_hotplug: is_mem_section_removable do not pass the end of a zone") Signed-off-by: Michal Hocko Reported-by: Tested-by: Acked-by: Mike Rapoport Reviewed-by: Oscar Salvador Cc: Matthew Wilcox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/memory_hotplug.c | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-) commit 6c8fcc096be9d02f478c508052a41a4430506ab3 Author: Daniel Vetter Date: Wed Feb 20 22:20:42 2019 -0800 mm: don't let userspace spam allocations warnings memdump_user usually gets fed unchecked userspace input. Blasting a full backtrace into dmesg every time is a bit excessive - I'm not sure on the kernel rule in general, but at least in drm we're trying not to let unpriviledge userspace spam the logs freely. Definitely not entire warning backtraces. It also means more filtering for our CI, because our testsuite exercises these corner cases and so hits these a lot. Link: http://lkml.kernel.org/r/20190220204058.11676-1-daniel.vetter@ffwll.ch Signed-off-by: Daniel Vetter Reviewed-by: Andrew Morton Acked-by: Michal Hocko Reviewed-by: Kees Cook Cc: Mike Rapoport Cc: Roman Gushchin Cc: Vlastimil Babka Cc: Jan Stancek Cc: Andrey Ryabinin Cc: "Michael S. Tsirkin" Cc: Huang Ying Cc: Bartosz Golaszewski Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6373dca16c911b2828ef8d836d7f6f1800e1bbbc Author: Qian Cai Date: Wed Feb 20 22:20:37 2019 -0800 slub: fix a crash with SLUB_DEBUG + KASAN_SW_TAGS In process_slab(), "p = get_freepointer()" could return a tagged pointer, but "addr = page_address()" always return a native pointer. As the result, slab_index() is messed up here, return (p - addr) / s->size; All other callers of slab_index() have the same situation where "addr" is from page_address(), so just need to untag "p". # cat /sys/kernel/slab/hugetlbfs_inode_cache/alloc_calls Unable to handle kernel paging request at virtual address 2bff808aa4856d48 Mem abort info: ESR = 0x96000007 Exception class = DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000007 CM = 0, WnR = 0 swapper pgtable: 64k pages, 48-bit VAs, pgdp = 0000000002498338 [2bff808aa4856d48] pgd=00000097fcfd0003, pud=00000097fcfd0003, pmd=00000097fca30003, pte=00e8008b24850712 Internal error: Oops: 96000007 [#1] SMP CPU: 3 PID: 79210 Comm: read_all Tainted: G L 5.0.0-rc7+ #84 Hardware name: HPE Apollo 70 /C01_APACHE_MB , BIOS L50_5.13_1.0.6 07/10/2018 pstate: 00400089 (nzcv daIf +PAN -UAO) pc : get_map+0x78/0xec lr : get_map+0xa0/0xec sp : aeff808989e3f8e0 x29: aeff808989e3f940 x28: ffff800826200000 x27: ffff100012d47000 x26: 9700000000002500 x25: 0000000000000001 x24: 52ff8008200131f8 x23: 52ff8008200130a0 x22: 52ff800820013098 x21: ffff800826200000 x20: ffff100013172ba0 x19: 2bff808a8971bc00 x18: ffff1000148f5538 x17: 000000000000001b x16: 00000000000000ff x15: ffff1000148f5000 x14: 00000000000000d2 x13: 0000000000000001 x12: 0000000000000000 x11: 0000000020000002 x10: 2bff808aa4856d48 x9 : 0000020000000000 x8 : 68ff80082620ebb0 x7 : 0000000000000000 x6 : ffff1000105da1dc x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000010 x2 : 2bff808a8971bc00 x1 : ffff7fe002098800 x0 : ffff80082620ceb0 Process read_all (pid: 79210, stack limit = 0x00000000f65b9361) Call trace: get_map+0x78/0xec process_slab+0x7c/0x47c list_locations+0xb0/0x3c8 alloc_calls_show+0x34/0x40 slab_attr_show+0x34/0x48 sysfs_kf_seq_show+0x2e4/0x570 kernfs_seq_show+0x12c/0x1a0 seq_read+0x48c/0xf84 kernfs_fop_read+0xd4/0x448 __vfs_read+0x94/0x5d4 vfs_read+0xcc/0x194 ksys_read+0x6c/0xe8 __arm64_sys_read+0x68/0xb0 el0_svc_handler+0x230/0x3bc el0_svc+0x8/0xc Code: d3467d2a 9ac92329 8b0a0e6a f9800151 (c85f7d4b) ---[ end trace a383a9a44ff13176 ]--- Kernel panic - not syncing: Fatal exception SMP: stopping secondary CPUs SMP: failed to stop secondary CPUs 1-7,32,40,127 Kernel Offset: disabled CPU features: 0x002,20000c18 Memory Limit: none ---[ end Kernel panic - not syncing: Fatal exception ]--- Link: http://lkml.kernel.org/r/20190220020251.82039-1-cai@lca.pw Signed-off-by: Qian Cai Reviewed-by: Andrey Konovalov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/slub.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 557ea25383a231fe3ffc72881ada35c24b960dbc Author: Andrey Konovalov Date: Wed Feb 20 22:20:33 2019 -0800 kasan, slab: remove redundant kasan_slab_alloc hooks kasan_slab_alloc() calls in kmem_cache_alloc() and kmem_cache_alloc_node() are redundant as they are already called via slab_alloc/slab_alloc_node()-> slab_post_alloc_hook()->kasan_slab_alloc(). Remove them. Link: http://lkml.kernel.org/r/4ca1655cdcfc4379c49c50f7bf80f81c4ad01485.1550602886.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Tested-by: Qian Cai Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Catalin Marinas Cc: Dmitry Vyukov Cc: Evgeniy Stepanov Cc: Kostya Serebryany Cc: Vincenzo Frascino Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/slab.c | 2 -- 1 file changed, 2 deletions(-) commit 51dedad06b5f6c3eea7ec1069631b1ef7796912a Author: Andrey Konovalov Date: Wed Feb 20 22:20:28 2019 -0800 kasan, slab: make freelist stored without tags Similarly to "kasan, slub: move kasan_poison_slab hook before page_address", move kasan_poison_slab() before alloc_slabmgmt(), which calls page_address(), to make page_address() return value to be non-tagged. This, combined with calling kasan_reset_tag() for off-slab slab management object, leads to freelist being stored non-tagged. Link: http://lkml.kernel.org/r/dfb53b44a4d00de3879a05a9f04c1f55e584f7a1.1550602886.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Tested-by: Qian Cai Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Catalin Marinas Cc: Dmitry Vyukov Cc: Evgeniy Stepanov Cc: Kostya Serebryany Cc: Vincenzo Frascino Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/slab.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) commit 219667c23c68eb3dbc0d5662b9246f28477fe529 Author: Andrey Konovalov Date: Wed Feb 20 22:20:25 2019 -0800 kasan, slab: fix conflicts with CONFIG_HARDENED_USERCOPY Similarly to commit 96fedce27e13 ("kasan: make tag based mode work with CONFIG_HARDENED_USERCOPY"), we need to reset pointer tags in __check_heap_object() in mm/slab.c before doing any pointer math. Link: http://lkml.kernel.org/r/9a5c0f958db10e69df5ff9f2b997866b56b7effc.1550602886.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Tested-by: Qian Cai Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Catalin Marinas Cc: Dmitry Vyukov Cc: Evgeniy Stepanov Cc: Kostya Serebryany Cc: Vincenzo Frascino Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/slab.c | 2 ++ 1 file changed, 2 insertions(+) commit dc15a8a2543cb9ebe67998eefe2880ce1a20d42e Author: Andrey Konovalov Date: Wed Feb 20 22:20:20 2019 -0800 kasan: prevent tracing of tags.c Similarly to commit 0d0c8de8788b ("kasan: mark file common so ftrace doesn't trace it") add the -pg flag to mm/kasan/tags.c to prevent conflicts with tracing. Link: http://lkml.kernel.org/r/9c4c3ce5ccfb894c7fe66d91de7c1da2787b4da4.1550602886.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reported-by: Qian Cai Tested-by: Qian Cai Cc: Andrey Ryabinin Cc: Alexander Potapenko Cc: Dmitry Vyukov Cc: Catalin Marinas Cc: Vincenzo Frascino Cc: Kostya Serebryany Cc: Evgeniy Stepanov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/kasan/Makefile | 2 ++ 1 file changed, 2 insertions(+) commit 3f41b609382388f95c0a05b69b8db0d706adafb4 Author: Andrey Konovalov Date: Wed Feb 20 22:20:15 2019 -0800 kasan: fix random seed generation for tag-based mode There are two issues with assigning random percpu seeds right now: 1. We use for_each_possible_cpu() to iterate over cpus, but cpumask is not set up yet at the moment of kasan_init(), and thus we only set the seed for cpu #0. 2. A call to get_random_u32() always returns the same number and produces a message in dmesg, since the random subsystem is not yet initialized. Fix 1 by calling kasan_init_tags() after cpumask is set up. Fix 2 by using get_cycles() instead of get_random_u32(). This gives us lower quality random numbers, but it's good enough, as KASAN is meant to be used as a debugging tool and not a mitigation. Link: http://lkml.kernel.org/r/1f815cc914b61f3516ed4cc9bfd9eeca9bd5d9de.1550677973.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Cc: Catalin Marinas Cc: Will Deacon Cc: Andrey Ryabinin Cc: Alexander Potapenko Cc: Dmitry Vyukov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/arm64/kernel/setup.c | 3 +++ arch/arm64/mm/kasan_init.c | 2 -- mm/kasan/tags.c | 2 +- 3 files changed, 4 insertions(+), 3 deletions(-) commit 1062af920c07f5b54cf5060fde3339da6df0cf6b Author: Darrick J. Wong Date: Thu Feb 21 08:48:09 2019 -0800 tmpfs: fix link accounting when a tmpfile is linked in tmpfs has a peculiarity of accounting hard links as if they were separate inodes: so that when the number of inodes is limited, as it is by default, a user cannot soak up an unlimited amount of unreclaimable dcache memory just by repeatedly linking a file. But when v3.11 added O_TMPFILE, and the ability to use linkat() on the fd, we missed accommodating this new case in tmpfs: "df -i" shows that an extra "inode" remains accounted after the file is unlinked and the fd closed and the actual inode evicted. If a user repeatedly links tmpfiles into a tmpfs, the limit will be hit (ENOSPC) even after they are deleted. Just skip the extra reservation from shmem_link() in this case: there's a sense in which this first link of a tmpfile is then cheaper than a hard link of another file, but the accounting works out, and there's still good limiting, so no need to do anything more complicated. Link: http://lkml.kernel.org/r/alpine.LSU.2.11.1902182134370.7035@eggly.anvils Fixes: f4e0c30c191 ("allow the temp files created by open() to be linked to") Signed-off-by: Darrick J. Wong Signed-off-by: Hugh Dickins Reported-by: Matej Kupljen Acked-by: Al Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/shmem.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) commit 4e37504d1c49eec6434d0cc97278d2b51c9e8763 Author: Johannes Weiner Date: Wed Feb 20 22:19:59 2019 -0800 psi: avoid divide-by-zero crash inside virtual machines We've been seeing hard-to-trigger psi crashes when running inside VM instances: divide error: 0000 [#1] SMP PTI Modules linked in: [...] CPU: 0 PID: 212 Comm: kworker/0:2 Not tainted 4.16.18-119_fbk9_3817_gfe944c98d695 #119 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015 Workqueue: events psi_clock RIP: 0010:psi_update_stats+0x270/0x490 RSP: 0018:ffffc90001117e10 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff8800a35a13f8 RDX: 0000000000000000 RSI: ffff8800a35a1340 RDI: 0000000000000000 RBP: 0000000000000658 R08: ffff8800a35a1470 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 00000000000f8502 FS: 0000000000000000(0000) GS:ffff88023fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fbe370fa000 CR3: 00000000b1e3a000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: psi_clock+0x12/0x50 process_one_work+0x1e0/0x390 worker_thread+0x2b/0x3c0 ? rescuer_thread+0x330/0x330 kthread+0x113/0x130 ? kthread_create_worker_on_cpu+0x40/0x40 ? SyS_exit_group+0x10/0x10 ret_from_fork+0x35/0x40 Code: 48 0f 47 c7 48 01 c2 45 85 e4 48 89 16 0f 85 e6 00 00 00 4c 8b 49 10 4c 8b 51 08 49 69 d9 f2 07 00 00 48 6b c0 64 4c 8b 29 31 d2 <48> f7 f7 49 69 d5 8d 06 00 00 48 89 c5 4c 69 f0 00 98 0b 00 48 The Code-line points to `period` being 0 inside update_stats(), and we divide by that when calculating that period's pressure percentage. The elapsed period should never be 0. The reason this can happen is due to an off-by-one in the idle time / missing period calculation combined with a coarse sched_clock() in the virtual machine. The target time for aggregation is advanced into the future on a fixed grid to prevent clock drift. So when an aggregation runs after some idle period, we can not just set it to "now + psi_period", but have to calculate the downtime and advance the target time relative to itself. However, if the aggregator was disabled exactly one psi_period (ns), we drop one idle period in the calculation due to a > when we should do >=. In that case, next_update will be advanced from 'now - psi_period' to 'now' when it should be moved to 'now + psi_period'. The run finishes with last_update == next_update == sched_clock(). With hardware clocks, this exact nanosecond match isn't likely in the first place; but if it does happen, the clock will still have moved on and the period non-zero by the time the worker runs. A pointlessly short period, but besides the extra work, no harm no foul. However, a slow sched_clock() like we have on VMs might not have advanced either by the time the worker runs again. And when we calculate the elapsed period, the result, our pressure divisor, will be 0. Ouch. Fix this by correctly handling the situation when the elapsed time between aggregation runs is precisely two periods, and advance the expiration timestamp correctly to period into the future. Link: http://lkml.kernel.org/r/20190214193157.15788-1-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Reported-by: Łukasz Siudut Cc: Peter Zijlstra Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/sched/psi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6ea183d60c469560e7b08a83c9804299e84ec9eb Author: Michal Hocko Date: Wed Feb 20 22:19:54 2019 -0800 mm: handle lru_add_drain_all for UP properly Since for_each_cpu(cpu, mask) added by commit 2d3854a37e8b767a ("cpumask: introduce new API, without changing anything") did not evaluate the mask argument if NR_CPUS == 1 due to CONFIG_SMP=n, lru_add_drain_all() is hitting WARN_ON() at __flush_work() added by commit 4d43d395fed12463 ("workqueue: Try to catch flush_work() without INIT_WORK().") by unconditionally calling flush_work() [1]. Workaround this issue by using CONFIG_SMP=n specific lru_add_drain_all implementation. There is no real need to defer the implementation to the workqueue as the draining is going to happen on the local cpu. So alias lru_add_drain_all to lru_add_drain which does all the necessary work. [akpm@linux-foundation.org: fix various build warnings] [1] https://lkml.kernel.org/r/18a30387-6aa5-6123-e67c-57579ecc3f38@roeck-us.net Link: http://lkml.kernel.org/r/20190213124334.GH4525@dhcp22.suse.cz Signed-off-by: Michal Hocko Reported-by: Guenter Roeck Debugged-by: Tetsuo Handa Cc: Tejun Heo Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/swap.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) commit 94b3334cbebea34d56a7e6321c6fe9d89b309a49 Author: Mel Gorman Date: Wed Feb 20 22:19:49 2019 -0800 mm, page_alloc: fix a division by zero error when boosting watermarks v2 Yury Norov reported that an arm64 KVM instance could not boot since after v5.0-rc1 and could addressed by reverting the patches 1c30844d2dfe272d58c ("mm: reclaim small amounts of memory when an external 73444bc4d8f92e46a20 ("mm, page_alloc: do not wake kswapd with zone lock held") The problem is that a division by zero error is possible if boosting occurs very early in boot if the system has very little memory. This patch avoids the division by zero error. Link: http://lkml.kernel.org/r/20190213143012.GT9565@techsingularity.net Fixes: 1c30844d2dfe ("mm: reclaim small amounts of memory when an external fragmentation event occurs") Signed-off-by: Mel Gorman Reported-by: Yury Norov Tested-by: Yury Norov Tested-by: Will Deacon Acked-by: Vlastimil Babka Cc: Andrea Arcangeli Cc: David Rientjes Cc: Michal Hocko Cc: Catalin Marinas Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/page_alloc.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit 311ade0eab192f0abee2f70bce761bf0d66990c4 Author: Robin Murphy Date: Wed Feb 20 22:19:45 2019 -0800 mm/debug.c: fix __dump_page() for poisoned pages Evaluating page_mapping() on a poisoned page ends up dereferencing junk and making PF_POISONED_CHECK() considerably crashier than intended: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000006 Mem abort info: ESR = 0x96000005 Exception class = DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000005 CM = 0, WnR = 0 user pgtable: 4k pages, 39-bit VAs, pgdp = 00000000c2f6ac38 [0000000000000006] pgd=0000000000000000, pud=0000000000000000 Internal error: Oops: 96000005 [#1] PREEMPT SMP Modules linked in: CPU: 2 PID: 491 Comm: bash Not tainted 5.0.0-rc1+ #1 Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform, BIOS EDK II Dec 17 2018 pstate: 00000005 (nzcv daif -PAN -UAO) pc : page_mapping+0x18/0x118 lr : __dump_page+0x1c/0x398 Process bash (pid: 491, stack limit = 0x000000004ebd4ecd) Call trace: page_mapping+0x18/0x118 __dump_page+0x1c/0x398 dump_page+0xc/0x18 remove_store+0xbc/0x120 dev_attr_store+0x18/0x28 sysfs_kf_write+0x40/0x50 kernfs_fop_write+0x130/0x1d8 __vfs_write+0x30/0x180 vfs_write+0xb4/0x1a0 ksys_write+0x60/0xd0 __arm64_sys_write+0x18/0x20 el0_svc_common+0x94/0xf8 el0_svc_handler+0x68/0x70 el0_svc+0x8/0xc Code: f9400401 d1000422 f240003f 9a801040 (f9400402) ---[ end trace cdb5eb5bf435cecb ]--- Fix that by not inspecting the mapping until we've determined that it's likely to be valid. Now the above condition still ends up stopping the kernel, but in the correct manner: page:ffffffbf20000000 is uninitialized and poisoned raw: ffffffffffffffff ffffffffffffffff ffffffffffffffff ffffffffffffffff raw: ffffffffffffffff ffffffffffffffff ffffffffffffffff ffffffffffffffff page dumped because: VM_BUG_ON_PAGE(PagePoisoned(p)) ------------[ cut here ]------------ kernel BUG at ./include/linux/mm.h:1006! Internal error: Oops - BUG: 0 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 483 Comm: bash Not tainted 5.0.0-rc1+ #3 Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform, BIOS EDK II Dec 17 2018 pstate: 40000005 (nZcv daif -PAN -UAO) pc : remove_store+0xbc/0x120 lr : remove_store+0xbc/0x120 ... Link: http://lkml.kernel.org/r/03b53ee9d7e76cda4b9b5e1e31eea080db033396.1550071778.git.robin.murphy@arm.com Fixes: 1c6fb1d89e73 ("mm: print more information about mapping in __dump_page") Signed-off-by: Robin Murphy Acked-by: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/debug.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit b2b469939e93458753cfbf8282ad52636495965e Author: Michal Hocko Date: Wed Feb 20 22:19:42 2019 -0800 proc, oom: do not report alien mms when setting oom_score_adj Tetsuo has reported that creating a thousands of processes sharing MM without SIGHAND (aka alien threads) and setting /proc//oom_score_adj will swamp the kernel log and takes ages [1] to finish. This is especially worrisome that all that printing is done under RCU lock and this can potentially trigger RCU stall or softlockup detector. The primary reason for the printk was to catch potential users who might depend on the behavior prior to 44a70adec910 ("mm, oom_adj: make sure processes sharing mm have same view of oom_score_adj") but after more than 2 years without a single report I guess it is safe to simply remove the printk altogether. The next step should be moving oom_score_adj over to the mm struct and remove all the tasks crawling as suggested by [2] [1] http://lkml.kernel.org/r/97fce864-6f75-bca5-14bc-12c9f890e740@i-love.sakura.ne.jp [2] http://lkml.kernel.org/r/20190117155159.GA4087@dhcp22.suse.cz Link: http://lkml.kernel.org/r/20190212102129.26288-1-mhocko@kernel.org Signed-off-by: Michal Hocko Reported-by: Tetsuo Handa Acked-by: Johannes Weiner Cc: David Rientjes Cc: Yong-Taek Lee Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/proc/base.c | 4 ---- 1 file changed, 4 deletions(-) commit 338cfaad4993d3bc35a740e28981747770a65f90 Author: Qian Cai Date: Wed Feb 20 22:19:36 2019 -0800 slub: fix SLAB_CONSISTENCY_CHECKS + KASAN_SW_TAGS Enabling SLUB_DEBUG's SLAB_CONSISTENCY_CHECKS with KASAN_SW_TAGS triggers endless false positives during boot below due to check_valid_pointer() checks tagged pointers which have no addresses that is valid within slab pages: BUG radix_tree_node (Tainted: G B ): Freelist Pointer check fails ----------------------------------------------------------------------------- INFO: Slab objects=69 used=69 fp=0x (null) flags=0x7ffffffc000200 INFO: Object @offset=15060037153926966016 fp=0x Redzone: bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 18 6b 06 00 08 80 ff d0 .........k...... Object : 18 6b 06 00 08 80 ff d0 00 00 00 00 00 00 00 00 .k.............. Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Object : 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ Redzone: bb bb bb bb bb bb bb bb ........ Padding: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ CPU: 0 PID: 0 Comm: swapper/0 Tainted: G B 5.0.0-rc5+ #18 Call trace: dump_backtrace+0x0/0x450 show_stack+0x20/0x2c __dump_stack+0x20/0x28 dump_stack+0xa0/0xfc print_trailer+0x1bc/0x1d0 object_err+0x40/0x50 alloc_debug_processing+0xf0/0x19c ___slab_alloc+0x554/0x704 kmem_cache_alloc+0x2f8/0x440 radix_tree_node_alloc+0x90/0x2fc idr_get_free+0x1e8/0x6d0 idr_alloc_u32+0x11c/0x2a4 idr_alloc+0x74/0xe0 worker_pool_assign_id+0x5c/0xbc workqueue_init_early+0x49c/0xd50 start_kernel+0x52c/0xac4 FIX radix_tree_node: Marking all objects used Link: http://lkml.kernel.org/r/20190209044128.3290-1-cai@lca.pw Signed-off-by: Qian Cai Reviewed-by: Andrey Konovalov Cc: Christoph Lameter Cc: Pekka Enberg Cc: David Rientjes Cc: Joonsoo Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/slub.c | 1 + 1 file changed, 1 insertion(+) commit d36a63a943e37081e92e4abdf4a207fd2e83a006 Author: Andrey Konovalov Date: Wed Feb 20 22:19:32 2019 -0800 kasan, slub: fix more conflicts with CONFIG_SLAB_FREELIST_HARDENED When CONFIG_KASAN_SW_TAGS is enabled, ptr_addr might be tagged. Normally, this doesn't cause any issues, as both set_freepointer() and get_freepointer() are called with a pointer with the same tag. However, there are some issues with CONFIG_SLUB_DEBUG code. For example, when __free_slub() iterates over objects in a cache, it passes untagged pointers to check_object(). check_object() in turns calls get_freepointer() with an untagged pointer, which causes the freepointer to be restored incorrectly. Add kasan_reset_tag to freelist_ptr(). Also add a detailed comment. Link: http://lkml.kernel.org/r/bf858f26ef32eb7bd24c665755b3aee4bc58d0e4.1550103861.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reported-by: Qian Cai Tested-by: Qian Cai Cc: Andrey Ryabinin Cc: Alexander Potapenko Cc: Dmitry Vyukov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/slub.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) commit 18e506610238eda2b0c5a19a123d3d6ec0ab2de6 Author: Andrey Konovalov Date: Wed Feb 20 22:19:28 2019 -0800 kasan, slub: fix conflicts with CONFIG_SLAB_FREELIST_HARDENED CONFIG_SLAB_FREELIST_HARDENED hashes freelist pointer with the address of the object where the pointer gets stored. With tag based KASAN we don't account for that when building freelist, as we call set_freepointer() with the first argument untagged. This patch changes the code to properly propagate tags throughout the loop. Link: http://lkml.kernel.org/r/3df171559c52201376f246bf7ce3184fe21c1dc7.1549921721.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reported-by: Qian Cai Cc: Andrey Ryabinin Cc: Alexander Potapenko Cc: Dmitry Vyukov Cc: Catalin Marinas Cc: Christoph Lameter Cc: Pekka Enberg Cc: David Rientjes Cc: Joonsoo Kim Cc: Vincenzo Frascino Cc: Kostya Serebryany Cc: Evgeniy Stepanov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/slub.c | 20 +++++++------------- 1 file changed, 7 insertions(+), 13 deletions(-) commit a71012242837fe5e67d8c999cfc357174ed5dba0 Author: Andrey Konovalov Date: Wed Feb 20 22:19:23 2019 -0800 kasan, slub: move kasan_poison_slab hook before page_address With tag based KASAN page_address() looks at the page flags to see whether the resulting pointer needs to have a tag set. Since we don't want to set a tag when page_address() is called on SLAB pages, we call page_kasan_tag_reset() in kasan_poison_slab(). However in allocate_slab() page_address() is called before kasan_poison_slab(). Fix it by changing the order. [andreyknvl@google.com: fix compilation error when CONFIG_SLUB_DEBUG=n] Link: http://lkml.kernel.org/r/ac27cc0bbaeb414ed77bcd6671a877cf3546d56e.1550066133.git.andreyknvl@google.com Link: http://lkml.kernel.org/r/cd895d627465a3f1c712647072d17f10883be2a1.1549921721.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Catalin Marinas Cc: Christoph Lameter Cc: David Rientjes Cc: Dmitry Vyukov Cc: Evgeniy Stepanov Cc: Joonsoo Kim Cc: Kostya Serebryany Cc: Pekka Enberg Cc: Qian Cai Cc: Vincenzo Frascino Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/slub.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) commit a2f775751d964e638818487544fa8320180d106e Author: Andrey Konovalov Date: Wed Feb 20 22:19:16 2019 -0800 kmemleak: account for tagged pointers when calculating pointer range kmemleak keeps two global variables, min_addr and max_addr, which store the range of valid (encountered by kmemleak) pointer values, which it later uses to speed up pointer lookup when scanning blocks. With tagged pointers this range will get bigger than it needs to be. This patch makes kmemleak untag pointers before saving them to min_addr and max_addr and when performing a lookup. Link: http://lkml.kernel.org/r/16e887d442986ab87fe87a755815ad92fa431a5f.1550066133.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Tested-by: Qian Cai Acked-by: Catalin Marinas Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Christoph Lameter Cc: David Rientjes Cc: Dmitry Vyukov Cc: Evgeniy Stepanov Cc: Joonsoo Kim Cc: Kostya Serebryany Cc: Pekka Enberg Cc: Vincenzo Frascino Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/kmemleak.c | 10 +++++++--- mm/slab.h | 1 + mm/slab_common.c | 1 + mm/slub.c | 1 + 4 files changed, 10 insertions(+), 3 deletions(-) commit 53128245b43daad600d9fe72940206570e064112 Author: Andrey Konovalov Date: Wed Feb 20 22:19:11 2019 -0800 kasan, kmemleak: pass tagged pointers to kmemleak Right now we call kmemleak hooks before assigning tags to pointers in KASAN hooks. As a result, when an objects gets allocated, kmemleak sees a differently tagged pointer, compared to the one it sees when the object gets freed. Fix it by calling KASAN hooks before kmemleak's ones. Link: http://lkml.kernel.org/r/cd825aa4897b0fc37d3316838993881daccbe9f5.1549921721.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reported-by: Qian Cai Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Catalin Marinas Cc: Christoph Lameter Cc: David Rientjes Cc: Dmitry Vyukov Cc: Evgeniy Stepanov Cc: Joonsoo Kim Cc: Kostya Serebryany Cc: Pekka Enberg Cc: Vincenzo Frascino Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/slab.h | 6 ++---- mm/slab_common.c | 2 +- mm/slub.c | 3 ++- 3 files changed, 5 insertions(+), 6 deletions(-) commit e1db95befb3e9e3476629afec6e0f5d0707b9825 Author: Andrey Konovalov Date: Wed Feb 20 22:19:01 2019 -0800 kasan: fix assigning tags twice When an object is kmalloc()'ed, two hooks are called: kasan_slab_alloc() and kasan_kmalloc(). Right now we assign a tag twice, once in each of the hooks. Fix it by assigning a tag only in the former hook. Link: http://lkml.kernel.org/r/ce8c6431da735aa7ec051fd6497153df690eb021.1549921721.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Catalin Marinas Cc: Christoph Lameter Cc: David Rientjes Cc: Dmitry Vyukov Cc: Evgeniy Stepanov Cc: Joonsoo Kim Cc: Kostya Serebryany Cc: Pekka Enberg Cc: Qian Cai Cc: Vincenzo Frascino Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/kasan/common.c | 29 +++++++++++++++++------------ 1 file changed, 17 insertions(+), 12 deletions(-) commit 050c17f239fd53adb55aa768d4f41bc76c0fe045 Author: Ralph Campbell Date: Wed Feb 20 22:18:58 2019 -0800 numa: change get_mempolicy() to use nr_node_ids instead of MAX_NUMNODES The system call, get_mempolicy() [1], passes an unsigned long *nodemask pointer and an unsigned long maxnode argument which specifies the length of the user's nodemask array in bits (which is rounded up). The manual page says that if the maxnode value is too small, get_mempolicy will return EINVAL but there is no system call to return this minimum value. To determine this value, some programs search /proc//status for a line starting with "Mems_allowed:" and use the number of digits in the mask to determine the minimum value. A recent change to the way this line is formatted [2] causes these programs to compute a value less than MAX_NUMNODES so get_mempolicy() returns EINVAL. Change get_mempolicy(), the older compat version of get_mempolicy(), and the copy_nodes_to_user() function to use nr_node_ids instead of MAX_NUMNODES, thus preserving the defacto method of computing the minimum size for the nodemask array and the maxnode argument. [1] http://man7.org/linux/man-pages/man2/get_mempolicy.2.html [2] https://lore.kernel.org/lkml/1545405631-6808-1-git-send-email-longman@redhat.com Link: http://lkml.kernel.org/r/20190211180245.22295-1-rcampbell@nvidia.com Fixes: 4fb8e5b89bcbbbb ("include/linux/nodemask.h: use nr_node_ids (not MAX_NUMNODES) in __nodemask_pr_numnodes()") Signed-off-by: Ralph Campbell Suggested-by: Alexander Duyck Cc: Waiman Long Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/mempolicy.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit a841c673f1352f607fd3ba85de6c9c49ff2c1e12 Author: Andrew Morton Date: Wed Feb 20 22:18:52 2019 -0800 revert "initramfs: cleanup incomplete rootfs" Revert ff1522bb7d9845 ("initramfs: cleanup incomplete rootfs"). Andy reports : This breaks my setup where I have U-boot provided more size of initramfs : than needed. This allows a bit of flexibility to increase or decrease : initramfs compressed image without taking care of bootloader. The proper : solution is to do this if we sure that we didn't get enough memory, : otherwise I can't consider the error fatal to clean up rootfs. Fixes: ff1522bb7d9845 ("initramfs: cleanup incomplete rootfs") Reported-by: Andy Shevchenko Tested-by: Andy Shevchenko Cc: David Engraf Cc: Dominik Brodowski Cc: Greg Kroah-Hartman Cc: Philippe Ombredanne Cc: Arnd Bergmann Cc: Luc Van Oostenryck Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds init/initramfs.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 11fe9262ed226c127f67ca4bd85977b22589b68a Author: Björn Töpel Date: Thu Feb 21 13:07:38 2019 +0100 Revert "xsk: simplify AF_XDP socket teardown" This reverts commit e2ce3674883ecba2605370404208c9d4a07ae1c3. It turns out that the sock destructor xsk_destruct was needed after all. The cleanup simplification broke the skb transmit cleanup path, due to that the umem was prematurely destroyed. The umem cannot be destroyed until all outstanding skbs are freed, which means that we cannot remove the umem until the sk_destruct has been called. Signed-off-by: Björn Töpel Signed-off-by: Daniel Borkmann net/xdp/xsk.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) commit 74fb44863084275b952f21ec6a024af0e2e75cb8 Author: Vincent Guittot Date: Thu Feb 21 08:59:02 2019 +0100 PM-runtime: Fix deadlock when canceling hrtimer When rpm_resume() desactivates the autosuspend timer, it should only try to cancel hrtimer but not wait for the handler to finish, because both rpm_resume() and pm_suspend_timer_fn() take the power.lock. A deadlock is possible as follows: CPU0 CPU1 rpm_resume() spin_lock_irqsave pm_suspend_timer_fn() spin_lock_irqsave pm_runtime_deactivate_timer() hrtimer_cancel() It is sufficient to call hrtimer_try_to_cancel() from pm_runtime_deactivate_timer(), because dev->power.timer_expires reset to 0 by it, so use that function instead of hrtimer_cancel(). Fixes: 8234f6734c5d ("PM-runtime: Switch autosuspend over to using hrtimers") Reported-by: Sunzhaosheng Sun(Zhaosheng) Signed-off-by: Vincent Guittot [ rjw: Changelog ] Signed-off-by: Rafael J. Wysocki drivers/base/power/runtime.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ae3b564179bfd06f32d051b9e5d72ce4b2a07c37 Author: Al Viro Date: Fri Feb 15 20:09:35 2019 +0000 missing barriers in some of unix_sock ->addr and ->path accesses Several u->addr and u->path users are not holding any locks in common with unix_bind(). unix_state_lock() is useless for those purposes. u->addr is assign-once and *(u->addr) is fully set up by the time we set u->addr (all under unix_table_lock). u->path is also set in the same critical area, also before setting u->addr, and any unix_sock with ->path filled will have non-NULL ->addr. So setting ->addr with smp_store_release() is all we need for those "lockless" users - just have them fetch ->addr with smp_load_acquire() and don't even bother looking at ->path if they see NULL ->addr. Users of ->addr and ->path fall into several classes now: 1) ones that do smp_load_acquire(u->addr) and access *(u->addr) and u->path only if smp_load_acquire() has returned non-NULL. 2) places holding unix_table_lock. These are guaranteed that *(u->addr) is seen fully initialized. If unix_sock is in one of the "bound" chains, so's ->path. 3) unix_sock_destructor() using ->addr is safe. All places that set u->addr are guaranteed to have seen all stores *(u->addr) while holding a reference to u and unix_sock_destructor() is called when (atomic) refcount hits zero. 4) unix_release_sock() using ->path is safe. unix_bind() is serialized wrt unix_release() (normally - by struct file refcount), and for the instances that had ->path set by unix_bind() unix_release_sock() comes from unix_release(), so they are fine. Instances that had it set in unix_stream_connect() either end up attached to a socket (in unix_accept()), in which case the call chain to unix_release_sock() and serialization are the same as in the previous case, or they never get accept'ed and unix_release_sock() is called when the listener is shut down and its queue gets purged. In that case the listener's queue lock provides the barriers needed - unix_stream_connect() shoves our unix_sock into listener's queue under that lock right after having set ->path and eventual unix_release_sock() caller picks them from that queue under the same lock right before calling unix_release_sock(). 5) unix_find_other() use of ->path is pointless, but safe - it happens with successful lookup by (abstract) name, so ->path.dentry is guaranteed to be NULL there. earlier-variant-reviewed-by: "Paul E. McKenney" Signed-off-by: Al Viro Signed-off-by: David S. Miller net/unix/af_unix.c | 57 ++++++++++++++++++++++++++++++---------------------- net/unix/diag.c | 3 ++- security/lsm_audit.c | 10 +++++---- 3 files changed, 41 insertions(+), 29 deletions(-) commit a8fef9ba58c9966ddb1fec916d8d8137c9d8bc89 Author: Russell King Date: Fri Feb 15 13:55:47 2019 +0000 net: marvell: mvneta: fix DMA debug warning Booting 4.20 on SolidRun Clearfog issues this warning with DMA API debug enabled: WARNING: CPU: 0 PID: 555 at kernel/dma/debug.c:1230 check_sync+0x514/0x5bc mvneta f1070000.ethernet: DMA-API: device driver tries to sync DMA memory it has not allocated [device address=0x000000002dd7dc00] [size=240 bytes] Modules linked in: ahci mv88e6xxx dsa_core xhci_plat_hcd xhci_hcd devlink armada_thermal marvell_cesa des_generic ehci_orion phy_armada38x_comphy mcp3021 spi_orion evbug sfp mdio_i2c ip_tables x_tables CPU: 0 PID: 555 Comm: bridge-network- Not tainted 4.20.0+ #291 Hardware name: Marvell Armada 380/385 (Device Tree) [] (unwind_backtrace) from [] (show_stack+0x10/0x14) [] (show_stack) from [] (dump_stack+0x9c/0xd4) [] (dump_stack) from [] (__warn+0xf8/0x124) [] (__warn) from [] (warn_slowpath_fmt+0x38/0x48) [] (warn_slowpath_fmt) from [] (check_sync+0x514/0x5bc) [] (check_sync) from [] (debug_dma_sync_single_range_for_cpu+0x6c/0x74) [] (debug_dma_sync_single_range_for_cpu) from [] (mvneta_poll+0x298/0xf58) [] (mvneta_poll) from [] (net_rx_action+0x128/0x424) [] (net_rx_action) from [] (__do_softirq+0xf0/0x540) [] (__do_softirq) from [] (irq_exit+0x124/0x144) [] (irq_exit) from [] (__handle_domain_irq+0x58/0xb0) [] (__handle_domain_irq) from [] (gic_handle_irq+0x48/0x98) [] (gic_handle_irq) from [] (__irq_svc+0x70/0x98) ... This appears to be caused by mvneta_rx_hwbm() calling dma_sync_single_range_for_cpu() with the wrong struct device pointer, as the buffer manager device pointer is used to map and unmap the buffer. Fix this. Signed-off-by: Russell King Signed-off-by: David S. Miller drivers/net/ethernet/marvell/mvneta.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9c526fed6a57561fc63abaf9497512ba4bf4e49e Merge: a3b22b9f11d9 d179b88deb3b Author: Dave Airlie Date: Thu Feb 21 12:21:43 2019 +1000 Merge tag 'drm-intel-fixes-2019-02-20' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fbdev takeover fix for v5.0 Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87k1hutrmc.fsf@intel.com commit 73de65f5b9de517d8d9251a755e91296dd521ca6 Merge: a3b22b9f11d9 b10bd9a256ae Author: Paolo Bonzini Date: Wed Feb 20 23:48:55 2019 +0100 Merge tag 'kvm-s390-master-5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into kvm-master KVM: s390: Fix crypto handling for nested KVM commit f6163d67cc31b8f2a946c4df82be3c6dd918412d Merge: 2137397c92ae 0358affb5cd8 Author: Linus Torvalds Date: Wed Feb 20 14:14:31 2019 -0800 Merge tag 'docs-5.0-fix' of git://git.lwn.net/linux Pull documentation fix from Jonathan Corbet: "A single patch from Arnd bringing some top-level docs into the 5.0 era" * tag 'docs-5.0-fix' of git://git.lwn.net/linux: Documentation: change linux-4.x references to 5.x commit a213c2c7e235cfc0e0a161a558f7fdf2fb3a624a Author: Christian König Date: Wed Feb 20 15:16:06 2019 +0100 drm/amdgpu: disable bulk moves for now The changes to fix those are two invasive for backporting. Just disable the feature in 4.20 and 5.0. Acked-by: Alex Deucher Signed-off-by: Christian König Cc: [4.20+] Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 2 ++ 1 file changed, 2 insertions(+) commit 4ece61a22be5ab5d49cc5fc20a19a0afa24a019d Author: Bhawanpreet Lakha Date: Tue Feb 5 14:03:52 2019 -0500 drm/amd/display: set clocks to 0 on suspend on dce80 [Why] When a dce80 asic was suspended, the clocks were not set to 0. Upon resume, the new clock was compared to the existing clock, they were found to be the same, and so the clock was not set. This resulted in a blackscreen. [How] In atomic commit, check to see if there are any active pipes. If no, set clocks to 0 Signed-off-by: Bhawanpreet Lakha Reviewed-by: Nicholas Kazlauskas Acked-by: Leo Li Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) commit 9f7ddbea2bb826a2147309f735726a8b09950944 Author: Bhawanpreet Lakha Date: Tue Feb 5 13:55:20 2019 -0500 drm/amd/display: fix optimize_bandwidth func pointer for dce80 [Why] optimize_bandwidth was using dce100_prepare_bandwidth this is incorrect [How] change it to dce100_optimize_bandwidth Signed-off-by: Bhawanpreet Lakha Reviewed-by: Charlene Liu Acked-by: Leo Li Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/display/dc/dce100/dce100_hw_sequencer.h | 4 ++++ drivers/gpu/drm/amd/display/dc/dce80/dce80_hw_sequencer.c | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) commit 0921c41e19028314830b33daa681e46b46477c5e Author: Nicholas Kazlauskas Date: Fri Feb 1 09:36:59 2019 -0500 drm/amd/display: Fix negative cursor pos programming [Why] If the cursor pos passed from DM is less than the plane_state->dst_rect top left corner then the unsigned cursor pos wraps around to a large positive number since cursor pos is a u32. There was an attempt to guard against this in hubp1_cursor_set_position by checking the src_x_offset and src_y_offset and offseting the cursor hotspot within hubp1_cursor_set_position. However, the cursor position itself is still being programmed incorrectly as a large value. This manifests itself visually as the cursor disappearing or containing strange artifacts near the middle of the screen on raven. [How] Don't subtract the destination rect top left corner from the pos but add it to the hotspot instead. This happens before the pos gets passed into hubp1_cursor_set_position. This achieves the same result but avoids the subtraction wrap around. With this fix the original cursor programming logic can be used again. Signed-off-by: Nicholas Kazlauskas Reviewed-by: Charlene Liu Acked-by: Leo Li Acked-by: Murton Liu Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 65a91e2e597dea62a798a8b771edc44859037e7f Author: Alexandre Belloni Date: Fri Feb 8 15:40:59 2019 +0100 clk: at91: fix masterck name The master clock is actually named masterck earlier in the driver. Having "mck" in the parent list means that it can never be selected. Fixes: 1eabdc2f9dd8 ("clk: at91: add at91sam9x5 PMCs driver") Fixes: a2038077de9a ("clk: at91: add sama5d2 PMC driver") Fixes: 084b696bb509 ("clk: at91: add sama5d4 pmc driver") Signed-off-by: Alexandre Belloni Acked-by: Nicolas Ferre Cc: # v4.20+ Signed-off-by: Stephen Boyd drivers/clk/at91/at91sam9x5.c | 2 +- drivers/clk/at91/sama5d2.c | 4 ++-- drivers/clk/at91/sama5d4.c | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) commit 1b328a2e095a009518ebac05e937cc0fc242fede Author: Alexandre Belloni Date: Tue Feb 19 17:51:14 2019 +0100 clk: at91: fix at91sam9x5 peripheral clock number nck() looks at the last id in an array and unfortunately, at91sam9x35_periphck has a sentinel, hence the id is 0 and the calculated number of peripheral clocks is 1 instead of a maximum of 31. Fixes: 1eabdc2f9dd8 ("clk: at91: add at91sam9x5 PMCs driver") Signed-off-by: Alexandre Belloni Acked-by: Nicolas Ferre Cc: # v4.20+ Signed-off-by: Stephen Boyd drivers/clk/at91/at91sam9x5.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 9c2054a5cf415a9dc32c91ffde78399955deb571 Author: Russell King Date: Wed Feb 20 10:32:52 2019 +0000 net: dsa: fix unintended change of bridge interface STP state When a DSA port is added to a bridge and brought up, the resulting STP state programmed into the hardware depends on the order that these operations are performed. However, the Linux bridge code believes that the port is in disabled mode. If the DSA port is first added to a bridge and then brought up, it will be in blocking mode. If it is brought up and then added to the bridge, it will be in disabled mode. This difference is caused by DSA always setting the STP mode in dsa_port_enable() whether or not this port is part of a bridge. Since bridge always sets the STP state when the port is added, brought up or taken down, it is unnecessary for us to manipulate the STP state. Apparently, this code was copied from Rocker, and the very next day a similar fix for Rocker was merged but was not propagated to DSA. See e47172ab7e41 ("rocker: put port in FORWADING state after leaving bridge") Fixes: b73adef67765 ("net: dsa: integrate with SWITCHDEV for HW bridging") Signed-off-by: Russell King Reviewed-by: Vivien Didelot Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller net/dsa/port.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 2137397c92aec3713fa10be3c9b830f9a1674e60 Merge: fb83f15ef9dd 268836649c07 Author: Linus Torvalds Date: Wed Feb 20 09:42:52 2019 -0800 Merge tag 'sound-5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Here are a few last-minute fixes for 5.0. The most significant one is the OF-node refcount fix for ASoC simple-card, which could be triggered on many boards. Another fix for ASoC core is for the error handling in topology, while others are device-specific fixes for Samsung and HD-audio" * tag 'sound-5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ASoC: simple-card: fixup refcount_t underflow ASoC: topology: free created components in tplg load error ALSA: hda/realtek: Disable PC beep in passthrough on alc285 ALSA: hda/realtek - Headset microphone and internal speaker support for System76 oryp5 ASoC: samsung: i2s: Fix prescaler setting for the secondary DAI commit fb83f15ef9dd984834bc60b380efbeffdf1ecc04 Merge: c828c2651b9a c17abcfa93bf Author: Linus Torvalds Date: Wed Feb 20 09:39:53 2019 -0800 Merge tag 'pinctrl-v5.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: "Some final pin control fixes (I hope) to round off the v5.0 pin control development cycle. Only driver fixes, one for stable: - Meson8B fixup for the sdc pins - Fix SDC tile position for Qualcomm QCS404" * tag 'pinctrl-v5.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: meson: meson8b: fix the sdxc_a data 1..3 pins pinctrl: qcom: qcs404: Correct SDC tile commit c828c2651b9a8184e1414fa0611d18b84d3847dd Merge: 7d9d592caf8c af14b2c98adb Author: Linus Torvalds Date: Wed Feb 20 09:36:33 2019 -0800 Merge tag 'gpio-v5.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO fixes from Linus Walleij: "Two GPIO fixes for the v5.0 series: - Per-instance irqchip on the MT7621 - Avoid direction setting using pin control on MMP2" * tag 'gpio-v5.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: gpio: pxa: avoid attempting to set pin direction via pinctrl on MMP2 gpio: MT7621: use a per instance irq_chip structure commit 7d9d592caf8cc5d91f7923c5e717b69d0b1e246f Merge: 1f5a018c5b15 3e35730dd754 Author: Linus Torvalds Date: Wed Feb 20 09:16:11 2019 -0800 Merge tag 'mtd/fixes-for-5.0-rc8' of git://git.infradead.org/linux-mtd Pull MTD fixes from Boris Brezillon: - Don't add a digit to MTD-backed nvmem device names - Make sure powernv flash names are unique * tag 'mtd/fixes-for-5.0-rc8' of git://git.infradead.org/linux-mtd: mtd: powernv_flash: Fix device registration error mtd: Use mtd->name when registering nvmem device commit 1f5a018c5b15c2e3e519ae8ca9bfb03a00384448 Merge: 40e196a906d9 7c1857bdbdf1 Author: Linus Torvalds Date: Wed Feb 20 09:09:33 2019 -0800 Merge branch 'fixes-v5.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security Pull keys fixes from James Morris: - Handle quotas better, allowing full quota to be reached. - Fix the creation of shortcuts in the assoc_array internal representation when the index key needs to be an exact multiple of the machine word size. - Fix a dependency loop between the request_key contruction record and the request_key authentication key. The construction record isn't really necessary and can be dispensed with. - Set the timestamp on a new key rather than leaving it as 0. This would ordinarily be fine - provided the system clock is never set to a time before 1970 * 'fixes-v5.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: keys: Timestamp new keys keys: Fix dependency loop between construction record and auth key assoc_array: Fix shortcut creation KEYS: allow reaching the keys quotas exactly commit 94d9b9337d09bdd27735005b3251d97ab29f7273 Author: Thierry Reding Date: Mon Feb 11 12:09:19 2019 +0100 ARM: tegra: Restore DT ABI on Tegra124 Chromebooks Commit 482997699ef0 ("ARM: tegra: Fix unit_address_vs_reg DTC warnings for /memory") inadventently broke device tree ABI by adding a unit- address to the "/memory" node because the device tree compiler flagged the missing unit-address as a warning. Tegra124 Chromebooks (a.k.a. Nyan) use a bootloader that relies on the full name of the memory node in device tree being exactly "/memory". It can be argued whether this was a good decision or not, and some other bootloaders (such as U-Boot) do accept a unit-address in the name of the node, but the device tree is an ABI and we can't break existing setups just because the device tree compiler considers it bad practice to omit the unit-address nowadays. This partially reverts the offending commit and restores device tree ABI compatibility. Fixes: 482997699ef0 ("ARM: tegra: Fix unit_address_vs_reg DTC warnings for /memory") Reported-by: Tristan Bastian Signed-off-by: Thierry Reding Tested-by: Tristan Bastian Signed-off-by: Arnd Bergmann arch/arm/boot/dts/tegra124-nyan.dtsi | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) commit 74698f6971f25d045301139413578865fc2bd8f9 Author: Vladimir Murzin Date: Wed Feb 20 11:43:05 2019 +0000 arm64: Relax GIC version check during early boot Updates to the GIC architecture allow ID_AA64PFR0_EL1.GIC to have values other than 0 or 1. At the moment, Linux is quite strict in the way it handles this field at early boot stage (cpufeature is fine) and will refuse to use the system register CPU interface if it doesn't find the value 1. Fixes: 021f653791ad17e03f98aaa7fb933816ae16f161 ("irqchip: gic-v3: Initial support for GICv3") Reported-by: Chase Conklin Reviewed-by: Marc Zyngier Signed-off-by: Vladimir Murzin Signed-off-by: Will Deacon arch/arm64/kernel/head.S | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit d179b88deb3bf6fed4991a31fd6f0f2cad21fab5 Author: Chris Wilson Date: Fri Feb 15 12:30:19 2019 +0000 drm/i915/fbdev: Actually configure untiled displays If we skipped all the connectors that were not part of a tile, we would leave conn_seq=0 and conn_configured=0, convincing ourselves that we had stagnated in our configuration attempts. Avoid this situation by starting conn_seq=ALL_CONNECTORS, and repeating until we find no more connectors to configure. Fixes: 754a76591b12 ("drm/i915/fbdev: Stop repeating tile configuration on stagnation") Reported-by: Maarten Lankhorst Signed-off-by: Chris Wilson Cc: Maarten Lankhorst Reviewed-by: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/20190215123019.32283-1-chris@chris-wilson.co.uk Cc: # v3.19+ (cherry picked from commit d9b308b1f8a1acc0c3279f443d4fe0f9f663252e) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_fbdev.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) commit 40e196a906d969fd10d885c692d2674b3d657006 Merge: b5372fe5dc84 1765f5dcd009 Author: Linus Torvalds Date: Tue Feb 19 16:13:19 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) Fix suspend and resume in mt76x0u USB driver, from Stanislaw Gruszka. 2) Missing memory barriers in xsk, from Magnus Karlsson. 3) rhashtable fixes in mac80211 from Herbert Xu. 4) 32-bit MIPS eBPF JIT fixes from Paul Burton. 5) Fix for_each_netdev_feature() on big endian, from Hauke Mehrtens. 6) GSO validation fixes from Willem de Bruijn. 7) Endianness fix for dwmac4 timestamp handling, from Alexandre Torgue. 8) More strict checks in tcp_v4_err(), from Eric Dumazet. 9) af_alg_release should NULL out the sk after the sock_put(), from Mao Wenan. 10) Missing unlock in mac80211 mesh error path, from Wei Yongjun. 11) Missing device put in hns driver, from Salil Mehta. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (44 commits) sky2: Increase D3 delay again vhost: correctly check the return value of translate_desc() in log_used() net: netcp: Fix ethss driver probe issue net: hns: Fixes the missing put_device in positive leg for roce reset net: stmmac: Fix a race in EEE enable callback qed: Fix iWARP syn packet mac address validation. qed: Fix iWARP buffer size provided for syn packet processing. r8152: Add support for MAC address pass through on RTL8153-BD mac80211: mesh: fix missing unlock on error in table_path_del() net/mlx4_en: fix spelling mistake: "quiting" -> "quitting" net: crypto set sk to NULL when af_alg_release. net: Do not allocate page fragments that are not skb aligned mm: Use fixed constant in page_frag_alloc instead of size + 1 tcp: tcp_v4_err() should be more careful tcp: clear icsk_backoff in tcp_write_queue_purge() net: mv643xx_eth: disable clk on error path in mv643xx_eth_shared_probe() qmi_wwan: apply SET_DTR quirk to Sierra WP7607 net: stmmac: handle endianness in dwmac4_get_timestamp doc: Mention MSG_ZEROCOPY implementation for UDP mlxsw: __mlxsw_sp_port_headroom_set(): Fix a use of local variable ... commit 1765f5dcd00963e33f1b8a4e0f34061fbc0e2f7f Author: Kai-Heng Feng Date: Tue Feb 19 23:45:29 2019 +0800 sky2: Increase D3 delay again Another platform requires even longer delay to make the device work correctly after S3. So increase the delay to 300ms. BugLink: https://bugs.launchpad.net/bugs/1798921 Signed-off-by: Kai-Heng Feng Signed-off-by: David S. Miller drivers/net/ethernet/marvell/sky2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 816db7663565cd23f74ed3d5c9240522e3fb0dda Author: Jason Wang Date: Tue Feb 19 14:53:44 2019 +0800 vhost: correctly check the return value of translate_desc() in log_used() When fail, translate_desc() returns negative value, otherwise the number of iovs. So we should fail when the return value is negative instead of a blindly check against zero. Detected by CoverityScan, CID# 1442593: Control flow issues (DEADCODE) Fixes: cc5e71075947 ("vhost: log dirty page correctly") Acked-by: Michael S. Tsirkin Reported-by: Stephen Hemminger Signed-off-by: Jason Wang Signed-off-by: David S. Miller drivers/vhost/vhost.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8852ae9a82498207c15262b6294d14aea1796966 Author: Roman Li Date: Mon Jan 28 10:59:34 2019 -0500 drm/amd/display: Raise dispclk value for dce11 [Why] The visual corruption due to low display clock value. Observed on Carrizo 4K@60Hz. [How] There was earlier patch for dce_update_clocks: Adding +15% workaround also to to dce11_update_clocks Signed-off-by: Roman Li Reviewed-by: Nicholas Kazlauskas Acked-by: Leo Li Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dce/dce_clk_mgr.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit d2f0b53bda3193874f3905bc839888f895d1c0cf Author: Leo (Hanghong) Ma Date: Thu Jan 24 15:07:52 2019 -0500 drm/amd/display: Fix MST reboot/poweroff sequence [Why] drm_dp_mst_topology_mgr_suspend() is added into the new reboot sequence, which disables the UP request at the beginning. Therefore sideband messages are blocked. [How] Finish MST sideband message transaction before UP request is suppressed. Signed-off-by: Leo (Hanghong) Ma Reviewed-by: Roman Li Acked-by: Leo Li Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 9db97d8aa8f8a518c421196a504dbfc942ef8d40 Author: shaoyunl Date: Fri Feb 15 11:05:04 2019 -0500 drm/amdgpu: Update sdma golden setting for vega20 According to hardware engineer, WRITE_BURST_LENGTH [9:8] in register SDMA0_CHICKEN_BITS need to change to 3 for better performance Signed-off-by: shaoyunl Acked-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit d33158530660bc89be3cc870a2152e4e9a76cac7 Author: Alex Deucher Date: Mon Feb 18 17:11:38 2019 -0500 drm/amdgpu: Set DPM_FLAG_NEVER_SKIP when enabling PM-runtime Based on a similar patch from Rafael for radeon. When using ATPX to control dGPU power, the state is not retained across suspend and resume cycles by default. This can probably be loosened for Hybrid Graphics (_PR3) laptops where I think the state is properly retained. Fixes: c62ec4610c40 ("PM / core: Fix direct_complete handling for devices with no callbacks") Cc: Rafael J. Wysocki Acked-by: Rafael J. Wysocki Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 1 + 1 file changed, 1 insertion(+) commit 450d007d199e632a1a4c4b91302deacd7d56815f Author: Rafael J. Wysocki Date: Thu Feb 14 23:46:19 2019 +0100 gpu: drm: radeon: Set DPM_FLAG_NEVER_SKIP when enabling PM-runtime On HP ProBook 4540s, if PM-runtime is enabled in the radeon driver and the direct-complete optimization is used for the radeon device during system-wide suspend, the system doesn't resume. Preventing direct-complete from being used with the radeon device by setting the DPM_FLAG_NEVER_SKIP driver flag for it makes the problem go away, which indicates that direct-complete is not safe for the radeon driver in general and should not be used with it (at least for now). This fixes a regression introduced by commit c62ec4610c40 ("PM / core: Fix direct_complete handling for devices with no callbacks") which allowed direct-complete to be applied to devices without PM callbacks (again) which in turn unlocked direct-complete for radeon on HP ProBook 4540s. Fixes: c62ec4610c40 ("PM / core: Fix direct_complete handling for devices with no callbacks") Link: https://bugzilla.kernel.org/show_bug.cgi?id=201519 Reported-by: Ярослав Семченко Tested-by: Ярослав Семченко Signed-off-by: Rafael J. Wysocki Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/radeon/radeon_kms.c | 1 + 1 file changed, 1 insertion(+) commit 0661465ec86e8ae28f09a04e51425c486d64dfb1 Merge: 50d6b3cf9403 37685f6a63ee Author: Tony Lindgren Date: Tue Feb 19 08:47:17 2019 -0800 Merge branch 'am335x-phy-fixes' into omap-for-v5.0/fixes-v2 commit 37685f6a63eeca2135d1f704e7638409a071b1f6 Author: Peter Ujfalusi Date: Tue Feb 19 08:46:33 2019 -0800 ARM: dts: am335x-evm: Fix PHY mode for ethernet The PHY must add both tx and rx delay and not only on the tx clock. The board uses AR8031_AL1A PHY where the rx delay is enabled by default, the tx dealy is disabled. The reason why rgmii-txid worked because the rx delay was not disabled by the driver so essentially we ended up with rgmii-id PHY mode. Signed-off-by: Peter Ujfalusi Signed-off-by: Tony Lindgren arch/arm/boot/dts/am335x-evm.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 759c962d3c9bb1a60e3b4b780daa66ee6d4be13a Author: Peter Ujfalusi Date: Tue Feb 19 08:46:32 2019 -0800 ARM: dts: am335x-evmsk: Fix PHY mode for ethernet The PHY must add both tx and rx delay and not only on the tx clock. The board uses AR8031_AL1A PHY where the rx delay is enabled by default, the tx dealy is disabled. The reason why rgmii-txid worked because the rx delay was not disabled by the driver so essentially we ended up with rgmii-id PHY mode. Signed-off-by: Peter Ujfalusi Signed-off-by: Tony Lindgren arch/arm/boot/dts/am335x-evmsk.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit bdd22a41d55bb0068c8685e28839ed9492e96aba Author: Baruch Siach Date: Sun Feb 17 20:21:40 2019 +0200 arm64: dts: clearfog-gt-8k: fix SGMII PHY reset signal The PHY reset signal goes to mpp43 on CP0. Fixes: babc5544c293 ("arm64: dts: clearfog-gt-8k: 1G eth PHY reset signal") Reported-by: Denis Odintsov Signed-off-by: Baruch Siach Signed-off-by: Gregory CLEMENT arch/arm64/boot/dts/marvell/armada-8040-clearfog-gt-8k.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6fc979179c98d2591784937d5618edc3e5cd31c1 Author: Thomas Petazzoni Date: Fri Feb 15 16:30:42 2019 +0100 ARM: dts: armada-xp: fix Armada XP boards NAND description Commit 3b79919946cd2cf4dac47842afc9a893acec4ed7 ("ARM: dts: armada-370-xp: update NAND node with new bindings") updated some Marvell Armada DT description to use the new NAND controller bindings, but did it incorrectly for a number of boards: armada-xp-gp, armada-xp-db and armada-xp-lenovo-ix4-300d. Due to this, the NAND is no longer detected on those platforms. This commit fixes that by properly using the new NAND DT binding. This commit was runtime-tested on Armada XP GP, the two other platforms are only compile-tested. Fixes: 3b79919946cd2 ("ARM: dts: armada-370-xp: update NAND node with new bindings") Cc: Miquel Raynal Signed-off-by: Thomas Petazzoni Signed-off-by: Gregory CLEMENT arch/arm/boot/dts/armada-xp-db.dts | 46 ++++++------- arch/arm/boot/dts/armada-xp-gp.dts | 13 ++-- arch/arm/boot/dts/armada-xp-lenovo-ix4-300d.dts | 85 +++++++++++++------------ 3 files changed, 76 insertions(+), 68 deletions(-) commit 268836649c07e0d38866006b5e94294b5bbc9806 Merge: c8c6ee611926 19dd0777773a Author: Takashi Iwai Date: Tue Feb 19 12:35:55 2019 +0100 Merge tag 'asoc-fix-v5.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v5.0 A few small fixes, a driver fix for Samsung, a fix for refcounting of of_nodes in the simple-card driver that triggered on a lot of systems and a fix for topology error handling. commit 8cbd468bdeb5ed3acac2d7a9f7494d5b77e46297 Author: Yangtao Li Date: Sat Feb 16 11:31:48 2019 -0500 cpufreq: scmi: Fix use-after-free in scmi_cpufreq_exit() This issue was detected with the help of Coccinelle. So change the order of function calls to fix it. Fixes: 1690d8bb91e37 (cpufreq: scpi/scmi: Fix freeing of dynamic OPPs) Signed-off-by: Yangtao Li Acked-by: Viresh Kumar Acked-by: Sudeep Holla Cc: 4.20+ # 4.20+ Signed-off-by: Rafael J. Wysocki drivers/cpufreq/scmi-cpufreq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5cd856a5ef9aa189df757c322be34ad735a5b17f Merge: 1f43f400a2cb c93a49b9769e Author: David S. Miller Date: Mon Feb 18 17:56:30 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter/IPVS fixes for net The following patchset contains Netfilter/IPVS fixes for net: 1) Follow up patch to fix a compilation warning in a recent IPVS fix: 098e13f5b21d ("ipvs: fix dependency on nf_defrag_ipv6"). 2) Bogus ENOENT error on flush after rule deletion in the same batch, reported by Phil Sutter. ==================== Signed-off-by: David S. Miller commit 1f43f400a2cbb02f3d34de8fe30075c070254816 Author: Murali Karicheri Date: Mon Feb 18 15:10:51 2019 -0500 net: netcp: Fix ethss driver probe issue Recent commit below has introduced a bug in netcp driver that causes the ethss driver probe failure and thus break the networking function on K2 SoCs such as K2HK, K2L, K2E etc. This patch fixes the issue to restore networking on the above SoCs. Fixes: 21c328dcecfc ("net: ethernet: Convert to using %pOFn instead of device_node.name") Signed-off-by: Murali Karicheri Signed-off-by: David S. Miller drivers/net/ethernet/ti/netcp_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4d96e13ee9cd1f7f801e8c7f4b12f09d1da4a5d8 Author: Salil Mehta Date: Mon Feb 18 17:40:32 2019 +0000 net: hns: Fixes the missing put_device in positive leg for roce reset This patch fixes the missing device reference release-after-use in the positive leg of the roce reset API of the HNS DSAF. Fixes: c969c6e7ab8c ("net: hns: Fix object reference leaks in hns_dsaf_roce_reset()") Reported-by: John Garry Signed-off-by: Salil Mehta Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c | 3 +++ 1 file changed, 3 insertions(+) commit 92a8c299a75d1397551bc067f6a26211346abf15 Merge: 8a7493e58ad6 d04ca383860b Author: David S. Miller Date: Mon Feb 18 17:40:47 2019 -0800 Merge tag 'wireless-drivers-for-davem-2019-02-18' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== wireless-drivers fixes for 5.0 Hopefully the last set of fixes for 5.0, only fix this time. mt76 * fix regression with resume on mt76x0u USB devices ==================== Signed-off-by: David S. Miller commit 8a7493e58ad688eb23b81e45461c5d314f4402f1 Author: Jose Abreu Date: Mon Feb 18 14:35:03 2019 +0100 net: stmmac: Fix a race in EEE enable callback We are saving the status of EEE even before we try to enable it. This leads to a race with XMIT function that tries to arm EEE timer before we set it up. Fix this by only saving the EEE parameters after all operations are performed with success. Signed-off-by: Jose Abreu Fixes: d765955d2ae0 ("stmmac: add the Energy Efficient Ethernet support") Cc: Joao Pinto Cc: David S. Miller Cc: Giuseppe Cavallaro Cc: Alexandre Torgue Signed-off-by: David S. Miller .../net/ethernet/stmicro/stmmac/stmmac_ethtool.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) commit 694d79027ef496afe3d87ec1738f5c7fb54e04f5 Merge: 8e29d23e28ee 8be3dadf0405 Author: David S. Miller Date: Mon Feb 18 16:51:54 2019 -0800 Merge branch 'qed-iWARP' Michal Kalderon says: ==================== qed: iWARP - fix some syn related issues. This series fixes two bugs related to iWARP syn processing flow. ==================== Signed-off-by: David S. Miller commit 8be3dadf04050c2907760ec1955ca1c8fbc25585 Author: Michal Kalderon Date: Mon Feb 18 15:24:03 2019 +0200 qed: Fix iWARP syn packet mac address validation. The ll2 forwards all syn packets to the driver without validating the mac address. Add validation check in the driver's iWARP listener flow and drop the packet if it isn't intended for the device. Signed-off-by: Ariel Elior Signed-off-by: Michal Kalderon Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_iwarp.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit 9addc92730df55e2c05e8d3f69267a89d65bcba8 Author: Michal Kalderon Date: Mon Feb 18 15:24:02 2019 +0200 qed: Fix iWARP buffer size provided for syn packet processing. The assumption that the maximum size of a syn packet is 128 bytes is wrong. Tunneling headers were not accounted for. Allocate buffers large enough for mtu. Signed-off-by: Ariel Elior Signed-off-by: Michal Kalderon Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_iwarp.c | 12 ++++++------ drivers/net/ethernet/qlogic/qed/qed_iwarp.h | 1 - 2 files changed, 6 insertions(+), 7 deletions(-) commit 8f5b27347e88b171c755562f0090ce40e514fc00 Author: Alexey Kardashevskiy Date: Mon Feb 18 16:58:01 2019 +1100 powerpc/powernv/sriov: Register IOMMU groups for VFs The compound IOMMU group rework moved iommu_register_group() together in pnv_pci_ioda_setup_iommu_api() (which is a part of ppc_md.pcibios_fixup). As the result, pnv_ioda_setup_bus_iommu_group() does not create groups any more, it only adds devices to groups. This works fine for boot time devices. However IOMMU groups for SRIOV's VFs were added by pnv_ioda_setup_bus_iommu_group() so this got broken: pnv_tce_iommu_bus_notifier() expects a group to be registered for VF and it is not. This adds missing group registration and adds a NULL pointer check into the bus notifier so we won't crash if there is no group, although it is not expected to happen now because of the change above. Example oops seen prior to this patch: $ echo 1 > /sys/bus/pci/devices/0000\:01\:00.0/sriov_numvfs Unable to handle kernel paging request for data at address 0x00000030 Faulting instruction address: 0xc0000000004a6018 Oops: Kernel access of bad area, sig: 11 [#1] LE SMP NR_CPUS=2048 NUMA PowerNV CPU: 46 PID: 7006 Comm: bash Not tainted 4.15-ish NIP: c0000000004a6018 LR: c0000000004a6014 CTR: 0000000000000000 REGS: c000008fc876b400 TRAP: 0300 Not tainted (4.15-ish) MSR: 900000000280b033 CFAR: c000000000d0be20 DAR: 0000000000000030 DSISR: 40000000 SOFTE: 1 ... NIP sysfs_do_create_link_sd.isra.0+0x68/0x150 LR sysfs_do_create_link_sd.isra.0+0x64/0x150 Call Trace: pci_dev_type+0x0/0x30 (unreliable) iommu_group_add_device+0x8c/0x600 iommu_add_device+0xe8/0x180 pnv_tce_iommu_bus_notifier+0xb0/0xf0 notifier_call_chain+0x9c/0x110 blocking_notifier_call_chain+0x64/0xa0 device_add+0x524/0x7d0 pci_device_add+0x248/0x450 pci_iov_add_virtfn+0x294/0x3e0 pci_enable_sriov+0x43c/0x580 mlx5_core_sriov_configure+0x15c/0x2f0 [mlx5_core] sriov_numvfs_store+0x180/0x240 dev_attr_store+0x3c/0x60 sysfs_kf_write+0x64/0x90 kernfs_fop_write+0x1ac/0x240 __vfs_write+0x3c/0x70 vfs_write+0xd8/0x220 SyS_write+0x6c/0x110 system_call+0x58/0x6c Fixes: 0bd971676e68 ("powerpc/powernv/npu: Add compound IOMMU groups") Signed-off-by: Alexey Kardashevskiy Reported-by: Santwana Samantray Signed-off-by: Michael Ellerman arch/powerpc/platforms/powernv/pci-ioda.c | 2 ++ arch/powerpc/platforms/powernv/pci.c | 2 ++ 2 files changed, 4 insertions(+) commit b5372fe5dc84235dbe04998efdede3c4daa866a9 Author: Kees Cook Date: Mon Feb 18 16:36:48 2019 -0800 exec: load_script: Do not exec truncated interpreter path Commit 8099b047ecc4 ("exec: load_script: don't blindly truncate shebang string") was trying to protect against a confused exec of a truncated interpreter path. However, it was overeager and also refused to truncate arguments as well, which broke userspace, and it was reverted. This attempts the protection again, but allows arguments to remain truncated. In an effort to improve readability, helper functions and comments have been added. Co-developed-by: Linus Torvalds Signed-off-by: Kees Cook Cc: Andrew Morton Cc: Oleg Nesterov Cc: Samuel Dionne-Riel Cc: Richard Weinberger Cc: Graham Christensen Cc: Michal Hocko Signed-off-by: Linus Torvalds fs/binfmt_script.c | 57 +++++++++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 48 insertions(+), 9 deletions(-) commit 8e29d23e28ee7fb995a00c1ca7e1a4caf5070b12 Author: David Chen Date: Sat Feb 16 17:16:42 2019 +0800 r8152: Add support for MAC address pass through on RTL8153-BD RTL8153-BD is used in Dell DA300 type-C dongle. It should be added to the whitelist of devices to activate MAC address pass through. Per confirming with Realtek all devices containing RTL8153-BD should activate MAC pass through and there won't use pass through bit on efuse like in RTL8153-AD. Signed-off-by: David Chen Signed-off-by: David S. Miller drivers/net/usb/r8152.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit f2ffff085d287eec499f1fccd682796ad8010303 Author: Wei Yongjun Date: Mon Feb 18 11:29:29 2019 +0100 mac80211: mesh: fix missing unlock on error in table_path_del() spin_lock_bh() is used in table_path_del() but rcu_read_unlock() is used for unlocking. Fix it by using spin_unlock_bh() instead of rcu_read_unlock() in the error handling case. Fixes: b4c3fbe63601 ("mac80211: Use linked list instead of rhashtable walk for mesh tables") Acked-by: Herbert Xu Signed-off-by: Wei Yongjun Signed-off-by: Johannes Berg Signed-off-by: David S. Miller net/mac80211/mesh_pathtbl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit df1a2cb7c74b3d3abc8d8c2d690f82c8ebc3490a Author: Stanislav Fomichev Date: Tue Feb 12 15:42:38 2019 -0800 bpf/test_run: fix unkillable BPF_PROG_TEST_RUN Syzbot found out that running BPF_PROG_TEST_RUN with repeat=0xffffffff makes process unkillable. The problem is that when CONFIG_PREEMPT is enabled, we never see need_resched() return true. This is due to the fact that preempt_enable() (which we do in bpf_test_run_one on each iteration) now handles resched if it's needed. Let's disable preemption for the whole run, not per test. In this case we can properly see whether resched is needed. Let's also properly return -EINTR to the userspace in case of a signal interrupt. See recent discussion: http://lore.kernel.org/netdev/CAH3MdRWHr4N8jei8jxDppXjmw-Nw=puNDLbu1dQOFQHxfU2onA@mail.gmail.com I'll follow up with the same fix bpf_prog_test_run_flow_dissector in bpf-next. Reported-by: syzbot Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann net/bpf/test_run.c | 45 ++++++++++++++++++++++++--------------------- 1 file changed, 24 insertions(+), 21 deletions(-) commit 21d2cb491b9e10bfdf10424673b43cd9eddc2da1 Author: Colin Ian King Date: Sun Feb 17 23:03:31 2019 +0000 net/mlx4_en: fix spelling mistake: "quiting" -> "quitting" There is a spelling mistake in a en_err error message. Fix it. Signed-off-by: Colin Ian King Reviewed-by: Tariq Toukan Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9060cb719e61b685ec0102574e10337fa5f445ea Author: Mao Wenan Date: Mon Feb 18 10:44:44 2019 +0800 net: crypto set sk to NULL when af_alg_release. KASAN has found use-after-free in sockfs_setattr. The existed commit 6d8c50dcb029 ("socket: close race condition between sock_close() and sockfs_setattr()") is to fix this simillar issue, but it seems to ignore that crypto module forgets to set the sk to NULL after af_alg_release. KASAN report details as below: BUG: KASAN: use-after-free in sockfs_setattr+0x120/0x150 Write of size 4 at addr ffff88837b956128 by task syz-executor0/4186 CPU: 2 PID: 4186 Comm: syz-executor0 Not tainted xxx + #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Call Trace: dump_stack+0xca/0x13e print_address_description+0x79/0x330 ? vprintk_func+0x5e/0xf0 kasan_report+0x18a/0x2e0 ? sockfs_setattr+0x120/0x150 sockfs_setattr+0x120/0x150 ? sock_register+0x2d0/0x2d0 notify_change+0x90c/0xd40 ? chown_common+0x2ef/0x510 chown_common+0x2ef/0x510 ? chmod_common+0x3b0/0x3b0 ? __lock_is_held+0xbc/0x160 ? __sb_start_write+0x13d/0x2b0 ? __mnt_want_write+0x19a/0x250 do_fchownat+0x15c/0x190 ? __ia32_sys_chmod+0x80/0x80 ? trace_hardirqs_on_thunk+0x1a/0x1c __x64_sys_fchownat+0xbf/0x160 ? lockdep_hardirqs_on+0x39a/0x5e0 do_syscall_64+0xc8/0x580 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x462589 Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fb4b2c83c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000104 RAX: ffffffffffffffda RBX: 000000000072bfa0 RCX: 0000000000462589 RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000007 RBP: 0000000000000005 R08: 0000000000001000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb4b2c846bc R13: 00000000004bc733 R14: 00000000006f5138 R15: 00000000ffffffff Allocated by task 4185: kasan_kmalloc+0xa0/0xd0 __kmalloc+0x14a/0x350 sk_prot_alloc+0xf6/0x290 sk_alloc+0x3d/0xc00 af_alg_accept+0x9e/0x670 hash_accept+0x4a3/0x650 __sys_accept4+0x306/0x5c0 __x64_sys_accept4+0x98/0x100 do_syscall_64+0xc8/0x580 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 4184: __kasan_slab_free+0x12e/0x180 kfree+0xeb/0x2f0 __sk_destruct+0x4e6/0x6a0 sk_destruct+0x48/0x70 __sk_free+0xa9/0x270 sk_free+0x2a/0x30 af_alg_release+0x5c/0x70 __sock_release+0xd3/0x280 sock_close+0x1a/0x20 __fput+0x27f/0x7f0 task_work_run+0x136/0x1b0 exit_to_usermode_loop+0x1a7/0x1d0 do_syscall_64+0x461/0x580 entry_SYSCALL_64_after_hwframe+0x49/0xbe Syzkaller reproducer: r0 = perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) getrusage(0x0, 0x0) bind(r1, &(0x7f00000001c0)=@alg={0x26, 'hash\x00', 0x0, 0x0, 'sha256-ssse3\x00'}, 0x80) r2 = accept(r1, 0x0, 0x0) r3 = accept4$unix(r2, 0x0, 0x0, 0x0) r4 = dup3(r3, r0, 0x0) fchownat(r4, &(0x7f00000000c0)='\x00', 0x0, 0x0, 0x1000) Fixes: 6d8c50dcb029 ("socket: close race condition between sock_close() and sockfs_setattr()") Signed-off-by: Mao Wenan Signed-off-by: David S. Miller crypto/af_alg.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 19dd0777773ab17b4d97f7105e836867c0cdecb4 Author: Kuninori Morimoto Date: Fri Feb 15 15:31:29 2019 +0900 ASoC: simple-card: fixup refcount_t underflow commit da215354eb55c ("ASoC: simple-card: merge simple-scu-card") merged simple-card and simple-scu-card. Then it had refcount underflow bug. This patch fixup it. We will get below error without this patch. OF: ERROR: Bad of_node_put() on /sound CPU: 3 PID: 237 Comm: kworker/3:1 Not tainted 5.0.0-rc6+ #1514 Hardware name: Renesas H3ULCB Kingfisher board based on r8a7795 ES2.0+ (DT) Workqueue: events deferred_probe_work_func Call trace: dump_backtrace+0x0/0x150 show_stack+0x24/0x30 dump_stack+0xb0/0xec of_node_release+0xd0/0xd8 kobject_put+0x74/0xe8 of_node_put+0x24/0x30 __of_get_next_child+0x50/0x70 of_get_next_child+0x40/0x68 asoc_simple_card_probe+0x604/0x730 platform_drv_probe+0x58/0xa8 ... Reported-by: Vicente Bergas Signed-off-by: Kuninori Morimoto Signed-off-by: Mark Brown sound/soc/generic/simple-card.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 304017d31df36fb61eb2ed3ebf65fb6870b3c731 Author: Bard liao Date: Sun Feb 17 21:23:47 2019 +0800 ASoC: topology: free created components in tplg load error Topology resources are no longer needed if any element failed to load. Signed-off-by: Bard liao Signed-off-by: Mark Brown sound/soc/soc-topology.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 301e361072e56a6d6afbf952ae5e746dc8bbb865 Merge: 3ddc14e25e7f d7bf31a0f85f Author: Linus Torvalds Date: Mon Feb 18 10:03:19 2019 -0800 Merge tag 'mailbox-fixes-v5.0-rc7' of git://git.linaro.org/landing-teams/working/fujitsu/integration Pull mailbox fixes from Jassi Brar: - API: Fix build breakge by exporting the function mbox_flush - BRCM: Fix FlexRM ring flush timeout issue * tag 'mailbox-fixes-v5.0-rc7' of git://git.linaro.org/landing-teams/working/fujitsu/integration: mailbox: bcm-flexrm-mailbox: Fix FlexRM ring flush timeout issue mailbox: Export mbox_flush() commit 3ddc14e25e7fef143d35fdd0cad1e8dcf48efaa7 Merge: 10f490217313 fc67e6f120a3 Author: Linus Torvalds Date: Mon Feb 18 09:59:28 2019 -0800 Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM fixes from Russell King: "A few ARM fixes: - Dietmar Eggemann noticed an issue with IRQ migration during CPU hotplug stress testing. - Mathieu Desnoyers noticed that a previous fix broke optimised kprobes. - Robin Murphy noticed a case where we were not clearing the dma_ops" * tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm: ARM: 8835/1: dma-mapping: Clear DMA ops on teardown ARM: 8834/1: Fix: kprobes: optimized kprobes illegal instruction ARM: 8824/1: fix a migrating irq bug when hotplug cpu commit 10f4902173130fcbb02a69566fefab35fc5f1f30 Merge: a3b22b9f11d9 9e7382153f80 Author: Linus Torvalds Date: Mon Feb 18 09:40:16 2019 -0800 Merge tag 'trace-v5.0-rc4-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fixes from Steven Rostedt: "Two more tracing fixes - Have kprobes not use copy_from_user() to access kernel addresses, because kprobes can legitimately poke at bad kernel memory, which will fault. Copy from user code should never fault in kernel space. Using probe_mem_read() can handle kernel address space faulting. - Put back the entries counter in the tracing output that was accidentally removed" * tag 'trace-v5.0-rc4-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing: Fix number of entries in trace header kprobe: Do not use uaccess functions to access kernel memory that can fault commit 04242ff3ac0abbaa4362f97781dac268e6c3541a Author: Yan, Zheng Date: Mon Feb 11 15:18:52 2019 +0800 ceph: avoid repeatedly adding inode to mdsc->snap_flush_list Otherwise, mdsc->snap_flush_list may get corrupted. Cc: stable@vger.kernel.org Signed-off-by: "Yan, Zheng" Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov fs/ceph/snap.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 0fd3fd0a9bb0b02b6435bb7070e9f7b82a23f068 Author: Ilya Dryomov Date: Tue Feb 5 20:30:27 2019 +0100 libceph: handle an empty authorize reply The authorize reply can be empty, for example when the ticket used to build the authorizer is too old and TAG_BADAUTHORIZER is returned from the service. Calling ->verify_authorizer_reply() results in an attempt to decrypt and validate (somewhat) random data in au->buf (most likely the signature block from calc_signature()), which fails and ends up in con_fault_finish() with !con->auth_retry. The ticket isn't invalidated and the connection is retried again and again until a new ticket is obtained from the monitor: libceph: osd2 192.168.122.1:6809 bad authorize reply libceph: osd2 192.168.122.1:6809 bad authorize reply libceph: osd2 192.168.122.1:6809 bad authorize reply libceph: osd2 192.168.122.1:6809 bad authorize reply Let TAG_BADAUTHORIZER handler kick in and increment con->auth_retry. Cc: stable@vger.kernel.org Fixes: 5c056fdc5b47 ("libceph: verify authorize reply on connect") Link: https://tracker.ceph.com/issues/20164 Signed-off-by: Ilya Dryomov Reviewed-by: Sage Weil net/ceph/messenger.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) commit d7bf31a0f85faaf63c63c39d55154825a1eaaea9 Author: Rayagonda Kokatanur Date: Mon Feb 4 11:21:29 2019 -0800 mailbox: bcm-flexrm-mailbox: Fix FlexRM ring flush timeout issue RING_CONTROL reg was not written due to wrong address, hence all the subsequent ring flush was timing out. Fixes: a371c10ea4b3 ("mailbox: bcm-flexrm-mailbox: Fix FlexRM ring flush sequence") Signed-off-by: Rayagonda Kokatanur Signed-off-by: Ray Jui Reviewed-by: Scott Branden Signed-off-by: Jassi Brar drivers/mailbox/bcm-flexrm-mailbox.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 4f0557795e76d049f0a1687f1f050addf4df2dac Author: Thierry Reding Date: Mon Feb 4 15:07:06 2019 +0100 mailbox: Export mbox_flush() The mbox_flush() function can be used by drivers that are built as modules, so the function needs to be exported. Reported-by: Mark Brown Signed-off-by: Thierry Reding Signed-off-by: Jassi Brar drivers/mailbox/mailbox.c | 1 + 1 file changed, 1 insertion(+) commit 0738c8b5915c7eaf1e6007b441008e8f3b460443 Author: Nathan Chancellor Date: Thu Feb 14 18:39:59 2019 -0700 arm64/neon: Disable -Wincompatible-pointer-types when building with Clang After commit cc9f8349cb33 ("arm64: crypto: add NEON accelerated XOR implementation"), Clang builds for arm64 started failing with the following error message. arch/arm64/lib/xor-neon.c:58:28: error: incompatible pointer types assigning to 'const unsigned long *' from 'uint64_t *' (aka 'unsigned long long *') [-Werror,-Wincompatible-pointer-types] v3 = veorq_u64(vld1q_u64(dp1 + 6), vld1q_u64(dp2 + 6)); ^~~~~~~~ /usr/lib/llvm-9/lib/clang/9.0.0/include/arm_neon.h:7538:47: note: expanded from macro 'vld1q_u64' __ret = (uint64x2_t) __builtin_neon_vld1q_v(__p0, 51); \ ^~~~ There has been quite a bit of debate and triage that has gone into figuring out what the proper fix is, viewable at the link below, which is still ongoing. Ard suggested disabling this warning with Clang with a pragma so no neon code will have this type of error. While this is not at all an ideal solution, this build error is the only thing preventing KernelCI from having successful arm64 defconfig and allmodconfig builds on linux-next. Getting continuous integration running is more important so new warnings/errors or boot failures can be caught and fixed quickly. Link: https://github.com/ClangBuiltLinux/linux/issues/283 Suggested-by: Ard Biesheuvel Acked-by: Ard Biesheuvel Signed-off-by: Nathan Chancellor Signed-off-by: Will Deacon arch/arm64/include/asm/neon-intrinsics.h | 4 ++++ 1 file changed, 4 insertions(+) commit f54dada8274643e3ff4436df0ea124aeedc43cae Author: Mark Rutland Date: Fri Feb 15 16:34:27 2019 +0000 arm64: fix SSBS sanitization In valid_user_regs() we treat SSBS as a RES0 bit, and consequently it is unexpectedly cleared when we restore a sigframe or fiddle with GPRs via ptrace. This patch fixes valid_user_regs() to account for this, updating the function to refer to the latest ARM ARM (ARM DDI 0487D.a). For AArch32 tasks, SSBS appears in bit 23 of SPSR_EL1, matching its position in the AArch32-native PSR format, and we don't need to translate it as we have to for DIT. There are no other bit assignments that we need to account for today. As the recent documentation describes the DIT bit, we can drop our comment regarding DIT. While removing SSBS from the RES0 masks, existing inconsistent whitespace is corrected. Fixes: d71be2b6c0e19180 ("arm64: cpufeature: Detect SSBS and advertise to userspace") Signed-off-by: Mark Rutland Cc: Catalin Marinas Cc: Suzuki K Poulose Cc: Will Deacon Signed-off-by: Will Deacon arch/arm64/kernel/ptrace.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) commit 660899ddf06ae8bb5bbbd0a19418b739375430c5 Author: Tobias Brunner Date: Mon Feb 18 10:49:39 2019 +0100 xfrm: Fix inbound traffic via XFRM interfaces across network namespaces After moving an XFRM interface to another namespace it stays associated with the original namespace (net in `struct xfrm_if` and the list keyed with `xfrmi_net_id`), allowing processes in the new namespace to use SAs/policies that were created in the original namespace. For instance, this allows a keying daemon in one namespace to establish IPsec SAs for other namespaces without processes there having access to the keys or IKE credentials. This worked fine for outbound traffic, however, for inbound traffic the lookup for the interfaces and the policies used the incorrect namespace (the one the XFRM interface was moved to). Fixes: f203b76d7809 ("xfrm: Add virtual xfrm interfaces") Signed-off-by: Tobias Brunner Signed-off-by: Steffen Klassert net/xfrm/xfrm_interface.c | 4 ++-- net/xfrm/xfrm_policy.c | 4 +++- 2 files changed, 5 insertions(+), 3 deletions(-) commit a3b22b9f11d9fbc48b0291ea92259a5a810e9438 Author: Linus Torvalds Date: Sun Feb 17 18:46:40 2019 -0800 Linux 5.0-rc7 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 254a1a2b2c2eb4332e9f8d73f7cd35b97abc6493 Merge: e09c6a4ec1bb 3bed3cc4156e Author: David S. Miller Date: Sun Feb 17 15:48:43 2019 -0800 Merge branch 'netdev-page_frag_alloc-fixes' Alexander Duyck says: ==================== Address recent issues found in netdev page_frag_alloc usage This patch set addresses a couple of issues that I had pointed out to Jann Horn in response to a recent patch submission. The first issue is that I wanted to avoid the need to read/modify/write the size value in order to generate the value for pagecnt_bias. Instead we can just use a fixed constant which reduces the need for memory read operations and the overall number of instructions to update the pagecnt bias values. The other, and more important issue is, that apparently we were letting tun access the napi_alloc_cache indirectly through netdev_alloc_frag and as a result letting it create unaligned accesses via unaligned allocations. In order to prevent this I have added a call to SKB_DATA_ALIGN for the fragsz field so that we will keep the offset in the napi_alloc_cache SMP_CACHE_BYTES aligned. ==================== Signed-off-by: David S. Miller commit 3bed3cc4156eedf652b4df72bdb35d4f1a2a739d Author: Alexander Duyck Date: Fri Feb 15 14:44:18 2019 -0800 net: Do not allocate page fragments that are not skb aligned This patch addresses the fact that there are drivers, specifically tun, that will call into the network page fragment allocators with buffer sizes that are not cache aligned. Doing this could result in data alignment and DMA performance issues as these fragment pools are also shared with the skb allocator and any other devices that will use napi_alloc_frags or netdev_alloc_frags. Fixes: ffde7328a36d ("net: Split netdev_alloc_frag into __alloc_page_frag and add __napi_alloc_frag") Reported-by: Jann Horn Signed-off-by: Alexander Duyck Signed-off-by: David S. Miller net/core/skbuff.c | 4 ++++ 1 file changed, 4 insertions(+) commit 8644772637deb121f7ac2df690cbf83fa63d3b70 Author: Alexander Duyck Date: Fri Feb 15 14:44:12 2019 -0800 mm: Use fixed constant in page_frag_alloc instead of size + 1 This patch replaces the size + 1 value introduced with the recent fix for 1 byte allocs with a constant value. The idea here is to reduce code overhead as the previous logic would have to read size into a register, then increment it, and write it back to whatever field was being used. By using a constant we can avoid those memory reads and arithmetic operations in favor of just encoding the maximum value into the operation itself. Fixes: 2c2ade81741c ("mm: page_alloc: fix ref bias in page_frag_alloc() for 1-byte allocs") Signed-off-by: Alexander Duyck Signed-off-by: David S. Miller mm/page_alloc.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit e09c6a4ec1bb9ed73b4157b69c261e408d875b0f Merge: e928b5d6b75e 2c4cc9712364 Author: David S. Miller Date: Sun Feb 17 15:46:59 2019 -0800 Merge branch 'tcp-fix-possible-crash-in-tcp_v4_err' Eric Dumazet says: ==================== tcp: fix possible crash in tcp_v4_err() soukjin bae reported a crash in tcp_v4_err() that we root caused to a missing initialization. Second patch adds a sanity check in tcp_v4_err() to avoid future potential problems. Ignoring an ICMP message is probably better than crashing a machine. ==================== Signed-off-by: David S. Miller commit 2c4cc9712364c051b1de2d175d5fbea6be948ebf Author: Eric Dumazet Date: Fri Feb 15 13:36:21 2019 -0800 tcp: tcp_v4_err() should be more careful ICMP handlers are not very often stressed, we should make them more resilient to bugs that might surface in the future. If there is no packet in retransmit queue, we should avoid a NULL deref. Signed-off-by: Eric Dumazet Reported-by: soukjin bae Acked-by: Neal Cardwell Acked-by: Soheil Hassas Yeganeh Signed-off-by: David S. Miller net/ipv4/tcp_ipv4.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 04c03114be82194d4a4858d41dba8e286ad1787c Author: Eric Dumazet Date: Fri Feb 15 13:36:20 2019 -0800 tcp: clear icsk_backoff in tcp_write_queue_purge() soukjin bae reported a crash in tcp_v4_err() handling ICMP_DEST_UNREACH after tcp_write_queue_head(sk) returned a NULL pointer. Current logic should have prevented this : if (seq != tp->snd_una || !icsk->icsk_retransmits || !icsk->icsk_backoff || fastopen) break; Problem is the write queue might have been purged and icsk_backoff has not been cleared. Signed-off-by: Eric Dumazet Reported-by: soukjin bae Acked-by: Neal Cardwell Signed-off-by: David S. Miller net/ipv4/tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e928b5d6b75e239feb9c6d5488974b6646a0ebc8 Author: Alexey Khoroshilov Date: Sat Feb 16 00:20:54 2019 +0300 net: mv643xx_eth: disable clk on error path in mv643xx_eth_shared_probe() If mv643xx_eth_shared_of_probe() fails, mv643xx_eth_shared_probe() leaves clk enabled. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov Signed-off-by: David S. Miller drivers/net/ethernet/marvell/mv643xx_eth.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 97dc47a1308a3af46a09b1546cfb869f2e382a81 Author: Beniamino Galvani Date: Fri Feb 15 13:20:42 2019 +0100 qmi_wwan: apply SET_DTR quirk to Sierra WP7607 The 1199:68C0 USB ID is reused by Sierra WP7607 which requires the DTR quirk to be detected. Apply QMI_QUIRK_SET_DTR unconditionally as already done for other IDs shared between different devices. Signed-off-by: Beniamino Galvani Acked-by: Bjørn Mork Signed-off-by: David S. Miller drivers/net/usb/qmi_wwan.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 4012e7d09d99b62d80046790657c0b0e32310d50 Author: Alexandre Torgue Date: Fri Feb 15 10:49:09 2019 +0100 net: stmmac: handle endianness in dwmac4_get_timestamp GMAC IP is little-endian and used on several kind of CPU (big or little endian). Main callbacks functions of the stmmac drivers take care about it. It was not the case for dwmac4_get_timestamp function. Fixes: ba1ffd74df74 ("stmmac: fix PTP support for GMAC4") Signed-off-by: Alexandre Torgue Signed-off-by: David S. Miller drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 31a1b8d528fa4aedaa207b38d7fafc4e9b0a0d6c Author: Petr Vorel Date: Fri Feb 15 00:43:27 2019 +0100 doc: Mention MSG_ZEROCOPY implementation for UDP MSG_ZEROCOPY implementation for UDP was merged in v5.0, 6e360f733113 ("Merge branch 'udp-msg_zerocopy'"). Signed-off-by: Petr Vorel Signed-off-by: David S. Miller Documentation/networking/msg_zerocopy.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0358affb5cd8bbd685a6ab163a36dd28a818da73 Author: Arnd Bergmann Date: Tue Feb 12 15:41:01 2019 +0100 Documentation: change linux-4.x references to 5.x As linux-5.0.x is coming up soon, the documentation should match, in particular the README.rst file, so change all 4.x references accordingly. There was a mix of lowercase and uppercase X here, which I changed to using lowercase consistently. Signed-off-by: Arnd Bergmann Signed-off-by: Jonathan Corbet Documentation/admin-guide/README.rst | 32 +++--- Documentation/process/applying-patches.rst | 117 +++++++++++---------- .../translations/it_IT/admin-guide/README.rst | 2 +- 3 files changed, 78 insertions(+), 73 deletions(-) commit c17abcfa93bf0be5e48bb011607d237ac2bfc839 Author: Martin Blumenstingl Date: Sat Feb 9 02:01:01 2019 +0100 pinctrl: meson: meson8b: fix the sdxc_a data 1..3 pins Fix the mismatch between the "sdxc_d13_1_a" pin group definition from meson8b_cbus_groups and the entry in sdxc_a_groups ("sdxc_d0_13_1_a"). This makes it possible to use "sdxc_d13_1_a" in device-tree files to route the MMC data 1..3 pins to GPIOX_1..3. Fixes: 0fefcb6876d0d6 ("pinctrl: Add support for Meson8b") Signed-off-by: Martin Blumenstingl Signed-off-by: Linus Walleij drivers/pinctrl/meson/pinctrl-meson8b.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 289460404f6947ef1c38e67d680be9a84161250b Author: Petr Machata Date: Sun Feb 17 07:18:41 2019 +0000 mlxsw: __mlxsw_sp_port_headroom_set(): Fix a use of local variable The function-local variable "delay" enters the loop interpreted as delay in bits. However, inside the loop it gets overwritten by the result of mlxsw_sp_pg_buf_delay_get(), and thus leaves the loop as quantity in cells. Thus on second and further loop iterations, the headroom for a given priority is configured with a wrong size. Fix by introducing a loop-local variable, delay_cells. Rename thres to thres_cells for consistency. Fixes: f417f04da589 ("mlxsw: spectrum: Refactor port buffer configuration") Signed-off-by: Petr Machata Acked-by: Jiri Pirko Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) commit 2fee036af043fa07ab19cbe8a7350fc685bd8be1 Merge: 8d33316d5205 582a32e70882 Author: Linus Torvalds Date: Sun Feb 17 09:22:01 2019 -0800 Merge branch 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull EFI fixes from Ingo Molnar: "This tree reverts a GICv3 commit (which was broken) and fixes it in another way, by adding a memblock build-time entries quirk for ARM64" * 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: efi/arm: Revert "Defer persistent reservations until after paging_init()" arm64, mm, efi: Account for GICv3 LPI tables in static memblock reserve table commit 8d33316d520501f24fef180ea5b860ecb9e64506 Merge: dd6f29da695d f331e766c4be Author: Linus Torvalds Date: Sun Feb 17 08:44:38 2019 -0800 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "Three changes: - An UV fix/quirk to pull UV BIOS calls into the efi_runtime_lock locking regime. (This done by aliasing __efi_uv_runtime_lock to efi_runtime_lock, which should make the quirk nature obvious and maintain the general policy that the EFI lock (name...) isn't exposed to drivers.) - Our version of MAGA: Make a.out Great Again. - Add a new Intel model name enumerator to an upstream header to help reduce dependencies going forward" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/platform/UV: Use efi_runtime_lock to serialise BIOS calls x86/CPU: Add Icelake model number x86/a.out: Clear the dump structure initially commit dd6f29da695dbfe5a8ff84ebfdd2110d68e8f511 Merge: c5f1ac5e9afb 528871b45602 Author: Linus Torvalds Date: Sun Feb 17 08:38:13 2019 -0800 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Ingo Molnar: "Two fixes on the kernel side: fix an over-eager condition that failed larger perf ring-buffer sizes, plus fix crashes in the Intel BTS code for a corner case, found by fuzzing" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/core: Fix impossible ring-buffer sizes warning perf/x86: Add check_period PMU callback commit c5f1ac5e9afb199638414be77cbc22eb68e14d97 Merge: 0513ebc33ed6 a58007621be3 Author: Linus Torvalds Date: Sun Feb 17 08:36:21 2019 -0800 Merge tag 'powerpc-5.0-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fix from Michael Ellerman: "Just one fix, for pgd/pud_present() which were broken on big endian since v4.20, leading to possible data corruption. Thanks to: Aneesh Kumar K.V., Erhard F., Jan Kara" * tag 'powerpc-5.0-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/64s: Fix possible corruption on big endian due to pgd/pud_present() commit 0513ebc33ed6b590bfbaaf21cd7b3d571c20edb9 Merge: 1653c2f2da01 131aee8b9807 Author: Linus Torvalds Date: Sun Feb 17 08:34:10 2019 -0800 Merge tag 'csky-for-linus-5.0-rc6' of git://github.com/c-sky/csky-linux Pull arch/csky fixes from Guo Ren: "Here are some fixup patches for 5.0-rc6" * tag 'csky-for-linus-5.0-rc6' of git://github.com/c-sky/csky-linux: csky: Fixup dead loop in show_stack csky: Fixup io-range page attribute for mmap("/dev/mem") csky: coding convention: Use task_stack_page csky: Fixup wrong pt_regs size csky: Fixup _PAGE_GLOBAL bit for 610 tlb entry commit 1653c2f2da0153f386b3b7494dc077631ae982c8 Merge: b8c82b6a3a8b f275a4659484 Author: Linus Torvalds Date: Sun Feb 17 08:32:25 2019 -0800 Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "Two more driver bugfixes" * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: bcm2835: Clear current buffer pointers and counts after a transfer i2c: cadence: Fix the hold bit setting commit b8c82b6a3a8bee7858df08d25f5ddcfbe6210a69 Merge: ed0a0ec98ffc 7ad222b3aed3 Author: Linus Torvalds Date: Sun Feb 17 08:30:35 2019 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - tweaks to Elan drivers (both PS/2 and I2C) to support new devices. Also revert of one of IDs as that device should really be driven by i2c-hid + hid-multitouch - a few drivers have been switched to set_brightness_blocking() call because they either were sleeping the their set_brightness() implementation or used workqueue but were not canceling it on unbind. - ps2-gpio and matrix_keypad needed to [properly] flush their works to avoid potential use-after-free on unbind. - other miscellaneous fixes. * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: elan_i2c - add ACPI ID for touchpad in Lenovo V330-15ISK Input: st-keyscan - fix potential zalloc NULL dereference Input: apanel - switch to using brightness_set_blocking() Revert "Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G" Input: qt2160 - switch to using brightness_set_blocking() Input: matrix_keypad - use flush_delayed_work() Input: ps2-gpio - flush TX work when closing port Input: cap11xx - switch to using set_brightness_blocking() Input: elantech - enable 3rd button support on Fujitsu CELSIUS H780 Input: bma150 - register input device after setting private data Input: pwm-vibra - stop regulator after disabling pwm, not before Input: pwm-vibra - prevent unbalanced regulator Input: snvs_pwrkey - allow selecting driver for i.MX 7D commit ed0a0ec98ffcaa67f8cb3e6237cdf6f29acd9481 Merge: 64c0133eb88a 98ae70cc476e Author: Linus Torvalds Date: Sun Feb 17 08:28:49 2019 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM fixes from Paolo Bonzini: "A somewhat bigger ARM update, and the usual smattering of x86 bug fixes" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: kvm: vmx: Fix entry number check for add_atomic_switch_msr() KVM: x86: Recompute PID.ON when clearing PID.SN KVM: nVMX: Restore a preemption timer consistency check x86/kvm/nVMX: read from MSR_IA32_VMX_PROCBASED_CTLS2 only when it is available KVM: arm64: Forbid kprobing of the VHE world-switch code KVM: arm64: Relax the restriction on using stage2 PUD huge mapping arm: KVM: Add missing kvm_stage2_has_pmd() helper KVM: arm/arm64: vgic: Always initialize the group of private IRQs arm/arm64: KVM: Don't panic on failure to properly reset system registers arm/arm64: KVM: Allow a VCPU to fully reset itself KVM: arm/arm64: Reset the VCPU without preemption and vcpu state loaded arm64: KVM: Don't generate UNDEF when LORegion feature is present KVM: arm/arm64: vgic: Make vgic_cpu->ap_list_lock a raw_spinlock KVM: arm/arm64: vgic: Make vgic_dist->lpi_list_lock a raw_spinlock KVM: arm/arm64: vgic: Make vgic_irq->irq_lock a raw_spinlock commit 7ad222b3aed350adfc27ee7eec4587ffe55dfdce Author: Mauro Ciancio Date: Mon Jan 14 10:24:53 2019 -0300 Input: elan_i2c - add ACPI ID for touchpad in Lenovo V330-15ISK This adds ELAN0617 to the ACPI table to support Elan touchpad found in Lenovo V330-15ISK. Signed-off-by: Mauro Ciancio Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov drivers/input/mouse/elan_i2c_core.c | 1 + 1 file changed, 1 insertion(+) commit 6e1077f51436e5ca9c415aec503333de1187b89a Merge: 8681ef1f3d29 1910faebf61d Author: David S. Miller Date: Sat Feb 16 22:34:07 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Alexei Starovoitov says: ==================== pull-request: bpf 2019-02-16 The following pull-request contains BPF updates for your *net* tree. The main changes are: 1) fix lockdep false positive in bpf_get_stackid(), from Alexei. 2) several AF_XDP fixes, from Bjorn, Magnus, Davidlohr. 3) fix narrow load from struct bpf_sock, from Martin. 4) mips JIT fixes, from Paul. 5) gso handling fix in bpf helpers, from Willem. ==================== Signed-off-by: David S. Miller commit 2439d37e1bf8a34d437573c086572abe0f3f1b15 Author: Gabriel Fernandez Date: Sat Feb 16 21:10:16 2019 -0800 Input: st-keyscan - fix potential zalloc NULL dereference This patch fixes the following static checker warning: drivers/input/keyboard/st-keyscan.c:156 keyscan_probe() error: potential zalloc NULL dereference: 'keypad_data->input_dev' Reported-by: Dan Carpenter Signed-off-by: Gabriel Fernandez Signed-off-by: Dmitry Torokhov drivers/input/keyboard/st-keyscan.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 1cd48dc51857899e8fb28dd45d4b936c94ea1dab Author: Dmitry Torokhov Date: Wed Feb 6 10:32:46 2019 -0800 Input: apanel - switch to using brightness_set_blocking() Now that LEDs core allows "blocking" flavor of "set brightness" method we can use it and get rid of private work item. As a bonus, we are no longer forgetting to cancel it when we unbind the driver. Reviewed-by: Sven Van Asbroeck Signed-off-by: Dmitry Torokhov drivers/input/misc/apanel.c | 24 ++++-------------------- 1 file changed, 4 insertions(+), 20 deletions(-) commit a58007621be33e9f7c7bed5d5ff8ecb914e1044a Author: Michael Ellerman Date: Thu Feb 14 15:00:36 2019 +1100 powerpc/64s: Fix possible corruption on big endian due to pgd/pud_present() In v4.20 we changed our pgd/pud_present() to check for _PAGE_PRESENT rather than just checking that the value is non-zero, e.g.: static inline int pgd_present(pgd_t pgd) { - return !pgd_none(pgd); + return (pgd_raw(pgd) & cpu_to_be64(_PAGE_PRESENT)); } Unfortunately this is broken on big endian, as the result of the bitwise & is truncated to int, which is always zero because _PAGE_PRESENT is 0x8000000000000000ul. This means pgd_present() and pud_present() are always false at compile time, and the compiler elides the subsequent code. Remarkably with that bug present we are still able to boot and run with few noticeable effects. However under some work loads we are able to trigger a warning in the ext4 code: WARNING: CPU: 11 PID: 29593 at fs/ext4/inode.c:3927 .ext4_set_page_dirty+0x70/0xb0 CPU: 11 PID: 29593 Comm: debugedit Not tainted 4.20.0-rc1 #1 ... NIP .ext4_set_page_dirty+0x70/0xb0 LR .set_page_dirty+0xa0/0x150 Call Trace: .set_page_dirty+0xa0/0x150 .unmap_page_range+0xbf0/0xe10 .unmap_vmas+0x84/0x130 .unmap_region+0xe8/0x190 .__do_munmap+0x2f0/0x510 .__vm_munmap+0x80/0x110 .__se_sys_munmap+0x14/0x30 system_call+0x5c/0x70 The fix is simple, we need to convert the result of the bitwise & to an int before returning it. Thanks to Erhard, Jan Kara and Aneesh for help with debugging. Fixes: da7ad366b497 ("powerpc/mm/book3s: Update pmd_present to look at _PAGE_PRESENT bit") Cc: stable@vger.kernel.org # v4.20+ Reported-by: Erhard F. Reviewed-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman arch/powerpc/include/asm/book3s/64/pgtable.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 64c0133eb88a3b0c11c42580a520fe78b71b3932 Merge: 88fe73cb804a 410d7360541c Author: Linus Torvalds Date: Sat Feb 16 17:44:12 2019 -0800 Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Arnd Bergmann: "This week is a much smaller update, containing fixes only for TI OMAP, NXP i.MX and Rockchips platforms: omap: - omap4 had problems with lost timer interrupts - another IRQ handling issue with OMAP5 - A workaround for a regression in the pwm-omap-dmtimer driver NXP i.MX: - eMMC was broken on the new imx8mq-evk board Rockchip: - a fix for new dtc graph warnings and a regulator fix for rock64 - USB support broke on rk3328-rock64" * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: ARM: OMAP2+: fix lack of timer interrupts on CPU1 after hotplug arm64: dts: imx8mq: Fix boot from eMMC ARM: OMAP2+: Variable "reg" in function omap4_dsi_mux_pads() could be uninitialized ARM: dts: Configure clock parent for pwm vibra bus: ti-sysc: Fix timer handling with drop pm_runtime_irq_safe() arm64: dts: rockchip: enable usb-host regulators at boot on rk3328-rock64 arm64: dts: rockchip: fix graph_port warning on rk3399 bob kevin and excavator ARM: OMAP5+: Fix inverted nirq pin interrupts with irq_set_type clocksource: timer-ti-dm: Fix pwm dmtimer usage of fck reparenting ARM: dts: rockchip: remove qos_cif1 from rk3188 power-domain commit 88fe73cb804abc3d209a06f6221a7108d89ff04f Merge: 55638c520bb7 e7afe6c1d486 Author: Linus Torvalds Date: Sat Feb 16 17:38:01 2019 -0800 Merge tag 'nfsd-5.0-2' of git://linux-nfs.org/~bfields/linux Pull more nfsd fixes from Bruce Fields: "Two small fixes, one for crashes using nfs/krb5 with older enctypes, one that could prevent clients from reclaiming state after a kernel upgrade" * tag 'nfsd-5.0-2' of git://linux-nfs.org/~bfields/linux: sunrpc: fix 4 more call sites that were using stack memory with a scatterlist Revert "nfsd4: return default lease period" commit 55638c520bb7b92999b6f0867ba135b6aeafc8d7 Merge: 9a7dcde4a661 d2ceb7e57086 Author: Linus Torvalds Date: Sat Feb 16 17:33:39 2019 -0800 Merge tag 'nfs-for-5.0-4' of git://git.linux-nfs.org/projects/anna/linux-nfs Pull more NFS client fixes from Anna Schumaker: "Three fixes this time. Nicolas's is for xprtrdma completion vector allocation on single-core systems. Greg's adds an error check when allocating a debugfs dentry. And Ben's is an additional fix for nfs_page_async_flush() to prevent pages from accidentally getting truncated. Summary: - Make sure Send CQ is allocated on an existing compvec - Properly check debugfs dentry before using it - Don't use page_file_mapping() after removing a page" * tag 'nfs-for-5.0-4' of git://git.linux-nfs.org/projects/anna/linux-nfs: NFS: Don't use page_file_mapping after removing the page rpc: properly check debugfs dentry before using it xprtrdma: Make sure Send CQ is allocated on an existing compvec commit 9a7dcde4a661ccad2b641e873b15ce26bf302c4e Merge: 0b999ae3614d 69ef9bc54715 Author: Linus Torvalds Date: Sat Feb 16 17:31:36 2019 -0800 Merge tag 'auxdisplay-for-linus-v5.0-rc7' of git://github.com/ojeda/linux Pull auxdisplay fix from Miguel Ojeda: "Fix potential user-after-free on ht16k33 module unload. Reported by Sven Van Asbroeck" * tag 'auxdisplay-for-linus-v5.0-rc7' of git://github.com/ojeda/linux: auxdisplay: ht16k33: fix potential user-after-free on module unload commit 8681ef1f3d295bd3600315325f3b3396d76d02f6 Author: David S. Miller Date: Sat Feb 16 13:44:39 2019 -0800 net: Add header for usage of fls64() Fixes: 3b89ea9c5902 ("net: Fix for_each_netdev_feature on Big endian") Suggested-by: Eric Dumazet Signed-off-by: David S. Miller include/linux/netdev_features.h | 1 + 1 file changed, 1 insertion(+) commit 0b999ae3614d09d97a1575936bcee884f912b10e Merge: 5ded5871030e a6e60d84989f Author: Linus Torvalds Date: Sat Feb 16 10:28:05 2019 -0800 Merge tag 'compiler-attributes-for-linus-v5.0-rc7' of git://github.com/ojeda/linux Pull compiler attributes fixes from Miguel Ojeda: "Clean the new GCC 9 -Wmissing-attributes warnings The upcoming GCC 9 release extends the -Wmissing-attributes warnings (enabled by -Wall) to C and aliases: it warns when particular function attributes are missing in the aliases but not in their target, e.g.: void __cold f(void) {} void __alias("f") g(void); diagnoses: warning: 'g' specifies less restrictive attribute than its target 'f': 'cold' [-Wmissing-attributes] These patch series clean these new warnings. Most of them are caused by the module_init/exit macros" Link: https://lore.kernel.org/lkml/20190125104353.2791-1-labbott@redhat.com/ * tag 'compiler-attributes-for-linus-v5.0-rc7' of git://github.com/ojeda/linux: include/linux/module.h: copy __init/__exit attrs to init/cleanup_module Compiler Attributes: add support for __copy (gcc >= 9) lib/crc32.c: mark crc32_le_base/__crc32c_le_base aliases as __pure commit 582a32e708823e5957fd73ccd78dc4a9e49d21ea Author: Ard Biesheuvel Date: Fri Feb 15 13:33:33 2019 +0100 efi/arm: Revert "Defer persistent reservations until after paging_init()" This reverts commit eff896288872d687d9662000ec9ae11b6d61766f, which deferred the processing of persistent memory reservations to a point where the memory may have already been allocated and overwritten, defeating the purpose. Signed-off-by: Ard Biesheuvel Acked-by: Will Deacon Cc: Linus Torvalds Cc: Marc Zyngier Cc: Mike Rapoport Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-arm-kernel@lists.infradead.org Cc: linux-efi@vger.kernel.org Link: http://lkml.kernel.org/r/20190215123333.21209-3-ard.biesheuvel@linaro.org Signed-off-by: Ingo Molnar arch/arm64/kernel/setup.c | 1 - drivers/firmware/efi/efi.c | 4 ---- drivers/firmware/efi/libstub/arm-stub.c | 3 --- include/linux/efi.h | 7 ------- 4 files changed, 15 deletions(-) commit 8a5b403d71affa098009cc3dff1b2c45113021ad Author: Ard Biesheuvel Date: Fri Feb 15 13:33:32 2019 +0100 arm64, mm, efi: Account for GICv3 LPI tables in static memblock reserve table In the irqchip and EFI code, we have what basically amounts to a quirk to work around a peculiarity in the GICv3 architecture, which permits the system memory address of LPI tables to be programmable only once after a CPU reset. This means kexec kernels must use the same memory as the first kernel, and thus ensure that this memory has not been given out for other purposes by the time the ITS init code runs, which is not very early for secondary CPUs. On systems with many CPUs, these reservations could overflow the memblock reservation table, and this was addressed in commit: eff896288872 ("efi/arm: Defer persistent reservations until after paging_init()") However, this turns out to have made things worse, since the allocation of page tables and heap space for the resized memblock reservation table itself may overwrite the regions we are attempting to reserve, which may cause all kinds of corruption, also considering that the ITS will still be poking bits into that memory in response to incoming MSIs. So instead, let's grow the static memblock reservation table on such systems so it can accommodate these reservations at an earlier time. This will permit us to revert the above commit in a subsequent patch. [ mingo: Minor cleanups. ] Signed-off-by: Ard Biesheuvel Acked-by: Mike Rapoport Acked-by: Will Deacon Acked-by: Marc Zyngier Cc: Andrew Morton Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-arm-kernel@lists.infradead.org Cc: linux-efi@vger.kernel.org Link: http://lkml.kernel.org/r/20190215123333.21209-2-ard.biesheuvel@linaro.org Signed-off-by: Ingo Molnar arch/arm64/include/asm/memory.h | 11 +++++++++++ include/linux/memblock.h | 3 --- mm/memblock.c | 11 +++++++++-- 3 files changed, 20 insertions(+), 5 deletions(-) commit c93a49b9769e435990c82297aa0baa31e1538790 Author: Andrea Claudi Date: Fri Feb 15 17:51:48 2019 +0100 ipvs: fix warning on unused variable When CONFIG_IP_VS_IPV6 is not defined, build produced this warning: net/netfilter/ipvs/ip_vs_ctl.c:899:6: warning: unused variable ‘ret’ [-Wunused-variable] int ret = 0; ^~~ Fix this by moving the declaration of 'ret' in the CONFIG_IP_VS_IPV6 section in the same function. While at it, drop its unneeded initialisation. Fixes: 098e13f5b21d ("ipvs: fix dependency on nf_defrag_ipv6") Reported-by: Stefano Brivio Signed-off-by: Andrea Claudi Reviewed-by: Stefano Brivio Signed-off-by: Pablo Neira Ayuso net/netfilter/ipvs/ip_vs_ctl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 46f37666381026dc38124af1badae7feb52c0df5 Merge: d5be7f632bad 10163aaee967 Author: David S. Miller Date: Fri Feb 15 20:37:54 2019 -0800 Merge branch 'net-dsa-b53-VLAN-and-L2-fixes' Florian Fainelli says: ==================== net: dsa: b53: VLAN and L2 fixes This patch series contains a collection of fixes to the b53 driver in order to: - consistently program the same default VLAN ID when a port is bridged or not - properly account for VLAN filtering being turned on/off and turning on ingress VID checking accordingly - have SYSTEMPORT properly forward BPDU frames to the network stack (which it did not) - do not assume that WoL is supported by the DSA master network device we are connected to ==================== Signed-off-by: David S. Miller commit 10163aaee9671b01b2f4737922e1a4f43581047a Author: Florian Fainelli Date: Fri Feb 15 12:16:53 2019 -0800 net: dsa: b53: Do not program CPU port's PVID The CPU port is special and does not need to obey VLAN restrictions as far as untagged traffic goes, also, having the CPU port be part of a particular PVID is against the idea of keeping it tagged in all VLANs. Fixes: ca8931948344 ("net: dsa: b53: Keep CPU port as tagged in all VLANs") Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/dsa/b53/b53_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c3152ec4c0691e351f35a2f63347a464b5f35151 Author: Florian Fainelli Date: Fri Feb 15 12:16:52 2019 -0800 net: dsa: bcm_sf2: Do not assume DSA master supports WoL We assume in the bcm_sf2 driver that the DSA master network device supports ethtool_ops::{get,set}_wol operations, which is not a given. Avoid de-referencing potentially non-existent function pointers and check them as we should. Fixes: 96e65d7f3f88 ("net: dsa: bcm_sf2: add support for Wake-on-LAN") Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/dsa/bcm_sf2.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit a40061ea2e39494104602b3048751341bda374a1 Author: Florian Fainelli Date: Fri Feb 15 12:16:51 2019 -0800 net: systemport: Fix reception of BPDUs SYSTEMPORT has its RXCHK parser block that attempts to validate the packet structures, unfortunately setting the L2 header check bit will cause Bridge PDUs (BPDUs) to be incorrectly rejected because they look like LLC/SNAP packets with a non-IPv4 or non-IPv6 Ethernet Type. Fixes: 4e8aedfe78c7 ("net: systemport: Turn on offloads by default") Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bcmsysport.c | 4 ++++ 1 file changed, 4 insertions(+) commit dad8d7c6452b5b9f9828c9e2c7ca143205fd40c7 Author: Florian Fainelli Date: Fri Feb 15 12:16:50 2019 -0800 net: dsa: b53: Properly account for VLAN filtering VLAN filtering can be built into the kernel, and also dynamically turned on/off through the bridge master device. Allow re-configuring the switch appropriately to account for that by deciding whether VLAN table (v_table) misses should lead to a drop or forward. Fixes: a2482d2ce349 ("net: dsa: b53: Plug in VLAN support") Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/dsa/b53/b53_common.c | 59 ++++++++++++++++++++++++++++++++++++---- drivers/net/dsa/b53/b53_priv.h | 3 ++ 2 files changed, 57 insertions(+), 5 deletions(-) commit fea83353177a55540c71c140887737c282137aa2 Author: Florian Fainelli Date: Fri Feb 15 12:16:49 2019 -0800 net: dsa: b53: Fix default VLAN ID We were not consistent in how the default VID of a given port was defined, b53_br_leave() would make sure the VLAN ID would be either 0/1 depending on the switch generation, but b53_configure_vlan(), which is the default configuration would unconditionally set it to 1. The correct value is 1 for 5325/5365 series and 0 otherwise. To avoid repeating that mistake ever again, introduce a helper function: b53_default_pvid() to factor that out. Fixes: 967dd82ffc52 ("net: dsa: b53: Add support for Broadcom RoboSwitch") Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/dsa/b53/b53_common.c | 29 ++++++++++++++++------------- 1 file changed, 16 insertions(+), 13 deletions(-) commit d5be7f632bad0f489879eed0ff4b99bd7fe0b74c Author: Willem de Bruijn Date: Fri Feb 15 12:15:47 2019 -0500 net: validate untrusted gso packets without csum offload Syzkaller again found a path to a kernel crash through bad gso input. By building an excessively large packet to cause an skb field to wrap. If VIRTIO_NET_HDR_F_NEEDS_CSUM was set this would have been dropped in skb_partial_csum_set. GSO packets that do not set checksum offload are suspicious and rare. Most callers of virtio_net_hdr_to_skb already pass them to skb_probe_transport_header. Move that test forward, change it to detect parse failure and drop packets on failure as those cleary are not one of the legitimate VIRTIO_NET_HDR_GSO types. Fixes: bfd5f4a3d605 ("packet: Add GSO/csum offload support.") Fixes: f43798c27684 ("tun: Allow GSO using virtio_net_hdr") Reported-by: syzbot Signed-off-by: Willem de Bruijn Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller include/linux/skbuff.h | 2 +- include/linux/virtio_net.h | 9 +++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) commit 3b89ea9c5902acccdbbdec307c85edd1bf52515e Author: Hauke Mehrtens Date: Fri Feb 15 17:58:54 2019 +0100 net: Fix for_each_netdev_feature on Big endian The features attribute is of type u64 and stored in the native endianes on the system. The for_each_set_bit() macro takes a pointer to a 32 bit array and goes over the bits in this area. On little Endian systems this also works with an u64 as the most significant bit is on the highest address, but on big endian the words are swapped. When we expect bit 15 here we get bit 47 (15 + 32). This patch converts it more or less to its own for_each_set_bit() implementation which works on 64 bit integers directly. This is then completely in host endianness and should work like expected. Fixes: fd867d51f ("net/core: generic support for disabling netdev features down stack") Signed-off-by: Hauke Mehrtens Signed-off-by: David S. Miller include/linux/netdev_features.h | 23 +++++++++++++++++++++-- net/core/dev.c | 4 ++-- 2 files changed, 23 insertions(+), 4 deletions(-) commit 197f9ab7f08ce4b9ece662f747c3991b2f0fbb57 Author: Paul Kocialkowski Date: Fri Feb 15 17:17:08 2019 +0100 net: phy: xgmiitorgmii: Support generic PHY status read Some PHY drivers like the generic one do not provide a read_status callback on their own but rely on genphy_read_status being called directly. With the current code, this results in a NULL function pointer call. Call genphy_read_status instead when there is no specific callback. Signed-off-by: Paul Kocialkowski Signed-off-by: David S. Miller drivers/net/phy/xilinx_gmii2rgmii.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 4974d5f678abb34401558559d47e2ea3d1c15cba Author: Lorenzo Bianconi Date: Fri Feb 15 15:10:32 2019 +0100 net: ip6_gre: initialize erspan_ver just for erspan tunnels After commit c706863bc890 ("net: ip6_gre: always reports o_key to userspace"), ip6gre and ip6gretap tunnels started reporting TUNNEL_KEY output flag even if it is not configured. ip6gre_fill_info checks erspan_ver value to add TUNNEL_KEY for erspan tunnels, however in commit 84581bdae9587 ("erspan: set erspan_ver to 1 by default when adding an erspan dev") erspan_ver is initialized to 1 even for ip6gre or ip6gretap Fix the issue moving erspan_ver initialization in a dedicated routine Fixes: c706863bc890 ("net: ip6_gre: always reports o_key to userspace") Signed-off-by: Lorenzo Bianconi Reviewed-by: Greg Rose Signed-off-by: David S. Miller net/ipv6/ip6_gre.c | 34 ++++++++++++++++++++-------------- 1 file changed, 20 insertions(+), 14 deletions(-) commit a31687e85a36c8f72b49f3d0714922c8583d0a0b Merge: 24f0a48743a2 83e37e0bdd14 Author: David S. Miller Date: Fri Feb 15 19:42:24 2019 -0800 Merge tag 'mac80211-for-davem-2019-02-15' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== Just a few fixes this time: * mesh rhashtable fixes from Herbert * a small error path fix when starting AP interfaces ==================== Signed-off-by: David S. Miller commit 4a067cf823d9d8e50d41cfb618011c0d4a969c72 Author: Martin Wilck Date: Thu Feb 14 22:57:41 2019 +0100 scsi: core: reset host byte in DID_NEXUS_FAILURE case Up to 4.12, __scsi_error_from_host_byte() would reset the host byte to DID_OK for various cases including DID_NEXUS_FAILURE. Commit 2a842acab109 ("block: introduce new block status code type") replaced this function with scsi_result_to_blk_status() and removed the host-byte resetting code for the DID_NEXUS_FAILURE case. As the line set_host_byte(cmd, DID_OK) was preserved for the other cases, I suppose this was an editing mistake. The fact that the host byte remains set after 4.13 is causing problems with the sg_persist tool, which now returns success rather then exit status 24 when a RESERVATION CONFLICT error is encountered. Fixes: 2a842acab109 "block: introduce new block status code type" Signed-off-by: Martin Wilck Reviewed-by: Hannes Reinecke Reviewed-by: Christoph Hellwig Signed-off-by: Martin K. Petersen drivers/scsi/scsi_lib.c | 1 + 1 file changed, 1 insertion(+) commit ffeafdd2bf0b280d67ec1a47ea6287910d271f3f Author: John Garry Date: Fri Feb 15 00:37:57 2019 +0800 scsi: libsas: Fix rphy phy_identifier for PHYs with end devices attached The sysfs phy_identifier attribute for a sas_end_device comes from the rphy phy_identifier value. Currently this is not being set for rphys with an end device attached, so we see incorrect symlinks from systemd disk/by-path: root@localhost:~# ls -l /dev/disk/by-path/ total 0 lrwxrwxrwx 1 root root 9 Feb 13 12:26 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy0-lun-0 -> ../../sdb lrwxrwxrwx 1 root root 10 Feb 13 12:26 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy0-lun-0-part1 -> ../../sdb1 lrwxrwxrwx 1 root root 10 Feb 13 12:26 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy0-lun-0-part2 -> ../../sdb2 lrwxrwxrwx 1 root root 10 Feb 13 12:26 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy0-lun-0-part3 -> ../../sdc3 Indeed, each sas_end_device phy_identifier value is 0: root@localhost:/# more sys/class/sas_device/end_device-0\:0\:2/phy_identifier 0 root@localhost:/# more sys/class/sas_device/end_device-0\:0\:10/phy_identifier 0 This patch fixes the discovery code to set the phy_identifier. With this, we now get proper symlinks: root@localhost:~# ls -l /dev/disk/by-path/ total 0 lrwxrwxrwx 1 root root 9 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy10-lun-0 -> ../../sdg lrwxrwxrwx 1 root root 9 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy11-lun-0 -> ../../sdh lrwxrwxrwx 1 root root 9 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy2-lun-0 -> ../../sda lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy2-lun-0-part1 -> ../../sda1 lrwxrwxrwx 1 root root 9 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy3-lun-0 -> ../../sdb lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy3-lun-0-part1 -> ../../sdb1 lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy3-lun-0-part2 -> ../../sdb2 lrwxrwxrwx 1 root root 9 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy4-lun-0 -> ../../sdc lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy4-lun-0-part1 -> ../../sdc1 lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy4-lun-0-part2 -> ../../sdc2 lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy4-lun-0-part3 -> ../../sdc3 lrwxrwxrwx 1 root root 9 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy5-lun-0 -> ../../sdd lrwxrwxrwx 1 root root 9 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy7-lun-0 -> ../../sde lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy7-lun-0-part1 -> ../../sde1 lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy7-lun-0-part2 -> ../../sde2 lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy7-lun-0-part3 -> ../../sde3 lrwxrwxrwx 1 root root 9 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy8-lun-0 -> ../../sdf lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy8-lun-0-part1 -> ../../sdf1 lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy8-lun-0-part2 -> ../../sdf2 lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy8-lun-0-part3 -> ../../sdf3 Fixes: 2908d778ab3e ("[SCSI] aic94xx: new driver") Reported-by: dann frazier Signed-off-by: John Garry Reviewed-by: Jason Yan Tested-by: dann frazier Signed-off-by: Martin K. Petersen drivers/scsi/libsas/sas_expander.c | 2 ++ 1 file changed, 2 insertions(+) commit 515ce60613128be7a176a8b82b20c7624f3b440d Author: Masato Suzuki Date: Thu Feb 14 15:01:18 2019 +0900 scsi: sd_zbc: Fix sd_zbc_report_zones() buffer allocation The function sd_zbc_do_report_zones() issues a REPORT ZONES command with a buffer size calculated based on the number of zones requested by the caller. This value should however not exceed the capabilities of the hardware maximum command size, that is, should not exceed the max_hw_sectors limit of the device. This problem leads to failures of report zones commands when re-validating disks with some SAS HBAs. Fix this by limiting a report zone command buffer size to the minimum of the device max_hw_sectors and calculated value based on the requested number of zones. This does not change the semantic of the report_zones file operation as report zones can always return less zone reports than requested. Short reports are handled using a loop execution of the report_zones file operation in the function blk_report_zones(). [Damien] Before patch 'e76239a3748c ("block: add a report_zones method")', report zones buffer allocation was limited to max_sectors when allocated in blk_report_zones(). This however does not consider the actual format of the device reply which is interface dependent. Limiting the allocation based on the size of the expected reply format rather than the size of the array of generic sturct blkzone passed by blk_report_zones() makes more sense. Fixes: e76239a3748c ("block: add a report_zones method") Cc: stable@vger.kernel.org Signed-off-by: Masato Suzuki Signed-off-by: Damien Le Moal Signed-off-by: Martin K. Petersen drivers/scsi/sd_zbc.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit 79edd00dc6a96644d76b4a1cb97d94d49e026768 Author: Anoob Soman Date: Wed Feb 13 13:21:39 2019 +0800 scsi: libiscsi: Fix race between iscsi_xmit_task and iscsi_complete_task When a target sends Check Condition, whilst initiator is busy xmiting re-queued data, could lead to race between iscsi_complete_task() and iscsi_xmit_task() and eventually crashing with the following kernel backtrace. [3326150.987523] ALERT: BUG: unable to handle kernel NULL pointer dereference at 0000000000000078 [3326150.987549] ALERT: IP: [] iscsi_xmit_task+0x2d/0xc0 [libiscsi] [3326150.987571] WARN: PGD 569c8067 PUD 569c9067 PMD 0 [3326150.987582] WARN: Oops: 0002 [#1] SMP [3326150.987593] WARN: Modules linked in: tun nfsv3 nfs fscache dm_round_robin [3326150.987762] WARN: CPU: 2 PID: 8399 Comm: kworker/u32:1 Tainted: G O 4.4.0+2 #1 [3326150.987774] WARN: Hardware name: Dell Inc. PowerEdge R720/0W7JN5, BIOS 2.5.4 01/22/2016 [3326150.987790] WARN: Workqueue: iscsi_q_13 iscsi_xmitworker [libiscsi] [3326150.987799] WARN: task: ffff8801d50f3800 ti: ffff8801f5458000 task.ti: ffff8801f5458000 [3326150.987810] WARN: RIP: e030:[] [] iscsi_xmit_task+0x2d/0xc0 [libiscsi] [3326150.987825] WARN: RSP: e02b:ffff8801f545bdb0 EFLAGS: 00010246 [3326150.987831] WARN: RAX: 00000000ffffffc3 RBX: ffff880282d2ab20 RCX: ffff88026b6ac480 [3326150.987842] WARN: RDX: 0000000000000000 RSI: 00000000fffffe01 RDI: ffff880282d2ab20 [3326150.987852] WARN: RBP: ffff8801f545bdc8 R08: 0000000000000000 R09: 0000000000000008 [3326150.987862] WARN: R10: 0000000000000000 R11: 000000000000fe88 R12: 0000000000000000 [3326150.987872] WARN: R13: ffff880282d2abe8 R14: ffff880282d2abd8 R15: ffff880282d2ac08 [3326150.987890] WARN: FS: 00007f5a866b4840(0000) GS:ffff88028a640000(0000) knlGS:0000000000000000 [3326150.987900] WARN: CS: e033 DS: 0000 ES: 0000 CR0: 0000000080050033 [3326150.987907] WARN: CR2: 0000000000000078 CR3: 0000000070244000 CR4: 0000000000042660 [3326150.987918] WARN: Stack: [3326150.987924] WARN: ffff880282d2ad58 ffff880282d2ab20 ffff880282d2abe8 ffff8801f545be18 [3326150.987938] WARN: ffffffffa05cea90 ffff880282d2abf8 ffff88026b59cc80 ffff88026b59cc00 [3326150.987951] WARN: ffff88022acf32c0 ffff880289491800 ffff880255a80800 0000000000000400 [3326150.987964] WARN: Call Trace: [3326150.987975] WARN: [] iscsi_xmitworker+0x2f0/0x360 [libiscsi] [3326150.987988] WARN: [] process_one_work+0x1fc/0x3b0 [3326150.987997] WARN: [] worker_thread+0x2a5/0x470 [3326150.988006] WARN: [] ? __schedule+0x648/0x870 [3326150.988015] WARN: [] ? rescuer_thread+0x300/0x300 [3326150.988023] WARN: [] kthread+0xd5/0xe0 [3326150.988031] WARN: [] ? kthread_stop+0x110/0x110 [3326150.988040] WARN: [] ret_from_fork+0x3f/0x70 [3326150.988048] WARN: [] ? kthread_stop+0x110/0x110 [3326150.988127] ALERT: RIP [] iscsi_xmit_task+0x2d/0xc0 [libiscsi] [3326150.988138] WARN: RSP [3326150.988144] WARN: CR2: 0000000000000078 [3326151.020366] WARN: ---[ end trace 1c60974d4678d81b ]--- Commit 6f8830f5bbab ("scsi: libiscsi: add lock around task lists to fix list corruption regression") introduced "taskqueuelock" to fix list corruption during the race, but this wasn't enough. Re-setting of conn->task to NULL, could race with iscsi_xmit_task(). iscsi_complete_task() { .... if (conn->task == task) conn->task = NULL; } conn->task in iscsi_xmit_task() could be NULL and so will be task. __iscsi_get_task(task) will crash (NullPtr de-ref), trying to access refcount. iscsi_xmit_task() { struct iscsi_task *task = conn->task; __iscsi_get_task(task); } This commit will take extra conn->session->back_lock in iscsi_xmit_task() to ensure iscsi_xmit_task() waits for iscsi_complete_task(), if iscsi_complete_task() wins the race. If iscsi_xmit_task() wins the race, iscsi_xmit_task() increments task->refcount (__iscsi_get_task) ensuring iscsi_complete_task() will not iscsi_free_task(). Signed-off-by: Anoob Soman Signed-off-by: Bob Liu Acked-by: Lee Duncan Signed-off-by: Martin K. Petersen drivers/scsi/libiscsi.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 1910faebf61d85a5b7138c0c1c600672e41f82a3 Author: Paul Burton Date: Fri Feb 15 20:14:16 2019 +0000 MIPS: eBPF: Remove REG_32BIT_ZERO_EX REG_32BIT_ZERO_EX and REG_64BIT are always handled in exactly the same way, and reg_val_propagate_range() never actually sets any register to type REG_32BIT_ZERO_EX. Remove the redundant & unused REG_32BIT_ZERO_EX. Signed-off-by: Paul Burton Signed-off-by: Daniel Borkmann arch/mips/net/ebpf_jit.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) commit 13443154f6cac61d148471ede6d7f1f6b5ea946a Author: Paul Burton Date: Fri Feb 15 20:14:15 2019 +0000 MIPS: eBPF: Always return sign extended 32b values The function prototype used to call JITed eBPF code (ie. the type of the struct bpf_prog bpf_func field) returns an unsigned int. The MIPS n64 ABI that MIPS64 kernels target defines that 32 bit integers should always be sign extended when passed in registers as either arguments or return values. This means that when returning any value which may not already be sign extended (ie. of type REG_64BIT or REG_32BIT_ZERO_EX) we need to perform that sign extension in order to comply with the n64 ABI. Without this we see strange looking test failures from test_bpf.ko, such as: test_bpf: #65 ALU64_MOV_X: dst = 4294967295 jited:1 ret -1 != -1 FAIL (1 times) Although the return value printed matches the expected value, this is only because printf is only examining the least significant 32 bits of the 64 bit register value we returned. The register holding the expected value is sign extended whilst the v0 register was set to a zero extended value by our JITed code, so when compared by a conditional branch instruction the values are not equal. We already handle this when the return value register is of type REG_32BIT_ZERO_EX, so simply extend this to also cover REG_64BIT. Signed-off-by: Paul Burton Fixes: b6bd53f9c4e8 ("MIPS: Add missing file for eBPF JIT.") Cc: stable@vger.kernel.org # v4.13+ Signed-off-by: Daniel Borkmann arch/mips/net/ebpf_jit.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 7c1857bdbdf1e4c541e45eab477ee23ed4333ea4 Author: David Howells Date: Thu Feb 14 16:20:37 2019 +0000 keys: Timestamp new keys Set the timestamp on new keys rather than leaving it unset. Fixes: 31d5a79d7f3d ("KEYS: Do LRU discard in full keyrings") Signed-off-by: David Howells Signed-off-by: James Morris security/keys/key.c | 1 + 1 file changed, 1 insertion(+) commit 822ad64d7e46a8e2c8b8a796738d7b657cbb146d Author: David Howells Date: Thu Feb 14 16:20:25 2019 +0000 keys: Fix dependency loop between construction record and auth key In the request_key() upcall mechanism there's a dependency loop by which if a key type driver overrides the ->request_key hook and the userspace side manages to lose the authorisation key, the auth key and the internal construction record (struct key_construction) can keep each other pinned. Fix this by the following changes: (1) Killing off the construction record and using the auth key instead. (2) Including the operation name in the auth key payload and making the payload available outside of security/keys/. (3) The ->request_key hook is given the authkey instead of the cons record and operation name. Changes (2) and (3) allow the auth key to naturally be cleaned up if the keyring it is in is destroyed or cleared or the auth key is unlinked. Fixes: 7ee02a316600 ("keys: Fix dependency loop between construction record and auth key") Signed-off-by: David Howells Signed-off-by: James Morris fs/nfs/nfs4idmap.c | 31 +++++++++------- include/keys/request_key_auth-type.h | 36 ++++++++++++++++++ include/linux/key-type.h | 22 +++-------- security/keys/internal.h | 13 +------ security/keys/keyctl.c | 1 + security/keys/process_keys.c | 1 + security/keys/request_key.c | 72 +++++++++++++++--------------------- security/keys/request_key_auth.c | 16 ++++---- 8 files changed, 100 insertions(+), 92 deletions(-) commit bb2ba2d75a2d673e76ddaf13a9bd30d6a8b1bb08 Author: David Howells Date: Thu Feb 14 16:20:15 2019 +0000 assoc_array: Fix shortcut creation Fix the creation of shortcuts for which the length of the index key value is an exact multiple of the machine word size. The problem is that the code that blanks off the unused bits of the shortcut value malfunctions if the number of bits in the last word equals machine word size. This is due to the "<<" operator being given a shift of zero in this case, and so the mask that should be all zeros is all ones instead. This causes the subsequent masking operation to clear everything rather than clearing nothing. Ordinarily, the presence of the hash at the beginning of the tree index key makes the issue very hard to test for, but in this case, it was encountered due to a development mistake that caused the hash output to be either 0 (keyring) or 1 (non-keyring) only. This made it susceptible to the keyctl/unlink/valid test in the keyutils package. The fix is simply to skip the blanking if the shift would be 0. For example, an index key that is 64 bits long would produce a 0 shift and thus a 'blank' of all 1s. This would then be inverted and AND'd onto the index_key, incorrectly clearing the entire last word. Fixes: 3cb989501c26 ("Add a generic associative array implementation.") Signed-off-by: David Howells Signed-off-by: James Morris lib/assoc_array.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit a08bf91ce28ed3ae7b6fef35d843fef8dc8c2cd9 Author: Eric Biggers Date: Thu Feb 14 16:20:01 2019 +0000 KEYS: allow reaching the keys quotas exactly If the sysctl 'kernel.keys.maxkeys' is set to some number n, then actually users can only add up to 'n - 1' keys. Likewise for 'kernel.keys.maxbytes' and the root_* versions of these sysctls. But these sysctls are apparently supposed to be *maximums*, as per their names and all documentation I could find -- the keyrings(7) man page, Documentation/security/keys/core.rst, and all the mentions of EDQUOT meaning that the key quota was *exceeded* (as opposed to reached). Thus, fix the code to allow reaching the quotas exactly. Fixes: 0b77f5bfb45c ("keys: make the keyring quotas controllable through /proc/sys") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Signed-off-by: David Howells Signed-off-by: James Morris security/keys/key.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 5ded5871030eb75017639148da0a58931dfbfc25 Merge: 24f0a48743a2 388a49959ee4 Author: Linus Torvalds Date: Fri Feb 15 13:36:43 2019 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Two fairly small fixes: the qla one is a panic inducing use after free and the entropy fix may seem minor but it has had huge userspace impact thanks to an unrelated change in openssl that causes sshd to refuse logins until it has enough entropy for the session keys, which causes tens of minutes delay before the affected systems allow logins after reboot" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: qla2xxx: Fix panic from use after free in qla2x00_async_tm_cmd scsi: sd: fix entropy gathering for most rotational disks commit e7afe6c1d486b516ed586dcc10b3e7e3e85a9c2b Author: Scott Mayhew Date: Fri Feb 15 13:42:02 2019 -0500 sunrpc: fix 4 more call sites that were using stack memory with a scatterlist While trying to reproduce a reported kernel panic on arm64, I discovered that AUTH_GSS basically doesn't work at all with older enctypes on arm64 systems with CONFIG_VMAP_STACK enabled. It turns out there still a few places using stack memory with scatterlists, causing krb5_encrypt() and krb5_decrypt() to produce incorrect results (or a BUG if CONFIG_DEBUG_SG is enabled). Tested with cthon on v4.0/v4.1/v4.2 with krb5/krb5i/krb5p using des3-cbc-sha1 and arcfour-hmac-md5. Signed-off-by: Scott Mayhew Cc: stable@vger.kernel.org Signed-off-by: J. Bruce Fields net/sunrpc/auth_gss/gss_krb5_seqnum.c | 49 +++++++++++++++++++++++++++-------- 1 file changed, 38 insertions(+), 11 deletions(-) commit 410d7360541c0e21b58e56b64e5bcdbec9c1d285 Merge: 62a23bb0063c 50d6b3cf9403 Author: Arnd Bergmann Date: Fri Feb 15 20:39:46 2019 +0100 Merge tag 'omap-for-v5.0/fixes-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into arm/fixes Fix omap4 and later lost cpu1 interrupts for periodic timer A fix from Russell that took a while to get applied into fixes as I thought Russell is merging this one. * tag 'omap-for-v5.0/fixes-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: ARM: OMAP2+: fix lack of timer interrupts on CPU1 after hotplug commit a6e60d84989fa0e91db7f236eda40453b0e44afa Author: Miguel Ojeda Date: Sat Jan 19 20:59:34 2019 +0100 include/linux/module.h: copy __init/__exit attrs to init/cleanup_module The upcoming GCC 9 release extends the -Wmissing-attributes warnings (enabled by -Wall) to C and aliases: it warns when particular function attributes are missing in the aliases but not in their target. In particular, it triggers for all the init/cleanup_module aliases in the kernel (defined by the module_init/exit macros), ending up being very noisy. These aliases point to the __init/__exit functions of a module, which are defined as __cold (among other attributes). However, the aliases themselves do not have the __cold attribute. Since the compiler behaves differently when compiling a __cold function as well as when compiling paths leading to calls to __cold functions, the warning is trying to point out the possibly-forgotten attribute in the alias. In order to keep the warning enabled, we decided to silence this case. Ideally, we would mark the aliases directly as __init/__exit. However, there are currently around 132 modules in the kernel which are missing __init/__exit in their init/cleanup functions (either because they are missing, or for other reasons, e.g. the functions being called from somewhere else); and a section mismatch is a hard error. A conservative alternative was to mark the aliases as __cold only. However, since we would like to eventually enforce __init/__exit to be always marked, we chose to use the new __copy function attribute (introduced by GCC 9 as well to deal with this). With it, we copy the attributes used by the target functions into the aliases. This way, functions that were not marked as __init/__exit won't have their aliases marked either, and therefore there won't be a section mismatch. Note that the warning would go away marking either the extern declaration, the definition, or both. However, we only mark the definition of the alias, since we do not want callers (which only see the declaration) to be compiled as if the function was __cold (and therefore the paths leading to those calls would be assumed to be unlikely). Link: https://lore.kernel.org/lkml/20190123173707.GA16603@gmail.com/ Link: https://lore.kernel.org/lkml/20190206175627.GA20399@gmail.com/ Suggested-by: Martin Sebor Acked-by: Jessica Yu Signed-off-by: Miguel Ojeda include/linux/module.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit c0d9782f5b6d7157635ae2fd782a4b27d55a6013 Author: Miguel Ojeda Date: Fri Feb 8 23:51:05 2019 +0100 Compiler Attributes: add support for __copy (gcc >= 9) From the GCC manual: copy copy(function) The copy attribute applies the set of attributes with which function has been declared to the declaration of the function to which the attribute is applied. The attribute is designed for libraries that define aliases or function resolvers that are expected to specify the same set of attributes as their targets. The copy attribute can be used with functions, variables, or types. However, the kind of symbol to which the attribute is applied (either function or variable) must match the kind of symbol to which the argument refers. The copy attribute copies only syntactic and semantic attributes but not attributes that affect a symbol’s linkage or visibility such as alias, visibility, or weak. The deprecated attribute is also not copied. https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html The upcoming GCC 9 release extends the -Wmissing-attributes warnings (enabled by -Wall) to C and aliases: it warns when particular function attributes are missing in the aliases but not in their target, e.g.: void __cold f(void) {} void __alias("f") g(void); diagnoses: warning: 'g' specifies less restrictive attribute than its target 'f': 'cold' [-Wmissing-attributes] Using __copy(f) we can copy the __cold attribute from f to g: void __cold f(void) {} void __copy(f) __alias("f") g(void); This attribute is most useful to deal with situations where an alias is declared but we don't know the exact attributes the target has. For instance, in the kernel, the widely used module_init/exit macros define the init/cleanup_module aliases, but those cannot be marked always as __init/__exit since some modules do not have their functions marked as such. Suggested-by: Martin Sebor Reviewed-by: Nick Desaulniers Signed-off-by: Miguel Ojeda include/linux/compiler_attributes.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+) commit ff98e20ef2081b8620dada28fc2d4fb24ca0abf2 Author: Miguel Ojeda Date: Thu Jan 24 15:59:11 2019 +0100 lib/crc32.c: mark crc32_le_base/__crc32c_le_base aliases as __pure The upcoming GCC 9 release extends the -Wmissing-attributes warnings (enabled by -Wall) to C and aliases: it warns when particular function attributes are missing in the aliases but not in their target. In particular, it triggers here because crc32_le_base/__crc32c_le_base aren't __pure while their target crc32_le/__crc32c_le are. These aliases are used by architectures as a fallback in accelerated versions of CRC32. See commit 9784d82db3eb ("lib/crc32: make core crc32() routines weak so they can be overridden"). Therefore, being fallbacks, it is likely that even if the aliases were called from C, there wouldn't be any optimizations possible. Currently, the only user is arm64, which calls this from asm. Still, marking the aliases as __pure makes sense and is a good idea for documentation purposes and possible future optimizations, which also silences the warning. Acked-by: Ard Biesheuvel Tested-by: Laura Abbott Signed-off-by: Miguel Ojeda lib/crc32.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 69ef9bc54715fb1cb7786ada15774e469e822209 Author: Miguel Ojeda Date: Sat Feb 9 00:38:45 2019 +0100 auxdisplay: ht16k33: fix potential user-after-free on module unload On module unload/remove, we need to ensure that work does not run after we have freed resources. Concretely, cancel_delayed_work() may return while the callback function is still running. From kernel/workqueue.c: The work callback function may still be running on return, unless it returns true and the work doesn't re-arm itself. Explicitly flush or use cancel_delayed_work_sync() to wait on it. Link: https://lore.kernel.org/lkml/20190204220952.30761-1-TheSven73@googlemail.com/ Reported-by: Sven Van Asbroeck Reviewed-by: Dmitry Torokhov Reviewed-by: Sven Van Asbroeck Acked-by: Robin van der Gracht Signed-off-by: Miguel Ojeda drivers/auxdisplay/ht16k33.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9e7382153f80ba45a0bbcd540fb77d4b15f6e966 Author: Quentin Perret Date: Thu Feb 14 15:29:50 2019 +0000 tracing: Fix number of entries in trace header The following commit 441dae8f2f29 ("tracing: Add support for display of tgid in trace output") removed the call to print_event_info() from print_func_help_header_irq() which results in the ftrace header not reporting the number of entries written in the buffer. As this wasn't the original intent of the patch, re-introduce the call to print_event_info() to restore the orginal behaviour. Link: http://lkml.kernel.org/r/20190214152950.4179-1-quentin.perret@arm.com Acked-by: Joel Fernandes Cc: stable@vger.kernel.org Fixes: 441dae8f2f29 ("tracing: Add support for display of tgid in trace output") Signed-off-by: Quentin Perret Signed-off-by: Steven Rostedt (VMware) kernel/trace/trace.c | 2 ++ 1 file changed, 2 insertions(+) commit 2c4f1fcbef0bc324830bc2fb1a264c08ec93dec5 Author: Changbin Du Date: Fri Jan 25 23:10:50 2019 +0800 kprobe: Do not use uaccess functions to access kernel memory that can fault The userspace can ask kprobe to intercept strings at any memory address, including invalid kernel address. In this case, fetch_store_strlen() would crash since it uses general usercopy function, and user access functions are no longer allowed to access kernel memory. For example, we can crash the kernel by doing something as below: $ sudo kprobe 'p:do_sys_open +0(+0(%si)):string' [ 103.620391] BUG: GPF in non-whitelisted uaccess (non-canonical address?) [ 103.622104] general protection fault: 0000 [#1] SMP PTI [ 103.623424] CPU: 10 PID: 1046 Comm: cat Not tainted 5.0.0-rc3-00130-gd73aba1-dirty #96 [ 103.625321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-2-g628b2e6-dirty-20190104_103505-linux 04/01/2014 [ 103.628284] RIP: 0010:process_fetch_insn+0x1ab/0x4b0 [ 103.629518] Code: 10 83 80 28 2e 00 00 01 31 d2 31 ff 48 8b 74 24 28 eb 0c 81 fa ff 0f 00 00 7f 1c 85 c0 75 18 66 66 90 0f ae e8 48 63 ca 89 f8 <8a> 0c 31 66 66 90 83 c2 01 84 c9 75 dc 89 54 24 34 89 44 24 28 48 [ 103.634032] RSP: 0018:ffff88845eb37ce0 EFLAGS: 00010246 [ 103.635312] RAX: 0000000000000000 RBX: ffff888456c4e5a8 RCX: 0000000000000000 [ 103.637057] RDX: 0000000000000000 RSI: 2e646c2f6374652f RDI: 0000000000000000 [ 103.638795] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 103.640556] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 [ 103.642297] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 103.644040] FS: 0000000000000000(0000) GS:ffff88846f000000(0000) knlGS:0000000000000000 [ 103.646019] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 103.647436] CR2: 00007ffc79758038 CR3: 0000000463360006 CR4: 0000000000020ee0 [ 103.649147] Call Trace: [ 103.649781] ? sched_clock_cpu+0xc/0xa0 [ 103.650747] ? do_sys_open+0x5/0x220 [ 103.651635] kprobe_trace_func+0x303/0x380 [ 103.652645] ? do_sys_open+0x5/0x220 [ 103.653528] kprobe_dispatcher+0x45/0x50 [ 103.654682] ? do_sys_open+0x1/0x220 [ 103.655875] kprobe_ftrace_handler+0x90/0xf0 [ 103.657282] ftrace_ops_assist_func+0x54/0xf0 [ 103.658564] ? __call_rcu+0x1dc/0x280 [ 103.659482] 0xffffffffc00000bf [ 103.660384] ? __ia32_sys_open+0x20/0x20 [ 103.661682] ? do_sys_open+0x1/0x220 [ 103.662863] do_sys_open+0x5/0x220 [ 103.663988] do_syscall_64+0x60/0x210 [ 103.665201] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 103.666862] RIP: 0033:0x7fc22fadccdd [ 103.668034] Code: 48 89 54 24 e0 41 83 e2 40 75 32 89 f0 25 00 00 41 00 3d 00 00 41 00 74 24 89 f2 b8 01 01 00 00 48 89 fe bf 9c ff ff ff 0f 05 <48> 3d 00 f0 ff ff 77 33 f3 c3 66 0f 1f 84 00 00 00 00 00 48 8d 44 [ 103.674029] RSP: 002b:00007ffc7972c3a8 EFLAGS: 00000287 ORIG_RAX: 0000000000000101 [ 103.676512] RAX: ffffffffffffffda RBX: 0000562f86147a21 RCX: 00007fc22fadccdd [ 103.678853] RDX: 0000000000080000 RSI: 00007fc22fae1428 RDI: 00000000ffffff9c [ 103.681151] RBP: ffffffffffffffff R08: 0000000000000000 R09: 0000000000000000 [ 103.683489] R10: 0000000000000000 R11: 0000000000000287 R12: 00007fc22fce90a8 [ 103.685774] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000 [ 103.688056] Modules linked in: [ 103.689131] ---[ end trace 43792035c28984a1 ]--- This can be fixed by using probe_mem_read() instead, as it can handle faulting kernel memory addresses, which kprobes can legitimately do. Link: http://lkml.kernel.org/r/20190125151051.7381-1-changbin.du@gmail.com Cc: stable@vger.kernel.org Fixes: 9da3f2b7405 ("x86/fault: BUG() when uaccess helpers fault on kernel addresses") Signed-off-by: Changbin Du Signed-off-by: Steven Rostedt (VMware) kernel/trace/trace_kprobe.c | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) commit 24f0a48743a256bdec1bcb80708bc309da4aa261 Merge: ae3fa8bd73c9 ace74f73c200 Author: Linus Torvalds Date: Fri Feb 15 09:12:28 2019 -0800 Merge tag 'for-linus-20190215' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: - Ensure we insert into the hctx dispatch list, if a request is marked as DONTPREP (Jianchao) - NVMe pull request, single missing unlock on error fix (Keith) - MD pull request, single fix for a potentially data corrupting issue (Nate) - Floppy check_events regression fix (Yufen) * tag 'for-linus-20190215' of git://git.kernel.dk/linux-block: md/raid1: don't clear bitmap bits on interrupted recovery. floppy: check_events callback should not return a negative number nvme-pci: add missing unlock for reset error blk-mq: insert rq with DONTPREP to hctx dispatch list when requeue commit ae3fa8bd73c9b64416816ec0e9951cd8695c9854 Merge: dfeae3379836 4ae280b4ee34 Author: Linus Torvalds Date: Fri Feb 15 08:50:48 2019 -0800 Merge tag 'for-5.0/dm-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: - Fix bug in DM crypt's sizing of its block integrity tag space, resulting in less memory use when DM crypt layers on DM integrity. - Fix a long-standing DM thinp crash consistency bug that was due to improper handling of FUA. This issue is specific to writes that fill an entire thinp block which needs to be allocated. * tag 'for-5.0/dm-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm thin: fix bug where bio that overwrites thin block ignores FUA dm crypt: don't overallocate the integrity tag space commit dfeae3379836fd0609488e73f4df260af4af2672 Merge: 545aabcbdcec 83e418a805d8 Author: Linus Torvalds Date: Fri Feb 15 08:45:28 2019 -0800 Merge tag 'mmc-v5.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: "A couple of MMC fixes intended for v5.0-rc7. MMC core: - Fix deadlock bug for block I/O requests MMC host: - sunxi: Disable broken HS-DDR mode for H5 by default - sunxi: Avoid unsupported speed modes declared via DT - meson-gx: Restore interrupt name" * tag 'mmc-v5.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: meson-gx: fix interrupt name mmc: block: handle complete_work on separate workqueue mmc: sunxi: Filter out unsupported modes declared in the device tree mmc: sunxi: Disable HS-DDR mode for H5 eMMC controller by default commit f09ef134a7ca3f0d2ce485a757f5b79809ebb803 Author: Raju Rangoju Date: Thu Feb 14 17:40:54 2019 +0530 iw_cxgb4: cq/qp mask depends on bar2 pages in a host page Adjust the cq/qp mask based on the number of bar2 pages in a host page. For user-mode rdma, the granularity of the BAR2 memory mapped to a user rdma process during queue allocation must be based on the host page size. The lld attributes udb_density and ucq_density are used to figure out how many sge contexts are in a bar2 page. So the rdev->qpmask and rdev->cqmask in iw_cxgb4 need to now be adjusted based on how many sge bar2 pages are in a host page. Otherwise the device fails to work on non 4k page size systems. Fixes: 2391b0030e24 ("cxgb4: Remove SGE_HOST_PAGE_SIZE dependency on page size") Signed-off-by: Raju Rangoju Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/cxgb4/device.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) commit fc4144e7815b7747b6aba140d7a91da45ee9dd8c Author: Raju Rangoju Date: Thu Feb 14 17:40:53 2019 +0530 cxgb4: Export sge_host_page_size to ulds Export the sge_host_page_size field to ULDs via cxgb4_lld_info, so that iw_cxgb4 can make use of this in calculating the correct qp/cq mask. Fixes: 2391b0030e24 ("cxgb4: Remove SGE_HOST_PAGE_SIZE dependency on page size") Signed-off-by: Raju Rangoju Signed-off-by: Jason Gunthorpe drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c | 1 + drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h | 1 + 2 files changed, 2 insertions(+) commit 545aabcbdcec6c88faa3dfde506ad1931d119f52 Merge: 2aba322074de 69ef943dbc14 Author: Linus Torvalds Date: Fri Feb 15 08:20:33 2019 -0800 Merge tag 'drm-fixes-2019-02-15-1' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Usual pull request, little larger than I'd like but nothing too strange in it. Willy found an bug in the lease ioctl calculations, but it's a drm master only ioctl which makes it harder to mess with. i915: - combo phy programming fix - opregion version check fix for VBT RVDA lookup - gem mmap ioctl race fix - fbdev hpd during suspend fix - array size bounds check fix in pmu amdgpu: - Vega20 psp fix - Add vrr range to debugfs for freesync debugging sched: - Scheduler race fix vkms: - license header fixups imx: - Fix CSI register offsets for i.MX51 and i.MX53. - Fix delayed page flip completion events on i.MX6QP due to unexpected behaviour of the PRE when issuing NOP buffer updates to the same buffer address. - Stop throwing errors for plane updates on disabled CRTCs when a userspace process is killed while a plane update is pending. - Add missing of_node_put cleanup in imx_ldb_bind" * tag 'drm-fixes-2019-02-15-1' of git://anongit.freedesktop.org/drm/drm: drm: Use array_size() when creating lease drm/amdgpu/psp11: TA firmware is optional (v3) drm/i915/opregion: rvda is relative from opregion base in opregion 2.1+ drm/i915/opregion: fix version check drm/i915: Prevent a race during I915_GEM_MMAP ioctl with WC set drm/i915: Block fbdev HPD processing during suspend drm/i915/pmu: Fix enable count array size and bounds checking drm/i915/cnl: Fix CNL macros for Voltage Swing programming drm/i915/icl: combo port vswing programming changes per BSPEC drm/vkms: Fix license inconsistent drm/amd/display: Expose connector VRR range via debugfs drm/sched: Always trace the dependencies we wait on, to fix a race. gpu: ipu-v3: pre: don't trigger update if buffer address doesn't change gpu: ipu-v3: Fix CSI offsets for imx53 drm/imx: imx-ldb: add missing of_node_puts gpu: ipu-v3: Fix i.MX51 CSI control registers offset drm/imx: ignore plane updates on disabled crtcs commit 2aba322074de0d6781f4ae6b44d3e792b9bd2243 Merge: 6e7bd3b54946 1358c13a48c4 Author: Linus Torvalds Date: Fri Feb 15 08:11:43 2019 -0800 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: "This fixes a crash on resume in the ccree driver" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: ccree - fix resume race condition on init commit 6e7bd3b5494620265d39463b9289b7ba872f6df1 Merge: 02d75040897f f9bcc9f3ee4f Author: Linus Torvalds Date: Fri Feb 15 08:00:11 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) Fix MAC address setting in mac80211 pmsr code, from Johannes Berg. 2) Probe SFP modules after being attached, from Russell King. 3) Byte ordering bug in SMC rx_curs_confirmed code, from Ursula Braun. 4) Revert some r8169 changes that are causing regressions, from Heiner Kallweit. 5) Fix spurious connection timeouts in netfilter nat code, from Florian Westphal. 6) SKB leak in tipc, from Hoang Le. 7) Short packet checkum issue in mlx4, similar to a previous mlx5 change, from Saeed Mahameed. The issue is that whilst padding bytes are usually zero, it is not guarateed and the hardware doesn't take the padding bytes into consideration when generating the checksum. 8) Fix various races in cls_tcindex, from Cong Wang. 9) Need to set stream ext to NULL before freeing in SCTP code, from Xin Long. 10) Fix locking in phy_is_started, from Heiner Kallweit. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (54 commits) net: ethernet: freescale: set FEC ethtool regs version net: hns: Fix object reference leaks in hns_dsaf_roce_reset() mm: page_alloc: fix ref bias in page_frag_alloc() for 1-byte allocs net: phy: fix potential race in the phylib state machine net: phy: don't use locking in phy_is_started selftests: fix timestamping Makefile net: dsa: bcm_sf2: potential array overflow in bcm_sf2_sw_suspend() net: fix possible overflow in __sk_mem_raise_allocated() dsa: mv88e6xxx: Ensure all pending interrupts are handled prior to exit net: phy: fix interrupt handling in non-started states sctp: set stream ext to NULL after freeing it in sctp_stream_outq_migrate sctp: call gso_reset_checksum when computing checksum in sctp_gso_segment net/mlx5e: XDP, fix redirect resources availability check net/mlx5: Fix a compilation warning in events.c net/mlx5: No command allowed when command interface is not ready net/mlx5e: Fix NULL pointer derefernce in set channels error flow netfilter: nft_compat: use-after-free when deleting targets team: avoid complex list operations in team_nl_cmd_options_set() net_sched: fix two more memory leaks in cls_tcindex net_sched: fix a memory leak in cls_tcindex ... commit 02d75040897f37e43cc6df9a7084ecdd20526f1a Merge: cb5b020a8d38 cf43a757fd49 Author: Linus Torvalds Date: Fri Feb 15 07:56:24 2019 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace Pull signal fix from Eric Biederman: "Just a single patch that restores PTRACE_EVENT_EXIT functionality that was accidentally broken by last weeks fixes" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: signal: Restore the stop PTRACE_EVENT_EXIT commit 23b7ca4f745f21c2b9cfcb67fdd33733b3ae7e66 Author: Pablo Neira Ayuso Date: Fri Feb 15 12:50:24 2019 +0100 netfilter: nf_tables: fix flush after rule deletion in the same batch Flush after rule deletion bogusly hits -ENOENT. Skip rules that have been already from nft_delrule_by_chain() which is always called from the flush path. Fixes: cf9dc09d0949 ("netfilter: nf_tables: fix missing rules flushing per table") Reported-by: Phil Sutter Acked-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_tables_api.c | 3 +++ 1 file changed, 3 insertions(+) commit f331e766c4be33f4338574f3c9f7f77e98ab4571 Author: Hedi Berriche Date: Wed Feb 13 19:34:13 2019 +0000 x86/platform/UV: Use efi_runtime_lock to serialise BIOS calls Calls into UV firmware must be protected against concurrency, expose the efi_runtime_lock to the UV platform, and use it to serialise UV BIOS calls. Signed-off-by: Hedi Berriche Signed-off-by: Borislav Petkov Reviewed-by: Ard Biesheuvel Reviewed-by: Russ Anderson Reviewed-by: Dimitri Sivanich Reviewed-by: Mike Travis Cc: Andy Shevchenko Cc: Bhupesh Sharma Cc: Darren Hart Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: linux-efi Cc: platform-driver-x86@vger.kernel.org Cc: stable@vger.kernel.org # v4.9+ Cc: Steve Wahl Cc: Thomas Gleixner Cc: x86-ml Link: https://lkml.kernel.org/r/20190213193413.25560-5-hedi.berriche@hpe.com arch/x86/include/asm/uv/bios.h | 8 +++++++- arch/x86/platform/uv/bios_uv.c | 23 +++++++++++++++++++++-- drivers/firmware/efi/runtime-wrappers.c | 7 +++++++ 3 files changed, 35 insertions(+), 3 deletions(-) commit 62a23bb0063cde4b898afb5092c10c4b5acb5e96 Merge: d6780626db97 f2ce6ed3dcc8 Author: Arnd Bergmann Date: Fri Feb 15 13:43:08 2019 +0100 Merge tag 'imx-fixes-5.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 5.0, 3rd round: It contains a fix for i.MX8MQ EVK board device tree, which makes the broken eMMC support work as expected. * tag 'imx-fixes-5.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: arm64: dts: imx8mq: Fix boot from eMMC commit d6780626db9710479c3fce8d940cbb0b25b66d97 Merge: d50ce40a5a44 26e2d7b03ea7 Author: Arnd Bergmann Date: Fri Feb 15 13:41:45 2019 +0100 Merge tag 'v5.0-rockchip-dts64fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/fixes Fix for new dtc graph warnings and a regulator fix for rock64. * tag 'v5.0-rockchip-dts64fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: arm64: dts: rockchip: enable usb-host regulators at boot on rk3328-rock64 arm64: dts: rockchip: fix graph_port warning on rk3399 bob kevin and excavator commit d50ce40a5a44f0c9d8f15c700c096c12c657a25f Merge: 2ed5c2e3f27b c9a8a92a9961 Author: Arnd Bergmann Date: Fri Feb 15 13:41:11 2019 +0100 Merge tag 'v5.0-rockchip-dts32fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/fixes Drop one non-existent component from powerdomain list. * tag 'v5.0-rockchip-dts32fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: ARM: dts: rockchip: remove qos_cif1 from rk3188 power-domain commit 2ed5c2e3f27b5c934bdc50734f2496e823f22876 Merge: d13937116f1e dc30e7039137 Author: Arnd Bergmann Date: Fri Feb 15 13:38:20 2019 +0100 Merge tag 'omap-for-v5.0/fixes-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes SoC fixes for omaps for v5.0-rc cycle This series contains two SoC regression fixes and one uninitialized variable fix: - Fix inverted nirq pin handling for omap5 that started producing warnings with earlier GIC direction checks and took a while to understand and confirm. Basically there are two sys_nirq pins that are bypassing peripheral modules and inverted automatically by the SoC and need to be handled with a custom irq_set_type() - Recent ti-sysc changes caused a regression to the pwm-omap-dmtimer code where the device tree handling code for timer source clock gets confused. It looks like we can remove that code eventually, but for now we just drop a bogus pm_runtime_irq_safe() for the timers with the related quirks caused by pm_runtime_irq_safe(), and have the standard assigned-clocks and assigned-clock-parents deal with setting the source clock - Fix potentially uninitialized value for display init code if regmap_read() fails * tag 'omap-for-v5.0/fixes-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: ARM: OMAP2+: Variable "reg" in function omap4_dsi_mux_pads() could be uninitialized ARM: dts: Configure clock parent for pwm vibra bus: ti-sysc: Fix timer handling with drop pm_runtime_irq_safe() ARM: OMAP5+: Fix inverted nirq pin interrupts with irq_set_type clocksource: timer-ti-dm: Fix pwm dmtimer usage of fck reparenting commit 83e37e0bdd1470bbe6612250b745ad39b1a7b130 Author: Rakesh Pillai Date: Fri Feb 15 14:16:02 2019 +0530 mac80211: Restore vif beacon interval if start ap fails The starting of AP interface can fail due to invalid beacon interval, which does not match the minimum gcd requirement set by the wifi driver. In such case, the beacon interval of that interface gets updated with that invalid beacon interval. The next time that interface is brought up in AP mode, an interface combination check is performed and the beacon interval is taken from the previously set value. In a case where an invalid beacon interval, i.e. a beacon interval value which does not satisfy the minimum gcd criteria set by the driver, is set, all the subsequent trials to bring that interface in AP mode will fail, even if the subsequent trials have a valid beacon interval. To avoid this, in case of a failure in bringing up an interface in AP mode due to interface combination error, the interface beacon interval which is stored in bss conf, needs to be restored with the last working value of beacon interval. Tested on ath10k using WCN3990. Cc: stable@vger.kernel.org Fixes: 0c317a02ca98 ("cfg80211: support virtual interfaces with different beacon intervals") Signed-off-by: Rakesh Pillai Signed-off-by: Johannes Berg net/mac80211/cfg.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 4ff3a9d14c6c06eaa4e5976c61599ea2bd9e81b2 Author: Herbert Xu Date: Thu Feb 14 22:03:25 2019 +0800 mac80211: Free mpath object when rhashtable insertion fails When rhashtable insertion fails the mesh table code doesn't free the now-orphan mesh path object. This patch fixes that. Cc: stable@vger.kernel.org Signed-off-by: Herbert Xu Signed-off-by: Johannes Berg net/mac80211/mesh_pathtbl.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) commit b4c3fbe6360178dc2181b7b43b7ae793a192b282 Author: Herbert Xu Date: Thu Feb 14 22:03:24 2019 +0800 mac80211: Use linked list instead of rhashtable walk for mesh tables The mesh table code walks over hash tables for two purposes. First of all it's used as part of a netlink dump process, but it is also used for looking up entries to delete using criteria other than the hash key. The second purpose is directly contrary to the design specification of rhashtable walks. It is only meant for use by netlink dumps. This is because rhashtable is resizable and you cannot obtain a stable walk over it during a resize process. In fact mesh's use of rhashtable for dumping is bogus too. Rather than using rhashtable walk's iterator to keep track of the current position, it always converts the current position to an integer which defeats the purpose of the iterator. Therefore this patch converts all uses of rhashtable walk into a simple linked list. This patch also adds a new spin lock to protect the hash table insertion/removal as well as the walk list modifications. In fact the previous code was buggy as the removals can race with each other, potentially resulting in a double-free. Cc: stable@vger.kernel.org Signed-off-by: Herbert Xu Signed-off-by: Johannes Berg net/mac80211/mesh.h | 6 ++ net/mac80211/mesh_pathtbl.c | 138 ++++++++++++-------------------------------- 2 files changed, 43 insertions(+), 101 deletions(-) commit f275a4659484716259cc46268d9043424e51cf0f Author: Paul Kocialkowski Date: Thu Dec 27 16:42:25 2018 +0100 i2c: bcm2835: Clear current buffer pointers and counts after a transfer The driver's interrupt handler checks whether a message is currently being handled with the curr_msg pointer. When it is NULL, the interrupt is considered to be unexpected. Similarly, the i2c_start_transfer routine checks for the remaining number of messages to handle in num_msgs. However, these values are never cleared and always keep the message and number relevant to the latest transfer (which might be done already and the underlying message memory might have been freed). When an unexpected interrupt hits with the DONE bit set, the isr will then try to access the flags field of the curr_msg structure, leading to a fatal page fault. The msg_buf and msg_buf_remaining fields are also never cleared at the end of the transfer, which can lead to similar pitfalls. Fix these issues by introducing a cleanup function and always calling it after a transfer is finished. Fixes: e2474541032d ("i2c: bcm2835: Fix hang for writing messages larger than 16 bytes") Signed-off-by: Paul Kocialkowski Acked-by: Stefan Wahren Signed-off-by: Wolfram Sang drivers/i2c/busses/i2c-bcm2835.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit d358def706880defa4c9e87381c5bf086a97d5f9 Author: Shubhrajyoti Datta Date: Tue Feb 5 16:42:53 2019 +0530 i2c: cadence: Fix the hold bit setting In case the hold bit is not needed we are carrying the old values. Fix the same by resetting the bit when not needed. Fixes the sporadic i2c bus lockups on National Instruments Zynq-based devices. Fixes: df8eb5691c48 ("i2c: Add driver for Cadence I2C controller") Reported-by: Kyle Roeschley Acked-by: Michal Simek Signed-off-by: Shubhrajyoti Datta Tested-by: Kyle Roeschley Signed-off-by: Wolfram Sang drivers/i2c/busses/i2c-cadence.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) commit 69ef943dbc14b21987c79f8399ffea08f9a1b446 Author: Matthew Wilcox Date: Thu Feb 14 11:03:48 2019 -0800 drm: Use array_size() when creating lease Passing an object_count of sufficient size will make object_count * 4 wrap around to be very small, then a later function will happily iterate off the end of the object_ids array. Using array_size() will saturate at SIZE_MAX, the kmalloc() will fail and we'll return an -ENOMEM to the norty userspace. Fixes: 62884cd386b8 ("drm: Add four ioctls for managing drm mode object leases [v7]") Signed-off-by: Matthew Wilcox Acked-by: Kees Cook Acked-by: Daniel Vetter Cc: # v4.15+ Signed-off-by: Dave Airlie drivers/gpu/drm/drm_lease.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 7abbb35ba98ec52583b92898b2e37533f462d248 Merge: 5016bd248076 1d69511e49b0 Author: Dave Airlie Date: Fri Feb 15 11:46:40 2019 +1000 Merge branch 'drm-fixes-5.0' of git://people.freedesktop.org/~agd5f/linux into drm-fixes amdgpu: - Vega20 psp fix - Add vrr range to debugfs for freesync debugging sched: - Scheduler race fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20190213202958.3336-1-alexander.deucher@amd.com commit 5016bd248076ccdcd1a0dc28cf7e10b9f8cb6102 Merge: d586d571ca1a 16eb0f34cdf4 Author: Dave Airlie Date: Fri Feb 15 11:22:37 2019 +1000 Merge tag 'drm-intel-fixes-2019-02-13' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v5.0-rc7: - combo phy programming fix - opregion version check fix for VBT RVDA lookup - gem mmap ioctl race fix - fbdev hpd during suspend fix - array size bounds check fix in pmu Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/877ee3504b.fsf@intel.com commit d586d571ca1af63387af1aa758f66391692cb685 Merge: cd4c5a487410 7fd56e0260a2 Author: Dave Airlie Date: Fri Feb 15 11:21:46 2019 +1000 Merge tag 'drm-misc-fixes-2019-02-13' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes drm-misc-fixes for v5.0: - Fix license inconsistency in vkms. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/812e2f53-d72a-8fba-6c8c-fde8f44cf141@linux.intel.com commit 4ae280b4ee3463fa57bbe6eede26b97daff8a0f1 Author: Nikos Tsironis Date: Thu Feb 14 20:38:47 2019 +0200 dm thin: fix bug where bio that overwrites thin block ignores FUA When provisioning a new data block for a virtual block, either because the block was previously unallocated or because we are breaking sharing, if the whole block of data is being overwritten the bio that triggered the provisioning is issued immediately, skipping copying or zeroing of the data block. When this bio completes the new mapping is inserted in to the pool's metadata by process_prepared_mapping(), where the bio completion is signaled to the upper layers. This completion is signaled without first committing the metadata. If the bio in question has the REQ_FUA flag set and the system crashes right after its completion and before the next metadata commit, then the write is lost despite the REQ_FUA flag requiring that I/O completion for this request must only be signaled after the data has been committed to non-volatile storage. Fix this by deferring the completion of overwrite bios, with the REQ_FUA flag set, until after the metadata has been committed. Cc: stable@vger.kernel.org Signed-off-by: Nikos Tsironis Acked-by: Joe Thornber Acked-by: Mikulas Patocka Signed-off-by: Mike Snitzer drivers/md/dm-thin.c | 55 +++++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 50 insertions(+), 5 deletions(-) commit cb5b020a8d38f77209d0472a0fea755299a8ec78 Author: Linus Torvalds Date: Thu Feb 14 15:02:18 2019 -0800 Revert "exec: load_script: don't blindly truncate shebang string" This reverts commit 8099b047ecc431518b9bb6bdbba3549bbecdc343. It turns out that people do actually depend on the shebang string being truncated, and on the fact that an interpreter (like perl) will often just re-interpret it entirely to get the full argument list. Reported-by: Samuel Dionne-Riel Acked-by: Kees Cook Cc: Oleg Nesterov Signed-off-by: Linus Torvalds fs/binfmt_script.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) commit 23e93c9b2cde73f9912d0d8534adbddd3dcc48f4 Author: Bob Peterson Date: Wed Feb 13 15:12:17 2019 -0500 Revert "gfs2: read journal in large chunks to locate the head" This reverts commit 2a5f14f279f59143139bcd1606903f2f80a34241. This patch causes xfstests generic/311 to fail. Reverting this for now until we have a proper fix. Signed-off-by: Abhi Das Signed-off-by: Bob Peterson Signed-off-by: Linus Torvalds fs/gfs2/glops.c | 1 - fs/gfs2/log.c | 4 +- fs/gfs2/lops.c | 190 ++------------------------------------------------- fs/gfs2/lops.h | 4 +- fs/gfs2/ops_fstype.c | 1 - fs/gfs2/recovery.c | 123 +++++++++++++++++++++++++++++++++ fs/gfs2/recovery.h | 2 + fs/gfs2/super.c | 1 - 8 files changed, 134 insertions(+), 192 deletions(-) commit f9bcc9f3ee4fbbe8f11dfec76745476f5780517e Author: Vivien Didelot Date: Thu Feb 14 11:15:35 2019 -0500 net: ethernet: freescale: set FEC ethtool regs version Currently the ethtool_regs version is set to 0 for FEC devices. Use this field to store the register dump version exposed by the kernel. The choosen version 2 corresponds to the kernel compile test: #if defined(CONFIG_M523x) || defined(CONFIG_M527x) || defined(CONFIG_M528x) || defined(CONFIG_M520x) || defined(CONFIG_M532x) || defined(CONFIG_ARM) || defined(CONFIG_ARM64) || defined(CONFIG_COMPILE_TEST) and version 1 corresponds to the opposite. Binaries of ethtool unaware of this version will dump the whole set as usual. Signed-off-by: Vivien Didelot Signed-off-by: David S. Miller drivers/net/ethernet/freescale/fec_main.c | 4 ++++ 1 file changed, 4 insertions(+) commit 3bf6b57ec2ec945e5a6edf5c202a754f1e852ecd Author: J. Bruce Fields Date: Thu Feb 14 12:33:19 2019 -0500 Revert "nfsd4: return default lease period" This reverts commit d6ebf5088f09472c1136cd506bdc27034a6763f8. I forgot that the kernel's default lease period should never be decreased! After a kernel upgrade, the kernel has no way of knowing on its own what the previous lease time was. Unless userspace tells it otherwise, it will assume the previous lease period was the same. So if we decrease this value in a kernel upgrade, we end up enforcing a grace period that's too short, and clients will fail to reclaim state in time. Symptoms may include EIO and log messages like "NFS: nfs4_reclaim_open_state: Lock reclaim failed!" There was no real justification for the lease period decrease anyway. Reported-by: Donald Buczek Fixes: d6ebf5088f09 "nfsd4: return default lease period" Cc: stable@vger.kernel.org Signed-off-by: J. Bruce Fields fs/nfsd/nfsctl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit c969c6e7ab8cb42b5c787c567615474fdbad9d6a Author: Huang Zijiang Date: Thu Feb 14 14:41:45 2019 +0800 net: hns: Fix object reference leaks in hns_dsaf_roce_reset() The of_find_device_by_node() takes a reference to the underlying device structure, we should release that reference. Signed-off-by: Huang Zijiang Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c | 2 ++ 1 file changed, 2 insertions(+) commit 2c2ade81741c66082f8211f0b96cf509cc4c0218 Author: Jann Horn Date: Wed Feb 13 22:45:59 2019 +0100 mm: page_alloc: fix ref bias in page_frag_alloc() for 1-byte allocs The basic idea behind ->pagecnt_bias is: If we pre-allocate the maximum number of references that we might need to create in the fastpath later, the bump-allocation fastpath only has to modify the non-atomic bias value that tracks the number of extra references we hold instead of the atomic refcount. The maximum number of allocations we can serve (under the assumption that no allocation is made with size 0) is nc->size, so that's the bias used. However, even when all memory in the allocation has been given away, a reference to the page is still held; and in the `offset < 0` slowpath, the page may be reused if everyone else has dropped their references. This means that the necessary number of references is actually `nc->size+1`. Luckily, from a quick grep, it looks like the only path that can call page_frag_alloc(fragsz=1) is TAP with the IFF_NAPI_FRAGS flag, which requires CAP_NET_ADMIN in the init namespace and is only intended to be used for kernel testing and fuzzing. To test for this issue, put a `WARN_ON(page_ref_count(page) == 0)` in the `offset < 0` path, below the virt_to_page() call, and then repeatedly call writev() on a TAP device with IFF_TAP|IFF_NO_PI|IFF_NAPI_FRAGS|IFF_NAPI, with a vector consisting of 15 elements containing 1 byte each. Signed-off-by: Jann Horn Signed-off-by: David S. Miller mm/page_alloc.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 61c4c0bcff87773cd65d1cf487e2b2a34bc6730f Merge: 39c133196237 a20049071796 Author: David S. Miller Date: Thu Feb 14 12:04:55 2019 -0500 Merge branch 'net-phy-fix-locking-issue' Heiner Kallweit says: ==================== net: phy: fix locking issue Russell pointed out that the locking used in phy_is_started() isn't needed and misleading. This locking also contributes to a race fixed with patch 2. ==================== Signed-off-by: David S. Miller commit a20049071796691cf99eb6433968fc3c27632b95 Author: Heiner Kallweit Date: Wed Feb 13 20:12:54 2019 +0100 net: phy: fix potential race in the phylib state machine Russell reported the following race in the phylib state machine (quoting from his mail): if (phy_polling_mode(phydev) && phy_is_started(phydev)) phy_queue_state_machine(phydev, PHY_STATE_TIME); state = PHY_UP thread 0 thread 1 phy_disconnect() +-phy_is_started() phy_is_started() | `-phy_stop() +-phydev->state = PHY_HALTED `-phy_stop_machine() `-cancel_delayed_work_sync() phy_queue_state_machine() `-mod_delayed_work() At this point, the phydev->state_queue() has been added back onto the system workqueue despite phy_stop_machine() having been called and cancel_delayed_work_sync() called on it. Fix this by protecting the complete operation in thread 0. Fixes: 2b3e88ea6528 ("net: phy: improve phy state checking") Reported-by: Russell King - ARM Linux admin Signed-off-by: Heiner Kallweit Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/phy/phy.c | 2 ++ 1 file changed, 2 insertions(+) commit a2fc9d7e36f6d484d9be4a0a204400aaf6059544 Author: Heiner Kallweit Date: Wed Feb 13 20:11:40 2019 +0100 net: phy: don't use locking in phy_is_started Russell suggested to remove the locking from phy_is_started() because the read is atomic anyway and actually the locking may be more misleading. Fixes: 2b3e88ea6528 ("net: phy: improve phy state checking") Suggested-by: Russell King - ARM Linux admin Signed-off-by: Heiner Kallweit Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/phy/phy.c | 11 +++++------ include/linux/phy.h | 15 +-------------- 2 files changed, 6 insertions(+), 20 deletions(-) commit 39c133196237335e8ee9e3694ef7921241cf6a41 Author: Deepa Dinamani Date: Wed Feb 13 09:09:13 2019 -0800 selftests: fix timestamping Makefile The clean target in the makefile conflicts with the generic kselftests lib.mk, and fails to properly remove the compiled test programs. Remove the redundant rule, the TEST_GEN_FILES will be already removed by the CLEAN macro in lib.mk. Signed-off-by: Deepa Dinamani Acked-by: Shuah Khan Signed-off-by: David S. Miller tools/testing/selftests/networking/timestamping/Makefile | 3 --- 1 file changed, 3 deletions(-) commit 98ae70cc476e833332a2c6bb72f941a25f0de226 Author: Xiaoyao Li Date: Thu Feb 14 12:08:58 2019 +0800 kvm: vmx: Fix entry number check for add_atomic_switch_msr() Commit ca83b4a7f2d068da79a0 ("x86/KVM/VMX: Add find_msr() helper function") introduces the helper function find_msr(), which returns -ENOENT when not find the msr in vmx->msr_autoload.guest/host. Correct checking contion of no more available entry in vmx->msr_autoload. Fixes: ca83b4a7f2d0 ("x86/KVM/VMX: Add find_msr() helper function") Cc: stable@vger.kernel.org Signed-off-by: Xiaoyao Li Signed-off-by: Paolo Bonzini arch/x86/kvm/vmx/vmx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit c112b5f50232a257056903040c66d97efb536889 Author: Luwei Kang Date: Thu Feb 14 10:48:07 2019 +0800 KVM: x86: Recompute PID.ON when clearing PID.SN Some Posted-Interrupts from passthrough devices may be lost or overwritten when the vCPU is in runnable state. The SN (Suppress Notification) of PID (Posted Interrupt Descriptor) will be set when the vCPU is preempted (vCPU in KVM_MP_STATE_RUNNABLE state but not running on physical CPU). If a posted interrupt comes at this time, the irq remapping facility will set the bit of PIR (Posted Interrupt Requests) but not ON (Outstanding Notification). Then, the interrupt will not be seen by KVM, which always expects PID.ON=1 if PID.PIR=1 as documented in the Intel processor SDM but not in the VT-d specification. To fix this, restore the invariant after PID.SN is cleared. Signed-off-by: Luwei Kang Signed-off-by: Paolo Bonzini arch/x86/kvm/vmx/vmx.c | 26 +++++++++++--------------- arch/x86/kvm/vmx/vmx.h | 10 +++++----- arch/x86/kvm/x86.c | 2 +- 3 files changed, 17 insertions(+), 21 deletions(-) commit 8cd8f0ce0d6aafe661cb3d6781c8b82bc696c04d Author: Rajneesh Bhardwaj Date: Thu Feb 14 17:27:08 2019 +0530 x86/CPU: Add Icelake model number Add the CPUID model number of Icelake (ICL) mobile processors to the Intel family list. Icelake U/Y series uses model number 0x7E. Signed-off-by: Rajneesh Bhardwaj Signed-off-by: Borislav Petkov Cc: Andy Shevchenko Cc: Dave Hansen Cc: "David E. Box" Cc: dvhart@infradead.org Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Kan Liang Cc: Peter Zijlstra Cc: platform-driver-x86@vger.kernel.org Cc: Qiuxu Zhuo Cc: Srinivas Pandruvada Cc: Thomas Gleixner Cc: x86-ml Link: https://lkml.kernel.org/r/20190214115712.19642-2-rajneesh.bhardwaj@linux.intel.com arch/x86/include/asm/intel-family.h | 2 ++ 1 file changed, 2 insertions(+) commit af14b2c98adb85e9517390bb88309338b9075350 Author: Lubomir Rintel Date: Thu Feb 14 00:06:18 2019 +0100 gpio: pxa: avoid attempting to set pin direction via pinctrl on MMP2 Similarly to PXA3xx, pinctrl-single can't set pin direction on MMP2 either. See also: commit 9dabfdd84bdfa ("gpio: pxa: disable pinctrl calls for PXA3xx") Cc: stable@vger.kernel.org Fixes: a770d946371e ("gpio: pxa: add pin control gpio direction and request") Signed-off-by: Lubomir Rintel Acked-by: Pavel Machek Signed-off-by: Linus Walleij drivers/gpio/gpio-pxa.c | 1 + 1 file changed, 1 insertion(+) commit c8c6ee611926685a7d753409e0a6e48b9e1b8748 Author: Hui Wang Date: Thu Feb 14 11:41:33 2019 +0800 ALSA: hda/realtek: Disable PC beep in passthrough on alc285 It is reported that there's a constant background "hum/whitenoise" in the headset on the Lenovo X1 machines with the codec alc285, and it is confirmed that if we run the command below, the noise will stop. sudo hda-verb /dev/snd/hwC0D0 0x1d SET_PIN_WIDGET_CONTROL 0x0 Then I consulted this issue with Kailang, he told me the pin 0x1d on this codec is used for PC beep in, the noise probably comes from this pin and we can also disable the PC beep in passthrough, then the PC beep in will not affect other sound playback. Fixes: c4cfcf6f4297 ("ALSA: hda/realtek - fix the pop noise on headphone for lenovo laptops") Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1660581 Cc: Signed-off-by: Kailang Yang Signed-off-by: Hui Wang Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) commit 7f665b1c3283aae5b61843136d0a8ee808ba3199 Author: Jeremy Soller Date: Wed Feb 13 10:56:19 2019 -0700 ALSA: hda/realtek - Headset microphone and internal speaker support for System76 oryp5 On the System76 Oryx Pro (oryp5), there is a headset microphone input attached to 0x19 that does not have a jack detect. In order to get it working, the pin configuration needs to be set correctly, and the ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC fixup needs to be applied. This is similar to the MIC_NO_PRESENCE fixups for some Dell laptops, except we have a separate microphone jack that is already configured correctly. Since the ALC1220 does not have a fixup similar to ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC, I have exposed the fixup from the ALC269 in a way that it can be accessed from the alc1220_fixup_system76_oryp5 function. In addition, the alc1220_fixup_clevo_p950 needs to be applied to gain speaker output. Signed-off-by: Jeremy Soller Cc: Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) commit 8d6ea932856c7087ce8c3d0e79494b7d5386f962 Author: Dan Carpenter Date: Wed Feb 13 11:23:04 2019 +0300 net: dsa: bcm_sf2: potential array overflow in bcm_sf2_sw_suspend() The value of ->num_ports comes from bcm_sf2_sw_probe() and it is less than or equal to DSA_MAX_PORTS. The ds->ports[] array is used inside the dsa_is_user_port() and dsa_is_cpu_port() functions. The ds->ports[] array is allocated in dsa_switch_alloc() and it has ds->num_ports elements so this leads to a static checker warning about a potential out of bounds read. Fixes: 8cfa94984c9c ("net: dsa: bcm_sf2: add suspend/resume callbacks") Signed-off-by: Dan Carpenter Reviewed-by: Vivien Didelot Signed-off-by: David S. Miller drivers/net/dsa/bcm_sf2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5bf325a53202b8728cf7013b72688c46071e212e Author: Eric Dumazet Date: Tue Feb 12 12:26:27 2019 -0800 net: fix possible overflow in __sk_mem_raise_allocated() With many active TCP sockets, fat TCP sockets could fool __sk_mem_raise_allocated() thanks to an overflow. They would increase their share of the memory, instead of decreasing it. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller include/net/sock.h | 2 +- net/core/sock.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 7c0db24cc431e2196d98a5d5ddaa9088e2fcbfe5 Author: John David Anglin Date: Mon Feb 11 13:40:21 2019 -0500 dsa: mv88e6xxx: Ensure all pending interrupts are handled prior to exit The GPIO interrupt controller on the espressobin board only supports edge interrupts. If one enables the use of hardware interrupts in the device tree for the 88E6341, it is possible to miss an edge. When this happens, the INTn pin on the Marvell switch is stuck low and no further interrupts occur. I found after adding debug statements to mv88e6xxx_g1_irq_thread_work() that there is a race in handling device interrupts (e.g. PHY link interrupts). Some interrupts are directly cleared by reading the Global 1 status register. However, the device interrupt flag, for example, is not cleared until all the unmasked SERDES and PHY ports are serviced. This is done by reading the relevant SERDES and PHY status register. The code only services interrupts whose status bit is set at the time of reading its status register. If an interrupt event occurs after its status is read and before all interrupts are serviced, then this event will not be serviced and the INTn output pin will remain low. This is not a problem with polling or level interrupts since the handler will be called again to process the event. However, it's a big problem when using level interrupts. The fix presented here is to add a loop around the code servicing switch interrupts. If any pending interrupts remain after the current set has been handled, we loop and process the new set. If there are no pending interrupts after servicing, we are sure that INTn has gone high and we will get an edge when a new event occurs. Tested on espressobin board. Fixes: dc30c35be720 ("net: dsa: mv88e6xxx: Implement interrupt support.") Signed-off-by: John David Anglin Tested-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx/chip.c | 28 ++++++++++++++++++++++------ 1 file changed, 22 insertions(+), 6 deletions(-) commit b79555d5d8d32643e9d7193341dcaff13bf9ffcd Author: Heiner Kallweit Date: Tue Feb 12 19:56:15 2019 +0100 net: phy: fix interrupt handling in non-started states phylib enables interrupts before phy_start() has been called, and if we receive an interrupt in a non-started state, the interrupt handler returns IRQ_NONE. This causes problems with at least one Marvell chip as reported by Andrew. Fix this by handling interrupts the same as in phy_mac_interrupt(), basically always running the phylib state machine. It knows when it has to do something and when not. This change allows to handle interrupts gracefully even if they occur in a non-started state. Fixes: 2b3e88ea6528 ("net: phy: improve phy state checking") Reported-by: Andrew Lunn Signed-off-by: Heiner Kallweit Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/phy/phy.c | 3 --- 1 file changed, 3 deletions(-) commit af98c5a78517c04adb5fd68bb64b1ad6fe3d473f Author: Xin Long Date: Tue Feb 12 18:51:01 2019 +0800 sctp: set stream ext to NULL after freeing it in sctp_stream_outq_migrate In sctp_stream_init(), after sctp_stream_outq_migrate() freed the surplus streams' ext, but sctp_stream_alloc_out() returns -ENOMEM, stream->outcnt will not be set to 'outcnt'. With the bigger value on stream->outcnt, when closing the assoc and freeing its streams, the ext of those surplus streams will be freed again since those stream exts were not set to NULL after freeing in sctp_stream_outq_migrate(). Then the invalid-free issue reported by syzbot would be triggered. We fix it by simply setting them to NULL after freeing. Fixes: 5bbbbe32a431 ("sctp: introduce stream scheduler foundations") Reported-by: syzbot+58e480e7b28f2d890bfd@syzkaller.appspotmail.com Signed-off-by: Xin Long Acked-by: Neil Horman Acked-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller net/sctp/stream.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit fc228abc2347e106a44c0e9b29ab70b712c4ca51 Author: Xin Long Date: Tue Feb 12 18:47:30 2019 +0800 sctp: call gso_reset_checksum when computing checksum in sctp_gso_segment Jianlin reported a panic when running sctp gso over gre over vlan device: [ 84.772930] RIP: 0010:do_csum+0x6d/0x170 [ 84.790605] Call Trace: [ 84.791054] csum_partial+0xd/0x20 [ 84.791657] gre_gso_segment+0x2c3/0x390 [ 84.792364] inet_gso_segment+0x161/0x3e0 [ 84.793071] skb_mac_gso_segment+0xb8/0x120 [ 84.793846] __skb_gso_segment+0x7e/0x180 [ 84.794581] validate_xmit_skb+0x141/0x2e0 [ 84.795297] __dev_queue_xmit+0x258/0x8f0 [ 84.795949] ? eth_header+0x26/0xc0 [ 84.796581] ip_finish_output2+0x196/0x430 [ 84.797295] ? skb_gso_validate_network_len+0x11/0x80 [ 84.798183] ? ip_finish_output+0x169/0x270 [ 84.798875] ip_output+0x6c/0xe0 [ 84.799413] ? ip_append_data.part.50+0xc0/0xc0 [ 84.800145] iptunnel_xmit+0x144/0x1c0 [ 84.800814] ip_tunnel_xmit+0x62d/0x930 [ip_tunnel] [ 84.801699] gre_tap_xmit+0xac/0xf0 [ip_gre] [ 84.802395] dev_hard_start_xmit+0xa5/0x210 [ 84.803086] sch_direct_xmit+0x14f/0x340 [ 84.803733] __dev_queue_xmit+0x799/0x8f0 [ 84.804472] ip_finish_output2+0x2e0/0x430 [ 84.805255] ? skb_gso_validate_network_len+0x11/0x80 [ 84.806154] ip_output+0x6c/0xe0 [ 84.806721] ? ip_append_data.part.50+0xc0/0xc0 [ 84.807516] sctp_packet_transmit+0x716/0xa10 [sctp] [ 84.808337] sctp_outq_flush+0xd7/0x880 [sctp] It was caused by SKB_GSO_CB(skb)->csum_start not set in sctp_gso_segment. sctp_gso_segment() calls skb_segment() with 'feature | NETIF_F_HW_CSUM', which causes SKB_GSO_CB(skb)->csum_start not to be set in skb_segment(). For TCP/UDP, when feature supports HW_CSUM, CHECKSUM_PARTIAL will be set and gso_reset_checksum will be called to set SKB_GSO_CB(skb)->csum_start. So SCTP should do the same as TCP/UDP, to call gso_reset_checksum() when computing checksum in sctp_gso_segment. Reported-by: Jianlin Shi Signed-off-by: Xin Long Acked-by: Neil Horman Acked-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller net/sctp/offload.c | 1 + 1 file changed, 1 insertion(+) commit f325ef72975d5e0f95f39e2efeb5acadfb418890 Merge: 41ceb5e87f6e 753c111f655e Author: David S. Miller Date: Wed Feb 13 19:13:47 2019 -0500 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter/IPVS fixes for net The following patchset contains Netfilter/IPVS fixes for net: 1) Missing structure initialization in ebtables causes splat with 32-bit user level on a 64-bit kernel, from Francesco Ruggeri. 2) Missing dependency on nf_defrag in IPVS IPv6 codebase, from Andrea Claudi. 3) Fix possible use-after-free from release path of target extensions. ==================== Signed-off-by: David S. Miller commit 41ceb5e87f6e7ffcc4ff76519a11d1a5e72e19f5 Merge: 2fdeee254923 407e17b1a69a Author: David S. Miller Date: Wed Feb 13 19:07:47 2019 -0500 Merge tag 'mlx5-fixes-2019-02-13' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== Mellanox, mlx5 fixes 2019-02-13 This series introduces some fixes to mlx5 driver. For more information please see tag log below. ==================== Signed-off-by: David S. Miller commit 407e17b1a69a51ba9a512a04342da56c1f931df4 Author: Saeed Mahameed Date: Mon Feb 11 16:27:02 2019 -0800 net/mlx5e: XDP, fix redirect resources availability check Currently mlx5 driver creates xdp redirect hw queues unconditionally on netdevice open, This is great until someone starts redirecting XDP traffic via ndo_xdp_xmit on mlx5 device and changes the device configuration at the same time, this might cause crashes, since the other device's napi is not aware of the mlx5 state change (resources un-availability). To fix this we must synchronize with other devices napi's on the system. Added a new flag under mlx5e_priv to determine XDP TX resources are available, set/clear it up when necessary and use synchronize_rcu() when the flag is turned off, so other napi's are in-sync with it, before we actually cleanup the hw resources. The flag is tested prior to committing to transmit on mlx5e_xdp_xmit, and it is sufficient to determine if it safe to transmit or not. The other two internal flags (MLX5E_STATE_OPENED and MLX5E_SQ_STATE_ENABLED) become unnecessary. Thus, they are removed from data path. Fixes: 58b99ee3e3eb ("net/mlx5e: Add support for XDP_REDIRECT in device-out side") Reported-by: Toke Høiland-Jørgensen Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 + drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c | 6 ++---- drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h | 17 +++++++++++++++++ drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 2 ++ 4 files changed, 22 insertions(+), 4 deletions(-) commit 5400261e4d293d741c5b71a07f6eaabe2c8d3f1b Author: Tariq Toukan Date: Tue Jan 22 14:18:04 2019 +0200 net/mlx5: Fix a compilation warning in events.c Eliminate the following compilation warning: drivers/net/ethernet/mellanox/mlx5/core/events.c: warning: 'error_str' may be used uninitialized in this function [-Wuninitialized]: => 238:3 Fixes: c2fb3db22d35 ("net/mlx5: Rework handling of port module events") Signed-off-by: Tariq Toukan Reviewed-by: Mikhael Goikhman Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/events.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) commit 4cab346bcf74f44665d57726ec2bccff6e679619 Author: Huy Nguyen Date: Thu Feb 7 09:22:56 2019 -0600 net/mlx5: No command allowed when command interface is not ready When EEH is injected and PCI bus stalls, mlx5's pci error detect function is called to deactivate the command interface and tear down the device. The issue is that there can be a thread that already passed MLX5_DEVICE_STATE_INTERNAL_ERROR check, it will send the command and stuck in the wait_func. Solution: Add function mlx5_cmd_flush to disable command interface and clear all the pending commands. When device state is set to MLX5_DEVICE_STATE_INTERNAL_ERROR, call mlx5_cmd_flush to ensure all pending threads waiting for firmware commands completion are terminated. Fixes: c1d4d2e92ad6 ("net/mlx5: Avoid calling sleeping function by the health poll thread") Signed-off-by: Huy Nguyen Reviewed-by: Daniel Jurgens Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 18 ++++++++++++++++++ drivers/net/ethernet/mellanox/mlx5/core/health.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h | 1 + 3 files changed, 20 insertions(+), 1 deletion(-) commit fb35c534b7881c0f7f94b01ddd95a9b17483252f Author: Maria Pasechnik Date: Sun Feb 3 17:55:09 2019 +0200 net/mlx5e: Fix NULL pointer derefernce in set channels error flow New channels are applied to the priv channels only after they are successfully opened. Then, the indirection table should be built according to the new number of channels. Currently, such build is preformed independently of whether the channels opening is successful, and is not reverted on failure. The bug is caused due to removal of rss params from channels struct and moving it to priv struct. That change cause to independency between channels and rss params. This causes a crash on a later point, when accessing rqn of a non existing channel. This patch fixes it by moving the indirection table build right before switching the priv channels to new channels struct, after the new set of channels was successfully opened. Fixes: bbeb53b8b2c9 ("net/mlx5e: Move RSS params to a dedicated struct") Signed-off-by: Maria Pasechnik Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 08e16754cad2298f8cb58bd0f99e658da54c327d Merge: bc44121190ae 7d82602909ed Author: Paolo Bonzini Date: Wed Feb 13 19:39:24 2019 +0100 Merge tag 'kvm-arm-fixes-for-5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into kvm-master KVM/ARM fixes for 5.0: - Fix the way we reset vcpus, plugging the race that could happen on VHE - Fix potentially inconsistent group setting for private interrupts - Don't generate UNDEF when LORegion feature is present - Relax the restriction on using stage2 PUD huge mapping - Turn some spinlocks into raw_spinlocks to help RT compliance commit bc44121190aea96de171408310db3d3c87e2cc11 Author: Sean Christopherson Date: Tue Feb 12 16:42:23 2019 -0800 KVM: nVMX: Restore a preemption timer consistency check A recently added preemption timer consistency check was unintentionally dropped when the consistency checks were being reorganized to match the SDM's ordering. Fixes: 461b4ba4c7ad ("KVM: nVMX: Move the checks for VM-Execution Control Fields to a separate helper function") Cc: Krish Sadhukhan Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini arch/x86/kvm/vmx/nested.c | 4 ++++ 1 file changed, 4 insertions(+) commit b6ea7bcf77831ee5741e903738a19c94715b15e9 Merge: 1f947a7a011f f6675872db57 Author: Linus Torvalds Date: Wed Feb 13 10:28:17 2019 -0800 Merge tag 'trace-v5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fix from Steven Rostedt: "This fixes kprobes/uprobes dynamic processing of strings, where it processes the args but does not update the remaining length of the buffer that the string arguments will be placed in. It constantly passes in the total size of buffer used instead of passing in the remaining size of the buffer used. This could cause issues if the strings are larger than the max size of an event which could cause the strings to be written beyond what was reserved on the buffer" * tag 'trace-v5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing: probeevent: Correctly update remaining space in dynamic area commit 753c111f655e38bbd52fc01321266633f022ebe2 Author: Pablo Neira Ayuso Date: Wed Feb 13 13:03:53 2019 +0100 netfilter: nft_compat: use-after-free when deleting targets Fetch pointer to module before target object is released. Fixes: 29e3880109e3 ("netfilter: nf_tables: fix use-after-free when deleting compat expressions") Fixes: 0ca743a55991 ("netfilter: nf_tables: add compatibility layer for x_tables") Signed-off-by: Pablo Neira Ayuso net/netfilter/nft_compat.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 05c3ae7aa13084d31b5109e7e8d7c74e305b325f Merge: 9ff1a3b49125 ee0b27a3a4da Author: Stephen Boyd Date: Wed Feb 13 09:01:21 2019 -0800 Merge tag 'sunxi-clk-fixes-for-5.0' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into clk-fixes Pull Allwinner clock fixes from Maxime Ripard: Two fixes for clock indices, one for the A31 and one for the V3s. * tag 'sunxi-clk-fixes-for-5.0' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: clk: sunxi: A31: Fix wrong AHB gate number clk: sunxi-ng: v3s: Fix TCON reset de-assert bit commit 1d69511e49b0107c0a60ff5ef488f5a2512a50ae Author: Alex Deucher Date: Tue Feb 12 09:54:31 2019 -0500 drm/amdgpu/psp11: TA firmware is optional (v3) Don't warn or fail if it's missing. v2: handle xgmi case more gracefully. v3: handle older kernels properly Reviewed-by: Hawking Zhang Tested-by: James Zhu Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 9 +++++++-- drivers/gpu/drm/amd/amdgpu/psp_v11_0.c | 28 ++++++++++++++++------------ 2 files changed, 23 insertions(+), 14 deletions(-) commit ace74f73c200df4254788210ac70e00a7aeca4b8 Merge: 69306fe17ac5 4726bcf30fad Author: Jens Axboe Date: Wed Feb 13 07:32:30 2019 -0700 Merge branch 'nvme-5.0' of git://git.infradead.org/nvme into for-linus Pull single NVMe fix from Christoph * 'nvme-5.0' of git://git.infradead.org/nvme: nvme-pci: add missing unlock for reset error commit cf43a757fd49442bc38f76088b70c2299eed2c2f Author: Eric W. Biederman Date: Mon Feb 11 23:27:42 2019 -0600 signal: Restore the stop PTRACE_EVENT_EXIT In the middle of do_exit() there is there is a call "ptrace_event(PTRACE_EVENT_EXIT, code);" That call places the process in TACKED_TRACED aka "(TASK_WAKEKILL | __TASK_TRACED)" and waits for for the debugger to release the task or SIGKILL to be delivered. Skipping past dequeue_signal when we know a fatal signal has already been delivered resulted in SIGKILL remaining pending and TIF_SIGPENDING remaining set. This in turn caused the scheduler to not sleep in PTACE_EVENT_EXIT as it figured a fatal signal was pending. This also caused ptrace_freeze_traced in ptrace_check_attach to fail because it left a per thread SIGKILL pending which is what fatal_signal_pending tests for. This difference in signal state caused strace to report strace: Exit of unknown pid NNNNN ignored Therefore update the signal handling state like dequeue_signal would when removing a per thread SIGKILL, by removing SIGKILL from the per thread signal mask and clearing TIF_SIGPENDING. Acked-by: Oleg Nesterov Reported-by: Oleg Nesterov Reported-by: Ivan Delalande Cc: stable@vger.kernel.org Fixes: 35634ffa1751 ("signal: Always notice exiting tasks") Signed-off-by: "Eric W. Biederman" kernel/signal.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 207a369e3c085799e7836221f64e7a7329985fb6 Author: Masahiro Yamada Date: Mon Feb 4 18:10:55 2019 +0900 sh: fix build error for invisible CONFIG_BUILTIN_DTB_SOURCE I fixed a similar build error in commit 1b1e4ee86e00 ("sh: fix build error for empty CONFIG_BUILTIN_DTB_SOURCE"), but it came back again. Since commit 37c8a5fafa3b ("kbuild: consolidate Devicetree dtb build rules"), the combination of CONFIG_OF_EARLY_FLATTREE=y and CONFIG_USE_BUILTIN_DTB=n results in the following build error: make[1]: *** No rule to make target 'arch/sh/boot/dts/.dtb.o', needed by 'arch/sh/boot/dts/built-in.a'. Stop. Prior to that commit, there was only one path to descend into arch/sh/boot/dts/, and arch/sh/Makefile correctly guards it with CONFIG_USE_BUILTIN_DTB: core-$(CONFIG_USE_BUILTIN_DTB) += arch/sh/boot/dts/ Now, there is another path to descend there from the top Makefile when CONFIG_OF_EARLY_FLATTREE=y. If CONFIG_USE_BUILTIN_DTB is disabled, CONFIG_BUILTIN_DTB_SOURCE is invisible instead of defined as "". Add obj-$(CONFIG_USE_BUILTIN_DTB) guard to avoid the attempt to build the non-existing file. Fixes: 37c8a5fafa3b ("kbuild: consolidate Devicetree dtb build rules") Reported-by: kbuild test robot Signed-off-by: Masahiro Yamada arch/sh/boot/dts/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3e35730dd7540bad2d4e002703996391d9be49a0 Author: Aneesh Kumar K.V Date: Mon Feb 11 19:03:38 2019 +0530 mtd: powernv_flash: Fix device registration error This change helps me to get multiple mtd device registered. Without this I get sysfs: cannot create duplicate filename '/bus/nvmem/devices/flash0' CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.0.0-rc2-00557-g1ef20ef21f22 #13 Call Trace: [c0000000b38e3220] [c000000000b58fe4] dump_stack+0xe8/0x164 (unreliable) [c0000000b38e3270] [c0000000004cf074] sysfs_warn_dup+0x84/0xb0 [c0000000b38e32f0] [c0000000004cf6c4] sysfs_do_create_link_sd.isra.0+0x114/0x150 [c0000000b38e3340] [c000000000726a84] bus_add_device+0x94/0x1e0 [c0000000b38e33c0] [c0000000007218f0] device_add+0x4d0/0x830 [c0000000b38e3480] [c0000000009d54a8] nvmem_register.part.2+0x1c8/0xb30 [c0000000b38e3560] [c000000000834530] mtd_nvmem_add+0x90/0x120 [c0000000b38e3650] [c000000000835bc8] add_mtd_device+0x198/0x4e0 [c0000000b38e36f0] [c00000000083619c] mtd_device_parse_register+0x11c/0x280 [c0000000b38e3780] [c000000000840830] powernv_flash_probe+0x180/0x250 [c0000000b38e3820] [c00000000072c120] platform_drv_probe+0x60/0xf0 [c0000000b38e38a0] [c0000000007283c8] really_probe+0x138/0x4d0 [c0000000b38e3930] [c000000000728acc] driver_probe_device+0x13c/0x1b0 [c0000000b38e39b0] [c000000000728c7c] __driver_attach+0x13c/0x1c0 [c0000000b38e3a30] [c000000000725130] bus_for_each_dev+0xa0/0x120 [c0000000b38e3a90] [c000000000727b2c] driver_attach+0x2c/0x40 [c0000000b38e3ab0] [c0000000007270f8] bus_add_driver+0x228/0x360 [c0000000b38e3b40] [c00000000072a2e0] driver_register+0x90/0x1a0 [c0000000b38e3bb0] [c00000000072c020] __platform_driver_register+0x50/0x70 [c0000000b38e3bd0] [c00000000105c984] powernv_flash_driver_init+0x24/0x38 [c0000000b38e3bf0] [c000000000010904] do_one_initcall+0x84/0x464 [c0000000b38e3cd0] [c000000001004548] kernel_init_freeable+0x530/0x634 [c0000000b38e3db0] [c000000000011154] kernel_init+0x1c/0x168 [c0000000b38e3e20] [c00000000000bed4] ret_from_kernel_thread+0x5c/0x68 mtd mtd1: Failed to register NVMEM device With the change we now have root@(none):/sys/bus/nvmem/devices# ls -al total 0 drwxr-xr-x 2 root root 0 Feb 6 20:49 . drwxr-xr-x 4 root root 0 Feb 6 20:49 .. lrwxrwxrwx 1 root root 0 Feb 6 20:49 flash@0 -> ../../../devices/platform/ibm,opal:flash@0/mtd/mtd0/flash@0 lrwxrwxrwx 1 root root 0 Feb 6 20:49 flash@1 -> ../../../devices/platform/ibm,opal:flash@1/mtd/mtd1/flash@1 Fixes: 1cbb4a1c433a ("mtd: powernv: Add powernv flash MTD abstraction driver") Signed-off-by: Aneesh Kumar K.V Signed-off-by: Boris Brezillon drivers/mtd/devices/powernv_flash.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6e9526852fad7eb77b7755114951237312258ec7 Author: Aneesh Kumar K.V Date: Mon Feb 11 19:03:37 2019 +0530 mtd: Use mtd->name when registering nvmem device With this patch, we use the mtd->name instead of concatenating the name with '0'. Fixes: c4dfa25ab307 ("mtd: add support for reading MTD devices via the nvmem API") Signed-off-by: Aneesh Kumar K.V Signed-off-by: Boris Brezillon drivers/mtd/mtdcore.c | 1 + 1 file changed, 1 insertion(+) commit 10970e1b4be9c74fce8ab6e3c34a7d718f063f2c Author: Borislav Petkov Date: Tue Feb 12 14:28:03 2019 +0100 x86/a.out: Clear the dump structure initially dump_thread32() in aout_core_dump() does not clear the user32 structure allocated on the stack as the first thing on function entry. As a result, the dump.u_comm, dump.u_ar0 and dump.signal which get assigned before the clearing, get overwritten. Rename that function to fill_dump() to make it clear what it does and call it first thing. This was caught while staring at a patch by Derek Robson . Signed-off-by: Borislav Petkov Cc: Derek Robson Cc: Linus Torvalds Cc: Michael Matz Cc: x86@kernel.org Cc: Link: https://lkml.kernel.org/r/20190202005512.3144-1-robsonde@gmail.com arch/x86/ia32/ia32_aout.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 83e418a805d880a8b18add07f94d19b2a5a80307 Author: Martin Blumenstingl Date: Sat Feb 9 01:58:50 2019 +0100 mmc: meson-gx: fix interrupt name Commit bb364890323cca ("mmc: meson-gx: Free irq in release() callback") changed the _probe code to use request_threaded_irq() instead of devm_request_threaded_irq(). Unfortunately this removes a fallback for the interrupt name: devm_request_threaded_irq() uses the device name as fallback if the given IRQ name is NULL. request_threaded_irq() has no such fallback, thus /proc/interrupts shows "(null)" instead. Explicitly pass the dev_name() so we get the IRQ name shown in /proc/interrupts again. While here, also fix the indentation of the request_threaded_irq() parameter list. Fixes: bb364890323cca ("mmc: meson-gx: Free irq in release() callback") Signed-off-by: Martin Blumenstingl Signed-off-by: Ulf Hansson drivers/mmc/host/meson-gx-mmc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 528871b456026e6127d95b1b2bd8e3a003dc1614 Author: Ingo Molnar Date: Wed Feb 13 07:57:02 2019 +0100 perf/core: Fix impossible ring-buffer sizes warning The following commit: 9dff0aa95a32 ("perf/core: Don't WARN() for impossible ring-buffer sizes") results in perf recording failures with larger mmap areas: root@skl:/tmp# perf record -g -a failed to mmap with 12 (Cannot allocate memory) The root cause is that the following condition is buggy: if (order_base_2(size) >= MAX_ORDER) goto fail; The problem is that @size is in bytes and MAX_ORDER is in pages, so the right test is: if (order_base_2(size) >= PAGE_SHIFT+MAX_ORDER) goto fail; Fix it. Reported-by: "Jin, Yao" Bisected-by: Borislav Petkov Analyzed-by: Peter Zijlstra Cc: Julien Thierry Cc: Mark Rutland Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Greg Kroah-Hartman Cc: Fixes: 9dff0aa95a32 ("perf/core: Don't WARN() for impossible ring-buffer sizes") Signed-off-by: Ingo Molnar kernel/events/ring_buffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 388a49959ee4e4e99f160241d9599efa62cd4299 Author: Bill Kuzeja Date: Tue Feb 12 09:29:50 2019 -0500 scsi: qla2xxx: Fix panic from use after free in qla2x00_async_tm_cmd In qla2x00_async_tm_cmd, we reference off sp after it has been freed. This caused a panic on a system running a slub debug kernel. Since fcport is passed in anyways, just use that instead. Signed-off-by: Bill Kuzeja Acked-by: Giridhar Malavali Acked-by: Himanshu Madhani Signed-off-by: Martin K. Petersen drivers/scsi/qla2xxx/qla_init.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit e4a056987c86f402f1286e050b1dee3f4ce7c7eb Author: James Bottomley Date: Tue Feb 12 08:05:25 2019 -0800 scsi: sd: fix entropy gathering for most rotational disks The problem is that the default for MQ is not to gather entropy, whereas the default for the legacy queue was always to gather it. The original attempt to fix entropy gathering for rotational disks under MQ added an else branch in sd_read_block_characteristics(). Unfortunately, the entire check isn't reached if the device has no characteristics VPD page. Since this page was only introduced in SBC-3 and its optional anyway, most less expensive rotational disks don't have one, meaning they all stopped gathering entropy when we made MQ the default. In a wholly unrelated change, openssl and openssh won't function until the random number generator is initialised, meaning lots of people have been seeing large delays before they could log into systems with default MQ kernels due to this lack of entropy, because it now can take tens of minutes to initialise the kernel random number generator. The fix is to set the non-rotational and add-randomness flags unconditionally early on in the disk initialization path, so they can be reset only if the device actually reports being non-rotational via the VPD page. Reported-by: Mikael Pettersson Fixes: 83e32a591077 ("scsi: sd: Contribute to randomness when running rotational device") Cc: stable@vger.kernel.org Signed-off-by: James Bottomley Reviewed-by: Jens Axboe Reviewed-by: Xuewei Zhang Signed-off-by: Martin K. Petersen drivers/scsi/sd.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) commit cd4c5a48741056266ff19b2516e5355b5a01abf3 Merge: d13937116f1e eb0200a4357d Author: Dave Airlie Date: Wed Feb 13 13:05:03 2019 +1000 Merge tag 'imx-drm-fixes-2019-02-12' of git://git.pengutronix.de/pza/linux into drm-fixes drm/imx: plane, ldb, and ipu-v3 fixes - Fix CSI register offsets for i.MX51 and i.MX53. - Fix delayed page flip completion events on i.MX6QP due to unexpected behaviour of the PRE when issuing NOP buffer updates to the same buffer address. - Stop throwing errors for plane updates on disabled CRTCs when a userspace process is killed while a plane update is pending. - Add missing of_node_put cleanup in imx_ldb_bind. Signed-off-by: Dave Airlie From: Philipp Zabel Link: https://patchwork.freedesktop.org/patch/msgid/1549990602.4800.11.camel@pengutronix.de commit 131aee8b9807bc98379fa5a0270389dbc7dcec90 Author: Guo Ren Date: Thu Jan 31 14:34:37 2019 +0800 csky: Fixup dead loop in show_stack When STACKTRACE is enabled, we must pass fp as stack for unwind, otherwise random value in stack will casue a dead loop. Signed-off-by: Guo Ren Reported-by: Lu Baoquan arch/csky/kernel/dumpstack.c | 4 ++++ 1 file changed, 4 insertions(+) commit 76d21d186a65523b08ea5f70302e2c29ee8f6a8d Author: Guo Ren Date: Wed Jan 30 20:13:11 2019 +0800 csky: Fixup io-range page attribute for mmap("/dev/mem") Some user space drivers need accessing IO address and IO remap need SO(strong order) page-attribute to make IO operation correct. So we need add SO-page-attr for all non-memory address. Signed-off-by: Guo Ren Reported-by: Fan Xiaodong arch/csky/include/asm/pgtable.h | 5 +++++ arch/csky/mm/ioremap.c | 14 ++++++++++++++ 2 files changed, 19 insertions(+) commit 0f231dcfc664aaafa75a006ee10e55f3ae0c9b3c Author: Guo Ren Date: Thu Jan 24 22:43:58 2019 +0800 csky: coding convention: Use task_stack_page Use task_stack_page instead of p->stack to get stack. Follow the coding convention style. Also for init_stack, the same with other archs. Signed-off-by: Guo Ren arch/csky/include/asm/processor.h | 4 ++-- arch/csky/kernel/smp.c | 3 ++- 2 files changed, 4 insertions(+), 3 deletions(-) commit 9216cd7231c12a8c391bb2c904d13695398d3453 Author: Guo Ren Date: Thu Jan 24 22:16:31 2019 +0800 csky: Fixup wrong pt_regs size The bug is from commit 2054f4af1957 ("csky: bugfix gdb coredump error.") We change the ELF_NGREG to ELF_NGREG - 2 to fit gdb&gcc define, but forgot modify ptrace regset. Now coredump use ELF_NRGEG to parse GPRs and ptrace use pt_regs_regset, so there are two different reg_sets for userspace. Signed-off-by: Guo Ren arch/csky/kernel/ptrace.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 62eebea655d4be5a20fd563abfd7656724cdcd00 Author: Guo Ren Date: Fri Jan 11 12:48:25 2019 +0800 csky: Fixup _PAGE_GLOBAL bit for 610 tlb entry C-SKY CPU 8xx's _PAGE_GLOBAL is BIT(0), but 610's _PAGE_GLOBAL is BIT(6). Use _PAGE_GLOBAL macro instead of bad magic number. Signed-off-by: Guo Ren arch/csky/include/asm/pgtable.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 1f947a7a011fcceb14cb912f5481a53b18f1879a Merge: 991b9eb4243b 27dd768ed8db Author: Linus Torvalds Date: Tue Feb 12 17:15:33 2019 -0800 Merge branch 'akpm' (patches from Andrew) Merge fixes from Andrew Morton: "6 fixes" * emailed patches from Andrew Morton : mm: proc: smaps_rollup: fix pss_locked calculation Rename include/{uapi => }/asm-generic/shmparam.h really Revert "mm: use early_pfn_to_nid in page_ext_init" mm/gup: fix gup_pmd_range() for dax Revert "mm: slowly shrink slabs with a relatively small number of objects" Revert "mm: don't reclaim inodes with many attached pages" commit 27dd768ed8db48beefc4d9e006c58e7a00342bde Author: Sandeep Patil Date: Tue Feb 12 15:36:11 2019 -0800 mm: proc: smaps_rollup: fix pss_locked calculation The 'pss_locked' field of smaps_rollup was being calculated incorrectly. It accumulated the current pss everytime a locked VMA was found. Fix that by adding to 'pss_locked' the same time as that of 'pss' if the vma being walked is locked. Link: http://lkml.kernel.org/r/20190203065425.14650-1-sspatil@android.com Fixes: 493b0e9d945f ("mm: add /proc/pid/smaps_rollup") Signed-off-by: Sandeep Patil Acked-by: Vlastimil Babka Reviewed-by: Joel Fernandes (Google) Cc: Alexey Dobriyan Cc: Daniel Colascione Cc: [4.14.x, 4.19.x] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/proc/task_mmu.c | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) commit 76ce2a80a28ef5caa8cc0cd41ad04138fb7ffeed Author: Masahiro Yamada Date: Tue Feb 12 15:36:06 2019 -0800 Rename include/{uapi => }/asm-generic/shmparam.h really Commit 36c0f7f0f899 ("arch: unexport asm/shmparam.h for all architectures") is different from the patch I submitted. My patch is this: https://lore.kernel.org/lkml/1546904307-11124-1-git-send-email-yamada.masahiro@socionext.com/T/#u The file renaming part: rename include/{uapi => }/asm-generic/shmparam.h (100%) was lost when it was picked up. I think it was an accident because Andrew did not say anything. Link: http://lkml.kernel.org/r/1549158277-24558-1-git-send-email-yamada.masahiro@socionext.com Fixes: 36c0f7f0f899 ("arch: unexport asm/shmparam.h for all architectures") Signed-off-by: Masahiro Yamada Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/{uapi => }/asm-generic/shmparam.h | 0 1 file changed, 0 insertions(+), 0 deletions(-) commit 2f1ee0913ce58efe7f18fbd518bd54c598559b89 Author: Qian Cai Date: Tue Feb 12 15:36:03 2019 -0800 Revert "mm: use early_pfn_to_nid in page_ext_init" This reverts commit fe53ca54270a ("mm: use early_pfn_to_nid in page_ext_init"). When booting a system with "page_owner=on", start_kernel page_ext_init invoke_init_callbacks init_section_page_ext init_page_owner init_early_allocated_pages init_zones_in_node init_pages_in_zone lookup_page_ext page_to_nid The issue here is that page_to_nid() will not work since some page flags have no node information until later in page_alloc_init_late() due to DEFERRED_STRUCT_PAGE_INIT. Hence, it could trigger an out-of-bounds access with an invalid nid. UBSAN: Undefined behaviour in ./include/linux/mm.h:1104:50 index 7 is out of range for type 'zone [5]' Also, kernel will panic since flags were poisoned earlier with, CONFIG_DEBUG_VM_PGFLAGS=y CONFIG_NODE_NOT_IN_PAGE_FLAGS=n start_kernel setup_arch pagetable_init paging_init sparse_init sparse_init_nid memblock_alloc_try_nid_raw It did not handle it well in init_pages_in_zone() which ends up calling page_to_nid(). page:ffffea0004200000 is uninitialized and poisoned raw: ffffffffffffffff ffffffffffffffff ffffffffffffffff ffffffffffffffff raw: ffffffffffffffff ffffffffffffffff ffffffffffffffff ffffffffffffffff page dumped because: VM_BUG_ON_PAGE(PagePoisoned(p)) page_owner info is not active (free page?) kernel BUG at include/linux/mm.h:990! RIP: 0010:init_page_owner+0x486/0x520 This means that assumptions behind commit fe53ca54270a ("mm: use early_pfn_to_nid in page_ext_init") are incomplete. Therefore, revert the commit for now. A proper way to move the page_owner initialization to sooner is to hook into memmap initialization. Link: http://lkml.kernel.org/r/20190115202812.75820-1-cai@lca.pw Signed-off-by: Qian Cai Acked-by: Michal Hocko Cc: Pasha Tatashin Cc: Mel Gorman Cc: Yang Shi Cc: Joonsoo Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds init/main.c | 3 ++- mm/page_ext.c | 4 +--- 2 files changed, 3 insertions(+), 4 deletions(-) commit 414fd080d125408cb15d04ff4907e1dd8145c8c7 Author: Yu Zhao Date: Tue Feb 12 15:35:58 2019 -0800 mm/gup: fix gup_pmd_range() for dax For dax pmd, pmd_trans_huge() returns false but pmd_huge() returns true on x86. So the function works as long as hugetlb is configured. However, dax doesn't depend on hugetlb. Link: http://lkml.kernel.org/r/20190111034033.601-1-yuzhao@google.com Signed-off-by: Yu Zhao Reviewed-by: Jan Kara Cc: Dan Williams Cc: Huang Ying Cc: Matthew Wilcox Cc: Keith Busch Cc: "Michael S . Tsirkin" Cc: John Hubbard Cc: Wei Yang Cc: Mike Rapoport Cc: Andrea Arcangeli Cc: "Kirill A . Shutemov" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/gup.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit a9a238e83fbb0df31c3b9b67003f8f9d1d1b6c96 Author: Dave Chinner Date: Tue Feb 12 15:35:55 2019 -0800 Revert "mm: slowly shrink slabs with a relatively small number of objects" This reverts commit 172b06c32b9497 ("mm: slowly shrink slabs with a relatively small number of objects"). This change changes the agressiveness of shrinker reclaim, causing small cache and low priority reclaim to greatly increase scanning pressure on small caches. As a result, light memory pressure has a disproportionate affect on small caches, and causes large caches to be reclaimed much faster than previously. As a result, it greatly perturbs the delicate balance of the VFS caches (dentry/inode vs file page cache) such that the inode/dentry caches are reclaimed much, much faster than the page cache and this drives us into several other caching imbalance related problems. As such, this is a bad change and needs to be reverted. [ Needs some massaging to retain the later seekless shrinker modifications.] Link: http://lkml.kernel.org/r/20190130041707.27750-3-david@fromorbit.com Fixes: 172b06c32b9497 ("mm: slowly shrink slabs with a relatively small number of objects") Signed-off-by: Dave Chinner Cc: Wolfgang Walter Cc: Roman Gushchin Cc: Spock Cc: Rik van Riel Cc: Michal Hocko Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/vmscan.c | 10 ---------- 1 file changed, 10 deletions(-) commit 69056ee6a8a3d576ed31e38b3b14c70d6c74edcc Author: Dave Chinner Date: Tue Feb 12 15:35:51 2019 -0800 Revert "mm: don't reclaim inodes with many attached pages" This reverts commit a76cf1a474d7d ("mm: don't reclaim inodes with many attached pages"). This change causes serious changes to page cache and inode cache behaviour and balance, resulting in major performance regressions when combining worklaods such as large file copies and kernel compiles. https://bugzilla.kernel.org/show_bug.cgi?id=202441 This change is a hack to work around the problems introduced by changing how agressive shrinkers are on small caches in commit 172b06c32b94 ("mm: slowly shrink slabs with a relatively small number of objects"). It creates more problems than it solves, wasn't adequately reviewed or tested, so it needs to be reverted. Link: http://lkml.kernel.org/r/20190130041707.27750-2-david@fromorbit.com Fixes: a76cf1a474d7d ("mm: don't reclaim inodes with many attached pages") Signed-off-by: Dave Chinner Cc: Wolfgang Walter Cc: Roman Gushchin Cc: Spock Cc: Rik van Riel Cc: Michal Hocko Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/inode.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) commit 991b9eb4243b53e6dcaeda94e515d713ca7ddd2e Merge: 57902dc0670c 2a2ec4aa0577 Author: Linus Torvalds Date: Tue Feb 12 16:29:33 2019 -0800 Merge tag 'hwmon-for-v5.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fix from Guenter Roeck: "Fix fan detection for NCT6793D" * tag 'hwmon-for-v5.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (nct6775) Fix fan6 detection for NCT6793D commit 69306fe17ac56ea787bfea8545d7802981aec0d9 Merge: 96d7cb932e82 dfcc34c99f3e Author: Jens Axboe Date: Tue Feb 12 15:21:48 2019 -0700 Merge branch 'md-fixes' of https://github.com/liu-song-6/linux into for-linus Pull MD fix from Song * 'md-fixes' of https://github.com/liu-song-6/linux: md/raid1: don't clear bitmap bits on interrupted recovery. commit dfcc34c99f3ebc16b787b118763bf9cb6b1efc7a Author: Nate Dailey Date: Thu Feb 7 14:19:01 2019 -0500 md/raid1: don't clear bitmap bits on interrupted recovery. sync_request_write no longer submits writes to a Faulty device. This has the unfortunate side effect that bitmap bits can be incorrectly cleared if a recovery is interrupted (previously, end_sync_write would have prevented this). This means the next recovery may not copy everything it should, potentially corrupting data. Add a function for doing the proper md_bitmap_end_sync, called from end_sync_write and the Faulty case in sync_request_write. backport note to 4.14: s/md_bitmap_end_sync/bitmap_end_sync Cc: stable@vger.kernel.org 4.14+ Fixes: 0c9d5b127f69 ("md/raid1: avoid reusing a resync bio after error handling.") Reviewed-by: Jack Wang Tested-by: Jack Wang Signed-off-by: Nate Dailey Signed-off-by: Song Liu drivers/md/raid1.c | 28 ++++++++++++++++++---------- 1 file changed, 18 insertions(+), 10 deletions(-) commit 57902dc0670c2926b0b5cc93a1e2ddf09d53e706 Merge: 1d110257c290 41fb9d54f12b Author: Linus Torvalds Date: Tue Feb 12 13:33:48 2019 -0800 Merge tag 'riscv-for-linus-5.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/palmer/riscv-linux Pull RISC-V fixes from Palmer Dabbelt: "This contains a pair of bug fixes that I'd like to include in 5.0: - A fix to disambiguate swap from invalid PTEs, which fixes an error when trying to unmap PROT_NONE pages. - A revert to an optimization of the size of flat binaries. This is really a workaround to prevent breaking existing boot flows, but since the change was introduced as part of the 5.0 merge window I'd like to have the fix in before 5.0 so we can avoid a regression for any proper releases. With these I hope we're out of patches for 5.0 in RISC-V land" * tag 'riscv-for-linus-5.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/palmer/riscv-linux: Revert "RISC-V: Make BSS section as the last section in vmlinux.lds.S" riscv: Add pte bit to distinguish swap from invalid commit d2ceb7e57086750ea6198a31fd942d98099a0786 Author: Benjamin Coddington Date: Wed Feb 6 06:09:43 2019 -0500 NFS: Don't use page_file_mapping after removing the page If nfs_page_async_flush() removes the page from the mapping, then we can't use page_file_mapping() on it as nfs_updatepate() is wont to do when receiving an error. Instead, push the mapping to the stack before the page is possibly truncated. Fixes: 8fc75bed96bb ("NFS: Fix up return value on fatal errors in nfs_page_async_flush()") Signed-off-by: Benjamin Coddington Signed-off-by: Anna Schumaker fs/nfs/write.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) commit ad6fef776927b4172e55a1bd97b3cd441a0c261c Author: Greg Kroah-Hartman Date: Tue Feb 12 19:27:34 2019 +0100 rpc: properly check debugfs dentry before using it debugfs can now report an error code if something went wrong instead of just NULL. So if the return value is to be used as a "real" dentry, it needs to be checked if it is an error before dereferencing it. This is now happening because of ff9fb72bc077 ("debugfs: return error values, not NULL"), but why debugfs files are not being created properly is an older issue, probably one that has always been there and should probably be looked at... Cc: "J. Bruce Fields" Cc: Jeff Layton Cc: Trond Myklebust Cc: Anna Schumaker Cc: linux-nfs@vger.kernel.org Cc: netdev@vger.kernel.org Reported-by: David Howells Tested-by: David Howells Signed-off-by: Greg Kroah-Hartman Signed-off-by: Anna Schumaker net/sunrpc/debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a4cb5bdb754afe21f3e9e7164213e8600cf69427 Author: Nicolas Morey-Chaisemartin Date: Tue Feb 5 18:21:02 2019 +0100 xprtrdma: Make sure Send CQ is allocated on an existing compvec Make sure the device has at least 2 completion vectors before allocating to compvec#1 Fixes: a4699f5647f3 (xprtrdma: Put Send CQ in IB_POLL_WORKQUEUE mode) Signed-off-by: Nicolas Morey-Chaisemartin Reviewed-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/verbs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 2fdeee2549231b1f989f011bb18191f5660d3745 Author: Cong Wang Date: Mon Feb 11 21:59:51 2019 -0800 team: avoid complex list operations in team_nl_cmd_options_set() The current opt_inst_list operations inside team_nl_cmd_options_set() is too complex to track: LIST_HEAD(opt_inst_list); nla_for_each_nested(...) { list_for_each_entry(opt_inst, &team->option_inst_list, list) { if (__team_option_inst_tmp_find(&opt_inst_list, opt_inst)) continue; list_add(&opt_inst->tmp_list, &opt_inst_list); } } team_nl_send_event_options_get(team, &opt_inst_list); as while we retrieve 'opt_inst' from team->option_inst_list, it could be added to the local 'opt_inst_list' for multiple times. The __team_option_inst_tmp_find() doesn't work, as the setter team_mode_option_set() still calls team->ops.exit() which uses ->tmp_list too in __team_options_change_check(). Simplify the list operations by moving the 'opt_inst_list' and team_nl_send_event_options_get() into the nla_for_each_nested() loop so that it can be guranteed that we won't insert a same list entry for multiple times. Therefore, __team_option_inst_tmp_find() can be removed too. Fixes: 4fb0534fb7bb ("team: avoid adding twice the same option to the event list") Fixes: 2fcdb2c9e659 ("team: allow to send multiple set events in one message") Reported-by: syzbot+4d4af685432dc0e56c91@syzkaller.appspotmail.com Reported-by: syzbot+68ee510075cf64260cc4@syzkaller.appspotmail.com Cc: Jiri Pirko Cc: Paolo Abeni Signed-off-by: Cong Wang Acked-by: Jiri Pirko Reviewed-by: Paolo Abeni Signed-off-by: David S. Miller drivers/net/team/team.c | 27 +++++---------------------- 1 file changed, 5 insertions(+), 22 deletions(-) commit a090d7948edab45688e78497ffc072c03db4086c Merge: 6a7dd172000b 1db817e75f5b Author: David S. Miller Date: Tue Feb 12 14:10:56 2019 -0500 Merge branch 'net_sched-some-fixes-for-cls_tcindex' Cong Wang says: ==================== net_sched: some fixes for cls_tcindex This patchset contains 3 bug fixes for tcindex filter. Please check each patch for details. v2: fix a compile error in patch 2 drop netns refcnt in patch 1 ==================== Signed-off-by: Cong Wang commit 1db817e75f5b9387b8db11e37d5f0624eb9223e0 Author: Cong Wang Date: Mon Feb 11 13:06:16 2019 -0800 net_sched: fix two more memory leaks in cls_tcindex struct tcindex_filter_result contains two parts: struct tcf_exts and struct tcf_result. For the local variable 'cr', its exts part is never used but initialized without being released properly on success path. So just completely remove the exts part to fix this leak. For the local variable 'new_filter_result', it is never properly released if not used by 'r' on success path. Cc: Jamal Hadi Salim Cc: Jiri Pirko Signed-off-by: Cong Wang Signed-off-by: David S. Miller net/sched/cls_tcindex.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) commit 033b228e7f26b29ae37f8bfa1bc6b209a5365e9f Author: Cong Wang Date: Mon Feb 11 13:06:15 2019 -0800 net_sched: fix a memory leak in cls_tcindex When tcindex_destroy() destroys all the filter results in the perfect hash table, it invokes the walker to delete each of them. However, results with class==0 are skipped in either tcindex_walk() or tcindex_delete(), which causes a memory leak reported by kmemleak. This patch fixes it by skipping the walker and directly deleting these filter results so we don't miss any filter result. As a result of this change, we have to initialize exts->net properly in tcindex_alloc_perfect_hash(). For net-next, we need to consider whether we should initialize ->net in tcf_exts_init() instead, before that just directly test CONFIG_NET_CLS_ACT=y. Cc: Jamal Hadi Salim Cc: Jiri Pirko Signed-off-by: Cong Wang Signed-off-by: David S. Miller net/sched/cls_tcindex.c | 46 ++++++++++++++++++++++++++++++---------------- 1 file changed, 30 insertions(+), 16 deletions(-) commit 8015d93ebd27484418d4952284fd02172fa4b0b2 Author: Cong Wang Date: Mon Feb 11 13:06:14 2019 -0800 net_sched: fix a race condition in tcindex_destroy() tcindex_destroy() invokes tcindex_destroy_element() via a walker to delete each filter result in its perfect hash table, and tcindex_destroy_element() calls tcindex_delete() which schedules tcf RCU works to do the final deletion work. Unfortunately this races with the RCU callback __tcindex_destroy(), which could lead to use-after-free as reported by Adrian. Fix this by migrating this RCU callback to tcf RCU work too, as that workqueue is ordered, we will not have use-after-free. Note, we don't need to hold netns refcnt because we don't call tcf_exts_destroy() here. Fixes: 27ce4f05e2ab ("net_sched: use tcf_queue_work() in tcindex filter") Reported-by: Adrian Cc: Ben Hutchings Cc: Jamal Hadi Salim Cc: Jiri Pirko Signed-off-by: Cong Wang Signed-off-by: David S. Miller net/sched/cls_tcindex.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) commit 6a7dd172000bf3d50a24b2548fe9c692875d669c Merge: fc62814d690c d9b8656da922 Author: David S. Miller Date: Tue Feb 12 14:05:07 2019 -0500 Merge branch 'ena-races' Arthur Kiyanovski says: ==================== net: ena: race condition bug fix and version update This patchset includes a fix to a race condition that can cause kernel panic, as well as a driver version update because of this fix. ==================== Signed-off-by: David S. Miller commit d9b8656da92223eb004b4f4db74fe48e7433f7b2 Author: Arthur Kiyanovski Date: Mon Feb 11 19:17:44 2019 +0200 net: ena: update driver version from 2.0.2 to 2.0.3 Update driver version due to bug fix. Signed-off-by: Arthur Kiyanovski Signed-off-by: David S. Miller drivers/net/ethernet/amazon/ena/ena_netdev.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e1f1bd9bfbedcfce428ee7e1b82a6ec12d4c3863 Author: Arthur Kiyanovski Date: Mon Feb 11 19:17:43 2019 +0200 net: ena: fix race between link up and device initalization Fix race condition between ena_update_on_link_change() and ena_restore_device(). This race can occur if link notification arrives while the driver is performing a reset sequence. In this case link can be set up, enabling the device, before it is fully restored. If packets are sent at this time, the driver might access uninitialized data structures, causing kernel crash. Move the clearing of ENA_FLAG_ONGOING_RESET and netif_carrier_on() after ena_up() to ensure the device is ready when link is set up. Fixes: d18e4f683445 ("net: ena: fix race condition between device reset and link up setup") Signed-off-by: Arthur Kiyanovski Signed-off-by: David S. Miller drivers/net/ethernet/amazon/ena/ena_netdev.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit fc62814d690cf62189854464f4bd07457d5e9e50 Author: Kal Conley Date: Sun Feb 10 09:57:11 2019 +0100 net/packet: fix 4gb buffer limit due to overflow check When calculating rb->frames_per_block * req->tp_block_nr the result can overflow. Check it for overflow without limiting the total buffer size to UINT_MAX. This change fixes support for packet ring buffers >= UINT_MAX. Fixes: 8f8d28e4d6d8 ("net/packet: fix overflow in check for tp_frame_nr") Signed-off-by: Kal Conley Signed-off-by: David S. Miller net/packet/af_packet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1ec17dbd90f8b638f41ee650558609c1af63dfa0 Author: Konstantin Khlebnikov Date: Sat Feb 9 13:35:52 2019 +0300 inet_diag: fix reporting cgroup classid and fallback to priority Field idiag_ext in struct inet_diag_req_v2 used as bitmap of requested extensions has only 8 bits. Thus extensions starting from DCTCPINFO cannot be requested directly. Some of them included into response unconditionally or hook into some of lower 8 bits. Extension INET_DIAG_CLASS_ID has not way to request from the beginning. This patch bundle it with INET_DIAG_TCLASS (ipv6 tos), fixes space reservation, and documents behavior for other extensions. Also this patch adds fallback to reporting socket priority. This filed is more widely used for traffic classification because ipv4 sockets automatically maps TOS to priority and default qdisc pfifo_fast knows about that. But priority could be changed via setsockopt SO_PRIORITY so INET_DIAG_TOS isn't enough for predicting class. Also cgroup2 obsoletes net_cls classid (it always zero), but we cannot reuse this field for reporting cgroup2 id because it is 64-bit (ino+gen). So, after this patch INET_DIAG_CLASS_ID will report socket priority for most common setup when net_cls isn't set and/or cgroup2 in use. Fixes: 0888e372c37f ("net: inet: diag: expose sockets cgroup classid") Signed-off-by: Konstantin Khlebnikov Signed-off-by: David S. Miller include/uapi/linux/inet_diag.h | 16 +++++++++++----- net/ipv4/inet_diag.c | 10 +++++++++- net/sctp/diag.c | 1 + 3 files changed, 21 insertions(+), 6 deletions(-) commit 4ffcbfac60642f63ae3d80891f573ba7e94a265c Author: Eric Dumazet Date: Mon Feb 11 14:41:22 2019 -0800 batman-adv: fix uninit-value in batadv_interface_tx() KMSAN reported batadv_interface_tx() was possibly using a garbage value [1] batadv_get_vid() does have a pskb_may_pull() call but batadv_interface_tx() does not actually make sure this did not fail. [1] BUG: KMSAN: uninit-value in batadv_interface_tx+0x908/0x1e40 net/batman-adv/soft-interface.c:231 CPU: 0 PID: 10006 Comm: syz-executor469 Not tainted 4.20.0-rc7+ #5 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x173/0x1d0 lib/dump_stack.c:113 kmsan_report+0x12e/0x2a0 mm/kmsan/kmsan.c:613 __msan_warning+0x82/0xf0 mm/kmsan/kmsan_instr.c:313 batadv_interface_tx+0x908/0x1e40 net/batman-adv/soft-interface.c:231 __netdev_start_xmit include/linux/netdevice.h:4356 [inline] netdev_start_xmit include/linux/netdevice.h:4365 [inline] xmit_one net/core/dev.c:3257 [inline] dev_hard_start_xmit+0x607/0xc40 net/core/dev.c:3273 __dev_queue_xmit+0x2e42/0x3bc0 net/core/dev.c:3843 dev_queue_xmit+0x4b/0x60 net/core/dev.c:3876 packet_snd net/packet/af_packet.c:2928 [inline] packet_sendmsg+0x8306/0x8f30 net/packet/af_packet.c:2953 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg net/socket.c:631 [inline] __sys_sendto+0x8c4/0xac0 net/socket.c:1788 __do_sys_sendto net/socket.c:1800 [inline] __se_sys_sendto+0x107/0x130 net/socket.c:1796 __x64_sys_sendto+0x6e/0x90 net/socket.c:1796 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 RIP: 0033:0x441889 Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 bb 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffdda6fd468 EFLAGS: 00000216 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 0000000000441889 RDX: 000000000000000e RSI: 00000000200000c0 RDI: 0000000000000003 RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000216 R12: 00007ffdda6fd4c0 R13: 00007ffdda6fd4b0 R14: 0000000000000000 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:204 [inline] kmsan_internal_poison_shadow+0x92/0x150 mm/kmsan/kmsan.c:158 kmsan_kmalloc+0xa6/0x130 mm/kmsan/kmsan_hooks.c:176 kmsan_slab_alloc+0xe/0x10 mm/kmsan/kmsan_hooks.c:185 slab_post_alloc_hook mm/slab.h:446 [inline] slab_alloc_node mm/slub.c:2759 [inline] __kmalloc_node_track_caller+0xe18/0x1030 mm/slub.c:4383 __kmalloc_reserve net/core/skbuff.c:137 [inline] __alloc_skb+0x309/0xa20 net/core/skbuff.c:205 alloc_skb include/linux/skbuff.h:998 [inline] alloc_skb_with_frags+0x1c7/0xac0 net/core/skbuff.c:5220 sock_alloc_send_pskb+0xafd/0x10e0 net/core/sock.c:2083 packet_alloc_skb net/packet/af_packet.c:2781 [inline] packet_snd net/packet/af_packet.c:2872 [inline] packet_sendmsg+0x661a/0x8f30 net/packet/af_packet.c:2953 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg net/socket.c:631 [inline] __sys_sendto+0x8c4/0xac0 net/socket.c:1788 __do_sys_sendto net/socket.c:1800 [inline] __se_sys_sendto+0x107/0x130 net/socket.c:1796 __x64_sys_sendto+0x6e/0x90 net/socket.c:1796 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") Signed-off-by: Eric Dumazet Reported-by: syzbot Cc: Marek Lindner Cc: Simon Wunderlich Cc: Antonio Quartulli Signed-off-by: David S. Miller net/batman-adv/soft-interface.c | 2 ++ 1 file changed, 2 insertions(+) commit 1d110257c290a2c825d83ff6d12fef9732429dd2 Merge: 8ae757efd32b 00a399cad1a0 Author: Linus Torvalds Date: Tue Feb 12 10:18:08 2019 -0800 Merge tag 'sound-5.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "It's a bit of surprising that we've got more changes than hoped at this late stage, but they all don't look too scary but small fixes. One change in ALSA core side is again the PCM regression fix that was partially addressed for OSS, but now the all relevant change is reverted instead. Also, a few ASoC core fixes for UAF and OOB are included, while the rest are usual random device-specific fixes" * tag 'sound-5.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: pcm: Revert capture stream behavior change in blocking mode ALSA: usb-audio: Fix implicit fb endpoint setup by quirk ALSA: hda - Add quirk for HP EliteBook 840 G5 ASoC: samsung: Prevent clk_get_rate() calls in atomic context ASoC: rsnd: ssiu: correct shift bit for ssiu9 ASoC: rsnd: fixup rsnd_ssi_master_clk_start() user count check ASoC: dapm: fix out-of-bounds accesses to DAPM lookup tables ASoC: topology: fix oops/use-after-free case with dai driver ASoC: rsnd: fixup MIX kctrl registration ASoC: core: Allow soc_find_component lookups to match parent of_node ASoC: rt5682: Correct the setting while select ASRC clk for AD/DA filter ASoC: MAINTAINERS: fsl: Change Fabio's email address ASoC: hdmi-codec: fix oops on re-probe commit 8ae757efd32bd4962fa16366875416a55307f7c4 Merge: aa0c38cf39de 8fdd60f2ae36 Author: Linus Torvalds Date: Tue Feb 12 09:57:45 2019 -0800 Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 fix from Ted Ts'o: "Revert a commit which landed in v5.0-rc1 since it makes fsync in ext4 nojournal mode unsafe" * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: Revert "ext4: use ext4_write_inode() when fsyncing w/o a journal" commit d1f20798a119be71746949ba9b2e2ff330fdc038 Author: Li RongQing Date: Mon Feb 11 19:32:20 2019 +0800 ipv6: propagate genlmsg_reply return code genlmsg_reply can fail, so propagate its return code Fixes: 915d7e5e593 ("ipv6: sr: add code base for control plane support of SR-IPv6") Signed-off-by: Li RongQing Signed-off-by: David S. Miller net/ipv6/seg6.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 29dded89e80e3fff61efb34f07a8a3fba3ea146d Author: Saeed Mahameed Date: Mon Feb 11 18:04:17 2019 +0200 net/mlx4_en: Force CHECKSUM_NONE for short ethernet frames When an ethernet frame is padded to meet the minimum ethernet frame size, the padding octets are not covered by the hardware checksum. Fortunately the padding octets are usually zero's, which don't affect checksum. However, it is not guaranteed. For example, switches might choose to make other use of these octets. This repeatedly causes kernel hardware checksum fault. Prior to the cited commit below, skb checksum was forced to be CHECKSUM_NONE when padding is detected. After it, we need to keep skb->csum updated. However, fixing up CHECKSUM_COMPLETE requires to verify and parse IP headers, it does not worth the effort as the packets are so small that CHECKSUM_COMPLETE has no significant advantage. Future work: when reporting checksum complete is not an option for IP non-TCP/UDP packets, we can actually fallback to report checksum unnecessary, by looking at cqe IPOK bit. Fixes: 88078d98d1bb ("net: pskb_trim_rcsum() and CHECKSUM_COMPLETE are friends") Cc: Eric Dumazet Signed-off-by: Saeed Mahameed Signed-off-by: Tariq Toukan Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx4/en_rx.c | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) commit 87454b6edc1b0143fdb3d9853285477e95af74a4 Author: Russell King Date: Mon Feb 11 15:04:24 2019 +0000 net: phylink: avoid resolving link state too early During testing on Armada 388 platforms, it was found with a certain module configuration that it was possible to trigger a kernel oops during the module load process, caused by the phylink resolver being triggered for a currently disabled interface. This problem was introduced by changing the way the SFP registration works, which now can result in the sfp link down notification being called during phylink_create(). Fixes: b5bfc21af5cb ("net: sfp: do not probe SFP module before we're attached") Signed-off-by: Russell King Signed-off-by: David S. Miller drivers/net/phy/phylink.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) commit a7603ac1fc8ce1409f8ff70e6ce505f308b2c002 Author: Matteo Croce Date: Mon Feb 11 15:32:36 2019 +0100 geneve: change NET_UDP_TUNNEL dependency to select Due to the depends on NET_UDP_TUNNEL, at the moment it is impossible to compile GENEVE if no other protocol depending on NET_UDP_TUNNEL is selected. Fix this changing the depends to a select, and drop NET_IP_TUNNEL from the select list, as it already depends on NET_UDP_TUNNEL. Signed-off-by: Matteo Croce Reviewed-and-tested-by: Andrea Claudi Tested-by: Davide Caratti Signed-off-by: David S. Miller drivers/net/Kconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit c65285428b6e7797f1bb063f33b0ae7e93397b7b Author: Bert Kenward Date: Tue Feb 12 13:10:00 2019 +0000 sfc: initialise found bitmap in efx_ef10_mtd_probe The bitmap of found partitions in efx_ef10_mtd_probe was not initialised, causing partitions to be suppressed based off whatever value was in the bitmap at the start. Fixes: 3366463513f5 ("sfc: suppress duplicate nvmem partition types in efx_ef10_mtd_probe") Signed-off-by: Bert Kenward Signed-off-by: David S. Miller drivers/net/ethernet/sfc/ef10.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1ea06107b0d0465633bc225c00b3914fa404c30e Merge: 91986ee166cf 6157ca0d6bfe Author: David S. Miller Date: Tue Feb 12 11:43:19 2019 -0500 Merge tag 'mac80211-for-davem-2019-02-12' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== Just a few fixes: * aggregation session teardown with internal TXQs was continuing to send some frames marked as aggregation, fix from Ilan * IBSS join was missed during firmware restart, should such a thing happen * speculative execution based on the return value of cfg80211_classify8021d() - which is controlled by the sender of the packet - could be problematic in some code using it, prevent it * a few peer measurement fixes ==================== Signed-off-by: David S. Miller commit 323fb7b947b265753de34703dbbf8acc8ea3a4de Author: Sylwester Nawrocki Date: Thu Feb 7 18:00:12 2019 +0100 ASoC: samsung: i2s: Fix prescaler setting for the secondary DAI Make sure i2s->rclk_srcrate is properly initialized also during playback through the secondary DAI. Signed-off-by: Sylwester Nawrocki Acked-by: Krzysztof Kozlowski Signed-off-by: Mark Brown sound/soc/samsung/i2s.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 96d7cb932e826219ec41ac02e5af037ffae6098c Author: Yufen Yu Date: Tue Jan 29 16:34:04 2019 +0800 floppy: check_events callback should not return a negative number floppy_check_events() is supposed to return bit flags to say which events occured. We should return zero to say that no event flags are set. Only BIT(0) and BIT(1) are used in the caller. And .check_events interface also expect to return an unsigned int value. However, after commit a0c80efe5956, it may return -EINTR (-4u). Here, both BIT(0) and BIT(1) are cleared. So this patch shouldn't affect runtime, but it obviously is still worth fixing. Reviewed-by: Dan Carpenter Fixes: a0c80efe5956 ("floppy: fix lock_fdc() signal handling") Signed-off-by: Yufen Yu Signed-off-by: Jens Axboe drivers/block/floppy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1e405c1a3f667bf152905127b94e9c8f454a343e Author: Björn Töpel Date: Tue Feb 12 08:51:14 2019 +0100 xsk: do not remove umem from netdevice on fall-back to copy-mode Commit c9b47cc1fabc ("xsk: fix bug when trying to use both copy and zero-copy on one queue id") stores the umem into the netdev._rx struct. However, the patch incorrectly removed the umem from the netdev._rx struct when user-space passed "best-effort" mode (i.e. select the fastest possible option available), and zero-copy mode was not available. This commit fixes that. Fixes: c9b47cc1fabc ("xsk: fix bug when trying to use both copy and zero-copy on one queue id") Signed-off-by: Björn Töpel Signed-off-by: Daniel Borkmann net/xdp/xdp_umem.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit fc67e6f120a388b611d94cc40baf99a5cc56b283 Author: Robin Murphy Date: Wed Feb 6 18:43:24 2019 +0100 ARM: 8835/1: dma-mapping: Clear DMA ops on teardown Installing the appropriate non-IOMMU DMA ops in arm_iommu_detch_device() serves the case where IOMMU-aware drivers choose to control their own mapping but still make DMA API calls, however it also affects the case when the arch code itself tears down the mapping upon driver unbinding, where the ops now get left in place and can inhibit arch_setup_dma_ops() on subsequent re-probe attempts. Fix the latter case by making sure that arch_teardown_dma_ops() cleans up whenever the ops were automatically installed by its counterpart. Reported-by: Tobias Jakobi Reported-by: Marek Szyprowski Fixes: 1874619a7df4 "ARM: dma-mapping: Set proper DMA ops in arm_iommu_detach_device()" Tested-by: Tobias Jakobi Tested-by: Thierry Reding Signed-off-by: Robin Murphy Signed-off-by: Russell King arch/arm/mm/dma-mapping.c | 2 ++ 1 file changed, 2 insertions(+) commit 0ac569bf6a7983c0c5747d6df8db9dc05bc92b6c Author: Mathieu Desnoyers Date: Tue Feb 5 16:37:40 2019 +0100 ARM: 8834/1: Fix: kprobes: optimized kprobes illegal instruction commit e46daee53bb5 ("ARM: 8806/1: kprobes: Fix false positive with FORTIFY_SOURCE") introduced a regression in optimized kprobes. It triggers "invalid instruction" oopses when using kprobes instrumentation through lttng and perf. This commit was introduced in kernel v4.20, and has been backported to stable kernels 4.19 and 4.14. This crash was also reported by Hongzhi Song on the redhat bugzilla where the patch was originally introduced. Link: https://bugzilla.redhat.com/show_bug.cgi?id=1639397 Link: https://bugs.lttng.org/issues/1174 Link: https://lore.kernel.org/lkml/342740659.2887.1549307721609.JavaMail.zimbra@efficios.com Fixes: e46daee53bb5 ("ARM: 8806/1: kprobes: Fix false positive with FORTIFY_SOURCE") Signed-off-by: Mathieu Desnoyers Reported-by: Robert Berger Tested-by: Robert Berger Acked-by: Kees Cook Cc: Robert Berger Cc: Masami Hiramatsu Cc: William Cohen Cc: Laura Abbott Cc: Kees Cook Cc: # v4.14+ Cc: linux-arm-kernel@lists.infradead.org Cc: patches@armlinux.org.uk Signed-off-by: Russell King arch/arm/probes/kprobes/opt-arm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6b1971c694975e49af302229202c0043568b1791 Author: Vitaly Kuznetsov Date: Thu Feb 7 11:42:14 2019 +0100 x86/kvm/nVMX: read from MSR_IA32_VMX_PROCBASED_CTLS2 only when it is available SDM says MSR_IA32_VMX_PROCBASED_CTLS2 is only available "If (CPUID.01H:ECX.[5] && IA32_VMX_PROCBASED_CTLS[63])". It was found that some old cpus (namely "Intel(R) Core(TM)2 CPU 6600 @ 2.40GHz (family: 0x6, model: 0xf, stepping: 0x6") don't have it. Add the missing check. Reported-by: Zdenek Kaspar Tested-by: Zdenek Kaspar Signed-off-by: Vitaly Kuznetsov Reviewed-by: Jim Mattson Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini arch/x86/kvm/vmx/nested.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit 16eb0f34cdf4cf04cd92762c7a79f98aa51e053f Author: Jani Nikula Date: Fri Feb 8 20:42:53 2019 +0200 drm/i915/opregion: rvda is relative from opregion base in opregion 2.1+ Starting from opregion version 2.1 (roughly corresponding to ICL+) the RVDA field is relative from the beginning of opregion, not absolute address. Fix the error path while at it. v2: Make relative vs. absolute conditional on the opregion version, bumped for the purpose. Turned out there are machines relying on absolute RVDA in the wild. v3: Fix the version checks Fixes: 04ebaadb9f2d ("drm/i915/opregion: handle VBT sizes bigger than 6 KB") Cc: Ville Syrjälä Cc: Imre Deak Reviewed-by: Ville Syrjälä Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20190208184254.24123-2-jani.nikula@intel.com (cherry picked from commit a0f52c3d357af218a9c1f7cd906ab70426176a1a) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_opregion.c | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) commit fc89a38d99d4b1b33ca5b0e2329f5ddea02ecfb5 Author: Jani Nikula Date: Fri Feb 8 20:42:52 2019 +0200 drm/i915/opregion: fix version check The u32 version field encodes major, minor, revision and reserved. We've basically been checking for any non-zero version. Add opregion version logging while at it. v2: Fix the fix of the version check Fixes: 04ebaadb9f2d ("drm/i915/opregion: handle VBT sizes bigger than 6 KB") Cc: Ville Syrjälä Cc: Imre Deak Reviewed-by: Ville Syrjälä Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20190208184254.24123-1-jani.nikula@intel.com (cherry picked from commit 98fdaaca9537b997062f1abc0aa87c61b50ce40a) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_opregion.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) commit 2e7bd10e05afb866b5fb13eda25095c35d7a27cc Author: Joonas Lahtinen Date: Thu Feb 7 10:54:53 2019 +0200 drm/i915: Prevent a race during I915_GEM_MMAP ioctl with WC set Make sure the underlying VMA in the process address space is the same as it was during vm_mmap to avoid applying WC to wrong VMA. A more long-term solution would be to have vm_mmap_locked variant in linux/mmap.h for when caller wants to hold mmap_sem for an extended duration. v2: - Refactor the compare function Fixes: 1816f9236303 ("drm/i915: Support creation of unbound wc user mappings for objects") Reported-by: Adam Zabrocki Suggested-by: Linus Torvalds Signed-off-by: Joonas Lahtinen Cc: # v4.0+ Cc: Akash Goel Cc: Chris Wilson Cc: Tvrtko Ursulin Cc: Adam Zabrocki Reviewed-by: Chris Wilson Reviewed-by: Tvrtko Ursulin #v1 Link: https://patchwork.freedesktop.org/patch/msgid/20190207085454.10598-1-joonas.lahtinen@linux.intel.com (cherry picked from commit 5c4604e757ba9b193b09768d75a7d2105a5b883f) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_gem.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) commit e8a8fedd57fdcebf0e4f24ef0fc7e29323df8e66 Author: Lyude Paul Date: Tue Jan 29 14:09:59 2019 -0500 drm/i915: Block fbdev HPD processing during suspend When resuming, we check whether or not any previously connected MST topologies are still present and if so, attempt to resume them. If this fails, we disable said MST topologies and fire off a hotplug event so that userspace knows to reprobe. However, sending a hotplug event involves calling drm_fb_helper_hotplug_event(), which in turn results in fbcon doing a connector reprobe in the caller's thread - something we can't do at the point in which i915 calls drm_dp_mst_topology_mgr_resume() since hotplugging hasn't been fully initialized yet. This currently causes some rather subtle but fatal issues. For example, on my T480s the laptop dock connected to it usually disappears during a suspend cycle, and comes back up a short while after the system has been resumed. This guarantees pretty much every suspend and resume cycle, drm_dp_mst_topology_mgr_set_mst(mgr, false); will be caused and in turn, a connector hotplug will occur. Now it's Rute Goldberg time: when the connector hotplug occurs, i915 reprobes /all/ of the connectors, including eDP. However, eDP probing requires that we power on the panel VDD which in turn, grabs a wakeref to the appropriate power domain on the GPU (on my T480s, this is the PORT_DDI_A_IO domain). This is where things start breaking, since this all happens before intel_power_domains_enable() is called we end up leaking the wakeref that was acquired and never releasing it later. Come next suspend/resume cycle, this causes us to fail to shut down the GPU properly, which causes it not to resume properly and die a horrible complicated death. (as a note: this only happens when there's both an eDP panel and MST topology connected which is removed mid-suspend. One or the other seems to always be OK). We could try to fix the VDD wakeref leak, but this doesn't seem like it's worth it at all since we aren't able to handle hotplug detection while resuming anyway. So, let's go with a more robust solution inspired by nouveau: block fbdev from handling hotplug events until we resume fbdev. This allows us to still send sysfs hotplug events to be handled later by user space while we're resuming, while also preventing us from actually processing any hotplug events we receive until it's safe. This fixes the wakeref leak observed on the T480s and as such, also fixes suspend/resume with MST topologies connected on this machine. Changes since v2: * Don't call drm_fb_helper_hotplug_event() under lock, do it after lock (Chris Wilson) * Don't call drm_fb_helper_hotplug_event() in intel_fbdev_output_poll_changed() under lock (Chris Wilson) * Always set ifbdev->hpd_waiting (Chris Wilson) Signed-off-by: Lyude Paul Fixes: 0e32b39ceed6 ("drm/i915: add DP 1.2 MST support (v0.7)") Cc: Todd Previte Cc: Dave Airlie Cc: Jani Nikula Cc: Joonas Lahtinen Cc: Rodrigo Vivi Cc: Imre Deak Cc: intel-gfx@lists.freedesktop.org Cc: # v3.17+ Reviewed-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/msgid/20190129191001.442-2-lyude@redhat.com (cherry picked from commit fe5ec65668cdaa4348631d8ce1766eed43b33c10) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_drv.h | 10 ++++++++++ drivers/gpu/drm/i915/intel_fbdev.c | 33 ++++++++++++++++++++++++++++++++- 2 files changed, 42 insertions(+), 1 deletion(-) commit d8b879bb2ed25e641ab99a5144843786922e2a64 Author: Tvrtko Ursulin Date: Tue Feb 5 13:03:53 2019 +0000 drm/i915/pmu: Fix enable count array size and bounds checking Enable count array is supposed to have one counter for each possible engine sampler. As such, array sizing and bounds checking is not correct and would blow up the asserts if more samplers were added. No ill-effect in the current code base but lets fix it for correctness. At the same time tidy the assert for readability and robustness. v2: * One check per assert. (Chris Wilson) Signed-off-by: Tvrtko Ursulin Fixes: b46a33e271ed ("drm/i915/pmu: Expose a PMU interface for perf queries") Reviewed-by: Chris Wilson Link: https://patchwork.freedesktop.org/patch/msgid/20190205130353.21105-1-tvrtko.ursulin@linux.intel.com (cherry picked from commit 26a11deea685b41a43edb513194718aa1f461c9a) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_pmu.c | 22 +++++++++++++++------- drivers/gpu/drm/i915/i915_pmu.h | 2 ++ drivers/gpu/drm/i915/intel_ringbuffer.h | 9 +++++---- 3 files changed, 22 insertions(+), 11 deletions(-) commit 098e13f5b21d3398065fce8780f07a3ef62f4812 Author: Andrea Claudi Date: Mon Feb 11 16:14:39 2019 +0100 ipvs: fix dependency on nf_defrag_ipv6 ipvs relies on nf_defrag_ipv6 module to manage IPv6 fragmentation, but lacks proper Kconfig dependencies and does not explicitly request defrag features. As a result, if netfilter hooks are not loaded, when IPv6 fragmented packet are handled by ipvs only the first fragment makes through. Fix it properly declaring the dependency on Kconfig and registering netfilter hooks on ip_vs_add_service() and ip_vs_new_dest(). Reported-by: Li Shuang Signed-off-by: Andrea Claudi Acked-by: Julian Anastasov Acked-by: Simon Horman Signed-off-by: Pablo Neira Ayuso net/netfilter/ipvs/Kconfig | 1 + net/netfilter/ipvs/ip_vs_core.c | 10 ++++------ net/netfilter/ipvs/ip_vs_ctl.c | 10 ++++++++++ 3 files changed, 15 insertions(+), 6 deletions(-) commit fc2d5cfdcfe2ab76b263d91429caa22451123085 Author: Sean Tranchetti Date: Thu Feb 7 13:33:21 2019 -0700 af_key: unconditionally clone on broadcast Attempting to avoid cloning the skb when broadcasting by inflating the refcount with sock_hold/sock_put while under RCU lock is dangerous and violates RCU principles. It leads to subtle race conditions when attempting to free the SKB, as we may reference sockets that have already been freed by the stack. Unable to handle kernel paging request at virtual address 6b6b6b6b6b6c4b [006b6b6b6b6b6c4b] address between user and kernel address ranges Internal error: Oops: 96000004 [#1] PREEMPT SMP task: fffffff78f65b380 task.stack: ffffff8049a88000 pc : sock_rfree+0x38/0x6c lr : skb_release_head_state+0x6c/0xcc Process repro (pid: 7117, stack limit = 0xffffff8049a88000) Call trace: sock_rfree+0x38/0x6c skb_release_head_state+0x6c/0xcc skb_release_all+0x1c/0x38 __kfree_skb+0x1c/0x30 kfree_skb+0xd0/0xf4 pfkey_broadcast+0x14c/0x18c pfkey_sendmsg+0x1d8/0x408 sock_sendmsg+0x44/0x60 ___sys_sendmsg+0x1d0/0x2a8 __sys_sendmsg+0x64/0xb4 SyS_sendmsg+0x34/0x4c el0_svc_naked+0x34/0x38 Kernel panic - not syncing: Fatal exception Suggested-by: Eric Dumazet Signed-off-by: Sean Tranchetti Signed-off-by: Steffen Klassert net/key/af_key.c | 40 +++++++++++++++------------------------- 1 file changed, 15 insertions(+), 25 deletions(-) commit 4726bcf30fad37cc555cd9dcd6c73f2b2668c879 Author: Keith Busch Date: Mon Feb 11 09:23:50 2019 -0700 nvme-pci: add missing unlock for reset error The reset work holds a mutex to prevent races with removal modifying the same resources, but was unlocking only on success. Unlock on failure too. Fixes: 5c959d73dba64 ("nvme-pci: fix rapid add remove sequence") Signed-off-by: Keith Busch Signed-off-by: Christoph Hellwig drivers/nvme/host/pci.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit 91986ee166cf0816ae92668476ea7872d51b0c6e Author: Tuong Lien Date: Mon Feb 11 13:29:43 2019 +0700 tipc: fix link session and re-establish issues When a link endpoint is re-created (e.g. after a node reboot or interface reset), the link session number is varied by random, the peer endpoint will be synced with this new session number before the link is re-established. However, there is a shortcoming in this mechanism that can lead to the link never re-established or faced with a failure then. It happens when the peer endpoint is ready in ESTABLISHING state, the 'peer_session' as well as the 'in_session' flag have been set, but suddenly this link endpoint leaves. When it comes back with a random session number, there are two situations possible: 1/ If the random session number is larger than (or equal to) the previous one, the peer endpoint will be updated with this new session upon receipt of a RESET_MSG from this endpoint, and the link can be re- established as normal. Otherwise, all the RESET_MSGs from this endpoint will be rejected by the peer. In turn, when this link endpoint receives one ACTIVATE_MSG from the peer, it will move to ESTABLISHED and start to send STATE_MSGs, but again these messages will be dropped by the peer due to wrong session. The peer link endpoint can still become ESTABLISHED after receiving a traffic message from this endpoint (e.g. a BCAST_PROTOCOL or NAME_DISTRIBUTOR), but since all the STATE_MSGs are invalid, the link will be forced down sooner or later! Even in case the random session number is larger than the previous one, it can be that the ACTIVATE_MSG from the peer arrives first, and this link endpoint moves quickly to ESTABLISHED without sending out any RESET_MSG yet. Consequently, the peer link will not be updated with the new session number, and the same link failure scenario as above will happen. 2/ Another situation can be that, the peer link endpoint was reset due to any reasons in the meantime, its link state was set to RESET from ESTABLISHING but still in session, i.e. the 'in_session' flag is not reset... Now, if the random session number from this endpoint is less than the previous one, all the RESET_MSGs from this endpoint will be rejected by the peer. In the other direction, when this link endpoint receives a RESET_MSG from the peer, it moves to ESTABLISHING and starts to send ACTIVATE_MSGs, but all these messages will be rejected by the peer too. As a result, the link cannot be re-established but gets stuck with this link endpoint in state ESTABLISHING and the peer in RESET! Solution: =========== This link endpoint should not go directly to ESTABLISHED when getting ACTIVATE_MSG from the peer which may belong to the old session if the link was re-created. To ensure the session to be correct before the link is re-established, the peer endpoint in ESTABLISHING state will send back the last session number in ACTIVATE_MSG for a verification at this endpoint. Then, if needed, a new and more appropriate session number will be regenerated to force a re-synch first. In addition, when a link in ESTABLISHING state is reset, its state will move to RESET according to the link FSM, along with resetting the 'in_session' flag (and the other data) as a normal link reset, it will also be deleted if requested. The solution is backward compatible. Acked-by: Jon Maloy Acked-by: Ying Xue Signed-off-by: Tuong Lien Signed-off-by: David S. Miller net/tipc/link.c | 15 +++++++++++++++ net/tipc/msg.h | 22 ++++++++++++++++++++++ net/tipc/node.c | 11 ++++++----- 3 files changed, 43 insertions(+), 5 deletions(-) commit e75913c93f7cd5f338ab373c34c93a655bd309cb Author: Zhiqiang Liu Date: Mon Feb 11 10:57:46 2019 +0800 net: fix IPv6 prefix route residue Follow those steps: # ip addr add 2001:123::1/32 dev eth0 # ip addr add 2001:123:456::2/64 dev eth0 # ip addr del 2001:123::1/32 dev eth0 # ip addr del 2001:123:456::2/64 dev eth0 and then prefix route of 2001:123::1/32 will still exist. This is because ipv6_prefix_equal in check_cleanup_prefix_route func does not check whether two IPv6 addresses have the same prefix length. If the prefix of one address starts with another shorter address prefix, even though their prefix lengths are different, the return value of ipv6_prefix_equal is true. Here I add a check of whether two addresses have the same prefix to decide whether their prefixes are equal. Fixes: 5b84efecb7d9 ("ipv6 addrconf: don't cleanup prefix route for IFA_F_NOPREFIXROUTE") Signed-off-by: Zhiqiang Liu Reported-by: Wenhao Zhang Signed-off-by: David S. Miller net/ipv6/addrconf.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit aef1897cd36dcf5e296f1d2bae7e0d268561b685 Author: Jianchao Wang Date: Tue Feb 12 09:56:25 2019 +0800 blk-mq: insert rq with DONTPREP to hctx dispatch list when requeue When requeue, if RQF_DONTPREP, rq has contained some driver specific data, so insert it to hctx dispatch list to avoid any merge. Take scsi as example, here is the trace event log (no io scheduler, because RQF_STARTED would prevent merging), kworker/0:1H-339 [000] ...1 2037.209289: block_rq_insert: 8,0 R 4096 () 32768 + 8 [kworker/0:1H] scsi_inert_test-1987 [000] .... 2037.220465: block_bio_queue: 8,0 R 32776 + 8 [scsi_inert_test] scsi_inert_test-1987 [000] ...2 2037.220466: block_bio_backmerge: 8,0 R 32776 + 8 [scsi_inert_test] kworker/0:1H-339 [000] .... 2047.220913: block_rq_issue: 8,0 R 8192 () 32768 + 16 [kworker/0:1H] scsi_inert_test-1996 [000] ..s1 2047.221007: block_rq_complete: 8,0 R () 32768 + 8 [0] scsi_inert_test-1996 [000] .Ns1 2047.221045: block_rq_requeue: 8,0 R () 32776 + 8 [0] kworker/0:1H-339 [000] ...1 2047.221054: block_rq_insert: 8,0 R 4096 () 32776 + 8 [kworker/0:1H] kworker/0:1H-339 [000] ...1 2047.221056: block_rq_issue: 8,0 R 4096 () 32776 + 8 [kworker/0:1H] scsi_inert_test-1986 [000] ..s1 2047.221119: block_rq_complete: 8,0 R () 32776 + 8 [0] (32768 + 8) was requeued by scsi_queue_insert and had RQF_DONTPREP. Then it was merged with (32776 + 8) and issued. Due to RQF_DONTPREP, the sdb only contained the part of (32768 + 8), then only that part was completed. The lucky thing was that scsi_io_completion detected it and requeued the remaining part. So we didn't get corrupted data. However, the requeue of (32776 + 8) is not expected. Suggested-by: Jens Axboe Signed-off-by: Jianchao Wang Signed-off-by: Jens Axboe block/blk-mq.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) commit 7384b538d3aed2ed49d3575483d17aeee790fb06 Author: Hoang Le Date: Mon Feb 11 09:18:28 2019 +0700 tipc: fix skb may be leaky in tipc_link_input When we free skb at tipc_data_input, we return a 'false' boolean. Then, skb passed to subcalling tipc_link_input in tipc_link_rcv, 1303 int tipc_link_rcv: ... 1354 if (!tipc_data_input(l, skb, l->inputq)) 1355 rc |= tipc_link_input(l, skb, l->inputq); Fix it by simple changing to a 'true' boolean when skb is being free-ed. Then, tipc_link_rcv will bypassed to subcalling tipc_link_input as above condition. Acked-by: Ying Xue Acked-by: Jon Maloy Signed-off-by: Hoang Le Signed-off-by: David S. Miller net/tipc/link.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8d29d16d21342a0c86405d46de0c4ac5daf1760f Author: Francesco Ruggeri Date: Sun Feb 10 11:58:29 2019 -0800 netfilter: compat: initialize all fields in xt_init If a non zero value happens to be in xt[NFPROTO_BRIDGE].cur at init time, the following panic can be caused by running % ebtables -t broute -F BROUTING from a 32-bit user level on a 64-bit kernel. This patch replaces kmalloc_array with kcalloc when allocating xt. [ 474.680846] BUG: unable to handle kernel paging request at 0000000009600920 [ 474.687869] PGD 2037006067 P4D 2037006067 PUD 2038938067 PMD 0 [ 474.693838] Oops: 0000 [#1] SMP [ 474.697055] CPU: 9 PID: 4662 Comm: ebtables Kdump: loaded Not tainted 4.19.17-11302235.AroraKernelnext.fc18.x86_64 #1 [ 474.707721] Hardware name: Supermicro X9DRT/X9DRT, BIOS 3.0 06/28/2013 [ 474.714313] RIP: 0010:xt_compat_calc_jump+0x2f/0x63 [x_tables] [ 474.720201] Code: 40 0f b6 ff 55 31 c0 48 6b ff 70 48 03 3d dc 45 00 00 48 89 e5 8b 4f 6c 4c 8b 47 60 ff c9 39 c8 7f 2f 8d 14 08 d1 fa 48 63 fa <41> 39 34 f8 4c 8d 0c fd 00 00 00 00 73 05 8d 42 01 eb e1 76 05 8d [ 474.739023] RSP: 0018:ffffc9000943fc58 EFLAGS: 00010207 [ 474.744296] RAX: 0000000000000000 RBX: ffffc90006465000 RCX: 0000000002580249 [ 474.751485] RDX: 00000000012c0124 RSI: fffffffff7be17e9 RDI: 00000000012c0124 [ 474.758670] RBP: ffffc9000943fc58 R08: 0000000000000000 R09: ffffffff8117cf8f [ 474.765855] R10: ffffc90006477000 R11: 0000000000000000 R12: 0000000000000001 [ 474.773048] R13: 0000000000000000 R14: ffffc9000943fcb8 R15: ffffc9000943fcb8 [ 474.780234] FS: 0000000000000000(0000) GS:ffff88a03f840000(0063) knlGS:00000000f7ac7700 [ 474.788612] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 474.794632] CR2: 0000000009600920 CR3: 0000002037422006 CR4: 00000000000606e0 [ 474.802052] Call Trace: [ 474.804789] compat_do_replace+0x1fb/0x2a3 [ebtables] [ 474.810105] compat_do_ebt_set_ctl+0x69/0xe6 [ebtables] [ 474.815605] ? try_module_get+0x37/0x42 [ 474.819716] compat_nf_setsockopt+0x4f/0x6d [ 474.824172] compat_ip_setsockopt+0x7e/0x8c [ 474.828641] compat_raw_setsockopt+0x16/0x3a [ 474.833220] compat_sock_common_setsockopt+0x1d/0x24 [ 474.838458] __compat_sys_setsockopt+0x17e/0x1b1 [ 474.843343] ? __check_object_size+0x76/0x19a [ 474.847960] __ia32_compat_sys_socketcall+0x1cb/0x25b [ 474.853276] do_fast_syscall_32+0xaf/0xf6 [ 474.857548] entry_SYSENTER_compat+0x6b/0x7a Signed-off-by: Francesco Ruggeri Acked-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/netfilter/x_tables.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 41fb9d54f12b87fb1f670653e95d34668a08e8ee Author: Palmer Dabbelt Date: Fri Feb 8 09:11:08 2019 -0800 Revert "RISC-V: Make BSS section as the last section in vmlinux.lds.S" At least BBL relies on the flat binaries containing all the bytes in the actual image to exist in the file. Before this revert the flat images dropped the trailing zeros, which caused BBL to put its copy of the device tree where Linux thought the BSS was, which wreaks all sorts of havoc. Manifesting the bug is a bit subtle because BBL aligns everything to 2MiB page boundaries, but with large enough kernels you're almost certain to get bitten by the bug. While moving the sections around isn't a great long-term fix, it will at least avoid producing broken images. This reverts commit 22e6a2e14cb8ebcae059488cf24e778e4058c2bf. Signed-off-by: Palmer Dabbelt Reviewed-by: Christoph Hellwig arch/riscv/kernel/vmlinux.lds.S | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) commit e3613bb8afc2a9474c9214d65c8326c5ac02135e Author: Stefan O'Rear Date: Sun Dec 16 13:03:36 2018 -0500 riscv: Add pte bit to distinguish swap from invalid Previously, invalid PTEs and swap PTEs had the same binary representation, causing errors when attempting to unmap PROT_NONE mappings, including implicit unmap on exit. Typical error: swap_info_get: Bad swap file entry 40000000007a9879 BUG: Bad page map in process a.out pte:3d4c3cc0 pmd:3e521401 Cc: stable@vger.kernel.org Signed-off-by: Stefan O'Rear Reviewed-by: Christoph Hellwig Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/pgtable-bits.h | 6 ++++++ arch/riscv/include/asm/pgtable.h | 8 ++++---- 2 files changed, 10 insertions(+), 4 deletions(-) commit f420c54e4b12c1361c6ed313002ee7bd7ac58362 Author: Dmitry Torokhov Date: Mon Feb 11 14:32:40 2019 -0800 Revert "Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G" This reverts commit 7db54c89f0b30a101584e09d3729144e6170059d as it breaks Acer Aspire V-371 and other devices. According to Elan: "Acer Aspire F5-573G is MS Precision touchpad which should use hid multitouch driver. ELAN0501 should not be added in elan_i2c." Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=202503 Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov drivers/input/mouse/elan_i2c_core.c | 1 - 1 file changed, 1 deletion(-) commit 83cd203084f68707839c00df120eed367d49e311 Author: Dmitry Torokhov Date: Wed Feb 6 10:29:17 2019 -0800 Input: qt2160 - switch to using brightness_set_blocking() Now that LEDs core allows "blocking" flavor of "set brightness" method we can use it and get rid of private work items. Reviewed-by: Sven Van Asbroeck Signed-off-by: Dmitry Torokhov drivers/input/keyboard/qt2160.c | 69 ++++++++++++++++------------------------- 1 file changed, 27 insertions(+), 42 deletions(-) commit aa0c38cf39de73bf7360a3da8f1707601261e518 Merge: fb7453e61a2b bf78f133cd39 Author: Linus Torvalds Date: Mon Feb 11 13:30:50 2019 -0800 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal Pull thermal SoC management fixes from Eduardo Valentin: "Minor fixes on of-thermal and cpu cooling" * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal: thermal: cpu_cooling: Clarify error message thermal: of-thermal: Print name of device node with error commit cf657d22ee1f0e887326a92169f2e28dc932fd10 Author: Eric Dumazet Date: Fri Feb 8 12:41:05 2019 -0800 net/x25: do not hold the cpu too long in x25_new_lci() Due to quadratic behavior of x25_new_lci(), syzbot was able to trigger an rcu stall. Fix this by not blocking BH for the whole duration of the function, and inserting a reschedule point when possible. If we care enough, using a bitmap could get rid of the quadratic behavior. syzbot report : rcu: INFO: rcu_preempt self-detected stall on CPU rcu: 0-...!: (10500 ticks this GP) idle=4fa/1/0x4000000000000002 softirq=283376/283376 fqs=0 rcu: (t=10501 jiffies g=383105 q=136) rcu: rcu_preempt kthread starved for 10502 jiffies! g383105 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=0 rcu: RCU grace-period kthread stack dump: rcu_preempt I28928 10 2 0x80000000 Call Trace: context_switch kernel/sched/core.c:2844 [inline] __schedule+0x817/0x1cc0 kernel/sched/core.c:3485 schedule+0x92/0x180 kernel/sched/core.c:3529 schedule_timeout+0x4db/0xfd0 kernel/time/timer.c:1803 rcu_gp_fqs_loop kernel/rcu/tree.c:1948 [inline] rcu_gp_kthread+0x956/0x17a0 kernel/rcu/tree.c:2105 kthread+0x357/0x430 kernel/kthread.c:246 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 NMI backtrace for cpu 0 CPU: 0 PID: 8759 Comm: syz-executor2 Not tainted 5.0.0-rc4+ #51 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x172/0x1f0 lib/dump_stack.c:113 nmi_cpu_backtrace.cold+0x63/0xa4 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0x1be/0x236 lib/nmi_backtrace.c:62 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38 trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline] rcu_dump_cpu_stacks+0x183/0x1cf kernel/rcu/tree.c:1211 print_cpu_stall kernel/rcu/tree.c:1348 [inline] check_cpu_stall kernel/rcu/tree.c:1422 [inline] rcu_pending kernel/rcu/tree.c:3018 [inline] rcu_check_callbacks.cold+0x500/0xa4a kernel/rcu/tree.c:2521 update_process_times+0x32/0x80 kernel/time/timer.c:1635 tick_sched_handle+0xa2/0x190 kernel/time/tick-sched.c:161 tick_sched_timer+0x47/0x130 kernel/time/tick-sched.c:1271 __run_hrtimer kernel/time/hrtimer.c:1389 [inline] __hrtimer_run_queues+0x33e/0xde0 kernel/time/hrtimer.c:1451 hrtimer_interrupt+0x314/0x770 kernel/time/hrtimer.c:1509 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1035 [inline] smp_apic_timer_interrupt+0x120/0x570 arch/x86/kernel/apic/apic.c:1060 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807 RIP: 0010:__read_once_size include/linux/compiler.h:193 [inline] RIP: 0010:queued_write_lock_slowpath+0x13e/0x290 kernel/locking/qrwlock.c:86 Code: 00 00 fc ff df 4c 8d 2c 01 41 83 c7 03 41 0f b6 45 00 41 38 c7 7c 08 84 c0 0f 85 0c 01 00 00 8b 03 3d 00 01 00 00 74 1a f3 90 <41> 0f b6 55 00 41 38 d7 7c eb 84 d2 74 e7 48 89 df e8 6c 0f 4f 00 RSP: 0018:ffff88805f117bd8 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000300 RBX: ffffffff89413ba0 RCX: 1ffffffff1282774 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff89413ba0 RBP: ffff88805f117c70 R08: 1ffffffff1282774 R09: fffffbfff1282775 R10: fffffbfff1282774 R11: ffffffff89413ba3 R12: 00000000000000ff R13: fffffbfff1282774 R14: 1ffff1100be22f7d R15: 0000000000000003 queued_write_lock include/asm-generic/qrwlock.h:104 [inline] do_raw_write_lock+0x1d6/0x290 kernel/locking/spinlock_debug.c:203 __raw_write_lock_bh include/linux/rwlock_api_smp.h:204 [inline] _raw_write_lock_bh+0x3b/0x50 kernel/locking/spinlock.c:312 x25_insert_socket+0x21/0xe0 net/x25/af_x25.c:267 x25_bind+0x273/0x340 net/x25/af_x25.c:705 __sys_bind+0x23f/0x290 net/socket.c:1505 __do_sys_bind net/socket.c:1516 [inline] __se_sys_bind net/socket.c:1514 [inline] __x64_sys_bind+0x73/0xb0 net/socket.c:1514 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457e39 Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fafccd0dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457e39 RDX: 0000000000000012 RSI: 0000000020000240 RDI: 0000000000000004 RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fafccd0e6d4 R13: 00000000004bdf8b R14: 00000000004ce4b8 R15: 00000000ffffffff Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 8752 Comm: syz-executor4 Not tainted 5.0.0-rc4+ #51 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__x25_find_socket+0x78/0x120 net/x25/af_x25.c:328 Code: 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 a6 00 00 00 4d 8b 64 24 68 4d 85 e4 74 7f e8 03 97 3d fb 49 83 ec 68 74 74 e8 f8 96 3d fb <49> 8d bc 24 88 04 00 00 48 89 f8 48 c1 e8 03 0f b6 04 18 84 c0 74 RSP: 0018:ffff8880639efc58 EFLAGS: 00000246 RAX: 0000000000040000 RBX: dffffc0000000000 RCX: ffffc9000e677000 RDX: 0000000000040000 RSI: ffffffff863244b8 RDI: ffff88806a764628 RBP: ffff8880639efc80 R08: ffff8880a80d05c0 R09: fffffbfff1282775 R10: fffffbfff1282774 R11: ffffffff89413ba3 R12: ffff88806a7645c0 R13: 0000000000000001 R14: ffff88809f29ac00 R15: 0000000000000000 FS: 00007fe8d0c58700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b32823000 CR3: 00000000672eb000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: x25_new_lci net/x25/af_x25.c:357 [inline] x25_connect+0x374/0xdf0 net/x25/af_x25.c:786 __sys_connect+0x266/0x330 net/socket.c:1686 __do_sys_connect net/socket.c:1697 [inline] __se_sys_connect net/socket.c:1694 [inline] __x64_sys_connect+0x73/0xb0 net/socket.c:1694 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457e39 Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fe8d0c57c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457e39 RDX: 0000000000000012 RSI: 0000000020000200 RDI: 0000000000000004 RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe8d0c586d4 R13: 00000000004be378 R14: 00000000004ceb00 R15: 00000000ffffffff Signed-off-by: Eric Dumazet Reported-by: syzbot Cc: Andrew Hendry Cc: linux-x25@vger.kernel.org Signed-off-by: David S. Miller net/x25/af_x25.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit f6675872db57305fa957021efc788f9983ed3b67 Author: Andreas Ziegler Date: Wed Feb 6 20:00:13 2019 +0100 tracing: probeevent: Correctly update remaining space in dynamic area Commit 9178412ddf5a ("tracing: probeevent: Return consumed bytes of dynamic area") improved the string fetching mechanism by returning the number of required bytes after copying the argument to the dynamic area. However, this return value is now only used to increment the pointer inside the dynamic area but misses updating the 'maxlen' variable which indicates the remaining space in the dynamic area. This means that fetch_store_string() always reads the *total* size of the dynamic area from the data_loc pointer instead of the *remaining* size (and passes it along to strncpy_from_{user,unsafe}) even if we're already about to copy data into the middle of the dynamic area. Link: http://lkml.kernel.org/r/20190206190013.16405-1-andreas.ziegler@fau.de Cc: Ingo Molnar Cc: stable@vger.kernel.org Fixes: 9178412ddf5a ("tracing: probeevent: Return consumed bytes of dynamic area") Acked-by: Masami Hiramatsu Signed-off-by: Andreas Ziegler Signed-off-by: Steven Rostedt (VMware) kernel/trace/trace_probe_tmpl.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 4179cb5a4c924cd233eaadd081882425bc98f44e Author: Eric Dumazet Date: Thu Feb 7 12:27:38 2019 -0800 vxlan: test dev->flags & IFF_UP before calling netif_rx() netif_rx() must be called under a strict contract. At device dismantle phase, core networking clears IFF_UP and flush_all_backlogs() is called after rcu grace period to make sure no incoming packet might be in a cpu backlog and still referencing the device. Most drivers call netif_rx() from their interrupt handler, and since the interrupts are disabled at device dismantle, netif_rx() does not have to check dev->flags & IFF_UP Virtual drivers do not have this guarantee, and must therefore make the check themselves. Otherwise we risk use-after-free and/or crashes. Note this patch also fixes a small issue that came with commit ce6502a8f957 ("vxlan: fix a use after free in vxlan_encap_bypass"), since the dev->stats.rx_dropped change was done on the wrong device. Fixes: d342894c5d2f ("vxlan: virtual extensible lan") Fixes: ce6502a8f957 ("vxlan: fix a use after free in vxlan_encap_bypass") Signed-off-by: Eric Dumazet Cc: Petr Machata Cc: Ido Schimmel Cc: Roopa Prabhu Cc: Stefano Brivio Signed-off-by: David S. Miller drivers/net/vxlan.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) commit 989723b00b7fecad9acad55b151c73ccf2eac3ca Author: Jouke Witteveen Date: Thu Feb 7 17:14:32 2019 +0100 Documentation: bring operstate documentation up-to-date Netlink has moved from bitmasks to group numbers long ago. Signed-off-by: Jouke Witteveen Signed-off-by: David S. Miller Documentation/networking/operstates.txt | 14 ++++++++------ net/sched/sch_generic.c | 2 +- 2 files changed, 9 insertions(+), 7 deletions(-) commit e451eb51068496054d071af10b3530af4002a4f4 Author: Davidlohr Bueso Date: Mon Feb 11 08:15:29 2019 -0800 xsk: share the mmap_sem for page pinning Holding mmap_sem exclusively for a gup() is an overkill. Lets share the lock and replace the gup call for gup_longterm(), as it is better suited for the lifetime of the pinning. Fixes: c0c77d8fb787 ("xsk: add user memory registration support sockopt") Signed-off-by: Davidlohr Bueso Cc: David S. Miller Cc: Bjorn Topel Cc: Magnus Karlsson CC: netdev@vger.kernel.org Acked-by: Björn Töpel Signed-off-by: Daniel Borkmann net/xdp/xdp_umem.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 4d73eaee24ff0cc2736c304927c1425d2541d6ab Merge: 31b58ad0c327 8303b7e8f018 Author: David S. Miller Date: Mon Feb 11 10:42:50 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Out-of-bound access to packet data from the snmp nat helper, from Jann Horn. 2) ICMP(v6) error packets are set as related traffic by conntrack, update protocol number before calling nf_nat_ipv4_manip_pkt() to use ICMP(v6) rather than the original protocol number, from Florian Westphal. ==================== Signed-off-by: David S. Miller commit fb7453e61a2b6c29ab08f87b71e2647efe816526 Merge: 244cce14c177 614db26954ff Author: Linus Torvalds Date: Mon Feb 11 10:28:48 2019 -0800 Merge tag 's390-5.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 bug fixes from Martin Schwidefsky: - Fix specification exception on z196 during ap probe - A fix for suspend-to-disk, the VMAP stack patch broke the swsusp_arch_suspend function - The EMC CKD ioctl of the dasd driver needs an additional size check for user space data - Revert an incorrect patch for the PCI base code that removed a bit lock that turned out to be required after all * tag 's390-5.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: Revert "s390/pci: remove bit_lock usage in interrupt handler" s390/zcrypt: fix specification exception on z196 during ap probe s390/dasd: fix using offset into zero size array error s390/suspend: fix stack setup in swsusp_arch_suspend commit 244cce14c17705e6376cd12c20c27f8712793acc Merge: 1413d9af241c 491af60ffb84 Author: Linus Torvalds Date: Mon Feb 11 10:19:33 2019 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha Pull alpha fixes from Matt Turner: "A few changes for alpha, including a build fix, a fix for the Eiger platform, and a fix for a tricky bug uncovered by the strace test suite that has existed since at least 1997 (v2.1.32)!" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha: alpha: fix page fault handling for r16-r18 targets alpha: Fix Eiger NR_IRQS to 128 tools uapi: fix Alpha support commit 1413d9af241c3c3b36319213b725a9e95be3935f Author: Waiman Long Date: Thu Feb 7 15:15:42 2019 -0500 Documentation: Fix grammatical error in sysctl/fs.txt & clarify negative dentry Fix a grammatical error in the dentry-state text and clarify the usage of negative dentries. Fixes: af0c9af1b3f66 ("fs/dcache: Track & report number of negative dentries") Signed-off-by: Waiman Long Signed-off-by: Linus Torvalds Documentation/sysctl/fs.txt | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit ff0c129d3b5ecb3df7c8f5e2236582bf745b6c5f Author: Mikulas Patocka Date: Fri Feb 8 10:52:07 2019 -0500 dm crypt: don't overallocate the integrity tag space bio_sectors() returns the value in the units of 512-byte sectors (no matter what the real sector size of the device). dm-crypt multiplies bio_sectors() by on_disk_tag_size to calculate the space allocated for integrity tags. If dm-crypt is running with sector size larger than 512b, it allocates more data than is needed. Device Mapper trims the extra space when passing the bio to dm-integrity, so this bug didn't result in any visible misbehavior. But it must be fixed to avoid wasteful memory allocation for the block integrity payload. Fixes: ef43aa38063a6 ("dm crypt: add cryptographic data integrity protection (authenticated encryption)") Cc: stable@vger.kernel.org # 4.12+ Reported-by: Milan Broz Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer drivers/md/dm-crypt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8303b7e8f018724a2cd7752eb29c2801fa8c4067 Author: Florian Westphal Date: Fri Feb 8 16:39:52 2019 +0100 netfilter: nat: fix spurious connection timeouts Sander Eikelenboom bisected a NAT related regression down to the l4proto->manip_pkt indirection removal. I forgot that ICMP(v6) errors (e.g. PKTTOOBIG) can be set as related to the existing conntrack entry. Therefore, when passing the skb to nf_nat_ipv4/6_manip_pkt(), that ended up calling the wrong l4 manip function, as tuple->dst.protonum is the original flows l4 protocol (TCP, UDP, etc). Set the dst protocol field to ICMP(v6), we already have a private copy of the tuple due to the inversion of src/dst. Reported-by: Sander Eikelenboom Tested-by: Sander Eikelenboom Fixes: faec18dbb0405 ("netfilter: nat: remove l4proto->manip_pkt") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/ipv4/netfilter/nf_nat_l3proto_ipv4.c | 1 + net/ipv6/netfilter/nf_nat_l3proto_ipv6.c | 1 + 2 files changed, 2 insertions(+) commit c4c07b4d6fa1f11880eab8e076d3d060ef3f55fc Author: Jann Horn Date: Wed Feb 6 22:56:15 2019 +0100 netfilter: nf_nat_snmp_basic: add missing length checks in ASN.1 cbs The generic ASN.1 decoder infrastructure doesn't guarantee that callbacks will get as much data as they expect; callbacks have to check the `datalen` parameter before looking at `data`. Make sure that snmp_version() and snmp_helper() don't read/write beyond the end of the packet data. (Also move the assignment to `pdata` down below the check to make it clear that it isn't necessarily a pointer we can use before the `datalen` check.) Fixes: cc2d58634e0f ("netfilter: nf_nat_snmp_basic: use asn1 decoder library") Signed-off-by: Jann Horn Signed-off-by: Pablo Neira Ayuso net/ipv4/netfilter/nf_nat_snmp_basic_main.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 3b91a93597327f682a1c4392350ced99a44840b7 Author: Aditya Swarup Date: Thu Jan 10 15:08:44 2019 -0800 drm/i915/cnl: Fix CNL macros for Voltage Swing programming CNL macros for register groups CNL_PORT_TX_DW2_* / CNL_PORT_TX_DW5_* are configured incorrectly wrt definition of _CNL_PORT_TX_DW_GRP. v2: Jani suggested to keep the macros organized semantically i.e., by function, secondarily by port/pipe/transcoder.->(dw, port) Fixes: 4e53840fdfdd ("drm/i915/icl: Introduce new macros to get combophy registers") Cc: Clint Taylor Cc: Imre Deak Cc: Jani Nikula Signed-off-by: Aditya Swarup Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20190110230844.9213-1-aditya.swarup@intel.com (cherry picked from commit b14c06ec024947eaa35212f2380e90233d5092e0) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_reg.h | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit 9659c1af451a92533d2d8dfcecd1a848a08a883b Author: Clint Taylor Date: Mon Dec 17 14:13:47 2018 -0800 drm/i915/icl: combo port vswing programming changes per BSPEC In August 2018 the BSPEC changed the ICL port programming sequence to closely resemble earlier gen programming sequence. Restrict combo phy to HBR max rate unless eDP panel is connected to port. v2: remove debug code that Imre found v3: simplify translation table if-else v4: edp translation table now based on link rate and low_swing v5: Misc review comments + r-b BSpec: 21257 Cc: Ville Syrjälä Cc: Imre Deak Cc: Rodrigo Vivi Reviewed-by: Imre Deak Signed-off-by: Clint Taylor Signed-off-by: Imre Deak Link: https://patchwork.freedesktop.org/patch/msgid/1545084827-5776-1-git-send-email-clinton.a.taylor@intel.com (cherry picked from commit b265a2a6255f581258ccfdccbd2efca51a142fe2) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_reg.h | 4 + drivers/gpu/drm/i915/intel_ddi.c | 238 ++++++++++++++------------------------- drivers/gpu/drm/i915/intel_dp.c | 4 +- 3 files changed, 93 insertions(+), 153 deletions(-) commit 3defaf2f15b2bfd86c6664181ac009e91985f8ac Author: Alexei Starovoitov Date: Sun Feb 10 12:52:35 2019 -0800 bpf: fix lockdep false positive in stackmap Lockdep warns about false positive: [ 11.211460] ------------[ cut here ]------------ [ 11.211936] DEBUG_LOCKS_WARN_ON(depth <= 0) [ 11.211985] WARNING: CPU: 0 PID: 141 at ../kernel/locking/lockdep.c:3592 lock_release+0x1ad/0x280 [ 11.213134] Modules linked in: [ 11.214954] RIP: 0010:lock_release+0x1ad/0x280 [ 11.223508] Call Trace: [ 11.223705] [ 11.223874] ? __local_bh_enable+0x7a/0x80 [ 11.224199] up_read+0x1c/0xa0 [ 11.224446] do_up_read+0x12/0x20 [ 11.224713] irq_work_run_list+0x43/0x70 [ 11.225030] irq_work_run+0x26/0x50 [ 11.225310] smp_irq_work_interrupt+0x57/0x1f0 [ 11.225662] irq_work_interrupt+0xf/0x20 since rw_semaphore is released in a different task vs task that locked the sema. It is expected behavior. Fix the warning with up_read_non_owner() and rwsem_release() annotation. Fixes: bae77c5eb5b2 ("bpf: enable stackmap with build_id in nmi context") Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann kernel/bpf/stackmap.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 6157ca0d6bfe437691b1e98a62e2efe12b6714da Author: Ilan Peer Date: Wed Feb 6 13:17:21 2019 +0200 mac80211: Fix Tx aggregation session tear down with ITXQs When mac80211 requests the low level driver to stop an ongoing Tx aggregation, the low level driver is expected to call ieee80211_stop_tx_ba_cb_irqsafe() to indicate that it is ready to stop the session. The callback in turn schedules a worker to complete the session tear down, which in turn also handles the relevant state for the intermediate Tx queue. However, as this flow in asynchronous, the intermediate queue should be stopped and not continue servicing frames, as in such a case frames that are dequeued would be marked as part of an aggregation, although the aggregation is already been stopped. Fix this by stopping the intermediate Tx queue, before calling the low level driver to stop the Tx aggregation. Signed-off-by: Ilan Peer Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg net/mac80211/agg-tx.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 1fc9b7253382ce1a83d9a3e63e88d656eb63f263 Author: Johannes Berg Date: Wed Feb 6 13:17:14 2019 +0200 cfg80211: prevent speculation on cfg80211_classify8021d() return It's possible that the caller of cfg80211_classify8021d() uses the value to index an array, like mac80211 in ieee80211_downgrade_queue(). Prevent speculation on the return value. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg net/wireless/util.c | 35 ++++++++++++++++++++++++----------- 1 file changed, 24 insertions(+), 11 deletions(-) commit ff1bab1ba19165d4402447dd39abae9e21880ebf Author: Johannes Berg Date: Wed Feb 6 13:17:07 2019 +0200 cfg80211: pmsr: record netlink port ID Without recording the netlink port ID, we cannot return the results or complete messages to userspace, nor will we be able to abort if the socket is closed, so clearly we need to fill the value. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg net/wireless/pmsr.c | 1 + 1 file changed, 1 insertion(+) commit ea18709a6f102f975178c21aa7fc4b69eeba1424 Author: Aviya Erenfeld Date: Wed Feb 6 13:17:08 2019 +0200 nl80211: Fix FTM per burst maximum value Fix FTM per burst maximum value from 15 to 31 (The maximal bits that represents that number in the frame is 5 hence a maximal value of 31) Signed-off-by: Aviya Erenfeld Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg net/wireless/nl80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4926b51bfaa6d36bd6f398fb7698679d3962e19d Author: Johannes Berg Date: Wed Feb 6 13:17:12 2019 +0200 mac80211: call drv_ibss_join() on restart If a driver does any significant activity in its ibss_join method, then it will very well expect that to be called during restart, before any stations are added. Do that. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg net/mac80211/util.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit b10bd9a256aec504c14a7c9b6fccb6301ecf290a Author: Pierre Morel Date: Mon Feb 11 10:20:49 2019 +0100 s390: vsie: Use effective CRYCBD.31 to check CRYCBD validity When facility.76 MSAX3 is present for the guest we must issue a validity interception if the CRYCBD is not valid. The bit CRYCBD.31 is an effective field and tested at each guest level and has for effect to mask the facility.76 It follows that if CRYCBD.31 is clear and AP is not in use we do not have to test the CRYCBD validatity even if facility.76 is present in the host. Fixes: 6ee74098201b ("KVM: s390: vsie: allow CRYCB FORMAT-0") Cc: stable@vger.kernel.org Signed-off-by: Pierre Morel Reported-by: Claudio Imbrenda Acked-by: David Hildenbrand Acked-by: Cornelia Huck Reviewed-by: Christian Borntraeger Message-Id: <1549876849-32680-1-git-send-email-pmorel@linux.ibm.com> Signed-off-by: Christian Borntraeger arch/s390/kvm/vsie.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 81ec3f3c4c4d78f2d3b6689c9816bfbdf7417dbb Author: Jiri Olsa Date: Mon Feb 4 13:35:32 2019 +0100 perf/x86: Add check_period PMU callback Vince (and later on Ravi) reported crashes in the BTS code during fuzzing with the following backtrace: general protection fault: 0000 [#1] SMP PTI ... RIP: 0010:perf_prepare_sample+0x8f/0x510 ... Call Trace: ? intel_pmu_drain_bts_buffer+0x194/0x230 intel_pmu_drain_bts_buffer+0x160/0x230 ? tick_nohz_irq_exit+0x31/0x40 ? smp_call_function_single_interrupt+0x48/0xe0 ? call_function_single_interrupt+0xf/0x20 ? call_function_single_interrupt+0xa/0x20 ? x86_schedule_events+0x1a0/0x2f0 ? x86_pmu_commit_txn+0xb4/0x100 ? find_busiest_group+0x47/0x5d0 ? perf_event_set_state.part.42+0x12/0x50 ? perf_mux_hrtimer_restart+0x40/0xb0 intel_pmu_disable_event+0xae/0x100 ? intel_pmu_disable_event+0xae/0x100 x86_pmu_stop+0x7a/0xb0 x86_pmu_del+0x57/0x120 event_sched_out.isra.101+0x83/0x180 group_sched_out.part.103+0x57/0xe0 ctx_sched_out+0x188/0x240 ctx_resched+0xa8/0xd0 __perf_event_enable+0x193/0x1e0 event_function+0x8e/0xc0 remote_function+0x41/0x50 flush_smp_call_function_queue+0x68/0x100 generic_smp_call_function_single_interrupt+0x13/0x30 smp_call_function_single_interrupt+0x3e/0xe0 call_function_single_interrupt+0xf/0x20 The reason is that while event init code does several checks for BTS events and prevents several unwanted config bits for BTS event (like precise_ip), the PERF_EVENT_IOC_PERIOD allows to create BTS event without those checks being done. Following sequence will cause the crash: If we create an 'almost' BTS event with precise_ip and callchains, and it into a BTS event it will crash the perf_prepare_sample() function because precise_ip events are expected to come in with callchain data initialized, but that's not the case for intel_pmu_drain_bts_buffer() caller. Adding a check_period callback to be called before the period is changed via PERF_EVENT_IOC_PERIOD. It will deny the change if the event would become BTS. Plus adding also the limit_period check as well. Reported-by: Vince Weaver Signed-off-by: Jiri Olsa Acked-by: Peter Zijlstra Cc: Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Naveen N. Rao Cc: Ravi Bangoria Cc: Stephane Eranian Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/20190204123532.GA4794@krava Signed-off-by: Ingo Molnar arch/x86/events/core.c | 14 ++++++++++++++ arch/x86/events/intel/core.c | 9 +++++++++ arch/x86/events/perf_event.h | 16 ++++++++++++++-- include/linux/perf_event.h | 5 +++++ kernel/events/core.c | 16 ++++++++++++++++ 5 files changed, 58 insertions(+), 2 deletions(-) commit a5a08c35d382a5a8da397260c3febb8dff4bdeef Author: Bjorn Andersson Date: Thu Jan 31 09:29:53 2019 -0800 pinctrl: qcom: qcs404: Correct SDC tile The SDC controls live in the south tile, not the north one. Correct this so that we program the right registers. Cc: stable@vger.kernel.org Fixes: 22eb8301dbc1 ("pinctrl: qcom: Add qcs404 pinctrl driver") Signed-off-by: Bjorn Andersson Reviewed-by: Vinod Koul Signed-off-by: Linus Walleij drivers/pinctrl/qcom/pinctrl-qcs404.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 491af60ffb848b59e82f7c9145833222e0bf27a5 Author: Sergei Trofimovich Date: Mon Dec 31 11:53:55 2018 +0000 alpha: fix page fault handling for r16-r18 targets Fix page fault handling code to fixup r16-r18 registers. Before the patch code had off-by-two registers bug. This bug caused overwriting of ps,pc,gp registers instead of fixing intended r16,r17,r18 (see `struct pt_regs`). More details: Initially Dmitry noticed a kernel bug as a failure on strace test suite. Test passes unmapped userspace pointer to io_submit: ```c #include #include #include #include int main(void) { unsigned long ctx = 0; if (syscall(__NR_io_setup, 1, &ctx)) err(1, "io_setup"); const size_t page_size = sysconf(_SC_PAGESIZE); const size_t size = page_size * 2; void *ptr = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); if (MAP_FAILED == ptr) err(1, "mmap(%zu)", size); if (munmap(ptr, size)) err(1, "munmap"); syscall(__NR_io_submit, ctx, 1, ptr + page_size); syscall(__NR_io_destroy, ctx); return 0; } ``` Running this test causes kernel to crash when handling page fault: ``` Unable to handle kernel paging request at virtual address ffffffffffff9468 CPU 3 aio(26027): Oops 0 pc = [] ra = [] ps = 0000 Not tainted pc is at sys_io_submit+0x108/0x200 ra is at sys_io_submit+0x6c/0x200 v0 = fffffc00c58e6300 t0 = fffffffffffffff2 t1 = 000002000025e000 t2 = fffffc01f159fef8 t3 = fffffc0001009640 t4 = fffffc0000e0f6e0 t5 = 0000020001002e9e t6 = 4c41564e49452031 t7 = fffffc01f159c000 s0 = 0000000000000002 s1 = 000002000025e000 s2 = 0000000000000000 s3 = 0000000000000000 s4 = 0000000000000000 s5 = fffffffffffffff2 s6 = fffffc00c58e6300 a0 = fffffc00c58e6300 a1 = 0000000000000000 a2 = 000002000025e000 a3 = 00000200001ac260 a4 = 00000200001ac1e8 a5 = 0000000000000001 t8 = 0000000000000008 t9 = 000000011f8bce30 t10= 00000200001ac440 t11= 0000000000000000 pv = fffffc00006fd320 at = 0000000000000000 gp = 0000000000000000 sp = 00000000265fd174 Disabling lock debugging due to kernel taint Trace: [] entSys+0xa4/0xc0 ``` Here `gp` has invalid value. `gp is s overwritten by a fixup for the following page fault handler in `io_submit` syscall handler: ``` __se_sys_io_submit ... ldq a1,0(t1) bne t0,4280 <__se_sys_io_submit+0x180> ``` After a page fault `t0` should contain -EFALUT and `a1` is 0. Instead `gp` was overwritten in place of `a1`. This happens due to a off-by-two bug in `dpf_reg()` for `r16-r18` (aka `a0-a2`). I think the bug went unnoticed for a long time as `gp` is one of scratch registers. Any kernel function call would re-calculate `gp`. Dmitry tracked down the bug origin back to 2.1.32 kernel version where trap_a{0,1,2} fields were inserted into struct pt_regs. And even before that `dpf_reg()` contained off-by-one error. Cc: Richard Henderson Cc: Ivan Kokshaysky Cc: linux-alpha@vger.kernel.org Cc: linux-kernel@vger.kernel.org Reported-and-reviewed-by: "Dmitry V. Levin" Cc: stable@vger.kernel.org # v2.1.32+ Bug: https://bugs.gentoo.org/672040 Signed-off-by: Sergei Trofimovich Signed-off-by: Matt Turner arch/alpha/mm/fault.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bfc913682464f45bc4d6044084e370f9048de9d5 Author: Meelis Roos Date: Fri Oct 12 12:27:51 2018 +0300 alpha: Fix Eiger NR_IRQS to 128 Eiger machine vector definition has nr_irqs 128, and working 2.6.26 boot shows SCSI getting IRQ-s 64 and 65. Current kernel boot fails because Symbios SCSI fails to request IRQ-s and does not find the disks. It has been broken at least since 3.18 - the earliest I could test with my gcc-5. The headers have moved around and possibly another order of defines has worked in the past - but since 128 seems to be correct and used, fix arch/alpha/include/asm/irq.h to have NR_IRQS=128 for Eiger. This fixes 4.19-rc7 boot on my Force Flexor A264 (Eiger subarch). Cc: stable@vger.kernel.org # v3.18+ Signed-off-by: Meelis Roos Signed-off-by: Matt Turner arch/alpha/include/asm/irq.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit e6762c8bcf982821935a2b1cb33cf8335d0eefae Author: Magnus Karlsson Date: Fri Feb 8 14:13:50 2019 +0100 xsk: add missing smp_rmb() in xsk_mmap All the setup code in AF_XDP is protected by a mutex with the exception of the mmap code that cannot use it. To make sure that a process banging on the mmap call at the same time as another process is setting up the socket, smp_wmb() calls were added in the umem registration code and the queue creation code, so that the published structures that xsk_mmap needs would be consistent. However, the corresponding smp_rmb() calls were not added to the xsk_mmap code. This patch adds these calls. Fixes: 37b076933a8e3 ("xsk: add missing write- and data-dependency barrier") Fixes: c0c77d8fb787c ("xsk: add user memory registration support sockopt") Signed-off-by: Magnus Karlsson Signed-off-by: Alexei Starovoitov net/xdp/xsk.c | 4 ++++ 1 file changed, 4 insertions(+) commit b90efd2258749e04e1b3f71ef0d716f2ac2337e0 Author: Willem de Bruijn Date: Thu Feb 7 14:54:16 2019 -0500 bpf: only adjust gso_size on bytestream protocols bpf_skb_change_proto and bpf_skb_adjust_room change skb header length. For GSO packets they adjust gso_size to maintain the same MTU. The gso size can only be safely adjusted on bytestream protocols. Commit d02f51cbcf12 ("bpf: fix bpf_skb_adjust_net/bpf_skb_proto_xlat to deal with gso sctp skbs") excluded SKB_GSO_SCTP. Since then type SKB_GSO_UDP_L4 has been added, whose contents are one gso_size unit per datagram. Also exclude these. Move from a blacklist to a whitelist check to future proof against additional such new GSO types, e.g., for fraglist based GRO. Fixes: bec1f6f69736 ("udp: generate gso with UDP_SEGMENT") Signed-off-by: Willem de Bruijn Signed-off-by: Alexei Starovoitov include/linux/skbuff.h | 6 ++++++ net/core/filter.c | 12 ++++-------- 2 files changed, 10 insertions(+), 8 deletions(-) commit 842fc0f5dc5c9f9bd91f891554996d903c40cf35 Author: Bob Tracy Date: Mon Jan 21 21:09:14 2019 -0800 tools uapi: fix Alpha support Cc: stable@vger.kernel.org # v4.18+ Signed-off-by: Bob Tracy Signed-off-by: Matt Turner tools/include/uapi/asm/bitsperlong.h | 2 ++ 1 file changed, 2 insertions(+) commit d13937116f1e82bf508a6325111b322c30c85eb9 Author: Linus Torvalds Date: Sun Feb 10 14:42:20 2019 -0800 Linux 5.0-rc6 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 31b58ad0c3279817cd246eab27eaf53b626dfcde Merge: ccc8ca9b90ac 0255d5927c0f Author: David S. Miller Date: Sun Feb 10 12:54:49 2019 -0800 Merge branch 'r8169-revert-two-commits-due-to-a-regression' Heiner Kallweit says: ==================== r8169: revert two commits due to a regression Sander reported a regression (kernel panic, see[1]), therefore let's revert these commits. Removal of the barriers doesn't seem to contribute to the issue, the patch just overlaps with the problematic one and only reverting both patches was tested. [1] https://marc.info/?t=154965066400001&r=1&w=2 v2: - improve commit message ==================== Signed-off-by: David S. Miller commit 0255d5927c0f2484de2649c7eb69e4fc459f0130 Author: Heiner Kallweit Date: Sun Feb 10 15:28:04 2019 +0100 Revert "r8169: make use of xmit_more and __netdev_sent_queue" This reverts commit 2e6eedb4813e34d8d84ac0eb3afb668966f3f356. Sander reported a regression causing a kernel panic[1], therefore let's revert this commit. [1] https://marc.info/?t=154965066400001&r=1&w=2 Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller drivers/net/ethernet/realtek/r8169.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) commit 978749617bc0b5355e659cbeb855f7bcdc3b40ea Author: Heiner Kallweit Date: Sun Feb 10 15:26:07 2019 +0100 Revert "r8169: remove unneeded mmiowb barriers" This reverts commit bd7153bd83b806bfcc2e79b7a6f43aa653d06ef3. There doesn't seem to be anything wrong with this patch, it's just reverted to get a stable baseline again. Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller drivers/net/ethernet/realtek/r8169.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 68d94a8424352d723e4991de4745ce6795b23069 Merge: aadaa8061189 6454368a804c Author: Linus Torvalds Date: Sun Feb 10 10:39:37 2019 -0800 Merge tag 'dmaengine-fix-5.0-rc6' of git://git.infradead.org/users/vkoul/slave-dma Pull dmaengine fixes from Vinod Koul: - Fix in at_xdmac fr wrongful channel state - Fix for imx driver for wrong callback invocation - Fix to bcm driver for interrupt race & transaction abort. - Fix in dmatest to abort in mapping error * tag 'dmaengine-fix-5.0-rc6' of git://git.infradead.org/users/vkoul/slave-dma: dmaengine: dmatest: Abort test in case of mapping error dmaengine: bcm2835: Fix abort of transactions dmaengine: bcm2835: Fix interrupt race on RT dmaengine: imx-dma: fix wrong callback invoke dmaengine: at_xdmac: Fix wrongfull report of a channel as in use commit aadaa8061189a9e5d8a1327b328453d663e8cbc9 Merge: 73a4c5218414 20e55bc17dd0 Author: Linus Torvalds Date: Sun Feb 10 09:57:42 2019 -0800 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "A handful of fixes: - Fix an MCE corner case bug/crash found via MCE injection testing - Fix 5-level paging boot crash - Fix MCE recovery cache invalidation bug - Fix regression on Xen guests caused by a recent PMD level mremap speedup optimization" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mm: Make set_pmd_at() paravirt aware x86/mm/cpa: Fix set_mce_nospec() x86/boot/compressed/64: Do not corrupt EDX on EFER.LME=1 setting x86/MCE: Initialize mce.bank in the case of a fatal error in mce_no_way_out() commit 73a4c52184141943146ebbf07de4dca27141f21c Merge: 212146f0800e 8087f407364d Author: Linus Torvalds Date: Sun Feb 10 09:54:19 2019 -0800 Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Ingo Molnar: "irqchip driver fixes: most of them are race fixes for ARM GIC (General Interrupt Controller) variants, but also a fix for the ARM MMP (Marvell PXA168 et al) irqchip affecting OLPC keyboards" * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/gic-v3-its: Fix ITT_entry_size accessor irqchip/mmp: Only touch the PJ4 IRQ & FIQ bits on enable/disable irqchip/gic-v3-its: Gracefully fail on LPI exhaustion irqchip/gic-v3-its: Plug allocation race for devices sharing a DevID irqchip/gic-v4: Fix occasional VLPI drop commit 212146f0800e151bd61b98fb6fe4b8b6778a649a Merge: d2a6aae99f5f 3bb2600657da Author: Linus Torvalds Date: Sun Feb 10 09:48:18 2019 -0800 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Ingo Molnar: "A couple of kernel side fixes: - Fix the Intel uncore driver on certain hardware configurations - Fix a CPU hotplug related memory allocation bug - Remove a spurious WARN() ... plus also a handful of perf tooling fixes" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf script python: Add Python3 support to tests/attr.py perf trace: Support multiple "vfs_getname" probes perf symbols: Filter out hidden symbols from labels perf symbols: Add fallback definitions for GELF_ST_VISIBILITY() tools headers uapi: Sync linux/in.h copy from the kernel sources perf clang: Do not use 'return std::move(something)' perf mem/c2c: Fix perf_mem_events to support powerpc perf tests evsel-tp-sched: Fix bitwise operator perf/core: Don't WARN() for impossible ring-buffer sizes perf/x86/intel: Delay memory deallocation until x86_pmu_dead_cpu() perf/x86/intel/uncore: Add Node ID mask commit d2a6aae99f5fa2f1e7e400bd2f17c1d42c50312a Merge: df3865f8f568 1a1fb985f2e2 Author: Linus Torvalds Date: Sun Feb 10 09:44:52 2019 -0800 Merge branch 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fixes from Ingo Molnar: "An rtmutex (PI-futex) deadlock scenario fix, plus a locking documentation fix" * 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: futex: Handle early deadlock return correctly futex: Fix barrier comment commit 7fd56e0260a22c0cfaf9adb94a2427b76e239dd0 Author: Rodrigo Siqueira Date: Wed Feb 6 12:01:16 2019 -0200 drm/vkms: Fix license inconsistent Fixes license inconsistent related to the VKMS driver and remove the redundant boilerplate comment. Fixes: 854502fa0a38 ("drm/vkms: Add basic CRTC initialization") Cc: stable@vger.kernel.org Signed-off-by: Rodrigo Siqueira Acked-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20190206140116.7qvy2lpwbcd7wds6@smtp.gmail.com drivers/gpu/drm/vkms/vkms_crc.c | 3 ++- drivers/gpu/drm/vkms/vkms_crtc.c | 8 +------- drivers/gpu/drm/vkms/vkms_drv.c | 7 +------ drivers/gpu/drm/vkms/vkms_drv.h | 2 ++ drivers/gpu/drm/vkms/vkms_gem.c | 8 +------- drivers/gpu/drm/vkms/vkms_output.c | 8 +------- drivers/gpu/drm/vkms/vkms_plane.c | 8 +------- 7 files changed, 9 insertions(+), 35 deletions(-) commit 20e55bc17dd01f13cec0eb17e76e9511b23963ef Author: Juergen Gross Date: Sun Feb 10 08:40:56 2019 +0100 x86/mm: Make set_pmd_at() paravirt aware set_pmd_at() calls native_set_pmd() unconditionally on x86. This was fine as long as only huge page entries were written via set_pmd_at(), as Xen pv guests don't support those. Commit 2c91bd4a4e2e53 ("mm: speed up mremap by 20x on large regions") introduced a usage of set_pmd_at() possible on pv guests, leading to failures like: BUG: unable to handle kernel paging request at ffff888023e26778 #PF error: [PROT] [WRITE] RIP: e030:move_page_tables+0x7c1/0xae0 move_vma.isra.3+0xd1/0x2d0 __se_sys_mremap+0x3c6/0x5b0 do_syscall_64+0x49/0x100 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Make set_pmd_at() paravirt aware by just letting it use set_pmd(). Fixes: 2c91bd4a4e2e53 ("mm: speed up mremap by 20x on large regions") Reported-by: Sander Eikelenboom Signed-off-by: Juergen Gross Signed-off-by: Thomas Gleixner Cc: xen-devel@lists.xenproject.org Cc: boris.ostrovsky@oracle.com Cc: sstabellini@kernel.org Cc: hpa@zytor.com Cc: bp@alien8.de Cc: torvalds@linux-foundation.org Link: https://lkml.kernel.org/r/20190210074056.11842-1-jgross@suse.com arch/x86/include/asm/pgtable.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d623876646be119439999a229a2c3ce30fd197fb Author: Martin KaFai Lau Date: Fri Feb 8 22:25:54 2019 -0800 bpf: Fix narrow load on a bpf_sock returned from sk_lookup() By adding this test to test_verifier: { "reference tracking: access sk->src_ip4 (narrow load)", .insns = { BPF_SK_LOOKUP, BPF_MOV64_REG(BPF_REG_6, BPF_REG_0), BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3), BPF_LDX_MEM(BPF_H, BPF_REG_2, BPF_REG_0, offsetof(struct bpf_sock, src_ip4) + 2), BPF_MOV64_REG(BPF_REG_1, BPF_REG_6), BPF_EMIT_CALL(BPF_FUNC_sk_release), BPF_EXIT_INSN(), }, .prog_type = BPF_PROG_TYPE_SCHED_CLS, .result = ACCEPT, }, The above test loads 2 bytes from sk->src_ip4 where sk is obtained by bpf_sk_lookup_tcp(). It hits an internal verifier error from convert_ctx_accesses(): [root@arch-fb-vm1 bpf]# ./test_verifier 665 665 Failed to load prog 'Invalid argument'! 0: (b7) r2 = 0 1: (63) *(u32 *)(r10 -8) = r2 2: (7b) *(u64 *)(r10 -16) = r2 3: (7b) *(u64 *)(r10 -24) = r2 4: (7b) *(u64 *)(r10 -32) = r2 5: (7b) *(u64 *)(r10 -40) = r2 6: (7b) *(u64 *)(r10 -48) = r2 7: (bf) r2 = r10 8: (07) r2 += -48 9: (b7) r3 = 36 10: (b7) r4 = 0 11: (b7) r5 = 0 12: (85) call bpf_sk_lookup_tcp#84 13: (bf) r6 = r0 14: (15) if r0 == 0x0 goto pc+3 R0=sock(id=1,off=0,imm=0) R6=sock(id=1,off=0,imm=0) R10=fp0,call_-1 fp-8=????0000 fp-16=0000mmmm fp-24=mmmmmmmm fp-32=mmmmmmmm fp-40=mmmmmmmm fp-48=mmmmmmmm refs=1 15: (69) r2 = *(u16 *)(r0 +26) 16: (bf) r1 = r6 17: (85) call bpf_sk_release#86 18: (95) exit from 14 to 18: safe processed 20 insns (limit 131072), stack depth 48 bpf verifier is misconfigured Summary: 0 PASSED, 0 SKIPPED, 1 FAILED The bpf_sock_is_valid_access() is expecting src_ip4 can be narrowly loaded (meaning load any 1 or 2 bytes of the src_ip4) by marking info->ctx_field_size. However, this marked ctx_field_size is not used. This patch fixes it. Due to the recent refactoring in test_verifier, this new test will be added to the bpf-next branch (together with the bpf_tcp_sock patchset) to avoid merge conflict. Fixes: c64b7983288e ("bpf: Add PTR_TO_SOCKET verifier type") Cc: Joe Stringer Signed-off-by: Martin KaFai Lau Acked-by: Joe Stringer Signed-off-by: Alexei Starovoitov kernel/bpf/verifier.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) commit df3865f8f56879b7e9f0ca47fa7bc5f2252df6d3 Merge: e8b50608f666 13c80dda84c4 Author: Linus Torvalds Date: Sat Feb 9 13:43:12 2019 -0800 Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "One PM related driver bugfix and a MAINTAINERS update" * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: MAINTAINERS: Update the ocores i2c bus driver maintainer, etc i2c: omap: Use noirq system sleep pm ops to idle device for suspend commit e8b50608f666cf5c314a9df3dc4b85789a6aeaa5 Merge: e5a8a1163211 05dc6001af06 Author: Linus Torvalds Date: Sat Feb 9 12:41:14 2019 -0800 Merge tag 'mips_fixes_5.0_3' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS fixes from Paul Burton: "A batch of MIPS fixes for 5.0, nothing too scary. - A workaround for a Loongson 3 CPU bug is the biggest change, but still fairly straightforward. It adds extra memory barriers (sync instructions) around atomics to avoid a CPU bug that can break atomicity. - Loongson64 also sees a fix for powering off some systems which would incorrectly reboot rather than waiting for the power down sequence to complete. - We have DT fixes for the Ingenic JZ4740 SoC & the JZ4780-based Ci20 board, and a DT warning fix for the Nexsys4/MIPSfpga board. - The Cavium Octeon platform sees a further fix to the behaviour of the pcie_disable command line argument that was introduced in v3.3. - The VDSO, introduced in v4.4, sees build fixes for configurations of GCC that were built using the --with-fp-32= flag to specify a default 32-bit floating point ABI. - get_frame_info() sees a fix for configurations with CONFIG_KALLSYMS=n, for which it previously always returned an error. - If the MIPS Coherence Manager (CM) reports an error then we'll now clear that error correctly so that the GCR_ERROR_CAUSE register will be updated with information about any future errors" * tag 'mips_fixes_5.0_3' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: mips: cm: reprime error cause mips: loongson64: remove unreachable(), fix loongson_poweroff(). MIPS: Remove function size check in get_frame_info() MIPS: Use lower case for addresses in nexys4ddr.dts MIPS: Loongson: Introduce and use loongson_llsc_mb() MIPS: VDSO: Include $(ccflags-vdso) in o32,n32 .lds builds MIPS: VDSO: Use same -m%-float cflag as the kernel proper MIPS: OCTEON: don't set octeon_dma_bar_type if PCI is disabled DTS: CI20: Fix bugs in ci20's device tree. MIPS: DTS: jz4740: Correct interrupt number of DMA core commit e5a8a1163211e2ab6f71c3545b26d55dc99ff1d3 Merge: 5610789ad08d 2698484178ca Author: Linus Torvalds Date: Sat Feb 9 10:26:09 2019 -0800 Merge tag 'for-linus-20190209' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: - NVMe pull request from Christoph, fixing namespace locking when dealing with the effects log, and a rapid add/remove issue (Keith) - blktrace tweak, ensuring requests with -1 sectors are shown (Jan) - link power management quirk for a Smasung SSD (Hans) - m68k nfblock dynamic major number fix (Chengguang) - series fixing blk-iolatency inflight counter issue (Liu) - ensure that we clear ->private when setting up the aio kiocb (Mike) - __find_get_block_slow() rate limit print (Tetsuo) * tag 'for-linus-20190209' of git://git.kernel.dk/linux-block: blk-mq: remove duplicated definition of blk_mq_freeze_queue Blk-iolatency: warn on negative inflight IO counter blk-iolatency: fix IO hang due to negative inflight counter blktrace: Show requests without sector fs: ratelimit __find_get_block_slow() failure message. m68k: set proper major_num when specifying module param major_num libata: Add NOLPM quirk for SAMSUNG MZ7TE512HMHP-000L1 SSD nvme-pci: fix rapid add remove sequence nvme: lock NS list changes while handling command effects aio: initialize kiocb private in case any filesystems expect it. commit 5610789ad08dacfd96fd684b53d7acd9e628ca20 Merge: 3e5e692fcd6c d5d27fd9826b Author: Linus Torvalds Date: Sat Feb 9 10:17:01 2019 -0800 Merge tag 'mtd/fixes-for-5.0-rc6' of git://git.infradead.org/linux-mtd Pull mtd fixes from Boris Brezillon: - Fix a problem with the imx28 ECC engine - Remove a debug trace introduced in 2b6f0090a333 ("mtd: Check add_mtd_device() ret code") - Make sure partitions of size 0 can be registered - Fix kernel-doc warning in the rawnand core - Fix the error path of spinand_init() (missing manufacturer cleanup in a few places) - Address a problem with the SPI NAND PROGRAM LOAD operation which does not work as expected on some parts. * tag 'mtd/fixes-for-5.0-rc6' of git://git.infradead.org/linux-mtd: mtd: rawnand: gpmi: fix MX28 bus master lockup problem mtd: Make sure mtd->erasesize is valid even if the partition is of size 0 mtd: Remove a debug trace in mtdpart.c mtd: rawnand: fix kernel-doc warnings mtd: spinand: Fix the error/cleanup path in spinand_init() mtd: spinand: Handle the case where PROGRAM LOAD does not reset the cache commit 3e5e692fcd6ce0d63d8c9bd8677d9aaeec61d70e Merge: 46c291e277f9 9ab7d228e972 Author: Linus Torvalds Date: Sat Feb 9 09:44:08 2019 -0800 Merge tag 'for-linus-5.0-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: "Two very minor fixes: one remove of a #include for an unused header and a fix of the xen ML address in MAINTAINERS" * tag 'for-linus-5.0-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: MAINTAINERS: unify reference to xen-devel list arch/arm/xen: Remove duplicate header commit a342083abe576db43594a32d458a61fa81f7cb32 Author: Dmitry Torokhov Date: Thu Feb 7 14:39:40 2019 -0800 Input: matrix_keypad - use flush_delayed_work() We should be using flush_delayed_work() instead of flush_work() in matrix_keypad_stop() to ensure that we are not missing work that is scheduled but not yet put in the workqueue (i.e. its delay timer has not expired yet). Signed-off-by: Dmitry Torokhov drivers/input/keyboard/matrix_keypad.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 33a841ce5cef4ca6c18ad333248b6d273f54c839 Author: Dmitry Torokhov Date: Thu Feb 7 14:22:42 2019 -0800 Input: ps2-gpio - flush TX work when closing port To ensure that TX work is not running after serio port has been torn down, let's flush it when closing the port. Reported-by: Sven Van Asbroeck Acked-by: Danilo Krummrich Reviewed-by: Sven Van Asbroeck Signed-off-by: Dmitry Torokhov drivers/input/serio/ps2-gpio.c | 1 + 1 file changed, 1 insertion(+) commit 628442880af8c201d307a45f3862a7a17df8a189 Author: Dmitry Torokhov Date: Tue Feb 5 13:52:26 2019 -0800 Input: cap11xx - switch to using set_brightness_blocking() Updating LED state requires access to regmap and therefore we may sleep, so we could not do that directly form set_brightness() method. Historically we used private work to adjust the brightness, but with the introduction of set_brightness_blocking() we no longer need it. As a bonus, not having our own work item means we do not have use-after-free issue as we neglected to cancel outstanding work on driver unbind. Reported-by: Sven Van Asbroeck Reviewed-by: Sven Van Asbroeck Acked-by: Jacek Anaszewski Signed-off-by: Dmitry Torokhov drivers/input/keyboard/cap11xx.c | 35 +++++++++++------------------------ 1 file changed, 11 insertions(+), 24 deletions(-) commit 3bb2600657dac78580e5b8fecc202eaaff5d4ced Merge: 9dff0aa95a32 8f2f350cbdb2 Author: Ingo Molnar Date: Sat Feb 9 13:13:45 2019 +0100 Merge tag 'perf-urgent-for-mingo-5.0-20190205' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/urgent fixes from Arnaldo Carvalho de Melo: perf trace: Arnaldo Carvalho de Melo: Fix handling of probe:vfs_getname when the probed routine is inlined in multiple places, fixing the collection of the 'filename' parameter in open syscalls. perf test: Gustavo A. R. Silva: Fix bitwise operator usage in evsel-tp-sched test, which made tat test always detect fields as signed. Jiri Olsa: Filter out hidden symbols from labels, added in systems where the annobin plugin is used, such as RHEL8, which, if left in place make the DWARF unwind 'perf test' to fail on PPC. Tony Jones: Fix 'perf_event_attr' tests when building with python3. perf mem/c2c: Ravi Bangoria: Fix perf_mem_events on PowerPC. tools headers UAPI: Arnaldo Carvalho de Melo: Sync linux/in.h copy from the kernel sources, silencing a perf build warning. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit ccc8ca9b90acb45a3309f922b2591b07b4e070ec Author: Ursula Braun Date: Thu Feb 7 14:52:54 2019 +0100 net/smc: fix byte_order for rx_curs_confirmed The recent change in the rx_curs_confirmed assignment disregards byte order, which causes problems on little endian architectures. This patch fixes it. Fixes: b8649efad879 ("net/smc: fix sender_free computation") (net-tree) Signed-off-by: Ursula Braun Signed-off-by: David S. Miller net/smc/smc_cdc.c | 4 +--- net/smc/smc_cdc.h | 19 ++++++++++--------- 2 files changed, 11 insertions(+), 12 deletions(-) commit 225d9464268599a5b4d094d02ec17808e44c7553 Author: Paolo Abeni Date: Thu Feb 7 14:13:18 2019 +0100 vsock: cope with memory allocation failure at socket creation time In the unlikely event that the kmalloc call in vmci_transport_socket_init() fails, we end-up calling vmci_transport_destruct() with a NULL vmci_trans() and oopsing. This change addresses the above explicitly checking for zero vmci_trans() at destruction time. Reported-by: Xiumei Mu Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") Signed-off-by: Paolo Abeni Reviewed-by: Stefano Garzarella Reviewed-by: Jorgen Hansen Signed-off-by: David S. Miller net/vmw_vsock/vmci_transport.c | 4 ++++ 1 file changed, 4 insertions(+) commit c09551c6ff7fe16a79a42133bcecba5fc2fc3291 Author: Lorenzo Bianconi Date: Wed Feb 6 19:18:04 2019 +0100 net: ipv4: use a dedicated counter for icmp_v4 redirect packets According to the algorithm described in the comment block at the beginning of ip_rt_send_redirect, the host should try to send 'ip_rt_redirect_number' ICMP redirect packets with an exponential backoff and then stop sending them at all assuming that the destination ignores redirects. If the device has previously sent some ICMP error packets that are rate-limited (e.g TTL expired) and continues to receive traffic, the redirect packets will never be transmitted. This happens since peer->rate_tokens will be typically greater than 'ip_rt_redirect_number' and so it will never be reset even if the redirect silence timeout (ip_rt_redirect_silence) has elapsed without receiving any packet requiring redirects. Fix it by using a dedicated counter for the number of ICMP redirect packets that has been sent by the host I have not been able to identify a given commit that introduced the issue since ip_rt_send_redirect implements the same rate-limiting algorithm from commit 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Lorenzo Bianconi Signed-off-by: David S. Miller include/net/inetpeer.h | 1 + net/ipv4/inetpeer.c | 1 + net/ipv4/route.c | 7 +++++-- 3 files changed, 7 insertions(+), 2 deletions(-) commit 46c291e277f93737877305f5626a2c5c35522cb1 Merge: 5bb513ed838c d0f9f16788e1 Author: Linus Torvalds Date: Fri Feb 8 16:23:41 2019 -0800 Merge tag 'armsoc-fixes-5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC fixes from Arnd Bergmann: "This is a bit larger than normal, as we had not managed to send out a pull request before traveling for a week without my signing key. There are multiple code fixes for older bugs, all of which should get backported into stable kernels: - tango: one fix for multiplatform configurations broken on other platforms when tango is enabled - arm_scmi: device unregistration fix - iop32x: fix kernel oops from extraneous __init annotation - pxa: remove a double kfree - fsl qbman: close an interrupt clearing race The rest is the usual collection of smaller fixes for device tree files, on the renesas, allwinner, meson, omap, davinci, qualcomm and imx platforms. Some of these are for compile-time warnings, most are for board specific functionality that fails to work because of incorrect settings" * tag 'armsoc-fixes-5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (30 commits) ARM: tango: Improve ARCH_MULTIPLATFORM compatibility firmware: arm_scmi: provide the mandatory device release callback ARM: iop32x/n2100: fix PCI IRQ mapping arm64: dts: add msm8996 compatible to gicv3 ARM: dts: am335x-shc.dts: fix wrong cd pin level ARM: dts: n900: fix mmc1 card detect gpio polarity ARM: dts: omap3-gta04: Fix graph_port warning ARM: pxa: ssp: unneeded to free devm_ allocated data ARM: dts: r8a7743: Convert to new LVDS DT bindings soc: fsl: qbman: avoid race in clearing QMan interrupt arm64: dts: renesas: r8a77965: Enable DMA for SCIF2 arm64: dts: renesas: r8a7796: Enable DMA for SCIF2 arm64: dts: renesas: r8a774a1: Enable DMA for SCIF2 ARM: dts: da850: fix interrupt numbers for clocksource dt-bindings: imx8mq: Number clocks consecutively arm64: dts: meson: Fix mmc cd-gpios polarity ARM: dts: imx6sx: correct backward compatible of gpt ARM: dts: imx: replace gpio-key,wakeup with wakeup-source property ARM: dts: vf610-bk4: fix incorrect #address-cells for dspi3 ARM: dts: meson8m2: mxiii-plus: mark the SD card detection GPIO active-low ... commit 5bb513ed838c9eaae1704a3389eabc04e4cc0da5 Merge: 820828bffeb1 ea5736805190 Author: Linus Torvalds Date: Fri Feb 8 16:21:33 2019 -0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "Two arm64 fixes for -rc6. They resolve a kernel NULL dereference in kexec and bogus kernel page table dumping when userspace is configured for 52-bit virtual addressing. Summary: - Fix kernel oops when attemping kexec_file() with a NULL cmdline - Fix page table output in debugfs when ARM64_USER_VA_BITS_52=y" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: kexec_file: handle empty command-line arm64: ptdump: Don't iterate kernel page tables using PTRS_PER_PXX commit 820828bffeb11eee41e197a0c9be1b72afa37482 Merge: 6b2912cedc23 5a3840a470c4 Author: Linus Torvalds Date: Fri Feb 8 16:04:12 2019 -0800 Merge tag 'powerpc-5.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: "Just two fixes, both going to stable. - Our support for split pmd page table lock had a bug which could lead to a crash on mremap() when using the Radix MMU (Power9 only). - A fix for the PAPR SCM driver (nvdimm) we added last release, which had a bug where we might mis-handle a hypervisor response leading to us failing to attach the memory region. Thanks to: Aneesh Kumar K.V, Oliver O'Halloran" * tag 'powerpc-5.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/papr_scm: Use the correct bind address powerpc/radix: Fix kernel crash with mremap() commit 6b2912cedc238c984e6a4039836ed9c911121076 Merge: 3b6e8204a997 7146db3317c6 Author: Linus Torvalds Date: Fri Feb 8 15:39:28 2019 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace Pull signal fixes from Eric Biederman: "This contains four small fixes for signal handling. A missing range check, a regression fix, prioritizing signals we have already started a signal group exit for, and better detection of synchronous signals. The confused decision of which signals to handle failed spectacularly when a timer was pointed at SIGBUS and the stack overflowed. Resulting in an unkillable process in an infinite loop instead of a SIGSEGV and core dump" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: signal: Better detection of synchronous signals signal: Always notice exiting tasks signal: Always attempt to allocate siginfo for SIGSTOP signal: Make siginmask safe when passed a signal of 0 commit 3b6e8204a997510718949fd177f01da1860c738a Merge: 2e277fa08939 bb61b843ffd4 Author: Linus Torvalds Date: Fri Feb 8 15:37:17 2019 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "This is a set of five minor fixes (although, tecnhincally, the aicxxx fix is for a major problem in that the driver won't load without it, but I think the fact it's taken us since 4.10 to discover this indicates that the user base for these things has declined)" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: cxlflash: Prevent deadlock when adapter probe fails Revert "scsi: libfc: Add WARN_ON() when deleting rports" scsi: sd_zbc: Fix zone information messages scsi: target: make the pi_prot_format ConfigFS path readable scsi: aic94xx: fix module loading commit 2e277fa0893936bb4ab8432828f5d422a9ed0a7f Merge: 70be9ac2b64c 8950dcd83ae7 Author: Linus Torvalds Date: Fri Feb 8 15:34:10 2019 -0800 Merge tag 'iommu-fixes-v5.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull IOMMU fix from Joerg Roedel: "Intel decided to leave the newly added Scalable Mode Feature default-disabled for now. The patch here accomplishes that" * tag 'iommu-fixes-v5.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/vt-d: Leave scalable mode default off commit 70be9ac2b64c0d0db4f0e3004b764df33b1098e2 Merge: e2dac603d4bc f57a98e1b713 Author: Linus Torvalds Date: Fri Feb 8 15:32:10 2019 -0800 Merge tag 'pci-v5.0-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI fix from Bjorn Helgaas: "Work around Synopsys duplicate Device ID (HAPS USB3, NXP i.MX) that breaks PCIe on I.MX SoCs (Thinh Nguyen)" * tag 'pci-v5.0-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: PCI: Work around Synopsys duplicate Device ID (HAPS USB3, NXP i.MX) commit e2dac603d4bcb98c65d6f97848b72a217d0dd854 Merge: 27b4ad621e88 ce5cbf53496b Author: Linus Torvalds Date: Fri Feb 8 15:30:02 2019 -0800 Merge tag 'acpi-5.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "This prevents excessive ACPI debug messages from being printed to the kernel log, which has started to happen after one of the recent ACPICA commits (Erik Schmauss)" * tag 'acpi-5.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: Set debug output flags independent of ACPICA commit b5bfc21af5cb3d53f9cee0ef82eaa43762a90f81 Author: Russell King Date: Wed Feb 6 10:52:30 2019 +0000 net: sfp: do not probe SFP module before we're attached When we probe a SFP module, we expect to be able to call the upstream device's module_insert() function so that the upstream link can be configured. However, when the upstream device is delayed, we currently may end up probing the module before the upstream device is available, and lose the module_insert() call. Avoid this by holding off probing the module until the SFP bus is properly connected to both the SFP socket driver and the upstream driver. Signed-off-by: Russell King Signed-off-by: David S. Miller drivers/net/phy/sfp-bus.c | 2 ++ drivers/net/phy/sfp.c | 30 +++++++++++++++++++++--------- drivers/net/phy/sfp.h | 2 ++ 3 files changed, 25 insertions(+), 9 deletions(-) commit 13c80dda84c4c0c0f52f8dc2e8f083ca3ccc2aa0 Author: Andrew Lunn Date: Fri Feb 8 17:56:31 2019 +0100 MAINTAINERS: Update the ocores i2c bus driver maintainer, etc The listed maintainer has not been responding to emails for a while. Add myself as a second maintainer. Add the platform data include file, which was not listed. Signed-off-by: Andrew Lunn Signed-off-by: Wolfram Sang MAINTAINERS | 2 ++ 1 file changed, 2 insertions(+) commit 2698484178ca5cbfdde189b1d8809e1528f82a10 Author: Liu Bo Date: Fri Jan 25 08:12:49 2019 +0800 blk-mq: remove duplicated definition of blk_mq_freeze_queue As the prototype has been defined in "include/linux/blk-mq.h", the one in "block/blk-mq.h" can be removed then. Signed-off-by: Liu Bo Signed-off-by: Jens Axboe block/blk-mq.h | 1 - 1 file changed, 1 deletion(-) commit 391f552af213985d3d324c60004475759a7030c5 Author: Liu Bo Date: Fri Jan 25 08:12:48 2019 +0800 Blk-iolatency: warn on negative inflight IO counter This is to catch any unexpected negative value of inflight IO counter. Signed-off-by: Liu Bo Signed-off-by: Jens Axboe block/blk-iolatency.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 8c772a9bfc7c07c76f4a58b58910452fbb20843b Author: Liu Bo Date: Fri Jan 25 08:12:47 2019 +0800 blk-iolatency: fix IO hang due to negative inflight counter Our test reported the following stack, and vmcore showed that ->inflight counter is -1. [ffffc9003fcc38d0] __schedule at ffffffff8173d95d [ffffc9003fcc3958] schedule at ffffffff8173de26 [ffffc9003fcc3970] io_schedule at ffffffff810bb6b6 [ffffc9003fcc3988] blkcg_iolatency_throttle at ffffffff813911cb [ffffc9003fcc3a20] rq_qos_throttle at ffffffff813847f3 [ffffc9003fcc3a48] blk_mq_make_request at ffffffff8137468a [ffffc9003fcc3b08] generic_make_request at ffffffff81368b49 [ffffc9003fcc3b68] submit_bio at ffffffff81368d7d [ffffc9003fcc3bb8] ext4_io_submit at ffffffffa031be00 [ext4] [ffffc9003fcc3c00] ext4_writepages at ffffffffa03163de [ext4] [ffffc9003fcc3d68] do_writepages at ffffffff811c49ae [ffffc9003fcc3d78] __filemap_fdatawrite_range at ffffffff811b6188 [ffffc9003fcc3e30] filemap_write_and_wait_range at ffffffff811b6301 [ffffc9003fcc3e60] ext4_sync_file at ffffffffa030cee8 [ext4] [ffffc9003fcc3ea8] vfs_fsync_range at ffffffff8128594b [ffffc9003fcc3ee8] do_fsync at ffffffff81285abd [ffffc9003fcc3f18] sys_fsync at ffffffff81285d50 [ffffc9003fcc3f28] do_syscall_64 at ffffffff81003c04 [ffffc9003fcc3f50] entry_SYSCALL_64_after_swapgs at ffffffff81742b8e The ->inflight counter may be negative (-1) if 1) blk-iolatency was disabled when the IO was issued, 2) blk-iolatency was enabled before this IO reached its endio, 3) the ->inflight counter is decreased from 0 to -1 in endio() In fact the hang can be easily reproduced by the below script, H=/sys/fs/cgroup/unified/ P=/sys/fs/cgroup/unified/test echo "+io" > $H/cgroup.subtree_control mkdir -p $P echo $$ > $P/cgroup.procs xfs_io -f -d -c "pwrite 0 4k" /dev/sdg echo "`cat /sys/block/sdg/dev` target=1000000" > $P/io.latency xfs_io -f -d -c "pwrite 0 4k" /dev/sdg This fixes the problem by freezing the queue so that while enabling/disabling iolatency, there is no inflight rq running. Note that quiesce_queue is not needed as this only updating iolatency configuration about which dispatching request_queue doesn't care. Signed-off-by: Liu Bo Signed-off-by: Jens Axboe block/blk-iolatency.c | 52 ++++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 45 insertions(+), 7 deletions(-) commit 27b4ad621e887ce8e5eb508a0103f13d30f6b38a Merge: 680905431b9d 39841cc1cbb6 Author: Linus Torvalds Date: Fri Feb 8 11:21:54 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: "This pull request is dedicated to the upcoming snowpocalypse parts 2 and 3 in the Pacific Northwest: 1) Drop profiles are broken because some drivers use dev_kfree_skb* instead of dev_consume_skb*, from Yang Wei. 2) Fix IWLWIFI kconfig deps, from Luca Coelho. 3) Fix percpu maps updating in bpftool, from Paolo Abeni. 4) Missing station release in batman-adv, from Felix Fietkau. 5) Fix some networking compat ioctl bugs, from Johannes Berg. 6) ucc_geth must reset the BQL queue state when stopping the device, from Mathias Thore. 7) Several XDP bug fixes in virtio_net from Toshiaki Makita. 8) TSO packets must be sent always on queue 0 in stmmac, from Jose Abreu. 9) Fix socket refcounting bug in RDS, from Eric Dumazet. 10) Handle sparse cpu allocations in bpf selftests, from Martynas Pumputis. 11) Make sure mgmt frames have enough tailroom in mac80211, from Felix Feitkau. 12) Use safe list walking in sctp_sendmsg() asoc list traversal, from Greg Kroah-Hartman. 13) Make DCCP's ccid_hc_[rt]x_parse_options always check for NULL ccid, from Eric Dumazet. 14) Need to reload WoL password into bcmsysport device after deep sleeps, from Florian Fainelli. 15) Remove filter from mask before freeing in cls_flower, from Petr Machata. 16) Missing release and use after free in error paths of s390 qeth code, from Julian Wiedmann. 17) Fix lockdep false positive in dsa code, from Marc Zyngier. 18) Fix counting of ATU violations in mv88e6xxx, from Andrew Lunn. 19) Fix EQ firmware assert in qed driver, from Manish Chopra. 20) Don't default Caivum PTP to Y in kconfig, from Bjorn Helgaas" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (116 commits) net: dsa: b53: Fix for failure when irq is not defined in dt sit: check if IPv6 enabled before calling ip6_err_gen_icmpv6_unreach() geneve: should not call rt6_lookup() when ipv6 was disabled net: Don't default Cavium PTP driver to 'y' net: broadcom: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles net: via-velocity: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles net: tehuti: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles net: sun: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles net: fsl_ucc_hdlc: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles net: fec_mpc52xx: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles net: smsc: epic100: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles net: dscc4: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles net: tulip: de2104x: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles net: defxx: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles net/mlx5e: Don't overwrite pedit action when multiple pedit used net/mlx5e: Update hw flows when encap source mac changed qed*: Advance drivers version to 8.37.0.20 qed: Change verbosity for coalescing message. qede: Fix system crash on configuring channels. qed: Consider TX tcs while deriving the max num_queues for PF. ... commit 727962f030c23422a01e8b22d0f463815fb15ec4 Author: Nicholas Kazlauskas Date: Thu Jan 24 12:06:00 2019 -0500 drm/amd/display: Expose connector VRR range via debugfs [Why] It's useful to know the min and max vrr range for IGT testing. [How] Expose the min and max vfreq for the connector via a debugfs file on the connector, "vrr_range". Example usage: cat /sys/kernel/debug/dri/0/DP-1/vrr_range Signed-off-by: Nicholas Kazlauskas Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) commit 82abf33766712d8446ea137a3400165e31bd12c7 Author: Eric Anholt Date: Fri Dec 7 11:16:53 2018 -0800 drm/sched: Always trace the dependencies we wait on, to fix a race. The entity->dependency can go away completely once we've called drm_sched_entity_add_dependency_cb() (if the cb is called before we get around to tracing). The tracepoint is more useful if we trace every dependency instead of just ones that get callbacks installed, anyway, so just do that. Fixes any easy-to-produce OOPS when tracing the scheduler on V3D with "perf record -a -e gpu_scheduler:.\* glxgears" and DEBUG_SLAB enabled. Signed-off-by: Eric Anholt Reviewed-by: Christian König Cc: stable@vger.kernel.org Signed-off-by: Alex Deucher drivers/gpu/drm/scheduler/sched_entity.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) commit 680905431b9de8c7224b15b76b1826a1481cfeaf Merge: 8c8e62cc9839 4bf13fdbc356 Author: Linus Torvalds Date: Fri Feb 8 10:56:31 2019 -0800 Merge tag 'char-misc-5.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc fixes from Greg KH: "Here are some small char and misc driver fixes for 5.0-rc6. Nothing huge here, some more binderfs fixups found as people use it, and there is a "large" selftest added to validate the binderfs code, which makes up the majority of this pull request. There's also some small mei and mic fixes to resolve some reported issues. All of these have been in linux-next for over a week with no reported issues" * tag 'char-misc-5.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: mic: vop: Fix crash on remove mic: vop: Fix use-after-free on remove binderfs: remove separate device_initcall() fpga: stratix10-soc: fix wrong of_node_put() in init function mic: vop: Fix broken virtqueues mei: free read cb on ctrl_wr list flush samples: mei: use /dev/mei0 instead of /dev/mei mei: me: add ice lake point device id. binderfs: respect limit on binder control creation binder: fix CONFIG_ANDROID_BINDER_DEVICES selftests: add binderfs selftests commit 8c8e62cc983938a554d39497b5600b842f8a7965 Merge: e464f50c057a 36991ca68db9 Author: Linus Torvalds Date: Fri Feb 8 10:53:44 2019 -0800 Merge tag 'driver-core-5.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core fixes from Greg KH: "Here are some driver core fixes for 5.0-rc6. Well, not so much "driver core" as "debugfs". There's a lot of outstanding debugfs cleanup patches coming in through different subsystem trees, and in that process the debugfs core was found that it really should return errors when something bad happens, to prevent random files from showing up in the root of debugfs afterward. So debugfs was fixed up to handle this properly, and then two fixes for the relay and blk-mq code was needed as it was making invalid assumptions about debugfs return values. There's also a cacheinfo fix in here that resolves a tiny issue. All of these have been in linux-next for over a week with no reported problems" * tag 'driver-core-5.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: blk-mq: protect debugfs_create_files() from failures relay: check return of create_buf_file() properly debugfs: debugfs_lookup() should return NULL if not found debugfs: return error values, not NULL debugfs: fix debugfs_rename parameter checking cacheinfo: Keep the old value if of_property_read_u32 fails commit e464f50c057a1fbefae6c6078f9bd5511f84f199 Merge: e22a15d1c4b3 6d923f8fe821 Author: Linus Torvalds Date: Fri Feb 8 10:51:59 2019 -0800 Merge tag 'staging-5.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging/IIO driver fixes from Greg KH: "Here are some small iio and staging driver fixes for 5.0-rc6. Nothing big, just resolve some reported IIO driver issues, and one staging driver bug. One staging driver patch was added and then reverted as well. All of these have been in linux-next for a while with no reported issues" * tag 'staging-5.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: Revert "staging: erofs: keep corrupted fs from crashing kernel in erofs_namei()" staging: erofs: keep corrupted fs from crashing kernel in erofs_namei() staging: octeon: fix broken phylib usage iio: ti-ads8688: Update buffer allocation for timestamps tools: iio: iio_generic_buffer: make num_loops signed iio: adc: axp288: Fix TS-pin handling iio: chemical: atlas-ph-sensor: correct IIO_TEMP values to millicelsius commit e22a15d1c4b36877934ab360aace41ddf8a6577c Merge: 00a159a0007b fedb5760648a Author: Linus Torvalds Date: Fri Feb 8 10:49:55 2019 -0800 Merge tag 'tty-5.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial fixes from Greg KH: "Here are some small tty and serial fixes for 5.0-rc6. Nothing huge, just a few small fixes for reported issues. The speakup fix is in here as it is a tty operation issue. All of these have been in linux-next for a while with no reported problems" * tag 'tty-5.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial: fix race between flush_to_ldisc and tty_open staging: speakup: fix tty-operation NULL derefs serial: sh-sci: Do not free irqs that have already been freed serial: 8250_pci: Make PCI class test non fatal tty: serial: 8250_mtk: Fix potential NULL pointer dereference commit 00a159a0007b91fbce2a93e2666951c760ce6811 Merge: bd5ff862ec78 a07ddce4df80 Author: Linus Torvalds Date: Fri Feb 8 10:48:26 2019 -0800 Merge tag 'usb-5.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Grek KH: "Here are some small USB fixes for 5.0-rc6. Nothing huge, the normal amount of USB gadget fixes as well as some USB phy fixes. There's also a typec fix as well. Full details are in the shortlog. All of these have been in linux-next for a while with no reported issues" * tag 'usb-5.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: typec: tcpm: Correct the PPS out_volt calculation usb: gadget: musb: fix short isoc packets with inventra dma usb: phy: am335x: fix race condition in _probe usb: dwc3: exynos: Fix error handling of clk_prepare_enable usb: phy: fix link errors usb: gadget: udc: net2272: Fix bitwise and boolean operations usb: dwc3: gadget: Handle 0 xfer length for OUT EP commit bd5ff862ec7855cc7a110891443e7dc6deeb6b84 Merge: adcbc921d3df add46b3b0212 Author: Linus Torvalds Date: Fri Feb 8 10:46:14 2019 -0800 Merge tag 'xfs-5.0-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Darrick Wong: "Here are a handful of XFS fixes to fix a data corruption problem, a crasher bug, and a deadlock. Summary: - Fix cache coherency problem with writeback mappings - Fix buffer deadlock when shutting fs down - Fix a null pointer dereference when running online repair" * tag 'xfs-5.0-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: set buffer ops when repair probes for btree type xfs: end sync buffer I/O properly on shutdown error xfs: eof trim writeback mapping as soon as it is cached commit adcbc921d3dff0bf1657d4d31beee68f92f51538 Merge: 74e96711e337 dada163c5eab Author: Linus Torvalds Date: Fri Feb 8 10:43:15 2019 -0800 Merge tag 'drm-fixes-2019-02-08' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Missed fixes last week as had nothing until amdgpu showed up on Saturday. Other stuff has since rolled in along with some more amdgpu fixes, so we have two weeks of those, and some i915, vmwgfx, sun4i, rockchip and omap fixes. amdgpu/radeon: - fix crash on passthrough for SI - fencing fix for shared buffers - APU hwmon fix - API powerplay fix - eDP freesync fix - PASID mgr locking fix - KFD warning fix - DC/powerplay fix - raven revision ids fix - vega20 doorbell fix i915: - SNB display fix - SKL srckey mask fix - ICL DDI clock selection fix vmwgfx: - DMA API fix - IOMMU detection fix - display fixes sun4i: - tcon clock fix rockchip: - SPDX identifier fix omap: - DSI fixes" * tag 'drm-fixes-2019-02-08' of git://anongit.freedesktop.org/drm/drm: (28 commits) drm/omap: dsi: Hack-fix DSI bus flags drm/omap: dsi: Fix OF platform depopulate drm/omap: dsi: Fix crash in DSI debug dumps drm/i915: Try to sanitize bogus DPLL state left over by broken SNB BIOSen drm/amd/display: Attach VRR properties for eDP connectors drm/amdkfd: Fix if preprocessor statement above kfd_fill_iolink_info_for_cpu drm/amdgpu: use spin_lock_irqsave to protect vm_manager.pasid_idr drm/i915: always return something on DDI clock selection drm/i915: Fix skl srckey mask bits drm/vmwgfx: Improve on IOMMU detection drm/vmwgfx: Fix setting of dma masks drm/vmwgfx: Also check for crtc status while checking for DU active drm/vmwgfx: Fix an uninitialized fence handle value drm/vmwgfx: Return error code from vmw_execbuf_copy_fence_user drm/sun4i: tcon: Prepare and enable TCON channel 0 clock at init drm/amdgpu: fix the incorrect external id for raven series drm/amdgpu: Implement doorbell self-ring for NBIO 7.4 drm/amd/display: Fix fclk idle state drm/amdgpu: Transfer fences to dmabuf importer drm/amd/powerplay: Fix missing break in switch ... commit 9ab7d228e972b50d06ee28076ab5d0f93e862463 Author: Lukas Bulwahn Date: Sat Jan 12 10:07:23 2019 +0100 MAINTAINERS: unify reference to xen-devel list In the linux kernel MAINTAINERS file, largely "xen-devel@lists.xenproject.org (moderated for non-subscribers)" is used to refer to the xen-devel mailing list. The DRM DRIVERS FOR XEN section entry mentions xen-devel@lists.xen.org instead, but that is just the same mailing list as the mailing list above. Signed-off-by: Lukas Bulwahn Signed-off-by: Juergen Gross MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 00a399cad1a063e7665f06b6497a807db20441fd Author: Takashi Iwai Date: Wed Feb 6 07:30:44 2019 +0100 ALSA: pcm: Revert capture stream behavior change in blocking mode In the commit 62ba568f7aef ("ALSA: pcm: Return 0 when size < start_threshold in capture"), we changed the behavior of __snd_pcm_lib_xfer() to return immediately with 0 when a capture stream has a high start_threshold. This was intended to be a correction of the behavior consistency and looked harmless, but this was the culprit of the recent breakage reported by syzkaller, which was fixed by the commit e190161f96b8 ("ALSA: pcm: Fix tight loop of OSS capture stream"). At the time for the OSS fix, I didn't touch the behavior for ALSA native API, as assuming that this behavior actually is good. But this turned out to be also broken actually for a similar deployment, e.g. one thread goes to a write loop in blocking mode while another thread controls the start/stop of the stream manually. Overall, the original commit is harmful, and it brings less merit to keep that behavior. Let's revert it. Fixes: 62ba568f7aef ("ALSA: pcm: Return 0 when size < start_threshold in capture") Fixes: e190161f96b8 ("ALSA: pcm: Fix tight loop of OSS capture stream") Cc: Signed-off-by: Takashi Iwai sound/core/pcm_lib.c | 20 ++++---------------- 1 file changed, 4 insertions(+), 16 deletions(-) commit 0521e8be211cd20d547bff9da2534b7ed6f2c1b9 Author: Peter Zijlstra Date: Fri Feb 8 13:08:59 2019 +0100 x86/mm/cpa: Fix set_mce_nospec() The recent commit fe0937b24ff5 ("x86/mm/cpa: Fold cpa_flush_range() and cpa_flush_array() into a single cpa_flush() function") accidentally made the call to make_addr_canonical_again() go away, which breaks set_mce_nospec(). Re-instate the call to convert the address back into canonical form right before invoking either CLFLUSH or INVLPG. Rename the function while at it to be shorter (and less MAGA). Fixes: fe0937b24ff5 ("x86/mm/cpa: Fold cpa_flush_range() and cpa_flush_array() into a single cpa_flush() function") Reported-by: Tony Luck Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Tested-by: Tony Luck Cc: Linus Torvalds Cc: Dan Williams Cc: Dave Hansen Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Rik van Riel Link: https://lkml.kernel.org/r/20190208120859.GH32511@hirez.programming.kicks-ass.net arch/x86/mm/pageattr.c | 50 +++++++++++++++++++++++++------------------------- 1 file changed, 25 insertions(+), 25 deletions(-) commit 0a5cf9e88b5178d15f00f3cf35081841d80403cd Merge: 2bc16b9f3223 860b454c2c0c Author: Takashi Iwai Date: Fri Feb 8 14:07:18 2019 +0100 Merge tag 'asoc-fix-v5.0-rc5' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v5.0 A selection of driver specific fixes here, along with a few core fixes: - A fixup for some MFD devices that were broken by the previous fixes for deferred probe. - A fix for potential out of bounds array accesses when ordering DAPM power/up down sequences. - Avoid use after free issue when unloading and reloading drivers using topologies. commit 1a1fb985f2e2b85ec0d3dc2e519ee48389ec2434 Author: Thomas Gleixner Date: Tue Jan 29 23:15:12 2019 +0100 futex: Handle early deadlock return correctly commit 56222b212e8e ("futex: Drop hb->lock before enqueueing on the rtmutex") changed the locking rules in the futex code so that the hash bucket lock is not longer held while the waiter is enqueued into the rtmutex wait list. This made the lock and the unlock path symmetric, but unfortunately the possible early exit from __rt_mutex_proxy_start() due to a detected deadlock was not updated accordingly. That allows a concurrent unlocker to observe inconsitent state which triggers the warning in the unlock path. futex_lock_pi() futex_unlock_pi() lock(hb->lock) queue(hb_waiter) lock(hb->lock) lock(rtmutex->wait_lock) unlock(hb->lock) // acquired hb->lock hb_waiter = futex_top_waiter() lock(rtmutex->wait_lock) __rt_mutex_proxy_start() ---> fail remove(rtmutex_waiter); ---> returns -EDEADLOCK unlock(rtmutex->wait_lock) // acquired wait_lock wake_futex_pi() rt_mutex_next_owner() --> returns NULL --> WARN lock(hb->lock) unqueue(hb_waiter) The problem is caused by the remove(rtmutex_waiter) in the failure case of __rt_mutex_proxy_start() as this lets the unlocker observe a waiter in the hash bucket but no waiter on the rtmutex, i.e. inconsistent state. The original commit handles this correctly for the other early return cases (timeout, signal) by delaying the removal of the rtmutex waiter until the returning task reacquired the hash bucket lock. Treat the failure case of __rt_mutex_proxy_start() in the same way and let the existing cleanup code handle the eventual handover of the rtmutex gracefully. The regular rt_mutex_proxy_start() gains the rtmutex waiter removal for the failure case, so that the other callsites are still operating correctly. Add proper comments to the code so all these details are fully documented. Thanks to Peter for helping with the analysis and writing the really valuable code comments. Fixes: 56222b212e8e ("futex: Drop hb->lock before enqueueing on the rtmutex") Reported-by: Heiko Carstens Co-developed-by: Peter Zijlstra Signed-off-by: Peter Zijlstra Signed-off-by: Thomas Gleixner Tested-by: Heiko Carstens Cc: Martin Schwidefsky Cc: linux-s390@vger.kernel.org Cc: Stefan Liebler Cc: Sebastian Sewior Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/alpine.DEB.2.21.1901292311410.1950@nanos.tec.linutronix.de kernel/futex.c | 28 ++++++++++++++++++---------- kernel/locking/rtmutex.c | 37 ++++++++++++++++++++++++++++++++----- 2 files changed, 50 insertions(+), 15 deletions(-) commit 6f568ebe2afefdc33a6fb06ef20a94f8b96455f1 Author: Davidlohr Bueso Date: Wed Feb 6 10:56:02 2019 -0800 futex: Fix barrier comment The current comment for the barrier that guarantees that waiter increment is always before taking the hb spinlock (barrier (A)) needs to be fixed as it is misplaced. This is obviously referring to hb_waiters_inc, which is a full barrier. Reported-by: Peter Zijlstra Signed-off-by: Davidlohr Bueso Signed-off-by: Thomas Gleixner Link: https://lkml.kernel.org/r/20190206185602.949-1-dave@stgolabs.net kernel/futex.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit fa84667b98fd1a191b2465d66b440bda6714b3bf Author: René van Dorst Date: Wed Jan 30 17:10:49 2019 +0100 gpio: MT7621: use a per instance irq_chip structure This fixes the kernel complains: gpio gpiochip1: (1e000600.gpio-bank1): detected irqchip that is shared with multiple gpiochips: please fix the driver. gpio gpiochip2: (1e000600.gpio-bank2): detected irqchip that is shared with multiple gpiochips: please fix the driver. Fixes: 4ba9c3afda41 ("gpio: mt7621: Add a driver for MT7621") Cc: stable@vger.kernel.org Signed-off-by: René van Dorst Cc: linux-gpio@vger.kernel.org Cc: linux-mediatek@lists.infradead.org Tested-by: Greg Ungerer Signed-off-by: Linus Walleij drivers/gpio/gpio-mt7621.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) commit dcf6e2e38a1c7ccbc535de5e1d9b14998847499d Author: Zachary Hays Date: Thu Feb 7 10:03:08 2019 -0500 mmc: block: handle complete_work on separate workqueue The kblockd workqueue is created with the WQ_MEM_RECLAIM flag set. This generates a rescuer thread for that queue that will trigger when the CPU is under heavy load and collect the uncompleted work. In the case of mmc, this creates the possibility of a deadlock when there are multiple partitions on the device as other blk-mq work is also run on the same queue. For example: - worker 0 claims the mmc host to work on partition 1 - worker 1 attempts to claim the host for partition 2 but has to wait for worker 0 to finish - worker 0 schedules complete_work to release the host - rescuer thread is triggered after time-out and collects the dangling work - rescuer thread attempts to complete the work in order starting with claim host - the task to release host is now blocked by a task to claim it and will never be called The above results in multiple hung tasks that lead to failures to mount partitions. Handling complete_work on a separate workqueue avoids this by keeping the work completion tasks separate from the other blk-mq work. This allows the host to be released without getting blocked by other tasks attempting to claim the host. Signed-off-by: Zachary Hays Fixes: 81196976ed94 ("mmc: block: Add blk-mq support") Cc: Signed-off-by: Ulf Hansson drivers/mmc/core/block.c | 10 +++++++++- include/linux/mmc/card.h | 1 + 2 files changed, 10 insertions(+), 1 deletion(-) commit e8b22d0a329f0fb5c7ef95406872d268f01ee3b1 Author: Matti Kurkela Date: Thu Feb 7 23:49:23 2019 -0800 Input: elantech - enable 3rd button support on Fujitsu CELSIUS H780 Like Fujitsu CELSIUS H760, the H780 also has a three-button Elantech touchpad, but the driver needs to be told so to enable the middle touchpad button. The elantech_dmi_force_crc_enabled quirk was not necessary with the H780. Also document the fw_version and caps values detected for both H760 and H780 models. Signed-off-by: Matti Kurkela Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov drivers/input/mouse/elantech.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit 1358c13a48c43f5e4de0c1835291837a27b9720c Author: Gilad Ben-Yossef Date: Thu Feb 7 15:36:11 2019 +0200 crypto: ccree - fix resume race condition on init We were enabling autosuspend, which is using data set by the hash module, prior to the hash module being inited, casuing a crash on resume as part of the startup sequence if the race was lost. This was never a real problem because the PM infra was using low res timers so we were always winning the race, until commit 8234f6734c5d ("PM-runtime: Switch autosuspend over to using hrtimers") changed that :-) Fix this by seperating the PM setup and enablement and doing the latter only at the end of the init sequence. Signed-off-by: Gilad Ben-Yossef Cc: Vincent Guittot Cc: stable@kernel.org # v4.20 Signed-off-by: Herbert Xu drivers/crypto/ccree/cc_driver.c | 7 ++++--- drivers/crypto/ccree/cc_pm.c | 13 ++++++------- drivers/crypto/ccree/cc_pm.h | 3 +++ 3 files changed, 13 insertions(+), 10 deletions(-) commit 39841cc1cbb69344539c98a1fa9d858ed124c7ba Author: Arun Parameswaran Date: Thu Feb 7 16:01:18 2019 -0800 net: dsa: b53: Fix for failure when irq is not defined in dt Fixes the issues with non BCM58XX chips in the b53 driver failing, when the irq is not specified in the device tree. Removed the check for BCM58XX in b53_srab_prepare_irq(), so the 'port->irq' will be set to '-EXIO' if the irq is not specified in the device tree. Fixes: 16994374a6fc ("net: dsa: b53: Make SRAB driver manage port interrupts") Fixes: b2ddc48a81b5 ("net: dsa: b53: Do not fail when IRQ are not initialized") Signed-off-by: Arun Parameswaran Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/dsa/b53/b53_srab.c | 3 --- 1 file changed, 3 deletions(-) commit dada163c5eab43adf2c7595bc6d562748e1eb69e Merge: 151e3d6add61 6297388e1edd Author: Dave Airlie Date: Fri Feb 8 10:32:47 2019 +1000 Merge tag 'drm-misc-fixes-2019-02-07' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes drm-misc-fixes for v5.0-rc6: - Fixes to omap/dsi encoder. - Clock fix for sun4i. - Licensing header fix for rockchip. - Fix division by zero in the mode when trying to set a mode on i915 with GVT-g enabled. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/84462cef-609f-e2af-084a-f9fe2b05c53e@linux.intel.com commit 151e3d6add61729609587fbf88e4ac41c1d8f81b Merge: 78eb1ca47589 d028a646e84b Author: Dave Airlie Date: Fri Feb 8 10:30:29 2019 +1000 Merge tag 'drm-intel-fixes-2019-02-07-1' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v5.0-rc6: - SNB DPLL sanitize - ICL DDI clock selection - SLK srckey mask Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87lg2s6nur.fsf@intel.com commit 74e96711e3379fc66630f2a1d184947f80cf2c48 Merge: e303a067ceed 6a730fcb9cb4 Author: Linus Torvalds Date: Thu Feb 7 15:54:45 2019 -0700 Merge tag 'platform-drivers-x86-v5.0-2' of git://git.infradead.org/linux-platform-drivers-x86 Pull x86 platform driver fixlet from Darren Hart: "Correct Documentation/ABI 4.21 KernelVersion to 5.0" * tag 'platform-drivers-x86-v5.0-2' of git://git.infradead.org/linux-platform-drivers-x86: Documentation/ABI: Correct mlxreg-io KernelVersion for 5.0 commit e303a067ceede918fbf90ff3dc8affbb98bad4e8 Merge: ee6c0737a025 ecec76885bcf Author: Linus Torvalds Date: Thu Feb 7 15:53:26 2019 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM fixes from Paolo Bonzini: "Three security fixes" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221) KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222) kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974) commit ee6c0737a0253d6e79063f0a74c1101fdaad0812 Merge: 8b5cdbe595a0 e248aa7be86e Author: Linus Torvalds Date: Thu Feb 7 15:44:45 2019 -0700 Merge tag 'nfsd-5.0-1' of git://linux-nfs.org/~bfields/linux Pull nfsd fixes from Bruce Fields: "Two small nfsd bugfixes for 5.0, for an RDMA bug and a file clone bug" * tag 'nfsd-5.0-1' of git://linux-nfs.org/~bfields/linux: svcrdma: Remove max_sge check at connect time nfsd: Fix error return values for nfsd4_clone_file_range() commit 8b5cdbe595a05b8c767d9fe779bd47e997f934c9 Merge: d47e3da17592 fa8db4948f52 Author: Linus Torvalds Date: Thu Feb 7 15:42:43 2019 -0700 Merge tag 'for-5.0/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: "Both of these fixes address issues in changes merged for 5.0-rc4: - Fix DM core's missing memory barrier before waitqueue_active() calls. - Fix DM core's clone_bio() to work when cloning a subset of a bio with an integrity payload; bio_integrity_trim() wasn't getting called due to bio_trim()'s early return" * tag 'for-5.0/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm: don't use bio_trim() afterall dm: add memory barrier before waitqueue_active commit 8087f407364d50d5c3ac8e39365548351e2859f2 Merge: 37b144df8099 56841070ccc8 Author: Thomas Gleixner Date: Thu Feb 7 21:12:40 2019 +0100 Merge tag 'irqchip-5.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/urgent Pull irqchip updates from Marc Zyngier: - Another GICv3 ITS fix for devices sharing the same DevID - Don't return invalid data on exhaustion of the GICv3 LPI pool - Fix a GICv3 field decoding bug leading to memory over-allocation - Init GICv4 at boot time instead of lazy init - Fix interrupt masking on PJ4 commit 0803de78049fe1b0baf44bcddc727b036fb9139b Author: Jan Kara Date: Thu Feb 7 11:55:39 2019 +0100 blktrace: Show requests without sector Currently, blktrace will not show requests that don't have any data as rq->__sector is initialized to -1 which is out of device range and thus discarded by act_log_check(). This is most notably the case for cache flush requests sent to the device. Fix the problem by making blk_rq_trace_sector() return 0 for requests without initialized sector. Reviewed-by: Johannes Thumshirn Signed-off-by: Jan Kara Signed-off-by: Jens Axboe include/linux/blktrace_api.h | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 05dc6001af0630e200ad5ea08707187fe5537e6d Author: Vladimir Kondratiev Date: Wed Feb 6 13:46:17 2019 +0200 mips: cm: reprime error cause Accordingly to the documentation ---cut--- The GCR_ERROR_CAUSE.ERR_TYPE field and the GCR_ERROR_MULT.ERR_TYPE fields can be cleared by either a reset or by writing the current value of GCR_ERROR_CAUSE.ERR_TYPE to the GCR_ERROR_CAUSE.ERR_TYPE register. ---cut--- Do exactly this. Original value of cm_error may be safely written back; it clears error cause and keeps other bits untouched. Fixes: 3885c2b463f6 ("MIPS: CM: Add support for reporting CM cache errors") Signed-off-by: Vladimir Kondratiev Signed-off-by: Paul Burton Cc: Ralf Baechle Cc: James Hogan Cc: linux-mips@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org # v4.3+ arch/mips/kernel/mips-cm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8a96669d77897ff3613157bf43f875739205d66d Author: Yifeng Li Date: Wed Feb 6 15:07:21 2019 +0800 mips: loongson64: remove unreachable(), fix loongson_poweroff(). On my Yeeloong 8089, I noticed the machine fails to shutdown properly, and often, the function mach_prepare_reboot() is unexpectedly executed, thus the machine reboots instead. A wait loop is needed to ensure the system is in a well-defined state before going down. In commit 997e93d4df16 ("MIPS: Hang more efficiently on halt/powerdown/restart"), a general superset of the wait loop for all platforms is already provided, so we don't need to implement our own. This commit simply removes the unreachable() compiler marco after mach_prepare_reboot(), thus allowing the execution of machine_hang(). My test shows that the machine is now able to shutdown successfully. Please note that there are two different bugs preventing the machine from shutting down, another work-in-progress commit is needed to fix a lockup in cpufreq / i8259 driver, please read Reference, this commit does not fix that bug. Reference: https://lkml.org/lkml/2019/2/5/908 Signed-off-by: Yifeng Li Signed-off-by: Paul Burton Cc: linux-mips@vger.kernel.org Cc: Huacai Chen Cc: Ralf Baechle Cc: James Hogan Cc: linux-kernel@vger.kernel.org Cc: Aaro Koskinen Cc: stable@vger.kernel.org # v4.17+ arch/mips/loongson64/common/reset.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 2bc16b9f3223d049b57202ee702fcb5b9b507019 Author: Manuel Reinhardt Date: Thu Jan 31 15:32:35 2019 +0100 ALSA: usb-audio: Fix implicit fb endpoint setup by quirk The commit a60945fd08e4 ("ALSA: usb-audio: move implicit fb quirks to separate function") introduced an error in the handling of quirks for implicit feedback endpoints. This commit fixes this. If a quirk successfully sets up an implicit feedback endpoint, usb-audio no longer tries to find the implicit fb endpoint itself. Fixes: a60945fd08e4 ("ALSA: usb-audio: move implicit fb quirks to separate function") Signed-off-by: Manuel Reinhardt Cc: Signed-off-by: Takashi Iwai sound/usb/pcm.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit ec7fd009e87cf5459fe9aef1c9a6111e093e49cd Merge: e8c32c32b48c 173656accaf5 Author: David S. Miller Date: Thu Feb 7 10:48:42 2019 -0800 Merge branch 'ipv6-fixes' Hangbin Liu says: ==================== fix two kernel panics when disabled IPv6 on boot up When disabled IPv6 on boot up, since there is no ipv6 route tables, we should not call rt6_lookup. Fix them by checking if we have inet6_dev pointer on netdevice. v2: Fix idev reference leak, declarations and code mixing as Stefano, Eric pointed. Since we only want to check if idev exists and not reference it, use __in6_dev_get() insteand of in6_dev_get(). ==================== Signed-off-by: David S. Miller commit 173656accaf583698bac3f9e269884ba60d51ef4 Author: Hangbin Liu Date: Thu Feb 7 18:36:11 2019 +0800 sit: check if IPv6 enabled before calling ip6_err_gen_icmpv6_unreach() If we disabled IPv6 from the kernel command line (ipv6.disable=1), we should not call ip6_err_gen_icmpv6_unreach(). This: ip link add sit1 type sit local 192.0.2.1 remote 192.0.2.2 ttl 1 ip link set sit1 up ip addr add 198.51.100.1/24 dev sit1 ping 198.51.100.2 if IPv6 is disabled at boot time, will crash the kernel. v2: there's no need to use in6_dev_get(), use __in6_dev_get() instead, as we only need to check that idev exists and we are under rcu_read_lock() (from netif_receive_skb_internal()). Reported-by: Jianlin Shi Fixes: ca15a078bd90 ("sit: generate icmpv6 error when receiving icmpv4 error") Cc: Oussama Ghorbel Signed-off-by: Hangbin Liu Reviewed-by: Stefano Brivio Signed-off-by: David S. Miller net/ipv6/sit.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit c0a47e44c0980b3b23ee31fa7936d70ea5dce491 Author: Hangbin Liu Date: Thu Feb 7 18:36:10 2019 +0800 geneve: should not call rt6_lookup() when ipv6 was disabled When we add a new GENEVE device with IPv6 remote, checking only for IS_ENABLED(CONFIG_IPV6) is not enough as we may disable IPv6 in the kernel command line (ipv6.disable=1), and calling rt6_lookup() would cause a NULL pointer dereference. v2: - don't mix declarations and code (reported by Stefano Brivio, Eric Dumazet) - there's no need to use in6_dev_get() as we only need to check that idev exists (reported by David Ahern). This is under RTNL, so we can simply use __in6_dev_get() instead (Stefano, Eric). Reported-by: Jianlin Shi Fixes: c40e89fd358e9 ("geneve: configure MTU based on a lower device") Cc: Alexey Kodanev Signed-off-by: Hangbin Liu Reviewed-by: Stefano Brivio Signed-off-by: David S. Miller drivers/net/geneve.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) commit ecec76885bcfe3294685dc363fd1273df0d5d65f Author: Peter Shier Date: Thu Oct 11 11:46:46 2018 -0700 KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221) Bugzilla: 1671904 There are multiple code paths where an hrtimer may have been started to emulate an L1 VMX preemption timer that can result in a call to free_nested without an intervening L2 exit where the hrtimer is normally cancelled. Unconditionally cancel in free_nested to cover all cases. Embargoed until Feb 7th 2019. Signed-off-by: Peter Shier Reported-by: Jim Mattson Reviewed-by: Jim Mattson Reported-by: Felix Wilhelm Cc: stable@kernel.org Message-Id: <20181011184646.154065-1-pshier@google.com> Signed-off-by: Paolo Bonzini arch/x86/kvm/vmx/nested.c | 1 + 1 file changed, 1 insertion(+) commit 353c0956a618a07ba4bbe7ad00ff29fe70e8412a Author: Paolo Bonzini Date: Tue Jan 29 18:41:16 2019 +0100 KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222) Bugzilla: 1671930 Emulation of certain instructions (VMXON, VMCLEAR, VMPTRLD, VMWRITE with memory operand, INVEPT, INVVPID) can incorrectly inject a page fault when passed an operand that points to an MMIO address. The page fault will use uninitialized kernel stack memory as the CR2 and error code. The right behavior would be to abort the VM with a KVM_EXIT_INTERNAL_ERROR exit to userspace; however, it is not an easy fix, so for now just ensure that the error code and CR2 are zero. Embargoed until Feb 7th 2019. Reported-by: Felix Wilhelm Cc: stable@kernel.org Signed-off-by: Paolo Bonzini arch/x86/kvm/x86.c | 7 +++++++ 1 file changed, 7 insertions(+) commit cfa39381173d5f969daf43582c95ad679189cbc9 Author: Jann Horn Date: Sat Jan 26 01:54:33 2019 +0100 kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974) kvm_ioctl_create_device() does the following: 1. creates a device that holds a reference to the VM object (with a borrowed reference, the VM's refcount has not been bumped yet) 2. initializes the device 3. transfers the reference to the device to the caller's file descriptor table 4. calls kvm_get_kvm() to turn the borrowed reference to the VM into a real reference The ownership transfer in step 3 must not happen before the reference to the VM becomes a proper, non-borrowed reference, which only happens in step 4. After step 3, an attacker can close the file descriptor and drop the borrowed reference, which can cause the refcount of the kvm object to drop to zero. This means that we need to grab a reference for the device before anon_inode_getfd(), otherwise the VM can disappear from under us. Fixes: 852b6d57dc7f ("kvm: add device control API") Cc: stable@kernel.org Signed-off-by: Jann Horn Signed-off-by: Paolo Bonzini virt/kvm/kvm_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 4cd3016ce996494f78fdfd87ea35c8ca5d0b413e Author: Jurica Vukadin Date: Thu Feb 7 16:29:37 2019 +0100 ALSA: hda - Add quirk for HP EliteBook 840 G5 This enables mute LED support and fixes switching jacks when the laptop is docked. Signed-off-by: Jurica Vukadin Cc: Signed-off-by: Takashi Iwai sound/pci/hda/patch_conexant.c | 1 + 1 file changed, 1 insertion(+) commit d04ca383860bef90a0dab4eb397907f7f05e839e Author: Stanislaw Gruszka Date: Wed Feb 6 15:34:16 2019 +0100 mt76x0u: fix suspend/resume We need to reset MCU and do other initializations on resume otherwise MT7610U device will fail to initialize, what cause system hung due to USB requests timeouts. Patch fixes 4.19 -> 4.20 regression. Cc: stable@vger.kernel.org # 4.20+ Signed-off-by: Stanislaw Gruszka Acked-by: Lorenzo Bianconi Signed-off-by: Kalle Valo drivers/net/wireless/mediatek/mt76/mt76x0/usb.c | 46 ++++++++++++++++--------- 1 file changed, 29 insertions(+), 17 deletions(-) commit 50d6b3cf9403879911e06d69c7ef41e43f8f7b4b Author: Russell King Date: Wed Dec 12 11:49:47 2018 +0000 ARM: OMAP2+: fix lack of timer interrupts on CPU1 after hotplug If we have a kernel configured for periodic timer interrupts, and we have cpuidle enabled, then we end up with CPU1 losing timer interupts after a hotplug. This can manifest itself in RCU stall warnings, or userspace becoming unresponsive. The problem is that the kernel initially wants to use the TWD timer for interrupts, but the TWD loses context when we enter the C3 cpuidle state. Nothing reprograms the TWD after idle. We have solved this in the past by switching to broadcast timer ticks, and cpuidle44xx switches to that mode at boot time. However, there is nothing to switch from periodic mode local timers after a hotplug operation. We call tick_broadcast_enter() in omap_enter_idle_coupled(), which one would expect would take care of the issue, but internally this only deals with one-shot local timers - tick_broadcast_enable() on the other hand only deals with periodic local timers. So, we need to call both. Signed-off-by: Russell King [tony@atomide.com: just standardized the subject line] Signed-off-by: Tony Lindgren arch/arm/mach-omap2/cpuidle44xx.c | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) commit 7146db3317c67b517258cb5e1b08af387da0618b Author: Eric W. Biederman Date: Wed Feb 6 17:51:47 2019 -0600 signal: Better detection of synchronous signals Recently syzkaller was able to create unkillablle processes by creating a timer that is delivered as a thread local signal on SIGHUP, and receiving SIGHUP SA_NODEFERER. Ultimately causing a loop failing to deliver SIGHUP but always trying. When the stack overflows delivery of SIGHUP fails and force_sigsegv is called. Unfortunately because SIGSEGV is numerically higher than SIGHUP next_signal tries again to deliver a SIGHUP. From a quality of implementation standpoint attempting to deliver the timer SIGHUP signal is wrong. We should attempt to deliver the synchronous SIGSEGV signal we just forced. We can make that happening in a fairly straight forward manner by instead of just looking at the signal number we also look at the si_code. In particular for exceptions (aka synchronous signals) the si_code is always greater than 0. That still has the potential to pick up a number of asynchronous signals as in a few cases the same si_codes that are used for synchronous signals are also used for asynchronous signals, and SI_KERNEL is also included in the list of possible si_codes. Still the heuristic is much better and timer signals are definitely excluded. Which is enough to prevent all known ways for someone sending a process signals fast enough to cause unexpected and arguably incorrect behavior. Cc: stable@vger.kernel.org Fixes: a27341cd5fcb ("Prioritize synchronous signals over 'normal' signals") Tested-by: Dmitry Vyukov Reported-by: Dmitry Vyukov Signed-off-by: "Eric W. Biederman" kernel/signal.c | 52 +++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 51 insertions(+), 1 deletion(-) commit 35634ffa1751b6efd8cf75010b509dcb0263e29b Author: Eric W. Biederman Date: Wed Feb 6 18:39:40 2019 -0600 signal: Always notice exiting tasks Recently syzkaller was able to create unkillablle processes by creating a timer that is delivered as a thread local signal on SIGHUP, and receiving SIGHUP SA_NODEFERER. Ultimately causing a loop failing to deliver SIGHUP but always trying. Upon examination it turns out part of the problem is actually most of the solution. Since 2.5 signal delivery has found all fatal signals, marked the signal group for death, and queued SIGKILL in every threads thread queue relying on signal->group_exit_code to preserve the information of which was the actual fatal signal. The conversion of all fatal signals to SIGKILL results in the synchronous signal heuristic in next_signal kicking in and preferring SIGHUP to SIGKILL. Which is especially problematic as all fatal signals have already been transformed into SIGKILL. Instead of dequeueing signals and depending upon SIGKILL to be the first signal dequeued, first test if the signal group has already been marked for death. This guarantees that nothing in the signal queue can prevent a process that needs to exit from exiting. Cc: stable@vger.kernel.org Tested-by: Dmitry Vyukov Reported-by: Dmitry Vyukov Ref: ebf5ebe31d2c ("[PATCH] signal-fixes-2.5.59-A4") History Tree: https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git Signed-off-by: "Eric W. Biederman" kernel/signal.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 860b454c2c0cbda6892954f5cdbbb48931b3c8db Author: Sylwester Nawrocki Date: Thu Feb 7 15:20:41 2019 +0100 ASoC: samsung: Prevent clk_get_rate() calls in atomic context This patch moves clk_get_rate() call from trigger() to hw_params() callback to avoid calling sleeping clk API from atomic context and prevent deadlock as indicated below. Before this change clk_get_rate() was being called with same spinlock held as the one passed to the clk API when registering clocks exposed by the I2S driver. [ 82.109780] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:908 [ 82.117009] in_atomic(): 1, irqs_disabled(): 128, pid: 1554, name: speaker-test [ 82.124235] 3 locks held by speaker-test/1554: [ 82.128653] #0: cc8c5328 (snd_pcm_link_rwlock){...-}, at: snd_pcm_stream_lock_irq+0x20/0x38 [ 82.137058] #1: ec9eda17 (&(&substream->self_group.lock)->rlock){..-.}, at: snd_pcm_ioctl+0x900/0x1268 [ 82.146417] #2: 6ac279bf (&(&pri_dai->spinlock)->rlock){..-.}, at: i2s_trigger+0x64/0x6d4 [ 82.154650] irq event stamp: 8144 [ 82.157949] hardirqs last enabled at (8143): [] _raw_read_unlock_irq+0x24/0x5c [ 82.166089] hardirqs last disabled at (8144): [] _raw_read_lock_irq+0x18/0x58 [ 82.174063] softirqs last enabled at (8004): [] __do_softirq+0x3a4/0x66c [ 82.181688] softirqs last disabled at (7997): [] irq_exit+0x140/0x168 [ 82.188964] Preemption disabled at: [ 82.188967] [<00000000>] (null) [ 82.195728] CPU: 6 PID: 1554 Comm: speaker-test Not tainted 5.0.0-rc5-00192-ga6e6caca8f03 #191 [ 82.204302] Hardware name: SAMSUNG EXYNOS (Flattened Device Tree) [ 82.210376] [] (unwind_backtrace) from [] (show_stack+0x10/0x14) [ 82.218084] [] (show_stack) from [] (dump_stack+0x90/0xc8) [ 82.225278] [] (dump_stack) from [] (___might_sleep+0x22c/0x2c8) [ 82.232990] [] (___might_sleep) from [] (__mutex_lock+0x28/0xa3c) [ 82.240788] [] (__mutex_lock) from [] (mutex_lock_nested+0x1c/0x24) [ 82.248763] [] (mutex_lock_nested) from [] (clk_prepare_lock+0x78/0xec) [ 82.257079] [] (clk_prepare_lock) from [] (clk_core_get_rate+0xc/0x5c) [ 82.265309] [] (clk_core_get_rate) from [] (i2s_trigger+0x490/0x6d4) [ 82.273369] [] (i2s_trigger) from [] (soc_pcm_trigger+0x100/0x140) [ 82.281254] [] (soc_pcm_trigger) from [] (snd_pcm_do_start+0x2c/0x30) [ 82.289400] [] (snd_pcm_do_start) from [] (snd_pcm_action_single+0x38/0x78) [ 82.298065] [] (snd_pcm_action_single) from [] (snd_pcm_ioctl+0x910/0x1268) [ 82.306734] [] (snd_pcm_ioctl) from [] (do_vfs_ioctl+0x90/0x9ec) [ 82.314443] [] (do_vfs_ioctl) from [] (ksys_ioctl+0x34/0x60) [ 82.321808] [] (ksys_ioctl) from [] (ret_fast_syscall+0x0/0x28) [ 82.329431] Exception stack(0xeb875fa8 to 0xeb875ff0) [ 82.334459] 5fa0: 00033c18 b6e31000 00000004 00004142 00033d80 00033d80 [ 82.342605] 5fc0: 00033c18 b6e31000 00008000 00000036 00008000 00000000 beea38a8 00008000 [ 82.350748] 5fe0: b6e3142c beea384c b6da9a30 b6c9212c [ 82.355789] [ 82.357245] ====================================================== [ 82.363397] WARNING: possible circular locking dependency detected [ 82.369551] 5.0.0-rc5-00192-ga6e6caca8f03 #191 Tainted: G W [ 82.376395] ------------------------------------------------------ [ 82.382548] speaker-test/1554 is trying to acquire lock: [ 82.387834] 6d2007f4 (prepare_lock){+.+.}, at: clk_prepare_lock+0x78/0xec [ 82.394593] [ 82.394593] but task is already holding lock: [ 82.400398] 6ac279bf (&(&pri_dai->spinlock)->rlock){..-.}, at: i2s_trigger+0x64/0x6d4 [ 82.408197] [ 82.408197] which lock already depends on the new lock. [ 82.416343] [ 82.416343] the existing dependency chain (in reverse order) is: [ 82.423795] [ 82.423795] -> #1 (&(&pri_dai->spinlock)->rlock){..-.}: [ 82.430472] clk_mux_set_parent+0x34/0xb8 [ 82.434975] clk_core_set_parent_nolock+0x1c4/0x52c [ 82.440347] clk_set_parent+0x38/0x6c [ 82.444509] of_clk_set_defaults+0xc8/0x308 [ 82.449186] of_clk_add_provider+0x84/0xd0 [ 82.453779] samsung_i2s_probe+0x408/0x5f8 [ 82.458376] platform_drv_probe+0x48/0x98 [ 82.462879] really_probe+0x224/0x3f4 [ 82.467037] driver_probe_device+0x70/0x1c4 [ 82.471716] bus_for_each_drv+0x44/0x8c [ 82.476049] __device_attach+0xa0/0x138 [ 82.480382] bus_probe_device+0x88/0x90 [ 82.484715] deferred_probe_work_func+0x6c/0xbc [ 82.489741] process_one_work+0x200/0x740 [ 82.494246] worker_thread+0x2c/0x4c8 [ 82.498408] kthread+0x128/0x164 [ 82.502131] ret_from_fork+0x14/0x20 [ 82.506204] (null) [ 82.508976] [ 82.508976] -> #0 (prepare_lock){+.+.}: [ 82.514264] __mutex_lock+0x60/0xa3c [ 82.518336] mutex_lock_nested+0x1c/0x24 [ 82.522756] clk_prepare_lock+0x78/0xec [ 82.527088] clk_core_get_rate+0xc/0x5c [ 82.531421] i2s_trigger+0x490/0x6d4 [ 82.535494] soc_pcm_trigger+0x100/0x140 [ 82.539913] snd_pcm_do_start+0x2c/0x30 [ 82.544246] snd_pcm_action_single+0x38/0x78 [ 82.549012] snd_pcm_ioctl+0x910/0x1268 [ 82.553345] do_vfs_ioctl+0x90/0x9ec [ 82.557417] ksys_ioctl+0x34/0x60 [ 82.561229] ret_fast_syscall+0x0/0x28 [ 82.565477] 0xbeea384c [ 82.568421] [ 82.568421] other info that might help us debug this: [ 82.568421] [ 82.576394] Possible unsafe locking scenario: [ 82.576394] [ 82.582285] CPU0 CPU1 [ 82.586792] ---- ---- [ 82.591297] lock(&(&pri_dai->spinlock)->rlock); [ 82.595977] lock(prepare_lock); [ 82.601782] lock(&(&pri_dai->spinlock)->rlock); [ 82.608975] lock(prepare_lock); [ 82.612268] [ 82.612268] *** DEADLOCK *** Fixes: 647d04f8e07a ("ASoC: samsung: i2s: Ensure the RCLK rate is properly determined") Reported-by: Krzysztof Kozłowski Signed-off-by: Sylwester Nawrocki Signed-off-by: Mark Brown sound/soc/samsung/i2s.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 76379dfbfd7c8fd7dd29eea3f828cf85c884829e Author: Jiada Wang Date: Mon Feb 4 22:41:05 2019 +0900 ASoC: rsnd: ssiu: correct shift bit for ssiu9 Currently "0xf << 36" is used to clear SSIU-9 internal buffer state, which overflows 32-bit value according to user reference manual, it is always bit4 ~ bit7 of SSI_SYS_STATUS[1,3,5,7] registers indicate SSIU-9's buffer state, so "0xf << 4" should be used. This patch fix incorrect shifting issue in SSIU-9 case Fixes: commit b7169ddea2f2 ("ASoC: rsnd: remove RSND_REG_ from rsnd_reg") Signed-off-by: Jiada Wang Acked-by: Kuninori Morimoto Signed-off-by: Mark Brown sound/soc/sh/rcar/ssiu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d47e3da1759230e394096fd742aad423c291ba48 Merge: 6f64e3a4de74 13054abbaa4f Author: Linus Torvalds Date: Thu Feb 7 11:51:31 2019 +0000 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fix from Jiri Kosina: "A fix for a bug in hid-debug that can lock up the kernel in infinite loop (CVE-2019-3819), from Vladis Dronov" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: debug: fix the ring buffer implementation commit 7d82602909ed9c73b34ad26f05d10db4850a4f8c Author: James Morse Date: Thu Jan 24 16:32:54 2019 +0000 KVM: arm64: Forbid kprobing of the VHE world-switch code On systems with VHE the kernel and KVM's world-switch code run at the same exception level. Code that is only used on a VHE system does not need to be annotated as __hyp_text as it can reside anywhere in the kernel text. __hyp_text was also used to prevent kprobes from patching breakpoint instructions into this region, as this code runs at a different exception level. While this is no longer true with VHE, KVM still switches VBAR_EL1, meaning a kprobe's breakpoint executed in the world-switch code will cause a hyp-panic. echo "p:weasel sysreg_save_guest_state_vhe" > /sys/kernel/debug/tracing/kprobe_events echo 1 > /sys/kernel/debug/tracing/events/kprobes/weasel/enable lkvm run -k /boot/Image --console serial -p "console=ttyS0 earlycon=uart,mmio,0x3f8" # lkvm run -k /boot/Image -m 384 -c 3 --name guest-1474 Info: Placing fdt at 0x8fe00000 - 0x8fffffff Info: virtio-mmio.devices=0x200@0x10000:36 Info: virtio-mmio.devices=0x200@0x10200:37 Info: virtio-mmio.devices=0x200@0x10400:38 [ 614.178186] Kernel panic - not syncing: HYP panic: [ 614.178186] PS:404003c9 PC:ffff0000100d70e0 ESR:f2000004 [ 614.178186] FAR:0000000080080000 HPFAR:0000000000800800 PAR:1d00007edbadc0de [ 614.178186] VCPU:00000000f8de32f1 [ 614.178383] CPU: 2 PID: 1482 Comm: kvm-vcpu-0 Not tainted 5.0.0-rc2 #10799 [ 614.178446] Call trace: [ 614.178480] dump_backtrace+0x0/0x148 [ 614.178567] show_stack+0x24/0x30 [ 614.178658] dump_stack+0x90/0xb4 [ 614.178710] panic+0x13c/0x2d8 [ 614.178793] hyp_panic+0xac/0xd8 [ 614.178880] kvm_vcpu_run_vhe+0x9c/0xe0 [ 614.178958] kvm_arch_vcpu_ioctl_run+0x454/0x798 [ 614.179038] kvm_vcpu_ioctl+0x360/0x898 [ 614.179087] do_vfs_ioctl+0xc4/0x858 [ 614.179174] ksys_ioctl+0x84/0xb8 [ 614.179261] __arm64_sys_ioctl+0x28/0x38 [ 614.179348] el0_svc_common+0x94/0x108 [ 614.179401] el0_svc_handler+0x38/0x78 [ 614.179487] el0_svc+0x8/0xc [ 614.179558] SMP: stopping secondary CPUs [ 614.179661] Kernel Offset: disabled [ 614.179695] CPU features: 0x003,2a80aa38 [ 614.179758] Memory Limit: none [ 614.179858] ---[ end Kernel panic - not syncing: HYP panic: [ 614.179858] PS:404003c9 PC:ffff0000100d70e0 ESR:f2000004 [ 614.179858] FAR:0000000080080000 HPFAR:0000000000800800 PAR:1d00007edbadc0de [ 614.179858] VCPU:00000000f8de32f1 ]--- Annotate the VHE world-switch functions that aren't marked __hyp_text using NOKPROBE_SYMBOL(). Signed-off-by: James Morse Fixes: 3f5c90b890ac ("KVM: arm64: Introduce VHE-specific kvm_vcpu_run") Acked-by: Masami Hiramatsu Signed-off-by: Marc Zyngier arch/arm64/kvm/hyp/switch.c | 5 +++++ arch/arm64/kvm/hyp/sysreg-sr.c | 5 +++++ 2 files changed, 10 insertions(+) commit 280cebfd05c8e381a392c662006dfaa6377feefc Author: Suzuki K Poulose Date: Tue Jan 29 19:12:17 2019 +0000 KVM: arm64: Relax the restriction on using stage2 PUD huge mapping We restrict mapping the PUD huge pages in stage2 to only when the stage2 has 4 level page table, leaving the feature unused with the default IPA size. But we could use it even with a 3 level page table, i.e, when the PUD level is folded into PGD, just like the stage1. Relax the condition to allow using the PUD huge page mappings at stage2 when it is possible. Cc: Christoffer Dall Reviewed-by: Marc Zyngier Signed-off-by: Suzuki K Poulose Signed-off-by: Marc Zyngier virt/kvm/arm/mmu.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 309a205688060fbb000e9402078cf53cebde0793 Author: Marc Zyngier Date: Sat Feb 2 12:14:03 2019 +0000 arm: KVM: Add missing kvm_stage2_has_pmd() helper Fixup 32bit by providing the now required helper. Cc: Suzuki Poulose Signed-off-by: Marc Zyngier arch/arm/include/asm/stage2_pgtable.h | 5 +++++ 1 file changed, 5 insertions(+) commit ab2d5eb03dbb7b37a1c6356686fb48626ab0c93e Author: Christoffer Dall Date: Thu Jan 10 15:33:52 2019 +0100 KVM: arm/arm64: vgic: Always initialize the group of private IRQs We currently initialize the group of private IRQs during kvm_vgic_vcpu_init, and the value of the group depends on the GIC model we are emulating. However, CPUs created before creating (and initializing) the VGIC might end up with the wrong group if the VGIC is created as GICv3 later. Since we have no enforced ordering of creating the VGIC and creating VCPUs, we can end up with part the VCPUs being properly intialized and the remaining incorrectly initialized. That also means that we have no single place to do the per-cpu data structure initialization which depends on knowing the emulated GIC model (which is only the group field). This patch removes the incorrect comment from kvm_vgic_vcpu_init and initializes the group of all previously created VCPUs's private interrupts in vgic_init in addition to the existing initialization in kvm_vgic_vcpu_init. Signed-off-by: Christoffer Dall Signed-off-by: Marc Zyngier virt/kvm/arm/vgic/vgic-init.c | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) commit 20589c8cc47dce5854c8bf1b44a9fc63d798d26d Author: Marc Zyngier Date: Thu Dec 20 13:07:40 2018 +0000 arm/arm64: KVM: Don't panic on failure to properly reset system registers Failing to properly reset system registers is pretty bad. But not quite as bad as bringing the whole machine down... So warn loudly, but slightly more gracefully. Signed-off-by: Marc Zyngier Acked-by: Christoffer Dall arch/arm/kvm/coproc.c | 4 ++-- arch/arm64/kvm/sys_regs.c | 8 +++++--- 2 files changed, 7 insertions(+), 5 deletions(-) commit 358b28f09f0ab074d781df72b8a671edb1547789 Author: Marc Zyngier Date: Thu Dec 20 11:36:07 2018 +0000 arm/arm64: KVM: Allow a VCPU to fully reset itself The current kvm_psci_vcpu_on implementation will directly try to manipulate the state of the VCPU to reset it. However, since this is not done on the thread that runs the VCPU, we can end up in a strangely corrupted state when the source and target VCPUs are running at the same time. Fix this by factoring out all reset logic from the PSCI implementation and forwarding the required information along with a request to the target VCPU. Reviewed-by: Andrew Jones Signed-off-by: Marc Zyngier Signed-off-by: Christoffer Dall arch/arm/include/asm/kvm_host.h | 10 ++++++++++ arch/arm/kvm/reset.c | 24 ++++++++++++++++++++++++ arch/arm64/include/asm/kvm_host.h | 11 +++++++++++ arch/arm64/kvm/reset.c | 24 ++++++++++++++++++++++++ virt/kvm/arm/arm.c | 10 ++++++++++ virt/kvm/arm/psci.c | 36 ++++++++++++++++-------------------- 6 files changed, 95 insertions(+), 20 deletions(-) commit e761a927bc9a7ee6ceb7c4f63d5922dbced87f0d Author: Christoffer Dall Date: Thu Dec 20 12:44:05 2018 +0100 KVM: arm/arm64: Reset the VCPU without preemption and vcpu state loaded We have two ways to reset a vcpu: - either through VCPU_INIT - or through a PSCI_ON call The first one is easy to reason about. The second one is implemented in a more bizarre way, as it is the vcpu that handles PSCI_ON that resets the vcpu that is being powered-on. As we need to turn the logic around and have the target vcpu to reset itself, we must take some preliminary steps. Resetting the VCPU state modifies the system register state in memory, but this may interact with vcpu_load/vcpu_put if running with preemption disabled, which in turn may lead to corrupted system register state. Address this by disabling preemption and doing put/load if required around the reset logic. Reviewed-by: Andrew Jones Signed-off-by: Christoffer Dall Signed-off-by: Marc Zyngier arch/arm64/kvm/reset.c | 26 ++++++++++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-) commit ce5cbf53496bfebe1b7478a532820373342e8302 Author: Erik Schmauss Date: Tue Feb 5 16:14:00 2019 -0800 ACPI: Set debug output flags independent of ACPICA There was a divergence between Linux and ACPICA on the definition of ACPI_DEBUG_DEFAULT. This divergence was solved by taking ACPICA's definition in 4c1379d7bb42. After resolving the divergence, it was clear that Linux users wanted to use their old set of debug flags. This change fixes the divergence by setting these debug flags during acpi_early_init() rather than during global variable initialization in acpixf.h (owned by ACPICA). Fixes: 4c1379d7bb42 ("ACPICA: Debug output: Add option to display method/object evaluation") Reported-by: Michael J Ruhl Reported-by: Alex Gagniuc Signed-off-by: Erik Schmauss Signed-off-by: Rafael J. Wysocki drivers/acpi/bus.c | 3 +++ 1 file changed, 3 insertions(+) commit 614db26954ff08fa8e92b04100e31ebc04b817cf Author: Sebastian Ott Date: Tue Jan 29 15:15:18 2019 +0100 Revert "s390/pci: remove bit_lock usage in interrupt handler" This reverts commit 9594ca6b87d9f11e9f14ac31581e0e5d79a8e839. With the handle_simple_irq irq_flow_handler it must be ensured to not call generic_handle_irq with the same IRQ number on 2 CPUs at the same time (interrupts are floating on s390). Contrary to my initial investigation the irq_desc's lock usage in handle_simple_irq does not ensure this. Thus re-introduce the bit- lock usage in s390's pci handler. Reported-by: Ursula Braun Reported-by: Alexander Schmidt Signed-off-by: Sebastian Ott Signed-off-by: Martin Schwidefsky arch/s390/pci/pci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 6f64e3a4de749575e4705fa53dd49aed28f92623 Merge: b0314565da2b c97617a81a76 Author: Linus Torvalds Date: Thu Feb 7 08:33:56 2019 +0000 Merge tag 'sound-5.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of a few small fixes. The most significant one is the fix for the possible race at loading HD-audio drivers. This has been present for long time and surfaced only in a rare occasion, but finally spotted out" * tag 'sound-5.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/ca0132 - Fix build error without CONFIG_PCI ALSA: compress: Fix stop handling on compressed capture streams ALSA: usb-audio: Add support for new T+A USB DAC ALSA: hda - Serialize codec registrations ALSA: hda/realtek - Use a common helper for hp pin reference ALSA: hda/realtek - Fix lose hp_pins for disable auto mute ALSA: hda/realtek - Headset microphone support for System76 darp5 commit b0314565da2b95e73feab484467ad171fcce6dff Merge: 4879f11615d2 9c0644ee4aa8 Author: Linus Torvalds Date: Thu Feb 7 08:05:28 2019 +0000 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio fixes from Michael Tsirkin: "A small fix for a uapi header, and a fix for VDPA for non-x86 guests" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: virtio: drop internal struct from UAPI virtio: support VIRTIO_F_ORDER_PLATFORM commit 4879f11615d29d7b91cd5a4cfbff8e563ada991d Merge: 076a3f553743 0722069a5374 Author: Linus Torvalds Date: Thu Feb 7 07:59:01 2019 +0000 Merge tag 'trace-v5.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fixes from Steven Rostedt: "This has two fixes for uprobe code. - Cut and paste fix to have uprobe printks say "uprobe" and not "kprobe" - Add terminating '\0' byte when copying function arguments" * tag 'trace-v5.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing/uprobes: Fix output for multiple string arguments tracing: uprobes: Fix typo in pr_fmt string commit 076a3f553743cca32ff261d4bea29a4e92d936dd Merge: b66bc7776748 a2ebba824106 Author: Linus Torvalds Date: Thu Feb 7 07:52:08 2019 +0000 Merge tag 'fuse-fixes-5.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse Pull fuse fixes from Miklos Szeredi: "A fix for a CUSE regression introduced in v4.20, as well as fixes for a couple of old bugs" * tag 'fuse-fixes-5.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: fuse: decrement NR_WRITEBACK_TEMP on the right page fuse: call pipe_buf_release() under pipe lock cuse: fix ioctl fuse: handle zero sized retrieve correctly commit b66bc7776748c97a6dc013c8d06e10ebf1c14307 Merge: 8834f5600cf3 10098709b4ee Author: Linus Torvalds Date: Thu Feb 7 07:47:08 2019 +0000 Merge tag 'pinctrl-v5.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: - Mediatek Kconfig fix - Sunxi regulator, IRQ banks and pin base fixup - Intel Cherryview Strago DMI workaround - Potential regmap problem on mcp23s08 * tag 'pinctrl-v5.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: sunxi: Correct number of IRQ banks on H6 main pin controller pinctrl: mcp23s08: spi: Fix regmap allocation for mcp23s18 pinctrl: cherryview: fix Strago DMI workaround pinctrl: sunxi: Consider pin_base when calculating regulator array index pinctrl: sunxi: Fix and simplify pin bank regulator handling pinctrl: mediatek: fix Kconfig build errors for moore core commit e8c32c32b48c2e889704d8ca0872f92eb027838e Author: Bjorn Helgaas Date: Tue Feb 5 14:47:21 2019 -0600 net: Don't default Cavium PTP driver to 'y' 8c56df372bc1 ("net: add support for Cavium PTP coprocessor") added the Cavium PTP coprocessor driver and enabled it by default. Remove the "default y" because the driver only applies to Cavium ThunderX processors. Fixes: 8c56df372bc1 ("net: add support for Cavium PTP coprocessor") Signed-off-by: Bjorn Helgaas Signed-off-by: David S. Miller drivers/net/ethernet/cavium/Kconfig | 1 - 1 file changed, 1 deletion(-) commit d2901b0739a42a5669ae33356206591a6bd3a64c Author: Yang Wei Date: Wed Feb 6 00:25:54 2019 +0800 net: broadcom: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles dev_consume_skb_irq() should be called in sbdma_tx_process() when skb xmit done. It makes drop profiles(dropwatch, perf) more friendly. Signed-off-by: Yang Wei Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/sb1250-mac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e0cbbc613175e1c67bd82721230692047923d845 Author: Yang Wei Date: Wed Feb 6 00:22:54 2019 +0800 net: via-velocity: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles dev_consume_skb_irq() should be called in velocity_free_tx_buf() when skb xmit done. It makes drop profiles(dropwatch, perf) more friendly. Signed-off-by: Yang Wei Signed-off-by: David S. Miller drivers/net/ethernet/via/via-velocity.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f4ad1a6154e305dbcde20395a6961658d1ce032b Author: Yang Wei Date: Wed Feb 6 00:21:31 2019 +0800 net: tehuti: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles dev_consume_skb_irq() should be called in bdx_tx_cleanup() when skb xmit done. It makes drop profiles(dropwatch, perf) more friendly. Signed-off-by: Yang Wei Signed-off-by: David S. Miller drivers/net/ethernet/tehuti/tehuti.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 98fcd70b642dd843f80c92eeb6f8c07886876999 Author: Yang Wei Date: Wed Feb 6 00:19:44 2019 +0800 net: sun: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles dev_consume_skb_irq() should be called when skb xmit done. It makes drop profiles(dropwatch, perf) more friendly. Signed-off-by: Yang Wei Signed-off-by: David S. Miller drivers/net/ethernet/sun/cassini.c | 2 +- drivers/net/ethernet/sun/sunbmac.c | 2 +- drivers/net/ethernet/sun/sunhme.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) commit 7c3850adbcccc2c6c9e7ab23a7dcbc4926ee5b96 Author: Yang Wei Date: Wed Feb 6 00:14:51 2019 +0800 net: fsl_ucc_hdlc: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles dev_consume_skb_irq() should be called in hdlc_tx_done() when skb xmit done. It makes drop profiles(dropwatch, perf) more friendly. Signed-off-by: Yang Wei Signed-off-by: David S. Miller drivers/net/wan/fsl_ucc_hdlc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c50e964b76903b03a1516a04463c2faf945ec140 Author: Yang Wei Date: Wed Feb 6 00:12:04 2019 +0800 net: fec_mpc52xx: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles dev_consume_skb_irq() should be called in mpc52xx_fec_tx_interrupt() when skb xmit done. It makes drop profiles(dropwatch, perf) more friendly. Signed-off-by: Yang Wei Signed-off-by: David S. Miller drivers/net/ethernet/freescale/fec_mpc52xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bb6a702c6d512b16a7c16a38468a14eda72f44b5 Author: Yang Wei Date: Wed Feb 6 00:09:41 2019 +0800 net: smsc: epic100: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles dev_consume_skb_irq() should be called in epic_tx() when skb xmit done. It makes drop profiles(dropwatch, perf) more friendly. Signed-off-by: Yang Wei Signed-off-by: David S. Miller drivers/net/ethernet/smsc/epic100.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 96d26503e1deba5d12e0e4b473336479cc0965af Author: Yang Wei Date: Wed Feb 6 00:07:03 2019 +0800 net: dscc4: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles dev_consume_skb_irq() should be called in dscc4_tx_irq() when skb xmit done. It makes drop profiles(dropwatch, perf) more friendly. Signed-off-by: Yang Wei Signed-off-by: David S. Miller drivers/net/wan/dscc4.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 62d1a31cfb5d9291f4dd90c1b0ef5c22f3c235bf Author: Yang Wei Date: Wed Feb 6 00:03:51 2019 +0800 net: tulip: de2104x: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles dev_consume_skb_irq() should be called in de_tx() when skb xmit done. It makes drop profiles(dropwatch, perf) more friendly. Signed-off-by: Yang Wei Signed-off-by: David S. Miller drivers/net/ethernet/dec/tulip/de2104x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3703a395012b509cb2fea50958cdbe4a6a895eed Author: Yang Wei Date: Wed Feb 6 00:01:04 2019 +0800 net: defxx: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles dev_consume_skb_irq() should be called in dfx_xmt_done() when skb xmit done. It makes drop profiles(dropwatch, perf) more friendly. Signed-off-by: Yang Wei Reviewed-by: Maciej W. Rozycki Signed-off-by: David S. Miller drivers/net/fddi/defxx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 218d05ce326f9e1b40a56085431fa1068b43d5d9 Author: Tonghao Zhang Date: Mon Jan 28 15:28:06 2019 -0800 net/mlx5e: Don't overwrite pedit action when multiple pedit used In some case, we may use multiple pedit actions to modify packets. The command shown as below: the last pedit action is effective. $ tc filter add dev netdev_rep parent ffff: protocol ip prio 1 \ flower skip_sw ip_proto icmp dst_ip 3.3.3.3 \ action pedit ex munge ip dst set 192.168.1.100 pipe \ action pedit ex munge eth src set 00:00:00:00:00:01 pipe \ action pedit ex munge eth dst set 00:00:00:00:00:02 pipe \ action csum ip pipe \ action tunnel_key set src_ip 1.1.1.100 dst_ip 1.1.1.200 dst_port 4789 id 100 \ action mirred egress redirect dev vxlan0 To fix it, we add max_mod_hdr_actions to mlx5e_tc_flow_parse_attr struction, max_mod_hdr_actions will store the max pedit action number we support and num_mod_hdr_actions indicates how many pedit action we used, and store all pedit action to mod_hdr_actions. Fixes: d79b6df6b10a ("net/mlx5e: Add parsing of TC pedit actions to HW format") Cc: Or Gerlitz Signed-off-by: Tonghao Zhang Reviewed-by: Or Gerlitz Acked-by: Saeed Mahameed Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-) commit 6707f74be8621ae067d2cf1c4485900e2742c20f Author: Tonghao Zhang Date: Mon Jan 28 15:28:05 2019 -0800 net/mlx5e: Update hw flows when encap source mac changed When we offload tc filters to hardware, hardware flows can be updated when mac of encap destination ip is changed. But we ignore one case, that the mac of local encap ip can be changed too, so we should also update them. To fix it, add route_dev in mlx5e_encap_entry struct to save the local encap netdevice, and when mac changed, kernel will flush all the neighbour on the netdevice and send NETEVENT_NEIGH_UPDATE event. The mlx5 driver will delete the flows and add them when neighbour available again. Fixes: 232c001398ae ("net/mlx5e: Add support to neighbour update flow") Cc: Hadar Hen Zion Signed-off-by: Tonghao Zhang Reviewed-by: Or Gerlitz Acked-by: Saeed Mahameed Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c | 2 ++ drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 4 ++++ drivers/net/ethernet/mellanox/mlx5/core/en_rep.h | 1 + 3 files changed, 7 insertions(+) commit 2ba036b970b7dffc2b114c960d68d156f0b16689 Merge: 00670cb8a73b 42dbcd6b25cd Author: David S. Miller Date: Wed Feb 6 16:53:33 2019 -0800 Merge branch 'qed-Bug-fixes' Manish Chopra says: ==================== qed*: Bug fixes. This series contains general qed/qede fixes. Please consider applying this to "net" ==================== Signed-off-by: David S. Miller commit 42dbcd6b25cd6fe8b47cf838f5da8178d1cd926c Author: Manish Chopra Date: Wed Feb 6 14:43:47 2019 -0800 qed*: Advance drivers version to 8.37.0.20 Version update for qed/qede modules. Signed-off-by: Manish Chopra Signed-off-by: Ariel Elior Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed.h | 2 +- drivers/net/ethernet/qlogic/qede/qede.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 8c8502532f0064d0f04335bfe0f80d9431866a73 Author: Rahul Verma Date: Wed Feb 6 14:43:46 2019 -0800 qed: Change verbosity for coalescing message. Fix unnecessary logging of message in an expected default case where coalescing value read (via ethtool -c) migh not be valid unless they are configured explicitly in the hardware using ethtool -C. Signed-off-by: Rahul Verma Signed-off-by: Manish Chopra Signed-off-by: Ariel Elior Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_l2.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 0aa4febb420d91df5b56b1864a2465765da85f4b Author: Sudarsana Reddy Kalluru Date: Wed Feb 6 14:43:45 2019 -0800 qede: Fix system crash on configuring channels. Under heavy traffic load, when changing number of channels via ethtool (ethtool -L) which will cause interface to be reloaded, it was observed that some packets gets transmitted on old TX channel/queue id which doesn't really exist after the channel configuration leads to system crash. Add a safeguard in the driver by validating queue id through ndo_select_queue() which is called before the ndo_start_xmit(). Signed-off-by: Sudarsana Reddy Kalluru Signed-off-by: Ariel Elior Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qede/qede.h | 3 +++ drivers/net/ethernet/qlogic/qede/qede_fp.c | 13 +++++++++++++ drivers/net/ethernet/qlogic/qede/qede_main.c | 3 +++ 3 files changed, 19 insertions(+) commit fb1faab74ddef9ec2d841d54e5d0912a097b3abe Author: Sudarsana Reddy Kalluru Date: Wed Feb 6 14:43:44 2019 -0800 qed: Consider TX tcs while deriving the max num_queues for PF. Max supported queues is derived incorrectly in the case of multi-CoS. Need to consider TCs while calculating num_queues for PF. Signed-off-by: Sudarsana Reddy Kalluru Signed-off-by: Ariel Elior Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_l2.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit ebd873a31cae778c2379959ab382b34ba3b73549 Author: Sudarsana Reddy Kalluru Date: Wed Feb 6 14:43:43 2019 -0800 qed: Assign UFP TC value to vlan priority in UFP mode. In the case of Unified Fabric Port (UFP) mode, switch provides the traffic class (TC) value to be used for the traffic. Configure hardware to use this TC value for vlan priority. Signed-off-by: Sudarsana Reddy Kalluru Signed-off-by: Ariel Elior Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_sp_commands.c | 3 +++ 1 file changed, 3 insertions(+) commit 660492bcf4a7561b5fdc13be0ae0b0c0a8c120be Author: Manish Chopra Date: Wed Feb 6 14:43:42 2019 -0800 qed: Fix EQ full firmware assert. When slowpath messages are sent with high rate, the resulting events can lead to a FW assert in case they are not handled fast enough (Event Queue Full assert). Attempt to send queued slowpath messages only after the newly evacuated entries in the EQ ring are indicated to FW. Signed-off-by: Manish Chopra Signed-off-by: Ariel Elior Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_sp.h | 1 + drivers/net/ethernet/qlogic/qed/qed_spq.c | 15 +++++++-------- 2 files changed, 8 insertions(+), 8 deletions(-) commit 78eb1ca47589f0cd9db2ceb28b60434e8d512131 Merge: 8628752d0c97 9ddac734aa31 Author: Dave Airlie Date: Thu Feb 7 10:36:43 2019 +1000 Merge branch 'vmwgfx-fixes-5.0-2' of git://people.freedesktop.org/~thomash/linux into drm-fixes A patch set from Christoph for vmwgfx dma mode detection breakage with the new dma code restructuring in 5.0 A couple of fixes also CC'd stable Finally an improved IOMMU detection that automatically enables dma mapping also with other vIOMMUS than the intel one if present and enabled. Currently trying to start a VM in that case would fail catastrophically. Signed-off-by: Dave Airlie From: Thomas Hellstrom Link: https://patchwork.freedesktop.org/patch/msgid/20190206194735.4663-1-thellstrom@vmware.com commit 8628752d0c97c0b4d0406c39e313a30db950eba6 Merge: 2072ce03637f 7fad8da1ae23 Author: Dave Airlie Date: Thu Feb 7 10:25:27 2019 +1000 Merge branch 'drm-fixes-5.0' of git://people.freedesktop.org/~agd5f/linux into drm-fixes - Fix missing freesync properties on eDP - Fix locking in pasid mgr - Fix clang warning in kfd - DC/powerplay fix - Fix reported rev ids on raven - Doorbell fix for vega20 Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20190205231301.3815-1-alexander.deucher@amd.com commit f57a98e1b71357713e44c57268a53d9c803f0626 Author: Thinh Nguyen Date: Wed Feb 6 17:17:27 2019 -0600 PCI: Work around Synopsys duplicate Device ID (HAPS USB3, NXP i.MX) There are at least four different parts with the same Vendor and Device ID ([16c3:abcd]): 1) Synopsys HAPS USB3 controller 2) Synopsys PCIe Root Port in Freescale/NXP i.MX6Q (reported by Lucas) 3) Synopsys PCIe Root Port in Freescale/NXP i.MX6QP (reported by Lukas) 4) Synopsys PCIe Root Port in Freescale/NXP i.MX7D (reported by Trent) The HAPS USB3 controller has a Class Code of PCI_CLASS_SERIAL_USB_XHCI, which means the XHCI driver would normally claim it. Previously, quirk_synopsys_haps() changed the Class Code of all [16c3:abcd] devices, including the Root Ports, to PCI_CLASS_SERIAL_USB_DEVICE to prevent the XHCI driver from claiming them so dwc3-haps can claim them instead. Changing the Class Code of the Root Ports prevents the PCI core from handling them as bridges, so devices below them don't work. Restrict the quirk so it only changes the Class Code for devices that start with the PCI_CLASS_SERIAL_USB_XHCI Class Code, leaving the Root Ports alone. Fixes: 03e6742584af ("PCI: Override Synopsys USB 3.x HAPS device class") Reported-by: Lukas F. Hartmann Reported-by: Trent Piepho Reported-by: Lucas Stach Signed-off-by: Thinh Nguyen [bhelgaas: changelog] Signed-off-by: Bjorn Helgaas drivers/pci/quirks.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit fa8db4948f5224dae33a0e783e7dec682e145f88 Author: Mike Snitzer Date: Tue Feb 5 17:07:58 2019 -0500 dm: don't use bio_trim() afterall bio_trim() has an early return, which makes it _not_ idempotent, if the offset is 0 and the bio's bi_size already matches the requested size. Prior to DM, all users of bio_trim() were fine with this. But DM has exposed the fact that bio_trim()'s early return is incompatible with a cloned bio whose integrity payload must be trimmed via bio_integrity_trim(). Fix this by reverting DM back to doing the equivalent of bio_trim() but in an idempotent manner (so bio_integrity_trim is always performed). Follow-on work is needed to assess what benefit bio_trim()'s early return is providing to its existing callers. Reported-by: Milan Broz Fixes: 57c36519e4b94 ("dm: fix clone_bio() to trigger blk_recount_segments()") Signed-off-by: Mike Snitzer drivers/md/dm.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 645efa84f6c7566ea863ed37a8b3247247f72e02 Author: Mikulas Patocka Date: Tue Feb 5 05:09:00 2019 -0500 dm: add memory barrier before waitqueue_active Block core changes to switch bio-based IO accounting to be percpu had a side-effect of altering DM core to now rely on calling waitqueue_active (in both bio-based and request-based) to check if another task is in dm_wait_for_completion(). A memory barrier is needed before calling waitqueue_active(). DM core doesn't piggyback on a preceding memory barrier so it must explicitly use its own. For more details on why using waitqueue_active() without a preceding barrier is unsafe, please see the comment before the waitqueue_active() definition in include/linux/wait.h. Add the missing memory barrier by switching to using wq_has_sleeper(). Fixes: 6f75723190d8 ("dm: remove the pending IO accounting") Fixes: c4576aed8d85 ("dm: fix request-based dm's use of dm_wait_for_completion") Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer drivers/md/dm-rq.c | 2 +- drivers/md/dm.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 00670cb8a73b10b10d3c40f045c15411715e4465 Author: Dan Carpenter Date: Wed Feb 6 18:35:15 2019 +0300 net: dsa: Fix NULL checking in dsa_slave_set_eee() This function can't succeed if dp->pl is NULL. It will Oops inside the call to return phylink_ethtool_get_eee(dp->pl, e); Fixes: 1be52e97ed3e ("dsa: slave: eee: Allow ports to use phylink") Signed-off-by: Dan Carpenter Reviewed-by: Florian Fainelli Reviewed-by: Vivien Didelot Signed-off-by: David S. Miller net/dsa/slave.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit e248aa7be86e8179f20ac0931774ecd746f3f5bf Author: Chuck Lever Date: Fri Jan 25 16:54:54 2019 -0500 svcrdma: Remove max_sge check at connect time Two and a half years ago, the client was changed to use gathered Send for larger inline messages, in commit 655fec6987b ("xprtrdma: Use gathered Send for large inline messages"). Several fixes were required because there are a few in-kernel device drivers whose max_sge is 3, and these were broken by the change. Apparently my memory is going, because some time later, I submitted commit 25fd86eca11c ("svcrdma: Don't overrun the SGE array in svc_rdma_send_ctxt"), and after that, commit f3c1fd0ee294 ("svcrdma: Reduce max_send_sges"). These too incorrectly assumed in-kernel device drivers would have more than a few Send SGEs available. The fix for the server side is not the same. This is because the fundamental problem on the server is that, whether or not the client has provisioned a chunk for the RPC reply, the server must squeeze even the most complex RPC replies into a single RDMA Send. Failing in the send path because of Send SGE exhaustion should never be an option. Therefore, instead of failing when the send path runs out of SGEs, switch to using a bounce buffer mechanism to handle RPC replies that are too complex for the device to send directly. That allows us to remove the max_sge check to enable drivers with small max_sge to work again. Reported-by: Don Dutile Fixes: 25fd86eca11c ("svcrdma: Don't overrun the SGE array in ...") Cc: stable@vger.kernel.org Signed-off-by: Chuck Lever Signed-off-by: J. Bruce Fields net/sunrpc/xprtrdma/svc_rdma_sendto.c | 105 +++++++++++++++++++++++++++++-- net/sunrpc/xprtrdma/svc_rdma_transport.c | 9 +-- 2 files changed, 102 insertions(+), 12 deletions(-) commit e3fdc89ca47ef34dfb6fd5101fec084c3dba5486 Author: Trond Myklebust Date: Mon Jan 21 15:58:38 2019 -0500 nfsd: Fix error return values for nfsd4_clone_file_range() If the parameter 'count' is non-zero, nfsd4_clone_file_range() will currently clobber all errors returned by vfs_clone_file_range() and replace them with EINVAL. Fixes: 42ec3d4c0218 ("vfs: make remap_file_range functions take and...") Signed-off-by: Trond Myklebust Cc: stable@vger.kernel.org # v4.20+ Signed-off-by: J. Bruce Fields fs/nfsd/vfs.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 43636c804df0126da669c261fc820fb22f62bfc2 Author: Tetsuo Handa Date: Mon Jan 21 22:49:37 2019 +0900 fs: ratelimit __find_get_block_slow() failure message. When something let __find_get_block_slow() hit all_mapped path, it calls printk() for 100+ times per a second. But there is no need to print same message with such high frequency; it is just asking for stall warning, or at least bloating log files. [ 399.866302][T15342] __find_get_block_slow() failed. block=1, b_blocknr=8 [ 399.873324][T15342] b_state=0x00000029, b_size=512 [ 399.878403][T15342] device loop0 blocksize: 4096 [ 399.883296][T15342] __find_get_block_slow() failed. block=1, b_blocknr=8 [ 399.890400][T15342] b_state=0x00000029, b_size=512 [ 399.895595][T15342] device loop0 blocksize: 4096 [ 399.900556][T15342] __find_get_block_slow() failed. block=1, b_blocknr=8 [ 399.907471][T15342] b_state=0x00000029, b_size=512 [ 399.912506][T15342] device loop0 blocksize: 4096 This patch reduces frequency to up to once per a second, in addition to concatenating three lines into one. [ 399.866302][T15342] __find_get_block_slow() failed. block=1, b_blocknr=8, b_state=0x00000029, b_size=512, device loop0 blocksize: 4096 Signed-off-by: Tetsuo Handa Reviewed-by: Jan Kara Cc: Dmitry Vyukov Signed-off-by: Jens Axboe fs/buffer.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) commit 2b1f86bf741a3220b4471fef197631d6e2264983 Author: Russell King Date: Wed Feb 6 10:54:54 2019 +0000 MAINTAINERS: add maintainer for SFF/SFP/SFP+ support Add maintainer entry for SFF/SFP/SFP+ support. Signed-off-by: Russell King Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller MAINTAINERS | 9 +++++++++ 1 file changed, 9 insertions(+) commit 30363d6506d0d202bb14f4dac36d9b4b0714ad8d Author: Chengguang Xu Date: Fri Feb 1 11:26:02 2019 +0800 m68k: set proper major_num when specifying module param major_num When calling register_blkdev() with specified major device number, the return code is 0 on success. So it seems not correct direct assign return code to variable major_num in this case. Tested-by: Michael Schmitz Reviewed-by: Geert Uytterhoeven Signed-off-by: Chengguang Xu Signed-off-by: Jens Axboe arch/m68k/emu/nfblock.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) commit dd957493baa586f1431490f97f9c7c45eaf8ab10 Author: Hans de Goede Date: Sun Feb 3 10:02:07 2019 +0100 libata: Add NOLPM quirk for SAMSUNG MZ7TE512HMHP-000L1 SSD We've received a bugreport that using LPM with a SAMSUNG MZ7TE512HMHP-000L1 SSD leads to system instability, we already have a quirk for the MZ7TD256HAFV-000L9, which is also a Samsun EVO 840 / PM851 OEM model, so it seems some of these models have a LPM issue. This commits adds a NOLPM quirk for the model string from the new bugeport, to avoid the reported stability issues. Cc: stable@vger.kernel.org BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1571330 Signed-off-by: Hans de Goede Signed-off-by: Jens Axboe drivers/ata/libata-core.c | 1 + 1 file changed, 1 insertion(+) commit 90cc55f067f6ca0e64e5e52883ece47d8af7b67b Author: Jonathan Bakker Date: Wed Feb 6 10:45:37 2019 -0800 Input: bma150 - register input device after setting private data Otherwise we introduce a race condition where userspace can request input before we're ready leading to null pointer dereference such as input: bma150 as /devices/platform/i2c-gpio-2/i2c-5/5-0038/input/input3 Unable to handle kernel NULL pointer dereference at virtual address 00000018 pgd = (ptrval) [00000018] *pgd=55dac831, *pte=00000000, *ppte=00000000 Internal error: Oops: 17 [#1] PREEMPT ARM Modules linked in: bma150 input_polldev [last unloaded: bma150] CPU: 0 PID: 2870 Comm: accelerometer Not tainted 5.0.0-rc3-dirty #46 Hardware name: Samsung S5PC110/S5PV210-based board PC is at input_event+0x8/0x60 LR is at bma150_report_xyz+0x9c/0xe0 [bma150] pc : [<80450f70>] lr : [<7f0a614c>] psr: 800d0013 sp : a4c1fd78 ip : 00000081 fp : 00020000 r10: 00000000 r9 : a5e2944c r8 : a7455000 r7 : 00000016 r6 : 00000101 r5 : a7617940 r4 : 80909048 r3 : fffffff2 r2 : 00000000 r1 : 00000003 r0 : 00000000 Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 10c5387d Table: 54e34019 DAC: 00000051 Process accelerometer (pid: 2870, stack limit = 0x(ptrval)) Stackck: (0xa4c1fd78 to 0xa4c20000) fd60: fffffff3 fc813f6c fd80: 40410581 d7530ce3 a5e2817c a7617f00 a5e29404 a5e2817c 00000000 7f008324 fda0: a5e28000 8044f59c a5fdd9d0 a5e2945c a46a4a00 a5e29668 a7455000 80454f10 fdc0: 80909048 a5e29668 a5fdd9d0 a46a4a00 806316d0 00000000 a46a4a00 801df5f0 fde0: 00000000 d7530ce3 a4c1fec0 a46a4a00 00000000 a5fdd9d0 a46a4a08 801df53c fe00: 00000000 801d74bc a4c1fec0 00000000 a4c1ff70 00000000 a7038da8 00000000 fe20: a46a4a00 801e91fc a411bbe0 801f2e88 00000004 00000000 80909048 00000041 fe40: 00000000 00020000 00000000 dead4ead a6a88da0 00000000 ffffe000 806fcae8 fe60: a4c1fec8 00000000 80909048 00000002 a5fdd9d0 a7660110 a411bab0 00000001 fe80: dead4ead ffffffff ffffffff a4c1fe8c a4c1fe8c d7530ce3 20000013 80909048 fea0: 80909048 a4c1ff70 00000001 fffff000 a4c1e000 00000005 00026038 801eabd8 fec0: a7660110 a411bab0 b9394901 00000006 a696201b 76fb3000 00000000 a7039720 fee0: a5fdd9d0 00000101 00000002 00000096 00000000 00000000 00000000 a4c1ff00 ff00: a6b310f4 805cb174 a6b310f4 00000010 00000fe0 00000010 a4c1e000 d7530ce3 ff20: 00000003 a5f41400 a5f41424 00000000 a6962000 00000000 00000003 00000002 ff40: ffffff9c 000a0000 80909048 d7530ce3 a6962000 00000003 80909048 ffffff9c ff60: a6962000 801d890c 00000000 00000000 00020000 a7590000 00000004 00000100 ff80: 00000001 d7530ce3 000288b8 00026320 000288b8 00000005 80101204 a4c1e000 ffa0: 00000005 80101000 000288b8 00026320 000288b8 000a0000 00000000 00000000 ffc0: 000288b8 00026320 000288b8 00000005 7eef3bac 000264e8 00028ad8 00026038 ffe0: 00000005 7eef3300 76f76e91 76f78546 800d0030 000288b8 00000000 00000000 [<80450f70>] (input_event) from [] (0xa5e2817c) Code: e1a08148 eaffffa8 e351001f 812fff1e (e590c018) ---[ end trace 1c691ee85f2ff243 ]--- Signed-off-by: Jonathan Bakker Signed-off-by: Paweł Chmiel Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov drivers/input/misc/bma150.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 6dce3c20ac429e7a651d728e375853370c796e8d Author: Eric Dumazet Date: Mon Feb 4 08:36:06 2019 -0800 rxrpc: bad unlock balance in rxrpc_recvmsg When either "goto wait_interrupted;" or "goto wait_error;" paths are taken, socket lock has already been released. This patch fixes following syzbot splat : WARNING: bad unlock balance detected! 5.0.0-rc4+ #59 Not tainted ------------------------------------- syz-executor223/8256 is trying to release lock (sk_lock-AF_RXRPC) at: [] rxrpc_recvmsg+0x6d3/0x3099 net/rxrpc/recvmsg.c:598 but there are no more locks to release! other info that might help us debug this: 1 lock held by syz-executor223/8256: #0: 00000000fa9ed0f4 (slock-AF_RXRPC){+...}, at: spin_lock_bh include/linux/spinlock.h:334 [inline] #0: 00000000fa9ed0f4 (slock-AF_RXRPC){+...}, at: release_sock+0x20/0x1c0 net/core/sock.c:2798 stack backtrace: CPU: 1 PID: 8256 Comm: syz-executor223 Not tainted 5.0.0-rc4+ #59 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x172/0x1f0 lib/dump_stack.c:113 print_unlock_imbalance_bug kernel/locking/lockdep.c:3391 [inline] print_unlock_imbalance_bug.cold+0x114/0x123 kernel/locking/lockdep.c:3368 __lock_release kernel/locking/lockdep.c:3601 [inline] lock_release+0x67e/0xa00 kernel/locking/lockdep.c:3860 sock_release_ownership include/net/sock.h:1471 [inline] release_sock+0x183/0x1c0 net/core/sock.c:2808 rxrpc_recvmsg+0x6d3/0x3099 net/rxrpc/recvmsg.c:598 sock_recvmsg_nosec net/socket.c:794 [inline] sock_recvmsg net/socket.c:801 [inline] sock_recvmsg+0xd0/0x110 net/socket.c:797 __sys_recvfrom+0x1ff/0x350 net/socket.c:1845 __do_sys_recvfrom net/socket.c:1863 [inline] __se_sys_recvfrom net/socket.c:1859 [inline] __x64_sys_recvfrom+0xe1/0x1a0 net/socket.c:1859 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x446379 Code: e8 2c b3 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b 09 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fe5da89fd98 EFLAGS: 00000246 ORIG_RAX: 000000000000002d RAX: ffffffffffffffda RBX: 00000000006dbc28 RCX: 0000000000446379 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00000000006dbc20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dbc2c R13: 0000000000000000 R14: 0000000000000000 R15: 20c49ba5e353f7cf Fixes: 248f219cb8bc ("rxrpc: Rewrite the data and ack handling code") Signed-off-by: Eric Dumazet Cc: David Howells Reported-by: syzbot Signed-off-by: David S. Miller net/rxrpc/recvmsg.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 45b13b424faafb81c8c44541f093a682fdabdefc Author: Kirill A. Shutemov Date: Wed Feb 6 14:52:53 2019 +0300 x86/boot/compressed/64: Do not corrupt EDX on EFER.LME=1 setting RDMSR in the trampoline code overwrites EDX but that register is used to indicate whether 5-level paging has to be enabled and if clobbered, leads to failure to boot on a 5-level paging machine. Preserve EDX on the stack while we are dealing with EFER. Fixes: b677dfae5aa1 ("x86/boot/compressed/64: Set EFER.LME=1 in 32-bit trampoline before returning to long mode") Reported-by: Kyle D Pelton Signed-off-by: Kirill A. Shutemov Signed-off-by: Borislav Petkov Cc: dave.hansen@linux.intel.com Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Thomas Gleixner Cc: Wei Huang Cc: x86-ml Link: https://lkml.kernel.org/r/20190206115253.1907-1-kirill.shutemov@linux.intel.com arch/x86/boot/compressed/head_64.S | 2 ++ 1 file changed, 2 insertions(+) commit d9111d36024de07784f2e1ba2ccf70b16035f378 Author: Kuninori Morimoto Date: Tue Feb 5 09:46:43 2019 +0900 ASoC: rsnd: fixup rsnd_ssi_master_clk_start() user count check commit 4d230d1271064 ("ASoC: rsnd: fixup not to call clk_get/set under non-atomic") added new rsnd_ssi_prepare() and moved rsnd_ssi_master_clk_start() to .prepare. But, ssi user count (= ssi->usrcnt) is incremented at .init (= rsnd_ssi_init()). Because of these timing exchange, ssi->usrcnt check at rsnd_ssi_master_clk_start() should be adjusted. Otherwise, 2nd master clock setup will be no check. This patch fixup this issue. Fixes: commit 4d230d1271064 ("ASoC: rsnd: fixup not to call clk_get/set under non-atomic") Reported-by: Yusuke Goda Reported-by: Valentine Barshak Signed-off-by: Kuninori Morimoto Tested-by: Yusuke Goda Signed-off-by: Mark Brown sound/soc/sh/rcar/ssi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c16e12010060c6c7a31f08b4a99513064cb53b7d Author: Pierre-Louis Bossart Date: Tue Feb 5 10:22:27 2019 -0600 ASoC: dapm: fix out-of-bounds accesses to DAPM lookup tables KASAN reports and additional traces point to out-of-bounds accesses to the dapm_up_seq and dapm_down_seq lookup tables. The indices used are larger than the array definition. Fix by adding missing entries for the new widget types in these two lookup tables, and align them with PGA values. Also the sequences for the following widgets were not defined. Since their values defaulted to zero, assign them explicitly snd_soc_dapm_input snd_soc_dapm_output snd_soc_dapm_vmid snd_soc_dapm_siggen snd_soc_dapm_sink Fixes: 8a70b4544ef4 ('ASoC: dapm: Add new widget type for constructing DAPM graphs on DSPs.'). Signed-off-by: Pierre-Louis Bossart Signed-off-by: Mark Brown sound/soc/soc-dapm.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) commit d592974f8c32d3e3110c693145c4cd8730779839 Merge: ec51f8ee1e63 5c959d73dba6 Author: Jens Axboe Date: Wed Feb 6 08:43:07 2019 -0700 Merge branch 'nvme-5.0' of git://git.infradead.org/nvme into for-linus Pull NVMe fixes from Christoph for this release. * 'nvme-5.0' of git://git.infradead.org/nvme: nvme-pci: fix rapid add remove sequence nvme: lock NS list changes while handling command effects commit 5c959d73dba6495ec01d04c206ee679d61ccb2b0 Author: Keith Busch Date: Wed Jan 23 18:46:11 2019 -0700 nvme-pci: fix rapid add remove sequence A surprise removal may fail to tear down request queues if it is racing with the initial asynchronous probe. If that happens, the remove path won't see the queue resources to tear down, and the controller reset path may create a new request queue on a removed device, but will not be able to make forward progress, deadlocking the pci removal. Protect setting up non-blocking resources from a shutdown by holding the same mutex, and transition to the CONNECTING state after these resources are initialized so the probe path may see the dead controller state before dispatching new IO. Link: https://bugzilla.kernel.org/show_bug.cgi?id=202081 Reported-by: Alex Gagniuc Signed-off-by: Keith Busch Tested-by: Alex Gagniuc Signed-off-by: Christoph Hellwig drivers/nvme/host/pci.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) commit e7ad43c3eda6a1690c4c3c341f95dc1c6898da83 Author: Keith Busch Date: Mon Jan 28 09:46:07 2019 -0700 nvme: lock NS list changes while handling command effects If a controller supports the NS Change Notification, the namespace scan_work is automatically triggered after attaching a new namespace. Occasionally the namespace scan_work may append the new namespace to the list before the admin command effects handling is completed. The effects handling unfreezes namespaces, but if it unfreezes the newly attached namespace, its request_queue freeze depth will be off and we'll hit the warning in blk_mq_unfreeze_queue(). On the next namespace add, we will fail to freeze that queue due to the previous bad accounting and deadlock waiting for frozen. Fix that by preventing scan work from altering the namespace list while command effects handling needs to pair freeze with unfreeze. Reported-by: Wen Xiong Tested-by: Wen Xiong Signed-off-by: Keith Busch Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig drivers/nvme/host/core.c | 8 +++++++- drivers/nvme/host/nvme.h | 1 + 2 files changed, 8 insertions(+), 1 deletion(-) commit ec51f8ee1e63498e9f521ec0e5a6d04622bb2c67 Author: Mike Marshall Date: Tue Feb 5 14:13:35 2019 -0500 aio: initialize kiocb private in case any filesystems expect it. A recent optimization had left private uninitialized. Fixes: 2bc4ca9bb600 ("aio: don't zero entire aio_kiocb aio_get_req()") Reviewed-by: Christoph Hellwig Signed-off-by: Mike Marshall Signed-off-by: Jens Axboe fs/aio.c | 1 + 1 file changed, 1 insertion(+) commit d6f11e7d91f2ac85f66194fe3ef8789b49901d64 Author: Chen-Yu Tsai Date: Tue Feb 5 23:42:24 2019 +0800 mmc: sunxi: Filter out unsupported modes declared in the device tree The MMC device tree bindings include properties used to signal various signalling speed modes. Until now the sunxi driver was accepting them without any further filtering, while the sunxi device trees were not actually using them. Since some of the H5 boards can not run at higher speed modes stably, we are resorting to declaring the higher speed modes per-board. Regardless, having boards declare modes and blindly following them, even without proper support in the driver, is generally a bad thing. Filter out all unsupported modes from the capabilities mask after the device tree properties have been parsed. Cc: Signed-off-by: Chen-Yu Tsai Acked-by: Maxime Ripard Signed-off-by: Ulf Hansson drivers/mmc/host/sunxi-mmc.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) commit d49d92ace4974510dd5845ff91860823cf30dc08 Author: Chen-Yu Tsai Date: Tue Feb 5 23:42:23 2019 +0800 mmc: sunxi: Disable HS-DDR mode for H5 eMMC controller by default Some H5 boards seem to not have proper trace lengths for eMMC to be able to use the default setting for the delay chains under HS-DDR mode. These include the Bananapi M2+ H5 and NanoPi NEO Core2. However the Libre Computer ALL-H3-CC-H5 works just fine. For the H5 (at least for now), default to not enabling HS-DDR modes in the driver, and expect the device tree to signal HS-DDR capability on boards that work. Reported-by: Chris Blake Fixes: 07bafc1e3536 ("mmc: sunxi: Use new timing mode for A64 eMMC controller") Cc: Acked-by: Maxime Ripard Signed-off-by: Chen-Yu Tsai Signed-off-by: Ulf Hansson drivers/mmc/host/sunxi-mmc.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) commit 6297388e1eddd2f1345cea5892156223995bcf2d Author: Tomi Valkeinen Date: Fri Jan 11 05:50:35 2019 +0200 drm/omap: dsi: Hack-fix DSI bus flags Since commit b4935e3a3cfa ("drm/omap: Store bus flags in the omap_dss_device structure") video mode flags are managed by the omapdss (and later omapdrm) core based on bus flags stored in omap_dss_device. This works fine for all devices whose video modes are set by the omapdss and omapdrm core, but breaks DSI operation as the DSI still uses legacy code paths and sets the DISPC timings manually. To fix the problem properly we should move the DSI encoder to the new encoder model. This will however require a considerable amount of work. Restore DSI operation by adding back video mode flags handling in the DSI encoder driver as a hack in the meantime. Fixes: b4935e3a3cfa ("drm/omap: Store bus flags in the omap_dss_device structure") Signed-off-by: Laurent Pinchart Reviewed-by: Laurent Pinchart Signed-off-by: Tomi Valkeinen Link: https://patchwork.freedesktop.org/patch/msgid/20190111035120.20668-5-laurent.pinchart@ideasonboard.com drivers/gpu/drm/omapdrm/dss/dsi.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit 0940c52742de0d2f70ba687bfd5fe8aa38c5f27d Author: Tomi Valkeinen Date: Fri Jan 11 05:50:34 2019 +0200 drm/omap: dsi: Fix OF platform depopulate Commit edb715dffdee ("drm/omap: dss: dsi: Move initialization code from bind to probe") moved the of_platform_populate() call from dsi_bind() to dsi_probe(), but failed to move the corresponding of_platform_depopulate() from dsi_unbind() to dsi_remove(). This results in OF child devices being potentially removed multiple times. Fix it by placing the of_platform_depopulate() call where it belongs. Fixes: edb715dffdee ("drm/omap: dss: dsi: Move initialization code from bind to probe") Signed-off-by: Laurent Pinchart Reviewed-by: Laurent Pinchart Signed-off-by: Tomi Valkeinen Link: https://patchwork.freedesktop.org/patch/msgid/20190111035120.20668-4-laurent.pinchart@ideasonboard.com drivers/gpu/drm/omapdrm/dss/dsi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 4df04ac9b37f278c48bb696289aff8f81226af4b Author: Tomi Valkeinen Date: Fri Jan 11 05:50:33 2019 +0200 drm/omap: dsi: Fix crash in DSI debug dumps Reading any of the DSI debugfs files results in a crash, as wrong pointer is passed to the dump functions, and the dump functions use a wrong pointer. This patch fixes DSI debug dumps. Fixes: f3ed97f9ae7d ("drm/omap: dsi: Simplify debugfs implementation") Signed-off-by: Tomi Valkeinen Reviewed-by: Laurent Pinchart Signed-off-by: Laurent Pinchart Signed-off-by: Tomi Valkeinen Link: https://patchwork.freedesktop.org/patch/msgid/20190111035120.20668-3-laurent.pinchart@ideasonboard.com drivers/gpu/drm/omapdrm/dss/dsi.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 73350424bec9c76cf42d4d502ff156c7d5daf191 Author: Johannes Berg Date: Wed Feb 6 08:03:10 2019 +0200 cfg80211: pmsr: fix abort locking When we destroy the interface we already hold the wdev->mtx while calling cfg80211_pmsr_wdev_down(), which assumes this isn't true and flushes the worker that takes the lock, thus leading to a deadlock. Fix this by refactoring the worker and calling its code in cfg80211_pmsr_wdev_down() directly. We still need to flush the work later to make sure it's not still running and will crash, but it will not do anything. Fixes: 9bb7e0f24e7e ("cfg80211: add peer measurement with FTM initiator API") Signed-off-by: Johannes Berg net/wireless/core.c | 2 ++ net/wireless/pmsr.c | 22 +++++++++++++++------- 2 files changed, 17 insertions(+), 7 deletions(-) commit 0acd99282bef617fdbc4dff29359fe8160f00846 Author: Johannes Berg Date: Wed Feb 6 07:59:41 2019 +0200 cfg80211: pmsr: fix MAC address setting When we *don't* have a MAC address attribute, we shouldn't try to use this - this was intended to copy the local MAC address instead, so fix it. Fixes: 9bb7e0f24e7e ("cfg80211: add peer measurement with FTM initiator API") Signed-off-by: Johannes Berg net/wireless/pmsr.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit d5d27fd9826b59979b184ec288e4812abac0e988 Author: Martin Kepplinger Date: Tue Feb 5 16:52:51 2019 +0100 mtd: rawnand: gpmi: fix MX28 bus master lockup problem Disable BCH soft reset according to MX23 erratum #2847 ("BCH soft reset may cause bus master lock up") for MX28 too. It has the same problem. Observed problem: once per 100,000+ MX28 reboots NAND read failed on DMA timeout errors: [ 1.770823] UBI: attaching mtd3 to ubi0 [ 2.768088] gpmi_nand: DMA timeout, last DMA :1 [ 3.958087] gpmi_nand: BCH timeout, last DMA :1 [ 4.156033] gpmi_nand: Error in ECC-based read: -110 [ 4.161136] UBI warning: ubi_io_read: error -110 while reading 64 bytes from PEB 0:0, read only 0 bytes, retry [ 4.171283] step 1 error [ 4.173846] gpmi_nand: Chip: 0, Error -1 Without BCH soft reset we successfully executed 1,000,000 MX28 reboots. I have a quote from NXP regarding this problem, from July 18th 2016: "As the i.MX23 and i.MX28 are of the same generation, they share many characteristics. Unfortunately, also the erratas may be shared. In case of the documented erratas and the workarounds, you can also apply the workaround solution of one device on the other one. This have been reported, but I’m afraid that there are not an estimated date for updating the Errata documents. Please accept our apologies for any inconveniences this may cause." Fixes: 6f2a6a52560a ("mtd: nand: gpmi: reset BCH earlier, too, to avoid NAND startup problems") Cc: stable@vger.kernel.org Signed-off-by: Manfred Schlaegl Signed-off-by: Martin Kepplinger Reviewed-by: Miquel Raynal Reviewed-by: Fabio Estevam Acked-by: Han Xu Signed-off-by: Boris Brezillon drivers/mtd/nand/raw/gpmi-nand/gpmi-lib.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) commit d028a646e84b9b131e4ff2cb5bbdd3825d141028 Author: Ville Syrjälä Date: Tue Feb 5 16:18:46 2019 +0200 drm/i915: Try to sanitize bogus DPLL state left over by broken SNB BIOSen Certain SNB machines (eg. ASUS K53SV) seem to have a broken BIOS which misprograms the hardware badly when encountering a suitably high resolution display. The programmed pipe timings are somewhat bonkers and the DPLL is totally misprogrammed (P divider == 0). That will result in atomic commit timeouts as apparently the pipe is sufficiently stuck to not signal vblank interrupts. IIRC something like this was also observed on some other SNB machine years ago (might have been a Dell XPS 8300) but a BIOS update cured it. Sadly looks like this was never fixed for the ASUS K53SV as the latest BIOS (K53SV.320 11/11/2011) is still broken. The quickest way to deal with this seems to be to shut down the pipe+ports+DPLL. Unfortunately doing this during the normal sanitization phase isn't quite soon enough as we already spew several WARNs about the bogus hardware state. But it's better than hanging the boot for a few dozen seconds. Since this is limited to a few old machines it doesn't seem entirely worthwile to try and rework the readout+sanitization code to handle it more gracefully. v2: Fix potential NULL deref (kbuild test robot) Constify has_bogus_dpll_config() Cc: stable@vger.kernel.org # v4.20+ Cc: Daniel Kamil Kozar Reported-by: Daniel Kamil Kozar Tested-by: Daniel Kamil Kozar Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=109245 Fixes: 516a49cc1946 ("drm/i915: Fix assert_plane() warning on bootup with external display") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20190111174950.10681-1-ville.syrjala@linux.intel.com Reviewed-by: Mika Kahola (cherry picked from commit 7bed8adcd9f86231bb69bbc02f88ad89330f99e3) Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20190205141846.6053-1-ville.syrjala@linux.intel.com drivers/gpu/drm/i915/intel_display.c | 50 +++++++++++++++++++++++++++++++----- 1 file changed, 44 insertions(+), 6 deletions(-) commit c97617a81a7616d49bc3700959e08c6c6f447093 Author: Takashi Iwai Date: Tue Feb 5 17:57:27 2019 +0100 ALSA: hda/ca0132 - Fix build error without CONFIG_PCI A call of pci_iounmap() call without CONFIG_PCI leads to a build error on some architectures. We tried to address this and add a check of IS_ENABLED(CONFIG_PCI), but this still doesn't seem enough for sh. Ideally we should fix it globally, it's really a corner case, so let's paper over it with a simpler ifdef. Fixes: 1e73359a24fa ("ALSA: hda/ca0132 - make pci_iounmap() call conditional") Reported-by: Kuninori Morimoto Signed-off-by: Takashi Iwai sound/pci/hda/patch_ca0132.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit bdcc5bc25548ef6b08e2e43937148f907c212292 Author: Eric Dumazet Date: Tue Feb 5 15:38:44 2019 -0800 mISDN: fix a race in dev_expire_timer() Since mISDN_close() uses dev->pending to iterate over active timers, there is a chance that one timer got removed from the ->pending list in dev_expire_timer() but that the thread has not called yet wake_up_interruptible() So mISDN_close() could miss this and free dev before completion of at least one dev_expire_timer() syzbot was able to catch this race : BUG: KASAN: use-after-free in register_lock_class+0x140c/0x1bf0 kernel/locking/lockdep.c:827 Write of size 8 at addr ffff88809fc18948 by task syz-executor1/24769 CPU: 1 PID: 24769 Comm: syz-executor1 Not tainted 5.0.0-rc5 #60 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x172/0x1f0 lib/dump_stack.c:113 print_address_description.cold+0x7c/0x20d mm/kasan/report.c:187 kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317 __asan_report_store8_noabort+0x17/0x20 mm/kasan/generic_report.c:140 register_lock_class+0x140c/0x1bf0 kernel/locking/lockdep.c:827 __lock_acquire+0x11f/0x4700 kernel/locking/lockdep.c:3224 lock_acquire+0x16f/0x3f0 kernel/locking/lockdep.c:3841 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x95/0xcd kernel/locking/spinlock.c:152 __wake_up_common_lock+0xc7/0x190 kernel/sched/wait.c:120 __wake_up+0xe/0x10 kernel/sched/wait.c:145 dev_expire_timer+0xe4/0x3b0 drivers/isdn/mISDN/timerdev.c:174 call_timer_fn+0x190/0x720 kernel/time/timer.c:1325 protocol 88fb is buggy, dev hsr_slave_0 protocol 88fb is buggy, dev hsr_slave_1 expire_timers kernel/time/timer.c:1362 [inline] __run_timers kernel/time/timer.c:1681 [inline] __run_timers kernel/time/timer.c:1649 [inline] run_timer_softirq+0x652/0x1700 kernel/time/timer.c:1694 __do_softirq+0x266/0x95a kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x180/0x1d0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x14a/0x570 arch/x86/kernel/apic/apic.c:1062 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807 RIP: 0010:__sanitizer_cov_trace_pc+0x26/0x50 kernel/kcov.c:101 Code: 90 90 90 90 55 48 89 e5 48 8b 75 08 65 48 8b 04 25 40 ee 01 00 65 8b 15 98 12 92 7e 81 e2 00 01 1f 00 75 2b 8b 90 d8 12 00 00 <83> fa 02 75 20 48 8b 88 e0 12 00 00 8b 80 dc 12 00 00 48 8b 11 48 RSP: 0018:ffff8880589b7a60 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 RAX: ffff888087ce25c0 RBX: 0000000000000001 RCX: ffffffff818f8ca3 RDX: 0000000000000000 RSI: ffffffff818f8b48 RDI: 0000000000000001 RBP: ffff8880589b7a60 R08: ffff888087ce25c0 R09: ffffed1015d25bd0 R10: ffffed1015d25bcf R11: ffff8880ae92de7b R12: ffffea0001ae4680 R13: ffffea0001ae4688 R14: 0000000000000000 R15: ffffea0001b41648 PageIdle include/linux/page-flags.h:398 [inline] page_is_idle include/linux/page_idle.h:29 [inline] mark_page_accessed+0x618/0x1140 mm/swap.c:398 touch_buffer fs/buffer.c:59 [inline] __find_get_block+0x312/0xcc0 fs/buffer.c:1298 sb_find_get_block include/linux/buffer_head.h:338 [inline] recently_deleted fs/ext4/ialloc.c:682 [inline] find_inode_bit.isra.0+0x202/0x510 fs/ext4/ialloc.c:722 __ext4_new_inode+0x14ad/0x52c0 fs/ext4/ialloc.c:914 ext4_symlink+0x3f8/0xbe0 fs/ext4/namei.c:3096 vfs_symlink fs/namei.c:4126 [inline] vfs_symlink+0x378/0x5d0 fs/namei.c:4112 do_symlinkat+0x22b/0x290 fs/namei.c:4153 __do_sys_symlink fs/namei.c:4172 [inline] __se_sys_symlink fs/namei.c:4170 [inline] __x64_sys_symlink+0x59/0x80 fs/namei.c:4170 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457b67 Code: 0f 1f 00 b8 5c 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 6d bb fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 58 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 4d bb fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fff045ce0f8 EFLAGS: 00000202 ORIG_RAX: 0000000000000058 RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 0000000000457b67 RDX: 00007fff045ce173 RSI: 00000000004bd63f RDI: 00007fff045ce160 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000013 R10: 0000000000000075 R11: 0000000000000202 R12: 0000000000000000 R13: 0000000000000001 R14: 000000000000029b R15: 0000000000000001 Allocated by task 24763: save_stack+0x45/0xd0 mm/kasan/common.c:73 set_track mm/kasan/common.c:85 [inline] __kasan_kmalloc mm/kasan/common.c:496 [inline] __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:469 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:504 kmem_cache_alloc_trace+0x151/0x760 mm/slab.c:3609 kmalloc include/linux/slab.h:545 [inline] mISDN_open+0x9a/0x270 drivers/isdn/mISDN/timerdev.c:59 misc_open+0x398/0x4c0 drivers/char/misc.c:141 chrdev_open+0x247/0x6b0 fs/char_dev.c:417 do_dentry_open+0x47d/0x1130 fs/open.c:771 vfs_open+0xa0/0xd0 fs/open.c:880 do_last fs/namei.c:3418 [inline] path_openat+0x10d7/0x4690 fs/namei.c:3534 do_filp_open+0x1a1/0x280 fs/namei.c:3564 do_sys_open+0x3fe/0x5d0 fs/open.c:1063 __do_sys_openat fs/open.c:1090 [inline] __se_sys_openat fs/open.c:1084 [inline] __x64_sys_openat+0x9d/0x100 fs/open.c:1084 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 24762: save_stack+0x45/0xd0 mm/kasan/common.c:73 set_track mm/kasan/common.c:85 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/common.c:458 kasan_slab_free+0xe/0x10 mm/kasan/common.c:466 __cache_free mm/slab.c:3487 [inline] kfree+0xcf/0x230 mm/slab.c:3806 mISDN_close+0x2a1/0x390 drivers/isdn/mISDN/timerdev.c:97 __fput+0x2df/0x8d0 fs/file_table.c:278 ____fput+0x16/0x20 fs/file_table.c:309 task_work_run+0x14a/0x1c0 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_usermode_loop+0x273/0x2c0 arch/x86/entry/common.c:166 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline] syscall_return_slowpath arch/x86/entry/common.c:268 [inline] do_syscall_64+0x52d/0x610 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff88809fc18900 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 72 bytes inside of 192-byte region [ffff88809fc18900, ffff88809fc189c0) The buggy address belongs to the page: page:ffffea00027f0600 count:1 mapcount:0 mapping:ffff88812c3f0040 index:0xffff88809fc18000 flags: 0x1fffc0000000200(slab) raw: 01fffc0000000200 ffffea000269f648 ffffea00029f7408 ffff88812c3f0040 raw: ffff88809fc18000 ffff88809fc18000 000000010000000b 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88809fc18800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88809fc18880: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88809fc18900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88809fc18980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff88809fc18a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Signed-off-by: Eric Dumazet Cc: Karsten Keil Reported-by: syzbot Signed-off-by: David S. Miller drivers/isdn/mISDN/timerdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 75c05a74e745ae7d663b04d75777af80ada2233c Author: Andrew Lunn Date: Wed Feb 6 00:02:58 2019 +0100 net: dsa: mv88e6xxx: Fix counting of ATU violations The ATU port vector contains a bit per port of the switch. The code wrongly used it as a port number, and incremented a port counter. This resulted in the wrong interfaces counter being incremented, and potentially going off the end of the array of ports. Fix this by using the source port ID for the violation, which really is a port number. Reported-by: Chris Healy Tested-by: Chris Healy Fixes: 65f60e4582bd ("net: dsa: mv88e6xxx: Keep ATU/VTU violation statistics") Signed-off-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx/global1_atu.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) commit bf78f133cd39e0ed41551150909e41513958a738 Author: Amit Kucheria Date: Mon Jan 21 15:12:23 2019 +0530 thermal: cpu_cooling: Clarify error message Make it clear that it is a failure if the cpufreq driver was unable to register as a cooling device. Makes it easier to find in logs and grepping for words like fail, err, warn. Signed-off-by: Amit Kucheria Acked-by: Viresh Kumar Signed-off-by: Eduardo Valentin drivers/thermal/cpu_cooling.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3079f340caa72a3707357c28e8653120757baeb1 Author: Amit Kucheria Date: Mon Jan 21 15:12:22 2019 +0530 thermal: of-thermal: Print name of device node with error Make it easier to debug devicetree definition in case of errors. Signed-off-by: Amit Kucheria Signed-off-by: Eduardo Valentin drivers/thermal/of-thermal.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 7fad8da1ae23171de0ea3cdb2c620f71eb2ab983 Author: Nicholas Kazlauskas Date: Thu Jan 31 13:58:21 2019 -0500 drm/amd/display: Attach VRR properties for eDP connectors [Why] eDP was missing in the checks for supported VRR connectors. [How] Attach the properties for eDP connectors too. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=202449 Signed-off-by: Nicholas Kazlauskas Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 6d3d8065bb14dcd3d36b63f81fff9bc7f4388bda Author: Nathan Chancellor Date: Mon Jan 21 16:52:15 2019 -0700 drm/amdkfd: Fix if preprocessor statement above kfd_fill_iolink_info_for_cpu Clang warns: drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_crat.c:866:5: warning: 'CONFIG_X86_64' is not defined, evaluates to 0 [-Wundef] ^ 1 warning generated. Fixes: d1c234e2cd10 ("drm/amdkfd: Allow building KFD on ARM64 (v2)") Signed-off-by: Nathan Chancellor Reviewed-by: Felix Kuehling Signed-off-by: Felix Kuehling Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdkfd/kfd_crat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0a5f49cbf9d6ad3721c16f8a6d823363ea7a160f Author: Philip Yang Date: Wed Jan 30 15:21:16 2019 -0500 drm/amdgpu: use spin_lock_irqsave to protect vm_manager.pasid_idr amdgpu_vm_get_task_info is called from interrupt handler and sched timeout workqueue, we should use irq version spin_lock to avoid deadlock. Signed-off-by: Philip Yang Reviewed-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit ad4635153034c20c6f6e211e2ed3fd38b658649a Author: Boris Brezillon Date: Wed Jan 30 12:55:52 2019 +0100 mtd: Make sure mtd->erasesize is valid even if the partition is of size 0 Commit 33f45c44d68b ("mtd: Do not allow MTD devices with inconsistent erase properties") introduced a check to make sure ->erasesize and ->_erase values are consistent with the MTD_NO_ERASE flag. This patch did not take the 0 bytes partition case into account which can happen when the defined partition is outside the flash device memory range. Fix that by setting the partition erasesize to the parent erasesize. Fixes: 33f45c44d68b ("mtd: Do not allow MTD devices with inconsistent erase properties") Reported-by: Geert Uytterhoeven Cc: Cc: Geert Uytterhoeven Signed-off-by: Boris Brezillon Tested-by: Geert Uytterhoeven drivers/mtd/mtdpart.c | 4 ++++ 1 file changed, 4 insertions(+) commit 9c0bda64abb880f5b93418af768dd7dde4e238fe Merge: f09bef61f1ed 1651925d403e Author: David S. Miller Date: Tue Feb 5 13:36:18 2019 -0800 Merge tag 'mlx5-fixes-2019-02-05' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux mlx5-fixes-2019-02-05 commit 4f2ab5e1d13d6aa77c55f4914659784efd776eb4 Author: Charles Keepax Date: Tue Feb 5 16:29:40 2019 +0000 ALSA: compress: Fix stop handling on compressed capture streams It is normal user behaviour to start, stop, then start a stream again without closing it. Currently this works for compressed playback streams but not capture ones. The states on a compressed capture stream go directly from OPEN to PREPARED, unlike a playback stream which moves to SETUP and waits for a write of data before moving to PREPARED. Currently however, when a stop is sent the state is set to SETUP for both types of streams. This leaves a capture stream in the situation where a new start can't be sent as that requires the state to be PREPARED and a new set_params can't be sent as that requires the state to be OPEN. The only option being to close the stream, and then reopen. Correct this issues by allowing snd_compr_drain_notify to set the state depending on the stream direction, as we already do in set_params. Fixes: 49bb6402f1aa ("ALSA: compress_core: Add support for capture streams") Signed-off-by: Charles Keepax Cc: Signed-off-by: Takashi Iwai include/sound/compress_driver.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 9c0644ee4aa8792f1e60a2b014b4710faaddafeb Author: Michael S. Tsirkin Date: Fri Feb 1 17:13:57 2019 -0500 virtio: drop internal struct from UAPI There's no reason to expose struct vring_packed in UAPI - if we do we won't be able to change or drop it, and it's not part of any interface. Let's move it to virtio_ring.c Cc: Tiwei Bie Signed-off-by: Michael S. Tsirkin drivers/virtio/virtio_ring.c | 7 ++++++- include/uapi/linux/virtio_ring.h | 10 ---------- 2 files changed, 6 insertions(+), 11 deletions(-) commit 1651925d403e077e3fc86f961905e27c6810e132 Author: Guy Shattah Date: Mon Jan 28 13:58:07 2019 +0000 net/mlx5e: Use the inner headers to determine tc/pedit offload limitation on decap flows In packets that need to be decaped the internal headers have to be checked, not the external ones. Fixes: bdd66ac0aeed ("net/mlx5e: Disallow TC offloading of unsupported match/action combinations") Signed-off-by: Guy Shattah Reviewed-by: Or Gerlitz Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) commit 6363651d6dd79694d586f4ae68967036dd14bc3a Author: Or Gerlitz Date: Thu Jan 10 20:37:36 2019 +0200 net/mlx5e: Properly set steering match levels for offloaded TC decap rules The match level computed by the driver gets to be wrong for decap rules with wildcarded inner packet match such as: tc filter add dev vxlan_sys_4789 protocol all parent ffff: prio 2 flower enc_dst_ip 192.168.0.9 enc_key_id 100 enc_dst_port 4789 action tunnel_key unset action mirred egress redirect dev eth1 The FW errs for a missing matching meta-data indicator for the outer headers (where we do have a match), and a wrong matching meta-data indicator for the inner headers (where we don't have a match). Fix that by taking into account the matching on the tunnel info and relating the match level of the encapsulated packet to the firmware inner headers indicator in case of decap. As for vxlan we mandate a match on the tunnel udp dst port, and in general we practically madndate a match on the source or dest ip for any IP tunnel, the fix was done in a minimal manner around the tunnel match parsing code. Fixes: d708f902989b ('net/mlx5e: Get the required HW match level while parsing TC flow matches') Signed-off-by: Or Gerlitz Reported-by: Slava Ovsiienko Reviewed-by: Jianbo Liu Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c | 4 +++- drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.h | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 18 ++++++++++-------- drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 1 + .../net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 17 +++++++++-------- 5 files changed, 24 insertions(+), 18 deletions(-) commit 82eaa1fa0448da1852d7b80832e67e80a08dcc27 Author: Raed Salem Date: Mon Dec 17 11:40:06 2018 +0200 net/mlx5e: FPGA, fix Innova IPsec TX offload data path performance At Innova IPsec TX offload data path a special software parser metadata is used to pass some packet attributes to the hardware, this metadata is passed using the Ethernet control segment of a WQE (a HW descriptor) header. The cited commit might nullify this header, hence the metadata is lost, this caused a significant performance drop during hw offloading operation. Fix by restoring the metadata at the Ethernet control segment in case it was nullified. Fixes: 37fdffb217a4 ("net/mlx5: WQ, fixes for fragmented WQ buffers API") Signed-off-by: Raed Salem Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 6 ++++++ 1 file changed, 6 insertions(+) commit f09bef61f1ed72869b231e5cff16e73a06505cfb Merge: c8101f7729da 947e492c0fc2 Author: David S. Miller Date: Tue Feb 5 11:23:23 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Use CONFIG_NF_TABLES_INET from seltests, not NF_TABLES_INET. From Naresh Kamboju. 2) Add a test to cover masquerading and redirect case, from Florian Westphal. 3) Two packets coming from the same socket may race to set up NAT, ending up with different tuples and the packet losing race being dropped. Update nf_conntrack_tuple_taken() to exercise clash resolution for this case. From Martynas Pumputis and Florian Westphal. 4) Unbind anonymous sets from the commit and abort path, this fixes a splat due to double set list removal/release in case that the transaction needs to be aborted. 5) Do not preserve original output interface for packets that are redirected in the output chain when ip6_route_me_harder() is called. Otherwise packets end up going not going to the loopback device. From Eli Cooper. 6) Fix bogus splat in nft_compat with CONFIG_REFCOUNT_FULL=y, this also simplifies the existing logic to deal with the list insertions of the xtables extensions. From Florian Westphal. Diffstat look rather larger than usual because of the new selftest, but Florian and I consider that having tests soon into the tree is good to improve coverage. If there's a different policy in this regard, please, let me know. ==================== Signed-off-by: David S. Miller commit 3bff2407fbd28fd55ad5b5cccd98fc0c9598f23b Author: Udo Eberhardt Date: Tue Feb 5 17:20:47 2019 +0100 ALSA: usb-audio: Add support for new T+A USB DAC This patch adds the T+A VID to the generic check in order to enable native DSD support for T+A devices. This works with the new T+A USB DAC model SD3100HV and will also work with future devices which support the XMOS/Thesycon style DSD format. Signed-off-by: Udo Eberhardt Cc: Signed-off-by: Takashi Iwai sound/usb/quirks.c | 1 + 1 file changed, 1 insertion(+) commit a692933a87691681e880feb708081681ff32400a Author: Eric W. Biederman Date: Tue Feb 5 07:19:11 2019 -0600 signal: Always attempt to allocate siginfo for SIGSTOP Since 2.5.34 the code has had the potential to not allocate siginfo for SIGSTOP signals. Except for ptrace this is perfectly fine as only ptrace can use PTRACE_PEEK_SIGINFO and see what the contents of the delivered siginfo are. Users of PTRACE_PEEK_SIGINFO that care about the contents siginfo for SIGSTOP are rare, but they do exist. A seccomp self test has cared and lldb cares. Jack Andersen writes: > The patch titled > `signal: Never allocate siginfo for SIGKILL or SIGSTOP` > created a regression for users of PTRACE_GETSIGINFO needing to > discern signals that were raised via the tgkill syscall. > > A notable user of this tgkill+ptrace combination is lldb while > debugging a multithreaded program. Without the ability to detect a > SIGSTOP originating from tgkill, lldb does not have a way to > synchronize on a per-thread basis and falls back to SIGSTOP-ing the > entire process. Everyone affected by this please note. The kernel can still fail to allocate a siginfo structure. The allocation is with GFP_KERNEL and is best effort only. If memory is tight when the signal allocation comes in this will fail to allocate a siginfo. So I strongly recommend looking at more robust solutions for synchronizing with a single thread such as PTRACE_INTERRUPT. Or if that does not work persuading your friendly local kernel developer to build the interface you need. Reported-by: Tycho Andersen Reported-by: Kees Cook Reported-by: Jack Andersen Acked-by: Linus Torvalds Reviewed-by: Christian Brauner Cc: stable@vger.kernel.org Fixes: f149b3155744 ("signal: Never allocate siginfo for SIGKILL or SIGSTOP") Fixes: 6dfc88977e42 ("[PATCH] shared thread signals") History Tree: https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git Signed-off-by: "Eric W. Biederman" kernel/signal.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 8f2f350cbdb2c2fbff654cb778139144b48a59ba Author: Tony Jones Date: Wed Jan 23 16:52:29 2019 -0800 perf script python: Add Python3 support to tests/attr.py Support both Python 2 and Python 3 in tests/attr.py The use of "except as" syntax implies the minimum supported Python2 version is now v2.6 Committer testing: $ make -C tools/perf PYTHON3=python install-bin Before: # perf test attr 16: Setup struct perf_event_attr : FAILED! 48: Synthesize attr update : Ok [root@quaco ~]# perf test -v attr 16: Setup struct perf_event_attr : --- start --- test child forked, pid 3121 File "/home/acme/libexec/perf-core/tests/attr.py", line 324 except Unsup, obj: ^ SyntaxError: invalid syntax test child finished with -1 ---- end ---- Setup struct perf_event_attr: FAILED! 48: Synthesize attr update : --- start --- test child forked, pid 3124 test child finished with 0 ---- end ---- Synthesize attr update: Ok # After: # perf test attr 16: Setup struct perf_event_attr : Ok 48: Synthesize attr update : Ok # Signed-off-by: Tony Jones Acked-by: Jiri Olsa Tested-by: Arnaldo Carvalho de Melo Cc: Jonathan Corbet Cc: Ravi Bangoria Cc: Seeteena Thoufeek Link: http://lkml.kernel.org/r/20190124005229.16146-7-tonyj@suse.de Signed-off-by: Arnaldo Carvalho de Melo tools/perf/tests/attr.py | 32 +++++++++++++++++++------------- 1 file changed, 19 insertions(+), 13 deletions(-) commit 2a121030d4ee3f84f60c6f415f9c44bffbcde81d Author: Lucas De Marchi Date: Fri Jan 25 14:24:42 2019 -0800 drm/i915: always return something on DDI clock selection Even if we don't have the correct clock and get a warning, we should not skip the return. v2: improve commit message (from Joonas) Fixes: 1fa11ee2d9d0 ("drm/i915/icl: start adding the TBT pll") Cc: Paulo Zanoni Cc: # v4.19+ Signed-off-by: Lucas De Marchi Reviewed-by: Mika Kahola Link: https://patchwork.freedesktop.org/patch/msgid/20190125222444.19926-3-lucas.demarchi@intel.com (cherry picked from commit 7a61a6dec3dfb9f2e8c39a337580a3c3036c5cdf) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_ddi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3e0b69bbed7161eee8702eee5dcdc18afc1dc982 Author: Ville Syrjälä Date: Fri Jan 25 20:38:46 2019 +0200 drm/i915: Fix skl srckey mask bits We're incorrectly masking off the R/V channel enable bit from KEYMSK. Fix it up. Cc: Maarten Lankhorst Cc: Matt Roper Fixes: b20815255693 ("drm/i915: Add plane alpha blending support, v2.") Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20190125183846.28755-1-ville.syrjala@linux.intel.com Reviewed-by: Matt Roper (cherry picked from commit 968bf969b47df2481022b9a05eaab02948eec088) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_sprite.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 947e492c0fc2132ae5fca081a9c2952ccaab0404 Author: Florian Westphal Date: Tue Feb 5 12:16:18 2019 +0100 netfilter: nft_compat: don't use refcount_inc on newly allocated entry When I moved the refcount to refcount_t type I missed the fact that refcount_inc() will result in use-after-free warning with CONFIG_REFCOUNT_FULL=y builds. The correct fix would be to init the reference count to 1 at allocation time, but, unfortunately we cannot do this, as we can't undo that in case something else fails later in the batch. So only solution I see is to special-case the 'new entry' condition and replace refcount_inc() with a "delayed" refcount_set(1) in this case, as done here. The .activate callback can be removed to simplify things, we only need to make sure that deactivate() decrements/unlinks the entry from the list at end of transaction phase (commit or abort). Fixes: 12c44aba6618 ("netfilter: nft_compat: use refcnt_t type for nft_xt reference count") Reported-by: Jordan Glover Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/netfilter/nft_compat.c | 62 +++++++++++++++++----------------------------- 1 file changed, 23 insertions(+), 39 deletions(-) commit 15df03c661cb362366ecfc3a21820cb934f3e4ca Author: Eli Cooper Date: Mon Jan 21 18:45:27 2019 +0800 netfilter: ipv6: Don't preserve original oif for loopback address Commit 508b09046c0f ("netfilter: ipv6: Preserve link scope traffic original oif") made ip6_route_me_harder() keep the original oif for link-local and multicast packets. However, it also affected packets for the loopback address because it used rt6_need_strict(). REDIRECT rules in the OUTPUT chain rewrite the destination to loopback address; thus its oif should not be preserved. This commit fixes the bug that redirected local packets are being dropped. Actually the packet was not exactly dropped; Instead it was sent out to the original oif rather than lo. When a packet with daddr ::1 is sent to the router, it is effectively dropped. Fixes: 508b09046c0f ("netfilter: ipv6: Preserve link scope traffic original oif") Signed-off-by: Eli Cooper Signed-off-by: Pablo Neira Ayuso net/ipv6/netfilter.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 9ddac734aa310c5fbc0ec93602335d2a39092451 Author: Thomas Hellstrom Date: Thu Jan 17 14:34:52 2019 +0100 drm/vmwgfx: Improve on IOMMU detection instead of relying on intel_iommu_enabled, use the fact that the dma_map_ops::map_page != dma_direct_map_page. Signed-off-by: Thomas Hellstrom Reviewed-by: Deepak Rawat drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) commit 4cbfa1e6c09e98450aab3240e5119b0ab2c9795b Author: Thomas Hellstrom Date: Mon Jan 28 10:31:33 2019 +0100 drm/vmwgfx: Fix setting of dma masks Previously we set only the dma mask and not the coherent mask. Fix that. Also, for clarity, make sure both are initially set to 64 bits. Cc: Fixes: 0d00c488f3de: ("drm/vmwgfx: Fix the driver for large dma addresses") Signed-off-by: Thomas Hellstrom Reviewed-by: Deepak Rawat drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 479d59026fe44f89fa67efa01a4d47e00808e688 Author: Deepak Rawat Date: Fri Dec 21 14:38:35 2018 -0800 drm/vmwgfx: Also check for crtc status while checking for DU active During modeset check it is possible to have all crtc_state's in atomic state. Check for crtc enable status while checking for display unit active status. Only error if enabling a crtc while display unit is not active. Cc: Fixes: 9da6e26c0aae: ("drm/vmwgfx: Fix a layout race condition") Signed-off-by: Deepak Rawat Reviewed-by: Thomas Hellstrom Signed-off-by: Thomas Hellstrom drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 51fdbeb4ca1a8415c98f87cb877956ae83e71627 Author: Thomas Hellstrom Date: Thu Jan 31 10:52:21 2019 +0100 drm/vmwgfx: Fix an uninitialized fence handle value if vmw_execbuf_fence_commands() fails, The handle value will be uninitialized and a bogus fence handle might be copied to user-space. Cc: Fixes: 2724b2d54cda: ("drm/vmwgfx: Use new validation interface for the modesetting code v2") Reported-by: Dan Carpenter Signed-off-by: Thomas Hellstrom Reviewed-by: Brian Paul #v1 Reviewed-by: Sinclair Yeh #v1 Reviewed-by: Deepak Rawat drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 728354c005c36eaf44b6e5552372b67e60d17f56 Author: Thomas Hellstrom Date: Thu Jan 31 10:55:37 2019 +0100 drm/vmwgfx: Return error code from vmw_execbuf_copy_fence_user The function was unconditionally returning 0, and a caller would have to rely on the returned fence pointer being NULL to detect errors. However, the function vmw_execbuf_copy_fence_user() would expect a non-zero error code in that case and would BUG otherwise. So make sure we return a proper non-zero error code if the fence pointer returned is NULL. Cc: Fixes: ae2a104058e2: ("vmwgfx: Implement fence objects") Signed-off-by: Thomas Hellstrom Reviewed-by: Deepak Rawat drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c6e2bd956936d925748581e4d0294f10f1d92f2c Author: Tony Lindgren Date: Thu Jan 10 07:59:16 2019 -0800 i2c: omap: Use noirq system sleep pm ops to idle device for suspend We currently get the following error with pixcir_ts driver during a suspend resume cycle: omap_i2c 4802a000.i2c: controller timed out pixcir_ts 1-005c: pixcir_int_enable: can't read reg 0x34 : -110 pixcir_ts 1-005c: Failed to disable interrupt generation: -110 pixcir_ts 1-005c: Failed to stop dpm_run_callback(): pixcir_i2c_ts_resume+0x0/0x98 [pixcir_i2c_ts] returns -110 PM: Device 1-005c failed to resume: error -110 And at least am437x based devices with pixcir_ts will fail to resume to a touchscreen that is configured as the wakeup-source in device tree for these devices. This is because pixcir_ts tries to reconfigure it's registers for noirq suspend which fails. This also leaves i2c-omap in enabled state for suspend. Let's fix the pixcir_ts issue and make sure i2c-omap is suspended by adding SET_NOIRQ_SYSTEM_SLEEP_PM_OPS. Let's also get rid of some ifdefs while at it and replace them with __maybe_unused as SET_RUNTIME_PM_OPS and SET_NOIRQ_SYSTEM_SLEEP_PM_OPS already deal with the various PM Kconfig options. Reported-by: Keerthy Signed-off-by: Tony Lindgren Acked-by: Vignesh R Signed-off-by: Wolfram Sang drivers/i2c/busses/i2c-omap.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) commit ea5736805190e912903c27c9f17c7a4341a405e9 Author: Jean-Philippe Brucker Date: Fri Feb 1 16:26:08 2019 +0000 arm64: kexec_file: handle empty command-line Calling strlen() on cmdline == NULL produces a kernel oops. Since having a NULL cmdline is valid, handle this case explicitly. Fixes: 52b2a8af7436 ("arm64: kexec_file: load initrd and device-tree") Signed-off-by: Jean-Philippe Brucker Signed-off-by: Will Deacon arch/arm64/kernel/machine_kexec_file.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit f75a2804da391571563c4b6b29e7797787332673 Author: Cong Wang Date: Thu Jan 31 13:05:49 2019 -0800 xfrm: destroy xfrm_state synchronously on net exit path xfrm_state_put() moves struct xfrm_state to the GC list and schedules the GC work to clean it up. On net exit call path, xfrm_state_flush() is called to clean up and xfrm_flush_gc() is called to wait for the GC work to complete before exit. However, this doesn't work because one of the ->destructor(), ipcomp_destroy(), schedules the same GC work again inside the GC work. It is hard to wait for such a nested async callback. This is also why syzbot still reports the following warning: WARNING: CPU: 1 PID: 33 at net/ipv6/xfrm6_tunnel.c:351 xfrm6_tunnel_net_exit+0x2cb/0x500 net/ipv6/xfrm6_tunnel.c:351 ... ops_exit_list.isra.0+0xb0/0x160 net/core/net_namespace.c:153 cleanup_net+0x51d/0xb10 net/core/net_namespace.c:551 process_one_work+0xd0c/0x1ce0 kernel/workqueue.c:2153 worker_thread+0x143/0x14a0 kernel/workqueue.c:2296 kthread+0x357/0x430 kernel/kthread.c:246 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 In fact, it is perfectly fine to bypass GC and destroy xfrm_state synchronously on net exit call path, because it is in process context and doesn't need a work struct to do any blocking work. This patch introduces xfrm_state_put_sync() which simply bypasses GC, and lets its callers to decide whether to use this synchronous version. On net exit path, xfrm_state_fini() and xfrm6_tunnel_net_exit() use it. And, as ipcomp_destroy() itself is blocking, it can use xfrm_state_put_sync() directly too. Also rename xfrm_state_gc_destroy() to ___xfrm_state_destroy() to reflect this change. Fixes: b48c05ab5d32 ("xfrm: Fix warning in xfrm6_tunnel_net_exit.") Reported-and-tested-by: syzbot+e9aebef558e3ed673934@syzkaller.appspotmail.com Cc: Steffen Klassert Signed-off-by: Cong Wang Signed-off-by: Steffen Klassert include/net/xfrm.h | 12 +++++++++--- net/ipv6/xfrm6_tunnel.c | 2 +- net/key/af_key.c | 2 +- net/xfrm/xfrm_state.c | 30 +++++++++++++++++++----------- net/xfrm/xfrm_user.c | 2 +- 5 files changed, 31 insertions(+), 17 deletions(-) commit bb61b843ffd46978d7ca5095453e572714934eeb Author: Vaibhav Jain Date: Wed Jan 30 17:56:51 2019 +0530 scsi: cxlflash: Prevent deadlock when adapter probe fails Presently when an error is encountered during probe of the cxlflash adapter, a deadlock is seen with cpu thread stuck inside cxlflash_remove(). Below is the trace of the deadlock as logged by khungtaskd: cxlflash 0006:00:00.0: cxlflash_probe: init_afu failed rc=-16 INFO: task kworker/80:1:890 blocked for more than 120 seconds. Not tainted 5.0.0-rc4-capi2-kexec+ #2 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. kworker/80:1 D 0 890 2 0x00000808 Workqueue: events work_for_cpu_fn Call Trace: 0x4d72136320 (unreliable) __switch_to+0x2cc/0x460 __schedule+0x2bc/0xac0 schedule+0x40/0xb0 cxlflash_remove+0xec/0x640 [cxlflash] cxlflash_probe+0x370/0x8f0 [cxlflash] local_pci_probe+0x6c/0x140 work_for_cpu_fn+0x38/0x60 process_one_work+0x260/0x530 worker_thread+0x280/0x5d0 kthread+0x1a8/0x1b0 ret_from_kernel_thread+0x5c/0x80 INFO: task systemd-udevd:5160 blocked for more than 120 seconds. The deadlock occurs as cxlflash_remove() is called from cxlflash_probe() without setting 'cxlflash_cfg->state' to STATE_PROBED and the probe thread starts to wait on 'cxlflash_cfg->reset_waitq'. Since the device was never successfully probed the 'cxlflash_cfg->state' never changes from STATE_PROBING hence the deadlock occurs. We fix this deadlock by setting the variable 'cxlflash_cfg->state' to STATE_PROBED in case an error occurs during cxlflash_probe() and just before calling cxlflash_remove(). Cc: stable@vger.kernel.org Fixes: c21e0bbfc485("cxlflash: Base support for IBM CXL Flash Adapter") Signed-off-by: Vaibhav Jain Signed-off-by: Martin K. Petersen drivers/scsi/cxlflash/main.c | 2 ++ 1 file changed, 2 insertions(+) commit d8f6382a7d026989029e2e50c515df954488459b Author: Ross Lagerwall Date: Fri Feb 1 14:42:28 2019 +0000 Revert "scsi: libfc: Add WARN_ON() when deleting rports" This reverts commit bbc0f8bd88abefb0f27998f40a073634a3a2db89. It added a warning whose intent was to check whether the rport was still linked into the peer list. It doesn't work as intended and gives false positive warnings for two reasons: 1) If the rport is never linked into the peer list it will not be considered empty since the list_head is never initialized. 2) If the rport is deleted from the peer list using list_del_rcu(), then the list_head is in an undefined state and it is not considered empty. Signed-off-by: Ross Lagerwall Reviewed-by: Hannes Reinecke Signed-off-by: Martin K. Petersen drivers/scsi/libfc/fc_rport.c | 1 - 1 file changed, 1 deletion(-) commit 88fc41c407158a7d2eaa4b2f7cfa289749d456c6 Author: Damien Le Moal Date: Wed Jan 30 15:54:58 2019 +0900 scsi: sd_zbc: Fix zone information messages Commit bf5054569653 ("block: Introduce blk_revalidate_disk_zones()") inadvertently broke the message output of sd_zbc_print_zones() because the zone information initialization of the scsi disk structure was moved to the second scan run while sd_zbc_print_zones() is called on the first scan. This leads to the following incorrect message to be printed for any ZBC or ZAC zoned disks. "...[sdX] 4294967295 zones of 0 logical blocks + 1 runt zone" Fix this by initializing sdkp zone size and number of zones early on the first scan. This does not impact the execution of blk_revalidate_zones(). This functions is still called only once the block device capacity is set on the second revalidate run on boot, or if the disk zone configuration changed (i.e. the disk changed). Fixes: bf5054569653 ("block: Introduce blk_revalidate_disk_zones()") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Signed-off-by: Martin K. Petersen drivers/scsi/sd_zbc.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) commit b6cd7f34ba1354498de03e6882c33f935b071e99 Author: David Disseldorp Date: Mon Feb 4 19:32:10 2019 +0100 scsi: target: make the pi_prot_format ConfigFS path readable pi_prot_format conversion to write-only caused userspace breakage. Make the ConfigFS path readable again and hardcode the "0\n" content, matching previous output. Fixes: 6baca7601bde ("scsi: target: drop unused pi_prot_format attribute storage") Link: https://bugzilla.redhat.com/show_bug.cgi?id=1667505 Reported-by: Lee Duncan Reported-by: Laura Abbott Reviewed-by: Bart Van Assche Signed-off-by: David Disseldorp Signed-off-by: Martin K. Petersen drivers/target/target_core_configfs.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit c8101f7729daee251f4f6505f9d135ec08e1342f Author: Marc Zyngier Date: Sat Feb 2 17:53:29 2019 +0000 net: dsa: Fix lockdep false positive splat Creating a macvtap on a DSA-backed interface results in the following splat when lockdep is enabled: [ 19.638080] IPv6: ADDRCONF(NETDEV_CHANGE): lan0: link becomes ready [ 23.041198] device lan0 entered promiscuous mode [ 23.043445] device eth0 entered promiscuous mode [ 23.049255] [ 23.049557] ============================================ [ 23.055021] WARNING: possible recursive locking detected [ 23.060490] 5.0.0-rc3-00013-g56c857a1b8d3 #118 Not tainted [ 23.066132] -------------------------------------------- [ 23.071598] ip/2861 is trying to acquire lock: [ 23.076171] 00000000f61990cb (_xmit_ETHER){+...}, at: dev_set_rx_mode+0x1c/0x38 [ 23.083693] [ 23.083693] but task is already holding lock: [ 23.089696] 00000000ecf0c3b4 (_xmit_ETHER){+...}, at: dev_uc_add+0x24/0x70 [ 23.096774] [ 23.096774] other info that might help us debug this: [ 23.103494] Possible unsafe locking scenario: [ 23.103494] [ 23.109584] CPU0 [ 23.112093] ---- [ 23.114601] lock(_xmit_ETHER); [ 23.117917] lock(_xmit_ETHER); [ 23.121233] [ 23.121233] *** DEADLOCK *** [ 23.121233] [ 23.127325] May be due to missing lock nesting notation [ 23.127325] [ 23.134315] 2 locks held by ip/2861: [ 23.137987] #0: 000000003b766c72 (rtnl_mutex){+.+.}, at: rtnetlink_rcv_msg+0x338/0x4e0 [ 23.146231] #1: 00000000ecf0c3b4 (_xmit_ETHER){+...}, at: dev_uc_add+0x24/0x70 [ 23.153757] [ 23.153757] stack backtrace: [ 23.158243] CPU: 0 PID: 2861 Comm: ip Not tainted 5.0.0-rc3-00013-g56c857a1b8d3 #118 [ 23.166212] Hardware name: Globalscale Marvell ESPRESSOBin Board (DT) [ 23.172843] Call trace: [ 23.175358] dump_backtrace+0x0/0x188 [ 23.179116] show_stack+0x14/0x20 [ 23.182524] dump_stack+0xb4/0xec [ 23.185928] __lock_acquire+0x123c/0x1860 [ 23.190048] lock_acquire+0xc8/0x248 [ 23.193724] _raw_spin_lock_bh+0x40/0x58 [ 23.197755] dev_set_rx_mode+0x1c/0x38 [ 23.201607] dev_set_promiscuity+0x3c/0x50 [ 23.205820] dsa_slave_change_rx_flags+0x5c/0x70 [ 23.210567] __dev_set_promiscuity+0x148/0x1e0 [ 23.215136] __dev_set_rx_mode+0x74/0x98 [ 23.219167] dev_uc_add+0x54/0x70 [ 23.222575] macvlan_open+0x170/0x1d0 [ 23.226336] __dev_open+0xe0/0x160 [ 23.229830] __dev_change_flags+0x16c/0x1b8 [ 23.234132] dev_change_flags+0x20/0x60 [ 23.238074] do_setlink+0x2d0/0xc50 [ 23.241658] __rtnl_newlink+0x5f8/0x6e8 [ 23.245601] rtnl_newlink+0x50/0x78 [ 23.249184] rtnetlink_rcv_msg+0x360/0x4e0 [ 23.253397] netlink_rcv_skb+0xe8/0x130 [ 23.257338] rtnetlink_rcv+0x14/0x20 [ 23.261012] netlink_unicast+0x190/0x210 [ 23.265043] netlink_sendmsg+0x288/0x350 [ 23.269075] sock_sendmsg+0x18/0x30 [ 23.272659] ___sys_sendmsg+0x29c/0x2c8 [ 23.276602] __sys_sendmsg+0x60/0xb8 [ 23.280276] __arm64_sys_sendmsg+0x1c/0x28 [ 23.284488] el0_svc_common+0xd8/0x138 [ 23.288340] el0_svc_handler+0x24/0x80 [ 23.292192] el0_svc+0x8/0xc This looks fairly harmless (no actual deadlock occurs), and is fixed in a similar way to c6894dec8ea9 ("bridge: fix lockdep addr_list_lock false positive splat") by putting the addr_list_lock in its own lockdep class. Signed-off-by: Marc Zyngier Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller net/dsa/master.c | 4 ++++ 1 file changed, 4 insertions(+) commit 17ab4f61b8cd6f9c38e9d0b935d86d73b5d0d2b5 Author: Rundong Ge Date: Sat Feb 2 14:29:35 2019 +0000 net: dsa: slave: Don't propagate flag changes on down slave interfaces The unbalance of master's promiscuity or allmulti will happen after ifdown and ifup a slave interface which is in a bridge. When we ifdown a slave interface , both the 'dsa_slave_close' and 'dsa_slave_change_rx_flags' will clear the master's flags. The flags of master will be decrease twice. In the other hand, if we ifup the slave interface again, since the slave's flags were cleared the 'dsa_slave_open' won't set the master's flag, only 'dsa_slave_change_rx_flags' that triggered by 'br_add_if' will set the master's flags. The flags of master is increase once. Only propagating flag changes when a slave interface is up makes sure this does not happen. The 'vlan_dev_change_rx_flags' had the same problem and was fixed, and changes here follows that fix. Fixes: 91da11f870f0 ("net: Distributed Switch Architecture protocol support") Signed-off-by: Rundong Ge Signed-off-by: David S. Miller net/dsa/slave.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) commit 48396e80fb6526ea5ed267bd84f028bae56d2f9e Author: Bart Van Assche Date: Wed Jan 30 14:05:55 2019 -0800 RDMA/srp: Rework SCSI device reset handling Since .scsi_done() must only be called after scsi_queue_rq() has finished, make sure that the SRP initiator driver does not call .scsi_done() while scsi_queue_rq() is in progress. Although invoking sg_reset -d while I/O is in progress works fine with kernel v4.20 and before, that is not the case with kernel v5.0-rc1. This patch avoids that the following crash is triggered with kernel v5.0-rc1: BUG: unable to handle kernel NULL pointer dereference at 0000000000000138 CPU: 0 PID: 360 Comm: kworker/0:1H Tainted: G B 5.0.0-rc1-dbg+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 Workqueue: kblockd blk_mq_run_work_fn RIP: 0010:blk_mq_dispatch_rq_list+0x116/0xb10 Call Trace: blk_mq_sched_dispatch_requests+0x2f7/0x300 __blk_mq_run_hw_queue+0xd6/0x180 blk_mq_run_work_fn+0x27/0x30 process_one_work+0x4f1/0xa20 worker_thread+0x67/0x5b0 kthread+0x1cf/0x1f0 ret_from_fork+0x24/0x30 Cc: Fixes: 94a9174c630c ("IB/srp: reduce lock coverage of command completion") Signed-off-by: Bart Van Assche Signed-off-by: Jason Gunthorpe drivers/infiniband/ulp/srp/ib_srp.c | 10 ---------- 1 file changed, 10 deletions(-) commit 2b424cfc69728224fcb5fad138ea7260728e0901 Author: Jun-Ru Chang Date: Tue Jan 29 11:56:07 2019 +0800 MIPS: Remove function size check in get_frame_info() Patch (b6c7a324df37b "MIPS: Fix get_frame_info() handling of microMIPS function size.") introduces additional function size check for microMIPS by only checking insn between ip and ip + func_size. However, func_size in get_frame_info() is always 0 if KALLSYMS is not enabled. This causes get_frame_info() to return immediately without calculating correct frame_size, which in turn causes "Can't analyze schedule() prologue" warning messages at boot time. This patch removes func_size check, and let the frame_size check run up to 128 insns for both MIPS and microMIPS. Signed-off-by: Jun-Ru Chang Signed-off-by: Tony Wu Signed-off-by: Paul Burton Fixes: b6c7a324df37b ("MIPS: Fix get_frame_info() handling of microMIPS function size.") Cc: Cc: Cc: Cc: Cc: Cc: Cc: Cc: arch/mips/kernel/process.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit 047f2d941b8b24cadd6a4a09e606b7f41188ba3e Author: Paul Burton Date: Mon Feb 4 19:53:53 2019 +0000 MIPS: Use lower case for addresses in nexys4ddr.dts DTC introduced an i2c_bus_reg check in v1.4.7, used since Linux v4.20, which complains about upper case addresses used in the unit name. nexys4ddr.dts names an I2C device node "ad7420@4B", leading to: arch/mips/boot/dts/xilfpga/nexys4ddr.dts:109.16-112.8: Warning (i2c_bus_reg): /i2c@10A00000/ad7420@4B: I2C bus unit address format error, expected "4b" Fix this by switching to lower case addresses throughout the file, as is *mostly* the case in the file already & fairly standard throughout the tree. Signed-off-by: Paul Burton Cc: stable@vger.kernel.org # v4.20+ Cc: linux-mips@vger.kernel.org arch/mips/boot/dts/xilfpga/nexys4ddr.dts | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit e02e07e3127d8aec1f4bcdfb2fc52a2d99b4859e Author: Huacai Chen Date: Tue Jan 15 16:04:54 2019 +0800 MIPS: Loongson: Introduce and use loongson_llsc_mb() On the Loongson-2G/2H/3A/3B there is a hardware flaw that ll/sc and lld/scd is very weak ordering. We should add sync instructions "before each ll/lld" and "at the branch-target between ll/sc" to workaround. Otherwise, this flaw will cause deadlock occasionally (e.g. when doing heavy load test with LTP). Below is the explaination of CPU designer: "For Loongson 3 family, when a memory access instruction (load, store, or prefetch)'s executing occurs between the execution of LL and SC, the success or failure of SC is not predictable. Although programmer would not insert memory access instructions between LL and SC, the memory instructions before LL in program-order, may dynamically executed between the execution of LL/SC, so a memory fence (SYNC) is needed before LL/LLD to avoid this situation. Since Loongson-3A R2 (3A2000), we have improved our hardware design to handle this case. But we later deduce a rarely circumstance that some speculatively executed memory instructions due to branch misprediction between LL/SC still fall into the above case, so a memory fence (SYNC) at branch-target (if its target is not between LL/SC) is needed for Loongson 3A1000, 3B1500, 3A2000 and 3A3000. Our processor is continually evolving and we aim to to remove all these workaround-SYNCs around LL/SC for new-come processor." Here is an example: Both cpu1 and cpu2 simutaneously run atomic_add by 1 on same atomic var, this bug cause both 'sc' run by two cpus (in atomic_add) succeed at same time('sc' return 1), and the variable is only *added by 1*, sometimes, which is wrong and unacceptable(it should be added by 2). Why disable fix-loongson3-llsc in compiler? Because compiler fix will cause problems in kernel's __ex_table section. This patch fix all the cases in kernel, but: +. the fix at the end of futex_atomic_cmpxchg_inatomic is for branch-target of 'bne', there other cases which smp_mb__before_llsc() and smp_llsc_mb() fix the ll and branch-target coincidently such as atomic_sub_if_positive/ cmpxchg/xchg, just like this one. +. Loongson 3 does support CONFIG_EDAC_ATOMIC_SCRUB, so no need to touch edac.h +. local_ops and cmpxchg_local should not be affected by this bug since only the owner can write. +. mips_atomic_set for syscall.c is deprecated and rarely used, just let it go Signed-off-by: Huacai Chen Signed-off-by: Huang Pei [paul.burton@mips.com: - Simplify the addition of -mno-fix-loongson3-llsc to cflags, and add a comment describing why it's there. - Make loongson_llsc_mb() a no-op when CONFIG_CPU_LOONGSON3_WORKAROUNDS=n, rather than a compiler memory barrier. - Add a comment describing the bug & how loongson_llsc_mb() helps in asm/barrier.h.] Signed-off-by: Paul Burton Cc: Ralf Baechle Cc: ambrosehua@gmail.com Cc: Steven J . Hill Cc: linux-mips@linux-mips.org Cc: Fuxin Zhang Cc: Zhangjin Wu Cc: Li Xuefeng Cc: Xu Chenghua arch/mips/Kconfig | 15 +++++++++++++++ arch/mips/include/asm/atomic.h | 6 ++++++ arch/mips/include/asm/barrier.h | 36 ++++++++++++++++++++++++++++++++++++ arch/mips/include/asm/bitops.h | 5 +++++ arch/mips/include/asm/futex.h | 3 +++ arch/mips/include/asm/pgtable.h | 2 ++ arch/mips/loongson64/Platform | 23 +++++++++++++++++++++++ arch/mips/mm/tlbex.c | 10 ++++++++++ 8 files changed, 100 insertions(+) commit 6ab3bc240ade47a0f52bc16d97edd9accbe0024e Author: Arnaldo Carvalho de Melo Date: Tue Jan 29 15:12:34 2019 +0100 perf trace: Support multiple "vfs_getname" probes With a suitably defined "probe:vfs_getname" probe, 'perf trace' can "beautify" its output, so syscalls like open() or openat() can print the "filename" argument instead of just its hex address, like: $ perf trace -e open -- touch /dev/null [...] 0.590 ( 0.014 ms): touch/18063 open(filename: /dev/null, flags: CREAT|NOCTTY|NONBLOCK|WRONLY, mode: IRUGO|IWUGO) = 3 [...] The output without such beautifier looks like: 0.529 ( 0.011 ms): touch/18075 open(filename: 0xc78cf288, flags: CREAT|NOCTTY|NONBLOCK|WRONLY, mode: IRUGO|IWUGO) = 3 However, when the vfs_getname probe expands to multiple probes and it is not the first one that is hit, the beautifier fails, as following: 0.326 ( 0.010 ms): touch/18072 open(filename: , flags: CREAT|NOCTTY|NONBLOCK|WRONLY, mode: IRUGO|IWUGO) = 3 Fix it by hooking into all the expanded probes (inlines), now, for instance: [root@quaco ~]# perf probe -l probe:vfs_getname (on getname_flags:73@fs/namei.c with pathname) probe:vfs_getname_1 (on getname_flags:73@fs/namei.c with pathname) [root@quaco ~]# perf trace -e open* sleep 1 0.010 ( 0.005 ms): sleep/5588 openat(dfd: CWD, filename: /etc/ld.so.cache, flags: RDONLY|CLOEXEC) = 3 0.029 ( 0.006 ms): sleep/5588 openat(dfd: CWD, filename: /lib64/libc.so.6, flags: RDONLY|CLOEXEC) = 3 0.194 ( 0.008 ms): sleep/5588 openat(dfd: CWD, filename: /usr/lib/locale/locale-archive, flags: RDONLY|CLOEXEC) = 3 [root@quaco ~]# Works, further verified with: [root@quaco ~]# perf test vfs 65: Use vfs_getname probe to get syscall args filenames : Ok 66: Add vfs_getname probe to get syscall args filenames : Ok 67: Check open filename arg using perf trace + vfs_getname: Ok [root@quaco ~]# Reported-by: Michael Petlan Tested-by: Michael Petlan Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-mv8kolk17xla1smvmp3qabv1@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-trace.c | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) commit 59a17706915fe5ea6f711e1f92d4fb706bce07fe Author: Jiri Olsa Date: Mon Jan 28 14:35:26 2019 +0100 perf symbols: Filter out hidden symbols from labels When perf is built with the annobin plugin (RHEL8 build) extra symbols are added to its binary: # nm perf | grep annobin | head -10 0000000000241100 t .annobin_annotate.c 0000000000326490 t .annobin_annotate.c 0000000000249255 t .annobin_annotate.c_end 00000000003283a8 t .annobin_annotate.c_end 00000000001bce18 t .annobin_annotate.c_end.hot 00000000001bce18 t .annobin_annotate.c_end.hot 00000000001bc3e2 t .annobin_annotate.c_end.unlikely 00000000001bc400 t .annobin_annotate.c_end.unlikely 00000000001bce18 t .annobin_annotate.c.hot 00000000001bce18 t .annobin_annotate.c.hot ... Those symbols have no use for report or annotation and should be skipped. Moreover they interfere with the DWARF unwind test on the PPC arch, where they are mixed with checked symbols and then the test fails: # perf test dwarf -v 59: Test dwarf unwind : --- start --- test child forked, pid 8515 unwind: .annobin_dwarf_unwind.c:ip = 0x10dba40dc (0x2740dc) ... got: .annobin_dwarf_unwind.c 0x10dba40dc, expecting test__arch_unwind_sample unwind: failed with 'no error' The annobin symbols are defined as NOTYPE/LOCAL/HIDDEN: # readelf -s ./perf | grep annobin | head -1 40: 00000000001bce4f 0 NOTYPE LOCAL HIDDEN 13 .annobin_init.c They can still pass the check for the label symbol. Adding check for HIDDEN and INTERNAL (as suggested by Nick below) visibility and filter out such symbols. > Just to be awkward, if you are going to ignore STV_HIDDEN > symbols then you should probably also ignore STV_INTERNAL ones > as well... Annobin does not generate them, but you never know, > one day some other tool might create some. Signed-off-by: Jiri Olsa Cc: Alexander Shishkin Cc: Masami Hiramatsu Cc: Michael Petlan Cc: Namhyung Kim Cc: Nick Clifton Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/20190128133526.GD15461@krava Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/symbol-elf.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit 843cf70ed29a7fb51f1e796c1d6e1ba3620250ac Author: Arnaldo Carvalho de Melo Date: Mon Feb 4 15:48:03 2019 -0300 perf symbols: Add fallback definitions for GELF_ST_VISIBILITY() Those aren't present in Alpine Linux 3.4 to edge, so provide fallback defines to get the next patch building there keeping the build bisectable. Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Masami Hiramatsu Cc: Michael Petlan Cc: Namhyung Kim Cc: Nick Clifton Cc: Peter Zijlstra Link: https://lkml.kernel.org/n/tip-03cg3gya2ju4ba2x6ibb9fuz@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/symbol-elf.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) commit 0429f237ce08b3f72f11c14c08de354460500f26 Merge: c1f7e02979ed c0a2e4d10d93 Author: David S. Miller Date: Mon Feb 4 09:43:48 2019 -0800 Merge branch 's390-qeth-fixes' Julian Wiedmann says: ==================== s390/qeth: fixes 2019-02-04 please apply the following four fixes to -net. Patch 1 takes care of a common resource leak in various error paths, while the second patch fixes a misordered kfree when cleaning up after an error. The other two patches ensure that there's no stale work dangling on workqueues when the qeth device has already been offlined and/or removed. ==================== Signed-off-by: David S. Miller commit c0a2e4d10d9366ada133a8ae4ff2f32397f8b15b Author: Julian Wiedmann Date: Mon Feb 4 17:40:09 2019 +0100 s390/qeth: conclude all event processing before offlining a card Work for Bridgeport events is currently placed on a driver-wide workqueue. If the card is removed and freed while any such work is still active, this causes a use-after-free. So put the events on a per-card queue, where we can control their lifetime. As we also don't want stale events to last beyond an offline & online cycle, flush this queue when setting the card offline. Fixes: b4d72c08b358 ("qeth: bridgeport support - basic control") Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller drivers/s390/net/qeth_core.h | 2 +- drivers/s390/net/qeth_core_main.c | 10 ++++++++-- drivers/s390/net/qeth_l2_main.c | 6 ++++-- drivers/s390/net/qeth_l3_main.c | 2 ++ 4 files changed, 15 insertions(+), 5 deletions(-) commit c2780c1a3fb724560b1d44f7976e0de17bf153c7 Author: Julian Wiedmann Date: Mon Feb 4 17:40:08 2019 +0100 s390/qeth: cancel close_dev work before removing a card A card's close_dev work is scheduled on a driver-wide workqueue. If the card is removed and freed while the work is still active, this causes a use-after-free. So make sure that the work is completed before freeing the card. Fixes: 0f54761d167f ("qeth: Support VEPA mode") Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller drivers/s390/net/qeth_core.h | 1 + drivers/s390/net/qeth_l2_main.c | 2 ++ drivers/s390/net/qeth_l3_main.c | 1 + 3 files changed, 4 insertions(+) commit afa0c5904ba16d59b0454f7ee4c807dae350f432 Author: Julian Wiedmann Date: Mon Feb 4 17:40:07 2019 +0100 s390/qeth: fix use-after-free in error path The error path in qeth_alloc_qdio_buffers() that takes care of cleaning up the Output Queues is buggy. It first frees the queue, but then calls qeth_clear_outq_buffers() with that very queue struct. Make the call to qeth_clear_outq_buffers() part of the free action (in the correct order), and while at it fix the naming of the helper. Fixes: 0da9581ddb0f ("qeth: exploit asynchronous delivery of storage blocks") Signed-off-by: Julian Wiedmann Reviewed-by: Alexandra Winter Signed-off-by: David S. Miller drivers/s390/net/qeth_core_main.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) commit 5065b2dd3e5f9247a6c9d67974bc0472bf561b9d Author: Julian Wiedmann Date: Mon Feb 4 17:40:06 2019 +0100 s390/qeth: release cmd buffer in error paths Whenever we fail before/while starting an IO, make sure to release the IO buffer. Usually qeth_irq() would do this for us, but if the IO doesn't even start we obviously won't get an interrupt for it either. Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller drivers/s390/net/qeth_core_main.c | 6 ++++++ 1 file changed, 6 insertions(+) commit c1f7e02979edd7a3a3e69fe04be60b1d650dc8a7 Author: Petr Machata Date: Mon Feb 4 14:50:38 2019 +0000 net: cls_flower: Remove filter from mask before freeing it In fl_change(), when adding a new rule (i.e. fold == NULL), a driver may reject the new rule, for example due to resource exhaustion. By that point, the new rule was already assigned a mask, and it was added to that mask's hash table. The clean-up path that's invoked as a result of the rejection however neglects to undo the hash table addition, and proceeds to free the new rule, thus leaving a dangling pointer in the hash table. Fix by removing fnew from the mask's hash table before it is freed. Fixes: 35cc3cefc4de ("net/sched: cls_flower: Reject duplicated rules also under skip_sw") Signed-off-by: Petr Machata Acked-by: Jiri Pirko Reviewed-by: Ido Schimmel Signed-off-by: David S. Miller net/sched/cls_flower.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 3e5a7c981464fd592f10a62c911001c174d46c12 Merge: 277aa590c3d5 8c22d81d5535 Author: David S. Miller Date: Mon Feb 4 09:12:06 2019 -0800 Merge tag 'wireless-drivers-for-davem-2019-02-04' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== wireless-drivers fixes for 5.0 First set of small, but importnat, fixes for 5.0. iwlwifi * fix a build regression introduced in 5.0-rc1 wlcore * fix a firmware regression from v4.18-rc1 mt76x0 * fix for configuring tx power from user space ath10k * fix wcn3990 regression from v4.20-rc1 ==================== Signed-off-by: David S. Miller commit 277aa590c3d552d01f9e62619707b2aa1a724566 Merge: 53bc8d2af086 84b799a292eb Author: David S. Miller Date: Mon Feb 4 09:11:19 2019 -0800 Merge branch 'smc-fixes' Ursula Braun says: ==================== net/smc: fixes 2019-02-04 here are more fixes in the smc code for the net tree: Patch 1 fixes an IB-related problem with SMCR. Patch 2 fixes a cursor problem for one-way traffic. Patch 3 fixes a problem with RMB-reusage. Patch 4 fixes a closing issue. ==================== Signed-off-by: David S. Miller commit 84b799a292ebc03de388f8573a169de6eb12c340 Author: Ursula Braun Date: Mon Feb 4 13:44:47 2019 +0100 net/smc: correct state change for peer closing If some kind of closing is received from the peer while still in state SMC_INIT, it means the peer has had an active connection and closed the socket quickly before listen_work finished. This should not result in a shortcut from state SMC_INIT to state SMC_CLOSED. This patch adds the socket to the accept queue in state SMC_APPCLOSEWAIT1. The socket reaches state SMC_CLOSED once being accepted and closed with smc_release(). Signed-off-by: Ursula Braun Signed-off-by: David S. Miller net/smc/smc_close.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) commit a5e04318c83a31925300af1ce358dbc1a708b732 Author: Ursula Braun Date: Mon Feb 4 13:44:46 2019 +0100 net/smc: delete rkey first before switching to unused Once RMBs are flagged as unused they are candidates for reuse. Thus the LLC DELETE RKEY operaton should be made before flagging the RMB as unused. Fixes: c7674c001b11 ("net/smc: unregister rkeys of unused buffer") Signed-off-by: Ursula Braun Signed-off-by: David S. Miller net/smc/smc_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b8649efad879c69c7ab1f19ce8814fcabef1f72b Author: Ursula Braun Date: Mon Feb 4 13:44:45 2019 +0100 net/smc: fix sender_free computation In some scenarios a separate consumer cursor update is necessary. The decision is made in smc_tx_consumer_cursor_update(). The sender_free computation could be wrong: The rx confirmed cursor is always smaller than or equal to the rx producer cursor. The parameters in the smc_curs_diff() call have to be exchanged, otherwise sender_free might even be negative. And if more data arrives local_rx_ctrl.prod might be updated, enabling a cursor difference between local_rx_ctrl.prod and rx confirmed cursor larger than the RMB size. This case is not covered by smc_curs_diff(). Thus function smc_curs_diff_large() is introduced here. If a recvmsg() is processed in parallel, local_tx_ctrl.cons might change during smc_cdc_msg_send. Make sure rx_curs_confirmed is updated with the actually sent local_tx_ctrl.cons value. Fixes: e82f2e31f559 ("net/smc: optimize consumer cursor updates") Signed-off-by: Ursula Braun Signed-off-by: David S. Miller net/smc/smc_cdc.c | 5 +++-- net/smc/smc_cdc.h | 26 +++++++++++++++++++++++++- net/smc/smc_tx.c | 3 ++- 3 files changed, 30 insertions(+), 4 deletions(-) commit ad6f317f720f4a3121756c23831a43dda9b095e5 Author: Ursula Braun Date: Mon Feb 4 13:44:44 2019 +0100 net/smc: preallocated memory for rdma work requests The work requests for rdma writes are built in local variables within function smc_tx_rdma_write(). This violates the rule that the work request storage has to stay till the work request is confirmed by a completion queue response. This patch introduces preallocated memory for these work requests. The storage is allocated, once a link (and thus a queue pair) is established. Signed-off-by: Ursula Braun Signed-off-by: David S. Miller net/smc/smc_cdc.c | 11 +++-------- net/smc/smc_cdc.h | 8 +++++++- net/smc/smc_core.h | 20 ++++++++++++++++++++ net/smc/smc_llc.c | 3 ++- net/smc/smc_tx.c | 44 ++++++++++++++++++++++---------------------- net/smc/smc_wr.c | 38 +++++++++++++++++++++++++++++++++++++- net/smc/smc_wr.h | 1 + 7 files changed, 92 insertions(+), 33 deletions(-) commit 53bc8d2af08654659abfadfd3e98eb9922ff787c Author: Sebastian Andrzej Siewior Date: Mon Feb 4 11:20:29 2019 +0100 net: dp83640: expire old TX-skb During sendmsg() a cloned skb is saved via dp83640_txtstamp() in ->tx_queue. After the NIC sends this packet, the PHY will reply with a timestamp for that TX packet. If the cable is pulled at the right time I don't see that packet. It might gets flushed as part of queue shutdown on NIC's side. Once the link is up again then after the next sendmsg() we enqueue another skb in dp83640_txtstamp() and have two on the list. Then the PHY will send a reply and decode_txts() attaches it to the first skb on the list. No crash occurs since refcounting works but we are one packet behind. linuxptp/ptp4l usually closes the socket and opens a new one (in such a timeout case) so those "stale" replies never get there. However it does not resume normal operation anymore. Purge old skbs in decode_txts(). Fixes: cb646e2b02b2 ("ptp: Added a clock driver for the National Semiconductor PHYTER.") Signed-off-by: Sebastian Andrzej Siewior Reviewed-by: Kurt Kanzenbach Acked-by: Richard Cochran Signed-off-by: David S. Miller drivers/net/phy/dp83640.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) commit f6ac8585897684374a19863fff21186a05805286 Author: Pablo Neira Ayuso Date: Sat Feb 2 10:49:13 2019 +0100 netfilter: nf_tables: unbind set in rule from commit path Anonymous sets that are bound to rules from the same transaction trigger a kernel splat from the abort path due to double set list removal and double free. This patch updates the logic to search for the transaction that is responsible for creating the set and disable the set list removal and release, given the rule is now responsible for this. Lookup is reverse since the transaction that adds the set is likely to be at the tail of the list. Moreover, this patch adds the unbind step to deliver the event from the commit path. This should not be done from the worker thread, since we have no guarantees of in-order delivery to the listener. This patch removes the assumption that both activate and deactivate callbacks need to be provided. Fixes: cd5125d8f518 ("netfilter: nf_tables: split set destruction in deactivate and destroy phase") Reported-by: Mikhail Morfikov Signed-off-by: Pablo Neira Ayuso include/net/netfilter/nf_tables.h | 17 ++++++-- net/netfilter/nf_tables_api.c | 85 +++++++++++++++++++-------------------- net/netfilter/nft_compat.c | 6 ++- net/netfilter/nft_dynset.c | 18 ++++----- net/netfilter/nft_immediate.c | 6 ++- net/netfilter/nft_lookup.c | 18 ++++----- net/netfilter/nft_objref.c | 18 ++++----- 7 files changed, 85 insertions(+), 83 deletions(-) commit d23c808c6fc6132e812690648e14c0d6b0cbe273 Author: Will Deacon Date: Mon Feb 4 14:37:38 2019 +0000 arm64: ptdump: Don't iterate kernel page tables using PTRS_PER_PXX When 52-bit virtual addressing is enabled for userspace (CONFIG_ARM64_USER_VA_BITS_52=y), the kernel continues to utilise 48-bit virtual addressing in TTBR1. Consequently, PTRS_PER_PGD reflects the larger page table size for userspace and the pgd pointer for kernel page tables is offset before being written to TTBR1. This means that we can't use PTRS_PER_PGD to iterate over kernel page tables unless we apply the same offset, which is fiddly to get right and leads to some non-idiomatic walking code. Instead, just follow the usual pattern when walking page tables by using a while loop driven by pXd_offset() and pXd_addr_end(). Reported-by: Qian Cai Tested-by: Qian Cai Acked-by: Steve Capper Tested-by: Steve Capper Signed-off-by: Will Deacon arch/arm64/mm/dump.c | 59 ++++++++++++++++++++++++++-------------------------- 1 file changed, 29 insertions(+), 30 deletions(-) commit 27b8e90eaea6a6fe8c1ab457443601dabff500d0 Author: Arnaldo Carvalho de Melo Date: Mon Feb 4 11:34:20 2019 -0300 tools headers uapi: Sync linux/in.h copy from the kernel sources To get the changes in this cset: f275ee0fa3a0 ("IN_BADCLASS: fix macro to actually work") The macros changed in this cset are not used in tools/, so this is just to silence this perf tools build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/in.h' differs from latest version at 'include/uapi/linux/in.h' diff -u tools/include/uapi/linux/in.h include/uapi/linux/in.h Cc: Adrian Hunter Cc: David S. Miller Cc: Greg Kroah-Hartman Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-xbk34kwamn8bw8ywpuxetct9@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/include/uapi/linux/in.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d34cecfb6b2bdc35713180ba4fcfd912a2f3e9bf Author: Arnaldo Carvalho de Melo Date: Mon Feb 4 11:04:20 2019 -0300 perf clang: Do not use 'return std::move(something)' It prevents copy elision, generating this warning when building with fedora:rawhide's clang: clang version 7.0.1 (Fedora 7.0.1-2.fc30) Target: x86_64-unknown-linux-gnu Thread model: posix InstalledDir: /usr/bin Found candidate GCC installation: /usr/bin/../lib/gcc/x86_64-redhat-linux/9 Found candidate GCC installation: /usr/lib/gcc/x86_64-redhat-linux/9 Selected GCC installation: /usr/bin/../lib/gcc/x86_64-redhat-linux/9 Candidate multilib: .;@m64 Candidate multilib: 32;@m32 Selected multilib: .;@m64 $ make -C tools/perf CC=clang LIBCLANGLLVM=1 util/c++/clang.cpp: In function 'std::unique_ptr > perf::getBPFObjectFromModule(llvm::Module*)': util/c++/clang.cpp:163:18: error: moving a local object in a return statement prevents copy elision [-Werror=pessimizing-move] 163 | return std::move(Buffer); | ~~~~~~~~~^~~~~~~~ util/c++/clang.cpp:163:18: note: remove 'std::move' call cc1plus: all warnings being treated as errors References: http://www.cplusplus.com/forum/general/186411/#msg908572 https://en.cppreference.com/w/cpp/language/return#Notes https://en.cppreference.com/w/cpp/language/copy_elision Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-lehqf5x5q96l0o8myhb6blz6@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/c++/clang.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f0fabf9c897327abd39018aefb5029aff8c7e133 Author: Ravi Bangoria Date: Tue Jan 29 18:54:12 2019 +0530 perf mem/c2c: Fix perf_mem_events to support powerpc PowerPC hardware does not have a builtin latency filter (--ldlat) for the "mem-load" event and perf_mem_events by default includes "/ldlat=30/" which is causing a failure on PowerPC. Refactor the code to support "perf mem/c2c" on PowerPC. This patch depends on kernel side changes done my Madhavan: https://lists.ozlabs.org/pipermail/linuxppc-dev/2018-December/182596.html Signed-off-by: Ravi Bangoria Acked-by: Jiri Olsa Cc: Dick Fowles Cc: Don Zickus Cc: Joe Mario Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Namhyung Kim Cc: linuxppc-dev@lists.ozlabs.org Link: http://lkml.kernel.org/r/20190129132412.771-1-ravi.bangoria@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/Documentation/perf-c2c.txt | 16 ++++++++++++---- tools/perf/Documentation/perf-mem.txt | 2 +- tools/perf/arch/powerpc/util/Build | 1 + tools/perf/arch/powerpc/util/mem-events.c | 11 +++++++++++ tools/perf/util/mem-events.c | 2 +- 5 files changed, 26 insertions(+), 6 deletions(-) commit 489338a717a0dfbbd5a3fabccf172b78f0ac9015 Author: Gustavo A. R. Silva Date: Tue Jan 22 17:34:39 2019 -0600 perf tests evsel-tp-sched: Fix bitwise operator Notice that the use of the bitwise OR operator '|' always leads to true in this particular case, which seems a bit suspicious due to the context in which this expression is being used. Fix this by using bitwise AND operator '&' instead. This bug was detected with the help of Coccinelle. Signed-off-by: Gustavo A. R. Silva Acked-by: Jiri Olsa Cc: Alexander Shishkin Cc: Namhyung Kim Cc: Peter Zijlstra Cc: stable@vger.kernel.org Fixes: 6a6cd11d4e57 ("perf test: Add test for the sched tracepoint format fields") Link: http://lkml.kernel.org/r/20190122233439.GA5868@embeddedor Signed-off-by: Arnaldo Carvalho de Melo tools/perf/tests/evsel-tp-sched.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4e35c1cb9460240e983a01745b5f29fe3a4d8e39 Author: Martynas Pumputis Date: Tue Jan 29 15:51:42 2019 +0100 netfilter: nf_nat: skip nat clash resolution for same-origin entries It is possible that two concurrent packets originating from the same socket of a connection-less protocol (e.g. UDP) can end up having different IP_CT_DIR_REPLY tuples which results in one of the packets being dropped. To illustrate this, consider the following simplified scenario: 1. Packet A and B are sent at the same time from two different threads by same UDP socket. No matching conntrack entry exists yet. Both packets cause allocation of a new conntrack entry. 2. get_unique_tuple gets called for A. No clashing entry found. conntrack entry for A is added to main conntrack table. 3. get_unique_tuple is called for B and will find that the reply tuple of B is already taken by A. It will allocate a new UDP source port for B to resolve the clash. 4. conntrack entry for B cannot be added to main conntrack table because its ORIGINAL direction is clashing with A and the REPLY directions of A and B are not the same anymore due to UDP source port reallocation done in step 3. This patch modifies nf_conntrack_tuple_taken so it doesn't consider colliding reply tuples if the IP_CT_DIR_ORIGINAL tuples are equal. [ Florian: simplify patch to not use .allow_clash setting and always ignore identical flows ] Signed-off-by: Martynas Pumputis Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_conntrack_core.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) commit 98bfc3414bda335dbd7fec58bde6266f991801d7 Author: Florian Westphal Date: Tue Jan 29 15:16:23 2019 +0100 selftests: netfilter: add simple masq/redirect test cases Check basic nat/redirect/masquerade for ipv4 and ipv6. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso tools/testing/selftests/netfilter/Makefile | 2 +- tools/testing/selftests/netfilter/nft_nat.sh | 762 +++++++++++++++++++++++++++ 2 files changed, 763 insertions(+), 1 deletion(-) commit 952b72f89ae23b316da8c1021b18d0c388ad6cc4 Author: Naresh Kamboju Date: Tue Jan 29 06:28:35 2019 +0000 selftests: netfilter: fix config fragment CONFIG_NF_TABLES_INET In selftests the config fragment for netfilter was added as NF_TABLES_INET=y and this patch correct it as CONFIG_NF_TABLES_INET=y Signed-off-by: Naresh Kamboju Acked-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso tools/testing/selftests/netfilter/config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6454368a804c4955ccd116236037536f81e5b1f1 Author: Andy Shevchenko Date: Wed Jan 30 21:48:44 2019 +0200 dmaengine: dmatest: Abort test in case of mapping error In case of mapping error the DMA addresses are invalid and continuing will screw system memory or potentially something else. [ 222.480310] dmatest: dma0chan7-copy0: summary 1 tests, 3 failures 6 iops 349 KB/s (0) ... [ 240.912725] check: Corrupted low memory at 00000000c7c75ac9 (2940 phys) = 5656000000000000 [ 240.921998] check: Corrupted low memory at 000000005715a1cd (2948 phys) = 279f2aca5595ab2b [ 240.931280] check: Corrupted low memory at 000000002f4024c0 (2950 phys) = 5e5624f349e793cf ... Abort any test if mapping failed. Fixes: 4076e755dbec ("dmatest: convert to dmaengine_unmap_data") Cc: Dan Williams Signed-off-by: Andy Shevchenko Signed-off-by: Vinod Koul drivers/dma/dmatest.c | 32 ++++++++++++++------------------ 1 file changed, 14 insertions(+), 18 deletions(-) commit 9dff0aa95a324e262ffb03f425d00e4751f3294e Author: Mark Rutland Date: Thu Jan 10 14:27:45 2019 +0000 perf/core: Don't WARN() for impossible ring-buffer sizes The perf tool uses /proc/sys/kernel/perf_event_mlock_kb to determine how large its ringbuffer mmap should be. This can be configured to arbitrary values, which can be larger than the maximum possible allocation from kmalloc. When this is configured to a suitably large value (e.g. thanks to the perf fuzzer), attempting to use perf record triggers a WARN_ON_ONCE() in __alloc_pages_nodemask(): WARNING: CPU: 2 PID: 5666 at mm/page_alloc.c:4511 __alloc_pages_nodemask+0x3f8/0xbc8 Let's avoid this by checking that the requested allocation is possible before calling kzalloc. Reported-by: Julien Thierry Signed-off-by: Mark Rutland Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Julien Thierry Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Link: https://lkml.kernel.org/r/20190110142745.25495-1-mark.rutland@arm.com Signed-off-by: Ingo Molnar kernel/events/ring_buffer.c | 3 +++ 1 file changed, 3 insertions(+) commit 602cae04c4864bb3487dfe4c2126c8d9e7e1614a Author: Peter Zijlstra Date: Wed Dec 19 17:53:50 2018 +0100 perf/x86/intel: Delay memory deallocation until x86_pmu_dead_cpu() intel_pmu_cpu_prepare() allocated memory for ->shared_regs among other members of struct cpu_hw_events. This memory is released in intel_pmu_cpu_dying() which is wrong. The counterpart of the intel_pmu_cpu_prepare() callback is x86_pmu_dead_cpu(). Otherwise if the CPU fails on the UP path between CPUHP_PERF_X86_PREPARE and CPUHP_AP_PERF_X86_STARTING then it won't release the memory but allocate new memory on the next attempt to online the CPU (leaking the old memory). Also, if the CPU down path fails between CPUHP_AP_PERF_X86_STARTING and CPUHP_PERF_X86_PREPARE then the CPU will go back online but never allocate the memory that was released in x86_pmu_dying_cpu(). Make the memory allocation/free symmetrical in regard to the CPU hotplug notifier by moving the deallocation to intel_pmu_cpu_dead(). This started in commit: a7e3ed1e47011 ("perf: Add support for supplementary event registers"). In principle the bug was introduced in v2.6.39 (!), but it will almost certainly not backport cleanly across the big CPU hotplug rewrite between v4.7-v4.15... [ bigeasy: Added patch description. ] [ mingo: Added backporting guidance. ] Reported-by: He Zhe Signed-off-by: Peter Zijlstra (Intel) # With developer hat on Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Peter Zijlstra (Intel) # With maintainer hat on Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: acme@kernel.org Cc: bp@alien8.de Cc: hpa@zytor.com Cc: jolsa@kernel.org Cc: kan.liang@linux.intel.com Cc: namhyung@kernel.org Cc: Fixes: a7e3ed1e47011 ("perf: Add support for supplementary event registers"). Link: https://lkml.kernel.org/r/20181219165350.6s3jvyxbibpvlhtq@linutronix.de Signed-off-by: Ingo Molnar arch/x86/events/intel/core.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) commit 9e63a7894fd302082cf3627fe90844421a6cbe7f Author: Kan Liang Date: Sun Jan 27 06:53:14 2019 -0800 perf/x86/intel/uncore: Add Node ID mask Some PCI uncore PMUs cannot be registered on an 8-socket system (HPE Superdome Flex). To understand which Socket the PCI uncore PMUs belongs to, perf retrieves the local Node ID of the uncore device from CPUNODEID(0xC0) of the PCI configuration space, and the mapping between Socket ID and Node ID from GIDNIDMAP(0xD4). The Socket ID can be calculated accordingly. The local Node ID is only available at bit 2:0, but current code doesn't mask it. If a BIOS doesn't clear the rest of the bits, an incorrect Node ID will be fetched. Filter the Node ID by adding a mask. Reported-by: Song Liu Tested-by: Song Liu Signed-off-by: Kan Liang Signed-off-by: Peter Zijlstra (Intel) Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: # v3.7+ Fixes: 7c94ee2e0917 ("perf/x86: Add Intel Nehalem and Sandy Bridge-EP uncore support") Link: https://lkml.kernel.org/r/1548600794-33162-1-git-send-email-kan.liang@linux.intel.com Signed-off-by: Ingo Molnar arch/x86/events/intel/uncore_snbep.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 6d66c8d1a034eeb1bbf4a0a8dd99fa6f33a8db5d Merge: 341198eda723 9e528c799d17 Author: Vinod Koul Date: Mon Feb 4 12:57:56 2019 +0530 Merge branch 'fix/brcm' into fixes commit 9e528c799d17a4ac37d788c81440b50377dd592d Author: Lukas Wunner Date: Wed Jan 23 09:26:00 2019 +0100 dmaengine: bcm2835: Fix abort of transactions There are multiple issues with bcm2835_dma_abort() (which is called on termination of a transaction): * The algorithm to abort the transaction first pauses the channel by clearing the ACTIVE flag in the CS register, then waits for the PAUSED flag to clear. Page 49 of the spec documents the latter as follows: "Indicates if the DMA is currently paused and not transferring data. This will occur if the active bit has been cleared [...]" https://www.raspberrypi.org/app/uploads/2012/02/BCM2835-ARM-Peripherals.pdf So the function is entering an infinite loop because it is waiting for PAUSED to clear which is always set due to the function having cleared the ACTIVE flag. The only thing that's saving it from itself is the upper bound of 10000 loop iterations. The code comment says that the intention is to "wait for any current AXI transfer to complete", so the author probably wanted to check the WAITING_FOR_OUTSTANDING_WRITES flag instead. Amend the function accordingly. * The CS register is only read at the beginning of the function. It needs to be read again after pausing the channel and before checking for outstanding writes, otherwise writes which were issued between the register read at the beginning of the function and pausing the channel may not be waited for. * The function seeks to abort the transfer by writing 0 to the NEXTCONBK register and setting the ABORT and ACTIVE flags. Thereby, the 0 in NEXTCONBK is sought to be loaded into the CONBLK_AD register. However experimentation has shown this approach to not work: The CONBLK_AD register remains the same as before and the CS register contains 0x00000030 (PAUSED | DREQ_STOPS_DMA). In other words, the control block is not aborted but merely paused and it will be resumed once the next DMA transaction is started. That is absolutely not the desired behavior. A simpler approach is to set the channel's RESET flag instead. This reliably zeroes the NEXTCONBK as well as the CS register. It requires less code and only a single MMIO write. This is also what popular user space DMA drivers do, e.g.: https://github.com/metachris/RPIO/blob/master/source/c_pwm/pwm.c Note that the spec is contradictory whether the NEXTCONBK register is writeable at all. On the one hand, page 41 claims: "The value loaded into the NEXTCONBK register can be overwritten so that the linked list of Control Block data structures can be dynamically altered. However it is only safe to do this when the DMA is paused." On the other hand, page 40 specifies: "Only three registers in each channel's register set are directly writeable (CS, CONBLK_AD and DEBUG). The other registers (TI, SOURCE_AD, DEST_AD, TXFR_LEN, STRIDE & NEXTCONBK), are automatically loaded from a Control Block data structure held in external memory." Fixes: 96286b576690 ("dmaengine: Add support for BCM2835") Signed-off-by: Lukas Wunner Cc: stable@vger.kernel.org # v3.14+ Cc: Frank Pavlic Cc: Martin Sperl Cc: Florian Meier Cc: Clive Messer Cc: Matthias Reichl Tested-by: Stefan Wahren Acked-by: Florian Kauer Signed-off-by: Vinod Koul drivers/dma/bcm2835-dma.c | 41 +++++++++-------------------------------- 1 file changed, 9 insertions(+), 32 deletions(-) commit f7da7782aba92593f7b82f03d2409a1c5f4db91b Author: Lukas Wunner Date: Wed Jan 23 09:26:00 2019 +0100 dmaengine: bcm2835: Fix interrupt race on RT If IRQ handlers are threaded (either because CONFIG_PREEMPT_RT_BASE is enabled or "threadirqs" was passed on the command line) and if system load is sufficiently high that wakeup latency of IRQ threads degrades, SPI DMA transactions on the BCM2835 occasionally break like this: ks8851 spi0.0: SPI transfer timed out bcm2835-dma 3f007000.dma: DMA transfer could not be terminated ks8851 spi0.0 eth2: ks8851_rdfifo: spi_sync() failed The root cause is an assumption made by the DMA driver which is documented in a code comment in bcm2835_dma_terminate_all(): /* * Stop DMA activity: we assume the callback will not be called * after bcm_dma_abort() returns (even if it does, it will see * c->desc is NULL and exit.) */ That assumption falls apart if the IRQ handler bcm2835_dma_callback() is threaded: A client may terminate a descriptor and issue a new one before the IRQ handler had a chance to run. In fact the IRQ handler may miss an *arbitrary* number of descriptors. The result is the following race condition: 1. A descriptor finishes, its interrupt is deferred to the IRQ thread. 2. A client calls dma_terminate_async() which sets channel->desc = NULL. 3. The client issues a new descriptor. Because channel->desc is NULL, bcm2835_dma_issue_pending() immediately starts the descriptor. 4. Finally the IRQ thread runs and writes BCM2835_DMA_INT to the CS register to acknowledge the interrupt. This clears the ACTIVE flag, so the newly issued descriptor is paused in the middle of the transaction. Because channel->desc is not NULL, the IRQ thread finalizes the descriptor and tries to start the next one. I see two possible solutions: The first is to call synchronize_irq() in bcm2835_dma_issue_pending() to wait until the IRQ thread has finished before issuing a new descriptor. The downside of this approach is unnecessary latency if clients desire rapidly terminating and re-issuing descriptors and don't have any use for an IRQ callback. (The SPI TX DMA channel is a case in point.) A better alternative is to make the IRQ thread recognize that it has missed descriptors and avoid finalizing the newly issued descriptor. So first of all, set the ACTIVE flag when acknowledging the interrupt. This keeps a newly issued descriptor running. If the descriptor was finished, the channel remains idle despite the ACTIVE flag being set. However the ACTIVE flag can then no longer be used to check whether the channel is idle, so instead check whether the register containing the current control block address is zero and finalize the current descriptor only if so. That way, there is no impact on latency and throughput if the client doesn't care for the interrupt: Only minimal additional overhead is introduced for non-cyclic descriptors as one further MMIO read is necessary per interrupt to check for idleness of the channel. Cyclic descriptors are sped up slightly by removing one MMIO write per interrupt. Fixes: 96286b576690 ("dmaengine: Add support for BCM2835") Signed-off-by: Lukas Wunner Cc: stable@vger.kernel.org # v3.14+ Cc: Frank Pavlic Cc: Martin Sperl Cc: Florian Meier Cc: Clive Messer Cc: Matthias Reichl Tested-by: Stefan Wahren Acked-by: Florian Kauer Signed-off-by: Vinod Koul drivers/dma/bcm2835-dma.c | 33 ++++++++++++++++++--------------- 1 file changed, 18 insertions(+), 15 deletions(-) commit 341198eda723c8c1cddbb006a89ad9e362502ea2 Author: Leonid Iziumtsev Date: Tue Jan 15 17:15:23 2019 +0000 dmaengine: imx-dma: fix wrong callback invoke Once the "ld_queue" list is not empty, next descriptor will migrate into "ld_active" list. The "desc" variable will be overwritten during that transition. And later the dmaengine_desc_get_callback_invoke() will use it as an argument. As result we invoke wrong callback. That behaviour was in place since: commit fcaaba6c7136 ("dmaengine: imx-dma: fix callback path in tasklet"). But after commit 4cd13c21b207 ("softirq: Let ksoftirqd do its job") things got worse, since possible delay between tasklet_schedule() from DMA irq handler and actual tasklet function execution got bigger. And that gave more time for new DMA request to be submitted and to be put into "ld_queue" list. It has been noticed that DMA issue is causing problems for "mxc-mmc" driver. While stressing the system with heavy network traffic and writing/reading to/from sd card simultaneously the timeout may happen: 10013000.sdhci: mxcmci_watchdog: read time out (status = 0x30004900) That often lead to file system corruption. Signed-off-by: Leonid Iziumtsev Signed-off-by: Vinod Koul Cc: stable@vger.kernel.org drivers/dma/imx-dma.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 546f28974d771b124fb0bf7b551b343888cf0419 Author: Toshiaki Makita Date: Thu Jan 31 20:40:30 2019 +0900 virtio_net: Account for tx bytes and packets on sending xdp_frames Previously virtnet_xdp_xmit() did not account for device tx counters, which caused confusions. To be consistent with SKBs, account them on freeing xdp_frames. Reported-by: David Ahern Signed-off-by: Toshiaki Makita Acked-by: Michael S. Tsirkin Signed-off-by: David S. Miller drivers/net/virtio_net.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) commit 2072ce03637fa23c324dc470d3009c327649e9b7 Merge: 8834f5600cf3 6e11ea9de957 Author: Dave Airlie Date: Mon Feb 4 11:05:49 2019 +1000 Merge branch 'drm-fixes-5.0' of git://people.freedesktop.org/~agd5f/linux into drm-fixes A few fixes for 5.0: - Fix radeon crash on SI with VM passthrough - Fencing fix for shared buffers - Fix power hwmon reporting on APUs - Powerplay fix for APUs Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20190201043455.5988-1-alexander.deucher@amd.com commit cfe4bd7a257f6d6f81d3458d8c9d9ec4957539e6 Author: Xin Long Date: Mon Feb 4 03:27:58 2019 +0800 sctp: check and update stream->out_curr when allocating stream_out Now when using stream reconfig to add out streams, stream->out will get re-allocated, and all old streams' information will be copied to the new ones and the old ones will be freed. So without stream->out_curr updated, next time when trying to send from stream->out_curr stream, a panic would be caused. This patch is to check and update stream->out_curr when allocating stream_out. v1->v2: - define fa_index() to get elem index from stream->out_curr. v2->v3: - repost with no change. Fixes: 5bbbbe32a431 ("sctp: introduce stream scheduler foundations") Reported-by: Ying Xu Reported-by: syzbot+e33a3a138267ca119c7d@syzkaller.appspotmail.com Signed-off-by: Xin Long Acked-by: Neil Horman Signed-off-by: David S. Miller net/sctp/stream.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) commit add46b3b021263c02d5a7080c58e5b459479fafd Author: Darrick J. Wong Date: Sun Feb 3 14:03:59 2019 -0800 xfs: set buffer ops when repair probes for btree type In xrep_findroot_block, we work out the btree type and correctness of a given block by calling different btree verifiers on root block candidates. However, we leave the NULL b_ops while ->verify_read validates the block, which means that if the verifier calls xfs_buf_verifier_error it'll crash on the null b_ops. Fix it to set b_ops before calling the verifier and unsetting it if the verifier fails. Furthermore, improve the documentation around xfs_buf_ensure_ops, which is the function that is responsible for cleaning up the b_ops state of buffers that go through xrep_findroot_block but don't match anything. Signed-off-by: Darrick J. Wong Reviewed-by: Brian Foster fs/xfs/scrub/repair.c | 11 ++++++++--- fs/xfs/xfs_buf.c | 16 ++++++++++++++++ 2 files changed, 24 insertions(+), 3 deletions(-) commit 465fa17f4a303d9fdff9eac4d45f91ece92e96ca Author: Brian Foster Date: Sun Feb 3 14:03:06 2019 -0800 xfs: end sync buffer I/O properly on shutdown error As of commit e339dd8d8b ("xfs: use sync buffer I/O for sync delwri queue submission"), the delwri submission code uses sync buffer I/O for sync delwri I/O. Instead of waiting on async I/O to unlock the buffer, it uses the underlying sync I/O completion mechanism. If delwri buffer submission fails due to a shutdown scenario, an error is set on the buffer and buffer completion never occurs. This can cause xfs_buf_delwri_submit() to deadlock waiting on a completion event. We could check the error state before waiting on such buffers, but that doesn't serialize against the case of an error set via a racing I/O completion. Instead, invoke I/O completion in the shutdown case regardless of buffer I/O type. Signed-off-by: Brian Foster Reviewed-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/xfs_buf.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit aa6ee4ab69293969867ab09b57546d226ace3d7a Author: Brian Foster Date: Fri Feb 1 09:36:36 2019 -0800 xfs: eof trim writeback mapping as soon as it is cached The cached writeback mapping is EOF trimmed to try and avoid races between post-eof block management and writeback that result in sending cached data to a stale location. The cached mapping is currently trimmed on the validation check, which leaves a race window between the time the mapping is cached and when it is trimmed against the current inode size. For example, if a new mapping is cached by delalloc conversion on a blocksize == page size fs, we could cycle various locks, perform memory allocations, etc. in the writeback codepath before the associated mapping is eventually trimmed to i_size. This leaves enough time for a post-eof truncate and file append before the cached mapping is trimmed. The former event essentially invalidates a range of the cached mapping and the latter bumps the inode size such the trim on the next writepage event won't trim all of the invalid blocks. fstest generic/464 reproduces this scenario occasionally and causes a lost writeback and stale delalloc blocks warning on inode inactivation. To work around this problem, trim the cached writeback mapping as soon as it is cached in addition to on subsequent validation checks. This is a minor tweak to tighten the race window as much as possible until a proper invalidation mechanism is available. Fixes: 40214d128e07 ("xfs: trim writepage mapping to within eof") Cc: # v4.14+ Signed-off-by: Brian Foster Reviewed-by: Allison Henderson Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/xfs_aops.c | 2 ++ 1 file changed, 2 insertions(+) commit 8834f5600cf3c8db365e18a3d5cac2c2780c81e5 Author: Linus Torvalds Date: Sun Feb 3 13:48:04 2019 -0800 Linux 5.0-rc5 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8c22d81d55353209f8976074ffa9fb1085da0830 Author: Siva Rebbagondla Date: Fri Feb 1 16:35:20 2019 +0530 MAINTAINERS: add entry for redpine wireless driver Create an entry for Redpine wireless driver and add Amit and myself as maintainers. Signed-off-by: Siva Rebbagondla Signed-off-by: Kalle Valo MAINTAINERS | 7 +++++++ 1 file changed, 7 insertions(+) commit 8dfb8d2cceb76b74ad5b58cc65c75994329b4d5e Author: Florian Fainelli Date: Fri Feb 1 13:23:38 2019 -0800 net: systemport: Fix WoL with password after deep sleep Broadcom STB chips support a deep sleep mode where all register contents are lost. Because we were stashing the MagicPacket password into some of these registers a suspend into that deep sleep then a resumption would not lead to being able to wake-up from MagicPacket with password again. Fix this by keeping a software copy of the password and program it during suspend. Fixes: 83e82f4c706b ("net: systemport: add Wake-on-LAN support") Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bcmsysport.c | 25 ++++++++++--------------- drivers/net/ethernet/broadcom/bcmsysport.h | 2 ++ 2 files changed, 12 insertions(+), 15 deletions(-) commit 2348bb3117e1c88fd7799cd751200eda84b55c23 Merge: c14f07c6211c 85965487abc5 Author: David S. Miller Date: Sun Feb 3 11:06:25 2019 -0800 Merge branch 'vsock-virtio-hot-unplug' Stefano Garzarella says: ==================== vsock/virtio: fix issues on device hot-unplug These patches try to handle the hot-unplug of vsock virtio transport device in a proper way. Maybe move the vsock_core_init()/vsock_core_exit() functions in the module_init and module_exit of vsock_virtio_transport module can't be the best way, but the architecture of vsock_core forces us to this approach for now. The vsock_core proto_ops expect a valid pointer to the transport device, so we can't call vsock_core_exit() until there are open sockets. v2 -> v3: - Rebased on master v1 -> v2: - Fixed commit message of patch 1. - Added Reviewed-by, Acked-by tags by Stefan ==================== Signed-off-by: David S. Miller commit 85965487abc540368393a15491e6e7fcd230039d Author: Stefano Garzarella Date: Fri Feb 1 12:42:07 2019 +0100 vsock/virtio: reset connected sockets on device removal When the virtio transport device disappear, we should reset all connected sockets in order to inform the users. Signed-off-by: Stefano Garzarella Reviewed-by: Stefan Hajnoczi Signed-off-by: David S. Miller net/vmw_vsock/virtio_transport.c | 3 +++ 1 file changed, 3 insertions(+) commit 22b5c0b63f32568e130fa2df4ba23efce3eb495b Author: Stefano Garzarella Date: Fri Feb 1 12:42:06 2019 +0100 vsock/virtio: fix kernel panic after device hot-unplug virtio_vsock_remove() invokes the vsock_core_exit() also if there are opened sockets for the AF_VSOCK protocol family. In this way the vsock "transport" pointer is set to NULL, triggering the kernel panic at the first socket activity. This patch move the vsock_core_init()/vsock_core_exit() in the virtio_vsock respectively in module_init and module_exit functions, that cannot be invoked until there are open sockets. Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1609699 Reported-by: Yan Fu Signed-off-by: Stefano Garzarella Acked-by: Stefan Hajnoczi Signed-off-by: David S. Miller net/vmw_vsock/virtio_transport.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) commit 24b888d8d59847871387aa3b241b524661070a6e Merge: cc6810e36bd8 e6d429313ea5 Author: Linus Torvalds Date: Sun Feb 3 09:08:12 2019 -0800 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Thomas Gleixner: "A few updates for x86: - Fix an unintended sign extension issue in the fault handling code - Rename the new resource control config switch so it's less confusing - Avoid setting up EFI info in kexec when the EFI runtime is disabled. - Fix the microcode version check in the AMD microcode loader so it only loads higher version numbers and never downgrades - Set EFER.LME in the 32bit trampoline before returning to long mode to handle older AMD/KVM behaviour properly. - Add Darren and Andy as x86/platform reviewers" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/resctrl: Avoid confusion over the new X86_RESCTRL config x86/kexec: Don't setup EFI info if EFI runtime is not enabled x86/microcode/amd: Don't falsely trick the late loading mechanism MAINTAINERS: Add Andy and Darren as arch/x86/platform/ reviewers x86/fault: Fix sign-extend unintended sign extension x86/boot/compressed/64: Set EFER.LME=1 in 32-bit trampoline before returning to long mode x86/cpu: Add Atom Tremont (Jacobsville) commit cc6810e36bd875f197fcd6c74ad01f48090ecc05 Merge: 58f6d4287af7 b284909abad4 Author: Linus Torvalds Date: Sun Feb 3 09:02:03 2019 -0800 Merge branch 'smp-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull cpu hotplug fixes from Thomas Gleixner: "Two fixes for the cpu hotplug machinery: - Replace the overly clever 'SMT disabled by BIOS' detection logic as it breaks KVM scenarios and prevents speculation control updates when the Hyperthreads are brought online late after boot. - Remove a redundant invocation of the speculation control update function" * 'smp-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: cpu/hotplug: Fix "SMT disabled by BIOS" detection for KVM x86/speculation: Remove redundant arch_smt_update() invocation commit 58f6d4287af751a75b24f4d32e6e1b077146ab18 Merge: 89401be6580e d3c8c0af7565 Author: Linus Torvalds Date: Sun Feb 3 08:59:51 2019 -0800 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Thomas Gleixner: "A pile of perf updates: - Fix broken sanity check in the /proc/sys/kernel/perf_cpu_time_max_percent write handler - Cure a perf script crash which caused by an unitinialized data structure - Highlight the hottest instruction in perf top and not a random one - Cure yet another clang issue when building perf python - Handle topology entries with no CPU correctly in the tools - Handle perf data which contains both tracepoints and performance counter entries correctly. - Add a missing NULL pointer check in perf ordered_events_free()" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf script: Fix crash when processing recorded stat data perf top: Fix wrong hottest instruction highlighted perf tools: Handle TOPOLOGY headers with no CPU perf python: Remove -fstack-clash-protection when building with some clang versions perf core: Fix perf_proc_update_handler() bug perf script: Fix crash with printing mixed trace point and other events perf ordered_events: Fix crash in ordered_events__free commit 89401be6580eab6419bab1f553144131e7a335dc Merge: 312b3a93dda6 74c953ca5f6b Author: Linus Torvalds Date: Sun Feb 3 08:57:05 2019 -0800 Merge branch 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull EFI fix from Thomas Gleixner: "The dump info for the efi page table debugging lacks a terminator which causes the kernel to crash when the debugfile is read" * 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: efi/arm64: Fix debugfs crash by adding a terminator for ptdump marker commit 312b3a93dda6db9354b0c6b0f1868c1434e8c787 Merge: 12491ed354d2 532b618bdf23 Author: Linus Torvalds Date: Sun Feb 3 08:48:33 2019 -0800 Merge tag 'for-5.0-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - regression fix: transaction commit can run away due to delayed ref waiting heuristic, this is not necessary now because of the proper reservation mechanism introduced in 5.0 - regression fix: potential crash due to use-before-check of an ERR_PTR return value - fix for transaction abort during transaction commit that needs to properly clean up pending block groups - fix deadlock during b-tree node/leaf splitting, when this happens on some of the fundamental trees, we must prevent new tree block allocation to re-enter indirectly via the block group flushing path - potential memory leak after errors during mount * tag 'for-5.0-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: On error always free subvol_name in btrfs_mount btrfs: clean up pending block groups when transaction commit aborts btrfs: fix potential oops in device_list_add btrfs: don't end the transaction for delayed refs in throttle Btrfs: fix deadlock when allocating tree block during leaf/node split commit d28af26faa0b1daf3c692603d46bc4687c16f19e Author: Tony Luck Date: Thu Jan 31 16:33:41 2019 -0800 x86/MCE: Initialize mce.bank in the case of a fatal error in mce_no_way_out() Internal injection testing crashed with a console log that said: mce: [Hardware Error]: CPU 7: Machine Check Exception: f Bank 0: bd80000000100134 This caused a lot of head scratching because the MCACOD (bits 15:0) of that status is a signature from an L1 data cache error. But Linux says that it found it in "Bank 0", which on this model CPU only reports L1 instruction cache errors. The answer was that Linux doesn't initialize "m->bank" in the case that it finds a fatal error in the mce_no_way_out() pre-scan of banks. If this was a local machine check, then this partially initialized struct mce is being passed to mce_panic(). Fix is simple: just initialize m->bank in the case of a fatal error. Fixes: 40c36e2741d7 ("x86/mce: Fix incorrect "Machine check from unknown source" message") Signed-off-by: Tony Luck Signed-off-by: Borislav Petkov Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Thomas Gleixner Cc: Vishal Verma Cc: x86-ml Cc: stable@vger.kernel.org # v4.18 Note pre-v5.0 arch/x86/kernel/cpu/mce/core.c was called arch/x86/kernel/cpu/mcheck/mce.c Link: https://lkml.kernel.org/r/20190201003341.10638-1-tony.luck@intel.com arch/x86/kernel/cpu/mce/core.c | 1 + 1 file changed, 1 insertion(+) commit 6d923f8fe821c0c6b5378635cbcc9da5f5ec520a Merge: 798badf8467f f214ff521fb1 Author: Greg Kroah-Hartman Date: Sun Feb 3 13:10:41 2019 +0100 Merge tag 'iio-fixes-5.0a' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus Jonathan writes: First set of IIO fixes for the 5.0 cycle. Been a busy month, so these are rather later than they should have been. * atlas-ph-sensor: - Temperature scale didn't correspond to the ABI. * axp288: - A few different fixes around the TS-pin handling. * ti-ads8688 - Not enough space in the buffer used to build the scan to allow for the timestamp. * tools - iio_generic_buffer - Make num_loops signed so that we really are running for ever rather than just a long time when we specify -1. * tag 'iio-fixes-5.0a' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio: iio: ti-ads8688: Update buffer allocation for timestamps tools: iio: iio_generic_buffer: make num_loops signed iio: adc: axp288: Fix TS-pin handling iio: chemical: atlas-ph-sensor: correct IIO_TEMP values to millicelsius commit c14f07c6211cc01d52ed92cce1fade5071b8d197 Author: Russell King Date: Thu Jan 31 16:59:46 2019 +0000 Revert "net: phy: marvell: avoid pause mode on SGMII-to-Copper for 88e151x" This reverts commit 6623c0fba10ef45b64ca213ad5dec926f37fa9a0. The original diagnosis was incorrect: it appears that the NIC had PHY polling mode enabled, which meant that it overwrote the PHYs advertisement register during negotiation. Signed-off-by: Russell King Tested-by: Yonglong Liu Signed-off-by: David S. Miller drivers/net/phy/marvell.c | 16 ---------------- 1 file changed, 16 deletions(-) commit 12491ed354d23c0ecbe02459bf4be58b8c772bc8 Merge: 74b13e7efe00 5fa98c2eda35 Author: Linus Torvalds Date: Sat Feb 2 10:34:32 2019 -0800 Merge tag 'devicetree-fixes-for-5.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull Devicetree fix from Rob Herring: "A single fix for building DT bindings in-tree" * tag 'devicetree-fixes-for-5.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: dt-bindings: Fix dt_binding_check target for in tree builds commit 74b13e7efe005a600451d024d0c8fd52d58ad959 Merge: c8864cb70fd1 ae662eec8a51 Author: Linus Torvalds Date: Sat Feb 2 10:26:14 2019 -0800 Merge tag 'riscv-for-linus-5.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/palmer/riscv-linux Pull RISC-V fixes from Palmer Dabbelt: "This contains a handful of mostly-independent patches: - make our port respect TIF_NEED_RESCHED, which fixes CONFIG_PREEMPT=y kernels - fix double-put of OF nodes - fix a misspelling of target in our Kconfig - generic PCIe is enabled in our defconfig - fix our SBI early console to properly handle line endings - fix max_low_pfn being counted in PFNs - a change to TASK_UNMAPPED_BASE to match what other arches do This has passed my standard 'boot Fedora' flow" * tag 'riscv-for-linus-5.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/palmer/riscv-linux: riscv: Adjust mmap base address at a third of task size riscv: fixup max_low_pfn with PFN_DOWN. tty/serial: use uart_console_write in the RISC-V SBL early console RISC-V: defconfig: Add CRYPTO_DEV_VIRTIO=y RISC-V: defconfig: Enable Generic PCIE by default RISC-V: defconfig: Move CONFIG_PCI{,E_XILINX} RISC-V: Kconfig: fix spelling mistake "traget" -> "target" RISC-V: asm/page.h: fix spelling mistake "CONFIG_64BITS" -> "CONFIG_64BIT" RISC-V: fix bad use of of_node_put RISC-V: Add _TIF_NEED_RESCHED check for kernel thread when CONFIG_PREEMPT=y commit c8864cb70fd13beb57211982bf3b78b6629f1a68 Merge: 3cde55ee7921 9a6d5488002f Author: Linus Torvalds Date: Sat Feb 2 10:16:28 2019 -0800 Merge tag 'for-linus-20190202' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "A few fixes that should go into this release. This contains: - MD pull request from Song, fixing a recovery OOM issue (Alexei) - Fix for a sync related stall (Jianchao) - Dummy callback for timeouts (Tetsuo) - IDE atapi sense ordering fix (me)" * tag 'for-linus-20190202' of git://git.kernel.dk/linux-block: ide: ensure atapi sense request aren't preempted blk-mq: fix a hung issue when fsync block: pass no-op callback to INIT_WORK(). md/raid5: fix 'out of memory' during raid cache recovery commit 3cde55ee7921609331178c84cca485491c97df2a Merge: b9de6efed25c 8437fcf14dee Author: Linus Torvalds Date: Sat Feb 2 10:12:53 2019 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Five minor bug fixes. The libfc one is a tiny memory leak, the zfcp one is an incorrect user visible parameter and the rest are on error legs or obscure features" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: 53c700: pass correct "dev" to dma_alloc_attrs() scsi: bnx2fc: Fix error handling in probe() scsi: scsi_debug: fix write_same with virtual_gb problem scsi: libfc: free skb when receiving invalid flogi resp scsi: zfcp: fix sysfs block queue limit output for max_segment_size commit b9de6efed25cb713c1648e71302f4af83bd14ee6 Merge: cd984a5be215 f585b283e3f0 Author: Linus Torvalds Date: Sat Feb 2 09:32:58 2019 -0800 Merge branch 'akpm' (patches from Andrew) Merge misc fixes from Andrew Morton: "24 fixes" * emailed patches from Andrew Morton : (24 commits) autofs: fix error return in autofs_fill_super() autofs: drop dentry reference only when it is never used fs/drop_caches.c: avoid softlockups in drop_pagecache_sb() mm: migrate: don't rely on __PageMovable() of newpage after unlocking it psi: clarify the Kconfig text for the default-disable option mm, memory_hotplug: __offline_pages fix wrong locking mm: hwpoison: use do_send_sig_info() instead of force_sig() kasan: mark file common so ftrace doesn't trace it init/Kconfig: fix grammar by moving a closing parenthesis lib/test_kmod.c: potential double free in error handling mm, oom: fix use-after-free in oom_kill_process mm/hotplug: invalid PFNs from pfn_to_online_page() mm,memory_hotplug: fix scan_movable_pages() for gigantic hugepages psi: fix aggregation idle shut-off mm, memory_hotplug: test_pages_in_a_zone do not pass the end of zone mm, memory_hotplug: is_mem_section_removable do not pass the end of a zone oom, oom_reaper: do not enqueue same task twice mm: migrate: make buffer_migrate_page_norefs() actually succeed kernel/exit.c: release ptraced tasks before zap_pid_ns_processes x86_64: increase stack size for KASAN_EXTRA ... commit 52abe6cc1866ac3d54612f5d80563e6608c0ddfc Author: Guennadi Liakhovetski Date: Fri Feb 1 11:05:13 2019 -0600 ASoC: topology: fix oops/use-after-free case with dai driver rmmod/modprobe tests expose a kernel oops when accessing the dai driver pointer. This comes from the topology design which operates in multiple passes. Each object removal happens at a specific iteration, and the code checks for the iteration (order) number after the memory containing the order was freed. Fix this be clearing a reference to the dai driver and check its validity to avoid dereferences. Signed-off-by: Guennadi Liakhovetski Signed-off-by: Pierre-Louis Bossart Signed-off-by: Mark Brown sound/soc/soc-core.c | 2 +- sound/soc/soc-topology.c | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) commit 7aea8a9d71d54f449f49e20324df06341cc18395 Author: Kuninori Morimoto Date: Fri Feb 1 16:49:30 2019 +0900 ASoC: rsnd: fixup MIX kctrl registration Renesas sound device has many IPs and many situations. If platform/board uses MIXer, situation will be more complex. To avoid duplicate DVC kctrl registration when MIXer was used, it had original flags. But it was issue when sound card was re-binded, because no one can't cleanup this flags then. To solve this issue, commit 9c698e8481a15237a ("ASoC: rsnd: tidyup registering method for rsnd_kctrl_new()") checks registered card->controls, because if card was re-binded, these were cleanuped automatically. This patch could solve re-binding issue. But, it start to avoid MIX kctrl. To solve these issues, we need below. To avoid card re-binding issue: check registered card->controls To avoid duplicate DVC registration: check registered rsnd_kctrl_cfg To allow multiple MIX registration: check registered rsnd_kctrl_cfg This patch do it. Fixes: 9c698e8481a15237a ("ASoC: rsnd: tidyup registering method for rsnd_kctrl_new()") Reported-by: Jiada Wang Signed-off-by: Kuninori Morimoto Tested-By: Jiada Wang Signed-off-by: Mark Brown sound/soc/sh/rcar/core.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 74c953ca5f6b4d5f1daa1ef34f4317e15c1a2987 Author: Qian Cai Date: Sat Feb 2 10:50:17 2019 +0100 efi/arm64: Fix debugfs crash by adding a terminator for ptdump marker When reading 'efi_page_tables' debugfs triggers an out-of-bounds access here: arch/arm64/mm/dump.c: 282 if (addr >= st->marker[1].start_address) { called from: arch/arm64/mm/dump.c: 331 note_page(st, addr, 2, pud_val(pud)); because st->marker++ is is called after "UEFI runtime end" which is the last element in addr_marker[]. Therefore, add a terminator like the one for kernel_page_tables, so it can be skipped to print out non-existent markers. Here's the KASAN bug report: # cat /sys/kernel/debug/efi_page_tables ---[ UEFI runtime start ]--- 0x0000000020000000-0x0000000020010000 64K PTE RW NX SHD AF ... 0x0000000020200000-0x0000000021340000 17664K PTE RW NX SHD AF ... ... 0x0000000021920000-0x0000000021950000 192K PTE RW x SHD AF ... 0x0000000021950000-0x00000000219a0000 320K PTE RW NX SHD AF ... ---[ UEFI runtime end ]--- ---[ (null) ]--- ---[ (null) ]--- BUG: KASAN: global-out-of-bounds in note_page+0x1f0/0xac0 Read of size 8 at addr ffff2000123f2ac0 by task read_all/42464 Call trace: dump_backtrace+0x0/0x298 show_stack+0x24/0x30 dump_stack+0xb0/0xdc print_address_description+0x64/0x2b0 kasan_report+0x150/0x1a4 __asan_report_load8_noabort+0x30/0x3c note_page+0x1f0/0xac0 walk_pgd+0xb4/0x244 ptdump_walk_pgd+0xec/0x140 ptdump_show+0x40/0x50 seq_read+0x3f8/0xad0 full_proxy_read+0x9c/0xc0 __vfs_read+0xfc/0x4c8 vfs_read+0xec/0x208 ksys_read+0xd0/0x15c __arm64_sys_read+0x84/0x94 el0_svc_handler+0x258/0x304 el0_svc+0x8/0xc The buggy address belongs to the variable: __compound_literal.0+0x20/0x800 Memory state around the buggy address: ffff2000123f2980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff2000123f2a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa >ffff2000123f2a80: fa fa fa fa 00 00 00 00 fa fa fa fa 00 00 00 00 ^ ffff2000123f2b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff2000123f2b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0 [ ardb: fix up whitespace ] [ mingo: fix up some moar ] Signed-off-by: Qian Cai Signed-off-by: Ard Biesheuvel Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-efi@vger.kernel.org Fixes: 9d80448ac92b ("efi/arm64: Add debugfs node to dump UEFI runtime page tables") Link: http://lkml.kernel.org/r/20190202095017.13799-2-ard.biesheuvel@linaro.org Signed-off-by: Ingo Molnar drivers/firmware/efi/arm-runtime.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit dc3f595b6617ebc0307e0ce151e8f2f2b2489b95 Author: Codrin Ciubotariu Date: Wed Jan 23 16:33:47 2019 +0000 dmaengine: at_xdmac: Fix wrongfull report of a channel as in use atchan->status variable is used to store two different information: - pass channel interrupts status from interrupt handler to tasklet; - channel information like whether it is cyclic or paused; This causes a bug when device_terminate_all() is called, (AT_XDMAC_CHAN_IS_CYCLIC cleared on atchan->status) and then a late End of Block interrupt arrives (AT_XDMAC_CIS_BIS), which sets bit 0 of atchan->status. Bit 0 is also used for AT_XDMAC_CHAN_IS_CYCLIC, so when a new descriptor for a cyclic transfer is created, the driver reports the channel as in use: if (test_and_set_bit(AT_XDMAC_CHAN_IS_CYCLIC, &atchan->status)) { dev_err(chan2dev(chan), "channel currently used\n"); return NULL; } This patch fixes the bug by adding a different struct member to keep the interrupts status separated from the channel status bits. Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver") Signed-off-by: Codrin Ciubotariu Acked-by: Ludovic Desroches Signed-off-by: Vinod Koul drivers/dma/at_xdmac.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) commit e6d429313ea5c776d2e76b4494df69102e6b7115 Author: Johannes Weiner Date: Tue Jan 29 17:44:36 2019 -0500 x86/resctrl: Avoid confusion over the new X86_RESCTRL config "Resource Control" is a very broad term for this CPU feature, and a term that is also associated with containers, cgroups etc. This can easily cause confusion. Make the user prompt more specific. Match the config symbol name. [ bp: In the future, the corresponding ARM arch-specific code will be under ARM_CPU_RESCTRL and the arch-agnostic bits will be carved out under the CPU_RESCTRL umbrella symbol. ] Signed-off-by: Johannes Weiner Signed-off-by: Borislav Petkov Cc: Babu Moger Cc: Fenghua Yu Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: James Morse Cc: Jonathan Corbet Cc: "Kirill A. Shutemov" Cc: linux-doc@vger.kernel.org Cc: Peter Zijlstra Cc: Pu Wen Cc: Reinette Chatre Cc: Thomas Gleixner Cc: Tony Luck Cc: x86-ml Link: https://lkml.kernel.org/r/20190130195621.GA30653@cmpxchg.org Documentation/x86/resctrl_ui.txt | 2 +- arch/x86/Kconfig | 6 +++--- arch/x86/include/asm/resctrl_sched.h | 4 ++-- arch/x86/kernel/cpu/Makefile | 2 +- arch/x86/kernel/cpu/resctrl/Makefile | 4 ++-- include/linux/sched.h | 2 +- 6 files changed, 10 insertions(+), 10 deletions(-) commit cd984a5be21549273a3f13b52a8b7b84097b32a7 Merge: 8b050fe42d8a 25384ce5f953 Author: Linus Torvalds Date: Fri Feb 1 16:56:30 2019 -0800 Merge tag 'xtensa-20190201' of git://github.com/jcmvbkbc/linux-xtensa Pull xtensa fixes from Max Filippov: - fix ccount_timer_shutdown for secondary CPUs - fix secondary CPU initialization - fix secondary CPU reset vector clash with double exception vector - fix present CPUs when booting with 'maxcpus' parameter - limit possible CPUs by configured NR_CPUS - issue a warning if xtensa PIC is asked to retrigger anything other than software IRQ - fix masking/unmasking of the first two IRQs on xtensa MX PIC - fix typo in Kconfig description for user space unaligned access feature - fix Kconfig warning for selecting BUILTIN_DTB * tag 'xtensa-20190201' of git://github.com/jcmvbkbc/linux-xtensa: xtensa: SMP: limit number of possible CPUs by NR_CPUS xtensa: rename BUILTIN_DTB to BUILTIN_DTB_SOURCE xtensa: Fix typo use space=>user space drivers/irqchip: xtensa-mx: fix mask and unmask drivers/irqchip: xtensa: add warning to irq_retrigger xtensa: SMP: mark each possible CPU as present xtensa: smp_lx200_defconfig: fix vectors clash xtensa: SMP: fix secondary CPU initialization xtensa: SMP: fix ccount_timer_shutdown commit 8b050fe42d8ad1a2219201ba6d773e5b0eff1a29 Merge: 33640d718c5e f7daa9c8fd19 Author: Linus Torvalds Date: Fri Feb 1 16:54:25 2019 -0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "Although we're still debugging a few minor arm64-specific issues in mainline, I didn't want to hold this lot up in the meantime. We've got an additional KASLR fix after the previous one wasn't quite complete, a fix for a performance regression when mapping executable pages into userspace and some fixes for kprobe blacklisting. All candidates for stable. Summary: - Fix module loading when KASLR is configured but disabled at runtime - Fix accidental IPI when mapping user executable pages - Ensure hyp-stub and KVM world switch code cannot be kprobed" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: hibernate: Clean the __hyp_text to PoC after resume arm64: hyp-stub: Forbid kprobing of the hyp-stub arm64: kprobe: Always blacklist the KVM world-switch code arm64: kaslr: ensure randomized quantities are clean also when kaslr is off arm64: Do not issue IPIs for user executable ptes commit 33640d718c5ec9dccdeea49fd23bd9acfc537ce7 Merge: b7bd29b530b9 b9b9378b4903 Author: Linus Torvalds Date: Fri Feb 1 16:53:01 2019 -0800 Merge tag '5.0-rc4-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb3 fixes from Steve French: "SMB3 fixes, some from this week's SMB3 test evemt, 5 for stable and a particularly important one for queryxattr (see xfstests 70 and 117)" * tag '5.0-rc4-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: update internal module version number CIFS: fix use-after-free of the lease keys CIFS: Do not consider -ENODATA as stat failure for reads CIFS: Do not count -ENODATA as failure for query directory CIFS: Fix trace command logging for SMB2 reads and writes CIFS: Fix possible oops and memory leaks in async IO cifs: limit amount of data we request for xattrs to CIFSMaxBufSize cifs: fix computation for MAX_SMB2_HDR_SIZE commit b7bd29b530b9e8c0456ef703e64e773830185724 Merge: 5eeb63359b1e d6d478aee003 Author: Linus Torvalds Date: Fri Feb 1 16:18:38 2019 -0800 Merge tag 'apparmor-pr-2019-02-01' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor Pull apparmor bug fixes from John Johansen: "Two bug fixes for apparmor: - Fix aa_label_build() error handling for failed merges - Fix warning about unused function apparmor_ipv6_postroute" * tag 'apparmor-pr-2019-02-01' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor: apparmor: Fix aa_label_build() error handling for failed merges apparmor: Fix warning about unused function apparmor_ipv6_postroute commit f585b283e3f025754c45bbe7533fc6e5c4643700 Author: Ian Kent Date: Fri Feb 1 14:21:29 2019 -0800 autofs: fix error return in autofs_fill_super() In autofs_fill_super() on error of get inode/make root dentry the return should be ENOMEM as this is the only failure case of the called functions. Link: http://lkml.kernel.org/r/154725123240.11260.796773942606871359.stgit@pluto-themaw-net Signed-off-by: Ian Kent Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/autofs/inode.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 63ce5f552beb9bdb41546b3a26c4374758b21815 Author: Pan Bian Date: Fri Feb 1 14:21:26 2019 -0800 autofs: drop dentry reference only when it is never used autofs_expire_run() calls dput(dentry) to drop the reference count of dentry. However, dentry is read via autofs_dentry_ino(dentry) after that. This may result in a use-free-bug. The patch drops the reference count of dentry only when it is never used. Link: http://lkml.kernel.org/r/154725122396.11260.16053424107144453867.stgit@pluto-themaw-net Signed-off-by: Pan Bian Signed-off-by: Ian Kent Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/autofs/expire.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit c27d82f52f75fc9d8d9d40d120d2a96fdeeada5e Author: Jan Kara Date: Fri Feb 1 14:21:23 2019 -0800 fs/drop_caches.c: avoid softlockups in drop_pagecache_sb() When superblock has lots of inodes without any pagecache (like is the case for /proc), drop_pagecache_sb() will iterate through all of them without dropping sb->s_inode_list_lock which can lead to softlockups (one of our customers hit this). Fix the problem by going to the slow path and doing cond_resched() in case the process needs rescheduling. Link: http://lkml.kernel.org/r/20190114085343.15011-1-jack@suse.cz Signed-off-by: Jan Kara Acked-by: Michal Hocko Reviewed-by: Andrew Morton Cc: Al Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/drop_caches.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit e0a352fabce61f730341d119fbedf71ffdb8663f Author: David Hildenbrand Date: Fri Feb 1 14:21:19 2019 -0800 mm: migrate: don't rely on __PageMovable() of newpage after unlocking it We had a race in the old balloon compaction code before b1123ea6d3b3 ("mm: balloon: use general non-lru movable page feature") refactored it that became visible after backporting 195a8c43e93d ("virtio-balloon: deflate via a page list") without the refactoring. The bug existed from commit d6d86c0a7f8d ("mm/balloon_compaction: redesign ballooned pages management") till b1123ea6d3b3 ("mm: balloon: use general non-lru movable page feature"). d6d86c0a7f8d ("mm/balloon_compaction: redesign ballooned pages management") was backported to 3.12, so the broken kernels are stable kernels [3.12 - 4.7]. There was a subtle race between dropping the page lock of the newpage in __unmap_and_move() and checking for __is_movable_balloon_page(newpage). Just after dropping this page lock, virtio-balloon could go ahead and deflate the newpage, effectively dequeueing it and clearing PageBalloon, in turn making __is_movable_balloon_page(newpage) fail. This resulted in dropping the reference of the newpage via putback_lru_page(newpage) instead of put_page(newpage), leading to page->lru getting modified and a !LRU page ending up in the LRU lists. With 195a8c43e93d ("virtio-balloon: deflate via a page list") backported, one would suddenly get corrupted lists in release_pages_balloon(): - WARNING: CPU: 13 PID: 6586 at lib/list_debug.c:59 __list_del_entry+0xa1/0xd0 - list_del corruption. prev->next should be ffffe253961090a0, but was dead000000000100 Nowadays this race is no longer possible, but it is hidden behind very ugly handling of __ClearPageMovable() and __PageMovable(). __ClearPageMovable() will not make __PageMovable() fail, only PageMovable(). So the new check (__PageMovable(newpage)) will still hold even after newpage was dequeued by virtio-balloon. If anybody would ever change that special handling, the BUG would be introduced again. So instead, make it explicit and use the information of the original isolated page before migration. This patch can be backported fairly easy to stable kernels (in contrast to the refactoring). Link: http://lkml.kernel.org/r/20190129233217.10747-1-david@redhat.com Fixes: d6d86c0a7f8d ("mm/balloon_compaction: redesign ballooned pages management") Signed-off-by: David Hildenbrand Reported-by: Vratislav Bendel Acked-by: Michal Hocko Acked-by: Rafael Aquini Cc: Mel Gorman Cc: "Kirill A. Shutemov" Cc: Michal Hocko Cc: Naoya Horiguchi Cc: Jan Kara Cc: Andrea Arcangeli Cc: Dominik Brodowski Cc: Matthew Wilcox Cc: Vratislav Bendel Cc: Rafael Aquini Cc: Konstantin Khlebnikov Cc: Minchan Kim Cc: [3.12 - 4.7] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/migrate.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 7b2489d37e1e355228f7c55724f77580e1dec22a Author: Johannes Weiner Date: Fri Feb 1 14:21:15 2019 -0800 psi: clarify the Kconfig text for the default-disable option The current help text caused some confusion in online forums about whether or not to default-enable or default-disable psi in vendor kernels. This is because it doesn't communicate the reason for why we made this setting configurable in the first place: that the overhead is non-zero in an artificial scheduler stress test. Since this isn't representative of real workloads, and the effect was not measurable in scheduler-heavy real world applications such as the webservers and memcache installations at Facebook, it's fair to point out that this is a pretty cautious option to select. Link: http://lkml.kernel.org/r/20190129233617.16767-1-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Reviewed-by: Andrew Morton Cc: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds init/Kconfig | 11 +++++++++++ 1 file changed, 11 insertions(+) commit e3df4c6e4836ce93cd5cf92d9cbdeaf4439a0241 Author: Michal Hocko Date: Fri Feb 1 14:21:12 2019 -0800 mm, memory_hotplug: __offline_pages fix wrong locking Jan has noticed that we do double unlock on some failure paths when offlining a page range. This is indeed the case when test_pages_in_a_zone respp. start_isolate_page_range fail. This was an omission when forward porting the debugging patch from an older kernel. Fix the issue by dropping mem_hotplug_done from the failure condition and keeping the single unlock in the catch all failure path. Link: http://lkml.kernel.org/r/20190115120307.22768-1-mhocko@kernel.org Fixes: 7960509329c2 ("mm, memory_hotplug: print reason for the offlining failure") Signed-off-by: Michal Hocko Reported-by: Jan Kara Reviewed-by: Jan Kara Tested-by: Jan Kara Reviewed-by: Oscar Salvador Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/memory_hotplug.c | 2 -- 1 file changed, 2 deletions(-) commit 6376360ecbe525a9c17b3d081dfd88ba3e4ed65b Author: Naoya Horiguchi Date: Fri Feb 1 14:21:08 2019 -0800 mm: hwpoison: use do_send_sig_info() instead of force_sig() Currently memory_failure() is racy against process's exiting, which results in kernel crash by null pointer dereference. The root cause is that memory_failure() uses force_sig() to forcibly kill asynchronous (meaning not in the current context) processes. As discussed in thread https://lkml.org/lkml/2010/6/8/236 years ago for OOM fixes, this is not a right thing to do. OOM solves this issue by using do_send_sig_info() as done in commit d2d393099de2 ("signal: oom_kill_task: use SEND_SIG_FORCED instead of force_sig()"), so this patch is suggesting to do the same for hwpoison. do_send_sig_info() properly accesses to siglock with lock_task_sighand(), so is free from the reported race. I confirmed that the reported bug reproduces with inserting some delay in kill_procs(), and it never reproduces with this patch. Note that memory_failure() can send another type of signal using force_sig_mceerr(), and the reported race shouldn't happen on it because force_sig_mceerr() is called only for synchronous processes (i.e. BUS_MCEERR_AR happens only when some process accesses to the corrupted memory.) Link: http://lkml.kernel.org/r/20190116093046.GA29835@hori1.linux.bs1.fc.nec.co.jp Signed-off-by: Naoya Horiguchi Reported-by: Jane Chu Reviewed-by: Dan Williams Reviewed-by: William Kucharski Cc: Oleg Nesterov Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/memory-failure.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 0d0c8de8788b6c441ea01365612de7efc20cc682 Author: Anders Roxell Date: Fri Feb 1 14:21:05 2019 -0800 kasan: mark file common so ftrace doesn't trace it When option CONFIG_KASAN is enabled toghether with ftrace, function ftrace_graph_caller() gets in to a recursion, via functions kasan_check_read() and kasan_check_write(). Breakpoint 2, ftrace_graph_caller () at ../arch/arm64/kernel/entry-ftrace.S:179 179 mcount_get_pc x0 // function's pc (gdb) bt #0 ftrace_graph_caller () at ../arch/arm64/kernel/entry-ftrace.S:179 #1 0xffffff90101406c8 in ftrace_caller () at ../arch/arm64/kernel/entry-ftrace.S:151 #2 0xffffff90106fd084 in kasan_check_write (p=0xffffffc06c170878, size=4) at ../mm/kasan/common.c:105 #3 0xffffff90104a2464 in atomic_add_return (v=, i=) at ./include/generated/atomic-instrumented.h:71 #4 atomic_inc_return (v=) at ./include/generated/atomic-fallback.h:284 #5 trace_graph_entry (trace=0xffffffc03f5ff380) at ../kernel/trace/trace_functions_graph.c:441 #6 0xffffff9010481774 in trace_graph_entry_watchdog (trace=) at ../kernel/trace/trace_selftest.c:741 #7 0xffffff90104a185c in function_graph_enter (ret=, func=, frame_pointer=18446743799894897728, retp=) at ../kernel/trace/trace_functions_graph.c:196 #8 0xffffff9010140628 in prepare_ftrace_return (self_addr=18446743592948977792, parent=0xffffffc03f5ff418, frame_pointer=18446743799894897728) at ../arch/arm64/kernel/ftrace.c:231 #9 0xffffff90101406f4 in ftrace_graph_caller () at ../arch/arm64/kernel/entry-ftrace.S:182 Backtrace stopped: previous frame identical to this frame (corrupt stack?) (gdb) Rework so that the kasan implementation isn't traced. Link: http://lkml.kernel.org/r/20181212183447.15890-1-anders.roxell@linaro.org Signed-off-by: Anders Roxell Acked-by: Dmitry Vyukov Tested-by: Dmitry Vyukov Acked-by: Steven Rostedt (VMware) Cc: Andrey Ryabinin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/kasan/Makefile | 1 + 1 file changed, 1 insertion(+) commit 980768338488921b15c2f01d67f0324a48ef8625 Author: Jonathan Neuschäfer Date: Fri Feb 1 14:21:01 2019 -0800 init/Kconfig: fix grammar by moving a closing parenthesis Link: http://lkml.kernel.org/r/20190129150813.15785-1-j.neuschaefer@gmx.net Signed-off-by: Jonathan Neuschäfer Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds init/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit db7ddeab3ce5d64c9696e70d61f45ea9909cd196 Author: Dan Carpenter Date: Fri Feb 1 14:20:58 2019 -0800 lib/test_kmod.c: potential double free in error handling There is a copy and paste bug so we set "config->test_driver" to NULL twice instead of setting "config->test_fs". Smatch complains that it leads to a double free: lib/test_kmod.c:840 __kmod_config_init() warn: 'config->test_fs' double freed Link: http://lkml.kernel.org/r/20190121140011.GA14283@kadam Fixes: d9c6a72d6fa2 ("kmod: add test driver to stress test the module loader") Signed-off-by: Dan Carpenter Acked-by: Luis Chamberlain Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds lib/test_kmod.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cefc7ef3c87d02fc9307835868ff721ea12cc597 Author: Shakeel Butt Date: Fri Feb 1 14:20:54 2019 -0800 mm, oom: fix use-after-free in oom_kill_process Syzbot instance running on upstream kernel found a use-after-free bug in oom_kill_process. On further inspection it seems like the process selected to be oom-killed has exited even before reaching read_lock(&tasklist_lock) in oom_kill_process(). More specifically the tsk->usage is 1 which is due to get_task_struct() in oom_evaluate_task() and the put_task_struct within for_each_thread() frees the tsk and for_each_thread() tries to access the tsk. The easiest fix is to do get/put across the for_each_thread() on the selected task. Now the next question is should we continue with the oom-kill as the previously selected task has exited? However before adding more complexity and heuristics, let's answer why we even look at the children of oom-kill selected task? The select_bad_process() has already selected the worst process in the system/memcg. Due to race, the selected process might not be the worst at the kill time but does that matter? The userspace can use the oom_score_adj interface to prefer children to be killed before the parent. I looked at the history but it seems like this is there before git history. Link: http://lkml.kernel.org/r/20190121215850.221745-1-shakeelb@google.com Reported-by: syzbot+7fbbfa368521945f0e3d@syzkaller.appspotmail.com Fixes: 6b0c81b3be11 ("mm, oom: reduce dependency on tasklist_lock") Signed-off-by: Shakeel Butt Reviewed-by: Roman Gushchin Acked-by: Michal Hocko Cc: David Rientjes Cc: Johannes Weiner Cc: Tetsuo Handa Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/oom_kill.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit b13bc35193d9e7a8c050a24928ca5c9e7c9a009b Author: Qian Cai Date: Fri Feb 1 14:20:51 2019 -0800 mm/hotplug: invalid PFNs from pfn_to_online_page() On an arm64 ThunderX2 server, the first kmemleak scan would crash [1] with CONFIG_DEBUG_VM_PGFLAGS=y due to page_to_nid() found a pfn that is not directly mapped (MEMBLOCK_NOMAP). Hence, the page->flags is uninitialized. This is due to the commit 9f1eb38e0e11 ("mm, kmemleak: little optimization while scanning") starts to use pfn_to_online_page() instead of pfn_valid(). However, in the CONFIG_MEMORY_HOTPLUG=y case, pfn_to_online_page() does not call memblock_is_map_memory() while pfn_valid() does. Historically, the commit 68709f45385a ("arm64: only consider memblocks with NOMAP cleared for linear mapping") causes pages marked as nomap being no long reassigned to the new zone in memmap_init_zone() by calling __init_single_page(). Since the commit 2d070eab2e82 ("mm: consider zone which is not fully populated to have holes") introduced pfn_to_online_page() and was designed to return a valid pfn only, but it is clearly broken on arm64. Therefore, let pfn_to_online_page() call pfn_valid_within(), so it can handle nomap thanks to the commit f52bb98f5ade ("arm64: mm: always enable CONFIG_HOLES_IN_ZONE"), while it will be optimized away on architectures where have no HOLES_IN_ZONE. [1] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000006 Mem abort info: ESR = 0x96000005 Exception class = DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000005 CM = 0, WnR = 0 Internal error: Oops: 96000005 [#1] SMP CPU: 60 PID: 1408 Comm: kmemleak Not tainted 5.0.0-rc2+ #8 pstate: 60400009 (nZCv daif +PAN -UAO) pc : page_mapping+0x24/0x144 lr : __dump_page+0x34/0x3dc sp : ffff00003a5cfd10 x29: ffff00003a5cfd10 x28: 000000000000802f x27: 0000000000000000 x26: 0000000000277d00 x25: ffff000010791f56 x24: ffff7fe000000000 x23: ffff000010772f8b x22: ffff00001125f670 x21: ffff000011311000 x20: ffff000010772f8b x19: fffffffffffffffe x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: ffff802698b19600 x13: ffff802698b1a200 x12: ffff802698b16f00 x11: ffff802698b1a400 x10: 0000000000001400 x9 : 0000000000000001 x8 : ffff00001121a000 x7 : 0000000000000000 x6 : ffff0000102c53b8 x5 : 0000000000000000 x4 : 0000000000000003 x3 : 0000000000000100 x2 : 0000000000000000 x1 : ffff000010772f8b x0 : ffffffffffffffff Process kmemleak (pid: 1408, stack limit = 0x(____ptrval____)) Call trace: page_mapping+0x24/0x144 __dump_page+0x34/0x3dc dump_page+0x28/0x4c kmemleak_scan+0x4ac/0x680 kmemleak_scan_thread+0xb4/0xdc kthread+0x12c/0x13c ret_from_fork+0x10/0x18 Code: d503201f f9400660 36000040 d1000413 (f9400661) ---[ end trace 4d4bd7f573490c8e ]--- Kernel panic - not syncing: Fatal exception SMP: stopping secondary CPUs Kernel Offset: disabled CPU features: 0x002,20000c38 Memory Limit: none ---[ end Kernel panic - not syncing: Fatal exception ]--- Link: http://lkml.kernel.org/r/20190122132916.28360-1-cai@lca.pw Fixes: 9f1eb38e0e11 ("mm, kmemleak: little optimization while scanning") Signed-off-by: Qian Cai Acked-by: Michal Hocko Cc: Oscar Salvador Cc: Catalin Marinas Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/memory_hotplug.h | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) commit eeb0efd071d821a88da3fbd35f2d478f40d3b2ea Author: Oscar Salvador Date: Fri Feb 1 14:20:47 2019 -0800 mm,memory_hotplug: fix scan_movable_pages() for gigantic hugepages This is the same sort of error we saw in commit 17e2e7d7e1b8 ("mm, page_alloc: fix has_unmovable_pages for HugePages"). Gigantic hugepages cross several memblocks, so it can be that the page we get in scan_movable_pages() is a page-tail belonging to a 1G-hugepage. If that happens, page_hstate()->size_to_hstate() will return NULL, and we will blow up in hugepage_migration_supported(). The splat is as follows: BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 #PF error: [normal kernel read fault] PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI CPU: 1 PID: 1350 Comm: bash Tainted: G E 5.0.0-rc1-mm1-1-default+ #27 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.0.0-prebuilt.qemu-project.org 04/01/2014 RIP: 0010:__offline_pages+0x6ae/0x900 Call Trace: memory_subsys_offline+0x42/0x60 device_offline+0x80/0xa0 state_store+0xab/0xc0 kernfs_fop_write+0x102/0x180 __vfs_write+0x26/0x190 vfs_write+0xad/0x1b0 ksys_write+0x42/0x90 do_syscall_64+0x5b/0x180 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Modules linked in: af_packet(E) xt_tcpudp(E) ipt_REJECT(E) xt_conntrack(E) nf_conntrack(E) nf_defrag_ipv4(E) ip_set(E) nfnetlink(E) ebtable_nat(E) ebtable_broute(E) bridge(E) stp(E) llc(E) iptable_mangle(E) iptable_raw(E) iptable_security(E) ebtable_filter(E) ebtables(E) iptable_filter(E) ip_tables(E) x_tables(E) kvm_intel(E) kvm(E) irqbypass(E) crct10dif_pclmul(E) crc32_pclmul(E) ghash_clmulni_intel(E) bochs_drm(E) ttm(E) aesni_intel(E) drm_kms_helper(E) aes_x86_64(E) crypto_simd(E) cryptd(E) glue_helper(E) drm(E) virtio_net(E) syscopyarea(E) sysfillrect(E) net_failover(E) sysimgblt(E) pcspkr(E) failover(E) i2c_piix4(E) fb_sys_fops(E) parport_pc(E) parport(E) button(E) btrfs(E) libcrc32c(E) xor(E) zstd_decompress(E) zstd_compress(E) xxhash(E) raid6_pq(E) sd_mod(E) ata_generic(E) ata_piix(E) ahci(E) libahci(E) libata(E) crc32c_intel(E) serio_raw(E) virtio_pci(E) virtio_ring(E) virtio(E) sg(E) scsi_mod(E) autofs4(E) [akpm@linux-foundation.org: fix brace layout, per David. Reduce indentation] Link: http://lkml.kernel.org/r/20190122154407.18417-1-osalvador@suse.de Signed-off-by: Oscar Salvador Reviewed-by: Anthony Yznaga Acked-by: Michal Hocko Reviewed-by: David Hildenbrand Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/memory_hotplug.c | 36 ++++++++++++++++++++---------------- 1 file changed, 20 insertions(+), 16 deletions(-) commit 1b69ac6b40ebd85eed73e4dbccde2a36961ab990 Author: Johannes Weiner Date: Fri Feb 1 14:20:42 2019 -0800 psi: fix aggregation idle shut-off psi has provisions to shut off the periodic aggregation worker when there is a period of no task activity - and thus no data that needs aggregating. However, while developing psi monitoring, Suren noticed that the aggregation clock currently won't stay shut off for good. Debugging this revealed a flaw in the idle design: an aggregation run will see no task activity and decide to go to sleep; shortly thereafter, the kworker thread that executed the aggregation will go idle and cause a scheduling change, during which the psi callback will kick the !pending worker again. This will ping-pong forever, and is equivalent to having no shut-off logic at all (but with more code!) Fix this by exempting aggregation workers from psi's clock waking logic when the state change is them going to sleep. To do this, tag workers with the last work function they executed, and if in psi we see a worker going to sleep after aggregating psi data, we will not reschedule the aggregation work item. What if the worker is also executing other items before or after? Any psi state times that were incurred by work items preceding the aggregation work will have been collected from the per-cpu buckets during the aggregation itself. If there are work items following the aggregation work, the worker's last_func tag will be overwritten and the aggregator will be kept alive to process this genuine new activity. If the aggregation work is the last thing the worker does, and we decide to go idle, the brief period of non-idle time incurred between the aggregation run and the kworker's dequeue will be stranded in the per-cpu buckets until the clock is woken by later activity. But that should not be a problem. The buckets can hold 4s worth of time, and future activity will wake the clock with a 2s delay, giving us 2s worth of data we can leave behind when disabling aggregation. If it takes a worker more than two seconds to go idle after it finishes its last work item, we likely have bigger problems in the system, and won't notice one sample that was averaged with a bogus per-CPU weight. Link: http://lkml.kernel.org/r/20190116193501.1910-1-hannes@cmpxchg.org Fixes: eb414681d5a0 ("psi: pressure stall information for CPU, memory, and IO") Signed-off-by: Johannes Weiner Reported-by: Suren Baghdasaryan Acked-by: Tejun Heo Cc: Peter Zijlstra Cc: Lai Jiangshan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/sched/psi.c | 21 +++++++++++++++++---- kernel/workqueue.c | 23 +++++++++++++++++++++++ kernel/workqueue_internal.h | 6 +++++- 3 files changed, 45 insertions(+), 5 deletions(-) commit 24feb47c5fa5b825efb0151f28906dfdad027e61 Author: Mikhail Zaslonko Date: Fri Feb 1 14:20:38 2019 -0800 mm, memory_hotplug: test_pages_in_a_zone do not pass the end of zone If memory end is not aligned with the sparse memory section boundary, the mapping of such a section is only partly initialized. This may lead to VM_BUG_ON due to uninitialized struct pages access from test_pages_in_a_zone() function triggered by memory_hotplug sysfs handlers. Here are the the panic examples: CONFIG_DEBUG_VM_PGFLAGS=y kernel parameter mem=2050M -------------------------- page:000003d082008000 is uninitialized and poisoned page dumped because: VM_BUG_ON_PAGE(PagePoisoned(p)) Call Trace: test_pages_in_a_zone+0xde/0x160 show_valid_zones+0x5c/0x190 dev_attr_show+0x34/0x70 sysfs_kf_seq_show+0xc8/0x148 seq_read+0x204/0x480 __vfs_read+0x32/0x178 vfs_read+0x82/0x138 ksys_read+0x5a/0xb0 system_call+0xdc/0x2d8 Last Breaking-Event-Address: test_pages_in_a_zone+0xde/0x160 Kernel panic - not syncing: Fatal exception: panic_on_oops Fix this by checking whether the pfn to check is within the zone. [mhocko@suse.com: separated this change from http://lkml.kernel.org/r/20181105150401.97287-2-zaslonko@linux.ibm.com] Link: http://lkml.kernel.org/r/20190128144506.15603-3-mhocko@kernel.org [mhocko@suse.com: separated this change from http://lkml.kernel.org/r/20181105150401.97287-2-zaslonko@linux.ibm.com] Signed-off-by: Michal Hocko Signed-off-by: Mikhail Zaslonko Tested-by: Mikhail Gavrilov Reviewed-by: Oscar Salvador Tested-by: Gerald Schaefer Cc: Heiko Carstens Cc: Martin Schwidefsky Cc: Mikhail Gavrilov Cc: Pavel Tatashin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/memory_hotplug.c | 3 +++ 1 file changed, 3 insertions(+) commit efad4e475c312456edb3c789d0996d12ed744c13 Author: Michal Hocko Date: Fri Feb 1 14:20:34 2019 -0800 mm, memory_hotplug: is_mem_section_removable do not pass the end of a zone Patch series "mm, memory_hotplug: fix uninitialized pages fallouts", v2. Mikhail Zaslonko has posted fixes for the two bugs quite some time ago [1]. I have pushed back on those fixes because I believed that it is much better to plug the problem at the initialization time rather than play whack-a-mole all over the hotplug code and find all the places which expect the full memory section to be initialized. We have ended up with commit 2830bf6f05fb ("mm, memory_hotplug: initialize struct pages for the full memory section") merged and cause a regression [2][3]. The reason is that there might be memory layouts when two NUMA nodes share the same memory section so the merged fix is simply incorrect. In order to plug this hole we really have to be zone range aware in those handlers. I have split up the original patch into two. One is unchanged (patch 2) and I took a different approach for `removable' crash. [1] http://lkml.kernel.org/r/20181105150401.97287-2-zaslonko@linux.ibm.com [2] https://bugzilla.redhat.com/show_bug.cgi?id=1666948 [3] http://lkml.kernel.org/r/20190125163938.GA20411@dhcp22.suse.cz This patch (of 2): Mikhail has reported the following VM_BUG_ON triggered when reading sysfs removable state of a memory block: page:000003d08300c000 is uninitialized and poisoned page dumped because: VM_BUG_ON_PAGE(PagePoisoned(p)) Call Trace: is_mem_section_removable+0xb4/0x190 show_mem_removable+0x9a/0xd8 dev_attr_show+0x34/0x70 sysfs_kf_seq_show+0xc8/0x148 seq_read+0x204/0x480 __vfs_read+0x32/0x178 vfs_read+0x82/0x138 ksys_read+0x5a/0xb0 system_call+0xdc/0x2d8 Last Breaking-Event-Address: is_mem_section_removable+0xb4/0x190 Kernel panic - not syncing: Fatal exception: panic_on_oops The reason is that the memory block spans the zone boundary and we are stumbling over an unitialized struct page. Fix this by enforcing zone range in is_mem_section_removable so that we never run away from a zone. Link: http://lkml.kernel.org/r/20190128144506.15603-2-mhocko@kernel.org Signed-off-by: Michal Hocko Reported-by: Mikhail Zaslonko Debugged-by: Mikhail Zaslonko Tested-by: Gerald Schaefer Tested-by: Mikhail Gavrilov Reviewed-by: Oscar Salvador Cc: Pavel Tatashin Cc: Heiko Carstens Cc: Martin Schwidefsky Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/memory_hotplug.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 9bcdeb51bd7d2ae9fe65ea4d60643d2aeef5bfe3 Author: Tetsuo Handa Date: Fri Feb 1 14:20:31 2019 -0800 oom, oom_reaper: do not enqueue same task twice Arkadiusz reported that enabling memcg's group oom killing causes strange memcg statistics where there is no task in a memcg despite the number of tasks in that memcg is not 0. It turned out that there is a bug in wake_oom_reaper() which allows enqueuing same task twice which makes impossible to decrease the number of tasks in that memcg due to a refcount leak. This bug existed since the OOM reaper became invokable from task_will_free_mem(current) path in out_of_memory() in Linux 4.7, T1@P1 |T2@P1 |T3@P1 |OOM reaper ----------+----------+----------+------------ # Processing an OOM victim in a different memcg domain. try_charge() mem_cgroup_out_of_memory() mutex_lock(&oom_lock) try_charge() mem_cgroup_out_of_memory() mutex_lock(&oom_lock) try_charge() mem_cgroup_out_of_memory() mutex_lock(&oom_lock) out_of_memory() oom_kill_process(P1) do_send_sig_info(SIGKILL, @P1) mark_oom_victim(T1@P1) wake_oom_reaper(T1@P1) # T1@P1 is enqueued. mutex_unlock(&oom_lock) out_of_memory() mark_oom_victim(T2@P1) wake_oom_reaper(T2@P1) # T2@P1 is enqueued. mutex_unlock(&oom_lock) out_of_memory() mark_oom_victim(T1@P1) wake_oom_reaper(T1@P1) # T1@P1 is enqueued again due to oom_reaper_list == T2@P1 && T1@P1->oom_reaper_list == NULL. mutex_unlock(&oom_lock) # Completed processing an OOM victim in a different memcg domain. spin_lock(&oom_reaper_lock) # T1P1 is dequeued. spin_unlock(&oom_reaper_lock) but memcg's group oom killing made it easier to trigger this bug by calling wake_oom_reaper() on the same task from one out_of_memory() request. Fix this bug using an approach used by commit 855b018325737f76 ("oom, oom_reaper: disable oom_reaper for oom_kill_allocating_task"). As a side effect of this patch, this patch also avoids enqueuing multiple threads sharing memory via task_will_free_mem(current) path. Link: http://lkml.kernel.org/r/e865a044-2c10-9858-f4ef-254bc71d6cc2@i-love.sakura.ne.jp Link: http://lkml.kernel.org/r/5ee34fc6-1485-34f8-8790-903ddabaa809@i-love.sakura.ne.jp Fixes: af8e15cc85a25315 ("oom, oom_reaper: do not enqueue task if it is on the oom_reaper_list head") Signed-off-by: Tetsuo Handa Reported-by: Arkadiusz Miskiewicz Tested-by: Arkadiusz Miskiewicz Acked-by: Michal Hocko Acked-by: Roman Gushchin Cc: Tejun Heo Cc: Aleksa Sarai Cc: Jay Kamat Cc: Johannes Weiner Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/sched/coredump.h | 1 + mm/oom_kill.c | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) commit 80409c65e2c6cd1540045ee01fc55e50d95e0983 Author: Jan Kara Date: Fri Feb 1 14:20:27 2019 -0800 mm: migrate: make buffer_migrate_page_norefs() actually succeed Currently, buffer_migrate_page_norefs() was constantly failing because buffer_migrate_lock_buffers() grabbed reference on each buffer. In fact, there's no reason for buffer_migrate_lock_buffers() to grab any buffer references as the page is locked during all our operation and thus nobody can reclaim buffers from the page. So remove grabbing of buffer references which also makes buffer_migrate_page_norefs() succeed. Link: http://lkml.kernel.org/r/20190116131217.7226-1-jack@suse.cz Fixes: 89cb0888ca14 "mm: migrate: provide buffer_migrate_page_norefs()" Signed-off-by: Jan Kara Cc: Sergey Senozhatsky Cc: Pavel Machek Cc: Mel Gorman Cc: Vlastimil Babka Cc: Andrea Arcangeli Cc: David Rientjes Cc: Michal Hocko Cc: Zi Yan Cc: Johannes Weiner Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/migrate.c | 5 ----- 1 file changed, 5 deletions(-) commit 8fb335e078378c8426fabeed1ebee1fbf915690c Author: Andrei Vagin Date: Fri Feb 1 14:20:24 2019 -0800 kernel/exit.c: release ptraced tasks before zap_pid_ns_processes Currently, exit_ptrace() adds all ptraced tasks in a dead list, then zap_pid_ns_processes() waits on all tasks in a current pidns, and only then are tasks from the dead list released. zap_pid_ns_processes() can get stuck on waiting tasks from the dead list. In this case, we will have one unkillable process with one or more dead children. Thanks to Oleg for the advice to release tasks in find_child_reaper(). Link: http://lkml.kernel.org/r/20190110175200.12442-1-avagin@gmail.com Fixes: 7c8bd2322c7f ("exit: ptrace: shift "reap dead" code from exit_ptrace() to forget_original_parent()") Signed-off-by: Andrei Vagin Signed-off-by: Oleg Nesterov Cc: "Eric W. Biederman" Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/exit.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) commit a8e911d13540487942d53137c156bd7707f66e5d Author: Qian Cai Date: Fri Feb 1 14:20:20 2019 -0800 x86_64: increase stack size for KASAN_EXTRA If the kernel is configured with KASAN_EXTRA, the stack size is increasted significantly because this option sets "-fstack-reuse" to "none" in GCC [1]. As a result, it triggers stack overrun quite often with 32k stack size compiled using GCC 8. For example, this reproducer https://github.com/linux-test-project/ltp/blob/master/testcases/kernel/syscalls/madvise/madvise06.c triggers a "corrupted stack end detected inside scheduler" very reliably with CONFIG_SCHED_STACK_END_CHECK enabled. There are just too many functions that could have a large stack with KASAN_EXTRA due to large local variables that have been called over and over again without being able to reuse the stacks. Some noticiable ones are size 7648 shrink_page_list 3584 xfs_rmap_convert 3312 migrate_page_move_mapping 3312 dev_ethtool 3200 migrate_misplaced_transhuge_page 3168 copy_process There are other 49 functions are over 2k in size while compiling kernel with "-Wframe-larger-than=" even with a related minimal config on this machine. Hence, it is too much work to change Makefiles for each object to compile without "-fsanitize-address-use-after-scope" individually. [1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81715#c23 Although there is a patch in GCC 9 to help the situation, GCC 9 probably won't be released in a few months and then it probably take another 6-month to 1-year for all major distros to include it as a default. Hence, the stack usage with KASAN_EXTRA can be revisited again in 2020 when GCC 9 is everywhere. Until then, this patch will help users avoid stack overrun. This has already been fixed for arm64 for the same reason via 6e8830674ea ("arm64: kasan: Increase stack size for KASAN_EXTRA"). Link: http://lkml.kernel.org/r/20190109215209.2903-1-cai@lca.pw Signed-off-by: Qian Cai Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: "H. Peter Anvin" Cc: Andrey Ryabinin Cc: Alexander Potapenko Cc: Dmitry Vyukov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/x86/include/asm/page_64_types.h | 4 ++++ 1 file changed, 4 insertions(+) commit 1ac25013fb9e4ed595cd608a406191e93520881e Author: Andrea Arcangeli Date: Fri Feb 1 14:20:16 2019 -0800 mm/hugetlb.c: teach follow_hugetlb_page() to handle FOLL_NOWAIT hugetlb needs the same fix as faultin_nopage (which was applied in commit 96312e61282a ("mm/gup.c: teach get_user_pages_unlocked to handle FOLL_NOWAIT")) or KVM hangs because it thinks the mmap_sem was already released by hugetlb_fault() if it returned VM_FAULT_RETRY, but it wasn't in the FOLL_NOWAIT case. Link: http://lkml.kernel.org/r/20190109020203.26669-2-aarcange@redhat.com Fixes: ce53053ce378 ("kvm: switch get_user_page_nowait() to get_user_pages_unlocked()") Signed-off-by: Andrea Arcangeli Tested-by: "Dr. David Alan Gilbert" Reported-by: "Dr. David Alan Gilbert" Reviewed-by: Mike Kravetz Reviewed-by: Peter Xu Cc: Mike Rapoport Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/hugetlb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 36c0f7f0f89984bb21e6d0f92d776faf7be73096 Author: Masahiro Yamada Date: Fri Feb 1 14:20:12 2019 -0800 arch: unexport asm/shmparam.h for all architectures Most architectures do not export shmparam.h to user-space. $ find arch -name shmparam.h | sort arch/alpha/include/asm/shmparam.h arch/arc/include/asm/shmparam.h arch/arm64/include/asm/shmparam.h arch/arm/include/asm/shmparam.h arch/csky/include/asm/shmparam.h arch/ia64/include/asm/shmparam.h arch/mips/include/asm/shmparam.h arch/nds32/include/asm/shmparam.h arch/nios2/include/asm/shmparam.h arch/parisc/include/asm/shmparam.h arch/powerpc/include/asm/shmparam.h arch/s390/include/asm/shmparam.h arch/sh/include/asm/shmparam.h arch/sparc/include/asm/shmparam.h arch/x86/include/asm/shmparam.h arch/xtensa/include/asm/shmparam.h Strangely, some users of the asm-generic wrapper export shmparam.h $ git grep 'generic-y += shmparam.h' arch/c6x/include/uapi/asm/Kbuild:generic-y += shmparam.h arch/h8300/include/uapi/asm/Kbuild:generic-y += shmparam.h arch/hexagon/include/uapi/asm/Kbuild:generic-y += shmparam.h arch/m68k/include/uapi/asm/Kbuild:generic-y += shmparam.h arch/microblaze/include/uapi/asm/Kbuild:generic-y += shmparam.h arch/openrisc/include/uapi/asm/Kbuild:generic-y += shmparam.h arch/riscv/include/asm/Kbuild:generic-y += shmparam.h arch/unicore32/include/uapi/asm/Kbuild:generic-y += shmparam.h The newly added riscv correctly creates the asm-generic wrapper in the kernel space, but the others (c6x, h8300, hexagon, m68k, microblaze, openrisc, unicore32) create the one in the uapi directory. Digging into the git history, now I guess fcc8487d477a ("uapi: export all headers under uapi directories") was the misconversion. Prior to that commit, no architecture exported to shmparam.h As its commit description said, that commit exported shmparam.h for c6x, h8300, hexagon, m68k, openrisc, unicore32. 83f0124ad81e ("microblaze: remove asm-generic wrapper headers") accidentally exported shmparam.h for microblaze. This commit unexports shmparam.h for those architectures. There is no more reason to export include/uapi/asm-generic/shmparam.h, so it has been moved to include/asm-generic/shmparam.h Link: http://lkml.kernel.org/r/1546904307-11124-1-git-send-email-yamada.masahiro@socionext.com Signed-off-by: Masahiro Yamada Acked-by: Stafford Horne Cc: Geert Uytterhoeven Cc: Michal Simek Cc: Yoshinori Sato Cc: Richard Kuo Cc: Guan Xuetao Cc: Nicolas Dichtel Cc: Arnd Bergmann Cc: Aurelien Jacquiot Cc: Greentime Hu Cc: Guo Ren Cc: Palmer Dabbelt Cc: Stefan Kristiansson Cc: Mark Salter Cc: Albert Ou Cc: Jonas Bonn Cc: Vincent Chen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/c6x/include/asm/Kbuild | 1 + arch/c6x/include/uapi/asm/Kbuild | 1 - arch/h8300/include/asm/Kbuild | 1 + arch/h8300/include/uapi/asm/Kbuild | 1 - arch/hexagon/include/asm/Kbuild | 1 + arch/hexagon/include/uapi/asm/Kbuild | 1 - arch/m68k/include/asm/Kbuild | 1 + arch/m68k/include/uapi/asm/Kbuild | 1 - arch/microblaze/include/asm/Kbuild | 1 + arch/microblaze/include/uapi/asm/Kbuild | 1 - arch/openrisc/include/asm/Kbuild | 1 + arch/openrisc/include/uapi/asm/Kbuild | 1 - arch/unicore32/include/asm/Kbuild | 1 + arch/unicore32/include/uapi/asm/Kbuild | 1 - 14 files changed, 7 insertions(+), 7 deletions(-) commit 1fde6f21d90f8ba5da3cb9c54ca991ed72696c43 Author: Alexey Dobriyan Date: Fri Feb 1 14:20:01 2019 -0800 proc: fix /proc/net/* after setns(2) /proc entries under /proc/net/* can't be cached into dcache because setns(2) can change current net namespace. [akpm@linux-foundation.org: coding-style fixes] [akpm@linux-foundation.org: avoid vim miscolorization] [adobriyan@gmail.com: write test, add dummy ->d_revalidate hook: necessary if /proc/net/* is pinned at setns time] Link: http://lkml.kernel.org/r/20190108192350.GA12034@avx2 Link: http://lkml.kernel.org/r/20190107162336.GA9239@avx2 Fixes: 1da4d377f943fe4194ffb9fb9c26cc58fad4dd24 ("proc: revalidate misc dentries") Signed-off-by: Alexey Dobriyan Reported-by: Mateusz Stępień Reported-by: Ahmad Fatoum Cc: Al Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/proc/generic.c | 4 +- fs/proc/internal.h | 1 + fs/proc/proc_net.c | 20 +++++ tools/testing/selftests/proc/.gitignore | 1 + tools/testing/selftests/proc/Makefile | 1 + tools/testing/selftests/proc/setns-dcache.c | 129 ++++++++++++++++++++++++++++ 6 files changed, 155 insertions(+), 1 deletion(-) commit 1723058eab19de741b80ac8ad25bfe2a00e02987 Author: Oscar Salvador Date: Fri Feb 1 14:19:57 2019 -0800 mm, memory_hotplug: don't bail out in do_migrate_range() prematurely do_migrate_range() takes a memory range and tries to isolate the pages to put them into a list. This list will be later on used in migrate_pages() to know the pages we need to migrate. Currently, if we fail to isolate a single page, we put all already isolated pages back to their LRU and we bail out from the function. This is quite suboptimal, as this will force us to start over again because scan_movable_pages will give us the same range. If there is no chance that we can isolate that page, we will loop here forever. Issue debugged in [1] has proved that. During the debugging of that issue, it was noticed that if do_migrate_ranges() fails to isolate a single page, we will just discard the work we have done so far and bail out, which means that scan_movable_pages() will find again the same set of pages. Instead, we can just skip the error, keep isolating as much pages as possible and then proceed with the call to migrate_pages(). This will allow us to do as much work as possible at once. [1] https://lkml.org/lkml/2018/12/6/324 Michal said: : I still think that this doesn't give us a whole picture. Looping for : ever is a bug. Failing the isolation is quite possible and it should : be a ephemeral condition (e.g. a race with freeing the page or : somebody else isolating the page for whatever reason). And here comes : the disadvantage of the current implementation. We simply throw : everything on the floor just because of a ephemeral condition. The : racy page_count check is quite dubious to prevent from that. Link: http://lkml.kernel.org/r/20181211135312.27034-1-osalvador@suse.de Signed-off-by: Oscar Salvador Acked-by: Michal Hocko Cc: David Hildenbrand Cc: Dan Williams Cc: Jan Kara Cc: Kirill A. Shutemov Cc: William Kucharski Cc: Pavel Tatashin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/memory_hotplug.c | 18 ++---------------- 1 file changed, 2 insertions(+), 16 deletions(-) commit e7b816415e031bf7879ffd234c5e4f4fcec13a74 Merge: 9b1f19d810e9 f01c2803873e Author: David S. Miller Date: Fri Feb 1 15:28:07 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Alexei Starovoitov says: ==================== pull-request: bpf 2019-01-31 The following pull-request contains BPF updates for your *net* tree. The main changes are: 1) disable preemption in sender side of socket filters, from Alexei. 2) fix two potential deadlocks in syscall bpf lookup and prog_register, from Martin and Alexei. 3) fix BTF to allow typedef on func_proto, from Yonghong. 4) two bpftool fixes, from Jiri and Paolo. ==================== Signed-off-by: David S. Miller commit 42caa0edabd6a0a392ec36a5f0943924e4954311 Author: James Bottomley Date: Wed Jan 30 16:42:12 2019 -0800 scsi: aic94xx: fix module loading The aic94xx driver is currently failing to load with errors like sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:03.0/0000:02:00.3/0000:07:02.0/revision' Because the PCI code had recently added a file named 'revision' to every PCI device. Fix this by renaming the aic94xx revision file to aic_revision. This is safe to do for us because as far as I can tell, there's nothing in userspace relying on the current aic94xx revision file so it can be renamed without breaking anything. Fixes: 702ed3be1b1b (PCI: Create revision file in sysfs) Cc: stable@vger.kernel.org Signed-off-by: James Bottomley Signed-off-by: Martin K. Petersen drivers/scsi/aic94xx/aic94xx_init.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 9b1f19d810e92d6cdc68455fbc22d9f961a58ce1 Author: Eric Dumazet Date: Wed Jan 30 11:39:41 2019 -0800 dccp: fool proof ccid_hc_[rt]x_parse_options() Similarly to commit 276bdb82dedb ("dccp: check ccid before dereferencing") it is wise to test for a NULL ccid. kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 5.0.0-rc3+ #37 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:ccid_hc_tx_parse_options net/dccp/ccid.h:205 [inline] RIP: 0010:dccp_parse_options+0x8d9/0x12b0 net/dccp/options.c:233 Code: c5 0f b6 75 b3 80 38 00 0f 85 d6 08 00 00 48 b9 00 00 00 00 00 fc ff df 48 8b 45 b8 4c 8b b8 f8 07 00 00 4c 89 f8 48 c1 e8 03 <80> 3c 08 00 0f 85 95 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b kobject: 'loop5' (0000000080f78fc1): kobject_uevent_env RSP: 0018:ffff8880a94df0b8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8880858ac723 RCX: dffffc0000000000 RDX: 0000000000000100 RSI: 0000000000000007 RDI: 0000000000000001 RBP: ffff8880a94df140 R08: 0000000000000001 R09: ffff888061b83a80 R10: ffffed100c370752 R11: ffff888061b83a97 R12: 0000000000000026 R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f0defa33518 CR3: 000000008db5e000 CR4: 00000000001406e0 kobject: 'loop5' (0000000080f78fc1): fill_kobj_path: path = '/devices/virtual/block/loop5' DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: dccp_rcv_state_process+0x2b6/0x1af6 net/dccp/input.c:654 dccp_v4_do_rcv+0x100/0x190 net/dccp/ipv4.c:688 sk_backlog_rcv include/net/sock.h:936 [inline] __sk_receive_skb+0x3a9/0xea0 net/core/sock.c:473 dccp_v4_rcv+0x10cb/0x1f80 net/dccp/ipv4.c:880 ip_protocol_deliver_rcu+0xb6/0xa20 net/ipv4/ip_input.c:208 ip_local_deliver_finish+0x23b/0x390 net/ipv4/ip_input.c:234 NF_HOOK include/linux/netfilter.h:289 [inline] NF_HOOK include/linux/netfilter.h:283 [inline] ip_local_deliver+0x1f0/0x740 net/ipv4/ip_input.c:255 dst_input include/net/dst.h:450 [inline] ip_rcv_finish+0x1f4/0x2f0 net/ipv4/ip_input.c:414 NF_HOOK include/linux/netfilter.h:289 [inline] NF_HOOK include/linux/netfilter.h:283 [inline] ip_rcv+0xed/0x620 net/ipv4/ip_input.c:524 __netif_receive_skb_one_core+0x160/0x210 net/core/dev.c:4973 __netif_receive_skb+0x2c/0x1c0 net/core/dev.c:5083 process_backlog+0x206/0x750 net/core/dev.c:5923 napi_poll net/core/dev.c:6346 [inline] net_rx_action+0x76d/0x1930 net/core/dev.c:6412 __do_softirq+0x30b/0xb11 kernel/softirq.c:292 run_ksoftirqd kernel/softirq.c:654 [inline] run_ksoftirqd+0x8e/0x110 kernel/softirq.c:646 smpboot_thread_fn+0x6ab/0xa10 kernel/smpboot.c:164 kthread+0x357/0x430 kernel/kthread.c:246 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 Modules linked in: ---[ end trace 58a0ba03bea2c376 ]--- RIP: 0010:ccid_hc_tx_parse_options net/dccp/ccid.h:205 [inline] RIP: 0010:dccp_parse_options+0x8d9/0x12b0 net/dccp/options.c:233 Code: c5 0f b6 75 b3 80 38 00 0f 85 d6 08 00 00 48 b9 00 00 00 00 00 fc ff df 48 8b 45 b8 4c 8b b8 f8 07 00 00 4c 89 f8 48 c1 e8 03 <80> 3c 08 00 0f 85 95 08 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b RSP: 0018:ffff8880a94df0b8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8880858ac723 RCX: dffffc0000000000 RDX: 0000000000000100 RSI: 0000000000000007 RDI: 0000000000000001 RBP: ffff8880a94df140 R08: 0000000000000001 R09: ffff888061b83a80 R10: ffffed100c370752 R11: ffff888061b83a97 R12: 0000000000000026 R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f0defa33518 CR3: 0000000009871000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Signed-off-by: Eric Dumazet Reported-by: syzbot Cc: Gerrit Renker Signed-off-by: David S. Miller net/dccp/ccid.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit ec34f792d357514469ce48a8672f175b2fa7a96f Merge: 7596175e99b3 46ad02229d6b Author: David S. Miller Date: Fri Feb 1 14:45:45 2019 -0800 Merge branch 'smc-fixes' Ursula Braun says: ==================== net/smc: fixes 2019-01-30 here are some fixes in different areas of the smc code for the net tree. ==================== Signed-off-by: David S. Miller commit 46ad02229d6b4ee276eb295ca08f039993f323c8 Author: Karsten Graul Date: Wed Jan 30 18:51:08 2019 +0100 net/smc: fix use of variable in cleared area Do not use pend->idx as index for the arrays because its value is located in the cleared area. Use the existing local variable instead. Without this fix the wrong area might be cleared. Signed-off-by: Karsten Graul Signed-off-by: Ursula Braun Signed-off-by: David S. Miller net/smc/smc_wr.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit e5f3aa04dbfd92154f21edfeb7a1676a45918928 Author: Karsten Graul Date: Wed Jan 30 18:51:07 2019 +0100 net/smc: use device link provided in qp_context The device field of the IB event structure does not always point to the SMC IB device. Load the pointer from the qp_context which is always provided to smc_ib_qp_event_handler() in the priv field. And for qp events the affected port is given in the qp structure of the ibevent, derive it from there. Signed-off-by: Karsten Graul Signed-off-by: Ursula Braun Signed-off-by: David S. Miller net/smc/smc_ib.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 2dee25af42f99b476d5916aeac5c994e4dcc910b Author: Karsten Graul Date: Wed Jan 30 18:51:06 2019 +0100 net/smc: call smc_cdc_msg_send() under send_lock Call smc_cdc_msg_send() under the connection send_lock to make sure all send operations for one connection are serialized. Signed-off-by: Karsten Graul Signed-off-by: Ursula Braun Signed-off-by: David S. Miller net/smc/smc_cdc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 33f3fcc290671590821ff3c0c9396db1ec9b7d4c Author: Karsten Graul Date: Wed Jan 30 18:51:05 2019 +0100 net/smc: do not wait under send_lock smc_cdc_get_free_slot() might wait for free transfer buffers when using SMC-R. This wait should not be done under the send_lock, which is a spin_lock. This fixes a cpu loop in parallel threads waiting for the send_lock. Signed-off-by: Karsten Graul Signed-off-by: Ursula Braun Signed-off-by: David S. Miller net/smc/smc_tx.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) commit 51c5aba3b672c4285fca052817f34b22dc79dda7 Author: Karsten Graul Date: Wed Jan 30 18:51:04 2019 +0100 net/smc: recvmsg and splice_read should return 0 after shutdown When a socket was connected and is now shut down for read, return 0 to indicate end of data in recvmsg and splice_read (like TCP) and do not return ENOTCONN. This behavior is required by the socket api. Signed-off-by: Karsten Graul Signed-off-by: Ursula Braun Signed-off-by: David S. Miller net/smc/af_smc.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) commit 6889b36da78a21a312d8b462c1fa25a03c2ff192 Author: Karsten Graul Date: Wed Jan 30 18:51:03 2019 +0100 net/smc: don't wait for send buffer space when data was already sent When there is no more send buffer space and at least 1 byte was already sent then return to user space. The wait is only done when no data was sent by the sendmsg() call. This fixes smc_tx_sendmsg() which tried to always send all user data and started to wait for free send buffer space when needed. During this wait the user space program was blocked in the sendmsg() call and hence not able to receive incoming data. When both sides were in such a situation then the connection stalled forever. Signed-off-by: Karsten Graul Signed-off-by: Ursula Braun Signed-off-by: David S. Miller net/smc/smc_tx.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit 77f838ace755d2f466536c44dac6c856f62cd901 Author: Karsten Graul Date: Wed Jan 30 18:51:02 2019 +0100 net/smc: prevent races between smc_lgr_terminate() and smc_conn_free() To prevent races between smc_lgr_terminate() and smc_conn_free() add an extra check of the lgr field before accessing it, and cancel a delayed free_work when a new smc connection is created. This fixes the problem that free_work cleared the lgr variable but smc_lgr_terminate() or smc_conn_free() still access it in parallel. Signed-off-by: Karsten Graul Signed-off-by: Ursula Braun Signed-off-by: David S. Miller net/smc/smc_core.c | 4 ++++ 1 file changed, 4 insertions(+) commit ca8dc1334a71d6081b09e18d55198a27e28fd44b Author: Hans Wippel Date: Wed Jan 30 18:51:01 2019 +0100 net/smc: allow 16 byte pnetids in netlink policy Currently, users can only send pnetids with a maximum length of 15 bytes over the SMC netlink interface although the maximum pnetid length is 16 bytes. This patch changes the SMC netlink policy to accept 16 byte pnetids. Signed-off-by: Hans Wippel Signed-off-by: Ursula Braun Signed-off-by: David S. Miller net/smc/smc_pnet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 14d22d4d61e40623a7c5816728bfe55c322e779a Author: Ursula Braun Date: Wed Jan 30 18:51:00 2019 +0100 net/smc: fix another sizeof to int comparison Comparing an int to a size, which is unsigned, causes the int to become unsigned, giving the wrong result. kernel_sendmsg can return a negative error code. Signed-off-by: Ursula Braun Signed-off-by: David S. Miller net/smc/smc_clc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7596175e99b3d4bce28022193efd954c201a782a Author: Govindarajulu Varadarajan Date: Wed Jan 30 06:59:00 2019 -0800 enic: fix checksum validation for IPv6 In case of IPv6 pkts, ipv4_csum_ok is 0. Because of this, driver does not set skb->ip_summed. So IPv6 rx checksum is not offloaded. Signed-off-by: Govindarajulu Varadarajan Signed-off-by: David S. Miller drivers/net/ethernet/cisco/enic/enic_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 1b5ba350784242eb1f899bcffd95d2c7cff61e84 Author: Dietmar Eggemann Date: Mon Jan 21 14:42:42 2019 +0100 ARM: 8824/1: fix a migrating irq bug when hotplug cpu Arm TC2 fails cpu hotplug stress test. This issue was tracked down to a missing copy of the new affinity cpumask for the vexpress-spc interrupt into struct irq_common_data.affinity when the interrupt is migrated in migrate_one_irq(). Fix it by replacing the arm specific hotplug cpu migration with the generic irq code. This is the counterpart implementation to commit 217d453d473c ("arm64: fix a migrating irq bug when hotplug cpu"). Tested with cpu hotplug stress test on Arm TC2 (multi_v7_defconfig plus CONFIG_ARM_BIG_LITTLE_CPUFREQ=y and CONFIG_ARM_VEXPRESS_SPC_CPUFREQ=y). The vexpress-spc interrupt (irq=22) on this board is affine to CPU0. Its affinity cpumask now changes correctly e.g. from 0 to 1-4 when CPU0 is hotplugged out. Suggested-by: Marc Zyngier Signed-off-by: Dietmar Eggemann Acked-by: Marc Zyngier Reviewed-by: Linus Walleij Signed-off-by: Russell King arch/arm/Kconfig | 1 + arch/arm/include/asm/irq.h | 1 - arch/arm/kernel/irq.c | 62 ---------------------------------------------- arch/arm/kernel/smp.c | 2 +- 4 files changed, 2 insertions(+), 64 deletions(-) commit ba59fb0273076637f0add4311faa990a5eec27c0 Author: Greg Kroah-Hartman Date: Fri Feb 1 15:15:22 2019 +0100 sctp: walk the list of asoc safely In sctp_sendmesg(), when walking the list of endpoint associations, the association can be dropped from the list, making the list corrupt. Properly handle this by using list_for_each_entry_safe() Fixes: 4910280503f3 ("sctp: add support for snd flag SCTP_SENDALL process in sendmsg") Reported-by: Secunia Research Tested-by: Secunia Research Signed-off-by: Greg Kroah-Hartman Acked-by: Marcelo Ricardo Leitner Acked-by: Neil Horman Signed-off-by: David S. Miller net/sctp/socket.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 5eeb63359b1ec4914d9898e24aa357ff930e6ee1 Merge: 9ace868a17d8 7b21b69ab203 Author: Linus Torvalds Date: Fri Feb 1 10:39:24 2019 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: "Still not much going on, the usual set of oops and driver fixes this time: - Fix two uapi breakage regressions in mlx5 drivers - Various oops fixes in hfi1, mlx4, umem, uverbs, and ipoib - A protocol bug fix for hfi1 preventing it from implementing the verbs API properly, and a compatability fix for EXEC STACK user programs - Fix missed refcounting in the 'advise_mr' patches merged this cycle. - Fix wrong use of the uABI in the hns SRQ patches merged this cycle" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: IB/uverbs: Fix OOPs in uverbs_user_mmap_disassociate IB/ipoib: Fix for use-after-free in ipoib_cm_tx_start IB/uverbs: Fix ioctl query port to consider device disassociation RDMA/mlx5: Fix flow creation on representors IB/uverbs: Fix OOPs upon device disassociation RDMA/umem: Add missing initialization of owning_mm RDMA/hns: Update the kernel header file of hns IB/mlx5: Fix how advise_mr() launches async work RDMA/device: Expose ib_device_try_get(() IB/hfi1: Add limit test for RC/UC send via loopback IB/hfi1: Remove overly conservative VM_EXEC flag check IB/{hfi1, qib}: Fix WC.byte_len calculation for UD_SEND_WITH_IMM IB/mlx4: Fix using wrong function to destroy sqp AHs under SRIOV RDMA/mlx5: Fix check for supported user flags when creating a QP commit 9ace868a17d875ee18f9127d0f456be6dd88fa47 Merge: 3325254ca14c 4ea899ead278 Author: Linus Torvalds Date: Fri Feb 1 10:30:18 2019 -0800 Merge tag 'iomap-5.0-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull iomap fixes from Darrick Wong: "A couple of iomap fixes to eliminate some memory corruption and hang problems that were reported: - fix page migration when using iomap for pagecache management - fix a use-after-free bug in the directio code" * tag 'iomap-5.0-fixes-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: iomap: fix a use after free in iomap_dio_rw iomap: get/put the page in iomap_page_create/release() commit 3325254ca14c4b859d75be757518dc2c0ebe298f Merge: 4771eec1d0f2 cbffab682573 Author: Linus Torvalds Date: Fri Feb 1 10:23:39 2019 -0800 Merge tag 'pm-5.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix a PM-runtime framework regression introduced by the recent switch-over of device autosuspend to hrtimers and a mistake in the "poll idle state" code introduced by a recent change in it. Specifics: - Since ktime_get() turns out to be problematic for device autosuspend in the PM-runtime framework, make it use ktime_get_mono_fast_ns() instead (Vincent Guittot). - Fix an initial value of a local variable in the "poll idle state" code that makes it behave not exactly as expected when all idle states except for the "polling" one are disabled (Doug Smythies)" * tag 'pm-5.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpuidle: poll_state: Fix default time limit PM-runtime: Fix deadlock with ktime_get() commit 4771eec1d0f25c41b31073176c6ff8f9904e4eee Merge: cca2e06ae832 b473406a06c4 Author: Linus Torvalds Date: Fri Feb 1 10:21:29 2019 -0800 Merge tag 'acpi-5.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI Kconfig fixes from Rafael Wysocki: "Prevent invalid configurations from being created (e.g. by randconfig) due to some ACPI-related Kconfig options' dependencies that are not specified directly (Sinan Kaya)" * tag 'acpi-5.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: platform/x86: Fix unmet dependency warning for SAMSUNG_Q10 platform/x86: Fix unmet dependency warning for ACPI_CMPC mfd: Fix unmet dependency warning for MFD_TPS68470 commit cca2e06ae8325b5280491954b919e6d8d430b12d Merge: 520fac05b651 3751e008da0d Author: Linus Torvalds Date: Fri Feb 1 10:19:50 2019 -0800 Merge tag 'mmc-v5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC host fixes from Ulf Hansson: - mediatek: Fix incorrect register write for tunings - bcm2835: Fixup leakage of DMA channel on probe errors * tag 'mmc-v5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: mediatek: fix incorrect register setting of hs400_cmd_int_delay mmc: bcm2835: Fix DMA channel leak on probe error commit 34dbba5d2dafc8ec0f9d70a0d9ac5c4504f27ccd Merge: 84826ac7337e 7d652669b61d Author: David S. Miller Date: Fri Feb 1 10:19:26 2019 -0800 Merge tag 'batadv-net-for-davem-20190201' of git://git.open-mesh.org/linux-merge Simon Wunderlich says: ==================== Here are some batman-adv bugfixes: - Avoid WARN to report incorrect configuration, by Sven Eckelmann - Fix mac header position setting, by Sven Eckelmann - Fix releasing station statistics, by Felix Fietkau ==================== Signed-off-by: David S. Miller commit 520fac05b65106f0f3a488776f759baccc600f2a Merge: c228d294f204 f36c1f9a8dfd Author: Linus Torvalds Date: Fri Feb 1 10:17:51 2019 -0800 Merge tag 'i3c/fixes-for-5.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux Pull i3c fixes from Boris Brezillon: - Fix a deadlock in the designware driver - Fix the error path in i3c_master_add_i3c_dev_locked() * tag 'i3c/fixes-for-5.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux: i3c: master: dw: fix deadlock i3c: fix missing detach if failed to retrieve i3c dev commit 84826ac7337ed9af8a57c6445773d63d2fbe2fbc Merge: 294c149a209c e005bd7ddea0 Author: David S. Miller Date: Fri Feb 1 10:14:12 2019 -0800 Merge tag 'mac80211-for-davem-2019-02-01' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== Two more fixes: * sometimes, not enough tailroom was allocated for software-encrypted management frames in mac80211 * cfg80211 regulatory restore got an additional condition, needs to rerun the checks after that condition changes ==================== Signed-off-by: David S. Miller commit 294c149a209c6196c2de85f512b52ef50f519949 Author: Dan Carpenter Date: Fri Feb 1 11:28:16 2019 +0300 skge: potential memory corruption in skge_get_regs() The "p" buffer is 0x4000 bytes long. B3_RI_WTO_R1 is 0x190. The value of "regs->len" is in the 1-0x4000 range. The bug here is that "regs->len - B3_RI_WTO_R1" can be a negative value which would lead to memory corruption and an abrupt crash. Fixes: c3f8be961808 ("[PATCH] skge: expand ethtool debug register dump") Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller drivers/net/ethernet/marvell/skge.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 2aa958c99c7fd3162b089a1a56a34a0cdb778de1 Author: Kairui Song Date: Fri Jan 18 19:13:08 2019 +0800 x86/kexec: Don't setup EFI info if EFI runtime is not enabled Kexec-ing a kernel with "efi=noruntime" on the first kernel's command line causes the following null pointer dereference: BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 #PF error: [normal kernel read fault] Call Trace: efi_runtime_map_copy+0x28/0x30 bzImage64_load+0x688/0x872 arch_kexec_kernel_image_load+0x6d/0x70 kimage_file_alloc_init+0x13e/0x220 __x64_sys_kexec_file_load+0x144/0x290 do_syscall_64+0x55/0x1a0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Just skip the EFI info setup if EFI runtime services are not enabled. [ bp: Massage commit message. ] Suggested-by: Dave Young Signed-off-by: Kairui Song Signed-off-by: Borislav Petkov Acked-by: Dave Young Cc: AKASHI Takahiro Cc: Andrew Morton Cc: Ard Biesheuvel Cc: bhe@redhat.com Cc: David Howells Cc: erik.schmauss@intel.com Cc: fanc.fnst@cn.fujitsu.com Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: kexec@lists.infradead.org Cc: lenb@kernel.org Cc: linux-acpi@vger.kernel.org Cc: Philipp Rudo Cc: rafael.j.wysocki@intel.com Cc: robert.moore@intel.com Cc: Thomas Gleixner Cc: x86-ml Cc: Yannik Sembritzki Link: https://lkml.kernel.org/r/20190118111310.29589-2-kasong@redhat.com arch/x86/kernel/kexec-bzimage64.c | 3 +++ 1 file changed, 3 insertions(+) commit c228d294f2040c3a5f5965ff04d4947d0bf6e7da Author: Linus Torvalds Date: Thu Jan 31 11:10:20 2019 -0800 x86: explicitly align IO accesses in memcpy_{to,from}io In commit 170d13ca3a2f ("x86: re-introduce non-generic memcpy_{to,from}io") I made our copy from IO space use a separate copy routine rather than rely on the generic memcpy. I did that because our generic memory copy isn't actually well-defined when it comes to internal access ordering or alignment, and will in fact depend on various CPUID flags. In particular, the default memcpy() for a modern Intel CPU will generally be just a "rep movsb", which works reasonably well for medium-sized memory copies of regular RAM, since the CPU will turn it into fairly optimized microcode. However, for non-cached memory and IO, "rep movs" ends up being horrendously slow and will just do the architectural "one byte at a time" accesses implied by the movsb. At the other end of the spectrum, if you _don't_ end up using the "rep movsb" code, you'd likely fall back to the software copy, which does overlapping accesses for the tail, and may copy things backwards. Again, for regular memory that's fine, for IO memory not so much. The thinking was that clearly nobody really cared (because things worked), but some people had seen horrible performance due to the byte accesses, so let's just revert back to our long ago version that dod "rep movsl" for the bulk of the copy, and then fixed up the potentially last few bytes of the tail with "movsw/b". Interestingly (and perhaps not entirely surprisingly), while that was our original memory copy implementation, and had been used before for IO, in the meantime many new users of memcpy_*io() had come about. And while the access patterns for the memory copy weren't well-defined (so arguably _any_ access pattern should work), in practice the "rep movsb" case had been very common for the last several years. In particular Jarkko Sakkinen reported that the memcpy_*io() change resuled in weird errors from his Geminilake NUC TPM module. And it turns out that the TPM TCG accesses according to spec require that the accesses be (a) done strictly sequentially (b) be naturally aligned otherwise the TPM chip will abort the PCI transaction. And, in fact, the tpm_crb.c driver did this: memcpy_fromio(buf, priv->rsp, 6); ... memcpy_fromio(&buf[6], &priv->rsp[6], expected - 6); which really should never have worked in the first place, but back before commit 170d13ca3a2f it *happened* to work, because the memcpy_fromio() would be expanded to a regular memcpy, and (a) gcc would expand the first memcpy in-line, and turn it into a 4-byte and a 2-byte read, and they happened to be in the right order, and the alignment was right. (b) gcc would call "memcpy()" for the second one, and the machines that had this TPM chip also apparently ended up always having ERMS ("Enhanced REP MOVSB/STOSB instructions"), so we'd use the "rep movbs" for that copy. In other words, basically by pure luck, the code happened to use the right access sizes in the (two different!) memcpy() implementations to make it all work. But after commit 170d13ca3a2f, both of the memcpy_fromio() calls resulted in a call to the routine with the consistent memory accesses, and in both cases it started out transferring with 4-byte accesses. Which worked for the first copy, but resulted in the second copy doing a 32-bit read at an address that was only 2-byte aligned. Jarkko is actually fixing the fragile code in the TPM driver, but since this is an excellent example of why we absolutely must not use a generic memcpy for IO accesses, _and_ an IO-specific one really should strive to align the IO accesses, let's do exactly that. Side note: Jarkko also noted that the driver had been used on ARM platforms, and had worked. That was because on 32-bit ARM, memcpy_*io() ends up always doing byte accesses, and on 64-bit ARM it first does byte accesses to align to 8-byte boundaries, and then does 8-byte accesses for the bulk. So ARM actually worked by design, and the x86 case worked by pure luck. We *might* want to make x86-64 do the 8-byte case too. That should be a pretty straightforward extension, but let's do one thing at a time. And generally MMIO accesses aren't really all that performance-critical, as shown by the fact that for a long time we just did them a byte at a time, and very few people ever noticed. Reported-and-tested-by: Jarkko Sakkinen Tested-by: Jerry Snitselaar Cc: David Laight Fixes: 170d13ca3a2f ("x86: re-introduce non-generic memcpy_{to,from}io") Signed-off-by: Linus Torvalds arch/x86/lib/iomem.c | 33 ++++++++++++++++++++++++++++++--- 1 file changed, 30 insertions(+), 3 deletions(-) commit d6d478aee003e19ef90321176552a8ad2929a47f Author: John Johansen Date: Thu Jan 24 13:53:05 2019 -0800 apparmor: Fix aa_label_build() error handling for failed merges aa_label_merge() can return NULL for memory allocations failures make sure to handle and set the correct error in this case. Reported-by: Peng Hao Signed-off-by: John Johansen security/apparmor/domain.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 4bf13fdbc3567e571c20b415e4df70f564d54067 Author: Vincent Whitchurch Date: Fri Feb 1 09:45:09 2019 +0100 mic: vop: Fix crash on remove The remove path contains a hack which depends on internal structures in other source files, similar to the one which was recently removed from the registration path. Since commit 1ce9e6055fa0 ("virtio_ring: introduce packed ring support"), this leads to a crash when vop devices are removed. The structure in question is only examined to get the virtual address of the allocated used page. Store that pointer locally instead to fix the crash. Fixes: 1ce9e6055fa0 ("virtio_ring: introduce packed ring support") Signed-off-by: Vincent Whitchurch Signed-off-by: Greg Kroah-Hartman drivers/misc/mic/vop/vop_main.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 70ed7148dadb812f2f7c9927e98ef3cf4869dfa9 Author: Vincent Whitchurch Date: Fri Feb 1 10:03:12 2019 +0100 mic: vop: Fix use-after-free on remove KASAN detects a use-after-free when vop devices are removed. This problem was introduced by commit 0063e8bbd2b62d136 ("virtio_vop: don't kfree device on register failure"). That patch moved the freeing of the struct _vop_vdev to the release function, but failed to ensure that vop holds a reference to the device when it doesn't want it to go away. A kfree() was replaced with a put_device() in the unregistration path, but the last reference to the device is already dropped in unregister_virtio_device() so the struct is freed before vop is done with it. Fix it by holding a reference until cleanup is done. This is similar to the fix in virtio_pci in commit 2989be09a8a9d6 ("virtio_pci: fix use after free on release"). ================================================================== BUG: KASAN: use-after-free in vop_scan_devices+0xc6c/0xe50 [vop] Read of size 8 at addr ffff88800da18580 by task kworker/0:1/12 CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.0.0-rc4+ #53 Workqueue: events vop_hotplug_devices [vop] Call Trace: dump_stack+0x74/0xbb print_address_description+0x5d/0x2b0 ? vop_scan_devices+0xc6c/0xe50 [vop] kasan_report+0x152/0x1aa ? vop_scan_devices+0xc6c/0xe50 [vop] ? vop_scan_devices+0xc6c/0xe50 [vop] vop_scan_devices+0xc6c/0xe50 [vop] ? vop_loopback_free_irq+0x160/0x160 [vop_loopback] process_one_work+0x7c0/0x14b0 ? pwq_dec_nr_in_flight+0x2d0/0x2d0 ? do_raw_spin_lock+0x120/0x280 worker_thread+0x8f/0xbf0 ? __kthread_parkme+0x78/0xf0 ? process_one_work+0x14b0/0x14b0 kthread+0x2ae/0x3a0 ? kthread_park+0x120/0x120 ret_from_fork+0x3a/0x50 Allocated by task 12: kmem_cache_alloc_trace+0x13a/0x2a0 vop_scan_devices+0x473/0xe50 [vop] process_one_work+0x7c0/0x14b0 worker_thread+0x8f/0xbf0 kthread+0x2ae/0x3a0 ret_from_fork+0x3a/0x50 Freed by task 12: kfree+0x104/0x310 device_release+0x73/0x1d0 kobject_put+0x14f/0x420 unregister_virtio_device+0x32/0x50 vop_scan_devices+0x19d/0xe50 [vop] process_one_work+0x7c0/0x14b0 worker_thread+0x8f/0xbf0 kthread+0x2ae/0x3a0 ret_from_fork+0x3a/0x50 The buggy address belongs to the object at ffff88800da18008 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1400 bytes inside of 2048-byte region [ffff88800da18008, ffff88800da18808) The buggy address belongs to the page: page:ffffea0000368600 count:1 mapcount:0 mapping:ffff88801440dbc0 index:0x0 compound_mapcount: 0 flags: 0x4000000000010200(slab|head) raw: 4000000000010200 ffffea0000378608 ffffea000037a008 ffff88801440dbc0 raw: 0000000000000000 00000000000d000d 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88800da18480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88800da18500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88800da18580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88800da18600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88800da18680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Fixes: 0063e8bbd2b62d136 ("virtio_vop: don't kfree device on register failure") Signed-off-by: Vincent Whitchurch Cc: stable Signed-off-by: Greg Kroah-Hartman drivers/misc/mic/vop/vop_main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 5b9633af298bfd1de650f6774d3fada546543101 Author: Christian Brauner Date: Thu Jan 31 01:25:02 2019 +0100 binderfs: remove separate device_initcall() binderfs should not have a separate device_initcall(). When a kernel is compiled with CONFIG_ANDROID_BINDERFS register the filesystem alongside CONFIG_ANDROID_IPC. This use-case is especially sensible when users specify CONFIG_ANDROID_IPC=y, CONFIG_ANDROID_BINDERFS=y and ANDROID_BINDER_DEVICES="". When CONFIG_ANDROID_BINDERFS=n then this always succeeds so there's no regression potential for legacy workloads. Signed-off-by: Christian Brauner Signed-off-by: Greg Kroah-Hartman drivers/android/binder.c | 7 ++++++- drivers/android/binder_internal.h | 9 +++++++++ drivers/android/binderfs.c | 4 +--- 3 files changed, 16 insertions(+), 4 deletions(-) commit f7daa9c8fd191724b9ab9580a7be55cd1a67d799 Author: James Morse Date: Thu Jan 24 16:32:57 2019 +0000 arm64: hibernate: Clean the __hyp_text to PoC after resume During resume hibernate restores all physical memory. Any memory that is accessed with the MMU disabled needs to be cleaned to the PoC. KVMs __hyp_text was previously ommitted as it runs with the MMU enabled, but now that the hyp-stub is located in this section, we must clean __hyp_text too. This ensures secondary CPUs that come online after hibernate has finished resuming, and load KVM via the freshly written hyp-stub see the correct instructions. Signed-off-by: James Morse Cc: stable@vger.kernel.org Signed-off-by: Will Deacon arch/arm64/kernel/hibernate.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 8fac5cbdfe0f01254d9d265c6aa1a95f94f58595 Author: James Morse Date: Thu Jan 24 16:32:56 2019 +0000 arm64: hyp-stub: Forbid kprobing of the hyp-stub The hyp-stub is loaded by the kernel's early startup code at EL2 during boot, before KVM takes ownership later. The hyp-stub's text is part of the regular kernel text, meaning it can be kprobed. A breakpoint in the hyp-stub causes the CPU to spin in el2_sync_invalid. Add it to the __hyp_text. Signed-off-by: James Morse Cc: stable@vger.kernel.org Signed-off-by: Will Deacon arch/arm64/kernel/hyp-stub.S | 2 ++ 1 file changed, 2 insertions(+) commit f2b3d8566d81deaca31f4e3163def0bea7746e11 Author: James Morse Date: Thu Jan 24 16:32:55 2019 +0000 arm64: kprobe: Always blacklist the KVM world-switch code On systems with VHE the kernel and KVM's world-switch code run at the same exception level. Code that is only used on a VHE system does not need to be annotated as __hyp_text as it can reside anywhere in the kernel text. __hyp_text was also used to prevent kprobes from patching breakpoint instructions into this region, as this code runs at a different exception level. While this is no longer true with VHE, KVM still switches VBAR_EL1, meaning a kprobe's breakpoint executed in the world-switch code will cause a hyp-panic. Move the __hyp_text check in the kprobes blacklist so it applies on VHE systems too, to cover the common code and guest enter/exit assembly. Fixes: 888b3c8720e0 ("arm64: Treat all entry code as non-kprobe-able") Reviewed-by: Christoffer Dall Signed-off-by: James Morse Acked-by: Masami Hiramatsu Signed-off-by: Will Deacon arch/arm64/kernel/probes/kprobes.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 8ea235932314311f15ea6cf65c1393ed7e31af70 Author: Ard Biesheuvel Date: Sun Jan 27 09:29:42 2019 +0100 arm64: kaslr: ensure randomized quantities are clean also when kaslr is off Commit 1598ecda7b23 ("arm64: kaslr: ensure randomized quantities are clean to the PoC") added cache maintenance to ensure that global variables set by the kaslr init routine are not wiped clean due to cache invalidation occurring during the second round of page table creation. However, if kaslr_early_init() exits early with no randomization being applied (either due to the lack of a seed, or because the user has disabled kaslr explicitly), no cache maintenance is performed, leading to the same issue we attempted to fix earlier, as far as the module_alloc_base variable is concerned. Note that module_alloc_base cannot be initialized statically, because that would cause it to be subject to a R_AARCH64_RELATIVE relocation, causing it to be overwritten by the second round of KASLR relocation processing. Fixes: f80fb3a3d508 ("arm64: add support for kernel ASLR") Cc: # v4.6+ Signed-off-by: Ard Biesheuvel Signed-off-by: Will Deacon arch/arm64/kernel/kaslr.c | 1 + 1 file changed, 1 insertion(+) commit 132fdc379eb143932d209a20fd581e1ce7630960 Author: Catalin Marinas Date: Thu Jan 24 17:28:37 2019 +0000 arm64: Do not issue IPIs for user executable ptes Commit 3b8c9f1cdfc5 ("arm64: IPI each CPU after invalidating the I-cache for kernel mappings") was aimed at fixing the I-cache invalidation for kernel mappings. However, it inadvertently caused all cache maintenance for user mappings via set_pte_at() -> __sync_icache_dcache() -> sync_icache_aliases() to call kick_all_cpus_sync(). Reported-by: Shijith Thotton Tested-by: Shijith Thotton Reported-by: Wandun Chen Fixes: 3b8c9f1cdfc5 ("arm64: IPI each CPU after invalidating the I-cache for kernel mappings") Cc: # 4.19.x- Signed-off-by: Catalin Marinas Signed-off-by: Will Deacon arch/arm64/mm/flush.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit b14e945bda8ae227d1bf2b1837c0c4a61721cd1a Author: Paul Kocialkowski Date: Thu Jan 31 14:25:50 2019 +0100 drm/sun4i: tcon: Prepare and enable TCON channel 0 clock at init When initializing clocks, a reference to the TCON channel 0 clock is obtained. However, the clock is never prepared and enabled later. Switching from simplefb to DRM actually disables the clock (that was usually configured by U-Boot) because of that. On the V3s, this results in a hang when writing to some mixer registers when switching over to DRM from simplefb. Fix this by preparing and enabling the clock when initializing other clocks. Waiting for sun4i_tcon_channel_enable to enable the clock is apparently too late and results in the same mixer register access hang. Signed-off-by: Paul Kocialkowski Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20190131132550.26355-1-paul.kocialkowski@bootlin.com drivers/gpu/drm/sun4i/sun4i_tcon.c | 2 ++ 1 file changed, 2 insertions(+) commit a1a02062ad466052a34a8c4323143ccf9726eb52 Author: Petr Vorel Date: Mon Nov 12 11:59:12 2018 +0100 apparmor: Fix warning about unused function apparmor_ipv6_postroute when compiled without CONFIG_IPV6: security/apparmor/lsm.c:1601:21: warning: ‘apparmor_ipv6_postroute’ defined but not used [-Wunused-function] static unsigned int apparmor_ipv6_postroute(void *priv, ^~~~~~~~~~~~~~~~~~~~~~~ Reported-by: Jordan Glover Tested-by: Jordan Glover Signed-off-by: Petr Vorel Signed-off-by: John Johansen security/apparmor/lsm.c | 2 ++ 1 file changed, 2 insertions(+) commit 305a0ade180981686eec1f92aa6252a7c6ebb1cf Author: Takashi Iwai Date: Wed Jan 30 17:46:03 2019 +0100 ALSA: hda - Serialize codec registrations In the current code, the codec registration may happen both at the codec bind time and the end of the controller probe time. In a rare occasion, they race with each other, leading to Oops due to the still uninitialized card device. This patch introduces a simple flag to prevent the codec registration at the codec bind time as long as the controller probe is going on. The controller probe invokes snd_card_register() that does the whole registration task, and we don't need to register each piece beforehand. Cc: Signed-off-by: Takashi Iwai include/sound/hda_codec.h | 1 + sound/pci/hda/hda_bind.c | 3 ++- sound/pci/hda/hda_intel.c | 2 ++ 3 files changed, 5 insertions(+), 1 deletion(-) commit 35a39f98567d8d3f1cea48f0f30de1a7e736b644 Author: Takashi Iwai Date: Fri Feb 1 11:19:50 2019 +0100 ALSA: hda/realtek - Use a common helper for hp pin reference Replace the open-codes in many places with a new common helper for performing the same thing: referring to the primary headphone pin. This eventually fixes the potentially missing headphone pin on some weird devices, too. Cc: Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 96 +++++++++++-------------------------------- 1 file changed, 24 insertions(+), 72 deletions(-) commit d561aa0a70bb2e1dd85fde98b6a5561e4175ac3e Author: Kailang Yang Date: Fri Feb 1 16:51:10 2019 +0800 ALSA: hda/realtek - Fix lose hp_pins for disable auto mute When auto_mute = no or spec->suppress_auto_mute = 1, cfg->hp_pins will lose value. Add this patch to find hp_pins value. I add fixed for ALC282 ALC225 ALC256 ALC294 and alc_default_init() alc_default_shutup(). Signed-off-by: Kailang Yang Cc: Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 45 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) commit e005bd7ddea06784c1eb91ac5bb6b171a94f3b05 Author: Johannes Berg Date: Fri Feb 1 11:09:54 2019 +0100 cfg80211: call disconnect_wk when AP stops Since we now prevent regulatory restore during STA disconnect if concurrent AP interfaces are active, we need to reschedule this check when the AP state changes. This fixes never doing a restore when an AP is the last interface to stop. Or to put it another way: we need to re-check after anything we check here changes. Cc: stable@vger.kernel.org Fixes: 113f3aaa81bd ("cfg80211: Prevent regulatory restore during STA disconnect in concurrent interfaces") Signed-off-by: Johannes Berg net/wireless/ap.c | 2 ++ net/wireless/core.h | 2 ++ net/wireless/sme.c | 2 +- 3 files changed, 5 insertions(+), 1 deletion(-) commit 9d0f50b80222dc273e67e4e14410fcfa4130a90c Author: Felix Fietkau Date: Tue Jan 29 11:10:57 2019 +0100 mac80211: ensure that mgmt tx skbs have tailroom for encryption Some drivers use IEEE80211_KEY_FLAG_SW_MGMT_TX to indicate that management frames need to be software encrypted. Since normal data packets are still encrypted by the hardware, crypto_tx_tailroom_needed_cnt gets decremented after key upload to hw. This can lead to passing skbs to ccmp_encrypt_skb, which don't have the necessary tailroom for software encryption. Change the code to add tailroom for encrypted management packets, even if crypto_tx_tailroom_needed_cnt is 0. Cc: stable@vger.kernel.org Signed-off-by: Felix Fietkau Signed-off-by: Johannes Berg net/mac80211/tx.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) commit b473406a06c49d39d6d653e9981b0bd70300485d Merge: 9baddb61dfec 0ee4b5f801b7 Author: Rafael J. Wysocki Date: Fri Feb 1 11:06:05 2019 +0100 Merge branch 'acpi-misc' * acpi-misc: platform/x86: Fix unmet dependency warning for SAMSUNG_Q10 platform/x86: Fix unmet dependency warning for ACPI_CMPC commit cbffab6825731f1baac7a950f6b7dd9239f55594 Merge: 15efb47dc560 1617971c6616 Author: Rafael J. Wysocki Date: Fri Feb 1 11:05:27 2019 +0100 Merge branch 'pm-cpuidle-fixes' * pm-cpuidle-fixes: cpuidle: poll_state: Fix default time limit commit bda2ab56356b9acdfab150f31c4bac9846253092 Author: Boris Brezillon Date: Wed Jan 30 09:47:00 2019 +0100 mtd: Remove a debug trace in mtdpart.c Commit 2b6f0090a333 ("mtd: Check add_mtd_device() ret code") contained a leftover of the debug session that led to this bug fix. Remove this pr_info(). Fixes: 2b6f0090a333 ("mtd: Check add_mtd_device() ret code") Signed-off-by: Boris Brezillon drivers/mtd/mtdpart.c | 1 - 1 file changed, 1 deletion(-) commit 5b4746a031992d3b788b7e5280d949b8ab6d32d0 Merge: 52107c545de1 9ff1a3b49125 Author: Linus Torvalds Date: Thu Jan 31 23:22:57 2019 -0800 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "Mostly driver fixes, but there's a core framework fix in here too: - Revert the commits that introduce clk management for the SP clk on MMP2 SoCs (used for OLPC). Turns out it wasn't a good idea and there isn't any need to manage this clk, it just causes more headaches. - A performance regression that went unnoticed for many years where we would traverse the entire clk tree looking for a clk by name when we already have the pointer to said clk that we're looking for - A parent linkage fix for the qcom SDM845 clk driver - An i.MX clk driver rate miscalculation fix where order of operations were messed up - One error handling fix from the static checkers" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: qcom: gcc: Use active only source for CPUSS clocks clk: ti: Fix error handling in ti_clk_parse_divider_data() clk: imx: Fix fractional clock set rate computation clk: Remove global clk traversal on fetch parent index Revert "dt-bindings: marvell,mmp2: Add clock id for the SP clock" Revert "clk: mmp2: add SP clock" Revert "Input: olpc_apsp - enable the SP clock" commit 52107c545de1ef684963146d34f3c4ef6922dd99 Merge: 44e56f325b7d 356690d029e1 Author: Linus Torvalds Date: Thu Jan 31 23:09:00 2019 -0800 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: "This fixes a bug in cavium/nitrox where the callback is invoked prior to the DMA unmap" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: cavium/nitrox - Invoke callback after DMA unmap commit 44e56f325b7d63e8a53008956ce7b28e4272a599 Merge: e74c98ca2d6a f14bcc0add3a Author: Linus Torvalds Date: Thu Jan 31 23:06:17 2019 -0800 Merge tag 'pci-v5.0-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI fixes from Bjorn Helgaas: - Revert armada8k GPIO reset change that broke Macchiatobin booting (Baruch Siach) - Use actual size config reads on ARM cns3xxx (Koen Vandeputte) - Fix ARM cns3xxx config write alignment issue (Koen Vandeputte) - Fix imx6 PHY device link error checking (Leonard Crestez) - Fix imx6 probe failure on chips without separate PCI power domain (Leonard Crestez) * tag 'pci-v5.0-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: Revert "PCI: armada8k: Add support for gpio controlled reset signal" ARM: cns3xxx: Use actual size reads for PCIe ARM: cns3xxx: Fix writing to wrong PCI config registers after alignment PCI: imx: Fix checking pd_pcie_phy device link addition PCI: imx: Fix probe failure without power domain commit 7e4545d372b560df10fa47281ef0783a479ce435 Author: Huang Rui Date: Wed Jan 30 19:50:04 2019 +0800 drm/amdgpu: fix the incorrect external id for raven series This patch fixes the incorrect external id that kernel reports to user mode driver. Raven2's rev_id is starts from 0x8, so its external id (0x81) should start from rev_id + 0x79 (0x81 - 0x8). And Raven's rev_id should be 0x21 while rev_id == 1. Reported-by: Crystal Jin Signed-off-by: Huang Rui Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/soc15.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 12292519d919ecde92e7e7c8acbcdb9f0c7c6013 Author: Jay Cornwall Date: Wed Jan 30 12:53:29 2019 -0600 drm/amdgpu: Implement doorbell self-ring for NBIO 7.4 Fixes doorbell reflection on Vega20. Change-Id: I0495139d160a9032dff5977289b1eec11c16f781 Signed-off-by: Jay Cornwall Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit 1f66b7ea8c4c99dba1e4e4a85ac532eee00af908 Author: Roman Li Date: Thu Jan 17 15:47:54 2019 -0500 drm/amd/display: Fix fclk idle state [Why] The earlier change 'Fix 6x4K displays' led to fclk value idling at higher DPM level. [How] Apply the fix only to respective multi-display configuration. Signed-off-by: Roman Li Reviewed-by: Feifei Xu Acked-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dce/dce_clk_mgr.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) commit 8fdd60f2ae3682caf2a7258626abc21eb4711892 Author: Theodore Ts'o Date: Thu Jan 31 23:41:11 2019 -0500 Revert "ext4: use ext4_write_inode() when fsyncing w/o a journal" This reverts commit ad211f3e94b314a910d4af03178a0b52a7d1ee0a. As Jan Kara pointed out, this change was unsafe since it means we lose the call to sync_mapping_buffers() in the nojournal case. The original point of the commit was avoid taking the inode mutex (since it causes a lockdep warning in generic/113); but we need the mutex in order to call sync_mapping_buffers(). The real fix to this problem was discussed here: https://lore.kernel.org/lkml/20181025150540.259281-4-bvanassche@acm.org The proposed patch was to fix a syzbot complaint, but the problem can also demonstrated via "kvm-xfstests -c nojournal generic/113". Multiple solutions were discused in the e-mail thread, but none have landed in the kernel as of this writing. Anyway, commit ad211f3e94b314 is absolutely the wrong way to suppress the lockdep, so revert it. Fixes: ad211f3e94b314a910d4af03178a0b52a7d1ee0a ("ext4: use ext4_write_inode() when fsyncing w/o a journal") Signed-off-by: Theodore Ts'o Reported: Jan Kara fs/ext4/fsync.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) commit f2ce6ed3dcc837af8ddb4076c71f5d370e65f6af Author: Carlo Caione Date: Fri Jan 25 13:55:58 2019 +0000 arm64: dts: imx8mq: Fix boot from eMMC The boot from eMMC is currently broken on the NXP i.MX8MQ EVK board. When trying to boot from eMMC it fails with: ... [ 1.271938] mmc1: Tuning failed, falling back to fixed sampling clock [ 1.287429] print_req_error: I/O error, dev mmcblk1, sector 1 flags 0 [ 1.306833] mmc1: Tuning failed, falling back to fixed sampling clock [ 1.322325] print_req_error: I/O error, dev mmcblk1, sector 2 flags 0 [ 1.329559] Buffer I/O error on dev mmcblk1, logical block 0, async page read [ 1.336714] mmcblk1: unable to read partition table ... The problem is the result of a partial misconfiguration of the pins and the missing assigned clock rate. Fixes: 9079aca4aacd ("arm64: add support for i.MX8M EVK board") Signed-off-by: Carlo Caione Tested-by: Chris Spencer Reviewed-by: Fabio Estevam Signed-off-by: Shawn Guo arch/arm64/boot/dts/freescale/imx8mq-evk.dts | 44 ++++++++++++++-------------- arch/arm64/boot/dts/freescale/imx8mq.dtsi | 2 ++ 2 files changed, 24 insertions(+), 22 deletions(-) commit 5a3840a470c41ec0b85cd36ca80370330656b163 Author: Oliver O'Halloran Date: Thu Jan 31 12:53:47 2019 +1100 powerpc/papr_scm: Use the correct bind address When binding an SCM volume to a physical address the hypervisor has the option to return early with a continue token with the expectation that the guest will resume the bind operation until it completes. A quirk of this interface is that the bind address will only be returned by the first bind h-call and the subsequent calls will return 0xFFFF_FFFF_FFFF_FFFF for the bind address. We currently do not save the address returned by the first h-call. As a result we will use the junk address as the base of the bound region if the hypervisor decides to split the bind across multiple h-calls. This bug was found when testing with very large SCM volumes where the bind process would take more time than they hypervisor's internal h-call time limit would allow. This patch fixes the issue by saving the bind address from the first call. Cc: stable@vger.kernel.org Fixes: b5beae5e224f ("powerpc/pseries: Add driver for PAPR SCM regions") Signed-off-by: Oliver O'Halloran Signed-off-by: Michael Ellerman arch/powerpc/platforms/pseries/papr_scm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit f01c2803873e83ea5f1b160c3169ed6018704be8 Merge: 6cab5e90ab2b 7c4cd051add3 Author: Daniel Borkmann Date: Thu Jan 31 23:18:22 2019 +0100 Merge branch 'bpf-lockdep-fixes' Alexei Starovoitov says: ==================== v1->v2: - reworded 2nd patch. It's a real dead lock. Not a false positive - dropped the lockdep fix for up_read_non_owner in bpf_get_stackid In addition to preempt_disable patch for socket filters https://patchwork.ozlabs.org/patch/1032437/ First patch fixes lockdep false positive in percpu_freelist Second patch fixes potential deadlock in bpf_prog_register Third patch fixes another potential deadlock in stackmap access from tracing bpf prog and from syscall. ==================== Signed-off-by: Daniel Borkmann commit 7c4cd051add3d00bbff008a133c936c515eaa8fe Author: Martin KaFai Lau Date: Wed Jan 30 18:12:45 2019 -0800 bpf: Fix syscall's stackmap lookup potential deadlock The map_lookup_elem used to not acquiring spinlock in order to optimize the reader. It was true until commit 557c0c6e7df8 ("bpf: convert stackmap to pre-allocation") The syscall's map_lookup_elem(stackmap) calls bpf_stackmap_copy(). bpf_stackmap_copy() may find the elem no longer needed after the copy is done. If that is the case, pcpu_freelist_push() saves this elem for reuse later. This push requires a spinlock. If a tracing bpf_prog got run in the middle of the syscall's map_lookup_elem(stackmap) and this tracing bpf_prog is calling bpf_get_stackid(stackmap) which also requires the same pcpu_freelist's spinlock, it may end up with a dead lock situation as reported by Eric Dumazet in https://patchwork.ozlabs.org/patch/1030266/ The situation is the same as the syscall's map_update_elem() which needs to acquire the pcpu_freelist's spinlock and could race with tracing bpf_prog. Hence, this patch fixes it by protecting bpf_stackmap_copy() with this_cpu_inc(bpf_prog_active) to prevent tracing bpf_prog from running. A later syscall's map_lookup_elem commit f1a2e44a3aec ("bpf: add queue and stack maps") also acquires a spinlock and races with tracing bpf_prog similarly. Hence, this patch is forward looking and protects the majority of the map lookups. bpf_map_offload_lookup_elem() is the exception since it is for network bpf_prog only (i.e. never called by tracing bpf_prog). Fixes: 557c0c6e7df8 ("bpf: convert stackmap to pre-allocation") Reported-by: Eric Dumazet Acked-by: Alexei Starovoitov Signed-off-by: Martin KaFai Lau Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann kernel/bpf/syscall.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) commit e16ec34039c701594d55d08a5aa49ee3e1abc821 Author: Alexei Starovoitov Date: Wed Jan 30 18:12:44 2019 -0800 bpf: fix potential deadlock in bpf_prog_register Lockdep found a potential deadlock between cpu_hotplug_lock, bpf_event_mutex, and cpuctx_mutex: [ 13.007000] WARNING: possible circular locking dependency detected [ 13.007587] 5.0.0-rc3-00018-g2fa53f892422-dirty #477 Not tainted [ 13.008124] ------------------------------------------------------ [ 13.008624] test_progs/246 is trying to acquire lock: [ 13.009030] 0000000094160d1d (tracepoints_mutex){+.+.}, at: tracepoint_probe_register_prio+0x2d/0x300 [ 13.009770] [ 13.009770] but task is already holding lock: [ 13.010239] 00000000d663ef86 (bpf_event_mutex){+.+.}, at: bpf_probe_register+0x1d/0x60 [ 13.010877] [ 13.010877] which lock already depends on the new lock. [ 13.010877] [ 13.011532] [ 13.011532] the existing dependency chain (in reverse order) is: [ 13.012129] [ 13.012129] -> #4 (bpf_event_mutex){+.+.}: [ 13.012582] perf_event_query_prog_array+0x9b/0x130 [ 13.013016] _perf_ioctl+0x3aa/0x830 [ 13.013354] perf_ioctl+0x2e/0x50 [ 13.013668] do_vfs_ioctl+0x8f/0x6a0 [ 13.014003] ksys_ioctl+0x70/0x80 [ 13.014320] __x64_sys_ioctl+0x16/0x20 [ 13.014668] do_syscall_64+0x4a/0x180 [ 13.015007] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 13.015469] [ 13.015469] -> #3 (&cpuctx_mutex){+.+.}: [ 13.015910] perf_event_init_cpu+0x5a/0x90 [ 13.016291] perf_event_init+0x1b2/0x1de [ 13.016654] start_kernel+0x2b8/0x42a [ 13.016995] secondary_startup_64+0xa4/0xb0 [ 13.017382] [ 13.017382] -> #2 (pmus_lock){+.+.}: [ 13.017794] perf_event_init_cpu+0x21/0x90 [ 13.018172] cpuhp_invoke_callback+0xb3/0x960 [ 13.018573] _cpu_up+0xa7/0x140 [ 13.018871] do_cpu_up+0xa4/0xc0 [ 13.019178] smp_init+0xcd/0xd2 [ 13.019483] kernel_init_freeable+0x123/0x24f [ 13.019878] kernel_init+0xa/0x110 [ 13.020201] ret_from_fork+0x24/0x30 [ 13.020541] [ 13.020541] -> #1 (cpu_hotplug_lock.rw_sem){++++}: [ 13.021051] static_key_slow_inc+0xe/0x20 [ 13.021424] tracepoint_probe_register_prio+0x28c/0x300 [ 13.021891] perf_trace_event_init+0x11f/0x250 [ 13.022297] perf_trace_init+0x6b/0xa0 [ 13.022644] perf_tp_event_init+0x25/0x40 [ 13.023011] perf_try_init_event+0x6b/0x90 [ 13.023386] perf_event_alloc+0x9a8/0xc40 [ 13.023754] __do_sys_perf_event_open+0x1dd/0xd30 [ 13.024173] do_syscall_64+0x4a/0x180 [ 13.024519] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 13.024968] [ 13.024968] -> #0 (tracepoints_mutex){+.+.}: [ 13.025434] __mutex_lock+0x86/0x970 [ 13.025764] tracepoint_probe_register_prio+0x2d/0x300 [ 13.026215] bpf_probe_register+0x40/0x60 [ 13.026584] bpf_raw_tracepoint_open.isra.34+0xa4/0x130 [ 13.027042] __do_sys_bpf+0x94f/0x1a90 [ 13.027389] do_syscall_64+0x4a/0x180 [ 13.027727] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 13.028171] [ 13.028171] other info that might help us debug this: [ 13.028171] [ 13.028807] Chain exists of: [ 13.028807] tracepoints_mutex --> &cpuctx_mutex --> bpf_event_mutex [ 13.028807] [ 13.029666] Possible unsafe locking scenario: [ 13.029666] [ 13.030140] CPU0 CPU1 [ 13.030510] ---- ---- [ 13.030875] lock(bpf_event_mutex); [ 13.031166] lock(&cpuctx_mutex); [ 13.031645] lock(bpf_event_mutex); [ 13.032135] lock(tracepoints_mutex); [ 13.032441] [ 13.032441] *** DEADLOCK *** [ 13.032441] [ 13.032911] 1 lock held by test_progs/246: [ 13.033239] #0: 00000000d663ef86 (bpf_event_mutex){+.+.}, at: bpf_probe_register+0x1d/0x60 [ 13.033909] [ 13.033909] stack backtrace: [ 13.034258] CPU: 1 PID: 246 Comm: test_progs Not tainted 5.0.0-rc3-00018-g2fa53f892422-dirty #477 [ 13.034964] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 [ 13.035657] Call Trace: [ 13.035859] dump_stack+0x5f/0x8b [ 13.036130] print_circular_bug.isra.37+0x1ce/0x1db [ 13.036526] __lock_acquire+0x1158/0x1350 [ 13.036852] ? lock_acquire+0x98/0x190 [ 13.037154] lock_acquire+0x98/0x190 [ 13.037447] ? tracepoint_probe_register_prio+0x2d/0x300 [ 13.037876] __mutex_lock+0x86/0x970 [ 13.038167] ? tracepoint_probe_register_prio+0x2d/0x300 [ 13.038600] ? tracepoint_probe_register_prio+0x2d/0x300 [ 13.039028] ? __mutex_lock+0x86/0x970 [ 13.039337] ? __mutex_lock+0x24a/0x970 [ 13.039649] ? bpf_probe_register+0x1d/0x60 [ 13.039992] ? __bpf_trace_sched_wake_idle_without_ipi+0x10/0x10 [ 13.040478] ? tracepoint_probe_register_prio+0x2d/0x300 [ 13.040906] tracepoint_probe_register_prio+0x2d/0x300 [ 13.041325] bpf_probe_register+0x40/0x60 [ 13.041649] bpf_raw_tracepoint_open.isra.34+0xa4/0x130 [ 13.042068] ? __might_fault+0x3e/0x90 [ 13.042374] __do_sys_bpf+0x94f/0x1a90 [ 13.042678] do_syscall_64+0x4a/0x180 [ 13.042975] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 13.043382] RIP: 0033:0x7f23b10a07f9 [ 13.045155] RSP: 002b:00007ffdef42fdd8 EFLAGS: 00000202 ORIG_RAX: 0000000000000141 [ 13.045759] RAX: ffffffffffffffda RBX: 00007ffdef42ff70 RCX: 00007f23b10a07f9 [ 13.046326] RDX: 0000000000000070 RSI: 00007ffdef42fe10 RDI: 0000000000000011 [ 13.046893] RBP: 00007ffdef42fdf0 R08: 0000000000000038 R09: 00007ffdef42fe10 [ 13.047462] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 13.048029] R13: 0000000000000016 R14: 00007f23b1db4690 R15: 0000000000000000 Since tracepoints_mutex will be taken in tracepoint_probe_register/unregister() there is no need to take bpf_event_mutex too. bpf_event_mutex is protecting modifications to prog array used in kprobe/perf bpf progs. bpf_raw_tracepoints don't need to take this mutex. Fixes: c4f6699dfcb8 ("bpf: introduce BPF_RAW_TRACEPOINT") Acked-by: Martin KaFai Lau Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann kernel/trace/bpf_trace.c | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) commit a89fac57b5d080771efd4d71feaae19877cf68f0 Author: Alexei Starovoitov Date: Wed Jan 30 18:12:43 2019 -0800 bpf: fix lockdep false positive in percpu_freelist Lockdep warns about false positive: [ 12.492084] 00000000e6b28347 (&head->lock){+...}, at: pcpu_freelist_push+0x2a/0x40 [ 12.492696] but this lock was taken by another, HARDIRQ-safe lock in the past: [ 12.493275] (&rq->lock){-.-.} [ 12.493276] [ 12.493276] [ 12.493276] and interrupts could create inverse lock ordering between them. [ 12.493276] [ 12.494435] [ 12.494435] other info that might help us debug this: [ 12.494979] Possible interrupt unsafe locking scenario: [ 12.494979] [ 12.495518] CPU0 CPU1 [ 12.495879] ---- ---- [ 12.496243] lock(&head->lock); [ 12.496502] local_irq_disable(); [ 12.496969] lock(&rq->lock); [ 12.497431] lock(&head->lock); [ 12.497890] [ 12.498104] lock(&rq->lock); [ 12.498368] [ 12.498368] *** DEADLOCK *** [ 12.498368] [ 12.498837] 1 lock held by dd/276: [ 12.499110] #0: 00000000c58cb2ee (rcu_read_lock){....}, at: trace_call_bpf+0x5e/0x240 [ 12.499747] [ 12.499747] the shortest dependencies between 2nd lock and 1st lock: [ 12.500389] -> (&rq->lock){-.-.} { [ 12.500669] IN-HARDIRQ-W at: [ 12.500934] _raw_spin_lock+0x2f/0x40 [ 12.501373] scheduler_tick+0x4c/0xf0 [ 12.501812] update_process_times+0x40/0x50 [ 12.502294] tick_periodic+0x27/0xb0 [ 12.502723] tick_handle_periodic+0x1f/0x60 [ 12.503203] timer_interrupt+0x11/0x20 [ 12.503651] __handle_irq_event_percpu+0x43/0x2c0 [ 12.504167] handle_irq_event_percpu+0x20/0x50 [ 12.504674] handle_irq_event+0x37/0x60 [ 12.505139] handle_level_irq+0xa7/0x120 [ 12.505601] handle_irq+0xa1/0x150 [ 12.506018] do_IRQ+0x77/0x140 [ 12.506411] ret_from_intr+0x0/0x1d [ 12.506834] _raw_spin_unlock_irqrestore+0x53/0x60 [ 12.507362] __setup_irq+0x481/0x730 [ 12.507789] setup_irq+0x49/0x80 [ 12.508195] hpet_time_init+0x21/0x32 [ 12.508644] x86_late_time_init+0xb/0x16 [ 12.509106] start_kernel+0x390/0x42a [ 12.509554] secondary_startup_64+0xa4/0xb0 [ 12.510034] IN-SOFTIRQ-W at: [ 12.510305] _raw_spin_lock+0x2f/0x40 [ 12.510772] try_to_wake_up+0x1c7/0x4e0 [ 12.511220] swake_up_locked+0x20/0x40 [ 12.511657] swake_up_one+0x1a/0x30 [ 12.512070] rcu_process_callbacks+0xc5/0x650 [ 12.512553] __do_softirq+0xe6/0x47b [ 12.512978] irq_exit+0xc3/0xd0 [ 12.513372] smp_apic_timer_interrupt+0xa9/0x250 [ 12.513876] apic_timer_interrupt+0xf/0x20 [ 12.514343] default_idle+0x1c/0x170 [ 12.514765] do_idle+0x199/0x240 [ 12.515159] cpu_startup_entry+0x19/0x20 [ 12.515614] start_kernel+0x422/0x42a [ 12.516045] secondary_startup_64+0xa4/0xb0 [ 12.516521] INITIAL USE at: [ 12.516774] _raw_spin_lock_irqsave+0x38/0x50 [ 12.517258] rq_attach_root+0x16/0xd0 [ 12.517685] sched_init+0x2f2/0x3eb [ 12.518096] start_kernel+0x1fb/0x42a [ 12.518525] secondary_startup_64+0xa4/0xb0 [ 12.518986] } [ 12.519132] ... key at: [] __key.71384+0x0/0x8 [ 12.519649] ... acquired at: [ 12.519892] pcpu_freelist_pop+0x7b/0xd0 [ 12.520221] bpf_get_stackid+0x1d2/0x4d0 [ 12.520563] ___bpf_prog_run+0x8b4/0x11a0 [ 12.520887] [ 12.521008] -> (&head->lock){+...} { [ 12.521292] HARDIRQ-ON-W at: [ 12.521539] _raw_spin_lock+0x2f/0x40 [ 12.521950] pcpu_freelist_push+0x2a/0x40 [ 12.522396] bpf_get_stackid+0x494/0x4d0 [ 12.522828] ___bpf_prog_run+0x8b4/0x11a0 [ 12.523296] INITIAL USE at: [ 12.523537] _raw_spin_lock+0x2f/0x40 [ 12.523944] pcpu_freelist_populate+0xc0/0x120 [ 12.524417] htab_map_alloc+0x405/0x500 [ 12.524835] __do_sys_bpf+0x1a3/0x1a90 [ 12.525253] do_syscall_64+0x4a/0x180 [ 12.525659] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 12.526167] } [ 12.526311] ... key at: [] __key.13130+0x0/0x8 [ 12.526812] ... acquired at: [ 12.527047] __lock_acquire+0x521/0x1350 [ 12.527371] lock_acquire+0x98/0x190 [ 12.527680] _raw_spin_lock+0x2f/0x40 [ 12.527994] pcpu_freelist_push+0x2a/0x40 [ 12.528325] bpf_get_stackid+0x494/0x4d0 [ 12.528645] ___bpf_prog_run+0x8b4/0x11a0 [ 12.528970] [ 12.529092] [ 12.529092] stack backtrace: [ 12.529444] CPU: 0 PID: 276 Comm: dd Not tainted 5.0.0-rc3-00018-g2fa53f892422 #475 [ 12.530043] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 [ 12.530750] Call Trace: [ 12.530948] dump_stack+0x5f/0x8b [ 12.531248] check_usage_backwards+0x10c/0x120 [ 12.531598] ? ___bpf_prog_run+0x8b4/0x11a0 [ 12.531935] ? mark_lock+0x382/0x560 [ 12.532229] mark_lock+0x382/0x560 [ 12.532496] ? print_shortest_lock_dependencies+0x180/0x180 [ 12.532928] __lock_acquire+0x521/0x1350 [ 12.533271] ? find_get_entry+0x17f/0x2e0 [ 12.533586] ? find_get_entry+0x19c/0x2e0 [ 12.533902] ? lock_acquire+0x98/0x190 [ 12.534196] lock_acquire+0x98/0x190 [ 12.534482] ? pcpu_freelist_push+0x2a/0x40 [ 12.534810] _raw_spin_lock+0x2f/0x40 [ 12.535099] ? pcpu_freelist_push+0x2a/0x40 [ 12.535432] pcpu_freelist_push+0x2a/0x40 [ 12.535750] bpf_get_stackid+0x494/0x4d0 [ 12.536062] ___bpf_prog_run+0x8b4/0x11a0 It has been explained that is a false positive here: https://lkml.org/lkml/2018/7/25/756 Recap: - stackmap uses pcpu_freelist - The lock in pcpu_freelist is a percpu lock - stackmap is only used by tracing bpf_prog - A tracing bpf_prog cannot be run if another bpf_prog has already been running (ensured by the percpu bpf_prog_active counter). Eric pointed out that this lockdep splats stops other legit lockdep splats in selftests/bpf/test_progs.c. Fix this by calling local_irq_save/restore for stackmap. Another false positive had also been worked around by calling local_irq_save in commit 89ad2fa3f043 ("bpf: fix lockdep splat"). That commit added unnecessary irq_save/restore to fast path of bpf hash map. irqs are already disabled at that point, since htab is holding per bucket spin_lock with irqsave. Let's reduce overhead for htab by introducing __pcpu_freelist_push/pop function w/o irqsave and convert pcpu_freelist_push/pop to irqsave to be used elsewhere (right now only in stackmap). It stops lockdep false positive in stackmap with a bit of acceptable overhead. Fixes: 557c0c6e7df8 ("bpf: convert stackmap to pre-allocation") Reported-by: Naresh Kamboju Reported-by: Eric Dumazet Acked-by: Martin KaFai Lau Signed-off-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann kernel/bpf/hashtab.c | 4 ++-- kernel/bpf/percpu_freelist.c | 41 +++++++++++++++++++++++++++++------------ kernel/bpf/percpu_freelist.h | 4 ++++ 3 files changed, 35 insertions(+), 14 deletions(-) commit 6cab5e90ab2bd323c9f3811b6c70a4687df51e27 Author: Alexei Starovoitov Date: Mon Jan 28 18:43:34 2019 -0800 bpf: run bpf programs with preemption disabled Disabled preemption is necessary for proper access to per-cpu maps from BPF programs. But the sender side of socket filters didn't have preemption disabled: unix_dgram_sendmsg->sk_filter->sk_filter_trim_cap->bpf_prog_run_save_cb->BPF_PROG_RUN and a combination of af_packet with tun device didn't disable either: tpacket_snd->packet_direct_xmit->packet_pick_tx_queue->ndo_select_queue-> tun_select_queue->tun_ebpf_select_queue->bpf_prog_run_clear_cb->BPF_PROG_RUN Disable preemption before executing BPF programs (both classic and extended). Reported-by: Jann Horn Signed-off-by: Alexei Starovoitov Acked-by: Song Liu Signed-off-by: Daniel Borkmann include/linux/filter.h | 21 ++++++++++++++++++--- kernel/bpf/cgroup.c | 2 +- 2 files changed, 19 insertions(+), 4 deletions(-) commit 1bb54c4071f585ebef56ce8fdfe6026fa2cbcddd Author: Martynas Pumputis Date: Thu Jan 31 10:19:33 2019 +0100 bpf, selftests: fix handling of sparse CPU allocations Previously, bpf_num_possible_cpus() had a bug when calculating a number of possible CPUs in the case of sparse CPU allocations, as it was considering only the first range or element of /sys/devices/system/cpu/possible. E.g. in the case of "0,2-3" (CPU 1 is not available), the function returned 1 instead of 3. This patch fixes the function by making it parse all CPU ranges and elements. Signed-off-by: Martynas Pumputis Acked-by: Yonghong Song Signed-off-by: Daniel Borkmann tools/testing/selftests/bpf/bpf_util.h | 30 ++++++++++++++++++++---------- 1 file changed, 20 insertions(+), 10 deletions(-) commit f14bcc0add3abecceca1a3fe538c4ec9566893f3 Author: Baruch Siach Date: Thu Jan 31 15:00:18 2019 -0600 Revert "PCI: armada8k: Add support for gpio controlled reset signal" Revert commit 3d71746c42 ("PCI: armada8k: Add support for gpio controlled reset signal"). That commit breaks boot on Macchiatobin board when a Mellanox NIC is present in the PCIe slot. It turns out that full reset cycle requires first comphy serdes initialization. Reset signal toggle without comphy initialization makes access to PCI configuration registers stall indefinitely. U-Boot toggles the Macchiatobin PCIe reset line already at boot, after initializing the comphy serdes. So while commit 3d71746c42 ("PCI: armada8k: Add support for gpio controlled reset signal") enables PCIe on platforms that U-Boot does not touch the reset line (like Clearfog GT-8K), it breaks PCIe (and boot) on the Macchiatobin board. Revert commit 3d71746c42 ("PCI: armada8k: Add support for gpio controlled reset signal") entirely to fix the Macchiatobin regression. Reported-by: Sven Auhagen Signed-off-by: Baruch Siach Signed-off-by: Lorenzo Pieralisi drivers/pci/controller/dwc/pcie-armada8k.c | 16 ---------------- 1 file changed, 16 deletions(-) commit 432dd7064aa1c030a488745917cfa4ebc6c8c060 Author: Koen Vandeputte Date: Thu Jan 31 15:00:11 2019 -0600 ARM: cns3xxx: Use actual size reads for PCIe commit 802b7c06adc7 ("ARM: cns3xxx: Convert PCI to use generic config accessors") reimplemented cns3xxx_pci_read_config() using pci_generic_config_read32(), which preserved the property of only doing 32-bit reads. It also replaced cns3xxx_pci_write_config() with pci_generic_config_write(), so it changed writes from always being 32 bits to being the actual size, which works just fine. Given that: - The documentation does not mention that only 32 bit access is allowed. - Writes are already executed using the actual size - Extensive testing shows that 8b, 16b and 32b reads work as intended Allow read access of any size by replacing pci_generic_config_read32() with the pci_generic_config_read() accessors. Fixes: 802b7c06adc7 ("ARM: cns3xxx: Convert PCI to use generic config accessors") Suggested-by: Bjorn Helgaas Signed-off-by: Koen Vandeputte [lorenzo.pieralisi@arm.com: updated commit log] Signed-off-by: Lorenzo Pieralisi Acked-by: Krzysztof Halasa Acked-by: Arnd Bergmann CC: Krzysztof Halasa CC: Olof Johansson CC: Robin Leblon CC: Rob Herring CC: Russell King CC: Tim Harvey arch/arm/mach-cns3xxx/pcie.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 65dbb423cf28232fed1732b779249d6164c5999b Author: Koen Vandeputte Date: Thu Jan 31 15:00:01 2019 -0600 ARM: cns3xxx: Fix writing to wrong PCI config registers after alignment Originally, cns3xxx used its own functions for mapping, reading and writing config registers. Commit 802b7c06adc7 ("ARM: cns3xxx: Convert PCI to use generic config accessors") removed the internal PCI config write function in favor of the generic one: cns3xxx_pci_write_config() --> pci_generic_config_write() cns3xxx_pci_write_config() expected aligned addresses, being produced by cns3xxx_pci_map_bus() while the generic one pci_generic_config_write() actually expects the real address as both the function and hardware are capable of byte-aligned writes. This currently leads to pci_generic_config_write() writing to the wrong registers. For instance, upon ath9k module loading: - driver ath9k gets loaded - The driver wants to write value 0xA8 to register PCI_LATENCY_TIMER, located at 0x0D - cns3xxx_pci_map_bus() aligns the address to 0x0C - pci_generic_config_write() effectively writes 0xA8 into register 0x0C (CACHE_LINE_SIZE) Fix the bug by removing the alignment in the cns3xxx mapping function. Fixes: 802b7c06adc7 ("ARM: cns3xxx: Convert PCI to use generic config accessors") Signed-off-by: Koen Vandeputte [lorenzo.pieralisi@arm.com: updated commit log] Signed-off-by: Lorenzo Pieralisi Acked-by: Krzysztof Halasa Acked-by: Tim Harvey Acked-by: Arnd Bergmann CC: stable@vger.kernel.org # v4.0+ CC: Bjorn Helgaas CC: Olof Johansson CC: Robin Leblon CC: Rob Herring CC: Russell King arch/arm/mach-cns3xxx/pcie.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a4ace4fa20072dfe60ab48ba227e50bc2d69c246 Author: Leonard Crestez Date: Thu Jan 31 14:59:56 2019 -0600 PCI: imx: Fix checking pd_pcie_phy device link addition The check on the device_link_add() return value is wrong; this leads to erroneous code execution, so fix it. Fixes: 3f7cceeab895 ("PCI: imx: Add multi-pd support") Signed-off-by: Leonard Crestez [lorenzo.pieralisi@arm.com: updated commit log] Signed-off-by: Lorenzo Pieralisi drivers/pci/controller/dwc/pci-imx6.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit a6093ad7fc4962099d2d723bcca72f8175b58c82 Author: Leonard Crestez Date: Thu Jan 31 14:59:50 2019 -0600 PCI: imx: Fix probe failure without power domain On chips without a separate power domain for PCI (such as 6q/6qp) the imx6_pcie_attach_pd() function incorrectly returns an error. Fix by returning 0 if dev_pm_domain_attach_by_name() does not find anything. Fixes: 3f7cceeab895 ("PCI: imx: Add multi-pd support") Reported-by: Lukas F.Hartmann Signed-off-by: Leonard Crestez [lorenzo.pieralisi@arm.com: updated commit log] Signed-off-by: Lorenzo Pieralisi drivers/pci/controller/dwc/pci-imx6.c | 3 +++ 1 file changed, 3 insertions(+) commit 5e66e35aab335b83d9ffb220d8a3a13986a7a60e Author: Michael Chan Date: Thu Jan 31 14:31:48 2019 -0500 bnxt_en: Disable interrupts when allocating CP rings or NQs. When calling firmware to allocate a CP ring or NQ, an interrupt associated with that ring may be generated immediately before the doorbell is even setup after the firmware call returns. When servicing the interrupt, the driver may crash when trying to access the doorbell. Fix it by disabling interrupt on that vector until the doorbell is set up. Fixes: 697197e5a173 ("bnxt_en: Re-structure doorbells.") Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit e74c98ca2d6ae4376cc15fa2a22483430909d96b Author: Andreas Gruenbacher Date: Wed Jan 30 21:30:36 2019 +0100 gfs2: Revert "Fix loop in gfs2_rbm_find" This reverts commit 2d29f6b96d8f80322ed2dd895bca590491c38d34. It turns out that the fix can lead to a ~20 percent performance regression in initial writes to the page cache according to iozone. Let's revert this for now to have more time for a proper fix. Cc: stable@vger.kernel.org # v3.13+ Signed-off-by: Andreas Gruenbacher Signed-off-by: Bob Peterson Signed-off-by: Linus Torvalds fs/gfs2/rgrp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9f789567142c0cd1ffd6c28c56eed40cb36495ca Merge: 937108b093f7 7d4e591bc051 Author: Linus Torvalds Date: Thu Jan 31 11:11:18 2019 -0800 Merge tag 'linux-kselftest-5.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest fixes from Shuah Khan: "This consists of run-time fixes to cpu-hotplug, and seccomp tests, compile fixes to ir, net, and timers Makefiles" * tag 'linux-kselftest-5.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests: timers: use LDLIBS instead of LDFLAGS selftests: net: use LDLIBS instead of LDFLAGS selftests/seccomp: Enhance per-arch ptrace syscall skip tests selftests: Use lirc.h from kernel tree, not from system selftests: cpu-hotplug: fix case where CPUs offline > CPUs present commit fedb5760648a291e949f2380d383b5b2d2749b5e Author: Greg Kroah-Hartman Date: Thu Jan 31 17:43:16 2019 +0800 serial: fix race between flush_to_ldisc and tty_open There still is a race window after the commit b027e2298bd588 ("tty: fix data race between tty_init_dev and flush of buf"), and we encountered this crash issue if receive_buf call comes before tty initialization completes in tty_open and tty->driver_data may be NULL. CPU0 CPU1 ---- ---- tty_open tty_init_dev tty_ldisc_unlock schedule flush_to_ldisc receive_buf tty_port_default_receive_buf tty_ldisc_receive_buf n_tty_receive_buf_common __receive_buf uart_flush_chars uart_start /*tty->driver_data is NULL*/ tty->ops->open /*init tty->driver_data*/ it can be fixed by extending ldisc semaphore lock in tty_init_dev to driver_data initialized completely after tty->ops->open(), but this will lead to get lock on one function and unlock in some other function, and hard to maintain, so fix this race only by checking tty->driver_data when receiving, and return if tty->driver_data is NULL, and n_tty_receive_buf_common maybe calls uart_unthrottle, so add the same check. Because the tty layer knows nothing about the driver associated with the device, the tty layer can not do anything here, it is up to the tty driver itself to check for this type of race. Fix up the serial driver to correctly check to see if it is finished binding with the device when being called, and if not, abort the tty calls. [Description and problem report and testing from Li RongQing, I rewrote the patch to be in the serial layer, not in the tty core - gregkh] Reported-by: Li RongQing Tested-by: Li RongQing Signed-off-by: Wang Li Signed-off-by: Zhang Yu Signed-off-by: Li RongQing Cc: stable Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/serial_core.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 937108b093f74ed8ae4fed21ee215bcb773e2781 Merge: 83f4997a01e7 8fc75bed96bb Author: Linus Torvalds Date: Thu Jan 31 10:13:05 2019 -0800 Merge tag 'nfs-for-5.0-3' of git://git.linux-nfs.org/projects/anna/linux-nfs Pull NFS client fixes from Anna Schumaker: "This addresses two bugs, one in the error code handling of nfs_page_async_flush() and one to fix a potential NULL pointer dereference in nfs_parse_devname(). Stable bugfix: - Fix up return value on fatal errors in nfs_page_async_flush() Other bugfix: - Fix NULL pointer dereference of dev_name" * tag 'nfs-for-5.0-3' of git://git.linux-nfs.org/projects/anna/linux-nfs: NFS: Fix up return value on fatal errors in nfs_page_async_flush() nfs: Fix NULL pointer dereference of dev_name commit 83f4997a01e72844045a2bf1f348359a1acbfb19 Merge: af0c9af1b3f6 693abe11aa6b Author: Linus Torvalds Date: Thu Jan 31 10:00:00 2019 -0800 Merge tag 'sound-5.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Only three fixes. The fix for Realtek HD-audio looks lengthy, but it's just a code shuffling, and the actual changes are fairly small. The rest are a PCM core fix for a long-standing bug that was recently scratched by syzkaller, and a trivial USB-audio quirk for DSD support" * tag 'sound-5.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/realtek - Fixed hp_pin no value ALSA: pcm: Fix tight loop of OSS capture stream ALSA: usb-audio: Add Opus #3 to quirks for native DSD support commit da0e51716646b8ca2aa91a98463778f4fe526dcd Merge: 6fa19f5637a6 34aaaac815d1 Author: David S. Miller Date: Thu Jan 31 09:47:56 2019 -0800 Merge branch 'ieee802154-for-davem-2019-01-31' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan Stefan Schmidt says: ==================== pull-request: ieee802154 for net 2019-01-31 An update from ieee802154 for your *net* tree. I waited a while to see if anything else comes up, but it seems this time we only have one fixup patch for the -rc rounds. Colin fixed some indentation in the mcr20a drivers. That's about it. If there are any problems with taking these two before the final 5.0 let me know. ==================== Signed-off-by: David S. Miller commit 6fa19f5637a6c22bc0999596bcc83bdcac8a4fa6 Author: Eric Dumazet Date: Thu Jan 31 08:47:10 2019 -0800 rds: fix refcount bug in rds_sock_addref syzbot was able to catch a bug in rds [1] The issue here is that the socket might be found in a hash table but that its refcount has already be set to 0 by another cpu. We need to use refcount_inc_not_zero() to be safe here. [1] refcount_t: increment on 0; use-after-free. WARNING: CPU: 1 PID: 23129 at lib/refcount.c:153 refcount_inc_checked lib/refcount.c:153 [inline] WARNING: CPU: 1 PID: 23129 at lib/refcount.c:153 refcount_inc_checked+0x61/0x70 lib/refcount.c:151 Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 23129 Comm: syz-executor3 Not tainted 5.0.0-rc4+ #53 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1db/0x2d0 lib/dump_stack.c:113 panic+0x2cb/0x65c kernel/panic.c:214 __warn.cold+0x20/0x48 kernel/panic.c:571 report_bug+0x263/0x2b0 lib/bug.c:186 fixup_bug arch/x86/kernel/traps.c:178 [inline] fixup_bug arch/x86/kernel/traps.c:173 [inline] do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:271 do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:290 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:973 RIP: 0010:refcount_inc_checked lib/refcount.c:153 [inline] RIP: 0010:refcount_inc_checked+0x61/0x70 lib/refcount.c:151 Code: 1d 51 63 c8 06 31 ff 89 de e8 eb 1b f2 fd 84 db 75 dd e8 a2 1a f2 fd 48 c7 c7 60 9f 81 88 c6 05 31 63 c8 06 01 e8 af 65 bb fd <0f> 0b eb c1 90 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 54 49 RSP: 0018:ffff8880a0cbf1e8 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffc90006113000 RDX: 000000000001047d RSI: ffffffff81685776 RDI: 0000000000000005 RBP: ffff8880a0cbf1f8 R08: ffff888097c9e100 R09: ffffed1015ce5021 R10: ffffed1015ce5020 R11: ffff8880ae728107 R12: ffff8880723c20c0 R13: ffff8880723c24b0 R14: dffffc0000000000 R15: ffffed1014197e64 sock_hold include/net/sock.h:647 [inline] rds_sock_addref+0x19/0x20 net/rds/af_rds.c:675 rds_find_bound+0x97c/0x1080 net/rds/bind.c:82 rds_recv_incoming+0x3be/0x1430 net/rds/recv.c:362 rds_loop_xmit+0xf3/0x2a0 net/rds/loop.c:96 rds_send_xmit+0x1355/0x2a10 net/rds/send.c:355 rds_sendmsg+0x323c/0x44e0 net/rds/send.c:1368 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg+0xdd/0x130 net/socket.c:631 __sys_sendto+0x387/0x5f0 net/socket.c:1788 __do_sys_sendto net/socket.c:1800 [inline] __se_sys_sendto net/socket.c:1796 [inline] __x64_sys_sendto+0xe1/0x1a0 net/socket.c:1796 do_syscall_64+0x1a3/0x800 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x458089 Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fc266df8c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000458089 RDX: 0000000000000000 RSI: 00000000204b3fff RDI: 0000000000000005 RBP: 000000000073bf00 R08: 00000000202b4000 R09: 0000000000000010 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc266df96d4 R13: 00000000004c56e4 R14: 00000000004d94a8 R15: 00000000ffffffff Fixes: cc4dfb7f70a3 ("rds: fix two RCU related problems") Signed-off-by: Eric Dumazet Reported-by: syzbot Cc: Sowmini Varadhan Cc: Santosh Shilimkar Cc: rds-devel@oss.oracle.com Cc: Cong Wang Acked-by: Santosh Shilimkar Signed-off-by: David S. Miller net/rds/bind.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit fc42a689c4c097859e5bd37b5ea11b60dc426df6 Author: Bart Van Assche Date: Wed Jan 30 10:42:30 2019 -0800 lib/test_rhashtable: Make test_insert_dup() allocate its hash table dynamically The test_insert_dup() function from lib/test_rhashtable.c passes a pointer to a stack object to rhltable_init(). Allocate the hash table dynamically to avoid that the following is reported with object debugging enabled: ODEBUG: object (ptrval) is on stack (ptrval), but NOT annotated. WARNING: CPU: 0 PID: 1 at lib/debugobjects.c:368 __debug_object_init+0x312/0x480 Modules linked in: EIP: __debug_object_init+0x312/0x480 Call Trace: ? debug_object_init+0x1a/0x20 ? __init_work+0x16/0x30 ? rhashtable_init+0x1e1/0x460 ? sched_clock_cpu+0x57/0xe0 ? rhltable_init+0xb/0x20 ? test_insert_dup+0x32/0x20f ? trace_hardirqs_on+0x38/0xf0 ? ida_dump+0x10/0x10 ? jhash+0x130/0x130 ? my_hashfn+0x30/0x30 ? test_rht_init+0x6aa/0xab4 ? ida_dump+0x10/0x10 ? test_rhltable+0xc5c/0xc5c ? do_one_initcall+0x67/0x28e ? trace_hardirqs_off+0x22/0xe0 ? restore_all_kernel+0xf/0x70 ? trace_hardirqs_on_thunk+0xc/0x10 ? restore_all_kernel+0xf/0x70 ? kernel_init_freeable+0x142/0x213 ? rest_init+0x230/0x230 ? kernel_init+0x10/0x110 ? schedule_tail_wrapper+0x9/0xc ? ret_from_fork+0x19/0x24 Cc: Thomas Graf Cc: Herbert Xu Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Bart Van Assche Acked-by: Herbert Xu Signed-off-by: David S. Miller lib/test_rhashtable.c | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) commit 91c524708de6207f59dd3512518d8a1c7b434ee3 Author: Jacob Wen Date: Thu Jan 31 15:18:56 2019 +0800 l2tp: copy 4 more bytes to linear part if necessary The size of L2TPv2 header with all optional fields is 14 bytes. l2tp_udp_recv_core only moves 10 bytes to the linear part of a skb. This may lead to l2tp_recv_common read data outside of a skb. This patch make sure that there is at least 14 bytes in the linear part of a skb to meet the maximum need of l2tp_udp_recv_core and l2tp_recv_common. The minimum size of both PPP HDLC-like frame and Ethernet frame is larger than 14 bytes, so we are safe to do so. Also remove L2TP_HDR_SIZE_NOSEQ, it is unused now. Fixes: fd558d186df2 ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts") Suggested-by: Guillaume Nault Signed-off-by: Jacob Wen Acked-by: Guillaume Nault Signed-off-by: David S. Miller net/l2tp/l2tp_core.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 2c2008a63e482654ab137c84d3c61c03b75e7df6 Author: Brian Norris Date: Tue Jan 29 15:12:01 2019 -0800 ath10k: correct bus type for WCN3990 WCN3990 is SNOC, not PCI. This prevents probing WCN3990. Fixes: 367c899f622c ("ath10k: add bus type check in ath10k_init_hw_params") Signed-off-by: Brian Norris Reviewed-by: Bjorn Andersson Signed-off-by: Kalle Valo drivers/net/wireless/ath/ath10k/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 05672636b339c557feb6a98b2f2034be790aa4fb Author: Lorenzo Bianconi Date: Sun Jan 27 12:15:49 2019 +0100 mt76x0: eeprom: fix chan_vs_power map in mt76x0_get_power_info Report correct eeprom per channel power value. Fix chan_vs_power map in mt76x0_get_power_info routine Fixes: f2a2e819d672 ("mt76x0: remove eeprom dependency from mt76x0_get_power_info") Signed-off-by: Lorenzo Bianconi Signed-off-by: Kalle Valo drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.c | 40 ++++++++++------------ drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.h | 2 +- drivers/net/wireless/mediatek/mt76/mt76x0/phy.c | 10 +++--- 3 files changed, 25 insertions(+), 27 deletions(-) commit 34aaaac815d166daef361f49529f4c6b77da49f1 Author: Colin Ian King Date: Mon Jan 14 15:48:34 2019 +0000 ieee802154: mcr20a: fix indentation, remove tabs The are a couple of statments that are one level too deep, fix this by removing tabs. Signed-off-by: Colin Ian King Signed-off-by: Stefan Schmidt drivers/net/ieee802154/mcr20a.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 912139cfbfa6a2bc1da052314d2c29338dae1f6a Author: Thomas Lendacky Date: Thu Jan 31 14:33:06 2019 +0000 x86/microcode/amd: Don't falsely trick the late loading mechanism The load_microcode_amd() function searches for microcode patches and attempts to apply a microcode patch if it is of different level than the currently installed level. While the processor won't actually load a level that is less than what is already installed, the logic wrongly returns UCODE_NEW thus signaling to its caller reload_store() that a late loading should be attempted. If the file-system contains an older microcode revision than what is currently running, such a late microcode reload can result in these misleading messages: x86/CPU: CPU features have changed after loading microcode, but might not take effect. x86/CPU: Please consider either early loading through initrd/built-in or a potential BIOS update. These messages were issued on a system where SME/SEV are not enabled by the BIOS (MSR C001_0010[23] = 0b) because during boot, early_detect_mem_encrypt() is called and cleared the SME and SEV features in this case. However, after the wrong late load attempt, get_cpu_cap() is called and reloads the SME and SEV feature bits, resulting in the messages. Update the microcode level check to not attempt microcode loading if the current level is greater than(!) and not only equal to the current patch level. [ bp: massage commit message. ] Fixes: 2613f36ed965 ("x86/microcode: Attempt late loading only when new microcode is present") Signed-off-by: Tom Lendacky Signed-off-by: Borislav Petkov Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Thomas Gleixner Cc: x86-ml Link: https://lkml.kernel.org/r/154894518427.9406.8246222496874202773.stgit@tlendack-t1.amdoffice.net arch/x86/kernel/cpu/microcode/amd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9a6d5488002fdca7134a0e59b0ae252f61042810 Author: Jens Axboe Date: Wed Jan 30 08:41:40 2019 -0700 ide: ensure atapi sense request aren't preempted There's an issue with how sense requests are handled in IDE. If ide-cd encounters an error, it queues a sense request. With how IDE request handling is done, this is the next request we need to handle. But it's impossible to guarantee this, as another request could come in between the sense being queued, and ->queue_rq() being run and handling it. If that request ALSO fails, then we attempt to doubly queue the single sense request we have. Since we only support one active request at the time, defer request processing when a sense request is queued. Fixes: 600335205b8d "ide: convert to blk-mq" Reported-by: He Zhe Tested-by: He Zhe Signed-off-by: Jens Axboe drivers/ide/ide-atapi.c | 9 +++++++- drivers/ide/ide-io.c | 61 +++++++++++++++++++++++++------------------------ drivers/ide/ide-park.c | 2 ++ drivers/ide/ide-probe.c | 23 +++++++++++++------ include/linux/ide.h | 2 ++ 5 files changed, 59 insertions(+), 38 deletions(-) commit 32a66374487bbd78115747f0084cea5e8fca4c80 Author: Nicolas Saenz Julienne Date: Sat Jan 26 10:38:29 2019 -0600 fpga: stratix10-soc: fix wrong of_node_put() in init function After finding a "firmware" dt node stratix10 tries to match it's compatible string with it. To do so it's calling of_find_matching_node() which already takes care of decreasing the refcount on the "firmware" node. We are then incorrectly decreasing the refcount on that node again. This patch removes the unwarranted call to of_node_put(). Fixes: e7eef1d7633a ("fpga: add intel stratix10 soc fpga manager driver") Signed-off-by: Nicolas Saenz Julienne Acked-by: Alan Tull Acked-by: Moritz Fischer [atull: remove unnecessary braces] Signed-off-by: Greg Kroah-Hartman drivers/fpga/stratix10-soc.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) commit 36991ca68db9dd43bac7f3519f080ee3939263ef Author: Greg Kroah-Hartman Date: Wed Jan 23 14:48:54 2019 +0100 blk-mq: protect debugfs_create_files() from failures If debugfs were to return a non-NULL error for a debugfs call, using that pointer later in debugfs_create_files() would crash. Fix that by properly checking the pointer before referencing it. Reported-by: Michal Hocko Reported-and-tested-by: syzbot+b382ba6a802a3d242790@syzkaller.appspotmail.com Reported-by: Tetsuo Handa Signed-off-by: Greg Kroah-Hartman block/blk-mq-debugfs.c | 3 +++ 1 file changed, 3 insertions(+) commit b9b9378b49030d1aeca2387660fcd1ac1f306cad Author: Steve French Date: Tue Jan 29 17:27:33 2019 -0600 cifs: update internal module version number To 2.17 Signed-off-by: Steve French fs/cifs/cifsfs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d339adc12a4f885b572c5412e4869af8939db854 Author: Aurelien Aptel Date: Thu Jan 31 13:46:07 2019 +0100 CIFS: fix use-after-free of the lease keys The request buffers are freed right before copying the pointers. Use the func args instead which are identical and still valid. Simple reproducer (requires KASAN enabled) on a cifs mount: echo foo > foo ; tail -f foo & rm foo Cc: # 4.20 Fixes: 179e44d49c2f ("smb3: add tracepoint for sending lease break responses to server") Signed-off-by: Aurelien Aptel Signed-off-by: Steve French Reviewed-by: Paulo Alcantara fs/cifs/smb2pdu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 2c1cf00eeacb784781cf1c9896b8af001246d339 Author: Greg Kroah-Hartman Date: Thu Jan 31 13:57:58 2019 +0100 relay: check return of create_buf_file() properly If create_buf_file() returns an error, don't try to reference it later as a valid dentry pointer. This problem was exposed when debugfs started to return errors instead of just NULL for some calls when they do not succeed properly. Also, the check for WARN_ON(dentry) was just wrong :) Reported-by: Kees Cook Reported-and-tested-by: syzbot+16c3a70e1e9b29346c43@syzkaller.appspotmail.com Reported-by: Tetsuo Handa Cc: Andrew Morton Cc: David Rientjes Fixes: ff9fb72bc077 ("debugfs: return error values, not NULL") Signed-off-by: Greg Kroah-Hartman kernel/relay.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 56841070ccc87b463ac037d2d1f2beb8e5e35f0c Author: Zenghui Yu Date: Thu Jan 31 11:19:43 2019 +0000 irqchip/gic-v3-its: Fix ITT_entry_size accessor According to ARM IHI 0069C (ID070116), we should use GITS_TYPER's bits [7:4] as ITT_entry_size instead of [8:4]. Although this is pretty annoying, it only results in a potential over-allocation of memory, and nothing bad happens. Fixes: 3dfa576bfb45 ("irqchip/gic-v3-its: Add probing for VLPI properties") Signed-off-by: Zenghui Yu [maz: massaged subject and commit message] Signed-off-by: Marc Zyngier include/linux/irqchip/arm-gic-v3.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 89e3a5682edaa4e5bb334719afb180256ac7bf78 Author: Jeremy Soller Date: Wed Jan 30 16:12:31 2019 -0700 ALSA: hda/realtek - Headset microphone support for System76 darp5 On the System76 Darter Pro (darp5), there is a headset microphone input attached to 0x1a that does not have a jack detect. In order to get it working, the pin configuration needs to be set correctly, and the ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC fixup needs to be applied. This is similar to the MIC_NO_PRESENCE fixups for some Dell laptops, except we have a separate microphone jack that is already configured correctly. Signed-off-by: Jeremy Soller Cc: Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit 455e7b387b441ddd1da1df35251c179fe7805b53 Author: Randy Dunlap Date: Sun Jan 27 18:21:42 2019 -0800 mtd: rawnand: fix kernel-doc warnings Fix kernel-doc warnings in drivers/mtd/nand/raw: ../drivers/mtd/nand/raw/nand_base.c:420: warning: Function parameter or member 'chip' not described in 'nand_fill_oob' ../drivers/mtd/nand/raw/nand_bbt.c:173: warning: Function parameter or member 'this' not described in 'read_bbt' ../drivers/mtd/nand/raw/nand_bbt.c:173: warning: Excess function parameter 'chip' description in 'read_bbt' Fixes: 0813621ba898a ("mtd: rawnand: Stop passing mtd_info objects to internal functions") Signed-off-by: Randy Dunlap Cc: Boris Brezillon Cc: Miquel Raynal Cc: Richard Weinberger Cc: linux-mtd@lists.infradead.org Acked-by: Miquel Raynal Signed-off-by: Boris Brezillon drivers/mtd/nand/raw/nand_base.c | 1 + drivers/mtd/nand/raw/nand_bbt.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) commit c3c7dbf4887ab3ed9d611cd1f6e16937f8700743 Author: Boris Brezillon Date: Thu Jan 24 15:46:54 2019 +0100 mtd: spinand: Fix the error/cleanup path in spinand_init() The manufacturer specific initialization has already been done when block unlocking takes place, and if anything goes wrong during this procedure we should call spinand_manufacturer_cleanup(). Fixes: 7529df465248 ("mtd: nand: Add core infrastructure to support SPI NANDs") Cc: Signed-off-by: Boris Brezillon Acked-by: Miquel Raynal drivers/mtd/nand/spi/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 13c15e07eedf26092054c8c71f2f47edb8388310 Author: Boris Brezillon Date: Thu Jan 24 15:20:07 2019 +0100 mtd: spinand: Handle the case where PROGRAM LOAD does not reset the cache Looks like PROGRAM LOAD (AKA write cache) does not necessarily reset the cache content to 0xFF (depends on vendor implementation), so we must fill the page cache entirely even if we only want to program the data portion of the page, otherwise we might corrupt the BBM or user data previously programmed in OOB area. Fixes: 7529df465248 ("mtd: nand: Add core infrastructure to support SPI NANDs") Reported-by: Stefan Roese Cc: Signed-off-by: Boris Brezillon Tested-by: Stefan Roese Reviewed-by: Stefan Roese Acked-by: Miquel Raynal drivers/mtd/nand/spi/core.c | 42 ++++++++++++++++++++---------------------- 1 file changed, 20 insertions(+), 22 deletions(-) commit 579b9239c1f38665b21e8d0e6ee83ecc96dbd6bb Author: Aneesh Kumar K.V Date: Wed Jan 23 11:51:38 2019 +0530 powerpc/radix: Fix kernel crash with mremap() With support for split pmd lock, we use pmd page pmd_huge_pte pointer to store the deposited page table. In those config when we move page tables we need to make sure we move the deposited page table to the correct pmd page. Otherwise this can result in crash when we withdraw of deposited page table because we can find the pmd_huge_pte NULL. eg: __split_huge_pmd+0x1070/0x1940 __split_huge_pmd+0xe34/0x1940 (unreliable) vma_adjust_trans_huge+0x110/0x1c0 __vma_adjust+0x2b4/0x9b0 __split_vma+0x1b8/0x280 __do_munmap+0x13c/0x550 sys_mremap+0x220/0x7e0 system_call+0x5c/0x70 Fixes: 675d995297d4 ("powerpc/book3s64: Enable split pmd ptlock.") Cc: stable@vger.kernel.org # v4.18+ Signed-off-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman arch/powerpc/include/asm/book3s/64/pgtable.h | 22 +++++++--------------- arch/powerpc/mm/pgtable-book3s64.c | 22 ++++++++++++++++++++++ 2 files changed, 29 insertions(+), 15 deletions(-) commit a07ddce4df807e41a85245e769b6f6f14f0c6db0 Author: Kyle Tso Date: Wed Jan 30 11:13:53 2019 +0800 usb: typec: tcpm: Correct the PPS out_volt calculation When Sink negotiates PPS, the voltage range of selected PPS APDO might not cover the previous voltage (out_volt). If the previous out_volt is lower than the new min_volt, the output voltage in RDO might be set to an invalid value. For instance, supposed that the previous voltage is 5V, and the new voltage range in the APDO is 7V-12V. Then the output voltage in the RDO should not be set to 5V which is lower than the possible min_volt 7V. Fix this by choosing the maximal value between the previous voltage and the new min_volt first. And ensure that this value will not exceed the new max_volt. The new out_volt will fall within the new voltage range while being the closest value compared to the previous out_volt. Signed-off-by: Kyle Tso Reviewed-by: Adam Thomson Reviewed-by: Guenter Roeck Reviewed-by: Heikki Krogerus Fixes: c710d0bb76ff0 ("usb: typec: tcpm: Extend the matching rules on PPS APDO selection") Signed-off-by: Greg Kroah-Hartman drivers/usb/typec/tcpm/tcpm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit c7b0c3bbe4c2c28df54f7161d6ecb2b555d25a35 Merge: c418fd6c01fb a53469a68eb8 Author: Greg Kroah-Hartman Date: Thu Jan 31 08:57:51 2019 +0100 Merge tag 'fixes-for-v5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus Felipe writes: usb: fixes for v5.0-rc4 Dwc3 got a fix for cases when gadget driver queue an OUT request of length 0; this is a case that has been overlooked for quite some time now. Exynos' dwc3 glue layer got a fix on the error path for those cases where clk_prepare_enable() fails. TI's AM335x PHY driver got a fix for a race condition during probe. This race happened because driver was powering off the PHY only after adding the PHY handle to the framework. The result is that we could fall into a situation where user of the PHY (MUSB) could call phy_init() before phy driver's probe() called phy_poweroff() which would result in a powered off PHY after phy_init() was called. The old net2272 driver got a fix for an erroneous use of bitwise negation. * tag 'fixes-for-v5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb: usb: phy: am335x: fix race condition in _probe usb: dwc3: exynos: Fix error handling of clk_prepare_enable usb: phy: fix link errors usb: gadget: udc: net2272: Fix bitwise and boolean operations usb: dwc3: gadget: Handle 0 xfer length for OUT EP commit 3aa9179b2dfe06d32d4248f07cf6dd005a964507 Merge: d5256083f62e e2cd682deb23 Author: David S. Miller Date: Wed Jan 30 22:24:49 2019 -0800 Merge branch 'stmmac-fixes' Jose Abreu says: ==================== net: stmmac: Misc fixes Some misc fixes for stmmac targeting -net. ==================== Signed-off-by: David S. Miller commit e2cd682deb231ba6f80524bb84e57e7138261149 Author: Jose Abreu Date: Wed Jan 30 15:54:21 2019 +0100 net: stmmac: Disable EEE mode earlier in XMIT callback In stmmac xmit callback we use a different flow for TSO packets but TSO xmit callback is not disabling the EEE mode. Fix this by disabling earlier the EEE mode, i.e. before calling the TSO xmit callback. Signed-off-by: Jose Abreu Cc: Joao Pinto Cc: David S. Miller Cc: Giuseppe Cavallaro Cc: Alexandre Torgue Signed-off-by: David S. Miller drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit c5acdbee22a1b200dde07effd26fd1f649e9ab8a Author: Jose Abreu Date: Wed Jan 30 15:54:20 2019 +0100 net: stmmac: Send TSO packets always from Queue 0 The number of TSO enabled channels in HW can be different than the number of total channels. There is no way to determined, at runtime, the number of TSO capable channels and its safe to assume that if TSO is enabled then at least channel 0 will be TSO capable. Lets always send TSO packets from Queue 0. Signed-off-by: Jose Abreu Cc: Joao Pinto Cc: David S. Miller Cc: Giuseppe Cavallaro Cc: Alexandre Torgue Signed-off-by: David S. Miller drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) commit 4ec5302fa906ec9d86597b236f62315bacdb9622 Author: Jose Abreu Date: Wed Jan 30 15:54:19 2019 +0100 net: stmmac: Fallback to Platform Data clock in Watchdog conversion If we don't have DT then stmmac_clk will not be available. Let's add a new Platform Data field so that we can specify the refclk by this mean. This way we can still use the coalesce command in PCI based setups. Signed-off-by: Jose Abreu Cc: Joao Pinto Cc: David S. Miller Cc: Giuseppe Cavallaro Cc: Alexandre Torgue Signed-off-by: David S. Miller drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c | 14 ++++++++++---- include/linux/stmmac.h | 1 + 2 files changed, 11 insertions(+), 4 deletions(-) commit d5256083f62e2720f75bb3c5a928a0afe47d6bc3 Author: Daniel Borkmann Date: Wed Jan 30 12:49:48 2019 +0100 ipvlan, l3mdev: fix broken l3s mode wrt local routes While implementing ipvlan l3 and l3s mode for kubernetes CNI plugin, I ran into the issue that while l3 mode is working fine, l3s mode does not have any connectivity to kube-apiserver and hence all pods end up in Error state as well. The ipvlan master device sits on top of a bond device and hostns traffic to kube-apiserver (also running in hostns) is DNATed from 10.152.183.1:443 to 139.178.29.207:37573 where the latter is the address of the bond0. While in l3 mode, a curl to https://10.152.183.1:443 or to https://139.178.29.207:37573 works fine from hostns, neither of them do in case of l3s. In the latter only a curl to https://127.0.0.1:37573 appeared to work where for local addresses of bond0 I saw kernel suddenly starting to emit ARP requests to query HW address of bond0 which remained unanswered and neighbor entries in INCOMPLETE state. These ARP requests only happen while in l3s. Debugging this further, I found the issue is that l3s mode is piggy- backing on l3 master device, and in this case local routes are using l3mdev_master_dev_rcu(dev) instead of net->loopback_dev as per commit f5a0aab84b74 ("net: ipv4: dst for local input routes should use l3mdev if relevant") and 5f02ce24c269 ("net: l3mdev: Allow the l3mdev to be a loopback"). I found that reverting them back into using the net->loopback_dev fixed ipvlan l3s connectivity and got everything working for the CNI. Now judging from 4fbae7d83c98 ("ipvlan: Introduce l3s mode") and the l3mdev paper in [0] the only sole reason why ipvlan l3s is relying on l3 master device is to get the l3mdev_ip_rcv() receive hook for setting the dst entry of the input route without adding its own ipvlan specific hacks into the receive path, however, any l3 domain semantics beyond just that are breaking l3s operation. Note that ipvlan also has the ability to dynamically switch its internal operation from l3 to l3s for all ports via ipvlan_set_port_mode() at runtime. In any case, l3 vs l3s soley distinguishes itself by 'de-confusing' netfilter through switching skb->dev to ipvlan slave device late in NF_INET_LOCAL_IN before handing the skb to L4. Minimal fix taken here is to add a IFF_L3MDEV_RX_HANDLER flag which, if set from ipvlan setup, gets us only the wanted l3mdev_l3_rcv() hook without any additional l3mdev semantics on top. This should also have minimal impact since dev->priv_flags is already hot in cache. With this set, l3s mode is working fine and I also get things like masquerading pod traffic on the ipvlan master properly working. [0] https://netdevconf.org/1.2/papers/ahern-what-is-l3mdev-paper.pdf Fixes: f5a0aab84b74 ("net: ipv4: dst for local input routes should use l3mdev if relevant") Fixes: 5f02ce24c269 ("net: l3mdev: Allow the l3mdev to be a loopback") Fixes: 4fbae7d83c98 ("ipvlan: Introduce l3s mode") Signed-off-by: Daniel Borkmann Cc: Mahesh Bandewar Cc: David Ahern Cc: Florian Westphal Cc: Martynas Pumputis Acked-by: David Ahern Signed-off-by: David S. Miller drivers/net/ipvlan/ipvlan_main.c | 6 +++--- include/linux/netdevice.h | 8 ++++++++ include/net/l3mdev.h | 3 ++- 3 files changed, 13 insertions(+), 4 deletions(-) commit 4522a70db7aa5e77526a4079628578599821b193 Author: Jacob Wen Date: Wed Jan 30 14:55:14 2019 +0800 l2tp: fix reading optional fields of L2TPv3 Use pskb_may_pull() to make sure the optional fields are in skb linear parts, so we can safely read them later. It's easy to reproduce the issue with a net driver that supports paged skb data. Just create a L2TPv3 over IP tunnel and then generates some network traffic. Once reproduced, rx err in /sys/kernel/debug/l2tp/tunnels will increase. Changes in v4: 1. s/l2tp_v3_pull_opt/l2tp_v3_ensure_opt_in_linear/ 2. s/tunnel->version != L2TP_HDR_VER_2/tunnel->version == L2TP_HDR_VER_3/ 3. Add 'Fixes' in commit messages. Changes in v3: 1. To keep consistency, move the code out of l2tp_recv_common. 2. Use "net" instead of "net-next", since this is a bug fix. Changes in v2: 1. Only fix L2TPv3 to make code simple. To fix both L2TPv3 and L2TPv2, we'd better refactor l2tp_recv_common. It's complicated to do so. 2. Reloading pointers after pskb_may_pull Fixes: f7faffa3ff8e ("l2tp: Add L2TPv3 protocol support") Fixes: 0d76751fad77 ("l2tp: Add L2TPv3 IP encapsulation (no UDP) support") Fixes: a32e0eec7042 ("l2tp: introduce L2TPv3 IP encapsulation support for IPv6") Signed-off-by: Jacob Wen Acked-by: Guillaume Nault Signed-off-by: David S. Miller net/l2tp/l2tp_core.c | 4 ++++ net/l2tp/l2tp_core.h | 20 ++++++++++++++++++++ net/l2tp/l2tp_ip.c | 3 +++ net/l2tp/l2tp_ip6.c | 3 +++ 4 files changed, 30 insertions(+) commit 3a03cb8456cc1d61c467a5375e0a10e5207b948c Author: George Amanakis Date: Tue Jan 29 22:50:13 2019 -0500 tun: move the call to tun_set_real_num_queues Call tun_set_real_num_queues() after the increment of tun->numqueues since the former depends on it. Otherwise, the number of queues is not correctly accounted for, which results to warnings similar to: "vnet0 selects TX queue 11, but real number of TX queues is 11". Fixes: 0b7959b62573 ("tun: publish tfile after it's fully initialized") Reported-and-tested-by: George Amanakis Signed-off-by: George Amanakis Signed-off-by: Stanislav Fomichev Signed-off-by: David S. Miller drivers/net/tun.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit ef489749aae508e6f17886775c075f12ff919fb1 Author: Yohei Kanemaru Date: Tue Jan 29 15:52:34 2019 +0900 ipv6: sr: clear IP6CB(skb) on SRH ip4ip6 encapsulation skb->cb may contain data from previous layers (in an observed case IPv4 with L3 Master Device). In the observed scenario, the data in IPCB(skb)->frags was misinterpreted as IP6CB(skb)->frag_max_size, eventually caused an unexpected IPv6 fragmentation in ip6_fragment() through ip6_finish_output(). This patch clears IP6CB(skb), which potentially contains garbage data, on the SRH ip4ip6 encapsulation. Fixes: 32d99d0b6702 ("ipv6: sr: add support for ip4ip6 encapsulation") Signed-off-by: Yohei Kanemaru Signed-off-by: David S. Miller net/ipv6/seg6_iptunnel.c | 2 ++ 1 file changed, 2 insertions(+) commit a10cc84791b1eaa8471ff4e76a1bc8f399800a0b Merge: 41ef81be794f 5050471d35d1 Author: David S. Miller Date: Wed Jan 30 14:02:43 2019 -0800 Merge branch 'virtio_net-Fix-problems-around-XDP-tx-and-napi_tx' Toshiaki Makita says: ==================== virtio_net: Fix problems around XDP tx and napi_tx While I'm looking into how to account standard tx counters on XDP tx processing, I found several bugs around XDP tx and napi_tx. Patch1: Fix oops on error path. Patch2 depends on this. Patch2: Fix memory corruption on freeing xdp_frames with napi_tx enabled. Patch3: Minor fix patch5 depends on. Patch4: Fix memory corruption on processing xdp_frames when XDP is disabled. Also patch5 depends on this. Patch5: Fix memory corruption on processing xdp_frames while XDP is being disabled. Patch6: Minor fix patch7 depends on. Patch7: Fix memory corruption on freeing sk_buff or xdp_frames when a normal queue is reused for XDP and vise versa. v2: - patch5: Make rcu_assign_pointer/synchronize_net conditional instead of _virtnet_set_queues. - patch7: Use napi_consume_skb() instead of dev_consume_skb_any() ==================== Signed-off-by: Toshiaki Makita Signed-off-by: David S. Miller commit 5050471d35d1316ba32dfcbb409978337eb9e75e Author: Toshiaki Makita Date: Tue Jan 29 09:45:59 2019 +0900 virtio_net: Differentiate sk_buff and xdp_frame on freeing We do not reset or free up unused buffers when enabling/disabling XDP, so it can happen that xdp_frames are freed after disabling XDP or sk_buffs are freed after enabling XDP on xdp tx queues. Thus we need to handle both forms (xdp_frames and sk_buffs) regardless of XDP setting. One way to trigger this problem is to disable XDP when napi_tx is enabled. In that case, virtnet_xdp_set() calls virtnet_napi_enable() which kicks NAPI. The NAPI handler will call virtnet_poll_cleantx() which invokes free_old_xmit_skbs() for queues which have been used by XDP. Note that even with this change we need to keep skipping free_old_xmit_skbs() from NAPI handlers when XDP is enabled, because XDP tx queues do not aquire queue locks. - v2: Use napi_consume_skb() instead of dev_consume_skb_any() Fixes: 4941d472bf95 ("virtio-net: do not reset during XDP set") Signed-off-by: Toshiaki Makita Acked-by: Jason Wang Acked-by: Michael S. Tsirkin Signed-off-by: David S. Miller drivers/net/virtio_net.c | 54 +++++++++++++++++++++++++++++++++++++----------- 1 file changed, 42 insertions(+), 12 deletions(-) commit 07b344f494ddda9f061b396407c96df8c46c82b5 Author: Toshiaki Makita Date: Tue Jan 29 09:45:58 2019 +0900 virtio_net: Use xdp_return_frame to free xdp_frames on destroying vqs put_page() can work as a fallback for freeing xdp_frames, but the appropriate way is to use xdp_return_frame(). Fixes: cac320c850ef ("virtio_net: convert to use generic xdp_frame and xdp_return_frame API") Signed-off-by: Toshiaki Makita Acked-by: Jason Wang Acked-by: Jesper Dangaard Brouer Acked-by: Michael S. Tsirkin Signed-off-by: David S. Miller drivers/net/virtio_net.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 03aa6d34868c07b2b1b8b2db080602d7ec528173 Author: Toshiaki Makita Date: Tue Jan 29 09:45:57 2019 +0900 virtio_net: Don't process redirected XDP frames when XDP is disabled Commit 8dcc5b0ab0ec ("virtio_net: fix ndo_xdp_xmit crash towards dev not ready for XDP") tried to avoid access to unexpected sq while XDP is disabled, but was not complete. There was a small window which causes out of bounds sq access in virtnet_xdp_xmit() while disabling XDP. An example case of - curr_queue_pairs = 6 (2 for SKB and 4 for XDP) - online_cpu_num = xdp_queue_paris = 4 when XDP is enabled: CPU 0 CPU 1 (Disabling XDP) (Processing redirected XDP frames) virtnet_xdp_xmit() virtnet_xdp_set() _virtnet_set_queues() set curr_queue_pairs (2) check if rq->xdp_prog is not NULL virtnet_xdp_sq(vi) qp = curr_queue_pairs - xdp_queue_pairs + smp_processor_id() = 2 - 4 + 1 = -1 sq = &vi->sq[qp] // out of bounds access set xdp_queue_pairs (0) rq->xdp_prog = NULL Basically we should not change curr_queue_pairs and xdp_queue_pairs while someone can read the values. Thus, when disabling XDP, assign NULL to rq->xdp_prog first, and wait for RCU grace period, then change xxx_queue_pairs. Note that we need to keep the current order when enabling XDP though. - v2: Make rcu_assign_pointer/synchronize_net conditional instead of _virtnet_set_queues. Fixes: 186b3c998c50 ("virtio-net: support XDP_REDIRECT") Signed-off-by: Toshiaki Makita Acked-by: Jason Wang Acked-by: Michael S. Tsirkin Signed-off-by: David S. Miller drivers/net/virtio_net.c | 33 ++++++++++++++++++++++++++------- 1 file changed, 26 insertions(+), 7 deletions(-) commit 1667c08a9d31c7cdf09f4890816bfbf20b685495 Author: Toshiaki Makita Date: Tue Jan 29 09:45:56 2019 +0900 virtio_net: Fix out of bounds access of sq When XDP is disabled, curr_queue_pairs + smp_processor_id() can be larger than max_queue_pairs. There is no guarantee that we have enough XDP send queues dedicated for each cpu when XDP is disabled, so do not count drops on sq in that case. Fixes: 5b8f3c8d30a6 ("virtio_net: Add XDP related stats") Signed-off-by: Toshiaki Makita Acked-by: Jason Wang Acked-by: Michael S. Tsirkin Signed-off-by: David S. Miller drivers/net/virtio_net.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) commit 188313c137c4f76afd0862f50dbc185b198b9e2a Author: Toshiaki Makita Date: Tue Jan 29 09:45:55 2019 +0900 virtio_net: Fix not restoring real_num_rx_queues When _virtnet_set_queues() failed we did not restore real_num_rx_queues. Fix this by placing the change of real_num_rx_queues after _virtnet_set_queues(). This order is also in line with virtnet_set_channels(). Fixes: 4941d472bf95 ("virtio-net: do not reset during XDP set") Signed-off-by: Toshiaki Makita Acked-by: Jason Wang Acked-by: Michael S. Tsirkin Signed-off-by: David S. Miller drivers/net/virtio_net.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 534da5e856334fb54cb0272a9fb3afec28ea3aed Author: Toshiaki Makita Date: Tue Jan 29 09:45:54 2019 +0900 virtio_net: Don't call free_old_xmit_skbs for xdp_frames When napi_tx is enabled, virtnet_poll_cleantx() called free_old_xmit_skbs() even for xdp send queue. This is bogus since the queue has xdp_frames, not sk_buffs, thus mangled device tx bytes counters because skb->len is meaningless value, and even triggered oops due to general protection fault on freeing them. Since xdp send queues do not aquire locks, old xdp_frames should be freed only in virtnet_xdp_xmit(), so just skip free_old_xmit_skbs() for xdp send queues. Similarly virtnet_poll_tx() called free_old_xmit_skbs(). This NAPI handler is called even without calling start_xmit() because cb for tx is by default enabled. Once the handler is called, it enabled the cb again, and then the handler would be called again. We don't need this handler for XDP, so don't enable cb as well as not calling free_old_xmit_skbs(). Also, we need to disable tx NAPI when disabling XDP, so virtnet_poll_tx() can safely access curr_queue_pairs and xdp_queue_pairs, which are not atomically updated while disabling XDP. Fixes: b92f1e6751a6 ("virtio-net: transmit napi") Fixes: 7b0411ef4aa6 ("virtio-net: clean tx descriptors from rx napi") Signed-off-by: Toshiaki Makita Acked-by: Jason Wang Acked-by: Michael S. Tsirkin Signed-off-by: David S. Miller drivers/net/virtio_net.c | 49 ++++++++++++++++++++++++++++++++---------------- 1 file changed, 33 insertions(+), 16 deletions(-) commit 8be4d9a492f88b96d4d3a06c6cbedbc40ca14c83 Author: Toshiaki Makita Date: Tue Jan 29 09:45:53 2019 +0900 virtio_net: Don't enable NAPI when interface is down Commit 4e09ff536284 ("virtio-net: disable NAPI only when enabled during XDP set") tried to fix inappropriate NAPI enabling/disabling when !netif_running(), but was not complete. On error path virtio_net could enable NAPI even when !netif_running(). This can cause enabling NAPI twice on virtnet_open(), which would trigger BUG_ON() in napi_enable(). Fixes: 4941d472bf95b ("virtio-net: do not reset during XDP set") Signed-off-by: Toshiaki Makita Acked-by: Jason Wang Acked-by: Michael S. Tsirkin Signed-off-by: David S. Miller drivers/net/virtio_net.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 41ef81be794f8d3f0edb7f15f952113ec999cbd6 Merge: e15aa3b2b138 c706863bc890 Author: David S. Miller Date: Wed Jan 30 14:00:02 2019 -0800 Merge branch 'erspan-always-reports-output-key-to-userspace' Lorenzo Bianconi says: ==================== erspan: always reports output key to userspace Erspan protocol relies on output key to set session id header field. However TUNNEL_KEY bit is cleared in order to not add key field to the external GRE header and so the configured o_key is not reported to userspace. Fix the issue adding TUNNEL_KEY bit to the o_flags parameter dumping device info ==================== Signed-off-by: David S. Miller commit c706863bc8902d0c2d1a5a27ac8e1ead5d06b79d Author: Lorenzo Bianconi Date: Mon Jan 28 22:23:49 2019 +0100 net: ip6_gre: always reports o_key to userspace As Erspan_v4, Erspan_v6 protocol relies on o_key to configure session id header field. However TUNNEL_KEY bit is cleared in ip6erspan_tunnel_xmit since ERSPAN protocol does not set the key field of the external GRE header and so the configured o_key is not reported to userspace. The issue can be triggered with the following reproducer: $ip link add ip6erspan1 type ip6erspan local 2000::1 remote 2000::2 \ key 1 seq erspan_ver 1 $ip link set ip6erspan1 up ip -d link sh ip6erspan1 ip6erspan1@NONE: mtu 1422 qdisc noop state DOWN mode DEFAULT link/ether ba:ff:09:24:c3:0e brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 1500 ip6erspan remote 2000::2 local 2000::1 encaplimit 4 flowlabel 0x00000 ikey 0.0.0.1 iseq oseq Fix the issue adding TUNNEL_KEY bit to the o_flags parameter in ip6gre_fill_info Fixes: 5a963eb61b7c ("ip6_gre: Add ERSPAN native tunnel support") Signed-off-by: Lorenzo Bianconi Signed-off-by: David S. Miller net/ipv6/ip6_gre.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit feaf5c796b3f0240f10d0d6d0b686715fd58a05b Author: Lorenzo Bianconi Date: Mon Jan 28 22:23:48 2019 +0100 net: ip_gre: always reports o_key to userspace Erspan protocol (version 1 and 2) relies on o_key to configure session id header field. However TUNNEL_KEY bit is cleared in erspan_xmit since ERSPAN protocol does not set the key field of the external GRE header and so the configured o_key is not reported to userspace. The issue can be triggered with the following reproducer: $ip link add erspan1 type erspan local 192.168.0.1 remote 192.168.0.2 \ key 1 seq erspan_ver 1 $ip link set erspan1 up $ip -d link sh erspan1 erspan1@NONE: mtu 1450 qdisc pfifo_fast state UNKNOWN mode DEFAULT link/ether 52:aa:99:95:9a:b5 brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 1500 erspan remote 192.168.0.2 local 192.168.0.1 ttl inherit ikey 0.0.0.1 iseq oseq erspan_index 0 Fix the issue adding TUNNEL_KEY bit to the o_flags parameter in ipgre_fill_info Fixes: 84e54fe0a5ea ("gre: introduce native tunnel support for ERSPAN") Signed-off-by: Lorenzo Bianconi Signed-off-by: David S. Miller net/ipv4/ip_gre.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 1617971c6616c87185cbc78fa1a86dfc70dd16b6 Author: Doug Smythies Date: Wed Jan 30 08:28:22 2019 -0800 cpuidle: poll_state: Fix default time limit The default time is declared in units of microsecnds, but is used as nanoseconds, resulting in significant accounting errors for idle state 0 time when all idle states deeper than 0 are disabled. Under these unusual conditions, we don't really care about the poll time limit anyhow. Fixes: 800fb34a99ce ("cpuidle: poll_state: Disregard disable idle states") Signed-off-by: Doug Smythies Signed-off-by: Rafael J. Wysocki drivers/cpuidle/poll_state.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 15efb47dc560849d0c07db96fdad5121f2cf736e Author: Vincent Guittot Date: Wed Jan 30 18:26:02 2019 +0100 PM-runtime: Fix deadlock with ktime_get() A deadlock has been seen when swicthing clocksources which use PM-runtime. The call path is: change_clocksource ... write_seqcount_begin ... timekeeping_update ... sh_cmt_clocksource_enable ... rpm_resume pm_runtime_mark_last_busy ktime_get do read_seqcount_begin while read_seqcount_retry .... write_seqcount_end Although we should be safe because we haven't yet changed the clocksource at that time, we can't do that because of seqcount protection. Use ktime_get_mono_fast_ns() instead which is lock safe for such cases. With ktime_get_mono_fast_ns, the timestamp is not guaranteed to be monotonic across an update and as a result can goes backward. According to update_fast_timekeeper() description: "In the worst case, this can result is a slightly wrong timestamp (a few nanoseconds)". For PM-runtime autosuspend, this means only that the suspend decision may be slightly suboptimal. Fixes: 8234f6734c5d ("PM-runtime: Switch autosuspend over to using hrtimers") Reported-by: Biju Das Signed-off-by: Vincent Guittot Reviewed-by: Ulf Hansson Signed-off-by: Rafael J. Wysocki drivers/base/power/runtime.c | 10 +++++----- include/linux/pm_runtime.h | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) commit af0c9af1b3f66052c369d08be3f60fa9a9559e48 Author: Waiman Long Date: Wed Jan 30 13:52:38 2019 -0500 fs/dcache: Track & report number of negative dentries The current dentry number tracking code doesn't distinguish between positive & negative dentries. It just reports the total number of dentries in the LRU lists. As excessive number of negative dentries can have an impact on system performance, it will be wise to track the number of positive and negative dentries separately. This patch adds tracking for the total number of negative dentries in the system LRU lists and reports it in the 5th field in the /proc/sys/fs/dentry-state file. The number, however, does not include negative dentries that are in flight but not in the LRU yet as well as those in the shrinker lists which are on the way out anyway. The number of positive dentries in the LRU lists can be roughly found by subtracting the number of negative dentries from the unused count. Matthew Wilcox had confirmed that since the introduction of the dentry_stat structure in 2.1.60, the dummy array was there, probably for future extension. They were not replacements of pre-existing fields. So no sane applications that read the value of /proc/sys/fs/dentry-state will do dummy thing if the last 2 fields of the sysctl parameter are not zero. IOW, it will be safe to use one of the dummy array entry for negative dentry count. Signed-off-by: Waiman Long Signed-off-by: Linus Torvalds Documentation/sysctl/fs.txt | 26 ++++++++++++++++---------- fs/dcache.c | 32 ++++++++++++++++++++++++++++++++ include/linux/dcache.h | 7 ++++--- 3 files changed, 52 insertions(+), 13 deletions(-) commit 7d10f70fc198877b43d92bdcd7604279788b9568 Author: Waiman Long Date: Wed Jan 30 13:52:37 2019 -0500 fs: Don't need to put list_lru into its own cacheline The list_lru structure is essentially just a pointer to a table of per-node LRU lists. Even if CONFIG_MEMCG_KMEM is defined, the list field is just used for LRU list registration and shrinker_id is set at initialization. Those fields won't need to be touched that often. So there is no point to make the list_lru structures to sit in their own cachelines. Signed-off-by: Waiman Long Reviewed-by: Dave Chinner Signed-off-by: Linus Torvalds include/linux/fs.h | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 1dbd449c9943e3145148cc893c2461b72ba6fef0 Author: Waiman Long Date: Wed Jan 30 13:52:36 2019 -0500 fs/dcache: Fix incorrect nr_dentry_unused accounting in shrink_dcache_sb() The nr_dentry_unused per-cpu counter tracks dentries in both the LRU lists and the shrink lists where the DCACHE_LRU_LIST bit is set. The shrink_dcache_sb() function moves dentries from the LRU list to a shrink list and subtracts the dentry count from nr_dentry_unused. This is incorrect as the nr_dentry_unused count will also be decremented in shrink_dentry_list() via d_shrink_del(). To fix this double decrement, the decrement in the shrink_dcache_sb() function is taken out. Fixes: 4e717f5c1083 ("list_lru: remove special case function list_lru_dispose_all." Cc: stable@kernel.org Signed-off-by: Waiman Long Reviewed-by: Dave Chinner Signed-off-by: Linus Torvalds fs/dcache.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) commit e15aa3b2b1388c399c1a2ce08550d2cc4f7e3e14 Author: Mathias Thore Date: Mon Jan 28 10:07:47 2019 +0100 ucc_geth: Reset BQL queue when stopping device After a timeout event caused by for example a broadcast storm, when the MAC and PHY are reset, the BQL TX queue needs to be reset as well. Otherwise, the device will exhibit severe performance issues even after the storm has ended. Co-authored-by: David Gounaris Signed-off-by: Mathias Thore Signed-off-by: David S. Miller drivers/net/ethernet/freescale/ucc_geth.c | 2 ++ 1 file changed, 2 insertions(+) commit b284909abad48b07d3071a9fc9b5692b3e64914b Author: Josh Poimboeuf Date: Wed Jan 30 07:13:58 2019 -0600 cpu/hotplug: Fix "SMT disabled by BIOS" detection for KVM With the following commit: 73d5e2b47264 ("cpu/hotplug: detect SMT disabled by BIOS") ... the hotplug code attempted to detect when SMT was disabled by BIOS, in which case it reported SMT as permanently disabled. However, that code broke a virt hotplug scenario, where the guest is booted with only primary CPU threads, and a sibling is brought online later. The problem is that there doesn't seem to be a way to reliably distinguish between the HW "SMT disabled by BIOS" case and the virt "sibling not yet brought online" case. So the above-mentioned commit was a bit misguided, as it permanently disabled SMT for both cases, preventing future virt sibling hotplugs. Going back and reviewing the original problems which were attempted to be solved by that commit, when SMT was disabled in BIOS: 1) /sys/devices/system/cpu/smt/control showed "on" instead of "notsupported"; and 2) vmx_vm_init() was incorrectly showing the L1TF_MSG_SMT warning. I'd propose that we instead consider #1 above to not actually be a problem. Because, at least in the virt case, it's possible that SMT wasn't disabled by BIOS and a sibling thread could be brought online later. So it makes sense to just always default the smt control to "on" to allow for that possibility (assuming cpuid indicates that the CPU supports SMT). The real problem is #2, which has a simple fix: change vmx_vm_init() to query the actual current SMT state -- i.e., whether any siblings are currently online -- instead of looking at the SMT "control" sysfs value. So fix it by: a) reverting the original "fix" and its followup fix: 73d5e2b47264 ("cpu/hotplug: detect SMT disabled by BIOS") bc2d8d262cba ("cpu/hotplug: Fix SMT supported evaluation") and b) changing vmx_vm_init() to query the actual current SMT state -- instead of the sysfs control value -- to determine whether the L1TF warning is needed. This also requires the 'sched_smt_present' variable to exported, instead of 'cpu_smt_control'. Fixes: 73d5e2b47264 ("cpu/hotplug: detect SMT disabled by BIOS") Reported-by: Igor Mammedov Signed-off-by: Josh Poimboeuf Signed-off-by: Thomas Gleixner Cc: Joe Mario Cc: Jiri Kosina Cc: Peter Zijlstra Cc: kvm@vger.kernel.org Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/e3a85d585da28cc333ecbc1e78ee9216e6da9396.1548794349.git.jpoimboe@redhat.com arch/x86/kernel/cpu/bugs.c | 2 +- arch/x86/kvm/vmx/vmx.c | 3 ++- include/linux/cpu.h | 2 -- kernel/cpu.c | 33 ++++----------------------------- kernel/sched/fair.c | 1 + kernel/smp.c | 2 -- 6 files changed, 8 insertions(+), 35 deletions(-) commit 794827f3ea9ddc53ea900395953381a4252c7cb8 Merge: 62967898789d 98406133dd9c Author: David S. Miller Date: Wed Jan 30 10:19:31 2019 -0800 Merge branch 'net-various-compat-ioctl-fixes' Johannes Berg says: ==================== various compat ioctl fixes Back a long time ago, I already fixed a few of these by passing the size of the struct ifreq to do_sock_ioctl(). However, Robert found more cases, and now it won't be as simple because we'd have to pass that down all the way to e.g. bond_do_ioctl() which isn't really feasible. Therefore, restore the old code. While looking at why SIOCGIFNAME was broken, I realized that Al had removed that case - which had been handled in an explicit separate function - as well, and looking through his work at the time I saw that bond ioctls were also affected by the erroneous removal. I've restored SIOCGIFNAME and bond ioctls by going through the (now renamed) dev_ifsioc() instead of reintroducing their own helper functions, which I hope is correct but have only tested with SIOCGIFNAME. ==================== Acked-by: Al Viro Signed-off-by: David S. Miller commit 98406133dd9cb9f195676eab540c270dceca879a Author: Johannes Berg Date: Fri Jan 25 22:43:20 2019 +0100 net: socket: make bond ioctls go through compat_ifreq_ioctl() Same story as before, these use struct ifreq and thus need to be read with the shorter version to not cause faults. Cc: stable@vger.kernel.org Fixes: f92d4fc95341 ("kill bond_ioctl()") Signed-off-by: Johannes Berg Signed-off-by: David S. Miller net/socket.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit c6c9fee35dc27362b7bac34b2fc9f5b8ace2e22c Author: Johannes Berg Date: Fri Jan 25 22:43:19 2019 +0100 net: socket: fix SIOCGIFNAME in compat As reported by Robert O'Callahan in https://bugzilla.kernel.org/show_bug.cgi?id=202273 reverting the previous changes in this area broke the SIOCGIFNAME ioctl in compat again (I'd previously fixed it after his previous report of breakage in https://bugzilla.kernel.org/show_bug.cgi?id=199469). This is obviously because I fixed SIOCGIFNAME more or less by accident. Fix it explicitly now by making it pass through the restored compat translation code. Cc: stable@vger.kernel.org Fixes: 4cf808e7ac32 ("kill dev_ifname32()") Reported-by: Robert O'Callahan Signed-off-by: Johannes Berg Signed-off-by: David S. Miller net/socket.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 37ac39bdddc528c998a9f36db36937de923fdf2a Author: Johannes Berg Date: Fri Jan 25 22:43:18 2019 +0100 Revert "kill dev_ifsioc()" This reverts commit bf4405737f9f ("kill dev_ifsioc()"). This wasn't really unused as implied by the original commit, it still handles the copy to/from user differently, and the commit thus caused issues such as https://bugzilla.kernel.org/show_bug.cgi?id=199469 and https://bugzilla.kernel.org/show_bug.cgi?id=202273 However, deviating from a strict revert, rename dev_ifsioc() to compat_ifreq_ioctl() to be clearer as to its purpose and add a comment. Cc: stable@vger.kernel.org Fixes: bf4405737f9f ("kill dev_ifsioc()") Signed-off-by: Johannes Berg Signed-off-by: David S. Miller net/socket.c | 49 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) commit 63ff03ab786ab1bc6cca01d48eacd22c95b9b3eb Author: Johannes Berg Date: Fri Jan 25 22:43:17 2019 +0100 Revert "socket: fix struct ifreq size in compat ioctl" This reverts commit 1cebf8f143c2 ("socket: fix struct ifreq size in compat ioctl"), it's a bugfix for another commit that I'll revert next. This is not a 'perfect' revert, I'm keeping some coding style intact rather than revert to the state with indentation errors. Cc: stable@vger.kernel.org Fixes: 1cebf8f143c2 ("socket: fix struct ifreq size in compat ioctl") Signed-off-by: Johannes Berg Signed-off-by: David S. Miller net/socket.c | 22 ++++++++-------------- 1 file changed, 8 insertions(+), 14 deletions(-) commit 798badf8467f41af6dfbf5621e1fc966c80446fd Author: Greg Kroah-Hartman Date: Wed Jan 30 19:17:53 2019 +0100 Revert "staging: erofs: keep corrupted fs from crashing kernel in erofs_namei()" This reverts commit d4104c5e783f5d053b97268fb92001d785de7dd5. Turns out it still needs some more work, I merged it to soon :( Reported-by: Gao Xiang Reported-by: Dan Carpenter Cc: Al Viro Signed-off-by: Greg Kroah-Hartman drivers/staging/erofs/namei.c | 167 ++++++++++++++++++++---------------------- 1 file changed, 78 insertions(+), 89 deletions(-) commit 6e11ea9de9576a644045ffdc2067c09bc2012eda Author: Chris Wilson Date: Wed Jan 30 10:55:17 2019 +0000 drm/amdgpu: Transfer fences to dmabuf importer amdgpu only uses shared-fences internally, but dmabuf importers rely on implicit write hazard tracking via the reservation_object.fence_excl. For example, the importer use the write hazard for timing a page flip to only occur after the exporter has finished flushing its write into the surface. As such, on exporting a dmabuf, we must either flush all outstanding fences (for we do not know which are writes and should have been exclusive) or alternatively create a new exclusive fence that is the composite of all the existing shared fences, and so will only be signaled when all earlier fences are signaled (ensuring that we can not be signaled before the completion of any earlier write). v2: reservation_object is already locked by amdgpu_bo_reserve() v3: Replace looping with get_fences_rcu and special case the promotion of a single shared fence directly to an exclusive fence, bypassing the fence array. v4: Drop the fence array ref after assigning to reservation_object Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=107341 Testcase: igt/amd_prime/amd-to-i915 References: 8e94a46c1770 ("drm/amdgpu: Attach exclusive fence to prime exported bo's. (v5)") Signed-off-by: Chris Wilson Cc: Alex Deucher Cc: "Christian König" Reviewed-by: "Christian König" Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c | 59 ++++++++++++++++++++++++++----- 1 file changed, 51 insertions(+), 8 deletions(-) commit 1c0490ce902206f4685f812fa81304fd1adf4e35 Merge: 877ef51d53ab 9825bd94e3a2 Author: Linus Torvalds Date: Wed Jan 30 09:30:03 2019 -0800 Merge tag 'iommu-fixes-v5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull IOMMU fixes from Joerg Roedel: "A few more fixes this time: - Two patches to fix the error path of the map_sg implementation of the AMD IOMMU driver. - Also a missing IOTLB flush is fixed in the AMD IOMMU driver. - Memory leak fix for the Intel IOMMU driver. - Fix a regression in the Mediatek IOMMU driver which caused device initialization to fail (seen as broken HDMI output)" * tag 'iommu-fixes-v5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/amd: Fix IOMMU page flush when detach device from a domain iommu/mediatek: Use correct fwspec in mtk_iommu_add_device() iommu/vt-d: Fix memory leak in intel_iommu_put_resv_regions() iommu/amd: Unmap all mapped pages in error path of map_sg iommu/amd: Call free_iova_fast with pfn in map_sg commit 877ef51d53abfdadabc64809d045d9c27c1cf757 Merge: 62967898789d 7ae710f9f8b2 Author: Linus Torvalds Date: Wed Jan 30 09:23:21 2019 -0800 Merge tag 'gpio-v5.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO fixes from Linus Walleij: "Here is a bunch of GPIO fixes for the v5.0 series. I was helped out by Bartosz in collecting these fixes, for which I am very grateful, the biggest achievement in GPIO right now is work distribution. There is one serious core fix (timestamping) and a bunch of driver fixes: - Fix timestamps on nested IRQs - Handle IRQs properly in multiple instances of PCF857x - Use the right data register and IRQ type setting in the Spreadtrum GPIO driver - Let the value argument work properly when setting direction in the Altera GPIO driver - Mask interrupts properly in the vf610 driver" * tag 'gpio-v5.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: gpio: vf610: Mask all GPIO interrupts gpio: altera-a10sr: Set proper output level for direction_output gpio: sprd: Fix incorrect irq type setting for the async EIC gpio: sprd: Fix the incorrect data register gpiolib: fix line event timestamps for nested irqs gpio: pcf857x: Fix interrupts on multiple instances commit 532b618bdf237250d6d4566536d4b6ce3d0a31fe Author: Eric W. Biederman Date: Wed Jan 30 07:54:12 2019 -0600 btrfs: On error always free subvol_name in btrfs_mount The subvol_name is allocated in btrfs_parse_subvol_options and is consumed and freed in mount_subvol. Add a free to the error paths that don't call mount_subvol so that it is guaranteed that subvol_name is freed when an error happens. Fixes: 312c89fbca06 ("btrfs: cleanup btrfs_mount() using btrfs_mount_root()") Cc: stable@vger.kernel.org # v4.19+ Reviewed-by: Nikolay Borisov Signed-off-by: "Eric W. Biederman" Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/super.c | 3 +++ 1 file changed, 3 insertions(+) commit c7cc64a98512ffc41df86d14a414eb3b09bf7481 Author: David Sterba Date: Wed Jan 23 17:09:16 2019 +0100 btrfs: clean up pending block groups when transaction commit aborts The fstests generic/475 stresses transaction aborts and can reveal space accounting or use-after-free bugs regarding block goups. In this case the pending block groups that remain linked to the structures after transaction commit aborts in the middle. The corrupted slabs lead to failures in following tests, eg. generic/476 [ 8172.752887] BUG: unable to handle kernel NULL pointer dereference at 0000000000000058 [ 8172.755799] #PF error: [normal kernel read fault] [ 8172.757571] PGD 661ae067 P4D 661ae067 PUD 3db8e067 PMD 0 [ 8172.759000] Oops: 0000 [#1] PREEMPT SMP [ 8172.760209] CPU: 0 PID: 39 Comm: kswapd0 Tainted: G W 5.0.0-rc2-default #408 [ 8172.762495] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.2-0-gf9626cc-prebuilt.qemu-project.org 04/01/2014 [ 8172.765772] RIP: 0010:shrink_page_list+0x2f9/0xe90 [ 8172.770453] RSP: 0018:ffff967f00663b18 EFLAGS: 00010287 [ 8172.771184] RAX: 0000000000000000 RBX: ffff967f00663c20 RCX: 0000000000000000 [ 8172.772850] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8c0620ab20e0 [ 8172.774629] RBP: ffff967f00663dd8 R08: 0000000000000000 R09: 0000000000000000 [ 8172.776094] R10: ffff8c0620ab22f8 R11: ffff8c063f772688 R12: ffff967f00663b78 [ 8172.777533] R13: ffff8c063f625600 R14: ffff8c063f625608 R15: dead000000000200 [ 8172.778886] FS: 0000000000000000(0000) GS:ffff8c063d400000(0000) knlGS:0000000000000000 [ 8172.780545] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8172.781787] CR2: 0000000000000058 CR3: 000000004e962000 CR4: 00000000000006f0 [ 8172.783547] Call Trace: [ 8172.784112] shrink_inactive_list+0x194/0x410 [ 8172.784747] shrink_node_memcg.constprop.85+0x3a5/0x6a0 [ 8172.785472] shrink_node+0x62/0x1e0 [ 8172.786011] balance_pgdat+0x216/0x460 [ 8172.786577] kswapd+0xe3/0x4a0 [ 8172.787085] ? finish_wait+0x80/0x80 [ 8172.787795] ? balance_pgdat+0x460/0x460 [ 8172.788799] kthread+0x116/0x130 [ 8172.789640] ? kthread_create_on_node+0x60/0x60 [ 8172.790323] ret_from_fork+0x24/0x30 [ 8172.794253] CR2: 0000000000000058 or accounting errors at umount time: [ 8159.537251] WARNING: CPU: 2 PID: 19031 at fs/btrfs/extent-tree.c:5987 btrfs_free_block_groups+0x3d5/0x410 [btrfs] [ 8159.543325] CPU: 2 PID: 19031 Comm: umount Tainted: G W 5.0.0-rc2-default #408 [ 8159.545472] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.2-0-gf9626cc-prebuilt.qemu-project.org 04/01/2014 [ 8159.548155] RIP: 0010:btrfs_free_block_groups+0x3d5/0x410 [btrfs] [ 8159.554030] RSP: 0018:ffff967f079cbde8 EFLAGS: 00010206 [ 8159.555144] RAX: 0000000001000000 RBX: ffff8c06366cf800 RCX: 0000000000000000 [ 8159.556730] RDX: 0000000000000002 RSI: 0000000000000001 RDI: ffff8c06255ad800 [ 8159.558279] RBP: ffff8c0637ac0000 R08: 0000000000000001 R09: 0000000000000000 [ 8159.559797] R10: 0000000000000000 R11: 0000000000000001 R12: ffff8c0637ac0108 [ 8159.561296] R13: ffff8c0637ac0158 R14: 0000000000000000 R15: dead000000000100 [ 8159.562852] FS: 00007f7f693b9fc0(0000) GS:ffff8c063d800000(0000) knlGS:0000000000000000 [ 8159.564839] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8159.566160] CR2: 00007f7f68fab7b0 CR3: 000000000aec7000 CR4: 00000000000006e0 [ 8159.567898] Call Trace: [ 8159.568597] close_ctree+0x17f/0x350 [btrfs] [ 8159.569628] generic_shutdown_super+0x64/0x100 [ 8159.570808] kill_anon_super+0x14/0x30 [ 8159.571857] btrfs_kill_super+0x12/0xa0 [btrfs] [ 8159.573063] deactivate_locked_super+0x29/0x60 [ 8159.574234] cleanup_mnt+0x3b/0x70 [ 8159.575176] task_work_run+0x98/0xc0 [ 8159.576177] exit_to_usermode_loop+0x83/0x90 [ 8159.577315] do_syscall_64+0x15b/0x180 [ 8159.578339] entry_SYSCALL_64_after_hwframe+0x49/0xbe This fix is based on 2 Josef's patches that used sideefects of btrfs_create_pending_block_groups, this fix introduces the helper that does what we need. CC: stable@vger.kernel.org # 4.4+ CC: Josef Bacik Reviewed-by: Nikolay Borisov Signed-off-by: David Sterba fs/btrfs/transaction.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) commit 92900e5160a5444d47dd376bc40066b709fbb5a6 Author: Al Viro Date: Sun Jan 27 04:58:00 2019 +0000 btrfs: fix potential oops in device_list_add alloc_fs_devices() can return ERR_PTR(-ENOMEM), so dereferencing its result before the check for IS_ERR() is a bad idea. Fixes: d1a63002829a4 ("btrfs: add members to fs_devices to track fsid changes") Reviewed-by: Nikolay Borisov Reviewed-by: Anand Jain Signed-off-by: Al Viro Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/volumes.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 8950dcd83ae7d62bdc2a60507949acebd85399f2 Author: Lu Baolu Date: Thu Jan 24 10:31:32 2019 +0800 iommu/vt-d: Leave scalable mode default off Commit 765b6a98c1de3 ("iommu/vt-d: Enumerate the scalable mode capability") enables VT-d scalable mode if hardware advertises the capability. As we will bring up different features and use cases to upstream in different patch series, it will leave some intermediate kernel versions which support partial features. Hence, end user might run into problems when they use such kernels on bare metals or virtualization environments. This leaves scalable mode default off and end users could turn it on with "intel-iommu=sm_on" only when they have clear ideas about which scalable features are supported in the kernel. Cc: Liu Yi L Cc: Jacob Pan Suggested-by: Ashok Raj Suggested-by: Kevin Tian Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel Documentation/admin-guide/kernel-parameters.txt | 7 +++---- drivers/iommu/intel-iommu.c | 8 ++++---- 2 files changed, 7 insertions(+), 8 deletions(-) commit 85bd6e61f34dffa8ec2dc75ff3c02ee7b2f1cbce Author: Jianchao Wang Date: Wed Jan 30 17:01:56 2019 +0800 blk-mq: fix a hung issue when fsync Florian reported a io hung issue when fsync(). It should be triggered by following race condition. data + post flush a flush blk_flush_complete_seq case REQ_FSEQ_DATA blk_flush_queue_rq issued to driver blk_mq_dispatch_rq_list try to issue a flush req failed due to NON-NCQ command .queue_rq return BLK_STS_DEV_RESOURCE request completion req->end_io // doesn't check RESTART mq_flush_data_end_io case REQ_FSEQ_POSTFLUSH blk_kick_flush do nothing because previous flush has not been completed blk_mq_run_hw_queue insert rq to hctx->dispatch due to RESTART is still set, do nothing To fix this, replace the blk_mq_run_hw_queue in mq_flush_data_end_io with blk_mq_sched_restart to check and clear the RESTART flag. Fixes: bd166ef1 (blk-mq-sched: add framework for MQ capable IO schedulers) Reported-by: Florian Stecker Tested-by: Florian Stecker Signed-off-by: Jianchao Wang Signed-off-by: Jens Axboe block/blk-flush.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2e3c18d0ada16f145087b2687afcad1748c0827c Author: Tetsuo Handa Date: Wed Jan 30 22:21:45 2019 +0900 block: pass no-op callback to INIT_WORK(). syzbot is hitting flush_work() warning caused by commit 4d43d395fed12463 ("workqueue: Try to catch flush_work() without INIT_WORK().") [1]. Although that commit did not expect INIT_WORK(NULL) case, calling flush_work() without setting a valid callback should be avoided anyway. Fix this problem by setting a no-op callback instead of NULL. [1] https://syzkaller.appspot.com/bug?id=e390366bc48bc82a7c668326e0663be3b91cbd29 Signed-off-by: Tetsuo Handa Reported-and-tested-by: syzbot Cc: Tejun Heo Signed-off-by: Jens Axboe block/blk-core.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit c418fd6c01fbc5516a2cd1eaf1df1ec86869028a Author: Paul Elder Date: Wed Jan 30 08:13:21 2019 -0600 usb: gadget: musb: fix short isoc packets with inventra dma Handling short packets (length < max packet size) in the Inventra DMA engine in the MUSB driver causes the MUSB DMA controller to hang. An example of a problem that is caused by this problem is when streaming video out of a UVC gadget, only the first video frame is transferred. For short packets (mode-0 or mode-1 DMA), MUSB_TXCSR_TXPKTRDY must be set manually by the driver. This was previously done in musb_g_tx (musb_gadget.c), but incorrectly (all csr flags were cleared, and only MUSB_TXCSR_MODE and MUSB_TXCSR_TXPKTRDY were set). Fixing that problem allows some requests to be transferred correctly, but multiple requests were often put together in one USB packet, and caused problems if the packet size was not a multiple of 4. Instead, set MUSB_TXCSR_TXPKTRDY in dma_controller_irq (musbhsdma.c), just like host mode transfers. This topic was originally tackled by Nicolas Boichat [0] [1] and is discussed further at [2] as part of his GSoC project [3]. [0] https://groups.google.com/forum/?hl=en#!topic/beagleboard-gsoc/k8Azwfp75CU [1] https://gitorious.org/beagleboard-usbsniffer/beagleboard-usbsniffer-kernel/commit/b0be3b6cc195ba732189b04f1d43ec843c3e54c9?p=beagleboard-usbsniffer:beagleboard-usbsniffer-kernel.git;a=patch;h=b0be3b6cc195ba732189b04f1d43ec843c3e54c9 [2] http://beagleboard-usbsniffer.blogspot.com/2010/07/musb-isochronous-transfers-fixed.html [3] http://elinux.org/BeagleBoard/GSoC/USBSniffer Fixes: 550a7375fe72 ("USB: Add MUSB and TUSB support") Signed-off-by: Paul Elder Signed-off-by: Bin Liu Cc: stable Signed-off-by: Greg Kroah-Hartman drivers/usb/musb/musb_gadget.c | 13 +------------ drivers/usb/musb/musbhsdma.c | 21 +++++++++++---------- 2 files changed, 12 insertions(+), 22 deletions(-) commit 5aa608348f86d90f05b16dec93963801e2dd4ef5 Author: Vincent Whitchurch Date: Tue Jan 29 11:22:07 2019 +0100 mic: vop: Fix broken virtqueues VOP is broken in mainline since commit 1ce9e6055fa0a9043 ("virtio_ring: introduce packed ring support"); attempting to use the virtqueues leads to various kernel crashes. I'm testing it with my not-yet-merged loopback patches, but even the in-tree MIC hardware cannot work. The problem is not in the referenced commit per se, but is due to the following hack in vop_find_vq() which depends on the layout of private structures in other source files, which that commit happened to change: /* * To reassign the used ring here we are directly accessing * struct vring_virtqueue which is a private data structure * in virtio_ring.c. At the minimum, a BUILD_BUG_ON() in * vring_new_virtqueue() would ensure that * (&vq->vring == (struct vring *) (&vq->vq + 1)); */ vr = (struct vring *)(vq + 1); vr->used = used; Fix vop by using __vring_new_virtqueue() to create the needed vring layout from the start, instead of attempting to patch in the used ring later. __vring_new_virtqueue() was added way back in commit 2a2d1382fe9dcc ("virtio: Add improved queue allocation API") in order to address mic's usecase, according to the commit message. Fixes: 1ce9e6055fa0 ("virtio_ring: introduce packed ring support") Signed-off-by: Vincent Whitchurch Signed-off-by: Greg Kroah-Hartman drivers/misc/mic/vop/vop_main.c | 60 +++++++++++++++++++++++------------------ 1 file changed, 34 insertions(+), 26 deletions(-) commit d4104c5e783f5d053b97268fb92001d785de7dd5 Author: Gao Xiang Date: Tue Jan 29 23:55:40 2019 +0800 staging: erofs: keep corrupted fs from crashing kernel in erofs_namei() As Al pointed out, " ... and while we are at it, what happens to unsigned int nameoff = le16_to_cpu(de[mid].nameoff); unsigned int matched = min(startprfx, endprfx); struct qstr dname = QSTR_INIT(data + nameoff, unlikely(mid >= ndirents - 1) ? maxsize - nameoff : le16_to_cpu(de[mid + 1].nameoff) - nameoff); /* string comparison without already matched prefix */ int ret = dirnamecmp(name, &dname, &matched); if le16_to_cpu(de[...].nameoff) is not monotonically increasing? I.e. what's to prevent e.g. (unsigned)-1 ending up in dname.len? Corrupted fs image shouldn't oops the kernel.. " Revisit the related lookup flow to address the issue. Fixes: d72d1ce60174 ("staging: erofs: add namei functions") Cc: # 4.19+ Suggested-by: Al Viro Signed-off-by: Gao Xiang Signed-off-by: Greg Kroah-Hartman drivers/staging/erofs/namei.c | 167 ++++++++++++++++++++++-------------------- 1 file changed, 89 insertions(+), 78 deletions(-) commit 49230b49c4398765feba809ac27ae09562cbead1 Author: Aaro Koskinen Date: Sun Jan 27 21:54:50 2019 +0200 staging: octeon: fix broken phylib usage Commit 2b3e88ea6528 ("net: phy: improve phy state checking") added checks for phylib usage, and this triggers with OCTEON ethernet and results in broken networking. Fix by replacing phy_start_aneg() with phy_start(). Fixes: 2b3e88ea6528 ("net: phy: improve phy state checking") Signed-off-by: Aaro Koskinen Signed-off-by: Greg Kroah-Hartman drivers/staging/octeon/ethernet-mdio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cee4c4d63ba7b0df9b2d2a6724c41b2a260d72ec Author: Alexander Usyskin Date: Wed Jan 30 10:12:26 2019 +0200 mei: free read cb on ctrl_wr list flush There is a little window during disconnection flow when read cb is moved between lists and may be not freed. Remove moving read cbs explicitly during flash fixes this memory leak. Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman drivers/misc/mei/client.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit c4a46acf1db3ce547d290c29e55b3476c78dd76c Author: Tomas Winkler Date: Thu Jan 24 14:45:03 2019 +0200 samples: mei: use /dev/mei0 instead of /dev/mei The device was moved from misc device to character devices to support multiple mei devices. Cc: #v4.9+ Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman samples/mei/mei-amt-version.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit efe814e90b98aed6d655b5a4092b9114b8b26e42 Author: Tomas Winkler Date: Thu Jan 24 14:45:02 2019 +0200 mei: me: add ice lake point device id. Add icelake mei device id. Cc: Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman drivers/misc/mei/hw-me-regs.h | 2 ++ drivers/misc/mei/pci-me.c | 2 ++ 2 files changed, 4 insertions(+) commit da8ddba566ff0a883237dbc8c5dadef1ca769e19 Author: Christian Brauner Date: Wed Jan 23 12:41:15 2019 +0100 binderfs: respect limit on binder control creation We currently adhere to the reserved devices limit when creating new binderfs devices in binderfs instances not located in the inital ipc namespace. But it is still possible to rob the host instances of their 4 reserved devices by creating the maximum allowed number of devices in a single binderfs instance located in a non-initial ipc namespace and then mounting 4 separate binderfs instances in non-initial ipc namespaces. That happens because the limit is currently not respected for the creation of the initial binder-control device node. Block this nonsense by performing the same check in binderfs_binder_ctl_create() that we perform in binderfs_binder_device_create(). Fixes: 36bdf3cae09d ("binderfs: reserve devices for initial mount") Signed-off-by: Christian Brauner Signed-off-by: Greg Kroah-Hartman drivers/android/binderfs.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) commit 793c8232937610ae00bc174b87d7fc324346eaea Author: Christian Brauner Date: Sat Jan 26 11:23:20 2019 +0100 binder: fix CONFIG_ANDROID_BINDER_DEVICES Several users have tried to only rely on binderfs to provide binder devices and set CONFIG_ANDROID_BINDER_DEVICES="" empty. This is a great use-case of binderfs and one that was always intended to work. However, this is currently not possible since setting CONFIG_ANDROID_BINDER_DEVICES="" emtpy will simply panic the kernel: kobject: (00000000028c2f79): attempted to be registered with empty name! WARNING: CPU: 7 PID: 1703 at lib/kobject.c:228 kobject_add_internal+0x288/0x2b0 Modules linked in: binder_linux(+) bridge stp llc ipmi_ssif gpio_ich dcdbas coretemp kvm_intel kvm irqbypass serio_raw input_leds lpc_ich i5100_edac mac_hid ipmi_si ipmi_devintf ipmi_msghandler sch_fq_codel ib_i CPU: 7 PID: 1703 Comm: modprobe Not tainted 5.0.0-rc2-brauner-binderfs #263 Hardware name: Dell DCS XS24-SC2 /XS24-SC2 , BIOS S59_3C20 04/07/2011 RIP: 0010:kobject_add_internal+0x288/0x2b0 Code: 12 95 48 c7 c7 78 63 3b 95 e8 77 35 71 ff e9 91 fe ff ff 0f 0b eb a7 0f 0b eb 9a 48 89 de 48 c7 c7 00 63 3b 95 e8 f8 95 6a ff <0f> 0b 41 bc ea ff ff ff e9 6d fe ff ff 41 bc fe ff ff ff e9 62 fe RSP: 0018:ffff973f84237a30 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff8b53e2472010 RCX: 0000000000000006 RDX: 0000000000000007 RSI: 0000000000000086 RDI: ffff8b53edbd63a0 RBP: ffff973f84237a60 R08: 0000000000000342 R09: 0000000000000004 R10: ffff973f84237af0 R11: 0000000000000001 R12: 0000000000000000 R13: ffff8b53e9f1a1e0 R14: 00000000e9f1a1e0 R15: 0000000000a00037 FS: 00007fbac36f7540(0000) GS:ffff8b53edbc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fbac364cfa7 CR3: 00000004a6d48000 CR4: 00000000000406e0 Call Trace: kobject_add+0x71/0xd0 ? _cond_resched+0x19/0x40 ? mutex_lock+0x12/0x40 device_add+0x12e/0x6b0 device_create_groups_vargs+0xe4/0xf0 device_create_with_groups+0x3f/0x60 ? _cond_resched+0x19/0x40 misc_register+0x140/0x180 binder_init+0x1ed/0x2d4 [binder_linux] ? trace_event_define_fields_binder_transaction_fd_send+0x8e/0x8e [binder_linux] do_one_initcall+0x4a/0x1c9 ? _cond_resched+0x19/0x40 ? kmem_cache_alloc_trace+0x151/0x1c0 do_init_module+0x5f/0x216 load_module+0x223d/0x2b20 __do_sys_finit_module+0xfc/0x120 ? __do_sys_finit_module+0xfc/0x120 __x64_sys_finit_module+0x1a/0x20 do_syscall_64+0x5a/0x120 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7fbac3202839 Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 1f f6 2c 00 f7 d8 64 89 01 48 RSP: 002b:00007ffd1494a908 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 000055b629ebec60 RCX: 00007fbac3202839 RDX: 0000000000000000 RSI: 000055b629c20d2e RDI: 0000000000000003 RBP: 000055b629c20d2e R08: 0000000000000000 R09: 000055b629ec2310 R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000 R13: 000055b629ebed70 R14: 0000000000040000 R15: 000055b629ebec60 So check for the empty string since strsep() will otherwise return the emtpy string which will cause kobject_add_internal() to panic when trying to add a kobject with an emtpy name. Fixes: ac4812c5ffbb ("binder: Support multiple /dev instances") Cc: Martijn Coenen Signed-off-by: Christian Brauner Acked-by: Todd Kjos Signed-off-by: Greg Kroah-Hartman drivers/android/binder.c | 30 ++++++++++++++++-------------- 1 file changed, 16 insertions(+), 14 deletions(-) commit 75abec73de65a86a23019ee7a3569220ee344f37 Author: Christian Brauner Date: Thu Jan 17 12:48:54 2019 +0100 selftests: add binderfs selftests This adds the promised selftest for binderfs. It will verify the following things: - binderfs mounting works - binder device allocation works - performing a binder ioctl() request through a binderfs device works - binder device removal works - binder-control removal fails - binderfs unmounting works The tests are performed both privileged and unprivileged. The latter verifies that binderfs behaves correctly in user namespaces. Cc: Todd Kjos Signed-off-by: Christian Brauner Acked-by: Shuah Khan Signed-off-by: Greg Kroah-Hartman tools/testing/selftests/Makefile | 1 + .../selftests/filesystems/binderfs/.gitignore | 1 + .../selftests/filesystems/binderfs/Makefile | 6 + .../selftests/filesystems/binderfs/binderfs_test.c | 275 +++++++++++++++++++++ .../testing/selftests/filesystems/binderfs/config | 3 + 5 files changed, 286 insertions(+) commit 37ea7b630ae5cdea4e8ff381d9d23abfef5939e6 Author: Greg Kroah-Hartman Date: Wed Jan 30 12:37:35 2019 +0100 debugfs: debugfs_lookup() should return NULL if not found Lots of callers of debugfs_lookup() were just checking NULL to see if the file/directory was found or not. By changing this in ff9fb72bc077 ("debugfs: return error values, not NULL") we caused some subsystems to easily crash. Fixes: ff9fb72bc077 ("debugfs: return error values, not NULL") Reported-by: syzbot+b382ba6a802a3d242790@syzkaller.appspotmail.com Reported-by: Tetsuo Handa Cc: Omar Sandoval Cc: Jens Axboe Signed-off-by: Greg Kroah-Hartman fs/debugfs/inode.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit a1960e0f1639cb1f7a3d94521760fc73091f6640 Author: Johan Hovold Date: Wed Jan 30 10:49:34 2019 +0100 staging: speakup: fix tty-operation NULL derefs The send_xchar() and tiocmset() tty operations are optional. Add the missing sanity checks to prevent user-space triggerable NULL-pointer dereferences. Fixes: 6b9ad1c742bf ("staging: speakup: add send_xchar, tiocmset and input functionality for tty") Cc: stable # 4.13 Cc: Okash Khawaja Cc: Samuel Thibault Signed-off-by: Johan Hovold Reviewed-by: Samuel Thibault Signed-off-by: Greg Kroah-Hartman drivers/staging/speakup/spk_ttyio.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 0b053bbf07867c9942d706e70040398df59de54b Author: Borislav Petkov Date: Thu Jan 24 11:18:48 2019 +0100 MAINTAINERS: Add Andy and Darren as arch/x86/platform/ reviewers ... so that they can get CCed on platform patches. Signed-off-by: Borislav Petkov Acked-by: Andy Shevchenko Acked-by: Thomas Gleixner Cc: Darren Hart Cc: Andy Shevchenko Cc: x86@kernel.org Link: https://lkml.kernel.org/r/20190128113619.19025-1-bp@alien8.de MAINTAINERS | 9 +++++++++ 1 file changed, 9 insertions(+) commit d0f9f16788e15d9eb40f68b047732d49658c5a3a Author: Marc Gonzalez Date: Wed Jan 16 16:49:58 2019 +0100 ARM: tango: Improve ARCH_MULTIPLATFORM compatibility Calling platform-specific code unconditionally blows up when running an ARCH_MULTIPLATFORM kernel on a different platform. Don't do it. Reported-by: Paolo Pisati Signed-off-by: Marc Gonzalez Acked-by: Pavel Machek Cc: stable@vger.kernel.org # v4.8+ Fixes: a30eceb7a59d ("ARM: tango: add Suspend-to-RAM support") Signed-off-by: Arnd Bergmann arch/arm/mach-tango/pm.c | 6 ++---- arch/arm/mach-tango/pm.h | 7 +++++++ arch/arm/mach-tango/setup.c | 2 ++ 3 files changed, 11 insertions(+), 4 deletions(-) commit a17bab2d6784630a8ef50f872db7a68b43392f82 Merge: a7403eb27e3e 6a6a797625b5 Author: Arnd Bergmann Date: Wed Jan 30 11:41:52 2019 +0100 Merge tag 'renesas-fixes3-for-v5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas into arm/fixes Third Round of Renesas ARM Based SoC Fixes for v5.0 * Convert to new LVDS DT bindings fixing a regression introduced in v4.17 * tag 'renesas-fixes3-for-v5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas: ARM: dts: r8a7743: Convert to new LVDS DT bindings Signed-off-by: Arnd Bergmann commit a7403eb27e3eb27378f039695a0ead3f2693dfad Merge: 83d365150272 b1360dcfdaa1 Author: Arnd Bergmann Date: Wed Jan 30 11:35:33 2019 +0100 Merge tag 'sunxi-fixes-for-5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into arm/fixes Allwinner Fixes for 5.0 A couple of device tree fixes for the 5.0 cycle: - Add missing clock-output-names for the osc24M clock on sun6i/A31 The Linux clock driver uses the device node as the clock name if the property is missing. The node name was changed in 5.0-rc1, breaking a subtle dependency in the sunxi-ng clock driver, and renders Linux unable to completely boot up. - Add alias for Ethernet controller on Beelink X2 This allows the bootloader to assign a deterministically generated MAC address to it. - Add property to enable USB VBUS regulator on OrangePi Win The board had defined the constraints for the regulator, but was missing the property to actually enable it. * tag 'sunxi-fixes-for-5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: arm64: dts: allwinner: a64: Fix USB OTG regulator ARM: dts: sun8i: h3: Add ethernet0 alias to Beelink X2 ARM: dts: sun6i: Add clock-output-names to osc24M clock arm64: dts: allwinner: a64: Fix the video engine compatible Signed-off-by: Arnd Bergmann commit 83d365150272aa3b28bac8637bc4069179df884a Merge: 46edb8d1322c f29200c8b1e2 Author: Arnd Bergmann Date: Wed Jan 30 11:34:55 2019 +0100 Merge tag 'amlogic-fixes-2.1' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-amlogic into arm/fixes Amlogic fixes for v5.0-rc, round 2 - several fixups for the GPIO cd-inverted change - IRQ trigger fixes for MAC IRQ * tag 'amlogic-fixes-2.1' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-amlogic: arm64: dts: meson: Fix mmc cd-gpios polarity ARM: dts: meson8m2: mxiii-plus: mark the SD card detection GPIO active-low ARM: dts: meson8b: ec100: mark the SD card detection GPIO active-low ARM: dts: meson8b: odroidc1: mark the SD card detection GPIO active-low arm: dts: meson: Fix IRQ trigger type for macirq Signed-off-by: Arnd Bergmann commit 46edb8d1322c1763dd04e179992f8e9996085047 Author: Sudeep Holla Date: Tue Jan 22 11:35:25 2019 +0000 firmware: arm_scmi: provide the mandatory device release callback The device/driver model clearly mandates that bus driver that discover and allocate the device must set the release callback. This callback will be used to free the device after all references have gone away. scmi bus driver is missing the obvious callback which will result in the following warning if the device is unregistered: Device 'scmi_dev.1' does not have a release() function, it is broken and must be fixed. See Documentation/kobject.txt. WARNING at drivers/base/core.c:922 device_release+0x8c/0xa0 Hardware name: ARM LTD Juno Development Platform BIOS EDK II Jan 21 2019 Workqueue: events deferred_probe_work_func pstate: 60000005 (nZCv daif -PAN -UAO) pc : device_release+0x8c/0xa0 lr : device_release+0x8c/0xa0 Call trace: device_release+0x8c/0xa0 kobject_put+0x8c/0x208 device_unregister+0x30/0x78 scmi_device_destroy+0x28/0x50 scmi_probe+0x354/0x5b0 platform_drv_probe+0x58/0xa8 really_probe+0x2c4/0x3e8 driver_probe_device+0x12c/0x148 __device_attach_driver+0xac/0x150 bus_for_each_drv+0x78/0xd8 __device_attach+0xe0/0x168 device_initial_probe+0x24/0x30 bus_probe_device+0xa0/0xa8 deferred_probe_work_func+0x8c/0xe0 process_one_work+0x1f0/0x478 worker_thread+0x22c/0x450 kthread+0x134/0x138 ret_from_fork+0x10/0x1c ---[ end trace 420bdb7f6af50937 ]--- Fix the issue by providing scmi_device_release callback. We have everything required for device release already in scmi_device_destroy, so we just need to move freeing of the device to scmi_device_release. Fixes: 933c504424a2 ("firmware: arm_scmi: add scmi protocol bus to enumerate protocol devices") Signed-off-by: Sudeep Holla Cc: stable@vger.kernel.org # 4.17+ Signed-off-by: Arnd Bergmann drivers/firmware/arm_scmi/bus.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) commit db4090920ba2d61a5827a23e441447926a02ffee Author: Russell King Date: Fri Jan 25 20:10:15 2019 +0000 ARM: iop32x/n2100: fix PCI IRQ mapping Booting 4.20 on a TheCUS N2100 results in a kernel oops while probing PCI, due to n2100_pci_map_irq() having been discarded during boot. Signed-off-by: Russell King Cc: stable@vger.kernel.org # 2.6.18+ Signed-off-by: Arnd Bergmann arch/arm/mach-iop32x/n2100.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 44a0f88467f54478e3f3f6d29d22186fa6861dc4 Merge: 2b3604e24313 063c20e12f8b Author: Arnd Bergmann Date: Wed Jan 30 11:24:03 2019 +0100 Merge tag 'omap-for-v5.0/fixes-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into arm/fixes Device tree fixes for omaps for v5.0-rc cycle This series of dts fixes for omap devices fixes several device specific regressions: - The onenand timings for n950/n9 have been wrong for a while since we moved to dts based timings - A typo for the cpcap pmic is now producing erors during boot as the level should be 0 for unconfigurable triggering instead of 1 - Changes for ti-sysc for omap5 left uart3 with debug flags that should not be set - Fix a new dtc warning started showing up for omap3-gta04 grap_port - With the generic MMC card detection code we need to fix the gpio in dts for n900 and am335x-shc * tag 'omap-for-v5.0/fixes-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: ARM: dts: am335x-shc.dts: fix wrong cd pin level ARM: dts: n900: fix mmc1 card detect gpio polarity ARM: dts: omap3-gta04: Fix graph_port warning ARM: dts: Remove unnecessary idle flags for omap5 uart3 ARM: dts: omap4-droid4: Fix typo in cpcap IRQ flags ARM: OMAP: dts: N950/N9: fix onenand timings Signed-off-by: Arnd Bergmann commit 2b3604e243134e0000340b34cae8233f382ff08c Merge: 91c577ef1eac e3966a766865 Author: Arnd Bergmann Date: Wed Jan 30 11:22:57 2019 +0100 Merge tag 'davinci-fixes-for-v5.0-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/nsekhar/linux-davinci into arm/fixes This fixes a long standing typo in device-tree for DA850 in interrupt number for timer. It did not affect us so far because we use non-DT timer driver within mach-davinci. This was caught while migrating to clocksource driver. * tag 'davinci-fixes-for-v5.0-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/nsekhar/linux-davinci: ARM: dts: da850: fix interrupt numbers for clocksource Signed-off-by: Arnd Bergmann commit 91c577ef1eac03be257fbc206f8f0fd64caee3df Merge: 1229c729bb94 2a81efb0de0e Author: Arnd Bergmann Date: Wed Jan 30 11:22:15 2019 +0100 Merge tag 'qcom-fixes-for-5.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/agross/linux into arm/fixes Qualcomm ARM64 Fixes for 5.0-rc3 * Fix irq controller compatible for the MSM8996 platforms * tag 'qcom-fixes-for-5.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/agross/linux: arm64: dts: add msm8996 compatible to gicv3 Signed-off-by: Arnd Bergmann commit 1229c729bb944c239f70927e983b5cd185418a43 Merge: 03937704b84c 05c8478abd48 Author: Arnd Bergmann Date: Wed Jan 30 11:21:08 2019 +0100 Merge tag 'renesas-fixes2-for-v5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas into arm/fixes Second Round of Renesas ARM Based SoC Fixes for v5.0 Enable DMA for SCIF2 on R-Car M3-W (r8a7796) and M3-n (r8a77965), and (RZ/G2M) r8a774a1 SoCs. This is was omitted from patches enabling DMA for other SCIF devices on the same SoCs due to missing documentation. However, it is regarded as a fix as arguably those patches claim to add this feature. Per-SoC patches are provided to ease backporting of this fix as the kernel version to be fixed is different for each SoC. * tag 'renesas-fixes2-for-v5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas: arm64: dts: renesas: r8a77965: Enable DMA for SCIF2 arm64: dts: renesas: r8a7796: Enable DMA for SCIF2 arm64: dts: renesas: r8a774a1: Enable DMA for SCIF2 Signed-off-by: Arnd Bergmann commit 03937704b84c84465fb1b716ce905d09e102a477 Merge: 3673a91c0709 ba16adeb3463 Author: Arnd Bergmann Date: Wed Jan 30 11:20:12 2019 +0100 Merge tag 'pxa-fixes-5.0' of https://github.com/rjarzmik/linux into arm/fixes This is the pxa fixes set for v4.20 cycle: - only a single devm allocated pointer free fix, which was never triggered runtime but code analysis found. * tag 'pxa-fixes-5.0' of https://github.com/rjarzmik/linux: ARM: pxa: ssp: unneeded to free devm_ allocated data Signed-off-by: Arnd Bergmann commit 3673a91c0709a2687a582a87d9e391af4b213071 Merge: e22dc7be4c65 c5b11ee9f1c2 Author: Arnd Bergmann Date: Wed Jan 30 11:16:50 2019 +0100 Merge tag 'imx-fixes-5.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 5.0, 2nd round: It contains a single fix for i.MX8MQ clock numbers, removing the duplicate use of 232 and numbering the clocks consecutively. * tag 'imx-fixes-5.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: dt-bindings: imx8mq: Number clocks consecutively Signed-off-by: Arnd Bergmann commit e22dc7be4c657a8733f96e45bcc5c26c95351ee9 Merge: 69835820f1f3 89857a8a5c89 Author: Arnd Bergmann Date: Wed Jan 30 11:13:58 2019 +0100 Merge tag 'soc-fsl-fix-v5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/leo/linux into arm/fixes soc/fsl fixes for v5.0 - qbman: avoid missing interrupts by only clearing processed events * tag 'soc-fsl-fix-v5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/leo/linux: soc: fsl: qbman: avoid race in clearing QMan interrupt Signed-off-by: Arnd Bergmann commit 69835820f1f35f1b87ba17ae1c9ec9a99040b54d Merge: f17b5f06cb92 ba0f4560526b Author: Arnd Bergmann Date: Wed Jan 30 11:12:02 2019 +0100 Merge tag 'imx-fixes-5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 5.0: - Fix spi_bus_bridge DTC warning by correcting '#address-cells' of dspi3 node on vf610-bk4 board, as it's being used a SPI slave controller there. - Replace deprecated gpio-key,wakeup property with wakeup-source for board imx6q-pistachio and imx6sll-evk, into which the deprecated property sneaked during the merge window. - Correct the backward compatible for i.MX6SX GPT device, as it's actually compatible with i.MX6DL GPT rather than i.MX31 one. * tag 'imx-fixes-5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: ARM: dts: imx6sx: correct backward compatible of gpt ARM: dts: imx: replace gpio-key,wakeup with wakeup-source property ARM: dts: vf610-bk4: fix incorrect #address-cells for dspi3 Signed-off-by: Arnd Bergmann commit 4d95987a32db53f3beca76f8c4c8309ef6a5f192 Author: Chris Brandt Date: Mon Jan 28 13:25:56 2019 -0500 serial: sh-sci: Do not free irqs that have already been freed Since IRQs might be muxed on some parts, we need to pay attention when we are freeing them. Otherwise we get the ugly WARNING "Trying to free already-free IRQ 20". Fixes: 628c534ae735 ("serial: sh-sci: Improve support for separate TEI and DRI interrupts") Cc: stable Signed-off-by: Chris Brandt Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/sh-sci.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit 824d17c57b0abbcb9128fb3f7327fae14761914b Author: Andy Shevchenko Date: Thu Jan 24 23:51:21 2019 +0200 serial: 8250_pci: Make PCI class test non fatal As has been reported the National Instruments serial cards have broken PCI class. The commit 7d8905d06405 ("serial: 8250_pci: Enable device after we check black list") made the PCI class check mandatory for the case when device is listed in a quirk list. Make PCI class test non fatal to allow broken card be enumerated. Fixes: 7d8905d06405 ("serial: 8250_pci: Enable device after we check black list") Cc: stable Reported-by: Guan Yung Tseng Tested-by: Guan Yung Tseng Tested-by: KHUENY.Gerhard Signed-off-by: Andy Shevchenko Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/8250/8250_pci.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 1575c083a78cc1137ad8bfa042d02eeb9dc86ef4 Author: Gustavo A. R. Silva Date: Tue Jan 22 13:57:19 2019 -0600 tty: serial: 8250_mtk: Fix potential NULL pointer dereference There is a potential NULL pointer dereference in case devm_kzalloc() fails and returns NULL. Fix this by adding a NULL check on data->dma This bug was detected with the help of Coccinelle. Fixes: 85b5c1dd0456 ("serial: 8250-mtk: add uart DMA support") Signed-off-by: Gustavo A. R. Silva Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/8250/8250_mtk.c | 3 +++ 1 file changed, 3 insertions(+) commit 9d90436ece8f2c5b4da617e679590137e54ce4cb Merge: 2fa53f892422 32b750b92504 Author: Alexei Starovoitov Date: Tue Jan 29 19:15:33 2019 -0800 Merge branch 'typedef-func_proto' Yonghong Song says: ==================== The current btf implementation disallows the typedef of a func_proto type. This actually is allowed per C standard. This patch fixed btf verification to permit such types. Patch #1 fixed the kernel side and Patch #2 fixed the tools test_btf test. ==================== Signed-off-by: Alexei Starovoitov commit 32b750b925040565bbeff1fe2f7510e3dc71ce2e Author: Yonghong Song Date: Tue Jan 29 16:38:17 2019 -0800 tools/bpf: fix test_btf for typedef func_proto case Fixed one test_btf raw test such that typedef func_proto is permitted now. Fixes: 78a2540e8945 ("tools/bpf: Add tests for BTF_KIND_FUNC_PROTO and BTF_KIND_FUNC") Acked-by: Martin KaFai Lau Signed-off-by: Yonghong Song Signed-off-by: Alexei Starovoitov tools/testing/selftests/bpf/test_btf.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) commit 81f5c6f5db37bf2360b64c304b27b8f499b48367 Author: Yonghong Song Date: Tue Jan 29 16:38:16 2019 -0800 bpf: btf: allow typedef func_proto Current implementation does not allow typedef func_proto. But it is actually allowed. -bash-4.4$ cat t.c typedef int (f) (int); f *g; -bash-4.4$ clang -O2 -g -c -target bpf t.c -Xclang -target-feature -Xclang +dwarfris -bash-4.4$ pahole -JV t.o File t.o: [1] PTR (anon) type_id=2 [2] TYPEDEF f type_id=3 [3] FUNC_PROTO (anon) return=4 args=(4 (anon)) [4] INT int size=4 bit_offset=0 nr_bits=32 encoding=SIGNED -bash-4.4$ This patch related btf verifier to allow such (typedef func_proto) patterns. Fixes: 2667a2626f4d ("bpf: btf: Add BTF_KIND_FUNC and BTF_KIND_FUNC_PROTO") Acked-by: Martin KaFai Lau Signed-off-by: Yonghong Song Signed-off-by: Alexei Starovoitov kernel/bpf/btf.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 62967898789dc1f09a06e59fa85ae2c5ca4dc2da Merge: 4aa9fc2a435a d07e1e0febe1 Author: Linus Torvalds Date: Tue Jan 29 17:11:47 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) Need to save away the IV across tls async operations, from Dave Watson. 2) Upon successful packet processing, we should liberate the SKB with dev_consume_skb{_irq}(). From Yang Wei. 3) Only apply RX hang workaround on effected macb chips, from Harini Katakam. 4) Dummy netdev need a proper namespace assigned to them, from Josh Elsasser. 5) Some paths of nft_compat run lockless now, and thus we need to use a proper refcnt_t. From Florian Westphal. 6) Avoid deadlock in mlx5 by doing IRQ locking, from Moni Shoua. 7) netrom does not refcount sockets properly wrt. timers, fix that by using the sock timer API. From Cong Wang. 8) Fix locking of inexact inserts of xfrm policies, from Florian Westphal. 9) Missing xfrm hash generation bump, also from Florian. 10) Missing of_node_put() in hns driver, from Yonglong Liu. 11) Fix DN_IFREQ_SIZE, from Johannes Berg. 12) ip6mr notifier is invoked during traversal of wrong table, from Nir Dotan. 13) TX promisc settings not performed correctly in qed, from Manish Chopra. 14) Fix OOB access in vhost, from Jason Wang. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (52 commits) MAINTAINERS: Add entry for XDP (eXpress Data Path) net: set default network namespace in init_dummy_netdev() net: b44: replace dev_kfree_skb_xxx by dev_consume_skb_xxx for drop profiles net: caif: call dev_consume_skb_any when skb xmit done net: 8139cp: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles net: macb: Apply RXUBR workaround only to versions with errata net: ti: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles net: apple: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles net: amd8111e: replace dev_kfree_skb_irq by dev_consume_skb_irq net: alteon: replace dev_kfree_skb_irq by dev_consume_skb_irq net: tls: Fix deadlock in free_resources tx net: tls: Save iv in tls_rec for async crypto requests vhost: fix OOB in get_rx_bufs() qed: Fix stack out of bounds bug qed: Fix system crash in ll2 xmit qed: Fix VF probe failure while FLR qed: Fix LACP pdu drops for VFs qed: Fix bug in tx promiscuous mode settings net: i825xx: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles netfilter: ipt_CLUSTERIP: fix warning unused variable cn ... commit 082aaa8700415f6471ec9c5ef0c8307ca214989a Author: Pavel Shilovsky Date: Fri Jan 18 15:54:34 2019 -0800 CIFS: Do not consider -ENODATA as stat failure for reads When doing reads beyound the end of a file the server returns error STATUS_END_OF_FILE error which is mapped to -ENODATA. Currently we report it as a failure which confuses read stats. Change it to not consider -ENODATA as failure for stat purposes. Signed-off-by: Pavel Shilovsky Signed-off-by: Steve French CC: Stable fs/cifs/smb2pdu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8e6e72aeceaaed5aeeb1cb43d3085de7ceb14f79 Author: Pavel Shilovsky Date: Sat Jan 26 12:21:32 2019 -0800 CIFS: Do not count -ENODATA as failure for query directory Signed-off-by: Pavel Shilovsky Signed-off-by: Steve French CC: Stable fs/cifs/smb2pdu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 7d42e72fe8ee5ab70b1af843dd7d8615e6fb0abe Author: Pavel Shilovsky Date: Fri Jan 25 11:38:53 2019 -0800 CIFS: Fix trace command logging for SMB2 reads and writes Currently we log success once we send an async IO request to the server. Instead we need to analyse a response and then log success or failure for a particular command. Also fix argument list for read logging. Cc: # 4.18 Signed-off-by: Pavel Shilovsky Signed-off-by: Steve French fs/cifs/smb2pdu.c | 46 ++++++++++++++++++++++++++++++---------------- 1 file changed, 30 insertions(+), 16 deletions(-) commit 9bda8723da2d55b1de833b98cf802b88006e5b69 Author: Pavel Shilovsky Date: Wed Jan 23 17:12:09 2019 -0800 CIFS: Fix possible oops and memory leaks in async IO Allocation of a page array for non-cached IO was separated from allocation of rdata and wdata structures and this introduced memory leaks and a possible null pointer dereference. This patch fixes these problems. Cc: Signed-off-by: Pavel Shilovsky Signed-off-by: Steve French fs/cifs/file.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit c4627e66f73a28c5515b908c90c2bf7120086497 Author: Ronnie Sahlberg Date: Tue Jan 29 12:46:17 2019 +1000 cifs: limit amount of data we request for xattrs to CIFSMaxBufSize minus the various headers and blobs that will be part of the reply. or else we might trigger a session reconnect. Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French Reviewed-by: Pavel Shilovsky fs/cifs/smb2ops.c | 4 +++- fs/cifs/smb2pdu.h | 15 +++++++++++++-- 2 files changed, 16 insertions(+), 3 deletions(-) commit 58d15ed1203f4d858c339ea4d7dafa94bd2a56d3 Author: Ronnie Sahlberg Date: Tue Jan 29 12:46:16 2019 +1000 cifs: fix computation for MAX_SMB2_HDR_SIZE The size of the fixed part of the create response is 88 bytes not 56. Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French Reviewed-by: Pavel Shilovsky fs/cifs/smb2pdu.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 8fc75bed96bb94e23ca51bd9be4daf65c57697bf Author: Trond Myklebust Date: Tue Jan 29 15:52:55 2019 -0500 NFS: Fix up return value on fatal errors in nfs_page_async_flush() Ensure that we return the fatal error value that caused us to exit nfs_page_async_flush(). Fixes: c373fff7bd25 ("NFSv4: Don't special case "launder"") Signed-off-by: Trond Myklebust Cc: stable@vger.kernel.org # v4.12+ Reviewed-by: Benjamin Coddington Signed-off-by: Anna Schumaker fs/nfs/write.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 34d66caf251df91ff27b24a3a786810d29989eca Author: Zhenzhong Duan Date: Thu Jan 17 02:10:59 2019 -0800 x86/speculation: Remove redundant arch_smt_update() invocation With commit a74cfffb03b7 ("x86/speculation: Rework SMT state change"), arch_smt_update() is invoked from each individual CPU hotplug function. Therefore the extra arch_smt_update() call in the sysfs SMT control is redundant. Fixes: a74cfffb03b7 ("x86/speculation: Rework SMT state change") Signed-off-by: Zhenzhong Duan Signed-off-by: Thomas Gleixner Cc: Cc: Cc: Cc: Cc: Cc: Link: https://lkml.kernel.org/r/e2e064f2-e8ef-42ca-bf4f-76b612964752@default kernel/cpu.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) commit 5ccd35287edae4107475a141a477a6a4ecbe1cab Author: Colin Ian King Date: Sat Dec 22 19:11:16 2018 +0000 x86/fault: Fix sign-extend unintended sign extension show_ldttss() shifts desc.base2 by 24 bit, but base2 is 8 bits of a bitfield in a u16. Due to the really great idea of integer promotion in C99 base2 is promoted to an int, because that's the standard defined behaviour when all values which can be represented by base2 fit into an int. Now if bit 7 is set in desc.base2 the result of the shift left by 24 makes the resulting integer negative and the following conversion to unsigned long legitmately sign extends first causing the upper bits 32 bits to be set in the result. Fix this by casting desc.base2 to unsigned long before the shift. Detected by CoverityScan, CID#1475635 ("Unintended sign extension") [ tglx: Reworded the changelog a bit as I actually had to lookup the standard (again) to decode the original one. ] Fixes: a1a371c468f7 ("x86/fault: Decode page fault OOPSes better") Signed-off-by: Colin Ian King Signed-off-by: Thomas Gleixner Cc: Dave Hansen Cc: Andy Lutomirski Cc: Peter Zijlstra Cc: Borislav Petkov Cc: "H . Peter Anvin" Cc: kernel-janitors@vger.kernel.org Link: https://lkml.kernel.org/r/20181222191116.21831-1-colin.king@canonical.com arch/x86/mm/fault.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b677dfae5aa197afc5191755a76a8727ffca538a Author: Wei Huang Date: Thu Jan 3 23:44:11 2019 -0600 x86/boot/compressed/64: Set EFER.LME=1 in 32-bit trampoline before returning to long mode In some old AMD KVM implementation, guest's EFER.LME bit is cleared by KVM when the hypervsior detects that the guest sets CR0.PG to 0. This causes the guest OS to reboot when it tries to return from 32-bit trampoline code because the CPU is in incorrect state: CR4.PAE=1, CR0.PG=1, CS.L=1, but EFER.LME=0. As a precaution, set EFER.LME=1 as part of long mode activation procedure. This extra step won't cause any harm when Linux is booted on a bare-metal machine. Signed-off-by: Wei Huang Signed-off-by: Thomas Gleixner Acked-by: Kirill A. Shutemov Cc: bp@alien8.de Cc: hpa@zytor.com Link: https://lkml.kernel.org/r/20190104054411.12489-1-wei@redhat.com arch/x86/boot/compressed/head_64.S | 8 ++++++++ arch/x86/boot/compressed/pgtable.h | 2 +- 2 files changed, 9 insertions(+), 1 deletion(-) commit 7b21b69ab203136fdc153c7707fa6c409e523c2e Author: Yishai Hadas Date: Sun Jan 27 10:11:27 2019 +0200 IB/uverbs: Fix OOPs in uverbs_user_mmap_disassociate The vma->vm_mm can become impossible to get before rdma_umap_close() is called, in this case we must not try to get an mm that is already undergoing process exit. In this case there is no need to wait for anything as the VMA will be destroyed by another thread soon and is already effectively 'unreachable' by userspace. BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 PGD 800000012bc50067 P4D 800000012bc50067 PUD 129db5067 PMD 0 Oops: 0000 [#1] SMP PTI CPU: 1 PID: 2050 Comm: bash Tainted: G W OE 4.20.0-rc6+ #3 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 RIP: 0010:__rb_erase_color+0xb9/0x280 Code: 84 17 01 00 00 48 3b 68 10 0f 84 15 01 00 00 48 89 58 08 48 89 de 48 89 ef 4c 89 e3 e8 90 84 22 00 e9 60 ff ff ff 48 8b 5d 10 03 01 0f 84 9c 00 00 00 48 8b 43 10 48 85 c0 74 09 f6 00 01 0f RSP: 0018:ffffbecfc090bab8 EFLAGS: 00010246 RAX: ffff97616346cf30 RBX: 0000000000000000 RCX: 0000000000000101 RDX: 0000000000000000 RSI: ffff97623b6ca828 RDI: ffff97621ef10828 RBP: ffff97621ef10828 R08: ffff97621ef10828 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff97623b6ca838 R13: ffffffffbb3fef50 R14: ffff97623b6ca828 R15: 0000000000000000 FS: 00007f7a5c31d740(0000) GS:ffff97623bb00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000011255a000 CR4: 00000000000006e0 Call Trace: unlink_file_vma+0x3b/0x50 free_pgtables+0xa1/0x110 exit_mmap+0xca/0x1a0 ? mlx5_ib_dealloc_pd+0x28/0x30 [mlx5_ib] mmput+0x54/0x140 uverbs_user_mmap_disassociate+0xcc/0x160 [ib_uverbs] uverbs_destroy_ufile_hw+0xf7/0x120 [ib_uverbs] ib_uverbs_remove_one+0xea/0x240 [ib_uverbs] ib_unregister_device+0xfb/0x200 [ib_core] mlx5_ib_remove+0x51/0xe0 [mlx5_ib] mlx5_remove_device+0xc1/0xd0 [mlx5_core] mlx5_unregister_device+0x3d/0xb0 [mlx5_core] remove_one+0x2a/0x90 [mlx5_core] pci_device_remove+0x3b/0xc0 device_release_driver_internal+0x16d/0x240 unbind_store+0xb2/0x100 kernfs_fop_write+0x102/0x180 __vfs_write+0x36/0x1a0 ? __alloc_fd+0xa9/0x170 ? set_close_on_exec+0x49/0x70 vfs_write+0xad/0x1a0 ksys_write+0x52/0xc0 do_syscall_64+0x5b/0x180 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Cc: # 4.19 Fixes: 5f9794dc94f5 ("RDMA/ucontext: Add a core API for mmaping driver IO memory") Signed-off-by: Yishai Hadas Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/core/uverbs_main.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) commit ff9fb72bc07705c00795ca48631f7fffe24d2c6b Author: Greg Kroah-Hartman Date: Wed Jan 23 11:28:14 2019 +0100 debugfs: return error values, not NULL When an error happens, debugfs should return an error pointer value, not NULL. This will prevent the totally theoretical error where a debugfs call fails due to lack of memory, returning NULL, and that dentry value is then passed to another debugfs call, which would end up succeeding, creating a file at the root of the debugfs tree, but would then be impossible to remove (because you can not remove the directory NULL). So, to make everyone happy, always return errors, this makes the users of debugfs much simpler (they do not have to ever check the return value), and everyone can rest easy. Reported-by: Gary R Hook Reported-by: Heiko Carstens Reported-by: Masami Hiramatsu Reported-by: Michal Hocko Reported-by: Sebastian Andrzej Siewior Reported-by: Ulf Hansson Reviewed-by: Masami Hiramatsu Reviewed-by: Sebastian Andrzej Siewior Signed-off-by: Greg Kroah-Hartman fs/debugfs/inode.c | 39 ++++++++++++++++++++++----------------- 1 file changed, 22 insertions(+), 17 deletions(-) commit 67fc5dc8a541e8f458d7f08bf88ff55933bf9f9d Author: Paul Burton Date: Mon Jan 28 23:16:22 2019 +0000 MIPS: VDSO: Include $(ccflags-vdso) in o32,n32 .lds builds When generating vdso-o32.lds & vdso-n32.lds for use with programs running as compat ABIs under 64b kernels, we previously haven't included the compiler flags that are supposedly common to all ABIs - ie. those in the ccflags-vdso variable. This is problematic in cases where we need to provide the -m%-float flag in order to ensure that we don't attempt to use a floating point ABI that's incompatible with the target CPU & ABI. For example a toolchain using current gcc trunk configured --with-fp-32=xx fails to build a 64r6el_defconfig kernel with the following error: cc1: error: '-march=mips1' requires '-mfp32' make[2]: *** [arch/mips/vdso/Makefile:135: arch/mips/vdso/vdso-o32.lds] Error 1 Include $(ccflags-vdso) for the compat VDSO .lds builds, just as it is included for the native VDSO .lds & when compiling objects for the compat VDSOs. This ensures we consistently provide the -msoft-float flag amongst others, avoiding the problem by ensuring we're agnostic to the toolchain defaults. Signed-off-by: Paul Burton Fixes: ebb5e78cc634 ("MIPS: Initial implementation of a VDSO") Cc: linux-mips@vger.kernel.org Cc: Kevin Hilman Cc: Guenter Roeck Cc: Maciej W . Rozycki Cc: stable@vger.kernel.org # v4.4+ arch/mips/vdso/Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 0648e50e548d881d025b9419a1a168753c8e2bf7 Author: Paul Burton Date: Mon Jan 28 22:21:17 2019 +0000 MIPS: VDSO: Use same -m%-float cflag as the kernel proper The MIPS VDSO build currently doesn't provide the -msoft-float flag to the compiler as the kernel proper does. This results in an attempt to use the compiler's default floating point configuration, which can be problematic in cases where this is incompatible with the target CPU's -march= flag. For example decstation_defconfig fails to build using toolchains in which gcc was configured --with-fp-32=xx with the following error: LDS arch/mips/vdso/vdso.lds cc1: error: '-march=r3000' requires '-mfp32' make[2]: *** [scripts/Makefile.build:379: arch/mips/vdso/vdso.lds] Error 1 The kernel proper avoids this error because we build with the -msoft-float compiler flag, rather than using the compiler's default. Pass this flag through to the VDSO build so that it too becomes agnostic to the toolchain's floating point configuration. Note that this is filtered out from KBUILD_CFLAGS rather than simply always using -msoft-float such that if we switch the kernel to use -mno-float in the future the VDSO will automatically inherit the change. The VDSO doesn't actually include any floating point code, and its .MIPS.abiflags section is already manually generated to specify that it's compatible with any floating point ABI. As such this change should have no effect on the resulting VDSO, apart from fixing the build failure for affected toolchains. Signed-off-by: Paul Burton Reported-by: Kevin Hilman Reported-by: Guenter Roeck Tested-by: Kevin Hilman References: https://lore.kernel.org/linux-mips/1477843551-21813-1-git-send-email-linux@roeck-us.net/ References: https://kernelci.org/build/id/5c4e4ae059b5142a249ad004/logs/ Fixes: ebb5e78cc634 ("MIPS: Initial implementation of a VDSO") Cc: Maciej W. Rozycki Cc: linux-mips@vger.kernel.org Cc: stable@vger.kernel.org # v4.4+ arch/mips/vdso/Makefile | 1 + 1 file changed, 1 insertion(+) commit dcf300a69ac307053dfb35c2e33972e754a98bce Author: Aaro Koskinen Date: Sun Jan 27 23:28:33 2019 +0200 MIPS: OCTEON: don't set octeon_dma_bar_type if PCI is disabled Don't set octeon_dma_bar_type if PCI is disabled. This avoids creation of the MSI irqchip later on, and saves a bit of memory. Signed-off-by: Aaro Koskinen Signed-off-by: Paul Burton Fixes: a214720cbf50 ("Disable MSI also when pcie-octeon.pcie_disable on") Cc: stable@vger.kernel.org # v3.3+ Cc: linux-mips@vger.kernel.org arch/mips/pci/pci-octeon.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit d07e1e0febe10b65eecd3205ad3bd1e999754887 Author: Jesper Dangaard Brouer Date: Tue Jan 29 14:22:33 2019 +0100 MAINTAINERS: Add entry for XDP (eXpress Data Path) Add multiple people as maintainers for XDP, sorted alphabetically. XDP is also tied to driver level support and code, but we cannot add all drivers to the list. Instead K: and N: match on 'xdp' in hope to catch some of those changes in drivers. Signed-off-by: Jesper Dangaard Brouer Acked-by: John Fastabend Acked-by: Jakub Kicinski Acked-by: David S. Miller Acked-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: David S. Miller MAINTAINERS | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) commit 35edfdc77f683c8fd27d7732af06cf6489af60a5 Author: Josh Elsasser Date: Sat Jan 26 14:38:33 2019 -0800 net: set default network namespace in init_dummy_netdev() Assign a default net namespace to netdevs created by init_dummy_netdev(). Fixes a NULL pointer dereference caused by busy-polling a socket bound to an iwlwifi wireless device, which bumps the per-net BUSYPOLLRXPACKETS stat if napi_poll() received packets: BUG: unable to handle kernel NULL pointer dereference at 0000000000000190 IP: napi_busy_loop+0xd6/0x200 Call Trace: sock_poll+0x5e/0x80 do_sys_poll+0x324/0x5a0 SyS_poll+0x6c/0xf0 do_syscall_64+0x6b/0x1f0 entry_SYSCALL_64_after_hwframe+0x3d/0xa2 Fixes: 7db6b048da3b ("net: Commonize busy polling code to focus on napi_id instead of socket") Signed-off-by: Josh Elsasser Signed-off-by: David S. Miller net/core/dev.c | 3 +++ 1 file changed, 3 insertions(+) commit 0f0ed8282e5bfdc87cdd562e58f3d90d893e7ee5 Author: Yang Wei Date: Tue Jan 29 23:04:40 2019 +0800 net: b44: replace dev_kfree_skb_xxx by dev_consume_skb_xxx for drop profiles The skb should be freed by dev_consume_skb_any() in b44_start_xmit() when bounce_skb is used. The skb is be replaced by bounce_skb, so the original skb should be consumed(not drop). dev_consume_skb_irq() should be called in b44_tx() when skb xmit done. It makes drop profiles(dropwatch, perf) more friendly. Signed-off-by: Yang Wei Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/b44.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit e339f8631eb70fb48b2801e9e66a267c9a730a6a Author: Yang Wei Date: Tue Jan 29 23:32:22 2019 +0800 net: caif: call dev_consume_skb_any when skb xmit done The skb shouled be consumed when xmit done, it makes drop profiles (dropwatch, perf) more friendly. dev_kfree_skb_irq()/kfree_skb() shouled be replaced by dev_consume_skb_any(), it makes code cleaner. Signed-off-by: Yang Wei Signed-off-by: David S. Miller drivers/net/caif/caif_serial.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) commit 896cebc0e261a29a6f0b20ab21d1bfc06959e91d Author: Yang Wei Date: Tue Jan 29 22:40:51 2019 +0800 net: 8139cp: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles dev_consume_skb_irq() should be called in cp_tx() when skb xmit done. It makes drop profiles(dropwatch, perf) more friendly. Signed-off-by: Yang Wei Signed-off-by: David S. Miller drivers/net/ethernet/realtek/8139cp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e501070e4db0b67a4c17a5557d1e9d098f3db310 Author: Harini Katakam Date: Tue Jan 29 15:20:03 2019 +0530 net: macb: Apply RXUBR workaround only to versions with errata The interrupt handler contains a workaround for RX hang applicable to Zynq and AT91RM9200 only. Subsequent versions do not need this workaround. This workaround unnecessarily resets RX whenever RX used bit read is observed, which can be often under heavy traffic. There is no other action performed on RX UBR interrupt. Hence introduce a CAPS mask; enable this interrupt and workaround only on affected versions. Signed-off-by: Harini Katakam Signed-off-by: David S. Miller drivers/net/ethernet/cadence/macb.h | 3 +++ drivers/net/ethernet/cadence/macb_main.c | 28 +++++++++++++++++----------- 2 files changed, 20 insertions(+), 11 deletions(-) commit dc30e70391376ba3987aeb856ae6d9c0706534f1 Author: Yizhuo Date: Fri Jan 25 22:32:20 2019 -0800 ARM: OMAP2+: Variable "reg" in function omap4_dsi_mux_pads() could be uninitialized In function omap4_dsi_mux_pads(), local variable "reg" could be uninitialized if function regmap_read() returns -EINVAL. However, it will be used directly in the later context, which is potentially unsafe. Signed-off-by: Yizhuo Signed-off-by: Tony Lindgren arch/arm/mach-omap2/display.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 2f10d823739680d2477ce34437e8a08a53117f40 Author: Gustavo A. R. Silva Date: Fri Jan 25 15:55:33 2019 -0600 drm/amd/powerplay: Fix missing break in switch Add missing break statement in order to prevent the code from falling through to the default case. The resoning for this is that pclk_vol_table is an automatic variable. So, it makes no sense to update it just before falling through to the default case and return -EINVAL. This bug was found thanks to the ongoing efforts to enabling -Wimplicit-fallthrough. Fixes: cd70f3d6e3fa ("drm/amd/powerplay: PP/DAL interface changes for dynamic clock switch") Cc: stable@vger.kernel.org Signed-off-by: Gustavo A. R. Silva Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c | 1 + 1 file changed, 1 insertion(+) commit afeff4c16edaa6275b903f82b0561406259aa3a3 Author: Alex Deucher Date: Tue Jan 15 12:05:16 2019 -0500 drm/radeon: check if device is root before getting pci speed caps Check if the device is root rather before attempting to see what speeds the pcie port supports. Fixes a crash with pci passthrough in a VM. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=109366 Reviewed-by: Evan Quan Signed-off-by: Alex Deucher drivers/gpu/drm/radeon/ci_dpm.c | 5 +++-- drivers/gpu/drm/radeon/si_dpm.c | 5 +++-- 2 files changed, 6 insertions(+), 4 deletions(-) commit dc14eb12f6bb3e779c5461429c1889a339c67aab Author: Alex Deucher Date: Wed Jan 9 22:19:28 2019 -0500 drm/amdgpu: Add missing power attribute to APU check Add missing power_average to visible check for power attributes for APUs. Was missed before. Reviewed-by: Evan Quan Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 072167d13ce46d5fcef1a80a53a667a46c9b17e7 Merge: d0243693fbf6 0840242e8875 Author: Tony Lindgren Date: Tue Jan 29 07:53:47 2019 -0800 Merge branch 'pwm-dmtimer-fixes' into omap-for-v5.0/fixes-v2 commit 2380a22b60ce6f995eac806e69c66e397b59d045 Author: Lubomir Rintel Date: Mon Jan 28 16:59:35 2019 +0100 irqchip/mmp: Only touch the PJ4 IRQ & FIQ bits on enable/disable Resetting bit 4 disables the interrupt delivery to the "secure processor" core. This breaks the keyboard on a OLPC XO 1.75 laptop, where the firmware running on the "secure processor" bit-bangs the PS/2 protocol over the GPIO lines. It is not clear what the rest of the bits are and Marvell was unhelpful when asked for documentation. Aside from the SP bit, there are probably priority bits. Leaving the unknown bits as the firmware set them up seems to be a wiser course of action compared to just turning them off. Signed-off-by: Lubomir Rintel Acked-by: Pavel Machek [maz: fixed-up subject and commit message] Signed-off-by: Marc Zyngier drivers/irqchip/irq-mmp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 45725e0fc3e7fe52fedb94f59806ec50e9618682 Author: Marc Zyngier Date: Tue Jan 29 15:19:23 2019 +0000 irqchip/gic-v3-its: Gracefully fail on LPI exhaustion In the unlikely event that we cannot find any available LPI in the system, we should gracefully return an error instead of carrying on with no LPI allocated at all. Fixes: 38dd7c494cf6 ("irqchip/gic-v3-its: Drop chunk allocation compatibility") Signed-off-by: Marc Zyngier drivers/irqchip/irq-gic-v3-its.c | 3 +++ 1 file changed, 3 insertions(+) commit 9791ec7df0e7b4d80706ccea8f24b6542f6059e9 Author: Marc Zyngier Date: Tue Jan 29 10:02:33 2019 +0000 irqchip/gic-v3-its: Plug allocation race for devices sharing a DevID On systems or VMs where multiple devices share a single DevID (because they sit behind a PCI bridge, or because the HW is broken in funky ways), we reuse the save its_device structure in order to reflect this. It turns out that there is a distinct lack of locking when looking up the its_device, and two device being probed concurrently can result in double allocations. That's obviously not nice. A solution for this is to have a per-ITS mutex that serializes device allocation. A similar issue exists on the freeing side, which can run concurrently with the allocation. On top of now taking the appropriate lock, we also make sure that a shared device is never freed, as we have no way to currently track the life cycle of such object. Reported-by: Zheng Xiang Tested-by: Zheng Xiang Cc: stable@vger.kernel.org Signed-off-by: Marc Zyngier drivers/irqchip/irq-gic-v3-its.c | 32 +++++++++++++++++++++++++++----- 1 file changed, 27 insertions(+), 5 deletions(-) commit 0840242e887586268f665bf58d5e1a7d6ebf35ed Author: Tony Lindgren Date: Tue Jan 22 08:21:01 2019 -0800 ARM: dts: Configure clock parent for pwm vibra Commit 84badc5ec5fc ("ARM: dts: omap4: Move l4 child devices to probe them with ti-sysc") moved some omap4 timers to probe with ti-sysc interconnect target module. Turns out this broke pwm-omap-dmtimer for reparenting of the timer clock. With ti-sysc, we can now configure the clock sources in the dts with assigned-clocks and assigned-clock-parents. Fixes: 84badc5ec5fc ("ARM: dts: omap4: Move l4 child devices to probe them with ti-sysc") Cc: Bartosz Golaszewski Cc: Daniel Lezcano Cc: H. Nikolaus Schaller Cc: Keerthy Cc: Ladislav Michl Cc: Pavel Machek Cc: Sebastian Reichel Cc: Tero Kristo Cc: Thierry Reding Cc: Thomas Gleixner Reported-by: H. Nikolaus Schaller Signed-off-by: Tony Lindgren arch/arm/boot/dts/omap4-droid4-xt894.dts | 11 +++++++++++ 1 file changed, 11 insertions(+) commit 9bd34c63f5536c490c152833c77fa47f59aeade3 Author: Tony Lindgren Date: Tue Jan 22 09:03:08 2019 -0800 bus: ti-sysc: Fix timer handling with drop pm_runtime_irq_safe() Commit 84badc5ec5fc ("ARM: dts: omap4: Move l4 child devices to probe them with ti-sysc") started producing a warning for pwm-omap-dmtimer: WARNING: CPU: 0 PID: 77 at drivers/bus/omap_l3_noc.c:147 l3_interrupt_handler+0x2f8/0x388 44000000.ocp:L3 Custom Error: MASTER MPU TARGET L4PER2 (Idle): Data Access in Supervisor mode during Functional access ... __pm_runtime_idle omap_dm_timer_disable pwm_omap_dmtimer_start pwm_omap_dmtimer_enable pwm_apply_state pwm_vibrator_start pwm_vibrator_play_work This is because the timer that pwm-omap-dmtimer is using is now being probed with ti-sysc interconnect target module instead of omap_device and the ti-sysc quirk for SYSC_QUIRK_LEGACY_IDLE is not fully compatible with what omap_device has been doing. We could fix this by reverting the timer changes and have the timer probe again with omap_device. Or we could add more quirk handling to ti-sysc driver. But as these options don't work nicely as longer term solutions, let's just make timers probe with ti-sysc without any quirks. To do this, all we need to do is remove quirks for timers for ti-sysc, and drop the bogus pm_runtime_irq_safe() flag for timer-ti-dm. We should not use pm_runtime_irq_safe() anyways for drivers as it will take a permanent use count on the parent device blocking the parent devices from idling and has been forcing ti-sysc driver to use a quirk flag. Note that we will move the timer data to DEBUG section later on in clean-up patches. Fixes: 84badc5ec5fc ("ARM: dts: omap4: Move l4 child devices to probe them with ti-sysc") Cc: Andy Shevchenko Cc: Bartosz Golaszewski Cc: Daniel Lezcano Cc: H. Nikolaus Schaller Cc: Keerthy Cc: Ladislav Michl Cc: Pavel Machek Cc: Sebastian Reichel Cc: Tero Kristo Cc: Thierry Reding Cc: Thomas Gleixner Reported-by: H. Nikolaus Schaller Tested-By: Andreas Kemnade Tested-By: H. Nikolaus Schaller Signed-off-by: Tony Lindgren drivers/bus/ti-sysc.c | 4 ++-- drivers/clocksource/timer-ti-dm.c | 1 - 2 files changed, 2 insertions(+), 3 deletions(-) commit 00ae831dfe4474ef6029558f5eb3ef0332d80043 Author: Kan Liang Date: Fri Jan 25 11:59:01 2019 -0800 x86/cpu: Add Atom Tremont (Jacobsville) Add the Atom Tremont model number to the Intel family list. [ Tony: Also update comment at head of file to say "_X" suffix is also used for microserver parts. ] Signed-off-by: Kan Liang Signed-off-by: Qiuxu Zhuo Signed-off-by: Tony Luck Signed-off-by: Borislav Petkov Cc: Andy Shevchenko Cc: Aristeu Rozanski Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: linux-edac Cc: Mauro Carvalho Chehab Cc: Megha Dey Cc: Peter Zijlstra Cc: Qiuxu Zhuo Cc: Rajneesh Bhardwaj Cc: Thomas Gleixner Cc: x86-ml Link: https://lkml.kernel.org/r/20190125195902.17109-4-tony.luck@intel.com arch/x86/include/asm/intel-family.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 693abe11aa6b27aed6eb8222162f8fb986325cef Author: Kailang Yang Date: Tue Jan 29 15:38:21 2019 +0800 ALSA: hda/realtek - Fixed hp_pin no value Fix hp_pin always no value. [More notes on the changes: The hp_pin value that is referred in alc294_hp_init() is always zero at the moment the function gets called, hence this is actually useless as in the current code. And, this kind of init sequence should be called from the codec init callback, instead of the parser function. So, the first fix in this patch to move the call call into its own init_hook. OTOH, this function is needed to be called only once after the boot, and it'd take too long for invoking at each resume (where the init callback gets called). So we add a new flag and invoke this only once as an additional fix. The one case is still not covered, though: S4 resume. But this change itself won't lead to any regression in that regard, so we leave S4 issue as is for now and fix it later. -- tiwai ] Fixes: bde1a7459623 ("ALSA: hda/realtek - Fixed headphone issue for ALC700") Signed-off-by: Kailang Yang Cc: Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 78 +++++++++++++++++++++++++------------------ 1 file changed, 45 insertions(+), 33 deletions(-) commit 3ca17a24e7fb3937417acf7d74773e3dbcf99dc7 Merge: 4aa9fc2a435a 483cbbeddd5f Author: Jens Axboe Date: Tue Jan 29 06:41:44 2019 -0700 Merge branch 'md-fixes' of https://github.com/liu-song-6/linux into for-linus Pull MD fix from Song. * 'md-fixes' of https://github.com/liu-song-6/linux: md/raid5: fix 'out of memory' during raid cache recovery commit 05f9467e70ed7c9cd19fd3d42346941cdc03eef3 Author: Christoph Hellwig Date: Sat Jan 5 09:01:08 2019 +0100 drm/vmwgfx: unwind spaghetti code in vmw_dma_select_mode Just use a simple if/else chain to select the DMA mode. Signed-off-by: Christoph Hellwig Reviewed-by: Thomas Hellstrom Signed-off-by: Thomas Hellstrom drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 25 ++++++------------------- 1 file changed, 6 insertions(+), 19 deletions(-) commit 2b3cd6249b14e25da14f13cd520eb336230a4422 Author: Christoph Hellwig Date: Sat Jan 5 09:01:07 2019 +0100 drm/vmwgfx: fix the check when to use dma_alloc_coherent Since Linux 4.21 we merged the swiotlb ops into the DMA direct ops, so they would always have a the sync_single methods. But late in the cicle we also removed the direct ops entirely, so we'd see NULL DMA ops. Switch vmw_dma_select_mode to only detect swiotlb presence using swiotlb_nr_tbl() instead. Fixes: 55897af630 ("dma-direct: merge swiotlb_dma_ops into the dma_direct code") Fixes: 356da6d0cd ("dma-mapping: bypass indirect calls for dma-direct") Signed-off-by: Christoph Hellwig Reviewed-by: Thomas Hellstrom Signed-off-by: Thomas Hellstrom drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) commit 9b5bf2421b43ef85568f9b875d6387a114e92efe Author: Christoph Hellwig Date: Sat Jan 5 09:01:06 2019 +0100 drm/vmwgfx: remove CONFIG_INTEL_IOMMU ifdefs v2 intel_iommu_enabled is defined as always false for !CONFIG_INTEL_IOMMU, so remove the ifdefs around it. Signed-off-by: Christoph Hellwig Reviewed-by: Thomas Hellstrom Signed-off-by: Thomas Hellstrom drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 21 ++++----------------- 1 file changed, 4 insertions(+), 17 deletions(-) commit 3f47d00bc65ba11b3e5753d733a74ca4f7af3240 Author: Christoph Hellwig Date: Sat Jan 5 09:01:05 2019 +0100 drm/vmwgfx: remove CONFIG_X86 ifdefs The driver depends on CONFIG_X86 so these are dead code. Signed-off-by: Christoph Hellwig Reviewed-by: Thomas Hellstrom Signed-off-by: Thomas Hellstrom drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 6 ------ 1 file changed, 6 deletions(-) commit 13054abbaa4f1fd4e6f3b4b63439ec033b4c8035 Author: Vladis Dronov Date: Tue Jan 29 11:58:35 2019 +0100 HID: debug: fix the ring buffer implementation Ring buffer implementation in hid_debug_event() and hid_debug_events_read() is strange allowing lost or corrupted data. After commit 717adfdaf147 ("HID: debug: check length before copy_to_user()") it is possible to enter an infinite loop in hid_debug_events_read() by providing 0 as count, this locks up a system. Fix this by rewriting the ring buffer implementation with kfifo and simplify the code. This fixes CVE-2019-3819. v2: fix an execution logic and add a comment v3: use __set_current_state() instead of set_current_state() Link: https://bugzilla.redhat.com/show_bug.cgi?id=1669187 Cc: stable@vger.kernel.org # v4.18+ Fixes: cd667ce24796 ("HID: use debugfs for events/reports dumping") Fixes: 717adfdaf147 ("HID: debug: check length before copy_to_user()") Signed-off-by: Vladis Dronov Reviewed-by: Oleg Nesterov Signed-off-by: Benjamin Tissoires drivers/hid/hid-debug.c | 120 ++++++++++++++++++---------------------------- include/linux/hid-debug.h | 9 ++-- 2 files changed, 51 insertions(+), 78 deletions(-) commit 0ee4b5f801b73b83a9fb3921d725f2162fd4a2e5 Author: Sinan Kaya Date: Thu Jan 24 19:31:01 2019 +0000 platform/x86: Fix unmet dependency warning for SAMSUNG_Q10 Add BACKLIGHT_LCD_SUPPORT for SAMSUNG_Q10 to fix the warning: unmet direct dependencies detected for BACKLIGHT_CLASS_DEVICE. SAMSUNG_Q10 selects BACKLIGHT_CLASS_DEVICE but BACKLIGHT_CLASS_DEVICE depends on BACKLIGHT_LCD_SUPPORT. Copy BACKLIGHT_LCD_SUPPORT dependency into SAMSUNG_Q10 to fix: WARNING: unmet direct dependencies detected for BACKLIGHT_CLASS_DEVICE Depends on [n]: HAS_IOMEM [=y] && BACKLIGHT_LCD_SUPPORT [=n] Selected by [y]: - SAMSUNG_Q10 [=y] && X86 [=y] && X86_PLATFORM_DEVICES [=y] && ACPI [=y] Signed-off-by: Sinan Kaya Acked-by: Andy Shevchenko Signed-off-by: Rafael J. Wysocki drivers/platform/x86/Kconfig | 1 + 1 file changed, 1 insertion(+) commit d58bf90a32a33becec78c3034e781735049fcd25 Author: Sinan Kaya Date: Thu Jan 24 19:31:00 2019 +0000 platform/x86: Fix unmet dependency warning for ACPI_CMPC Add BACKLIGHT_LCD_SUPPORT for ACPI_CMPC to fix the warning: unmet direct dependencies detected for BACKLIGHT_CLASS_DEVICE. ACPI_CMPC selects BACKLIGHT_CLASS_DEVICE but BACKLIGHT_CLASS_DEVICE depends on BACKLIGHT_LCD_SUPPORT. Copy BACKLIGHT_LCD_SUPPORT dependency into ACPI_CMPC to fix WARNING: unmet direct dependencies detected for BACKLIGHT_CLASS_DEVICE Depends on [n]: HAS_IOMEM [=y] && BACKLIGHT_LCD_SUPPORT [=n] Selected by [y]: - ACPI_CMPC [=y] && X86 [=y] && X86_PLATFORM_DEVICES [=y] && ACPI [=y] && INPUT [=y] && (RFKILL [=n] || RFKILL [=n]=n) Signed-off-by: Sinan Kaya Acked-by: Andy Shevchenko Signed-off-by: Rafael J. Wysocki drivers/platform/x86/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 9baddb61dfec0215da5d10a1d173790443e276c2 Author: Sinan Kaya Date: Mon Jan 21 23:19:57 2019 +0000 mfd: Fix unmet dependency warning for MFD_TPS68470 After commit 5d32a66541c4 ("PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set") dependencies on CONFIG_PCI that previously were satisfied implicitly through dependencies on CONFIG_ACPI have to be specified directly. WARNING: unmet direct dependencies detected for I2C_DESIGNWARE_PLATFORM Depends on [n]: I2C [=y] && HAS_IOMEM [=y] && (ACPI [=y] && COMMON_CLK [=n] || !ACPI [=y]) Selected by [y]: - MFD_TPS68470 [=y] && HAS_IOMEM [=y] && ACPI [=y] && I2C [=y]=y MFD_TPS68470 is an ACPI only device and selects I2C_DESIGNWARE_PLATFORM. I2C_DESIGNWARE_PLATFORM does not have any configuration today for ACPI support without CONFIG_PCI set. For sake of a quick fix this introduces a new mandatory dependency to the driver which may survive without it. Otherwise we need to revisit the driver architecture to address this properly. Fixes: 5d32a66541c46 ("PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set") Signed-off-by: Sinan Kaya Acked-by: Lee Jones Signed-off-by: Rafael J. Wysocki drivers/mfd/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b3379a424dde97755ad7a6f4405648a9ea13d6e3 Author: Yang Wei Date: Tue Jan 29 07:40:10 2019 +0800 net: ti: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles dev_consume_skb_irq() should be called in cpmac_end_xmit() when xmit done. It makes drop profiles more friendly. Signed-off-by: Yang Wei Signed-off-by: David S. Miller drivers/net/ethernet/ti/cpmac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 100091156c1a4da11c0764265b9e328d7858f2bb Author: Yang Wei Date: Tue Jan 29 07:39:13 2019 +0800 net: apple: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles dev_consume_skb_irq() should be called in bmac_txdma_intr() when xmit done. It makes drop profiles more friendly. Signed-off-by: Yang Wei Signed-off-by: David S. Miller drivers/net/ethernet/apple/bmac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3afa73dd7c8b586d9d01a96063d537e1550d1287 Author: Yang Wei Date: Sun Jan 27 23:58:25 2019 +0800 net: amd8111e: replace dev_kfree_skb_irq by dev_consume_skb_irq dev_consume_skb_irq() should be called in amd8111e_tx() when xmit done. It makes drop profiles more friendly. Signed-off-by: Yang Wei Signed-off-by: David S. Miller drivers/net/ethernet/amd/amd8111e.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f48af114895b2f9cdc218ed75666ade83380255b Author: Yang Wei Date: Sun Jan 27 23:56:34 2019 +0800 net: alteon: replace dev_kfree_skb_irq by dev_consume_skb_irq dev_consume_skb_irq() should be called in ace_tx_int() when xmit done. It makes drop profiles more friendly. Signed-off-by: Yang Wei Signed-off-by: David S. Miller drivers/net/ethernet/alteon/acenic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1023121375c6b0b3dc00334983c762ba2b76cb19 Author: Dave Watson Date: Sun Jan 27 00:59:03 2019 +0000 net: tls: Fix deadlock in free_resources tx If there are outstanding async tx requests (when crypto returns EINPROGRESS), there is a potential deadlock: the tx work acquires the lock, while we cancel_delayed_work_sync() while holding the lock. Drop the lock while waiting for the work to complete. Fixes: a42055e8d2c30 ("Add support for async encryption of records...") Signed-off-by: Dave Watson Signed-off-by: David S. Miller net/tls/tls_sw.c | 2 ++ 1 file changed, 2 insertions(+) commit 32eb67b93c9e3cd62cb423e30b090cdd4aa8d275 Author: Dave Watson Date: Sun Jan 27 00:57:38 2019 +0000 net: tls: Save iv in tls_rec for async crypto requests aead_request_set_crypt takes an iv pointer, and we change the iv soon after setting it. Some async crypto algorithms don't save the iv, so we need to save it in the tls_rec for async requests. Found by hardcoding x64 aesni to use async crypto manager (to test the async codepath), however I don't think this combination can happen in the wild. Presumably other hardware offloads will need this fix, but there have been no user reports. Fixes: a42055e8d2c30 ("Add support for async encryption of records...") Signed-off-by: Dave Watson Signed-off-by: David S. Miller include/net/tls.h | 2 ++ net/tls/tls_sw.c | 4 +++- 2 files changed, 5 insertions(+), 1 deletion(-) commit b46a0bf78ad7b150ef5910da83859f7f5a514ffd Author: Jason Wang Date: Mon Jan 28 15:05:05 2019 +0800 vhost: fix OOB in get_rx_bufs() After batched used ring updating was introduced in commit e2b3b35eb989 ("vhost_net: batch used ring update in rx"). We tend to batch heads in vq->heads for more than one packet. But the quota passed to get_rx_bufs() was not correctly limited, which can result a OOB write in vq->heads. headcount = get_rx_bufs(vq, vq->heads + nvq->done_idx, vhost_len, &in, vq_log, &log, likely(mergeable) ? UIO_MAXIOV : 1); UIO_MAXIOV was still used which is wrong since we could have batched used in vq->heads, this will cause OOB if the next buffer needs more than 960 (1024 (UIO_MAXIOV) - 64 (VHOST_NET_BATCH)) heads after we've batched 64 (VHOST_NET_BATCH) heads: Acked-by: Stefan Hajnoczi ============================================================================= BUG kmalloc-8k (Tainted: G B ): Redzone overwritten ----------------------------------------------------------------------------- INFO: 0x00000000fd93b7a2-0x00000000f0713384. First byte 0xa9 instead of 0xcc INFO: Allocated in alloc_pd+0x22/0x60 age=3933677 cpu=2 pid=2674 kmem_cache_alloc_trace+0xbb/0x140 alloc_pd+0x22/0x60 gen8_ppgtt_create+0x11d/0x5f0 i915_ppgtt_create+0x16/0x80 i915_gem_create_context+0x248/0x390 i915_gem_context_create_ioctl+0x4b/0xe0 drm_ioctl_kernel+0xa5/0xf0 drm_ioctl+0x2ed/0x3a0 do_vfs_ioctl+0x9f/0x620 ksys_ioctl+0x6b/0x80 __x64_sys_ioctl+0x11/0x20 do_syscall_64+0x43/0xf0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 INFO: Slab 0x00000000d13e87af objects=3 used=3 fp=0x (null) flags=0x200000000010201 INFO: Object 0x0000000003278802 @offset=17064 fp=0x00000000e2e6652b Fixing this by allocating UIO_MAXIOV + VHOST_NET_BATCH iovs for vhost-net. This is done through set the limitation through vhost_dev_init(), then set_owner can allocate the number of iov in a per device manner. This fixes CVE-2018-16880. Fixes: e2b3b35eb989 ("vhost_net: batch used ring update in rx") Signed-off-by: Jason Wang Signed-off-by: David S. Miller drivers/vhost/net.c | 3 ++- drivers/vhost/scsi.c | 2 +- drivers/vhost/vhost.c | 7 ++++--- drivers/vhost/vhost.h | 4 +++- drivers/vhost/vsock.c | 2 +- 5 files changed, 11 insertions(+), 7 deletions(-) commit 8437fcf14deed67e5ad90b5e8abf62fb20f30881 Author: Dan Carpenter Date: Thu Jan 24 13:33:27 2019 +0300 scsi: 53c700: pass correct "dev" to dma_alloc_attrs() The "hostdata->dev" pointer is NULL here. We set "hostdata->dev = dev;" later in the function and we also use "hostdata->dev" when we call dma_free_attrs() in NCR_700_release(). This bug predates git version control. Signed-off-by: Dan Carpenter Signed-off-by: Martin K. Petersen drivers/scsi/53c700.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b2d3492fc591b1fb46b81d79ca1fc44cac6ae0ae Author: Dan Carpenter Date: Thu Jan 24 13:29:40 2019 +0300 scsi: bnx2fc: Fix error handling in probe() There are two issues here. First if cmgr->hba is not set early enough then it leads to a NULL dereference. Second if we don't completely initialize cmgr->io_bdt_pool[] then we end up dereferencing uninitialized pointers. Fixes: 853e2bd2103a ("[SCSI] bnx2fc: Broadcom FCoE offload driver") Signed-off-by: Dan Carpenter Signed-off-by: Martin K. Petersen drivers/scsi/bnx2fc/bnx2fc_io.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 40d07b523cf434f252b134c86b1f8f2d907ffb0b Author: Douglas Gilbert Date: Fri Jan 25 12:46:09 2019 -0500 scsi: scsi_debug: fix write_same with virtual_gb problem The WRITE SAME(10) and (16) implementations didn't take account of the buffer wrap required when the virtual_gb parameter is greater than 0. Fix that and rename the fake_store() function to lba2fake_store() to lessen confusion with the global fake_storep pointer. Bump version date. Signed-off-by: Douglas Gilbert Reported-by: Bart Van Assche Tested by: Bart Van Assche Signed-off-by: Martin K. Petersen drivers/scsi/scsi_debug.c | 41 +++++++++++++++++++++-------------------- 1 file changed, 21 insertions(+), 20 deletions(-) commit 5d8fc4a9f0eec20b6c07895022a6bea3fb6dfb38 Author: Ming Lu Date: Thu Jan 24 13:25:42 2019 +0800 scsi: libfc: free skb when receiving invalid flogi resp The issue to be fixed in this commit is when libfc found it received a invalid FLOGI response from FC switch, it would return without freeing the fc frame, which is just the skb data. This would cause memory leak if FC switch keeps sending invalid FLOGI responses. This fix is just to make it execute `fc_frame_free(fp)` before returning from function `fc_lport_flogi_resp`. Signed-off-by: Ming Lu Reviewed-by: Hannes Reinecke Signed-off-by: Martin K. Petersen drivers/scsi/libfc/fc_lport.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit b63195698dea6ea83eeede20e38dbc6ad67076b6 Author: Steffen Maier Date: Thu Jan 24 17:40:34 2019 +0100 scsi: zfcp: fix sysfs block queue limit output for max_segment_size Since v2.6.35 commit 683229845f17 ("[SCSI] zfcp: Report scatter-gather limits to SCSI and block layer"), zfcp set dma_parms.max_segment_size == PAGE_SIZE (but without using the setter dma_set_max_seg_size()) and scsi_host_template.dma_boundary == PAGE_SIZE - 1. v5.0-rc1 commit 50c2e9107f17 ("scsi: introduce a max_segment_size host_template parameters") introduced a new field scsi_host_template.max_segment_size. If an LLDD such as zfcp does not set it, scsi_host_alloc() uses BLK_MAX_SEGMENT_SIZE = 65536 for Scsi_Host.max_segment_size. __scsi_init_queue() announced the minimum of Scsi_Host.max_segment_size and dma_parms.max_segment_size to the block layer. For zfcp: min(65536, 4096) == 4096 which was still good. v5.0 commit a8cf59a6692c ("scsi: communicate max segment size to the DMA mapping code") announces Scsi_Host.max_segment_size to the block layer and overwrites dma_parms.max_segment_size with Scsi_Host.max_segment_size. For zfcp dma_parms.max_segment_size == Scsi_Host.max_segment_size == 65536 which is also reflected in block queue limits. $ cd /sys/bus/ccw/drivers/zfcp $ cd 0.0.3c40/host5/rport-5:0-4/target5:0:4/5:0:4:10/block/sdi/queue $ cat max_segment_size 65536 Zfcp I/O still works because dma_boundary implicitly still keeps the effective max segment size <= PAGE_SIZE. However, dma_boundary does not seem visible to user space, but max_segment_size is visible and shows a misleading wrong value. Fix it and inherit the stable tag of a8cf59a6692c. Devices on our bus ccw support DMA but no DMA mapping. Of multiple device types on the ccw bus, only zfcp needs dma_parms for SCSI limits. So, leave dma_parms setup in zfcp and do not move it to the bus. Signed-off-by: Steffen Maier Fixes: 50c2e9107f ("scsi: introduce a max_segment_size host_template parameters") Signed-off-by: Martin K. Petersen drivers/s390/scsi/zfcp_aux.c | 1 - drivers/s390/scsi/zfcp_scsi.c | 2 ++ 2 files changed, 2 insertions(+), 1 deletion(-) commit 2fa53f8924223e81cd85e19f0c2caf110f086752 Author: Daniel Borkmann Date: Mon Jan 28 23:55:26 2019 +0100 bpf, doc: add reviewers to maintainers entry In order to better scale BPF development on netdev, we've adopted a reviewer rotation for all BPF patches among the five of us for some time now. Lets give credit where credit is due, and add Martin, Song and Yonghong as official BPF reviewers to MAINTAINERS file. Also while at it, add regex matching for BPF such that we get properly Cc'ed for files not listed here. Signed-off-by: Daniel Borkmann Acked-by: Martin KaFai Lau Acked-by: Yonghong Song Acked-by: Song Liu Signed-off-by: Alexei Starovoitov MAINTAINERS | 5 +++++ 1 file changed, 5 insertions(+) commit 1d79895aef18fa05789995d86d523c9b2ee58a02 Author: Jakub Sitnicki Date: Mon Jan 28 10:13:35 2019 +0100 sk_msg: Always cancel strp work before freeing the psock Despite having stopped the parser, we still need to deinitialize it by calling strp_done so that it cancels its work. Otherwise the worker thread can run after we have freed the parser, and attempt to access its workqueue resulting in a use-after-free: ================================================================== BUG: KASAN: use-after-free in pwq_activate_delayed_work+0x1b/0x1d0 Read of size 8 at addr ffff888069975240 by task kworker/u2:2/93 CPU: 0 PID: 93 Comm: kworker/u2:2 Not tainted 5.0.0-rc2-00335-g28f9d1a3d4fe-dirty #14 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-2.fc27 04/01/2014 Workqueue: (null) (kstrp) Call Trace: print_address_description+0x6e/0x2b0 ? pwq_activate_delayed_work+0x1b/0x1d0 kasan_report+0xfd/0x177 ? pwq_activate_delayed_work+0x1b/0x1d0 ? pwq_activate_delayed_work+0x1b/0x1d0 pwq_activate_delayed_work+0x1b/0x1d0 ? process_one_work+0x4aa/0x660 pwq_dec_nr_in_flight+0x9b/0x100 worker_thread+0x82/0x680 ? process_one_work+0x660/0x660 kthread+0x1b9/0x1e0 ? __kthread_create_on_node+0x250/0x250 ret_from_fork+0x1f/0x30 Allocated by task 111: sk_psock_init+0x3c/0x1b0 sock_map_link.isra.2+0x103/0x4b0 sock_map_update_common+0x94/0x270 sock_map_update_elem+0x145/0x160 __se_sys_bpf+0x152e/0x1e10 do_syscall_64+0xb2/0x3e0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Freed by task 112: kfree+0x7f/0x140 process_one_work+0x40b/0x660 worker_thread+0x82/0x680 kthread+0x1b9/0x1e0 ret_from_fork+0x1f/0x30 The buggy address belongs to the object at ffff888069975180 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 192 bytes inside of 512-byte region [ffff888069975180, ffff888069975380) The buggy address belongs to the page: page:ffffea0001a65d00 count:1 mapcount:0 mapping:ffff88806d401280 index:0x0 compound_mapcount: 0 flags: 0x4000000000010200(slab|head) raw: 4000000000010200 dead000000000100 dead000000000200 ffff88806d401280 raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888069975100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888069975180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888069975200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888069975280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888069975300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Reported-by: Marek Majkowski Signed-off-by: Jakub Sitnicki Link: https://lore.kernel.org/netdev/CAJPywTLwgXNEZ2dZVoa=udiZmtrWJ0q5SuBW64aYs0Y1khXX3A@mail.gmail.com Acked-by: Song Liu Signed-off-by: Daniel Borkmann net/core/skmsg.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 8c79b35693380d856dcbbc21629682a90f26ca62 Author: Jakub Kicinski Date: Mon Jan 28 10:01:21 2019 -0800 tools: bpftool: fix crash with un-owned prog arrays Prog arrays don't have 'owner_prog_type' and 'owner_jited' fields in their fdinfo when they are created. Those fields are set and reported when first program is checked for compatibility by bpf_prog_array_compatible(). This means that bpftool cannot expect the fields to always be there. Currently trying to show maps on a system with an un-owned prog array leads to a crash: $ bpftool map show 389: prog_array name tail_call_map flags 0x0 Error: key 'owner_prog_type' not found in fdinfo Error: key 'owner_jited' not found in fdinfo key 4B value 4B max_entries 4 memlock 4096B Segmentation fault (core dumped) We pass a NULL pointer to atoi(). Remove the assumption that fdinfo keys are always present. Add missing validations and remove the p_err() calls which may lead to broken JSON output as caller will not propagate the failure. Fixes: 99a44bef5870 ("tools: bpftool: add owner_prog_type and owner_jited to bpftool output") Signed-off-by: Jakub Kicinski Reviewed-by: Quentin Monnet Acked-by: Song Liu Signed-off-by: Daniel Borkmann tools/bpf/bpftool/common.c | 6 +----- tools/bpf/bpftool/map.c | 17 ++++++++--------- 2 files changed, 9 insertions(+), 14 deletions(-) commit 8d2df8a2d0fa59d1214841202d8e9176057c42ae Author: Souptick Joarder Date: Mon Jan 7 23:07:19 2019 +0530 arch/arm/xen: Remove duplicate header Remove duplicate header which is included twice. Signed-off-by: Souptick Joarder Reviewed-by: Oleksandr Andrushchenko Acked-by: Stefano Stabellini Signed-off-by: Boris Ostrovsky arch/arm/xen/mm.c | 1 - 1 file changed, 1 deletion(-) commit 483cbbeddd5fe2c80fd4141ff0748fa06c4ff146 Author: Alexei Naberezhnov Date: Tue Mar 27 16:54:16 2018 -0700 md/raid5: fix 'out of memory' during raid cache recovery This fixes the case when md array assembly fails because of raid cache recovery unable to allocate a stripe, despite attempts to replay stripes and increase cache size. This happens because stripes released by r5c_recovery_replay_stripes and raid5_set_cache_size don't become available for allocation immediately. Released stripes first are placed on conf->released_stripes list and require md thread to merge them on conf->inactive_list before they can be allocated. Patch allows final allocation attempt during cache recovery to wait for new stripes to become availabe for allocation. Cc: linux-raid@vger.kernel.org Cc: Shaohua Li Cc: linux-stable # 4.10+ Fixes: b4c625c67362 ("md/r5cache: r5cache recovery: part 1") Signed-off-by: Alexei Naberezhnov Signed-off-by: Song Liu drivers/md/raid5-cache.c | 33 ++++++++++++++++++++++----------- drivers/md/raid5.c | 8 ++++++-- 2 files changed, 28 insertions(+), 13 deletions(-) commit 94803aef3533676194c772383472636c453e3147 Author: Paweł Chmiel Date: Mon Jan 28 11:13:34 2019 -0800 Input: pwm-vibra - stop regulator after disabling pwm, not before This patch fixes order of disable calls in pwm_vibrator_stop. Currently when starting device, we first enable vcc regulator and then setup and enable pwm. When stopping, we should do this in oposite order, so first disable pwm and then disable regulator. Previously order was the same as in start. Signed-off-by: Paweł Chmiel Signed-off-by: Dmitry Torokhov drivers/input/misc/pwm-vibra.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 3ca232df9921f083c3b37ba5fbc76f4d9046268b Author: Jonathan Bakker Date: Mon Jan 28 11:13:01 2019 -0800 Input: pwm-vibra - prevent unbalanced regulator pwm_vibrator_stop disables the regulator, but it can be called from multiple places, even when the regulator is already disabled. Fix this by using regulator_is_enabled check when starting and stopping device. Signed-off-by: Jonathan Bakker Signed-off-by: Paweł Chmiel Signed-off-by: Dmitry Torokhov drivers/input/misc/pwm-vibra.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) commit 4d741f3dd11c2a8a11536d568f14ab0321169f3d Author: Stefan Agner Date: Mon Jan 28 10:24:29 2019 -0800 Input: snvs_pwrkey - allow selecting driver for i.MX 7D The i.MX SNVS Power Key driver supports the i.MX 7D SoC family too. Allow to enable the i.MX SNVS Power Key driver even if only i.MX 7D SoC is selected. Signed-off-by: Stefan Agner Signed-off-by: Dmitry Torokhov drivers/input/keyboard/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bfe2599dd2f958de54ccfb11b209797e737a99b5 Merge: ca899324305d ffb057f98928 Author: David S. Miller Date: Mon Jan 28 11:13:35 2019 -0800 Merge branch 'qed-Bug-fixes' Manish Chopra says: ==================== qed: Bug fixes This series have SR-IOV and some general fixes. Please consider applying it to "net" ==================== Signed-off-by: David S. Miller commit ffb057f98928aa099b08e419bbe5afc26ec9f448 Author: Manish Chopra Date: Mon Jan 28 10:05:08 2019 -0800 qed: Fix stack out of bounds bug KASAN reported following bug in qed_init_qm_get_idx_from_flags due to inappropriate casting of "pq_flags". Fix the type of "pq_flags". [ 196.624707] BUG: KASAN: stack-out-of-bounds in qed_init_qm_get_idx_from_flags+0x1a4/0x1b8 [qed] [ 196.624712] Read of size 8 at addr ffff809b00bc7360 by task kworker/0:9/1712 [ 196.624714] [ 196.624720] CPU: 0 PID: 1712 Comm: kworker/0:9 Not tainted 4.18.0-60.el8.aarch64+debug #1 [ 196.624723] Hardware name: To be filled by O.E.M. Saber/Saber, BIOS 0ACKL024 09/26/2018 [ 196.624733] Workqueue: events work_for_cpu_fn [ 196.624738] Call trace: [ 196.624742] dump_backtrace+0x0/0x2f8 [ 196.624745] show_stack+0x24/0x30 [ 196.624749] dump_stack+0xe0/0x11c [ 196.624755] print_address_description+0x68/0x260 [ 196.624759] kasan_report+0x178/0x340 [ 196.624762] __asan_report_load_n_noabort+0x38/0x48 [ 196.624786] qed_init_qm_get_idx_from_flags+0x1a4/0x1b8 [qed] [ 196.624808] qed_init_qm_info+0xec0/0x2200 [qed] [ 196.624830] qed_resc_alloc+0x284/0x7e8 [qed] [ 196.624853] qed_slowpath_start+0x6cc/0x1ae8 [qed] [ 196.624864] __qede_probe.isra.10+0x1cc/0x12c0 [qede] [ 196.624874] qede_probe+0x78/0xf0 [qede] [ 196.624879] local_pci_probe+0xc4/0x180 [ 196.624882] work_for_cpu_fn+0x54/0x98 [ 196.624885] process_one_work+0x758/0x1900 [ 196.624888] worker_thread+0x4e0/0xd18 [ 196.624892] kthread+0x2c8/0x350 [ 196.624897] ret_from_fork+0x10/0x18 [ 196.624899] [ 196.624902] Allocated by task 2: [ 196.624906] kasan_kmalloc.part.1+0x40/0x108 [ 196.624909] kasan_kmalloc+0xb4/0xc8 [ 196.624913] kasan_slab_alloc+0x14/0x20 [ 196.624916] kmem_cache_alloc_node+0x1dc/0x480 [ 196.624921] copy_process.isra.1.part.2+0x1d8/0x4a98 [ 196.624924] _do_fork+0x150/0xfa0 [ 196.624926] kernel_thread+0x48/0x58 [ 196.624930] kthreadd+0x3a4/0x5a0 [ 196.624932] ret_from_fork+0x10/0x18 [ 196.624934] [ 196.624937] Freed by task 0: [ 196.624938] (stack is not available) [ 196.624940] [ 196.624943] The buggy address belongs to the object at ffff809b00bc0000 [ 196.624943] which belongs to the cache thread_stack of size 32768 [ 196.624946] The buggy address is located 29536 bytes inside of [ 196.624946] 32768-byte region [ffff809b00bc0000, ffff809b00bc8000) [ 196.624948] The buggy address belongs to the page: [ 196.624952] page:ffff7fe026c02e00 count:1 mapcount:0 mapping:ffff809b4001c000 index:0x0 compound_mapcount: 0 [ 196.624960] flags: 0xfffff8000008100(slab|head) [ 196.624967] raw: 0fffff8000008100 dead000000000100 dead000000000200 ffff809b4001c000 [ 196.624970] raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000 [ 196.624973] page dumped because: kasan: bad access detected [ 196.624974] [ 196.624976] Memory state around the buggy address: [ 196.624980] ffff809b00bc7200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 196.624983] ffff809b00bc7280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 196.624985] >ffff809b00bc7300: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 f2 f2 f2 [ 196.624988] ^ [ 196.624990] ffff809b00bc7380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 196.624993] ffff809b00bc7400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 196.624995] ================================================================== Signed-off-by: Manish Chopra Signed-off-by: Ariel Elior Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_dev.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 7c81626a3c37e4ac320b8ad785694ba498f24794 Author: Manish Chopra Date: Mon Jan 28 10:05:07 2019 -0800 qed: Fix system crash in ll2 xmit Cache number of fragments in the skb locally as in case of linear skb (with zero fragments), tx completion (or freeing of skb) may happen before driver tries to get number of frgaments from the skb which could lead to stale access to an already freed skb. Signed-off-by: Manish Chopra Signed-off-by: Ariel Elior Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_ll2.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) commit 327852ec64205bb651be391a069784872098a3b2 Author: Manish Chopra Date: Mon Jan 28 10:05:06 2019 -0800 qed: Fix VF probe failure while FLR VFs may hit VF-PF channel timeout while probing, as in some cases it was observed that VF FLR and VF "acquire" message transaction (i.e first message from VF to PF in VF's probe flow) could occur simultaneously which could lead VF to fail sending "acquire" message to PF as VF is marked disabled from HW perspective due to FLR, which will result into channel timeout and VF probe failure. In such cases, try retrying VF "acquire" message so that in later attempts it could be successful to pass message to PF after the VF FLR is completed and can be probed successfully. Signed-off-by: Manish Chopra Signed-off-by: Ariel Elior Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_vf.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit ff9296966e5e00b0d0d00477b2365a178f0f06a3 Author: Manish Chopra Date: Mon Jan 28 10:05:05 2019 -0800 qed: Fix LACP pdu drops for VFs VF is always configured to drop control frames (with reserved mac addresses) but to work LACP on the VFs, it would require LACP control frames to be forwarded or transmitted successfully. This patch fixes this in such a way that trusted VFs (marked through ndo_set_vf_trust) would be allowed to pass the control frames such as LACP pdus. Signed-off-by: Manish Chopra Signed-off-by: Ariel Elior Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_l2.c | 5 +++++ drivers/net/ethernet/qlogic/qed/qed_l2.h | 3 +++ drivers/net/ethernet/qlogic/qed/qed_sriov.c | 10 ++++++++-- 3 files changed, 16 insertions(+), 2 deletions(-) commit 9e71a15d8b5bbce25c637f7f8833cd3f45b65646 Author: Manish Chopra Date: Mon Jan 28 10:05:04 2019 -0800 qed: Fix bug in tx promiscuous mode settings When running tx switched traffic between VNICs created via a bridge(to which VFs are added), adapter drops the unicast packets in tx flow due to VNIC's ucast mac being unknown to it. But VF interfaces being in promiscuous mode should have caused adapter to accept all the unknown ucast packets. Later, it was found that driver doesn't really configure tx promiscuous mode settings to accept all unknown unicast macs. This patch fixes tx promiscuous mode settings to accept all unknown/unmatched unicast macs and works out the scenario. Signed-off-by: Manish Chopra Signed-off-by: Ariel Elior Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_l2.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit ca899324305d953c19abb583b96f0dd81274b0b2 Author: Yang Wei Date: Mon Jan 28 22:42:25 2019 +0800 net: i825xx: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles dev_consume_skb_irq() should be called in i596_interrupt() when skb xmit done. It makes drop profiles(dropwatch, perf) more friendly. Signed-off-by: Yang Wei Signed-off-by: David S. Miller drivers/net/ethernet/i825xx/82596.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ff44a8373c882221c1ff30b87c42fba4f6938119 Merge: 6fb6e6371f8c 206b8cc514d7 Author: David S. Miller Date: Mon Jan 28 10:51:51 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter/IPVS fixes for net The following patchset contains Netfilter/IPVS fixes for your net tree: 1) The nftnl mutex is now per-netns, therefore use reference counter for matches and targets to deal with concurrent updates from netns. Moreover, place extensions in a pernet list. Patches from Florian Westphal. 2) Bail out with EINVAL in case of negative timeouts via setsockopt() through ip_vs_set_timeout(), from ZhangXiaoxu. 3) Spurious EINVAL on ebtables 32bit binary with 64bit kernel, also from Florian. 4) Reset TCP option header parser in case of fingerprint mismatch, otherwise follow up overlapping fingerprint definitions including TCP options do not work, from Fernando Fernandez Mancera. 5) Compilation warning in ipt_CLUSTER with CONFIG_PROC_FS unset. From Anders Roxell. ==================== Signed-off-by: David S. Miller commit 4aa9fc2a435abe95a1e8d7f8c7b3d6356514b37a Author: Michal Hocko Date: Fri Jan 25 19:08:58 2019 +0100 Revert "mm, memory_hotplug: initialize struct pages for the full memory section" This reverts commit 2830bf6f05fb3e05bc4743274b806c821807a684. The underlying assumption that one sparse section belongs into a single numa node doesn't hold really. Robert Shteynfeld has reported a boot failure. The boot log was not captured but his memory layout is as follows: Early memory node ranges node 1: [mem 0x0000000000001000-0x0000000000090fff] node 1: [mem 0x0000000000100000-0x00000000dbdf8fff] node 1: [mem 0x0000000100000000-0x0000001423ffffff] node 0: [mem 0x0000001424000000-0x0000002023ffffff] This means that node0 starts in the middle of a memory section which is also in node1. memmap_init_zone tries to initialize padding of a section even when it is outside of the given pfn range because there are code paths (e.g. memory hotplug) which assume that the full worth of memory section is always initialized. In this particular case, though, such a range is already intialized and most likely already managed by the page allocator. Scribbling over those pages corrupts the internal state and likely blows up when any of those pages gets used. Reported-by: Robert Shteynfeld Fixes: 2830bf6f05fb ("mm, memory_hotplug: initialize struct pages for the full memory section") Cc: stable@kernel.org Signed-off-by: Michal Hocko Signed-off-by: Linus Torvalds mm/page_alloc.c | 12 ------------ 1 file changed, 12 deletions(-) commit 6479450f72c1391c03f08affe0d0110f41ae7ca0 Author: Heyi Guo Date: Thu Jan 24 21:37:08 2019 +0800 irqchip/gic-v4: Fix occasional VLPI drop 1. In current implementation, every VLPI will temporarily be mapped to the first CPU in system (normally CPU0) and then moved to the real scheduled CPU later. 2. So there is a time window and a VLPI may be sent to CPU0 instead of the real scheduled vCPU, in a multi-CPU virtual machine. 3. However, CPU0 may have not been scheduled as a virtual CPU after system boots up, so the value of its GICR_VPROPBASER is unknown at that moment. 4. If the INTID of VLPI is larger than 2^(GICR_VPROPBASER.IDbits+1), while IDbits is also in unknown state, GIC will behave as if the VLPI is out of range and simply drop it, which results in interrupt missing in Guest. As no code will clear GICR_VPROPBASER at runtime, we can safely initialize the IDbits field at boot time for each CPU to get rid of this issue. We also clear Valid bit of GICR_VPENDBASER in case any ancient programming gets left in and causes memory corrupting. A new function its_clear_vpend_valid() is added to reuse the code in its_vpe_deschedule(). Fixes: e643d8034036 ("irqchip/gic-v3-its: Add VPE scheduling") Signed-off-by: Heyi Guo Signed-off-by: Heyi Guo Signed-off-by: Marc Zyngier drivers/irqchip/irq-gic-v3-its.c | 66 +++++++++++++++++++++++++++++----------- 1 file changed, 49 insertions(+), 17 deletions(-) commit 80ff00172407e0aad4b10b94ef0816fc3e7813cb Author: Yao Liu Date: Mon Jan 28 19:44:14 2019 +0800 nfs: Fix NULL pointer dereference of dev_name There is a NULL pointer dereference of dev_name in nfs_parse_devname() The oops looks something like: BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 ... RIP: 0010:nfs_fs_mount+0x3b6/0xc20 [nfs] ... Call Trace: ? ida_alloc_range+0x34b/0x3d0 ? nfs_clone_super+0x80/0x80 [nfs] ? nfs_free_parsed_mount_data+0x60/0x60 [nfs] mount_fs+0x52/0x170 ? __init_waitqueue_head+0x3b/0x50 vfs_kern_mount+0x6b/0x170 do_mount+0x216/0xdc0 ksys_mount+0x83/0xd0 __x64_sys_mount+0x25/0x30 do_syscall_64+0x65/0x220 entry_SYSCALL_64_after_hwframe+0x49/0xbe Fix this by adding a NULL check on dev_name Signed-off-by: Yao Liu Signed-off-by: Anna Schumaker fs/nfs/super.c | 5 +++++ 1 file changed, 5 insertions(+) commit 7d4e591bc051d3382c45caaa2530969fb42ed23d Author: Fathi Boudra Date: Wed Jan 16 11:43:20 2019 -0600 selftests: timers: use LDLIBS instead of LDFLAGS posix_timers fails to build due to undefined reference errors: aarch64-linaro-linux-gcc --sysroot=/build/tmp-rpb-glibc/sysroots/hikey -O2 -pipe -g -feliminate-unused-debug-types -O3 -Wl,-no-as-needed -Wall -DKTEST -Wl,-O1 -Wl,--hash-style=gnu -Wl,--as-needed -lrt -lpthread posix_timers.c -o /build/tmp-rpb-glibc/work/hikey-linaro-linux/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/timers/posix_timers /tmp/cc1FTZzT.o: In function `check_timer_create': /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/timers/posix_timers.c:157: undefined reference to `timer_create' /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/timers/posix_timers.c:170: undefined reference to `timer_settime' collect2: error: ld returned 1 exit status It's GNU Make and linker specific. The default Makefile rule looks like: $(CC) $(CFLAGS) $(LDFLAGS) $@ $^ $(LDLIBS) When linking is done by gcc itself, no issue, but when it needs to be passed to proper ld, only LDLIBS follows and then ld cannot know what libs to link with. More detail: https://www.gnu.org/software/make/manual/html_node/Implicit-Variables.html LDFLAGS Extra flags to give to compilers when they are supposed to invoke the linker, ‘ld’, such as -L. Libraries (-lfoo) should be added to the LDLIBS variable instead. LDLIBS Library flags or names given to compilers when they are supposed to invoke the linker, ‘ld’. LOADLIBES is a deprecated (but still supported) alternative to LDLIBS. Non-library linker flags, such as -L, should go in the LDFLAGS variable. https://lkml.org/lkml/2010/2/10/362 tools/perf: libraries must come after objects Link order matters, use LDLIBS instead of LDFLAGS to properly link against libpthread. Signed-off-by: Denys Dmytriyenko Signed-off-by: Fathi Boudra Signed-off-by: Shuah Khan tools/testing/selftests/timers/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 870f193d48c25a97d61a8e6c04e3c29a2c606850 Author: Fathi Boudra Date: Wed Jan 16 11:43:18 2019 -0600 selftests: net: use LDLIBS instead of LDFLAGS reuseport_bpf_numa fails to build due to undefined reference errors: aarch64-linaro-linux-gcc --sysroot=/build/tmp-rpb-glibc/sysroots/hikey -Wall -Wl,--no-as-needed -O2 -g -I../../../../usr/include/ -Wl,-O1 -Wl,--hash-style=gnu -Wl,--as-needed -lnuma reuseport_bpf_numa.c -o /build/tmp-rpb-glibc/work/hikey-linaro-linux/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/net/reuseport_bpf_numa /tmp/ccfUuExT.o: In function `send_from_node': /build/tmp-rpb-glibc/work/hikey-linaro-linux/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/net/reuseport_bpf_numa.c:138: undefined reference to `numa_run_on_node' /tmp/ccfUuExT.o: In function `main': /build/tmp-rpb-glibc/work/hikey-linaro-linux/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/net/reuseport_bpf_numa.c:230: undefined reference to `numa_available' /build/tmp-rpb-glibc/work/hikey-linaro-linux/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/net/reuseport_bpf_numa.c:233: undefined reference to `numa_max_node' It's GNU Make and linker specific. The default Makefile rule looks like: $(CC) $(CFLAGS) $(LDFLAGS) $@ $^ $(LDLIBS) When linking is done by gcc itself, no issue, but when it needs to be passed to proper ld, only LDLIBS follows and then ld cannot know what libs to link with. More detail: https://www.gnu.org/software/make/manual/html_node/Implicit-Variables.html LDFLAGS Extra flags to give to compilers when they are supposed to invoke the linker, ‘ld’, such as -L. Libraries (-lfoo) should be added to the LDLIBS variable instead. LDLIBS Library flags or names given to compilers when they are supposed to invoke the linker, ‘ld’. LOADLIBES is a deprecated (but still supported) alternative to LDLIBS. Non-library linker flags, such as -L, should go in the LDFLAGS variable. https://lkml.org/lkml/2010/2/10/362 tools/perf: libraries must come after objects Link order matters, use LDLIBS instead of LDFLAGS to properly link against libnuma. Signed-off-by: Fathi Boudra Signed-off-by: Shuah Khan tools/testing/selftests/net/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8f9aca0c45322a807a343fc32f95f2500f83b9ae Author: Harald Freudenberger Date: Wed Jan 23 13:41:35 2019 +0100 s390/zcrypt: fix specification exception on z196 during ap probe The older machines don't have the QCI instruction available. With support for up to 256 crypto cards the probing of each card has been extended to check card ids from 0 up to 255. For machines with QCI support there is a filter limiting the range of probed cards. The older machines (z196 and older) don't have this filter and so since support for 256 cards is in the driver all cards are probed. However, these machines also require to have the card id fit into 6 bits. Exceeding this limit results in a specification exception which happens on every kernel startup even when there is no crypto configured and used at all. This fix limits the range of probed crypto cards to 64 if there is no QCI instruction available to obey to the older ap architecture and so fixes the specification exceptions on z196 machines. Cc: stable@vger.kernel.org # v4.17+ Fixes: af4a72276d49 ("s390/zcrypt: Support up to 256 crypto adapters.") Signed-off-by: Harald Freudenberger Signed-off-by: Martin Schwidefsky drivers/s390/crypto/ap_bus.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 4a8ef6999bce998fa5813023a9a6b56eea329dba Author: Stefan Haberland Date: Wed Nov 21 12:39:47 2018 +0100 s390/dasd: fix using offset into zero size array error Dan Carpenter reported the following: The patch 52898025cf7d: "[S390] dasd: security and PSF update patch for EMC CKD ioctl" from Mar 8, 2010, leads to the following static checker warning: drivers/s390/block/dasd_eckd.c:4486 dasd_symm_io() error: using offset into zero size array 'psf_data[]' drivers/s390/block/dasd_eckd.c 4458 /* Copy parms from caller */ 4459 rc = -EFAULT; 4460 if (copy_from_user(&usrparm, argp, sizeof(usrparm))) ^^^^^^^ The user can specify any "usrparm.psf_data_len". They choose zero by mistake. 4461 goto out; 4462 if (is_compat_task()) { 4463 /* Make sure pointers are sane even on 31 bit. */ 4464 rc = -EINVAL; 4465 if ((usrparm.psf_data >> 32) != 0) 4466 goto out; 4467 if ((usrparm.rssd_result >> 32) != 0) 4468 goto out; 4469 usrparm.psf_data &= 0x7fffffffULL; 4470 usrparm.rssd_result &= 0x7fffffffULL; 4471 } 4472 /* alloc I/O data area */ 4473 psf_data = kzalloc(usrparm.psf_data_len, GFP_KERNEL | GFP_DMA); 4474 rssd_result = kzalloc(usrparm.rssd_result_len, GFP_KERNEL | GFP_DMA); 4475 if (!psf_data || !rssd_result) { kzalloc() returns a ZERO_SIZE_PTR (0x16). 4476 rc = -ENOMEM; 4477 goto out_free; 4478 } 4479 4480 /* get syscall header from user space */ 4481 rc = -EFAULT; 4482 if (copy_from_user(psf_data, 4483 (void __user *)(unsigned long) usrparm.psf_data, 4484 usrparm.psf_data_len)) That all works great. 4485 goto out_free; 4486 psf0 = psf_data[0]; 4487 psf1 = psf_data[1]; But now we're assuming that "->psf_data_len" was at least 2 bytes. Fix this by checking the user specified length psf_data_len. Fixes: 52898025cf7d ("[S390] dasd: security and PSF update patch for EMC CKD ioctl") Reported-by: Dan Carpenter Signed-off-by: Stefan Haberland Signed-off-by: Martin Schwidefsky drivers/s390/block/dasd_eckd.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 634692ab7007e8e3fec758ab0b26e65abf7c79e0 Author: Martin Schwidefsky Date: Thu Jan 17 11:20:28 2019 +0100 s390/suspend: fix stack setup in swsusp_arch_suspend The patch that added support for the virtually mapped kernel stacks changed swsusp_arch_suspend to switch to the nodat-stack as the vmap stack is not available while going in and out of suspend. Unfortunately the switch to the nodat-stack is incorrect which breaks suspend to disk. Cc: stable@vger.kernel.org # v4.20 Fixes: ce3dc447493f ("s390: add support for virtually mapped kernel stacks") Signed-off-by: Martin Schwidefsky arch/s390/kernel/swsusp.S | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 302167c50b32e7fccc98994a91d40ddbbab04e52 Author: Josef Bacik Date: Thu Jan 24 09:31:43 2019 -0500 btrfs: don't end the transaction for delayed refs in throttle Previously callers to btrfs_end_transaction_throttle() would commit the transaction if there wasn't enough delayed refs space. This happens in relocation, and if the fs is relatively empty we'll run out of delayed refs space basically immediately, so we'll just be stuck in this loop of committing the transaction over and over again. This code existed because we didn't have a good feedback mechanism for running delayed refs, but with the delayed refs rsv we do now. Delete this throttling code and let the btrfs_start_transaction() in relocation deal with putting pressure on the delayed refs infrastructure. With this patch we no longer take 5 minutes to balance a metadata only fs. Qu has submitted a fstest to catch slow balance or excessive transaction commits. Steps to reproduce: * create subvolume * create many (eg. 16000) inlined files, of size 2KiB * iteratively snapshot and touch several files to trigger metadata updates * start balance -m Reported-by: Qu Wenruo Fixes: 64403612b73a ("btrfs: rework btrfs_check_space_for_delayed_refs") Signed-off-by: Josef Bacik [ add tags and steps to reproduce ] Signed-off-by: David Sterba fs/btrfs/transaction.c | 8 -------- 1 file changed, 8 deletions(-) commit 7ae710f9f8b2cf95297e7bbfe1c09789a7dc43d4 Author: Andrew Lunn Date: Sun Jan 27 22:58:00 2019 +0100 gpio: vf610: Mask all GPIO interrupts On SoC reset all GPIO interrupts are disable. However, if kexec is used to boot into a new kernel, the SoC does not experience a reset. Hence GPIO interrupts can be left enabled from the previous kernel. It is then possible for the interrupt to fire before an interrupt handler is registered, resulting in the kernel complaining of an "unexpected IRQ trap", the interrupt is never cleared, and so fires again, resulting in an interrupt storm. Disable all GPIO interrupts before registering the GPIO IRQ chip. Fixes: 7f2691a19627 ("gpio: vf610: add gpiolib/IRQ chip driver for Vybrid") Signed-off-by: Andrew Lunn Acked-by: Stefan Agner Signed-off-by: Linus Walleij drivers/gpio/gpio-vf610.c | 5 +++++ 1 file changed, 5 insertions(+) commit a6279470762c19ba97e454f90798373dccdf6148 Author: Filipe Manana Date: Fri Jan 25 11:48:51 2019 +0000 Btrfs: fix deadlock when allocating tree block during leaf/node split When splitting a leaf or node from one of the trees that are modified when flushing pending block groups (extent, chunk, device and free space trees), we need to allocate a new tree block, which in turn can result in the need to allocate a new block group. After allocating the new block group we may need to flush new block groups that were previously allocated during the course of the current transaction, which is what may cause a deadlock due to attempts to write lock twice the same leaf or node, as when splitting a leaf or node we are holding a write lock on it and its parent node. The same type of deadlock can also happen when increasing the tree's height, since we are holding a lock on the existing root while allocating the tree block to use as the new root node. An example trace when the deadlock happens during the leaf split path is: [27175.293054] CPU: 0 PID: 3005 Comm: kworker/u17:6 Tainted: G W 4.19.16 #1 [27175.293942] Hardware name: Penguin Computing Relion 1900/MD90-FS0-ZB-XX, BIOS R15 06/25/2018 [27175.294846] Workqueue: btrfs-extent-refs btrfs_extent_refs_helper [btrfs] (...) [27175.298384] RSP: 0018:ffffab2087107758 EFLAGS: 00010246 [27175.299269] RAX: 0000000000000bbd RBX: ffff9fadc7141c48 RCX: 0000000000000001 [27175.300155] RDX: 0000000000000001 RSI: 0000000000000002 RDI: ffff9fadc7141c48 [27175.301023] RBP: 0000000000000001 R08: ffff9faeb6ac1040 R09: ffff9fa9c0000000 [27175.301887] R10: 0000000000000000 R11: 0000000000000040 R12: ffff9fb21aac8000 [27175.302743] R13: ffff9fb1a64d6a20 R14: 0000000000000001 R15: ffff9fb1a64d6a18 [27175.303601] FS: 0000000000000000(0000) GS:ffff9fb21fa00000(0000) knlGS:0000000000000000 [27175.304468] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [27175.305339] CR2: 00007fdc8743ead8 CR3: 0000000763e0a006 CR4: 00000000003606f0 [27175.306220] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [27175.307087] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [27175.307940] Call Trace: [27175.308802] btrfs_search_slot+0x779/0x9a0 [btrfs] [27175.309669] ? update_space_info+0xba/0xe0 [btrfs] [27175.310534] btrfs_insert_empty_items+0x67/0xc0 [btrfs] [27175.311397] btrfs_insert_item+0x60/0xd0 [btrfs] [27175.312253] btrfs_create_pending_block_groups+0xee/0x210 [btrfs] [27175.313116] do_chunk_alloc+0x25f/0x300 [btrfs] [27175.313984] find_free_extent+0x706/0x10d0 [btrfs] [27175.314855] btrfs_reserve_extent+0x9b/0x1d0 [btrfs] [27175.315707] btrfs_alloc_tree_block+0x100/0x5b0 [btrfs] [27175.316548] split_leaf+0x130/0x610 [btrfs] [27175.317390] btrfs_search_slot+0x94d/0x9a0 [btrfs] [27175.318235] btrfs_insert_empty_items+0x67/0xc0 [btrfs] [27175.319087] alloc_reserved_file_extent+0x84/0x2c0 [btrfs] [27175.319938] __btrfs_run_delayed_refs+0x596/0x1150 [btrfs] [27175.320792] btrfs_run_delayed_refs+0xed/0x1b0 [btrfs] [27175.321643] delayed_ref_async_start+0x81/0x90 [btrfs] [27175.322491] normal_work_helper+0xd0/0x320 [btrfs] [27175.323328] ? move_linked_works+0x6e/0xa0 [27175.324160] process_one_work+0x191/0x370 [27175.324976] worker_thread+0x4f/0x3b0 [27175.325763] kthread+0xf8/0x130 [27175.326531] ? rescuer_thread+0x320/0x320 [27175.327284] ? kthread_create_worker_on_cpu+0x50/0x50 [27175.328027] ret_from_fork+0x35/0x40 [27175.328741] ---[ end trace 300a1b9f0ac30e26 ]--- Fix this by preventing the flushing of new blocks groups when splitting a leaf/node and when inserting a new root node for one of the trees modified by the flushing operation, similar to what is done when COWing a node/leaf from on of these trees. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=202383 Reported-by: Eli V CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Filipe Manana Signed-off-by: David Sterba fs/btrfs/ctree.c | 78 ++++++++++++++++++++++++++++++++++++-------------------- 1 file changed, 50 insertions(+), 28 deletions(-) commit a53469a68eb886e84dd8b69a1458a623d3591793 Author: Bin Liu Date: Wed Jan 16 11:54:07 2019 -0600 usb: phy: am335x: fix race condition in _probe power off the phy should be done before populate the phy. Otherwise, am335x_init() could be called by the phy owner to power on the phy first, then am335x_phy_probe() turns off the phy again without the caller knowing it. Fixes: 2fc711d76352 ("usb: phy: am335x: Enable USB remote wakeup using PHY wakeup") Cc: stable@vger.kernel.org # v3.18+ Signed-off-by: Bin Liu Signed-off-by: Felipe Balbi drivers/usb/phy/phy-am335x.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) commit 512e6fb589bc18f9321457632e89b95017447db9 Author: Alexey Khoroshilov Date: Tue Jan 22 00:23:50 2019 +0300 usb: dwc3: exynos: Fix error handling of clk_prepare_enable If clk_prepare_enable() fails in dwc3_exynos_probe() or in dwc3_exynos_resume(), exynos->clks[0] is left undisabled because of usage preincrement in while condition. Found by Linux Driver Verification project (linuxtesting.org). Fixes: 9f2168367a0a ("usb: dwc3: exynos: Rework clock handling and prepare for new variants") Acked-by: Marek Szyprowski Signed-off-by: Alexey Khoroshilov Signed-off-by: Felipe Balbi drivers/usb/dwc3/dwc3-exynos.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit f2105d42597f4d10e431b195d69e96dccaf9b012 Author: Anders Roxell Date: Tue Jan 22 11:36:02 2019 +0100 usb: phy: fix link errors Fix link errors when CONFIG_FSL_USB2_OTG is enabled and USB_OTG_FSM is set to module then the following link error occurs. aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.o: in function `fsl_otg_ioctl': drivers/usb/phy/phy-fsl-usb.c:1083: undefined reference to `otg_statemachine' aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.c:1083:(.text+0x574): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `otg_statemachine' aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.o: in function `fsl_otg_start_srp': drivers/usb/phy/phy-fsl-usb.c:674: undefined reference to `otg_statemachine' aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.c:674:(.text+0x61c): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `otg_statemachine' aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.o: in function `fsl_otg_set_host': drivers/usb/phy/phy-fsl-usb.c:593: undefined reference to `otg_statemachine' aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.c:593:(.text+0x7a4): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `otg_statemachine' aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.o: in function `fsl_otg_start_hnp': drivers/usb/phy/phy-fsl-usb.c:695: undefined reference to `otg_statemachine' aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.c:695:(.text+0x858): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `otg_statemachine' aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.o: in function `a_wait_enum': drivers/usb/phy/phy-fsl-usb.c:274: undefined reference to `otg_statemachine' aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.c:274:(.text+0x16f0): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `otg_statemachine' aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.o:drivers/usb/phy/phy-fsl-usb.c:619: more undefined references to `otg_statemachine' follow aarch64-linux-gnu-ld: drivers/usb/phy/phy-fsl-usb.o: in function `fsl_otg_set_peripheral': drivers/usb/phy/phy-fsl-usb.c:619:(.text+0x1fa0): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `otg_statemachine' make[1]: *** [Makefile:1020: vmlinux] Error 1 make[1]: Target 'Image' not remade because of errors. make: *** [Makefile:152: sub-make] Error 2 make: Target 'Image' not remade because of errors. Rework so that FSL_USB2_OTG depends on that the USB_OTG_FSM is builtin. Signed-off-by: Anders Roxell Signed-off-by: Felipe Balbi drivers/usb/phy/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 07c69f1148da7de3978686d3af9263325d9d60bd Author: Gustavo A. R. Silva Date: Tue Jan 22 15:28:08 2019 -0600 usb: gadget: udc: net2272: Fix bitwise and boolean operations (!x & y) strikes again. Fix bitwise and boolean operations by enclosing the expression: intcsr & (1 << NET2272_PCI_IRQ) in parentheses, before applying the boolean operator '!'. Notice that this code has been there since 2011. So, it would be helpful if someone can double-check this. This issue was detected with the help of Coccinelle. Fixes: ceb80363b2ec ("USB: net2272: driver for PLX NET2272 USB device controller") Cc: stable@vger.kernel.org Signed-off-by: Gustavo A. R. Silva Signed-off-by: Felipe Balbi drivers/usb/gadget/udc/net2272.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1e19cdc8060227b0802bda6bc0bd22b23679ba32 Author: Tejas Joglekar Date: Tue Jan 22 13:26:51 2019 +0530 usb: dwc3: gadget: Handle 0 xfer length for OUT EP For OUT endpoints, zero-length transfers require MaxPacketSize buffer as per the DWC_usb3 programming guide 3.30a section 4.2.3.3. This patch fixes this by explicitly checking zero length transfer to correctly pad up to MaxPacketSize. Fixes: c6267a51639b ("usb: dwc3: gadget: align transfers to wMaxPacketSize") Cc: stable@vger.kernel.org Signed-off-by: Tejas Joglekar Signed-off-by: Felipe Balbi drivers/usb/dwc3/gadget.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3751e008da0df4384031bd66a516c0292f915605 Author: Chaotian Jing Date: Wed Jan 23 20:05:25 2019 +0800 mmc: mediatek: fix incorrect register setting of hs400_cmd_int_delay to set cmd internal delay, need set PAD_TUNE register but not PAD_CMD_TUNE register. Signed-off-by: Chaotian Jing Fixes: 1ede5cb88a29 ("mmc: mediatek: Use data tune for CMD line tune") Cc: stable@vger.kernel.org # v4.12+ Signed-off-by: Ulf Hansson drivers/mmc/host/mtk-sd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8c9620b1cc9b69e82fa8d4081d646d0016b602e7 Author: Lukas Wunner Date: Sat Jan 19 16:31:00 2019 +0100 mmc: bcm2835: Fix DMA channel leak on probe error The BCM2835 MMC host driver requests a DMA channel on probe but neglects to release the channel in the probe error path. The channel may therefore be leaked, in particular if devm_clk_get() causes probe deferral. Fix it. Fixes: 660fc733bd74 ("mmc: bcm2835: Add new driver for the sdhost controller.") Signed-off-by: Lukas Wunner Cc: stable@vger.kernel.org # v4.12+ Cc: Frank Pavlic Tested-by: Stefan Wahren Signed-off-by: Ulf Hansson drivers/mmc/host/bcm2835.c | 2 ++ 1 file changed, 2 insertions(+) commit 09db51241118aeb06e1c8cd393b45879ce099b36 Author: Martin Willi Date: Mon Jan 28 09:35:35 2019 +0100 esp: Skip TX bytes accounting when sending from a request socket On ESP output, sk_wmem_alloc is incremented for the added padding if a socket is associated to the skb. When replying with TCP SYNACKs over IPsec, the associated sk is a casted request socket, only. Increasing sk_wmem_alloc on a request socket results in a write at an arbitrary struct offset. In the best case, this produces the following WARNING: WARNING: CPU: 1 PID: 0 at lib/refcount.c:102 esp_output_head+0x2e4/0x308 [esp4] refcount_t: addition on 0; use-after-free. CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.0.0-rc3 #2 Hardware name: Marvell Armada 380/385 (Device Tree) [...] [] (esp_output_head [esp4]) from [] (esp_output+0xb8/0x180 [esp4]) [] (esp_output [esp4]) from [] (xfrm_output_resume+0x558/0x664) [] (xfrm_output_resume) from [] (xfrm4_output+0x44/0xc4) [] (xfrm4_output) from [] (tcp_v4_send_synack+0xa8/0xe8) [] (tcp_v4_send_synack) from [] (tcp_conn_request+0x7f4/0x948) [] (tcp_conn_request) from [] (tcp_rcv_state_process+0x2a0/0xe64) [] (tcp_rcv_state_process) from [] (tcp_v4_do_rcv+0xf0/0x1f4) [] (tcp_v4_do_rcv) from [] (tcp_v4_rcv+0xdb8/0xe20) [] (tcp_v4_rcv) from [] (ip_protocol_deliver_rcu+0x2c/0x2dc) [] (ip_protocol_deliver_rcu) from [] (ip_local_deliver_finish+0x48/0x54) [] (ip_local_deliver_finish) from [] (ip_local_deliver+0x54/0xec) [] (ip_local_deliver) from [] (ip_rcv+0x48/0xb8) [] (ip_rcv) from [] (__netif_receive_skb_one_core+0x50/0x6c) [...] The issue triggers only when not using TCP syncookies, as for syncookies no socket is associated. Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible") Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible") Signed-off-by: Martin Willi Signed-off-by: Steffen Klassert net/ipv4/esp4.c | 2 +- net/ipv6/esp6.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 206b8cc514d7ff2b79dd2d5ad939adc7c493f07a Author: Anders Roxell Date: Wed Jan 23 12:48:11 2019 +0100 netfilter: ipt_CLUSTERIP: fix warning unused variable cn When CONFIG_PROC_FS isn't set the variable cn isn't used. net/ipv4/netfilter/ipt_CLUSTERIP.c: In function ‘clusterip_net_exit’: net/ipv4/netfilter/ipt_CLUSTERIP.c:849:24: warning: unused variable ‘cn’ [-Wunused-variable] struct clusterip_net *cn = clusterip_pernet(net); ^~ Rework so the variable 'cn' is declared inside "#ifdef CONFIG_PROC_FS". Fixes: b12f7bad5ad3 ("netfilter: ipt_CLUSTERIP: remove wrong WARN_ON_ONCE in netns exit routine") Signed-off-by: Anders Roxell Signed-off-by: Pablo Neira Ayuso net/ipv4/netfilter/ipt_CLUSTERIP.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b Author: Fernando Fernandez Mancera Date: Mon Jan 21 12:53:21 2019 +0100 netfilter: nfnetlink_osf: add missing fmatch check When we check the tcp options of a packet and it doesn't match the current fingerprint, the tcp packet option pointer must be restored to its initial value in order to do the proper tcp options check for the next fingerprint. Here we can see an example. Assumming the following fingerprint base with two lines: S10:64:1:60:M*,S,T,N,W6: Linux:3.0::Linux 3.0 S20:64:1:60:M*,S,T,N,W7: Linux:4.19:arch:Linux 4.1 Where TCP options are the last field in the OS signature, all of them overlap except by the last one, ie. 'W6' versus 'W7'. In case a packet for Linux 4.19 kicks in, the osf finds no matching because the TCP options pointer is updated after checking for the TCP options in the first line. Therefore, reset pointer back to where it should be. Fixes: 11eeef41d5f6 ("netfilter: passive OS fingerprint xtables match") Signed-off-by: Fernando Fernandez Mancera Signed-off-by: Pablo Neira Ayuso net/netfilter/nfnetlink_osf.c | 4 ++++ 1 file changed, 4 insertions(+) commit 2035f3ff8eaa29cfb5c8e2160b0f6e85eeb21a95 Author: Florian Westphal Date: Mon Jan 21 21:54:36 2019 +0100 netfilter: ebtables: compat: un-break 32bit setsockopt when no rules are present Unlike ip(6)tables ebtables only counts user-defined chains. The effect is that a 32bit ebtables binary on a 64bit kernel can do 'ebtables -N FOO' only after adding at least one rule, else the request fails with -EINVAL. This is a similar fix as done in 3f1e53abff84 ("netfilter: ebtables: don't attempt to allocate 0-sized compat array"). Fixes: 7d7d7e02111e9 ("netfilter: compat: reject huge allocation requests") Reported-by: Francesco Ruggeri Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/bridge/netfilter/ebtables.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit ee0b27a3a4da0b0ed2318aa092f8856896e9450b Author: Andre Przywara Date: Wed Jan 23 00:59:11 2019 +0000 clk: sunxi: A31: Fix wrong AHB gate number According to the manual the gate clock for MMC3 is at bit 11, and NAND1 is controlled by bit 12. Fix the gate bit definitions in the clock driver. Fixes: c6e6c96d8fa6 ("clk: sunxi-ng: Add A31/A31s clocks") Signed-off-by: Andre Przywara Signed-off-by: Maxime Ripard drivers/clk/sunxi-ng/ccu-sun6i-a31.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 6fb6e6371f8c463020a41cc0ed1915e140219c3d Author: Andrew Lunn Date: Sun Jan 27 22:48:00 2019 +0100 net: dsa: mv88e6xxx: Fix serdes irq setup going recursive Duec to a typo, mv88e6390_serdes_irq_setup() calls itself, rather than mv88e6390x_serdes_irq_setup(). It then blows the stack, and shortly after the machine blows up. Fixes: 2defda1f4b91 ("net: dsa: mv88e6xxx: Add support for SERDES on ports 2-8 for 6390X") Signed-off-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx/serdes.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 146820cc240f4389cf33481c058d9493aef95e25 Author: Nir Dotan Date: Sun Jan 27 09:26:22 2019 +0200 ip6mr: Fix notifiers call on mroute_clean_tables() When the MC route socket is closed, mroute_clean_tables() is called to cleanup existing routes. Mistakenly notifiers call was put on the cleanup of the unresolved MC route entries cache. In a case where the MC socket closes before an unresolved route expires, the notifier call leads to a crash, caused by the driver trying to increment a non initialized refcount_t object [1] and then when handling is done, to decrement it [2]. This was detected by a test recently added in commit 6d4efada3b82 ("selftests: forwarding: Add multicast routing test"). Fix that by putting notifiers call on the resolved entries traversal, instead of on the unresolved entries traversal. [1] [ 245.748967] refcount_t: increment on 0; use-after-free. [ 245.754829] WARNING: CPU: 3 PID: 3223 at lib/refcount.c:153 refcount_inc_checked+0x2b/0x30 ... [ 245.802357] Hardware name: Mellanox Technologies Ltd. MSN2740/SA001237, BIOS 5.6.5 06/07/2016 [ 245.811873] RIP: 0010:refcount_inc_checked+0x2b/0x30 ... [ 245.907487] Call Trace: [ 245.910231] mlxsw_sp_router_fib_event.cold.181+0x42/0x47 [mlxsw_spectrum] [ 245.917913] notifier_call_chain+0x45/0x7 [ 245.922484] atomic_notifier_call_chain+0x15/0x20 [ 245.927729] call_fib_notifiers+0x15/0x30 [ 245.932205] mroute_clean_tables+0x372/0x3f [ 245.936971] ip6mr_sk_done+0xb1/0xc0 [ 245.940960] ip6_mroute_setsockopt+0x1da/0x5f0 ... [2] [ 246.128487] refcount_t: underflow; use-after-free. [ 246.133859] WARNING: CPU: 0 PID: 7 at lib/refcount.c:187 refcount_sub_and_test_checked+0x4c/0x60 [ 246.183521] Hardware name: Mellanox Technologies Ltd. MSN2740/SA001237, BIOS 5.6.5 06/07/2016 ... [ 246.193062] Workqueue: mlxsw_core_ordered mlxsw_sp_router_fibmr_event_work [mlxsw_spectrum] [ 246.202394] RIP: 0010:refcount_sub_and_test_checked+0x4c/0x60 ... [ 246.298889] Call Trace: [ 246.301617] refcount_dec_and_test_checked+0x11/0x20 [ 246.307170] mlxsw_sp_router_fibmr_event_work.cold.196+0x47/0x78 [mlxsw_spectrum] [ 246.315531] process_one_work+0x1fa/0x3f0 [ 246.320005] worker_thread+0x2f/0x3e0 [ 246.324083] kthread+0x118/0x130 [ 246.327683] ? wq_update_unbound_numa+0x1b0/0x1b0 [ 246.332926] ? kthread_park+0x80/0x80 [ 246.337013] ret_from_fork+0x1f/0x30 Fixes: 088aa3eec2ce ("ip6mr: Support fib notifications") Signed-off-by: Nir Dotan Reviewed-by: Ido Schimmel Signed-off-by: David S. Miller net/ipv6/ip6mr.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit 50c2936634bcb1db78a8ca63249236810c11a80f Author: Johannes Berg Date: Sat Jan 26 21:12:19 2019 +0100 decnet: fix DN_IFREQ_SIZE Digging through the ioctls with Al because of the previous patches, we found that on 64-bit decnet's dn_dev_ioctl() is wrong, because struct ifreq::ifr_ifru is actually 24 bytes (not 16 as expected from struct sockaddr) due to the ifru_map and ifru_settings members. Clearly, decnet expects the ioctl to be called with a struct like struct ifreq_dn { char ifr_name[IFNAMSIZ]; struct sockaddr_dn ifr_addr; }; since it does struct ifreq *ifr = ...; struct sockaddr_dn *sdn = (struct sockaddr_dn *)&ifr->ifr_addr; This means that DN_IFREQ_SIZE is too big for what it wants on 64-bit, as it is sizeof(struct ifreq) - sizeof(struct sockaddr) + sizeof(struct sockaddr_dn) This assumes that sizeof(struct sockaddr) is the size of ifr_ifru but that isn't true. Fix this to use offsetof(struct ifreq, ifr_ifru). This indeed doesn't really matter much - the result is that we copy in/out 8 bytes more than we should on 64-bit platforms. In case the "struct ifreq_dn" lands just on the end of a page though it might lead to faults. As far as I can tell, it has been like this forever, so it seems very likely that nobody cares. Signed-off-by: Johannes Berg Signed-off-by: David S. Miller net/decnet/dn_dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c69c29a1a0a8f68cd87e98ba4a5a79fb8ef2a58c Author: Alexey Khoroshilov Date: Sat Jan 26 22:48:57 2019 +0300 net: stmmac: dwmac-rk: fix error handling in rk_gmac_powerup() If phy_power_on() fails in rk_gmac_powerup(), clocks are left enabled. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov Signed-off-by: David S. Miller drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 417c8045c1e9d1a8697052342606ed596835e5e5 Merge: 3da15ad3e9c8 cec8abba13e6 Author: David S. Miller Date: Sun Jan 27 23:01:56 2019 -0800 Merge branch 'hns-fixes' Peng Li says: ==================== net: hns: code optimizations & bugfixes for HNS driver This patchset includes bugfixes and code optimizations for the HNS ethernet controller driver ==================== Signed-off-by: David S. Miller commit cec8abba13e6a26729dfed41019720068eeeff2b Author: Yonglong Liu Date: Sat Jan 26 17:18:27 2019 +0800 net: hns: Fix wrong read accesses via Clause 45 MDIO protocol When reading phy registers via Clause 45 MDIO protocol, after write address operation, the driver use another write address operation, so can not read the right value of any phy registers. This patch fixes it. Signed-off-by: Yonglong Liu Signed-off-by: Peng Li Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns_mdio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ed29ca8b9592562559c64d027fb5eb126e463e2c Author: Yonglong Liu Date: Sat Jan 26 17:18:26 2019 +0800 net: hns: Restart autoneg need return failed when autoneg off The hns driver of earlier devices, when autoneg off, restart autoneg will return -EINVAL, so make the hns driver for the latest devices do the same. Signed-off-by: Yonglong Liu Signed-off-by: Peng Li Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns/hns_ethtool.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) commit 263c6d75f9a544a3c2f8f6a26de4f4808d8f59cf Author: Yonglong Liu Date: Sat Jan 26 17:18:25 2019 +0800 net: hns: Fix for missing of_node_put() after of_parse_phandle() In hns enet driver, we use of_parse_handle() to get hold of the device node related to "ae-handle" but we have missed to put the node reference using of_node_put() after we are done using the node. This patch fixes it. Note: This problem is stated in Link: https://lkml.org/lkml/2018/12/22/217 Fixes: 48189d6aaf1e ("net: hns: enet specifies a reference to dsaf") Reported-by: Alexey Khoroshilov Signed-off-by: Yonglong Liu Signed-off-by: Peng Li Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns/hns_enet.c | 5 +++++ 1 file changed, 5 insertions(+) commit 6db2983cd8064808141ccefd75218f5b4345ffae Author: Eugene Loh Date: Thu Jan 17 14:46:00 2019 -0800 kallsyms: Handle too long symbols in kallsyms.c When checking for symbols with excessively long names, account for null terminating character. Fixes: f3462aa952cf ("Kbuild: Handle longer symbols in kallsyms.c") Signed-off-by: Eugene Loh Acked-by: Ard Biesheuvel Signed-off-by: Masahiro Yamada scripts/kallsyms.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 2a2ec4aa0577ec0b7df2d1bde5c84ed39a8637cb Author: Guenter Roeck Date: Sun Jan 27 16:08:00 2019 -0800 hwmon: (nct6775) Fix fan6 detection for NCT6793D Commit 2d99925a15b6 ("hwmon: (nct6775) Separate fan/pwm configuration detection for NCT6793D") accidentally removed part of the code detecting if fan6 is enabled or not. As result, fan6 is no longer detected on Asus PRIME Z370-A. Restore the missing detection code. Fixes: 2d99925a15b6 ("hwmon: (nct6775) Separate fan/pwm configuration detection for NCT6793D") Reported-by: Chris Siebenmann Cc: Chris Siebenmann Signed-off-by: Guenter Roeck drivers/hwmon/nct6775.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit f17b5f06cb92ef2250513a1e154c47b78df07d40 Author: Linus Torvalds Date: Sun Jan 27 15:18:05 2019 -0800 Linux 5.0-rc4 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 26e2d7b03ea7ff254bf78305aa44dda62e70b78e Author: Dmitry Voytik Date: Tue Jan 22 23:38:48 2019 +0100 arm64: dts: rockchip: enable usb-host regulators at boot on rk3328-rock64 After commit ef05bcb60c1a, boot from USB drives is broken. Fix this problem by enabling usb-host regulators during boot time. Fixes: ef05bcb60c1a ("arm64: dts: rockchip: fix vcc_host1_5v pin assign on rk3328-rock64") Cc: stable@vger.kernel.org Signed-off-by: Dmitry Voytik Signed-off-by: Heiko Stuebner arch/arm64/boot/dts/rockchip/rk3328-rock64.dts | 2 ++ 1 file changed, 2 insertions(+) commit 26cd8657c7e745686a4c54a5cccf721ede208a25 Author: Enric Balletbo i Serra Date: Sat Jan 26 11:37:28 2019 +0100 arm64: dts: rockchip: fix graph_port warning on rk3399 bob kevin and excavator Ports are described by child 'port' nodes contained in the device node. 'ports' is optional and is used to group all 'port' nodes which is not the case here. This patch fixes the following warnings: arch/arm64/boot/dts/rockchip/rk3399-gru-bob.dts:25.9-29.5: Warning (graph_port): /edp-panel/ports: graph port node name should be 'port' arch/arm64/boot/dts/rockchip/rk3399-gru-kevin.dts:46.9-50.5: Warningi (graph_port): /edp-panel/ports: graph port node name should be 'port' arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts:94.9-98.5: Warning (graph_port): /edp-panel/ports: graph port node name should be 'port' Signed-off-by: Enric Balletbo i Serra Signed-off-by: Heiko Stuebner arch/arm64/boot/dts/rockchip/rk3399-gru-bob.dts | 2 +- arch/arm64/boot/dts/rockchip/rk3399-gru-kevin.dts | 2 +- arch/arm64/boot/dts/rockchip/rk3399-sapphire-excavator.dts | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) commit 8a5f06056a25ac7dbca2b0505cc0fe8ffb6947c1 Merge: 351e1aa6cb4b 625210cfa6c0 Author: Linus Torvalds Date: Sun Jan 27 12:02:00 2019 -0800 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Thomas Gleixner: "A set of fixes for x86: - Fix the swapped outb() parameters in the KASLR code - Fix the PKEY handling at fork which missed to preserve the pkey state for the child. Comes with a test case to validate that. - Fix the entry stack handling for XEN PV to respect that XEN PV systems enter the function already on the current thread stack and not on the trampoline. - Fix kexec load failure caused by using a stale value when the kexec_buf structure is reused for subsequent allocations. - Fix a bogus sizeof() in the memory encryption code - Enforce PCI dependency for the Intel Low Power Subsystem - Enforce PCI_LOCKLESS_CONFIG when PCI is enabled" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/Kconfig: Select PCI_LOCKLESS_CONFIG if PCI is enabled x86/entry/64/compat: Fix stack switching for XEN PV x86/kexec: Fix a kexec_file_load() failure x86/mm/mem_encrypt: Fix erroneous sizeof() x86/selftests/pkeys: Fork() to check for state being preserved x86/pkeys: Properly copy pkey state at fork() x86/kaslr: Fix incorrect i8254 outb() parameters x86/intel/lpss: Make PCI dependency explicit commit 351e1aa6cb4b136e3f772605071d7a8db3c5b4e0 Merge: f907bb4c326d d999c0ec2498 Author: Linus Torvalds Date: Sun Jan 27 11:57:46 2019 -0800 Merge branch 'x86-timers-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 timer fixes from Thomas Gleixner: "Two commits which were missed to be sent during the merge window. - The TSC calibration fix turns out to be more urgent as recent Skylake-X systems seem to have massive trouble with calibration disturbance. This should go back into stable for that reason and it the risk of breakage is rather low. - Drop an unused define" * 'x86-timers-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/hpet: Remove unused FSEC_PER_NSEC define x86/tsc: Make calibration refinement more robust commit f907bb4c326d145c13504db184f38557d169f4bc Merge: 988105182837 93ad0fc088c5 Author: Linus Torvalds Date: Sun Jan 27 11:55:06 2019 -0800 Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Thomas Glexiner: "A single regression fix to address the unintended breakage of posix cpu timers. This is caused by a new sanity check in the common code, which fails for posix cpu timers under certain conditions because the posix cpu timer code never updates the variable which is checked" * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: posix-cpu-timers: Unbreak timer rearming commit 9881051828375a872964f91bf985b8a35e4fbaef Merge: 0d484375d73a e158488be27b Author: Linus Torvalds Date: Sun Jan 27 11:52:50 2019 -0800 Merge branch 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fixes from Thomas Gleixner: "A small series of fixes which all address possible missed wakeups: - Document and fix the wakeup ordering of wake_q - Add the missing barrier in rcuwait_wake_up(), which was documented in the comment but missing in the code - Fix the possible missed wakeups in the rwsem and futex code" * 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: locking/rwsem: Fix (possible) missed wakeup futex: Fix (possible) missed wakeup sched/wake_q: Fix wakeup ordering for wake_q sched/wake_q: Document wake_q_add() sched/wait: Fix rcuwait_wake_up() ordering commit 0d484375d73ad2ec39a395365449a70c200645b1 Merge: 983542434e6b 37b144df8099 Author: Linus Torvalds Date: Sun Jan 27 11:25:38 2019 -0800 Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Thomas Gleixner: "A small set of fixes for the interrupt subsystem: - Fix a double increment in the irq descriptor allocator which resulted in a sanity check only being done for every second affinity mask - Add a missing device tree translation in the stm32-exti driver. Without that the interrupt association is completely wrong. - Initialize the mutex in the GIC-V3 MBI driver - Fix the alignment for aliasing devices in the GIC-V3-ITS driver so multi MSI allocations work correctly - Ensure that the initial affinity of a interrupt is not empty at startup time. - Drop bogus include in the madera irq chip driver - Fix KernelDoc regression" * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/gic-v3-its: Align PCI Multi-MSI allocation on their size genirq/irqdesc: Fix double increment in alloc_descs() genirq: Fix the kerneldoc comment for struct irq_affinity_desc irqchip/madera: Drop GPIO includes irqchip/gic-v3-mbi: Fix uninitialized mbi_lock irqchip/stm32-exti: Add domain translate function genirq: Make sure the initial affinity is not empty commit 3da15ad3e9c856ab26516bd423f6a87c48acbc3f Merge: b0cf029234f9 6ce966fd2671 Author: David S. Miller Date: Sun Jan 27 11:06:45 2019 -0800 Merge tag 'mlx5-fixes-2019-01-25' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== Mellanox, mlx5 fixes 2019-01-25 This series introduces some fixes to mlx5 driver. For more information please see tag log below. Please pull and let me know if there is any problem. For -stable v4.13 ('net/mlx5e: Allow MAC invalidation while spoofchk is ON') For -stable v4.18 ('Revert "net/mlx5e: E-Switch, Initialize eswitch only if eswitch manager"') ==================== Signed-off-by: David S. Miller commit 983542434e6beef911d5ae4488c49080a177e5e4 Merge: 419967d53fc7 245b6c655812 Author: Linus Torvalds Date: Sun Jan 27 11:00:37 2019 -0800 Merge tag 'edac_fix_for_5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp Pull EDAC fix from Borislav Petkov: "Fix persistent register offsets of altera_edac, from Thor Thayer" * tag 'edac_fix_for_5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp: EDAC, altera: Fix S10 persistent register offset commit 419967d53fc74bb151cdc9a00d0df80a2cc37173 Merge: 1fc7f56db7a7 947b7ac135b1 Author: Linus Torvalds Date: Sun Jan 27 10:58:20 2019 -0800 Merge tag 'for-linus-20190127' of git://git.kernel.dk/linux-block Pull block revert from Jens Axboe: "Silly error snuck into a patch from the last series, let's do a revert to avoid a potential use-after-free" * tag 'for-linus-20190127' of git://git.kernel.dk/linux-block: Revert "block: cover another queue enter recursion via BIO_QUEUE_ENTERED" commit b0cf029234f9b18e10703ba5147f0389c382bccc Author: Bernard Pidoux Date: Fri Jan 25 11:46:40 2019 +0100 net/rose: fix NULL ax25_cb kernel panic When an internally generated frame is handled by rose_xmit(), rose_route_frame() is called: if (!rose_route_frame(skb, NULL)) { dev_kfree_skb(skb); stats->tx_errors++; return NETDEV_TX_OK; } We have the same code sequence in Net/Rom where an internally generated frame is handled by nr_xmit() calling nr_route_frame(skb, NULL). However, in this function NULL argument is tested while it is not in rose_route_frame(). Then kernel panic occurs later on when calling ax25cmp() with a NULL ax25_cb argument as reported many times and recently with syzbot. We need to test if ax25 is NULL before using it. Testing: Built kernel with CONFIG_ROSE=y. Signed-off-by: Bernard Pidoux Acked-by: Dmitry Vyukov Reported-by: syzbot+1a2c456a1ea08fa5b5f7@syzkaller.appspotmail.com Cc: "David S. Miller" Cc: Ralf Baechle Cc: Bernard Pidoux Cc: linux-hams@vger.kernel.org Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: David S. Miller net/rose/rose_route.c | 5 +++++ 1 file changed, 5 insertions(+) commit 6571ebce112a21ec9be68ef2f53b96fcd41fd81b Author: Tomonori Sakita Date: Fri Jan 25 11:02:22 2019 +0900 net: altera_tse: fix msgdma_tx_completion on non-zero fill_level case If fill_level was not zero and status was not BUSY, result of "tx_prod - tx_cons - inuse" might be zero. Subtracting 1 unconditionally results invalid negative return value on this case. Make sure not to return an negative value. Signed-off-by: Tomonori Sakita Signed-off-by: Atsushi Nemoto Reviewed-by: Dalon L Westergreen Acked-by: Thor Thayer Signed-off-by: David S. Miller drivers/net/ethernet/altera/altera_msgdma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 63346650c1a94a92be61a57416ac88c0a47c4327 Author: Cong Wang Date: Thu Jan 24 14:18:18 2019 -0800 netrom: switch to sock timer API sk_reset_timer() and sk_stop_timer() properly handle sock refcnt for timer function. Switching to them could fix a refcounting bug reported by syzbot. Reported-and-tested-by: syzbot+defa700d16f1bd1b9a05@syzkaller.appspotmail.com Cc: Ralf Baechle Cc: linux-hams@vger.kernel.org Signed-off-by: Cong Wang Signed-off-by: David S. Miller net/netrom/nr_timer.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) commit c303a9b297fab7ab874fed35f7fd5d9ab559edca Merge: 1fc7f56db7a7 e2612cd496e7 Author: David S. Miller Date: Sun Jan 27 10:30:01 2019 -0800 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2019-01-25 1) Several patches to fix the fallout from the recent tree based policy lookup work. From Florian Westphal. 2) Fix VTI for IPCOMP for 'not compressed' IPCOMP packets. We need an extra IPIP handler to process these packets correctly. From Su Yanjun. 3) Fix validation of template and selector families for MODE_ROUTEOPTIMIZATION with ipv4-in-ipv6 packets. This can lead to a stack-out-of-bounds because flowi4 struct is treated as flowi6 struct. Fix from Florian Westphal. 4) Restore the default behaviour of the xfrm set-mark in the output path. This was changed accidentally when mark setting was extended to the input path. From Benedict Wong. ==================== Signed-off-by: David S. Miller commit 25384ce5f9530def39421597b1457d9462df6455 Author: Max Filippov Date: Sat Jan 26 20:35:18 2019 -0800 xtensa: SMP: limit number of possible CPUs by NR_CPUS This fixes the following warning at boot when the kernel is booted on a board with more CPU cores than was configured in NR_CPUS: smp_init_cpus: Core Count = 8 smp_init_cpus: Core Id = 0 ------------[ cut here ]------------ WARNING: CPU: 0 PID: 0 at include/linux/cpumask.h:121 smp_init_cpus+0x54/0x74 Modules linked in: CPU: 0 PID: 0 Comm: swapper Not tainted 5.0.0-rc3-00015-g1459333f88a0 #124 Call Trace: __warn$part$3+0x6a/0x7c warn_slowpath_null+0x35/0x3c smp_init_cpus+0x54/0x74 setup_arch+0x1c0/0x1d0 start_kernel+0x44/0x310 _startup+0x107/0x107 Signed-off-by: Max Filippov arch/xtensa/kernel/smp.c | 5 +++++ 1 file changed, 5 insertions(+) commit 1fc7f56db7a7c467e46a5d2e2a009d2f337e0338 Merge: c180f1b04be0 b2869f28e147 Author: Linus Torvalds Date: Sun Jan 27 09:21:00 2019 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM fixes from Paolo Bonzini: "Quite a few fixes for x86: nested virtualization save/restore, AMD nested virtualization and virtual APIC, 32-bit fixes, an important fix to restore operation on older processors, and a bunch of hyper-v bugfixes. Several are marked stable. There are also fixes for GCC warnings and for a GCC/objtool interaction" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: x86: Mark expected switch fall-throughs KVM: x86: fix TRACE_INCLUDE_PATH and remove -I. header search paths KVM: selftests: check returned evmcs version range x86/kvm/hyper-v: nested_enable_evmcs() sets vmcs_version incorrectly KVM: VMX: Move vmx_vcpu_run()'s VM-Enter asm blob to a helper function kvm: selftests: Fix region overlap check in kvm_util kvm: vmx: fix some -Wmissing-prototypes warnings KVM: nSVM: clear events pending from svm_complete_interrupts() when exiting to L1 svm: Fix AVIC incomplete IPI emulation svm: Add warning message for AVIC IPI invalid target KVM: x86: WARN_ONCE if sending a PV IPI returns a fatal error KVM: x86: Fix PV IPIs for 32-bit KVM host x86/kvm/hyper-v: recommend using eVMCS only when it is enabled x86/kvm/hyper-v: don't recommend doing reset via synthetic MSR kvm: x86/vmx: Use kzalloc for cached_vmcs12 KVM: VMX: Use the correct field var when clearing VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL KVM: x86: Fix single-step debugging x86/kvm/hyper-v: don't announce GUEST IDLE MSR support commit c180f1b04be01d025aa1e6e53e1a8b6626bd90c4 Merge: 6a2651b55bcf 60d8cd572f65 Author: Linus Torvalds Date: Sun Jan 27 09:18:05 2019 -0800 Merge tag 'dma-mapping-5.0-2' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping fix from Christoph Hellwig: "Fix a xen-swiotlb regression on arm64" * tag 'dma-mapping-5.0-2' of git://git.infradead.org/users/hch/dma-mapping: arm64/xen: fix xen-swiotlb cache flushing commit 6a2651b55bcf5b56177d4ccaeb52adeeadb142ea Merge: 78e372e6509b 11189c1089da Author: Linus Torvalds Date: Sun Jan 27 09:11:51 2019 -0800 Merge tag 'libnvdimm-fixes-5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm fixes from Dan Williams: "A fix for namespace label support for non-Intel NVDIMMs that implement the ACPI standard label method. This has apparently never worked and could wait for v5.1. However it has enough visibility with hardware vendors [1] and distro bug trackers [2], and low enough risk that I decided it should go in for -rc4. The other fixups target the new, for v5.0, nvdimm security functionality. The larger init path fixup closes a memory leak and a potential userspace lockup due to missed notifications. [1] https://github.com/pmem/ndctl/issues/78 [2] https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1811785 These have all soaked in -next for a week with no reported issues. Summary: - Fix support for NVDIMMs that implement the ACPI standard label methods. - Fix error handling for security overwrite (memory leak / userspace hang condition), and another one-line security cleanup" * tag 'libnvdimm-fixes-5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: acpi/nfit: Fix command-supported detection acpi/nfit: Block function zero DSMs libnvdimm/security: Require nvdimm_security_setup_events() to succeed nfit_test: fix security state pull for nvdimm security nfit_test commit 78e372e6509bc2412e86afb11be65185f4c9c568 Merge: 037222ad3f43 141e5dcaa735 Author: Linus Torvalds Date: Sun Jan 27 09:07:03 2019 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: "A fixup for the input_event fix for y2038 Sparc64, and couple other minor fixes" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: input_event - fix the CONFIG_SPARC64 mixup Input: olpc_apsp - assign priv->dev earlier Input: uinput - fix undefined behavior in uinput_validate_absinfo() Input: raspberrypi-ts - fix link error Input: xpad - add support for SteelSeries Stratus Duo Input: input_event - provide override for sparc64 commit 037222ad3f43a45c3a601dabf893efc9264ff5a0 Merge: 7c2614bf7a1f abfd04f738c2 Author: Linus Torvalds Date: Sun Jan 27 08:59:12 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) Count ttl-dropped frames properly in mac80211, from Bob Copeland. 2) Integer overflow in ktime handling of bcm can code, from Oliver Hartkopp. 3) Fix RX desc handling wrt. hw checksumming in ravb, from Simon Horman. 4) Various hash key fixes in hv_netvsc, from Haiyang Zhang. 5) Use after free in ax25, from Eric Dumazet. 6) Several fixes to the SSN support in SCTP, from Xin Long. 7) Do not process frames after a NAPI reschedule in ibmveth, from Thomas Falcon. 8) Fix NLA_POLICY_NESTED arguments, from Johannes Berg. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (42 commits) qed: Revert error handling changes. cfg80211: extend range deviation for DMG cfg80211: reg: remove warn_on for a normal case mac80211: Add attribute aligned(2) to struct 'action' mac80211: don't initiate TDLS connection if station is not associated to AP nl80211: fix NLA_POLICY_NESTED() arguments ibmveth: Do not process frames after calling napi_reschedule net: dev_is_mac_header_xmit() true for ARPHRD_RAWIP net: usb: asix: ax88772_bind return error when hw_reset fail MAINTAINERS: Update cavium networking drivers net/mlx4_core: Fix error handling when initializing CQ bufs in the driver net/mlx4_core: Add masking for a few queries on HCA caps sctp: set flow sport from saddr only when it's 0 sctp: set chunk transport correctly when it's a new asoc sctp: improve the events for sctp stream adding sctp: improve the events for sctp stream reset ip_tunnel: Make none-tunnel-dst tunnel port work with lwtunnel ax25: fix possible use-after-free sfc: suppress duplicate nvmem partition types in efx_ef10_mtd_probe hv_netvsc: fix typos in code comments ... commit 4ea899ead2786a30aaa8181fefa81a3df4ad28f6 Author: Christoph Hellwig Date: Thu Jan 17 08:58:58 2019 -0800 iomap: fix a use after free in iomap_dio_rw Introduce a local wait_for_completion variable to avoid an access to the potentially freed dio struture after dropping the last reference count. Also use the chance to document the completion behavior to make the refcounting clear to the reader of the code. Fixes: ff6a9292e6 ("iomap: implement direct I/O") Reported-by: Chandan Rajendra Reported-by: Darrick J. Wong Signed-off-by: Christoph Hellwig Tested-by: Chandan Rajendra Tested-by: Darrick J. Wong Reviewed-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/iomap.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-) commit 8e47a457321ca1a74ad194ab5dcbca764bc70731 Author: Piotr Jaroszynski Date: Sun Jan 27 08:46:45 2019 -0800 iomap: get/put the page in iomap_page_create/release() migrate_page_move_mapping() expects pages with private data set to have a page_count elevated by 1. This is what used to happen for xfs through the buffer_heads code before the switch to iomap in commit 82cb14175e7d ("xfs: add support for sub-pagesize writeback without buffer_heads"). Not having the count elevated causes move_pages() to fail on memory mapped files coming from xfs. Make iomap compatible with the migrate_page_move_mapping() assumption by elevating the page count as part of iomap_page_create() and lowering it in iomap_page_release(). It causes the move_pages() syscall to misbehave on memory mapped files from xfs. It does not not move any pages, which I suppose is "just" a perf issue, but it also ends up returning a positive number which is out of spec for the syscall. Talking to Michal Hocko, it sounds like returning positive numbers might be a necessary update to move_pages() anyway though. Fixes: 82cb14175e7d ("xfs: add support for sub-pagesize writeback without buffer_heads") Signed-off-by: Piotr Jaroszynski [hch: actually get/put the page iomap_migrate_page() to make it work properly] Signed-off-by: Christoph Hellwig Reviewed-by: Dave Chinner Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/iomap.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit 947b7ac135b16aa60f9141ff72bd494eda0edb5e Author: Jens Axboe Date: Sun Jan 27 06:35:28 2019 -0700 Revert "block: cover another queue enter recursion via BIO_QUEUE_ENTERED" We can't touch a bio after ->make_request_fn(), for all we know it could already have been completed by the time this function returns. This reverts commit 698cef173983b086977e633e46476e0f925ca01e. Reported-by: syzbot+4df6ca820108fd248943@syzkaller.appspotmail.com Signed-off-by: Jens Axboe block/blk-core.c | 11 ----------- block/blk-merge.c | 10 ++++++++++ 2 files changed, 10 insertions(+), 11 deletions(-) commit 7c2614bf7a1fc0da0743129e5b60af82f34cde55 Merge: 2580acb2a1b1 a5f1a81f701c Author: Linus Torvalds Date: Sat Jan 26 15:38:22 2019 -0800 Merge tag '5.0-rc3-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb3 fixes from Steve French: "A set of small smb3 fixes, some fixing various crediting issues discovered during xfstest runs, five for stable" * tag '5.0-rc3-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: print CIFSMaxBufSize as part of /proc/fs/cifs/DebugData smb3: add credits we receive from oplock/break PDUs CIFS: Fix mounts if the client is low on credits CIFS: Do not assume one credit for async responses CIFS: Fix credit calculations in compound mid callback CIFS: Fix credit calculation for encrypted reads with errors CIFS: Fix credits calculations for reads with errors CIFS: Do not reconnect TCP session in add_credits() smb3: Cleanup license mess CIFS: Fix possible hang during async MTU reads and writes cifs: fix memory leak of an allocated cifs_ntsd structure commit 2580acb2a1b12f93f8259ff2053cec455d1d22a7 Merge: 7930851ef10c 9a71ac7e15a7 Author: Linus Torvalds Date: Sat Jan 26 15:27:04 2019 -0800 Merge tag 'vfio-v5.0-rc4' of git://github.com/awilliam/linux-vfio Pull VFIO fixes from Alex Williamson: - cleanup licenses in new files (Thomas Gleixner) - cleanup new compiler warnings (Alexey Kardashevskiy) * tag 'vfio-v5.0-rc4' of git://github.com/awilliam/linux-vfio: vfio-pci/nvlink2: Fix ancient gcc warnings vfio/pci: Cleanup license mess commit 7930851ef10c137c1035d1ef2addfdb3c53a1273 Merge: 6b8f91591665 d67247566450 Author: Linus Torvalds Date: Sat Jan 26 15:03:43 2019 -0800 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Six fixes, all of which appear to have user visible consequences. The DMA one is a regression fix from the merge window and of the others, four are driver specific and one specific to the target code" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: Use explicit access size in ufshcd_dump_regs scsi: tcmu: fix use after free scsi: csiostor: fix NULL pointer dereference in csio_vport_set_state() scsi: lpfc: nvmet: avoid hang / use-after-free when destroying targetport scsi: lpfc: nvme: avoid hang / use-after-free when destroying localport scsi: communicate max segment size to the DMA mapping code commit 6b8f9159166545e576b2bc8a0c984beaeae9cc05 Merge: ba6069759381 8367de2c99a1 Author: Linus Torvalds Date: Sat Jan 26 12:42:41 2019 -0800 Merge tag 'for-linus-20190125' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "A collection of fixes for this release. This contains: - Silence sparse rightfully complaining about non-static wbt functions (Bart) - Fixes for the zoned comments/ioctl documentation (Damien) - direct-io fix that's been lingering for a while (Ernesto) - cgroup writeback fix (Tejun) - Set of NVMe patches for nvme-rdma/tcp (Sagi, Hannes, Raju) - Block recursion tracking fix (Ming) - Fix debugfs command flag naming for a few flags (Jianchao)" * tag 'for-linus-20190125' of git://git.kernel.dk/linux-block: block: Fix comment typo uapi: fix ioctl documentation blk-wbt: Declare local functions static blk-mq: fix the cmd_flag_name array nvme-multipath: drop optimization for static ANA group IDs nvmet-rdma: fix null dereference under heavy load nvme-rdma: rework queue maps handling nvme-tcp: fix timeout handler nvme-rdma: fix timeout handler writeback: synchronize sync(2) against cgroup writeback membership switches block: cover another queue enter recursion via BIO_QUEUE_ENTERED direct-io: allow direct writes to empty inodes commit 6a730fcb9cb472ba2d42b26a50ac65dacdd68882 Author: Darren Hart (VMware) Date: Sat Jan 12 20:27:35 2019 -0800 Documentation/ABI: Correct mlxreg-io KernelVersion for 5.0 The mlxreg-io for the merge window assumed 4.21 as the next kernel version. Replace 4.21 with 5.0. Signed-off-by: Darren Hart (VMware) Reviewed-by: Andy Shevchenko Documentation/ABI/stable/sysfs-driver-mlxreg-io | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit f36c1f9a8dfd6a78e6c3fe7aff5e722b84307597 Author: Jisheng Zhang Date: Fri Jan 25 07:29:20 2019 +0000 i3c: master: dw: fix deadlock In dw_i3c_master_irq_handler(), we already have gotten &master->xferqueue.lock, if we try to get the same lock again in dw_i3c_master_dequeue_xfer(), deadlock happens. We fix this issue by introduing dw_i3c_master_dequeue_xfer_locked() which does all what dw_i3c_master_dequeue_xfer() does without trying to lock &master->xferqueue.lock. Signed-off-by: Jisheng Zhang Acked-by: Vitor Soares  Signed-off-by: Boris Brezillon drivers/i3c/master/dw-i3c-master.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) commit 687cffd3450911b1b7449fd6c30f598b35666b41 Author: Corentin Labbe Date: Wed Jan 23 09:49:18 2019 +0000 xtensa: rename BUILTIN_DTB to BUILTIN_DTB_SOURCE When building some xtensa config, I hit the following warning: drivers/staging/mt7621-dts/Kconfig:4:warning: 'BUILTIN_DTB' has wrong type. 'select' only accept arguments of bool and tristate type It is due to some arch use BUILTIN_DTB as a flag for the need to builtin dtb but xtensa use it as a string for which dtb to bulltin. But for this (which dtb to build), it is better to use BUILTIN_DTB_SOURCE like other arch do. Signed-off-by: Corentin Labbe Signed-off-by: Max Filippov arch/xtensa/Kconfig | 2 +- arch/xtensa/boot/dts/Makefile | 6 +++--- arch/xtensa/configs/audio_kc705_defconfig | 2 +- arch/xtensa/configs/cadence_csp_defconfig | 2 +- arch/xtensa/configs/generic_kc705_defconfig | 2 +- arch/xtensa/configs/nommu_kc705_defconfig | 2 +- arch/xtensa/configs/smp_lx200_defconfig | 2 +- 7 files changed, 9 insertions(+), 9 deletions(-) commit ad33cc805223614166c8f4081288f0b3c4b0862d Author: Corentin Labbe Date: Fri Jan 18 13:45:27 2019 +0000 xtensa: Fix typo use space=>user space This patch fix a simple typo. Signed-off-by: Corentin Labbe Signed-off-by: Max Filippov arch/xtensa/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit eb271710ec0241a99d1cfcd2a887172ac0858aa9 Author: Max Filippov Date: Thu Jan 24 14:06:49 2019 -0800 drivers/irqchip: xtensa-mx: fix mask and unmask xtensa_irq_mask and xtensa_irq_unmask don't do the right thing when called for the first two external IRQs. Treat these IRQs as per-CPU IRQs. Signed-off-by: Max Filippov drivers/irqchip/irq-xtensa-mx.c | 34 ++++++++++++++++++++-------------- 1 file changed, 20 insertions(+), 14 deletions(-) commit bb6652363be0415578ec4a8794cbe9403db9c336 Author: Max Filippov Date: Thu Jan 24 16:51:28 2019 -0800 drivers/irqchip: xtensa: add warning to irq_retrigger XEA2 and MX PIC can only retrigger software interrupts. Issue a warning if an interrupt of any other type is retriggered. Signed-off-by: Max Filippov drivers/irqchip/irq-xtensa-mx.c | 6 +++++- drivers/irqchip/irq-xtensa-pic.c | 6 +++++- 2 files changed, 10 insertions(+), 2 deletions(-) commit 8b1c42cdd7181200dc1fff39dcb6ac1a3fac2c25 Author: Max Filippov Date: Sat Jan 19 00:26:48 2019 -0800 xtensa: SMP: mark each possible CPU as present Otherwise it is impossible to enable CPUs after booting with 'maxcpus' parameter. Signed-off-by: Max Filippov arch/xtensa/kernel/smp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 306b38305c0f86de7f17c5b091a95451dcc93d7d Author: Max Filippov Date: Thu Jan 24 17:16:11 2019 -0800 xtensa: smp_lx200_defconfig: fix vectors clash Secondary CPU reset vector overlaps part of the double exception handler code, resulting in weird crashes and hangups when running user code. Move exception vectors one page up so that they don't clash with the secondary CPU reset vector. Signed-off-by: Max Filippov arch/xtensa/configs/smp_lx200_defconfig | 1 + 1 file changed, 1 insertion(+) commit 32a7726c4f4aadfabdb82440d84f88a5a2c8fe13 Author: Max Filippov Date: Fri Dec 21 08:26:20 2018 -0800 xtensa: SMP: fix secondary CPU initialization - add missing memory barriers to the secondary CPU synchronization spin loops; add comment to the matching memory barrier in the boot_secondary and __cpu_die functions; - use READ_ONCE/WRITE_ONCE to access cpu_start_id/cpu_start_ccount instead of reading/writing them directly; - re-initialize cpu_running every time before starting secondary CPU to flush possible previous CPU startup results. Signed-off-by: Max Filippov arch/xtensa/kernel/head.S | 5 ++++- arch/xtensa/kernel/smp.c | 34 +++++++++++++++++++++------------- 2 files changed, 25 insertions(+), 14 deletions(-) commit abfd04f738c2625f63e04c8fc7cadb3b7a70d580 Author: David S. Miller Date: Fri Jan 25 15:32:28 2019 -0800 qed: Revert error handling changes. This is new code and not bug fixes. This reverts all changes added by merge commit 8fb18be93efd7292d6ee403b9f61af1008239639 Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed.h | 5 +- drivers/net/ethernet/qlogic/qed/qed_dev.c | 158 ++++++------- drivers/net/ethernet/qlogic/qed/qed_dev_api.h | 12 - drivers/net/ethernet/qlogic/qed/qed_hsi.h | 2 +- drivers/net/ethernet/qlogic/qed/qed_hw.c | 11 - drivers/net/ethernet/qlogic/qed/qed_int.c | 126 +++++------ drivers/net/ethernet/qlogic/qed/qed_int.h | 3 - drivers/net/ethernet/qlogic/qed/qed_main.c | 30 --- drivers/net/ethernet/qlogic/qed/qed_mcp.c | 115 ---------- drivers/net/ethernet/qlogic/qed/qed_mcp.h | 42 ---- drivers/net/ethernet/qlogic/qed/qed_reg_addr.h | 2 - drivers/net/ethernet/qlogic/qed/qed_spq.c | 22 -- drivers/net/ethernet/qlogic/qed/qed_sriov.c | 9 +- drivers/net/ethernet/qlogic/qede/qede.h | 3 - drivers/net/ethernet/qlogic/qede/qede_main.c | 300 +++++-------------------- drivers/net/ethernet/qlogic/qede/qede_rdma.c | 64 ++---- include/linux/qed/qed_if.h | 20 -- include/linux/qed/qede_rdma.h | 21 +- 18 files changed, 202 insertions(+), 743 deletions(-) commit ba606975938179b1e893e44e190d0001de8e5262 Merge: d488bd21a4b2 f3716b8ae934 Author: Linus Torvalds Date: Fri Jan 25 13:07:03 2019 -1000 Merge tag 'mmc-v5.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: - sdhci-acpi: Fixup build dependency for PCI - sdhci-omap: Resolve Kconfig warnings on keystone - sdhci-iproc: Propagate errors from DT parsing - meson-gx: Fixup IRQ handling in release callback - meson-gx: Use signal re-sampling to fixup tuning - dw_mmc-bluefield: Fix the license information * tag 'mmc-v5.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: dw_mmc-bluefield: : Fix the license information mmc: meson-gx: enable signal re-sampling together with tuning mmc: sdhci-iproc: handle mmc_of_parse() errors during probe mmc: meson-gx: Free irq in release() callback mmc: host: Fix Kconfig warnings on keystone_defconfig mmc: sdhci-acpi: Make PCI dependency explicit commit d488bd21a4b2bf6b3f236f22ed213c61e74c878b Merge: 96f18cb89ffa 52768f324241 Author: Linus Torvalds Date: Fri Jan 25 13:03:34 2019 -1000 Merge tag 'char-misc-5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are some small char and misc driver fixes to resolve some reported issues, as well as a number of binderfs fixups that were found after auditing the filesystem code by Al Viro. As binderfs hasn't been in a previous release yet, it's good to get these in now before the first users show up. All of these have been in linux-next for a bit with no reported issues" * tag 'char-misc-5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (26 commits) i3c: master: Fix an error checking typo in 'cdns_i3c_master_probe()' binderfs: switch from d_add() to d_instantiate() binderfs: drop lock in binderfs_binder_ctl_create binderfs: kill_litter_super() before cleanup binderfs: rework binderfs_binder_device_create() binderfs: rework binderfs_fill_super() binderfs: prevent renaming the control dentry binderfs: remove outdated comment binderfs: use __u32 for device numbers binderfs: use correct include guards in header misc: pvpanic: fix warning implicit declaration char/mwave: fix potential Spectre v1 vulnerability misc: ibmvsm: Fix potential NULL pointer dereference binderfs: fix error return code in binderfs_fill_super() mei: me: add denverton innovation engine device IDs mei: me: mark LBG devices as having dma support mei: dma: silent the reject message binderfs: handle !CONFIG_IPC_NS builds binderfs: reserve devices for initial mount binderfs: rename header to binderfs.h ... commit 96f18cb89ffa4bc6dafa447c9493449809fbb318 Merge: 473721f9c649 31eb79db420a Author: Linus Torvalds Date: Fri Jan 25 13:02:12 2019 -1000 Merge tag 'staging-5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fixes from Greg KH: "Here are some small staging driver fixes for 5.0-rc4. They resolve some reported bugs and add a new device id for one driver. Nothing major at all, but all good to have. All of these have been in linux-next for a while with no reported issues" * tag 'staging-5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: android: ion: Support cpu access during dma_buf_detach staging: rtl8723bs: Fix build error with Clang when inlining is disabled staging: rtl8188eu: Add device code for D-Link DWA-121 rev B1 staging: vchiq: Fix local event signalling Staging: wilc1000: unlock on error in init_chip() staging: wilc1000: fix memory leak in wilc_add_rx_gtk staging: wilc1000: fix registration frame size commit 473721f9c6494c04991b9a4cb787361d941d0d7d Merge: b48cef32b6a5 815d835b7ba4 Author: Linus Torvalds Date: Fri Jan 25 12:58:40 2019 -1000 Merge tag 'tty-5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial driver fixes from Greg KH: "Here are a number of small tty core and serial driver fixes for 5.0-rc4 to resolve some reported issues. Nothing major, the small serial driver fixes, a tty core fixup for a crash that was reported, and some good vt fixes from Nicolas Pitre as he seems to be auditing that chunk of code a lot lately. All of these have been in linux-next for a while with no reported issues" * tag 'tty-5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial: fsl_lpuart: fix maximum acceptable baud rate with over-sampling tty: serial: qcom_geni_serial: Allow mctrl when flow control is disabled tty: Handle problem if line discipline does not have receive_buf vgacon: unconfuse vc_origin when using soft scrollback vt: invoke notifier on screen size change vt: always call notifier with the console lock held vt: make vt_console_print() compatible with the unicode screen buffer tty/n_hdlc: fix __might_sleep warning serial: 8250: Fix serial8250 initialization crash uart: Fix crash in uart_write and uart_put_char commit b48cef32b6a5103dddf52aadbeda90ab0f7ef673 Merge: d73aba1115cf 4f9b83892781 Author: Linus Torvalds Date: Fri Jan 25 12:57:09 2019 -1000 Merge tag 'usb-5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB/PHY fixes from Greg KH: "Here are a number of small USB and PHY driver fixes for 5.0-rc4. Nothing major at all, just the usual selection of USB gadget bugfixes, some new USB serial driver ids, some SPDX fixes, and some PHY driver fixes for reported issues. All of these have been in linux-next for a while with no reported issues" * tag 'usb-5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: USB: serial: keyspan_usa: add proper SPDX lines for .h files USB: EHCI: ehci-mv: add MODULE_DEVICE_TABLE USB: leds: fix regression in usbport led trigger usb: chipidea: fix static checker warning for NULL pointer MAINTAINERS: email address update in MAINTAINERS entries USB: usbip: delete README file USB: serial: pl2303: add new PID to support PL2303TB usb: dwc2: gadget: Fix Remote Wakeup interrupt bit clearing phy: ath79-usb: Fix the main reset name to match the DT binding phy: ath79-usb: Fix the power on error path phy: fix build breakage: add PHY_MODE_SATA phy: ti: ensure priv is not null before dereferencing it USB: serial: ftdi_sio: fix GPIO not working in autosuspend usb: gadget: Potential NULL dereference on allocation error usb: dwc3: gadget: Fix the uninitialized link_state when udc starts usb: dwc3: gadget: Clear req->needs_extra_trb flag on cleanup usb: dwc3: gadget: synchronize_irq dwc irq in suspend USB: serial: simple: add Motorola Tetra TPG2200 device id commit ed5f13261cb65b02c611ae9971677f33581d4286 Author: Kees Cook Date: Fri Jan 25 10:33:59 2019 -0800 selftests/seccomp: Enhance per-arch ptrace syscall skip tests Passing EPERM during syscall skipping was confusing since the test wasn't actually exercising the errno evaluation -- it was just passing a literal "1" (EPERM). Instead, expand the tests to check both direct value returns (positive, 45000 in this case), and errno values (negative, -ESRCH in this case) to check both fake success and fake failure during syscall skipping. Reported-by: Colin Ian King Fixes: a33b2d0359a0 ("selftests/seccomp: Add tests for basic ptrace actions") Cc: stable@vger.kernel.org Signed-off-by: Kees Cook Signed-off-by: Shuah Khan tools/testing/selftests/seccomp/seccomp_bpf.c | 72 +++++++++++++++++++++------ 1 file changed, 57 insertions(+), 15 deletions(-) commit 7e35a5940fab59eeccb9162eb2389342e0a87e53 Author: Sean Young Date: Thu Jan 17 15:29:38 2019 +0000 selftests: Use lirc.h from kernel tree, not from system When the system lirc.h is older than v4.16, you will get errors like: ir_loopback.c:32:16: error: field ‘proto’ has incomplete type enum rc_proto proto; Cc: Shuah Khan Signed-off-by: Sean Young Signed-off-by: Shuah Khan tools/testing/selftests/ir/Makefile | 2 ++ 1 file changed, 2 insertions(+) commit 2b531b6137834a55857a337ac17510d6436b6fbb Author: Colin Ian King Date: Thu Jan 10 12:38:02 2019 +0000 selftests: cpu-hotplug: fix case where CPUs offline > CPUs present The cpu-hotplug test assumes that we can offline the maximum CPU as described by /sys/devices/system/cpu/offline. However, in the case where the number of CPUs exceeds like kernel configuration then the offline count can be greater than the present count and we end up trying to test the offlining of a CPU that is not available to offline. Fix this by testing the maximum present CPU instead. Also, the test currently offlines the CPU and does not online it, so fix this by onlining the CPU after the test. Fixes: d89dffa976bc ("fault-injection: add selftests for cpu and memory hotplug") Signed-off-by: Colin Ian King Signed-off-by: Shuah Khan tools/testing/selftests/cpu-hotplug/cpu-on-off-test.sh | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) commit 6ce966fd2671899a48037abe7bf1df80a5adf029 Author: Or Gerlitz Date: Tue Jan 1 12:44:52 2019 +0200 net/mlx5e: Unblock setting vid 0 for VFs through the uplink rep It turns out that libvirt uses 0-vid as a default if no vlan was set for the guest (which is the case for switchdev mode) and errs if we disallow that: error: Failed to start domain vm75 error: Cannot set interface MAC/vlanid to 6a:66:2d:48:92:c2/0 \ for ifname enp59s0f0 vf 0: Operation not supported So allow this in order not to break existing systems. Signed-off-by: Or Gerlitz Reported-by: Maor Dickman Reviewed-by: Gavi Teitz Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit c12ecc2305648822970002871230979359edb2c0 Author: Or Gerlitz Date: Wed Apr 25 17:32:04 2018 +0300 net/mlx5e: Move to use common phys port names for vport representors With VF LAG commit 491c37e49b48 "net/mlx5e: In case of LAG, one switch parent id is used for all representors", both uplinks and all the VFs (on both of them) get the same switchdev id. This cause the provisioning system method to identify the rep of a given VF from the parent PF PCI device using switchev id and physical port name to break, since VFm of PF0 will have the (id, name) as VFm of PF1. To fix that, we align to use the framework agreed upstream and set by nfp commit 168c478e107e "nfp: wire get_phys_port_name on representors": $ cat /sys/class/net/eth4_*/phys_port_name p0 pf0vf0 pf0vf1 Now, the names will be different, e.g. pf0vf0 vs. pf1vf0. Fixes: 491c37e49b48 ("net/mlx5e: In case of LAG, one switch parent id is used for all representors") Signed-off-by: Or Gerlitz Reported-by: Waleed Musa Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 12 ++++++++++-- drivers/net/ethernet/mellanox/mlx5/core/lag.c | 21 +++++++++++++++++++++ drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h | 2 ++ 3 files changed, 33 insertions(+), 2 deletions(-) commit 9d2cbdc5d334967c35b5f58c7bf3208e17325647 Author: Aya Levin Date: Mon Dec 24 09:48:42 2018 +0200 net/mlx5e: Allow MAC invalidation while spoofchk is ON Prior to this patch the driver prohibited spoof checking on invalid MAC. Now the user can set this configuration if it wishes to. This is required since libvirt might invalidate the VF Mac by setting it to zero, while spoofcheck is ON. Fixes: 1ab2068a4c66 ("net/mlx5: Implement vports admin state backup/restore") Signed-off-by: Aya Levin Reviewed-by: Eran Ben Elisha Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 18 ++++++------------ 1 file changed, 6 insertions(+), 12 deletions(-) commit 33814e5d127e21f53b52e17b0722c1b57d4f4d29 Author: Moni Shoua Date: Wed Dec 26 19:21:21 2018 +0200 net/mlx5: Take lock with IRQs disabled to avoid deadlock The lock in qp_table might be taken from process context or from interrupt context. This may lead to a deadlock unless it is taken with IRQs disabled. Discovered by lockdep ================================ WARNING: inconsistent lock state 4.20.0-rc6 -------------------------------- inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} python/12572 [HC1[1]:SC0[0]:HE0:SE1] takes: 00000000052a4df4 (&(&table->lock)->rlock#2){?.+.}, /0x50 [mlx5_core] {HARDIRQ-ON-W} state was registered at: _raw_spin_lock+0x33/0x70 mlx5_get_rsc+0x1a/0x50 [mlx5_core] mlx5_ib_eqe_pf_action+0x493/0x1be0 [mlx5_ib] process_one_work+0x90c/0x1820 worker_thread+0x87/0xbb0 kthread+0x320/0x3e0 ret_from_fork+0x24/0x30 irq event stamp: 103928 hardirqs last enabled at (103927): [] nk+0x1a/0x1c hardirqs last disabled at (103928): [] unk+0x1a/0x1c softirqs last enabled at (103924): [] tcp_sendmsg+0x31/0x40 softirqs last disabled at (103922): [] 80 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&(&table->lock)->rlock#2); lock(&(&table->lock)->rlock#2); *** DEADLOCK *** Fixes: 032080ab43ac ("IB/mlx5: Lock QP during page fault handling") Signed-off-by: Moni Shoua Reviewed-by: Leon Romanovsky Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/qp.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 92b32772940b981240f6471a70c0fdbff23983ea Author: Shay Agroskin Date: Sun Jan 6 17:55:59 2019 +0200 net/mlx5e: Fix wrong private flag usage causing checksum disable MLX5E_PFLAG_* definitions were changed from bitmask to enumerated values. However, in mlx5e_open_rq(), the proper API (MLX5E_GET_PFLAG macro) was not used to read the flag value of MLX5E_PFLAG_RX_NO_CSUM_COMPLETE. Fixed it. Fixes: 8ff57c18e9f6 ("net/mlx5e: Improve ethtool private-flags code structure") Signed-off-by: Shay Agroskin Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4e046de0f50e04acd48eb373d6a9061ddf014e0c Author: Bodong Wang Date: Sun Jan 13 22:47:26 2019 -0600 Revert "net/mlx5e: E-Switch, Initialize eswitch only if eswitch manager" This reverts commit 5f5991f36dce1e69dd8bd7495763eec2e28f08e7. With the original commit, eswitch instance will not be initialized for a function which is vport group manager but not eswitch manager such as host PF on SmartNIC (BlueField) card. This will result in a kernel crash when such a vport group manager is trying to access vports in its group. E.g, PF vport manager (not eswitch manager) tries to configure the MAC of its VF vport, a kernel trace will happen similar as bellow: BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 ... RIP: 0010:mlx5_eswitch_get_vport_config+0xc/0x180 [mlx5_core] ... Fixes: 5f5991f36dce ("net/mlx5e: E-Switch, Initialize eswitch only if eswitch manager") Signed-off-by: Bodong Wang Reported-by: Yuval Avnery Reviewed-by: Daniel Jurgens Reviewed-by: Or Gerlitz Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 1ca1c87f91d9dc50d6a38e2177b2032996e7901c Author: Zhou Yanjie Date: Fri Jan 25 02:22:15 2019 +0800 DTS: CI20: Fix bugs in ci20's device tree. According to the Schematic, the hardware of ci20 leads to uart3, but not to uart2. Uart2 is miswritten in the original code. Signed-off-by: Zhou Yanjie Signed-off-by: Paul Burton Cc: linux-mips Cc: linux-kernel Cc: devicetree@vger.kernel.org Cc: robh+dt@kernel.org Cc: ralf@linux-mips.org Cc: jhogan@kernel.org Cc: mark.rutland@arm.com Cc: malat@debian.org Cc: ezequiel@collabora.co.uk Cc: ulf.hansson@linaro.org Cc: syq Cc: jiaxun.yang arch/mips/boot/dts/ingenic/ci20.dts | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 6ab4aba00f811a5265acc4d3eb1863bb3ca60562 Author: Feras Daoud Date: Thu Jan 24 14:33:19 2019 +0200 IB/ipoib: Fix for use-after-free in ipoib_cm_tx_start The following BUG was reported by kasan: BUG: KASAN: use-after-free in ipoib_cm_tx_start+0x430/0x1390 [ib_ipoib] Read of size 80 at addr ffff88034c30bcd0 by task kworker/u16:1/24020 Workqueue: ipoib_wq ipoib_cm_tx_start [ib_ipoib] Call Trace: dump_stack+0x9a/0xeb print_address_description+0xe3/0x2e0 kasan_report+0x18a/0x2e0 ? ipoib_cm_tx_start+0x430/0x1390 [ib_ipoib] memcpy+0x1f/0x50 ipoib_cm_tx_start+0x430/0x1390 [ib_ipoib] ? kvm_clock_read+0x1f/0x30 ? ipoib_cm_skb_reap+0x610/0x610 [ib_ipoib] ? __lock_is_held+0xc2/0x170 ? process_one_work+0x880/0x1960 ? process_one_work+0x912/0x1960 process_one_work+0x912/0x1960 ? wq_pool_ids_show+0x310/0x310 ? lock_acquire+0x145/0x440 worker_thread+0x87/0xbb0 ? process_one_work+0x1960/0x1960 kthread+0x314/0x3d0 ? kthread_create_worker_on_cpu+0xc0/0xc0 ret_from_fork+0x3a/0x50 Allocated by task 0: kasan_kmalloc+0xa0/0xd0 kmem_cache_alloc_trace+0x168/0x3e0 path_rec_create+0xa2/0x1f0 [ib_ipoib] ipoib_start_xmit+0xa98/0x19e0 [ib_ipoib] dev_hard_start_xmit+0x159/0x8d0 sch_direct_xmit+0x226/0xb40 __dev_queue_xmit+0x1d63/0x2950 neigh_update+0x889/0x1770 arp_process+0xc47/0x21f0 arp_rcv+0x462/0x760 __netif_receive_skb_core+0x1546/0x2da0 netif_receive_skb_internal+0xf2/0x590 napi_gro_receive+0x28e/0x390 ipoib_ib_handle_rx_wc_rss+0x873/0x1b60 [ib_ipoib] ipoib_rx_poll_rss+0x17d/0x320 [ib_ipoib] net_rx_action+0x427/0xe30 __do_softirq+0x28e/0xc42 Freed by task 26680: __kasan_slab_free+0x11d/0x160 kfree+0xf5/0x360 ipoib_flush_paths+0x532/0x9d0 [ib_ipoib] ipoib_set_mode_rss+0x1ad/0x560 [ib_ipoib] set_mode+0xc8/0x150 [ib_ipoib] kernfs_fop_write+0x279/0x440 __vfs_write+0xd8/0x5c0 vfs_write+0x15e/0x470 ksys_write+0xb8/0x180 do_syscall_64+0x9b/0x420 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff88034c30bcc8 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 8 bytes inside of 512-byte region [ffff88034c30bcc8, ffff88034c30bec8) The buggy address belongs to the page: The following race between change mode and xmit flow is the reason for this use-after-free: Change mode Send packet 1 to GID XX Send packet 2 to GID XX | | | start | | | | | | | | | Create new path for GID XX | | and update neigh path | | | | | | | | | | flush_paths | | | | queue_work(cm.start_task) | | Path for GID XX not found | create new path | | start_task runs with old released path There is no locking to protect the lifetime of the path through the ipoib_cm_tx struct, so delete it entirely and always use the newly looked up path under the priv->lock. Fixes: 546481c2816e ("IB/ipoib: Fix memory corruption in ipoib cm mode connect flow") Signed-off-by: Feras Daoud Reviewed-by: Erez Shitrit Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/ulp/ipoib/ipoib.h | 1 - drivers/infiniband/ulp/ipoib/ipoib_cm.c | 3 +-- 2 files changed, 1 insertion(+), 3 deletions(-) commit 70999ec1c9d3f783a7232973cfc26971e5732758 Author: Paul Cercueil Date: Fri Jan 25 15:12:45 2019 -0300 MIPS: DTS: jz4740: Correct interrupt number of DMA core The interrupt number set in the devicetree node of the DMA driver was wrong. Signed-off-by: Paul Cercueil Signed-off-by: Paul Burton Cc: Rob Herring Cc: Mark Rutland Cc: Ralf Baechle Cc: James Hogan Cc: devicetree@vger.kernel.org Cc: linux-mips@vger.kernel.org Cc: linux-kernel@vger.kernel.org arch/mips/boot/dts/ingenic/jz4740.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 517952756ed3027a9b776e331985320a829b9f62 Merge: e95d22c69b2c 93183bdbe73b Author: David S. Miller Date: Fri Jan 25 10:59:36 2019 -0800 Merge tag 'mac80211-for-davem-2019-01-25' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== Just a few small fixes: * avoid trying to operate TDLS when not connection, this is not valid and led to issues * count TTL-dropped frames in mesh better * deal with new WiGig channels in regulatory code * remove a WARN_ON() that can trigger due to benign races during device/driver registration * fix nested netlink policy maxattrs (syzkaller) * fix hwsim n_limits (syzkaller) * propagate __aligned(2) to a surrounding struct * return proper error in virt_wifi error path ==================== Signed-off-by: David S. Miller commit f8ade8e2429758efa1eddf0a6e2cc936714afc8d Author: Yishai Hadas Date: Thu Jan 24 15:00:07 2019 +0200 IB/uverbs: Fix ioctl query port to consider device disassociation Methods cannot peak into the ufile, the only way to get a ucontext and hence a device is via the ib_uverbs_get_ucontext() call or inspecing a locked uobject. Otherwise during/after disassociation the pointers may be null or free'd. BUG: unable to handle kernel NULL pointer dereference at 0000000000000078 PGD 800000005ece6067 P4D 800000005ece6067 PUD 5ece7067 PMD 0 Oops: 0000 [#1] SMP PTI CPU: 0 PID: 10631 Comm: ibv_ud_pingpong Tainted: GW OE 4.20.0-rc6+ #3 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 RIP: 0010:ib_uverbs_handler_UVERBS_METHOD_QUERY_PORT+0x53/0x191 [ib_uverbs] Code: 80 00 00 00 31 c0 48 8b 47 40 48 8d 5c 24 38 48 8d 6c 24 08 48 89 df 48 8b 40 08 4c 8b a0 18 03 00 00 31 c0 f3 48 ab 48 89 ef <49> 83 7c 24 78 00 b1 06 f3 48 ab 0f 84 89 00 00 00 45 31 c9 31 d2 RSP: 0018:ffffb54802ccfb10 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffb54802ccfb48 RCX:0000000000000000 RDX: fffffffffffffffa RSI: ffffb54802ccfcf8 RDI:ffffb54802ccfb18 RBP: ffffb54802ccfb18 R08: ffffb54802ccfd18 R09:0000000000000000 R10: 0000000000000000 R11: 00000000000000d0 R12:0000000000000000 R13: ffffb54802ccfcb0 R14: ffffb54802ccfc48 R15:ffff9f736e0059a0 FS: 00007f55a6bd7740(0000) GS:ffff9f737ba00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000078 CR3: 0000000064214000 CR4:00000000000006f0 Call Trace: ib_uverbs_cmd_verbs.isra.5+0x94d/0xa60 [ib_uverbs] ? copy_port_attr_to_resp+0x120/0x120 [ib_uverbs] ? arch_tlb_finish_mmu+0x16/0xc0 ? tlb_finish_mmu+0x1f/0x30 ? unmap_region+0xd9/0x120 ib_uverbs_ioctl+0xbc/0x120 [ib_uverbs] do_vfs_ioctl+0xa9/0x620 ? __do_munmap+0x29f/0x3a0 ksys_ioctl+0x60/0x90 __x64_sys_ioctl+0x16/0x20 do_syscall_64+0x5b/0x180 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f55a62cb567 Fixes: 641d1207d2ed ("IB/core: Move query port to ioctl") Signed-off-by: Yishai Hadas Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/core/uverbs_std_types_device.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit c1b03c25f5c1503e2db3ac1c0e12ef3e054fa065 Author: Mark Bloch Date: Thu Jan 24 14:33:32 2019 +0200 RDMA/mlx5: Fix flow creation on representors The intention of the flow_is_supported was to disable the entire tree and methods that allow raw flow creation, but the grammar syntax has this disable the entire UVERBS_FLOW object. Since the method requires a MLX5_IB_OBJECT_FLOW_MATCHER there is no need to do anything, as it is automatically disabled when matchers are disabled. This restores the ability to create flow steering rules on representors via regular verbs. Fixes: a1462351b590 ("RDMA/mlx5: Fail early if user tries to create flows on IB representors") Signed-off-by: Mark Bloch Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/mlx5/flow.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 425784aa5b029eeb80498c73a68f62c3ad1d3b3f Author: Yishai Hadas Date: Thu Jan 24 14:33:12 2019 +0200 IB/uverbs: Fix OOPs upon device disassociation The async_file might be freed before the disassociation has been ended, causing qp shutdown to use after free on it. Since uverbs_destroy_ufile_hw is not a fence, it returns if a disassociation is ongoing in another thread. It has to be written this way to avoid deadlock. However this means that the ufile FD close cannot destroy anything that may still be used by an active kref, such as the the async_file. To fix that move the kref_put() to be in ib_uverbs_release_file(). BUG: unable to handle kernel paging request at ffffffffba682787 PGD bc80e067 P4D bc80e067 PUD bc80f063 PMD 1313df163 PTE 80000000bc682061 Oops: 0003 [#1] SMP PTI CPU: 1 PID: 32410 Comm: bash Tainted: G OE 4.20.0-rc6+ #3 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 RIP: 0010:__pv_queued_spin_lock_slowpath+0x1b3/0x2a0 Code: 98 83 e2 60 49 89 df 48 8b 04 c5 80 18 72 ba 48 8d ba 80 32 02 00 ba 00 80 00 00 4c 8d 65 14 41 bd 01 00 00 00 48 01 c7 85 d2 <48> 89 2f 48 89 fb 74 14 8b 45 08 85 c0 75 42 84 d2 74 6b f3 90 83 RSP: 0018:ffffc1bbc064fb58 EFLAGS: 00010006 RAX: ffffffffba65f4e7 RBX: ffff9f209c656c00 RCX: 0000000000000001 RDX: 0000000000008000 RSI: 0000000000000000 RDI: ffffffffba682787 RBP: ffff9f217bb23280 R08: 0000000000000001 R09: 0000000000000000 R10: ffff9f209d2c7800 R11: ffffffffffffffe8 R12: ffff9f217bb23294 R13: 0000000000000001 R14: 0000000000000000 R15: ffff9f209c656c00 FS: 00007fac55aad740(0000) GS:ffff9f217bb00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffba682787 CR3: 000000012f8e0000 CR4: 00000000000006e0 Call Trace: _raw_spin_lock_irq+0x27/0x30 ib_uverbs_release_uevent+0x1e/0xa0 [ib_uverbs] uverbs_free_qp+0x7e/0x90 [ib_uverbs] destroy_hw_idr_uobject+0x1c/0x50 [ib_uverbs] uverbs_destroy_uobject+0x2e/0x180 [ib_uverbs] __uverbs_cleanup_ufile+0x73/0x90 [ib_uverbs] uverbs_destroy_ufile_hw+0x5d/0x120 [ib_uverbs] ib_uverbs_remove_one+0xea/0x240 [ib_uverbs] ib_unregister_device+0xfb/0x200 [ib_core] mlx5_ib_remove+0x51/0xe0 [mlx5_ib] mlx5_remove_device+0xc1/0xd0 [mlx5_core] mlx5_unregister_device+0x3d/0xb0 [mlx5_core] remove_one+0x2a/0x90 [mlx5_core] pci_device_remove+0x3b/0xc0 device_release_driver_internal+0x16d/0x240 unbind_store+0xb2/0x100 kernfs_fop_write+0x102/0x180 __vfs_write+0x36/0x1a0 ? __alloc_fd+0xa9/0x170 ? set_close_on_exec+0x49/0x70 vfs_write+0xad/0x1a0 ksys_write+0x52/0xc0 do_syscall_64+0x5b/0x180 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7fac551aac60 Cc: # 4.2 Fixes: 036b10635739 ("IB/uverbs: Enable device removal when there are active user space applications") Signed-off-by: Yishai Hadas Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/core/uverbs_main.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit ae662eec8a515ab550524e04c793b5ddf1aae3a1 Author: Alexandre Ghiti Date: Mon Dec 10 06:21:46 2018 +0000 riscv: Adjust mmap base address at a third of task size This ratio is the most used among all other architectures and make icache_hygiene libhugetlbfs test pass: this test mmap lots of hugepages whose addresses, without this patch, reach the end of the process user address space. Signed-off-by: Alexandre Ghiti Reviewed-by: Christoph Hellwig Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/processor.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e190161f96b88ffae870405fd6c3fdd1d2e7f98d Author: Takashi Iwai Date: Fri Jan 25 17:11:32 2019 +0100 ALSA: pcm: Fix tight loop of OSS capture stream When the trigger=off is passed for a PCM OSS stream, it sets the start_threshold of the given substream to the boundary size, so that it won't be automatically started. This can be problematic for a capture stream, unfortunately, as detected by syzkaller. The scenario is like the following: - In __snd_pcm_lib_xfer() that is invoked from snd_pcm_oss_read() loop, we have a check whether the stream was already started or the stream can be auto-started. - The function at this check returns 0 with trigger=off since we explicitly disable the auto-start. - The loop continues and repeats calling __snd_pcm_lib_xfer() tightly, which may lead to an RCU stall. This patch fixes the bug by simply allowing the wait for non-started stream in the case of OSS capture. For native usages, it's supposed to be done by the caller side (which is user-space), hence it returns zero like before. (In theory, __snd_pcm_lib_xfer() could wait even for the native API usage cases, too; but I'd like to stay in a safer side for not breaking the existing stuff for now.) Reported-by: syzbot+fbe0496f92a0ce7b786c@syzkaller.appspotmail.com Cc: Signed-off-by: Takashi Iwai sound/core/pcm_lib.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit 9e6966646b6bc5078d579151b90016522d4ff2cb Author: Olek Poplavsky Date: Thu Jan 24 23:30:03 2019 -0500 ALSA: usb-audio: Add Opus #3 to quirks for native DSD support This patch adds quirk VID/PID IDs for the Opus #3 DAP (made by 'The Bit') in order to enable Native DSD support. [ NOTE: this could be handled in the generic way with fp->dvd_raw if we add 0x10cb to the vendor whitelist, but since 0x10cb shows a different vendor name (Erantech), put to the individual entry at this time -- tiwai ] Signed-off-by: Olek Poplavsky Cc: Signed-off-by: Takashi Iwai sound/usb/quirks.c | 1 + 1 file changed, 1 insertion(+) commit b2869f28e1476cd705bb28c58fd01b0bd661bb99 Author: Gustavo A. R. Silva Date: Fri Jan 25 12:23:17 2019 -0600 KVM: x86: Mark expected switch fall-throughs In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. This patch fixes the following warnings: arch/x86/kvm/lapic.c:1037:27: warning: this statement may fall through [-Wimplicit-fallthrough=] arch/x86/kvm/lapic.c:1876:3: warning: this statement may fall through [-Wimplicit-fallthrough=] arch/x86/kvm/hyperv.c:1637:6: warning: this statement may fall through [-Wimplicit-fallthrough=] arch/x86/kvm/svm.c:4396:6: warning: this statement may fall through [-Wimplicit-fallthrough=] arch/x86/kvm/mmu.c:4372:36: warning: this statement may fall through [-Wimplicit-fallthrough=] arch/x86/kvm/x86.c:3835:6: warning: this statement may fall through [-Wimplicit-fallthrough=] arch/x86/kvm/x86.c:7938:23: warning: this statement may fall through [-Wimplicit-fallthrough=] arch/x86/kvm/vmx/vmx.c:2015:6: warning: this statement may fall through [-Wimplicit-fallthrough=] arch/x86/kvm/vmx/vmx.c:1773:6: warning: this statement may fall through [-Wimplicit-fallthrough=] Warning level 3 was used: -Wimplicit-fallthrough=3 This patch is part of the ongoing efforts to enabling -Wimplicit-fallthrough. Signed-off-by: Gustavo A. R. Silva Signed-off-by: Paolo Bonzini arch/x86/kvm/hyperv.c | 2 +- arch/x86/kvm/lapic.c | 2 ++ arch/x86/kvm/mmu.c | 1 + arch/x86/kvm/svm.c | 2 +- arch/x86/kvm/vmx/vmx.c | 4 ++-- arch/x86/kvm/x86.c | 3 +++ 6 files changed, 10 insertions(+), 4 deletions(-) commit 5cd5548ff439b916cf72448109994394c2bf4b3c Author: Masahiro Yamada Date: Fri Jan 25 16:32:46 2019 +0900 KVM: x86: fix TRACE_INCLUDE_PATH and remove -I. header search paths The header search path -I. in kernel Makefiles is very suspicious; it allows the compiler to search for headers in the top of $(srctree), where obviously no header file exists. The reason of having -I. here is to make the incorrectly set TRACE_INCLUDE_PATH working. As the comment block in include/trace/define_trace.h says, TRACE_INCLUDE_PATH should be a relative path to the define_trace.h Fix the TRACE_INCLUDE_PATH, and remove the iffy include paths. Signed-off-by: Masahiro Yamada Signed-off-by: Paolo Bonzini arch/x86/kvm/Makefile | 4 ---- arch/x86/kvm/trace.h | 2 +- 2 files changed, 1 insertion(+), 5 deletions(-) commit 35b531a1e7fc30ac8c62e5ac1794eb1460da614e Author: Vitaly Kuznetsov Date: Thu Jan 17 18:12:10 2019 +0100 KVM: selftests: check returned evmcs version range Check that KVM_CAP_HYPERV_ENLIGHTENED_VMCS returns correct version range. Signed-off-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini tools/testing/selftests/kvm/x86_64/evmcs_test.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 3a2f5773baab34a9943be4c77e1ff2ac79d16c75 Author: Vitaly Kuznetsov Date: Thu Jan 17 18:12:09 2019 +0100 x86/kvm/hyper-v: nested_enable_evmcs() sets vmcs_version incorrectly Commit e2e871ab2f02 ("x86/kvm/hyper-v: Introduce nested_get_evmcs_version() helper") broke EVMCS enablement: to set vmcs_version we now call nested_get_evmcs_version() but this function checks enlightened_vmcs_enabled flag which is not yet set so we end up returning zero. Fix the issue by re-arranging things in nested_enable_evmcs(). Fixes: e2e871ab2f02 ("x86/kvm/hyper-v: Introduce nested_get_evmcs_version() helper") Signed-off-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini arch/x86/kvm/vmx/evmcs.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 5ad6ece869d46c834976ce383ef200f9116881f8 Author: Sean Christopherson Date: Tue Jan 15 17:10:53 2019 -0800 KVM: VMX: Move vmx_vcpu_run()'s VM-Enter asm blob to a helper function ...along with the function's STACK_FRAME_NON_STANDARD tag. Moving the asm blob results in a significantly smaller amount of code that is marked with STACK_FRAME_NON_STANDARD, which makes it far less likely that gcc will split the function and trigger a spurious objtool warning. As a bonus, removing STACK_FRAME_NON_STANDARD from vmx_vcpu_run() allows the bulk of code to be properly checked by objtool. Because %rbp is not loaded via VMCS fields, vmx_vcpu_run() must manually save/restore the host's RBP and load the guest's RBP prior to calling vmx_vmenter(). Modifying %rbp triggers objtool's stack validation code, and so vmx_vcpu_run() is tagged with STACK_FRAME_NON_STANDARD since it's impossible to avoid modifying %rbp. Unfortunately, vmx_vcpu_run() is also a gigantic function that gcc will split into separate functions, e.g. so that pieces of the function can be inlined. Splitting the function means that the compiled Elf file will contain one or more vmx_vcpu_run.part.* functions in addition to a vmx_vcpu_run function. Depending on where the function is split, objtool may warn about a "call without frame pointer save/setup" in vmx_vcpu_run.part.* since objtool's stack validation looks for exact names when whitelisting functions tagged with STACK_FRAME_NON_STANDARD. Up until recently, the undesirable function splitting was effectively blocked because vmx_vcpu_run() was tagged with __noclone. At the time, __noclone had an unintended side effect that put vmx_vcpu_run() into a separate optimization unit, which in turn prevented gcc from inlining the function (or any of its own function calls) and thus eliminated gcc's motivation to split the function. Removing the __noclone attribute allowed gcc to optimize vmx_vcpu_run(), exposing the objtool warning. Kudos to Qian Cai for root causing that the fnsplit optimization is what caused objtool to complain. Fixes: 453eafbe65f7 ("KVM: VMX: Move VM-Enter + VM-Exit handling to non-inline sub-routines") Tested-by: Qian Cai Cc: Josh Poimboeuf Reported-by: kbuild test robot Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini arch/x86/kvm/vmx/vmx.c | 139 ++++++++++++++++++++++++++----------------------- 1 file changed, 73 insertions(+), 66 deletions(-) commit 94a980c39c8e3f8abaff5d3b5bbcd4ccf1c02c4f Author: Ben Gardon Date: Wed Jan 16 09:41:15 2019 -0800 kvm: selftests: Fix region overlap check in kvm_util Fix a call to userspace_mem_region_find to conform to its spec of taking an inclusive, inclusive range. It was previously being called with an inclusive, exclusive range. Also remove a redundant region bounds check in vm_userspace_mem_region_add. Region overlap checking is already performed by the call to userspace_mem_region_find. Tested: Compiled tools/testing/selftests/kvm with -static Ran all resulting test binaries on an Intel Haswell test machine All tests passed Signed-off-by: Ben Gardon Reviewed-by: Jim Mattson Signed-off-by: Paolo Bonzini tools/testing/selftests/kvm/lib/kvm_util.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) commit 8997f657001d1ac5042d368a936987c87251c5ec Author: Yi Wang Date: Mon Jan 21 15:27:05 2019 +0800 kvm: vmx: fix some -Wmissing-prototypes warnings We get some warnings when building kernel with W=1: arch/x86/kvm/vmx/vmx.c:426:5: warning: no previous prototype for ‘kvm_fill_hv_flush_list_func’ [-Wmissing-prototypes] arch/x86/kvm/vmx/nested.c:58:6: warning: no previous prototype for ‘init_vmcs_shadow_fields’ [-Wmissing-prototypes] Make them static to fix this. Signed-off-by: Yi Wang Signed-off-by: Paolo Bonzini arch/x86/kvm/vmx/nested.c | 2 +- arch/x86/kvm/vmx/vmx.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 619ad846fc3452adaf71ca246c5aa711e2055398 Author: Vitaly Kuznetsov Date: Mon Jan 7 19:44:51 2019 +0100 KVM: nSVM: clear events pending from svm_complete_interrupts() when exiting to L1 kvm-unit-tests' eventinj "NMI failing on IDT" test results in NMI being delivered to the host (L1) when it's running nested. The problem seems to be: svm_complete_interrupts() raises 'nmi_injected' flag but later we decide to reflect EXIT_NPF to L1. The flag remains pending and we do NMI injection upon entry so it got delivered to L1 instead of L2. It seems that VMX code solves the same issue in prepare_vmcs12(), this was introduced with code refactoring in commit 5f3d5799974b ("KVM: nVMX: Rework event injection and recovery"). Signed-off-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini arch/x86/kvm/svm.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit bb218fbcfaaa3b115d4cd7a43c0ca164f3a96e57 Author: Suravee Suthikulpanit Date: Tue Jan 22 10:25:13 2019 +0000 svm: Fix AVIC incomplete IPI emulation In case of incomplete IPI with invalid interrupt type, the current SVM driver does not properly emulate the IPI, and fails to boot FreeBSD guests with multiple vcpus when enabling AVIC. Fix this by update APIC ICR high/low registers, which also emulate sending the IPI. Signed-off-by: Suravee Suthikulpanit Signed-off-by: Paolo Bonzini arch/x86/kvm/svm.c | 19 ++++--------------- 1 file changed, 4 insertions(+), 15 deletions(-) commit 37ef0c4414c9743ba7f1af4392f0a27a99649f2a Author: Suravee Suthikulpanit Date: Tue Jan 22 10:24:19 2019 +0000 svm: Add warning message for AVIC IPI invalid target Print warning message when IPI target ID is invalid due to one of the following reasons: * In logical mode: cluster > max_cluster (64) * In physical mode: target > max_physical (512) * Address is not present in the physical or logical ID tables Signed-off-by: Suravee Suthikulpanit Signed-off-by: Paolo Bonzini arch/x86/kvm/svm.c | 2 ++ 1 file changed, 2 insertions(+) commit de81c2f912ef57917bdc6d63b410c534c3e07982 Author: Sean Christopherson Date: Wed Jan 23 09:22:40 2019 -0800 KVM: x86: WARN_ONCE if sending a PV IPI returns a fatal error KVM hypercalls return a negative value error code in case of a fatal error, e.g. when the hypercall isn't supported or was made with invalid parameters. WARN_ONCE on fatal errors when sending PV IPIs as any such error all but guarantees an SMP system will hang due to a missing IPI. Fixes: aaffcfd1e82d ("KVM: X86: Implement PV IPIs in linux guest") Cc: stable@vger.kernel.org Cc: Wanpeng Li Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini arch/x86/kernel/kvm.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 1ed199a41c70ad7bfaee8b14f78e791fcf43b278 Author: Sean Christopherson Date: Wed Jan 23 09:22:39 2019 -0800 KVM: x86: Fix PV IPIs for 32-bit KVM host The recognition of the KVM_HC_SEND_IPI hypercall was unintentionally wrapped in "#ifdef CONFIG_X86_64", causing 32-bit KVM hosts to reject any and all PV IPI requests despite advertising the feature. This results in all KVM paravirtualized guests hanging during SMP boot due to IPIs never being delivered. Fixes: 4180bf1b655a ("KVM: X86: Implement "send IPI" hypercall") Cc: stable@vger.kernel.org Cc: Wanpeng Li Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini arch/x86/kvm/x86.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f1adceaf01f0446e69c15b32f24ce98e3c3623f1 Author: Vitaly Kuznetsov Date: Fri Jan 25 12:19:34 2019 +0100 x86/kvm/hyper-v: recommend using eVMCS only when it is enabled We shouldn't probably be suggesting using Enlightened VMCS when it's not enabled (not supported from guest's point of view). Hyper-V on KVM seems to be fine either way but let's be consistent. Fixes: 2bc39970e932 ("x86/kvm/hyper-v: Introduce KVM_GET_SUPPORTED_HV_CPUID") Reviewed-by: Liran Alon Signed-off-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini arch/x86/kvm/hyperv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit d0b95e6cd298a785c126e75a085af6dd7b7b1f60 Author: Charles Keepax Date: Fri Jan 25 16:04:06 2019 +0000 ASoC: core: Allow soc_find_component lookups to match parent of_node For devices implemented as a MFD it is common to only have a single node in devicetree representing the whole device. As such when looking up components in soc_find_components we should match against both the devices of_node and the devices parent's of_node, as is already done in the rest of the ASoC core. This causes regressions for some DAI links at the moment as soc_find_component was recently added as a check in soc_init_dai_link. Fixes: 8780cf1142a5 ("ASoC: soc-core: defer card probe until all component is added to list") Signed-off-by: Charles Keepax Signed-off-by: Mark Brown sound/soc/soc-core.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 1998fd32aa62fbf22cd1d8258e6a9deffd6bc466 Author: Vitaly Kuznetsov Date: Fri Jan 25 12:19:33 2019 +0100 x86/kvm/hyper-v: don't recommend doing reset via synthetic MSR System reset through synthetic MSR is not recommended neither by genuine Hyper-V nor my QEMU. Fixes: 2bc39970e932 ("x86/kvm/hyper-v: Introduce KVM_GET_SUPPORTED_HV_CPUID") Signed-off-by: Vitaly Kuznetsov Reviewed-by: Liran Alon Signed-off-by: Paolo Bonzini arch/x86/kvm/hyperv.c | 1 - 1 file changed, 1 deletion(-) commit 3a33d030daaa7c507e1c12d5adcf828248429593 Author: Tom Roeder Date: Thu Jan 24 13:48:20 2019 -0800 kvm: x86/vmx: Use kzalloc for cached_vmcs12 This changes the allocation of cached_vmcs12 to use kzalloc instead of kmalloc. This removes the information leak found by Syzkaller (see Reported-by) in this case and prevents similar leaks from happening based on cached_vmcs12. It also changes vmx_get_nested_state to copy out the full 4k VMCS12_SIZE in copy_to_user rather than only the size of the struct. Tested: rebuilt against head, booted, and ran the syszkaller repro https://syzkaller.appspot.com/text?tag=ReproC&x=174efca3400000 without observing any problems. Reported-by: syzbot+ded1696f6b50b615b630@syzkaller.appspotmail.com Fixes: 8fcc4b5923af5de58b80b53a069453b135693304 Cc: stable@vger.kernel.org Signed-off-by: Tom Roeder Signed-off-by: Paolo Bonzini arch/x86/kvm/vmx/nested.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) commit 85ba2b165d11029c0c57a58640d4cf41f9d9fa0d Author: Sean Christopherson Date: Mon Jan 14 12:12:02 2019 -0800 KVM: VMX: Use the correct field var when clearing VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL Fix a recently introduced bug that results in the wrong VMCS control field being updated when applying a IA32_PERF_GLOBAL_CTRL errata. Fixes: c73da3fcab43 ("KVM: VMX: Properly handle dynamic VM Entry/Exit controls") Reported-by: Harald Arnesen Tested-by: Harald Arnesen Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini arch/x86/kvm/vmx/vmx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5cc244a20b86090c087073c124284381cdf47234 Author: Alexander Popov Date: Mon Jan 21 15:48:40 2019 +0300 KVM: x86: Fix single-step debugging The single-step debugging of KVM guests on x86 is broken: if we run gdb 'stepi' command at the breakpoint when the guest interrupts are enabled, RIP always jumps to native_apic_mem_write(). Then other nasty effects follow. Long investigation showed that on Jun 7, 2017 the commit c8401dda2f0a00cd25c0 ("KVM: x86: fix singlestepping over syscall") introduced the kvm_run.debug corruption: kvm_vcpu_do_singlestep() can be called without X86_EFLAGS_TF set. Let's fix it. Please consider that for -stable. Signed-off-by: Alexander Popov Cc: stable@vger.kernel.org Fixes: c8401dda2f0a00cd25c0 ("KVM: x86: fix singlestepping over syscall") Signed-off-by: Paolo Bonzini arch/x86/kvm/x86.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 9699f970de84292a766709029e5135ea0b6c9aa9 Author: Vitaly Kuznetsov Date: Thu Jan 24 15:27:09 2019 +0100 x86/kvm/hyper-v: don't announce GUEST IDLE MSR support HV_X64_MSR_GUEST_IDLE_AVAILABLE appeared in kvm_vcpu_ioctl_get_hv_cpuid() by mistake: it announces support for HV_X64_MSR_GUEST_IDLE (0x400000F0) which we don't support in KVM (yet). Fixes: 2bc39970e932 ("x86/kvm/hyper-v: Introduce KVM_GET_SUPPORTED_HV_CPUID") Signed-off-by: Vitaly Kuznetsov Signed-off-by: Paolo Bonzini arch/x86/kvm/hyperv.c | 1 - 1 file changed, 1 deletion(-) commit a2093dd35f8cfb28dd7c878ccbd020c1bb20d0d7 Author: Artemy Kovalyov Date: Tue Jan 22 09:16:10 2019 +0200 RDMA/umem: Add missing initialization of owning_mm When allocating a umem leaf for implicit ODP MR during page fault the field owning_mm was not set. Initialize and take a reference on this field to avoid kernel panic when trying to access this field. BUG: unable to handle kernel NULL pointer dereference at 0000000000000058 PGD 800000022dfed067 P4D 800000022dfed067 PUD 22dfcf067 PMD 0 Oops: 0000 [#1] SMP PTI CPU: 0 PID: 634 Comm: kworker/u33:0 Not tainted 4.20.0-rc6+ #89 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 Workqueue: mlx5_ib_page_fault mlx5_ib_eqe_pf_action [mlx5_ib] RIP: 0010:ib_umem_odp_map_dma_pages+0xf3/0x710 [ib_core] Code: 45 c0 48 21 f3 48 89 75 b0 31 f6 4a 8d 04 33 48 89 45 a8 49 8b 44 24 60 48 8b 78 10 e8 66 16 a8 c5 49 8b 54 24 08 48 89 45 98 <8b> 42 58 85 c0 0f 84 8e 05 00 00 8d 48 01 48 8d 72 58 f0 0f b1 4a RSP: 0000:ffffb610813a7c20 EFLAGS: 00010202 RAX: ffff95ace6e8ac80 RBX: 0000000000000000 RCX: 000000000000000c RDX: 0000000000000000 RSI: 0000000000000850 RDI: ffff95aceaadae80 RBP: ffffb610813a7ce0 R08: 0000000000000000 R09: 0000000000080c77 R10: ffff95acfffdbd00 R11: 0000000000000000 R12: ffff95aceaa20a00 R13: 0000000000001000 R14: 0000000000001000 R15: 000000000000000c FS: 0000000000000000(0000) GS:ffff95acf7800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000058 CR3: 000000022c834001 CR4: 00000000001606f0 Call Trace: pagefault_single_data_segment+0x1df/0xc60 [mlx5_ib] mlx5_ib_eqe_pf_action+0x7bc/0xa70 [mlx5_ib] ? __switch_to+0xe1/0x470 process_one_work+0x174/0x390 worker_thread+0x4f/0x3e0 kthread+0x102/0x140 ? drain_workqueue+0x130/0x130 ? kthread_stop+0x110/0x110 ret_from_fork+0x1f/0x30 Fixes: f27a0d50a4bc ("RDMA/umem: Use umem->owning_mm inside ODP") Signed-off-by: Artemy Kovalyov Signed-off-by: Moni Shoua Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/core/umem_odp.c | 3 +++ 1 file changed, 3 insertions(+) commit 9d9d4ff788845fad1626b80164e43a1f0f17ccbc Author: Lijun Ou Date: Wed Jan 23 10:09:27 2019 +0800 RDMA/hns: Update the kernel header file of hns The hns_roce_ib_create_srq_resp is used to interact with the user for data, this was open coded to use a u32 directly, instead use a properly sized structure. Fixes: c7bcb13442e1 ("RDMA/hns: Add SRQ support for hip08 kernel mode") Signed-off-by: Lijun Ou Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/hns/hns_roce_srq.c | 10 ++++++++-- include/uapi/rdma/hns-abi.h | 5 +++++ 2 files changed, 13 insertions(+), 2 deletions(-) commit 053ff09f1a8f2151339f9fda457c5250929d1c49 Author: Sandy Huang Date: Wed Jan 23 18:14:39 2019 +0800 drm/rockchip: rgb: update SPDX license identifier Update SPDX License Identifier from GPL-2.0+ to GPL-2.0 and drop some GPL text. This fixes a mismatch between the existing SPDX headers and GPL boilerplate text. Fixes: 1f0f01515172 ("Add support for Rockchip Soc RGB output interface") Cc: stable@vger.kernel.org Reported-by: Thomas Gleixner Signed-off-by: Sandy Huang Signed-off-by: Heiko Stuebner Link: https://patchwork.freedesktop.org/patch/msgid/1548238479-171491-1-git-send-email-hjc@rock-chips.com drivers/gpu/drm/rockchip/rockchip_rgb.c | 11 +---------- drivers/gpu/drm/rockchip/rockchip_rgb.h | 11 +---------- 2 files changed, 2 insertions(+), 20 deletions(-) commit d88c93f090f708c18195553b352b9f205e65418f Author: Greg Kroah-Hartman Date: Wed Jan 23 11:27:02 2019 +0100 debugfs: fix debugfs_rename parameter checking debugfs_rename() needs to check that the dentries passed into it really are valid, as sometimes they are not (i.e. if the return value of another debugfs call is passed into this one.) So fix this up by properly checking if the two parent directories are errors (they are allowed to be NULL), and if the dentry to rename is not NULL or an error. Cc: stable Signed-off-by: Greg Kroah-Hartman fs/debugfs/inode.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 356690d029e10f1aadebc49819d3908d5f6389fb Author: Nagadheeraj Rottela Date: Mon Jan 14 13:52:24 2019 +0000 crypto: cavium/nitrox - Invoke callback after DMA unmap In process_response_list() invoke the callback handler after unmapping the DMA buffers. It ensures DMA data is synced form device to cpu before the client code access the data from callback handler. Fixes: c9613335bf4f ("crypto: cavium/nitrox - Added AEAD cipher support") Signed-off-by: Nagadheeraj Rottela Signed-off-by: Herbert Xu drivers/crypto/cavium/nitrox/nitrox_reqmgr.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit 2292552102b0599ab976072e5609eaf6fb6628f6 Author: Marc Zyngier Date: Mon Nov 5 15:30:26 2018 +0000 arm64: KVM: Don't generate UNDEF when LORegion feature is present We currently hide the LORegion feature, and generate an UNDEF if the guest dares using the corresponding registers. This is a bit extreme, as ARMv8.1 guarantees the feature to be present. The guest should check the feature register before doing anything, but we could also give the guest some slack (read "allow the guest to be a bit stupid"). So instead of unconditionnaly deliver an exception, let's only do it when the host doesn't support LORegion at all (or when the feature has been sanitized out), and treat the registers as RAZ/WI otherwise (with the exception of LORID_EL1 being RO). Fixes: cc33c4e20185 ("arm64/kvm: Prohibit guest LOR accesses") Suggested-by: Richard Henderson Acked-by: Mark Rutland Signed-off-by: Marc Zyngier Signed-off-by: Christoffer Dall arch/arm64/kvm/sys_regs.c | 42 +++++++++++++++++++++++++++--------------- 1 file changed, 27 insertions(+), 15 deletions(-) commit 93183bdbe73bbdd03e9566c8dc37c9d06b0d0db6 Author: Chaitanya Tata Date: Sat Jan 19 03:17:47 2019 +0530 cfg80211: extend range deviation for DMG Recently, DMG frequency bands have been extended till 71GHz, so extend the range check till 20GHz (45-71GHZ), else some channels will be marked as disabled. Signed-off-by: Chaitanya Tata Signed-off-by: Johannes Berg net/wireless/reg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit faae54ad4151f120bde60fd6e2b2a40e0de8ac73 Author: Chaitanya Tata Date: Thu Jan 24 16:13:02 2019 +0530 cfg80211: reg: remove warn_on for a normal case If there are simulatenous queries of regdb, then there might be a case where multiple queries can trigger request_firmware_no_wait and can have parallel callbacks being executed asynchronously. In this scenario we might hit the WARN_ON. So remove the warn_on, as the code already handles multiple callbacks gracefully. Signed-off-by: Chaitanya Tata Signed-off-by: Johannes Berg net/wireless/reg.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) commit 7c53eb5d87bc21464da4268c3c0c47457b6d9c9b Author: Mathieu Malaterre Date: Thu Jan 24 19:19:57 2019 +0100 mac80211: Add attribute aligned(2) to struct 'action' During refactor in commit 9e478066eae4 ("mac80211: fix MU-MIMO follow-MAC mode") a new struct 'action' was declared with packed attribute as: struct { struct ieee80211_hdr_3addr hdr; u8 category; u8 action_code; } __packed action; But since struct 'ieee80211_hdr_3addr' is declared with an aligned keyword as: struct ieee80211_hdr { __le16 frame_control; __le16 duration_id; u8 addr1[ETH_ALEN]; u8 addr2[ETH_ALEN]; u8 addr3[ETH_ALEN]; __le16 seq_ctrl; u8 addr4[ETH_ALEN]; } __packed __aligned(2); Solve the ambiguity of placing aligned structure in a packed one by adding the aligned(2) attribute to struct 'action'. This removes the following warning (W=1): net/mac80211/rx.c:234:2: warning: alignment 1 of 'struct ' is less than 2 [-Wpacked-not-aligned] Cc: Johannes Berg Suggested-by: Johannes Berg Signed-off-by: Mathieu Malaterre Signed-off-by: Johannes Berg net/mac80211/rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7ed5285396c257fd4070b1e29e7b2341aae2a1ce Author: Balaji Pothunoori Date: Mon Jan 21 12:30:43 2019 +0530 mac80211: don't initiate TDLS connection if station is not associated to AP Following call trace is observed while adding TDLS peer entry in driver during TDLS setup. Call Trace: [] dump_stack+0x47/0x61 [] __warn+0xe2/0x100 [] ? sta_apply_parameters+0x49f/0x550 [mac80211] [] warn_slowpath_null+0x25/0x30 [] sta_apply_parameters+0x49f/0x550 [mac80211] [] ? sta_info_alloc+0x1c2/0x450 [mac80211] [] ieee80211_add_station+0xe3/0x160 [mac80211] [] nl80211_new_station+0x273/0x420 [] genl_rcv_msg+0x219/0x3c0 [] ? genl_rcv+0x30/0x30 [] netlink_rcv_skb+0x8e/0xb0 [] genl_rcv+0x1c/0x30 [] netlink_unicast+0x13a/0x1d0 [] netlink_sendmsg+0x2d8/0x390 [] sock_sendmsg+0x2d/0x40 [] ___sys_sendmsg+0x1d9/0x1e0 Fixing this by allowing TDLS setup request only when we have completed association. Signed-off-by: Balaji Pothunoori Signed-off-by: Johannes Berg net/mac80211/cfg.c | 4 ++++ 1 file changed, 4 insertions(+) commit a8b5c6d69261889e022e9d64ac7ee8741db730bf Author: Johannes Berg Date: Fri Jan 25 09:26:32 2019 +0100 nl80211: fix NLA_POLICY_NESTED() arguments syzbot reported an out-of-bounds read when passing certain malformed messages into nl80211. The specific place where this happened isn't interesting, the problem is that nested policy parsing was referring to the wrong maximum attribute and thus the policy wasn't long enough. Fix this by referring to the correct attribute. Since this is really not necessary, I'll come up with a separate patch to just pass the policy instead of both, in the common case we can infer the maxattr from the size of the policy array. Reported-by: syzbot+4157b036c5f4713b1f2f@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Fixes: 9bb7e0f24e7e ("cfg80211: add peer measurement with FTM initiator API") Signed-off-by: Johannes Berg net/wireless/nl80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7d652669b61d702c6e62a39579d17f6881670ab6 Author: Felix Fietkau Date: Fri Jan 25 08:21:26 2019 +0100 batman-adv: release station info tidstats With the addition of TXQ stats in the per-tid statistics the struct station_info grew significantly. This resulted in stack size warnings due to the structure itself being above the limit for the warnings. To work around this, the TID array was allocated dynamically. Also a function to free this content was introduced with commit 7ea3e110f2f8 ("cfg80211: release station info tidstats where needed") but the necessary changes were not provided for batman-adv's B.A.T.M.A.N. V implementation. Signed-off-by: Felix Fietkau Fixes: 8689c051a201 ("cfg80211: dynamically allocate per-tid stats for station info") [sven@narfation.org: add commit message] Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich net/batman-adv/bat_v_elp.c | 3 +++ 1 file changed, 3 insertions(+) commit 093c61b6a0d5768f48442ec59d671496314cc47d Author: Jisheng Zhang Date: Fri Jan 25 07:40:32 2019 +0000 i3c: fix missing detach if failed to retrieve i3c dev If we failed to retrieve the i3c dev, we should detach the i3c dev I.E i3c_master_detach_i3c_dev(). Signed-off-by: Jisheng Zhang Signed-off-by: Boris Brezillon drivers/i3c/master.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e95d22c69b2c130ccce257b84daf283fd82d611e Author: Thomas Falcon Date: Thu Jan 24 11:17:01 2019 -0600 ibmveth: Do not process frames after calling napi_reschedule The IBM virtual ethernet driver's polling function continues to process frames after rescheduling NAPI, resulting in a warning if it exhausted its budget. Do not restart polling after calling napi_reschedule. Instead let frames be processed in the following instance. Signed-off-by: Thomas Falcon Signed-off-by: David S. Miller drivers/net/ethernet/ibm/ibmveth.c | 2 -- 1 file changed, 2 deletions(-) commit 3b707c3008cad04604c1f50e39f456621821c414 Author: Maciej Żenczykowski Date: Thu Jan 24 03:07:02 2019 -0800 net: dev_is_mac_header_xmit() true for ARPHRD_RAWIP __bpf_redirect() and act_mirred checks this boolean to determine whether to prefix an ethernet header. Signed-off-by: Maciej Żenczykowski Acked-by: Daniel Borkmann Signed-off-by: David S. Miller include/linux/if_arp.h | 1 + 1 file changed, 1 insertion(+) commit 6eea3527e68acc22483f4763c8682f223eb90029 Author: Zhang Run Date: Thu Jan 24 13:48:49 2019 +0800 net: usb: asix: ax88772_bind return error when hw_reset fail The ax88772_bind() should return error code immediately when the PHY was not reset properly through ax88772a_hw_reset(). Otherwise, The asix_get_phyid() will block when get the PHY Identifier from the PHYSID1 MII registers through asix_mdio_read() due to the PHY isn't ready. Furthermore, it will produce a lot of error message cause system crash.As follows: asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to send software reset: ffffffb9 asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to enable software MII access asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to enable software MII access asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 ... Signed-off-by: Zhang Run Reviewed-by: Yang Wei Tested-by: Marcel Ziswiler Signed-off-by: David S. Miller drivers/net/usb/asix_devices.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) commit d524e6416aeb2854bbeef2bb596803914fe286c0 Author: Sudarsana Reddy Kalluru Date: Wed Jan 23 18:03:20 2019 -0800 MAINTAINERS: Update cavium networking drivers Following Marvell's acquisition of Cavium, we need to update all the Cavium drivers maintainer's entries to point to our new e-mail addresses. Signed-off-by: Sudarsana Reddy Kalluru Signed-off-by: Ameen Rahman Signed-off-by: David S. Miller MAINTAINERS | 42 +++++++++++++++++++++--------------------- 1 file changed, 21 insertions(+), 21 deletions(-) commit b8812920b5a2cad3c88cdb61ebcec6cea17d4845 Merge: 9620d6f6833e 52d3b4949192 Author: David S. Miller Date: Thu Jan 24 22:22:17 2019 -0800 Merge tag 'hyperv-fixes-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Sasha Levin says: ==================== Hyper-V hv_netvsc commits for 5.0 Three patches from Haiyang Zhang to fix settings hash key using ethtool, and Adrian Vladu's first patch fixing a few spelling mistakes. ==================== Signed-off-by: David S. Miller commit 9620d6f6833e22b7168caf0665bd43478ef58cb5 Merge: 21507dc46adc a55234dabe1f Author: David S. Miller Date: Thu Jan 24 21:52:37 2019 -0800 Merge tag 'linux-can-fixes-for-5.0-20190122' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2019-01-22 this is a pull request of 4 patches for net/master. The first patch by is by Manfred Schlaegl and reverts a patch that caused wrong warning messages in certain use cases. The next patch is by Oliver Hartkopp for the bcm that adds sanity checks for the timer value before using it to detect potential interger overflows. The last two patches are for the flexcan driver, YueHaibing's patch fixes the the return value in the error path of the flexcan_setup_stop_mode() function. The second patch is by Uwe Kleine-König and fixes a NULL pointer deref on older flexcan cores in flexcan_chip_start(). ==================== Signed-off-by: David S. Miller commit 21507dc46adc691098724775287a8855fb4c8fa3 Merge: ecf938fe7d00 ffe4cfc3da5e Author: David S. Miller Date: Thu Jan 24 21:48:26 2019 -0800 Merge branch 'mlx4_core-fixes' Tariq Toukan says: ==================== mlx4_core fixes for 5.0-rc This patchset includes two fixes for the mlx4_core driver. First patch by Aya fixes inaccurate parsing of some FW fields, mistakenly including additional (mostly reserved) bits. Second patch by Jack fixes a wrong (yet harmless) error handling of calls to copy_to_user() during the CQs init stage. Series generated against net commit: 49a57857aeea Linux 5.0-rc3 ==================== Signed-off-by: David S. Miller commit ffe4cfc3da5e61555aca189e2432ee637fd12eec Author: Jack Morgenstein Date: Tue Jan 22 15:19:45 2019 +0200 net/mlx4_core: Fix error handling when initializing CQ bufs in the driver Procedure mlx4_init_user_cqes() handles returns by copy_to_user incorrectly. copy_to_user() returns the number of bytes not copied. Thus, a non-zero return should be treated as a -EFAULT error (as is done elsewhere in the kernel). However, mlx4_init_user_cqes() error handling simply returns the number of bytes not copied (instead of -EFAULT). Note, though, that this is a harmless bug: procedure mlx4_alloc_cq() (which is the only caller of mlx4_init_user_cqes()) treats any non-zero return as an error, but that returned error value is processed internally, and not passed further up the call stack. In addition, fixes the following sparse warning: warning: incorrect type in argument 1 (different address spaces) expected void [noderef] *to got void *buf Fixes: e45678973dcb ("{net, IB}/mlx4: Initialize CQ buffers in the driver when possible") Reported by: Dan Carpenter Signed-off-by: Jack Morgenstein Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx4/cq.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit a40ded6043658444ee4dd6ee374119e4e98b33fc Author: Aya Levin Date: Tue Jan 22 15:19:44 2019 +0200 net/mlx4_core: Add masking for a few queries on HCA caps Driver reads the query HCA capabilities without the corresponding masks. Without the correct masks, the base addresses of the queues are unaligned. In addition some reserved bits were wrongly read. Using the correct masks, ensures alignment of the base addresses and allows future firmware versions safe use of the reserved bits. Fixes: ab9c17a009ee ("mlx4_core: Modify driver initialization flow to accommodate SRIOV for Ethernet") Fixes: 0ff1fb654bec ("{NET, IB}/mlx4: Add device managed flow steering firmware API") Signed-off-by: Aya Levin Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx4/fw.c | 75 ++++++++++++++++++++------------- 1 file changed, 46 insertions(+), 29 deletions(-) commit 2a81efb0de0e33f2d2c83154af0bd3ce389b3269 Author: Srinivas Kandagatla Date: Mon Dec 10 13:56:33 2018 +0000 arm64: dts: add msm8996 compatible to gicv3 Add compatible to gicv3 node to enable quirk required to restrict writing to GICR_WAKER register which is restricted on msm8996 SoC in Hypervisor. With this quirk MSM8996 can at least boot out of mainline, which can help community to work with boards based on MSM8996. Without this patch Qualcomm DB820c board reboots on mainline. Signed-off-by: Srinivas Kandagatla Signed-off-by: Andy Gross arch/arm64/boot/dts/qcom/msm8996.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ecf938fe7d0088077ee1280419a2b3c5429b47c8 Author: Xin Long Date: Tue Jan 22 02:42:41 2019 +0800 sctp: set flow sport from saddr only when it's 0 Now sctp_transport_pmtu() passes transport->saddr into .get_dst() to set flow sport from 'saddr'. However, transport->saddr is set only when transport->dst exists in sctp_transport_route(). If sctp_transport_pmtu() is called without transport->saddr set, like when transport->dst doesn't exists, the flow sport will be set to 0 from transport->saddr, which will cause a wrong route to be got. Commit 6e91b578bf3f ("sctp: re-use sctp_transport_pmtu in sctp_transport_route") made the issue be triggered more easily since sctp_transport_pmtu() would be called in sctp_transport_route() after that. In gerneral, fl4->fl4_sport should always be set to htons(asoc->base.bind_addr.port), unless transport->asoc doesn't exist in sctp_v4/6_get_dst(), which is the case: sctp_ootb_pkt_new() -> sctp_transport_route() For that, we can simply handle it by setting flow sport from saddr only when it's 0 in sctp_v4/6_get_dst(). Fixes: 6e91b578bf3f ("sctp: re-use sctp_transport_pmtu in sctp_transport_route") Reported-by: Ying Xu Signed-off-by: Xin Long Signed-off-by: David S. Miller net/sctp/ipv6.c | 3 ++- net/sctp/protocol.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) commit 4ff40b86262b73553ee47cc3784ce8ba0f220bd8 Author: Xin Long Date: Tue Jan 22 02:42:09 2019 +0800 sctp: set chunk transport correctly when it's a new asoc In the paths: sctp_sf_do_unexpected_init() -> sctp_make_init_ack() sctp_sf_do_dupcook_a/b()() -> sctp_sf_do_5_1D_ce() The new chunk 'retval' transport is set from the incoming chunk 'chunk' transport. However, 'retval' transport belong to the new asoc, which is a different one from 'chunk' transport's asoc. It will cause that the 'retval' chunk gets set with a wrong transport. Later when sending it and because of Commit b9fd683982c9 ("sctp: add sctp_packet_singleton"), sctp_packet_singleton() will set some fields, like vtag to 'retval' chunk from that wrong transport's asoc. This patch is to fix it by setting 'retval' transport correctly which belongs to the right asoc in sctp_make_init_ack() and sctp_sf_do_5_1D_ce(). Fixes: b9fd683982c9 ("sctp: add sctp_packet_singleton") Reported-by: Ying Xu Signed-off-by: Xin Long Signed-off-by: David S. Miller net/sctp/sm_make_chunk.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit 8220c870cb0f4eaa4e335c9645dbd9a1c461c1dd Author: Xin Long Date: Tue Jan 22 02:40:12 2019 +0800 sctp: improve the events for sctp stream adding This patch is to improve sctp stream adding events in 2 places: 1. In sctp_process_strreset_addstrm_out(), move up SCTP_MAX_STREAM and in stream allocation failure checks, as the adding has to succeed after reconf_timer stops for the in stream adding request retransmission. 3. In sctp_process_strreset_addstrm_in(), no event should be sent, as no in or out stream is added here. Fixes: 50a41591f110 ("sctp: implement receiver-side procedures for the Add Outgoing Streams Request Parameter") Fixes: c5c4ebb3ab87 ("sctp: implement receiver-side procedures for the Add Incoming Streams Request Parameter") Reported-by: Ying Xu Signed-off-by: Xin Long Signed-off-by: David S. Miller net/sctp/stream.c | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) commit 2e6dc4d95110becfe0ff4c3d4749c33ea166e9e7 Author: Xin Long Date: Tue Jan 22 02:39:34 2019 +0800 sctp: improve the events for sctp stream reset This patch is to improve sctp stream reset events in 4 places: 1. In sctp_process_strreset_outreq(), the flag should always be set with SCTP_STREAM_RESET_INCOMING_SSN instead of OUTGOING, as receiver's in stream is reset here. 2. In sctp_process_strreset_outreq(), move up SCTP_STRRESET_ERR_WRONG_SSN check, as the reset has to succeed after reconf_timer stops for the in stream reset request retransmission. 3. In sctp_process_strreset_inreq(), no event should be sent, as no in or out stream is reset here. 4. In sctp_process_strreset_resp(), SCTP_STREAM_RESET_INCOMING_SSN or OUTGOING event should always be sent for stream reset requests, no matter it fails or succeeds to process the request. Fixes: 810544764536 ("sctp: implement receiver-side procedures for the Outgoing SSN Reset Request Parameter") Fixes: 16e1a91965b0 ("sctp: implement receiver-side procedures for the Incoming SSN Reset Request Parameter") Fixes: 11ae76e67a17 ("sctp: implement receiver-side procedures for the Reconf Response Parameter") Reported-by: Ying Xu Signed-off-by: Xin Long Signed-off-by: David S. Miller net/sctp/stream.c | 39 +++++++++++++++++---------------------- 1 file changed, 17 insertions(+), 22 deletions(-) commit d71b57532d70c03f4671dd04e84157ac6bf021b0 Author: wenxu Date: Sat Jan 19 13:11:25 2019 +0800 ip_tunnel: Make none-tunnel-dst tunnel port work with lwtunnel ip l add dev tun type gretap key 1000 ip a a dev tun 10.0.0.1/24 Packets with tun-id 1000 can be recived by tun dev. But packet can't be sent through dev tun for non-tunnel-dst With this patch: tunnel-dst can be get through lwtunnel like beflow: ip r a 10.0.0.7 encap ip dst 172.168.0.11 dev tun Signed-off-by: wenxu Signed-off-by: David S. Miller net/ipv4/ip_tunnel.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 4fe8713b873fc881284722ce4ac47995de7cf62c Author: Max Filippov Date: Mon Jan 29 09:09:41 2018 -0800 xtensa: SMP: fix ccount_timer_shutdown ccount_timer_shutdown is called from the atomic context in the secondary_start_kernel, resulting in the following BUG: BUG: sleeping function called from invalid context in_atomic(): 1, irqs_disabled(): 1, pid: 0, name: swapper/1 Preemption disabled at: secondary_start_kernel+0xa1/0x130 Call Trace: ___might_sleep+0xe7/0xfc __might_sleep+0x41/0x44 synchronize_irq+0x24/0x64 disable_irq+0x11/0x14 ccount_timer_shutdown+0x12/0x20 clockevents_switch_state+0x82/0xb4 clockevents_exchange_device+0x54/0x60 tick_check_new_device+0x46/0x70 clockevents_register_device+0x8c/0xc8 clockevents_config_and_register+0x1d/0x2c local_timer_setup+0x75/0x7c secondary_start_kernel+0xb4/0x130 should_never_return+0x32/0x35 Use disable_irq_nosync instead of disable_irq to avoid it. This is safe because the ccount timer IRQ is per-CPU, and once IRQ is masked the ISR will not be called. Signed-off-by: Max Filippov arch/xtensa/kernel/time.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d73aba1115cf40630cc8b4b7aed049ed8117b458 Merge: cffd425b9014 f0e7ce1eef58 Author: Linus Torvalds Date: Fri Jan 25 12:19:10 2019 +1300 Merge tag 'drm-fixes-2019-01-25-1' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Live from LCA pull, some fixes all over the place, i915: - GVT workload destruction fix msm: - A6XX opp-level fix - build fixes - hard-coded irq removal amdgpu: - overclocking fix - hybrid gfx fix sun4i: - fix TMDS clock usage" * tag 'drm-fixes-2019-01-25-1' of git://anongit.freedesktop.org/drm/drm: drm/msm: avoid unused function warning drm/msm: Add __printf verification drm/msm: Fix A6XX support for opp-level drm/msm: honor GPU_READONLY flag drm/msm: drop interrupt-names drm/msm/gpu: Remove hardcoded interrupt name drm/msm/gpu: fix building without debugfs drm/i915/execlists: Mark up priority boost on preemption drm/i915/gvt: release shadow batch buffer and wa_ctx before destroy one workload drm/sun4i: hdmi: Fix usage of TMDS clock drm/amd/powerplay: OD setting fix on Vega10 drm/amdgpu: Add APTX quirk for Lenovo laptop drm/msm: Unblock writer if reader closes file commit f0e7ce1eef5854584dfb59b3824a67edee37580f Merge: 7325e4bd06b0 a840f690d3c6 Author: Dave Airlie Date: Fri Jan 25 07:44:53 2019 +1000 Merge tag 'drm-msm-fixes-2019-01-24' of git://people.freedesktop.org/~robclark/linux into drm-fixes A few fixes for v5.0.. the opp-level fix and removal of hard-coded irq name is partially to make things smoother in v5.1 merge window to avoid dependency on drm vs dt trees, but are otherwise sane changes. Signed-off-by: Dave Airlie From: Rob Clark Link: https://patchwork.freedesktop.org/patch/msgid/CAF6AEGsAEHd2tGRQxRTs+A-8y_tthPs2iUgCCCEwR5vDMXab4A@mail.gmail.com commit 7325e4bd06b02c3aa14fb1066164aefcdee73115 Merge: edaf690170c8 b42606b0397d Author: Dave Airlie Date: Fri Jan 25 06:57:45 2019 +1000 Merge tag 'drm-intel-fixes-2019-01-24' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915 fixes for v5.0-rc4: - fix priority boost - gvt: fix destroy of shadow batch and indirect ctx Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87k1iu1a2e.fsf@intel.com commit edaf690170c835d8f6575c82f40c6a977cdd2eb9 Merge: dc15159a2ccb 6d87dc97eb33 Author: Dave Airlie Date: Fri Jan 25 06:53:16 2019 +1000 Merge branch 'drm-fixes-5.0' of git://people.freedesktop.org/~agd5f/linux into drm-fixes - Overclock fix for vega10 - Hybrid gfx laptop fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20190123231004.3111-1-alexander.deucher@amd.com commit a5f1a81f701c594194eb70c679785882ab15f138 Author: Ronnie Sahlberg Date: Thu Jan 24 16:19:31 2019 +1000 cifs: print CIFSMaxBufSize as part of /proc/fs/cifs/DebugData Was helpful in debug for some recent problems. Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French fs/cifs/cifs_debug.c | 1 + 1 file changed, 1 insertion(+) commit 2e5700bdde438ed708b36d8acd0398dc73cbf759 Author: Ronnie Sahlberg Date: Wed Jan 23 16:20:38 2019 +1000 smb3: add credits we receive from oplock/break PDUs Otherwise we gradually leak credits leading to potential hung session. Signed-off-by: Ronnie Sahlberg CC: Stable Reviewed-by: Pavel Shilovsky Signed-off-by: Steve French fs/cifs/smb2misc.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 6a9cbdd1ceca1dc2359ddf082efe61b97c3e752b Author: Pavel Shilovsky Date: Wed Jan 16 11:48:42 2019 -0800 CIFS: Fix mounts if the client is low on credits If the server doesn't grant us at least 3 credits during the mount we won't be able to complete it because query path info operation requires 3 credits. Use the cached file handle if possible to allow the mount to succeed. Signed-off-by: Pavel Shilovsky Reviewed-by: Ronnie Sahlberg Signed-off-by: Steve French fs/cifs/smb2inode.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) commit 0fd1d37b0501efc6e295f56ab55cdaff784aa50c Author: Pavel Shilovsky Date: Tue Jan 15 15:08:48 2019 -0800 CIFS: Do not assume one credit for async responses If we don't receive a response we can't assume that the server granted one credit. Assume zero credits in such cases. Signed-off-by: Pavel Shilovsky Reviewed-by: Ronnie Sahlberg Signed-off-by: Steve French fs/cifs/smb2pdu.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) commit 3d3003fce8e837acc4e3960fe3cbabebc356dcb5 Author: Pavel Shilovsky Date: Tue Jan 22 16:50:21 2019 -0800 CIFS: Fix credit calculations in compound mid callback The current code doesn't do proper accounting for credits in SMB1 case: it adds one credit per response only if we get a complete response while it needs to return it unconditionally. Fix this and also include malformed responses for SMB2+ into accounting for credits because such responses have Credit Granted field, thus nothing prevents to get a proper credit value from them. Signed-off-by: Pavel Shilovsky Reviewed-by: Ronnie Sahlberg Signed-off-by: Steve French fs/cifs/smb2ops.c | 6 +++++- fs/cifs/transport.c | 11 +---------- 2 files changed, 6 insertions(+), 11 deletions(-) commit ec678eae746dd25766a61c4095e2b649d3b20b09 Author: Pavel Shilovsky Date: Fri Jan 18 15:38:11 2019 -0800 CIFS: Fix credit calculation for encrypted reads with errors We do need to account for credits received in error responses to read requests on encrypted sessions. Cc: Signed-off-by: Pavel Shilovsky Reviewed-by: Ronnie Sahlberg Signed-off-by: Steve French fs/cifs/smb2ops.c | 24 ++++++++++++++---------- 1 file changed, 14 insertions(+), 10 deletions(-) commit 8004c78c68e894e4fd5ac3c22cc22eb7dc24cabc Author: Pavel Shilovsky Date: Thu Jan 17 15:29:26 2019 -0800 CIFS: Fix credits calculations for reads with errors Currently we mark MID as malformed if we get an error from server in a read response. This leads to not properly processing credits in the readv callback. Fix this by marking such a response as normal received response and process it appropriately. Cc: Signed-off-by: Pavel Shilovsky Reviewed-by: Ronnie Sahlberg Signed-off-by: Steve French fs/cifs/cifssmb.c | 35 +++++++++++++++++++++++------------ 1 file changed, 23 insertions(+), 12 deletions(-) commit ef68e831840c40c7d01b328b3c0f5d8c4796c232 Author: Pavel Shilovsky Date: Fri Jan 18 17:25:36 2019 -0800 CIFS: Do not reconnect TCP session in add_credits() When executing add_credits() we currently call cifs_reconnect() if the number of credits is zero and there are no requests in flight. In this case we may call cifs_reconnect() recursively twice and cause memory corruption given the following sequence of functions: mid1.callback() -> add_credits() -> cifs_reconnect() -> -> mid2.callback() -> add_credits() -> cifs_reconnect(). Fix this by avoiding to call cifs_reconnect() in add_credits() and checking for zero credits in the demultiplex thread. Cc: Signed-off-by: Pavel Shilovsky Reviewed-by: Ronnie Sahlberg Signed-off-by: Steve French fs/cifs/connect.c | 21 +++++++++++++++++++++ fs/cifs/smb2ops.c | 32 +++++++++++++++++++++++++------- 2 files changed, 46 insertions(+), 7 deletions(-) commit dc15159a2ccbdc07e9d39f402cbd61a09426680b Merge: 49a57857aeea 5e1bc251cebc Author: Dave Airlie Date: Fri Jan 25 06:46:51 2019 +1000 Merge tag 'drm-misc-fixes-2019-01-24' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes drm-misc-fixes for v5.0-rc4: - Small refcounting fix to sun4i's HDMI support. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/588e9ecb-d80d-2cc6-254e-e5311f04224f@linux.intel.com commit a840f690d3c6f2f27425ca7e7bd2d635cdec07d7 Author: Arnd Bergmann Date: Thu Jan 10 15:14:03 2019 +0100 drm/msm: avoid unused function warning drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c:368:13: error: 'dpu_plane_danger_signal_ctrl' defined but not used [-Werror=unused-function] Fixes: 7b2e7adea732 ("drm/msm/dpu: Make dpu_plane_danger_signal_ctrl void") Signed-off-by: Arnd Bergmann Signed-off-by: Anders Roxell Signed-off-by: Rob Clark drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) commit 023014e72e0a6e4c188a6ecb67cc744d90866327 Author: Joe Perches Date: Thu Jan 17 14:17:36 2019 -0800 drm/msm: Add __printf verification Add a few __printf attribute specifiers to routines that could use them. Signed-off-by: Joe Perches Signed-off-by: Rob Clark drivers/gpu/drm/msm/msm_drv.h | 3 +++ 1 file changed, 3 insertions(+) commit a3c5e2cd79753121f49a8662c1e0a60ddb5486ca Author: Douglas Anderson Date: Wed Jan 16 10:46:21 2019 -0800 drm/msm: Fix A6XX support for opp-level The bindings for Qualcomm opp levels changed after being Acked but before landing. Thus the code in the GPU driver that was relying on the old bindings is now broken. Let's change the code to match the new bindings by adjusting the old string 'qcom,level' to the new string 'opp-level'. See the patch ("dt-bindings: opp: Introduce opp-level bindings"). NOTE: we will do additional cleanup to totally remove the string from the code and use the new dev_pm_opp_get_level() but we'll do it in a future patch. This will facilitate getting the important code fix in sooner without having to deal with cross-maintainer dependencies. This patch needs to land before the patch ("arm64: dts: sdm845: Add gpu and gmu device nodes") since if a tree contains the device tree patch but not this one you'll get a crash at bootup. Fixes: 4b565ca5a2cb ("drm/msm: Add A6XX device support") Signed-off-by: Douglas Anderson Reviewed-by: Jordan Crouse Signed-off-by: Rob Clark drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bbc2cd07c5100514f25ac6e09d2a94521b46b35b Author: Rob Clark Date: Wed Jan 9 14:25:05 2019 -0500 drm/msm: honor GPU_READONLY flag Signed-off-by: Rob Clark drivers/gpu/drm/msm/msm_drv.h | 3 ++- drivers/gpu/drm/msm/msm_gem.c | 8 ++++++-- drivers/gpu/drm/msm/msm_gem_vma.c | 5 +++-- 3 files changed, 11 insertions(+), 5 deletions(-) commit 895ad6b0ccf71ec1f8d5bc4d9f15b525feb160a8 Author: Jordan Crouse Date: Tue Dec 18 11:32:37 2018 -0700 drm/msm: drop interrupt-names Each GPU core only uses one interrupt so we don't to look up an interrupt by name and thereby we don't need interrupt-names. Signed-off-by: Jordan Crouse Reviewed-by: Rob Herring Signed-off-by: Rob Clark Documentation/devicetree/bindings/display/msm/gpu.txt | 1 - 1 file changed, 1 deletion(-) commit 878411aef631e4e2dd8d6c7cdb01e95a076cbcb9 Author: Jordan Crouse Date: Tue Dec 18 11:32:36 2018 -0700 drm/msm/gpu: Remove hardcoded interrupt name Every GPU core only has one interrupt so there isn't any value in looking up the interrupt by name. Remove the name (which is legacy anyway) and use platform_get_irq() instead. Signed-off-by: Jordan Crouse Reviewed-by: Douglas Anderson Signed-off-by: Rob Clark drivers/gpu/drm/msm/adreno/adreno_gpu.c | 1 - drivers/gpu/drm/msm/msm_gpu.c | 2 +- drivers/gpu/drm/msm/msm_gpu.h | 1 - 3 files changed, 1 insertion(+), 3 deletions(-) commit c878a628e0c483ec36fa70f4590e4a58e34a6e49 Author: Arnd Bergmann Date: Mon Aug 13 23:23:44 2018 +0200 drm/msm/gpu: fix building without debugfs When debugfs is disabled, but coredump is turned on, the adreno driver fails to build: drivers/gpu/drm/msm/adreno/a3xx_gpu.c:460:4: error: 'struct msm_gpu_funcs' has no member named 'show' .show = adreno_show, ^~~~ drivers/gpu/drm/msm/adreno/a3xx_gpu.c:460:11: note: (near initialization for 'funcs.base') drivers/gpu/drm/msm/adreno/a3xx_gpu.c:460:11: error: initialization of 'void (*)(struct msm_gpu *, struct msm_gem_submit *, struct msm_file_private *)' from incompatible pointer type 'void (*)(struct msm_gpu *, struct msm_gpu_state *, struct drm_printer *)' [-Werror=incompatible-pointer-types] drivers/gpu/drm/msm/adreno/a3xx_gpu.c:460:11: note: (near initialization for 'funcs.base.submit') drivers/gpu/drm/msm/adreno/a4xx_gpu.c:546:4: error: 'struct msm_gpu_funcs' has no member named 'show' drivers/gpu/drm/msm/adreno/a5xx_gpu.c:1460:4: error: 'struct msm_gpu_funcs' has no member named 'show' drivers/gpu/drm/msm/adreno/a6xx_gpu.c:769:4: error: 'struct msm_gpu_funcs' has no member named 'show' drivers/gpu/drm/msm/msm_gpu.c: In function 'msm_gpu_devcoredump_read': drivers/gpu/drm/msm/msm_gpu.c:289:12: error: 'const struct msm_gpu_funcs' has no member named 'show' Adjust the #ifdef to make it build again. Fixes: c0fec7f562ec ("drm/msm/gpu: Capture the GPU state on a GPU hang") Signed-off-by: Arnd Bergmann Signed-off-by: Rob Clark drivers/gpu/drm/msm/msm_gpu.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cffd425b90147296c627dfb13f7ea8f361d962b2 Merge: c04e2a780caf 075c18c3e124 Author: Linus Torvalds Date: Fri Jan 25 09:07:18 2019 +1300 Merge tag 'for-5.0/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: - Fix DM crypt's parsing of extended IV arguments. - Fix DM thinp's discard passdown to properly account for extra reference that is taken to guard against reallocating a block before a discard has been issued. - Fix bio-based DM's redundant IO accounting that was occurring for bios that must be split due to the nature of the DM target (e.g. dm-stripe, dm-thinp, etc). * tag 'for-5.0/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm: add missing trace_block_split() to __split_and_process_bio() dm: fix dm_wq_work() to only use __split_and_process_bio() if appropriate dm: fix redundant IO accounting for bios that need splitting dm: fix clone_bio() to trigger blk_recount_segments() dm thin: fix passdown_double_checking_shared_status() dm crypt: fix parsing of extended IV arguments commit 9ff1a3b4912528f853048ccd9757ba6a2cc75557 Author: Taniya Das Date: Tue Dec 18 23:49:41 2018 +0530 clk: qcom: gcc: Use active only source for CPUSS clocks The clocks of the CPUSS such as "gcc_cpuss_ahb_clk_src" is a CRITICAL clock and needs to vote on the active only source of XO, so as to keep the vote as long as CPUSS is active. Similar rbcpr_clk_src is also has the same requirement. Signed-off-by: Taniya Das Fixes: 06391eddb60a ("clk: qcom: Add Global Clock controller (GCC) driver for SDM845") Signed-off-by: Stephen Boyd drivers/clk/qcom/gcc-sdm845.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) commit 303aef8b84272d73999a3207dd05bbe10ed89dc5 Author: Dan Carpenter Date: Tue Jan 15 22:46:25 2019 +0300 clk: ti: Fix error handling in ti_clk_parse_divider_data() The ti_clk_parse_divider_data() function is only called from _get_div_table_from_setup(). That function doesn't look at the return value but instead looks at the "*table" pointer. In this case, if the kcalloc() fails then *table is NULL (which means success). It should instead be an error pointer. The ti_clk_parse_divider_data() function has two callers. One checks for errors and the other doesn't. I have fixed it so now both handle errors. Fixes: 4f6be5655dc9 ("clk: ti: divider: add driver internal API for parsing divider data") Signed-off-by: Dan Carpenter Acked-by: Tero Kristo Signed-off-by: Stephen Boyd drivers/clk/ti/divider.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) commit a64a9c088b75cba5840320d57e0bbfb36739c3b5 Author: Abel Vesa Date: Fri Jan 18 12:54:13 2019 +0000 clk: imx: Fix fractional clock set rate computation Before multiplying by PLL_FRAC_DENOM, the temp64 needs to be temp64 = rate * 2 - divfi * parent_rate * 8, instead of: temp64 = (rate * 2 - divfi) * parent_rate Fixes: 6209624b9a5c1e ("clk: imx: Add fractional PLL output clock") Signed-off-by: Abel Vesa Signed-off-by: Stephen Boyd drivers/clk/imx/clk-frac-pll.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit ede77858473ae4cab6f8f147efcaa76989761535 Author: Derek Basehore Date: Thu Dec 20 16:31:00 2018 -0800 clk: Remove global clk traversal on fetch parent index It's not required to traverse the entire clk tree when the parents array contains a NULL value. We already have the parent clk_core pointer, so we can just compare the parent->name and parent_names[i] pointers. This can be a substantial power improvement in cases where the parent clk isn't known and that clk is never registered, because a mux having an unregistered parent name may traverse the clk tree on every clk_set_rate() call in clk_mux_determine_rate_flags(). This can happen hundreds of times a second for CPU clks. This patch is the combination of reverting commit 470b5e2f97cf ("clk: simplify clk_fetch_parent_index() function") and optimizing the resulting code to never call __clk_lookup() because we already have the clk_core pointer we're looking for. That optimization went unnoticed even after commit da0f0b2c3ad2 ("clk: Correct lookup logic in clk_fetch_parent_index()") tried to optimize this path. Signed-off-by: Derek Basehore [sboyd@kernel.org: More description in commit text] Signed-off-by: Stephen Boyd drivers/clk/clk.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) commit 401fbb34f53e20a8d4734136a2d02ff1ee76f86e Author: Lubomir Rintel Date: Mon Jan 21 07:22:56 2019 +0100 Revert "dt-bindings: marvell,mmp2: Add clock id for the SP clock" It seems that the kernel has no business managing this clock: once the SP clock is disabled, it's not sufficient to just enable it in order to bring the SP core back up. Pretty sure nothing ever used this and it's safe to remove. This reverts commit e8a2c779141415105825e65a4715f1130bba61b1. Signed-off-by: Lubomir Rintel Signed-off-by: Stephen Boyd include/dt-bindings/clock/marvell,mmp2.h | 1 - 1 file changed, 1 deletion(-) commit 0acb69e7b904135ff540bc483942c0dba40ecdb9 Author: Lubomir Rintel Date: Mon Jan 21 07:22:55 2019 +0100 Revert "clk: mmp2: add SP clock" It seems that the kernel has no business managing this clock: once the SP clock is disabled, it's not sufficient to just enable in order to bring the SP core back up. Just let the firmware keep it enabled and don't expose it to drivers. This reverts commit fc27c2394d96fd19854b7e2d3f0e60df0d86fc90. Link: https://lore.kernel.org/lkml/154783267051.169631.3197836544646625747@swboyd.mtv.corp.google.com/ Signed-off-by: Lubomir Rintel Signed-off-by: Stephen Boyd drivers/clk/mmp/clk-of-mmp2.c | 4 ---- 1 file changed, 4 deletions(-) commit 0113613faf0214b5e04ccf9149c330ee67f9779c Author: Lubomir Rintel Date: Mon Jan 21 07:22:54 2019 +0100 Revert "Input: olpc_apsp - enable the SP clock" Turns out this is not such a great idea. Once the SP clock is disabled, it's not sufficient to just enable in order to bring the SP core back up. It seems that the kernel has no business managing this clock. Just let the firmware keep it enabled. This reverts commit ed22cee91a88c47e564478b012fdbcb079653499. Link: https://lore.kernel.org/lkml/154783267051.169631.3197836544646625747@swboyd.mtv.corp.google.com/ Signed-off-by: Lubomir Rintel Acked-by: Dmitry Torokhov Signed-off-by: Stephen Boyd Documentation/devicetree/bindings/serio/olpc,ap-sp.txt | 4 ---- drivers/input/serio/olpc_apsp.c | 14 -------------- 2 files changed, 18 deletions(-) commit 8367de2c99a13d35960a51d6084631c883e93a4d Author: Damien Le Moal Date: Thu Jan 24 18:20:14 2019 +0900 block: Fix comment typo Fix typo in REQ_OP_ZONE_RESET description. Signed-off-by: Damien Le Moal Signed-off-by: Jens Axboe include/linux/blk_types.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 745815f955f65f22d378d69822da11043d00aaff Author: Damien Le Moal Date: Thu Jan 24 18:20:13 2019 +0900 uapi: fix ioctl documentation The description of the BLKGETNRZONES zoned block device ioctl was not added as a comment together with this ioctl definition in commit 65e4e3eee83d7 ("block: Introduce BLKGETNRZONES ioctl"). Add its description here. Signed-off-by: Damien Le Moal Signed-off-by: Jens Axboe include/uapi/linux/blkzoned.h | 1 + 1 file changed, 1 insertion(+) commit c83f536a87d9dd6d6bf989c0b0882459a902eb07 Author: Bart Van Assche Date: Wed Jan 23 11:05:57 2019 -0800 blk-wbt: Declare local functions static This patch avoids that sparse reports the following warnings: CHECK block/blk-wbt.c block/blk-wbt.c:600:6: warning: symbol 'wbt_issue' was not declared. Should it be static? block/blk-wbt.c:620:6: warning: symbol 'wbt_requeue' was not declared. Should it be static? CC block/blk-wbt.o block/blk-wbt.c:600:6: warning: no previous prototype for wbt_issue [-Wmissing-prototypes] void wbt_issue(struct rq_qos *rqos, struct request *rq) ^~~~~~~~~ block/blk-wbt.c:620:6: warning: no previous prototype for wbt_requeue [-Wmissing-prototypes] void wbt_requeue(struct rq_qos *rqos, struct request *rq) ^~~~~~~~~~~ Reviewed-by: Chaitanya Kulkarni Signed-off-by: Bart Van Assche Signed-off-by: Jens Axboe block/blk-wbt.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit c04e2a780caf7073c31c4289c4b7c3d62f9c0130 Merge: 22a89a6b88e6 125892edfe69 Author: Linus Torvalds Date: Fri Jan 25 06:03:24 2019 +1300 Merge tag 'fsnotify_for_v5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull inotify fix from Jan Kara: "Fix a file refcount leak in an inotify error path" * tag 'fsnotify_for_v5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: inotify: Fix fd refcount leak in inotify_add_watch(). commit 22a89a6b88e6db7328292491f564b54b13cc15fb Merge: aa7b98459f15 74827ee29565 Author: Linus Torvalds Date: Fri Jan 25 05:59:22 2019 +1300 Merge tag 'ceph-for-5.0-rc4' of git://github.com/ceph/ceph-client Pull ceph fixes from Ilya Dryomov: "A fix for a potential use-after-free, a patch to close a (mostly benign) race in the messenger and a licence clarification for quota.c" * tag 'ceph-for-5.0-rc4' of git://github.com/ceph/ceph-client: ceph: quota: cleanup license mess libceph: avoid KEEPALIVE_PENDING races in ceph_con_keepalive() ceph: clear inode pointer when snap realm gets dropped by its inode commit aa7b98459f15bf45d0610c8acfa7929a8641864a Merge: 30bac164aca7 699390381a7b Author: Linus Torvalds Date: Fri Jan 25 05:55:26 2019 +1300 Merge tag 'sound-5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A significant amount of fixes at this time, mostly for covering the recent ASoC issues. - Fixes for the missing ASoC driver initialization with non-deferred probes; these triggered other problems in chain, which resulted in yet more fix commits - DaVinci runtime PM fix; the diff looks large but it's just a code shuffling - Various fixes for ASoC Intel drivers: a regression in HD-A HDMI, Kconfig dependency, machine driver adjustments, PLL fix. - Other ASoC driver-specific stuff including the trivial fixes caught by static analysis - Usual HD-audio quirks" * tag 'sound-5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (30 commits) ALSA: hda - Add mute LED support for HP ProBook 470 G5 ASoC: amd: Fix potential NULL pointer dereference ASoC: imx-audmux: change snprintf to scnprintf for possible overflow ASoC: rt5514-spi: Fix potential NULL pointer dereference ASoC: dapm: change snprintf to scnprintf for possible overflow ASoC: rt5682: Fix PLL source register definitions ASoC: core: Don't defer probe on optional, NULL components ASoC: core: Make snd_soc_find_component() more robust ASoC: soc-core: fix init platform memory handling ASoC: intel: skl: Fix display power regression ALSA: hda/realtek - Fix typo for ALC225 model ASoC: soc-core: Hold client_mutex around soc_init_dai_link() ASoC: Intel: Boards: move the codec PLL configuration to _init ASoC: soc-core: defer card probe until all component is added to list ASoC: atom: fix a missing check of snd_pcm_lib_malloc_pages ASoC: tlv320aic32x4: Kernel OOPS while entering DAPM standby mode ASoC: ti: davinci-mcasp: Move context save/restore to runtime_pm callbacks ASoC: Variable "val" in function rt274_i2c_probe() could be uninitialized ASoC: rt5682: Fix recording no sound issue ASoC: Intel: atom: Make PCI dependency explicit ... commit 245b6c6558128327d330549b23d09594c46f58df Author: Thor Thayer Date: Tue Jan 22 11:48:04 2019 -0600 EDAC, altera: Fix S10 persistent register offset Correct the persistent register offset where address and status are stored. Fixes: 08f08bfb7b4c ("EDAC, altera: Merge Stratix10 into the Arria10 SDRAM probe routine") Signed-off-by: Thor Thayer Signed-off-by: Borislav Petkov Cc: James Morse Cc: Mauro Carvalho Chehab Cc: devicetree@vger.kernel.org Cc: dinguyen@kernel.org Cc: linux-edac Cc: mark.rutland@arm.com Cc: robh+dt@kernel.org Cc: stable Link: https://lkml.kernel.org/r/1548179287-21760-2-git-send-email-thor.thayer@linux.intel.com drivers/edac/altera_edac.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 1c26010c5e1b9ad22a77968428b68150d27ae65f Author: Jianchao Wang Date: Thu Jan 24 18:28:55 2019 +0800 blk-mq: fix the cmd_flag_name array Swap REQ_NOWAIT and REQ_NOUNMAP and add REQ_HIPRI. Acked-by: Jeff Moyer Signed-off-by: Jianchao Wang Signed-off-by: Jens Axboe block/blk-mq-debugfs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit b0b2cac7e244629e1a84a26d7eabb885fed7ff68 Author: Thomas Gleixner Date: Fri Jan 18 00:14:23 2019 +0100 smb3: Cleanup license mess Precise and non-ambiguous license information is important. The recently added aegis header file has a SPDX license identifier, which is nice, but at the same time it has a contradictionary license boiler plate text. SPDX-License-Identifier: GPL-2.0 versus * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or * (at your option) any later version. Oh well. Assuming that the SPDX identifier is correct and according to x86/hyper-v contributions from Microsoft GPL V2 only is the usual license. Remove the boiler plate as it is wrong and even if correct it is redundant. Fixes: eccb4422cf97 ("smb3: Add ftrace tracepoints for improved SMB3 debugging") Signed-off-by: Thomas Gleixner Cc: Steve French Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French fs/cifs/trace.c | 10 ---------- fs/cifs/trace.h | 10 ---------- 2 files changed, 20 deletions(-) commit acc58d0bab55a50e02c25f00bd6a210ee121595f Author: Pavel Shilovsky Date: Thu Jan 17 08:21:24 2019 -0800 CIFS: Fix possible hang during async MTU reads and writes When doing MTU i/o we need to leave some credits for possible reopen requests and other operations happening in parallel. Currently we leave 1 credit which is not enough even for reopen only: we need at least 2 credits if durable handle reconnect fails. Also there may be other operations at the same time including compounding ones which require 3 credits at a time each. Fix this by leaving 8 credits which is big enough to cover most scenarios. Was able to reproduce this when server was configured to give out fewer credits than usual. The proper fix would be to reconnect a file handle first and then obtain credits for an MTU request but this leads to bigger code changes and should happen in other patches. Cc: Signed-off-by: Pavel Shilovsky Signed-off-by: Steve French fs/cifs/smb2ops.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 73aaf920cc72024c4a4460cfa46d56e5014172f3 Author: Colin Ian King Date: Wed Jan 16 16:28:59 2019 +0000 cifs: fix memory leak of an allocated cifs_ntsd structure The call to SMB2_queary_acl can allocate memory to pntsd and also return a failure via a call to SMB2_query_acl (and then query_info). This occurs when query_info allocates the structure and then in query_info the call to smb2_validate_and_copy_iov fails. Currently the failure just returns without kfree'ing pntsd hence causing a memory leak. Currently, *data is allocated if it's not already pointing to a buffer, so it needs to be kfree'd only if was allocated in query_info, so the fix adds an allocated flag to track this. Also set *dlen to zero on an error just to be safe since *data is kfree'd. Also set errno to -ENOMEM if the allocation of *data fails. Signed-off-by: Colin Ian King Signed-off-by: Steve French Reviewed-by: Dan Carpener fs/cifs/smb2pdu.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 45383fb0f42db3945ac6cc658704706cdae19528 Author: Tiwei Bie Date: Wed Jan 23 17:50:26 2019 +0800 virtio: support VIRTIO_F_ORDER_PLATFORM This patch introduces the support for VIRTIO_F_ORDER_PLATFORM. If this feature is negotiated, the driver must use the barriers suitable for hardware devices. Otherwise, the device and driver are assumed to be implemented in software, that is they can be assumed to run on identical CPUs in an SMP configuration. Thus a weaker form of memory barriers is sufficient to yield better performance. It is recommended that an add-in card based PCI device offers this feature for portability. The device will fail to operate further or will operate in a slower emulation mode if this feature is offered but not accepted. Signed-off-by: Tiwei Bie Signed-off-by: Michael S. Tsirkin drivers/virtio/virtio_ring.c | 8 ++++++++ include/uapi/linux/virtio_config.h | 6 ++++++ 2 files changed, 14 insertions(+) commit 9825bd94e3a2baae1f4874767ae3a7d4c049720e Author: Suravee Suthikulpanit Date: Thu Jan 24 04:16:45 2019 +0000 iommu/amd: Fix IOMMU page flush when detach device from a domain When a VM is terminated, the VFIO driver detaches all pass-through devices from VFIO domain by clearing domain id and page table root pointer from each device table entry (DTE), and then invalidates the DTE. Then, the VFIO driver unmap pages and invalidate IOMMU pages. Currently, the IOMMU driver keeps track of which IOMMU and how many devices are attached to the domain. When invalidate IOMMU pages, the driver checks if the IOMMU is still attached to the domain before issuing the invalidate page command. However, since VFIO has already detached all devices from the domain, the subsequent INVALIDATE_IOMMU_PAGES commands are being skipped as there is no IOMMU attached to the domain. This results in data corruption and could cause the PCI device to end up in indeterministic state. Fix this by invalidate IOMMU pages when detach a device, and before decrementing the per-domain device reference counts. Cc: Boris Ostrovsky Suggested-by: Joerg Roedel Co-developed-by: Brijesh Singh Signed-off-by: Brijesh Singh Signed-off-by: Suravee Suthikulpanit Fixes: 6de8ad9b9ee0 ('x86/amd-iommu: Make iommu_flush_pages aware of multiple IOMMUs') Signed-off-by: Joerg Roedel drivers/iommu/amd_iommu.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) commit e08d8d296079e8fd7eefd53f73dcafebd3a5bf9f Author: Julien Thierry Date: Mon Jan 7 15:06:17 2019 +0000 KVM: arm/arm64: vgic: Make vgic_cpu->ap_list_lock a raw_spinlock vgic_cpu->ap_list_lock must always be taken with interrupts disabled as it is used in interrupt context. For configurations such as PREEMPT_RT_FULL, this means that it should be a raw_spinlock since RT spinlocks are interruptible. Signed-off-by: Julien Thierry Acked-by: Christoffer Dall Acked-by: Marc Zyngier Signed-off-by: Christoffer Dall include/kvm/arm_vgic.h | 2 +- virt/kvm/arm/vgic/vgic-init.c | 2 +- virt/kvm/arm/vgic/vgic.c | 37 +++++++++++++++++++------------------ 3 files changed, 21 insertions(+), 20 deletions(-) commit fc3bc475231e12e9c0142f60100cf84d077c79e1 Author: Julien Thierry Date: Mon Jan 7 15:06:16 2019 +0000 KVM: arm/arm64: vgic: Make vgic_dist->lpi_list_lock a raw_spinlock vgic_dist->lpi_list_lock must always be taken with interrupts disabled as it is used in interrupt context. For configurations such as PREEMPT_RT_FULL, this means that it should be a raw_spinlock since RT spinlocks are interruptible. Signed-off-by: Julien Thierry Acked-by: Christoffer Dall Acked-by: Marc Zyngier Signed-off-by: Christoffer Dall include/kvm/arm_vgic.h | 2 +- virt/kvm/arm/vgic/vgic-init.c | 2 +- virt/kvm/arm/vgic/vgic-its.c | 8 ++++---- virt/kvm/arm/vgic/vgic.c | 10 +++++----- 4 files changed, 11 insertions(+), 11 deletions(-) commit 8fa3adb8c6beee4af079ac90b9575ab92951de3f Author: Julien Thierry Date: Mon Jan 7 15:06:15 2019 +0000 KVM: arm/arm64: vgic: Make vgic_irq->irq_lock a raw_spinlock vgic_irq->irq_lock must always be taken with interrupts disabled as it is used in interrupt context. For configurations such as PREEMPT_RT_FULL, this means that it should be a raw_spinlock since RT spinlocks are interruptible. Signed-off-by: Julien Thierry Acked-by: Christoffer Dall Acked-by: Marc Zyngier Signed-off-by: Christoffer Dall include/kvm/arm_vgic.h | 2 +- virt/kvm/arm/vgic/vgic-debug.c | 4 +-- virt/kvm/arm/vgic/vgic-init.c | 4 +-- virt/kvm/arm/vgic/vgic-its.c | 14 ++++---- virt/kvm/arm/vgic/vgic-mmio-v2.c | 14 ++++---- virt/kvm/arm/vgic/vgic-mmio-v3.c | 12 +++---- virt/kvm/arm/vgic/vgic-mmio.c | 34 +++++++++---------- virt/kvm/arm/vgic/vgic-v2.c | 4 +-- virt/kvm/arm/vgic/vgic-v3.c | 8 ++--- virt/kvm/arm/vgic/vgic.c | 71 ++++++++++++++++++++-------------------- 10 files changed, 83 insertions(+), 84 deletions(-) commit 53ab60baa1ac4f20b080a22c13b77b6373922fd7 Author: ZhangXiaoxu Date: Thu Jan 10 16:39:06 2019 +0800 ipvs: Fix signed integer overflow when setsockopt timeout There is a UBSAN bug report as below: UBSAN: Undefined behaviour in net/netfilter/ipvs/ip_vs_ctl.c:2227:21 signed integer overflow: -2147483647 * 1000 cannot be represented in type 'int' Reproduce program: #include #include #include #define IPPROTO_IP 0 #define IPPROTO_RAW 255 #define IP_VS_BASE_CTL (64+1024+64) #define IP_VS_SO_SET_TIMEOUT (IP_VS_BASE_CTL+10) /* The argument to IP_VS_SO_GET_TIMEOUT */ struct ipvs_timeout_t { int tcp_timeout; int tcp_fin_timeout; int udp_timeout; }; int main() { int ret = -1; int sockfd = -1; struct ipvs_timeout_t to; sockfd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW); if (sockfd == -1) { printf("socket init error\n"); return -1; } to.tcp_timeout = -2147483647; to.tcp_fin_timeout = -2147483647; to.udp_timeout = -2147483647; ret = setsockopt(sockfd, IPPROTO_IP, IP_VS_SO_SET_TIMEOUT, (char *)(&to), sizeof(to)); printf("setsockopt return %d\n", ret); return ret; } Return -EINVAL if the timeout value is negative or max than 'INT_MAX / HZ'. Signed-off-by: ZhangXiaoxu Acked-by: Simon Horman Signed-off-by: Pablo Neira Ayuso net/netfilter/ipvs/ip_vs_ctl.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit a2fcd5c84f7a7825e028381b10182439067aa90d Author: Tina Zhang Date: Wed Jan 23 15:28:59 2019 +0800 drm/modes: Prevent division by zero htotal This patch prevents division by zero htotal. In a follow-up mail Tina writes: > > How did you manage to get here with htotal == 0? This needs backtraces (or if > > this is just about static checkers, a mention of that). > > -Daniel > > In GVT-g, we are trying to enable a virtual display w/o setting timings for a pipe > (a.k.a htotal=0), then we met the following kernel panic: > > [ 32.832048] divide error: 0000 [#1] SMP PTI > [ 32.833614] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.18.0-rc4-sriov+ #33 > [ 32.834438] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.10.1-0-g8891697-dirty-20180511_165818-tinazhang-linux-1 04/01/2014 > [ 32.835901] RIP: 0010:drm_mode_hsync+0x1e/0x40 > [ 32.836004] Code: 31 c0 c3 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 8b 87 d8 00 00 00 85 c0 75 22 8b 4f 68 85 c9 78 1b 69 47 58 e8 03 00 00 99 f9 b9 d3 4d 62 10 05 f4 01 00 00 f7 e1 89 d0 c1 e8 06 f3 c3 66 > [ 32.836004] RSP: 0000:ffffc900000ebb90 EFLAGS: 00010206 > [ 32.836004] RAX: 0000000000000000 RBX: ffff88001c67c8a0 RCX: 0000000000000000 > [ 32.836004] RDX: 0000000000000000 RSI: ffff88001c67c000 RDI: ffff88001c67c8a0 > [ 32.836004] RBP: ffff88001c7d03a0 R08: ffff88001c67c8a0 R09: ffff88001c7d0330 > [ 32.836004] R10: ffffffff822c3a98 R11: 0000000000000001 R12: ffff88001c67c000 > [ 32.836004] R13: ffff88001c7d0370 R14: ffffffff8207eb78 R15: ffff88001c67c800 > [ 32.836004] FS: 0000000000000000(0000) GS:ffff88001da00000(0000) knlGS:0000000000000000 > [ 32.836004] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [ 32.836004] CR2: 0000000000000000 CR3: 000000000220a000 CR4: 00000000000006f0 > [ 32.836004] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > [ 32.836004] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > [ 32.836004] Call Trace: > [ 32.836004] intel_mode_from_pipe_config+0x72/0x90 > [ 32.836004] intel_modeset_setup_hw_state+0x569/0xf90 > [ 32.836004] intel_modeset_init+0x905/0x1db0 > [ 32.836004] i915_driver_load+0xb8c/0x1120 > [ 32.836004] i915_pci_probe+0x4d/0xb0 > [ 32.836004] local_pci_probe+0x44/0xa0 > [ 32.836004] ? pci_assign_irq+0x27/0x130 > [ 32.836004] pci_device_probe+0x102/0x1c0 > [ 32.836004] driver_probe_device+0x2b8/0x480 > [ 32.836004] __driver_attach+0x109/0x110 > [ 32.836004] ? driver_probe_device+0x480/0x480 > [ 32.836004] bus_for_each_dev+0x67/0xc0 > [ 32.836004] ? klist_add_tail+0x3b/0x70 > [ 32.836004] bus_add_driver+0x1e8/0x260 > [ 32.836004] driver_register+0x5b/0xe0 > [ 32.836004] ? mipi_dsi_bus_init+0x11/0x11 > [ 32.836004] do_one_initcall+0x4d/0x1eb > [ 32.836004] kernel_init_freeable+0x197/0x237 > [ 32.836004] ? rest_init+0xd0/0xd0 > [ 32.836004] kernel_init+0xa/0x110 > [ 32.836004] ret_from_fork+0x35/0x40 > [ 32.836004] Modules linked in: > [ 32.859183] ---[ end trace 525608b0ed0e8665 ]--- > [ 32.859722] RIP: 0010:drm_mode_hsync+0x1e/0x40 > [ 32.860287] Code: 31 c0 c3 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 8b 87 d8 00 00 00 85 c0 75 22 8b 4f 68 85 c9 78 1b 69 47 58 e8 03 00 00 99 f9 b9 d3 4d 62 10 05 f4 01 00 00 f7 e1 89 d0 c1 e8 06 f3 c3 66 > [ 32.862680] RSP: 0000:ffffc900000ebb90 EFLAGS: 00010206 > [ 32.863309] RAX: 0000000000000000 RBX: ffff88001c67c8a0 RCX: 0000000000000000 > [ 32.864182] RDX: 0000000000000000 RSI: ffff88001c67c000 RDI: ffff88001c67c8a0 > [ 32.865206] RBP: ffff88001c7d03a0 R08: ffff88001c67c8a0 R09: ffff88001c7d0330 > [ 32.866359] R10: ffffffff822c3a98 R11: 0000000000000001 R12: ffff88001c67c000 > [ 32.867213] R13: ffff88001c7d0370 R14: ffffffff8207eb78 R15: ffff88001c67c800 > [ 32.868075] FS: 0000000000000000(0000) GS:ffff88001da00000(0000) knlGS:0000000000000000 > [ 32.868983] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [ 32.869659] CR2: 0000000000000000 CR3: 000000000220a000 CR4: 00000000000006f0 > [ 32.870599] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > [ 32.871598] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > [ 32.872549] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b > > Since drm_mode_hsync() has the logic to check mode->htotal, I just extend it to cover the case htotal==0. Signed-off-by: Tina Zhang Cc: Adam Jackson Cc: Dave Airlie Cc: Daniel Vetter [danvet: Add additional explanations + cc: stable.] Cc: stable@vger.kernel.org Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/1548228539-3061-1-git-send-email-tina.zhang@intel.com drivers/gpu/drm/drm_modes.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b42606b0397daf3b35345da99791968417bbced4 Merge: 2b2440815827 0f7555121609 Author: Jani Nikula Date: Thu Jan 24 10:41:34 2019 +0200 Merge tag 'gvt-fixes-2019-01-24' of https://github.com/intel/gvt-linux into drm-intel-fixes gvt-fixes-2019-01-24 - Fix destroy of shadow batch and indirect ctx (Weinan) Signed-off-by: Jani Nikula From: Zhenyu Wang Link: https://patchwork.freedesktop.org/patch/msgid/20190124054801.GP7203@zhen-hp.sh.intel.com commit 141e5dcaa7356077028b4cd48ec351a38c70e5e5 Author: Deepa Dinamani Date: Thu Jan 24 00:29:20 2019 -0800 Input: input_event - fix the CONFIG_SPARC64 mixup Arnd Bergmann pointed out that CONFIG_* cannot be used in a uapi header. Override with an equivalent conditional. Fixes: 2e746942ebac ("Input: input_event - provide override for sparc64") Fixes: 152194fe9c3f ("Input: extend usable life of event timestamps to 2106 on 32 bit systems") Signed-off-by: Deepa Dinamani Signed-off-by: Dmitry Torokhov include/uapi/linux/input.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit aa284d64a9c5885ccf1a09ead52dd592ab9b394b Merge: 49a57857aeea 2095a45e345e Author: Linus Walleij Date: Thu Jan 24 09:02:24 2019 +0100 Merge tag 'gpio-5.0-rc4-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into fixes GPIO fixes for 5.0-rc4 - fix from Roger Quadros for a warning resulting from reusing the same irqchip for multiple pcf857x instances - fix for missing line event timestamp when using nested interrupts - two fixes for the sprd driver dealing with value reading and the irq chip - fix for the direction_output callback for altera-a10sr commit 2b24408158276faf0f4a71eb97a2364686d5b06c Author: Chris Wilson Date: Wed Jan 23 13:51:55 2019 +0000 drm/i915/execlists: Mark up priority boost on preemption Record the priority boost we giving to the preempted client or else we may end up in a situation where the priority queue no longer matches the request priority order and so we can end up in an infinite loop of preempting the same pair of requests. Fixes: e9eaf82d97a2 ("drm/i915: Priority boost for waiting clients") Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20190123135155.21562-1-chris@chris-wilson.co.uk (cherry picked from commit 6e062b60b0b1bd82cac475e63cdb8c451647182b) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_lrc.c | 4 ++++ 1 file changed, 4 insertions(+) commit 28198c4639b39899a728ac89aea29d2a7a72562f Author: Guo Ren Date: Sat Jan 12 16:16:27 2019 +0800 riscv: fixup max_low_pfn with PFN_DOWN. max_low_pfn should be pfn_size not byte_size. Signed-off-by: Guo Ren Signed-off-by: Mao Han Signed-off-by: Palmer Dabbelt arch/riscv/kernel/setup.c | 2 +- arch/riscv/mm/init.c | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) commit d0243693fbf6fbd48b4efb2ba7210765983b03e3 Author: Tony Lindgren Date: Tue Jan 15 10:09:38 2019 -0800 ARM: OMAP5+: Fix inverted nirq pin interrupts with irq_set_type Commit 83a86fbb5b56 ("irqchip/gic: Loudly complain about the use of IRQ_TYPE_NONE") started warning about incorrect dts usage for irqs. ARM GIC only supports active-high interrupts for SPI (Shared Peripheral Interrupts), and the Palmas PMIC by default is active-low. Palmas PMIC allows changing the interrupt polarity using register PALMAS_POLARITY_CTRL_INT_POLARITY, but configuring sys_nirq1 with a pull-down and setting PALMAS_POLARITY_CTRL_INT_POLARITY made the Palmas RTC interrupts stop working. This can be easily tested with kernel tools rtctest.c. Turns out the SoC inverts the sys_nirq pins for GIC as they do not go through a peripheral device but go directly to the MPUSS wakeupgen. I've verified this by muxing the interrupt line temporarily to gpio_wk16 instead of sys_nirq1. with a gpio, the interrupt works fine both active-low and active-high with the SoC internal pull configured and palmas polarity configured. But as sys_nirq1, the interrupt only works when configured ACTIVE_LOW for palmas, and ACTIVE_HIGH for GIC. Note that there was a similar issue earlier with tegra114 and palmas interrupt polarity that got fixed by commit df545d1cd01a ("mfd: palmas: Provide irq flags through DT/platform data"). However, the difference between omap5 and tegra114 is that tegra inverts the palmas interrupt twice, once when entering tegra PMC, and again when exiting tegra PMC to GIC. Let's fix the issue by adding a custom wakeupgen_irq_set_type() for wakeupgen and invert any interrupts with wrong polarity. Let's also warn about any non-sysnirq pins using wrong polarity. Note that we also need to update the dts for the level as IRQ_TYPE_NONE never has irq_set_type() called, and let's add some comments and use proper pin nameing to avoid more confusion later on. Cc: Belisko Marek Cc: Dmitry Lifshitz Cc: "Dr. H. Nikolaus Schaller" Cc: Jon Hunter Cc: Keerthy Cc: Laxman Dewangan Cc: Nishanth Menon Cc: Peter Ujfalusi Cc: Richard Woodruff Cc: Santosh Shilimkar Cc: Tero Kristo Cc: Thierry Reding Cc: stable@vger.kernel.org # v4.17+ Reported-by: Belisko Marek Signed-off-by: Tony Lindgren arch/arm/boot/dts/omap5-board-common.dtsi | 9 +++++--- arch/arm/boot/dts/omap5-cm-t54.dts | 12 ++++++++++- arch/arm/mach-omap2/omap-wakeupgen.c | 36 ++++++++++++++++++++++++++++++- 3 files changed, 52 insertions(+), 5 deletions(-) commit 78a61cd42a64f3587862b372a79e1d6aaf131fd7 Author: Hannes Reinecke Date: Wed Jan 9 09:45:15 2019 +0100 nvme-multipath: drop optimization for static ANA group IDs Bit 6 in the ANACAP field is used to indicate that the ANA group ID doesn't change while the namespace is attached to the controller. There is an optimisation in the code to only allocate space for the ANA group header, as the namespace list won't change and hence would not need to be refreshed. However, this optimisation was never carried over to the actual workflow, which always assumes that the buffer is large enough to hold the ANA header _and_ the namespace list. So drop this optimisation and always allocate enough space. Reviewed-by: Christoph Hellwig Signed-off-by: Hannes Reinecke Signed-off-by: Sagi Grimberg Signed-off-by: Jens Axboe drivers/nvme/host/multipath.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 5cbab6303b4791a3e6713dfe2c5fda6a867f9adc Author: Raju Rangoju Date: Thu Jan 3 23:05:31 2019 +0530 nvmet-rdma: fix null dereference under heavy load Under heavy load if we don't have any pre-allocated rsps left, we dynamically allocate a rsp, but we are not actually allocating memory for nvme_completion (rsp->req.rsp). In such a case, accessing pointer fields (req->rsp->status) in nvmet_req_init() will result in crash. To fix this, allocate the memory for nvme_completion by calling nvmet_rdma_alloc_rsp() Fixes: 8407879c("nvmet-rdma:fix possible bogus dereference under heavy load") Cc: Reviewed-by: Max Gurtovoy Reviewed-by: Christoph Hellwig Signed-off-by: Raju Rangoju Signed-off-by: Sagi Grimberg Signed-off-by: Jens Axboe drivers/nvme/target/rdma.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) commit b1064d3e337b4d0b67d641b5f771187d8f1f027d Author: Sagi Grimberg Date: Fri Jan 18 16:43:24 2019 -0800 nvme-rdma: rework queue maps handling If the device supports less queues than provided (if the device has less completion vectors), we might hit a bug due to the fact that we ignore that in nvme_rdma_map_queues (we override the maps nr_queues with user opts). Instead, keep track of how many default/read/poll queues we actually allocated (rather than asked by the user) and use that to assign our queue mappings. Fixes: b65bb777ef22 (" nvme-rdma: support separate queue maps for read and write") Reported-by: Saleem, Shiraz Reviewed-by: Christoph Hellwig Signed-off-by: Sagi Grimberg Signed-off-by: Jens Axboe drivers/nvme/host/rdma.c | 38 +++++++++++++++++++++++++------------- 1 file changed, 25 insertions(+), 13 deletions(-) commit 39d57757467b6346bbc1a1f416e3057f681cf903 Author: Sagi Grimberg Date: Tue Jan 8 01:01:30 2019 -0800 nvme-tcp: fix timeout handler Currently, we have several problems with the timeout handler: 1. If we timeout on the controller establishment flow, we will hang because we don't execute the error recovery (and we shouldn't because the create_ctrl flow needs to fail and cleanup on its own) 2. We might also hang if we get a disconnet on a queue while the controller is already deleting. This racy flow can cause the controller disable/shutdown admin command to hang. We cannot complete a timed out request from the timeout handler without mutual exclusion from the teardown flow (e.g. nvme_rdma_error_recovery_work). So we serialize it in the timeout handler and teardown io and admin queues to guarantee that no one races with us from completing the request. Reviewed-by: Christoph Hellwig Signed-off-by: Sagi Grimberg Signed-off-by: Jens Axboe drivers/nvme/host/tcp.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) commit 4c174e6366746ae8d49f9cc409f728eebb7a9ac9 Author: Sagi Grimberg Date: Tue Jan 8 00:53:22 2019 -0800 nvme-rdma: fix timeout handler Currently, we have several problems with the timeout handler: 1. If we timeout on the controller establishment flow, we will hang because we don't execute the error recovery (and we shouldn't because the create_ctrl flow needs to fail and cleanup on its own) 2. We might also hang if we get a disconnet on a queue while the controller is already deleting. This racy flow can cause the controller disable/shutdown admin command to hang. We cannot complete a timed out request from the timeout handler without mutual exclusion from the teardown flow (e.g. nvme_rdma_error_recovery_work). So we serialize it in the timeout handler and teardown io and admin queues to guarantee that no one races with us from completing the request. Reported-by: Jaesoo Lee Reviewed-by: Christoph Hellwig Signed-off-by: Sagi Grimberg Signed-off-by: Jens Axboe drivers/nvme/host/rdma.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) commit 063c20e12f8bbbc10cabc2413606b140085beb62 Author: Heiko Schocher Date: Tue Jan 22 06:26:23 2019 +0100 ARM: dts: am335x-shc.dts: fix wrong cd pin level cd pin on mmc1 is GPIO_ACTIVE_LOW not GPIO_ACTIVE_HIGH Fixes: e63201f19438 ("mmc: omap_hsmmc: Delete platform data GPIO CD and WP") Signed-off-by: Heiko Schocher Signed-off-by: Tony Lindgren arch/arm/boot/dts/am335x-shc.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5b90df44fd9b415d8c5d11b92746212a63d3c47f Author: Tony Lindgren Date: Wed Jan 9 20:01:56 2019 +0100 ARM: dts: omap3-gta04: Fix graph_port warning We're currently getting a warning with make dtbs: arch/arm/boot/dts/omap3-gta04.dtsi:720.7-727.4: Warning (graph_port): /ocp@68000000/dss@48050000/encoder@48050c0 0/port: graph node unit address error, expected "0" Tested-by: H. Nikolaus Schaller Acked-by: Rob Herring Signed-off-by: H. Nikolaus Schaller Signed-off-by: Tony Lindgren arch/arm/boot/dts/omap3-gta04.dtsi | 4 ---- 1 file changed, 4 deletions(-) commit ac9c908eecde3ed252cb1d67fc79b3c1346f76bc Author: Arthur Demchenkov Date: Mon Jan 21 06:21:09 2019 +0300 ARM: dts: n900: fix mmc1 card detect gpio polarity Wrong polarity of card detect GPIO pin leads to the system not booting from external mmc, if the back cover of N900 is closed. When the cover is open the system boots fine. This wasn't noticed before, because of a bug, which was fixed by commit e63201f19 (mmc: omap_hsmmc: Delete platform data GPIO CD and WP). Kernels up to 4.19 ignored the card detect GPIO from DT. Fixes: e63201f19438 ("mmc: omap_hsmmc: Delete platform data GPIO CD and WP") Signed-off-by: Arthur Demchenkov Signed-off-by: Tony Lindgren arch/arm/boot/dts/omap3-n900.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a19f74708ef693d7ddc3ee577a458b6807d43e5b Author: Andreas Schwab Date: Thu Jan 10 18:11:39 2019 +0100 tty/serial: use uart_console_write in the RISC-V SBL early console This enables proper NLCR processing. Suggested-by: Anup Patel Signed-off-by: Andreas Schwab Reviewed-by: Anup Patel Reviewed-by: Christoph Hellwig Signed-off-by: Palmer Dabbelt drivers/tty/serial/earlycon-riscv-sbi.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) commit 2a200fb9fb124e2889516c4668c5483bf7107044 Author: Palmer Dabbelt Date: Wed Jan 23 14:09:01 2019 -0800 RISC-V: defconfig: Add CRYPTO_DEV_VIRTIO=y This allows acceleration of cryptography inside QEMU. Signed-off-by: Palmer Dabbelt arch/riscv/configs/defconfig | 1 + 1 file changed, 1 insertion(+) commit e4cf9e47ab244977d12513bb4610a44f88ad5e68 Author: Alistair Francis Date: Sat Jan 12 00:41:26 2019 +0000 RISC-V: defconfig: Enable Generic PCIE by default Enable generic PCIe by default in the RISC-V defconfig, this allows us to use QEMU's PCIe support out of the box. CONFIG_RAS=y is automatically selected by generic PCIe, so it has been dropped from the defconfig. Signed-off-by: Alistair Francis [Palmer: Split out PCIE_XILINX and CRYPTO_DEV_VIRTIO] Signed-off-by: Palmer Dabbelt arch/riscv/configs/defconfig | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 60d8cd572f655aac6107a2330dced004ad1fe3d7 Author: Christoph Hellwig Date: Wed Jan 16 19:01:48 2019 +0100 arm64/xen: fix xen-swiotlb cache flushing Xen-swiotlb hooks into the arm/arm64 arch code through a copy of the DMA DMA mapping operations stored in the struct device arch data. Switching arm64 to use the direct calls for the merged DMA direct / swiotlb code broke this scheme. Replace the indirect calls with direct-calls in xen-swiotlb as well to fix this problem. Fixes: 356da6d0cde3 ("dma-mapping: bypass indirect calls for dma-direct") Reported-by: Julien Grall Signed-off-by: Christoph Hellwig Reviewed-by: Stefano Stabellini arch/arm/include/asm/xen/page-coherent.h | 94 +++++++++++++++++++++++++++++ arch/arm64/include/asm/device.h | 3 - arch/arm64/include/asm/xen/page-coherent.h | 76 +++++++++++++++++++++++ arch/arm64/mm/dma-mapping.c | 4 +- drivers/xen/swiotlb-xen.c | 4 +- include/xen/arm/page-coherent.h | 97 +----------------------------- 6 files changed, 176 insertions(+), 102 deletions(-) commit a37ead8f2efb1595c15079eddac2672630f750ea Author: Palmer Dabbelt Date: Wed Jan 23 12:59:17 2019 -0800 RISC-V: defconfig: Move CONFIG_PCI{,E_XILINX} eb01d42a7778 ("PCI: consolidate PCI config entry in drivers/pci") reorganized the PCI-related Kconfig entries and resulted in a diff in our defconfig. This simply removes the diff. Signed-off-by: Palmer Dabbelt arch/riscv/configs/defconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 86cca81a31cdc6f1f292b5b0c6a4e7e06863cdc9 Author: Antony Pavlov Date: Tue Jan 8 22:45:57 2019 +0300 RISC-V: Kconfig: fix spelling mistake "traget" -> "target" Signed-off-by: Antony Pavlov Reviewed-by: Christoph Hellwig Signed-off-by: Palmer Dabbelt arch/riscv/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8581f38742cf98f55e53a384a2612a1171b3600a Author: Antony Pavlov Date: Tue Jan 8 22:45:38 2019 +0300 RISC-V: asm/page.h: fix spelling mistake "CONFIG_64BITS" -> "CONFIG_64BIT" There is no CONFIG_64BITS Kconfig macro. Please see arch/riscv/Kconfig for details, e.g. linux$ git grep -HnA 1 "config 64BIT" arch/riscv/Kconfig arch/riscv/Kconfig:6:config 64BIT arch/riscv/Kconfig-7- bool Signed-off-by: Antony Pavlov Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/page.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2bb10639f12c925faeed8b4c3678fb92f97b90b7 Author: Andreas Schwab Date: Mon Jan 7 15:16:35 2019 +0100 RISC-V: fix bad use of of_node_put of_find_node_by_type already calls of_node_put, don't call it again. Fixes: 94f9bf118f ("RISC-V: Fix of_node_* refcount") Signed-off-by: Andreas Schwab Reviewed-by: Atish Patra Signed-off-by: Palmer Dabbelt arch/riscv/kernel/smpboot.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) commit 99fd6e875d0c24448a5e2c241422a691be46b241 Author: Vincent Chen Date: Thu Jan 3 11:32:33 2019 +0800 RISC-V: Add _TIF_NEED_RESCHED check for kernel thread when CONFIG_PREEMPT=y The cond_resched() can be used to yield the CPU resource if CONFIG_PREEMPT is not defined. Otherwise, cond_resched() is a dummy function. In order to avoid kernel thread occupying entire CPU, when CONFIG_PREEMPT=y, the kernel thread needs to follow the rescheduling mechanism like a user thread. Signed-off-by: Vincent Chen Tested-by: Guenter Roeck Signed-off-by: Palmer Dabbelt arch/riscv/kernel/asm-offsets.c | 1 + arch/riscv/kernel/entry.S | 18 +++++++++++++++++- 2 files changed, 18 insertions(+), 1 deletion(-) commit ba16adeb346387eb2d1ada69003588be96f098fa Author: Peng Hao Date: Sat Dec 29 13:10:06 2018 +0800 ARM: pxa: ssp: unneeded to free devm_ allocated data devm_ allocated data will be automatically freed. The free of devm_ allocated data is invalid. Fixes: 1c459de1e645 ("ARM: pxa: ssp: use devm_ functions") Signed-off-by: Peng Hao [title's prefix changed] Signed-off-by: Robert Jarzmik arch/arm/plat-pxa/ssp.c | 3 --- 1 file changed, 3 deletions(-) commit 30bac164aca750892b93eef350439a0562a68647 Author: Linus Torvalds Date: Thu Jan 24 09:04:37 2019 +1300 Revert "Change mincore() to count "mapped" pages rather than "cached" pages" This reverts commit 574823bfab82d9d8fa47f422778043fbb4b4f50e. It turns out that my hope that we could just remove the code that exposes the cache residency status from mincore() was too optimistic. There are various random users that want it, and one example would be the Netflix database cluster maintenance. To quote Josh Snyder: "For Netflix, losing accurate information from the mincore syscall would lengthen database cluster maintenance operations from days to months. We rely on cross-process mincore to migrate the contents of a page cache from machine to machine, and across reboots. To do this, I wrote and maintain happycache [1], a page cache dumper/loader tool. It is quite similar in architecture to pgfincore, except that it is agnostic to workload. The gist of happycache's operation is "produce a dump of residence status for each page, do some operation, then reload exactly the same pages which were present before." happycache is entirely dependent on accurate reporting of the in-core status of file-backed pages, as accessed by another process. We primarily use happycache with Cassandra, which (like Postgres + pgfincore) relies heavily on OS page cache to reduce disk accesses. Because our workloads never experience a cold page cache, we are able to provision hardware for a peak utilization level that is far lower than the hypothetical "every query is a cache miss" peak. A database warmed by happycache can be ready for service in seconds (bounded only by the performance of the drives and the I/O subsystem), with no period of in-service degradation. By contrast, putting a database in service without a page cache entails a potentially unbounded period of degradation (at Netflix, the time to populate a single node's cache via natural cache misses varies by workload from hours to weeks). If a single node upgrade were to take weeks, then upgrading an entire cluster would take months. Since we want to apply security upgrades (and other things) on a somewhat tighter schedule, we would have to develop more complex solutions to provide the same functionality already provided by mincore. At the bottom line, happycache is designed to benignly exploit the same information leak documented in the paper [2]. I think it makes perfect sense to remove cross-process mincore functionality from unprivileged users, but not to remove it entirely" We do have an alternate approach that limits the cache residency reporting only to processes that have write permissions to the file, so we can fix the original information leak issue that way. It involves _adding_ code rather than removing it, which is sad, but hey, at least we haven't found any users that would find the restrictions unacceptable. So revert the optimistic first approach to make room for that alternate fix instead. Reported-by: Josh Snyder Cc: Jiri Kosina Cc: Dominique Martinet Cc: Andy Lutomirski Cc: Dave Chinner Cc: Kevin Easton Cc: Matthew Wilcox Cc: Cyril Hrubis Cc: Vlastimil Babka Cc: Tejun Heo Cc: Kirill A. Shutemov Cc: Daniel Gruss Signed-off-by: Linus Torvalds mm/mincore.c | 94 +++++++++++++++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 81 insertions(+), 13 deletions(-) commit db781446312314fb11a860ece9a757db2c2d69f1 Merge: 09c2fe608a26 913a89f009d9 Author: Linus Torvalds Date: Thu Jan 24 09:00:19 2019 +1300 Merge tag 'for-linus-5.0' of git://github.com/cminyard/linux-ipmi Pull IPMI fixes from Corey Minyard: "I missed the merge window, which wasn't really important at the time as there was nothing that critical that I had for 5.0. However, I say that,and then a number of critical fixes come in: - ipmi: fix use-after-free of user->release_barrier.rda - ipmi: Prevent use-after-free in deliver_response - ipmi: msghandler: Fix potential Spectre v1 vulnerabilities which are obvious candidates for 5.0. Then there is: - ipmi:ssif: Fix handling of multi-part return messages which is less critical, but it still has some off-by-one things that are not great, so it seemed appropriate. Some machines are broken without it. Then: - ipmi: Don't initialize anything in the core until something uses it It turns out that using SRCU causes large chunks of memory to be used on big iron machines, even if IPMI is never used. This was causing some issues for people on those machines. Everything here is destined for stable" * tag 'for-linus-5.0' of git://github.com/cminyard/linux-ipmi: ipmi: Don't initialize anything in the core until something uses it ipmi: fix use-after-free of user->release_barrier.rda ipmi: Prevent use-after-free in deliver_response ipmi: msghandler: Fix potential Spectre v1 vulnerabilities ipmi:ssif: Fix handling of multi-part return messages commit 09c2fe608a2608f9c7de7928f96f0ebc6197e195 Merge: 333478a7eb21 60f1bf29c0b2 Author: Linus Torvalds Date: Thu Jan 24 08:58:01 2019 +1300 Merge tag 's390-5.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Martin Schwidefsky: - Do not claim to run under z/VM if the hypervisor can not be identified - Fix crashes due to outdated ASCEs in CR1 - Avoid a deadlock in regard to CPU hotplug - Really fix the vdso mapping issue for compat tasks - Avoid crash on restart due to an incorrect stack address * tag 's390-5.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/smp: Fix calling smp_call_ipl_cpu() from ipl CPU s390/vdso: correct vdso mapping for compat tasks s390/smp: fix CPU hotplug deadlock with CPU rescan s390/mm: always force a load of the primary ASCE on context switch s390/early: improve machine detection commit 63530aba7826a0f8e129874df9c4d264f9db3f9e Author: Eric Dumazet Date: Tue Jan 22 10:40:59 2019 -0800 ax25: fix possible use-after-free syzbot found that ax25 routes where not properly protected against concurrent use [1]. In this particular report the bug happened while copying ax25->digipeat. Fix this problem by making sure we call ax25_get_route() while ax25_route_lock is held, so that no modification could happen while using the route. The current two ax25_get_route() callers do not sleep, so this change should be fine. Once we do that, ax25_get_route() no longer needs to grab a reference on the found route. [1] ax25_connect(): syz-executor0 uses autobind, please contact jreuter@yaina.de BUG: KASAN: use-after-free in memcpy include/linux/string.h:352 [inline] BUG: KASAN: use-after-free in kmemdup+0x42/0x60 mm/util.c:113 Read of size 66 at addr ffff888066641a80 by task syz-executor2/531 ax25_connect(): syz-executor0 uses autobind, please contact jreuter@yaina.de CPU: 1 PID: 531 Comm: syz-executor2 Not tainted 5.0.0-rc2+ #10 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1db/0x2d0 lib/dump_stack.c:113 print_address_description.cold+0x7c/0x20d mm/kasan/report.c:187 kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317 check_memory_region_inline mm/kasan/generic.c:185 [inline] check_memory_region+0x123/0x190 mm/kasan/generic.c:191 memcpy+0x24/0x50 mm/kasan/common.c:130 memcpy include/linux/string.h:352 [inline] kmemdup+0x42/0x60 mm/util.c:113 kmemdup include/linux/string.h:425 [inline] ax25_rt_autobind+0x25d/0x750 net/ax25/ax25_route.c:424 ax25_connect.cold+0x30/0xa4 net/ax25/af_ax25.c:1224 __sys_connect+0x357/0x490 net/socket.c:1664 __do_sys_connect net/socket.c:1675 [inline] __se_sys_connect net/socket.c:1672 [inline] __x64_sys_connect+0x73/0xb0 net/socket.c:1672 do_syscall_64+0x1a3/0x800 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x458099 Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f870ee22c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000458099 RDX: 0000000000000048 RSI: 0000000020000080 RDI: 0000000000000005 RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 ax25_connect(): syz-executor4 uses autobind, please contact jreuter@yaina.de R10: 0000000000000000 R11: 0000000000000246 R12: 00007f870ee236d4 R13: 00000000004be48e R14: 00000000004ce9a8 R15: 00000000ffffffff Allocated by task 526: save_stack+0x45/0xd0 mm/kasan/common.c:73 set_track mm/kasan/common.c:85 [inline] __kasan_kmalloc mm/kasan/common.c:496 [inline] __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:469 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:504 ax25_connect(): syz-executor5 uses autobind, please contact jreuter@yaina.de kmem_cache_alloc_trace+0x151/0x760 mm/slab.c:3609 kmalloc include/linux/slab.h:545 [inline] ax25_rt_add net/ax25/ax25_route.c:95 [inline] ax25_rt_ioctl+0x3b9/0x1270 net/ax25/ax25_route.c:233 ax25_ioctl+0x322/0x10b0 net/ax25/af_ax25.c:1763 sock_do_ioctl+0xe2/0x400 net/socket.c:950 sock_ioctl+0x32f/0x6c0 net/socket.c:1074 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:509 [inline] do_vfs_ioctl+0x107b/0x17d0 fs/ioctl.c:696 ksys_ioctl+0xab/0xd0 fs/ioctl.c:713 __do_sys_ioctl fs/ioctl.c:720 [inline] __se_sys_ioctl fs/ioctl.c:718 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718 do_syscall_64+0x1a3/0x800 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe ax25_connect(): syz-executor5 uses autobind, please contact jreuter@yaina.de Freed by task 550: save_stack+0x45/0xd0 mm/kasan/common.c:73 set_track mm/kasan/common.c:85 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/common.c:458 kasan_slab_free+0xe/0x10 mm/kasan/common.c:466 __cache_free mm/slab.c:3487 [inline] kfree+0xcf/0x230 mm/slab.c:3806 ax25_rt_add net/ax25/ax25_route.c:92 [inline] ax25_rt_ioctl+0x304/0x1270 net/ax25/ax25_route.c:233 ax25_ioctl+0x322/0x10b0 net/ax25/af_ax25.c:1763 sock_do_ioctl+0xe2/0x400 net/socket.c:950 sock_ioctl+0x32f/0x6c0 net/socket.c:1074 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:509 [inline] do_vfs_ioctl+0x107b/0x17d0 fs/ioctl.c:696 ksys_ioctl+0xab/0xd0 fs/ioctl.c:713 __do_sys_ioctl fs/ioctl.c:720 [inline] __se_sys_ioctl fs/ioctl.c:718 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718 do_syscall_64+0x1a3/0x800 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff888066641a80 which belongs to the cache kmalloc-96 of size 96 The buggy address is located 0 bytes inside of 96-byte region [ffff888066641a80, ffff888066641ae0) The buggy address belongs to the page: page:ffffea0001999040 count:1 mapcount:0 mapping:ffff88812c3f04c0 index:0x0 flags: 0x1fffc0000000200(slab) ax25_connect(): syz-executor4 uses autobind, please contact jreuter@yaina.de raw: 01fffc0000000200 ffffea0001817948 ffffea0002341dc8 ffff88812c3f04c0 raw: 0000000000000000 ffff888066641000 0000000100000020 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888066641980: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ffff888066641a00: 00 00 00 00 00 00 00 00 02 fc fc fc fc fc fc fc >ffff888066641a80: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ^ ffff888066641b00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ffff888066641b80: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc Signed-off-by: Eric Dumazet Cc: Ralf Baechle Reported-by: syzbot Signed-off-by: David S. Miller include/net/ax25.h | 12 ++++++++++++ net/ax25/ax25_ip.c | 4 ++-- net/ax25/ax25_route.c | 19 ++++++++----------- 3 files changed, 22 insertions(+), 13 deletions(-) commit 3366463513f544c12c6b88c13da4462ee9e7a1a1 Author: Edward Cree Date: Tue Jan 22 19:02:17 2019 +0000 sfc: suppress duplicate nvmem partition types in efx_ef10_mtd_probe Use a bitmap to keep track of which partition types we've already seen; for duplicates, return -EEXIST from efx_ef10_mtd_probe_partition() and thus skip adding that partition. Duplicate partitions occur because of the A/B backup scheme used by newer sfc NICs. Prior to this patch they cause sysfs_warn_dup errors because they have the same name, causing us not to expose any MTDs at all. Signed-off-by: Edward Cree Signed-off-by: David S. Miller drivers/net/ethernet/sfc/ef10.c | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-) commit 52d3b4949192e93b948daaa40678fcd4b94bcbd0 Author: Adrian Vladu Date: Thu Jan 3 19:43:08 2019 +0000 hv_netvsc: fix typos in code comments Fix all typos from hyperv netvsc code comments. Signed-off-by: Adrian Vladu Cc: "K. Y. Srinivasan" Cc: Haiyang Zhang Cc: Stephen Hemminger Cc: Sasha Levin Cc: "David S. Miller" Cc: "Alessandro Pilotti" Signed-off-by: Sasha Levin drivers/net/hyperv/hyperv_net.h | 2 +- drivers/net/hyperv/netvsc.c | 2 +- drivers/net/hyperv/netvsc_drv.c | 6 +++--- drivers/net/hyperv/rndis_filter.c | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-) commit 17d91256898402daf4425cc541ac9cbf64574d9a Author: Haiyang Zhang Date: Tue Jan 15 00:51:44 2019 +0000 hv_netvsc: Fix hash key value reset after other ops Changing mtu, channels, or buffer sizes ops call to netvsc_attach(), rndis_set_subchannel(), which always reset the hash key to default value. That will override hash key changed previously. This patch fixes the problem by save the hash key, then restore it when we re- add the netvsc device. Fixes: ff4a44199012 ("netvsc: allow get/set of RSS indirection table") Signed-off-by: Haiyang Zhang Reviewed-by: Michael Kelley [sl: fix up subject line] Signed-off-by: Sasha Levin drivers/net/hyperv/hyperv_net.h | 10 +++++++--- drivers/net/hyperv/netvsc.c | 2 +- drivers/net/hyperv/netvsc_drv.c | 5 ++++- drivers/net/hyperv/rndis_filter.c | 9 +++++++-- 4 files changed, 19 insertions(+), 7 deletions(-) commit 7c9f335a3ff20557a92584199f3d35c7e992bbe5 Author: Haiyang Zhang Date: Tue Jan 15 00:51:43 2019 +0000 hv_netvsc: Refactor assignments of struct netvsc_device_info These assignments occur in multiple places. The patch refactor them to a function for simplicity. It also puts the struct to heap area for future expension. Signed-off-by: Haiyang Zhang Reviewed-by: Michael Kelley [sl: fix up subject line] Signed-off-by: Sasha Levin drivers/net/hyperv/netvsc_drv.c | 134 +++++++++++++++++++++++++--------------- 1 file changed, 85 insertions(+), 49 deletions(-) commit b4a10c750424e01b5e37372fef0a574ebf7b56c3 Author: Haiyang Zhang Date: Tue Jan 15 00:51:42 2019 +0000 hv_netvsc: Fix ethtool change hash key error Hyper-V hosts require us to disable RSS before changing RSS key, otherwise the changing request will fail. This patch fixes the coding error. Fixes: ff4a44199012 ("netvsc: allow get/set of RSS indirection table") Reported-by: Wei Hu Signed-off-by: Haiyang Zhang Reviewed-by: Michael Kelley [sl: fix up subject line] Signed-off-by: Sasha Levin drivers/net/hyperv/rndis_filter.c | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-) commit 12da64300fbc76b875900445f4146c3dc617d43e Author: Simon Horman Date: Wed Jan 23 12:14:52 2019 +0100 ravb: expand rx descriptor data to accommodate hw checksum EtherAVB may provide a checksum of packet data appended to packet data. In order to allow this checksum to be received by the host descriptor data needs to be enlarged by 2 bytes to accommodate the checksum. In the case of MTU-sized packets without a VLAN tag the checksum were already accommodated by virtue of the space reserved for the VLAN tag. However, a packet of MTU-size with a VLAN tag consumed all packet data space provided by a descriptor leaving no space for the trailing checksum. This was not detected by the driver which incorrectly used the last two bytes of packet data as the checksum and truncate the packet by two bytes. This resulted all such packets being dropped. A work around is to disable RX checksum offload # ethtool -K eth0 rx off This patch resolves this problem by increasing the size available for packet data in RX descriptors by two bytes. Tested on R-Car E3 (r8a77990) ES1.0 based Ebisu-4D board v2 * Use sizeof(__sum16) directly rather than adding a driver-local #define for the size of the checksum provided by the hw (2 bytes). Fixes: 4d86d3818627 ("ravb: RX checksum offload") Signed-off-by: Simon Horman Reviewed-by: Sergei Shtylyov Signed-off-by: David S. Miller drivers/net/ethernet/renesas/ravb_main.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) commit 913a89f009d98c85a902d718cd54bb32ab11d167 Author: Corey Minyard Date: Thu Dec 20 16:50:23 2018 -0600 ipmi: Don't initialize anything in the core until something uses it The IPMI driver was recently modified to use SRCU, but it turns out this uses a chunk of percpu memory, even if IPMI is never used. So modify thing to on initialize on the first use. There was already code to sort of handle this for handling init races, so piggy back on top of that, and simplify it in the process. Signed-off-by: Corey Minyard Reported-by: Tejun Heo Cc: Paul E. McKenney Reviewed-by: Paul E. McKenney Cc: stable@vger.kernel.org # 4.18 drivers/char/ipmi/ipmi_msghandler.c | 143 ++++++++++++++++++++---------------- 1 file changed, 80 insertions(+), 63 deletions(-) commit 77f8269606bf95fcb232ee86f6da80886f1dfae8 Author: Yang Yingliang Date: Wed Jan 16 13:33:22 2019 +0800 ipmi: fix use-after-free of user->release_barrier.rda When we do the following test, we got oops in ipmi_msghandler driver while((1)) do service ipmievd restart & service ipmievd restart done --------------------------------------------------------------- [ 294.230186] Unable to handle kernel paging request at virtual address 0000803fea6ea008 [ 294.230188] Mem abort info: [ 294.230190] ESR = 0x96000004 [ 294.230191] Exception class = DABT (current EL), IL = 32 bits [ 294.230193] SET = 0, FnV = 0 [ 294.230194] EA = 0, S1PTW = 0 [ 294.230195] Data abort info: [ 294.230196] ISV = 0, ISS = 0x00000004 [ 294.230197] CM = 0, WnR = 0 [ 294.230199] user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000a1c1b75a [ 294.230201] [0000803fea6ea008] pgd=0000000000000000 [ 294.230204] Internal error: Oops: 96000004 [#1] SMP [ 294.235211] Modules linked in: nls_utf8 isofs rpcrdma ib_iser ib_srpt target_core_mod ib_srp scsi_transport_srp ib_ipoib rdma_ucm ib_umad rdma_cm ib_cm iw_cm dm_mirror dm_region_hash dm_log dm_mod aes_ce_blk crypto_simd cryptd aes_ce_cipher ghash_ce sha2_ce ses sha256_arm64 sha1_ce hibmc_drm hisi_sas_v2_hw enclosure sg hisi_sas_main sbsa_gwdt ip_tables mlx5_ib ib_uverbs marvell ib_core mlx5_core ixgbe ipmi_si mdio hns_dsaf ipmi_devintf ipmi_msghandler hns_enet_drv hns_mdio [ 294.277745] CPU: 3 PID: 0 Comm: swapper/3 Kdump: loaded Not tainted 5.0.0-rc2+ #113 [ 294.285511] Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.37 11/21/2017 [ 294.292835] pstate: 80000005 (Nzcv daif -PAN -UAO) [ 294.297695] pc : __srcu_read_lock+0x38/0x58 [ 294.301940] lr : acquire_ipmi_user+0x2c/0x70 [ipmi_msghandler] [ 294.307853] sp : ffff00001001bc80 [ 294.311208] x29: ffff00001001bc80 x28: ffff0000117e5000 [ 294.316594] x27: 0000000000000000 x26: dead000000000100 [ 294.321980] x25: dead000000000200 x24: ffff803f6bd06800 [ 294.327366] x23: 0000000000000000 x22: 0000000000000000 [ 294.332752] x21: ffff00001001bd04 x20: ffff80df33d19018 [ 294.338137] x19: ffff80df33d19018 x18: 0000000000000000 [ 294.343523] x17: 0000000000000000 x16: 0000000000000000 [ 294.348908] x15: 0000000000000000 x14: 0000000000000002 [ 294.354293] x13: 0000000000000000 x12: 0000000000000000 [ 294.359679] x11: 0000000000000000 x10: 0000000000100000 [ 294.365065] x9 : 0000000000000000 x8 : 0000000000000004 [ 294.370451] x7 : 0000000000000000 x6 : ffff80df34558678 [ 294.375836] x5 : 000000000000000c x4 : 0000000000000000 [ 294.381221] x3 : 0000000000000001 x2 : 0000803fea6ea000 [ 294.386607] x1 : 0000803fea6ea008 x0 : 0000000000000001 [ 294.391994] Process swapper/3 (pid: 0, stack limit = 0x0000000083087293) [ 294.398791] Call trace: [ 294.401266] __srcu_read_lock+0x38/0x58 [ 294.405154] acquire_ipmi_user+0x2c/0x70 [ipmi_msghandler] [ 294.410716] deliver_response+0x80/0xf8 [ipmi_msghandler] [ 294.416189] deliver_local_response+0x28/0x68 [ipmi_msghandler] [ 294.422193] handle_one_recv_msg+0x158/0xcf8 [ipmi_msghandler] [ 294.432050] handle_new_recv_msgs+0xc0/0x210 [ipmi_msghandler] [ 294.441984] smi_recv_tasklet+0x8c/0x158 [ipmi_msghandler] [ 294.451618] tasklet_action_common.isra.5+0x88/0x138 [ 294.460661] tasklet_action+0x2c/0x38 [ 294.468191] __do_softirq+0x120/0x2f8 [ 294.475561] irq_exit+0x134/0x140 [ 294.482445] __handle_domain_irq+0x6c/0xc0 [ 294.489954] gic_handle_irq+0xb8/0x178 [ 294.497037] el1_irq+0xb0/0x140 [ 294.503381] arch_cpu_idle+0x34/0x1a8 [ 294.510096] do_idle+0x1d4/0x290 [ 294.516322] cpu_startup_entry+0x28/0x30 [ 294.523230] secondary_start_kernel+0x184/0x1d0 [ 294.530657] Code: d538d082 d2800023 8b010c81 8b020021 (c85f7c25) [ 294.539746] ---[ end trace 8a7a880dee570b29 ]--- [ 294.547341] Kernel panic - not syncing: Fatal exception in interrupt [ 294.556837] SMP: stopping secondary CPUs [ 294.563996] Kernel Offset: disabled [ 294.570515] CPU features: 0x002,21006008 [ 294.577638] Memory Limit: none [ 294.587178] Starting crashdump kernel... [ 294.594314] Bye! Because the user->release_barrier.rda is freed in ipmi_destroy_user(), but the refcount is not zero, when acquire_ipmi_user() uses user->release_barrier.rda in __srcu_read_lock(), it causes oops. Fix this by calling cleanup_srcu_struct() when the refcount is zero. Fixes: e86ee2d44b44 ("ipmi: Rework locking and shutdown for hot remove") Cc: stable@vger.kernel.org # 4.18 Signed-off-by: Yang Yingliang Signed-off-by: Corey Minyard drivers/char/ipmi/ipmi_msghandler.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 479d6b39b9e0d2de648ebf146f23a1e40962068f Author: Fred Klassen Date: Sat Jan 19 14:28:18 2019 -0800 ipmi: Prevent use-after-free in deliver_response Some IPMI modules (e.g. ibmpex_msg_handler()) will have ipmi_usr_hdlr handlers that call ipmi_free_recv_msg() directly. This will essentially kfree(msg), leading to use-after-free. This does not happen in the ipmi_devintf module, which will queue the message and run ipmi_free_recv_msg() later. BUG: KASAN: use-after-free in deliver_response+0x12f/0x1b0 Read of size 8 at addr ffff888a7bf20018 by task ksoftirqd/3/27 CPU: 3 PID: 27 Comm: ksoftirqd/3 Tainted: G O 4.19.11-amd64-ani99-debug #12.0.1.601133+pv Hardware name: AppNeta r1000/X11SPW-TF, BIOS 2.1a-AP 09/17/2018 Call Trace: dump_stack+0x92/0xeb print_address_description+0x73/0x290 kasan_report+0x258/0x380 deliver_response+0x12f/0x1b0 ? ipmi_free_recv_msg+0x50/0x50 deliver_local_response+0xe/0x50 handle_one_recv_msg+0x37a/0x21d0 handle_new_recv_msgs+0x1ce/0x440 ... Allocated by task 9885: kasan_kmalloc+0xa0/0xd0 kmem_cache_alloc_trace+0x116/0x290 ipmi_alloc_recv_msg+0x28/0x70 i_ipmi_request+0xb4a/0x1640 ipmi_request_settime+0x1b8/0x1e0 ... Freed by task 27: __kasan_slab_free+0x12e/0x180 kfree+0xe9/0x280 deliver_response+0x122/0x1b0 deliver_local_response+0xe/0x50 handle_one_recv_msg+0x37a/0x21d0 handle_new_recv_msgs+0x1ce/0x440 tasklet_action_common.isra.19+0xc4/0x250 __do_softirq+0x11f/0x51f Fixes: e86ee2d44b44 ("ipmi: Rework locking and shutdown for hot remove") Cc: stable@vger.kernel.org # 4.18 Signed-off-by: Fred Klassen Signed-off-by: Corey Minyard drivers/char/ipmi/ipmi_msghandler.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a7102c7461794a5bb31af24b08e9e0f50038897a Author: Gustavo A. R. Silva Date: Wed Jan 9 17:39:06 2019 -0600 ipmi: msghandler: Fix potential Spectre v1 vulnerabilities channel and addr->channel are indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. These issues were detected with the help of Smatch: drivers/char/ipmi/ipmi_msghandler.c:1381 ipmi_set_my_address() warn: potential spectre issue 'user->intf->addrinfo' [w] (local cap) drivers/char/ipmi/ipmi_msghandler.c:1401 ipmi_get_my_address() warn: potential spectre issue 'user->intf->addrinfo' [r] (local cap) drivers/char/ipmi/ipmi_msghandler.c:1421 ipmi_set_my_LUN() warn: potential spectre issue 'user->intf->addrinfo' [w] (local cap) drivers/char/ipmi/ipmi_msghandler.c:1441 ipmi_get_my_LUN() warn: potential spectre issue 'user->intf->addrinfo' [r] (local cap) drivers/char/ipmi/ipmi_msghandler.c:2260 check_addr() warn: potential spectre issue 'intf->addrinfo' [r] (local cap) Fix this by sanitizing channel and addr->channel before using them to index user->intf->addrinfo and intf->addrinfo, correspondingly. Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://lore.kernel.org/lkml/20180423164740.GY17484@dhcp22.suse.cz/ Cc: stable@vger.kernel.org Signed-off-by: Gustavo A. R. Silva Signed-off-by: Corey Minyard drivers/char/ipmi/ipmi_msghandler.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) commit 7d6380cd40f7993f75c4bde5b36f6019237e8719 Author: Corey Minyard Date: Fri Nov 16 09:59:21 2018 -0600 ipmi:ssif: Fix handling of multi-part return messages The block number was not being compared right, it was off by one when checking the response. Some statistics wouldn't be incremented properly in some cases. Check to see if that middle-part messages always have 31 bytes of data. Signed-off-by: Corey Minyard Cc: stable@vger.kernel.org # 4.4 drivers/char/ipmi/ipmi_ssif.c | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-) commit 2095a45e345e669ea77a9b34bdd7de5ceb422f93 Author: Axel Lin Date: Wed Jan 23 08:00:57 2019 +0800 gpio: altera-a10sr: Set proper output level for direction_output The altr_a10sr_gpio_direction_output should set proper output level based on the value argument. Fixes: 26a48c4cc2f1 ("gpio: altera-a10sr: Add A10 System Resource Chip GPIO support.") Cc: Signed-off-by: Axel Lin Tested by: Thor Thayer Reviewed by: Thor Thayer Signed-off-by: Bartosz Golaszewski drivers/gpio/gpio-altera-a10sr.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit f785ffb61605734b518afa766d1b5445e9f38c8d Author: Neo Hou Date: Wed Jan 16 13:06:14 2019 +0800 gpio: sprd: Fix incorrect irq type setting for the async EIC When setting async EIC as IRQ_TYPE_EDGE_BOTH type, we missed to set the SPRD_EIC_ASYNC_INTMODE register to 0, which means detecting edge signals. Thus this patch fixes the issue. Fixes: 25518e024e3a ("gpio: Add Spreadtrum EIC driver support") Cc: Signed-off-by: Neo Hou Signed-off-by: Baolin Wang Signed-off-by: Bartosz Golaszewski drivers/gpio/gpio-eic-sprd.c | 1 + 1 file changed, 1 insertion(+) commit 09d158d52d2bceda736797a61b6c13d7fc83707b Author: Neo Hou Date: Wed Jan 16 13:06:13 2019 +0800 gpio: sprd: Fix the incorrect data register Since differnt type EICs have its own data register to read, thus fix the incorrect data register. Fixes: 25518e024e3a ("gpio: Add Spreadtrum EIC driver support") Cc: Signed-off-by: Neo Hou Signed-off-by: Baolin Wang Signed-off-by: Bartosz Golaszewski drivers/gpio/gpio-eic-sprd.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) commit 1033be58992f818dc564196ded2bcc3f360bc297 Author: Bartosz Golaszewski Date: Fri Jan 4 11:24:20 2019 +0100 gpiolib: fix line event timestamps for nested irqs Nested interrupts run inside the calling thread's context and the top half handler is never called which means that we never read the timestamp. This issue came up when trying to read line events from a gpiochip using regmap_irq_chip for interrupts. Fix it by reading the timestamp from the irq thread function if it's still 0 by the time the second handler is called. Fixes: d58f2bf261fd ("gpio: Timestamp events in hardirq handler") Cc: stable@vger.kernel.org Signed-off-by: Bartosz Golaszewski drivers/gpio/gpiolib.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit 2486e67374aa8b7854c2de32869642c2873b3d53 Author: Roger Quadros Date: Wed Jan 9 11:11:24 2019 +0200 gpio: pcf857x: Fix interrupts on multiple instances When multiple instances of pcf857x chips are present, a fix up message [1] is printed during the probe of the 2nd and later instances. The issue is that the driver is using the same irq_chip data structure between multiple instances. Fix this by allocating the irq_chip data structure per instance. [1] fix up message addressed by this patch [ 1.212100] gpio gpiochip9: (pcf8575): detected irqchip that is shared with multiple gpiochips: please fix the driver. Cc: Stable Signed-off-by: Roger Quadros Signed-off-by: Bartosz Golaszewski drivers/gpio/gpio-pcf857x.c | 26 ++++++++++++-------------- 1 file changed, 12 insertions(+), 14 deletions(-) commit 9a71ac7e15a723e90fc40388b4b92eefaabf747c Author: Alexey Kardashevskiy Date: Wed Jan 23 15:07:11 2019 +1100 vfio-pci/nvlink2: Fix ancient gcc warnings Using the {0} construct as a generic initializer is perfectly fine in C, however due to a bug in old gcc there is a warning: + /kisskb/src/drivers/vfio/pci/vfio_pci_nvlink2.c: warning: (near initialization for 'cap.header') [-Wmissing-braces]: => 181:9 Since for whatever reason we still want to compile the modern kernel with such an old gcc without warnings, this changes the capabilities initialization. The gcc bugzilla: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53119 Fixes: 7f92891778df ("vfio_pci: Add NVIDIA GV100GL [Tesla V100 SXM2] subdriver") Signed-off-by: Alexey Kardashevskiy Reported-by: Geert Uytterhoeven Signed-off-by: Alex Williamson drivers/vfio/pci/vfio_pci_nvlink2.c | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) commit 5fa98c2eda35fcd1a1d91a9785c390f54688240c Author: Rob Herring Date: Tue Jan 22 09:10:10 2019 -0600 dt-bindings: Fix dt_binding_check target for in tree builds On in tree builds, subsequent builds will incorrectly include the intermediate file 'processed-schema.yaml' with the input schema files resulting in a build error. Update the find command to ignore processed-schema.yaml. Signed-off-by: Rob Herring Documentation/devicetree/bindings/Makefile | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit da5d2748e4a4512237764d2a53bdf686eccee18b Author: Joerg Roedel Date: Wed Jan 23 08:46:29 2019 +0100 iommu/mediatek: Use correct fwspec in mtk_iommu_add_device() The mtk_iommu_add_device() function keeps the fwspec in an on-stack pointer and calls mtk_iommu_create_mapping(), which might change its source, dev->iommu_fwspec. This causes the on-stack pointer to be obsoleted and the device initialization to fail. Update the on-stack fwspec pointer after mtk_iommu_create_mapping() has been called. Reported-by: Frank Wunderlich Fixes: a9bf2eec5a6f ('iommu/mediatek: Use helper functions to access dev->iommu_fwspec') Tested-by: Frank Wunderlich Signed-off-by: Joerg Roedel drivers/iommu/mtk_iommu_v1.c | 4 ++++ 1 file changed, 4 insertions(+) commit c9e4576743eeda8d24dedc164d65b78877f9a98c Author: Yafang Shao Date: Wed Jan 23 12:37:19 2019 +0800 bpf: sock recvbuff must be limited by rmem_max in bpf_setsockopt() When sock recvbuff is set by bpf_setsockopt(), the value must by limited by rmem_max. It is the same with sendbuff. Fixes: 8c4b4c7e9ff0 ("bpf: Add setsockopt helper function to bpf") Signed-off-by: Yafang Shao Acked-by: Martin KaFai Lau Acked-by: Lawrence Brakmo Signed-off-by: Daniel Borkmann net/core/filter.c | 2 ++ 1 file changed, 2 insertions(+) commit eb0200a4357da100064971689d3a0e9e3cf57f33 Author: Lucas Stach Date: Tue Dec 18 16:46:29 2018 +0100 gpu: ipu-v3: pre: don't trigger update if buffer address doesn't change On a NOP double buffer update where current buffer address is the same as the next buffer address, the SDW_UPDATE bit clears too late. As we are now using this bit to determine when it is safe to signal flip completion to userspace this will delay completion of atomic commits where one plane doesn't change the buffer by a whole frame period. Fix this by remembering the last buffer address and just skip the double buffer update if it would not change the buffer address. Signed-off-by: Lucas Stach [p.zabel@pengutronix.de: initialize last_bufaddr in ipu_pre_configure] Signed-off-by: Philipp Zabel drivers/gpu/ipu-v3/ipu-pre.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 6a6a797625b5fe855bf60c798561896e311d58ce Author: Biju Das Date: Tue Jan 22 15:25:45 2019 +0000 ARM: dts: r8a7743: Convert to new LVDS DT bindings The internal LVDS encoder now has DT bindings separate from the DU. Port the device tree over to the new model. Fixes: c6a27fa41fab ("drm: rcar-du: Convert LVDS encoder code to bridge driver") Signed-off-by: Biju Das Reviewed-by: Laurent Pinchart Signed-off-by: Simon Horman arch/arm/boot/dts/r8a7743.dtsi | 36 ++++++++++++++++++++++++++++++------ 1 file changed, 30 insertions(+), 6 deletions(-) commit b0ca5ecb8e2279d706261f525f1bd0ba9e3fe800 Author: Paolo Abeni Date: Mon Jan 21 12:36:12 2019 +0100 bpftool: fix percpu maps updating When updating a percpu map, bpftool currently copies the provided value only into the first per CPU copy of the specified value, all others instances are left zeroed. This change explicitly copies the user-provided bytes to all the per CPU instances, keeping the sub-command syntax unchanged. v2 -> v3: - drop unused argument, as per Quentin's suggestion v1 -> v2: - rename the helper as per Quentin's suggestion Fixes: 71bb428fe2c1 ("tools: bpf: add bpftool") Signed-off-by: Paolo Abeni Reviewed-by: Quentin Monnet Signed-off-by: Daniel Borkmann tools/bpf/bpftool/map.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) commit 752bcf80f5549c9901b2e8bc77b2138de55b1026 Author: Jiri Olsa Date: Fri Jan 18 13:58:17 2019 +0100 bpftool: Fix prog dump by tag Lance reported an issue with bpftool not being able to dump program if there are more programs loaded and you want to dump any but the first program, like: # bpftool prog 28: kprobe name trace_req_start tag 1dfc28ba8b3dd597 gpl loaded_at 2019-01-18T17:02:40+1100 uid 0 xlated 112B jited 109B memlock 4096B map_ids 13 29: kprobe name trace_req_compl tag 5b6a5ecc6030a683 gpl loaded_at 2019-01-18T17:02:40+1100 uid 0 xlated 928B jited 575B memlock 4096B map_ids 13,14 # bpftool prog dum jited tag 1dfc28ba8b3dd597 0: push %rbp 1: mov %rsp,%rbp ... # bpftool prog dum jited tag 5b6a5ecc6030a683 Error: can't get prog info (29): Bad address The problem is in the prog_fd_by_tag function not cleaning the struct bpf_prog_info before another request, so the previous program length is still in there and kernel assumes it needs to dump the program, which fails because there's no user pointer set. Moving the struct bpf_prog_info declaration into the loop, so it gets cleaned before each query. Fixes: 71bb428fe2c1 ("tools: bpf: add bpftool") Reported-by: Lance Digby Signed-off-by: Jiri Olsa Reviewed-by: Quentin Monnet Acked-by: Jakub Kicinski Signed-off-by: Daniel Borkmann tools/bpf/bpftool/prog.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 0f75551216091223efe1f18295f655aff6415385 Author: Weinan Li Date: Tue Jan 22 13:46:27 2019 +0800 drm/i915/gvt: release shadow batch buffer and wa_ctx before destroy one workload GVT-g will shadow the privilege batch buffer and the indirect context during command scan, move the release process into intel_vgpu_destroy_workload() to ensure the resources are recycled properly. Fixes: 0cce2823ed37 ("drm/i915/gvt/kvmgt:Refine error handling for prepare_execlist_workload") Reviewed-by: Zhenyu Wang Signed-off-by: Weinan Li Signed-off-by: Zhenyu Wang drivers/gpu/drm/i915/gvt/scheduler.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) commit ab06418b7fb8cc1bf82cbce3ebd74e1bbf446d06 Author: Andrew Lunn Date: Mon Jan 21 19:08:49 2019 +0100 net: phy: Fixup GPLv2+ SPDX tags based on license text A few PHY drivers have the GPLv2+ license text. They then either have a MODULE_LICENSE() of GPLv2 only, or an SPDX tag of GPLv2 only. Since the license text is much easier to understand than either the SPDX tag or the MODULE_LICENSE, use it as the definitive source of the licence, and fixup the others when there are contradictions. Cc: David Wu Cc: Dongpo Li Cc: Michael Schmitz Signed-off-by: Andrew Lunn Acked-by: Michael Schmitz Signed-off-by: David S. Miller drivers/net/phy/asix.c | 8 +------- drivers/net/phy/mdio-hisi-femac.c | 16 ++-------------- drivers/net/phy/rockchip.c | 9 ++------- 3 files changed, 5 insertions(+), 28 deletions(-) commit 25974d8af1bc5116f0d79fc6722425930fd8c0e9 Author: Stefan Agner Date: Mon Jan 21 15:58:47 2019 +0100 net: fec: get regulator optional According to the device tree binding the phy-supply property is optional. Use the regulator_get_optional API accordingly. The code already handles NULL just fine. This gets rid of the following warning: fec 2188000.ethernet: 2188000.ethernet supply phy not found, using dummy regulator Signed-off-by: Stefan Agner Reviewed-by: Marcel Ziswiler Acked-by: Fugang Duan Signed-off-by: David S. Miller drivers/net/ethernet/freescale/fec_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7c62b8dd5ca89dabd9f455d19e663bad60951bd5 Author: Lubomir Rintel Date: Mon Jan 21 14:54:20 2019 +0100 net/ipv6: lower the level of "link is not ready" messages This message gets logged far too often for how interesting is it. Most distributions nowadays configure NetworkManager to use randomly generated MAC addresses for Wi-Fi network scans. The interfaces end up being periodically brought down for the address change. When they're subsequently brought back up, the message is logged, eventually flooding the log. Perhaps the message is not all that helpful: it seems to be more interesting to hear when the addrconf actually start, not when it does not. Let's lower its level. Signed-off-by: Lubomir Rintel Acked-By: Thomas Haller Signed-off-by: David S. Miller net/ipv6/addrconf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 333478a7eb21245880c89aad166ad08478cc577d Merge: 0b0d4be6b488 129699bb8c75 Author: Linus Torvalds Date: Wed Jan 23 16:23:41 2019 +1300 Merge branch 'for-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux Pull thermal management fixes from Zhang Rui: - Fix a race condition that sysfs could be accessed before necessary initialization in int340x thermal driver. (Aaron Hill) - Fix a NULL vs IS_ERR() check in int340x thermal driver. (Dan Carpenter) * 'for-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux: drivers: thermal: int340x_thermal: Fix sysfs race condition thermal: int340x_thermal: Fix a NULL vs IS_ERR() check commit d67247566450cf89a693307c9bc9f05a32d96cea Author: Marc Gonzalez Date: Tue Jan 22 18:29:22 2019 +0100 scsi: ufs: Use explicit access size in ufshcd_dump_regs memcpy_fromio() doesn't provide any control over access size. For example, on arm64, it is implemented using readb and readq. This may trigger a synchronous external abort: [ 3.729943] Internal error: synchronous external abort: 96000210 [#1] PREEMPT SMP [ 3.737000] Modules linked in: [ 3.744371] CPU: 2 PID: 1 Comm: swapper/0 Tainted: G S 4.20.0-rc4 #16 [ 3.747413] Hardware name: Qualcomm Technologies, Inc. MSM8998 v1 MTP (DT) [ 3.755295] pstate: 00000005 (nzcv daif -PAN -UAO) [ 3.761978] pc : __memcpy_fromio+0x68/0x80 [ 3.766718] lr : ufshcd_dump_regs+0x50/0xb0 [ 3.770767] sp : ffff00000807ba00 [ 3.774830] x29: ffff00000807ba00 x28: 00000000fffffffb [ 3.778344] x27: ffff0000089db068 x26: ffff8000f6e58000 [ 3.783728] x25: 000000000000000e x24: 0000000000000800 [ 3.789023] x23: ffff8000f6e587c8 x22: 0000000000000800 [ 3.794319] x21: ffff000008908368 x20: ffff8000f6e1ab80 [ 3.799615] x19: 000000000000006c x18: ffffffffffffffff [ 3.804910] x17: 0000000000000000 x16: 0000000000000000 [ 3.810206] x15: ffff000009199648 x14: ffff000089244187 [ 3.815502] x13: ffff000009244195 x12: ffff0000091ab000 [ 3.820797] x11: 0000000005f5e0ff x10: ffff0000091998a0 [ 3.826093] x9 : 0000000000000000 x8 : ffff8000f6e1ac00 [ 3.831389] x7 : 0000000000000000 x6 : 0000000000000068 [ 3.836676] x5 : ffff8000f6e1abe8 x4 : 0000000000000000 [ 3.841971] x3 : ffff00000928c868 x2 : ffff8000f6e1abec [ 3.847267] x1 : ffff00000928c868 x0 : ffff8000f6e1abe8 [ 3.852567] Process swapper/0 (pid: 1, stack limit = 0x(____ptrval____)) [ 3.857900] Call trace: [ 3.864473] __memcpy_fromio+0x68/0x80 [ 3.866683] ufs_qcom_dump_dbg_regs+0x1c0/0x370 [ 3.870522] ufshcd_print_host_regs+0x168/0x190 [ 3.874946] ufshcd_init+0xd4c/0xde0 [ 3.879459] ufshcd_pltfrm_init+0x3c8/0x550 [ 3.883264] ufs_qcom_probe+0x24/0x60 [ 3.887188] platform_drv_probe+0x50/0xa0 Assuming aligned 32-bit registers, let's use readl, after making sure that 'offset' and 'len' are indeed multiples of 4. Fixes: ba80917d9932d ("scsi: ufs: ufshcd_dump_regs to use memcpy_fromio") Cc: Signed-off-by: Marc Gonzalez Acked-by: Tomas Winkler Reviewed-by: Jeffrey Hugo Reviewed-by: Bjorn Andersson Tested-by: Evan Green Signed-off-by: Martin K. Petersen drivers/scsi/ufs/ufshcd.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) commit 40d883b091758472c79b81fa1c0e0347e24a9cff Author: Xiubo Li Date: Tue Jan 22 18:10:51 2019 +0800 scsi: tcmu: fix use after free Fixes: a94a2572b977 ("scsi: tcmu: avoid cmd/qfull timers updated whenever a new cmd comes") Reported-by: Dan Carpenter Cc: Mike Christie Signed-off-by: Xiubo Li Reviewed-by: Mike Christie Signed-off-by: Martin K. Petersen drivers/target/target_core_user.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 17b42a20d7ca59377788c6a2409e77569570cc10 Author: Atsushi Nemoto Date: Mon Jan 21 17:26:41 2019 +0900 net: altera_tse: fix connect_local_phy error path The connect_local_phy should return NULL (not negative errno) on error, since its caller expects it. Signed-off-by: Atsushi Nemoto Acked-by: Thor Thayer Signed-off-by: David S. Miller drivers/net/ethernet/altera/altera_tse_main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit fe35a40e675473eb65f2f5462b82770f324b5689 Author: Varun Prakash Date: Sat Jan 12 22:14:30 2019 +0530 scsi: csiostor: fix NULL pointer dereference in csio_vport_set_state() Assign fc_vport to ln->fc_vport before calling csio_fcoe_alloc_vnp() to avoid a NULL pointer dereference in csio_vport_set_state(). ln->fc_vport is dereferenced in csio_vport_set_state(). Signed-off-by: Varun Prakash Signed-off-by: Martin K. Petersen drivers/scsi/csiostor/csio_attr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c41f59884be5cca293ed61f3d64637dbba3a6381 Author: Ewan D. Milne Date: Thu Jan 17 11:14:45 2019 -0500 scsi: lpfc: nvmet: avoid hang / use-after-free when destroying targetport We cannot wait on a completion object in the lpfc_nvme_targetport structure in the _destroy_targetport() code path because the NVMe/fc transport will free that structure immediately after the .targetport_delete() callback. This results in a use-after-free, and a hang if slub_debug=FZPU is enabled. Fix this by putting the completion on the stack. Signed-off-by: Ewan D. Milne Acked-by: James Smart Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc_nvmet.c | 8 +++++--- drivers/scsi/lpfc/lpfc_nvmet.h | 2 +- 2 files changed, 6 insertions(+), 4 deletions(-) commit 7961cba6f7d8215fa632df3d220e5154bb825249 Author: Ewan D. Milne Date: Thu Jan 17 11:14:44 2019 -0500 scsi: lpfc: nvme: avoid hang / use-after-free when destroying localport We cannot wait on a completion object in the lpfc_nvme_lport structure in the _destroy_localport() code path because the NVMe/fc transport will free that structure immediately after the .localport_delete() callback. This results in a use-after-free, and a hang if slub_debug=FZPU is enabled. Fix this by putting the completion on the stack. Signed-off-by: Ewan D. Milne Acked-by: James Smart Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc_nvme.c | 16 +++++++++------- drivers/scsi/lpfc/lpfc_nvme.h | 2 +- 2 files changed, 10 insertions(+), 8 deletions(-) commit a8cf59a6692c9c55a5a10257de97919fae6edef8 Author: Christoph Hellwig Date: Wed Jan 16 17:12:15 2019 +0100 scsi: communicate max segment size to the DMA mapping code When a host driver sets a maximum segment size we should not only propagate that setting to the block layer, which can merge segments, but also to the DMA mapping layer which can merge segments as well. Fixes: 50c2e9107f ("scsi: introduce a max_segment_size host_template parameters") Signed-off-by: Christoph Hellwig Signed-off-by: Martin K. Petersen drivers/ata/pata_macio.c | 9 ++++----- drivers/ata/sata_inic162x.c | 22 +++++++++------------- drivers/firewire/sbp2.c | 5 +---- drivers/scsi/aacraid/linit.c | 9 ++++----- drivers/scsi/scsi_lib.c | 4 ++-- 5 files changed, 20 insertions(+), 29 deletions(-) commit 5d9bf43357d5b0ef386bcaa2cafb94898364ff7d Author: Yangbo Lu Date: Mon Jan 21 14:26:37 2019 +0800 net: dpaa2: improve PTP Kconfig option Converted to use "imply" instead of "select" for PTP_1588_CLOCK driver selecting. This could break the hard dependency between the PTP clock subsystem and ethernet drivers. This patch also set "default y" for dpaa2 ptp driver building to provide user an available ptp clock in default. Signed-off-by: Yangbo Lu Acked-by: Richard Cochran Signed-off-by: David S. Miller drivers/net/ethernet/freescale/dpaa2/Kconfig | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 8fb18be93efd7292d6ee403b9f61af1008239639 Merge: 1518039f6b5a 278396de78a9 Author: David S. Miller Date: Tue Jan 22 17:30:39 2019 -0800 Merge branch 'qed-Error-recovery-process' Michal Kalderon says: ==================== qed*: Error recovery process Parity errors might happen in the device's memories due to momentary bit flips which are caused by radiation. Errors that are not correctable initiate a process kill event, which blocks the device access towards the host and the network, and a recovery process is started in the management FW and in the driver. This series adds the support of this process in the qed core module and in the qede driver (patches 2 & 3). Patch 1 in the series revises the load sequence, to avoid PCI errors that might be observed during a recovery process. ==================== Signed-off-by: David S. Miller commit 278396de78a9b59a692bc140233bde3a9d8a8a31 Author: Tomer Tayar Date: Sun Jan 20 11:36:39 2019 +0200 qede: Error recovery process This patch adds the error recovery process in the qede driver. The process includes a partial/customized driver unload and load, which allows it to look like a short suspend period to the kernel while preserving the net devices' state. Signed-off-by: Tomer Tayar Signed-off-by: Ariel Elior Signed-off-by: Michal Kalderon Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qede/qede.h | 3 + drivers/net/ethernet/qlogic/qede/qede_main.c | 300 ++++++++++++++++++++++----- drivers/net/ethernet/qlogic/qede/qede_rdma.c | 64 ++++-- include/linux/qed/qede_rdma.h | 21 +- 4 files changed, 314 insertions(+), 74 deletions(-) commit c75860e48a7634ff8dc050842211f79a0e4e6c46 Author: Tomer Tayar Date: Sun Jan 20 11:36:38 2019 +0200 qed: Add infrastructure for error detection and recovery This patch adds the detection and handling of a parity error ("process kill event"), including the update of the protocol drivers, and the prevention of any HW access that will lead to device access towards the host while recovery is in progress. It also provides the means for the protocol drivers to trigger a recovery process on their decision. Signed-off-by: Tomer Tayar Signed-off-by: Ariel Elior Signed-off-by: Michal Kalderon Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed.h | 4 ++ drivers/net/ethernet/qlogic/qed/qed_dev.c | 41 +++++++---- drivers/net/ethernet/qlogic/qed/qed_hsi.h | 2 +- drivers/net/ethernet/qlogic/qed/qed_hw.c | 11 +++ drivers/net/ethernet/qlogic/qed/qed_main.c | 30 ++++++++ drivers/net/ethernet/qlogic/qed/qed_mcp.c | 94 ++++++++++++++++++++++++++ drivers/net/ethernet/qlogic/qed/qed_mcp.h | 32 +++++++++ drivers/net/ethernet/qlogic/qed/qed_reg_addr.h | 2 + drivers/net/ethernet/qlogic/qed/qed_spq.c | 22 ++++++ drivers/net/ethernet/qlogic/qed/qed_sriov.c | 9 ++- include/linux/qed/qed_if.h | 20 ++++++ 11 files changed, 251 insertions(+), 16 deletions(-) commit cfdb1b63eefe918e5c8419c9a88188fef1b9cc5e Author: Tomer Tayar Date: Sun Jan 20 11:36:37 2019 +0200 qed: Revise load sequence to avoid PCI errors Initiating final cleanup after an ungraceful driver unload can lead to bad PCI accesses towards the host. This patch revises the load sequence so final cleanup is sent while the internal master enable is cleared, to prevent the host accesses, and clears the internal error indications just before enabling the internal master enable. Signed-off-by: Tomer Tayar Signed-off-by: Ariel Elior Signed-off-by: Michal Kalderon Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed.h | 1 - drivers/net/ethernet/qlogic/qed/qed_dev.c | 117 ++++++++++++++---------- drivers/net/ethernet/qlogic/qed/qed_dev_api.h | 12 +++ drivers/net/ethernet/qlogic/qed/qed_int.c | 126 +++++++++++++------------- drivers/net/ethernet/qlogic/qed/qed_int.h | 3 + drivers/net/ethernet/qlogic/qed/qed_mcp.c | 21 +++++ drivers/net/ethernet/qlogic/qed/qed_mcp.h | 10 ++ 7 files changed, 178 insertions(+), 112 deletions(-) commit 1518039f6b5ac794313c24c76f85cead0cd60f6c Author: Jakub Kicinski Date: Tue Jan 22 14:47:19 2019 -0800 net/ipv6: don't return positive numbers when nothing was dumped in6_dump_addrs() returns a positive 1 if there was nothing to dump. This return value can not be passed as return from inet6_dump_addr() as is, because it will confuse rtnetlink, resulting in NLMSG_DONE never getting set: $ ip addr list dev lo EOF on netlink Dump terminated v2: flip condition to avoid a new goto (DaveA) Fixes: 7c1e8a3817c5 ("netlink: fixup regression in RTM_GETADDR") Reported-by: Brendan Galloway Signed-off-by: Jakub Kicinski Reviewed-by: David Ahern Tested-by: David Ahern Signed-off-by: David S. Miller net/ipv6/addrconf.c | 2 ++ 1 file changed, 2 insertions(+) commit 0b0d4be6b4880c7199d41afe4d9a3f20f47fd9bb Merge: 8f45fa2724a6 b488517b28a4 Author: Linus Torvalds Date: Wed Jan 23 14:04:22 2019 +1300 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "This is a sort of random collection of clk fixes that have come in since the merge window: - Handful of memory allocation and potentially bad pointer usage fixes - JSON format was incorrect for clk_dump because it missed a comma - Two Kconfig fixes, one duplicate and one missing select line - Compiler warning fix for the VC5 clk driver - Name and rate fixes for PLLs in the stratix10 driver so it can properly detect PLL rates and parents" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: socfpga: stratix10: fix naming convention for the fixed-clocks clk: socfpga: stratix10: fix rate calculation for pll clocks clk: qcom: Select QCOM_GDSC with MSM_GCC_8998 clk: vc5: Abort clock configuration without upstream clock clk: sysfs: fix invalid JSON in clk_dump clk: imx: Remove Kconfig duplicate include clk: zynqmp: Fix memory allocation in zynqmp_clk_setup clk: tegra: dfll: Fix a potential Oop in remove() clk: imx: fix potential NULL dereference in imx8qxp_lpcg_clk_probe() commit 8f45fa2724a67f660a3b089950cb51eb9fef63d1 Merge: 787a3b432276 3d244c192afe Author: Linus Torvalds Date: Wed Jan 23 14:02:14 2019 +1300 Merge tag 'linux-kselftest-5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest fixes from Shuah Khan: "Fixes to rtc, seccomp and other tests" * tag 'linux-kselftest-5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests/seccomp: Abort without user notification support selftests: gpio-mockup-chardev: Check asprintf() for error selftests: seccomp: use LDLIBS instead of LDFLAGS selftests/vm/gup_benchmark.c: match gup struct to kernel tools/testing/selftests/x86/unwind_vdso.c: Remove duplicate header x86/mpx/selftests: fix spelling mistake "succeded" -> "succeeded" selftests: rtc: rtctest: add alarm test on minute boundary selftests: rtc: rtctest: fix alarm tests commit 7fc5854f8c6efae9e7624970ab49a1eac2faefb1 Author: Tejun Heo Date: Tue Dec 12 08:38:30 2017 -0800 writeback: synchronize sync(2) against cgroup writeback membership switches sync_inodes_sb() can race against cgwb (cgroup writeback) membership switches and fail to writeback some inodes. For example, if an inode switches to another wb while sync_inodes_sb() is in progress, the new wb might not be visible to bdi_split_work_to_wbs() at all or the inode might jump from a wb which hasn't issued writebacks yet to one which already has. This patch adds backing_dev_info->wb_switch_rwsem to synchronize cgwb switch path against sync_inodes_sb() so that sync_inodes_sb() is guaranteed to see all the target wbs and inodes can't jump wbs to escape syncing. v2: Fixed misplaced rwsem init. Spotted by Jiufei. Signed-off-by: Tejun Heo Reported-by: Jiufei Xue Link: http://lkml.kernel.org/r/dc694ae2-f07f-61e1-7097-7c8411cee12d@gmail.com Acked-by: Jan Kara Signed-off-by: Jens Axboe fs/fs-writeback.c | 40 ++++++++++++++++++++++++++++++++++++++-- include/linux/backing-dev-defs.h | 1 + mm/backing-dev.c | 1 + 3 files changed, 40 insertions(+), 2 deletions(-) commit cb73ee40b1b381eaf3749e6dbeed567bb38e5258 Author: Lorenzo Bianconi Date: Fri Jan 18 12:05:39 2019 +0100 net: ip_gre: use erspan key field for tunnel lookup Use ERSPAN key header field as tunnel key in gre_parse_header routine since ERSPAN protocol sets the key field of the external GRE header to 0 resulting in a tunnel lookup fail in ip6gre_err. In addition remove key field parsing and pskb_may_pull check in erspan_rcv and ip6erspan_rcv Fixes: 5a963eb61b7c ("ip6_gre: Add ERSPAN native tunnel support") Signed-off-by: Lorenzo Bianconi Signed-off-by: David S. Miller net/ipv4/gre_demux.c | 17 +++++++++++++++++ net/ipv4/ip_gre.c | 9 --------- net/ipv6/ip6_gre.c | 4 ---- 3 files changed, 17 insertions(+), 13 deletions(-) commit 56cb4e5034998b5522a657957321ca64ca2ea0a0 Author: Thomas Gleixner Date: Fri Jan 18 11:49:58 2019 +0100 net: sun: cassini: Cleanup license conflict The recent addition of SPDX license identifiers to the files in drivers/net/ethernet/sun created a licensing conflict. The cassini driver files contain a proper license notice: * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License as * published by the Free Software Foundation; either version 2 of the * License, or (at your option) any later version. but the SPDX change added: SPDX-License-Identifier: GPL-2.0 So the file got tagged GPL v2 only while in fact it is licensed under GPL v2 or later. It's nice that people care about the SPDX tags, but they need to be more careful about it. Not everything under (the) sun belongs to ... Fix up the SPDX identifier and remove the boiler plate text as it is redundant. Fixes: c861ef83d771 ("sun: Add SPDX license tags to Sun network drivers") Signed-off-by: Thomas Gleixner Cc: Shannon Nelson Cc: Zhu Yanjun Cc: David S. Miller Cc: netdev@vger.kernel.org Cc: stable@vger.kernel.org Acked-by: Shannon Nelson Reviewed-by: Zhu Yanjun Signed-off-by: David S. Miller drivers/net/ethernet/sun/cassini.c | 15 +-------------- drivers/net/ethernet/sun/cassini.h | 15 +-------------- 2 files changed, 2 insertions(+), 28 deletions(-) commit 075c18c3e124a1511ebc10a89f1858c8a77dcb01 Author: Mike Snitzer Date: Fri Jan 18 01:21:11 2019 -0500 dm: add missing trace_block_split() to __split_and_process_bio() Provides useful context about bio splits in blktrace. Signed-off-by: Mike Snitzer drivers/md/dm.c | 1 + 1 file changed, 1 insertion(+) commit 6548c7c538e5658cbce686c2dd1a9b4f5398bf34 Author: Mike Snitzer Date: Thu Jan 17 14:33:01 2019 -0500 dm: fix dm_wq_work() to only use __split_and_process_bio() if appropriate Otherwise targets that don't support/expect IO splitting could resubmit bios using code paths with unnecessary IO splitting complexity. Depends-on: 24113d487843 ("dm: avoid indirect call in __dm_make_request") Fixes: 978e51ba38e00 ("dm: optimize bio-based NVMe IO submission") Signed-off-by: Mike Snitzer drivers/md/dm.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) commit 787a3b4322763284a594a5dd3680508c0bfb20b0 Merge: 48b161983ae5 1950f462916e Author: Linus Torvalds Date: Wed Jan 23 07:16:05 2019 +1300 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - descriptor parsing regression fix for devices that have more than 16 collections, from Peter Hutterer (and followup cleanup from Philipp Zabel) - quirk for Goodix touchpad * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: core: simplify active collection tracking HID: i2c-hid: Disable runtime PM on Goodix touchpad HID: core: replace the collection tree pointers with indices commit 33e5ee780e37bcf494013e2497580b00b7676507 Author: Thomas Gleixner Date: Fri Jan 18 00:14:25 2019 +0100 vfio/pci: Cleanup license mess The recently added nvlink2 VFIO driver introduced a license conflict in two files. In both cases the SPDX license identifier is: SPDX-License-Identifier: GPL-2.0+ but the files contain also the following license boiler plate text: * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as * published by the Free Software Foundation The latter is GPL-2.9-only and not GPL-2.0=. Looking deeper. The nvlink source file is derived from vfio_pci_igd.c which is also licensed under GPL-2.0-only and it can be assumed that the file was copied and modified. As the original file is licensed GPL-2.0-only it's not possible to relicense derivative work to GPL-2.0-or-later. Fix the SPDX identifier and remove the boiler plate as it is redundant. Fixes: 7f92891778df ("vfio_pci: Add NVIDIA GV100GL [Tesla V100 SXM2] subdriver") Signed-off-by: Thomas Gleixner Cc: Alexey Kardashevskiy Cc: Alex Williamson Cc: Michael Ellerman Cc: kvm@vger.kernel.org Signed-off-by: Alex Williamson drivers/vfio/pci/trace.h | 6 +----- drivers/vfio/pci/vfio_pci_nvlink2.c | 6 +----- 2 files changed, 2 insertions(+), 10 deletions(-) commit 698cef173983b086977e633e46476e0f925ca01e Author: Ming Lei Date: Tue Jan 22 16:20:17 2019 +0800 block: cover another queue enter recursion via BIO_QUEUE_ENTERED Except for blk_queue_split(), bio_split() is used for splitting bio too, then the remained bio is often resubmit to queue via generic_make_request(). So the same queue enter recursion exits in this case too. Unfortunatley commit cd4a4ae4683dc2 doesn't help this case. This patch covers the above case by setting BIO_QUEUE_ENTERED before calling q->make_request_fn. In theory the per-bio flag is used to simulate one stack variable, it is just fine to clear it after q->make_request_fn is returned. Especially the same bio can't be submitted from another context. Fixes: cd4a4ae4683dc2 ("block: don't use blocking queue entered for recursive bio submits") Cc: Tetsuo Handa Cc: NeilBrown Reviewed-by: Mike Snitzer Signed-off-by: Ming Lei Signed-off-by: Jens Axboe block/blk-core.c | 11 +++++++++++ block/blk-merge.c | 10 ---------- 2 files changed, 11 insertions(+), 10 deletions(-) commit 983a5a43ec254cd5ddf3254db80ca96e8f8bb2a4 Author: Tony Lindgren Date: Tue Jan 22 09:03:08 2019 -0800 clocksource: timer-ti-dm: Fix pwm dmtimer usage of fck reparenting Commit 84badc5ec5fc ("ARM: dts: omap4: Move l4 child devices to probe them with ti-sysc") moved some omap4 timers to probe with ti-sysc interconnect target module. Turns out this broke pwm-omap-dmtimer where we now try to reparent the clock to itself with the following: omap_dm_timer_of_set_source: failed to set parent With ti-sysc, we can now configure the clock sources in the dts with assigned-clocks and assigned-clock-parents. So we should be able to remove omap_dm_timer_of_set_source with clean-up patches later on. But for now, let's just fix it first by checking if parent and fck are the same and bail out of so. Fixes: 84badc5ec5fc ("ARM: dts: omap4: Move l4 child devices to probe them with ti-sysc") Cc: Bartosz Golaszewski Cc: Daniel Lezcano Cc: H. Nikolaus Schaller Cc: Keerthy Cc: Ladislav Michl Cc: Pavel Machek Cc: Sebastian Reichel Cc: Tero Kristo Cc: Thierry Reding Cc: Thomas Gleixner Reported-by: H. Nikolaus Schaller Tested-By: Andreas Kemnade Tested-By: H. Nikolaus Schaller Signed-off-by: Tony Lindgren drivers/clocksource/timer-ti-dm.c | 4 ++++ 1 file changed, 4 insertions(+) commit 13e62626c578d9889ebbda7c521be5adff9bef8e Author: Ulf Hansson Date: Wed Jan 16 12:37:23 2019 +0100 wlcore: sdio: Fixup power on/off sequence During "wlan-up", we are programming the FW into the WiFi-chip. However, re-programming the FW doesn't work, unless a power cycle of the WiFi-chip is made in-between the programmings. To conform to this requirement and to fix the regression in a simple way, let's start by allowing that the SDIO card (WiFi-chip) may stay powered on (runtime resumed) when wl12xx_sdio_power_off() returns. The intent with the current code is to treat this scenario as an error, but unfortunate this doesn't work as expected, so let's fix this. The other part is to guarantee that a power cycle of the SDIO card has been completed when wl12xx_sdio_power_on() returns, as to allow the FW programming to succeed. However, relying solely on runtime PM to deal with this isn't sufficient. For example, userspace may prevent runtime suspend via sysfs for the device that represents the SDIO card, leading to that the mmc core also keeps it powered on. For this reason, let's instead do a brute force power cycle in wl12xx_sdio_power_on(). Fixes: 728a9dc61f13 ("wlcore: sdio: Fix flakey SDIO runtime PM handling") Signed-off-by: Ulf Hansson Tested-by: Tony Lindgren Tested-by: Anders Roxell Signed-off-by: Ulf Hansson Signed-off-by: Kalle Valo drivers/net/wireless/ti/wlcore/sdio.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) commit 625210cfa6c0c26ea422f655bf68288176f174e6 Author: Sinan Kaya Date: Mon Jan 21 23:19:58 2019 +0000 x86/Kconfig: Select PCI_LOCKLESS_CONFIG if PCI is enabled After commit 5d32a66541c4 ("PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set") dependencies on CONFIG_PCI that previously were satisfied implicitly through dependencies on CONFIG_ACPI have to be specified directly. PCI_LOCKLESS_CONFIG depends on PCI but this dependency has not been mentioned in the Kconfig so add an explicit dependency here and fix WARNING: unmet direct dependencies detected for PCI_LOCKLESS_CONFIG Depends on [n]: PCI [=n] Selected by [y]: - X86 [=y] Fixes: 5d32a66541c46 ("PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set") Signed-off-by: Sinan Kaya Signed-off-by: Borislav Petkov Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Thomas Gleixner Cc: linux-acpi@vger.kernel.org Cc: x86-ml Link: https://lkml.kernel.org/r/20190121231958.28255-2-okaya@kernel.org arch/x86/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8077ec011b1ea26abb7ca786f28ecccfb352717f Author: Shuming Fan Date: Tue Jan 22 15:50:09 2019 +0800 ASoC: rt5682: Correct the setting while select ASRC clk for AD/DA filter AD/DA ASRC function control two ASRC clock sources separately. Whether AD/DA filter select which clock source, we enable AD/DA ASRC function for all cases. Signed-off-by: Shuming Fan Signed-off-by: Mark Brown sound/soc/codecs/rt5682.c | 2 ++ 1 file changed, 2 insertions(+) commit 8b9433eb4de3c26a9226c981c283f9f4896ae030 Author: Ernesto A. Fernández Date: Mon Oct 8 20:58:23 2018 -0300 direct-io: allow direct writes to empty inodes On a DIO_SKIP_HOLES filesystem, the ->get_block() method is currently not allowed to create blocks for an empty inode. This confusion comes from trying to bit shift a negative number, so check the size of the inode first. The problem is most visible for hfsplus, because the fallback to buffered I/O doesn't happen and the write fails with EIO. This is in part the fault of the module, because it gives a wrong return value on ->get_block(); that will be fixed in a separate patch. Reviewed-by: Jeff Moyer Reviewed-by: Jan Kara Signed-off-by: Ernesto A. Fernández Signed-off-by: Jens Axboe fs/direct-io.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 198bc3252ea3a45b0c5d500e6a5b91cfdd08f001 Author: Gerald Schaefer Date: Wed Jan 16 20:11:44 2019 +0100 iommu/vt-d: Fix memory leak in intel_iommu_put_resv_regions() Commit 9d3a4de4cb8d ("iommu: Disambiguate MSI region types") changed the reserved region type in intel_iommu_get_resv_regions() from IOMMU_RESV_RESERVED to IOMMU_RESV_MSI, but it forgot to also change the type in intel_iommu_put_resv_regions(). This leads to a memory leak, because now the check in intel_iommu_put_resv_regions() for IOMMU_RESV_RESERVED will never be true, and no allocated regions will be freed. Fix this by changing the region type in intel_iommu_put_resv_regions() to IOMMU_RESV_MSI, matching the type of the allocated regions. Fixes: 9d3a4de4cb8d ("iommu: Disambiguate MSI region types") Cc: # v4.11+ Signed-off-by: Gerald Schaefer Reviewed-by: Eric Auger Signed-off-by: Joerg Roedel drivers/iommu/intel-iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 52768f324241b2d9624d32787cff63ec3e0e420a Author: Christophe JAILLET Date: Sat Dec 29 01:05:40 2018 +0100 i3c: master: Fix an error checking typo in 'cdns_i3c_master_probe()' Fix a cut'n'paste typo. Checking 'master->sysclk' is expected here. Fixes: 603f2bee2c54 ("i3c: master: Add driver for Cadence IP") Signed-off-by: Christophe JAILLET Signed-off-by: Greg Kroah-Hartman drivers/i3c/master/i3c-master-cdns.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 3a34c986324c07dde32903f7bb262e6138e77c2a Author: Huacai Chen Date: Wed Dec 19 16:16:03 2018 +0800 cacheinfo: Keep the old value if of_property_read_u32 fails Commit 448a5a552f336bd7b847b1951 ("drivers: base: cacheinfo: use OF property_read_u32 instead of get_property,read_number") makes cache size and number_of_sets be 0 if DT doesn't provide there values. I think this is unreasonable so make them keep the old values, which is the same as old kernels. Fixes: 448a5a552f33 ("drivers: base: cacheinfo: use OF property_read_u32 instead of get_property,read_number") Cc: stable@vger.kernel.org Signed-off-by: Huacai Chen Reviewed-by: Sudeep Holla Signed-off-by: Greg Kroah-Hartman drivers/base/cacheinfo.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 01684db950ea2b840531ab9298a8785776b6f6e8 Author: Christian Brauner Date: Mon Jan 21 11:48:08 2019 +0100 binderfs: switch from d_add() to d_instantiate() In a previous commit we switched from a d_alloc_name() + d_lookup() combination to setup a new dentry and find potential duplicates to the more idiomatic lookup_one_len(). As far as I understand, this also means we need to switch from d_add() to d_instantiate() since lookup_one_len() will create a new dentry when it doesn't find an existing one and add the new dentry to the hash queues. So we only need to call d_instantiate() to connect the dentry to the inode and turn it into a positive dentry. If we were to use d_add() we sure see stack traces like the following indicating that adding the same dentry twice over the same inode: [ 744.441889] CPU: 4 PID: 2849 Comm: landscape-sysin Not tainted 5.0.0-rc1-brauner-binderfs #243 [ 744.441889] Hardware name: Dell DCS XS24-SC2 /XS24-SC2 , BIOS S59_3C20 04/07/2011 [ 744.441889] RIP: 0010:__d_lookup_rcu+0x76/0x190 [ 744.441889] Code: 89 75 c0 49 c1 e9 20 49 89 fd 45 89 ce 41 83 e6 07 42 8d 04 f5 00 00 00 00 89 45 c8 eb 0c 48 8b 1b 48 85 db 0f 84 81 00 00 00 <44> 8b 63 fc 4c 3b 6b 10 75 ea 48 83 7b 08 00 74 e3 41 83 e4 fe 41 [ 744.441889] RSP: 0018:ffffb8c984e27ad0 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13 [ 744.441889] RAX: 0000000000000038 RBX: ffff9407ef770c08 RCX: ffffb8c980011000 [ 744.441889] RDX: ffffb8c984e27b54 RSI: ffffb8c984e27ce0 RDI: ffff9407e6689600 [ 744.441889] RBP: ffffb8c984e27b28 R08: ffffb8c984e27ba4 R09: 0000000000000007 [ 744.441889] R10: ffff9407e5c4f05c R11: 973f3eb9d84a94e5 R12: 0000000000000002 [ 744.441889] R13: ffff9407e6689600 R14: 0000000000000007 R15: 00000007bfef7a13 [ 744.441889] FS: 00007f0db13bb740(0000) GS:ffff9407f3b00000(0000) knlGS:0000000000000000 [ 744.441889] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 744.441889] CR2: 00007f0dacc51024 CR3: 000000032961a000 CR4: 00000000000006e0 [ 744.441889] Call Trace: [ 744.441889] lookup_fast+0x53/0x300 [ 744.441889] walk_component+0x49/0x350 [ 744.441889] ? inode_permission+0x63/0x1a0 [ 744.441889] link_path_walk.part.33+0x1bc/0x5a0 [ 744.441889] ? path_init+0x190/0x310 [ 744.441889] path_lookupat+0x95/0x210 [ 744.441889] filename_lookup+0xb6/0x190 [ 744.441889] ? __check_object_size+0xb8/0x1b0 [ 744.441889] ? strncpy_from_user+0x50/0x1a0 [ 744.441889] user_path_at_empty+0x36/0x40 [ 744.441889] ? user_path_at_empty+0x36/0x40 [ 744.441889] vfs_statx+0x76/0xe0 [ 744.441889] __do_sys_newstat+0x3d/0x70 [ 744.441889] __x64_sys_newstat+0x16/0x20 [ 744.441889] do_syscall_64+0x5a/0x120 [ 744.441889] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 744.441889] RIP: 0033:0x7f0db0ec2775 [ 744.441889] Code: 00 00 00 75 05 48 83 c4 18 c3 e8 26 55 02 00 66 0f 1f 44 00 00 83 ff 01 48 89 f0 77 30 48 89 c7 48 89 d6 b8 04 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 03 f3 c3 90 48 8b 15 e1 b6 2d 00 f7 d8 64 89 [ 744.441889] RSP: 002b:00007ffc36bc9388 EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 744.441889] RAX: ffffffffffffffda RBX: 00007ffc36bc9300 RCX: 00007f0db0ec2775 [ 744.441889] RDX: 00007ffc36bc9400 RSI: 00007ffc36bc9400 RDI: 00007f0dad26f050 [ 744.441889] RBP: 0000000000c0bc60 R08: 0000000000000000 R09: 0000000000000001 [ 744.441889] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc36bc9400 [ 744.441889] R13: 0000000000000001 R14: 00000000ffffff9c R15: 0000000000c0bc60 Cc: Al Viro Signed-off-by: Christian Brauner Signed-off-by: Greg Kroah-Hartman drivers/android/binderfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 29ef1c8e16aed079ac09989d752e38d412b6e1a8 Author: Christian Brauner Date: Mon Jan 21 11:48:07 2019 +0100 binderfs: drop lock in binderfs_binder_ctl_create The binderfs_binder_ctl_create() call is a no-op on subsequent calls and the first call is done before we unlock the suberblock. Hence, there is no need to take inode_lock() in there. Let's remove it. Suggested-by: Al Viro Signed-off-by: Christian Brauner Signed-off-by: Greg Kroah-Hartman drivers/android/binderfs.c | 4 ---- 1 file changed, 4 deletions(-) commit 4198479524aeccaf53c3a4cc73784982535573fa Author: Christian Brauner Date: Mon Jan 21 11:48:06 2019 +0100 binderfs: kill_litter_super() before cleanup Al pointed out that first calling kill_litter_super() before cleaning up info is more correct since destroying info doesn't depend on the state of the dentries and inodes. That the opposite remains true is not guaranteed. Suggested-by: Al Viro Signed-off-by: Christian Brauner Signed-off-by: Greg Kroah-Hartman drivers/android/binderfs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 01b3f1fc568352a1ffdcd3ee82a0297f16cc9bd9 Author: Christian Brauner Date: Mon Jan 21 11:48:05 2019 +0100 binderfs: rework binderfs_binder_device_create() - switch from d_alloc_name() + d_lookup() to lookup_one_len(): Instead of using d_alloc_name() and then doing a d_lookup() with the allocated dentry to find whether a device with the name we're trying to create already exists switch to using lookup_one_len(). The latter will either return the existing dentry or a new one. - switch from kmalloc() + strscpy() to kmemdup(): Use a more idiomatic way to copy the name for the new dentry that userspace gave us. Suggested-by: Al Viro Signed-off-by: Christian Brauner Signed-off-by: Greg Kroah-Hartman drivers/android/binderfs.c | 39 +++++++++++++++++++-------------------- 1 file changed, 19 insertions(+), 20 deletions(-) commit 36975fc3e5f241cc4f45df4ab4624d7d5199d9ed Author: Christian Brauner Date: Mon Jan 21 11:48:04 2019 +0100 binderfs: rework binderfs_fill_super() Al pointed out that on binderfs_fill_super() error deactivate_locked_super() will call binderfs_kill_super() so all of the freeing and putting we currently do in binderfs_fill_super() is unnecessary and buggy. Let's simply return errors and let binderfs_fill_super() take care of cleaning up on error. Suggested-by: Al Viro Signed-off-by: Christian Brauner Signed-off-by: Greg Kroah-Hartman drivers/android/binderfs.c | 41 +++++++++++------------------------------ 1 file changed, 11 insertions(+), 30 deletions(-) commit e98e6fa18636609f14a7f866524950a783cf4fbf Author: Christian Brauner Date: Mon Jan 21 11:48:03 2019 +0100 binderfs: prevent renaming the control dentry - make binderfs control dentry immutable: We don't allow to unlink it since it is crucial for binderfs to be useable but if we allow to rename it we make the unlink trivial to bypass. So prevent renaming too and simply treat the control dentry as immutable. - add is_binderfs_control_device() helper: Take the opportunity and turn the check for the control dentry into a separate helper is_binderfs_control_device() since it's now used in two places. - simplify binderfs_rename(): Instead of hand-rolling our custom version of simple_rename() just dumb the whole function down to first check whether we're trying to rename the control dentry. If we do EPERM the caller and if not call simple_rename(). Suggested-by: Al Viro Signed-off-by: Christian Brauner Signed-off-by: Greg Kroah-Hartman drivers/android/binderfs.c | 28 ++++++++++------------------ 1 file changed, 10 insertions(+), 18 deletions(-) commit 7c4d08fc4d5aca073bd4ebecbb9eda5e4d858b71 Author: Christian Brauner Date: Mon Jan 21 11:48:02 2019 +0100 binderfs: remove outdated comment The comment stems from an early version of that patchset and is just confusing now. Cc: Al Viro Signed-off-by: Christian Brauner Signed-off-by: Greg Kroah-Hartman drivers/android/binderfs.c | 4 ---- 1 file changed, 4 deletions(-) commit 7d0174065f4903fb0ce0bab3d5047284faa7226d Author: Christian Brauner Date: Mon Jan 21 12:01:20 2019 +0100 binderfs: use __u32 for device numbers We allow more then 255 binderfs binder devices to be created since there are workloads that require more than that. If we use __u8 we'll overflow after 255. So let's use a __u32. Note that there's no released kernel with binderfs out there so this is not a regression. Signed-off-by: Christian Brauner Signed-off-by: Greg Kroah-Hartman include/uapi/linux/android/binderfs.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 6fc23b6ed8fa0ba6cc47b2f8756df1199abc3a5c Author: Christian Brauner Date: Mon Jan 21 12:01:19 2019 +0100 binderfs: use correct include guards in header When we switched over from binder_ctl.h to binderfs.h we forgot to change the include guards. It's minor but it's obviously correct. Signed-off-by: Christian Brauner Signed-off-by: Greg Kroah-Hartman include/uapi/linux/android/binderfs.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit f1724c0883bb0ce93b8dcb94b53dcca3b75ac9a7 Author: Jerry Snitselaar Date: Sat Jan 19 10:38:05 2019 -0700 iommu/amd: Unmap all mapped pages in error path of map_sg In the error path of map_sg there is an incorrect if condition for breaking out of the loop that searches the scatterlist for mapped pages to unmap. Instead of breaking out of the loop once all the pages that were mapped have been unmapped, it will break out of the loop after it has unmapped 1 page. Fix the condition, so it breaks out of the loop only after all the mapped pages have been unmapped. Fixes: 80187fd39dcb ("iommu/amd: Optimize map_sg and unmap_sg") Cc: Joerg Roedel Signed-off-by: Jerry Snitselaar Signed-off-by: Joerg Roedel drivers/iommu/amd_iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 51d8838d66d3249508940d8f59b07701f2129723 Author: Jerry Snitselaar Date: Thu Jan 17 12:29:02 2019 -0700 iommu/amd: Call free_iova_fast with pfn in map_sg In the error path of map_sg, free_iova_fast is being called with address instead of the pfn. This results in a bad value getting into the rcache, and can result in hitting a BUG_ON when iova_magazine_free_pfns is called. Cc: Joerg Roedel Cc: Suravee Suthikulpanit Signed-off-by: Jerry Snitselaar Fixes: 80187fd39dcb ("iommu/amd: Optimize map_sg and unmap_sg") Signed-off-by: Joerg Roedel drivers/iommu/amd_iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 31eb79db420a3f94c4c45a8c0a05cd30e333f981 Author: Liam Mark Date: Fri Jan 18 10:37:44 2019 -0800 staging: android: ion: Support cpu access during dma_buf_detach Often userspace doesn't know when the kernel will be calling dma_buf_detach on the buffer. If userpace starts its CPU access at the same time as the sg list is being freed it could end up accessing the sg list after it has been freed. Thread A Thread B - DMA_BUF_IOCTL_SYNC IOCT - ion_dma_buf_begin_cpu_access - list_for_each_entry - ion_dma_buf_detatch - free_duped_table - dma_sync_sg_for_cpu Fix this by getting the ion_buffer lock before freeing the sg table memory. Fixes: 2a55e7b5e544 ("staging: android: ion: Call dma_map_sg for syncing and mapping") Signed-off-by: Liam Mark Acked-by: Laura Abbott Acked-by: Andrew F. Davis Signed-off-by: Greg Kroah-Hartman drivers/staging/android/ion/ion.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a55234dabe1f72cf22f9197980751d37e38ba020 Author: Uwe Kleine-König Date: Fri Jan 11 12:20:41 2019 +0100 can: flexcan: fix NULL pointer exception during bringup Commit cbffaf7aa09e ("can: flexcan: Always use last mailbox for TX") introduced a loop letting i run up to (including) ARRAY_SIZE(regs->mb) and in the body accessed regs->mb[i] which is an out-of-bounds array access that then resulted in an access to an reserved register area. Later this was changed by commit 0517961ccdf1 ("can: flexcan: Add provision for variable payload size") to iterate a bit differently but still runs one iteration too much resulting to call flexcan_get_mb(priv, priv->mb_count) which results in a WARN_ON and then a NULL pointer exception. This only affects devices compatible with "fsl,p1010-flexcan", "fsl,imx53-flexcan", "fsl,imx35-flexcan", "fsl,imx25-flexcan", "fsl,imx28-flexcan", so newer i.MX SoCs are not affected. Fixes: cbffaf7aa09e ("can: flexcan: Always use last mailbox for TX") Signed-off-by: Uwe Kleine-König Cc: linux-stable # >= 4.20 Signed-off-by: Marc Kleine-Budde drivers/net/can/flexcan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7873e98c614aa8dd2c3429aa2e25dc0e9ccadffa Author: YueHaibing Date: Wed Dec 12 17:24:01 2018 +0800 can: flexcan: fix 'passing zero to ERR_PTR()' warning Fix a static code checker warning: drivers/net/can/flexcan.c:1435 flexcan_setup_stop_mode() warn: passing zero to 'PTR_ERR' Fixes: de3578c198c6 ("can: flexcan: add self wakeup support") Signed-off-by: YueHaibing Signed-off-by: Marc Kleine-Budde drivers/net/can/flexcan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 93171ba6f1deffd82f381d36cb13177872d023f6 Author: Oliver Hartkopp Date: Sun Jan 13 19:31:43 2019 +0100 can: bcm: check timer values before ktime conversion Kyungtae Kim detected a potential integer overflow in bcm_[rx|tx]_setup() when the conversion into ktime multiplies the given value with NSEC_PER_USEC (1000). Reference: https://marc.info/?l=linux-can&m=154732118819828&w=2 Add a check for the given tv_usec, so that the value stays below one second. Additionally limit the tv_sec value to a reasonable value for CAN related use-cases of 400 days and ensure all values to be positive. Reported-by: Kyungtae Kim Tested-by: Oliver Hartkopp Signed-off-by: Oliver Hartkopp Cc: linux-stable # >= 2.6.26 Tested-by: Kyungtae Kim Acked-by: Andre Naujoks Signed-off-by: Marc Kleine-Budde net/can/bcm.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) commit 7b12c8189a3dc50638e7d53714c88007268d47ef Author: Manfred Schlaegl Date: Wed Dec 19 19:39:58 2018 +0100 can: dev: __can_get_echo_skb(): fix bogous check for non-existing skb by removing it This patch revert commit 7da11ba5c506 ("can: dev: __can_get_echo_skb(): print error message, if trying to echo non existing skb") After introduction of this change we encountered following new error message on various i.MX plattforms (flexcan): | flexcan 53fc8000.can can0: __can_get_echo_skb: BUG! Trying to echo non | existing skb: can_priv::echo_skb[0] The introduction of the message was a mistake because priv->echo_skb[idx] = NULL is a perfectly valid in following case: If CAN_RAW_LOOPBACK is disabled (setsockopt) in applications, the pkt_type of the tx skb's given to can_put_echo_skb is set to PACKET_LOOPBACK. In this case can_put_echo_skb will not set priv->echo_skb[idx]. It is therefore kept NULL. As additional argument for revert: The order of check and usage of idx was changed. idx is used to access an array element before checking it's boundaries. Signed-off-by: Manfred Schlaegl Fixes: 7da11ba5c506 ("can: dev: __can_get_echo_skb(): print error message, if trying to echo non existing skb") Cc: linux-stable Signed-off-by: Marc Kleine-Budde drivers/net/can/dev.c | 27 +++++++++++++-------------- 1 file changed, 13 insertions(+), 14 deletions(-) commit d3c8c0af7565ae5b4f9e65cff6e824ee2acdd451 Merge: d7393226d15a 8bf8c6da53c2 Author: Ingo Molnar Date: Tue Jan 22 11:08:47 2019 +0100 Merge tag 'perf-urgent-for-mingo-5.0-20190121' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/urgent fixes from Arnaldo Carvalho de Melo: Kernel: Stephane Eranian: - Fix perf_proc_update_handler() bug. perf script: Andi Kleen: - Fix crash with printing mixed trace point and other events. Tony Jones: - Fix crash when processing recorded stat data. perf top: He Kuang: - Fix wrong hottest instruction highlighted. perf python: Arnaldo Carvalho de Melo: - Remove -fstack-clash-protection when building with some clang versions. perf ordered_events: Jiri Olsa: - Fix out of buffers crash in ordered_events__free(). perf cpu_map: Stephane Eranian: - Handle TOPOLOGY headers with no CPU. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit 10098709b4ee6f6f19f25ba81d9c6f83518c584c Author: Chen-Yu Tsai Date: Tue Jan 15 10:45:43 2019 +0800 pinctrl: sunxi: Correct number of IRQ banks on H6 main pin controller The H6 main pin controller has four banks of interrupt-triggering pins. The driver as originally submitted only specified three, but had pin descriptions referencing a fourth bank. This results in a out-of-bounds access into .irq_array of struct sunxi_pinctrl. This however did not result in a crash until v4.20, with commit a66d972465d1 ("devres: Align data[] to ARCH_KMALLOC_MINALIGN"), which changed the alignment of memory region returned by devm_kcalloc(). The increase likely moved the out-of-bounds access into the next, unmapped page. With KASAN on, the bug is quite clear: BUG: KASAN: slab-out-of-bounds in sunxi_pinctrl_init_with_variant+0x49c/0x12b8 Write of size 4 at addr ffff80002c680280 by task swapper/0/1 CPU: 2 PID: 1 Comm: swapper/0 Not tainted 5.0.0-rc1-00016-gc480a5e6a077 #3 Hardware name: OrangePi Lite2 (DT) Call trace: dump_backtrace+0x0/0x220 show_stack+0x14/0x20 dump_stack+0xac/0xd4 print_address_description+0x60/0x25c kasan_report+0x14c/0x1ac __asan_store4+0x80/0xa0 sunxi_pinctrl_init_with_variant+0x49c/0x12b8 h6_pinctrl_probe+0x18/0x20 platform_drv_probe+0x6c/0xc8 really_probe+0x244/0x4b0 driver_probe_device.part.4+0x11c/0x164 __driver_attach+0x120/0x190 bus_for_each_dev+0xe8/0x158 driver_attach+0x30/0x40 bus_add_driver+0x308/0x318 driver_register+0xbc/0x1d0 __platform_driver_register+0x7c/0x88 h6_pinctrl_driver_init+0x18/0x20 do_one_initcall+0xd4/0x208 kernel_init_freeable+0x230/0x2c8 kernel_init+0x10/0x108 ret_from_fork+0x10/0x1c Allocated by task 1: kasan_kmalloc.part.0+0x4c/0x100 kasan_kmalloc+0xc4/0xe8 kasan_slab_alloc+0x14/0x20 __kmalloc_track_caller+0x130/0x238 devm_kmalloc+0x34/0xd0 sunxi_pinctrl_init_with_variant+0x1d8/0x12b8 h6_pinctrl_probe+0x18/0x20 platform_drv_probe+0x6c/0xc8 really_probe+0x244/0x4b0 driver_probe_device.part.4+0x11c/0x164 __driver_attach+0x120/0x190 bus_for_each_dev+0xe8/0x158 driver_attach+0x30/0x40 bus_add_driver+0x308/0x318 driver_register+0xbc/0x1d0 __platform_driver_register+0x7c/0x88 h6_pinctrl_driver_init+0x18/0x20 do_one_initcall+0xd4/0x208 kernel_init_freeable+0x230/0x2c8 kernel_init+0x10/0x108 ret_from_fork+0x10/0x1c Freed by task 0: (stack is not available) The buggy address belongs to the object at ffff80002c680080 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 0 bytes to the right of 512-byte region [ffff80002c680080, ffff80002c680280) The buggy address belongs to the page: page:ffff7e0000b1a000 count:1 mapcount:0 mapping:ffff80002e00c780 index:0xffff80002c683c80 compound_mapcount: 0 flags: 0x10200(slab|head) raw: 0000000000010200 ffff80002e003a10 ffff80002e003a10 ffff80002e00c780 raw: ffff80002c683c80 0000000000100001 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff80002c680180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff80002c680200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff80002c680280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff80002c680300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff80002c680380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc Correct the number of IRQ banks so there are no more mismatches. Fixes: c8a830904991 ("pinctrl: sunxi: add support for the Allwinner H6 main pin controller") Cc: Signed-off-by: Chen-Yu Tsai Tested-by: Neil Armstrong Acked-by: Maxime Ripard Signed-off-by: Linus Walleij drivers/pinctrl/sunxi/pinctrl-sun50i-h6.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5e1bc251cebc84b41b8eb5d2434e54d939a85430 Author: Priit Laes Date: Tue Jan 22 09:32:32 2019 +0200 drm/sun4i: hdmi: Fix usage of TMDS clock Although TMDS clock is required for HDMI to properly function, nobody called clk_prepare_enable(). This fixes reference counting issues and makes sure clock is running when it needs to be running. Due to TDMS clock being parent clock for DDC clock, TDMS clock was turned on/off for each EDID probe, causing spurious failures for certain HDMI/DVI screens. Fixes: 9c5681011a0c ("drm/sun4i: Add HDMI support") Signed-off-by: Priit Laes [Maxime: Moved the TMDS clock enable earlier] Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20190122073232.7240-1-plaes@plaes.org drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c | 4 ++++ 1 file changed, 4 insertions(+) commit 5c59801f7018acba11b12de59017a3fcdcf7421d Author: Paul Kocialkowski Date: Tue Jan 22 09:16:19 2019 +0100 clk: sunxi-ng: v3s: Fix TCON reset de-assert bit According to the datasheet and the reference code from Allwinner, the bit used to de-assert the TCON reset is bit 4, not bit 3. Fix it in the V3s CCU driver. Signed-off-by: Paul Kocialkowski Signed-off-by: Maxime Ripard drivers/clk/sunxi-ng/ccu-sun8i-v3s.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 815d835b7ba46685c316b000013367dacb2b461b Author: Tomonori Sakita Date: Mon Jan 21 17:34:16 2019 +0900 serial: fsl_lpuart: fix maximum acceptable baud rate with over-sampling Using over-sampling ratio, lpuart can accept baud rate upto uartclk / 4. Signed-off-by: Tomonori Sakita Signed-off-by: Atsushi Nemoto Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/fsl_lpuart.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e8a6ca808c5ed1e2b43ab25f1f2cbd43a7574f73 Author: Matthias Kaehlcke Date: Fri Jan 18 16:23:05 2019 -0800 tty: serial: qcom_geni_serial: Allow mctrl when flow control is disabled The geni set/get_mctrl() functions currently do nothing unless hardware flow control is enabled. Remove this arbitrary limitation. Suggested-by: Johan Hovold Fixes: 8a8a66a1a18a ("tty: serial: qcom_geni_serial: Add support for flow control") Signed-off-by: Matthias Kaehlcke Reviewed-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/qcom_geni_serial.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit f3716b8ae9347797b73896725f192c3a7b0069b5 Author: Liming Sun Date: Fri Jan 18 13:12:06 2019 -0500 mmc: dw_mmc-bluefield: : Fix the license information The SPDX license identifier and the boiler plate text are contradicting. Only the SPDX license identifier is needed. The other one is removed. Fixes: 86958dcc5ad7 ("mmc: dw_mmc-bluefield: Add driver extension") Cc: stable@vger.kernel.org Reviewed-by: David Woods Signed-off-by: Liming Sun Signed-off-by: Ulf Hansson drivers/mmc/host/dw_mmc-bluefield.c | 5 ----- 1 file changed, 5 deletions(-) commit 71e3e00c96efa851b2d5d3a3731711f9cc958b5b Author: Andreas Fenkart Date: Fri Jan 18 14:32:23 2019 +0100 mmc: meson-gx: enable signal re-sampling together with tuning card detection fails on "BeeLink Mini M8 SII" if enabled too early mmc1: error -110 whilst initialising MMC card Fixes: 71645e65729f ("mmc: meson-gx: add signal resampling") Signed-off-by: Andreas Fenkart Reviewed-by: Jerome Brunet Tested-by: Jerome Brunet Signed-off-by: Ulf Hansson drivers/mmc/host/meson-gx-mmc.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) commit 48b161983ae5266ffa42f0ccaf7224eaeda38e59 Merge: f8ff6c732d35 edcddd4c879a Author: Linus Torvalds Date: Tue Jan 22 17:08:30 2019 +1300 Merge tag 'xarray-5.0-rc3' of git://git.infradead.org/users/willy/linux-dax Pull XArray fixes from Matthew Wilcox: "Fix some oversights in the XArray porcelain API: - support for m68k's two-byte aligned pointers - reserving entries using xa_insert() - missing xa_insert_bh() and xa_insert_irq() functions - simplify using xa_for_each() - use lockdep correctly - a few other minor fixes and improvements" * tag 'xarray-5.0-rc3' of git://git.infradead.org/users/willy/linux-dax: XArray: Fix an arithmetic error in xa_is_err XArray tests: Check mark 2 gets squashed XArray: Fix typo in comment XArray: Honour reserved entries in xa_insert XArray: Permit storing 2-byte-aligned pointers XArray: Change xa_for_each iterator XArray: Turn xa_init_flags into a static inline XArray tests: Add RCU locking commit f8ff6c732d35904d773043f979b844ef330c701b Author: Christoph Hellwig Date: Thu Dec 20 17:16:53 2018 +0100 ide: fix a typo in the settings proc file name Fixes: ec7d9c9ce8 ("ide: replace ->proc_fops with ->proc_show") Reported-by: kernel test robot Signed-off-by: Christoph Hellwig Signed-off-by: Linus Torvalds drivers/ide/ide-proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 951d01b96f174ded6180e7e4e14929ef22e7da7e Author: Jason Gunthorpe Date: Fri Jan 11 19:31:24 2019 -0700 IB/mlx5: Fix how advise_mr() launches async work Work must hold a kref on the ib_device otherwise the dev pointer can become free before the work runs. This can happen because the work is being pushed onto the system work queue which is not flushed during driver unregister. Remove the bogus use of 'reg_state': - While in uverbs the reg_state is guaranteed to always be REGISTERED - Testing reg_state with no locking is bogus. Use ib_device_try_get() to get back into a region that prevents unregistration. For now continue with a flow that is similar to the existing code. Fixes: 813e90b1aeaa ("IB/mlx5: Add advise_mr() support") Signed-off-by: Jason Gunthorpe Reviewed-by: Moni Shoua drivers/infiniband/hw/mlx5/odp.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit d79af7242bb237d00e40092810e6828fbb929d2d Author: Jason Gunthorpe Date: Thu Jan 10 14:02:24 2019 -0700 RDMA/device: Expose ib_device_try_get(() It turns out future patches need this capability quite widely now, not just for netlink, so provide two global functions to manage the registration lock refcount. This also moves the point the lock becomes 1 to within ib_register_device() so that the semantics of the public API are very sane and clear. Calling ib_device_try_get() will fail on devices that are only allocated but not yet registered. Signed-off-by: Jason Gunthorpe Reviewed-by: Steve Wise Reviewed-by: Parav Pandit drivers/infiniband/core/core_priv.h | 1 - drivers/infiniband/core/device.c | 13 ++++++++++--- include/rdma/ib_verbs.h | 24 ++++++++++++++++++++++-- 3 files changed, 32 insertions(+), 6 deletions(-) commit 09ce351dff8e7636af0beb72cd4a86c3904a0500 Author: Mike Marciniszyn Date: Thu Jan 17 12:42:16 2019 -0800 IB/hfi1: Add limit test for RC/UC send via loopback Fix potential memory corruption and panic in loopback for IB_WR_SEND variants. The code blindly assumes the posted length will fit in the fetched rwqe, which is not a valid assumption. Fix by adding a limit test, and triggering the appropriate send completion and putting the QP in an error state. This mimics the handling for non-loopback QPs. Fixes: 15703461533a ("IB/{hfi1, qib, rdmavt}: Move ruc_loopback to rdmavt") Cc: #v4.20+ Reviewed-by: Michael J. Ruhl Signed-off-by: Mike Marciniszyn Signed-off-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe drivers/infiniband/sw/rdmavt/qp.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 7709b0dc265f28695487712c45f02bbd1f98415d Author: Michael J. Ruhl Date: Thu Jan 17 12:42:04 2019 -0800 IB/hfi1: Remove overly conservative VM_EXEC flag check Applications that use the stack for execution purposes cause userspace PSM jobs to fail during mmap(). Both Fortran (non-standard format parsing) and C (callback functions located in the stack) applications can be written such that stack execution is required. The linker notes this via the gnu_stack ELF flag. This causes READ_IMPLIES_EXEC to be set which forces all PROT_READ mmaps to have PROT_EXEC for the process. Checking for VM_EXEC bit and failing the request with EPERM is overly conservative and will break any PSM application using executable stacks. Cc: #v4.14+ Fixes: 12220267645c ("IB/hfi: Protect against writable mmap") Reviewed-by: Mike Marciniszyn Reviewed-by: Dennis Dalessandro Reviewed-by: Ira Weiny Signed-off-by: Michael J. Ruhl Signed-off-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/hfi1/file_ops.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 904bba211acc2112fdf866e5a2bc6cd9ecd0de1b Author: Brian Welty Date: Thu Jan 17 12:41:32 2019 -0800 IB/{hfi1, qib}: Fix WC.byte_len calculation for UD_SEND_WITH_IMM The work completion length for a receiving a UD send with immediate is short by 4 bytes causing application using this opcode to fail. The UD receive logic incorrectly subtracts 4 bytes for immediate value. These bytes are already included in header length and are used to calculate header/payload split, so the result is these 4 bytes are subtracted twice, once when the header length subtracted from the overall length and once again in the UD opcode specific path. Remove the extra subtraction when handling the opcode. Fixes: 7724105686e7 ("IB/hfi1: add driver files") Reviewed-by: Michael J. Ruhl Signed-off-by: Brian Welty Signed-off-by: Mike Marciniszyn Signed-off-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/hfi1/ud.c | 1 - drivers/infiniband/hw/qib/qib_ud.c | 1 - 2 files changed, 2 deletions(-) commit f45f8edbe1d345273ba0d8d8a9872bb30966869b Author: Jack Morgenstein Date: Tue Jan 15 16:45:48 2019 +0200 IB/mlx4: Fix using wrong function to destroy sqp AHs under SRIOV The commit cited below replaced rdma_create_ah with mlx4_ib_create_slave_ah when creating AHs for the paravirtualized special QPs. However, this change also required replacing rdma_destroy_ah with mlx4_ib_destroy_ah in the affected flows. The commit missed 3 places where rdma_destroy_ah should have been replaced with mlx4_ib_destroy_ah. As a result, the pd usecount was decremented when the ah was destroyed -- although the usecount was NOT incremented when the ah was created. This caused the pd usecount to become negative, and resulted in the WARN_ON stack trace below when the mlx4_ib.ko module was unloaded: WARNING: CPU: 3 PID: 25303 at drivers/infiniband/core/verbs.c:329 ib_dealloc_pd+0x6d/0x80 [ib_core] Modules linked in: rdma_ucm rdma_cm iw_cm ib_cm ib_umad mlx4_ib(-) ib_uverbs ib_core mlx4_en mlx4_core nfsv3 nfs fscache configfs xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c ipt_REJECT nf_reject_ipv4 tun ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter bridge stp llc dm_mirror dm_region_hash dm_log dm_mod dax rndis_wlan rndis_host coretemp kvm_intel cdc_ether kvm usbnet iTCO_wdt iTCO_vendor_support cfg80211 irqbypass lpc_ich ipmi_si i2c_i801 mii pcspkr i2c_core mfd_core ipmi_devintf i7core_edac ipmi_msghandler ioatdma pcc_cpufreq dca acpi_cpufreq nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables ext4 mbcache jbd2 sr_mod cdrom ata_generic pata_acpi mptsas scsi_transport_sas mptscsih crc32c_intel ata_piix bnx2 mptbase ipv6 crc_ccitt autofs4 [last unloaded: mlx4_core] CPU: 3 PID: 25303 Comm: modprobe Tainted: G W I 5.0.0-rc1-net-mlx4+ #1 Hardware name: IBM -[7148ZV6]-/Node 1, System Card, BIOS -[MLE170CUS-1.70]- 09/23/2011 RIP: 0010:ib_dealloc_pd+0x6d/0x80 [ib_core] Code: 00 00 85 c0 75 02 5b c3 80 3d aa 87 03 00 00 75 f5 48 c7 c7 88 d7 8f a0 31 c0 c6 05 98 87 03 00 01 e8 07 4c 79 e0 0f 0b 5b c3 <0f> 0b eb be 0f 0b eb ab 90 66 2e 0f 1f 84 00 00 00 00 00 66 66 66 RSP: 0018:ffffc90005347e30 EFLAGS: 00010282 RAX: 00000000ffffffea RBX: ffff8888589e9540 RCX: 0000000000000006 RDX: 0000000000000006 RSI: ffff88885d57ad40 RDI: 0000000000000000 RBP: ffff88885b029c00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000004 R12: ffff8887f06c0000 R13: ffff8887f06c13e8 R14: 0000000000000000 R15: 0000000000000000 FS: 00007fd6743c6740(0000) GS:ffff88887fcc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000ed1038 CR3: 00000007e3156000 CR4: 00000000000006e0 Call Trace: mlx4_ib_close_sriov+0x125/0x180 [mlx4_ib] mlx4_ib_remove+0x57/0x1f0 [mlx4_ib] mlx4_remove_device+0x92/0xa0 [mlx4_core] mlx4_unregister_interface+0x39/0x90 [mlx4_core] mlx4_ib_cleanup+0xc/0xd7 [mlx4_ib] __x64_sys_delete_module+0x17d/0x290 ? trace_hardirqs_off_thunk+0x1a/0x1c ? do_syscall_64+0x12/0x180 do_syscall_64+0x4a/0x180 entry_SYSCALL_64_after_hwframe+0x49/0xbe Fixes: 5e62d5ff1b9a ("IB/mlx4: Create slave AH's directly") Signed-off-by: Jack Morgenstein Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/mlx4/mad.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 8af526e035357d2df1d7cacc51bcde0a5d9f9f9f Author: Mark Bloch Date: Tue Jan 15 16:45:32 2019 +0200 RDMA/mlx5: Fix check for supported user flags when creating a QP When the flags verification was added two flags were missed from the check: * MLX5_QP_FLAG_TIR_ALLOW_SELF_LB_UC * MLX5_QP_FLAG_TIR_ALLOW_SELF_LB_MC This causes user applications that were using these flags to break. Fixes: 2e43bb31b8df ("IB/mlx5: Verify that driver supports user flags") Signed-off-by: Mark Bloch Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/mlx5/qp.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) commit 6d87dc97eb3341de3f7b1efa3156cb0e014f4a96 Author: Kenneth Feng Date: Fri Jan 18 18:08:19 2019 +0800 drm/amd/powerplay: OD setting fix on Vega10 gfxclk for OD setting is limited to 1980M for non-acg ASICs of Vega10 Signed-off-by: Kenneth Feng Reviewed-by: Evan Quan Signed-off-by: Alex Deucher .../amd/powerplay/hwmgr/vega10_processpptables.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) commit 52e60b754438f34d23348698534e9ca63cd751d7 Merge: 57ef300e4627 e8e683ae9a73 Author: Linus Torvalds Date: Tue Jan 22 07:27:17 2019 +1300 Merge tag 'iommu-fixes-v5.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull IOMMU fix from Joerg Roedel: "One fix only for now: Fix probe deferral in iommu/of code (broke with recent changes to iommu_ops->add_device invocation)" * tag 'iommu-fixes-v5.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/of: Fix probe-deferral commit 57ef300e4627db5bf41695b1932c24979efa600e Merge: 49a57857aeea e6a72b7daeeb Author: Linus Torvalds Date: Tue Jan 22 07:15:58 2019 +1300 Merge tag 'arc-5.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc Pull ARC architecture updates from Vineet Gupta: - Perf support for raw events - boot log printing: return stack, action points - fix memset to avoid prefetchw bleeding past end of buffer - do_page_fault fix for mmap_sem held while returning to userspace - other misc fixes * tag 'arc-5.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc: ARCv2: lib: memeset: fix doing prefetchw outside of buffer ARC: mm: do_page_fault fixes #1: relinquish mmap_sem if signal arrives while handle_mm_fault ARC: show_regs: lockdep: re-enable preemption ARC: show_regs: lockdep: avoid page allocator... ARC: perf: avoid kernel killing where it is possible ARC: perf: move HW events mapping to separate function ARC: perf: introduce Kernel PMU events support ARC: perf: trivial code cleanup ARC: perf: map generic branches to correct hardware condition ARC: adjust memblock_reserve of kernel memory arc: remove redundant kernel-space generic-y ARC: fix __ffs return value to avoid build warnings ARC: boot log: print Action point details ARCv2: boot log: BPU return stack depth commit 11189c1089da413aa4b5fd6be4c4d47c78968819 Author: Dan Williams Date: Sat Jan 19 10:55:04 2019 -0800 acpi/nfit: Fix command-supported detection The _DSM function number validation only happens to succeed when the generic Linux command number translation corresponds with a DSM-family-specific function number. This breaks NVDIMM-N implementations that correctly implement _LSR, _LSW, and _LSI, but do not happen to publish support for DSM function numbers 4, 5, and 6. Recall that the support for _LS{I,R,W} family of methods results in the DIMM being marked as supporting those command numbers at acpi_nfit_register_dimms() time. The DSM function mask is only used for ND_CMD_CALL support of non-NVDIMM_FAMILY_INTEL devices. Fixes: 31eca76ba2fc ("nfit, libnvdimm: limited/whitelisted dimm command...") Cc: Link: https://github.com/pmem/ndctl/issues/78 Reported-by: Sujith Pandel Tested-by: Sujith Pandel Reviewed-by: Vishal Verma Reviewed-by: Jeff Moyer Signed-off-by: Dan Williams drivers/acpi/nfit/core.c | 54 +++++++++++++++++++++++++++++++++++------------- 1 file changed, 40 insertions(+), 14 deletions(-) commit 5e9e38d0db1d29efed1dd4cf9a70115d33521be7 Author: Dan Williams Date: Mon Jan 14 14:07:19 2019 -0800 acpi/nfit: Block function zero DSMs In preparation for using function number 0 as an error value, prevent it from being considered a valid function value by acpi_nfit_ctl(). Cc: Cc: stuart hayes Fixes: e02fb7264d8a ("nfit: add Microsoft NVDIMM DSM command set...") Reported-by: Jeff Moyer Reviewed-by: Jeff Moyer Signed-off-by: Dan Williams drivers/acpi/nfit/core.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 1cd7386549f9b6f2f230da54aa9e7fe2d6c216d2 Author: Dan Williams Date: Sat Jan 19 08:45:56 2019 -0800 libnvdimm/security: Require nvdimm_security_setup_events() to succeed The following warning: ACPI0012:00: security event setup failed: -19 ...is meant to capture exceptional failures of sysfs_get_dirent(), however it will also fail in the common case when security support is disabled. A few issues: 1/ A dev_warn() report for a common case is too chatty 2/ The setup of this notifier is generic, no need for it to be driven from the nfit driver, it can exist completely in the core. 3/ If it fails for any reason besides security support being disabled, that's fatal and should abort DIMM activation. Userspace may hang if it never gets overwrite notifications. 4/ The dirent needs to be released. Move the call to the core 'dimm' driver, make it conditional on security support being active, make it fatal for the exceptional case, add the missing sysfs_put() at device disable time. Fixes: 7d988097c546 ("...Add security DSM overwrite support") Reviewed-by: Dave Jiang Signed-off-by: Dan Williams drivers/acpi/nfit/core.c | 5 ----- drivers/nvdimm/dimm.c | 6 ++++++ drivers/nvdimm/dimm_devs.c | 22 +++++++++++++++++----- drivers/nvdimm/nd.h | 1 + include/linux/libnvdimm.h | 1 - 5 files changed, 24 insertions(+), 11 deletions(-) commit 266c7bf52a7fe5cb5a97e78fedcaac629378008f Author: Dave Jiang Date: Mon Jan 14 18:41:04 2019 -0700 nfit_test: fix security state pull for nvdimm security nfit_test The override status function needs to be updated to use the proper request parameter in order to get the security state. Fixes: 3c13e2ac747a ("...Add test support for Intel nvdimm security DSMs") Reported-by: Vishal Verma Signed-off-by: Dave Jiang Signed-off-by: Dan Williams tools/testing/nvdimm/dimm_devs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 78ddc9b4417dacfbababb1c02f9987ebcc75c786 Author: Fabio Estevam Date: Mon Jan 21 14:27:11 2019 -0200 ASoC: MAINTAINERS: fsl: Change Fabio's email address I prefer to use my personal email address for kernel related work. Signed-off-by: Fabio Estevam Signed-off-by: Mark Brown MAINTAINERS | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 27cfb3a53be46a54ec5e0bd04e51995b74c90343 Author: Greg Kroah-Hartman Date: Sun Jan 20 10:46:58 2019 +0100 tty: Handle problem if line discipline does not have receive_buf Some tty line disciplines do not have a receive buf callback, so properly check for that before calling it. If they do not have this callback, just eat the character quietly, as we can't fail this call. Reported-by: Jann Horn Cc: stable Signed-off-by: Greg Kroah-Hartman drivers/tty/tty_io.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit a1e1cb72d96491277ede8d257ce6b48a381dd336 Author: Mike Snitzer Date: Thu Jan 17 10:48:01 2019 -0500 dm: fix redundant IO accounting for bios that need splitting The risk of redundant IO accounting was not taken into consideration when commit 18a25da84354 ("dm: ensure bio submission follows a depth-first tree walk") introduced IO splitting in terms of recursion via generic_make_request(). Fix this by subtracting the split bio's payload from the IO stats that were already accounted for by start_io_acct() upon dm_make_request() entry. This repeat oscillation of the IO accounting, up then down, isn't ideal but refactoring DM core's IO splitting to pre-split bios _before_ they are accounted turned out to be an excessive amount of change that will need a full development cycle to refine and verify. Before this fix: /dev/mapper/stripe_dev is a 4-way stripe using a 32k chunksize, so bios are split on 32k boundaries. # fio --name=16M --filename=/dev/mapper/stripe_dev --rw=write --bs=64k --size=16M \ --iodepth=1 --ioengine=libaio --direct=1 --refill_buffers with debugging added: [103898.310264] device-mapper: core: start_io_acct: dm-2 WRITE bio->bi_iter.bi_sector=0 len=128 [103898.318704] device-mapper: core: __split_and_process_bio: recursing for following split bio: [103898.329136] device-mapper: core: start_io_acct: dm-2 WRITE bio->bi_iter.bi_sector=64 len=64 ... 16M written yet 136M (278528 * 512b) accounted: # cat /sys/block/dm-2/stat | awk '{ print $7 }' 278528 After this fix: 16M written and 16M (32768 * 512b) accounted: # cat /sys/block/dm-2/stat | awk '{ print $7 }' 32768 Fixes: 18a25da84354 ("dm: ensure bio submission follows a depth-first tree walk") Cc: stable@vger.kernel.org # 4.16+ Reported-by: Bryan Gurney Reviewed-by: Ming Lei Signed-off-by: Mike Snitzer drivers/md/dm.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) commit 57c36519e4b949f89381053f7283f5d605595b42 Author: Mike Snitzer Date: Wed Jan 16 18:53:26 2019 -0500 dm: fix clone_bio() to trigger blk_recount_segments() DM's clone_bio() now benefits from using bio_trim() by fixing the fact that clone_bio() wasn't clearing BIO_SEG_VALID like bio_trim() does; which triggers blk_recount_segments() via bio_phys_segments(). Reviewed-by: Ming Lei Signed-off-by: Mike Snitzer drivers/md/dm.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) commit 699390381a7bae2fab01a22f742a17235c44ed8a Author: Anthony Wong Date: Sat Jan 19 12:22:31 2019 +0800 ALSA: hda - Add mute LED support for HP ProBook 470 G5 Support speaker and mic mute LEDs on HP ProBook 470 G5. BugLink: https://bugs.launchpad.net/bugs/1811254 Signed-off-by: Anthony Wong Cc: Signed-off-by: Takashi Iwai sound/pci/hda/patch_conexant.c | 1 + 1 file changed, 1 insertion(+) commit 8bf8c6da53c2265aea365a1de6038f118f522113 Author: Tony Jones Date: Sun Jan 20 11:14:14 2019 -0800 perf script: Fix crash when processing recorded stat data While updating perf to work with Python3 and Python2 I noticed that the stat-cpi script was dumping core. $ perf stat -e cycles,instructions record -o /tmp/perf.data /bin/false Performance counter stats for '/bin/false': 802,148 cycles 604,622 instructions 802,148 cycles 604,622 instructions 0.001445842 seconds time elapsed $ perf script -i /tmp/perf.data -s scripts/python/stat-cpi.py Segmentation fault (core dumped) ... ... rblist=rblist@entry=0xb2a200 , new_entry=new_entry@entry=0x7ffcb755c310) at util/rblist.c:33 ctx=, type=, create=, cpu=, evsel=) at util/stat-shadow.c:118 ctx=, type=, st=) at util/stat-shadow.c:196 count=count@entry=727442, cpu=cpu@entry=0, st=0xb2a200 ) at util/stat-shadow.c:239 config=config@entry=0xafeb40 , counter=counter@entry=0x133c6e0) at util/stat.c:372 ... ... The issue is that since 1fcd03946b52 perf_stat__update_shadow_stats now calls update_runtime_stat passing rt_stat rather than calling update_stats but perf_stat__init_shadow_stats has never been called to initialize rt_stat in the script path processing recorded stat data. Since I can't see any reason why perf_stat__init_shadow_stats() is presently initialized like it is in builtin-script.c::perf_sample__fprint_metric() [4bd1bef8bba2f] I'm proposing it instead be initialized once in __cmd_script Committer testing: After applying the patch: # perf script -i /tmp/perf.data -s tools/perf/scripts/python/stat-cpi.py 0.001970: cpu -1, thread -1 -> cpi 1.709079 (1075684/629394) # No segfault. Signed-off-by: Tony Jones Reviewed-by: Jiri Olsa Tested-by: Arnaldo Carvalho de Melo Tested-by: Ravi Bangoria Cc: Andi Kleen Cc: Jin Yao Fixes: 1fcd03946b52 ("perf stat: Update per-thread shadow stats") Link: http://lkml.kernel.org/r/20190120191414.12925-1-tonyj@suse.de Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-script.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) commit da06d568386877809532e8ec678f4a5e300f0951 Author: He Kuang Date: Mon Jan 21 00:05:22 2019 +0800 perf top: Fix wrong hottest instruction highlighted The annotation line percentage is compared and inserted into the rbtree, but the percent field of 'struct annotation_data' is an array, the comparison result between them is the address difference. This patch compares the right slot of percent array according to opts->percent_type and makes things right. The problem can be reproduced by pressing 'H' in perf top annotation view. It should highlight the instruction line which has the highest sampling percentage. Signed-off-by: He Kuang Reviewed-by: Jiri Olsa Cc: Alexander Shishkin Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/20190120160523.4391-1-hekuang@huawei.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/ui/browsers/annotate.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) commit 1497e804d1a6e2bd9107ddf64b0310449f4673eb Author: Stephane Eranian Date: Sat Jan 19 00:12:39 2019 -0800 perf tools: Handle TOPOLOGY headers with no CPU This patch fixes an issue in cpumap.c when used with the TOPOLOGY header. In some configurations, some NUMA nodes may have no CPU (empty cpulist). Yet a cpumap map must be created otherwise perf abort with an error. This patch handles this case by creating a dummy map. Before: $ perf record -o - -e cycles noploop 2 | perf script -i - 0x6e8 [0x6c]: failed to process type: 80 After: $ perf record -o - -e cycles noploop 2 | perf script -i - noploop for 2 seconds Signed-off-by: Stephane Eranian Acked-by: Jiri Olsa Cc: Andi Kleen Cc: Kan Liang Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/1547885559-1657-1-git-send-email-eranian@google.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/cpumap.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) commit 74827ee29565f86e2a64495a5e3e58d3371d74ee Author: Thomas Gleixner Date: Fri Jan 18 00:14:22 2019 +0100 ceph: quota: cleanup license mess Precise and non-ambiguous license information is important. The recently added quota.c file has a SPDX license identifier, which is nice, but at the same time it has a contradictionary license boiler plate text. SPDX-License-Identifier: GPL-2.0 versus * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version 2 * of the License, or (at your option) any later version. Oh well. As the other ceph related files are licensed under the GPL v2 only, it's assumed that the SPDX id is correct and the boiler plate was randomly copied into that patch. Remove the boiler plate as it is wrong and even if correct it is redundant. Fixes: fb18a57568c2 ("ceph: quota: add initial infrastructure to support cephfs quotas") Signed-off-by: Thomas Gleixner Cc: Luis Henriques Cc: Jiri Kosina Cc: "Yan, Zheng" Cc: Sage Weil Cc: Ilya Dryomov Cc: ceph-devel@vger.kernel.org Acked-by: Luis Henriques Signed-off-by: Ilya Dryomov fs/ceph/quota.c | 13 ------------- 1 file changed, 13 deletions(-) commit 4aac9228d16458cedcfd90c7fb37211cf3653ac3 Author: Ilya Dryomov Date: Mon Jan 14 21:13:10 2019 +0100 libceph: avoid KEEPALIVE_PENDING races in ceph_con_keepalive() con_fault() can transition the connection into STANDBY right after ceph_con_keepalive() clears STANDBY in clear_standby(): libceph user thread ceph-msgr worker ceph_con_keepalive() mutex_lock(&con->mutex) clear_standby(con) mutex_unlock(&con->mutex) mutex_lock(&con->mutex) con_fault() ... if KEEPALIVE_PENDING isn't set set state to STANDBY ... mutex_unlock(&con->mutex) set KEEPALIVE_PENDING set WRITE_PENDING This triggers warnings in clear_standby() when either ceph_con_send() or ceph_con_keepalive() get to clearing STANDBY next time. I don't see a reason to condition queue_con() call on the previous value of KEEPALIVE_PENDING, so move the setting of KEEPALIVE_PENDING into the critical section -- unlike WRITE_PENDING, KEEPALIVE_PENDING could have been a non-atomic flag. Reported-by: syzbot+acdeb633f6211ccdf886@syzkaller.appspotmail.com Signed-off-by: Ilya Dryomov Tested-by: Myungho Jung net/ceph/messenger.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit d95e674c01cfb5461e8b9fdeebf6d878c9b80b2f Author: Yan, Zheng Date: Thu Jan 10 15:41:09 2019 +0800 ceph: clear inode pointer when snap realm gets dropped by its inode snap realm and corresponding inode have pointers to each other. The two pointer should get clear at the same time. Otherwise, snap realm's pointer may reference freed inode. Cc: stable@vger.kernel.org # 4.17+ Signed-off-by: "Yan, Zheng" Reviewed-by: Luis Henriques Signed-off-by: Ilya Dryomov fs/ceph/caps.c | 2 ++ 1 file changed, 2 insertions(+) commit f165988b77ef849eb0c1aebd94fe778024f88314 Author: Jason Kridner Date: Fri Jan 11 10:02:13 2019 -0500 pinctrl: mcp23s08: spi: Fix regmap allocation for mcp23s18 Fixes issue created by 9b3e4207661e67f04c72af15e29f74cd944f5964. It wasn't possible for one_regmap_config to be non-NULL at the point it was tested for mcp23s18 devices. Applied the same pattern of allocating one_regmap_config using devm_kmemdump() and then initializing the local regmap structure from that. Signed-off-by: Jason Kridner Signed-off-by: Linus Walleij drivers/pinctrl/pinctrl-mcp23s08.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit e3f72b749da2bf63bed7409e416f160418d475b6 Author: Dmitry Torokhov Date: Mon Jan 14 19:38:36 2019 -0800 pinctrl: cherryview: fix Strago DMI workaround Well, hopefully 3rd time is a charm. We tried making that check DMI_BIOS_VERSION and DMI_BOARD_VERSION, but the real one is DMI_PRODUCT_VERSION. Fixes: 86c5dd6860a6 ("pinctrl: cherryview: limit Strago DMI workarounds to version 1.0") Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=197953 Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1631930 Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov Reviewed-by: Andy Shevchenko Acked-by: Mika Westerberg Signed-off-by: Linus Walleij drivers/pinctrl/intel/pinctrl-cherryview.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit e158488be27b157802753a59b336142dc0eb0380 Author: Xie Yongji Date: Thu Nov 29 20:50:30 2018 +0800 locking/rwsem: Fix (possible) missed wakeup Because wake_q_add() can imply an immediate wakeup (cmpxchg failure case), we must not rely on the wakeup being delayed. However, commit: e38513905eea ("locking/rwsem: Rework zeroing reader waiter->task") relies on exactly that behaviour in that the wakeup must not happen until after we clear waiter->task. [ peterz: Added changelog. ] Signed-off-by: Xie Yongji Signed-off-by: Zhang Yu Signed-off-by: Peter Zijlstra (Intel) Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Fixes: e38513905eea ("locking/rwsem: Rework zeroing reader waiter->task") Link: https://lkml.kernel.org/r/1543495830-2644-1-git-send-email-xieyongji@baidu.com Signed-off-by: Ingo Molnar kernel/locking/rwsem-xadd.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) commit b061c38bef43406df8e73c5be06cbfacad5ee6ad Author: Peter Zijlstra Date: Thu Nov 29 14:44:49 2018 +0100 futex: Fix (possible) missed wakeup We must not rely on wake_q_add() to delay the wakeup; in particular commit: 1d0dcb3ad9d3 ("futex: Implement lockless wakeups") moved wake_q_add() before smp_store_release(&q->lock_ptr, NULL), which could result in futex_wait() waking before observing ->lock_ptr == NULL and going back to sleep again. Signed-off-by: Peter Zijlstra (Intel) Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Fixes: 1d0dcb3ad9d3 ("futex: Implement lockless wakeups") Signed-off-by: Ingo Molnar kernel/futex.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) commit 4c4e3731564c8945ac5ac90fc2a1e1f21cb79c92 Author: Peter Zijlstra Date: Mon Dec 17 10:14:53 2018 +0100 sched/wake_q: Fix wakeup ordering for wake_q Notable cmpxchg() does not provide ordering when it fails, however wake_q_add() requires ordering in this specific case too. Without this it would be possible for the concurrent wakeup to not observe our prior state. Andrea Parri provided: C wake_up_q-wake_q_add { int next = 0; int y = 0; } P0(int *next, int *y) { int r0; /* in wake_up_q() */ WRITE_ONCE(*next, 1); /* node->next = NULL */ smp_mb(); /* implied by wake_up_process() */ r0 = READ_ONCE(*y); } P1(int *next, int *y) { int r1; /* in wake_q_add() */ WRITE_ONCE(*y, 1); /* wake_cond = true */ smp_mb__before_atomic(); r1 = cmpxchg_relaxed(next, 1, 2); } exists (0:r0=0 /\ 1:r1=0) This "exists" clause cannot be satisfied according to the LKMM: Test wake_up_q-wake_q_add Allowed States 3 0:r0=0; 1:r1=1; 0:r0=1; 1:r1=0; 0:r0=1; 1:r1=1; No Witnesses Positive: 0 Negative: 3 Condition exists (0:r0=0 /\ 1:r1=0) Observation wake_up_q-wake_q_add Never 0 3 Reported-by: Yongji Xie Signed-off-by: Peter Zijlstra (Intel) Cc: Davidlohr Bueso Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Waiman Long Cc: Will Deacon Signed-off-by: Ingo Molnar kernel/sched/core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit e6018c0f5c996e61639adce6a0697391a2861916 Author: Peter Zijlstra Date: Mon Dec 17 10:14:53 2018 +0100 sched/wake_q: Document wake_q_add() The only guarantee provided by wake_q_add() is that a wakeup will happen after it, it does _NOT_ guarantee the wakeup will be delayed until the matching wake_up_q(). If wake_q_add() fails the cmpxchg() a concurrent wakeup is pending and that can happen at any time after the cmpxchg(). This means we should not rely on the wakeup happening at wake_q_up(), but should be ready for wake_q_add() to issue the wakeup. The delay; if provided (most likely); should only result in more efficient behaviour. Reported-by: Yongji Xie Signed-off-by: Peter Zijlstra (Intel) Cc: Davidlohr Bueso Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Waiman Long Cc: Will Deacon Signed-off-by: Ingo Molnar include/linux/sched/wake_q.h | 6 +++++- kernel/sched/core.c | 12 ++++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) commit 6dc080eeb2ba01973bfff0d79844d7a59e12542e Author: Prateek Sood Date: Fri Nov 30 20:40:56 2018 +0530 sched/wait: Fix rcuwait_wake_up() ordering For some peculiar reason rcuwait_wake_up() has the right barrier in the comment, but not in the code. This mistake has been observed to cause a deadlock in the following situation: P1 P2 percpu_up_read() percpu_down_write() rcu_sync_is_idle() // false rcu_sync_enter() ... __percpu_up_read() [S] ,- __this_cpu_dec(*sem->read_count) | smp_rmb(); [L] | task = rcu_dereference(w->task) // NULL | | [S] w->task = current | smp_mb(); | [L] readers_active_check() // fail `-> Where the smp_rmb() (obviously) fails to constrain the store. [ peterz: Added changelog. ] Signed-off-by: Prateek Sood Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Andrea Parri Acked-by: Davidlohr Bueso Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Fixes: 8f95c90ceb54 ("sched/wait, RCU: Introduce rcuwait machinery") Link: https://lkml.kernel.org/r/1543590656-7157-1-git-send-email-prsood@codeaurora.org Signed-off-by: Ingo Molnar kernel/exit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 49a57857aeea06ca831043acbb0fa5e0f50602fd Author: Linus Torvalds Date: Mon Jan 21 13:14:44 2019 +1300 Linux 5.0-rc3 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1e556ba3b673166e28d5489b80c11e0605a86403 Merge: dbcfc9619393 5631e8576a3c Author: Linus Torvalds Date: Mon Jan 21 13:12:03 2019 +1300 Merge tag 'pstore-v5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull pstore fixes from Kees Cook: - Fix console ramoops to show the previous boot logs (Sai Prakash Ranjan) - Avoid allocation and leak of platform data * tag 'pstore-v5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: pstore/ram: Avoid allocation and leak of platform data pstore/ram: Fix console ramoops to show the previous boot logs commit dbcfc961939394152cbcf3f17144ff3df359f216 Merge: 7d0ae236ed13 2c88c742d011 Author: Linus Torvalds Date: Mon Jan 21 13:07:03 2019 +1300 Merge tag 'gcc-plugins-v5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull gcc-plugins fixes from Kees Cook: "Fix ARM per-task stack protector plugin under GCC 9 (Ard Biesheuvel)" * tag 'gcc-plugins-v5.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: gcc-plugins: arm_ssp_per_task_plugin: fix for GCC 9+ gcc-plugins: arm_ssp_per_task_plugin: sign extend the SP mask commit 7d0ae236ed13d7645fb73b85e7c95deee46c4656 Merge: bb617b9b4519 6436408e814b Author: Linus Torvalds Date: Mon Jan 21 12:52:31 2019 +1300 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) Fix endless loop in nf_tables, from Phil Sutter. 2) Fix cross namespace ip6_gre tunnel hash list corruption, from Olivier Matz. 3) Don't be too strict in phy_start_aneg() otherwise we might not allow restarting auto negotiation. From Heiner Kallweit. 4) Fix various KMSAN uninitialized value cases in tipc, from Ying Xue. 5) Memory leak in act_tunnel_key, from Davide Caratti. 6) Handle chip errata of mv88e6390 PHY, from Andrew Lunn. 7) Remove linear SKB assumption in fou/fou6, from Eric Dumazet. 8) Missing udplite rehash callbacks, from Alexey Kodanev. 9) Log dirty pages properly in vhost, from Jason Wang. 10) Use consume_skb() in neigh_probe() as this is a normal free not a drop, from Yang Wei. Likewise in macvlan_process_broadcast(). 11) Missing device_del() in mdiobus_register() error paths, from Thomas Petazzoni. 12) Fix checksum handling of short packets in mlx5, from Cong Wang. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (96 commits) bpf: in __bpf_redirect_no_mac pull mac only if present virtio_net: bulk free tx skbs net: phy: phy driver features are mandatory isdn: avm: Fix string plus integer warning from Clang net/mlx5e: Fix cb_ident duplicate in indirect block register net/mlx5e: Fix wrong (zero) TX drop counter indication for representor net/mlx5e: Fix wrong error code return on FEC query failure net/mlx5e: Force CHECKSUM_UNNECESSARY for short ethernet frames tools: bpftool: Cleanup license mess bpf: fix inner map masking to prevent oob under speculation bpf: pull in pkt_sched.h header for tooling to fix bpftool build selftests: forwarding: Add a test case for externally learned FDB entries selftests: mlxsw: Test FDB offload indication mlxsw: spectrum_switchdev: Do not treat static FDB entries as sticky net: bridge: Mark FDB entries that were added by user as such mlxsw: spectrum_fid: Update dummy FID index mlxsw: pci: Return error on PCI reset timeout mlxsw: pci: Increase PCI SW reset timeout mlxsw: pci: Ring CQ's doorbell before RDQ's MAINTAINERS: update email addresses of liquidio driver maintainers ... commit 5631e8576a3caf606cdc375f97425a67983b420c Author: Kees Cook Date: Sun Jan 20 14:33:34 2019 -0800 pstore/ram: Avoid allocation and leak of platform data Yue Hu noticed that when parsing device tree the allocated platform data was never freed. Since it's not used beyond the function scope, this switches to using a stack variable instead. Reported-by: Yue Hu Fixes: 35da60941e44 ("pstore/ram: add Device Tree bindings") Cc: stable@vger.kernel.org Signed-off-by: Kees Cook fs/pstore/ram.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) commit 2c88c742d011707b55da7b54b06a030c6f57233f Author: Ard Biesheuvel Date: Fri Jan 18 11:58:07 2019 +0100 gcc-plugins: arm_ssp_per_task_plugin: fix for GCC 9+ GCC 9 reworks the way the references to the stack canary are emitted, to prevent the value from being spilled to the stack before the final comparison in the epilogue, defeating the purpose, given that the spill slot is under control of the attacker that we are protecting ourselves from. Since our canary value address is obtained without accessing memory (as opposed to pre-v7 code that will obtain it from a literal pool), it is unlikely (although not guaranteed) that the compiler will spill the canary value in the same way, so let's just disable this improvement when building with GCC9+. Signed-off-by: Ard Biesheuvel Signed-off-by: Kees Cook scripts/gcc-plugins/arm_ssp_per_task_plugin.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) commit 560706d5d2589ef510f5436d69ab510a351b8cf7 Author: Ard Biesheuvel Date: Fri Jan 18 11:58:06 2019 +0100 gcc-plugins: arm_ssp_per_task_plugin: sign extend the SP mask The ARM per-task stack protector GCC plugin hits an assert in the compiler in some case, due to the fact the the SP mask expression is not sign-extended as it should be. So fix that. Suggested-by: Kugan Vivekanandarajah Signed-off-by: Ard Biesheuvel Signed-off-by: Kees Cook scripts/gcc-plugins/arm_ssp_per_task_plugin.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit bb617b9b4519b0cef939c9c8e9c41470749f0d51 Merge: 1be969f4682b 8e5dadfe76cf Author: Linus Torvalds Date: Mon Jan 21 07:37:16 2019 +1300 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio/vhost fixes and cleanups from Michael Tsirkin: "Fixes and cleanups all over the place" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: vhost/scsi: Use copy_to_iter() to send control queue response vhost: return EINVAL if iovecs size does not match the message size virtio-balloon: tweak config_changed implementation virtio: don't allocate vqs when names[i] = NULL virtio_pci: use queue idx instead of array idx to set up the vq virtio: document virtio_config_ops restrictions virtio: fix virtio_config_ops description commit 1be969f4682b0aa1995e46fba51502de55f15ce8 Merge: 315a6d850a82 fd340d0f68cc Author: Linus Torvalds Date: Mon Jan 21 07:35:26 2019 +1300 Merge tag 'for-5.0-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "A handful of fixes (some of them in testing for a long time): - fix some test failures regarding cleanup after transaction abort - revert of a patch that could cause a deadlock - delayed iput fixes, that can help in ENOSPC situation when there's low space and a lot data to write" * tag 'for-5.0-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: wakeup cleaner thread when adding delayed iput btrfs: run delayed iputs before committing btrfs: wait on ordered extents on abort cleanup btrfs: handle delayed ref head accounting cleanup in abort Revert "btrfs: balance dirty metadata pages in btrfs_finish_ordered_io" commit 315a6d850a8290919c499cfbed08737f6164c7bd Merge: fbfaf851902c 3e2ffd655cc6 99e309b6ed75 Author: Linus Torvalds Date: Mon Jan 21 07:23:42 2019 +1300 Merge tags 'compiler-attributes-for-linus-v5.0-rc3' and 'clang-format-for-linus-v5.0-rc3' of git://github.com/ojeda/linux Pull misc clang fixes from Miguel Ojeda: - A fix for OPTIMIZER_HIDE_VAR from Michael S Tsirkin - Update clang-format with the latest for_each macro list from Jason Gunthorpe * tag 'compiler-attributes-for-linus-v5.0-rc3' of git://github.com/ojeda/linux: include/linux/compiler*.h: fix OPTIMIZER_HIDE_VAR * tag 'clang-format-for-linus-v5.0-rc3' of git://github.com/ojeda/linux: clang-format: Update .clang-format with the latest for_each macro list commit fbfaf851902cd9293f392f3a1735e0543016d530 Author: Florian La Roche Date: Sat Jan 19 16:14:50 2019 +0100 fix int_sqrt64() for very large numbers If an input number x for int_sqrt64() has the highest bit set, then fls64(x) is 64. (1UL << 64) is an overflow and breaks the algorithm. Subtracting 1 is a better guess for the initial value of m anyway and that's what also done in int_sqrt() implicitly [*]. [*] Note how int_sqrt() uses __fls() with two underscores, which already returns the proper raw bit number. In contrast, int_sqrt64() used fls64(), and that returns bit numbers illogically starting at 1, because of error handling for the "no bits set" case. Will points out that he bug probably is due to a copy-and-paste error from the regular int_sqrt() case. Signed-off-by: Florian La Roche Acked-by: Will Deacon Signed-off-by: Linus Torvalds lib/int_sqrt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6e693b3ffecb0b478c7050b44a4842854154f715 Author: Will Deacon Date: Sat Jan 19 21:56:05 2019 +0000 x86: uaccess: Inhibit speculation past access_ok() in user_access_begin() Commit 594cc251fdd0 ("make 'user_access_begin()' do 'access_ok()'") makes the access_ok() check part of the user_access_begin() preceding a series of 'unsafe' accesses. This has the desirable effect of ensuring that all 'unsafe' accesses have been range-checked, without having to pick through all of the callsites to verify whether the appropriate checking has been made. However, the consolidated range check does not inhibit speculation, so it is still up to the caller to ensure that they are not susceptible to any speculative side-channel attacks for user addresses that ultimately fail the access_ok() check. This is an oversight, so use __uaccess_begin_nospec() to ensure that speculation is inhibited until the access_ok() check has passed. Reported-by: Julien Thierry Signed-off-by: Will Deacon Signed-off-by: Linus Torvalds arch/x86/include/asm/uaccess.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b0f3e768a89bbc72195023c3db1db45c40e5b70c Merge: 5d5c303ea095 7fa1e2e6afa7 Author: Linus Torvalds Date: Sun Jan 20 15:27:59 2019 +1200 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "Three arm64 fixes for -rc3. We've plugged a couple of nasty issues involving KASLR-enabled kernels, and removed a redundant #define that was introduced as part of the KHWASAN fixes from akpm at -rc2. - Fix broken kpti page-table rewrite in bizarre KASLR configuration - Fix module loading with KASLR - Remove redundant definition of ARCH_SLAB_MINALIGN" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: kasan, arm64: remove redundant ARCH_SLAB_MINALIGN define arm64: kaslr: ensure randomized quantities are clean to the PoC arm64: kpti: Update arm64_kernel_use_ng_mappings() when forced on commit 6436408e814b81046f4595245c1f9bc4409e945c Merge: df133f3f9625 e7c87bd6cc4e Author: David S. Miller Date: Sat Jan 19 16:38:12 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2019-01-20 The following pull-request contains BPF updates for your *net* tree. The main changes are: 1) Fix a out-of-bounds access in __bpf_redirect_no_mac, from Willem. 2) Fix bpf_setsockopt to reset sock dst on SO_MARK changes, from Peter. 3) Fix map in map masking to prevent out-of-bounds access under speculative execution, from Daniel. 4) Fix bpf_setsockopt's SO_MAX_PACING_RATE to support TCP internal pacing, from Yuchung. 5) Fix json writer license in bpftool, from Thomas. 6) Fix AF_XDP to check if an actually queue exists during umem setup, from Krzysztof. 7) Several fixes to BPF stackmap's build id handling. Another fix for bpftool build to account for libbfd variations wrt linking requirements, from Stanislav. 8) Fix BPF samples build with clang by working around missing asm goto, from Yonghong. 9) Fix libbpf to retry program load on signal interrupt, from Lorenz. 10) Various minor compile warning fixes in BPF code, from Mathieu. ==================== Signed-off-by: David S. Miller commit e7c87bd6cc4ec7b0ac1ed0a88a58f8206c577488 Author: Willem de Bruijn Date: Tue Jan 15 20:19:22 2019 -0500 bpf: in __bpf_redirect_no_mac pull mac only if present Syzkaller was able to construct a packet of negative length by redirecting from bpf_prog_test_run_skb with BPF_PROG_TYPE_LWT_XMIT: BUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:345 [inline] BUG: KASAN: slab-out-of-bounds in skb_copy_from_linear_data include/linux/skbuff.h:3421 [inline] BUG: KASAN: slab-out-of-bounds in __pskb_copy_fclone+0x2dd/0xeb0 net/core/skbuff.c:1395 Read of size 4294967282 at addr ffff8801d798009c by task syz-executor2/12942 kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412 check_memory_region_inline mm/kasan/kasan.c:260 [inline] check_memory_region+0x13e/0x1b0 mm/kasan/kasan.c:267 memcpy+0x23/0x50 mm/kasan/kasan.c:302 memcpy include/linux/string.h:345 [inline] skb_copy_from_linear_data include/linux/skbuff.h:3421 [inline] __pskb_copy_fclone+0x2dd/0xeb0 net/core/skbuff.c:1395 __pskb_copy include/linux/skbuff.h:1053 [inline] pskb_copy include/linux/skbuff.h:2904 [inline] skb_realloc_headroom+0xe7/0x120 net/core/skbuff.c:1539 ipip6_tunnel_xmit net/ipv6/sit.c:965 [inline] sit_tunnel_xmit+0xe1b/0x30d0 net/ipv6/sit.c:1029 __netdev_start_xmit include/linux/netdevice.h:4325 [inline] netdev_start_xmit include/linux/netdevice.h:4334 [inline] xmit_one net/core/dev.c:3219 [inline] dev_hard_start_xmit+0x295/0xc90 net/core/dev.c:3235 __dev_queue_xmit+0x2f0d/0x3950 net/core/dev.c:3805 dev_queue_xmit+0x17/0x20 net/core/dev.c:3838 __bpf_tx_skb net/core/filter.c:2016 [inline] __bpf_redirect_common net/core/filter.c:2054 [inline] __bpf_redirect+0x5cf/0xb20 net/core/filter.c:2061 ____bpf_clone_redirect net/core/filter.c:2094 [inline] bpf_clone_redirect+0x2f6/0x490 net/core/filter.c:2066 bpf_prog_41f2bcae09cd4ac3+0xb25/0x1000 The generated test constructs a packet with mac header, network header, skb->data pointing to network header and skb->len 0. Redirecting to a sit0 through __bpf_redirect_no_mac pulls the mac length, even though skb->data already is at skb->network_header. bpf_prog_test_run_skb has already pulled it as LWT_XMIT !is_l2. Update the offset calculation to pull only if skb->data differs from skb->network_header, which is not true in this case. The test itself can be run only from commit 1cf1cae963c2 ("bpf: introduce BPF_PROG_TEST_RUN command"), but the same type of packets with skb at network header could already be built from lwt xmit hooks, so this fix is more relevant to that commit. Also set the mac header on redirect from LWT_XMIT, as even after this change to __bpf_redirect_no_mac that field is expected to be set, but is not yet in ip_finish_output2. Fixes: 3a0af8fd61f9 ("bpf: BPF for lightweight tunnel infrastructure") Reported-by: syzbot Signed-off-by: Willem de Bruijn Acked-by: Martin KaFai Lau Signed-off-by: Daniel Borkmann net/core/filter.c | 21 +++++++++++---------- net/core/lwt_bpf.c | 1 + 2 files changed, 12 insertions(+), 10 deletions(-) commit df133f3f96257ee29696c0ed8bd198ec801dc810 Author: Michael S. Tsirkin Date: Thu Jan 17 23:20:07 2019 -0500 virtio_net: bulk free tx skbs Use napi_consume_skb() to get bulk free. Note that napi_consume_skb is safe to call in a non-napi context as long as the napi_budget flag is correct. Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang Signed-off-by: David S. Miller drivers/net/virtio_net.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 5d5c303ea095bdd3a2b073075920bf159457069a Merge: 6a0141a0966c 8a644c64a9f1 Author: Linus Torvalds Date: Sun Jan 20 10:33:18 2019 +1200 Merge tag 'mips_fixes_5.0_2' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS fixes from Paul Burton: - Fix IPI handling for Lantiq SoCs, which was broken by changes made back in v4.12. - Enable OF/DT serial support in ath79_defconfig to give us working serial by default. - Fix 64b builds for the Jazz platform. - Set up a struct device for the BCM47xx SoC to allow BCM47xx drivers to perform DMA again following the major DMA mapping changes made in v4.19. - Disable MSI on Cavium Octeon systems when the pcie_disable command line parameter introduced in v3.3 is used, in order to avoid inadvetently accessing PCIe controller registers despite the command line. - Fix a build failure for Cavium Octeon kernels with kexec enabled, introduced in v4.20. - Fix a regression in the behaviour of semctl/shmctl/msgctl IPC syscalls for kernels including n32 support but not o32 support caused by some cleanup in v3.19. * tag 'mips_fixes_5.0_2' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: MIPS: OCTEON: fix kexec support mips: fix n32 compat_ipc_parse_version Disable MSI also when pcie-octeon.pcie_disable on MIPS: BCM47XX: Setup struct device for the SoC MIPS: jazz: fix 64bit build MIPS: ath79: Enable OF serial ports in the default config MIPS: lantiq: Use CP0_LEGACY_COMPARE_IRQ MIPS: lantiq: Fix IPI interrupt handling commit 6a0141a0966cfbd765bff065c3eb61b09a92318e Merge: 26caabbcd7a5 75a080cde08d Author: Linus Torvalds Date: Sun Jan 20 10:28:46 2019 +1200 Merge tag 'devicetree-fixes-for-5.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull Devicetree fix from Rob Herring: "A single build fix for powerpc due to device_node.type removal" * tag 'devicetree-fixes-for-5.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: powerpc: chrp: Use of_node_is_type to access device_type commit 26caabbcd7a5d10577fd59eded2ec1c44466659e Merge: f403d718ebde faa8bd6e12e6 Author: Linus Torvalds Date: Sun Jan 20 10:24:30 2019 +1200 Merge tag 'libnvdimm-fixes-5.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm fixes from Dan Williams: "A crash fix, a build warning fix, a miscellaneous small cleanups. In case anyone is looking for them, there was a regression caught by testing that caused two patches to be dropped from this update. Those patches have been reworked and will soak for another week / re-target 5.0-rc4. - Fix driver initialization crash due to the inability to report an 'error' state for a DIMM's security capability. - Build warning fix for little-endian ARM64 builds - Fix a potential race between the EDAC driver's usage of the NFIT SMBIOS id for a DIMM and the driver shutdown path. - A small collection of one-line benign cleanups for duplicate variable assignments, a duplicate header include and a mis-typed function argument" * tag 'libnvdimm-fixes-5.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: libnvdimm/security: Fix nvdimm_security_state() state request selection acpi/nfit: Remove duplicate set nd_set in acpi_nfit_init_interleave_set() acpi/nfit: Fix race accessing memdev in nfit_get_smbios_id() libnvdimm/dimm: Fix security capability detection for non-Intel NVDIMMs nfit: Mark some functions as __maybe_unused ACPI/nfit: delete the function to_acpi_nfit_desc ACPI/nfit: delete the redundant header file commit f403d718ebde2059de848ae7548392dfb25a13ae Merge: b0efca46b570 4a22fc534f2f Author: Linus Torvalds Date: Sun Jan 20 09:58:52 2019 +1200 Merge tag 'linux-watchdog-5.0-rc-fixes' of git://www.linux-watchdog.org/linux-watchdog Pull watchdog fixes from Wim Van Sebroeck: - mt7621_wdt/rt2880_wdt: Fix compilation problem - tqmx86: Fix a couple IS_ERR() vs NULL bugs * tag 'linux-watchdog-5.0-rc-fixes' of git://www.linux-watchdog.org/linux-watchdog: watchdog: tqmx86: Fix a couple IS_ERR() vs NULL bugs watchdog: mt7621_wdt/rt2880_wdt: Fix compilation problem commit b0efca46b57071e4c281034f04d2b56edf79843d Merge: 4d5f6e0201bc deaa5c96c2f7 Author: Linus Torvalds Date: Sun Jan 20 09:27:38 2019 +1200 Merge tag 'nfs-for-5.0-2' of git://git.linux-nfs.org/projects/anna/linux-nfs Pull NFS client fixes from Anna Schumaker: "These are mostly fixes for SUNRPC bugs, with a single v4.2 copy_file_range() fix mixed in. Stable bugfixes: - Fix TCP receive code on archs with flush_dcache_page() Other bugfixes: - Fix error code in rpcrdma_buffer_create() - Fix a double free in rpcrdma_send_ctxs_create() - Fix kernel BUG at kernel/cred.c:825 - Fix unnecessary retry in nfs42_proc_copy_file_range() - Ensure rq_bytes_sent is reset before request transmission - Ensure we respect the RPCSEC_GSS sequence number limit - Address Kerberos performance/behavior regression" * tag 'nfs-for-5.0-2' of git://git.linux-nfs.org/projects/anna/linux-nfs: SUNRPC: Address Kerberos performance/behavior regression SUNRPC: Ensure we respect the RPCSEC_GSS sequence number limit SUNRPC: Ensure rq_bytes_sent is reset before request transmission NFSv4.2 fix unnecessary retry in nfs4_copy_file_range sunrpc: kernel BUG at kernel/cred.c:825! SUNRPC: Fix TCP receive code on archs with flush_dcache_page() xprtrdma: Double free in rpcrdma_sendctxs_create() xprtrdma: Fix error code in rpcrdma_buffer_create() commit 4d5f6e0201bc568c0758ed3f77a06648ec9fd482 Merge: 0facb892456f 9e8f1c798314 Author: Linus Torvalds Date: Sun Jan 20 09:15:04 2019 +1200 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "A set of 17 fixes. Most of these are minor or trivial. The one fix that may be serious is the isci one: the bug can cause hba parameters to be set from uninitialized memory. I don't think it's exploitable, but you never know" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: cxgb4i: add wait_for_completion() scsi: qla1280: set 64bit coherent mask scsi: ufs: Fix geometry descriptor size scsi: megaraid_sas: Retry reads of outbound_intr_status reg scsi: qedi: Add ep_state for login completion on un-reachable targets scsi: ufs: Fix system suspend status scsi: qla2xxx: Use correct number of vectors for online CPUs scsi: hisi_sas: Set protection parameters prior to adding SCSI host scsi: tcmu: avoid cmd/qfull timers updated whenever a new cmd comes scsi: isci: initialize shost fully before calling scsi_add_host() scsi: lpfc: lpfc_sli: Mark expected switch fall-throughs scsi: smartpqi_init: fix boolean expression in pqi_device_remove_start scsi: core: Synchronize request queue PM status only on successful resume scsi: pm80xx: reduce indentation scsi: qla4xxx: check return code of qla4xxx_copy_from_fwddb_param scsi: megaraid_sas: correct an info message scsi: target/iscsi: fix error msg typo when create lio_qr_cache failed scsi: sd: Fix cache_type_store() commit 0facb892456ff922924e704f78cafcaa7be85e8c Merge: 2339e91d0e66 38197ca176fc Author: Linus Torvalds Date: Sun Jan 20 09:12:50 2019 +1200 Merge tag 'for-linus-20190118' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: - block size setting fixes for loop/nbd (Jan Kara) - md bio_alloc_mddev() cleanup (Marcos) - Ensure we don't lose the REQ_INTEGRITY flag (Ming) - Two NVMe fixes by way of Christoph: - Fix NVMe IRQ calculation (Ming) - Uninitialized variable in nvmet-tcp (Sagi) - BFQ comment fix (Paolo) - License cleanup for recently added blk-mq-debugfs-zoned (Thomas) * tag 'for-linus-20190118' of git://git.kernel.dk/linux-block: block: Cleanup license notice nvme-pci: fix nvme_setup_irqs() nvmet-tcp: fix uninitialized variable access block: don't lose track of REQ_INTEGRITY flag blockdev: Fix livelocks on loop device nbd: Use set_blocksize() to set device blocksize md: Make bio_alloc_mddev use bio_alloc_bioset block, bfq: fix comments on __bfq_deactivate_entity commit 99e309b6ed75fab4a43afd9e523441ecc5a1f511 Author: Jason Gunthorpe Date: Fri Jan 18 22:57:04 2019 +0000 clang-format: Update .clang-format with the latest for_each macro list Re-run the shell fragment that generated the original list. In particular this adds the missing xarray related functions. Signed-off-by: Jason Gunthorpe Signed-off-by: Miguel Ojeda .clang-format | 43 ++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 42 insertions(+), 1 deletion(-) commit 3e64cf7a435ed0500e3adaa8aada2272d3ae8abc Author: Camelia Groza Date: Thu Jan 17 14:22:36 2019 +0200 net: phy: phy driver features are mandatory Since phy driver features became a link_mode bitmap, phy drivers that don't have a list of features configured will cause the kernel to crash when probed. Prevent the phy driver from registering if the features field is missing. Fixes: 719655a14971 ("net: phy: Replace phy driver features u32 with link_mode bitmap") Reported-by: Scott Wood Signed-off-by: Camelia Groza Signed-off-by: David S. Miller drivers/net/phy/phy_device.c | 5 +++++ include/linux/phy.h | 4 ++-- 2 files changed, 7 insertions(+), 2 deletions(-) commit 7afa81c55fca0cad589722cb4bce698b4803b0e1 Author: Nathan Chancellor Date: Wed Jan 9 22:41:08 2019 -0700 isdn: avm: Fix string plus integer warning from Clang A recent commit in Clang expanded the -Wstring-plus-int warning, showing some odd behavior in this file. drivers/isdn/hardware/avm/b1.c:426:30: warning: adding 'int' to a string does not append to the string [-Wstring-plus-int] cinfo->version[j] = "\0\0" + 1; ~~~~~~~^~~ drivers/isdn/hardware/avm/b1.c:426:30: note: use array indexing to silence this warning cinfo->version[j] = "\0\0" + 1; ^ & [ ] 1 warning generated. This is equivalent to just "\0". Nick pointed out that it is smarter to use "" instead of "\0" because "" is used elsewhere in the kernel and can be deduplicated at the linking stage. Link: https://github.com/ClangBuiltLinux/linux/issues/309 Suggested-by: Nick Desaulniers Signed-off-by: Nathan Chancellor Signed-off-by: David S. Miller drivers/isdn/hardware/avm/b1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 75a080cde08d2dcba19ee864f9732094d93fab41 Author: Rob Herring Date: Fri Jan 18 08:12:10 2019 -0600 powerpc: chrp: Use of_node_is_type to access device_type Commit 8ce5f8415753 ("of: Remove struct device_node.type pointer") removed struct device_node.type pointer, but the conversion to use of_node_is_type() accessor was missed in chrp_init_IRQ(). Fixes: 8ce5f8415753 ("of: Remove struct device_node.type pointer") Reported-by: kbuild test robot Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: linuxppc-dev@lists.ozlabs.org Acked-by: Michael Ellerman Signed-off-by: Rob Herring arch/powerpc/platforms/chrp/setup.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit f9d672f1c2ca36b788511bbd773d650c744e109a Author: Wei Yongjun Date: Fri Jan 18 07:29:52 2019 +0000 virt_wifi: fix error return code in virt_wifi_newlink() Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function. Fixes: c7cdba31ed8b ("mac80211-next: rtnetlink wifi simulation device") Signed-off-by: Wei Yongjun Signed-off-by: Johannes Berg drivers/net/wireless/virt_wifi.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit a0dc02039a2ee54fb4ae400e0b755ed30e73e58c Author: Bob Copeland Date: Thu Jan 17 16:32:42 2019 -0500 mac80211: fix miscounting of ttl-dropped frames In ieee80211_rx_h_mesh_fwding, we increment the 'dropped_frames_ttl' counter when we decrement the ttl to zero. For unicast frames destined for other hosts, we stop processing the frame at that point. For multicast frames, we do not rebroadcast it in this case, but we do pass the frame up the stack to process it on this STA. That doesn't match the usual definition of "dropped," so don't count those as such. With this change, something like `ping6 -i0.2 ff02::1%mesh0` from a peer in a ttl=1 network no longer increments the counter rapidly. Signed-off-by: Bob Copeland Signed-off-by: Johannes Berg net/mac80211/rx.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 9c5d3afac436beef91b7a6312068e9360c7d8446 Author: Johannes Berg Date: Tue Jan 15 14:24:23 2019 +0100 mac80211_hwsim: check that n_limits makes sense Under certain circumstances, radios created via netlink could have n_limits be zero and no possible interface types, which makes no sense. Reject this early to prevent a WARN_ON() in cfg80211. Fixes: 99e3a44bac37 ("mac80211_hwsim: allow setting iftype support") Reported-by: syzbot+73fd8b0aa60c67fa4b60@syzkaller.appspotmail.com Signed-off-by: Johannes Berg drivers/net/wireless/mac80211_hwsim.c | 5 +++++ 1 file changed, 5 insertions(+) commit 8a7fa0c35027d1a3ec3c3e8612800a1b4738e3c3 Merge: efa8c819a689 25f2d0e7791e Author: David S. Miller Date: Fri Jan 18 18:23:23 2019 -0800 Merge tag 'mlx5-fixes-2019-01-18' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== Mellanox, mlx5 fixes 2019-01-18 This series introduces some fixes to mlx5 driver. Please pull and let me know if there is any problem. For -stable v4.18 ('net/mlx5e: Force CHECKSUM_UNNECESSARY for short ethernet frames') The patch doesn't apply cleanly to 4.18.y, but it is very simple to resolve, what should be the procedure here ? ==================== Signed-off-by: David S. Miller commit 25f2d0e7791e71cc89c58a7c2231768ad200764b Author: Eli Britstein Date: Wed Dec 19 07:36:51 2018 +0200 net/mlx5e: Fix cb_ident duplicate in indirect block register Previously the identifier used for indirect block callback registry and for block rule cb registry (when done via indirect blocks) was the pointer to the tunnel netdev we were interested in receiving updates on. This worked fine if a single PF existed that registered one callback for the tunnel netdev of interest. However, if multiple PFs are in place then the 2nd PF tries to register with the same tunnel netdev identifier. This leads to EEXIST errors and/or incorrect cb deletions. Prevent this conflict by using the rpriv pointer as the identifier for netdev indirect block cb registry, allowing each PF to register a unique callback per tunnel netdev. For block cb registry, the same PF may register multiple cbs to the same block if using TC shared blocks. Instead of the rpriv, use the pointer to the allocated indr_priv data as the identifier here. This means that there can be a unique block callback for each PF/tunnel netdev combo. Fixes: f5bc2c5de101 ("net/mlx5e: Support TC indirect block notifications for eswitch uplink reprs") Signed-off-by: Eli Britstein Reviewed-by: Oz Shlomo Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 29 +++++++++++++----------- 1 file changed, 16 insertions(+), 13 deletions(-) commit 7fdc1adc52d3975740547a78c2df329bb207f15d Author: Tariq Toukan Date: Thu Nov 8 12:06:53 2018 +0200 net/mlx5e: Fix wrong (zero) TX drop counter indication for representor For representors, the TX dropped counter is not folded from the per-ring counters. Fix it. Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 1 + 1 file changed, 1 insertion(+) commit 2eb1e42551a8128d9182480dfaea52fa861e26e8 Author: Shay Agroskin Date: Sun Dec 9 12:00:13 2018 +0200 net/mlx5e: Fix wrong error code return on FEC query failure Advertised and configured FEC query failure resulted in printing wrong error code. Fixes: 6cfa94605091 ("net/mlx5e: Ethtool driver callback for query/set FEC policy") Signed-off-by: Shay Agroskin Reported-by: Or Gerlitz Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit e8c8b53ccaff568fef4c13a6ccaf08bf241aa01a Author: Cong Wang Date: Mon Dec 3 22:14:04 2018 -0800 net/mlx5e: Force CHECKSUM_UNNECESSARY for short ethernet frames When an ethernet frame is padded to meet the minimum ethernet frame size, the padding octets are not covered by the hardware checksum. Fortunately the padding octets are usually zero's, which don't affect checksum. However, we have a switch which pads non-zero octets, this causes kernel hardware checksum fault repeatedly. Prior to: commit '88078d98d1bb ("net: pskb_trim_rcsum() and CHECKSUM_COMPLETE ...")' skb checksum was forced to be CHECKSUM_NONE when padding is detected. After it, we need to keep skb->csum updated, like what we do for RXFCS. However, fixing up CHECKSUM_COMPLETE requires to verify and parse IP headers, it is not worthy the effort as the packets are so small that CHECKSUM_COMPLETE can't save anything. Fixes: 88078d98d1bb ("net: pskb_trim_rcsum() and CHECKSUM_COMPLETE are friends"), Cc: Eric Dumazet Cc: Tariq Toukan Cc: Nikola Ciprich Signed-off-by: Cong Wang Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit 64cf5481262b9664ae3cdcb333f4a06af3e8fb58 Author: Thomas Gleixner Date: Fri Jan 18 00:14:24 2019 +0100 tools: bpftool: Cleanup license mess Precise and non-ambiguous license information is important. The recent relicensing of the bpftools introduced a license conflict. The files have now: SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause and * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version * 2 of the License, or (at your option) any later version Amazingly about 20 people acked that change and neither they nor the committer noticed. Oh well. Digging deeper: The files were imported from the iproute2 repository with the GPL V2 or later boiler plate text in commit b66e907cfee2 ("tools: bpftool: copy JSON writer from iproute2 repository") Looking at the iproute2 repository at git://git.kernel.org/pub/scm/network/iproute2/iproute2.git the following commit is the equivivalent: commit d9d8c839 ("json_writer: add SPDX Identifier (GPL-2/BSD-2)") That commit explicitly removes the boiler plate and relicenses the code uner GPL-2.0-only and BSD-2-Clause. As Steven wrote the original code and also the relicensing commit, it's assumed that the relicensing was intended to do exaclty that. Just the kernel side update failed to remove the boiler plate. Do so now. Fixes: 907b22365115 ("tools: bpftool: dual license all files") Signed-off-by: Thomas Gleixner Cc: Jakub Kicinski Cc: Roman Gushchin Cc: YueHaibing Cc: Yonghong Song Cc: Stanislav Fomichev Cc: Sean Young Cc: Jiri Benc Cc: David Calavera Cc: Andrey Ignatov Cc: Joe Stringer Cc: David Ahern Cc: Alexei Starovoitov Cc: Petar Penkov Cc: Sandipan Das Cc: Prashant Bhole Cc: Stephen Hemminger Cc: John Fastabend Cc: Taeung Song Cc: Jiri Olsa Cc: Alexei Starovoitov Cc: Daniel Borkmann Cc: Quentin Monnet CC: okash.khawaja@gmail.com Cc: netdev@vger.kernel.org Acked-by: Jakub Kicinski Signed-off-by: Alexei Starovoitov tools/bpf/bpftool/json_writer.c | 7 +------ tools/bpf/bpftool/json_writer.h | 5 ----- 2 files changed, 1 insertion(+), 11 deletions(-) commit 9d5564ddcf2a0f5ba3fa1c3a1f8a1b59ad309553 Author: Daniel Borkmann Date: Thu Jan 17 16:34:45 2019 +0100 bpf: fix inner map masking to prevent oob under speculation During review I noticed that inner meta map setup for map in map is buggy in that it does not propagate all needed data from the reference map which the verifier is later accessing. In particular one such case is index masking to prevent out of bounds access under speculative execution due to missing the map's unpriv_array/index_mask field propagation. Fix this such that the verifier is generating the correct code for inlined lookups in case of unpriviledged use. Before patch (test_verifier's 'map in map access' dump): # bpftool prog dump xla id 3 0: (62) *(u32 *)(r10 -4) = 0 1: (bf) r2 = r10 2: (07) r2 += -4 3: (18) r1 = map[id:4] 5: (07) r1 += 272 | 6: (61) r0 = *(u32 *)(r2 +0) | 7: (35) if r0 >= 0x1 goto pc+6 | Inlined map in map lookup 8: (54) (u32) r0 &= (u32) 0 | with index masking for 9: (67) r0 <<= 3 | map->unpriv_array. 10: (0f) r0 += r1 | 11: (79) r0 = *(u64 *)(r0 +0) | 12: (15) if r0 == 0x0 goto pc+1 | 13: (05) goto pc+1 | 14: (b7) r0 = 0 | 15: (15) if r0 == 0x0 goto pc+11 16: (62) *(u32 *)(r10 -4) = 0 17: (bf) r2 = r10 18: (07) r2 += -4 19: (bf) r1 = r0 20: (07) r1 += 272 | 21: (61) r0 = *(u32 *)(r2 +0) | Index masking missing (!) 22: (35) if r0 >= 0x1 goto pc+3 | for inner map despite 23: (67) r0 <<= 3 | map->unpriv_array set. 24: (0f) r0 += r1 | 25: (05) goto pc+1 | 26: (b7) r0 = 0 | 27: (b7) r0 = 0 28: (95) exit After patch: # bpftool prog dump xla id 1 0: (62) *(u32 *)(r10 -4) = 0 1: (bf) r2 = r10 2: (07) r2 += -4 3: (18) r1 = map[id:2] 5: (07) r1 += 272 | 6: (61) r0 = *(u32 *)(r2 +0) | 7: (35) if r0 >= 0x1 goto pc+6 | Same inlined map in map lookup 8: (54) (u32) r0 &= (u32) 0 | with index masking due to 9: (67) r0 <<= 3 | map->unpriv_array. 10: (0f) r0 += r1 | 11: (79) r0 = *(u64 *)(r0 +0) | 12: (15) if r0 == 0x0 goto pc+1 | 13: (05) goto pc+1 | 14: (b7) r0 = 0 | 15: (15) if r0 == 0x0 goto pc+12 16: (62) *(u32 *)(r10 -4) = 0 17: (bf) r2 = r10 18: (07) r2 += -4 19: (bf) r1 = r0 20: (07) r1 += 272 | 21: (61) r0 = *(u32 *)(r2 +0) | 22: (35) if r0 >= 0x1 goto pc+4 | Now fixed inlined inner map 23: (54) (u32) r0 &= (u32) 0 | lookup with proper index masking 24: (67) r0 <<= 3 | for map->unpriv_array. 25: (0f) r0 += r1 | 26: (05) goto pc+1 | 27: (b7) r0 = 0 | 28: (b7) r0 = 0 29: (95) exit Fixes: b2157399cc98 ("bpf: prevent out-of-bounds speculation") Signed-off-by: Daniel Borkmann Acked-by: Martin KaFai Lau Signed-off-by: Alexei Starovoitov kernel/bpf/map_in_map.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) commit ad6dd7a9c47ba587c0aba57f73737764cd31136f Author: Daniel Borkmann Date: Thu Jan 17 16:15:09 2019 +0100 bpf: pull in pkt_sched.h header for tooling to fix bpftool build Dan reported that bpftool does not compile for him: $ make tools/bpf DESCEND bpf Auto-detecting system features: .. libbfd: [ on ] .. disassembler-four-args: [ OFF ] DESCEND bpftool Auto-detecting system features: .. libbfd: [ on ] .. disassembler-four-args: [ OFF ] CC /opt/linux.git/tools/bpf/bpftool/net.o In file included from /opt/linux.git/tools/include/uapi/linux/pkt_cls.h:6:0, from /opt/linux.git/tools/include/uapi/linux/tc_act/tc_bpf.h:14, from net.c:13: net.c: In function 'show_dev_tc_bpf': net.c:164:21: error: 'TC_H_CLSACT' undeclared (first use in this function) handle = TC_H_MAKE(TC_H_CLSACT, TC_H_MIN_INGRESS); [...] Fix it by importing pkt_sched.h header copy into tooling infrastructure. Fixes: 49a249c38726 ("tools/bpftool: copy a few net uapi headers to tools directory") Fixes: f6f3bac08ff9 ("tools/bpf: bpftool: add net support") Reported-by: Dan Gilson Reference: https://bugzilla.kernel.org/show_bug.cgi?id=202315 Signed-off-by: Daniel Borkmann Acked-by: Martin KaFai Lau Signed-off-by: Alexei Starovoitov tools/include/uapi/linux/pkt_sched.h | 1163 ++++++++++++++++++++++++++++++++++ 1 file changed, 1163 insertions(+) commit efa8c819a6892b03d5535b2ce1d8c85ea9850b58 Merge: 20f5248a502b 479a2b761d61 Author: David S. Miller Date: Fri Jan 18 15:12:16 2019 -0800 Merge branch 'mlxsw-fixes' Ido Schimmel says: ==================== mlxsw: Various fixes This patchset contains small fixes in mlxsw and one fix in the bridge driver. Patches #1-#4 perform small adjustments in PCI and FID code following recent tests that were performed on the Spectrum-2 ASIC. Patch #5 fixes the bridge driver to mark FDB entries that were added by user as such. Otherwise, these entries will be ignored by underlying switch drivers. Patch #6 fixes a long standing issue in mlxsw where the driver incorrectly programmed static FDB entries as both static and sticky. Patches #7-#8 add test cases for above mentioned bugs. Please consider patches #1, #2 and #4 for stable. ==================== Signed-off-by: David S. Miller commit 479a2b761d61c04e2ae97325aa391a8a8c99c23e Author: Ido Schimmel Date: Fri Jan 18 15:58:03 2019 +0000 selftests: forwarding: Add a test case for externally learned FDB entries Test that externally learned FDB entries can roam, but not age out. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller .../selftests/net/forwarding/bridge_vlan_aware.sh | 34 +++++++++++++++++++++- 1 file changed, 33 insertions(+), 1 deletion(-) commit 72159272fc08230a76791dd5d0a0019ede1b802c Author: Ido Schimmel Date: Fri Jan 18 15:58:02 2019 +0000 selftests: mlxsw: Test FDB offload indication Test that externally learned FDB entries added from user space are marked as offloaded. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller .../testing/selftests/drivers/net/mlxsw/rtnetlink.sh | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) commit 64254a2054611205798e6bde634639bc704573ac Author: Ido Schimmel Date: Fri Jan 18 15:58:01 2019 +0000 mlxsw: spectrum_switchdev: Do not treat static FDB entries as sticky The driver currently treats static FDB entries as both static and sticky. This is incorrect and prevents such entries from being roamed to a different port via learning. Fix this by configuring static entries with ageing disabled and roaming enabled. In net-next we can add proper support for the newly introduced 'sticky' flag. Fixes: 56ade8fe3fe1 ("mlxsw: spectrum: Add initial support for Spectrum ASIC") Signed-off-by: Ido Schimmel Reported-by: Alexander Petrovskiy Reviewed-by: Petr Machata Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 710ae72877378e7cde611efd30fe90502a6e5b30 Author: Ido Schimmel Date: Fri Jan 18 15:58:00 2019 +0000 net: bridge: Mark FDB entries that were added by user as such Externally learned entries can be added by a user or by a switch driver that is notifying the bridge driver about entries that were learned in hardware. In the first case, the entries are not marked with the 'added_by_user' flag, which causes switch drivers to ignore them and not offload them. The 'added_by_user' flag can be set on externally learned FDB entries based on the 'swdev_notify' parameter in br_fdb_external_learn_add(), which effectively means if the created / updated FDB entry was added by a user or not. Fixes: 816a3bed9549 ("switchdev: Add fdb.added_by_user to switchdev notifications") Signed-off-by: Ido Schimmel Reported-by: Alexander Petrovskiy Reviewed-by: Petr Machata Cc: Roopa Prabhu Cc: Nikolay Aleksandrov Cc: bridge@lists.linux-foundation.org Signed-off-by: David S. Miller net/bridge/br_fdb.c | 5 +++++ 1 file changed, 5 insertions(+) commit a11dcd6497915ba79d95ef4fe2541aaac27f6201 Author: Nir Dotan Date: Fri Jan 18 15:57:59 2019 +0000 mlxsw: spectrum_fid: Update dummy FID index When using a tc flower action of egress mirred redirect, the driver adds an implicit FID setting action. This implicit action sets a dummy FID to the packet and is used as part of a design for trapping unmatched flows in OVS. While this implicit FID setting action is supposed to be a NOP when a redirect action is added, in Spectrum-2 the FID record is consulted as the dummy FID index is an 802.1D FID index and the packet is dropped instead of being redirected. Set the dummy FID index value to be within 802.1Q range. This satisfies both Spectrum-1 which ignores the FID and Spectrum-2 which identifies it as an 802.1Q FID and will then follow the redirect action. Fixes: c3ab435466d5 ("mlxsw: spectrum: Extend to support Spectrum-2 ASIC") Signed-off-by: Nir Dotan Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 67c14cc9b35055264fc0efed00159a7de1819f1b Author: Nir Dotan Date: Fri Jan 18 15:57:57 2019 +0000 mlxsw: pci: Return error on PCI reset timeout Return an appropriate error in the case when the driver timeouts on waiting for firmware to go out of PCI reset. Fixes: 233fa44bd67a ("mlxsw: pci: Implement reset done check") Signed-off-by: Nir Dotan Acked-by: Jiri Pirko Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/pci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit d2f372ba0914e5722ac28e15f2ed2db61bcf0e44 Author: Nir Dotan Date: Fri Jan 18 15:57:56 2019 +0000 mlxsw: pci: Increase PCI SW reset timeout Spectrum-2 PHY layer introduces a calibration period which is a part of the Spectrum-2 firmware boot process. Hence increase the SW timeout waiting for the firmware to come out of boot. This does not increase system boot time in cases where the firmware PHY calibration process is done quickly. Fixes: c3ab435466d5 ("mlxsw: spectrum: Extend to support Spectrum-2 ASIC") Signed-off-by: Nir Dotan Acked-by: Jiri Pirko Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/pci_hw.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c9ebea04cb1b0a84d08de00f4800f726ca544ad2 Author: Ido Schimmel Date: Fri Jan 18 15:57:55 2019 +0000 mlxsw: pci: Ring CQ's doorbell before RDQ's When a packet should be trapped to the CPU the device consumes a WQE (work queue element) from an RDQ (receive descriptor queue) and copies the packet to the address specified in the WQE. The device then tries to post a CQE (completion queue element) that contains various metadata (e.g., ingress port) about the packet to a CQ (completion queue). In case the device managed to consume a WQE, but did not manage to post the corresponding CQE, it will get stuck. This unlikely situation can be triggered due to the scheme the driver is currently using to process CQEs. The driver will consume up to 512 CQEs at a time and after processing each corresponding WQE it will ring the RDQ's doorbell, letting the device know that a new WQE was posted for it to consume. Only after processing all the CQEs (up to 512), the driver will ring the CQ's doorbell, letting the device know that new ones can be posted. Fix this by having the driver ring the CQ's doorbell for every processed CQE, but before ringing the RDQ's doorbell. This guarantees that whenever we post a new WQE, there is a corresponding CQE available. Copy the currently processed CQE to prevent the device from overwriting it with a new CQE after ringing the doorbell. Note that the driver still arms the CQ only after processing all the pending CQEs, so that interrupts for this CQ will only be delivered after the driver finished its processing. Before commit 8404f6f2e8ed ("mlxsw: pci: Allow to use CQEs of version 1 and version 2") the issue was virtually impossible to trigger since the number of CQEs was twice the number of WQEs and the number of CQEs processed at a time was equal to the number of available WQEs. Fixes: 8404f6f2e8ed ("mlxsw: pci: Allow to use CQEs of version 1 and version 2") Signed-off-by: Ido Schimmel Reported-by: Semion Lisyansky Tested-by: Semion Lisyansky Acked-by: Jiri Pirko Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/pci.c | 12 +++++++----- drivers/net/ethernet/mellanox/mlxsw/pci_hw.h | 1 + 2 files changed, 8 insertions(+), 5 deletions(-) commit 89857a8a5c89a406b967ab2be7bd2ccdbe75e73d Author: Madalin Bucur Date: Fri Dec 21 16:41:42 2018 +0200 soc: fsl: qbman: avoid race in clearing QMan interrupt By clearing all interrupt sources, not only those that already occurred, the existing code may acknowledge by mistake interrupts that occurred after the code checks for them. Signed-off-by: Madalin Bucur Signed-off-by: Roy Pledge Signed-off-by: Li Yang drivers/soc/fsl/qbman/qman.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 37b144df8099465bf8d08296d8b424c77fd9b0ac Merge: 12fee4cd5be2 8208d1708b88 Author: Thomas Gleixner Date: Fri Jan 18 23:32:29 2019 +0100 Merge tag 'irqchip-5.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/urgent Pull irqchip updates from Marc Zyngier - Add missing DT translation call in stm32-exti - Fix uninitialized mutex in the GICv3 MBI support code - Drop useless GPIO includes from the madera driver - Fix PCI Multi-MSI allocation with aliasing devices on GICv3 ITS commit 20f5248a502b6d41746c02c699ec9791a03a4e27 Author: Felix Manlunas Date: Thu Jan 17 18:07:45 2019 +0000 MAINTAINERS: update email addresses of liquidio driver maintainers Update email addresses of liquidio driver maintainers. Also remove a former maintainer. Signed-off-by: Felix Manlunas Acked-by: Derek Chickles Signed-off-by: David S. Miller MAINTAINERS | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit 9437b629518866274d324122066a86ac6500c6b5 Author: Jonathan Neuschäfer Date: Thu Jan 17 18:02:18 2019 +0100 net: Fix typo in NET_FAILOVER help text "also enables" should not be spelled as one word. Fixes: cfc80d9a1163 ("net: Introduce net_failover driver") Signed-off-by: Jonathan Neuschäfer Signed-off-by: David S. Miller drivers/net/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6c57f0458022298e4da1729c67bd33ce41c14e7a Author: Ross Lagerwall Date: Thu Jan 17 15:34:38 2019 +0000 net: Fix usage of pskb_trim_rcsum In certain cases, pskb_trim_rcsum() may change skb pointers. Reinitialize header pointers afterwards to avoid potential use-after-frees. Add a note in the documentation of pskb_trim_rcsum(). Found by KASAN. Signed-off-by: Ross Lagerwall Signed-off-by: David S. Miller drivers/net/ppp/pppoe.c | 1 + include/linux/skbuff.h | 1 + net/bridge/br_netfilter_ipv6.c | 1 + net/bridge/netfilter/nft_reject_bridge.c | 1 + net/ipv4/ip_input.c | 1 + 5 files changed, 5 insertions(+) commit 2339e91d0e6609e17943a0ab3c3c8c4044760c05 Merge: d28f3e721974 240809ef6630 Author: Linus Torvalds Date: Sat Jan 19 07:34:10 2019 +1200 Merge tag 'media/v5.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: - a regression fix at v4l2 core, with affects multi-plane streams - a fix at vim2m driver * tag 'media/v5.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: vim2m: only cancel work if it is for right context media: v4l: ioctl: Validate num_planes for debug messages media: v4l: ioctl: Validate num_planes before using it media: v4l2-ioctl: Clear only per-plane reserved fields commit d28f3e721974378c404f16d17638d9ae5c0db0d2 Merge: 8b4fe58db679 d2fd6e81912a Author: Linus Torvalds Date: Sat Jan 19 07:26:16 2019 +1200 Merge tag 'pci-v5.0-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI fixes from Bjorn Helgaas:: - Fix PCI kconfig menu organization (Rob Herring) - Fix pci_alloc_irq_vectors_affinity() error return to allow "reduce and retry" for drivers using IRQ sets (Ming Lei) - Fix "pci=disable_acs_redir" initdata use-after-free problem (Logan Gunthorpe) * tag 'pci-v5.0-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: PCI: Fix __initdata issue with "pci=disable_acs_redir" parameter PCI/MSI: Return -ENOSPC from pci_alloc_irq_vectors_affinity() PCI: Fix PCI kconfig menu organization commit 8b4fe58db67947b0c7195405ecb041a991580693 Merge: 3cdf680ea14d f29fd331aa05 Author: Linus Torvalds Date: Sat Jan 19 07:23:25 2019 +1200 Merge tag 'i3c/fixes-for-5.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux Pull i3c fixes from Boris Brezillon: - Fix the error check on master->sysclk val in the Cadence driver - Fix reattach implementation in the Designware driver * tag 'i3c/fixes-for-5.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux: i3c: master: dw-i3c-master: fix i3c_attach/reattach i3c: master: Fix an error checking typo in 'cdns_i3c_master_probe()' commit 3cdf680ea14d8bd3460894eaae0a8bd6a048f705 Merge: 6e4673b42e68 d311e0c27b8f Author: Linus Torvalds Date: Sat Jan 19 07:21:43 2019 +1200 Merge tag 'mtd/fixes-for-5.0-rc3' of git://git.infradead.org/linux-mtd Pull mtd fixes from Boris Brezillon: "Raw NAND changes: - jz4740: fix a compilation warning - fsmc: fix a regression introduced by ->select_chip() deprecation - denali: fix a regression introduced by NAND_KEEP_TIMINGS addition" * tag 'mtd/fixes-for-5.0-rc3' of git://git.infradead.org/linux-mtd: mtd: rawnand: denali: get ->setup_data_interface() working again mtd: nand: jz4740: fix '__iomem *' vs. '* __iomem' mtd: rawnand: fsmc: Keep bank enable bit set commit 6e4673b42e68c78e449f3f6bfe64ff615c90d0f0 Merge: c5b709804ed7 7151449fe7fa Author: Linus Torvalds Date: Sat Jan 19 07:17:19 2019 +1200 Merge tag 'regmap-fix-v5.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap fixes from Mark Brown: "The cleanups for the way we handle type information introduced during the merge window revealed that we'd been abusing the irq APIs for a long time, causing breakage for systems. This has a couple of minimal fixes for that which restore the previous behaviour for the time being, we'll fix it properly for v5.1 but that'd be a bit much to do as a bug fix" * tag 'regmap-fix-v5.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap-irq: do not write mask register if mask_base is zero regmap: regmap-irq: silently ignore unsupported type settings commit e40e2a2e78664fa90ea4b9bdf4a84efce2fea9d9 Author: Thomas Petazzoni Date: Wed Jan 16 10:53:58 2019 +0100 net: phy: mdio_bus: add missing device_del() in mdiobus_register() error handling The current code in __mdiobus_register() doesn't properly handle failures returned by the devm_gpiod_get_optional() call: it returns immediately, without unregistering the device that was added by the call to device_register() earlier in the function. This leaves a stale device, which then causes a NULL pointer dereference in the code that handles deferred probing: [ 1.489982] Unable to handle kernel NULL pointer dereference at virtual address 00000074 [ 1.498110] pgd = (ptrval) [ 1.500838] [00000074] *pgd=00000000 [ 1.504432] Internal error: Oops: 17 [#1] SMP ARM [ 1.509133] Modules linked in: [ 1.512192] CPU: 1 PID: 51 Comm: kworker/1:3 Not tainted 4.20.0-00039-g3b73a4cc8b3e-dirty #99 [ 1.520708] Hardware name: Xilinx Zynq Platform [ 1.525261] Workqueue: events deferred_probe_work_func [ 1.530403] PC is at klist_next+0x10/0xfc [ 1.534403] LR is at device_for_each_child+0x40/0x94 [ 1.539361] pc : [] lr : [] psr: 200e0013 [ 1.545628] sp : ceeefe68 ip : 00000001 fp : ffffe000 [ 1.550863] r10: 00000000 r9 : c0c66790 r8 : 00000000 [ 1.556079] r7 : c0457d44 r6 : 00000000 r5 : ceeefe8c r4 : cfa2ec78 [ 1.562604] r3 : 00000064 r2 : c0457d44 r1 : ceeefe8c r0 : 00000064 [ 1.569129] Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none [ 1.576263] Control: 18c5387d Table: 0ed7804a DAC: 00000051 [ 1.582013] Process kworker/1:3 (pid: 51, stack limit = 0x(ptrval)) [ 1.588280] Stack: (0xceeefe68 to 0xceef0000) [ 1.592630] fe60: cfa2ec78 c0c03c08 00000000 c0457d44 00000000 c0c66790 [ 1.600814] fe80: 00000000 c0455d90 ceeefeac 00000064 00000000 0d7a542e cee9d494 cfa2ec78 [ 1.608998] fea0: cfa2ec78 00000000 c0457d44 c0457d7c cee9d494 c0c03c08 00000000 c0455dac [ 1.617182] fec0: cf98ba44 cf926a00 cee9d494 0d7a542e 00000000 cf935a10 cf935a10 cf935a10 [ 1.625366] fee0: c0c4e9b8 c0457d7c c0c4e80c 00000001 cf935a10 c0457df4 cf935a10 c0c4e99c [ 1.633550] ff00: c0c4e99c c045a27c c0c4e9c4 ced63f80 cfde8a80 cfdebc00 00000000 c013893c [ 1.641734] ff20: cfde8a80 cfde8a80 c07bd354 ced63f80 ced63f94 cfde8a80 00000008 c0c02d00 [ 1.649936] ff40: cfde8a98 cfde8a80 ffffe000 c0139a30 ffffe000 c0c6624a c07bd354 00000000 [ 1.658120] ff60: ffffe000 cee9e780 ceebfe00 00000000 ceeee000 ced63f80 c0139788 cf8cdea4 [ 1.666304] ff80: cee9e79c c013e598 00000001 ceebfe00 c013e44c 00000000 00000000 00000000 [ 1.674488] ffa0: 00000000 00000000 00000000 c01010e8 00000000 00000000 00000000 00000000 [ 1.682671] ffc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 1.690855] ffe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000 [ 1.699058] [] (klist_next) from [] (device_for_each_child+0x40/0x94) [ 1.707241] [] (device_for_each_child) from [] (device_reorder_to_tail+0x38/0x88) [ 1.716476] [] (device_reorder_to_tail) from [] (device_for_each_child+0x5c/0x94) [ 1.725692] [] (device_for_each_child) from [] (device_reorder_to_tail+0x38/0x88) [ 1.734927] [] (device_reorder_to_tail) from [] (device_pm_move_to_tail+0x28/0x40) [ 1.744235] [] (device_pm_move_to_tail) from [] (deferred_probe_work_func+0x58/0x8c) [ 1.753746] [] (deferred_probe_work_func) from [] (process_one_work+0x210/0x4fc) [ 1.762888] [] (process_one_work) from [] (worker_thread+0x2a8/0x5c0) [ 1.771072] [] (worker_thread) from [] (kthread+0x14c/0x154) [ 1.778482] [] (kthread) from [] (ret_from_fork+0x14/0x2c) [ 1.785689] Exception stack(0xceeeffb0 to 0xceeefff8) [ 1.790739] ffa0: 00000000 00000000 00000000 00000000 [ 1.798923] ffc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 1.807107] ffe0: 00000000 00000000 00000000 00000000 00000013 00000000 [ 1.813724] Code: e92d47f0 e1a05000 e8900048 e1a00003 (e5937010) [ 1.819844] ---[ end trace 3c2c0c8b65399ec9 ]--- The actual error that we had from devm_gpiod_get_optional() was -EPROBE_DEFER, due to the GPIO being provided by a driver that is probed later than the Ethernet controller driver. To fix this, we simply add the missing device_del() invocation in the error path. Fixes: 69226896ad636 ("mdio_bus: Issue GPIO RESET to PHYs") Signed-off-by: Thomas Petazzoni Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/phy/mdio_bus.c | 1 + 1 file changed, 1 insertion(+) commit 0e78f389a7cdc6de7dfd0778733f3b140c981c9e Author: Otto Sabart Date: Mon Jan 14 12:56:36 2019 +0100 doc: net: fix bad references to network drivers Fix "reference to nonexisting document" warnings. Fixes: b255e500c8dc ("net: documentation: build a directory structure for drivers") Signed-off-by: Otto Sabart Signed-off-by: David S. Miller Documentation/networking/index.rst | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) commit c5b709804ed7d36c45b5efa170d9e3ea8c29b865 Merge: e6ec2fda2d46 7bea7ac0ca01 Author: Linus Torvalds Date: Sat Jan 19 05:55:42 2019 +1200 Merge tag 'powerpc-5.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: "A couple of weeks of fixes. There's one fix for an oops on Power9 machines with Open CAPI adapters. And a fix for probable memory corruption in some of the new NPU code, caught by smatch though and not seen in the wild. Plus a few other minor fixes. There's one non-fix which is the perf_regs change. That was sent during the merge window but I accidentally only merged the first of two patches in the series. It's been in linux-next so hopefully doesn't conflict with anything in acme's tree. Thanks to: Alexey Kardashevskiy, Andrew Donnellan, Breno Leitao, Christian Lamparter, Christophe Leroy, Dan Carpenter, Frederic Barrat, Greg Kurz, Jason A. Donenfeld, Madhavan Srinivasan" * tag 'powerpc-5.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/syscalls: Fix syscall tracing powerpc/pseries: Fix build break due to pnv_npu2_init() powerpc/4xx/ocm: Fix fix for phys_addr_t printf warnings powerpc/powernv/npu: Fix oops in pnv_try_setup_npu_table_group() powerpc/tm: Limit TM code inside PPC_TRANSACTIONAL_MEM powerpc/8xx: fix setting of pagetable for Abatron BDI debug tool. powerpc/powernv/npu: Allocate enough memory in pnv_try_setup_npu_table_group() powerpc/perf: Update perf_regs structure to include MMCRA commit e6ec2fda2d464938989ecd770be92e492ace3ae1 Merge: dc6fef2cc579 867cefb4cb10 Author: Linus Torvalds Date: Sat Jan 19 05:53:41 2019 +1200 Merge tag 'for-linus-5.0-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: - Several fixes for the Xen pvcalls drivers (1 fix for the backend and 8 for the frontend). - A fix for a rather longstanding bug in the Xen sched_clock() interface which led to weird time jumps when migrating the system. - A fix for avoiding accesses to x2apic MSRs in Xen PV guests. * tag 'for-linus-5.0-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen: Fix x86 sched_clock() interface for xen pvcalls-front: fix potential null dereference always clear the X2APIC_ENABLE bit for PV guest pvcalls-front: Avoid get_free_pages(GFP_KERNEL) under spinlock xen/pvcalls: remove set but not used variable 'intf' pvcalls-back: set -ENOTCONN in pvcalls_conn_back_read pvcalls-front: don't return error when the ring is full pvcalls-front: properly allocate sk pvcalls-front: don't try to free unallocated rings pvcalls-front: read all data before closing the connection commit dc6fef2cc57972d4d64d9cd6d26b81060e1db0e6 Merge: 6e434bf2e36b d45a90cb5d06 Author: Linus Torvalds Date: Sat Jan 19 05:48:43 2019 +1200 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: "This fixes the following issues: - Zero-length DMA mapping in caam - Invalidly mapping stack memory for DMA in talitos - Use after free in cavium/nitrox - Key parsing in authenc - Undefined shift in sm3 - Bogus completion call in authencesn - SHA support detection in caam" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: sm3 - fix undefined shift by >= width of value crypto: talitos - fix ablkcipher for CONFIG_VMAP_STACK crypto: talitos - reorder code in talitos_edesc_alloc() crypto: adiantum - initialize crypto_spawn::inst crypto: cavium/nitrox - Use after free in process_response_list() crypto: authencesn - Avoid twice completion call in decrypt path crypto: caam - fix SHA support detection crypto: caam - fix zero-length buffer DMA mapping crypto: ccree - convert to use crypto_authenc_extractkeys() crypto: bcm - convert to use crypto_authenc_extractkeys() crypto: authenc - fix parsing key with misaligned rta_len commit 6e434bf2e36b8a111c4dea6c1d1e355ad39ec01b Merge: 2a8cbf2a0278 11ee2a3808ae Author: Linus Torvalds Date: Sat Jan 19 05:46:00 2019 +1200 Merge tag 'acpi-5.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "These fix an ACPI initialization ordering issue introduced in the 4.17 time frame and causing functional problems to appear on multiple systems and fix some fallout of the recent change to enable building kernels with ACPI support and without PCI. Specifics: - Restore the ACPI initialization ordering changed implicitly by the module-level AML handling rework during the 4.17 development cycle that caused the EC address space handler based on information from ECDT to be set up before loading AML definition blocks, making it effectively not accessible by AML on some systems that don't work as expected any more (Rafael Wysocki). - Add direct dependencies on PCI to Kconfig in multiple places for code that depends on both ACPI and PCI, but the PCI dependency was implicitly satisfied by the ACPI dependency before, to prevent invalid configurations from being created, for example by randconfig (Sinan Kaya)" * tag 'acpi-5.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: EC: Look for ECDT EC after calling acpi_load_tables() drivers: thermal: int340x_thermal: Make PCI dependency explicit x86/intel/lpss: Make PCI dependency explicit platform/x86: apple-gmux: Make PCI dependency explicit platform/x86: intel_pmc: Make PCI dependency explicit platform/x86: intel_ips: make PCI dependency explicit vga-switcheroo: make PCI dependency explicit ata: pata_acpi: Make PCI dependency explicit ACPI / LPSS: Make PCI dependency explicit commit 2a8cbf2a02784efc02f7093000010e20c4ebc9ea Merge: c3653ebdf893 890d14d2d4b5 Author: Linus Torvalds Date: Sat Jan 19 05:43:05 2019 +1200 Merge tag 'fbdev-v5.0-rc3' of git://github.com/bzolnier/linux Pull fbdev fixes from Bartlomiej Zolnierkiewicz: - fix stack memory leak in omap2fb driver (Vlad Tsyrklevich) - fix OF node name handling v4.20 regression in offb driver (Rob Herring) - convert CONFIG_FB_LOGO_CENTER config option added in v5.0-rc1 into a kernel parameter (Peter Rosin) * tag 'fbdev-v5.0-rc3' of git://github.com/bzolnier/linux: fbdev: fbmem: convert CONFIG_FB_LOGO_CENTER into a cmd line option fbdev: offb: Fix OF node name handling omap2fb: Fix stack memory disclosure commit c3653ebdf89315a3a683f03b8b181942e452d603 Merge: d7393226d15a 9420151d88ca Author: Linus Torvalds Date: Sat Jan 19 05:41:38 2019 +1200 Merge tag 'drm-fixes-2019-01-18-1' of git://anongit.freedesktop.org/drm/drm Pull drm update from Dave Airlie: "Add nouveau TU102 (RTX 2080 Ti) support" * tag 'drm-fixes-2019-01-18-1' of git://anongit.freedesktop.org/drm/drm: drm/nouveau/core: recognise TU102 commit fd340d0f68cc87badfc9efcb226f23a5428826a0 Author: Josef Bacik Date: Fri Jan 11 10:21:02 2019 -0500 btrfs: wakeup cleaner thread when adding delayed iput The cleaner thread usually takes care of delayed iputs, with the exception of the btrfs_end_transaction_throttle path. Delaying iputs means we are potentially delaying the eviction of an inode and it's respective space. The cleaner thread only gets woken up every 30 seconds, or when we require space. If there are a lot of inodes that need to be deleted we could induce a serious amount of latency while we wait for these inodes to be evicted. So instead wakeup the cleaner if it's not already awake to process any new delayed iputs we add to the list. If we suddenly need space we will less likely be backed up behind a bunch of inodes that are waiting to be deleted, and we could possibly free space before we need to get into the flushing logic which will save us some latency. Reviewed-by: Filipe Manana Signed-off-by: Josef Bacik Signed-off-by: David Sterba fs/btrfs/ctree.h | 3 +++ fs/btrfs/disk-io.c | 3 +++ fs/btrfs/inode.c | 2 ++ 3 files changed, 8 insertions(+) commit 3ec9a4c81c8cc2a8d9673588dd84d9cc7c31019b Author: Josef Bacik Date: Fri Jan 11 10:21:01 2019 -0500 btrfs: run delayed iputs before committing Delayed iputs means we can have final iputs of deleted inodes in the queue, which could potentially generate a lot of pinned space that could be free'd. So before we decide to commit the transaction for ENOPSC reasons, run the delayed iputs so that any potential space is free'd up. If there is and we freed enough we can then commit the transaction and potentially be able to make our reservation. Reviewed-by: Omar Sandoval Signed-off-by: Josef Bacik Signed-off-by: David Sterba fs/btrfs/extent-tree.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit 74d5d229b1bf60f93bff244b2dfc0eb21ec32a07 Author: Josef Bacik Date: Wed Nov 21 14:05:45 2018 -0500 btrfs: wait on ordered extents on abort cleanup If we flip read-only before we initiate writeback on all dirty pages for ordered extents we've created then we'll have ordered extents left over on umount, which results in all sorts of bad things happening. Fix this by making sure we wait on ordered extents if we have to do the aborted transaction cleanup stuff. generic/475 can produce this warning: [ 8531.177332] WARNING: CPU: 2 PID: 11997 at fs/btrfs/disk-io.c:3856 btrfs_free_fs_root+0x95/0xa0 [btrfs] [ 8531.183282] CPU: 2 PID: 11997 Comm: umount Tainted: G W 5.0.0-rc1-default+ #394 [ 8531.185164] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),BIOS rel-1.11.2-0-gf9626cc-prebuilt.qemu-project.org 04/01/2014 [ 8531.187851] RIP: 0010:btrfs_free_fs_root+0x95/0xa0 [btrfs] [ 8531.193082] RSP: 0018:ffffb1ab86163d98 EFLAGS: 00010286 [ 8531.194198] RAX: ffff9f3449494d18 RBX: ffff9f34a2695000 RCX:0000000000000000 [ 8531.195629] RDX: 0000000000000002 RSI: 0000000000000001 RDI:0000000000000000 [ 8531.197315] RBP: ffff9f344e930000 R08: 0000000000000001 R09:0000000000000000 [ 8531.199095] R10: 0000000000000000 R11: ffff9f34494d4ff8 R12:ffffb1ab86163dc0 [ 8531.200870] R13: ffff9f344e9300b0 R14: ffffb1ab86163db8 R15:0000000000000000 [ 8531.202707] FS: 00007fc68e949fc0(0000) GS:ffff9f34bd800000(0000)knlGS:0000000000000000 [ 8531.204851] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8531.205942] CR2: 00007ffde8114dd8 CR3: 000000002dfbd000 CR4:00000000000006e0 [ 8531.207516] Call Trace: [ 8531.208175] btrfs_free_fs_roots+0xdb/0x170 [btrfs] [ 8531.210209] ? wait_for_completion+0x5b/0x190 [ 8531.211303] close_ctree+0x157/0x350 [btrfs] [ 8531.212412] generic_shutdown_super+0x64/0x100 [ 8531.213485] kill_anon_super+0x14/0x30 [ 8531.214430] btrfs_kill_super+0x12/0xa0 [btrfs] [ 8531.215539] deactivate_locked_super+0x29/0x60 [ 8531.216633] cleanup_mnt+0x3b/0x70 [ 8531.217497] task_work_run+0x98/0xc0 [ 8531.218397] exit_to_usermode_loop+0x83/0x90 [ 8531.219324] do_syscall_64+0x15b/0x180 [ 8531.220192] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 8531.221286] RIP: 0033:0x7fc68e5e4d07 [ 8531.225621] RSP: 002b:00007ffde8116608 EFLAGS: 00000246 ORIG_RAX:00000000000000a6 [ 8531.227512] RAX: 0000000000000000 RBX: 00005580c2175970 RCX:00007fc68e5e4d07 [ 8531.229098] RDX: 0000000000000001 RSI: 0000000000000000 RDI:00005580c2175b80 [ 8531.230730] RBP: 0000000000000000 R08: 00005580c2175ba0 R09:00007ffde8114e80 [ 8531.232269] R10: 0000000000000000 R11: 0000000000000246 R12:00005580c2175b80 [ 8531.233839] R13: 00007fc68eac61c4 R14: 00005580c2175a68 R15:0000000000000000 Leaving a tree in the rb-tree: 3853 void btrfs_free_fs_root(struct btrfs_root *root) 3854 { 3855 iput(root->ino_cache_inode); 3856 WARN_ON(!RB_EMPTY_ROOT(&root->inode_tree)); CC: stable@vger.kernel.org Reviewed-by: Nikolay Borisov Signed-off-by: Josef Bacik [ add stacktrace ] Signed-off-by: David Sterba fs/btrfs/disk-io.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 31890da0bfdd24b135a258404b93c58a65510c7a Author: Josef Bacik Date: Wed Nov 21 14:05:41 2018 -0500 btrfs: handle delayed ref head accounting cleanup in abort We weren't doing any of the accounting cleanup when we aborted transactions. Fix this by making cleanup_ref_head_accounting global and calling it from the abort code, this fixes the issue where our accounting was all wrong after the fs aborts. The test generic/475 on a 2G VM can trigger the problems eg.: [ 8502.136957] WARNING: CPU: 0 PID: 11064 at fs/btrfs/extent-tree.c:5986 btrfs_free_block_grou +ps+0x3dc/0x410 [btrfs] [ 8502.148372] CPU: 0 PID: 11064 Comm: umount Not tainted 5.0.0-rc1-default+ #394 [ 8502.150807] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.2-0-gf9626 +cc-prebuilt.qemu-project.org 04/01/2014 [ 8502.154317] RIP: 0010:btrfs_free_block_groups+0x3dc/0x410 [btrfs] [ 8502.160623] RSP: 0018:ffffb1ab84b93de8 EFLAGS: 00010206 [ 8502.161906] RAX: 0000000001000000 RBX: ffff9f34b1756400 RCX: 0000000000000000 [ 8502.163448] RDX: 0000000000000002 RSI: 0000000000000001 RDI: ffff9f34b1755400 [ 8502.164906] RBP: ffff9f34b7e8c000 R08: 0000000000000001 R09: 0000000000000000 [ 8502.166716] R10: 0000000000000000 R11: 0000000000000001 R12: ffff9f34b7e8c108 [ 8502.168498] R13: ffff9f34b7e8c158 R14: 0000000000000000 R15: dead000000000100 [ 8502.170296] FS: 00007fb1cf15ffc0(0000) GS:ffff9f34bd400000(0000) knlGS:0000000000000000 [ 8502.172439] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8502.173669] CR2: 00007fb1ced507b0 CR3: 000000002f7a6000 CR4: 00000000000006f0 [ 8502.175094] Call Trace: [ 8502.175759] close_ctree+0x17f/0x350 [btrfs] [ 8502.176721] generic_shutdown_super+0x64/0x100 [ 8502.177702] kill_anon_super+0x14/0x30 [ 8502.178607] btrfs_kill_super+0x12/0xa0 [btrfs] [ 8502.179602] deactivate_locked_super+0x29/0x60 [ 8502.180595] cleanup_mnt+0x3b/0x70 [ 8502.181406] task_work_run+0x98/0xc0 [ 8502.182255] exit_to_usermode_loop+0x83/0x90 [ 8502.183113] do_syscall_64+0x15b/0x180 [ 8502.183919] entry_SYSCALL_64_after_hwframe+0x49/0xbe Corresponding to release_global_block_rsv() { ... WARN_ON(fs_info->delayed_refs_rsv.reserved > 0); CC: stable@vger.kernel.org Signed-off-by: Josef Bacik [ add log dump ] Signed-off-by: David Sterba fs/btrfs/ctree.h | 4 ++++ fs/btrfs/disk-io.c | 1 + fs/btrfs/extent-tree.c | 12 +++++------- 3 files changed, 10 insertions(+), 7 deletions(-) commit 77b7aad195099e7c6da11e94b7fa6ef5e6fb0025 Author: David Sterba Date: Wed Jan 9 15:02:23 2019 +0100 Revert "btrfs: balance dirty metadata pages in btrfs_finish_ordered_io" This reverts commit e73e81b6d0114d4a303205a952ab2e87c44bd279. This patch causes a few problems: - adds latency to btrfs_finish_ordered_io - as btrfs_finish_ordered_io is used for free space cache, generating more work from btrfs_btree_balance_dirty_nodelay could end up in the same workque, effectively deadlocking 12260 kworker/u96:16+btrfs-freespace-write D [<0>] balance_dirty_pages+0x6e6/0x7ad [<0>] balance_dirty_pages_ratelimited+0x6bb/0xa90 [<0>] btrfs_finish_ordered_io+0x3da/0x770 [<0>] normal_work_helper+0x1c5/0x5a0 [<0>] process_one_work+0x1ee/0x5a0 [<0>] worker_thread+0x46/0x3d0 [<0>] kthread+0xf5/0x130 [<0>] ret_from_fork+0x24/0x30 [<0>] 0xffffffffffffffff Transaction commit will wait on the freespace cache: 838 btrfs-transacti D [<0>] btrfs_start_ordered_extent+0x154/0x1e0 [<0>] btrfs_wait_ordered_range+0xbd/0x110 [<0>] __btrfs_wait_cache_io+0x49/0x1a0 [<0>] btrfs_write_dirty_block_groups+0x10b/0x3b0 [<0>] commit_cowonly_roots+0x215/0x2b0 [<0>] btrfs_commit_transaction+0x37e/0x910 [<0>] transaction_kthread+0x14d/0x180 [<0>] kthread+0xf5/0x130 [<0>] ret_from_fork+0x24/0x30 [<0>] 0xffffffffffffffff And then writepages ends up waiting on transaction commit: 9520 kworker/u96:13+flush-btrfs-1 D [<0>] wait_current_trans+0xac/0xe0 [<0>] start_transaction+0x21b/0x4b0 [<0>] cow_file_range_inline+0x10b/0x6b0 [<0>] cow_file_range.isra.69+0x329/0x4a0 [<0>] run_delalloc_range+0x105/0x3c0 [<0>] writepage_delalloc+0x119/0x180 [<0>] __extent_writepage+0x10c/0x390 [<0>] extent_write_cache_pages+0x26f/0x3d0 [<0>] extent_writepages+0x4f/0x80 [<0>] do_writepages+0x17/0x60 [<0>] __writeback_single_inode+0x59/0x690 [<0>] writeback_sb_inodes+0x291/0x4e0 [<0>] __writeback_inodes_wb+0x87/0xb0 [<0>] wb_writeback+0x3bb/0x500 [<0>] wb_workfn+0x40d/0x610 [<0>] process_one_work+0x1ee/0x5a0 [<0>] worker_thread+0x1e0/0x3d0 [<0>] kthread+0xf5/0x130 [<0>] ret_from_fork+0x24/0x30 [<0>] 0xffffffffffffffff Eventually, we have every process in the system waiting on balance_dirty_pages(), and nobody is able to make progress on page writeback. The original patch tried to fix an OOM condition, that happened on 4.4 but no success reproducing that on later kernels (4.19 and 4.20). This is more likely a problem in OOM itself. Link: https://lore.kernel.org/linux-btrfs/20180528054821.9092-1-ethanlien@synology.com/ Reported-by: Chris Mason CC: stable@vger.kernel.org # 4.18+ CC: ethanlien Signed-off-by: David Sterba fs/btrfs/inode.c | 3 --- 1 file changed, 3 deletions(-) commit d8e346eb30372233063236edeb7600b92c92b287 Author: Anders Roxell Date: Fri Jan 11 13:25:25 2019 +0100 misc: pvpanic: fix warning implicit declaration When building and have fragment CONFIG_NO_IOPORT_MAP enabled then the following warning: ../drivers/misc/pvpanic.c: In function ‘pvpanic_walk_resources’: ../drivers/misc/pvpanic.c:73:10: error: implicit declaration of function ‘ioport_map’; did you mean ‘ioremap’? [-Werror=implicit-function-declaration] base = ioport_map(r.start, resource_size(&r)); ^~~~~~~~~~ Since commmit 5d32a66541c4 ("PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set"), its now possible to have ACPI enabled without haveing PCI enabled. However, the pvpanic driver depends on HAS_IOPORT_MAP or HAVE_IOREMAP_PROT when ACPI is enabled. It was fine until commit 725eba2928ad ("misc/pvpanic: add MMIO support") got added. Rework so that we do a extra check ifdef CONFIG_HAS_IOPORT_MAP. Fixes: 5d32a66541c4 ("PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set") Suggested-by: Arnd Bergmann Signed-off-by: Anders Roxell Signed-off-by: Greg Kroah-Hartman drivers/misc/pvpanic.c | 4 ++++ 1 file changed, 4 insertions(+) commit 701956d4018e5d5438570e39e8bda47edd32c489 Author: Gustavo A. R. Silva Date: Wed Jan 9 13:02:36 2019 -0600 char/mwave: fix potential Spectre v1 vulnerability ipcnum is indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. This issue was detected with the help of Smatch: drivers/char/mwave/mwavedd.c:299 mwave_ioctl() warn: potential spectre issue 'pDrvData->IPCs' [w] (local cap) Fix this by sanitizing ipcnum before using it to index pDrvData->IPCs. Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 Cc: stable@vger.kernel.org Signed-off-by: Gustavo A. R. Silva Signed-off-by: Greg Kroah-Hartman drivers/char/mwave/mwavedd.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 0ce23d6d42147a692768e6baaaa3db75c44f4235 Author: Russell King Date: Thu Jan 17 17:32:05 2019 +0000 ASoC: hdmi-codec: fix oops on re-probe hdmi-codec oopses the kernel when it is unbound from a successfully bound audio subsystem, and is then rebound: Unable to handle kernel NULL pointer dereference at virtual address 0000001c pgd = ee3f0000 [0000001c] *pgd=3cc59831 Internal error: Oops: 817 [#1] PREEMPT ARM Modules linked in: ext2 snd_soc_spdif_tx vmeta dove_thermal snd_soc_kirkwood ofpart marvell_cesa m25p80 orion_wdt mtd spi_nor des_generic gpio_ir_recv snd_soc_kirkwood_spdif bmm_dmabuf auth_rpcgss nfsd autofs4 etnaviv thermal_sys hwmon gpu_sched tda9950 CPU: 0 PID: 1005 Comm: bash Not tainted 4.20.0+ #1762 Hardware name: Marvell Dove (Cubox) PC is at hdmi_dai_probe+0x68/0x80 LR is at find_held_lock+0x20/0x94 pc : [] lr : [] psr: 600f0013 sp : ee15bd28 ip : eebd8b1c fp : c093b488 r10: ee048000 r9 : eebdab18 r8 : ee048600 r7 : 00000001 r6 : 00000000 r5 : 00000000 r4 : ee82c100 r3 : 00000006 r2 : 00000001 r1 : c067e38c r0 : ee82c100 Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none[ 297.318599] Control: 10c5387d Table: 2e3f0019 DAC: 00000051 Process bash (pid: 1005, stack limit = 0xee15a248) ... [] (hdmi_dai_probe) from [] (soc_probe_dai.part.9+0x34/0x70) [] (soc_probe_dai.part.9) from [] (snd_soc_instantiate_card+0x734/0xc9c) [] (snd_soc_instantiate_card) from [] (snd_soc_add_component+0x29c/0x378) [] (snd_soc_add_component) from [] (snd_soc_register_component+0x44/0x54) [] (snd_soc_register_component) from [] (devm_snd_soc_register_component+0x48/0x84) [] (devm_snd_soc_register_component) from [] (hdmi_codec_probe+0x150/0x260) [] (hdmi_codec_probe) from [] (platform_drv_probe+0x48/0x98) This happens because hdmi_dai_probe() attempts to access the HDMI codec private data, but this has not been assigned by hdmi_dai_probe() before it calls devm_snd_soc_register_component(). Move the call to dev_set_drvdata() before devm_snd_soc_register_component() to avoid this oops. Signed-off-by: Russell King Signed-off-by: Mark Brown Cc: stable@vger.kernel.org sound/soc/codecs/hdmi-codec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 94ec1eb711db69be1414b56b3160b816e86a5c5b Author: Arnaldo Carvalho de Melo Date: Fri Jan 18 11:34:15 2019 -0300 perf python: Remove -fstack-clash-protection when building with some clang versions These options are not present in some (all?) clang versions, so when we build for a distro that has a gcc new enough to have these options and that the distro python build config settings use them but clang doesn't support, b00m. This is the case with fedora rawhide (now gearing towards f30), so check if clang has the and remove the missing ones from CFLAGS. Cc: Eduardo Habkost Cc: Thiago Macieira Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-5q50q9w458yawgxf9ez54jbp@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/setup.py | 2 ++ 1 file changed, 2 insertions(+) commit 8208d1708b88b412ca97f50a6d951242c88cbbac Author: Marc Zyngier Date: Fri Jan 18 14:08:59 2019 +0000 irqchip/gic-v3-its: Align PCI Multi-MSI allocation on their size The way we allocate events works fine in most cases, except when multiple PCI devices share an ITS-visible DevID, and that one of them is trying to use MultiMSI allocation. In that case, our allocation is not guaranteed to be zero-based anymore, and we have to make sure we allocate it on a boundary that is compatible with the PCI Multi-MSI constraints. Fix this by allocating the full region upfront instead of iterating over the number of MSIs. MSI-X are always allocated one by one, so this shouldn't change anything on that front. Fixes: b48ac83d6bbc2 ("irqchip: GICv3: ITS: MSI support") Cc: stable@vger.kernel.org Reported-by: Ard Biesheuvel Tested-by: Ard Biesheuvel Signed-off-by: Marc Zyngier drivers/irqchip/irq-gic-v3-its.c | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) commit b3c4014c2b25856b9aeaf0792df330e417a8bd7b Merge: 687ae9e287b3 4cb79ef9c6c4 Author: Takashi Iwai Date: Fri Jan 18 15:17:17 2019 +0100 Merge tag 'asoc-fix-v5.0-rc2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v5.0 Quite a big batch of fixes here. There's a couple of things going on, the main one is that we found some issues with not deferring probe when we should, causing us to skip some driver initialization. The fixes for this then in turn exposed some issues with how we were searching for components which had previously gone unnoticed due to the original issue. There's also been the normal driver specific stuff and there's been what looks like several batches of automated scanning for issues which have generated quite a large set of smaller fixes for potential crashes and missed error handling. commit 1a51c5da5acc6c188c917ba572eebac5f8793432 Author: Stephane Eranian Date: Thu Jan 10 17:17:16 2019 -0800 perf core: Fix perf_proc_update_handler() bug The perf_proc_update_handler() handles /proc/sys/kernel/perf_event_max_sample_rate syctl variable. When the PMU IRQ handler timing monitoring is disabled, i.e, when /proc/sys/kernel/perf_cpu_time_max_percent is equal to 0 or 100, then no modification to sysctl_perf_event_sample_rate is allowed to prevent possible hang from wrong values. The problem is that the test to prevent modification is made after the sysctl variable is modified in perf_proc_update_handler(). You get an error: $ echo 10001 >/proc/sys/kernel/perf_event_max_sample_rate echo: write error: invalid argument But the value is still modified causing all sorts of inconsistencies: $ cat /proc/sys/kernel/perf_event_max_sample_rate 10001 This patch fixes the problem by moving the parsing of the value after the test. Committer testing: # echo 100 > /proc/sys/kernel/perf_cpu_time_max_percent # echo 10001 > /proc/sys/kernel/perf_event_max_sample_rate -bash: echo: write error: Invalid argument # cat /proc/sys/kernel/perf_event_max_sample_rate 10001 # Signed-off-by: Stephane Eranian Reviewed-by: Andi Kleen Reviewed-by: Jiri Olsa Tested-by: Arnaldo Carvalho de Melo Cc: Kan Liang Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/1547169436-6266-1-git-send-email-eranian@google.com Signed-off-by: Arnaldo Carvalho de Melo kernel/events/core.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit e25df7812c91f62581301f9a7ac102acf92e4937 Author: Gustavo A. R. Silva Date: Wed Jan 16 10:46:16 2019 -0600 misc: ibmvsm: Fix potential NULL pointer dereference There is a potential NULL pointer dereference in case kzalloc() fails and returns NULL. Fix this by adding a NULL check on *session* Also, update the function header with information about the expected return on failure and remove unnecessary variable rc. This issue was detected with the help of Coccinelle. Fixes: 0eca353e7ae7 ("misc: IBM Virtual Management Channel Driver (VMC)") Cc: stable@vger.kernel.org Signed-off-by: Gustavo A. R. Silva Signed-off-by: Greg Kroah-Hartman drivers/misc/ibmvmc.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 7e7ca7744a539f1a172e3b81c29d000787e3d774 Author: Wei Yongjun Date: Wed Jan 16 10:42:59 2019 +0000 binderfs: fix error return code in binderfs_fill_super() Fix to return a negative error code -ENOMEM from the new_inode() and d_make_root() error handling cases instead of 0, as done elsewhere in this function. Fixes: 849d540ddfcd ("binderfs: implement "max" mount option") Signed-off-by: Wei Yongjun Reviewed-by: Christian Brauner Signed-off-by: Greg Kroah-Hartman drivers/android/binderfs.c | 1 + 1 file changed, 1 insertion(+) commit 96167167b6e17b25c0e05ecc31119b73baeab094 Author: Andi Kleen Date: Thu Jan 17 11:48:34 2019 -0800 perf script: Fix crash with printing mixed trace point and other events 'perf script' crashes currently when printing mixed trace points and other events because the trace format does not handle events without trace meta data. Add a simple check to avoid that. % cat > test.c main() { printf("Hello world\n"); } ^D % gcc -g -o test test.c % sudo perf probe -x test 'test.c:3' % perf record -e '{cpu/cpu-cycles,period=10000/,probe_test:main}:S' ./test % perf script Committer testing: Before: # perf probe -x /lib64/libc-2.28.so malloc Added new event: probe_libc:malloc (on malloc in /usr/lib64/libc-2.28.so) You can now use it in all perf tools, such as: perf record -e probe_libc:malloc -aR sleep 1 # perf probe -l probe_libc:malloc (on __libc_malloc@malloc/malloc.c in /usr/lib64/libc-2.28.so) # perf record -e '{cpu/cpu-cycles,period=10000/,probe_libc:*}:S' sleep 1 [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.023 MB perf.data (40 samples) ] # perf script Segmentation fault (core dumped) ^C # After: # perf script | head -6 sleep 2888 94796.944981: 16198 cpu/cpu-cycles,period=10000/: ffffffff925dc04f get_random_u32+0x1f (/lib/modules/5.0.0-rc2+/build/vmlinux) sleep 2888 [-01] 94796.944981: probe_libc:malloc: sleep 2888 94796.944983: 4713 cpu/cpu-cycles,period=10000/: ffffffff922763af change_protection+0xcf (/lib/modules/5.0.0-rc2+/build/vmlinux) sleep 2888 [-01] 94796.944983: probe_libc:malloc: sleep 2888 94796.944986: 9934 cpu/cpu-cycles,period=10000/: ffffffff922777e0 move_page_tables+0x0 (/lib/modules/5.0.0-rc2+/build/vmlinux) sleep 2888 [-01] 94796.944986: probe_libc:malloc: # Signed-off-by: Andi Kleen Tested-by: Arnaldo Carvalho de Melo Acked-by: Jiri Olsa Link: http://lkml.kernel.org/r/20190117194834.21940-1-andi@firstfloor.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-script.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bfd8d8fe98b8792f362cd210a7873969f8d2fc04 Author: Nicolas Pitre Date: Thu Jan 10 16:33:55 2019 -0500 vgacon: unconfuse vc_origin when using soft scrollback When CONFIG_VGACON_SOFT_SCROLLBACK is selected, the VGA display memory index and vc_visible_origin don't change when scrollback is activated. The actual screen content is saved away and the scrollbackdata is copied over it. However the vt code, and /dev/vcs devices in particular, still expect vc_origin to always point at the actual screen content not the displayed scrollback content. So adjust vc_origin to point at the saved screen content when scrollback is active and set it back to vc_visible_origin when restoring the screen. This fixes /dev/vcsa that return scrollback content when they shouldn't (onli /dev/vcsa without a number should), and also fixes /dev/vcsu that should return scrollback content when scrollback is active but currently doesn't. An unnecessary call to vga_set_mem_top() is also removed. Signed-off-by: Nicolas Pitre Cc: stable@vger.kernel.org # v4.19+ Signed-off-by: Greg Kroah-Hartman drivers/video/console/vgacon.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 0c9b1965faddad7534b6974b5b36c4ad37998f8e Author: Nicolas Pitre Date: Tue Jan 8 22:55:01 2019 -0500 vt: invoke notifier on screen size change User space using poll() on /dev/vcs devices are not awaken when a screen size change occurs. Let's fix that. Signed-off-by: Nicolas Pitre Cc: stable Signed-off-by: Greg Kroah-Hartman drivers/tty/vt/vt.c | 1 + 1 file changed, 1 insertion(+) commit 7e1d226345f89ad5d0216a9092c81386c89b4983 Author: Nicolas Pitre Date: Tue Jan 8 22:55:00 2019 -0500 vt: always call notifier with the console lock held Every invocation of notify_write() and notify_update() is performed under the console lock, except for one case. Let's fix that. Signed-off-by: Nicolas Pitre Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman drivers/tty/vt/vt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6609cff65c5b184ab889880ef5d41189611ea05f Author: Nicolas Pitre Date: Tue Jan 8 22:54:59 2019 -0500 vt: make vt_console_print() compatible with the unicode screen buffer When kernel messages are printed to the console, they appear blank on the unicode screen. This is because vt_console_print() is lacking a call to vc_uniscr_putc(). However the later function assumes vc->vc_x is always up to date when called, which is not the case here as vt_console_print() uses it to mark the beginning of the display update. This patch reworks (and simplifies) vt_console_print() so that vc->vc_x is always valid and keeps the start of display update in a local variable instead, which finally allows for adding the missing vc_uniscr_putc() call. Signed-off-by: Nicolas Pitre Cc: stable@vger.kernel.org # v4.19+ Signed-off-by: Greg Kroah-Hartman drivers/tty/vt/vt.c | 47 +++++++++++++++-------------------------------- 1 file changed, 15 insertions(+), 32 deletions(-) commit fc01d8c61ce02c034e67378cd3e645734bc18c8c Author: Paul Fulghum Date: Tue Jan 1 12:28:53 2019 -0800 tty/n_hdlc: fix __might_sleep warning Fix __might_sleep warning[1] in tty/n_hdlc.c read due to copy_to_user call while current is TASK_INTERRUPTIBLE. This is a false positive since the code path does not depend on current state remaining TASK_INTERRUPTIBLE. The loop breaks out and sets TASK_RUNNING after calling copy_to_user. This patch supresses the warning by setting TASK_RUNNING before calling copy_to_user. [1] https://syzkaller.appspot.com/bug?id=17d5de7f1fcab794cb8c40032f893f52de899324 Signed-off-by: Paul Fulghum Reported-by: syzbot Cc: Tetsuo Handa Cc: Alan Cox Cc: stable Acked-by: Arnd Bergmann Signed-off-by: Greg Kroah-Hartman drivers/tty/n_hdlc.c | 1 + 1 file changed, 1 insertion(+) commit 352c4cf40c4a7d439fa5d30aa2160f54b394da82 Author: He Zhe Date: Thu Jan 17 17:00:19 2019 +0800 serial: 8250: Fix serial8250 initialization crash The initialization code of interrupt backoff work might reference NULL pointer and cause the following crash, if no port was found. [ 10.017727] CPU 0 Unable to handle kernel paging request at virtual address 000001b0, epc == 807088e0, ra == 8070863c ---- snip ---- [ 11.704470] [<807088e0>] serial8250_register_8250_port+0x318/0x4ac [ 11.747251] [<80708d74>] serial8250_probe+0x148/0x1c0 [ 11.789301] [<80728450>] platform_drv_probe+0x40/0x94 [ 11.830515] [<807264f8>] really_probe+0xf8/0x318 [ 11.870876] [<80726b7c>] __driver_attach+0x110/0x12c [ 11.910960] [<80724374>] bus_for_each_dev+0x78/0xcc [ 11.951134] [<80725958>] bus_add_driver+0x200/0x234 [ 11.989756] [<807273d8>] driver_register+0x84/0x148 [ 12.029832] [<80d72f84>] serial8250_init+0x138/0x198 [ 12.070447] [<80100e6c>] do_one_initcall+0x5c/0x2a0 [ 12.110104] [<80d3a208>] kernel_init_freeable+0x370/0x484 [ 12.150722] [<80a49420>] kernel_init+0x10/0xf8 [ 12.191517] [<8010756c>] ret_from_kernel_thread+0x14/0x1c This patch makes sure the initialization code can be reached only if a port is found. Fixes: 6d7f677a2afa ("serial: 8250: Rate limit serial port rx interrupts during input overruns") Signed-off-by: He Zhe Reviewed-by: Darwin Dingel Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/8250/8250_core.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) commit aff9cf5955185d1f183227e46c5f8673fa483813 Author: Samir Virmani Date: Wed Jan 16 10:28:07 2019 -0800 uart: Fix crash in uart_write and uart_put_char We were experiencing a crash similar to the one reported as part of commit:a5ba1d95e46e ("uart: fix race between uart_put_char() and uart_shutdown()") in our testbed as well. We continue to observe the same crash after integrating the commit a5ba1d95e46e ("uart: fix race between uart_put_char() and uart_shutdown()") On reviewing the change, the port lock should be taken prior to checking for if (!circ->buf) in fn. __uart_put_char and other fns. that update the buffer uart_state->xmit. Traceback: [11/27/2018 06:24:32.4870] Unable to handle kernel NULL pointer dereference at virtual address 0000003b [11/27/2018 06:24:32.4950] PC is at memcpy+0x48/0x180 [11/27/2018 06:24:32.4950] LR is at uart_write+0x74/0x120 [11/27/2018 06:24:32.4950] pc : [] lr : [] pstate: 000001c5 [11/27/2018 06:24:32.4950] sp : ffffffc076433d30 [11/27/2018 06:24:32.4950] x29: ffffffc076433d30 x28: 0000000000000140 [11/27/2018 06:24:32.4950] x27: ffffffc0009b9d5e x26: ffffffc07ce36580 [11/27/2018 06:24:32.4950] x25: 0000000000000000 x24: 0000000000000140 [11/27/2018 06:24:32.4950] x23: ffffffc000891200 x22: ffffffc01fc34000 [11/27/2018 06:24:32.4950] x21: 0000000000000fff x20: 0000000000000076 [11/27/2018 06:24:32.4950] x19: 0000000000000076 x18: 0000000000000000 [11/27/2018 06:24:32.4950] x17: 000000000047cf08 x16: ffffffc000099e68 [11/27/2018 06:24:32.4950] x15: 0000000000000018 x14: 776d726966205948 [11/27/2018 06:24:32.4950] x13: 50203a6c6974755f x12: 74647075205d3333 [11/27/2018 06:24:32.4950] x11: 3a35323a36203831 x10: 30322f37322f3131 [11/27/2018 06:24:32.4950] x9 : 5b205d303638342e x8 : 746164206f742070 [11/27/2018 06:24:32.4950] x7 : 7520736920657261 x6 : 000000000000003b [11/27/2018 06:24:32.4950] x5 : 000000000000817a x4 : 0000000000000008 [11/27/2018 06:24:32.4950] x3 : 2f37322f31312a5b x2 : 000000000000006e [11/27/2018 06:24:32.4950] x1 : ffffffc0009b9cf0 x0 : 000000000000003b [11/27/2018 06:24:32.4950] CPU2: stopping [11/27/2018 06:24:32.4950] CPU: 2 PID: 0 Comm: swapper/2 Tainted: P D O 4.1.51 #3 [11/27/2018 06:24:32.4950] Hardware name: Broadcom-v8A (DT) [11/27/2018 06:24:32.4950] Call trace: [11/27/2018 06:24:32.4950] [] dump_backtrace+0x0/0x150 [11/27/2018 06:24:32.4950] [] show_stack+0x14/0x20 [11/27/2018 06:24:32.4950] [] dump_stack+0x90/0xb0 [11/27/2018 06:24:32.4950] [] handle_IPI+0x18c/0x1a0 [11/27/2018 06:24:32.4950] [] gic_handle_irq+0x88/0x90 Fixes: a5ba1d95e46e ("uart: fix race between uart_put_char() and uart_shutdown()") Cc: stable Signed-off-by: Samir Virmani Acked-by: Tycho Andersen Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/serial_core.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) commit 4f9b838927812b5949a9899f14e0c9ef7f02b0c8 Merge: af707f58d81c 527c1e567ead Author: Greg Kroah-Hartman Date: Fri Jan 18 12:58:20 2019 +0100 Merge tag 'usb-serial-5.0-rc3' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB-serial fixes for 5.0-rc3 Here's a fix for the new ftdi gpio support, which failed to take autosuspend into account, and a patch adding missing SPDX identifiers to the keyspan headers. Included are also some new device ids. All but the SPDX patch have been in linux-next with no reported issues. Signed-off-by: Johan Hovold * tag 'usb-serial-5.0-rc3' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: keyspan_usa: add proper SPDX lines for .h files USB: serial: pl2303: add new PID to support PL2303TB USB: serial: ftdi_sio: fix GPIO not working in autosuspend USB: serial: simple: add Motorola Tetra TPG2200 device id commit af707f58d81cd2ec5ba973f8c3d76e66b4b632cf Merge: 70d0ba4cf79a 827cb0323928 Author: Greg Kroah-Hartman Date: Fri Jan 18 12:54:46 2019 +0100 Merge tag 'phy-for-5.0-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/kishon/linux-phy into usb-linus Kishon writes: phy: for 5.0 -rc *) Fix de-reference before null check in TI's phy-gmii-sel driver *) Fix build breakage in AHCI platform driver (patch was merged in AHCI before dependent patches were merged in PHY layer) *) Fix the power on error path in ath79-usb PHY driver *) Fix the reset binding name to match the DT binding documentation in ath79-usb PHY driver. Signed-off-by: Kishon Vijay Abraham I * tag 'phy-for-5.0-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/kishon/linux-phy: phy: ath79-usb: Fix the main reset name to match the DT binding phy: ath79-usb: Fix the power on error path phy: fix build breakage: add PHY_MODE_SATA phy: ti: ensure priv is not null before dereferencing it commit 11ee2a3808aebbec73096551a716dea03d417fcb Merge: b1c0330823fe 6f9b5e70dfcd Author: Rafael J. Wysocki Date: Fri Jan 18 11:17:16 2019 +0100 Merge branch 'acpi-pci' * acpi-pci: drivers: thermal: int340x_thermal: Make PCI dependency explicit x86/intel/lpss: Make PCI dependency explicit platform/x86: apple-gmux: Make PCI dependency explicit platform/x86: intel_pmc: Make PCI dependency explicit platform/x86: intel_ips: make PCI dependency explicit vga-switcheroo: make PCI dependency explicit ata: pata_acpi: Make PCI dependency explicit ACPI / LPSS: Make PCI dependency explicit commit 527c1e567ead03ec21f6707e79c166ce680f17f7 Author: Greg Kroah-Hartman Date: Thu Jan 17 09:23:46 2019 +0100 USB: serial: keyspan_usa: add proper SPDX lines for .h files The keyspan_usa??msg.h files are under a BSD-3 style license, so properly label them as such with a SPDX line at the top of the file. Signed-off-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold drivers/usb/serial/keyspan_usa26msg.h | 1 + drivers/usb/serial/keyspan_usa28msg.h | 1 + drivers/usb/serial/keyspan_usa49msg.h | 1 + drivers/usb/serial/keyspan_usa67msg.h | 1 + drivers/usb/serial/keyspan_usa90msg.h | 1 + 5 files changed, 5 insertions(+) commit 97715058b70da1262fd07798c8b2e3e894f759dd Author: Nathan Chancellor Date: Wed Jan 16 06:20:11 2019 -0700 staging: rtl8723bs: Fix build error with Clang when inlining is disabled When CONFIG_NO_AUTO_INLINE was present in linux-next (which added '-fno-inline-functions' to KBUILD_CFLAGS), an allyesconfig build with Clang failed at the modpost stage: ERROR: "is_broadcast_mac_addr" [drivers/staging/rtl8723bs/r8723bs.ko] undefined! ERROR: "is_zero_mac_addr" [drivers/staging/rtl8723bs/r8723bs.ko] undefined! ERROR: "is_multicast_mac_addr" [drivers/staging/rtl8723bs/r8723bs.ko] undefined! These functions were marked as extern inline, meaning that if inlining doesn't happen, the function will be undefined, as it is above. This happens to work with GCC because the '-fno-inline-functions' option respects the __inline attribute so all instances of these functions are inlined as expected and the definition doesn't actually matter. However, with Clang and '-fno-inline-functions', a function has to be marked with the __always_inline attribute to be considered for inlining, which none of these functions are. Clang tries to find the symbol definition elsewhere as it was told and fails, which trickles down to modpost. To make sure that this code compiles regardless of compiler and make the intention of the code clearer, use 'static' to ensure these functions are always defined, regardless of inlining. Additionally, silence a checkpatch warning by switching from '__inline' to 'inline'. Signed-off-by: Nathan Chancellor Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8723bs/include/ieee80211.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit d311e0c27b8fcc27f707f8cac48cd8bdc4155224 Author: Masahiro Yamada Date: Fri Jan 18 14:30:38 2019 +0900 mtd: rawnand: denali: get ->setup_data_interface() working again Commit 7a08dbaedd36 ("mtd: rawnand: Move ->setup_data_interface() to nand_controller_ops") missed to invert the if-conditonal for denali. Since then, the Denali NAND driver cannnot invoke setup_data_interface. Fixes: 7a08dbaedd36 ("mtd: rawnand: Move ->setup_data_interface() to nand_controller_ops") Signed-off-by: Masahiro Yamada Acked-by: Miquel Raynal Signed-off-by: Boris Brezillon drivers/mtd/nand/raw/denali.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 01eeb927bbcc1952114b0aec1447699c4747c337 Author: Luc Van Oostenryck Date: Thu Jan 17 18:39:07 2019 +0100 mtd: nand: jz4740: fix '__iomem *' vs. '* __iomem' The function jz_nand_ioremap_resource() needs a pointer to an __iomem pointer as its last argument but this argument is declared as: void * __iomem *base Fix this by using the correct declaration: void __iomem **base which then also removes the following Sparse's warnings: 282:15: warning: incorrect type in assignment (different address spaces) 282:15: expected void *[noderef] 282:15: got void [noderef] * 322:57: warning: incorrect type in argument 4 (different address spaces) 322:57: expected void *[noderef] *base 322:57: got void [noderef] ** 402:67: warning: incorrect type in argument 4 (different address spaces) 402:67: expected void *[noderef] *base 402:67: got void [noderef] ** Signed-off-by: Luc Van Oostenryck Acked-by: Miquel Raynal Signed-off-by: Boris Brezillon drivers/mtd/nand/raw/jz4740_nand.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 70d0ba4cf79a0e73485b22d955991c6f27257376 Author: Lubomir Rintel Date: Mon Jan 14 21:16:08 2019 +0100 USB: EHCI: ehci-mv: add MODULE_DEVICE_TABLE This fixes autoloading the module by the OF compatible string. Fixes: 813e18b18a87 ("USB: EHCI: ehci-mv: add DT support") Cc: stable@vger.kernel.org Signed-off-by: Lubomir Rintel Signed-off-by: Greg Kroah-Hartman drivers/usb/host/ehci-mv.c | 1 + 1 file changed, 1 insertion(+) commit 91f7d2e89868fcac0e750a28230fdb1ad4512137 Author: Christian Lamparter Date: Fri Jan 11 17:29:45 2019 +0100 USB: leds: fix regression in usbport led trigger The patch "usb: simplify usbport trigger" together with "leds: triggers: add device attribute support" caused an regression for the usbport trigger. it will no longer enumerate any active usb hub ports under the "ports" directory in the sysfs class directory, if the usb host drivers are fully initialized before the usbport trigger was loaded. The reason is that the usbport driver tries to register the sysfs entries during the activate() callback. And this will fail with -2 / ENOENT because the patch "leds: triggers: add device attribute support" made it so that the sysfs "ports" group was only being added after the activate() callback succeeded. This version of the patch reverts parts of the "usb: simplify usbport trigger" patch and restores usbport trigger's functionality. Fixes: 6f7b0bad8839 ("usb: simplify usbport trigger") Signed-off-by: Christian Lamparter Cc: stable Acked-by: Jacek Anaszewski Signed-off-by: Greg Kroah-Hartman drivers/usb/core/ledtrig-usbport.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) commit 8ff396fe56f5593640a8ce7223cac33a2cda619e Author: Peter Chen Date: Thu Jan 17 09:24:20 2019 +0000 usb: chipidea: fix static checker warning for NULL pointer During the static checker, "data->usbmisc_data" may be NULL. Fix it by adding this pointer judgement before using. Reported-by: Dan Carpenter Signed-off-by: Peter Chen Cc: stable Signed-off-by: Greg Kroah-Hartman drivers/usb/chipidea/ci_hdrc_imx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit a817c59e8273e555acb5cbccc75f5b57c27e3da9 Author: Shuah Khan Date: Wed Jan 16 16:28:20 2019 -0700 MAINTAINERS: email address update in MAINTAINERS entries Update email address in MAINTAINERS entries. Signed-off-by: Shuah Khan Signed-off-by: Greg Kroah-Hartman MAINTAINERS | 3 +++ 1 file changed, 3 insertions(+) commit fa5762fca80146153bff37ce5b74fa69b84904eb Author: Greg Kroah-Hartman Date: Thu Jan 17 09:23:48 2019 +0100 USB: usbip: delete README file The README file ni the drivers/usb/usbip/ directory is not needed anymore, so just delete it. Cc: Valentina Manea Signed-off-by: Greg Kroah-Hartman Acked-by: Shuah Khan Signed-off-by: Greg Kroah-Hartman drivers/usb/usbip/README | 7 ------- 1 file changed, 7 deletions(-) commit 575088f60021e69a9ee8292ddc33b3196c53c239 Merge: 1c7fc5cbc339 87b6d2c56825 Author: Greg Kroah-Hartman Date: Fri Jan 18 09:32:26 2019 +0100 Merge tag 'fixes-for-v5.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus Felipe writes: usb: fixes for v5.0-rc2 Few minor bug fixes on dwc3: adding a missing synchronize_irq() to prevent a very rare spurious interrupt during suspend; clearing needs_extra_trb flag to prevent it from being left erroneously set and confusing the driver when the request is recycled; initializing link_to a sensible default during init. Apart from these, one minor fix on dwc2 and another on f_sourcesink.c * tag 'fixes-for-v5.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb: usb: dwc2: gadget: Fix Remote Wakeup interrupt bit clearing usb: gadget: Potential NULL dereference on allocation error usb: dwc3: gadget: Fix the uninitialized link_state when udc starts usb: dwc3: gadget: Clear req->needs_extra_trb flag on cleanup usb: dwc3: gadget: synchronize_irq dwc irq in suspend commit 129699bb8c7572106b5bbb2407c2daee4727ccad Author: Aaron Hill Date: Mon Dec 24 14:23:36 2018 -0500 drivers: thermal: int340x_thermal: Fix sysfs race condition Changes since V1: * Use dev_info instead of printk * Use dev_warn instead of BUG_ON Previously, sysfs_create_group was called before all initialization had fully run - specifically, before pci_set_drvdata was called. Since the sysctl group is visible to userspace as soon as sysfs_create_group returns, a small window of time existed during which a process could read from an uninitialized/partially-initialized device. This commit moves the creation of the sysctl group to after all initialized is completed. This ensures that it's impossible for userspace to read from a sysctl file before initialization has fully completed. To catch any future regressions, I've added a check to ensure that proc_thermal_emum_mode is never PROC_THERMAL_NONE when a process tries to read from a sysctl file. Previously, the aforementioned race condition could result in the 'else' branch running while PROC_THERMAL_NONE was set, leading to a null pointer deference. Signed-off-by: Aaron Hill Signed-off-by: Zhang Rui .../int340x_thermal/processor_thermal_device.c | 28 ++++++++++++---------- 1 file changed, 15 insertions(+), 13 deletions(-) commit bf97403ac4bfbc9f9f92f47e737aee983d9191f5 Author: Yang Wei Date: Thu Jan 17 23:30:03 2019 +0800 macvlan: replace kfree_skb by consume_skb for drop profiles Replace the kfree_skb() by consume_skb() to be drop monitor(dropwatch, perf) friendly. Signed-off-by: Yang Wei Signed-off-by: David S. Miller drivers/net/macvlan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 87fff3cacd0112bcaf42f932c1e44ae32b42f1fb Author: Yang Wei Date: Thu Jan 17 23:11:30 2019 +0800 neighbour: Do not perturb drop profiles when neigh_probe Replace the kfree_skb() by consume_skb() to be drop monitor(dropwatch, perf) friendly. Signed-off-by: Yang Wei Signed-off-by: David S. Miller net/core/neighbour.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5ab3121beeb76aa6090195b67d237115860dd9ec Author: Lendacky, Thomas Date: Thu Jan 17 14:20:14 2019 +0000 amd-xgbe: Fix mdio access for non-zero ports and clause 45 PHYs The XGBE hardware has support for performing MDIO operations using an MDIO command request. The driver mistakenly uses the mdio port address as the MDIO command request device address instead of the MDIO command request port address. Additionally, the driver does not properly check for and create a clause 45 MDIO command. Check the supplied MDIO register to determine if the request is a clause 45 operation (MII_ADDR_C45). For a clause 45 operation, extract the device address and register number from the supplied MDIO register and use them to set the MDIO command request device address and register number fields. For a clause 22 operation, the MDIO request device address is set to zero and the MDIO command request register number is set to the supplied MDIO register. In either case, the supplied MDIO port address is used as the MDIO command request port address. Fixes: 732f2ab7afb9 ("amd-xgbe: Add support for MDIO attached PHYs") Signed-off-by: Tom Lendacky Tested-by: Shyam Sundar S K Signed-off-by: David S. Miller drivers/net/ethernet/amd/xgbe/xgbe-common.h | 2 -- drivers/net/ethernet/amd/xgbe/xgbe-dev.c | 22 ++++++++++++++++------ 2 files changed, 16 insertions(+), 8 deletions(-) commit 40f89ebfbd73fc9439ae8d4950f60226ad176690 Author: Camelia Groza Date: Thu Jan 17 14:33:33 2019 +0200 net: phy: add missing phy driver features The phy drivers for CS4340 and TN2020 are missing their features attributes. Add them. Fixes: 719655a14971 ("net: phy: Replace phy driver features u32 with link_mode bitmap") Reported-by: Scott Wood Signed-off-by: Camelia Groza Signed-off-by: David S. Miller drivers/net/phy/cortina.c | 1 + drivers/net/phy/teranetics.c | 1 + 2 files changed, 2 insertions(+) commit c6ddfb9a963f0cac0f7365acfc87f3f3b33a3b69 Author: Madalin Bucur Date: Thu Jan 17 11:42:27 2019 +0200 dpaa_eth: NETIF_F_LLTX requires to do our own update of trans_start As txq_trans_update() only updates trans_start when the lock is held, trans_start does not get updated if NETIF_F_LLTX is declared. Signed-off-by: Madalin Bucur Signed-off-by: David S. Miller drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 28c1382fa28f2e2d9d0d6f25ae879b5af2ecbd03 Author: Yunjian Wang Date: Thu Jan 17 09:46:41 2019 +0800 net: bridge: Fix ethernet header pointer before check skb forwardable The skb header should be set to ethernet header before using is_skb_forwardable. Because the ethernet header length has been considered in is_skb_forwardable(including dev->hard_header_len length). To reproduce the issue: 1, add 2 ports on linux bridge br using following commands: $ brctl addbr br $ brctl addif br eth0 $ brctl addif br eth1 2, the MTU of eth0 and eth1 is 1500 3, send a packet(Data 1480, UDP 8, IP 20, Ethernet 14, VLAN 4) from eth0 to eth1 So the expect result is packet larger than 1500 cannot pass through eth0 and eth1. But currently, the packet passes through success, it means eth1's MTU limit doesn't take effect. Fixes: f6367b4660dd ("bridge: use is_skb_forwardable in forward path") Cc: bridge@lists.linux-foundation.org Cc: Nkolay Aleksandrov Cc: Roopa Prabhu Cc: Stephen Hemminger Signed-off-by: Yunjian Wang Signed-off-by: David S. Miller net/bridge/br_forward.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) commit cc5e710759470bc7f3c61d11fd54586f15fdbdf4 Author: Jason Wang Date: Wed Jan 16 16:54:42 2019 +0800 vhost: log dirty page correctly Vhost dirty page logging API is designed to sync through GPA. But we try to log GIOVA when device IOTLB is enabled. This is wrong and may lead to missing data after migration. To solve this issue, when logging with device IOTLB enabled, we will: 1) reuse the device IOTLB translation result of GIOVA->HVA mapping to get HVA, for writable descriptor, get HVA through iovec. For used ring update, translate its GIOVA to HVA 2) traverse the GPA->HVA mapping to get the possible GPA and log through GPA. Pay attention this reverse mapping is not guaranteed to be unique, so we should log each possible GPA in this case. This fix the failure of scp to guest during migration. In -next, we will probably support passing GIOVA->GPA instead of GIOVA->HVA. Fixes: 6b1e6cc7855b ("vhost: new device IOTLB API") Reported-by: Jintack Lim Cc: Jintack Lim Signed-off-by: Jason Wang Acked-by: Michael S. Tsirkin Signed-off-by: David S. Miller drivers/vhost/net.c | 3 +- drivers/vhost/vhost.c | 97 +++++++++++++++++++++++++++++++++++++++++++-------- drivers/vhost/vhost.h | 3 +- 3 files changed, 87 insertions(+), 16 deletions(-) commit f655f8b818684716b2ebe35760c9b96184587d56 Author: Jakub Kicinski Date: Sat Jan 12 12:51:05 2019 -0800 Documentation: timestamping: correct path to net_tstamp.h net_tstamp.h is an UAPI header, so it was moved under include/uapi. Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller Documentation/networking/timestamping.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 9420151d88ca35cd7f857774d90bfdca505a2cc1 Merge: df0219b4f957 7ebec5f43134 Author: Dave Airlie Date: Fri Jan 18 15:38:13 2019 +1000 Merge branch 'linux-4.21' of git://github.com/skeggsb/linux into drm-fixes nouveau support for TU102 (RTX 2080 Ti) Signed-off-by: Dave Airlie From: Ben Skeggs Link: https://patchwork.freedesktop.org/patch/msgid/CABDvA=mQsRr0BpRpv3n6UjthHush4u_kQR3oUGHkBtAHTmyCYw@mail.gmail.com commit d7393226d15add056285c8fc86723d54d7e0c77d Merge: 1092a94fcbcd d6f4a21f309d Author: Linus Torvalds Date: Fri Jan 18 17:17:20 2019 +1200 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes frfom Jason Gunthorpe: "Not much so far. We have the usual batch of bugs and two fixes to code merged this cycle: - Restore valgrind support for the ioctl verbs interface merged this window, and fix a missed error code on an error path from that conversion - A user reported crash on obsolete mthca hardware - pvrdma was using the wrong command opcode toward the hypervisor - NULL pointer crash regression when dumping rdma-cm over netlink - Be conservative about exposing the global rkey" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/uverbs: Mark ioctl responses with UVERBS_ATTR_F_VALID_OUTPUT RDMA/mthca: Clear QP objects during their allocation RDMA/vmw_pvrdma: Return the correct opcode when creating WR RDMA/cma: Add cm_id restrack resource based on kernel or user cm_id type RDMA/nldev: Don't expose unsafe global rkey to regular user RDMA/uverbs: Fix post send success return value in case of error commit 1092a94fcbcde03a8c2cc554f305af48c95d5d58 Merge: 2451f3717c53 df0219b4f957 Author: Linus Torvalds Date: Fri Jan 18 17:14:02 2019 +1200 Merge tag 'drm-fixes-2019-01-18' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "The rc3 fixes are a bit scattered: - meson, sun4i and rockchip all had missing of_node_put. - qxl and virtio both were advertising dma-buf to userspace when they really shouldn't have. Otherwise: meson: - modesetting regression fix i915 GVT: - one cmd parser failure fix - region cleanup fix in vGPU destroy amdgpu: - KFD fixes for arm64 mixed APU/DGPU - vega12 powerplay fix - raven DC fixes - freesync fix" * tag 'drm-fixes-2019-01-18' of git://anongit.freedesktop.org/drm/drm: drm/amd/display: Detach backlight from stream drm/sun4i: backend: add missing of_node_puts Revert "drm/amdgpu: validate user pitch alignment" Revert "drm/amdgpu: validate user GEM object size" drm/meson: Fix atomic mode switching regression drm/i915/gvt: Fix mmap range check drm/i915/gvt: free VFIO region space in vgpu detach drm/amd/display: Fix disabled cursor on top screen edge drm/amd/display: fix warning on raven hotplug drm/amd/display: fix PME notification not working in RV desktop drm/amd/display: Only get the connector state for VRR when toggled drm/amd/display: Pack DMCU iRAM alignment drm/amd/powerplay: run acg btc for Vega12 drm/amdkfd: Don't assign dGPUs to APU topology devices drm/amdkfd: Allow building KFD on ARM64 (v2) drm/meson: add missing of_node_put drm/virtio: drop prime import/export callbacks drm/qxl: drop prime import/export callbacks drm/i915/gvt: Allow F_CMD_ACCESS on mmio 0x21f0 drm/rockchip: add missing of_node_put commit 2451f3717c538795fc9fade46916683ebf7ea959 Merge: 0a2fbed84a96 248b57015f35 Author: Linus Torvalds Date: Fri Jan 18 16:58:07 2019 +1200 Merge tag 'led-fix-for-5.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds Pull LED fix from Jacek Anaszewski. * tag 'led-fix-for-5.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds: leds: lp5523: fix a missing check of return value of lp55xx_read commit 0a2fbed84a962c486a71d2c91c86a31332dcbf02 Merge: a3a80255d58d f422449b5854 Author: Linus Torvalds Date: Fri Jan 18 16:55:49 2019 +1200 Merge tag 'hwmon-for-v5.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: "Minor fixes/regressions" * tag 'hwmon-for-v5.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (tmp421) Correct the misspelling of the tmp442 compatible attribute in OF device ID table hwmon: (occ) Fix potential integer overflow hwmon: (lm80) Fix missing unlock on error in set_fan_div() hwmon: (nct6775) Enable IO mapping for NCT6797D and NCT6798D hwmon: (nct6775) Fix chip ID for NCT6798D commit 38197ca176fc259fa4c871d07bcf8389d044a895 Author: Thomas Gleixner Date: Fri Jan 18 00:14:17 2019 +0100 block: Cleanup license notice Remove the imprecise and sloppy: "This files is licensed under the GPL." license notice in the top level comment. 1) The file already contains a SPDX license identifier which clearly states that the license of the file is GPL V2 only 2) The notice resolves to GPL v1 or later for scanners which is just contrary to the intent of SPDX identifiers to provide clear and non ambiguous license information. Aside of that the value add of this notice is below zero, Cc: Damien Le Moal Cc: Matias Bjorling Cc: Christoph Hellwig Cc: Jens Axboe Cc: linux-block@vger.kernel.org Fixes: 6a5ac9846508 ("block: Make struct request_queue smaller for CONFIG_BLK_DEV_ZONED=n") Reviewed-by: Bart Van Assche Signed-off-by: Thomas Gleixner Signed-off-by: Jens Axboe block/blk-mq-debugfs-zoned.c | 2 -- 1 file changed, 2 deletions(-) commit 7ebec5f43134bbf3dd5f20228ac4c1b55ee73284 Author: Ben Skeggs Date: Thu Jan 17 11:39:55 2019 +1000 drm/nouveau/core: recognise TU102 Would usually do this split-out, verifying each component indivitually, but this has been squashed together to be more palatable for merging in 5.0-rc. Signed-off-by: Ben Skeggs drivers/gpu/drm/nouveau/nvkm/engine/device/base.c | 33 +++++++++++++++++++++++ 1 file changed, 33 insertions(+) commit b2e3d68d1251a051a620f9086e18f7ffa6833b5b Author: Florian Westphal Date: Mon Jan 14 14:28:50 2019 +0100 netfilter: nft_compat: destroy function must not have side effects The nft_compat destroy function deletes the nft_xt object from a list. This isn't allowed anymore. Destroy functions are called asynchronously, i.e. next batch can find the object that has a pending ->destroy() invocation: cpu0 cpu1 worker ->destroy for_each_entry() if (x == ... return x->ops; list_del(x) kfree_rcu(x) expr->ops->... // ops was free'd To resolve this, the list_del needs to occur before the transaction mutex gets released. nf_tables has a 'deactivate' hook for this purpose, so use that to unlink the object from the list. Fixes: 0935d5588400 ("netfilter: nf_tables: asynchronous release") Reported-by: Taehee Yoo Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/netfilter/nft_compat.c | 48 +++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 47 insertions(+), 1 deletion(-) commit cf52572ebbd7189a1966c2b5fc34b97078cd1dce Author: Florian Westphal Date: Mon Jan 14 14:28:49 2019 +0100 netfilter: nft_compat: make lists per netns There are two problems with nft_compat since the netlink config plane uses a per-netns mutex: 1. Concurrent add/del accesses to the same list 2. accesses to a list element after it has been free'd already. This patch fixes the first problem. Freeing occurs from a work queue, after transaction mutexes have been released, i.e., it still possible for a new transaction (even from same net ns) to find the to-be-deleted expression in the list. The ->destroy functions are not allowed to have any such side effects, i.e. the list_del() in the destroy function is not allowed. This part of the problem is solved in the next patch. I tried to make this work by serializing list access via mutex and by moving list_del() to a deactivate callback, but Taehee spotted following race on this approach: NET #0 NET #1 >select_ops() ->init() ->select_ops() ->deactivate() ->destroy() nft_xt_put() kfree_rcu(xt, rcu_head); ->init() <-- use-after-free occurred. Unfortunately, we can't increment reference count in select_ops(), because we can't undo the refcount increase in case a different expression fails in the same batch. (The destroy hook will only be called in case the expression was initialized successfully). Fixes: f102d66b335a ("netfilter: nf_tables: use dedicated mutex to guard transactions") Reported-by: Taehee Yoo Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/netfilter/nft_compat.c | 129 +++++++++++++++++++++++++++++++-------------- 1 file changed, 89 insertions(+), 40 deletions(-) commit 12c44aba6618b7f6c437076e5722237190f6cd5f Author: Florian Westphal Date: Mon Jan 14 14:28:48 2019 +0100 netfilter: nft_compat: use refcnt_t type for nft_xt reference count Using standard integer type was fine while all operations on it were guarded by the nftnl subsys mutex. This isn't true anymore: 1. transactions are guarded only by a pernet mutex, so concurrent rule manipulation in different netns is racy 2. the ->destroy hook runs from a work queue after the transaction mutex has been released already. cpu0 cpu1 (net 1) cpu2 (net 2) kworker nft_compat->destroy nft_compat->init nft_compat->init if (--nft_xt->ref == 0) nft_xt->ref++ nft_xt->ref++ Switch to refcount_t. Doing this however only fixes a minor aspect, nft_compat also performs linked-list operations in an unsafe way. This is addressed in the next two patches. Fixes: f102d66b335a ("netfilter: nf_tables: use dedicated mutex to guard transactions") Fixes: 0935d5588400 ("netfilter: nf_tables: asynchronous release") Reported-by: Taehee Yoo Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/netfilter/nft_compat.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) commit e6a72b7daeeb521753803550f0ed711152bb2555 Author: Eugeniy Paltsev Date: Mon Jan 14 18:16:48 2019 +0300 ARCv2: lib: memeset: fix doing prefetchw outside of buffer ARCv2 optimized memset uses PREFETCHW instruction for prefetching the next cache line but doesn't ensure that the line is not past the end of the buffer. PRETECHW changes the line ownership and marks it dirty, which can cause issues in SMP config when next line was already owned by other core. Fix the issue by avoiding the PREFETCHW Some more details: The current code has 3 logical loops (ignroing the unaligned part) (a) Big loop for doing aligned 64 bytes per iteration with PREALLOC (b) Loop for 32 x 2 bytes with PREFETCHW (c) any left over bytes loop (a) was already eliding the last 64 bytes, so PREALLOC was safe. The fix was removing PREFETCW from (b). Another potential issue (applicable to configs with 32 or 128 byte L1 cache line) is that PREALLOC assumes 64 byte cache line and may not do the right thing specially for 32b. While it would be easy to adapt, there are no known configs with those lie sizes, so for now, just compile out PREALLOC in such cases. Signed-off-by: Eugeniy Paltsev Cc: stable@vger.kernel.org #4.4+ Signed-off-by: Vineet Gupta [vgupta: rewrote changelog, used asm .macro vs. "C" macro] arch/arc/lib/memset-archs.S | 40 ++++++++++++++++++++++++++++++++-------- 1 file changed, 32 insertions(+), 8 deletions(-) commit 4d447455e73b47c43dd35fcc38ed823d3182a474 Author: Vineet Gupta Date: Mon Dec 10 16:56:45 2018 -0800 ARC: mm: do_page_fault fixes #1: relinquish mmap_sem if signal arrives while handle_mm_fault do_page_fault() forgot to relinquish mmap_sem if a signal came while handling handle_mm_fault() - due to say a ctl+c or oom etc. This would later cause a deadlock by acquiring it twice. This came to light when running libc testsuite tst-tls3-malloc test but is likely also the cause for prior seen LTP failures. Using lockdep clearly showed what the issue was. | # while true; do ./tst-tls3-malloc ; done | Didn't expect signal from child: got `Segmentation fault' | ^C | ============================================ | WARNING: possible recursive locking detected | 4.17.0+ #25 Not tainted | -------------------------------------------- | tst-tls3-malloc/510 is trying to acquire lock: | 606c7728 (&mm->mmap_sem){++++}, at: __might_fault+0x28/0x5c | |but task is already holding lock: |606c7728 (&mm->mmap_sem){++++}, at: do_page_fault+0x9c/0x2a0 | | other info that might help us debug this: | Possible unsafe locking scenario: | | CPU0 | ---- | lock(&mm->mmap_sem); | lock(&mm->mmap_sem); | | *** DEADLOCK *** | ------------------------------------------------------------ What the change does is not obvious (note to myself) prior code was | do_page_fault | | down_read() <-- lock taken | handle_mm_fault <-- signal pending as this runs | if fatal_signal_pending | if VM_FAULT_ERROR | up_read | if user_mode | return <-- lock still held, this was the BUG New code | do_page_fault | | down_read() <-- lock taken | handle_mm_fault <-- signal pending as this runs | if fatal_signal_pending | if VM_FAULT_RETRY | return <-- not same case as above, but still OK since | core mm already relinq lock for FAULT_RETRY | ... | | < Now falls through for bug case above > | | up_read() <-- lock relinquished Cc: stable@vger.kernel.org Signed-off-by: Vineet Gupta arch/arc/mm/fault.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) commit 88a8121dc1d3d0dbddd411b79ed236b6b6ea415c Author: Nicolas Dichtel Date: Thu Jan 17 11:27:22 2019 +0100 af_packet: fix raw sockets over 6in4 tunnel Since commit cb9f1b783850, scapy (which uses an AF_PACKET socket in SOCK_RAW mode) is unable to send a basic icmp packet over a sit tunnel: Here is a example of the setup: $ ip link set ntfp2 up $ ip addr add 10.125.0.1/24 dev ntfp2 $ ip tunnel add tun1 mode sit ttl 64 local 10.125.0.1 remote 10.125.0.2 dev ntfp2 $ ip addr add fd00:cafe:cafe::1/128 dev tun1 $ ip link set dev tun1 up $ ip route add fd00:200::/64 dev tun1 $ scapy >>> p = [] >>> p += IPv6(src='fd00:100::1', dst='fd00:200::1')/ICMPv6EchoRequest() >>> send(p, count=1, inter=0.1) >>> quit() $ ip -s link ls dev tun1 | grep -A1 "TX.*errors" TX: bytes packets errors dropped carrier collsns 0 0 1 0 0 0 The problem is that the network offset is set to the hard_header_len of the output device (tun1, ie 14 + 20) and in our case, because the packet is small (48 bytes) the pskb_inet_may_pull() fails (it tries to pull 40 bytes (ipv6 header) starting from the network offset). This problem is more generally related to device with variable hard header length. To avoid a too intrusive patch in the current release, a (ugly) workaround is proposed in this patch. It has to be cleaned up in net-next. Link: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=993675a3100b1 Link: http://patchwork.ozlabs.org/patch/1024489/ Fixes: cb9f1b783850 ("ip: validate header length on virtual device xmit") CC: Willem de Bruijn CC: Maxim Mikityanskiy Signed-off-by: Nicolas Dichtel Acked-by: Willem de Bruijn Signed-off-by: David S. Miller net/packet/af_packet.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 12fee4cd5be2c4a73cc13d7ad76eb2d2feda8a71 Author: Huacai Chen Date: Thu Jan 17 11:00:09 2019 +0800 genirq/irqdesc: Fix double increment in alloc_descs() The recent rework of alloc_descs() introduced a double increment of the loop counter. As a consequence only every second affinity mask is validated. Remove it. [ tglx: Massaged changelog ] Fixes: c410abbbacb9 ("genirq/affinity: Add is_managed to struct irq_affinity_desc") Signed-off-by: Huacai Chen Signed-off-by: Thomas Gleixner Cc: Fuxin Zhang Cc: Zhangjin Wu Cc: Huacai Chen Cc: Dou Liyang Link: https://lkml.kernel.org/r/1547694009-16261-1-git-send-email-chenhc@lemote.com kernel/irq/irqdesc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fc24d75a7f91837d7918e40719575951820b2b8f Author: Jan Beulich Date: Tue Jan 15 09:58:16 2019 -0700 x86/entry/64/compat: Fix stack switching for XEN PV While in the native case entry into the kernel happens on the trampoline stack, PV Xen kernels get entered with the current thread stack right away. Hence source and destination stacks are identical in that case, and special care is needed. Other than in sync_regs() the copying done on the INT80 path isn't NMI / #MC safe, as either of these events occurring in the middle of the stack copying would clobber data on the (source) stack. There is similar code in interrupt_entry() and nmi(), but there is no fixup required because those code paths are unreachable in XEN PV guests. [ tglx: Sanitized subject, changelog, Fixes tag and stable mail address. Sigh ] Fixes: 7f2590a110b8 ("x86/entry/64: Use a per-CPU trampoline stack for IDT entries") Signed-off-by: Jan Beulich Signed-off-by: Thomas Gleixner Reviewed-by: Juergen Gross Acked-by: Andy Lutomirski Cc: Peter Anvin Cc: xen-devel@lists.xenproject.org> Cc: Boris Ostrovsky Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/5C3E1128020000780020DFAD@prv1-mh.provo.novell.com arch/x86/entry/entry_64_compat.S | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit e224c390a6259c529f7b2a6bd215a087b3344f5c Author: Yuchung Cheng Date: Thu Jan 17 08:51:01 2019 -0800 bpf: fix SO_MAX_PACING_RATE to support TCP internal pacing If sch_fq packet scheduler is not used, TCP can fallback to internal pacing, but this requires sk_pacing_status to be properly set. Fixes: 8c4b4c7e9ff0 ("bpf: Add setsockopt helper function to bpf") Signed-off-by: Yuchung Cheng Signed-off-by: Eric Dumazet Cc: Lawrence Brakmo Acked-by: Martin KaFai Lau Signed-off-by: Daniel Borkmann net/core/filter.c | 4 ++++ 1 file changed, 4 insertions(+) commit f4924f24da8c7ef64195096817f3cde324091d97 Author: Peter Oskolkov Date: Wed Jan 16 08:47:54 2019 -0800 bpf: bpf_setsockopt: reset sock dst on SO_MARK changes In sock_setsockopt() (net/core/sock.h), when SO_MARK option is used to change sk_mark, sk_dst_reset(sk) is called. The same should be done in bpf_setsockopt(). Fixes: 8c4b4c7e9ff0 ("bpf: Add setsockopt helper function to bpf") Reported-by: Maciej Żenczykowski Signed-off-by: Peter Oskolkov Acked-by: Martin KaFai Lau Reviewed-by: Maciej Żenczykowski Signed-off-by: Daniel Borkmann net/core/filter.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 70921ae25f944423f0abf096f73455c586da0652 Author: Jonathan Corbet Date: Tue Jan 8 17:04:32 2019 -0700 genirq: Fix the kerneldoc comment for struct irq_affinity_desc A recent commit added a new field but did not update the kerneldoc comment, leading to this build warning: ./include/linux/interrupt.h:268: warning: Function parameter or member 'is_managed' not described in 'irq_affinity_desc' Add the missing information, making the docs build 0.001% quieter. Fixes: c410abbbacb9 ("genirq/affinity: Add is_managed to struct irq_affinity_desc") Signed-off-by: Jonathan Corbet Signed-off-by: Thomas Gleixner Cc: Dou Liyang Link: https://lkml.kernel.org/r/20190108170432.59bae8a6@lwn.net include/linux/interrupt.h | 1 + 1 file changed, 1 insertion(+) commit df0219b4f9576c72b618db5edf7bb75c14829dbd Merge: 4ac4cb70d15a 4bb0e6d72582 Author: Dave Airlie Date: Fri Jan 18 09:14:34 2019 +1000 Merge tag 'drm-misc-fixes-2019-01-17' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes drm-misc-fixes for v5.0-rc3: - Add missing calls to of_node_put to sun4i, meson, and rockchip. - Drop unimplemented prime callbacks in virtio and qxl, so support for prime is not advertised on those drivers. - Fix mode switching regression in meson. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/9af07312-f435-2fda-65a2-9fe92cdf5da4@linux.intel.com commit 4ac4cb70d15a94a2b11a0cebeee90806013f3bd0 Merge: 586cdb0db70b 15c05196ff84 Author: Dave Airlie Date: Fri Jan 18 09:12:39 2019 +1000 Merge tag 'drm-intel-fixes-2019-01-17' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes drm/i915/gvt fixes for v5.0-rc3 "This contains one cmd parser failure fix to allow cmd access for one register, and fix region cleanup properly in vGPU destroy, and another fix for critical mmap size check mistake." Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87ef9bfusc.fsf@intel.com commit 586cdb0db70ba54482d8b217839d8fa4377ea077 Merge: 1c7fc5cbc339 35dad45d5cad Author: Dave Airlie Date: Fri Jan 18 09:10:09 2019 +1000 Merge branch 'drm-fixes-5.0' of git://people.freedesktop.org/~agd5f/linux into drm-fixes Fixes for 5.0: - Fix KFD on ARM64 - Fix KFD topology with mixed APU and dGPU systems - Powerplay fix for vega12 - DC Raven fixes - Freesync fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20190116224524.3314-1-alexander.deucher@amd.com commit f7c46156f4a9d6ba5c6bcc5c48945e87b0f08c65 Author: Alexey Kodanev Date: Wed Jan 16 19:17:45 2019 +0300 udp6: add missing rehash callback to udplite After commit 23b0269e58ae ("net: udp6: prefer listeners bound to an address"), UDP-Lite only works when specifying a local address for the sockets. This is related to the problem addressed in the commit 719f835853a9 ("udp: add rehash on connect()"). Moreover, __udp6_lib_lookup() now looks for a socket immediately in the secondary hash table. And this issue was found with LTP/network tests as well. Fixes: 23b0269e58ae ("net: udp6: prefer listeners bound to an address") Signed-off-by: Alexey Kodanev Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller net/ipv6/udp.c | 2 +- net/ipv6/udp_impl.h | 1 + net/ipv6/udplite.c | 1 + 3 files changed, 3 insertions(+), 1 deletion(-) commit 8f6b5392856a4b74224e257f3e0874a163b04603 Author: Alexey Kodanev Date: Wed Jan 16 19:17:44 2019 +0300 udp: add missing rehash callback to udplite After commit 4cdeeee9252a ("net: udp: prefer listeners bound to an address"), UDP-Lite only works when specifying a local address for the sockets. This is related to the problem addressed in the commit 719f835853a9 ("udp: add rehash on connect()"). Moreover, __udp4_lib_lookup() now looks for a socket immediately in the secondary hash table. The issue was found with LTP/network tests (UDP-Lite test-cases). Fixes: 4cdeeee9252a ("net: udp: prefer listeners bound to an address") Signed-off-by: Alexey Kodanev Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller net/ipv4/udp.c | 2 +- net/ipv4/udp_impl.h | 1 + net/ipv4/udplite.c | 1 + 3 files changed, 3 insertions(+), 1 deletion(-) commit 2cddd20147826aef283115abb00012d4dafe3cdb Author: Ivan Vecera Date: Wed Jan 16 16:53:52 2019 +0100 net/sched: cls_flower: allocate mask dynamically in fl_change() Recent changes (especially 05cd271fd61a ("cls_flower: Support multiple masks per priority")) in the fl_flow_mask structure grow it and its current size e.g. on x86_64 with defconfig is 760 bytes and more than 1024 bytes with some debug options enabled. Prior the mentioned commit its size was 176 bytes (using defconfig on x86_64). With regard to this fact it's reasonable to allocate this structure dynamically in fl_change() to reduce its stack size. v2: - use kzalloc() instead of kcalloc() Fixes: 05cd271fd61a ("cls_flower: Support multiple masks per priority") Cc: Jiri Pirko Cc: Paul Blakey Acked-by: Jiri Pirko Signed-off-by: Ivan Vecera Signed-off-by: David S. Miller net/sched/cls_flower.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) commit f731a8e89f8c78985707c626680f3e24c7a60772 Author: Vineet Gupta Date: Tue Dec 18 10:39:58 2018 -0800 ARC: show_regs: lockdep: re-enable preemption signal handling core calls show_regs() with preemption disabled which on ARC takes mmap_sem for mm/vma access, causing lockdep splat. | [ARCLinux]# ./segv-null-ptr | potentially unexpected fatal signal 11. | BUG: sleeping function called from invalid context at kernel/fork.c:1011 | in_atomic(): 1, irqs_disabled(): 0, pid: 70, name: segv-null-ptr | no locks held by segv-null-ptr/70. | CPU: 0 PID: 70 Comm: segv-null-ptr Not tainted 4.18.0+ #69 | | Stack Trace: | arc_unwind_core+0xcc/0x100 | ___might_sleep+0x17a/0x190 | mmput+0x16/0xb8 | show_regs+0x52/0x310 | get_signal+0x5ee/0x610 | do_signal+0x2c/0x218 | resume_user_mode_begin+0x90/0xd8 Workaround by re-enabling preemption temporarily. Note that the preemption disabling in core code around show_regs() was introduced by commit 3a9f84d354ce ("signals, debug: fix BUG: using smp_processor_id() in preemptible code in print_fatal_signal()") to silence a differnt lockdep seen on x86 bakc in 2009. Cc: Signed-off-by: Vineet Gupta arch/arc/kernel/troubleshoot.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit ab6c03676cb190156603cf4c5ecf97aa406c9c53 Author: Vineet Gupta Date: Mon Dec 17 14:11:19 2018 -0800 ARC: show_regs: lockdep: avoid page allocator... and use smaller/on-stack buffer instead The motivation for this change was lockdep splat like below. | potentially unexpected fatal signal 11. | BUG: sleeping function called from invalid context at ../mm/page_alloc.c:4317 | in_atomic(): 1, irqs_disabled(): 0, pid: 57, name: segv | no locks held by segv/57. | Preemption disabled at: | [<8182f17e>] get_signal+0x4a6/0x7c4 | CPU: 0 PID: 57 Comm: segv Not tainted 4.17.0+ #23 | | Stack Trace: | arc_unwind_core.constprop.1+0xd0/0xf4 | __might_sleep+0x1f6/0x234 | __get_free_pages+0x174/0xca0 | show_regs+0x22/0x330 | get_signal+0x4ac/0x7c4 # print_fatal_signals() -> preempt_disable() | do_signal+0x30/0x224 | resume_user_mode_begin+0x90/0xd8 So signal handling core calls show_regs() with preemption disabled but an ensuing GFP_KERNEL page allocator call is flagged by lockdep. We could have switched to GFP_NOWAIT, but turns out that is not enough anways and eliding page allocator call leads to less code and instruction traces to sift thru when debugging pesky crashes. FWIW, this patch doesn't cure the lockdep splat (which next patch does). Reviewed-by: William Kucharski Signed-off-by: Vineet Gupta arch/arc/kernel/troubleshoot.c | 26 ++++++++++++-------------- 1 file changed, 12 insertions(+), 14 deletions(-) commit 29133260f7c2e4ce50b4da6bf0674331bc0a4da5 Author: Eugeniy Paltsev Date: Thu Dec 13 19:56:21 2018 +0300 ARC: perf: avoid kernel killing where it is possible No, not gonna die tonight. Signed-off-by: Eugeniy Paltsev Signed-off-by: Vineet Gupta arch/arc/kernel/perf_event.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit baf9cc85ba01f32cf2ee79042a64b874a58cfb92 Author: Eugeniy Paltsev Date: Thu Dec 13 19:56:20 2018 +0300 ARC: perf: move HW events mapping to separate function Move HW events mapping to separate function to make code more readable. Signed-off-by: Eugeniy Paltsev Signed-off-by: Vineet Gupta arch/arc/kernel/perf_event.c | 48 ++++++++++++++++++++++++++++++-------------- 1 file changed, 33 insertions(+), 15 deletions(-) commit 0e956150fe09fa4430c42a9bbe48a72967fa0012 Author: Eugeniy Paltsev Date: Thu Dec 13 19:56:19 2018 +0300 ARC: perf: introduce Kernel PMU events support Export all available ARC architected hardware events as kernel PMU events to make non-generic events accessible. ARC PMU HW allow us to read the list of all available events names. So we generate kernel PMU event list dynamically in arc_pmu_device_probe() using human-readable events names we got from HW instead of using pre-defined events list. -------------------------->8-------------------------- $ perf list [snip] arc_pmu/bdata64/ [Kernel PMU event] arc_pmu/bdcstall/ [Kernel PMU event] arc_pmu/bdslot/ [Kernel PMU event] arc_pmu/bfbmp/ [Kernel PMU event] arc_pmu/bfirqex/ [Kernel PMU event] arc_pmu/bflgstal/ [Kernel PMU event] arc_pmu/bflush/ [Kernel PMU event] -------------------------->8-------------------------- Signed-off-by: Eugeniy Paltsev Signed-off-by: Vineet Gupta arch/arc/kernel/perf_event.c | 106 ++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 105 insertions(+), 1 deletion(-) commit 14f81a91ad29a57d6c3cf123ad9489f2ca9133fb Author: Eugeniy Paltsev Date: Thu Dec 13 19:56:18 2018 +0300 ARC: perf: trivial code cleanup * Use BIT(), lower_32_bits(), upper_32_bits() macroses, fix code style violations. * Use u32, u64, s64 instead of uint32_t, uint64_t, int64_t * Fix description comment as this code doesn't belong only to ARC700 anymore. * Use SPDX License Identifier. * Remove useless ifdefs. ifdef around 'arc_pmu_match' structure declaration is useless as we refer to 'arc_pmu_match' in several places which aren't guarded with ifdef. Nevertheless 'ARC' option selects 'OF' unconditionally so we can simply get rid of this ifdef. Acked-by: Vineet Gupta Signed-off-by: Eugeniy Paltsev Signed-off-by: Vineet Gupta arch/arc/kernel/perf_event.c | 85 ++++++++++++++++++++++---------------------- 1 file changed, 42 insertions(+), 43 deletions(-) commit 3affbf0e154ee351add6fcc254c59c3f3947fa8f Author: Eugeniy Paltsev Date: Mon Dec 17 12:54:23 2018 +0300 ARC: perf: map generic branches to correct hardware condition So far we've mapped branches to "ijmp" which also counts conditional branches NOT taken. This makes us different from other architectures such as ARM which seem to be counting only taken branches. So use "ijmptak" hardware condition which only counts (all jump instructions that are taken) 'ijmptak' event is available on both ARCompact and ARCv2 ISA based cores. Signed-off-by: Eugeniy Paltsev Cc: stable@vger.kernel.org Signed-off-by: Vineet Gupta [vgupta: reworked changelog] arch/arc/include/asm/perf_event.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit a3010a0465383300f909f62b8a83f83ffa7b2517 Author: Eugeniy Paltsev Date: Wed Dec 19 19:16:16 2018 +0300 ARC: adjust memblock_reserve of kernel memory In setup_arch_memory we reserve the memory area wherein the kernel is located. Current implementation may reserve more memory than it actually required in case of CONFIG_LINUX_LINK_BASE is not equal to CONFIG_LINUX_RAM_BASE. This happens because we calculate start of the reserved region relatively to the CONFIG_LINUX_RAM_BASE and end of the region relatively to the CONFIG_LINUX_RAM_BASE. For example in case of HSDK board we wasted 256MiB of physical memory: ------------------->8------------------------------ Memory: 770416K/1048576K available (5496K kernel code, 240K rwdata, 1064K rodata, 2200K init, 275K bss, 278160K reserved, 0K cma-reserved) ------------------->8------------------------------ Fix that. Fixes: 9ed68785f7f2b ("ARC: mm: Decouple RAM base address from kernel link addr") Cc: stable@vger.kernel.org #4.14+ Signed-off-by: Eugeniy Paltsev Signed-off-by: Vineet Gupta arch/arc/mm/init.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 76e6086760563164d91f61f1e3e58c6a2a031fa5 Author: Masahiro Yamada Date: Sun Dec 16 23:16:21 2018 +0900 arc: remove redundant kernel-space generic-y This commit removes redundant generic-y defines in arch/arc/include/asm/Kbuild. It is redundant to define generic-y when arch-specific implementation exists in arch/$(ARCH)/include/asm/*.h Remove the following generic-y: dma-mapping.h fb.h kmap_types.h pci.h Signed-off-by: Masahiro Yamada Signed-off-by: Vineet Gupta arch/arc/include/asm/Kbuild | 4 ---- 1 file changed, 4 deletions(-) commit 4e868f8419cb4cb558c5d428e7ab5629cef864c7 Author: Eugeniy Paltsev Date: Thu Dec 13 18:42:57 2018 +0300 ARC: fix __ffs return value to avoid build warnings | CC mm/nobootmem.o |In file included from ./include/asm-generic/bug.h:18:0, | from ./arch/arc/include/asm/bug.h:32, | from ./include/linux/bug.h:5, | from ./include/linux/mmdebug.h:5, | from ./include/linux/gfp.h:5, | from ./include/linux/slab.h:15, | from mm/nobootmem.c:14: |mm/nobootmem.c: In function '__free_pages_memory': |./include/linux/kernel.h:845:29: warning: comparison of distinct pointer types lacks a cast | (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) | ^ |./include/linux/kernel.h:859:4: note: in expansion of macro '__typecheck' | (__typecheck(x, y) && __no_side_effects(x, y)) | ^~~~~~~~~~~ |./include/linux/kernel.h:869:24: note: in expansion of macro '__safe_cmp' | __builtin_choose_expr(__safe_cmp(x, y), \ | ^~~~~~~~~~ |./include/linux/kernel.h:878:19: note: in expansion of macro '__careful_cmp' | #define min(x, y) __careful_cmp(x, y, <) | ^~~~~~~~~~~~~ |mm/nobootmem.c:104:11: note: in expansion of macro 'min' | order = min(MAX_ORDER - 1UL, __ffs(start)); Change __ffs return value from 'int' to 'unsigned long' as it is done in other implementations (like asm-generic, x86, etc...) to avoid build-time warnings in places where type is strictly checked. As __ffs may return values in [0-31] interval changing return type to unsigned is valid. Signed-off-by: Eugeniy Paltsev Signed-off-by: Vineet Gupta arch/arc/include/asm/bitops.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 7dd380c338f1ec20ed46607ccd03541a7683cd67 Author: Vineet Gupta Date: Wed Jan 9 09:36:00 2019 -0800 ARC: boot log: print Action point details This now prints the number of action points {2,4,8} and {min,full} targets supported. Signed-off-by: Vineet Gupta arch/arc/include/asm/arcregs.h | 10 +++++++++- arch/arc/kernel/setup.c | 22 +++++++++++++++------- 2 files changed, 24 insertions(+), 8 deletions(-) commit 97e981324d492340e33baa9680780046377b561f Author: Vineet Gupta Date: Thu Dec 6 00:17:50 2018 -0800 ARCv2: boot log: BPU return stack depth Signed-off-by: Vineet Gupta arch/arc/include/asm/arcregs.h | 2 +- arch/arc/kernel/setup.c | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-) commit 3f1bb6abdf19cfa89860b3bc9e7f31b44b6a0ba1 Author: Johan Hovold Date: Wed Jan 16 11:27:08 2019 +0100 net: dsa: realtek-smi: fix OF child-node lookup Use the new of_get_compatible_child() helper to look up child nodes to avoid ever matching non-child nodes elsewhere in the tree. Also fix up the related struct device_node leaks. Fixes: d8652956cf37 ("net: dsa: realtek-smi: Add Realtek SMI driver") Cc: stable # 4.19: 36156f9241cb0 Cc: Linus Walleij Signed-off-by: Johan Hovold Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/dsa/realtek-smi.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) commit 248b57015f35c94d4eae2fdd8c6febf5cd703900 Author: Kangjie Lu Date: Tue Dec 25 22:18:23 2018 -0600 leds: lp5523: fix a missing check of return value of lp55xx_read When lp55xx_read() fails, "status" is an uninitialized variable and thus may contain random value; using it leads to undefined behaviors. The fix inserts a check for the return value of lp55xx_read: if it fails, returns with its error code. Signed-off-by: Kangjie Lu Signed-off-by: Jacek Anaszewski drivers/leds/leds-lp5523.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit f422449b58548a41e98fc97b259a283718e527db Author: Cheng-Min Ao Date: Mon Jan 7 14:29:32 2019 +0800 hwmon: (tmp421) Correct the misspelling of the tmp442 compatible attribute in OF device ID table Correct a typo in OF device ID table The last one should be 'ti,tmp442' Signed-off-by: Cheng-Min Ao Signed-off-by: Yu-Hsiang Chen Signed-off-by: Guenter Roeck drivers/hwmon/tmp421.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f15f3eb26e8d9d25ea2330ed1273473df2f039df Author: Alex Deucher Date: Tue Jan 15 12:09:09 2019 -0500 drm/amdgpu: Add APTX quirk for Lenovo laptop Needs ATPX rather than _PR3 for dGPU power control. Bug: https://bugzilla.kernel.org/show_bug.cgi?id=202263 Reviewed-by: Jim Qu Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c | 1 + 1 file changed, 1 insertion(+) commit cb12d72b27a6f41325ae23a11033cf5fedfa1b97 Author: Colin Ian King Date: Tue Jan 15 18:03:38 2019 +0000 atm: he: fix sign-extension overflow on large shift Shifting the 1 by exp by an int can lead to sign-extension overlow when exp is 31 since 1 is an signed int and sign-extending this result to an unsigned long long will set the upper 32 bits. Fix this by shifting an unsigned long. Detected by cppcheck: (warning) Shifting signed 32-bit value by 31 bits is undefined behaviour Signed-off-by: Colin Ian King Signed-off-by: David S. Miller drivers/atm/he.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a3a80255d58d0f0d304ba877ae0313a264973a70 Merge: 6d060fa39035 34fa47612bfe Author: Linus Torvalds Date: Fri Jan 18 06:27:24 2019 +1200 Merge tag 'afs-fixes-20190117' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull AFS fixes from David Howells: "Here's a set of fixes for AFS: - Use struct_size() for kzalloc() size calculation. - When calling YFS.CreateFile rather than AFS.CreateFile, it is possible to create a file with a file lock already held. The default value indicating no lock required is actually -1, not 0. - Fix an oops in inode/vnode validation if the target inode doesn't have a server interest assigned (ie. a server that will notify us of changes by third parties). - Fix refcounting of keys in file locking. - Fix a race in refcounting asynchronous operations in the event of an error during request transmission. The provision of a dedicated function to get an extra ref on a call is split into a separate commit" * tag 'afs-fixes-20190117' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: afs: Fix race in async call refcounting afs: Provide a function to get a ref on a call afs: Fix key refcounting in file locking code afs: Don't set vnode->cb_s_break in afs_validate() afs: Set correct lock type for the yfs CreateFile afs: Use struct_size() in kzalloc() commit 6d060fa39035d5ff6bb3e720a8119aeb50453e3b Merge: e4484a495586 227a76b64718 Author: Linus Torvalds Date: Fri Jan 18 06:22:08 2019 +1200 Merge branch 'stable/for-linus-5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/swiotlb Pull swiotlb fix from Konrad Rzeszutek Wilk: "A tiny fix for v5.0-rc2: This fixes an issue with GPU cards not working anymore with the DMA mapping work Christopher did - as the SWIOTLB is initialized first and then free'd (as IOMMU is available) but we forgot to clear our start and end entries which are used and BOOM" * 'stable/for-linus-5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/swiotlb: swiotlb: clear io_tlb_start and io_tlb_end in swiotlb_exit commit e4484a495586dddf989380f89a7c16d43db6790b Merge: d471c4dfa19f e00d88804814 Author: Linus Torvalds Date: Fri Jan 18 06:20:09 2019 +1200 Merge tag 'kbuild-fixes-v5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: - clean generated files in scripts/kconfig/ by 'make mrproper' - fix conflict between dead code elimination and ftrace for GCC <= 4.7 - fix external module build with CONFIG_STACKPROTECTOR - remove unused code * tag 'kbuild-fixes-v5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kbuild: mark prepare0 as PHONY to fix external module build openrisc: remove unneeded code in arch/openrisc/Makefile nds32: remove unneeded code in arch/nds32/Makefile ia64: remove redundant 'export AWK' kbuild: remove unused archmrproper kbuild: remove unused baseprereq kbuild: Disable LD_DEAD_CODE_DATA_ELIMINATION with ftrace & GCC <= 4.7 kconfig: clean generated *conf-cfg files commit d471c4dfa19f4d6de063256370a5be411a1f3149 Merge: 7fbfee7c80de 3705add0b783 Author: Linus Torvalds Date: Fri Jan 18 06:15:28 2019 +1200 Merge tag 'devicetree-fixes-for-5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull Devicetree fixes from Rob Herring: - Remove now unused struct device_node.type pointer - Fix meson-axg reset header SPDX tag - Add missing of_node_put in of_graph_get_remote_port_parent - Fix several binding doc file references and typos * tag 'devicetree-fixes-for-5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: dt-bindings: reset: meson-axg: fix SPDX license id dt-bindings: soc: qcom: Fix trivial language typos doc: gpio-mvebu: fix broken reference to cp110-system-controller0.txt file OF: properties: add missing of_node_put doc: bindings: fix bad reference to ARM CPU bindings dt-bindings: marvell,mmp2: fix typos in bindings doc of: Remove struct device_node.type pointer commit 3d244c192afeee7dd4f5fb1b916ea4e47420d401 Author: Kees Cook Date: Wed Jan 16 16:35:25 2019 -0800 selftests/seccomp: Abort without user notification support In the face of missing user notification support, the self test needs to stop executing a test (ASSERT_*) instead of just reporting and continuing (EXPECT_*). This adjusts the user notification tests to do that where needed. Reported-by: Shuah Khan Fixes: 6a21cc50f0c7 ("seccomp: add a return code to trap to userspace") Signed-off-by: Kees Cook Reviewed-by: Tycho Andersen Tested-by: Shuah Khan Signed-off-by: Shuah Khan tools/testing/selftests/seccomp/seccomp_bpf.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 6a4c9ab13feeacd3072175d7d1f1fcfabbb9fc90 Author: Sai Prakash Ranjan Date: Thu Jan 17 09:09:29 2019 -0800 pstore/ram: Fix console ramoops to show the previous boot logs commit b05c950698fe ("pstore/ram: Simplify ramoops_get_next_prz() arguments") changed update assignment in getting next persistent ram zone by adding a check for record type. But the check always returns true since the record type is assigned 0. And this breaks console ramoops by showing current console log instead of previous log on warm reset and hard reset (actually hard reset should not be showing any logs). Fix this by having persistent ram zone type check instead of record type check. Tested this on SDM845 MTP and dragonboard 410c. Reproducing this issue is simple as below: 1. Trigger hard reset and mount pstore. Will see console-ramoops record in the mounted location which is the current log. 2. Trigger warm reset and mount pstore. Will see the current console-ramoops record instead of previous record. Fixes: b05c950698fe ("pstore/ram: Simplify ramoops_get_next_prz() arguments") Signed-off-by: Sai Prakash Ranjan Acked-by: Joel Fernandes (Google) [kees: dropped local variable usage] Signed-off-by: Kees Cook fs/pstore/ram.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 8fa4e55bbfbfca3ad996517f679ab3648c03d8bb Author: Linus Walleij Date: Thu Jan 3 11:26:23 2019 +0100 irqchip/madera: Drop GPIO includes This irqchip does not use anything GPIO-related so drop the GPIO includes. Signed-off-by: Linus Walleij Acked-by: Richard Fitzgerald Signed-off-by: Marc Zyngier drivers/irqchip/irq-madera.c | 2 -- 1 file changed, 2 deletions(-) commit c530bb8a726a37811e9fb5d68cd6b5408173b545 Author: Yang Yingliang Date: Fri Oct 26 15:51:17 2018 +0800 irqchip/gic-v3-mbi: Fix uninitialized mbi_lock The mbi_lock mutex is left uninitialized, so let's use DEFINE_MUTEX to initialize it statically. Fixes: 505287525c24d ("irqchip/gic-v3: Add support for Message Based Interrupts as an MSI controller") Signed-off-by: Yang Yingliang Signed-off-by: Marc Zyngier drivers/irqchip/irq-gic-v3-mbi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1d47f48bf2d1608c2d6eb76b3ec7a5ec0c3f9e95 Author: Loic Pallardy Date: Fri Jan 11 18:54:31 2019 +0100 irqchip/stm32-exti: Add domain translate function Domain translate function is needed to recover irq configuration parameters from DT node Fixes: 927abfc4461e ("irqchip/stm32: Add stm32mp1 support with hierarchy domain") Signed-off-by: Loic Pallardy Signed-off-by: Marc Zyngier drivers/irqchip/irq-stm32-exti.c | 1 + 1 file changed, 1 insertion(+) commit 4dcf9ddc9ad5ab649abafa98c5a4d54b1a33dabb Author: Charles Yeh Date: Tue Jan 15 23:13:56 2019 +0800 USB: serial: pl2303: add new PID to support PL2303TB Add new PID to support PL2303TB (TYPE_HX) Signed-off-by: Charles Yeh Cc: stable Signed-off-by: Johan Hovold drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 2 ++ 2 files changed, 3 insertions(+) commit 0722069a5374b904ec1a67f91249f90e1cfae259 Author: Andreas Ziegler Date: Wed Jan 16 15:16:29 2019 +0100 tracing/uprobes: Fix output for multiple string arguments When printing multiple uprobe arguments as strings the output for the earlier arguments would also include all later string arguments. This is best explained in an example: Consider adding a uprobe to a function receiving two strings as parameters which is at offset 0xa0 in strlib.so and we want to print both parameters when the uprobe is hit (on x86_64): $ echo 'p:func /lib/strlib.so:0xa0 +0(%di):string +0(%si):string' > \ /sys/kernel/debug/tracing/uprobe_events When the function is called as func("foo", "bar") and we hit the probe, the trace file shows a line like the following: [...] func: (0x7f7e683706a0) arg1="foobar" arg2="bar" Note the extra "bar" printed as part of arg1. This behaviour stacks up for additional string arguments. The strings are stored in a dynamically growing part of the uprobe buffer by fetch_store_string() after copying them from userspace via strncpy_from_user(). The return value of strncpy_from_user() is then directly used as the required size for the string. However, this does not take the terminating null byte into account as the documentation for strncpy_from_user() cleary states that it "[...] returns the length of the string (not including the trailing NUL)" even though the null byte will be copied to the destination. Therefore, subsequent calls to fetch_store_string() will overwrite the terminating null byte of the most recently fetched string with the first character of the current string, leading to the "accumulation" of strings in earlier arguments in the output. Fix this by incrementing the return value of strncpy_from_user() by one if we did not hit the maximum buffer size. Link: http://lkml.kernel.org/r/20190116141629.5752-1-andreas.ziegler@fau.de Cc: Ingo Molnar Cc: stable@vger.kernel.org Fixes: 5baaa59ef09e ("tracing/probes: Implement 'memory' fetch method for uprobes") Acked-by: Masami Hiramatsu Signed-off-by: Andreas Ziegler Signed-off-by: Steven Rostedt (VMware) kernel/trace/trace_uprobe.c | 7 +++++++ 1 file changed, 7 insertions(+) commit c61c27687a5abce11431e6de1adb6e36099b9859 Author: Mathieu Malaterre Date: Wed Jan 16 20:35:41 2019 +0100 bpf: Correctly annotate implicit fall through in bpf_base_func_proto There is a plan to build the kernel with -Wimplicit-fallthrough and this place in the code produced a warnings (W=1). To preserve as much of the existing comment only change a ‘:’ into a ‘,’. This is enough change, to match the regular expression expected by GCC. This commit removes the following warning: net/core/filter.c:5310:6: warning: this statement may fall through [-Wimplicit-fallthrough=] Signed-off-by: Mathieu Malaterre Signed-off-by: Daniel Borkmann net/core/filter.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c8dc79806e7f6cb6b0952aae1ce626c39905ad7e Author: Mathieu Malaterre Date: Wed Jan 16 20:35:29 2019 +0100 bpf: Annotate implicit fall through in cgroup_dev_func_proto There is a plan to build the kernel with -Wimplicit-fallthrough and this place in the code produced a warnings (W=1). This commit removes the following warning: kernel/bpf/cgroup.c:719:6: warning: this statement may fall through [-Wimplicit-fallthrough=] Signed-off-by: Mathieu Malaterre Signed-off-by: Daniel Borkmann kernel/bpf/cgroup.c | 1 + 1 file changed, 1 insertion(+) commit 583c53185399cea5c51195064564d1c9ddc70cf3 Author: Mathieu Malaterre Date: Wed Jan 16 20:29:40 2019 +0100 bpf: Make function btf_name_offset_valid static Initially in commit 69b693f0aefa ("bpf: btf: Introduce BPF Type Format (BTF)") the function 'btf_name_offset_valid' was introduced as static function it was later on changed to a non-static one, and then finally in commit 23127b33ec80 ("bpf: Create a new btf_name_by_offset() for non type name use case") the function prototype was removed. Revert back to original implementation and make the function static. Remove warning triggered with W=1: kernel/bpf/btf.c:470:6: warning: no previous prototype for 'btf_name_offset_valid' [-Wmissing-prototypes] Fixes: 23127b33ec80 ("bpf: Create a new btf_name_by_offset() for non type name use case") Signed-off-by: Mathieu Malaterre Acked-by: Martin KaFai Lau Signed-off-by: Daniel Borkmann kernel/bpf/btf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f67ad87ab3120e82845521b18a2b99273a340308 Author: Stanislav Fomichev Date: Wed Jan 16 14:03:17 2019 -0800 selftests/bpf: retry tests that expect build-id While running test_progs in a loop I found out that I'm sometimes hitting "Didn't find expected build ID from the map" error. Looking at stack_map_get_build_id_offset() it seems that it is racy (by design) and can sometimes return BPF_STACK_BUILD_ID_IP (i.e. can't trylock current->mm->mmap_sem). Let's retry this test a single time. Fixes: 13790d1cc72c ("bpf: add selftest for stackmap with build_id in NMI context") Acked-by: Song Liu Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann tools/testing/selftests/bpf/test_progs.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) commit 4af396ae4836c4ecab61e975b8e61270c551894d Author: Stanislav Fomichev Date: Wed Jan 16 14:03:16 2019 -0800 bpf: zero out build_id for BPF_STACK_BUILD_ID_IP When returning BPF_STACK_BUILD_ID_IP from stack_map_get_build_id_offset, make sure that build_id field is empty. Since we are using percpu free list, there is a possibility that we might reuse some previous bpf_stack_build_id with non-zero build_id. Fixes: 615755a77b24 ("bpf: extend stackmap to save binary_build_id+offset instead of address") Acked-by: Song Liu Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann kernel/bpf/stackmap.c | 2 ++ 1 file changed, 2 insertions(+) commit 0b698005a9d11c0e91141ec11a2c4918a129f703 Author: Stanislav Fomichev Date: Wed Jan 16 14:03:15 2019 -0800 bpf: don't assume build-id length is always 20 bytes Build-id length is not fixed to 20, it can be (`man ld` /--build-id): * 128-bit (uuid) * 160-bit (sha1) * any length specified in ld --build-id=0xhexstring To fix the issue of missing BPF_STACK_BUILD_ID_VALID for shorter build-ids, assume that build-id is somewhere in the range of 1 .. 20. Set the remaining bytes to zero. v2: * don't introduce new "len = min(BPF_BUILD_ID_SIZE, nhdr->n_descsz)", we already know that nhdr->n_descsz <= BPF_BUILD_ID_SIZE if we enter this 'if' condition Fixes: 615755a77b24 ("bpf: extend stackmap to save binary_build_id+offset instead of address") Acked-by: Song Liu Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann kernel/bpf/stackmap.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 34fa47612bfe5d7de7fcaf658a6952b6aeec3b13 Author: David Howells Date: Thu Jan 10 15:40:50 2019 +0000 afs: Fix race in async call refcounting There's a race between afs_make_call() and afs_wake_up_async_call() in the case that an error is returned from rxrpc_kernel_send_data() after it has queued the final packet. afs_make_call() will try and clean up the mess, but the call state may have been moved on thereby causing afs_process_async_call() to also try and to delete the call. Fix this by: (1) Getting an extra ref for an asynchronous call for the call itself to hold. This makes sure the call doesn't evaporate on us accidentally and will allow the call to be retained by the caller in a future patch. The ref is released on leaving afs_make_call() or afs_wait_for_call_to_complete(). (2) In the event of an error from rxrpc_kernel_send_data(): (a) Don't set the call state to AFS_CALL_COMPLETE until *after* the call has been aborted and ended. This prevents afs_deliver_to_call() from doing anything with any notifications it gets. (b) Explicitly end the call immediately to prevent further callbacks. (c) Cancel any queued async_work and wait for the work if it's executing. This allows us to be sure the race won't recur when we change the state. We put the work queue's ref on the call if we managed to cancel it. (d) Put the call's ref that we got in (1). This belongs to us as long as the call is in state AFS_CALL_CL_REQUESTING. Fixes: 341f741f04be ("afs: Refcount the afs_call struct") Signed-off-by: David Howells fs/afs/rxrpc.c | 35 ++++++++++++++++++++++++++++++----- include/trace/events/afs.h | 2 ++ 2 files changed, 32 insertions(+), 5 deletions(-) commit 7a75b0079a1d54e342c502c3c8107ba97e05d3d3 Author: David Howells Date: Thu Jan 10 15:14:29 2019 +0000 afs: Provide a function to get a ref on a call Provide a function to get a reference on an afs_call struct. Signed-off-by: David Howells fs/afs/rxrpc.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) commit 59d49076ae3e6912e6d7df2fd68e2337f3d02036 Author: David Howells Date: Wed Jan 9 17:23:54 2019 +0000 afs: Fix key refcounting in file locking code Fix the refcounting of the authentication keys in the file locking code. The vnode->lock_key member points to a key on which it expects to be holding a ref, but it isn't always given an extra ref, however. Fixes: 0fafdc9f888b ("afs: Fix file locking") Signed-off-by: David Howells fs/afs/flock.c | 4 ++-- fs/afs/inode.c | 2 ++ 2 files changed, 4 insertions(+), 2 deletions(-) commit 4882a27cec24319d10f95e978ecc80050e3e3e15 Author: Marc Dionne Date: Wed Jan 9 17:23:54 2019 +0000 afs: Don't set vnode->cb_s_break in afs_validate() A cb_interest record is not necessarily attached to the vnode on entry to afs_validate(), which can cause an oops when we try to bring the vnode's cb_s_break up to date in the default case (ie. no current callback promise and the vnode has not been deleted). Fix this by simply removing the line, as vnode->cb_s_break will be set when needed by afs_register_server_cb_interest() when we next get a callback promise from RPC call. The oops looks something like: BUG: unable to handle kernel NULL pointer dereference at 0000000000000018 ... RIP: 0010:afs_validate+0x66/0x250 [kafs] ... Call Trace: afs_d_revalidate+0x8d/0x340 [kafs] ? __d_lookup+0x61/0x150 lookup_dcache+0x44/0x70 ? lookup_dcache+0x44/0x70 __lookup_hash+0x24/0xa0 do_unlinkat+0x11d/0x2c0 __x64_sys_unlink+0x23/0x30 do_syscall_64+0x4d/0xf0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fixes: ae3b7361dc0e ("afs: Fix validation/callback interaction") Signed-off-by: Marc Dionne Signed-off-by: David Howells fs/afs/inode.c | 1 - 1 file changed, 1 deletion(-) commit ea6eb5e7d15e1838de335609994b4546e2abcaaf Author: Andreas Ziegler Date: Thu Jan 17 14:30:23 2019 +0100 tracing: uprobes: Fix typo in pr_fmt string The subsystem-specific message prefix for uprobes was also "trace_kprobe: " instead of "trace_uprobe: " as described in the original commit message. Link: http://lkml.kernel.org/r/20190117133023.19292-1-andreas.ziegler@fau.de Cc: Ingo Molnar Cc: stable@vger.kernel.org Acked-by: Masami Hiramatsu Fixes: 7257634135c24 ("tracing/probe: Show subsystem name in messages") Signed-off-by: Andreas Ziegler Signed-off-by: Steven Rostedt (VMware) kernel/trace/trace_uprobe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d2fd6e81912a665993b24dcdc1c1384a42a54f7e Author: Logan Gunthorpe Date: Thu Jan 17 08:46:34 2019 -0600 PCI: Fix __initdata issue with "pci=disable_acs_redir" parameter The disable_acs_redir parameter stores a pointer to the string passed to pci_setup(). However, the string passed to PCI setup is actually a temporary copy allocated in static __initdata memory. After init, once the memory is freed, it is no longer valid to reference this pointer. This bug was noticed in v5.0-rc1 after a change in commit c5eb1190074c ("PCI / PM: Allow runtime PM without callback functions") caused pci_disable_acs_redir() to be called during shutdown which manifested as an unable to handle kernel paging request at: RIP: 0010:pci_enable_acs+0x3f/0x1e0 Call Trace: pci_restore_state.part.44+0x159/0x3c0 pci_restore_standard_config+0x33/0x40 pci_pm_runtime_resume+0x2b/0xd0 ? pci_restore_standard_config+0x40/0x40 __rpm_callback+0xbc/0x1b0 rpm_callback+0x1f/0x70 ? pci_restore_standard_config+0x40/0x40 rpm_resume+0x4f9/0x710 ? pci_conf1_read+0xb6/0xf0 ? pci_conf1_write+0xb2/0xe0 __pm_runtime_resume+0x47/0x70 pci_device_shutdown+0x1e/0x60 device_shutdown+0x14a/0x1f0 kernel_restart+0xe/0x50 __do_sys_reboot+0x1ee/0x210 ? __fput+0x144/0x1d0 do_writev+0x5e/0xf0 ? do_writev+0x5e/0xf0 do_syscall_64+0x48/0xf0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 It was also likely possible to trigger this bug when hotplugging PCI devices. To fix this, instead of storing a pointer, we use kstrdup() to copy the disable_acs_redir_param to its own buffer which will never be freed. Fixes: aaca43fda742 ("PCI: Add "pci=disable_acs_redir=" parameter for peer-to-peer support") Tested-by: Jarkko Nikula Signed-off-by: Logan Gunthorpe Signed-off-by: Bjorn Helgaas Reviewed-by: Jarkko Nikula drivers/pci/pci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit e00d8880481497474792d28c14479a9fb6752046 Author: Masahiro Yamada Date: Tue Jan 15 16:19:00 2019 +0900 kbuild: mark prepare0 as PHONY to fix external module build Commit c3ff2a5193fa ("powerpc/32: add stack protector support") caused kernel panic on PowerPC when an external module is used with CONFIG_STACKPROTECTOR because the 'prepare' target was not executed for the external module build. Commit e07db28eea38 ("kbuild: fix single target build for external module") turned it into a build error because the 'prepare' target is now executed but the 'prepare0' target is missing for the external module build. External module on arm/arm64 with CONFIG_STACKPROTECTOR_PER_TASK is also broken in the same way. Move 'PHONY += prepare0' to the common place. GNU Make is fine with missing rule for phony targets. I also removed the comment which is wrong irrespective of this commit. I minimize the change so it can be easily backported to 4.20.x To fix v4.20, please backport e07db28eea38 ("kbuild: fix single target build for external module"), and then this commit. Link: https://bugzilla.kernel.org/show_bug.cgi?id=201891 Fixes: e07db28eea38 ("kbuild: fix single target build for external module") Fixes: c3ff2a5193fa ("powerpc/32: add stack protector support") Fixes: 189af4657186 ("ARM: smp: add support for per-task stack canaries") Fixes: 0a1213fa7432 ("arm64: enable per-task stack canaries") Cc: linux-stable # v4.20 Reported-by: Samuel Holland Reported-by: Alexey Kardashevskiy Signed-off-by: Masahiro Yamada Acked-by: Ard Biesheuvel Tested-by: Alexey Kardashevskiy Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 1b504a7bb18fc32a324712a0fc56d667bdabe258 Author: Masahiro Yamada Date: Tue Jan 15 04:14:23 2019 +0900 openrisc: remove unneeded code in arch/openrisc/Makefile - LDFLAGS_vmlinux is cleared by the top Makefile - 'all: vmlinux' is specified by the top Makefile Signed-off-by: Masahiro Yamada arch/openrisc/Makefile | 3 --- 1 file changed, 3 deletions(-) commit 558ee616d177c8225e65c75b6b72952408e64a74 Author: Masahiro Yamada Date: Mon Jan 14 17:44:40 2019 +0900 nds32: remove unneeded code in arch/nds32/Makefile - scripts/Kbuild.include already defined 'comma' - The top Makefile has 'PHONY += FORCE' - include/asm-*/ was moved to arch/*/include/asm/ a decade ago Signed-off-by: Masahiro Yamada arch/nds32/Makefile | 8 -------- 1 file changed, 8 deletions(-) commit 99d86c8b88393e29cf07c020585f2c8afbcdd97d Author: Jiri Olsa Date: Thu Jan 17 12:30:17 2019 +0100 perf ordered_events: Fix crash in ordered_events__free Song Liu reported crash in 'perf record': > #0 0x0000000000500055 in ordered_events(float, long double,...)(...) () > #1 0x0000000000500196 in ordered_events.reinit () > #2 0x00000000004fe413 in perf_session.process_events () > #3 0x0000000000440431 in cmd_record () > #4 0x00000000004a439f in run_builtin () > #5 0x000000000042b3e5 in main ()" This can happen when we get out of buffers during event processing. The subsequent ordered_events__free() call assumes oe->buffer != NULL and crashes. Add a check to prevent that. Reported-by: Song Liu Signed-off-by: Jiri Olsa Reviewed-by: Song Liu Tested-by: Song Liu Cc: Alexander Shishkin Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Link: http://lkml.kernel.org/r/20190117113017.12977-1-jolsa@kernel.org Fixes: d5ceb62b3654 ("perf ordered_events: Add 'struct ordered_events_buffer' layer") Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/ordered-events.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit bb867d219fda7fbaabea3314702474c4eac2b91d Author: Steve Longerbeam Date: Tue Oct 16 17:31:40 2018 -0700 gpu: ipu-v3: Fix CSI offsets for imx53 The CSI offsets are wrong for both CSI0 and CSI1. They are at physical address 0x1e030000 and 0x1e038000 respectively. Fixes: 2ffd48f2e7 ("gpu: ipu-v3: Add Camera Sensor Interface unit") Signed-off-by: Steve Longerbeam Signed-off-by: Philipp Zabel drivers/gpu/ipu-v3/ipu-common.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit aa3312012f103f91f123600bbf768b11c8f431bc Author: Julia Lawall Date: Sun Jan 13 09:47:42 2019 +0100 drm/imx: imx-ldb: add missing of_node_puts The device node iterators perform an of_node_get on each iteration, so a jump out of the loop requires an of_node_put. Move the initialization channel->child = child; down to just before the call to imx_ldb_register so that intervening failures don't need to clear it. Add a label at the end of the function to do all the of_node_puts. The semantic patch that finds part of this problem is as follows (http://coccinelle.lip6.fr): // @@ expression root,e; local idexpression child; iterator name for_each_child_of_node; @@ for_each_child_of_node(root, child) { ... when != of_node_put(child) when != e = child ( return child; | * return ...; ) ... } // Signed-off-by: Julia Lawall Signed-off-by: Philipp Zabel drivers/gpu/drm/imx/imx-ldb.c | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-) commit 2c0408dd0d8906b26fe8023889af7adf5e68b2c2 Author: Alexander Shiyan Date: Thu Dec 20 11:06:38 2018 +0300 gpu: ipu-v3: Fix i.MX51 CSI control registers offset The CSI0/CSI1 registers offset is at +0xe030000/+0xe038000 relative to the control module registers on IPUv3EX. This patch fixes wrong values for i.MX51 CSI0/CSI1. Fixes: 2ffd48f2e7 ("gpu: ipu-v3: Add Camera Sensor Interface unit") Signed-off-by: Alexander Shiyan Signed-off-by: Philipp Zabel drivers/gpu/ipu-v3/ipu-common.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 87b6d2c56825c3119a0e64cc208ae6d795810a2e Author: Minas Harutyunyan Date: Wed Dec 12 16:44:32 2018 +0400 usb: dwc2: gadget: Fix Remote Wakeup interrupt bit clearing To clear GINTSTS2_WKUP_ALERT_INT bit in GINTSTS2 register require to write 1. This bit is implemented as "Write to clear". Fixes: 187c5298a122 ("usb: dwc2: gadget: Add handler for WkupAlert interrupt") Signed-off-by: Minas Harutyunyan Signed-off-by: Felipe Balbi drivers/usb/dwc2/gadget.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 05c8478abd485507c25aa565afab604af8d8fe46 Author: Geert Uytterhoeven Date: Thu Jan 10 14:39:16 2019 +0100 arm64: dts: renesas: r8a77965: Enable DMA for SCIF2 SCIF2 on R-Car M3-N can be used with both DMAC1 and DMAC2. Fixes: 0ea5b2fd38db56aa ("arm64: dts: renesas: r8a77965: Add SCIF device nodes") Signed-off-by: Geert Uytterhoeven Signed-off-by: Simon Horman arch/arm64/boot/dts/renesas/r8a77965.dtsi | 3 +++ 1 file changed, 3 insertions(+) commit 97f26702bc95b5c3a72671d5c6675e4d6ee0a2f4 Author: Geert Uytterhoeven Date: Thu Jan 10 14:39:15 2019 +0100 arm64: dts: renesas: r8a7796: Enable DMA for SCIF2 SCIF2 on R-Car M3-W can be used with both DMAC1 and DMAC2. Fixes: dbcae5ea4bd27409 ("arm64: dts: r8a7796: Enable SCIF DMA") Signed-off-by: Geert Uytterhoeven Signed-off-by: Simon Horman arch/arm64/boot/dts/renesas/r8a7796.dtsi | 3 +++ 1 file changed, 3 insertions(+) commit 2bb7b675248c3ad11ada0ce3d0f6d480ec8cc87b Author: Geert Uytterhoeven Date: Thu Jan 10 14:39:13 2019 +0100 arm64: dts: renesas: r8a774a1: Enable DMA for SCIF2 SCIF2 on RZ/G2M can be used with both DMAC1 and DMAC2. Fixes: 3a3933a4fa36430a ("arm64: dts: renesas: r8a774a1: Add SCIF and HSCIF nodes") Signed-off-by: Geert Uytterhoeven Signed-off-by: Simon Horman arch/arm64/boot/dts/renesas/r8a774a1.dtsi | 3 +++ 1 file changed, 3 insertions(+) commit e3966a766865da7ced1dece663697861dd5cf103 Author: Bartosz Golaszewski Date: Fri Jan 11 18:21:18 2019 +0100 ARM: dts: da850: fix interrupt numbers for clocksource The timer interrupts specified in commit 3652e2741f42 ("ARM: dts: da850: Add clocks") are wrong but since the current timer code hard-codes them, the bug was never spotted. This patch must go into stable since, once we introduce a proper clocksource driver, devices with buggy device tree will stop booting. Fixes: 3652e2741f42 ("ARM: dts: da850: Add clocks") Cc: stable@vger.kernel.org Signed-off-by: Bartosz Golaszewski Signed-off-by: Sekhar Nori arch/arm/boot/dts/da850.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit edcddd4c879af48ec922d680b2d56834c085683b Author: Dan Carpenter Date: Thu Jan 17 07:15:35 2019 -0500 XArray: Fix an arithmetic error in xa_is_err There is a math problem here which leads to a lot of static checker warnings for me: net/sunrpc/clnt.c:451 rpc_new_client() error: (-4096) too low for ERR_PTR Error values are from -1 to -4095 or from 0xffffffff to 0xfffff001 in hexadecimal. (I am assuming a 32 bit system for simplicity). We are using the lowest two bits to hold some internal XArray data so the error is shifted two spaces to the left. 0xfffff001 << 2 is 0xffffc004. And finally we want to check that BIT(1) is set so we add 2 which gives us 0xffffc006. In other words, we should be checking that "entry >= 0xffffc006", but the check is actually testing if "entry >= 0xffffc002". Fixes: 76b4e5299565 ("XArray: Permit storing 2-byte-aligned pointers") Signed-off-by: Dan Carpenter [Use xa_mk_internal() instead of changing the bracketing] Signed-off-by: Matthew Wilcox include/linux/xarray.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 15c05196ff84ab07d9b1d05289216de2d5bedcd7 Merge: 1c7fc5cbc339 51b00d8509dc Author: Jani Nikula Date: Thu Jan 17 11:49:51 2019 +0200 Merge tag 'gvt-fixes-2018-01-17' of https://github.com/intel/gvt-linux into drm-intel-fixes gvt-fixes-2018-01-17 - Fix one register cmd parser failure (Colin) - Fix region cleanup for vGPU destroy (Henry) - Fix mmap size check (Zhenyu) Signed-off-by: Jani Nikula From: Zhenyu Wang Link: https://patchwork.freedesktop.org/patch/msgid/20190117074604.GI18272@zhen-hp.sh.intel.com commit ec87da107d11521123beaa9f8e4869c6f54e8df8 Author: Lubomir Rintel Date: Wed Jan 16 23:09:31 2019 -0800 Input: olpc_apsp - assign priv->dev earlier The dev field needs to be set when serio_register_port() is called, because the open callback may use it (in the error handling path). Fixes: commit af518342effd ("Input: olpc_apsp - check FIFO status on open(), not probe()") Signed-off-by: Lubomir Rintel Signed-off-by: Dmitry Torokhov drivers/input/serio/olpc_apsp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 7fbfee7c80ded94278f109aae4063741c323294a Merge: 47bfa6d9dc8c a5795fd38ee8 Author: Linus Torvalds Date: Thu Jan 17 16:54:58 2019 +1200 Merge branch 'fixes-v5.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security Pull security subsystem fixes from James Morris: "Fixes for the security subsystem. The first (by Casey actually - it's misattributed) fixes a regression introduced with the LSM stacking changes" * 'fixes-v5.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: LSM: Check for NULL cred-security on free Yama: Check for pid death before checking ancestry seccomp: fix UAF in user-trap code commit 0f149c9fec3cd720628ecde83bfc6f64c1e7dcb6 Author: Willem de Bruijn Date: Tue Jan 15 11:40:02 2019 -0500 udp: with udp_segment release on error path Failure __ip_append_data triggers udp_flush_pending_frames, but these tests happen later. The skb must be freed directly. Fixes: bec1f6f697362 ("udp: generate gso with UDP_SEGMENT") Reported-by: Eric Dumazet Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller net/ipv4/udp.c | 16 ++++++++++++---- net/ipv6/udp.c | 16 ++++++++++++---- 2 files changed, 24 insertions(+), 8 deletions(-) commit 1a9352687c19e4937d861ff2c5c6fc45c0a08aff Author: Taehee Yoo Date: Wed Jan 16 01:35:22 2019 +0900 net: bpfilter: change section name of bpfilter UMH blob. The section of bpfilter UMH blob is the ".bpfilter_umh". but this is not an explicit section. so linking warning occurred at compile time for the powerpc. So, this patch makes use of the ".rodata" instead of the ".bpfilter_umh". Config condition: CONFIG_BPFILTER=y CONFIG_BPFILTER_UMH=y Result: ld: warning: orphan section `.bpfilter_umh' from `net/bpfilter/bpfilter_umh_blob.o' being placed in section `.bpfilter_umh' Fixes: 61fbf5933d42 ("net: bpfilter: restart bpfilter_umh when error occurred") Reported-by: Stephen Rothwell Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller net/bpfilter/bpfilter_umh_blob.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a5795fd38ee8194451ba3f281f075301a3696ce2 Author: James Morris Date: Wed Jan 16 15:41:11 2019 -0800 LSM: Check for NULL cred-security on free From: Casey Schaufler Check that the cred security blob has been set before trying to clean it up. There is a case during credential initialization that could result in this. Signed-off-by: Casey Schaufler Acked-by: John Johansen Signed-off-by: James Morris Reported-by: syzbot+69ca07954461f189e808@syzkaller.appspotmail.com security/security.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 9e857a40dc4eba15a739b4194d7db873d82c28a0 Author: Andrew Lunn Date: Tue Jan 15 16:55:30 2019 +0100 net: phy: Add missing features to PHY drivers The bcm87xx and micrel driver has PHYs which are missing the .features value. Add them. The bcm87xx is a 10G FEC only PHY. Add the needed features definition of this PHY. Fixes: 719655a14971 ("net: phy: Replace phy driver features u32 with link_mode bitmap") Reported-by: Scott Wood Reported-by: Camelia Groza Signed-off-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/phy/bcm87xx.c | 2 ++ drivers/net/phy/micrel.c | 1 + drivers/net/phy/phy_device.c | 12 ++++++++++++ include/linux/phy.h | 2 ++ 4 files changed, 17 insertions(+) commit 35dad45d5cad3c9ca8d6a338cbf668cd7ea86469 Author: David Francis Date: Tue Nov 20 09:42:58 2018 -0500 drm/amd/display: Detach backlight from stream [Why] Backlight is conceptually a property of links, not streams. All backlight programming is done on links, but there is a stream property bl_pwm_level that is used to restore backlight on dpms on and s3 resume. This is unnecessary, as backlight is already restored by hardware with no driver intervention. [How] Remove bl_pwm_level, and the stream argument to set_backlight Bug: https://bugs.freedesktop.org/show_bug.cgi?id=109375 Signed-off-by: David Francis Reviewed-by: Harry Wentland Acked-by: Anthony Koo Acked-by: Leo Li Signed-off-by: Alex Deucher (cherry picked from commit 923fe4951282cbdfce05186c10380bbc45b5e03b) drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- drivers/gpu/drm/amd/display/dc/core/dc_link.c | 12 +----------- drivers/gpu/drm/amd/display/dc/dc_link.h | 3 +-- drivers/gpu/drm/amd/display/dc/dc_stream.h | 1 - 4 files changed, 3 insertions(+), 15 deletions(-) commit a5a82d841186d13c4a6d500dfcf7d02b4195e3ff Author: Jakub Kicinski Date: Mon Jan 14 10:52:45 2019 -0800 ipv6: route: place a warning with duplicated string with correct extack "IPv6: " prefix is already added by pr_fmt, no need to include it again in the pr_warn() format. The message predates extack support, we can replace the whole thing with an extack message. Suggested-by: David Ahern Signed-off-by: Jakub Kicinski Reviewed-by: David Ahern Signed-off-by: David S. Miller net/ipv6/route.c | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) commit 91fa038d9446b5bf5ea80822790af7dd9bcbb5a2 Author: Davide Caratti Date: Mon Jan 14 18:16:44 2019 +0100 selftests: tc-testing: fix parsing of ife type In iproute2 commit 90c5c969f0b9 ("fix print_0xhex on 32 bit"), the format specifier for the ife type changed from 0x%X to %#llX, causing systematic failures in the following TDC test cases: 7682 - Create valid ife encode action with mark and pass control ef47 - Create valid ife encode action with mark and pipe control df43 - Create valid ife encode action with mark and continue control e4cf - Create valid ife encode action with mark and drop control ccba - Create valid ife encode action with mark and reclassify control a1cf - Create valid ife encode action with mark and jump control cb3d - Create valid ife encode action with mark value at 32-bit maximum 95ed - Create valid ife encode action with prio and pass control aa17 - Create valid ife encode action with prio and pipe control 74c7 - Create valid ife encode action with prio and continue control 7a97 - Create valid ife encode action with prio and drop control f66b - Create valid ife encode action with prio and reclassify control 3056 - Create valid ife encode action with prio and jump control 7dd3 - Create valid ife encode action with prio value at 32-bit maximum 05bb - Create valid ife encode action with tcindex and pass control ce65 - Create valid ife encode action with tcindex and pipe control 09cd - Create valid ife encode action with tcindex and continue control 8eb5 - Create valid ife encode action with tcindex and continue control 451a - Create valid ife encode action with tcindex and drop control d76c - Create valid ife encode action with tcindex and reclassify control e731 - Create valid ife encode action with tcindex and jump control b7b8 - Create valid ife encode action with tcindex value at 16-bit maximum 2a9c - Create valid ife encode action with mac src parameter cf5c - Create valid ife encode action with mac dst parameter 2353 - Create valid ife encode action with mac src and mac dst parameters 552c - Create valid ife encode action with mark and type parameters 0421 - Create valid ife encode action with prio and type parameters 4017 - Create valid ife encode action with tcindex and type parameters fac3 - Create valid ife encode action with index at 32-bit maximnum 7c25 - Create valid ife decode action with pass control dccb - Create valid ife decode action with pipe control 7bb9 - Create valid ife decode action with continue control d9ad - Create valid ife decode action with drop control 219f - Create valid ife decode action with reclassify control 8f44 - Create valid ife decode action with jump control b330 - Create ife encode action with cookie Change 'matchPattern' values, allowing '0' and '0x0' if ife type is equal to 0, and accepting both '0x' and '0X' otherwise, to let these tests pass both with old and new tc binaries. While at it, fix a small typo in test case fac3 ('maximnum'->'maximum'). Signed-off-by: Davide Caratti Acked-by: Stephen Hemminger Signed-off-by: David S. Miller .../selftests/tc-testing/tc-tests/actions/ife.json | 88 +++++++++++----------- 1 file changed, 44 insertions(+), 44 deletions(-) commit 508cacd7da6659ae7b7bdd0a335f675422277758 Author: Geert Uytterhoeven Date: Mon Jan 14 14:51:33 2019 +0100 selftests: gpio-mockup-chardev: Check asprintf() for error With gcc 7.3.0: gpio-mockup-chardev.c: In function ‘get_debugfs’: gpio-mockup-chardev.c:62:3: warning: ignoring return value of ‘asprintf’, declared with attribute warn_unused_result [-Wunused-result] asprintf(path, "%s/gpio", mnt_fs_get_target(fs)); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Handle asprintf() failures to fix this. Signed-off-by: Geert Uytterhoeven Signed-off-by: Shuah Khan tools/testing/selftests/gpio/gpio-mockup-chardev.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 01b833ab44c9e484060aad72267fc7e71beb559b Author: Konstantin Khlebnikov Date: Mon Jan 14 13:38:43 2019 +0300 net/core/neighbour: fix kmemleak minimal reference count for hash tables This should be 1 for normal allocations, 0 disables leak reporting. Signed-off-by: Konstantin Khlebnikov Reported-by: Cong Wang Fixes: 85704cb8dcfd ("net/core/neighbour: tell kmemleak about hash tables") Signed-off-by: David S. Miller net/core/neighbour.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 400b8b9a2a17918f8ce00786f596f530e7f30d50 Author: Xin Long Date: Mon Jan 14 18:34:02 2019 +0800 sctp: allocate sctp_sockaddr_entry with kzalloc The similar issue as fixed in Commit 4a2eb0c37b47 ("sctp: initialize sin6_flowinfo for ipv6 addrs in sctp_inet6addr_event") also exists in sctp_inetaddr_event, as Alexander noticed. To fix it, allocate sctp_sockaddr_entry with kzalloc for both sctp ipv4 and ipv6 addresses, as does in sctp_v4/6_copy_addrlist(). Reported-by: Alexander Potapenko Signed-off-by: Xin Long Reported-by: syzbot+ae0c70c0c2d40c51bb92@syzkaller.appspotmail.com Acked-by: Marcelo Ricardo Leitner Acked-by: Neil Horman Signed-off-by: David S. Miller net/sctp/ipv6.c | 5 +---- net/sctp/protocol.c | 4 +--- 2 files changed, 2 insertions(+), 7 deletions(-) commit 20704bd1633dd5afb29a321d3a615c9c8e9c9d05 Author: Xin Long Date: Mon Jan 14 18:10:06 2019 +0800 erspan: build the header with the right proto according to erspan_ver As said in draft-foschiano-erspan-03#section4: Different frame variants known as "ERSPAN Types" can be distinguished based on the GRE "Protocol Type" field value: Type I and II's value is 0x88BE while Type III's is 0x22EB [ETYPES]. So set it properly in erspan_xmit() according to erspan_ver. While at it, also remove the unused parameter 'proto' in erspan_fb_xmit(). Fixes: 94d7d8f29287 ("ip6_gre: add erspan v2 support") Reported-by: Jianlin Shi Signed-off-by: Xin Long Signed-off-by: David S. Miller net/ipv4/ip_gre.c | 23 ++++++++++++++--------- net/ipv6/ip6_gre.c | 6 ++++-- 2 files changed, 18 insertions(+), 11 deletions(-) commit 04a4af334b971814eedf4e4a413343ad3287d9a9 Author: Ross Lagerwall Date: Mon Jan 14 09:16:56 2019 +0000 openvswitch: Avoid OOB read when parsing flow nlattrs For nested and variable attributes, the expected length of an attribute is not known and marked by a negative number. This results in an OOB read when the expected length is later used to check if the attribute is all zeros. Fix this by using the actual length of the attribute rather than the expected length. Signed-off-by: Ross Lagerwall Acked-by: Pravin B Shelar Signed-off-by: David S. Miller net/openvswitch/flow_netlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9098f21f4cc0f13bc0caa747590e53479c267405 Author: Dmitry Bezrukov Date: Mon Jan 14 08:14:41 2019 +0000 net: usb: aqc111: Extend HWID table by TRENDnet device New device of TRENDnet based on aqc111u Add this ID to blacklist of cdc_ether driver as well Signed-off-by: Dmitry Bezrukov Signed-off-by: Igor Russkikh Signed-off-by: David S. Miller drivers/net/usb/aqc111.c | 15 +++++++++++++++ drivers/net/usb/cdc_ether.c | 8 ++++++++ 2 files changed, 23 insertions(+) commit cd0c4e70fc0ccfa705cdf55efb27519ce9337a26 Author: Cong Wang Date: Fri Jan 11 18:55:42 2019 -0800 net_sched: refetch skb protocol for each filter Martin reported a set of filters don't work after changing from reclassify to continue. Looking into the code, it looks like skb protocol is not always fetched for each iteration of the filters. But, as demonstrated by Martin, TC actions could modify skb->protocol, for example act_vlan, this means we have to refetch skb protocol in each iteration, rather than using the one we fetch in the beginning of the loop. This bug is _not_ introduced by commit 3b3ae880266d ("net: sched: consolidate tc_classify{,_compat}"), technically, if act_vlan is the only action that modifies skb protocol, then it is commit c7e2b9689ef8 ("sched: introduce vlan action") which introduced this bug. Reported-by: Martin Olsson Cc: Jamal Hadi Salim Cc: Jiri Pirko Signed-off-by: Cong Wang Acked-by: Jamal Hadi Salim Signed-off-by: David S. Miller net/sched/cls_api.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 9474f4e7cd71a633fa1ef93b7daefd44bbdfd482 Author: Kees Cook Date: Wed Jan 16 10:31:09 2019 -0800 Yama: Check for pid death before checking ancestry It's possible that a pid has died before we take the rcu lock, in which case we can't walk the ancestry list as it may be detached. Instead, check for death first before doing the walk. Reported-by: syzbot+a9ac39bf55329e206219@syzkaller.appspotmail.com Fixes: 2d514487faf1 ("security: Yama LSM") Cc: stable@vger.kernel.org Suggested-by: Oleg Nesterov Signed-off-by: Kees Cook Signed-off-by: James Morris security/yama/yama_lsm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 3705add0b783e0deeb6646ba0311bf214fe52b0a Author: Jerome Brunet Date: Wed Jan 16 11:36:32 2019 +0100 dt-bindings: reset: meson-axg: fix SPDX license id As reported, the SPDX license id is not placed correctly and the variant of the BSD License used should be specified. Fixes: c16292578ffa ("dt-bindings: reset: Add bindings for the Meson-AXG SoC Reset Controller") Reported-by: Thomas Gleixner Signed-off-by: Jerome Brunet Reviewed-by: Thomas Gleixner Signed-off-by: Rob Herring include/dt-bindings/reset/amlogic,meson-axg-reset.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 9eac0ae1683575375de8c63166b3596b11d3b56a Author: Krzysztof Kozlowski Date: Tue Jan 8 13:11:40 2019 +0100 dt-bindings: soc: qcom: Fix trivial language typos Fix few trivial language typos in bindings. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Rob Herring Documentation/devicetree/bindings/soc/qcom/qcom,glink.txt | 2 +- Documentation/devicetree/bindings/soc/qcom/qcom,smp2p.txt | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) commit 889f4ce60ed19cfd16216e96f90e64a0c1181c0d Author: Otto Sabart Date: Wed Jan 9 20:07:41 2019 +0100 doc: gpio-mvebu: fix broken reference to cp110-system-controller0.txt file The cp110-system-controller0.txt file was renamed to cp110-system-controller.txt. Fixes: 4aa5496980e4 ("dt-bindings: cp110: rename cp110 syscon file") Signed-off-by: Otto Sabart Signed-off-by: Rob Herring Documentation/devicetree/bindings/gpio/gpio-mvebu.txt | 2 -- 1 file changed, 2 deletions(-) commit 28b170e88bc0c7509e6724717c15cb4b5686026e Author: Julia Lawall Date: Sun Jan 13 10:44:50 2019 +0100 OF: properties: add missing of_node_put Add an of_node_put when the result of of_graph_get_remote_port_parent is not available. The semantic match that finds this problem is as follows (http://coccinelle.lip6.fr): // @r exists@ local idexpression e; expression x; @@ e = of_graph_get_remote_port_parent(...); ... when != x = e when != true e == NULL when != of_node_put(e) when != of_fwnode_handle(e) ( return e; | *return ...; ) // Signed-off-by: Julia Lawall Cc: stable@vger.kernel.org Signed-off-by: Rob Herring drivers/of/property.c | 1 + 1 file changed, 1 insertion(+) commit 5bbc73a841d7f0bbe025a342146dde462a796a5a Author: Fathi Boudra Date: Wed Jan 16 11:43:19 2019 -0600 selftests: seccomp: use LDLIBS instead of LDFLAGS seccomp_bpf fails to build due to undefined reference errors: aarch64-linaro-linux-gcc --sysroot=/build/tmp-rpb-glibc/sysroots/hikey -O2 -pipe -g -feliminate-unused-debug-types -Wl,-no-as-needed -Wall -Wl,-O1 -Wl,--hash-style=gnu -Wl,--as-needed -lpthread seccomp_bpf.c -o /build/tmp-rpb-glibc/work/hikey-linaro-linux/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf /tmp/ccrlR3MW.o: In function `tsync_sibling': /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1920: undefined reference to `sem_post' /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1920: undefined reference to `sem_post' /tmp/ccrlR3MW.o: In function `TSYNC_setup': /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1863: undefined reference to `sem_init' /tmp/ccrlR3MW.o: In function `TSYNC_teardown': /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1904: undefined reference to `sem_destroy' /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1897: undefined reference to `pthread_kill' /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1898: undefined reference to `pthread_cancel' /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1899: undefined reference to `pthread_join' /tmp/ccrlR3MW.o: In function `tsync_start_sibling': /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' /tmp/ccrlR3MW.o: In function `TSYNC_siblings_fail_prctl': /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1978: undefined reference to `sem_wait' /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1990: undefined reference to `pthread_join' /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1992: undefined reference to `pthread_join' /tmp/ccrlR3MW.o: In function `tsync_start_sibling': /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' /tmp/ccrlR3MW.o: In function `TSYNC_two_siblings_with_ancestor': /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2016: undefined reference to `sem_wait' /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2032: undefined reference to `pthread_join' /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2034: undefined reference to `pthread_join' /tmp/ccrlR3MW.o: In function `tsync_start_sibling': /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' /tmp/ccrlR3MW.o: In function `TSYNC_two_sibling_want_nnp': /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2046: undefined reference to `sem_wait' /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2058: undefined reference to `pthread_join' /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2060: undefined reference to `pthread_join' /tmp/ccrlR3MW.o: In function `tsync_start_sibling': /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' /tmp/ccrlR3MW.o: In function `TSYNC_two_siblings_with_no_filter': /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2073: undefined reference to `sem_wait' /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2098: undefined reference to `pthread_join' /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2100: undefined reference to `pthread_join' /tmp/ccrlR3MW.o: In function `tsync_start_sibling': /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' /tmp/ccrlR3MW.o: In function `TSYNC_two_siblings_with_one_divergence': /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2125: undefined reference to `sem_wait' /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2143: undefined reference to `pthread_join' /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2145: undefined reference to `pthread_join' /tmp/ccrlR3MW.o: In function `tsync_start_sibling': /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' /tmp/ccrlR3MW.o: In function `TSYNC_two_siblings_not_under_filter': /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2169: undefined reference to `sem_wait' /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2202: undefined reference to `pthread_join' /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2227: undefined reference to `pthread_join' /tmp/ccrlR3MW.o: In function `tsync_start_sibling': /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' It's GNU Make and linker specific. The default Makefile rule looks like: $(CC) $(CFLAGS) $(LDFLAGS) $@ $^ $(LDLIBS) When linking is done by gcc itself, no issue, but when it needs to be passed to proper ld, only LDLIBS follows and then ld cannot know what libs to link with. More detail: https://www.gnu.org/software/make/manual/html_node/Implicit-Variables.html LDFLAGS Extra flags to give to compilers when they are supposed to invoke the linker, ‘ld’, such as -L. Libraries (-lfoo) should be added to the LDLIBS variable instead. LDLIBS Library flags or names given to compilers when they are supposed to invoke the linker, ‘ld’. LOADLIBES is a deprecated (but still supported) alternative to LDLIBS. Non-library linker flags, such as -L, should go in the LDFLAGS variable. https://lkml.org/lkml/2010/2/10/362 tools/perf: libraries must come after objects Link order matters, use LDLIBS instead of LDFLAGS to properly link against libpthread. Signed-off-by: Fathi Boudra Acked-by: Kees Cook Signed-off-by: Shuah Khan tools/testing/selftests/seccomp/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ec5aecc0b227f5509d25853537f989ca303e2be1 Author: Luca Coelho Date: Mon Jan 14 13:00:23 2019 +0200 iwlwifi: make IWLWIFI depend on CFG80211 Since IWLWIFI doesn't depend on MAC80211 anymore, it needs to depend on CFG80211, because it uses a few symbols from it. Add the dependency on CFG80211 accordingly. Additionally, make IWLWIFI_LEDS depend on IWLMVM or IWLDVM, since it doesn't need mac80211 but must be used for these. Fixes: aca432f06b8a ("iwlwifi: make MVM and DVM depend on MAC80211") Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo drivers/net/wireless/intel/iwlwifi/Kconfig | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 867cefb4cb1012f42cada1c7d1f35ac8dd276071 Author: Juergen Gross Date: Mon Jan 14 13:44:13 2019 +0100 xen: Fix x86 sched_clock() interface for xen Commit f94c8d11699759 ("sched/clock, x86/tsc: Rework the x86 'unstable' sched_clock() interface") broke Xen guest time handling across migration: [ 187.249951] Freezing user space processes ... (elapsed 0.001 seconds) done. [ 187.251137] OOM killer disabled. [ 187.251137] Freezing remaining freezable tasks ... (elapsed 0.001 seconds) done. [ 187.252299] suspending xenstore... [ 187.266987] xen:grant_table: Grant tables using version 1 layout [18446743811.706476] OOM killer enabled. [18446743811.706478] Restarting tasks ... done. [18446743811.720505] Setting capacity to 16777216 Fix that by setting xen_sched_clock_offset at resume time to ensure a monotonic clock value. [boris: replaced pr_info() with pr_info_once() in xen_callback_vector() to avoid printing with incorrect timestamp during resume (as we haven't re-adjusted the clock yet)] Fixes: f94c8d11699759 ("sched/clock, x86/tsc: Rework the x86 'unstable' sched_clock() interface") Cc: # 4.11 Reported-by: Hans van Kranenburg Signed-off-by: Juergen Gross Tested-by: Hans van Kranenburg Signed-off-by: Boris Ostrovsky arch/x86/xen/time.c | 12 +++++++++--- drivers/xen/events/events_base.c | 2 +- 2 files changed, 10 insertions(+), 4 deletions(-) commit c45b1fa2433c65e44bdf48f513cb37289f3116b9 Author: Ming Lei Date: Thu Jan 3 09:34:39 2019 +0800 nvme-pci: fix nvme_setup_irqs() When -ENOSPC is returned from pci_alloc_irq_vectors_affinity(), we still try to allocate multiple irq vectors again, so irq queues covers the admin queue actually. But we don't consider that, then number of the allocated irq vector may be same with sum of io_queues[HCTX_TYPE_DEFAULT] and io_queues[HCTX_TYPE_READ], this way is obviously wrong, and finally breaks nvme_pci_map_queues(), and warning from pci_irq_get_affinity() is triggered. IRQ queues should cover admin queues, this patch makes this point explicitely in nvme_calc_io_queues(). We got severl boot failure internal report on aarch64, so please consider to fix it in v4.20. Fixes: 6451fe73fa0f ("nvme: fix irq vs io_queue calculations") Signed-off-by: Ming Lei Reviewed-by: Keith Busch Tested-by: fin4478 Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe drivers/nvme/host/pci.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) commit fb8658581a150a859b654b154cefe3118ff4f1e0 Author: Sagi Grimberg Date: Wed Jan 9 14:56:32 2019 -0800 nvmet-tcp: fix uninitialized variable access If we end up in nvmet_tcp_try_recv_one with a bogus state queue receive state we will access result which is uninitialized. Initialize restult to 0 which will be considered as if no data was received by the tcp socket. Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver") Reported-by: Dan Carpenter Signed-off-by: Sagi Grimberg Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe drivers/nvme/target/tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 890d14d2d4b57ff5a149309da3ed36c8a529987f Author: Peter Rosin Date: Wed Jan 16 17:42:35 2019 +0100 fbdev: fbmem: convert CONFIG_FB_LOGO_CENTER into a cmd line option A command line option is much more flexible than a config option and the supporting code is small. Gets rid of #ifdefs in the code too... Suggested-by: Geert Uytterhoeven Cc: Jonathan Corbet Signed-off-by: Peter Rosin Signed-off-by: Bartlomiej Zolnierkiewicz Documentation/fb/fbcon.txt | 8 ++++++++ drivers/video/fbdev/core/fbcon.c | 7 +++++++ drivers/video/fbdev/core/fbmem.c | 19 ++++++++++--------- drivers/video/logo/Kconfig | 9 --------- include/linux/fb.h | 1 + 5 files changed, 26 insertions(+), 18 deletions(-) commit 240809ef6630a4ce57c273c2d79ffb657cd361eb Author: Hans Verkuil Date: Fri Jan 11 07:07:25 2019 -0500 media: vim2m: only cancel work if it is for right context cancel_delayed_work_sync() was called for any queue, but it should only be called for the queue that is associated with the currently running job. Otherwise, if two filehandles are streaming at the same time, then closing the first will cancel the work which might still be running for a job from the second filehandle. As a result the second filehandle will never be able to finish the job and an attempt to stop streaming on that second filehandle will stall. Fixes: 52117be68b82 ("media: vim2m: use cancel_delayed_work_sync instead of flush_schedule_work") Signed-off-by: Hans Verkuil Cc: # for v4.20 and up Signed-off-by: Mauro Carvalho Chehab drivers/media/platform/vim2m.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 7fe9f01c04c2673bd6662c35b664f0f91888b96f Author: Sakari Ailus Date: Thu Jan 10 09:24:26 2019 -0500 media: v4l: ioctl: Validate num_planes for debug messages The num_planes field in struct v4l2_pix_format_mplane is used in a loop before validating it. As the use is printing a debug message in this case, just cap the value to the maximum allowed. Signed-off-by: Sakari Ailus Cc: stable@vger.kernel.org Reviewed-by: Thierry Reding Signed-off-by: Hans Verkuil Cc: # for v4.12 and up Signed-off-by: Mauro Carvalho Chehab drivers/media/v4l2-core/v4l2-ioctl.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 9048b2e15b11c591c649cc6edc7a64fa62c15419 Author: Sakari Ailus Date: Thu Jan 10 07:43:19 2019 -0500 media: v4l: ioctl: Validate num_planes before using it The for loop to reset the memory of the plane reserved fields runs over num_planes provided by the user without validating it. Ensure num_planes is no more than VIDEO_MAX_PLANES before the loop. Fixes: 4e1e0eb0e074 ("media: v4l2-ioctl: Zero v4l2_plane_pix_format reserved fields") Signed-off-by: Sakari Ailus Reviewed-by: Thierry Reding Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab drivers/media/v4l2-core/v4l2-ioctl.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit dd91642ac71208fe972a9c577ed52b6b3ba7b732 Author: Thierry Reding Date: Thu Jan 10 05:48:39 2019 -0500 media: v4l2-ioctl: Clear only per-plane reserved fields Currently the IOCTL code clears everything after the per-plane bytesperline field in struct v4l2_format. The intent was to only clear the per-plane reserved fields since there is data in struct v4l2_format after the per-plane format data that userspace may have filled in. Fixes: 4e1e0eb0e074 ("media: v4l2-ioctl: Zero v4l2_plane_pix_format reserved fields") Signed-off-by: Thierry Reding Signed-off-by: Hans Verkuil [hverkuil-cisco@xs4all.nl: fix checkpatch alignment warning] Signed-off-by: Mauro Carvalho Chehab drivers/media/v4l2-core/v4l2-ioctl.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) commit 227a76b64718888c1687cc237463aa000ae6fb2b Author: Christoph Hellwig Date: Mon Jan 14 21:14:08 2019 +0100 swiotlb: clear io_tlb_start and io_tlb_end in swiotlb_exit Otherwise is_swiotlb_buffer will return false positives when we first initialize a swiotlb buffer, but then free it because we have an IOMMU available. Fixes: 55897af63091 ("dma-direct: merge swiotlb_dma_ops into the dma_direct code") Reported-by: Sibren Vasse Signed-off-by: Christoph Hellwig Tested-by: Sibren Vasse Signed-off-by: Konrad Rzeszutek Wilk kernel/dma/swiotlb.c | 2 ++ 1 file changed, 2 insertions(+) commit be3bb599d84b50d27d6077085388afabdd2ee18a Author: Masahiro Yamada Date: Mon Jan 14 17:19:57 2019 +0900 ia64: remove redundant 'export AWK' This is exported by the top Makefile. Signed-off-by: Masahiro Yamada arch/ia64/Makefile | 2 -- 1 file changed, 2 deletions(-) commit b421b8a6cb87f099466fff00d1870c2db778c617 Author: Masahiro Yamada Date: Mon Jan 14 17:29:29 2019 +0900 kbuild: remove unused archmrproper No one uses archmrproper. Signed-off-by: Masahiro Yamada Makefile | 4 ++-- arch/h8300/Makefile | 2 -- 2 files changed, 2 insertions(+), 4 deletions(-) commit 7809167da5c86fd6bf309b33dee7a797e263342f Author: Ming Lei Date: Wed Jan 16 19:08:15 2019 +0800 block: don't lose track of REQ_INTEGRITY flag We need to pass bio->bi_opf after bio intergrity preparing, otherwise the flag of REQ_INTEGRITY may not be set on the allocated request, then breaks block integrity. Fixes: f9afca4d367b ("blk-mq: pass in request/bio flags to queue mapping") Cc: Hannes Reinecke Cc: Keith Busch Signed-off-by: Ming Lei Signed-off-by: Jens Axboe block/blk-mq.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 1950f462916edc9581168ca8d5882a8101e8bbcf Author: Philipp Zabel Date: Mon Jan 14 08:19:22 2019 +0100 HID: core: simplify active collection tracking Manually tracking an active collection to set collection parents is not necessary, we just have to look one step back into the collection stack to find the correct parent. Signed-off-by: Philipp Zabel Reviewed-by: Peter Hutterer Signed-off-by: Benjamin Tissoires drivers/hid/hid-core.c | 13 ++----------- include/linux/hid.h | 1 - 2 files changed, 2 insertions(+), 12 deletions(-) commit c5b11ee9f1c22a8d6b5cab2099904f7adbe79a7f Author: Guido Günther Date: Wed Jan 16 09:41:22 2019 +0100 dt-bindings: imx8mq: Number clocks consecutively This fixes a duplicate use of 232 and numbers the clocks without holes. Fixes: 1cf3817bf1f5 ("dt-bindings: Add binding for i.MX8MQ CCM") Signed-off-by: Guido Günther Reviewed-by: Lucas Stach Signed-off-by: Shawn Guo include/dt-bindings/clock/imx8mq-clock.h | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) commit 827cb0323928952c0db9515aba9d534fb1285b3f Author: Alban Bedel Date: Mon Jan 7 20:44:54 2019 +0100 phy: ath79-usb: Fix the main reset name to match the DT binding I submitted this driver several times before it got accepted. The first series hasn't been accepted but the DTS binding did made it. I then made a second series that added generic reset support to the PHY core, this in turn required a change to the DT binding. This second series seemed to have been ignored, so I did a third one without the change to the PHY core and the DT binding update, and this last attempt finally made it. But two months later the DT binding update from the second series has been integrated too. So now the driver doesn't match the binding and the only DTS using it. This patch fix the driver to match the new binding. Signed-off-by: Alban Bedel Signed-off-by: Kishon Vijay Abraham I drivers/phy/qualcomm/phy-ath79-usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 009808154c69c48d5b41fc8cf5ad5ab5704efd8f Author: Alban Bedel Date: Mon Jan 7 20:44:53 2019 +0100 phy: ath79-usb: Fix the power on error path In the power on function the error path doesn't return the suspend override to its proper state. It should should deassert this reset line to enable the suspend override. Signed-off-by: Alban Bedel Signed-off-by: Kishon Vijay Abraham I drivers/phy/qualcomm/phy-ath79-usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4fae92797879bd58bd5d4e39c790b515bce4a1af Author: John Hubbard Date: Sat Jan 12 17:29:09 2019 -0800 phy: fix build breakage: add PHY_MODE_SATA Commit 49e54187ae0b ("ata: libahci_platform: comply to PHY framework") uses the PHY_MODE_SATA, but that enum had not yet been added. This caused a build failure for me, with today's linux.git. Also, there is a potentially conflicting (mis-named) PHY_MODE_SATA, hiding in the Marvell Berlin SATA PHY driver. Fix the build by: 1) Renaming Marvell's defined value to a more scoped name, in order to avoid any potential conflicts: PHY_BERLIN_MODE_SATA. 2) Adding the missing enum, which was going to be added anyway as part of [1]. [1] https://lkml.kernel.org/r/20190108163124.6409-3-miquel.raynal@bootlin.com Fixes: 49e54187ae0b ("ata: libahci_platform: comply to PHY framework") Cc: Grzegorz Jaszczyk Cc: Miquel Raynal Cc: Hans de Goede Cc: Jens Axboe Signed-off-by: John Hubbard Signed-off-by: Kishon Vijay Abraham I drivers/phy/marvell/phy-berlin-sata.c | 5 +++-- include/linux/phy/phy.h | 1 + 2 files changed, 4 insertions(+), 2 deletions(-) commit 1138a442a0c5e97594ec63e898098b0c9e781172 Author: Colin Ian King Date: Sat Dec 22 11:56:53 2018 +0000 phy: ti: ensure priv is not null before dereferencing it Currently priv is being dereferenced before priv is being null checked. Fix this by moving the null check on priv before the dereference. Detected by CoverityScan, CID#1476018 ("Dereference before null check") Fixes: 92b58b34741f ("phy: ti: introduce phy-gmii-sel driver") Signed-off-by: Colin Ian King Signed-off-by: Kishon Vijay Abraham I drivers/phy/ti/phy-gmii-sel.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit e2612cd496e7b465711d219ea6118893d7253f52 Author: Benedict Wong Date: Mon Jan 14 11:24:38 2019 -0800 xfrm: Make set-mark default behavior backward compatible Fixes 9b42c1f179a6, which changed the default route lookup behavior for tunnel mode SAs in the outbound direction to use the skb mark, whereas previously mark=0 was used if the output mark was unspecified. In mark-based routing schemes such as Android’s, this change in default behavior causes routing loops or lookup failures. This patch restores the default behavior of using a 0 mark while still incorporating the skb mark if the SET_MARK (and SET_MARK_MASK) is specified. Tested with additions to Android's kernel unit test suite: https://android-review.googlesource.com/c/kernel/tests/+/860150 Fixes: 9b42c1f179a6 ("xfrm: Extend the output_mark to support input direction and masking") Signed-off-by: Benedict Wong Signed-off-by: Steffen Klassert net/xfrm/xfrm_policy.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 7fa1e2e6afa7f4c9f46528e61de6a15d9e8dffd9 Author: Andrey Konovalov Date: Fri Jan 11 14:47:40 2019 +0100 kasan, arm64: remove redundant ARCH_SLAB_MINALIGN define Defining ARCH_SLAB_MINALIGN in arch/arm64/include/asm/cache.h when KASAN is off is not needed, as it is defined in defined in include/linux/slab.h as ifndef. Signed-off-by: Andrey Konovalov Signed-off-by: Will Deacon arch/arm64/include/asm/cache.h | 2 -- 1 file changed, 2 deletions(-) commit 1598ecda7b239e9232dda032bfddeed9d89fab6c Author: Ard Biesheuvel Date: Tue Jan 15 20:47:07 2019 +0100 arm64: kaslr: ensure randomized quantities are clean to the PoC kaslr_early_init() is called with the kernel mapped at its link time offset, and if it returns with a non-zero offset, the kernel is unmapped and remapped again at the randomized offset. During its execution, kaslr_early_init() also randomizes the base of the module region and of the linear mapping of DRAM, and sets two variables accordingly. However, since these variables are assigned with the caches on, they may get lost during the cache maintenance that occurs when unmapping and remapping the kernel, so ensure that these values are cleaned to the PoC. Acked-by: Catalin Marinas Fixes: f80fb3a3d508 ("arm64: add support for kernel ASLR") Cc: # v4.6+ Signed-off-by: Ard Biesheuvel Signed-off-by: Will Deacon arch/arm64/kernel/kaslr.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 2f97967503df8e45bc256a348b6f050abd2a38ed Author: James Morse Date: Tue Jan 15 18:49:17 2019 +0000 arm64: kpti: Update arm64_kernel_use_ng_mappings() when forced on Since commit b89d82ef01b3 ("arm64: kpti: Avoid rewriting early page tables when KASLR is enabled"), a kernel built with CONFIG_RANDOMIZE_BASE can decide early whether to use non-global mappings by checking the kaslr_offset(). A kernel built without CONFIG_RANDOMIZE_BASE, instead checks the cpufeature static-key. This leaves a gap where CONFIG_RANDOMIZE_BASE was enabled, no kaslr seed was provided, but kpti was forced on using the cmdline option. When the decision is made late, kpti_install_ng_mappings() will re-write the page tables, but arm64_kernel_use_ng_mappings()'s value does not change as it only tests the cpufeature static-key if CONFIG_RANDOMIZE_BASE is disabled. This function influences PROT_DEFAULT via PTE_MAYBE_NG, and causes pgattr_change_is_safe() to catch nG->G transitions when the unchanged PROT_DEFAULT is used as part of PAGE_KERNEL_RO: [ 1.942255] alternatives: patching kernel code [ 1.998288] ------------[ cut here ]------------ [ 2.000693] kernel BUG at arch/arm64/mm/mmu.c:165! [ 2.019215] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP [ 2.020257] Modules linked in: [ 2.020807] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.0.0-rc2 #51 [ 2.021917] Hardware name: linux,dummy-virt (DT) [ 2.022790] pstate: 40000005 (nZcv daif -PAN -UAO) [ 2.023742] pc : __create_pgd_mapping+0x508/0x6d0 [ 2.024671] lr : __create_pgd_mapping+0x500/0x6d0 [ 2.058059] Process swapper/0 (pid: 1, stack limit = 0x(____ptrval____)) [ 2.059369] Call trace: [ 2.059845] __create_pgd_mapping+0x508/0x6d0 [ 2.060684] update_mapping_prot+0x48/0xd0 [ 2.061477] mark_linear_text_alias_ro+0xdc/0xe4 [ 2.070502] smp_cpus_done+0x90/0x98 [ 2.071216] smp_init+0x100/0x114 [ 2.071878] kernel_init_freeable+0xd4/0x220 [ 2.072750] kernel_init+0x10/0x100 [ 2.073455] ret_from_fork+0x10/0x18 [ 2.075414] ---[ end trace 3572f3a7782292de ]--- [ 2.076389] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b If arm64_kernel_unmapped_at_el0() is true, arm64_kernel_use_ng_mappings() should also be true. Signed-off-by: James Morse CC: Ard Biesheuvel CC: John Garry CC: Will Deacon Signed-off-by: Will Deacon arch/arm64/include/asm/mmu.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit a2ebba824106dabe79937a9f29a875f837e1b6d4 Author: Miklos Szeredi Date: Wed Jan 16 10:27:59 2019 +0100 fuse: decrement NR_WRITEBACK_TEMP on the right page NR_WRITEBACK_TEMP is accounted on the temporary page in the request, not the page cache page. Fixes: 8b284dc47291 ("fuse: writepages: handle same page rewrites") Cc: # v3.13 Signed-off-by: Miklos Szeredi fs/fuse/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9509941e9c534920ccc4771ae70bd6cbbe79df1c Author: Jann Horn Date: Sat Jan 12 02:39:05 2019 +0100 fuse: call pipe_buf_release() under pipe lock Some of the pipe_buf_release() handlers seem to assume that the pipe is locked - in particular, anon_pipe_buf_release() accesses pipe->tmp_page without taking any extra locks. From a glance through the callers of pipe_buf_release(), it looks like FUSE is the only one that calls pipe_buf_release() without having the pipe locked. This bug should only lead to a memory leak, nothing terrible. Fixes: dd3bb14f44a6 ("fuse: support splice() writing to fuse device") Cc: stable@vger.kernel.org Signed-off-by: Jann Horn Signed-off-by: Miklos Szeredi fs/fuse/dev.c | 2 ++ 1 file changed, 2 insertions(+) commit 8a3177db59cd644fde05ba9efee29392dfdec8aa Author: Miklos Szeredi Date: Wed Jan 16 10:27:59 2019 +0100 cuse: fix ioctl cuse_process_init_reply() doesn't initialize fc->max_pages and thus all cuse bases ioctls fail with ENOMEM. Reported-by: Andreas Steinmetz Fixes: 5da784cce430 ("fuse: add max_pages to init_out") Cc: # v4.20 Signed-off-by: Miklos Szeredi fs/fuse/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 97e1532ef81acb31c30f9e75bf00306c33a77812 Author: Miklos Szeredi Date: Wed Jan 16 10:27:59 2019 +0100 fuse: handle zero sized retrieve correctly Dereferencing req->page_descs[0] will Oops if req->max_pages is zero. Reported-by: syzbot+c1e36d30ee3416289cc0@syzkaller.appspotmail.com Tested-by: syzbot+c1e36d30ee3416289cc0@syzkaller.appspotmail.com Fixes: b2430d7567a3 ("fuse: add per-page descriptor to fuse_req") Cc: # v3.9 Signed-off-by: Miklos Szeredi fs/fuse/dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f2f98c1d7fa81e25a5cf910edc9db4d3c6f36c1b Author: Timotej Lazar Date: Sun Jan 13 01:22:55 2019 +0100 net: phy: meson-gxl: Use the genphy_soft_reset callback Since the referenced commit, Ethernet fails to come up at boot on the board meson-gxl-s905x-libretech-cc. Fix this by re-enabling the genphy_soft_reset callback for the Amlogic Meson GXL PHY driver. Fixes: 6e2d85ec0559 ("net: phy: Stop with excessive soft reset") Signed-off-by: Timotej Lazar Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/phy/meson-gxl.c | 1 + 1 file changed, 1 insertion(+) commit a6c7c7aac2de6be777b9805fe21848b9a323b8ff Author: yupeng Date: Fri Jan 11 15:07:24 2019 -0800 net: add document for several snmp counters add document for below counters: TcpEstabResets TcpAttemptFails TcpOutRsts TcpExtTCPSACKDiscard TcpExtTCPDSACKIgnoredOld TcpExtTCPDSACKIgnoredNoUndo TcpExtTCPSackShifted TcpExtTCPSackMerged TcpExtTCPSackShiftFallback TcpExtTCPWantZeroWindowAdv TcpExtTCPToZeroWindowAdv TcpExtTCPFromZeroWindowAdv TcpExtDelayedACKs TcpExtDelayedACKLocked TcpExtDelayedACKLost TcpExtTCPLossProbes TcpExtTCPLossProbeRecovery Signed-off-by: yupeng Signed-off-by: David S. Miller Documentation/networking/snmp_counter.rst | 130 ++++++++++++++++++++++++++++-- 1 file changed, 125 insertions(+), 5 deletions(-) commit 26fc181e6cacacd4837da7ffe0c871134a421600 Author: Eric Dumazet Date: Fri Jan 11 06:27:35 2019 -0800 fou, fou6: do not assume linear skbs Both gue_err() and gue6_err() incorrectly assume linear skbs. Fix them to use pskb_may_pull(). BUG: KMSAN: uninit-value in gue6_err+0x475/0xc40 net/ipv6/fou6.c:101 CPU: 0 PID: 18083 Comm: syz-executor1 Not tainted 5.0.0-rc1+ #7 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x173/0x1d0 lib/dump_stack.c:113 kmsan_report+0x12e/0x2a0 mm/kmsan/kmsan.c:600 __msan_warning+0x82/0xf0 mm/kmsan/kmsan_instr.c:313 gue6_err+0x475/0xc40 net/ipv6/fou6.c:101 __udp6_lib_err_encap_no_sk net/ipv6/udp.c:434 [inline] __udp6_lib_err_encap net/ipv6/udp.c:491 [inline] __udp6_lib_err+0x18d0/0x2590 net/ipv6/udp.c:522 udplitev6_err+0x118/0x130 net/ipv6/udplite.c:27 icmpv6_notify+0x462/0x9f0 net/ipv6/icmp.c:784 icmpv6_rcv+0x18ac/0x3fa0 net/ipv6/icmp.c:872 ip6_protocol_deliver_rcu+0xb5a/0x23a0 net/ipv6/ip6_input.c:394 ip6_input_finish net/ipv6/ip6_input.c:434 [inline] NF_HOOK include/linux/netfilter.h:289 [inline] ip6_input+0x2b6/0x350 net/ipv6/ip6_input.c:443 dst_input include/net/dst.h:450 [inline] ip6_rcv_finish+0x4e7/0x6d0 net/ipv6/ip6_input.c:76 NF_HOOK include/linux/netfilter.h:289 [inline] ipv6_rcv+0x34b/0x3f0 net/ipv6/ip6_input.c:272 __netif_receive_skb_one_core net/core/dev.c:4973 [inline] __netif_receive_skb net/core/dev.c:5083 [inline] process_backlog+0x756/0x10e0 net/core/dev.c:5923 napi_poll net/core/dev.c:6346 [inline] net_rx_action+0x78b/0x1a60 net/core/dev.c:6412 __do_softirq+0x53f/0x93a kernel/softirq.c:293 do_softirq_own_stack+0x49/0x80 arch/x86/entry/entry_64.S:1039 do_softirq kernel/softirq.c:338 [inline] __local_bh_enable_ip+0x16f/0x1a0 kernel/softirq.c:190 local_bh_enable+0x36/0x40 include/linux/bottom_half.h:32 rcu_read_unlock_bh include/linux/rcupdate.h:696 [inline] ip6_finish_output2+0x1d64/0x25f0 net/ipv6/ip6_output.c:121 ip6_finish_output+0xae4/0xbc0 net/ipv6/ip6_output.c:154 NF_HOOK_COND include/linux/netfilter.h:278 [inline] ip6_output+0x5ca/0x710 net/ipv6/ip6_output.c:171 dst_output include/net/dst.h:444 [inline] ip6_local_out+0x164/0x1d0 net/ipv6/output_core.c:176 ip6_send_skb+0xfa/0x390 net/ipv6/ip6_output.c:1727 udp_v6_send_skb+0x1733/0x1d20 net/ipv6/udp.c:1169 udpv6_sendmsg+0x424e/0x45d0 net/ipv6/udp.c:1466 inet_sendmsg+0x54a/0x720 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg net/socket.c:631 [inline] ___sys_sendmsg+0xdb9/0x11b0 net/socket.c:2116 __sys_sendmmsg+0x580/0xad0 net/socket.c:2211 __do_sys_sendmmsg net/socket.c:2240 [inline] __se_sys_sendmmsg+0xbd/0xe0 net/socket.c:2237 __x64_sys_sendmmsg+0x56/0x70 net/socket.c:2237 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 RIP: 0033:0x457ec9 Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f4a5204fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000457ec9 RDX: 00000000040001ab RSI: 0000000020000240 RDI: 0000000000000003 RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f4a520506d4 R13: 00000000004c4ce5 R14: 00000000004d85d8 R15: 00000000ffffffff Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:205 [inline] kmsan_internal_poison_shadow+0x92/0x150 mm/kmsan/kmsan.c:159 kmsan_kmalloc+0xa6/0x130 mm/kmsan/kmsan_hooks.c:176 kmsan_slab_alloc+0xe/0x10 mm/kmsan/kmsan_hooks.c:185 slab_post_alloc_hook mm/slab.h:446 [inline] slab_alloc_node mm/slub.c:2754 [inline] __kmalloc_node_track_caller+0xe9e/0xff0 mm/slub.c:4377 __kmalloc_reserve net/core/skbuff.c:140 [inline] __alloc_skb+0x309/0xa20 net/core/skbuff.c:208 alloc_skb include/linux/skbuff.h:1012 [inline] alloc_skb_with_frags+0x1c7/0xac0 net/core/skbuff.c:5288 sock_alloc_send_pskb+0xafd/0x10a0 net/core/sock.c:2091 sock_alloc_send_skb+0xca/0xe0 net/core/sock.c:2108 __ip6_append_data+0x42ed/0x5dc0 net/ipv6/ip6_output.c:1443 ip6_append_data+0x3c2/0x650 net/ipv6/ip6_output.c:1619 icmp6_send+0x2f5c/0x3c40 net/ipv6/icmp.c:574 icmpv6_send+0xe5/0x110 net/ipv6/ip6_icmp.c:43 ip6_link_failure+0x5c/0x2c0 net/ipv6/route.c:2231 dst_link_failure include/net/dst.h:427 [inline] vti_xmit net/ipv4/ip_vti.c:229 [inline] vti_tunnel_xmit+0xf3b/0x1ea0 net/ipv4/ip_vti.c:265 __netdev_start_xmit include/linux/netdevice.h:4382 [inline] netdev_start_xmit include/linux/netdevice.h:4391 [inline] xmit_one net/core/dev.c:3278 [inline] dev_hard_start_xmit+0x604/0xc40 net/core/dev.c:3294 __dev_queue_xmit+0x2e48/0x3b80 net/core/dev.c:3864 dev_queue_xmit+0x4b/0x60 net/core/dev.c:3897 neigh_direct_output+0x42/0x50 net/core/neighbour.c:1511 neigh_output include/net/neighbour.h:508 [inline] ip6_finish_output2+0x1d4e/0x25f0 net/ipv6/ip6_output.c:120 ip6_finish_output+0xae4/0xbc0 net/ipv6/ip6_output.c:154 NF_HOOK_COND include/linux/netfilter.h:278 [inline] ip6_output+0x5ca/0x710 net/ipv6/ip6_output.c:171 dst_output include/net/dst.h:444 [inline] ip6_local_out+0x164/0x1d0 net/ipv6/output_core.c:176 ip6_send_skb+0xfa/0x390 net/ipv6/ip6_output.c:1727 udp_v6_send_skb+0x1733/0x1d20 net/ipv6/udp.c:1169 udpv6_sendmsg+0x424e/0x45d0 net/ipv6/udp.c:1466 inet_sendmsg+0x54a/0x720 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg net/socket.c:631 [inline] ___sys_sendmsg+0xdb9/0x11b0 net/socket.c:2116 __sys_sendmmsg+0x580/0xad0 net/socket.c:2211 __do_sys_sendmmsg net/socket.c:2240 [inline] __se_sys_sendmmsg+0xbd/0xe0 net/socket.c:2237 __x64_sys_sendmmsg+0x56/0x70 net/socket.c:2237 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 Fixes: b8a51b38e4d4 ("fou, fou6: ICMP error handlers for FoU and GUE") Signed-off-by: Eric Dumazet Reported-by: syzbot Cc: Stefano Brivio Cc: Sabrina Dubroca Signed-off-by: David S. Miller net/ipv4/fou.c | 9 +++++++-- net/ipv6/fou6.c | 9 +++++++-- 2 files changed, 14 insertions(+), 4 deletions(-) commit 5216bd77798e2ed773ecd45f3f368dcaec63e5dd Author: Davide Caratti Date: Fri Jan 11 15:08:23 2019 +0100 selftests: tc-testing: fix tunnel_key failure if dst_port is unspecified After commit 1c25324caf82 ("net/sched: act_tunnel_key: Don't dump dst port if it wasn't set"), act_tunnel_key doesn't dump anymore the destination port, unless it was explicitly configured. This caused systematic failures in the following TDC test case: 7a88 - Add tunnel_key action with cookie parameter Avoid matching zero values of TCA_TUNNEL_KEY_ENC_DST_PORT to let the test pass again. Signed-off-by: Davide Caratti Signed-off-by: David S. Miller tools/testing/selftests/tc-testing/tc-tests/actions/tunnel_key.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e413615502a3324daba038f529932ba9a5248af0 Author: Davide Caratti Date: Fri Jan 11 11:49:58 2019 +0100 selftests: tc-testing: drop test on missing tunnel key id After merge of commit 80ef0f22ceda ("net/sched: act_tunnel_key: Allow key-less tunnels"), act_tunnel_key does not reject anymore requests to install 'set' rules where the key id is missing. Therefore, drop the following TDC testcase: ba4e - Add tunnel_key set action with missing mandatory id parameter because it's going to become a systematic fail as soon as userspace iproute2 will start supporting key-less tunnels. Signed-off-by: Davide Caratti Signed-off-by: David S. Miller .../tc-testing/tc-tests/actions/tunnel_key.json | 29 ---------------------- 1 file changed, 29 deletions(-) commit e0a7328fad9979104f73e19bedca821ef3262ae1 Author: Andrew Lunn Date: Fri Jan 11 00:15:21 2019 +0100 net: phy: marvell: Fix deadlock from wrong locking m88e1318_set_wol() takes the lock as part of phy_select_page(). Don't take the lock again with phy_read(), use the unlocked __phy_read(). Fixes: 424ca4c55121 ("net: phy: marvell: fix paged access races") Reported-by: Åke Rehnman Signed-off-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/phy/marvell.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8cbcdc1a51999ca81db2956608b917aacd28d837 Author: Andrew Lunn Date: Thu Jan 10 22:48:36 2019 +0100 net: phy: marvell: Errata for mv88e6390 internal PHYs The VOD can be out of spec, unless some magic value is poked into an undocumented register in an undocumented page. Fixes: e4cf8a38fc0d ("net: phy: Marvell: Add mv88e6390 internal PHY") Signed-off-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/phy/marvell.c | 35 ++++++++++++++++++++++++++++++++++- 1 file changed, 34 insertions(+), 1 deletion(-) commit f275ee0fa3a06eb87edc229749cf1eb18f0663fa Author: Greg Kroah-Hartman Date: Thu Jan 10 21:24:13 2019 +0100 IN_BADCLASS: fix macro to actually work Commit 65cab850f0ee ("net: Allow class-e address assignment via ifconfig ioctl") modified the IN_BADCLASS macro a bit, but unfortunatly one too many '(' characters were added to the line, making any code that used it, not build properly. Also, the macro now compares an unsigned with a signed value, which isn't ok, so fix that up by making both types match properly. Reported-by: Christopher Ferris Fixes: 65cab850f0ee ("net: Allow class-e address assignment via ifconfig ioctl") Cc: Dave Taht Signed-off-by: Greg Kroah-Hartman Signed-off-by: David S. Miller include/uapi/linux/in.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 13d7f46386e060df31b727c9975e38306fa51e7a Author: Willem de Bruijn Date: Thu Jan 10 14:40:33 2019 -0500 tcp: allow MSG_ZEROCOPY transmission also in CLOSE_WAIT state TCP transmission with MSG_ZEROCOPY fails if the peer closes its end of the connection and so transitions this socket to CLOSE_WAIT state. Transmission in close wait state is acceptable. Other similar tests in the stack (e.g., in FastOpen) accept both states. Relax this test, too. Link: https://www.mail-archive.com/netdev@vger.kernel.org/msg276886.html Link: https://www.mail-archive.com/netdev@vger.kernel.org/msg227390.html Fixes: f214f915e7db ("tcp: enable MSG_ZEROCOPY") Reported-by: Marek Majkowski Signed-off-by: Willem de Bruijn CC: Yuchung Cheng CC: Neal Cardwell CC: Soheil Hassas Yeganeh CC: Alexey Kodanev Acked-by: Soheil Hassas Yeganeh Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller net/ipv4/tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1d16073a326891c2a964e4cb95bc18fbcafb5f74 Author: Heiner Kallweit Date: Thu Jan 10 20:22:26 2019 +0100 net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ9031 So far genphy_soft_reset was used automatically if the PHY driver didn't implement the soft_reset callback. This changed with the mentioned commit and broke KSZ9031. To fix this configure the KSZ9031 PHY driver to use genphy_soft_reset. Fixes: 6e2d85ec0559 ("net: phy: Stop with excessive soft reset") Reported-by: Tony Lindgren Signed-off-by: Heiner Kallweit Tested-by: Tony Lindgren Tested-by: Sekhar Nori Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/phy/micrel.c | 1 + 1 file changed, 1 insertion(+) commit 9174c3df1cd181c14913138d50ccbe539bb08335 Author: Davide Caratti Date: Thu Jan 10 20:21:02 2019 +0100 net/sched: act_tunnel_key: fix memory leak in case of action replace running the following TDC test cases: 7afc - Replace tunnel_key set action with all parameters 364d - Replace tunnel_key set action with all parameters and cookie it's possible to trigger kmemleak warnings like: unreferenced object 0xffff94797127ab40 (size 192): comm "tc", pid 3248, jiffies 4300565293 (age 1006.862s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 c0 93 f9 8a ff ff ff ff ................ 41 84 ee 89 ff ff ff ff 00 00 00 00 00 00 00 00 A............... backtrace: [<000000001e85b61c>] tunnel_key_init+0x31d/0x820 [act_tunnel_key] [<000000007f3f6ee7>] tcf_action_init_1+0x384/0x4c0 [<00000000e89e3ded>] tcf_action_init+0x12b/0x1a0 [<00000000c1c8c0f8>] tcf_action_add+0x73/0x170 [<0000000095a9fc28>] tc_ctl_action+0x122/0x160 [<000000004bebeac5>] rtnetlink_rcv_msg+0x263/0x2d0 [<000000009fd862dd>] netlink_rcv_skb+0x4a/0x110 [<00000000b55199e7>] netlink_unicast+0x1a0/0x250 [<000000004996cd21>] netlink_sendmsg+0x2c1/0x3c0 [<000000004d6a94b4>] sock_sendmsg+0x36/0x40 [<000000005d9f0208>] ___sys_sendmsg+0x280/0x2f0 [<00000000dec19023>] __sys_sendmsg+0x5e/0xa0 [<000000004b82ac81>] do_syscall_64+0x5b/0x180 [<00000000a0f1209a>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [<000000002926b2ab>] 0xffffffffffffffff when the tunnel_key action is replaced, the kernel forgets to release the dst metadata: ensure they are released by tunnel_key_init(), the same way it's done in tunnel_key_release(). Fixes: d0f6dd8a914f4 ("net/sched: Introduce act_tunnel_key") Signed-off-by: Davide Caratti Acked-by: Cong Wang Signed-off-by: David S. Miller net/sched/act_tunnel_key.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) commit e122d845a01ece2ddd28b2f125ef2db66b8b627a Author: David Howells Date: Thu Jan 10 16:59:13 2019 +0000 Revert "rxrpc: Allow failed client calls to be retried" The changes introduced to allow rxrpc calls to be retried creates an issue when it comes to refcounting afs_call structs. The problem is that when rxrpc_send_data() queues the last packet for an asynchronous call, the following sequence can occur: (1) The notify_end_tx callback is invoked which causes the state in the afs_call to be changed from AFS_CALL_CL_REQUESTING or AFS_CALL_SV_REPLYING. (2) afs_deliver_to_call() can then process event notifications from rxrpc on the async_work queue. (3) Delivery of events, such as an abort from the server, can cause the afs_call state to be changed to AFS_CALL_COMPLETE on async_work. (4) For an asynchronous call, afs_process_async_call() notes that the call is complete and tried to clean up all the refs on async_work. (5) rxrpc_send_data() might return the amount of data transferred (success) or an error - which could in turn reflect a local error or a received error. Synchronising the clean up after rxrpc_kernel_send_data() returns an error with the asynchronous cleanup is then tricky to get right. Mostly revert commit c038a58ccfd6704d4d7d60ed3d6a0fca13cf13a4. The two API functions the original commit added aren't currently used. This makes rxrpc_kernel_send_data() always return successfully if it queued the data it was given. Note that this doesn't affect synchronous calls since their Rx notification function merely pokes a wait queue and does not refcounting. The asynchronous call notification function *has* to do refcounting and pass a ref over the work item to avoid the need to sync the workqueue in call cleanup. Signed-off-by: David Howells Signed-off-by: David S. Miller Documentation/networking/rxrpc.txt | 45 ------------------ include/net/af_rxrpc.h | 16 ------- net/rxrpc/af_rxrpc.c | 70 --------------------------- net/rxrpc/ar-internal.h | 19 +++++--- net/rxrpc/call_object.c | 97 -------------------------------------- net/rxrpc/conn_client.c | 5 +- net/rxrpc/sendmsg.c | 24 +++++----- 7 files changed, 24 insertions(+), 252 deletions(-) commit 47bfa6d9dc8c060bf56554a465c9031e286d2f80 Merge: 7939f8beecf1 5b0e7310a2a3 Author: Linus Torvalds Date: Wed Jan 16 17:06:39 2019 +1200 Merge tag 'selinux-pr-20190115' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull SELinux fix from Paul Moore: "One small patch to fix a potential NULL dereference on a failed SELinux policy load" * tag 'selinux-pr-20190115' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: fix GPF on invalid policy commit 70a44f9f6e4297e013de29088608ab2c6fb642f7 Merge: d62f38c295e5 2753ca5d9009 Author: David S. Miller Date: Tue Jan 15 20:29:21 2019 -0800 Merge branch 'tipc-uninit-values' Ying Xue says: ==================== tipc: fix uninit-value issues reported by syzbot Recently, syzbot complained that TIPC module exits several issues associated with uninit-value type. So, in this series, we try to fix them as many as possible. ==================== Signed-off-by: David S. Miller commit 2753ca5d9009c180dbfd4c802c80983b4b6108d1 Author: Ying Xue Date: Mon Jan 14 17:22:29 2019 +0800 tipc: fix uninit-value in tipc_nl_compat_doit BUG: KMSAN: uninit-value in tipc_nl_compat_doit+0x404/0xa10 net/tipc/netlink_compat.c:335 CPU: 0 PID: 4514 Comm: syz-executor485 Not tainted 4.16.0+ #87 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x185/0x1d0 lib/dump_stack.c:53 kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067 __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:683 tipc_nl_compat_doit+0x404/0xa10 net/tipc/netlink_compat.c:335 tipc_nl_compat_recv+0x164b/0x2700 net/tipc/netlink_compat.c:1153 genl_family_rcv_msg net/netlink/genetlink.c:599 [inline] genl_rcv_msg+0x1686/0x1810 net/netlink/genetlink.c:624 netlink_rcv_skb+0x378/0x600 net/netlink/af_netlink.c:2447 genl_rcv+0x63/0x80 net/netlink/genetlink.c:635 netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline] netlink_unicast+0x166b/0x1740 net/netlink/af_netlink.c:1337 netlink_sendmsg+0x1048/0x1310 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec net/socket.c:630 [inline] sock_sendmsg net/socket.c:640 [inline] ___sys_sendmsg+0xec0/0x1310 net/socket.c:2046 __sys_sendmsg net/socket.c:2080 [inline] SYSC_sendmsg+0x2a3/0x3d0 net/socket.c:2091 SyS_sendmsg+0x54/0x80 net/socket.c:2087 do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x3d/0xa2 RIP: 0033:0x43fda9 RSP: 002b:00007ffd0c184ba8 EFLAGS: 00000213 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 000000000043fda9 RDX: 0000000000000000 RSI: 0000000020023000 RDI: 0000000000000003 RBP: 00000000006ca018 R08: 00000000004002c8 R09: 00000000004002c8 R10: 00000000004002c8 R11: 0000000000000213 R12: 00000000004016d0 R13: 0000000000401760 R14: 0000000000000000 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline] kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:188 kmsan_kmalloc+0x94/0x100 mm/kmsan/kmsan.c:314 kmsan_slab_alloc+0x11/0x20 mm/kmsan/kmsan.c:321 slab_post_alloc_hook mm/slab.h:445 [inline] slab_alloc_node mm/slub.c:2737 [inline] __kmalloc_node_track_caller+0xaed/0x11c0 mm/slub.c:4369 __kmalloc_reserve net/core/skbuff.c:138 [inline] __alloc_skb+0x2cf/0x9f0 net/core/skbuff.c:206 alloc_skb include/linux/skbuff.h:984 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1183 [inline] netlink_sendmsg+0x9a6/0x1310 net/netlink/af_netlink.c:1875 sock_sendmsg_nosec net/socket.c:630 [inline] sock_sendmsg net/socket.c:640 [inline] ___sys_sendmsg+0xec0/0x1310 net/socket.c:2046 __sys_sendmsg net/socket.c:2080 [inline] SYSC_sendmsg+0x2a3/0x3d0 net/socket.c:2091 SyS_sendmsg+0x54/0x80 net/socket.c:2087 do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x3d/0xa2 In tipc_nl_compat_recv(), when the len variable returned by nlmsg_attrlen() is 0, the message is still treated as a valid one, which is obviously unresonable. When len is zero, it means the message not only doesn't contain any valid TLV payload, but also TLV header is not included. Under this stituation, tlv_type field in TLV header is still accessed in tipc_nl_compat_dumpit() or tipc_nl_compat_doit(), but the field space is obviously illegal. Of course, it is not initialized. Reported-by: syzbot+bca0dc46634781f08b38@syzkaller.appspotmail.com Reported-by: syzbot+6bdb590321a7ae40c1a6@syzkaller.appspotmail.com Signed-off-by: Ying Xue Signed-off-by: David S. Miller net/tipc/netlink_compat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 974cb0e3e7c963ced06c4e32c5b2884173fa5e01 Author: Ying Xue Date: Mon Jan 14 17:22:28 2019 +0800 tipc: fix uninit-value in tipc_nl_compat_name_table_dump syzbot reported: BUG: KMSAN: uninit-value in __arch_swab32 arch/x86/include/uapi/asm/swab.h:10 [inline] BUG: KMSAN: uninit-value in __fswab32 include/uapi/linux/swab.h:59 [inline] BUG: KMSAN: uninit-value in tipc_nl_compat_name_table_dump+0x4a8/0xba0 net/tipc/netlink_compat.c:826 CPU: 0 PID: 6290 Comm: syz-executor848 Not tainted 4.19.0-rc8+ #70 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x306/0x460 lib/dump_stack.c:113 kmsan_report+0x1a2/0x2e0 mm/kmsan/kmsan.c:917 __msan_warning+0x7c/0xe0 mm/kmsan/kmsan_instr.c:500 __arch_swab32 arch/x86/include/uapi/asm/swab.h:10 [inline] __fswab32 include/uapi/linux/swab.h:59 [inline] tipc_nl_compat_name_table_dump+0x4a8/0xba0 net/tipc/netlink_compat.c:826 __tipc_nl_compat_dumpit+0x59e/0xdb0 net/tipc/netlink_compat.c:205 tipc_nl_compat_dumpit+0x63a/0x820 net/tipc/netlink_compat.c:270 tipc_nl_compat_handle net/tipc/netlink_compat.c:1151 [inline] tipc_nl_compat_recv+0x1402/0x2760 net/tipc/netlink_compat.c:1210 genl_family_rcv_msg net/netlink/genetlink.c:601 [inline] genl_rcv_msg+0x185c/0x1a20 net/netlink/genetlink.c:626 netlink_rcv_skb+0x394/0x640 net/netlink/af_netlink.c:2454 genl_rcv+0x63/0x80 net/netlink/genetlink.c:637 netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline] netlink_unicast+0x166d/0x1720 net/netlink/af_netlink.c:1343 netlink_sendmsg+0x1391/0x1420 net/netlink/af_netlink.c:1908 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg net/socket.c:631 [inline] ___sys_sendmsg+0xe47/0x1200 net/socket.c:2116 __sys_sendmsg net/socket.c:2154 [inline] __do_sys_sendmsg net/socket.c:2163 [inline] __se_sys_sendmsg+0x307/0x460 net/socket.c:2161 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2161 do_syscall_64+0xbe/0x100 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 RIP: 0033:0x440179 Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffecec49318 EFLAGS: 00000213 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440179 RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000003 RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 R10: 0000000000000000 R11: 0000000000000213 R12: 0000000000401a00 R13: 0000000000401a90 R14: 0000000000000000 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:255 [inline] kmsan_internal_poison_shadow+0xc8/0x1d0 mm/kmsan/kmsan.c:180 kmsan_kmalloc+0xa4/0x120 mm/kmsan/kmsan_hooks.c:104 kmsan_slab_alloc+0x10/0x20 mm/kmsan/kmsan_hooks.c:113 slab_post_alloc_hook mm/slab.h:446 [inline] slab_alloc_node mm/slub.c:2727 [inline] __kmalloc_node_track_caller+0xb43/0x1400 mm/slub.c:4360 __kmalloc_reserve net/core/skbuff.c:138 [inline] __alloc_skb+0x422/0xe90 net/core/skbuff.c:206 alloc_skb include/linux/skbuff.h:996 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1189 [inline] netlink_sendmsg+0xcaf/0x1420 net/netlink/af_netlink.c:1883 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg net/socket.c:631 [inline] ___sys_sendmsg+0xe47/0x1200 net/socket.c:2116 __sys_sendmsg net/socket.c:2154 [inline] __do_sys_sendmsg net/socket.c:2163 [inline] __se_sys_sendmsg+0x307/0x460 net/socket.c:2161 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2161 do_syscall_64+0xbe/0x100 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 We cannot take for granted the thing that the length of data contained in TLV is longer than the size of struct tipc_name_table_query in tipc_nl_compat_name_table_dump(). Reported-by: syzbot+06e771a754829716a327@syzkaller.appspotmail.com Signed-off-by: Ying Xue Signed-off-by: David S. Miller net/tipc/netlink_compat.c | 2 ++ 1 file changed, 2 insertions(+) commit edf5ff04a45750ac8ce2435974f001dc9cfbf055 Author: Ying Xue Date: Mon Jan 14 17:22:27 2019 +0800 tipc: fix uninit-value in tipc_nl_compat_link_set syzbot reports following splat: BUG: KMSAN: uninit-value in strlen+0x3b/0xa0 lib/string.c:486 CPU: 1 PID: 9306 Comm: syz-executor172 Not tainted 4.20.0-rc7+ #2 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x173/0x1d0 lib/dump_stack.c:113 kmsan_report+0x12e/0x2a0 mm/kmsan/kmsan.c:613 __msan_warning+0x82/0xf0 mm/kmsan/kmsan_instr.c:313 strlen+0x3b/0xa0 lib/string.c:486 nla_put_string include/net/netlink.h:1154 [inline] __tipc_nl_compat_link_set net/tipc/netlink_compat.c:708 [inline] tipc_nl_compat_link_set+0x929/0x1220 net/tipc/netlink_compat.c:744 __tipc_nl_compat_doit net/tipc/netlink_compat.c:311 [inline] tipc_nl_compat_doit+0x3aa/0xaf0 net/tipc/netlink_compat.c:344 tipc_nl_compat_handle net/tipc/netlink_compat.c:1107 [inline] tipc_nl_compat_recv+0x14d7/0x2760 net/tipc/netlink_compat.c:1210 genl_family_rcv_msg net/netlink/genetlink.c:601 [inline] genl_rcv_msg+0x185f/0x1a60 net/netlink/genetlink.c:626 netlink_rcv_skb+0x444/0x640 net/netlink/af_netlink.c:2477 genl_rcv+0x63/0x80 net/netlink/genetlink.c:637 netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline] netlink_unicast+0xf40/0x1020 net/netlink/af_netlink.c:1336 netlink_sendmsg+0x127f/0x1300 net/netlink/af_netlink.c:1917 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg net/socket.c:631 [inline] ___sys_sendmsg+0xdb9/0x11b0 net/socket.c:2116 __sys_sendmsg net/socket.c:2154 [inline] __do_sys_sendmsg net/socket.c:2163 [inline] __se_sys_sendmsg+0x305/0x460 net/socket.c:2161 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2161 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 The uninitialised access happened in nla_put_string(skb, TIPC_NLA_LINK_NAME, lc->name) This is because lc->name string is not validated before it's used. Reported-by: syzbot+d78b8a29241a195aefb8@syzkaller.appspotmail.com Signed-off-by: Ying Xue Signed-off-by: David S. Miller net/tipc/netlink_compat.c | 5 +++++ 1 file changed, 5 insertions(+) commit 0762216c0ad2a2fccd63890648eca491f2c83d9a Author: Ying Xue Date: Mon Jan 14 17:22:26 2019 +0800 tipc: fix uninit-value in tipc_nl_compat_bearer_enable syzbot reported: BUG: KMSAN: uninit-value in strlen+0x3b/0xa0 lib/string.c:484 CPU: 1 PID: 6371 Comm: syz-executor652 Not tainted 4.19.0-rc8+ #70 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x306/0x460 lib/dump_stack.c:113 kmsan_report+0x1a2/0x2e0 mm/kmsan/kmsan.c:917 __msan_warning+0x7c/0xe0 mm/kmsan/kmsan_instr.c:500 strlen+0x3b/0xa0 lib/string.c:484 nla_put_string include/net/netlink.h:1011 [inline] tipc_nl_compat_bearer_enable+0x238/0x7b0 net/tipc/netlink_compat.c:389 __tipc_nl_compat_doit net/tipc/netlink_compat.c:311 [inline] tipc_nl_compat_doit+0x39f/0xae0 net/tipc/netlink_compat.c:344 tipc_nl_compat_recv+0x147c/0x2760 net/tipc/netlink_compat.c:1107 genl_family_rcv_msg net/netlink/genetlink.c:601 [inline] genl_rcv_msg+0x185c/0x1a20 net/netlink/genetlink.c:626 netlink_rcv_skb+0x394/0x640 net/netlink/af_netlink.c:2454 genl_rcv+0x63/0x80 net/netlink/genetlink.c:637 netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline] netlink_unicast+0x166d/0x1720 net/netlink/af_netlink.c:1343 netlink_sendmsg+0x1391/0x1420 net/netlink/af_netlink.c:1908 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg net/socket.c:631 [inline] ___sys_sendmsg+0xe47/0x1200 net/socket.c:2116 __sys_sendmsg net/socket.c:2154 [inline] __do_sys_sendmsg net/socket.c:2163 [inline] __se_sys_sendmsg+0x307/0x460 net/socket.c:2161 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2161 do_syscall_64+0xbe/0x100 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 RIP: 0033:0x440179 Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fffef7beee8 EFLAGS: 00000213 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440179 RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000003 RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 R10: 0000000000000000 R11: 0000000000000213 R12: 0000000000401a00 R13: 0000000000401a90 R14: 0000000000000000 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:255 [inline] kmsan_internal_poison_shadow+0xc8/0x1d0 mm/kmsan/kmsan.c:180 kmsan_kmalloc+0xa4/0x120 mm/kmsan/kmsan_hooks.c:104 kmsan_slab_alloc+0x10/0x20 mm/kmsan/kmsan_hooks.c:113 slab_post_alloc_hook mm/slab.h:446 [inline] slab_alloc_node mm/slub.c:2727 [inline] __kmalloc_node_track_caller+0xb43/0x1400 mm/slub.c:4360 __kmalloc_reserve net/core/skbuff.c:138 [inline] __alloc_skb+0x422/0xe90 net/core/skbuff.c:206 alloc_skb include/linux/skbuff.h:996 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1189 [inline] netlink_sendmsg+0xcaf/0x1420 net/netlink/af_netlink.c:1883 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg net/socket.c:631 [inline] ___sys_sendmsg+0xe47/0x1200 net/socket.c:2116 __sys_sendmsg net/socket.c:2154 [inline] __do_sys_sendmsg net/socket.c:2163 [inline] __se_sys_sendmsg+0x307/0x460 net/socket.c:2161 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2161 do_syscall_64+0xbe/0x100 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 The root cause is that we don't validate whether bear name is a valid string in tipc_nl_compat_bearer_enable(). Meanwhile, we also fix the same issue in the following functions: tipc_nl_compat_bearer_disable() tipc_nl_compat_link_stat_dump() tipc_nl_compat_media_set() tipc_nl_compat_bearer_set() Reported-by: syzbot+b33d5cae0efd35dbfe77@syzkaller.appspotmail.com Signed-off-by: Ying Xue Signed-off-by: David S. Miller net/tipc/netlink_compat.c | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) commit 8b66fee7f8ee18f9c51260e7a43ab37db5177a05 Author: Ying Xue Date: Mon Jan 14 17:22:25 2019 +0800 tipc: fix uninit-value in tipc_nl_compat_link_reset_stats syzbot reports following splat: BUG: KMSAN: uninit-value in strlen+0x3b/0xa0 lib/string.c:486 CPU: 1 PID: 11057 Comm: syz-executor0 Not tainted 4.20.0-rc7+ #2 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x173/0x1d0 lib/dump_stack.c:113 kmsan_report+0x12e/0x2a0 mm/kmsan/kmsan.c:613 __msan_warning+0x82/0xf0 mm/kmsan/kmsan_instr.c:295 strlen+0x3b/0xa0 lib/string.c:486 nla_put_string include/net/netlink.h:1154 [inline] tipc_nl_compat_link_reset_stats+0x1f0/0x360 net/tipc/netlink_compat.c:760 __tipc_nl_compat_doit net/tipc/netlink_compat.c:311 [inline] tipc_nl_compat_doit+0x3aa/0xaf0 net/tipc/netlink_compat.c:344 tipc_nl_compat_handle net/tipc/netlink_compat.c:1107 [inline] tipc_nl_compat_recv+0x14d7/0x2760 net/tipc/netlink_compat.c:1210 genl_family_rcv_msg net/netlink/genetlink.c:601 [inline] genl_rcv_msg+0x185f/0x1a60 net/netlink/genetlink.c:626 netlink_rcv_skb+0x444/0x640 net/netlink/af_netlink.c:2477 genl_rcv+0x63/0x80 net/netlink/genetlink.c:637 netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline] netlink_unicast+0xf40/0x1020 net/netlink/af_netlink.c:1336 netlink_sendmsg+0x127f/0x1300 net/netlink/af_netlink.c:1917 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg net/socket.c:631 [inline] ___sys_sendmsg+0xdb9/0x11b0 net/socket.c:2116 __sys_sendmsg net/socket.c:2154 [inline] __do_sys_sendmsg net/socket.c:2163 [inline] __se_sys_sendmsg+0x305/0x460 net/socket.c:2161 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2161 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 RIP: 0033:0x457ec9 Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f2557338c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457ec9 RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000003 RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f25573396d4 R13: 00000000004cb478 R14: 00000000004d86c8 R15: 00000000ffffffff Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:204 [inline] kmsan_internal_poison_shadow+0x92/0x150 mm/kmsan/kmsan.c:158 kmsan_kmalloc+0xa6/0x130 mm/kmsan/kmsan_hooks.c:176 kmsan_slab_alloc+0xe/0x10 mm/kmsan/kmsan_hooks.c:185 slab_post_alloc_hook mm/slab.h:446 [inline] slab_alloc_node mm/slub.c:2759 [inline] __kmalloc_node_track_caller+0xe18/0x1030 mm/slub.c:4383 __kmalloc_reserve net/core/skbuff.c:137 [inline] __alloc_skb+0x309/0xa20 net/core/skbuff.c:205 alloc_skb include/linux/skbuff.h:998 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1182 [inline] netlink_sendmsg+0xb82/0x1300 net/netlink/af_netlink.c:1892 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg net/socket.c:631 [inline] ___sys_sendmsg+0xdb9/0x11b0 net/socket.c:2116 __sys_sendmsg net/socket.c:2154 [inline] __do_sys_sendmsg net/socket.c:2163 [inline] __se_sys_sendmsg+0x305/0x460 net/socket.c:2161 __x64_sys_sendmsg+0x4a/0x70 net/socket.c:2161 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 The uninitialised access happened in tipc_nl_compat_link_reset_stats: nla_put_string(skb, TIPC_NLA_LINK_NAME, name) This is because name string is not validated before it's used. Reported-by: syzbot+e01d94b5a4c266be6e4c@syzkaller.appspotmail.com Signed-off-by: Ying Xue Signed-off-by: David S. Miller net/tipc/netlink_compat.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) commit a88289f4ddee4165d5f796bd99e09eec3133c16b Author: Ying Xue Date: Mon Jan 14 17:22:24 2019 +0800 tipc: fix uninit-value in in tipc_conn_rcv_sub syzbot reported: BUG: KMSAN: uninit-value in tipc_conn_rcv_sub+0x184/0x950 net/tipc/topsrv.c:373 CPU: 0 PID: 66 Comm: kworker/u4:4 Not tainted 4.17.0-rc3+ #88 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: tipc_rcv tipc_conn_recv_work Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x185/0x1d0 lib/dump_stack.c:113 kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067 __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:683 tipc_conn_rcv_sub+0x184/0x950 net/tipc/topsrv.c:373 tipc_conn_rcv_from_sock net/tipc/topsrv.c:409 [inline] tipc_conn_recv_work+0x3cd/0x560 net/tipc/topsrv.c:424 process_one_work+0x12c6/0x1f60 kernel/workqueue.c:2145 worker_thread+0x113c/0x24f0 kernel/workqueue.c:2279 kthread+0x539/0x720 kernel/kthread.c:239 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:412 Local variable description: ----s.i@tipc_conn_recv_work Variable was created at: tipc_conn_recv_work+0x65/0x560 net/tipc/topsrv.c:419 process_one_work+0x12c6/0x1f60 kernel/workqueue.c:2145 In tipc_conn_rcv_from_sock(), it always supposes the length of message received from sock_recvmsg() is not smaller than the size of struct tipc_subscr. However, this assumption is false. Especially when the length of received message is shorter than struct tipc_subscr size, we will end up touching uninitialized fields in tipc_conn_rcv_sub(). Reported-by: syzbot+8951a3065ee7fd6d6e23@syzkaller.appspotmail.com Reported-by: syzbot+75e6e042c5bbf691fc82@syzkaller.appspotmail.com Signed-off-by: Ying Xue Signed-off-by: David S. Miller net/tipc/topsrv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d62f38c295e56147e8298af1e0e0ec9e7cc14937 Merge: 80b3671e9377 8c6c37fdc20e Author: David S. Miller Date: Tue Jan 15 20:12:01 2019 -0800 Merge branch 'sch_cake-leaf-qdisc-fixes' Toke Høiland-Jørgensen says: ==================== sched: Fix qdisc interactions exposed by using sch_cake as a leaf qdisc This series fixes a couple of issues exposed by running sch_cake as a leaf qdisc in an HFSC tree, which were discovered and reported by Pete Heist. The interaction between CAKE's GSO splitting and the parent qdisc's notion of its own queue length could cause queue stalls. While investigating the report, I also noticed that several qdiscs would dereference the skb pointer after dequeue, which is potentially problematic since the GSO splitting code also frees the original skb. See the individual patches in the series for details. ==================== Signed-off-by: David S. Miller commit 8c6c37fdc20ec9ffaa342f827a8e20afe736fb0c Author: Toke Høiland-Jørgensen Date: Wed Jan 9 17:09:44 2019 +0100 sch_cake: Correctly update parent qlen when splitting GSO packets To ensure parent qdiscs have the same notion of the number of enqueued packets even after splitting a GSO packet, update the qdisc tree with the number of packets that was added due to the split. Reported-by: Pete Heist Tested-by: Pete Heist Signed-off-by: Toke Høiland-Jørgensen Signed-off-by: David S. Miller net/sched/sch_cake.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 37d9cf1a3ce35de3df6f7d209bfb1f50cf188cea Author: Toke Høiland-Jørgensen Date: Wed Jan 9 17:09:43 2019 +0100 sched: Fix detection of empty queues in child qdiscs Several qdiscs check on enqueue whether the packet was enqueued to a class with an empty queue, in which case the class is activated. This is done by checking if the qlen is exactly 1 after enqueue. However, if GSO splitting is enabled in the child qdisc, a single packet can result in a qlen longer than 1. This means the activation check fails, leading to a stalled queue. Fix this by checking if the queue is empty *before* enqueue, and running the activation logic if this was the case. Reported-by: Pete Heist Signed-off-by: Toke Høiland-Jørgensen Signed-off-by: David S. Miller net/sched/sch_drr.c | 4 +++- net/sched/sch_hfsc.c | 4 +++- net/sched/sch_qfq.c | 4 +++- 3 files changed, 9 insertions(+), 3 deletions(-) commit f6bab199315b70fd83fe3ee0947bc84c7a35f3d4 Author: Toke Høiland-Jørgensen Date: Wed Jan 9 17:09:42 2019 +0100 sched: Avoid dereferencing skb pointer after child enqueue Parent qdiscs may dereference the pointer to the enqueued skb after enqueue. However, both CAKE and TBF call consume_skb() on the original skb when splitting GSO packets, leading to a potential use-after-free in the parent. Fix this by avoiding dereferencing the skb pointer after enqueueing to the child. Signed-off-by: Toke Høiland-Jørgensen Signed-off-by: David S. Miller net/sched/sch_cbs.c | 3 ++- net/sched/sch_drr.c | 3 ++- net/sched/sch_dsmark.c | 3 ++- net/sched/sch_hfsc.c | 5 ++--- net/sched/sch_htb.c | 3 ++- net/sched/sch_prio.c | 3 ++- net/sched/sch_qfq.c | 16 +++++++++------- net/sched/sch_tbf.c | 3 ++- 8 files changed, 23 insertions(+), 16 deletions(-) commit 6e8ccb4f624a73c56fc6ef0c45bcf91ca80703c3 Author: Stanislav Fomichev Date: Tue Jan 15 14:03:27 2019 -0800 tools/bpf: properly account for libbfd variations On some platforms, in order to link against libbfd, we need to link against liberty and even possibly libz. Account for that in the bpftool Makefile. We now have proper feature detection for each case, so handle each one separately. See recent commit 14541b1e7e72 ("perf build: Don't unconditionally link the libbfd feature test to -liberty and -lz") where I fixed feature detection. v2 (addressed Jakub's nits): * better syntax for 'else ifeq' * no space between ifeq args v3: * use LIBS, not EXTLIBS for -DHAVE_LIBBFD_SUPPORT Fixes: 29a9c10e4110 ("bpftool: make libbfd optional") Signed-off-by: Stanislav Fomichev Acked-by: Jakub Kicinski Signed-off-by: Daniel Borkmann tools/bpf/bpftool/Makefile | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit 77f88abd4a6f73a1a68dbdc0e3f21575fd508fc3 Author: Ming Lei Date: Tue Jan 15 17:31:29 2019 -0600 PCI/MSI: Return -ENOSPC from pci_alloc_irq_vectors_affinity() The API of pci_alloc_irq_vectors_affinity() says it returns -ENOSPC if fewer than @min_vecs interrupt vectors are available for @dev. However, if a device supports MSI-X but not MSI and a caller requests @min_vecs that can't be satisfied by MSI-X, we previously returned -EINVAL (from the failed attempt to enable MSI), not -ENOSPC. When -ENOSPC is returned, callers may reduce the number IRQs they request and try again. Most callers can use the @min_vecs and @max_vecs parameters to avoid this retry loop, but that doesn't work when using IRQ affinity "nr_sets" because rebalancing the sets is driver-specific. This return value bug has been present since pci_alloc_irq_vectors() was added in v4.10 by aff171641d18 ("PCI: Provide sensible IRQ vector alloc/free routines"), but it wasn't an issue because @min_vecs/@max_vecs removed the need for callers to iteratively reduce the number of IRQs requested and retry the allocation, so they didn't need to distinguish -ENOSPC from -EINVAL. In v5.0, 6da4b3ab9a6e ("genirq/affinity: Add support for allocating interrupt sets") added IRQ sets to the interface, which reintroduced the need to check for -ENOSPC and possibly reduce the number of IRQs requested and retry the allocation. Signed-off-by: Ming Lei [bhelgaas: changelog] Signed-off-by: Bjorn Helgaas Cc: Jens Axboe Cc: Keith Busch Cc: Christoph Hellwig drivers/pci/msi.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) commit b1c0330823fe842dbb34641f1410f0afa51c29d3 Author: Rafael J. Wysocki Date: Wed Jan 9 00:34:37 2019 +0100 ACPI: EC: Look for ECDT EC after calling acpi_load_tables() Some systems have had functional issues since commit 5a8361f7ecce (ACPICA: Integrate package handling with module-level code) that, among other things, changed the initial values of the acpi_gbl_group_module_level_code and acpi_gbl_parse_table_as_term_list global flags in ACPICA which implicitly caused acpi_ec_ecdt_probe() to be called before acpi_load_tables() on the vast majority of platforms. Namely, before commit 5a8361f7ecce, acpi_load_tables() was called from acpi_early_init() if acpi_gbl_parse_table_as_term_list was FALSE and acpi_gbl_group_module_level_code was TRUE, which almost always was the case as FALSE and TRUE were their initial values, respectively. The acpi_gbl_parse_table_as_term_list value would be changed to TRUE for a couple of platforms in acpi_quirks_dmi_table[], but it remained FALSE in the vast majority of cases. After commit 5a8361f7ecce, the initial values of the two flags have been reversed, so in effect acpi_load_tables() has not been called from acpi_early_init() any more. That, in turn, affects acpi_ec_ecdt_probe() which is invoked before acpi_load_tables() now and it is not possible to evaluate the _REG method for the EC address space handler installed by it. That effectively causes the EC address space to be inaccessible to AML on platforms with an ECDT matching the EC device definition in the DSDT and functional problems ensue in there. Because the default behavior before commit 5a8361f7ecce was to call acpi_ec_ecdt_probe() after acpi_load_tables(), it should be safe to do that again. Moreover, the EC address space handler installed by acpi_ec_ecdt_probe() is only needed for AML to be able to access the EC address space and the only AML that can run during acpi_load_tables() is module-level code which only is allowed to access address spaces with default handlers (memory, I/O and PCI config space). For this reason, move the acpi_ec_ecdt_probe() invocation back to acpi_bus_init(), from where it was taken away by commit d737f333b211 (ACPI: probe ECDT before loading AML tables regardless of module-level code flag), and put it after the invocation of acpi_load_tables() to restore the original code ordering from before commit 5a8361f7ecce. Fixes: 5a8361f7ecce ("ACPICA: Integrate package handling with module-level code") Link: https://bugzilla.kernel.org/show_bug.cgi?id=199981 Reported-by: step-ali Reported-by: Charles Stanhope Tested-by: Charles Stanhope Reported-by: Paulo Nascimento Reported-by: David Purton Reported-by: Adam Harvey Reported-by: Zhang Rui Tested-by: Zhang Rui Tested-by: Jean-Marc Lenoir Signed-off-by: Rafael J. Wysocki drivers/acpi/bus.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) commit 6f9b5e70dfcde983192155549f584472aa9f54cd Author: Sinan Kaya Date: Sat Jan 5 10:06:06 2019 +0000 drivers: thermal: int340x_thermal: Make PCI dependency explicit After commit 5d32a66541c4 (PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set) dependencies on CONFIG_PCI that previously were satisfied implicitly through dependencies on CONFIG_ACPI have to be specified directly. IOSF_CORE depends on PCI. For this reason, add a direct dependency on CONFIG_PCI. Fixes: 5d32a66541c46 ("PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set") Signed-off-by: Sinan Kaya Signed-off-by: Rafael J. Wysocki drivers/thermal/intel/int340x_thermal/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e9820d6b0a6c85f753e8d6626320367ef12ebe15 Author: Sinan Kaya Date: Sat Jan 5 10:06:05 2019 +0000 x86/intel/lpss: Make PCI dependency explicit After commit 5d32a66541c4 (PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set) dependencies on CONFIG_PCI that previously were satisfied implicitly through dependencies on CONFIG_ACPI have to be specified directly. LPSS code relies on PCI infrastructure but this dependency has not been called out explicitly yet. Fixes: 5d32a66541c46 ("PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set") Signed-off-by: Sinan Kaya Signed-off-by: Rafael J. Wysocki arch/x86/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7934d76c88816f12ac991540eeece403204f8a1c Author: Sinan Kaya Date: Sat Jan 5 10:06:01 2019 +0000 platform/x86: apple-gmux: Make PCI dependency explicit After commit 5d32a66541c4 (PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set) dependencies on CONFIG_PCI that previously were satisfied implicitly through dependencies on CONFIG_ACPI have to be specified directly. This driver depends on the PCI infrastructure but the dependency has not been called out explicitly yet. Fixes: 5d32a66541c46 ("PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set") Signed-off-by: Sinan Kaya Reviewed-by: Andy Shevchenko Signed-off-by: Rafael J. Wysocki drivers/platform/x86/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 737ee5824d91292682be7e0c0771ad67992c199f Author: Sinan Kaya Date: Sat Jan 5 10:06:00 2019 +0000 platform/x86: intel_pmc: Make PCI dependency explicit After commit 5d32a66541c4 (PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set) dependencies on CONFIG_PCI that previously were satisfied implicitly through dependencies on CONFIG_ACPI have to be specified directly. Some code in intel_pmc relies on PCI for execution. Specify this in the Kconfig. [ Andy S: For sake of a quick fix this introduces a new mandatory dependency to the driver which may survive without it. Otherwise we need to revisit the driver architecture to address this properly. ] Fixes: 5d32a66541c46 ("PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set") Signed-off-by: Sinan Kaya Signed-off-by: Rafael J. Wysocki drivers/platform/x86/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 63680e0d625be8f4bd570d30aaf3562551e179e3 Author: Sinan Kaya Date: Sat Jan 5 10:05:59 2019 +0000 platform/x86: intel_ips: make PCI dependency explicit After commit 5d32a66541c4 (PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set) dependencies on CONFIG_PCI that previously were satisfied implicitly through dependencies on CONFIG_ACPI have to be specified directly. intel_ips is a PCI device driver but this has not been mentioned anywhere in Kconfig. Fixes: 5d32a66541c46 ("PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set") Signed-off-by: Sinan Kaya Acked-by: Andy Shevchenko Signed-off-by: Rafael J. Wysocki drivers/platform/x86/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 94e8e8e97661dc3c2a4c253755f6bfe9e2e697f3 Author: Sinan Kaya Date: Sat Jan 5 10:05:58 2019 +0000 vga-switcheroo: make PCI dependency explicit This driver depends on the PCI infrastructure, but the dependency has not been explicitly called out. Fixes: 5d32a66541c46 ("PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set") Signed-off-by: Sinan Kaya Reviewed-by: Lukas Wunner Acked-by: Daniel Vetter Signed-off-by: Rafael J. Wysocki drivers/gpu/vga/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 995592bc531992d4a93c37d86e7f9635ee823258 Author: Sinan Kaya Date: Sat Jan 5 10:05:57 2019 +0000 ata: pata_acpi: Make PCI dependency explicit After commit 5d32a66541c4 (PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set) dependencies on CONFIG_PCI that previously were satisfied implicitly through dependencies on CONFIG_ACPI have to be specified directly. PATA_ACPI is a PCI device driver but the PCI dependency has not been explicitly called out. Fixes: 5d32a66541c46 ("PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set") Acked-by: Bartlomiej Zolnierkiewicz Signed-off-by: Sinan Kaya Reviewed-by: Jens Axboe Signed-off-by: Rafael J. Wysocki drivers/ata/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1622745551db05071ed7263abf768007f7cbd3ae Author: Sinan Kaya Date: Sat Jan 5 10:05:56 2019 +0000 ACPI / LPSS: Make PCI dependency explicit After commit 5d32a66541c4 (PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set), it is possible to build ACPI without any PCI support. This code depends on PCI. Compile only when PCI is present. Fixes: 5d32a66541c46 ("PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set") Signed-off-by: Sinan Kaya Signed-off-by: Rafael J. Wysocki drivers/acpi/Makefile | 3 ++- drivers/acpi/internal.h | 4 ++++ 2 files changed, 6 insertions(+), 1 deletion(-) commit faa8bd6e12e6aeea289d8e6ba74777b72a69434c Author: Dave Jiang Date: Tue Jan 15 11:26:21 2019 -0700 libnvdimm/security: Fix nvdimm_security_state() state request selection The input parameter should be enum nvdimm_passphrase_type instead of bool for selection of master/user for selection of extended master passphrase state or the regular user passphrase state. Fixes: 89fa9d8ea7bdf ("...add Intel DSM 1.8 master passphrase support") Signed-off-by: Dave Jiang Signed-off-by: Dan Williams drivers/nvdimm/nd-core.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 80b3671e9377916bf2b02e56113fa7377ce5705a Author: Hangbin Liu Date: Thu Jan 10 11:17:42 2019 +0800 ip6_gre: update version related info when changing link We forgot to update ip6erspan version related info when changing link, which will cause setting new hwid failed. Reported-by: Jianlin Shi Fixes: 94d7d8f292870 ("ip6_gre: add erspan v2 support") Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller net/ipv6/ip6_gre.c | 4 ++++ 1 file changed, 4 insertions(+) commit d9f903f6af3dc6d13b21c0eca8f4a169aa70d80d Author: Heiner Kallweit Date: Wed Jan 9 20:34:56 2019 +0100 net: phy: fix too strict check in phy_start_aneg When adding checks to detect wrong usage of the phylib API we added a check to phy_start_aneg() which is too strict. If the phylib state machine is in state PHY_HALTED we should allow reconfiguring and restarting aneg, and just don't touch the state. Fixes: 2b3e88ea6528 ("net: phy: improve phy state checking") Reported-by: Chris Wilson Signed-off-by: Heiner Kallweit Tested-by: Chris Wilson Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/phy/phy.c | 19 +++++++------------ 1 file changed, 7 insertions(+), 12 deletions(-) commit 5642e27bf6a935c1d0d9149e83d625dfba286463 Author: Jeff Kirsher Date: Wed Jan 9 09:10:53 2019 -0800 Revert "igb: reduce CPU0 latency when updating statistics" This reverts commit 59361316afcb08569af21e1af83e89c7051c055a. Due to problems found in additional testing, this causes an illegal context switch in the RCU read-side critical section. CC: Dave Jones CC: Cong Wang CC: Jan Jablonsky Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller drivers/net/ethernet/intel/igb/igb.h | 2 +- drivers/net/ethernet/intel/igb/igb_ethtool.c | 4 ++-- drivers/net/ethernet/intel/igb/igb_main.c | 14 +++++++------- 3 files changed, 10 insertions(+), 10 deletions(-) commit 5be99560c6a0c24b7a0cc3bb4f26051c92cdff2a Author: Dan Carpenter Date: Wed Jan 9 13:50:07 2019 +0300 selftests/txtimestamp: Fix an equals vs assign bug This should be == instead of =. Fixes: b52354aa068e ("selftests: expand txtimestamp with ipv6 dgram + raw and pf_packet") Signed-off-by: Dan Carpenter Acked-by: Willem de Bruijn Signed-off-by: David S. Miller tools/testing/selftests/networking/timestamping/txtimestamp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f97f4dd8b3bb9d0993d2491e0f22024c68109184 Author: Ido Schimmel Date: Wed Jan 9 09:57:39 2019 +0000 net: ipv4: Fix memory leak in network namespace dismantle IPv4 routing tables are flushed in two cases: 1. In response to events in the netdev and inetaddr notification chains 2. When a network namespace is being dismantled In both cases only routes associated with a dead nexthop group are flushed. However, a nexthop group will only be marked as dead in case it is populated with actual nexthops using a nexthop device. This is not the case when the route in question is an error route (e.g., 'blackhole', 'unreachable'). Therefore, when a network namespace is being dismantled such routes are not flushed and leaked [1]. To reproduce: # ip netns add blue # ip -n blue route add unreachable 192.0.2.0/24 # ip netns del blue Fix this by not skipping error routes that are not marked with RTNH_F_DEAD when flushing the routing tables. To prevent the flushing of such routes in case #1, add a parameter to fib_table_flush() that indicates if the table is flushed as part of namespace dismantle or not. Note that this problem does not exist in IPv6 since error routes are associated with the loopback device. [1] unreferenced object 0xffff888066650338 (size 56): comm "ip", pid 1206, jiffies 4294786063 (age 26.235s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 b0 1c 62 61 80 88 ff ff ..........ba.... e8 8b a1 64 80 88 ff ff 00 07 00 08 fe 00 00 00 ...d............ backtrace: [<00000000856ed27d>] inet_rtm_newroute+0x129/0x220 [<00000000fcdfc00a>] rtnetlink_rcv_msg+0x397/0xa20 [<00000000cb85801a>] netlink_rcv_skb+0x132/0x380 [<00000000ebc991d2>] netlink_unicast+0x4c0/0x690 [<0000000014f62875>] netlink_sendmsg+0x929/0xe10 [<00000000bac9d967>] sock_sendmsg+0xc8/0x110 [<00000000223e6485>] ___sys_sendmsg+0x77a/0x8f0 [<000000002e94f880>] __sys_sendmsg+0xf7/0x250 [<00000000ccb1fa72>] do_syscall_64+0x14d/0x610 [<00000000ffbe3dae>] entry_SYSCALL_64_after_hwframe+0x49/0xbe [<000000003a8b605b>] 0xffffffffffffffff unreferenced object 0xffff888061621c88 (size 48): comm "ip", pid 1206, jiffies 4294786063 (age 26.235s) hex dump (first 32 bytes): 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk 6b 6b 6b 6b 6b 6b 6b 6b d8 8e 26 5f 80 88 ff ff kkkkkkkk..&_.... backtrace: [<00000000733609e3>] fib_table_insert+0x978/0x1500 [<00000000856ed27d>] inet_rtm_newroute+0x129/0x220 [<00000000fcdfc00a>] rtnetlink_rcv_msg+0x397/0xa20 [<00000000cb85801a>] netlink_rcv_skb+0x132/0x380 [<00000000ebc991d2>] netlink_unicast+0x4c0/0x690 [<0000000014f62875>] netlink_sendmsg+0x929/0xe10 [<00000000bac9d967>] sock_sendmsg+0xc8/0x110 [<00000000223e6485>] ___sys_sendmsg+0x77a/0x8f0 [<000000002e94f880>] __sys_sendmsg+0xf7/0x250 [<00000000ccb1fa72>] do_syscall_64+0x14d/0x610 [<00000000ffbe3dae>] entry_SYSCALL_64_after_hwframe+0x49/0xbe [<000000003a8b605b>] 0xffffffffffffffff Fixes: 8cced9eff1d4 ("[NETNS]: Enable routing configuration in non-initial namespace.") Signed-off-by: Ido Schimmel Reviewed-by: David Ahern Signed-off-by: David S. Miller include/net/ip_fib.h | 2 +- net/ipv4/fib_frontend.c | 4 ++-- net/ipv4/fib_trie.c | 15 ++++++++++++--- 3 files changed, 15 insertions(+), 6 deletions(-) commit ab5098fa25b91cb6fe0a0676f17abb64f2bbf024 Author: Olivier Matz Date: Wed Jan 9 10:57:21 2019 +0100 ip6_gre: fix tunnel list corruption for x-netns In changelink ops, the ip6gre_net pointer is retrieved from dev_net(dev), which is wrong in case of x-netns. Thus, the tunnel is not unlinked from its current list and is relinked into another net namespace. This corrupts the tunnel lists and can later trigger a kernel oops. Fix this by retrieving the netns from device private area. Fixes: c8632fc30bb0 ("net: ip6_gre: Split up ip6gre_changelink()") Cc: Petr Machata Signed-off-by: Olivier Matz Acked-by: Nicolas Dichtel Signed-off-by: David S. Miller net/ipv6/ip6_gre.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 72f6d4d14c2e23c8ad416ccbe5cfc744ba703d0a Merge: 7939f8beecf1 2314e879747e Author: David S. Miller Date: Tue Jan 15 13:31:46 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net This is the first batch of Netfilter fixes for your net tree: 1) Fix endless loop in nf_tables rules netlink dump, from Phil Sutter. 2) Reference counter leak in object from the error path, from Taehee Yoo. 3) Selective rule dump requires table and chain. 4) Fix DNAT with nft_flow_offload reverse route lookup, from wenxu. 5) Use GFP_KERNEL_ACCOUNT in vmalloc allocation from ebtables, from Shakeel Butt. 6) Set ifindex from route to fix interaction with VRF slave device, also from wenxu. 7) Use nfct_help() to check for conntrack helper, IPS_HELPER status flag is only set from explicit helpers via -j CT, from Henry Yen. ==================== Signed-off-by: David S. Miller commit b4711098066f1cf808d4dc11a1a842860a3292fe Author: Wen Yang Date: Tue Jan 15 10:31:27 2019 +0800 pvcalls-front: fix potential null dereference static checker warning: drivers/xen/pvcalls-front.c:373 alloc_active_ring() error: we previously assumed 'map->active.ring' could be null (see line 357) drivers/xen/pvcalls-front.c 351 static int alloc_active_ring(struct sock_mapping *map) 352 { 353 void *bytes; 354 355 map->active.ring = (struct pvcalls_data_intf *) 356 get_zeroed_page(GFP_KERNEL); 357 if (!map->active.ring) ^^^^^^^^^^^^^^^^^ Check 358 goto out; 359 360 map->active.ring->ring_order = PVCALLS_RING_ORDER; 361 bytes = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, 362 PVCALLS_RING_ORDER); 363 if (!bytes) 364 goto out; 365 366 map->active.data.in = bytes; 367 map->active.data.out = bytes + 368 XEN_FLEX_RING_SIZE(PVCALLS_RING_ORDER); 369 370 return 0; 371 372 out: --> 373 free_active_ring(map); ^^^ Add null check on map->active.ring before dereferencing it to avoid any NULL pointer dereferences. Fixes: 9f51c05dc41a ("pvcalls-front: Avoid get_free_pages(GFP_KERNEL) under spinlock") Reported-by: Dan Carpenter Suggested-by: Boris Ostrovsky Signed-off-by: Wen Yang Reviewed-by: Boris Ostrovsky CC: Boris Ostrovsky CC: Juergen Gross CC: Stefano Stabellini CC: Dan Carpenter CC: xen-devel@lists.xenproject.org CC: linux-kernel@vger.kernel.org Signed-off-by: Boris Ostrovsky drivers/xen/pvcalls-front.c | 3 +++ 1 file changed, 3 insertions(+) commit d445bd9cec1a850c2100fcf53684c13b3fd934f2 Author: Joe Thornber Date: Tue Jan 15 13:27:01 2019 -0500 dm thin: fix passdown_double_checking_shared_status() Commit 00a0ea33b495 ("dm thin: do not queue freed thin mapping for next stage processing") changed process_prepared_discard_passdown_pt1() to increment all the blocks being discarded until after the passdown had completed to avoid them being prematurely reused. IO issued to a thin device that breaks sharing with a snapshot, followed by a discard issued to snapshot(s) that previously shared the block(s), results in passdown_double_checking_shared_status() being called to iterate through the blocks double checking their reference count is zero and issuing the passdown if so. So a side effect of commit 00a0ea33b495 is passdown_double_checking_shared_status() was broken. Fix this by checking if the block reference count is greater than 1. Also, rename dm_pool_block_is_used() to dm_pool_block_is_shared(). Fixes: 00a0ea33b495 ("dm thin: do not queue freed thin mapping for next stage processing") Cc: stable@vger.kernel.org # 4.9+ Reported-by: ryan.p.norwood@gmail.com Signed-off-by: Joe Thornber Signed-off-by: Mike Snitzer drivers/md/dm-thin-metadata.c | 4 ++-- drivers/md/dm-thin-metadata.h | 2 +- drivers/md/dm-thin.c | 10 +++++----- 3 files changed, 8 insertions(+), 8 deletions(-) commit b488517b28a47d16b228ce8dcf07f5cb8e5b3dc5 Author: Dinh Nguyen Date: Wed Jan 2 08:59:31 2019 -0600 clk: socfpga: stratix10: fix naming convention for the fixed-clocks The fixed clocks in the DTS file have a hyphen, but the clock driver has the fixed clocks using underbar. Thus the clock driver cannot detect the other fixed clocks correctly. Change the fixed clock names to a hyphen. Fixes: 07afb8db7340 ("clk: socfpga: stratix10: add clock driver for Stratix10 platform") Cc: linux-stable@vger.kernel.org Signed-off-by: Dinh Nguyen Signed-off-by: Stephen Boyd drivers/clk/socfpga/clk-s10.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) commit 91cd63d320f84dcbf21d4327f31f7e1f85adebd0 Author: Alison Schofield Date: Fri Dec 7 18:06:45 2018 -0800 selftests/vm/gup_benchmark.c: match gup struct to kernel An expansion field was added to the kernel copy of this structure for future use. See mm/gup_benchmark.c. Add the same expansion field here, so that the IOCTL command decodes correctly. Otherwise, it fails with EINVAL. Signed-off-by: Alison Schofield Acked-by: Kirill A. Shutemov Signed-off-by: Shuah Khan tools/testing/selftests/vm/gup_benchmark.c | 1 + 1 file changed, 1 insertion(+) commit 4bb0e6d7258213d4893c2c876712fbba40e712fe Author: Julia Lawall Date: Sun Jan 13 09:47:44 2019 +0100 drm/sun4i: backend: add missing of_node_puts The device node iterators perform an of_node_get on each iteration, so a jump out of the loop requires an of_node_put. Remote and port also have augmented reference counts, so drop them on each iteration and at the end of the function, respectively. Remote is only used for the address it contains, not for the contents of that address, so the reference count can be dropped immediately. The semantic patch that fixes the first part of this problem is as follows (http://coccinelle.lip6.fr): // @@ expression root,e; local idexpression child; iterator name for_each_child_of_node; @@ for_each_available_child_of_node(root, child) { ... when != of_node_put(child) when != e = child + of_node_put(child); ? break; ... } ... when != child // Signed-off-by: Julia Lawall Signed-off-by: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/1547369264-24831-5-git-send-email-Julia.Lawall@lip6.fr drivers/gpu/drm/sun4i/sun4i_backend.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit deaa5c96c2f7e8b934088a1e70a0fe8797bd1149 Author: Chuck Lever Date: Wed Jan 9 10:04:57 2019 -0500 SUNRPC: Address Kerberos performance/behavior regression When using Kerberos with v4.20, I've observed frequent connection loss on heavy workloads. I traced it down to the client underrunning the GSS sequence number window -- NFS servers are required to drop the RPC with the low sequence number, and also drop the connection to signal that an RPC was dropped. Bisected to commit 918f3c1fe83c ("SUNRPC: Improve latency for interactive tasks"). I've got a one-line workaround for this issue, which is easy to backport to v4.20 while a more permanent solution is being derived. Essentially, tk_owner-based sorting is disabled for RPCs that carry a GSS sequence number. Fixes: 918f3c1fe83c ("SUNRPC: Improve latency for interactive ... ") Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 86edaed379632e216a97e6bcef9f498b64522d50 Author: Lorenz Bauer Date: Tue Jan 8 13:58:00 2019 +0000 bpf: libbpf: retry loading program on EAGAIN Commit c3494801cd17 ("bpf: check pending signals while verifying programs") makes it possible for the BPF_PROG_LOAD to fail with EAGAIN. Retry unconditionally in this case. Fixes: c3494801cd17 ("bpf: check pending signals while verifying programs") Signed-off-by: Lorenz Bauer Signed-off-by: Daniel Borkmann tools/lib/bpf/bpf.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) commit 97b78ae96ba76f4ca2d8f5afee6a2e567ccb8f45 Author: Trond Myklebust Date: Wed Jan 2 17:53:13 2019 -0500 SUNRPC: Ensure we respect the RPCSEC_GSS sequence number limit According to RFC2203, the RPCSEC_GSS sequence numbers are bounded to an upper limit of MAXSEQ = 0x80000000. Ensure that we handle that correctly. Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker net/sunrpc/auth_gss/auth_gss.c | 12 +++++++++--- net/sunrpc/clnt.c | 19 ++++++++++++------- 2 files changed, 21 insertions(+), 10 deletions(-) commit e66721f0436396f779291a29616858b76bfd9415 Author: Trond Myklebust Date: Wed Jan 2 17:53:10 2019 -0500 SUNRPC: Ensure rq_bytes_sent is reset before request transmission When we resend a request, ensure that the 'rq_bytes_sent' is reset to zero. Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker net/sunrpc/clnt.c | 1 - net/sunrpc/xprt.c | 1 + 2 files changed, 1 insertion(+), 1 deletion(-) commit 6bf3bbe1f4d4cf405e3c2bf07bbdff56d3223ec8 Author: Yonghong Song Date: Sat Jan 12 15:04:30 2019 -0800 samples/bpf: workaround clang asm goto compilation errors x86 compilation has required asm goto support since 4.17. Since clang does not support asm goto, at 4.17, Commit b1ae32dbab50 ("x86/cpufeature: Guard asm_volatile_goto usage for BPF compilation") worked around the issue by permitting an alternative implementation without asm goto for clang. At 5.0, more asm goto usages appeared. [yhs@148 x86]$ egrep -r asm_volatile_goto include/asm/cpufeature.h: asm_volatile_goto("1: jmp 6f\n" include/asm/jump_label.h: asm_volatile_goto("1:" include/asm/jump_label.h: asm_volatile_goto("1:" include/asm/rmwcc.h: asm_volatile_goto (fullop "; j" #cc " %l[cc_label]" \ include/asm/uaccess.h: asm_volatile_goto("\n" \ include/asm/uaccess.h: asm_volatile_goto("\n" \ [yhs@148 x86]$ Compiling samples/bpf directories, most bpf programs failed compilation with error messages like: In file included from /home/yhs/work/bpf-next/samples/bpf/xdp_sample_pkts_kern.c:2: In file included from /home/yhs/work/bpf-next/include/linux/ptrace.h:6: In file included from /home/yhs/work/bpf-next/include/linux/sched.h:15: In file included from /home/yhs/work/bpf-next/include/linux/sem.h:5: In file included from /home/yhs/work/bpf-next/include/uapi/linux/sem.h:5: In file included from /home/yhs/work/bpf-next/include/linux/ipc.h:9: In file included from /home/yhs/work/bpf-next/include/linux/refcount.h:72: /home/yhs/work/bpf-next/arch/x86/include/asm/refcount.h:70:9: error: 'asm goto' constructs are not supported yet return GEN_BINARY_SUFFIXED_RMWcc(LOCK_PREFIX "subl", ^ /home/yhs/work/bpf-next/arch/x86/include/asm/rmwcc.h:67:2: note: expanded from macro 'GEN_BINARY_SUFFIXED_RMWcc' __GEN_RMWcc(op " %[val], %[var]\n\t" suffix, var, cc, \ ^ /home/yhs/work/bpf-next/arch/x86/include/asm/rmwcc.h:21:2: note: expanded from macro '__GEN_RMWcc' asm_volatile_goto (fullop "; j" #cc " %l[cc_label]" \ ^ /home/yhs/work/bpf-next/include/linux/compiler_types.h:188:37: note: expanded from macro 'asm_volatile_goto' #define asm_volatile_goto(x...) asm goto(x) Most implementation does not even provide an alternative implementation. And it is also not practical to make changes for each call site. This patch workarounded the asm goto issue by redefining the macro like below: #define asm_volatile_goto(x...) asm volatile("invalid use of asm_volatile_goto") If asm_volatile_goto is not used by bpf programs, which is typically the case, nothing bad will happen. If asm_volatile_goto is used by bpf programs, which is incorrect, the compiler will issue an error since "invalid use of asm_volatile_goto" is not valid assembly codes. With this patch, all bpf programs under samples/bpf can pass compilation. Note that bpf programs under tools/testing/selftests/bpf/ compiled fine as they do not access kernel internal headers. Fixes: e769742d3584 ("Revert "x86/jump-labels: Macrofy inline assembly code to work around GCC inlining bugs"") Fixes: 18fe58229d80 ("x86, asm: change the GEN_*_RMWcc() macros to not quote the condition") Acked-by: Alexei Starovoitov Signed-off-by: Yonghong Song Signed-off-by: Daniel Borkmann samples/bpf/Makefile | 1 + samples/bpf/asm_goto_workaround.h | 16 ++++++++++++++++ 2 files changed, 17 insertions(+) commit 1be72f29bfb98be27a95309f18b4ab5249967b59 Author: Stanislav Fomichev Date: Mon Jan 14 09:41:41 2019 -0800 selftests/bpf: install with_tunnels.sh for test_flow_dissector.sh test_flow_dissector.sh depends on both with_addr.sh and with_tunnels.sh However, we install only with_addr.sh. Add with_tunnels.sh to TEST_PROGS_EXTENDED to make sure it gets installed as well. Tested with: make TARGETS=bpf install INSTALL_PATH=$PWD/x Fixes: ef4ab8447aa26 ("selftests: bpf: install script with_addr.sh") Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann tools/testing/selftests/bpf/Makefile | 1 + 1 file changed, 1 insertion(+) commit cc5b5d3565048ae57d14e5674a5fb085b2ab0193 Author: Krzysztof Kazimierczak Date: Thu Jan 10 20:29:02 2019 +0100 xsk: Check if a queue exists during umem setup In the xdp_umem_assign_dev() path, the xsk code does not check if a queue for which umem is to be created exists. It leads to a situation where umem is not assigned to any Tx/Rx queue of a netdevice, without notifying the stack about an error. This affects both XDP_SKB and XDP_DRV modes - in case of XDP_DRV_ZC, queue index is checked by the driver. This patch fixes xsk code, so that in both XDP_SKB and XDP_DRV mode of AF_XDP, an error is returned when requested queue index exceedes an existing maximum. Fixes: c9b47cc1fabca ("xsk: fix bug when trying to use both copy and zero-copy on one queue id") Reported-by: Jakub Spizewski Signed-off-by: Krzysztof Kazimierczak Acked-by: Björn Töpel Signed-off-by: Daniel Borkmann net/xdp/xdp_umem.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) commit 4cb79ef9c6c4413427cd70afbb1f3bc01e9b7abf Author: Gustavo A. R. Silva Date: Mon Jan 14 17:40:10 2019 -0600 ASoC: amd: Fix potential NULL pointer dereference Check return value from call to devm_kzalloc() in order to prevent a potential NULL pointer dereference. Also, notice that it makes no sense to allocate any resources if res = platform_get_resource(pdev, IORESOURCE_MEM, 0); fails, so move the call to devm_kzalloc() below the mentioned code. Lastly, improve the use of sizeof in the call to devm_kzalloc() by changing it from sizeof(struct i2s_dev_data) to sizeof(*adata) This issue was detected with the help of Coccinelle. Fixes: ac289c7ec0bc ("ASoC: amd: add ACP3x PCM platform driver") Cc: stable@vger.kernel.org Signed-off-by: Gustavo A. R. Silva Signed-off-by: Mark Brown sound/soc/amd/raven/acp3x-pcm-dma.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit c407cd008fd039320d147088b52d0fa34ed3ddcb Author: Silvio Cesare Date: Tue Jan 15 04:27:27 2019 +0100 ASoC: imx-audmux: change snprintf to scnprintf for possible overflow Change snprintf to scnprintf. There are generally two cases where using snprintf causes problems. 1) Uses of size += snprintf(buf, SIZE - size, fmt, ...) In this case, if snprintf would have written more characters than what the buffer size (SIZE) is, then size will end up larger than SIZE. In later uses of snprintf, SIZE - size will result in a negative number, leading to problems. Note that size might already be too large by using size = snprintf before the code reaches a case of size += snprintf. 2) If size is ultimately used as a length parameter for a copy back to user space, then it will potentially allow for a buffer overflow and information disclosure when size is greater than SIZE. When the size is used to index the buffer directly, we can have memory corruption. This also means when size = snprintf... is used, it may also cause problems since size may become large. Copying to userspace is mitigated by the HARDENED_USERCOPY kernel configuration. The solution to these issues is to use scnprintf which returns the number of characters actually written to the buffer, so the size variable will never exceed SIZE. Signed-off-by: Silvio Cesare Cc: Timur Tabi Cc: Nicolin Chen Cc: Mark Brown Cc: Xiubo Li Cc: Fabio Estevam Cc: Dan Carpenter Cc: Kees Cook Cc: Will Deacon Cc: Greg KH Signed-off-by: Willy Tarreau Acked-by: Nicolin Chen Reviewed-by: Kees Cook Signed-off-by: Mark Brown sound/soc/fsl/imx-audmux.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) commit 060d0bf491874daece47053c4e1fb0489eb867d2 Author: Gustavo A. R. Silva Date: Tue Jan 15 11:57:23 2019 -0600 ASoC: rt5514-spi: Fix potential NULL pointer dereference There is a potential NULL pointer dereference in case devm_kzalloc() fails and returns NULL. Fix this by adding a NULL check on rt5514_dsp. This issue was detected with the help of Coccinelle. Fixes: 6eebf35b0e4a ("ASoC: rt5514: add rt5514 SPI driver") Cc: stable@vger.kernel.org Signed-off-by: Gustavo A. R. Silva Signed-off-by: Mark Brown sound/soc/codecs/rt5514-spi.c | 2 ++ 1 file changed, 2 insertions(+) commit e581e151e965bf1f2815dd94620b638fec4d0a7e Author: Silvio Cesare Date: Sat Jan 12 16:28:43 2019 +0100 ASoC: dapm: change snprintf to scnprintf for possible overflow Change snprintf to scnprintf. There are generally two cases where using snprintf causes problems. 1) Uses of size += snprintf(buf, SIZE - size, fmt, ...) In this case, if snprintf would have written more characters than what the buffer size (SIZE) is, then size will end up larger than SIZE. In later uses of snprintf, SIZE - size will result in a negative number, leading to problems. Note that size might already be too large by using size = snprintf before the code reaches a case of size += snprintf. 2) If size is ultimately used as a length parameter for a copy back to user space, then it will potentially allow for a buffer overflow and information disclosure when size is greater than SIZE. When the size is used to index the buffer directly, we can have memory corruption. This also means when size = snprintf... is used, it may also cause problems since size may become large. Copying to userspace is mitigated by the HARDENED_USERCOPY kernel configuration. The solution to these issues is to use scnprintf which returns the number of characters actually written to the buffer, so the size variable will never exceed SIZE. Signed-off-by: Silvio Cesare Cc: Liam Girdwood Cc: Mark Brown Cc: Dan Carpenter Cc: Kees Cook Cc: Will Deacon Cc: Greg KH Signed-off-by: Willy Tarreau Signed-off-by: Mark Brown sound/soc/soc-dapm.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit ee7ea2a9a318a89d21b156dc75e54d53904bdbe5 Author: Shuming Fan Date: Tue Jan 15 11:27:39 2019 +0800 ASoC: rt5682: Fix PLL source register definitions Fix typo which causes headphone no sound while using BCLK as PLL source. Signed-off-by: Shuming Fan Signed-off-by: Mark Brown sound/soc/codecs/rt5682.h | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) commit 2833548ecbb385a289124077ab4d812258a867d5 Author: Matthias Reichl Date: Tue Jan 15 17:51:07 2019 +0100 ASoC: core: Don't defer probe on optional, NULL components cpu and platform are optional components in DAI links. For example codec-codec links usually have no platform set. Call snd_soc_find_component only if the name or of_node of a cpu or platform is set. Otherwise it will return NULL and soc_init_dai_link bails out immediately with -EPROBE_DEFER, meaning registering a card with NULL cpu or platform in DAI links can never succeed. Fixes: 8780cf1142a5 ("ASoC: soc-core: defer card probe until all component is added to list") Signed-off-by: Matthias Reichl Signed-off-by: Mark Brown sound/soc/soc-core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit a811dc61559e0c8003f1086c2a4dc8e4d5ae4cb8 Author: Tycho Andersen Date: Sat Jan 12 11:24:20 2019 -0700 seccomp: fix UAF in user-trap code On the failure path, we do an fput() of the listener fd if the filter fails to install (e.g. because of a TSYNC race that's lost, or if the thread is killed, etc.). fput() doesn't actually release the fd, it just ads it to a work queue. Then the thread proceeds to free the filter, even though the listener struct file has a reference to it. To fix this, on the failure path let's set the private data to null, so we know in ->release() to ignore the filter. Reported-by: syzbot+981c26489b2d1c6316ba@syzkaller.appspotmail.com Fixes: 6a21cc50f0c7 ("seccomp: add a return code to trap to userspace") Signed-off-by: Tycho Andersen Acked-by: Kees Cook Signed-off-by: James Morris kernel/seccomp.c | 4 ++++ 1 file changed, 4 insertions(+) commit 663ec3a2c2d02775bc723b20a1af33262f790f50 Author: Linus Walleij Date: Wed Jan 9 22:51:44 2019 +0100 mtd: rawnand: fsmc: Keep bank enable bit set Hammering the "bank enable" (PBKEN) bit on and off between every command crashes the Nomadik NHK15 with this message: Scanning device for bad blocks Unhandled fault: external abort on non-linefetch (0x008) at 0xcc95e000 pgd = (ptrval) [cc95e000] *pgd=0b808811, *pte=40000653, *ppte=40000552 Internal error: : 8 [#1] PREEMPT ARM Modules linked in: CPU: 0 PID: 1 Comm: swapper Not tainted 4.20.0-rc2+ #72 Hardware name: Nomadik STn8815 PC is at fsmc_exec_op+0x194/0x204 (...) After a discussion we (me and Boris Brezillon) start to suspect that this bit does not immediately control the chip select line at all, it rather enables access to the bank and the hardware will drive the CS autonomously. If there is a NAND chip connected, we should keep this enabled. As fsmc_nand_setup() sets this bit, we can simply remove the offending code. Fixes: 550b9fc4e3af ("mtd: rawnand: fsmc: Stop implementing ->select_chip()") Signed-off-by: Linus Walleij Acked-by: Miquel Raynal Signed-off-by: Boris Brezillon drivers/mtd/nand/raw/fsmc_nand.c | 21 --------------------- 1 file changed, 21 deletions(-) commit 7939f8beecf1cfb10d255be65bfbd3793fae82a1 Merge: e8746440bf68 8b05a3a7503c Author: Linus Torvalds Date: Wed Jan 16 05:28:26 2019 +1200 Merge tag 'trace-v5.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fix from Steven Rostedt: "Andrea Righi fixed a NULL pointer dereference in trace_kprobe_create() It is possible to trigger a NULL pointer dereference by writing an incorrectly formatted string to the krpobe_events file" * tag 'trace-v5.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing/kprobes: Fix NULL pointer dereference in trace_kprobe_create() commit e8746440bf68212f19688f1454dad593c74abee1 Merge: fe76fc6aaf53 2f960bd05640 Author: Linus Torvalds Date: Wed Jan 16 05:13:36 2019 +1200 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) Fix regression in multi-SKB responses to RTM_GETADDR, from Arthur Gautier. 2) Fix ipv6 frag parsing in openvswitch, from Yi-Hung Wei. 3) Unbounded recursion in ipv4 and ipv6 GUE tunnels, from Stefano Brivio. 4) Use after free in hns driver, from Yonglong Liu. 5) icmp6_send() needs to handle the case of NULL skb, from Eric Dumazet. 6) Missing rcu read lock in __inet6_bind() when operating on mapped addresses, from David Ahern. 7) Memory leak in tipc-nl_compat_publ_dump(), from Gustavo A. R. Silva. 8) Fix PHY vs r8169 module loading ordering issues, from Heiner Kallweit. 9) Fix bridge vlan memory leak, from Ido Schimmel. 10) Dev refcount leak in AF_PACKET, from Jason Gunthorpe. 11) Infoleak in ipv6_local_error(), flow label isn't completely initialized. From Eric Dumazet. 12) Handle mv88e6390 errata, from Andrew Lunn. 13) Making vhost/vsock CID hashing consistent, from Zha Bin. 14) Fix lack of UMH cleanup when it unexpectedly exits, from Taehee Yoo. 15) Bridge forwarding must clear skb->tstamp, from Paolo Abeni. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (87 commits) bnxt_en: Fix context memory allocation. bnxt_en: Fix ring checking logic on 57500 chips. mISDN: hfcsusb: Use struct_size() in kzalloc() net: clear skb->tstamp in bridge forwarding path net: bpfilter: disallow to remove bpfilter module while being used net: bpfilter: restart bpfilter_umh when error occurred net: bpfilter: use cleanup callback to release umh_info umh: add exit routine for UMH process isdn: i4l: isdn_tty: Fix some concurrency double-free bugs vhost/vsock: fix vhost vsock cid hashing inconsistent net: stmmac: Prevent RX starvation in stmmac_napi_poll() net: stmmac: Fix the logic of checking if RX Watchdog must be enabled net: stmmac: Check if CBS is supported before configuring net: stmmac: dwxgmac2: Only clear interrupts that are active net: stmmac: Fix PCI module removal leak tools/bpf: fix bpftool map dump with bitfields tools/bpf: test btf bitfield with >=256 struct member offset bpf: fix bpffs bitfield pretty print net: ethernet: mediatek: fix warning in phy_start_aneg tcp: change txhash on SYN-data timeout ... commit 8b05a3a7503c2a982c9c462eae96cfbd59506783 Author: Andrea Righi Date: Fri Jan 11 07:01:13 2019 +0100 tracing/kprobes: Fix NULL pointer dereference in trace_kprobe_create() It is possible to trigger a NULL pointer dereference by writing an incorrectly formatted string to krpobe_events (trying to create a kretprobe omitting the symbol). Example: echo "r:event_1 " >> /sys/kernel/debug/tracing/kprobe_events That triggers this: BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 #PF error: [normal kernel read fault] PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI CPU: 6 PID: 1757 Comm: bash Not tainted 5.0.0-rc1+ #125 Hardware name: Dell Inc. XPS 13 9370/0F6P3V, BIOS 1.5.1 08/09/2018 RIP: 0010:kstrtoull+0x2/0x20 Code: 28 00 00 00 75 17 48 83 c4 18 5b 41 5c 5d c3 b8 ea ff ff ff eb e1 b8 de ff ff ff eb da e8 d6 36 bb ff 66 0f 1f 44 00 00 31 c0 <80> 3f 2b 55 48 89 e5 0f 94 c0 48 01 c7 e8 5c ff ff ff 5d c3 66 2e RSP: 0018:ffffb5d482e57cb8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffffffff82b12720 RDX: ffffb5d482e57cf8 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffb5d482e57d70 R08: ffffa0c05e5a7080 R09: ffffa0c05e003980 R10: 0000000000000000 R11: 0000000040000000 R12: ffffa0c04fe87b08 R13: 0000000000000001 R14: 000000000000000b R15: ffffa0c058d749e1 FS: 00007f137c7f7740(0000) GS:ffffa0c05e580000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000497d46004 CR4: 00000000003606e0 Call Trace: ? trace_kprobe_create+0xb6/0x840 ? _cond_resched+0x19/0x40 ? _cond_resched+0x19/0x40 ? __kmalloc+0x62/0x210 ? argv_split+0x8f/0x140 ? trace_kprobe_create+0x840/0x840 ? trace_kprobe_create+0x840/0x840 create_or_delete_trace_kprobe+0x11/0x30 trace_run_command+0x50/0x90 trace_parse_run_command+0xc1/0x160 probes_write+0x10/0x20 __vfs_write+0x3a/0x1b0 ? apparmor_file_permission+0x1a/0x20 ? security_file_permission+0x31/0xf0 ? _cond_resched+0x19/0x40 vfs_write+0xb1/0x1a0 ksys_write+0x55/0xc0 __x64_sys_write+0x1a/0x20 do_syscall_64+0x5a/0x120 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fix by doing the proper argument checks in trace_kprobe_create(). Cc: Ingo Molnar Link: https://lore.kernel.org/lkml/20190111095108.b79a2ee026185cbd62365977@kernel.org Link: http://lkml.kernel.org/r/20190111060113.GA22841@xps-13 Fixes: 6212dd29683e ("tracing/kprobes: Use dyn_event framework for kprobe events") Acked-by: Masami Hiramatsu Signed-off-by: Andrea Righi Signed-off-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) kernel/trace/trace_kprobe.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) commit 45ac486ecf2dc998e25cf32f0cabf2deaad875be Author: Olga Kornievskaia Date: Fri Jan 11 19:04:44 2019 -0500 NFSv4.2 fix unnecessary retry in nfs4_copy_file_range Currently nfs42_proc_copy_file_range() can not return EAGAIN. Fixes: e4648aa4f98a ("NFS recover from destination server reboot for copies") Signed-off-by: Olga Kornievskaia Signed-off-by: Anna Schumaker fs/nfs/nfs4file.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) commit 92b0730eaf2d549fdfb10ecc8b71f34b9f472c12 Author: Michel Dänzer Date: Fri Jan 11 16:21:02 2019 +0100 Revert "drm/amdgpu: validate user pitch alignment" The check turned out to be too strict in some cases. Reviewed-by: Alex Deucher Signed-off-by: Michel Dänzer Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 10 ---------- 1 file changed, 10 deletions(-) commit 25ec429e86bb790e40387a550f0501d0ac55a47c Author: Alex Deucher Date: Thu Jan 10 12:16:57 2019 +0100 Revert "drm/amdgpu: validate user GEM object size" It was at the same time too strict (for linear tiling modes, where no height alignment is required) and too lenient (for 2D tiling modes, where height may need to be aligned to values > 8). Acked-by: Alex Deucher Signed-off-by: Michel Dänzer Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 8 -------- 1 file changed, 8 deletions(-) commit 93ad0fc088c5b4631f796c995bdd27a082ef33a6 Author: Thomas Gleixner Date: Fri Jan 11 14:33:16 2019 +0100 posix-cpu-timers: Unbreak timer rearming The recent commit which prevented a division by 0 issue in the alarm timer code broke posix CPU timers as an unwanted side effect. The reason is that the common rearm code checks for timer->it_interval being 0 now. What went unnoticed is that the posix cpu timer setup does not initialize timer->it_interval as it stores the interval in CPU timer specific storage. The reason for the separate storage is historical as the posix CPU timers always had a 64bit nanoseconds representation internally while timer->it_interval is type ktime_t which used to be a modified timespec representation on 32bit machines. Instead of reverting the offending commit and fixing the alarmtimer issue in the alarmtimer code, store the interval in timer->it_interval at CPU timer setup time so the common code check works. This also repairs the existing inconistency of the posix CPU timer code which kept a single shot timer armed despite of the interval being 0. The separate storage can be removed in mainline, but that needs to be a separate commit as the current one has to be backported to stable kernels. Fixes: 0e334db6bb4b ("posix-timers: Fix division by zero bug") Reported-by: H.J. Lu Signed-off-by: Thomas Gleixner Cc: John Stultz Cc: Peter Zijlstra Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20190111133500.840117406@linutronix.de kernel/time/posix-cpu-timers.c | 1 + 1 file changed, 1 insertion(+) commit 5f74a8cbb38d10615ed46bc3e37d9a4c9af8045a Author: Michael Straube Date: Mon Jan 7 18:28:58 2019 +0100 staging: rtl8188eu: Add device code for D-Link DWA-121 rev B1 This device was added to the stand-alone driver on github. Add it to the staging driver as well. Link: https://github.com/lwfinger/rtl8188eu/commit/a0619a07cd1e Signed-off-by: Michael Straube Acked-by: Larry Finger Cc: stable Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 + 1 file changed, 1 insertion(+) commit a50c4c9a65779ca835746b5fd79d3d5278afbdbe Author: Phil Elwell Date: Fri Jan 11 11:34:53 2019 +0000 staging: vchiq: Fix local event signalling Prior to the recent event reworking (see Fixes), thread synchronisation was implemented using completions, the worker thread being woken with a call to complete(). The replacement uses waitqueues, which are more like condition variables in that the waiting thread is only woken if the condition is true. When the VPU signals the ARM, it first sets the event's fired flag to indicate which event is being signalled, but the places in the ARM-side code where the worker thread is being woken - remote_event_signal_local via request_poll - did not do so as it wasn't previously necessary, and since the armed flag was being cleared this lead to a deadlock. Fixes: 852b2876a8a8 ("staging: vchiq: rework remove_event handling") Signed-off-by: Phil Elwell Tested-by: Stefan Wahren Signed-off-by: Greg Kroah-Hartman drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c | 1 + 1 file changed, 1 insertion(+) commit 0a9019cc8ae0caf97d3d914d178e31ffd37cc48e Author: Dan Carpenter Date: Fri Dec 21 12:12:02 2018 +0300 Staging: wilc1000: unlock on error in init_chip() When there is an error in init_bus() then we need to call release_bus() before we return. Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver") Signed-off-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman drivers/staging/wilc1000/wilc_wlan.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit fe2570fbf3dfce39996819deeaf1693ac6d7b5a3 Author: Gustavo A. R. Silva Date: Sat Dec 22 03:08:15 2018 -0600 staging: wilc1000: fix memory leak in wilc_add_rx_gtk In case *mode* happens to be different than WILC_AP_MODE and WILC_STATION_MODE, gtk_key is not released, hence leanding to a memory leak. So, in this case it is safer to release gtk_key just before returning to callers. Addresses-Coverity-ID: 1476020 ("Resource leak") Signed-off-by: Gustavo A. R. Silva Signed-off-by: Greg Kroah-Hartman drivers/staging/wilc1000/host_interface.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit b62ce02e157afa9b57d7f0625e8c585935f422a5 Author: Július Milan Date: Mon Jan 7 15:43:05 2019 +0100 staging: wilc1000: fix registration frame size Fixes the following sparse warnings: drivers/staging/wilc1000/host_interface.c:2360:30: warning: incorrect type in assignment (different base types) expected restricted __le32 [addressable] [assigned] [usertype] frame_type got restricted __le16 [usertype] Fixes: 147ccfd451024 ("staging: wilc1000: handle mgmt_frame_register ops from cfg82011 context") Signed-off-by: Július Milan Reviewed-by: Ajay Singh Signed-off-by: Greg Kroah-Hartman drivers/staging/wilc1000/host_interface.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 04906b2f542c23626b0ef6219b808406f8dddbe9 Author: Jan Kara Date: Mon Jan 14 09:48:10 2019 +0100 blockdev: Fix livelocks on loop device bd_set_size() updates also block device's block size. This is somewhat unexpected from its name and at this point, only blkdev_open() uses this functionality. Furthermore, this can result in changing block size under a filesystem mounted on a loop device which leads to livelocks inside __getblk_gfp() like: Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 10863 Comm: syz-executor0 Not tainted 4.18.0-rc5+ #151 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__sanitizer_cov_trace_pc+0x3f/0x50 kernel/kcov.c:106 ... Call Trace: init_page_buffers+0x3e2/0x530 fs/buffer.c:904 grow_dev_page fs/buffer.c:947 [inline] grow_buffers fs/buffer.c:1009 [inline] __getblk_slow fs/buffer.c:1036 [inline] __getblk_gfp+0x906/0xb10 fs/buffer.c:1313 __bread_gfp+0x2d/0x310 fs/buffer.c:1347 sb_bread include/linux/buffer_head.h:307 [inline] fat12_ent_bread+0x14e/0x3d0 fs/fat/fatent.c:75 fat_ent_read_block fs/fat/fatent.c:441 [inline] fat_alloc_clusters+0x8ce/0x16e0 fs/fat/fatent.c:489 fat_add_cluster+0x7a/0x150 fs/fat/inode.c:101 __fat_get_block fs/fat/inode.c:148 [inline] ... Trivial reproducer for the problem looks like: truncate -s 1G /tmp/image losetup /dev/loop0 /tmp/image mkfs.ext4 -b 1024 /dev/loop0 mount -t ext4 /dev/loop0 /mnt losetup -c /dev/loop0 l /mnt Fix the problem by moving initialization of a block device block size into a separate function and call it when needed. Thanks to Tetsuo Handa for help with debugging the problem. Reported-by: syzbot+9933e4476f365f5d5a1b@syzkaller.appspotmail.com Signed-off-by: Jan Kara Signed-off-by: Jens Axboe fs/block_dev.c | 28 ++++++++++++++++++---------- 1 file changed, 18 insertions(+), 10 deletions(-) commit c8a83a6b54d0ca078de036aafb3f6af58c1dc5eb Author: Jan Kara Date: Mon Jan 14 09:48:09 2019 +0100 nbd: Use set_blocksize() to set device blocksize NBD can update block device block size implicitely through bd_set_size(). Make it explicitely set blocksize with set_blocksize() as this behavior of bd_set_size() is going away. CC: Josef Bacik Signed-off-by: Jan Kara Signed-off-by: Jens Axboe drivers/block/nbd.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit ce0210c12433031aba3bbacd75f4c02ab77f2004 Author: Neil Armstrong Date: Mon Jan 14 16:31:18 2019 +0100 drm/meson: Fix atomic mode switching regression Since commit 2bcd3ecab773 when switching mode from X11 (ubuntu mate for example) the display gets blurry, looking like an invalid framebuffer width. This commit fixed atomic crtc modesetting in a totally wrong way and introduced a local unnecessary ->enabled crtc state. This commit reverts the crctc _begin() and _enable() changes and simply adds drm_atomic_helper_commit_tail_rpm as helper. Reported-by: Tony McKahan Suggested-by: Daniel Vetter Fixes: 2bcd3ecab773 ("drm/meson: Fixes for drm_crtc_vblank_on/off support") Signed-off-by: Neil Armstrong Acked-by: Daniel Vetter [narmstrong: fixed blank line issue from checkpatch] Link: https://patchwork.freedesktop.org/patch/msgid/20190114153118.8024-1-narmstrong@baylibre.com drivers/gpu/drm/meson/meson_crtc.c | 23 ++--------------------- drivers/gpu/drm/meson/meson_drv.c | 5 +++++ 2 files changed, 7 insertions(+), 21 deletions(-) commit 993a110319a4a60aadbd02f6defdebe048f7773b Author: Dave Young Date: Fri Dec 28 09:12:47 2018 +0800 x86/kexec: Fix a kexec_file_load() failure Commit b6664ba42f14 ("s390, kexec_file: drop arch_kexec_mem_walk()") changed the behavior of kexec_locate_mem_hole(): it will try to allocate free memory only when kbuf.mem is initialized to zero. However, x86's kexec_file_load() implementation reuses a struct kexec_buf allocated on the stack and its kbuf.mem member gets set by each kexec_add_buffer() invocation. The second kexec_add_buffer() will reuse the same kbuf but not reinitialize kbuf.mem. Therefore, explictily reset kbuf.mem each time in order for kexec_locate_mem_hole() to locate a free memory region each time. [ bp: massage commit message. ] Fixes: b6664ba42f14 ("s390, kexec_file: drop arch_kexec_mem_walk()") Signed-off-by: Dave Young Signed-off-by: Borislav Petkov Acked-by: Baoquan He Cc: "Eric W. Biederman" Cc: "H. Peter Anvin" Cc: AKASHI Takahiro Cc: Andrew Morton Cc: Ingo Molnar Cc: Martin Schwidefsky Cc: Philipp Rudo Cc: Thomas Gleixner Cc: Vivek Goyal Cc: Yannik Sembritzki Cc: Yi Wang Cc: kexec@lists.infradead.org Cc: x86-ml Link: https://lkml.kernel.org/r/20181228011247.GA9999@dhcp-128-65.nay.redhat.com arch/x86/kernel/crash.c | 1 + arch/x86/kernel/kexec-bzimage64.c | 2 ++ 2 files changed, 3 insertions(+) commit 51b00d8509dc69c98740da2ad07308b630d3eb7d Author: Zhenyu Wang Date: Fri Jan 11 13:58:53 2019 +0800 drm/i915/gvt: Fix mmap range check This is to fix missed mmap range check on vGPU bar2 region and only allow to map vGPU allocated GMADDR range, which means user space should support sparse mmap to get proper offset for mmap vGPU aperture. And this takes care of actual pgoff in mmap request as original code always does from beginning of vGPU aperture. Fixes: 659643f7d814 ("drm/i915/gvt/kvmgt: add vfio/mdev support to KVMGT") Cc: "Monroy, Rodrigo Axel" Cc: "Orrala Contreras, Alfredo" Cc: stable@vger.kernel.org # v4.10+ Reviewed-by: Hang Yuan Signed-off-by: Zhenyu Wang drivers/gpu/drm/i915/gvt/kvmgt.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) commit bf7d28c53453ea904584960de55e33e03b9d93b1 Author: Peng Hao Date: Sat Dec 29 14:34:12 2018 +0800 x86/mm/mem_encrypt: Fix erroneous sizeof() Using sizeof(pointer) for determining the size of a memset() only works when the size of the pointer and the size of type to which it points are the same. For pte_t this is only true for 64bit and 32bit-NONPAE. On 32bit PAE systems this is wrong as the pointer size is 4 byte but the PTE entry is 8 bytes. It's actually not a real world issue as this code depends on 64bit, but it's wrong nevertheless. Use sizeof(*p) for correctness sake. Fixes: aad983913d77 ("x86/mm/encrypt: Simplify sme_populate_pgd() and sme_populate_pgd_large()") Signed-off-by: Peng Hao Signed-off-by: Thomas Gleixner Cc: Kirill A. Shutemov Cc: Tom Lendacky Cc: dave.hansen@linux.intel.com Cc: peterz@infradead.org Cc: luto@kernel.org Link: https://lkml.kernel.org/r/1546065252-97996-1-git-send-email-peng.hao2@zte.com.cn arch/x86/mm/mem_encrypt_identity.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 7bea7ac0ca0121798f3618d16201ca4dc4e67a00 Author: Michael Ellerman Date: Tue Jan 15 17:37:28 2019 +1100 powerpc/syscalls: Fix syscall tracing Recently in commit fbf508da7440 ("powerpc: split compat syscall table out from native table") we changed the layout of the system call table. Instead of having two entries for each syscall number, one for the regular entry point and one for the compat entry point, we now have separate tables for regular and compat entry points. This inadvertently broke syscall tracing (CONFIG_FTRACE_SYSCALLS), because our implementation of arch_syscall_addr() knew about the layout of the table (it did nr * 2). We can fix it just by dropping our version of arch_syscall_addr() and using the generic version which does: return (unsigned long)sys_call_table[nr]; Fixes: fbf508da7440 ("powerpc: split compat syscall table out from native table") Signed-off-by: Michael Ellerman arch/powerpc/kernel/trace/ftrace.c | 7 ------- 1 file changed, 7 deletions(-) commit 6c2d0f9976ad19eca6d03dad5d726f8eff848b70 Author: Hang Yuan Date: Mon Jan 14 18:43:39 2019 +0800 drm/i915/gvt: free VFIO region space in vgpu detach VFIO region space is allocated when one region is registered for one vgpu. So free the space when destroy the vgpu. Also change the parameter of detach_vgpu callback to use vgpu directly. Fixes: b851adeac0858c7d257b3 ("drm/i915/gvt: Add opregion support") Reviewed-by: Zhenyu Wang Signed-off-by: Hang Yuan Signed-off-by: Zhenyu Wang drivers/gpu/drm/i915/gvt/hypercall.h | 2 +- drivers/gpu/drm/i915/gvt/kvmgt.c | 16 ++++++++++++++-- drivers/gpu/drm/i915/gvt/mpt.h | 2 +- 3 files changed, 16 insertions(+), 4 deletions(-) commit da727097a482a93645ba5beea8d389ebab11fc64 Author: Jason A. Donenfeld Date: Mon Jan 14 16:47:45 2019 -0800 powerpc/pseries: Fix build break due to pnv_npu2_init() Commit 3be2df00e299 ("powerpc/pseries/npu: Enable platform support") added a call to pnv_npu2_init() in pseries code. This causes a build break if we build with CONFIG_PPC_PSERIES && !CONFIG_PPC_POWERNV: powerpc64le-pc-linux-gnu-ld: arch/powerpc/platforms/pseries/pci.o: in function `pSeries_final_fixup': pci.c:(.init.text+0x1b0): undefined reference to `pnv_npu2_init' This commit therefore wraps that line in an ifdef, so that pseries builds without powernv. Fixes: 3be2df00e299 ("powerpc/pseries/npu: Enable platform support") Signed-off-by: Jason A. Donenfeld Reviewed-by: Alexey Kardashevskiy [mpe: Frob change log a bit to blame a different commit] Signed-off-by: Michael Ellerman arch/powerpc/platforms/pseries/pci.c | 2 ++ 1 file changed, 2 insertions(+) commit bddda606ec76550dd63592e32a6e87e7d32583f7 Author: Srinivas Ramana Date: Thu Dec 20 19:05:57 2018 +0530 genirq: Make sure the initial affinity is not empty If all CPUs in the irq_default_affinity mask are offline when an interrupt is initialized then irq_setup_affinity() can set an empty affinity mask for a newly allocated interrupt. Fix this by falling back to cpu_online_mask in case the resulting affinity mask is zero. Signed-off-by: Srinivas Ramana Signed-off-by: Thomas Gleixner Cc: linux-arm-msm@vger.kernel.org Link: https://lkml.kernel.org/r/1545312957-8504-1-git-send-email-sramana@codeaurora.org kernel/irq/manage.c | 3 +++ 1 file changed, 3 insertions(+) commit f29fd331aa055fbeb5a496b4af937b7952111b6b Author: Vitor Soares Date: Thu Jan 10 16:34:59 2019 +0100 i3c: master: dw-i3c-master: fix i3c_attach/reattach This patch fix i3c_attach/reattach functions. During the i3c_attach the driver ignores the static address used for SETDASA CCC command. During the i3c_reattach the driver doesn't update master->addrs[data->index] with new address if old_dyn_addr = 0. Fixes: 1dd728f5d4d4 ("i3c: master: Add driver for Synopsys DesignWare IP") Signed-off-by: Vitor Soares Signed-off-by: Boris Brezillon drivers/i3c/master/dw-i3c-master.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) commit e1812933b17be7814f51b6c310c5d1ced7a9a5f5 Author: Dave Hansen Date: Wed Jan 2 13:56:57 2019 -0800 x86/selftests/pkeys: Fork() to check for state being preserved There was a bug where the per-mm pkey state was not being preserved across fork() in the child. fork() is performed in the pkey selftests, but all of the pkey activity is performed in the parent. The child does not perform any actions sensitive to pkey state. To make the test more sensitive to these kinds of bugs, add a fork() where the parent exits, and execution continues in the child. To achieve this let the key exhaustion test not terminate at the first allocation failure and fork after 2*NR_PKEYS loops and continue in the child. Signed-off-by: Dave Hansen Signed-off-by: Thomas Gleixner Cc: bp@alien8.de Cc: hpa@zytor.com Cc: peterz@infradead.org Cc: mpe@ellerman.id.au Cc: will.deacon@arm.com Cc: luto@kernel.org Cc: jroedel@suse.de Cc: stable@vger.kernel.org Cc: Borislav Petkov Cc: "H. Peter Anvin" Cc: Peter Zijlstra Cc: Michael Ellerman Cc: Will Deacon Cc: Andy Lutomirski Cc: Joerg Roedel Link: https://lkml.kernel.org/r/20190102215657.585704B7@viggo.jf.intel.com tools/testing/selftests/x86/protection_keys.c | 41 ++++++++++++++++++++------- 1 file changed, 31 insertions(+), 10 deletions(-) commit a31e184e4f69965c99c04cc5eb8a4920e0c63737 Author: Dave Hansen Date: Wed Jan 2 13:56:55 2019 -0800 x86/pkeys: Properly copy pkey state at fork() Memory protection key behavior should be the same in a child as it was in the parent before a fork. But, there is a bug that resets the state in the child at fork instead of preserving it. The creation of new mm's is a bit convoluted. At fork(), the code does: 1. memcpy() the parent mm to initialize child 2. mm_init() to initalize some select stuff stuff 3. dup_mmap() to create true copies that memcpy() did not do right For pkeys two bits of state need to be preserved across a fork: 'execute_only_pkey' and 'pkey_allocation_map'. Those are preserved by the memcpy(), but mm_init() invokes init_new_context() which overwrites 'execute_only_pkey' and 'pkey_allocation_map' with "new" values. The author of the code erroneously believed that init_new_context is *only* called at execve()-time. But, alas, init_new_context() is used at execve() and fork(). The result is that, after a fork(), the child's pkey state ends up looking like it does after an execve(), which is totally wrong. pkeys that are already allocated can be allocated again, for instance. To fix this, add code called by dup_mmap() to copy the pkey state from parent to child explicitly. Also add a comment above init_new_context() to make it more clear to the next poor sod what this code is used for. Fixes: e8c24d3a23a ("x86/pkeys: Allocation/free syscalls") Signed-off-by: Dave Hansen Signed-off-by: Thomas Gleixner Reviewed-by: Thomas Gleixner Cc: bp@alien8.de Cc: hpa@zytor.com Cc: peterz@infradead.org Cc: mpe@ellerman.id.au Cc: will.deacon@arm.com Cc: luto@kernel.org Cc: jroedel@suse.de Cc: stable@vger.kernel.org Cc: Borislav Petkov Cc: "H. Peter Anvin" Cc: Peter Zijlstra Cc: Michael Ellerman Cc: Will Deacon Cc: Andy Lutomirski Cc: Joerg Roedel Link: https://lkml.kernel.org/r/20190102215655.7A69518C@viggo.jf.intel.com arch/x86/include/asm/mmu_context.h | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) commit fe76fc6aaf538df27708ffa3e5d549a6c8e16142 Author: Ming Lei Date: Tue Jan 15 11:59:52 2019 +0800 sbitmap: Protect swap_lock from hardirq Because we may call blk_mq_get_driver_tag() directly from blk_mq_dispatch_rq_list() without holding any lock, then HARDIRQ may come and the above DEADLOCK is triggered. Commit ab53dcfb3e7b ("sbitmap: Protect swap_lock from hardirq") tries to fix this issue by using 'spin_lock_bh', which isn't enough because we complete request from hardirq context direclty in case of multiqueue. Cc: Clark Williams Fixes: ab53dcfb3e7b ("sbitmap: Protect swap_lock from hardirq") Cc: Jens Axboe Cc: Ming Lei Cc: Guenter Roeck Cc: Steven Rostedt (VMware) Signed-off-by: Ming Lei Signed-off-by: Linus Torvalds lib/sbitmap.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit b4fe30e45a660efa8f122070fc7173715d0e1d00 Author: Wei Yang Date: Tue Jan 15 11:09:46 2019 +0800 acpi/nfit: Remove duplicate set nd_set in acpi_nfit_init_interleave_set() We allocate nd_set in acpi_nfit_init_interleave_set() and assignn it to ndr_desc, while the assignment is done twice in this function. This patch removes the first assignment. No functional change. Signed-off-by: Wei Yang Signed-off-by: Dan Williams drivers/acpi/nfit/core.c | 1 - 1 file changed, 1 deletion(-) commit b686057e95075b51939ade6b8c9b478a1011342a Author: Sabyasachi Gupta Date: Mon Jan 14 17:48:02 2019 +0530 tools/testing/selftests/x86/unwind_vdso.c: Remove duplicate header Remove sys/ucontext.h which is included more than once. Signed-off-by: Sabyasachi Gupta Signed-off-by: Shuah Khan tools/testing/selftests/x86/unwind_vdso.c | 1 - 1 file changed, 1 deletion(-) commit a180ac19ac19145789faa8ece9a45934822f6a29 Author: Colin Ian King Date: Wed Jan 2 09:54:03 2019 +0000 x86/mpx/selftests: fix spelling mistake "succeded" -> "succeeded" There is a spelling mistake eprintf error message, fix it. Signed-off-by: Colin Ian King Signed-off-by: Shuah Khan tools/testing/selftests/x86/mpx-mini-test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7b3027728f4d4f6763f4d7e771acfc9424cdd0e6 Author: Alexandre Belloni Date: Tue Dec 18 22:34:21 2018 +0100 selftests: rtc: rtctest: add alarm test on minute boundary Unfortunately, some RTC don't have a second resolution for alarm so also test for alarm on a minute boundary. Signed-off-by: Alexandre Belloni Signed-off-by: Shuah Khan tools/testing/selftests/rtc/rtctest.c | 102 ++++++++++++++++++++++++++++++++++ 1 file changed, 102 insertions(+) commit fdac94489c4d247088b3885875b39b3e1eb621ef Author: Alexandre Belloni Date: Tue Dec 18 22:34:20 2018 +0100 selftests: rtc: rtctest: fix alarm tests Return values for select are not checked properly and timeouts may not be detected. Signed-off-by: Alexandre Belloni Signed-off-by: Shuah Khan tools/testing/selftests/rtc/rtctest.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) commit 8e5dadfe76cf2862ebf3e4f22adef29982df7766 Author: Bijan Mottahedeh Date: Mon Dec 3 16:48:23 2018 -0800 vhost/scsi: Use copy_to_iter() to send control queue response Uses copy_to_iter() instead of __copy_to_user() in order to ensure we support arbitrary layouts and an input buffer split across iov entries. Fixes: 0d02dbd68c47b ("vhost/scsi: Respond to control queue operations") Signed-off-by: Bijan Mottahedeh Signed-off-by: Michael S. Tsirkin drivers/vhost/scsi.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) commit 74ad7419489ddade8044e3c9ab064ad656520306 Author: Pavel Tikhomirov Date: Thu Dec 13 17:53:50 2018 +0300 vhost: return EINVAL if iovecs size does not match the message size We've failed to copy and process vhost_iotlb_msg so let userspace at least know about it. For instance before these patch the code below runs without any error: int main() { struct vhost_msg msg; struct iovec iov; int fd; fd = open("/dev/vhost-net", O_RDWR); if (fd == -1) { perror("open"); return 1; } iov.iov_base = &msg; iov.iov_len = sizeof(msg)-4; if (writev(fd, &iov,1) == -1) { perror("writev"); return 1; } return 0; } Signed-off-by: Pavel Tikhomirov Signed-off-by: Michael S. Tsirkin drivers/vhost/vhost.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit bf4dc0b2beebfd9338df7c0bcf473b356f67cf66 Author: Wei Wang Date: Mon Jan 7 15:01:04 2019 +0800 virtio-balloon: tweak config_changed implementation virtio-ccw has deadlock issues with reading the config space inside the interrupt context, so we tweak the virtballoon_changed implementation by moving the config read operations into the related workqueue contexts. The config_read_bitmap is used as a flag to the workqueue callbacks about the related config fields that need to be read. The cmd_id_received is also renamed to cmd_id_received_cache, and the value should be obtained via virtio_balloon_cmd_id_received. Reported-by: Christian Borntraeger Signed-off-by: Wei Wang Reviewed-by: Cornelia Huck Reviewed-by: Halil Pasic Signed-off-by: Michael S. Tsirkin Cc: stable@vger.kernel.org Fixes: 86a559787e6f ("virtio-balloon: VIRTIO_BALLOON_F_FREE_PAGE_HINT") Tested-by: Christian Borntraeger drivers/virtio/virtio_balloon.c | 98 +++++++++++++++++++++++++++-------------- 1 file changed, 65 insertions(+), 33 deletions(-) commit a229989d975eb926076307c1f2f5e4c6111768e7 Author: Wei Wang Date: Fri Dec 28 10:26:26 2018 +0800 virtio: don't allocate vqs when names[i] = NULL Some vqs may not need to be allocated when their related feature bits are disabled. So callers may pass in such vqs with "names = NULL". Then we skip such vq allocations. Signed-off-by: Wei Wang Signed-off-by: Michael S. Tsirkin Signed-off-by: Wei Wang Signed-off-by: Wei Wang Reviewed-by: Cornelia Huck Cc: stable@vger.kernel.org Fixes: 86a559787e6f ("virtio-balloon: VIRTIO_BALLOON_F_FREE_PAGE_HINT") drivers/misc/mic/vop/vop_main.c | 9 +++++++-- drivers/remoteproc/remoteproc_virtio.c | 9 +++++++-- drivers/s390/virtio/virtio_ccw.c | 12 +++++++++--- drivers/virtio/virtio_mmio.c | 9 +++++++-- 4 files changed, 30 insertions(+), 9 deletions(-) commit ddbeac07a39a81d82331a312d0578fab94fccbf1 Author: Wei Wang Date: Fri Dec 28 10:26:25 2018 +0800 virtio_pci: use queue idx instead of array idx to set up the vq When find_vqs, there will be no vq[i] allocation if its corresponding names[i] is NULL. For example, the caller may pass in names[i] (i=4) with names[2] being NULL because the related feature bit is turned off, so technically there are 3 queues on the device, and name[4] should correspond to the 3rd queue on the device. So we use queue_idx as the queue index, which is increased only when the queue exists. Signed-off-by: Wei Wang Signed-off-by: Michael S. Tsirkin Signed-off-by: Wei Wang Signed-off-by: Wei Wang drivers/virtio/virtio_pci_common.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit d1c1dad89e7a8be2cfdc7b92deca2c8048f0d263 Author: Cornelia Huck Date: Thu Jan 3 17:08:04 2019 +0100 virtio: document virtio_config_ops restrictions Some transports (e.g. virtio-ccw) implement virtio operations that seem to be a simple read/write as something more involved that cannot be done from an atomic context. Give at least a hint about that. Signed-off-by: Cornelia Huck Signed-off-by: Michael S. Tsirkin include/linux/virtio_config.h | 5 +++++ 1 file changed, 5 insertions(+) commit b89a07c4373b27321b1f6d4b4fdc369fd45ef79d Author: Cornelia Huck Date: Thu Jan 3 17:08:03 2019 +0100 virtio: fix virtio_config_ops description - get_features has returned 64 bits since commit d025477368792 ("virtio: add support for 64 bit features.") - properly mark all optional callbacks Signed-off-by: Cornelia Huck Signed-off-by: Michael S. Tsirkin Reviewed-by: Halil Pasic include/linux/virtio_config.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 5a7b2aabc1aa0393f067d9325ada96fdf67f8cb7 Author: Mark Brown Date: Mon Jan 14 23:29:36 2019 +0000 ASoC: core: Make snd_soc_find_component() more robust There are some use cases where you're checking for a lot of things on a card and it makes sense that you might end up trying to call snd_soc_find_component() without either a name or an of_node. Currently in that case we try to dereference the name and crash but it's more useful to allow the caller to just treat that as a case where we don't find anything, that error handling will already exist. Inspired by a patch from Ajit Pandey fixing some callers. Fixes: 8780cf1142a5 ("ASoC: soc-core: defer card probe until all component is added to list") Reported-by: Pierre-Louis Bossart Signed-off-by: Mark Brown sound/soc/soc-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d77651a227f8920dd7ec179b84e400cce844eeb3 Author: Dmitry Torokhov Date: Mon Jan 14 13:54:55 2019 -0800 Input: uinput - fix undefined behavior in uinput_validate_absinfo() An integer overflow may arise in uinput_validate_absinfo() if "max - min" can't be represented by an "int". We should check for overflow before trying to use the result. Reported-by: Kyungtae Kim Reviewed-by: Peter Hutterer Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov drivers/input/misc/uinput.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 3eb66e91a25497065c5322b1268cbc3953642227 Merge: 4add635b4e00 8fe28cb58bcb Author: Dmitry Torokhov Date: Mon Jan 14 15:33:23 2019 -0800 Merge tag 'v4.20' into for-linus Sync with mainline to get linux/overflow.h among other things. commit 2e8cb2cf1bd6e90f58bd517eb9ca1938e64fa51c Author: Rob Herring Date: Mon Jan 14 15:35:46 2019 -0600 PCI: Fix PCI kconfig menu organization After commit eb01d42a7778 ("PCI: consolidate PCI config entry in drivers/pci"), all the PCI kconfig options appear below "PCI support" rather than within a sub-menu. This is because menuconfig expects all kconfig entries to be enclosed in an if/endif section. Add the missing if/endif. With this, "depends on PCI" is redundant in the sub-menu entries and can be removed. Fixes: eb01d42a7778 ("PCI: consolidate PCI config entry in drivers/pci") Signed-off-by: Rob Herring Signed-off-by: Bjorn Helgaas Reviewed-by: Christoph Hellwig drivers/pci/Kconfig | 22 ++++++++-------------- 1 file changed, 8 insertions(+), 14 deletions(-) commit 09ac6a817bd687e7f5dac00470262efdd72f9319 Author: Curtis Malainey Date: Thu Jan 10 16:21:04 2019 -0800 ASoC: soc-core: fix init platform memory handling snd_soc_init_platform initializes pointers to snd_soc_dai_link which is statically allocated and it does this by devm_kzalloc. In the event of an EPROBE_DEFER the memory will be freed and the pointers are left dangling. snd_soc_init_platform sees the dangling pointers and assumes they are pointing to initialized memory and does not reallocate them on the second probe attempt which results in a use after free bug since devm has freed the memory from the first probe attempt. Since the intention for snd_soc_dai_link->platform is that it can be set statically by the machine driver we need to respect the pointer in the event we did not set it but still catch dangling pointers. The solution is to add a flag to track whether the pointer was dynamically allocated or not. Signed-off-by: Curtis Malainey Signed-off-by: Mark Brown include/sound/soc.h | 6 ++++++ sound/soc/soc-core.c | 11 ++++++----- 2 files changed, 12 insertions(+), 5 deletions(-) commit 7151449fe7fa5962c6153355f9779d6be99e8e97 Author: Mark Zhang Date: Mon Jan 14 17:32:58 2019 +0800 regmap-irq: do not write mask register if mask_base is zero If client have not provided the mask base register then do not write into the mask register. Signed-off-by: Laxman Dewangan Signed-off-by: Jinyoung Park Signed-off-by: Venkat Reddy Talla Signed-off-by: Mark Zhang Signed-off-by: Mark Brown drivers/base/regmap/regmap-irq.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 8a644c64a9f1aefb99fdc4413e6b7fee17809e38 Author: Aurelien Jarno Date: Sat Jan 12 20:37:28 2019 +0100 MIPS: OCTEON: fix kexec support Commit 62cac480f33f ("MIPS: kexec: Make a framework for both jumping and halting on nonboot CPUs") broke the build of the OCTEON platform as the relocated_kexec_smp_wait() is now static and not longer exported in kexec.h. Replace it by kexec_reboot() like it has been done in other places. Fixes: 62cac480f33f ("MIPS: kexec: Make a framework for both jumping and halting on nonboot CPUs") Signed-off-by: Aurelien Jarno Signed-off-by: Paul Burton Cc: linux-mips@vger.kernel.org Cc: Dengcheng Zhu Cc: ralf@linux-mips.org Cc: stable@vger.kernel.org # 4.20+ arch/mips/cavium-octeon/setup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d6f4a21f309dfe10a5693ad236358dd6fcc46f7a Author: Jason Gunthorpe Date: Fri Jan 11 08:21:44 2019 +0200 RDMA/uverbs: Mark ioctl responses with UVERBS_ATTR_F_VALID_OUTPUT When the ioctl interface for the write commands was introduced it did not mark the core response with UVERBS_ATTR_F_VALID_OUTPUT. This causes rdma-core in userspace to not mark the buffers as written for valgrind. Along the same lines it turns out we have always missed marking the driver data. Fixing both of these makes valgrind work properly with rdma-core and ioctl. Fixes: 4785860e04bc ("RDMA/uverbs: Implement an ioctl that can call write and write_ex handlers") Signed-off-by: Jason Gunthorpe Reviewed-by: Artemy Kovalyov Signed-off-by: Leon Romanovsky drivers/infiniband/core/rdma_core.h | 2 ++ drivers/infiniband/core/uverbs_cmd.c | 7 ++++ drivers/infiniband/core/uverbs_ioctl.c | 62 +++++++++++++++++++++++++++------- drivers/infiniband/core/uverbs_main.c | 1 + 4 files changed, 59 insertions(+), 13 deletions(-) commit ae1cf20df7a9c60ff5ef41c3315c33c1a5fafd77 Author: Nicholas Kazlauskas Date: Tue Dec 11 12:35:56 2018 -0500 drm/amd/display: Fix disabled cursor on top screen edge [Why] The cursor vanishes when touching the top of edge of the screen for Raven on Linux. This occurs because the cursor height is not taken into account when deciding to disable the cursor. [How] Factor in the cursor height into the cursor calculations - and mimic the existing x position calculations. Fixes: 94a4ffd1d40b ("drm/amd/display: fix PIP bugs on Dal3") Signed-off-by: Nicholas Kazlauskas Reviewed-by: Harry Wentland Acked-by: Leo Li Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp.c | 2 +- drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubp.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit f5c412ac596fbe1508514257fef3d48e263f40a7 Author: Roman Li Date: Wed Dec 19 09:24:06 2018 -0500 drm/amd/display: fix warning on raven hotplug [Why] Hotplug on raven results in REG_WAIT_TIMEOUT warning due to failing attempt to lock disabled otg for the hubp interdependent pipes programming. [How] Don't setup pipe interdependencies for disabled otg. Also removed the unnecessary duplicate logic checks. Signed-off-by: Roman Li Reviewed-by: Dmytro Laktyushkin Acked-by: Leo Li Signed-off-by: Alex Deucher .../gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-) commit 20300db4aec5ba5edf6f0ad6f7111a51fbea7e10 Author: Charlene Liu Date: Wed Dec 12 18:09:16 2018 -0500 drm/amd/display: fix PME notification not working in RV desktop [Why] PPLIB not receive the PME when unplug. Signed-off-by: Charlene Liu Reviewed-by: Chris Park Acked-by: Leo Li Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit dddce8b490051018f8d5d1457af47483064c7e09 Author: Nicholas Kazlauskas Date: Thu Jan 10 15:12:48 2019 -0500 drm/amd/display: Only get the connector state for VRR when toggled [Why] This fixes a stuttering issue that occurs when moving a hardware cursor when VRR is enabled. Previously when VRR is enabled atomic check will grab the connector state for every atomic update. This has to lock the connector in order to do so. The locking is bad enough by itself for performance, but it gets worse with what we do just below that - add all the planes for the CRTC to the commit. This prevents the cursor fast path from working - there's more than one plane now. With state->allow_modeset = true on top of this, it also adds and removes all the planes from the DC context triggering a full (very slow) update in DC. [How] We need the connector state to get the VRR min/max capbilities, but we only need them when there's a CRTC mode change or when VRR is toggled. The condition has been updated accordingly. Fixes: 3cc22f281318 ("drm/amdgpu: Set FreeSync state using drm VRR properties") Signed-off-by: Nicholas Kazlauskas Reviewed-by: Leo Li Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 099139bef026faefebc508ddb77d397cf55f1b15 Author: Josip Pavic Date: Tue Dec 11 15:13:08 2018 -0500 drm/amd/display: Pack DMCU iRAM alignment [Why] When the DMCU's iRAM definition was moved to the newly created power_helpers, a #pragma pack was lost, causing the iRAM to be misaligned [How] Restore the #pragma pack Signed-off-by: Josip Pavic Reviewed-by: Anthony Koo Acked-by: Leo Li Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/modules/power/power_helpers.c | 2 ++ 1 file changed, 2 insertions(+) commit a29b01a1313d20a6d45c0f25858f31701cee625d Author: Kenneth Feng Date: Wed Jan 9 14:39:48 2019 +0800 drm/amd/powerplay: run acg btc for Vega12 acg btc was added to Vega12 Signed-off-by: Kenneth Feng Reviewed-by: Evan Quan Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/hwmgr/vega12_hwmgr.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) commit bbdf514fe5648566b0754476cbcb92ac3422dde2 Author: Felix Kuehling Date: Wed Jan 2 17:47:39 2019 -0500 drm/amdkfd: Don't assign dGPUs to APU topology devices dGPUs need their own topology devices. Don't assign them to APU topology devices with CPU cores. Bug: https://github.com/RadeonOpenCompute/ROCK-Kernel-Driver/issues/66 Signed-off-by: Felix Kuehling Tested-by: Elias Konstantinidis Acked-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) commit d1c234e2cd1091b816c990a1848d88a8697f97b4 Author: Felix Kuehling Date: Wed Jan 2 14:52:13 2019 -0500 drm/amdkfd: Allow building KFD on ARM64 (v2) ifdef x86_64 specific code. Allow enabling CONFIG_HSA_AMD on ARM64. v2: Fixed a compiler warning due to an unused variable CC: Mark Nutter Signed-off-by: Felix Kuehling Tested-by: Mark Nutter Acked-by: Alex Deucher Acked-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdkfd/Kconfig | 4 ++-- drivers/gpu/drm/amd/amdkfd/kfd_crat.c | 8 ++++++++ drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 9 +++++---- 3 files changed, 15 insertions(+), 6 deletions(-) commit d69d287a9002b70bdbe2975660b97241ccefc071 Author: Matthew Wilcox Date: Mon Jan 14 13:57:31 2019 -0500 XArray tests: Check mark 2 gets squashed We do not currently check that the loop in xas_squash_marks() doesn't have an off-by-one error in it. It didn't, but a patch which introduced an off-by-one error wasn't caught by any existing test. Switch the roles of XA_MARK_1 and XA_MARK_2 to catch that bug. Reported-by: Cyrill Gorcunov Signed-off-by: Matthew Wilcox lib/test_xarray.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 3719876809e745b9db5293d418600c194bbf5c23 Author: Steven Rostedt (VMware) Date: Mon Jan 14 12:25:40 2019 -0500 sbitmap: Protect swap_lock from softirqs The swap_lock used by sbitmap has a chain with locks taken from softirq, but the swap_lock is not protected from being preempted by softirqs. A chain exists of: sbq->ws[i].wait -> dispatch_wait_lock -> swap_lock Where the sbq->ws[i].wait lock can be taken from softirq context, which means all locks below it in the chain must also be protected from softirqs. Reported-by: Clark Williams Fixes: 58ab5e32e6fd ("sbitmap: silence bogus lockdep IRQ warning") Fixes: ea86ea2cdced ("sbitmap: amortize cost of clearing bits") Cc: Jens Axboe Cc: Ming Lei Cc: Guenter Roeck Signed-off-by: Steven Rostedt (VMware) Signed-off-by: Linus Torvalds lib/sbitmap.c | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) commit 4add635b4e00dd7d6aad83a937afdf1957196da6 Author: Anders Roxell Date: Mon Jan 14 10:30:04 2019 -0800 Input: raspberrypi-ts - fix link error Fix link error when TOUCHSCREEN_RASPBERRYPI_FW is enabled as a module and the dependent module is built-in. The 'depends on RASPBERRYPI_FIRMWARE' by itself prevents the touchscreen driver from being built-in when the firmware is configured as a module. However, the '|| COMPILE_TEST' still allows it unless we explicitly prevent that configuration with '|| (RASPBERRYPI_FIRMWARE=n && COMPILE_TEST)'. ld: drivers/input/touchscreen/raspberrypi-ts.o: in function `rpi_ts_probe': raspberrypi-ts.c:(.text+0x3a8): undefined reference to `rpi_firmware_get' ld: raspberrypi-ts.c:(.text+0x3a8): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `rpi_firmware_get' ld: raspberrypi-ts.c:(.text+0x4c8): undefined reference to `rpi_firmware_property' ld: raspberrypi-ts.c:(.text+0x4c8): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `rpi_firmware_property' Rework so that TOUCHSCREEN_RASPBERRYPI_FW depends on RASPBERRYPI_FIRMWARE=n if COMPILE_TEST is enabled. Fixes: 0b9f28fed3f7 ("Input: add official Raspberry Pi's touchscreen driver") Suggested-by: Arnd Bergmann Signed-off-by: Anders Roxell Signed-off-by: Dmitry Torokhov drivers/input/touchscreen/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c962cb323ec260652cff9331e7bf3d606292db88 Merge: 9deb9e163776 e3e4767bd550 Author: Linus Torvalds Date: Tue Jan 15 06:26:28 2019 +1200 Merge tag 'gpio-v5.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO fixes from Linus Walleij: "The patch hitting the MMC/SD subsystem is fixing up my own mess when moving semantics from MMC/SD over to gpiolib. Ulf is on vacation but I managed to reach him on chat and obtain his ACK. The other two are early-rc fixes that are not super serious but pretty annoying so I'd like to get rid of them. Summary: - Get rid of some WARN_ON() from the ACPI code - Staticize a symbol - Fix MMC polarity detection" * tag 'gpio-v5.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: mmc: core: don't override the CD GPIO level when "cd-inverted" is set gpio: pca953x: Make symbol 'pca953x_i2c_regmap' static gpiolib-acpi: Remove unnecessary WARN_ON from acpi_gpiochip_free_interrupts commit 9deb9e1637761cc4e6df5104a34197ef0bae1358 Merge: 3a73e73a10a7 3f2d347e851e Author: Linus Torvalds Date: Tue Jan 15 06:24:36 2019 +1200 Merge tag 'mfd-next-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD updates from Lee Jones: "New Device Support - Add support for Power Supply to AXP813 - Add support for GPIO, ADC, AC and Battery Power Supply to AXP803 - Add support for UART to Exynos LPASS Fix-ups: - Use supplied MACROS; ti_am335x_tscadc - Trivial spelling/whitespace/alignment; tmio, axp20x, rave-sp - Regmap changes; bd9571mwv, wm5110-tables - Kconfig dependencies; MFD_AT91_USART - Supply shared data for child-devices; madera-core - Use new of_node_name_eq() API call; max77620, stmpe - Use managed resources (devm_*); tps65218 - Comment descriptions; ingenic-tcu - Coding style; madera-core Bug Fixes: - Fix section mismatches; twl-core, db8500-prcmu - Correct error path related issues; mt6397-core, ab8500-core, mc13xxx-core - IRQ related fixes; tps6586x - Ensure proper initialisation sequence; qcom_rpm - Repair potential memory leak; cros_ec_dev" * tag 'mfd-next-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (25 commits) mfd: exynos-lpass: Enable UART module support mfd: mc13xxx: Fix a missing check of a register-read failure mfd: cros_ec: Add commands to control codec mfd: madera: Remove spurious semicolon in while loop mfd: rave-sp: Fix typo in rave_sp_checksum comment mfd: ingenic-tcu: Fix bit field description in header mfd: tps65218: Use devm_regmap_add_irq_chip and clean up error path in probe() mfd: Use of_node_name_eq() for node name comparisons mfd: cros_ec_dev: Add missing mfd_remove_devices() call in remove mfd: axp20x: Add supported cells for AXP803 mfd: axp20x: Re-align MFD cell entries mfd: axp20x: Add AC power supply cell for AXP813 mfd: wm5110: Add missing ASRC rate register mfd: qcom_rpm: write fw_version to CTRL_REG mfd: tps6586x: Handle interrupts on suspend mfd: madera: Add shared data for accessory detection mfd: at91-usart: Add platform dependency mfd: bd9571mwv: Add volatile register to make DVFS work mfd: ab8500-core: Return zero in get_register_interruptible() mfd: tmio: Typo s/use use/use/ ... commit 3a73e73a10a791344587103a1adbe0c5f02fedeb Merge: 1c7fc5cbc339 3cee7a7d05b1 Author: Linus Torvalds Date: Tue Jan 15 06:21:10 2019 +1200 Merge tag 'backlight-next-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight Pull backlight updates from Lee Jones: "Fix-ups: - Use new of_node_name_eq() API call Bug Fixes: - Internally track 'enabled' state in pwm_bl - Fix auto-generated pwm_bl brightness tables parsed by DT * tag 'backlight-next-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight: backlight: 88pm860x_bl: Use of_node_name_eq for node name comparisons backlight: pwm_bl: Fix devicetree parsing with auto-generated brightness tables backlight: pwm_bl: Re-add driver internal enabled tracking commit 687ae9e287b3a1a71e5e1c2a9c96b23d70768821 Author: Takashi Iwai Date: Tue Jan 8 11:37:31 2019 +0100 ASoC: intel: skl: Fix display power regression Since the refactoring of HD-audio display power management, the display power status is managed per domain. Meanwhile the ASoC hdac_hdmi driver still keeps and relies (incorrectly) on the refcounting together with ASoC skl driver, and this leads to the display state always on. This patch is an attempt to address the regression by simplifying the PM code of ASoC skl and hdac_hdmi drivers. Basically, since the refactoring, we don't have to manage the display power at HD-audio controller suspend / resume but only at HD-audio HDMI codec suspend / resume. So the patch drops the superfluous snd_hdac_display_power() calls in skl driver. Meanwhile, in hdac_hdmi side, we rewrite the PM call just to re-use the runtime PM callbacks like other drivers do. Now the logic is simple: turn off at suspend and turn on at resume. The patch also fixes the possibly missing display-power off at skl driver removal as well as some error paths at probe. Fixes: 029d92c289bd ("ALSA: hda: Refactor display power management") Reported-by: Libin Yang Signed-off-by: Takashi Iwai sound/soc/codecs/hdac_hdmi.c | 116 +++++------------------------------------- sound/soc/intel/skylake/skl.c | 13 ++--- 2 files changed, 17 insertions(+), 112 deletions(-) commit 19ba9ecf24189bd74d070aa1b1c4bcb9fe4ae849 Author: Cyrill Gorcunov Date: Mon Jan 14 11:40:47 2019 +0300 XArray: Fix typo in comment Seems copy and paste typo, not a big deal but still for consistency sake better to fix. Signed-off-by: Cyrill Gorcunov Signed-off-by: Matthew Wilcox include/linux/xarray.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f29200c8b1e267b109242677ae7f2146c7682d14 Author: Loys Ollivier Date: Mon Jan 14 15:44:21 2019 +0100 arm64: dts: meson: Fix mmc cd-gpios polarity Commit 89a5e15bcba8 ("gpio/mmc/of: Respect polarity in the device tree") changed the behavior of "cd-inverted" to follow the device tree bindings specification: According to SDHCI standard, CD lines are specified as "active low". Using the "cd-inverted" property means that the CD line is "active high". Fix the SD card description for meson by setting the cd-gpios as "active low", according to the boards specifications, and dropping the "cd-inverted" property. Fixes: 89a5e15bcba8 ("gpio/mmc/of: Respect polarity in the device tree") Signed-off-by: Loys Ollivier Signed-off-by: Kevin Hilman arch/arm64/boot/dts/amlogic/meson-gx-p23x-q20x.dtsi | 3 +-- arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts | 3 +-- arch/arm64/boot/dts/amlogic/meson-gxbb-nexbox-a95x.dts | 3 +-- arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts | 3 +-- arch/arm64/boot/dts/amlogic/meson-gxbb-p20x.dtsi | 3 +-- arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi | 3 +-- arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi | 3 +-- arch/arm64/boot/dts/amlogic/meson-gxl-s905x-hwacom-amazetv.dts | 3 +-- arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts | 3 +-- arch/arm64/boot/dts/amlogic/meson-gxl-s905x-nexbox-a95x.dts | 3 +-- arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtsi | 3 +-- arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts | 3 +-- arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts | 3 +-- arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts | 3 +-- 14 files changed, 14 insertions(+), 28 deletions(-) commit f672b93e4a0a4947d2e1103ed8780e01e13eadb6 Author: Julia Lawall Date: Sun Jan 13 10:44:51 2019 +0100 drm/meson: add missing of_node_put Add an of_node_put when the result of of_graph_get_remote_port_parent is not available. An of_node_put is also needed when meson_probe_remote completes. This was present at the recursive call, but not in the call from meson_drv_probe. The semantic match that finds this problem is as follows (http://coccinelle.lip6.fr): // @r exists@ local idexpression e; expression x; @@ e = of_graph_get_remote_port_parent(...); ... when != x = e when != true e == NULL when != of_node_put(e) when != of_fwnode_handle(e) ( return e; | *return ...; ) // Signed-off-by: Julia Lawall Acked-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/1547372691-28324-4-git-send-email-Julia.Lawall@lip6.fr drivers/gpu/drm/meson/meson_drv.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) commit ca4438442ef263cbaa3ae62a712143132cf508c1 Author: Chen-Yu Tsai Date: Sun Jan 13 17:57:23 2019 +0800 pinctrl: sunxi: Consider pin_base when calculating regulator array index On most newer Allwinner SoCs, there are two pinctrl devices, the PIO and R_PIO. PIO covers pin-banks PA to PI (PJ and PK have not been seen), while R_PIO covers PL to PN. The regulator array only has space for 12 entries, which was designed to cover PA to PL. On the A80, the pin banks go up to PN, which would be the 14th entry in the regulator array. However since the driver only needs to track regulators for its own pin banks, the array only needs to have 9 entries, and also take in to account the value of pin_base, such that the regulator for the first pin-bank of the pinctrl device, be it "PA" or "PL" uses the first entry of the array. Base the regulator array index on pin_base, such that "PA" for PIO and "PL" for R_PIO both take the first element within their respective device's regulator array. Also decrease the size of the regulator array to 9, just enough to cover "PA" to "PI". Fixes: 9a2a566adb00 ("pinctrl: sunxi: Deal with per-bank regulators") Signed-off-by: Chen-Yu Tsai Signed-off-by: Linus Walleij drivers/pinctrl/sunxi/pinctrl-sunxi.c | 8 ++++++-- drivers/pinctrl/sunxi/pinctrl-sunxi.h | 2 +- 2 files changed, 7 insertions(+), 3 deletions(-) commit dc14455841773df52b15a17b36d01a26745f212b Author: Chen-Yu Tsai Date: Sun Jan 13 17:57:22 2019 +0800 pinctrl: sunxi: Fix and simplify pin bank regulator handling The new per-pin-bank regulator handling code in the sunxi pinctrl driver has mismatched conditions for enabling and disabling the regulator: it is enabled each time a pin is requested, but only disabled when the pin-bank's reference count reaches zero. Since we are doing reference counting already, there's no need to enable the regulator each time a pin is requested. Instead we can just do it for the first requested pin of each pin-bank. Thus we can reverse the test and bail out early if it's not the first occurrence. Fixes: 9a2a566adb00 ("pinctrl: sunxi: Deal with per-bank regulators") Acked-by: Maxime Ripard Signed-off-by: Chen-Yu Tsai Signed-off-by: Linus Walleij drivers/pinctrl/sunxi/pinctrl-sunxi.c | 36 ++++++++++++++++------------------- 1 file changed, 16 insertions(+), 20 deletions(-) commit 5268c8f39e0efef81af2aaed160272d9eb507beb Author: Talons Lee Date: Mon Dec 10 18:03:00 2018 +0800 always clear the X2APIC_ENABLE bit for PV guest Commit e657fcc clears cpu capability bit instead of using fake cpuid value, the EXTD should always be off for PV guest without depending on cpuid value. So remove the cpuid check in xen_read_msr_safe() to always clear the X2APIC_ENABLE bit. Signed-off-by: Talons Lee Reviewed-by: Juergen Gross Signed-off-by: Boris Ostrovsky arch/x86/xen/enlighten_pv.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) commit a8eda9fa1bd84065b75bfa81bf675a7af9055478 Author: Karoly Pados Date: Mon Jan 14 13:30:03 2019 +0100 USB: serial: ftdi_sio: fix GPIO not working in autosuspend There is a bug in the current GPIO code for ftdi_sio: it failed to take USB autosuspend into account. If the device is in autosuspend, calls to usb_control_msg() fail with -EHOSTUNREACH. Because the standard value for autosuspend timeout is usually 2-5 seconds, this made it almost impossible to use the GPIOs on machines that have USB autosuspend enabled. This patch fixes the issue by acquiring a PM lock on the device for the duration of the USB transfers. Tested on an FT231X device. Signed-off-by: Karoly Pados [ johan: simplify code somewhat ] Fixes: ba93cc7da896 ("USB: serial: ftdi_sio: implement GPIO support for FT-X devices") Cc: stable # 4.20 Signed-off-by: Johan Hovold drivers/usb/serial/ftdi_sio.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) commit 6251691a92170d3a781aaf7b5f2c31b50d669809 Author: Marcos Paulo de Souza Date: Mon Jan 14 06:31:56 2019 -0700 md: Make bio_alloc_mddev use bio_alloc_bioset bio_alloc_bioset returns a bio pointer or NULL, so we can avoid storing the returned data into a new variable. Acked-by: Guoqing Jiang Acked-by: Artur Paszkiewicz Signed-off-by: Marcos Paulo de Souza Signed-off-by: Jens Axboe drivers/md/md.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) commit 5bf859081f6a7575a3f7509d7a70d0a9baa88ce3 Author: Paolo Valente Date: Thu Dec 6 19:18:19 2018 +0100 block, bfq: fix comments on __bfq_deactivate_entity Comments on function __bfq_deactivate_entity contains two imprecise or wrong statements: 1) The function performs the deactivation of the entity. 2) The function must be invoked only if the entity is on a service tree. This commits replaces both statements with the correct ones: 1) The functions updates sched_data and service trees for the entity, so as to represent entity as inactive (which is only part of the steps needed for the deactivation of the entity). 2) The function must be invoked on every entity being deactivated. Signed-off-by: Paolo Valente Signed-off-by: Jens Axboe block/bfq-wf2q.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) commit 2bd44dadd5bfb4135162322fd0b45a174d4ad5bf Author: Stefan Wahren Date: Sun Dec 23 21:59:17 2018 +0100 mmc: sdhci-iproc: handle mmc_of_parse() errors during probe We need to handle mmc_of_parse() errors during probe. This finally fixes the wifi regression on Raspberry Pi 3 series. In error case the wifi chip was permanently in reset because of the power sequence depending on the deferred probe of the GPIO expander. Fixes: b580c52d58d9 ("mmc: sdhci-iproc: add IPROC SDHCI driver") Cc: stable@vger.kernel.org Signed-off-by: Stefan Wahren Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-iproc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 2314e879747e82896f51cce4488f6a00f3e1af7b Author: Henry Yen Date: Mon Jan 14 17:59:43 2019 +0800 netfilter: nft_flow_offload: fix checking method of conntrack helper This patch uses nfct_help() to detect whether an established connection needs conntrack helper instead of using test_bit(IPS_HELPER_BIT, &ct->status). The reason is that IPS_HELPER_BIT is only set when using explicit CT target. However, in the case that a device enables conntrack helper via command "echo 1 > /proc/sys/net/netfilter/nf_conntrack_helper", the status of IPS_HELPER_BIT will not present any change, and consequently it loses the checking ability in the context. Signed-off-by: Henry Yen Reviewed-by: Ryder Lee Tested-by: John Crispin Signed-off-by: Pablo Neira Ayuso net/netfilter/nft_flow_offload.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 77ae0d8e401f083ca69c202502da4fc0e38cb1b7 Author: Kai-Heng Feng Date: Mon Jan 14 16:47:34 2019 +0800 HID: i2c-hid: Disable runtime PM on Goodix touchpad A Goodix touchpad doesn't work. Touching the touchpad can trigger IRQ but there's no input event from HID subsystem. Turns out it reports some invalid data: [ 22.136630] i2c_hid i2c-DELL091F:00: input: 0b 00 01 00 00 00 00 00 00 00 00 After some trial and error, it's another device that doesn't work well with ON/SLEEP commands. Disable runtime PM to fix the issue. Signed-off-by: Kai-Heng Feng Signed-off-by: Jiri Kosina drivers/hid/hid-ids.h | 3 +++ drivers/hid/i2c-hid/i2c-hid-core.c | 2 ++ 2 files changed, 5 insertions(+) commit bb364890323cca6e43f13e86d190ebf34a7d8cea Author: Remi Pommarel Date: Fri Jan 11 00:01:35 2019 +0100 mmc: meson-gx: Free irq in release() callback Because the irq was requested through device managed resources API (devm_request_threaded_irq()) it was freed after meson_mmc_remove() completion, thus after mmc_free_host() has reclaimed meson_host memory. As this irq is IRQF_SHARED, while using CONFIG_DEBUG_SHIRQ, its handler get called by free_irq(). So meson_mmc_irq() was called after the meson_host memory reclamation and was using invalid memory. We ended up with the following scenario: device_release_driver() meson_mmc_remove() mmc_free_host() /* Freeing host memory */ ... devres_release_all() devm_irq_release() __free_irq() meson_mmc_irq() /* Uses freed memory */ To avoid this, the irq is released in meson_mmc_remove() and in mseon_mmc_probe() error path before mmc_free_host() gets called. Reported-by: Elie Roudninski Signed-off-by: Remi Pommarel Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson drivers/mmc/host/meson-gx-mmc.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) commit 287b1da6a458a30da2e5be745498d31092ebb001 Author: Faiz Abbas Date: Wed Jan 9 18:13:12 2019 +0530 mmc: host: Fix Kconfig warnings on keystone_defconfig Commit 961de0a856e3 ("mmc: sdhci-omap: Workaround errata regarding SDR104/HS200 tuning failures (i929)") added a select on TI_SOC_THERMAL for the driver to get temperature for tuning. However, this causes the following warning on keystone_defconfig because keystone does not support TI_SOC_THERMAL: "WARNING: unmet direct dependencies detected for TI_SOC_THERMAL" Fix this by changing the select to imply. Fixes: 961de0a856e3 ("mmc: sdhci-omap: Workaround errata regarding SDR104/HS200 tuning failures (i929)") Signed-off-by: Faiz Abbas Tested-by: Borislav Petkov Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson drivers/mmc/host/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c2eda8ab2e2d52e2d618aa4d858126cebf9c7de2 Author: Sinan Kaya Date: Sat Jan 5 10:06:04 2019 +0000 mmc: sdhci-acpi: Make PCI dependency explicit After 'commit 5d32a66541c4 ("PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set")' dependencies on CONFIG_PCI that previously were satisfied implicitly through dependencies on CONFIG_ACPI have to be specified directly. This driver relies on IOSF_MBI and IOSF_MBI depends on PCI. For this reason, add a direct dependency to CONFIG_PCI here. Fixes: 5d32a66541c46 ("PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set") Signed-off-by: Sinan Kaya Acked-by: Arnd Bergmann Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson drivers/mmc/host/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 82aa0d7e09840704d9a37434fef1770179d663fb Author: Kailang Yang Date: Fri Jan 11 17:15:53 2019 +0800 ALSA: hda/realtek - Fix typo for ALC225 model Fix typo for model alc255-dell1 to alc225-dell1. Enable headset mode support for new WYSE NB platform. Fixes: a26d96c7802e ("ALSA: hda/realtek - Comprehensive model list for ALC259 & co") Signed-off-by: Kailang Yang Cc: Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit df28169e1538e4a8bcd8b779b043e5aa6524545c Author: Dan Carpenter Date: Fri Dec 21 23:42:52 2018 +0300 usb: gadget: Potential NULL dereference on allocation error The source_sink_alloc_func() function is supposed to return error pointers on error. The function is called from usb_get_function() which doesn't check for NULL returns so it would result in an Oops. Of course, in the current kernel, small allocations always succeed so this doesn't affect runtime. Signed-off-by: Dan Carpenter Signed-off-by: Felipe Balbi drivers/usb/gadget/function/f_sourcesink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 88b1bb1f3b88e0bf20b05d543a53a5b99bd7ceb6 Author: Zeng Tao Date: Wed Dec 26 19:22:00 2018 +0800 usb: dwc3: gadget: Fix the uninitialized link_state when udc starts Currently the link_state is uninitialized and the default value is 0(U0) before the first time we start the udc, and after we start the udc then stop the udc, the link_state will be undefined. We may have the following warnings if we start the udc again with an undefined link_state: WARNING: CPU: 0 PID: 327 at drivers/usb/dwc3/gadget.c:294 dwc3_send_gadget_ep_cmd+0x304/0x308 dwc3 100e0000.hidwc3_0: wakeup failed --> -22 [...] Call Trace: [] (unwind_backtrace) from [] (show_stack+0x10/0x14) [] (show_stack) from [] (dump_stack+0x84/0x98) [] (dump_stack) from [] (__warn+0xe8/0x100) [] (__warn) from [](warn_slowpath_fmt+0x38/0x48) [] (warn_slowpath_fmt) from [](dwc3_send_gadget_ep_cmd+0x304/0x308) [] (dwc3_send_gadget_ep_cmd) from [](dwc3_ep0_start_trans+0x48/0xf4) [] (dwc3_ep0_start_trans) from [](dwc3_ep0_out_start+0x64/0x80) [] (dwc3_ep0_out_start) from [](__dwc3_gadget_start+0x1e0/0x278) [] (__dwc3_gadget_start) from [](dwc3_gadget_start+0x88/0x10c) [] (dwc3_gadget_start) from [](udc_bind_to_driver+0x88/0xbc) [] (udc_bind_to_driver) from [](usb_gadget_probe_driver+0xf8/0x140) [] (usb_gadget_probe_driver) from [](gadget_dev_desc_UDC_store+0xac/0xc4 [libcomposite]) [] (gadget_dev_desc_UDC_store [libcomposite]) from[] (configfs_write_file+0xd4/0x160) [] (configfs_write_file) from [] (__vfs_write+0x1c/0x114) [] (__vfs_write) from [] (vfs_write+0xa4/0x168) [] (vfs_write) from [] (SyS_write+0x3c/0x90) [] (SyS_write) from [] (ret_fast_syscall+0x0/0x3c) Signed-off-by: Zeng Tao Signed-off-by: Felipe Balbi drivers/usb/dwc3/gadget.c | 1 + 1 file changed, 1 insertion(+) commit bd6742249b9ca918565e4e3abaa06665e587f4b5 Author: Jack Pham Date: Thu Jan 10 12:39:55 2019 -0800 usb: dwc3: gadget: Clear req->needs_extra_trb flag on cleanup OUT endpoint requests may somtimes have this flag set when preparing to be submitted to HW indicating that there is an additional TRB chained to the request for alignment purposes. If that request is removed before the controller can execute the transfer (e.g. ep_dequeue/ep_disable), the request will not go through the dwc3_gadget_ep_cleanup_completed_request() handler and will not have its needs_extra_trb flag cleared when dwc3_gadget_giveback() is called. This same request could be later requeued for a new transfer that does not require an extra TRB and if it is successfully completed, the cleanup and TRB reclamation will incorrectly process the additional TRB which belongs to the next request, and incorrectly advances the TRB dequeue pointer, thereby messing up calculation of the next requeust's actual/remaining count when it completes. The right thing to do here is to ensure that the flag is cleared before it is given back to the function driver. A good place to do that is in dwc3_gadget_del_and_unmap_request(). Fixes: c6267a51639b ("usb: dwc3: gadget: align transfers to wMaxPacketSize") Cc: stable@vger.kernel.org Signed-off-by: Jack Pham Signed-off-by: Felipe Balbi drivers/usb/dwc3/gadget.c | 1 + 1 file changed, 1 insertion(+) commit 01c10880d24291a96a4ab0da773e3c5ce4d12da8 Author: Bo He Date: Mon Jan 14 09:48:32 2019 +0200 usb: dwc3: gadget: synchronize_irq dwc irq in suspend We see dwc3 endpoint stopped by unwanted irq during suspend resume test, which is caused dwc3 ep can't be started with error "No Resource". Here, add synchronize_irq before suspend to sync the pending IRQ handlers complete. Signed-off-by: Bo He Signed-off-by: Yu Wang Signed-off-by: Felipe Balbi drivers/usb/dwc3/gadget.c | 2 ++ 1 file changed, 2 insertions(+) commit fe2bfd0d40c935763812973ce15f5764f1c12833 Author: Tom Panfil Date: Fri Jan 11 17:49:40 2019 -0800 Input: xpad - add support for SteelSeries Stratus Duo Add support for the SteelSeries Stratus Duo, a wireless Xbox 360 controller. The Stratus Duo ships with a USB dongle to enable wireless connectivity, but it can also function as a wired controller by connecting it directly to a PC via USB, hence the need for two USD PIDs. 0x1430 is the dongle, and 0x1431 is the controller. Signed-off-by: Tom Panfil Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov drivers/input/joystick/xpad.c | 3 +++ 1 file changed, 3 insertions(+) commit b318e3ff7ca065d6b107e424c85a63d7a6798a69 Author: Gerd Hoffmann Date: Thu Jan 10 12:15:45 2019 +0100 drm/virtio: drop prime import/export callbacks Also set prime_handle_to_fd and prime_fd_to_handle to NULL, so drm will not advertive DRM_PRIME_CAP_{IMPORT,EXPORT} to userspace. Signed-off-by: Gerd Hoffmann Reviewed-by: Oleksandr Andrushchenko Reviewed-by: Dave Airlie Link: http://patchwork.freedesktop.org/patch/msgid/20190110111545.26768-1-kraxel@redhat.com drivers/gpu/drm/virtio/virtgpu_drv.c | 4 ---- drivers/gpu/drm/virtio/virtgpu_drv.h | 4 ---- drivers/gpu/drm/virtio/virtgpu_prime.c | 14 -------------- 3 files changed, 22 deletions(-) commit f4c34b1e2a37d5676180901fa6ff188bcb6371f8 Author: Gerd Hoffmann Date: Thu Jan 10 09:17:50 2019 +0100 drm/qxl: drop prime import/export callbacks Also set prime_handle_to_fd and prime_fd_to_handle to NULL, so drm will not advertive DRM_PRIME_CAP_{IMPORT,EXPORT} to userspace. Signed-off-by: Gerd Hoffmann Reviewed-by: Dave Airlie Link: http://patchwork.freedesktop.org/patch/msgid/20190110081750.11358-1-kraxel@redhat.com drivers/gpu/drm/qxl/qxl_drv.c | 4 ---- drivers/gpu/drm/qxl/qxl_prime.c | 14 -------------- 2 files changed, 18 deletions(-) commit 2e746942ebacf1565caa72cf980745e5ce297c48 Author: Deepa Dinamani Date: Sun Jan 13 22:28:05 2019 -0800 Input: input_event - provide override for sparc64 The usec part of the timeval is defined as __kernel_suseconds_t tv_usec; /* microseconds */ Arnd noticed that sparc64 is the only architecture that defines __kernel_suseconds_t as int rather than long. This breaks the current y2038 fix for kernel as we only access and define the timeval struct for non-kernel use cases. But, this was hidden by an another typo in the use of __KERNEL__ qualifier. Fix the typo, and provide an override for sparc64. Fixes: 152194fe9c3f ("Input: extend usable life of event timestamps to 2106 on 32 bit systems") Reported-by: Arnd Bergmann Signed-off-by: Deepa Dinamani Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov include/uapi/linux/input.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit ba0a64bcf8fc491f73e4646069d97abb4374beb3 Author: Colin Xu Date: Fri Jan 11 14:25:54 2019 +0800 drm/i915/gvt: Allow F_CMD_ACCESS on mmio 0x21f0 The newly updated guest driver could program 0x21f0 via lri and srm, without F_CMD_ACCESS flag cmd parser will stop parser reset cmd. 0x21f0 applies to BDW, SKL, KBL, BXT and CFL. Reviewed-by: Yan Zhao Signed-off-by: Colin Xu Signed-off-by: Zhenyu Wang drivers/gpu/drm/i915/gvt/handlers.c | 1 + 1 file changed, 1 insertion(+) commit bd352a739fde9834d48379e8eca428fe897144ac Author: Masahiro Yamada Date: Mon Jan 14 12:16:45 2019 +0900 kbuild: remove unused baseprereq Commit eea199b445f6 ("kbuild: remove unnecessary LEX_PREFIX and YACC_PREFIX") removed the last users of this macro. Signed-off-by: Masahiro Yamada scripts/Kbuild.include | 4 ---- 1 file changed, 4 deletions(-) commit 16fd20aa98080c2fa666dc384036ec08c80af710 Author: Paul Burton Date: Fri Jan 11 19:06:44 2019 +0000 kbuild: Disable LD_DEAD_CODE_DATA_ELIMINATION with ftrace & GCC <= 4.7 When building using GCC 4.7 or older, -ffunction-sections & the -pg flag used by ftrace are incompatible. This causes warnings or build failures (where -Werror applies) such as the following: arch/mips/generic/init.c: error: -ffunction-sections disabled; it makes profiling impossible This used to be taken into account by the ordering of calls to cc-option from within the top-level Makefile, which was introduced by commit 90ad4052e85c ("kbuild: avoid conflict between -ffunction-sections and -pg on gcc-4.7"). Unfortunately this was broken when the CONFIG_LD_DEAD_CODE_DATA_ELIMINATION cc-option check was moved to Kconfig in commit e85d1d65cd8a ("kbuild: test dead code/data elimination support in Kconfig"), because the flags used by this check no longer include -pg. Fix this by not allowing CONFIG_LD_DEAD_CODE_DATA_ELIMINATION to be enabled at the same time as ftrace/CONFIG_FUNCTION_TRACER when building using GCC 4.7 or older. Signed-off-by: Paul Burton Fixes: e85d1d65cd8a ("kbuild: test dead code/data elimination support in Kconfig") Reported-by: Geert Uytterhoeven Cc: Nicholas Piggin Cc: stable@vger.kernel.org # v4.19+ Signed-off-by: Masahiro Yamada init/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 2648ca1859bb48cacdbbaf60bbc0bfef74f13330 Author: Masahiro Yamada Date: Fri Jan 11 11:51:48 2019 +0900 kconfig: clean generated *conf-cfg files I accidentally dropped '*' in the previous renaming patch. Revive it so that 'make mrproper' can clean the generated files. Fixes: d86271af6460 ("kconfig: rename generated .*conf-cfg to *conf-cfg") Signed-off-by: Masahiro Yamada scripts/kconfig/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1c7fc5cbc33980acd13d668f1c8f0313d6ae9fd8 Author: Linus Torvalds Date: Mon Jan 14 10:41:12 2019 +1200 Linux 5.0-rc2 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b7285b425318331c2de4af2a784a18e6dccef484 Author: Jonathan Neuschäfer Date: Sat Jan 12 18:14:30 2019 +0100 kernel/sys.c: Clarify that UNAME26 does not generate unique versions anymore UNAME26 is a mechanism to report Linux's version as 2.6.x, for compatibility with old/broken software. Due to the way it is implemented, it would have to be updated after 5.0, to keep the resulting versions unique. Linus Torvalds argued: "Do we actually need this? I'd rather let it bitrot, and just let it return random versions. It will just start again at 2.4.60, won't it? Anybody who uses UNAME26 for a 5.x kernel might as well think it's still 4.x. The user space is so old that it can't possibly care about differences between 4.x and 5.x, can it? The only thing that matters is that it shows "2.4.", which it will do regardless" Signed-off-by: Jonathan Neuschäfer Signed-off-by: Linus Torvalds kernel/sys.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit dbc3c09b819f2bd42460b148e55ac5a9d83aaeaf Merge: 6b529fb0a3ea 465612178b44 Author: Linus Torvalds Date: Mon Jan 14 10:34:14 2019 +1200 Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC fixes from Olof Johansson: "A bigger batch than I anticipated this week, for two reasons: - Some fallout on Davinci from board file -> DTB conversion, that also includes a few longer-standing fixes (i.e. not recent regressions). - drivers/reset material that has been in linux-next for a while, but didn't get sent to us until now for a variety of reasons (maintainer out sick, holidays, etc). There's a functional dependency in there such that one platform (Altera's SoCFPGA) won't boot without one of the patches; instead of reverting the patch that got merged, I looked at this set and decided it was small enough that I'll pick it up anyway. If you disagree I can revisit with a smaller set. That being said, there's also a handful of the usual stuff: - Fix for a crash on Armada 7K/8K when the kernel touches PSCI-reserved memory - Fix for PCIe reset on Macchiatobin (Armada 8K development board, what this email is sent from in fact :) - Enable a few new-merged modules for Amlogic in arm64 defconfig - Error path fixes on Integrator - Build fix for Renesas and Qualcomm - Initialization fix for Renesas RZ/G2E .. plus a few more fixlets" * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (28 commits) ARM: integrator: impd1: use struct_size() in devm_kzalloc() qcom-scm: Include header gpio: pl061: handle failed allocations ARM: dts: kirkwood: Fix polarity of GPIO fan lines arm64: dts: marvell: mcbin: fix PCIe reset signal arm64: dts: marvell: armada-ap806: reserve PSCI area ARM: dts: da850-lcdk: Correct the sound card name ARM: dts: da850-lcdk: Correct the audio codec regulators ARM: dts: da850-evm: Correct the sound card name ARM: dts: da850-evm: Correct the audio codec regulators ARM: davinci: omapl138-hawk: fix label names in GPIO lookup entries ARM: davinci: dm644x-evm: fix label names in GPIO lookup entries ARM: davinci: dm355-evm: fix label names in GPIO lookup entries ARM: davinci: da850-evm: fix label names in GPIO lookup entries ARM: davinci: da830-evm: fix label names in GPIO lookup entries arm64: defconfig: enable modules for amlogic s400 sound card reset: uniphier-glue: Add AHCI reset control support in glue layer dt-bindings: reset: uniphier: Add AHCI core reset description reset: uniphier-usb3: Rename to reset-uniphier-glue dt-bindings: reset: uniphier: Replace the expression of USB3 with generic peripherals ... commit a17ce9960b3628b9f546c454741a1cad551d5695 Author: Julia Lawall Date: Sun Jan 13 09:47:43 2019 +0100 drm/rockchip: add missing of_node_put The device node iterators perform an of_node_get on each iteration, so a jump out of the loop requires an of_node_put. The semantic patch that fixes this problem is as follows (http://coccinelle.lip6.fr): // @@ expression root,e; local idexpression child; iterator name for_each_child_of_node; @@ for_each_child_of_node(root, child) { ... when != of_node_put(child) when != e = child + of_node_put(child); ? break; ... } ... when != child // Fixes: 1f0f01515172 ("drm/rockchip: Add support for Rockchip Soc RGB output interface") Cc: stable@vger.kernel.org Signed-off-by: Julia Lawall [added fixes and cc-stable] Signed-off-by: Heiko Stuebner Link: https://patchwork.freedesktop.org/patch/msgid/1547369264-24831-4-git-send-email-Julia.Lawall@lip6.fr drivers/gpu/drm/rockchip/rockchip_rgb.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 6b529fb0a3eabf9c4cc3e94c11477250379ce6d8 Merge: 72d657dd2115 1b3922a8bc74 Author: Linus Torvalds Date: Mon Jan 14 05:55:51 2019 +1200 Merge tag 'for-5.0-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - two regression fixes in clone/dedupe ioctls, the generic check callback needs to lock extents properly and wait for io to avoid problems with writeback and relocation - fix deadlock when using free space tree due to block group creation - a recently added check refuses a valid fileystem with seeding device, make that work again with a quickfix, proper solution needs more intrusive changes * tag 'for-5.0-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: Use real device structure to verify dev extent Btrfs: fix deadlock when using free space tree due to block group creation Btrfs: fix race between reflink/dedupe and relocation Btrfs: fix race between cloning range ending at eof and writeback commit 72d657dd2115804b93bde4b77e426cc2de70eebf Merge: f7c1038bc759 735df0ff6ece Author: Linus Torvalds Date: Mon Jan 14 05:51:08 2019 +1200 Merge tag 'driver-core-5.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core fixes from Greg KH: "Here is one small sysfs change, and a documentation update for 5.0-rc2 The sysfs change moves from using BUG_ON to WARN_ON, as discussed in an email thread on lkml while trying to track down another driver bug. sysfs should not be crashing and preventing people from seeing where they went wrong. Now it properly recovers and warns the developer. The documentation update removes the use of BUS_ATTR() as the kernel is moving away from this to use the specific BUS_ATTR_RW() and friends instead. There are pending patches in all of the different subsystems to remove the last users of this macro, but for now, don't advertise it should be used anymore to keep new ones from being introduced. Both have been in linux-next with no reported issues" * tag 'driver-core-5.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: Documentation: driver core: remove use of BUS_ATTR sysfs: convert BUG_ON to WARN_ON commit f7c1038bc7597af5d6809c5b3e0352627cef5c07 Merge: 437e878a6c48 06382deac2b8 Author: Linus Torvalds Date: Mon Jan 14 05:49:35 2019 +1200 Merge tag 'staging-5.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fixes from Greg KH: "Here are some small staging driver fixes for some reported issues. One reverts a patch that was made to the rtl8723bs driver that turned out to not be needed at all as it was a bug in clang. The others fix up some reported issues in the rtl8188eu driver and update the MAINTAINERS file to point to Larry for this driver so he can get the bug reports easier. All have been in linux-next with no reported issues" * tag 'staging-5.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: Revert "staging: rtl8723bs: Mark ACPI table declaration as used" staging: rtl8188eu: Fix module loading from tasklet for WEP encryption staging: rtl8188eu: Fix module loading from tasklet for CCMP encryption MAINTAINERS: Add entry for staging driver r8188eu commit 437e878a6c48028273e4b06be7e09d235b189e62 Merge: 1dd8a3f6c619 d3736d82e816 Author: Linus Torvalds Date: Mon Jan 14 05:47:48 2019 +1200 Merge tag 'tty-5.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial fixes from Greg KH: "Here are 2 tty and serial fixes for 5.0-rc2 that resolve some reported issues. The first is a simple serial driver fix for a regression that showed up in 5.0-rc1. The second one resolves a number of reported issues with the recent tty locking fixes that went into 5.0-rc1. Lots of people have tested the second one and say it resolves their issues. Both have been in linux-next with no reported issues" * tag 'tty-5.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: tty: Don't hold ldisc lock in tty_reopen() if ldisc present serial: lantiq: Do not swap register read/writes commit 1dd8a3f6c619723ab442d6a27247d2f2153f3b11 Merge: 0f9d140a5665 b9fcb0e6b705 Author: Linus Torvalds Date: Mon Jan 14 05:45:28 2019 +1200 Merge tag 'usb-5.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some small USB driver fixes and quirk updates for 5.0-rc2. The majority here are some quirks for some storage devices to get them to work properly. There's also a fix here to resolve the reported issues with some audio devices that say they are UAC3 compliant, but really are not. And a fix up for the MAINTAINERS file to remove a dead url. All have been in linux-next with no reported issues" * tag 'usb-5.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: storage: Remove outdated URL from MAINTAINERS USB: Add USB_QUIRK_DELAY_CTRL_MSG quirk for Corsair K70 RGB usbcore: Select only first configuration for non-UAC3 compliant devices USB: storage: add quirk for SMI SM3350 USB: storage: don't insert sane sense for SPC3+ when bad sense specified usb: cdc-acm: send ZLP for Telit 3G Intel based modems commit 0f9d140a566532175b4555401ee47ed58b01f9c9 Merge: e1706720408e 48d2ba625701 Author: Linus Torvalds Date: Mon Jan 14 05:43:40 2019 +1200 Merge tag '5.0-rc1-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs fixes from Steve French: "A set of cifs/smb3 fixes, 4 for stable, most from Pavel. His patches fix an important set of crediting (flow control) problems, and also two problems in cifs_writepages, ddressing some large i/o and also compounding issues" * tag '5.0-rc1-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: update internal module version number CIFS: Fix error paths in writeback code CIFS: Move credit processing to mid callbacks for SMB3 CIFS: Fix credits calculation for cancelled requests cifs: Fix potential OOB access of lock element array cifs: Limit memory used by lock request calls to a page cifs: move large array from stack to heap CIFS: Do not hide EINTR after sending network packets CIFS: Fix credit computation for compounded requests CIFS: Do not set credits to 1 if the server didn't grant anything CIFS: Fix adjustment of credits for MTU requests cifs: Fix a tiny potential memory leak cifs: Fix a debug message commit f7ee8ead151f9d0b8dac6ab6c3ff49bbe809c564 Author: Tomas Winkler Date: Sun Jan 13 14:24:48 2019 +0200 mei: me: add denverton innovation engine device IDs Add the Denverton innovation engine (IE) device ids. The IE is an ME-like device which provides HW security offloading. Cc: Signed-off-by: Tomas Winkler Signed-off-by: Alexander Usyskin Signed-off-by: Greg Kroah-Hartman drivers/misc/mei/hw-me-regs.h | 2 ++ drivers/misc/mei/pci-me.c | 2 ++ 2 files changed, 4 insertions(+) commit 173436ba800d01178a8b19e5de4a8cb02c0db760 Author: Alexander Usyskin Date: Sun Jan 13 14:24:47 2019 +0200 mei: me: mark LBG devices as having dma support The LBG server platform sports DMA support. Cc: #v5.0+ Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman drivers/misc/mei/pci-me.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 82e59cbe5fdc0d521f9037861af21af6d5814afd Author: Tomas Winkler Date: Sun Jan 13 14:24:46 2019 +0200 mei: dma: silent the reject message Not all FW versions support DMA on their first release, hence it is normal behavior to receive a reject response upon DMA setup request. In order to prevent confusion, the DMA setup reject message is printed only in debug level. Cc: #v5.0+ Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman drivers/misc/mei/hbm.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) commit 465612178b44840b2066e62c3bcfae80862011d4 Merge: 56acb3ef7617 d0c2d2101b4c Author: Olof Johansson Date: Sat Jan 12 22:06:54 2019 -0800 Merge tag 'reset-for-5.0-rc2' of git://git.pengutronix.de/git/pza/linux into fixes Late reset controller changes for v5.0 This adds missing deassert functionality to the ARC HSDK reset driver, fixes some indentation and grammar issues in the kernel docs, adds a helper to count the number of resets on a device for the non-DT case as well, adds an early reset driver for SoCFPGA and simple reset driver support for Stratix10, and generalizes the uniphier USB3 glue layer reset to also cover AHCI. * tag 'reset-for-5.0-rc2' of git://git.pengutronix.de/git/pza/linux: reset: uniphier-glue: Add AHCI reset control support in glue layer dt-bindings: reset: uniphier: Add AHCI core reset description reset: uniphier-usb3: Rename to reset-uniphier-glue dt-bindings: reset: uniphier: Replace the expression of USB3 with generic peripherals ARM: socfpga: dts: document "altr,stratix10-rst-mgr" binding reset: socfpga: add an early reset driver for SoCFPGA reset: fix null pointer dereference on dev by dev_name reset: Add reset_control_get_count() reset: Improve reset controller kernel docs ARC: HSDK: improve reset driver Signed-off-by: Olof Johansson commit 56acb3ef76177a5aabe6613bf27348d34f1e65c0 Merge: 2ec472edcd72 b5f034845e70 Author: Olof Johansson Date: Sat Jan 12 22:03:59 2019 -0800 Merge tag 'mvebu-fixes-5.0-1' of git://git.infradead.org/linux-mvebu into fixes mvebu fixes for 5.0 They are all device tree fixes which also worth being in stable: - Reserve PSCI area on Armada 7K/8K preventing the kernel accessing this area and crashing while doing it. - Use correct PCIe reset signal on MACCHIATOBin (Armada 8040 based) - Fix polarity of GPIO fan line D-Link DNS NASes(kikwood based) * tag 'mvebu-fixes-5.0-1' of git://git.infradead.org/linux-mvebu: ARM: dts: kirkwood: Fix polarity of GPIO fan lines arm64: dts: marvell: mcbin: fix PCIe reset signal arm64: dts: marvell: armada-ap806: reserve PSCI area Signed-off-by: Olof Johansson commit 2ec472edcd72947b031ec998d646dd7a6be958dd Merge: 431a8b73de58 21face6f0d4d Author: Olof Johansson Date: Sat Jan 12 22:03:18 2019 -0800 Merge tag 'integrator-fixes-armsoc' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-integrator into fixes Fixes for the Integrator: - Handle failed allocations in the IM/PC bus attachment. - Use struct_size() for allocation. * tag 'integrator-fixes-armsoc' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-integrator: ARM: integrator: impd1: use struct_size() in devm_kzalloc() gpio: pl061: handle failed allocations Signed-off-by: Olof Johansson commit 431a8b73de58448227515767c757cb6731ab5854 Merge: f4f8aa6de35a 19a220dd1e8a Author: Olof Johansson Date: Sat Jan 12 22:02:28 2019 -0800 Merge tag 'amlogic-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-amlogic into fixes Amlogic DT fixes for v5.0-rc - arm64: defconfig: enable modules for amlogic s400 sound card * tag 'amlogic-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-amlogic: arm64: defconfig: enable modules for amlogic s400 sound card Signed-off-by: Olof Johansson commit f4f8aa6de35a86c2207fca0f4c48542ce4ef9e14 Merge: 98a5f673119b 2076607a20bd Author: Olof Johansson Date: Sat Jan 12 22:01:49 2019 -0800 Merge tag 'qcom-fixes-for-5.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/agross/linux into fixes Qualcomm Driver Fixes for 5.0-rc1 * Add required includes into qcom_scm.h * tag 'qcom-fixes-for-5.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/agross/linux: qcom-scm: Include header Signed-off-by: Olof Johansson commit 98a5f673119b918272894fe3fecf5136fe786e13 Merge: 70bf439a9492 c25748acc5c2 Author: Olof Johansson Date: Sat Jan 12 22:00:36 2019 -0800 Merge tag 'davinci-fixes-for-v5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/nsekhar/linux-davinci into fixes This pull request fixes some more regressions on legacy DaVinci board support due to GPIO driver clean-up introduced in v4.20 kernel. These are marked for stable. Also has fixes for some long standing Audio issues on DA850 boards. * tag 'davinci-fixes-for-v5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/nsekhar/linux-davinci: ARM: dts: da850-lcdk: Correct the sound card name ARM: dts: da850-lcdk: Correct the audio codec regulators ARM: dts: da850-evm: Correct the sound card name ARM: dts: da850-evm: Correct the audio codec regulators ARM: davinci: omapl138-hawk: fix label names in GPIO lookup entries ARM: davinci: dm644x-evm: fix label names in GPIO lookup entries ARM: davinci: dm355-evm: fix label names in GPIO lookup entries ARM: davinci: da850-evm: fix label names in GPIO lookup entries ARM: davinci: da830-evm: fix label names in GPIO lookup entries Signed-off-by: Olof Johansson commit 70bf439a9492e7687bf2b9e8576f609160b21200 Merge: bfeffd155283 a64597227d0d Author: Olof Johansson Date: Sat Jan 12 21:59:42 2019 -0800 Merge tag 'renesas-fixes-for-v5.0' of https://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas into fixes Renesas ARM Based SoC Fixes for v5.0 Renesas SoCs: * Fix build regressions caused by move of Kconfig symbols RZ/G2E (r8a774c0) SoC: * Correct initialization order of 3DG-{A,B} in SYSC driver * tag 'renesas-fixes-for-v5.0' of https://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas: soc: renesas: r8a774c0-sysc: Fix initialization order of 3DG-{A,B} ARM: shmobile: fix build regressions Signed-off-by: Olof Johansson commit e1706720408e72fb883f6b151c2b3b23d8e7e5b2 Author: John Hubbard Date: Sat Jan 12 17:29:09 2019 -0800 phy: fix build breakage: add PHY_MODE_SATA Commit 49e54187ae0b ("ata: libahci_platform: comply to PHY framework") uses the PHY_MODE_SATA, but that enum had not yet been added. This caused a build failure for me, with today's linux.git. Also, there is a potentially conflicting (mis-named) PHY_MODE_SATA, hiding in the Marvell Berlin SATA PHY driver. Fix the build by: 1) Renaming Marvell's defined value to a more scoped name, in order to avoid any potential conflicts: PHY_BERLIN_MODE_SATA. 2) Adding the missing enum, which was going to be added anyway as part of [1]. [1] https://lkml.kernel.org/r/20190108163124.6409-3-miquel.raynal@bootlin.com Fixes: 49e54187ae0b ("ata: libahci_platform: comply to PHY framework") Signed-off-by: John Hubbard Acked-by: Jens Axboe Acked-by: Olof Johansson Cc: Grzegorz Jaszczyk Cc: Miquel Raynal Cc: Hans de Goede Signed-off-by: Linus Torvalds drivers/phy/marvell/phy-berlin-sata.c | 5 +++-- include/linux/phy/phy.h | 1 + 2 files changed, 4 insertions(+), 2 deletions(-) commit ba0f4560526ba19300c07ed5a3c1df7592815dc6 Author: Anson Huang Date: Sat Dec 29 10:01:18 2018 +0000 ARM: dts: imx6sx: correct backward compatible of gpt i.MX6SX has same GPT type as i.MX6DL, in GPT driver, it uses below TIMER_OF_DECLARE, so the backward compatible should be "fsl,imx6dl-gpt", correct it. TIMER_OF_DECLARE(imx6sx_timer, "fsl,imx6sx-gpt", imx6dl_timer_init_dt); Signed-off-by: Anson Huang Signed-off-by: Shawn Guo arch/arm/boot/dts/imx6sx.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b8c3b8992ff2827482ac1543f84f5024a72c4f2e Merge: 66c56cfa64d9 bde0b5c109e8 Author: Linus Torvalds Date: Sat Jan 12 13:40:51 2019 -0800 Merge tag 'for-linus-20190112' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: - NVMe pull request from Christoph, with little fixes all over the map - Loop caching fix for offset/bs change (Jaegeuk Kim) - Block documentation tweaks (Jeff, Jon, Weiping, John) - null_blk zoned tweak (John) - ahch mvebu suspend/resume support. Should have gone into the merge window, but there was some confusion on which tree had it. (Miquel) * tag 'for-linus-20190112' of git://git.kernel.dk/linux-block: (22 commits) ata: ahci: mvebu: request PHY suspend/resume for Armada 3700 ata: ahci: mvebu: add Armada 3700 initialization needed for S2RAM ata: ahci: mvebu: do Armada 38x configuration only on relevant SoCs ata: ahci: mvebu: remove stale comment ata: libahci_platform: comply to PHY framework loop: drop caches if offset or block_size are changed block: fix kerneldoc comment for blk_attempt_plug_merge() nvme: don't initlialize ctrl->cntlid twice nvme: introduce NVME_QUIRK_IGNORE_DEV_SUBNQN nvme: pad fake subsys NQN vid and ssvid with zeros nvme-multipath: zero out ANA log buffer nvme-fabrics: unset write/poll queues for discovery controllers nvme-tcp: don't ask if controller is fabrics nvme-tcp: remove dead code nvme-pci: fix out of bounds access in nvme_cqe_pending nvme-pci: rerun irq setup on IO queue init errors nvme-pci: use the same attributes when freeing host_mem_desc_bufs. nvme-pci: fix the wrong setting of nr_maps block: doc: add slice_idle_us to bfq documentation block: clarify documentation for blk_{start|finish}_plug ... commit 66c56cfa64d9dbb9efa8a06c1aece77e8d57ea19 Merge: 473348891c36 dfd32cad146e Author: Linus Torvalds Date: Sat Jan 12 10:52:40 2019 -0800 Merge tag 'remove-dma_zalloc_coherent-5.0' of git://git.infradead.org/users/hch/dma-mapping Pull dma_zalloc_coherent() removal from Christoph Hellwig: "We've always had a weird situation around dma_zalloc_coherent. To safely support mapping the allocations to userspace major architectures like x86 and arm have always zeroed allocations from dma_alloc_coherent, but a couple other architectures were missing that zeroing either always or in corner cases. Then later we grew anothe dma_zalloc_coherent interface to explicitly request zeroing, but that just added __GFP_ZERO to the allocation flags, which for some allocators that didn't end up using the page allocator ended up being a no-op and still not zeroing the allocations. So for this merge window I fixed up all remaining architectures to zero the memory in dma_alloc_coherent, and made dma_zalloc_coherent a no-op wrapper around dma_alloc_coherent, which fixes all of the above issues. dma_zalloc_coherent is now pointless and can go away, and Luis helped me writing a cocchinelle script and patch series to kill it, which I think we should apply now just after -rc1 to finally settle these issue" * tag 'remove-dma_zalloc_coherent-5.0' of git://git.infradead.org/users/hch/dma-mapping: dma-mapping: remove dma_zalloc_coherent() cross-tree: phase out dma_zalloc_coherent() on headers cross-tree: phase out dma_zalloc_coherent() commit 2f960bd0564081ff85d2eea54890b0d2356934f8 Merge: 8d008e64a2eb 6ef982dec7ed Author: David S. Miller Date: Sat Jan 12 10:51:39 2019 -0800 Merge branch 'bnxt_en-Bug-fixes-for-57500-chips' Michael Chan says: ==================== bnxt_en: Bug fixes for 57500 chips. Two small bug fixes for ring checking and context memory allocation that affect the new 57500 chips. ==================== Signed-off-by: David S. Miller commit 6ef982dec7eda9affa81a2bb84f75441deb56d06 Author: Michael Chan Date: Sat Jan 12 00:13:05 2019 -0500 bnxt_en: Fix context memory allocation. When allocating memory pages for context memory, if the last page table should be fully populated, the current code will set nr_pages to 0 when calling bnxt_alloc_ctx_mem_blk(). This will cause the last page table to be completely blank and causing some RDMA failures. Fix it by setting the last page table's nr_pages to the remainder only if it is non-zero. Fixes: 08fe9d181606 ("bnxt_en: Add Level 2 context memory paging support.") Reported-by: Eric Davis Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 0b815023a1d479aa8f8851ee880d5388e53b7ae5 Author: Michael Chan Date: Sat Jan 12 00:13:04 2019 -0500 bnxt_en: Fix ring checking logic on 57500 chips. In bnxt_hwrm_check_pf_rings(), add the proper flag to test the NQ resources. Without the proper flag, the firmware will change the NQ resource allocation and remap the IRQ, causing missing IRQs. This issue shows up when adding MQPRIO TX queues, for example. Fixes: 36d65be9a880 ("bnxt_en: Disable MSIX before re-reserving NQs/CMPL rings.") Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 ++- drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h | 5 +++-- 2 files changed, 5 insertions(+), 3 deletions(-) commit 473348891c36ff6de3e224fefa0b3fc86a629178 Merge: 7b5c8f5226bd 826c1362e79a Author: Linus Torvalds Date: Sat Jan 12 10:39:43 2019 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM fixes from Radim Krčmář: "Minor fixes for new code, corner cases, and documentation" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: x86/kvm/nVMX: don't skip emulated instruction twice when vmptr address is not backed Documentation/virtual/kvm: Update URL for AMD SEV API specification KVM/VMX: Avoid return error when flush tlb successfully in the hv_remote_flush_tlb_with_range() kvm: sev: Fail KVM_SEV_INIT if already initialized KVM: validate userspace input in kvm_clear_dirty_log_protect() KVM: x86: Fix bit shifting in update_intel_pt_cfg commit f214ff521fb1f861c8d7f7d0af98b06bf61b3369 Author: Dan Murphy Date: Fri Jan 11 13:57:07 2019 -0600 iio: ti-ads8688: Update buffer allocation for timestamps Per Jonathan Cameron, the buffer needs to allocate room for a 64 bit timestamp as well as the channels. Change the buffer to allocate this additional space. Fixes: 2a86487786b5c ("iio: adc: ti-ads8688: add trigger and buffer support") Signed-off-by: Dan Murphy Cc: Signed-off-by: Jonathan Cameron drivers/iio/adc/ti-ads8688.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 7b5c8f5226bd0eb77da8a055f43b2f1a06e92ba8 Merge: 4b3c31c8d4dd e2d3c414ec0f Author: Linus Torvalds Date: Sat Jan 12 10:30:43 2019 -0800 Merge tag 'drm-fixes-2019-01-11-1' of git://anongit.freedesktop.org/drm/drm Pull more drm fixes from Daniel Vetter: "Dave sends out his pull, everybody remembers holidays are over :-) Since Dave's already in weekend mode and it was quite a few patches I figured better to apply all the pulls and forward them to you. Hence here 2nd part of bugfixes for -rc2. nouveau: - backlight fix - falcon register access fix - fan fix. i915: - Disable PSR for Apple panels - Broxton ERR_PTR error state fix - Kabylake VECS workaround fix - Unwind failure on pinning the gen7 ppgtt - GVT workload request allocation fix core: - Fix fb-helper to work correctly with SDL 1.2 bugs - Fix lockdep warning in the atomic ioctl and setproperty" * tag 'drm-fixes-2019-01-11-1' of git://anongit.freedesktop.org/drm/drm: drm/nouveau/falcon: avoid touching registers if engine is off drm/nouveau: Don't disable polling in fallback mode drm/nouveau: register backlight on pascal and newer drm: Fix documentation generation for DP_DPCD_QUIRK_NO_PSR drm/i915: init per-engine WAs for all engines drm/i915: Unwind failure on pinning the gen7 ppgtt drm/i915: Skip the ERR_PTR error state drm/i915: Disable PSR in Apple panels gpu/drm: Fix lock held when returning to user space. drm/fb-helper: Ignore the value of fb_var_screeninfo.pixclock drm/fb-helper: Partially bring back workaround for bugs of SDL 1.2 drm/i915/gvt: Fix workload request allocation before request add commit b119d3bc328e7a9574861ebe0c2110e2776c2de1 Author: Martin Kelly Date: Fri Jan 11 23:13:09 2019 +0000 tools: iio: iio_generic_buffer: make num_loops signed Currently, num_loops is unsigned, but it's set by strtoll, which returns a (signed) long long int. This could lead to overflow, and it also makes the check "num_loops < 0" always be false, since num_loops is unsigned. Setting num_loops to -1 to loop forever is almost working because num_loops is getting set to a very high number, but it's technically still incorrect. Fix this issue by making num_loops signed. This also fixes an error found by Smatch. Signed-off-by: Martin Kelly Reported-by: Dan Carpenter Fixes: 55dda0abcf9d ("tools: iio: iio_generic_buffer: allow continuous looping") Cc: Signed-off-by: Jonathan Cameron tools/iio/iio_generic_buffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ee17e5d6201c66492a0e8053190fca2ed2b8457d Author: Eric W. Biederman Date: Sat Jan 12 11:48:20 2019 -0600 signal: Make siginmask safe when passed a signal of 0 Eric Biggers reported: > The following commit, which went into v4.20, introduced undefined behavior when > sys_rt_sigqueueinfo() is called with sig=0: > > commit 4ce5f9c9e7546915c559ffae594e6d73f918db00 > Author: Eric W. Biederman > Date: Tue Sep 25 12:59:31 2018 +0200 > > signal: Use a smaller struct siginfo in the kernel > > In sig_specific_sicodes(), used from known_siginfo_layout(), the expression > '1ULL << ((sig)-1)' is undefined as it evaluates to 1ULL << 4294967295. > > Reproducer: > > #include > #include > #include > > int main(void) > { > siginfo_t si = { .si_code = 1 }; > syscall(__NR_rt_sigqueueinfo, 0, 0, &si); > } > > UBSAN report for v5.0-rc1: > > UBSAN: Undefined behaviour in kernel/signal.c:2946:7 > shift exponent 4294967295 is too large for 64-bit type 'long unsigned int' > CPU: 2 PID: 346 Comm: syz_signal Not tainted 5.0.0-rc1 #25 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 > Call Trace: > __dump_stack lib/dump_stack.c:77 [inline] > dump_stack+0x70/0xa5 lib/dump_stack.c:113 > ubsan_epilogue+0xd/0x40 lib/ubsan.c:159 > __ubsan_handle_shift_out_of_bounds+0x12c/0x170 lib/ubsan.c:425 > known_siginfo_layout+0xae/0xe0 kernel/signal.c:2946 > post_copy_siginfo_from_user kernel/signal.c:3009 [inline] > __copy_siginfo_from_user+0x35/0x60 kernel/signal.c:3035 > __do_sys_rt_sigqueueinfo kernel/signal.c:3553 [inline] > __se_sys_rt_sigqueueinfo kernel/signal.c:3549 [inline] > __x64_sys_rt_sigqueueinfo+0x31/0x70 kernel/signal.c:3549 > do_syscall_64+0x4c/0x1b0 arch/x86/entry/common.c:290 > entry_SYSCALL_64_after_hwframe+0x49/0xbe > RIP: 0033:0x433639 > Code: c4 18 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 27 00 00 c3 66 2e 0f 1f 84 00 00 00 00 > RSP: 002b:00007fffcb289fc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000081 > RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 0000000000433639 > RDX: 00007fffcb289fd0 RSI: 0000000000000000 RDI: 0000000000000000 > RBP: 00000000006b2018 R08: 000000000000004d R09: 0000000000000000 > R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401560 > R13: 00000000004015f0 R14: 0000000000000000 R15: 0000000000000000 I have looked at the other callers of siginmask and they all appear to in locations where sig can not be zero. I have looked at the code generation of adding an extra test against zero and gcc was able with a simple decrement instruction to combine the two tests together. So the at most adding this test cost a single cpu cycle. In practice that decrement instruction was already present as part of the mask comparison, so the only change was when the instruction was executed. So given that it is cheap, and obviously correct to update siginmask to verify the signal is not zero. Fix this issue there to avoid any future problems. Reported-by: Eric Biggers Fixes: 4ce5f9c9e754 ("signal: Use a smaller struct siginfo in the kernel") Signed-off-by: "Eric W. Biederman" include/linux/signal.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9bcf15f75cac3c6a00d8f8083a635de9c8537799 Author: Hans de Goede Date: Sat Jan 5 19:36:18 2019 +0100 iio: adc: axp288: Fix TS-pin handling Prior to this commit there were 3 issues with our handling of the TS-pin: 1) There are 2 ways how the firmware can disable monitoring of the TS-pin for designs which do not have a temperature-sensor for the battery: a) Clearing bit 0 of the AXP20X_ADC_EN1 register b) Setting bit 2 of the AXP288_ADC_TS_PIN_CTRL monitoring Prior to this commit we were unconditionally setting both bits to the value used on devices with a TS. This causes the temperature protection to kick in on devices without a TS, such as the Jumper ezbook v2, causing them to not charge under Linux. This commit fixes this by using regmap_update_bits when updating these 2 registers, leaving the 2 mentioned bits alone. The next 2 problems are related to our handling of the current-source for the TS-pin. The current-source used for the battery temp-sensor (TS) is shared with the GPADC. For proper fuel-gauge and charger operation the TS current-source needs to be permanently on. But to read the GPADC we need to temporary switch the TS current-source to ondemand, so that the GPADC can use it, otherwise we will always read an all 0 value. 2) Problem 2 is we were writing hardcoded values to the ADC TS pin-ctrl register, overwriting various other unrelated bits. Specifically we were overwriting the current-source setting for the TS and GPIO0 pins, forcing it to 80ųA independent of its original setting. On a Chuwi Vi10 tablet this was causing us to get a too high adc value (due to a too high current-source) resulting in the following errors being logged: ACPI Error: AE_ERROR, Returned by Handler for [UserDefinedRegion] ACPI Error: Method parse/execution failed \_SB.SXP1._TMP, AE_ERROR This commit fixes this by using regmap_update_bits to change only the relevant bits. 3) After reading the GPADC channel we were unconditionally enabling the TS current-source even on devices where the TS-pin is not used and the current-source thus was off before axp288_adc_read_raw call. This commit fixes this by making axp288_adc_set_ts a nop on devices where the ADC is not enabled for the TS-pin. BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1610545 Fixes: 3091141d7803 ("iio: adc: axp288: Fix the GPADC pin ...") Signed-off-by: Hans de Goede Cc: Signed-off-by: Jonathan Cameron drivers/iio/adc/axp288_adc.c | 76 ++++++++++++++++++++++++++++++++++---------- 1 file changed, 60 insertions(+), 16 deletions(-) commit 0808831dc62e90023ad14ff8da4804c7846e904b Author: Matt Ranostay Date: Sun Dec 30 19:07:01 2018 -0800 iio: chemical: atlas-ph-sensor: correct IIO_TEMP values to millicelsius IIO_TEMP scale value for temperature was incorrect and not in millicelsius as required by the ABI documentation. Signed-off-by: Matt Ranostay Fixes: 27dec00ecf2d (iio: chemical: add Atlas pH-SM sensor support) Cc: Signed-off-by: Jonathan Cameron drivers/iio/chemical/atlas-ph-sensor.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit 7fefaadd6a962987baac50e7b3c4c3d5ef9b55c6 Author: Christian Brauner Date: Sat Jan 12 01:06:03 2019 +0100 binderfs: handle !CONFIG_IPC_NS builds kbuild reported a build faile in [1]. This is triggered when CONFIG_IPC_NS is not set. So let's make the use of init_ipc_ns conditional on CONFIG_IPC_NS being set. [1]: https://lists.01.org/pipermail/kbuild-all/2019-January/056903.html Signed-off-by: Christian Brauner Signed-off-by: Greg Kroah-Hartman drivers/android/binderfs.c | 4 ++++ 1 file changed, 4 insertions(+) commit 9e8f1c79831424d30c0e3df068be7f4a244157c9 Author: Varun Prakash Date: Thu Jan 10 23:29:28 2019 +0530 scsi: cxgb4i: add wait_for_completion() In case of ->set_param() and ->bind_conn() cxgb4i driver does not wait for cmd completion, this can create race conditions, to avoid this add wait_for_completion(). Signed-off-by: Varun Prakash Signed-off-by: Martin K. Petersen drivers/scsi/cxgbi/cxgb3i/cxgb3i.c | 9 ++++----- drivers/scsi/cxgbi/cxgb4i/cxgb4i.c | 28 ++++++++++++++++++++-------- drivers/scsi/cxgbi/libcxgbi.c | 7 ++++--- drivers/scsi/cxgbi/libcxgbi.h | 5 +++-- 4 files changed, 31 insertions(+), 18 deletions(-) commit 4a01ab60f55041b1ccc760e43258a5b3aeeca1bc Author: Thomas Bogendoerfer Date: Wed Jan 9 15:09:02 2019 +0100 scsi: qla1280: set 64bit coherent mask After Commit 54aed4dd3526 ("MIPS: IP27: use dma_direct_ops") qla1280 driver failed on SGI IP27 machines with qla1280: QLA1040 found on PCI bus 0, dev 0 qla1280 0000:00:00.0: enabling device (0006 -> 0007) qla1280: Failed to get request memory qla1280: probe of 0000:00:00.0 failed with error -12 Reason is that SGI IP27 always generates 64bit DMA addresses and has no fallback mode for 32bit DMA addresses implemented. QLA1280 supports 64bit addressing for all DMA accesses so setting coherent mask to 64bit fixes the issue. Signed-off-by: Thomas Bogendoerfer Signed-off-by: Martin K. Petersen drivers/scsi/qla1280.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9be9db9f78f52ef03ee90063730cb9d730e7032b Author: Avri Altman Date: Thu Jan 10 13:31:26 2019 +0200 scsi: ufs: Fix geometry descriptor size Albeit we no longer rely on those hard-coded descriptor sizes, we still use them as our defaults, so better get it right. While adding its sysfs entries, we forgot to update the geometry descriptor size. It is 0x48 according to UFS2.1, and wasn't changed in UFS3.0. [mkp: typo] Fixes: c720c091222e (scsi: ufs: sysfs: geometry descriptor) Signed-off-by: Avri Altman Signed-off-by: Martin K. Petersen drivers/scsi/ufs/ufs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c65bfc8163696dd171e081488b0321beb630b708 Author: Shivasharan S Date: Wed Jan 9 05:08:37 2019 -0800 scsi: megaraid_sas: Retry reads of outbound_intr_status reg commit 272652fcbf1a ("scsi: megaraid_sas: add retry logic in megasas_readl") missed changing readl to megasas_readl in megasas_clear_intr_fusion(). For Aero controllers, reads of outbound_intr_status register needs to be retried. Reported-by: Tomas Henzl Signed-off-by: Shivasharan S Signed-off-by: Martin K. Petersen drivers/scsi/megaraid/megaraid_sas_fusion.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 34a2ce887668db9dda4b56e6f155c49ac13f3e54 Author: Manish Rangankar Date: Wed Jan 9 01:39:07 2019 -0800 scsi: qedi: Add ep_state for login completion on un-reachable targets When the driver finds invalid destination MAC for the first un-reachable target, and before completes the PATH_REQ operation, set new ep_state to OFFLDCONN_NONE so that as part of driver ep_poll mechanism, the upper open-iscsi layer is notified to complete the login process on the first un-reachable target and thus proceed login to other reachable targets. Signed-off-by: Manish Rangankar Signed-off-by: Martin K. Petersen drivers/scsi/qedi/qedi_iscsi.c | 3 +++ drivers/scsi/qedi/qedi_iscsi.h | 1 + 2 files changed, 4 insertions(+) commit ce9e7bce43526626f7cffe2e657953997870197e Author: Stanley Chu Date: Mon Jan 7 22:19:34 2019 +0800 scsi: ufs: Fix system suspend status hba->is_sys_suspended is set after successful system suspend but not clear after successful system resume. According to current behavior, hba->is_sys_suspended will not be set if host is runtime-suspended but not system-suspended. Thus we shall aligh the same policy: clear this flag even if host remains runtime-suspended after ufshcd_system_resume is successfully returned. Simply fix this flag to correct host status logs. Signed-off-by: Stanley Chu Reviewed-by: Avri Altman Signed-off-by: Martin K. Petersen drivers/scsi/ufs/ufshcd.c | 2 ++ 1 file changed, 2 insertions(+) commit f0783d43dde4bb349fcd667df0afabbdbab8b477 Author: Ming Lei Date: Fri Jan 11 09:40:47 2019 -0800 scsi: qla2xxx: Use correct number of vectors for online CPUs When SCSI-MQ is enabled, in some case system would present nr_possible_cpus() which is greater than requested vectors by the driver. This results into driver being able to get larger number of MSI-X vectors than actual online CPUs. Driver then uses pci_alloc_irq_vectors_affinity() to assign 1:1 mapping and affinity for each MSI-x vector to CPUs. When the command is submitted using MSI-x vector, assigned to offline CPU, it results in an ABTS and system hang. This hang is result of a driver not being able to process interrupt on a vector assigned to an Off-line CPUs This patch fixes this issue by setting irq_offset value for the blk_mq_pci_map_queues() to use only those CPUs which has CPU mask affinity assigned and are online. By using the irq_offset value, driver will allow online cpumask to decide which vectors are used in blk_mq_pci_map_queues(). Fixes: 5601236b6f794 ("scsi: qla2xxx: Add Block Multi Queue functionality.") Cc: #4.19 Signed-off-by: Ming Lei Reviewed-by: Himanshu Madhani Tested-by: Himanshu Madhani Reviewed-by: Ewan D. Milne Signed-off-by: Himanshu Madhani Signed-off-by: Martin K. Petersen drivers/scsi/qla2xxx/qla_def.h | 2 ++ drivers/scsi/qla2xxx/qla_isr.c | 1 + drivers/scsi/qla2xxx/qla_os.c | 2 +- 3 files changed, 4 insertions(+), 1 deletion(-) commit 8d008e64a2ebe6567c3f5e048b05842a0297350b Author: Gustavo A. R. Silva Date: Tue Jan 8 15:27:05 2019 -0600 mISDN: hfcsusb: Use struct_size() in kzalloc() One of the more common cases of allocation size calculations is finding the size of a structure that has a zero-sized array at the end, along with memory for some number of elements for that array. For example: struct foo { int stuff; void *entry[]; }; instance = kzalloc(sizeof(struct foo) + sizeof(void *) * count, GFP_KERNEL); Instead of leaving these open-coded and prone to type mistakes, we can now use the new struct_size() helper: instance = kzalloc(struct_size(instance, entry, count), GFP_KERNEL); This code was detected with the help of Coccinelle. Signed-off-by: Gustavo A. R. Silva Signed-off-by: David S. Miller drivers/isdn/hardware/mISDN/hfcsusb.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 08b88e80a1f476970284235278bf27a273b94118 Author: Sudeep Holla Date: Fri Dec 21 18:12:03 2018 +0000 ARM: dts: imx: replace gpio-key,wakeup with wakeup-source property Most of the legacy "gpio-key,wakeup" and "enable-sdio-wakeup" boolean properties are already replaced with "wakeup-source". However few occurrences of old property has popped up again, probably from the remnants in downstream trees. Almost all of those were remove couple of years back. Replace the legacy properties with the unified "wakeup-source" property introduced in the commit 700a38b27eef ("Input: gpio_keys - switch to using generic device properties") and commit 0dbcdc0622ea ("mmc: core: enable support for the standard "wakeup-source" property") Cc: Fabio Estevam Cc: Shawn Guo Cc: NXP Linux Team Signed-off-by: Sudeep Holla Signed-off-by: Shawn Guo arch/arm/boot/dts/imx6q-pistachio.dts | 2 +- arch/arm/boot/dts/imx6sll-evk.dts | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 7bb25a89aad2cc96de188c9ecc89a175360f6fb4 Author: John Garry Date: Thu Jan 10 21:32:41 2019 +0800 scsi: hisi_sas: Set protection parameters prior to adding SCSI host Currently we set the protection parameters after calling scsi_add_host() for v3 hw. They should be set beforehand, so make this change. Appearantly this fixes our DIX issue (not mainline yet) also, but more testing required. Fixes: d6a9000b81be ("scsi: hisi_sas: Add support for DIF feature for v2 hw") Signed-off-by: John Garry Signed-off-by: Martin K. Petersen drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 41d1c8839e5f8cb781cc635f12791decee8271b7 Author: Paolo Abeni Date: Tue Jan 8 18:45:05 2019 +0100 net: clear skb->tstamp in bridge forwarding path Matteo reported forwarding issues inside the linux bridge, if the enslaved interfaces use the fq qdisc. Similar to commit 8203e2d844d3 ("net: clear skb->tstamp in forwarding paths"), we need to clear the tstamp field in the bridge forwarding path. Fixes: 80b14dee2bea ("net: Add a new socket option for a future transmit time.") Fixes: fb420d5d91c1 ("tcp/fq: move back to CLOCK_MONOTONIC") Reported-and-tested-by: Matteo Croce Signed-off-by: Paolo Abeni Acked-by: Nikolay Aleksandrov Acked-by: Roopa Prabhu Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller net/bridge/br_forward.c | 1 + 1 file changed, 1 insertion(+) commit 3f4261d4e62fb2fe7eb5238b12fb22f06aed6e21 Merge: 2ff33d663739 71a8508402b5 Author: David S. Miller Date: Fri Jan 11 18:05:41 2019 -0800 Merge branch 'bpfilter-fixes' Taehee Yoo says: ==================== net: bpfilter: fix two bugs in bpfilter This patches fix two bugs in the bpfilter_umh which are related in iptables command. The first patch adds an exit code for UMH process. This provides an opportunity to cleanup members of the umh_info to modules which use the UMH. In order to identify UMH processes, a new flag PF_UMH is added. The second patch makes the bpfilter_umh use UMH cleanup callback. The third patch adds re-start routine for the bpfilter_umh. The bpfilter_umh does not re-start after error occurred. because there is no re-start routine in the module. The fourth patch ensures that the bpfilter.ko module will not removed while it's being used. The bpfilter.ko is not protected by locks or module reference counter. Therefore that can be removed while module is being used. In order to protect that, mutex is used. The first and second patch are preparation patches for the third and fourth patch. TEST #1 while : do modprobe bpfilter kill -9 iptables -vnL done TEST #2 while : do iptables -I FORWARD -m string --string ap --algo kmp & iptables -F & modprobe -rv bpfilter & done TEST #3 while : do modprobe bpfilter & modprobe -rv bpfilter & done The TEST1 makes a failure of iptables command. This is fixed by the third patch. The TEST2 makes a panic because of a race condition in the bpfilter_umh module. This is fixed by the fourth patch. The TEST3 makes a double-create UMH process. This is fixed by the third and fourth patch. v4 : - declare the exit_umh() as static inline - check stop flag in the load_umh() to avoid a double-create UMH v3 : - Avoid unnecessary list lookup for non-UMH processes - Add a new PF_UMH flag v2 : add the first and second patch v1 : Initial patch ==================== Signed-off-by: David S. Miller commit 71a8508402b570127d6500c1ad456bbd33ccf187 Author: Taehee Yoo Date: Wed Jan 9 02:25:10 2019 +0900 net: bpfilter: disallow to remove bpfilter module while being used The bpfilter.ko module can be removed while functions of the bpfilter.ko are executing. so panic can occurred. in order to protect that, locks can be used. a bpfilter_lock protects routines in the __bpfilter_process_sockopt() but it's not enough because __exit routine can be executed concurrently. Now, the bpfilter_umh can not run in parallel. So, the module do not removed while it's being used and it do not double-create UMH process. The members of the umh_info and the bpfilter_umh_ops are protected by the bpfilter_umh_ops.lock. test commands: while : do iptables -I FORWARD -m string --string ap --algo kmp & modprobe -rv bpfilter & done splat looks like: [ 298.623435] BUG: unable to handle kernel paging request at fffffbfff807440b [ 298.628512] #PF error: [normal kernel read fault] [ 298.633018] PGD 124327067 P4D 124327067 PUD 11c1a3067 PMD 119eb2067 PTE 0 [ 298.638859] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI [ 298.638859] CPU: 0 PID: 2997 Comm: iptables Not tainted 4.20.0+ #154 [ 298.638859] RIP: 0010:__mutex_lock+0x6b9/0x16a0 [ 298.638859] Code: c0 00 00 e8 89 82 ff ff 80 bd 8f fc ff ff 00 0f 85 d9 05 00 00 48 8b 85 80 fc ff ff 48 bf 00 00 00 00 00 fc ff df 48 c1 e8 03 <80> 3c 38 00 0f 85 1d 0e 00 00 48 8b 85 c8 fc ff ff 49 39 47 58 c6 [ 298.638859] RSP: 0018:ffff88810e7777a0 EFLAGS: 00010202 [ 298.638859] RAX: 1ffffffff807440b RBX: ffff888111bd4d80 RCX: 0000000000000000 [ 298.638859] RDX: 1ffff110235ff806 RSI: ffff888111bd5538 RDI: dffffc0000000000 [ 298.638859] RBP: ffff88810e777b30 R08: 0000000080000002 R09: 0000000000000000 [ 298.638859] R10: 0000000000000000 R11: 0000000000000000 R12: fffffbfff168a42c [ 298.638859] R13: ffff888111bd4d80 R14: ffff8881040e9a05 R15: ffffffffc03a2000 [ 298.638859] FS: 00007f39e3758700(0000) GS:ffff88811ae00000(0000) knlGS:0000000000000000 [ 298.638859] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 298.638859] CR2: fffffbfff807440b CR3: 000000011243e000 CR4: 00000000001006f0 [ 298.638859] Call Trace: [ 298.638859] ? mutex_lock_io_nested+0x1560/0x1560 [ 298.638859] ? kasan_kmalloc+0xa0/0xd0 [ 298.638859] ? kmem_cache_alloc+0x1c2/0x260 [ 298.638859] ? __alloc_file+0x92/0x3c0 [ 298.638859] ? alloc_empty_file+0x43/0x120 [ 298.638859] ? alloc_file_pseudo+0x220/0x330 [ 298.638859] ? sock_alloc_file+0x39/0x160 [ 298.638859] ? __sys_socket+0x113/0x1d0 [ 298.638859] ? __x64_sys_socket+0x6f/0xb0 [ 298.638859] ? do_syscall_64+0x138/0x560 [ 298.638859] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 298.638859] ? __alloc_file+0x92/0x3c0 [ 298.638859] ? init_object+0x6b/0x80 [ 298.638859] ? cyc2ns_read_end+0x10/0x10 [ 298.638859] ? cyc2ns_read_end+0x10/0x10 [ 298.638859] ? hlock_class+0x140/0x140 [ 298.638859] ? sched_clock_local+0xd4/0x140 [ 298.638859] ? sched_clock_local+0xd4/0x140 [ 298.638859] ? check_flags.part.37+0x440/0x440 [ 298.638859] ? __lock_acquire+0x4f90/0x4f90 [ 298.638859] ? set_rq_offline.part.89+0x140/0x140 [ ... ] Fixes: d2ba09c17a06 ("net: add skeleton of bpfilter kernel module") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller include/linux/bpfilter.h | 2 ++ net/bpfilter/bpfilter_kern.c | 28 +++++++++++----------------- net/ipv4/bpfilter/sockopt.c | 22 ++++++++++++++++------ 3 files changed, 29 insertions(+), 23 deletions(-) commit 61fbf5933d42b02f552123af5a87a06335a3b4db Author: Taehee Yoo Date: Wed Jan 9 02:24:53 2019 +0900 net: bpfilter: restart bpfilter_umh when error occurred The bpfilter_umh will be stopped via __stop_umh() when the bpfilter error occurred. The bpfilter_umh() couldn't start again because there is no restart routine. The section of the bpfilter_umh_{start/end} is no longer .init.rodata because these area should be reused in the restart routine. hence the section name is changed to .bpfilter_umh. The bpfilter_ops->start() is restart callback. it will be called when bpfilter_umh is stopped. The stop bit means bpfilter_umh is stopped. this bit is set by both start and stop routine. Before this patch, Test commands: $ iptables -vnL $ kill -9 $ iptables -vnL [ 480.045136] bpfilter: write fail -32 $ iptables -vnL All iptables commands will fail. After this patch, Test commands: $ iptables -vnL $ kill -9 $ iptables -vnL $ iptables -vnL Now, all iptables commands will work. Fixes: d2ba09c17a06 ("net: add skeleton of bpfilter kernel module") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller include/linux/bpfilter.h | 2 ++ net/bpfilter/bpfilter_kern.c | 37 +++++++++++++++++++++++++++---------- net/bpfilter/bpfilter_umh_blob.S | 2 +- net/ipv4/bpfilter/sockopt.c | 11 ++++++++++- 4 files changed, 40 insertions(+), 12 deletions(-) commit 5b4cb650e569db2e6a09d2fa0ef8eb789a0ac5d8 Author: Taehee Yoo Date: Wed Jan 9 02:24:34 2019 +0900 net: bpfilter: use cleanup callback to release umh_info Now, UMH process is killed, do_exit() calls the umh_info->cleanup callback to release members of the umh_info. This patch makes bpfilter_umh's cleanup routine to use the umh_info->cleanup callback. Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller include/linux/bpfilter.h | 11 ++++++++--- net/bpfilter/bpfilter_kern.c | 23 ++++++++++------------- net/ipv4/bpfilter/sockopt.c | 33 ++++++++++++++++++++++++++------- 3 files changed, 44 insertions(+), 23 deletions(-) commit 73ab1cb2de9e3efe7f818d5453de271e5371df1d Author: Taehee Yoo Date: Wed Jan 9 02:23:56 2019 +0900 umh: add exit routine for UMH process A UMH process which is created by the fork_usermode_blob() such as bpfilter needs to release members of the umh_info when process is terminated. But the do_exit() does not release members of the umh_info. hence module which uses UMH needs own code to detect whether UMH process is terminated or not. But this implementation needs extra code for checking the status of UMH process. it eventually makes the code more complex. The new PF_UMH flag is added and it is used to identify UMH processes. The exit_umh() does not release members of the umh_info. Hence umh_info->cleanup callback should release both members of the umh_info and the private data. Suggested-by: David S. Miller Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller include/linux/sched.h | 9 +++++++++ include/linux/umh.h | 2 ++ kernel/exit.c | 1 + kernel/umh.c | 33 +++++++++++++++++++++++++++++++-- 4 files changed, 43 insertions(+), 2 deletions(-) commit a94a2572b97744d3a35a1996df0e5cf6b2461a4a Author: Xiubo Li Date: Fri Nov 23 09:15:30 2018 +0800 scsi: tcmu: avoid cmd/qfull timers updated whenever a new cmd comes Currently there is one cmd timeout timer and one qfull timer for each udev, and whenever any new command is coming in we will update the cmd timer or qfull timer. For some corner cases the timers are always working only for the ringbuffer's and full queue's newest cmd. That's to say the timer won't be fired even if one cmd has been stuck for a very long time and the deadline is reached. This fix will keep the cmd/qfull timers to be pended for the oldest cmd in ringbuffer and full queue, and will update them with the next cmd's deadline only when the old cmd's deadline is reached or removed from the ringbuffer and full queue. Signed-off-by: Xiubo Li Acked-by: Mike Christie Signed-off-by: Martin K. Petersen drivers/target/target_core_user.c | 88 +++++++++++++++++++++++++++------------ 1 file changed, 61 insertions(+), 27 deletions(-) commit 2ff33d6637393fe9348357285931811b76e1402f Author: Jia-Ju Bai Date: Tue Jan 8 21:04:48 2019 +0800 isdn: i4l: isdn_tty: Fix some concurrency double-free bugs The functions isdn_tty_tiocmset() and isdn_tty_set_termios() may be concurrently executed. isdn_tty_tiocmset isdn_tty_modem_hup line 719: kfree(info->dtmf_state); line 721: kfree(info->silence_state); line 723: kfree(info->adpcms); line 725: kfree(info->adpcmr); isdn_tty_set_termios isdn_tty_modem_hup line 719: kfree(info->dtmf_state); line 721: kfree(info->silence_state); line 723: kfree(info->adpcms); line 725: kfree(info->adpcmr); Thus, some concurrency double-free bugs may occur. These possible bugs are found by a static tool written by myself and my manual code review. To fix these possible bugs, the mutex lock "modem_info_mutex" used in isdn_tty_tiocmset() is added in isdn_tty_set_termios(). Signed-off-by: Jia-Ju Bai Signed-off-by: David S. Miller drivers/isdn/i4l/isdn_tty.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 7fbe078c37aba3088359c9256c1a1d0c3e39ee81 Author: Zha Bin Date: Tue Jan 8 16:07:03 2019 +0800 vhost/vsock: fix vhost vsock cid hashing inconsistent The vsock core only supports 32bit CID, but the Virtio-vsock spec define CID (dst_cid and src_cid) as u64 and the upper 32bits is reserved as zero. This inconsistency causes one bug in vhost vsock driver. The scenarios is: 0. A hash table (vhost_vsock_hash) is used to map an CID to a vsock object. And hash_min() is used to compute the hash key. hash_min() is defined as: (sizeof(val) <= 4 ? hash_32(val, bits) : hash_long(val, bits)). That means the hash algorithm has dependency on the size of macro argument 'val'. 0. In function vhost_vsock_set_cid(), a 64bit CID is passed to hash_min() to compute the hash key when inserting a vsock object into the hash table. 0. In function vhost_vsock_get(), a 32bit CID is passed to hash_min() to compute the hash key when looking up a vsock for an CID. Because the different size of the CID, hash_min() returns different hash key, thus fails to look up the vsock object for an CID. To fix this bug, we keep CID as u64 in the IOCTLs and virtio message headers, but explicitly convert u64 to u32 when deal with the hash table and vsock core. Fixes: 834e772c8db0 ("vhost/vsock: fix use-after-free in network stack callers") Link: https://github.com/stefanha/virtio/blob/vsock/trunk/content.tex Signed-off-by: Zha Bin Reviewed-by: Liu Jiang Reviewed-by: Stefan Hajnoczi Acked-by: Jason Wang Signed-off-by: David S. Miller drivers/vhost/vsock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 00ccd4532c8a61e6c65ca62eb7b6da6a272c30f1 Author: Shawn Guo Date: Sat Jan 12 09:02:51 2019 +0800 ARM: dts: vf610-bk4: fix incorrect #address-cells for dspi3 The dspi3 is used as slave controller on vf610-bk4, and the default '#address-cells = <1>;' setting in vfxxx.dtsi causes the following DTC warning. DTC arch/arm/boot/dts/vf610-bk4.dtb ../arch/arm/boot/dts/vfxxx.dtsi:550.24-563.6: Warning (spi_bus_bridge): /soc/aips-bus@40080000/spi@400ad000: incorrect #address-cells for SPI bus also defined at ../arch/arm/boot/dts/vf610-bk4.dts:107.8-119.3 arch/arm/boot/dts/vf610-bk4.dtb: Warning (spi_bus_reg): Failed prerequisite 'spi_bus_bridge' For spi device used as slave controller, '#address-cells' should be 0. Let's overwrite the property in vf610-bk4.dts to fix the warning. Reported-by: Stephen Rothwell Signed-off-by: Shawn Guo arch/arm/boot/dts/vf610-bk4.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit c0a636e4cc2eb39244d23c0417c117be4c96a7fe Author: Dinh Nguyen Date: Mon Dec 17 18:06:14 2018 -0600 clk: socfpga: stratix10: fix rate calculation for pll clocks The main PLL calculation has a mistake. We should be using the multiplying the VCO frequency, not the parent clock frequency. Fixes: 07afb8db7340 ("clk: socfpga: stratix10: add clock driver for Stratix10 platform") Cc: linux-stable@vger.kernel.org Signed-off-by: Dinh Nguyen Signed-off-by: Stephen Boyd drivers/clk/socfpga/clk-pll-s10.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5fea7f1091d725bd0601c931f237fed210d37dad Merge: e8b108b050e8 fa0be0a43f10 Author: David S. Miller Date: Fri Jan 11 15:35:06 2019 -0800 Merge branch 'stmmac-fixes' Jose Abreu says: ==================== net: stmmac: Misc Fixes Some small fixes for stmmac targeting -net. Detailed info in commit log. ==================== Signed-off-by: David S. Miller commit fa0be0a43f101888ac677dba31b590963eafeaa1 Author: Jose Abreu Date: Wed Jan 9 10:06:00 2019 +0100 net: stmmac: Prevent RX starvation in stmmac_napi_poll() Currently, TX is given a budget which is consumed by stmmac_tx_clean() and stmmac_rx() is given the remaining non-consumed budget. This is wrong and in case we are sending a large number of packets this can starve RX because remaining budget will be low. Let's give always the same budget for RX and TX clean. While at it, check if we missed any interrupts while we were in NAPI callback by looking at DMA interrupt status. Cc: Joao Pinto Cc: David S. Miller Cc: Giuseppe Cavallaro Cc: Alexandre Torgue Signed-off-by: Jose Abreu Signed-off-by: David S. Miller drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 27 ++++++++++++----------- 1 file changed, 14 insertions(+), 13 deletions(-) commit 3b5094665e273c4a2a99f7f5f16977c0f1e19095 Author: Jose Abreu Date: Wed Jan 9 10:05:59 2019 +0100 net: stmmac: Fix the logic of checking if RX Watchdog must be enabled RX Watchdog can be disabled by platform definitions but currently we are initializing the descriptors before checking if Watchdog must be disabled or not. Fix this by checking earlier if user wants Watchdog disabled or not. Cc: Joao Pinto Cc: David S. Miller Cc: Giuseppe Cavallaro Cc: Alexandre Torgue Signed-off-by: Jose Abreu Signed-off-by: David S. Miller drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 24 +++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) commit 0650d4017f4d2eee67230a02285a7ae5204240c2 Author: Jose Abreu Date: Wed Jan 9 10:05:58 2019 +0100 net: stmmac: Check if CBS is supported before configuring Check if CBS is currently supported before trying to configure it in HW. Cc: Joao Pinto Cc: David S. Miller Cc: Giuseppe Cavallaro Cc: Alexandre Torgue Signed-off-by: Jose Abreu Signed-off-by: David S. Miller drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 2 ++ 1 file changed, 2 insertions(+) commit fcc509eb10ff4794641e6ad3082118287a750d0a Author: Jose Abreu Date: Wed Jan 9 10:05:57 2019 +0100 net: stmmac: dwxgmac2: Only clear interrupts that are active In DMA interrupt handler we were clearing all interrupts status, even the ones that were not active. Fix this and only clear the active interrupts. Cc: Joao Pinto Cc: David S. Miller Cc: Giuseppe Cavallaro Cc: Alexandre Torgue Signed-off-by: Jose Abreu Signed-off-by: David S. Miller drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 6dea7e1881fd86b80da64e476ac398008daed857 Author: Jose Abreu Date: Wed Jan 9 10:05:56 2019 +0100 net: stmmac: Fix PCI module removal leak Since commit b7d0f08e9129, the enable / disable of PCI device is not managed which will result in IO regions not being automatically unmapped. As regions continue mapped it is currently not possible to remove and then probe again the PCI module of stmmac. Fix this by manually unmapping regions on remove callback. Changes from v1: - Fix build error Cc: Joao Pinto Cc: David S. Miller Cc: Giuseppe Cavallaro Cc: Alexandre Torgue Fixes: b7d0f08e9129 ("net: stmmac: Fix WoL for PCI-based setups") Signed-off-by: Jose Abreu Signed-off-by: David S. Miller drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 8217724eb7c51bbec351b23cbc924577b2f4b8e6 Author: Otto Sabart Date: Wed Jan 9 00:46:55 2019 +0100 doc: bindings: fix bad reference to ARM CPU bindings The primecell.txt and cpus.txt files were converted into YAML. This patch updates old references with new ones. Fixes: d3c207eeb905 ("dt-bindings: arm: Convert primecell binding to json-schema") Fixes: 672951cbd1b7 ("dt-bindings: arm: Convert cpu binding to json-schema") Signed-off-by: Otto Sabart Signed-off-by: Rob Herring Documentation/devicetree/bindings/arm/cpu-capacity.txt | 2 +- Documentation/devicetree/bindings/arm/idle-states.txt | 2 +- Documentation/devicetree/bindings/arm/sp810.txt | 2 +- Documentation/devicetree/bindings/arm/topology.txt | 2 +- Documentation/devicetree/bindings/display/arm,pl11x.txt | 2 +- Documentation/devicetree/bindings/interrupt-controller/arm,gic-v3.txt | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) commit 0919871ac37fdcf46c7657da0f1742efe096b399 Author: Tony Luck Date: Fri Jan 11 14:46:37 2019 -0800 acpi/nfit: Fix race accessing memdev in nfit_get_smbios_id() Possible race accessing memdev structures after dropping the mutex. Dan Williams says this could race against another thread that is doing: # echo "ACPI0012:00" > /sys/bus/acpi/drivers/nfit/unbind Reported-by: Jane Chu Fixes: 23222f8f8dce ("acpi, nfit: Add function to look up nvdimm...") Signed-off-by: Tony Luck Signed-off-by: Dan Williams drivers/acpi/nfit/core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit bde0b5c109e8b22b57745e3b9914f9e87ad857ea Author: Miquel Raynal Date: Tue Dec 4 20:28:29 2018 +0100 ata: ahci: mvebu: request PHY suspend/resume for Armada 3700 A feature has been added in the libahci driver: the possibility to set a new flag in hpriv->flags to let the core handle PHY suspend/resume automatically. Make use of this feature to make suspend to RAM work with SATA drives on A3700. Signed-off-by: Miquel Raynal Signed-off-by: Jens Axboe drivers/ata/ahci_mvebu.c | 3 +++ 1 file changed, 3 insertions(+) commit 2f558bc3f33ca344489cec2218545741028b6a70 Author: Miquel Raynal Date: Tue Dec 4 20:28:28 2018 +0100 ata: ahci: mvebu: add Armada 3700 initialization needed for S2RAM A3700 comphy initialization is done in the firmware (TF-A). Looking at the SATA PHY initialization routine, there is a comment about "vendor specific" registers. Two registers are mentioned. They are not initialized there in the firmware because they are AHCI related, while the firmware at this location does only PHY configuration. The solution to avoid doing such initialization is relying on U-Boot. While this work at boot time, U-Boot is definitely not going to run during a resume after suspending to RAM. Two possible solutions were considered: * Fixing the firmware. * Fixing the kernel driver. The first solution would take ages to propagate, while the second solution is easy to implement as the driver as been a little bit reworked to prepare for such platform configuration. Hence, this patch adds an Armada 3700 configuration function to set these two registers both at boot time (in the probe) and after a suspend (in the resume path). Signed-off-by: Miquel Raynal Signed-off-by: Jens Axboe drivers/ata/ahci_mvebu.c | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-) commit 96dbcb40e4b1a387cdb9b21f43638c759aebb5a4 Author: Miquel Raynal Date: Tue Dec 4 20:28:27 2018 +0100 ata: ahci: mvebu: do Armada 38x configuration only on relevant SoCs At the beginning, only Armada 38x SoCs where supported by the ahci_mvebu.c driver. Commit 15d3ce7b63bd ("ata: ahci_mvebu: add support for Armada 3700 variant") introduced Armada 3700 support. As opposed to Armada 38x SoCs, the 3700 variants do not have to configure mbus and the regret option. This patch took care of avoiding such configuration when not needed in the probe function, but failed to do the same in the resume path. While doing so looks harmless by experience, let's clean the driver logic and avoid doing this useless configuration with Armada 3700 SoCs. Because the logic is very similar between these two places, it has been decided to factorize this code and put it in a "Armada 38x configuration function". This function is part of a new (per-compatible) platform data structure, so that the addition of such configuration function for Armada 3700 will be eased. Fixes: 15d3ce7b63bd ("ata: ahci_mvebu: add support for Armada 3700 variant") Signed-off-by: Miquel Raynal Signed-off-by: Jens Axboe drivers/ata/ahci_mvebu.c | 68 ++++++++++++++++++++++++++++++++++++------------ 1 file changed, 51 insertions(+), 17 deletions(-) commit c9bc136791ba0eefe07ed57d3850b8c5cee6471b Author: Miquel Raynal Date: Tue Dec 4 20:28:26 2018 +0100 ata: ahci: mvebu: remove stale comment For Armada-38x (32-bit) SoCs, PM platform support has been added since: commit 32f9494c9dfd ("ARM: mvebu: prepare pm-board.c for the introduction of Armada 38x support") commit 3cbd6a6ca81c ("ARM: mvebu: Add standby support") For Armada 64-bit SoCs, like the A3700 also using this AHCI driver, PM platform support has always existed. There are even suspend/resume hooks in this driver since: commit d6ecf15814888 ("ata: ahci_mvebu: add suspend/resume support") Remove the stale comment at the end of this driver stating that all the above does not exist yet. Fixes: d6ecf15814888 ("ata: ahci_mvebu: add suspend/resume support") Signed-off-by: Miquel Raynal Signed-off-by: Jens Axboe drivers/ata/ahci_mvebu.c | 5 ----- 1 file changed, 5 deletions(-) commit 49e54187ae0b2f9b5c0760e568a103baf4481610 Author: Miquel Raynal Date: Tue Dec 4 20:28:25 2018 +0100 ata: libahci_platform: comply to PHY framework Current implementation of the libahci does not take into account the new PHY framework. Correct the situation by adding a call to phy_set_mode() before phy_power_on(). PHYs should also be handled at suspend/resume time. For this, call ahci_platform_enable/disable_phys() at suspend/resume_host() time. These calls are guarded by a HFLAG (AHCI_HFLAG_SUSPEND_PHYS) that the user of the libahci driver must set manually in hpriv->flags at probe time. This is to avoid breaking users that have not been tested with this change. Reviewed-by: Hans de Goede Suggested-by: Grzegorz Jaszczyk Signed-off-by: Miquel Raynal Signed-off-by: Jens Axboe drivers/ata/ahci.h | 2 ++ drivers/ata/libahci_platform.c | 13 +++++++++++++ 2 files changed, 15 insertions(+) commit e8b108b050e84b6d7497d2cd29fe7623d0a33ed6 Merge: b19bce0335e2 fb4129b9279d Author: David S. Miller Date: Fri Jan 11 12:51:49 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2019-01-11 The following pull-request contains BPF updates for your *net* tree. The main changes are: 1) Fix TCP-BPF support for correctly setting the initial window via TCP_BPF_IW on an active TFO sender, from Yuchung. 2) Fix a panic in BPF's stack_map_get_build_id()'s ELF parsing on 32 bit archs caused by page_address() returning NULL, from Song. 3) Fix BTF pretty print in kernel and bpftool when bitfield member offset is greater than 256. Also add test cases, from Yonghong. 4) Fix improper argument handling in xdp1 sample, from Ioana. 5) Install missing tcp_server.py and tcp_client.py files from BPF selftests, from Anders. 6) Add test_libbpf to gitignore in libbpf and BPF selftests, from Stanislav. ==================== Signed-off-by: David S. Miller commit 7e6fc2f50a3197d0e82d1c0e86282976c9e6c8a4 Author: Daniel Drake Date: Mon Jan 7 11:40:24 2019 +0800 x86/kaslr: Fix incorrect i8254 outb() parameters The outb() function takes parameters value and port, in that order. Fix the parameters used in the kalsr i8254 fallback code. Fixes: 5bfce5ef55cb ("x86, kaslr: Provide randomness functions") Signed-off-by: Daniel Drake Signed-off-by: Thomas Gleixner Cc: bp@alien8.de Cc: hpa@zytor.com Cc: linux@endlessm.com Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/20190107034024.15005-1-drake@endlessm.com arch/x86/lib/kaslr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 4b3c31c8d4dda4d70f3f24a165f3be99499e0328 Merge: c3405d689974 b67d4530cdad Author: Linus Torvalds Date: Fri Jan 11 12:28:01 2019 -0800 Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "I2C has one core and one driver bugfix for you" * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: tegra: Fix Maximum transfer size i2c: dev: prevent adapter retries and timeout being set as minus value commit c3405d689974555532c12a4f3a5e72dedc660c0b Merge: f87092c4337f 279667212ab2 Author: Linus Torvalds Date: Fri Jan 11 12:25:40 2019 -0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "Another handful of arm64 fixes here. Most of the complication comes from improving our kpti code to avoid lengthy pauses (30+ seconds) during boot when we rewrite the page tables. There are also a couple of IORT fixes that came in via Lorenzo. Summary: - Don't error in kexec_file_load if kaslr-seed is missing in device-tree - Fix incorrect argument type passed to iort_match_node_callback() - Fix IORT build failure when CONFIG_IOMMU_API=n - Fix kpti performance regression with new rodata default option - Typo fix" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: kexec_file: return successfully even if kaslr-seed doesn't exist ACPI/IORT: Fix rc_dma_get_range() arm64: kpti: Avoid rewriting early page tables when KASLR is enabled arm64: asm-prototypes: Fix fat-fingered typo in comment ACPI/IORT: Fix build when CONFIG_IOMMU_API=n commit f87092c4337fc064b52bfad1df499a5b82f6d088 Merge: 40a31da414c3 85f5a4d666fd Author: Linus Torvalds Date: Fri Jan 11 12:17:30 2019 -0800 Merge tag 'ceph-for-5.0-rc2' of git://github.com/ceph/ceph-client Pull ceph updates from Ilya Dryomov: "A patch to allow setting abort_on_full and a fix for an old "rbd unmap" edge case, marked for stable" * tag 'ceph-for-5.0-rc2' of git://github.com/ceph/ceph-client: rbd: don't return 0 on unmap if RBD_DEV_FLAG_REMOVING is set ceph: use vmf_error() in ceph_filemap_fault() libceph: allow setting abort_on_full for rbd commit ef4efa14560adf7cdc77022c86e659d910c5c6fc Author: Lubomir Rintel Date: Fri Jan 4 22:56:56 2019 +0100 dt-bindings: marvell,mmp2: fix typos in bindings doc A pair of rather trivial ones. Signed-off-by: Lubomir Rintel Signed-off-by: Rob Herring Documentation/devicetree/bindings/clock/marvell,mmp2.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5a9372f751b5350e0ce3d2ee91832f1feae2c2e5 Author: Arnd Bergmann Date: Thu Jan 10 17:24:31 2019 +0100 mips: fix n32 compat_ipc_parse_version While reading through the sysvipc implementation, I noticed that the n32 semctl/shmctl/msgctl system calls behave differently based on whether o32 support is enabled or not: Without o32, the IPC_64 flag passed by user space is rejected but calls without that flag get IPC_64 behavior. As far as I can tell, this was inadvertently changed by a cleanup patch but never noticed by anyone, possibly nobody has tried using sysvipc on n32 after linux-3.19. Change it back to the old behavior now. Fixes: 78aaf956ba3a ("MIPS: Compat: Fix build error if CONFIG_MIPS32_COMPAT but no compat ABI.") Signed-off-by: Arnd Bergmann Signed-off-by: Paul Burton Cc: linux-mips@vger.kernel.org Cc: stable@vger.kernel.org # 3.19+ arch/mips/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 83b4c147967b20b9140e38f7b1a79258a8e9fa6f Author: Marc Gonzalez Date: Fri Jan 11 14:37:43 2019 +0100 clk: qcom: Select QCOM_GDSC with MSM_GCC_8998 If QCOM_GDSC is disabled, gdsc_register() returns -ENOSYS, which causes gcc_msm8998_probe() to fail. Select QCOM_GDSC to solve the problem. gcc-msm8998: probe of 100000.clock-controller failed with error -38 Signed-off-by: Marc Gonzalez Fixes: b5f5f525c547 ("clk: qcom: Add MSM8998 Global Clock Control (GCC) driver") Signed-off-by: Stephen Boyd drivers/clk/qcom/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 5962dd22f0ff6f7d72fff974b3c637d52586643e Author: Sinan Kaya Date: Wed Jan 2 18:10:37 2019 +0000 x86/intel/lpss: Make PCI dependency explicit After commit 5d32a66541c4 ("PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set") dependencies on CONFIG_PCI that previously were satisfied implicitly through dependencies on CONFIG_ACPI have to be specified directly. LPSS code relies on PCI infrastructure but this dependency has not been explicitly called out so do that. Fixes: 5d32a66541c46 ("PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set") Signed-off-by: Sinan Kaya Signed-off-by: Borislav Petkov Cc: "H. Peter Anvin" Cc: linux-acpi@vger.kernel.org Cc: x86-ml Link: https://lkml.kernel.org/r/20190102181038.4418-11-okaya@kernel.org arch/x86/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 40a31da414c39e3cd8c4137c1ceedf59b7ffd4ce Merge: e8af37f3f488 4e72ee887227 Author: Linus Torvalds Date: Fri Jan 11 09:44:05 2019 -0800 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf tooling updates from Ingo Molnar: "Tooling changes only: fixes and a few stray improvements. Most of the diffstat is dominated by a PowerPC related fix of system call trace output beautification that allows us to (again) use the UAPI header version and sync up with the kernel's version of PowerPC system call names in the arch/powerpc/kernel/syscalls/syscall.tbl header" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (36 commits) tools headers powerpc: Remove unistd.h perf powerpc: Rework syscall table generation perf symbols: Add 'arch_cpu_idle' to the list of kernel idle symbols tools include uapi: Sync linux/if_link.h copy with the kernel sources tools include uapi: Sync linux/vhost.h with the kernel sources tools include uapi: Sync linux/fs.h copy with the kernel sources perf beauty: Switch from using uapi/linux/fs.h to uapi/linux/mount.h tools include uapi: Grab a copy of linux/mount.h perf top: Lift restriction on using callchains without "sym" in --sort tools lib traceevent: Remove tep_data_event_from_type() API tools lib traceevent: Rename tep_is_file_bigendian() to tep_file_bigendian() tools lib traceevent: Changed return logic of tep_register_event_handler() API tools lib traceevent: Changed return logic of trace_seq_printf() and trace_seq_vprintf() APIs tools lib traceevent: Rename struct cmdline to struct tep_cmdline tools lib traceevent: Initialize host_bigendian at tep_handle allocation tools lib traceevent: Introduce new libtracevent API: tep_override_comm() perf tests: Add a test for the ARM 32-bit [vectors] page perf tools: Make find_vdso_map() more modular perf trace: Fix alignment for [continued] lines perf trace: Fix ')' placement in "interrupted" syscall lines ... commit 826c1362e79abcd36f99092acd083b5a2d576676 Author: Vitaly Kuznetsov Date: Wed Jan 9 18:22:56 2019 +0100 x86/kvm/nVMX: don't skip emulated instruction twice when vmptr address is not backed Since commit 09abb5e3e5e50 ("KVM: nVMX: call kvm_skip_emulated_instruction in nested_vmx_{fail,succeed}") nested_vmx_failValid() results in kvm_skip_emulated_instruction() so doing it again in handle_vmptrld() when vmptr address is not backed is wrong, we end up advancing RIP twice. Fixes: fca91f6d60b6e ("kvm: nVMX: Set VM instruction error for VMPTRLD of unbacked page") Reported-by: Cornelia Huck Signed-off-by: Vitaly Kuznetsov Reviewed-by: Sean Christopherson Reviewed-by: Cornelia Huck Signed-off-by: Radim Krčmář arch/x86/kvm/vmx/nested.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit cf1754c2a1d6e92688f7353aa7f598f5ad6d8f78 Author: Christophe de Dinechin Date: Mon Jan 7 18:52:38 2019 +0100 Documentation/virtual/kvm: Update URL for AMD SEV API specification The URL of [api-spec] in Documentation/virtual/kvm/amd-memory-encryption.rst is no longer valid, replaced space with underscore. Signed-off-by: Christophe de Dinechin Reviewed-by: Brijesh Singh Signed-off-by: Radim Krčmář Documentation/virtual/kvm/amd-memory-encryption.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b7c1c226f9403c52bf58b0bceef24501429c7351 Author: Lan Tianyu Date: Fri Jan 4 15:20:44 2019 +0800 KVM/VMX: Avoid return error when flush tlb successfully in the hv_remote_flush_tlb_with_range() The "ret" is initialized to be ENOTSUPP. The return value of __hv_remote_flush_tlb_with_range() will be Or with "ret" when ept table potiners are mismatched. This will cause return ENOTSUPP even if flush tlb successfully. This patch is to fix the issue and set "ret" to 0. Fixes: a5c214dad198 ("KVM/VMX: Change hv flush logic when ept tables are mismatched.") Signed-off-by: Lan Tianyu Signed-off-by: Radim Krčmář arch/x86/kvm/vmx/vmx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3f14a89d1132dcae3c8ce6721c6ef51f6e6d9b5f Author: David Rientjes Date: Wed Jan 2 12:56:33 2019 -0800 kvm: sev: Fail KVM_SEV_INIT if already initialized By code inspection, it was found that multiple calls to KVM_SEV_INIT could deplete asid bits and overwrite kvm_sev_info's regions_list. Multiple calls to KVM_SVM_INIT is not likely to occur with QEMU, but this should likely be fixed anyway. This code is serialized by kvm->lock. Fixes: 1654efcbc431 ("KVM: SVM: Add KVM_SEV_INIT command") Reported-by: Cfir Cohen Signed-off-by: David Rientjes Signed-off-by: Radim Krčmář arch/x86/kvm/svm.c | 3 +++ 1 file changed, 3 insertions(+) commit 98938aa8edd66dc95024d7c936a4bc315f6615ff Author: Tomas Bortoli Date: Wed Jan 2 18:29:37 2019 +0100 KVM: validate userspace input in kvm_clear_dirty_log_protect() The function at issue does not fully validate the content of the structure pointed by the log parameter, though its content has just been copied from userspace and lacks validation. Fix that. Moreover, change the type of n to unsigned long as that is the type returned by kvm_dirty_bitmap_bytes(). Signed-off-by: Tomas Bortoli Reported-by: syzbot+028366e52c9ace67deb3@syzkaller.appspotmail.com [Squashed the fix from Paolo. - Radim.] Signed-off-by: Radim Krčmář virt/kvm/kvm_main.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) commit d14eff1bc53e6a268c3b48da5cdb469f26832d1a Author: Gustavo A. R. Silva Date: Wed Dec 26 14:40:59 2018 -0600 KVM: x86: Fix bit shifting in update_intel_pt_cfg ctl_bitmask in pt_desc is of type u64. When an integer like 0xf is being left shifted more than 32 bits, the behavior is undefined. Fix this by adding suffix ULL to integer 0xf. Addresses-Coverity-ID: 1476095 ("Bad bit shift operation") Fixes: 6c0f0bba85a0 ("KVM: x86: Introduce a function to initialize the PT configuration") Signed-off-by: Gustavo A. R. Silva Reviewed-by: Wei Yang Reviewed-by: Luwei Kang Signed-off-by: Radim Krčmář arch/x86/kvm/vmx/vmx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e8af37f3f488e7adce2b5c6f6dfe8c83c2662e1f Merge: 8e1b295b693c e4f358916d52 Author: Linus Torvalds Date: Fri Jan 11 09:07:19 2019 -0800 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "A 32-bit build fix, CONFIG_RETPOLINE fixes and rename CONFIG_RESCTRL to CONFIG_X86_RESCTRL" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86, modpost: Replace last remnants of RETPOLINE with CONFIG_RETPOLINE x86/cache: Rename config option to CONFIG_X86_RESCTRL samples/seccomp: Fix 32-bit build commit 8e1b295b693cbf2d8499c24fbb1f8f50c58771e3 Merge: f4f31fff3225 65a4f3a1efda Author: Linus Torvalds Date: Fri Jan 11 09:04:36 2019 -0800 Merge tag 'acpi-5.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "Fix a build failure introduced recently, fix the xpower PMIC ACPI driver, clean up the handling of duplicate entries in _PRx power resource lists and fix addresses in NUMA-related messages on 32-bit with PAE. Specifics: - Fix build failures with both CONFIG_NLS and CONFIG_PCI unset that can occur since ACPI can be built without PCI now (Sinan Kaya). - Clean up the handling of duplicate entries in power resource lists returned by _PRx evaluation to avoid triggering WARN_ON() on attempts to add duplicate symlinks in sysfs (Hans de Goede). - Fix issues with the TS current-source switching on systems using the xpower PMIC by avoiding to update unrelated bits in the TS pin-ctrl register and avoiding to unconditionally enable TS current-source on systems where it is not used (Hans de Goede). - Fix addresses in NUMA-related messages on 32-bit with PAE which can be truncated due to integer type conversions (Chao Fan)" * tag 'acpi-5.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI / PMIC: xpower: Fix TS-pin current-source handling ACPI: NUMA: Use correct type for printing addresses on i386-PAE ACPI: power: Skip duplicate power resource references in _PRx ACPI: Fix build failure when CONFIG_NLS is set to 'n' commit f4f31fff32252da3791e9d901adb44f963a79153 Merge: 385c59c7baaa 343e60e52a3a Author: Linus Torvalds Date: Fri Jan 11 09:01:43 2019 -0800 Merge tag 'pm-5.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management updates from Rafael Wysocki: "These fix fallout after starting to use hrtimers in the runtime PM framework, fix a few cpufreq issues, fix a recently broken reference to cpuidle documentation, update MAINTAINERS entries for cpufreq and cpuidle and make the recently added system suspend and resume support in devfreq actually work. Specifics: - Prevent integer overflows from occurring on 32-bit when converting milliseconds to nanoseconds in the runtime PM framework and update comments that still refer to jiffies in it (Vincent Guittot, Ladislav Michl). - Fix the SCMI cpufreq driver to always use the same frequency units for arch_set_freq_scale() and make the scale-invariant load tracking acutally work with this driver (Quentin Perret). - Fix freeing of dynamic OPPs in the SCPI and SCMI cpufreq drivers broken during the 4.20 defelopment cycle (Viresh Kumar). - Prevent the cpufreq core from attempting to return the current frequency of offline CPUs (Sudeep Holla). - Add devfreq suspend and resume hooks (missed previously) to the PM core to make the recently added system suspend and resume support in devfreq actually work (Lukasz Luba). - Update MAINTAINERS entries for cpufreq and cpuidle, mostly to add references to new/current documentation to them (Rafael Wysocki). - Fix a recently broken reference to cpuidle documentation (Otto Sabart)" * tag 'pm-5.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM-runtime: Fix autosuspend_delay on 32bits arch PM-runtime: Fix 'jiffies' in comments after switch to hrtimers cpufreq: scmi: Fix frequency invariance in slow path doc: trace: fix reference to cpuidle documentation file cpufreq: check if policy is inactive early in __cpufreq_get() cpufreq: scpi/scmi: Fix freeing of dynamic OPPs cpuidle / Documentation: Update cpuidle MAINTAINERS entry cpufreq / Documentation: Update cpufreq MAINTAINERS entry PM: sleep: call devfreq suspend/resume commit 385c59c7baaa4626f5c01888d50e86e5636e655e Merge: de6629eb262e f34c48e06ddc Author: Linus Torvalds Date: Fri Jan 11 08:58:02 2019 -0800 Merge tag 'drm-fixes-2019-01-11' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Not a huge amount for rc2, assume the usual quiet period, and rc3 will be most of it. amdgpu: - Powerplay fixes - Virtual display pinning fixes - Golden register updates for Vega - Pitch and gem size validation fixes - SR-IOV init error fix - Pagetables in system RAM disable for some Raven system - DP-MST resume fixes tc358767 bridge: - fix to work with displayport connector" * tag 'drm-fixes-2019-01-11' of git://anongit.freedesktop.org/drm/drm: (26 commits) drm/amdgpu: disable system memory page tables for now drm/amdgpu: set WRITE_BURST_LENGTH to 64B to workaround SDMA1 hang drm/amdgpu: fix CPDMA hang in PRT mode for VEGA20 drm/bridge: tc358767: use DP connector if no panel set drm/bridge: tc358767: fix output H/V syncs drm/bridge: tc358767: reject modes which require too much BW drm/bridge: tc358767: fix initial DP0/1_SRCCTRL value drm/bridge: tc358767: fix single lane configuration drm/bridge: tc358767: add defines for DP1_SRCCTRL & PHY_2LANE drm/bridge: tc358767: add bus flags drm/dp_mst: Add __must_check to drm_dp_mst_topology_mgr_resume() drm/amdgpu: Don't fail resume process if resuming atomic state fails drm/amdgpu: Don't ignore rc from drm_dp_mst_topology_mgr_resume() drm/amdgpu: validate user GEM object size drm/amdgpu: validate user pitch alignment drm/amd/powerplay: drop the unnecessary uclk hard min setting drm/amd/powerplay: avoid possible buffer overflow drm/amd/powerplay: create pp_od_clk_voltage device file under OD support drm/amd/powerplay: update OD support flag for SKU with no OD capabilities drm/amdgpu: make gfx9 enter into rlc safe mode when set MGCG ... commit 60f1bf29c0b2519989927cae640cd1f50f59dc7f Author: David Hildenbrand Date: Fri Jan 11 15:18:22 2019 +0100 s390/smp: Fix calling smp_call_ipl_cpu() from ipl CPU When calling smp_call_ipl_cpu() from the IPL CPU, we will try to read from pcpu_devices->lowcore. However, due to prefixing, that will result in reading from absolute address 0 on that CPU. We have to go via the actual lowcore instead. This means that right now, we will read lc->nodat_stack == 0 and therfore work on a very wrong stack. This BUG essentially broke rebooting under QEMU TCG (which will report a low address protection exception). And checking under KVM, it is also broken under KVM. With 1 VCPU it can be easily triggered. :/# echo 1 > /proc/sys/kernel/sysrq :/# echo b > /proc/sysrq-trigger [ 28.476745] sysrq: SysRq : Resetting [ 28.476793] Kernel stack overflow. [ 28.476817] CPU: 0 PID: 424 Comm: sh Not tainted 5.0.0-rc1+ #13 [ 28.476820] Hardware name: IBM 2964 NE1 716 (KVM/Linux) [ 28.476826] Krnl PSW : 0400c00180000000 0000000000115c0c (pcpu_delegate+0x12c/0x140) [ 28.476861] R:0 T:1 IO:0 EX:0 Key:0 M:0 W:0 P:0 AS:3 CC:0 PM:0 RI:0 EA:3 [ 28.476863] Krnl GPRS: ffffffffffffffff 0000000000000000 000000000010dff8 0000000000000000 [ 28.476864] 0000000000000000 0000000000000000 0000000000ab7090 000003e0006efbf0 [ 28.476864] 000000000010dff8 0000000000000000 0000000000000000 0000000000000000 [ 28.476865] 000000007fffc000 0000000000730408 000003e0006efc58 0000000000000000 [ 28.476887] Krnl Code: 0000000000115bfe: 4170f000 la %r7,0(%r15) [ 28.476887] 0000000000115c02: 41f0a000 la %r15,0(%r10) [ 28.476887] #0000000000115c06: e370f0980024 stg %r7,152(%r15) [ 28.476887] >0000000000115c0c: c0e5fffff86e brasl %r14,114ce8 [ 28.476887] 0000000000115c12: 41f07000 la %r15,0(%r7) [ 28.476887] 0000000000115c16: a7f4ffa8 brc 15,115b66 [ 28.476887] 0000000000115c1a: 0707 bcr 0,%r7 [ 28.476887] 0000000000115c1c: 0707 bcr 0,%r7 [ 28.476901] Call Trace: [ 28.476902] Last Breaking-Event-Address: [ 28.476920] [<0000000000a01c4a>] arch_call_rest_init+0x22/0x80 [ 28.476927] Kernel panic - not syncing: Corrupt kernel stack, can't continue. [ 28.476930] CPU: 0 PID: 424 Comm: sh Not tainted 5.0.0-rc1+ #13 [ 28.476932] Hardware name: IBM 2964 NE1 716 (KVM/Linux) [ 28.476932] Call Trace: Fixes: 2f859d0dad81 ("s390/smp: reduce size of struct pcpu") Cc: stable@vger.kernel.org # 4.0+ Reported-by: Cornelia Huck Signed-off-by: David Hildenbrand Signed-off-by: Martin Schwidefsky arch/s390/kernel/smp.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 190f056fba230abee80712eb810939ef9a8c462f Author: Vasily Gorbik Date: Wed Jan 2 13:43:22 2019 +0100 s390/vdso: correct vdso mapping for compat tasks While "s390/vdso: avoid 64-bit vdso mapping for compat tasks" fixed 64-bit vdso mapping for compat tasks under gdb it introduced another problem. "compat_mm" flag is not inherited during fork and when 31-bit process forks a child (but does not perform exec) it ends up with 64-bit vdso. To address that, init_new_context (which is called during fork and exec) now initialize compat_mm based on thread TIF_31BIT flag. Later compat_mm is adjusted in arch_setup_additional_pages, which is called during exec. Fixes: d1befa65823e ("s390/vdso: avoid 64-bit vdso mapping for compat tasks") Reported-by: Stefan Liebler Reviewed-by: Heiko Carstens Cc: # v4.20+ Signed-off-by: Vasily Gorbik Signed-off-by: Martin Schwidefsky arch/s390/include/asm/mmu_context.h | 2 +- arch/s390/kernel/vdso.c | 5 ++--- 2 files changed, 3 insertions(+), 4 deletions(-) commit b7cb707c373094ce4008d4a6ac9b6b366ec52da5 Author: Gerald Schaefer Date: Wed Jan 9 13:00:03 2019 +0100 s390/smp: fix CPU hotplug deadlock with CPU rescan smp_rescan_cpus() is called without the device_hotplug_lock, which can lead to a dedlock when a new CPU is found and immediately set online by a udev rule. This was observed on an older kernel version, where the cpu_hotplug_begin() loop was still present, and it resulted in hanging chcpu and systemd-udev processes. This specific deadlock will not show on current kernels. However, there may be other possible deadlocks, and since smp_rescan_cpus() can still trigger a CPU hotplug operation, the device_hotplug_lock should be held. For reference, this was the deadlock with the old cpu_hotplug_begin() loop: chcpu (rescan) systemd-udevd echo 1 > /sys/../rescan -> smp_rescan_cpus() -> (*) get_online_cpus() (increases refcount) -> smp_add_present_cpu() (new CPU found) -> register_cpu() -> device_add() -> udev "add" event triggered -----------> udev rule sets CPU online -> echo 1 > /sys/.../online -> lock_device_hotplug_sysfs() (this is missing in rescan path) -> device_online() -> (**) device_lock(new CPU dev) -> cpu_up() -> cpu_hotplug_begin() (loops until refcount == 0) -> deadlock with (*) -> bus_probe_device() -> device_attach() -> device_lock(new CPU dev) -> deadlock with (**) Fix this by taking the device_hotplug_lock in the CPU rescan path. Cc: Signed-off-by: Gerald Schaefer Signed-off-by: Martin Schwidefsky arch/s390/kernel/smp.c | 4 ++++ drivers/s390/char/sclp_config.c | 2 ++ 2 files changed, 6 insertions(+) commit a38662084c8bdb829ff486468c7ea801c13fcc34 Author: Martin Schwidefsky Date: Tue Jan 8 12:44:57 2019 +0100 s390/mm: always force a load of the primary ASCE on context switch The ASCE of an mm_struct can be modified after a task has been created, e.g. via crst_table_downgrade for a compat process. The active_mm logic to avoid the switch_mm call if the next task is a kernel thread can lead to a situation where switch_mm is called where 'prev == next' is true but 'prev->context.asce == next->context.asce' is not. This can lead to a situation where a CPU uses the outdated ASCE to run a task. The result can be a crash, endless loops and really subtle problem due to TLBs being created with an invalid ASCE. Cc: stable@kernel.org # v3.15+ Fixes: 53e857f30867 ("s390/mm,tlb: race of lazy TLB flush vs. recreation") Reported-by: Heiko Carstens Reviewed-by: Heiko Carstens Signed-off-by: Martin Schwidefsky arch/s390/include/asm/mmu_context.h | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 03aa047ef2db4985e444af6ee1c1dd084ad9fb4c Author: Christian Borntraeger Date: Fri Nov 9 09:21:47 2018 +0100 s390/early: improve machine detection Right now the early machine detection code check stsi 3.2.2 for "KVM" and set MACHINE_IS_VM if this is different. As the console detection uses diagnose 8 if MACHINE_IS_VM returns true this will crash Linux early for any non z/VM system that sets a different value than KVM. So instead of assuming z/VM, do not set any of MACHINE_IS_LPAR, MACHINE_IS_VM, or MACHINE_IS_KVM. CC: stable@vger.kernel.org Reviewed-by: Heiko Carstens Signed-off-by: Christian Borntraeger Signed-off-by: Martin Schwidefsky arch/s390/kernel/early.c | 4 ++-- arch/s390/kernel/setup.c | 2 ++ 2 files changed, 4 insertions(+), 2 deletions(-) commit d3736d82e8169768218ee0ef68718875918091a0 Author: Dmitry Safonov Date: Wed Jan 9 01:17:40 2019 +0000 tty: Don't hold ldisc lock in tty_reopen() if ldisc present Try to get reference for ldisc during tty_reopen(). If ldisc present, we don't need to do tty_ldisc_reinit() and lock the write side for line discipline semaphore. Effectively, it optimizes fast-path for tty_reopen(), but more importantly it won't interrupt ongoing IO on the tty as no ldisc change is needed. Fixes user-visible issue when tty_reopen() interrupted login process for user with a long password, observed and reported by Lukas. Fixes: c96cf923a98d ("tty: Don't block on IO when ldisc change is pending") Fixes: 83d817f41070 ("tty: Hold tty_ldisc_lock() during tty_reopen()") Cc: Jiri Slaby Reported-by: Lukas F. Hartmann Tested-by: Lukas F. Hartmann Cc: stable Signed-off-by: Dmitry Safonov Signed-off-by: Greg Kroah-Hartman drivers/tty/tty_io.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) commit 411aba3c128fb4fd68b03e12a7ec6e7350d3b101 Merge: 36bdf3cae09d b5679cebf780 Author: Greg Kroah-Hartman Date: Fri Jan 11 15:28:48 2019 +0100 Merge tag 'hyperv-fixes-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux into char-misc-linus Sasha writes: Three bug fixes for different parts of the hyper-v code: - Fix for a lockup when changing NIC's MTU from Dexuan. - Fix of use of uninitialized memory from Dexuan. - Fix for memory corruption caused by ballooning from Vitaly. All 3 were tested internally. * tag 'hyperv-fixes-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: vmbus: fix subchannel removal hv_balloon: avoid touching uninitialized struct page during tail onlining Drivers: hv: vmbus: Check for ring when getting debug info commit e3e4767bd550b3f19278e42bcce143e0d2316ba2 Author: Martin Blumenstingl Date: Tue Jan 1 20:44:14 2019 +0100 mmc: core: don't override the CD GPIO level when "cd-inverted" is set Since commit 89a5e15bcba87d ("gpio/mmc/of: Respect polarity in the device tree") gpiolib-of parses the "cd-gpios" property and flips the polarity if "cd-inverted" is also set. This results in the "cd-inverted" property being evaluated twice, which effectively makes it a no-op: - first in drivers/gpio/gpiolib-of.c (of_xlate_and_get_gpiod_flags) when setting up the CD GPIO - then again in drivers/mmc/core/slot-gpio.c (mmc_gpio_get_cd) when reading the CD GPIO value at runtime On boards which are using device-tree with the "cd-inverted" property being set any inserted card are not detected anymore. This is due to the MMC core treating the CD GPIO with the wrong polarity. Disable "override_cd_active_level" for the card detection GPIO which is parsed using mmc_of_parse. This fixes SD card detection on the boards which are currently using the "cd-inverted" device-tree property (tested on Meson8b Odroid-C1 and Meson8b EC-100). This does not remove the CD GPIO inversion logic from the MMC core because there's at least one driver (sdhci-pci-core for Intel BayTrail based boards) which still passes "override_cd_active_level = true" to mmc_gpiod_request_cd(). Due to lack of hardware for testing this is left untouched. In the future the GPIO inversion logic for both, card and read-only detection can be removed once no driver is using it anymore. Fixes: 89a5e15bcba87d ("gpio/mmc/of: Respect polarity in the device tree") Signed-off-by: Martin Blumenstingl Tested-by: Anand Moon Tested-by: Loys Ollivier Acked-by: Ulf Hansson Signed-off-by: Linus Walleij drivers/mmc/core/host.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2d2d478576d71000b29c52668c5712c825ee9af8 Author: Ryder Lee Date: Wed Jan 9 10:13:55 2019 +0800 pinctrl: mediatek: fix Kconfig build errors for moore core on i386 or x86_64: Lots of build errors for drivers/pinctrl/mediatek/pinctrl-moore.c when CONFIG_OF is not enabled (but COMPILE_TEST is). first this: WARNING: unmet direct dependencies detected for PINCTRL_MTK_MOORE Depends on [n]: PINCTRL [=y] && (ARCH_MEDIATEK || COMPILE_TEST [=y]) && OF [=n] Selected by [y]: - PINCTRL_MT7623 [=y] && PINCTRL [=y] && (ARCH_MEDIATEK || COMPILE_TEST [=y]) && (MACH_MT7623 || COMPILE_TEST [=y]) and then: ../drivers/pinctrl/mediatek/pinctrl-moore.c:22:44: error: array type has incomplete element type static const struct pinconf_generic_params mtk_custom_bindings[] = { (etc) Fixes: b5af33df50e9 ("pinctrl: mediatek: improve Kconfig dependencies") Cc: stable@vger.kernel.org Reported-by: Randy Dunlap Signed-off-by: Ryder Lee Acked-by: Sean Wang Signed-off-by: Linus Walleij drivers/pinctrl/mediatek/Kconfig | 3 +++ 1 file changed, 3 insertions(+) commit 00257e0cc550c4a8df5f99c0a4fc74fec0656144 Author: Rob Herring Date: Fri Jan 11 14:34:39 2019 +0100 fbdev: offb: Fix OF node name handling Commit 5c63e407aaab ("fbdev: Convert to using %pOFn instead of device_node.name") changed how the OF FB driver handles the OF node name. This missed the case where the node name is passed to offb_init_palette_hacks(). This results in a NULL ptr dereference in strncmp and breaks any system except ones using bootx with no display node. Fix this by making offb_init_palette_hacks() use the OF node pointer and use of_node_name_prefix() helper function instead for node name comparisons. This helps in moving all OF node name accesses to helper functions in preparation to remove struct device_node.name pointer. Fixes: 5c63e407aaab ("fbdev: Convert to using %pOFn instead of device_node.name") Reported-by: Mathieu Malaterre Tested-by: Mathieu Malaterre Cc: stable@vger.kernel.org # v4.19+ Cc: Elimar Riesebieter Signed-off-by: Rob Herring Signed-off-by: Bartlomiej Zolnierkiewicz drivers/video/fbdev/offb.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) commit a01421e4484327fe44f8e126793ed5a48a221e24 Author: Vlad Tsyrklevich Date: Fri Jan 11 14:34:38 2019 +0100 omap2fb: Fix stack memory disclosure Using [1] for static analysis I found that the OMAPFB_QUERY_PLANE, OMAPFB_GET_COLOR_KEY, OMAPFB_GET_DISPLAY_INFO, and OMAPFB_GET_VRAM_INFO cases could all leak uninitialized stack memory--either due to uninitialized padding or 'reserved' fields. Fix them by clearing the shared union used to store copied out data. [1] https://github.com/vlad902/kernel-uninitialized-memory-checker Signed-off-by: Vlad Tsyrklevich Reviewed-by: Kees Cook Fixes: b39a982ddecf ("OMAP: DSS2: omapfb driver") Cc: security@kernel.org [b.zolnierkie: prefix patch subject with "omap2fb: "] Signed-off-by: Bartlomiej Zolnierkiewicz drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c | 2 ++ 1 file changed, 2 insertions(+) commit 48d2ba6257013676e57ff69444d5212031aee763 Author: Steve French Date: Sat Jan 5 19:46:35 2019 -0600 cifs: update internal module version number To 2.16 Signed-off-by: Steve French fs/cifs/cifsfs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9a66396f1857cc1de06f4f4771797315e1a4ea56 Author: Pavel Shilovsky Date: Tue Jan 8 11:15:28 2019 -0800 CIFS: Fix error paths in writeback code This patch aims to address writeback code problems related to error paths. In particular it respects EINTR and related error codes and stores and returns the first error occurred during writeback. Signed-off-by: Pavel Shilovsky Acked-by: Jeff Layton Signed-off-by: Steve French fs/cifs/cifsglob.h | 19 +++++++++++++++++++ fs/cifs/cifssmb.c | 7 ++++--- fs/cifs/file.c | 29 +++++++++++++++++++++++------ fs/cifs/inode.c | 10 ++++++++++ 4 files changed, 56 insertions(+), 9 deletions(-) commit ee258d79159afed52ca9372aeb9c1a51e89b32ee Author: Pavel Shilovsky Date: Thu Jan 3 15:53:10 2019 -0800 CIFS: Move credit processing to mid callbacks for SMB3 Currently we account for credits in the thread initiating a request and waiting for a response. The demultiplex thread receives the response, wakes up the thread and the latter collects credits from the response buffer and add them to the server structure on the client. This approach is not accurate, because it may race with reconnect events in the demultiplex thread which resets the number of credits. Fix this by moving credit processing to new mid callbacks that collect credits granted by the server from the response in the demultiplex thread. Signed-off-by: Pavel Shilovsky Signed-off-by: Steve French fs/cifs/transport.c | 51 ++++++++++++++++++++++++++++++++++----------------- 1 file changed, 34 insertions(+), 17 deletions(-) commit 8a26f0f781f56d3016b34a2217e346973d067e7b Author: Pavel Shilovsky Date: Thu Jan 3 16:45:27 2019 -0800 CIFS: Fix credits calculation for cancelled requests If a request is cancelled, we can't assume that the server returns 1 credit back. Instead we need to wait for a response and process the number of credits granted by the server. Create a separate mid callback for cancelled request, parse the number of credits in a response buffer and add them to the client's credits. If the didn't get a response (no response buffer available) assume 0 credits granted. The latter most probably happens together with session reconnect, so the client's credits are adjusted anyway. Signed-off-by: Pavel Shilovsky Signed-off-by: Steve French fs/cifs/cifsglob.h | 1 + fs/cifs/transport.c | 28 ++++++++++++++++++++++++++-- 2 files changed, 27 insertions(+), 2 deletions(-) commit b9a74cde94957d82003fb9f7ab4777938ca851cd Author: Ross Lagerwall Date: Tue Jan 8 18:30:57 2019 +0000 cifs: Fix potential OOB access of lock element array If maxBuf is small but non-zero, it could result in a zero sized lock element array which we would then try and access OOB. Signed-off-by: Ross Lagerwall Signed-off-by: Steve French CC: Stable fs/cifs/file.c | 8 ++++---- fs/cifs/smb2file.c | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-) commit 92a8109e4d3a34fb6b115c9098b51767dc933444 Author: Ross Lagerwall Date: Tue Jan 8 18:30:56 2019 +0000 cifs: Limit memory used by lock request calls to a page The code tries to allocate a contiguous buffer with a size supplied by the server (maxBuf). This could fail if memory is fragmented since it results in high order allocations for commonly used server implementations. It is also wasteful since there are probably few locks in the usual case. Limit the buffer to be no larger than a page to avoid memory allocation failures due to fragmentation. Signed-off-by: Ross Lagerwall Signed-off-by: Steve French fs/cifs/file.c | 8 ++++++++ fs/cifs/smb2file.c | 4 ++++ 2 files changed, 12 insertions(+) commit 15bc77f94e9f0e3cfd6972f3b84bb7aaa4c36b1b Author: Aurelien Aptel Date: Tue Jan 8 13:41:00 2019 +0100 cifs: move large array from stack to heap This addresses some compile warnings that you can see depending on configuration settings. Signed-off-by: Aurelien Aptel Signed-off-by: Steve French fs/cifs/cifssmb.c | 23 ++++++++++++++++------- fs/cifs/smb2pdu.c | 23 ++++++++++++++++------- 2 files changed, 32 insertions(+), 14 deletions(-) commit ee13919c2e8d1f904e035ad4b4239029a8994131 Author: Pavel Shilovsky Date: Thu Jan 10 11:27:28 2019 -0800 CIFS: Do not hide EINTR after sending network packets Currently we hide EINTR code returned from sock_sendmsg() and return 0 instead. This makes a caller think that we successfully completed the network operation which is not true. Fix this by properly returning EINTR to callers. Cc: Signed-off-by: Pavel Shilovsky Reviewed-by: Jeff Layton Signed-off-by: Steve French fs/cifs/transport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fcf5036f09694d09d946c0455f329894a6482a4d Author: Michael Ellerman Date: Fri Jan 11 23:53:46 2019 +1100 powerpc/4xx/ocm: Fix fix for phys_addr_t printf warnings My recent commit to fix the printf warnings in ocm.c got the format specifier wrong, because I copied it from the documentation without realising the square brackets are not meant as literals. This results in the address being suffixed with a literal "[p]". Actually tested this time: # cat info /sys/kernel/debug/ppc4xx_ocm PhysAddr : 0x0000000400040000 ... NC.PhysAddr : 0x0000000400040000 ... C.PhysAddr : 0x0000000000000000 Fixes: 52b88fa1e8c7 ("powerpc/4xx/ocm: Fix phys_addr_t printf warnings") Reported-by: Christian Lamparter Tested-by: Christian Lamparter Signed-off-by: Michael Ellerman arch/powerpc/platforms/4xx/ocm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 6bca515917515b66b7e1dfc1d1d3b7bd8058315c Author: Frederic Barrat Date: Wed Jan 9 16:13:42 2019 +0100 powerpc/powernv/npu: Fix oops in pnv_try_setup_npu_table_group() With a recent change around IOMMU group, a system with an opencapi adapter is no longer booting and we get a kernel oops: BUG: Kernel NULL pointer dereference at 0x00000028 Faulting instruction address: 0xc0000000000aa38c ... NIP pnv_try_setup_npu_table_group+0x1c/0x1a0 LR pnv_pci_ioda_fixup+0x1f8/0x660 Call Trace: pnv_try_setup_npu_table_group+0x60/0x pnv_pci_ioda_fixup+0x20c/0x660 pcibios_resource_survey+0x2c8/0x31c pcibios_init+0xb0/0xe4 do_one_initcall+0x64/0x264 kernel_init_freeable+0x36c/0x468 kernel_init+0x2c/0x148 ret_from_kernel_thread+0x5c/0x68 An opencapi device is using a device PE, so the current code breaks because pe->pbus is not defined. More generally, there's no need to define an IOMMU group for opencapi, as the device sends real addresses directly (admittedly, the virtualization story is yet to be written). So let's fix it by skipping the IOMMU group setup for opencapi PHBs. Fixes: 0bd971676e68 ("powerpc/powernv/npu: Add compound IOMMU groups") Signed-off-by: Frederic Barrat Reviewed-by: Greg Kurz Reviewed-by: Andrew Donnellan Signed-off-by: Michael Ellerman arch/powerpc/platforms/powernv/pci-ioda.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 897bc3df8c5aebb54c32d831f917592e873d0559 Author: Breno Leitao Date: Wed Jan 9 11:16:45 2019 -0200 powerpc/tm: Limit TM code inside PPC_TRANSACTIONAL_MEM Commit e1c3743e1a20 ("powerpc/tm: Set MSR[TS] just prior to recheckpoint") moved a code block around and this block uses a 'msr' variable outside of the CONFIG_PPC_TRANSACTIONAL_MEM, however the 'msr' variable is declared inside a CONFIG_PPC_TRANSACTIONAL_MEM block, causing a possible error when CONFIG_PPC_TRANSACTION_MEM is not defined. error: 'msr' undeclared (first use in this function) This is not causing a compilation error in the mainline kernel, because 'msr' is being used as an argument of MSR_TM_ACTIVE(), which is defined as the following when CONFIG_PPC_TRANSACTIONAL_MEM is *not* set: #define MSR_TM_ACTIVE(x) 0 This patch just fixes this issue avoiding the 'msr' variable usage outside the CONFIG_PPC_TRANSACTIONAL_MEM block, avoiding trusting in the MSR_TM_ACTIVE() definition. Cc: stable@vger.kernel.org Reported-by: Christoph Biedl Fixes: e1c3743e1a20 ("powerpc/tm: Set MSR[TS] just prior to recheckpoint") Signed-off-by: Breno Leitao Signed-off-by: Michael Ellerman arch/powerpc/kernel/signal_64.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit fb0bdec51a4901b7dd088de0a1e365e1b9f5cd21 Author: Christophe Leroy Date: Wed Jan 9 20:30:07 2019 +0000 powerpc/8xx: fix setting of pagetable for Abatron BDI debug tool. Commit 8c8c10b90d88 ("powerpc/8xx: fix handling of early NULL pointer dereference") moved the loading of r6 earlier in the code. As some functions are called inbetween, r6 needs to be loaded again with the address of swapper_pg_dir in order to set PTE pointers for the Abatron BDI. Fixes: 8c8c10b90d88 ("powerpc/8xx: fix handling of early NULL pointer dereference") Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman arch/powerpc/kernel/head_8xx.S | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit d7b6cc199b2dea602b4a2a681cf6d3223a61e2be Author: Dan Carpenter Date: Wed Jan 9 13:23:29 2019 +0300 powerpc/powernv/npu: Allocate enough memory in pnv_try_setup_npu_table_group() There is a typo so we accidentally allocate enough memory for a pointer when we wanted to allocate enough for a struct. Fixes: 0bd971676e68 ("powerpc/powernv/npu: Add compound IOMMU groups") Signed-off-by: Dan Carpenter Reviewed-by: Alexey Kardashevskiy Signed-off-by: Michael Ellerman arch/powerpc/platforms/powernv/npu-dma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 36bdf3cae09df891b191f3955c8e54a2e05d67d0 Author: Christian Brauner Date: Fri Jan 11 11:19:40 2019 +0100 binderfs: reserve devices for initial mount The binderfs instance in the initial ipc namespace will always have a reserve of 4 binder devices unless explicitly capped by specifying a lower value via the "max" mount option. This ensures when binder devices are removed (on accident or on purpose) they can always be recreated without risking that all minor numbers have already been used up. Cc: Todd Kjos Cc: Greg Kroah-Hartman Signed-off-by: Christian Brauner Signed-off-by: Greg Kroah-Hartman drivers/android/binderfs.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 21face6f0d4d033d949d5517f307a15f76a9d9f2 Author: Gustavo A. R. Silva Date: Fri Jan 4 23:55:27 2019 -0600 ARM: integrator: impd1: use struct_size() in devm_kzalloc() One of the more common cases of allocation size calculations is finding the size of a structure that has a zero-sized array at the end, along with memory for some number of elements for that array. For example: struct foo { int stuff; void *entry[]; }; instance = devm_kzalloc(dev, sizeof(struct foo) + sizeof(void *) * count, GFP_KERNEL); Instead of leaving these open-coded and prone to type mistakes, we can now use the new struct_size() helper: instance = devm_kzalloc(dev, struct_size(instance, entry, count), GFP_KERNEL); This code was detected with the help of Coccinelle. Signed-off-by: Gustavo A. R. Silva arch/arm/mach-integrator/impd1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e8e683ae9a736407a20135df7809090a446db707 Author: Robin Murphy Date: Mon Jan 7 17:04:50 2019 +0000 iommu/of: Fix probe-deferral Whilst iommu_probe_device() does check for non-NULL ops as the previous code did, it does not do so in the same order relative to the other checks, and as a result means that -EPROBE_DEFER returned by of_xlate() (plus any real error condition too) gets overwritten with -EINVAL and leads to various misbehaviour. Reinstate the original logic, but without implicitly relying on ops being set to infer !err as the initial condition (now that the validity of ops for its own sake is checked elsewhere). Fixes: 641fb0efbff0 ("iommu/of: Don't call iommu_ops->add_device directly") Signed-off-by: Robin Murphy Signed-off-by: Joerg Roedel drivers/iommu/of_iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 279667212ab2a4f36c3b0347657ddcc11f9cfa25 Author: AKASHI Takahiro Date: Fri Jan 11 16:40:21 2019 +0900 arm64: kexec_file: return successfully even if kaslr-seed doesn't exist In kexec_file_load, kaslr-seed property of the current dtb will be deleted any way before setting a new value if possible. It doesn't matter whether it exists in the current dtb. So "ret" should be reset to 0 here. Fixes: commit 884143f60c89 ("arm64: kexec_file: add kaslr support") Signed-off-by: AKASHI Takahiro Signed-off-by: Will Deacon arch/arm64/kernel/machine_kexec_file.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit c7777236dd8f587f6a8d6800c03df318fd4d2627 Author: Jean-Philippe Brucker Date: Thu Jan 10 18:41:51 2019 +0000 ACPI/IORT: Fix rc_dma_get_range() When executed for a PCI_ROOT_COMPLEX type, iort_match_node_callback() expects the opaque pointer argument to be a PCI bus device. At the moment rc_dma_get_range() passes the PCI endpoint instead of the bus, and we've been lucky to have pci_domain_nr(ptr) return 0 instead of crashing. Pass the bus device to iort_scan_node(). Fixes: 5ac65e8c8941 ("ACPI/IORT: Support address size limit for root complexes") Reported-by: Eric Auger Signed-off-by: Jean-Philippe Brucker Signed-off-by: Lorenzo Pieralisi Reviewed-by: Eric Auger Acked-by: Robin Murphy Cc: stable@vger.kernel.org Cc: Will Deacon Cc: Hanjun Guo Cc: Sudeep Holla Cc: Catalin Marinas Cc: "Rafael J. Wysocki" Signed-off-by: Will Deacon drivers/acpi/arm64/iort.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit fb4129b9279dc40be51060004e8f5e4b360739b8 Merge: beaf3d1901f4 298e59d32295 Author: Daniel Borkmann Date: Fri Jan 11 10:40:55 2019 +0100 Merge branch 'bpf-fix-bitfield-printing' Yonghong Song says: ==================== The previous BTF kind_flag support patch set introduced a bug for kernel bpffs pretty printing and another bug for bpftool map pretty printing. If a bitfield struct member offset is greater than 256 bits, printed value for that struct member will be incorrect. - Patch #1 fixed the bug in kernel bpffs pretty printing. - Patch #2 enhanced the test_btf test case to cover the issue exposed by patch #1. - Patch #3 fixed the bug in bpftool map pretty printing. ==================== Signed-off-by: Daniel Borkmann commit 298e59d322954e89ed2a556c601a04a4c007d1b3 Author: Yonghong Song Date: Thu Jan 10 11:14:02 2019 -0800 tools/bpf: fix bpftool map dump with bitfields Commit 8772c8bc093b ("tools: bpftool: support pretty print with kind_flag set") added bpftool map dump with kind_flag support. When bitfield_size can be retrieved directly from btf_member, function btf_dumper_bitfield() is called to dump the bitfield. The implementation passed the wrong parameter "bit_offset" to the function. The excepted value is the bit_offset within a byte while the passed-in value is the struct member offset. This commit fixed the bug with passing correct "bit_offset" with adjusted data pointer. Fixes: 8772c8bc093b ("tools: bpftool: support pretty print with kind_flag set") Acked-by: Martin KaFai Lau Signed-off-by: Yonghong Song Signed-off-by: Daniel Borkmann tools/bpf/bpftool/btf_dumper.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) commit e43207fa2e6130e39e3aca4c55e2ee21cfb46828 Author: Yonghong Song Date: Thu Jan 10 11:14:01 2019 -0800 tools/bpf: test btf bitfield with >=256 struct member offset This patch modified test_btf pretty print test to cover the bitfield with struct member equal to or greater 256. Without the previous kernel patch fix, the modified test will fail: $ test_btf -p ...... BTF pretty print array(#1)......unexpected pprint output expected: 0: {0,0,0,0x3,0x0,0x3,{0|[0,0,0,0,0,0,0,0]},ENUM_ZERO,4,0x1} read: 0: {0,0,0,0x3,0x0,0x3,{0|[0,0,0,0,0,0,0,0]},ENUM_ZERO,4,0x0} BTF pretty print array(#2)......unexpected pprint output expected: 0: {0,0,0,0x3,0x0,0x3,{0|[0,0,0,0,0,0,0,0]},ENUM_ZERO,4,0x1} read: 0: {0,0,0,0x3,0x0,0x3,{0|[0,0,0,0,0,0,0,0]},ENUM_ZERO,4,0x0} PASS:6 SKIP:0 FAIL:2 With the kernel fix, the modified test will succeed: $ test_btf -p ...... BTF pretty print array(#1)......OK BTF pretty print array(#2)......OK PASS:8 SKIP:0 FAIL:0 Fixes: 9d5f9f701b18 ("bpf: btf: fix struct/union/fwd types with kind_flag") Acked-by: Martin KaFai Lau Signed-off-by: Yonghong Song Signed-off-by: Daniel Borkmann tools/testing/selftests/bpf/test_btf.c | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-) commit 17e3ac812541f73224299d8958ddb420c2d5bbd8 Author: Yonghong Song Date: Thu Jan 10 11:14:00 2019 -0800 bpf: fix bpffs bitfield pretty print Commit 9d5f9f701b18 ("bpf: btf: fix struct/union/fwd types with kind_flag") introduced kind_flag and used bitfield_size in the btf_member to directly pretty print member values. The commit contained a bug where the incorrect parameters could be passed to function btf_bitfield_seq_show(). The bits_offset parameter in the function expects a value less than 8. Instead, the member offset in the structure is passed. The below is btf_bitfield_seq_show() func signature: void btf_bitfield_seq_show(void *data, u8 bits_offset, u8 nr_bits, struct seq_file *m) both bits_offset and nr_bits are u8 type. If the bitfield member offset is greater than 256, incorrect value will be printed. This patch fixed the issue by calculating correct proper data offset and bits_offset similar to non kind_flag case. Fixes: 9d5f9f701b18 ("bpf: btf: fix struct/union/fwd types with kind_flag") Acked-by: Martin KaFai Lau Signed-off-by: Yonghong Song Signed-off-by: Daniel Borkmann kernel/bpf/btf.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 06382deac2b8a49bbc5aaa3c9118fed6da4a1ac1 Author: Greg Kroah-Hartman Date: Fri Jan 11 10:40:13 2019 +0100 Revert "staging: rtl8723bs: Mark ACPI table declaration as used" This reverts commit e6d093719e22a09e778edde192dfd89a0cd77b5c. Turns out it is not needed at all, a fix for clang was made and accepted upstream in that project that makes this change unnecessary. So revert it. Reported-by: Nick Desaulniers Cc: Nathan Chancellor Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8723bs/os_dep/sdio_intf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e2d3c414ec0f9d1557c8c5ff2c32166e68bbc4ad Merge: 95681cda8dcc f299e0bdbaeb Author: Daniel Vetter Date: Fri Jan 11 10:26:21 2019 +0100 Merge tag 'drm-intel-fixes-2019-01-11' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes i915 fixes for v5.0-rc2: - Disable PSR for Apple panels - Broxton ERR_PTR error state fix - Kabylake VECS workaround fix - Unwind failure on pinning the gen7 ppgtt - GVT workload request allocation fix Signed-off-by: Daniel Vetter From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87pnt35z8h.fsf@intel.com commit 95681cda8dcc3e90f25b3e0c84c49778dae43346 Merge: ae5e5ae90d32 4089e272ac61 Author: Daniel Vetter Date: Fri Jan 11 10:25:05 2019 +0100 Merge tag 'drm-misc-fixes-2019-01-10-1' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Second pull request, drm-misc-fixes for v5.0-rc2: - Fix fb-helper to work correctly with SDL 1.2 bugs. - Fix lockdep warning in the atomic ioctl and setproperty. Signed-off-by: Daniel Vetter From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/2cf24f5c-2b1f-befa-8d08-058661146b61@linux.intel.com commit c13295ad219d8bb0e47942d4cfc8251de449a67e Author: Christian Brauner Date: Fri Jan 11 00:25:41 2019 +0100 binderfs: rename header to binderfs.h It doesn't make sense to call the header binder_ctl.h when its sole existence is tied to binderfs. So give it a sensible name. Users will far more easily remember binderfs.h than binder_ctl.h. Signed-off-by: Christian Brauner Signed-off-by: Greg Kroah-Hartman drivers/android/binderfs.c | 2 +- include/uapi/linux/android/{binder_ctl.h => binderfs.h} | 0 2 files changed, 1 insertion(+), 1 deletion(-) commit 849d540ddfcd4f232f3b2cf40a2e07eccbd6212c Author: Christian Brauner Date: Wed Jan 2 12:32:18 2019 +0100 binderfs: implement "max" mount option Since binderfs can be mounted by userns root in non-initial user namespaces some precautions are in order. First, a way to set a maximum on the number of binder devices that can be allocated per binderfs instance and second, a way to reserve a reasonable chunk of binderfs devices for the initial ipc namespace. A first approach as seen in [1] used sysctls similiar to devpts but was shown to be flawed (cf. [2] and [3]) since some aspects were unneeded. This is an alternative approach which avoids sysctls completely and instead switches to a single mount option. Starting with this commit binderfs instances can be mounted with a limit on the number of binder devices that can be allocated. The max= mount option serves as a per-instance limit. If max= is set then only number of binder devices can be allocated in this binderfs instance. This allows to safely bind-mount binderfs instances into unprivileged user namespaces since userns root in a non-initial user namespace cannot change the mount option as long as it does not own the mount namespace the binderfs mount was created in and hence cannot drain the host of minor device numbers [1]: https://lore.kernel.org/lkml/20181221133909.18794-1-christian@brauner.io/ [2]; https://lore.kernel.org/lkml/20181221163316.GA8517@kroah.com/ [3]: https://lore.kernel.org/lkml/CAHRSSEx+gDVW4fKKK8oZNAir9G5icJLyodO8hykv3O0O1jt2FQ@mail.gmail.com/ [4]: https://lore.kernel.org/lkml/20181221192044.5yvfnuri7gdop4rs@brauner.io/ Cc: Todd Kjos Cc: Greg Kroah-Hartman Signed-off-by: Christian Brauner Signed-off-by: Greg Kroah-Hartman drivers/android/binderfs.c | 104 ++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 98 insertions(+), 6 deletions(-) commit 65a4f3a1efda8e0cc2516301fc3ad64e3eca716c Merge: 2b531d71595d 2e61069b056f 7d7b467cb95b b9ced18acf68 Author: Rafael J. Wysocki Date: Fri Jan 11 10:12:07 2019 +0100 Merge branches 'acpi-pci', 'acpi-power' and 'acpi-misc' * acpi-pci: ACPI: Fix build failure when CONFIG_NLS is set to 'n' * acpi-power: ACPI: power: Skip duplicate power resource references in _PRx * acpi-misc: ACPI: NUMA: Use correct type for printing addresses on i386-PAE commit 343e60e52a3a093bb7baeca441789724fcac4bb5 Merge: ca27e4cd0bdd 7604bf092098 0e141d1c65c1 6e863844ad6e Author: Rafael J. Wysocki Date: Fri Jan 11 10:09:51 2019 +0100 Merge branches 'pm-cpuidle', 'pm-cpufreq' and 'pm-sleep' * pm-cpuidle: doc: trace: fix reference to cpuidle documentation file cpuidle / Documentation: Update cpuidle MAINTAINERS entry * pm-cpufreq: cpufreq: scmi: Fix frequency invariance in slow path cpufreq: check if policy is inactive early in __cpufreq_get() cpufreq: scpi/scmi: Fix freeing of dynamic OPPs cpufreq / Documentation: Update cpufreq MAINTAINERS entry * pm-sleep: PM: sleep: call devfreq suspend/resume commit d04e779fb1dbeedf8a60b66d0d0048be4e65d366 Author: Wei Yongjun Date: Thu Jan 10 14:07:42 2019 +0000 gpio: pca953x: Make symbol 'pca953x_i2c_regmap' static Fixes the following sparse warning: drivers/gpio/gpio-pca953x.c:292:28: warning: symbol 'pca953x_i2c_regmap' was not declared. Should it be static? Fixes: 49427232764d ("gpio: pca953x: Perform basic regmap conversion") Signed-off-by: Wei Yongjun Reviewed-by: Marek Vasut Signed-off-by: Linus Walleij drivers/gpio/gpio-pca953x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ae5e5ae90d32667e107ba0bd2f1dc9e20a08dfaf Merge: f34c48e06ddc a5176a4cb85b Author: Dave Airlie Date: Fri Jan 11 17:25:00 2019 +1000 Merge branch 'linux-4.21' of git://github.com/skeggsb/linux into drm-fixes 3 nouveau fixes: one backlight, falcon register access, and a fan fix. Signed-off-by: Dave Airlie From: Ben Skeggs Link: https://patchwork.freedesktop.org/patch/msgid/CACAvsv4MHr=Rq3FkZFTYWPc7o5-dTWFysXB=wN2L91SYeFbzkQ@mail.gmail.com commit 4e72ee8872279a70ebe973172133b98e8acbf54e Merge: 576b50ea2356 15c03092a9fb Author: Ingo Molnar Date: Fri Jan 11 08:12:09 2019 +0100 Merge tag 'perf-core-for-mingo-5.0-20190110' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/core fixes and improvements from Arnaldo Carvalho de Melo: perf trace: Ravi Bangoria: - Rework PowerPC syscall table generation, now using a .tbl file just like x86_64 and S/390, also silencing a tools build warning about headers out of sync with the kernel sources. tools include uapi: Arnaldo Carvalho de Melo: - Sync linux/if_link.h copy with the kernel sources, silencing a build warning. perf top: Arnaldo Carvalho de Melo: - Add 'arch_cpu_idle' to the list of kernel idle symbols, noticed on a Orange Pi Zero ARM board, just like with other symbols in other arches. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit a5176a4cb85bb6213daadf691097cf411da35df2 Author: Ilia Mirkin Date: Thu Dec 13 22:44:08 2018 -0500 drm/nouveau/falcon: avoid touching registers if engine is off Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=108980 Signed-off-by: Ilia Mirkin Signed-off-by: Ben Skeggs drivers/gpu/drm/nouveau/nvkm/engine/falcon.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 118780066e30c34de3d9349710b51780bfa0ba83 Author: Takashi Iwai Date: Wed Sep 12 12:58:43 2018 +0200 drm/nouveau: Don't disable polling in fallback mode When a fan is controlled via linear fallback without cstate, we shouldn't stop polling. Otherwise it won't be adjusted again and keeps running at an initial crazy pace. Fixes: 800efb4c2857 ("drm/nouveau/drm/therm/fan: add a fallback if no fan control is specified in the vbios") Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1103356 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=107447 Reported-by: Thomas Blume Signed-off-by: Takashi Iwai Reviewed-by: Martin Peres Signed-off-by: Ben Skeggs drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 15f77c4ade3364106a3a397f0a8d6fce9d6a6326 Author: Ben Skeggs Date: Fri Jan 11 16:08:20 2019 +1000 drm/nouveau: register backlight on pascal and newer Signed-off-by: Ben Skeggs drivers/gpu/drm/nouveau/nouveau_backlight.c | 3 +++ 1 file changed, 3 insertions(+) commit 5b0e7310a2a33c06edc7eb81ffc521af9b2c5610 Author: Stephen Smalley Date: Wed Jan 9 10:55:10 2019 -0500 selinux: fix GPF on invalid policy levdatum->level can be NULL if we encounter an error while loading the policy during sens_read prior to initializing it. Make sure sens_destroy handles that case correctly. Reported-by: syzbot+6664500f0f18f07a5c0e@syzkaller.appspotmail.com Signed-off-by: Stephen Smalley Signed-off-by: Paul Moore security/selinux/ss/policydb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 8615f5596335db0978cea593dcd0070dc5f8b116 Author: Martin Blumenstingl Date: Sat Dec 29 13:57:11 2018 +0100 ARM: dts: meson8m2: mxiii-plus: mark the SD card detection GPIO active-low After commit 89a5e15bcba87d ("gpio/mmc/of: Respect polarity in the device tree") SD cards are not detected anymore. The CD GPIO is "active low" on the MXIII-Plus. The MMC dt-bindings specify: "[...] using the "cd-inverted" property means, that the CD line is active high, i.e. it is high, when a card is inserted". Fix the description of the SD card by marking it as GPIO_ACTIVE_LOW and drop the "cd-inverted" property. This makes the definition consistent with the existing dt-bindings and fixes the check whether an SD card is inserted. Fixes: 35ee52bea66c74 ("ARM: dts: meson8m2: add support for the Tronsmart MXIII Plus") Signed-off-by: Martin Blumenstingl Reviewed-by: Linus Walleij Signed-off-by: Kevin Hilman arch/arm/boot/dts/meson8m2-mxiii-plus.dts | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit c8bfe65fb1fb7a43d766df1dfa379406112cba61 Author: Martin Blumenstingl Date: Sat Dec 29 13:57:10 2018 +0100 ARM: dts: meson8b: ec100: mark the SD card detection GPIO active-low After commit 89a5e15bcba87d ("gpio/mmc/of: Respect polarity in the device tree") SD cards are not detected anymore. The CD GPIO is "active low" on the EC-100. The MMC dt-bindings specify: "[...] using the "cd-inverted" property means, that the CD line is active high, i.e. it is high, when a card is inserted". Fix the description of the SD card by marking it as GPIO_ACTIVE_LOW and drop the "cd-inverted" property. This makes the definition consistent with the existing dt-bindings and fixes the check whether an SD card is inserted. Fixes: bbedc1f1d90e33 ("ARM: dts: meson8b: Add support for the Endless Mini (EC-100)") Signed-off-by: Martin Blumenstingl Reviewed-by: Linus Walleij Signed-off-by: Kevin Hilman arch/arm/boot/dts/meson8b-ec100.dts | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 3fb348e030319f20ebbde082a449d4bf8a96f2fd Author: Martin Blumenstingl Date: Sat Dec 29 13:57:09 2018 +0100 ARM: dts: meson8b: odroidc1: mark the SD card detection GPIO active-low After commit 89a5e15bcba87d ("gpio/mmc/of: Respect polarity in the device tree") SD cards are not detected anymore. The CD GPIO is "active low" on Odroid-C1. The MMC dt-bindings specify: "[...] using the "cd-inverted" property means, that the CD line is active high, i.e. it is high, when a card is inserted". Fix the description of the SD card by marking it as GPIO_ACTIVE_LOW and drop the "cd-inverted" property. This makes the definition consistent with the existing dt-bindings and fixes the check whether an SD card is inserted. Fixes: e03efbce6bebf5 ("ARM: dts: meson8b-odroidc1: add microSD support") Signed-off-by: Martin Blumenstingl Reviewed-by: Linus Walleij Tested-by: Anand Moon Signed-off-by: Kevin Hilman arch/arm/boot/dts/meson8b-odroidc1.dts | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit e35e26b26e955c53e61c154ba26b9bb15da6b858 Author: Carlo Caione Date: Fri Dec 7 10:52:31 2018 +0000 arm: dts: meson: Fix IRQ trigger type for macirq A long running stress test on a custom board shipping an AXG SoCs and a Realtek RTL8211F PHY revealed that after a few hours the connection speed would drop drastically, from ~1000Mbps to ~3Mbps. At the same time the 'macirq' (eth0) IRQ would stop being triggered at all and as consequence the GMAC IRQs never ACKed. After a painful investigation the problem seemed to be due to a wrong defined IRQ type for the GMAC IRQ that should be LEVEL_HIGH instead of EDGE_RISING. The change in the macirq IRQ type also solved another long standing issue affecting this SoC/PHY where EEE was causing the network connection to die after stressing it with iperf3 (even though much sooner). It's now possible to remove the 'eee-broken-1000t' quirk as well. Fixes: 9c15795a4f96 ("ARM: dts: meson8b-odroidc1: ethernet support") Signed-off-by: Carlo Caione Reviewed-by: Martin Blumenstingl Tested-by: Martin Blumenstingl Signed-off-by: Kevin Hilman arch/arm/boot/dts/meson.dtsi | 2 +- arch/arm/boot/dts/meson8b-odroidc1.dts | 1 - 2 files changed, 1 insertion(+), 2 deletions(-) commit 9d9f59b4204bc41896c866b3e5856e5b416aa199 Author: Leon Romanovsky Date: Thu Jan 10 08:15:45 2019 +0200 RDMA/mthca: Clear QP objects during their allocation As part of audit process to update drivers to use rdma_restrack_add() ensure that QP objects is cleared before access. Such change fixes the crash observed with uninitialized non zero sgid attr accessed by ib_destroy_qp(). CPU: 3 PID: 74 Comm: kworker/u16:1 Not tainted 4.19.10-300.fc29.x86_64 Workqueue: ipoib_wq ipoib_cm_tx_reap [ib_ipoib] RIP: 0010:rdma_put_gid_attr+0x9/0x30 [ib_core] RSP: 0018:ffffb7ad819dbde8 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffff8d1bdf5a2e00 RCX: 0000000000002699 RDX: 206c656e72656af8 RSI: ffff8d1bf7ae6160 RDI: 206c656e72656b20 RBP: 0000000000000000 R08: 0000000000026160 R09: ffffffffc06b45bf R10: ffffe849887da000 R11: 0000000000000002 R12: ffff8d1be30cb400 R13: ffff8d1bdf681800 R14: ffff8d1be2272400 R15: ffff8d1be30ca000 FS: 0000000000000000(0000) GS:ffff8d1bf7ac0000(0000) knlGS:0000000000000000 Trace: ib_destroy_qp+0xc9/0x240 [ib_core] ipoib_cm_tx_reap+0x1f9/0x4e0 [ib_ipoib] process_one_work+0x1a1/0x3a0 worker_thread+0x30/0x380 ? pwq_unbound_release_workfn+0xd0/0xd0 kthread+0x112/0x130 ? kthread_create_worker_on_cpu+0x70/0x70 ret_from_fork+0x22/0x40 Reported-by: Alexander Murashkin Tested-by: Alexander Murashkin Fixes: 1a1f460ff151 ("RDMA: Hold the sgid_attr inside the struct ib_ah/qp") Signed-off-by: Parav Pandit Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/mthca/mthca_provider.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 6325e01b6cdf4636b721cf7259c1616e3cf28ce2 Author: Adit Ranadive Date: Wed Jan 9 23:08:49 2019 +0000 RDMA/vmw_pvrdma: Return the correct opcode when creating WR Since the IB_WR_REG_MR opcode value changed, let's set the PVRDMA device opcodes explicitly. Reported-by: Ruishuang Wang Fixes: 9a59739bd01f ("IB/rxe: Revise the ib_wr_opcode enum") Cc: stable@vger.kernel.org Reviewed-by: Bryan Tan Reviewed-by: Ruishuang Wang Reviewed-by: Vishnu Dasa Signed-off-by: Adit Ranadive Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/vmw_pvrdma/pvrdma.h | 35 +++++++++++++++++++++++++++- drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c | 6 +++++ include/uapi/rdma/vmw_pvrdma-abi.h | 1 + 3 files changed, 41 insertions(+), 1 deletion(-) commit 10f4e765879e514e1ce7f52ed26603047af196e2 Author: wenxu Date: Thu Jan 10 14:51:35 2019 +0800 netfilter: nft_flow_offload: fix interaction with vrf slave device In the forward chain, the iif is changed from slave device to master vrf device. Thus, flow offload does not find a match on the lower slave device. This patch uses the cached route, ie. dst->dev, to update the iif and oif fields in the flow entry. After this patch, the following example works fine: # ip addr add dev eth0 1.1.1.1/24 # ip addr add dev eth1 10.0.0.1/24 # ip link add user1 type vrf table 1 # ip l set user1 up # ip l set dev eth0 master user1 # ip l set dev eth1 master user1 # nft add table firewall # nft add flowtable f fb1 { hook ingress priority 0 \; devices = { eth0, eth1 } \; } # nft add chain f ftb-all {type filter hook forward priority 0 \; policy accept \; } # nft add rule f ftb-all ct zone 1 ip protocol tcp flow offload @fb1 # nft add rule f ftb-all ct zone 1 ip protocol udp flow offload @fb1 Signed-off-by: wenxu Signed-off-by: Pablo Neira Ayuso include/net/netfilter/nf_flow_table.h | 1 - net/netfilter/nf_flow_table_core.c | 5 +++-- net/netfilter/nft_flow_offload.c | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) commit e2c8d550a973bb34fc28bc8d0ec996f84562fb8a Author: Shakeel Butt Date: Wed Jan 2 19:14:31 2019 -0800 netfilter: ebtables: account ebt_table_info to kmemcg The [ip,ip6,arp]_tables use x_tables_info internally and the underlying memory is already accounted to kmemcg. Do the same for ebtables. The syzbot, by using setsockopt(EBT_SO_SET_ENTRIES), was able to OOM the whole system from a restricted memcg, a potential DoS. By accounting the ebt_table_info, the memory used for ebt_table_info can be contained within the memcg of the allocating process. However the lifetime of ebt_table_info is independent of the allocating process and is tied to the network namespace. So, the oom-killer will not be able to relieve the memory pressure due to ebt_table_info memory. The memory for ebt_table_info is allocated through vmalloc. Currently vmalloc does not handle the oom-killed allocating process correctly and one large allocation can bypass memcg limit enforcement. So, with this patch, at least the small allocations will be contained. For large allocations, we need to fix vmalloc. Reported-by: syzbot+7713f3aa67be76b1552c@syzkaller.appspotmail.com Signed-off-by: Shakeel Butt Reviewed-by: Kirill Tkhai Signed-off-by: Pablo Neira Ayuso net/bridge/netfilter/ebtables.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit b67d4530cdade7ebfafa2c6b46f2a0dad3e41bcb Author: Sowjanya Komatineni Date: Tue Jan 8 13:59:10 2019 -0800 i2c: tegra: Fix Maximum transfer size Tegra194 supports maximum 64K Bytes transfer per packet. Tegra186 and prior supports maximum 4K Bytes transfer per packet. This patch fixes this payload difference between Tegra194 and prior Tegra chipsets using separate i2c_adapter_quirks. Signed-off-by: Sowjanya Komatineni Acked-by: Thierry Reding Signed-off-by: Wolfram Sang drivers/i2c/busses/i2c-tegra.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) commit 6ebec961d59bccf65d08b13fc1ad4e6272a89338 Author: Yi Zeng Date: Wed Jan 9 15:33:07 2019 +0800 i2c: dev: prevent adapter retries and timeout being set as minus value If adapter->retries is set to a minus value from user space via ioctl, it will make __i2c_transfer and __i2c_smbus_xfer skip the calling to adapter->algo->master_xfer and adapter->algo->smbus_xfer that is registered by the underlying bus drivers, and return value 0 to all the callers. The bus driver will never be accessed anymore by all users, besides, the users may still get successful return value without any error or information log print out. If adapter->timeout is set to minus value from user space via ioctl, it will make the retrying loop in __i2c_transfer and __i2c_smbus_xfer always break after the the first try, due to the time_after always returns true. Signed-off-by: Yi Zeng [wsa: minor grammar updates to commit message] Signed-off-by: Wolfram Sang Cc: stable@kernel.org drivers/i2c/i2c-dev.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 2076607a20bd4dfba699185616cbbbce06d3fa59 Author: Fabio Estevam Date: Wed Dec 26 10:06:19 2018 -0200 qcom-scm: Include header Since commit e6f6d63ed14c ("drm/msm: add headless gpu device for imx5") the DRM_MSM symbol can be selected by SOC_IMX5 causing the following error when building imx_v6_v7_defconfig: In file included from ../drivers/gpu/drm/msm/adreno/a5xx_gpu.c:17:0: ../include/linux/qcom_scm.h: In function 'qcom_scm_set_cold_boot_addr': ../include/linux/qcom_scm.h:73:10: error: 'ENODEV' undeclared (first use in this function) return -ENODEV; Include the header file to fix this problem. Reported-by: kernelci.org bot Fixes: e6f6d63ed14c ("drm/msm: add headless gpu device for imx5") Signed-off-by: Fabio Estevam Reviewed-by: Bjorn Andersson Tested-by: Guenter Roeck Signed-off-by: Andy Gross include/linux/qcom_scm.h | 1 + 1 file changed, 1 insertion(+) commit a39c330d7436530151a619319f7ff6e9b3a6d8c6 Merge: 5db470e229e2 b8a38ea64dc7 Author: Jens Axboe Date: Thu Jan 10 15:29:57 2019 -0700 Merge branch 'nvme-5.0' of git://git.infradead.org/nvme into for-linus Pull NVMe fixes from Christoph. * 'nvme-5.0' of git://git.infradead.org/nvme: nvme: don't initlialize ctrl->cntlid twice nvme: introduce NVME_QUIRK_IGNORE_DEV_SUBNQN nvme: pad fake subsys NQN vid and ssvid with zeros nvme-multipath: zero out ANA log buffer nvme-fabrics: unset write/poll queues for discovery controllers nvme-tcp: don't ask if controller is fabrics nvme-tcp: remove dead code nvme-pci: fix out of bounds access in nvme_cqe_pending nvme-pci: rerun irq setup on IO queue init errors nvme-pci: use the same attributes when freeing host_mem_desc_bufs. nvme-pci: fix the wrong setting of nr_maps commit 8ce5f84157530ffa64b3e0acf00b9261f41c8da8 Author: Rob Herring Date: Tue Dec 11 14:31:05 2018 -0600 of: Remove struct device_node.type pointer Now that all users of device_node.type pointer have been removed in favor of accessor functions, we can remove it. Cc: Frank Rowand Cc: devicetree@vger.kernel.org Signed-off-by: Rob Herring drivers/of/dynamic.c | 3 --- drivers/of/fdt.c | 4 ---- drivers/of/overlay.c | 3 --- drivers/of/pdt.c | 1 - include/linux/of.h | 1 - 5 files changed, 12 deletions(-) commit de6629eb262e0dc52a2367db38e3d2780cff5427 Merge: 4f548c25a38e a3869d43c980 Author: Linus Torvalds Date: Thu Jan 10 14:16:47 2019 -0800 Merge tag 'pci-v5.0-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI fix from Bjorn Helgaas: "Fix Amlogic Meson host controller driver build failure (Corentin Labbe)" * tag 'pci-v5.0-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: PCI: amlogic: Fix build failure due to missing gpio header commit b19bce0335e25b9069ddb10d234e673bbd46d2f4 Author: Heiner Kallweit Date: Wed Jan 9 08:20:28 2019 +0100 net: ethernet: mediatek: fix warning in phy_start_aneg linux 5.0-rc1 shows following warning on bpi-r2/mt7623 bootup: [ 5.170597] WARNING: CPU: 3 PID: 1 at drivers/net/phy/phy.c:548 phy_start_aneg+0x110/0x144 [ 5.178826] called from state READY .... [ 5.264111] [] (phy_start_aneg) from [] (mtk_init+0x414/0x47c) [ 5.271630] r7:df5f5eec r6:c0f08c48 r5:00000000 r4:dea67800 [ 5.277256] [] (mtk_init) from [] (register_netdevice+0x98/0x51c) [ 5.285035] r8:00000000 r7:00000000 r6:c0f97080 r5:c0f08c48 r4:dea67800 [ 5.291693] [] (register_netdevice) from [] (register_netdev+0x2c/0x44) [ 5.299989] r8:00000000 r7:dea2e608 r6:deacea00 r5:dea2e604 r4:dea67800 [ 5.306646] [] (register_netdev) from [] (mtk_probe+0x668/0x7ac) [ 5.314336] r5:dea2e604 r4:dea2e040 [ 5.317890] [] (mtk_probe) from [] (platform_drv_probe+0x58/0xa8) [ 5.325670] r10:c0f86bac r9:00000000 r8:c0fbe578 r7:00000000 r6:c0f86bac r5:00000000 [ 5.333445] r4:deacea10 [ 5.335963] [] (platform_drv_probe) from [] (really_probe+0x2d8/0x424) maybe other boards using this generic driver are affected v2: optimization: - phy_set_max_speed() is only needed if you want to reduce the max speed, typically if the PHY supports 1Gbps but the MAC supports 100Mbps only. - The pause parameters are autonegotiated. Except you have a specific need you normally don't need to manually fiddle with this. - phy_start_aneg() is called implicitly by the phylib state machine, you shouldn't call it manually except you have a good excuse. - netif_carrier_on/netif_carrier_off in mtk_phy_link_adjust() isn't needed. It's done by phy_link_change() in phylib. Signed-off-by: Frank Wunderlich Reviewed-by: Heiner Kallweit Acked-by: Sean Wang Signed-off-by: David S. Miller drivers/net/ethernet/mediatek/mtk_eth_soc.c | 16 ---------------- 1 file changed, 16 deletions(-) commit c5715b8fabfca0ef85903f8bad2189940ed41cc8 Author: Yuchung Cheng Date: Tue Jan 8 18:14:28 2019 -0800 tcp: change txhash on SYN-data timeout Previously upon SYN timeouts the sender recomputes the txhash to try a different path. However this does not apply on the initial timeout of SYN-data (active Fast Open). Therefore an active IPv6 Fast Open connection may incur one second RTO penalty to take on a new path after the second SYN retransmission uses a new flow label. This patch removes this undesirable behavior so Fast Open changes the flow label just like the regular connections. This also helps avoid falsely disabling Fast Open on the sender which triggers after two consecutive SYN timeouts on Fast Open. Signed-off-by: Yuchung Cheng Reviewed-by: Neal Cardwell Signed-off-by: David S. Miller net/ipv4/tcp_timer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ea89098ef9a574bceca00d3b5df14aaf0b3f9ccf Author: Andrew Lunn Date: Wed Jan 9 00:24:03 2019 +0100 net: dsa: mv88x6xxx: mv88e6390 errata The 6390 copper ports have an errata which require poking magic values into undocumented magic registers and then performing a software reset. Signed-off-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx/chip.c | 113 +++++++++++++++++++++++++++++++++++++++ drivers/net/dsa/mv88e6xxx/chip.h | 5 ++ drivers/net/dsa/mv88e6xxx/port.h | 10 ++++ 3 files changed, 128 insertions(+) commit 001e465f09a18857443489a57e74314a3368c805 Author: Willem de Bruijn Date: Tue Jan 8 12:32:42 2019 -0500 bonding: update nest level on unlink A network device stack with multiple layers of bonding devices can trigger a false positive lockdep warning. Adding lockdep nest levels fixes this. Update the level on both enslave and unlink, to avoid the following series of events .. ip netns add test ip netns exec test bash ip link set dev lo addr 00:11:22:33:44:55 ip link set dev lo down ip link add dev bond1 type bond ip link add dev bond2 type bond ip link set dev lo master bond1 ip link set dev bond1 master bond2 ip link set dev bond1 nomaster ip link set dev bond2 master bond1 .. from still generating a splat: [ 193.652127] ====================================================== [ 193.658231] WARNING: possible circular locking dependency detected [ 193.664350] 4.20.0 #8 Not tainted [ 193.668310] ------------------------------------------------------ [ 193.674417] ip/15577 is trying to acquire lock: [ 193.678897] 00000000a40e3b69 (&(&bond->stats_lock)->rlock#3/3){+.+.}, at: bond_get_stats+0x58/0x290 [ 193.687851] but task is already holding lock: [ 193.693625] 00000000807b9d9f (&(&bond->stats_lock)->rlock#2/2){+.+.}, at: bond_get_stats+0x58/0x290 [..] [ 193.851092] lock_acquire+0xa7/0x190 [ 193.855138] _raw_spin_lock_nested+0x2d/0x40 [ 193.859878] bond_get_stats+0x58/0x290 [ 193.864093] dev_get_stats+0x5a/0xc0 [ 193.868140] bond_get_stats+0x105/0x290 [ 193.872444] dev_get_stats+0x5a/0xc0 [ 193.876493] rtnl_fill_stats+0x40/0x130 [ 193.880797] rtnl_fill_ifinfo+0x6c5/0xdc0 [ 193.885271] rtmsg_ifinfo_build_skb+0x86/0xe0 [ 193.890091] rtnetlink_event+0x5b/0xa0 [ 193.894320] raw_notifier_call_chain+0x43/0x60 [ 193.899225] netdev_change_features+0x50/0xa0 [ 193.904044] bond_compute_features.isra.46+0x1ab/0x270 [ 193.909640] bond_enslave+0x141d/0x15b0 [ 193.913946] do_set_master+0x89/0xa0 [ 193.918016] do_setlink+0x37c/0xda0 [ 193.921980] __rtnl_newlink+0x499/0x890 [ 193.926281] rtnl_newlink+0x48/0x70 [ 193.930238] rtnetlink_rcv_msg+0x171/0x4b0 [ 193.934801] netlink_rcv_skb+0xd1/0x110 [ 193.939103] rtnetlink_rcv+0x15/0x20 [ 193.943151] netlink_unicast+0x3b5/0x520 [ 193.947544] netlink_sendmsg+0x2fd/0x3f0 [ 193.951942] sock_sendmsg+0x38/0x50 [ 193.955899] ___sys_sendmsg+0x2ba/0x2d0 [ 193.960205] __x64_sys_sendmsg+0xad/0x100 [ 193.964687] do_syscall_64+0x5a/0x460 [ 193.968823] entry_SYSCALL_64_after_hwframe+0x49/0xbe Fixes: 7e2556e40026 ("bonding: avoid lockdep confusion in bond_get_stats()") Reported-by: syzbot Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller drivers/net/bonding/bond_main.c | 3 +++ 1 file changed, 3 insertions(+) commit f34c48e06ddcc197f2cf7cbc006ceb74e28e1ccf Merge: bd86c9e66c83 1c1eba86339c Author: Dave Airlie Date: Fri Jan 11 07:37:56 2019 +1000 Merge branch 'drm-fixes-5.0' of git://people.freedesktop.org/~agd5f/linux into drm-fixes - Powerplay fixes - Virtual display pinning fixes - Golden register updates for vega - Pitch and gem size validation fixes - Fix for error case in sr-iov init - Disable page tables in system memory on RV due to issues with IOMMU reported on some platforms Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20190109204336.3315-1-alexander.deucher@amd.com commit 4f548c25a38efb3589c4e797a6e87f6900345dc0 Merge: 1bdbe2274920 27de1f541f1f Author: Linus Torvalds Date: Thu Jan 10 13:36:53 2019 -0800 Merge tag 'riscv-for-linus-4.21-rc2-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/palmer/riscv-linux Pull RISC-V updates from Palmer Dabbelt: "This tag contains a handful of updates that slipped through the cracks during the merge window due to the holidays. The fixes are mostly independent, with the exception of one larger audit-related branch. Core RISC-V updates: - The BSS has been moved, which shrinks flat images. - A fix to test-bpf so it compiles on RV64I-based systems. - A fix to respect the kernel commandline when there is no device tree. - A fix to prevent CPUs from trying to put themselves to sleep when bringing down the system. - Support for MODULE_SECTIONS on RV32I-based systems. - [new in v2] The addition of an SBI earlycon driver. This is definately a new feature, but I'd like to include it now because I dropped this patch when submitting the merge window PR that removed our EARLY_PRINTK support. RISC-V audit updates: - The addition of NR_syscalls into unistd.h, which is necessary for CONFIG_FTRACE_SYSCALLS. - The definition of CREATE_TRACE_POINTS so __tracepoint_sys_{enter,exit} get defined. - A fix for trace_sys_exit() so we can enable HAVE_SYSCALL_TRACEPOINTS As usual, I've tested this by booting a Fedora-based image on a recent QEMU (this time just whatever I had lying around). * tag 'riscv-for-linus-4.21-rc2-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/palmer/riscv-linux: tty/serial: Add RISC-V SBI earlycon support riscv: add HAVE_SYSCALL_TRACEPOINTS to Kconfig riscv: fix trace_sys_exit hook riscv: define CREATE_TRACE_POINTS in ptrace.c riscv: define NR_syscalls in unistd.h riscv: audit: add audit hook in do_syscall_trace_enter/exit() riscv: add audit support RISC-V: Support MODULE_SECTIONS mechanism on RV32 MAINTAINERS: SiFive drivers: add myself as a SiFive driver maintainer MAINTAINERS: SiFive drivers: change the git tree to a SiFive git tree riscv: don't stop itself in smp_send_stop arch: riscv: support kernel command line forcing when no DTB passed tools uapi: fix RISC-V 64-bit support RISC-V: Make BSS section as the last section in vmlinux.lds.S commit bd86c9e66c8385fb437c5ad506243304a8814b65 Merge: bfeffd155283 f8c15790e4d8 Author: Dave Airlie Date: Fri Jan 11 06:32:37 2019 +1000 Merge tag 'drm-misc-fixes-2019-01-10' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes Pull request for drm-misc-fixes for v5.0-rc2: - Fixes for the tc358767 bridge to work correctly with tc358867 using a DP connector. - Make resume work on amdgpu when a DP-MST display is unplugged. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/1c47722d-c416-184d-4340-0dc6a614d685@linux.intel.com commit 8544f4aa9dd19a04d1244dae10feecc813ccf175 Author: Pavel Shilovsky Date: Sat Dec 22 12:40:05 2018 -0800 CIFS: Fix credit computation for compounded requests In SMB3 protocol every part of the compound chain consumes credits individually, so we need to call wait_for_free_credits() for each of the PDUs in the chain. If an operation is interrupted, we must ensure we return all credits taken from the server structure back. Without this patch server can sometimes disconnect the session due to credit mismatches, especially when first operation(s) are large writes. Signed-off-by: Pavel Shilovsky Signed-off-by: Steve French CC: Stable fs/cifs/transport.c | 59 +++++++++++++++++++++++++++++++++++++---------------- 1 file changed, 41 insertions(+), 18 deletions(-) commit 33fa5c8b8a7dbe6353a56eaa654b790348890d42 Author: Pavel Shilovsky Date: Thu Jan 3 16:45:13 2019 -0800 CIFS: Do not set credits to 1 if the server didn't grant anything Currently we reset the number of total credits granted by the server to 1 if the server didn't grant us anything int the response. This violates the SMB3 protocol - we need to trust the server and use the credit values from the response. Fix this by removing the corresponding code. Signed-off-by: Pavel Shilovsky Signed-off-by: Steve French CC: Stable fs/cifs/transport.c | 2 -- 1 file changed, 2 deletions(-) commit b983f7e92348d7e7d091db1b78b7915e9dd3d63a Author: Pavel Shilovsky Date: Wed Dec 19 22:49:09 2018 +0000 CIFS: Fix adjustment of credits for MTU requests Currently for MTU requests we allocate maximum possible credits in advance and then adjust them according to the request size. While we were adjusting the number of credits belonging to the server, we were skipping adjustment of credits belonging to the request. This patch fixes it by setting request credits to CreditCharge field value of SMB2 packet header. Also ask 1 credit more for async read and write operations to increase parallelism and match the behavior of other operations. Signed-off-by: Pavel Shilovsky Signed-off-by: Steve French CC: Stable fs/cifs/smb2pdu.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit c715f89c4dab76317c773df2611af2dac4dea2b7 Author: Dan Carpenter Date: Sat Jan 5 21:18:03 2019 +0300 cifs: Fix a tiny potential memory leak The most recent "it" allocation is leaked on this error path. I believe that small allocations always succeed in current kernels so this doesn't really affect run time. Fixes: 54be1f6c1c37 ("cifs: Add DFS cache routines") Signed-off-by: Dan Carpenter Signed-off-by: Steve French fs/cifs/dfs_cache.c | 1 + 1 file changed, 1 insertion(+) commit 8428817dc40006dca0a531cfa06e89cb3b41790d Author: Dan Carpenter Date: Sat Jan 5 15:25:29 2019 +0300 cifs: Fix a debug message This debug message was never shown because it was checking for NULL returns but extract_hostname() returns error pointers. Fixes: 93d5cb517db3 ("cifs: Add support for failover in cifs_reconnect()") Signed-off-by: Dan Carpenter Signed-off-by: Steve French Reviewed-by: Paulo Alcantara fs/cifs/connect.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 1856b9f7bcc8e9bdcccc360aabb56fbd4dd6c565 Author: Milan Broz Date: Wed Jan 9 11:57:14 2019 +0100 dm crypt: fix parsing of extended IV arguments The dm-crypt cipher specification in a mapping table is defined as: cipher[:keycount]-chainmode-ivmode[:ivopts] or (new crypt API format): capi:cipher_api_spec-ivmode[:ivopts] For ESSIV, the parameter includes hash specification, for example: aes-cbc-essiv:sha256 The implementation expected that additional IV option to never include another dash '-' character. But, with SHA3, there are names like sha3-256; so the mapping table parser fails: dmsetup create test --table "0 8 crypt aes-cbc-essiv:sha3-256 9c1185a5c5e9fc54612808977ee8f5b9e 0 /dev/sdb 0" or (new crypt API format) dmsetup create test --table "0 8 crypt capi:cbc(aes)-essiv:sha3-256 9c1185a5c5e9fc54612808977ee8f5b9e 0 /dev/sdb 0" device-mapper: crypt: Ignoring unexpected additional cipher options device-mapper: table: 253:0: crypt: Error creating IV device-mapper: ioctl: error adding target to table Fix the dm-crypt constructor to ignore additional dash in IV options and also remove a bogus warning (that is ignored anyway). Cc: stable@vger.kernel.org # 4.12+ Signed-off-by: Milan Broz Signed-off-by: Mike Snitzer drivers/md/dm-crypt.c | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-) commit a214720cbf50cd8c3f76bbb9c3f5c283910e9d33 Author: YunQiang Su Date: Tue Jan 8 13:45:10 2019 +0800 Disable MSI also when pcie-octeon.pcie_disable on Octeon has an boot-time option to disable pcie. Since MSI depends on PCI-E, we should also disable MSI also with this option is on in order to avoid inadvertently accessing PCIe registers. Signed-off-by: YunQiang Su Signed-off-by: Paul Burton Cc: pburton@wavecomp.com Cc: linux-mips@vger.kernel.org Cc: aaro.koskinen@iki.fi Cc: stable@vger.kernel.org # v3.3+ arch/mips/pci/msi-octeon.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit b89d82ef01b33bc50cbaa8ff05607879b40d0704 Author: Will Deacon Date: Tue Jan 8 16:19:01 2019 +0000 arm64: kpti: Avoid rewriting early page tables when KASLR is enabled A side effect of commit c55191e96caa ("arm64: mm: apply r/o permissions of VM areas to its linear alias as well") is that the linear map is created with page granularity, which means that transitioning the early page table from global to non-global mappings when enabling kpti can take a significant amount of time during boot. Given that most CPU implementations do not require kpti, this mainly impacts KASLR builds where kpti is forcefully enabled. However, in these situations we know early on that non-global mappings are required and can avoid the use of global mappings from the beginning. The only gotcha is Cavium erratum #27456, which we must detect based on the MIDR value of the boot CPU. Reviewed-by: Ard Biesheuvel Reported-by: John Garry Signed-off-by: Will Deacon arch/arm64/include/asm/mmu.h | 41 +++++++++++++++++++++++++++++++++++ arch/arm64/include/asm/pgtable-prot.h | 4 ++-- arch/arm64/kernel/cpu_errata.c | 2 +- arch/arm64/kernel/cpufeature.c | 9 ++++++-- arch/arm64/kernel/head.S | 1 + 5 files changed, 52 insertions(+), 5 deletions(-) commit 1bdbe227492075d058e37cb3d400e6468d0095b5 Merge: f0ebbe9b18e0 58fec830fc19 Author: Linus Torvalds Date: Thu Jan 10 09:20:46 2019 -0800 Merge tag 'vfio-v5.0-rc2' of git://github.com/awilliam/linux-vfio Pull VFIO fixes from Alex Williamson: - Fix trace header include path for in-tree builds (Masahiro Yamada) - Fix overflow in unmap wrap-around test (Alex Williamson) * tag 'vfio-v5.0-rc2' of git://github.com/awilliam/linux-vfio: vfio/type1: Fix unmap overflow off-by-one vfio/pci: set TRACE_INCLUDE_PATH to fix the build error commit f0ebbe9b18e0d2bb79c7963faf847b949d4f5720 Merge: e7446be4468b d1dd42110d27 Author: Linus Torvalds Date: Thu Jan 10 09:17:48 2019 -0800 Merge tag 'sound-5.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes for USB-audio, HD-audio and cs46xx. The USB-audio fixes are for out-of-bound accesses and a regression in the recent cleanup, while HD-audio fixes are usual device-specific quirks" * tag 'sound-5.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/realtek - Disable headset Mic VREF for headset mode of ALC225 ALSA: hda/realtek - Add unplug function into unplug state of Headset Mode for ALC225 ALSA: usb-audio: fix CM6206 register definitions ALSA: cs46xx: Potential NULL dereference in probe ALSA: hda/realtek - Support Dell headset mode for New AIO platform ALSA: usb-audio: Fix an out-of-bound read in create_composite_quirks ALSA: usb-audio: Always check descriptor sizes in parser code ALSA: usb-audio: Check mixer unit descriptors more strictly ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit() commit e7446be4468bb24c9e45a153bcc9f29ec0372a6f Merge: 70c25259537c 81d9bdf59092 Author: Linus Torvalds Date: Thu Jan 10 09:14:12 2019 -0800 Merge tag 'mtd/fixes-for-5.0-rc2' of git://git.infradead.org/linux-mtd Pull mtd fixes from Boris Brezillon: "Core MTD Fixes: - Fix a bug introduced when exposing MTD devs as NVMEM providers and check for add_mtd_device() return code everywhere raw NAND fixes: - Fix a memory corruption in the QCOM driver" * tag 'mtd/fixes-for-5.0-rc2' of git://git.infradead.org/linux-mtd: mtd: rawnand: qcom: fix memory corruption that causes panic mtd: Check add_mtd_device() ret code mtd: Fix the check on nvmem_register() ret code commit 5edc22cc1d33d6a88d175d25adc38d2a5cee134d Author: Marc Dionne Date: Wed Jan 9 17:23:54 2019 +0000 afs: Set correct lock type for the yfs CreateFile A lock type of 0 is "LockRead", which makes the fileserver record an unintentional read lock on the new file. This will cause problems later on if the file is the subject of locking operations. The correct default value should be -1 ("LockNone"). Fix the operation marshalling code to set the value and provide an enum to symbolise the values whilst we're at it. Fixes: 30062bd13e36 ("afs: Implement YFS support in the fs client") Signed-off-by: Marc Dionne Signed-off-by: David Howells fs/afs/protocol_yfs.h | 11 +++++++++++ fs/afs/yfsclient.c | 2 +- 2 files changed, 12 insertions(+), 1 deletion(-) commit c2b8bd49d35a768d3966c5e14e8f6971f2a63439 Author: Gustavo A. R. Silva Date: Wed Jan 9 17:23:54 2019 +0000 afs: Use struct_size() in kzalloc() One of the more common cases of allocation size calculations is finding the size of a structure that has a zero-sized array at the end, along with memory for some number of elements for that array. For example: struct foo { int stuff; void *entry[]; }; instance = kzalloc(sizeof(struct foo) + sizeof(void *) * count, GFP_KERNEL); Instead of leaving these open-coded and prone to type mistakes, we can now use the new struct_size() helper: instance = kzalloc(struct_size(instance, entry, count), GFP_KERNEL); This code was detected with the help of Coccinelle. Signed-off-by: Gustavo A. R. Silva Signed-off-by: David Howells fs/afs/server_list.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 1b3922a8bc74231f9a767d1be6d9a061a4d4eeab Author: Qu Wenruo Date: Tue Jan 8 14:08:18 2019 +0800 btrfs: Use real device structure to verify dev extent [BUG] Linux v5.0-rc1 will fail fstests/btrfs/163 with the following kernel message: BTRFS error (device dm-6): dev extent devid 1 physical offset 13631488 len 8388608 is beyond device boundary 0 BTRFS error (device dm-6): failed to verify dev extents against chunks: -117 BTRFS error (device dm-6): open_ctree failed [CAUSE] Commit cf90d884b347 ("btrfs: Introduce mount time chunk <-> dev extent mapping check") introduced strict check on dev extents. We use btrfs_find_device() with dev uuid and fs uuid set to NULL, and only dependent on @devid to find the real device. For seed devices, we call clone_fs_devices() in open_seed_devices() to allow us search seed devices directly. However clone_fs_devices() just populates devices with devid and dev uuid, without populating other essential members, like disk_total_bytes. This makes any device returned by btrfs_find_device(fs_info, devid, NULL, NULL) is just a dummy, with 0 disk_total_bytes, and any dev extents on the seed device will not pass the device boundary check. [FIX] This patch will try to verify the device returned by btrfs_find_device() and if it's a dummy then re-search in seed devices. Fixes: cf90d884b347 ("btrfs: Introduce mount time chunk <-> dev extent mapping check") CC: stable@vger.kernel.org # 4.19+ Reported-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba fs/btrfs/volumes.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit beaf3d1901f4ea46fbd5c9d857227d99751de469 Author: Song Liu Date: Tue Jan 8 14:20:44 2019 -0800 bpf: fix panic in stack_map_get_build_id() on i386 and arm32 As Naresh reported, test_stacktrace_build_id() causes panic on i386 and arm32 systems. This is caused by page_address() returns NULL in certain cases. This patch fixes this error by using kmap_atomic/kunmap_atomic instead of page_address. Fixes: 615755a77b24 (" bpf: extend stackmap to save binary_build_id+offset instead of address") Reported-by: Naresh Kamboju Signed-off-by: Song Liu Signed-off-by: Daniel Borkmann kernel/bpf/stackmap.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit f98937c6bb73ae11717a15aec85c187d33ca5d34 Author: Anders Roxell Date: Tue Jan 8 10:23:03 2019 +0100 selftests: bpf: install files tcp_(server|client)*.py When test_tcpbpf_user runs it complains that it can't find files tcp_server.py and tcp_client.py. Rework so that tcp_server.py and tcp_client.py gets installed, added them to the variable TEST_PROGS_EXTENDED. Fixes: d6d4f60c3a09 ("bpf: add selftest for tcpbpf") Signed-off-by: Anders Roxell Signed-off-by: Daniel Borkmann tools/testing/selftests/bpf/Makefile | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit df209c43a0e8258e096fb722dfbdae4f0dd13fde Author: Nicholas Mc Guire Date: Sat Dec 1 12:57:18 2018 +0100 gpio: pl061: handle failed allocations devm_kzalloc(), devm_kstrdup() and devm_kasprintf() all can fail internal allocation and return NULL. Using any of the assigned objects without checking is not safe. As this is early in the boot phase and these allocations really should not fail, any failure here is probably an indication of a more serious issue so it makes little sense to try and rollback the previous allocated resources or try to continue; but rather the probe function is simply exited with -ENOMEM. Signed-off-by: Nicholas Mc Guire Fixes: 684284b64aae ("ARM: integrator: add MMCI device to IM-PD1") Signed-off-by: Linus Walleij arch/arm/mach-integrator/impd1.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 11b36abc249f5e100d532c5271dae938fde85175 Author: Ioana Ciornei Date: Wed Jan 9 17:06:55 2019 +0000 samples: bpf: user proper argument index Use optind as index for argv instead of a hardcoded value. When the program has options this leads to improper parameter handling. Fixes: dc378a1ab5b6 ("samples: bpf: get ifindex from ifname") Signed-off-by: Ioana Ciornei Acked-by: Matteo Croce Signed-off-by: Daniel Borkmann samples/bpf/xdp1_user.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e3ca63de8ade75757a067f6a5bd111d30cdcadb5 Author: Stanislav Fomichev Date: Tue Jan 8 16:07:28 2019 -0800 selftests/bpf: add missing executables to .gitignore We build test_libbpf with CXX to make sure linking against C++ works. $ make -s -C tools/lib/bpf $ git status -sb ? tools/lib/bpf/test_libbpf $ make -s -C tools/testing/selftests/bpf $ git status -sb ? tools/lib/bpf/test_libbpf ? tools/testing/selftests/bpf/test_libbpf Fixes: 8c4905b995c6 ("libbpf: make sure bpf headers are c++ include-able") Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann tools/lib/bpf/.gitignore | 1 + tools/testing/selftests/bpf/.gitignore | 1 + 2 files changed, 2 insertions(+) commit 3fe931b31a4078395c1967f0495dcc9e5ec6b5e3 Author: Dan Carpenter Date: Mon Dec 17 10:02:42 2018 +0300 thermal: int340x_thermal: Fix a NULL vs IS_ERR() check The intel_soc_dts_iosf_init() function doesn't return NULL, it returns error pointers. Fixes: 4d0dd6c1576b ("Thermal/int340x/processor_thermal: Enable auxiliary DTS for Braswell") Signed-off-by: Dan Carpenter Signed-off-by: Zhang Rui drivers/thermal/intel/int340x_thermal/processor_thermal_device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7d033c9f6a7fd3821af75620a0257db87c2b552a Author: Eric Dumazet Date: Tue Jan 8 04:06:14 2019 -0800 ipv6: fix kernel-infoleak in ipv6_local_error() This patch makes sure the flow label in the IPv6 header forged in ipv6_local_error() is initialized. BUG: KMSAN: kernel-infoleak in _copy_to_user+0x16b/0x1f0 lib/usercopy.c:32 CPU: 1 PID: 24675 Comm: syz-executor1 Not tainted 4.20.0-rc7+ #4 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x173/0x1d0 lib/dump_stack.c:113 kmsan_report+0x12e/0x2a0 mm/kmsan/kmsan.c:613 kmsan_internal_check_memory+0x455/0xb00 mm/kmsan/kmsan.c:675 kmsan_copy_to_user+0xab/0xc0 mm/kmsan/kmsan_hooks.c:601 _copy_to_user+0x16b/0x1f0 lib/usercopy.c:32 copy_to_user include/linux/uaccess.h:177 [inline] move_addr_to_user+0x2e9/0x4f0 net/socket.c:227 ___sys_recvmsg+0x5d7/0x1140 net/socket.c:2284 __sys_recvmsg net/socket.c:2327 [inline] __do_sys_recvmsg net/socket.c:2337 [inline] __se_sys_recvmsg+0x2fa/0x450 net/socket.c:2334 __x64_sys_recvmsg+0x4a/0x70 net/socket.c:2334 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 RIP: 0033:0x457ec9 Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f8750c06c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002f RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457ec9 RDX: 0000000000002000 RSI: 0000000020000400 RDI: 0000000000000005 RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8750c076d4 R13: 00000000004c4a60 R14: 00000000004d8140 R15: 00000000ffffffff Uninit was stored to memory at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:204 [inline] kmsan_save_stack mm/kmsan/kmsan.c:219 [inline] kmsan_internal_chain_origin+0x134/0x230 mm/kmsan/kmsan.c:439 __msan_chain_origin+0x70/0xe0 mm/kmsan/kmsan_instr.c:200 ipv6_recv_error+0x1e3f/0x1eb0 net/ipv6/datagram.c:475 udpv6_recvmsg+0x398/0x2ab0 net/ipv6/udp.c:335 inet_recvmsg+0x4fb/0x600 net/ipv4/af_inet.c:830 sock_recvmsg_nosec net/socket.c:794 [inline] sock_recvmsg+0x1d1/0x230 net/socket.c:801 ___sys_recvmsg+0x4d5/0x1140 net/socket.c:2278 __sys_recvmsg net/socket.c:2327 [inline] __do_sys_recvmsg net/socket.c:2337 [inline] __se_sys_recvmsg+0x2fa/0x450 net/socket.c:2334 __x64_sys_recvmsg+0x4a/0x70 net/socket.c:2334 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:204 [inline] kmsan_internal_poison_shadow+0x92/0x150 mm/kmsan/kmsan.c:158 kmsan_kmalloc+0xa6/0x130 mm/kmsan/kmsan_hooks.c:176 kmsan_slab_alloc+0xe/0x10 mm/kmsan/kmsan_hooks.c:185 slab_post_alloc_hook mm/slab.h:446 [inline] slab_alloc_node mm/slub.c:2759 [inline] __kmalloc_node_track_caller+0xe18/0x1030 mm/slub.c:4383 __kmalloc_reserve net/core/skbuff.c:137 [inline] __alloc_skb+0x309/0xa20 net/core/skbuff.c:205 alloc_skb include/linux/skbuff.h:998 [inline] ipv6_local_error+0x1a7/0x9e0 net/ipv6/datagram.c:334 __ip6_append_data+0x129f/0x4fd0 net/ipv6/ip6_output.c:1311 ip6_make_skb+0x6cc/0xcf0 net/ipv6/ip6_output.c:1775 udpv6_sendmsg+0x3f8e/0x45d0 net/ipv6/udp.c:1384 inet_sendmsg+0x54a/0x720 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg net/socket.c:631 [inline] __sys_sendto+0x8c4/0xac0 net/socket.c:1788 __do_sys_sendto net/socket.c:1800 [inline] __se_sys_sendto+0x107/0x130 net/socket.c:1796 __x64_sys_sendto+0x6e/0x90 net/socket.c:1796 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 Bytes 4-7 of 28 are uninitialized Memory access of size 28 starts at ffff8881937bfce0 Data copied to user address 0000000020000000 Signed-off-by: Eric Dumazet Reported-by: syzbot Signed-off-by: David S. Miller net/ipv6/datagram.c | 1 + 1 file changed, 1 insertion(+) commit 85704cb8dcfd88d351bfc87faaeba1c8214f3177 Author: Konstantin Khlebnikov Date: Tue Jan 8 12:30:00 2019 +0300 net/core/neighbour: tell kmemleak about hash tables This fixes false-positive kmemleak reports about leaked neighbour entries: unreferenced object 0xffff8885c6e4d0a8 (size 1024): comm "softirq", pid 0, jiffies 4294922664 (age 167640.804s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 20 2c f3 83 ff ff ff ff ........ ,...... 08 c0 ef 5f 84 88 ff ff 01 8c 7d 02 01 00 00 00 ..._......}..... backtrace: [<00000000748509fe>] ip6_finish_output2+0x887/0x1e40 [<0000000036d7a0d8>] ip6_output+0x1ba/0x600 [<0000000027ea7dba>] ip6_send_skb+0x92/0x2f0 [<00000000d6e2111d>] udp_v6_send_skb.isra.24+0x680/0x15e0 [<000000000668a8be>] udpv6_sendmsg+0x18c9/0x27a0 [<000000004bd5fa90>] sock_sendmsg+0xb3/0xf0 [<000000008227b29f>] ___sys_sendmsg+0x745/0x8f0 [<000000008698009d>] __sys_sendmsg+0xde/0x170 [<00000000889dacf1>] do_syscall_64+0x9b/0x400 [<0000000081cdb353>] entry_SYSCALL_64_after_hwframe+0x49/0xbe [<000000005767ed39>] 0xffffffffffffffff Signed-off-by: Konstantin Khlebnikov Signed-off-by: David S. Miller net/core/neighbour.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) commit fd21c89b876565df76051eca395018de2280f8e1 Author: Colin Ian King Date: Mon Jan 7 23:48:09 2019 +0000 net: cxgb4: fix various indentation issues There are some lines that have indentation issues, fix these. Signed-off-by: Colin Ian King Signed-off-by: David S. Miller drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c | 8 ++++---- drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c | 2 +- drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) commit 2acc0abc882ac3be47719e189f3db006493ab640 Author: Colin Ian King Date: Mon Jan 7 23:39:24 2019 +0000 net: cxgb3: fix various indentation issues There are handful of lines that have indentation issues, fix these. Signed-off-by: Colin Ian King Signed-off-by: David S. Miller drivers/net/ethernet/chelsio/cxgb3/sge.c | 12 +++++++----- drivers/net/ethernet/chelsio/cxgb3/t3_hw.c | 6 +++--- 2 files changed, 10 insertions(+), 8 deletions(-) commit 4a06fa67c4da20148803525151845276cdb995c1 Author: Willem de Bruijn Date: Mon Jan 7 16:47:33 2019 -0500 ip: on queued skb use skb_header_pointer instead of pskb_may_pull Commit 2efd4fca703a ("ip: in cmsg IP(V6)_ORIGDSTADDR call pskb_may_pull") avoided a read beyond the end of the skb linear segment by calling pskb_may_pull. That function can trigger a BUG_ON in pskb_expand_head if the skb is shared, which it is when when peeking. It can also return ENOMEM. Avoid both by switching to safer skb_header_pointer. Fixes: 2efd4fca703a ("ip: in cmsg IP(V6)_ORIGDSTADDR call pskb_may_pull") Reported-by: syzbot Suggested-by: Eric Dumazet Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller net/ipv4/ip_sockglue.c | 12 +++++------- net/ipv6/datagram.c | 10 ++++------ 2 files changed, 9 insertions(+), 13 deletions(-) commit 0b7959b6257322f7693b08a459c505d4938646f2 Author: Stanislav Fomichev Date: Mon Jan 7 13:38:38 2019 -0800 tun: publish tfile after it's fully initialized BUG: unable to handle kernel NULL pointer dereference at 00000000000000d1 Call Trace: ? napi_gro_frags+0xa7/0x2c0 tun_get_user+0xb50/0xf20 tun_chr_write_iter+0x53/0x70 new_sync_write+0xff/0x160 vfs_write+0x191/0x1e0 __x64_sys_write+0x5e/0xd0 do_syscall_64+0x47/0xf0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 I think there is a subtle race between sending a packet via tap and attaching it: CPU0: CPU1: tun_chr_ioctl(TUNSETIFF) tun_set_iff tun_attach rcu_assign_pointer(tfile->tun, tun); tun_fops->write_iter() tun_chr_write_iter tun_napi_alloc_frags napi_get_frags napi->skb = napi_alloc_skb tun_napi_init netif_napi_add napi->skb = NULL napi->skb is NULL here napi_gro_frags napi_frags_skb skb = napi->skb skb_reset_mac_header(skb) panic() Move rcu_assign_pointer(tfile->tun) and rcu_assign_pointer(tun->tfiles) to be the last thing we do in tun_attach(); this should guarantee that when we call tun_get() we always get an initialized object. v2 changes: * remove extra napi_mutex locks/unlocks for napi operations Reported-by: syzbot Fixes: 90e33d459407 ("tun: enable napi_gro_frags() for TUN/TAP driver") Signed-off-by: Stanislav Fomichev Signed-off-by: David S. Miller drivers/net/tun.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) commit 9f51c05dc41a6d69423e3d03d18eb7ab22f9ec19 Author: Wen Yang Date: Wed Dec 5 10:35:50 2018 +0800 pvcalls-front: Avoid get_free_pages(GFP_KERNEL) under spinlock The problem is that we call this with a spin lock held. The call tree is: pvcalls_front_accept() holds bedata->socket_lock. -> create_active() -> __get_free_pages() uses GFP_KERNEL The create_active() function is only called from pvcalls_front_accept() with a spin_lock held, The allocation is not allowed to sleep and GFP_KERNEL is not sufficient. This issue was detected by using the Coccinelle software. v2: Add a function doing the allocations which is called outside the lock and passing the allocated data to create_active(). v3: Use the matching deallocators i.e., free_page() and free_pages(), respectively. v4: It would be better to pre-populate map (struct sock_mapping), rather than introducing one more new struct. v5: Since allocating the data outside of this call it should also be freed outside, when create_active() fails. Move kzalloc(sizeof(*map2), GFP_ATOMIC) outside spinlock and use GFP_KERNEL instead. v6: Drop the superfluous calls. Suggested-by: Juergen Gross Suggested-by: Boris Ostrovsky Suggested-by: Stefano Stabellini Signed-off-by: Wen Yang Acked-by: Stefano Stabellini CC: Julia Lawall CC: Boris Ostrovsky CC: Juergen Gross CC: Stefano Stabellini CC: xen-devel@lists.xenproject.org CC: linux-kernel@vger.kernel.org Signed-off-by: Boris Ostrovsky drivers/xen/pvcalls-front.c | 81 +++++++++++++++++++++++++++++++++------------ 1 file changed, 59 insertions(+), 22 deletions(-) commit 15c03092a9fbcdd041f58e5f832bf76c21c42e6a Author: Ravi Bangoria Date: Thu Jan 10 15:19:36 2019 +0530 tools headers powerpc: Remove unistd.h We use syscall.tbl to generate system call table on powerpc. The unistd.h copy is no longer required now. Remove it. Signed-off-by: Ravi Bangoria Cc: Jiri Olsa Cc: Michael Ellerman Cc: Namhyung Kim Cc: linuxppc-dev@lists.ozlabs.org Link: http://lkml.kernel.org/r/20190110094936.3132-2-ravi.bangoria@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo tools/arch/powerpc/include/uapi/asm/unistd.h | 404 --------------------------- tools/perf/check-headers.sh | 1 - 2 files changed, 405 deletions(-) commit d45a90cb5d061fa7d411b974b950fe0b8bc5f265 Author: Eric Biggers Date: Tue Jan 8 22:12:41 2019 -0800 crypto: sm3 - fix undefined shift by >= width of value sm3_compress() calls rol32() with shift >= 32, which causes undefined behavior. This is easily detected by enabling CONFIG_UBSAN. Explicitly AND with 31 to make the behavior well defined. Fixes: 4f0fc1600edb ("crypto: sm3 - add OSCCA SM3 secure hash") Cc: # v4.15+ Cc: Gilad Ben-Yossef Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu crypto/sm3_generic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1bea445b0a022ee126ca328b3705cd4df18ebc14 Author: Christophe Leroy Date: Tue Jan 8 06:56:48 2019 +0000 crypto: talitos - fix ablkcipher for CONFIG_VMAP_STACK [ 2.364486] WARNING: CPU: 0 PID: 60 at ./arch/powerpc/include/asm/io.h:837 dma_nommu_map_page+0x44/0xd4 [ 2.373579] CPU: 0 PID: 60 Comm: cryptomgr_test Tainted: G W 4.20.0-rc5-00560-g6bfb52e23a00-dirty #531 [ 2.384740] NIP: c000c540 LR: c000c584 CTR: 00000000 [ 2.389743] REGS: c95abab0 TRAP: 0700 Tainted: G W (4.20.0-rc5-00560-g6bfb52e23a00-dirty) [ 2.400042] MSR: 00029032 CR: 24042204 XER: 00000000 [ 2.406669] [ 2.406669] GPR00: c02f2244 c95abb60 c6262990 c95abd80 0000256a 00000001 00000001 00000001 [ 2.406669] GPR08: 00000000 00002000 00000010 00000010 24042202 00000000 00000100 c95abd88 [ 2.406669] GPR16: 00000000 c05569d4 00000001 00000010 c95abc88 c0615664 00000004 00000000 [ 2.406669] GPR24: 00000010 c95abc88 c95abc88 00000000 c61ae210 c7ff6d40 c61ae210 00003d68 [ 2.441559] NIP [c000c540] dma_nommu_map_page+0x44/0xd4 [ 2.446720] LR [c000c584] dma_nommu_map_page+0x88/0xd4 [ 2.451762] Call Trace: [ 2.454195] [c95abb60] [82000808] 0x82000808 (unreliable) [ 2.459572] [c95abb80] [c02f2244] talitos_edesc_alloc+0xbc/0x3c8 [ 2.465493] [c95abbb0] [c02f2600] ablkcipher_edesc_alloc+0x4c/0x5c [ 2.471606] [c95abbd0] [c02f4ed0] ablkcipher_encrypt+0x20/0x64 [ 2.477389] [c95abbe0] [c02023b0] __test_skcipher+0x4bc/0xa08 [ 2.483049] [c95abe00] [c0204b60] test_skcipher+0x2c/0xcc [ 2.488385] [c95abe20] [c0204c48] alg_test_skcipher+0x48/0xbc [ 2.494064] [c95abe40] [c0205cec] alg_test+0x164/0x2e8 [ 2.499142] [c95abf00] [c0200dec] cryptomgr_test+0x48/0x50 [ 2.504558] [c95abf10] [c0039ff4] kthread+0xe4/0x110 [ 2.509471] [c95abf40] [c000e1d0] ret_from_kernel_thread+0x14/0x1c [ 2.515532] Instruction dump: [ 2.518468] 7c7e1b78 7c9d2378 7cbf2b78 41820054 3d20c076 8089c200 3d20c076 7c84e850 [ 2.526127] 8129c204 7c842e70 7f844840 419c0008 <0fe00000> 2f9e0000 54847022 7c84fa14 [ 2.533960] ---[ end trace bf78d94af73fe3b8 ]--- [ 2.539123] talitos ff020000.crypto: master data transfer error [ 2.544775] talitos ff020000.crypto: TEA error: ISR 0x20000000_00000040 [ 2.551625] alg: skcipher: encryption failed on test 1 for ecb-aes-talitos: ret=22 IV cannot be on stack when CONFIG_VMAP_STACK is selected because the stack cannot be DMA mapped anymore. This patch copies the IV into the extended descriptor. Fixes: 4de9d0b547b9 ("crypto: talitos - Add ablkcipher algorithms") Cc: stable@vger.kernel.org Signed-off-by: Christophe Leroy Reviewed-by: Horia Geantă Signed-off-by: Herbert Xu drivers/crypto/talitos.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit c56c2e173773097a248fd3bace91ac8f6fc5386d Author: Christophe Leroy Date: Tue Jan 8 06:56:46 2019 +0000 crypto: talitos - reorder code in talitos_edesc_alloc() This patch moves the mapping of IV after the kmalloc(). This avoids having to unmap in case kmalloc() fails. Signed-off-by: Christophe Leroy Reviewed-by: Horia Geantă Cc: stable@vger.kernel.org Signed-off-by: Herbert Xu drivers/crypto/talitos.c | 25 +++++++------------------ 1 file changed, 7 insertions(+), 18 deletions(-) commit 6db43410179bc40419a9859ebb333f178a49829d Author: Eric Biggers Date: Sun Jan 6 12:46:05 2019 -0800 crypto: adiantum - initialize crypto_spawn::inst crypto_grab_*() doesn't set crypto_spawn::inst, so templates must set it beforehand. Otherwise it will be left NULL, which causes a crash in certain cases where algorithms are dynamically loaded/unloaded. E.g. with CONFIG_CRYPTO_CHACHA20_X86_64=m, the following caused a crash: insmod chacha-x86_64.ko python -c 'import socket; socket.socket(socket.AF_ALG, 5, 0).bind(("skcipher", "adiantum(xchacha12,aes)"))' rmmod chacha-x86_64.ko python -c 'import socket; socket.socket(socket.AF_ALG, 5, 0).bind(("skcipher", "adiantum(xchacha12,aes)"))' Fixes: 059c2a4d8e16 ("crypto: adiantum - add Adiantum support") Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu crypto/adiantum.c | 4 ++++ 1 file changed, 4 insertions(+) commit 06bbf753476dab23eb262cb5fbab6d6d277a0ba3 Author: Dan Carpenter Date: Fri Jan 4 09:46:11 2019 +0300 crypto: cavium/nitrox - Use after free in process_response_list() We free "sr" and then dereference it on the next line. Fixes: c9613335bf4f ("crypto: cavium/nitrox - Added AEAD cipher support") Signed-off-by: Dan Carpenter Signed-off-by: Herbert Xu drivers/crypto/cavium/nitrox/nitrox_reqmgr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a7773363624b034ab198c738661253d20a8055c2 Author: Harsh Jain Date: Thu Jan 3 14:21:05 2019 +0530 crypto: authencesn - Avoid twice completion call in decrypt path Authencesn template in decrypt path unconditionally calls aead_request_complete after ahash_verify which leads to following kernel panic in after decryption. [ 338.539800] BUG: unable to handle kernel NULL pointer dereference at 0000000000000004 [ 338.548372] PGD 0 P4D 0 [ 338.551157] Oops: 0000 [#1] SMP PTI [ 338.554919] CPU: 0 PID: 0 Comm: swapper/0 Kdump: loaded Tainted: G W I 4.19.7+ #13 [ 338.564431] Hardware name: Supermicro X8ST3/X8ST3, BIOS 2.0 07/29/10 [ 338.572212] RIP: 0010:esp_input_done2+0x350/0x410 [esp4] [ 338.578030] Code: ff 0f b6 68 10 48 8b 83 c8 00 00 00 e9 8e fe ff ff 8b 04 25 04 00 00 00 83 e8 01 48 98 48 8b 3c c5 10 00 00 00 e9 f7 fd ff ff <8b> 04 25 04 00 00 00 83 e8 01 48 98 4c 8b 24 c5 10 00 00 00 e9 3b [ 338.598547] RSP: 0018:ffff911c97803c00 EFLAGS: 00010246 [ 338.604268] RAX: 0000000000000002 RBX: ffff911c4469ee00 RCX: 0000000000000000 [ 338.612090] RDX: 0000000000000000 RSI: 0000000000000130 RDI: ffff911b87c20400 [ 338.619874] RBP: 0000000000000000 R08: ffff911b87c20498 R09: 000000000000000a [ 338.627610] R10: 0000000000000001 R11: 0000000000000004 R12: 0000000000000000 [ 338.635402] R13: ffff911c89590000 R14: ffff911c91730000 R15: 0000000000000000 [ 338.643234] FS: 0000000000000000(0000) GS:ffff911c97800000(0000) knlGS:0000000000000000 [ 338.652047] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 338.658299] CR2: 0000000000000004 CR3: 00000001ec20a000 CR4: 00000000000006f0 [ 338.666382] Call Trace: [ 338.669051] [ 338.671254] esp_input_done+0x12/0x20 [esp4] [ 338.675922] chcr_handle_resp+0x3b5/0x790 [chcr] [ 338.680949] cpl_fw6_pld_handler+0x37/0x60 [chcr] [ 338.686080] chcr_uld_rx_handler+0x22/0x50 [chcr] [ 338.691233] uldrx_handler+0x8c/0xc0 [cxgb4] [ 338.695923] process_responses+0x2f0/0x5d0 [cxgb4] [ 338.701177] ? bitmap_find_next_zero_area_off+0x3a/0x90 [ 338.706882] ? matrix_alloc_area.constprop.7+0x60/0x90 [ 338.712517] ? apic_update_irq_cfg+0x82/0xf0 [ 338.717177] napi_rx_handler+0x14/0xe0 [cxgb4] [ 338.722015] net_rx_action+0x2aa/0x3e0 [ 338.726136] __do_softirq+0xcb/0x280 [ 338.730054] irq_exit+0xde/0xf0 [ 338.733504] do_IRQ+0x54/0xd0 [ 338.736745] common_interrupt+0xf/0xf Fixes: 104880a6b470 ("crypto: authencesn - Convert to new AEAD...") Signed-off-by: Harsh Jain Cc: stable@vger.kernel.org Signed-off-by: Herbert Xu crypto/authencesn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2dd3fde41bf3dc68e38de23da87e72a07719b708 Author: Horia Geantă Date: Fri Dec 21 14:47:46 2018 +0200 crypto: caam - fix SHA support detection The addition of Chacha20 + Poly1305 authenc support inadvertently broke detection of algorithms supported by MDHA (Message Digest Hardware Accelerator), fix it. Fixes: d6bbd4eea243 ("crypto: caam/jr - add support for Chacha20 + Poly1305") Signed-off-by: Horia Geantă Signed-off-by: Herbert Xu drivers/crypto/caam/caamalg.c | 2 +- drivers/crypto/caam/desc.h | 1 + drivers/crypto/caam/error.h | 9 +++++++++ 3 files changed, 11 insertions(+), 1 deletion(-) commit 04e6d25c5bb244c1a37eb9fe0b604cc11a04e8c5 Author: Aymen Sghaier Date: Wed Dec 19 16:36:44 2018 +0200 crypto: caam - fix zero-length buffer DMA mapping Recent changes - probably DMA API related (generic and/or arm64-specific) - exposed a case where driver maps a zero-length buffer: ahash_init()->ahash_update()->ahash_final() with a zero-length string to hash kernel BUG at kernel/dma/swiotlb.c:475! Internal error: Oops - BUG: 0 [#1] PREEMPT SMP Modules linked in: CPU: 2 PID: 1823 Comm: cryptomgr_test Not tainted 4.20.0-rc1-00108-g00c9fe37a7f2 #1 Hardware name: LS1046A RDB Board (DT) pstate: 80000005 (Nzcv daif -PAN -UAO) pc : swiotlb_tbl_map_single+0x170/0x2b8 lr : swiotlb_map_page+0x134/0x1f8 sp : ffff00000f79b8f0 x29: ffff00000f79b8f0 x28: 0000000000000000 x27: ffff0000093d0000 x26: 0000000000000000 x25: 00000000001f3ffe x24: 0000000000200000 x23: 0000000000000000 x22: 00000009f2c538c0 x21: ffff800970aeb410 x20: 0000000000000001 x19: ffff800970aeb410 x18: 0000000000000007 x17: 000000000000000e x16: 0000000000000001 x15: 0000000000000019 x14: c32cb8218a167fe8 x13: ffffffff00000000 x12: ffff80097fdae348 x11: 0000800976bca000 x10: 0000000000000010 x9 : 0000000000000000 x8 : ffff0000091fd6c8 x7 : 0000000000000000 x6 : 00000009f2c538bf x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000 x2 : 00000009f2c538c0 x1 : 00000000f9fff000 x0 : 0000000000000000 Process cryptomgr_test (pid: 1823, stack limit = 0x(____ptrval____)) Call trace: swiotlb_tbl_map_single+0x170/0x2b8 swiotlb_map_page+0x134/0x1f8 ahash_final_no_ctx+0xc4/0x6cc ahash_final+0x10/0x18 crypto_ahash_op+0x30/0x84 crypto_ahash_final+0x14/0x1c __test_hash+0x574/0xe0c test_hash+0x28/0x80 __alg_test_hash+0x84/0xd0 alg_test_hash+0x78/0x144 alg_test.part.30+0x12c/0x2b4 alg_test+0x3c/0x68 cryptomgr_test+0x44/0x4c kthread+0xfc/0x128 ret_from_fork+0x10/0x18 Code: d34bfc18 2a1a03f7 1a9f8694 35fff89a (d4210000) Cc: Signed-off-by: Aymen Sghaier Signed-off-by: Horia Geantă Reviewed-by: Christoph Hellwig Signed-off-by: Herbert Xu drivers/crypto/caam/caamhash.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) commit dc95b5350a8f07d73d6bde3a79ef87289698451d Author: Eric Biggers Date: Sun Dec 16 23:23:24 2018 -0800 crypto: ccree - convert to use crypto_authenc_extractkeys() Convert the ccree crypto driver to use crypto_authenc_extractkeys() so that it picks up the fix for broken validation of rtattr::rta_len. Fixes: ff27e85a85bb ("crypto: ccree - add AEAD support") Cc: # v4.17+ Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu drivers/crypto/ccree/cc_aead.c | 40 +++++++++++++++++++--------------------- 1 file changed, 19 insertions(+), 21 deletions(-) commit ab57b33525c3221afaebd391458fa0cbcd56903d Author: Eric Biggers Date: Sun Dec 16 23:23:23 2018 -0800 crypto: bcm - convert to use crypto_authenc_extractkeys() Convert the bcm crypto driver to use crypto_authenc_extractkeys() so that it picks up the fix for broken validation of rtattr::rta_len. This also fixes the DES weak key check to actually be done on the right key. (It was checking the authentication key, not the encryption key...) Fixes: 9d12ba86f818 ("crypto: brcm - Add Broadcom SPU driver") Cc: # v4.11+ Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu drivers/crypto/Kconfig | 1 + drivers/crypto/bcm/cipher.c | 44 +++++++++++++------------------------------- 2 files changed, 14 insertions(+), 31 deletions(-) commit 8f9c469348487844328e162db57112f7d347c49f Author: Eric Biggers Date: Sun Dec 16 23:23:22 2018 -0800 crypto: authenc - fix parsing key with misaligned rta_len Keys for "authenc" AEADs are formatted as an rtattr containing a 4-byte 'enckeylen', followed by an authentication key and an encryption key. crypto_authenc_extractkeys() parses the key to find the inner keys. However, it fails to consider the case where the rtattr's payload is longer than 4 bytes but not 4-byte aligned, and where the key ends before the next 4-byte aligned boundary. In this case, 'keylen -= RTA_ALIGN(rta->rta_len);' underflows to a value near UINT_MAX. This causes a buffer overread and crash during crypto_ahash_setkey(). Fix it by restricting the rtattr payload to the expected size. Reproducer using AF_ALG: #include #include #include int main() { int fd; struct sockaddr_alg addr = { .salg_type = "aead", .salg_name = "authenc(hmac(sha256),cbc(aes))", }; struct { struct rtattr attr; __be32 enckeylen; char keys[1]; } __attribute__((packed)) key = { .attr.rta_len = sizeof(key), .attr.rta_type = 1 /* CRYPTO_AUTHENC_KEYA_PARAM */, }; fd = socket(AF_ALG, SOCK_SEQPACKET, 0); bind(fd, (void *)&addr, sizeof(addr)); setsockopt(fd, SOL_ALG, ALG_SET_KEY, &key, sizeof(key)); } It caused: BUG: unable to handle kernel paging request at ffff88007ffdc000 PGD 2e01067 P4D 2e01067 PUD 2e04067 PMD 2e05067 PTE 0 Oops: 0000 [#1] SMP CPU: 0 PID: 883 Comm: authenc Not tainted 4.20.0-rc1-00108-g00c9fe37a7f27 #13 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-20181126_142135-anatol 04/01/2014 RIP: 0010:sha256_ni_transform+0xb3/0x330 arch/x86/crypto/sha256_ni_asm.S:155 [...] Call Trace: sha256_ni_finup+0x10/0x20 arch/x86/crypto/sha256_ssse3_glue.c:321 crypto_shash_finup+0x1a/0x30 crypto/shash.c:178 shash_digest_unaligned+0x45/0x60 crypto/shash.c:186 crypto_shash_digest+0x24/0x40 crypto/shash.c:202 hmac_setkey+0x135/0x1e0 crypto/hmac.c:66 crypto_shash_setkey+0x2b/0xb0 crypto/shash.c:66 shash_async_setkey+0x10/0x20 crypto/shash.c:223 crypto_ahash_setkey+0x2d/0xa0 crypto/ahash.c:202 crypto_authenc_setkey+0x68/0x100 crypto/authenc.c:96 crypto_aead_setkey+0x2a/0xc0 crypto/aead.c:62 aead_setkey+0xc/0x10 crypto/algif_aead.c:526 alg_setkey crypto/af_alg.c:223 [inline] alg_setsockopt+0xfe/0x130 crypto/af_alg.c:256 __sys_setsockopt+0x6d/0xd0 net/socket.c:1902 __do_sys_setsockopt net/socket.c:1913 [inline] __se_sys_setsockopt net/socket.c:1910 [inline] __x64_sys_setsockopt+0x1f/0x30 net/socket.c:1910 do_syscall_64+0x4a/0x180 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Fixes: e236d4a89a2f ("[CRYPTO] authenc: Move enckeylen into key itself") Cc: # v2.6.25+ Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu crypto/authenc.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) commit 0206131811fa6e4b3ed64b5f1c107e2815dcab42 Author: Ravi Bangoria Date: Thu Jan 10 15:19:35 2019 +0530 perf powerpc: Rework syscall table generation Commit aff850393200 ("powerpc: add system call table generation support") changed how systemcall table is generated for powerpc. Incorporate these changes into perf as well. Committer testing: $ podman run --entrypoint=/bin/sh --privileged -v /home/acme/git:/git --rm -ti docker.io/acmel/linux-perf-tools-build-ubuntu:18.04-x-powerpc64 perfbuilder@d7a7af166a80:/git/perf$ head -2 /etc/os-release NAME="Ubuntu" VERSION="18.04.1 LTS (Bionic Beaver)" perfbuilder@d7a7af166a80:/git/perf$ perfbuilder@d7a7af166a80:/git/perf$ make ARCH=powerpc CROSS_COMPILE=powerpc64-linux-gnu- EXTRA_CFLAGS= -C /git/linux/tools/perf O=/tmp/build/perf make: Entering directory '/git/linux/tools/perf' BUILD: Doing 'make -j8' parallel build HOSTCC /tmp/build/perf/fixdep.o HOSTLD /tmp/build/perf/fixdep-in.o LINK /tmp/build/perf/fixdep Warning: Kernel ABI header at 'tools/include/uapi/linux/mman.h' differs from latest version at 'include/uapi/linux/mman.h' diff -u tools/include/uapi/linux/mman.h include/uapi/linux/mman.h sh: 1: command: Illegal option -c Auto-detecting system features: ... dwarf: [ on ] ... dwarf_getlocations: [ on ] ... glibc: [ on ] ... gtk2: [ OFF ] ... libaudit: [ OFF ] ... libbfd: [ OFF ] ... libelf: [ on ] ... libnuma: [ OFF ] ... numa_num_possible_cpus: [ OFF ] ... libperl: [ OFF ] ... libpython: [ OFF ] ... libslang: [ OFF ] ... libcrypto: [ OFF ] ... libunwind: [ OFF ] ... libdw-dwarf-unwind: [ on ] ... zlib: [ on ] ... lzma: [ OFF ] ... get_cpuid: [ OFF ] ... bpf: [ on ] Makefile.config:445: No sys/sdt.h found, no SDT events are defined, please install systemtap-sdt-devel or systemtap-sdt-dev Makefile.config:491: No libunwind found. Please install libunwind-dev[el] >= 1.1 and/or set LIBUNWIND_DIR Makefile.config:583: No libcrypto.h found, disables jitted code injection, please install libssl-devel or libssl-dev Makefile.config:598: slang not found, disables TUI support. Please install slang-devel, libslang-dev or libslang2-dev Makefile.config:612: GTK2 not found, disables GTK2 support. Please install gtk2-devel or libgtk2.0-dev Makefile.config:639: Missing perl devel files. Disabling perl scripting support, please install perl-ExtUtils-Embed/libperl-dev Makefile.config:666: No python interpreter was found: disables Python support - please install python-devel/python-dev Makefile.config:721: No bfd.h/libbfd found, please install binutils-dev[el]/zlib-static/libiberty-dev to gain symbol demangling Makefile.config:750: No liblzma found, disables xz kernel module decompression, please install xz-devel/liblzma-dev Makefile.config:763: No numa.h found, disables 'perf bench numa mem' benchmark, please install numactl-devel/libnuma-devel/libnuma-dev Makefile.config:814: No libbabeltrace found, disables 'perf data' CTF format support, please install libbabeltrace-dev[el]/libbabeltrace-ctf-dev Makefile.config:840: No alternatives command found, you need to set JDIR= to point to the root of your Java directory GEN /tmp/build/perf/common-cmds.h CC /tmp/build/perf/util/syscalltbl.o LD /tmp/build/perf/libperf-in.o AR /tmp/build/perf/libperf.a LINK /tmp/build/perf/perf make: Leaving directory '/git/linux/tools/perf' perfbuilder@d7a7af166a80:/git/perf$ head /tmp/build/perf/arch/powerpc/include/generated/asm/syscalls_64.c static const char *syscalltbl_powerpc_64[] = { [0] = "restart_syscall", [1] = "exit", [2] = "fork", [3] = "read", [4] = "write", [5] = "open", [6] = "close", [7] = "waitpid", [8] = "creat", perfbuilder@d7a7af166a80:/git/perf$ tail /tmp/build/perf/arch/powerpc/include/generated/asm/syscalls_64.c [381] = "pwritev2", [382] = "kexec_file_load", [383] = "statx", [384] = "pkey_alloc", [385] = "pkey_free", [386] = "pkey_mprotect", [387] = "rseq", [388] = "io_pgetevents", }; #define SYSCALLTBL_POWERPC_64_MAX_ID 388 perfbuilder@d7a7af166a80:/git/perf$ head /tmp/build/perf/arch/powerpc/include/generated/asm/syscalls_32.c static const char *syscalltbl_powerpc_32[] = { [0] = "restart_syscall", [1] = "exit", [2] = "fork", [3] = "read", [4] = "write", [5] = "open", [6] = "close", [7] = "waitpid", [8] = "creat", perfbuilder@d7a7af166a80:/git/perf$ tail /tmp/build/perf/arch/powerpc/include/generated/asm/syscalls_32.c [381] = "pwritev2", [382] = "kexec_file_load", [383] = "statx", [384] = "pkey_alloc", [385] = "pkey_free", [386] = "pkey_mprotect", [387] = "rseq", [388] = "io_pgetevents", }; #define SYSCALLTBL_POWERPC_32_MAX_ID 388 perfbuilder@d7a7af166a80:/git/perf$ Signed-off-by: Ravi Bangoria Reported-by: Arnaldo Carvalho de Melo Tested-by: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Michael Ellerman Cc: Namhyung Kim Cc: linuxppc-dev@lists.ozlabs.org Link: http://lkml.kernel.org/r/20190110094936.3132-1-ravi.bangoria@linux.ibm.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/arch/powerpc/Makefile | 15 +- .../perf/arch/powerpc/entry/syscalls/mksyscalltbl | 22 +- tools/perf/arch/powerpc/entry/syscalls/syscall.tbl | 427 +++++++++++++++++++++ 3 files changed, 450 insertions(+), 14 deletions(-) commit f299e0bdbaeb60fd8829f42e53a7457cc5a6f4a2 Author: José Roberto de Souza Date: Wed Dec 5 10:48:50 2018 -0800 drm: Fix documentation generation for DP_DPCD_QUIRK_NO_PSR The DP_DPCD_QUIRK_NO_PSR comment is missing colon causing this warning when generating kernel documentation. ./include/drm/drm_dp_helper.h:1374: warning: Incorrect use of kernel-doc format: * @DP_DPCD_QUIRK_NO_PSR Fixes: 1035f4a65f58 ("drm/i915: Disable PSR in Apple panels") Cc: Dhinakaran Pandiyan Signed-off-by: José Roberto de Souza Reviewed-by: Dhinakaran Pandiyan Link: https://patchwork.freedesktop.org/patch/msgid/20181205184850.13218-1-jose.souza@intel.com (cherry picked from commit ed17b555303c74a35f226268523b1695dbd4617d) Signed-off-by: Jani Nikula include/drm/drm_dp_helper.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 70e31424eabe4923a2140eb86f704c75db6a5c87 Author: Daniele Ceraolo Spurio Date: Wed Jan 9 17:32:32 2019 -0800 drm/i915: init per-engine WAs for all engines commit 4a15c75c4246 ("drm/i915: Introduce per-engine workarounds") refactored the workaround code to have functions per-engine, but didn't call any of them from logical_xcs_ring_init. Since we do have a non-RCS workaround for KBL (WaKBLVECSSemaphoreWaitPoll) we do need to call intel_engine_init_workarounds for non-RCS engines. Note that whitelist is still RCS-only. v2: move the call to logical_ring_init (Chris) Fixes: 4a15c75c4246 ("drm/i915: Introduce per-engine workarounds") Cc: Tvrtko Ursulin Cc: Chris Wilson Signed-off-by: Daniele Ceraolo Spurio Reviewed-by: Chris Wilson Signed-off-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20190110013232.8972-2-daniele.ceraolospurio@intel.com (cherry picked from commit a60acb223fecc77531540196008ac2de89e2a162) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_lrc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 280d479b310298dfeb1d6f9a1617eca37beb6ce4 Author: Chris Wilson Date: Sat Dec 22 03:06:23 2018 +0000 drm/i915: Unwind failure on pinning the gen7 ppgtt If we fail to pin the ggtt vma slot for the ppgtt page tables, we need to unwind the locals before reporting the error. Or else on subsequent attempts to bind the page tables into the ggtt, we will already believe that the vma has been pinned and continue on blithely. If something else should happen to be at that location, choas ensues. Fixes: a2bbf7148342 ("drm/i915/gtt: Only keep gen6 page directories pinned while active") Signed-off-by: Chris Wilson Cc: Joonas Lahtinen Cc: Mika Kuoppala Cc: Matthew Auld Cc: # v4.19+ Reviewed-by: Matthew Auld Link: https://patchwork.freedesktop.org/patch/msgid/20181222030623.21710-1-chris@chris-wilson.co.uk (cherry picked from commit d4de753526f4d99f541f1b6ed1d963005c09700c) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_gem_gtt.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) commit 107c595c2a277be65b28762f12e1dad243e05623 Author: Chris Wilson Date: Fri Dec 7 11:05:54 2018 +0000 drm/i915: Skip the ERR_PTR error state Although commit fb6f0b64e455 ("drm/i915: Prevent machine hang from Broxton's vtd w/a and error capture") applied cleanly after a 24 month hiatus, the code had moved on with new methods for peeking and fetching the captured gpu info. Make sure we catch all uses of the stashed error state and avoid dereferencing the error pointer. v2: Move error pointer determination into i915_gpu_capture_state v3: Restore early check to avoid capturing and then throwing away subsequent GPU error states. Fixes: fb6f0b64e455 ("drm/i915: Prevent machine hang from Broxton's vtd w/a and error capture") Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Cc: Joonas Lahtinen Reviewed-by: Tvrtko Ursulin Link: https://patchwork.freedesktop.org/patch/msgid/20181207110554.19897-1-chris@chris-wilson.co.uk (cherry picked from commit e6154e4cb8b0d3692f84ca0d66b4e1ba0389b134) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_debugfs.c | 12 +++++++++--- drivers/gpu/drm/i915/i915_gpu_error.c | 23 ++++++++++++++--------- drivers/gpu/drm/i915/i915_sysfs.c | 4 +++- 3 files changed, 26 insertions(+), 13 deletions(-) commit 1035f4a65f58407951d8d2f54c289c2b252e499c Author: José Roberto de Souza Date: Mon Dec 3 16:33:55 2018 -0800 drm/i915: Disable PSR in Apple panels i915 yet don't support PSR in Apple panels, so lets keep it disabled while we work on that. v2: Renamed DP_DPCD_QUIRK_PSR_NOT_CURRENTLY_SUPPORTED to DP_DPCD_QUIRK_NO_PSR (Ville) v3: Adding documentation to DP_DPCD_QUIRK_NO_PSR(Dhinakaran and Jani) Fixed typo in comment of the new quirk entry(Jani) Fixes: 598c6cfe0690 (drm/i915/psr: Enable PSR1 on gen-9+ HW) Cc: Jani Nikula Cc: Ville Syrjälä Cc: Rodrigo Vivi Cc: Dhinakaran Pandiyan Reviewed-by: Dhinakaran Pandiyan Signed-off-by: José Roberto de Souza Link: https://patchwork.freedesktop.org/patch/msgid/20181204003403.23361-1-jose.souza@intel.com (cherry picked from commit 7c5c641a930ed06ca317ee39faee7d5824266348) Signed-off-by: Jani Nikula drivers/gpu/drm/drm_dp_helper.c | 2 ++ drivers/gpu/drm/i915/intel_psr.c | 6 ++++++ include/drm/drm_dp_helper.h | 7 +++++++ 3 files changed, 15 insertions(+) commit 038a0a8d2972962aa8d5adc250ce28cd0b2a3448 Merge: bfeffd155283 f0e994372518 Author: Jani Nikula Date: Thu Jan 10 15:02:03 2019 +0200 Merge tag 'gvt-fixes-2019-01-09' of https://github.com/intel/gvt-linux into drm-intel-fixes gvt-fixes-2019-01-09 - Fix one race issue between pre-scan of guest workload with submission Signed-off-by: Jani Nikula From: Zhenyu Wang Link: https://patchwork.freedesktop.org/patch/msgid/20190109050151.GL11631@zhen-hp.sh.intel.com commit 70c25259537c073584eb906865307687275b527f Author: Guo Ren Date: Thu Jan 10 20:28:39 2019 +0800 csky: fixup compile error with CPU 810. This bug is from commit f553aa1c13cb ("csky: fixup relocation error with 807 & 860"). I forgot to compile with 810 for that patch. Signed-off-by: Guo Ren Cc: Arnd Bergmann Signed-off-by: Linus Torvalds arch/csky/kernel/module.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 04eb1efcd614d6f067b76a355b3a3599667959dc Author: Rohit kumar Date: Thu Jan 10 14:32:41 2019 +0530 ASoC: soc-core: Hold client_mutex around soc_init_dai_link() soc_init_dai_link() calls soc_find_component() which needs to be within client_mutex lock. Add client_mutex lock around soc_init_dai_link() in snd_soc_register_card() to avoid lockdep warning. Fixes: 8780cf1142a5 ("ASoC: soc-core: defer card probe until all component is added to list") Reported-by: Kuninori Morimoto Signed-off-by: Rohit kumar Signed-off-by: Ajit Pandey Signed-off-by: Mark Brown sound/soc/soc-core.c | 4 ++++ 1 file changed, 4 insertions(+) commit b5f034845e70916fd33e172fad5ad530a29c10ab Author: Linus Walleij Date: Tue Jan 8 00:08:18 2019 +0100 ARM: dts: kirkwood: Fix polarity of GPIO fan lines These two lines are active high, not active low. The bug was found when we changed the kernel to respect the polarity defined in the device tree. Fixes: 1b90e06b1429 ("ARM: kirkwood: Use devicetree to define DNS-32[05] fan") Cc: Jamie Lentin Cc: Guenter Roeck Cc: Jason Cooper Cc: Andrew Lunn Cc: Gregory Clement Cc: Sebastian Hesselbarth Cc: Julien D'Ascenzio Reviewed-by: Andrew Lunn Tested-by: Jamie Lentin Reported-by: Julien D'Ascenzio Tested-by: Julien D'Ascenzio Signed-off-by: Linus Walleij Signed-off-by: Gregory CLEMENT arch/arm/boot/dts/kirkwood-dnskw.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 59c4dccbc3676144091783c8b46bd51daa4f80bc Author: Baruch Siach Date: Wed Dec 12 08:43:26 2018 +0200 arm64: dts: marvell: mcbin: fix PCIe reset signal The MPP52 signal is on the seconds GPIO instance of CP0, which corresponds to the &cp0_gpio2 handle. Rename the property name to the standard '-gpios' suffix while at it. Fixes: b83e1669adce6 ("arm64: dts: marvell: mcbin: add support for PCIe") Signed-off-by: Baruch Siach Signed-off-by: Gregory CLEMENT arch/arm64/boot/dts/marvell/armada-8040-mcbin.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 132ac39cffbcfed80ada38ef0fc6d34d95da7be6 Author: Heinrich Schuchardt Date: Fri Dec 21 17:45:03 2018 +0100 arm64: dts: marvell: armada-ap806: reserve PSCI area The memory area [0x4000000-0x4200000[ is occupied by the PSCI firmware. Any attempt to access it from Linux leads to an immediate crash. So let's make the same memory reservation as the vendor kernel. [gregory: added as comment that this region matches the mainline U-boot] Signed-off-by: Heinrich Schuchardt Signed-off-by: Gregory CLEMENT arch/arm64/boot/dts/marvell/armada-ap806.dtsi | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) commit d9ed41962ee202f653a5fa8d2ea0f52924abe629 Author: Will Deacon Date: Wed Jan 9 10:34:49 2019 +0000 arm64: asm-prototypes: Fix fat-fingered typo in comment Some of the right letters, not necessarily in the right order: CONFIG_MODEVERIONS -> CONFIG_MODVERSIONS Signed-off-by: Will Deacon arch/arm64/include/asm/asm-prototypes.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ba422731316dde1e22dcc84b83c7349dc0ce1c3c Author: Sean Christopherson Date: Wed Jan 9 16:51:17 2019 -0800 mm/mmu_notifier: mm/rmap.c: Fix a mmu_notifier range bug in try_to_unmap_one The conversion to use a structure for mmu_notifier_invalidate_range_*() unintentionally changed the usage in try_to_unmap_one() to init the 'struct mmu_notifier_range' with vma->vm_start instead of @address, i.e. it invalidates the wrong address range. Revert to the correct address range. Manifests as KVM use-after-free WARNINGs and subsequent "BUG: Bad page state in process X" errors when reclaiming from a KVM guest due to KVM removing the wrong pages from its own mappings. Reported-by: leozinho29_eu@hotmail.com Reported-by: Mike Galbraith Reported-and-tested-by: Adam Borowski Reviewed-by: Jérôme Glisse Reviewed-by: Pankaj gupta Cc: Christian König Cc: Jan Kara Cc: Matthew Wilcox Cc: Ross Zwisler Cc: Dan Williams Cc: Paolo Bonzini Cc: Radim Krčmář Cc: Michal Hocko Cc: Felix Kuehling Cc: Ralph Campbell Cc: John Hubbard Cc: Andrew Morton Fixes: ac46d4f3c432 ("mm/mmu_notifier: use structure for invalidate_range_start/end calls v2") Signed-off-by: Sean Christopherson Signed-off-by: Linus Torvalds mm/rmap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 4089e272ac61603931beb024d4d640de2cb390e0 Author: Tetsuo Handa Date: Thu Jan 10 19:19:31 2019 +0900 gpu/drm: Fix lock held when returning to user space. We need to call drm_modeset_acquire_fini() when drm_atomic_state_alloc() failed or call drm_modeset_acquire_init() after drm_atomic_state_alloc() succeeded. Signed-off-by: Tetsuo Handa Reported-by: syzbot Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/1547115571-21219-1-git-send-email-penguin-kernel@I-love.SAKURA.ne.jp drivers/gpu/drm/drm_atomic_uapi.c | 3 +-- drivers/gpu/drm/drm_mode_object.c | 4 ++-- 2 files changed, 3 insertions(+), 4 deletions(-) commit ca27e4cd0bdd87e33fda38e6e3d18d36d54356d4 Author: Vincent Guittot Date: Thu Jan 10 10:00:40 2019 +0100 PM-runtime: Fix autosuspend_delay on 32bits arch Cast autosuspend_delay to u64 to make sure that the full computation of 'expires' or slack will be done in u64, even on 32bits arch. Otherwise, any delay greater than 2^31 nsec can overflow if signed 32bits is used when converting delay from msec to nsec. Fixes: 8234f6734c5d (PM-runtime: Switch autosuspend over to using hrtimers) Reported-by: Tony Lindgren Tested-by: Tony Lindgren Signed-off-by: Vincent Guittot Signed-off-by: Rafael J. Wysocki drivers/base/power/runtime.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 1f7b7081568bca281f4ef42096206180cfaced00 Author: Ladislav Michl Date: Thu Jan 10 00:19:44 2019 +0100 PM-runtime: Fix 'jiffies' in comments after switch to hrtimers PM-runtime now uses the hrtimers infrastructure for autosuspend, however comments still reference 'jiffies'. Fixes: 8234f6734c5d (PM-runtime: Switch autosuspend over to using hrtimers) Signed-off-by: Ladislav Michl Signed-off-by: Rafael J. Wysocki drivers/base/power/runtime.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 85f5a4d666fd9be73856ed16bb36c5af5b406b29 Author: Ilya Dryomov Date: Tue Jan 8 19:47:38 2019 +0100 rbd: don't return 0 on unmap if RBD_DEV_FLAG_REMOVING is set There is a window between when RBD_DEV_FLAG_REMOVING is set and when the device is removed from rbd_dev_list. During this window, we set "already" and return 0. Returning 0 from write(2) can confuse userspace tools because 0 indicates that nothing was written. In particular, "rbd unmap" will retry the write multiple times a second: 10:28:05.463299 write(4, "0", 1) = 0 10:28:05.463509 write(4, "0", 1) = 0 10:28:05.463720 write(4, "0", 1) = 0 10:28:05.463942 write(4, "0", 1) = 0 10:28:05.464155 write(4, "0", 1) = 0 Cc: stable@vger.kernel.org Signed-off-by: Ilya Dryomov Tested-by: Dongsheng Yang drivers/block/rbd.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) commit 35e6103861a3a970de6c84688c6e7a1f65b164ca Author: Florian Westphal Date: Wed Jan 9 14:37:34 2019 +0100 xfrm: refine validation of template and selector families The check assumes that in transport mode, the first templates family must match the address family of the policy selector. Syzkaller managed to build a template using MODE_ROUTEOPTIMIZATION, with ipv4-in-ipv6 chain, leading to following splat: BUG: KASAN: stack-out-of-bounds in xfrm_state_find+0x1db/0x1854 Read of size 4 at addr ffff888063e57aa0 by task a.out/2050 xfrm_state_find+0x1db/0x1854 xfrm_tmpl_resolve+0x100/0x1d0 xfrm_resolve_and_create_bundle+0x108/0x1000 [..] Problem is that addresses point into flowi4 struct, but xfrm_state_find treats them as being ipv6 because it uses templ->encap_family is used (AF_INET6 in case of reproducer) rather than family (AF_INET). This patch inverts the logic: Enforce 'template family must match selector' EXCEPT for tunnel and BEET mode. In BEET and Tunnel mode, xfrm_tmpl_resolve_one will have remote/local address pointers changed to point at the addresses found in the template, rather than the flowi ones, so no oob read will occur. Reported-by: 3ntr0py1337@gmail.com Reported-by: Daniel Borkmann Signed-off-by: Florian Westphal Signed-off-by: Steffen Klassert net/xfrm/xfrm_user.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) commit c25748acc5c20786ecb7518bfeae8fcef93472d6 Author: Peter Ujfalusi Date: Wed Dec 19 13:47:26 2018 +0200 ARM: dts: da850-lcdk: Correct the sound card name To avoid the following error: asoc-simple-card sound: ASoC: Failed to create card debugfs directory Which is because the card name contains '/' character, which can not be used in file or directory names. Signed-off-by: Peter Ujfalusi Signed-off-by: Sekhar Nori arch/arm/boot/dts/da850-lcdk.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bd540ebe68c3017194a1caa38e075bbbc0832749 Author: Peter Ujfalusi Date: Wed Dec 19 13:47:25 2018 +0200 ARM: dts: da850-lcdk: Correct the audio codec regulators Add the board level fixed regulators for 3.3V and 1.8V which is used to power - among other things - the tlv320aic3106 codec. Apart from removing the following warning during boot: tlv320aic3x-codec 0-0018: Invalid supply voltage(s) AVDD: -22, DVDD: -22 With the correct voltages the driver can select correct OCMV value to reduce pop noise. Signed-off-by: Peter Ujfalusi Signed-off-by: Sekhar Nori arch/arm/boot/dts/da850-lcdk.dts | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) commit 7fca69d4e43fa1ae9cb4f652772c132dc5a659c6 Author: Peter Ujfalusi Date: Wed Dec 19 13:47:24 2018 +0200 ARM: dts: da850-evm: Correct the sound card name To avoid the following error: asoc-simple-card sound: ASoC: Failed to create card debugfs directory Which is because the card name contains '/' character, which can not be used in file or directory names. Signed-off-by: Peter Ujfalusi Signed-off-by: Sekhar Nori arch/arm/boot/dts/da850-evm.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 706edaa88835e3d8de8920584ad5da76dd3d6666 Author: Peter Ujfalusi Date: Wed Dec 19 13:47:23 2018 +0200 ARM: dts: da850-evm: Correct the audio codec regulators Add the board level fixed regulators for 3.3V and 1.8V which is used to power - among other things - the tlv320aic3106 codec. Apart from removing the following warning during boot: tlv320aic3x-codec 0-0018: Too high supply voltage(s) AVDD: 5000000, DVDD: 5000000 With the correct voltages the driver can select correct OCMV value to reduce pop noise. Signed-off-by: Peter Ujfalusi Signed-off-by: Sekhar Nori arch/arm/boot/dts/da850-evm.dts | 29 +++++++++++++++++++++++++---- 1 file changed, 25 insertions(+), 4 deletions(-) commit 054b8dc381b1c784852ad3e109270d236a58b71d Author: Bartosz Golaszewski Date: Thu Jan 3 16:11:04 2019 +0100 ARM: davinci: omapl138-hawk: fix label names in GPIO lookup entries Since commit 587f7a694f01 ("gpio: davinci: Use dev name for label and automatic base selection") the gpiochip label no longer has an ID suffix. Update the GPIO lookup entries. Fixes: 587f7a694f01 ("gpio: davinci: Use dev name for label and automatic base selection") Cc: stable@vger.kernel.org Signed-off-by: Bartosz Golaszewski Signed-off-by: Sekhar Nori arch/arm/mach-davinci/board-omapl138-hawk.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 7f1015b29d9b9eb1cd3c038d6c30d698c6d7782e Author: Bartosz Golaszewski Date: Thu Jan 3 16:11:03 2019 +0100 ARM: davinci: dm644x-evm: fix label names in GPIO lookup entries Since commit 587f7a694f01 ("gpio: davinci: Use dev name for label and automatic base selection") the gpiochip label no longer has an ID suffix. Update the GPIO lookup entries. Fixes: 587f7a694f01 ("gpio: davinci: Use dev name for label and automatic base selection") Cc: stable@vger.kernel.org Signed-off-by: Bartosz Golaszewski Signed-off-by: Sekhar Nori arch/arm/mach-davinci/board-dm644x-evm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 94777ed3b644a1af09843f729b2a3f25794bed0f Author: Bartosz Golaszewski Date: Thu Jan 3 16:11:02 2019 +0100 ARM: davinci: dm355-evm: fix label names in GPIO lookup entries Since commit 587f7a694f01 ("gpio: davinci: Use dev name for label and automatic base selection") the gpiochip label no longer has an ID suffix. Update the GPIO lookup entries. Fixes: 587f7a694f01 ("gpio: davinci: Use dev name for label and automatic base selection") Cc: stable@vger.kernel.org Signed-off-by: Bartosz Golaszewski Signed-off-by: Sekhar Nori arch/arm/mach-davinci/board-dm355-evm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit c3f08cceb6a59f328f1c847b002729d1584c7a32 Author: Bartosz Golaszewski Date: Thu Jan 3 16:11:01 2019 +0100 ARM: davinci: da850-evm: fix label names in GPIO lookup entries Since commit 587f7a694f01 ("gpio: davinci: Use dev name for label and automatic base selection") the gpiochip label no longer has an ID suffix. Update the GPIO lookup entries. Fixes: 587f7a694f01 ("gpio: davinci: Use dev name for label and automatic base selection") Cc: stable@vger.kernel.org Signed-off-by: Bartosz Golaszewski Signed-off-by: Sekhar Nori arch/arm/mach-davinci/board-da850-evm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit cc557afb4d10cba175fd08d51c557004a229eded Author: Bartosz Golaszewski Date: Thu Jan 3 16:11:00 2019 +0100 ARM: davinci: da830-evm: fix label names in GPIO lookup entries Since commit 587f7a694f01 ("gpio: davinci: Use dev name for label and automatic base selection") the gpiochip label no longer has an ID suffix. Update the GPIO lookup entries. Fixes: 587f7a694f01 ("gpio: davinci: Use dev name for label and automatic base selection") Cc: stable@vger.kernel.org Signed-off-by: Bartosz Golaszewski Signed-off-by: Sekhar Nori arch/arm/mach-davinci/board-da830-evm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 66a8d5bfb518f9f12d47e1d2dce1732279f9451e Author: Ivan Mironov Date: Tue Jan 8 12:23:53 2019 +0500 drm/fb-helper: Ignore the value of fb_var_screeninfo.pixclock Strict requirement of pixclock to be zero breaks support of SDL 1.2 which contains hardcoded table of supported video modes with non-zero pixclock values[1]. To better understand which pixclock values are considered valid and how driver should handle these values, I briefly examined few existing fbdev drivers and documentation in Documentation/fb/. And it looks like there are no strict rules on that and actual behaviour varies: * some drivers treat (pixclock == 0) as "use defaults" (uvesafb.c); * some treat (pixclock == 0) as invalid value which leads to -EINVAL (clps711x-fb.c); * some pass converted pixclock value to hardware (uvesafb.c); * some are trying to find nearest value from predefined table (vga16fb.c, video_gx.c). Given this, I believe that it should be safe to just ignore this value if changing is not supported. It seems that any portable fbdev application which was not written only for one specific device working under one specific kernel version should not rely on any particular behaviour of pixclock anyway. However, while enabling SDL1 applications to work out of the box when there is no /etc/fb.modes with valid settings, this change affects the video mode choosing logic in SDL. Depending on current screen resolution, contents of /etc/fb.modes and resolution requested by application, this may lead to user-visible difference (not always): image will be displayed in a right way, but it will be aligned to the left instead of center. There is no "right behaviour" here as well, as emulated fbdev, opposing to old fbdev drivers, simply ignores any requsts of video mode changes with resolutions smaller than current. The easiest way to reproduce this problem is to install sdl-sopwith[2], remove /etc/fb.modes file if it exists, and then try to run sopwith from console without X. At least in Fedora 29, sopwith may be simply installed from standard repositories. [1] SDL 1.2.15 source code, src/video/fbcon/SDL_fbvideo.c, vesa_timings [2] http://sdl-sopwith.sourceforge.net/ Signed-off-by: Ivan Mironov Cc: stable@vger.kernel.org Fixes: 79e539453b34e ("DRM: i915: add mode setting support") Fixes: 771fe6b912fca ("drm/radeon: introduce kernel modesetting for radeon hardware") Fixes: 785b93ef8c309 ("drm/kms: move driver specific fb common code to helper functions (v2)") Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20190108072353.28078-3-mironov.ivan@gmail.com drivers/gpu/drm/drm_fb_helper.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 62d85b3bf9d978ed4b6b2aeef5cf0ccf1423906e Author: Ivan Mironov Date: Tue Jan 8 12:23:52 2019 +0500 drm/fb-helper: Partially bring back workaround for bugs of SDL 1.2 SDL 1.2 sets all fields related to the pixel format to zero in some cases[1]. Prior to commit db05c48197759 ("drm: fb-helper: Reject all pixel format changing requests"), there was an unintentional workaround for this that existed for more than a decade. First in device-specific DRM drivers, then here in drm_fb_helper.c. Previous code containing this workaround just ignores pixel format fields from userspace code. Not a good thing either, as this way, driver may silently use pixel format different from what client actually requested, and this in turn will lead to displaying garbage on the screen. I think that returning EINVAL to userspace in this particular case is the right option, so I decided to left code from problematic commit untouched instead of just reverting it entirely. Here is the steps required to reproduce this problem exactly: 1) Compile fceux[2] with SDL 1.2.15 and without GTK or OpenGL support. SDL should be compiled with fbdev support (which is on by default). 2) Create /etc/fb.modes with following contents (values seems not used, and just required to trigger problematic code in SDL): mode "test" geometry 1 1 1 1 1 timings 1 1 1 1 1 1 1 endmode 3) Create ~/.fceux/fceux.cfg with following contents: SDL.Hotkeys.Quit = 27 SDL.DoubleBuffering = 1 4) Ensure that screen resolution is at least 1280x960 (e.g. append "video=Virtual-1:1280x960-32" to the kernel cmdline for qemu/QXL). 5) Try to run fceux on VT with some ROM file[3]: # ./fceux color_test.nes [1] SDL 1.2.15 source code, src/video/fbcon/SDL_fbvideo.c, FB_SetVideoMode() [2] http://www.fceux.com [3] Example ROM: https://github.com/bokuweb/rustynes/blob/master/roms/color_test.nes Reported-by: saahriktu Suggested-by: saahriktu Cc: stable@vger.kernel.org Fixes: db05c48197759 ("drm: fb-helper: Reject all pixel format changing requests") Signed-off-by: Ivan Mironov [danvet: Delete misleading comment.] Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20190108072353.28078-2-mironov.ivan@gmail.com Link: https://patchwork.freedesktop.org/patch/msgid/20190108072353.28078-2-mironov.ivan@gmail.com drivers/gpu/drm/drm_fb_helper.c | 126 +++++++++++++++++++++++----------------- 1 file changed, 73 insertions(+), 53 deletions(-) commit b1360dcfdaa1d55952e5ec8dd9d99f88965d7ac9 Author: Jernej Skrabec Date: Wed Jan 9 19:16:04 2019 +0100 arm64: dts: allwinner: a64: Fix USB OTG regulator Currently, AXP803 driver assumes that reg_drivevbus is input which is wrong. Unfortunate consequence of that is that none of the USB ports work on the board, even USB HOST port, because USB PHY driver probing fails due to missing regulator. Fix that by adding "x-powers,drive-vbus-en" property to AXP803 node. Fixes: 14ff5d8f9151 ("arm64: dts: allwinner: a64: Orange Pi Win: Enable USB OTG socket") Cc: stable@vger.kernel.org Signed-off-by: Jernej Skrabec Signed-off-by: Maxime Ripard arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts | 1 + 1 file changed, 1 insertion(+) commit ee46967fc6e74d412fe1ec15f77fdb8624bde2b0 Author: Peter Hutterer Date: Wed Jan 9 13:50:18 2019 +1000 HID: core: replace the collection tree pointers with indices Previously, the pointer to the parent collection was stored. If a device exceeds 16 collections (HID_DEFAULT_NUM_COLLECTIONS), the array to store the collections is reallocated, the pointer to the parent collection becomes invalid. Replace the pointers with an index-based lookup into the collections array. Fixes: c53431eb696f3c ("HID: core: store the collections as a basic tree") Reported-by: Pandruvada, Srinivas Signed-off-by: Peter Hutterer Tested-by: Kyle Pelton Signed-off-by: Jiri Kosina drivers/hid/hid-core.c | 32 +++++++++++++++++++++----------- include/linux/hid.h | 4 ++-- 2 files changed, 23 insertions(+), 13 deletions(-) commit 5db470e229e22b7eda6e23b5566e532c96fb5bc3 Author: Jaegeuk Kim Date: Wed Jan 9 19:17:14 2019 -0800 loop: drop caches if offset or block_size are changed If we don't drop caches used in old offset or block_size, we can get old data from new offset/block_size, which gives unexpected data to user. For example, Martijn found a loopback bug in the below scenario. 1) LOOP_SET_FD loads first two pages on loop file 2) LOOP_SET_STATUS64 changes the offset on the loop file 3) mount is failed due to the cached pages having wrong superblock Cc: Jens Axboe Cc: linux-block@vger.kernel.org Reported-by: Martijn Coenen Reviewed-by: Bart Van Assche Signed-off-by: Jaegeuk Kim Signed-off-by: Jens Axboe drivers/block/loop.c | 35 +++++++++++++++++++++++++++++++++-- 1 file changed, 33 insertions(+), 2 deletions(-) commit b5679cebf780c6f1c2451a73bf1842a4409840e7 Author: Dexuan Cui Date: Wed Jan 9 20:56:06 2019 +0000 vmbus: fix subchannel removal The changes to split ring allocation from open/close, broke the cleanup of subchannels. This resulted in problems using uio on network devices because the subchannel was left behind when the network device was unbound. The cause was in the disconnect logic which used list splice to move the subchannel list into a local variable. This won't work because the subchannel list is needed later during the process of the rescind messages (relid2channel). The fix is to just leave the subchannel list in place which is what the original code did. The list is cleaned up later when the host rescind is processed. Without the fix, we have a lot of "hang" issues in netvsc when we try to change the NIC's MTU, set the number of channels, etc. Fixes: ae6935ed7d42 ("vmbus: split ring buffer allocation from open") Cc: stable@vger.kernel.org Signed-off-by: Stephen Hemminger Signed-off-by: Dexuan Cui Signed-off-by: Sasha Levin drivers/hv/channel.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) commit 31aa6503a15ba00182ea6dbbf51afb63bf9e851d Author: Yuchung Cheng Date: Tue Jan 8 18:12:24 2019 -0800 bpf: correctly set initial window on active Fast Open sender The existing BPF TCP initial congestion window (TCP_BPF_IW) does not to work on (active) Fast Open sender. This is because it changes the (initial) window only if data_segs_out is zero -- but data_segs_out is also incremented on SYN-data. This patch fixes the issue by proerly accounting for SYN-data additionally. Fixes: fc7478103c84 ("bpf: Adds support for setting initial cwnd") Signed-off-by: Yuchung Cheng Reviewed-by: Neal Cardwell Acked-by: Lawrence Brakmo Signed-off-by: Alexei Starovoitov net/core/filter.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 27de1f541f1f911bc2242ae68ef7375247b36c7d Author: Anup Patel Date: Tue Dec 4 19:25:05 2018 +0530 tty/serial: Add RISC-V SBI earlycon support In RISC-V, the M-mode runtime firmware provide SBI calls for debug prints. This patch adds earlycon support using RISC-V SBI console calls. To enable it, just pass "earlycon=sbi" in kernel parameters. Signed-off-by: Anup Patel Acked-by: Greg Kroah-Hartman Reviewed-by: Palmer Dabbelt Signed-off-by: Palmer Dabbelt drivers/tty/serial/Kconfig | 12 ++++++++++++ drivers/tty/serial/Makefile | 1 + drivers/tty/serial/earlycon-riscv-sbi.c | 28 ++++++++++++++++++++++++++++ 3 files changed, 41 insertions(+) commit 649d4968860ba708636ad643bd52b28027367042 Author: Jonathan Corbet Date: Wed Jan 9 13:59:32 2019 -0700 block: fix kerneldoc comment for blk_attempt_plug_merge() Commit 5f0ed774ed29 ("block: sum requests in the plug structure") removed the request_count parameter from block_attempt_plug_merge(), but did not remove the associated kerneldoc comment, introducing this warning to the docs build: ./block/blk-core.c:685: warning: Excess function parameter 'request_count' description in 'blk_attempt_plug_merge' Remove the obsolete description and make things a little quieter. Signed-off-by: Jonathan Corbet Signed-off-by: Jens Axboe block/blk-core.c | 1 - 1 file changed, 1 deletion(-) commit a799aea0988ea0d1b1f263e996fdad2f6133c680 Author: wenxu Date: Wed Jan 9 10:40:11 2019 +0800 netfilter: nft_flow_offload: Fix reverse route lookup Using the following example: client 1.1.1.7 ---> 2.2.2.7 which dnat to 10.0.0.7 server The first reply packet (ie. syn+ack) uses an incorrect destination address for the reverse route lookup since it uses: daddr = ct->tuplehash[!dir].tuple.dst.u3.ip; which is 2.2.2.7 in the scenario that is described above, while this should be: daddr = ct->tuplehash[dir].tuple.src.u3.ip; that is 10.0.0.7. Signed-off-by: wenxu Signed-off-by: Pablo Neira Ayuso net/netfilter/nft_flow_offload.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit e7f45099442a380f8e087b6a8aadc36e887df1cc Author: Santosh kumar pradhan Date: Wed Jan 9 22:08:26 2019 +0530 sunrpc: kernel BUG at kernel/cred.c:825! Init missing debug member magic with CRED_MAGIC. Signed-off-by: Santosh kumar pradhan Reported-by: Dave Jones Signed-off-by: Anna Schumaker net/sunrpc/auth.c | 3 +++ 1 file changed, 3 insertions(+) commit 321c46b91550adc03054125fa7a1639390608e1a Author: Rafał Miłecki Date: Thu Jan 3 08:34:17 2019 +0100 MIPS: BCM47XX: Setup struct device for the SoC So far we never had any device registered for the SoC. This resulted in some small issues that we kept ignoring like: 1) Not working GPIOLIB_IRQCHIP (gpiochip_irqchip_add_key() failing) 2) Lack of proper tree in the /sys/devices/ 3) mips_dma_alloc_coherent() silently handling empty coherent_dma_mask Kernel 4.19 came with a lot of DMA changes and caused a regression on bcm47xx. Starting with the commit f8c55dc6e828 ("MIPS: use generic dma noncoherent ops for simple noncoherent platforms") DMA coherent allocations just fail. Example: [ 1.114914] bgmac_bcma bcma0:2: Allocation of TX ring 0x200 failed [ 1.121215] bgmac_bcma bcma0:2: Unable to alloc memory for DMA [ 1.127626] bgmac_bcma: probe of bcma0:2 failed with error -12 [ 1.133838] bgmac_bcma: Broadcom 47xx GBit MAC driver loaded The bgmac driver also triggers a WARNING: [ 0.959486] ------------[ cut here ]------------ [ 0.964387] WARNING: CPU: 0 PID: 1 at ./include/linux/dma-mapping.h:516 bgmac_enet_probe+0x1b4/0x5c4 [ 0.973751] Modules linked in: [ 0.976913] CPU: 0 PID: 1 Comm: swapper Not tainted 4.19.9 #0 [ 0.982750] Stack : 804a0000 804597c4 00000000 00000000 80458fd8 8381bc2c 838282d4 80481a47 [ 0.991367] 8042e3ec 00000001 804d38f0 00000204 83980000 00000065 8381bbe0 6f55b24f [ 0.999975] 00000000 00000000 80520000 00002018 00000000 00000075 00000007 00000000 [ 1.008583] 00000000 80480000 000ee811 00000000 00000000 00000000 80432c00 80248db8 [ 1.017196] 00000009 00000204 83980000 803ad7b0 00000000 801feeec 00000000 804d0000 [ 1.025804] ... [ 1.028325] Call Trace: [ 1.030875] [<8000aef8>] show_stack+0x58/0x100 [ 1.035513] [<8001f8b4>] __warn+0xe4/0x118 [ 1.039708] [<8001f9a4>] warn_slowpath_null+0x48/0x64 [ 1.044935] [<80248db8>] bgmac_enet_probe+0x1b4/0x5c4 [ 1.050101] [<802498e0>] bgmac_probe+0x558/0x590 [ 1.054906] [<80252fd0>] bcma_device_probe+0x38/0x70 [ 1.060017] [<8020e1e8>] really_probe+0x170/0x2e8 [ 1.064891] [<8020e714>] __driver_attach+0xa4/0xec [ 1.069784] [<8020c1e0>] bus_for_each_dev+0x58/0xb0 [ 1.074833] [<8020d590>] bus_add_driver+0xf8/0x218 [ 1.079731] [<8020ef24>] driver_register+0xcc/0x11c [ 1.084804] [<804b54cc>] bgmac_init+0x1c/0x44 [ 1.089258] [<8000121c>] do_one_initcall+0x7c/0x1a0 [ 1.094343] [<804a1d34>] kernel_init_freeable+0x150/0x218 [ 1.099886] [<803a082c>] kernel_init+0x10/0x104 [ 1.104583] [<80005878>] ret_from_kernel_thread+0x14/0x1c [ 1.110107] ---[ end trace f441c0d873d1fb5b ]--- This patch setups a "struct device" (and passes it to the bcma) which allows fixing all the mentioned problems. It'll also require a tiny bcma patch which will follow through the wireless tree & its maintainer. Fixes: f8c55dc6e828 ("MIPS: use generic dma noncoherent ops for simple noncoherent platforms") Signed-off-by: Rafał Miłecki Signed-off-by: Paul Burton Acked-by: Hauke Mehrtens Cc: Christoph Hellwig Cc: Linus Walleij Cc: linux-wireless@vger.kernel.org Cc: Ralf Baechle Cc: James Hogan Cc: linux-mips@linux-mips.org Cc: linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org # v4.19+ arch/mips/bcm47xx/setup.c | 31 +++++++++++++++++++++++++++++++ include/linux/bcma/bcma_soc.h | 1 + 2 files changed, 32 insertions(+) commit 41af167fbc0032f9d7562854f58114eaa9270336 Author: Thomas Bogendoerfer Date: Wed Jan 9 18:12:16 2019 +0100 MIPS: jazz: fix 64bit build 64bit JAZZ builds failed with linux-next/arch/mips/jazz/jazzdma.c: In function `vdma_init`: /linux-next/arch/mips/jazz/jazzdma.c:77:30: error: implicit declaration of function `KSEG1ADDR`; did you mean `CKSEG1ADDR`? [-Werror=implicit-function-declaration] pgtbl = (VDMA_PGTBL_ENTRY *)KSEG1ADDR(pgtbl); ^~~~~~~~~ CKSEG1ADDR /linux-next/arch/mips/jazz/jazzdma.c:77:10: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast] pgtbl = (VDMA_PGTBL_ENTRY *)KSEG1ADDR(pgtbl); ^ In file included from /linux-next/arch/mips/include/asm/barrier.h:11:0, from /linux-next/include/linux/compiler.h:248, from /linux-next/include/linux/kernel.h:10, from /linux-next/arch/mips/jazz/jazzdma.c:11: /linux-next/arch/mips/include/asm/addrspace.h:41:29: error: cast from pointer to integer of different size [-Werror=pointer-to-int-cast] #define _ACAST32_ (_ATYPE_)(_ATYPE32_) /* widen if necessary */ ^ /linux-next/arch/mips/include/asm/addrspace.h:53:25: note: in expansion of macro `_ACAST32_` #define CPHYSADDR(a) ((_ACAST32_(a)) & 0x1fffffff) ^~~~~~~~~ /linux-next/arch/mips/jazz/jazzdma.c:84:44: note: in expansion of macro `CPHYSADDR` r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE, CPHYSADDR(pgtbl)); Using correct casts and CKSEG1ADDR when dealing with the pgtbl setup fixes this. Signed-off-by: Thomas Bogendoerfer Signed-off-by: Paul Burton Cc: Ralf Baechle Cc: James Hogan Cc: linux-mips@vger.kernel.org Cc: linux-kernel@vger.kernel.org arch/mips/jazz/jazzdma.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 1c1eba86339c8517814863bc7dd21e2661a84e77 Author: Christian König Date: Mon Jan 7 14:43:55 2019 +0100 drm/amdgpu: disable system memory page tables for now We hit a problem with IOMMU with that. Disable until we have time to debug further. Signed-off-by: Christian König Reviewed-by: Michel Dänzer Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 3 --- 1 file changed, 3 deletions(-) commit 0c6c8125582714e1fd3544983eba3d750db0f5b8 Author: Jim Qu Date: Mon Dec 17 17:00:50 2018 +0800 drm/amdgpu: set WRITE_BURST_LENGTH to 64B to workaround SDMA1 hang effect asics: VEGA10 and VEGA12 Signed-off-by: Jim Qu Acked-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 3e958fe67720b37d04ab8ef81b9d507a56a09bbc Author: Tao Zhou Date: Tue Jan 8 15:08:44 2019 +0800 drm/amdgpu: fix CPDMA hang in PRT mode for VEGA20 Fix CPDMA hang in PRT mode for both VEGA10 and VEGA20 Signed-off-by: Tao Zhou Tested-by: Yukun.Li Acked-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 239b8b34a856777e562373ae0de605536a7ccade Author: Mac Chiang Date: Wed Dec 5 18:11:19 2018 +0800 ASoC: Intel: Boards: move the codec PLL configuration to _init move the codec PLL to rt5682_codec_init, because codec only need to config the clock source/PLL once. As the result, remove the platform_clock_controls since no need to control clock anymore. Signed-off-by: Shuming Fan Signed-off-by: Mac Chiang Acked-by: Pierre-Louis Bossart Signed-off-by: Mark Brown sound/soc/intel/boards/glk_rt5682_max98357a.c | 45 +++++---------------------- 1 file changed, 7 insertions(+), 38 deletions(-) commit 549aff770ccfec368aa8f0652dbce8b1e8e6715a Author: Arnaldo Carvalho de Melo Date: Wed Jan 9 16:19:24 2019 -0300 perf symbols: Add 'arch_cpu_idle' to the list of kernel idle symbols When testing 'perf top' on a armhf system (32-bit, Orange Pi Zero), I noticed that 'arch_cpu_idle' dominated, add it to the list of idle symbols, so that we can see what is that being done when not idle. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-4q2b5g4p2hrstrhp9t2mrlho@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/symbol.c | 1 + 1 file changed, 1 insertion(+) commit da8ced360ca8ad72d8f41f5c8fcd5b0e63e1555f Author: Vitaly Kuznetsov Date: Fri Jan 4 15:19:42 2019 +0100 hv_balloon: avoid touching uninitialized struct page during tail onlining Hyper-V memory hotplug protocol has 2M granularity and in Linux x86 we use 128M. To deal with it we implement partial section onlining by registering custom page onlining callback (hv_online_page()). Later, when more memory arrives we try to online the 'tail' (see hv_bring_pgs_online()). It was found that in some cases this 'tail' onlining causes issues: BUG: Bad page state in process kworker/0:2 pfn:109e3a page:ffffe08344278e80 count:0 mapcount:1 mapping:0000000000000000 index:0x0 flags: 0xfffff80000000() raw: 000fffff80000000 dead000000000100 dead000000000200 0000000000000000 raw: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 page dumped because: nonzero mapcount ... Workqueue: events hot_add_req [hv_balloon] Call Trace: dump_stack+0x5c/0x80 bad_page.cold.112+0x7f/0xb2 free_pcppages_bulk+0x4b8/0x690 free_unref_page+0x54/0x70 hv_page_online_one+0x5c/0x80 [hv_balloon] hot_add_req.cold.24+0x182/0x835 [hv_balloon] ... Turns out that we now have deferred struct page initialization for memory hotplug so e.g. memory_block_action() in drivers/base/memory.c does pages_correctly_probed() check and in that check it avoids inspecting struct pages and checks sections instead. But in Hyper-V balloon driver we do PageReserved(pfn_to_page()) check and this is now wrong. Switch to checking online_section_nr() instead. Signed-off-by: Vitaly Kuznetsov Cc: stable@kernel.org Signed-off-by: Sasha Levin drivers/hv/hv_balloon.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit ba50bf1ce9a51fc97db58b96d01306aa70bc3979 Author: Dexuan Cui Date: Mon Dec 17 20:16:09 2018 +0000 Drivers: hv: vmbus: Check for ring when getting debug info fc96df16a1ce is good and can already fix the "return stack garbage" issue, but let's also improve hv_ringbuffer_get_debuginfo(), which would silently return stack garbage, if people forget to check channel->state or ring_info->ring_buffer, when using the function in the future. Having an error check in the function would eliminate the potential risk. Add a Fixes tag to indicate the patch depdendency. Fixes: fc96df16a1ce ("Drivers: hv: vmbus: Return -EINVAL for the sys files for unopened channels") Cc: stable@vger.kernel.org Cc: K. Y. Srinivasan Cc: Haiyang Zhang Signed-off-by: Stephen Hemminger Signed-off-by: Dexuan Cui Signed-off-by: Sasha Levin drivers/hv/ring_buffer.c | 31 ++++++++--------- drivers/hv/vmbus_drv.c | 91 ++++++++++++++++++++++++++++++++---------------- include/linux/hyperv.h | 5 +-- 3 files changed, 79 insertions(+), 48 deletions(-) commit 2137a109a5e39c2bdccfffe65230ed3fadbaac0e Author: Marek Vasut Date: Sat Dec 15 01:55:19 2018 +0100 clk: vc5: Abort clock configuration without upstream clock In case the upstream clock are not set, which can happen in case the VC5 has no valid upstream clock, the $src variable is used uninited by regmap_update_bits(). Check for this condition and return -EINVAL in such case. Note that in case the VC5 has no valid upstream clock, the VC5 can not operate correctly. That is a hardware property of the VC5. The internal oscilator present in some VC5 models is also considered upstream clock. Signed-off-by: Marek Vasut Cc: Alexey Firago Cc: Laurent Pinchart Cc: Stephen Boyd Cc: linux-renesas-soc@vger.kernel.org [sboyd@kernel.org: Added comment about probe preventing this from happening in the first place] Signed-off-by: Stephen Boyd drivers/clk/clk-versaclock5.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit b8a38ea64dc714a64f8fb76e311a4f15a3f67861 Author: Andrey Smirnov Date: Mon Jan 7 19:08:49 2019 -0800 nvme: don't initlialize ctrl->cntlid twice ctrl->cntlid will already be initialized from id->cntlid for non-NVME_F_FABRICS controllers few lines below. For NVME_F_FABRICS controllers this field should already be initialized, otherwise the check if (ctrl->cntlid != le16_to_cpu(id->cntlid)) below will always be a no-op. Signed-off-by: Andrey Smirnov Reviewed-by: Keith Busch Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig drivers/nvme/host/core.c | 1 - 1 file changed, 1 deletion(-) commit 6299358d198a0635da2dd3c4b3ec37789e811e44 Author: James Dingwall Date: Tue Jan 8 10:20:51 2019 -0700 nvme: introduce NVME_QUIRK_IGNORE_DEV_SUBNQN If a device provides an NQN it is expected to be globally unique. Unfortunately some firmware revisions for Intel 760p/Pro 7600p devices did not satisfy this requirement. In these circumstances if a system has >1 affected device then only one device is enabled. If this quirk is enabled then the device supplied subnqn is ignored and we fallback to generating one as if the field was empty. In this case we also suppress the version check so we don't print a warning when the quirk is enabled. Reviewed-by: Keith Busch Signed-off-by: James Dingwall Signed-off-by: Christoph Hellwig drivers/nvme/host/core.c | 16 +++++++++------- drivers/nvme/host/nvme.h | 5 +++++ drivers/nvme/host/pci.c | 2 ++ 3 files changed, 16 insertions(+), 7 deletions(-) commit 3da584f57133e51aeb84aaefae5e3d69531a1e4f Author: Keith Busch Date: Tue Jan 8 09:37:43 2019 -0700 nvme: pad fake subsys NQN vid and ssvid with zeros We need to preserve the leading zeros in the vid and ssvid when generating a unique NQN. Truncating these may lead to naming collisions. Signed-off-by: Keith Busch Signed-off-by: Christoph Hellwig drivers/nvme/host/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c7055fd15ff46d92eb0dd1c16a4fe010d58224c8 Author: Hannes Reinecke Date: Tue Jan 8 12:46:58 2019 +0100 nvme-multipath: zero out ANA log buffer When nvme_init_identify() fails the ANA log buffer is deallocated but _not_ set to NULL. This can cause double free oops when this controller is deleted without ever being reconnected. Signed-off-by: Hannes Reinecke Signed-off-by: Christoph Hellwig drivers/nvme/host/multipath.c | 2 ++ 1 file changed, 2 insertions(+) commit 9846ac0143fe9872e92fe2a1ddff868ad05bdbb6 Author: Sagi Grimberg Date: Mon Jan 7 23:54:23 2019 -0800 nvme-fabrics: unset write/poll queues for discovery controllers Even if user-space sent it to us, it got it wrong so lets help by disallowing it. Signed-off-by: Sagi Grimberg Signed-off-by: Christoph Hellwig drivers/nvme/host/fabrics.c | 2 ++ 1 file changed, 2 insertions(+) commit e85037a2e90ac9aa448a08927d7a7436206c6000 Author: Sagi Grimberg Date: Mon Dec 31 23:58:30 2018 -0800 nvme-tcp: don't ask if controller is fabrics For sure we are a fabric driver. Signed-off-by: Sagi Grimberg Signed-off-by: Christoph Hellwig drivers/nvme/host/tcp.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) commit e9c2edc098921173920df370c69b5c38fe52df56 Author: Sagi Grimberg Date: Mon Dec 31 23:58:29 2018 -0800 nvme-tcp: remove dead code We should never touch the opal device from the transport driver. Signed-off-by: Sagi Grimberg Signed-off-by: Christoph Hellwig drivers/nvme/host/tcp.c | 1 - 1 file changed, 1 deletion(-) commit dcca1662727220d18fa351097ddff33f95f516c5 Author: Hongbo Yao Date: Mon Jan 7 10:22:07 2019 +0800 nvme-pci: fix out of bounds access in nvme_cqe_pending There is an out of bounds array access in nvme_cqe_peding(). When enable irq_thread for nvme interrupt, there is racing between the nvmeq->cq_head updating and reading. nvmeq->cq_head is updated in nvme_update_cq_head(), if nvmeq->cq_head equals nvmeq->q_depth and before its value set to zero, nvme_cqe_pending() uses its value as an array index, the index will be out of bounds. Signed-off-by: Hongbo Yao [hch: slight coding style update] Signed-off-by: Christoph Hellwig drivers/nvme/host/pci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 8fae268b40f5191227ae7050a99cb2cf1b914ddd Author: Keith Busch Date: Fri Jan 4 15:04:33 2019 -0700 nvme-pci: rerun irq setup on IO queue init errors If the driver is unable to create a subset of IO queues for any reason, the read/write and polled queue sets will not match the actual allocated hardware contexts. This leaves gaps in the CPU affinity mappings and causes the following kernel panic after blk_mq_map_queue_type() returns a NULL hctx. BUG: unable to handle kernel NULL pointer dereference at 0000000000000198 #PF error: [normal kernel read fault] PGD 0 P4D 0 Oops: 0000 [#1] SMP CPU: 64 PID: 1171 Comm: kworker/u259:1 Not tainted 4.20.0+ #241 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-2.fc27 04/01/2014 Workqueue: nvme-wq nvme_scan_work [nvme_core] RIP: 0010:blk_mq_init_allocated_queue+0x2d9/0x440 RSP: 0018:ffffb1bf0abc3cd0 EFLAGS: 00010286 RAX: 000000000000001f RBX: ffff8ea744cf0718 RCX: 0000000000000000 RDX: 0000000000000002 RSI: 000000000000007c RDI: ffffffff9109a820 RBP: ffff8ea7565f7008 R08: 000000000000001f R09: 000000000000003f R10: ffffb1bf0abc3c00 R11: 0000000000000000 R12: 000000000001d008 R13: ffff8ea7565f7008 R14: 000000000000003f R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8ea757200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000198 CR3: 0000000013058000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: blk_mq_init_queue+0x35/0x60 nvme_validate_ns+0xc6/0x7c0 [nvme_core] ? nvme_identify_ctrl.isra.56+0x7e/0xc0 [nvme_core] nvme_scan_work+0xc8/0x340 [nvme_core] ? __wake_up_common+0x6d/0x120 ? try_to_wake_up+0x55/0x410 process_one_work+0x1e9/0x3d0 worker_thread+0x2d/0x3d0 ? process_one_work+0x3d0/0x3d0 kthread+0x111/0x130 ? kthread_park+0x90/0x90 ret_from_fork+0x1f/0x30 Modules linked in: nvme nvme_core serio_raw CR2: 0000000000000198 Fix by re-running the interrupt vector setup from scratch using a reduced count that may be successful until the created queues matches the irq affinity plus polling queue sets. Signed-off-by: Keith Busch Reviewed-by: Sagi Grimberg Reviewed-by: Ming Lei Signed-off-by: Christoph Hellwig drivers/nvme/host/pci.c | 50 +++++++++++++++++++++++++++++++++++-------------- 1 file changed, 36 insertions(+), 14 deletions(-) commit cc667f6d5de023ee131e96bb88e5cddca23272bd Author: Liviu Dudau Date: Sat Dec 29 17:23:43 2018 +0000 nvme-pci: use the same attributes when freeing host_mem_desc_bufs. When using HMB the PCIe host driver allocates host_mem_desc_bufs using dma_alloc_attrs() but frees them using dma_free_coherent(). Use the correct dma_free_attrs() function to free the buffers. Signed-off-by: Liviu Dudau Signed-off-by: Christoph Hellwig drivers/nvme/host/pci.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit c61e678f30da733a1b7fdd5983d0770de2e6009c Author: Jianchao Wang Date: Mon Dec 24 11:15:53 2018 +0800 nvme-pci: fix the wrong setting of nr_maps We only set the nr_maps to 3 if poll queues are supported. Signed-off-by: Jianchao Wang Signed-off-by: Christoph Hellwig drivers/nvme/host/pci.c | 1 - 1 file changed, 1 deletion(-) commit c6e909972ef87aa2a479269f46b84126f99ec6db Author: Lubomir Rintel Date: Fri Jan 4 23:05:49 2019 +0100 clk: sysfs: fix invalid JSON in clk_dump Add a missing comma so that the output is valid JSON format again. Fixes: 9fba738a53dd ("clk: add duty cycle support") Signed-off-by: Lubomir Rintel Signed-off-by: Stephen Boyd drivers/clk/clk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3d51e4d9de7dd4e495dfbc6f4803e0f99c120aff Author: Abel Vesa Date: Thu Jan 3 16:58:20 2019 +0000 clk: imx: Remove Kconfig duplicate include Commit d360b130e210f2 ("clk: imx: Make the i.MX8MQ CCM clock driver CLK_IMX8MQ dependant") introduced this duplicate and incorrectly ordered kconfig include. Fixes: d360b130e210f2 ("clk: imx: Make the i.MX8MQ CCM clock driver CLK_IMX8MQ dependant") Signed-off-by: Abel Vesa Reviewed-by: Dong Aisheng Signed-off-by: Stephen Boyd drivers/clk/Kconfig | 1 - 1 file changed, 1 deletion(-) commit 4f340efcb21220b7a0afcea3884e66f79e6f2306 Author: Gustavo A. R. Silva Date: Sun Dec 23 23:50:58 2018 -0600 clk: zynqmp: Fix memory allocation in zynqmp_clk_setup Fix memory allocation and use struct_size() in kzalloc(). This also fixes the allocation size to be correct, and smaller, because before we were allocating a bunch of sizeof(struct clk_hw_onecell_data) structures for each struct clk_hw we needed. Fixes: 3fde0e16d016 ("drivers: clk: Add ZynqMP clock driver") Cc: stable@vger.kernel.org Signed-off-by: Gustavo A. R. Silva Acked-by: Michal Simek [sboyd@kernel.org: Expand commit text] Signed-off-by: Stephen Boyd drivers/clk/zynqmp/clkc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit d39eca547f3ec67140a5d765a426eb157b978a59 Author: Dan Carpenter Date: Tue Dec 18 11:22:41 2018 +0300 clk: tegra: dfll: Fix a potential Oop in remove() If tegra_dfll_unregister() fails then "soc" is an error pointer. We should just return instead of dereferencing it. Fixes: 1752c9ee23fb ("clk: tegra: dfll: Fix drvdata overwriting issue") Signed-off-by: Dan Carpenter Signed-off-by: Stephen Boyd drivers/clk/tegra/clk-tegra124-dfll-fcpu.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 48504619a65977fb2a4c7182eab637867f1e6548 Author: Wei Yongjun Date: Tue Dec 18 06:43:09 2018 +0000 clk: imx: fix potential NULL dereference in imx8qxp_lpcg_clk_probe() platform_get_resource() may fail and return NULL, so we should better check it's return value to avoid a NULL pointer dereference a bit later in the code. This is detected by Coccinelle semantic patch. @@ expression pdev, res, n, t, e, e1, e2; @@ res = platform_get_resource(pdev, t, n); + if (!res) + return -EINVAL; ... when != res == NULL e = devm_ioremap(e1, res->start, e2); Fixes: 1e3121bfe51a ("clk: imx: add imx8qxp lpcg driver") Signed-off-by: Wei Yongjun Reviewed-by: Dong Aisheng Signed-off-by: Stephen Boyd drivers/clk/imx/clk-imx8qxp-lpcg.c | 2 ++ 1 file changed, 2 insertions(+) commit 4064e47c82810586975b4304b105056389beaa06 Merge: a88cc8da0279 56752b21755a Author: Linus Torvalds Date: Wed Jan 9 10:00:11 2019 -0800 Merge tag 'csky-for-linus-5.0-rc1' of git://github.com/c-sky/csky-linux Pull arch/csky bug fixes from Guo Ren: "Here are some fixup patches for 5.0-rc1: - fix compile error with pte_alloc - fix handle_irq_perbit break irq flow - fix CACHEV1 store instruction fast retire - fix module relocation error with 807 & 860 - add csky kernel features to documentation" * tag 'csky-for-linus-5.0-rc1' of git://github.com/c-sky/csky-linux: irqchip/csky: fixup handle_irq_perbit break irq csky: fixup compile error with pte_alloc csky: fixup CACHEV1 store instruction fast retire csky: fixup relocation error with 807 & 860 Documentation/features: Add csky kernel features commit 47cb393ee4815e10ab66f981fed581afdcc7caac Author: John Pittman Date: Tue Jan 8 16:56:13 2019 -0500 block: doc: add slice_idle_us to bfq documentation Of the tunables available for the bfq I/O scheduler, the only one missing from the documentation in 'Documentation/block/bfq-iosched.txt' is slice_idle_us. Add this tunable to the documentation and a short explanation of its purpose. Acked-by: Paolo Valente Signed-off-by: John Pittman Signed-off-by: Jens Axboe Documentation/block/bfq-iosched.txt | 7 +++++++ 1 file changed, 7 insertions(+) commit a6d8654d885d7d79a3fb82da64eaa489ca332a82 Author: Filipe Manana Date: Tue Jan 8 11:44:41 2019 +0000 Btrfs: fix deadlock when using free space tree due to block group creation When modifying the free space tree we can end up COWing one of its extent buffers which in turn might result in allocating a new chunk, which in turn can result in flushing (finish creation) of pending block groups. If that happens we can deadlock because creating a pending block group needs to update the free space tree, and if any of the updates tries to modify the same extent buffer that we are COWing, we end up in a deadlock since we try to write lock twice the same extent buffer. So fix this by skipping pending block group creation if we are COWing an extent buffer from the free space tree. This is a case missed by commit 5ce555578e091 ("Btrfs: fix deadlock when writing out free space caches"). Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=202173 Fixes: 5ce555578e091 ("Btrfs: fix deadlock when writing out free space caches") CC: stable@vger.kernel.org # 4.18+ Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/ctree.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) commit d8b5524242108cb7d28c9b8b9aded7c1edd0e8a8 Author: Filipe Manana Date: Tue Jan 8 11:43:07 2019 +0000 Btrfs: fix race between reflink/dedupe and relocation The recent rework that makes btrfs' remap_file_range operation use the generic helper generic_remap_file_range_prep() introduced a race between relocation and reflinking (for both cloning and deduplication) the file extents between the source and destination inodes. This happens because we no longer lock the source range anymore, and we do not lock it anymore because we wait for direct IO writes and writeback to complete early on the code path right after locking the inodes, which guarantees no other file operations interfere with the reflinking. However there is one exception which is relocation, since it replaces the byte number of file extents items in the fs tree after locking the range the file extent items represent. This is a problem because after finding each file extent to clone in the fs tree, the reflink process copies the file extent item into a local buffer, releases the search path, inserts new file extent items in the destination range and then increments the reference count for the extent mentioned in the file extent item that it previously copied to the buffer. If right after copying the file extent item into the buffer and releasing the path the relocation process updates the file extent item to point to the new extent, the reflink process ends up creating a delayed reference to increment the reference count of the old extent, for which the relocation process already created a delayed reference to drop it. This results in failure to run delayed references because we will attempt to increment the count of a reference that was already dropped. This is illustrated by the following diagram: CPU 1 CPU 2 relocation is running btrfs_clone_files() btrfs_clone() --> finds extent item in source range point to extent at bytenr X --> copies it into a local buffer --> releases path replace_file_extents() --> successfully locks the range represented by the file extent item --> replaces disk_bytenr field in the file extent item with some other value Y --> creates delayed reference to increment reference count for extent at bytenr Y --> creates delayed reference to drop the extent at bytenr X --> starts transaction --> creates delayed reference to increment extent at bytenr X When this race is hit the running transaction ends up getting aborted with an -EIO error and a trace like the following is produced: [ 4382.553858] WARNING: CPU: 2 PID: 3648 at fs/btrfs/extent-tree.c:1552 lookup_inline_extent_backref+0x4f4/0x650 [btrfs] (...) [ 4382.556293] CPU: 2 PID: 3648 Comm: btrfs Tainted: G W 4.20.0-rc6-btrfs-next-41 #1 [ 4382.556294] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.2-0-gf9626ccb91-prebuilt.qemu-project.org 04/01/2014 [ 4382.556308] RIP: 0010:lookup_inline_extent_backref+0x4f4/0x650 [btrfs] (...) [ 4382.556310] RSP: 0018:ffffac784408f738 EFLAGS: 00010202 [ 4382.556311] RAX: 0000000000000001 RBX: ffff8980673c3a48 RCX: 0000000000000001 [ 4382.556312] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000000 [ 4382.556312] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001 [ 4382.556313] R10: 0000000000000001 R11: ffff897f40000000 R12: 0000000000001000 [ 4382.556313] R13: 00000000c224f000 R14: ffff89805de9bd40 R15: ffff8980453f4548 [ 4382.556315] FS: 00007f5e759178c0(0000) GS:ffff89807b300000(0000) knlGS:0000000000000000 [ 4382.563130] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4382.563562] CR2: 00007f2e9789fcbc CR3: 0000000120512001 CR4: 00000000003606e0 [ 4382.564005] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 4382.564451] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 4382.564887] Call Trace: [ 4382.565343] insert_inline_extent_backref+0x55/0xe0 [btrfs] [ 4382.565796] __btrfs_inc_extent_ref.isra.60+0x88/0x260 [btrfs] [ 4382.566249] ? __btrfs_run_delayed_refs+0x93/0x1650 [btrfs] [ 4382.566702] __btrfs_run_delayed_refs+0xa22/0x1650 [btrfs] [ 4382.567162] btrfs_run_delayed_refs+0x7e/0x1d0 [btrfs] [ 4382.567623] btrfs_commit_transaction+0x50/0x9c0 [btrfs] [ 4382.568112] ? _raw_spin_unlock+0x24/0x30 [ 4382.568557] ? block_rsv_release_bytes+0x14e/0x410 [btrfs] [ 4382.569006] create_subvol+0x3c8/0x830 [btrfs] [ 4382.569461] ? btrfs_mksubvol+0x317/0x600 [btrfs] [ 4382.569906] btrfs_mksubvol+0x317/0x600 [btrfs] [ 4382.570383] ? rcu_sync_lockdep_assert+0xe/0x60 [ 4382.570822] ? __sb_start_write+0xd4/0x1c0 [ 4382.571262] ? mnt_want_write_file+0x24/0x50 [ 4382.571712] btrfs_ioctl_snap_create_transid+0x117/0x1a0 [btrfs] [ 4382.572155] ? _copy_from_user+0x66/0x90 [ 4382.572602] btrfs_ioctl_snap_create+0x66/0x80 [btrfs] [ 4382.573052] btrfs_ioctl+0x7c1/0x30e0 [btrfs] [ 4382.573502] ? mem_cgroup_commit_charge+0x8b/0x570 [ 4382.573946] ? do_raw_spin_unlock+0x49/0xc0 [ 4382.574379] ? _raw_spin_unlock+0x24/0x30 [ 4382.574803] ? __handle_mm_fault+0xf29/0x12d0 [ 4382.575215] ? do_vfs_ioctl+0xa2/0x6f0 [ 4382.575622] ? btrfs_ioctl_get_supported_features+0x30/0x30 [btrfs] [ 4382.576020] do_vfs_ioctl+0xa2/0x6f0 [ 4382.576405] ksys_ioctl+0x70/0x80 [ 4382.576776] __x64_sys_ioctl+0x16/0x20 [ 4382.577137] do_syscall_64+0x60/0x1b0 [ 4382.577488] entry_SYSCALL_64_after_hwframe+0x49/0xbe (...) [ 4382.578837] RSP: 002b:00007ffe04bf64c8 EFLAGS: 00000202 ORIG_RAX: 0000000000000010 [ 4382.579174] RAX: ffffffffffffffda RBX: 00005564136f3050 RCX: 00007f5e74724dd7 [ 4382.579505] RDX: 00007ffe04bf64d0 RSI: 000000005000940e RDI: 0000000000000003 [ 4382.579848] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000044 [ 4382.580164] R10: 0000000000000541 R11: 0000000000000202 R12: 00005564136f3010 [ 4382.580477] R13: 0000000000000003 R14: 00005564136f3035 R15: 00005564136f3050 [ 4382.580792] irq event stamp: 0 [ 4382.581106] hardirqs last enabled at (0): [<0000000000000000>] (null) [ 4382.581441] hardirqs last disabled at (0): [] copy_process.part.32+0x6e2/0x2320 [ 4382.581772] softirqs last enabled at (0): [] copy_process.part.32+0x6e2/0x2320 [ 4382.582095] softirqs last disabled at (0): [<0000000000000000>] (null) [ 4382.582413] ---[ end trace d3c188e3e9367382 ]--- [ 4382.623855] BTRFS: error (device sdc) in btrfs_run_delayed_refs:2981: errno=-5 IO failure [ 4382.624295] BTRFS info (device sdc): forced readonly Fix this by locking the source range before searching for the file extent items in the fs tree, since the relocation process will try to lock the range a file extent item represents before updating it with the new extent location. Fixes: 34a28e3d7753 ("Btrfs: use generic_remap_file_range_prep() for cloning and deduplication") Signed-off-by: Filipe Manana Signed-off-by: David Sterba fs/btrfs/ioctl.c | 34 ++++++++++++++++++++++++++++------ 1 file changed, 28 insertions(+), 6 deletions(-) commit f7fa1107f30e13255fb9a5359d357e07d3721b0b Author: Filipe Manana Date: Tue Jan 8 11:42:54 2019 +0000 Btrfs: fix race between cloning range ending at eof and writeback The recent rework that makes btrfs' remap_file_range operation use the generic helper generic_remap_file_range_prep() introduced a race between writeback and cloning a range that covers the eof extent of the source file into a destination offset that is greater then the same file's size. This happens because we now wait for writeback to complete before doing the truncation of the eof block, while previously we did the truncation and then waited for writeback to complete. This leads to a race between writeback of the truncated block and cloning the file extents in the source range, because we copy each file extent item we find in the fs root into a buffer, then release the path and then increment the reference count for the extent referred in that file extent item we copied, which can no longer exist if writeback of the truncated eof block completes after we copied the file extent item into the buffer and before we incremented the reference count. This is illustrated by the following diagram: CPU 1 CPU 2 btrfs_clone_files() btrfs_cont_expand() btrfs_truncate_block() --> zeroes part of the page containg eof, marking it for delalloc btrfs_clone() --> finds extent item covering eof, points to extent at bytenr X --> copies it into a local buffer --> releases path writeback starts btrfs_finish_ordered_io() insert_reserved_file_extent() __btrfs_drop_extents() --> creates delayed reference to drop the extent at bytenr X --> starts transaction --> creates delayed reference to increment extent at bytenr X When this race is hit the running transaction ends up getting aborted with an -EIO error and a trace like the following is produced: [ 4382.553858] WARNING: CPU: 2 PID: 3648 at fs/btrfs/extent-tree.c:1552 lookup_inline_extent_backref+0x4f4/0x650 [btrfs] (...) [ 4382.556293] CPU: 2 PID: 3648 Comm: btrfs Tainted: G W 4.20.0-rc6-btrfs-next-41 #1 [ 4382.556294] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.2-0-gf9626ccb91-prebuilt.qemu-project.org 04/01/2014 [ 4382.556308] RIP: 0010:lookup_inline_extent_backref+0x4f4/0x650 [btrfs] (...) [ 4382.556310] RSP: 0018:ffffac784408f738 EFLAGS: 00010202 [ 4382.556311] RAX: 0000000000000001 RBX: ffff8980673c3a48 RCX: 0000000000000001 [ 4382.556312] RDX: 0000000000000008 RSI: 0000000000000000 RDI: 0000000000000000 [ 4382.556312] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001 [ 4382.556313] R10: 0000000000000001 R11: ffff897f40000000 R12: 0000000000001000 [ 4382.556313] R13: 00000000c224f000 R14: ffff89805de9bd40 R15: ffff8980453f4548 [ 4382.556315] FS: 00007f5e759178c0(0000) GS:ffff89807b300000(0000) knlGS:0000000000000000 [ 4382.563130] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4382.563562] CR2: 00007f2e9789fcbc CR3: 0000000120512001 CR4: 00000000003606e0 [ 4382.564005] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 4382.564451] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 4382.564887] Call Trace: [ 4382.565343] insert_inline_extent_backref+0x55/0xe0 [btrfs] [ 4382.565796] __btrfs_inc_extent_ref.isra.60+0x88/0x260 [btrfs] [ 4382.566249] ? __btrfs_run_delayed_refs+0x93/0x1650 [btrfs] [ 4382.566702] __btrfs_run_delayed_refs+0xa22/0x1650 [btrfs] [ 4382.567162] btrfs_run_delayed_refs+0x7e/0x1d0 [btrfs] [ 4382.567623] btrfs_commit_transaction+0x50/0x9c0 [btrfs] [ 4382.568112] ? _raw_spin_unlock+0x24/0x30 [ 4382.568557] ? block_rsv_release_bytes+0x14e/0x410 [btrfs] [ 4382.569006] create_subvol+0x3c8/0x830 [btrfs] [ 4382.569461] ? btrfs_mksubvol+0x317/0x600 [btrfs] [ 4382.569906] btrfs_mksubvol+0x317/0x600 [btrfs] [ 4382.570383] ? rcu_sync_lockdep_assert+0xe/0x60 [ 4382.570822] ? __sb_start_write+0xd4/0x1c0 [ 4382.571262] ? mnt_want_write_file+0x24/0x50 [ 4382.571712] btrfs_ioctl_snap_create_transid+0x117/0x1a0 [btrfs] [ 4382.572155] ? _copy_from_user+0x66/0x90 [ 4382.572602] btrfs_ioctl_snap_create+0x66/0x80 [btrfs] [ 4382.573052] btrfs_ioctl+0x7c1/0x30e0 [btrfs] [ 4382.573502] ? mem_cgroup_commit_charge+0x8b/0x570 [ 4382.573946] ? do_raw_spin_unlock+0x49/0xc0 [ 4382.574379] ? _raw_spin_unlock+0x24/0x30 [ 4382.574803] ? __handle_mm_fault+0xf29/0x12d0 [ 4382.575215] ? do_vfs_ioctl+0xa2/0x6f0 [ 4382.575622] ? btrfs_ioctl_get_supported_features+0x30/0x30 [btrfs] [ 4382.576020] do_vfs_ioctl+0xa2/0x6f0 [ 4382.576405] ksys_ioctl+0x70/0x80 [ 4382.576776] __x64_sys_ioctl+0x16/0x20 [ 4382.577137] do_syscall_64+0x60/0x1b0 [ 4382.577488] entry_SYSCALL_64_after_hwframe+0x49/0xbe (...) [ 4382.578837] RSP: 002b:00007ffe04bf64c8 EFLAGS: 00000202 ORIG_RAX: 0000000000000010 [ 4382.579174] RAX: ffffffffffffffda RBX: 00005564136f3050 RCX: 00007f5e74724dd7 [ 4382.579505] RDX: 00007ffe04bf64d0 RSI: 000000005000940e RDI: 0000000000000003 [ 4382.579848] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000044 [ 4382.580164] R10: 0000000000000541 R11: 0000000000000202 R12: 00005564136f3010 [ 4382.580477] R13: 0000000000000003 R14: 00005564136f3035 R15: 00005564136f3050 [ 4382.580792] irq event stamp: 0 [ 4382.581106] hardirqs last enabled at (0): [<0000000000000000>] (null) [ 4382.581441] hardirqs last disabled at (0): [] copy_process.part.32+0x6e2/0x2320 [ 4382.581772] softirqs last enabled at (0): [] copy_process.part.32+0x6e2/0x2320 [ 4382.582095] softirqs last disabled at (0): [<0000000000000000>] (null) [ 4382.582413] ---[ end trace d3c188e3e9367382 ]--- [ 4382.623855] BTRFS: error (device sdc) in btrfs_run_delayed_refs:2981: errno=-5 IO failure [ 4382.624295] BTRFS info (device sdc): forced readonly Fix this by waiting for writeback to complete after truncating the eof block. Fixes: 34a28e3d7753 ("Btrfs: use generic_remap_file_range_prep() for cloning and deduplication") Signed-off-by: Filipe Manana Signed-off-by: David Sterba fs/btrfs/ioctl.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) commit 498c203d855eaf6571b63ea860a53862c4fe91b7 Author: Arnaldo Carvalho de Melo Date: Wed Jan 9 10:02:12 2019 -0300 tools include uapi: Sync linux/if_link.h copy with the kernel sources To pick the changes from: a428afe82f98 ("net: bridge: add support for user-controlled bool options") a025fb5f49ad ("geneve: Allow configuration of DF behaviour") b4d3069783bc ("vxlan: Allow configuration of DF behaviour") Silencing this tools/ build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/if_link.h' differs from latest version at 'include/uapi/linux/if_link.h' Cc: Adrian Hunter Cc: David S. Miller Cc: Jiri Olsa Cc: Namhyung Kim Cc: Nikolay Aleksandrov Cc: Stefano Brivio Link: https://lkml.kernel.org/n/tip-wq410s2wuqv5k980bidw0ju8@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/include/uapi/linux/if_link.h | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) commit dd9ee3444014e8f28c0eefc9fffc9ac9c5248c12 Author: Su Yanjun Date: Sun Jan 6 21:31:20 2019 -0500 vti4: Fix a ipip packet processing bug in 'IPCOMP' virtual tunnel Recently we run a network test over ipcomp virtual tunnel.We find that if a ipv4 packet needs fragment, then the peer can't receive it. We deep into the code and find that when packet need fragment the smaller fragment will be encapsulated by ipip not ipcomp. So when the ipip packet goes into xfrm, it's skb->dev is not properly set. The ipv4 reassembly code always set skb'dev to the last fragment's dev. After ipv4 defrag processing, when the kernel rp_filter parameter is set, the skb will be drop by -EXDEV error. This patch adds compatible support for the ipip process in ipcomp virtual tunnel. Signed-off-by: Su Yanjun Signed-off-by: Steffen Klassert net/ipv4/ip_vti.c | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) commit 12750abad517a991c4568969bc748db302ab52cd Author: Florian Westphal Date: Fri Jan 4 14:17:05 2019 +0100 xfrm: policy: fix infinite loop when merging src-nodes With very small change to test script we can trigger softlockup due to bogus assignment of 'p' (policy to be examined) on restart. Previously the two to-be-merged nodes had same address/prefixlength pair, so no erase/reinsert was necessary, we only had to append the list from node a to b. If prefix lengths are different, the node has to be deleted and re-inserted into the tree, with the updated prefix length. This was broken; due to bogus update to 'p' this loops forever. Add a 'restart' label and use that instead. While at it, don't perform the unneeded reinserts of the policies that are already sorted into the 'new' node. A previous patch in this series made xfrm_policy_inexact_list_reinsert() use the relative position indicator to sort policies according to age in case priorities are identical. Fixes: 6ac098b2a9d30 ("xfrm: policy: add 2nd-level saddr trees for inexact policies") Signed-off-by: Florian Westphal Signed-off-by: Steffen Klassert net/xfrm/xfrm_policy.c | 15 +++++++-------- tools/testing/selftests/net/xfrm_policy.sh | 4 ++-- 2 files changed, 9 insertions(+), 10 deletions(-) commit fcf86f55f2d4a6b58da5feccd45d9584edc17c5a Author: Florian Westphal Date: Fri Jan 4 14:17:04 2019 +0100 selftests: xfrm: alter htresh to trigger move of policies to hash table ... and back to inexact tree. Repeat ping test after each htresh change: lookup results must not change. Signed-off-by: Florian Westphal Signed-off-by: Steffen Klassert tools/testing/selftests/net/xfrm_policy.sh | 44 +++++++++++++++++++++++++++--- 1 file changed, 40 insertions(+), 4 deletions(-) commit 1d38900cb85d5d311dbd23c2c93294527b82cd2b Author: Florian Westphal Date: Fri Jan 4 14:17:03 2019 +0100 xfrm: policy: fix reinsertion on node merge "newpos" has wrong scope. It must be NULL on each iteration of the loop. Otherwise, when policy is to be inserted at the start, we would instead insert at point found by the previous loop-iteration instead. Also, we need to unlink the policy before we reinsert it to the new node, else we can get next-points-to-self loops. Because policies are only ordered by priority it is irrelevant which policy is "more recent" except when two policies have same priority. (the more recent one is placed after the older one). In these cases, we can use the ->pos id number to know which one is the 'older': the higher the id, the more recent the policy. So we only need to unlink all policies from the node that is about to be removed, and insert them to the replacement node. Fixes: 9cf545ebd591da ("xfrm: policy: store inexact policies in a tree ordered by destination address") Signed-off-by: Florian Westphal Signed-off-by: Steffen Klassert net/xfrm/xfrm_policy.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) commit 1548bc4e0512700cf757192c106b3a20ab639223 Author: Florian Westphal Date: Fri Jan 4 14:17:02 2019 +0100 xfrm: policy: delete inexact policies from inexact list on hash rebuild An xfrm hash rebuild has to reset the inexact policy list before the policies get re-inserted: A change of hash thresholds will result in policies to get moved from inexact tree to the policy hash table. If the thresholds are increased again later, they get moved from hash table to inexact tree. We must unlink all policies from the inexact tree before re-insertion. Otherwise 'migrate' may find policies that are in main hash table a second time, when it searches the inexact lists. Furthermore, re-insertion without deletion can cause elements ->next to point back to itself, causing soft lockups or double-frees. Reported-by: syzbot+9d971dd21eb26567036b@syzkaller.appspotmail.com Fixes: 9cf545ebd591da ("xfrm: policy: store inexact policies in a tree ordered by destination address") Signed-off-by: Florian Westphal Signed-off-by: Steffen Klassert net/xfrm/xfrm_policy.c | 23 ++++++++++------------- 1 file changed, 10 insertions(+), 13 deletions(-) commit 7a474c36586f4277f930ab7e6865c97e44dfc3bc Author: Florian Westphal Date: Fri Jan 4 14:17:01 2019 +0100 xfrm: policy: increment xfrm_hash_generation on hash rebuild Hash rebuild will re-set all the inexact entries, then re-insert them. Lookups that can occur in parallel will therefore not find any policies. This was safe when lookups were still guarded by rwlock. After rcu-ification, lookups check the hash_generation seqcount to detect when a hash resize takes place. Hash rebuild missed the needed increment. Hash resizes and hash rebuilds cannot occur in parallel (both acquire hash_resize_mutex), so just increment xfrm_hash_generation, like resize. Fixes: a7c44247f704e3 ("xfrm: policy: make xfrm_policy_lookup_bytype lockless") Signed-off-by: Florian Westphal Signed-off-by: Steffen Klassert net/xfrm/xfrm_policy.c | 2 ++ 1 file changed, 2 insertions(+) commit 355b00d1e14051c13aea48c1c5430c486fed2d7a Author: Florian Westphal Date: Fri Jan 4 14:17:00 2019 +0100 xfrm: policy: use hlist rcu variants on inexact insert, part 2 This function was modeled on the 'exact' insert one, which did not use the rcu variant either. When I fixed the 'exact' insert I forgot to propagate this to my development tree, so the inexact variant retained the bug. Fixes: 9cf545ebd591d ("xfrm: policy: store inexact policies in a tree ordered by destination address") Signed-off-by: Florian Westphal Signed-off-by: Steffen Klassert net/xfrm/xfrm_policy.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 0977b2383de69dc48e9fa61c5c77878ed08d87fe Author: Florian Westphal Date: Fri Jan 4 14:16:59 2019 +0100 selftests: xfrm: add block rules with adjacent/overlapping subnets The existing script lacks a policy pattern that triggers 'tree node merges' in the kernel. Consider adding policy affecting following subnet: pol1: dst 10.0.0.0/22 pol2: dst 10.0.0.0/23 # adds to existing 10.0.0.0/22 node -> no problems here. But now, lets consider reverse order: pol1: dst 10.0.0.0/24 pol2: dst 10.0.0.0/23 # CANNOT add to existing node When second policy gets added, the kernel must check that the new node ("10.0.0.0/23") doesn't overlap with any existing subnet. Example: dst 10.0.0.0/24 dst 10.0.0.1/24 dst 10.0.0.0/23 When the third policy gets added, the kernel must replace the nodes for the 10.0.0.0/24 and 10.0.0.1/24 policies with a single one and must merge all the subtrees/lists stored in those nodes into the new node. The existing test cases only have overlaps with a single node, so no merging takes place (we can always remove the 'old' node and replace it with the new subnet prefix). Add a few 'block policies' in a pattern that triggers this, with a priority that will make kernel prefer the 'esp' rules. Make sure the 'tunnel ping' tests still pass after they have been added. Signed-off-by: Florian Westphal Signed-off-by: Steffen Klassert tools/testing/selftests/net/xfrm_policy.sh | 109 ++++++++++++++++++++++++----- 1 file changed, 91 insertions(+), 18 deletions(-) commit 8780cf1142a59568a3aa77959cbd76b2edb6fd81 Author: Ajit Pandey Date: Wed Jan 9 14:17:07 2019 +0530 ASoC: soc-core: defer card probe until all component is added to list DAI component probe is not called if it is not present in component list during sound card registration. Check if component is available in component list for platform and cpu dai before soundcard registration. Signed-off-by: Ajit Pandey Signed-off-by: Rohit kumar Signed-off-by: Mark Brown sound/soc/soc-core.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) commit 0e141d1c65c1dd31c914eb2e11651adcc1a15912 Author: Quentin Perret Date: Wed Jan 9 10:42:36 2019 +0000 cpufreq: scmi: Fix frequency invariance in slow path The scmi-cpufreq driver calls the arch_set_freq_scale() callback on frequency changes to provide scale-invariant load-tracking signals to the scheduler. However, in the slow path, it does so while specifying the current and max frequencies in different units, hence resulting in a broken freq_scale factor. Fix this by passing all frequencies in KHz, as stored in the CPUFreq frequency table. Fixes: 99d6bdf33877 (cpufreq: add support for CPU DVFS based on SCMI message protocol) Signed-off-by: Quentin Perret Acked-by: Viresh Kumar Acked-by: Sudeep Holla Cc: 4.17+ # v4.17+ Signed-off-by: Rafael J. Wysocki drivers/cpufreq/scmi-cpufreq.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 7604bf0920985c9280c8b24e2f0c3e4ed47f502f Author: Otto Sabart Date: Wed Jan 9 00:56:51 2019 +0100 doc: trace: fix reference to cpuidle documentation file Old cpuidle/sysfs.txt file was replaced in aa5eee355b46. So, refer to an updated file. Fixes: aa5eee355b46 (Documentation: admin-guide: PM: Add cpuidle document) Signed-off-by: Otto Sabart Signed-off-by: Rafael J. Wysocki Documentation/trace/coresight-cpu-debug.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3e2ffd655cc6a694608d997738989ff5572a8266 Author: Michael S. Tsirkin Date: Wed Jan 2 15:57:49 2019 -0500 include/linux/compiler*.h: fix OPTIMIZER_HIDE_VAR Since commit 815f0ddb346c ("include/linux/compiler*.h: make compiler-*.h mutually exclusive") clang no longer reuses the OPTIMIZER_HIDE_VAR macro from compiler-gcc - instead it gets the version in include/linux/compiler.h. Unfortunately that version doesn't actually prevent compiler from optimizing out the variable. Fix up by moving the macro out from compiler-gcc.h to compiler.h. Compilers without incline asm support will keep working since it's protected by an ifdef. Also fix up comments to match reality since we are no longer overriding any macros. Build-tested with gcc and clang. Fixes: 815f0ddb346c ("include/linux/compiler*.h: make compiler-*.h mutually exclusive") Cc: Eli Friedman Cc: Joe Perches Cc: Linus Torvalds Reviewed-by: Nick Desaulniers Signed-off-by: Michael S. Tsirkin Signed-off-by: Miguel Ojeda include/linux/compiler-clang.h | 5 ++--- include/linux/compiler-gcc.h | 4 ---- include/linux/compiler-intel.h | 4 +--- include/linux/compiler.h | 4 +++- 4 files changed, 6 insertions(+), 11 deletions(-) commit cc4bddade114b696ab27c1a77cfc7040151306da Author: Jernej Skrabec Date: Tue Jan 8 20:18:40 2019 +0100 ARM: dts: sun8i: h3: Add ethernet0 alias to Beelink X2 Because "ethernet0" alias is missing, U-Boot doesn't generate board specific MAC address. Effect of this is random MAC address every boot and thus new IP address is assigned to the board. Fix this by adding alias. Fixes: 7389172fc3ed ("ARM: dts: sun8i: h3: Enable dwmac-sun8i on the Beelink X2") Signed-off-by: Jernej Skrabec [Maxime: Removed unneeded comment] Signed-off-by: Maxime Ripard arch/arm/boot/dts/sun8i-h3-beelink-x2.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit aa9ad54285c78e7f69b20b3734c0c79aa98af3c3 Author: Chen-Yu Tsai Date: Tue Jan 8 15:25:26 2019 +0800 ARM: dts: sun6i: Add clock-output-names to osc24M clock The osc24M clock does not have a "clock-output-names" property, which means that the clock name is derived from the node name in Linux. The node name was changed in commit acfd5bbe2641 ("ARM: dts: sun6i: Change clock node names to avoid warnings"). This breaks Linux as the sunxi-ng clock driver implicitly depends on the external clock being named "osc24M". Add a "clock-output-names" property to restore the previous behavior. Fixes: acfd5bbe2641 ("ARM: dts: sun6i: Change clock node names to avoid warnings") Signed-off-by: Chen-Yu Tsai Signed-off-by: Maxime Ripard arch/arm/boot/dts/sun6i-a31.dtsi | 1 + 1 file changed, 1 insertion(+) commit f8c15790e4d8bdf2d21a5e9d43b5f97983af1222 Author: Tomi Valkeinen Date: Thu Jan 3 13:59:54 2019 +0200 drm/bridge: tc358767: use DP connector if no panel set tc358767 driver sets the connector type always to eDP. This patch sets the type to DP if there is no panel defined, which implies that there's a DP connector on the board. Signed-off-by: Tomi Valkeinen Reviewed-by: Andrzej Hajda Signed-off-by: Andrzej Hajda Link: https://patchwork.freedesktop.org/patch/msgid/20190103115954.12785-8-tomi.valkeinen@ti.com drivers/gpu/drm/bridge/tc358767.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 7923e09c7a766e2d58de7fc395bb84c18e5bc625 Author: Tomi Valkeinen Date: Thu Jan 3 13:59:53 2019 +0200 drm/bridge: tc358767: fix output H/V syncs The H and V syncs of the DP output are always set to active high. This patch fixes the syncs by configuring them according to the videomode. Signed-off-by: Tomi Valkeinen Reviewed-by: Andrzej Hajda Signed-off-by: Andrzej Hajda Link: https://patchwork.freedesktop.org/patch/msgid/20190103115954.12785-7-tomi.valkeinen@ti.com drivers/gpu/drm/bridge/tc358767.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 51b9e62eb6950c762162ab7eb8390990179be067 Author: Tomi Valkeinen Date: Thu Jan 3 13:59:52 2019 +0200 drm/bridge: tc358767: reject modes which require too much BW The current driver accepts any videomode with pclk < 154MHz. This is not correct, as with 1 lane and/or 1.62Mbps speed not all videomodes can be supported. Add code to reject modes that require more bandwidth that is available. Signed-off-by: Tomi Valkeinen Reviewed-by: Andrzej Hajda Signed-off-by: Andrzej Hajda Link: https://patchwork.freedesktop.org/patch/msgid/20190103115954.12785-6-tomi.valkeinen@ti.com drivers/gpu/drm/bridge/tc358767.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 9a63bd6fe1b5590ffa42ae2ed22ee21363293e31 Author: Tomi Valkeinen Date: Thu Jan 3 13:59:51 2019 +0200 drm/bridge: tc358767: fix initial DP0/1_SRCCTRL value Initially DP0_SRCCTRL is set to a static value which includes DP0_SRCCTRL_LANES_2 and DP0_SRCCTRL_BW27, even when only 1 lane of 1.62Gbps speed is used. DP1_SRCCTRL is configured to a magic number. This patch changes the configuration as follows: Configure DP0_SRCCTRL by using tc_srcctrl() which provides the correct value. DP1_SRCCTRL needs two bits to be set to the same value as DP0_SRCCTRL: SSCG and BW27. All other bits can be zero. Signed-off-by: Tomi Valkeinen Reviewed-by: Andrzej Hajda Signed-off-by: Andrzej Hajda Link: https://patchwork.freedesktop.org/patch/msgid/20190103115954.12785-5-tomi.valkeinen@ti.com drivers/gpu/drm/bridge/tc358767.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) commit 4d9d54a730434cc068dd3515ba6116697196f77b Author: Tomi Valkeinen Date: Thu Jan 3 13:59:50 2019 +0200 drm/bridge: tc358767: fix single lane configuration PHY_2LANE bit is always set in DP_PHY_CTRL, breaking 1 lane use. Set PHY_2LANE only when 2 lanes are used. Signed-off-by: Tomi Valkeinen Reviewed-by: Andrzej Hajda Signed-off-by: Andrzej Hajda Link: https://patchwork.freedesktop.org/patch/msgid/20190103115954.12785-4-tomi.valkeinen@ti.com drivers/gpu/drm/bridge/tc358767.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) commit adf4109896bbee27fd2ac3b48d22d6a0062fe517 Author: Tomi Valkeinen Date: Thu Jan 3 13:59:49 2019 +0200 drm/bridge: tc358767: add defines for DP1_SRCCTRL & PHY_2LANE DP1_SRCCTRL register and PHY_2LANE field did not have matching defines. Add these. Signed-off-by: Tomi Valkeinen Reviewed-by: Andrzej Hajda Signed-off-by: Andrzej Hajda Link: https://patchwork.freedesktop.org/patch/msgid/20190103115954.12785-3-tomi.valkeinen@ti.com drivers/gpu/drm/bridge/tc358767.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) commit 4842379cbe6e851de914a7132f76f4e200b9a98b Author: Tomi Valkeinen Date: Thu Jan 3 13:59:48 2019 +0200 drm/bridge: tc358767: add bus flags tc358767 driver does not set DRM bus_flags, even if it does configures the polarity settings into its registers. This means that the DPI source can't configure the polarities correctly. Add sync flags accordingly. Signed-off-by: Tomi Valkeinen Reviewed-by: Andrzej Hajda Signed-off-by: Andrzej Hajda Link: https://patchwork.freedesktop.org/patch/msgid/20190103115954.12785-2-tomi.valkeinen@ti.com drivers/gpu/drm/bridge/tc358767.c | 4 ++++ 1 file changed, 4 insertions(+) commit e4f358916d528d479c3c12bd2fd03f2d5a576380 Author: WANG Chao Date: Tue Dec 11 00:37:25 2018 +0800 x86, modpost: Replace last remnants of RETPOLINE with CONFIG_RETPOLINE Commit 4cd24de3a098 ("x86/retpoline: Make CONFIG_RETPOLINE depend on compiler support") replaced the RETPOLINE define with CONFIG_RETPOLINE checks. Remove the remaining pieces. [ bp: Massage commit message. ] Fixes: 4cd24de3a098 ("x86/retpoline: Make CONFIG_RETPOLINE depend on compiler support") Signed-off-by: WANG Chao Signed-off-by: Borislav Petkov Reviewed-by: Zhenzhong Duan Reviewed-by: Masahiro Yamada Cc: "H. Peter Anvin" Cc: Andi Kleen Cc: Andrew Morton Cc: Andy Lutomirski Cc: Arnd Bergmann Cc: Daniel Borkmann Cc: David Woodhouse Cc: Geert Uytterhoeven Cc: Jessica Yu Cc: Jiri Kosina Cc: Kees Cook Cc: Konrad Rzeszutek Wilk Cc: Luc Van Oostenryck Cc: Michal Marek Cc: Miguel Ojeda Cc: Peter Zijlstra Cc: Tim Chen Cc: Vasily Gorbik Cc: linux-kbuild@vger.kernel.org Cc: srinivas.eeda@oracle.com Cc: stable Cc: x86-ml Link: https://lkml.kernel.org/r/20181210163725.95977-1-chao.wang@ucloud.cn arch/x86/kernel/cpu/bugs.c | 2 +- include/linux/compiler-gcc.h | 2 +- include/linux/module.h | 2 +- scripts/mod/modpost.c | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) commit 90802938f7e88045ace123e105e22e8c3e7f9c7e Author: Borislav Petkov Date: Tue Jan 8 17:38:29 2019 +0100 x86/cache: Rename config option to CONFIG_X86_RESCTRL CONFIG_RESCTRL is too generic. The final goal is to have a generic option called like this which is selected by the arch-specific ones CONFIG_X86_RESCTRL and CONFIG_ARM64_RESCTRL. The generic one will cover the resctrl filesystem and other generic and shared bits of functionality. Signed-off-by: Borislav Petkov Suggested-by: Ingo Molnar Requested-by: Linus Torvalds Cc: Babu Moger Cc: Fenghua Yu Cc: James Morse Cc: Reinette Chatre Cc: Tony Luck Cc: x86@kernel.org Link: http://lkml.kernel.org/r/20190108171401.GC12235@zn.tnic Documentation/x86/resctrl_ui.txt | 2 +- arch/x86/Kconfig | 2 +- arch/x86/include/asm/resctrl_sched.h | 4 ++-- arch/x86/kernel/cpu/Makefile | 2 +- arch/x86/kernel/cpu/resctrl/Makefile | 4 ++-- include/linux/sched.h | 2 +- 6 files changed, 8 insertions(+), 8 deletions(-) commit d1dd42110d2727e81b9265841a62bc84c454c3a2 Author: Kailang Yang Date: Wed Jan 9 17:05:24 2019 +0800 ALSA: hda/realtek - Disable headset Mic VREF for headset mode of ALC225 Disable Headset Mic VREF for headset mode of ALC225. This will be controlled by coef bits of headset mode functions. [ Fixed a compile warning and code simplification -- tiwai ] Signed-off-by: Kailang Yang Cc: Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) commit 4d4b0c52bde470c379f5d168d5c139ad866cb808 Author: Kailang Yang Date: Wed Jan 9 16:23:37 2019 +0800 ALSA: hda/realtek - Add unplug function into unplug state of Headset Mode for ALC225 Forgot to add unplug function to unplug state of headset mode for ALC225. Signed-off-by: Kailang Yang Cc: Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) commit 576b50ea235699d83758c0c514c65b8d486a159d Merge: 64598e8b6fda ee412f14693a Author: Ingo Molnar Date: Wed Jan 9 07:59:40 2019 +0100 Merge tag 'perf-core-for-mingo-5.0-20190108' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/core fixes and improvements from Arnaldo Carvalho de Melo: perf top: Arnaldo Carvalho de Melo: - Lift restriction on using callchains without "sym" in --sort perf trace: Arnaldo Carvalho de Melo: - Fix ')' placement in "interrupted" syscall lines. - Fix alignment for [continued] lines. perf tests: Florian Fainelli: - Add a test for the ARM 32-bit [vectors] page. tools lib traceevent: Tzvetomir Stoyanov: - Introduce new libtracevent API: tep_override_comm(). - Initialize host_bigendian at tep_handle allocation. - More namespacing changes. - Remove superfluous APIs. tools headers uapi: Arnaldo Carvalho de Melo: . Update linux/{fs,vhost}.h, grab a copy o linux/mount.h, where the MS_ mount flags were moved. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit 1cb95e072ede5e3d6a54eefd520db21b45985896 Author: Dan Williams Date: Tue Jan 8 15:34:52 2019 -0800 libnvdimm/dimm: Fix security capability detection for non-Intel NVDIMMs Kees reports a crash with the following signature... RIP: 0010:nvdimm_visible+0x79/0x80 [..] Call Trace: internal_create_group+0xf4/0x380 sysfs_create_groups+0x46/0xb0 device_add+0x331/0x680 nd_async_device_register+0x15/0x60 async_run_entry_fn+0x38/0x100 ...when starting a QEMU environment with "label-less" DIMM. Without labels QEMU does not publish any DSM methods. Without defined methods the NVDIMM_FAMILY type is not established and the nfit driver will skip registering security operations. In that case the security state should be initialized to a negative value in __nvdimm_create() and nvdimm_visible() should skip interrogating the specific ops. However, since 'enum nvdimm_security_state' was only defined to contain positive values the "if (nvdimm->sec.state < 0)" check always fails. Define a negative error state to allow negative state values to be handled as expected. Fixes: f2989396553a ("acpi/nfit, libnvdimm: Introduce nvdimm_security_ops") Reviewed-by: Dave Jiang Reported-by: Kees Cook Tested-by: Kees Cook Signed-off-by: Dan Williams include/linux/libnvdimm.h | 1 + 1 file changed, 1 insertion(+) commit ccb7f15a8a3c0c7a35389e4c8e083c424b4df79d Author: Nathan Chancellor Date: Tue Jan 8 22:00:37 2019 -0700 nfit: Mark some functions as __maybe_unused On arm64 little endian allyesconfig: drivers/acpi/nfit/intel.c:149:12: warning: unused function 'intel_security_unlock' [-Wunused-function] static int intel_security_unlock(struct nvdimm *nvdimm, ^ drivers/acpi/nfit/intel.c:230:12: warning: unused function 'intel_security_erase' [-Wunused-function] static int intel_security_erase(struct nvdimm *nvdimm, ^ drivers/acpi/nfit/intel.c:279:12: warning: unused function 'intel_security_query_overwrite' [-Wunused-function] static int intel_security_query_overwrite(struct nvdimm *nvdimm) ^ drivers/acpi/nfit/intel.c:316:12: warning: unused function 'intel_security_overwrite' [-Wunused-function] static int intel_security_overwrite(struct nvdimm *nvdimm, ^ 4 warnings generated. Mark these functions as __maybe_unused because they are only used when CONFIG_X86 is set. Fixes: 4c6926a23b76 ("acpi/nfit, libnvdimm: Add unlock of nvdimm support for Intel DIMMs") Suggested-by: Dan Williams Signed-off-by: Nathan Chancellor Signed-off-by: Dan Williams drivers/acpi/nfit/intel.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit f0e9943725186ddbdc9718a559c26c5f507262f2 Author: Zhenyu Wang Date: Sat Dec 29 11:13:10 2018 +0800 drm/i915/gvt: Fix workload request allocation before request add In commit 6bb2a2af8b1b ("drm/i915/gvt: Fix crash after request->hw_context change"), forgot to handle workload scan path in ELSP handler case which was to optimize scanning earlier instead of in gvt submission thread, so request alloc and add was splitting then which is against right process. This trys to do a partial revert of that commit which still has workload request alloc helper and make sure shadow state population is handled after request alloc for target state buffer. v3: Fix missed workload status setting in request alloc error path v2: Fix dispatch workload err path that should add request after alloc anyway. Fixes: 6bb2a2af8b1b ("drm/i915/gvt: Fix crash after request->hw_context change") Cc: Bin Yang Cc: Chris Wilson Tested-by: Bin Yang Reviewed-by: Xiaolin Zhang Signed-off-by: Zhenyu Wang drivers/gpu/drm/i915/gvt/scheduler.c | 64 +++++++++++++++++++++++------------- drivers/gpu/drm/i915/gvt/scheduler.h | 1 + 2 files changed, 43 insertions(+), 22 deletions(-) commit 40405851af73c59678ffd8f490e6b288c7fbaf29 Author: Jeff Moyer Date: Tue Jan 8 16:57:34 2019 -0500 block: clarify documentation for blk_{start|finish}_plug There was some confusion about what these functions did. Make it clear that this is a hint for upper layers to pass to the block layer, and that it does not guarantee that I/O will not be submitted between a start and finish plug. Reported-by: "Darrick J. Wong" Reviewed-by: Darrick J. Wong Reviewed-by: Ming Lei Signed-off-by: Jeff Moyer Signed-off-by: Jens Axboe block/blk-core.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) commit cc29a1b0a3f2597ce887d339222fa85b9307706d Author: Logan Gunthorpe Date: Tue Jan 8 13:50:43 2019 -0700 scsi: isci: initialize shost fully before calling scsi_add_host() scsi_mq_setup_tags(), which is called by scsi_add_host(), calculates the command size to allocate based on the prot_capabilities. In the isci driver, scsi_host_set_prot() is called after scsi_add_host() so the command size gets calculated to be smaller than it needs to be. Eventually, scsi_mq_init_request() locates the 'prot_sdb' after the command assuming it was sized correctly and a buffer overrun may occur. However, seeing blk_mq_alloc_rqs() rounds up to the nearest cache line size, the mistake can go unnoticed. The bug was noticed after the struct request size was reduced by commit 9d037ad707ed ("block: remove req->timeout_list") Which likely reduced the allocated space for the request by an entire cache line, enough that the overflow could be hit and it caused a panic, on boot, at: RIP: 0010:t10_pi_complete+0x77/0x1c0 Call Trace: sd_done+0xf5/0x340 scsi_finish_command+0xc3/0x120 blk_done_softirq+0x83/0xb0 __do_softirq+0xa1/0x2e6 irq_exit+0xbc/0xd0 call_function_single_interrupt+0xf/0x20 sd_done() would call scsi_prot_sg_count() which reads the number of entities in 'prot_sdb', but seeing 'prot_sdb' is located after the end of the allocated space it reads a garbage number and erroneously calls t10_pi_complete(). To prevent this, the calls to scsi_host_set_prot() are moved into isci_host_alloc() before the call to scsi_add_host(). Out of caution, also move the similar call to scsi_host_set_guard(). Fixes: 3d2d75254915 ("[SCSI] isci: T10 DIF support") Link: http://lkml.kernel.org/r/da851333-eadd-163a-8c78-e1f4ec5ec857@deltatee.com Signed-off-by: Logan Gunthorpe Cc: Intel SCU Linux support Cc: Artur Paszkiewicz Cc: "James E.J. Bottomley" Cc: "Martin K. Petersen" Cc: Christoph Hellwig Cc: Jens Axboe Cc: Jeff Moyer Reviewed-by: Jeff Moyer Reviewed-by: Jens Axboe Signed-off-by: Martin K. Petersen drivers/scsi/isci/init.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit a88cc8da0279f8e481b0d90e51a0a1cffac55906 Merge: 9cb2feb4d21d 73444bc4d8f9 Author: Linus Torvalds Date: Tue Jan 8 18:58:29 2019 -0800 Merge branch 'akpm' (patches from Andrew) Merge misc fixes from Andrew Morton: "14 fixes" * emailed patches from Andrew Morton : mm, page_alloc: do not wake kswapd with zone lock held hugetlbfs: revert "use i_mmap_rwsem for more pmd sharing synchronization" hugetlbfs: revert "Use i_mmap_rwsem to fix page fault/truncate race" mm: page_mapped: don't assume compound page is huge or THP mm/memory.c: initialise mmu_notifier_range correctly tools/vm/page_owner: use page_owner_sort in the use example kasan: fix krealloc handling for tag-based mode kasan: make tag based mode work with CONFIG_HARDENED_USERCOPY kasan, arm64: use ARCH_SLAB_MINALIGN instead of manual aligning mm, memcg: fix reclaim deadlock with writeback mm/usercopy.c: no check page span for stack objects slab: alien caches must not be initialized if the allocation of the alien cache failed fork, memcg: fix cached_stacks case zram: idle writeback fixes and cleanup commit 5bd5f66cf142703e163459e1b36b73e265f0a0da Author: Gustavo A. R. Silva Date: Tue Nov 27 22:32:18 2018 -0600 scsi: lpfc: lpfc_sli: Mark expected switch fall-throughs In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Notice that, in this particular case, I replaced "Drop thru" and "Fall Thru" with "fall through" annotations, which is what GCC is expecting to find. Also, in some cases a dash is added as a token in order to separate the "fall through" annotation from the rest of the comment on the same line, which is what GCC is expecting to find. Addresses-Coverity-ID: 114979 ("Missing break in switch") Addresses-Coverity-ID: 114980 ("Missing break in switch") Signed-off-by: Gustavo A. R. Silva Acked-by: Dick Kennedy Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc_sli.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) commit 12de280b36f0e0599c7f170aa7f1058f3aeb6d9d Author: Gustavo A. R. Silva Date: Thu Jan 3 10:47:44 2019 -0600 scsi: smartpqi_init: fix boolean expression in pqi_device_remove_start Fix boolean expression by using logical AND operator '&&' instead of bitwise operator '&'. This issue was detected with the help of Coccinelle. Fixes: 1e46731efd9c ("scsi: smartpqi: check for null device pointers") Signed-off-by: Gustavo A. R. Silva Signed-off-by: Gustavo A. R. Silva Acked-by: Don Brace Signed-off-by: Martin K. Petersen drivers/scsi/smartpqi/smartpqi_init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3f7e62bba0003f9c68f599f5997c4647ef5b4f4e Author: Stanley Chu Date: Thu Jan 3 22:08:05 2019 +0800 scsi: core: Synchronize request queue PM status only on successful resume The commit 356fd2663cff ("scsi: Set request queue runtime PM status back to active on resume") fixed up the inconsistent RPM status between request queue and device. However changing request queue RPM status shall be done only on successful resume, otherwise status may be still inconsistent as below, Request queue: RPM_ACTIVE Device: RPM_SUSPENDED This ends up soft lockup because requests can be submitted to underlying devices but those devices and their required resource are not resumed. For example, After above inconsistent status happens, IO request can be submitted to UFS device driver but required resource (like clock) is not resumed yet thus lead to warning as below call stack, WARN_ON(hba->clk_gating.state != CLKS_ON); ufshcd_queuecommand scsi_dispatch_cmd scsi_request_fn __blk_run_queue cfq_insert_request __elv_add_request blk_flush_plug_list blk_finish_plug jbd2_journal_commit_transaction kjournald2 We may see all behind IO requests hang because of no response from storage host or device and then soft lockup happens in system. In the end, system may crash in many ways. Fixes: 356fd2663cff (scsi: Set request queue runtime PM status back to active on resume) Cc: stable@vger.kernel.org Signed-off-by: Stanley Chu Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen drivers/scsi/scsi_pm.c | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-) commit 251f24e63fc291f288f765663e62cd575f048fd5 Author: Julia Lawall Date: Sun Dec 30 16:53:13 2018 +0100 scsi: pm80xx: reduce indentation Delete tab aligning a statement with the right hand side of a preceding assignment rather than the left hand side. Found with the help of Coccinelle. [mkp: added space] Signed-off-by: Julia Lawall Acked-by: Jack Wang Signed-off-by: Martin K. Petersen drivers/scsi/pm8001/pm8001_sas.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 72b4a0465f995175a2e22cf4a636bf781f1f28a7 Author: YueHaibing Date: Thu Dec 20 11:16:07 2018 +0800 scsi: qla4xxx: check return code of qla4xxx_copy_from_fwddb_param The return code should be check while qla4xxx_copy_from_fwddb_param fails. Signed-off-by: YueHaibing Acked-by: Manish Rangankar Signed-off-by: Martin K. Petersen drivers/scsi/qla4xxx/ql4_os.c | 2 ++ 1 file changed, 2 insertions(+) commit d1f38d995e984db36449661fcbad1649c21883e7 Author: Tomas Henzl Date: Wed Jan 2 16:07:25 2019 +0100 scsi: megaraid_sas: correct an info message This was apparently forgotten in 894169db1 ("scsi: megaraid_sas: Use 63-bit DMA addressing"). Signed-off-by: Tomas Henzl Signed-off-by: Martin K. Petersen drivers/scsi/megaraid/megaraid_sas_base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 621a4367d69509f35abb4559a2dd7179ea5acada Author: Leo Zhang Date: Mon Dec 24 00:18:27 2018 +0800 scsi: target/iscsi: fix error msg typo when create lio_qr_cache failed Signed-off-by: Leo Zhang Signed-off-by: Martin K. Petersen drivers/target/iscsi/iscsi_target.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 44759979a49bfd2d20d789add7fa81a21eb1a4ab Author: Ivan Mironov Date: Sun Dec 23 12:41:58 2018 +0500 scsi: sd: Fix cache_type_store() Changing of caching mode via /sys/devices/.../scsi_disk/.../cache_type may fail if device responds to MODE SENSE command with DPOFUA flag set, and then checks this flag to be not set on MODE SELECT command. In this scenario, when trying to change cache_type, write always fails: # echo "none" >cache_type bash: echo: write error: Invalid argument And following appears in dmesg: [13007.865745] sd 1:0:1:0: [sda] Sense Key : Illegal Request [current] [13007.865753] sd 1:0:1:0: [sda] Add. Sense: Invalid field in parameter list From SBC-4 r15, 6.5.1 "Mode pages overview", description of DEVICE-SPECIFIC PARAMETER field in the mode parameter header: ... The write protect (WP) bit for mode data sent with a MODE SELECT command shall be ignored by the device server. ... The DPOFUA bit is reserved for mode data sent with a MODE SELECT command. ... The remaining bits in the DEVICE-SPECIFIC PARAMETER byte are also reserved and shall be set to zero. [mkp: shuffled commentary to commit description] Cc: stable@vger.kernel.org Signed-off-by: Ivan Mironov Signed-off-by: Martin K. Petersen drivers/scsi/sd.c | 6 ++++++ 1 file changed, 6 insertions(+) commit d972f3dce8d161e2142da0ab1ef25df00e2f21a9 Author: Jason Gunthorpe Date: Tue Jan 8 23:27:06 2019 +0000 packet: Do not leak dev refcounts on error exit 'dev' is non NULL when the addr_len check triggers so it must goto a label that does the dev_put otherwise dev will have a leaked refcount. This bug causes the ib_ipoib module to become unloadable when using systemd-network as it triggers this check on InfiniBand links. Fixes: 99137b7888f4 ("packet: validate address length") Reported-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe Acked-by: Willem de Bruijn Signed-off-by: David S. Miller net/packet/af_packet.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 9cb2feb4d21d97386eb25c7b67e2793efcc1e70a Author: Stafford Horne Date: Tue Jan 8 22:15:15 2019 +0900 arch/openrisc: Fix issues with access_ok() The commit 594cc251fdd0 ("make 'user_access_begin()' do 'access_ok()'") exposed incorrect implementations of access_ok() macro in several architectures. This change fixes 2 issues found in OpenRISC. OpenRISC was not properly using parenthesis for arguments and also using arguments twice. This patch fixes those 2 issues. I test booted this patch with v5.0-rc1 on qemu and it's working fine. Cc: Guenter Roeck Cc: Linus Torvalds Reported-by: Linus Torvalds Signed-off-by: Stafford Horne Signed-off-by: Linus Torvalds arch/openrisc/include/asm/uaccess.h | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 8a7f02f67c395949c768ae1cf4f12905a81e3cde Author: Xiaochun Lee Date: Sat Jan 5 16:08:38 2019 +0800 ACPI/nfit: delete the function to_acpi_nfit_desc The function to_acpi_nfit_desc and function to_acpi_desc do the same things,delete the function to_acpi_nfit_desc, and keep the inline function to_acpi_desc. Signed-off-by: Xiaochun Lee Signed-off-by: Dan Williams drivers/acpi/nfit/core.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) commit dadbcb450cb22acbc06bb53edf2bcc9261cb78f3 Author: Xiaochun Lee Date: Mon Jan 7 10:33:36 2019 +0800 ACPI/nfit: delete the redundant header file The header file "intel.h" is repeated here, So delete one. Signed-off-by: Xiaochun Lee Signed-off-by: Dan Williams drivers/acpi/nfit/core.c | 1 - 1 file changed, 1 deletion(-) commit 73444bc4d8f92e46a20cb6bd3342fc2ea75c6787 Author: Mel Gorman Date: Tue Jan 8 15:23:39 2019 -0800 mm, page_alloc: do not wake kswapd with zone lock held syzbot reported the following regression in the latest merge window and it was confirmed by Qian Cai that a similar bug was visible from a different context. ====================================================== WARNING: possible circular locking dependency detected 4.20.0+ #297 Not tainted ------------------------------------------------------ syz-executor0/8529 is trying to acquire lock: 000000005e7fb829 (&pgdat->kswapd_wait){....}, at: __wake_up_common_lock+0x19e/0x330 kernel/sched/wait.c:120 but task is already holding lock: 000000009bb7bae0 (&(&zone->lock)->rlock){-.-.}, at: spin_lock include/linux/spinlock.h:329 [inline] 000000009bb7bae0 (&(&zone->lock)->rlock){-.-.}, at: rmqueue_bulk mm/page_alloc.c:2548 [inline] 000000009bb7bae0 (&(&zone->lock)->rlock){-.-.}, at: __rmqueue_pcplist mm/page_alloc.c:3021 [inline] 000000009bb7bae0 (&(&zone->lock)->rlock){-.-.}, at: rmqueue_pcplist mm/page_alloc.c:3050 [inline] 000000009bb7bae0 (&(&zone->lock)->rlock){-.-.}, at: rmqueue mm/page_alloc.c:3072 [inline] 000000009bb7bae0 (&(&zone->lock)->rlock){-.-.}, at: get_page_from_freelist+0x1bae/0x52a0 mm/page_alloc.c:3491 It appears to be a false positive in that the only way the lock ordering should be inverted is if kswapd is waking itself and the wakeup allocates debugging objects which should already be allocated if it's kswapd doing the waking. Nevertheless, the possibility exists and so it's best to avoid the problem. This patch flags a zone as needing a kswapd using the, surprisingly, unused zone flag field. The flag is read without the lock held to do the wakeup. It's possible that the flag setting context is not the same as the flag clearing context or for small races to occur. However, each race possibility is harmless and there is no visible degredation in fragmentation treatment. While zone->flag could have continued to be unused, there is potential for moving some existing fields into the flags field instead. Particularly read-mostly ones like zone->initialized and zone->contiguous. Link: http://lkml.kernel.org/r/20190103225712.GJ31517@techsingularity.net Fixes: 1c30844d2dfe ("mm: reclaim small amounts of memory when an external fragmentation event occurs") Reported-by: syzbot+93d94a001cfbce9e60e1@syzkaller.appspotmail.com Signed-off-by: Mel Gorman Acked-by: Vlastimil Babka Tested-by: Qian Cai Cc: Dmitry Vyukov Cc: Vlastimil Babka Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/mmzone.h | 6 ++++++ mm/page_alloc.c | 8 +++++++- 2 files changed, 13 insertions(+), 1 deletion(-) commit ddeaab32a89f04b7e2a2df8771583a719c4ac6b7 Author: Mike Kravetz Date: Tue Jan 8 15:23:36 2019 -0800 hugetlbfs: revert "use i_mmap_rwsem for more pmd sharing synchronization" This reverts b43a9990055958e70347c56f90ea2ae32c67334c The reverted commit caused issues with migration and poisoning of anon huge pages. The LTP move_pages12 test will cause an "unable to handle kernel NULL pointer" BUG would occur with stack similar to: RIP: 0010:down_write+0x1b/0x40 Call Trace: migrate_pages+0x81f/0xb90 __ia32_compat_sys_migrate_pages+0x190/0x190 do_move_pages_to_node.isra.53.part.54+0x2a/0x50 kernel_move_pages+0x566/0x7b0 __x64_sys_move_pages+0x24/0x30 do_syscall_64+0x5b/0x180 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The purpose of the reverted patch was to fix some long existing races with huge pmd sharing. It used i_mmap_rwsem for this purpose with the idea that this could also be used to address truncate/page fault races with another patch. Further analysis has determined that i_mmap_rwsem can not be used to address all these hugetlbfs synchronization issues. Therefore, revert this patch while working an another approach to the underlying issues. Link: http://lkml.kernel.org/r/20190103235452.29335-2-mike.kravetz@oracle.com Signed-off-by: Mike Kravetz Reported-by: Jan Stancek Cc: Michal Hocko Cc: Hugh Dickins Cc: Naoya Horiguchi Cc: "Aneesh Kumar K . V" Cc: Andrea Arcangeli Cc: "Kirill A . Shutemov" Cc: Davidlohr Bueso Cc: Prakash Sangappa Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/hugetlb.c | 64 +++++++++++++---------------------------------------- mm/memory-failure.c | 16 ++------------ mm/migrate.c | 13 +---------- mm/rmap.c | 4 ---- mm/userfaultfd.c | 11 ++------- 5 files changed, 20 insertions(+), 88 deletions(-) commit e7c58097793ef15d58fadf190ee58738fbf447cd Author: Mike Kravetz Date: Tue Jan 8 15:23:32 2019 -0800 hugetlbfs: revert "Use i_mmap_rwsem to fix page fault/truncate race" This reverts c86aa7bbfd5568ba8a82d3635d8f7b8a8e06fe54 The reverted commit caused ABBA deadlocks when file migration raced with file eviction for specific hugetlbfs files. This was discovered with a modified version of the LTP move_pages12 test. The purpose of the reverted patch was to close a long existing race between hugetlbfs file truncation and page faults. After more analysis of the patch and impacted code, it was determined that i_mmap_rwsem can not be used for all required synchronization. Therefore, revert this patch while working an another approach to the underlying issue. Link: http://lkml.kernel.org/r/20190103235452.29335-1-mike.kravetz@oracle.com Signed-off-by: Mike Kravetz Reported-by: Jan Stancek Cc: Michal Hocko Cc: Hugh Dickins Cc: Naoya Horiguchi Cc: "Aneesh Kumar K . V" Cc: Andrea Arcangeli Cc: "Kirill A . Shutemov" Cc: Davidlohr Bueso Cc: Prakash Sangappa Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/hugetlbfs/inode.c | 61 ++++++++++++++++++++++++++++------------------------ mm/hugetlb.c | 21 +++++++++--------- 2 files changed, 44 insertions(+), 38 deletions(-) commit 8ab88c7169b7fba98812ead6524b9d05bc76cf00 Author: Jan Stancek Date: Tue Jan 8 15:23:28 2019 -0800 mm: page_mapped: don't assume compound page is huge or THP LTP proc01 testcase has been observed to rarely trigger crashes on arm64: page_mapped+0x78/0xb4 stable_page_flags+0x27c/0x338 kpageflags_read+0xfc/0x164 proc_reg_read+0x7c/0xb8 __vfs_read+0x58/0x178 vfs_read+0x90/0x14c SyS_read+0x60/0xc0 The issue is that page_mapped() assumes that if compound page is not huge, then it must be THP. But if this is 'normal' compound page (COMPOUND_PAGE_DTOR), then following loop can keep running (for HPAGE_PMD_NR iterations) until it tries to read from memory that isn't mapped and triggers a panic: for (i = 0; i < hpage_nr_pages(page); i++) { if (atomic_read(&page[i]._mapcount) >= 0) return true; } I could replicate this on x86 (v4.20-rc4-98-g60b548237fed) only with a custom kernel module [1] which: - allocates compound page (PAGEC) of order 1 - allocates 2 normal pages (COPY), which are initialized to 0xff (to satisfy _mapcount >= 0) - 2 PAGEC page structs are copied to address of first COPY page - second page of COPY is marked as not present - call to page_mapped(COPY) now triggers fault on access to 2nd COPY page at offset 0x30 (_mapcount) [1] https://github.com/jstancek/reproducers/blob/master/kernel/page_mapped_crash/repro.c Fix the loop to iterate for "1 << compound_order" pages. Kirrill said "IIRC, sound subsystem can producuce custom mapped compound pages". Link: http://lkml.kernel.org/r/c440d69879e34209feba21e12d236d06bc0a25db.1543577156.git.jstancek@redhat.com Fixes: e1534ae95004 ("mm: differentiate page_mapped() from page_mapcount() for compound pages") Signed-off-by: Jan Stancek Debugged-by: Laszlo Ersek Suggested-by: "Kirill A. Shutemov" Acked-by: Michal Hocko Acked-by: Kirill A. Shutemov Reviewed-by: David Hildenbrand Reviewed-by: Andrea Arcangeli Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1ed7293ac40c5b1950b8ab21b6bc1838578ae2ad Author: Matthew Wilcox Date: Tue Jan 8 15:23:25 2019 -0800 mm/memory.c: initialise mmu_notifier_range correctly One of the paths in follow_pte_pmd() initialised the mmu_notifier_range incorrectly. Link: http://lkml.kernel.org/r/20190103002126.GM6310@bombadil.infradead.org Fixes: ac46d4f3c432 ("mm/mmu_notifier: use structure for invalidate_range_start/end calls v2") Signed-off-by: Matthew Wilcox Tested-by: Dave Chinner Reviewed-by: Jérôme Glisse Cc: John Hubbard Cc: Jan Kara Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/memory.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit aff876dcf4461f311adbdf39ce48c134b3f99c49 Author: Miles Chen Date: Tue Jan 8 15:23:22 2019 -0800 tools/vm/page_owner: use page_owner_sort in the use example The example in comment does not useable because the output binary is named "page_owner_sort", not "sort". Also add a reference to Documentation/vm/page_owner.rst Link: http://lkml.kernel.org/r/1546515361-8317-1-git-send-email-miles.chen@mediatek.com Signed-off-by: Miles Chen Reviewed-by: Andrew Morton Cc: Joonsoo Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds tools/vm/page_owner_sort.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit a3fe7cdf02e318870fb71218726cc2321ff41f30 Author: Andrey Konovalov Date: Tue Jan 8 15:23:18 2019 -0800 kasan: fix krealloc handling for tag-based mode Right now tag-based KASAN can retag the memory that is reallocated via krealloc and return a differently tagged pointer even if the same slab object gets used and no reallocated technically happens. There are a few issues with this approach. One is that krealloc callers can't rely on comparing the return value with the passed argument to check whether reallocation happened. Another is that if a caller knows that no reallocation happened, that it can access object memory through the old pointer, which leads to false positives. Look at nf_ct_ext_add() to see an example. Fix this by keeping the same tag if the memory don't actually gets reallocated during krealloc. Link: http://lkml.kernel.org/r/bb2a71d17ed072bcc528cbee46fcbd71a6da3be4.1546540962.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Cc: Andrey Ryabinin Cc: Christoph Lameter Cc: Dmitry Vyukov Cc: Mark Rutland Cc: Vincenzo Frascino Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/kasan/common.c | 63 +++++++++++++++++++++++++++++++++++++------------------ 1 file changed, 43 insertions(+), 20 deletions(-) commit 96fedce27e1356a2fff1c270710d9405848db562 Author: Andrey Konovalov Date: Tue Jan 8 15:23:15 2019 -0800 kasan: make tag based mode work with CONFIG_HARDENED_USERCOPY With CONFIG_HARDENED_USERCOPY enabled __check_heap_object() compares and then subtracts a potentially tagged pointer with a non-tagged address of the page that this pointer belongs to, which leads to unexpected behavior. Untag the pointer in __check_heap_object() before doing any of these operations. Link: http://lkml.kernel.org/r/7e756a298d514c4482f52aea6151db34818d395d.1546540962.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Cc: Andrey Ryabinin Cc: Christoph Lameter Cc: Dmitry Vyukov Cc: Mark Rutland Cc: Vincenzo Frascino Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/slub.c | 2 ++ 1 file changed, 2 insertions(+) commit eb214f2dda31ffa989033b1e0f848ba0d3cb6188 Author: Andrey Konovalov Date: Tue Jan 8 15:23:11 2019 -0800 kasan, arm64: use ARCH_SLAB_MINALIGN instead of manual aligning Instead of changing cache->align to be aligned to KASAN_SHADOW_SCALE_SIZE in kasan_cache_create() we can reuse the ARCH_SLAB_MINALIGN macro. Link: http://lkml.kernel.org/r/52ddd881916bcc153a9924c154daacde78522227.1546540962.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Suggested-by: Vincenzo Frascino Cc: Andrey Ryabinin Cc: Christoph Lameter Cc: Dmitry Vyukov Cc: Mark Rutland Cc: Vincenzo Frascino Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/arm64/include/asm/cache.h | 6 ++++++ mm/kasan/common.c | 2 -- 2 files changed, 6 insertions(+), 2 deletions(-) commit 63f3655f950186752236bb88a22f8252c11ce394 Author: Michal Hocko Date: Tue Jan 8 15:23:07 2019 -0800 mm, memcg: fix reclaim deadlock with writeback Liu Bo has experienced a deadlock between memcg (legacy) reclaim and the ext4 writeback task1: wait_on_page_bit+0x82/0xa0 shrink_page_list+0x907/0x960 shrink_inactive_list+0x2c7/0x680 shrink_node_memcg+0x404/0x830 shrink_node+0xd8/0x300 do_try_to_free_pages+0x10d/0x330 try_to_free_mem_cgroup_pages+0xd5/0x1b0 try_charge+0x14d/0x720 memcg_kmem_charge_memcg+0x3c/0xa0 memcg_kmem_charge+0x7e/0xd0 __alloc_pages_nodemask+0x178/0x260 alloc_pages_current+0x95/0x140 pte_alloc_one+0x17/0x40 __pte_alloc+0x1e/0x110 alloc_set_pte+0x5fe/0xc20 do_fault+0x103/0x970 handle_mm_fault+0x61e/0xd10 __do_page_fault+0x252/0x4d0 do_page_fault+0x30/0x80 page_fault+0x28/0x30 task2: __lock_page+0x86/0xa0 mpage_prepare_extent_to_map+0x2e7/0x310 [ext4] ext4_writepages+0x479/0xd60 do_writepages+0x1e/0x30 __writeback_single_inode+0x45/0x320 writeback_sb_inodes+0x272/0x600 __writeback_inodes_wb+0x92/0xc0 wb_writeback+0x268/0x300 wb_workfn+0xb4/0x390 process_one_work+0x189/0x420 worker_thread+0x4e/0x4b0 kthread+0xe6/0x100 ret_from_fork+0x41/0x50 He adds "task1 is waiting for the PageWriteback bit of the page that task2 has collected in mpd->io_submit->io_bio, and tasks2 is waiting for the LOCKED bit the page which tasks1 has locked" More precisely task1 is handling a page fault and it has a page locked while it charges a new page table to a memcg. That in turn hits a memory limit reclaim and the memcg reclaim for legacy controller is waiting on the writeback but that is never going to finish because the writeback itself is waiting for the page locked in the #PF path. So this is essentially ABBA deadlock: lock_page(A) SetPageWriteback(A) unlock_page(A) lock_page(B) lock_page(B) pte_alloc_pne shrink_page_list wait_on_page_writeback(A) SetPageWriteback(B) unlock_page(B) # flush A, B to clear the writeback This accumulating of more pages to flush is used by several filesystems to generate a more optimal IO patterns. Waiting for the writeback in legacy memcg controller is a workaround for pre-mature OOM killer invocations because there is no dirty IO throttling available for the controller. There is no easy way around that unfortunately. Therefore fix this specific issue by pre-allocating the page table outside of the page lock. We have that handy infrastructure for that already so simply reuse the fault-around pattern which already does this. There are probably other hidden __GFP_ACCOUNT | GFP_KERNEL allocations from under a fs page locked but they should be really rare. I am not aware of a better solution unfortunately. [akpm@linux-foundation.org: fix mm/memory.c:__do_fault()] [akpm@linux-foundation.org: coding-style fixes] [mhocko@kernel.org: enhance comment, per Johannes] Link: http://lkml.kernel.org/r/20181214084948.GA5624@dhcp22.suse.cz Link: http://lkml.kernel.org/r/20181213092221.27270-1-mhocko@kernel.org Fixes: c3b94f44fcb0 ("memcg: further prevent OOM with too many dirty pages") Signed-off-by: Michal Hocko Reported-by: Liu Bo Debugged-by: Liu Bo Acked-by: Kirill A. Shutemov Acked-by: Johannes Weiner Reviewed-by: Liu Bo Cc: Jan Kara Cc: Dave Chinner Cc: Theodore Ts'o Cc: Vladimir Davydov Cc: Shakeel Butt Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/memory.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) commit 7bff3c06997374fb9b9991536a547b840549a813 Author: Qian Cai Date: Tue Jan 8 15:23:04 2019 -0800 mm/usercopy.c: no check page span for stack objects It is easy to trigger this with CONFIG_HARDENED_USERCOPY_PAGESPAN=y, usercopy: Kernel memory overwrite attempt detected to spans multiple pages (offset 0, size 23)! kernel BUG at mm/usercopy.c:102! For example, print_worker_info char name[WQ_NAME_LEN] = { }; char desc[WORKER_DESC_LEN] = { }; probe_kernel_read(name, wq->name, sizeof(name) - 1); probe_kernel_read(desc, worker->desc, sizeof(desc) - 1); __copy_from_user_inatomic check_object_size check_heap_object check_page_span This is because on-stack variables could cross PAGE_SIZE boundary, and failed this check, if (likely(((unsigned long)ptr & (unsigned long)PAGE_MASK) == ((unsigned long)end & (unsigned long)PAGE_MASK))) ptr = FFFF889007D7EFF8 end = FFFF889007D7F00E Hence, fix it by checking if it is a stack object first. [keescook@chromium.org: improve comments after reorder] Link: http://lkml.kernel.org/r/20190103165151.GA32845@beast Link: http://lkml.kernel.org/r/20181231030254.99441-1-cai@lca.pw Signed-off-by: Qian Cai Signed-off-by: Kees Cook Acked-by: Kees Cook Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/usercopy.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 09c2e76ed734a1d36470d257a778aaba28e86531 Author: Christoph Lameter Date: Tue Jan 8 15:23:00 2019 -0800 slab: alien caches must not be initialized if the allocation of the alien cache failed Callers of __alloc_alien() check for NULL. We must do the same check in __alloc_alien_cache to avoid NULL pointer dereferences on allocation failures. Link: http://lkml.kernel.org/r/010001680f42f192-82b4e12e-1565-4ee0-ae1f-1e98974906aa-000000@email.amazonses.com Fixes: 49dfc304ba241 ("slab: use the lock on alien_cache, instead of the lock on array_cache") Fixes: c8522a3a5832b ("Slab: introduce alloc_alien") Signed-off-by: Christoph Lameter Reported-by: syzbot+d6ed4ec679652b4fd4e4@syzkaller.appspotmail.com Reviewed-by: Andrew Morton Cc: Pekka Enberg Cc: David Rientjes Cc: Joonsoo Kim Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/slab.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit ba4a45746c362b665e245c50b870615f02f34781 Author: Shakeel Butt Date: Tue Jan 8 15:22:57 2019 -0800 fork, memcg: fix cached_stacks case Commit 5eed6f1dff87 ("fork,memcg: fix crash in free_thread_stack on memcg charge fail") fixes a crash caused due to failed memcg charge of the kernel stack. However the fix misses the cached_stacks case which this patch fixes. So, the same crash can happen if the memcg charge of a cached stack is failed. Link: http://lkml.kernel.org/r/20190102180145.57406-1-shakeelb@google.com Fixes: 5eed6f1dff87 ("fork,memcg: fix crash in free_thread_stack on memcg charge fail") Signed-off-by: Shakeel Butt Acked-by: Michal Hocko Acked-by: Rik van Riel Cc: Rik van Riel Cc: Roman Gushchin Cc: Johannes Weiner Cc: Tejun Heo Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/fork.c | 1 + 1 file changed, 1 insertion(+) commit 1d69a3f8ae77e3dbfdc1356225cce5ea9c366aec Author: Minchan Kim Date: Tue Jan 8 15:22:53 2019 -0800 zram: idle writeback fixes and cleanup This patch includes some fixes and cleanup for idle-page writeback. 1. writeback_limit interface Now writeback_limit interface is rather conusing. For example, once writeback limit budget is exausted, admin can see 0 from /sys/block/zramX/writeback_limit which is same semantic with disable writeback_limit at this moment. IOW, admin cannot tell that zero came from disable writeback limit or exausted writeback limit. To make the interface clear, let's sepatate enable of writeback limit to another knob - /sys/block/zram0/writeback_limit_enable * before: while true : # to re-enable writeback limit once previous one is used up echo 0 > /sys/block/zram0/writeback_limit echo $((200<<20)) > /sys/block/zram0/writeback_limit .. .. # used up the writeback limit budget * new # To enable writeback limit, from the beginning, admin should # enable it. echo $((200<<20)) > /sys/block/zram0/writeback_limit echo 1 > /sys/block/zram/0/writeback_limit_enable while true : echo $((200<<20)) > /sys/block/zram0/writeback_limit .. .. # used up the writeback limit budget It's much strightforward. 2. fix condition check idle/huge writeback mode check The mode in writeback_store is not bit opeartion any more so no need to use bit operations. Furthermore, current condition check is broken in that it does writeback every pages regardless of huge/idle. 3. clean up idle_store No need to use goto. [minchan@kernel.org: missed spin_lock_init] Link: http://lkml.kernel.org/r/20190103001601.GA255139@google.com Link: http://lkml.kernel.org/r/20181224033529.19450-1-minchan@kernel.org Signed-off-by: Minchan Kim Suggested-by: John Dias Cc: Sergey Senozhatsky Cc: John Dias Cc: Srinivas Paladugu Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Documentation/ABI/testing/sysfs-block-zram | 11 +++- Documentation/blockdev/zram.txt | 74 +++++++++++++++--------- drivers/block/zram/zram_drv.c | 90 ++++++++++++++++++++++-------- drivers/block/zram/zram_drv.h | 5 +- 4 files changed, 125 insertions(+), 55 deletions(-) commit 917cb8a72a94d198073ad1e087685f801292042d Author: Steve Wise Date: Mon Jan 7 11:01:13 2019 -0800 RDMA/cma: Add cm_id restrack resource based on kernel or user cm_id type A recent regression causes a null ptr crash when dumping cm_id resources. The cma is incorrectly adding all cm_id restrack resources as kernel mode. Fixes: af8d70375d56 ("RDMA/restrack: Resource-tracker should not use uobject pointers") Signed-off-by: Steve Wise Reviewed-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/core/cma.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 19a220dd1e8a1b1d8e5e2f8f4a25313c4b02d527 Author: Jerome Brunet Date: Tue Aug 28 14:27:35 2018 +0200 arm64: defconfig: enable modules for amlogic s400 sound card Compile the necessary drivers as modules, including codecs, for the s400 sound card. Signed-off-by: Jerome Brunet Signed-off-by: Kevin Hilman arch/arm64/configs/defconfig | 4 ++++ 1 file changed, 4 insertions(+) commit c235316d935a19deedc2fc48076798c9a56e1a7c Author: Lyude Paul Date: Tue Jan 8 16:11:29 2019 -0500 drm/dp_mst: Add __must_check to drm_dp_mst_topology_mgr_resume() Since I've had to fix two cases of drivers not checking the return code from this function, let's make the compiler complain so this doesn't come up again in the future. Changes since v1: * Remove unneeded __must_check in function declaration - danvet Signed-off-by: Lyude Paul Cc: Jerry Zuo Reviewed-by: Daniel Vetter Reviewed-by: Harry Wentland Link: https://patchwork.freedesktop.org/patch/msgid/20190108211133.32564-4-lyude@redhat.com include/drm/drm_dp_mst_helper.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 2d1af6a11cb9d88e0e3dd10258904c437fe1b315 Author: Lyude Paul Date: Tue Jan 8 16:11:28 2019 -0500 drm/amdgpu: Don't fail resume process if resuming atomic state fails This is an ugly one unfortunately. Currently, all DRM drivers supporting atomic modesetting will save the state that userspace had set before suspending, then attempt to restore that state on resume. This probably worked very well at one point, like many other things, until DP MST came into the picture. While it's easy to restore state on normal display connectors that were disconnected during suspend regardless of their state post-resume, this can't really be done with MST because of the fact that setting up a downstream sink requires performing sideband transactions between the source and the MST hub, sending out the ACT packets, etc. Because of this, there isn't really a guarantee that we can restore the atomic state we had before suspend once we've resumed. This sucks pretty bad, but so far I haven't run into any compositors that this actually causes serious issues with. Most compositors will notice the hotplug we send afterwards, and then reprobe state. Since nouveau and i915 also don't fail the suspend/resume process due to failing to restore the atomic state, let's make amdgpu match this behavior. Better to resume the GPU properly, then to stop the process half way because of a potentially unavoidable atomic commit failure. Eventually, we'll have a real fix for this problem on the DRM level. But we've got some more important low-hanging fruit to deal with first. Signed-off-by: Lyude Paul Reviewed-by: Harry Wentland Cc: Jerry Zuo Cc: # v4.15+ Link: https://patchwork.freedesktop.org/patch/msgid/20190108211133.32564-3-lyude@redhat.com drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit fe7553bef8d676d1d8b40666868b33ec39b9df5d Author: Lyude Paul Date: Tue Jan 8 16:11:27 2019 -0500 drm/amdgpu: Don't ignore rc from drm_dp_mst_topology_mgr_resume() drm_dp_mst_topology_mgr_resume() returns whether or not it managed to find the topology in question after a suspend resume cycle, and the driver is supposed to check this value and disable MST accordingly if it's gone-in addition to sending a hotplug in order to notify userspace that something changed during suspend. Currently, amdgpu just makes the mistake of ignoring the return code from drm_dp_mst_topology_mgr_resume() which means that if a topology was removed in suspend, amdgpu never notices and assumes it's still connected which leads to all sorts of problems. So, fix this by actually checking the rc from drm_dp_mst_topology_mgr_resume(). Also, reformat the rest of the function while we're at it to fix the over-indenting. Signed-off-by: Lyude Paul Reviewed-by: Harry Wentland Cc: Jerry Zuo Cc: # v4.15+ Link: https://patchwork.freedesktop.org/patch/msgid/20190108211133.32564-2-lyude@redhat.com drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 32 ++++++++++++++++------- 1 file changed, 23 insertions(+), 9 deletions(-) commit 715849ab31f8e57bbad84cc6c38912aeba6beb21 Author: Pablo Neira Ayuso Date: Tue Jan 8 23:18:58 2019 +0100 netfilter: nf_tables: selective rule dump needs table to be specified Table needs to be specified for selective rule dumps per chain. Fixes: 241faeceb849c ("netfilter: nf_tables: Speed up selective rule dumps") Reported-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_tables_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b91d9036883793122cf6575ca4dfbfbdd201a83d Author: Taehee Yoo Date: Fri Jan 4 17:56:16 2019 +0900 netfilter: nf_tables: fix leaking object reference count There is no code that decreases the reference count of stateful objects in error path of the nft_add_set_elem(). this causes a leak of reference count of stateful objects. Test commands: $nft add table ip filter $nft add counter ip filter c1 $nft add map ip filter m1 { type ipv4_addr : counter \;} $nft add element ip filter m1 { 1 : c1 } $nft add element ip filter m1 { 1 : c1 } $nft delete element ip filter m1 { 1 } $nft delete counter ip filter c1 Result: Error: Could not process rule: Device or resource busy delete counter ip filter c1 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ At the second 'nft add element ip filter m1 { 1 : c1 }', the reference count of the 'c1' is increased then it tries to insert into the 'm1'. but the 'm1' already has same element so it returns -EEXIST. But it doesn't decrease the reference count of the 'c1' in the error path. Due to a leak of the reference count of the 'c1', the 'c1' can't be removed by 'nft delete counter ip filter c1'. Fixes: 8aeff920dcc9 ("netfilter: nf_tables: add stateful object reference to set elements") Signed-off-by: Taehee Yoo Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_tables_api.c | 2 ++ 1 file changed, 2 insertions(+) commit 310529e663ed975d564cf029f878583e70c3b8a3 Author: Phil Sutter Date: Sun Dec 30 17:27:43 2018 +0100 netfilter: nf_tables: Fix for endless loop when dumping ruleset __nf_tables_dump_rules() stores the current idx value into cb->args[0] before returning to caller. With multiple chains present, cb->args[0] is therefore updated after each chain's rules have been traversed. This though causes the final nf_tables_dump_rules() run (which should return an skb->len of zero since no rules are left to dump) to continue dumping rules for each but the first chain. Fix this by moving the cb->args[0] update to nf_tables_dump_rules(). With no final action to be performed anymore in __nf_tables_dump_rules(), drop 'out_unfinished' jump label and 'rc' variable - instead return the appropriate value directly. Fixes: 241faeceb849c ("netfilter: nf_tables: Speed up selective rule dumps") Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_tables_api.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) commit 4314b1f68a3f655f75010ab04bb57419eab34ec3 Merge: 11287b693d03 4fabf3bf93a1 Author: David S. Miller Date: Tue Jan 8 16:53:54 2019 -0500 Merge branch 'mlxsw-fixes' Daniel Borkmann says: ==================== pull-request: bpf 2019-01-08 The following pull-request contains BPF updates for your *net* tree. The main changes are: 1) Fix BSD'ism in sendmsg(2) to rewrite unspecified IPv6 dst for unconnected UDP sockets with [::1] _after_ cgroup BPF invocation, from Andrey. 2) Follow-up fix to the speculation fix where we need to reject a corner case for sanitation when ptr and scalars are mixed in the same alu op. Also, some unrelated minor doc fixes, from Daniel. 3) Fix BPF kselftest's incorrect uses of create_and_get_cgroup() by not assuming fd of zero value to be the result of an error case, from Stanislav. ==================== Signed-off-by: David S. Miller commit 4fabf3bf93a194c7fa5288da3e0af37e4b943cf3 Author: Ido Schimmel Date: Tue Jan 8 16:48:14 2019 +0000 selftests: forwarding: Add a test for VLAN deletion Add a VLAN on a bridge port, delete it and make sure the PVID VLAN is not affected. Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller .../testing/selftests/net/forwarding/bridge_vlan_aware.sh | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) commit 674bed5df4cab8f96d04f7b99608883a48f9226b Author: Ido Schimmel Date: Tue Jan 8 16:48:13 2019 +0000 mlxsw: spectrum_switchdev: Set PVID correctly during VLAN deletion When a VLAN is deleted from a bridge port we should not change the PVID unless the deleted VLAN is the PVID. Fixes: fe9ccc785de5 ("mlxsw: spectrum_switchdev: Don't batch VLAN operations") Signed-off-by: Ido Schimmel Acked-by: Jiri Pirko Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 289fb44df4e4c3fe977ee4b451e1d11e10227654 Author: Ido Schimmel Date: Tue Jan 8 16:48:12 2019 +0000 selftests: forwarding: Fix test for different devices When running the test on the Spectrum ASIC the generated packets are counted on the ingress filter and injected back to the pipeline because of the 'pass' action. The router block then drops the packets due to checksum error, as the test generates packets with zero checksum. When running the test on an emulator that is not as strict about checksum errors the test fails since packets are counted twice. Once by the emulated ASIC on its ingress filter and again by the kernel as the emulator does not perform checksum validation and allows the packets to be trapped by a matching host route. Fix this by changing the action to 'drop', which will prevent the packet from continuing further in the pipeline to the router block. For veth pairs this change is essentially a NOP given packets are only processed once (by the kernel). Fixes: a0b61f3d8ebf ("selftests: forwarding: vxlan_bridge_1d: Add an ECN decap test") Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller tools/testing/selftests/net/forwarding/vxlan_bridge_1d.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 279737939a8194f02fa352ab4476a1b241f44ef4 Author: Ido Schimmel Date: Tue Jan 8 16:48:11 2019 +0000 net: bridge: Fix VLANs memory leak When adding / deleting VLANs to / from a bridge port, the bridge driver first tries to propagate the information via switchdev and falls back to the 8021q driver in case the underlying driver does not support switchdev. This can result in a memory leak [1] when VXLAN and mlxsw ports are enslaved to the bridge: $ ip link set dev vxlan0 master br0 # No mlxsw ports are enslaved to 'br0', so mlxsw ignores the switchdev # notification and the bridge driver adds the VLAN on 'vxlan0' via the # 8021q driver $ bridge vlan add vid 10 dev vxlan0 pvid untagged # mlxsw port is enslaved to the bridge $ ip link set dev swp1 master br0 # mlxsw processes the switchdev notification and the 8021q driver is # skipped $ bridge vlan del vid 10 dev vxlan0 This results in 'struct vlan_info' and 'struct vlan_vid_info' being leaked, as they were allocated by the 8021q driver during VLAN addition, but never freed as the 8021q driver was skipped during deletion. Fix this by introducing a new VLAN private flag that indicates whether the VLAN was added on the port by switchdev or the 8021q driver. If the VLAN was added by the 8021q driver, then we make sure to delete it via the 8021q driver as well. [1] unreferenced object 0xffff88822d20b1e8 (size 256): comm "bridge", pid 2532, jiffies 4295216998 (age 1188.830s) hex dump (first 32 bytes): e0 42 97 ce 81 88 ff ff 00 00 00 00 00 00 00 00 .B.............. 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000f82d851d>] kmem_cache_alloc_trace+0x1be/0x330 [<00000000e0178b02>] vlan_vid_add+0x661/0x920 [<00000000218ebd5f>] __vlan_add+0x1be9/0x3a00 [<000000006eafa1ca>] nbp_vlan_add+0x8b3/0xd90 [<000000003535392c>] br_vlan_info+0x132/0x410 [<00000000aedaa9dc>] br_afspec+0x75c/0x870 [<00000000f5716133>] br_setlink+0x3dc/0x6d0 [<00000000aceca5e2>] rtnl_bridge_setlink+0x615/0xb30 [<00000000a2f2d23e>] rtnetlink_rcv_msg+0x3a3/0xa80 [<0000000064097e69>] netlink_rcv_skb+0x152/0x3c0 [<000000008be8d614>] rtnetlink_rcv+0x21/0x30 [<000000009ab2ca25>] netlink_unicast+0x52f/0x740 [<00000000e7d9ac96>] netlink_sendmsg+0x9c7/0xf50 [<000000005d1e2050>] sock_sendmsg+0xbe/0x120 [<00000000d51426bc>] ___sys_sendmsg+0x778/0x8f0 [<00000000b9d7b2cc>] __sys_sendmsg+0x112/0x270 unreferenced object 0xffff888227454308 (size 32): comm "bridge", pid 2532, jiffies 4295216998 (age 1188.882s) hex dump (first 32 bytes): 88 b2 20 2d 82 88 ff ff 88 b2 20 2d 82 88 ff ff .. -...... -.... 81 00 0a 00 01 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000f82d851d>] kmem_cache_alloc_trace+0x1be/0x330 [<0000000018050631>] vlan_vid_add+0x3e6/0x920 [<00000000218ebd5f>] __vlan_add+0x1be9/0x3a00 [<000000006eafa1ca>] nbp_vlan_add+0x8b3/0xd90 [<000000003535392c>] br_vlan_info+0x132/0x410 [<00000000aedaa9dc>] br_afspec+0x75c/0x870 [<00000000f5716133>] br_setlink+0x3dc/0x6d0 [<00000000aceca5e2>] rtnl_bridge_setlink+0x615/0xb30 [<00000000a2f2d23e>] rtnetlink_rcv_msg+0x3a3/0xa80 [<0000000064097e69>] netlink_rcv_skb+0x152/0x3c0 [<000000008be8d614>] rtnetlink_rcv+0x21/0x30 [<000000009ab2ca25>] netlink_unicast+0x52f/0x740 [<00000000e7d9ac96>] netlink_sendmsg+0x9c7/0xf50 [<000000005d1e2050>] sock_sendmsg+0xbe/0x120 [<00000000d51426bc>] ___sys_sendmsg+0x778/0x8f0 [<00000000b9d7b2cc>] __sys_sendmsg+0x112/0x270 Fixes: d70e42b22dd4 ("mlxsw: spectrum: Enable VxLAN enslavement to VLAN-aware bridges") Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Cc: Roopa Prabhu Cc: Nikolay Aleksandrov Cc: bridge@lists.linux-foundation.org Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller net/bridge/br_private.h | 1 + net/bridge/br_vlan.c | 26 +++++++++++++------------- 2 files changed, 14 insertions(+), 13 deletions(-) commit 16dc42e4511172aa3a4d49931597582c9ff78843 Author: Ido Schimmel Date: Tue Jan 8 16:48:10 2019 +0000 selftests: mlxsw: Add a test case for VLAN addition error flow Add a test case for the issue fixed by previous commit. In case the offloading of an unsupported VxLAN tunnel was triggered by adding the mapped VLAN to a local port, then error should be returned to the user. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller tools/testing/selftests/drivers/net/mlxsw/vxlan.sh | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) commit 412283eedc138381e24d8c1304a3c5b298c503c4 Author: Ido Schimmel Date: Tue Jan 8 16:48:08 2019 +0000 mlxsw: spectrum_nve: Replace error code with EINVAL Adding a VLAN on a port can trigger the offload of a VXLAN tunnel which is already a member in the VLAN. In case the configuration of the VXLAN is not supported, the driver would return -EOPNOTSUPP. This is problematic since bridge code does not interpret this as error, but rather that it should try to setup the VLAN using the 8021q driver instead of switchdev. Fixes: d70e42b22dd4 ("mlxsw: spectrum: Enable VxLAN enslavement to VLAN-aware bridges") Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum_nve.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 457e20d659247a09524e276aed46f19d853701d0 Author: Ido Schimmel Date: Tue Jan 8 16:48:07 2019 +0000 mlxsw: spectrum_switchdev: Avoid returning errors in commit phase Drivers are not supposed to return errors in switchdev commit phase if they returned OK in prepare phase. Otherwise, a WARNING is emitted. However, when the offloading of a VXLAN tunnel is triggered by the addition of a VLAN on a local port, it is not possible to guarantee that the commit phase will succeed without doing a lot of work. In these cases, the artificial division between prepare and commit phase does not make sense, so simply do the work in the prepare phase. Fixes: d70e42b22dd4 ("mlxsw: spectrum: Enable VxLAN enslavement to VLAN-aware bridges") Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller .../ethernet/mellanox/mlxsw/spectrum_switchdev.c | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-) commit 143a8e038ac599ca73c6354c8af6a8fdeee9fa7d Author: Ido Schimmel Date: Tue Jan 8 16:48:06 2019 +0000 mlxsw: spectrum: Add VXLAN dependency for spectrum When VXLAN is a loadable module, MLXSW_SPECTRUM must not be built-in: drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c:2547: undefined reference to `vxlan_fdb_find_uc' Add Kconfig dependency to enforce usable configurations. Fixes: 1231e04f5bba ("mlxsw: spectrum_switchdev: Add support for VxLAN encapsulation") Signed-off-by: Ido Schimmel Reported-by: kbuild test robot Reviewed-by: Petr Machata Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 8adbe212a159d9c78a90fca1d854f6e63452426b Author: Jiri Pirko Date: Tue Jan 8 16:48:05 2019 +0000 mlxsw: spectrum: Disable lag port TX before removing it Make sure that lag port TX is disabled before mlxsw_sp_port_lag_leave() is called and prevent from possible EMAD error. Fixes: 0d65fc13042f ("mlxsw: spectrum: Implement LAG port join/leave") Signed-off-by: Jiri Pirko Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 04d075b7aa8433dc3c98e14c571705effc318cd8 Author: Nir Dotan Date: Tue Jan 8 16:48:04 2019 +0000 mlxsw: spectrum_acl: Remove ASSERT_RTNL()s in module removal flow Removal of the mlxsw driver on Spectrum-2 platforms hits an ASSERT_RTNL() in Spectrum-2 ACL Bloom filter and in ERP removal paths. This happens because the multicast router implementation in Spectrum-2 relies on ACLs. Taking the RTNL lock upon driver removal is useless since the driver first removes its ports and unregisters from notifiers so concurrent writes cannot happen at that time. The assertions were originally put as a reminder for future work involving ERP background optimization, but having these assertions only during addition serves this purpose as well. Therefore remove the ASSERT_RTNL() in both places related to ERP and Bloom filter removal. Fixes: cf7221a4f5a5 ("mlxsw: spectrum_router: Add Multicast routing support for Spectrum-2") Signed-off-by: Nir Dotan Reviewed-by: Jiri Pirko Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c | 2 -- 1 file changed, 2 deletions(-) commit ff0db43cd6c530ff944773ccf48ece55d32d0c22 Author: Nir Dotan Date: Tue Jan 8 16:48:03 2019 +0000 mlxsw: spectrum_acl: Add cleanup after C-TCAM update error condition When writing to C-TCAM, mlxsw driver uses cregion->ops->entry_insert(). In case of C-TCAM HW insertion error, the opposite action should take place. Add error handling case in which the C-TCAM region entry is removed, by calling cregion->ops->entry_remove(). Fixes: a0a777b9409f ("mlxsw: spectrum_acl: Start using A-TCAM") Signed-off-by: Nir Dotan Reviewed-by: Jiri Pirko Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_ctcam.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) commit f5c9571e2265b3cbfad2ed41ba60c3da474daa61 Author: Amadeusz Sławiński Date: Tue Jan 8 21:03:11 2019 +0100 ALSA: usb-audio: fix CM6206 register definitions fix typo after a recent commit causing headphones to have no sound Fixes: ad43d528a7ac (ALSA: usb-audio: Define registers for CM6206) Signed-off-by: Amadeusz Sławiński Signed-off-by: Takashi Iwai sound/usb/quirks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 11287b693d03830010356339e4ceddf47dee34fa Author: Heiner Kallweit Date: Mon Jan 7 21:49:09 2019 +0100 r8169: load Realtek PHY driver module before r8169 This soft dependency works around an issue where sometimes the genphy driver is used instead of the dedicated PHY driver. The root cause of the issue isn't clear yet. People reported the unloading/re-loading module r8169 helps, and also configuring this soft dependency in the modprobe config files. Important just seems to be that the realtek module is loaded before r8169. Once this has been applied preliminary fix 38af4b903210 ("net: phy: add workaround for issue where PHY driver doesn't bind to the device") will be removed. Fixes: f1e911d5d0df ("r8169: add basic phylib support") Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller drivers/net/ethernet/realtek/r8169.c | 1 + 1 file changed, 1 insertion(+) commit c4a32b266da7bb702e60381ca0c35eaddbc89a6c Author: Yu Zhao Date: Mon Jan 7 15:51:15 2019 -0700 drm/amdgpu: validate user GEM object size When creating frame buffer, userspace may request to attach to a previously allocated GEM object that is smaller than what GPU requires. Validation must be done to prevent out-of-bound DMA, otherwise it could be exploited to reveal sensitive data. This fix is not done in a common code path because individual driver might have different requirement. Cc: stable@vger.kernel.org # v4.2+ Reviewed-by: Michel Dänzer Signed-off-by: Yu Zhao Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 89f23b6efef554766177bf51aa754bce14c3e7da Author: Yu Zhao Date: Mon Jan 7 15:51:14 2019 -0700 drm/amdgpu: validate user pitch alignment Userspace may request pitch alignment that is not supported by GPU. Some requests 32, but GPU ignores it and uses default 64 when cpp is 4. If GEM object is allocated based on the smaller alignment, GPU DMA will go out of bound. Cc: stable@vger.kernel.org # v4.2+ Reviewed-by: Michel Dänzer Signed-off-by: Yu Zhao Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit fadcb8f9fc89f7b517ce48f30e0b607b16d99d63 Author: Evan Quan Date: Tue Jan 8 12:22:24 2019 +0800 drm/amd/powerplay: drop the unnecessary uclk hard min setting Since soft min setting is enough. Hard min setting is redundant. Reported-by: Likun Gao Signed-off-by: Evan Quan Acked-by: Alex Deucher Reviewed-by: Likun Gao Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c | 7 ------- 1 file changed, 7 deletions(-) commit fff0d3f7686942bd544b53a48d1b76bd62c46946 Author: Evan Quan Date: Tue Jan 8 10:33:35 2019 +0800 drm/amd/powerplay: avoid possible buffer overflow Make sure the clock level enforced is within the allowed ranges. Signed-off-by: Evan Quan Reviewed-by: Alex Deucher Reviewed-by: Likun Gao Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) commit 0624e145fb2ba87c752bec355af12f43cb52cd68 Author: Evan Quan Date: Mon Jan 7 18:56:14 2019 +0800 drm/amd/powerplay: create pp_od_clk_voltage device file under OD support Since pp_od_clk_voltage device file is for OD related sysfs operations. Signed-off-by: Evan Quan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) commit a0071840d2040ea1b27e5a008182b09b88defc15 Author: Bryan Whitehead Date: Mon Jan 7 14:00:09 2019 -0500 lan743x: Remove phy_read from link status change function It has been noticed that some phys do not have the registers required by the previous implementation. To fix this, instead of using phy_read, the required information is extracted from the phy_device structure. fixes: 23f0703c125b ("lan743x: Add main source files for new lan743x driver") Signed-off-by: Bryan Whitehead Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/ethernet/microchip/lan743x_main.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) commit 8139d493daf1ef19d34192f95e92e19dc19b648a Author: Evan Quan Date: Mon Jan 7 18:38:30 2019 +0800 drm/amd/powerplay: update OD support flag for SKU with no OD capabilities For those ASICs with no overdrive capabilities, the OD support flag will be reset. Signed-off-by: Evan Quan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c | 3 +++ 1 file changed, 3 insertions(+) commit b7ea4894aa867aaf1c31bfb4b00a3c3e38eedf95 Author: Eugene Syromiatnikov Date: Mon Jan 7 16:22:38 2019 +0100 ptp: uapi: change _IOW to IOWR in PTP_SYS_OFFSET_EXTENDED definition The ioctl command is read/write (or just read, if the fact that user space writes n_samples field is ignored). Signed-off-by: Eugene Syromiatnikov Signed-off-by: David S. Miller include/uapi/linux/ptp_clock.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 895ac1376d5abcb94ca1b70a595579f253237790 Author: Eugene Syromiatnikov Date: Mon Jan 7 16:22:29 2019 +0100 ptp: check that rsv field is zero in struct ptp_sys_offset_extended Otherwise it is impossible to use it for something else, as it will break userspace that puts garbage there. The same check should be done in other structures, but the fact that data in reserved fields is ignored is already part of the kernel ABI. Signed-off-by: Eugene Syromiatnikov Signed-off-by: David S. Miller drivers/ptp/ptp_chardev.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 6a829eb8619fbdde6d7d627ad582fe119805f39d Author: Trond Myklebust Date: Thu Jan 3 09:04:45 2019 -0500 SUNRPC: Fix TCP receive code on archs with flush_dcache_page() After receiving data into the page cache, we need to call flush_dcache_page() for the architectures that define it. Fixes: 277e4ab7d530b ("SUNRPC: Simplify TCP receive code by switching...") Reported-by: Geert Uytterhoeven Signed-off-by: Trond Myklebust Cc: stable@vger.kernel.org # v4.20 Tested-by: Geert Uytterhoeven Signed-off-by: Anna Schumaker net/sunrpc/xprtsock.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) commit 7b55851367136b1efd84d98fea81ba57a98304cf Author: David Herrmann Date: Tue Jan 8 13:58:52 2019 +0100 fork: record start_time late This changes the fork(2) syscall to record the process start_time after initializing the basic task structure but still before making the new process visible to user-space. Technically, we could record the start_time anytime during fork(2). But this might lead to scenarios where a start_time is recorded long before a process becomes visible to user-space. For instance, with userfaultfd(2) and TLS, user-space can delay the execution of fork(2) for an indefinite amount of time (and will, if this causes network access, or similar). By recording the start_time late, it much closer reflects the point in time where the process becomes live and can be observed by other processes. Lastly, this makes it much harder for user-space to predict and control the start_time they get assigned. Previously, user-space could fork a process and stall it in copy_thread_tls() before its pid is allocated, but after its start_time is recorded. This can be misused to later-on cycle through PIDs and resume the stalled fork(2) yielding a process that has the same pid and start_time as a process that existed before. This can be used to circumvent security systems that identify processes by their pid+start_time combination. Even though user-space was always aware that start_time recording is flaky (but several projects are known to still rely on start_time-based identification), changing the start_time to be recorded late will help mitigate existing attacks and make it much harder for user-space to control the start_time a process gets assigned. Reported-by: Jann Horn Signed-off-by: Tom Gundersen Signed-off-by: David Herrmann Signed-off-by: Linus Torvalds kernel/fork.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) commit ee412f14693a3fe2645b3528603dfd37dd05118a Author: Arnaldo Carvalho de Melo Date: Tue Jan 8 13:53:23 2019 -0300 tools include uapi: Sync linux/vhost.h with the kernel sources To get the changes in: 4b86713236e4 ("vhost: split structs into a separate header file") Silencing this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/vhost.h' differs from latest version at 'include/uapi/linux/vhost.h' diff -u tools/include/uapi/linux/vhost.h include/uapi/linux/vhost.h Those didn't touch things used in tools, i.e. the following continues working: $ tools/perf/trace/beauty/vhost_virtio_ioctl.sh static const char *vhost_virtio_ioctl_cmds[] = { [0x00] = "SET_FEATURES", [0x01] = "SET_OWNER", [0x02] = "RESET_OWNER", [0x03] = "SET_MEM_TABLE", [0x04] = "SET_LOG_BASE", [0x07] = "SET_LOG_FD", [0x10] = "SET_VRING_NUM", [0x11] = "SET_VRING_ADDR", [0x12] = "SET_VRING_BASE", [0x13] = "SET_VRING_ENDIAN", [0x14] = "GET_VRING_ENDIAN", [0x20] = "SET_VRING_KICK", [0x21] = "SET_VRING_CALL", [0x22] = "SET_VRING_ERR", [0x23] = "SET_VRING_BUSYLOOP_TIMEOUT", [0x24] = "GET_VRING_BUSYLOOP_TIMEOUT", [0x25] = "SET_BACKEND_FEATURES", [0x30] = "NET_SET_BACKEND", [0x40] = "SCSI_SET_ENDPOINT", [0x41] = "SCSI_CLEAR_ENDPOINT", [0x42] = "SCSI_GET_ABI_VERSION", [0x43] = "SCSI_SET_EVENTS_MISSED", [0x44] = "SCSI_GET_EVENTS_MISSED", [0x60] = "VSOCK_SET_GUEST_CID", [0x61] = "VSOCK_SET_RUNNING", }; static const char *vhost_virtio_ioctl_read_cmds[] = { [0x00] = "GET_FEATURES", [0x12] = "GET_VRING_BASE", [0x26] = "GET_BACKEND_FEATURES", }; $ At some point in the eBPFication of perf, using something like: # perf trace -e ioctl(cmd=VHOST_VRING*) Will setup a BPF filter right at the raw_syscalls:sys_enter tracepoint, i.e. filtering at the origin. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Michael S. Tsirkin Cc: Namhyung Kim Cc: Paolo Bonzini Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-g28usrt7l59lwq3wuh8vzbig@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/include/uapi/linux/vhost.h | 113 +-------------------------------------- 1 file changed, 2 insertions(+), 111 deletions(-) commit fdc42ca190c7d8976f4f9240752f0bd008270b72 Author: Arnaldo Carvalho de Melo Date: Tue Jan 8 13:48:14 2019 -0300 tools include uapi: Sync linux/fs.h copy with the kernel sources To get the changes in: e262e32d6bde ("vfs: Suppress MS_* flag defs within the kernel unless explicitly enabled") That made the mount flags string table generator to switch to using mount.h instead. This silences the following perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/fs.h' differs from latest version at 'include/uapi/linux/fs.h' diff -u tools/include/uapi/linux/fs.h include/uapi/linux/fs.h Cc: Adrian Hunter Cc: David Howells Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-mosz81pa6iwxko4p2owbm3ss@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/include/uapi/linux/fs.h | 60 ++++++------------------------------------- 1 file changed, 8 insertions(+), 52 deletions(-) commit 1c23397d2a6a077ab32f01c01406c2fe61b7b3a4 Author: Arnaldo Carvalho de Melo Date: Tue Jan 8 13:46:43 2019 -0300 perf beauty: Switch from using uapi/linux/fs.h to uapi/linux/mount.h As now we'll update our fs.h copy and what tools/perf/trace/beauty/mount_flags.sh needs just got moved to mount.h, use that instead. Cc: Adrian Hunter Cc: David Howells Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-ls19h376xukeouxrw9dswkcn@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/trace/beauty/mount_flags.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 250bfc87ddc427fa001bbc8bc1468ce5fc06645b Author: Arnaldo Carvalho de Melo Date: Tue Jan 8 13:42:37 2019 -0300 tools include uapi: Grab a copy of linux/mount.h We were using a copy of uapi/linux/fs.h to create the mount syscall 'flags' string table to use in 'perf trace', to convert from the number obtained via the raw_syscalls:sys_enter into a string, using tools/perf/trace/beauty/mount_flags.sh, but in e262e32d6bde ("vfs: Suppress MS_* flag defs within the kernel unless explicitly enabled") those defines got moved to linux/mount.h, so grab a copy of mount.h too. Keep the uapi/linux/fs.h as we'll use it for the SEEK_ constants. Cc: Adrian Hunter Cc: David Howells Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-i2ricmpwpdrpukfq3298jr1z@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/include/uapi/linux/mount.h | 58 ++++++++++++++++++++++++++++++++++++++++ tools/perf/check-headers.sh | 1 + 2 files changed, 59 insertions(+) commit 6e17f58c486d9554341f70aa5b63b8fbed07b3fa Author: Dan Carpenter Date: Sat Jan 5 16:06:48 2019 +0300 xprtrdma: Double free in rpcrdma_sendctxs_create() The clean up is handled by the caller, rpcrdma_buffer_create(), so this call to rpcrdma_sendctxs_destroy() leads to a double free. Fixes: ae72950abf99 ("xprtrdma: Add data structure to manage RDMA Send arguments") Signed-off-by: Dan Carpenter Reviewed-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/verbs.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) commit 4429b668e0375206408617d6440e3bb76c56c7d2 Author: Dan Carpenter Date: Sat Jan 5 16:06:07 2019 +0300 xprtrdma: Fix error code in rpcrdma_buffer_create() This should return -ENOMEM if __alloc_workqueue_key() fails, but it returns success. Fixes: 6d2d0ee27c7a ("xprtrdma: Replace rpcrdma_receive_wq with a per-xprt workqueue") Signed-off-by: Dan Carpenter Reviewed-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/verbs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 58fec830fc19208354895d9832785505046d6c01 Author: Alex Williamson Date: Mon Jan 7 22:13:22 2019 -0700 vfio/type1: Fix unmap overflow off-by-one The below referenced commit adds a test for integer overflow, but in doing so prevents the unmap ioctl from ever including the last page of the address space. Subtract one to compare to the last address of the unmap to avoid the overflow and wrap-around. Fixes: 71a7d3d78e3c ("vfio/type1: silence integer overflow warning") Link: https://bugzilla.redhat.com/show_bug.cgi?id=1662291 Cc: stable@vger.kernel.org # v4.15+ Reported-by: Pei Zhang Debugged-by: Peter Xu Reviewed-by: Dan Carpenter Reviewed-by: Peter Xu Tested-by: Peter Xu Reviewed-by: Cornelia Huck Signed-off-by: Alex Williamson drivers/vfio/vfio_iommu_type1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f2e14cd2c93699aa0aeaa8240457ab359f1258ff Author: Arnaldo Carvalho de Melo Date: Tue Jan 8 10:56:59 2019 -0300 perf top: Lift restriction on using callchains without "sym" in --sort This restriction is not present in 'perf report' and since 'perf top' uses the same hists browser, remove it from it as well. With this we create per event buckets with callchain trees, so that # perf top --sort dso -g --no-children Bucketizes samples by DSO and below it shows the callchains leading to functions in this DSO. Try also: # perf top -e sched:*switch -g --no-children To see the callchains leading to sched switches, pressing 'E' to expand all one can quickly see the most common scheduler switches and what leads to them, for instance, calls to IO, futexes, etc. Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Jiri Olsa Link: https://lkml.kernel.org/r/20190107140854.GA28965@kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-top.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) commit 9231967e2f515fce9e19687c0c40dfda416b3512 Author: Tzvetomir Stoyanov Date: Fri Nov 30 23:08:13 2018 -0500 tools lib traceevent: Remove tep_data_event_from_type() API In order to make libtraceevent into a proper library, its API should be straightforward. After discussion with Steven Rostedt, we decided to remove the tep_data_event_from_type() API and to replace it with tep_find_event(), as it does the same. Signed-off-by: Tzvetomir Stoyanov Cc: Andrew Morton Cc: Jiri Olsa Cc: Namhyung Kim Link: http://lkml.kernel.org/r/20181201040852.913841066@goodmis.org Signed-off-by: Steven Rostedt (VMware) Signed-off-by: Arnaldo Carvalho de Melo tools/lib/traceevent/event-parse.c | 12 ------------ tools/lib/traceevent/event-parse.h | 1 - 2 files changed, 13 deletions(-) commit 4104e604277016b3e6a7d120368054f9d2716953 Author: Tzvetomir Stoyanov Date: Fri Nov 30 23:08:12 2018 -0500 tools lib traceevent: Rename tep_is_file_bigendian() to tep_file_bigendian() In order to make libtraceevent into a proper library, its API should be straightforward. After a discussion with Steven Rostedt, we decided to rename a few APIs, to have more intuitive names. This patch renames tep_is_file_bigendian() to tep_file_bigendian(). Signed-off-by: Tzvetomir Stoyanov Cc: Andrew Morton Cc: Jiri Olsa Cc: Namhyung Kim Link: http://lkml.kernel.org/r/20181201040852.767549746@goodmis.org Signed-off-by: Steven Rostedt (VMware) Signed-off-by: Arnaldo Carvalho de Melo tools/lib/traceevent/event-parse-api.c | 4 ++-- tools/lib/traceevent/event-parse.h | 2 +- tools/lib/traceevent/plugin_kvm.c | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) commit f87ce7c43f36d4abff91b19edadd23939f99ff98 Author: Tzvetomir Stoyanov Date: Fri Nov 30 23:08:11 2018 -0500 tools lib traceevent: Changed return logic of tep_register_event_handler() API In order to make libtraceevent into a proper library, its API should be straightforward. The tep_register_event_handler() functions returns -1 in case it successfully registers the new event handler. Such return code is used by the other library APIs in case of an error. To unify the return logic of tep_register_event_handler() with the other APIs, this patch introduces enum tep_reg_handler, which is used by this function as return value, to handle all possible successful return cases. Signed-off-by: Tzvetomir Stoyanov Cc: Andrew Morton Cc: Jiri Olsa Cc: Namhyung Kim Link: http://lkml.kernel.org/r/20181201040852.628034497@goodmis.org Signed-off-by: Steven Rostedt (VMware) Signed-off-by: Arnaldo Carvalho de Melo tools/lib/traceevent/event-parse.c | 10 ++++++++-- tools/lib/traceevent/event-parse.h | 5 +++++ 2 files changed, 13 insertions(+), 2 deletions(-) commit 6d2d6fd7e3ee0daf0d8308741792b3ec41aafd0c Author: Tzvetomir Stoyanov Date: Fri Nov 30 23:08:10 2018 -0500 tools lib traceevent: Changed return logic of trace_seq_printf() and trace_seq_vprintf() APIs In order to make libtraceevent into a proper library, its API should be straightforward. The trace_seq_printf() and trace_seq_vprintf() APIs have inconsistent returned values with the other trace_seq_* APIs. This path changes the return logic of trace_seq_printf() and trace_seq_vprintf() to return the number of printed characters, as the other trace_seq_* related APIs. Signed-off-by: Tzvetomir Stoyanov Cc: Andrew Morton Cc: Jiri Olsa Cc: Namhyung Kim Link: http://lkml.kernel.org/r/20181201040852.485792891@goodmis.org Signed-off-by: Steven Rostedt (VMware) Signed-off-by: Arnaldo Carvalho de Melo tools/lib/traceevent/trace-seq.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) commit 2e4318a287bdf815140462257ab8697f5289a12f Author: Tzvetomir Stoyanov Date: Fri Nov 30 23:08:09 2018 -0500 tools lib traceevent: Rename struct cmdline to struct tep_cmdline In order to make libtraceevent a proper library, variables, data structures and functions should have a unique prefix to prevent name space conflicts. That prefix will be "tep_". This patch renames 'struct cmdline' to 'struct tep_cmdline'. Signed-off-by: Tzvetomir Stoyanov Cc: Andrew Morton Cc: Jiri Olsa Cc: Namhyung Kim Link: http://lkml.kernel.org/r/20181201040852.358871851@goodmis.org Signed-off-by: Steven Rostedt (VMware) Signed-off-by: Arnaldo Carvalho de Melo tools/lib/traceevent/event-parse-local.h | 4 ++-- tools/lib/traceevent/event-parse.c | 36 ++++++++++++++++---------------- tools/lib/traceevent/event-parse.h | 8 +++---- 3 files changed, 24 insertions(+), 24 deletions(-) commit eed14f4b075ec594ac09921b998bf3dd61f5886b Author: Tzvetomir Stoyanov Date: Fri Nov 30 23:08:08 2018 -0500 tools lib traceevent: Initialize host_bigendian at tep_handle allocation This patch initializes the host_bigendian member of the tep_handle structure with the byte order of the current host, when this handler is created - in tep_alloc() API. We need this in order to remove the tep_set_host_bigendian() API. Signed-off-by: Tzvetomir Stoyanov Cc: Andrew Morton Cc: Jiri Olsa Cc: Namhyung Kim Link: http://lkml.kernel.org/r/20181201040852.216292134@goodmis.org Signed-off-by: Steven Rostedt (VMware) Signed-off-by: Arnaldo Carvalho de Melo tools/lib/traceevent/event-parse.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit ca3958b1c0968a6f3105e211355f128ce871e796 Author: Tzvetomir Stoyanov Date: Fri Nov 30 10:44:11 2018 -0500 tools lib traceevent: Introduce new libtracevent API: tep_override_comm() This patch adds a new API of tracevent library: tep_override_comm() It registers a pid / command mapping. If a mapping with the same pid already exists, the entry is updated with the new command. Signed-off-by: Tzvetomir Stoyanov Cc: Andrew Morton Cc: Jiri Olsa Cc: Namhyung Kim Link: http://lkml.kernel.org/r/20181130154648.038915912@goodmis.org Signed-off-by: Steven Rostedt (VMware) Signed-off-by: Arnaldo Carvalho de Melo tools/lib/traceevent/event-parse.c | 69 +++++++++++++++++++++++++++++--------- tools/lib/traceevent/event-parse.h | 1 + 2 files changed, 55 insertions(+), 15 deletions(-) commit 21327c7843e9169d5e2e527713e60e6c9842a56c Author: Florian Fainelli Date: Thu Dec 20 19:43:37 2018 -0800 perf tests: Add a test for the ARM 32-bit [vectors] page perf on ARM requires CONFIG_KUSER_HELPERS to be turned on to allow some independance with respect to the ARM CPU being used. Add a test which tries to locate the [vectors] page, created when CONFIG_KUSER_HELPERS is turned on to help asses the system's health. Signed-off-by: Florian Fainelli Acked-by: Jiri Olsa Cc: Alexander Shishkin Cc: Chris Healy Cc: Greg Kroah-Hartman Cc: Kim Phillips Cc: Lucas Stach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Russell King Cc: Thomas Gleixner Cc: Thomas Richter Link: http://lkml.kernel.org/r/20181221034337.26663-3-f.fainelli@gmail.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/arch/arm/tests/Build | 1 + tools/perf/arch/arm/tests/arch-tests.c | 4 ++++ tools/perf/arch/arm/tests/vectors-page.c | 24 ++++++++++++++++++++++++ tools/perf/tests/tests.h | 5 +++++ 4 files changed, 34 insertions(+) commit 011532379b7c2de6757e129037bdfc8d704bce23 Author: Florian Fainelli Date: Thu Dec 20 19:43:36 2018 -0800 perf tools: Make find_vdso_map() more modular In preparation for checking that the vectors page on the ARM architecture, refactor the find_vdso_map() function to accept finding an arbitrary string and create a dedicated helper function for that under util/find-map.c and update the filename to find-map.c and all references to it: perf-read-vdso.c and util/vdso.c. Signed-off-by: Florian Fainelli Acked-by: Jiri Olsa Cc: Alexander Shishkin Cc: Chris Healy Cc: Greg Kroah-Hartman Cc: Kim Phillips Cc: Lucas Stach Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Russell King Cc: Thomas Gleixner Cc: Thomas Richter Link: http://lkml.kernel.org/r/20181221034337.26663-2-f.fainelli@gmail.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/Makefile.perf | 4 ++-- tools/perf/perf-read-vdso.c | 6 +++--- tools/perf/util/{find-vdso-map.c => find-map.c} | 7 +++---- tools/perf/util/vdso.c | 6 +++--- 4 files changed, 11 insertions(+), 12 deletions(-) commit ac6e022cbfdce215ad545e91d9827060855da3d7 Author: Arnaldo Carvalho de Melo Date: Mon Jan 7 16:54:38 2019 -0300 perf trace: Fix alignment for [continued] lines We were not taking into account the "... [continued]" printed characters, fix it. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-qt20y0acmf8k0bzisce8kw95@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-trace.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 172bf02d564bdb6df8410f64720fa2c68e755d1a Author: Arnaldo Carvalho de Melo Date: Mon Jan 7 16:24:27 2019 -0300 perf trace: Fix ')' placement in "interrupted" syscall lines When we get the sys_enter for a syscall we check if the last one is still waiting for its matching sys_exit, if so we print this: 468.753 ( ): firefox/32382 poll(ufds: 0x7f3988d3dd00, nfds: 7, timeout_msecs: 4294967295) ... 449.575 ( 0.004 ms): Softwar~cThrea/32434 futex(uaddr: 0x7f39a18a9b70, op: WAKE|PRIVATE_FLAG, val: 1) = 0 At some point we'll get that poll sys_exit event and will print a "[continued]" line. While making the sizing of the alignment after the syscall arg list and its result configurable, so that we can mimic strace, which uses a smaller alingment by default, a bug was introduced where the closing parens appeared before the syscall name and its arg list, fix it. Fixes: 4b8a240ed5e0 ("perf trace: Add alignment spaces after the closing parens") Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-oi45i54s59h1w1kmgpzrfuum@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-trace.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) commit 56752b21755aef598709d143684cb363db98a7d2 Author: Guo Ren Date: Tue Jan 8 20:49:24 2019 +0800 irqchip/csky: fixup handle_irq_perbit break irq The handle_irq_perbit function loop every bit in hwirq local variable. handle_irq_perbit(hwirq) { for_everyt_bit_in(hwirq) { handle_domain_irq() ->irq_exit() ->invoke_softirq() ->__do_softirq() ->local_irq_enable() // Here will cause new interrupt. } } When new interrupt coming at local_irq_enable, it will finish another interrupt handler and pull down the interrupt source. But hwirq is the local variable for handle_irq_perbit(), it can't get new interrupt controller pending reg status. So we need update hwirq with pending reg in every loop. Also change write_relax to writel could prevent stw from fast retire. When local_irq is enabled, intc regs is really set-in. Signed-off-by: Guo Ren Cc: Lu Baoquan drivers/irqchip/irq-csky-apb-intc.c | 77 ++++++++++++++++++++----------------- 1 file changed, 42 insertions(+), 35 deletions(-) commit 2a60aa14a9a0333b3eef58150bc1ef654f7321ef Author: Guo Ren Date: Tue Jan 8 20:31:43 2019 +0800 csky: fixup compile error with pte_alloc Commit: 4cf58924951e remove the address argument of pte_alloc without modify csky related code. linux-5.0-rc1 compile failed with csky. Remove the unnecessary address testing in pte_alloc(). Signed-off-by: Guo Ren Cc: Joel Fernandes (Google) Cc: Guenter Roeck Cc: Arnd Bergmann Cc: Linus Torvalds arch/csky/include/asm/pgalloc.h | 43 +++++++++++++++++------------------------ 1 file changed, 18 insertions(+), 25 deletions(-) commit d1fc1176c055c9ec9c6ec4d113a284e0bad9d09a Author: Masahiro Yamada Date: Tue Jan 8 12:08:03 2019 +0900 vfio/pci: set TRACE_INCLUDE_PATH to fix the build error drivers/vfio/pci/vfio_pci_nvlink2.c cannot be compiled for in-tree building. CC drivers/vfio/pci/vfio_pci_nvlink2.o In file included from drivers/vfio/pci/trace.h:102, from drivers/vfio/pci/vfio_pci_nvlink2.c:29: ./include/trace/define_trace.h:89:42: fatal error: ./trace.h: No such file or directory #include TRACE_INCLUDE(TRACE_INCLUDE_FILE) ^ compilation terminated. make[1]: *** [scripts/Makefile.build;277: drivers/vfio/pci/vfio_pci_nvlink2.o] Error 1 To fix the build error, let's tell include/trace/define_trace.h the location of drivers/vfio/pci/trace.h Fixes: 7f92891778df ("vfio_pci: Add NVIDIA GV100GL [Tesla V100 SXM2] subdriver") Reported-by: Laura Abbott Signed-off-by: Masahiro Yamada Reviewed-by: Cornelia Huck Signed-off-by: Alex Williamson drivers/vfio/pci/trace.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d3a28a53630e1ca10f59562ef560e3f70785cb09 Author: Hauke Mehrtens Date: Sun Jan 6 19:50:37 2019 +0100 serial: lantiq: Do not swap register read/writes The ltq_r32() and ltq_w32() macros use the __raw_readl() and __raw_writel() functions which do not swap the value to little endian. On the big endian vrx200 SoC the UART is operated in big endian IO mode, the readl() and write() functions convert the value to little endian first and then the driver does not work any more on this SoC. Currently the vrx200 SoC selects the CONFIG_SWAP_IO_SPACE option, without this option the serial driver would work, but PCI devices do not work any more. This patch makes the driver use the __raw_readl() and __raw_writel() functions which do not swap the endianness. On big endian system it is assumed that the device should be access in big endian IO mode and on a little endian system it would be access in little endian mode. Fixes: 89b8bd2082bb ("serial: lantiq: Use readl/writel instead of ltq_r32/ltq_w32") Signed-off-by: Hauke Mehrtens Acked-by: John Crispin Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/lantiq.c | 36 +++++++++++++++++++----------------- 1 file changed, 19 insertions(+), 17 deletions(-) commit b9fcb0e6b7052b7e2d18fed1d673f8247060c32c Author: David Brown Date: Mon Jan 7 12:15:03 2019 -0700 usb: storage: Remove outdated URL from MAINTAINERS This website hasn't worked for quite some time. Signed-off-by: David Brown Cc: Matt Dharm Signed-off-by: Greg Kroah-Hartman MAINTAINERS | 1 - 1 file changed, 1 deletion(-) commit 96354ad79e2e59f9d620669c8e1ac2452440c260 Author: Guo Ren Date: Tue Jan 8 20:17:49 2019 +0800 csky: fixup CACHEV1 store instruction fast retire For I/O access, 810/807 store instruction fast retire will cause wrong primitive. For example: stw (clear interrupt source) stw (unmask interrupt controller) enable interrupt stw is fast retire instruction. When PC is run at enable interrupt stage, the clear interrupt source hasn't finished. It will cause another wrong irq-enter. So use mb() to prevent above. Signed-off-by: Guo Ren Cc: Lu Baoquan arch/csky/include/asm/io.h | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) commit 64598e8b6fdaf28e37c3530f8b95a9f8ef6af131 Merge: 3bd6e94bec12 03fa483821c0 Author: Ingo Molnar Date: Tue Jan 8 16:31:19 2019 +0100 Merge tag 'perf-core-for-mingo-4.21-20190104' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/core improvements and fixes from Arnaldo Carvalho de Melo: perf annotate: Ivan Krylov: - Pass filename to objdump via execl, fixing usage with filenames with special characters. perf report: Jin Yao: Fix wrong iteration count in --branch-history perf stat: Jin Yao: - Fix endless wait for child process perf test: Arnaldo Carvalho de Melo: - Use a fallback to get the pathname in vfs_getname in tools build: Jiri Olsa: - Allow overriding CFLAGS assignments. Misc: Arnaldo Carvalho de Melo: - Syncronize UAPI headers Mattias Jacobsson: - Remove redundant va_end() in strbuf_addv() Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit b6c770d7c9dc7185b17d53a9d5ca1278c182d6fa Author: Christian Brauner Date: Sun Jan 6 15:05:41 2019 +0100 binderfs: make each binderfs mount a new instance When currently mounting binderfs in the same ipc namespace twice: mount -t binder binder /A mount -t binder binder /B then the binderfs instances mounted on /A and /B will be the same, i.e. they will have the same superblock. This was the first approach that seemed reasonable. However, this leads to some problems and inconsistencies: /* private binderfs instance in same ipc namespace */ There is no way for a user to request a private binderfs instance in the same ipc namespace. This request has been made in a private mail to me by two independent people. /* bind-mounts */ If users want the same binderfs instance to appear in multiple places they can use bind mounts. So there is no value in having a request for a new binderfs mount giving them the same instance. /* unexpected behavior */ It's surprising that request to mount binderfs is not giving the user a new instance like tmpfs, devpts, ramfs, and others do. /* past mistakes */ Other pseudo-filesystems once made the same mistakes of giving back the same superblock when actually requesting a new mount (cf. devpts's deprecated "newinstance" option). We should not make the same mistake. Once we've committed to always giving back the same superblock in the same IPC namespace with the next kernel release we will not be able to make that change so better to do it now. /* kdbusfs */ It was pointed out to me that kdbusfs - which is conceptually closely related to binderfs - also allowed users to get a private kdbusfs instance in the same IPC namespace by making each mount of kdbusfs a separate instance. I think that makes a lot of sense. Signed-off-by: Christian Brauner Signed-off-by: Greg Kroah-Hartman drivers/android/binderfs.c | 41 ++--------------------------------------- 1 file changed, 2 insertions(+), 39 deletions(-) commit 3fdd94acd50d607cf6a971455307e711fd8ee16e Author: Christian Brauner Date: Sun Jan 6 15:05:40 2019 +0100 binderfs: remove wrong kern_mount() call The binderfs filesystem never needs to be mounted by the kernel itself. This is conceptually wrong and should never have been done in the first place. Fixes: 3ad20fe393b ("binder: implement binderfs") Signed-off-by: Christian Brauner Signed-off-by: Greg Kroah-Hartman drivers/android/binderfs.c | 10 ---------- 1 file changed, 10 deletions(-) commit a3869d43c9800cf39496615361c83635fa3e7c82 Author: Corentin Labbe Date: Mon Jan 7 17:22:23 2019 +0000 PCI: amlogic: Fix build failure due to missing gpio header Building the driver when GPIOLIB=n is not selected is causing the following compilation failure: drivers/pci/controller/dwc/pci-meson.c: In function 'meson_pcie_assert_reset': drivers/pci/controller/dwc/pci-meson.c:290:2: error: implicit declaration of function 'gpiod_set_value_cansleep'; did you mean 'gpio_set_value_cansleep'? [-Werror=implicit-function-declaration] gpiod_set_value_cansleep(mp->reset_gpio, 0); ^~~~~~~~~~~~~~~~~~~~~~~~ gpio_set_value_cansleep drivers/pci/controller/dwc/pci-meson.c: In function 'meson_pcie_probe': drivers/pci/controller/dwc/pci-meson.c:540:19: error: implicit declaration of function 'devm_gpiod_get'; did you mean 'devm_gpio_free'? [-Werror=implicit-function-declaration] mp->reset_gpio = devm_gpiod_get(dev, "reset", GPIOD_OUT_LOW); ^~~~~~~~~~~~~~ devm_gpio_free drivers/pci/controller/dwc/pci-meson.c:540:48: error: 'GPIOD_OUT_LOW' undeclared (first use in this function); did you mean 'GPIOF_INIT_LOW'? mp->reset_gpio = devm_gpiod_get(dev, "reset", GPIOD_OUT_LOW); ^~~~~~~~~~~~~ GPIOF_INIT_LOW Add the missing linux/gpio/consumer.h header to fix it. Fixes: 9c0ef6d34fdb ("PCI: amlogic: Add the Amlogic Meson PCIe controller driver") Signed-off-by: Corentin Labbe [lorenzo.pieralisi@arm.com: commit log] Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas drivers/pci/controller/dwc/pci-meson.c | 1 + 1 file changed, 1 insertion(+) commit 735df0ff6ece7b8759a744158f5d246fae4739f4 Author: Greg Kroah-Hartman Date: Fri Dec 21 08:54:40 2018 +0100 Documentation: driver core: remove use of BUS_ATTR We are getting rid of the "raw" BUS_ATTR() macro, so fix up the documentation to not refer to it anymore. Cc: "Rafael J. Wysocki" Signed-off-by: Greg Kroah-Hartman Documentation/driver-model/bus.txt | 8 ++++---- Documentation/filesystems/sysfs.txt | 4 +++- 2 files changed, 7 insertions(+), 5 deletions(-) commit dfd32cad146e3624970eee9329e99d2c6ef751b3 Author: Luis Chamberlain Date: Wed Dec 19 12:30:34 2018 -0800 dma-mapping: remove dma_zalloc_coherent() dma_zalloc_coherent() is no longer needed as it has no users because dma_alloc_coherent() already zeroes out memory for us. The Coccinelle grammar rule that used to check for dma_alloc_coherent() + memset() is modified so that it just tells the user that the memset is not needed anymore. Suggested-by: Christoph Hellwig Signed-off-by: Luis Chamberlain Signed-off-by: Christoph Hellwig include/linux/dma-mapping.h | 9 --------- scripts/coccinelle/api/alloc/alloc_cast.cocci | 8 ++++---- scripts/coccinelle/api/alloc/zalloc-simple.cocci | 11 +---------- 3 files changed, 5 insertions(+), 23 deletions(-) commit 07a85fe14254e01bcf37f4d2e0a13f093378620b Author: Luis Chamberlain Date: Wed Dec 19 12:24:08 2018 -0800 cross-tree: phase out dma_zalloc_coherent() on headers The last few stragglers coccinelle doesn't pick up are on driver specific header files. Phase those out as well as dma_alloc_coherent() zeroes out the memory as well now too. Suggested-by: Christoph Hellwig Signed-off-by: Luis Chamberlain Signed-off-by: Christoph Hellwig drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 2 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h | 2 +- drivers/net/ethernet/marvell/octeontx2/af/common.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) commit 750afb08ca71310fcf0c4e2cb1565c63b8235b60 Author: Luis Chamberlain Date: Fri Jan 4 09:23:09 2019 +0100 cross-tree: phase out dma_zalloc_coherent() We already need to zero out memory for dma_alloc_coherent(), as such using dma_zalloc_coherent() is superflous. Phase it out. This change was generated with the following Coccinelle SmPL patch: @ replace_dma_zalloc_coherent @ expression dev, size, data, handle, flags; @@ -dma_zalloc_coherent(dev, size, handle, flags) +dma_alloc_coherent(dev, size, handle, flags) Suggested-by: Christoph Hellwig Signed-off-by: Luis Chamberlain [hch: re-ran the script on the latest tree] Signed-off-by: Christoph Hellwig arch/mips/lantiq/xway/dma.c | 6 +- arch/powerpc/platforms/pasemi/dma_lib.c | 2 +- arch/powerpc/sysdev/fsl_rmu.c | 7 ++- drivers/ata/sata_fsl.c | 4 +- drivers/atm/he.c | 39 ++++++------- drivers/atm/idt77252.c | 16 ++--- drivers/block/skd_main.c | 4 +- drivers/crypto/amcc/crypto4xx_core.c | 6 +- drivers/crypto/cavium/cpt/cptpf_main.c | 4 +- drivers/crypto/cavium/cpt/cptvf_main.c | 7 ++- drivers/crypto/cavium/nitrox/nitrox_lib.c | 6 +- drivers/crypto/ccp/ccp-dev-v5.c | 6 +- drivers/crypto/hisilicon/sec/sec_algs.c | 4 +- drivers/crypto/hisilicon/sec/sec_drv.c | 15 ++--- drivers/crypto/ixp4xx_crypto.c | 6 +- drivers/crypto/mediatek/mtk-platform.c | 16 ++--- drivers/crypto/qat/qat_common/adf_admin.c | 12 ++-- drivers/crypto/qat/qat_common/qat_algs.c | 24 ++++---- drivers/crypto/qat/qat_common/qat_asym_algs.c | 68 +++++++++++----------- drivers/dma/imx-sdma.c | 8 +-- drivers/dma/mediatek/mtk-hsdma.c | 4 +- drivers/dma/mxs-dma.c | 6 +- drivers/dma/xgene-dma.c | 4 +- drivers/dma/xilinx/xilinx_dma.c | 14 ++--- drivers/dma/xilinx/zynqmp_dma.c | 6 +- drivers/gpu/drm/drm_pci.c | 5 +- drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 4 +- drivers/infiniband/hw/bnxt_re/qplib_res.c | 8 +-- drivers/infiniband/hw/cxgb3/cxio_hal.c | 6 +- drivers/infiniband/hw/cxgb4/qp.c | 5 +- drivers/infiniband/hw/hfi1/init.c | 29 ++++----- drivers/infiniband/hw/hfi1/pio.c | 9 ++- drivers/infiniband/hw/hfi1/sdma.c | 27 +++------ drivers/infiniband/hw/hns/hns_roce_alloc.c | 11 ++-- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 10 ++-- drivers/infiniband/hw/i40iw/i40iw_utils.c | 4 +- drivers/infiniband/hw/mthca/mthca_memfree.c | 5 +- drivers/infiniband/hw/ocrdma/ocrdma_hw.c | 14 ++--- drivers/infiniband/hw/ocrdma/ocrdma_stats.c | 4 +- drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 6 +- drivers/infiniband/hw/qedr/verbs.c | 4 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c | 4 +- drivers/input/touchscreen/raspberrypi-ts.c | 4 +- drivers/iommu/mtk_iommu_v1.c | 5 +- drivers/media/pci/intel/ipu3/ipu3-cio2.c | 4 +- .../media/platform/mtk-vcodec/mtk_vcodec_util.c | 2 +- drivers/misc/genwqe/card_utils.c | 4 +- drivers/mmc/host/sdhci.c | 5 +- drivers/net/ethernet/aeroflex/greth.c | 12 ++-- drivers/net/ethernet/alacritech/slicoss.c | 12 ++-- drivers/net/ethernet/amazon/ena/ena_com.c | 61 +++++++++---------- drivers/net/ethernet/apm/xgene-v2/main.c | 8 +-- drivers/net/ethernet/atheros/alx/main.c | 7 +-- drivers/net/ethernet/atheros/atl1c/atl1c_main.c | 4 +- drivers/net/ethernet/broadcom/bcm63xx_enet.c | 8 +-- drivers/net/ethernet/broadcom/bcmsysport.c | 4 +- drivers/net/ethernet/broadcom/bgmac.c | 12 ++-- drivers/net/ethernet/broadcom/bnx2.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 16 ++--- drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c | 4 +- drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 4 +- drivers/net/ethernet/broadcom/tg3.c | 22 +++---- drivers/net/ethernet/cavium/thunder/nicvf_queues.c | 2 +- drivers/net/ethernet/chelsio/cxgb3/sge.c | 2 +- drivers/net/ethernet/chelsio/cxgb4/sge.c | 2 +- drivers/net/ethernet/chelsio/cxgb4vf/sge.c | 2 +- drivers/net/ethernet/emulex/benet/be_cmds.c | 68 +++++++++++----------- drivers/net/ethernet/emulex/benet/be_ethtool.c | 18 +++--- drivers/net/ethernet/emulex/benet/be_main.c | 18 +++--- drivers/net/ethernet/faraday/ftgmac100.c | 14 ++--- drivers/net/ethernet/faraday/ftmac100.c | 7 +-- drivers/net/ethernet/hisilicon/hix5hd2_gmac.c | 4 +- drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 5 +- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c | 5 +- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_cmd.c | 5 +- .../net/ethernet/huawei/hinic/hinic_hw_api_cmd.c | 16 ++--- drivers/net/ethernet/huawei/hinic/hinic_hw_eqs.c | 8 +-- drivers/net/ethernet/huawei/hinic/hinic_hw_io.c | 6 +- drivers/net/ethernet/huawei/hinic/hinic_hw_qp.c | 10 ++-- drivers/net/ethernet/huawei/hinic/hinic_hw_wq.c | 8 +-- drivers/net/ethernet/ibm/emac/mal.c | 4 +- drivers/net/ethernet/intel/e1000/e1000_ethtool.c | 8 +-- drivers/net/ethernet/intel/e1000e/netdev.c | 4 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 4 +- drivers/net/ethernet/intel/ixgb/ixgb_main.c | 8 +-- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 6 +- drivers/net/ethernet/marvell/pxa168_eth.c | 18 +++--- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 18 +++--- drivers/net/ethernet/mellanox/mlx4/alloc.c | 8 +-- drivers/net/ethernet/mellanox/mlx5/core/alloc.c | 4 +- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 10 ++-- drivers/net/ethernet/myricom/myri10ge/myri10ge.c | 6 +- .../net/ethernet/netronome/nfp/nfp_net_common.c | 12 ++-- drivers/net/ethernet/ni/nixge.c | 12 ++-- .../net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c | 12 ++-- drivers/net/ethernet/pasemi/pasemi_mac.c | 6 +- drivers/net/ethernet/qlogic/qed/qed_cxt.c | 16 ++--- drivers/net/ethernet/qlogic/qlcnic/qlcnic_ctx.c | 28 ++++----- drivers/net/ethernet/qualcomm/emac/emac-mac.c | 2 +- drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 12 ++-- drivers/net/ethernet/sfc/falcon/nic.c | 4 +- drivers/net/ethernet/sfc/nic.c | 4 +- drivers/net/ethernet/sgi/meth.c | 4 +- drivers/net/ethernet/socionext/netsec.c | 4 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 40 +++++-------- drivers/net/ethernet/tundra/tsi108_eth.c | 8 +-- drivers/net/ethernet/xilinx/ll_temac_main.c | 12 ++-- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 12 ++-- drivers/net/fddi/defxx.c | 6 +- drivers/net/fddi/skfp/skfddi.c | 8 +-- drivers/net/vmxnet3/vmxnet3_drv.c | 8 +-- drivers/net/wan/fsl_ucc_hdlc.c | 7 +-- drivers/net/wireless/ath/ath10k/ce.c | 7 +-- drivers/net/wireless/ath/ath10k/mac.c | 8 +-- drivers/net/wireless/ath/ath10k/pci.c | 3 +- drivers/net/wireless/ath/ath10k/wmi.c | 2 +- drivers/net/wireless/ath/wcn36xx/dxe.c | 17 +++--- drivers/net/wireless/ath/wil6210/txrx_edma.c | 8 +-- drivers/net/wireless/broadcom/b43/dma.c | 6 +- drivers/net/wireless/broadcom/b43legacy/dma.c | 6 +- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 16 ++--- drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 39 +++++-------- drivers/net/wireless/ralink/rt2x00/rt2x00mmio.c | 6 +- drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 8 +-- drivers/nvme/host/pci.c | 8 +-- drivers/pci/controller/pcie-iproc-msi.c | 6 +- drivers/pci/switch/switchtec.c | 8 +-- drivers/rapidio/devices/tsi721.c | 22 +++---- drivers/rapidio/devices/tsi721_dma.c | 8 +-- drivers/s390/net/ism_drv.c | 15 +++-- drivers/scsi/3w-sas.c | 5 +- drivers/scsi/a100u2w.c | 8 +-- drivers/scsi/arcmsr/arcmsr_hba.c | 18 ++++-- drivers/scsi/be2iscsi/be_main.c | 4 +- drivers/scsi/be2iscsi/be_mgmt.c | 11 ++-- drivers/scsi/bfa/bfad_bsg.c | 6 +- drivers/scsi/bnx2fc/bnx2fc_hwi.c | 49 ++++++++-------- drivers/scsi/bnx2fc/bnx2fc_tgt.c | 44 +++++++------- drivers/scsi/bnx2i/bnx2i_hwi.c | 8 +-- drivers/scsi/csiostor/csio_wr.c | 4 +- drivers/scsi/lpfc/lpfc_bsg.c | 4 +- drivers/scsi/lpfc/lpfc_init.c | 14 ++--- drivers/scsi/lpfc/lpfc_mbox.c | 6 +- drivers/scsi/lpfc/lpfc_sli.c | 15 +++-- drivers/scsi/megaraid/megaraid_mbox.c | 15 ++--- drivers/scsi/megaraid/megaraid_sas_base.c | 26 ++++----- drivers/scsi/megaraid/megaraid_sas_fusion.c | 5 +- drivers/scsi/mesh.c | 5 +- drivers/scsi/mvumi.c | 9 +-- drivers/scsi/pm8001/pm8001_sas.c | 4 +- drivers/scsi/qedf/qedf_main.c | 29 +++++---- drivers/scsi/qedi/qedi_main.c | 39 ++++++------- drivers/scsi/qla2xxx/qla_attr.c | 4 +- drivers/scsi/qla2xxx/qla_bsg.c | 4 +- drivers/scsi/qla2xxx/qla_gs.c | 14 +++-- drivers/scsi/qla2xxx/qla_init.c | 8 +-- drivers/scsi/qla4xxx/ql4_init.c | 4 +- drivers/scsi/qla4xxx/ql4_mbx.c | 18 +++--- drivers/scsi/qla4xxx/ql4_nx.c | 4 +- drivers/scsi/qla4xxx/ql4_os.c | 10 ++-- drivers/scsi/smartpqi/smartpqi_init.c | 32 +++++----- drivers/soc/fsl/qbman/dpaa_sys.c | 2 +- drivers/spi/spi-pic32-sqi.c | 6 +- drivers/staging/mt7621-eth/mtk_eth_soc.c | 3 +- .../interface/vchiq_arm/vchiq_2835_arm.c | 6 +- drivers/staging/vt6655/device_main.c | 19 ++---- drivers/usb/gadget/udc/bdc/bdc_core.c | 13 ++--- drivers/usb/host/uhci-hcd.c | 6 +- drivers/usb/host/xhci-mem.c | 8 +-- drivers/video/fbdev/da8xx-fb.c | 6 +- include/linux/pci-dma-compat.h | 2 +- sound/aoa/soundbus/i2sbus/core.c | 4 +- sound/sparc/dbri.c | 4 +- 173 files changed, 915 insertions(+), 949 deletions(-) commit f553aa1c13cbc29aaf420349a28fc33ca98440e5 Author: Guo Ren Date: Tue Jan 8 19:52:22 2019 +0800 csky: fixup relocation error with 807 & 860 810 doesn't support jsri instruction and csky-as will leave jsri + nop for relocation. Module-probe need replace them with lrw + jsr. Signed-off-by: Guo Ren Cc: Hui Kai arch/csky/kernel/module.c | 38 ++++++++++++++++++++++---------------- 1 file changed, 22 insertions(+), 16 deletions(-) commit 81d9bdf59092e4755fc4307c93c4589ef0fe2e0f Author: Christian Lamparter Date: Sun Dec 23 01:31:26 2018 +0100 mtd: rawnand: qcom: fix memory corruption that causes panic This patch fixes a memory corruption that occurred in the qcom-nandc driver since it was converted to nand_scan(). On boot, an affected device will panic from a NPE at a weird place: | Unable to handle kernel NULL pointer dereference at virtual address 0 | pgd = (ptrval) | [00000000] *pgd=00000000 | Internal error: Oops: 80000005 [#1] SMP ARM | CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.19.9 #0 | Hardware name: Generic DT based system | PC is at (null) | LR is at nand_block_isbad+0x90/0xa4 | pc : [<00000000>] lr : [] psr: 80000013 | sp : cf839d40 ip : 00000000 fp : cfae9e20 | r10: cf815810 r9 : 00000000 r8 : 00000000 | r7 : 00000000 r6 : 00000000 r5 : 00000001 r4 : cf815810 | r3 : 00000000 r2 : cfae9810 r1 : ffffffff r0 : cf815810 | Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none | Control: 10c5387d Table: 8020406a DAC: 00000051 | Process swapper/0 (pid: 1, stack limit = 0x(ptrval)) | [] (nand_block_isbad) from [] | [] (allocate_partition) from [] | [] (add_mtd_partitions) from [] | [] (parse_mtd_partitions) from [] | [] (mtd_device_parse_register) from [] | [] (qcom_nandc_probe) from [] The problem is that the nand_scan()'s qcom_nand_attach_chip callback is updating the nandc->max_cwperpage from 1 to 4. This causes the sg_init_table of clear_bam_transaction() in the driver's qcom_nandc_block_bad() to memset much more than what was initially allocated by alloc_bam_transaction(). This patch restores the old behavior by reallocating the shared bam transaction alloc_bam_transaction() after the chip was identified, but before mtd_device_parse_register() (which is an alias for mtd_device_register() - see panic) gets called. This fixes the corruption and the driver is working again. Cc: stable@vger.kernel.org Fixes: 6a3cec64f18c ("mtd: rawnand: qcom: convert driver to nand_scan()") Signed-off-by: Christian Lamparter Acked-by: Miquel Raynal Signed-off-by: Boris Brezillon drivers/mtd/nand/raw/qcom_nandc.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) commit 2f66196208c98b3d1b4294edffb2c5a8197be899 Author: Sudeep Holla Date: Mon Jan 7 18:51:53 2019 +0000 cpufreq: check if policy is inactive early in __cpufreq_get() cpuinfo_cur_freq gets current CPU frequency as detected by hardware while scaling_cur_freq last known CPU frequency. Some platforms may not allow checking the CPU frequency of an offline CPU or the associated resources may have been released via cpufreq_exit when the CPU gets offlined, in which case the policy would have been invalidated already. If we attempt to get current frequency from the hardware, it may result in hang or crash. For example on Juno, I see: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000188 [0000000000000188] pgd=0000000000000000 Internal error: Oops: 96000004 [#1] PREEMPT SMP Modules linked in: CPU: 5 PID: 4202 Comm: cat Not tainted 4.20.0-08251-ga0f2c0318a15-dirty #87 Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform pstate: 40000005 (nZcv daif -PAN -UAO) pc : scmi_cpufreq_get_rate+0x34/0xb0 lr : scmi_cpufreq_get_rate+0x34/0xb0 Call trace: scmi_cpufreq_get_rate+0x34/0xb0 __cpufreq_get+0x34/0xc0 show_cpuinfo_cur_freq+0x24/0x78 show+0x40/0x60 sysfs_kf_seq_show+0xc0/0x148 kernfs_seq_show+0x44/0x50 seq_read+0xd4/0x480 kernfs_fop_read+0x15c/0x208 __vfs_read+0x60/0x188 vfs_read+0x94/0x150 ksys_read+0x6c/0xd8 __arm64_sys_read+0x24/0x30 el0_svc_common+0x78/0x100 el0_svc_handler+0x38/0x78 el0_svc+0x8/0xc ---[ end trace 3d1024e58f77f6b2 ]--- So fix the issue by checking if the policy is invalid early in __cpufreq_get before attempting to get the current frequency. Signed-off-by: Sudeep Holla Acked-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki drivers/cpufreq/cpufreq.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) commit 6529870cb0323823f49b3e95d1760383910f96cd Author: Madhavan Srinivasan Date: Sun Dec 9 14:55:36 2018 +0530 powerpc/perf: Update perf_regs structure to include MMCRA On each sample, Monitor Mode Control Register A (MMCRA) content is saved in pt_regs. MMCRA does not have a entry as-is in the pt_regs but instead, MMCRA content is saved in the "dsisr" register of pt_regs. Patch adds another entry to the perf_regs structure to include the "MMCRA" printing which internally maps to the "dsisr" of pt_regs. It also check for the MMCRA availability in the platform and present value accordingly mpe: This was the 2nd patch in a series with commit 333804dc3b7a ("powerpc/perf: Update perf_regs structure to include SIER") but I accidentally only merged the 1st patch, so merge this one now. Signed-off-by: Madhavan Srinivasan Signed-off-by: Michael Ellerman arch/powerpc/include/uapi/asm/perf_regs.h | 1 + arch/powerpc/perf/perf_regs.c | 6 ++++++ tools/arch/powerpc/include/uapi/asm/perf_regs.h | 1 + tools/perf/arch/powerpc/include/perf_regs.h | 3 ++- tools/perf/arch/powerpc/util/perf_regs.c | 1 + 5 files changed, 11 insertions(+), 1 deletion(-) commit 1524f4e47f90b27a3ac84efbdd94c63172246a6f Author: Dan Carpenter Date: Tue Jan 8 10:43:30 2019 +0300 ALSA: cs46xx: Potential NULL dereference in probe The "chip->dsp_spos_instance" can be NULL on some of the ealier error paths in snd_cs46xx_create(). Reported-by: "Yavuz, Tuba" Signed-off-by: Dan Carpenter Cc: Signed-off-by: Takashi Iwai sound/pci/cs46xx/dsp_spos.c | 3 +++ 1 file changed, 3 insertions(+) commit a77d1d196bc63b37d9b4d1b614884669e8e79d32 Author: Tycho Andersen Date: Mon Jan 7 16:16:31 2019 -0700 samples/seccomp: Fix 32-bit build Both the .o and the actual executable need to be built with -m32 in order to link correctly. Reported-by: Ingo Molnar Signed-off-by: Tycho Andersen Reviewed-by: Kees Cook Cc: Borislav Petkov Cc: James Morris Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Fixes: fec7b6690541 ("samples: add an example of seccomp user trap") Link: http://lkml.kernel.org/r/20190107231631.1849-1-tycho@tycho.ws Signed-off-by: Ingo Molnar samples/seccomp/Makefile | 1 + 1 file changed, 1 insertion(+) commit b0407d820b65272fcaa77e0dd1347dc7678d23b8 Author: Gustavo A. R. Silva Date: Mon Jan 7 12:34:31 2019 -0600 hwmon: (occ) Fix potential integer overflow Cast get_unaligned_be32(...) to u64 in order to give the compiler complete information about the proper arithmetic to use and avoid a potential integer overflow. Notice that such function call is used in contexts that expect expressions of type u64 (64 bits, unsigned); and the following expressions are currently being evaluated using 32-bit arithmetic: val = get_unaligned_be32(&power->update_tag) * occ->powr_sample_time_us; val = get_unaligned_be32(&power->vdn.update_tag) * occ->powr_sample_time_us; Addresses-Coverity-ID: 1442357 ("Unintentional integer overflow") Addresses-Coverity-ID: 1442476 ("Unintentional integer overflow") Addresses-Coverity-ID: 1442508 ("Unintentional integer overflow") Fixes: ff692d80b2e2 ("hwmon (occ): Add sensor types and versions") Cc: stable@vger.kernel.org Signed-off-by: Gustavo A. R. Silva Reviewed-by: Eddie James Signed-off-by: Guenter Roeck drivers/hwmon/occ/common.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) commit 977e4899c9b4bea787531b0837af5ed442e3118f Merge: 26d92e951fe0 2dc0f02da14e Author: David S. Miller Date: Mon Jan 7 22:49:35 2019 -0500 Merge ra.kernel.org:/pub/scm/linux/kernel/git/bpf/bpf Daniel Borkmann says: ==================== pull-request: bpf 2019-01-08 The following pull-request contains BPF updates for your *net* tree. The main changes are: 1) Fix BSD'ism in sendmsg(2) to rewrite unspecified IPv6 dst for unconnected UDP sockets with [::1] _after_ cgroup BPF invocation, from Andrey. 2) Follow-up fix to the speculation fix where we need to reject a corner case for sanitation when ptr and scalars are mixed in the same alu op. Also, some unrelated minor doc fixes, from Daniel. 3) Fix BPF kselftest's incorrect uses of create_and_get_cgroup() by not assuming fd of zero value to be the result of an error case, from Stanislav. ==================== Signed-off-by: David S. Miller commit 2dc0f02da14e19f510694f8d8bbcb0f2f63e0646 Merge: a8911d6d5878 80f21ff987eb Author: Alexei Starovoitov Date: Mon Jan 7 15:52:00 2019 -0800 Merge branch 'bpf-doc-updates' Daniel Borkmann says: ==================== Two trivial doc follow-ups to i) remove deprecated kern_version mentioning in the design qa and ii) to mention stand-alone build and license of libbpf. Thanks! ==================== Signed-off-by: Alexei Starovoitov commit 80f21ff987eb377140d27102285f8dd1167b335c Author: Daniel Borkmann Date: Mon Jan 7 22:57:18 2019 +0100 bpf, doc: add note for libbpf's stand-alone build Given this came up couple of times, add a note to libbpf's readme about the semi-automated mirror for a stand-alone build which is officially managed by BPF folks. While at it, also explicitly state the libbpf license in the readme file. Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: Alexei Starovoitov tools/lib/bpf/README.rst | 14 ++++++++++++++ 1 file changed, 14 insertions(+) commit a769fa7208b94f37b6240215dc6970f9d76fc58c Author: Daniel Borkmann Date: Mon Jan 7 22:57:17 2019 +0100 bpf, doc: update design qa to reflect kern_version requirement Update the bpf_design_QA.rst to also reflect recent changes in 6c4fc209fcf9 ("bpf: remove useless version check for prog load"). Suggested-by: Quentin Monnet Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: Alexei Starovoitov Documentation/bpf/bpf_design_QA.rst | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) commit 2bb7babaae8780dd257abeb354c70cc176fd9dfa Author: Tony Lindgren Date: Mon Jan 7 13:42:40 2019 -0800 ARM: dts: Remove unnecessary idle flags for omap5 uart3 Looks like I accidentally left some extra flags for uart3 to not idle it. This happened as I generated the data from a running system where these flags are set dynamically on boot by omap_hwmod_setup_earlycon_flags() if earlycon is enabled. We can just remove them. Fixes: 4c387984618f ("ARM: dts: omap5: Add l4 interconnect hierarchy and ti-sysc data") Signed-off-by: Tony Lindgren arch/arm/boot/dts/omap5-l4.dtsi | 2 -- 1 file changed, 2 deletions(-) commit c64a2b0516a02361d8deb1f038647c29020d0852 Author: Souptick Joarder Date: Sat Jan 5 01:00:29 2019 +0530 ceph: use vmf_error() in ceph_filemap_fault() This code is converted to use vmf_error(). Signed-off-by: Souptick Joarder Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov fs/ceph/addr.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) commit 02b2f549d502b46e68b97ea1452fb8853b3327dd Author: Dongsheng Yang Date: Tue Dec 18 04:31:48 2018 -0500 libceph: allow setting abort_on_full for rbd Introduce a new option abort_on_full, default to false. Then we can get -ENOSPC when the pool is full, or reaches quota. [ Don't show abort_on_full in /proc/mounts. ] Signed-off-by: Dongsheng Yang Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov fs/ceph/super.c | 4 ++-- include/linux/ceph/libceph.h | 6 ++++-- include/linux/ceph/osd_client.h | 1 - net/ceph/ceph_common.c | 11 ++++++++++- net/ceph/debugfs.c | 2 +- net/ceph/osd_client.c | 4 ++-- 6 files changed, 19 insertions(+), 9 deletions(-) commit 565dc8a4f55e491935bfb04866068d21784ea9a4 Author: Alban Bedel Date: Mon Jan 7 20:45:15 2019 +0100 MIPS: ath79: Enable OF serial ports in the default config CONFIG_SERIAL_OF_PLATFORM is needed to get a working console on the OF boards, enable it in the default config to get a working setup out of the box. Signed-off-by: Alban Bedel Signed-off-by: Paul Burton Cc: linux-mips@vger.kernel.org Cc: Ralf Baechle Cc: James Hogan Cc: linux-kernel@vger.kernel.org arch/mips/configs/ath79_defconfig | 1 + 1 file changed, 1 insertion(+) commit 390d1b461eec4b15aed78df0ce72a5c4bc40d619 Author: Hauke Mehrtens Date: Sun Jan 6 19:44:12 2019 +0100 MIPS: lantiq: Use CP0_LEGACY_COMPARE_IRQ Instead of using the lantiq specific MIPS_CPU_TIMER_IRQ use the generic CP0_LEGACY_COMPARE_IRQ constant for the timer interrupt number. MIPS_CPU_TIMER_IRQ was already defined to 7 for both supported SoC families. Signed-off-by: Hauke Mehrtens Signed-off-by: Paul Burton Cc: jhogan@kernel.org Cc: ralf@linux-mips.org Cc: john@phrozen.org Cc: linux-mips@linux-mips.org Cc: linux-mips@vger.kernel.org arch/mips/include/asm/mach-lantiq/falcon/falcon_irq.h | 2 -- arch/mips/include/asm/mach-lantiq/xway/lantiq_irq.h | 2 -- arch/mips/lantiq/irq.c | 9 +-------- 3 files changed, 1 insertion(+), 12 deletions(-) commit 2b4dba55b04b212a7fd1f0395b41d79ee3a9801b Author: Hauke Mehrtens Date: Sun Jan 6 19:44:11 2019 +0100 MIPS: lantiq: Fix IPI interrupt handling This makes SMP on the vrx200 work again, by removing all the MIPS CPU interrupt specific code and making it fully use the generic MIPS CPU interrupt controller. The mti,cpu-interrupt-controller from irq-mips-cpu.c now handles the CPU interrupts and also the IPI interrupts which are used to communication between the CPUs in a SMP system. The generic interrupt code was already used before but the interrupt vectors were overwritten again when we called set_vi_handler() in the lantiq interrupt driver and we also provided our own plat_irq_dispatch() function which overwrote the weak generic implementation. Now the code uses the generic handler for the MIPS CPU interrupts including the IPI interrupts and registers a handler for the CPU interrupts which are handled by the lantiq ICU with irq_set_chained_handler() which was already called before. Calling the set_c0_status() function is also not needed any more because the generic MIPS CPU interrupt already activates the needed bits. Fixes: 1eed40043579 ("MIPS: smp-mt: Use CPU interrupt controller IPI IRQ domain support") Cc: stable@kernel.org # v4.12 Signed-off-by: Hauke Mehrtens Signed-off-by: Paul Burton Cc: jhogan@kernel.org Cc: ralf@linux-mips.org Cc: john@phrozen.org Cc: linux-mips@linux-mips.org Cc: linux-mips@vger.kernel.org arch/mips/lantiq/irq.c | 68 ++++---------------------------------------------- 1 file changed, 5 insertions(+), 63 deletions(-) commit a8911d6d5878587767a78c6bde371298ca2a3be3 Author: Stanislav Fomichev Date: Mon Jan 7 09:46:46 2019 -0800 selftests/bpf: fix incorrect users of create_and_get_cgroup We have some tests that assume create_and_get_cgroup returns -1 on error which is incorrect (it returns 0 on error). Since fd might be zero in general case, change create_and_get_cgroup to return -1 on error and fix the users that assume 0 on error. Fixes: f269099a7e7a ("tools/bpf: add a selftest for bpf_get_current_cgroup_id() helper") Fixes: 7d2c6cfc5411 ("bpf: use --cgroup in test_suite if supplied") v2: - instead of fixing the uses that assume -1 on error, convert the users that assume 0 on error (fd might be zero in general case) Signed-off-by: Stanislav Fomichev Signed-off-by: Alexei Starovoitov samples/bpf/test_cgrp2_attach2.c | 14 +++++++------- samples/bpf/test_current_task_under_cgroup_user.c | 2 +- tools/testing/selftests/bpf/cgroup_helpers.c | 6 +++--- tools/testing/selftests/bpf/test_cgroup_storage.c | 2 +- tools/testing/selftests/bpf/test_dev_cgroup.c | 2 +- tools/testing/selftests/bpf/test_netcnt.c | 2 +- tools/testing/selftests/bpf/test_skb_cgroup_id_user.c | 2 +- tools/testing/selftests/bpf/test_sock.c | 2 +- tools/testing/selftests/bpf/test_sock_addr.c | 2 +- tools/testing/selftests/bpf/test_socket_cookie.c | 2 +- tools/testing/selftests/bpf/test_tcpbpf_user.c | 2 +- tools/testing/selftests/bpf/test_tcpnotify_user.c | 2 +- 12 files changed, 20 insertions(+), 20 deletions(-) commit a9666c1cae8dbcd1a9aacd08a778bf2a28eea300 Author: Leon Romanovsky Date: Mon Dec 24 11:05:16 2018 +0200 RDMA/nldev: Don't expose unsafe global rkey to regular user Unsafe global rkey is considered dangerous because it exposes memory registered for all memory in the system. Only users with a QP on the same PD can use the rkey, and generally those QPs will already know the value. However, out of caution, do not expose the value to unprivleged users on the local system. Require CAP_NET_ADMIN instead. Cc: # 4.16 Fixes: 29cf1351d450 ("RDMA/nldev: provide detailed PD information") Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/core/nldev.c | 4 ---- 1 file changed, 4 deletions(-) commit 26d92e951fe0a44ee4aec157cabb65a818cc8151 Author: Cong Wang Date: Sat Jan 5 23:45:26 2019 -0800 smc: move unhash as early as possible in smc_release() In smc_release() we release smc->clcsock before unhash the smc sock, but a parallel smc_diag_dump() may be still reading smc->clcsock, therefore this could cause a use-after-free as reported by syzbot. Reported-and-tested-by: syzbot+fbd1e5476e4c94c7b34e@syzkaller.appspotmail.com Fixes: 51f1de79ad8e ("net/smc: replace sock_put worker by socket refcounting") Cc: Ursula Braun Signed-off-by: Cong Wang Reported-by: syzbot+0bf2e01269f1274b4b03@syzkaller.appspotmail.com Reported-by: syzbot+e3132895630f957306bc@syzkaller.appspotmail.com Signed-off-by: David S. Miller net/smc/af_smc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 7acf8b36a2ac6eb4fdc53c4d862570089e56c69e Author: Jason Gunthorpe Date: Mon Jan 7 17:54:14 2019 +0000 phy: ti: Fix compilation failures without REGMAP This driver requires regmap or the compile fails: drivers/phy/ti/phy-gmii-sel.c:43:27: error: array type has incomplete element type ‘struct reg_field’ const struct reg_field (*regfields)[PHY_GMII_SEL_LAST]; Add it to kconfig. Signed-off-by: Jason Gunthorpe Signed-off-by: David S. Miller drivers/phy/ti/Kconfig | 1 + 1 file changed, 1 insertion(+) commit f687ccea10d23a9b0faed67ceac535b76604669a Author: Gal Pressman Date: Mon Jan 7 13:36:56 2019 +0200 RDMA/uverbs: Fix post send success return value in case of error If get QP object fails 'ret' must be assigned with a proper error code. Fixes: 9a0738575f26 ("RDMA/uverbs: Use uverbs_response() for remaining response copying") Signed-off-by: Gal Pressman Signed-off-by: Jason Gunthorpe drivers/infiniband/core/uverbs_cmd.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit ef4a55b9197a8f844ea0663138e902dcce3e2f36 Author: Tony Lindgren Date: Mon Jan 7 09:52:43 2019 -0800 ARM: dts: omap4-droid4: Fix typo in cpcap IRQ flags We're now getting the following error: genirq: Setting trigger mode 1 for irq 230 failed (regmap_irq_set_type+0x0/0x15c) cpcap-usb-phy cpcap-usb-phy.0: could not get irq dp: -524 Cc: Sebastian Reichel Reported-by: Pavel Machek Tested-by: Pavel Machek Signed-off-by: Tony Lindgren arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 44fabd8cdaaa3acb80ad2bb3b5c61ae2136af661 Author: Kangjie Lu Date: Tue Dec 25 20:29:48 2018 -0600 ASoC: atom: fix a missing check of snd_pcm_lib_malloc_pages snd_pcm_lib_malloc_pages() may fail, so let's check its status and return its error code upstream. Signed-off-by: Kangjie Lu Acked-by: Pierre-Louis Bossart Signed-off-by: Mark Brown Cc: stable@vger.kernel.org sound/soc/intel/atom/sst-mfld-platform-pcm.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 6b68835b5af4feb2a3f31592a52a1a68d7c1b1f3 Author: Qian Cai Date: Mon Jan 7 16:42:07 2019 +0000 ACPI/IORT: Fix build when CONFIG_IOMMU_API=n Commit 8097e53eaba2 ("ACPI/IORT: Use helper functions to access dev->iommu_fwspec") changed by mistake the iort_fwspec_iommu_ops() stub definition (compiled in when CONFIG_IOMMU_API=n), that caused the following compilation failure: drivers/acpi/arm64/iort.c:880:1: error: expected identifier or '(' before '{' token { return NULL; } ^ drivers/acpi/arm64/iort.c:879:39: warning: 'iort_fwspec_iommu_ops' used but never defined static inline const struct iommu_ops *iort_fwspec_iommu_ops(struct device *dev); ^~~~~~~~~~~~~~~~~~~~~ Fix it. Fixes: 8097e53eaba2 ("ACPI/IORT: Use helper functions to access dev->iommu_fwspec") Signed-off-by: Qian Cai [lorenzo.pieralisi@arm.com: updated tags and log] Signed-off-by: Lorenzo Pieralisi Acked-by: Hanjun Guo Cc: Will Deacon Cc: Sudeep Holla Cc: Catalin Marinas Cc: Joerg Roedel Signed-off-by: Will Deacon drivers/acpi/arm64/iort.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4c84edc11b76590859b1e45dd676074c59602dc4 Author: JianJhen Chen Date: Sun Jan 6 11:28:13 2019 +0800 net: bridge: fix a bug on using a neighbour cache entry without checking its state When handling DNAT'ed packets on a bridge device, the neighbour cache entry from lookup was used without checking its state. It means that a cache entry in the NUD_STALE state will be used directly instead of entering the NUD_DELAY state to confirm the reachability of the neighbor. This problem becomes worse after commit 2724680bceee ("neigh: Keep neighbour cache entries if number of them is small enough."), since all neighbour cache entries in the NUD_STALE state will be kept in the neighbour table as long as the number of cache entries does not exceed the value specified in gc_thresh1. This commit validates the state of a neighbour cache entry before using the entry. Signed-off-by: JianJhen Chen Reviewed-by: JinLin Chen Signed-off-by: David S. Miller net/bridge/br_netfilter_hooks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 667e9334fa64da2273e36ce131b05ac9e47c5769 Author: b-ak Date: Mon Jan 7 22:30:22 2019 +0530 ASoC: tlv320aic32x4: Kernel OOPS while entering DAPM standby mode During the bootup of the kernel, the DAPM bias level is in the OFF state. As soon as the DAPM framework kicks in it pushes the codec into STANDBY state. The probe function doesn't prepare the clock, and STANDBY state does a clk_disable_unprepare() without checking the previous state. This leads to an OOPS. Not transitioning from an OFF state to the STANDBY state fixes the problem. Signed-off-by: b-ak Signed-off-by: Mark Brown Cc: stable@vger.kernel.org sound/soc/codecs/tlv320aic32x4.c | 4 ++++ 1 file changed, 4 insertions(+) commit 801009424e05cf110f016d7fac7fcf20ef94941a Merge: 2cffc9569050 5aeb1b36cedd Author: Palmer Dabbelt Date: Mon Jan 7 08:45:47 2019 -0800 Fix a handful of audit-related issue This is sort of a mix between a new feature and a bug fix. I've managed to screw up merging this patch set a handful of times but I think it's OK this time around. The main new feature here is audit support for RISC-V, with some fixes to audit-related bugs that cropped up along the way: * The addition of NR_syscalls into unistd.h, which is necessary for CONFIG_FTRACE_SYSCALLS. * The definition of CREATE_TRACE_POINTS so __tracepoint_sys_{enter,exit} get defined. * A fix for trace_sys_exit() so we can enable CONFIG_HAVE_SYSCALL_TRACEPOINTS. commit f87d8ad9233f115db92c6c087d58403b0009ed36 Author: Gustavo A. R. Silva Date: Sat Jan 5 10:52:23 2019 -0600 tipc: fix memory leak in tipc_nl_compat_publ_dump There is a memory leak in case genlmsg_put fails. Fix this by freeing *args* before return. Addresses-Coverity-ID: 1476406 ("Resource leak") Fixes: 46273cf7e009 ("tipc: fix a missing check of genlmsg_put") Signed-off-by: Gustavo A. R. Silva Acked-by: Ying Xue Signed-off-by: David S. Miller net/tipc/netlink_compat.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit a29c3c09bad18ac2c91dfdbcc892a7a37e407227 Author: Bjørn Mork Date: Sat Jan 5 14:32:39 2019 +0100 cdc_ether: trivial whitespace readability fix This function is unreadable enough without indenting mismatches and unnecessary line breaks. Signed-off-by: Bjørn Mork Signed-off-by: David S. Miller drivers/net/usb/cdc_ether.c | 26 +++++++++++--------------- 1 file changed, 11 insertions(+), 15 deletions(-) commit 3483254b89438e60f719937376c5e0ce2bc46761 Author: Jack Stocker Date: Thu Jan 3 21:56:53 2019 +0000 USB: Add USB_QUIRK_DELAY_CTRL_MSG quirk for Corsair K70 RGB To match the Corsair Strafe RGB, the Corsair K70 RGB also requires USB_QUIRK_DELAY_CTRL_MSG to completely resolve boot connection issues discussed here: https://github.com/ckb-next/ckb-next/issues/42. Otherwise roughly 1 in 10 boots the keyboard will fail to be detected. Patch that applied delay control quirk for Corsair Strafe RGB: cb88a0588717 ("usb: quirks: add control message delay for 1b1c:1b20") Previous K70 RGB patch to add delay-init quirk: 7a1646d92257 ("Add delay-init quirk for Corsair K70 RGB keyboards") Signed-off-by: Jack Stocker Cc: stable Signed-off-by: Greg Kroah-Hartman drivers/usb/core/quirks.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit ff2a8c532c14fd22fb26a36574d9ff199afbbe54 Author: Saranya Gopal Date: Sun Jan 6 08:14:02 2019 +0530 usbcore: Select only first configuration for non-UAC3 compliant devices In most of the UAC1 and UAC2 audio devices, the first configuration is most often the best configuration. However, with recent patch to support UAC3 configuration, second configuration was unintentionally chosen for some of the UAC1/2 devices that had more than one configuration. This was because of the existing check after the audio config check which selected any config which had a non-vendor class. This patch fixes this issue. Fixes: f13912d3f014 ("usbcore: Select UAC3 configuration for audio if present") Reported-by: Con Kolivas Signed-off-by: Saranya Gopal Tested-by: Con Kolivas Cc: stable Signed-off-by: Greg Kroah-Hartman drivers/usb/core/generic.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 0a99cc4b8ee83885ab9f097a3737d1ab28455ac0 Author: Icenowy Zheng Date: Thu Jan 3 11:26:18 2019 +0800 USB: storage: add quirk for SMI SM3350 The SMI SM3350 USB-UFS bridge controller cannot handle long sense request correctly and will make the chip refuse to do read/write when requested long sense. Add a bad sense quirk for it. Signed-off-by: Icenowy Zheng Cc: stable Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman drivers/usb/storage/unusual_devs.h | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit c5603d2fdb424849360fe7e3f8c1befc97571b8c Author: Icenowy Zheng Date: Thu Jan 3 11:26:17 2019 +0800 USB: storage: don't insert sane sense for SPC3+ when bad sense specified Currently the code will set US_FL_SANE_SENSE flag unconditionally if device claims SPC3+, however we should allow US_FL_BAD_SENSE flag to prevent this behavior, because SMI SM3350 UFS-USB bridge controller, which claims SPC4, will show strange behavior with 96-byte sense (put the chip into a wrong state that cannot read/write anything). Check the presence of US_FL_BAD_SENSE when assuming US_FL_SANE_SENSE on SPC4+ devices. Signed-off-by: Icenowy Zheng Cc: stable Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman drivers/usb/storage/scsiglue.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 34aabf918717dd14e05051896aaecd3b16b53d95 Author: Daniele Palmas Date: Fri Dec 28 16:15:41 2018 +0100 usb: cdc-acm: send ZLP for Telit 3G Intel based modems Telit 3G Intel based modems require zero packet to be sent if out data size is equal to the endpoint max packet size. Signed-off-by: Daniele Palmas Cc: stable Signed-off-by: Greg Kroah-Hartman drivers/usb/class/cdc-acm.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 5aeb1b36cedd3a1dfdbfe368629fed52dee34103 Author: David Abdurachmanov Date: Thu Dec 6 16:26:35 2018 +0100 riscv: add HAVE_SYSCALL_TRACEPOINTS to Kconfig I looked into Documentation/trace/ftrace-design.rst and, I think, we check all the boxes needed for HAVE_SYSCALL_TRACEPOINTS. Signed-off-by: David Abdurachmanov Signed-off-by: Palmer Dabbelt arch/riscv/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 775800b0f1d7303d4fd8ce0e0d9eca4ff2f338f2 Author: David Abdurachmanov Date: Thu Dec 6 16:26:34 2018 +0100 riscv: fix trace_sys_exit hook Fix compilation error. Signed-off-by: David Abdurachmanov Signed-off-by: Palmer Dabbelt arch/riscv/kernel/ptrace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 008e901b70282183b52ee80d838d2994b2610231 Author: David Abdurachmanov Date: Mon Dec 10 21:43:55 2018 +0100 riscv: define CREATE_TRACE_POINTS in ptrace.c Define CREATE_TRACE_POINTS in order to create functions and structures for the trace events. This is needed if HAVE_SYSCALL_TRACEPOINTS and CONFIG_FTRACE_SYSCALLS are enabled, otherwise we get linking errors: [..] MODPOST vmlinux.o kernel/trace/trace_syscalls.o: In function `.L0 ': trace_syscalls.c:(.text+0x1152): undefined reference to `__tracepoint_sys_enter' trace_syscalls.c:(.text+0x126c): undefined reference to `__tracepoint_sys_enter' trace_syscalls.c:(.text+0x1328): undefined reference to `__tracepoint_sys_enter' trace_syscalls.c:(.text+0x14aa): undefined reference to `__tracepoint_sys_enter' trace_syscalls.c:(.text+0x1684): undefined reference to `__tracepoint_sys_exit' trace_syscalls.c:(.text+0x17a0): undefined reference to `__tracepoint_sys_exit' trace_syscalls.c:(.text+0x185c): undefined reference to `__tracepoint_sys_exit' trace_syscalls.c:(.text+0x19de): undefined reference to `__tracepoint_sys_exit' arch/riscv/kernel/ptrace.o: In function `.L0 ': ptrace.c:(.text+0x4dc): undefined reference to `__tracepoint_sys_enter' ptrace.c:(.text+0x632): undefined reference to `__tracepoint_sys_exit' make: *** [Makefile:1036: vmlinux] Error 1 Signed-off-by: David Abdurachmanov Fixes: b78002b395b4 ("riscv: add HAVE_SYSCALL_TRACEPOINTS to Kconfig") Signed-off-by: Palmer Dabbelt arch/riscv/kernel/ptrace.c | 2 ++ 1 file changed, 2 insertions(+) commit 45ef1aa8a0e3b0da449c619035b0841f28abca63 Author: David Abdurachmanov Date: Mon Dec 10 21:43:54 2018 +0100 riscv: define NR_syscalls in unistd.h This macro is used by kernel/trace/{trace.h,trace_syscalls.c} if we have CONFIG_FTRACE_SYSCALLS enabled. Signed-off-by: David Abdurachmanov Fixes: b78002b395b4 ("riscv: add HAVE_SYSCALL_TRACEPOINTS to Kconfig") Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/unistd.h | 2 ++ 1 file changed, 2 insertions(+) commit 0aea89430a4c79c65c541c947497007d33fbe002 Author: David Abdurachmanov Date: Mon Oct 29 11:48:54 2018 +0100 riscv: audit: add audit hook in do_syscall_trace_enter/exit() This patch adds auditing functions on entry to and exit from every system call invocation. Signed-off-by: David Abdurachmanov Signed-off-by: Palmer Dabbelt arch/riscv/kernel/ptrace.c | 5 +++++ 1 file changed, 5 insertions(+) commit efe75c494f57890900caf6c8a0667db35bfaf56a Author: David Abdurachmanov Date: Mon Oct 29 11:48:53 2018 +0100 riscv: add audit support On RISC-V (riscv) audit is supported through generic lib/audit.c. The patch adds required arch specific definitions. Signed-off-by: David Abdurachmanov Signed-off-by: Palmer Dabbelt arch/riscv/Kconfig | 1 + arch/riscv/include/asm/ptrace.h | 5 +++++ arch/riscv/include/asm/syscall.h | 10 ++++++++++ arch/riscv/include/asm/thread_info.h | 6 ++++++ arch/riscv/kernel/entry.S | 4 ++-- include/uapi/linux/audit.h | 2 ++ 6 files changed, 26 insertions(+), 2 deletions(-) commit 2cffc9569050a8dbc0c4a6ee7186c0919487c3ec Author: Zong Li Date: Fri Dec 7 17:02:16 2018 +0800 RISC-V: Support MODULE_SECTIONS mechanism on RV32 This patch supports dynamic generate got and plt sections mechanism on rv32. It contains the modification as follows: - Always enable MODULE_SECTIONS (both rv64 and rv32) - Change the fixed size type. This patch had been tested by following modules: btrfs 6795991 0 - Live 0xa544b000 test_static_keys 17304 0 - Live 0xa28be000 zstd_compress 1198986 1 btrfs, Live 0xa2a25000 zstd_decompress 608112 1 btrfs, Live 0xa24e7000 lzo 8787 0 - Live 0xa2049000 xor 27461 1 btrfs, Live 0xa2041000 zram 78849 0 - Live 0xa2276000 netdevsim 55909 0 - Live 0xa202d000 tun 211534 0 - Live 0xa21b5000 fuse 566049 0 - Live 0xa25fb000 nfs_layout_flexfiles 192597 0 - Live 0xa229b000 ramoops 74895 0 - Live 0xa2019000 xfs 3973221 0 - Live 0xa507f000 libcrc32c 3053 2 btrfs,xfs, Live 0xa34af000 lzo_compress 17302 2 btrfs,lzo, Live 0xa347d000 lzo_decompress 7178 2 btrfs,lzo, Live 0xa3451000 raid6_pq 142086 1 btrfs, Live 0xa33a4000 reed_solomon 31022 1 ramoops, Live 0xa31eb000 test_bitmap 3734 0 - Live 0xa31af000 test_bpf 1588736 0 - Live 0xa2c11000 test_kmod 41161 0 - Live 0xa29f8000 test_module 1356 0 - Live 0xa299e000 test_printf 6024 0 [permanent], Live 0xa2971000 test_static_key_base 5797 1 test_static_keys, Live 0xa2931000 test_user_copy 4382 0 - Live 0xa28c9000 xxhash 70501 2 zstd_compress,zstd_decompress, Live 0xa2055000 Signed-off-by: Zong Li Signed-off-by: Palmer Dabbelt arch/riscv/Kconfig | 2 +- arch/riscv/include/asm/module.h | 28 +++++++++++++++------------- arch/riscv/kernel/module-sections.c | 30 ++++++++++++++++-------------- 3 files changed, 32 insertions(+), 28 deletions(-) commit 3b56adcf94d03533666e87e41d23ac91756cec9b Author: Paul Walmsley Date: Mon Dec 17 16:09:59 2018 -0800 MAINTAINERS: SiFive drivers: add myself as a SiFive driver maintainer I'll be helping Palmer review drivers for SiFive-specific IP blocks, so add myself to the MAINTAINERS file. Cc: Albert Ou Cc: Palmer Dabbelt Cc: linux-kernel@vger.kernel.org Cc: linux-riscv@lists.infradead.org Signed-off-by: Paul Walmsley Signed-off-by: Paul Walmsley Signed-off-by: Palmer Dabbelt MAINTAINERS | 1 + 1 file changed, 1 insertion(+) commit af5f462c2d9ed227ffca4c8d02eb38679c9b8846 Author: Paul Walmsley Date: Mon Dec 17 16:09:58 2018 -0800 MAINTAINERS: SiFive drivers: change the git tree to a SiFive git tree Update the git tree URL for drivers for SiFive-related IP blocks to point to a SiFive-managed URL. Cc: Albert Ou Cc: Palmer Dabbelt Cc: linux-kernel@vger.kernel.org Cc: linux-riscv@lists.infradead.org Signed-off-by: Paul Walmsley Signed-off-by: Paul Walmsley Signed-off-by: Palmer Dabbelt MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 37a107ff6dcd773da4dc75b62b9bf4349dd7300f Author: Andreas Schwab Date: Tue Dec 11 11:20:40 2018 +0100 riscv: don't stop itself in smp_send_stop Add IPI_CPU_STOP message and use it in smp_send_stop to stop other cpus, but not itself. Mark cpu offline on reception of IPI_CPU_STOP. Signed-off-by: Andreas Schwab Reviewed-by: Atish Patra Signed-off-by: Palmer Dabbelt arch/riscv/kernel/smp.c | 43 ++++++++++++++++++++++++++++++++++++------- 1 file changed, 36 insertions(+), 7 deletions(-) commit 8fd6e05c7463b635e51ec7df0a1858c1b5a6e350 Author: Paul Walmsley Date: Mon Dec 17 19:15:12 2018 -0800 arch: riscv: support kernel command line forcing when no DTB passed CONFIG_CMDLINE_FORCE doesn't work on RISC-V when no DTB is passed into the kernel. This is because the code that forces the kernel command line only runs if a valid DTB is present at boot. During debugging, it's useful to have the ability to force kernel command lines even when no DTB is present. This patch adds support for doing so. Cc: Palmer Dabbelt Cc: Albert Ou Cc: linux-riscv@lists.infradead.org Cc: linux-kernel@vger.kernel.org (open list) Signed-off-by: Paul Walmsley Signed-off-by: Paul Walmsley Signed-off-by: Palmer Dabbelt arch/riscv/kernel/setup.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit 8443e4843e1c2594bf5664e1d993a1be71d1befb Author: Aaro Koskinen Date: Sun Dec 23 20:24:13 2018 +0200 ARM: OMAP: dts: N950/N9: fix onenand timings Commit a758f50f10cf ("mtd: onenand: omap2: Configure driver from DT") started using DT specified timings for GPMC, and as a result the OneNAND stopped working on N950/N9 as we had wrong values in the DT. Fix by updating the values to bootloader timings that have been tested to be working on both Nokia N950 and N9. Fixes: a758f50f10cf ("mtd: onenand: omap2: Configure driver from DT") Signed-off-by: Aaro Koskinen Signed-off-by: Tony Lindgren arch/arm/boot/dts/omap3-n950-n9.dtsi | 42 ++++++++++++++++++++++++------------ 1 file changed, 28 insertions(+), 14 deletions(-) commit d0df00e30e4bf9bc27ddbd092ad683ff6121b360 Author: Aurelien Jarno Date: Tue Dec 25 15:46:24 2018 +0100 tools uapi: fix RISC-V 64-bit support The BPF library is not built on 64-bit RISC-V, as the BPF feature is not detected. Looking more in details, feature/test-bpf.c fails to build with the following error: | In file included from /tmp/linux-4.19.12/tools/include/uapi/asm/bitsperlong.h:17, | from /tmp/linux-4.19.12/tools/include/uapi/asm-generic/unistd.h:2, | from /usr/include/riscv64-linux-gnu/asm/unistd.h:1, | from test-bpf.c:2: | /tmp/linux-4.19.12/tools/include/asm-generic/bitsperlong.h:14:2: error: #error Inconsistent word size. Check asm/bitsperlong.h | #error Inconsistent word size. Check asm/bitsperlong.h | ^~~~~ The UAPI from the tools directory is missing RISC-V support, therefore bitsperlong.h from asm-generic is used, defaulting to 32 bits. Fix that by adding tools/arch/riscv/include/uapi/asm/bitsperlong.h as a copy of arch/riscv/include/uapi/asm/bitsperlong.h and by updating tools/include/uapi/asm/bitsperlong.h. Signed-off-by: Aurelien Jarno Signed-off-by: Palmer Dabbelt tools/arch/riscv/include/uapi/asm/bitsperlong.h | 25 +++++++++++++++++++++++++ tools/include/uapi/asm/bitsperlong.h | 2 ++ 2 files changed, 27 insertions(+) commit 22e6a2e14cb8ebcae059488cf24e778e4058c2bf Author: Anup Patel Date: Wed Dec 19 18:06:57 2018 +0530 RISC-V: Make BSS section as the last section in vmlinux.lds.S The objcopy only emits loadable sections when creating flat kernel Image. To have minimal possible size of flat kernel Image, we should have all non-loadable sections after loadable sections. Currently, execption table section (loadable section) is after BSS section (non-loadable section) in the RISC-V vmlinux.lds.S. This is not optimal for having minimal flat kernel Image size hence this patch makes BSS section as the last section in RISC-V vmlinux.lds.S. In addition, we make BSS section aligned to 16byte instead of PAGE aligned which further reduces flat kernel Image size by few KBs. The flat kernel Image size of Linux-4.20-rc4 using GCC 8.2.0 is 8819980 bytes with current RISC-V vmlinux.lds.S and it reduces to 7991740 bytes with this patch applied. In summary, this patch reduces Linux-4.20-rc4 flat kernel Image size by 809 KB. Signed-off-by: Anup Patel Reviewed-by: Bin Meng Signed-off-by: Palmer Dabbelt arch/riscv/kernel/vmlinux.lds.S | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit d0c2d2101b4c1a41e6ebeca6a28c70df43d2a6a3 Author: Kunihiko Hayashi Date: Fri Nov 9 10:42:07 2018 +0900 reset: uniphier-glue: Add AHCI reset control support in glue layer Add a reset line included in AHCI glue layer to enable AHCI core implemented in UniPhier SoCs. Signed-off-by: Kunihiko Hayashi Signed-off-by: Philipp Zabel drivers/reset/reset-uniphier-glue.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit 69af3d1b8a91cf9b426c4238964df847036bf214 Author: Kunihiko Hayashi Date: Fri Nov 9 10:42:06 2018 +0900 dt-bindings: reset: uniphier: Add AHCI core reset description Add compatible strings for reset control of AHCI core implemented in UniPhier SoCs. The reset control belongs to AHCI glue layer. Signed-off-by: Kunihiko Hayashi Reviewed-by: Rob Herring Signed-off-by: Philipp Zabel Documentation/devicetree/bindings/reset/uniphier-reset.txt | 3 +++ 1 file changed, 3 insertions(+) commit 3eb8f765f5aeca6e4195246f41e534025f69eee8 Author: Kunihiko Hayashi Date: Fri Nov 9 10:42:05 2018 +0900 reset: uniphier-usb3: Rename to reset-uniphier-glue This driver works for controlling the reset lines including USB3 glue layer, however, this can be applied to other glue layers. Now this patch renames the driver from "reset-uniphier-usb3" to "reset-uniphier-glue". At the same time, this changes CONFIG_RESET_UNIPHIER_USB3 to CONFIG_RESET_UNIPHIER_GLUE. Signed-off-by: Kunihiko Hayashi Signed-off-by: Philipp Zabel drivers/reset/Kconfig | 10 +++--- drivers/reset/Makefile | 2 +- ...reset-uniphier-usb3.c => reset-uniphier-glue.c} | 38 +++++++++++----------- 3 files changed, 25 insertions(+), 25 deletions(-) commit 21b22136b4330abd1467e59fbe651ae4d18f0357 Author: Kunihiko Hayashi Date: Fri Nov 9 10:42:04 2018 +0900 dt-bindings: reset: uniphier: Replace the expression of USB3 with generic peripherals Replace the expression of "USB3 glue layer" with the glue layer of the generic peripherals to allow other devices to use it. The reset control belongs to this glue layer. Signed-off-by: Kunihiko Hayashi Reviewed-by: Rob Herring Signed-off-by: Philipp Zabel .../devicetree/bindings/reset/uniphier-reset.txt | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) commit a277105b239bdcb6490ec51366413643dbc8ed4a Author: Dinh Nguyen Date: Mon Nov 5 14:05:49 2018 -0600 ARM: socfpga: dts: document "altr,stratix10-rst-mgr" binding "altr,stratix10-rst-mgr" is used for the Stratix10 reset manager. Signed-off-by: Dinh Nguyen Signed-off-by: Philipp Zabel Documentation/devicetree/bindings/reset/socfpga-reset.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit b3ca9888f35fa6919569cf27c929dc0ac49e9716 Author: Dinh Nguyen Date: Tue Nov 13 12:50:48 2018 -0600 reset: socfpga: add an early reset driver for SoCFPGA Create a separate reset driver that uses the reset operations in reset-simple. The reset driver for the SoCFPGA platform needs to register early in order to be able bring online timers that needed early in the kernel bootup. We do not need this early reset driver for Stratix10, because on arm64, Linux does not need the timers are that in reset. Linux is able to run just fine with the internal armv8 timer. Thus, we use a new binding "altr,stratix10-rst-mgr" for the Stratix10 platform. The Stratix10 platform will continue to use the reset-simple platform driver, while the 32-bit platforms(Cyclone5/Arria5/Arria10) will use the early reset driver. Signed-off-by: Dinh Nguyen [p.zabel@pengutronix.de: fixed socfpga of_device_id in reset-simple] Signed-off-by: Philipp Zabel arch/arm/mach-socfpga/socfpga.c | 4 ++ drivers/reset/Kconfig | 10 ++++- drivers/reset/Makefile | 1 + drivers/reset/reset-simple.c | 13 ++---- drivers/reset/reset-socfpga.c | 88 +++++++++++++++++++++++++++++++++++++++++ 5 files changed, 105 insertions(+), 11 deletions(-) commit 151f72f493f2605ebbed0198362eed05918ed839 Author: Colin Ian King Date: Wed Nov 14 21:49:35 2018 +0000 reset: fix null pointer dereference on dev by dev_name The call to dev_name will dereference dev, however, dev is later being null checked, so there is a possibility of a null pointer dereference on dev by the call to dev_name. Fix this by null checking dev first before the call to dev_name Detected by CoverityScan, CID#1475475 ("Dereference before null check") Fixes: 2a6cb2b1d83b ("reset: Add reset_control_get_count()") Signed-off-by: Colin Ian King Signed-off-by: Philipp Zabel drivers/reset/core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit eaf91db0ab22dc2c664a9782f2f31dcbc410f3b5 Author: Geert Uytterhoeven Date: Tue Nov 13 13:47:44 2018 +0100 reset: Add reset_control_get_count() Currently the reset core has internal support for counting the number of resets for a device described in DT. Generalize this to devices using lookup resets, and export it for public use. This will be used by generic drivers that need to be sure a device is controlled by a single, dedicated reset line (e.g. vfio-platform). Signed-off-by: Geert Uytterhoeven [p.zabel@pengutronix.de: fixed a typo in reset_control_get_count comment] Signed-off-by: Philipp Zabel drivers/reset/core.c | 41 +++++++++++++++++++++++++++++++++++++++++ include/linux/reset.h | 7 +++++++ 2 files changed, 48 insertions(+) commit 12c62b9d6ce57d37f3c03cc902c30498909fbc42 Author: Geert Uytterhoeven Date: Mon Oct 8 13:15:43 2018 +0200 reset: Improve reset controller kernel docs Grammar and indentation fixes. Signed-off-by: Geert Uytterhoeven [p.zabel@pengutronix.de: dropped "shared among" -> "shared between"] Signed-off-by: Philipp Zabel include/linux/reset.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 42f03ab3c75197e8fec2dbd6b50bc699619aab9b Author: Eugeniy Paltsev Date: Wed Oct 17 17:05:52 2018 +0300 ARC: HSDK: improve reset driver As for today HSDK reset driver implements only .reset() callback. In case of driver which implements one of standard reset controller usage pattern (call *_deassert() in probe(), call *_assert() in remove()) that leads to inoperability of this reset driver. Improve HSDK reset driver by calling .reset() callback inside of .deassert() callback to avoid each reset controller user adaptation for work with both reset methods (reset() and {.assert() & .deassert()} pair) Signed-off-by: Eugeniy Paltsev Signed-off-by: Philipp Zabel drivers/reset/reset-hsdk.c | 1 + 1 file changed, 1 insertion(+) commit b81c2c33eab79dfd3650293b2227ee5c6036585c Author: Max Schulze Date: Mon Jan 7 08:31:49 2019 +0100 USB: serial: simple: add Motorola Tetra TPG2200 device id Add new Motorola Tetra device id for Motorola Solutions TETRA PEI device T: Bus=02 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 4 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=0cad ProdID=9016 Rev=24.16 S: Manufacturer=Motorola Solutions, Inc. S: Product=TETRA PEI interface C: #Ifs= 2 Cfg#= 1 Atr=80 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=usb_serial_simple I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=usb_serial_simple Signed-off-by: Max Schulze Cc: stable Signed-off-by: Johan Hovold drivers/usb/serial/usb-serial-simple.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit eeb2c4fb6a3d0ebed35fbc13a255f691c8b8d7e5 Author: Jacob Wen Date: Mon Jan 7 09:59:59 2019 +0800 rds: use DIV_ROUND_UP instead of ceil Yes indeed, DIV_ROUND_UP is in kernel.h. Signed-off-by: Jacob Wen Signed-off-by: David S. Miller net/rds/ib_send.c | 4 ++-- net/rds/message.c | 4 ++-- net/rds/rds.h | 4 ---- net/rds/send.c | 2 +- 4 files changed, 5 insertions(+), 9 deletions(-) commit 10262b0b53666cbc506989b17a3ead1e9c3b43b4 Author: Heiner Kallweit Date: Sun Jan 6 20:44:00 2019 +0100 r8169: don't try to read counters if chip is in a PCI power-save state Avoid log spam caused by trying to read counters from the chip whilst it is in a PCI power-save state. Reference: https://bugzilla.kernel.org/show_bug.cgi?id=107421 Fixes: 1ef7286e7f36 ("r8169: Dereference MMIO address immediately before use") Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller drivers/net/ethernet/realtek/r8169.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 7775665aadc48a562051834a73519129bf717d73 Author: Larry Finger Date: Wed Jan 2 20:12:47 2019 -0600 staging: rtl8188eu: Fix module loading from tasklet for WEP encryption Commit 2b2ea09e74a5 ("staging:r8188eu: Use lib80211 to decrypt WEP-frames") causes scheduling while atomic bugs followed by a hard freeze whenever the driver tries to connect to a WEP-encrypted network. Experimentation showed that the freezes were eliminated when module lib80211 was preloaded, which can be forced by calling lib80211_get_crypto_ops() directly rather than indirectly through try_then_request_module(). With this change, no BUG messages are logged. Fixes: 2b2ea09e74a5 ("staging:r8188eu: Use lib80211 to decrypt WEP-frames") Cc: Stable # v4.17+ Cc: Michael Straube Cc: Ivan Safonov Signed-off-by: Larry Finger Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8188eu/core/rtw_security.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 84cad97a717f5749a0236abd5ce68da582ea074f Author: Larry Finger Date: Wed Jan 2 20:12:46 2019 -0600 staging: rtl8188eu: Fix module loading from tasklet for CCMP encryption Commit 6bd082af7e36 ("staging:r8188eu: use lib80211 CCMP decrypt") causes scheduling while atomic bugs followed by a hard freeze whenever the driver tries to connect to a CCMP-encrypted network. Experimentation showed that the freezes were eliminated when module lib80211 was preloaded, which can be forced by calling lib80211_get_crypto_ops() directly rather than indirectly through try_then_request_module(). With this change, no BUG messages are logged. Fixes: 6bd082af7e36 ("staging:r8188eu: use lib80211 CCMP decrypt") Cc: Stable # v4.17+ Reported-and-tested-by: Michael Straube Cc: Ivan Safonov Signed-off-by: Larry Finger Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8188eu/core/rtw_security.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8a5aaf97cc4876a9b61cb3b7c07128d4569ac536 Author: Guo Ren Date: Fri Jan 4 11:17:33 2019 +0800 Documentation/features: Add csky kernel features core/ cBPF-JIT : TODO | core/ eBPF-JIT : TODO | core/ generic-idle-thread : ok | core/ jump-labels : TODO | core/ tracehook : ok | debug/ KASAN : TODO | debug/ gcov-profile-all : TODO | debug/ kgdb : TODO | debug/ kprobes-on-ftrace : TODO | debug/ kprobes : TODO | debug/ kretprobes : TODO | debug/ optprobes : TODO | debug/ stackprotector : TODO | debug/ uprobes : TODO | debug/ user-ret-profiler : TODO | io/ dma-contiguous : ok | locking/ cmpxchg-local : TODO | locking/ lockdep : TODO | locking/ queued-rwlocks : ok | locking/ queued-spinlocks : TODO | locking/ rwsem-optimized : TODO | perf/ kprobes-event : TODO | perf/ perf-regs : TODO | perf/ perf-stackdump : TODO | sched/ membarrier-sync-core : TODO | sched/ numa-balancing : .. | seccomp/ seccomp-filter : TODO | time/ arch-tick-broadcast : TODO | time/ clockevents : ok | time/ context-tracking : TODO | time/ irq-time-acct : TODO | time/ modern-timekeeping : ok | time/ virt-cpuacct : TODO | vm/ ELF-ASLR : TODO | vm/ PG_uncached : TODO | vm/ THP : .. | vm/ batch-unmap-tlb-flush: TODO | vm/ huge-vmap : TODO | vm/ ioremap_prot : TODO | vm/ numa-memblock : .. | vm/ pte_special : TODO | Signed-off-by: Guo Ren Cc: Arnd Bergmann Documentation/features/core/cBPF-JIT/arch-support.txt | 1 + Documentation/features/core/eBPF-JIT/arch-support.txt | 1 + Documentation/features/core/generic-idle-thread/arch-support.txt | 1 + Documentation/features/core/jump-labels/arch-support.txt | 1 + Documentation/features/core/tracehook/arch-support.txt | 1 + Documentation/features/debug/KASAN/arch-support.txt | 1 + Documentation/features/debug/gcov-profile-all/arch-support.txt | 1 + Documentation/features/debug/kgdb/arch-support.txt | 1 + Documentation/features/debug/kprobes-on-ftrace/arch-support.txt | 1 + Documentation/features/debug/kprobes/arch-support.txt | 1 + Documentation/features/debug/kretprobes/arch-support.txt | 1 + Documentation/features/debug/optprobes/arch-support.txt | 1 + Documentation/features/debug/stackprotector/arch-support.txt | 1 + Documentation/features/debug/uprobes/arch-support.txt | 1 + Documentation/features/debug/user-ret-profiler/arch-support.txt | 1 + Documentation/features/io/dma-contiguous/arch-support.txt | 1 + Documentation/features/locking/cmpxchg-local/arch-support.txt | 1 + Documentation/features/locking/lockdep/arch-support.txt | 1 + Documentation/features/locking/queued-rwlocks/arch-support.txt | 1 + Documentation/features/locking/queued-spinlocks/arch-support.txt | 1 + Documentation/features/locking/rwsem-optimized/arch-support.txt | 1 + Documentation/features/perf/kprobes-event/arch-support.txt | 1 + Documentation/features/perf/perf-regs/arch-support.txt | 1 + Documentation/features/perf/perf-stackdump/arch-support.txt | 1 + Documentation/features/sched/membarrier-sync-core/arch-support.txt | 1 + Documentation/features/sched/numa-balancing/arch-support.txt | 1 + Documentation/features/seccomp/seccomp-filter/arch-support.txt | 1 + Documentation/features/time/arch-tick-broadcast/arch-support.txt | 1 + Documentation/features/time/clockevents/arch-support.txt | 1 + Documentation/features/time/context-tracking/arch-support.txt | 1 + Documentation/features/time/irq-time-acct/arch-support.txt | 1 + Documentation/features/time/modern-timekeeping/arch-support.txt | 1 + Documentation/features/time/virt-cpuacct/arch-support.txt | 1 + Documentation/features/vm/ELF-ASLR/arch-support.txt | 1 + Documentation/features/vm/PG_uncached/arch-support.txt | 1 + Documentation/features/vm/THP/arch-support.txt | 1 + Documentation/features/vm/TLB/arch-support.txt | 1 + Documentation/features/vm/huge-vmap/arch-support.txt | 1 + Documentation/features/vm/ioremap_prot/arch-support.txt | 1 + Documentation/features/vm/numa-memblock/arch-support.txt | 1 + Documentation/features/vm/pte_special/arch-support.txt | 1 + 41 files changed, 41 insertions(+) commit a64597227d0de5610407fcc95dc835745a53f5d0 Author: Biju Das Date: Wed Dec 12 12:17:11 2018 +0000 soc: renesas: r8a774c0-sysc: Fix initialization order of 3DG-{A,B} The workaround for the wrong hierarchy of the 3DG-{A,B} power domains on RZ/G2E ES1.0 corrected the parent domains. However, the 3DG-{A,B} power domains were still initialized and powered in the wrong order, causing 3DG operation to fail. Fix this by changing the order in the table at runtime, when running on an affected SoC. This work is based on the work done by Geert for R-Car E3. Fixes: f37d211c687588328 ("soc: renesas: rcar-sysc: Add r8a774c0 support") Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Signed-off-by: Simon Horman drivers/soc/renesas/r8a774c0-sysc.c | 23 ++++------------------- 1 file changed, 4 insertions(+), 19 deletions(-) commit 0fac32f24ceadad801ef1f4de468f1d5186c808d Author: Christophe JAILLET Date: Sat Dec 29 01:05:40 2018 +0100 i3c: master: Fix an error checking typo in 'cdns_i3c_master_probe()' Fix a cut'n'paste typo. Checking 'master->sysclk' is expected here. Fixes: 603f2bee2c54 ("i3c: master: Add driver for Cadence IP") Signed-off-by: Christophe JAILLET Signed-off-by: Boris Brezillon drivers/i3c/master/i3c-master-cdns.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 0aaa81377c5a01f686bcdb8c7a6929a7bf330c68 Author: Oliver Hartkopp Date: Fri Jan 4 15:55:26 2019 +0100 can: gw: ensure DLC boundaries after CAN frame modification Muyu Yu provided a POC where user root with CAP_NET_ADMIN can create a CAN frame modification rule that makes the data length code a higher value than the available CAN frame data size. In combination with a configured checksum calculation where the result is stored relatively to the end of the data (e.g. cgw_csum_xor_rel) the tail of the skb (e.g. frag_list pointer in skb_shared_info) can be rewritten which finally can cause a system crash. Michael Kubecek suggested to drop frames that have a DLC exceeding the available space after the modification process and provided a patch that can handle CAN FD frames too. Within this patch we also limit the length for the checksum calculations to the maximum of Classic CAN data length (8). CAN frames that are dropped by these additional checks are counted with the CGW_DELETED counter which indicates misconfigurations in can-gw rules. This fixes CVE-2019-3701. Reported-by: Muyu Yu Reported-by: Marcus Meissner Suggested-by: Michal Kubecek Tested-by: Muyu Yu Tested-by: Oliver Hartkopp Signed-off-by: Oliver Hartkopp Cc: linux-stable # >= v3.2 Signed-off-by: Marc Kleine-Budde Signed-off-by: David S. Miller net/can/gw.c | 30 +++++++++++++++++++++++++++--- 1 file changed, 27 insertions(+), 3 deletions(-) commit 01cd364a15f42575ef4aac8f82ff05516ea5da9a Author: Stephen Warren Date: Thu Jan 3 10:23:24 2019 -0700 net/mlx4: replace pci_{,un}map_sg with dma_{,un}map_sg pci_{,un}map_sg are deprecated and replaced by dma_{,un}map_sg. This is especially relevant since the rest of the driver uses the DMA API. Fix the driver to use the replacement APIs. Signed-off-by: Stephen Warren Reviewed-by: Tariq Toukan Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx4/icm.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) commit f65e192af35058e5c82da9e90871b472d24912bc Author: Stephen Warren Date: Thu Jan 3 10:23:23 2019 -0700 net/mlx4: Get rid of page operation after dma_alloc_coherent This patch solves a crash at the time of mlx4 driver unload or system shutdown. The crash occurs because dma_alloc_coherent() returns one value in mlx4_alloc_icm_coherent(), but a different value is passed to dma_free_coherent() in mlx4_free_icm_coherent(). In turn this is because when allocated, that pointer is passed to sg_set_buf() to record it, then when freed it is re-calculated by calling lowmem_page_address(sg_page()) which returns a different value. Solve this by recording the value that dma_alloc_coherent() returns, and passing this to dma_free_coherent(). This patch is roughly equivalent to commit 378efe798ecf ("RDMA/hns: Get rid of page operation after dma_alloc_coherent"). Based-on-code-from: Christoph Hellwig Signed-off-by: Stephen Warren Reviewed-by: Tariq Toukan Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx4/icm.c | 92 +++++++++++++++++++------------- drivers/net/ethernet/mellanox/mlx4/icm.h | 22 ++++++-- 2 files changed, 75 insertions(+), 39 deletions(-) commit 2b6f0090a3335b7bdd03ca520c35591159463041 Author: Boris Brezillon Date: Wed Jan 2 15:36:54 2019 +0100 mtd: Check add_mtd_device() ret code add_mtd_device() can fail. We should always check its return value and gracefully handle the failure case. Fix the call sites where this not done (in mtdpart.c) and add a __must_check attribute to the prototype to avoid this kind of mistakes. Signed-off-by: Boris Brezillon drivers/mtd/mtdcore.h | 2 +- drivers/mtd/mtdpart.c | 36 +++++++++++++++++++++++++++++++----- 2 files changed, 32 insertions(+), 6 deletions(-) commit 19e16fb4f319b84b3220e98abf726218beba8c34 Author: Boris Brezillon Date: Wed Jan 2 15:36:53 2019 +0100 mtd: Fix the check on nvmem_register() ret code Commit 20167b70c894 ("nvmem: use EOPNOTSUPP instead of ENOSYS") changed the nvmem_register() ret code from ENOSYS to EOPNOTSUPP when CONFIG_NVMEM is not enabled, but the check in mtd_nvmem_add() was not adjusted accordingly. Cc: Bartosz Golaszewski Cc: Alban Bedel Fixes: c4dfa25ab307 ("mtd: add support for reading MTD devices via the nvmem API") Reported-by: kernel test robot Signed-off-by: Boris Brezillon Reviewed-by: Bartosz Golaszewski Signed-off-by: Boris Brezillon drivers/mtd/mtdcore.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1cd824361eed0f3621e32df1be15159c91f137d9 Merge: bfeffd155283 74d4b4e0f43e Author: Mark Brown Date: Mon Jan 7 12:42:14 2019 +0000 Merge branch 'regmap-4.21' into regmap-5.0 commit 8070ba6348608aa1da15eb83dbaa9ece596aaa67 Author: Arnd Bergmann Date: Mon Dec 10 22:00:23 2018 +0100 ARM: shmobile: fix build regressions A number of Kconfig options have become available now to random ARM platforms outside of ARCH_MULTIPLATFORM, which now causes Kconfig warnings, and other build errors when those select options that lack additional dependencies, e.g.: WARNING: unmet direct dependencies detected for HAVE_ARM_ARCH_TIMER Depends on [n]: CPU_V7 [=n] Selected by [y]: - ARCH_RCAR_GEN2 [=y] && SOC_RENESAS [=y] - ARCH_R8A73A4 [=y] && SOC_RENESAS [=y] && ARM [=y] WARNING: unmet direct dependencies detected for SYS_SUPPORTS_EM_STI Depends on [n]: GENERIC_CLOCKEVENTS [=n] Selected by [y]: - ARCH_EMEV2 [=y] && SOC_RENESAS [=y] && ARM [=y] Put the old dependency on ARCH_RENESAS back for the moment to restore the previous behavior. Fixes: 062887bf5ef7 ("ARM: shmobile: Move SoC Kconfig symbols to drivers/soc/renesas/") Signed-off-by: Arnd Bergmann Acked-by: Geert Uytterhoeven Signed-off-by: Simon Horman drivers/soc/renesas/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2b531d71595d2b5b12782a49b23c335869e2621e Author: Hans de Goede Date: Fri Jan 4 23:10:54 2019 +0100 ACPI / PMIC: xpower: Fix TS-pin current-source handling The current-source used for the battery temp-sensor (TS) is shared with the GPADC. For proper fuel-gauge and charger operation the TS current-source needs to be permanently on. But to read the GPADC we need to temporary switch the TS current-source to ondemand, so that the GPADC can use it, otherwise we will always read an all 0 value. The switching from on to on-ondemand is not necessary when the TS current-source is off (this happens on devices which do not have a TS). Prior to this commit there were 2 issues with our handling of the TS current-source switching: 1) We were writing hardcoded values to the ADC TS pin-ctrl register, overwriting various other unrelated bits. Specifically we were overwriting the current-source setting for the TS and GPIO0 pins, forcing it to 80ųA independent of its original setting. On a Chuwi Vi10 tablet this was causing us to get a too high adc value (due to a too high current-source) resulting in acpi_lpat_raw_to_temp() returning -ENOENT, resulting in: ACPI Error: AE_ERROR, Returned by Handler for [UserDefinedRegion] ACPI Error: Method parse/execution failed \_SB.SXP1._TMP, AE_ERROR This commit fixes this by using regmap_update_bits to change only the relevant bits. 2) At the end of intel_xpower_pmic_get_raw_temp() we were unconditionally enabling the TS current-source even on devices where the TS-pin is not used and the current-source thus was off on entry of the function. This commit fixes this by checking if the TS current-source is off when entering intel_xpower_pmic_get_raw_temp() and if so it is left as is. Fixes: 58eefe2f3f53 (ACPI / PMIC: xpower: Do pinswitch ... reading GPADC) Signed-off-by: Hans de Goede Acked-by: Andy Shevchenko Cc: 4.14+ # 4.14+ Signed-off-by: Rafael J. Wysocki drivers/acpi/pmic/intel_pmic_xpower.c | 41 ++++++++++++++++++++++++++++------- 1 file changed, 33 insertions(+), 8 deletions(-) commit c2a7c55a04065c3b0c32d23b099db7ea1dbf6250 Author: Kailang Yang Date: Thu Jan 3 15:53:39 2019 +0800 ALSA: hda/realtek - Support Dell headset mode for New AIO platform Dell has new platform for ALC274. This will support to enable headset mode. Signed-off-by: Kailang Yang Cc: Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) commit 605c0351fa36e857e29d34ebab2719d9c04e95f6 Author: Larry Finger Date: Wed Jan 2 14:02:08 2019 -0600 MAINTAINERS: Add entry for staging driver r8188eu This entry was missed when the driver was added. Signed-off-by: Larry Finger Signed-off-by: Greg Kroah-Hartman MAINTAINERS | 5 +++++ 1 file changed, 5 insertions(+) commit cbb2ebf70daf7f7d97d3811a2ff8e39655b8c184 Author: Hui Peng Date: Tue Dec 25 18:11:52 2018 -0500 ALSA: usb-audio: Fix an out-of-bound read in create_composite_quirks In `create_composite_quirk`, the terminating condition of for loops is `quirk->ifnum < 0`. So any composite quirks should end with `struct snd_usb_audio_quirk` object with ifnum < 0. for (quirk = quirk_comp->data; quirk->ifnum >= 0; ++quirk) { ..... } the data field of Bower's & Wilkins PX headphones usb device device quirks do not end with {.ifnum = -1}, wihch may result in out-of-bound read. This Patch fix the bug by adding an ending quirk object. Fixes: 240a8af929c7 ("ALSA: usb-audio: Add a quirck for B&W PX headphones") Signed-off-by: Hui Peng Cc: Signed-off-by: Takashi Iwai sound/usb/quirks-table.h | 6 ++++++ 1 file changed, 6 insertions(+) commit 3e96d7280f16e2f787307f695a31296b9e4a1cd7 Author: Takashi Iwai Date: Wed Jan 2 17:12:21 2019 +0100 ALSA: usb-audio: Always check descriptor sizes in parser code There are a few places where we access the data without checking the actual object size from the USB audio descriptor. This may result in OOB access, as recently reported. This patch addresses these missing checks. Most of added codes are simple bLength checks in the caller side. For the input and output terminal parsers, we put the length check in the parser functions. For the input terminal, a new argument is added to distinguish between UAC1 and the rest, as they treat different objects. Reported-by: Mathias Payer Reported-by: Hui Peng Tested-by: Hui Peng Cc: Signed-off-by: Takashi Iwai sound/usb/card.c | 2 +- sound/usb/mixer.c | 4 ++++ sound/usb/stream.c | 36 +++++++++++++++++++++++++----------- 3 files changed, 30 insertions(+), 12 deletions(-) commit 0bfe5e434e6665b3590575ec3c5e4f86a1ce51c9 Author: Takashi Iwai Date: Wed Dec 19 14:04:47 2018 +0100 ALSA: usb-audio: Check mixer unit descriptors more strictly We've had some sanity checks of the mixer unit descriptors but they are too loose and some corner cases are overlooked. Add more strict checks in uac_mixer_unit_get_channels() for avoiding possible OOB accesses by malformed descriptors. This also changes the semantics of uac_mixer_unit_get_channels() slightly. Now it returns zero for the cases where the descriptor lacks of bmControls instead of -EINVAL. Then the caller side skips the mixer creation for such unit while it keeps parsing it. This corresponds to the case like Maya44. Cc: Signed-off-by: Takashi Iwai sound/usb/mixer.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) commit f4351a199cc120ff9d59e06d02e8657d08e6cc46 Author: Takashi Iwai Date: Wed Dec 19 12:36:27 2018 +0100 ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit() The parser for the processing unit reads bNrInPins field before the bLength sanity check, which may lead to an out-of-bound access when a malformed descriptor is given. Fix it by assignment after the bLength check. Cc: Signed-off-by: Takashi Iwai sound/usb/mixer.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) commit 4ab88516b097ac8c23e00e7c3a26fbcd16feeefd Author: Paul Kocialkowski Date: Mon Dec 10 11:14:29 2018 +0100 arm64: dts: allwinner: a64: Fix the video engine compatible When introducing the video-codec node for the video engine, the compatible for the H5 was used instead of the compatible for the A64. Use the right compatible instead. Fixes: d60ce24740d2 ("arm64: dts: allwinner: a64: Add Video Engine node") Signed-off-by: Paul Kocialkowski Signed-off-by: Maxime Ripard arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4fb873c9648e383206e0a91cef9b03aa54066aca Author: Philipp Zabel Date: Mon Nov 5 16:36:07 2018 +0100 drm/imx: ignore plane updates on disabled crtcs This patch fixes backtraces like the following when sending SIGKILL to a process with a currently pending plane update: [drm:ipu_plane_atomic_check] CRTC should be enabled [drm:drm_framebuffer_remove] *ERROR* failed to commit ------------[ cut here ]------------ WARNING: CPU: 3 PID: 63 at drivers/gpu/drm/drm_framebuffer.c:926 drm_framebuffer_remove+0x47c/0x498 atomic remove_fb failed with -22 Signed-off-by: Philipp Zabel drivers/gpu/drm/imx/ipuv3-plane.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 4a22fc534f2f55808c41197cf17d829099032acb Author: Dan Carpenter Date: Fri Jan 4 09:47:25 2019 +0300 watchdog: tqmx86: Fix a couple IS_ERR() vs NULL bugs These functions return NULL on error but we accidentally check for IS_ERR() instead. Fixes: e3c21e088f89 ("watchdog: tqmx86: Add watchdog driver for the IO controller") Signed-off-by: Dan Carpenter Reviewed-by: Andrew Lunn Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/tqmx86_wdt.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 3aa8b8bbc142eeaac89891de584535ceb7fce405 Author: NeilBrown Date: Sun Dec 30 14:21:52 2018 +1100 watchdog: mt7621_wdt/rt2880_wdt: Fix compilation problem These files need #include to compile correctly. Fixes: ac3167257b9f ("headers: separate linux/mod_devicetable.h from linux/platform_device.h") Signed-off-by: NeilBrown Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/mt7621_wdt.c | 1 + drivers/watchdog/rt2880_wdt.c | 1 + 2 files changed, 2 insertions(+) commit 862523297778775a0543110dcbf2ca832782f675 Author: Hans de Goede Date: Wed Nov 28 17:57:56 2018 +0100 gpiolib-acpi: Remove unnecessary WARN_ON from acpi_gpiochip_free_interrupts acpi_gpiochip_alloc_event only continues allocating an event and adding it to the list if gpiochip_request_own_desc does not return an error. So events with an error desc are never placed on the events list and this check is really not necessary. Suggested-by: Andy Shevchenko Signed-off-by: Hans de Goede Acked-by: Mika Westerberg Signed-off-by: Linus Walleij drivers/gpio/gpiolib-acpi.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) commit c9a8a92a9961dcd822015ee406e1a011b772112e Author: Johan Jonker Date: Wed Jan 2 20:35:52 2019 +0100 ARM: dts: rockchip: remove qos_cif1 from rk3188 power-domain While the rk3066 does have 2 camera interfaces, the rk3188 does not, so there also isn't a QoS block for that non-existing interface, so remove it. Fixes: e6e1869f0b71 ("ARM: dts: rockchip: add rk3066/rk3188 power-domains") Signed-off-by: Johan Jonker Signed-off-by: Heiko Stuebner arch/arm/boot/dts/rk3188.dtsi | 1 - 1 file changed, 1 deletion(-) commit de96e9fea7ba56042f105b6fe163447b280eb800 Author: Greg Kroah-Hartman Date: Thu Jan 3 10:23:47 2019 +0100 sysfs: convert BUG_ON to WARN_ON It's rude to crash the system just because the developer did something wrong, as it prevents them from usually even seeing what went wrong. So convert the few BUG_ON() calls that have snuck into the sysfs code over the years to WARN_ON() to make it more "friendly". All of these are able to be recovered from, so it makes no sense to crash. Reported-by: Linus Torvalds Reviewed-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman fs/sysfs/dir.c | 3 ++- fs/sysfs/file.c | 6 ++++-- fs/sysfs/group.c | 3 ++- fs/sysfs/symlink.c | 3 ++- 4 files changed, 10 insertions(+), 5 deletions(-) commit 07bd14ccc3049f9c0147a91a4227a571f981601a Author: Wei Yongjun Date: Wed Dec 26 11:28:24 2018 +0000 hwmon: (lm80) Fix missing unlock on error in set_fan_div() Add the missing unlock before return from function set_fan_div() in the error handling case. Fixes: c9c63915519b ("hwmon: (lm80) fix a missing check of the status of SMBus read") Signed-off-by: Wei Yongjun Signed-off-by: Guenter Roeck drivers/hwmon/lm80.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 9de15c95a63f527c8f7a968cd95e6ec71fc6891d Author: Guenter Roeck Date: Wed Dec 26 13:56:15 2018 -0800 hwmon: (nct6775) Enable IO mapping for NCT6797D and NCT6798D Similar to other recent chips from Nuvoton, IO mapping may be disabled by default. Enable it when instantiating the driver and after resume. Fixes: 0599682b826f ("hwmon: (nct6775) Add support for NCT6798D") Fixes: e41da286a2fd ("hwmon: (nct6775) Add support for NCT6797D") Reported-by: Michael Cook Cc: Michael Cook Signed-off-by: Guenter Roeck drivers/hwmon/nct6775.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 264142bc70ec039e26d8f3b46a717e8037f59ca0 Author: Guenter Roeck Date: Wed Dec 26 07:34:31 2018 -0800 hwmon: (nct6775) Fix chip ID for NCT6798D The chip ID is 0xd42[8-f], not 0xd45[8-f]. Fixes: 0599682b826f ("hwmon: (nct6775) Add support for NCT6798D") Reported-by: Michael Cook Cc: Michael Cook Signed-off-by: Guenter Roeck drivers/hwmon/nct6775.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit b0606fed6eece16a421034eca0bbea9a08b90e91 Author: Matthew Wilcox Date: Wed Jan 2 13:57:03 2019 -0500 XArray: Honour reserved entries in xa_insert xa_insert() should treat reserved entries as occupied, not as available. Also, it should treat requests to insert a NULL pointer as a request to reserve the slot. Add xa_insert_bh() and xa_insert_irq() for completeness. Signed-off-by: Matthew Wilcox Documentation/core-api/xarray.rst | 15 +++--- include/linux/xarray.h | 110 ++++++++++++++++++++++++-------------- lib/test_xarray.c | 8 +-- lib/xarray.c | 41 ++++++++++++++ 4 files changed, 126 insertions(+), 48 deletions(-) commit 76b4e52995654af260f14558e0e07b5b039ae202 Author: Matthew Wilcox Date: Fri Dec 28 23:20:44 2018 -0500 XArray: Permit storing 2-byte-aligned pointers On m68k, statically allocated pointers may only be two-byte aligned. This clashes with the XArray's method for tagging internal pointers. Permit storing these pointers in single slots (ie not in multislots). Signed-off-by: Matthew Wilcox include/linux/xarray.h | 18 +++++++++++++++--- lib/test_xarray.c | 30 ++++++++++++++++++++++++++++++ lib/xarray.c | 22 +++++++++++++--------- 3 files changed, 58 insertions(+), 12 deletions(-) commit 4a31896c5b5a2715ecf4033426aa0a35066d92d6 Author: Matthew Wilcox Date: Mon Dec 17 14:45:36 2018 -0500 XArray: Change xa_for_each iterator There were three problems with this API: 1. It took too many arguments; almost all users wanted to iterate over every element in the array rather than a subset. 2. It required that 'index' be initialised before use, and there's no realistic way to make GCC catch that. 3. 'index' and 'entry' were the opposite way round from every other member of the XArray APIs. So split it into three different APIs: xa_for_each(xa, index, entry) xa_for_each_start(xa, index, entry, start) xa_for_each_marked(xa, index, entry, filter) Signed-off-by: Matthew Wilcox include/linux/xarray.h | 78 +++++++++++++++++++++++++++++++++++++++++--------- lib/test_xarray.c | 11 ++++--- 2 files changed, 70 insertions(+), 19 deletions(-) commit 02669b17a433c242a40f01f14b691c9c9d1f8a13 Author: Matthew Wilcox Date: Wed Dec 5 16:37:03 2018 -0500 XArray: Turn xa_init_flags into a static inline A regular xa_init_flags() put all dynamically-initialised XArrays into the same locking class. That leads to lockdep believing that taking one XArray lock while holding another is a deadlock. It's possible to work around some of these situations with separate locking classes for irq/bh/regular XArrays, and SINGLE_DEPTH_NESTING, but that's ugly, and it doesn't work for all situations (where we have completely unrelated XArrays). Signed-off-by: Matthew Wilcox include/linux/xarray.h | 19 ++++++++++++++++++- lib/xarray.c | 29 ----------------------------- 2 files changed, 18 insertions(+), 30 deletions(-) commit 490fd30f859572ac97a51faa31860869744ba97b Author: Matthew Wilcox Date: Mon Dec 17 17:37:25 2018 -0500 XArray tests: Add RCU locking 0day picked up that I'd forgotten to add locking to this new test. Signed-off-by: Matthew Wilcox lib/test_xarray.c | 2 ++ 1 file changed, 2 insertions(+) commit 3bd6e94bec122a951d462c239b47954cf5f36e33 Author: Masahiro Yamada Date: Mon Jan 7 11:08:08 2019 +0900 arch: restore generic-y += shmparam.h for some architectures For some reasons, I accidentally got rid of "generic-y += shmparam.h" from some architectures. Restore them to fix building c6x, h8300, hexagon, m68k, microblaze, openrisc, and unicore32. Fixes: d6e4b3e326d8 ("arch: remove redundant UAPI generic-y defines") Signed-off-by: Masahiro Yamada Signed-off-by: Linus Torvalds arch/c6x/include/uapi/asm/Kbuild | 1 + arch/h8300/include/uapi/asm/Kbuild | 1 + arch/hexagon/include/uapi/asm/Kbuild | 1 + arch/m68k/include/uapi/asm/Kbuild | 1 + arch/microblaze/include/uapi/asm/Kbuild | 1 + arch/openrisc/include/uapi/asm/Kbuild | 1 + arch/unicore32/include/uapi/asm/Kbuild | 1 + 7 files changed, 7 insertions(+) commit bfeffd155283772bbe78c6a05dec7c0128ee500c Author: Linus Torvalds Date: Sun Jan 6 17:08:20 2019 -0800 Linux 5.0-rc1 Makefile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 85e1ffbd42f664965dc05f6e9851c06379f27fb2 Merge: ac5eed2b4177 d86271af6460 Author: Linus Torvalds Date: Sun Jan 6 16:33:10 2019 -0800 Merge tag 'kbuild-v4.21-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull more Kbuild updates from Masahiro Yamada: - improve boolinit.cocci and use_after_iter.cocci semantic patches - fix alignment for kallsyms - move 'asm goto' compiler test to Kconfig and clean up jump_label CONFIG option - generate asm-generic wrappers automatically if arch does not implement mandatory UAPI headers - remove redundant generic-y defines - misc cleanups * tag 'kbuild-v4.21-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kconfig: rename generated .*conf-cfg to *conf-cfg kbuild: remove unnecessary stubs for archheader and archscripts kbuild: use assignment instead of define ... endef for filechk_* rules arch: remove redundant UAPI generic-y defines kbuild: generate asm-generic wrappers if mandatory headers are missing arch: remove stale comments "UAPI Header export list" riscv: remove redundant kernel-space generic-y kbuild: change filechk to surround the given command with { } kbuild: remove redundant target cleaning on failure kbuild: clean up rule_dtc_dt_yaml kbuild: remove UIMAGE_IN and UIMAGE_OUT jump_label: move 'asm goto' support test to Kconfig kallsyms: lower alignment on ARM scripts: coccinelle: boolinit: drop warnings on named constants scripts: coccinelle: check for redeclaration kconfig: remove unused "file" field of yylval union nds32: remove redundant kernel-space generic-y nios2: remove unneeded HAS_DMA define commit ac5eed2b41776b05cf03aac761d3bb5e64eea24c Merge: 574823bfab82 2573be22e5b6 Author: Linus Torvalds Date: Sun Jan 6 16:30:14 2019 -0800 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf tooling updates form Ingo Molnar: "A final batch of perf tooling changes: mostly fixes and small improvements" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (29 commits) perf session: Add comment for perf_session__register_idle_thread() perf thread-stack: Fix thread stack processing for the idle task perf thread-stack: Allocate an array of thread stacks perf thread-stack: Factor out thread_stack__init() perf thread-stack: Allow for a thread stack array perf thread-stack: Avoid direct reference to the thread's stack perf thread-stack: Tidy thread_stack__bottom() usage perf thread-stack: Simplify some code in thread_stack__process() tools gpio: Allow overriding CFLAGS tools power turbostat: Override CFLAGS assignments and add LDFLAGS to build command tools thermal tmon: Allow overriding CFLAGS assignments tools power x86_energy_perf_policy: Override CFLAGS assignments and add LDFLAGS to build command perf c2c: Increase the HITM ratio limit for displayed cachelines perf c2c: Change the default coalesce setup perf trace beauty ioctl: Beautify USBDEVFS_ commands perf trace beauty: Export function to get the files for a thread perf trace: Wire up ioctl's USBDEBFS_ cmd table generator perf beauty ioctl: Add generator for USBDEVFS_ ioctl commands tools headers uapi: Grab a copy of usbdevice_fs.h perf trace: Store the major number for a file when storing its pathname ... commit 574823bfab82d9d8fa47f422778043fbb4b4f50e Author: Linus Torvalds Date: Sat Jan 5 17:50:59 2019 -0800 Change mincore() to count "mapped" pages rather than "cached" pages The semantics of what "in core" means for the mincore() system call are somewhat unclear, but Linux has always (since 2.3.52, which is when mincore() was initially done) treated it as "page is available in page cache" rather than "page is mapped in the mapping". The problem with that traditional semantic is that it exposes a lot of system cache state that it really probably shouldn't, and that users shouldn't really even care about. So let's try to avoid that information leak by simply changing the semantics to be that mincore() counts actual mapped pages, not pages that might be cheaply mapped if they were faulted (note the "might be" part of the old semantics: being in the cache doesn't actually guarantee that you can access them without IO anyway, since things like network filesystems may have to revalidate the cache before use). In many ways the old semantics were somewhat insane even aside from the information leak issue. From the very beginning (and that beginning is a long time ago: 2.3.52 was released in March 2000, I think), the code had a comment saying Later we can get more picky about what "in core" means precisely. and this is that "later". Admittedly it is much later than is really comfortable. NOTE! This is a real semantic change, and it is for example known to change the output of "fincore", since that program literally does a mmmap without populating it, and then doing "mincore()" on that mapping that doesn't actually have any pages in it. I'm hoping that nobody actually has any workflow that cares, and the info leak is real. We may have to do something different if it turns out that people have valid reasons to want the old semantics, and if we can limit the information leak sanely. Cc: Kevin Easton Cc: Jiri Kosina Cc: Masatake YAMATO Cc: Andrew Morton Cc: Greg KH Cc: Peter Zijlstra Cc: Michal Hocko Signed-off-by: Linus Torvalds mm/mincore.c | 94 +++++++++--------------------------------------------------- 1 file changed, 13 insertions(+), 81 deletions(-) commit 94bd8a05cd4de344a9a57e52ef7d99550251984f Author: Linus Torvalds Date: Sun Jan 6 11:15:04 2019 -0800 Fix 'acccess_ok()' on alpha and SH Commit 594cc251fdd0 ("make 'user_access_begin()' do 'access_ok()'") broke both alpha and SH booting in qemu, as noticed by Guenter Roeck. It turns out that the bug wasn't actually in that commit itself (which would have been surprising: it was mostly a no-op), but in how the addition of access_ok() to the strncpy_from_user() and strnlen_user() functions now triggered the case where those functions would test the access of the very last byte of the user address space. The string functions actually did that user range test before too, but they did it manually by just comparing against user_addr_max(). But with user_access_begin() doing the check (using "access_ok()"), it now exposed problems in the architecture implementations of that function. For example, on alpha, the access_ok() helper macro looked like this: #define __access_ok(addr, size) \ ((get_fs().seg & (addr | size | (addr+size))) == 0) and what it basically tests is of any of the high bits get set (the USER_DS masking value is 0xfffffc0000000000). And that's completely wrong for the "addr+size" check. Because it's off-by-one for the case where we check to the very end of the user address space, which is exactly what the strn*_user() functions do. Why? Because "addr+size" will be exactly the size of the address space, so trying to access the last byte of the user address space will fail the __access_ok() check, even though it shouldn't. As a result, the user string accessor functions failed consistently - because they literally don't know how long the string is going to be, and the max access is going to be that last byte of the user address space. Side note: that alpha macro is buggy for another reason too - it re-uses the arguments twice. And SH has another version of almost the exact same bug: #define __addr_ok(addr) \ ((unsigned long __force)(addr) < current_thread_info()->addr_limit.seg) so far so good: yes, a user address must be below the limit. But then: #define __access_ok(addr, size) \ (__addr_ok((addr) + (size))) is wrong with the exact same off-by-one case: the case when "addr+size" is exactly _equal_ to the limit is actually perfectly fine (think "one byte access at the last address of the user address space") The SH version is actually seriously buggy in another way: it doesn't actually check for overflow, even though it did copy the _comment_ that talks about overflow. So it turns out that both SH and alpha actually have completely buggy implementations of access_ok(), but they happened to work in practice (although the SH overflow one is a serious serious security bug, not that anybody likely cares about SH security). This fixes the problems by using a similar macro on both alpha and SH. It isn't trying to be clever, the end address is based on this logic: unsigned long __ao_end = __ao_a + __ao_b - !!__ao_b; which basically says "add start and length, and then subtract one unless the length was zero". We can't subtract one for a zero length, or we'd just hit an underflow instead. For a lot of access_ok() users the length is a constant, so this isn't actually as expensive as it initially looks. Reported-and-tested-by: Guenter Roeck Cc: Matt Turner Cc: Yoshinori Sato Signed-off-by: Linus Torvalds arch/alpha/include/asm/uaccess.h | 8 +++++--- arch/sh/include/asm/uaccess.h | 7 +++++-- 2 files changed, 10 insertions(+), 5 deletions(-) commit baa6707381285e68cc472efba58e7e736057aacc Merge: 215240462a96 8094c3ceb21a Author: Linus Torvalds Date: Sun Jan 6 12:21:11 2019 -0800 Merge tag 'fscrypt_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/fscrypt Pull fscrypt updates from Ted Ts'o: "Add Adiantum support for fscrypt" * tag 'fscrypt_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/fscrypt: fscrypt: add Adiantum support commit 215240462a9672db771bb60adcc1c4fdf40e8ec4 Merge: e2b745f469ec 191ce17876c9 Author: Linus Torvalds Date: Sun Jan 6 12:19:23 2019 -0800 Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 bug fixes from Ted Ts'o: "Fix a number of ext4 bugs" * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: fix special inode number checks in __ext4_iget() ext4: track writeback errors using the generic tracking infrastructure ext4: use ext4_write_inode() when fsyncing w/o a journal ext4: avoid kernel warning when writing the superblock to a dead device ext4: fix a potential fiemap/page fault deadlock w/ inline_data ext4: make sure enough credits are reserved for dioread_nolock writes commit e2b745f469ec0f3165ba5ffaee3ce40f98d77878 Merge: 12133258d7fe 8270f3a11cee Author: Linus Torvalds Date: Sun Jan 6 11:47:26 2019 -0800 Merge tag 'dma-mapping-4.21-1' of git://git.infradead.org/users/hch/dma-mapping Pull dma-mapping fixes from Christoph Hellwig: "Fix various regressions introduced in this cycles: - fix dma-debug tracking for the map_page / map_single consolidatation - properly stub out DMA mapping symbols for !HAS_DMA builds to avoid link failures - fix AMD Gart direct mappings - setup the dma address for no kernel mappings using the remap allocator" * tag 'dma-mapping-4.21-1' of git://git.infradead.org/users/hch/dma-mapping: dma-direct: fix DMA_ATTR_NO_KERNEL_MAPPING for remapped allocations x86/amd_gart: fix unmapping of non-GART mappings dma-mapping: remove a few unused exports dma-mapping: properly stub out the DMA API for !CONFIG_HAS_DMA dma-mapping: remove dmam_{declare,release}_coherent_memory dma-mapping: implement dmam_alloc_coherent using dmam_alloc_attrs dma-mapping: implement dma_map_single_attrs using dma_map_page_attrs commit 12133258d7fe309b42a35677549c606b15a0822d Merge: 66e012f6188f cdd6a4a0e2ec Author: Linus Torvalds Date: Sun Jan 6 11:40:06 2019 -0800 Merge tag 'tag-chrome-platform-for-v4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/bleung/chrome-platform Pull chrome platform updates from Benson Leung: - Changes for EC_MKBP_EVENT_SENSOR_FIFO handling. - Also, maintainership changes. Olofj out, Enric balletbo in. * tag 'tag-chrome-platform-for-v4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/bleung/chrome-platform: MAINTAINERS: add maintainers for ChromeOS EC sub-drivers MAINTAINERS: platform/chrome: Add Enric as a maintainer MAINTAINERS: platform/chrome: remove myself as maintainer platform/chrome: don't report EC_MKBP_EVENT_SENSOR_FIFO as wakeup platform/chrome: straighten out cros_ec_get_{next,host}_event() error codes commit 66e012f6188fb37b18c774277f34fb52278059c3 Merge: b5aef86e089a 4d5a91fd1f42 Author: Linus Torvalds Date: Sun Jan 6 11:37:44 2019 -0800 Merge tag 'hwlock-v4.21' of git://github.com/andersson/remoteproc Pull hwspinlock updates from Bjorn Andersson: "This adds support for the hardware semaphores found in STM32MP1" * tag 'hwlock-v4.21' of git://github.com/andersson/remoteproc: hwspinlock: fix return value check in stm32_hwspinlock_probe() hwspinlock: add STM32 hwspinlock device dt-bindings: hwlock: Document STM32 hwspinlock bindings commit 373282e7ab6840cd583a223fa90628f2d8293c26 Author: John Pittman Date: Fri Jan 4 12:06:37 2019 -0500 null_blk: add zoned config support information If the kernel is built without CONFIG_BLK_DEV_ZONED, a modprobe of the null_blk driver with zoned=1 fails with 'Invalid argument'. This can be confusing to users, prompting a search as to why the parameter is invalid. To assist in that search, add a bit more information to the failure, additionally adding to the documentation that CONFIG_BLK_DEV_ZONED is needed for zoned=1. Reviewed-by: Bart Van Assche Signed-off-by: John Pittman Added null_blk prefix to error message. Signed-off-by: Jens Axboe Documentation/block/null_blk.txt | 3 ++- drivers/block/null_blk.h | 1 + 2 files changed, 3 insertions(+), 1 deletion(-) commit 8094c3ceb21ad93896fd4d238e8ba41911932eaf Author: Eric Biggers Date: Sun Jan 6 08:36:21 2019 -0500 fscrypt: add Adiantum support Add support for the Adiantum encryption mode to fscrypt. Adiantum is a tweakable, length-preserving encryption mode with security provably reducible to that of XChaCha12 and AES-256, subject to a security bound. It's also a true wide-block mode, unlike XTS. See the paper "Adiantum: length-preserving encryption for entry-level processors" (https://eprint.iacr.org/2018/720.pdf) for more details. Also see commit 059c2a4d8e16 ("crypto: adiantum - add Adiantum support"). On sufficiently long messages, Adiantum's bottlenecks are XChaCha12 and the NH hash function. These algorithms are fast even on processors without dedicated crypto instructions. Adiantum makes it feasible to enable storage encryption on low-end mobile devices that lack AES instructions; currently such devices are unencrypted. On ARM Cortex-A7, on 4096-byte messages Adiantum encryption is about 4 times faster than AES-256-XTS encryption; decryption is about 5 times faster. In fscrypt, Adiantum is suitable for encrypting both file contents and names. With filenames, it fixes a known weakness: when two filenames in a directory share a common prefix of >= 16 bytes, with CTS-CBC their encrypted filenames share a common prefix too, leaking information. Adiantum does not have this problem. Since Adiantum also accepts long tweaks (IVs), it's also safe to use the master key directly for Adiantum encryption rather than deriving per-file keys, provided that the per-file nonce is included in the IVs and the master key isn't used for any other encryption mode. This configuration saves memory and improves performance. A new fscrypt policy flag is added to allow users to opt-in to this configuration. Signed-off-by: Eric Biggers Signed-off-by: Theodore Ts'o Documentation/filesystems/fscrypt.rst | 179 +++++++++-------- fs/crypto/crypto.c | 28 +-- fs/crypto/fname.c | 22 ++- fs/crypto/fscrypt_private.h | 67 ++++++- fs/crypto/keyinfo.c | 351 ++++++++++++++++++++++++++-------- fs/crypto/policy.c | 5 +- include/uapi/linux/fs.h | 4 +- 7 files changed, 468 insertions(+), 188 deletions(-) commit 97274b6126193cca2b820579f5d758589a2badc2 Merge: 466f89e9ec8c 1cbbcfbbd56e Author: Alexei Starovoitov Date: Sat Jan 5 21:32:39 2019 -0800 Merge branch 'reject-ptr-scalar-mix' Daniel Borkmann says: ==================== Follow-up fix to 979d63d50c0c ("bpf: prevent out of bounds speculation on pointer arithmetic") in order to reject a corner case for sanitation when ptr / scalars are mixed in the same alu op. ==================== Signed-off-by: Alexei Starovoitov commit 1cbbcfbbd56efd994d643428c69467fe3c8ab672 Author: Daniel Borkmann Date: Sun Jan 6 00:54:38 2019 +0100 bpf: add various test cases for alu op on mixed dst register types Add couple of test_verifier tests to check sanitation of alu op insn with pointer and scalar type coming from different paths. This also includes BPF insns of the test reproducer provided by Jann Horn. Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: Alexei Starovoitov tools/testing/selftests/bpf/test_verifier.c | 120 ++++++++++++++++++++++++++++ 1 file changed, 120 insertions(+) commit d3bd7413e0ca40b60cf60d4003246d067cafdeda Author: Daniel Borkmann Date: Sun Jan 6 00:54:37 2019 +0100 bpf: fix sanitation of alu op with pointer / scalar type from different paths While 979d63d50c0c ("bpf: prevent out of bounds speculation on pointer arithmetic") took care of rejecting alu op on pointer when e.g. pointer came from two different map values with different map properties such as value size, Jann reported that a case was not covered yet when a given alu op is used in both "ptr_reg += reg" and "numeric_reg += reg" from different branches where we would incorrectly try to sanitize based on the pointer's limit. Catch this corner case and reject the program instead. Fixes: 979d63d50c0c ("bpf: prevent out of bounds speculation on pointer arithmetic") Reported-by: Jann Horn Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: Alexei Starovoitov include/linux/bpf_verifier.h | 1 + kernel/bpf/verifier.c | 61 ++++++++++++++++++++++++++++++++++---------- 2 files changed, 49 insertions(+), 13 deletions(-) commit b5aef86e089a2d85a6d627372287785d08938cbe Merge: 15b215e5aa29 93fb7f19985a Author: Linus Torvalds Date: Sat Jan 5 18:35:02 2019 -0800 Merge tag 'docs-5.0-fixes' of git://git.lwn.net/linux Pull documentation fixes from Jonathan Corbet: "A handful of late-arriving documentation fixes" * tag 'docs-5.0-fixes' of git://git.lwn.net/linux: doc: filesystems: fix bad references to nonexistent ext4.rst file Documentation/admin-guide: update URL of LKML information link Docs/kernel-api.rst: Remove blk-tag.c reference commit 15b215e5aa29993c1b0f46693a1b482296bcf08e Merge: d7252d0d3637 c820518f6ca1 Author: Linus Torvalds Date: Sat Jan 5 18:33:21 2019 -0800 Merge tag 'firewire-update' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire fixlet from Stefan Richter: "Remove an explicit dependency in Kconfig which is implied by another dependency" * tag 'firewire-update' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: firewire: Remove depends on HAS_DMA in case of platform dependency commit d7252d0d36375fe8c544098469a21d03fa267a55 Merge: 0fe4e2d5cd93 59f75fd0e315 Author: Linus Torvalds Date: Sat Jan 5 18:29:13 2019 -0800 Merge tag 'for-linus-20190104' of git://git.kernel.dk/linux-block Pull block updates and fixes from Jens Axboe: - Pulled in MD changes that Shaohua had queued up for 4.21. Unfortunately we lost Shaohua late 2018, I'm sending these in on his behalf. - In conjunction with the above, I added a CREDITS entry for Shaoua. - sunvdc queue restart fix (Ming) * tag 'for-linus-20190104' of git://git.kernel.dk/linux-block: Add CREDITS entry for Shaohua Li block: sunvdc: don't run hw queue synchronously from irq context md: fix raid10 hang issue caused by barrier raid10: refactor common wait code from regular read/write request md: remvoe redundant condition check lib/raid6: add option to skip algo benchmarking lib/raid6: sort algos in rough performance order lib/raid6: check for assembler SSSE3 support lib/raid6: avoid __attribute_const__ redefinition lib/raid6: add missing include for raid6test md: remove set but not used variable 'bi_rdev' commit 0fe4e2d5cd931ad2ff99d61cfdd5c6dc0c3ec60b Merge: 3954e1d0310e 9ddf32a8df9e Author: Linus Torvalds Date: Sat Jan 5 18:25:19 2019 -0800 Merge tag 'drm-next-2019-01-05' of git://anongit.freedesktop.org/drm/drm Pull drm fixes from Dave Airlie: "Happy New Year, just decloaking from leave to get some stuff from the last week in before rc1: core: - two regression fixes for damage blob and atomic i915 gvt: - Some missed GVT fixes from the original pull amdgpu: - new PCI IDs - SR-IOV fixes - DC fixes - Vega20 fixes" * tag 'drm-next-2019-01-05' of git://anongit.freedesktop.org/drm/drm: (53 commits) drm: Put damage blob when destroy plane state drm: fix null pointer dereference on null state pointer drm/amdgpu: Add new VegaM pci id drm/ttm: Use drm_debug_printer for all ttm_bo_mem_space_debug output drm/amdgpu: add Vega20 PSP ASD firmware loading drm/amd/display: Fix MST dp_blank REG_WAIT timeout drm/amd/display: validate extended dongle caps drm/amd/display: Use div_u64 for flip timestamp ns to ms drm/amdgpu/uvd:Change uvd ring name convention drm/amd/powerplay: add Vega20 LCLK DPM level setting support drm/amdgpu: print process info when job timeout drm/amdgpu/nbio7.4: add hw bug workaround for vega20 drm/amdgpu/nbio6.1: add hw bug workaround for vega10/12 drm/amd/display: Optimize passive update planes. drm/amd/display: verify lane status before exiting verify link cap drm/amd/display: Fix bug with not updating VSP infoframe drm/amd/display: Add retry to read ddc_clock pin drm/amd/display: Don't skip link training for empty dongle drm/amd/display: Wait edp HPD to high in detect_sink drm/amd/display: fix surface update sequence ... commit 3954e1d0310e30e743431b58918825c4d4fe8812 Merge: a8a6b1186b1a 9c6260de505b Author: Linus Torvalds Date: Sat Jan 5 18:20:51 2019 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: "Over the break a few defects were found, so this is a -rc style pull request of various small things that have been posted. - An attempt to shorten RCU grace period driven delays showed crashes during heavier testing, and has been entirely reverted - A missed merge/rebase error between the advise_mr and ib_device_ops series - Some small static analysis driven fixes from Julia and Aditya - Missed ability to create a XRC_INI in the devx verbs interop series" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: infiniband/qedr: Potential null ptr dereference of qp infiniband: bnxt_re: qplib: Check the return value of send_message IB/ipoib: drop useless LIST_HEAD IB/core: Add advise_mr to the list of known ops Revert "IB/mlx5: Fix long EEH recover time with NVMe offloads" IB/mlx5: Allow XRC INI usage via verbs in DEVX context commit a8a6b1186b1a209647483c2ff81e0d59c43dbdd3 Merge: 7671c14e6aca 399382f80182 Author: Linus Torvalds Date: Sat Jan 5 18:15:37 2019 -0800 Merge tag 'fbdev-v4.21' of git://github.com/bzolnier/linux Pull fbdev updates from Bartlomiej Zolnierkiewicz: "This time the pull request is really small. The most notable changes are fixing fbcon to not cause crash on unregister_framebuffer() operation when there is more than one framebuffer, adding config option to center the bootup logo and making FB_BACKLIGHT config option tristate (which in turn uncovered incorrect FB_BACKLIGHT usage by DRM's nouveau driver). Summary: - fix fbcon to not cause crash on unregister_framebuffer() when there is more than one framebuffer (Noralf Trønnes) - improve support for small rotated displays (Peter Rosin) - fix probe failure handling in udlfb driver (Dan Carpenter) - add config option to center the bootup logo (Peter Rosin) - make FB_BACKLIGHT config option tristate (Rob Clark) - remove superfluous HAS_DMA dependency for goldfishfb driver (Geert Uytterhoeven) - misc fixes (Alexey Khoroshilov, YueHaibing, Colin Ian King, Lubomir Rintel) - misc cleanups (Yangtao Li, Wen Yang) also there is DRM's nouveau driver fix for wrong FB_BACKLIGHT config option usage (FB_BACKLIGHT is for internal fbdev subsystem use only)" * tag 'fbdev-v4.21' of git://github.com/bzolnier/linux: drm/nouveau: fix incorrect FB_BACKLIGHT usage in Kconfig fbdev: fbcon: Fix unregister crash when more than one framebuffer fbdev: Remove depends on HAS_DMA in case of platform dependency pxa168fb: trivial typo fix fbdev: fsl-diu: remove redundant null check on cmap fbdev: omap2: omapfb: convert to DEFINE_SHOW_ATTRIBUTE fbdev: uvesafb: fix spelling mistake "memoery" -> "memory" fbdev: fbmem: add config option to center the bootup logo fbdev: fbmem: make fb_show_logo_line return the end instead of the height video: fbdev: pxafb: Fix "WARNING: invalid free of devm_ allocated data" fbdev: fbmem: behave better with small rotated displays and many CPUs video: clps711x-fb: release disp device node in probe() fbdev: make FB_BACKLIGHT a tristate udlfb: fix some inconsistent NULL checking commit 7671c14e6aca7a816a29a85eba47d9bccb7d23ae Merge: 926b02d3eb54 81482d13f37b Author: Linus Torvalds Date: Sat Jan 5 18:13:35 2019 -0800 Merge branch 'i2c/for-5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c updates from Wolfram Sang: "I2C has only driver updates for you this time. Mostly new IDs/DT compatibles, also SPDX conversions, small cleanups. STM32F7 got FastMode+ and PM support, Axxia some reliabilty improvements" * 'i2c/for-5.0' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (26 commits) i2c: Add Actions Semiconductor Owl family S700 I2C support dt-bindings: i2c: Add S700 support for Actions Semi Soc's i2c: ismt: Add support for Intel Cedar Fork i2c: tegra: Switch to SPDX identifier i2c: tegra: Add missing kerneldoc for some fields i2c: tegra: Cleanup kerneldoc comments i2c: axxia: support sequence command mode dt-bindings: i2c: rcar: Add r8a774c0 support dt-bindings: i2c: sh_mobile: Add r8a774c0 support i2c: sh_mobile: Add support for r8a774c0 (RZ/G2E) i2c: i2c-cros-ec-tunnel: Switch to SPDX identifier. i2c: powermac: Use of_node_name_eq for node name comparisons i2c-axxia: check for error conditions first i2c-axxia: dedicated function to set client addr dt-bindings: i2c: Use correct vendor prefix for Atmel i2c: tegra: replace spin_lock_irqsave with spin_lock in ISR eeprom: at24: add support for 24c2048 dt-bindings: eeprom: at24: add "atmel,24c2048" compatible string i2c: i2c-stm32f7: add PM Runtime support i2c: sh_mobile: add support for r8a77990 (R-Car E3) ... commit 926b02d3eb547daa1d56cf9b586f31b270488b77 Merge: cf26057a9441 72199051af62 Author: Linus Torvalds Date: Sat Jan 5 17:57:34 2019 -0800 Merge tag 'pci-v4.21-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI updates from Bjorn Helgaas: - Remove unused lists from ASPM pcie_link_state (Frederick Lawler) - Fix Broadcom CNB20LE host bridge unintended sign extension (Colin Ian King) - Expand Kconfig "PF" acronyms (Randy Dunlap) - Update MAINTAINERS for arch/x86/kernel/early-quirks.c (Bjorn Helgaas) - Add missing include to drivers/pci.h (Alexandru Gagniuc) - Override Synopsys USB 3.x HAPS device class so dwc3-haps can claim it instead of xhci (Thinh Nguyen) - Clean up P2PDMA documentation (Randy Dunlap) - Allow runtime PM even if driver doesn't supply callbacks (Jarkko Nikula) - Remove status check after submitting Switchtec MRPC Firmware Download commands to avoid Completion Timeouts (Kelvin Cao) - Set Switchtec coherent DMA mask to allow 64-bit DMA (Boris Glimcher) - Fix Switchtec SWITCHTEC_IOCTL_EVENT_IDX_ALL flag overwrite issue (Joey Zhang) - Enable write combining for Switchtec MRPC Input buffers (Kelvin Cao) - Add Switchtec MRPC DMA mode support (Wesley Sheng) - Skip VF scanning on powerpc, which does this in firmware (Sebastian Ott) - Add Amlogic Meson PCIe controller driver and DT bindings (Yue Wang) - Constify histb dw_pcie_host_ops structure (Julia Lawall) - Support multiple power domains for imx6 (Leonard Crestez) - Constify layerscape driver data (Stefan Agner) - Update imx6 Kconfig to allow imx6 PCIe in imx7 kernel (Trent Piepho) - Support armada8k GPIO reset (Baruch Siach) - Support suspend/resume support on imx6 (Leonard Crestez) - Don't hard-code DesignWare DBI/ATU offst (Stephen Warren) - Skip i.MX6 PHY setup on i.MX7D (Andrey Smirnov) - Remove Jianguo Sun from HiSilicon STB maintainers (Lorenzo Pieralisi) - Mask DesignWare interrupts instead of disabling them to avoid lost interrupts (Marc Zyngier) - Add locking when acking DesignWare interrupts (Marc Zyngier) - Ack DesignWare interrupts in the proper callbacks (Marc Zyngier) - Use devm resource parser in mediatek (Honghui Zhang) - Remove unused mediatek "num-lanes" DT property (Honghui Zhang) - Add UniPhier PCIe controller driver and DT bindings (Kunihiko Hayashi) - Enable MSI for imx6 downstream components (Richard Zhu) * tag 'pci-v4.21-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: (40 commits) PCI: imx: Enable MSI from downstream components s390/pci: skip VF scanning PCI/IOV: Add flag so platforms can skip VF scanning PCI/IOV: Factor out sriov_add_vfs() PCI: uniphier: Add UniPhier PCIe host controller support dt-bindings: PCI: Add UniPhier PCIe host controller description PCI: amlogic: Add the Amlogic Meson PCIe controller driver dt-bindings: PCI: meson: add DT bindings for Amlogic Meson PCIe controller arm64: dts: mt7622: Remove un-used property for PCIe arm: dts: mt7623: Remove un-used property for PCIe dt-bindings: PCI: MediaTek: Remove un-used property PCI: mediatek: Remove un-used variant in struct mtk_pcie_port MAINTAINERS: Remove Jianguo Sun from HiSilicon STB DWC entry PCI: dwc: Don't hard-code DBI/ATU offset PCI: imx: Add imx6sx suspend/resume support PCI: armada8k: Add support for gpio controlled reset signal PCI: dwc: Adjust Kconfig to allow IMX6 PCIe host on IMX7 PCI: dwc: layerscape: Constify driver data PCI: imx: Add multi-pd support PCI: Override Synopsys USB 3.x HAPS device class ... commit cf26057a9441173ad552e90cea3344607075c9ad Merge: 1686cc1a31f4 bd8879faafe6 Author: Linus Torvalds Date: Sat Jan 5 17:53:40 2019 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID updates from Jiri Kosina: - high-resolution scrolling support that gracefully handles differences between MS and Logitech implementations in HW, from Peter Hutterer and Harry Cutts - MSI IRQ support for intel-ish driver, from Song Hongyan - support for new hardware (Cougar 700K, Odys Winbook 13, ASUS FX503VD, ASUS T101HA) from Daniel M. Lambea, Hans de Goede and Aleix Roca Nonell - other small assorted fixups * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (22 commits) HID: i2c-hid: Add Odys Winbook 13 to descriptor override HID: lenovo: Add checks to fix of_led_classdev_register HID: intel-ish-hid: add MSI interrupt support HID: debug: Change to use DEFINE_SHOW_ATTRIBUTE macro HID: doc: fix wrong data structure reference for UHID_OUTPUT HID: intel-ish-hid: fixes incorrect error handling HID: asus: Add support for the ASUS T101HA keyboard dock HID: logitech: Use LDJ_DEVICE macro for existing Logitech mice HID: logitech: Enable high-resolution scrolling on Logitech mice HID: logitech: Add function to enable HID++ 1.0 "scrolling acceleration" HID: logitech-hidpp: fix typo, hiddpp to hidpp HID: input: use the Resolution Multiplier for high-resolution scrolling HID: core: process the Resolution Multiplier HID: core: store the collections as a basic tree Input: add `REL_WHEEL_HI_RES` and `REL_HWHEEL_HI_RES` HID: input: support Microsoft wireless radio control hotkey HID: use macros in IS_INPUT_APPLICATION HID: asus: Add support for the ASUS FX503VD laptop HID: asus: Add event handler to catch unmapped Asus Vendor UsagePage codes HID: cougar: Add support for Cougar 700K Gaming Keyboard ... commit 1686cc1a31f45a3fd090e5d0c6fce777422e13fa Merge: 5c4a60831aa6 5f30b2e82348 Author: Linus Torvalds Date: Sat Jan 5 17:51:36 2019 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/livepatching Pull livepatch update from Jiri Kosina: "Return value checking fixup in livepatching samples, from Nicholas Mc Guire" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/livepatching: livepatch: check kzalloc return values commit d86271af64602e7c86c003b27f27c7216706ff96 Author: Masahiro Yamada Date: Sat Jan 5 12:01:51 2019 +0900 kconfig: rename generated .*conf-cfg to *conf-cfg Remove the dot-prefixing since it is just a matter of the .gitignore file. Signed-off-by: Masahiro Yamada scripts/kconfig/.gitignore | 1 + scripts/kconfig/Makefile | 36 ++++++++++++++++++------------------ 2 files changed, 19 insertions(+), 18 deletions(-) commit f7de64b73172e0c4cc900c14a432b76f0347ee9e Author: Masahiro Yamada Date: Thu Jan 3 10:47:05 2019 +0900 kbuild: remove unnecessary stubs for archheader and archscripts Make simply skips a missing rule when it is marked as .PHONY. Remove the dummy targets. Signed-off-by: Masahiro Yamada Makefile | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) commit ba97df45581f09a987ffa38444c33ed6a0a9479e Author: Masahiro Yamada Date: Thu Jan 3 10:16:54 2019 +0900 kbuild: use assignment instead of define ... endef for filechk_* rules You do not have to use define ... endef for filechk_* rules. For simple cases, the use of assignment looks cleaner, IMHO. I updated the usage for scripts/Kbuild.include in case somebody misunderstands the 'define ... endif' is the requirement. Signed-off-by: Masahiro Yamada Acked-by: Heiko Carstens Kbuild | 4 +--- Makefile | 3 +-- arch/s390/kernel/syscalls/Makefile | 12 +++--------- arch/s390/tools/Makefile | 7 ++----- scripts/Kbuild.include | 8 ++++---- scripts/kconfig/Makefile | 4 +--- 6 files changed, 12 insertions(+), 26 deletions(-) commit d6e4b3e326d8b44675b9e19534347d97073826aa Author: Masahiro Yamada Date: Thu Jan 3 10:10:39 2019 +0900 arch: remove redundant UAPI generic-y defines Now that Kbuild automatically creates asm-generic wrappers for missing mandatory headers, it is redundant to list the same headers in generic-y and mandatory-y. Suggested-by: Sam Ravnborg Signed-off-by: Masahiro Yamada Acked-by: Sam Ravnborg arch/alpha/include/uapi/asm/Kbuild | 6 ------ arch/arc/include/uapi/asm/Kbuild | 24 ------------------------ arch/arm/include/uapi/asm/Kbuild | 17 ----------------- arch/arm64/include/uapi/asm/Kbuild | 17 ----------------- arch/c6x/include/uapi/asm/Kbuild | 26 -------------------------- arch/csky/include/uapi/asm/Kbuild | 27 --------------------------- arch/h8300/include/uapi/asm/Kbuild | 26 -------------------------- arch/hexagon/include/uapi/asm/Kbuild | 23 ----------------------- arch/ia64/include/uapi/asm/Kbuild | 6 ------ arch/m68k/include/uapi/asm/Kbuild | 19 ------------------- arch/microblaze/include/uapi/asm/Kbuild | 25 ------------------------- arch/mips/include/uapi/asm/Kbuild | 2 -- arch/nds32/include/uapi/asm/Kbuild | 25 ------------------------- arch/nios2/include/uapi/asm/Kbuild | 25 ------------------------- arch/openrisc/include/uapi/asm/Kbuild | 27 --------------------------- arch/parisc/include/uapi/asm/Kbuild | 6 ------ arch/powerpc/include/uapi/asm/Kbuild | 6 ------ arch/riscv/include/uapi/asm/Kbuild | 27 --------------------------- arch/s390/include/uapi/asm/Kbuild | 15 --------------- arch/sh/include/uapi/asm/Kbuild | 18 ------------------ arch/sparc/include/uapi/asm/Kbuild | 2 -- arch/unicore32/include/uapi/asm/Kbuild | 28 ---------------------------- arch/x86/include/uapi/asm/Kbuild | 2 -- arch/xtensa/include/uapi/asm/Kbuild | 9 --------- 24 files changed, 408 deletions(-) commit 919987318a129b4d0c2203a3c6fd2d804be77100 Author: Masahiro Yamada Date: Thu Jan 3 10:10:38 2019 +0900 kbuild: generate asm-generic wrappers if mandatory headers are missing Some time ago, Sam pointed out a certain degree of overwrap between generic-y and mandatory-y. (https://lkml.org/lkml/2017/7/10/121) I tweaked the meaning of mandatory-y a little bit; now it defines the minimum set of ASM headers that all architectures must have. If arch does not have specific implementation of a mandatory header, Kbuild will let it fallback to the asm-generic one by automatically generating a wrapper. This will allow to drop lots of redundant generic-y defines. Previously, "mandatory" was used in the context of UAPI, but I guess this can be extended to kernel space ASM headers. Suggested-by: Sam Ravnborg Signed-off-by: Masahiro Yamada Acked-by: Sam Ravnborg Documentation/kbuild/makefiles.txt | 9 ++++++--- scripts/Makefile.asm-generic | 4 ++++ scripts/Makefile.headersinst | 7 ------- 3 files changed, 10 insertions(+), 10 deletions(-) commit d4ce5458ea1b7d8ca49c436d602095c4912777d3 Author: Masahiro Yamada Date: Thu Jan 3 10:10:37 2019 +0900 arch: remove stale comments "UAPI Header export list" These comments are leftovers of commit fcc8487d477a ("uapi: export all headers under uapi directories"). Prior to that commit, exported headers must be explicitly added to header-y. Now, all headers under the uapi/ directories are exported. Signed-off-by: Masahiro Yamada arch/alpha/include/uapi/asm/Kbuild | 1 - arch/arc/include/uapi/asm/Kbuild | 1 - arch/arm/include/uapi/asm/Kbuild | 1 - arch/arm64/include/uapi/asm/Kbuild | 1 - arch/c6x/include/uapi/asm/Kbuild | 1 - arch/h8300/include/uapi/asm/Kbuild | 1 - arch/hexagon/include/uapi/asm/Kbuild | 1 - arch/ia64/include/uapi/asm/Kbuild | 1 - arch/m68k/include/uapi/asm/Kbuild | 1 - arch/microblaze/include/uapi/asm/Kbuild | 1 - arch/mips/include/uapi/asm/Kbuild | 1 - arch/nds32/include/uapi/asm/Kbuild | 1 - arch/nios2/include/uapi/asm/Kbuild | 1 - arch/openrisc/include/uapi/asm/Kbuild | 1 - arch/parisc/include/uapi/asm/Kbuild | 1 - arch/powerpc/include/uapi/asm/Kbuild | 1 - arch/riscv/include/uapi/asm/Kbuild | 1 - arch/s390/include/uapi/asm/Kbuild | 1 - arch/sh/include/uapi/asm/Kbuild | 1 - arch/sparc/include/uapi/asm/Kbuild | 1 - arch/unicore32/include/uapi/asm/Kbuild | 1 - arch/x86/include/uapi/asm/Kbuild | 1 - arch/xtensa/include/uapi/asm/Kbuild | 1 - include/uapi/linux/Kbuild | 2 -- 24 files changed, 25 deletions(-) commit 8c4fa8b8d48326353afaf6934edd5f1cc49ee90b Author: Masahiro Yamada Date: Thu Jan 3 10:10:36 2019 +0900 riscv: remove redundant kernel-space generic-y This commit removes redundant generic-y defines in arch/riscv/include/asm/Kbuild. [1] It is redundant to define the same generic-y in both arch/$(ARCH)/include/asm/Kbuild and arch/$(ARCH)/include/uapi/asm/Kbuild. Remove the following generic-y: errno.h fcntl.h ioctl.h ioctls.h ipcbuf.h mman.h msgbuf.h param.h poll.h posix_types.h resource.h sembuf.h setup.h shmbuf.h signal.h socket.h sockios.h stat.h statfs.h swab.h termbits.h termios.h types.h [2] It is redundant to define generic-y when arch-specific implementation exists in arch/$(ARCH)/include/asm/*.h Remove the following generic-y: cacheflush.h module.h Signed-off-by: Masahiro Yamada arch/riscv/include/asm/Kbuild | 25 ------------------------- 1 file changed, 25 deletions(-) commit ad774086356da92a477a87916613d96f4b36005c Author: Masahiro Yamada Date: Mon Dec 31 17:24:09 2018 +0900 kbuild: change filechk to surround the given command with { } filechk_* rules often consist of multiple 'echo' lines. They must be surrounded with { } or ( ) to work correctly. Otherwise, only the string from the last 'echo' would be written into the target. Let's take care of that in the 'filechk' in scripts/Kbuild.include to clean up filechk_* rules. Signed-off-by: Masahiro Yamada Kbuild | 2 +- Makefile | 6 +++--- arch/s390/tools/Makefile | 2 +- firmware/Makefile | 5 ++--- kernel/Makefile | 6 +++++- scripts/Kbuild.include | 2 +- scripts/Makefile.lib | 3 +-- 7 files changed, 14 insertions(+), 12 deletions(-) commit 172caf1993b7a6503a9f7faf589e2cf26eb1f219 Author: Masahiro Yamada Date: Mon Dec 31 17:24:08 2018 +0900 kbuild: remove redundant target cleaning on failure Since commit 9c2af1c7377a ("kbuild: add .DELETE_ON_ERROR special target"), the target file is automatically deleted on failure. The boilerplate code ... || { rm -f $@; false; } is unneeded. Signed-off-by: Masahiro Yamada arch/arm/boot/Makefile | 2 +- arch/arm/boot/compressed/Makefile | 2 +- arch/arm/tools/Makefile | 3 +-- arch/sh/tools/Makefile | 2 +- arch/x86/boot/compressed/Makefile | 2 +- arch/x86/lib/Makefile | 2 +- certs/Makefile | 2 +- lib/raid6/Makefile | 5 ++--- scripts/Makefile.lib | 21 +++++++-------------- 9 files changed, 16 insertions(+), 25 deletions(-) commit f5688663db9b207d7d31f30f388417504b16b76c Author: Masahiro Yamada Date: Mon Dec 31 13:09:00 2018 +0900 kbuild: clean up rule_dtc_dt_yaml Commit 3a2429e1faf4 ("kbuild: change if_changed_rule for multi-line recipe") and commit 4f0e3a57d6eb ("kbuild: Add support for DT binding schema checks") came in via different sub-systems. This is a follow-up cleanup. Signed-off-by: Masahiro Yamada scripts/Makefile.lib | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 786ac51a48465da56f333652ec1d8b215bb272fe Author: Masahiro Yamada Date: Mon Dec 31 10:05:01 2018 +0900 kbuild: remove UIMAGE_IN and UIMAGE_OUT The only/last user of UIMAGE_IN/OUT was removed by commit 4722a3e6b716 ("microblaze: fix multiple bugs in arch/microblaze/boot/Makefile"). The input and output should always be $< and $@. Signed-off-by: Masahiro Yamada scripts/Makefile.lib | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit e9666d10a5677a494260d60d1fa0b73cc7646eb3 Author: Masahiro Yamada Date: Mon Dec 31 00:14:15 2018 +0900 jump_label: move 'asm goto' support test to Kconfig Currently, CONFIG_JUMP_LABEL just means "I _want_ to use jump label". The jump label is controlled by HAVE_JUMP_LABEL, which is defined like this: #if defined(CC_HAVE_ASM_GOTO) && defined(CONFIG_JUMP_LABEL) # define HAVE_JUMP_LABEL #endif We can improve this by testing 'asm goto' support in Kconfig, then make JUMP_LABEL depend on CC_HAS_ASM_GOTO. Ugly #ifdef HAVE_JUMP_LABEL will go away, and CONFIG_JUMP_LABEL will match to the real kernel capability. Signed-off-by: Masahiro Yamada Acked-by: Michael Ellerman (powerpc) Tested-by: Sedat Dilek Makefile | 7 ------- arch/Kconfig | 1 + arch/arm/kernel/jump_label.c | 4 ---- arch/arm64/kernel/jump_label.c | 4 ---- arch/mips/kernel/jump_label.c | 4 ---- arch/powerpc/include/asm/asm-prototypes.h | 2 +- arch/powerpc/kernel/jump_label.c | 2 -- arch/powerpc/platforms/powernv/opal-tracepoints.c | 2 +- arch/powerpc/platforms/powernv/opal-wrappers.S | 2 +- arch/powerpc/platforms/pseries/hvCall.S | 4 ++-- arch/powerpc/platforms/pseries/lpar.c | 2 +- arch/s390/kernel/Makefile | 3 ++- arch/s390/kernel/jump_label.c | 4 ---- arch/sparc/kernel/Makefile | 2 +- arch/sparc/kernel/jump_label.c | 4 ---- arch/x86/Makefile | 2 +- arch/x86/entry/calling.h | 2 +- arch/x86/include/asm/cpufeature.h | 2 +- arch/x86/include/asm/jump_label.h | 13 ------------- arch/x86/include/asm/rmwcc.h | 6 +++--- arch/x86/kernel/Makefile | 3 ++- arch/x86/kernel/jump_label.c | 4 ---- arch/x86/kvm/emulate.c | 2 +- arch/xtensa/kernel/jump_label.c | 4 ---- include/linux/dynamic_debug.h | 6 +++--- include/linux/jump_label.h | 22 +++++++++------------- include/linux/jump_label_ratelimit.h | 8 +++----- include/linux/module.h | 2 +- include/linux/netfilter.h | 4 ++-- include/linux/netfilter_ingress.h | 2 +- init/Kconfig | 3 +++ kernel/jump_label.c | 10 +++------- kernel/module.c | 2 +- kernel/sched/core.c | 2 +- kernel/sched/debug.c | 4 ++-- kernel/sched/fair.c | 6 +++--- kernel/sched/sched.h | 6 +++--- lib/dynamic_debug.c | 2 +- net/core/dev.c | 6 +++--- net/netfilter/core.c | 6 +++--- scripts/gcc-goto.sh | 2 +- tools/arch/x86/include/asm/rmwcc.h | 6 +++--- 42 files changed, 65 insertions(+), 119 deletions(-) commit 72d3ebb929de339f991fc49b58942d2d5ecdb753 Author: Mathias Krause Date: Sun Dec 30 13:36:00 2018 +0100 kallsyms: lower alignment on ARM As mentioned in the info pages of gas, the '.align' pseudo op's interpretation of the alignment value is architecture specific. It might either be a byte value or taken to the power of two. On ARM it's actually the latter which leads to unnecessary large alignments of 16 bytes for 32 bit builds or 256 bytes for 64 bit builds. Fix this by switching to '.balign' instead which is consistent across all architectures. Signed-off-by: Mathias Krause Cc: Catalin Marinas Cc: Will Deacon Signed-off-by: Masahiro Yamada scripts/kallsyms.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit c3003315fbf442d99a73a3fc5288dbf89a735e38 Author: Julia Lawall Date: Sat Dec 29 07:14:16 2018 +0100 scripts: coccinelle: boolinit: drop warnings on named constants Coccinelle doesn't always have access to the values of named (#define) constants, and they may likely often be bound to true and false values anyway, resulting in false positives. So stop warning about them. Signed-off-by: Julia Lawall Signed-off-by: Masahiro Yamada scripts/coccinelle/misc/boolinit.cocci | 5 +++++ 1 file changed, 5 insertions(+) commit dc7884f34a5da79c61a9443c465a99512dc7bb15 Author: Julia Lawall Date: Fri Dec 28 15:49:01 2018 +0100 scripts: coccinelle: check for redeclaration Avoid reporting on the use of an iterator index variable when the variable is redeclared. Signed-off-by: Julia Lawall Signed-off-by: Masahiro Yamada scripts/coccinelle/iterators/use_after_iter.cocci | 3 +++ 1 file changed, 3 insertions(+) commit a5003571e627789d8104ebdbe3ae24be41ea071a Author: Masahiro Yamada Date: Fri Dec 21 15:23:02 2018 +0900 kconfig: remove unused "file" field of yylval union This has never been used. Signed-off-by: Masahiro Yamada scripts/kconfig/zconf.y | 1 - 1 file changed, 1 deletion(-) commit 5c0ab286aeb1b7feeb50c138f2d9d80b3b04c276 Author: Masahiro Yamada Date: Sun Dec 16 23:14:11 2018 +0900 nds32: remove redundant kernel-space generic-y This commit removes redundant generic-y defines in arch/nds32/include/asm/Kbuild. [1] It is redundant to define the same generic-y in both arch/$(ARCH)/include/asm/Kbuild and arch/$(ARCH)/include/uapi/asm/Kbuild. Remove the following generic-y: bitsperlong.h bpf_perf_event.h errno.h fcntl.h ioctl.h ioctls.h mman.h shmbuf.h stat.h [2] It is redundant to define generic-y when arch-specific implementation exists in arch/$(ARCH)/include/asm/*.h Remove the following generic-y: ftrace.h Signed-off-by: Masahiro Yamada arch/nds32/include/asm/Kbuild | 10 ---------- 1 file changed, 10 deletions(-) commit fd8658b58030b1815ba8bccfc02692c9fa718996 Author: Masahiro Yamada Date: Mon Nov 26 16:42:10 2018 +0900 nios2: remove unneeded HAS_DMA define kernel/dma/Kconfig globally defines HAS_DMA as follows: config HAS_DMA bool depends on !NO_DMA default y Signed-off-by: Masahiro Yamada Reviewed-by: Christoph Hellwig arch/nios2/Kconfig | 3 --- 1 file changed, 3 deletions(-) commit 5c4a60831aa6d937cec9cf17aef8eb6c1851bfcd Merge: c28023025463 24ef9ec891c7 Author: Linus Torvalds Date: Sat Jan 5 16:07:28 2019 -0800 Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux Pull thermal management updates from Zhang Rui: - Add locking for cooling device sysfs attribute in case the cooling device state is changed by userspace and thermal framework simultaneously. (Thara Gopinath) - Fix a problem that passive cooling is reset improperly after system suspend/resume. (Wei Wang) - Cleanup the driver/thermal/ directory by moving intel and qcom platform specific drivers to platform specific sub-directories. (Amit Kucheria) - Some trivial cleanups. (Lukasz Luba, Wolfram Sang) * 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux: thermal/intel: fixup for Kconfig string parsing tightening up drivers: thermal: Move QCOM_SPMI_TEMP_ALARM into the qcom subdir drivers: thermal: Move various drivers for intel platforms into a subdir thermal: Fix locking in cooling device sysfs update cur_state Thermal: do not clear passive state during system sleep thermal: zx2967_thermal: simplify getting .driver_data thermal: st: st_thermal: simplify getting .driver_data thermal: spear_thermal: simplify getting .driver_data thermal: rockchip_thermal: simplify getting .driver_data thermal: int340x_thermal: int3400_thermal: simplify getting .driver_data thermal: remove unused function parameter commit c280230254635da33703dd8f4a10cad23f640fb0 Merge: a67012412e5a 9d216211fded Author: Linus Torvalds Date: Sat Jan 5 16:01:16 2019 -0800 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal Pull thermal SoC updates from Eduardo Valentin: - Tegra DT binding documentation for Tegra194 - Armada now supports ap806 and cp110 - RCAR thermal now supports R8A774C0 and R8A77990 - Fixes on thermal_hwmon, IMX, generic-ADC, ST, RCAR, Broadcom, Uniphier, QCOM, Tegra, PowerClamp, and Armada thermal drivers. * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal: (22 commits) thermal: generic-adc: Fix adc to temp interpolation thermal: rcar_thermal: add R8A77990 support dt-bindings: thermal: rcar-thermal: add R8A77990 support thermal: rcar_thermal: add R8A774C0 support dt-bindings: thermal: rcar-thermal: add R8A774C0 support dt-bindings: cp110: document the thermal interrupt capabilities dt-bindings: ap806: document the thermal interrupt capabilities MAINTAINERS: thermal: add entry for Marvell MVEBU thermal driver thermal: armada: add overheat interrupt support thermal: st: fix Makefile typo thermal: uniphier: Convert to SPDX identifier thermal/intel_powerclamp: Change to use DEFINE_SHOW_ATTRIBUTE macro thermal: tegra: soctherm: Change to use DEFINE_SHOW_ATTRIBUTE macro dt-bindings: thermal: tegra-bpmp: Add Tegra194 support thermal: imx: save one condition block for normal case of nvmem initialization thermal: imx: fix for dependency on cpu-freq thermal: tsens: qcom: do not create duplicate regmap debugfs entries thermal: armada: Use PTR_ERR_OR_ZERO in armada_thermal_probe_legacy() dt-bindings: thermal: rcar-gen3-thermal: All variants use 3 interrupts thermal: broadcom: use devm_thermal_zone_of_sensor_register ... commit d4a7e9bb74b5aaf07b89f6531c080b1130bdf019 Author: David Ahern Date: Sat Jan 5 07:35:04 2019 -0800 ipv6: Take rcu_read_lock in __inet6_bind for mapped addresses I realized the last patch calls dev_get_by_index_rcu in a branch not holding the rcu lock. Add the calls to rcu_read_lock and rcu_read_unlock. Fixes: ec90ad334986 ("ipv6: Consider sk_bound_dev_if when binding a socket to a v4 mapped address") Signed-off-by: David Ahern Signed-off-by: David S. Miller net/ipv6/af_inet6.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit a67012412e5a820c44239af9712a1a6037b33fd4 Merge: 7e928df80d30 dc56367cb5db Author: Linus Torvalds Date: Sat Jan 5 14:08:00 2019 -0800 Merge tag 'trace-v4.21-1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull ftrace sh build fix from Steven Rostedt: "It appears that the zero-day bot did find a bug in my sh build. And that I didn't have the bad code in my config file when I cross compiled it, although there are a few other errors in sh that makes it not build for me, I missed that I added one more" * tag 'trace-v4.21-1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: sh: ftrace: Fix missing parenthesis in WARN_ON() commit 7e928df80d30b7664b5822784c95b4a54dc7cfbf Merge: 3cd6d495db2a d5c7076b772a Author: Linus Torvalds Date: Sat Jan 5 14:05:06 2019 -0800 Merge tag '4.21-smb3-small-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb3 fixes from Steve French: "Three fixes, one for stable, one adds the (most secure) SMB3.1.1 dialect to default list requested" * tag '4.21-smb3-small-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb3: add smb3.1.1 to default dialect list cifs: fix confusing warning message on reconnect smb3: fix large reads on encrypted connections commit 3cd6d495db2a0acfd2854f43aac8bfc5914bc89c Merge: acda9efa8c62 31af12efd0a2 Author: Linus Torvalds Date: Sat Jan 5 14:02:22 2019 -0800 Merge tag 'iomap-4.21-merge-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull iomap maintainer update from Darrick Wong: "Christoph Hellwig and I have decided to take responsibility for the fs iomap code rather than let it languish further" * tag 'iomap-4.21-merge-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: iomap: take responsibility for the filesystem iomap code commit acda9efa8c62d4baa0395c83bda43f252137e302 Merge: c7eaf342ecb1 90be9b86da90 Author: Linus Torvalds Date: Sat Jan 5 14:00:56 2019 -0800 Merge tag 'xfs-4.21-merge-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixlets from Darrick Wong: "Remove a couple of unnecessary local variables" * tag 'xfs-4.21-merge-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: xfs_fsops: drop useless LIST_HEAD xfs: xfs_buf: drop useless LIST_HEAD commit c7eaf342ecb164d79275a6c1c93aef19293a4aaf Merge: 35004f2e5580 5ccedf1ccd71 Author: Linus Torvalds Date: Sat Jan 5 13:58:08 2019 -0800 Merge tag 'ceph-for-4.21-rc1' of git://github.com/ceph/ceph-client Pull ceph updates from Ilya Dryomov: "A fairly quiet round: a couple of messenger performance improvements from myself and a few cap handling fixes from Zheng" * tag 'ceph-for-4.21-rc1' of git://github.com/ceph/ceph-client: ceph: don't encode inode pathes into reconnect message ceph: update wanted caps after resuming stale session ceph: skip updating 'wanted' caps if caps are already issued ceph: don't request excl caps when mount is readonly ceph: don't update importing cap's mseq when handing cap export libceph: switch more to bool in ceph_tcp_sendmsg() libceph: use MSG_SENDPAGE_NOTLAST with ceph_tcp_sendpage() libceph: use sock_no_sendpage() as a fallback in ceph_tcp_sendpage() libceph: drop last_piece logic from write_partial_message_data() ceph: remove redundant assignment ceph: cleanup splice_dentry() commit 35004f2e55807a1a1491db24ab512dd2f770a130 Author: Olof Johansson Date: Sat Jan 5 13:21:18 2019 -0800 lib/genalloc.c: include vmalloc.h Fixes build break on most ARM/ARM64 defconfigs: lib/genalloc.c: In function 'gen_pool_add_virt': lib/genalloc.c:190:10: error: implicit declaration of function 'vzalloc_node'; did you mean 'kzalloc_node'? lib/genalloc.c:190:8: warning: assignment to 'struct gen_pool_chunk *' from 'int' makes pointer from integer without a cast [-Wint-conversion] lib/genalloc.c: In function 'gen_pool_destroy': lib/genalloc.c:254:3: error: implicit declaration of function 'vfree'; did you mean 'kfree'? Fixes: 6862d2fc8185 ('lib/genalloc.c: use vzalloc_node() to allocate the bitmap') Cc: Huang Shijie Cc: Andrew Morton Cc: Alexey Skidanov Signed-off-by: Olof Johansson Signed-off-by: Linus Torvalds lib/genalloc.c | 1 + 1 file changed, 1 insertion(+) commit 505b050fdf42097883b2d37b8e796e1f11dbef50 Merge: 9b286efeb5eb 718c43038f28 Author: Linus Torvalds Date: Sat Jan 5 13:25:58 2019 -0800 Merge branch 'mount.part1' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs mount API prep from Al Viro: "Mount API prereqs. Mostly that's LSM mount options cleanups. There are several minor fixes in there, but nothing earth-shattering (leaks on failure exits, mostly)" * 'mount.part1' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (27 commits) mount_fs: suppress MAC on MS_SUBMOUNT as well as MS_KERNMOUNT smack: rewrite smack_sb_eat_lsm_opts() smack: get rid of match_token() smack: take the guts of smack_parse_opts_str() into a new helper LSM: new method: ->sb_add_mnt_opt() selinux: rewrite selinux_sb_eat_lsm_opts() selinux: regularize Opt_... names a bit selinux: switch away from match_token() selinux: new helper - selinux_add_opt() LSM: bury struct security_mnt_opts smack: switch to private smack_mnt_opts selinux: switch to private struct selinux_mnt_opts LSM: hide struct security_mnt_opts from any generic code selinux: kill selinux_sb_get_mnt_opts() LSM: turn sb_eat_lsm_opts() into a method nfs_remount(): don't leak, don't ignore LSM options quietly btrfs: sanitize security_mnt_opts use selinux; don't open-code a loop in sb_finish_set_opts() LSM: split ->sb_set_mnt_opts() out of ->sb_kern_mount() new helper: security_sb_eat_lsm_opts() ... commit 9b286efeb5eb5aaa2712873fc1f928b2f879dbde Merge: 47f3f4eb7834 e4f2283cc6ff Author: Linus Torvalds Date: Sat Jan 5 13:18:59 2019 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull trivial vfs updates from Al Viro: "A few cleanups + Neil's namespace_unlock() optimization" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: exec: make prepare_bprm_creds static genheaders: %-s had been there since v6; %-*s - since v7 VFS: use synchronize_rcu_expedited() in namespace_unlock() iov_iter: reduce code duplication commit 47f3f4eb7834ea424b0704bffd0d3e3c8ffbc3a1 Merge: f1c2f8857c5a edefae94b7b9 Author: Linus Torvalds Date: Sat Jan 5 12:48:25 2019 -0800 Merge tag 'mips_fixes_4.21_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS fixes from Paul Burton: "A few early MIPS fixes for 4.21: - The Broadcom BCM63xx platform sees a fix for resetting the BCM6368 ethernet switch, and the removal of a platform device we've never had a driver for. - The Alchemy platform sees a few fixes for bitrot that occurred within the past few cycles. - We now enable vectored interrupt support for the MediaTek MT7620 SoC, which makes sense since they're supported by the SoC but in this case also works around a bug relating to the location of exception vectors when using a recent version of U-Boot. - The atomic64_fetch_*_relaxed() family of functions see a fix for a regression in MIPS64 kernels since v4.19. - Cavium Octeon III CN7xxx systems will now disable their RGMII interfaces rather than attempt to enable them & warn about the lack of support for doing so, as they did since initial CN7xxx ethernet support was added in v4.7. - The Microsemi/Microchip MSCC SoCs gain a MAINTAINERS entry. - .mailmap now provides consistency for Dengcheng Zhu's name & current email address" * tag 'mips_fixes_4.21_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: MIPS: OCTEON: mark RGMII interface disabled on OCTEON III MIPS: Fix a R10000_LLSC_WAR logic in atomic.h MIPS: BCM63XX: drop unused and broken DSP platform device mailmap: Update name spelling and email for Dengcheng Zhu MIPS: ralink: Select CONFIG_CPU_MIPSR2_IRQ_VI on MT7620/8 MAINTAINERS: Add a maintainer for MSCC MIPS SoCs MIPS: Alchemy: update dma masks for devboard devices MIPS: Alchemy: update cpu-feature-overrides MIPS: Alchemy: drop DB1000 IrDA support bits MIPS: alchemy: cpu_all_mask is forbidden for clock event devices MIPS: BCM63XX: fix switch core reset on BCM6368 commit f1c2f8857c5aa6c92aa903bc06437503422e5925 Merge: cd08f68c659f 074400a7be61 Author: Linus Torvalds Date: Sat Jan 5 11:48:44 2019 -0800 Merge tag 'powerpc-4.21-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: "A fix for the recent access_ok() change, which broke the build. We recently added a use of type in order to squash a warning elsewhere about type being unused. A handful of other minor build fixes, and one defconfig update. Thanks to: Christian Lamparter, Christophe Leroy, Diana Craciun, Mathieu Malaterre" * tag 'powerpc-4.21-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc: Drop use of 'type' from access_ok() KVM: PPC: Book3S HV: radix: Fix uninitialized var build error powerpc/configs: Add PPC4xx_OCM to ppc40x_defconfig powerpc/4xx/ocm: Fix phys_addr_t printf warnings powerpc/4xx/ocm: Fix compilation error due to PAGE_KERNEL usage powerpc/fsl: Fixed warning: orphan section `__btb_flush_fixup' commit cd08f68c659f42f9ec23b25b9cefd1ef49dc78b5 Merge: 670b321f4150 dfbaecb2b707 Author: Linus Torvalds Date: Sat Jan 5 11:44:20 2019 -0800 Merge branch 'parisc-4.21-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc fix from Helge Deller: "Fix boot issues with a series of parisc servers since kernel 4.20. Remapping kernel text with set_kernel_text_rw() missed to remap from lowest up until the highest huge-page aligned kernel text addresss" * 'parisc-4.21-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Remap hugepage-aligned pages in set_kernel_text_rw() commit 670b321f4150bfc8a2261f4db3fcdab21738506b Merge: b23b0ea3708c 21c7acc439b5 Author: Linus Torvalds Date: Sat Jan 5 11:35:55 2019 -0800 Merge tag 'for-4.21' of git://git.sourceforge.jp/gitroot/uclinux-h8/linux Pull h8300 fix from Yoshinori Sato: "Build problem fix" * tag 'for-4.21' of git://git.sourceforge.jp/gitroot/uclinux-h8/linux: h8300: pci: Remove local declaration of pcibios_penalize_isa_irq commit b23b0ea3708c3dec599966fc856836aca48835b9 Merge: 078a5a4faf64 00f8ccd0c95f Author: Linus Torvalds Date: Sat Jan 5 11:30:37 2019 -0800 Merge tag 'armsoc-late' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull more ARM SoC updates from Olof Johansson: "A few updates that we merged late but are low risk for regressions for other platforms (and a few other straggling patches): - I mis-tagged the 'drivers' branch, and missed 3 patches. Merged in here. They're for a driver for the PL353 SRAM controller and a build fix for the qualcomm scm driver. - A new platform, RDA Micro RDA8810PL (Cortex-A5 w/ integrated Vivante GPU, 256MB RAM, Wifi). This includes some acked platform-specific drivers (serial, etc). This also include DTs for two boards with this SoC, OrangePi 2G and OrangePi i86. - i.MX8 is another new platform (NXP, 4x Cortex-A53 + Cortex-M4, 4K video playback offload). This is the first i.MX 64-bit SoC. - Some minor updates to Samsung boards (adding a few peripherals in DTs). - Small rework for SMP bootup on STi platforms. - A couple of TEE driver fixes. - A couple of new config options (bcm2835 thermal, Uniphier MDMAC) enabled in defconfigs" * tag 'armsoc-late' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (27 commits) ARM: multi_v7_defconfig: enable CONFIG_UNIPHIER_MDMAC arm64: defconfig: Re-enable bcm2835-thermal driver MAINTAINERS: Add entry for RDA Micro SoC architecture tty: serial: Add RDA8810PL UART driver ARM: dts: rda8810pl: Add interrupt support for UART dt-bindings: serial: Document RDA Micro UART ARM: dts: rda8810pl: Add timer support ARM: dts: Add devicetree for OrangePi i96 board ARM: dts: Add devicetree for OrangePi 2G IoT board ARM: dts: Add devicetree for RDA8810PL SoC ARM: Prepare RDA8810PL SoC dt-bindings: arm: Document RDA8810PL and reference boards dt-bindings: Add RDA Micro vendor prefix ARM: sti: remove pen_release and boot_lock arm64: dts: exynos: Add Bluetooth chip to TM2(e) boards arm64: dts: imx8mq-evk: enable watchdog arm64: dts: imx8mq: add watchdog devices MAINTAINERS: add i.MX8 DT path to i.MX architecture arm64: add support for i.MX8M EVK board arm64: add basic DTS for i.MX8MQ ... commit 078a5a4faf64fefaf13478a9091782432cad33fa Merge: 1205b62390ee 7e0b44e870cf Author: Linus Torvalds Date: Sat Jan 5 11:28:39 2019 -0800 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "I'm safely chained back up to my desk, so please pull these arm64 fixes for -rc1 that address some issues that cropped up during the merge window: - Prevent KASLR from mapping the top page of the virtual address space - Fix device-tree probing of SDEI driver - Fix incorrect register offset definition in Hisilicon DDRC PMU driver - Fix compilation issue with older binutils not liking unsigned immediates - Fix uapi headers so that libc can provide its own sigcontext definition - Fix handling of private compat syscalls - Hook up compat io_pgetevents() syscall for 32-bit tasks - Cleanup to arm64 Makefile (including now to avoid silly conflicts)" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: compat: Hook up io_pgetevents() for 32-bit tasks arm64: compat: Don't pull syscall number from regs in arm_compat_syscall arm64: compat: Avoid sending SIGILL for unallocated syscall numbers arm64/sve: Disentangle from arm64/sve: ptrace: Fix SVE_PT_REGS_OFFSET definition drivers/perf: hisi: Fixup one DDRC PMU register offset arm64: replace arm64-obj-* in Makefile with obj-* arm64: kaslr: Reserve size of ARM64_MEMSTART_ALIGN in linear region firmware: arm_sdei: Fix DT platform device creation firmware: arm_sdei: fix wrong of_node_put() in init function arm64: entry: remove unused register aliases arm64: smp: Fix compilation error commit 1205b62390eed4e747232d183fbf412a5aecacd9 Merge: 9ee3b3f4a5eb 6de92920a717 Author: Linus Torvalds Date: Sat Jan 5 11:23:17 2019 -0800 Merge tag 'for-4.21' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM updates from Russell King: "Included in this update: - Florian Fainelli noticed that userspace segfaults caused by the lack of kernel-userspace helpers was hard to diagnose; we now issue a warning when userspace tries to use the helpers but the kernel has them disabled. - Ben Dooks wants compatibility for the old ATAG serial number with DT systems. - Some cleanup of assembly by Nicolas Pitre. - User accessors optimisation from Vincent Whitchurch. - More robust kdump on SMP systems from Yufen Wang. - Sebastian Andrzej Siewior noticed problems with the SMP "boot_lock" on RT kernels, and so we convert the Versatile series of platforms to use a raw spinlock instead, consolidating the Versatile implementation. We entirely remove the boot_lock on OMAP systems, where it's unnecessary. Further patches for other systems will be submitted for the following merge window. - Start switching old StrongARM-11x0 systems to use gpiolib rather than their private GPIO implementation - mostly PCMCIA bits. - ARM Kconfig cleanups. - Cleanup a mostly harmless mistake in the recent Spectre patch in 4.20 (which had the effect that data that can be placed into the init sections was incorrectly always placed in the rodata section)" * tag 'for-4.21' of git://git.armlinux.org.uk/~rmk/linux-arm: (25 commits) ARM: omap2: remove unnecessary boot_lock ARM: versatile: rename and comment SMP implementation ARM: versatile: convert boot_lock to raw ARM: vexpress/realview: consolidate immitation CPU hotplug ARM: fix the cockup in the previous patch ARM: sa1100/cerf: switch to using gpio_led_register_device() ARM: sa1100/assabet: switch to using gpio leds ARM: sa1100/assabet: add gpio keys support for right-hand two buttons ARM: sa1111: remove legacy GPIO interfaces pcmcia: sa1100*: remove redundant bvd1/bvd2 setting ARM: pxa/lubbock: switch PCMCIA to MAX1600 library ARM: pxa/mainstone: switch PCMCIA to MAX1600 library and gpiod APIs ARM: sa1100/neponset: switch PCMCIA to MAX1600 library and gpiod APIs ARM: sa1100/jornada720: switch PCMCIA to gpiod APIs pcmcia: add MAX1600 library ARM: sa1100: explicitly register sa11x0-pcmcia devices ARM: 8813/1: Make aligned 2-byte getuser()/putuser() atomic on ARMv6+ ARM: 8812/1: Optimise copy_{from/to}_user for !CPU_USE_DOMAINS ARM: 8811/1: always list both ldrd/strd registers explicitly ARM: 8808/1: kexec:offline panic_smp_self_stop CPU ... commit 9ee3b3f4a5eb523ef27675ac2fcd2269b9d68767 Merge: a65981109f29 f50fd2d8524c Author: Linus Torvalds Date: Sat Jan 5 09:50:07 2019 -0800 Merge tag 'csky-for-linus-4.21' of git://github.com/c-sky/csky-linux Pull arch/csky updates from Guo Ren: "Here are three main features (cpu_hotplug, basic ftrace, basic perf) and some bugfixes: Features: - Add CPU-hotplug support for SMP - Add ftrace with function trace and function graph trace - Add Perf support - Add EM_CSKY_OLD 39 - optimize kernel panic print. - remove syscall_exit_work Bugfixes: - fix abiv2 mmap(... O_SYNC) failure - fix gdb coredump error - remove vdsp implement for kernel - fix qemu failure to bootup sometimes - fix ftrace call-graph panic - fix device tree node reference leak - remove meaningless header-y - fix save hi,lo,dspcr regs in switch_stack - remove unused members in processor.h" * tag 'csky-for-linus-4.21' of git://github.com/c-sky/csky-linux: csky: Add perf support for C-SKY csky: Add EM_CSKY_OLD 39 clocksource/drivers/c-sky: fixup ftrace call-graph panic csky: ftrace call graph supported. csky: basic ftrace supported csky: remove unused members in processor.h csky: optimize kernel panic print. csky: stacktrace supported. csky: CPU-hotplug supported for SMP clocksource/drivers/c-sky: fixup qemu fail to bootup sometimes. csky: fixup save hi,lo,dspcr regs in switch_stack. csky: remove syscall_exit_work csky: fixup remove vdsp implement for kernel. csky: bugfix gdb coredump error. csky: fixup abiv2 mmap(... O_SYNC) failed. csky: define syscall_get_arch() elf-em.h: add EM_CSKY csky: remove meaningless header-y csky: Don't leak device tree node reference commit a65981109f294ba7e64b33ad3b4575a4636fce66 Merge: 3fed6ae4b027 b685a7350ae7 Author: Linus Torvalds Date: Sat Jan 5 09:16:18 2019 -0800 Merge branch 'akpm' (patches from Andrew) Merge more updates from Andrew Morton: - procfs updates - various misc bits - lib/ updates - epoll updates - autofs - fatfs - a few more MM bits * emailed patches from Andrew Morton : (58 commits) mm/page_io.c: fix polled swap page in checkpatch: add Co-developed-by to signature tags docs: fix Co-Developed-by docs drivers/base/platform.c: kmemleak ignore a known leak fs: don't open code lru_to_page() fs/: remove caller signal_pending branch predictions mm/: remove caller signal_pending branch predictions arch/arc/mm/fault.c: remove caller signal_pending_branch predictions kernel/sched/: remove caller signal_pending branch predictions kernel/locking/mutex.c: remove caller signal_pending branch predictions mm: select HAVE_MOVE_PMD on x86 for faster mremap mm: speed up mremap by 20x on large regions mm: treewide: remove unused address argument from pte_alloc functions initramfs: cleanup incomplete rootfs scripts/gdb: fix lx-version string output kernel/kcov.c: mark write_comp_data() as notrace kernel/sysctl: add panic_print into sysctl panic: add options to print system info when panic happens bfs: extra sanity checking and static inode bitmap exec: separate MM_ANONPAGES and RLIMIT_STACK accounting ... commit 8270f3a11ceef64bdb0ab141180e8d2f17c619ec Author: Christoph Hellwig Date: Fri Jan 4 18:31:48 2019 +0100 dma-direct: fix DMA_ATTR_NO_KERNEL_MAPPING for remapped allocations We need to return a dma_addr_t even if we don't have a kernel mapping. Do so by consolidating the phys_to_dma call in a single place and jump to it from all the branches that return successfully. Fixes: bfd56cd60521 ("dma-mapping: support highmem in the generic remap allocator") Reported-by: Liviu Dudau Tested-by: Liviu Dudau kernel/dma/remap.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) commit 06f55fd2d22742ed7e725124dfea68936d12ce40 Author: Christoph Hellwig Date: Fri Jan 4 09:50:33 2019 +0100 x86/amd_gart: fix unmapping of non-GART mappings In many cases we don't have to create a GART mapping at all, which also means there is nothing to unmap. Fix the range check that was incorrectly modified when removing the mapping_error method. Fixes: 9e8aa6b546 ("x86/amd_gart: remove the mapping_error dma_map_ops method") Reported-by: Michal Kubecek Signed-off-by: Christoph Hellwig Tested-by: Michal Kubecek arch/x86/kernel/amd_gart_64.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) commit 466f89e9ec8c6868131c2d2ba9cd5f536879c42a Merge: ec90ad334986 976b4f3a4646 Author: Alexei Starovoitov Date: Fri Jan 4 20:23:33 2019 -0800 Merge branch 'udpv6_sendmsg-addr_any-fix' Andrey Ignatov says: ==================== The patch set fixes BSD'ism in sys_sendmsg to rewrite unspecified destination IPv6 for unconnected UDP sockets in sys_sendmsg with [::1] in case when either CONFIG_CGROUP_BPF is enabled or when sys_sendmsg BPF hook sets destination IPv6 to [::]. Patch 1 is the fix and provides more details. Patch 2 adds two test cases to verify the fix. v1->v2: * Fix compile error in patch 1. ==================== Signed-off-by: Alexei Starovoitov commit 976b4f3a4646fbf0d189caca25f91f82e4be4b5a Author: Andrey Ignatov Date: Fri Jan 4 01:07:08 2019 -0800 selftests/bpf: Test [::] -> [::1] rewrite in sys_sendmsg in test_sock_addr Test that sys_sendmsg BPF hook doesn't break sys_sendmsg behaviour to rewrite destination IPv6 = [::] with [::1] (BSD'ism). Two test cases are added: 1) User passes dst IPv6 = [::] and BPF_CGROUP_UDP6_SENDMSG program doesn't touch it. 2) User passes dst IPv6 != [::], but BPF_CGROUP_UDP6_SENDMSG program rewrites it with [::]. In both cases [::1] is used by sys_sendmsg code eventually and datagram is sent successfully for unconnected UDP socket. Example of relevant output: Test case: sendmsg6: set dst IP = [::] (BSD'ism) .. [PASS] Test case: sendmsg6: preserve dst IP = [::] (BSD'ism) .. [PASS] Signed-off-by: Andrey Ignatov Signed-off-by: Alexei Starovoitov tools/testing/selftests/bpf/test_sock_addr.c | 53 ++++++++++++++++++++++++++-- 1 file changed, 50 insertions(+), 3 deletions(-) commit e8e36984080b55ac5e57bdb09a5b570f2fc8e963 Author: Andrey Ignatov Date: Fri Jan 4 01:07:07 2019 -0800 bpf: Fix [::] -> [::1] rewrite in sys_sendmsg sys_sendmsg has supported unspecified destination IPv6 (wildcard) for unconnected UDP sockets since 876c7f41. When [::] is passed by user as destination, sys_sendmsg rewrites it with [::1] to be consistent with BSD (see "BSD'ism" comment in the code). This didn't work when cgroup-bpf was enabled though since the rewrite [::] -> [::1] happened before passing control to cgroup-bpf block where fl6.daddr was updated with passed by user sockaddr_in6.sin6_addr (that might or might not be changed by BPF program). That way if user passed [::] as dst IPv6 it was first rewritten with [::1] by original code from 876c7f41, but then rewritten back with [::] by cgroup-bpf block. It happened even when BPF_CGROUP_UDP6_SENDMSG program was not present (CONFIG_CGROUP_BPF=y was enough). The fix is to apply BSD'ism after cgroup-bpf block so that [::] is replaced with [::1] no matter where it came from: passed by user to sys_sendmsg or set by BPF_CGROUP_UDP6_SENDMSG program. Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg") Reported-by: Nitin Rawat Signed-off-by: Andrey Ignatov Signed-off-by: Alexei Starovoitov net/ipv6/udp.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit bb351abaf5cd4f9237e1b3094d9cc04853de6d95 Author: Weiping Zhang Date: Wed Dec 26 11:56:33 2018 +0800 block: add documentation for io_timeout Add documentation for /sys/block//queue/io_timeout. Reviewed-by: Bart Van Assche Signed-off-by: Weiping Zhang Signed-off-by: Jens Axboe Documentation/ABI/testing/sysfs-block | 9 +++++++++ Documentation/block/queue-sysfs.txt | 7 +++++++ 2 files changed, 16 insertions(+) commit 3fed6ae4b027f9c93be18520f87bd06bdffd196b Author: Christoph Hellwig Date: Fri Jan 4 13:03:08 2019 -0800 ia64: fix compile without swiotlb Some non-generic ia64 configs don't build swiotlb, and thus should not pull in the generic non-coherent DMA infrastructure. Fixes: 68c608345c ("swiotlb: remove dma_mark_clean") Reported-by: Tony Luck Signed-off-by: Christoph Hellwig Signed-off-by: Tony Luck Signed-off-by: Linus Torvalds arch/ia64/Kconfig | 2 +- arch/ia64/mm/init.c | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) commit 170d13ca3a2fdaaa0283399247631b76b441cca2 Author: Linus Torvalds Date: Fri Jan 4 17:52:49 2019 -0800 x86: re-introduce non-generic memcpy_{to,from}io This has been broken forever, and nobody ever really noticed because it's purely a performance issue. Long long ago, in commit 6175ddf06b61 ("x86: Clean up mem*io functions") Brian Gerst simplified the memory copies to and from iomem, since on x86, the instructions to access iomem are exactly the same as the regular instructions. That is technically true, and things worked, and nobody said anything. Besides, back then the regular memcpy was pretty simple and worked fine. Nobody noticed except for David Laight, that is. David has a testing a TLP monitor he was writing for an FPGA, and has been occasionally complaining about how memcpy_toio() writes things one byte at a time. Which is completely unacceptable from a performance standpoint, even if it happens to technically work. The reason it's writing one byte at a time is because while it's technically true that accesses to iomem are the same as accesses to regular memory on x86, the _granularity_ (and ordering) of accesses matter to iomem in ways that they don't matter to regular cached memory. In particular, when ERMS is set, we default to using "rep movsb" for larger memory copies. That is indeed perfectly fine for real memory, since the whole point is that the CPU is going to do cacheline optimizations and executes the memory copy efficiently for cached memory. With iomem? Not so much. With iomem, "rep movsb" will indeed work, but it will copy things one byte at a time. Slowly and ponderously. Now, originally, back in 2010 when commit 6175ddf06b61 was done, we didn't use ERMS, and this was much less noticeable. Our normal memcpy() was simpler in other ways too. Because in fact, it's not just about using the string instructions. Our memcpy() these days does things like "read and write overlapping values" to handle the last bytes of the copy. Again, for normal memory, overlapping accesses isn't an issue. For iomem? It can be. So this re-introduces the specialized memcpy_toio(), memcpy_fromio() and memset_io() functions. It doesn't particularly optimize them, but it tries to at least not be horrid, or do overlapping accesses. In fact, this uses the existing __inline_memcpy() function that we still had lying around that uses our very traditional "rep movsl" loop followed by movsw/movsb for the final bytes. Somebody may decide to try to improve on it, but if we've gone almost a decade with only one person really ever noticing and complaining, maybe it's not worth worrying about further, once it's not _completely_ broken? Reported-by: David Laight Signed-off-by: Linus Torvalds arch/x86/include/asm/io.h | 8 ++++++++ arch/x86/include/asm/string_64.h | 18 ----------------- arch/x86/lib/Makefile | 1 + arch/x86/lib/iomem.c | 42 ++++++++++++++++++++++++++++++++++++++++ 4 files changed, 51 insertions(+), 18 deletions(-) commit a959dc88f9c8900296ccf13e2f3e1cbc555a8917 Author: Linus Torvalds Date: Sat May 21 21:55:19 2016 -0700 Use __put_user_goto in __put_user_size() and unsafe_put_user() This actually enables the __put_user_goto() functionality in unsafe_put_user(). For an example of the effect of this, this is the code generated for the unsafe_put_user(signo, &infop->si_signo, Efault); in the waitid() system call: movl %ecx,(%rbx) # signo, MEM[(struct __large_struct *)_2] It's just one single store instruction, along with generating an exception table entry pointing to the Efault label case in case that instruction faults. Before, we would generate this: xorl %edx, %edx movl %ecx,(%rbx) # signo, MEM[(struct __large_struct *)_3] testl %edx, %edx jne .L309 with the exception table generated for that 'mov' instruction causing us to jump to a stub that set %edx to -EFAULT and then jumped back to the 'testl' instruction. So not only do we now get rid of the extra code in the normal sequence, we also avoid unnecessarily keeping that extra error register live across it all. Signed-off-by: Linus Torvalds arch/x86/include/asm/uaccess.h | 53 ++++++++++++++++++------------------------ 1 file changed, 22 insertions(+), 31 deletions(-) commit 4a789213c9a54c8b618924d3421e56e98df8a447 Author: Linus Torvalds Date: Sat May 21 21:44:51 2016 -0700 x86 uaccess: Introduce __put_user_goto This is finally the actual reason for the odd error handling in the "unsafe_get/put_user()" functions, introduced over three years ago. Using a "jump to error label" interface is somewhat odd, but very convenient as a programming interface, and more importantly, it fits very well with simply making the target be the exception handler address directly from the inline asm. The reason it took over three years to actually do this? We need "asm goto" support for it, which only became the default on x86 last year. It's now been a year that we've forced asm goto support (see commit e501ce957a78 "x86: Force asm-goto"), and so let's just do it here too. [ Side note: this commit was originally done back in 2016. The above commentary about timing is obviously about it only now getting merged into my real upstream tree - Linus ] Sadly, gcc still only supports "asm goto" with asms that do not have any outputs, so we are limited to only the put_user case for this. Maybe in several more years we can do the get_user case too. Signed-off-by: Linus Torvalds arch/x86/include/asm/uaccess.h | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-) commit ec90ad334986fa5856d11dd272f7f22fa86c55c4 Author: David Ahern Date: Fri Jan 4 16:58:15 2019 -0800 ipv6: Consider sk_bound_dev_if when binding a socket to a v4 mapped address Similar to c5ee066333eb ("ipv6: Consider sk_bound_dev_if when binding a socket to an address"), binding a socket to v4 mapped addresses needs to consider if the socket is bound to a device. This problem also exists from the beginning of git history. Signed-off-by: David Ahern Signed-off-by: David S. Miller net/ipv6/af_inet6.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) commit dfbaecb2b707cfdc5276b548d52b437384bd6483 Author: Helge Deller Date: Fri Jan 4 23:32:53 2019 +0100 parisc: Remap hugepage-aligned pages in set_kernel_text_rw() The alternative coding patch for parisc in kernel 4.20 broke booting machines with PA8500-PA8700 CPUs. The problem is, that for such machines the parisc kernel automatically utilizes huge pages to access kernel text code, but the set_kernel_text_rw() function, which is used shortly before applying any alternative patches, didn't used the correctly hugepage-aligned addresses to remap the kernel text read-writeable. Fixes: 3847dab77421 ("parisc: Add alternative coding infrastructure") Cc: [4.20] Signed-off-by: Helge Deller arch/parisc/mm/init.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 00f8ccd0c95f4e604297057a5bccec86c0903d14 Merge: 8e564895c30c 3e730e858139 Author: Olof Johansson Date: Fri Jan 4 14:30:36 2019 -0800 Merge branch 'next/drivers' into next/late Merge in a few missing patches from the pull request (my copy of the branch was behind the staged version in linux-next). * next/drivers: memory: pl353: Add driver for arm pl353 static memory controller dt-bindings: memory: Add pl353 smc controller devicetree binding information firmware: qcom: scm: fix compilation error when disabled Signed-off-by: Olof Johansson commit 8e564895c30ca73cd9788aecb845879ddee987c3 Author: Masahiro Yamada Date: Fri Dec 21 17:51:24 2018 +0900 ARM: multi_v7_defconfig: enable CONFIG_UNIPHIER_MDMAC Enable the UniPhier MIO DMAC driver. This is used as the DMA engine for accelerating the SD/eMMC controller drivers. Signed-off-by: Masahiro Yamada Signed-off-by: Olof Johansson arch/arm/configs/multi_v7_defconfig | 1 + 1 file changed, 1 insertion(+) commit ae84e4a8eb6f0d7f3b902ce238f285e98cf2ac12 Author: Jeff Kirsher Date: Fri Jan 4 10:48:02 2019 -0800 ixgbe: fix Kconfig when driver is not a module The new ability added to the driver to use mii_bus to handle MII related ioctls is causing compile issues when the driver is compiled into the kernel (i.e. not a module). The problem was in selecting MDIO_DEVICE instead of the preferred PHYLIB Kconfig option. The reason being that MDIO_DEVICE had a dependency on PHYLIB and would be compiled as a module when PHYLIB was a module, no matter whether ixgbe was compiled into the kernel. CC: Dave Jones CC: Steve Douthit CC: Florian Fainelli Signed-off-by: Jeff Kirsher Reviewed-by: Stephen Douthit Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/ethernet/intel/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8d933670452107e41165bea70a30dffbd281bef1 Author: Eric Dumazet Date: Fri Jan 4 11:00:00 2019 -0800 ipv6: make icmp6_send() robust against null skb->dev syzbot was able to crash one host with the following stack trace : kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 8625 Comm: syz-executor4 Not tainted 4.20.0+ #8 RIP: 0010:dev_net include/linux/netdevice.h:2169 [inline] RIP: 0010:icmp6_send+0x116/0x2d30 net/ipv6/icmp.c:426 icmpv6_send smack_socket_sock_rcv_skb security_sock_rcv_skb sk_filter_trim_cap __sk_receive_skb dccp_v6_do_rcv release_sock This is because a RX packet found socket owned by user and was stored into socket backlog. Before leaving RCU protected section, skb->dev was cleared in __sk_receive_skb(). When socket backlog was finally handled at release_sock() time, skb was fed to smack_socket_sock_rcv_skb() then icmp6_send() We could fix the bug in smack_socket_sock_rcv_skb(), or simply make icmp6_send() more robust against such possibility. In the future we might provide to icmp6_send() the net pointer instead of infering it. Fixes: d66a8acbda92 ("Smack: Inform peer that IPv6 traffic has been blocked") Signed-off-by: Eric Dumazet Cc: Piotr Sawicki Cc: Casey Schaufler Reported-by: syzbot Acked-by: Casey Schaufler Signed-off-by: David S. Miller net/ipv6/icmp.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 3271a4821882a64214acc1bd7b173900ec70c9bf Author: Peter Oskolkov Date: Fri Jan 4 09:43:08 2019 -0800 selftests: net: fix/improve ip_defrag selftest Commit ade446403bfb ("net: ipv4: do not handle duplicate fragments as overlapping") changed IPv4 defragmentation so that duplicate fragments, as well as _some_ fragments completely covered by previously delivered fragments, do not lead to the whole frag queue being discarded. This makes the existing ip_defrag selftest flaky. This patch * makes sure that negative IPv4 defrag tests generate truly overlapping fragments that trigger defrag queue drops; * tests that duplicate IPv4 fragments do not trigger defrag queue drops; * makes a couple of minor tweaks to the test aimed at increasing its code coverage and reduce flakiness. Signed-off-by: Peter Oskolkov Signed-off-by: David S. Miller tools/testing/selftests/net/ip_defrag.c | 96 +++++++++++++++++++++++++++++--- tools/testing/selftests/net/ip_defrag.sh | 9 ++- 2 files changed, 95 insertions(+), 10 deletions(-) commit f87118d5760f00af7228033fbe783c7f380d2866 Author: Daniele Palmas Date: Fri Jan 4 13:26:10 2019 +0100 qmi_wwan: add MTU default to qmap network interface This patch adds MTU default value to qmap network interface in order to avoid "RTNETLINK answers: No buffer space available" error when setting an ipv6 address. Signed-off-by: Daniele Palmas Acked-by: Bjørn Mork Signed-off-by: David S. Miller drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+) commit 75e7fb0a87a11c085a58ce583be3f4b1369584e7 Merge: cff1e01f16f8 bb989501abca Author: David S. Miller Date: Fri Jan 4 13:33:57 2019 -0800 Merge branch 'hns-fixes' Huazhong Tan says: ==================== net: hns: Bugfixes for HNS driver This patchset includes bugfixes for the HNS ethernet controller driver. Every patch is independent. ==================== Signed-off-by: David S. Miller commit bb989501abcafa0de5f18b0ec0ec459b5b817908 Author: Yonglong Liu Date: Fri Jan 4 20:18:11 2019 +0800 net: hns: Fix use after free identified by SLUB debug When enable SLUB debug, than remove hns_enet_drv module, SLUB debug will identify a use after free bug: [134.189505] Unable to handle kernel paging request at virtual address 006b6b6b6b6b6b6b [134.197553] Mem abort info: [134.200381] ESR = 0x96000004 [134.203487] Exception class = DABT (current EL), IL = 32 bits [134.209497] SET = 0, FnV = 0 [134.212596] EA = 0, S1PTW = 0 [134.215777] Data abort info: [134.218701] ISV = 0, ISS = 0x00000004 [134.222596] CM = 0, WnR = 0 [134.225606] [006b6b6b6b6b6b6b] address between user and kernel address ranges [134.232851] Internal error: Oops: 96000004 [#1] SMP [134.237798] CPU: 21 PID: 27834 Comm: rmmod Kdump: loaded Tainted: G OE 4.19.5-1.2.34.aarch64 #1 [134.247856] Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.58 10/24/2018 [134.255181] pstate: 20000005 (nzCv daif -PAN -UAO) [134.260044] pc : hns_ae_put_handle+0x38/0x60 [134.264372] lr : hns_ae_put_handle+0x24/0x60 [134.268700] sp : ffff00001be93c50 [134.272054] x29: ffff00001be93c50 x28: ffff802faaec8040 [134.277442] x27: 0000000000000000 x26: 0000000000000000 [134.282830] x25: 0000000056000000 x24: 0000000000000015 [134.288284] x23: ffff0000096fe098 x22: ffff000001050070 [134.293671] x21: ffff801fb3c044a0 x20: ffff80afb75ec098 [134.303287] x19: ffff80afb75ec098 x18: 0000000000000000 [134.312945] x17: 0000000000000000 x16: 0000000000000000 [134.322517] x15: 0000000000000002 x14: 0000000000000000 [134.332030] x13: dead000000000100 x12: ffff7e02bea3c988 [134.341487] x11: ffff80affbee9e68 x10: 0000000000000000 [134.351033] x9 : 6fffff8000008101 x8 : 0000000000000000 [134.360569] x7 : dead000000000100 x6 : ffff000009579748 [134.370059] x5 : 0000000000210d00 x4 : 0000000000000000 [134.379550] x3 : 0000000000000001 x2 : 0000000000000000 [134.388813] x1 : 6b6b6b6b6b6b6b6b x0 : 0000000000000000 [134.397993] Process rmmod (pid: 27834, stack limit = 0x00000000d474b7fd) [134.408498] Call trace: [134.414611] hns_ae_put_handle+0x38/0x60 [134.422208] hnae_put_handle+0xd4/0x108 [134.429563] hns_nic_dev_remove+0x60/0xc0 [hns_enet_drv] [134.438342] platform_drv_remove+0x2c/0x70 [134.445958] device_release_driver_internal+0x174/0x208 [134.454810] driver_detach+0x70/0xd8 [134.461913] bus_remove_driver+0x64/0xe8 [134.469396] driver_unregister+0x34/0x60 [134.476822] platform_driver_unregister+0x20/0x30 [134.485130] hns_nic_dev_driver_exit+0x14/0x6e4 [hns_enet_drv] [134.494634] __arm64_sys_delete_module+0x238/0x290 struct hnae_handle is a member of struct hnae_vf_cb, so when vf_cb is freed, than use hnae_handle will cause use after free panic. This patch frees vf_cb after hnae_handle used. Signed-off-by: Yonglong Liu Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit c77804be53369dd4c15bfc376cf9b45948194cab Author: Yonglong Liu Date: Fri Jan 4 20:18:10 2019 +0800 net: hns: Fix WARNING when hns modules installed Commit 308c6cafde01 ("net: hns: All ports can not work when insmod hns ko after rmmod.") add phy_stop in hns_nic_init_phy(), In the branch of "net", this method is effective, but in the branch of "net-next", it will cause a WARNING when hns modules loaded, reference to commit 2b3e88ea6528 ("net: phy: improve phy state checking"): [10.092168] ------------[ cut here ]------------ [10.092171] called from state READY [10.092189] WARNING: CPU: 4 PID: 1 at ../drivers/net/phy/phy.c:854 phy_stop+0x90/0xb0 [10.092192] Modules linked in: [10.092197] CPU: 4 PID:1 Comm:swapper/0 Not tainted 4.20.0-rc7-next-20181220 #1 [10.092200] Hardware name: Huawei TaiShan 2280 /D05, BIOS Hisilicon D05 UEFI 16.12 Release 05/15/2017 [10.092202] pstate: 60000005 (nZCv daif -PAN -UAO) [10.092205] pc : phy_stop+0x90/0xb0 [10.092208] lr : phy_stop+0x90/0xb0 [10.092209] sp : ffff00001159ba90 [10.092212] x29: ffff00001159ba90 x28: 0000000000000007 [10.092215] x27: ffff000011180068 x26: ffff0000110a5620 [10.092218] x25: ffff0000113b6000 x24: ffff842f96dac000 [10.092221] x23: 0000000000000000 x22: 0000000000000000 [10.092223] x21: ffff841fb8425e18 x20: ffff801fb3a56438 [10.092226] x19: ffff801fb3a56000 x18: ffffffffffffffff [10.092228] x17: 0000000000000000 x16: 0000000000000000 [10.092231] x15: ffff00001122d6c8 x14: ffff00009159b7b7 [10.092234] x13: ffff00001159b7c5 x12: ffff000011245000 [10.092236] x11: 0000000005f5e0ff x10: ffff00001159b750 [10.092239] x9 : 00000000ffffffd0 x8 : 0000000000000465 [10.092242] x7 : ffff0000112457f8 x6 : ffff0000113bd7ce [10.092245] x5 : 0000000000000000 x4 : 0000000000000000 [10.092247] x3 : 00000000ffffffff x2 : ffff000011245828 [10.092250] x1 : 4b5860bd05871300 x0 : 0000000000000000 [10.092253] Call trace: [10.092255] phy_stop+0x90/0xb0 [10.092260] hns_nic_init_phy+0xf8/0x110 [10.092262] hns_nic_try_get_ae+0x4c/0x3b0 [10.092264] hns_nic_dev_probe+0x1fc/0x480 [10.092268] platform_drv_probe+0x50/0xa0 [10.092271] really_probe+0x1f4/0x298 [10.092273] driver_probe_device+0x58/0x108 [10.092275] __driver_attach+0xdc/0xe0 [10.092278] bus_for_each_dev+0x74/0xc8 [10.092280] driver_attach+0x20/0x28 [10.092283] bus_add_driver+0x1b8/0x228 [10.092285] driver_register+0x60/0x110 [10.092288] __platform_driver_register+0x40/0x48 [10.092292] hns_nic_dev_driver_init+0x18/0x20 [10.092296] do_one_initcall+0x5c/0x180 [10.092299] kernel_init_freeable+0x198/0x240 [10.092303] kernel_init+0x10/0x108 [10.092306] ret_from_fork+0x10/0x18 [10.092308] ---[ end trace 1396dd0278e397eb ]--- This WARNING occurred because of calling phy_stop before phy_start. The root cause of the problem in commit '308c6cafde01' is: Reference to hns_nic_init_phy, the flag phydev->supported is changed after phy_connect_direct. The flag phydev->supported is 0x6ff when hns modules is loaded, so will not change Fiber Port power(Reference to marvell.c), which is power on at default. Then the flag phydev->supported is changed to 0x6f, so Fiber Port power is off when removing hns modules. When hns modules installed again, the flag phydev->supported is default value 0x6ff, so will not change Fiber Port power(now is off), causing mac link not up problem. So the solution is change phy flags before phy_connect_direct. Fixes: 308c6cafde01 ("net: hns: All ports can not work when insmod hns ko after rmmod.") Signed-off-by: Yonglong Liu Signed-off-by: Huazhong Tan Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns/hns_enet.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) commit 59f75fd0e31532bdcf65f754516cac2954d5ddc7 Author: Jens Axboe Date: Fri Jan 4 14:27:09 2019 -0700 Add CREDITS entry for Shaohua Li Signed-off-by: Jens Axboe CREDITS | 6 ++++++ 1 file changed, 6 insertions(+) commit b685a7350ae76bc0f388e24b36d06a63776c68ee Author: Jens Axboe Date: Thu Jan 3 15:29:15 2019 -0800 mm/page_io.c: fix polled swap page in swap_readpage() wants to do polling to bring in pages if asked to, but it doesn't mark the bio as being polled. Additionally, the looping around the blk_poll() check isn't correct - if we get a zero return, we should call io_schedule(), we can't just assume that the bio has completed. The regular bio->bi_private check should be used for that. Link: http://lkml.kernel.org/r/e15243a8-2cdf-c32c-ecee-f289377c8ef9@kernel.dk Signed-off-by: Jens Axboe Reviewed-by: Andrew Morton Cc: Christoph Hellwig Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/page_io.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit d499480cc435ff153bf7e2e7ee6ab6ac44306c28 Author: Jorge Ramirez-Ortiz Date: Thu Jan 3 15:29:12 2019 -0800 checkpatch: add Co-developed-by to signature tags As per Documentation/process/submitting-patches, Co-developed-by is a valid signature. This commit removes the warning. Link: http://lkml.kernel.org/r/1544808928-20002-3-git-send-email-jorge.ramirez-ortiz@linaro.org Signed-off-by: Jorge Ramirez-Ortiz Cc: Greg Kroah-Hartman Cc: Himanshu Jha Cc: Joe Perches Cc: Jonathan Cameron Cc: Jonathan Corbet Cc: Niklas Cassel Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds scripts/checkpatch.pl | 1 + 1 file changed, 1 insertion(+) commit ae67ee6c5e1d5b6acdb0d51fddde651834096d75 Author: Jorge Ramirez-Ortiz Date: Thu Jan 3 15:29:09 2019 -0800 docs: fix Co-Developed-by docs The accepted terminology will be Co-developed-by therefore lose the capital letter from now on. Link: http://lkml.kernel.org/r/1544808928-20002-2-git-send-email-jorge.ramirez-ortiz@linaro.org Signed-off-by: Jorge Ramirez-Ortiz Acked-by: Himanshu Jha Cc: Jonathan Cameron Cc: Joe Perches Cc: Greg Kroah-Hartman Cc: Niklas Cassel Cc: Jonathan Corbet Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Documentation/process/submitting-patches.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 967d3010df8b6f6f9aa95c198edc5fe3646ebf36 Author: Qian Cai Date: Thu Jan 3 15:29:05 2019 -0800 drivers/base/platform.c: kmemleak ignore a known leak unreferenced object 0xffff808ec6dc5a80 (size 128): comm "swapper/0", pid 1, jiffies 4294938063 (age 2560.530s) hex dump (first 32 bytes): ff ff ff ff 00 00 00 00 6b 6b 6b 6b 6b 6b 6b 6b ........kkkkkkkk 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk backtrace: [<00000000476dcf8c>] kmem_cache_alloc_trace+0x430/0x500 [<000000004f708d37>] platform_device_register_full+0xbc/0x1e8 [<000000006c2a7ec7>] acpi_create_platform_device+0x370/0x450 [<00000000ef135642>] acpi_default_enumeration+0x34/0x78 [<000000003bd9a052>] acpi_bus_attach+0x2dc/0x3e0 [<000000003cf4f7f2>] acpi_bus_attach+0x108/0x3e0 [<000000003cf4f7f2>] acpi_bus_attach+0x108/0x3e0 [<000000002968643e>] acpi_bus_scan+0xb0/0x110 [<0000000010dd0bd7>] acpi_scan_init+0x1a8/0x410 [<00000000965b3c5a>] acpi_init+0x408/0x49c [<00000000ed4b9fe2>] do_one_initcall+0x178/0x7f4 [<00000000a5ac5a74>] kernel_init_freeable+0x9d4/0xa9c [<0000000070ea6c15>] kernel_init+0x18/0x138 [<00000000fb8fff06>] ret_from_fork+0x10/0x1c [<0000000041273a0d>] 0xffffffffffffffff Then, faddr2line pointed out this line, /* * This memory isn't freed when the device is put, * I don't have a nice idea for that though. Conceptually * dma_mask in struct device should not be a pointer. * See http://thread.gmane.org/gmane.linux.kernel.pci/9081 */ pdev->dev.dma_mask = kmalloc(sizeof(*pdev->dev.dma_mask), GFP_KERNEL); Since this leak has existed for more than 8 years and it does not reference other parts of the memory, let kmemleak ignore it, so users don't need to waste time reporting this in the future. Link: http://lkml.kernel.org/r/20181206160751.36211-1-cai@gmx.us Signed-off-by: Qian Cai Reviewed-by: Andrew Morton Cc: Greg Kroah-Hartman Cc: "Rafael J . Wysocki" Cc: Catalin Marinas Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/base/platform.c | 3 +++ 1 file changed, 3 insertions(+) commit f86196ea8737c98ea96e5f95c99d0367be39a5d2 Author: Nikolay Borisov Date: Thu Jan 3 15:29:02 2019 -0800 fs: don't open code lru_to_page() Multiple filesystems open code lru_to_page(). Rectify this by moving the macro from mm_inline (which is specific to lru stuff) to the more generic mm.h header and start using the macro where appropriate. No functional changes. Link: http://lkml.kernel.org/r/20181129104810.23361-1-nborisov@suse.com Link: https://lkml.kernel.org/r/20181129075301.29087-1-nborisov@suse.com Signed-off-by: Nikolay Borisov Acked-by: Michal Hocko Reviewed-by: David Hildenbrand Reviewed-by: Mike Rapoport Acked-by: Pankaj gupta Acked-by: "Yan, Zheng" [ceph] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/afs/file.c | 5 +++-- fs/btrfs/extent_io.c | 3 +-- fs/ceph/addr.c | 5 ++--- fs/cifs/file.c | 3 ++- fs/ext4/readpage.c | 2 +- fs/ocfs2/aops.c | 3 ++- fs/orangefs/inode.c | 2 +- include/linux/mm.h | 2 ++ include/linux/mm_inline.h | 3 --- mm/swap.c | 2 +- 10 files changed, 15 insertions(+), 15 deletions(-) commit 08d405c8b845a4b871fa3606c9ebe0d0f3b74614 Author: Davidlohr Bueso Date: Thu Jan 3 15:28:58 2019 -0800 fs/: remove caller signal_pending branch predictions This is already done for us internally by the signal machinery. [akpm@linux-foundation.org: fix fs/buffer.c] Link: http://lkml.kernel.org/r/20181116002713.8474-7-dave@stgolabs.net Signed-off-by: Davidlohr Bueso Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/afs/fs_probe.c | 2 +- fs/afs/vl_probe.c | 2 +- fs/buffer.c | 2 +- fs/exec.c | 4 ++-- fs/orangefs/orangefs-bufmap.c | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) commit fa45f1162f28cbba6c38180647b7b300f317ecb4 Author: Davidlohr Bueso Date: Thu Jan 3 15:28:55 2019 -0800 mm/: remove caller signal_pending branch predictions This is already done for us internally by the signal machinery. Link: http://lkml.kernel.org/r/20181116002713.8474-5-dave@stgolabs.net Signed-off-by: Davidlohr Bueso Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/filemap.c | 2 +- mm/gup.c | 2 +- mm/hugetlb.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) commit d8d7d842e8286a98fb56df9caf5d19b46e01ba4b Author: Davidlohr Bueso Date: Thu Jan 3 15:28:51 2019 -0800 arch/arc/mm/fault.c: remove caller signal_pending_branch predictions This is already done for us internally by the signal machinery. Link: http://lkml.kernel.org/r/20181116002713.8474-4-dave@stgolabs.net Signed-off-by: Davidlohr Bueso Reviewed-by: Andrew Morton Cc: Vineet Gupta Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/arc/mm/fault.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 34ec35ad8f5f4624e8391dbb83afb4c791f027e3 Author: Davidlohr Bueso Date: Thu Jan 3 15:28:48 2019 -0800 kernel/sched/: remove caller signal_pending branch predictions This is already done for us internally by the signal machinery. Link: http://lkml.kernel.org/r/20181116002713.8474-3-dave@stgolabs.net Signed-off-by: Davidlohr Bueso Reviewed-by: Andrew Morton Cc: Peter Zijlstra Cc: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/sched/core.c | 2 +- kernel/sched/swait.c | 2 +- kernel/sched/wait.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) commit 3bb5f4ac55dd91d516e7e36b45c94bd57efbb068 Author: Davidlohr Bueso Date: Thu Jan 3 15:28:44 2019 -0800 kernel/locking/mutex.c: remove caller signal_pending branch predictions This is already done for us internally by the signal machinery. Link: http://lkml.kernel.org/r/20181116002713.8474-2-dave@stgolabs.net Signed-off-by: Davidlohr Bueso Reviewed-by: Andrew Morton Cc: Peter Zijlstra Cc: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/locking/mutex.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9f132f7e145506efc0744426cb338b18a54afc3b Author: Joel Fernandes (Google) Date: Thu Jan 3 15:28:41 2019 -0800 mm: select HAVE_MOVE_PMD on x86 for faster mremap Moving page-tables at the PMD-level on x86 is known to be safe. Enable this option so that we can do fast mremap when possible. Link: http://lkml.kernel.org/r/20181108181201.88826-4-joelaf@google.com Signed-off-by: Joel Fernandes (Google) Suggested-by: Kirill A. Shutemov Acked-by: Kirill A. Shutemov Cc: Julia Lawall Cc: Michal Hocko Cc: William Kucharski Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/x86/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 2c91bd4a4e2e530582d6fd643ea7b86b27907151 Author: Joel Fernandes (Google) Date: Thu Jan 3 15:28:38 2019 -0800 mm: speed up mremap by 20x on large regions Android needs to mremap large regions of memory during memory management related operations. The mremap system call can be really slow if THP is not enabled. The bottleneck is move_page_tables, which is copying each pte at a time, and can be really slow across a large map. Turning on THP may not be a viable option, and is not for us. This patch speeds up the performance for non-THP system by copying at the PMD level when possible. The speedup is an order of magnitude on x86 (~20x). On a 1GB mremap, the mremap completion times drops from 3.4-3.6 milliseconds to 144-160 microseconds. Before: Total mremap time for 1GB data: 3521942 nanoseconds. Total mremap time for 1GB data: 3449229 nanoseconds. Total mremap time for 1GB data: 3488230 nanoseconds. After: Total mremap time for 1GB data: 150279 nanoseconds. Total mremap time for 1GB data: 144665 nanoseconds. Total mremap time for 1GB data: 158708 nanoseconds. If THP is enabled the optimization is mostly skipped except in certain situations. [joel@joelfernandes.org: fix 'move_normal_pmd' unused function warning] Link: http://lkml.kernel.org/r/20181108224457.GB209347@google.com Link: http://lkml.kernel.org/r/20181108181201.88826-3-joelaf@google.com Signed-off-by: Joel Fernandes (Google) Acked-by: Kirill A. Shutemov Reviewed-by: William Kucharski Cc: Julia Lawall Cc: Michal Hocko Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/Kconfig | 5 +++++ mm/mremap.c | 64 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 69 insertions(+) commit 4cf58924951ef80eec636b863e7a53973c44261a Author: Joel Fernandes (Google) Date: Thu Jan 3 15:28:34 2019 -0800 mm: treewide: remove unused address argument from pte_alloc functions Patch series "Add support for fast mremap". This series speeds up the mremap(2) syscall by copying page tables at the PMD level even for non-THP systems. There is concern that the extra 'address' argument that mremap passes to pte_alloc may do something subtle architecture related in the future that may make the scheme not work. Also we find that there is no point in passing the 'address' to pte_alloc since its unused. This patch therefore removes this argument tree-wide resulting in a nice negative diff as well. Also ensuring along the way that the enabled architectures do not do anything funky with the 'address' argument that goes unnoticed by the optimization. Build and boot tested on x86-64. Build tested on arm64. The config enablement patch for arm64 will be posted in the future after more testing. The changes were obtained by applying the following Coccinelle script. (thanks Julia for answering all Coccinelle questions!). Following fix ups were done manually: * Removal of address argument from pte_fragment_alloc * Removal of pte_alloc_one_fast definitions from m68k and microblaze. // Options: --include-headers --no-includes // Note: I split the 'identifier fn' line, so if you are manually // running it, please unsplit it so it runs for you. virtual patch @pte_alloc_func_def depends on patch exists@ identifier E2; identifier fn =~ "^(__pte_alloc|pte_alloc_one|pte_alloc|__pte_alloc_kernel|pte_alloc_one_kernel)$"; type T2; @@ fn(... - , T2 E2 ) { ... } @pte_alloc_func_proto_noarg depends on patch exists@ type T1, T2, T3, T4; identifier fn =~ "^(__pte_alloc|pte_alloc_one|pte_alloc|__pte_alloc_kernel|pte_alloc_one_kernel)$"; @@ ( - T3 fn(T1, T2); + T3 fn(T1); | - T3 fn(T1, T2, T4); + T3 fn(T1, T2); ) @pte_alloc_func_proto depends on patch exists@ identifier E1, E2, E4; type T1, T2, T3, T4; identifier fn =~ "^(__pte_alloc|pte_alloc_one|pte_alloc|__pte_alloc_kernel|pte_alloc_one_kernel)$"; @@ ( - T3 fn(T1 E1, T2 E2); + T3 fn(T1 E1); | - T3 fn(T1 E1, T2 E2, T4 E4); + T3 fn(T1 E1, T2 E2); ) @pte_alloc_func_call depends on patch exists@ expression E2; identifier fn =~ "^(__pte_alloc|pte_alloc_one|pte_alloc|__pte_alloc_kernel|pte_alloc_one_kernel)$"; @@ fn(... -, E2 ) @pte_alloc_macro depends on patch exists@ identifier fn =~ "^(__pte_alloc|pte_alloc_one|pte_alloc|__pte_alloc_kernel|pte_alloc_one_kernel)$"; identifier a, b, c; expression e; position p; @@ ( - #define fn(a, b, c) e + #define fn(a, b) e | - #define fn(a, b) e + #define fn(a) e ) Link: http://lkml.kernel.org/r/20181108181201.88826-2-joelaf@google.com Signed-off-by: Joel Fernandes (Google) Suggested-by: Kirill A. Shutemov Acked-by: Kirill A. Shutemov Cc: Michal Hocko Cc: Julia Lawall Cc: Kirill A. Shutemov Cc: William Kucharski Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/alpha/include/asm/pgalloc.h | 6 +++--- arch/arc/include/asm/pgalloc.h | 5 ++--- arch/arm/include/asm/pgalloc.h | 4 ++-- arch/arm64/include/asm/pgalloc.h | 4 ++-- arch/hexagon/include/asm/pgalloc.h | 6 ++---- arch/ia64/include/asm/pgalloc.h | 5 ++--- arch/m68k/include/asm/mcf_pgalloc.h | 8 ++------ arch/m68k/include/asm/motorola_pgalloc.h | 4 ++-- arch/m68k/include/asm/sun3_pgalloc.h | 6 ++---- arch/microblaze/include/asm/pgalloc.h | 19 ++----------------- arch/microblaze/mm/pgtable.c | 3 +-- arch/mips/include/asm/pgalloc.h | 6 ++---- arch/nds32/include/asm/pgalloc.h | 5 ++--- arch/nios2/include/asm/pgalloc.h | 6 ++---- arch/openrisc/include/asm/pgalloc.h | 5 ++--- arch/openrisc/mm/ioremap.c | 3 +-- arch/parisc/include/asm/pgalloc.h | 4 ++-- arch/powerpc/include/asm/book3s/32/pgalloc.h | 6 +++--- arch/powerpc/include/asm/book3s/64/pgalloc.h | 12 +++++------- arch/powerpc/include/asm/nohash/32/pgalloc.h | 6 +++--- arch/powerpc/include/asm/nohash/64/pgalloc.h | 6 ++---- arch/powerpc/mm/pgtable-frag.c | 2 +- arch/powerpc/mm/pgtable_32.c | 8 ++++---- arch/riscv/include/asm/pgalloc.h | 6 ++---- arch/s390/include/asm/pgalloc.h | 4 ++-- arch/sh/include/asm/pgalloc.h | 6 ++---- arch/sparc/include/asm/pgalloc_32.h | 5 ++--- arch/sparc/include/asm/pgalloc_64.h | 6 ++---- arch/sparc/mm/init_64.c | 6 ++---- arch/sparc/mm/srmmu.c | 4 ++-- arch/um/include/asm/pgalloc.h | 4 ++-- arch/um/kernel/mem.c | 4 ++-- arch/unicore32/include/asm/pgalloc.h | 4 ++-- arch/x86/include/asm/pgalloc.h | 4 ++-- arch/x86/mm/pgtable.c | 4 ++-- arch/xtensa/include/asm/pgalloc.h | 8 +++----- include/linux/mm.h | 13 ++++++------- mm/huge_memory.c | 8 ++++---- mm/kasan/init.c | 2 +- mm/memory.c | 17 ++++++++--------- mm/migrate.c | 2 +- mm/mremap.c | 2 +- mm/userfaultfd.c | 2 +- virt/kvm/arm/mmu.c | 2 +- 44 files changed, 101 insertions(+), 151 deletions(-) commit ff1522bb7d98450c72aea729f0b4147bc9986aed Author: David Engraf Date: Thu Jan 3 15:28:31 2019 -0800 initramfs: cleanup incomplete rootfs Unpacking an external initrd may fail e.g. not enough memory. This leads to an incomplete rootfs because some files might be extracted already. Fixed by cleaning the rootfs so the kernel is not using an incomplete rootfs. Link: http://lkml.kernel.org/r/20181030151805.5519-1-david.engraf@sysgo.com Signed-off-by: David Engraf Cc: Dominik Brodowski Cc: Greg Kroah-Hartman Cc: Philippe Ombredanne Cc: Arnd Bergmann Cc: Luc Van Oostenryck Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds init/initramfs.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit b058809bfc8faeb7b7cae047666e23375a060059 Author: Du Changbin Date: Thu Jan 3 15:28:27 2019 -0800 scripts/gdb: fix lx-version string output A bug is present in GDB which causes early string termination when parsing variables. This has been reported [0], but we should ensure that we can support at least basic printing of the core kernel strings. For current gdb version (has been tested with 7.3 and 8.1), 'lx-version' only prints one character. (gdb) lx-version L(gdb) This can be fixed by casting 'linux_banner' as (char *). (gdb) lx-version Linux version 4.19.0-rc1+ (changbin@acer) (gcc version 7.3.0 (Ubuntu 7.3.0-16ubuntu3)) #21 SMP Sat Sep 1 21:43:30 CST 2018 [0] https://sourceware.org/bugzilla/show_bug.cgi?id=20077 [kbingham@kernel.org: add detail to commit message] Link: http://lkml.kernel.org/r/20181111162035.8356-1-kieran.bingham@ideasonboard.com Fixes: 2d061d999424 ("scripts/gdb: add version command") Signed-off-by: Du Changbin Signed-off-by: Kieran Bingham Acked-by: Jan Kiszka Cc: Jan Kiszka Cc: Jason Wessel Cc: Daniel Thompson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds scripts/gdb/linux/proc.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 634724431607f6f46c495dfef801a1c8b44a96d9 Author: Anders Roxell Date: Thu Jan 3 15:28:24 2019 -0800 kernel/kcov.c: mark write_comp_data() as notrace Since __sanitizer_cov_trace_const_cmp4 is marked as notrace, the function called from __sanitizer_cov_trace_const_cmp4 shouldn't be traceable either. ftrace_graph_caller() gets called every time func write_comp_data() gets called if it isn't marked 'notrace'. This is the backtrace from gdb: #0 ftrace_graph_caller () at ../arch/arm64/kernel/entry-ftrace.S:179 #1 0xffffff8010201920 in ftrace_caller () at ../arch/arm64/kernel/entry-ftrace.S:151 #2 0xffffff8010439714 in write_comp_data (type=5, arg1=0, arg2=0, ip=18446743524224276596) at ../kernel/kcov.c:116 #3 0xffffff8010439894 in __sanitizer_cov_trace_const_cmp4 (arg1=, arg2=) at ../kernel/kcov.c:188 #4 0xffffff8010201874 in prepare_ftrace_return (self_addr=18446743524226602768, parent=0xffffff801014b918, frame_pointer=18446743524223531344) at ./include/generated/atomic-instrumented.h:27 #5 0xffffff801020194c in ftrace_graph_caller () at ../arch/arm64/kernel/entry-ftrace.S:182 Rework so that write_comp_data() that are called from __sanitizer_cov_trace_*_cmp*() are marked as 'notrace'. Commit 903e8ff86753 ("kernel/kcov.c: mark funcs in __sanitizer_cov_trace_pc() as notrace") missed to mark write_comp_data() as 'notrace'. When that patch was created gcc-7 was used. In lib/Kconfig.debug config KCOV_ENABLE_COMPARISONS depends on $(cc-option,-fsanitize-coverage=trace-cmp) That code path isn't hit with gcc-7. However, it were that with gcc-8. Link: http://lkml.kernel.org/r/20181206143011.23719-1-anders.roxell@linaro.org Signed-off-by: Anders Roxell Signed-off-by: Arnd Bergmann Co-developed-by: Arnd Bergmann Acked-by: Steven Rostedt (VMware) Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/kcov.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 81c9d43f94870be66146739c6e61df40dc17bb64 Author: Feng Tang Date: Thu Jan 3 15:28:20 2019 -0800 kernel/sysctl: add panic_print into sysctl So that we can also runtime chose to print out the needed system info for panic, other than setting the kernel cmdline. Link: http://lkml.kernel.org/r/1543398842-19295-3-git-send-email-feng.tang@intel.com Signed-off-by: Feng Tang Suggested-by: Steven Rostedt Acked-by: Steven Rostedt (VMware) Cc: Thomas Gleixner Cc: John Stultz Cc: Ingo Molnar Cc: Peter Zijlstra Cc: Kees Cook Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Documentation/sysctl/kernel.txt | 17 +++++++++++++++++ include/linux/kernel.h | 1 + include/uapi/linux/sysctl.h | 1 + kernel/panic.c | 2 +- kernel/sysctl.c | 7 +++++++ kernel/sysctl_binary.c | 1 + 6 files changed, 28 insertions(+), 1 deletion(-) commit d999bd9392dea7c1a9ac43b8680b22c4425ae4c7 Author: Feng Tang Date: Thu Jan 3 15:28:17 2019 -0800 panic: add options to print system info when panic happens Kernel panic issues are always painful to debug, partially because it's not easy to get enough information of the context when panic happens. And we have ramoops and kdump for that, while this commit tries to provide a easier way to show the system info by adding a cmdline parameter, referring some idea from sysrq handler. Link: http://lkml.kernel.org/r/1543398842-19295-2-git-send-email-feng.tang@intel.com Signed-off-by: Feng Tang Reviewed-by: Kees Cook Acked-by: Steven Rostedt (VMware) Cc: Thomas Gleixner Cc: John Stultz Cc: Ingo Molnar Cc: Peter Zijlstra Cc: Steven Rostedt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Documentation/admin-guide/kernel-parameters.txt | 8 +++++++ kernel/panic.c | 28 +++++++++++++++++++++++++ 2 files changed, 36 insertions(+) commit d1877155891020cb26ad4fba45bfee52d8da9951 Author: Tigran Aivazian Date: Thu Jan 3 15:28:14 2019 -0800 bfs: extra sanity checking and static inode bitmap Strengthen validation of BFS superblock against corruption. Make in-core inode bitmap static part of superblock info structure. Print a warning when mounting a BFS filesystem created with "-N 512" option as only 510 files can be created in the root directory. Make the kernel messages more uniform. Update the 'prefix' passed to bfs_dump_imap() to match the current naming of operations. White space and comments cleanup. Link: http://lkml.kernel.org/r/CAK+_RLkFZMduoQF36wZFd3zLi-6ZutWKsydjeHFNdtRvZZEb4w@mail.gmail.com Signed-off-by: Tigran Aivazian Reported-by: Tetsuo Handa Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/bfs/bfs.h | 11 ++++++-- fs/bfs/dir.c | 4 +-- fs/bfs/file.c | 2 +- fs/bfs/inode.c | 65 +++++++++++++++++++-------------------------- include/uapi/linux/bfs_fs.h | 2 +- 5 files changed, 41 insertions(+), 43 deletions(-) commit 655c16a8ce9c15842547f40ce23fd148aeccc074 Author: Oleg Nesterov Date: Thu Jan 3 15:28:11 2019 -0800 exec: separate MM_ANONPAGES and RLIMIT_STACK accounting get_arg_page() checks bprm->rlim_stack.rlim_cur and re-calculates the "extra" size for argv/envp pointers every time, this is a bit ugly and even not strictly correct: acct_arg_size() must not account this size. Remove all the rlimit code in get_arg_page(). Instead, add bprm->argmin calculated once at the start of __do_execve_file() and change copy_strings to check bprm->p >= bprm->argmin. The patch adds the new helper, prepare_arg_pages() which initializes bprm->argc/envc and bprm->argmin. [oleg@redhat.com: fix !CONFIG_MMU version of get_arg_page()] Link: http://lkml.kernel.org/r/20181126122307.GA1660@redhat.com [akpm@linux-foundation.org: use max_t] Link: http://lkml.kernel.org/r/20181112160910.GA28440@redhat.com Signed-off-by: Oleg Nesterov Acked-by: Kees Cook Tested-by: Guenter Roeck Cc: "Eric W. Biederman" Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/exec.c | 105 ++++++++++++++++++++++++------------------------ include/linux/binfmts.h | 1 + 2 files changed, 53 insertions(+), 53 deletions(-) commit 8099b047ecc431518b9bb6bdbba3549bbecdc343 Author: Oleg Nesterov Date: Thu Jan 3 15:28:07 2019 -0800 exec: load_script: don't blindly truncate shebang string load_script() simply truncates bprm->buf and this is very wrong if the length of shebang string exceeds BINPRM_BUF_SIZE-2. This can silently truncate i_arg or (worse) we can execute the wrong binary if buf[2:126] happens to be the valid executable path. Change load_script() to return ENOEXEC if it can't find '\n' or zero in bprm->buf. Note that '\0' can come from either prepare_binprm()->memset() or from kernel_read(), we do not care. Link: http://lkml.kernel.org/r/20181112160931.GA28463@redhat.com Signed-off-by: Oleg Nesterov Acked-by: Kees Cook Acked-by: Michal Hocko Cc: Ben Woodard Cc: "Eric W. Biederman" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/binfmt_script.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) commit fb5bf31722d0805a3f394f7d59f2e8cd07acccb7 Author: Yi Wang Date: Thu Jan 3 15:28:03 2019 -0800 fork: fix some -Wmissing-prototypes warnings We get a warning when building kernel with W=1: kernel/fork.c:167:13: warning: no previous prototype for `arch_release_thread_stack' [-Wmissing-prototypes] kernel/fork.c:779:13: warning: no previous prototype for `fork_init' [-Wmissing-prototypes] Add the missing declaration in head file to fix this. Also, remove arch_release_thread_stack() completely because no arch seems to implement it since bb9d81264 (arch: remove tile port). Link: http://lkml.kernel.org/r/1542170087-23645-1-git-send-email-wang.yi59@zte.com.cn Signed-off-by: Yi Wang Acked-by: Michal Hocko Acked-by: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/sched/task.h | 2 ++ init/main.c | 1 - kernel/fork.c | 5 ----- 3 files changed, 2 insertions(+), 6 deletions(-) commit 306790f75ac2fe021a900395255e468807002c42 Author: Carmeli Tamir Date: Thu Jan 3 15:28:00 2019 -0800 fat: new inline functions to determine the FAT variant (32, 16 or 12) This patch introduces 3 new inline functions - is_fat12, is_fat16 and is_fat32, and replaces every occurrence in the code in which the FS variant (whether this is FAT12, FAT16 or FAT32) was previously checked using msdos_sb_info->fat_bits. Link: http://lkml.kernel.org/r/1544990640-11604-4-git-send-email-carmeli.tamir@gmail.com Signed-off-by: Carmeli Tamir Acked-by: OGAWA Hirofumi Reviewed-by: Sergey Senozhatsky Cc: Johannes Thumshirn Cc: Bart Van Assche Cc: Martin K. Petersen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/fat/cache.c | 2 +- fs/fat/dir.c | 4 ++-- fs/fat/fat.h | 25 ++++++++++++++++++++++--- fs/fat/fatent.c | 16 +++++++--------- fs/fat/inode.c | 12 ++++++------ fs/fat/misc.c | 2 +- 6 files changed, 39 insertions(+), 22 deletions(-) commit d19dc016187502dda6b8095e44eb46a18e89b2b3 Author: Carmeli Tamir Date: Thu Jan 3 15:27:56 2019 -0800 fat: move MAX_FAT to fat.h and change it to inline function MAX_FAT is useless in msdos_fs.h, since it uses the MSDOS_SB function that is defined in fat.h. So really, this macro can be only called from code that already includes fat.h. Hence, this patch moves it to fat.h, right after MSDOS_SB is defined. I also changed it to an inline function in order to save the double call to MSDOS_SB. This was suggested by joe@perches.com in the previous version. This patch is required for the next in the series, in which the variant (whether this is FAT12, FAT16 or FAT32) checks are replaced with new macros. Link: http://lkml.kernel.org/r/1544990640-11604-3-git-send-email-carmeli.tamir@gmail.com Signed-off-by: Carmeli Tamir Acked-by: OGAWA Hirofumi Reviewed-by: Sergey Senozhatsky Cc: Bart Van Assche Cc: Johannes Thumshirn Cc: Martin K. Petersen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/fat/fat.h | 9 +++++++++ fs/fat/inode.c | 2 +- include/uapi/linux/msdos_fs.h | 2 -- 3 files changed, 10 insertions(+), 3 deletions(-) commit b553337a57cf4f077464292520f4e975ea4cda83 Author: Carmeli Tamir Date: Thu Jan 3 15:27:53 2019 -0800 fat: remove FAT_FIRST_ENT macro The comment edited in this patch was the only reference to the FAT_FIRST_ENT macro, which is not used anymore. Moreover, the commented line of code does not compile with the current code. Since the FAT_FIRST_ENT macro checks the FAT variant in a way that the patch series changes, I removed it, and instead wrote a clear explanation of what was checked. I verified that the changed comment is correct according to Microsoft FAT spec, search for "BPB_Media" in the following references: 1. Microsoft FAT specification 2005 (http://read.pudn.com/downloads77/ebook/294884/FAT32%20Spec%20%28SDA%20Contribution%29.pdf). Search for 'volume label'. 2. Microsoft Extensible Firmware Initiative, FAT32 File System Specification (https://staff.washington.edu/dittrich/misc/fatgen103.pdf). Search for 'volume label'. Link: http://lkml.kernel.org/r/1544990640-11604-2-git-send-email-carmeli.tamir@gmail.com Signed-off-by: Carmeli Tamir Acked-by: OGAWA Hirofumi Reviewed-by: Sergey Senozhatsky Cc: Bart Van Assche Cc: Johannes Thumshirn Cc: Martin K. Petersen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/fat/inode.c | 12 ++++++++---- include/uapi/linux/msdos_fs.h | 3 --- 2 files changed, 8 insertions(+), 7 deletions(-) commit 9da22854761a76c45d78aa2ae2b4bbd504b4f171 Author: Carmeli Tamir Date: Thu Jan 3 15:27:49 2019 -0800 include/uapi/linux/msdos_fs.h: use MSDOS_NAME for volume label size The FAT file system volume label file stored in the root directory should match the volume label field in the FAT boot sector. As consequence, the max length of these fields ought to be the same. This patch replaces the magic '11' usef in the struct fat_boot_sector with MSDOS_NAME, which is used in struct msdos_dir_entry. Please check the following references: 1. Microsoft FAT specification 2005 (http://read.pudn.com/downloads77/ebook/294884/FAT32%20Spec%20%28SDA%20Contribution%29.pdf). Search for 'volume label'. 2. Microsoft Extensible Firmware Initiative, FAT32 File System Specification (https://staff.washington.edu/dittrich/misc/fatgen103.pdf). Search for 'volume label'. 3. User space code that creates FAT filesystem sometimes uses MSDOS_NAME for the label, sometimes not. Search for 'if (memcmp(label, NO_NAME, MSDOS_NAME))'. I consider to make the same patch there as well. https://github.com/dosfstools/dosfstools/blob/master/src/mkfs.fat.c Link: http://lkml.kernel.org/r/1543096879-82837-1-git-send-email-carmeli.tamir@gmail.com Signed-off-by: Carmeli Tamir Reviewed-by: Sergey Senozhatsky Reviewed-by: Johannes Thumshirn Acked-by: OGAWA Hirofumi Cc: Jens Axboe Cc: Bart Van Assche Cc: Martin K. Petersen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/uapi/linux/msdos_fs.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit f93ca1ed9ba09fa54d372ab17649d781384e34f7 Author: Ernesto A. Fernández Date: Thu Jan 3 15:27:46 2019 -0800 hfsplus: return file attributes on statx The immutable, append-only and no-dump attributes can only be retrieved with an ioctl; implement the ->getattr() method to return them on statx. Do not return the inode birthtime yet, because the issue of how best to handle the post-2038 timestamps is still under discussion. This patch is needed to pass xfstests generic/424. Link: http://lkml.kernel.org/r/20181014163558.sxorxlzjqccq2lpw@eaf Signed-off-by: Ernesto A. Fernández Cc: Viacheslav Dubeyko Cc: Al Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/hfsplus/dir.c | 1 + fs/hfsplus/hfsplus_fs.h | 2 ++ fs/hfsplus/inode.c | 21 +++++++++++++++++++++ 3 files changed, 24 insertions(+) commit f5162216b7dab0c07e070b8b7f98891a85047f59 Author: Ian Kent Date: Thu Jan 3 15:27:43 2019 -0800 autofs: add strictexpire mount option Commit 092a53452bb7 ("autofs: take more care to not update last_used on path walk") helped to (partially) resolve a problem where automounts were not expiring due to aggressive accesses from user space. This patch was later reverted because, for very large environments, it meant more mount requests from clients and when there are a lot of clients this caused a fairly significant increase in server load. But there is a need for both types of expire check, depending on use case, so add a mount option to allow for strict update of last use of autofs dentrys (which just means not updating the last use on path walk access). Link: http://lkml.kernel.org/r/154296973880.9889.14085372741514507967.stgit@pluto-themaw-net Signed-off-by: Ian Kent Cc: Al Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/autofs/autofs_i.h | 1 + fs/autofs/inode.c | 8 +++++++- fs/autofs/root.c | 5 ++++- include/uapi/linux/auto_fs.h | 2 +- 4 files changed, 13 insertions(+), 3 deletions(-) commit 9d8719a42e4671cfe27733d82b5a071295ab9975 Author: Ian Kent Date: Thu Jan 3 15:27:39 2019 -0800 autofs: change catatonic setting to a bit flag Change the superblock info. catatonic setting to be part of a flags bit field. Link: http://lkml.kernel.org/r/154296973142.9889.17275721668508589639.stgit@pluto-themaw-net Signed-off-by: Ian Kent Cc: Al Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/autofs/autofs_i.h | 7 +++++-- fs/autofs/dev-ioctl.c | 4 ++-- fs/autofs/inode.c | 4 ++-- fs/autofs/root.c | 11 ++++++----- fs/autofs/waitq.c | 10 +++++----- 5 files changed, 20 insertions(+), 16 deletions(-) commit 9bf964c9cee40285808ce973be7a266876404501 Author: Ian Kent Date: Thu Jan 3 15:27:36 2019 -0800 autofs: simplify parse_options() function call The parse_options() function uses a long list of parameters, most of which are present in the super block info structure already. The mount parameters set in parse_options() options don't require cleanup so using the super block info struct directly is simpler. Link: http://lkml.kernel.org/r/154296972423.9889.9368859245676473329.stgit@pluto-themaw-net Signed-off-by: Ian Kent Cc: Al Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/autofs/inode.c | 55 +++++++++++++++++++++++++++++-------------------------- 1 file changed, 29 insertions(+), 26 deletions(-) commit 55f0d8205dc6399826332c21bc56626868cd453d Author: Ian Kent Date: Thu Jan 3 15:27:33 2019 -0800 autofs: improve ioctl sbi checks Al Viro made some suggestions to improve the implementation of commit 0633da48f0 ("fix autofs_sbi() does not check super block type"). The check is unnecessary in all cases except for ioctl usage so placing the check in the super block accessor function adds a small overhead to the common case where it isn't needed. So it's sufficient to do this in the ioctl code only. Also the check in the ioctl code is needlessly complex. [akpm@linux-foundation.org: declare autofs_fs_type in .h, not .c] Link: http://lkml.kernel.org/r/154296970987.9889.1597442413573683096.stgit@pluto-themaw-net Signed-off-by: Ian Kent Cc: Al Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/autofs/autofs_i.h | 5 +++-- fs/autofs/dev-ioctl.c | 23 +++++------------------ fs/autofs/init.c | 2 +- 3 files changed, 9 insertions(+), 21 deletions(-) commit 7c8f71935a65a584c48cbe478aaffc52292d6e00 Author: Alexey Dobriyan Date: Thu Jan 3 15:27:29 2019 -0800 init/main.c: make "initcall_level_names[]" const char * Initcall names should not be changed. Link: http://lkml.kernel.org/r/20181124091829.GD10969@avx2 Signed-off-by: Alexey Dobriyan Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds init/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 86c051793b4c941ee4481725d57cf2a27f6b3aaf Author: Davidlohr Bueso Date: Thu Jan 3 15:27:26 2019 -0800 fs/epoll: deal with wait_queue only once There is no reason why we rearm the waitiqueue upon every fetch_events retry (for when events are found yet send_events() fails). If nothing else, this saves four lock operations per retry, and furthermore reduces the scope of the lock even further. [akpm@linux-foundation.org: restore code to original position, fix and reflow comment] Link: http://lkml.kernel.org/r/20181114182532.27981-2-dave@stgolabs.net Signed-off-by: Davidlohr Bueso Cc: Jason Baron Cc: Al Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/eventpoll.c | 29 ++++++++++++++++++----------- 1 file changed, 18 insertions(+), 11 deletions(-) commit 35cff1a6e0236500584a8ae227fe08120d9b5ee2 Author: Davidlohr Bueso Date: Thu Jan 3 15:27:22 2019 -0800 fs/epoll: rename check_events label to send_events It is currently called check_events because it, well, did exactly that. However, since the lockless ep_events_available() call, the label no longer checks, but just sends the events. Rename as such. Link: http://lkml.kernel.org/r/20181114182532.27981-1-dave@stgolabs.net Signed-off-by: Davidlohr Bueso Reviewed-by: Andrew Morton Cc: Al Viro Cc: Jason Baron Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/eventpoll.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit abc610e01c663e25c41a3bdcbc4115cd7fbb047b Author: Davidlohr Bueso Date: Thu Jan 3 15:27:19 2019 -0800 fs/epoll: avoid barrier after an epoll_wait(2) timeout Upon timeout, we can just exit out of the loop, without the cost of the changing the task's state with an smp_store_mb call. Just exit out of the loop and be done - setting the task state afterwards will be, of course, redundant. [dave@stgolabs.net: forgotten fixlets] Link: http://lkml.kernel.org/r/20181109155258.jxcr4t2pnz6zqct3@linux-r8p5 Link: http://lkml.kernel.org/r/20181108051006.18751-7-dave@stgolabs.net Signed-off-by: Davidlohr Bueso Reviewed-by: Andrew Morton Cc: Al Viro Cc: Davidlohr Bueso Cc: Jason Baron Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/eventpoll.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit c5a282e9635e9c7382821565083db5d260085e3e Author: Davidlohr Bueso Date: Thu Jan 3 15:27:15 2019 -0800 fs/epoll: reduce the scope of wq lock in epoll_wait() This patch aims at reducing ep wq.lock hold times in epoll_wait(2). For the blocking case, there is no need to constantly take and drop the spinlock, which is only needed to manipulate the waitqueue. The call to ep_events_available() is now lockless, and only exposed to benign races. Here, if false positive (returns available events and does not see another thread deleting an epi from the list) we call into send_events and then the list's state is correctly seen. Otoh, if a false negative and we don't see a list_add_tail(), for example, from irq callback, then it is rechecked again before blocking, which will see the correct state. In order for more accuracy to see concurrent list_del_init(), use the list_empty_careful() variant -- of course, this won't be safe against insertions from wakeup. For the overflow list we obviously need to prevent load/store tearing as we don't want to see partial values while the ready list is disabled. [dave@stgolabs.net: forgotten fixlets] Link: http://lkml.kernel.org/r/20181109155258.jxcr4t2pnz6zqct3@linux-r8p5 Link: http://lkml.kernel.org/r/20181108051006.18751-6-dave@stgolabs.net Signed-off-by: Davidlohr Bueso Suggested-by: Jason Baron Cc: Al Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/eventpoll.c | 114 ++++++++++++++++++++++++++++++--------------------------- 1 file changed, 60 insertions(+), 54 deletions(-) commit 21877e1a5b520132f54515f8835c963056418b4c Author: Davidlohr Bueso Date: Thu Jan 3 15:27:12 2019 -0800 fs/epoll: robustify ep->mtx held checks Insted of just commenting how important it is, lets make it more robust and add a lockdep_assert_held() call. Link: http://lkml.kernel.org/r/20181108051006.18751-5-dave@stgolabs.net Signed-off-by: Davidlohr Bueso Reviewed-by: Andrew Morton Cc: Al Viro Cc: Jason Baron Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/eventpoll.c | 2 ++ 1 file changed, 2 insertions(+) commit 76699a67f3041ff4c7af6d6ee9be2bfbf1ffb671 Author: Davidlohr Bueso Date: Thu Jan 3 15:27:09 2019 -0800 fs/epoll: drop ovflist branch prediction The ep->ovflist is a secondary ready-list to temporarily store events that might occur when doing sproc without holding the ep->wq.lock. This accounts for every time we check for ready events and also send events back to userspace; both callbacks, particularly the latter because of copy_to_user, can account for a non-trivial time. As such, the unlikely() check to see if the pointer is being used, seems both misleading and sub-optimal. In fact, we go to an awful lot of trouble to sync both lists, and populating the ovflist is far from an uncommon scenario. For example, profiling a concurrent epoll_wait(2) benchmark, with CONFIG_PROFILE_ANNOTATED_BRANCHES shows that for a two threads a 33% incorrect rate was seen; and when incrementally increasing the number of epoll instances (which is used, for example for multiple queuing load balancing models), up to a 90% incorrect rate was seen. Similarly, by deleting the prediction, 3% throughput boost was seen across incremental threads. Link: http://lkml.kernel.org/r/20181108051006.18751-4-dave@stgolabs.net Signed-off-by: Davidlohr Bueso Reviewed-by: Andrew Morton Cc: Al Viro Cc: Jason Baron Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/eventpoll.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4e0982a00564c80cb849a892043450860ef91e14 Author: Davidlohr Bueso Date: Thu Jan 3 15:27:05 2019 -0800 fs/epoll: simplify ep_send_events_proc() ready-list loop The current logic is a bit convoluted. Lets simplify this with a standard list_for_each_entry_safe() loop instead and just break out after maxevents is reached. While at it, remove an unnecessary indentation level in the loop when there are in fact ready events. Link: http://lkml.kernel.org/r/20181108051006.18751-3-dave@stgolabs.net Signed-off-by: Davidlohr Bueso Reviewed-by: Andrew Morton Cc: Al Viro Cc: Jason Baron Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/eventpoll.c | 73 +++++++++++++++++++++++++++++----------------------------- 1 file changed, 37 insertions(+), 36 deletions(-) commit 74bdc129850c32eaddc625ce557da560303fbf25 Author: Davidlohr Bueso Date: Thu Jan 3 15:27:02 2019 -0800 fs/epoll: remove max_nests argument from ep_call_nested() Patch series "epoll: some miscellaneous optimizations". The following are some incremental optimizations on some of the epoll core. Each patch has the details, but together, the series is seen to shave off measurable cycles on a number of systems and workloads. For example, on a 40-core IB, a pipetest as well as parallel epoll_wait() benchmark show around a 20-30% increase in raw operations per second when the box is fully occupied (incremental thread counts), and up to 15% performance improvement with lower counts. Passes ltp epoll related testcases. This patch(of 6): All callers pass the EP_MAX_NESTS constant already, so lets simplify this a tad and get rid of the redundant parameter for nested eventpolls. Link: http://lkml.kernel.org/r/20181108051006.18751-2-dave@stgolabs.net Signed-off-by: Davidlohr Bueso Reviewed-by: Andrew Morton Cc: Al Viro Cc: Jason Baron Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/eventpoll.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) commit 77b8c0a8e47484e205b01dfedcd224770aa9d800 Author: Joe Perches Date: Thu Jan 3 15:26:59 2019 -0800 checkpatch: warn on const char foo[] = "bar"; declarations These declarations should generally be static const to avoid poor compilation and runtime performance where compilers tend to initialize the const declaration for every call instead of using .rodata for the string. Miscellanea: - Convert spaces to tabs for indentation in 2 adjacent checks Link: http://lkml.kernel.org/r/10ea5f4b087dc911e41e187a4a2b5e79c7529aa3.camel@perches.com Signed-off-by: Joe Perches Cc: Rasmus Villemoes Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds scripts/checkpatch.pl | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) commit 05391772a72d49c37e6e4cb8e871be57beb66155 Author: huang.zijiang Date: Thu Jan 3 15:26:55 2019 -0800 drivers/firmware/memmap.c: modify memblock_alloc to memblock_alloc_nopanic memblock_alloc() never returns NULL because panic never returns. Link: http://lkml.kernel.org/r/1545640882-42009-1-git-send-email-huang.zijiang@zte.com.cn Signed-off-by: huang.zijiang Acked-by: Mike Rapoport Cc: Michal Hocko Cc: Stephen Rothwell Cc: Michael Ellerman Cc: Yi Wang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/firmware/memmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6862d2fc81859f88c1f3f660886427893f2b4f3f Author: Huang Shijie Date: Thu Jan 3 15:26:51 2019 -0800 lib/genalloc.c: use vzalloc_node() to allocate the bitmap Some devices may have big memory on chip, such as over 1G. In some cases, the nbytes maybe bigger then 4M which is the bounday of the memory buddy system (4K default). So use vzalloc_node() to allocate the bitmap. Also use vfree to free it. Link: http://lkml.kernel.org/r/20181225015701.6289-1-sjhuang@iluvatar.ai Signed-off-by: Huang Shijie Reviewed-by: Andrew Morton Cc: Alexey Skidanov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds lib/genalloc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 439e00b76a5fb1662e3ae49fc48bd3f950575b9d Author: Yury Norov Date: Thu Jan 3 15:26:48 2019 -0800 lib/find_bit_benchmark.c: align test_find_next_and_bit with others Contrary to other tests, test_find_next_and_bit() test uses tab formatting in output and get_cycles() instead of ktime_get(). get_cycles() is not supported by some arches, so ktime_get() fits better in generic code. Fix it and minor style issues, so the output looks like this: Start testing find_bit() with random-filled bitmap find_next_bit: 7142816 ns, 163282 iterations find_next_zero_bit: 8545712 ns, 164399 iterations find_last_bit: 6332032 ns, 163282 iterations find_first_bit: 20509424 ns, 16606 iterations find_next_and_bit: 4060016 ns, 73424 iterations Start testing find_bit() with sparse bitmap find_next_bit: 55984 ns, 656 iterations find_next_zero_bit: 19197536 ns, 327025 iterations find_last_bit: 65088 ns, 656 iterations find_first_bit: 5923712 ns, 656 iterations find_next_and_bit: 29088 ns, 1 iterations Link: http://lkml.kernel.org/r/20181123174803.10916-1-ynorov@caviumnetworks.com Signed-off-by: Yury Norov Reviewed-by: Andrew Morton Cc: "Norov, Yuri" Cc: Clement Courbet Cc: Geert Uytterhoeven Cc: Alexey Dobriyan Cc: Matthew Wilcox Cc: Rasmus Villemoes Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds lib/find_bit_benchmark.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) commit 52fbf1134d479234d7e64ba9dcbaea23405f229e Author: Alexey Skidanov Date: Thu Jan 3 15:26:44 2019 -0800 lib/genalloc.c: fix allocation of aligned buffer from non-aligned chunk gen_pool_alloc_algo() uses different allocation functions implementing different allocation algorithms. With gen_pool_first_fit_align() allocation function, the returned address should be aligned on the requested boundary. If chunk start address isn't aligned on the requested boundary, the returned address isn't aligned too. The only way to get properly aligned address is to initialize the pool with chunks aligned on the requested boundary. If want to have an ability to allocate buffers aligned on different boundaries (for example, 4K, 1MB, ...), the chunk start address should be aligned on the max possible alignment. This happens because gen_pool_first_fit_align() looks for properly aligned memory block without taking into account the chunk start address alignment. To fix this, we provide chunk start address to gen_pool_first_fit_align() and change its implementation such that it starts looking for properly aligned block with appropriate offset (exactly as is done in CMA). Link: https://lkml.kernel.org/lkml/a170cf65-6884-3592-1de9-4c235888cc8a@intel.com Link: http://lkml.kernel.org/r/1541690953-4623-1-git-send-email-alexey.skidanov@intel.com Signed-off-by: Alexey Skidanov Reviewed-by: Andrew Morton Cc: Logan Gunthorpe Cc: Daniel Mentz Cc: Mathieu Desnoyers Cc: Laura Abbott Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/genalloc.h | 13 +++++++------ lib/genalloc.c | 20 ++++++++++++-------- 2 files changed, 19 insertions(+), 14 deletions(-) commit 3fc2579e6f162fcff964f5aa01c8a29438ca5c05 Author: Matthew Wilcox Date: Thu Jan 3 15:26:41 2019 -0800 fls: change parameter to unsigned int When testing in userspace, UBSAN pointed out that shifting into the sign bit is undefined behaviour. It doesn't really make sense to ask for the highest set bit of a negative value, so just turn the argument type into an unsigned int. Some architectures (eg ppc) already had it declared as an unsigned int, so I don't expect too many problems. Link: http://lkml.kernel.org/r/20181105221117.31828-1-willy@infradead.org Signed-off-by: Matthew Wilcox Acked-by: Thomas Gleixner Acked-by: Geert Uytterhoeven Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/alpha/include/asm/bitops.h | 4 ++-- arch/arc/include/asm/bitops.h | 4 ++-- arch/c6x/include/asm/bitops.h | 2 +- arch/csky/include/asm/bitops.h | 2 +- arch/hexagon/include/asm/bitops.h | 2 +- arch/ia64/include/asm/bitops.h | 3 +-- arch/m68k/include/asm/bitops.h | 2 +- arch/mips/include/asm/bitops.h | 2 +- arch/openrisc/include/asm/bitops/fls.h | 2 +- arch/parisc/include/asm/bitops.h | 2 +- arch/s390/include/asm/bitops.h | 4 ++-- arch/unicore32/include/asm/bitops.h | 2 +- arch/x86/include/asm/bitops.h | 2 +- include/asm-generic/bitops/builtin-fls.h | 2 +- include/asm-generic/bitops/fls.h | 2 +- tools/include/asm-generic/bitops/fls.h | 2 +- 16 files changed, 19 insertions(+), 20 deletions(-) commit e6310f0fb5cd3f65244dbdef2fb264859891c7ec Author: Alexey Dobriyan Date: Thu Jan 3 15:26:37 2019 -0800 include/linux/printk.h: drop silly "static inline asmlinkage" from dump_stack() Empty function will be inlined so asmlinkage doesn't do anything. Link: http://lkml.kernel.org/r/20181124093530.GE10969@avx2 Signed-off-by: Alexey Dobriyan Reviewed-by: Andrew Morton Acked-by: Joey Pabalinas Cc: Petr Mladek Cc: Sergey Senozhatsky Cc: Steven Rostedt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/printk.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 300133d372b7b541c7e7c5e8d63ea5439f9865b6 Author: Souptick Joarder Date: Thu Jan 3 15:26:34 2019 -0800 drivers/dma-buf/udmabuf.c: convert to use vm_fault_t Use new return type vm_fault_t for fault handler. Link: http://lkml.kernel.org/r/20181106173628.GA12989@jordon-HP-15-Notebook-PC Signed-off-by: Souptick Joarder Cc: Gerd Hoffmann Cc: Sumit Semwal Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/dma-buf/udmabuf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 304ae42739b108305f8d7b3eb3c1aec7c2b643a9 Author: Tetsuo Handa Date: Thu Jan 3 15:26:31 2019 -0800 kernel/hung_task.c: break RCU locks based on jiffies check_hung_uninterruptible_tasks() is currently calling rcu_lock_break() for every 1024 threads. But check_hung_task() is very slow if printk() was called, and is very fast otherwise. If many threads within some 1024 threads called printk(), the RCU grace period might be extended enough to trigger RCU stall warnings. Therefore, calling rcu_lock_break() for every some fixed jiffies will be safer. Link: http://lkml.kernel.org/r/1544800658-11423-1-git-send-email-penguin-kernel@I-love.SAKURA.ne.jp Signed-off-by: Tetsuo Handa Acked-by: Paul E. McKenney Cc: Petr Mladek Cc: Sergey Senozhatsky Cc: Dmitry Vyukov Cc: "Rafael J. Wysocki" Cc: Vitaly Kuznetsov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/hung_task.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 168e06f7937d96c7222037d8a05565e8a6eb00fe Author: Liu, Chuansheng Date: Thu Jan 3 15:26:27 2019 -0800 kernel/hung_task.c: force console verbose before panic Based on commit 401c636a0eeb ("kernel/hung_task.c: show all hung tasks before panic"), we could get the call stack of hung task. However, if the console loglevel is not high, we still can not see the useful panic information in practice, and in most cases users don't set console loglevel to high level. This patch is to force console verbose before system panic, so that the real useful information can be seen in the console, instead of being like the following, which doesn't have hung task information. INFO: task init:1 blocked for more than 120 seconds. Tainted: G U W 4.19.0-quilt-2e5dc0ac-g51b6c21d76cc #1 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. Kernel panic - not syncing: hung_task: blocked tasks CPU: 2 PID: 479 Comm: khungtaskd Tainted: G U W 4.19.0-quilt-2e5dc0ac-g51b6c21d76cc #1 Call Trace: dump_stack+0x4f/0x65 panic+0xde/0x231 watchdog+0x290/0x410 kthread+0x12c/0x150 ret_from_fork+0x35/0x40 reboot: panic mode set: p,w Kernel Offset: 0x34000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) Link: http://lkml.kernel.org/r/27240C0AC20F114CBF8149A2696CBE4A6015B675@SHSMSX101.ccr.corp.intel.com Signed-off-by: Chuansheng Liu Reviewed-by: Petr Mladek Reviewed-by: Sergey Senozhatsky Cc: Tetsuo Handa Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/hung_task.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) commit 527edbc18a70e745740ef31edb0ffefb2f161afa Author: Masahiro Yamada Date: Thu Jan 3 15:26:23 2019 -0800 build_bug.h: remove most of dummy BUILD_BUG_ON stubs for Sparse The introduction of these dummy BUILD_BUG_ON stubs dates back to commmit 903c0c7cdc21 ("sparse: define dummy BUILD_BUG_ON definition for sparse"). At that time, BUILD_BUG_ON() was implemented with the negative array trick *and* the link-time trick, like this: extern int __build_bug_on_failed; #define BUILD_BUG_ON(condition) \ do { \ ((void)sizeof(char[1 - 2*!!(condition)])); \ if (condition) __build_bug_on_failed = 1; \ } while(0) Sparse is more strict about the negative array trick than GCC because Sparse requires the array length to be really constant. Here is the simple test code for the macro above: static const int x = 0; BUILD_BUG_ON(x); GCC is absolutely fine with it (-Wvla was enabled only very recently), but Sparse warns like this: error: bad constant expression error: cannot size expression (If you are using a newer version of Sparse, you will see a different warning message, "warning: Variable length array is used".) Anyway, Sparse was producing many false positives, and noisier than it should be at that time. With the previous commit, the leftover negative array trick is gone. Sparse is fine with the current BUILD_BUG_ON(), which is implemented by using the 'error' attribute. I am keeping the stub for BUILD_BUG_ON_ZERO(). Otherwise, Sparse would complain about the following code, which GCC is fine with: static const int x = 0; int y = BUILD_BUG_ON_ZERO(x); Link: http://lkml.kernel.org/r/1542856462-18836-3-git-send-email-yamada.masahiro@socionext.com Signed-off-by: Masahiro Yamada Acked-by: Kees Cook Reviewed-by: Luc Van Oostenryck Reviewed-by: Nick Desaulniers Tested-by: Nick Desaulniers Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/build_bug.h | 22 +++++++--------------- 1 file changed, 7 insertions(+), 15 deletions(-) commit c60d3b79423aab402085c30b33bfff5354a61d8b Author: Masahiro Yamada Date: Thu Jan 3 15:26:20 2019 -0800 build_bug.h: remove negative-array fallback for BUILD_BUG_ON() The kernel can only be compiled with an optimization option (-O2, -Os, or the currently proposed -Og). Hence, __OPTIMIZE__ is always defined in the kernel source. The fallback for the -O0 case is just hypothetical and pointless. Moreover, commit 0bb95f80a38f ("Makefile: Globally enable VLA warning") enabled -Wvla warning. The use of variable length arrays is banned. Link: http://lkml.kernel.org/r/1542856462-18836-2-git-send-email-yamada.masahiro@socionext.com Signed-off-by: Masahiro Yamada Acked-by: Kees Cook Reviewed-by: Nick Desaulniers Tested-by: Nick Desaulniers Cc: Luc Van Oostenryck Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/build_bug.h | 14 -------------- 1 file changed, 14 deletions(-) commit 3fe5dbfef47e992b810cbe82af1df02d8255fb8c Author: Alexey Dobriyan Date: Thu Jan 3 15:26:16 2019 -0800 Documentation/process/coding-style.rst: don't use "extern" with function prototypes `extern' with function prototypes makes lines longer and creates more characters on the screen. Do not bug people with checkpatch.pl warnings for now as fallout can be devastating. Link: http://lkml.kernel.org/r/20181101134153.GA29267@avx2 Signed-off-by: Alexey Dobriyan Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Documentation/process/coding-style.rst | 3 +++ 1 file changed, 3 insertions(+) commit 09be178400829dddc1189b50a7888495dd26aa84 Author: Cheng Lin Date: Thu Jan 3 15:26:13 2019 -0800 proc/sysctl: fix return error for proc_doulongvec_minmax() If the number of input parameters is less than the total parameters, an EINVAL error will be returned. For example, we use proc_doulongvec_minmax to pass up to two parameters with kern_table: { .procname = "monitor_signals", .data = &monitor_sigs, .maxlen = 2*sizeof(unsigned long), .mode = 0644, .proc_handler = proc_doulongvec_minmax, }, Reproduce: When passing two parameters, it's work normal. But passing only one parameter, an error "Invalid argument"(EINVAL) is returned. [root@cl150 ~]# echo 1 2 > /proc/sys/kernel/monitor_signals [root@cl150 ~]# cat /proc/sys/kernel/monitor_signals 1 2 [root@cl150 ~]# echo 3 > /proc/sys/kernel/monitor_signals -bash: echo: write error: Invalid argument [root@cl150 ~]# echo $? 1 [root@cl150 ~]# cat /proc/sys/kernel/monitor_signals 3 2 [root@cl150 ~]# The following is the result after apply this patch. No error is returned when the number of input parameters is less than the total parameters. [root@cl150 ~]# echo 1 2 > /proc/sys/kernel/monitor_signals [root@cl150 ~]# cat /proc/sys/kernel/monitor_signals 1 2 [root@cl150 ~]# echo 3 > /proc/sys/kernel/monitor_signals [root@cl150 ~]# echo $? 0 [root@cl150 ~]# cat /proc/sys/kernel/monitor_signals 3 2 [root@cl150 ~]# There are three processing functions dealing with digital parameters, __do_proc_dointvec/__do_proc_douintvec/__do_proc_doulongvec_minmax. This patch deals with __do_proc_doulongvec_minmax, just as __do_proc_dointvec does, adding a check for parameters 'left'. In __do_proc_douintvec, its code implementation explicitly does not support multiple inputs. static int __do_proc_douintvec(...){ ... /* * Arrays are not supported, keep this simple. *Do not* add * support for them. */ if (vleft != 1) { *lenp = 0; return -EINVAL; } ... } So, just __do_proc_doulongvec_minmax has the problem. And most use of proc_doulongvec_minmax/proc_doulongvec_ms_jiffies_minmax just have one parameter. Link: http://lkml.kernel.org/r/1544081775-15720-1-git-send-email-cheng.lin130@zte.com.cn Signed-off-by: Cheng Lin Acked-by: Luis Chamberlain Reviewed-by: Kees Cook Cc: Alexey Dobriyan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/sysctl.c | 2 ++ 1 file changed, 2 insertions(+) commit afe922c2daae4a8f0101a30658c886c2b6eb2a96 Author: Alexey Dobriyan Date: Thu Jan 3 15:26:09 2019 -0800 fs/proc/base.c: slightly faster /proc/*/limits Header of /proc/*/limits is a fixed string, so print it directly without formatting specifiers. Link: http://lkml.kernel.org/r/20181203164242.GB6904@avx2 Signed-off-by: Alexey Dobriyan Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/proc/base.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 230f72e9f6dc7b22ee92dc03a393429447b4395c Author: Alexey Dobriyan Date: Thu Jan 3 15:26:05 2019 -0800 fs/proc/inode.c: delete unnecessary variable in proc_alloc_inode() Link: http://lkml.kernel.org/r/20181203164015.GA6904@avx2 Signed-off-by: Alexey Dobriyan Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/proc/inode.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 81966d83492620bf42d94d580370c59ff8d02772 Author: Eric Biggers Date: Thu Jan 3 15:26:00 2019 -0800 fs/proc/util.c: include fs/proc/internal.h for name_to_int() name_to_int() is defined in fs/proc/util.c and declared in fs/proc/internal.h, but the declaration isn't included at the point of the definition. Include the header to enforce that the definition matches the declaration. This addresses a gcc warning when -Wmissing-prototypes is enabled. Link: http://lkml.kernel.org/r/20181115001833.49371-1-ebiggers@kernel.org Signed-off-by: Eric Biggers Reviewed-by: Alexey Dobriyan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/proc/util.c | 1 + 1 file changed, 1 insertion(+) commit 8da0b4f692c6d90b09c91f271517db746a22ff67 Author: Benjamin Gordon Date: Thu Jan 3 15:25:56 2019 -0800 fs/proc/base.c: use ns_capable instead of capable for timerslack_ns Access to timerslack_ns is controlled by a process having CAP_SYS_NICE in its effective capability set, but the current check looks in the root namespace instead of the process' user namespace. Since a process is allowed to do other activities controlled by CAP_SYS_NICE inside a namespace, it should also be able to adjust timerslack_ns. Link: http://lkml.kernel.org/r/20181030180012.232896-1-bmgordon@google.com Signed-off-by: Benjamin Gordon Acked-by: "Eric W. Biederman" Cc: John Stultz Cc: "Eric W. Biederman" Cc: Kees Cook Cc: "Serge E. Hallyn" Cc: Thomas Gleixner Cc: Arjan van de Ven Cc: Oren Laadan Cc: Ruchi Kandoi Cc: Rom Lemarchand Cc: Todd Kjos Cc: Colin Cross Cc: Nick Kralevich Cc: Dmitry Shmidt Cc: Elliott Hughes Cc: Alexey Dobriyan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/proc/base.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) commit cff1e01f16f84083e5b4e3a98331ba405fb3fbb5 Author: Linus Walleij Date: Thu Jan 3 22:31:32 2019 +0100 net: dsa: mt7530: Drop unused GPIO include This driver uses GPIO descriptors only, is not used so drop the include. Signed-off-by: Linus Walleij Reviewed-by: Vivien Didelot Signed-off-by: David S. Miller drivers/net/dsa/mt7530.c | 1 - 1 file changed, 1 deletion(-) commit 0c06a0919782cbe5f33d0f1411ca059e9bfb8190 Merge: 41e4e2cd7534 44039e00171b Author: David S. Miller Date: Fri Jan 4 13:06:07 2019 -0800 Merge branch 'GUE-error-recursion' Stefano Brivio says: ==================== Fix two further potential unbounded recursions in GUE error handlers Patch 1/2 takes care of preventing the issue fixed by commit 11789039da53 ("fou: Prevent unbounded recursion in GUE error handler") also with UDP-Lite payloads -- I just realised this might happen from a syzbot report. Patch 2/2 fixes the issue for both UDP and UDP-Lite on IPv6, which I also forgot to deal with in that same commit. ==================== Signed-off-by: David S. Miller commit 44039e00171b0fe930c07ff7b43e6023eaf1ed31 Author: Stefano Brivio Date: Thu Jan 3 21:43:35 2019 +0100 fou6: Prevent unbounded recursion in GUE error handler I forgot to deal with IPv6 in commit 11789039da53 ("fou: Prevent unbounded recursion in GUE error handler"). Now syzbot reported what might be the same type of issue, caused by gue6_err(), that is, handling exceptions for direct UDP encapsulation in GUE (UDP-in-UDP) leads to unbounded recursion in the GUE exception handler. As it probably doesn't make sense to set up GUE this way, and it's currently not even possible to configure this, skip exception handling for UDP (or UDP-Lite) packets encapsulated in UDP (or UDP-Lite) packets with GUE on IPv6. Reported-by: syzbot+4ad25edc7a33e4ab91e0@syzkaller.appspotmail.com Reported-by: Willem de Bruijn Reported-by: Eric Dumazet Fixes: b8a51b38e4d4 ("fou, fou6: ICMP error handlers for FoU and GUE") Signed-off-by: Stefano Brivio Signed-off-by: David S. Miller net/ipv6/fou6.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit bc6e019b6ee65ff4ebf3ca272f774cf6c67db669 Author: Stefano Brivio Date: Thu Jan 3 21:43:34 2019 +0100 fou: Prevent unbounded recursion in GUE error handler also with UDP-Lite In commit 11789039da53 ("fou: Prevent unbounded recursion in GUE error handler"), I didn't take care of the case where UDP-Lite is encapsulated into UDP or UDP-Lite with GUE. From a syzbot report about a possibly similar issue with GUE on IPv6, I just realised the same thing might happen with a UDP-Lite inner payload. Also skip exception handling for inner UDP-Lite protocol. Fixes: 11789039da53 ("fou: Prevent unbounded recursion in GUE error handler") Signed-off-by: Stefano Brivio Signed-off-by: David S. Miller net/ipv4/fou.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 41e4e2cd75346667b0c531c07dab05cce5b06d15 Author: Yi-Hung Wei Date: Thu Jan 3 09:51:57 2019 -0800 openvswitch: Fix IPv6 later frags parsing The previous commit fa642f08839b ("openvswitch: Derive IP protocol number for IPv6 later frags") introduces IP protocol number parsing for IPv6 later frags that can mess up the network header length calculation logic, i.e. nh_len < 0. However, the network header length calculation is mainly for deriving the transport layer header in the key extraction process which the later fragment does not apply. Therefore, this commit skips the network header length calculation to fix the issue. Reported-by: Chris Mi Reported-by: Greg Rose Fixes: fa642f08839b ("openvswitch: Derive IP protocol number for IPv6 later frags") Signed-off-by: Yi-Hung Wei Signed-off-by: David S. Miller net/openvswitch/flow.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit ba3e1847d6471f30241f11069d8f153ed8cb052b Author: Claudiu Beznea Date: Thu Jan 3 14:59:35 2019 +0000 net: macb: remove unnecessary code Commit 653e92a9175e ("net: macb: add support for padding and fcs computation") introduced a bug fixed by commit 899ecaedd155 ("net: ethernet: cadence: fix socket buffer corruption problem"). Code removed in this patch is not reachable at all so remove it. Fixes: 653e92a9175e ("net: macb: add support for padding and fcs computation") Cc: Tristram Ha Signed-off-by: Claudiu Beznea Signed-off-by: David S. Miller drivers/net/ethernet/cadence/macb_main.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) commit a09b42ba1a5e1cbeb934fd94cb7b5b9018bf15c7 Author: Linus Walleij Date: Thu Jan 3 13:36:43 2019 +0100 net: dsa: microchip: Drop unused GPIO includes This driver does not use the old GPIO includes so drop them. Signed-off-by: Linus Walleij Reviewed-by: Vivien Didelot Signed-off-by: David S. Miller drivers/net/dsa/microchip/ksz_common.c | 2 -- 1 file changed, 2 deletions(-) commit ebdefe4656470870579f1c42fa2e20dcda699263 Merge: f8c468e85379 46721c3d9e27 Author: David S. Miller Date: Fri Jan 4 12:57:31 2019 -0800 Merge branch 'qed-fixes' Denis Bolotin says: ==================== qed: Misc fixes in qed This patch series fixes 2 potential bugs in qed. Please consider applying to net. ==================== Signed-off-by: David S. Miller commit 46721c3d9e273aea880e9ff835b0e1271e1cd2fb Author: Denis Bolotin Date: Thu Jan 3 12:02:40 2019 +0200 qed: Fix qed_ll2_post_rx_buffer_notify_fw() by adding a write memory barrier Make sure chain element is updated before ringing the doorbell. Signed-off-by: Denis Bolotin Signed-off-by: Ariel Elior Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_ll2.c | 4 ++++ 1 file changed, 4 insertions(+) commit 2d533a9287f2011632977e87ce2783f4c689c984 Author: Denis Bolotin Date: Thu Jan 3 12:02:39 2019 +0200 qed: Fix qed_chain_set_prod() for PBL chains with non power of 2 page count In PBL chains with non power of 2 page count, the producer is not at the beginning of the chain when index is 0 after a wrap. Therefore, after the producer index wrap around, page index should be calculated more carefully. Signed-off-by: Denis Bolotin Signed-off-by: Ariel Elior Signed-off-by: David S. Miller include/linux/qed/qed_chain.h | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) commit 594cc251fdd0d231d342d88b2fdff4bc42fb0690 Author: Linus Torvalds Date: Fri Jan 4 12:56:09 2019 -0800 make 'user_access_begin()' do 'access_ok()' Originally, the rule used to be that you'd have to do access_ok() separately, and then user_access_begin() before actually doing the direct (optimized) user access. But experience has shown that people then decide not to do access_ok() at all, and instead rely on it being implied by other operations or similar. Which makes it very hard to verify that the access has actually been range-checked. If you use the unsafe direct user accesses, hardware features (either SMAP - Supervisor Mode Access Protection - on x86, or PAN - Privileged Access Never - on ARM) do force you to use user_access_begin(). But nothing really forces the range check. By putting the range check into user_access_begin(), we actually force people to do the right thing (tm), and the range check vill be visible near the actual accesses. We have way too long a history of people trying to avoid them. Signed-off-by: Linus Torvalds arch/x86/include/asm/uaccess.h | 9 ++++++++- drivers/gpu/drm/i915/i915_gem_execbuffer.c | 15 +++++++++++++-- include/linux/uaccess.h | 2 +- kernel/compat.c | 6 ++---- kernel/exit.c | 6 ++---- lib/strncpy_from_user.c | 9 +++++---- lib/strnlen_user.c | 9 +++++---- 7 files changed, 36 insertions(+), 20 deletions(-) commit f8c468e8537925e0c4607263f498a1b7c0c8982e Author: David Rientjes Date: Wed Jan 2 13:01:43 2019 -0800 net, skbuff: do not prefer skb allocation fails early Commit dcda9b04713c ("mm, tree wide: replace __GFP_REPEAT by __GFP_RETRY_MAYFAIL with more useful semantic") replaced __GFP_REPEAT in alloc_skb_with_frags() with __GFP_RETRY_MAYFAIL when the allocation may directly reclaim. The previous behavior would require reclaim up to 1 << order pages for skb aligned header_len of order > PAGE_ALLOC_COSTLY_ORDER before failing, otherwise the allocations in alloc_skb() would loop in the page allocator looking for memory. __GFP_RETRY_MAYFAIL makes both allocations failable under memory pressure, including for the HEAD allocation. This can cause, among many other things, write() to fail with ENOTCONN during RPC when under memory pressure. These allocations should succeed as they did previous to dcda9b04713c even if it requires calling the oom killer and additional looping in the page allocator to find memory. There is no way to specify the previous behavior of __GFP_REPEAT, but it's unlikely to be necessary since the previous behavior only guaranteed that 1 << order pages would be reclaimed before failing for order > PAGE_ALLOC_COSTLY_ORDER. That reclaim is not guaranteed to be contiguous memory, so repeating for such large orders is usually not beneficial. Removing the setting of __GFP_RETRY_MAYFAIL to restore the previous behavior, specifically not allowing alloc_skb() to fail for small orders and oom kill if necessary rather than allowing RPCs to fail. Fixes: dcda9b04713c ("mm, tree wide: replace __GFP_REPEAT by __GFP_RETRY_MAYFAIL with more useful semantic") Signed-off-by: David Rientjes Reviewed-by: Eric Dumazet Signed-off-by: David S. Miller net/core/skbuff.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) commit 8d68100ab4ad92560a16a68b72e068613ac4d573 Author: Wen Yang Date: Thu Jan 3 01:09:53 2019 +0800 soc/fsl/qe: fix err handling of ucc_of_parse_tdm Currently there are some issues with the ucc_of_parse_tdm function: 1, a possible null pointer dereference in ucc_of_parse_tdm, detected by the semantic patch deref_null.cocci, with the following warning: drivers/soc/fsl/qe/qe_tdm.c:177:21-24: ERROR: pdev is NULL but dereferenced. 2, dev gets modified, so in any case that devm_iounmap() will fail even when the new pdev is valid, because the iomap was done with a different pdev. 3, there is no driver bind with the "fsl,t1040-qe-si" or "fsl,t1040-qe-siram" device. So allocating resources using devm_*() with these devices won't provide a cleanup path for these resources when the caller fails. This patch fixes them. Suggested-by: Li Yang Suggested-by: Christophe LEROY Signed-off-by: Wen Yang Reviewed-by: Peng Hao CC: Julia Lawall CC: Zhao Qiang CC: David S. Miller CC: netdev@vger.kernel.org CC: linuxppc-dev@lists.ozlabs.org CC: linux-kernel@vger.kernel.org Signed-off-by: David S. Miller drivers/net/wan/fsl_ucc_hdlc.c | 62 +++++++++++++++++++++++++++++++++++++++++- drivers/soc/fsl/qe/qe_tdm.c | 55 ------------------------------------- 2 files changed, 61 insertions(+), 56 deletions(-) commit 36352991835ce99e46b4441dd0eb6980f9a83e8f Author: Kai-Heng Feng Date: Wed Jan 2 14:45:07 2019 +0800 r8169: Add support for new Realtek Ethernet There are two new Realtek Ethernet devices which are re-branded r8168h. Add the IDs to to support them. Signed-off-by: Kai-Heng Feng Reviewed-by: Heiner Kallweit Signed-off-by: David S. Miller drivers/net/ethernet/realtek/r8169.c | 2 ++ 1 file changed, 2 insertions(+) commit 7c1e8a3817c55d73b27cc29b84075999c8894179 Author: Arthur Gautier Date: Mon Dec 31 02:10:58 2018 +0000 netlink: fixup regression in RTM_GETADDR This commit fixes a regression in AF_INET/RTM_GETADDR and AF_INET6/RTM_GETADDR. Before this commit, the kernel would stop dumping addresses once the first skb was full and end the stream with NLMSG_DONE(-EMSGSIZE). The error shouldn't be sent back to netlink_dump so the callback is kept alive. The userspace is expected to call back with a new empty skb. Changes from V1: - The error is not handled in netlink_dump anymore but rather in inet_dump_ifaddr and inet6_dump_addr directly as suggested by David Ahern. Fixes: d7e38611b81e ("net/ipv4: Put target net when address dump fails due to bad attributes") Fixes: 242afaa6968c ("net/ipv6: Put target net when address dump fails due to bad attributes") Cc: David Ahern Cc: "David S . Miller" Cc: netdev@vger.kernel.org Signed-off-by: Arthur Gautier Reviewed-by: David Ahern Signed-off-by: David S. Miller net/ipv4/devinet.c | 2 +- net/ipv6/addrconf.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 1492623e837fe7ca6296f7f5411328307e242771 Author: Christophe JAILLET Date: Sat Dec 29 17:42:22 2018 +0100 octeontx2-af: Fix a resource leak in an error handling path in 'cgx_probe()' If an error occurs after the call to 'pci_alloc_irq_vectors()', we must call 'pci_free_irq_vectors()' in order to avoid a resource leak. The same sequence is already in place in the corresponding 'cgx_remove()' function. Fixes: 1463f382f58d ("octeontx2-af: Add support for CGX link management") Signed-off-by: Christophe JAILLET Signed-off-by: David S. Miller drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit e4f2283cc6ffefbe414317a0d89b602811b577ac Merge: 4addd2640fca a40612ef0ee1 f91528955d00 Author: Al Viro Date: Fri Jan 4 14:02:59 2019 -0500 Merge branches 'misc.misc' and 'work.iov_iter' into for-linus commit 0b2c8f8b6b0c7530e2866c95862546d0da2057b0 Author: Linus Torvalds Date: Fri Jan 4 10:23:10 2019 -0800 i915: fix missing user_access_end() in page fault exception case When commit fddcd00a49e9 ("drm/i915: Force the slow path after a user-write error") unified the error handling for various user access problems, it didn't do the user_access_end() that is needed for the unsafe_put_user() case. It's not a huge deal: a missed user_access_end() will only mean that SMAP protection isn't active afterwards, and for the error case we'll be returning to user mode soon enough anyway. But it's wrong, and adding the proper user_access_end() is trivial enough (and doing it for the other error cases where it isn't needed doesn't hurt). I noticed it while doing the same prep-work for changing user_access_begin() that precipitated the access_ok() changes in commit 96d4f267e40f ("Remove 'type' argument from access_ok() function"). Fixes: fddcd00a49e9 ("drm/i915: Force the slow path after a user-write error") Cc: Chris Wilson Cc: Joonas Lahtinen Cc: stable@kernel.org # v4.20 Signed-off-by: Linus Torvalds drivers/gpu/drm/i915/i915_gem_execbuffer.c | 1 + 1 file changed, 1 insertion(+) commit 03fa483821c0b4db7c2b1453d3332f397d82313f Author: Arnaldo Carvalho de Melo Date: Fri Jan 4 15:10:00 2019 -0300 perf test shell: Use a fallback to get the pathname in vfs_getname Some kernels, like 4.19.13-300.fc29.x86_64 in fedora 29, fail with the existing probe definition asking for the contents of result->name, working when we ask for the 'filename' variable instead, so add a fallback to that. Now those tests are back working on fedora 29 systems with that kernel: # perf test vfs_getname 65: Use vfs_getname probe to get syscall args filenames : Ok 66: Add vfs_getname probe to get syscall args filenames : Ok 67: Check open filename arg using perf trace + vfs_getname: Ok # Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-klt3n0i58dfqttveti09q3fi@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/tests/shell/lib/probe_vfs_getname.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 4caf4ebfe4cf0ea262eb9e829bb254a6a6d58acc Author: Linus Torvalds Date: Fri Jan 4 09:58:25 2019 -0800 Fix access_ok() fallout for sparc32 and powerpc These two architectures actually had an intentional use of the 'type' argument to access_ok() just to avoid warnings. I had actually noticed the powerpc one, but forgot to then fix it up. And I missed the sparc32 case entirely. This is hopefully all of it. Reported-by: Mathieu Malaterre Reported-by: Guenter Roeck Fixes: 96d4f267e40f ("Remove 'type' argument from access_ok() function") Signed-off-by: Linus Torvalds arch/powerpc/include/asm/uaccess.h | 2 +- arch/sparc/include/asm/uaccess_32.h | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-) commit 1f8ce09b36c41a026a37a24b20efa32000892a64 Author: YueHaibing Date: Fri Jan 4 06:03:40 2019 +0000 xen/pvcalls: remove set but not used variable 'intf' Fixes gcc '-Wunused-but-set-variable' warning: drivers/xen/pvcalls-back.c: In function 'pvcalls_sk_state_change': drivers/xen/pvcalls-back.c:286:28: warning: variable 'intf' set but not used [-Wunused-but-set-variable] It not used since e6587cdbd732 ("pvcalls-back: set -ENOTCONN in pvcalls_conn_back_read") Signed-off-by: YueHaibing Reviewed-by: Boris Ostrovsky Signed-off-by: Boris Ostrovsky drivers/xen/pvcalls-back.c | 2 -- 1 file changed, 2 deletions(-) commit f712a86c1406abf50b0dcff0500c723e2aca050a Author: Arnaldo Carvalho de Melo Date: Thu Jan 3 16:03:46 2019 -0300 perf python: Make sure the python binding output directory is in place Instead of doing an unconditional mkdir, use a dummy Makefile variable to check if the directory is there and if not, create it. This is better than what we had and will help with other python bindings that are in development, like one involved with python backtraces. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-iis6us2nocw3y4uuoon9osd7@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/Makefile.perf | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 099be748865eece21362aee416c350c0b1ae34df Author: Mattias Jacobsson <2pi@mok.nu> Date: Sat Dec 29 15:17:50 2018 +0100 perf strbuf: Remove redundant va_end() in strbuf_addv() Each call to va_copy() should have one, and only one, corresponding call to va_end(). In strbuf_addv() some code paths result in va_end() getting called multiple times. Remove the superfluous va_end(). Signed-off-by: Mattias Jacobsson <2pi@mok.nu> Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Sanskriti Sharma Link: http://lkml.kernel.org/r/20181229141750.16945-1-2pi@mok.nu Fixes: ce49d8436cff ("perf strbuf: Match va_{add,copy} with va_end") Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/strbuf.c | 1 - 1 file changed, 1 deletion(-) commit 442b4eb3af44906fcbb526d98c314b27f8c9acf3 Author: Ivan Krylov Date: Sun Oct 14 11:18:03 2018 +0300 perf annotate: Pass filename to objdump via execl The symbol__disassemble() function uses shell to launch objdump and filter its output via grep. Passing filenames by interpolating them into the command line via "%s" may lead to problems if said filenames contain special characters. Instead, pass the filename as a command line argument where it is not subject to any kind of interpretation, then use quoted shell interpolation to build the strings we need safely. Signed-off-by: Ivan Krylov Acked-by: Jiri Olsa Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/20181014111803.5d83b806@Tarkus Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/annotate.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit a3366db06bb656cef2e03f30f780d93059bcc594 Author: Jin Yao Date: Fri Jan 4 14:10:30 2019 +0800 perf report: Fix wrong iteration count in --branch-history By calculating the removed loops, we can get the iteration count. But the iteration count could be reported incorrectly, reporting impossibly high counts. That's because previous code uses the number of removed LBR entries for the iteration count. That's not good. Fix this by increasing the iteration count when a loop is detected. When matching the chain, the iteration count would be added up, finally we need to compute the average value when printing out. For example, $ perf report --branch-history --stdio --no-children Before: ---f2 +0 | |--33.62%--f1 +9 (cycles:1) | f1 +0 | main +22 (cycles:1) | main +17 | main +38 (cycles:1) | main +27 | f1 +26 (cycles:1) | f1 +24 | f2 +27 (cycles:7) | f2 +0 | f1 +19 (cycles:1) | f1 +14 | f2 +27 (cycles:11) | f2 +0 | f1 +9 (cycles:1 iter:2968 avg_cycles:3) | f1 +0 | main +22 (cycles:1 iter:2968 avg_cycles:3) | main +17 | main +38 (cycles:1 iter:2968 avg_cycles:3) 2968 is an impossible high iteration count and avg_cycles is too small. After: ---f2 +0 | |--33.62%--f1 +9 (cycles:1) | f1 +0 | main +22 (cycles:1) | main +17 | main +38 (cycles:1) | main +27 | f1 +26 (cycles:1) | f1 +24 | f2 +27 (cycles:7) | f2 +0 | f1 +19 (cycles:1) | f1 +14 | f2 +27 (cycles:11) | f2 +0 | f1 +9 (cycles:1 iter:1 avg_cycles:23) | f1 +0 | main +22 (cycles:1 iter:1 avg_cycles:23) | main +17 | main +38 (cycles:1 iter:1 avg_cycles:23) avg_cycles:23 is the average cycles of this iteration. Fixes: c4ee06251d42 ("perf report: Calculate the average cycles of iterations") Signed-off-by: Jin Yao Cc: Alexander Shishkin Cc: Andi Kleen Cc: Jiri Olsa Cc: Kan Liang Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/1546582230-17507-1-git-send-email-yao.jin@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/callchain.c | 32 ++++++++++++++++++++------------ tools/perf/util/callchain.h | 1 + tools/perf/util/machine.c | 2 +- 3 files changed, 22 insertions(+), 13 deletions(-) commit 86c22ab7227f59169f64275875c97ef495668b77 Author: Arnaldo Carvalho de Melo Date: Fri Jan 4 12:13:34 2019 -0300 tools headers x86: Sync asm/cpufeatures.h copy with the kernel sources To get the changes from: a0aea130afeb ("KVM: x86: Add CPUID support for new instruction WBNOINVD") 20c3a2c33e9f ("x86/speculation: Add support for STIBP always-on preferred mode") Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Cc: Paolo Bonzini Cc: Robert Hoo Cc: Thomas Gleixner Cc: Thomas Lendacky Link: https://lkml.kernel.org/n/tip-aonti3bu9rhnqe5hlawbidcp@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/arch/x86/include/asm/cpufeatures.h | 2 ++ 1 file changed, 2 insertions(+) commit 8c91fd605e1a66050c9c4dbc3e159a08e8c5f7d4 Author: Arnaldo Carvalho de Melo Date: Fri Jan 4 12:08:31 2019 -0300 tools headers uapi: Sync copy of asm-generic/unistd.h with the kernel sources To get the changes in: b7d624ab4312 asm-generic: unistd.h: fixup broken macro include. 4e21565b7fd4 asm-generic: add kexec_file_load system call to unistd.h With this the 'kexec_file_load' syscall will be added to arm64's syscall table and will appear on the output of 'perf trace' on that platform. This silences this tools/perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/asm-generic/unistd.h' differs from latest version at 'include/uapi/asm-generic/unistd.h' diff -u tools/include/uapi/asm-generic/unistd.h include/uapi/asm-generic/unistd.h Cc: Adrian Hunter Cc: AKASHI Takahiro Cc: Arnd Bergmann Cc: Guo Ren Cc: Jiri Olsa Cc: Namhyung Kim Cc: Will Deacon Link: https://lkml.kernel.org/n/tip-er8j7qhavtdw0kdga3zswynm@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/include/uapi/asm-generic/unistd.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 558517c52c87da91a963708fe589044172470653 Author: Arnaldo Carvalho de Melo Date: Fri Jan 4 11:45:03 2019 -0300 tools headers uapi: Sync linux/kvm.h with the kernel sources To get the changes from these csets: 2bc39970e932 ("x86/kvm/hyper-v: Introduce KVM_GET_SUPPORTED_HV_CPUID") 2a31b9db1535 ("kvm: introduce manual dirty log reprotect") That results in these new KVM IOCTLs being supported in 'perf trace' when beautifying the cmd ioctl syscall argument: $ cp include/uapi/linux/kvm.h tools/include/uapi/linux/kvm.h $ tools/perf/trace/beauty/kvm_ioctl.sh > after $ diff -u before after --- before 2019-01-04 11:44:23.506605301 -0300 +++ after 2019-01-04 11:44:36.878730583 -0300 @@ -86,6 +86,8 @@ [0xbd] = "HYPERV_EVENTFD", [0xbe] = "GET_NESTED_STATE", [0xbf] = "SET_NESTED_STATE", + [0xc0] = "CLEAR_DIRTY_LOG", + [0xc1] = "GET_SUPPORTED_HV_CPUID", [0xe0] = "CREATE_DEVICE", [0xe1] = "SET_DEVICE_ATTR", [0xe2] = "GET_DEVICE_ATTR", $ At some point we should be able to do something: # perf trace -e ioctl(cmd == KVM_CLEAR_DIRTY_LOG) And have just those ioctls, optionally with callchains, etc. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Cc: Paolo Bonzini Cc: Vitaly Kuznetsov Link: https://lkml.kernel.org/n/tip-konm3iigl2os6ritt7d2bori@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/include/uapi/linux/kvm.h | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) commit 4001b6a080aaca9a13ea07ae8972b82fdbd9ea6b Author: Arnaldo Carvalho de Melo Date: Fri Jan 4 11:41:42 2019 -0300 tools headers uapi: Sync linux/in.h copy from the kernel sources To get the changes in this cset: 65cab850f0ee ("net: Allow class-e address assignment via ifconfig ioctl") The macros changed in this cset are not used in tools/, so this is just to silence this perf tools build warning: Warning: Kernel ABI header at 'tools/include/uapi/linux/in.h' differs from latest version at 'include/uapi/linux/in.h' diff -u tools/include/uapi/linux/in.h include/uapi/linux/in.h Cc: Dave Taht Cc: David S. Miller Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-smghvyxb3budqd1e70i0ylw1@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/include/uapi/linux/in.h | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) commit 8858ecb5a28d871b79aa5b4eed45414b553a5b6e Author: Arnaldo Carvalho de Melo Date: Fri Jan 4 11:36:10 2019 -0300 tools headers uapi: Update i915_drm.h To get the changes in these csets: fe841686470d Revert "drm/i915/perf: add a parameter to control the size of OA buffer" cd956bfcd0f5 drm/i915/perf: add a parameter to control the size of OA buffer 4bdafb9ddfa4 drm/i915: Remove i915.enable_ppgtt override Not one of them result in any changes in tools/perf/, this is just to silence this perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/drm/i915_drm.h' differs from latest version at 'include/uapi/drm/i915_drm.h' diff -u tools/include/uapi/drm/i915_drm.h include/uapi/drm/i915_drm.h Cc: Adrian Hunter Cc: Chris Wilson Cc: Jiri Olsa Cc: Joonas Lahtinen Cc: Lionel Landwerlin Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-mdw7ta6qz7d2rl77gf00uqe8@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/include/uapi/drm/i915_drm.h | 8 ++++++++ 1 file changed, 8 insertions(+) commit 536cdb684d2d5139708d290b9dc124b1420886c1 Author: Jiri Olsa Date: Thu Jan 3 17:13:50 2019 +0100 tools iio: Override CFLAGS assignments So user could specify outside CFLAGS values. Signed-off-by: Jiri Olsa Cc: Alexander Shishkin Cc: Andy Shevchenko Cc: Hartmut Knaack Cc: Jonathan Cameron Cc: Lars-Peter Clausen Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/20190103161350.11446-3-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/iio/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 302df34c4e64b9e83ee31cbf508b38b62b428bd6 Author: Jiri Olsa Date: Thu Jan 3 17:13:49 2019 +0100 tools thermal tmon: Use -O3 instead of -O1 if available Using -O3 instead of -O1 if it's supported by compiler. Signed-off-by: Jiri Olsa Cc: Alexander Shishkin Cc: Brian Norris Cc: Markus Mayer Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Zhang Rui Link: http://lkml.kernel.org/r/20190103161350.11446-2-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/thermal/tmon/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6175471755075d256c1c654151fc1cad183c1e33 Author: Peter Ujfalusi Date: Thu Jan 3 16:05:50 2019 +0200 ASoC: ti: davinci-mcasp: Move context save/restore to runtime_pm callbacks McASP can loose it's context when runtime_pm is disabled. Save and restore the context when suspending and resuming the device. Signed-off-by: Peter Ujfalusi Signed-off-by: Mark Brown sound/soc/ti/davinci-mcasp.c | 136 ++++++++++++++++++++----------------------- 1 file changed, 64 insertions(+), 72 deletions(-) commit 6de92920a717ea2b7b45bb3d651b8bb951eab185 Merge: 97b6f89f7269 07a496de4c7e Author: Russell King Date: Fri Jan 4 14:34:46 2019 +0000 Merge commit 'smp-hotplug^{/omap2}' into for-linus commit 7e0b44e870cf265bb4a73fd25e0508c7363fcbd6 Author: Will Deacon Date: Thu Jan 3 17:55:12 2019 +0000 arm64: compat: Hook up io_pgetevents() for 32-bit tasks Commit 73aeb2cbcdc9 ("ARM: 8787/1: wire up io_pgetevents syscall") hooked up the io_pgetevents() system call for 32-bit ARM, so we can do the same for the compat wrapper on arm64. Signed-off-by: Will Deacon arch/arm64/include/asm/unistd.h | 2 +- arch/arm64/include/asm/unistd32.h | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) commit 53290432145a8eb143fe29e06e9c1465d43dc723 Author: Will Deacon Date: Thu Jan 3 18:00:39 2019 +0000 arm64: compat: Don't pull syscall number from regs in arm_compat_syscall The syscall number may have been changed by a tracer, so we should pass the actual number in from the caller instead of pulling it from the saved r7 value directly. Cc: Cc: Pi-Hsun Shih Reviewed-by: Dave Martin Signed-off-by: Will Deacon arch/arm64/kernel/sys_compat.c | 9 ++++----- arch/arm64/kernel/syscall.c | 9 ++++----- 2 files changed, 8 insertions(+), 10 deletions(-) commit 169113ece0f29ebe884a6cfcf57c1ace04d8a36a Author: Will Deacon Date: Thu Jan 3 17:45:07 2019 +0000 arm64: compat: Avoid sending SIGILL for unallocated syscall numbers The ARM Linux kernel handles the EABI syscall numbers as follows: 0 - NR_SYSCALLS-1 : Invoke syscall via syscall table NR_SYSCALLS - 0xeffff : -ENOSYS (to be allocated in future) 0xf0000 - 0xf07ff : Private syscall or -ENOSYS if not allocated > 0xf07ff : SIGILL Our compat code gets this wrong and ends up sending SIGILL in response to all syscalls greater than NR_SYSCALLS which have a value greater than 0x7ff in the bottom 16 bits. Fix this by defining the end of the ARM private syscall region and checking the syscall number against that directly. Update the comment while we're at it. Cc: Cc: Dave Martin Reported-by: Pi-Hsun Shih Signed-off-by: Will Deacon arch/arm64/include/asm/unistd.h | 5 +++-- arch/arm64/kernel/sys_compat.c | 4 ++-- 2 files changed, 5 insertions(+), 4 deletions(-) commit 8c3590de0a378c2449fc1aec127cc693632458e4 Author: Yizhuo Date: Thu Jan 3 13:59:12 2019 -0800 ASoC: Variable "val" in function rt274_i2c_probe() could be uninitialized Inside function rt274_i2c_probe(), if regmap_read() function returns -EINVAL, then local variable "val" leaves uninitialized but used in if statement. This is potentially unsafe. Signed-off-by: Yizhuo Signed-off-by: Mark Brown sound/soc/codecs/rt274.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 9966a05c7b80f075f2bc7e48dbb108d3f2927234 Author: Dave Martin Date: Fri Jan 4 13:09:51 2019 +0000 arm64/sve: Disentangle from Currently, provides common definitions for describing SVE context structures that are also used by the ptrace definitions in . For this reason, a #include of was added in ptrace.h, but it this turns out that this can interact badly with userspace code that tries to include ptrace.h on top of the libc headers (which may provide their own shadow definitions for sigcontext.h). To make the headers easier for userspace to consume, this patch bounces the common definitions into an __SVE_* namespace and moves them to a backend header that can be included by the other headers as appropriate. This should allow ptrace.h to be used alongside libc's sigcontext.h (if any) without ill effects. This should make the situation unambiguous: is the header to include for the sigframe-specific definitions, while is the header to include for ptrace-specific definitions. To avoid conflicting with existing usage, remains the canonical way to get the common definitions for SVE_VQ_MIN, sve_vq_from_vl() etc., both in userspace and in the kernel: relying on these being defined as a side effect of including just was never intended to be safe. Signed-off-by: Dave Martin Signed-off-by: Will Deacon arch/arm64/include/uapi/asm/ptrace.h | 39 ++++++++++----------- arch/arm64/include/uapi/asm/sigcontext.h | 56 +++++++++++++++---------------- arch/arm64/include/uapi/asm/sve_context.h | 53 +++++++++++++++++++++++++++++ 3 files changed, 99 insertions(+), 49 deletions(-) commit ee1b465b303591d3a04d403122bbc0d7026520fb Author: Dave Martin Date: Fri Jan 4 13:09:50 2019 +0000 arm64/sve: ptrace: Fix SVE_PT_REGS_OFFSET definition SVE_PT_REGS_OFFSET is supposed to indicate the offset for skipping over the ptrace NT_ARM_SVE header (struct user_sve_header) to the start of the SVE register data proper. However, currently SVE_PT_REGS_OFFSET is defined in terms of struct sve_context, which is wrong: that structure describes the SVE header in the signal frame, not in the ptrace regset. This patch fixes the definition to use the ptrace header structure struct user_sve_header instead. By good fortune, the two structures are the same size anyway, so there is no functional or ABI change. Signed-off-by: Dave Martin Signed-off-by: Will Deacon arch/arm64/include/uapi/asm/ptrace.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 074400a7be61250d9f0ccec07d5c35ffec4d8d22 Author: Mathieu Malaterre Date: Fri Jan 4 10:27:58 2019 +0100 powerpc: Drop use of 'type' from access_ok() In commit 05a4ab823983 ("powerpc/uaccess: fix warning/error with access_ok()") an attempt was made to remove a warning by referencing the variable `type`. However in commit 96d4f267e40f ("Remove 'type' argument from access_ok() function") the variable `type` has been removed, breaking the build: arch/powerpc/include/asm/uaccess.h:66:32: error: ‘type’ undeclared (first use in this function) This essentially reverts commit 05a4ab823983 ("powerpc/uaccess: fix warning/error with access_ok()") to fix the error. Fixes: 96d4f267e40f ("Remove 'type' argument from access_ok() function") Signed-off-by: Mathieu Malaterre [mpe: Reword change log slightly.] Signed-off-by: Michael Ellerman arch/powerpc/include/asm/uaccess.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1690d8bb91e370ab772062b79bd434ce815c4729 Author: Viresh Kumar Date: Fri Jan 4 15:14:33 2019 +0530 cpufreq: scpi/scmi: Fix freeing of dynamic OPPs Since the commit 2a4eb7358aba "OPP: Don't remove dynamic OPPs from _dev_pm_opp_remove_table()", dynamically created OPP aren't automatically removed anymore by dev_pm_opp_cpumask_remove_table(). This affects the scpi and scmi cpufreq drivers which no longer free OPPs on failures or on invocations of the policy->exit() callback. Create a generic OPP helper dev_pm_opp_remove_all_dynamic() which can be called from these drivers instead of dev_pm_opp_cpumask_remove_table(). In dev_pm_opp_remove_all_dynamic(), we need to make sure that the opp_list isn't getting accessed simultaneously from other parts of the OPP core while the helper is freeing dynamic OPPs, i.e. we can't drop the opp_table->lock while traversing through the OPP list. And to accomplish that, this patch also creates _opp_kref_release_unlocked() which can be called from this new helper with the opp_table lock already held. Cc: 4.20 # v4.20 Reported-by: Valentin Schneider Fixes: 2a4eb7358aba "OPP: Don't remove dynamic OPPs from _dev_pm_opp_remove_table()" Signed-off-by: Viresh Kumar Tested-by: Valentin Schneider Reviewed-by: Sudeep Holla Signed-off-by: Rafael J. Wysocki drivers/cpufreq/scmi-cpufreq.c | 4 +-- drivers/cpufreq/scpi-cpufreq.c | 4 +-- drivers/opp/core.c | 63 ++++++++++++++++++++++++++++++++++++++---- include/linux/pm_opp.h | 5 ++++ 4 files changed, 67 insertions(+), 9 deletions(-) commit d538d94f0ca86cfedc892cc427169219acb3c2f7 Merge: f460772291f8 96d4f267e40f Author: Michael Ellerman Date: Fri Jan 4 22:07:47 2019 +1100 Merge branch 'master' into fixes We have a fix to apply on top of commit 96d4f267e40f ("Remove 'type' argument from access_ok() function"), so merge master to get it. commit 09ad32dc6dc23beb638c48d0a2e5a9eaa8e85c6c Author: Rafael J. Wysocki Date: Thu Jan 3 11:30:07 2019 +0100 cpuidle / Documentation: Update cpuidle MAINTAINERS entry Update the MAINTAINERS entry for cpuidle by making it clear that it is not just drivers and adding a documentation record to it. Signed-off-by: Rafael J. Wysocki MAINTAINERS | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit eb4f5213251833567570df1a09803f895653274d Author: Shaokun Zhang Date: Fri Jan 4 14:21:34 2019 +0800 drivers/perf: hisi: Fixup one DDRC PMU register offset For DDRC PMU, each PMU counter is fixed-purpose. There is a mismatch between perf list and driver definition on rw_chg event. # perf list | grep chg hisi_sccl1_ddrc0/rnk_chg/ [Kernel PMU event] hisi_sccl1_ddrc0/rw_chg/ [Kernel PMU event] But the register offset of rw_chg event is not defined in the driver, meanwhile bnk_chg register offset is mis-defined, let's fixup it. Fixes: 904dcf03f086 ("perf: hisi: Add support for HiSilicon SoC DDRC PMU driver") Cc: stable@vger.kernel.org Cc: John Garry Cc: Will Deacon Cc: Mark Rutland Reported-by: Weijian Huang Signed-off-by: Shaokun Zhang Signed-off-by: Will Deacon drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 2f328fea47ac9020ac47c88dd01cd8f93da55bcc Author: Masahiro Yamada Date: Fri Jan 4 09:18:41 2019 +0900 arm64: replace arm64-obj-* in Makefile with obj-* Use the standard obj-$(CONFIG_...) syntex. The behavior is still the same. Signed-off-by: Masahiro Yamada Signed-off-by: Will Deacon arch/arm64/kernel/Makefile | 61 +++++++++++++++++++++++----------------------- 1 file changed, 30 insertions(+), 31 deletions(-) commit 48e638fb68be8fecdca0611beff53a9c947704e3 Author: Christoph Hellwig Date: Tue Jan 1 17:14:39 2019 +0100 dma-mapping: remove a few unused exports Now that the slow path DMA API calls are implemented out of line a few helpers only used by them don't need to be exported anymore. Signed-off-by: Christoph Hellwig kernel/dma/coherent.c | 2 -- kernel/dma/debug.c | 2 -- 2 files changed, 4 deletions(-) commit ed6ccf10f24bdfc1955bc8b976ddedc370fc3869 Author: Christoph Hellwig Date: Wed Dec 26 07:52:13 2018 +0100 dma-mapping: properly stub out the DMA API for !CONFIG_HAS_DMA This avoids link failures in drivers using the DMA API, when they are compiled for user mode Linux with CONFIG_COMPILE_TEST=y. Fixes: 356da6d0cd ("dma-mapping: bypass indirect calls for dma-direct") Signed-off-by: Christoph Hellwig include/linux/dma-mapping.h | 255 ++++++++++++++++++++++++++++---------------- 1 file changed, 164 insertions(+), 91 deletions(-) commit 4788ba5792cc1368ba4867e1488dc168b4fe97b7 Author: Christoph Hellwig Date: Wed Dec 26 07:51:44 2018 +0100 dma-mapping: remove dmam_{declare,release}_coherent_memory These functions have never been used. Signed-off-by: Christoph Hellwig Documentation/driver-model/devres.txt | 1 - include/linux/dma-mapping.h | 19 ------------ kernel/dma/mapping.c | 55 ----------------------------------- 3 files changed, 75 deletions(-) commit d7076f07840851bbe57cb21ba052d6a4a9b1efa9 Author: Christoph Hellwig Date: Tue Dec 25 17:44:19 2018 +0100 dma-mapping: implement dmam_alloc_coherent using dmam_alloc_attrs dmam_alloc_coherent is just the default no-flags case of dmam_alloc_attrs, so take advantage of this similar to the non-managed version. Signed-off-by: Christoph Hellwig include/linux/dma-mapping.h | 20 +++++++++++++------- kernel/dma/mapping.c | 39 --------------------------------------- 2 files changed, 13 insertions(+), 46 deletions(-) commit 2e05ea5cdc1ac55d9ef678ed5ea6c38acf7fd2a3 Author: Christoph Hellwig Date: Tue Dec 25 08:50:35 2018 +0100 dma-mapping: implement dma_map_single_attrs using dma_map_page_attrs And also switch the way we implement the unmap side around to stay consistent. This ensures dma-debug works again because it records which function we used for mapping to ensure it is also used for unmapping, and also reduces further code duplication. Last but not least this also officially allows calling dma_sync_single_* for mappings created using dma_map_page, which is perfectly fine given that the sync calls only take a dma_addr_t, but not a virtual address or struct page. Fixes: 7f0fee242e ("dma-mapping: merge dma_unmap_page_attrs and dma_unmap_single_attrs") Signed-off-by: Christoph Hellwig Tested-by: LABBE Corentin include/linux/dma-debug.h | 11 +++----- include/linux/dma-mapping.h | 66 +++++++++++++++++---------------------------- kernel/dma/debug.c | 17 +++--------- 3 files changed, 32 insertions(+), 62 deletions(-) commit 9ddf32a8df9e342371aaf9233d59739a356231e6 Merge: 74136a3d47f5 c75ff001f4fe Author: Dave Airlie Date: Fri Jan 4 14:09:12 2019 +1000 Merge tag 'drm-misc-next-fixes-2019-01-02' of git://anongit.freedesktop.org/drm/drm-misc into drm-next Fixes for v4.21: - Fix null pointer dereference on null state pointer. - Fix leaking damage clip when destroying plane state. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patchwork.freedesktop.org/patch/msgid/46c4dbcd-dc23-7b46-fda9-16fe33e6ceef@linux.intel.com commit dc56367cb5dbf9d593e4b12373489df9a7edb72c Author: Steven Rostedt (VMware) Date: Thu Jan 3 22:02:39 2019 -0500 sh: ftrace: Fix missing parenthesis in WARN_ON() Adding a function inside a WARN_ON() didn't close the WARN_ON parathesis. Link: http://lkml.kernel.org/r/201901020958.28Mzbs0O%fengguang.wu@intel.com Cc: linux-sh@vger.kernel.org Cc: Yoshinori Sato Cc: Rich Felker Reported-by: kbuild test robot Fixes: cec8d0e7f06e ("sh: ftrace: Use ftrace_graph_get_ret_stack() instead of curr_ret_stack") Signed-off-by: Steven Rostedt (VMware) arch/sh/kernel/dwarf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 96d4f267e40f9509e8a66e2b39e8b95655617693 Author: Linus Torvalds Date: Thu Jan 3 18:57:57 2019 -0800 Remove 'type' argument from access_ok() function Nobody has actually used the type (VERIFY_READ vs VERIFY_WRITE) argument of the user address range verification function since we got rid of the old racy i386-only code to walk page tables by hand. It existed because the original 80386 would not honor the write protect bit when in kernel mode, so you had to do COW by hand before doing any user access. But we haven't supported that in a long time, and these days the 'type' argument is a purely historical artifact. A discussion about extending 'user_access_begin()' to do the range checking resulted this patch, because there is no way we're going to move the old VERIFY_xyz interface to that model. And it's best done at the end of the merge window when I've done most of my merges, so let's just get this done once and for all. This patch was mostly done with a sed-script, with manual fix-ups for the cases that weren't of the trivial 'access_ok(VERIFY_xyz' form. There were a couple of notable cases: - csky still had the old "verify_area()" name as an alias. - the iter_iov code had magical hardcoded knowledge of the actual values of VERIFY_{READ,WRITE} (not that they mattered, since nothing really used it) - microblaze used the type argument for a debug printout but other than those oddities this should be a total no-op patch. I tried to fix up all architectures, did fairly extensive grepping for access_ok() uses, and the changes are trivial, but I may have missed something. Any missed conversion should be trivially fixable, though. Signed-off-by: Linus Torvalds arch/alpha/include/asm/futex.h | 2 +- arch/alpha/include/asm/uaccess.h | 2 +- arch/alpha/kernel/signal.c | 12 +-- arch/alpha/lib/csum_partial_copy.c | 2 +- arch/arc/include/asm/futex.h | 2 +- arch/arc/kernel/process.c | 2 +- arch/arc/kernel/signal.c | 4 +- arch/arm/include/asm/futex.h | 4 +- arch/arm/include/asm/uaccess.h | 4 +- arch/arm/kernel/perf_callchain.c | 2 +- arch/arm/kernel/signal.c | 6 +- arch/arm/kernel/swp_emulate.c | 2 +- arch/arm/kernel/sys_oabi-compat.c | 4 +- arch/arm/kernel/traps.c | 2 +- arch/arm/oprofile/common.c | 2 +- arch/arm64/include/asm/futex.h | 2 +- arch/arm64/include/asm/uaccess.h | 8 +- arch/arm64/kernel/armv8_deprecated.c | 2 +- arch/arm64/kernel/perf_callchain.c | 4 +- arch/arm64/kernel/signal.c | 6 +- arch/arm64/kernel/signal32.c | 6 +- arch/arm64/kernel/sys_compat.c | 2 +- arch/c6x/kernel/signal.c | 4 +- arch/csky/abiv1/alignment.c | 4 +- arch/csky/include/asm/uaccess.h | 16 +--- arch/csky/kernel/signal.c | 2 +- arch/csky/lib/usercopy.c | 8 +- arch/h8300/kernel/signal.c | 4 +- arch/hexagon/include/asm/futex.h | 2 +- arch/hexagon/include/asm/uaccess.h | 3 - arch/hexagon/kernel/signal.c | 4 +- arch/hexagon/mm/uaccess.c | 2 +- arch/ia64/include/asm/futex.h | 2 +- arch/ia64/include/asm/uaccess.h | 2 +- arch/ia64/kernel/ptrace.c | 4 +- arch/ia64/kernel/signal.c | 4 +- arch/m68k/include/asm/uaccess_mm.h | 2 +- arch/m68k/include/asm/uaccess_no.h | 2 +- arch/m68k/kernel/signal.c | 4 +- arch/microblaze/include/asm/futex.h | 2 +- arch/microblaze/include/asm/uaccess.h | 23 +++--- arch/microblaze/kernel/signal.c | 4 +- arch/mips/include/asm/checksum.h | 4 +- arch/mips/include/asm/futex.h | 2 +- arch/mips/include/asm/termios.h | 4 +- arch/mips/include/asm/uaccess.h | 12 +-- arch/mips/kernel/mips-r2-to-r6-emul.c | 24 +++--- arch/mips/kernel/ptrace.c | 12 +-- arch/mips/kernel/signal.c | 12 +-- arch/mips/kernel/signal32.c | 4 +- arch/mips/kernel/signal_n32.c | 4 +- arch/mips/kernel/signal_o32.c | 8 +- arch/mips/kernel/syscall.c | 2 +- arch/mips/kernel/unaligned.c | 98 ++++++++++++------------- arch/mips/math-emu/cp1emu.c | 16 ++-- arch/mips/mm/cache.c | 2 +- arch/mips/mm/gup.c | 3 +- arch/mips/oprofile/backtrace.c | 2 +- arch/mips/sibyte/common/sb_tbprof.c | 2 +- arch/nds32/include/asm/futex.h | 2 +- arch/nds32/include/asm/uaccess.h | 11 +-- arch/nds32/kernel/perf_event_cpu.c | 11 ++- arch/nds32/kernel/signal.c | 4 +- arch/nds32/mm/alignment.c | 8 +- arch/nios2/include/asm/uaccess.h | 8 +- arch/nios2/kernel/signal.c | 2 +- arch/openrisc/include/asm/futex.h | 2 +- arch/openrisc/include/asm/uaccess.h | 8 +- arch/openrisc/kernel/signal.c | 6 +- arch/parisc/include/asm/futex.h | 2 +- arch/parisc/include/asm/uaccess.h | 2 +- arch/powerpc/include/asm/futex.h | 2 +- arch/powerpc/include/asm/uaccess.h | 8 +- arch/powerpc/kernel/align.c | 3 +- arch/powerpc/kernel/rtas_flash.c | 2 +- arch/powerpc/kernel/rtasd.c | 2 +- arch/powerpc/kernel/signal.c | 2 +- arch/powerpc/kernel/signal_32.c | 12 +-- arch/powerpc/kernel/signal_64.c | 13 ++-- arch/powerpc/kernel/syscalls.c | 2 +- arch/powerpc/kernel/traps.c | 2 +- arch/powerpc/kvm/book3s_64_mmu_hv.c | 4 +- arch/powerpc/lib/checksum_wrappers.c | 4 +- arch/powerpc/mm/fault.c | 2 +- arch/powerpc/mm/subpage-prot.c | 2 +- arch/powerpc/oprofile/backtrace.c | 4 +- arch/powerpc/platforms/cell/spufs/file.c | 16 ++-- arch/powerpc/platforms/powernv/opal-lpc.c | 4 +- arch/powerpc/platforms/pseries/scanlog.c | 2 +- arch/riscv/include/asm/futex.h | 2 +- arch/riscv/include/asm/uaccess.h | 14 +--- arch/riscv/kernel/signal.c | 4 +- arch/s390/include/asm/uaccess.h | 2 +- arch/sh/include/asm/checksum_32.h | 2 +- arch/sh/include/asm/futex.h | 2 +- arch/sh/include/asm/uaccess.h | 9 +-- arch/sh/kernel/signal_32.c | 8 +- arch/sh/kernel/signal_64.c | 8 +- arch/sh/kernel/traps_64.c | 12 +-- arch/sh/mm/gup.c | 3 +- arch/sh/oprofile/backtrace.c | 2 +- arch/sparc/include/asm/checksum_32.h | 2 +- arch/sparc/include/asm/uaccess_32.h | 2 +- arch/sparc/include/asm/uaccess_64.h | 2 +- arch/sparc/kernel/sigutil_32.c | 2 +- arch/sparc/kernel/unaligned_32.c | 7 +- arch/um/kernel/ptrace.c | 4 +- arch/unicore32/kernel/signal.c | 4 +- arch/x86/entry/vsyscall/vsyscall_64.c | 2 +- arch/x86/ia32/ia32_aout.c | 4 +- arch/x86/ia32/ia32_signal.c | 8 +- arch/x86/ia32/sys_ia32.c | 2 +- arch/x86/include/asm/checksum_32.h | 2 +- arch/x86/include/asm/pgtable_32.h | 2 +- arch/x86/include/asm/uaccess.h | 7 +- arch/x86/kernel/fpu/signal.c | 4 +- arch/x86/kernel/signal.c | 14 ++-- arch/x86/kernel/stacktrace.c | 2 +- arch/x86/kernel/vm86_32.c | 4 +- arch/x86/lib/csum-wrappers_64.c | 4 +- arch/x86/lib/usercopy_32.c | 2 +- arch/x86/lib/usercopy_64.c | 2 +- arch/x86/math-emu/fpu_system.h | 4 +- arch/x86/math-emu/load_store.c | 6 +- arch/x86/math-emu/reg_ld_str.c | 48 ++++++------ arch/x86/mm/mpx.c | 2 +- arch/x86/um/asm/checksum_32.h | 2 +- arch/x86/um/signal.c | 6 +- arch/xtensa/include/asm/checksum.h | 2 +- arch/xtensa/include/asm/futex.h | 2 +- arch/xtensa/include/asm/uaccess.h | 10 +-- arch/xtensa/kernel/signal.c | 4 +- arch/xtensa/kernel/stacktrace.c | 2 +- drivers/acpi/acpi_dbg.c | 4 +- drivers/char/generic_nvram.c | 4 +- drivers/char/mem.c | 4 +- drivers/char/nwflash.c | 2 +- drivers/char/pcmcia/cm4000_cs.c | 4 +- drivers/crypto/ccp/psp-dev.c | 6 +- drivers/firewire/core-cdev.c | 2 +- drivers/firmware/efi/test/efi_test.c | 8 +- drivers/fpga/dfl-afu-dma-region.c | 2 +- drivers/fpga/dfl-fme-pr.c | 3 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 18 ++--- drivers/gpu/drm/armada/armada_gem.c | 2 +- drivers/gpu/drm/drm_file.c | 2 +- drivers/gpu/drm/etnaviv/etnaviv_drv.c | 8 +- drivers/gpu/drm/i915/i915_gem.c | 7 +- drivers/gpu/drm/i915/i915_gem_execbuffer.c | 6 +- drivers/gpu/drm/i915/i915_gem_userptr.c | 3 +- drivers/gpu/drm/i915/i915_ioc32.c | 2 +- drivers/gpu/drm/i915/i915_perf.c | 2 +- drivers/gpu/drm/i915/i915_query.c | 2 +- drivers/gpu/drm/msm/msm_gem_submit.c | 2 +- drivers/gpu/drm/qxl/qxl_ioctl.c | 3 +- drivers/infiniband/core/uverbs_main.c | 3 +- drivers/infiniband/hw/hfi1/user_exp_rcv.c | 2 +- drivers/infiniband/hw/qib/qib_file_ops.c | 2 +- drivers/macintosh/ans-lcd.c | 2 +- drivers/macintosh/via-pmu.c | 2 +- drivers/media/pci/ivtv/ivtvfb.c | 2 +- drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 46 ++++++------ drivers/misc/vmw_vmci/vmci_host.c | 2 +- drivers/pci/proc.c | 4 +- drivers/platform/goldfish/goldfish_pipe.c | 3 +- drivers/pnp/isapnp/proc.c | 2 +- drivers/scsi/pmcraid.c | 4 +- drivers/scsi/scsi_ioctl.c | 2 +- drivers/scsi/sg.c | 16 ++-- drivers/staging/comedi/comedi_compat32.c | 24 +++--- drivers/tty/n_hdlc.c | 2 +- drivers/usb/core/devices.c | 2 +- drivers/usb/core/devio.c | 7 +- drivers/usb/gadget/function/f_hid.c | 4 +- drivers/usb/gadget/udc/atmel_usba_udc.c | 2 +- drivers/vhost/vhost.c | 16 ++-- drivers/video/fbdev/amifb.c | 4 +- drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c | 2 +- drivers/xen/privcmd.c | 6 +- fs/binfmt_aout.c | 4 +- fs/btrfs/send.c | 2 +- fs/eventpoll.c | 2 +- fs/fat/dir.c | 4 +- fs/ioctl.c | 2 +- fs/namespace.c | 2 +- fs/ocfs2/dlmfs/dlmfs.c | 4 +- fs/pstore/pmsg.c | 2 +- fs/pstore/ram_core.c | 2 +- fs/read_write.c | 13 ++-- fs/readdir.c | 10 +-- fs/select.c | 11 +-- include/asm-generic/uaccess.h | 12 +-- include/linux/regset.h | 4 +- include/linux/uaccess.h | 9 +-- include/net/checksum.h | 4 +- kernel/bpf/syscall.c | 2 +- kernel/compat.c | 16 ++-- kernel/events/core.c | 2 +- kernel/exit.c | 4 +- kernel/futex.c | 35 +++++---- kernel/printk/printk.c | 4 +- kernel/ptrace.c | 4 +- kernel/rseq.c | 6 +- kernel/sched/core.c | 4 +- kernel/signal.c | 8 +- kernel/sys.c | 2 +- kernel/trace/bpf_trace.c | 2 +- lib/bitmap.c | 4 +- lib/iov_iter.c | 8 +- lib/usercopy.c | 4 +- mm/gup.c | 6 +- mm/mincore.c | 4 +- net/batman-adv/icmp_socket.c | 2 +- net/batman-adv/log.c | 2 +- net/compat.c | 30 ++++---- net/sunrpc/sysctl.c | 2 +- security/tomoyo/common.c | 2 +- sound/core/seq/seq_clientmgr.c | 2 +- sound/isa/sb/emu8000_patch.c | 4 +- tools/perf/util/include/asm/uaccess.h | 2 +- virt/kvm/kvm_main.c | 3 +- 221 files changed, 610 insertions(+), 679 deletions(-) commit 135143b2cac43d2a1ec73b53033b9473fbbcce6d Merge: 810574ca7e2f bf77ae4c98d7 Author: Linus Torvalds Date: Thu Jan 3 14:33:46 2019 -0800 Merge tag 'locks-v4.21-2' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux Pull file locking bugfix from Jeff Layton: "This is a one-line fix for a bug that syzbot turned up in the new patches to mitigate the thundering herd when a lock is released" * tag 'locks-v4.21-2' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux: locks: fix error in locks_move_blocks() commit 810574ca7e2f95d149023f4ea247d6672f69f9af Merge: 43d86ee8c639 3e9ad24b0e91 Author: Linus Torvalds Date: Thu Jan 3 13:08:00 2019 -0800 Merge tag 'sound-fix-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Among a few HD-audio fixes, the only significant one is the regression fix on some machines like Dell XPS due to the default binding changes. We ended up reverting the whole since the fix for ASoC HD-audio driver won't be available immediately" * tag 'sound-fix-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda - Revert DSP detection on legacy HD-audio driver ALSA: hda/tegra: clear pending irq handlers ALSA: hda/realtek: Enable the headset mic auto detection for ASUS laptops commit 43d86ee8c639df750529b4d8f062b328b61c423e Merge: 645ff1e8e704 c5ee066333eb Author: Linus Torvalds Date: Thu Jan 3 12:53:47 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: "Several fixes here. Basically split down the line between newly introduced regressions and long existing problems: 1) Double free in tipc_enable_bearer(), from Cong Wang. 2) Many fixes to nf_conncount, from Florian Westphal. 3) op->get_regs_len() can throw an error, check it, from Yunsheng Lin. 4) Need to use GFP_ATOMIC in *_add_hash_mac_address() of fsl/fman driver, from Scott Wood. 5) Inifnite loop in fib_empty_table(), from Yue Haibing. 6) Use after free in ax25_fillin_cb(), from Cong Wang. 7) Fix socket locking in nr_find_socket(), also from Cong Wang. 8) Fix WoL wakeup enable in r8169, from Heiner Kallweit. 9) On 32-bit sock->sk_stamp is not thread-safe, from Deepa Dinamani. 10) Fix ptr_ring wrap during queue swap, from Cong Wang. 11) Missing shutdown callback in hinic driver, from Xue Chaojing. 12) Need to return NULL on error from ip6_neigh_lookup(), from Stefano Brivio. 13) BPF out of bounds speculation fixes from Daniel Borkmann" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (57 commits) ipv6: Consider sk_bound_dev_if when binding a socket to an address ipv6: Fix dump of specific table with strict checking bpf: add various test cases to selftests bpf: prevent out of bounds speculation on pointer arithmetic bpf: fix check_map_access smin_value test when pointer contains offset bpf: restrict unknown scalars of mixed signed bounds for unprivileged bpf: restrict stack pointer arithmetic for unprivileged bpf: restrict map value pointer arithmetic for unprivileged bpf: enable access to ax register also from verifier rewrite bpf: move tmp variable into ax register in interpreter bpf: move {prev_,}insn_idx into verifier env isdn: fix kernel-infoleak in capi_unlocked_ioctl ipv6: route: Fix return value of ip6_neigh_lookup() on neigh_create() error net/hamradio/6pack: use mod_timer() to rearm timers net-next/hinic:add shutdown callback net: hns3: call hns3_nic_net_open() while doing HNAE3_UP_CLIENT ip: validate header length on virtual device xmit tap: call skb_probe_transport_header after setting skb->dev ptr_ring: wrap back ->producer in __ptr_ring_swap_queue() net: rds: remove unnecessary NULL check ... commit d5c7076b772ad7dcdb92303397b36aee8fa0d25d Author: Steve French Date: Thu Jan 3 02:37:21 2019 -0600 smb3: add smb3.1.1 to default dialect list SMB3.1.1 dialect has additional security (among other) features and should be requested when mounting to modern servers so it can be used if the server supports it. Add SMB3.1.1 to the default list of dialects requested. Signed-off-by: Steve French Reviewed-by: Ronnie Sahlberg fs/cifs/smb2pdu.c | 40 +++++++++++++++++++++++++++------------- fs/cifs/smb2pdu.h | 2 +- 2 files changed, 28 insertions(+), 14 deletions(-) commit cdd6a4a0e2ec590c30ad0e965fa08bf37461cadb Author: Enric Balletbo i Serra Date: Mon Dec 17 10:54:09 2018 +0100 MAINTAINERS: add maintainers for ChromeOS EC sub-drivers There are multiple ChromeOS EC sub-drivers spread in different subsystems, as all of them are related to the Chrome stuff add Benson and myself as a maintainers for all these sub-drivers. Signed-off-by: Enric Balletbo i Serra Signed-off-by: Benson Leung Acked-by: Wolfram Sang Acked-by: Chanwoo Choi Acked-by: Jonathan Cameron Acked-by: Alexandre Belloni Acked-by: Lee Jones Acked-by: Sebastian Reichel Acked-by: Guenter Roeck MAINTAINERS | 9 +++++++++ 1 file changed, 9 insertions(+) commit 4d5a91fd1f42a821d14b92b082b8e71be9911ba5 Author: Wei Yongjun Date: Thu Jan 3 07:02:30 2019 +0000 hwspinlock: fix return value check in stm32_hwspinlock_probe() In case of error, the function devm_ioremap_resource() returns ERR_PTR() and never returns NULL. The NULL test in the return value check should be replaced with IS_ERR(). Fixes: f24fcff1d267 ("hwspinlock: add STM32 hwspinlock device") Acked-by: Benjamin Gaignard Signed-off-by: Wei Yongjun Signed-off-by: Bjorn Andersson drivers/hwspinlock/stm32_hwspinlock.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 81482d13f37b1c9354d9bf5491699d993b193246 Author: Parthiban Nallathambi Date: Tue Dec 11 09:04:47 2018 +0100 i2c: Add Actions Semiconductor Owl family S700 I2C support Add S700 to the list of devices supported by Owl I2C driver. Add Actions Semiconductor Owl family S700 I2C driver. Signed-off-by: Parthiban Nallathambi Reviewed-by: Manivannan Sadhasivam Signed-off-by: Wolfram Sang drivers/i2c/busses/i2c-owl.c | 1 + 1 file changed, 1 insertion(+) commit 78c0c25a8c08d76d12dd682de259f303baf25770 Author: Parthiban Nallathambi Date: Tue Dec 11 09:04:45 2018 +0100 dt-bindings: i2c: Add S700 support for Actions Semi Soc's Add s700 compatible string to Actions Semi SoC dt-bindings. Signed-off-by: Parthiban Nallathambi Reviewed-by: Rob Herring Signed-off-by: Wolfram Sang Documentation/devicetree/bindings/i2c/i2c-owl.txt | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 5cda2d86de3ef7c926e441481c8e46ae3d1943cf Author: Jarkko Nikula Date: Wed Dec 19 09:01:58 2018 +0200 i2c: ismt: Add support for Intel Cedar Fork Add PCI ID for the Intel Cedar Fork iSMT SMBus controller. Signed-off-by: Jarkko Nikula Acked-by: Neil Horman [wsa: kept sorting] Signed-off-by: Wolfram Sang drivers/i2c/busses/i2c-ismt.c | 2 ++ 1 file changed, 2 insertions(+) commit 805e4c8b61bd62f6d3f416c915cb9bb423835fee Author: Arnaldo Carvalho de Melo Date: Thu Jan 3 14:59:11 2019 -0300 tools beauty: Make the prctl option table generator catch all PR_ options In ba8308856564 ("arm64: add prctl control for resetting ptrauth keys") the PR_PAC_RESET_KEYS prctl option was introduced, get that into the regex in addition to PR_GET_* and PR_SET_*: So just get everything that matches '^#define PR_\w+' this ends up adding these entries: $ tools/perf/trace/beauty/prctl_option.sh > after $ diff -u before after --- before 2019-01-03 14:58:51.541807353 -0300 +++ after 2019-01-03 15:17:05.909583804 -0300 @@ -19,12 +19,18 @@ [20] = "SET_ENDIAN", [21] = "GET_SECCOMP", [22] = "SET_SECCOMP", + [23] = "CAPBSET_READ", + [24] = "CAPBSET_DROP", [25] = "GET_TSC", [26] = "SET_TSC", [27] = "GET_SECUREBITS", [28] = "SET_SECUREBITS", [29] = "SET_TIMERSLACK", [30] = "GET_TIMERSLACK", + [31] = "TASK_PERF_EVENTS_DISABLE", + [32] = "TASK_PERF_EVENTS_ENABLE", + [33] = "MCE_KILL", + [34] = "MCE_KILL_GET", [35] = "SET_MM", [36] = "SET_CHILD_SUBREAPER", [37] = "GET_CHILD_SUBREAPER", @@ -33,8 +39,13 @@ [40] = "GET_TID_ADDRESS", [41] = "SET_THP_DISABLE", [42] = "GET_THP_DISABLE", + [43] = "MPX_ENABLE_MANAGEMENT", + [44] = "MPX_DISABLE_MANAGEMENT", [45] = "SET_FP_MODE", [46] = "GET_FP_MODE", + [47] = "CAP_AMBIENT", + [50] = "SVE_SET_VL", + [51] = "SVE_GET_VL", [52] = "GET_SPECULATION_CTRL", [53] = "SET_SPECULATION_CTRL", [54] = "PAC_RESET_KEYS", $ Cc: Adrian Hunter Cc: Jiri Olsa Cc: Kristina Martsenko Cc: Namhyung Kim Cc: Will Deacon Link: https://lkml.kernel.org/n/tip-sg2pkmtjr5988bhbcp4yp6sw@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/trace/beauty/prctl_option.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c8a43c18a97845e7f94ed7d181c11f41964976a2 Author: Yueyi Li Date: Mon Dec 24 07:40:07 2018 +0000 arm64: kaslr: Reserve size of ARM64_MEMSTART_ALIGN in linear region When KASLR is enabled (CONFIG_RANDOMIZE_BASE=y), the top 4K of kernel virtual address space may be mapped to physical addresses despite being reserved for ERR_PTR values. Fix the randomization of the linear region so that we avoid mapping the last page of the virtual address space. Cc: Ard Biesheuvel Signed-off-by: liyueyi [will: rewrote commit message; merged in suggestion from Ard] Signed-off-by: Will Deacon arch/arm64/mm/init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit acafce48b07bf5f9994a38e7fe237193d43d092e Author: James Morse Date: Fri Dec 21 19:25:19 2018 +0000 firmware: arm_sdei: Fix DT platform device creation It turns out the dt-probing part of this wasn't tested properly after it was merged. commit 3aa0582fdb82 ("of: platform: populate /firmware/ node from of_platform_default_populate_init()") changed the core-code to generate the platform devices, meaning the driver's attempt fails, and it bails out. Fix this by removing the manual platform-device creation for DT systems, core code has always done this for us. CC: Nicolas Saenz Julienne Signed-off-by: James Morse Signed-off-by: Will Deacon drivers/firmware/arm_sdei.c | 5 ----- 1 file changed, 5 deletions(-) commit c3790b3799f8d75d93d26f6fd7bb569fc8c8b0cb Author: Nicolas Saenz Julienne Date: Fri Dec 21 19:25:18 2018 +0000 firmware: arm_sdei: fix wrong of_node_put() in init function After finding a "firmware" dt node arm_sdei tries to match it's compatible string with it. To do so it's calling of_find_matching_node() which already takes care of decreasing the refcount on the "firmware" node. We are then incorrectly decreasing the refcount on that node again. This patch removes the unwarranted call to of_node_put(). Signed-off-by: Nicolas Saenz Julienne Signed-off-by: James Morse Signed-off-by: Will Deacon drivers/firmware/arm_sdei.c | 1 - 1 file changed, 1 deletion(-) commit 8c2c596f8f453ffa6ef3bf14abc48a86b5431e56 Author: Mark Rutland Date: Thu Jan 3 13:23:10 2019 +0000 arm64: entry: remove unused register aliases In commit: 3b7142752e4bee15 ("arm64: convert native/compat syscall entry to C") ... we moved the syscall invocation code from assembly to C, but left behind a number of register aliases which are now unused. Let's remove them before they confuse someone. Cc: Catalin Marinas Reviewed-by: Dave Martin Signed-off-by: Mark Rutland Signed-off-by: Will Deacon arch/arm64/kernel/entry.S | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) commit 3d32c4531958c433a6ee087f31891cb02d6b68d9 Author: Arnaldo Carvalho de Melo Date: Thu Jan 3 14:56:20 2019 -0300 tools headers uapi: Sync prctl.h with the kernel sources To get the changes in ba8308856564 ("arm64: add prctl control for resetting ptrauth keys"), that introduce a prctl with a name that needs to be catch by the prctl cmd table generator, which will be done in the next cset. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Kristina Martsenko Cc: Namhyung Kim Cc: Will Deacon Link: https://lkml.kernel.org/n/tip-a1pahzc8lci0ey1fjvv1chdm@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/include/uapi/linux/prctl.h | 8 ++++++++ 1 file changed, 8 insertions(+) commit abc856259a6dc513868ad91e00a70379825d59c4 Author: Likun Gao Date: Wed Jan 2 12:20:12 2019 +0800 drm/amdgpu: make gfx9 enter into rlc safe mode when set MGCG MGCG should RLC enter into safe mode first. Signed-off-by: Likun Gao Reviewed-by: Huang Rui Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 4 ++++ 1 file changed, 4 insertions(+) commit 96d8f63c44e5d4db48d98c40bb74d0a0e47ae301 Author: Kent Russell Date: Thu Jan 3 08:33:15 2019 -0500 drm/amdgpu: Cleanup 2 compiler warnings These 2 variables are unused now, so remove their references. Fixes: e4ae0fc drm/amdgpu: implement gfx8 post_soft_reset Fixes: 5e01c09 drm/amdgpu/gfx_v8_0: Reorder the gfx, kiq and kcq rings test sequence Signed-off-by: Kent Russell Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 2 -- 1 file changed, 2 deletions(-) commit 94f45df8aaa35471ab3fc802c2cf1b75c8107500 Author: Arnaldo Carvalho de Melo Date: Thu Jan 3 13:53:59 2019 -0300 tools headers x86: Sync disabled-features.h To silence the following tools/perf build warning: Warning: Kernel ABI header at 'tools/arch/x86/include/asm/disabled-features.h' differs from latest version at 'arch/x86/include/asm/disabled-features.h' diff -u tools/arch/x86/include/asm/disabled-features.h arch/x86/include/asm/disabled-features.h Picking up the changes in dae0a1059300 ("x86/cpufeatures, x86/fault: Mark SMAP as disabled when configured out") that didn't entail any functionality change in the tooling side. Cc: Adrian Hunter Cc: Andy Lutomirski Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-vvge5xh6ii12oszexqknbgwp@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/arch/x86/include/asm/disabled-features.h | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 22c7d5e7bad1fb2d8b9c611acb55a389f5d848d8 Author: Shuming Fan Date: Wed Jan 2 17:18:56 2019 +0800 ASoC: rt5682: Fix recording no sound issue The ADC mixer setting needs to restore to default value after calibration. Signed-off-by: Shuming Fan Signed-off-by: Mark Brown sound/soc/codecs/rt5682.c | 1 + 1 file changed, 1 insertion(+) commit a3d9036078715385ba156373e6cbc1a0b1deb075 Author: Sinan Kaya Date: Wed Jan 2 18:10:35 2019 +0000 ASoC: Intel: atom: Make PCI dependency explicit After 'commit 5d32a66541c4 ("PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set")' dependencies on CONFIG_PCI that previously were satisfied implicitly through dependencies on CONFIG_ACPI have to be specified directly. This code relies on IOSF_MBI and IOSF_MBI depends on PCI. For this reason, add a direct dependency on CONFIG_PCI to the IOSF_MBI driver. Fixes: 5d32a66541c46 ("PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set") Signed-off-by: Sinan Kaya Acked-by: Pierre-Louis Bossart Signed-off-by: Mark Brown sound/soc/intel/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 678e2b44c8e3fec3afc7202f1996a4500a50be93 Author: Dan Carpenter Date: Fri Dec 21 12:06:58 2018 +0300 ALSA: compress: prevent potential divide by zero bugs The problem is seen in the q6asm_dai_compr_set_params() function: ret = q6asm_map_memory_regions(dir, prtd->audio_client, prtd->phys, (prtd->pcm_size / prtd->periods), ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ prtd->periods); In this code prtd->pcm_size is the buffer_size and prtd->periods comes from params->buffer.fragments. If we allow the number of fragments to be zero then it results in a divide by zero bug. One possible fix would be to use prtd->pcm_count directly instead of using the division to re-calculate it. But I decided that it doesn't really make sense to allow zero fragments. Signed-off-by: Dan Carpenter Signed-off-by: Mark Brown sound/core/compress_offload.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit a41d9dbf5dac5b6a1283ee8001f22807d18352ea Author: Dan Carpenter Date: Fri Dec 21 12:06:10 2018 +0300 ASoC: qdsp6: q6asm-dai: Fix a small memory leak We can't return directly if snd_dma_alloc_pages() fails; we first need to free prtd->audio_client and prtd. Fixes: 22930c79ac5c ("ASoC: qdsp6: q6asm-dai: Add support to compress offload") Signed-off-by: Dan Carpenter Signed-off-by: Mark Brown sound/soc/qcom/qdsp6/q6asm-dai.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) commit 3391034e18b35bba8904cae457598ac276ac685a Author: Dan Carpenter Date: Fri Dec 21 12:05:16 2018 +0300 ASoC: qdsp6: q6asm-dai: Fix a NULL vs IS_ERR() bug The q6asm_audio_client_alloc() doesn't return NULL, it returns error pointers. Fixes: 22930c79ac5c ("ASoC: qdsp6: q6asm-dai: Add support to compress offload") Signed-off-by: Dan Carpenter Signed-off-by: Mark Brown sound/soc/qcom/qdsp6/q6asm-dai.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit eef08e5350618b7a9fdc8ac5b821a925366c8f3f Author: Dan Carpenter Date: Fri Dec 21 12:04:42 2018 +0300 ASoC: qdsp6: q6asm-dai: Off by one in of_q6asm_parse_dai_data() The q6asm_fe_dais[] array has MAX_SESSIONS (8) elements so the > comparison should be >= or we access one element beyond the end of the array. Fixes: 22930c79ac5c ("ASoC: qdsp6: q6asm-dai: Add support to compress offload") Signed-off-by: Dan Carpenter Signed-off-by: Mark Brown sound/soc/qcom/qdsp6/q6asm-dai.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 28b698b7342c7d5300cfe217cd77ff7d2a55e03d Author: Dan Carpenter Date: Fri Dec 21 12:11:20 2018 +0300 ASoC: pcm512x: Fix a double unlock in pcm512x_digital_mute() We accidentally call mutex_unlock(&pcm512x->mutex); twice in a row. I re-wrote the error handling to use "goto unlock;" instead of returning directly. Hopefully, it makes the code a little simpler. Fixes: 3500f1c589e9 ("ASoC: pcm512x: Implement the digital_mute interface") Signed-off-by: Dan Carpenter Reviwed-by: Dimitris Papavasiliou Signed-off-by: Mark Brown sound/soc/codecs/pcm512x.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) commit fd270fca2001bcdac0658eb673c20920baeed86c Author: Maruthi Srinivas Bayyavarapu Date: Wed Dec 19 15:10:40 2018 +0530 ASoC: xlnx: change license header format style Changed License header from C to C++ style comment block. Signed-off-by: Maruthi Srinivas Bayyavarapu Signed-off-by: Mark Brown sound/soc/xilinx/xlnx_i2s.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) commit 906a9abc5de73c383af518f5a806f4be2993a0c7 Author: Rander Wang Date: Tue Dec 18 16:24:54 2018 +0800 ASoC: Intel: Haswell/Broadwell: fix setting for .dynamic field For some reason this field was set to zero when all other drivers use .dynamic = 1 for front-ends. This change was tested on Dell XPS13 and has no impact with the existing legacy driver. The SOF driver also works with this change which enables it to override the fixed topology. Signed-off-by: Rander Wang Acked-by: Pierre-Louis Bossart Signed-off-by: Mark Brown sound/soc/intel/boards/broadwell.c | 2 +- sound/soc/intel/boards/haswell.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 6cb6746e95576878835cd27f634194bbd771c3f2 Author: Geert Uytterhoeven Date: Tue Dec 18 14:47:43 2018 +0100 ASoC: xlnx: Grammar s/the the/the/ Fixes: 33f8db9a89200c18 ("ASoC: xlnx: enable i2s driver build") Signed-off-by: Geert Uytterhoeven Signed-off-by: Mark Brown sound/soc/xilinx/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 02a07872f84fc5fe61fa65310ff23bcad166a4f5 Author: Dan Carpenter Date: Tue Dec 18 11:18:10 2018 +0300 ASoC: dma-sh7760: cleanup a debug printk The intent was to print the address as a hexadecimal but there is an extra "u" in the "0x%08ulx" format specification so it is displayed as decimal. Fixes: aef3b06ac697 ("[ALSA] SH7760 ASoC support") Signed-off-by: Dan Carpenter Signed-off-by: Mark Brown sound/soc/sh/dma-sh7760.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2998369fb93f129b953aeb2984ae01e26c4fdf69 Author: Rohit kumar Date: Fri Dec 14 15:31:43 2018 +0530 ASoC: sdm845: set jack only for a specific backend Headset codec is connected over PRIMARY_MI2S interface. Call set_jack for codec associated with Primary Mi2s interface. Also, set_jack to NULL when jack is freed. Signed-off-by: Rohit kumar Signed-off-by: Mark Brown sound/soc/qcom/sdm845.c | 31 ++++++++++++++++++++++--------- 1 file changed, 22 insertions(+), 9 deletions(-) commit 93fb7f19985a08bbe3b76da0b35e97b6e472e4a5 Author: Otto Sabart Date: Wed Jan 2 21:01:21 2019 +0100 doc: filesystems: fix bad references to nonexistent ext4.rst file The ext4.rst file does not exist anymore. This patch changes all references to point to the whole ext4 directory. Fixes: d3091215921b ("docs: move ext4 administrative docs to admin-guide/") Signed-off-by: Otto Sabart Signed-off-by: Jonathan Corbet Documentation/filesystems/dax.txt | 2 +- Documentation/filesystems/ext2.txt | 2 +- MAINTAINERS | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) commit 2d457d5506f88b3f6e63577387203f68fce472a9 Author: Ramunas Geciauskas Date: Sat Dec 29 16:00:00 2018 -0500 Documentation/admin-guide: update URL of LKML information link Information regarding linux-kernel mailing list is no longer hosted on tux.org Update the link to point to the one available at kernel.org Signed-off-by: Ramunas Geciauskas Signed-off-by: Jonathan Corbet Documentation/admin-guide/reporting-bugs.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit caaf3c83d2842c859d141711806d949f71c5f241 Author: Marcos Paulo de Souza Date: Tue Jan 1 22:40:14 2019 -0200 Docs/kernel-api.rst: Remove blk-tag.c reference After 7ca01926463a, legacy rq tagging was removed, so block/blk-tag.c does not exists anymore. When generating pdfdocs, sphinx complains about this missing file: Error: Cannot open file ./block/blk-tag.c Error: Cannot open file ./block/blk-tag.c Error: Cannot open file ./block/blk-tag.c Error: Cannot open file ./block/blk-tag.c So remove blk-tag.c traces from kernel-api.rst file to silence these warnings. Signed-off-by: Marcos Paulo de Souza Signed-off-by: Jonathan Corbet Documentation/core-api/kernel-api.rst | 6 ------ 1 file changed, 6 deletions(-) commit 24ef9ec891c761483c5270528781b8637b908eef Author: Stephen Rothwell Date: Mon Dec 17 10:57:15 2018 +1100 thermal/intel: fixup for Kconfig string parsing tightening up Signed-off-by: Stephen Rothwell drivers/thermal/intel/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 43bfeb45109ad154df4dde67d3d04a8876a3bfc1 Author: Ming Lei Date: Thu Jan 3 09:19:48 2019 +0800 block: sunvdc: don't run hw queue synchronously from irq context vdc_blk_queue_start() may be called from irq context, so we can't run queue via blk_mq_start_hw_queues() since we never allow to run queue from irq context. Use blk_mq_start_stopped_hw_queues(q, true) to fix this issue. Fixes: fa182a1fa97dff56cd ("sunvdc: convert to blk-mq") Reported-by: Anatoly Pugachev Tested-by: Anatoly Pugachev Cc: Anatoly Pugachev Cc: sparclinux@vger.kernel.org Acked-by: David S. Miller Signed-off-by: Ming Lei Signed-off-by: Jens Axboe drivers/block/sunvdc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit dc629c211c65ee5c8f1c4976886d4a5f33f50674 Merge: 645ff1e8e704 e820d55cb99d Author: Jens Axboe Date: Thu Jan 3 08:21:02 2019 -0700 Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md into for-linus Pull the pending 4.21 changes for md from Shaohua. * 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md: md: fix raid10 hang issue caused by barrier raid10: refactor common wait code from regular read/write request md: remvoe redundant condition check lib/raid6: add option to skip algo benchmarking lib/raid6: sort algos in rough performance order lib/raid6: check for assembler SSSE3 support lib/raid6: avoid __attribute_const__ redefinition lib/raid6: add missing include for raid6test md: remove set but not used variable 'bi_rdev' commit 1236cd2bad8bc9038af90830cf017c770fdba03c Author: Shaokun Zhang Date: Sat Dec 29 09:43:17 2018 +0800 arm64: smp: Fix compilation error For arm64: updates for 4.21, there is a compilation error: arch/arm64/kernel/head.S: Assembler messages: arch/arm64/kernel/head.S:824: Error: missing ')' arch/arm64/kernel/head.S:824: Error: missing ')' arch/arm64/kernel/head.S:824: Error: missing ')' arch/arm64/kernel/head.S:824: Error: unexpected characters following instruction at operand 2 -- `mov x2,#(2)|(2U<<(8))' scripts/Makefile.build:391: recipe for target 'arch/arm64/kernel/head.o' failed make[1]: *** [arch/arm64/kernel/head.o] Error 1 GCC version is gcc (Ubuntu/Linaro 5.4.0-6ubuntu1~16.04.10) 5.4.0 20160609 Let's fix it using the UL() macro. Fixes: 66f16a24512f ("arm64: smp: Rework early feature mismatched detection") Cc: Catalin Marinas Cc: Will Deacon Tested-by: John Stultz Signed-off-by: Shaokun Zhang [will: consistent use of UL() for all shifts in asm constants] Signed-off-by: Will Deacon arch/arm64/include/asm/smp.h | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit 8a99255a50c0b4c2a449b96fd8d45fcc8d72c701 Author: Jin Yao Date: Thu Jan 3 15:40:45 2019 +0800 perf stat: Fix endless wait for child process We hit a 'perf stat' issue by using following script: #!/bin/bash sleep 1000 & exec perf stat -a -e cycles -I1000 -- sleep 5 Since "perf stat" is launched by exec, the "sleep 1000" would be the child process of "perf stat". The wait4() call will not return because it's waiting for the child process "sleep 1000" to end. So 'perf stat' doesn't return even after 5s passes. This patch lets 'perf stat' return when the specified child process ends (in this case, the specified child process is "sleep 5"). Committer testing: # cat test.sh #!/bin/bash sleep 10 & exec perf stat -a -e cycles -I1000 -- sleep 5 # Before: # time ./test.sh # time counts unit events 1.001113090 108,453,351 cycles 2.002062196 142,075,435 cycles 3.002896194 164,801,068 cycles 4.003731666 107,062,140 cycles 5.002068867 112,241,832 cycles real 0m10.066s user 0m0.016s sys 0m0.101s # After: # time ./test.sh # time counts unit events 1.001016096 91,412,027 cycles 2.002014963 124,063,708 cycles 3.002883964 125,993,929 cycles 4.003706470 120,465,734 cycles 5.002006778 163,560,355 cycles real 0m5.123s user 0m0.014s sys 0m0.105s # Signed-off-by: Jin Yao Reviewed-by: Jiri Olsa Tested-by: Arnaldo Carvalho de Melo Cc: Alexander Shishkin Cc: Andi Kleen Cc: Kan Liang Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/1546501245-4512-1-git-send-email-yao.jin@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-stat.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 2573be22e5b6f24a0cabc97715c808c47e29eaaf Merge: 6d101ba6be2a b25756df5b28 Author: Ingo Molnar Date: Thu Jan 3 14:05:16 2019 +0100 Merge tag 'perf-core-for-mingo-4.21-20190103' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/core improvements and fixes from Arnaldo Carvalho de Melo: perf c2c: Jiri Olsa: - Change the default coalesce setup to from '--coalesce pid,iaddr' to just '--coalesce iaddr'. - Increase the HITM ratio limit for displayed cachelines. perf script: Andi Kleen: - Fix LBR skid dump problems in brstackinsn. perf trace: Arnaldo Carvalho de Melo: - Check if the raw_syscalls:sys_{enter,exit} are setup before setting tp filter. - Do not hardcode the size of the tracepoint common_ fields. - Beautify USBDEFFS_ ioctl commands. Colin Ian King: - Use correct SECCOMP prefix spelling, "SECOMP_*" -> "SECCOMP_*". perf python: Jiri Olsa: - Do not force closing original perf descriptor in evlist.get_pollfd(). tools misc: Jiri Olsa: - Allow overriding CFLAGS and LDFLAGS. perf build: Stanislav Fomichev: - Don't unconditionally link the libbfd feature test to -liberty and -lz thread-stack: Adrian Hunter: - Fix processing for the idle task, having a stack per cpu. Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit bd8879faafe6d057237461c4d58d8b0d37b9e3ee Merge: f8f807441eef 8c32d47b151b 0e1f37d120ec 7f5592742a42 aeed35faee52 31a8b3ee16e3 16767229940f 74fbc7d371d9 Author: Jiri Kosina Date: Thu Jan 3 12:50:28 2019 +0100 Merge branches 'for-4.20/upstream-fixes', 'for-4.21/core', 'for-4.21/hid-asus', 'for-4.21/hid-core', 'for-4.21/hid-cougar', 'for-4.21/hidraw', 'for-4.21/highres-wheel' and 'for-4.21/ish' into for-linus commit b9ced18acf68dffebe6888c7ec765a2b1db7a039 Author: Chao Fan Date: Wed Dec 26 11:34:50 2018 +0800 ACPI: NUMA: Use correct type for printing addresses on i386-PAE The addresses of NUMA nodes are not printed correctly on i386-PAE which is misleading. Here is a debian9-32bit with PAE in a QEMU guest having more than 4G of memory: qemu-system-i386 \ -hda /var/lib/libvirt/images/debian32.qcow2 \ -m 5G \ -enable-kvm \ -smp 10 \ -numa node,mem=512M,nodeid=0,cpus=0 \ -numa node,mem=512M,nodeid=1,cpus=1 \ -numa node,mem=512M,nodeid=2,cpus=2 \ -numa node,mem=512M,nodeid=3,cpus=3 \ -numa node,mem=512M,nodeid=4,cpus=4 \ -numa node,mem=512M,nodeid=5,cpus=5 \ -numa node,mem=512M,nodeid=6,cpus=6 \ -numa node,mem=512M,nodeid=7,cpus=7 \ -numa node,mem=512M,nodeid=8,cpus=8 \ -numa node,mem=512M,nodeid=9,cpus=9 \ -serial stdio Because of the wrong value type, it prints as below: [ 0.021049] ACPI: SRAT Memory (0x0 length 0xa0000) in proximity domain 0 enabled [ 0.021740] ACPI: SRAT Memory (0x100000 length 0x1ff00000) in proximity domain 0 enabled [ 0.022425] ACPI: SRAT Memory (0x20000000 length 0x20000000) in proximity domain 1 enabled [ 0.023092] ACPI: SRAT Memory (0x40000000 length 0x20000000) in proximity domain 2 enabled [ 0.023764] ACPI: SRAT Memory (0x60000000 length 0x20000000) in proximity domain 3 enabled [ 0.024431] ACPI: SRAT Memory (0x80000000 length 0x20000000) in proximity domain 4 enabled [ 0.025104] ACPI: SRAT Memory (0xa0000000 length 0x20000000) in proximity domain 5 enabled [ 0.025791] ACPI: SRAT Memory (0x0 length 0x20000000) in proximity domain 6 enabled [ 0.026412] ACPI: SRAT Memory (0x20000000 length 0x20000000) in proximity domain 7 enabled [ 0.027118] ACPI: SRAT Memory (0x40000000 length 0x20000000) in proximity domain 8 enabled [ 0.027802] ACPI: SRAT Memory (0x60000000 length 0x20000000) in proximity domain 9 enabled The upper half of the start address of the NUMA domains between 6 and 9 inclusive was cut, so the printed values are incorrect. Fix the value type, to get the correct values in the log as follows: [ 0.023698] ACPI: SRAT Memory (0x0 length 0xa0000) in proximity domain 0 enabled [ 0.024325] ACPI: SRAT Memory (0x100000 length 0x1ff00000) in proximity domain 0 enabled [ 0.024981] ACPI: SRAT Memory (0x20000000 length 0x20000000) in proximity domain 1 enabled [ 0.025659] ACPI: SRAT Memory (0x40000000 length 0x20000000) in proximity domain 2 enabled [ 0.026317] ACPI: SRAT Memory (0x60000000 length 0x20000000) in proximity domain 3 enabled [ 0.026980] ACPI: SRAT Memory (0x80000000 length 0x20000000) in proximity domain 4 enabled [ 0.027635] ACPI: SRAT Memory (0xa0000000 length 0x20000000) in proximity domain 5 enabled [ 0.028311] ACPI: SRAT Memory (0x100000000 length 0x20000000) in proximity domain 6 enabled [ 0.028985] ACPI: SRAT Memory (0x120000000 length 0x20000000) in proximity domain 7 enabled [ 0.029667] ACPI: SRAT Memory (0x140000000 length 0x20000000) in proximity domain 8 enabled [ 0.030334] ACPI: SRAT Memory (0x160000000 length 0x20000000) in proximity domain 9 enabled Signed-off-by: Chao Fan [ rjw: Subject & changelog ] Signed-off-by: Rafael J. Wysocki drivers/acpi/numa.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit f8f807441eefddc3c6d8a378421f0ede6361d565 Author: Hans de Goede Date: Wed Dec 26 15:31:56 2018 +0100 HID: i2c-hid: Add Odys Winbook 13 to descriptor override The Odys Winbook 13 uses a SIPODEV SP1064 touchpad, which does not supply descriptors, add this to the DMI descriptor override list, fixing the touchpad not working. BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1526312 Reported-by: Rene Wagner Signed-off-by: Hans de Goede Signed-off-by: Jiri Kosina drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 6ae16dfb61bce538d48b7fe98160fada446056c5 Author: Aditya Pakki Date: Mon Dec 24 15:39:14 2018 -0600 HID: lenovo: Add checks to fix of_led_classdev_register In lenovo_probe_tpkbd(), the function of_led_classdev_register() could return an error value that is unchecked. The fix adds these checks. Signed-off-by: Aditya Pakki Signed-off-by: Jiri Kosina drivers/hid/hid-lenovo.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) commit 088d923a11e683af28ad9cea9b66782fff588495 Author: Rafael J. Wysocki Date: Wed Jan 2 12:13:52 2019 +0100 cpufreq / Documentation: Update cpufreq MAINTAINERS entry Update the MAINTAINERS entry for cpufreq by making it clear that it is not just drivers and adding current documentation records to it. Signed-off-by: Rafael J. Wysocki Acked-by: Viresh Kumar MAINTAINERS | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 3f2d347e851ef4464dea49504cde85e5eef67b2d Author: Beomho Seo Date: Fri Dec 21 15:32:28 2018 +0100 mfd: exynos-lpass: Enable UART module support This patch enables proper interrupts routing between UART module in Exynos Audio SubSystem and the rest of the SoC. This routing is completely transparent for UART device and CPU/GIC. UART driver requests interrupts from the respective controller and enables/masks/handles it by itself via standard methods. There are boards (for example TM2), which use UART module in Exynos Audio SubStem for communication with BlueTooth chip. Signed-off-by: Beomho Seo [mszyprow: rephrased commit message, added UART reset] Signed-off-by: Marek Szyprowski Reviewed-by: Sylwester Nawrocki Signed-off-by: Lee Jones drivers/mfd/exynos-lpass.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 9e28989d41c0eab57ec0bb156617a8757406ff8a Author: Kangjie Lu Date: Thu Dec 20 15:12:11 2018 -0600 mfd: mc13xxx: Fix a missing check of a register-read failure When mc13xxx_reg_read() fails, "old_adc0" is uninitialized and will contain random value. Further execution uses "old_adc0" even when mc13xxx_reg_read() fails. The fix checks the return value of mc13xxx_reg_read(), and exits the execution when it fails. Signed-off-by: Kangjie Lu Signed-off-by: Lee Jones drivers/mfd/mc13xxx-core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit c1f3375be60c562e24460d41b75e564c0a429835 Author: Cheng-Yi Chiang Date: Tue Dec 18 17:06:26 2018 +0800 mfd: cros_ec: Add commands to control codec Add EC host commands to control codec on EC. Signed-off-by: Cheng-Yi Chiang Signed-off-by: Lee Jones include/linux/mfd/cros_ec_commands.h | 94 ++++++++++++++++++++++++++++++++++++ 1 file changed, 94 insertions(+) commit 4bcb83e055033592e8672a8deb7b209eed936e11 Author: Richard Fitzgerald Date: Fri Dec 14 14:39:14 2018 +0000 mfd: madera: Remove spurious semicolon in while loop Coccinelle warning of a spurious semicolon on the closing brace of a while loop. Signed-off-by: Richard Fitzgerald Signed-off-by: Lee Jones drivers/mfd/madera-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f7b1e49c670370eeb21e0d7feb7eaa2468ad7ae2 Author: Yangtao Li Date: Sat Dec 15 03:29:18 2018 -0500 mfd: rave-sp: Fix typo in rave_sp_checksum comment Caculated -> Calculated Signed-off-by: Yangtao Li Signed-off-by: Lee Jones drivers/mfd/rave-sp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ddf5aaa8eecb6ccf51f311a513c3a5011fbe0d54 Author: Paul Cercueil Date: Sun Dec 16 15:10:44 2018 +0100 mfd: ingenic-tcu: Fix bit field description in header The description of the bit was inverted. Signed-off-by: Paul Cercueil Signed-off-by: Lee Jones include/linux/mfd/ingenic-tcu.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 75d4c5e03c2ae9902ab521024b10291f6fc9515b Author: Keerthy Date: Sun Dec 9 19:29:31 2018 +0530 mfd: tps65218: Use devm_regmap_add_irq_chip and clean up error path in probe() Use devm_regmap_add_irq_chip and clean up error path in probe and also the remove function. Reported-by: Christian Hohnstaedt Signed-off-by: Keerthy Reviewed-by: Sebastian Reichel Signed-off-by: Lee Jones drivers/mfd/tps65218.c | 24 +++--------------------- 1 file changed, 3 insertions(+), 21 deletions(-) commit 38df91cc0b82d053234accf4429eafd2f5a4d401 Author: Rob Herring Date: Wed Dec 5 13:50:31 2018 -0600 mfd: Use of_node_name_eq() for node name comparisons Convert string compares of DT node names to use of_node_name_eq() helper instead. This removes direct access to the node name pointer. Signed-off-by: Rob Herring Signed-off-by: Lee Jones drivers/mfd/max77620.c | 2 +- drivers/mfd/stmpe.c | 12 ++++++------ 2 files changed, 7 insertions(+), 7 deletions(-) commit 18e294ddafaeb80a1e2e10c9bd750a6cb8388d5b Author: Enric Balletbo i Serra Date: Mon Dec 10 19:00:02 2018 +0100 mfd: cros_ec_dev: Add missing mfd_remove_devices() call in remove The driver adds different MFD child devices via mfd_add_devices() and hence it is required to call mfd_remove_devices() to remove MFD child devices. Fixes: 5e0115581bbc ("cros_ec: Move cros_ec_dev module to drivers/mfd") Signed-off-by: Enric Balletbo i Serra Signed-off-by: Lee Jones drivers/mfd/cros_ec_dev.c | 1 + 1 file changed, 1 insertion(+) commit ea90e7b47f0a8bd2fe14e9a88f523de7c67db90a Author: Oskari Lemmela Date: Sat Dec 8 19:58:47 2018 +0200 mfd: axp20x: Add supported cells for AXP803 Parts of the AXP803 are compatible with their counterparts on the AXP813. These include the GPIO, ADC, AC and battery power supplies. Signed-off-by: Oskari Lemmela Reviewed-by: Chen-Yu Tsai Tested-by: Vasily Khoruzhick Signed-off-by: Chen-Yu Tsai Signed-off-by: Lee Jones drivers/mfd/axp20x.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) commit 753a8d083e085c6f552c7982749de4cc7c40e2ac Author: Chen-Yu Tsai Date: Sat Dec 8 19:58:46 2018 +0200 mfd: axp20x: Re-align MFD cell entries In the axp20x driver, the various mfd_cell lists had varying amounts of indentation, sometimes even within the same list. For the axp288, there's no alignment at all. Re-align the right hand side of the assignments with the least amount of tabs possible. Also collapse the closing bracket and the opening bracket of the next entry onto the same line for the axp288, to be consistent with all the other mfd_cell lists. This patch is whitespace change only. No functionality is modified. Signed-off-by: Chen-Yu Tsai Signed-off-by: Oskari Lemmela Signed-off-by: Lee Jones drivers/mfd/axp20x.c | 107 ++++++++++++++++++++++++--------------------------- 1 file changed, 51 insertions(+), 56 deletions(-) commit 4a19f9a65375ca9781b3ca9e810ece92edfc3e78 Author: Oskari Lemmela Date: Tue Nov 20 19:52:10 2018 +0200 mfd: axp20x: Add AC power supply cell for AXP813 As axp20x-ac-power-supply now supports AXP813, add a cell for it. Signed-off-by: Oskari Lemmela Reviewed-by: Quentin Schulz Reviewed-by: Chen-Yu Tsai Tested-by: Vasily Khoruzhick Signed-off-by: Lee Jones drivers/mfd/axp20x.c | 5 +++++ 1 file changed, 5 insertions(+) commit 04c801c18ded421845324255e660147a6f58dcd6 Author: Charles Keepax Date: Wed Nov 28 10:04:22 2018 +0000 mfd: wm5110: Add missing ASRC rate register Signed-off-by: Charles Keepax Signed-off-by: Lee Jones drivers/mfd/wm5110-tables.c | 2 ++ 1 file changed, 2 insertions(+) commit 504e4175829c44328773b96ad9c538e4783a8d22 Author: Jonathan Marek Date: Mon Nov 19 14:53:17 2018 -0500 mfd: qcom_rpm: write fw_version to CTRL_REG This is required as part of the initialization sequence on certain SoCs. If these registers are not initialized, the hardware can be unresponsive. This fixes the driver on apq8060 (HP TouchPad device). Signed-off-by: Jonathan Marek Signed-off-by: Lee Jones drivers/mfd/qcom_rpm.c | 4 ++++ 1 file changed, 4 insertions(+) commit ac4ca4b9f4623ba5e1ea7a582f286567c611e027 Author: Jonathan Hunter Date: Tue Nov 13 08:56:31 2018 +0000 mfd: tps6586x: Handle interrupts on suspend The tps6586x driver creates an irqchip that is used by its various child devices for managing interrupts. The tps6586x-rtc device is one of its children that uses the tps6586x irqchip. When using the tps6586x-rtc as a wake-up device from suspend, the following is seen: PM: Syncing filesystems ... done. Freezing user space processes ... (elapsed 0.001 seconds) done. OOM killer disabled. Freezing remaining freezable tasks ... (elapsed 0.000 seconds) done. Disabling non-boot CPUs ... Entering suspend state LP1 Enabling non-boot CPUs ... CPU1 is up tps6586x 3-0034: failed to read interrupt status tps6586x 3-0034: failed to read interrupt status The reason why the tps6586x interrupt status cannot be read is because the tps6586x interrupt is not masked during suspend and when the tps6586x-rtc interrupt occurs, to wake-up the device, the interrupt is seen before the i2c controller has been resumed in order to read the tps6586x interrupt status. The tps6586x-rtc driver sets it's interrupt as a wake-up source during suspend, which gets propagated to the parent tps6586x interrupt. However, the tps6586x-rtc driver cannot disable it's interrupt during suspend otherwise we would never be woken up and so the tps6586x must disable it's interrupt instead. Prevent the tps6586x interrupt handler from executing on exiting suspend before the i2c controller has been resumed by disabling the tps6586x interrupt on entering suspend and re-enabling it on resuming from suspend. Cc: stable@vger.kernel.org Signed-off-by: Jon Hunter Reviewed-by: Dmitry Osipenko Tested-by: Dmitry Osipenko Acked-by: Thierry Reding Signed-off-by: Lee Jones drivers/mfd/tps6586x.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) commit 7f9472134a5af31bad191f074a5d416146da26f7 Author: Richard Fitzgerald Date: Mon Nov 12 15:28:37 2018 +0000 mfd: madera: Add shared data for accessory detection Add variables to struct madera that will be shared by the extcon and audio codec drivers to synchronize output state during accessory detection. Also add a mutex to protect the DAPM pointer. Signed-off-by: Richard Fitzgerald Signed-off-by: Lee Jones drivers/mfd/madera-core.c | 3 +++ include/linux/mfd/madera/core.h | 7 +++++++ 2 files changed, 10 insertions(+) commit 628f3dfe4c7b35bbe63ec194ca6da857b00b0083 Author: Jean Delvare Date: Mon Nov 12 10:49:42 2018 +0100 mfd: at91-usart: Add platform dependency It doesn't make sense to present option MFD_AT91_USART by default if not building an AT91 kernel, as the drivers which depend on it are not available. Fixes: 7d3aa342cef7 ("mfd: at91-usart: Add MFD driver for USART") Signed-off-by: Jean Delvare Signed-off-by: Lee Jones drivers/mfd/Kconfig | 1 + 1 file changed, 1 insertion(+) commit b0aff01e7aa6ad2d6998ef1323843212d1db8b04 Author: Dien Pham Date: Wed Oct 3 15:58:41 2018 +0200 mfd: bd9571mwv: Add volatile register to make DVFS work Because BD9571MWV_DVFS_MONIVDAC is not defined in the volatile table, the physical register value is not updated by regmap and DVFS doesn't work as expected. Fix it! Fixes: d3ea21272094 ("mfd: Add ROHM BD9571MWV-M MFD PMIC driver") Signed-off-by: Dien Pham [wsa: rebase, add 'Fixes', reword commit message] Signed-off-by: Wolfram Sang Reviewed-by: Marek Vasut Signed-off-by: Lee Jones drivers/mfd/bd9571mwv.c | 1 + 1 file changed, 1 insertion(+) commit 10628e3ecf544fa2e4e24f8e112d95c37884dc98 Author: Dan Carpenter Date: Thu Oct 25 15:43:44 2018 +0300 mfd: ab8500-core: Return zero in get_register_interruptible() This function is supposed to return zero on success or negative error codes on error. Unfortunately, there is a bug so it sometimes returns non-zero, positive numbers on success. I noticed this bug during review and I can't test it. It does appear that the return is sometimes propogated back to _regmap_read() where all non-zero returns are treated as failure so this may affect run time. Fixes: 47c1697508f2 ("mfd: Align ab8500 with the abx500 interface") Signed-off-by: Dan Carpenter Reviewed-by: Linus Walleij Signed-off-by: Lee Jones drivers/mfd/ab8500-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a54e950fdec3cde98caa04bc601cbdc95d0d319c Author: Geert Uytterhoeven Date: Wed Nov 7 14:50:01 2018 +0100 mfd: tmio: Typo s/use use/use/ Signed-off-by: Geert Uytterhoeven Reviewed-by: Wolfram Sang Reviewed-by: Simon Horman Signed-off-by: Lee Jones include/linux/mfd/tmio.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a177276aa098aa47a100d51a13eaaef029604b6d Author: Nicolas Boichat Date: Mon Oct 22 10:55:06 2018 +0800 mfd: mt6397: Do not call irq_domain_remove if PMIC unsupported If the PMIC ID is unknown, the current code would call irq_domain_remove and panic, as pmic->irq_domain is only initialized by mt6397_irq_init. Return immediately with an error, if the chip ID is unsupported. Signed-off-by: Nicolas Boichat Signed-off-by: Lee Jones drivers/mfd/mt6397-core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit a3888f62fe66429fad3be7f2ba962e1e08c26fd6 Author: Nathan Chancellor Date: Wed Oct 17 17:56:28 2018 -0700 mfd: db8500-prcmu: Fix some section annotations When building the kernel with Clang, the following section mismatch warnings appear: WARNING: vmlinux.o(.text+0x7239cc): Section mismatch in reference from the function db8500_prcmu_probe() to the function .init.text:init_prcm_registers() The function db8500_prcmu_probe() references the function __init init_prcm_registers(). This is often because db8500_prcmu_probe lacks a __init annotation or the annotation of init_prcm_registers is wrong. WARNING: vmlinux.o(.text+0x723e28): Section mismatch in reference from the function db8500_prcmu_probe() to the function .init.text:fw_project_name() The function db8500_prcmu_probe() references the function __init fw_project_name(). This is often because db8500_prcmu_probe lacks a __init annotation or the annotation of fw_project_name is wrong. db8500_prcmu_probe should not be marked as __init so remove the __init annotation from fw_project_name and init_prcm_registers. Signed-off-by: Nathan Chancellor Signed-off-by: Lee Jones drivers/mfd/db8500-prcmu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 8838555089f0345b87f4277fe5a8dd647dc65589 Author: Nathan Chancellor Date: Wed Oct 17 10:13:23 2018 -0700 mfd: twl-core: Fix section annotations on {,un}protect_pm_master When building the kernel with Clang, the following section mismatch warning appears: WARNING: vmlinux.o(.text+0x3d84a3b): Section mismatch in reference from the function twl_probe() to the function .init.text:unprotect_pm_master() The function twl_probe() references the function __init unprotect_pm_master(). This is often because twl_probe lacks a __init annotation or the annotation of unprotect_pm_master is wrong. Remove the __init annotation on the *protect_pm_master functions so there is no more mismatch. Signed-off-by: Nathan Chancellor Signed-off-by: Lee Jones drivers/mfd/twl-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 55a7f0065533f71991c720457ea24ff2fe909f81 Author: Steve French Date: Tue Jan 1 17:19:45 2019 -0600 cifs: fix confusing warning message on reconnect When DFS is not used on the mount we should not be mentioning DFS in the warning message on reconnect (it could be confusing). Signed-off-by: Steve French Reviewed-by: Ronnie Sahlberg fs/cifs/connect.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6d2f84eee098540ae857998fe32f29b9e2cd9613 Author: Paul Aurich Date: Mon Dec 31 14:13:34 2018 -0800 smb3: fix large reads on encrypted connections When passing a large read to receive_encrypted_read(), ensure that the demultiplex_thread knows that a MID was processed. Without this, those operations never complete. This is a similar issue/fix to lease break handling: commit 7af929d6d05ba5564139718e30d5bc96bdbc716a ("smb3: fix lease break problem introduced by compounding") CC: Stable # 4.19+ Fixes: b24df3e30cbf ("cifs: update receive_encrypted_standard to handle compounded responses") Signed-off-by: Paul Aurich Tested-by: Yves-Alexis Perez Signed-off-by: Steve French Reviewed-by: Ronnie Sahlberg fs/cifs/smb2ops.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit c5ee066333ebc322a24a00a743ed941a0c68617e Author: David Ahern Date: Wed Jan 2 18:57:09 2019 -0800 ipv6: Consider sk_bound_dev_if when binding a socket to an address IPv6 does not consider if the socket is bound to a device when binding to an address. The result is that a socket can be bound to eth0 and then bound to the address of eth1. If the device is a VRF, the result is that a socket can only be bound to an address in the default VRF. Resolve by considering the device if sk_bound_dev_if is set. This problem exists from the beginning of git history. Signed-off-by: David Ahern Signed-off-by: David S. Miller net/ipv6/af_inet6.c | 3 +++ 1 file changed, 3 insertions(+) commit 73155879b3c1ac3ace35208a54a3a160ec520bef Author: David Ahern Date: Wed Jan 2 18:26:13 2019 -0800 ipv6: Fix dump of specific table with strict checking Dump of a specific table with strict checking enabled is looping. The problem is that the end of the table dump is not marked in the cb. When dumping a specific table, cb args 0 and 1 are not used (they are the hash index and entry with an hash table index when dumping all tables). Re-use args[0] to hold a 'done' flag for the specific table dump. Fixes: 13e38901d46ca ("net/ipv6: Plumb support for filtering route dumps") Reported-by: Jakub Kicinski Signed-off-by: David Ahern Signed-off-by: David S. Miller net/ipv6/ip6_fib.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 645ff1e8e704c4f33ab1fcd3c87f95cb9b6d7144 Merge: d548e65904ae 592b15ba7260 Author: Linus Torvalds Date: Wed Jan 2 18:56:59 2019 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: "A tiny pull request this merge window unfortunately, should get more material in for the next release: - new driver for Raspberry Pi's touchscreen (firmware interface) - miscellaneous input driver fixes" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G Input: atmel_mxt_ts - don't try to free unallocated kernel memory Input: drv2667 - fix indentation issues Input: touchscreen - fix coding style issue Input: add official Raspberry Pi's touchscreen driver Input: nomadik-ske-keypad - fix a loop timeout test Input: rotary-encoder - don't log EPROBE_DEFER to kernel log Input: olpc_apsp - remove set but not used variable 'np' Input: olpc_apsp - enable the SP clock Input: olpc_apsp - check FIFO status on open(), not probe() Input: olpc_apsp - drop CONFIG_OLPC dependency clk: mmp2: add SP clock dt-bindings: marvell,mmp2: Add clock id for the SP clock Input: ad7879 - drop platform data support commit d548e65904ae43b0637d200a2441fc94e0589c30 Merge: 77d0b194b2df a691ffb46edd Author: Linus Torvalds Date: Wed Jan 2 18:54:45 2019 -0800 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio/vhost updates from Michael Tsirkin: "Features, fixes, cleanups: - discard in virtio blk - misc fixes and cleanups" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: vhost: correct the related warning message vhost: split structs into a separate header file virtio: remove deprecated VIRTIO_PCI_CONFIG() vhost/vsock: switch to a mutex for vhost_vsock_hash virtio_blk: add discard and write zeroes support commit 77d0b194b2df04a1992f882d96ff4e2bd8bb8fe0 Merge: b79f9f93eb48 427c5ce4417c Author: Linus Torvalds Date: Wed Jan 2 18:49:58 2019 -0800 Merge tag 'for-4.21/block-20190102' of git://git.kernel.dk/linux-block Pull more block updates from Jens Axboe: - Dead code removal for loop/sunvdc (Chengguang) - Mark BIDI support for bsg as deprecated, logging a single dmesg warning if anyone is actually using it (Christoph) - blkcg cleanup, killing a dead function and making the tryget_closest variant easier to read (Dennis) - Floppy fixes, one fixing a regression in swim3 (Finn) - lightnvm use-after-free fix (Gustavo) - gdrom leak fix (Wenwen) - a set of drbd updates (Lars, Luc, Nathan, Roland) * tag 'for-4.21/block-20190102' of git://git.kernel.dk/linux-block: (28 commits) block/swim3: Fix regression on PowerBook G3 block/swim3: Fix -EBUSY error when re-opening device after unmount block/swim3: Remove dead return statement block/amiflop: Don't log error message on invalid ioctl gdrom: fix a memory leak bug lightnvm: pblk: fix use-after-free bug block: sunvdc: remove redundant code block: loop: remove redundant code bsg: deprecate BIDI support in bsg blkcg: remove unused __blkg_release_rcu() blkcg: clean up blkg_tryget_closest() drbd: Change drbd_request_detach_interruptible's return type to int drbd: Avoid Clang warning about pointless switch statment drbd: introduce P_ZEROES (REQ_OP_WRITE_ZEROES on the "wire") drbd: skip spurious timeout (ping-timeo) when failing promote drbd: don't retry connection if peers do not agree on "authentication" settings drbd: fix print_st_err()'s prototype to match the definition drbd: avoid spurious self-outdating with concurrent disconnect / down drbd: do not block when adjusting "disk-options" while IO is frozen drbd: fix comment typos ... commit b79f9f93eb483f2757b089bb4e1eb3827a609080 Merge: 0f2107daec81 745d51dc8a29 Author: Linus Torvalds Date: Wed Jan 2 18:47:56 2019 -0800 Merge tag 'for-4.21/libata-20190102' of git://git.kernel.dk/linux-block Pull libata fix from Jens Axboe: "This libata change missed the original libata pull request. Just a single fix in here, fixing a missed reference drop" * tag 'for-4.21/libata-20190102' of git://git.kernel.dk/linux-block: ata: pata_macio: add of_node_put() commit 0f2107daec8137e1ea8bcd6df1323ffe46a2e873 Merge: 01766d27d265 08972760d366 Author: Linus Torvalds Date: Wed Jan 2 18:45:50 2019 -0800 Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull more clk updates from Stephen Boyd: "One more patch to generalize a set of DT binding defines now before -rc1 comes out. This way the SoC DTS files can use the proper defines from a stable tag" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: imx8qxp: make the name of clock ID generic commit 01766d27d265afe7e93a8aa033afae5635d5aba0 Merge: 35ddb06a4675 f4747b9c68b8 Author: Linus Torvalds Date: Wed Jan 2 18:43:57 2019 -0800 Merge tag 'devprop-4.21-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull device properties framework fixes from Rafael Wysocki: "Fix two potential NULL pointer dereferences found by Coverity in the software nodes code introduced recently (Colin Ian King)" * tag 'devprop-4.21-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: drivers: base: swnode: check if swnode is NULL before dereferencing it drivers: base: swnode: check if pointer p is NULL before dereferencing it commit 35ddb06a467538434b4139fbf5c02a2ef073162a Merge: 6aa293d8ff09 d69e11648e48 Author: Linus Torvalds Date: Wed Jan 2 18:41:38 2019 -0800 Merge tag 'mailbox-v4.21' of git://git.linaro.org/landing-teams/working/fujitsu/integration Pull mailbox updates from Jassi Brar: - Introduce device-managed registration devm_mbox_controller_un/register and convert drivers to use it - Introduce flush api to support clients that must busy-wait in atomic context - Support multiple controllers per device - Hi3660: a bugfix and constify ops structure - TI-MsgMgr: off by one bugfix. - BCM: switch to spdx license - Tegra-HSP: support for shared mailboxes and suspend/resume. * tag 'mailbox-v4.21' of git://git.linaro.org/landing-teams/working/fujitsu/integration: (30 commits) mailbox: tegra-hsp: Use device-managed registration API mailbox: tegra-hsp: use devm_kstrdup_const() mailbox: tegra-hsp: Add suspend/resume support mailbox: tegra-hsp: Add support for shared mailboxes dt-bindings: tegra186-hsp: Add shared mailboxes mailbox: Allow multiple controllers per device mailbox: Support blocking transfers in atomic context mailbox: ti-msgmgr: Use device-managed registration API mailbox: stm32-ipcc: Use device-managed registration API mailbox: rockchip: Use device-managed registration API mailbox: qcom-apcs: Use device-managed registration API mailbox: platform-mhu: Use device-managed registration API mailbox: omap: Use device-managed registration API mailbox: mtk-cmdq: Remove needless devm_kfree() calls mailbox: mtk-cmdq: Use device-managed registration API mailbox: xgene-slimpro: Use device-managed registration API mailbox: sti: Use device-managed registration API mailbox: altera: Use device-managed registration API mailbox: imx: Use device-managed registration API mailbox: hi6220: Use device-managed registration API ... commit 6aa293d8ff0939802a6c86cee6cd152c1b0a7a0d Merge: 04a17edeca52 940b241d9050 Author: Linus Torvalds Date: Wed Jan 2 18:39:22 2019 -0800 Merge branch 'for-linus-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml Pull UML updates from Richard Weinberger: - DISCARD support for our block device driver - Many TLB flush optimizations - Various smaller fixes - And most important, Anton agreed to help me maintaining UML * 'for-linus-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml: um: Remove obsolete reenable_XX calls um: writev needs Add Anton Ivanov to UML maintainers um: remove redundant generic-y um: Optimize Flush TLB for force/fork case um: Avoid marking pages with "changed protection" um: Skip TLB flushing where not needed um: Optimize TLB operations v2 um: Remove unnecessary faulted check in uaccess.c um: Add support for DISCARD in the UBD Driver um: Remove unsafe printks from the io thread um: Clean-up command processing in UML UBD driver um: Switch to block-mq constants in the UML UBD driver um: Make GCOV depend on !KCOV um: Include sys/uio.h to have writev() um: Add HAVE_DEBUG_BUGVERBOSE um: Update maintainers file entry commit 04a17edeca524b71dbb5be41a7002d247fbf34c0 Merge: e6b925728084 ec10574d00da Author: Linus Torvalds Date: Wed Jan 2 18:37:01 2019 -0800 Merge tag 's390-4.21-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Martin Schwidefsky: - A larger update for the zcrypt / AP bus code: + Update two inline assemblies in the zcrypt driver to make gcc happy + Add a missing reply code for invalid special commands for zcrypt + Allow AP device reset to be triggered from user space + Split the AP scan function into smaller, more readable functions - Updates for vfio-ccw and vfio-ap + Add maintainers and reviewer for vfio-ccw + Include facility.h in vfio_ap_drv.c to avoid fragile include chain + Simplicy vfio-ccw state machine - Use the common code version of bust_spinlocks - Make use of the DEFINE_SHOW_ATTRIBUTE - Fix three incorrect file permissions in the DASD driver - Remove bit spin-lock from the PCI interrupt handler - Fix GFP_ATOMIC vs GFP_KERNEL in the PCI code * tag 's390-4.21-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/zcrypt: rework ap scan bus code s390/zcrypt: make sysfs reset attribute trigger queue reset s390/pci: fix sleeping in atomic during hotplug s390/pci: remove bit_lock usage in interrupt handler s390/drivers: fix proc/debugfs file permissions s390: convert to DEFINE_SHOW_ATTRIBUTE MAINTAINERS/vfio-ccw: add Farhan and Eric, make Halil Reviewer vfio: ccw: Merge BUSY and BOXED states s390: use common bust_spinlocks() s390/zcrypt: improve special ap message cmd handling s390/ap: rework assembler functions to use unions for in/out register variables s390: vfio-ap: include for test_facility() commit bf77ae4c98d721a9aae3840970d46669a78e034a Author: NeilBrown Date: Thu Jan 3 11:04:08 2019 +1100 locks: fix error in locks_move_blocks() After moving all requests from fl->fl_blocked_requests to new->fl_blocked_requests it is nonsensical to do anything to all the remaining elements, there aren't any. This should do something to all the requests that have been moved. For simplicity, it does it to all requests in the target list. Setting "f->fl_blocker = new" to all members of new->fl_blocked_requests is "obviously correct" as it preserves the invariant of the linkage among requests. Reported-by: syzbot+239d99847eb49ecb3899@syzkaller.appspotmail.com Fixes: 5946c4319ebb ("fs/locks: allow a lock request to block other requests.") Signed-off-by: NeilBrown Signed-off-by: Jeff Layton fs/locks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit be63004336d008b71f93dfe166f503ae2e53a32e Merge: d63967e475ae a67825f51951 Author: David S. Miller Date: Wed Jan 2 16:38:59 2019 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Alexei Starovoitov says: ==================== pull-request: bpf 2019-01-02 The following pull-request contains BPF updates for your *net* tree. The main changes are: 1) prevent out of bounds speculation on pointer arithmetic, from Daniel. 2) typo fix, from Xiaozhou. ==================== Signed-off-by: David S. Miller commit e6b92572808467f35fd159d47c45b650de29e722 Merge: e45428a43676 260f71eff493 Author: Linus Torvalds Date: Wed Jan 2 16:35:23 2019 -0800 Merge tag 'nfs-for-4.21-1' of git://git.linux-nfs.org/projects/anna/linux-nfs Pull NFS client updates from Anna Schumaker: "Stable bugfixes: - xprtrdma: Yet another double DMA-unmap # v4.20 Features: - Allow some /proc/sys/sunrpc entries without CONFIG_SUNRPC_DEBUG - Per-xprt rdma receive workqueues - Drop support for FMR memory registration - Make port= mount option optional for RDMA mounts Other bugfixes and cleanups: - Remove unused nfs4_xdev_fs_type declaration - Fix comments for behavior that has changed - Remove generic RPC credentials by switching to 'struct cred' - Fix crossing mountpoints with different auth flavors - Various xprtrdma fixes from testing and auditing the close code - Fixes for disconnect issues when using xprtrdma with krb5 - Clean up and improve xprtrdma trace points - Fix NFS v4.2 async copy reboot recovery" * tag 'nfs-for-4.21-1' of git://git.linux-nfs.org/projects/anna/linux-nfs: (63 commits) sunrpc: convert to DEFINE_SHOW_ATTRIBUTE sunrpc: Add xprt after nfs4_test_session_trunk() sunrpc: convert unnecessary GFP_ATOMIC to GFP_NOFS sunrpc: handle ENOMEM in rpcb_getport_async NFS: remove unnecessary test for IS_ERR(cred) xprtrdma: Prevent leak of rpcrdma_rep objects NFSv4.2 fix async copy reboot recovery xprtrdma: Don't leak freed MRs xprtrdma: Add documenting comment for rpcrdma_buffer_destroy xprtrdma: Replace outdated comment for rpcrdma_ep_post xprtrdma: Update comments in frwr_op_send SUNRPC: Fix some kernel doc complaints SUNRPC: Simplify defining common RPC trace events NFS: Fix NFSv4 symbolic trace point output xprtrdma: Trace mapping, alloc, and dereg failures xprtrdma: Add trace points for calls to transport switch methods xprtrdma: Relocate the xprtrdma_mr_map trace points xprtrdma: Clean up of xprtrdma chunk trace points xprtrdma: Remove unused fields from rpcrdma_ia xprtrdma: Cull dprintk() call sites ... commit e45428a436765fcd154d461a2739b5640916dc00 Merge: 85f78456f286 0ad30ff67bd3 Author: Linus Torvalds Date: Wed Jan 2 16:21:50 2019 -0800 Merge tag 'nfsd-4.21' of git://linux-nfs.org/~bfields/linux Pull nfsd updates from Bruce Fields: "Thanks to Vasily Averin for fixing a use-after-free in the containerized NFSv4.2 client, and cleaning up some convoluted backchannel server code in the process. Otherwise, miscellaneous smaller bugfixes and cleanup" * tag 'nfsd-4.21' of git://linux-nfs.org/~bfields/linux: (25 commits) nfs: fixed broken compilation in nfs_callback_up_net() nfs: minor typo in nfs4_callback_up_net() sunrpc: fix debug message in svc_create_xprt() sunrpc: make visible processing error in bc_svc_process() sunrpc: remove unused xpo_prep_reply_hdr callback sunrpc: remove svc_rdma_bc_class sunrpc: remove svc_tcp_bc_class sunrpc: remove unused bc_up operation from rpc_xprt_ops sunrpc: replace svc_serv->sv_bc_xprt by boolean flag sunrpc: use-after-free in svc_process_common() sunrpc: use SVC_NET() in svcauth_gss_* functions nfsd: drop useless LIST_HEAD lockd: Show pid of lockd for remote locks NFSD remove OP_CACHEME from 4.2 op_flags nfsd: Return EPERM, not EACCES, in some SETATTR cases sunrpc: fix cache_head leak due to queued request nfsd: clean up indentation, increase indentation in switch statement svcrdma: Optimize the logic that selects the R_key to invalidate nfsd: fix a warning in __cld_pipe_upcall() nfsd4: fix crash on writing v4_end_grace before nfsd startup ... commit a67825f5195145f840939d0f85fc40b6b1077329 Merge: 8b6b25cf93b7 80c9b2fae87b Author: Alexei Starovoitov Date: Wed Jan 2 16:01:25 2019 -0800 Merge branch 'prevent-oob-under-speculation' Daniel Borkmann says: ==================== This set fixes an out of bounds case under speculative execution by implementing masking of pointer alu into the verifier. For details please see the individual patches. Thanks! v2 -> v3: - 8/9: change states_equal condition into old->speculative && !cur->speculative, thanks Jakub! - 8/9: remove incorrect speculative state test in propagate_liveness(), thanks Jakub! v1 -> v2: - Typo fixes in commit msg and a comment, thanks David! ==================== Signed-off-by: Alexei Starovoitov commit 80c9b2fae87bb5c5698940da1a981f14f89518d1 Author: Daniel Borkmann Date: Thu Jan 3 00:58:35 2019 +0100 bpf: add various test cases to selftests Add various map value pointer related test cases to test_verifier kselftest to reflect recent changes and improve test coverage. The tests include basic masking functionality, unprivileged behavior on pointer arithmetic which goes oob, mixed bounds tests, negative unknown scalar but resulting positive offset for access and helper range, handling of arithmetic from multiple maps, various masking scenarios with subsequent map value access and others including two test cases from Jann Horn for prior fixes. Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: Alexei Starovoitov tools/testing/selftests/bpf/test_verifier.c | 1146 ++++++++++++++++++++++++++- 1 file changed, 1124 insertions(+), 22 deletions(-) commit 979d63d50c0c0f7bc537bf821e056cc9fe5abd38 Author: Daniel Borkmann Date: Thu Jan 3 00:58:34 2019 +0100 bpf: prevent out of bounds speculation on pointer arithmetic Jann reported that the original commit back in b2157399cc98 ("bpf: prevent out-of-bounds speculation") was not sufficient to stop CPU from speculating out of bounds memory access: While b2157399cc98 only focussed on masking array map access for unprivileged users for tail calls and data access such that the user provided index gets sanitized from BPF program and syscall side, there is still a more generic form affected from BPF programs that applies to most maps that hold user data in relation to dynamic map access when dealing with unknown scalars or "slow" known scalars as access offset, for example: - Load a map value pointer into R6 - Load an index into R7 - Do a slow computation (e.g. with a memory dependency) that loads a limit into R8 (e.g. load the limit from a map for high latency, then mask it to make the verifier happy) - Exit if R7 >= R8 (mispredicted branch) - Load R0 = R6[R7] - Load R0 = R6[R0] For unknown scalars there are two options in the BPF verifier where we could derive knowledge from in order to guarantee safe access to the memory: i) While /<=/>= variants won't allow to derive any lower or upper bounds from the unknown scalar where it would be safe to add it to the map value pointer, it is possible through ==/!= test however. ii) another option is to transform the unknown scalar into a known scalar, for example, through ALU ops combination such as R &= followed by R |= or any similar combination where the original information from the unknown scalar would be destroyed entirely leaving R with a constant. The initial slow load still precedes the latter ALU ops on that register, so the CPU executes speculatively from that point. Once we have the known scalar, any compare operation would work then. A third option only involving registers with known scalars could be crafted as described in [0] where a CPU port (e.g. Slow Int unit) would be filled with many dependent computations such that the subsequent condition depending on its outcome has to wait for evaluation on its execution port and thereby executing speculatively if the speculated code can be scheduled on a different execution port, or any other form of mistraining as described in [1], for example. Given this is not limited to only unknown scalars, not only map but also stack access is affected since both is accessible for unprivileged users and could potentially be used for out of bounds access under speculation. In order to prevent any of these cases, the verifier is now sanitizing pointer arithmetic on the offset such that any out of bounds speculation would be masked in a way where the pointer arithmetic result in the destination register will stay unchanged, meaning offset masked into zero similar as in array_index_nospec() case. With regards to implementation, there are three options that were considered: i) new insn for sanitation, ii) push/pop insn and sanitation as inlined BPF, iii) reuse of ax register and sanitation as inlined BPF. Option i) has the downside that we end up using from reserved bits in the opcode space, but also that we would require each JIT to emit masking as native arch opcodes meaning mitigation would have slow adoption till everyone implements it eventually which is counter-productive. Option ii) and iii) have both in common that a temporary register is needed in order to implement the sanitation as inlined BPF since we are not allowed to modify the source register. While a push / pop insn in ii) would be useful to have in any case, it requires once again that every JIT needs to implement it first. While possible, amount of changes needed would also be unsuitable for a -stable patch. Therefore, the path which has fewer changes, less BPF instructions for the mitigation and does not require anything to be changed in the JITs is option iii) which this work is pursuing. The ax register is already mapped to a register in all JITs (modulo arm32 where it's mapped to stack as various other BPF registers there) and used in constant blinding for JITs-only so far. It can be reused for verifier rewrites under certain constraints. The interpreter's tmp "register" has therefore been remapped into extending the register set with hidden ax register and reusing that for a number of instructions that needed the prior temporary variable internally (e.g. div, mod). This allows for zero increase in stack space usage in the interpreter, and enables (restricted) generic use in rewrites otherwise as long as such a patchlet does not make use of these instructions. The sanitation mask is dynamic and relative to the offset the map value or stack pointer currently holds. There are various cases that need to be taken under consideration for the masking, e.g. such operation could look as follows: ptr += val or val += ptr or ptr -= val. Thus, the value to be sanitized could reside either in source or in destination register, and the limit is different depending on whether the ALU op is addition or subtraction and depending on the current known and bounded offset. The limit is derived as follows: limit := max_value_size - (smin_value + off). For subtraction: limit := umax_value + off. This holds because we do not allow any pointer arithmetic that would temporarily go out of bounds or would have an unknown value with mixed signed bounds where it is unclear at verification time whether the actual runtime value would be either negative or positive. For example, we have a derived map pointer value with constant offset and bounded one, so limit based on smin_value works because the verifier requires that statically analyzed arithmetic on the pointer must be in bounds, and thus it checks if resulting smin_value + off and umax_value + off is still within map value bounds at time of arithmetic in addition to time of access. Similarly, for the case of stack access we derive the limit as follows: MAX_BPF_STACK + off for subtraction and -off for the case of addition where off := ptr_reg->off + ptr_reg->var_off.value. Subtraction is a special case for the masking which can be in form of ptr += -val, ptr -= -val, or ptr -= val. In the first two cases where we know that the value is negative, we need to temporarily negate the value in order to do the sanitation on a positive value where we later swap the ALU op, and restore original source register if the value was in source. The sanitation of pointer arithmetic alone is still not fully sufficient as is, since a scenario like the following could happen ... PTR += 0x1000 (e.g. K-based imm) PTR -= BIG_NUMBER_WITH_SLOW_COMPARISON PTR += 0x1000 PTR -= BIG_NUMBER_WITH_SLOW_COMPARISON [...] ... which under speculation could end up as ... PTR += 0x1000 PTR -= 0 [ truncated by mitigation ] PTR += 0x1000 PTR -= 0 [ truncated by mitigation ] [...] ... and therefore still access out of bounds. To prevent such case, the verifier is also analyzing safety for potential out of bounds access under speculative execution. Meaning, it is also simulating pointer access under truncation. We therefore "branch off" and push the current verification state after the ALU operation with known 0 to the verification stack for later analysis. Given the current path analysis succeeded it is likely that the one under speculation can be pruned. In any case, it is also subject to existing complexity limits and therefore anything beyond this point will be rejected. In terms of pruning, it needs to be ensured that the verification state from speculative execution simulation must never prune a non-speculative execution path, therefore, we mark verifier state accordingly at the time of push_stack(). If verifier detects out of bounds access under speculative execution from one of the possible paths that includes a truncation, it will reject such program. Given we mask every reg-based pointer arithmetic for unprivileged programs, we've been looking into how it could affect real-world programs in terms of size increase. As the majority of programs are targeted for privileged-only use case, we've unconditionally enabled masking (with its alu restrictions on top of it) for privileged programs for the sake of testing in order to check i) whether they get rejected in its current form, and ii) by how much the number of instructions and size will increase. We've tested this by using Katran, Cilium and test_l4lb from the kernel selftests. For Katran we've evaluated balancer_kern.o, Cilium bpf_lxc.o and an older test object bpf_lxc_opt_-DUNKNOWN.o and l4lb we've used test_l4lb.o as well as test_l4lb_noinline.o. We found that none of the programs got rejected by the verifier with this change, and that impact is rather minimal to none. balancer_kern.o had 13,904 bytes (1,738 insns) xlated and 7,797 bytes JITed before and after the change. Most complex program in bpf_lxc.o had 30,544 bytes (3,817 insns) xlated and 18,538 bytes JITed before and after and none of the other tail call programs in bpf_lxc.o had any changes either. For the older bpf_lxc_opt_-DUNKNOWN.o object we found a small increase from 20,616 bytes (2,576 insns) and 12,536 bytes JITed before to 20,664 bytes (2,582 insns) and 12,558 bytes JITed after the change. Other programs from that object file had similar small increase. Both test_l4lb.o had no change and remained at 6,544 bytes (817 insns) xlated and 3,401 bytes JITed and for test_l4lb_noinline.o constant at 5,080 bytes (634 insns) xlated and 3,313 bytes JITed. This can be explained in that LLVM typically optimizes stack based pointer arithmetic by using K-based operations and that use of dynamic map access is not overly frequent. However, in future we may decide to optimize the algorithm further under known guarantees from branch and value speculation. Latter seems also unclear in terms of prediction heuristics that today's CPUs apply as well as whether there could be collisions in e.g. the predictor's Value History/Pattern Table for triggering out of bounds access, thus masking is performed unconditionally at this point but could be subject to relaxation later on. We were generally also brainstorming various other approaches for mitigation, but the blocker was always lack of available registers at runtime and/or overhead for runtime tracking of limits belonging to a specific pointer. Thus, we found this to be minimally intrusive under given constraints. With that in place, a simple example with sanitized access on unprivileged load at post-verification time looks as follows: # bpftool prog dump xlated id 282 [...] 28: (79) r1 = *(u64 *)(r7 +0) 29: (79) r2 = *(u64 *)(r7 +8) 30: (57) r1 &= 15 31: (79) r3 = *(u64 *)(r0 +4608) 32: (57) r3 &= 1 33: (47) r3 |= 1 34: (2d) if r2 > r3 goto pc+19 35: (b4) (u32) r11 = (u32) 20479 | 36: (1f) r11 -= r2 | Dynamic sanitation for pointer 37: (4f) r11 |= r2 | arithmetic with registers 38: (87) r11 = -r11 | containing bounded or known 39: (c7) r11 s>>= 63 | scalars in order to prevent 40: (5f) r11 &= r2 | out of bounds speculation. 41: (0f) r4 += r11 | 42: (71) r4 = *(u8 *)(r4 +0) 43: (6f) r4 <<= r1 [...] For the case where the scalar sits in the destination register as opposed to the source register, the following code is emitted for the above example: [...] 16: (b4) (u32) r11 = (u32) 20479 17: (1f) r11 -= r2 18: (4f) r11 |= r2 19: (87) r11 = -r11 20: (c7) r11 s>>= 63 21: (5f) r2 &= r11 22: (0f) r2 += r0 23: (61) r0 = *(u32 *)(r2 +0) [...] JIT blinding example with non-conflicting use of r10: [...] d5: je 0x0000000000000106 _ d7: mov 0x0(%rax),%edi | da: mov $0xf153246,%r10d | Index load from map value and e0: xor $0xf153259,%r10 | (const blinded) mask with 0x1f. e7: and %r10,%rdi |_ ea: mov $0x2f,%r10d | f0: sub %rdi,%r10 | Sanitized addition. Both use r10 f3: or %rdi,%r10 | but do not interfere with each f6: neg %r10 | other. (Neither do these instructions f9: sar $0x3f,%r10 | interfere with the use of ax as temp fd: and %r10,%rdi | in interpreter.) 100: add %rax,%rdi |_ 103: mov 0x0(%rdi),%eax [...] Tested that it fixes Jann's reproducer, and also checked that test_verifier and test_progs suite with interpreter, JIT and JIT with hardening enabled on x86-64 and arm64 runs successfully. [0] Speculose: Analyzing the Security Implications of Speculative Execution in CPUs, Giorgi Maisuradze and Christian Rossow, https://arxiv.org/pdf/1801.04084.pdf [1] A Systematic Evaluation of Transient Execution Attacks and Defenses, Claudio Canella, Jo Van Bulck, Michael Schwarz, Moritz Lipp, Benjamin von Berg, Philipp Ortner, Frank Piessens, Dmitry Evtyushkin, Daniel Gruss, https://arxiv.org/pdf/1811.05441.pdf Fixes: b2157399cc98 ("bpf: prevent out-of-bounds speculation") Reported-by: Jann Horn Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: Alexei Starovoitov include/linux/bpf_verifier.h | 10 +++ kernel/bpf/verifier.c | 185 +++++++++++++++++++++++++++++++++++++++++-- 2 files changed, 189 insertions(+), 6 deletions(-) commit b7137c4eab85c1cf3d46acdde90ce1163b28c873 Author: Daniel Borkmann Date: Thu Jan 3 00:58:33 2019 +0100 bpf: fix check_map_access smin_value test when pointer contains offset In check_map_access() we probe actual bounds through __check_map_access() with offset of reg->smin_value + off for lower bound and offset of reg->umax_value + off for the upper bound. However, even though the reg->smin_value could have a negative value, the final result of the sum with off could be positive when pointer arithmetic with known and unknown scalars is combined. In this case we reject the program with an error such as "R min value is negative, either use unsigned index or do a if (index >=0) check." even though the access itself would be fine. Therefore extend the check to probe whether the actual resulting reg->smin_value + off is less than zero. Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: Alexei Starovoitov kernel/bpf/verifier.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 9d7eceede769f90b66cfa06ad5b357140d5141ed Author: Daniel Borkmann Date: Thu Jan 3 00:58:32 2019 +0100 bpf: restrict unknown scalars of mixed signed bounds for unprivileged For unknown scalars of mixed signed bounds, meaning their smin_value is negative and their smax_value is positive, we need to reject arithmetic with pointer to map value. For unprivileged the goal is to mask every map pointer arithmetic and this cannot reliably be done when it is unknown at verification time whether the scalar value is negative or positive. Given this is a corner case, the likelihood of breaking should be very small. Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: Alexei Starovoitov kernel/bpf/verifier.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit e4298d25830a866cc0f427d4bccb858e76715859 Author: Daniel Borkmann Date: Thu Jan 3 00:58:31 2019 +0100 bpf: restrict stack pointer arithmetic for unprivileged Restrict stack pointer arithmetic for unprivileged users in that arithmetic itself must not go out of bounds as opposed to the actual access later on. Therefore after each adjust_ptr_min_max_vals() with a stack pointer as a destination we simulate a check_stack_access() of 1 byte on the destination and once that fails the program is rejected for unprivileged program loads. This is analog to map value pointer arithmetic and needed for masking later on. Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: Alexei Starovoitov kernel/bpf/verifier.c | 63 +++++++++++++++++++++++++++++++++------------------ 1 file changed, 41 insertions(+), 22 deletions(-) commit 0d6303db7970e6f56ae700fa07e11eb510cda125 Author: Daniel Borkmann Date: Thu Jan 3 00:58:30 2019 +0100 bpf: restrict map value pointer arithmetic for unprivileged Restrict map value pointer arithmetic for unprivileged users in that arithmetic itself must not go out of bounds as opposed to the actual access later on. Therefore after each adjust_ptr_min_max_vals() with a map value pointer as a destination it will simulate a check_map_access() of 1 byte on the destination and once that fails the program is rejected for unprivileged program loads. We use this later on for masking any pointer arithmetic with the remainder of the map value space. The likelihood of breaking any existing real-world unprivileged eBPF program is very small for this corner case. Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: Alexei Starovoitov kernel/bpf/verifier.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit 9b73bfdd08e73231d6a90ae6db4b46b3fbf56c30 Author: Daniel Borkmann Date: Thu Jan 3 00:58:29 2019 +0100 bpf: enable access to ax register also from verifier rewrite Right now we are using BPF ax register in JIT for constant blinding as well as in interpreter as temporary variable. Verifier will not be able to use it simply because its use will get overridden from the former in bpf_jit_blind_insn(). However, it can be made to work in that blinding will be skipped if there is prior use in either source or destination register on the instruction. Taking constraints of ax into account, the verifier is then open to use it in rewrites under some constraints. Note, ax register already has mappings in every eBPF JIT. Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: Alexei Starovoitov include/linux/filter.h | 7 +------ kernel/bpf/core.c | 20 ++++++++++++++++++++ 2 files changed, 21 insertions(+), 6 deletions(-) commit 144cd91c4c2bced6eb8a7e25e590f6618a11e854 Author: Daniel Borkmann Date: Thu Jan 3 00:58:28 2019 +0100 bpf: move tmp variable into ax register in interpreter This change moves the on-stack 64 bit tmp variable in ___bpf_prog_run() into the hidden ax register. The latter is currently only used in JITs for constant blinding as a temporary scratch register, meaning the BPF interpreter will never see the use of ax. Therefore it is safe to use it for the cases where tmp has been used earlier. This is needed to later on allow restricted hidden use of ax in both interpreter and JITs. Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: Alexei Starovoitov include/linux/filter.h | 3 ++- kernel/bpf/core.c | 34 +++++++++++++++++----------------- 2 files changed, 19 insertions(+), 18 deletions(-) commit c08435ec7f2bc8f4109401f696fd55159b4b40cb Author: Daniel Borkmann Date: Thu Jan 3 00:58:27 2019 +0100 bpf: move {prev_,}insn_idx into verifier env Move prev_insn_idx and insn_idx from the do_check() function into the verifier environment, so they can be read inside the various helper functions for handling the instructions. It's easier to put this into the environment rather than changing all call-sites only to pass it along. insn_idx is useful in particular since this later on allows to hold state in env->insn_aux_data[env->insn_idx]. Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: Alexei Starovoitov include/linux/bpf_verifier.h | 2 ++ kernel/bpf/verifier.c | 76 ++++++++++++++++++++++---------------------- 2 files changed, 40 insertions(+), 38 deletions(-) commit 9c6260de505b63638dd86fcc33849b17f6146d94 Author: Aditya Pakki Date: Mon Dec 24 12:24:45 2018 -0600 infiniband/qedr: Potential null ptr dereference of qp idr_find() may fail and return a NULL pointer. The fix checks the return value of the function and returns an error in case of NULL. Signed-off-by: Aditya Pakki Acked-by: Michal Kalderon Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/qedr/qedr_iw_cm.c | 2 ++ 1 file changed, 2 insertions(+) commit 94edd87a1c59f3efa6fdf4e98d6d492e6cec6173 Author: Aditya Pakki Date: Wed Dec 26 12:56:22 2018 -0600 infiniband: bnxt_re: qplib: Check the return value of send_message In bnxt_qplib_map_tc2cos(), bnxt_qplib_rcfw_send_message() can return an error value but it is lost. Propagate this error to the callers. Signed-off-by: Aditya Pakki Acked-By: Devesh Sharma Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/bnxt_re/qplib_sp.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 2fb458953a892020f36a323f386d8c7009f10777 Author: Julia Lawall Date: Sun Dec 23 09:57:01 2018 +0100 IB/ipoib: drop useless LIST_HEAD Drop LIST_HEAD where the variable it declares is never used. Commit 31c02e215700 ("IPoIB: Avoid using stale last_send counter when reaping AHs") removed the uses, but not the declaration. The semantic patch that fixes this problem is as follows: (http://coccinelle.lip6.fr/) // @@ identifier x; @@ - LIST_HEAD(x); ... when != x // Fixes: 31c02e215700 ("IPoIB: Avoid using stale last_send counter when reaping AHs") Signed-off-by: Julia Lawall Reviewed-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/ulp/ipoib/ipoib_ib.c | 1 - 1 file changed, 1 deletion(-) commit edefae94b7b9f10d5efe32dece5a36e9d9ecc29e Author: Aaro Koskinen Date: Wed Jan 2 20:43:01 2019 +0200 MIPS: OCTEON: mark RGMII interface disabled on OCTEON III Commit 885872b722b7 ("MIPS: Octeon: Add Octeon III CN7xxx interface detection") added RGMII interface detection for OCTEON III, but it results in the following logs: [ 7.165984] ERROR: Unsupported Octeon model in __cvmx_helper_rgmii_probe [ 7.173017] ERROR: Unsupported Octeon model in __cvmx_helper_rgmii_probe The current RGMII routines are valid only for older OCTEONS that use GMX/ASX hardware blocks. On later chips AGL should be used, but support for that is missing in the mainline. Until that is added, mark the interface as disabled. Fixes: 885872b722b7 ("MIPS: Octeon: Add Octeon III CN7xxx interface detection") Signed-off-by: Aaro Koskinen Signed-off-by: Paul Burton Cc: Ralf Baechle Cc: James Hogan Cc: linux-mips@vger.kernel.org Cc: stable@vger.kernel.org # 4.7+ arch/mips/cavium-octeon/executive/cvmx-helper.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 6e863844ad6effecac92a67a43b8467a8c2e129f Author: Lukasz Luba Date: Wed Dec 5 12:05:55 2018 +0100 PM: sleep: call devfreq suspend/resume Devfreq framework supports suspend of its devices. Call the the devfreq interface and allow devfreq devices preserve/restore their states during suspend/resume. Suggested-by: Tobias Jakobi Reviewed-by: Chanwoo Choi Signed-off-by: Lukasz Luba Signed-off-by: Rafael J. Wysocki drivers/base/power/main.c | 3 +++ 1 file changed, 3 insertions(+) commit 72199051af6205049e96ee7ed34f4fc5f44d1baf Merge: cdf4f4dc118b 75cb8d20c112 Author: Bjorn Helgaas Date: Wed Jan 2 15:31:15 2019 -0600 Merge branch 'pci/imx6' - Enable MSI for imx6 downstream components (Richard Zhu) * pci/imx6: PCI: imx: Enable MSI from downstream components commit cdf4f4dc118bafd97d0148d53730e396ece11afa Merge: c266b026ae7a 7e6d5cd88a6f Author: Bjorn Helgaas Date: Wed Jan 2 15:31:15 2019 -0600 Merge branch 'remotes/lorenzo/pci/uniphier' - Add UniPhier PCIe controller driver and DT bindings (Kunihiko Hayashi) * remotes/lorenzo/pci/uniphier: PCI: uniphier: Add UniPhier PCIe host controller support dt-bindings: PCI: Add UniPhier PCIe host controller description # Conflicts: # drivers/pci/controller/dwc/Kconfig # drivers/pci/controller/dwc/Makefile commit c266b026ae7a51f876eb74e15ff63f834fe35976 Merge: c8778707c23a 41c5c5b0e7c8 Author: Bjorn Helgaas Date: Wed Jan 2 15:31:10 2019 -0600 Merge branch 'remotes/lorenzo/pci/mediatek' - Use devm resource parser in mediatek (Honghui Zhang) - Remove unused mediatek "num-lanes" DT property (Honghui Zhang) * remotes/lorenzo/pci/mediatek: arm64: dts: mt7622: Remove un-used property for PCIe arm: dts: mt7623: Remove un-used property for PCIe dt-bindings: PCI: MediaTek: Remove un-used property PCI: mediatek: Remove un-used variant in struct mtk_pcie_port PCI: mediatek: Use devm_of_pci_get_host_bridge_resources() to parse DT commit c8778707c23a906576c1fdb40dd6ba4090c11773 Merge: 6a790bf0eac4 3f7bb2ec20ce Author: Bjorn Helgaas Date: Wed Jan 2 15:31:09 2019 -0600 Merge branch 'remotes/lorenzo/pci/dwc-msi' - Mask DesignWare interrupts instead of disabling them to avoid lost interrupts (Marc Zyngier) - Add locking when acking DesignWare interrupts (Marc Zyngier) - Ack DesignWare interrupts in the proper callbacks (Marc Zyngier) * remotes/lorenzo/pci/dwc-msi: PCI: dwc: Move interrupt acking into the proper callback PCI: dwc: Take lock when ACKing an interrupt PCI: dwc: Use interrupt masking instead of disabling commit 6a790bf0eac449c3b4dd844c2e799037531f6401 Merge: 33f3fd75b754 ffeccc22d59c Author: Bjorn Helgaas Date: Wed Jan 2 15:31:08 2019 -0600 Merge branch 'remotes/lorenzo/pci/dwc' - Constify histb dw_pcie_host_ops structure (Julia Lawall) - Support multiple power domains for imx6 (Leonard Crestez) - Constify layerscape driver data (Stefan Agner) - Update imx6 Kconfig to allow imx6 PCIe in imx7 kernel (Trent Piepho) - Support armada8k GPIO reset (Baruch Siach) - Support suspend/resume support on imx6 (Leonard Crestez) - Don't hard-code DesignWare DBI/ATU offst (Stephen Warren) - Skip i.MX6 PHY setup on i.MX7D (Andrey Smirnov) - Remove Jianguo Sun from HiSilicon STB maintainers (Lorenzo Pieralisi) * remotes/lorenzo/pci/dwc: MAINTAINERS: Remove Jianguo Sun from HiSilicon STB DWC entry PCI: dwc: Don't hard-code DBI/ATU offset PCI: imx: Add imx6sx suspend/resume support PCI: armada8k: Add support for gpio controlled reset signal PCI: dwc: Adjust Kconfig to allow IMX6 PCIe host on IMX7 PCI: dwc: layerscape: Constify driver data PCI: imx: Add multi-pd support dt-bindings: imx6q-pcie: Add multi-pd bindings for imx6sx PCI: histb: Constify dw_pcie_host_ops structure commit 33f3fd75b754818a6a3d40c4dd441b68b48bea0d Merge: 6ee86cac1cc4 9c0ef6d34fdb Author: Bjorn Helgaas Date: Wed Jan 2 15:31:07 2019 -0600 Merge branch 'remotes/lorenzo/pci/amlogic' - Add Amlogic Meson PCIe controller driver and DT bindings (Yue Wang) * remotes/lorenzo/pci/amlogic: PCI: amlogic: Add the Amlogic Meson PCIe controller driver dt-bindings: PCI: meson: add DT bindings for Amlogic Meson PCIe controller commit 6ee86cac1cc415031b443d8b584305696a300d1e Merge: 54aed1909db6 7dc20ab1b9c4 Author: Bjorn Helgaas Date: Wed Jan 2 15:31:06 2019 -0600 Merge branch 'pci/virtualization' - Skip VF scanning on powerpc, which does this in firmware (Sebastian Ott) * pci/virtualization: s390/pci: skip VF scanning PCI/IOV: Add flag so platforms can skip VF scanning PCI/IOV: Factor out sriov_add_vfs() commit 54aed1909db69f9b160bf36dd4ec314f0c91b56a Merge: 6f7cebea6b13 f7eb7b8a4f72 Author: Bjorn Helgaas Date: Wed Jan 2 15:31:05 2019 -0600 Merge branch 'pci/switchtec' - Remove status check after submitting Switchtec MRPC Firmware Download commands to avoid Completion Timeouts (Kelvin Cao) - Set Switchtec coherent DMA mask to allow 64-bit DMA (Boris Glimcher) - Fix Switchtec SWITCHTEC_IOCTL_EVENT_IDX_ALL flag overwrite issue (Joey Zhang) - Enable write combining for Switchtec MRPC Input buffers (Kelvin Cao) - Add Switchtec MRPC DMA mode support (Wesley Sheng) * pci/switchtec: switchtec: Add MRPC DMA mode support switchtec: Improve MRPC efficiency by enabling write combining switchtec: Fix SWITCHTEC_IOCTL_EVENT_IDX_ALL flags overwrite switchtec: Set DMA coherent mask switchtec: Remove immediate status check after submitting MRPC command commit 6f7cebea6b13d178ad9066bb3e190150cdfe9c75 Merge: baa12e5f3acb c5eb1190074c Author: Bjorn Helgaas Date: Wed Jan 2 15:31:05 2019 -0600 Merge branch 'pci/pm' - Allow runtime PM even if driver doesn't supply callbacks (Jarkko Nikula) * pci/pm: PCI / PM: Allow runtime PM without callback functions commit baa12e5f3acb3cd500c85c4be2c97e769af199fd Merge: e6397dfcb58d fcf9ab35ba41 Author: Bjorn Helgaas Date: Wed Jan 2 15:31:04 2019 -0600 Merge branch 'pci/peer-to-peer' - Clean up P2PDMA documentation (Randy Dunlap) * pci/peer-to-peer: PCI/P2PDMA: Clean up documentation and kernel-doc commit e6397dfcb58d8fcecea314026d4539c85f0dd94b Merge: 84e0e7272209 03e6742584af Author: Bjorn Helgaas Date: Wed Jan 2 15:31:03 2019 -0600 Merge branch 'pci/misc' - Expand Kconfig "PF" acronyms (Randy Dunlap) - Update MAINTAINERS for arch/x86/kernel/early-quirks.c (Bjorn Helgaas) - Add missing include to drivers/pci.h (Alexandru Gagniuc) - Override Synopsys USB 3.x HAPS device class so dwc3-haps can claim it instead of xhci (Thinh Nguyen) * pci/misc: PCI: Override Synopsys USB 3.x HAPS device class PCI: Move Synopsys HAPS platform device IDs PCI: Add missing include to drivers/pci.h PCI: Remove unnecessary space before function pointer arguments MAINTAINERS: Add x86 early-quirks.c file pattern to PCI subsystem PCI: Expand the "PF" acronym in Kconfig help text commit 84e0e72722098c7ced6362d1219c2a40a9d109fa Merge: 2caa4dc607a7 53bb565fc543 Author: Bjorn Helgaas Date: Wed Jan 2 15:31:02 2019 -0600 Merge branch 'pci/enumeration' - Fix Broadcom CNB20LE host bridge unintended sign extension (Colin Ian King) * pci/enumeration: x86/PCI: Fix Broadcom CNB20LE unintended sign extension (redux) commit 2caa4dc607a7025ab40c5bf9c2e2b0dae99ad09a Merge: 651022382c7f 3c259a1c3663 Author: Bjorn Helgaas Date: Wed Jan 2 15:31:02 2019 -0600 Merge branch 'pci/aspm' - Remove unused lists from ASPM pcie_link_state (Frederick Lawler) * pci/aspm: PCI/ASPM: Remove unused lists from struct pcie_link_state commit e49cddcd0ab08f2a3bf3fea8554ea45ae1446d26 Author: Tiecheng Zhou Date: Mon Dec 24 08:55:45 2018 +0800 drm/amdgpu/gfx_v8_0: Reorder the gfx, kiq and kcq rings test sequence The kiq ring and the very first compute ring may fail occasionally if they are tested directly following kiq_kcq_enable. Insert the gfx ring test before kiq ring test to delay the kiq and kcq ring tests will fix the issue. Acked-by: Alex Deucher Signed-off-by: Tiecheng Zhou Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 48 +++++++++++++++++++++++++---------- 1 file changed, 35 insertions(+), 13 deletions(-) commit b8cf66182eddb22e9c7539821ed6eecdb4f86d1a Author: Emily Deng Date: Sat Dec 29 17:46:05 2018 +0800 drm/amdgpu/sriov:Correct pfvf exchange logic The pfvf exchange need be in exclusive mode. And add pfvf exchange in gpu reset. Signed-off-by: Emily Deng Reviewed-By: Xiangliang Yu Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 8 ++++---- drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) commit 048b9b0f5ceefb2691834ac62f8459ebb7d3100e Author: Evan Quan Date: Thu Dec 27 14:23:30 2018 +0800 drm/amd/powerplay: support BOOTUP_DEFAULT power profile mode This can avoid unexpected profile mode change after running compute workload. Signed-off-by: Evan Quan Acked-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/include/kgd_pp_interface.h | 13 ++++++------ drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c | 24 ++++++++++++---------- drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 8 +++++--- drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c | 12 ++++++----- drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c | 10 ++++++--- drivers/gpu/drm/amd/powerplay/inc/hwmgr.h | 2 +- 6 files changed, 40 insertions(+), 29 deletions(-) commit baf3c982dfbf7b0742039e6fef3f1fe1ba4079ab Author: Emily Deng Date: Wed Dec 26 18:08:54 2018 +0800 drm/amdgpu/virtual_dce: No need to pin the cursor bo For virtual display feature, no need to pin cursor bo. Signed-off-by: Emily Deng Reviewed-by: Huang Rui Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 47bbcc1e92385b595e92e11e29076185c820a0b8 Author: Emily Deng Date: Wed Dec 26 18:09:33 2018 +0800 drm/amdgpu/virtual_dce: No need to pin the fb's bo For virtual display, no need to pin the fb's bo. Signed-off-by: Emily Deng Reviewed-by: Huang Rui Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 20 ++++++++++++-------- drivers/gpu/drm/amd/amdgpu/dce_virtual.c | 17 +++-------------- 2 files changed, 15 insertions(+), 22 deletions(-) commit 85f78456f286da46fb054c7d45e4193cb757ac83 Merge: cacf02df4b84 574d356b7a02 Author: Linus Torvalds Date: Wed Jan 2 12:11:01 2019 -0800 Merge tag '9p-for-4.21' of git://github.com/martinetd/linux Pull 9p updates from Dominique Martinet: "Missing prototype warning fix and a syzkaller fix when a 9p server advertises a too small msize" * tag '9p-for-4.21' of git://github.com/martinetd/linux: 9p/net: put a lower bound on msize net/9p: include trans_common.h to fix missing prototype warning. commit cacf02df4b84d261d76db3d290ccb6b951df28c0 Merge: 74673fc50bab fea170804b4d Author: Linus Torvalds Date: Wed Jan 2 12:08:29 2019 -0800 Merge tag '4.21-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs updates from Steve French: - four fixes for stable - improvements to DFS including allowing failover to alternate targets - some small performance improvements * tag '4.21-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6: (39 commits) cifs: update internal module version number cifs: we can not use small padding iovs together with encryption cifs: Minor Kconfig clarification cifs: Always resolve hostname before reconnecting cifs: Add support for failover in cifs_reconnect_tcon() cifs: Add support for failover in smb2_reconnect() cifs: Only free DFS target list if we actually got one cifs: start DFS cache refresher in cifs_mount() cifs: Use GFP_ATOMIC when a lock is held in cifs_mount() cifs: Add support for failover in cifs_reconnect() cifs: Add support for failover in cifs_mount() cifs: remove set but not used variable 'sep' cifs: Make use of DFS cache to get new DFS referrals cifs: minor updates to documentation cifs: check kzalloc return cifs: remove set but not used variable 'server' cifs: Use kzfree() to free password cifs: Fix to use kmem_cache_free() instead of kfree() cifs: update for current_kernel_time64() removal cifs: Add DFS cache routines ... commit 74673fc50babc9be22b32c4ce697fceb51c7671a Merge: 19f2e267a5d0 0db51ef26e87 Author: Linus Torvalds Date: Wed Jan 2 11:05:43 2019 -0800 Merge branch 'next-tpm' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security Pull TPM updates from James Morris: - Support for partial reads of /dev/tpm0. - Clean up for TPM 1.x code: move the commands to tpm1-cmd.c and make everything to use the same data structure for building TPM commands i.e. struct tpm_buf. * 'next-tpm' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (25 commits) tpm: add support for partial reads tpm: tpm_ibmvtpm: fix kdoc warnings tpm: fix kdoc for tpm2_flush_context_cmd() tpm: tpm_try_transmit() refactor error flow. tpm: use u32 instead of int for PCR index tpm1: reimplement tpm1_continue_selftest() using tpm_buf tpm1: reimplement SAVESTATE using tpm_buf tpm1: rename tpm1_pcr_read_dev to tpm1_pcr_read() tpm1: implement tpm1_pcr_read_dev() using tpm_buf structure tpm: tpm1: rewrite tpm1_get_random() using tpm_buf structure tpm: tpm-space.c remove unneeded semicolon tpm: tpm-interface.c drop unused macros tpm: add tpm_auto_startup() into tpm-interface.c tpm: factor out tpm_startup function tpm: factor out tpm 1.x pm suspend flow into tpm1-cmd.c tpm: move tpm 1.x selftest code from tpm-interface.c tpm1-cmd.c tpm: factor out tpm1_get_random into tpm1-cmd.c tpm: move tpm_getcap to tpm1-cmd.c tpm: move tpm1_pcr_extend to tpm1-cmd.c tpm: factor out tpm_get_timeouts() ... commit 19f2e267a5d0d26282a64f8f788c482852c95324 Merge: 1ac5cd497879 20bb4cb4fb9f Author: Linus Torvalds Date: Wed Jan 2 10:56:09 2019 -0800 Merge branch 'next-smack' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security Pull smack updates from James Morris: "Two Smack patches for 4.21. Jose's patch adds missing documentation and Zoran's fleshes out the access checks on keyrings" * 'next-smack' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: Smack: Improve Documentation smack: fix access permissions for keyring commit 1ac5cd4978794bd060d448acc0305e9fc996ba92 Author: Linus Torvalds Date: Wed Jan 2 10:46:03 2019 -0800 block: don't use un-ordered __set_current_state(TASK_UNINTERRUPTIBLE) This mostly reverts commit 849a370016a5 ("block: avoid ordered task state change for polled IO"). It was wrongly claiming that the ordering wasn't necessary. The memory barrier _is_ necessary. If something is truly polling and not going to sleep, it's the whole state setting that is unnecessary, not the memory barrier. Whenever you set your state to a sleeping state, you absolutely need the memory barrier. Note that sometimes the memory barrier can be elsewhere. For example, the ordering might be provided by an external lock, or by setting the process state to sleeping before adding yourself to the wait queue list that is used for waking up (where the wait queue lock itself will guarantee that any wakeup will correctly see the sleeping state). But none of those cases were true here. NOTE! Some of the polling paths may indeed be able to drop the state setting entirely, at which point the memory barrier also goes away. (Also note that this doesn't revert the TASK_RUNNING cases: there is no race between a wakeup and setting the process state to TASK_RUNNING, since the end result doesn't depend on ordering). Cc: Jens Axboe Cc: Christoph Hellwig Signed-off-by: Linus Torvalds fs/block_dev.c | 7 ++----- fs/iomap.c | 3 +-- mm/page_io.c | 3 +-- 3 files changed, 4 insertions(+), 9 deletions(-) commit d63967e475ae10f286dbd35e189cb241e0b1f284 Author: Eric Dumazet Date: Wed Jan 2 09:20:27 2019 -0800 isdn: fix kernel-infoleak in capi_unlocked_ioctl Since capi_ioctl() copies 64 bytes after calling capi20_get_manufacturer() we need to ensure to not leak information to user. BUG: KMSAN: kernel-infoleak in _copy_to_user+0x16b/0x1f0 lib/usercopy.c:32 CPU: 0 PID: 11245 Comm: syz-executor633 Not tainted 4.20.0-rc7+ #2 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x173/0x1d0 lib/dump_stack.c:113 kmsan_report+0x12e/0x2a0 mm/kmsan/kmsan.c:613 kmsan_internal_check_memory+0x9d4/0xb00 mm/kmsan/kmsan.c:704 kmsan_copy_to_user+0xab/0xc0 mm/kmsan/kmsan_hooks.c:601 _copy_to_user+0x16b/0x1f0 lib/usercopy.c:32 capi_ioctl include/linux/uaccess.h:177 [inline] capi_unlocked_ioctl+0x1a0b/0x1bf0 drivers/isdn/capi/capi.c:939 do_vfs_ioctl+0xebd/0x2bf0 fs/ioctl.c:46 ksys_ioctl fs/ioctl.c:713 [inline] __do_sys_ioctl fs/ioctl.c:720 [inline] __se_sys_ioctl+0x1da/0x270 fs/ioctl.c:718 __x64_sys_ioctl+0x4a/0x70 fs/ioctl.c:718 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 RIP: 0033:0x440019 Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffdd4659fb8 EFLAGS: 00000213 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440019 RDX: 0000000020000080 RSI: 00000000c0044306 RDI: 0000000000000003 RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 R10: 0000000000000000 R11: 0000000000000213 R12: 00000000004018a0 R13: 0000000000401930 R14: 0000000000000000 R15: 0000000000000000 Local variable description: ----data.i@capi_unlocked_ioctl Variable was created at: capi_ioctl drivers/isdn/capi/capi.c:747 [inline] capi_unlocked_ioctl+0x82/0x1bf0 drivers/isdn/capi/capi.c:939 do_vfs_ioctl+0xebd/0x2bf0 fs/ioctl.c:46 Bytes 12-63 of 64 are uninitialized Memory access of size 64 starts at ffff88807ac5fce8 Data copied to user address 0000000020000080 Signed-off-by: Eric Dumazet Reported-by: syzbot Cc: Karsten Keil Signed-off-by: David S. Miller drivers/isdn/capi/kcapi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 7adf3246092f5e87ed0fa610e8088fae416c581f Author: Stefano Brivio Date: Wed Jan 2 13:29:27 2019 +0100 ipv6: route: Fix return value of ip6_neigh_lookup() on neigh_create() error In ip6_neigh_lookup(), we must not return errors coming from neigh_create(): if creation of a neighbour entry fails, the lookup should return NULL, in the same way as it's done in __neigh_lookup(). Otherwise, callers legitimately checking for a non-NULL return value of the lookup function might dereference an invalid pointer. For instance, on neighbour table overflow, ndisc_router_discovery() crashes ndisc_update() by passing ERR_PTR(-ENOBUFS) as 'neigh' argument. Reported-by: Jianlin Shi Fixes: f8a1b43b709d ("net/ipv6: Create a neigh_lookup for FIB entries") Signed-off-by: Stefano Brivio Reviewed-by: David Ahern Signed-off-by: David S. Miller net/ipv6/route.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 202700e30740c6568b5a6943662f3829566dd533 Author: Eric Dumazet Date: Wed Jan 2 04:24:20 2019 -0800 net/hamradio/6pack: use mod_timer() to rearm timers Using del_timer() + add_timer() is generally unsafe on SMP, as noticed by syzbot. Use mod_timer() instead. kernel BUG at kernel/time/timer.c:1136! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 1026 Comm: kworker/u4:4 Not tainted 4.20.0+ #2 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events_unbound flush_to_ldisc RIP: 0010:add_timer kernel/time/timer.c:1136 [inline] RIP: 0010:add_timer+0xa81/0x1470 kernel/time/timer.c:1134 Code: 4d 89 7d 40 48 c7 85 70 fe ff ff 00 00 00 00 c7 85 7c fe ff ff ff ff ff ff 48 89 85 90 fe ff ff e9 e6 f7 ff ff e8 cf 42 12 00 <0f> 0b e8 c8 42 12 00 0f 0b e8 c1 42 12 00 4c 89 bd 60 fe ff ff e9 RSP: 0018:ffff8880a7fdf5a8 EFLAGS: 00010293 RAX: ffff8880a7846340 RBX: dffffc0000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff816f3ee1 RDI: ffff88808a514ff8 RBP: ffff8880a7fdf760 R08: 0000000000000007 R09: ffff8880a7846c58 R10: ffff8880a7846340 R11: 0000000000000000 R12: ffff88808a514ff8 R13: ffff88808a514ff8 R14: ffff88808a514dc0 R15: 0000000000000030 FS: 0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000061c500 CR3: 00000000994d9000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: decode_prio_command drivers/net/hamradio/6pack.c:903 [inline] sixpack_decode drivers/net/hamradio/6pack.c:971 [inline] sixpack_receive_buf drivers/net/hamradio/6pack.c:457 [inline] sixpack_receive_buf+0xf9c/0x1470 drivers/net/hamradio/6pack.c:434 tty_ldisc_receive_buf+0x164/0x1c0 drivers/tty/tty_buffer.c:465 tty_port_default_receive_buf+0x114/0x190 drivers/tty/tty_port.c:38 receive_buf drivers/tty/tty_buffer.c:481 [inline] flush_to_ldisc+0x3b2/0x590 drivers/tty/tty_buffer.c:533 process_one_work+0xd0c/0x1ce0 kernel/workqueue.c:2153 worker_thread+0x143/0x14a0 kernel/workqueue.c:2296 kthread+0x357/0x430 kernel/kthread.c:246 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet Reported-by: syzbot Cc: Andreas Koensgen Signed-off-by: David S. Miller drivers/net/hamradio/6pack.c | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) commit 53fe3ed19df0bca6ce752fae8e483910b6f112f6 Author: Xue Chaojing Date: Tue Jan 1 19:39:33 2019 +0000 net-next/hinic:add shutdown callback If there is no shutdown callback, our board will report pcie UNF errors after restarting. This patch add shutdown callback for hinic. Signed-off-by: Xue Chaojing Signed-off-by: David S. Miller drivers/net/ethernet/huawei/hinic/hinic_main.c | 6 ++++++ 1 file changed, 6 insertions(+) commit d9a7fa67b4bfe6ce93ee9aab23ae2e7ca0763e84 Merge: f218a29c25ad 55b8cbe470d1 Author: Linus Torvalds Date: Wed Jan 2 09:48:13 2019 -0800 Merge branch 'next-seccomp' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security Pull seccomp updates from James Morris: - Add SECCOMP_RET_USER_NOTIF - seccomp fixes for sparse warnings and s390 build (Tycho) * 'next-seccomp' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: seccomp, s390: fix build for syscall type change seccomp: fix poor type promotion samples: add an example of seccomp user trap seccomp: add a return code to trap to userspace seccomp: switch system call argument type to void * seccomp: hoist struct seccomp_data recalculation higher commit 399382f8018204407174f0229b4087d40e1cdc82 Author: Bartlomiej Zolnierkiewicz Date: Wed Jan 2 18:47:37 2019 +0100 drm/nouveau: fix incorrect FB_BACKLIGHT usage in Kconfig Making FB_BACKLIGHT tristate by commit b4a1ed0cd18b ("fbdev: make FB_BACKLIGHT a tristate") caused unmet dependencies in some configurations: WARNING: unmet direct dependencies detected for FB_BACKLIGHT Depends on [m]: HAS_IOMEM [=y] && FB [=m] Selected by [y]: - DRM_NOUVEAU [=y] && HAS_IOMEM [=y] && DRM [=y] && PCI [=y] && MMU [=y] && DRM_NOUVEAU_BACKLIGHT [=y] Selected by [m]: - FB_NVIDIA [=m] && HAS_IOMEM [=y] && FB [=m] && PCI [=y] && FB_NVIDIA_BACKLIGHT [=y] Fix it by making DRM_NOUVEAU select BACKLIGHT_CLASS_DEVICE and BACKLIGHT_LCD_SUPPORT instead of FB_BACKLIGHT. Fixes: b4a1ed0cd18b ("fbdev: make FB_BACKLIGHT a tristate") Reported-by: Randy Dunlap Acked-by: Randy Dunlap # build-tested Cc: Rob Clark Cc: Arnd Bergmann Cc: Ben Skeggs Cc: David Airlie Cc: Daniel Vetter Cc: Stephen Rothwell Signed-off-by: Bartlomiej Zolnierkiewicz drivers/gpu/drm/nouveau/Kconfig | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit f218a29c25ad8abdb961435d6b8139f462061364 Merge: 8e143b90e4d4 c7f7e58fcbf3 Author: Linus Torvalds Date: Wed Jan 2 09:43:14 2019 -0800 Merge branch 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security Pull integrity updates from James Morris: "In Linux 4.19, a new LSM hook named security_kernel_load_data was upstreamed, allowing LSMs and IMA to prevent the kexec_load syscall. Different signature verification methods exist for verifying the kexec'ed kernel image. This adds additional support in IMA to prevent loading unsigned kernel images via the kexec_load syscall, independently of the IMA policy rules, based on the runtime "secure boot" flag. An initial IMA kselftest is included. In addition, this pull request defines a new, separate keyring named ".platform" for storing the preboot/firmware keys needed for verifying the kexec'ed kernel image's signature and includes the associated IMA kexec usage of the ".platform" keyring. (David Howell's and Josh Boyer's patches for reading the preboot/firmware keys, which were previously posted for a different use case scenario, are included here)" * 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: integrity: Remove references to module keyring ima: Use inode_is_open_for_write ima: Support platform keyring for kernel appraisal efi: Allow the "db" UEFI variable to be suppressed efi: Import certificates from UEFI Secure Boot efi: Add an EFI signature blob parser efi: Add EFI signature data types integrity: Load certs to the platform keyring integrity: Define a trusted platform keyring selftests/ima: kexec_load syscall test ima: don't measure/appraise files on efivarfs x86/ima: retry detecting secure boot mode docs: Extend trusted keys documentation for TPM 2.0 x86/ima: define arch_get_ima_policy() for x86 ima: add support for arch specific policies ima: refactor ima_init_policy() ima: prevent kexec_load syscall based on runtime secureboot flag x86/ima: define arch_ima_get_secureboot integrity: support new struct public_key_signature encoding field commit 125892edfe69915a227d8d125ff0e1cd713178f4 Author: Tetsuo Handa Date: Tue Jan 1 18:54:26 2019 +0900 inotify: Fix fd refcount leak in inotify_add_watch(). Commit 4d97f7d53da7dc83 ("inotify: Add flag IN_MASK_CREATE for inotify_add_watch()") forgot to call fdput() before bailing out. Fixes: 4d97f7d53da7dc83 ("inotify: Add flag IN_MASK_CREATE for inotify_add_watch()") CC: stable@vger.kernel.org Signed-off-by: Tetsuo Handa Reviewed-by: Amir Goldstein Signed-off-by: Jan Kara fs/notify/inotify/inotify_user.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 260f71eff493a844531629854c0935fa8de4fa2c Author: Yangtao Li Date: Fri Dec 21 10:59:36 2018 -0500 sunrpc: convert to DEFINE_SHOW_ATTRIBUTE Use DEFINE_SHOW_ATTRIBUTE macro to simplify the code. Signed-off-by: Yangtao Li Signed-off-by: Anna Schumaker net/sunrpc/rpc_pipe.c | 19 +++---------------- 1 file changed, 3 insertions(+), 16 deletions(-) commit 10e037d1e0d5d93cc057e4fad6911e481a462407 Author: Santosh kumar pradhan Date: Wed Dec 19 12:29:57 2018 +0530 sunrpc: Add xprt after nfs4_test_session_trunk() Multipathing: In case of NFSv3, rpc_clnt_test_and_add_xprt() adds the xprt to xprt switch (i.e. xps) if rpc_call_null_helper() returns success. But in case of NFSv4.1, it needs to do EXCHANGEID to verify the path along with check for session trunking. Add the xprt in nfs4_test_session_trunk() only when nfs4_detect_session_trunking() returns success. Also release refcount hold by rpc_clnt_setup_test_and_add_xprt(). Signed-off-by: Santosh kumar pradhan Tested-by: Suresh Jayaraman Reported-by: Aditya Agnihotri Signed-off-by: Anna Schumaker fs/nfs/internal.h | 6 +++--- fs/nfs/nfs4_fs.h | 3 ++- fs/nfs/nfs4proc.c | 8 +++++--- include/linux/sunrpc/clnt.h | 4 ++-- net/sunrpc/clnt.c | 3 +++ 5 files changed, 15 insertions(+), 9 deletions(-) commit cb24e35b4fa8448e7ee963884958235b8de44f25 Author: J. Bruce Fields Date: Thu Dec 20 10:42:36 2018 -0500 sunrpc: convert unnecessary GFP_ATOMIC to GFP_NOFS It's OK to sleep here, we just don't want to recurse into the filesystem as a writeout could be waiting on this. Future work: the documentation for GFP_NOFS says "Please try to avoid using this flag directly and instead use memalloc_nofs_{save,restore} to mark the whole scope which cannot/shouldn't recurse into the FS layer with a short explanation why. All allocation requests will inherit GFP_NOFS implicitly." But I'm not sure where to do this. Should the workqueue be arranging that for us in the case of workqueues created with WQ_MEM_RECLAIM? Reported-by: Trond Myklebust Signed-off-by: J. Bruce Fields Signed-off-by: Anna Schumaker net/sunrpc/rpcb_clnt.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 81c88b18de1f11f70c97f28ced8d642c00bb3955 Author: J. Bruce Fields Date: Thu Dec 20 10:35:11 2018 -0500 sunrpc: handle ENOMEM in rpcb_getport_async If we ignore the error we'll hit a null dereference a little later. Reported-by: syzbot+4b98281f2401ab849f4b@syzkaller.appspotmail.com Signed-off-by: J. Bruce Fields Signed-off-by: Anna Schumaker net/sunrpc/rpcb_clnt.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit c2c7d84fd173aff121ffd45cf15277eff43348d3 Author: NeilBrown Date: Thu Dec 20 10:29:55 2018 +1100 NFS: remove unnecessary test for IS_ERR(cred) As gte_current_cred() cannot return an error, this test is not necessary. It hasn't been necessary for years, but it wasn't so obvious before. Reported-by: Dan Carpenter Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker fs/nfs/unlink.c | 5 ----- 1 file changed, 5 deletions(-) commit 07e10308ee5da8e6132e0b737ece1c99dd651fb6 Author: Chuck Lever Date: Fri Dec 7 11:11:44 2018 -0500 xprtrdma: Prevent leak of rpcrdma_rep objects If a reply has been processed but the RPC is later retransmitted anyway, the req->rl_reply field still contains the only pointer to the old rpcrdma rep. When the next reply comes in, the reply handler will stomp on the rl_reply field, leaking the old rep. A trace event is added to capture such leaks. This problem seems to be worsened by the restructuring of the RPC Call path in v4.20. Fully addressing this issue will require at least a re-architecture of the disconnect logic, which is not appropriate during -rc. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker include/trace/events/rpcrdma.h | 28 ++++++++++++++++++++++++++++ net/sunrpc/xprtrdma/rpc_rdma.c | 4 ++++ 2 files changed, 32 insertions(+) commit 9aeaf8cfcb71f3663737bc21b93da7e1b8845c0d Author: Olga Kornievskaia Date: Thu Dec 6 11:10:36 2018 -0500 NFSv4.2 fix async copy reboot recovery Original commit (e4648aa4f98a "NFS recover from destination server reboot for copies") used memcmp() and then it was changed to use nfs4_stateid_match_other() but that function returns opposite of memcmp. As the result, recovery can't find the copy leading to copy hanging. Fixes: 80f42368868e ("NFSv4: Split out NFS v4.2 copy completion functions") Fixes: cb7a8384dc02 ("NFS: Split out the body of nfs4_reclaim_open_state") Signed-of-by: Olga Kornievskaia Signed-off-by: Anna Schumaker fs/nfs/nfs4state.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f85adb1bf59557909f86f71cf4b1e5a906bdb465 Author: Chuck Lever Date: Wed Dec 19 11:00:48 2018 -0500 xprtrdma: Don't leak freed MRs Defensive clean up. Don't set frwr->fr_mr until we know that the scatterlist allocation has succeeded. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/frwr_ops.c | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-) commit af65ed404c437684c9f58d0c37495abedcdfa3fc Author: Chuck Lever Date: Wed Dec 19 11:00:37 2018 -0500 xprtrdma: Add documenting comment for rpcrdma_buffer_destroy Make a note of the function's dependency on an earlier ib_drain_qp. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/verbs.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 995d312a28cc2a6a5640ceb2dcbdfde37d050c07 Author: Chuck Lever Date: Wed Dec 19 11:00:32 2018 -0500 xprtrdma: Replace outdated comment for rpcrdma_ep_post Since commit 7c8d9e7c8863 ("xprtrdma: Move Receive posting to Receive handler"), rpcrdma_ep_post is no longer responsible for posting Receive buffers. Update the documenting comment to reflect this change. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/verbs.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) commit e0f86bc4f990edb56440640964fdcf3f3cf4e240 Author: Chuck Lever Date: Wed Dec 19 11:00:27 2018 -0500 xprtrdma: Update comments in frwr_op_send Commit f2877623082b ("xprtrdma: Chain Send to FastReg WRs") was written before commit ce5b37178283 ("xprtrdma: Replace all usage of "frmr" with "frwr""), but was merged afterwards. Thus it still refers to FRMR and MWs. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/frwr_ops.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit acf0a39f4f277d0cb7178be5ec8a808c6c2bcd9c Author: Chuck Lever Date: Wed Dec 19 11:00:22 2018 -0500 SUNRPC: Fix some kernel doc complaints Clean up some warnings observed when building with "make W=1". Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/auth_gss/gss_mech_switch.c | 2 +- net/sunrpc/backchannel_rqst.c | 2 +- net/sunrpc/xprtmultipath.c | 4 ++-- net/sunrpc/xprtsock.c | 2 ++ 4 files changed, 6 insertions(+), 4 deletions(-) commit dc5820bd21d84ee34770b0a1e2fca9378f8f7456 Author: Chuck Lever Date: Wed Dec 19 11:00:16 2018 -0500 SUNRPC: Simplify defining common RPC trace events Clean up, no functional change is expected. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker include/trace/events/sunrpc.h | 172 +++++++++++++++++------------------------- 1 file changed, 69 insertions(+), 103 deletions(-) commit 5b2095d0cefa218deca156eecbe0c656e5766129 Author: Chuck Lever Date: Wed Dec 19 11:00:11 2018 -0500 NFS: Fix NFSv4 symbolic trace point output These symbolic values were not being displayed in string form. TRACE_DEFINE_ENUM was missing in many cases. It also turns out that __print_symbolic wants an unsigned long in the first field... Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker fs/nfs/nfs4trace.h | 456 ++++++++++++++++++++++++++++++++++++----------------- 1 file changed, 313 insertions(+), 143 deletions(-) commit 53b2c1cb9b3cd901a200ddbbf08c77eabf1ab3e9 Author: Chuck Lever Date: Wed Dec 19 11:00:06 2018 -0500 xprtrdma: Trace mapping, alloc, and dereg failures These are rare, but can be helpful at tracking down DMAR and other problems. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker include/trace/events/rpcrdma.h | 136 +++++++++++++++++++++++++++++++++++++++++ net/sunrpc/xprtrdma/frwr_ops.c | 12 ++-- net/sunrpc/xprtrdma/rpc_rdma.c | 2 +- net/sunrpc/xprtrdma/verbs.c | 4 +- 4 files changed, 144 insertions(+), 10 deletions(-) commit 395069fc37e7a76280b176c0327d1ead6ca29838 Author: Chuck Lever Date: Wed Dec 19 11:00:00 2018 -0500 xprtrdma: Add trace points for calls to transport switch methods Name them "trace_xprtrdma_op_*" so they can be easily enabled as a group. No trace point is added where the generic layer already has observability. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker include/trace/events/rpcrdma.h | 10 ++++++---- net/sunrpc/xprtrdma/transport.c | 18 +++++++++++------- 2 files changed, 17 insertions(+), 11 deletions(-) commit ba217ec64aef91f40c3cbdbfb0ab3a4000782504 Author: Chuck Lever Date: Wed Dec 19 10:59:55 2018 -0500 xprtrdma: Relocate the xprtrdma_mr_map trace points The mr_map trace points were capturing information about the previous use of the MR rather than about the segment that was just mapped. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/frwr_ops.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit aba11831794356ff58da69de46a125e6335eb9ca Author: Chuck Lever Date: Wed Dec 19 10:59:49 2018 -0500 xprtrdma: Clean up of xprtrdma chunk trace points The chunk-related trace points capture nearly the same information as the MR-related trace points. Also, rename them so globbing can be used to enable or disable these trace points more easily. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker include/trace/events/rpcrdma.h | 42 ++++++++++++++++++++++++++---------------- net/sunrpc/xprtrdma/rpc_rdma.c | 6 +++--- 2 files changed, 29 insertions(+), 19 deletions(-) commit 9bef848f44b4316fbe12e364eea527bd59fa1ed3 Author: Chuck Lever Date: Wed Dec 19 10:59:44 2018 -0500 xprtrdma: Remove unused fields from rpcrdma_ia Clean up. The last use of these fields was in commit 173b8f49b3af ("xprtrdma: Demote "connect" log messages") . Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/xprt_rdma.h | 2 -- 1 file changed, 2 deletions(-) commit ddbb347f0c68a66cb20b78af4bc318b10d30e425 Author: Chuck Lever Date: Wed Dec 19 10:59:39 2018 -0500 xprtrdma: Cull dprintk() call sites Clean up: Remove dprintk() call sites that report rare or impossible errors. Leave a few that display high-value low noise status information. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/backchannel.c | 3 --- net/sunrpc/xprtrdma/rpc_rdma.c | 17 ++++++++++------- net/sunrpc/xprtrdma/transport.c | 33 ++++----------------------------- net/sunrpc/xprtrdma/verbs.c | 34 +++++----------------------------- 4 files changed, 19 insertions(+), 68 deletions(-) commit 92f4433e567a034d87e1e2c9e5402ff5f58b545b Author: Chuck Lever Date: Wed Dec 19 10:59:33 2018 -0500 xprtrdma: Simplify locking that protects the rl_allreqs list Clean up: There's little chance of contention between the use of rb_lock and rb_reqslock, so merge the two. This avoids having to take both in some (possibly future) cases. Transport tear-down is already serialized, thus there is no need for locking at all when destroying rpcrdma_reqs. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/backchannel.c | 20 +++----------------- net/sunrpc/xprtrdma/verbs.c | 31 +++++++++++++++++-------------- net/sunrpc/xprtrdma/xprt_rdma.h | 7 +++---- 3 files changed, 23 insertions(+), 35 deletions(-) commit 236b0943d1f21335a0fc4324f3bcc455cf99dfb7 Author: Chuck Lever Date: Wed Dec 19 10:59:28 2018 -0500 xprtrdma: Expose transport header errors For better observability of parsing errors, return the error code generated in the decoders to the upper layer consumer. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/rpc_rdma.c | 1 - 1 file changed, 1 deletion(-) commit 889ee07f7ed26bb2cc525eb48f7f865bc407ef0b Author: Chuck Lever Date: Wed Dec 19 10:59:23 2018 -0500 xprtrdma: Remove request_module from backchannel Since commit ffe1f0df5862 ("rpcrdma: Merge svcrdma and xprtrdma modules into one"), the forward and backchannel components are part of the same kernel module. A separate request_module() call in the backchannel code is no longer necessary. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/backchannel.c | 2 -- 1 file changed, 2 deletions(-) commit 15303d9ecd2f29168aea0b080bd1ec27c298da3f Author: Chuck Lever Date: Wed Dec 19 10:59:17 2018 -0500 xprtrdma: Recognize XDRBUF_SPARSE_PAGES Commit 431f6eb3570f ("SUNRPC: Add a label for RPC calls that require allocation on receive") didn't update similar logic in rpc_rdma.c. I don't think this is a bug, per-se; the commit just adds more careful checking for broken upper layer behavior. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/rpc_rdma.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) commit 0dfbb5f05e7888903e7e1da6c2c4aa017ee1a207 Author: Chuck Lever Date: Wed Dec 19 10:59:12 2018 -0500 NFS: Make "port=" mount option optional for RDMA mounts Having to specify "proto=rdma,port=20049" is cumbersome. RFC 8267 Section 6.3 requires NFSv4 clients to use "the alternative well-known port number", which is 20049. Make the use of the well- known port number automatic, just as it is for NFS/TCP and port 2049. For NFSv2/3, Section 4.2 allows clients to simply choose 20049 as the default or use rpcbind. I don't know of an NFS/RDMA server implementation that registers it's NFS/RDMA service with rpcbind, so automatically choosing 20049 seems like the better choice. The other widely-deployed NFS/RDMA client, Solaris, also uses 20049 as the default port. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker fs/nfs/super.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) commit 0a93fbcb16e6b1f36780f9a20d6427f26cec761d Author: Chuck Lever Date: Wed Dec 19 10:59:07 2018 -0500 xprtrdma: Plant XID in on-the-wire RDMA offset (FRWR) Place the associated RPC transaction's XID in the upper 32 bits of each RDMA segment's rdma_offset field. There are two reasons to do this: - The R_key only has 8 bits that are different from registration to registration. The XID adds more uniqueness to each RDMA segment to reduce the likelihood of a software bug on the server reading from or writing into memory it's not supposed to. - On-the-wire RDMA Read and Write requests do not otherwise carry any identifier that matches them up to an RPC. The XID in the upper 32 bits will act as an eye-catcher in network captures. Suggested-by: Tom Talpey Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/frwr_ops.c | 5 ++++- net/sunrpc/xprtrdma/rpc_rdma.c | 6 +++--- net/sunrpc/xprtrdma/xprt_rdma.h | 2 +- 3 files changed, 8 insertions(+), 5 deletions(-) commit 5f62412be3ff738c9575b28c1f4a9b010ac22316 Author: Chuck Lever Date: Wed Dec 19 10:59:01 2018 -0500 xprtrdma: Remove rpcrdma_memreg_ops Clean up: Now that there is only FRWR, there is no need for a memory registration switch. The indirect calls to the memreg operations can be replaced with faster direct calls. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/frwr_ops.c | 131 ++++++++++++++++++++++++++-------------- net/sunrpc/xprtrdma/rpc_rdma.c | 14 ++--- net/sunrpc/xprtrdma/transport.c | 2 +- net/sunrpc/xprtrdma/verbs.c | 22 +++---- net/sunrpc/xprtrdma/xprt_rdma.h | 48 ++++++--------- 5 files changed, 116 insertions(+), 101 deletions(-) commit ba69cd122ece618eba47589764c7f9c1f57aed95 Author: Chuck Lever Date: Wed Dec 19 10:58:56 2018 -0500 xprtrdma: Remove support for FMR memory registration FMR is not supported on most recent RDMA devices. It is also less secure than FRWR because an FMR memory registration can expose adjacent bytes to remote reading or writing. As discussed during the RDMA BoF at LPC 2018, it is time to remove support for FMR in the NFS/RDMA client stack. Note that NFS/RDMA server-side uses either local memory registration or FRWR. FMR is not used. There are a few Infiniband/RoCE devices in the kernel tree that do not appear to support MEM_MGT_EXTENSIONS (FRWR), and therefore will not support client-side NFS/RDMA after this patch. These are: - mthca - qib - hns (RoCE) Users of these devices can use NFS/TCP on IPoIB instead. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/Makefile | 3 +- net/sunrpc/xprtrdma/fmr_ops.c | 340 ---------------------------------------- net/sunrpc/xprtrdma/verbs.c | 6 - net/sunrpc/xprtrdma/xprt_rdma.h | 12 +- 4 files changed, 2 insertions(+), 359 deletions(-) commit a78868497c2e4858e2c73818eed7b4877ab2316d Author: Chuck Lever Date: Wed Dec 19 10:58:51 2018 -0500 xprtrdma: Reduce max_frwr_depth Some devices advertise a large max_fast_reg_page_list_len capability, but perform optimally when MRs are significantly smaller than that depth -- probably when the MR itself is no larger than a page. By default, the RDMA R/W core API uses max_sge_rd as the maximum page depth for MRs. For some devices, the value of max_sge_rd is 1, which is also not optimal. Thus, when max_sge_rd is larger than 1, use that value. Otherwise use the value of the max_fast_reg_page_list_len attribute. I've tested this with CX-3 Pro, FastLinq, and CX-5 devices. It reproducibly improves the throughput of large I/Os by several percent. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/frwr_ops.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) commit 6946f82380a83acb7023fab9d7033e1f016cb818 Author: Chuck Lever Date: Wed Dec 19 10:58:45 2018 -0500 xprtrdma: Fix ri_max_segs and the result of ro_maxpages With certain combinations of krb5i/p, MR size, and r/wsize, I/O can fail with EMSGSIZE. This is because the calculated value of ri_max_segs (the max number of MRs per RPC) exceeded RPCRDMA_MAX_HDR_SEGS, which caused Read or Write list encoding to walk off the end of the transport header. Once that was addressed, the ro_maxpages result has to be corrected to account for the number of MRs needed for Reply chunks, which is 2 MRs smaller than a normal Read or Write chunk. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/fmr_ops.c | 7 +++++-- net/sunrpc/xprtrdma/frwr_ops.c | 7 +++++-- net/sunrpc/xprtrdma/transport.c | 6 ++++-- 3 files changed, 14 insertions(+), 6 deletions(-) commit 0c0829bcf51aef713806e49b8ea2bac7962f54e2 Author: Chuck Lever Date: Wed Dec 19 10:58:40 2018 -0500 xprtrdma: Don't wake pending tasks until disconnect is done Transport disconnect processing does a "wake pending tasks" at various points. Suppose an RPC Reply is being processed. The RPC task that Reply goes with is waiting on the pending queue. If a disconnect wake-up happens before reply processing is done, that reply, even if it is good, is thrown away, and the RPC has to be sent again. This window apparently does not exist for socket transports because there is a lock held while a reply is being received which prevents the wake-up call until after reply processing is done. To resolve this, all RPC replies being processed on an RPC-over-RDMA transport have to complete before pending tasks are awoken due to a transport disconnect. Callers that already hold the transport write lock may invoke ->ops->close directly. Others use a generic helper that schedules a close when the write lock can be taken safely. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/backchannel.c | 13 +++++++------ net/sunrpc/xprtrdma/svc_rdma_backchannel.c | 8 +++++--- net/sunrpc/xprtrdma/transport.c | 17 ++++++++++------- net/sunrpc/xprtrdma/verbs.c | 1 - net/sunrpc/xprtrdma/xprt_rdma.h | 1 + 5 files changed, 23 insertions(+), 17 deletions(-) commit 3d433ad812baad45fa697f1af45a651147360712 Author: Chuck Lever Date: Wed Dec 19 10:58:35 2018 -0500 xprtrdma: No qp_event disconnect After thinking about this more, and auditing other kernel ULP imple- mentations, I believe that a DISCONNECT cm_event will occur after a fatal QP event. If that's the case, there's no need for an explicit disconnect in the QP event handler. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/verbs.c | 32 -------------------------------- net/sunrpc/xprtrdma/xprt_rdma.h | 1 - 2 files changed, 33 deletions(-) commit 6d2d0ee27c7a12371a0ca51a5db414204901228c Author: Chuck Lever Date: Wed Dec 19 10:58:29 2018 -0500 xprtrdma: Replace rpcrdma_receive_wq with a per-xprt workqueue To address a connection-close ordering problem, we need the ability to drain the RPC completions running on rpcrdma_receive_wq for just one transport. Give each transport its own RPC completion workqueue, and drain that workqueue when disconnecting the transport. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/rpc_rdma.c | 2 +- net/sunrpc/xprtrdma/transport.c | 17 ++++------- net/sunrpc/xprtrdma/verbs.c | 67 ++++++++++++++++++++++------------------- net/sunrpc/xprtrdma/xprt_rdma.h | 6 +--- 4 files changed, 44 insertions(+), 48 deletions(-) commit 6ceea36890a01aa626ce08487eecc5fb43e749b1 Author: Chuck Lever Date: Wed Dec 19 10:58:24 2018 -0500 xprtrdma: Refactor Receive accounting Clean up: Divide the work cleanly: - rpcrdma_wc_receive is responsible only for RDMA Receives - rpcrdma_reply_handler is responsible only for RPC Replies - the posted send and receive counts both belong in rpcrdma_ep Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker include/trace/events/rpcrdma.h | 2 +- net/sunrpc/xprtrdma/backchannel.c | 1 - net/sunrpc/xprtrdma/rpc_rdma.c | 21 +++------------------ net/sunrpc/xprtrdma/verbs.c | 31 ++++++++++++++----------------- net/sunrpc/xprtrdma/xprt_rdma.h | 3 +-- 5 files changed, 19 insertions(+), 39 deletions(-) commit b674c4b4a13dc3d37f1b4a449f3b9515f9a30615 Author: Chuck Lever Date: Wed Dec 19 10:58:19 2018 -0500 xprtrdma: Ensure MRs are DMA-unmapped when posting LOCAL_INV fails The recovery case in frwr_op_unmap_sync needs to DMA unmap each MR. frwr_release_mr does not DMA-unmap, but the recycle worker does. Fixes: 61da886bf74e ("xprtrdma: Explicitly resetting MRs is ... ") Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/frwr_ops.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit e2f34e26710bfaa545a9d9cd0c70137406401467 Author: Chuck Lever Date: Wed Dec 19 10:58:13 2018 -0500 xprtrdma: Yet another double DMA-unmap While chasing yet another set of DMAR fault reports, I noticed that the frwr recycler conflates whether or not an MR has been DMA unmapped with frwr->fr_state. Actually the two have only an indirect relationship. It's in fact impossible to guess reliably whether the MR has been DMA unmapped based on its fr_state field, especially as the surrounding code and its assumptions have changed over time. A better approach is to track the DMA mapping status explicitly so that the recycler is less brittle to unexpected situations, and attempts to DMA-unmap a second time are prevented. Signed-off-by: Chuck Lever Cc: stable@vger.kernel.org # v4.20 Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/frwr_ops.c | 6 ++++-- net/sunrpc/xprtrdma/verbs.c | 9 ++++++--- 2 files changed, 10 insertions(+), 5 deletions(-) commit 2f1927b090345d7e65e6e873baba1599b18a0e26 Author: Moni Shoua Date: Wed Dec 26 21:42:12 2018 +0200 IB/core: Add advise_mr to the list of known ops We need to add advise_mr to the list of operation setters on the ib_device or otherwise callers to ib_set_device_ops() for advise_mr operation will not have their callback registered. When the advise_mr series was merged with the device ops series the SET_DEVICE_OPS() was missed. Fixes: 813e90b1aeaa ("IB/mlx5: Add advise_mr() support") Signed-off-by: Moni Shoua Reviewed-by: Majd Dibbiny Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/core/device.c | 1 + 1 file changed, 1 insertion(+) commit ccffa545485714dcb001c78ffaa575a8192ed5e4 Author: Leon Romanovsky Date: Wed Dec 26 15:22:12 2018 +0200 Revert "IB/mlx5: Fix long EEH recover time with NVMe offloads" Longer term testing shows this patch didn't play well with MR cache and caused to call traces during remove_mkeys(). This reverts commit bb7e22a8ab00ff9ba911a45ba8784cef9e6d6f7a. Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/mlx5/mr.c | 19 +++---------------- 1 file changed, 3 insertions(+), 16 deletions(-) commit 7422edce73559d2985f322145c865cea2da3c152 Author: Yishai Hadas Date: Sun Dec 23 13:12:21 2018 +0200 IB/mlx5: Allow XRC INI usage via verbs in DEVX context From device point of view both XRC target and initiator are XRC transport type. Fix to use the expected UID as was handled for the XRC target case to allow its usage via verbs in DEVX context. Fixes: 5aa3771ded54 ("IB/mlx5: Allow XRC usage via verbs in DEVX context") Signed-off-by: Yishai Hadas Reviewed-by: Artemy Kovalyov Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/mlx5/qp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit e6587cdbd732eacb4c7ce592ed46f7bbcefb655f Author: Stefano Stabellini Date: Fri Dec 21 15:06:33 2018 -0800 pvcalls-back: set -ENOTCONN in pvcalls_conn_back_read When a connection is closing we receive on pvcalls_sk_state_change notification. Instead of setting the connection as closed immediately (-ENOTCONN), let's read one more time from it: pvcalls_conn_back_read will set the connection as closed when necessary. That way, we avoid races between pvcalls_sk_state_change and pvcalls_back_ioworker. Signed-off-by: Stefano Stabellini Reviewed-by: Boris Ostrovsky Signed-off-by: Boris Ostrovsky drivers/xen/pvcalls-back.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit d90a1ca60a1eccb4383fe203c76223ab4c0799ed Author: Stefano Stabellini Date: Fri Dec 21 15:06:32 2018 -0800 pvcalls-front: don't return error when the ring is full When the ring is full, size == array_size. It is not an error condition, so simply return 0 instead of an error. Signed-off-by: Stefano Stabellini Reviewed-by: Boris Ostrovsky Signed-off-by: Boris Ostrovsky drivers/xen/pvcalls-front.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit beee1fbe8f7d57d6ebaa5188f9f4db89c2077196 Author: Stefano Stabellini Date: Fri Dec 21 15:06:31 2018 -0800 pvcalls-front: properly allocate sk Don't use kzalloc: it ends up leaving sk->sk_prot not properly initialized. Use sk_alloc instead and define our own trivial struct proto. Signed-off-by: Stefano Stabellini Reviewed-by: Boris Ostrovsky Signed-off-by: Boris Ostrovsky drivers/xen/pvcalls-front.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 96283f9a084e23d7cda2d3c5d1ffa6df6cf1ecec Author: Stefano Stabellini Date: Fri Dec 21 15:06:30 2018 -0800 pvcalls-front: don't try to free unallocated rings inflight_req_id is 0 when initialized. If inflight_req_id is 0, there is no accept_map to free. Fix the check in pvcalls_front_release. Signed-off-by: Stefano Stabellini Reviewed-by: Boris Ostrovsky Signed-off-by: Boris Ostrovsky drivers/xen/pvcalls-front.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit b79470b64fa9266948d1ce8d825ced94c4f63293 Author: Stefano Stabellini Date: Fri Dec 21 15:06:29 2018 -0800 pvcalls-front: read all data before closing the connection When a connection is closing in_error is set to ENOTCONN. There could still be outstanding data on the ring left by the backend. Before closing the connection on the frontend side, drain the ring. Signed-off-by: Stefano Stabellini Reviewed-by: Boris Ostrovsky Signed-off-by: Boris Ostrovsky drivers/xen/pvcalls-front.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit f50fd2d8524c15b08da9e7e9d84752f0f1be7172 Author: Guo Ren Date: Wed Jan 2 22:09:25 2019 +0800 csky: Add perf support for C-SKY This adds basic perf support for all C-SKY CPUs. Hardware events are only supported by 807/810/860. Signed-off-by: Guo Ren arch/csky/Kconfig | 16 +- arch/csky/include/asm/perf_event.h | 7 + arch/csky/kernel/Makefile | 1 + arch/csky/kernel/perf_event.c | 1031 ++++++++++++++++++++++++++++++++++++ 4 files changed, 1054 insertions(+), 1 deletion(-) commit b25756df5b28cd7b6e91200fc5012e7c76e8ec69 Author: Adrian Hunter Date: Fri Dec 21 14:06:20 2018 +0200 perf session: Add comment for perf_session__register_idle_thread() Add a comment to perf_session__register_idle_thread() to bring attention to a pitfall with the idle task thread structure. The pitfall is that there should really be a 'struct thread' for the idle task of each cpu, but there is only one that can have pid == tid == 0. Signed-off-by: Adrian Hunter Acked-by: Jiri Olsa Link: http://lkml.kernel.org/r/20181221120620.9659-9-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/session.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 256d92bc93fd40411a02be5cdba74a7bf91e6e09 Author: Adrian Hunter Date: Fri Dec 21 14:06:19 2018 +0200 perf thread-stack: Fix thread stack processing for the idle task perf creates a single 'struct thread' to represent the idle task. That is because threads are identified by PID and TID, and the idle task always has PID == TID == 0. However, there are actually separate idle tasks for each CPU. That creates a problem for thread stack processing which assumes that each thread has a single stack, not one stack per CPU. Fix that by passing through the CPU number, and in the case of the idle "thread", pick the thread stack from an array based on the CPU number. Signed-off-by: Adrian Hunter Acked-by: Jiri Olsa Link: http://lkml.kernel.org/r/20181221120620.9659-8-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-script.c | 4 +-- tools/perf/util/intel-bts.c | 4 +-- tools/perf/util/intel-pt.c | 6 ++-- tools/perf/util/thread-stack.c | 72 ++++++++++++++++++++++++++++++++++-------- tools/perf/util/thread-stack.h | 8 ++--- 5 files changed, 69 insertions(+), 25 deletions(-) commit 139f42f3b3b495e61bb2cfef40e1dd5e845e3052 Author: Adrian Hunter Date: Fri Dec 21 14:06:18 2018 +0200 perf thread-stack: Allocate an array of thread stacks In preparation for fixing thread stack processing for the idle task, allocate an array of thread stacks. Signed-off-by: Adrian Hunter Acked-by: Jiri Olsa Link: http://lkml.kernel.org/r/20181221120620.9659-7-adrian.hunter@intel.com [ No need to check for NULL when calling zfree(), noticed by Jiri Olsa ] Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/thread-stack.c | 29 +++++++++++++++++------------ 1 file changed, 17 insertions(+), 12 deletions(-) commit 2e9e8688763ff80f032d9a78c3b4b951fb6dd7a4 Author: Adrian Hunter Date: Fri Dec 21 14:06:17 2018 +0200 perf thread-stack: Factor out thread_stack__init() In preparation for fixing thread stack processing for the idle task, factor out thread_stack__init(). Signed-off-by: Adrian Hunter Acked-by: Jiri Olsa Link: http://lkml.kernel.org/r/20181221120620.9659-6-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/thread-stack.c | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-) commit f6060ac60190c625101a0b94c2d96e9ca14a7d73 Author: Adrian Hunter Date: Fri Dec 21 14:06:16 2018 +0200 perf thread-stack: Allow for a thread stack array In preparation for fixing thread stack processing for the idle task, allow for a thread stack array. Signed-off-by: Adrian Hunter Acked-by: Jiri Olsa Link: http://lkml.kernel.org/r/20181221120620.9659-5-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/thread-stack.c | 40 ++++++++++++++++++++++++++++++++++------ 1 file changed, 34 insertions(+), 6 deletions(-) commit bd8e68ace110941f375f5d566b0cd99fe80634b8 Author: Adrian Hunter Date: Fri Dec 21 14:06:15 2018 +0200 perf thread-stack: Avoid direct reference to the thread's stack In preparation for fixing thread stack processing for the idle task, avoid direct reference to the thread's stack. The thread stack will change to an array of thread stacks, at which point the meaning of the direct reference will change. Signed-off-by: Adrian Hunter Acked-by: Jiri Olsa Link: http://lkml.kernel.org/r/20181221120620.9659-4-adrian.hunter@intel.com [ Rename thread_stack__ts() to thread__stack() since this operates on a 'thread' struct ] Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/thread-stack.c | 81 +++++++++++++++++++++++++----------------- 1 file changed, 49 insertions(+), 32 deletions(-) commit e0b8951190c11797971864c845e0909561525621 Author: Adrian Hunter Date: Fri Dec 21 14:06:14 2018 +0200 perf thread-stack: Tidy thread_stack__bottom() usage In preparation for fixing thread stack processing for the idle task, tidy thread_stack__bottom() usage. Specifically, the parameter 'thread' is not needed. Signed-off-by: Adrian Hunter Acked-by: Jiri Olsa Link: http://lkml.kernel.org/r/20181221120620.9659-3-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/thread-stack.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit 03b32cb2810814756095dbd91fce0c77617d096b Author: Adrian Hunter Date: Fri Dec 21 14:06:13 2018 +0200 perf thread-stack: Simplify some code in thread_stack__process() In preparation for fixing thread stack processing for the idle task, simplify some code in thread_stack__process(). Signed-off-by: Adrian Hunter Acked-by: Jiri Olsa Link: http://lkml.kernel.org/r/20181221120620.9659-2-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/thread-stack.c | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) commit 9d216211fded20fff301d0317af3238d8383634c Author: Bjorn Andersson Date: Sun Dec 23 23:26:44 2018 -0800 thermal: generic-adc: Fix adc to temp interpolation First correct the edge case to return the last element if we're outside the range, rather than at the last element, so that interpolation is not omitted for points between the two last entries in the table. Then correct the formula to perform linear interpolation based the two points surrounding the read ADC value. The indices for temp are kept as "hi" and "lo" to pair with the adc indices, but there's no requirement that the temperature is provided in descendent order. mult_frac() is used to prevent issues with overflowing the int. Cc: Laxman Dewangan Signed-off-by: Bjorn Andersson Signed-off-by: Eduardo Valentin drivers/thermal/thermal-generic-adc.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) commit e36e13003efd8b0160d49138385b0cec570900aa Author: Yoshihiro Kaneko Date: Mon Dec 17 23:50:21 2018 +0900 thermal: rcar_thermal: add R8A77990 support Add support for R-Car E3 (R8A77990) thermal support. Signed-off-by: Yoshihiro Kaneko Reviewed-by: Geert Uytterhoeven Reviewed-by: Simon Horman Signed-off-by: Eduardo Valentin drivers/thermal/rcar_thermal.c | 4 ++++ 1 file changed, 4 insertions(+) commit 6471a52deeea8bba8163a1f8c7aa309d4e287eb1 Author: Yoshihiro Kaneko Date: Mon Dec 17 23:50:20 2018 +0900 dt-bindings: thermal: rcar-thermal: add R8A77990 support Document the R-Car E3 (R8A77990) SoC bindings. Signed-off-by: Yoshihiro Kaneko Reviewed-by: Geert Uytterhoeven Reviewed-by: Simon Horman Tested-by: Simon Horman Signed-off-by: Eduardo Valentin Documentation/devicetree/bindings/thermal/rcar-thermal.txt | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit b8d3d11203afddf9e6c4e8b8ccecd401b6a8cc3e Author: Fabrizio Castro Date: Thu Dec 13 20:23:10 2018 +0000 thermal: rcar_thermal: add R8A774C0 support Add thermal support for the RZ/G2E SoC (a.k.a. R8A774C0). Signed-off-by: Fabrizio Castro Reviewed-by: Geert Uytterhoeven Reviewed-by: Simon Horman Signed-off-by: Eduardo Valentin drivers/thermal/rcar_thermal.c | 4 ++++ 1 file changed, 4 insertions(+) commit 69f8f55185ff2405366b1b193d3d2fea16589e54 Author: Fabrizio Castro Date: Thu Dec 13 20:19:48 2018 +0000 dt-bindings: thermal: rcar-thermal: add R8A774C0 support Document RZ/G2E SoC (a.k.a. r8a774c0) bindings. Signed-off-by: Fabrizio Castro Reviewed-by: Geert Uytterhoeven Signed-off-by: Eduardo Valentin Documentation/devicetree/bindings/thermal/rcar-thermal.txt | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit bf9ff83f93baf4f404b7e3a90037604f86bea854 Author: Miquel Raynal Date: Wed Dec 12 10:36:43 2018 +0100 dt-bindings: cp110: document the thermal interrupt capabilities The thermal IP can produce interrupts on overheat situation. Describe them. Signed-off-by: Miquel Raynal Reviewed-by: Rob Herring Signed-off-by: Eduardo Valentin .../devicetree/bindings/arm/marvell/cp110-system-controller.txt | 9 +++++++++ 1 file changed, 9 insertions(+) commit 1bc7523817215f94d8597f4daccb17a394a5703a Author: Miquel Raynal Date: Wed Dec 12 10:36:42 2018 +0100 dt-bindings: ap806: document the thermal interrupt capabilities The thermal IP can produce interrupts on overheat situation. Describe them. Signed-off-by: Miquel Raynal Signed-off-by: Eduardo Valentin .../devicetree/bindings/arm/marvell/ap806-system-controller.txt | 7 +++++++ 1 file changed, 7 insertions(+) commit ad3e72030bff0cbd4409074374a2a0f37ca1e20d Author: Miquel Raynal Date: Wed Dec 12 10:36:41 2018 +0100 MAINTAINERS: thermal: add entry for Marvell MVEBU thermal driver Add myself as Marvell MVEBU thermal driver maintainer. Signed-off-by: Miquel Raynal Signed-off-by: Eduardo Valentin MAINTAINERS | 5 +++++ 1 file changed, 5 insertions(+) commit 879d7362d1d01efd476a143c09048f5945936c32 Author: Miquel Raynal Date: Wed Dec 12 10:36:40 2018 +0100 thermal: armada: add overheat interrupt support The IP can manage to trigger interrupts on overheat situation from all the sensors. However, the interrupt source changes along with the last selected source (ie. the last read sensor), which is an inconsistent behavior. Avoid possible glitches by always selecting back only one channel which will then be referenced as the "overheat_sensor" (arbitrarily: the first in the DT which has a critical trip point filled in). It is possible that the scan of all thermal zone nodes did not bring a critical trip point from which the overheat interrupt could be configured. In this case just complain but do not fail the probe. Also disable sensor switch during overheat situations because changing the channel while the system is too hot could clear the overheat state by changing the source while the temperature is still very high. Even if the overheat state is not declared, overheat interrupt must be cleared by reading the DFX interrupt cause _after_ the temperature has fallen down to the low threshold, otherwise future possible interrupts would not be served. A work polls the corresponding register until the overheat flag gets cleared in this case. Suggested-by: David Sniatkiwicz Signed-off-by: Miquel Raynal Signed-off-by: Eduardo Valentin drivers/thermal/armada_thermal.c | 270 ++++++++++++++++++++++++++++++++++++++- 1 file changed, 269 insertions(+), 1 deletion(-) commit 5a78ad6d9c1b2c3c3226528346e9794ed3504381 Author: Arnd Bergmann Date: Mon Dec 10 22:57:27 2018 +0100 thermal: st: fix Makefile typo When STM32_THERMAL is enabled, this overrides all previously enabled files in the same directory, as seen from this link failure: ERROR: "st_thermal_pm_ops" [drivers/thermal/st/st_thermal_syscfg.ko] undefined! ERROR: "st_thermal_register" [drivers/thermal/st/st_thermal_syscfg.ko] undefined! ERROR: "st_thermal_unregister" [drivers/thermal/st/st_thermal_syscfg.ko] undefined! The correct syntax in Makefile requires using += instead of :=. Fixes: 1d6931556073 ("thermal: add stm32 thermal driver") Signed-off-by: Arnd Bergmann Reviewed-by: Daniel Lezcano Signed-off-by: Eduardo Valentin drivers/thermal/st/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ca74472dead17ad8e5de92c054d71109ef8a4beb Author: Kunihiko Hayashi Date: Fri Dec 7 10:06:04 2018 +0900 thermal: uniphier: Convert to SPDX identifier This converts license boilerplate to SPDX identifier, and removes unnecessary lines. Signed-off-by: Kunihiko Hayashi Reviewed-by: Daniel Lezcano Signed-off-by: Eduardo Valentin drivers/thermal/uniphier_thermal.c | 13 +------------ 1 file changed, 1 insertion(+), 12 deletions(-) commit 8632ed49c809160be3820cede35a7d0844c62c67 Author: Yangtao Li Date: Fri Nov 23 09:55:22 2018 -0500 thermal/intel_powerclamp: Change to use DEFINE_SHOW_ATTRIBUTE macro Use macro to simplify the code. Signed-off-by: Yangtao Li Signed-off-by: Eduardo Valentin drivers/thermal/intel_powerclamp.c | 14 +------------- 1 file changed, 1 insertion(+), 13 deletions(-) commit 05c1b7058aeab8a121e9af57ef97233f83ebeb75 Author: Yangtao Li Date: Fri Nov 23 09:50:58 2018 -0500 thermal: tegra: soctherm: Change to use DEFINE_SHOW_ATTRIBUTE macro Use macro to simplify the code. Signed-off-by: Yangtao Li Signed-off-by: Eduardo Valentin drivers/thermal/tegra/soctherm.c | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) commit 199bc54b4a1f3848a62ccb1fa22e9c43c352b8fa Author: Thierry Reding Date: Fri Nov 23 13:18:37 2018 +0100 dt-bindings: thermal: tegra-bpmp: Add Tegra194 support The thermal controller implementation on Tegra194 is very similar to the implementation on Tegra186. Add a compatible string for the new generation. Signed-off-by: Thierry Reding Signed-off-by: Eduardo Valentin .../bindings/thermal/nvidia,tegra186-bpmp-thermal.txt | 3 ++- include/dt-bindings/thermal/tegra194-bpmp-thermal.h | 15 +++++++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) commit 925b38361852ef314e9ecc649e830ad5319e3a65 Author: Anson Huang Date: Wed Nov 21 05:49:40 2018 +0000 thermal: imx: save one condition block for normal case of nvmem initialization Put return value checks of calling imx_init_from_nvmem_cells() into one block to save one condition block for normal case. Signed-off-by: Anson Huang Acked-by: Viresh Kumar Reviewed-by: Daniel Lezcano Signed-off-by: Eduardo Valentin drivers/thermal/imx_thermal.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit c589c56671c914fbd6b56a6f92dce80edbbfdada Author: Anson Huang Date: Wed Nov 21 05:49:36 2018 +0000 thermal: imx: fix for dependency on cpu-freq The thermal driver is a standalone driver for monitoring SoC temperature by enabling thermal sensor, so it can be enabled even when CONFIG_CPU_FREQ is NOT set. So remove the dependency with CPU_THERMAL. Introduce dummy function of legacy cooling register/unregister to make thermal driver probe successfully when CONFIG_CPU_FREQ is NOT set. Signed-off-by: Anson Huang Acked-by: Viresh Kumar Reviewed-by: Daniel Lezcano Signed-off-by: Eduardo Valentin drivers/thermal/Kconfig | 2 +- drivers/thermal/imx_thermal.c | 47 ++++++++++++++++++++++++++++++++----------- 2 files changed, 36 insertions(+), 13 deletions(-) commit 4ab248b3b10a58e379e2d32333fff99ea5ca256c Author: Srinivas Kandagatla Date: Thu Nov 15 17:43:30 2018 +0000 thermal: tsens: qcom: do not create duplicate regmap debugfs entries Regmap would use device name to create debugfs entries. If the device has multiple regmaps it is recommended to use name field in regmap_config. Fix this by providing name to the regmap configs correctly. Without this patch we would see below error on DB820c. qcom-tsens 4a9000.thermal-sensor: Failed to create 4a9000.thermal-sensor debugfs directory Signed-off-by: Srinivas Kandagatla Acked-by: Amit Kucheria Tested-by: Amit Kucheria Signed-off-by: Eduardo Valentin drivers/thermal/qcom/tsens-common.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) commit ac31f6e25d4e9e9dfda9c0621242036b291b7754 Author: YueHaibing Date: Tue Nov 13 14:13:45 2018 +0000 thermal: armada: Use PTR_ERR_OR_ZERO in armada_thermal_probe_legacy() Use PTR_ERR_OR_ZERO rather than if(IS_ERR(...)) + PTR_ERR Signed-off-by: YueHaibing Reviewed-by: Daniel Lezcano Signed-off-by: Eduardo Valentin drivers/thermal/armada_thermal.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) commit 24f1c13fa5f1599c373c53783f74de8a639f7999 Author: Geert Uytterhoeven Date: Wed Nov 7 14:35:00 2018 +0100 dt-bindings: thermal: rcar-gen3-thermal: All variants use 3 interrupts RZ/G2M also has 3 interrupts routed to the TSC, but the list was not updated to reflect this. Just drop the list, as this is the case for this TSC variant in all R-Car Gen3 and RZ/G2 SoCs. Fixes: be6af481f3b2d508 ("dt-bindings: thermal: rcar-gen3-thermal: Add r8a774a1 support") Signed-off-by: Geert Uytterhoeven Reviewed-by: Fabrizio Castro Reviewed-by: Simon Horman Signed-off-by: Eduardo Valentin Documentation/devicetree/bindings/thermal/rcar-gen3-thermal.txt | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit adad7c7d6a0ce3e9308fc6596865cdf570b5c466 Author: Julia Lawall Date: Tue Oct 30 17:08:51 2018 +0100 thermal: broadcom: use devm_thermal_zone_of_sensor_register Using devm_thermal_zone_of_sensor_register allows to simplify some error handling code, drop a label, and drop the remove function. Signed-off-by: Julia Lawall Reviewed-by: Daniel Lezcano Signed-off-by: Eduardo Valentin drivers/thermal/broadcom/brcmstb_thermal.c | 24 ++++-------------------- 1 file changed, 4 insertions(+), 20 deletions(-) commit d56c19d07e0bc3ceff366a49b7d7a2440c967b1b Author: Matthias Brugger Date: Sun Oct 21 23:58:48 2018 +0200 thermal: bcm2835: enable hwmon explicitly By defaul of-based thermal driver do not enable hwmon. This patch does this explicitly, so that the temperature can be read through the common hwmon sysfs. Signed-off-by: Matthias Brugger Acked-by: Stefan Wahren Signed-off-by: Eduardo Valentin drivers/thermal/broadcom/bcm2835_thermal.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit 03334ba8b425b2ad275c8f390cf83c7b081c3095 Author: Eduardo Valentin Date: Wed Jan 2 00:34:03 2019 +0000 thermal: hwmon: inline helpers when CONFIG_THERMAL_HWMON is not set Avoid warnings like this: thermal_hwmon.h:29:1: warning: ‘thermal_remove_hwmon_sysfs’ defined but not used [-Wunused-function] thermal_remove_hwmon_sysfs(struct thermal_zone_device *tz) Fixes: 0dd88793aacd ("thermal: hwmon: move hwmon support to single file") Reviewed-by: Geert Uytterhoeven Signed-off-by: Eduardo Valentin drivers/thermal/thermal_hwmon.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 7d7b467cb95bf29597b417d4990160d4ea6d69b9 Author: Hans de Goede Date: Sun Dec 30 18:25:00 2018 +0100 ACPI: power: Skip duplicate power resource references in _PRx Some ACPI tables contain duplicate power resource references like this: Name (_PR0, Package (0x04) // _PR0: Power Resources for D0 { P28P, P18P, P18P, CLK4 }) This causes a WARN_ON in sysfs_add_link_to_group() because we end up adding a link to the same acpi_device twice: sysfs: cannot create duplicate filename '/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A08:00/808622C1:00/OVTI2680:00/power_resources_D0/LNXPOWER:0a' CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.19.12-301.fc29.x86_64 #1 Hardware name: Insyde CherryTrail/Type2 - Board Product Name, BIOS jumperx.T87.KFBNEEA02 04/13/2016 Call Trace: dump_stack+0x5c/0x80 sysfs_warn_dup.cold.3+0x17/0x2a sysfs_do_create_link_sd.isra.2+0xa9/0xb0 sysfs_add_link_to_group+0x30/0x50 acpi_power_expose_list+0x74/0xa0 acpi_power_add_remove_device+0x50/0xa0 acpi_add_single_object+0x26b/0x5f0 acpi_bus_check_add+0xc4/0x250 ... To address this issue, make acpi_extract_power_resources() check for duplicates and simply skip them when found. Cc: All applicable Signed-off-by: Hans de Goede [ rjw: Subject & changelog, comments ] Signed-off-by: Rafael J. Wysocki drivers/acpi/power.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) commit 97b6f89f7269b746b68e7985c16d2354c688d29a Merge: 344eb5539abf 039bc3b7f29f d6951f582cc5 Author: Russell King Date: Wed Jan 2 10:37:05 2019 +0000 Merge branches 'misc', 'sa1100-for-next' and 'spectre' into for-linus commit 2e61069b056f7ac3cde5f84a4be8aa703b57089d Author: Sinan Kaya Date: Sun Dec 30 20:40:05 2018 +0000 ACPI: Fix build failure when CONFIG_NLS is set to 'n' Observing link failure as follows when CONFIG_ACPI is set but both CONFIG_NLS and CONFIG_PCI are no set: drivers/acpi/device_sysfs.o: In function `description_show': device_sysfs.c:(.text+0x48a): undefined reference to `utf16s_to_utf8s' This issue was previously addressed implicitly by commit 8a226e00eeed (PCI: pci-label: Fix build failure when CONFIG_NLS is set to 'm' by allmodconfig) causing PCI_LABEL to be selected when ACPI was set which caused NLS to be selected too in that case. However, after commit 5d32a66541c46 (PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set) it is possible to build ACPI support without PCI, so make ACPI select NLS directly to cover that case. Fixes: 5d32a66541c46 (PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set) Signed-off-by: Sinan Kaya [ rjw: Changelog ] Signed-off-by: Rafael J. Wysocki drivers/acpi/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 75cb8d20c112aba70f23d98e3f8d0a38ace16006 Author: Richard Zhu Date: Fri Dec 21 04:33:38 2018 +0000 PCI: imx: Enable MSI from downstream components The MSI Enable bit in the MSI Capability (PCIe r4.0, sec 7.7.1.2) controls whether a Function can request service using MSI. i.MX6 Root Ports implement the MSI Capability and may use MSI to request service for events like PME, hotplug, AER, etc. In addition, on i.MX6, the MSI Enable bit controls delivery of MSI interrupts from components below the Root Port. Prior to f3fdfc4ac3a2 ("PCI: Remove host driver Kconfig selection of CONFIG_PCIEPORTBUS"), enabling CONFIG_PCI_IMX6 automatically also enabled CONFIG_PCIEPORTBUS, and when portdrv claimed the Root Ports, it set the MSI Enable bit so it could use PME, hotplug, AER, etc. As a side effect, that also enabled delivery of MSI interrupts from downstream components. The imx6q-pcie driver itself does not depend on portdrv, so set MSI Enable in imx6q-pcie so MSI from downstream components works even if nobody uses MSI for the Root Port events. Fixes: f3fdfc4ac3a2 ("PCI: Remove host driver Kconfig selection of CONFIG_PCIEPORTBUS") Signed-off-by: Richard Zhu Signed-off-by: Bjorn Helgaas Tested-by: Sven Van Asbroeck Tested-by: Trent Piepho Reviewed-by: Lucas Stach Acked-by: Lorenzo Pieralisi drivers/pci/controller/dwc/pci-imx6.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 7dc20ab1b9c431b792a6fe1e78baf36b63edc5e3 Author: Sebastian Ott Date: Fri Dec 21 15:14:20 2018 +0100 s390/pci: skip VF scanning Set the flag to skip scanning for VFs after SR-IOV enablement. VF creation will be triggered by the hotplug code. Signed-off-by: Sebastian Ott Signed-off-by: Bjorn Helgaas Reviewed-by: Christoph Hellwig arch/s390/pci/pci.c | 3 +++ 1 file changed, 3 insertions(+) commit aff68a5a621e2569d126b817d0d42f658df524bf Author: Sebastian Ott Date: Fri Dec 21 15:14:19 2018 +0100 PCI/IOV: Add flag so platforms can skip VF scanning Provide a flag to skip scanning for new VFs after SR-IOV enablement. This can be set by implementations for which the VFs are already reported by other means. Signed-off-by: Sebastian Ott Signed-off-by: Bjorn Helgaas Reviewed-by: Christoph Hellwig drivers/pci/iov.c | 6 ++++++ include/linux/pci.h | 1 + 2 files changed, 7 insertions(+) commit 18f9e9d150fccfa747875df6f0a9f606740762b3 Author: Sebastian Ott Date: Fri Dec 21 15:14:18 2018 +0100 PCI/IOV: Factor out sriov_add_vfs() Provide sriov_add_vfs() as a wrapper to scan for VFs that cleans up after itself. This is just a code simplification. No functional change. Signed-off-by: Sebastian Ott Signed-off-by: Bjorn Helgaas Reviewed-by: Christoph Hellwig drivers/pci/iov.c | 44 +++++++++++++++++++++++++++++++------------- 1 file changed, 31 insertions(+), 13 deletions(-) commit 8e143b90e4d45cca3dc53760d3cfab988bc74571 Merge: 78e8696c234a 03ebe48e235f Author: Linus Torvalds Date: Tue Jan 1 15:55:29 2019 -0800 Merge tag 'iommu-updates-v4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull IOMMU updates from Joerg Roedel: - Page table code for AMD IOMMU now supports large pages where smaller page-sizes were mapped before. VFIO had to work around that in the past and I included a patch to remove it (acked by Alex Williamson) - Patches to unmodularize a couple of IOMMU drivers that would never work as modules anyway. - Work to unify the the iommu-related pointers in 'struct device' into one pointer. This work is not finished yet, but will probably be in the next cycle. - NUMA aware allocation in iommu-dma code - Support for r8a774a1 and r8a774c0 in the Renesas IOMMU driver - Scalable mode support for the Intel VT-d driver - PM runtime improvements for the ARM-SMMU driver - Support for the QCOM-SMMUv2 IOMMU hardware from Qualcom - Various smaller fixes and improvements * tag 'iommu-updates-v4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: (78 commits) iommu: Check for iommu_ops == NULL in iommu_probe_device() ACPI/IORT: Don't call iommu_ops->add_device directly iommu/of: Don't call iommu_ops->add_device directly iommu: Consolitate ->add/remove_device() calls iommu/sysfs: Rename iommu_release_device() dmaengine: sh: rcar-dmac: Use device_iommu_mapped() xhci: Use device_iommu_mapped() powerpc/iommu: Use device_iommu_mapped() ACPI/IORT: Use device_iommu_mapped() iommu/of: Use device_iommu_mapped() driver core: Introduce device_iommu_mapped() function iommu/tegra: Use helper functions to access dev->iommu_fwspec iommu/qcom: Use helper functions to access dev->iommu_fwspec iommu/of: Use helper functions to access dev->iommu_fwspec iommu/mediatek: Use helper functions to access dev->iommu_fwspec iommu/ipmmu-vmsa: Use helper functions to access dev->iommu_fwspec iommu/dma: Use helper functions to access dev->iommu_fwspec iommu/arm-smmu: Use helper functions to access dev->iommu_fwspec ACPI/IORT: Use helper functions to access dev->iommu_fwspec iommu: Introduce wrappers around dev->iommu_fwspec ... commit 78e8696c234ab637c4dd516cabeac344d84ec10b Merge: fcf010449ebe 660611827c03 Author: Linus Torvalds Date: Tue Jan 1 15:45:48 2019 -0800 Merge tag 'dmaengine-4.21-rc1' of git://git.infradead.org/users/vkoul/slave-dma Pull dmaengine updates from Vinod Koul: "This includes a new driver, removes R-Mobile APE6 as it is no longer used, sprd cyclic dma support, last batch of dma_slave_config direction removal and random updates to bunch of drivers. Summary: - New driver for UniPhier MIO DMA controller - Remove R-Mobile APE6 support - Sprd driver updates and support for cyclic link-list - Remove dma_slave_config direction usage from rest of drivers - Minor updates to dmatest, dw-dmac, zynqmp and bcm dma drivers" * tag 'dmaengine-4.21-rc1' of git://git.infradead.org/users/vkoul/slave-dma: (48 commits) dmaengine: qcom_hidma: convert to DEFINE_SHOW_ATTRIBUTE dmaengine: pxa: remove DBGFS_FUNC_DECL() dmaengine: mic_x100_dma: convert to DEFINE_SHOW_ATTRIBUTE dmaengine: amba-pl08x: convert to DEFINE_SHOW_ATTRIBUTE dmaengine: Documentation: Add documentation for multi chan testing dmaengine: dmatest: Add transfer_size parameter dmaengine: dmatest: Add alignment parameter dmaengine: dmatest: Use fixed point div to calculate iops dmaengine: dmatest: Add support for multi channel testing dmaengine: rcar-dmac: Document R8A774C0 bindings dt-bindings: dmaengine: usb-dmac: Add binding for r8a774c0 dmaengine: zynqmp_dma: replace spin_lock_bh with spin_lock_irqsave dmaengine: sprd: Add me as one of the module authors dmaengine: sprd: Support DMA 2-stage transfer mode dmaengine: sprd: Support DMA link-list cyclic callback dmaengine: sprd: Set cur_desc as NULL when free or terminate one dma channel dmaengine: sprd: Fix the last link-list configuration dmaengine: sprd: Get transfer residue depending on the transfer direction dmaengine: sprd: Remove direction usage from struct dma_slave_config dmaengine: dmatest: fix a small memory leak in dmatest_func() ... commit fcf010449ebe1db0cb68b2c6410972a782f2bd14 Merge: fbea8c7c7933 cc0282975b3f Author: Linus Torvalds Date: Tue Jan 1 15:38:14 2019 -0800 Merge tag 'kgdb-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/danielt/linux Pull kgdb updates from Daniel Thompson: "Mostly clean ups although while Doug's was chasing down a odd lockdep warning he also did some work to improved debugger resilience when some CPUs fail to respond to the round up request. The main changes are: - Fixing a lockdep warning on architectures that cannot use an NMI for the round up plus related changes to make CPU round up and all CPU backtrace more resilient. - Constify the arch ops tables - A couple of other small clean ups Two of the three patchsets here include changes that spill over into arch/. Changes in the arch space are relatively narrow in scope (and directly related to kgdb). Didn't get comprehensive acks but all impacted maintainers were Cc:ed in good time" * tag 'kgdb-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/danielt/linux: kgdb/treewide: constify struct kgdb_arch arch_kgdb_ops mips/kgdb: prepare arch_kgdb_ops for constness kdb: use bool for binary state indicators kdb: Don't back trace on a cpu that didn't round up kgdb: Don't round up a CPU that failed rounding up before kgdb: Fix kgdb_roundup_cpus() for arches who used smp_call_function() kgdb: Remove irq flags from roundup commit fbea8c7c793397cdf4ba53a32f99b656467b7c7f Merge: 28e8c4bc8eb4 57ce8ba0fd3a Author: Linus Torvalds Date: Tue Jan 1 15:35:55 2019 -0800 Merge tag 'for-linus' of git://github.com/openrisc/linux Pull OpenRISC update from Stafford Horne: "Just one change for 4.21: Update comments for name change or32 -> or1k from Geert Uytterhoeven" * tag 'for-linus' of git://github.com/openrisc/linux: openrisc: Fix broken paths to arch/or32 commit 28e8c4bc8eb483c22d977e147a0b98fc63efadf7 Merge: c9bef4a65176 36e14f5fdfdf Author: Linus Torvalds Date: Tue Jan 1 13:24:31 2019 -0800 Merge tag 'rtc-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC updates from Alexandre Belloni: "Subsystem: - new %ptR printk format - rename core files - allow registration of multiple nvmem devices New driver: - i.MX system controller RTC Driver updates: - abx80x: handle voltage ioctls, correct binding doc - m41t80: correct month in alarm reads - pcf85363: add pcf85263 support - pcf8523: properly handle battery low flag - s3c: limit alarm to one year in the future as ALMYEAR is broken - sun6i: rework clock output binding" * tag 'rtc-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: (54 commits) rtc: rename core files rtc: nvmem: fix possible use after free rtc: add i.MX system controller RTC support dt-bindings: fsl: scu: add rtc binding rtc: pcf2123: Add Microcrystal rv2123 rtc: class: reimplement devm_rtc_device_register rtc: enforce rtc_timer_init private_data type rtc: abx80x: Implement RTC_VL_READ,CLR ioctls rtc: pcf85363: Add support for NXP pcf85263 rtc dt-bindings: rtc: pcf85363: Document pcf85263 real-time clock rtc: pcf8523: don't return invalid date when battery is low dt-bindings: rtc: use a generic node name for ds1307 PM: Switch to use %ptR m68k/mac: Switch to use %ptR Input: hp_sdc_rtc - Switch to use %ptR rtc: tegra: Switch to use %ptR rtc: s5m: Switch to use %ptR rtc: s3c: Switch to use %ptR rtc: rx8025: Switch to use %ptR rtc: rx6110: Switch to use %ptR ... commit c9bef4a651769927445900564781a9c99fdf6258 Merge: 115502a6f31d 88cc9fc41c73 Author: Linus Torvalds Date: Tue Jan 1 13:19:16 2019 -0800 Merge tag 'pinctrl-v4.21-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control updates from Linus Walleij: "We have no core changes but lots of incremental development in drivers all over the place: Renesas, NXP, Mediatek and Actions Semiconductor keep churning out new SoCs. I have some subtree maintainers for Renesas and Intel helping out to keep down the load, it's been working smoothly (Samsung also have a subtree but it was not used this cycle.) New drivers: - NXP (ex Freescale) i.MX 8 QXP SoC driver. - Mediatek MT6797 SoC driver. - Mediatek MT7629 SoC driver. - Actions Semiconductor S700 SoC driver. - Renesas RZ/A2 SoC driver. - Allwinner sunxi suniv F1C100 SoC driver. - Qualcomm PMS405 PMIC driver. - Microsemi Ocelot Jaguar2 SoC driver. Improvements: - Some RT improvements (using raw spinlocks where appropriate). - A lot of new pin sets on the Renesas PFC pin controllers. - GPIO hogs now work on the Qualcomm SPMI/SSBI pin controller GPIO chips, and Xway. - Major modernization of the Intel pin control drivers. - STM32 pin control driver will now synchronize usage of pins with another CPU using a hardware spinlock" * tag 'pinctrl-v4.21-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (145 commits) dt-bindings: arm: fsl-scu: add imx8qm pinctrl support pinctrl: freescale: Break dependency on SOC_IMX8MQ for i.MX8MQ pinctrl: imx-scu: Depend on IMX_SCU pinctrl: ocelot: Add dependency on HAS_IOMEM pinctrl: ocelot: add MSCC Jaguar2 support pinctrl: bcm: ns: support updated DT binding as syscon subnode dt-bindings: pinctrl: bcm4708-pinmux: rework binding to use syscon MAINTAINERS: merge at91 pinctrl entries pinctrl: imx8qxp: break the dependency on SOC_IMX8QXP pinctrl: uniphier: constify uniphier_pinctrl_socdata pinctrl: mediatek: improve Kconfig dependencies pinctrl: msm: mark PM functions as __maybe_unused dt-bindings: pinctrl: sunxi: Add supply properties pinctrl: meson: meson8b: add the missing GPIO_GROUPs for BOOT and CARD pinctrl: meson: meson8: add the missing GPIO_GROUPs for BOOT and CARD pinctrl: meson: meson8: rename the "gpio" function to "gpio_periphs" pinctrl: meson: meson8: rename the "gpio" function to "gpio_periphs" pinctrl: meson: meson8b: fix the GPIO function for the GPIOAO pins pinctrl: meson: meson8: fix the GPIO function for the GPIOAO pins pinctrl: sh-pfc: Make pinmux_cfg_reg.var_field_width[] variable-length ... commit 115502a6f31d84d8172a71283aaea266302a8ad5 Merge: 57b0e3145320 e3c21e088f89 Author: Linus Torvalds Date: Tue Jan 1 13:16:45 2019 -0800 Merge tag 'linux-watchdog-4.21-rc1' of git://www.linux-watchdog.org/linux-watchdog Pull watchdog updates from Wim Van Sebroeck: - add TQ-Systems TQMX86 watchdog driver - add Qualcomm PM8916 watchdog driver - w83627hf_wdt: add quirk for Inves system - renesas_wdt: several improvements and document r8a774c0 support - mena21_wdt, mtx-1: Convert to use GPIO descriptor - bcm281xx, ie6xx_wdt: convert to DEFINE_SHOW_ATTRIBUTE - documentation: add PM usage and kernel-api: don't reference removed functions - update bindings for MT7629 SoC - several small fixes * tag 'linux-watchdog-4.21-rc1' of git://www.linux-watchdog.org/linux-watchdog: (22 commits) watchdog: tqmx86: Add watchdog driver for the IO controller dt-bindings: watchdog: renesas-wdt: Document r8a774c0 support watchdog: docs: kernel-api: don't reference removed functions watchdog: add documentation for PM usage watchdog: mtx-1: Convert to use GPIO descriptor watchdog: mena21_wdt: Convert to GPIO descriptors dt-bindings: watchdog: Add Qualcomm PM8916 watchdog watchdog: Add pm8916 watchdog driver dt-bindings: watchdog: update bindings for MT7629 SoC watchdog: renesas_wdt: don't keep timer value during suspend/resume watchdog: ie6xx_wdt: convert to DEFINE_SHOW_ATTRIBUTE watchdog: bcm281xx: convert to DEFINE_SHOW_ATTRIBUTE watchdog: asm9260_wdt: make array mode_name static, shrinks object size watchdog/hpwdt: Update driver version. watchdog/hpwdt: Do not claim unsupported hardware watchdog/hpwdt: Exclude via blacklist Watchdog: remove outdated comment watchdog: w83627hf_wdt: Add quirk for Inves system watchdog: cpwd: add of_node_put() watchdog: renesas_wdt: don't set divider while watchdog is running ... commit 57b0e31453209d746c99e513d80b3d0c44a80891 Author: Eric Biggers Date: Sat Nov 3 10:30:35 2018 -0700 KEYS: fix parsing invalid pkey info string We need to check the return value of match_token() for Opt_err before doing anything with it. [ Not only did the old "-1" value for Opt_err cause problems for the __test_and_set_bit(), as fixed in commit 94c13f66e13c ("security: don't use a negative Opt_err token index"), but accessing "args[0].from" is invalid for the Opt_err case, as pointed out by Eric later. - Linus ] Reported-by: syzbot+a22e0dc07567662c50bc@syzkaller.appspotmail.com Fixes: 00d60fd3b932 ("KEYS: Provide keyctls to drive the new key type ops for asymmetric keys [ver #2]") Signed-off-by: Eric Biggers Cc: stable@kernel.org # 4.20 Signed-off-by: Linus Torvalds security/keys/keyctl_pkey.c | 2 ++ 1 file changed, 2 insertions(+) commit e888402789b9db5de4fcda361331d66dbf0cd9fd Author: Huazhong Tan Date: Mon Dec 31 10:58:29 2018 +0800 net: hns3: call hns3_nic_net_open() while doing HNAE3_UP_CLIENT For HNAE3_DOWN_CLIENT calling hns3_nic_net_stop(), HNAE3_UP_CLIENT should call hns3_nic_net_open(), since if the number of queue or the map of TC has is changed before HHAE3_UP_CLIENT is called, it will cause problem. Also the HNS3_NIC_STATE_RESETTING flag needs to be cleared before hns3_nic_net_open() called, and set it back while hns3_nic_net_open() failed. Fixes: bb6b94a896d4 ("net: hns3: Add reset interface implementation in client") Signed-off-by: Huazhong Tan Signed-off-by: Yunsheng Lin Signed-off-by: Peng Li Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit cb9f1b783850b14cbd7f87d061d784a666dfba1f Author: Willem de Bruijn Date: Sun Dec 30 17:24:36 2018 -0500 ip: validate header length on virtual device xmit KMSAN detected read beyond end of buffer in vti and sit devices when passing truncated packets with PF_PACKET. The issue affects additional ip tunnel devices. Extend commit 76c0ddd8c3a6 ("ip6_tunnel: be careful when accessing the inner header") and commit ccfec9e5cb2d ("ip_tunnel: be careful when accessing the inner header"). Move the check to a separate helper and call at the start of each ndo_start_xmit function in net/ipv4 and net/ipv6. Minor changes: - convert dev_kfree_skb to kfree_skb on error path, as dev_kfree_skb calls consume_skb which is not for error paths. - use pskb_network_may_pull even though that is pedantic here, as the same as pskb_may_pull for devices without llheaders. - do not cache ipv6 hdrs if used only once (unsafe across pskb_may_pull, was more relevant to earlier patch) Reported-by: syzbot Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller include/net/ip_tunnels.h | 20 ++++++++++++++++++++ net/ipv4/ip_gre.c | 9 +++++++++ net/ipv4/ip_tunnel.c | 9 --------- net/ipv4/ip_vti.c | 12 +++++++++--- net/ipv6/ip6_gre.c | 10 +++++++--- net/ipv6/ip6_tunnel.c | 10 +++------- net/ipv6/ip6_vti.c | 8 ++++---- net/ipv6/ip6mr.c | 17 +++++++++++------ net/ipv6/sit.c | 3 +++ 9 files changed, 66 insertions(+), 32 deletions(-) commit 8c76e77f9069f10505c08e02646c3ee11ad79038 Author: Willem de Bruijn Date: Sun Dec 30 17:21:05 2018 -0500 tap: call skb_probe_transport_header after setting skb->dev The BPF flow dissector expects either skb->sk or skb->dev set on all skbs. Delay flow dissection until after skb->dev is set. This requires calling from within an rcu read-side critical section. That is fine, see also the call from tun_xdp_one. Fixes: d0e13a1488ad ("flow_dissector: lookup netns by skb->sk if skb->dev is NULL") Reported-by: Christian Borntraeger Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller drivers/net/tap.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit aff6db454599d62191aabc208930e891748e4322 Author: Cong Wang Date: Sun Dec 30 12:43:42 2018 -0800 ptr_ring: wrap back ->producer in __ptr_ring_swap_queue() __ptr_ring_swap_queue() tries to move pointers from the old ring to the new one, but it forgets to check if ->producer is beyond the new size at the end of the operation. This leads to an out-of-bound access in __ptr_ring_produce() as reported by syzbot. Reported-by: syzbot+8993c0fa96d57c399735@syzkaller.appspotmail.com Fixes: 5d49de532002 ("ptr_ring: resize support") Cc: "Michael S. Tsirkin" Cc: John Fastabend Cc: Jason Wang Signed-off-by: Cong Wang Acked-by: Michael S. Tsirkin Signed-off-by: David S. Miller include/linux/ptr_ring.h | 2 ++ 1 file changed, 2 insertions(+) commit 3e9ad24b0e91c066311a958afbd6210dda8a43eb Author: Takashi Iwai Date: Mon Dec 31 19:02:01 2018 +0100 ALSA: hda - Revert DSP detection on legacy HD-audio driver This essentially reverts the commits c337104b1a16 ("ALSA: HD-Audio: SKL+: abort probe if DSP is present and Skylake driver selected") and d82b51c855a2 ("ALSA: HD-Audio: SKL+: force HDaudio legacy or SKL+ driver selection") for the path of legacy HD-audio controller (snd-hda-intel). The automatic DSP detection and skip of binding with the legacy driver caused regressions on several machines like Dell XPS13. They give the PCI class 0x40380 indicating the availability of DSP while they don't work with ASoC SKL driver (yet). As the support of ASoC driver for such devices isn't available, it's better to revert the whole DSP-detection-and-skip behavior of the legacy driver, so that we can get the old good driver working on such devices. The pci_binding option for ASoC SKL driver is still kept so that it can work without blacklisting. Fixes: c337104b1a16 ("ALSA: HD-Audio: SKL+: abort probe if DSP is present and Skylake driver selected") Reported-by: Linus Torvalds Reported-by: Hans de Goede Reported-by: Azat Khuzhin Cc: Pierre-Louis Bossart Signed-off-by: Takashi Iwai sound/pci/hda/Kconfig | 62 ------------------------------------------ sound/pci/hda/hda_controller.h | 2 +- sound/pci/hda/hda_intel.c | 54 +++++------------------------------- sound/soc/intel/Kconfig | 6 ---- 4 files changed, 8 insertions(+), 116 deletions(-) commit 4087d2bc0d9469835f8d19d63a4a56739e5b8c5b Author: Zhu Yanjun Date: Sun Dec 30 23:24:11 2018 +0800 net: rds: remove unnecessary NULL check In kfree, the NULL check is done. Signed-off-by: Zhu Yanjun Signed-off-by: David S. Miller net/rds/tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2b96547223e3a036efb51733dbf37a1e4be92068 Author: yupeng Date: Sat Dec 29 21:46:38 2018 -0800 add document for TCP OFO, PAWS and skip ACK counters add document and examples for below counters: TcpExtTCPOFOQueue TcpExtTCPOFODrop TcpExtTCPOFOMerge TcpExtPAWSActive TcpExtPAWSEstab TcpExtTCPACKSkippedSynRecv TcpExtTCPACKSkippedPAWS TcpExtTCPACKSkippedSeq TcpExtTCPACKSkippedFinWait2 TcpExtTCPACKSkippedTimeWait TcpExtTCPACKSkippedChallenge Signed-off-by: yupeng Signed-off-by: David S. Miller Documentation/networking/snmp_counter.rst | 240 +++++++++++++++++++++++++++++- 1 file changed, 239 insertions(+), 1 deletion(-) commit 3a0ed3e9619738067214871e9cb826fa23b2ddb9 Author: Deepa Dinamani Date: Thu Dec 27 18:55:09 2018 -0800 sock: Make sock->sk_stamp thread-safe Al Viro mentioned (Message-ID <20170626041334.GZ10672@ZenIV.linux.org.uk>) that there is probably a race condition lurking in accesses of sk_stamp on 32-bit machines. sock->sk_stamp is of type ktime_t which is always an s64. On a 32 bit architecture, we might run into situations of unsafe access as the access to the field becomes non atomic. Use seqlocks for synchronization. This allows us to avoid using spinlocks for readers as readers do not need mutual exclusion. Another approach to solve this is to require sk_lock for all modifications of the timestamps. The current approach allows for timestamps to have their own lock: sk_stamp_lock. This allows for the patch to not compete with already existing critical sections, and side effects are limited to the paths in the patch. The addition of the new field maintains the data locality optimizations from commit 9115e8cd2a0c ("net: reorganize struct sock for better data locality") Note that all the instances of the sk_stamp accesses are either through the ioctl or the syscall recvmsg. Signed-off-by: Deepa Dinamani Signed-off-by: David S. Miller include/net/sock.h | 38 +++++++++++++++++++++++++++++++++++--- net/compat.c | 15 +++++++++------ net/core/sock.c | 15 ++++++++++----- net/sunrpc/svcsock.c | 2 +- 4 files changed, 55 insertions(+), 15 deletions(-) commit 8b6b25cf93b73e8e399adc55b0ffb9db32b881e0 Author: Xiaozhou Liu Date: Fri Dec 21 17:35:11 2018 +0800 selftests/bpf: fix error printing in test_devmap() As a simple fix, just print the correct map type. Signed-off-by: Xiaozhou Liu Signed-off-by: Daniel Borkmann tools/testing/selftests/bpf/test_maps.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 63d2a9ec310d8bcc955574220d4631aa55c1a80c Author: Sameer Pujar Date: Wed Dec 26 16:04:49 2018 +0530 ALSA: hda/tegra: clear pending irq handlers Even after disabling interrupts on the module, it could be possible that irq handlers are still running. System hang is seen during suspend path. It was found that, there were pending writes on the HDA bus and clock was disabled by that time. Above mentioned issue is fixed by clearing any pending irq handlers before disabling clocks and returning from hda suspend. Suggested-by: Mohan Kumar Suggested-by: Dara Ramesh Signed-off-by: Sameer Pujar Cc: Signed-off-by: Takashi Iwai sound/pci/hda/hda_tegra.c | 2 ++ 1 file changed, 2 insertions(+) commit 82b01149ec94d746867d7f9156c44d775d4d2d67 Author: Jian-Hong Pan Date: Thu Dec 27 16:46:31 2018 +0800 ALSA: hda/realtek: Enable the headset mic auto detection for ASUS laptops The headset mic of ASUS laptops like UX533FD, UX433FN and UX333FA, whose CODEC is Realtek ALC294 has jack auto detection feature. This patch enables the feature. Fixes: 4e051106730d ("ALSA: hda/realtek: Enable audio jacks of ASUS UX533FD with ALC294") Signed-off-by: Daniel Drake Signed-off-by: Jian-Hong Pan Cc: Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 191ce17876c9367819c4b0a25b503c0f6d9054d8 Author: Theodore Ts'o Date: Mon Dec 31 22:34:31 2018 -0500 ext4: fix special inode number checks in __ext4_iget() The check for special (reserved) inode number checks in __ext4_iget() was broken by commit 8a363970d1dc: ("ext4: avoid declaring fs inconsistent due to invalid file handles"). This was caused by a botched reversal of the sense of the flag now known as EXT4_IGET_SPECIAL (when it was previously named EXT4_IGET_NORMAL). Fix the logic appropriately. Fixes: 8a363970d1dc ("ext4: avoid declaring fs inconsistent...") Signed-off-by: Theodore Ts'o Reported-by: Dan Carpenter Cc: stable@kernel.org fs/ext4/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e1ef035d272ef4dbfdda98e58699698305138856 Merge: b7badd1d7aa6 82c7b351be3f Author: Linus Torvalds Date: Mon Dec 31 17:40:14 2018 -0800 Merge tag 'armsoc-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC defconfig updates from Olof Johansson: "Most changes here are to enable new drivers and platforms in the various configs that affect them. Most of these have been covered and described in the other branches, we mostly keep defconfig separate to avoid conflicts between SoC/dt/driver updates that they otherwise would be grouped with. One thing worth mentioning here is that OMAP changes from using their own UART driver, to 8250, for the multi_v7_defconfig shared config on 32-bit. This means that the console is now named ttyS* instead of ttyO*. This change was already done for omap2_defconfig a while back, so most users of these configs have either already updated, or can easily follow the same patterns as they did at that time. This makes platform support slightly easier for distros, since they no longer need to keep track of a separate console prefix for these platforms" * tag 'armsoc-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (31 commits) Revert "arm64: defconfig: Enable FSL_MC_BUS and FSL_MC_DPIO" arm64: defconfig: Enable FSL_MC_BUS and FSL_MC_DPIO arm64: defconfig: Replace PINCTRL_MT7622 with PINCTRL_MTK_MOORE arm64: defconfig: Regenerate for v4.20 ARM: multi_v7_defconfig: Add TOSHIBA TC358764 bridge driver ARM: multi_v7_defconfig: Add MAX8952 regulator driver ARM: exynos_defconfig: Add TOSHIBA TC358764 bridge driver ARM: exynos_defconfig: Add MAX8952 regulator driver ARM: exynos_defconfig: Add MAX8998 RTC and charger drivers ARM: imx_v6_v7_defconfig: add imx7ulp support ARM: imx_v6_v7_defconfig: Select TOUCHSCREEN_GOODIX ARM: multi_v7_defconfig: enable STM32 analog & timer drivers arm64: defconfig: Enable GCC and PINCTRL for MSM8998 arm64: defconfig: Enable core Qualcomm SDM845 options ARM: defconfig: Enable the PL111 DRM driver on vexpress ARM: defconfig: Update the vexpress defconfig arm64: defconfig: Enable some qcom remoteproc configs arm64: defconfig: Enable QCS404 configs ARM: imx_v6_v7_defconfig: Enable USB_ANNOUNCE_NEW_DEVICES ARM: imx_v6_v7_defconfig: Enable BT_BNEP ... commit b7badd1d7aa61087010803affa19bb83fb5a0af1 Merge: d36377c6eb07 3f47de2c6b60 Author: Linus Torvalds Date: Mon Dec 31 17:36:02 2018 -0800 Merge tag 'armsoc-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM Device-tree updates from Olof Johansson: "As usual, this is where the bulk of our changes end up landing each merge window. The individual updates are too many to enumerate, many many platforms have seen additions of device descriptions such that they are functionally more complete (in fact, this is often the bulk of updates we see). Instead I've mostly focused on highlighting the new platforms below as they are introduced. Sometimes the introduction is of mostly a fragment, that later gets filled in on later releases, and in some cases it's near-complete platform support. The latter is more common for derivative platforms that already has similar support in-tree. Two SoCs are slight outliers from the usual range of additions. Allwinner support for F1C100s, a quite old SoC (ARMv5-based) shipping in the Lychee Pi Nano platform. At the other end is NXP Layerscape LX2160A, a 16-core 2.2GHz Cortex-A72 SoC with a large amount of I/O aimed at infrastructure/networking. TI updates stick out in the diff stats too, in particular because they have moved the description of their L4 on-chip interconnect to devicetree, which opens up for removal of even more of their platform-specific 'hwmod' description tables over the next few releases. SoCs: - Qualcomm QCS404 (4x Cortex-A53) - Allwinner T3 (rebranded R40) and f1c100s (armv5) - NXP i.MX7ULP (1x Cortex-A7 + 1x Cortex-M4) - NXP LS1028A (2x Cortex-A72), LX2160A (16x Cortex-A72) New platforms: - Rockchip: Gru Scarlet (RK3188 Tablet) - Amlogic: Phicomm N1 (S905D), Libretech S805-AC - Broadcom: Linksys EA6500 v2 Wi-Fi router (BCM4708) - Qualcomm: QCS404 base platform and EVB - Qualcomm: Remove of Arrow SD600 - PXA: First PXA3xx DT board: Raumfeld - Aspeed: Facebook Backpack-CMM BMC - Renesas iWave G20D-Q7 (RZ/G1N) - Allwinner t3-cqa3t-bv3 (T3/R40) and Lichee Pi Nano (F1C100s) - Allwinner Emlid Neutis N5, Mapleboard MP130 - Marvell Macchiatobin Single Shot (Armada 8040, no 10GbE) - i.MX: mtrion emCON-MX6, imx6ul-pico-pi, imx7d-sdb-reva - VF610: Liebherr's BK4 device, ZII SCU4 AIB board - i.MX7D PICO Hobbit baseboard - i.MX7ULP EVK board - NXP LX2160AQDS and LX2160ARDB boards Other: - Coresight binding updates across the board - CPU cooling maps updates across the board" * tag 'armsoc-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (648 commits) ARM: dts: suniv: Fix improper bindings include patch ARM: dts: sunxi: Enable Broadcom-based Bluetooth for multiple boards arm64: dts: allwinner: a64: bananapi-m64: Add Bluetooth device node ARM: dts: suniv: Fix improper bindings include patch arm64: dts: Add spi-[tx/rx]-bus-width for the FSL QSPI controller arm64: dts: Remove unused properties from FSL QSPI driver nodes ARM: dts: Add spi-[tx/rx]-bus-width for the FSL QSPI controller ARM: dts: imx6sx-sdb: Fix the reg properties for the FSL QSPI nodes ARM: dts: Remove unused properties from FSL QSPI driver nodes arm64: dts: ti: k3-am654: Enable main domain McSPI0 arm64: dts: ti: k3-am654: Add McSPI DT nodes arm64: dts: ti: k3-am654: Populate power-domain property for UART nodes arm64: dts: ti: k3-am654-base-board: Enable ECAP PWM arm64: dts: ti: k3-am65-main: Add ECAP PWM node arm64: dts: ti: k3-am654-base-board: Add I2C nodes arm64: dts: ti: am654-base-board: Add pinmux for main uart0 arm64: dts: ti: k3-am65: Add pinctrl regions dt-bindings: pinctrl: k3: Introduce pinmux definitions ARM: dts: exynos: Specify I2S assigned clocks in proper node ARM: dts: exynos: Add missing CPUs in cooling maps for Odroid X2 ... commit d36377c6eb071e3d0751e9e0e3c19198c58d9a5d Merge: 0922275ef157 a6f119a06960 Author: Linus Torvalds Date: Mon Dec 31 17:32:35 2018 -0800 Merge tag 'armsoc-drivers' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC driver updates from Olof Johansson: "Misc driver updates for platforms, many of them power related. - Rockchip adds power domain support for rk3066 and rk3188 - Amlogic adds a power measurement driver - Allwinner adds SRAM support for three platforms (F1C100, H5, A64 C1) - Wakeup and ti-sysc (platform bus) fixes for OMAP/DRA7 - Broadcom fixes suspend/resume with Thumb2 kernels, and improves stability of a handful of firmware/platform interfaces - PXA completes their conversion to dmaengine framework - Renesas does a bunch of PM cleanups across many platforms - Tegra adds support for suspend/resume on T186/T194, which includes some driver cleanups and addition of wake events - Tegra also adds a driver for memory controller (EMC) on Tegra2 - i.MX tweaks power domain bindings, and adds support for i.MX8MQ in GPC - Atmel adds identifiers and LPDDR2 support for a new SoC, SAM9X60 and misc cleanups across several platforms" * tag 'armsoc-drivers' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (73 commits) ARM: at91: add support in soc driver for new SAM9X60 ARM: at91: add support in soc driver for LPDDR2 SiP memory: omap-gpmc: Use of_node_name_eq for node name comparisons bus: ti-sysc: Check for no-reset and no-idle flags at the child level ARM: OMAP2+: Check also the first dts child for hwmod flags soc: amlogic: meson-clk-measure: Add missing REGMAP_MMIO dependency soc: imx: gpc: Increase GPC_CLK_MAX to 7 soc: renesas: rcar-sysc: Fix power domain control after system resume soc: renesas: rcar-sysc: Merge PM Domain registration and linking soc: renesas: rcar-sysc: Remove rcar_sysc_power_{down,up}() helpers soc: renesas: r8a77990-sysc: Fix initialization order of 3DG-{A,B} dt-bindings: sram: sunxi: Add compatible for the A64 SRAM C1 dt-bindings: sram: sunxi: Add bindings for the H5 with SRAM C1 dt-bindings: sram: Add Allwinner suniv F1C100s soc: sunxi: sram: Add support for the H5 SoC system control soc: sunxi: sram: Enable EMAC clock access for H3 variant soc: imx: gpcv2: add support for i.MX8MQ SoC soc: imx: gpcv2: move register access table to domain data soc: imx: gpcv2: prefix i.MX7 specific defines dmaengine: pxa: make the filter function internal ... commit 0922275ef157ba8ac93e7e7857087eb0442d5397 Merge: 495d714ad140 cac1fc8fb561 Author: Linus Torvalds Date: Mon Dec 31 17:27:54 2018 -0800 Merge tag 'armsoc-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull arm SoC platform updates from Olof Johansson: "SoC updates, mostly refactorings and cleanups of old legacy platforms, but also a few more things: New SoC support this release: - NXP/Freescale i.MX7ULP (1x Cortex-A7, Cortex-M4, graphics, etc) - Allwinner F1C100, older platform with an ARM926-EJS (ARMv5) core Cleanups of various platforms: - OMAP1 ams-delta does some GPIO cleanups - Davinci removes of at24 platform data - Samsung cleans up old wakeup, PM debug and secondary core boot code - Renesas moves around config options and PM code to drivers/soc for sharing with 64-bit and more consistency - i.MX, Broadcom and SoCFPGA all have tweaks to lowlevel debug console setups - SoCFPGA adds explicit selection of ARM errata and removes some unused code This also contains a few patches that I had queued up as fixes for 4.20 but didn't send in before the release" * tag 'armsoc-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (68 commits) arm64: dts: renesas: draak: Fix CVBS input ARM: omap2: avoid section mismatch warning ARM: tegra: avoid section mismatch warning ARM: ks8695: fix section mismatch warning ARM: pxa: avoid section mismatch warning ARM: mmp: fix pxa168_device_usb_phy use on aspenite ARM: mmp: fix timer_init calls ARM: OMAP1: fix USB configuration for device-only setups ARM: OMAP1: add MMC configuration for Palm Tungsten E ARM: imx: fix dependencies on imx7ulp ARM: meson: select HAVE_ARM_TWD and ARM_GLOBAL_TIMER MAINTAINERS: add drivers/soc/amlogic/ to amlogic list ARM: imx: add initial support for imx7ulp ARM: debug-imx: only define DEBUG_IMX_UART_PORT if needed ARM: dts: Fix OMAP4430 SDP Ethernet startup ARM: dts: am335x-pdu001: Fix polarity of card detection input ARM: OMAP1: ams-delta: Fix audio permanently muted ARM: dts: omap5: Fix dual-role mode on Super-Speed port arm64: dts: rockchip: fix rk3399-rockpro64 regulator gpios ARM: davinci: da850-evm: remove unnecessary include ... commit 756af9c642329d54f048bac2a62f829b391f6944 Author: Tyrel Datwyler Date: Mon Dec 31 15:43:01 2018 -0600 ibmveth: fix DMA unmap error in ibmveth_xmit_start error path Commit 33a48ab105a7 ("ibmveth: Fix DMA unmap error") fixed an issue in the normal code path of ibmveth_xmit_start() that was originally introduced by Commit 6e8ab30ec677 ("ibmveth: Add scatter-gather support"). This original fix missed the error path where dma_unmap_page is wrongly called on the header portion in descs[0] which was mapped with dma_map_single. As a result a failure to DMA map any of the frags results in a dmesg warning when CONFIG_DMA_API_DEBUG is enabled. ------------[ cut here ]------------ DMA-API: ibmveth 30000002: device driver frees DMA memory with wrong function [device address=0x000000000a430000] [size=172 bytes] [mapped as page] [unmapped as single] WARNING: CPU: 1 PID: 8426 at kernel/dma/debug.c:1085 check_unmap+0x4fc/0xe10 ... ... DMA-API: Mapped at: ibmveth_start_xmit+0x30c/0xb60 dev_hard_start_xmit+0x100/0x450 sch_direct_xmit+0x224/0x490 __qdisc_run+0x20c/0x980 __dev_queue_xmit+0x1bc/0xf20 This fixes the API misuse by unampping descs[0] with dma_unmap_single. Fixes: 6e8ab30ec677 ("ibmveth: Add scatter-gather support") Signed-off-by: Tyrel Datwyler Signed-off-by: David S. Miller drivers/net/ethernet/ibm/ibmveth.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 9114daa825fc3f335f9bea3313ce667090187280 Author: Sven Eckelmann Date: Mon Dec 31 22:31:01 2018 +0100 batman-adv: Force mac header to start of data on xmit The caller of ndo_start_xmit may not already have called skb_reset_mac_header. The returned value of skb_mac_header/eth_hdr therefore can be in the wrong position and even outside the current skbuff. This for example happens when the user binds to the device using a PF_PACKET-SOCK_RAW with enabled qdisc-bypass: int opt = 4; setsockopt(sock, SOL_PACKET, PACKET_QDISC_BYPASS, &opt, sizeof(opt)); Since eth_hdr is used all over the codebase, the batadv_interface_tx function must always take care of resetting it. Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol") Reported-by: syzbot+9d7405c7faa390e60b4e@syzkaller.appspotmail.com Reported-by: syzbot+7d20bc3f1ddddc0f9079@syzkaller.appspotmail.com Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich net/batman-adv/soft-interface.c | 2 ++ 1 file changed, 2 insertions(+) commit 4d9226fd9a0d747030575d7cb184b30c6e64f155 Author: Stefan Wahren Date: Fri Dec 28 17:53:23 2018 +0100 arm64: defconfig: Re-enable bcm2835-thermal driver The bcm2835-thermal driver was added with commit ac178e4280e6 ("ARM64: bcm2835: add thermal driver to default config"). Unfortunately this was accidentally dropped by commit eb1e6716cc9c ("arm64: defconfig: sync with savedefconfig"). So enable the driver again. Fixes: eb1e6716cc9c ("arm64: defconfig: sync with savedefconfig") Signed-off-by: Stefan Wahren Signed-off-by: Olof Johansson arch/arm64/configs/defconfig | 1 + 1 file changed, 1 insertion(+) commit 2081076ac735de4eab6b9809d8b6ad8432d34d54 Merge: 8a66c20e66cc 704cfd7f5f71 Author: Olof Johansson Date: Mon Dec 31 13:12:02 2018 -0800 Merge tag 'sti-soc-for-v4.21-round1' of git://git.kernel.org/pub/scm/linux/kernel/git/pchotard/sti into next/late Highlights: ----------- - Following pen_release and boot_lock cleanup initiated by Russell King, .smp_prepare_cpus and .smp_boot_secondary STi callbacks must be reworked to keep secondary CPU's bringup. * tag 'sti-soc-for-v4.21-round1' of git://git.kernel.org/pub/scm/linux/kernel/git/pchotard/sti: ARM: sti: remove pen_release and boot_lock Signed-off-by: Olof Johansson commit 8a66c20e66cc0d961d6b98cd766de4040f6e485f Merge: c6f9fa88a398 74ebbdda7cec Author: Olof Johansson Date: Mon Dec 31 13:11:04 2018 -0800 Merge tag 'samsung-dt64-4.21-2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into next/late Samsung DTS ARM64 changes for v4.21, part 2 Add IMEM clock controller (for Security SubSystem) and Bluetooth chip to Exynos5433 TM2(e) boards. * tag 'samsung-dt64-4.21-2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: arm64: dts: exynos: Add Bluetooth chip to TM2(e) boards arm64: dts: exynos: Add IMEM clock controller to Exynos5433 arm64: dts: exynos: Add all CPUs in cooling maps arm64: dts: exynos: Update DWC3 modules on Exynos5433 SoCs Signed-off-by: Olof Johansson commit c6f9fa88a398288613bbf3387d0f6b0b280cf9a2 Merge: a684afa7b10f 8ac686d7dfed Author: Olof Johansson Date: Mon Dec 31 13:10:16 2018 -0800 Merge tag 'samsung-dt-4.21-2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into next/late Samsung DTS ARM changes for v4.21, part 2 1. Add missing CPUs in cooling maps for Odroid X2 (missed in previous round of fixups). 2. Fix clock configuration in audio subsystem on Odroid XU3/XU4. * tag 'samsung-dt-4.21-2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: ARM: dts: exynos: Specify I2S assigned clocks in proper node ARM: dts: exynos: Add missing CPUs in cooling maps for Odroid X2 ARM: dts: exynos: remove display-port node from Arndale ARM: dts: exynos: Add opp-suspend to DMC and leftbus devfreq OPPs on Exynos4 ARM: dts: s5pv210: Add s5p-jpeg codec node. ARM: dts: exynos: Use Samsung SoC specific compatible for DWC2 module ARM: dts: exynos: Add all CPUs in cooling maps ARM: dts: exynos: Clarify comment explaining purpose of Odroid XU3 DTSI ARM: dts: exynos: Add pin configuration for SD write protect on Odroid XU3/XU4/HC1 ARM: dts: exynos: Update maximum frequency for eMMC to 200MHz on Odroid XU3/XU4 ARM: dts: exynos: Update maximum frequency for SD card to 200MHz on Odroid XU3/XU4/HC1 ARM: dts: exynos: Fix LDO13 min values on Odroid XU3/XU4/HC1 ARM: dts: exynos: Add UHS-I bus speed support to Odroid XU3/XU4/HC1 ARM: dts: exynos: Add missing clocks to RTC node for Arndale board ARM: dts: exynos: Add compatible for s5m8767 clocks node on Itop Core ARM: dts: exynos: Add compatible for s2mps11 clocks node on Exynos542x Signed-off-by: Olof Johansson commit a684afa7b10f6bcd0fc51f212b4ad60dc2721fbe Author: Manivannan Sadhasivam Date: Tue Dec 18 20:32:38 2018 +0530 MAINTAINERS: Add entry for RDA Micro SoC architecture Add MAINTAINERS entry for RDA Micro SoC architecture with myself as the maintainer. Signed-off-by: Manivannan Sadhasivam Acked-by: Arnd Bergmann Signed-off-by: Olof Johansson MAINTAINERS | 14 ++++++++++++++ 1 file changed, 14 insertions(+) commit c10b13325ced237f6129e8ee73cd8c72e1bd10ed Author: Manivannan Sadhasivam Date: Tue Dec 18 20:32:37 2018 +0530 tty: serial: Add RDA8810PL UART driver Add UART driver for RDA Micro RDA8810PL SoC. Signed-off-by: Andreas Färber Signed-off-by: Manivannan Sadhasivam Reviewed-by: Greg Kroah-Hartman Acked-by: Arnd Bergmann Signed-off-by: Olof Johansson Documentation/admin-guide/kernel-parameters.txt | 6 + drivers/tty/serial/Kconfig | 19 + drivers/tty/serial/Makefile | 1 + drivers/tty/serial/rda-uart.c | 831 ++++++++++++++++++++++++ include/uapi/linux/serial_core.h | 3 + 5 files changed, 860 insertions(+) commit 6fc66a5c68af56c28b08267bfb7f7ac45afc21a8 Author: Manivannan Sadhasivam Date: Tue Dec 18 20:32:36 2018 +0530 ARM: dts: rda8810pl: Add interrupt support for UART Add interrupt support for UART in RDA Micro RDA8810PL SoC. Signed-off-by: Andreas Färber Signed-off-by: Manivannan Sadhasivam Acked-by: Arnd Bergmann Signed-off-by: Olof Johansson arch/arm/boot/dts/rda8810pl.dtsi | 3 +++ 1 file changed, 3 insertions(+) commit 804584a61ca0d4547965630d5a433ad1c39e0b27 Author: Andreas Färber Date: Tue Dec 18 20:32:35 2018 +0530 dt-bindings: serial: Document RDA Micro UART Add an initial binding for the UART in RDA Micro RDA8810PL SoC. Signed-off-by: Andreas Färber Signed-off-by: Manivannan Sadhasivam Reviewed-by: Rob Herring Acked-by: Arnd Bergmann Signed-off-by: Olof Johansson .../devicetree/bindings/serial/rda,8810pl-uart.txt | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) commit 5a9fe404b984cec1e3d51a8a377219a2592f3214 Author: Manivannan Sadhasivam Date: Tue Dec 18 20:32:34 2018 +0530 ARM: dts: rda8810pl: Add timer support Add timer support for RDA Micro RDA8810PL SoC. Signed-off-by: Andreas Färber Signed-off-by: Manivannan Sadhasivam Acked-by: Arnd Bergmann Signed-off-by: Olof Johansson arch/arm/boot/dts/rda8810pl.dtsi | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 7581d836bdbe2533e732f3bceb97a89d4f81de7b Author: Manivannan Sadhasivam Date: Tue Dec 18 20:32:33 2018 +0530 ARM: dts: Add devicetree for OrangePi i96 board Add initial devicetree for Orange Pi i96 board from Xunlong. It is one of the 96Boards IoT Edition board. Signed-off-by: Andreas Färber Signed-off-by: Manivannan Sadhasivam Acked-by: Arnd Bergmann Signed-off-by: Olof Johansson arch/arm/boot/dts/Makefile | 3 +- arch/arm/boot/dts/rda8810pl-orangepi-i96.dts | 50 ++++++++++++++++++++++++++++ 2 files changed, 52 insertions(+), 1 deletion(-) commit f0d319d26ea60f9dceaf00051b5876de039e49ca Author: Manivannan Sadhasivam Date: Tue Dec 18 20:32:32 2018 +0530 ARM: dts: Add devicetree for OrangePi 2G IoT board Add initial devicetree support for OrangePi 2G IoT board from Xunlong. Signed-off-by: Andreas Färber Signed-off-by: Manivannan Sadhasivam Acked-by: Arnd Bergmann Signed-off-by: Olof Johansson arch/arm/boot/dts/Makefile | 2 + arch/arm/boot/dts/rda8810pl-orangepi-2g-iot.dts | 50 +++++++++++++++++++++++++ 2 files changed, 52 insertions(+) commit 542e1c9dbad9137e84e136cb4ee53c89627d87fe Author: Manivannan Sadhasivam Date: Tue Dec 18 20:32:31 2018 +0530 ARM: dts: Add devicetree for RDA8810PL SoC Add initial device tree for RDA8810PL SoC from RDA Microelectronics. Signed-off-by: Andreas Färber Signed-off-by: Manivannan Sadhasivam Acked-by: Arnd Bergmann Signed-off-by: Olof Johansson arch/arm/boot/dts/rda8810pl.dtsi | 86 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 86 insertions(+) commit 78e3dbc166a137c5f796151281d39bec1b8e1cd0 Author: Andreas Färber Date: Tue Dec 18 20:32:30 2018 +0530 ARM: Prepare RDA8810PL SoC Introduce ARCH_RDA and mach-rda for RDA Micro SoCs. Signed-off-by: Andreas Färber Signed-off-by: Manivannan Sadhasivam Acked-by: Arnd Bergmann Signed-off-by: Olof Johansson arch/arm/Kconfig | 2 ++ arch/arm/Makefile | 1 + arch/arm/mach-rda/Kconfig | 7 +++++++ arch/arm/mach-rda/Makefile | 1 + 4 files changed, 11 insertions(+) commit 56f73e4bc145730c94894d5b5c557f19b89e073a Author: Andreas Färber Date: Tue Dec 18 20:32:29 2018 +0530 dt-bindings: arm: Document RDA8810PL and reference boards Add bindings for RDA Micro RDA8810PL SoC and below reference boards: 1. Orange Pi 2G-IoT - http://www.orangepi.org/OrangePi2GIOT/ 2. Orange Pi i96 - https://www.96boards.org/product/orangepi-i96/ Cc: zhao_steven@263.net Signed-off-by: Andreas Färber Signed-off-by: Manivannan Sadhasivam Reviewed-by: Rob Herring Acked-by: Arnd Bergmann Signed-off-by: Olof Johansson Documentation/devicetree/bindings/arm/rda.txt | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) commit 1def98f69807518e26dcb0ac70142dcbbd953dc6 Author: Andreas Färber Date: Tue Dec 18 20:32:28 2018 +0530 dt-bindings: Add RDA Micro vendor prefix Add vendor prefix for RDA Micro which now merged into Unisoc Communications Inc. Signed-off-by: Andreas Färber Signed-off-by: Manivannan Sadhasivam Reviewed-by: Rob Herring Acked-by: Arnd Bergmann Signed-off-by: Olof Johansson Documentation/devicetree/bindings/vendor-prefixes.txt | 1 + 1 file changed, 1 insertion(+) commit a2edaf7893e2bd0247ea4bc13f21302fecb30d95 Merge: 5e0bd98f8cef 3bbc9abbfb8c Author: Olof Johansson Date: Mon Dec 31 13:07:11 2018 -0800 Merge tag 'imx8mq-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into next/late i.MX8MQ device tree support for 4.21: - It contains the initial device tree support for i.MX8MQ - the first ARM64 i.MX processor. It features a quad Cortex-A53 core that operates at speeds of up to 1.3 GHz, a Cortex-M4 core for low-power processing, a DRAM controller that supports 32-bit/16-bit LPDDR4/DDR4/DDR3L memory, and hardware acceleration for 4K video playback. - A couple of patches from Baruch that add watchdog device for i.MX8MQ enable it for imx8mq-evk board. * tag 'imx8mq-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: arm64: dts: imx8mq-evk: enable watchdog arm64: dts: imx8mq: add watchdog devices MAINTAINERS: add i.MX8 DT path to i.MX architecture arm64: add support for i.MX8M EVK board arm64: add basic DTS for i.MX8MQ arm64: add basic Kconfig symbols for i.MX8 arm64: dts: ls1046a: add qdma device tree nodes arm64: dts: ls1043a: add qdma device tree nodes arm64: dts: ls1088a: Add missing dma-ranges property arm64: dts: ls1088a: Move fsl-mc node arm64: dts: fsl: Add all CPUs in cooling maps arm64: dts: Add support for NXP LS1028A SoC arm64: dts: layerscape: removed compatible string "snps,dw-pcie" arm64: dts: fsl: Add the status property disable PCIe arm64: dts: ls1012a: Add FRWY-LS1012A board support dt-bindings: Add binding for i.MX8MQ CCM arm64: dts: add LX2160AQDS board support arm64: dts: add LX2160ARDB board support arm64: dts: add QorIQ LX2160A SoC support Signed-off-by: Olof Johansson commit 5e0bd98f8ceffce3da9c09cdcf5f5f30d4d9bd59 Merge: 6ae284ab58a2 3c15ddb97c77 Author: Olof Johansson Date: Mon Dec 31 13:06:30 2018 -0800 Merge tag 'tee-subsys-optee-for-4.21' of https://git.linaro.org/people/jens.wiklander/linux-tee into next/late OP-TEE dynamic shm log message Adds a log message in the OP-TEE driver to inform that dynamic shared memory is enabled. * tag 'tee-subsys-optee-for-4.21' of https://git.linaro.org/people/jens.wiklander/linux-tee: tee: optee: log message if dynamic shm is enabled Signed-off-by: Olof Johansson commit 6ae284ab58a2e990a5f4daba1eb42fc600cf004b Merge: 8fe28cb58bcb b2d102bd0146 Author: Olof Johansson Date: Mon Dec 31 13:05:53 2018 -0800 Merge tag 'tee-subsys-fix-for-4.21' of https://git.linaro.org/people/jens.wiklander/linux-tee into next/late Avoid possible double list_del in supplicant comms A fix for the OP-TEE driver to avoid possible double list_del during tee-supplicant communication while the system is shutting down. * tag 'tee-subsys-fix-for-4.21' of https://git.linaro.org/people/jens.wiklander/linux-tee: tee: optee: avoid possible double list_del() Signed-off-by: Olof Johansson commit cac1fc8fb561ac766468394d49c3dd11a2b8cb44 Merge: bd3fde386dec 54518ed45734 Author: Olof Johansson Date: Mon Dec 31 11:54:03 2018 -0800 Merge branch 'fixes' into next/soc Merge in fixes here, since the last batch didn't make it in before the release of 4.20, and we might as well group them with this set of patches. * fixes: (822 commits) arm64: dts: renesas: draak: Fix CVBS input ARM: dts: Fix OMAP4430 SDP Ethernet startup ARM: dts: am335x-pdu001: Fix polarity of card detection input ARM: OMAP1: ams-delta: Fix audio permanently muted ARM: dts: omap5: Fix dual-role mode on Super-Speed port arm64: dts: rockchip: fix rk3399-rockpro64 regulator gpios ARM: dts: imx7d-nitrogen7: Fix the description of the Wifi clock ARM: imx: update the cpu power up timing setting on i.mx6sx Revert "arm64: dts: marvell: add CPU Idle power state support on Armada 7K/8K" ARM: dts: imx7d-pico: Describe the Wifi clock ARM: dts: realview: Fix some more duplicate regulator nodes MAINTAINERS: update entry for MMP platform ARM: mmp/mmp2: fix cpu_is_mmp2() on mmp2-dt MAINTAINERS: mediatek: Update SoC entry ARM: dts: bcm2837: Fix polarity of wifi reset GPIOs + Linux 4.20-rc5 Signed-off-by: Olof Johansson commit 495d714ad140e1732e66c45d0409054b24c1a0d6 Merge: f12e840c819b 3d739c1f6156 Author: Linus Torvalds Date: Mon Dec 31 11:46:59 2018 -0800 Merge tag 'trace-v4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing updates from Steven Rostedt: - Rework of the kprobe/uprobe and synthetic events to consolidate all the dynamic event code. This will make changes in the future easier. - Partial rewrite of the function graph tracing infrastructure. This will allow for multiple users of hooking onto functions to get the callback (return) of the function. This is the ground work for having kprobes and function graph tracer using one code base. - Clean up of the histogram code that will facilitate adding more features to the histograms in the future. - Addition of str_has_prefix() and a few use cases. There currently is a similar function strstart() that is used in a few places, but only returns a bool and not a length. These instances will be removed in the future to use str_has_prefix() instead. - A few other various clean ups as well. * tag 'trace-v4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: (57 commits) tracing: Use the return of str_has_prefix() to remove open coded numbers tracing: Have the historgram use the result of str_has_prefix() for len of prefix tracing: Use str_has_prefix() instead of using fixed sizes tracing: Use str_has_prefix() helper for histogram code string.h: Add str_has_prefix() helper function tracing: Make function ‘ftrace_exports’ static tracing: Simplify printf'ing in seq_print_sym tracing: Avoid -Wformat-nonliteral warning tracing: Merge seq_print_sym_short() and seq_print_sym_offset() tracing: Add hist trigger comments for variable-related fields tracing: Remove hist trigger synth_var_refs tracing: Use hist trigger's var_ref array to destroy var_refs tracing: Remove open-coding of hist trigger var_ref management tracing: Use var_refs[] for hist trigger reference checking tracing: Change strlen to sizeof for hist trigger static strings tracing: Remove unnecessary hist trigger struct field tracing: Fix ftrace_graph_get_ret_stack() to use task and not current seq_buf: Use size_t for len in seq_buf_puts() seq_buf: Make seq_buf_puts() null-terminate the buffer arm64: Use ftrace_graph_get_ret_stack() instead of curr_ret_stack ... commit 74d4b4e0f43e5ffb61b63f4e3cfcfad3d7398765 Author: Matti Vaittinen Date: Thu Dec 27 10:44:43 2018 +0200 regmap: regmap-irq: silently ignore unsupported type settings Do not return error if irq-type setting is requested for controlloer which does not support this. This is how regmap-irq has previously handled the undupported type settings and existing drivers seem to be upset if failure is now reported. Fixes: 1c2928e3e321 ("regmap: regmap-irq/gpio-max77620: add level-irq support") Signed-off-by: Matti Vaittinen Reported-by: Geert Uytterhoeven Signed-off-by: Mark Brown drivers/base/regmap/regmap-irq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f12e840c819bab42621685558a01d3f46ab9a226 Merge: e3ed513bcf00 1c3243f61fa7 Author: Linus Torvalds Date: Mon Dec 31 09:57:14 2018 -0800 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha Pull alpha architecture updates from Matt Turner: "A few small changes for alpha as well as the new system call table generation support from Firoz Khan" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha: alpha: Remove some unused variables alpha: rtc: simplify alpha_rtc_init alpha: Fix a typo on ptrace.h alpha: fix spelling mistake QSD_PORT_ACTUVE -> QSD_PORT_ACTIVE alpha: generate uapi header and syscall table header files alpha: add system call table generation support alpha: add __NR_syscalls along with NR_SYSCALLS alpha: remove CONFIG_OSF4_COMPAT flag from syscall table alpha: move __IGNORE* entries to non uapi header commit e3ed513bcf0097c0b8a1f1b4d791a8d0d8933b3b Merge: 2a1a2c1a76cf c40f7d74c741 Author: Linus Torvalds Date: Mon Dec 31 09:54:17 2018 -0800 Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Ingo Molnar: "This is a revert for a lockup in cgroups-intense workloads - the real fixes will come later" * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/fair: Fix infinite loop in update_blocked_averages() by reverting a9e7f6544b9c commit 2a1a2c1a76cf89aaeb98a89179c2942c7882f68a Merge: 9ab97aea85cc d8a706414af4 Author: Linus Torvalds Date: Mon Dec 31 09:46:39 2018 -0800 Merge tag 'dax-fix-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull dax fix from Dan Williams: "Clean up unnecessary usage of prepare_to_wait_exclusive(). While I feel a bit silly sending a single-commit pull-request there is nothing else queued up for dax this cycle. This change has shipped in -next for multiple releases" * tag 'dax-fix-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: dax: Use non-exclusive wait in wait_entry_unlocked() commit 9ab97aea85cca43a6aedc90e0d1feba91eebe1ad Merge: 195303136f19 64beba0558fc Author: Linus Torvalds Date: Mon Dec 31 09:41:37 2018 -0800 Merge tag 'f2fs-for-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs Pull f2fs updates from Jaegeuk Kim: "In this round, we've focused on bug fixes since Pixel devices have been shipping with f2fs. Some of them were related to hardware encryption support which are actually not an issue in mainline, but would be better to merge them in order to avoid potential bugs. Enhancements: - do GC sub-sections when the section is large - add a flag in ioctl(SHUTDOWN) to trigger fsck for QA - use kvmalloc() in order to give another chance to avoid ENOMEM Bug fixes: - fix accessing memory boundaries in a malformed iamge - GC gives stale unencrypted block - GC counts in large sections - detect idle time more precisely - block allocation of DIO writes - race conditions between write_begin and write_checkpoint - allow GCs for node segments via ioctl() There are various clean-ups and minor bug fixes as well" * tag 'f2fs-for-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (43 commits) f2fs: sanity check of xattr entry size f2fs: fix use-after-free issue when accessing sbi->stat_info f2fs: check PageWriteback flag for ordered case f2fs: fix validation of the block count in sanity_check_raw_super f2fs: fix missing unlock(sbi->gc_mutex) f2fs: fix to dirty inode synchronously f2fs: clean up structure extent_node f2fs: fix block address for __check_sit_bitmap f2fs: fix sbi->extent_list corruption issue f2fs: clean up checkpoint flow f2fs: flush stale issued discard candidates f2fs: correct wrong spelling, issing_* f2fs: use kvmalloc, if kmalloc is failed f2fs: remove redundant comment of unused wio_mutex f2fs: fix to reorder set_page_dirty and wait_on_page_writeback f2fs: clear PG_writeback if IPU failed f2fs: add an ioctl() to explicitly trigger fsck later f2fs: avoid frequent costly fsck triggers f2fs: fix m_may_create to make OPU DIO write correctly f2fs: fix to update new block address correctly for OPU ... commit 427c5ce4417cba0801fbf79c8525d1330704759c Author: Finn Thain Date: Mon Dec 31 16:44:09 2018 +1100 block/swim3: Fix regression on PowerBook G3 As of v4.20, the swim3 driver crashes when loaded on a PowerBook G3 (Wallstreet). MacIO PCI driver attached to Gatwick chipset MacIO PCI driver attached to Heathrow chipset swim3 0.00015000:floppy: [fd0] SWIM3 floppy controller in media bay 0.00013020:ch-a: ttyS0 at MMIO 0xf3013020 (irq = 16, base_baud = 230400) is a Z85c30 ESCC - Serial port 0.00013000:ch-b: ttyS1 at MMIO 0xf3013000 (irq = 17, base_baud = 230400) is a Z85c30 ESCC - Infrared port macio: fixed media-bay irq on gatwick macio: fixed left floppy irqs swim3 1.00015000:floppy: [fd1] Couldn't request interrupt Unable to handle kernel paging request for data at address 0x00000024 Faulting instruction address: 0xc02652f8 Oops: Kernel access of bad area, sig: 11 [#1] BE SMP NR_CPUS=2 PowerMac Modules linked in: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.20.0 #2 NIP: c02652f8 LR: c026915c CTR: c0276d1c REGS: df43ba10 TRAP: 0300 Not tainted (4.20.0) MSR: 00009032 CR: 28228288 XER: 00000100 DAR: 00000024 DSISR: 40000000 GPR00: c026915c df43bac0 df439060 c0731524 df494700 00000000 c06e1c08 00000001 GPR08: 00000001 00000000 df5ff220 00001032 28228282 00000000 c0004ca4 00000000 GPR16: 00000000 00000000 00000000 c073144c dfffe064 c0731524 00000120 c0586108 GPR24: c073132c c073143c c073143c 00000000 c0731524 df67cd70 df494700 00000001 NIP [c02652f8] blk_mq_free_rqs+0x28/0xf8 LR [c026915c] blk_mq_sched_tags_teardown+0x58/0x84 Call Trace: [df43bac0] [c0045f50] flush_workqueue_prep_pwqs+0x178/0x1c4 (unreliable) [df43bae0] [c026915c] blk_mq_sched_tags_teardown+0x58/0x84 [df43bb00] [c02697f0] blk_mq_exit_sched+0x9c/0xb8 [df43bb20] [c0252794] elevator_exit+0x84/0xa4 [df43bb40] [c0256538] blk_exit_queue+0x30/0x50 [df43bb50] [c0256640] blk_cleanup_queue+0xe8/0x184 [df43bb70] [c034732c] swim3_attach+0x330/0x5f0 [df43bbb0] [c034fb24] macio_device_probe+0x58/0xec [df43bbd0] [c032ba88] really_probe+0x1e4/0x2f4 [df43bc00] [c032bd28] driver_probe_device+0x64/0x204 [df43bc20] [c0329ac4] bus_for_each_drv+0x60/0xac [df43bc50] [c032b824] __device_attach+0xe8/0x160 [df43bc80] [c032ab38] bus_probe_device+0xa0/0xbc [df43bca0] [c0327338] device_add+0x3d8/0x630 [df43bcf0] [c0350848] macio_add_one_device+0x444/0x48c [df43bd50] [c03509f8] macio_pci_add_devices+0x168/0x1bc [df43bd90] [c03500ec] macio_pci_probe+0xc0/0x10c [df43bda0] [c02ad884] pci_device_probe+0xd4/0x184 [df43bdd0] [c032ba88] really_probe+0x1e4/0x2f4 [df43be00] [c032bd28] driver_probe_device+0x64/0x204 [df43be20] [c032bfcc] __driver_attach+0x104/0x108 [df43be40] [c0329a00] bus_for_each_dev+0x64/0xb4 [df43be70] [c032add8] bus_add_driver+0x154/0x238 [df43be90] [c032ca24] driver_register+0x84/0x148 [df43bea0] [c0004aa0] do_one_initcall+0x40/0x188 [df43bf00] [c0690100] kernel_init_freeable+0x138/0x1d4 [df43bf30] [c0004cbc] kernel_init+0x18/0x10c [df43bf40] [c00121e4] ret_from_kernel_thread+0x14/0x1c Instruction dump: 5484d97e 4bfff4f4 9421ffe0 7c0802a6 bf410008 7c9e2378 90010024 8124005c 2f890000 419e0078 81230004 7c7c1b78 <81290024> 2f890000 419e0064 81440000 ---[ end trace 12025ab921a9784c ]--- Reverting commit 8ccb8cb1892b ("swim3: convert to blk-mq") resolves the problem. That commit added a struct blk_mq_tag_set to struct floppy_state and initialized it with a blk_mq_init_sq_queue() call. Unfortunately, there is a memset() in swim3_add_device() that subsequently clears the floppy_state struct. That means fs->tag_set->ops is a NULL pointer, and it gets dereferenced by blk_mq_free_rqs() which gets called in the request_irq() error path. Move the memset() to fix this bug. BTW, the request_irq() failure for the left mediabay floppy (fd1) is not a regression. I don't know why it happens. The right media bay floppy (fd0) works fine however. Reported-and-tested-by: Stan Johnson Fixes: 8ccb8cb1892b ("swim3: convert to blk-mq") Cc: linuxppc-dev@lists.ozlabs.org Signed-off-by: Finn Thain Signed-off-by: Jens Axboe drivers/block/swim3.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit 296dcc40f2f2e402facf7cd26cf3f2c8f4b17d47 Author: Finn Thain Date: Mon Dec 31 16:44:09 2018 +1100 block/swim3: Fix -EBUSY error when re-opening device after unmount When the block device is opened with FMODE_EXCL, ref_count is set to -1. This value doesn't get reset when the device is closed which means the device cannot be opened again. Fix this by checking for refcount <= 0 in the release method. Reported-and-tested-by: Stan Johnson Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: linuxppc-dev@lists.ozlabs.org Signed-off-by: Finn Thain Signed-off-by: Jens Axboe drivers/block/swim3.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit f3010ec5b7963b63f5f455725f947a95e55e0c03 Author: Finn Thain Date: Mon Dec 31 16:44:09 2018 +1100 block/swim3: Remove dead return statement Cc: linuxppc-dev@lists.ozlabs.org Signed-off-by: Finn Thain Signed-off-by: Jens Axboe drivers/block/swim3.c | 1 - 1 file changed, 1 deletion(-) commit d4d179c37c74dd18684d3b197fb16642a39e27ee Author: Finn Thain Date: Mon Dec 31 16:44:09 2018 +1100 block/amiflop: Don't log error message on invalid ioctl Cc: linux-m68k@lists.linux-m68k.org Signed-off-by: Finn Thain Signed-off-by: Jens Axboe drivers/block/amiflop.c | 2 -- 1 file changed, 2 deletions(-) commit 0ad30ff67bd3e82da8c1dc4d74b88aca846dbbd9 Author: Vasily Averin Date: Sat Dec 29 16:38:51 2018 +0300 nfs: fixed broken compilation in nfs_callback_up_net() Patch fixes compilation error in nfs_callback_up_net() serv->sv_bc_enabled is defined under enabled CONFIG_SUNRPC_BACKCHANNEL, however nfs_callback_up_net() can access it even if this config option was not set. Fixes: a289ce5311f4 (sunrpc: replace svc_serv->sv_bc_xprt by boolean flag) Reported-by: kbuild test robot Signed-off-by: Vasily Averin Signed-off-by: J. Bruce Fields fs/nfs/callback.c | 2 +- include/linux/sunrpc/bc_xprt.h | 9 +++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) commit 6256734f9173b19e8dd1e21e04b1398a0137f99b Author: Guo Ren Date: Mon Dec 31 22:27:29 2018 +0800 csky: Add EM_CSKY_OLD 39 C-SKY historically used 39, the same value as MCORE, from which the architecture was derived. C-SKY binutils support both EM_CSKY and EM_CSKY_OLD, confirmed by binutils:include/elf/common.h Signed-off-by: Guo Ren arch/csky/include/asm/elf.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 0c87bb0e872cbbad59a965fc67668364066aa85e Author: Guo Ren Date: Mon Dec 31 20:52:41 2018 +0800 clocksource/drivers/c-sky: fixup ftrace call-graph panic We must add notrace on sched_clock_read, because it's called by ftrace_graph_caller. Signed-off-by: Guo Ren drivers/clocksource/timer-mp-csky.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d7950be145c84ca5094c52bc1ad1e7f1893d0f19 Author: Guo Ren Date: Sat Dec 15 21:04:27 2018 +0800 csky: ftrace call graph supported. With csky-gcc -pg -mbacktrace, ftrace call graph supported. Signed-off-by: Guo Ren arch/csky/Kconfig | 1 + arch/csky/abiv2/mcount.S | 116 ++++++++++++++++++++++++++++++++++++++--- arch/csky/include/asm/ftrace.h | 6 ++- arch/csky/kernel/ftrace.c | 48 +++++++++++++---- 4 files changed, 151 insertions(+), 20 deletions(-) commit db1ce3f5d01d2d6d5714aefba0159d2cb5167a0b Author: Huacai Chen Date: Tue Dec 25 08:51:01 2018 +0800 MIPS: Fix a R10000_LLSC_WAR logic in atomic.h Commit 4936084c2ee2 ("MIPS: Cleanup R10000_LLSC_WAR logic in atomic.h") introduce a mistake in atomic64_fetch_##op##_relaxed(), because it forget to delete R10000_LLSC_WAR in the if-condition. So fix it. Fixes: 4936084c2ee2 ("MIPS: Cleanup R10000_LLSC_WAR logic in atomic.h") Signed-off-by: Huacai Chen Signed-off-by: Paul Burton Cc: Joshua Kinard Cc: Ralf Baechle Cc: Steven J . Hill Cc: Fuxin Zhang Cc: Zhangjin Wu Cc: linux-mips@linux-mips.org Cc: stable@vger.kernel.org # 4.19+ arch/mips/include/asm/atomic.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 230c77a5e92a29bf21e98ee35e22b0537f61c55b Author: Guo Ren Date: Sun Dec 9 14:29:59 2018 +0800 csky: basic ftrace supported When gcc with -pg, it'll add _mcount stub in every function. We need implement the _mcount in kernel and ftrace depends on stackstrace. To do: call-graph, dynamic ftrace Signed-off-by: Guo Ren arch/csky/Kconfig | 1 + arch/csky/abiv2/Makefile | 1 + arch/csky/abiv2/mcount.S | 24 ++++++++++++++++++++++++ arch/csky/include/asm/ftrace.h | 9 +++++++++ arch/csky/kernel/Makefile | 5 +++++ arch/csky/kernel/ftrace.c | 24 ++++++++++++++++++++++++ 6 files changed, 64 insertions(+) commit 17a68777bc883c8044c8b2d40aa112ff4e8a4fb1 Author: Guo Ren Date: Sun Dec 9 17:31:53 2018 +0800 csky: remove unused members in processor.h Cleanup struct cpuinfo_csky and struct thread_struct, remove all esp0 related code. We could get pt_regs from sp and backtrace could use fp in switch_stack. Signed-off-by: Guo Ren arch/csky/include/asm/processor.h | 12 ------------ arch/csky/kernel/asm-offsets.c | 1 - arch/csky/kernel/entry.S | 12 ------------ arch/csky/kernel/ptrace.c | 4 ---- arch/csky/kernel/signal.c | 2 -- arch/csky/kernel/traps.c | 6 ------ arch/csky/mm/fault.c | 3 --- 7 files changed, 40 deletions(-) commit 8f4f1639a19db231e4579612dbc6d147e8d07ffd Author: Guo Ren Date: Sun Dec 9 17:07:20 2018 +0800 csky: optimize kernel panic print. Use STACKTRACE to optimize panic print more pretty and align registers printing. Signed-off-by: Guo Ren arch/csky/kernel/dumpstack.c | 59 ++++++++++++++------------------------------ arch/csky/kernel/ptrace.c | 34 ++++++++++++++----------- arch/csky/mm/fault.c | 4 +-- 3 files changed, 41 insertions(+), 56 deletions(-) commit 682fee802843b332f9c51ffc8e062de5ff773f2e Author: Jonas Gorski Date: Sun Dec 30 12:55:09 2018 +0100 MIPS: BCM63XX: drop unused and broken DSP platform device Trying to register the DSP platform device results in a null pointer access: [ 0.124184] CPU 0 Unable to handle kernel paging request at virtual address 00000000, epc == 804e305c, ra == 804e6f20 [ 0.135208] Oops[#1]: [ 0.137514] CPU: 0 PID: 1 Comm: swapper Not tainted 4.14.87 ... [ 0.197117] epc : 804e305c bcm63xx_dsp_register+0x80/0xa4 [ 0.202838] ra : 804e6f20 board_register_devices+0x258/0x390 ... This happens because it tries to copy the passed platform data over the platform_device's unpopulated platform_data. Since this code has been broken since its submission, no driver was ever submitted for it, and apparently nobody was using it, just remove it instead of trying to fix it. Fixes: e7300d04bd08 ("MIPS: BCM63xx: Add support for the Broadcom BCM63xx family of SOCs.") Signed-off-by: Jonas Gorski Signed-off-by: Paul Burton Acked-by: Florian Fainelli Cc: linux-mips@linux-mips.org Cc: Ralf Baechle Cc: James Hogan arch/mips/bcm63xx/Makefile | 6 +-- arch/mips/bcm63xx/boards/board_bcm963xx.c | 20 -------- arch/mips/bcm63xx/dev-dsp.c | 56 ---------------------- .../include/asm/mach-bcm63xx/bcm63xx_dev_dsp.h | 14 ------ .../mips/include/asm/mach-bcm63xx/board_bcm963xx.h | 5 -- 5 files changed, 3 insertions(+), 98 deletions(-) commit 0ea2dc7cd668be5475babecaf6fdeaa464e2847b Author: Guo Ren Date: Sun Dec 9 14:18:05 2018 +0800 csky: stacktrace supported. The gcc option "-mbacktrace" will push fp(r8),lr into stack and we could unwind the stack with: fp = *fp lr = (unsigned int *)fp[1] Signed-off-by: Guo Ren arch/csky/Kconfig | 3 ++ arch/csky/Makefile | 4 +++ arch/csky/include/asm/thread_info.h | 4 +++ arch/csky/kernel/Makefile | 1 + arch/csky/kernel/process.c | 29 +++++++++++-------- arch/csky/kernel/stacktrace.c | 57 +++++++++++++++++++++++++++++++++++++ 6 files changed, 86 insertions(+), 12 deletions(-) commit 859e5f45cbb33fe5d591a8e429667f0b7d4f4be8 Author: Guo Ren Date: Wed Dec 19 19:56:14 2018 +0800 csky: CPU-hotplug supported for SMP This is a simple implement of CPU-hotplug for power saving. CPU use wait instruction to enter power saving mode and waiting for IPI wakeup signal. Signed-off-by: Guo Ren arch/csky/Kconfig | 9 ++++++ arch/csky/include/asm/smp.h | 4 +++ arch/csky/kernel/smp.c | 71 +++++++++++++++++++++++++++++++++++---------- 3 files changed, 69 insertions(+), 15 deletions(-) commit 1d95fe4d3de42e915bc22d5fd6cd4de103c5e517 Author: Guo Ren Date: Thu Dec 20 15:21:41 2018 +0800 clocksource/drivers/c-sky: fixup qemu fail to bootup sometimes. Timer startup must after timer_irq_enable. For qemu, timer tick irq hanppens but irq not enable, so it will cause qemu boot failed. Signed-off-by: Guo Ren Tested-by: Liu Zhiwei drivers/clocksource/timer-mp-csky.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 789154c2ad74c29c3c60c5136c1785745abe4897 Author: Guo Ren Date: Mon Dec 31 15:17:48 2018 +0800 csky: fixup save hi,lo,dspcr regs in switch_stack. HI, LO, DSPCR registers are 807/810 related regs and no need for 610/860. All of the regs must be saved in pt_regs and switch_stack. This patch fixup saving dspcr reg in switch_stack and pt_regs. Signed-off-by: Guo Ren arch/csky/abiv1/inc/abi/switch_context.h | 17 ++++++++++++++ arch/csky/abiv2/inc/abi/entry.h | 28 ++++++++++++++++++++--- arch/csky/abiv2/inc/abi/switch_context.h | 32 ++++++++++++++++++++++++++ arch/csky/include/asm/processor.h | 3 +-- arch/csky/include/uapi/asm/ptrace.h | 39 +------------------------------- arch/csky/kernel/asm-offsets.c | 2 -- arch/csky/kernel/entry.S | 22 ------------------ arch/csky/kernel/ptrace.c | 4 +++- 8 files changed, 79 insertions(+), 68 deletions(-) commit 31295a72b525721d10737260aea6918fb34607be Author: Guo Ren Date: Sun Dec 9 13:18:15 2018 +0800 csky: remove syscall_exit_work Remove syscall_exit_work and union all to ret_from_exception. Signed-off-by: Guo Ren arch/csky/kernel/entry.S | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) commit 35ff802af1c49dab21af8ef47b492ff952831d72 Author: Guo Ren Date: Mon Dec 31 01:19:29 2018 +0800 csky: fixup remove vdsp implement for kernel. The vr regs for vdsp only saved in task_switch not in every exception trap-in. The memcpy with vdsp instructions will destroy the vr regs for user space applications. Signed-off-by: Guo Ren arch/csky/abiv2/memcpy.S | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) commit 660611827c03afeb0eec178dc1fb9f842332d908 Merge: 69ca36b3d629 aeaebcc17cdf Author: Vinod Koul Date: Mon Dec 31 19:32:32 2018 +0530 Merge branch 'topic/xilinx' into for-linus commit 69ca36b3d629f1fcdaa9e7abb8b6b2084ff947dd Merge: 990beed934fc 32e74aabebc8 Author: Vinod Koul Date: Mon Dec 31 19:32:27 2018 +0530 Merge branch 'topic/uniphier' into for-linus commit 990beed934fc4568d6e76a5117e71a92fd9fd9d1 Merge: f782086a49b7 531971231dac Author: Vinod Koul Date: Mon Dec 31 19:32:21 2018 +0530 Merge branch 'topic/sprd' into for-linus commit f782086a49b7e7eb713d09370fa4525b04fe0dbe Merge: 56e8e1a118a9 47ec4cf405e2 Author: Vinod Koul Date: Mon Dec 31 19:32:16 2018 +0530 Merge branch 'topic/sh' into for-linus commit 56e8e1a118a96b9d0d02efa6290b94d9082f69d3 Merge: 68ded1dcd138 bc822e80170d Author: Vinod Koul Date: Mon Dec 31 19:32:10 2018 +0530 Merge branch 'topic/sa11x0' into for-linus commit 68ded1dcd138cccb7b0e7b23c7a0c5f7e3785535 Merge: 23a1bff76406 b1f01e48df5a Author: Vinod Koul Date: Mon Dec 31 19:31:59 2018 +0530 Merge branch 'topic/mtk' into for-linus commit 23a1bff76406070c287c8c5a0b528ae7ffd07d1a Merge: b7ff66ca30f8 af8bf89a8e0b Author: Vinod Koul Date: Mon Dec 31 19:31:54 2018 +0530 Merge branch 'topic/imx' into for-linus commit b7ff66ca30f88dfd63763d12b848520baddc5ae5 Merge: 010299bfc2df 9b68cc012a73 Author: Vinod Koul Date: Mon Dec 31 19:31:47 2018 +0530 Merge branch 'topic/ep93xx' into for-linus commit 010299bfc2df19c2c330c75c048805939e5ab91b Merge: 466e601a68da 7b0c03ecc42f Author: Vinod Koul Date: Mon Dec 31 19:31:42 2018 +0530 Merge branch 'topic/dw' into for-linus commit 466e601a68da7554da84e87d81dac74608deedbe Merge: 77ee1aacdd5b f80f9988a26d Author: Vinod Koul Date: Mon Dec 31 19:31:37 2018 +0530 Merge branch 'topic/dmatest' into for-linus commit 77ee1aacdd5bad4617a9617bb838d79840cf1f20 Merge: 5f443256e3a1 9e314ef35c38 Author: Vinod Koul Date: Mon Dec 31 19:31:31 2018 +0530 Merge branch 'topic/dirn_remove' into for-linus commit 5f443256e3a1e22a0969878428bcfbd3639439d9 Merge: 7c2269e95883 35faaf0df42d Author: Vinod Koul Date: Mon Dec 31 19:31:25 2018 +0530 Merge branch 'topic/coh' into for-linus commit 7c2269e95883a2123dc5c273df54d6c9e05ab880 Merge: f7f41722efac 80c4445e56f4 Author: Vinod Koul Date: Mon Dec 31 19:31:21 2018 +0530 Merge branch 'topic/bcm' into for-linus commit 36e14f5fdfdf7cec8887b7ff69cd9bb5051ecf62 Author: Alexandre Belloni Date: Mon Dec 31 11:36:16 2018 +0100 rtc: rename core files Rename core files so there is a clearer separation between the RTC core and the RTC drivers. Signed-off-by: Alexandre Belloni drivers/rtc/Makefile | 8 ++++---- drivers/rtc/{rtc-dev.c => dev.c} | 0 drivers/rtc/{rtc-lib.c => lib.c} | 0 drivers/rtc/{rtc-proc.c => proc.c} | 0 drivers/rtc/{rtc-sysfs.c => sysfs.c} | 0 5 files changed, 4 insertions(+), 4 deletions(-) commit fea170804b4dc44cd79f8cb1ce236f3a824951cd Author: Steve French Date: Tue Nov 6 16:20:46 2018 -0600 cifs: update internal module version number To version 2.15 Signed-off-by: Steve French fs/cifs/cifsfs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e77fe73c7e38c36145825d84cfe385d400aba4fd Author: Ronnie Sahlberg Date: Mon Dec 31 13:43:40 2018 +1000 cifs: we can not use small padding iovs together with encryption We can not append small padding buffers as separate iovs when encryption is used. For this case we must flatten the request into a single buffer containing both the data from all the iovs as well as the padding bytes. This is at least needed for 4.20 as well due to compounding changes. CC: Stable Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French fs/cifs/smb2inode.c | 16 ++++++------- fs/cifs/smb2ops.c | 67 ++++++++++++++++++++++++++++++++++++----------------- fs/cifs/smb2proto.h | 5 ++-- 3 files changed, 55 insertions(+), 33 deletions(-) commit 95cb67138746451cc84cf8e516e14989746e93b0 Author: Theodore Ts'o Date: Mon Dec 31 00:11:07 2018 -0500 ext4: track writeback errors using the generic tracking infrastructure We already using mapping_set_error() in fs/ext4/page_io.c, so all we need to do is to use file_check_and_advance_wb_err() when handling fsync() requests in ext4_sync_file(). Signed-off-by: Theodore Ts'o Cc: stable@kernel.org fs/ext4/fsync.c | 3 +++ 1 file changed, 3 insertions(+) commit ad211f3e94b314a910d4af03178a0b52a7d1ee0a Author: Theodore Ts'o Date: Mon Dec 31 00:10:48 2018 -0500 ext4: use ext4_write_inode() when fsyncing w/o a journal In no-journal mode, we previously used __generic_file_fsync() in no-journal mode. This triggers a lockdep warning, and in addition, it's not safe to depend on the inode writeback mechanism in the case ext4. We can solve both problems by calling ext4_write_inode() directly. Signed-off-by: Theodore Ts'o Cc: stable@kernel.org fs/ext4/fsync.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) commit 3bd8264511035dc97c902f03fa9f1d07f95f8f62 Author: Heiner Kallweit Date: Sun Dec 30 13:16:12 2018 +0100 r8169: fix WoL device wakeup enable In rtl8169_runtime_resume() we configure WoL but don't set the device to wakeup-enabled. This prevents PME generation once the cable is re-plugged. Fix this by moving the call to device_set_wakeup_enable() to __rtl8169_set_wol(). Fixes: 433f9d0ddcc6 ("r8169: improve saved_wolopts handling") Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller drivers/net/ethernet/realtek/r8169.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 7314f5480f3e37e570104dc5e0f28823ef849e72 Author: Cong Wang Date: Sat Dec 29 13:56:38 2018 -0800 netrom: fix locking in nr_find_socket() nr_find_socket(), nr_find_peer() and nr_find_listener() lock the sock after finding it in the global list. However, the call path requires BH disabled for the sock lock consistently. Actually the locking is unnecessary at this point, we can just hold the sock refcnt to make sure it is not gone after we unlock the global list, and lock it later only when needed. Reported-and-tested-by: syzbot+f621cda8b7e598908efa@syzkaller.appspotmail.com Signed-off-by: Cong Wang Signed-off-by: David S. Miller net/netrom/af_netrom.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) commit d5c7c745f254c6cb98b3b3f15fe789b8bd770c72 Author: Cong Wang Date: Sat Dec 29 13:56:37 2018 -0800 net/wan: fix a double free in x25_asy_open_tty() When x25_asy_open() fails, it already cleans up by itself, so its caller doesn't need to free the memory again. It seems we still have to call x25_asy_free() to clear the SLF_INUSE bit, so just set these pointers to NULL after kfree(). Reported-and-tested-by: syzbot+5e5e969e525129229052@syzkaller.appspotmail.com Fixes: 3b780bed3138 ("x25_asy: Free x25_asy on x25_asy_open() failure.") Signed-off-by: Cong Wang Signed-off-by: David S. Miller drivers/net/wan/x25_asy.c | 2 ++ 1 file changed, 2 insertions(+) commit e86807862e6880809f191c4cea7f88a489f0ed34 Author: Theodore Ts'o Date: Sun Dec 30 23:20:39 2018 -0500 ext4: avoid kernel warning when writing the superblock to a dead device The xfstests generic/475 test switches the underlying device with dm-error while running a stress test. This results in a large number of file system errors, and since we can't lock the buffer head when marking the superblock dirty in the ext4_grp_locked_error() case, it's possible the superblock to be !buffer_uptodate() without buffer_write_io_error() being true. We need to set buffer_uptodate() before we call mark_buffer_dirty() or this will trigger a WARN_ON. It's safe to do this since the superblock must have been properly read into memory or the mount would have been successful. So if buffer_uptodate() is not set, we can safely assume that this happened due to a failed attempt to write the superblock. Signed-off-by: Theodore Ts'o Cc: stable@vger.kernel.org fs/ext4/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2054f4af19575d9d2a43bcefa48d2e64f10a25de Author: Guo Ren Date: Mon Dec 31 01:06:53 2018 +0800 csky: bugfix gdb coredump error. In gdb/bfd elf32-csky.c, csky_elf_grok_prstatus() use fixed size of elf_prstatus. It's 148 for abiv1 and 220 for abiv2, the size is enough for coredump and no need full sizeof(struct pt_regs). Signed-off-by: Guo Ren Reported-by: Lu Baoquan Reported-by: Liu Mao arch/csky/include/asm/elf.h | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 2b070ccdf8c020fb6c4911263852c021d8aa843c Author: Guo Ren Date: Sun Dec 30 21:47:28 2018 +0800 csky: fixup abiv2 mmap(... O_SYNC) failed. Glibc function mmap(... O_SYNC) will make page to _PAGE_UNCACHE + _PAGE_SO and strong-order page couldn't support unalignment access. So remove _PAGE_SO from _PAGE_UNCACHE, also sync abiv1 with the macro of _PAGE_SO. Signed-off-by: Guo Ren Reported-by: Liu Renwei Tested-by: Yuan Qiyun arch/csky/abiv1/inc/abi/pgtable-bits.h | 1 + arch/csky/abiv2/inc/abi/pgtable-bits.h | 2 +- arch/csky/mm/ioremap.c | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) commit bba3d2daa8a9bc888902275401f15ef48fcdd378 Author: Alexandre Belloni Date: Mon Dec 31 00:49:36 2018 +0100 rtc: nvmem: fix possible use after free In cas of probe failure, devres may free the memory allocated for rtc->nvram before devm_rtc_release_device() is called. This leads to rtc_nvram_unregister using it after being freed which may lead to a crash. This has been shown to happen after commit 461e557b9727 ("rtc: nvmem: use devm_nvmem_register()") Reported-by: kernel test robot Signed-off-by: Alexandre Belloni drivers/rtc/nvmem.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 74136a3d47f51ae72ee8b9ebc1ec2a29bcf30676 Merge: 4bcd2ffd214c f6653a0e0877 Author: Dave Airlie Date: Mon Dec 31 08:29:38 2018 +1000 Merge branch 'drm-next-4.21' of git://people.freedesktop.org/~agd5f/linux into drm-next Fixes for 4.21. A bit more than usual due to the holidays. Highlights: - add new vegaM pci id - sr-iov fixes - DC fix for fast cursor updates - DC freesync fix - DC display clock fix for polaris - DC fixes for dongles - DC fix for some eDP panels - misc vega20 fixes - kfd return code fix for dma_buf support - VCN fixes for PCO - nbio hw bug workaround Signed-off-by: Dave Airlie From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20181229183307.3330-1-alexander.deucher@amd.com commit c433570458e49bccea5c551df628d058b3526289 Author: Cong Wang Date: Sat Dec 29 13:56:36 2018 -0800 ax25: fix a use-after-free in ax25_fillin_cb() There are multiple issues here: 1. After freeing dev->ax25_ptr, we need to set it to NULL otherwise we may use a dangling pointer. 2. There is a race between ax25_setsockopt() and device notifier as reported by syzbot. Close it by holding RTNL lock. 3. We need to test if dev->ax25_ptr is NULL before using it. Reported-and-tested-by: syzbot+ae6bb869cbed29b29040@syzkaller.appspotmail.com Signed-off-by: Cong Wang Signed-off-by: David S. Miller net/ax25/af_ax25.c | 11 +++++++++-- net/ax25/ax25_dev.c | 2 ++ 2 files changed, 11 insertions(+), 2 deletions(-) commit 7f334a7e1ae113212e39aafba51352ea9ab8c9f9 Author: Su Yanjun Date: Sat Dec 29 14:07:55 2018 -0500 ipv6: fix typo in net/ipv6/reassembly.c Signed-off-by: Su Yanjun Signed-off-by: David S. Miller net/ipv6/reassembly.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 58075ff523af85002bfeace07304d57c59251605 Author: YueHaibing Date: Sat Dec 29 14:45:23 2018 +0800 ipv4: fib_rules: Fix possible infinite loop in fib_empty_table gcc warn this: net/ipv4/fib_rules.c:203 fib_empty_table() warn: always true condition '(id <= 4294967295) => (0-u32max <= u32max)' 'id' is u32, which always not greater than RT_TABLE_MAX (0xFFFFFFFF), So add a check to break while wrap around. Signed-off-by: YueHaibing Signed-off-by: David S. Miller net/ipv4/fib_rules.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 178fe94405bffbd1acd83b6ff3b40211185ae9c9 Author: Christophe JAILLET Date: Fri Dec 28 23:28:21 2018 +0100 net/ipv6: Fix a test against 'ipv6_find_idev()' return value 'ipv6_find_idev()' returns NULL on error, not an error pointer. Update the test accordingly and return -ENOBUFS, as already done in 'addrconf_add_dev()', if NULL is returned. Fixes: ("ipv6: allow userspace to add IFA_F_OPTIMISTIC addresses") Signed-off-by: Christophe JAILLET Signed-off-by: David S. Miller net/ipv6/addrconf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit f989d03ef25df3fc26d3ea0fe7c19c9830577166 Author: Nikolay Aleksandrov Date: Sun Dec 30 14:33:20 2018 +0200 net: rtnetlink: address is mandatory for rtnl_fdb_get We must have an address to lookup otherwise we'll derefence a null pointer in the ndo_fdb_get callbacks. CC: Roopa Prabhu CC: David Ahern Reported-by: syzbot+017b1f61c82a1c3e7efd@syzkaller.appspotmail.com Fixes: 5b2f94b27622 ("net: rtnetlink: support for fdb get") Signed-off-by: Nikolay Aleksandrov Acked-by: Roopa Prabhu Signed-off-by: David S. Miller net/core/rtnetlink.c | 5 +++++ 1 file changed, 5 insertions(+) commit d770b25653447b4c57303859e2ac04ebe9318f8e Author: Dmitry V. Levin Date: Thu Dec 13 20:22:07 2018 +0300 csky: define syscall_get_arch() syscall_get_arch() is required to be implemented on all architectures in order to extend the generic ptrace API with PTRACE_GET_SYSCALL_INFO request. Cc: Guo Ren Cc: Paul Moore Cc: Eric Paris Cc: Oleg Nesterov Cc: Andy Lutomirski Cc: Elvira Khabirova Cc: Eugene Syromyatnikov Cc: linux-audit@redhat.com Signed-off-by: Dmitry V. Levin Signed-off-by: Guo Ren arch/csky/include/asm/syscall.h | 7 +++++++ include/uapi/linux/audit.h | 1 + 2 files changed, 8 insertions(+) arch/csky/include/asm/syscall.h | 7 +++++++ include/uapi/linux/audit.h | 1 + 2 files changed, 8 insertions(+) commit 077b930adafead095cd38600539ec129f1379d8c Author: Dmitry V. Levin Date: Thu Dec 13 20:22:00 2018 +0300 elf-em.h: add EM_CSKY The uapi/linux/audit.h header is going to use EM_CSKY in order to define AUDIT_ARCH_CSKY which is needed to implement syscall_get_arch() which in turn is required to extend the generic ptrace API with PTRACE_GET_SYSCALL_INFO request. The value for EM_CSKY has been taken from arch/csky/include/asm/elf.h and confirmed by binutils:include/elf/common.h Cc: Guo Ren Cc: Oleg Nesterov Cc: Andy Lutomirski Cc: Elvira Khabirova Cc: Eugene Syromyatnikov Signed-off-by: Dmitry V. Levin Signed-off-by: Guo Ren arch/csky/include/asm/elf.h | 2 +- include/uapi/linux/elf-em.h | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) commit c40f7d74c741a907cfaeb73a7697081881c497d0 Author: Linus Torvalds Date: Thu Dec 27 13:46:17 2018 -0800 sched/fair: Fix infinite loop in update_blocked_averages() by reverting a9e7f6544b9c Zhipeng Xie, Xie XiuQi and Sargun Dhillon reported lockups in the scheduler under high loads, starting at around the v4.18 time frame, and Zhipeng Xie tracked it down to bugs in the rq->leaf_cfs_rq_list manipulation. Do a (manual) revert of: a9e7f6544b9c ("sched/fair: Fix O(nr_cgroups) in load balance path") It turns out that the list_del_leaf_cfs_rq() introduced by this commit is a surprising property that was not considered in followup commits such as: 9c2791f936ef ("sched/fair: Fix hierarchical order in rq->leaf_cfs_rq_list") As Vincent Guittot explains: "I think that there is a bigger problem with commit a9e7f6544b9c and cfs_rq throttling: Let take the example of the following topology TG2 --> TG1 --> root: 1) The 1st time a task is enqueued, we will add TG2 cfs_rq then TG1 cfs_rq to leaf_cfs_rq_list and we are sure to do the whole branch in one path because it has never been used and can't be throttled so tmp_alone_branch will point to leaf_cfs_rq_list at the end. 2) Then TG1 is throttled 3) and we add TG3 as a new child of TG1. 4) The 1st enqueue of a task on TG3 will add TG3 cfs_rq just before TG1 cfs_rq and tmp_alone_branch will stay on rq->leaf_cfs_rq_list. With commit a9e7f6544b9c, we can del a cfs_rq from rq->leaf_cfs_rq_list. So if the load of TG1 cfs_rq becomes NULL before step 2) above, TG1 cfs_rq is removed from the list. Then at step 4), TG3 cfs_rq is added at the beginning of rq->leaf_cfs_rq_list but tmp_alone_branch still points to TG3 cfs_rq because its throttled parent can't be enqueued when the lock is released. tmp_alone_branch doesn't point to rq->leaf_cfs_rq_list whereas it should. So if TG3 cfs_rq is removed or destroyed before tmp_alone_branch points on another TG cfs_rq, the next TG cfs_rq that will be added, will be linked outside rq->leaf_cfs_rq_list - which is bad. In addition, we can break the ordering of the cfs_rq in rq->leaf_cfs_rq_list but this ordering is used to update and propagate the update from leaf down to root." Instead of trying to work through all these cases and trying to reproduce the very high loads that produced the lockup to begin with, simplify the code temporarily by reverting a9e7f6544b9c - which change was clearly not thought through completely. This (hopefully) gives us a kernel that doesn't lock up so people can continue to enjoy their holidays without worrying about regressions. ;-) [ mingo: Wrote changelog, fixed weird spelling in code comment while at it. ] Analyzed-by: Xie XiuQi Analyzed-by: Vincent Guittot Reported-by: Zhipeng Xie Reported-by: Sargun Dhillon Reported-by: Xie XiuQi Tested-by: Zhipeng Xie Tested-by: Sargun Dhillon Signed-off-by: Linus Torvalds Acked-by: Vincent Guittot Cc: # v4.13+ Cc: Bin Li Cc: Mike Galbraith Cc: Peter Zijlstra Cc: Tejun Heo Cc: Thomas Gleixner Fixes: a9e7f6544b9c ("sched/fair: Fix O(nr_cgroups) in load balance path") Link: http://lkml.kernel.org/r/1545879866-27809-1-git-send-email-xiexiuqi@huawei.com Signed-off-by: Ingo Molnar kernel/sched/fair.c | 43 +++++++++---------------------------------- 1 file changed, 9 insertions(+), 34 deletions(-) commit dc3e0896003ee9b3bcc34c53965dc4bbc8671c44 Author: Masahiro Yamada Date: Mon Dec 17 01:03:25 2018 +0900 csky: remove meaningless header-y Since commit fcc8487d477a ("uapi: export all headers under uapi directories"), header-y is meaningless because headers under uapi are all exported. Signed-off-by: Masahiro Yamada Signed-off-by: Guo Ren arch/csky/include/uapi/asm/Kbuild | 2 -- 1 file changed, 2 deletions(-) commit 955d3411a17f590364238bd0d3329b61f20c1cd2 Author: Sven Eckelmann Date: Sun Dec 30 12:46:01 2018 +0100 batman-adv: Avoid WARN on net_device without parent in netns It is not allowed to use WARN* helpers on potential incorrect input from the user or transient problems because systems configured as panic_on_warn will reboot due to such a problem. A NULL return value of __dev_get_by_index can be caused by various problems which can either be related to the system configuration or problems (incorrectly returned network namespaces) in other (virtual) net_device drivers. batman-adv should not cause a (harmful) WARN in this situation and instead only report it via a simple message. Fixes: b7eddd0b3950 ("batman-adv: prevent using any virtual device created on batman-adv as hard-interface") Reported-by: syzbot+c764de0fcfadca9a8595@syzkaller.appspotmail.com Reported-by: Dmitry Vyukov Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich net/batman-adv/hard-interface.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 398539dd69341f8e3b87b8fea9355c7edfb6d99a Author: Yangtao Li Date: Thu Dec 27 12:45:51 2018 -0500 csky: Don't leak device tree node reference of_find_node_by_type() acquires a reference to the node returned by it and that reference needs to be dropped by its caller. setup_smp() doesn't do that, so fix it by converting to for_each_of_cpu_node(). Signed-off-by: Yangtao Li Signed-off-by: Guo Ren arch/csky/kernel/smp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cc0282975b3f887005c380adcf0af95915f0c1bb Author: Christophe Leroy Date: Thu Dec 6 20:07:40 2018 +0000 kgdb/treewide: constify struct kgdb_arch arch_kgdb_ops checkpatch.pl reports the following: WARNING: struct kgdb_arch should normally be const #28: FILE: arch/mips/kernel/kgdb.c:397: +struct kgdb_arch arch_kgdb_ops = { This report makes sense, as all other ops struct, this one should also be const. This patch does the change. Cc: Vineet Gupta Cc: Russell King Cc: Catalin Marinas Cc: Will Deacon Cc: Yoshinori Sato Cc: Richard Kuo Cc: Michal Simek Cc: Ralf Baechle Cc: Paul Burton Cc: James Hogan Cc: Ley Foon Tan Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Michael Ellerman Cc: Rich Felker Cc: "David S. Miller" Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: x86@kernel.org Acked-by: Daniel Thompson Acked-by: Paul Burton Signed-off-by: Christophe Leroy Acked-by: Borislav Petkov Acked-by: Michael Ellerman (powerpc) Signed-off-by: Daniel Thompson arch/arc/kernel/kgdb.c | 2 +- arch/arm/kernel/kgdb.c | 2 +- arch/arm64/kernel/kgdb.c | 2 +- arch/h8300/kernel/kgdb.c | 2 +- arch/hexagon/kernel/kgdb.c | 2 +- arch/microblaze/kernel/kgdb.c | 2 +- arch/mips/kernel/kgdb.c | 2 +- arch/nios2/kernel/kgdb.c | 2 +- arch/powerpc/kernel/kgdb.c | 2 +- arch/sh/kernel/kgdb.c | 2 +- arch/sparc/kernel/kgdb_32.c | 2 +- arch/sparc/kernel/kgdb_64.c | 2 +- arch/x86/kernel/kgdb.c | 2 +- include/linux/kgdb.h | 2 +- 14 files changed, 14 insertions(+), 14 deletions(-) commit 911b7afdeb1b6058056c3a74e15d5ebb7eb6225e Author: Christophe Leroy Date: Thu Dec 6 20:07:38 2018 +0000 mips/kgdb: prepare arch_kgdb_ops for constness MIPS is the only architecture modifying arch_kgdb_ops during init. This patch makes the init static, so that it can be changed to const in following patch, as recommended by checkpatch.pl Suggested-by: Paul Burton Acked-by: Daniel Thompson Acked-by: Paul Burton Signed-off-by: Christophe Leroy Signed-off-by: Daniel Thompson arch/mips/kernel/kgdb.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) commit 7faedcd4de4356dfcda30841a5ffef3bf35fa06c Author: Nicholas Mc Guire Date: Fri Jul 20 11:23:37 2018 +0200 kdb: use bool for binary state indicators defcmd_in_progress is the state trace for command group processing - within a command group or not - usable is an indicator if a command set is valid (allocated/non-empty) - so use a bool for those binary indication here. Signed-off-by: Nicholas Mc Guire Reviewed-by: Daniel Thompson Signed-off-by: Daniel Thompson kernel/debug/kdb/kdb_main.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit 162bc7f5afd75b72acbe3c5f3488ef7e64a3fe36 Author: Douglas Anderson Date: Tue Dec 4 19:38:28 2018 -0800 kdb: Don't back trace on a cpu that didn't round up If you have a CPU that fails to round up and then run 'btc' you'll end up crashing in kdb becaue we dereferenced NULL. Let's add a check. It's wise to also set the task to NULL when leaving the debugger so that if we fail to round up on a later entry into the debugger we won't backtrace a stale task. Signed-off-by: Douglas Anderson Acked-by: Daniel Thompson Signed-off-by: Daniel Thompson kernel/debug/debug_core.c | 4 ++++ kernel/debug/kdb/kdb_bt.c | 11 ++++++++++- kernel/debug/kdb/kdb_debugger.c | 7 ------- 3 files changed, 14 insertions(+), 8 deletions(-) commit 87b095928584da7d5cb3149016f00b0b139c2292 Author: Douglas Anderson Date: Tue Dec 4 19:38:27 2018 -0800 kgdb: Don't round up a CPU that failed rounding up before If we're using the default implementation of kgdb_roundup_cpus() that uses smp_call_function_single_async() we can end up hanging kgdb_roundup_cpus() if we try to round up a CPU that failed to round up before. Specifically smp_call_function_single_async() will try to wait on the csd lock for the CPU that we're trying to round up. If the previous round up never finished then that lock could still be held and we'll just sit there hanging. There's not a lot of use trying to round up a CPU that failed to round up before. Let's keep a flag that indicates whether the CPU started but didn't finish to round up before. If we see that flag set then we'll skip the next round up. In general we have a few goals here: - We never want to end up calling smp_call_function_single_async() when the csd is still locked. This is accomplished because flush_smp_call_function_queue() unlocks the csd _before_ invoking the callback. That means that when kgdb_nmicallback() runs we know for sure the the csd is no longer locked. Thus when we set "rounding_up = false" we know for sure that the csd is unlocked. - If there are no timeouts rounding up we should never skip a round up. NOTE #1: In general trying to continue running after failing to round up CPUs doesn't appear to be supported in the debugger. When I simulate this I find that kdb reports "Catastrophic error detected" when I try to continue. I can overrule and continue anyway, but it should be noted that we may be entering the land of dragons here. Possibly the "Catastrophic error detected" was added _because_ of the future failure to round up, but even so this is an area of the code that hasn't been strongly tested. NOTE #2: I did a bit of testing before and after this change. I introduced a 10 second hang in the kernel while holding a spinlock that I could invoke on a certain CPU with 'taskset -c 3 cat /sys/...". Before this change if I did: - Invoke hang - Enter debugger - g (which warns about Catastrophic error, g again to go anyway) - g - Enter debugger ...I'd hang the rest of the 10 seconds without getting a debugger prompt. After this change I end up in the debugger the 2nd time after only 1 second with the standard warning about 'Timed out waiting for secondary CPUs.' I'll also note that once the CPU finished waiting I could actually debug it (aka "btc" worked) I won't promise that everything works perfectly if the errant CPU comes back at just the wrong time (like as we're entering or exiting the debugger) but it certainly seems like an improvement. NOTE #3: setting 'kgdb_info[cpu].rounding_up = false' is in kgdb_nmicallback() instead of kgdb_call_nmi_hook() because some implementations override kgdb_call_nmi_hook(). It shouldn't hurt to have it in kgdb_nmicallback() in any case. NOTE #4: this logic is really only needed because there is no API call like "smp_try_call_function_single_async()" or "smp_csd_is_locked()". If such an API existed then we'd use it instead, but it seemed a bit much to add an API like this just for kgdb. Signed-off-by: Douglas Anderson Acked-by: Daniel Thompson Signed-off-by: Daniel Thompson kernel/debug/debug_core.c | 20 +++++++++++++++++++- kernel/debug/debug_core.h | 1 + 2 files changed, 20 insertions(+), 1 deletion(-) commit 3cd99ac3559855f69afbc1d5080e17eaa12394ff Author: Douglas Anderson Date: Tue Dec 4 19:38:26 2018 -0800 kgdb: Fix kgdb_roundup_cpus() for arches who used smp_call_function() When I had lockdep turned on and dropped into kgdb I got a nice splat on my system. Specifically it hit: DEBUG_LOCKS_WARN_ON(current->hardirq_context) Specifically it looked like this: sysrq: SysRq : DEBUG ------------[ cut here ]------------ DEBUG_LOCKS_WARN_ON(current->hardirq_context) WARNING: CPU: 0 PID: 0 at .../kernel/locking/lockdep.c:2875 lockdep_hardirqs_on+0xf0/0x160 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.19.0 #27 pstate: 604003c9 (nZCv DAIF +PAN -UAO) pc : lockdep_hardirqs_on+0xf0/0x160 ... Call trace: lockdep_hardirqs_on+0xf0/0x160 trace_hardirqs_on+0x188/0x1ac kgdb_roundup_cpus+0x14/0x3c kgdb_cpu_enter+0x53c/0x5cc kgdb_handle_exception+0x180/0x1d4 kgdb_compiled_brk_fn+0x30/0x3c brk_handler+0x134/0x178 do_debug_exception+0xfc/0x178 el1_dbg+0x18/0x78 kgdb_breakpoint+0x34/0x58 sysrq_handle_dbg+0x54/0x5c __handle_sysrq+0x114/0x21c handle_sysrq+0x30/0x3c qcom_geni_serial_isr+0x2dc/0x30c ... ... irq event stamp: ...45 hardirqs last enabled at (...44): [...] __do_softirq+0xd8/0x4e4 hardirqs last disabled at (...45): [...] el1_irq+0x74/0x130 softirqs last enabled at (...42): [...] _local_bh_enable+0x2c/0x34 softirqs last disabled at (...43): [...] irq_exit+0xa8/0x100 ---[ end trace adf21f830c46e638 ]--- Looking closely at it, it seems like a really bad idea to be calling local_irq_enable() in kgdb_roundup_cpus(). If nothing else that seems like it could violate spinlock semantics and cause a deadlock. Instead, let's use a private csd alongside smp_call_function_single_async() to round up the other CPUs. Using smp_call_function_single_async() doesn't require interrupts to be enabled so we can remove the offending bit of code. In order to avoid duplicating this across all the architectures that use the default kgdb_roundup_cpus(), we'll add a "weak" implementation to debug_core.c. Looking at all the people who previously had copies of this code, there were a few variants. I've attempted to keep the variants working like they used to. Specifically: * For arch/arc we passed NULL to kgdb_nmicallback() instead of get_irq_regs(). * For arch/mips there was a bit of extra code around kgdb_nmicallback() NOTE: In this patch we will still get into trouble if we try to round up a CPU that failed to round up before. We'll try to round it up again and potentially hang when we try to grab the csd lock. That's not new behavior but we'll still try to do better in a future patch. Suggested-by: Daniel Thompson Signed-off-by: Douglas Anderson Cc: Vineet Gupta Cc: Russell King Cc: Catalin Marinas Cc: Will Deacon Cc: Richard Kuo Cc: Ralf Baechle Cc: Paul Burton Cc: James Hogan Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Michael Ellerman Cc: Yoshinori Sato Cc: Rich Felker Cc: "David S. Miller" Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: "H. Peter Anvin" Acked-by: Will Deacon Signed-off-by: Daniel Thompson arch/arc/kernel/kgdb.c | 10 ++-------- arch/arm/kernel/kgdb.c | 12 ------------ arch/arm64/kernel/kgdb.c | 12 ------------ arch/hexagon/kernel/kgdb.c | 27 --------------------------- arch/mips/kernel/kgdb.c | 9 +-------- arch/powerpc/kernel/kgdb.c | 4 ++-- arch/sh/kernel/kgdb.c | 12 ------------ include/linux/kgdb.h | 15 +++++++++++++-- kernel/debug/debug_core.c | 41 +++++++++++++++++++++++++++++++++++++++++ 9 files changed, 59 insertions(+), 83 deletions(-) commit 9ef7fa507d6b53a96de4da3298c5f01bde603c0a Author: Douglas Anderson Date: Tue Dec 4 19:38:25 2018 -0800 kgdb: Remove irq flags from roundup The function kgdb_roundup_cpus() was passed a parameter that was documented as: > the flags that will be used when restoring the interrupts. There is > local_irq_save() call before kgdb_roundup_cpus(). Nobody used those flags. Anyone who wanted to temporarily turn on interrupts just did local_irq_enable() and local_irq_disable() without looking at them. So we can definitely remove the flags. Signed-off-by: Douglas Anderson Cc: Vineet Gupta Cc: Russell King Cc: Catalin Marinas Cc: Will Deacon Cc: Richard Kuo Cc: Ralf Baechle Cc: Paul Burton Cc: James Hogan Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Michael Ellerman Cc: Yoshinori Sato Cc: Rich Felker Cc: "David S. Miller" Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: "H. Peter Anvin" Acked-by: Will Deacon Signed-off-by: Daniel Thompson arch/arc/kernel/kgdb.c | 2 +- arch/arm/kernel/kgdb.c | 2 +- arch/arm64/kernel/kgdb.c | 2 +- arch/hexagon/kernel/kgdb.c | 9 ++------- arch/mips/kernel/kgdb.c | 2 +- arch/powerpc/kernel/kgdb.c | 2 +- arch/sh/kernel/kgdb.c | 2 +- arch/sparc/kernel/smp_64.c | 2 +- arch/x86/kernel/kgdb.c | 9 ++------- include/linux/kgdb.h | 9 ++------- kernel/debug/debug_core.c | 2 +- 11 files changed, 14 insertions(+), 29 deletions(-) commit f460772291f8171988b2b60141a45706123d0c69 Author: Michael Ellerman Date: Sun Dec 30 14:05:13 2018 +1100 KVM: PPC: Book3S HV: radix: Fix uninitialized var build error Old GCCs (4.6.3 at least), aren't able to follow the logic in __kvmhv_copy_tofrom_guest_radix() and warn that old_pid is used uninitialized: arch/powerpc/kvm/book3s_64_mmu_radix.c:75:3: error: 'old_pid' may be used uninitialized in this function The logic is OK, we only use old_pid if quadrant == 1, and in that case it has definitely be initialised, eg: if (quadrant == 1) { old_pid = mfspr(SPRN_PID); ... if (quadrant == 1 && pid != old_pid) mtspr(SPRN_PID, old_pid); Annotate it to fix the error. Signed-off-by: Michael Ellerman arch/powerpc/kvm/book3s_64_mmu_radix.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 42aee37298f4b1d91ecb55530a62de249ecf4266 Author: Michael Ellerman Date: Thu Dec 27 20:40:40 2018 +1100 powerpc/configs: Add PPC4xx_OCM to ppc40x_defconfig There was recently a compilation break to this driver, but we didn't notice because none of our defconfigs have it enabled. Fix that. Signed-off-by: Michael Ellerman arch/powerpc/configs/ppc40x_defconfig | 1 + 1 file changed, 1 insertion(+) commit 52b88fa1e8c7bae03bb691178a9f8bfb64e5679f Author: Michael Ellerman Date: Thu Dec 27 20:37:29 2018 +1100 powerpc/4xx/ocm: Fix phys_addr_t printf warnings Currently the code produces several warnings, eg: arch/powerpc/platforms/4xx/ocm.c:240:38: error: format '%llx' expects argument of type 'long long unsigned int', but argument 3 has type 'phys_addr_t {aka unsigned int}' seq_printf(m, "PhysAddr : 0x%llx\n", ocm->phys); ~~~^ ~~~~~~~~~ Fix it by using the special %pa[p] format for printing phys_addr_t. Note we need to pass the value by reference for the special specifier to work. Signed-off-by: Michael Ellerman arch/powerpc/platforms/4xx/ocm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit d0757237d7b18b1ce74293be7c077d86f7a732e8 Author: Christian Lamparter Date: Sat Dec 22 15:35:38 2018 +0100 powerpc/4xx/ocm: Fix compilation error due to PAGE_KERNEL usage This patch fixes a recent compilation regression in ocm: ocm.c: In function ‘ocm_init_node’: ocm.c:182:18: error: invalid operands to binary | (have ‘int’ and ‘pgprot_t’ {aka ‘struct ’}) _PAGE_EXEC | PAGE_KERNEL_NCG); ^ ocm.c:197:17: error: invalid operands to binary | (have ‘int’ and ‘pgprot_t’ {aka ‘struct ’}) _PAGE_EXEC | PAGE_KERNEL); ^ Fixes: 56f3c1413f5c ("powerpc/mm: properly set PAGE_KERNEL flags in ioremap()") Cc: stable@vger.kernel.org # v4.20 Signed-off-by: Christian Lamparter Reviewed-by: Christophe Leroy Signed-off-by: Michael Ellerman arch/powerpc/platforms/4xx/ocm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 039daac5526932ec731e4499613018d263af8b3e Author: Diana Craciun Date: Sun Dec 23 22:34:25 2018 +0200 powerpc/fsl: Fixed warning: orphan section `__btb_flush_fixup' Fixed the following build warning: powerpc-linux-gnu-ld: warning: orphan section `__btb_flush_fixup' from `arch/powerpc/kernel/head_44x.o' being placed in section `__btb_flush_fixup'. Signed-off-by: Diana Craciun Signed-off-by: Michael Ellerman arch/powerpc/kernel/head_booke.h | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) commit f7d18ef6a95f399544d7b767291980cecddc32eb Merge: 0d9c9a238faf a007232066f6 Author: David S. Miller Date: Sat Dec 29 14:25:52 2018 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net, specifically fixes for the nf_conncount infrastructure which is causing troubles since 5c789e131cbb9 ("netfilter: nf_conncount: Add list lock and gc worker, and RCU for init tree search"). Patches aim to simplify this infrastructure while fixing up the problems: 1) Use fixed size CONNCOUNT_SLOTS in nf_conncount, from Shawn Bohrer. 2) Incorrect signedness in age calculation from find_or_evict(), from Florian Westphal. 3) Proper locking for the garbage collector workqueue callback, first make a patch to count how many nodes can be collected without holding locks, then grab lock and release them. Also from Florian. 4) Restart node lookup from the insertion path, after releasing nodes via packet path garbage collection. Shawn Bohrer described a scenario that may result in inserting a connection in an already dead list node. Patch from Florian. 5) Merge lookup and add function to avoid a hold release and re-grab. From Florian. 6) Be safe and iterate over the node lists under the spinlock. 7) Speculative list nodes removal via garbage collection, check if list node got a connection while it was scheduled for deletion via gc. 8) Accidental argument swap in find_next_bit() that leads to more frequent scheduling of the workqueue. From Florian Westphal. ==================== Signed-off-by: David S. Miller commit 195303136f192d37b89e20a8d1d2670d0d825266 Merge: 769e47094dcc 5cfc879caee8 Author: Linus Torvalds Date: Sat Dec 29 13:40:29 2018 -0800 Merge tag 'kconfig-v4.21-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kconfig file consolidation from Masahiro Yamada: "Consolidation of bus (PCI, PCMCIA, EISA, RapidIO) config entries by Christoph Hellwig. Currently, every architecture that wants to provide common peripheral busses needs to add some boilerplate code and include the right Kconfig files. This series instead just selects the presence (when needed) and then handles everything in the bus-specific Kconfig file under drivers/" * tag 'kconfig-v4.21-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: pcmcia: remove per-arch PCMCIA config entry eisa: consolidate EISA Kconfig entry in drivers/eisa rapidio: consolidate RAPIDIO config entry in drivers/rapidio pcmcia: allow PCMCIA support independent of the architecture PCI: consolidate the PCI_SYSCALL symbol PCI: consolidate the PCI_DOMAINS and PCI_DOMAINS_GENERIC config options PCI: consolidate PCI config entry in drivers/pci MIPS: remove the HT_PCI config option commit 769e47094dcc0ddc8fe8e04c13565a71134ec1a2 Merge: 668c35f69cc7 f222b7f43661 Author: Linus Torvalds Date: Sat Dec 29 13:03:29 2018 -0800 Merge tag 'kconfig-v4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kconfig updates from Masahiro Yamada: - support -y option for merge_config.sh to avoid downgrading =y to =m - remove S_OTHER symbol type, and touch include/config/*.h files correctly - fix file name and line number in lexer warnings - fix memory leak when EOF is encountered in quotation - resolve all shift/reduce conflicts of the parser - warn no new line at end of file - make 'source' statement more strict to take only string literal - rewrite the lexer and remove the keyword lookup table - convert to SPDX License Identifier - compile C files independently instead of including them from zconf.y - fix various warnings of gconfig - misc cleanups * tag 'kconfig-v4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: (39 commits) kconfig: surround dbg_sym_flags with #ifdef DEBUG to fix gconf warning kconfig: split images.c out of qconf.cc/gconf.c to fix gconf warnings kconfig: add static qualifiers to fix gconf warnings kconfig: split the lexer out of zconf.y kconfig: split some C files out of zconf.y kconfig: convert to SPDX License Identifier kconfig: remove keyword lookup table entirely kconfig: update current_pos in the second lexer kconfig: switch to ASSIGN_VAL state in the second lexer kconfig: stop associating kconf_id with yylval kconfig: refactor end token rules kconfig: stop supporting '.' and '/' in unquoted words treewide: surround Kconfig file paths with double quotes microblaze: surround string default in Kconfig with double quotes kconfig: use T_WORD instead of T_VARIABLE for variables kconfig: use specific tokens instead of T_ASSIGN for assignments kconfig: refactor scanning and parsing "option" properties kconfig: use distinct tokens for type and default properties kconfig: remove redundant token defines kconfig: rename depends_list to comment_option_list ... commit 668c35f69cc750aaf07bd5fe7710a47e2aed6e43 Merge: d8372ba8ce28 dec28d8ea2f7 Author: Linus Torvalds Date: Sat Dec 29 12:03:17 2018 -0800 Merge tag 'kbuild-v4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild updates from Masahiro Yamada: "Kbuild core: - remove unneeded $(call cc-option,...) switches - consolidate Clang compiler flags into CLANG_FLAGS - announce the deprecation of SUBDIRS - fix single target build for external module - simplify the dependencies of 'prepare' stage targets - allow fixdep to directly write to .*.cmd files - simplify dependency generation for CONFIG_TRIM_UNUSED_KSYMS - change if_changed_rule to accept multi-line recipe - move .SECONDARY special target to scripts/Kbuild.include - remove redundant 'set -e' - improve parallel execution for CONFIG_HEADERS_CHECK - misc cleanups Treewide fixes and cleanups - set Clang flags correctly for PowerPC boot images - fix UML build error with CONFIG_GCC_PLUGINS - remove unneeded patterns from .gitignore files - refactor firmware/Makefile - remove unneeded rules for *offsets.s - avoid unneeded regeneration of intermediate .s files - clean up ./Kbuild Modpost: - remove unused -M, -K options - fix false positive warnings about section mismatch - use simple devtable lookup instead of linker magic - misc cleanups Coccinelle: - relax boolinit.cocci checks for overall consistency - fix warning messages of boolinit.cocci Other tools: - improve -dirty check of scripts/setlocalversion - add a tool to generate compile_commands.json from .*.cmd files" * tag 'kbuild-v4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: (51 commits) kbuild: remove unused cmd_gentimeconst kbuild: remove $(obj)/ prefixes in ./Kbuild treewide: add intermediate .s files to targets treewide: remove explicit rules for *offsets.s firmware: refactor firmware/Makefile firmware: remove unnecessary patterns from .gitignore scripts: remove unnecessary ihex2fw and check-lc_ctypes from .gitignore um: remove unused filechk_gen_header in Makefile scripts: add a tool to produce a compile_commands.json file kbuild: add -Werror=implicit-int flag unconditionally kbuild: add -Werror=strict-prototypes flag unconditionally kbuild: add -fno-PIE flag unconditionally scripts: coccinelle: Correct warning message scripts: coccinelle: only suggest true/false in files that already use them kbuild: handle part-of-module correctly for *.ll and *.symtypes kbuild: refactor part-of-module kbuild: refactor quiet_modtag kbuild: remove redundant quiet_modtag for $(obj-m) kbuild: refactor Makefile.asm-generic user/Makefile: Fix typo and capitalization in comment section ... commit d8372ba8ce288acdfce67cb873b2a741785c2e88 Author: NeilBrown Date: Sat Dec 29 13:58:09 2018 +1100 lib: don't depend on linux headers being installed. gen_crc64table requires linux include files to be installed in /usr/include/linux. This is a new requrement so hosts that could previously build the kernel, now cannot. gen_crc64table makes this requirement by including , but nothing from that header is actaully used. So remove the #include, so that the linux headers no longer need to be installed. Fixes: feba04fd2cf8 ("lib: add crc64 calculation routines") Signed-off-by: NeilBrown Acked-by: Coly Li Signed-off-by: Linus Torvalds lib/gen_crc64table.c | 2 -- 1 file changed, 2 deletions(-) commit 3868772b99e3146d02cf47e739d79022eba1d77c Merge: 6f9d71c9c759 942104a21ce4 Author: Linus Torvalds Date: Sat Dec 29 11:21:49 2018 -0800 Merge tag 'docs-5.0' of git://git.lwn.net/linux Pull documentation update from Jonathan Corbet: "A fairly normal cycle for documentation stuff. We have a new document on perf security, more Italian translations, more improvements to the memory-management docs, improvements to the pathname lookup documentation, and the usual array of smaller fixes. As is often the case, there are a few reaches outside of Documentation/ to adjust kerneldoc comments" * tag 'docs-5.0' of git://git.lwn.net/linux: (38 commits) docs: improve pathname-lookup document structure configfs: fix wrong name of struct in documentation docs/mm-api: link slab_common.c to "The Slab Cache" section slab: make kmem_cache_create{_usercopy} description proper kernel-doc doc:process: add links where missing docs/core-api: make mm-api.rst more structured x86, boot: documentation whitespace fixup Documentation: devres: note checking needs when converting doc:it: add some process/* translations doc:it: fixes in process/1.Intro Documentation: convert path-lookup from markdown to resturctured text Documentation/admin-guide: update admin-guide index.rst Documentation/admin-guide: introduce perf-security.rst file scripts/kernel-doc: Fix struct and struct field attribute processing Documentation: dev-tools: Fix typos in index.rst Correct gen_init_cpio tool's documentation Document /proc/pid PID reuse behavior Documentation: update path-lookup.md for parallel lookups Documentation: Use "while" instead of "whilst" dmaengine: Add mailing list address to the documentation ... commit 6f9d71c9c759b1e7d31189a4de228983192c7dc7 Merge: 55db91fbaad9 3fc9c12d27b4 Author: Linus Torvalds Date: Sat Dec 29 10:57:20 2018 -0800 Merge branch 'for-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup updates from Tejun Heo: - Waiman's cgroup2 cpuset support has been finally merged closing one of the last remaining feature gaps. - cgroup.procs could show non-leader threads when cgroup2 threaded mode was used in certain ways. I forgot to push the fix during the last cycle. - A patch to fix mount option parsing when all mount options have been consumed by someone else (LSM). - cgroup_no_v1 boot param can now block named cgroup1 hierarchies too. * 'for-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup: Add named hierarchy disabling to cgroup_no_v1 boot param cgroup: fix parsing empty mount option string cpuset: Remove set but not used variable 'cs' cgroup: fix CSS_TASK_ITER_PROCS cgroup: Add .__DEBUG__. prefix to debug file names cpuset: Minor cgroup2 interface updates cpuset: Expose cpuset.cpus.subpartitions with cgroup_debug cpuset: Add documentation about the new "cpuset.sched.partition" flag cpuset: Use descriptive text when reading/writing cpuset.sched.partition cpuset: Expose cpus.effective and mems.effective on cgroup v2 root cpuset: Make generate_sched_domains() work with partition cpuset: Make CPU hotplug work with partition cpuset: Track cpusets that use parent's effective_cpus cpuset: Add an error state to cpuset.sched.partition cpuset: Add new v2 cpuset.sched.partition flag cpuset: Simply allocation and freeing of cpumasks cpuset: Define data structures to support scheduling partition cpuset: Enable cpuset controller in default hierarchy cgroup: remove unnecessary unlikely() commit 90be9b86da9039fe6cf2880dc16fd0b0899603a5 Author: Julia Lawall Date: Sun Dec 23 14:52:12 2018 -0800 xfs: xfs_fsops: drop useless LIST_HEAD Drop LIST_HEAD where the variable it declares is never used. Commit 0410c3bb2b88 ("xfs: factor ag btree root block initialisation") stopped using buffer_list and started using a buffer list in an aghdr_init_data structure, but the declaration of buffer_list was not removed. The semantic patch that fixes this problem is as follows: (http://coccinelle.lip6.fr/) // @@ identifier x; @@ - LIST_HEAD(x); ... when != x // Fixes: 0410c3bb2b88 ("xfs: factor ag btree root block initialisation") Signed-off-by: Julia Lawall Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/xfs_fsops.c | 1 - 1 file changed, 1 deletion(-) commit 89be677b6b39f7be4533fea3281d49ff3e3af835 Author: Julia Lawall Date: Sun Dec 23 14:52:11 2018 -0800 xfs: xfs_buf: drop useless LIST_HEAD Drop LIST_HEAD where the variable it declares has never been used. The semantic patch that fixes this problem is as follows: (http://coccinelle.lip6.fr/) // @@ identifier x; @@ - LIST_HEAD(x); ... when != x // Fixes: 26f1fe858f274 ("xfs: reduce lock hold times in buffer writeback") Signed-off-by: Julia Lawall Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/xfs_buf.c | 1 - 1 file changed, 1 deletion(-) commit 55db91fbaad9ea769d516e6867195808b4399894 Merge: 9ef10340749e 6ab7d47bcbf0 Author: Linus Torvalds Date: Sat Dec 29 10:13:23 2018 -0800 Merge branch 'for-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/dennis/percpu Pull percpu update from Dennis Zhou: "Michael Cree noted generic UP Alpha has been broken since v3.18. This is a small fix for locking in UP percpu code that fixes the issue" * 'for-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/dennis/percpu: percpu: convert spin_lock_irq to spin_lock_irqsave. commit 9ef10340749e1da0c7fde609cedd5360f8484a0b Merge: 889bb74302e5 64711f9a47d4 Author: Linus Torvalds Date: Sat Dec 29 09:40:40 2018 -0800 Merge tag 'xtensa-20181228' of git://github.com/jcmvbkbc/linux-xtensa Pull Xtensa updates from Max Filippov: - switch to generated syscall table - switch ptrace to regsets, use regsets for core dumps - complete tracehook implementation - add syscall tracepoints support - add jumplabels support - add memtest support - drop unused/duplicated code from entry.S, ptrace.c, coprocessor.S, elf.h and syscall.h - clean up warnings caused by WSR/RSR macros - clean up DTC warnings about SPI controller node names in xtfpga.dtsi - simplify coprocessor.S - get rid of explicit 'l32r' instruction usage in assembly * tag 'xtensa-20181228' of git://github.com/jcmvbkbc/linux-xtensa: (25 commits) xtensa: implement jump_label support xtensa: implement syscall tracepoints xtensa: implement tracehook functions and enable HAVE_ARCH_TRACEHOOK xtensa: enable CORE_DUMP_USE_REGSET xtensa: implement TIE regset xtensa: implement task_user_regset_view xtensa: call do_syscall_trace_{enter,leave} selectively xtensa: use NO_SYSCALL instead of -1 xtensa: define syscall_get_arch() Move EM_XTENSA to uapi/linux/elf-em.h xtensa: support memtest xtensa: don't use l32r opcode directly xtensa: xtfpga.dtsi: fix dtc warnings about SPI xtensa: don't clear cpenable unconditionally on release xtensa: simplify coprocessor.S xtensa: clean up WSR*/RSR*/get_sr/set_sr xtensa: drop unused declarations from elf.h xtensa: clean up syscall.h xtensa: drop unused coprocessor helper functions xtensa: drop custom PTRACE_{PEEK,POKE}{TEXT,DATA} ... commit 889bb74302e5aba85d987b4093344150984d7cda Merge: 903b77c63167 e2f3f8b4a497 Author: Linus Torvalds Date: Sat Dec 29 09:37:03 2018 -0800 Merge tag 'nds32-for-linus-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/greentime/linux Pull nds32 updates from Greentime Hu: - Perf support - Power management support - FPU support - Hardware prefetcher support - Build error fixed - Performance enhancement * tag 'nds32-for-linus-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/greentime/linux: nds32: support hardware prefetcher nds32: Fix the items of hwcap_str ordering issue. math-emu/soft-fp.h: (_FP_ROUND_ZERO) cast 0 to void to fix warning math-emu/op-2.h: Use statement expressions to prevent negative constant shift nds32: support denormalized result through FP emulator nds32: Support FP emulation nds32: nds32 FPU port nds32: Remove duplicated include from pm.c nds32: Power management for nds32 nds32: Add document for NDS32 PMU. nds32: Add perf call-graph support. nds32: Perf porting nds32: Fix bug in bitfield.h nds32: Fix gcc 8.0 compiler option incompatible. nds32: Fill all TLB entries with kernel image mapping nds32: Remove the redundant assignment commit 093c48213ee37c3c3ff1cf5ac1aa2a9d8bc66017 Author: Wenwen Wang Date: Wed Dec 26 20:15:13 2018 -0600 gdrom: fix a memory leak bug In probe_gdrom(), the buffer pointed by 'gd.cd_info' is allocated through kzalloc() and is used to hold the information of the gdrom device. To register and unregister the device, the pointer 'gd.cd_info' is passed to the functions register_cdrom() and unregister_cdrom(), respectively. However, this buffer is not freed after it is used, which can cause a memory leak bug. This patch simply frees the buffer 'gd.cd_info' in exit_gdrom() to fix the above issue. Signed-off-by: Wenwen Wang Signed-off-by: Jens Axboe drivers/cdrom/gdrom.c | 1 + 1 file changed, 1 insertion(+) commit 0d9c9a238faf925823bde866182c663b6d734f2e Author: Scott Wood Date: Thu Dec 27 18:29:09 2018 -0600 fsl/fman: Use GFP_ATOMIC in {memac,tgec}_add_hash_mac_address() These functions are called from atomic context: [ 9.150239] BUG: sleeping function called from invalid context at /home/scott/git/linux/mm/slab.h:421 [ 9.158159] in_atomic(): 1, irqs_disabled(): 0, pid: 4432, name: ip [ 9.163128] CPU: 8 PID: 4432 Comm: ip Not tainted 4.20.0-rc2-00169-g63d86876f324 #29 [ 9.163130] Call Trace: [ 9.170701] [c0000002e899a980] [c0000000009c1068] .dump_stack+0xa8/0xec (unreliable) [ 9.177140] [c0000002e899aa10] [c00000000007a7b4] .___might_sleep+0x138/0x164 [ 9.184440] [c0000002e899aa80] [c0000000001d5bac] .kmem_cache_alloc_trace+0x238/0x30c [ 9.191216] [c0000002e899ab40] [c00000000065ea1c] .memac_add_hash_mac_address+0x104/0x198 [ 9.199464] [c0000002e899abd0] [c00000000065a788] .set_multi+0x1c8/0x218 [ 9.206242] [c0000002e899ac80] [c0000000006615ec] .dpaa_set_rx_mode+0xdc/0x17c [ 9.213544] [c0000002e899ad00] [c00000000083d2b0] .__dev_set_rx_mode+0x80/0xd4 [ 9.219535] [c0000002e899ad90] [c00000000083d334] .dev_set_rx_mode+0x30/0x54 [ 9.225271] [c0000002e899ae10] [c00000000083d4a0] .__dev_open+0x148/0x1c8 [ 9.230751] [c0000002e899aeb0] [c00000000083d934] .__dev_change_flags+0x19c/0x1e0 [ 9.230755] [c0000002e899af60] [c00000000083d9a4] .dev_change_flags+0x2c/0x80 [ 9.242752] [c0000002e899aff0] [c0000000008554ec] .do_setlink+0x350/0xf08 [ 9.248228] [c0000002e899b170] [c000000000857ad0] .rtnl_newlink+0x588/0x7e0 [ 9.253965] [c0000002e899b740] [c000000000852424] .rtnetlink_rcv_msg+0x3e0/0x498 [ 9.261440] [c0000002e899b820] [c000000000884790] .netlink_rcv_skb+0x134/0x14c [ 9.267607] [c0000002e899b8e0] [c000000000851840] .rtnetlink_rcv+0x18/0x2c [ 9.274558] [c0000002e899b950] [c000000000883c8c] .netlink_unicast+0x214/0x318 [ 9.281163] [c0000002e899ba00] [c000000000884220] .netlink_sendmsg+0x348/0x444 [ 9.287076] [c0000002e899bae0] [c00000000080d13c] .sock_sendmsg+0x2c/0x54 [ 9.287080] [c0000002e899bb50] [c0000000008106c0] .___sys_sendmsg+0x2d0/0x2d8 [ 9.298375] [c0000002e899bd30] [c000000000811a80] .__sys_sendmsg+0x5c/0xb0 [ 9.303939] [c0000002e899be20] [c0000000000006b0] system_call+0x60/0x6c Signed-off-by: Scott Wood Signed-off-by: David S. Miller drivers/net/ethernet/freescale/fman/fman_memac.c | 2 +- drivers/net/ethernet/freescale/fman/fman_tgec.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 7418e6520f22a2e35815122fa5a53d5bbfa2c10f Author: Jia-Ju Bai Date: Wed Dec 26 22:09:34 2018 +0800 isdn: hisax: hfc_pci: Fix a possible concurrency use-after-free bug in HFCPCI_l1hw() In drivers/isdn/hisax/hfc_pci.c, the functions hfcpci_interrupt() and HFCPCI_l1hw() may be concurrently executed. HFCPCI_l1hw() line 1173: if (!cs->tx_skb) hfcpci_interrupt() line 942: spin_lock_irqsave(); line 1066: dev_kfree_skb_irq(cs->tx_skb); Thus, a possible concurrency use-after-free bug may occur in HFCPCI_l1hw(). To fix these bugs, the calls to spin_lock_irqsave() and spin_unlock_irqrestore() are added in HFCPCI_l1hw(), to protect the access to cs->tx_skb. Signed-off-by: Jia-Ju Bai Signed-off-by: David S. Miller drivers/isdn/hisax/hfc_pci.c | 2 ++ 1 file changed, 2 insertions(+) commit 903b77c631673eeec9e9114e9524171cdf9a2646 Merge: 457fa3469a65 283ac6d5fb2a Author: Linus Torvalds Date: Fri Dec 28 21:27:13 2018 -0800 Merge tag 'linux-kselftest-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull Kselftest updates from Shuah Khan: - fixes and improvements to the framework, and individual tests - a new media test for IR encoders from Sean Young - a new watchdog test option to find time left on a timer * tag 'linux-kselftest-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests: Fix test errors related to lib.mk khdr target fix dma-buf/udmabuf selftest selftests: watchdog: fix spelling mistake "experies" -> "expires" selftests: watchdog: Add gettimeleft command line arg selftests: do not macro-expand failed assertion expressions selftests/ftrace: Fix invalid SPDX identifiers selftests: gpio: Find libmount with pkg-config if available selftests: firmware: add CONFIG_FW_LOADER_USER_HELPER_FALLBACK to config selftests: firmware: remove use of non-standard diff -Z option media: rc: self test for IR encoders and decoders commit f9fc54d313fab2834f44f516459cdc8ac91d797f Author: Yunsheng Lin Date: Wed Dec 26 19:51:46 2018 +0800 ethtool: check the return value of get_regs_len The return type for get_regs_len in struct ethtool_ops is int, the hns3 driver may return error when failing to get the regs len by sending cmd to firmware. Signed-off-by: Yunsheng Lin Signed-off-by: David S. Miller net/core/ethtool.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) commit 457fa3469a65a524be04412f5cd497fa3b11c9fd Merge: b07039b79c9e fbc4904c2877 Author: Linus Torvalds Date: Fri Dec 28 20:54:57 2018 -0800 Merge tag 'char-misc-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver updates from Greg KH: "Here is the big set of char and misc driver patches for 4.21-rc1. Lots of different types of driver things in here, as this tree seems to be the "collection of various driver subsystems not big enough to have their own git tree" lately. Anyway, some highlights of the changes in here: - binderfs: is it a rule that all driver subsystems will eventually grow to have their own filesystem? Binder now has one to handle the use of it in containerized systems. This was discussed at the Plumbers conference a few months ago and knocked into mergable shape very fast by Christian Brauner. Who also has signed up to be another binder maintainer, showing a distinct lack of good judgement :) - binder updates and fixes - mei driver updates - fpga driver updates and additions - thunderbolt driver updates - soundwire driver updates - extcon driver updates - nvmem driver updates - hyper-v driver updates - coresight driver updates - pvpanic driver additions and reworking for more device support - lp driver updates. Yes really, it's _finally_ moved to the proper parallal port driver model, something I never thought I would see happen. Good stuff. - other tiny driver updates and fixes. All of these have been in linux-next for a while with no reported issues" * tag 'char-misc-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (116 commits) MAINTAINERS: add another Android binder maintainer intel_th: msu: Fix an off-by-one in attribute store stm class: Add a reference to the SyS-T document stm class: Fix a module refcount leak in policy creation error path char: lp: use new parport device model char: lp: properly count the lp devices char: lp: use first unused lp number while registering char: lp: detach the device when parallel port is removed char: lp: introduce list to save port number bus: qcom: remove duplicated include from qcom-ebi2.c VMCI: Use memdup_user() rather than duplicating its implementation char/rtc: Use of_node_name_eq for node name comparisons misc: mic: fix a DMA pool free failure ptp: fix an IS_ERR() vs NULL check genwqe: Fix size check binder: implement binderfs binder: fix use-after-free due to ksys_close() during fdget() bus: fsl-mc: remove duplicated include files bus: fsl-mc: explicitly define the fsl_mc_command endianness misc: ti-st: make array read_ver_cmd static, shrinks object size ... commit b07039b79c9ea64c1eacda1e01d645082e4a0d5d Merge: 02061181d3a9 16df1456aa85 Author: Linus Torvalds Date: Fri Dec 28 20:44:29 2018 -0800 Merge tag 'driver-core-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core updates from Greg KH: "Here is the "big" set of driver core patches for 4.21-rc1. It's not really big, just a number of small changes for some reported issues, some documentation updates to hopefully make it harder for people to abuse the driver model, and some other minor cleanups. All of these have been in linux-next for a while with no reported issues" * tag 'driver-core-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: mm, memory_hotplug: update a comment in unregister_memory() component: convert to DEFINE_SHOW_ATTRIBUTE sysfs: Disable lockdep for driver bind/unbind files driver core: Add missing dev->bus->need_parent_lock checks kobject: return error code if writing /sys/.../uevent fails driver core: Move async_synchronize_full call driver core: platform: Respect return code of platform_device_register_full() kref/kobject: Improve documentation drivers/base/memory.c: Use DEVICE_ATTR_RO and friends driver core: Replace simple_strto{l,ul} by kstrtou{l,ul} kernfs: Improve kernfs_notify() poll notification latency kobject: Fix warnings in lib/kobject_uevent.c kobject: drop unnecessary cast "%llu" for u64 driver core: fix comments for device_block_probing() driver core: Replace simple_strtol by kstrtoint commit 02061181d3a9ccfe15ef6bc15fa56283acc47620 Merge: 117eda8f71ff 215852f4b8bb Author: Linus Torvalds Date: Fri Dec 28 20:39:58 2018 -0800 Merge tag 'staging-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging/IIO driver updates from Greg KH: "Here is the big staging and iio driver pull request for 4.21-rc1. Lots and lots of tiny patches here, nothing major at all. Which is good, tiny cleanups is nice to see. No new huge driver removal or addition, this release cycle, although there are lots of good IIO driver changes, addtions, and movement from staging into the "real" part of the kernel, which is always great. Full details are in the shortlog, and all of these have been in linux-next for a while with no reported issues" * tag 'staging-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (553 commits) staging: mt7621-mmc: Correct spelling mistakes in comments staging: wilc1000: fix missing read_write setting when reading data mt7621-mmc: char * array declaration might be better as static const mt7621-mmc: return statement in void function unnecessary mt7621-mmc: Alignment should match open parenthesis mt7621-mmc: Removed unnecessary blank lines mt7621-mmc: Fix some coding style issues staging: android: ashmem: doc: Fix spelling staging: rtl8188eu: cleanup brace coding style issues staging: rtl8188eu: add spaces around '&' in rtw_mlme_ext.c staging: rtl8188eu: change return type of is_basicrate() to bool staging: rtl8188eu: simplify null array initializations staging: rtl8188eu: change order of declarations to improve readability staging: rtl8188eu: make some arrays static in rtw_mlme_ext.c staging: rtl8188eu: constify some arrays staging: rtl8188eu: convert unsigned char arrays to u8 staging: rtl8188eu: remove redundant declaration in rtw_mlme_ext.c staging: rtl8188eu: remove unused arrays WFD_OUI and WMM_INFO_OUI staging: rtl8188eu: remove unnecessary parentheses in rtw_mlme_ext.c staging: rtl8188eu: remove unnecessary comments in rtw_mlme_ext.c ... commit 117eda8f71ff545cfdec8fe8073adbd173a1ceff Merge: c0ea81b4d378 598134ffcab5 Author: Linus Torvalds Date: Fri Dec 28 20:33:54 2018 -0800 Merge tag 'tty-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial driver updates from Greg KH: "Here is the large TTY/Serial driver set of patches for 4.21-rc1. A number of small serial driver changes along with some good tty core fixes for long-reported issues with locking. There is also a new console font added to the tree, for high-res screens, so that should be helpful for many. The last patch in the series is a revert of an older one in the tree, it came late but it resolves a reported issue that linux-next was having for some people. Full details are in the shortlog, and all of these, with the exception of the revert, have been in linux-next for a while with no reported issues" * tag 'tty-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (85 commits) Revert "serial: 8250: Default SERIAL_OF_PLATFORM to SERIAL_8250" serial: sccnxp: Allow to use non-standard baud rates serial: sccnxp: Adds a delay between sequential read/write cycles tty: serial: qcom_geni_serial: Fix UART hang tty: serial: qcom_geni_serial: Fix wrap around of TX buffer serial: max310x: Fix tx_empty() callback dt-bindings: serial: sh-sci: Document r8a774c0 bindings dt-bindings: serial: sh-sci: Document r8a774a1 bindings Fonts: New Terminus large console font dt-bindings: serial: lpuart: add imx8qxp compatible string serial: uartps: Fix interrupt mask issue to handle the RX interrupts properly serial: uartps: Fix error path when alloc failed serial: uartps: Check if the device is a console serial: uartps: Add the device_init_wakeup tty: serial: samsung: Increase maximum baudrate tty: serial: samsung: Properly set flags in autoCTS mode tty: Use of_node_name_{eq,prefix} for node name comparisons tty/serial: do not free trasnmit buffer page under port lock serial: 8250: Rate limit serial port rx interrupts during input overruns dt-bindings: serial: 8250: Add rate limit for serial port input overruns ... commit c0ea81b4d37837409d0dfd2036098a7babb312ed Merge: 4d6ad6fba6b7 4b2c01ad902e Author: Linus Torvalds Date: Fri Dec 28 20:30:00 2018 -0800 Merge tag 'usb-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB/PHY updates from Greg KH: "Here is the big set of USB and PHY driver patches for 4.21-rc1. All of the usual bits are in here: - loads of USB gadget driver updates and additions - new device ids - phy driver updates - xhci reworks and new features - typec updates Full details are in the shortlog. All of these have been in linux-next for a long time with no reported issues" * tag 'usb-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (142 commits) USB: serial: option: add Fibocom NL678 series cdc-acm: fix abnormal DATA RX issue for Mediatek Preloader. usb: r8a66597: Fix a possible concurrency use-after-free bug in r8a66597_endpoint_disable() usb: typec: tcpm: Extend the matching rules on PPS APDO selection usb: typec: Improve Alt Mode documentation usb: musb: dsps: fix runtime pm for peripheral mode usb: musb: dsps: fix otg state machine USB: serial: pl2303: add ids for Hewlett-Packard HP POS pole displays usb: renesas_usbhs: add support for RZ/G2E usb: ehci-omap: Fix deferred probe for phy handling usb: roles: Add a description for the class to Kconfig usb: renesas_usbhs: mark PM functions as __maybe_unused usb: core: Remove unnecessary memset() usb: host: isp1362-hcd: convert to DEFINE_SHOW_ATTRIBUTE phy: qcom-qmp: Expose provided clocks to DT dt-bindings: phy-qcom-qmp: Move #clock-cells to child phy: qcom-qmp: Utilize fully-specified DT registers dt-bindings: phy-qcom-qmp: Fix register underspecification phy: ti: fix semicolon.cocci warnings phy: dphy: Add configuration helpers ... commit 4d6ad6fba6b7af06143c67964f4095c74c9ce87c Merge: 579a70035949 3a658e09a215 Author: Linus Torvalds Date: Fri Dec 28 20:28:25 2018 -0800 Merge tag 'hsi-for-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi Pull HSI update from Sebastian Reichel: "omap-ssi: use DEFINE_SHOW_ATTRIBUTE" * tag 'hsi-for-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi: HSI: omap_ssi: Change to use DEFINE_SHOW_ATTRIBUTE macro commit 579a70035949b771a63a686db8becdd9b197d986 Merge: 030672aea826 958091396648 Author: Linus Torvalds Date: Fri Dec 28 20:22:45 2018 -0800 Merge tag 'for-v4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull power supply and reset updates from Sebastian Reichel: - New core support: - battery internal resistance - battery OCV capacity lookup table - support for custom sysfs attributes - Convert all drivers to use power-supply core support for custom sysfs attributes - bq24190-charger: bq24196 support - axp20x-charger: AXP813 support - sc27xx-battery: new fuel gauge driver - gpio-poweroff: support for specific active and inactive delays - Misc fixes * tag 'for-v4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: (53 commits) power: supply: bq25890: fix BAT_COMP field definition power: supply: gpio-charger: Do not use deprecated POWER_SUPPLY_TYPE_USB_* power: supply: ds2781: switch to devm_power_supply_register power: supply: ds2780: switch to devm_power_supply_register power: supply: ds2781: fix race-condition in bin attribute registration power: supply: ds2780: fix race-condition in bin attribute registration power: supply: pcf50633: fix race-condition in sysfs registration power: supply: charger-manager: fix race-condition in sysfs registration power: supply: charger-manager: simplify generation of sysfs attribute group name power: supply: bq24257: fix race-condition in sysfs registration power: supply: bq24190_charger: fix race-condition in sysfs registration power: supply: lp8788: fix race-condition in sysfs registration power: supply: ds2781: fix race-condition in sysfs registration power: supply: ds2780: fix race-condition in sysfs registration power: supply: bq2415x: fix race-condition in sysfs registration power: supply: core: add support for custom sysfs attributes power: supply: sc27xx: Save last battery capacity power: reset: at91-poweroff: move shdwc related data to one structure power: supply: sc27xx: Add suspend/resume interfaces power: supply: sc27xx: Add fuel gauge low voltage alarm ... commit 030672aea826adf3dee9100ee8ac303b62c8fe7f Merge: 24dc83635ffe 5801169a2ed2 Author: Linus Torvalds Date: Fri Dec 28 20:08:34 2018 -0800 Merge tag 'devicetree-for-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull Devicetree updates from Rob Herring: "The biggest highlight here is the start of using json-schema for DT bindings. Being able to validate bindings has been discussed for years with little progress. - Initial support for DT bindings using json-schema language. This is the start of converting DT bindings from free-form text to a structured format. - Reworking of initrd address initialization. This moves to using the phys address instead of virt addr in the DT parsing code. This rework was motivated by CONFIG_DEV_BLK_INITRD causing unnecessary rebuilding of lots of files. - Fix stale phandle entries in phandle cache - DT overlay validation improvements. This exposed several memory leak bugs which have been fixed. - Use node name and device_type helper functions in DT code - Last remaining conversions to using %pOFn printk specifier instead of device_node.name directly - Create new common RTC binding doc and move all trivial RTC devices out of trivial-devices.txt. - New bindings for Freescale MAG3110 magnetometer, Cadence Sierra PHY, and Xen shared memory - Update dtc to upstream version v1.4.7-57-gf267e674d145" * tag 'devicetree-for-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (68 commits) of: __of_detach_node() - remove node from phandle cache of: of_node_get()/of_node_put() nodes held in phandle cache gpio-omap.txt: add reg and interrupts properties dt-bindings: mrvl,intc: fix a trivial typo dt-bindings: iio: magnetometer: add dt-bindings for freescale mag3110 dt-bindings: Convert trivial-devices.txt to json-schema dt-bindings: arm: mrvl: amend Browstone compatible string dt-bindings: arm: Convert Tegra board/soc bindings to json-schema dt-bindings: arm: Convert ZTE board/soc bindings to json-schema dt-bindings: arm: Add missing Xilinx boards dt-bindings: arm: Convert Xilinx board/soc bindings to json-schema dt-bindings: arm: Convert VIA board/soc bindings to json-schema dt-bindings: arm: Convert ST STi board/soc bindings to json-schema dt-bindings: arm: Convert SPEAr board/soc bindings to json-schema dt-bindings: arm: Convert CSR SiRF board/soc bindings to json-schema dt-bindings: arm: Convert QCom board/soc bindings to json-schema dt-bindings: arm: Convert TI nspire board/soc bindings to json-schema dt-bindings: arm: Convert TI davinci board/soc bindings to json-schema dt-bindings: arm: Convert Calxeda board/soc bindings to json-schema dt-bindings: arm: Convert Altera board/soc bindings to json-schema ... commit 24dc83635ffe3c93d8122099a83ee228c9b7e4f7 Merge: 7e59fad9c9d1 a7c23f8d154f Author: Linus Torvalds Date: Fri Dec 28 20:00:21 2018 -0800 Merge tag 'gpio-v4.21-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO updates from Linus Walleij: "This is the bulk of GPIO changes for the v4.21 kernel series. Core changes: - Some core changes are already in outside of this pull request as they came through the regulator tree, most notably devm_gpiod_unhinge() that removes devres refcount management from a GPIO descriptor. This is needed in subsystems such as regulators where the regulator core need to take over the reference counting and lifecycle management for a GPIO descriptor. - We dropped devm_gpiochip_remove() and devm_gpio_chip_match() as nothing needs it. We can bring it back if need be. - Add a global TODO so people see where we are going. This helps setting the direction now that we are two GPIO maintainers. - Handle the MMC CD/WP properties in the device tree core. (The bulk of patches activating this code is already merged through the MMC/SD tree.) - Augment gpiochip_request_own_desc() to pass a flag so we as gpiochips can request lines as active low or open drain etc even from ourselves. New drivers: - New driver for Cadence GPIO blocks. - New driver for Atmel SAMA5D2 PIOBU GPIO lines. Driver improvements: - A major refactoring of the PCA953x driver - this driver has been around for ages, and is now modernized to reduce code duplication that has stacked up and is using regmap to read write and cache registers. - Intel drivers are now maintained in a separate tree and start with a round of cleanups and unifications" * tag 'gpio-v4.21-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: (99 commits) gpio: sama5d2-piobu: Depend on OF_GPIO gpio: Add Cadence GPIO driver dt-bindings: gpio: Add bindings for Cadence GPIO gpiolib-acpi: remove unused variable 'err', cleans up build warning gpio: mxs: read pin level directly instead of using .get gpio: aspeed: remove duplicated statement gpio: add driver for SAMA5D2 PIOBU pins dt-bindings: arm: atmel: describe SECUMOD usage as a GPIO controller gpio/mmc/of: Respect polarity in the device tree dt-bindings: gpio: rcar: Add r8a774c0 (RZ/G2E) support memory: omap-gpmc: Get the header of the enum ARM: omap1: Fix new user of gpiochip_request_own_desc() gpio: pca953x: Add regmap dependency for PCA953x driver gpio: raspberrypi-exp: decrease refcount on firmware dt node gpiolib: Fix return value of gpio_to_desc() stub if !GPIOLIB gpio: pca953x: Restore registers after suspend/resume cycle gpio: pca953x: Zap single use of pca953x_read_single() gpio: pca953x: Zap ad-hoc reg_output cache gpio: pca953x: Zap ad-hoc reg_direction cache gpio: pca953x: Perform basic regmap conversion ... commit 7e59fad9c9d1aeacdc96dfffd35f9e12ddc34dbf Merge: 8754040378e4 221b35fedee1 Author: Linus Torvalds Date: Fri Dec 28 19:57:29 2018 -0800 Merge tag 'drm-next-2018-12-27' of git://anongit.freedesktop.org/drm/drm Pull more drm updates from Dave Airlie: "Daniel collected a couple of pulls after I want on holidays, back for a couple of days, so may as well send them out. This has exynos and etnaviv work for 4.21. exynos: - plane alpha and blending configurability etnaviv: - mostly cleanups in prep for new features" * tag 'drm-next-2018-12-27' of git://anongit.freedesktop.org/drm/drm: drm/etnaviv: remove lastctx member from gpu struct drm/etnaviv: replace header include with forward declaration drm/etnaviv: remove unnecessary local irq disable drm/exynos: fimd: Make pixel blend mode configurable drm/exynos: fimd: Make plane alpha configurable drm/etnaviv: Replace drm_dev_unref with drm_dev_put drm/etnaviv: consolidate hardware fence handling in etnaviv_gpu drm/etnaviv: kill active fence tracking commit 8754040378e4ff70b3bb96b1dabac62da5dfb870 Merge: 1984f65c2fbc 9aa3aa15f4c2 Author: Linus Torvalds Date: Fri Dec 28 19:48:25 2018 -0800 Merge tag 'hwmon-for-v4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon updates from Guenter Roeck: "The big change in this series is for the most part automatic: Introducing SENSOR[_DEVICE]_ATTR_{RO,RW,WO} variants and conversion of various drivers to use it. This is similar to DEVICE_ATTR variants. Other than that, we have - Some conversions of S_ with octal values, also automated - Added support for Hygon Dhyana CPUs to k10temp driver - Added support for STLM75 to lm75 driver - B57891S0103 to ntc_thermistor - Added pm-runtime support to ina3221 driver - Support for PowerPC On-Chip Controller (OCC) - Various minor bug fices and improvements" * tag 'hwmon-for-v4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (80 commits) hwmon: (lm80) fix a missing check of bus read in lm80 probe hwmon: (lm80) fix a missing check of the status of SMBus read hwmon: (asus_atk0110) Fix debugfs_simple_attr.cocci warnings hwmon: (ftsteutates) Use permission specific SENSOR[_DEVICE]_ATTR variants hwmon: (fschmd) Use permission specific SENSOR[_DEVICE]_ATTR variants hwmon: (emc6w201) Use permission specific SENSOR[_DEVICE]_ATTR variants hwmon: (emc2103) Use permission specific SENSOR[_DEVICE]_ATTR variants hwmon: (emc1403) Use permission specific SENSOR[_DEVICE]_ATTR variants hwmon: (ds620) Use permission specific SENSOR[_DEVICE]_ATTR variants hwmon: (ds1621) Use permission specific SENSOR[_DEVICE]_ATTR variants hwmon: (dell-smm-hwmon) Use permission specific SENSOR[_DEVICE]_ATTR variants hwmon: (da9055-hwmon) Use permission specific SENSOR[_DEVICE]_ATTR variants hwmon: (da9052-hwmon) Use permission specific SENSOR[_DEVICE]_ATTR variants hwmon: (coretemp) Replace S_ with octal values hwmon: (asus_atk0110) Replace S_ with octal values hwmon: (aspeed-pwm-tacho) Use permission specific SENSOR[_DEVICE]_ATTR variants hwmon: (applesmc) Replace S_ with octal values hwmon: (amc6821) Use permission specific SENSOR[_DEVICE]_ATTR variants hwmon: (adt7x10) Use permission specific SENSOR[_DEVICE]_ATTR variants hwmon: (adt7475) Use permission specific SENSOR[_DEVICE]_ATTR variants ... commit 1984f65c2fbc0d2b557d6e89ece9b39267e215c6 Merge: f346b0becb1b 8ba35b3a0046 Author: Linus Torvalds Date: Fri Dec 28 19:41:58 2018 -0800 Merge tag 'vfio-v4.21-rc1' of git://github.com/awilliam/linux-vfio Pull VFIO updates from Alex Williamson: - Replace global vfio-pci lock with per bus lock to allow concurrent open and release (Alex Williamson) - Declare mdev function as static (Paolo Cretaro) - Convert char to u8 in mdev/mtty sample driver (Nathan Chancellor) * tag 'vfio-v4.21-rc1' of git://github.com/awilliam/linux-vfio: vfio-mdev/samples: Use u8 instead of char for handle functions vfio/mdev: add static modifier to add_mdev_supported_type vfio/pci: Parallelize device open and release commit a007232066f6839d6f256bab21e825d968f1a163 Author: Florian Westphal Date: Fri Dec 28 01:24:49 2018 +0100 netfilter: nf_conncount: fix argument order to find_next_bit Size and 'next bit' were swapped, this bug could cause worker to reschedule itself even if system was idle. Fixes: 5c789e131cbb9 ("netfilter: nf_conncount: Add list lock and gc worker, and RCU for init tree search") Reviewed-by: Shawn Bohrer Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_conncount.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c80f10bc973af2ace6b1414724eeff61eaa71837 Author: Pablo Neira Ayuso Date: Fri Dec 28 01:24:48 2018 +0100 netfilter: nf_conncount: speculative garbage collection on empty lists Instead of removing a empty list node that might be reintroduced soon thereafter, tentatively place the empty list node on the list passed to tree_nodes_free(), then re-check if the list is empty again before erasing it from the tree. [ Florian: rebase on top of pending nf_conncount fixes ] Fixes: 5c789e131cbb9 ("netfilter: nf_conncount: Add list lock and gc worker, and RCU for init tree search") Reviewed-by: Shawn Bohrer Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso include/net/netfilter/nf_conntrack_count.h | 1 - net/netfilter/nf_conncount.c | 47 ++++++++++-------------------- 2 files changed, 15 insertions(+), 33 deletions(-) commit 2f971a8f425545da52ca0e6bee81f5b1ea0ccc5f Author: Pablo Neira Ayuso Date: Fri Dec 28 01:24:47 2018 +0100 netfilter: nf_conncount: move all list iterations under spinlock Two CPUs may race to remove a connection from the list, the existing conn->dead will result in a use-after-free. Use the per-list spinlock to protect list iterations. As all accesses to the list now happen while holding the per-list lock, we no longer need to delay free operations with rcu. Joint work with Florian. Fixes: 5c789e131cbb9 ("netfilter: nf_conncount: Add list lock and gc worker, and RCU for init tree search") Reviewed-by: Shawn Bohrer Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_conncount.c | 46 +++++++++++++++++++------------------------- 1 file changed, 20 insertions(+), 26 deletions(-) commit df4a902509766897f7371fdfa4c3bf8bc321b55d Author: Florian Westphal Date: Fri Dec 28 01:24:46 2018 +0100 netfilter: nf_conncount: merge lookup and add functions 'lookup' is always followed by 'add'. Merge both and make the list-walk part of nf_conncount_add(). This also avoids one unneeded unlock/re-lock pair. Extra care needs to be taken in count_tree, as we only hold rcu read lock, i.e. we can only insert to an existing tree node after acquiring its lock and making sure it has a nonzero count. As a zero count should be rare, just fall back to insert_tree() (which acquires tree lock). This issue and its solution were pointed out by Shawn Bohrer during patch review. Reviewed-by: Shawn Bohrer Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso include/net/netfilter/nf_conntrack_count.h | 18 +--- net/netfilter/nf_conncount.c | 146 +++++++++++++---------------- net/netfilter/nft_connlimit.c | 14 +-- 3 files changed, 72 insertions(+), 106 deletions(-) commit e8cfb372b38a1b8979aa7f7631fb5e7b11c3793c Author: Florian Westphal Date: Fri Dec 28 01:24:45 2018 +0100 netfilter: nf_conncount: restart search when nodes have been erased Shawn Bohrer reported a following crash: |RIP: 0010:rb_erase+0xae/0x360 [..] Call Trace: nf_conncount_destroy+0x59/0xc0 [nf_conncount] cleanup_match+0x45/0x70 [ip_tables] ... Shawn tracked this down to bogus 'parent' pointer: Problem is that when we insert a new node, then there is a chance that the 'parent' that we found was also passed to tree_nodes_free() (because that node was empty) for erase+free. Instead of trying to be clever and detect when this happens, restart the search if we have evicted one or more nodes. To prevent frequent restarts, do not perform gc on the second round. Also, unconditionally schedule the gc worker. The condition gc_count > ARRAY_SIZE(gc_nodes)) cannot be true unless tree grows very large, as the height of the tree will be low even with hundreds of nodes present. Fixes: 5c789e131cbb9 ("netfilter: nf_conncount: Add list lock and gc worker, and RCU for init tree search") Reported-by: Shawn Bohrer Reviewed-by: Shawn Bohrer Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_conncount.c | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) commit f7fcc98dfc2d136722007fec0debbed761679b94 Author: Florian Westphal Date: Fri Dec 28 01:24:44 2018 +0100 netfilter: nf_conncount: split gc in two phases The lockless workqueue garbage collector can race with packet path garbage collector to delete list nodes, as it calls tree_nodes_free() with the addresses of nodes that might have been free'd already from another cpu. To fix this, split gc into two phases. One phase to perform gc on the connections: From a locking perspective, this is the same as count_tree(): we hold rcu lock, but we do not change the tree, we only change the nodes' contents. The second phase acquires the tree lock and reaps empty nodes. This avoids a race condition of the garbage collection vs. packet path: If a node has been free'd already, the second phase won't find it anymore. This second phase is, from locking perspective, same as insert_tree(). The former only modifies nodes (list content, count), latter modifies the tree itself (rb_erase or rb_insert). Fixes: 5c789e131cbb9 ("netfilter: nf_conncount: Add list lock and gc worker, and RCU for init tree search") Reviewed-by: Shawn Bohrer Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_conncount.c | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) commit 4cd273bb91b3001f623f516ec726c49754571b1a Author: Florian Westphal Date: Fri Dec 28 01:24:43 2018 +0100 netfilter: nf_conncount: don't skip eviction when age is negative age is signed integer, so result can be negative when the timestamps have a large delta. In this case we want to discard the entry. Instead of using age >= 2 || age < 0, just make it unsigned. Fixes: b36e4523d4d56 ("netfilter: nf_conncount: fix garbage collection confirm race") Reviewed-by: Shawn Bohrer Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_conncount.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c78e7818f16f687389174c4569243abbec8dc68f Author: Shawn Bohrer Date: Fri Dec 28 01:24:42 2018 +0100 netfilter: nf_conncount: replace CONNCOUNT_LOCK_SLOTS with CONNCOUNT_SLOTS Most of the time these were the same value anyway, but when CONFIG_LOCKDEP was enabled we would use a smaller number of locks to reduce overhead. Unfortunately having two values is confusing and not worth the complexity. This fixes a bug where tree_gc_worker() would only GC up to CONNCOUNT_LOCK_SLOTS trees which meant when CONFIG_LOCKDEP was enabled not all trees would be GCed by tree_gc_worker(). Fixes: 5c789e131cbb9 ("netfilter: nf_conncount: Add list lock and gc worker, and RCU for init tree search") Signed-off-by: Florian Westphal Signed-off-by: Shawn Bohrer Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_conncount.c | 19 +++++-------------- 1 file changed, 5 insertions(+), 14 deletions(-) commit eb8950861c1bfd3eecc8f6faad213e3bca0dc395 Author: Kangjie Lu Date: Fri Dec 21 00:46:23 2018 -0600 netfilter: nf_tables: fix a missing check of nla_put_failure If nla_nest_start() may fail. The fix checks its return value and goes to nla_put_failure if it fails. Signed-off-by: Kangjie Lu Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_tables_api.c | 2 ++ 1 file changed, 2 insertions(+) commit 592b15ba7260f8dec8bfc71ef0ea1934801a35aa Merge: 7db54c89f0b3 1e3c336ad8f4 Author: Dmitry Torokhov Date: Fri Dec 28 17:10:54 2018 -0800 Merge branch 'next' into for-linus Prepare input updates for 4.21 merge window. commit 7db54c89f0b30a101584e09d3729144e6170059d Author: Patrick Dreyer Date: Sun Dec 23 10:06:35 2018 -0800 Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G This adds ELAN0501 to the ACPI table to support Elan touchpad found in ASUS Aspire F5-573G. Signed-off-by: Patrick Dreyer Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov drivers/input/mouse/elan_i2c_core.c | 1 + 1 file changed, 1 insertion(+) commit 1e3c336ad8f40f88a8961c434640920fe35cc08b Author: Sanjeev Chugh Date: Fri Dec 28 17:04:31 2018 -0800 Input: atmel_mxt_ts - don't try to free unallocated kernel memory If the user attempts to update Atmel device with an invalid configuration cfg file, error handling code is trying to free cfg file memory which is not allocated yet hence results into kernel crash. This patch fixes the order of memory free operations. Signed-off-by: Sanjeev Chugh Fixes: a4891f105837 ("Input: atmel_mxt_ts - zero terminate config firmware file") Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov drivers/input/touchscreen/atmel_mxt_ts.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit f346b0becb1bc62e45495f9cdbae3eef35d0b635 Merge: 00d59fde8532 0f4991e8fd48 Author: Linus Torvalds Date: Fri Dec 28 16:55:46 2018 -0800 Merge branch 'akpm' (patches from Andrew) Merge misc updates from Andrew Morton: - large KASAN update to use arm's "software tag-based mode" - a few misc things - sh updates - ocfs2 updates - just about all of MM * emailed patches from Andrew Morton : (167 commits) kernel/fork.c: mark 'stack_vm_area' with __maybe_unused memcg, oom: notify on oom killer invocation from the charge path mm, swap: fix swapoff with KSM pages include/linux/gfp.h: fix typo mm/hmm: fix memremap.h, move dev_page_fault_t callback to hmm hugetlbfs: Use i_mmap_rwsem to fix page fault/truncate race hugetlbfs: use i_mmap_rwsem for more pmd sharing synchronization memory_hotplug: add missing newlines to debugging output mm: remove __hugepage_set_anon_rmap() include/linux/vmstat.h: remove unused page state adjustment macro mm/page_alloc.c: allow error injection mm: migrate: drop unused argument of migrate_page_move_mapping() blkdev: avoid migration stalls for blkdev pages mm: migrate: provide buffer_migrate_page_norefs() mm: migrate: move migrate_page_lock_buffers() mm: migrate: lock buffers before migrate_page_move_mapping() mm: migration: factor out code to compute expected number of page references mm, page_alloc: enable pcpu_drain with zone capability kmemleak: add config to select auto scan mm/page_alloc.c: don't call kasan_free_pages() at deferred mem init ... commit 00d59fde8532b2d42e80909d2e58678755e04da9 Merge: 75f95da078b2 5215b2e952f3 Author: Linus Torvalds Date: Fri Dec 28 16:52:18 2018 -0800 Merge tag 'mmc-v4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC updates from Ulf Hansson: "This time, this pull request contains changes crossing subsystems and archs/platforms, which is mainly because of a bigger modernization of moving from legacy GPIO to GPIO descriptors for MMC (by Linus Walleij). Additionally, once again, I am funneling changes to drivers/misc/cardreader/* and drivers/memstick/* through my MMC tree, mostly due to that we lack a maintainer for these. Summary: MMC core: - Cleanup BKOPS support - Introduce MMC_CAP_SYNC_RUNTIME_PM - slot-gpio: Delete legacy slot GPIO handling MMC host: - alcor: Add new mmc host driver for Alcor Micro PCI based cardreader - bcm2835: Several improvements to better recover from errors - jz4740: Rework and fixup pre|post_req support - mediatek: Add support for SDIO IRQs - meson-gx: Improve clock phase management - meson-gx: Stop descriptor on errors - mmci: Complete the sbc error path by sending a stop command - renesas_sdhi/tmio: Fixup reset/resume operations - renesas_sdhi: Add support for r8a774c0 and R7S9210 - renesas_sdhi: Whitelist R8A77990 SDHI - renesas_sdhi: Fixup eMMC HS400 compatibility issues for H3 and M3-W - rtsx_usb_sdmmc: Re-work card detection/removal support - rtsx_usb_sdmmc: Re-work runtime PM support - sdhci: Fix timeout loops for some variant drivers - sdhci: Improve support for error handling due to failing commands - sdhci-acpi/pci: Disable LED control for Intel BYT-based controllers - sdhci_am654: Add new SDHCI variant driver to support TI's AM654 SOCs - sdhci-of-esdhc: Add support for eMMC HS400 mode - sdhci-omap: Fixup reset support - sdhci-omap: Workaround errata regarding SDR104/HS200 tuning failures - sdhci-msm: Fixup sporadic write transfers issues for SDR104/HS200 - sdhci-msm: Fixup dynamical clock gating issues - various: Complete converting all hosts into using slot GPIO descriptors Other: - Move GPIO mmc platform data for mips/sh/arm to GPIO descriptors - Add new Alcor Micro cardreader PCI driver - Support runtime power management for memstick rtsx_usb_ms driver - Use USB remote wakeups for card detection for rtsx_usb misc driver" * tag 'mmc-v4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (99 commits) mmc: mediatek: Add MMC_CAP_SDIO_IRQ support mmc: renesas_sdhi_internal_dmac: Whitelist r8a774c0 dt-bindings: mmc: renesas_sdhi: Add r8a774c0 support mmc: core: Cleanup BKOPS support mmc: core: Drop redundant check in mmc_send_hpi_cmd() mmc: sdhci-omap: Workaround errata regarding SDR104/HS200 tuning failures (i929) dt-bindings: sdhci-omap: Add note for cpu_thermal mmc: sdhci-acpi: Disable LED control for Intel BYT-based controllers mmc: sdhci-pci: Disable LED control for Intel BYT-based controllers mmc: sdhci: Add quirk to disable LED control mmc: mmci: add variant property to set command stop bit misc: alcor_pci: fix spelling mistake "invailid" -> "invalid" mmc: meson-gx: add signal resampling mmc: meson-gx: align default phase on soc vendor tree mmc: meson-gx: remove useless lock mmc: meson-gx: make sure the descriptor is stopped on errors mmc: sdhci_am654: Add Initial Support for AM654 SDHCI driver dt-bindings: mmc: sdhci-of-arasan: Add deprecated message for AM65 dt-bindings: mmc: sdhci-am654: Document bindings for the host controllers on TI's AM654 SOCs mmc: sdhci-msm: avoid unused function warning ... commit 75f95da078b2891cd186f074ffc15a8e7c3f082d Merge: 4ed7bdc1eb4c 4b5f747e82b1 Author: Linus Torvalds Date: Fri Dec 28 15:05:13 2018 -0800 Merge tag 'libnvdimm-for-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm updates from Dan Williams: "The vast bulk of this update is the new support for the security capabilities of some nvdimms. The userspace tooling for this capability is still a work in progress, but the changes survive the existing libnvdimm unit tests. The changes also pass manual checkout on hardware and the new nfit_test emulation of the security capability. The touches of the security/keys/ files have received the necessary acks from Mimi and David. Those changes were necessary to allow for a new generic encrypted-key type, and allow the nvdimm sub-system to lookup key material referenced by the libnvdimm-sysfs interface. Summary: - Add support for the security features of nvdimm devices that implement a security model similar to ATA hard drive security. The security model supports locking access to the media at device-power-loss, to be unlocked with a passphrase, and secure-erase (crypto-scramble). Unlike the ATA security case where the kernel expects device security to be managed in a pre-OS environment, the libnvdimm security implementation allows key provisioning and key-operations at OS runtime. Keys are managed with the kernel's encrypted-keys facility to provide data-at-rest security for the libnvdimm key material. The usage model mirrors fscrypt key management, but is driven via libnvdimm sysfs. - Miscellaneous updates for api usage and comment fixes" * tag 'libnvdimm-for-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: (21 commits) libnvdimm/security: Quiet security operations libnvdimm/security: Add documentation for nvdimm security support tools/testing/nvdimm: add Intel DSM 1.8 support for nfit_test tools/testing/nvdimm: Add overwrite support for nfit_test tools/testing/nvdimm: Add test support for Intel nvdimm security DSMs acpi/nfit, libnvdimm/security: add Intel DSM 1.8 master passphrase support acpi/nfit, libnvdimm/security: Add security DSM overwrite support acpi/nfit, libnvdimm: Add support for issue secure erase DSM to Intel nvdimm acpi/nfit, libnvdimm: Add enable/update passphrase support for Intel nvdimms acpi/nfit, libnvdimm: Add disable passphrase support to Intel nvdimm. acpi/nfit, libnvdimm: Add unlock of nvdimm support for Intel DIMMs acpi/nfit, libnvdimm: Add freeze security support to Intel nvdimm acpi/nfit, libnvdimm: Introduce nvdimm_security_ops keys-encrypted: add nvdimm key format type to encrypted keys keys: Export lookup_user_key to external users acpi/nfit, libnvdimm: Store dimm id as a member to struct nvdimm libnvdimm, namespace: Replace kmemdup() with kstrndup() libnvdimm, label: Switch to bitmap_zalloc() ACPI/nfit: Adjust annotation for why return 0 if fail to find NFIT at start libnvdimm, bus: Check id immediately following ida_simple_get ... commit 4ed7bdc1eb4c82cf4bfdf6a94dd36fd695f6f387 Merge: 5d24ae67a961 c6d6e9b0f6b4 Author: Linus Torvalds Date: Fri Dec 28 15:02:26 2018 -0800 Merge tag 'for-4.21/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper updates from Mike Snitzer: - Eliminate a couple indirect calls from bio-based DM core. - Fix DM to allow reads that exceed readahead limits by setting io_pages in the backing_dev_info. - A couple code cleanups in request-based DM. - Fix various DM targets to check for device sector overflow if CONFIG_LBDAF is not set. - Use u64 instead of sector_t to store iv_offset in DM crypt; sector_t isn't large enough on 32bit when CONFIG_LBDAF is not set. - Performance fixes to DM's kcopyd and the snapshot target focused on limiting memory use and workqueue stalls. - Fix typos in the integrity and writecache targets. - Log which algorithm is used for dm-crypt's encryption and dm-integrity's hashing. - Fix false -EBUSY errors in DM raid target's handling of check/repair messages. - Fix DM flakey target's corrupt_bio_byte feature to reliably corrupt the Nth byte in a bio's payload. * tag 'for-4.21/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm: do not allow readahead to limit IO size dm raid: fix false -EBUSY when handling check/repair message dm rq: cleanup leftover code from recently removed q->mq_ops branching dm verity: log the hash algorithm implementation dm crypt: log the encryption algorithm implementation dm integrity: fix spelling mistake in workqueue name dm flakey: Properly corrupt multi-page bios. dm: Check for device sector overflow if CONFIG_LBDAF is not set dm crypt: use u64 instead of sector_t to store iv_offset dm kcopyd: Fix bug causing workqueue stalls dm snapshot: Fix excessive memory usage and workqueue stalls dm bufio: update comment in dm-bufio.c dm writecache: fix typo in error msg for creating writecache_flush_thread dm: remove indirect calls from __send_changing_extent_only() dm mpath: only flush workqueue when needed dm rq: remove unused arguments from rq_completed() dm: avoid indirect call in __dm_make_request commit 5d24ae67a961c51beb255a28c9c417d9710247c2 Merge: 938edb8a31b9 f617e5ffe04f Author: Linus Torvalds Date: Fri Dec 28 14:57:10 2018 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma updates from Jason Gunthorpe: "This has been a fairly typical cycle, with the usual sorts of driver updates. Several series continue to come through which improve and modernize various parts of the core code, and we finally are starting to get the uAPI command interface cleaned up. - Various driver fixes for bnxt_re, cxgb3/4, hfi1, hns, i40iw, mlx4, mlx5, qib, rxe, usnic - Rework the entire syscall flow for uverbs to be able to run over ioctl(). Finally getting past the historic bad choice to use write() for command execution - More functional coverage with the mlx5 'devx' user API - Start of the HFI1 series for 'TID RDMA' - SRQ support in the hns driver - Support for new IBTA defined 2x lane widths - A big series to consolidate all the driver function pointers into a big struct and have drivers provide a 'static const' version of the struct instead of open coding initialization - New 'advise_mr' uAPI to control device caching/loading of page tables - Support for inline data in SRPT - Modernize how umad uses the driver core and creates cdev's and sysfs files - First steps toward removing 'uobject' from the view of the drivers" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (193 commits) RDMA/srpt: Use kmem_cache_free() instead of kfree() RDMA/mlx5: Signedness bug in UVERBS_HANDLER() IB/uverbs: Signedness bug in UVERBS_HANDLER() IB/mlx5: Allocate the per-port Q counter shared when DEVX is supported IB/umad: Start using dev_groups of class IB/umad: Use class_groups and let core create class file IB/umad: Refactor code to use cdev_device_add() IB/umad: Avoid destroying device while it is accessed IB/umad: Simplify and avoid dynamic allocation of class IB/mlx5: Fix wrong error unwind IB/mlx4: Remove set but not used variable 'pd' RDMA/iwcm: Don't copy past the end of dev_name() string IB/mlx5: Fix long EEH recover time with NVMe offloads IB/mlx5: Simplify netdev unbinding IB/core: Move query port to ioctl RDMA/nldev: Expose port_cap_flags2 IB/core: uverbs copy to struct or zero helper IB/rxe: Reuse code which sets port state IB/rxe: Make counters thread safe IB/mlx5: Use the correct commands for UMEM and UCTX allocation ... commit 938edb8a31b976c9a92eb0cd4ff481e93f76c1f1 Merge: af7ddd8a627c da7903092b88 Author: Linus Torvalds Date: Fri Dec 28 14:48:06 2018 -0800 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI updates from James Bottomley: "This is mostly update of the usual drivers: smarpqi, lpfc, qedi, megaraid_sas, libsas, zfcp, mpt3sas, hisi_sas. Additionally, we have a pile of annotation, unused variable and minor updates. The big API change is the updates for Christoph's DMA rework which include removing the DISABLE_CLUSTERING flag. And finally there are a couple of target tree updates" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (259 commits) scsi: isci: request: mark expected switch fall-through scsi: isci: remote_node_context: mark expected switch fall-throughs scsi: isci: remote_device: Mark expected switch fall-throughs scsi: isci: phy: Mark expected switch fall-through scsi: iscsi: Capture iscsi debug messages using tracepoints scsi: myrb: Mark expected switch fall-throughs scsi: megaraid: fix out-of-bound array accesses scsi: mpt3sas: mpt3sas_scsih: Mark expected switch fall-through scsi: fcoe: remove set but not used variable 'port' scsi: smartpqi: call pqi_free_interrupts() in pqi_shutdown() scsi: smartpqi: fix build warnings scsi: smartpqi: update driver version scsi: smartpqi: add ofa support scsi: smartpqi: increase fw status register read timeout scsi: smartpqi: bump driver version scsi: smartpqi: add smp_utils support scsi: smartpqi: correct lun reset issues scsi: smartpqi: correct volume status scsi: smartpqi: do not offline disks for transient did no connect conditions scsi: smartpqi: allow for larger raid maps ... commit af7ddd8a627c62a835524b3f5b471edbbbcce025 Merge: fe2b0cdabcd9 8b1cce9f5832 Author: Linus Torvalds Date: Fri Dec 28 14:12:21 2018 -0800 Merge tag 'dma-mapping-4.21' of git://git.infradead.org/users/hch/dma-mapping Pull DMA mapping updates from Christoph Hellwig: "A huge update this time, but a lot of that is just consolidating or removing code: - provide a common DMA_MAPPING_ERROR definition and avoid indirect calls for dma_map_* error checking - use direct calls for the DMA direct mapping case, avoiding huge retpoline overhead for high performance workloads - merge the swiotlb dma_map_ops into dma-direct - provide a generic remapping DMA consistent allocator for architectures that have devices that perform DMA that is not cache coherent. Based on the existing arm64 implementation and also used for csky now. - improve the dma-debug infrastructure, including dynamic allocation of entries (Robin Murphy) - default to providing chaining scatterlist everywhere, with opt-outs for the few architectures (alpha, parisc, most arm32 variants) that can't cope with it - misc sparc32 dma-related cleanups - remove the dma_mark_clean arch hook used by swiotlb on ia64 and replace it with the generic noncoherent infrastructure - fix the return type of dma_set_max_seg_size (Niklas Söderlund) - move the dummy dma ops for not DMA capable devices from arm64 to common code (Robin Murphy) - ensure dma_alloc_coherent returns zeroed memory to avoid kernel data leaks through userspace. We already did this for most common architectures, but this ensures we do it everywhere. dma_zalloc_coherent has been deprecated and can hopefully be removed after -rc1 with a coccinelle script" * tag 'dma-mapping-4.21' of git://git.infradead.org/users/hch/dma-mapping: (73 commits) dma-mapping: fix inverted logic in dma_supported dma-mapping: deprecate dma_zalloc_coherent dma-mapping: zero memory returned from dma_alloc_* sparc/iommu: fix ->map_sg return value sparc/io-unit: fix ->map_sg return value arm64: default to the direct mapping in get_arch_dma_ops PCI: Remove unused attr variable in pci_dma_configure ia64: only select ARCH_HAS_DMA_COHERENT_TO_PFN if swiotlb is enabled dma-mapping: bypass indirect calls for dma-direct vmd: use the proper dma_* APIs instead of direct methods calls dma-direct: merge swiotlb_dma_ops into the dma_direct code dma-direct: use dma_direct_map_page to implement dma_direct_map_sg dma-direct: improve addressability error reporting swiotlb: remove dma_mark_clean swiotlb: remove SWIOTLB_MAP_ERROR ACPI / scan: Refactor _CCA enforcement dma-mapping: factor out dummy DMA ops dma-mapping: always build the direct mapping code dma-mapping: move dma_cache_sync out of line dma-mapping: move various slow path functions out of line ... commit fe2b0cdabcd9e6aeca66a104bc03576946e5fee2 Merge: 956eb6cb3676 9f83cfdb1ace Author: Linus Torvalds Date: Fri Dec 28 14:06:43 2018 -0800 Merge tag 'for-4.21/libata-20181221' of git://git.kernel.dk/linux-block Pull libata updates from Jens Axboe: "Here are the libata changes for this merge window. Nothing major in here. This contains: - GPIO descriptor conversions (Linus Walleij) - rcar deferred probing fix (Sergei Shtylyov)" * tag 'for-4.21/libata-20181221' of git://git.kernel.dk/linux-block: sata_rcar: fix deferred probing ata: palmld: Introduce state container ata: palmld: Convert to GPIO descriptors ata: rb532_cf: Convert to use GPIO descriptors ata: sata_highbank: Convert to use GPIO descriptors ata: pxa: Drop include commit 956eb6cb36765e3a79a744e6c9364dab1548e460 Merge: 0e9da3fbf7d8 875736bb3f3d Author: Linus Torvalds Date: Fri Dec 28 13:57:59 2018 -0800 Merge tag 'for-4.21/aio-20181221' of git://git.kernel.dk/linux-block Pull aio updates from Jens Axboe: "Flushing out pre-patches for the buffered/polled aio series. Some fixes in here, but also optimizations" * tag 'for-4.21/aio-20181221' of git://git.kernel.dk/linux-block: aio: abstract out io_event filler helper aio: split out iocb copy from io_submit_one() aio: use iocb_put() instead of open coding it aio: only use blk plugs for > 2 depth submissions aio: don't zero entire aio_kiocb aio_get_req() aio: separate out ring reservation from req allocation aio: use assigned completion handler commit 0e9da3fbf7d81f0f913b491c8de1ba7883d4f217 Merge: b12a9124eeb7 00203ba40d40 Author: Linus Torvalds Date: Fri Dec 28 13:19:59 2018 -0800 Merge tag 'for-4.21/block-20181221' of git://git.kernel.dk/linux-block Pull block updates from Jens Axboe: "This is the main pull request for block/storage for 4.21. Larger than usual, it was a busy round with lots of goodies queued up. Most notable is the removal of the old IO stack, which has been a long time coming. No new features for a while, everything coming in this week has all been fixes for things that were previously merged. This contains: - Use atomic counters instead of semaphores for mtip32xx (Arnd) - Cleanup of the mtip32xx request setup (Christoph) - Fix for circular locking dependency in loop (Jan, Tetsuo) - bcache (Coly, Guoju, Shenghui) * Optimizations for writeback caching * Various fixes and improvements - nvme (Chaitanya, Christoph, Sagi, Jay, me, Keith) * host and target support for NVMe over TCP * Error log page support * Support for separate read/write/poll queues * Much improved polling * discard OOM fallback * Tracepoint improvements - lightnvm (Hans, Hua, Igor, Matias, Javier) * Igor added packed metadata to pblk. Now drives without metadata per LBA can be used as well. * Fix from Geert on uninitialized value on chunk metadata reads. * Fixes from Hans and Javier to pblk recovery and write path. * Fix from Hua Su to fix a race condition in the pblk recovery code. * Scan optimization added to pblk recovery from Zhoujie. * Small geometry cleanup from me. - Conversion of the last few drivers that used the legacy path to blk-mq (me) - Removal of legacy IO path in SCSI (me, Christoph) - Removal of legacy IO stack and schedulers (me) - Support for much better polling, now without interrupts at all. blk-mq adds support for multiple queue maps, which enables us to have a map per type. This in turn enables nvme to have separate completion queues for polling, which can then be interrupt-less. Also means we're ready for async polled IO, which is hopefully coming in the next release. - Killing of (now) unused block exports (Christoph) - Unification of the blk-rq-qos and blk-wbt wait handling (Josef) - Support for zoned testing with null_blk (Masato) - sx8 conversion to per-host tag sets (Christoph) - IO priority improvements (Damien) - mq-deadline zoned fix (Damien) - Ref count blkcg series (Dennis) - Lots of blk-mq improvements and speedups (me) - sbitmap scalability improvements (me) - Make core inflight IO accounting per-cpu (Mikulas) - Export timeout setting in sysfs (Weiping) - Cleanup the direct issue path (Jianchao) - Export blk-wbt internals in block debugfs for easier debugging (Ming) - Lots of other fixes and improvements" * tag 'for-4.21/block-20181221' of git://git.kernel.dk/linux-block: (364 commits) kyber: use sbitmap add_wait_queue/list_del wait helpers sbitmap: add helpers for add/del wait queue handling block: save irq state in blkg_lookup_create() dm: don't reuse bio for flushes nvme-pci: trace SQ status on completions nvme-rdma: implement polling queue map nvme-fabrics: allow user to pass in nr_poll_queues nvme-fabrics: allow nvmf_connect_io_queue to poll nvme-core: optionally poll sync commands block: make request_to_qc_t public nvme-tcp: fix spelling mistake "attepmpt" -> "attempt" nvme-tcp: fix endianess annotations nvmet-tcp: fix endianess annotations nvme-pci: refactor nvme_poll_irqdisable to make sparse happy nvme-pci: only set nr_maps to 2 if poll queues are supported nvmet: use a macro for default error location nvmet: fix comparison of a u16 with -1 blk-mq: enable IO poll if .nr_queues of type poll > 0 blk-mq: change blk_mq_queue_busy() to blk_mq_queue_inflight() blk-mq: skip zero-queue maps in blk_mq_map_swqueue ... commit b12a9124eeb71d766a3e3eb594ebbb3fefc66902 Merge: 1a80dade010c e4b92b108c6c Author: Linus Torvalds Date: Fri Dec 28 12:45:04 2018 -0800 Merge tag 'y2038-for-4.21' of ssh://gitolite.kernel.org:/pub/scm/linux/kernel/git/arnd/playground Pull y2038 updates from Arnd Bergmann: "More syscalls and cleanups This concludes the main part of the system call rework for 64-bit time_t, which has spread over most of year 2018, the last six system calls being - ppoll - pselect6 - io_pgetevents - recvmmsg - futex - rt_sigtimedwait As before, nothing changes for 64-bit architectures, while 32-bit architectures gain another entry point that differs only in the layout of the timespec structure. Hopefully in the next release we can wire up all 22 of those system calls on all 32-bit architectures, which gives us a baseline version for glibc to start using them. This does not include the clock_adjtime, getrusage/waitid, and getitimer/setitimer system calls. I still plan to have new versions of those as well, but they are not required for correct operation of the C library since they can be emulated using the old 32-bit time_t based system calls. Aside from the system calls, there are also a few cleanups here, removing old kernel internal interfaces that have become unused after all references got removed. The arch/sh cleanups are part of this, there were posted several times over the past year without a reaction from the maintainers, while the corresponding changes made it into all other architectures" * tag 'y2038-for-4.21' of ssh://gitolite.kernel.org:/pub/scm/linux/kernel/git/arnd/playground: timekeeping: remove obsolete time accessors vfs: replace current_kernel_time64 with ktime equivalent timekeeping: remove timespec_add/timespec_del timekeeping: remove unused {read,update}_persistent_clock sh: remove board_time_init() callback sh: remove unused rtc_sh_get/set_time infrastructure sh: sh03: rtc: push down rtc class ops into driver sh: dreamcast: rtc: push down rtc class ops into driver y2038: signal: Add compat_sys_rt_sigtimedwait_time64 y2038: signal: Add sys_rt_sigtimedwait_time32 y2038: socket: Add compat_sys_recvmmsg_time64 y2038: futex: Add support for __kernel_timespec y2038: futex: Move compat implementation into futex.c io_pgetevents: use __kernel_timespec pselect6: use __kernel_timespec ppoll: use __kernel_timespec signal: Add restore_user_sigmask() signal: Add set_user_sigmask() commit 1a80dade010c7a7f4885a4c4c2a7ac22cc7b34df Author: Matthew Wilcox Date: Fri Dec 28 07:22:26 2018 -0800 Fix failure path in alloc_pid() The failure path removes the allocated PIDs from the wrong namespace. This could lead to us inadvertently reusing PIDs in the leaf namespace and leaking PIDs in parent namespaces. Fixes: 95846ecf9dac ("pid: replace pid bitmap implementation with IDR API") Cc: Signed-off-by: Matthew Wilcox Acked-by: "Eric W. Biederman" Reviewed-by: Oleg Nesterov Signed-off-by: Linus Torvalds kernel/pid.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 0f4991e8fd48987ae476a92cdee6bfec4aff31b8 Author: YueHaibing Date: Fri Dec 28 00:40:00 2018 -0800 kernel/fork.c: mark 'stack_vm_area' with __maybe_unused Fixes gcc '-Wunused-but-set-variable' warning when CONFIG_VMAP_STACK is not set: kernel/fork.c: In function 'dup_task_struct': kernel/fork.c:843:20: warning: variable 'stack_vm_area' set but not used [-Wunused-but-set-variable] Link: http://lkml.kernel.org/r/1545965190-2381-1-git-send-email-yuehaibing@huawei.com Signed-off-by: YueHaibing Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/fork.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7056d3a37d2c6aaaab10c13e8e69adc67ec1fc65 Author: Michal Hocko Date: Fri Dec 28 00:39:57 2018 -0800 memcg, oom: notify on oom killer invocation from the charge path Burt Holzman has noticed that memcg v1 doesn't notify about OOM events via eventfd anymore. The reason is that 29ef680ae7c2 ("memcg, oom: move out_of_memory back to the charge path") has moved the oom handling back to the charge path. While doing so the notification was left behind in mem_cgroup_oom_synchronize. Fix the issue by replicating the oom hierarchy locking and the notification. Link: http://lkml.kernel.org/r/20181224091107.18354-1-mhocko@kernel.org Fixes: 29ef680ae7c2 ("memcg, oom: move out_of_memory back to the charge path") Signed-off-by: Michal Hocko Reported-by: Burt Holzman Acked-by: Johannes Weiner Cc: Vladimir Davydov [4.19+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/memcontrol.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) commit 7af7a8e19f0c5425ff639b0f0d2d244c2a647724 Author: Huang Ying Date: Fri Dec 28 00:39:53 2018 -0800 mm, swap: fix swapoff with KSM pages KSM pages may be mapped to the multiple VMAs that cannot be reached from one anon_vma. So during swapin, a new copy of the page need to be generated if a different anon_vma is needed, please refer to comments of ksm_might_need_to_copy() for details. During swapoff, unuse_vma() uses anon_vma (if available) to locate VMA and virtual address mapped to the page, so not all mappings to a swapped out KSM page could be found. So in try_to_unuse(), even if the swap count of a swap entry isn't zero, the page needs to be deleted from swap cache, so that, in the next round a new page could be allocated and swapin for the other mappings of the swapped out KSM page. But this contradicts with the THP swap support. Where the THP could be deleted from swap cache only after the swap count of every swap entry in the huge swap cluster backing the THP has reach 0. So try_to_unuse() is changed in commit e07098294adf ("mm, THP, swap: support to reclaim swap space for THP swapped out") to check that before delete a page from swap cache, but this has broken KSM swapoff too. Fortunately, KSM is for the normal pages only, so the original behavior for KSM pages could be restored easily via checking PageTransCompound(). That is how this patch works. The bug is introduced by e07098294adf ("mm, THP, swap: support to reclaim swap space for THP swapped out"), which is merged by v4.14-rc1. So I think we should backport the fix to from 4.14 on. But Hugh thinks it may be rare for the KSM pages being in the swap device when swapoff, so nobody reports the bug so far. Link: http://lkml.kernel.org/r/20181226051522.28442-1-ying.huang@intel.com Fixes: e07098294adf ("mm, THP, swap: support to reclaim swap space for THP swapped out") Signed-off-by: "Huang, Ying" Reported-by: Hugh Dickins Tested-by: Hugh Dickins Acked-by: Hugh Dickins Cc: Rik van Riel Cc: Johannes Weiner Cc: Minchan Kim Cc: Shaohua Li Cc: Daniel Jordan Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/swapfile.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 70c6066e19c15749b579dde7d5722c7d7fb05d57 Author: Kyle Spiers Date: Fri Dec 28 00:39:49 2018 -0800 include/linux/gfp.h: fix typo Fix misspelled "satisfied" Link: http://lkml.kernel.org/r/20181227232354.64562-1-ksspiers@google.com Signed-off-by: Kyle Spiers Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/gfp.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 063a7d1d3623db31ca5d2309cab6030ebf93b72f Author: Dan Williams Date: Fri Dec 28 00:39:46 2018 -0800 mm/hmm: fix memremap.h, move dev_page_fault_t callback to hmm The kbuild robot reported the following on a development branch that used memremap.h in a new path: In file included from arch/m68k/include/asm/pgtable_mm.h:148:0, from arch/m68k/include/asm/pgtable.h:5, from include/linux/memremap.h:7, from drivers//dax/bus.c:3: arch/m68k/include/asm/motorola_pgtable.h: In function 'pgd_offset': >> arch/m68k/include/asm/motorola_pgtable.h:199:11: error: dereferencing pointer to incomplete type 'const struct mm_struct' return mm->pgd + pgd_index(address); ^~ The ->page_fault() callback is specific to HMM. Move it to 'struct hmm_devmem' where the unusual asm/pgtable.h dependency can be contained in include/linux/hmm.h. Longer term refactoring this dependency out of HMM is recommended, but in the meantime memremap.h remains generic. Link: http://lkml.kernel.org/r/154534090899.3120190.6652620807617715272.stgit@dwillia2-desk3.amr.corp.intel.com Fixes: 5042db43cc26 ("mm/ZONE_DEVICE: new type of ZONE_DEVICE memory...") Signed-off-by: Dan Williams Reviewed-by: "Jérôme Glisse" Cc: Logan Gunthorpe Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/hmm.h | 24 ++++++++++++++++++++++++ include/linux/memremap.h | 32 -------------------------------- kernel/memremap.c | 6 +++++- mm/hmm.c | 4 ++-- 4 files changed, 31 insertions(+), 35 deletions(-) commit c86aa7bbfd5568ba8a82d3635d8f7b8a8e06fe54 Author: Mike Kravetz Date: Fri Dec 28 00:39:42 2018 -0800 hugetlbfs: Use i_mmap_rwsem to fix page fault/truncate race hugetlbfs page faults can race with truncate and hole punch operations. Current code in the page fault path attempts to handle this by 'backing out' operations if we encounter the race. One obvious omission in the current code is removing a page newly added to the page cache. This is pretty straight forward to address, but there is a more subtle and difficult issue of backing out hugetlb reservations. To handle this correctly, the 'reservation state' before page allocation needs to be noted so that it can be properly backed out. There are four distinct possibilities for reservation state: shared/reserved, shared/no-resv, private/reserved and private/no-resv. Backing out a reservation may require memory allocation which could fail so that needs to be taken into account as well. Instead of writing the required complicated code for this rare occurrence, just eliminate the race. i_mmap_rwsem is now held in read mode for the duration of page fault processing. Hold i_mmap_rwsem longer in truncation and hold punch code to cover the call to remove_inode_hugepages. With this modification, code in remove_inode_hugepages checking for races becomes 'dead' as it can not longer happen. Remove the dead code and expand comments to explain reasoning. Similarly, checks for races with truncation in the page fault path can be simplified and removed. [mike.kravetz@oracle.com: incorporat suggestions from Kirill] Link: http://lkml.kernel.org/r/20181222223013.22193-3-mike.kravetz@oracle.com Link: http://lkml.kernel.org/r/20181218223557.5202-3-mike.kravetz@oracle.com Fixes: ebed4bfc8da8 ("hugetlb: fix absurd HugePages_Rsvd") Signed-off-by: Mike Kravetz Acked-by: Kirill A. Shutemov Cc: Michal Hocko Cc: Hugh Dickins Cc: Naoya Horiguchi Cc: "Aneesh Kumar K . V" Cc: Andrea Arcangeli Cc: Davidlohr Bueso Cc: Prakash Sangappa Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/hugetlbfs/inode.c | 61 ++++++++++++++++++++++++---------------------------- mm/hugetlb.c | 21 +++++++++--------- 2 files changed, 38 insertions(+), 44 deletions(-) commit b43a9990055958e70347c56f90ea2ae32c67334c Author: Mike Kravetz Date: Fri Dec 28 00:39:38 2018 -0800 hugetlbfs: use i_mmap_rwsem for more pmd sharing synchronization While looking at BUGs associated with invalid huge page map counts, it was discovered and observed that a huge pte pointer could become 'invalid' and point to another task's page table. Consider the following: A task takes a page fault on a shared hugetlbfs file and calls huge_pte_alloc to get a ptep. Suppose the returned ptep points to a shared pmd. Now, another task truncates the hugetlbfs file. As part of truncation, it unmaps everyone who has the file mapped. If the range being truncated is covered by a shared pmd, huge_pmd_unshare will be called. For all but the last user of the shared pmd, huge_pmd_unshare will clear the pud pointing to the pmd. If the task in the middle of the page fault is not the last user, the ptep returned by huge_pte_alloc now points to another task's page table or worse. This leads to bad things such as incorrect page map/reference counts or invalid memory references. To fix, expand the use of i_mmap_rwsem as follows: - i_mmap_rwsem is held in read mode whenever huge_pmd_share is called. huge_pmd_share is only called via huge_pte_alloc, so callers of huge_pte_alloc take i_mmap_rwsem before calling. In addition, callers of huge_pte_alloc continue to hold the semaphore until finished with the ptep. - i_mmap_rwsem is held in write mode whenever huge_pmd_unshare is called. [mike.kravetz@oracle.com: add explicit check for mapping != null] Link: http://lkml.kernel.org/r/20181218223557.5202-2-mike.kravetz@oracle.com Fixes: 39dde65c9940 ("shared page table for hugetlb page") Signed-off-by: Mike Kravetz Acked-by: Kirill A. Shutemov Cc: Michal Hocko Cc: Hugh Dickins Cc: Naoya Horiguchi Cc: "Aneesh Kumar K . V" Cc: Andrea Arcangeli Cc: Davidlohr Bueso Cc: Prakash Sangappa Cc: Colin Ian King Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/hugetlb.c | 64 ++++++++++++++++++++++++++++++++++++++++------------- mm/memory-failure.c | 16 ++++++++++++-- mm/migrate.c | 13 ++++++++++- mm/rmap.c | 4 ++++ mm/userfaultfd.c | 11 +++++++-- 5 files changed, 88 insertions(+), 20 deletions(-) commit 1ecc07fd0a6d350bbf4dc176e0d654661b304a30 Author: Michal Hocko Date: Fri Dec 28 00:39:34 2018 -0800 memory_hotplug: add missing newlines to debugging output pages_correctly_probed is missing new lines which means that the line is not printed rightaway but it rather waits for additional printks. Add \n to all three messages in pages_correctly_probed. Link: http://lkml.kernel.org/r/20181218162307.10518-1-mhocko@kernel.org Fixes: b77eab7079d9 ("mm/memory_hotplug: optimize probe routine") Signed-off-by: Michal Hocko Reviewed-by: Oscar Salvador Reviewed-by: Wei Yang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/base/memory.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 451b9514a59f3379d3bedd5a0e4909ef3ef1b98c Author: Kirill Tkhai Date: Fri Dec 28 00:39:31 2018 -0800 mm: remove __hugepage_set_anon_rmap() This function is identical to __page_set_anon_rmap() since the time, when it was introduced (8 years ago). The patch removes the function, and makes its users to use __page_set_anon_rmap() instead. Link: http://lkml.kernel.org/r/154504875359.30235.6237926369392564851.stgit@localhost.localdomain Signed-off-by: Kirill Tkhai Acked-by: Kirill A. Shutemov Reviewed-by: Andrew Morton Reviewed-by: Mike Kravetz Cc: Jerome Glisse Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/rmap.c | 25 ++++--------------------- 1 file changed, 4 insertions(+), 21 deletions(-) commit 4918e7625ffa82f388ea70538f0e1df20ea35a54 Author: Wei Yang Date: Fri Dec 28 00:39:27 2018 -0800 include/linux/vmstat.h: remove unused page state adjustment macro These four macro are not used anymore. Just remove them. Link: http://lkml.kernel.org/r/20181214063211.2290-1-richard.weiyang@gmail.com Signed-off-by: Wei Yang Acked-by: Michal Hocko Reviewed-by: David Hildenbrand Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/vmstat.h | 5 ----- 1 file changed, 5 deletions(-) commit af3b854492f351d1ff3b4744a83bf5ff7eed4920 Author: Benjamin Poirier Date: Fri Dec 28 00:39:23 2018 -0800 mm/page_alloc.c: allow error injection Model call chain after should_failslab(). Likewise, we can now use a kprobe to override the return value of should_fail_alloc_page() and inject allocation failures into alloc_page*(). This will allow injecting allocation failures using the BCC tools even without building kernel with CONFIG_FAIL_PAGE_ALLOC and booting it with a fail_page_alloc= parameter, which incurs some overhead even when failures are not being injected. On the other hand, this patch adds an unconditional call to should_fail_alloc_page() from page allocation hotpath. That overhead should be rather negligible with CONFIG_FAIL_PAGE_ALLOC=n when there's no kprobe attached, though. [vbabka@suse.cz: changelog addition] Link: http://lkml.kernel.org/r/20181214074330.18917-1-bpoirier@suse.com Signed-off-by: Benjamin Poirier Acked-by: Vlastimil Babka Cc: Arnd Bergmann Cc: Michal Hocko Cc: Pavel Tatashin Cc: Oscar Salvador Cc: Mike Rapoport Cc: Joonsoo Kim Cc: Alexander Duyck Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/asm-generic/error-injection.h | 1 + mm/page_alloc.c | 10 ++++++++-- 2 files changed, 9 insertions(+), 2 deletions(-) commit ab41ee6879981b3d3a16a1079a33fa6fd043eb3c Author: Jan Kara Date: Fri Dec 28 00:39:20 2018 -0800 mm: migrate: drop unused argument of migrate_page_move_mapping() All callers of migrate_page_move_mapping() now pass NULL for 'head' argument. Drop it. Link: http://lkml.kernel.org/r/20181211172143.7358-7-jack@suse.cz Signed-off-by: Jan Kara Acked-by: Mel Gorman Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/aio.c | 2 +- fs/f2fs/data.c | 2 +- fs/iomap.c | 2 +- fs/ubifs/file.c | 2 +- include/linux/migrate.h | 3 +-- mm/migrate.c | 7 +++---- 6 files changed, 8 insertions(+), 10 deletions(-) commit 88dbcbb3a4847f5e6dfeae952d3105497700c128 Author: Jan Kara Date: Fri Dec 28 00:39:16 2018 -0800 blkdev: avoid migration stalls for blkdev pages Currently, block device pages don't provide a ->migratepage callback and thus fallback_migrate_page() is used for them. This handler cannot deal with dirty pages in async mode and also with the case a buffer head is in the LRU buffer head cache (as it has elevated b_count). Thus such page can block memory offlining. Fix the problem by using buffer_migrate_page_norefs() for migrating block device pages. That function takes care of dropping bh LRU in case migration would fail due to elevated buffer refcount to avoid stalls and can also migrate dirty pages without writing them. Link: http://lkml.kernel.org/r/20181211172143.7358-6-jack@suse.cz Signed-off-by: Jan Kara Acked-by: Mel Gorman Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/block_dev.c | 1 + 1 file changed, 1 insertion(+) commit 89cb0888ca1483ad72648844ddd1b801863a8949 Author: Jan Kara Date: Fri Dec 28 00:39:12 2018 -0800 mm: migrate: provide buffer_migrate_page_norefs() Provide a variant of buffer_migrate_page() that also checks whether there are no unexpected references to buffer heads. This function will then be safe to use for block device pages. [akpm@linux-foundation.org: remove EXPORT_SYMBOL(buffer_migrate_page_norefs)] Link: http://lkml.kernel.org/r/20181211172143.7358-5-jack@suse.cz Signed-off-by: Jan Kara Acked-by: Mel Gorman Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/fs.h | 4 ++++ mm/migrate.c | 60 +++++++++++++++++++++++++++++++++++++++++++++++------- 2 files changed, 57 insertions(+), 7 deletions(-) commit 84ade7c15ccfb46f852f4e2469b007a33651904d Author: Jan Kara Date: Fri Dec 28 00:39:09 2018 -0800 mm: migrate: move migrate_page_lock_buffers() buffer_migrate_page() is the only caller of migrate_page_lock_buffers() move it close to it and also drop the now unused stub for !CONFIG_BLOCK. Link: http://lkml.kernel.org/r/20181211172143.7358-4-jack@suse.cz Signed-off-by: Jan Kara Acked-by: Mel Gorman Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/migrate.c | 92 +++++++++++++++++++++++++++--------------------------------- 1 file changed, 42 insertions(+), 50 deletions(-) commit cc4f11e69fd00c61c38619759b07d00631bda5ca Author: Jan Kara Date: Fri Dec 28 00:39:05 2018 -0800 mm: migrate: lock buffers before migrate_page_move_mapping() Lock buffers before calling into migrate_page_move_mapping() so that that function doesn't have to know about buffers (which is somewhat unexpected anyway) and all the buffer head logic is in buffer_migrate_page(). Link: http://lkml.kernel.org/r/20181211172143.7358-3-jack@suse.cz Signed-off-by: Jan Kara Acked-by: Mel Gorman Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/migrate.c | 39 +++++++++++++-------------------------- 1 file changed, 13 insertions(+), 26 deletions(-) commit 0b3901b38d9d916f634e903ce7cd2a8ddd5b1559 Author: Jan Kara Date: Fri Dec 28 00:39:01 2018 -0800 mm: migration: factor out code to compute expected number of page references Patch series "mm: migrate: Fix page migration stalls for blkdev pages". This patchset deals with page migration stalls that were reported by our customer due to a block device page that had a bufferhead that was in the bh LRU cache. The patchset modifies the page migration code so that bufferheads are completely handled inside buffer_migrate_page() and then provides a new migration helper for pages with buffer heads that is safe to use even for block device pages and that also deals with bh lrus. This patch (of 6): Factor out function to compute number of expected page references in migrate_page_move_mapping(). Note that we move hpage_nr_pages() and page_has_private() checks from under xas_lock_irq() however this is safe since we hold page lock. [jack@suse.cz: fix expected_page_refs()] Link: http://lkml.kernel.org/r/20181217131710.GB8611@quack2.suse.cz Link: http://lkml.kernel.org/r/20181211172143.7358-2-jack@suse.cz Signed-off-by: Jan Kara Acked-by: Mel Gorman Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/migrate.c | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-) commit d9367bd06faa1beb2951899272f925bdf877d28b Author: Wei Yang Date: Fri Dec 28 00:38:58 2018 -0800 mm, page_alloc: enable pcpu_drain with zone capability drain_all_pages is documented to drain per-cpu pages for a given zone (if non-NULL). The current implementation doesn't match the description though. It will drain all pcp pages for all zones that happen to have cached pages on the same cpu as the given zone. This will lead to premature pcp cache draining for zones that are not of any interest to the caller - e.g. compaction, hwpoison or memory offline. This forces the page allocator to take locks and potential lock contention as a result. There is no real reason for this sub-optimal implementation. Replace per-cpu work item with a dedicated structure which contains a pointer to the zone and pass it over to the worker. This will get the zone information all the way down to the worker function and do the right job. [akpm@linux-foundation.org: avoid 80-col tricks] [mhocko@suse.com: refactor the whole changelog] Link: http://lkml.kernel.org/r/20181212142550.61686-1-richard.weiyang@gmail.com Signed-off-by: Wei Yang Acked-by: Michal Hocko Reviewed-by: Oscar Salvador Reviewed-by: David Hildenbrand Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/page_alloc.c | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) commit d53ce042277a94eadf9a8a31fc41fac54c67dec5 Author: Sri Krishna chowdary Date: Fri Dec 28 00:38:54 2018 -0800 kmemleak: add config to select auto scan Kmemleak scan can be cpu intensive and can stall user tasks at times. To prevent this, add config DEBUG_KMEMLEAK_AUTO_SCAN to enable/disable auto scan on boot up. Also protect first_run with DEBUG_KMEMLEAK_AUTO_SCAN as this is meant for only first automatic scan. Link: http://lkml.kernel.org/r/1540231723-7087-1-git-send-email-prpatel@nvidia.com Signed-off-by: Sri Krishna chowdary Signed-off-by: Sachin Nikam Signed-off-by: Prateek Reviewed-by: Catalin Marinas Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds lib/Kconfig.debug | 15 +++++++++++++++ mm/kmemleak.c | 10 ++++++---- 2 files changed, 21 insertions(+), 4 deletions(-) commit 3c0c12cc8f00ca5f81acb010023b8eb13e9a7004 Author: Waiman Long Date: Fri Dec 28 00:38:51 2018 -0800 mm/page_alloc.c: don't call kasan_free_pages() at deferred mem init When CONFIG_KASAN is enabled on large memory SMP systems, the deferrred pages initialization can take a long time. Below were the reported init times on a 8-socket 96-core 4TB IvyBridge system. 1) Non-debug kernel without CONFIG_KASAN [ 8.764222] node 1 initialised, 132086516 pages in 7027ms 2) Debug kernel with CONFIG_KASAN [ 146.288115] node 1 initialised, 132075466 pages in 143052ms So the page init time in a debug kernel was 20X of the non-debug kernel. The long init time can be problematic as the page initialization is done with interrupt disabled. In this particular case, it caused the appearance of following warning messages as well as NMI backtraces of all the cores that were doing the initialization. [ 68.240049] rcu: INFO: rcu_sched detected stalls on CPUs/tasks: [ 68.241000] rcu: 25-...0: (100 ticks this GP) idle=b72/1/0x4000000000000000 softirq=915/915 fqs=16252 [ 68.241000] rcu: 44-...0: (95 ticks this GP) idle=49a/1/0x4000000000000000 softirq=788/788 fqs=16253 [ 68.241000] rcu: 54-...0: (104 ticks this GP) idle=03a/1/0x4000000000000000 softirq=721/825 fqs=16253 [ 68.241000] rcu: 60-...0: (103 ticks this GP) idle=cbe/1/0x4000000000000000 softirq=637/740 fqs=16253 [ 68.241000] rcu: 72-...0: (105 ticks this GP) idle=786/1/0x4000000000000000 softirq=536/641 fqs=16253 [ 68.241000] rcu: 84-...0: (99 ticks this GP) idle=292/1/0x4000000000000000 softirq=537/537 fqs=16253 [ 68.241000] rcu: 111-...0: (104 ticks this GP) idle=bde/1/0x4000000000000000 softirq=474/476 fqs=16253 [ 68.241000] rcu: (detected by 13, t=65018 jiffies, g=249, q=2) The long init time was mainly caused by the call to kasan_free_pages() to poison the newly initialized pages. On a 4TB system, we are talking about almost 500GB of memory probably on the same node. In reality, we may not need to poison the newly initialized pages before they are ever allocated. So KASAN poisoning of freed pages before the completion of deferred memory initialization is now disabled. Those pages will be properly poisoned when they are allocated or freed after deferred pages initialization is done. With this change, the new page initialization time became: [ 21.948010] node 1 initialised, 132075466 pages in 18702ms This was still about double the non-debug kernel time, but was much better than before. Link: http://lkml.kernel.org/r/1544459388-8736-1-git-send-email-longman@redhat.com Signed-off-by: Waiman Long Reviewed-by: Andrew Morton Cc: Andrey Ryabinin Cc: Alexander Potapenko Cc: Dmitry Vyukov Cc: Michal Hocko Cc: Pasha Tatashin Cc: Oscar Salvador Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/page_alloc.c | 37 +++++++++++++++++++++++++++++-------- 1 file changed, 29 insertions(+), 8 deletions(-) commit 3cfd22be0ad663248fadfc8f6ffa3e255c394552 Author: Peter Xu Date: Fri Dec 28 00:38:47 2018 -0800 userfaultfd: clear flag if remap event not enabled When the process being tracked does mremap() without UFFD_FEATURE_EVENT_REMAP on the corresponding tracking uffd file handle, we should not generate the remap event, and at the same time we should clear all the uffd flags on the new VMA. Without this patch, we can still have the VM_UFFD_MISSING|VM_UFFD_WP flags on the new VMA even the fault handling process does not even know the existance of the VMA. Link: http://lkml.kernel.org/r/20181211053409.20317-1-peterx@redhat.com Signed-off-by: Peter Xu Reviewed-by: Andrea Arcangeli Acked-by: Mike Rapoport Reviewed-by: William Kucharski Cc: Andrea Arcangeli Cc: Mike Rapoport Cc: Kirill A. Shutemov Cc: Hugh Dickins Cc: Pavel Emelyanov Cc: Pravin Shedge Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/userfaultfd.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) commit 125b860b251ad226b1384b6db06be37485127f69 Author: Pingfan Liu Date: Fri Dec 28 00:38:43 2018 -0800 mm/pageblock: throw compile error if pageblock_bits cannot hold MIGRATE_TYPES Currently, NR_PAGEBLOCK_BITS and MIGRATE_TYPES are not associated by code. If someone adds extra migrate type, then he may forget to enlarge the NR_PAGEBLOCK_BITS. Hence it requires some way to fix. NR_PAGEBLOCK_BITS depends on MIGRATE_TYPES, while these macro spread on two different .h file with reverse dependency, it is a little hard to refer to MIGRATE_TYPES in pageblock-flag.h. This patch tries to remind such relation in compiling-time. Link: http://lkml.kernel.org/r/1544508709-11358-1-git-send-email-kernelfans@gmail.com Signed-off-by: Pingfan Liu Reviewed-by: Andrew Morton Acked-by: Vlastimil Babka Cc: Michal Hocko Cc: Pavel Tatashin Cc: Oscar Salvador Cc: Mike Rapoport Cc: Joonsoo Kim Cc: Alexander Duyck Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/pageblock-flags.h | 3 ++- mm/page_alloc.c | 1 + 2 files changed, 3 insertions(+), 1 deletion(-) commit fcf9a0ef8dc3a3fb8be9de12b0e006c85ed5dc29 Author: Kirill Tkhai Date: Fri Dec 28 00:38:40 2018 -0800 ksm: react on changing "sleep_millisecs" parameter faster ksm thread unconditionally sleeps in ksm_scan_thread() after each iteration: schedule_timeout_interruptible( msecs_to_jiffies(ksm_thread_sleep_millisecs)) The timeout is configured in /sys/kernel/mm/ksm/sleep_millisecs. In case of user writes a big value by a mistake, and the thread enters into schedule_timeout_interruptible(), it's not possible to cancel the sleep by writing a new smaler value; the thread is just sleeping till timeout expires. The patch fixes the problem by waking the thread each time after the value is updated. This also may be useful for debug purposes; and also for userspace daemons, which change sleep_millisecs value in dependence of system load. Link: http://lkml.kernel.org/r/154454107680.3258.3558002210423531566.stgit@localhost.localdomain Signed-off-by: Kirill Tkhai Acked-by: Cyrill Gorcunov Reviewed-by: Andrew Morton Cc: Michal Hocko Cc: Hugh Dickins Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/ksm.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) commit e0975b2aae0e669f995f7d5f11db25c3080ae11c Author: Michal Hocko Date: Fri Dec 28 00:38:36 2018 -0800 mm, fault_around: do not take a reference to a locked page filemap_map_pages takes a speculative reference to each page in the range before it tries to lock that page. While this is correct it also can influence page migration which will bail out when seeing an elevated reference count. The faultaround code would bail on seeing a locked page so we can pro-actively check the PageLocked bit before page_cache_get_speculative and prevent from pointless reference count churn. Link: http://lkml.kernel.org/r/20181211142741.2607-4-mhocko@kernel.org Signed-off-by: Michal Hocko Suggested-by: Jan Kara Acked-by: Kirill A. Shutemov Reviewed-by: David Hildenbrand Acked-by: Hugh Dickins Reviewed-by: William Kucharski Cc: Oscar Salvador Cc: Pavel Tatashin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/filemap.c | 7 +++++++ 1 file changed, 7 insertions(+) commit bb8965bd82fd4ed433a888f1383016ab3fa0d7de Author: Michal Hocko Date: Fri Dec 28 00:38:32 2018 -0800 mm, memory_hotplug: deobfuscate migration part of offlining Memory migration might fail during offlining and we keep retrying in that case. This is currently obfuscated by goto retry loop. The code is hard to follow and as a result it is even suboptimal becase each retry round scans the full range from start_pfn even though we have successfully scanned/migrated [start_pfn, pfn] range already. This is all only because check_pages_isolated failure has to rescan the full range again. De-obfuscate the migration retry loop by promoting it to a real for loop. In fact remove the goto altogether by making it a proper double loop (yeah, gotos are nasty in this specific case). In the end we will get a slightly more optimal code which is better readable. [akpm@linux-foundation.org: reflow comments to 80 cols] Link: http://lkml.kernel.org/r/20181211142741.2607-3-mhocko@kernel.org Signed-off-by: Michal Hocko Reviewed-by: David Hildenbrand Reviewed-by: Oscar Salvador Cc: Hugh Dickins Cc: Jan Kara Cc: Kirill A. Shutemov Cc: Pavel Tatashin Cc: William Kucharski Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/memory_hotplug.c | 62 ++++++++++++++++++++++++++++------------------------- 1 file changed, 33 insertions(+), 29 deletions(-) commit a85009c377929d119fad5a75a16c4b7198946603 Author: Michal Hocko Date: Fri Dec 28 00:38:29 2018 -0800 mm, memory_hotplug: try to migrate full pfn range Patch series "few memory offlining enhancements". I have been chasing memory offlining not making progress recently. On the way I have noticed few weird decisions in the code. The migration itself is restricted without a reasonable justification and the retry loop around the migration is quite messy. This is addressed by patch 1 and patch 2. Patch 3 is targeting on the faultaround code which has been a hot candidate for the initial issue reported upstream [2] and that I am debugging internally. It turned out to be not the main contributor in the end but I believe we should address it regardless. See the patch description for more details. [1] http://lkml.kernel.org/r/20181120134323.13007-1-mhocko@kernel.org [2] http://lkml.kernel.org/r/20181114070909.GB2653@MiWiFi-R3L-srv This patch (of 3): do_migrate_range has been limiting the number of pages to migrate to 256 for some reason which is not documented. Even if the limit made some sense back then when it was introduced it doesn't really serve a good purpose these days. If the range contains huge pages then we break out of the loop too early and go through LRU and pcp caches draining and scan_movable_pages is quite suboptimal. The only reason to limit the number of pages I can think of is to reduce the potential time to react on the fatal signal. But even then the number of pages is a questionable metric because even a single page migration might block in a non-killable state (e.g. __unmap_and_move). Remove the limit and offline the full requested range (this is one memblock worth of pages with the current code). Should we ever get a report that offlining takes too long to react on fatal signal then we should rather fix the core migration to use killable waits and bailout on a signal. Link: http://lkml.kernel.org/r/20181211142741.2607-1-mhocko@kernel.org Link: http://lkml.kernel.org/r/20181211142741.2607-2-mhocko@kernel.org Signed-off-by: Michal Hocko Reviewed-by: David Hildenbrand Reviewed-by: Pavel Tatashin Reviewed-by: Oscar Salvador Cc: Hugh Dickins Cc: Jan Kara Cc: Kirill A. Shutemov Cc: William Kucharski Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/memory_hotplug.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) commit a1400af755631f5267f7cc3d0fda5ba72f58d7d3 Author: Michal Hocko Date: Fri Dec 28 00:38:25 2018 -0800 mm, proc: report PR_SET_THP_DISABLE in proc David Rientjes has reported that commit 1860033237d4 ("mm: make PR_SET_THP_DISABLE immediately active") has changed the way how we report THPable VMAs to the userspace. Their monitoring tool is triggering false alarms on PR_SET_THP_DISABLE tasks because it considers an insufficient THP usage as a memory fragmentation resp. memory pressure issue. Before the said commit each newly created VMA inherited VM_NOHUGEPAGE flag and that got exposed to the userspace via /proc//smaps file. This implementation had its downsides as explained in the commit message but it is true that the userspace doesn't have any means to query for the process wide THP enabled/disabled status. PR_SET_THP_DISABLE is a process wide flag so it makes a lot of sense to export in the process wide context rather than per-vma. Introduce a new field to /proc//status which export this status. If PR_SET_THP_DISABLE is used then it reports false same as when the THP is not compiled in. It doesn't consider the global THP status because we already export that information via sysfs Link: http://lkml.kernel.org/r/20181211143641.3503-4-mhocko@kernel.org Fixes: 1860033237d4 ("mm: make PR_SET_THP_DISABLE immediately active") Signed-off-by: Michal Hocko Acked-by: Vlastimil Babka Reported-by: David Rientjes Cc: Dan Williams Cc: Jan Kara Cc: Mike Rapoport Cc: Paul Oppenheimer Cc: William Kucharski Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Documentation/filesystems/proc.txt | 3 +++ fs/proc/array.c | 10 ++++++++++ 2 files changed, 13 insertions(+) commit 7635d9cbe8327e131a1d3d8517dc186c2796ce2e Author: Michal Hocko Date: Fri Dec 28 00:38:21 2018 -0800 mm, thp, proc: report THP eligibility for each vma Userspace falls short when trying to find out whether a specific memory range is eligible for THP. There are usecases that would like to know that http://lkml.kernel.org/r/alpine.DEB.2.21.1809251248450.50347@chino.kir.corp.google.com : This is used to identify heap mappings that should be able to fault thp : but do not, and they normally point to a low-on-memory or fragmentation : issue. The only way to deduce this now is to query for hg resp. nh flags and confronting the state with the global setting. Except that there is also PR_SET_THP_DISABLE that might change the picture. So the final logic is not trivial. Moreover the eligibility of the vma depends on the type of VMA as well. In the past we have supported only anononymous memory VMAs but things have changed and shmem based vmas are supported as well these days and the query logic gets even more complicated because the eligibility depends on the mount option and another global configuration knob. Simplify the current state and report the THP eligibility in /proc//smaps for each existing vma. Reuse transparent_hugepage_enabled for this purpose. The original implementation of this function assumes that the caller knows that the vma itself is supported for THP so make the core checks into __transparent_hugepage_enabled and use it for existing callers. __show_smap just use the new transparent_hugepage_enabled which also checks the vma support status (please note that this one has to be out of line due to include dependency issues). [mhocko@kernel.org: fix oops with NULL ->f_mapping] Link: http://lkml.kernel.org/r/20181224185106.GC16738@dhcp22.suse.cz Link: http://lkml.kernel.org/r/20181211143641.3503-3-mhocko@kernel.org Signed-off-by: Michal Hocko Acked-by: Vlastimil Babka Cc: Dan Williams Cc: David Rientjes Cc: Jan Kara Cc: Mike Rapoport Cc: Paul Oppenheimer Cc: William Kucharski Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Documentation/filesystems/proc.txt | 3 +++ fs/proc/task_mmu.c | 2 ++ include/linux/huge_mm.h | 13 ++++++++++++- mm/huge_memory.c | 12 +++++++++++- mm/memory.c | 4 ++-- 5 files changed, 30 insertions(+), 4 deletions(-) commit 7550c6079846a24f30d15ac75a941c8515dbedfb Author: Michal Hocko Date: Fri Dec 28 00:38:17 2018 -0800 mm, proc: be more verbose about unstable VMA flags in /proc//smaps Patch series "THP eligibility reporting via proc". This series of three patches aims at making THP eligibility reporting much more robust and long term sustainable. The trigger for the change is a regression report [2] and the long follow up discussion. In short the specific application didn't have good API to query whether a particular mapping can be backed by THP so it has used VMA flags to workaround that. These flags represent a deep internal state of VMAs and as such they should be used by userspace with a great deal of caution. A similar has happened for [3] when users complained that VM_MIXEDMAP is no longer set on DAX mappings. Again a lack of a proper API led to an abuse. The first patch in the series tries to emphasise that that the semantic of flags might change and any application consuming those should be really careful. The remaining two patches provide a more suitable interface to address [2] and provide a consistent API to query the THP status both for each VMA and process wide as well. [1] http://lkml.kernel.org/r/20181120103515.25280-1-mhocko@kernel.org [2] http://lkml.kernel.org/r/http://lkml.kernel.org/r/alpine.DEB.2.21.1809241054050.224429@chino.kir.corp.google.com [3] http://lkml.kernel.org/r/20181002100531.GC4135@quack2.suse.cz This patch (of 3): Even though vma flags exported via /proc//smaps are explicitly documented to be not guaranteed for future compatibility the warning doesn't go far enough because it doesn't mention semantic changes to those flags. And they are important as well because these flags are a deep implementation internal to the MM code and the semantic might change at any time. Let's consider two recent examples: http://lkml.kernel.org/r/20181002100531.GC4135@quack2.suse.cz : commit e1fb4a086495 "dax: remove VM_MIXEDMAP for fsdax and device dax" has : removed VM_MIXEDMAP flag from DAX VMAs. Now our testing shows that in the : mean time certain customer of ours started poking into /proc//smaps : and looks at VMA flags there and if VM_MIXEDMAP is missing among the VMA : flags, the application just fails to start complaining that DAX support is : missing in the kernel. http://lkml.kernel.org/r/alpine.DEB.2.21.1809241054050.224429@chino.kir.corp.google.com : Commit 1860033237d4 ("mm: make PR_SET_THP_DISABLE immediately active") : introduced a regression in that userspace cannot always determine the set : of vmas where thp is ineligible. : Userspace relies on the "nh" flag being emitted as part of /proc/pid/smaps : to determine if a vma is eligible to be backed by hugepages. : Previous to this commit, prctl(PR_SET_THP_DISABLE, 1) would cause thp to : be disabled and emit "nh" as a flag for the corresponding vmas as part of : /proc/pid/smaps. After the commit, thp is disabled by means of an mm : flag and "nh" is not emitted. : This causes smaps parsing libraries to assume a vma is eligible for thp : and ends up puzzling the user on why its memory is not backed by thp. In both cases userspace was relying on a semantic of a specific VMA flag. The primary reason why that happened is a lack of a proper interface. While this has been worked on and it will be fixed properly, it seems that our wording could see some refinement and be more vocal about semantic aspect of these flags as well. Link: http://lkml.kernel.org/r/20181211143641.3503-2-mhocko@kernel.org Signed-off-by: Michal Hocko Acked-by: Jan Kara Acked-by: Dan Williams Acked-by: David Rientjes Acked-by: Mike Rapoport Acked-by: Vlastimil Babka Cc: Dan Williams Cc: David Rientjes Cc: Paul Oppenheimer Cc: William Kucharski Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Documentation/filesystems/proc.txt | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 0614ce9776b037b6a08a9adcbfcc382c0053b178 Author: Wei Yang Date: Fri Dec 28 00:38:13 2018 -0800 include/linux/memory_hotplug.h: remove duplicate declaration of offline_pages() offline_pages() is already declared in this file. Just remove the duplicated one. Link: http://lkml.kernel.org/r/20181205031357.24769-1-richard.weiyang@gmail.com Signed-off-by: Wei Yang Reviewed-by: David Hildenbrand Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/memory_hotplug.h | 1 - 1 file changed, 1 deletion(-) commit ac46d4f3c43241ffa23d5bf36153a0830c0e02cc Author: Jérôme Glisse Date: Fri Dec 28 00:38:09 2018 -0800 mm/mmu_notifier: use structure for invalidate_range_start/end calls v2 To avoid having to change many call sites everytime we want to add a parameter use a structure to group all parameters for the mmu_notifier invalidate_range_start/end cakks. No functional changes with this patch. [akpm@linux-foundation.org: coding style fixes] Link: http://lkml.kernel.org/r/20181205053628.3210-3-jglisse@redhat.com Signed-off-by: Jérôme Glisse Acked-by: Christian König Acked-by: Jan Kara Cc: Matthew Wilcox Cc: Ross Zwisler Cc: Dan Williams Cc: Paolo Bonzini Cc: Radim Krcmar Cc: Michal Hocko Cc: Felix Kuehling Cc: Ralph Campbell Cc: John Hubbard From: Jérôme Glisse Subject: mm/mmu_notifier: use structure for invalidate_range_start/end calls v3 fix build warning in migrate.c when CONFIG_MMU_NOTIFIER=n Link: http://lkml.kernel.org/r/20181213171330.8489-3-jglisse@redhat.com Signed-off-by: Jérôme Glisse Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/dax.c | 8 ++-- fs/proc/task_mmu.c | 7 +++- include/linux/mm.h | 6 ++- include/linux/mmu_notifier.h | 87 +++++++++++++++++++++++++------------- kernel/events/uprobes.c | 10 ++--- mm/huge_memory.c | 54 +++++++++++------------- mm/hugetlb.c | 52 +++++++++++------------ mm/khugepaged.c | 10 ++--- mm/ksm.c | 21 ++++------ mm/madvise.c | 21 +++++----- mm/memory.c | 99 ++++++++++++++++++++++---------------------- mm/migrate.c | 28 ++++++------- mm/mmu_notifier.c | 37 ++++------------- mm/mprotect.c | 15 +++---- mm/mremap.c | 10 ++--- mm/oom_kill.c | 17 ++++---- mm/rmap.c | 30 ++++++++------ 17 files changed, 262 insertions(+), 250 deletions(-) commit 5d6527a784f7a6d247961e046e830de8d71b47d1 Author: Jérôme Glisse Date: Fri Dec 28 00:38:05 2018 -0800 mm/mmu_notifier: use structure for invalidate_range_start/end callback Patch series "mmu notifier contextual informations", v2. This patchset adds contextual information, why an invalidation is happening, to mmu notifier callback. This is necessary for user of mmu notifier that wish to maintains their own data structure without having to add new fields to struct vm_area_struct (vma). For instance device can have they own page table that mirror the process address space. When a vma is unmap (munmap() syscall) the device driver can free the device page table for the range. Today we do not have any information on why a mmu notifier call back is happening and thus device driver have to assume that it is always an munmap(). This is inefficient at it means that it needs to re-allocate device page table on next page fault and rebuild the whole device driver data structure for the range. Other use case beside munmap() also exist, for instance it is pointless for device driver to invalidate the device page table when the invalidation is for the soft dirtyness tracking. Or device driver can optimize away mprotect() that change the page table permission access for the range. This patchset enables all this optimizations for device drivers. I do not include any of those in this series but another patchset I am posting will leverage this. The patchset is pretty simple from a code point of view. The first two patches consolidate all mmu notifier arguments into a struct so that it is easier to add/change arguments. The last patch adds the contextual information (munmap, protection, soft dirty, clear, ...). This patch (of 3): To avoid having to change many callback definition everytime we want to add a parameter use a structure to group all parameters for the mmu_notifier invalidate_range_start/end callback. No functional changes with this patch. [akpm@linux-foundation.org: fix drivers/gpu/drm/amd/amdgpu/amdgpu_mn.c kerneldoc] Link: http://lkml.kernel.org/r/20181205053628.3210-2-jglisse@redhat.com Signed-off-by: Jérôme Glisse Acked-by: Jan Kara Acked-by: Jason Gunthorpe [infiniband] Cc: Matthew Wilcox Cc: Ross Zwisler Cc: Dan Williams Cc: Paolo Bonzini Cc: Radim Krcmar Cc: Michal Hocko Cc: Christian Koenig Cc: Felix Kuehling Cc: Ralph Campbell Cc: John Hubbard Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/gpu/drm/amd/amdgpu/amdgpu_mn.c | 47 ++++++++++++++------------------- drivers/gpu/drm/i915/i915_gem_userptr.c | 14 +++++----- drivers/gpu/drm/radeon/radeon_mn.c | 16 +++++------ drivers/infiniband/core/umem_odp.c | 20 ++++++-------- drivers/infiniband/hw/hfi1/mmu_rb.c | 13 ++++----- drivers/misc/mic/scif/scif_dma.c | 11 +++----- drivers/misc/sgi-gru/grutlbpurge.c | 14 +++++----- drivers/xen/gntdev.c | 12 ++++----- include/linux/mmu_notifier.h | 14 ++++++---- mm/hmm.c | 23 +++++++--------- mm/mmu_notifier.c | 21 +++++++++++++-- virt/kvm/kvm_main.c | 14 ++++------ 12 files changed, 103 insertions(+), 116 deletions(-) commit b15c87263a69272423771118c653e9a1d0672caa Author: Michal Hocko Date: Fri Dec 28 00:38:01 2018 -0800 hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined We have received a bug report that an injected MCE about faulty memory prevents memory offline to succeed on 4.4 base kernel. The underlying reason was that the HWPoison page has an elevated reference count and the migration keeps failing. There are two problems with that. First of all it is dubious to migrate the poisoned page because we know that accessing that memory is possible to fail. Secondly it doesn't make any sense to migrate a potentially broken content and preserve the memory corruption over to a new location. Oscar has found out that 4.4 and the current upstream kernels behave slightly differently with his simply testcase === int main(void) { int ret; int i; int fd; char *array = malloc(4096); char *array_locked = malloc(4096); fd = open("/tmp/data", O_RDONLY); read(fd, array, 4095); for (i = 0; i < 4096; i++) array_locked[i] = 'd'; ret = mlock((void *)PAGE_ALIGN((unsigned long)array_locked), sizeof(array_locked)); if (ret) perror("mlock"); sleep (20); ret = madvise((void *)PAGE_ALIGN((unsigned long)array_locked), 4096, MADV_HWPOISON); if (ret) perror("madvise"); for (i = 0; i < 4096; i++) array_locked[i] = 'd'; return 0; } === + offline this memory. In 4.4 kernels he saw the hwpoisoned page to be returned back to the LRU list kernel: [] dump_trace+0x59/0x340 kernel: [] show_stack_log_lvl+0xea/0x170 kernel: [] show_stack+0x21/0x40 kernel: [] dump_stack+0x5c/0x7c kernel: [] warn_slowpath_common+0x81/0xb0 kernel: [] __pagevec_lru_add_fn+0x14c/0x160 kernel: [] pagevec_lru_move_fn+0xad/0x100 kernel: [] __lru_cache_add+0x6c/0xb0 kernel: [] add_to_page_cache_lru+0x46/0x70 kernel: [] extent_readpages+0xc3/0x1a0 [btrfs] kernel: [] __do_page_cache_readahead+0x177/0x200 kernel: [] ondemand_readahead+0x168/0x2a0 kernel: [] generic_file_read_iter+0x41f/0x660 kernel: [] __vfs_read+0xcd/0x140 kernel: [] vfs_read+0x7a/0x120 kernel: [] kernel_read+0x3b/0x50 kernel: [] do_execveat_common.isra.29+0x490/0x6f0 kernel: [] do_execve+0x28/0x30 kernel: [] call_usermodehelper_exec_async+0xfb/0x130 kernel: [] ret_from_fork+0x55/0x80 And that latter confuses the hotremove path because an LRU page is attempted to be migrated and that fails due to an elevated reference count. It is quite possible that the reuse of the HWPoisoned page is some kind of fixed race condition but I am not really sure about that. With the upstream kernel the failure is slightly different. The page doesn't seem to have LRU bit set but isolate_movable_page simply fails and do_migrate_range simply puts all the isolated pages back to LRU and therefore no progress is made and scan_movable_pages finds same set of pages over and over again. Fix both cases by explicitly checking HWPoisoned pages before we even try to get reference on the page, try to unmap it if it is still mapped. As explained by Naoya: : Hwpoison code never unmapped those for no big reason because : Ksm pages never dominate memory, so we simply didn't have strong : motivation to save the pages. Also put WARN_ON(PageLRU) in case there is a race and we can hit LRU HWPoison pages which shouldn't happen but I couldn't convince myself about that. Naoya has noted the following: : Theoretically no such gurantee, because try_to_unmap() doesn't have a : guarantee of success and then memory_failure() returns immediately : when hwpoison_user_mappings fails. : Or the following code (comes after hwpoison_user_mappings block) also impli= : es : that the target page can still have PageLRU flag. : : /* : * Torn down by someone else? : */ : if (PageLRU(p) && !PageSwapCache(p) && p->mapping =3D=3D NULL) { : action_result(pfn, MF_MSG_TRUNCATED_LRU, MF_IGNORED); : res =3D -EBUSY; : goto out; : } : : So I think it's OK to keep "if (WARN_ON(PageLRU(page)))" block in : current version of your patch. Link: http://lkml.kernel.org/r/20181206120135.14079-1-mhocko@kernel.org Signed-off-by: Michal Hocko Reviewed-by: Oscar Salvador Debugged-by: Oscar Salvador Tested-by: Oscar Salvador Acked-by: David Hildenbrand Acked-by: Naoya Horiguchi Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/memory_hotplug.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) commit 9f1eb38e0e1131e75cc4ac684391b25d70282589 Author: Oscar Salvador Date: Fri Dec 28 00:37:57 2018 -0800 mm, kmemleak: little optimization while scanning kmemleak_scan() goes through all online nodes and tries to scan all used pages. We can do better and use pfn_to_online_page(), so in case we have CONFIG_MEMORY_HOTPLUG, offlined pages will be skiped automatically. For boxes where CONFIG_MEMORY_HOTPLUG is not present, pfn_to_online_page() will fallback to pfn_valid(). Another little optimization is to check if the page belongs to the node we are currently checking, so in case we have nodes interleaved we will not check the same pfn multiple times. I ran some tests: Add some memory to node1 and node2 making it interleaved: (qemu) object_add memory-backend-ram,id=ram0,size=1G (qemu) device_add pc-dimm,id=dimm0,memdev=ram0,node=1 (qemu) object_add memory-backend-ram,id=ram1,size=1G (qemu) device_add pc-dimm,id=dimm1,memdev=ram1,node=2 (qemu) object_add memory-backend-ram,id=ram2,size=1G (qemu) device_add pc-dimm,id=dimm2,memdev=ram2,node=1 Then, we offline that memory: # for i in {32..39} ; do echo "offline" > /sys/devices/system/node/node1/memory$i/state;done # for i in {48..55} ; do echo "offline" > /sys/devices/system/node/node1/memory$i/state;don # for i in {40..47} ; do echo "offline" > /sys/devices/system/node/node2/memory$i/state;done And we run kmemleak_scan: # echo "scan" > /sys/kernel/debug/kmemleak before the patch: kmemleak: time spend: 41596 us after the patch: kmemleak: time spend: 34899 us [akpm@linux-foundation.org: remove stray newline, per Oscar] Link: http://lkml.kernel.org/r/20181206131918.25099-1-osalvador@suse.de Signed-off-by: Oscar Salvador Reviewed-by: Wei Yang Suggested-by: Michal Hocko Acked-by: Catalin Marinas Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/kmemleak.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 8e2d43405b22e98cf5f3730c1829ec1fdbe17ae7 Author: Will Deacon Date: Fri Dec 28 00:37:53 2018 -0800 lib/ioremap: ensure break-before-make is used for huge p4d mappings Whilst no architectures actually enable support for huge p4d mappings in the vmap area, the code that is implemented should be using break-before-make, as we do for pud and pmd huge entries. Link: http://lkml.kernel.org/r/1544120495-17438-6-git-send-email-will.deacon@arm.com Signed-off-by: Will Deacon Reviewed-by: Toshi Kani Cc: Chintan Pandya Cc: Toshi Kani Cc: Thomas Gleixner Cc: Michal Hocko Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Sean Christopherson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/arm64/mm/mmu.c | 5 +++++ arch/x86/mm/pgtable.c | 8 ++++++++ include/asm-generic/pgtable.h | 5 +++++ lib/ioremap.c | 27 +++++++++++++++++++++------ 4 files changed, 39 insertions(+), 6 deletions(-) commit 36ddc5a78c878e9b10c323d2fe88b0dae2f487eb Author: Will Deacon Date: Fri Dec 28 00:37:49 2018 -0800 lib/ioremap: ensure phys_addr actually corresponds to a physical address The current ioremap() code uses a phys_addr variable at each level of page table, which is confusingly offset by subtracting the base virtual address being mapped so that adding the current virtual address back on when iterating through the page table entries gives back the corresponding physical address. This is fairly confusing and results in all users of phys_addr having to add the current virtual address back on. Instead, this patch just updates phys_addr when iterating over the page table entries, ensuring that it's always up-to-date and doesn't require explicit offsetting. Link: http://lkml.kernel.org/r/1544120495-17438-5-git-send-email-will.deacon@arm.com Signed-off-by: Will Deacon Tested-by: Sean Christopherson Reviewed-by: Sean Christopherson Cc: Chintan Pandya Cc: Toshi Kani Cc: Thomas Gleixner Cc: Michal Hocko Cc: Sean Christopherson Cc: "H. Peter Anvin" Cc: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds lib/ioremap.c | 28 ++++++++++++---------------- 1 file changed, 12 insertions(+), 16 deletions(-) commit 48e178ab0d630b8b60deca64b22b22e68818777e Author: Will Deacon Date: Fri Dec 28 00:37:45 2018 -0800 x86/pgtable: drop pXd_none() checks from pXd_free_pYd_table() The core code already has a check for pXd_none(), so remove it from the architecture implementation. Link: http://lkml.kernel.org/r/1544120495-17438-4-git-send-email-will.deacon@arm.com Signed-off-by: Will Deacon Acked-by: Thomas Gleixner Reviewed-by: Toshi Kani Cc: Chintan Pandya Cc: Toshi Kani Cc: Michal Hocko Cc: Ingo Molnar Cc: "H. Peter Anvin" Cc: Sean Christopherson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/x86/mm/pgtable.c | 6 ------ 1 file changed, 6 deletions(-) commit 9c006972c3fedbea43fde9667686e5949eba9981 Author: Will Deacon Date: Fri Dec 28 00:37:42 2018 -0800 arm64: mmu: drop pXd_present() checks from pXd_free_pYd_table() The core code already has a check for pXd_none(), so remove it from the architecture implementation. Link: http://lkml.kernel.org/r/1544120495-17438-3-git-send-email-will.deacon@arm.com Signed-off-by: Will Deacon Cc: Chintan Pandya Cc: Toshi Kani Cc: Thomas Gleixner Cc: Michal Hocko Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Sean Christopherson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/arm64/mm/mmu.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) commit d239865ac804c91a621294ca7bece4241b006fae Author: Will Deacon Date: Fri Dec 28 00:37:38 2018 -0800 ioremap: rework pXd_free_pYd_page() API The recently merged API for ensuring break-before-make on page-table entries when installing huge mappings in the vmalloc/ioremap region is fairly counter-intuitive, resulting in the arch freeing functions (e.g. pmd_free_pte_page()) being called even on entries that aren't present. This resulted in a minor bug in the arm64 implementation, giving rise to spurious VM_WARN messages. This patch moves the pXd_present() checks out into the core code, refactoring the callsites at the same time so that we avoid the complex conjunctions when determining whether or not we can put down a huge mapping. Link: http://lkml.kernel.org/r/1544120495-17438-2-git-send-email-will.deacon@arm.com Signed-off-by: Will Deacon Reviewed-by: Toshi Kani Suggested-by: Linus Torvalds Cc: Chintan Pandya Cc: Toshi Kani Cc: Thomas Gleixner Cc: Michal Hocko Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Sean Christopherson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds lib/ioremap.c | 56 ++++++++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 42 insertions(+), 14 deletions(-) commit c16eb000ca03f8cdc2153bca6c977b6f898e6934 Author: Kirill Tkhai Date: Fri Dec 28 00:37:35 2018 -0800 mm/filemap.c: remove useless check in pagecache_get_page() page always is not NULL, so we may remove this useless check. Link: http://lkml.kernel.org/r/154419752044.18559.2452963074922917720.stgit@localhost.localdomain Signed-off-by: Kirill Tkhai Acked-by: Cyrill Gorcunov Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/filemap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 144552ff8995dd34d049a203d636b259ab751137 Author: Anthony Yznaga Date: Fri Dec 28 00:37:31 2018 -0800 /proc/kpagecount: return 0 for special pages that are never mapped Certain pages that are never mapped to userspace have a type indicated in the page_type field of their struct pages (e.g. PG_buddy). page_type overlaps with _mapcount so set the count to 0 and avoid calling page_mapcount() for these pages. [anthony.yznaga@oracle.com: incorporate feedback from Matthew Wilcox] Link: http://lkml.kernel.org/r/1544481313-27318-1-git-send-email-anthony.yznaga@oracle.com Link: http://lkml.kernel.org/r/1543963526-27917-1-git-send-email-anthony.yznaga@oracle.com Signed-off-by: Anthony Yznaga Reviewed-by: Andrew Morton Acked-by: Matthew Wilcox Reviewed-by: Naoya Horiguchi Cc: Vlastimil Babka Cc: David Rientjes Cc: Alexey Dobriyan Cc: Kirill A. Shutemov Cc: Mike Rapoport Cc: Michal Hocko Cc: Alexander Duyck Cc: Johannes Weiner Cc: Miles Chen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/proc/page.c | 2 +- include/linux/page-flags.h | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) commit b6fb87b8e3ff1ef6bcf68470f24a97c984554d5a Author: Anthony Yznaga Date: Fri Dec 28 00:37:27 2018 -0800 tools/vm/page-types.c: fix "kpagecount returned fewer pages than expected" failures Because kpagecount_read() fakes success if map counts are not being collected, clamp the page count passed to it by walk_pfn() to the pages value returned by the preceding call to kpageflags_read(). Link: http://lkml.kernel.org/r/1543962269-26116-1-git-send-email-anthony.yznaga@oracle.com Fixes: 7f1d23e60718 ("tools/vm/page-types.c: include shared map counts") Signed-off-by: Anthony Yznaga Reviewed-by: Naoya Horiguchi Cc: Vlastimil Babka Cc: Matthew Wilcox Cc: David Rientjes Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds tools/vm/page-types.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bbe5d9939e81277bfbfb8fdba68374024b16d5fa Author: Oscar Salvador Date: Fri Dec 28 00:37:24 2018 -0800 mm/page_alloc.c: drop uneeded __meminit and __meminitdata Since commit 03e85f9d5f1 ("mm/page_alloc: Introduce free_area_init_core_hotplug"), some functions changed to only be called during system initialization. Concretly, free_area_init_node() and the functions that hang from it. Also, some variables are no longer used after the system has gone through initialization. So this could be considered as a late clean-up for that patch. This patch changes the functions from __meminit to __init, and the variables from __meminitdata to __initdata. In return, we get some KBs back: Before: Freeing unused kernel image memory: 2472K After: Freeing unused kernel image memory: 2480K Link: http://lkml.kernel.org/r/20181204111507.4808-1-osalvador@suse.de Signed-off-by: Oscar Salvador Reviewed-by: Wei Yang Cc: Michal Hocko Cc: Pavel Tatashin Cc: Vlastimil Babka Cc: Alexander Duyck Cc: David Hildenbrand Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/page_alloc.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) commit 3fa750dcf29e8606e3969d13d8e188cc1c0f511d Author: Brian Foster Date: Fri Dec 28 00:37:20 2018 -0800 mm/page-writeback.c: don't break integrity writeback on ->writepage() error write_cache_pages() is used in both background and integrity writeback scenarios by various filesystems. Background writeback is mostly concerned with cleaning a certain number of dirty pages based on various mm heuristics. It may not write the full set of dirty pages or wait for I/O to complete. Integrity writeback is responsible for persisting a set of dirty pages before the writeback job completes. For example, an fsync() call must perform integrity writeback to ensure data is on disk before the call returns. write_cache_pages() unconditionally breaks out of its processing loop in the event of a ->writepage() error. This is fine for background writeback, which had no strict requirements and will eventually come around again. This can cause problems for integrity writeback on filesystems that might need to clean up state associated with failed page writeouts. For example, XFS performs internal delayed allocation accounting before returning a ->writepage() error, where applicable. If the current writeback happens to be associated with an unmount and write_cache_pages() completes the writeback prematurely due to error, the filesystem is unmounted in an inconsistent state if dirty+delalloc pages still exist. To handle this problem, update write_cache_pages() to always process the full set of pages for integrity writeback regardless of ->writepage() errors. Save the first encountered error and return it to the caller once complete. This facilitates XFS (or any other fs that expects integrity writeback to process the entire set of dirty pages) to clean up its internal state completely in the event of persistent mapping errors. Background writeback continues to exit on the first error encountered. [akpm@linux-foundation.org: fix typo in comment] Link: http://lkml.kernel.org/r/20181116134304.32440-1-bfoster@redhat.com Signed-off-by: Brian Foster Reviewed-by: Jan Kara Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/page-writeback.c | 35 +++++++++++++++++++++-------------- 1 file changed, 21 insertions(+), 14 deletions(-) commit c3a5c77afefa697bf87f15272c7257e1574cad56 Author: Wei Yang Date: Fri Dec 28 00:37:16 2018 -0800 lib/show_mem.c: drop pgdat_resize_lock in show_mem() Function show_mem() is used to print system memory status when user requires or fail to allocate memory. Generally, this is a best effort information so any races with memory hotplug (or very theoretically an early initialization) should be tolerable and the worst that could happen is to print an imprecise node state. Drop the resize lock because this is the only place which might hold the lock from the interrupt context and so all other callers might use a simple spinlock. Even though this doesn't solve any real issue it makes the code easier to follow and tiny more effective. Link: http://lkml.kernel.org/r/20181129235532.9328-1-richard.weiyang@gmail.com Signed-off-by: Wei Yang Acked-by: Michal Hocko Reviewed-by: Oscar Salvador Cc: Johannes Weiner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds lib/show_mem.c | 3 --- 1 file changed, 3 deletions(-) commit 0ecea993d0100e7409f8840b463a34fae42c9c32 Author: YueHaibing Date: Fri Dec 28 00:37:13 2018 -0800 mm/hmm.c: remove set but not used variable 'devmem' Fixes gcc '-Wunused-but-set-variable' warning: mm/hmm.c: In function 'hmm_devmem_ref_kill': mm/hmm.c:995:21: warning: variable 'devmem' set but not used [-Wunused-but-set-variable] It not used any more since 35d39f953d4e ("mm, hmm: replace hmm_devmem_pages_create() with devm_memremap_pages()") Link: http://lkml.kernel.org/r/1543629971-128377-1-git-send-email-yuehaibing@huawei.com Signed-off-by: YueHaibing Reviewed-by: Reviewed-by: Jérôme Glisse Reviewed-by: David Hildenbrand Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/hmm.c | 3 --- 1 file changed, 3 deletions(-) commit fa004ab7365ffa1e17e6b267d64798afccb94946 Author: Wei Yang Date: Fri Dec 28 00:37:10 2018 -0800 mm, hotplug: move init_currently_empty_zone() under zone_span_lock protection During online_pages phase, pgdat->nr_zones will be updated in case this zone is empty. Currently the online_pages phase is protected by the global locks (device_device_hotplug_lock and mem_hotplug_lock), which ensures there is no contention during the update of nr_zones. These global locks introduces scalability issues (especially the second one), which slow down code relying on get_online_mems(). This is also a preparation for not having to rely on get_online_mems() but instead some more fine grained locks. The patch moves init_currently_empty_zone under both zone_span_writelock and pgdat_resize_lock because both the pgdat state is changed (nr_zones) and the zone's start_pfn. Also this patch changes the documentation of node_size_lock to include the protection of nr_zones. Link: http://lkml.kernel.org/r/20181203205016.14123-1-richard.weiyang@gmail.com Signed-off-by: Wei Yang Acked-by: Michal Hocko Reviewed-by: Oscar Salvador Cc: David Hildenbrand Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/mmzone.h | 4 ++-- mm/memory_hotplug.c | 5 ++--- 2 files changed, 4 insertions(+), 5 deletions(-) commit 4e0d2e7ef14d9e1c900dac909db45263822b824f Author: Wei Yang Date: Fri Dec 28 00:37:06 2018 -0800 mm, sparse: pass nid instead of pgdat to sparse_add_one_section() Since the information needed in sparse_add_one_section() is node id to allocate proper memory, it is not necessary to pass its pgdat. This patch changes the prototype of sparse_add_one_section() to pass node id directly. This is intended to reduce misleading that sparse_add_one_section() would touch pgdat. Link: http://lkml.kernel.org/r/20181204085657.20472-2-richard.weiyang@gmail.com Signed-off-by: Wei Yang Reviewed-by: David Hildenbrand Acked-by: Michal Hocko Cc: Dave Hansen Cc: Oscar Salvador Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/memory_hotplug.h | 4 ++-- mm/memory_hotplug.c | 2 +- mm/sparse.c | 8 ++++---- 3 files changed, 7 insertions(+), 7 deletions(-) commit 83af658898cb292a32d8b6cd9b51266d7cfc4b6a Author: Wei Yang Date: Fri Dec 28 00:37:02 2018 -0800 mm, sparse: drop pgdat_resize_lock in sparse_add/remove_one_section() pgdat_resize_lock is used to protect pgdat's memory region information like: node_start_pfn, node_present_pages, etc. While in function sparse_add/remove_one_section(), pgdat_resize_lock is used to protect initialization/release of one mem_section. This looks not proper. These code paths are currently protected by mem_hotplug_lock currently but should there ever be any reason for locking at the sparse layer a dedicated lock should be introduced. Following is the current call trace of sparse_add/remove_one_section() mem_hotplug_begin() arch_add_memory() add_pages() __add_pages() __add_section() sparse_add_one_section() mem_hotplug_done() mem_hotplug_begin() arch_remove_memory() __remove_pages() __remove_section() sparse_remove_one_section() mem_hotplug_done() The comment above the pgdat_resize_lock also mentions "Holding this will also guarantee that any pfn_valid() stays that way.", which is true with the current implementation and false after this patch. But current implementation doesn't meet this comment. There isn't any pfn walkers to take the lock so this looks like a relict from the past. This patch also removes this comment. [richard.weiyang@gmail.com: v4] Link: http://lkml.kernel.org/r/20181204085657.20472-1-richard.weiyang@gmail.com [mhocko@suse.com: changelog suggestion] Link: http://lkml.kernel.org/r/20181128091243.19249-1-richard.weiyang@gmail.com Signed-off-by: Wei Yang Reviewed-by: David Hildenbrand Acked-by: Michal Hocko Cc: Dave Hansen Cc: Oscar Salvador Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/mmzone.h | 3 +-- mm/sparse.c | 9 +-------- 2 files changed, 2 insertions(+), 10 deletions(-) commit 9e247bab0668a5893b3efa131cec5b5859467834 Author: Yu Zhao Date: Fri Dec 28 00:36:58 2018 -0800 mm: remove pte_lock_deinit() Pagetable page doesn't touch page->mapping or have any used field that overlaps with it. No need to clear mapping in dtor. In fact, doing so might mask problems that otherwise would be detected by bad_page(). Link: http://lkml.kernel.org/r/20181128235525.58780-1-yuzhao@google.com Signed-off-by: Yu Zhao Reviewed-by: Matthew Wilcox Acked-by: Michal Hocko Cc: Hugh Dickins Cc: "Kirill A . Shutemov" Cc: Dan Williams Cc: Pavel Tatashin Cc: Souptick Joarder Cc: Logan Gunthorpe Cc: Keith Busch Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/mm.h | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) commit bb416d18b850faaa44bd3bb67c9728922c3cce98 Author: Minchan Kim Date: Fri Dec 28 00:36:54 2018 -0800 zram: writeback throttle If there are lots of write IO with flash device, it could have a wearout problem of storage. To overcome the problem, admin needs to design write limitation to guarantee flash health for entire product life. This patch creates a new knob "writeback_limit" for zram. writeback_limit's default value is 0 so that it doesn't limit any writeback. If admin want to measure writeback count in a certain period, he could know it via /sys/block/zram0/bd_stat's 3rd column. If admin want to limit writeback as per-day 400M, he could do it like below. MB_SHIFT=20 4K_SHIFT=12 echo $((400<>4K_SHIFT)) > \ /sys/block/zram0/writeback_limit. If admin want to allow further write again, he could do it like below echo 0 > /sys/block/zram0/writeback_limit If admin want to see remaining writeback budget, cat /sys/block/zram0/writeback_limit The writeback_limit count will reset whenever you reset zram (e.g., system reboot, echo 1 > /sys/block/zramX/reset) so keeping how many of writeback happened until you reset the zram to allocate extra writeback budget in next setting is user's job. [minchan@kernel.org: v4] Link: http://lkml.kernel.org/r/20181203024045.153534-8-minchan@kernel.org Link: http://lkml.kernel.org/r/20181127055429.251614-8-minchan@kernel.org Signed-off-by: Minchan Kim Reviewed-by: Sergey Senozhatsky Cc: Joey Pabalinas Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Documentation/ABI/testing/sysfs-block-zram | 9 ++++++ Documentation/blockdev/zram.txt | 31 ++++++++++++++++++ drivers/block/zram/zram_drv.c | 52 ++++++++++++++++++++++++++++-- drivers/block/zram/zram_drv.h | 2 ++ 4 files changed, 91 insertions(+), 3 deletions(-) commit 23eddf39b2c28c05cb8f8203d38e61807d701b38 Author: Minchan Kim Date: Fri Dec 28 00:36:51 2018 -0800 zram: add bd_stat statistics bd_stat represents things that happened in the backing device. Currently it supports bd_counts, bd_reads and bd_writes which are helpful to understand wearout of flash and memory saving. [minchan@kernel.org: v4] Link: http://lkml.kernel.org/r/20181203024045.153534-7-minchan@kernel.org Link: http://lkml.kernel.org/r/20181127055429.251614-7-minchan@kernel.org Signed-off-by: Minchan Kim Reviewed-by: Sergey Senozhatsky Cc: Joey Pabalinas Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Documentation/ABI/testing/sysfs-block-zram | 8 ++++++++ Documentation/blockdev/zram.txt | 11 +++++++++++ drivers/block/zram/zram_drv.c | 29 +++++++++++++++++++++++++++++ drivers/block/zram/zram_drv.h | 5 +++++ 4 files changed, 53 insertions(+) commit a939888ec38bf1f33e4a903056677e92a4844244 Author: Minchan Kim Date: Fri Dec 28 00:36:47 2018 -0800 zram: support idle/huge page writeback Add a new feature "zram idle/huge page writeback". In the zram-swap use case, zram usually has many idle/huge swap pages. It's pointless to keep them in memory (ie, zram). To solve this problem, this feature introduces idle/huge page writeback to the backing device so the goal is to save more memory space on embedded systems. Normal sequence to use idle/huge page writeback feature is as follows, while (1) { # mark allocated zram slot to idle echo all > /sys/block/zram0/idle # leave system working for several hours # Unless there is no access for some blocks on zram, # they are still IDLE marked pages. echo "idle" > /sys/block/zram0/writeback or/and echo "huge" > /sys/block/zram0/writeback # write the IDLE or/and huge marked slot into backing device # and free the memory. } Per the discussion at https://lore.kernel.org/lkml/20181122065926.GG3441@jagdpanzerIV/T/#u, This patch removes direct incommpressibe page writeback feature (d2afd25114f4 ("zram: write incompressible pages to backing device")). Below concerns from Sergey: == &< == "IDLE writeback" is superior to "incompressible writeback". "incompressible writeback" is completely unpredictable and uncontrollable; it depens on data patterns and compression algorithms. While "IDLE writeback" is predictable. I even suspect, that, *ideally*, we can remove "incompressible writeback". "IDLE pages" is a super set which also includes "incompressible" pages. So, technically, we still can do "incompressible writeback" from "IDLE writeback" path; but a much more reasonable one, based on a page idling period. I understand that you want to keep "direct incompressible writeback" around. ZRAM is especially popular on devices which do suffer from flash wearout, so I can see "incompressible writeback" path becoming a dead code, long term. == &< == Below concerns from Minchan: == &< == My concern is if we enable CONFIG_ZRAM_WRITEBACK in this implementation, both hugepage/idlepage writeck will turn on. However someuser want to enable only idlepage writeback so we need to introduce turn on/off knob for hugepage or new CONFIG_ZRAM_IDLEPAGE_WRITEBACK for those usecase. I don't want to make it complicated *if possible*. Long term, I imagine we need to make VM aware of new swap hierarchy a little bit different with as-is. For example, first high priority swap can return -EIO or -ENOCOMP, swap try to fallback to next lower priority swap device. With that, hugepage writeback will work tranparently. So we could regard it as regression because incompressible pages doesn't go to backing storage automatically. Instead, user should do it via "echo huge" > /sys/block/zram/writeback" manually. == &< == Link: http://lkml.kernel.org/r/20181127055429.251614-6-minchan@kernel.org Signed-off-by: Minchan Kim Reviewed-by: Joey Pabalinas Reviewed-by: Sergey Senozhatsky Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Documentation/ABI/testing/sysfs-block-zram | 7 + Documentation/blockdev/zram.txt | 28 +++- drivers/block/zram/Kconfig | 5 +- drivers/block/zram/zram_drv.c | 247 ++++++++++++++++++++--------- drivers/block/zram/zram_drv.h | 1 + 5 files changed, 209 insertions(+), 79 deletions(-) commit e82592c4fd7eafe8dec12a70436e93e3afb28556 Author: Minchan Kim Date: Fri Dec 28 00:36:44 2018 -0800 zram: introduce ZRAM_IDLE flag To support idle page writeback with upcoming patches, this patch introduces a new ZRAM_IDLE flag. Userspace can mark zram slots as "idle" via "echo all > /sys/block/zramX/idle" which marks every allocated zram slot as ZRAM_IDLE. User could see it by /sys/kernel/debug/zram/zram0/block_state. 300 75.033841 ...i 301 63.806904 s..i 302 63.806919 ..hi Once there is IO for the slot, the mark will be disappeared. 300 75.033841 ... 301 63.806904 s..i 302 63.806919 ..hi Therefore, 300th block is idle zpage. With this feature, user can how many zram has idle pages which are waste of memory. Link: http://lkml.kernel.org/r/20181127055429.251614-5-minchan@kernel.org Signed-off-by: Minchan Kim Reviewed-by: Sergey Senozhatsky Reviewed-by: Joey Pabalinas Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Documentation/ABI/testing/sysfs-block-zram | 8 +++++ Documentation/blockdev/zram.txt | 10 +++--- drivers/block/zram/zram_drv.c | 57 ++++++++++++++++++++++++++++-- drivers/block/zram/zram_drv.h | 1 + 4 files changed, 69 insertions(+), 7 deletions(-) commit 7e5292831b346bacb05558ca385cae366187314c Author: Minchan Kim Date: Fri Dec 28 00:36:40 2018 -0800 zram: refactor flags and writeback stuff Rename some variables and restructure some code for better readability in writeback and zs_free_page. Link: http://lkml.kernel.org/r/20181127055429.251614-4-minchan@kernel.org Signed-off-by: Minchan Kim Reviewed-by: Sergey Senozhatsky Reviewed-by: Joey Pabalinas Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/block/zram/zram_drv.c | 105 ++++++++++++++++-------------------------- drivers/block/zram/zram_drv.h | 8 ++-- 2 files changed, 44 insertions(+), 69 deletions(-) commit 5547932dc67a48713eece4fa4703bfdf0cfcb818 Author: Minchan Kim Date: Fri Dec 28 00:36:37 2018 -0800 zram: fix double free backing device If blkdev_get fails, we shouldn't do blkdev_put. Otherwise, kernel emits below log. This patch fixes it. WARNING: CPU: 0 PID: 1893 at fs/block_dev.c:1828 blkdev_put+0x105/0x120 Modules linked in: CPU: 0 PID: 1893 Comm: swapoff Not tainted 4.19.0+ #453 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 RIP: 0010:blkdev_put+0x105/0x120 Call Trace: __x64_sys_swapoff+0x46d/0x490 do_syscall_64+0x5a/0x190 entry_SYSCALL_64_after_hwframe+0x49/0xbe irq event stamp: 4466 hardirqs last enabled at (4465): __free_pages_ok+0x1e3/0x490 hardirqs last disabled at (4466): trace_hardirqs_off_thunk+0x1a/0x1c softirqs last enabled at (3420): __do_softirq+0x333/0x446 softirqs last disabled at (3407): irq_exit+0xd1/0xe0 Link: http://lkml.kernel.org/r/20181127055429.251614-3-minchan@kernel.org Signed-off-by: Minchan Kim Reviewed-by: Sergey Senozhatsky Reviewed-by: Joey Pabalinas Cc: [4.14+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/block/zram/zram_drv.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 3c9959e025472122a61faebb208525cf26b305d1 Author: Minchan Kim Date: Fri Dec 28 00:36:33 2018 -0800 zram: fix lockdep warning of free block handling Patch series "zram idle page writeback", v3. Inherently, swap device has many idle pages which are rare touched since it was allocated. It is never problem if we use storage device as swap. However, it's just waste for zram-swap. This patchset supports zram idle page writeback feature. * Admin can define what is idle page "no access since X time ago" * Admin can define when zram should writeback them * Admin can define when zram should stop writeback to prevent wearout Details are in each patch's description. This patch (of 7): ================================ WARNING: inconsistent lock state 4.19.0+ #390 Not tainted -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. zram_verify/2095 [HC0[0]:SC1[1]:HE1:SE0] takes: 00000000b1828693 (&(&zram->bitmap_lock)->rlock){+.?.}, at: put_entry_bdev+0x1e/0x50 {SOFTIRQ-ON-W} state was registered at: _raw_spin_lock+0x2c/0x40 zram_make_request+0x755/0xdc9 generic_make_request+0x373/0x6a0 submit_bio+0x6c/0x140 __swap_writepage+0x3a8/0x480 shrink_page_list+0x1102/0x1a60 shrink_inactive_list+0x21b/0x3f0 shrink_node_memcg.constprop.99+0x4f8/0x7e0 shrink_node+0x7d/0x2f0 do_try_to_free_pages+0xe0/0x300 try_to_free_pages+0x116/0x2b0 __alloc_pages_slowpath+0x3f4/0xf80 __alloc_pages_nodemask+0x2a2/0x2f0 __handle_mm_fault+0x42e/0xb50 handle_mm_fault+0x55/0xb0 __do_page_fault+0x235/0x4b0 page_fault+0x1e/0x30 irq event stamp: 228412 hardirqs last enabled at (228412): [] __slab_free+0x3e6/0x600 hardirqs last disabled at (228411): [] __slab_free+0x1c5/0x600 softirqs last enabled at (228396): [] __do_softirq+0x31e/0x427 softirqs last disabled at (228403): [] irq_exit+0xd1/0xe0 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&(&zram->bitmap_lock)->rlock); lock(&(&zram->bitmap_lock)->rlock); *** DEADLOCK *** no locks held by zram_verify/2095. stack backtrace: CPU: 5 PID: 2095 Comm: zram_verify Not tainted 4.19.0+ #390 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 Call Trace: dump_stack+0x67/0x9b print_usage_bug+0x1bd/0x1d3 mark_lock+0x4aa/0x540 __lock_acquire+0x51d/0x1300 lock_acquire+0x90/0x180 _raw_spin_lock+0x2c/0x40 put_entry_bdev+0x1e/0x50 zram_free_page+0xf6/0x110 zram_slot_free_notify+0x42/0xa0 end_swap_bio_read+0x5b/0x170 blk_update_request+0x8f/0x340 scsi_end_request+0x2c/0x1e0 scsi_io_completion+0x98/0x650 blk_done_softirq+0x9e/0xd0 __do_softirq+0xcc/0x427 irq_exit+0xd1/0xe0 do_IRQ+0x93/0x120 common_interrupt+0xf/0xf With writeback feature, zram_slot_free_notify could be called in softirq context by end_swap_bio_read. However, bitmap_lock is not aware of that so lockdep yell out: get_entry_bdev spin_lock(bitmap->lock); irq softirq end_swap_bio_read zram_slot_free_notify zram_slot_lock <-- deadlock prone zram_free_page put_entry_bdev spin_lock(bitmap->lock); <-- deadlock prone With akpm's suggestion (i.e. bitmap operation is already atomic), we could remove bitmap lock. It might fail to find a empty slot if serious contention happens. However, it's not severe problem because huge page writeback has already possiblity to fail if there is severe memory pressure. Worst case is just keeping the incompressible in memory, not storage. The other problem is zram_slot_lock in zram_slot_slot_free_notify. To make it safe is this patch introduces zram_slot_trylock where zram_slot_free_notify uses it. Although it's rare to be contented, this patch adds new debug stat "miss_free" to keep monitoring how often it happens. Link: http://lkml.kernel.org/r/20181127055429.251614-2-minchan@kernel.org Signed-off-by: Minchan Kim Reviewed-by: Sergey Senozhatsky Reviewed-by: Joey Pabalinas Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/block/zram/zram_drv.c | 38 +++++++++++++++++++++----------------- drivers/block/zram/zram_drv.h | 2 +- 2 files changed, 22 insertions(+), 18 deletions(-) commit fed84c78527009d4f799a3ed9a566502fa026d82 Author: Qian Cai Date: Fri Dec 28 00:36:29 2018 -0800 mm/memblock.c: skip kmemleak for kasan_init() Kmemleak does not play well with KASAN (tested on both HPE Apollo 70 and Huawei TaiShan 2280 aarch64 servers). After calling start_kernel()->setup_arch()->kasan_init(), kmemleak early log buffer went from something like 280 to 260000 which caused kmemleak disabled and crash dump memory reservation failed. The multitude of kmemleak_alloc() calls is from nested loops while KASAN is setting up full memory mappings, so let early kmemleak allocations skip those memblock_alloc_internal() calls came from kasan_init() given that those early KASAN memory mappings should not reference to other memory. Hence, no kmemleak false positives. kasan_init kasan_map_populate [1] kasan_pgd_populate [2] kasan_pud_populate [3] kasan_pmd_populate [4] kasan_pte_populate [5] kasan_alloc_zeroed_page memblock_alloc_try_nid memblock_alloc_internal kmemleak_alloc [1] for_each_memblock(memory, reg) [2] while (pgdp++, addr = next, addr != end) [3] while (pudp++, addr = next, addr != end && pud_none(READ_ONCE(*pudp))) [4] while (pmdp++, addr = next, addr != end && pmd_none(READ_ONCE(*pmdp))) [5] while (ptep++, addr = next, addr != end && pte_none(READ_ONCE(*ptep))) Link: http://lkml.kernel.org/r/1543442925-17794-1-git-send-email-cai@gmx.us Signed-off-by: Qian Cai Acked-by: Catalin Marinas Cc: Michal Hocko Cc: Mike Rapoport Cc: Alexander Potapenko Cc: Dmitry Vyukov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/arm64/mm/kasan_init.c | 2 +- include/linux/memblock.h | 1 + mm/memblock.c | 19 +++++++++++-------- 3 files changed, 13 insertions(+), 9 deletions(-) commit 65c78784135f847e49eb98e6b976e453e71100c3 Author: Oscar Salvador Date: Fri Dec 28 00:36:26 2018 -0800 kernel, resource: check for IORESOURCE_SYSRAM in release_mem_region_adjustable This is a preparation for the next patch. Currently, we only call release_mem_region_adjustable() in __remove_pages if the zone is not ZONE_DEVICE, because resources that belong to HMM/devm are being released by themselves with devm_release_mem_region. Since we do not want to touch any zone/page stuff during the removing of the memory (but during the offlining), we do not want to check for the zone here. So we need another way to tell release_mem_region_adjustable() to not realease the resource in case it belongs to HMM/devm. HMM/devm acquires/releases a resource through devm_request_mem_region/devm_release_mem_region. These resources have the flag IORESOURCE_MEM, while resources acquired by hot-add memory path (register_memory_resource()) contain IORESOURCE_SYSTEM_RAM. So, we can check for this flag in release_mem_region_adjustable, and if the resource does not contain such flag, we know that we are dealing with a HMM/devm resource, so we can back off. Link: http://lkml.kernel.org/r/20181127162005.15833-3-osalvador@suse.de Signed-off-by: Oscar Salvador Reviewed-by: David Hildenbrand Reviewed-by: Pavel Tatashin Cc: Dan Williams Cc: Jerome Glisse Cc: Jonathan Cameron Cc: Michal Hocko Cc: Oscar Salvador Cc: "Rafael J. Wysocki" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/resource.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) commit 2c2a5af6fed20cf74401c9d64319c76c5ff81309 Author: Oscar Salvador Date: Fri Dec 28 00:36:22 2018 -0800 mm, memory_hotplug: add nid parameter to arch_remove_memory Patch series "Do not touch pages in hot-remove path", v2. This patchset aims for two things: 1) A better definition about offline and hot-remove stage 2) Solving bugs where we can access non-initialized pages during hot-remove operations [2] [3]. This is achieved by moving all page/zone handling to the offline stage, so we do not need to access pages when hot-removing memory. [1] https://patchwork.kernel.org/cover/10691415/ [2] https://patchwork.kernel.org/patch/10547445/ [3] https://www.spinics.net/lists/linux-mm/msg161316.html This patch (of 5): This is a preparation for the following-up patches. The idea of passing the nid is that it will allow us to get rid of the zone parameter afterwards. Link: http://lkml.kernel.org/r/20181127162005.15833-2-osalvador@suse.de Signed-off-by: Oscar Salvador Reviewed-by: David Hildenbrand Reviewed-by: Pavel Tatashin Cc: Michal Hocko Cc: Dan Williams Cc: Jerome Glisse Cc: Jonathan Cameron Cc: "Rafael J. Wysocki" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/ia64/mm/init.c | 2 +- arch/powerpc/mm/mem.c | 3 ++- arch/s390/mm/init.c | 2 +- arch/sh/mm/init.c | 2 +- arch/x86/mm/init_32.c | 2 +- arch/x86/mm/init_64.c | 3 ++- include/linux/memory_hotplug.h | 4 ++-- kernel/memremap.c | 5 ++++- mm/memory_hotplug.c | 2 +- 9 files changed, 15 insertions(+), 10 deletions(-) commit 23b68cfaae0ea40a9509fad37b756a6916dec54e Author: Wei Yang Date: Fri Dec 28 00:36:18 2018 -0800 mm: check nr_initialised with PAGES_PER_SECTION directly in defer_init() When DEFERRED_STRUCT_PAGE_INIT is configured, only the first section of each node's highest zone is initialized before defer stage. static_init_pgcnt is used to store the number of pages like this: pgdat->static_init_pgcnt = min_t(unsigned long, PAGES_PER_SECTION, pgdat->node_spanned_pages); because we don't want to overflow zone's range. But this is not necessary, since defer_init() is called like this: memmap_init_zone() for pfn in [start_pfn, end_pfn) defer_init(pfn, end_pfn) In case (pgdat->node_spanned_pages < PAGES_PER_SECTION), the loop would stop before calling defer_init(). BTW, comparing PAGES_PER_SECTION with node_spanned_pages is not correct, since nr_initialised is zone based instead of node based. Even node_spanned_pages is bigger than PAGES_PER_SECTION, its highest zone would have pages less than PAGES_PER_SECTION. Link: http://lkml.kernel.org/r/20181122094807.6985-1-richard.weiyang@gmail.com Signed-off-by: Wei Yang Reviewed-by: Alexander Duyck Cc: Pavel Tatashin Cc: Oscar Salvador Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/mmzone.h | 2 -- mm/page_alloc.c | 13 ++++++------- 2 files changed, 6 insertions(+), 9 deletions(-) commit 9a1ea439b16b92002e0a6fceebc5d1794906e297 Author: Hugh Dickins Date: Fri Dec 28 00:36:14 2018 -0800 mm: put_and_wait_on_page_locked() while page is migrated Waiting on a page migration entry has used wait_on_page_locked() all along since 2006: but you cannot safely wait_on_page_locked() without holding a reference to the page, and that extra reference is enough to make migrate_page_move_mapping() fail with -EAGAIN, when a racing task faults on the entry before migrate_page_move_mapping() gets there. And that failure is retried nine times, amplifying the pain when trying to migrate a popular page. With a single persistent faulter, migration sometimes succeeds; with two or three concurrent faulters, success becomes much less likely (and the more the page was mapped, the worse the overhead of unmapping and remapping it on each try). This is especially a problem for memory offlining, where the outer level retries forever (or until terminated from userspace), because a heavy refault workload can trigger an endless loop of migration failures. wait_on_page_locked() is the wrong tool for the job. David Herrmann (but was he the first?) noticed this issue in 2014: https://marc.info/?l=linux-mm&m=140110465608116&w=2 Tim Chen started a thread in August 2017 which appears relevant: https://marc.info/?l=linux-mm&m=150275941014915&w=2 where Kan Liang went on to implicate __migration_entry_wait(): https://marc.info/?l=linux-mm&m=150300268411980&w=2 and the thread ended up with the v4.14 commits: 2554db916586 ("sched/wait: Break up long wake list walk") 11a19c7b099f ("sched/wait: Introduce wakeup boomark in wake_up_page_bit") Baoquan He reported "Memory hotplug softlock issue" 14 November 2018: https://marc.info/?l=linux-mm&m=154217936431300&w=2 We have all assumed that it is essential to hold a page reference while waiting on a page lock: partly to guarantee that there is still a struct page when MEMORY_HOTREMOVE is configured, but also to protect against reuse of the struct page going to someone who then holds the page locked indefinitely, when the waiter can reasonably expect timely unlocking. But in fact, so long as wait_on_page_bit_common() does the put_page(), and is careful not to rely on struct page contents thereafter, there is no need to hold a reference to the page while waiting on it. That does mean that this case cannot go back through the loop: but that's fine for the page migration case, and even if used more widely, is limited by the "Stop walking if it's locked" optimization in wake_page_function(). Add interface put_and_wait_on_page_locked() to do this, using "behavior" enum in place of "lock" arg to wait_on_page_bit_common() to implement it. No interruptible or killable variant needed yet, but they might follow: I have a vague notion that reporting -EINTR should take precedence over return from wait_on_page_bit_common() without knowing the page state, so arrange it accordingly - but that may be nothing but pedantic. __migration_entry_wait() still has to take a brief reference to the page, prior to calling put_and_wait_on_page_locked(): but now that it is dropped before waiting, the chance of impeding page migration is very much reduced. Should we perhaps disable preemption across this? shrink_page_list()'s __ClearPageLocked(): that was a surprise! This survived a lot of testing before that showed up. PageWaiters may have been set by wait_on_page_bit_common(), and the reference dropped, just before shrink_page_list() succeeds in freezing its last page reference: in such a case, unlock_page() must be used. Follow the suggestion from Michal Hocko, just revert a978d6f52106 ("mm: unlockless reclaim") now: that optimization predates PageWaiters, and won't buy much these days; but we can reinstate it for the !PageWaiters case if anyone notices. It does raise the question: should vmscan.c's is_page_cache_freeable() and __remove_mapping() now treat a PageWaiters page as if an extra reference were held? Perhaps, but I don't think it matters much, since shrink_page_list() already had to win its trylock_page(), so waiters are not very common there: I noticed no difference when trying the bigger change, and it's surely not needed while put_and_wait_on_page_locked() is only used for page migration. [willy@infradead.org: add put_and_wait_on_page_locked() kerneldoc] Link: http://lkml.kernel.org/r/alpine.LSU.2.11.1811261121330.1116@eggly.anvils Signed-off-by: Hugh Dickins Reported-by: Baoquan He Tested-by: Baoquan He Reviewed-by: Andrea Arcangeli Acked-by: Michal Hocko Acked-by: Linus Torvalds Acked-by: Vlastimil Babka Cc: Matthew Wilcox Cc: Baoquan He Cc: David Hildenbrand Cc: Mel Gorman Cc: David Herrmann Cc: Tim Chen Cc: Kan Liang Cc: Andi Kleen Cc: Davidlohr Bueso Cc: Peter Zijlstra Cc: Christoph Lameter Cc: Nick Piggin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/pagemap.h | 2 ++ mm/filemap.c | 87 +++++++++++++++++++++++++++++++++++++++++-------- mm/huge_memory.c | 6 ++-- mm/migrate.c | 12 +++---- mm/vmscan.c | 10 ++---- 5 files changed, 84 insertions(+), 33 deletions(-) commit f0c867d9588d9efc10d6a55009c9560336673369 Author: yuzhoujian Date: Fri Dec 28 00:36:10 2018 -0800 mm, oom: add oom victim's memcg to the oom context information The current oom report doesn't display victim's memcg context during the global OOM situation. While this information is not strictly needed, it can be really helpful for containerized environments to locate which container has lost a process. Now that we have a single line for the oom context, we can trivially add both the oom memcg (this can be either global_oom or a specific memcg which hits its hard limits) and task_memcg which is the victim's memcg. Below is the single line output in the oom report after this patch. - global oom context information: oom-kill:constraint=,nodemask=,cpuset=,mems_allowed=,global_oom,task_memcg=,task=,pid=,uid= - memcg oom context information: oom-kill:constraint=,nodemask=,cpuset=,mems_allowed=,oom_memcg=,task_memcg=,task=,pid=,uid= [penguin-kernel@I-love.SAKURA.ne.jp: use pr_cont() in mem_cgroup_print_oom_context()] Link: http://lkml.kernel.org/r/201812190723.wBJ7NdkN032628@www262.sakura.ne.jp Link: http://lkml.kernel.org/r/1542799799-36184-2-git-send-email-ufo19890607@gmail.com Signed-off-by: yuzhoujian Signed-off-by: Tetsuo Handa Acked-by: Michal Hocko Cc: David Rientjes Cc: "Kirill A . Shutemov" Cc: Andrea Arcangeli Cc: Tetsuo Handa Cc: Roman Gushchin Cc: Yang Shi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/memcontrol.h | 11 +++++++++-- mm/memcontrol.c | 33 ++++++++++++++++++++------------- mm/oom_kill.c | 3 ++- 3 files changed, 31 insertions(+), 16 deletions(-) commit ef8444ea01d7442652f8e1b8a8b94278cb57eafd Author: yuzhoujian Date: Fri Dec 28 00:36:07 2018 -0800 mm, oom: reorganize the oom report in dump_header OOM report contains several sections. The first one is the allocation context that has triggered the OOM. Then we have cpuset context followed by the stack trace of the OOM path. The tird one is the OOM memory information. Followed by the current memory state of all system tasks. At last, we will show oom eligible tasks and the information about the chosen oom victim. One thing that makes parsing more awkward than necessary is that we do not have a single and easily parsable line about the oom context. This patch is reorganizing the oom report to 1) who invoked oom and what was the allocation request [ 515.902945] tuned invoked oom-killer: gfp_mask=0x6200ca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 2) OOM stack trace [ 515.904273] CPU: 24 PID: 1809 Comm: tuned Not tainted 4.20.0-rc3+ #3 [ 515.905518] Hardware name: Inspur SA5212M4/YZMB-00370-107, BIOS 4.1.10 11/14/2016 [ 515.906821] Call Trace: [ 515.908062] dump_stack+0x5a/0x73 [ 515.909311] dump_header+0x55/0x28c [ 515.914260] oom_kill_process+0x2d8/0x300 [ 515.916708] out_of_memory+0x145/0x4a0 [ 515.917932] __alloc_pages_slowpath+0x7d2/0xa16 [ 515.919157] __alloc_pages_nodemask+0x277/0x290 [ 515.920367] filemap_fault+0x3d0/0x6c0 [ 515.921529] ? filemap_map_pages+0x2b8/0x420 [ 515.922709] ext4_filemap_fault+0x2c/0x40 [ext4] [ 515.923884] __do_fault+0x20/0x80 [ 515.925032] __handle_mm_fault+0xbc0/0xe80 [ 515.926195] handle_mm_fault+0xfa/0x210 [ 515.927357] __do_page_fault+0x233/0x4c0 [ 515.928506] do_page_fault+0x32/0x140 [ 515.929646] ? page_fault+0x8/0x30 [ 515.930770] page_fault+0x1e/0x30 3) OOM memory information [ 515.958093] Mem-Info: [ 515.959647] active_anon:26501758 inactive_anon:1179809 isolated_anon:0 active_file:4402672 inactive_file:483963 isolated_file:1344 unevictable:0 dirty:4886753 writeback:0 unstable:0 slab_reclaimable:148442 slab_unreclaimable:18741 mapped:1347 shmem:1347 pagetables:58669 bounce:0 free:88663 free_pcp:0 free_cma:0 ... 4) current memory state of all system tasks [ 516.079544] [ 744] 0 744 9211 1345 114688 82 0 systemd-journal [ 516.082034] [ 787] 0 787 31764 0 143360 92 0 lvmetad [ 516.084465] [ 792] 0 792 10930 1 110592 208 -1000 systemd-udevd [ 516.086865] [ 1199] 0 1199 13866 0 131072 112 -1000 auditd [ 516.089190] [ 1222] 0 1222 31990 1 110592 157 0 smartd [ 516.091477] [ 1225] 0 1225 4864 85 81920 43 0 irqbalance [ 516.093712] [ 1226] 0 1226 52612 0 258048 426 0 abrtd [ 516.112128] [ 1280] 0 1280 109774 55 299008 400 0 NetworkManager [ 516.113998] [ 1295] 0 1295 28817 37 69632 24 0 ksmtuned [ 516.144596] [ 10718] 0 10718 2622484 1721372 15998976 267219 0 panic [ 516.145792] [ 10719] 0 10719 2622484 1164767 9818112 53576 0 panic [ 516.146977] [ 10720] 0 10720 2622484 1174361 9904128 53709 0 panic [ 516.148163] [ 10721] 0 10721 2622484 1209070 10194944 54824 0 panic [ 516.149329] [ 10722] 0 10722 2622484 1745799 14774272 91138 0 panic 5) oom context (contrains and the chosen victim). oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0-1,task=panic,pid=10737,uid=0 An admin can easily get the full oom context at a single line which makes parsing much easier. Link: http://lkml.kernel.org/r/1542799799-36184-1-git-send-email-ufo19890607@gmail.com Signed-off-by: yuzhoujian Acked-by: Michal Hocko Cc: Andrea Arcangeli Cc: David Rientjes Cc: "Kirill A . Shutemov" Cc: Roman Gushchin Cc: Tetsuo Handa Cc: Yang Shi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/oom.h | 10 ++++++++++ kernel/cgroup/cpuset.c | 4 ++-- mm/oom_kill.c | 29 ++++++++++++++++++++--------- mm/page_alloc.c | 4 ++-- 4 files changed, 34 insertions(+), 13 deletions(-) commit e5cb113f2dbc8125f31005faebab161a2a84ebe6 Author: Alexey Dobriyan Date: Fri Dec 28 00:36:03 2018 -0800 mm: make free_reserved_area() return "const char *" and propagate through down the call stack. Link: http://lkml.kernel.org/r/20181124091411.GC10969@avx2 Signed-off-by: Alexey Dobriyan Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/x86/include/asm/processor.h | 2 +- arch/x86/mm/init.c | 2 +- include/linux/mm.h | 2 +- mm/page_alloc.c | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) commit 9a2f45ff320287d49a3cd90ce68cb58a6da6f5e1 Author: Alexey Dobriyan Date: Fri Dec 28 00:35:59 2018 -0800 mm/debug.c: make "migrate_reason_names[]" const char * Those strings are immutable as well. Link: http://lkml.kernel.org/r/20181124090508.GB10877@avx2 Signed-off-by: Alexey Dobriyan Reviewed-by: Andrew Morton Reviewed-by: David Hildenbrand Acked-by: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/migrate.h | 2 +- mm/debug.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit c999fbd3dcc6535b1e298b016665ec23ac2b0a9a Author: Alexey Dobriyan Date: Fri Dec 28 00:35:55 2018 -0800 mm/mmzone.c: make "migratetype_names" const char * Those strings are immutable in fact. Link: http://lkml.kernel.org/r/20181124090327.GA10877@avx2 Signed-off-by: Alexey Dobriyan Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/mmzone.h | 2 +- mm/page_alloc.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 1c30844d2dfe272d58c8fc000960b835d13aa2ac Author: Mel Gorman Date: Fri Dec 28 00:35:52 2018 -0800 mm: reclaim small amounts of memory when an external fragmentation event occurs An external fragmentation event was previously described as When the page allocator fragments memory, it records the event using the mm_page_alloc_extfrag event. If the fallback_order is smaller than a pageblock order (order-9 on 64-bit x86) then it's considered an event that will cause external fragmentation issues in the future. The kernel reduces the probability of such events by increasing the watermark sizes by calling set_recommended_min_free_kbytes early in the lifetime of the system. This works reasonably well in general but if there are enough sparsely populated pageblocks then the problem can still occur as enough memory is free overall and kswapd stays asleep. This patch introduces a watermark_boost_factor sysctl that allows a zone watermark to be temporarily boosted when an external fragmentation causing events occurs. The boosting will stall allocations that would decrease free memory below the boosted low watermark and kswapd is woken if the calling context allows to reclaim an amount of memory relative to the size of the high watermark and the watermark_boost_factor until the boost is cleared. When kswapd finishes, it wakes kcompactd at the pageblock order to clean some of the pageblocks that may have been affected by the fragmentation event. kswapd avoids any writeback, slab shrinkage and swap from reclaim context during this operation to avoid excessive system disruption in the name of fragmentation avoidance. Care is taken so that kswapd will do normal reclaim work if the system is really low on memory. This was evaluated using the same workloads as "mm, page_alloc: Spread allocations across zones before introducing fragmentation". 1-socket Skylake machine config-global-dhp__workload_thpfioscale XFS (no special madvise) 4 fio threads, 1 THP allocating thread -------------------------------------- 4.20-rc3 extfrag events < order 9: 804694 4.20-rc3+patch: 408912 (49% reduction) 4.20-rc3+patch1-4: 18421 (98% reduction) 4.20.0-rc3 4.20.0-rc3 lowzone-v5r8 boost-v5r8 Amean fault-base-1 653.58 ( 0.00%) 652.71 ( 0.13%) Amean fault-huge-1 0.00 ( 0.00%) 178.93 * -99.00%* 4.20.0-rc3 4.20.0-rc3 lowzone-v5r8 boost-v5r8 Percentage huge-1 0.00 ( 0.00%) 5.12 ( 100.00%) Note that external fragmentation causing events are massively reduced by this path whether in comparison to the previous kernel or the vanilla kernel. The fault latency for huge pages appears to be increased but that is only because THP allocations were successful with the patch applied. 1-socket Skylake machine global-dhp__workload_thpfioscale-madvhugepage-xfs (MADV_HUGEPAGE) ----------------------------------------------------------------- 4.20-rc3 extfrag events < order 9: 291392 4.20-rc3+patch: 191187 (34% reduction) 4.20-rc3+patch1-4: 13464 (95% reduction) thpfioscale Fault Latencies 4.20.0-rc3 4.20.0-rc3 lowzone-v5r8 boost-v5r8 Min fault-base-1 912.00 ( 0.00%) 905.00 ( 0.77%) Min fault-huge-1 127.00 ( 0.00%) 135.00 ( -6.30%) Amean fault-base-1 1467.55 ( 0.00%) 1481.67 ( -0.96%) Amean fault-huge-1 1127.11 ( 0.00%) 1063.88 * 5.61%* 4.20.0-rc3 4.20.0-rc3 lowzone-v5r8 boost-v5r8 Percentage huge-1 77.64 ( 0.00%) 83.46 ( 7.49%) As before, massive reduction in external fragmentation events, some jitter on latencies and an increase in THP allocation success rates. 2-socket Haswell machine config-global-dhp__workload_thpfioscale XFS (no special madvise) 4 fio threads, 5 THP allocating threads ---------------------------------------------------------------- 4.20-rc3 extfrag events < order 9: 215698 4.20-rc3+patch: 200210 (7% reduction) 4.20-rc3+patch1-4: 14263 (93% reduction) 4.20.0-rc3 4.20.0-rc3 lowzone-v5r8 boost-v5r8 Amean fault-base-5 1346.45 ( 0.00%) 1306.87 ( 2.94%) Amean fault-huge-5 3418.60 ( 0.00%) 1348.94 ( 60.54%) 4.20.0-rc3 4.20.0-rc3 lowzone-v5r8 boost-v5r8 Percentage huge-5 0.78 ( 0.00%) 7.91 ( 910.64%) There is a 93% reduction in fragmentation causing events, there is a big reduction in the huge page fault latency and allocation success rate is higher. 2-socket Haswell machine global-dhp__workload_thpfioscale-madvhugepage-xfs (MADV_HUGEPAGE) ----------------------------------------------------------------- 4.20-rc3 extfrag events < order 9: 166352 4.20-rc3+patch: 147463 (11% reduction) 4.20-rc3+patch1-4: 11095 (93% reduction) thpfioscale Fault Latencies 4.20.0-rc3 4.20.0-rc3 lowzone-v5r8 boost-v5r8 Amean fault-base-5 6217.43 ( 0.00%) 7419.67 * -19.34%* Amean fault-huge-5 3163.33 ( 0.00%) 3263.80 ( -3.18%) 4.20.0-rc3 4.20.0-rc3 lowzone-v5r8 boost-v5r8 Percentage huge-5 95.14 ( 0.00%) 87.98 ( -7.53%) There is a large reduction in fragmentation events with some jitter around the latencies and success rates. As before, the high THP allocation success rate does mean the system is under a lot of pressure. However, as the fragmentation events are reduced, it would be expected that the long-term allocation success rate would be higher. Link: http://lkml.kernel.org/r/20181123114528.28802-5-mgorman@techsingularity.net Signed-off-by: Mel Gorman Acked-by: Vlastimil Babka Cc: Andrea Arcangeli Cc: David Rientjes Cc: Michal Hocko Cc: Zi Yan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Documentation/sysctl/vm.txt | 21 +++++++ include/linux/mm.h | 1 + include/linux/mmzone.h | 11 ++-- kernel/sysctl.c | 8 +++ mm/page_alloc.c | 43 +++++++++++++- mm/vmscan.c | 133 +++++++++++++++++++++++++++++++++++++++++--- 6 files changed, 202 insertions(+), 15 deletions(-) commit 0a79cdad5eb213b3a629e624565b1b3bf9192b7c Author: Mel Gorman Date: Fri Dec 28 00:35:48 2018 -0800 mm: use alloc_flags to record if kswapd can wake This is a preparation patch that copies the GFP flag __GFP_KSWAPD_RECLAIM into alloc_flags. This is a preparation patch only that avoids having to pass gfp_mask through a long callchain in a future patch. Note that the setting in the fast path happens in alloc_flags_nofragment() and it may be claimed that this has nothing to do with ALLOC_NO_FRAGMENT. That's true in this patch but is not true later so it's done now for easier review to show where the flag needs to be recorded. No functional change. [mgorman@techsingularity.net: ALLOC_KSWAPD flag needs to be applied in the !CONFIG_ZONE_DMA32 case] Link: http://lkml.kernel.org/r/20181126143503.GO23260@techsingularity.net Link: http://lkml.kernel.org/r/20181123114528.28802-4-mgorman@techsingularity.net Signed-off-by: Mel Gorman Reviewed-by: Andrew Morton Cc: Andrea Arcangeli Cc: David Rientjes Cc: Michal Hocko Cc: Vlastimil Babka Cc: Zi Yan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/internal.h | 1 + mm/page_alloc.c | 33 ++++++++++++++++++--------------- 2 files changed, 19 insertions(+), 15 deletions(-) commit a921444382b49cc7fdeca3fba3e278bc09484a27 Author: Mel Gorman Date: Fri Dec 28 00:35:44 2018 -0800 mm: move zone watermark accesses behind an accessor This is a preparation patch only, no functional change. Link: http://lkml.kernel.org/r/20181123114528.28802-3-mgorman@techsingularity.net Signed-off-by: Mel Gorman Acked-by: Vlastimil Babka Cc: Andrea Arcangeli Cc: David Rientjes Cc: Michal Hocko Cc: Zi Yan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/mmzone.h | 9 +++++---- mm/compaction.c | 2 +- mm/page_alloc.c | 12 ++++++------ 3 files changed, 12 insertions(+), 11 deletions(-) commit 6bb154504f8b496780ec53ec81aba957a12981fa Author: Mel Gorman Date: Fri Dec 28 00:35:41 2018 -0800 mm, page_alloc: spread allocations across zones before introducing fragmentation Patch series "Fragmentation avoidance improvements", v5. It has been noted before that fragmentation avoidance (aka anti-fragmentation) is not perfect. Given sufficient time or an adverse workload, memory gets fragmented and the long-term success of high-order allocations degrades. This series defines an adverse workload, a definition of external fragmentation events (including serious) ones and a series that reduces the level of those fragmentation events. The details of the workload and the consequences are described in more detail in the changelogs. However, from patch 1, this is a high-level summary of the adverse workload. The exact details are found in the mmtests implementation. The broad details of the workload are as follows; 1. Create an XFS filesystem (not specified in the configuration but done as part of the testing for this patch) 2. Start 4 fio threads that write a number of 64K files inefficiently. Inefficiently means that files are created on first access and not created in advance (fio parameterr create_on_open=1) and fallocate is not used (fallocate=none). With multiple IO issuers this creates a mix of slab and page cache allocations over time. The total size of the files is 150% physical memory so that the slabs and page cache pages get mixed 3. Warm up a number of fio read-only threads accessing the same files created in step 2. This part runs for the same length of time it took to create the files. It'll fault back in old data and further interleave slab and page cache allocations. As it's now low on memory due to step 2, fragmentation occurs as pageblocks get stolen. 4. While step 3 is still running, start a process that tries to allocate 75% of memory as huge pages with a number of threads. The number of threads is based on a (NR_CPUS_SOCKET - NR_FIO_THREADS)/4 to avoid THP threads contending with fio, any other threads or forcing cross-NUMA scheduling. Note that the test has not been used on a machine with less than 8 cores. The benchmark records whether huge pages were allocated and what the fault latency was in microseconds 5. Measure the number of events potentially causing external fragmentation, the fault latency and the huge page allocation success rate. 6. Cleanup Overall the series reduces external fragmentation causing events by over 94% on 1 and 2 socket machines, which in turn impacts high-order allocation success rates over the long term. There are differences in latencies and high-order allocation success rates. Latencies are a mixed bag as they are vulnerable to exact system state and whether allocations succeeded so they are treated as a secondary metric. Patch 1 uses lower zones if they are populated and have free memory instead of fragmenting a higher zone. It's special cased to handle a Normal->DMA32 fallback with the reasons explained in the changelog. Patch 2-4 boosts watermarks temporarily when an external fragmentation event occurs. kswapd wakes to reclaim a small amount of old memory and then wakes kcompactd on completion to recover the system slightly. This introduces some overhead in the slowpath. The level of boosting can be tuned or disabled depending on the tolerance for fragmentation vs allocation latency. Patch 5 stalls some movable allocation requests to let kswapd from patch 4 make some progress. The duration of the stalls is very low but it is possible to tune the system to avoid fragmentation events if larger stalls can be tolerated. The bulk of the improvement in fragmentation avoidance is from patches 1-4 but patch 5 can deal with a rare corner case and provides the option of tuning a system for THP allocation success rates in exchange for some stalls to control fragmentation. This patch (of 5): The page allocator zone lists are iterated based on the watermarks of each zone which does not take anti-fragmentation into account. On x86, node 0 may have multiple zones while other nodes have one zone. A consequence is that tasks running on node 0 may fragment ZONE_NORMAL even though ZONE_DMA32 has plenty of free memory. This patch special cases the allocator fast path such that it'll try an allocation from a lower local zone before fragmenting a higher zone. In this case, stealing of pageblocks or orders larger than a pageblock are still allowed in the fast path as they are uninteresting from a fragmentation point of view. This was evaluated using a benchmark designed to fragment memory before attempting THP allocations. It's implemented in mmtests as the following configurations configs/config-global-dhp__workload_thpfioscale configs/config-global-dhp__workload_thpfioscale-defrag configs/config-global-dhp__workload_thpfioscale-madvhugepage e.g. from mmtests ./run-mmtests.sh --run-monitor --config configs/config-global-dhp__workload_thpfioscale test-run-1 The broad details of the workload are as follows; 1. Create an XFS filesystem (not specified in the configuration but done as part of the testing for this patch). 2. Start 4 fio threads that write a number of 64K files inefficiently. Inefficiently means that files are created on first access and not created in advance (fio parameter create_on_open=1) and fallocate is not used (fallocate=none). With multiple IO issuers this creates a mix of slab and page cache allocations over time. The total size of the files is 150% physical memory so that the slabs and page cache pages get mixed. 3. Warm up a number of fio read-only processes accessing the same files created in step 2. This part runs for the same length of time it took to create the files. It'll refault old data and further interleave slab and page cache allocations. As it's now low on memory due to step 2, fragmentation occurs as pageblocks get stolen. 4. While step 3 is still running, start a process that tries to allocate 75% of memory as huge pages with a number of threads. The number of threads is based on a (NR_CPUS_SOCKET - NR_FIO_THREADS)/4 to avoid THP threads contending with fio, any other threads or forcing cross-NUMA scheduling. Note that the test has not been used on a machine with less than 8 cores. The benchmark records whether huge pages were allocated and what the fault latency was in microseconds. 5. Measure the number of events potentially causing external fragmentation, the fault latency and the huge page allocation success rate. 6. Cleanup the test files. Note that due to the use of IO and page cache that this benchmark is not suitable for running on large machines where the time to fragment memory may be excessive. Also note that while this is one mix that generates fragmentation that it's not the only mix that generates fragmentation. Differences in workload that are more slab-intensive or whether SLUB is used with high-order pages may yield different results. When the page allocator fragments memory, it records the event using the mm_page_alloc_extfrag ftrace event. If the fallback_order is smaller than a pageblock order (order-9 on 64-bit x86) then it's considered to be an "external fragmentation event" that may cause issues in the future. Hence, the primary metric here is the number of external fragmentation events that occur with order < 9. The secondary metric is allocation latency and huge page allocation success rates but note that differences in latencies and what the success rate also can affect the number of external fragmentation event which is why it's a secondary metric. 1-socket Skylake machine config-global-dhp__workload_thpfioscale XFS (no special madvise) 4 fio threads, 1 THP allocating thread -------------------------------------- 4.20-rc3 extfrag events < order 9: 804694 4.20-rc3+patch: 408912 (49% reduction) thpfioscale Fault Latencies 4.20.0-rc3 4.20.0-rc3 vanilla lowzone-v5r8 Amean fault-base-1 662.92 ( 0.00%) 653.58 * 1.41%* Amean fault-huge-1 0.00 ( 0.00%) 0.00 ( 0.00%) 4.20.0-rc3 4.20.0-rc3 vanilla lowzone-v5r8 Percentage huge-1 0.00 ( 0.00%) 0.00 ( 0.00%) Fault latencies are slightly reduced while allocation success rates remain at zero as this configuration does not make any special effort to allocate THP and fio is heavily active at the time and either filling memory or keeping pages resident. However, a 49% reduction of serious fragmentation events reduces the changes of external fragmentation being a problem in the future. Vlastimil asked during review for a breakdown of the allocation types that are falling back. vanilla 3816 MIGRATE_UNMOVABLE 800845 MIGRATE_MOVABLE 33 MIGRATE_UNRECLAIMABLE patch 735 MIGRATE_UNMOVABLE 408135 MIGRATE_MOVABLE 42 MIGRATE_UNRECLAIMABLE The majority of the fallbacks are due to movable allocations and this is consistent for the workload throughout the series so will not be presented again as the primary source of fallbacks are movable allocations. Movable fallbacks are sometimes considered "ok" to fallback because they can be migrated. The problem is that they can fill an unmovable/reclaimable pageblock causing those allocations to fallback later and polluting pageblocks with pages that cannot move. If there is a movable fallback, it is pretty much guaranteed to affect an unmovable/reclaimable pageblock and while it might not be enough to actually cause a unmovable/reclaimable fallback in the future, we cannot know that in advance so the patch takes the only option available to it. Hence, it's important to control them. This point is also consistent throughout the series and will not be repeated. 1-socket Skylake machine global-dhp__workload_thpfioscale-madvhugepage-xfs (MADV_HUGEPAGE) ----------------------------------------------------------------- 4.20-rc3 extfrag events < order 9: 291392 4.20-rc3+patch: 191187 (34% reduction) thpfioscale Fault Latencies 4.20.0-rc3 4.20.0-rc3 vanilla lowzone-v5r8 Amean fault-base-1 1495.14 ( 0.00%) 1467.55 ( 1.85%) Amean fault-huge-1 1098.48 ( 0.00%) 1127.11 ( -2.61%) thpfioscale Percentage Faults Huge 4.20.0-rc3 4.20.0-rc3 vanilla lowzone-v5r8 Percentage huge-1 78.57 ( 0.00%) 77.64 ( -1.18%) Fragmentation events were reduced quite a bit although this is known to be a little variable. The latencies and allocation success rates are similar but they were already quite high. 2-socket Haswell machine config-global-dhp__workload_thpfioscale XFS (no special madvise) 4 fio threads, 5 THP allocating threads ---------------------------------------------------------------- 4.20-rc3 extfrag events < order 9: 215698 4.20-rc3+patch: 200210 (7% reduction) thpfioscale Fault Latencies 4.20.0-rc3 4.20.0-rc3 vanilla lowzone-v5r8 Amean fault-base-5 1350.05 ( 0.00%) 1346.45 ( 0.27%) Amean fault-huge-5 4181.01 ( 0.00%) 3418.60 ( 18.24%) 4.20.0-rc3 4.20.0-rc3 vanilla lowzone-v5r8 Percentage huge-5 1.15 ( 0.00%) 0.78 ( -31.88%) The reduction of external fragmentation events is slight and this is partially due to the removal of __GFP_THISNODE in commit ac5b2c18911f ("mm: thp: relax __GFP_THISNODE for MADV_HUGEPAGE mappings") as THP allocations can now spill over to remote nodes instead of fragmenting local memory. 2-socket Haswell machine global-dhp__workload_thpfioscale-madvhugepage-xfs (MADV_HUGEPAGE) ----------------------------------------------------------------- 4.20-rc3 extfrag events < order 9: 166352 4.20-rc3+patch: 147463 (11% reduction) thpfioscale Fault Latencies 4.20.0-rc3 4.20.0-rc3 vanilla lowzone-v5r8 Amean fault-base-5 6138.97 ( 0.00%) 6217.43 ( -1.28%) Amean fault-huge-5 2294.28 ( 0.00%) 3163.33 * -37.88%* thpfioscale Percentage Faults Huge 4.20.0-rc3 4.20.0-rc3 vanilla lowzone-v5r8 Percentage huge-5 96.82 ( 0.00%) 95.14 ( -1.74%) There was a slight reduction in external fragmentation events although the latencies were higher. The allocation success rate is high enough that the system is struggling and there is quite a lot of parallel reclaim and compaction activity. There is also a certain degree of luck on whether processes start on node 0 or not for this patch but the relevance is reduced later in the series. Overall, the patch reduces the number of external fragmentation causing events so the success of THP over long periods of time would be improved for this adverse workload. Link: http://lkml.kernel.org/r/20181123114528.28802-2-mgorman@techsingularity.net Signed-off-by: Mel Gorman Acked-by: Vlastimil Babka Cc: David Rientjes Cc: Andrea Arcangeli Cc: Zi Yan Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/internal.h | 13 ++++--- mm/page_alloc.c | 108 +++++++++++++++++++++++++++++++++++++++++++++++++------- 2 files changed, 105 insertions(+), 16 deletions(-) commit f29d8e9c0191a2a02500945db505e5c89159c3f4 Author: David Hildenbrand Date: Fri Dec 28 00:35:36 2018 -0800 mm/memory_hotplug: drop "online" parameter from add_memory_resource() Userspace should always be in charge of how to online memory and if memory should be onlined automatically in the kernel. Let's drop the parameter to overwrite this - XEN passes memhp_auto_online, just like add_memory(), so we can directly use that instead internally. Link: http://lkml.kernel.org/r/20181123123740.27652-1-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Michal Hocko Reviewed-by: Oscar Salvador Acked-by: Juergen Gross Cc: Boris Ostrovsky Cc: Stefano Stabellini Cc: Dan Williams Cc: Pavel Tatashin Cc: David Hildenbrand Cc: Joonsoo Kim Cc: Arun KS Cc: Mathieu Malaterre Cc: Stephen Rothwell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/xen/balloon.c | 2 +- include/linux/memory_hotplug.h | 2 +- mm/memory_hotplug.c | 6 +++--- 3 files changed, 5 insertions(+), 5 deletions(-) commit 3b6fd6ffb27c2efa003c6d4d15ca72c054b71d7c Author: Wei Yang Date: Fri Dec 28 00:35:33 2018 -0800 drivers/base/memory.c: remove an unnecessary check on NR_MEM_SECTIONS In cb5e39b8038b ("drivers: base: refactor add_memory_section() to add_memory_block()"), add_memory_block() is introduced, which is only invoked in memory_dev_init(). When combining these two loops in memory_dev_init() and add_memory_block(), they looks like this: for (i = 0; i < NR_MEM_SECTIONS; i += sections_per_block) for (j = i; (j < i + sections_per_block) && j < NR_MEM_SECTIONS; j++) Since it is sure the (i < NR_MEM_SECTIONS) and j sits in its own memory block, the check of (j < NR_MEM_SECTIONS) is not necessary. This patch just removes this check. Link: http://lkml.kernel.org/r/20181123222811.18216-1-richard.weiyang@gmail.com Signed-off-by: Wei Yang Reviewed-by: Andrew Morton Cc: Greg Kroah-Hartman Cc: "Rafael J. Wysocki" Cc: Seth Jennings Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/base/memory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4d72868c8f7c293fc8408a54db4e0a12dc031152 Author: Mike Rapoport Date: Fri Dec 28 00:35:29 2018 -0800 memblock: replace usage of __memblock_free_early() with memblock_free() __memblock_free_early() is only used by the convenience wrappers, so essentially we wrap a call to memblock_free() twice. Replace calls of __memblock_free_early() with calls to memblock_free() and drop the former. Link: http://lkml.kernel.org/r/20181125102940.GE28634@rapoport-lnx Signed-off-by: Mike Rapoport Reviewed-by: Andrew Morton Cc: Wentao Wang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/memblock.h | 5 ++--- mm/memblock.c | 22 ++++++++-------------- 2 files changed, 10 insertions(+), 17 deletions(-) commit d31cfe7bff9109476da92c245b56083e9b48d60a Author: Wentao Wang Date: Fri Dec 28 00:35:26 2018 -0800 mm/page_alloc.c: deduplicate __memblock_free_early() and memblock_free() Link: http://lkml.kernel.org/r/C8ECE1B7A767434691FEEFA3A01765D72AFB8E78@MX203CL03.corp.emc.com Signed-off-by: Wentao Wang Reviewed-by: Andrew Morton Cc: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/memblock.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) commit 742aa7fb52c56fb3b307e704f93e67b698959cc2 Author: Aaron Lu Date: Fri Dec 28 00:35:22 2018 -0800 mm/page_alloc.c: use a single function to free page There are multiple places of freeing a page, they all do the same things so a common function can be used to reduce code duplicate. It also avoids bug fixed in one function but left in another. Link: http://lkml.kernel.org/r/20181119134834.17765-3-aaron.lu@intel.com Signed-off-by: Aaron Lu Acked-by: Vlastimil Babka Cc: Alexander Duyck Cc: Ilias Apalodimas Cc: Jesper Dangaard Brouer Cc: Mel Gorman Cc: Pankaj gupta Cc: Pawel Staszewski Cc: Tariq Toukan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/page_alloc.c | 37 ++++++++++++++----------------------- 1 file changed, 14 insertions(+), 23 deletions(-) commit 65895b67ad27df0f62bfaf82dd5622f95ea29196 Author: Aaron Lu Date: Fri Dec 28 00:35:18 2018 -0800 mm/page_alloc.c: free order-0 pages through PCP in page_frag_free() page_frag_free() calls __free_pages_ok() to free the page back to Buddy. This is OK for high order page, but for order-0 pages, it misses the optimization opportunity of using Per-Cpu-Pages and can cause zone lock contention when called frequently. Pawel Staszewski recently shared his result of 'how Linux kernel handles normal traffic'[1] and from perf data, Jesper Dangaard Brouer found the lock contention comes from page allocator: mlx5e_poll_tx_cq | --16.34%--napi_consume_skb | |--12.65%--__free_pages_ok | | | --11.86%--free_one_page | | | |--10.10%--queued_spin_lock_slowpath | | | --0.65%--_raw_spin_lock | |--1.55%--page_frag_free | --1.44%--skb_release_data Jesper explained how it happened: mlx5 driver RX-page recycle mechanism is not effective in this workload and pages have to go through the page allocator. The lock contention happens during mlx5 DMA TX completion cycle. And the page allocator cannot keep up at these speeds.[2] I thought that __free_pages_ok() are mostly freeing high order pages and thought this is an lock contention for high order pages but Jesper explained in detail that __free_pages_ok() here are actually freeing order-0 pages because mlx5 is using order-0 pages to satisfy its page pool allocation request.[3] The free path as pointed out by Jesper is: skb_free_head() -> skb_free_frag() -> page_frag_free() And the pages being freed on this path are order-0 pages. Fix this by doing similar things as in __page_frag_cache_drain() - send the being freed page to PCP if it's an order-0 page, or directly to Buddy if it is a high order page. With this change, Paweł hasn't noticed lock contention yet in his workload and Jesper has noticed a 7% performance improvement using a micro benchmark and lock contention is gone. Ilias' test on a 'low' speed 1Gbit interface on an cortex-a53 shows ~11% performance boost testing with 64byte packets and __free_pages_ok() disappeared from perf top. [1]: https://www.spinics.net/lists/netdev/msg531362.html [2]: https://www.spinics.net/lists/netdev/msg531421.html [3]: https://www.spinics.net/lists/netdev/msg531556.html [akpm@linux-foundation.org: add comment] Link: http://lkml.kernel.org/r/20181120014544.GB10657@intel.com Signed-off-by: Aaron Lu Reported-by: Pawel Staszewski Analysed-by: Jesper Dangaard Brouer Acked-by: Vlastimil Babka Acked-by: Mel Gorman Acked-by: Jesper Dangaard Brouer Acked-by: Ilias Apalodimas Tested-by: Ilias Apalodimas Acked-by: Alexander Duyck Acked-by: Tariq Toukan Acked-by: Pankaj gupta Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/page_alloc.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) commit 02917e9f8676207a4c577d4d94eae12bf348e9d7 Author: Dan Williams Date: Fri Dec 28 00:35:15 2018 -0800 mm, hmm: mark hmm_devmem_{add, add_resource} EXPORT_SYMBOL_GPL At Maintainer Summit, Greg brought up a topic I proposed around EXPORT_SYMBOL_GPL usage. The motivation was considerations for when EXPORT_SYMBOL_GPL is warranted and the criteria for taking the exceptional step of reclassifying an existing export. Specifically, I wanted to make the case that although the line is fuzzy and hard to specify in abstract terms, it is nonetheless clear that devm_memremap_pages() and HMM (Heterogeneous Memory Management) have crossed it. The devm_memremap_pages() facility should have been EXPORT_SYMBOL_GPL from the beginning, and HMM as a derivative of that functionality should have naturally picked up that designation as well. Contrary to typical rules, the HMM infrastructure was merged upstream with zero in-tree consumers. There was a promise at the time that those users would be merged "soon", but it has been over a year with no drivers arriving. While the Nouveau driver is about to belatedly make good on that promise it is clear that HMM was targeted first and foremost at an out-of-tree consumer. HMM is derived from devm_memremap_pages(), a facility Christoph and I spearheaded to support persistent memory. It combines a device lifetime model with a dynamically created 'struct page' / memmap array for any physical address range. It enables coordination and control of the many code paths in the kernel built to interact with memory via 'struct page' objects. With HMM the integration goes even deeper by allowing device drivers to hook and manipulate page fault and page free events. One interpretation of when EXPORT_SYMBOL is suitable is when it is exporting stable and generic leaf functionality. The devm_memremap_pages() facility continues to see expanding use cases, peer-to-peer DMA being the most recent, with no clear end date when it will stop attracting reworks and semantic changes. It is not suitable to export devm_memremap_pages() as a stable 3rd party driver API due to the fact that it is still changing and manipulates core behavior. Moreover, it is not in the best interest of the long term development of the core memory management subsystem to permit any external driver to effectively define its own system-wide memory management policies with no encouragement to engage with upstream. I am also concerned that HMM was designed in a way to minimize further engagement with the core-MM. That, with these hooks in place, device-drivers are free to implement their own policies without much consideration for whether and how the core-MM could grow to meet that need. Going forward not only should HMM be EXPORT_SYMBOL_GPL, but the core-MM should be allowed the opportunity and stimulus to change and address these new use cases as first class functionality. Original changelog: hmm_devmem_add(), and hmm_devmem_add_resource() duplicated devm_memremap_pages() and are now simple now wrappers around the core facility to inject a dev_pagemap instance into the global pgmap_radix and hook page-idle events. The devm_memremap_pages() interface is base infrastructure for HMM. HMM has more and deeper ties into the kernel memory management implementation than base ZONE_DEVICE which is itself a EXPORT_SYMBOL_GPL facility. Originally, the HMM page structure creation routines copied the devm_memremap_pages() code and reused ZONE_DEVICE. A cleanup to unify the implementations was discussed during the initial review: http://lkml.iu.edu/hypermail/linux/kernel/1701.2/00812.html Recent work to extend devm_memremap_pages() for the peer-to-peer-DMA facility enabled this cleanup to move forward. In addition to the integration with devm_memremap_pages() HMM depends on other GPL-only symbols: mmu_notifier_unregister_no_release percpu_ref region_intersects __class_create It goes further to consume / indirectly expose functionality that is not exported to any other driver: alloc_pages_vma walk_page_range HMM is derived from devm_memremap_pages(), and extends deep core-kernel fundamentals. Similar to devm_memremap_pages(), mark its entry points EXPORT_SYMBOL_GPL(). [logang@deltatee.com: PCI/P2PDMA: match interface changes to devm_memremap_pages()] Link: http://lkml.kernel.org/r/20181130225911.2900-1-logang@deltatee.com Link: http://lkml.kernel.org/r/154275560565.76910.15919297436557795278.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams Signed-off-by: Logan Gunthorpe Reviewed-by: Christoph Hellwig Cc: Logan Gunthorpe Cc: "Jérôme Glisse" Cc: Balbir Singh , Cc: Michal Hocko Cc: Benjamin Herrenschmidt Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/pci/p2pdma.c | 10 ++-------- mm/hmm.c | 4 ++-- 2 files changed, 4 insertions(+), 10 deletions(-) commit bbecd94e6c514a1559fc1a7749a62715958137b1 Author: Dan Williams Date: Fri Dec 28 00:35:11 2018 -0800 mm, hmm: replace hmm_devmem_pages_create() with devm_memremap_pages() Commit e8d513483300 ("memremap: change devm_memremap_pages interface to use struct dev_pagemap") refactored devm_memremap_pages() to allow a dev_pagemap instance to be supplied. Passing in a dev_pagemap interface simplifies the design of pgmap type drivers in that they can rely on container_of() to lookup any private data associated with the given dev_pagemap instance. In addition to the cleanups this also gives hmm users multi-order-radix improvements that arrived with commit ab1b597ee0e4 "mm, devm_memremap_pages: use multi-order radix for ZONE_DEVICE lookups" As part of the conversion to the devm_memremap_pages() method of handling the percpu_ref relative to when pages are put, the percpu_ref completion needs to move to hmm_devmem_ref_exit(). See 71389703839e ("mm, zone_device: Replace {get, put}_zone_device_page...") for details. Link: http://lkml.kernel.org/r/154275560053.76910.10870962637383152392.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams Reviewed-by: Christoph Hellwig Reviewed-by: Jérôme Glisse Acked-by: Balbir Singh Cc: Logan Gunthorpe Cc: Michal Hocko Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/hmm.c | 196 +++++++++------------------------------------------------------ 1 file changed, 26 insertions(+), 170 deletions(-) commit 58ef15b765af0d2cbe6799ec564f1dc485010ab8 Author: Dan Williams Date: Fri Dec 28 00:35:07 2018 -0800 mm, hmm: use devm semantics for hmm_devmem_{add, remove} devm semantics arrange for resources to be torn down when device-driver-probe fails or when device-driver-release completes. Similar to devm_memremap_pages() there is no need to support an explicit remove operation when the users properly adhere to devm semantics. Note that devm_kzalloc() automatically handles allocating node-local memory. Link: http://lkml.kernel.org/r/154275559545.76910.9186690723515469051.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams Reviewed-by: Christoph Hellwig Reviewed-by: Jérôme Glisse Cc: "Jérôme Glisse" Cc: Logan Gunthorpe Cc: Balbir Singh Cc: Michal Hocko Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/hmm.h | 4 +- mm/hmm.c | 127 ++++++++++------------------------------------------ 2 files changed, 25 insertions(+), 106 deletions(-) commit 69324b8f48339de2f90fdf2f774687fc6c47629a Author: Dan Williams Date: Fri Dec 28 00:35:01 2018 -0800 mm, devm_memremap_pages: add MEMORY_DEVICE_PRIVATE support In preparation for consolidating all ZONE_DEVICE enabling via devm_memremap_pages(), teach it how to handle the constraints of MEMORY_DEVICE_PRIVATE ranges. [jglisse@redhat.com: call move_pfn_range_to_zone for MEMORY_DEVICE_PRIVATE] Link: http://lkml.kernel.org/r/154275559036.76910.12434636179931292607.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams Reviewed-by: Jérôme Glisse Acked-by: Christoph Hellwig Reported-by: Logan Gunthorpe Reviewed-by: Logan Gunthorpe Cc: Balbir Singh Cc: Michal Hocko Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/memremap.c | 53 +++++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 41 insertions(+), 12 deletions(-) commit a95c90f1e2c253b280385ecf3d4ebfe476926b28 Author: Dan Williams Date: Fri Dec 28 00:34:57 2018 -0800 mm, devm_memremap_pages: fix shutdown handling The last step before devm_memremap_pages() returns success is to allocate a release action, devm_memremap_pages_release(), to tear the entire setup down. However, the result from devm_add_action() is not checked. Checking the error from devm_add_action() is not enough. The api currently relies on the fact that the percpu_ref it is using is killed by the time the devm_memremap_pages_release() is run. Rather than continue this awkward situation, offload the responsibility of killing the percpu_ref to devm_memremap_pages_release() directly. This allows devm_memremap_pages() to do the right thing relative to init failures and shutdown. Without this change we could fail to register the teardown of devm_memremap_pages(). The likelihood of hitting this failure is tiny as small memory allocations almost always succeed. However, the impact of the failure is large given any future reconfiguration, or disable/enable, of an nvdimm namespace will fail forever as subsequent calls to devm_memremap_pages() will fail to setup the pgmap_radix since there will be stale entries for the physical address range. An argument could be made to require that the ->kill() operation be set in the @pgmap arg rather than passed in separately. However, it helps code readability, tracking the lifetime of a given instance, to be able to grep the kill routine directly at the devm_memremap_pages() call site. Link: http://lkml.kernel.org/r/154275558526.76910.7535251937849268605.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams Fixes: e8d513483300 ("memremap: change devm_memremap_pages interface...") Reviewed-by: "Jérôme Glisse" Reported-by: Logan Gunthorpe Reviewed-by: Logan Gunthorpe Reviewed-by: Christoph Hellwig Cc: Balbir Singh Cc: Michal Hocko Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/dax/pmem.c | 14 +++----------- drivers/nvdimm/pmem.c | 13 +++++-------- include/linux/memremap.h | 2 ++ kernel/memremap.c | 30 ++++++++++++++---------------- tools/testing/nvdimm/test/iomap.c | 15 ++++++++++++++- 5 files changed, 38 insertions(+), 36 deletions(-) commit 06489cfbd915ff36c8e36df27f1c2dc60f97ca56 Author: Dan Williams Date: Fri Dec 28 00:34:54 2018 -0800 mm, devm_memremap_pages: kill mapping "System RAM" support Given the fact that devm_memremap_pages() requires a percpu_ref that is torn down by devm_memremap_pages_release() the current support for mapping RAM is broken. Support for remapping "System RAM" has been broken since the beginning and there is no existing user of this this code path, so just kill the support and make it an explicit error. This cleanup also simplifies a follow-on patch to fix the error path when setting a devm release action for devm_memremap_pages_release() fails. Link: http://lkml.kernel.org/r/154275557997.76910.14689813630968180480.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams Reviewed-by: "Jérôme Glisse" Reviewed-by: Christoph Hellwig Reviewed-by: Logan Gunthorpe Cc: Balbir Singh Cc: Michal Hocko Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/memremap.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) commit 808153e1187fa77ac7d7dad261ff476888dcf398 Author: Dan Williams Date: Fri Dec 28 00:34:50 2018 -0800 mm, devm_memremap_pages: mark devm_memremap_pages() EXPORT_SYMBOL_GPL devm_memremap_pages() is a facility that can create struct page entries for any arbitrary range and give drivers the ability to subvert core aspects of page management. Specifically the facility is tightly integrated with the kernel's memory hotplug functionality. It injects an altmap argument deep into the architecture specific vmemmap implementation to allow allocating from specific reserved pages, and it has Linux specific assumptions about page structure reference counting relative to get_user_pages() and get_user_pages_fast(). It was an oversight and a mistake that this was not marked EXPORT_SYMBOL_GPL from the outset. Again, devm_memremap_pagex() exposes and relies upon core kernel internal assumptions and will continue to evolve along with 'struct page', memory hotplug, and support for new memory types / topologies. Only an in-kernel GPL-only driver is expected to keep up with this ongoing evolution. This interface, and functionality derived from this interface, is not suitable for kernel-external drivers. Link: http://lkml.kernel.org/r/154275557457.76910.16923571232582744134.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Dan Williams Reviewed-by: Christoph Hellwig Acked-by: Michal Hocko Cc: "Jérôme Glisse" Cc: Balbir Singh Cc: Logan Gunthorpe Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/memremap.c | 2 +- tools/testing/nvdimm/test/iomap.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 7ead3342150ef253b3635385b0f5721e80c87fce Author: Huang Shijie Date: Fri Dec 28 00:34:46 2018 -0800 mm/page_alloc.c: change the order of MIGRATE_RECLAIMABLE/MIGRATE_MOVABLE in fallbacks In the enum migratetype definition, MIGRATE_MOVABLE is before MIGRATE_RECLAIMABLE. Change the order of them to match the enumeration's order. Link: http://lkml.kernel.org/r/20181121085821.3442-1-sjhuang@iluvatar.ai Signed-off-by: Huang Shijie Reviewed-by: Andrew Morton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/page_alloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ca880420665dbc8beec3693bee9f5eccb89de4a6 Author: Eric Biggers Date: Fri Dec 28 00:34:43 2018 -0800 userfaultfd: convert userfaultfd_ctx::refcount to refcount_t Reference counters should use refcount_t rather than atomic_t, since the refcount_t implementation can prevent overflows, reducing the exploitability of reference leak bugs. userfaultfd_ctx::refcount is a reference counter with the usual semantics, so convert it to refcount_t. Note: I replaced the BUG() on incrementing a 0 refcount with just refcount_inc(), since part of the semantics of refcount_t is that that incrementing a 0 refcount is not allowed; with CONFIG_REFCOUNT_FULL, refcount_inc() already checks for it and warns. Link: http://lkml.kernel.org/r/20181115003916.63381-1-ebiggers@kernel.org Signed-off-by: Eric Biggers Reviewed-by: Andrew Morton Cc: Andrea Arcangeli Reviewed-by: Mike Rapoport Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/userfaultfd.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) commit 66f71da9dd38af17dc17209cdde7987d4679a699 Author: Aaron Lu Date: Fri Dec 28 00:34:39 2018 -0800 mm/swap: use nr_node_ids for avail_lists in swap_info_struct Since a2468cc9bfdf ("swap: choose swap device according to numa node"), avail_lists field of swap_info_struct is changed to an array with MAX_NUMNODES elements. This made swap_info_struct size increased to 40KiB and needs an order-4 page to hold it. This is not optimal in that: 1 Most systems have way less than MAX_NUMNODES(1024) nodes so it is a waste of memory; 2 It could cause swapon failure if the swap device is swapped on after system has been running for a while, due to no order-4 page is available as pointed out by Vasily Averin. Solve the above two issues by using nr_node_ids(which is the actual possible node number the running system has) for avail_lists instead of MAX_NUMNODES. nr_node_ids is unknown at compile time so can't be directly used when declaring this array. What I did here is to declare avail_lists as zero element array and allocate space for it when allocating space for swap_info_struct. The reason why keep using array but not pointer is plist_for_each_entry needs the field to be part of the struct, so pointer will not work. This patch is on top of Vasily Averin's fix commit. I think the use of kvzalloc for swap_info_struct is still needed in case nr_node_ids is really big on some systems. Link: http://lkml.kernel.org/r/20181115083847.GA11129@intel.com Signed-off-by: Aaron Lu Reviewed-by: Andrew Morton Acked-by: Michal Hocko Cc: Vasily Averin Cc: Huang Ying Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/swap.h | 11 ++++++++++- mm/swapfile.c | 3 ++- 2 files changed, 12 insertions(+), 2 deletions(-) commit 8b09549c2bfd9f3f8f4cdad74107ef4f4ff9cdd7 Author: Wei Yang Date: Fri Dec 28 00:34:36 2018 -0800 vmscan: return NODE_RECLAIM_NOSCAN in node_reclaim() when CONFIG_NUMA is n Commit fa5e084e43eb ("vmscan: do not unconditionally treat zones that fail zone_reclaim() as full") changed the return value of node_reclaim(). The original return value 0 means NODE_RECLAIM_SOME after this commit. While the return value of node_reclaim() when CONFIG_NUMA is n is not changed. This will leads to call zone_watermark_ok() again. This patch fixes the return value by adjusting to NODE_RECLAIM_NOSCAN. Since node_reclaim() is only called in page_alloc.c, move it to mm/internal.h. Link: http://lkml.kernel.org/r/20181113080436.22078-1-richard.weiyang@gmail.com Signed-off-by: Wei Yang Acked-by: Michal Hocko Reviewed-by: Matthew Wilcox Cc: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/swap.h | 6 ------ mm/internal.h | 10 ++++++++++ 2 files changed, 10 insertions(+), 6 deletions(-) commit 476567e8735a0d06225f3873a86dfa0efd95f3a5 Author: Arun KS Date: Fri Dec 28 00:34:32 2018 -0800 mm: remove managed_page_count_lock spinlock Now that totalram_pages and managed_pages are atomic varibles, no need of managed_page_count spinlock. The lock had really a weak consistency guarantee. It hasn't been used for anything but the update but no reader actually cares about all the values being updated to be in sync. Link: http://lkml.kernel.org/r/1542090790-21750-5-git-send-email-arunks@codeaurora.org Signed-off-by: Arun KS Reviewed-by: Konstantin Khlebnikov Acked-by: Michal Hocko Acked-by: Vlastimil Babka Cc: David Hildenbrand Reviewed-by: Pavel Tatashin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/mmzone.h | 6 ------ mm/page_alloc.c | 5 ----- 2 files changed, 11 deletions(-) commit ca79b0c211af63fa3276f0e3fd7dd9ada2439839 Author: Arun KS Date: Fri Dec 28 00:34:29 2018 -0800 mm: convert totalram_pages and totalhigh_pages variables to atomic totalram_pages and totalhigh_pages are made static inline function. Main motivation was that managed_page_count_lock handling was complicating things. It was discussed in length here, https://lore.kernel.org/patchwork/patch/995739/#1181785 So it seemes better to remove the lock and convert variables to atomic, with preventing poteintial store-to-read tearing as a bonus. [akpm@linux-foundation.org: coding style fixes] Link: http://lkml.kernel.org/r/1542090790-21750-4-git-send-email-arunks@codeaurora.org Signed-off-by: Arun KS Suggested-by: Michal Hocko Suggested-by: Vlastimil Babka Reviewed-by: Konstantin Khlebnikov Reviewed-by: Pavel Tatashin Acked-by: Michal Hocko Acked-by: Vlastimil Babka Cc: David Hildenbrand Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/csky/mm/init.c | 4 ++-- arch/powerpc/platforms/pseries/cmm.c | 10 +++++----- arch/s390/mm/init.c | 2 +- arch/um/kernel/mem.c | 2 +- arch/x86/kernel/cpu/microcode/core.c | 2 +- drivers/char/agp/backend.c | 4 ++-- drivers/gpu/drm/i915/i915_gem.c | 2 +- drivers/gpu/drm/i915/selftests/i915_gem_gtt.c | 4 ++-- drivers/hv/hv_balloon.c | 2 +- drivers/md/dm-bufio.c | 2 +- drivers/md/dm-crypt.c | 2 +- drivers/md/dm-integrity.c | 2 +- drivers/md/dm-stats.c | 2 +- drivers/media/platform/mtk-vpu/mtk_vpu.c | 2 +- drivers/misc/vmw_balloon.c | 2 +- drivers/parisc/ccio-dma.c | 4 ++-- drivers/parisc/sba_iommu.c | 4 ++-- drivers/staging/android/ion/ion_system_heap.c | 2 +- drivers/xen/xen-selfballoon.c | 6 +++--- fs/ceph/super.h | 2 +- fs/file_table.c | 2 +- fs/fuse/inode.c | 2 +- fs/nfs/write.c | 2 +- fs/nfsd/nfscache.c | 2 +- fs/ntfs/malloc.h | 2 +- fs/proc/base.c | 2 +- include/linux/highmem.h | 28 +++++++++++++++++++++++++-- include/linux/mm.h | 27 +++++++++++++++++++++++++- include/linux/swap.h | 1 - kernel/fork.c | 2 +- kernel/kexec_core.c | 2 +- kernel/power/snapshot.c | 2 +- mm/highmem.c | 5 ++--- mm/huge_memory.c | 2 +- mm/kasan/quarantine.c | 2 +- mm/memblock.c | 4 ++-- mm/mm_init.c | 2 +- mm/oom_kill.c | 2 +- mm/page_alloc.c | 20 ++++++++++--------- mm/shmem.c | 9 +++++---- mm/slab.c | 2 +- mm/swap.c | 2 +- mm/util.c | 2 +- mm/vmalloc.c | 4 ++-- mm/workingset.c | 2 +- mm/zswap.c | 4 ++-- net/dccp/proto.c | 2 +- net/decnet/dn_route.c | 2 +- net/ipv4/tcp_metrics.c | 2 +- net/netfilter/nf_conntrack_core.c | 2 +- net/netfilter/xt_hashlimit.c | 2 +- net/sctp/protocol.c | 2 +- security/integrity/ima/ima_kexec.c | 2 +- 53 files changed, 131 insertions(+), 81 deletions(-) commit 9705bea5f833f4fc21d5bef5fce7348427f76ea4 Author: Arun KS Date: Fri Dec 28 00:34:24 2018 -0800 mm: convert zone->managed_pages to atomic variable totalram_pages, zone->managed_pages and totalhigh_pages updates are protected by managed_page_count_lock, but readers never care about it. Convert these variables to atomic to avoid readers potentially seeing a store tear. This patch converts zone->managed_pages. Subsequent patches will convert totalram_panges, totalhigh_pages and eventually managed_page_count_lock will be removed. Main motivation was that managed_page_count_lock handling was complicating things. It was discussed in length here, https://lore.kernel.org/patchwork/patch/995739/#1181785 So it seemes better to remove the lock and convert variables to atomic, with preventing poteintial store-to-read tearing as a bonus. Link: http://lkml.kernel.org/r/1542090790-21750-3-git-send-email-arunks@codeaurora.org Signed-off-by: Arun KS Suggested-by: Michal Hocko Suggested-by: Vlastimil Babka Reviewed-by: Konstantin Khlebnikov Reviewed-by: David Hildenbrand Acked-by: Michal Hocko Acked-by: Vlastimil Babka Reviewed-by: Pavel Tatashin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/gpu/drm/amd/amdkfd/kfd_crat.c | 2 +- include/linux/mmzone.h | 9 +++++-- lib/show_mem.c | 2 +- mm/memblock.c | 2 +- mm/page_alloc.c | 44 +++++++++++++++++------------------ mm/vmstat.c | 4 ++-- 6 files changed, 34 insertions(+), 29 deletions(-) commit 3d6357de8aa09e1966770dc1171c72679946464f Author: Arun KS Date: Fri Dec 28 00:34:20 2018 -0800 mm: reference totalram_pages and managed_pages once per function Patch series "mm: convert totalram_pages, totalhigh_pages and managed pages to atomic", v5. This series converts totalram_pages, totalhigh_pages and zone->managed_pages to atomic variables. totalram_pages, zone->managed_pages and totalhigh_pages updates are protected by managed_page_count_lock, but readers never care about it. Convert these variables to atomic to avoid readers potentially seeing a store tear. Main motivation was that managed_page_count_lock handling was complicating things. It was discussed in length here, https://lore.kernel.org/patchwork/patch/995739/#1181785 It seemes better to remove the lock and convert variables to atomic. With the change, preventing poteintial store-to-read tearing comes as a bonus. This patch (of 4): This is in preparation to a later patch which converts totalram_pages and zone->managed_pages to atomic variables. Please note that re-reading the value might lead to a different value and as such it could lead to unexpected behavior. There are no known bugs as a result of the current code but it is better to prevent from them in principle. Link: http://lkml.kernel.org/r/1542090790-21750-2-git-send-email-arunks@codeaurora.org Signed-off-by: Arun KS Reviewed-by: Konstantin Khlebnikov Reviewed-by: David Hildenbrand Acked-by: Michal Hocko Acked-by: Vlastimil Babka Reviewed-by: Pavel Tatashin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/um/kernel/mem.c | 2 +- arch/x86/kernel/cpu/microcode/core.c | 5 +++-- drivers/hv/hv_balloon.c | 19 ++++++++++--------- fs/file_table.c | 7 ++++--- kernel/fork.c | 5 +++-- kernel/kexec_core.c | 5 +++-- mm/page_alloc.c | 5 +++-- mm/shmem.c | 3 ++- net/dccp/proto.c | 7 ++++--- net/netfilter/nf_conntrack_core.c | 7 ++++--- net/netfilter/xt_hashlimit.c | 5 +++-- net/sctp/protocol.c | 7 ++++--- 12 files changed, 44 insertions(+), 33 deletions(-) commit fecd4a50baaebf6bde7f9e0b88fef13ffe5d98a1 Author: Wei Yang Date: Fri Dec 28 00:34:16 2018 -0800 mm: remove reset of pcp->counter in pageset_init() per_cpu_pageset is cleared by memset, it is not necessary to reset it again. Link: http://lkml.kernel.org/r/20181021023920.5501-1-richard.weiyang@gmail.com Signed-off-by: Wei Yang Reviewed-by: Andrew Morton Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/page_alloc.c | 1 - 1 file changed, 1 deletion(-) commit 46a3679b8190101e4ebdfe252ef79e6150a4f2ac Author: Michal Hocko Date: Fri Dec 28 00:34:13 2018 -0800 mm, memory_hotplug: do not clear numa_node association after hot_remove Per-cpu numa_node provides a default node for each possible cpu. The association gets initialized during the boot when the architecture specific code explores cpu->NUMA affinity. When the whole NUMA node is removed though we are clearing this association try_offline_node check_and_unmap_cpu_on_node unmap_cpu_on_node numa_clear_node numa_set_node(cpu, NUMA_NO_NODE) This means that whoever calls cpu_to_node for a cpu associated with such a node will get NUMA_NO_NODE. This is problematic for two reasons. First it is fragile because __alloc_pages_node would simply blow up on an out-of-bound access. We have encountered this when loading kvm module BUG: unable to handle kernel paging request at 00000000000021c0 IP: __alloc_pages_nodemask+0x93/0xb70 PGD 800000ffe853e067 PUD 7336bbc067 PMD 0 Oops: 0000 [#1] SMP [...] CPU: 88 PID: 1223749 Comm: modprobe Tainted: G W 4.4.156-94.64-default #1 RIP: __alloc_pages_nodemask+0x93/0xb70 RSP: 0018:ffff887354493b40 EFLAGS: 00010202 RAX: 00000000000021c0 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 00000000014000c0 RBP: 00000000014000c0 R08: ffffffffffffffff R09: 0000000000000000 R10: ffff88fffc89e790 R11: 0000000000014000 R12: 0000000000000101 R13: ffffffffa0772cd4 R14: ffffffffa0769ac0 R15: 0000000000000000 FS: 00007fdf2f2f1700(0000) GS:ffff88fffc880000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000021c0 CR3: 00000077205ee000 CR4: 0000000000360670 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: alloc_vmcs_cpu+0x3d/0x90 [kvm_intel] hardware_setup+0x781/0x849 [kvm_intel] kvm_arch_hardware_setup+0x28/0x190 [kvm] kvm_init+0x7c/0x2d0 [kvm] vmx_init+0x1e/0x32c [kvm_intel] do_one_initcall+0xca/0x1f0 do_init_module+0x5a/0x1d7 load_module+0x1393/0x1c90 SYSC_finit_module+0x70/0xa0 entry_SYSCALL_64_fastpath+0x1e/0xb7 DWARF2 unwinder stuck at entry_SYSCALL_64_fastpath+0x1e/0xb7 on an older kernel but the code is basically the same in the current Linus tree as well. alloc_vmcs_cpu could use alloc_pages_nodemask which would recognize NUMA_NO_NODE and use alloc_pages_node which would translate it to numa_mem_id but that is wrong as well because it would use a cpu affinity of the local CPU which might be quite far from the original node. It is also reasonable to expect that cpu_to_node will provide a sane value and there might be many more callers like that. The second problem is that __register_one_node relies on cpu_to_node to properly associate cpus back to the node when it is onlined. We do not want to lose that link as there is no arch independent way to get it from the early boot time AFAICS. Drop the whole check_and_unmap_cpu_on_node machinery and keep the association to fix both issues. The NODE_DATA(nid) is not deallocated so it will stay in place and if anybody wants to allocate from that node then a fallback node will be used. Thanks to Vlastimil Babka for his live system debugging skills that helped debugging the issue. Link: http://lkml.kernel.org/r/20181108100413.966-1-mhocko@kernel.org Fixes: e13fe8695c57 ("cpu-hotplug,memory-hotplug: clear cpu_to_node() when offlining the node") Signed-off-by: Michal Hocko Debugged-by: Vlastimil Babka Reported-by: Miroslav Benes Acked-by: Anshuman Khandual Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/memory_hotplug.c | 30 +----------------------------- 1 file changed, 1 insertion(+), 29 deletions(-) commit 9cabf929e7d92139a7d1ef3e517ad57dfece4739 Author: Yangtao Li Date: Fri Dec 28 00:34:09 2018 -0800 mm/mmap.c: remove verify_mm_writelocked() We should get rid of this function. It no longer serves its purpose. This is a historical artifact from 2005 where do_brk was called outside of the core mm. We do have a proper abstraction in vm_brk_flags and that one does the locking properly so there is no need to use this function. Link: http://lkml.kernel.org/r/20181108174856.10811-1-tiny.windzz@gmail.com Signed-off-by: Yangtao Li Acked-by: Michal Hocko Acked-by: David Rientjes Cc: Dan Williams Cc: Dominik Brodowski Cc: Dave Hansen Cc: David Woodhouse Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/mmap.c | 16 ---------------- 1 file changed, 16 deletions(-) commit 59e1a2f4bf83744e748636415fde7d1e9f557e05 Author: Timofey Titovets Date: Fri Dec 28 00:34:05 2018 -0800 ksm: replace jhash2 with xxhash Replace jhash2 with xxhash. Perf numbers: Intel(R) Xeon(R) CPU E5-2420 v2 @ 2.20GHz ksm: crc32c hash() 12081 MB/s ksm: xxh64 hash() 8770 MB/s ksm: xxh32 hash() 4529 MB/s ksm: jhash2 hash() 1569 MB/s Sioh Lee did some testing: crc32c_intel: 1084.10ns crc32c (no hardware acceleration): 7012.51ns xxhash32: 2227.75ns xxhash64: 1413.16ns jhash2: 5128.30ns As jhash2 always will be slower (for data size like PAGE_SIZE). Don't use it in ksm at all. Use only xxhash for now, because for using crc32c, cryptoapi must be initialized first - that requires some tricky solution to work well in all situations. Link: http://lkml.kernel.org/r/20181023182554.23464-3-nefelim4ag@gmail.com Signed-off-by: Timofey Titovets Signed-off-by: leesioh Reviewed-by: Pavel Tatashin Reviewed-by: Mike Rapoport Reviewed-by: Andrew Morton Cc: Andrea Arcangeli Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/Kconfig | 1 + mm/ksm.c | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) commit 0b9df58b79fa283fbedc0fb6a8e248599444bacc Author: Timofey Titovets Date: Fri Dec 28 00:34:00 2018 -0800 xxHash: create arch dependent 32/64-bit xxhash() Patch series "Currently used jhash are slow enough and replace it allow as to make KSM", v8. Apeed (in kernel): ksm: crc32c hash() 12081 MB/s ksm: xxh64 hash() 8770 MB/s ksm: xxh32 hash() 4529 MB/s ksm: jhash2 hash() 1569 MB/s Sioh Lee's testing (copy from other mail): Test platform: openstack cloud platform (NEWTON version) Experiment node: openstack based cloud compute node (CPU: xeon E5-2620 v3, memory 64gb) VM: (2 VCPU, RAM 4GB, DISK 20GB) * 4 Linux kernel: 4.14 (latest version) KSM setup - sleep_millisecs: 200ms, pages_to_scan: 200 Experiment process: Firstly, we turn off KSM and launch 4 VMs. Then we turn on the KSM and measure the checksum computation time until full_scans become two. The experimental results (the experimental value is the average of the measured values) crc32c_intel: 1084.10ns crc32c (no hardware acceleration): 7012.51ns xxhash32: 2227.75ns xxhash64: 1413.16ns jhash2: 5128.30ns In summary, the result shows that crc32c_intel has advantages over all of the hash function used in the experiment. (decreased by 84.54% compared to crc32c, 78.86% compared to jhash2, 51.33% xxhash32, 23.28% compared to xxhash64) the results are similar to those of Timofey. But, use only xxhash for now, because for using crc32c, cryptoapi must be initialized first - that require some tricky solution to work good in all situations. So: - First patch implement compile time pickup of fastest implementation of xxhash for target platform. - The second patch replaces jhash2 with xxhash This patch (of 2): xxh32() - fast on both 32/64-bit platforms xxh64() - fast only on 64-bit platform Create xxhash() which will pick up the fastest version at compile time. Link: http://lkml.kernel.org/r/20181023182554.23464-2-nefelim4ag@gmail.com Signed-off-by: Timofey Titovets Reviewed-by: Pavel Tatashin Reviewed-by: Mike Rapoport Reviewed-by: Andrew Morton Cc: Andrea Arcangeli Cc: leesioh Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/xxhash.h | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) commit d381c54760dcfad23743da40516e7e003d73952a Author: Michal Hocko Date: Fri Dec 28 00:33:56 2018 -0800 mm: only report isolation failures when offlining memory Heiko has complained that his log is swamped by warnings from has_unmovable_pages [ 20.536664] page dumped because: has_unmovable_pages [ 20.536792] page:000003d081ff4080 count:1 mapcount:0 mapping:000000008ff88600 index:0x0 compound_mapcount: 0 [ 20.536794] flags: 0x3fffe0000010200(slab|head) [ 20.536795] raw: 03fffe0000010200 0000000000000100 0000000000000200 000000008ff88600 [ 20.536796] raw: 0000000000000000 0020004100000000 ffffffff00000001 0000000000000000 [ 20.536797] page dumped because: has_unmovable_pages [ 20.536814] page:000003d0823b0000 count:1 mapcount:0 mapping:0000000000000000 index:0x0 [ 20.536815] flags: 0x7fffe0000000000() [ 20.536817] raw: 07fffe0000000000 0000000000000100 0000000000000200 0000000000000000 [ 20.536818] raw: 0000000000000000 0000000000000000 ffffffff00000001 0000000000000000 which are not triggered by the memory hotplug but rather CMA allocator. The original idea behind dumping the page state for all call paths was that these messages will be helpful debugging failures. From the above it seems that this is not the case for the CMA path because we are lacking much more context. E.g the second reported page might be a CMA allocated page. It is still interesting to see a slab page in the CMA area but it is hard to tell whether this is bug from the above output alone. Address this issue by dumping the page state only on request. Both start_isolate_page_range and has_unmovable_pages already have an argument to ignore hwpoison pages so make this argument more generic and turn it into flags and allow callers to combine non-default modes into a mask. While we are at it, has_unmovable_pages call from is_pageblock_removable_nolock (sysfs removable file) is questionable to report the failure so drop it from there as well. Link: http://lkml.kernel.org/r/20181218092802.31429-1-mhocko@kernel.org Signed-off-by: Michal Hocko Reported-by: Heiko Carstens Reviewed-by: Oscar Salvador Cc: Anshuman Khandual Cc: Stephen Rothwell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/page-isolation.h | 11 +++++++++-- mm/memory_hotplug.c | 5 +++-- mm/page_alloc.c | 11 +++++------ mm/page_isolation.c | 10 ++++------ 4 files changed, 21 insertions(+), 16 deletions(-) commit 2932c8b05056d4ba702f70f4deebe1c97600e62b Author: Michal Hocko Date: Fri Dec 28 00:33:53 2018 -0800 mm, memory_hotplug: be more verbose for memory offline failures There is only very limited information printed when the memory offlining fails: [ 1984.506184] rac1 kernel: memory offlining [mem 0x82600000000-0x8267fffffff] failed due to signal backoff This tells us that the failure is triggered by the userspace intervention but it doesn't tell us much more about the underlying reason. It might be that the page migration failes repeatedly and the userspace timeout expires and send a signal or it might be some of the earlier steps (isolation, memory notifier) takes too long. If the migration failes then it would be really helpful to see which page that and its state. The same applies to the isolation phase. If we fail to isolate a page from the allocator then knowing the state of the page would be helpful as well. Dump the page state that fails to get isolated or migrated. This will tell us more about the failure and what to focus on during debugging. [akpm@linux-foundation.org: add missing printk arg] [mhocko@suse.com: tweak dump_page() `reason' text] Link: http://lkml.kernel.org/r/20181116083020.20260-6-mhocko@kernel.org Link: http://lkml.kernel.org/r/20181107101830.17405-6-mhocko@kernel.org Signed-off-by: Michal Hocko Reviewed-by: Andrew Morton Reviewed-by: Oscar Salvador Reviewed-by: Anshuman Khandual Cc: Baoquan He Cc: Oscar Salvador Cc: William Kucharski Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/memory_hotplug.c | 12 ++++++++---- mm/page_alloc.c | 1 + 2 files changed, 9 insertions(+), 4 deletions(-) commit 7960509329c24a2bf0bc4929636614a1b7bb4443 Author: Michal Hocko Date: Fri Dec 28 00:33:49 2018 -0800 mm, memory_hotplug: print reason for the offlining failure The memory offlining failure reporting is inconsistent and insufficient. Some error paths simply do not report the failure to the log at all. When we do report there are no details about the reason of the failure and there are several of them which makes memory offlining failures hard to debug. Make sure that the memory offlining [mem %#010llx-%#010llx] failed message is printed for all failures and also provide a short textual reason for the failure e.g. [ 1984.506184] rac1 kernel: memory offlining [mem 0x82600000000-0x8267fffffff] failed due to signal backoff this tells us that the offlining has failed because of a signal pending aka user intervention. [akpm@linux-foundation.org: tweak messages a bit] Link: http://lkml.kernel.org/r/20181107101830.17405-5-mhocko@kernel.org Signed-off-by: Michal Hocko Reviewed-by: Andrew Morton Reviewed-by: Oscar Salvador Reviewed-by: Anshuman Khandual Cc: Baoquan He Cc: Oscar Salvador Cc: William Kucharski Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/memory_hotplug.c | 34 +++++++++++++++++++++++----------- 1 file changed, 23 insertions(+), 11 deletions(-) commit 6cc2baf600eca841549e182b471d5c7b8c4143c3 Author: Michal Hocko Date: Fri Dec 28 00:33:45 2018 -0800 mm, memory_hotplug: drop pointless block alignment checks from __offline_pages This function is never called from a context which would provide misaligned pfn range so drop the pointless check. Link: http://lkml.kernel.org/r/20181107101830.17405-4-mhocko@kernel.org Signed-off-by: Michal Hocko Reviewed-by: Andrew Morton Reviewed-by: Oscar Salvador Reviewed-by: Anshuman Khandual Cc: Baoquan He Cc: Oscar Salvador Cc: William Kucharski Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/memory_hotplug.c | 6 ------ 1 file changed, 6 deletions(-) commit e0392cf7c53a2c03dbda93de4073c78609b88c51 Author: Michal Hocko Date: Fri Dec 28 00:33:42 2018 -0800 mm: lower the printk loglevel for __dump_page messages __dump_page messages use KERN_EMERG resp. KERN_ALERT loglevel (this is the case since 2004). Most callers of this function are really detecting a critical page state and BUG right after. On the other hand the function is called also from contexts which just want to inform about the page state and those would rather not disrupt logs that much (e.g. some systems route these messages to the normal console). Reduce the loglevel to KERN_WARNING to make dump_page easier to reuse for other contexts while those messages will still make it to the kernel log in most setups. Even if the loglevel setup filters warnings away those paths that are really critical already print the more targeted error or panic and that should make it to the kernel log. [mhocko@kernel.org: fix __dump_page()] Link: http://lkml.kernel.org/r/20181212142540.GA7378@dhcp22.suse.cz [akpm@linux-foundation.org: s/KERN_WARN/KERN_WARNING/, per Michal] Link: http://lkml.kernel.org/r/20181107101830.17405-3-mhocko@kernel.org Signed-off-by: Michal Hocko Reviewed-by: Andrew Morton Reviewed-by: Anshuman Khandual Cc: Baoquan He Cc: Oscar Salvador Cc: Oscar Salvador Cc: William Kucharski Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/debug.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) commit 1c6fb1d89e73cd3bbfae7c400f1c615272aa435f Author: Michal Hocko Date: Fri Dec 28 00:33:38 2018 -0800 mm: print more information about mapping in __dump_page I have been promissing to improve memory offlining failures debugging for quite some time. As things stand now we get only very limited information in the kernel log when the offlining fails. It is usually only [ 1984.506184] rac1 kernel: memory offlining [mem 0x82600000000-0x8267fffffff] failed with no further details. We do not know what exactly fails and for what reason. Whenever I was forced to debug such a failure I've always had to do a debugging patch to tell me more. We can enable some tracepoints but it would be much better to get a better picture without using them. This patch series does 2 things. The first one is to make dump_page more usable by printing more information about the mapping patch 1. Then it reduces the log level from emerg to warning so that this function is usable from less critical context patch 2. Then I have added more detailed information about the offlining failure patch 4 and finally add dump_page to isolation and offlining migration paths. Patch 3 is a trivial cleanup. This patch (of 6): __dump_page prints the mapping pointer but that is quite unhelpful for many reports because the pointer itself only helps to distinguish anon/ksm mappings from other ones (because of lowest bits set). Sometimes it would be much more helpful to know what kind of mapping that is actually and if we know this is a file mapping then also try to resolve the dentry name. [dan.carpenter@oracle.com: fix a width vs precision bug in printk] Link: http://lkml.kernel.org/r/20181123072135.gqvblm2vdujbvfjs@kili.mountain [mhocko@kernel.org: use %dp to print dentry] Link: http://lkml.kernel.org/r/20181125080834.GB12455@dhcp22.suse.cz Link: http://lkml.kernel.org/r/20181107101830.17405-2-mhocko@kernel.org Signed-off-by: Michal Hocko Reviewed-by: Andrew Morton Reviewed-by: Anshuman Khandual Reviewed-by: William Kucharski Cc: Oscar Salvador Cc: Baoquan He Cc: Oscar Salvador Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/debug.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit 20ff1c950500380c6f74ec1a0d6f4eafab673ef6 Author: Gao Xiang Date: Fri Dec 28 00:33:34 2018 -0800 mm/readahead.c: simplify get_next_ra_size() It's a trivial simplification for get_next_ra_size() and clear enough for humans to understand. It also fixes potential overflow if ra->size(< ra_pages) is too large. Link: http://lkml.kernel.org/r/1540707206-19649-1-git-send-email-hsiangkao@aol.com Signed-off-by: Gao Xiang Reviewed-by: Fengguang Wu Reviewed-by: Matthew Wilcox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/readahead.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) commit 368686a95e55fd66b88542b5b23d802a4886b1aa Author: Anders Roxell Date: Fri Dec 28 00:33:31 2018 -0800 writeback: don't decrement wb->refcnt if !wb->bdi This happened while running in qemu-system-aarch64, the AMBA PL011 UART driver when enabling CONFIG_DEBUG_TEST_DRIVER_REMOVE. arch_initcall(pl011_init) came before subsys_initcall(default_bdi_init), devtmpfs' handle_remove() crashes because the reference count is a NULL pointer only because wb->bdi hasn't been initialized yet. Rework so that wb_put have an extra check if wb->bdi before decrement wb->refcnt and also add a WARN_ON_ONCE to get a warning if it happens again in other drivers. Link: http://lkml.kernel.org/r/20181030113545.30999-2-anders.roxell@linaro.org Fixes: 52ebea749aae ("writeback: make backing_dev_info host cgroup-specific bdi_writebacks") Signed-off-by: Arnd Bergmann Signed-off-by: Anders Roxell Co-developed-by: Arnd Bergmann Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/backing-dev-defs.h | 8 ++++++++ 1 file changed, 8 insertions(+) commit 6a90a83f1d1957647581ca48caa1f7cc4fa44f8d Author: Sean Christopherson Date: Fri Dec 28 00:33:28 2018 -0800 mm/mmu_notifier.c: remove mmu_notifier_synchronize() Contrary to its name, mmu_notifier_synchronize() does not synchronize the notifier's SRCU instance, but rather waits for RCU callbacks to finish. i.e. it invokes rcu_barrier(). The RCU documentation is quite clear on this matter, explicitly calling out that rcu_barrier() does not imply synchronize_rcu(). As there are no callers of mmu_notifier_synchronize() and it's unclear whether any user of mmu_notifier_call_srcu() will ever want to barrier on their callbacks, simply remove the function. Link: http://lkml.kernel.org/r/20181106134705.14197-1-sean.j.christopherson@intel.com Signed-off-by: Sean Christopherson Reviewed-by: Andrew Morton Cc: Peter Zijlstra Cc: Jérôme Glisse Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/mmu_notifier.h | 1 - mm/mmu_notifier.c | 7 ------- 2 files changed, 8 deletions(-) commit 5eb570a8d9248e0c1358078a59916d0e337e695b Author: Balbir Singh Date: Fri Dec 28 00:33:24 2018 -0800 mm/hotplug: optimize clear_hwpoisoned_pages() In hot remove, we try to clear poisoned pages, but a small optimization to check if num_poisoned_pages is 0 helps remove the iteration through nr_pages. [akpm@linux-foundation.org: tweak comment text] Link: http://lkml.kernel.org/r/20181102120001.4526-1-bsingharora@gmail.com Signed-off-by: Balbir Singh Acked-by: Michal Hocko Acked-by: Naoya Horiguchi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/sparse.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit c8f61cfc871fadfb73ad3eacd64fda457279e911 Author: Miles Chen Date: Fri Dec 28 00:33:21 2018 -0800 mm/page_owner: clamp read count to PAGE_SIZE The (root-only) page owner read might allocate a large size of memory with a large read count. Allocation fails can easily occur when doing high order allocations. Clamp buffer size to PAGE_SIZE to avoid arbitrary size allocation and avoid allocation fails due to high order allocation. [akpm@linux-foundation.org: use min_t()] Link: http://lkml.kernel.org/r/1541091607-27402-1-git-send-email-miles.chen@mediatek.com Signed-off-by: Miles Chen Acked-by: Michal Hocko Cc: Joe Perches Cc: Matthew Wilcox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/page_owner.c | 1 + 1 file changed, 1 insertion(+) commit 4e45f712d82c6b7a37e02faf388173ad12ab464d Author: Vlastimil Babka Date: Fri Dec 28 00:33:17 2018 -0800 include/linux/slab.h: fix sparse warning in kmalloc_type() Multiple people have reported the following sparse warning: ./include/linux/slab.h:332:43: warning: dubious: x & !y The minimal fix would be to change the logical & to boolean &&, which emits the same code, but Andrew has suggested that the branch-avoiding tricks are maybe not worthwile. David Laight provided a nice comparison of disassembly of multiple variants, which shows that the current version produces a 4 deep dependency chain, and fixing the sparse warning by changing logical and to multiplication emits an IMUL, making it even more expensive. The code as rewritten by this patch yielded the best disassembly, with a single predictable branch for the most common case, and a ternary operator for the rest, which gcc seems to compile without a branch or cmov by itself. The result should be more readable, without a sparse warning and probably also faster for the common case. Link: http://lkml.kernel.org/r/80340595-d7c5-97b9-4f6c-23fa893a91e9@suse.cz Fixes: 1291523f2c1d ("mm, slab/slub: introduce kmalloc-reclaimable caches") Reviewed-by: Andrew Morton Signed-off-by: Vlastimil Babka Reported-by: Bart Van Assche Reported-by: Darryl T. Agostinelli Reported-by: Masahiro Yamada Suggested-by: Andrew Morton Suggested-by: David Laight Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/slab.h | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) commit 88349a2837fbaef83862a011e1f53c4551d3e199 Author: Wei Yang Date: Fri Dec 28 00:33:13 2018 -0800 mm/slub.c: record final state of slub action in deactivate_slab() If __cmpxchg_double_slab() fails and (l != m), current code records transition states of slub action. Update the action after __cmpxchg_double_slab() success to record the final state. [akpm@linux-foundation.org: more whitespace cleanup] Link: http://lkml.kernel.org/r/20181107013119.3816-1-richard.weiyang@gmail.com Signed-off-by: Wei Yang Reviewed-by: Andrew Morton Cc: Christoph Lameter Cc: Pekka Enberg Cc: David Rientjes Cc: Joonsoo Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/slub.c | 21 +++++++-------------- 1 file changed, 7 insertions(+), 14 deletions(-) commit 6159d0f5c03e81daed29657e60383ee27f979b4a Author: Wei Yang Date: Fri Dec 28 00:33:09 2018 -0800 mm/slub.c: page is always non-NULL in node_match() node_match() is a static function and is only invoked in slub.c. In all three places, `page' is ensured to be valid. Link: http://lkml.kernel.org/r/20181106150245.1668-1-richard.weiyang@gmail.com Signed-off-by: Wei Yang Acked-by: Christoph Lameter Cc: Pekka Enberg Cc: David Rientjes Cc: Joonsoo Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/slub.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1265ef2de4cef44cec91ba47009958eec6162836 Author: Wei Yang Date: Fri Dec 28 00:33:06 2018 -0800 mm/slub.c: remove validation on cpu_slab in __flush_cpu_slab() cpu_slab is a per cpu variable which is allocated in all or none. If a cpu_slab failed to be allocated, the slub is not usable. We could use cpu_slab without validation in __flush_cpu_slab(). Link: http://lkml.kernel.org/r/20181103141218.22844-1-richard.weiyang@gmail.com Signed-off-by: Wei Yang Reviewed-by: Andrew Morton Cc: Christoph Lameter Cc: Pekka Enberg Cc: David Rientjes Cc: Joonsoo Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/slub.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) commit 221d7da66cd3435b28a0404f62168d25f57aca4e Author: Yangtao Li Date: Fri Dec 28 00:33:01 2018 -0800 mm, slab: remove unnecessary unlikely() WARN_ON() already contains an unlikely(), so it's not necessary to use unlikely. Also change WARN_ON() back to WARN_ON_ONCE() to avoid potentially spamming dmesg with user-triggerable large allocations. [akpm@linux-foundation.org: s/WARN_ON/WARN_ON_ONCE/, per Vlastimil] Link: http://lkml.kernel.org/r/20181104125028.3572-1-tiny.windzz@gmail.com Signed-off-by: Yangtao Li Acked-by: Vlastimil Babka Reviewed-by: Andrew Morton Acked-by: David Rientjes Cc: Christoph Lameter Cc: Pekka Enberg Cc: Joonsoo Kim Cc: Dmitry Vyukov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/slab_common.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 70306d9dce75abde855cefaf32b3f71eed8602a3 Author: Junxiao Bi Date: Fri Dec 28 00:32:57 2018 -0800 ocfs2: don't clear bh uptodate for block read For sync io read in ocfs2_read_blocks_sync(), first clear bh uptodate flag and submit the io, second wait io done, last check whether bh uptodate, if not return io error. If two sync io for the same bh were issued, it could be the first io done and set uptodate flag, but just before check that flag, the second io came in and cleared uptodate, then ocfs2_read_blocks_sync() for the first io will return IO error. Indeed it's not necessary to clear uptodate flag, as the io end handler end_buffer_read_sync() will set or clear it based on io succeed or failed. The following message was found from a nfs server but the underlying storage returned no error. [4106438.567376] (nfsd,7146,3):ocfs2_get_suballoc_slot_bit:2780 ERROR: read block 1238823695 failed -5 [4106438.567569] (nfsd,7146,3):ocfs2_get_suballoc_slot_bit:2812 ERROR: status = -5 [4106438.567611] (nfsd,7146,3):ocfs2_test_inode_bit:2894 ERROR: get alloc slot and bit failed -5 [4106438.567643] (nfsd,7146,3):ocfs2_test_inode_bit:2932 ERROR: status = -5 [4106438.567675] (nfsd,7146,3):ocfs2_get_dentry:94 ERROR: test inode bit failed -5 Same issue in non sync read ocfs2_read_blocks(), fixed it as well. Link: http://lkml.kernel.org/r/20181121020023.3034-4-junxiao.bi@oracle.com Signed-off-by: Junxiao Bi Reviewed-by: Changwei Ge Reviewed-by: Yiwen Jiang Cc: Joel Becker Cc: Joseph Qi Cc: Jun Piao Cc: Mark Fasheh Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/ocfs2/buffer_head_io.c | 2 -- 1 file changed, 2 deletions(-) commit d85400af790dba2aa294f0a77e712f166681f977 Author: Junxiao Bi Date: Fri Dec 28 00:32:53 2018 -0800 ocfs2: clear journal dirty flag after shutdown journal Dirty flag of the journal should be cleared at the last stage of umount, if do it before jbd2_journal_destroy(), then some metadata in uncommitted transaction could be lost due to io error, but as dirty flag of journal was already cleared, we can't find that until run a full fsck. This may cause system panic or other corruption. Link: http://lkml.kernel.org/r/20181121020023.3034-3-junxiao.bi@oracle.com Signed-off-by: Junxiao Bi Reviewed-by: Yiwen Jiang Reviewed-by: Joseph Qi Cc: Jun Piao Cc: Changwei Ge Cc: Joel Becker Cc: Mark Fasheh Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/ocfs2/journal.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 532e1e54c8140188e192348c790317921cb2dc1c Author: Junxiao Bi Date: Fri Dec 28 00:32:50 2018 -0800 ocfs2: fix panic due to unrecovered local alloc mount.ocfs2 ignore the inconsistent error that journal is clean but local alloc is unrecovered. After mount, local alloc not empty, then reserver cluster didn't alloc a new local alloc window, reserveration map is empty(ocfs2_reservation_map.m_bitmap_len = 0), that triggered the following panic. This issue was reported at https://oss.oracle.com/pipermail/ocfs2-devel/2015-May/010854.html and was advised to fixed during mount. But this is a very unusual inconsistent state, usually journal dirty flag should be cleared at the last stage of umount until every other things go right. We may need do further debug to check that. Any way to avoid possible futher corruption, mount should be abort and fsck should be run. (mount.ocfs2,1765,1):ocfs2_load_local_alloc:353 ERROR: Local alloc hasn't been recovered! found = 6518, set = 6518, taken = 8192, off = 15912372 ocfs2: Mounting device (202,64) on (node 0, slot 3) with ordered data mode. o2dlm: Joining domain 89CEAC63CC4F4D03AC185B44E0EE0F3F ( 0 1 2 3 4 5 6 8 ) 8 nodes ocfs2: Mounting device (202,80) on (node 0, slot 3) with ordered data mode. o2hb: Region 89CEAC63CC4F4D03AC185B44E0EE0F3F (xvdf) is now a quorum device o2net: Accepted connection from node yvwsoa17p (num 7) at 172.22.77.88:7777 o2dlm: Node 7 joins domain 64FE421C8C984E6D96ED12C55FEE2435 ( 0 1 2 3 4 5 6 7 8 ) 9 nodes o2dlm: Node 7 joins domain 89CEAC63CC4F4D03AC185B44E0EE0F3F ( 0 1 2 3 4 5 6 7 8 ) 9 nodes ------------[ cut here ]------------ kernel BUG at fs/ocfs2/reservations.c:507! invalid opcode: 0000 [#1] SMP Modules linked in: ocfs2 rpcsec_gss_krb5 auth_rpcgss nfsv4 nfs fscache lockd grace ocfs2_dlmfs ocfs2_stack_o2cb ocfs2_dlm ocfs2_nodemanager ocfs2_stackglue configfs sunrpc ipt_REJECT nf_reject_ipv4 nf_conntrack_ipv4 nf_defrag_ipv4 iptable_filter ip_tables ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables ib_ipoib rdma_ucm ib_ucm ib_uverbs ib_umad rdma_cm ib_cm iw_cm ib_sa ib_mad ib_core ib_addr ipv6 ovmapi ppdev parport_pc parport xen_netfront fb_sys_fops sysimgblt sysfillrect syscopyarea acpi_cpufreq pcspkr i2c_piix4 i2c_core sg ext4 jbd2 mbcache2 sr_mod cdrom xen_blkfront pata_acpi ata_generic ata_piix floppy dm_mirror dm_region_hash dm_log dm_mod CPU: 0 PID: 4349 Comm: startWebLogic.s Not tainted 4.1.12-124.19.2.el6uek.x86_64 #2 Hardware name: Xen HVM domU, BIOS 4.4.4OVM 09/06/2018 task: ffff8803fb04e200 ti: ffff8800ea4d8000 task.ti: ffff8800ea4d8000 RIP: 0010:[] [] __ocfs2_resv_find_window+0x498/0x760 [ocfs2] Call Trace: ocfs2_resmap_resv_bits+0x10d/0x400 [ocfs2] ocfs2_claim_local_alloc_bits+0xd0/0x640 [ocfs2] __ocfs2_claim_clusters+0x178/0x360 [ocfs2] ocfs2_claim_clusters+0x1f/0x30 [ocfs2] ocfs2_convert_inline_data_to_extents+0x634/0xa60 [ocfs2] ocfs2_write_begin_nolock+0x1c6/0x1da0 [ocfs2] ocfs2_write_begin+0x13e/0x230 [ocfs2] generic_perform_write+0xbf/0x1c0 __generic_file_write_iter+0x19c/0x1d0 ocfs2_file_write_iter+0x589/0x1360 [ocfs2] __vfs_write+0xb8/0x110 vfs_write+0xa9/0x1b0 SyS_write+0x46/0xb0 system_call_fastpath+0x18/0xd7 Code: ff ff 8b 75 b8 39 75 b0 8b 45 c8 89 45 98 0f 84 e5 fe ff ff 45 8b 74 24 18 41 8b 54 24 1c e9 56 fc ff ff 85 c0 0f 85 48 ff ff ff <0f> 0b 48 8b 05 cf c3 de ff 48 ba 00 00 00 00 00 00 00 10 48 85 RIP __ocfs2_resv_find_window+0x498/0x760 [ocfs2] RSP ---[ end trace 566f07529f2edf3c ]--- Kernel panic - not syncing: Fatal exception Kernel Offset: disabled Link: http://lkml.kernel.org/r/20181121020023.3034-2-junxiao.bi@oracle.com Signed-off-by: Junxiao Bi Reviewed-by: Yiwen Jiang Acked-by: Joseph Qi Cc: Jun Piao Cc: Mark Fasheh Cc: Joel Becker Cc: Changwei Ge Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/ocfs2/localalloc.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) commit 9e6aea22802b5684c7e1d69822aeb0844dd01953 Author: Larry Chen Date: Fri Dec 28 00:32:46 2018 -0800 ocfs2: improve ocfs2 Makefile Included file path was hard-wired in the ocfs2 makefile, which might causes some confusion when compiling ocfs2 as an external module. Say if we compile ocfs2 module as following. cp -r /kernel/tree/fs/ocfs2 /other/dir/ocfs2 cd /other/dir/ocfs2 make -C /path/to/kernel_source M=`pwd` modules Acutally, the compiler wil try to find included file in /kernel/tree/fs/ocfs2, rather than the directory /other/dir/ocfs2. To fix this little bug, we introduce the var $(src) provided by kbuild. $(src) means the absolute path of the running kbuild file. Link: http://lkml.kernel.org/r/20181108085546.15149-1-lchen@suse.com Signed-off-by: Larry Chen Reviewed-by: Andrew Morton Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Joseph Qi Cc: Changwei Ge Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/ocfs2/Makefile | 2 +- fs/ocfs2/dlm/Makefile | 2 +- fs/ocfs2/dlmfs/Makefile | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) commit dec5b0d4a99f5d4be02461ac0c7f62904509b88b Author: zhong jiang Date: Fri Dec 28 00:32:43 2018 -0800 ocfs2: remove set but not used variable 'lastzero' lastzero is not used after setting its value. It is safe to remove the unused variable. Link: http://lkml.kernel.org/r/1540296942-24533-1-git-send-email-zhongjiang@huawei.com Signed-off-by: zhong jiang Reviewed-by: Andrew Morton Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Joseph Qi Cc: Changwei Ge Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/ocfs2/localalloc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit cb6a8fd7a6bfa0999f726a9cdb506b3345d937b6 Author: zhong jiang Date: Fri Dec 28 00:32:39 2018 -0800 ocfs2: dlmfs: remove set but not used variable 'status' status is not used after setting its value. It is safe to remove the unused variable. Link: http://lkml.kernel.org/r/1540300179-26697-1-git-send-email-zhongjiang@huawei.com Signed-off-by: zhong jiang Reviewed-by: Jun Piao Acked-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/ocfs2/dlmfs/dlmfs.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 874b1ef0ef5117c071f431fdebbf388eccbcc1f2 Author: Jia Guo Date: Fri Dec 28 00:32:35 2018 -0800 ocfs2: optimize the reading of heartbeat data Reading heartbeat data from lowest node rather than from zero, in cases where the node is not defined from zero, can reduce the number of sectors read. Here is a simple test data obtained with 'iostat -dmx dm-5 2', with two nodes in the cluster, node number 10, 20, respectively. Before optimization: Device: rrqm/s wrqm/s r/s w/s rMB/s wMB/s avgrq-sz avgqu-sz await r_await w_await svctm %util dm-5 0.00 0.00 0.50 0.50 0.01 0.00 11.00 0.00 1.00 1.00 1.00 1.50 0.15 After the optimization: Device: rrqm/s wrqm/s r/s w/s rMB/s wMB/s avgrq-sz avgqu-sz await r_await w_await svctm %util dm-5 0.00 0.00 0.50 0.50 0.00 0.00 6.00 0.00 0.50 1.00 0.00 0.50 0.05 Link: http://lkml.kernel.org/r/99fe4988-69ac-3615-a218-3042fe6fbe72@huawei.com Signed-off-by: Jia Guo Reviewed-by: Jun Piao Reviewed-by: Yiwen Jiang Acked-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/ocfs2/cluster/heartbeat.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) commit a9ee3a63dbfff5237bc682b88c02d91a3c798e35 Author: Qian Cai Date: Fri Dec 28 00:32:32 2018 -0800 debugobjects: call debug_objects_mem_init eariler The current value of the early boot static pool size, 1024 is not big enough for systems with large number of CPUs with timer or/and workqueue objects selected. As the results, systems have 60+ CPUs with both timer and workqueue objects enabled could trigger "ODEBUG: Out of memory. ODEBUG disabled". Some debug objects are allocated during the early boot. Enabling some options like timers or workqueue objects may increase the size required significantly with large number of CPUs. For example, CONFIG_DEBUG_OBJECTS_TIMERS: No. CPUs x 2 (worker pool) objects: start_kernel workqueue_init_early init_worker_pool init_timer_key debug_object_init plus No. CPUs objects (CONFIG_HIGH_RES_TIMERS): sched_init hrtick_rq_init hrtimer_init CONFIG_DEBUG_OBJECTS_WORK: No. CPUs objects: vmalloc_init __init_work plus No. CPUs x 6 (workqueue) objects: workqueue_init_early alloc_workqueue __alloc_workqueue_key alloc_and_link_pwqs init_pwq Also, plus No. CPUs objects: perf_event_init __init_srcu_struct init_srcu_struct_fields init_srcu_struct_nodes __init_work However, none of the things are actually used or required before debug_objects_mem_init() is invoked, so just move the call right before vmalloc_init(). According to tglx, "the reason why the call is at this place in start_kernel() is historical. It's because back in the days when debugobjects were added the memory allocator was enabled way later than today." Link: http://lkml.kernel.org/r/20181126102407.1836-1-cai@gmx.us Signed-off-by: Qian Cai Suggested-by: Thomas Gleixner Cc: Waiman Long Cc: Yang Shi Cc: Arnd Bergmann Cc: Catalin Marinas Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds init/main.c | 2 +- lib/debugobjects.c | 8 +++----- 2 files changed, 4 insertions(+), 6 deletions(-) commit 4494ce4fb4ff42946f48bbc8a5ac55ee18dca600 Author: Kuninori Morimoto Date: Fri Dec 28 00:32:28 2018 -0800 sh: lib: convert to SPDX identifiers Update license to use SPDX-License-Identifier instead of verbose license text. Link: http://lkml.kernel.org/r/871s6wcswb.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Kuninori Morimoto Reviewed-by: Simon Horman Cc: Yoshinori Sato Cc: Rich Felker Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/sh/lib/ashiftrt.S | 29 ++++------------------------- arch/sh/lib/ashlsi3.S | 29 ++++------------------------- arch/sh/lib/ashrsi3.S | 29 ++++------------------------- arch/sh/lib/checksum.S | 9 +++------ arch/sh/lib/io.c | 5 +---- arch/sh/lib/libgcc.h | 2 ++ arch/sh/lib/lshrsi3.S | 29 ++++------------------------- arch/sh/lib/mcount.S | 7 ++----- arch/sh/lib/movmem.S | 29 ++++------------------------- arch/sh/lib/udiv_qrnnd.S | 29 ++++------------------------- arch/sh/lib/udivsi3.S | 29 ++++------------------------- arch/sh/lib/udivsi3_i4i-Os.S | 29 ++++------------------------- arch/sh/lib/udivsi3_i4i.S | 29 ++++------------------------- 13 files changed, 44 insertions(+), 240 deletions(-) commit 5933f6d220403b55772d2caf48a9a39d777fd630 Author: Kuninori Morimoto Date: Fri Dec 28 00:32:24 2018 -0800 sh: kernel: convert to SPDX identifiers Update license to use SPDX-License-Identifier instead of verbose license text. Link: http://lkml.kernel.org/r/8736rccswn.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Kuninori Morimoto Reviewed-by: Simon Horman Cc: Rich Felker Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/sh/kernel/debugtraps.S | 7 ++----- arch/sh/kernel/disassemble.c | 5 +---- arch/sh/kernel/dma-coherent.c | 5 +---- arch/sh/kernel/dumpstack.c | 5 +---- arch/sh/kernel/dwarf.c | 5 +---- arch/sh/kernel/entry-common.S | 8 ++------ arch/sh/kernel/head_32.S | 7 ++----- arch/sh/kernel/head_64.S | 7 ++----- arch/sh/kernel/hw_breakpoint.c | 5 +---- arch/sh/kernel/idle.c | 5 +---- arch/sh/kernel/io.c | 5 +---- arch/sh/kernel/io_trapped.c | 5 +---- arch/sh/kernel/iomap.c | 5 +---- arch/sh/kernel/ioport.c | 5 +---- arch/sh/kernel/irq_32.c | 5 +---- arch/sh/kernel/irq_64.c | 5 +---- arch/sh/kernel/kgdb.c | 5 +---- arch/sh/kernel/kprobes.c | 5 +---- arch/sh/kernel/machine_kexec.c | 4 +--- arch/sh/kernel/machvec.c | 5 +---- arch/sh/kernel/module.c | 15 +-------------- arch/sh/kernel/nmi_debug.c | 5 +---- arch/sh/kernel/perf_callchain.c | 5 +---- arch/sh/kernel/perf_event.c | 5 +---- arch/sh/kernel/process_32.c | 5 +---- arch/sh/kernel/process_64.c | 5 +---- arch/sh/kernel/ptrace_32.c | 5 +---- arch/sh/kernel/ptrace_64.c | 5 +---- arch/sh/kernel/relocate_kernel.S | 6 ++---- arch/sh/kernel/return_address.c | 5 +---- arch/sh/kernel/sh_bios.c | 5 +---- arch/sh/kernel/sh_ksyms_64.c | 5 +---- arch/sh/kernel/signal_64.c | 5 +---- arch/sh/kernel/smp.c | 5 +---- arch/sh/kernel/stacktrace.c | 5 +---- arch/sh/kernel/swsusp.c | 5 +---- arch/sh/kernel/syscalls_32.S | 8 ++------ arch/sh/kernel/syscalls_64.S | 7 ++----- arch/sh/kernel/time.c | 5 +---- arch/sh/kernel/topology.c | 5 +---- arch/sh/kernel/traps_32.c | 5 +---- arch/sh/kernel/traps_64.c | 5 +---- arch/sh/kernel/unwinder.c | 1 + arch/sh/kernel/vsyscall/vsyscall.c | 5 +---- 44 files changed, 51 insertions(+), 189 deletions(-) commit b0a148f80c1526951d6d196ded1d0c93158c2e25 Author: Kuninori Morimoto Date: Fri Dec 28 00:32:21 2018 -0800 sh: cpu: convert to SPDX identifiers Update license to use SPDX-License-Identifier instead of verbose license text. Link: http://lkml.kernel.org/r/874lbscswy.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Kuninori Morimoto Reviewed-by: Simon Horman Cc: Rich Felker Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/sh/kernel/cpu/clock.c | 5 +---- arch/sh/kernel/cpu/init.c | 5 +---- arch/sh/kernel/cpu/irq/Makefile | 1 + arch/sh/kernel/cpu/irq/intc-sh5.c | 5 +---- arch/sh/kernel/cpu/irq/ipr.c | 5 +---- arch/sh/kernel/cpu/pfc.c | 10 +--------- 6 files changed, 6 insertions(+), 25 deletions(-) commit 176ce1b7b0f6469eac05677e6f2ae9624e7bf879 Author: Kuninori Morimoto Date: Fri Dec 28 00:32:18 2018 -0800 sh: shmobile: convert to SPDX identifiers Update license to use SPDX-License-Identifier instead of verbose license text. Link: http://lkml.kernel.org/r/875zw8csxa.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Kuninori Morimoto Reviewed-by: Simon Horman Cc: Rich Felker Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/sh/kernel/cpu/shmobile/Makefile | 1 + arch/sh/kernel/cpu/shmobile/cpuidle.c | 5 +---- arch/sh/kernel/cpu/shmobile/pm.c | 5 +---- arch/sh/kernel/cpu/shmobile/sleep.S | 7 ++----- 4 files changed, 5 insertions(+), 13 deletions(-) commit 82e1d03766a2b5d088f66a938ce8e1605a24d327 Author: Kuninori Morimoto Date: Fri Dec 28 00:32:14 2018 -0800 sh: sh5: convert to SPDX identifiers Update license to use SPDX-License-Identifier instead of verbose license text. Link: http://lkml.kernel.org/r/877egocsxl.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Kuninori Morimoto Reviewed-by: Simon Horman Cc: Rich Felker Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/sh/kernel/cpu/sh5/clock-sh5.c | 5 +---- arch/sh/kernel/cpu/sh5/entry.S | 7 ++----- arch/sh/kernel/cpu/sh5/fpu.c | 5 +---- arch/sh/kernel/cpu/sh5/probe.c | 5 +---- arch/sh/kernel/cpu/sh5/setup-sh5.c | 5 +---- arch/sh/kernel/cpu/sh5/switchto.S | 7 ++----- arch/sh/kernel/cpu/sh5/unwind.c | 5 +---- 7 files changed, 9 insertions(+), 30 deletions(-) commit add5ca2c48870cc6632179eccd0f0048a03fe43f Author: Kuninori Morimoto Date: Fri Dec 28 00:32:11 2018 -0800 sh: sh4a: convert to SPDX identifiers Update license to use SPDX-License-Identifier instead of verbose license text. Link: http://lkml.kernel.org/r/878t14csxy.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Kuninori Morimoto Reviewed-by: Simon Horman Cc: Rich Felker Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/sh/kernel/cpu/sh4a/clock-sh7343.c | 14 +------------- arch/sh/kernel/cpu/sh4a/clock-sh7366.c | 14 +------------- arch/sh/kernel/cpu/sh4a/clock-sh7722.c | 14 +------------- arch/sh/kernel/cpu/sh4a/clock-sh7723.c | 14 +------------- arch/sh/kernel/cpu/sh4a/clock-sh7724.c | 14 +------------- arch/sh/kernel/cpu/sh4a/clock-sh7734.c | 5 +---- arch/sh/kernel/cpu/sh4a/clock-sh7757.c | 5 +---- arch/sh/kernel/cpu/sh4a/clock-sh7763.c | 5 +---- arch/sh/kernel/cpu/sh4a/clock-sh7770.c | 5 +---- arch/sh/kernel/cpu/sh4a/clock-sh7780.c | 5 +---- arch/sh/kernel/cpu/sh4a/clock-sh7785.c | 5 +---- arch/sh/kernel/cpu/sh4a/clock-sh7786.c | 5 +---- arch/sh/kernel/cpu/sh4a/clock-shx3.c | 5 +---- arch/sh/kernel/cpu/sh4a/intc-shx3.c | 5 +---- arch/sh/kernel/cpu/sh4a/perf_event.c | 5 +---- arch/sh/kernel/cpu/sh4a/pinmux-sh7723.c | 5 +---- arch/sh/kernel/cpu/sh4a/pinmux-sh7724.c | 5 +---- arch/sh/kernel/cpu/sh4a/pinmux-sh7734.c | 5 +---- arch/sh/kernel/cpu/sh4a/pinmux-sh7757.c | 5 +---- arch/sh/kernel/cpu/sh4a/pinmux-sh7785.c | 5 +---- arch/sh/kernel/cpu/sh4a/pinmux-sh7786.c | 5 +---- arch/sh/kernel/cpu/sh4a/pinmux-shx3.c | 5 +---- arch/sh/kernel/cpu/sh4a/setup-sh7343.c | 5 +---- arch/sh/kernel/cpu/sh4a/setup-sh7366.c | 5 +---- arch/sh/kernel/cpu/sh4a/setup-sh7722.c | 5 +---- arch/sh/kernel/cpu/sh4a/setup-sh7723.c | 5 +---- arch/sh/kernel/cpu/sh4a/setup-sh7724.c | 5 +---- arch/sh/kernel/cpu/sh4a/setup-sh7734.c | 7 ++----- arch/sh/kernel/cpu/sh4a/setup-sh7757.c | 5 +---- arch/sh/kernel/cpu/sh4a/setup-sh7763.c | 5 +---- arch/sh/kernel/cpu/sh4a/setup-sh7770.c | 5 +---- arch/sh/kernel/cpu/sh4a/setup-sh7780.c | 5 +---- arch/sh/kernel/cpu/sh4a/setup-sh7785.c | 5 +---- arch/sh/kernel/cpu/sh4a/setup-sh7786.c | 5 +---- arch/sh/kernel/cpu/sh4a/setup-shx3.c | 5 +---- arch/sh/kernel/cpu/sh4a/smp-shx3.c | 5 +---- arch/sh/kernel/cpu/sh4a/ubc.c | 5 +---- 37 files changed, 38 insertions(+), 194 deletions(-) commit 6ecc0a4dbb076ef658cb5e140a7560d6326c8240 Author: Kuninori Morimoto Date: Fri Dec 28 00:32:07 2018 -0800 sh: sh4: convert to SPDX identifiers Update license to use SPDX-License-Identifier instead of verbose license text, excepting ${LINUX}/arch/sh/kernel/cpu/sh4/softfloat.c which is not GPL license Link: http://lkml.kernel.org/r/87a7lkcsya.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Kuninori Morimoto Reviewed-by: Simon Horman Cc: Rich Felker Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/sh/kernel/cpu/sh4/clock-sh4-202.c | 5 +---- arch/sh/kernel/cpu/sh4/clock-sh4.c | 5 +---- arch/sh/kernel/cpu/sh4/fpu.c | 5 +---- arch/sh/kernel/cpu/sh4/perf_event.c | 5 +---- arch/sh/kernel/cpu/sh4/probe.c | 5 +---- arch/sh/kernel/cpu/sh4/setup-sh4-202.c | 5 +---- arch/sh/kernel/cpu/sh4/setup-sh7750.c | 5 +---- arch/sh/kernel/cpu/sh4/setup-sh7760.c | 5 +---- arch/sh/kernel/cpu/sh4/sq.c | 5 +---- 9 files changed, 9 insertions(+), 36 deletions(-) commit 5ab5d57cc0c6a4c36fcd52588734f8ab706516f0 Author: Kuninori Morimoto Date: Fri Dec 28 00:32:03 2018 -0800 sh: sh3: convert to SPDX identifiers Update license to use SPDX-License-Identifier instead of verbose license text. Link: http://lkml.kernel.org/r/87bm60csyl.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Kuninori Morimoto Reviewed-by: Simon Horman Cc: Rich Felker Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/sh/kernel/cpu/sh3/clock-sh3.c | 5 +---- arch/sh/kernel/cpu/sh3/clock-sh7705.c | 5 +---- arch/sh/kernel/cpu/sh3/clock-sh7706.c | 5 +---- arch/sh/kernel/cpu/sh3/clock-sh7709.c | 5 +---- arch/sh/kernel/cpu/sh3/clock-sh7710.c | 5 +---- arch/sh/kernel/cpu/sh3/clock-sh7712.c | 5 +---- arch/sh/kernel/cpu/sh3/entry.S | 7 ++----- arch/sh/kernel/cpu/sh3/ex.S | 9 +++------ arch/sh/kernel/cpu/sh3/pinmux-sh7720.c | 5 +---- arch/sh/kernel/cpu/sh3/probe.c | 5 +---- arch/sh/kernel/cpu/sh3/setup-sh3.c | 5 +---- arch/sh/kernel/cpu/sh3/setup-sh7705.c | 5 +---- arch/sh/kernel/cpu/sh3/setup-sh770x.c | 5 +---- arch/sh/kernel/cpu/sh3/setup-sh7710.c | 5 +---- arch/sh/kernel/cpu/sh3/setup-sh7720.c | 5 +---- arch/sh/kernel/cpu/sh3/swsusp.S | 7 ++----- 16 files changed, 20 insertions(+), 68 deletions(-) commit 234a0538240caa05f12ec4ef7a573b173ab7ea57 Author: Kuninori Morimoto Date: Fri Dec 28 00:32:00 2018 -0800 sh: sh2a: convert to SPDX identifiers Update license to use SPDX-License-Identifier instead of verbose license text. Link: http://lkml.kernel.org/r/87d0qgcsz8.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Kuninori Morimoto Reviewed-by: Simon Horman Cc: Rich Felker Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/sh/kernel/cpu/sh2a/clock-sh7201.c | 5 +---- arch/sh/kernel/cpu/sh2a/clock-sh7203.c | 5 +---- arch/sh/kernel/cpu/sh2a/clock-sh7206.c | 5 +---- arch/sh/kernel/cpu/sh2a/clock-sh7264.c | 5 +---- arch/sh/kernel/cpu/sh2a/clock-sh7269.c | 5 +---- arch/sh/kernel/cpu/sh2a/entry.S | 7 ++----- arch/sh/kernel/cpu/sh2a/ex.S | 7 ++----- arch/sh/kernel/cpu/sh2a/fpu.c | 5 +---- arch/sh/kernel/cpu/sh2a/opcode_helper.c | 5 +---- arch/sh/kernel/cpu/sh2a/pinmux-sh7203.c | 5 +---- arch/sh/kernel/cpu/sh2a/pinmux-sh7264.c | 5 +---- arch/sh/kernel/cpu/sh2a/pinmux-sh7269.c | 5 +---- arch/sh/kernel/cpu/sh2a/probe.c | 5 +---- arch/sh/kernel/cpu/sh2a/setup-mxg.c | 5 +---- arch/sh/kernel/cpu/sh2a/setup-sh7201.c | 5 +---- arch/sh/kernel/cpu/sh2a/setup-sh7203.c | 5 +---- arch/sh/kernel/cpu/sh2a/setup-sh7206.c | 5 +---- arch/sh/kernel/cpu/sh2a/setup-sh7264.c | 5 +---- arch/sh/kernel/cpu/sh2a/setup-sh7269.c | 5 +---- 19 files changed, 21 insertions(+), 78 deletions(-) commit 47d11326259baaed7659b47e3a49d31715719793 Author: Kuninori Morimoto Date: Fri Dec 28 00:31:56 2018 -0800 sh: sh2: convert to SPDX identifiers Update license to use SPDX-License-Identifier instead of verbose license text. Link: http://lkml.kernel.org/r/87efawcszk.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Kuninori Morimoto Reviewed-by: Simon Horman Cc: Rich Felker Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/sh/kernel/cpu/sh2/Makefile | 1 + arch/sh/kernel/cpu/sh2/clock-sh7619.c | 5 +---- arch/sh/kernel/cpu/sh2/entry.S | 7 ++----- arch/sh/kernel/cpu/sh2/ex.S | 7 ++----- arch/sh/kernel/cpu/sh2/probe.c | 5 +---- arch/sh/kernel/cpu/sh2/setup-sh7619.c | 5 +---- arch/sh/kernel/cpu/sh2/smp-j2.c | 5 +---- 7 files changed, 9 insertions(+), 26 deletions(-) commit 6a0abce4c4cce0890e2c930b960b9a05c8c6e5da Author: Kuninori Morimoto Date: Fri Dec 28 00:31:53 2018 -0800 sh: include: convert to SPDX identifiers Update license to use SPDX-License-Identifier instead of verbose license text. Link: http://lkml.kernel.org/r/87ftvccszx.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Kuninori Morimoto Reviewed-by: Simon Horman Cc: Rich Felker Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/sh/include/asm/Kbuild | 1 + arch/sh/include/asm/addrspace.h | 5 +---- arch/sh/include/asm/asm-offsets.h | 1 + arch/sh/include/asm/bl_bit_64.h | 7 ++----- arch/sh/include/asm/cache_insns_64.h | 7 ++----- arch/sh/include/asm/checksum_32.h | 5 +---- arch/sh/include/asm/cmpxchg-xchg.h | 4 +--- arch/sh/include/asm/device.h | 5 ++--- arch/sh/include/asm/dma-register.h | 7 ++----- arch/sh/include/asm/dma.h | 7 ++----- arch/sh/include/asm/dwarf.h | 8 ++------ arch/sh/include/asm/fb.h | 1 + arch/sh/include/asm/fixmap.h | 7 ++----- arch/sh/include/asm/flat.h | 7 ++----- arch/sh/include/asm/freq.h | 8 ++------ arch/sh/include/asm/gpio.h | 7 ++----- arch/sh/include/asm/machvec.h | 6 ++---- arch/sh/include/asm/mmu_context_64.h | 5 +---- arch/sh/include/asm/pgtable.h | 7 ++----- arch/sh/include/asm/pgtable_64.h | 5 +---- arch/sh/include/asm/processor_64.h | 5 +---- arch/sh/include/asm/sfp-machine.h | 20 ++++---------------- arch/sh/include/asm/shmparam.h | 7 ++----- arch/sh/include/asm/siu.h | 7 ++----- arch/sh/include/asm/spinlock-cas.h | 7 ++----- arch/sh/include/asm/spinlock-llsc.h | 7 ++----- arch/sh/include/asm/spinlock.h | 7 ++----- arch/sh/include/asm/string_32.h | 1 + arch/sh/include/asm/switch_to.h | 7 ++----- arch/sh/include/asm/switch_to_64.h | 7 ++----- arch/sh/include/asm/tlb_64.h | 7 ++----- arch/sh/include/asm/traps_64.h | 7 ++----- arch/sh/include/asm/uaccess_64.h | 5 +---- arch/sh/include/asm/vga.h | 1 + arch/sh/include/asm/watchdog.h | 8 ++------ arch/sh/include/cpu-common/cpu/addrspace.h | 7 ++----- arch/sh/include/cpu-common/cpu/mmu_context.h | 7 ++----- arch/sh/include/cpu-common/cpu/pfc.h | 12 ++---------- arch/sh/include/cpu-common/cpu/timer.h | 1 + arch/sh/include/cpu-sh2/cpu/cache.h | 7 ++----- arch/sh/include/cpu-sh2/cpu/freq.h | 7 ++----- arch/sh/include/cpu-sh2/cpu/watchdog.h | 7 ++----- arch/sh/include/cpu-sh2a/cpu/cache.h | 7 ++----- arch/sh/include/cpu-sh2a/cpu/freq.h | 7 ++----- arch/sh/include/cpu-sh2a/cpu/watchdog.h | 1 + arch/sh/include/cpu-sh3/cpu/cache.h | 7 ++----- arch/sh/include/cpu-sh3/cpu/dma-register.h | 7 ++----- arch/sh/include/cpu-sh3/cpu/freq.h | 7 ++----- arch/sh/include/cpu-sh3/cpu/gpio.h | 7 ++----- arch/sh/include/cpu-sh3/cpu/mmu_context.h | 7 ++----- arch/sh/include/cpu-sh3/cpu/watchdog.h | 7 ++----- arch/sh/include/cpu-sh4/cpu/addrspace.h | 5 +---- arch/sh/include/cpu-sh4/cpu/cache.h | 7 ++----- arch/sh/include/cpu-sh4/cpu/dma-register.h | 7 ++----- arch/sh/include/cpu-sh4/cpu/fpu.h | 6 ++---- arch/sh/include/cpu-sh4/cpu/freq.h | 7 ++----- arch/sh/include/cpu-sh4/cpu/mmu_context.h | 7 ++----- arch/sh/include/cpu-sh4/cpu/sh7786.h | 7 ++----- arch/sh/include/cpu-sh4/cpu/sq.h | 7 ++----- arch/sh/include/cpu-sh4/cpu/watchdog.h | 7 ++----- arch/sh/include/cpu-sh5/cpu/cache.h | 5 +---- arch/sh/include/cpu-sh5/cpu/irq.h | 5 +---- arch/sh/include/cpu-sh5/cpu/registers.h | 5 +---- arch/sh/include/mach-common/mach/hp6xx.h | 12 ++++-------- arch/sh/include/mach-common/mach/lboxre2.h | 6 +----- arch/sh/include/mach-common/mach/magicpanelr2.h | 7 ++----- arch/sh/include/mach-common/mach/mangle-port.h | 7 ++----- arch/sh/include/mach-common/mach/microdev.h | 6 ++---- arch/sh/include/mach-common/mach/sdk7780.h | 5 +---- arch/sh/include/mach-common/mach/secureedge5410.h | 6 ++---- arch/sh/include/mach-common/mach/sh7763rdp.h | 6 +----- arch/sh/include/mach-dreamcast/mach/dma.h | 7 ++----- arch/sh/include/mach-dreamcast/mach/pci.h | 7 ++----- arch/sh/include/mach-dreamcast/mach/sysasic.h | 7 +++---- .../include/mach-ecovec24/mach/partner-jet-setup.txt | 1 + .../include/mach-kfr2r09/mach/partner-jet-setup.txt | 1 + arch/sh/include/mach-se/mach/se7721.h | 8 ++------ arch/sh/include/mach-se/mach/se7722.h | 6 +----- arch/sh/include/mach-se/mach/se7724.h | 6 +----- arch/sh/include/mach-se/mach/se7780.h | 5 +---- arch/sh/include/uapi/asm/Kbuild | 1 + arch/sh/include/uapi/asm/setup.h | 1 + arch/sh/include/uapi/asm/types.h | 1 + 83 files changed, 142 insertions(+), 357 deletions(-) commit ff4a7481c3898ffc3cc271d6aca431d190c37247 Author: Kuninori Morimoto Date: Fri Dec 28 00:31:49 2018 -0800 sh: drivers: convert to SPDX identifiers Update license to use SPDX-License-Identifier instead of verbose license text. As original license mentioned, it is GPL-2.0 in SPDX. Then, MODULE_LICENSE() should be "GPL v2" instead of "GPL". See ${LINUX}/include/linux/module.h "GPL" [GNU Public License v2 or later] "GPL v2" [GNU Public License v2] Link: http://lkml.kernel.org/r/87h8fsct0a.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Kuninori Morimoto Reviewed-by: Simon Horman Cc: Rich Felker Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/sh/drivers/dma/Makefile | 1 + arch/sh/drivers/dma/dma-api.c | 7 ++----- arch/sh/drivers/dma/dma-g2.c | 7 ++----- arch/sh/drivers/dma/dma-pvr2.c | 7 ++----- arch/sh/drivers/dma/dma-sh.c | 7 ++----- arch/sh/drivers/dma/dma-sysfs.c | 5 +---- arch/sh/drivers/dma/dmabrg.c | 3 +-- arch/sh/drivers/heartbeat.c | 5 +---- arch/sh/drivers/pci/fixups-dreamcast.c | 5 +---- arch/sh/drivers/pci/fixups-landisk.c | 4 +--- arch/sh/drivers/pci/fixups-r7780rp.c | 5 +---- arch/sh/drivers/pci/fixups-rts7751r2d.c | 5 +---- arch/sh/drivers/pci/fixups-sdk7780.c | 5 +---- arch/sh/drivers/pci/fixups-sdk7786.c | 5 +---- arch/sh/drivers/pci/fixups-snapgear.c | 4 +--- arch/sh/drivers/pci/fixups-titan.c | 4 +--- arch/sh/drivers/pci/ops-dreamcast.c | 5 +---- arch/sh/drivers/pci/ops-sh4.c | 5 +---- arch/sh/drivers/pci/ops-sh5.c | 4 +--- arch/sh/drivers/pci/ops-sh7786.c | 5 +---- arch/sh/drivers/pci/pci-dreamcast.c | 5 +---- arch/sh/drivers/pci/pci-sh5.c | 4 +--- arch/sh/drivers/pci/pci-sh5.h | 6 ++---- arch/sh/drivers/pci/pci-sh7751.c | 5 +---- arch/sh/drivers/pci/pci-sh7751.h | 7 ++----- arch/sh/drivers/pci/pci-sh7780.c | 5 +---- arch/sh/drivers/pci/pci-sh7780.h | 7 ++----- arch/sh/drivers/pci/pci.c | 5 +---- arch/sh/drivers/pci/pcie-sh7786.c | 5 +---- arch/sh/drivers/pci/pcie-sh7786.h | 7 ++----- arch/sh/drivers/push-switch.c | 5 +---- arch/sh/drivers/superhyway/Makefile | 1 + arch/sh/drivers/superhyway/ops-sh4-202.c | 5 +---- 33 files changed, 41 insertions(+), 124 deletions(-) commit aaf9128abcb8314eb9756db3e32d667c5161156f Author: Kuninori Morimoto Date: Fri Dec 28 00:31:46 2018 -0800 sh: boards: convert to SPDX identifiers Update license to use SPDX-License-Identifier instead of verbose license text. Link: http://lkml.kernel.org/r/87in08ct0n.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Kuninori Morimoto Reviewed-by: Simon Horman Cc: Rich Felker Cc: Yoshinori Sato Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/sh/boards/board-apsh4a3a.c | 5 +---- arch/sh/boards/board-apsh4ad0a.c | 5 +---- arch/sh/boards/board-edosk7760.c | 15 +-------------- arch/sh/boards/board-espt.c | 5 +---- arch/sh/boards/board-magicpanelr2.c | 5 +---- arch/sh/boards/board-sh7757lcr.c | 5 +---- arch/sh/boards/board-sh7785lcr.c | 5 +---- arch/sh/boards/board-titan.c | 5 +---- arch/sh/boards/board-urquell.c | 5 +---- arch/sh/boards/mach-ap325rxa/Makefile | 1 + arch/sh/boards/mach-ap325rxa/sdram.S | 7 ++----- arch/sh/boards/mach-cayman/Makefile | 1 + arch/sh/boards/mach-cayman/irq.c | 5 +---- arch/sh/boards/mach-cayman/panic.c | 5 +---- arch/sh/boards/mach-cayman/setup.c | 5 +---- arch/sh/boards/mach-dreamcast/Makefile | 1 + arch/sh/boards/mach-dreamcast/irq.c | 2 +- arch/sh/boards/mach-dreamcast/rtc.c | 4 +--- arch/sh/boards/mach-dreamcast/setup.c | 3 +-- arch/sh/boards/mach-ecovec24/Makefile | 3 ++- arch/sh/boards/mach-ecovec24/sdram.S | 7 ++----- arch/sh/boards/mach-ecovec24/setup.c | 5 +---- arch/sh/boards/mach-highlander/irq-r7780mp.c | 5 +---- arch/sh/boards/mach-highlander/irq-r7780rp.c | 5 +---- arch/sh/boards/mach-highlander/irq-r7785rp.c | 5 +---- arch/sh/boards/mach-highlander/pinmux-r7785rp.c | 5 +---- arch/sh/boards/mach-highlander/psw.c | 5 +---- arch/sh/boards/mach-highlander/setup.c | 5 +---- arch/sh/boards/mach-hp6xx/Makefile | 1 + arch/sh/boards/mach-hp6xx/hp6xx_apm.c | 4 +--- arch/sh/boards/mach-hp6xx/pm.c | 4 +--- arch/sh/boards/mach-hp6xx/pm_wakeup.S | 8 ++------ arch/sh/boards/mach-hp6xx/setup.c | 4 +--- arch/sh/boards/mach-kfr2r09/Makefile | 1 + arch/sh/boards/mach-kfr2r09/lcd_wqvga.c | 5 +---- arch/sh/boards/mach-kfr2r09/sdram.S | 7 ++----- arch/sh/boards/mach-landisk/Makefile | 1 + arch/sh/boards/mach-landisk/gio.c | 6 +----- arch/sh/boards/mach-landisk/irq.c | 5 +---- arch/sh/boards/mach-landisk/psw.c | 5 +---- arch/sh/boards/mach-landisk/setup.c | 5 +---- arch/sh/boards/mach-lboxre2/Makefile | 1 + arch/sh/boards/mach-lboxre2/irq.c | 6 +----- arch/sh/boards/mach-lboxre2/setup.c | 6 +----- arch/sh/boards/mach-microdev/Makefile | 1 + arch/sh/boards/mach-microdev/fdc37c93xapm.c | 5 +---- arch/sh/boards/mach-microdev/io.c | 4 +--- arch/sh/boards/mach-microdev/irq.c | 4 +--- arch/sh/boards/mach-microdev/setup.c | 4 +--- arch/sh/boards/mach-migor/Makefile | 1 + arch/sh/boards/mach-migor/lcd_qvga.c | 5 +---- arch/sh/boards/mach-migor/sdram.S | 7 ++----- arch/sh/boards/mach-r2d/Makefile | 1 + arch/sh/boards/mach-r2d/setup.c | 5 +---- arch/sh/boards/mach-rsk/Makefile | 1 + arch/sh/boards/mach-rsk/devices-rsk7203.c | 5 +---- arch/sh/boards/mach-rsk/devices-rsk7264.c | 5 +---- arch/sh/boards/mach-rsk/devices-rsk7269.c | 5 +---- arch/sh/boards/mach-rsk/setup.c | 5 +---- arch/sh/boards/mach-sdk7780/Makefile | 1 + arch/sh/boards/mach-sdk7780/irq.c | 5 +---- arch/sh/boards/mach-sdk7780/setup.c | 5 +---- arch/sh/boards/mach-sdk7786/Makefile | 1 + arch/sh/boards/mach-sdk7786/fpga.c | 5 +---- arch/sh/boards/mach-sdk7786/gpio.c | 5 +---- arch/sh/boards/mach-sdk7786/irq.c | 5 +---- arch/sh/boards/mach-sdk7786/nmi.c | 5 +---- arch/sh/boards/mach-sdk7786/setup.c | 5 +---- arch/sh/boards/mach-sdk7786/sram.c | 5 +---- arch/sh/boards/mach-se/7206/Makefile | 1 + arch/sh/boards/mach-se/7343/Makefile | 1 + arch/sh/boards/mach-se/7343/irq.c | 5 +---- arch/sh/boards/mach-se/770x/Makefile | 1 + arch/sh/boards/mach-se/7721/Makefile | 1 + arch/sh/boards/mach-se/7721/irq.c | 5 +---- arch/sh/boards/mach-se/7721/setup.c | 6 +----- arch/sh/boards/mach-se/7722/Makefile | 1 + arch/sh/boards/mach-se/7722/irq.c | 5 +---- arch/sh/boards/mach-se/7722/setup.c | 6 +----- arch/sh/boards/mach-se/7724/Makefile | 1 + arch/sh/boards/mach-se/7724/irq.c | 5 +---- arch/sh/boards/mach-se/7724/sdram.S | 7 ++----- arch/sh/boards/mach-se/7751/Makefile | 1 + arch/sh/boards/mach-se/7780/Makefile | 1 + arch/sh/boards/mach-se/7780/irq.c | 5 +---- arch/sh/boards/mach-se/7780/setup.c | 5 +---- arch/sh/boards/mach-sh03/Makefile | 1 + arch/sh/boards/mach-sh7763rdp/Makefile | 1 + arch/sh/boards/mach-sh7763rdp/irq.c | 5 +---- arch/sh/boards/mach-sh7763rdp/setup.c | 5 +---- arch/sh/boards/mach-x3proto/Makefile | 1 + arch/sh/boards/mach-x3proto/gpio.c | 5 +---- arch/sh/boards/mach-x3proto/ilsel.c | 5 +---- arch/sh/boards/mach-x3proto/setup.c | 5 +---- arch/sh/boards/of-generic.c | 5 +---- 95 files changed, 102 insertions(+), 291 deletions(-) commit ffa6daa9937a108faf9e6b9f9cdcedb36a9e0d63 Author: YueHaibing Date: Fri Dec 28 00:31:42 2018 -0800 arch/sh/boards/mach-kfr2r09/setup.c: drop pointless static qualifier in kfr2r09_usb0_gadget_setup() There is no need to have the 'struct clk *camera_clk' variable static since a new value is always assigned before use. Link: http://lkml.kernel.org/r/1543628631-99957-1-git-send-email-yuehaibing@huawei.com Signed-off-by: YueHaibing Reviewed-by: Andrew Morton Cc: Yoshinori Sato Cc: Rich Felker Cc: Jacopo Mondi Cc: "Miquel Raynal" Cc: Randy Dunlap Cc: Masahiro Yamada Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/sh/boards/mach-kfr2r09/setup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 440e7b379f91acd245d5c8de94d533f40f5dffb3 Author: Randy Dunlap Date: Fri Dec 28 00:31:39 2018 -0800 arch/sh/boards/mach-kfr2r09/setup.c: fix struct mtd_oob_ops build warning arch/sh/boards/mach-kfr2r09/setup.c does not need to #include , and doing so causes a build warning, so drop that header file. In file included from ../arch/sh/boards/mach-kfr2r09/setup.c:28: ../include/linux/mtd/onenand.h:225:12: warning: 'struct mtd_oob_ops' declared inside parameter list will not be visible outside of this definition or declaration struct mtd_oob_ops *ops); Link: http://lkml.kernel.org/r/702f0a25-c63e-6912-4640-6ab0f00afbc7@infradead.org Fixes: f3590dc32974 ("media: arch: sh: kfr2r09: Use new renesas-ceu camera driver") Signed-off-by: Randy Dunlap Reported-by: Geert Uytterhoeven Suggested-by: Miquel Raynal Reviewed-by: Miquel Raynal Cc: Yoshinori Sato Cc: Rich Felker Cc: Jacopo Mondi Cc: Magnus Damm Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/sh/boards/mach-kfr2r09/setup.c | 1 - 1 file changed, 1 deletion(-) commit cd68a52533380213beb95c5bc41d8f9d7e4aec1f Author: Kirill Tkhai Date: Fri Dec 28 00:31:35 2018 -0800 scripts/tags.sh: add more declarations New declarations and identifier (__always_inline). Link: http://lkml.kernel.org/r/154505048571.504.18330420599768007443.stgit@localhost.localdomain Signed-off-by: Kirill Tkhai Cc: Masahiro Yamada Cc: Constantine Shulyupin Cc: Kirill Tkhai Cc: Joey Pabalinas Cc: Matthew Wilcox Cc: Arend van Spriel Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds scripts/tags.sh | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) commit b72231eb708459ea9171eb21201a0701fb39adfb Author: Thierry Reding Date: Fri Dec 28 00:31:32 2018 -0800 scripts: add spdxcheck.py self test Add a script that will run spdxcheck.py through a couple of self tests to simplify validation in the future. The tests are run for both Python 2 and Python 3 to make sure all changes to the script remain compatible across both versions. The script tests a regular text file (Makefile) for basic sanity checks and then runs it on a binary file (Documentation/logo.gif) to make sure it works in both cases. It also tests opening files passed on the command line as well as piped files read from standard input. Finally a run on the complete tree will be performed to catch any other potential issues. Link: http://lkml.kernel.org/r/20181212131210.28024-2-thierry.reding@gmail.com Signed-off-by: Thierry Reding Thomas Gleixner Cc: Jonathan Corbet Cc: Joe Perches Cc: Jeremy Cline Cc: Uwe Kleine-König Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds scripts/spdxcheck-test.sh | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit 919e9d39e722dc79d7d051e5bda503423fe6c953 Author: Qian Cai Date: Fri Dec 28 00:31:28 2018 -0800 scripts/checkstack.pl: dynamic stack growth for aarch64 This is to track dynamic amount of stack growth for aarch64, so it is possible to print out offensive functions that may consume too much stack. For example, 0xffff2000084d1270 try_to_unmap_one [vmlinux]: Dynamic (0xcf0) 0xffff200008538358 migrate_page_move_mapping [vmlinux]: Dynamic (0xc60) 0xffff2000081276c8 copy_process.isra.2 [vmlinux]: Dynamic (0xb20) 0xffff200008424958 show_free_areas [vmlinux]: Dynamic (0xb40) 0xffff200008545178 __split_huge_pmd_locked [vmlinux]: Dynamic (0xb30) 0xffff200008555120 collapse_shmem [vmlinux]: Dynamic (0xbc0) 0xffff20000862e0d0 do_direct_IO [vmlinux]: Dynamic (0xb70) 0xffff200008cc0aa0 md_do_sync [vmlinux]: Dynamic (0xb90) Link: http://lkml.kernel.org/r/20181208025143.39363-1-cai@lca.pw Signed-off-by: Qian Cai Cc: Catalin Marinas Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds scripts/checkstack.pl | 2 ++ 1 file changed, 2 insertions(+) commit 67a28de47faa83585dd644bd4c31e5a1d9346c50 Author: Marc Zyngier Date: Fri Dec 28 00:31:25 2018 -0800 scripts/decode_stacktrace: only strip base path when a prefix of the path Running something like: decodecode vmlinux . leads to interested results where not only the leading "." gets stripped from the displayed paths, but also anywhere in the string, displaying something like: kvm_vcpu_check_block (arch/arm64/kvm/virt/kvm/kvm_mainc:2141) which doesn't help further processing. Fix it by only stripping the base path if it is a prefix of the path. Link: http://lkml.kernel.org/r/20181210174659.31054-3-marc.zyngier@arm.com Signed-off-by: Marc Zyngier Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds scripts/decode_stacktrace.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c5cfb62f2bdf51c71ab4b8b33271beab34096c71 Author: Marc Zyngier Date: Fri Dec 28 00:31:21 2018 -0800 scripts/decodecode: set ARCH when running natively on arm/arm64 When running decodecode natively on arm64, ARCH is likely not to be set, and we end-up with .4byte instead of .inst when generating the disassembly. Similar effects would occur if running natively on a 32bit ARM platform, although that's even less popular. A simple workaround is to populate ARCH when it is not set and that we're running on an arm/arm64 system. Link: http://lkml.kernel.org/r/20181210174659.31054-2-marc.zyngier@arm.com Signed-off-by: Marc Zyngier Acked-by: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds scripts/decodecode | 7 +++++++ 1 file changed, 7 insertions(+) commit e0b2475a3f36a7a0a001fe552145055da1daf245 Author: Rasmus Villemoes Date: Fri Dec 28 00:31:18 2018 -0800 bloat-o-meter: ignore __addressable_ symbols Since __LINE__ is part of the symbol created by __ADDRESSABLE, almost any change causes those symbols to disappear and get reincarnated, e.g. add/remove: 4/4 grow/shrink: 0/3 up/down: 32/-171 (-139) Function old new delta __addressable_tracing_set_default_clock8649 - 8 +8 __addressable_tracer_init_tracefs8631 - 8 +8 __addressable_ftrace_dump8383 - 8 +8 __addressable_clear_boot_tracer8632 - 8 +8 __addressable_tracing_set_default_clock8650 8 - -8 __addressable_tracer_init_tracefs8632 8 - -8 __addressable_ftrace_dump8384 8 - -8 __addressable_clear_boot_tracer8633 8 - -8 trace_default_header 663 642 -21 tracing_mark_raw_write 406 355 -51 tracing_mark_write 624 557 -67 Total: Before=63889, After=63750, chg -0.22% They're small and in .discard, so ignore them, leading to more useful add/remove: 0/0 grow/shrink: 0/3 up/down: 0/-139 (-139) Function old new delta trace_default_header 663 642 -21 tracing_mark_raw_write 406 355 -51 tracing_mark_write 624 557 -67 Total: Before=63721, After=63582, chg -0.22% Link: http://lkml.kernel.org/r/20181102210030.8383-1-linux@rasmusvillemoes.dk Signed-off-by: Rasmus Villemoes Reviewed-by: Andy Shevchenko Cc: Alexey Dobriyan Cc: Ingo Molnar Cc: Dominik Brodowski Cc: Maninder Singh Cc: Matteo Croce Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds scripts/bloat-o-meter | 1 + 1 file changed, 1 insertion(+) commit e886bf9d9abedf8236464bfd21bc5707748b4a02 Author: Andrey Konovalov Date: Fri Dec 28 00:31:14 2018 -0800 kasan: add SPDX-License-Identifier mark to source files This patch adds a "SPDX-License-Identifier: GPL-2.0" mark to all source files under mm/kasan. Link: http://lkml.kernel.org/r/bce2d1e618afa5142e81961ab8fa4b4165337380.1544099024.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Andrey Ryabinin Reviewed-by: Dmitry Vyukov Cc: Christoph Lameter Cc: Mark Rutland Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/kasan/common.c | 1 + mm/kasan/generic.c | 1 + mm/kasan/generic_report.c | 1 + mm/kasan/init.c | 1 + mm/kasan/quarantine.c | 1 + mm/kasan/report.c | 1 + mm/kasan/tags.c | 1 + mm/kasan/tags_report.c | 1 + 8 files changed, 8 insertions(+) commit b3b0e6accb5b3d249760e071f2cf77f696961158 Author: Andrey Konovalov Date: Fri Dec 28 00:31:10 2018 -0800 kasan: update documentation This patch updates KASAN documentation to reflect the addition of the new tag-based mode. Link: http://lkml.kernel.org/r/aabef9de317c54b8a3919a4946ce534c6576726a.1544099024.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Andrey Ryabinin Reviewed-by: Dmitry Vyukov Cc: Christoph Lameter Cc: Mark Rutland Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Documentation/dev-tools/kasan.rst | 232 +++++++++++++++++++++++--------------- 1 file changed, 138 insertions(+), 94 deletions(-) commit 2d4acb90878b076b8c735500121f73e32756ddce Author: Andrey Konovalov Date: Fri Dec 28 00:31:07 2018 -0800 kasan, arm64: select HAVE_ARCH_KASAN_SW_TAGS Now, that all the necessary infrastructure code has been introduced, select HAVE_ARCH_KASAN_SW_TAGS for arm64 to enable software tag-based KASAN mode. Link: http://lkml.kernel.org/r/25abce9a21d0c1df2d9d72488aced418c3465d7b.1544099024.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Acked-by: Will Deacon Cc: Andrey Ryabinin Cc: Christoph Lameter Cc: Dmitry Vyukov Cc: Mark Rutland Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/arm64/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 66afc7f1e07a1db74453be9167ac0d1205653854 Author: Andrey Konovalov Date: Fri Dec 28 00:31:01 2018 -0800 kasan: add __must_check annotations to kasan hooks This patch adds __must_check annotations to kasan hooks that return a pointer to make sure that a tagged pointer always gets propagated. Link: http://lkml.kernel.org/r/03b269c5e453945f724bfca3159d4e1333a8fb1c.1544099024.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Suggested-by: Andrey Ryabinin Cc: Christoph Lameter Cc: Dmitry Vyukov Cc: Mark Rutland Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/kasan.h | 16 ++++++++++------ mm/kasan/common.c | 15 +++++++++------ 2 files changed, 19 insertions(+), 12 deletions(-) commit 2813b9c0296259fb11e75c839bab2d958ba4f96c Author: Andrey Konovalov Date: Fri Dec 28 00:30:57 2018 -0800 kasan, mm, arm64: tag non slab memory allocated via pagealloc Tag-based KASAN doesn't check memory accesses through pointers tagged with 0xff. When page_address is used to get pointer to memory that corresponds to some page, the tag of the resulting pointer gets set to 0xff, even though the allocated memory might have been tagged differently. For slab pages it's impossible to recover the correct tag to return from page_address, since the page might contain multiple slab objects tagged with different values, and we can't know in advance which one of them is going to get accessed. For non slab pages however, we can recover the tag in page_address, since the whole page was marked with the same tag. This patch adds tagging to non slab memory allocated with pagealloc. To set the tag of the pointer returned from page_address, the tag gets stored to page->flags when the memory gets allocated. Link: http://lkml.kernel.org/r/d758ddcef46a5abc9970182b9137e2fbee202a2c.1544099024.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Andrey Ryabinin Reviewed-by: Dmitry Vyukov Acked-by: Will Deacon Cc: Christoph Lameter Cc: Mark Rutland Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/arm64/include/asm/memory.h | 8 +++++++- include/linux/mm.h | 29 +++++++++++++++++++++++++++++ include/linux/page-flags-layout.h | 10 ++++++++++ mm/cma.c | 11 +++++++++++ mm/kasan/common.c | 15 +++++++++++++-- mm/page_alloc.c | 1 + mm/slab.c | 2 +- 7 files changed, 72 insertions(+), 4 deletions(-) commit 41eea9cd239c5b3fff726894f85c97f60e5799a3 Author: Andrey Konovalov Date: Fri Dec 28 00:30:54 2018 -0800 kasan, arm64: add brk handler for inline instrumentation Tag-based KASAN inline instrumentation mode (which embeds checks of shadow memory into the generated code, instead of inserting a callback) generates a brk instruction when a tag mismatch is detected. This commit adds a tag-based KASAN specific brk handler, that decodes the immediate value passed to the brk instructions (to extract information about the memory access that triggered the mismatch), reads the register values (x0 contains the guilty address) and reports the bug. Link: http://lkml.kernel.org/r/c91fe7684070e34dc34b419e6b69498f4dcacc2d.1544099024.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Andrey Ryabinin Reviewed-by: Dmitry Vyukov Acked-by: Will Deacon Cc: Christoph Lameter Cc: Mark Rutland Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/arm64/include/asm/brk-imm.h | 2 ++ arch/arm64/kernel/traps.c | 60 ++++++++++++++++++++++++++++++++++++++++ include/linux/kasan.h | 3 ++ 3 files changed, 65 insertions(+) commit 7f94ffbc4c6a1bdb51d39965e4f2acaa19bd798f Author: Andrey Konovalov Date: Fri Dec 28 00:30:50 2018 -0800 kasan: add hooks implementation for tag-based mode This commit adds tag-based KASAN specific hooks implementation and adjusts common generic and tag-based KASAN ones. 1. When a new slab cache is created, tag-based KASAN rounds up the size of the objects in this cache to KASAN_SHADOW_SCALE_SIZE (== 16). 2. On each kmalloc tag-based KASAN generates a random tag, sets the shadow memory, that corresponds to this object to this tag, and embeds this tag value into the top byte of the returned pointer. 3. On each kfree tag-based KASAN poisons the shadow memory with a random tag to allow detection of use-after-free bugs. The rest of the logic of the hook implementation is very much similar to the one provided by generic KASAN. Tag-based KASAN saves allocation and free stack metadata to the slab object the same way generic KASAN does. Link: http://lkml.kernel.org/r/bda78069e3b8422039794050ddcb2d53d053ed41.1544099024.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Andrey Ryabinin Reviewed-by: Dmitry Vyukov Cc: Christoph Lameter Cc: Mark Rutland Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/kasan/common.c | 116 +++++++++++++++++++++++++++++++++++++++++++++--------- mm/kasan/kasan.h | 8 ++++ mm/kasan/tags.c | 48 ++++++++++++++++++++++ 3 files changed, 153 insertions(+), 19 deletions(-) commit 5b7c4148222d7acaa1612e5eec84fc66c88d54f3 Author: Andrey Konovalov Date: Fri Dec 28 00:30:46 2018 -0800 mm: move obj_to_index to include/linux/slab_def.h While with SLUB we can actually preassign tags for caches with contructors and store them in pointers in the freelist, SLAB doesn't allow that since the freelist is stored as an array of indexes, so there are no pointers to store the tags. Instead we compute the tag twice, once when a slab is created before calling the constructor and then again each time when an object is allocated with kmalloc. Tag is computed simply by taking the lowest byte of the index that corresponds to the object. However in kasan_kmalloc we only have access to the objects pointer, so we need a way to find out which index this object corresponds to. This patch moves obj_to_index from slab.c to include/linux/slab_def.h to be reused by KASAN. Link: http://lkml.kernel.org/r/c02cd9e574cfd93858e43ac94b05e38f891fef64.1544099024.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Andrey Ryabinin Reviewed-by: Dmitry Vyukov Acked-by: Christoph Lameter Cc: Mark Rutland Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/slab_def.h | 13 +++++++++++++ mm/slab.c | 13 ------------- 2 files changed, 13 insertions(+), 13 deletions(-) commit 121e8f81d38cc43834195722d0768340dc130a33 Author: Andrey Konovalov Date: Fri Dec 28 00:30:42 2018 -0800 kasan: add bug reporting routines for tag-based mode This commit adds rountines, that print tag-based KASAN error reports. Those are quite similar to generic KASAN, the difference is: 1. The way tag-based KASAN finds the first bad shadow cell (with a mismatching tag). Tag-based KASAN compares memory tags from the shadow memory to the pointer tag. 2. Tag-based KASAN reports all bugs with the "KASAN: invalid-access" header. Also simplify generic KASAN find_first_bad_addr. Link: http://lkml.kernel.org/r/aee6897b1bd077732a315fd84c6b4f234dbfdfcb.1544099024.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Andrey Ryabinin Reviewed-by: Dmitry Vyukov Cc: Christoph Lameter Cc: Mark Rutland Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/kasan/generic_report.c | 16 +++++-------- mm/kasan/kasan.h | 5 +++++ mm/kasan/report.c | 57 ++++++++++++++++++++++++++--------------------- mm/kasan/tags_report.c | 18 +++++++++++++++ 4 files changed, 59 insertions(+), 37 deletions(-) commit 11cd3cd69a256a353dd1a249b48ccd727d945952 Author: Andrey Konovalov Date: Fri Dec 28 00:30:38 2018 -0800 kasan: split out generic_report.c from report.c Move generic KASAN specific error reporting routines to generic_report.c without any functional changes, leaving common error reporting code in report.c to be later reused by tag-based KASAN. Link: http://lkml.kernel.org/r/ba48c32f8e5aefedee78998ccff0413bee9e0f5b.1544099024.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Andrey Ryabinin Reviewed-by: Dmitry Vyukov Cc: Christoph Lameter Cc: Mark Rutland Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/kasan/Makefile | 4 +- mm/kasan/generic_report.c | 158 +++++++++++++++++++++++++++++++ mm/kasan/kasan.h | 7 ++ mm/kasan/report.c | 234 ++++++++++------------------------------------ mm/kasan/tags_report.c | 39 ++++++++ 5 files changed, 257 insertions(+), 185 deletions(-) commit 772a2fa50ffb2f4282be8436da6e70530a2ac63c Author: Andrey Konovalov Date: Fri Dec 28 00:30:35 2018 -0800 kasan, mm: perform untagged pointers comparison in krealloc The krealloc function checks where the same buffer was reused or a new one allocated by comparing kernel pointers. Tag-based KASAN changes memory tag on the krealloc'ed chunk of memory and therefore also changes the pointer tag of the returned pointer. Therefore we need to perform comparison on untagged (with tags reset) pointers to check whether it's the same memory region or not. Link: http://lkml.kernel.org/r/14f6190d7846186a3506cd66d82446646fe65090.1544099024.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Andrey Ryabinin Reviewed-by: Dmitry Vyukov Cc: Christoph Lameter Cc: Mark Rutland Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/slab_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 21696c1613244f2ad4e9216c4f6e7804831a992c Author: Andrey Konovalov Date: Fri Dec 28 00:30:31 2018 -0800 kasan, arm64: enable top byte ignore for the kernel Tag-based KASAN uses the Top Byte Ignore feature of arm64 CPUs to store a pointer tag in the top byte of each pointer. This commit enables the TCR_TBI1 bit, which enables Top Byte Ignore for the kernel, when tag-based KASAN is used. Link: http://lkml.kernel.org/r/f51eca084c8cdb2f3a55195fe342dc8953b7aead.1544099024.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Andrey Ryabinin Reviewed-by: Dmitry Vyukov Acked-by: Will Deacon Cc: Christoph Lameter Cc: Mark Rutland Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/arm64/include/asm/pgtable-hwdef.h | 1 + arch/arm64/mm/proc.S | 8 +++++++- 2 files changed, 8 insertions(+), 1 deletion(-) commit 356607f21e603523d4b0a4f918722845214fc6a8 Author: Andrey Konovalov Date: Fri Dec 28 00:30:27 2018 -0800 kasan, arm64: fix up fault handling logic Right now arm64 fault handling code removes pointer tags from addresses covered by TTBR0 in faults taken from both EL0 and EL1, but doesn't do that for pointers covered by TTBR1. This patch adds two helper functions is_ttbr0_addr() and is_ttbr1_addr(), where the latter one accounts for the fact that TTBR1 pointers might be tagged when tag-based KASAN is in use, and uses these helper functions to perform pointer checks in arch/arm64/mm/fault.c. Link: http://lkml.kernel.org/r/3f349b0e9e48b5df3298a6b4ae0634332274494a.1544099024.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Suggested-by: Mark Rutland Acked-by: Will Deacon Cc: Andrey Ryabinin Cc: Christoph Lameter Cc: Dmitry Vyukov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/arm64/mm/fault.c | 31 ++++++++++++++++++++++--------- 1 file changed, 22 insertions(+), 9 deletions(-) commit 4d176711ea7a8d4873e7157ac6ab242ade3ba351 Author: Andrey Konovalov Date: Fri Dec 28 00:30:23 2018 -0800 kasan: preassign tags to objects with ctors or SLAB_TYPESAFE_BY_RCU An object constructor can initialize pointers within this objects based on the address of the object. Since the object address might be tagged, we need to assign a tag before calling constructor. The implemented approach is to assign tags to objects with constructors when a slab is allocated and call constructors once as usual. The downside is that such object would always have the same tag when it is reallocated, so we won't catch use-after-frees on it. Also pressign tags for objects from SLAB_TYPESAFE_BY_RCU caches, since they can be validy accessed after having been freed. Link: http://lkml.kernel.org/r/f158a8a74a031d66f0a9398a5b0ed453c37ba09a.1544099024.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Andrey Ryabinin Reviewed-by: Dmitry Vyukov Cc: Christoph Lameter Cc: Mark Rutland Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/slab.c | 2 +- mm/slub.c | 24 ++++++++++++++---------- 2 files changed, 15 insertions(+), 11 deletions(-) commit e71fe3f921aeb27f0c65ee7ebfdde7f8c7d60b74 Author: Andrey Konovalov Date: Fri Dec 28 00:30:20 2018 -0800 kasan, arm64: untag address in _virt_addr_is_linear virt_addr_is_linear (which is used by virt_addr_valid) assumes that the top byte of the address is 0xff, which isn't always the case with tag-based KASAN. This patch resets the tag in this macro. Link: http://lkml.kernel.org/r/df73a37dd5ed37f4deaf77bc718e9f2e590e69b1.1544099024.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Andrey Ryabinin Reviewed-by: Dmitry Vyukov Acked-by: Will Deacon Cc: Christoph Lameter Cc: Mark Rutland Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/arm64/include/asm/memory.h | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 3c9e3aa11094e821aff4a8f6812a6e032293dbc0 Author: Andrey Konovalov Date: Fri Dec 28 00:30:16 2018 -0800 kasan: add tag related helper functions This commit adds a few helper functions, that are meant to be used to work with tags embedded in the top byte of kernel pointers: to set, to get or to reset the top byte. Link: http://lkml.kernel.org/r/f6c6437bb8e143bc44f42c3c259c62e734be7935.1544099024.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Cc: Andrey Ryabinin Cc: Christoph Lameter Cc: Dmitry Vyukov Cc: Mark Rutland Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/arm64/include/asm/kasan.h | 8 ++++++-- arch/arm64/include/asm/memory.h | 12 ++++++++++++ arch/arm64/mm/kasan_init.c | 2 ++ include/linux/kasan.h | 13 +++++++++++++ mm/kasan/kasan.h | 31 +++++++++++++++++++++++++++++++ mm/kasan/tags.c | 37 +++++++++++++++++++++++++++++++++++++ 6 files changed, 101 insertions(+), 2 deletions(-) commit 9c23f84723d2bb5611a973f56f0952fa74f048f3 Author: Andrey Konovalov Date: Fri Dec 28 00:30:12 2018 -0800 arm64: move untagged_addr macro from uaccess.h to memory.h Move the untagged_addr() macro from arch/arm64/include/asm/uaccess.h to arch/arm64/include/asm/memory.h to be later reused by KASAN. Also make the untagged_addr() macro accept all kinds of address types (void *, unsigned long, etc.). This allows not to specify type casts in each place where the macro is used. This is done by using __typeof__. Link: http://lkml.kernel.org/r/2e9ef8d2ed594106eca514b268365b5419113f6a.1544099024.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Acked-by: Mark Rutland Acked-by: Will Deacon Cc: Andrey Ryabinin Cc: Christoph Lameter Cc: Dmitry Vyukov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/arm64/include/asm/memory.h | 8 ++++++++ arch/arm64/include/asm/uaccess.h | 7 ------- 2 files changed, 8 insertions(+), 7 deletions(-) commit 080eb83f54cf5b96ae5b6ce3c1896e35c341aff9 Author: Andrey Konovalov Date: Fri Dec 28 00:30:09 2018 -0800 kasan: initialize shadow to 0xff for tag-based mode A tag-based KASAN shadow memory cell contains a memory tag, that corresponds to the tag in the top byte of the pointer, that points to that memory. The native top byte value of kernel pointers is 0xff, so with tag-based KASAN we need to initialize shadow memory to 0xff. [cai@lca.pw: arm64: skip kmemleak for KASAN again\ Link: http://lkml.kernel.org/r/20181226020550.63712-1-cai@lca.pw Link: http://lkml.kernel.org/r/5cc1b789aad7c99cf4f3ec5b328b147ad53edb40.1544099024.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Andrey Ryabinin Reviewed-by: Dmitry Vyukov Cc: Christoph Lameter Cc: Mark Rutland Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/arm64/mm/kasan_init.c | 14 ++++++++++++-- include/linux/kasan.h | 8 ++++++++ mm/kasan/common.c | 3 ++- 3 files changed, 22 insertions(+), 3 deletions(-) commit 9577dd7486487722ed8f0773243223f108e8089f Author: Andrey Konovalov Date: Fri Dec 28 00:30:01 2018 -0800 kasan: rename kasan_zero_page to kasan_early_shadow_page With tag based KASAN mode the early shadow value is 0xff and not 0x00, so this patch renames kasan_zero_(page|pte|pmd|pud|p4d) to kasan_early_shadow_(page|pte|pmd|pud|p4d) to avoid confusion. Link: http://lkml.kernel.org/r/3fed313280ebf4f88645f5b89ccbc066d320e177.1544099024.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Suggested-by: Mark Rutland Cc: Andrey Ryabinin Cc: Christoph Lameter Cc: Dmitry Vyukov Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/arm64/mm/kasan_init.c | 43 ++++++++++++++------------ arch/s390/mm/dump_pagetables.c | 17 +++++----- arch/s390/mm/kasan_init.c | 33 ++++++++++++-------- arch/x86/mm/dump_pagetables.c | 11 ++++--- arch/x86/mm/kasan_init_64.c | 55 +++++++++++++++++---------------- arch/xtensa/mm/kasan_init.c | 18 ++++++----- include/linux/kasan.h | 12 ++++---- mm/kasan/init.c | 70 ++++++++++++++++++++++++------------------ 8 files changed, 145 insertions(+), 114 deletions(-) commit b2f557eae9ed0ab2b612ce9ce7e3f06174a83e76 Author: Andrey Konovalov Date: Fri Dec 28 00:29:57 2018 -0800 kasan, arm64: adjust shadow size for tag-based mode Tag-based KASAN uses 1 shadow byte for 16 bytes of kernel memory, so it requires 1/16th of the kernel virtual address space for the shadow memory. This commit sets KASAN_SHADOW_SCALE_SHIFT to 4 when the tag-based KASAN mode is enabled. Link: http://lkml.kernel.org/r/308b6bd49f756bb5e533be93c6f085ba99b30339.1544099024.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Andrey Ryabinin Reviewed-by: Dmitry Vyukov Acked-by: Will Deacon Cc: Christoph Lameter Cc: Mark Rutland Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/arm64/Makefile | 11 ++++++++++- arch/arm64/include/asm/memory.h | 8 +++----- 2 files changed, 13 insertions(+), 6 deletions(-) commit 2bd926b439b4cb6b9ed240a9781cd01958b53d85 Author: Andrey Konovalov Date: Fri Dec 28 00:29:53 2018 -0800 kasan: add CONFIG_KASAN_GENERIC and CONFIG_KASAN_SW_TAGS This commit splits the current CONFIG_KASAN config option into two: 1. CONFIG_KASAN_GENERIC, that enables the generic KASAN mode (the one that exists now); 2. CONFIG_KASAN_SW_TAGS, that enables the software tag-based KASAN mode. The name CONFIG_KASAN_SW_TAGS is chosen as in the future we will have another hardware tag-based KASAN mode, that will rely on hardware memory tagging support in arm64. With CONFIG_KASAN_SW_TAGS enabled, compiler options are changed to instrument kernel files with -fsantize=kernel-hwaddress (except the ones for which KASAN_SANITIZE := n is set). Both CONFIG_KASAN_GENERIC and CONFIG_KASAN_SW_TAGS support both CONFIG_KASAN_INLINE and CONFIG_KASAN_OUTLINE instrumentation modes. This commit also adds empty placeholder (for now) implementation of tag-based KASAN specific hooks inserted by the compiler and adjusts common hooks implementation. While this commit adds the CONFIG_KASAN_SW_TAGS config option, this option is not selectable, as it depends on HAVE_ARCH_KASAN_SW_TAGS, which we will enable once all the infrastracture code has been added. Link: http://lkml.kernel.org/r/b2550106eb8a68b10fefbabce820910b115aa853.1544099024.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Andrey Ryabinin Reviewed-by: Dmitry Vyukov Cc: Christoph Lameter Cc: Mark Rutland Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/compiler-clang.h | 6 ++- include/linux/compiler-gcc.h | 6 +++ include/linux/compiler_attributes.h | 13 ----- include/linux/kasan.h | 16 ++++-- lib/Kconfig.kasan | 98 ++++++++++++++++++++++++++++--------- mm/kasan/Makefile | 6 ++- mm/kasan/generic.c | 2 +- mm/kasan/kasan.h | 3 +- mm/kasan/tags.c | 75 ++++++++++++++++++++++++++++ mm/slub.c | 2 +- scripts/Makefile.kasan | 53 +++++++++++--------- 11 files changed, 214 insertions(+), 66 deletions(-) commit b938fcf42739de8270e6ea41593722929c8a7dd0 Author: Andrey Konovalov Date: Fri Dec 28 00:29:49 2018 -0800 kasan: rename source files to reflect the new naming scheme We now have two KASAN modes: generic KASAN and tag-based KASAN. Rename kasan.c to generic.c to reflect that. Also rename kasan_init.c to init.c as it contains initialization code for both KASAN modes. Link: http://lkml.kernel.org/r/88c6fd2a883e459e6242030497230e5fb0d44d44.1544099024.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Andrey Ryabinin Reviewed-by: Dmitry Vyukov Cc: Christoph Lameter Cc: Mark Rutland Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/kasan/Makefile | 8 ++++---- mm/kasan/{kasan.c => generic.c} | 0 mm/kasan/{kasan_init.c => init.c} | 0 3 files changed, 4 insertions(+), 4 deletions(-) commit bffa986c6f80e39d9903015fc7d0d99a66bbf559 Author: Andrey Konovalov Date: Fri Dec 28 00:29:45 2018 -0800 kasan: move common generic and tag-based code to common.c Tag-based KASAN reuses a significant part of the generic KASAN code, so move the common parts to common.c without any functional changes. Link: http://lkml.kernel.org/r/114064d002356e03bb8cc91f7835e20dc61b51d9.1544099024.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Andrey Ryabinin Reviewed-by: Dmitry Vyukov Cc: Christoph Lameter Cc: Mark Rutland Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/kasan/Makefile | 5 +- mm/kasan/common.c | 603 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ mm/kasan/kasan.c | 570 +-------------------------------------------------- mm/kasan/kasan.h | 5 + 4 files changed, 614 insertions(+), 569 deletions(-) commit 12b22386998ccf97497a49c88f9579cf9c0dee55 Author: Andrey Konovalov Date: Fri Dec 28 00:29:41 2018 -0800 kasan, slub: handle pointer tags in early_kmem_cache_node_alloc The previous patch updated KASAN hooks signatures and their usage in SLAB and SLUB code, except for the early_kmem_cache_node_alloc function. This patch handles that function separately, as it requires to reorder some of the initialization code to correctly propagate a tagged pointer in case a tag is assigned by kasan_kmalloc. Link: http://lkml.kernel.org/r/fc8d0fdcf733a7a52e8d0daaa650f4736a57de8c.1544099024.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Cc: Andrey Ryabinin Cc: Christoph Lameter Cc: Dmitry Vyukov Cc: Mark Rutland Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/slub.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 0116523cfffa62aeb5aa3b85ce7419f3dae0c1b8 Author: Andrey Konovalov Date: Fri Dec 28 00:29:37 2018 -0800 kasan, mm: change hooks signatures Patch series "kasan: add software tag-based mode for arm64", v13. This patchset adds a new software tag-based mode to KASAN [1]. (Initially this mode was called KHWASAN, but it got renamed, see the naming rationale at the end of this section). The plan is to implement HWASan [2] for the kernel with the incentive, that it's going to have comparable to KASAN performance, but in the same time consume much less memory, trading that off for somewhat imprecise bug detection and being supported only for arm64. The underlying ideas of the approach used by software tag-based KASAN are: 1. By using the Top Byte Ignore (TBI) arm64 CPU feature, we can store pointer tags in the top byte of each kernel pointer. 2. Using shadow memory, we can store memory tags for each chunk of kernel memory. 3. On each memory allocation, we can generate a random tag, embed it into the returned pointer and set the memory tags that correspond to this chunk of memory to the same value. 4. By using compiler instrumentation, before each memory access we can add a check that the pointer tag matches the tag of the memory that is being accessed. 5. On a tag mismatch we report an error. With this patchset the existing KASAN mode gets renamed to generic KASAN, with the word "generic" meaning that the implementation can be supported by any architecture as it is purely software. The new mode this patchset adds is called software tag-based KASAN. The word "tag-based" refers to the fact that this mode uses tags embedded into the top byte of kernel pointers and the TBI arm64 CPU feature that allows to dereference such pointers. The word "software" here means that shadow memory manipulation and tag checking on pointer dereference is done in software. As it is the only tag-based implementation right now, "software tag-based" KASAN is sometimes referred to as simply "tag-based" in this patchset. A potential expansion of this mode is a hardware tag-based mode, which would use hardware memory tagging support (announced by Arm [3]) instead of compiler instrumentation and manual shadow memory manipulation. Same as generic KASAN, software tag-based KASAN is strictly a debugging feature. [1] https://www.kernel.org/doc/html/latest/dev-tools/kasan.html [2] http://clang.llvm.org/docs/HardwareAssistedAddressSanitizerDesign.html [3] https://community.arm.com/processors/b/blog/posts/arm-a-profile-architecture-2018-developments-armv85a ====== Rationale On mobile devices generic KASAN's memory usage is significant problem. One of the main reasons to have tag-based KASAN is to be able to perform a similar set of checks as the generic one does, but with lower memory requirements. Comment from Vishwath Mohan : I don't have data on-hand, but anecdotally both ASAN and KASAN have proven problematic to enable for environments that don't tolerate the increased memory pressure well. This includes (a) Low-memory form factors - Wear, TV, Things, lower-tier phones like Go, (c) Connected components like Pixel's visual core [1]. These are both places I'd love to have a low(er) memory footprint option at my disposal. Comment from Evgenii Stepanov : Looking at a live Android device under load, slab (according to /proc/meminfo) + kernel stack take 8-10% available RAM (~350MB). KASAN's overhead of 2x - 3x on top of it is not insignificant. Not having this overhead enables near-production use - ex. running KASAN/KHWASAN kernel on a personal, daily-use device to catch bugs that do not reproduce in test configuration. These are the ones that often cost the most engineering time to track down. CPU overhead is bad, but generally tolerable. RAM is critical, in our experience. Once it gets low enough, OOM-killer makes your life miserable. [1] https://www.blog.google/products/pixel/pixel-visual-core-image-processing-and-machine-learning-pixel-2/ ====== Technical details Software tag-based KASAN mode is implemented in a very similar way to the generic one. This patchset essentially does the following: 1. TCR_TBI1 is set to enable Top Byte Ignore. 2. Shadow memory is used (with a different scale, 1:16, so each shadow byte corresponds to 16 bytes of kernel memory) to store memory tags. 3. All slab objects are aligned to shadow scale, which is 16 bytes. 4. All pointers returned from the slab allocator are tagged with a random tag and the corresponding shadow memory is poisoned with the same value. 5. Compiler instrumentation is used to insert tag checks. Either by calling callbacks or by inlining them (CONFIG_KASAN_OUTLINE and CONFIG_KASAN_INLINE flags are reused). 6. When a tag mismatch is detected in callback instrumentation mode KASAN simply prints a bug report. In case of inline instrumentation, clang inserts a brk instruction, and KASAN has it's own brk handler, which reports the bug. 7. The memory in between slab objects is marked with a reserved tag, and acts as a redzone. 8. When a slab object is freed it's marked with a reserved tag. Bug detection is imprecise for two reasons: 1. We won't catch some small out-of-bounds accesses, that fall into the same shadow cell, as the last byte of a slab object. 2. We only have 1 byte to store tags, which means we have a 1/256 probability of a tag match for an incorrect access (actually even slightly less due to reserved tag values). Despite that there's a particular type of bugs that tag-based KASAN can detect compared to generic KASAN: use-after-free after the object has been allocated by someone else. ====== Testing Some kernel developers voiced a concern that changing the top byte of kernel pointers may lead to subtle bugs that are difficult to discover. To address this concern deliberate testing has been performed. It doesn't seem feasible to do some kind of static checking to find potential issues with pointer tagging, so a dynamic approach was taken. All pointer comparisons/subtractions have been instrumented in an LLVM compiler pass and a kernel module that would print a bug report whenever two pointers with different tags are being compared/subtracted (ignoring comparisons with NULL pointers and with pointers obtained by casting an error code to a pointer type) has been used. Then the kernel has been booted in QEMU and on an Odroid C2 board and syzkaller has been run. This yielded the following results. The two places that look interesting are: is_vmalloc_addr in include/linux/mm.h is_kernel_rodata in mm/util.c Here we compare a pointer with some fixed untagged values to make sure that the pointer lies in a particular part of the kernel address space. Since tag-based KASAN doesn't add tags to pointers that belong to rodata or vmalloc regions, this should work as is. To make sure debug checks to those two functions that check that the result doesn't change whether we operate on pointers with or without untagging has been added. A few other cases that don't look that interesting: Comparing pointers to achieve unique sorting order of pointee objects (e.g. sorting locks addresses before performing a double lock): tty_ldisc_lock_pair_timeout in drivers/tty/tty_ldisc.c pipe_double_lock in fs/pipe.c unix_state_double_lock in net/unix/af_unix.c lock_two_nondirectories in fs/inode.c mutex_lock_double in kernel/events/core.c ep_cmp_ffd in fs/eventpoll.c fsnotify_compare_groups fs/notify/mark.c Nothing needs to be done here, since the tags embedded into pointers don't change, so the sorting order would still be unique. Checks that a pointer belongs to some particular allocation: is_sibling_entry in lib/radix-tree.c object_is_on_stack in include/linux/sched/task_stack.h Nothing needs to be done here either, since two pointers can only belong to the same allocation if they have the same tag. Overall, since the kernel boots and works, there are no critical bugs. As for the rest, the traditional kernel testing way (use until fails) is the only one that looks feasible. Another point here is that tag-based KASAN is available under a separate config option that needs to be deliberately enabled. Even though it might be used in a "near-production" environment to find bugs that are not found during fuzzing or running tests, it is still a debug tool. ====== Benchmarks The following numbers were collected on Odroid C2 board. Both generic and tag-based KASAN were used in inline instrumentation mode. Boot time [1]: * ~1.7 sec for clean kernel * ~5.0 sec for generic KASAN * ~5.0 sec for tag-based KASAN Network performance [2]: * 8.33 Gbits/sec for clean kernel * 3.17 Gbits/sec for generic KASAN * 2.85 Gbits/sec for tag-based KASAN Slab memory usage after boot [3]: * ~40 kb for clean kernel * ~105 kb (~260% overhead) for generic KASAN * ~47 kb (~20% overhead) for tag-based KASAN KASAN memory overhead consists of three main parts: 1. Increased slab memory usage due to redzones. 2. Shadow memory (the whole reserved once during boot). 3. Quaratine (grows gradually until some preset limit; the more the limit, the more the chance to detect a use-after-free). Comparing tag-based vs generic KASAN for each of these points: 1. 20% vs 260% overhead. 2. 1/16th vs 1/8th of physical memory. 3. Tag-based KASAN doesn't require quarantine. [1] Time before the ext4 driver is initialized. [2] Measured as `iperf -s & iperf -c 127.0.0.1 -t 30`. [3] Measured as `cat /proc/meminfo | grep Slab`. ====== Some notes A few notes: 1. The patchset can be found here: https://github.com/xairy/kasan-prototype/tree/khwasan 2. Building requires a recent Clang version (7.0.0 or later). 3. Stack instrumentation is not supported yet and will be added later. This patch (of 25): Tag-based KASAN changes the value of the top byte of pointers returned from the kernel allocation functions (such as kmalloc). This patch updates KASAN hooks signatures and their usage in SLAB and SLUB code to reflect that. Link: http://lkml.kernel.org/r/aec2b5e3973781ff8a6bb6760f8543643202c451.1544099024.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Andrey Ryabinin Reviewed-by: Dmitry Vyukov Cc: Christoph Lameter Cc: Mark Rutland Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/kasan.h | 43 +++++++++++++++++++++++++++++-------------- include/linux/slab.h | 4 ++-- mm/kasan/kasan.c | 30 ++++++++++++++++++------------ mm/slab.c | 12 ++++++------ mm/slab.h | 2 +- mm/slab_common.c | 4 ++-- mm/slub.c | 15 +++++++-------- 7 files changed, 65 insertions(+), 45 deletions(-) commit 4ccc98a48958da9f89beb71c66a4e05468727951 Author: Jiri Olsa Date: Wed Dec 12 11:25:37 2018 +0100 tools gpio: Allow overriding CFLAGS So that the user can specify outside CFLAGS values. Signed-off-by: Jiri Olsa Reviewed-by: Andy Shevchenko Cc: Hartmut Knaack Cc: Herton Krzesinski Cc: Jonathan Cameron Cc: Lars-Peter Clausen Link: http://lkml.kernel.org/r/20181212102537.25902-7-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/gpio/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6b7f98a37ac63fe94e84a5289962457b4b504a8d Author: Jiri Olsa Date: Wed Dec 12 11:25:35 2018 +0100 tools power turbostat: Override CFLAGS assignments and add LDFLAGS to build command So that the user can specify outside CFLAGS/LDFLAGS values. Signed-off-by: Jiri Olsa Reviewed-by: Andy Shevchenko Cc: Herton Krzesinski Cc: Len Brown Link: http://lkml.kernel.org/r/20181212102537.25902-5-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/power/x86/turbostat/Makefile | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit ad6b474f445e587e9b56ec44241b1639bccf6738 Author: Jiri Olsa Date: Wed Dec 12 11:25:33 2018 +0100 tools thermal tmon: Allow overriding CFLAGS assignments So that the user can provide, e.g. distro package alternative values. Signed-off-by: Jiri Olsa Cc: Brian Norris Cc: Herton Krzesinski Cc: Markus Mayer Cc: Zhang Rui Link: http://lkml.kernel.org/r/20181212102537.25902-3-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/thermal/tmon/Makefile | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit f1770e3ca4ec10ce43825de2f855a1831c711195 Author: Jiri Olsa Date: Fri Oct 12 07:20:16 2018 -0400 tools power x86_energy_perf_policy: Override CFLAGS assignments and add LDFLAGS to build command So user could specify outside CFLAGS/LDFLAGS values. Signed-off-by: Jiri Olsa Cc: Herton Krzesinski Cc: Len Brown Link: https://lkml.kernel.org/r/20181212102537.25902-2-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/power/x86/x86_energy_perf_policy/Makefile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit c4a75bb9488a9f7b3c7e79017609529d1aa5deab Author: Jiri Olsa Date: Fri Dec 28 11:18:20 2018 +0100 perf c2c: Increase the HITM ratio limit for displayed cachelines The cachelines being reported are the ones with percentages all the way down to 0.05%. That makes for very long output files. Raising that to 0.1%. The user can always specify --show-all if they want all the cachelines with hits. Suggested-by: Joe Mario Signed-off-by: Jiri Olsa Cc: Alexander Shishkin Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/20181228101820.28010-2-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-c2c.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 423701a0c8d754d9a39547f6c48904347e4f1eca Author: Jiri Olsa Date: Fri Dec 28 11:18:19 2018 +0100 perf c2c: Change the default coalesce setup Joe suggested to have the coalesce default set just to 'iaddr', because it's easier to read on the default 'perf c2c report' output. By removing the "pid" field from the default -c/--coalesce option, the 'perf c2c' report will group all the relevant PIDs under the instruction address ('iaddr') bucket. User can always run "-c pid,iaddr" for a more fine grained output on particular PIDs. Suggested-by: Joe Mario Signed-off-by: Jiri Olsa Cc: Alexander Shishkin Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/20181228101820.28010-1-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-c2c.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 38fc9da69f3385667ba8c3d45bd43065491854a6 Author: Arnaldo Carvalho de Melo Date: Thu Dec 27 16:20:21 2018 -0300 perf trace beauty ioctl: Beautify USBDEVFS_ commands For instance, while debugging the 'galileo' python utility to synchronize fitbit trackers: # perf trace -e ioctl ./run --force ioctl(0, TCSETS, 0x7ffe28666420) = 0 ioctl(0, TCSETS, 0x7ffe28666290) = 0 ioctl(1, TCSETS, 0x7ffe28666290) = 0 ioctl(2, TCSETS, 0x7ffe28666290) = 0 ioctl(3, TCSETS, 0x7ffe286663f0) = -1 ENOTTY (Inappropriate ioctl for device) ioctl(1, TCSETS, 0x7ffe286655a0) = 0 ioctl(1, TCSETS, 0x7ffe28665470) = 0 ioctl(1, TCSETS, 0x7ffe28665470) = 0 ioctl(1, TCSETS, 0x7ffe286654a0) = 0 ioctl(1, TCSETS, 0x7ffe286654a0) = 0 ioctl(1, TCSETS, 0x7ffe28665400) = 0 ioctl(1, TIOCSWINSZ, 0x7ffe286654c0) = 0 ioctl(0, TIOCSWINSZ, 0x7ffe28665560) = 0 ioctl(0, TIOCSWINSZ, 0x7ffe28665560) = 0 ioctl(0, TIOCMGET, 0x7ffe28665560) = 0 ioctl(0, TCSETS, 0x7ffe28665530) = 0 ioctl(10, USBDEVFS_GET_CAPABILITIES, 0x561468dad048) = 0 ioctl(10, USBDEVFS_GETDRIVER, 0x7ffe28665500) = -1 ENODATA (No data available) ioctl(10, USBDEVFS_GETDRIVER, 0x7ffe28665500) = -1 ENODATA (No data available) ioctl(10, USBDEVFS_SETCONFIGURATION, 0x7ffe2866513c) = 0 ioctl(10, USBDEVFS_CLAIMINTERFACE, 0x7ffe286647bc) = 0 ioctl(10, USBDEVFS_SUBMITURB, 0x561468dace40) = 0 ioctl(10, USBDEVFS_REAPURBNDELAY, 0x7ffe28664c10) = 0 ioctl(10, USBDEVFS_REAPURBNDELAY, 0x7ffe28664c10) = -1 EAGAIN (Resource temporarily unavailable) ioctl(10, USBDEVFS_SUBMITURB, 0x561468dace40) = 0 ioctl(10, USBDEVFS_REAPURBNDELAY, 0x7ffe28664dd0) = 0 ioctl(10, USBDEVFS_REAPURBNDELAY, 0x7ffe28664dd0) = -1 EAGAIN (Resource temporarily unavailable) ioctl(10, USBDEVFS_SUBMITURB, 0x561468e72ec0) = 0 ioctl(10, USBDEVFS_REAPURBNDELAY, 0x7ffe28664cc0) = 0 ioctl(10, USBDEVFS_REAPURBNDELAY, 0x7ffe28664cc0) = -1 EAGAIN (Resource temporarily unavailable) ioctl(10, USBDEVFS_RELEASEINTERFACE, 0x7ffe2866463c) = 0 ioctl(10, USBDEVFS_RELEASEINTERFACE, 0x7ffe2866463c) = 0 Tracker: 813F4690C3D1: Synchronisation successful # Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-6x2cawak7jno3gpp5pagzj50@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/trace/beauty/ioctl.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) commit 2d473389f87ace284bda35a5254bc66e24d0caa9 Author: Arnaldo Carvalho de Melo Date: Thu Dec 27 16:19:33 2018 -0300 perf trace beauty: Export function to get the files for a thread So that beautifiers can access things like dev_maj. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-wm5o51f206c5pi063dsaeraq@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-trace.c | 10 +++++----- tools/perf/trace/beauty/beauty.h | 7 +++++++ 2 files changed, 12 insertions(+), 5 deletions(-) commit 86cf4c659c9ae1609262699caa4b2c3ab7fefa9b Author: Arnaldo Carvalho de Melo Date: Thu Dec 27 15:10:34 2018 -0300 perf trace: Wire up ioctl's USBDEBFS_ cmd table generator That ends up generating this: [acme@quaco perf]$ cat /tmp/build/perf/trace/beauty/generated/ioctl/usbdevfs_ioctl_array.c static const char *usbdevfs_ioctl_cmds[] = { [0] = "CONTROL", [10] = "SUBMITURB", [11] = "DISCARDURB", [12] = "REAPURB", [13] = "REAPURBNDELAY", [14] = "DISCSIGNAL", [15] = "CLAIMINTERFACE", [16] = "RELEASEINTERFACE", [17] = "CONNECTINFO", [18] = "IOCTL", [19] = "HUB_PORTINFO", [2] = "BULK", [20] = "RESET", [21] = "CLEAR_HALT", [22] = "DISCONNECT", [23] = "CONNECT", [24] = "CLAIM_PORT", [25] = "RELEASE_PORT", [26] = "GET_CAPABILITIES", [27] = "DISCONNECT_CLAIM", [28] = "ALLOC_STREAMS", [29] = "FREE_STREAMS", [3] = "RESETEP", [30] = "DROP_PRIVILEGES", [31] = "GET_SPEED", [4] = "SETINTERFACE", [5] = "SETCONFIGURATION", [8] = "GETDRIVER", }; #if 0 static const char *usbdevfs_ioctl_32_cmds[] = { [0] = "CONTROL32", [10] = "SUBMITURB32", [12] = "REAPURB32", [13] = "REAPURBNDELAY32", [14] = "DISCSIGNAL32", [18] = "IOCTL32", [2] = "BULK32", }; #endif $ Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-hkam6lt1g806l0p4b7buif3n@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/Makefile.perf | 8 ++++++++ 1 file changed, 8 insertions(+) commit 870c3f40dc78edec6437a2ced03976b66eeacf49 Author: Arnaldo Carvalho de Melo Date: Thu Dec 27 14:27:35 2018 -0300 perf beauty ioctl: Add generator for USBDEVFS_ ioctl commands Will be associated with fds with the right device major. $ tools/perf/trace/beauty/usbdevfs_ioctl.sh static const char *usbdevfs_ioctl_cmds[] = { [0] = "CONTROL", [10] = "SUBMITURB", [11] = "DISCARDURB", [12] = "REAPURB", [13] = "REAPURBNDELAY", [14] = "DISCSIGNAL", [15] = "CLAIMINTERFACE", [16] = "RELEASEINTERFACE", [17] = "CONNECTINFO", [18] = "IOCTL", [19] = "HUB_PORTINFO", [20] = "RESET", [21] = "CLEAR_HALT", [22] = "DISCONNECT", [23] = "CONNECT", [24] = "CLAIM_PORT", [25] = "RELEASE_PORT", [26] = "GET_CAPABILITIES", [27] = "DISCONNECT_CLAIM", [28] = "ALLOC_STREAMS", [29] = "FREE_STREAMS", [2] = "BULK", [30] = "DROP_PRIVILEGES", [31] = "GET_SPEED", [3] = "RESETEP", [4] = "SETINTERFACE", [5] = "SETCONFIGURATION", [8] = "GETDRIVER", }; #if 0 static const char *usbdevfs_ioctl_32_cmds[] = { [0] = "CONTROL32", [10] = "SUBMITURB32", [12] = "REAPURB32", [13] = "REAPURBNDELAY32", [14] = "DISCSIGNAL32", [18] = "IOCTL32", [2] = "BULK32", }; #endif $ Leaving the '32' variants commented, later we can try to support those as well, from some other hint (maybe something about the thread issuing the ioctls) and from the _IOC_SIZE(cmd). Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-neq1lrji5k4ku0rktn7ytnri@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/trace/beauty/usbdevfs_ioctl.sh | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) commit 2bd71d11a86e8419a33a131d194fd735a8f74400 Author: Arnaldo Carvalho de Melo Date: Thu Dec 27 14:18:13 2018 -0300 tools headers uapi: Grab a copy of usbdevice_fs.h Will be used to generate the string table for the USBDEVFS_ prefixed ioctl commands. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-3vrm9b55tdhzn8sw9qazh4z5@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/include/uapi/linux/usbdevice_fs.h | 201 ++++++++++++++++++++++++++++++++ tools/perf/check-headers.sh | 1 + 2 files changed, 202 insertions(+) commit 4bcc4cff6a10e5287d4dd3e73b6b4689f9a0c570 Author: Arnaldo Carvalho de Melo Date: Thu Dec 27 13:32:59 2018 -0300 perf trace: Store the major number for a file when storing its pathname We keep a table for the fds to map them back to pathnames when showing 'fd' based APIs such as write(), store as well the major number for the device the path is in, to use in things like choosing the right ioctl 'cmd' beautifier. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-qjkds7bnk7v7fk2xhqsb0a4v@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-trace.c | 5 +++++ 1 file changed, 5 insertions(+) commit d7e134845d6b19288dec5582ce91d6c6052fcdad Author: Arnaldo Carvalho de Melo Date: Thu Dec 27 11:05:18 2018 -0300 perf trace: Move the files table resizing to outside set_pathname() So that we can have that table expanded when setting other attributes. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-hzvpe3qwafe6sqcq3bhtbxds@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-trace.c | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) commit f4a74fcbfd943e128bbd464dc31b4405e1514d63 Author: Arnaldo Carvalho de Melo Date: Thu Dec 27 10:56:12 2018 -0300 perf trace: Rename thread_thread->paths to thread_trace->files So that we can add more per file attributes besides the pathname, such as which ioctl beautifier to use, for cases such as the sound and usbdeffs ioctls, that both use the 'U' command, so we have to differentiate at the major number for the device file. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-1895cmhrdz2dkl5prf2cj2yj@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-trace.c | 42 +++++++++++++++++++++++------------------- 1 file changed, 23 insertions(+), 19 deletions(-) commit 61f611593f2c90547cb09c0bf6977414454a27e6 Author: Andi Kleen Date: Mon Nov 19 21:06:17 2018 -0800 perf script: Fix LBR skid dump problems in brstackinsn This is a fix for another instance of the skid problem Milian recently found [1] The LBRs don't freeze at the exact same time as the PMI is triggered. The perf script brstackinsn code that dumps LBR assembler assumes that the last branch in the LBR leads to the sample point. But with skid it's possible that the CPU executes one or more branches before the sample, but which do not appear in the LBR. What happens then is either that the sample point is before the last LBR branch. In this case the dumper sees a negative length and ignores it. Or it the sample point is long after the last branch. Then the dumper sees a very long block and dumps it upto its block limit (16k bytes), which is noise in the output. On typical sample session this can happen regularly. This patch tries to detect and handle the situation. On the last block that is dumped by the LBR dumper we always stop on the first branch. If the block length is negative just scan forward to the first branch. Otherwise scan until a branch is found. The PT decoder already has a function that uses the instruction decoder to detect branches, so we can just reuse it here. Then when a terminating branch is found print an indication and stop dumping. This might miss a few instructions, but at least shows no runaway blocks. Signed-off-by: Andi Kleen Acked-by: Adrian Hunter Cc: Jiri Olsa Cc: Milian Wolff Link: http://lkml.kernel.org/r/20181120050617.4119-1-andi@firstfloor.org [ Resolved conflict with dd2e18e9ac20 ("perf tools: Support 'srccode' output") ] Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-script.c | 17 ++++++++++++++++- tools/perf/util/dump-insn.c | 8 ++++++++ tools/perf/util/dump-insn.h | 2 ++ .../perf/util/intel-pt-decoder/intel-pt-insn-decoder.c | 8 ++++++++ 4 files changed, 34 insertions(+), 1 deletion(-) commit a389aece97938966616ce0336466b98b0351ef10 Author: Jiri Olsa Date: Wed Dec 26 12:21:21 2018 +0100 perf python: Do not force closing original perf descriptor in evlist.get_pollfd() Ondřej reported that when compiled with python3, the python extension regresses in evlist.get_pollfd function behaviour. The evlist.get_pollfd function creates file objects from evlist's fds and returns them in a list. The python3 version also sets them to 'close the original descriptor' when the object dies (is closed), by passing True via the 'closefd' arg in the PyFile_FromFd call. The python's closefd doc says: If closefd is False, the underlying file descriptor will be kept open when the file is closed. That's why the following line in python3 closes all evlist fds: evlist.get_pollfd() the returned list is immediately destroyed and that takes down the original events fds. Passing closefd as False to PyFile_FromFd to fix this. Reported-by: Ondřej Lysoněk Signed-off-by: Jiri Olsa Cc: Alexander Shishkin Cc: Jaroslav Škarvada Cc: Namhyung Kim Cc: Peter Zijlstra Fixes: 66dfdff03d19 ("perf tools: Add Python 3 support") Link: http://lkml.kernel.org/r/20181226112121.5285-1-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/python.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit fbe7e42515af6c2ecee04b1c851f78de1d190281 Author: Colin Ian King Date: Fri Dec 21 08:48:09 2018 +0000 perf trace: Use correct SECCOMP prefix spelling, "SECOMP_*" -> "SECCOMP_*" The spelling of the SECCOMP is incorrect, fix these. Signed-off-by: Colin King Cc: Alexander Shishkin Cc: Peter Zijlstra Cc: kernel-janitors@vger.kernel.org Fixes: c65c83ffe904 ("perf trace: Allow asking for not suppressing common string prefixes") Link: http://lkml.kernel.org/r/20181221084809.6108-1-colin.king@canonical.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/trace/beauty/seccomp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 08972760d366b83a87d366b0079747f8c409163c Author: Aisheng Dong Date: Sun Dec 23 16:20:02 2018 +0000 clk: imx8qxp: make the name of clock ID generic SCU clock can be used in a similar way by IMX8QXP and IMX8QM SoCs. Let's make the name of clock ID generic to allow other SoCs to reuse the common part. This patch only changes the clock id name and file name, so no functional change. Cc: Stephen Boyd Cc: Rob Herring Cc: Shawn Guo Cc: Sascha Hauer Cc: Fabio Estevam Cc: Michael Turquette Cc: devicetree@vger.kernel.org Signed-off-by: Dong Aisheng Reviewed-by: Fabio Estevam Reviewed-by: Rob Herring Signed-off-by: Stephen Boyd drivers/clk/imx/clk-imx8qxp-lpcg.c | 148 +++++++-------- drivers/clk/imx/clk-imx8qxp.c | 154 ++++++++-------- include/dt-bindings/clock/imx8-clock.h | 289 ++++++++++++++++++++++++++++++ include/dt-bindings/clock/imx8qxp-clock.h | 289 ------------------------------ 4 files changed, 440 insertions(+), 440 deletions(-) commit 3fc9c12d27b4ded4f1f761a800558dab2e6bbac5 Author: Tejun Heo Date: Fri Dec 28 10:31:07 2018 -0800 cgroup: Add named hierarchy disabling to cgroup_no_v1 boot param It can be useful to inhibit all cgroup1 hierarchies especially during transition and for debugging. cgroup_no_v1 can block hierarchies with controllers which leaves out the named hierarchies. Expand it to cover the named hierarchies so that "cgroup_no_v1=all,named" disables all cgroup1 hierarchies. Signed-off-by: Tejun Heo Suggested-by: Marcin Pawlowski Signed-off-by: Tejun Heo Documentation/admin-guide/kernel-parameters.txt | 8 ++++++-- kernel/cgroup/cgroup-v1.c | 14 +++++++++++++- 2 files changed, 19 insertions(+), 3 deletions(-) commit e250d91d65750a0c0c62483ac4f9f357e7317617 Author: Ondrej Mosnacek Date: Thu Dec 13 15:17:37 2018 +0100 cgroup: fix parsing empty mount option string This fixes the case where all mount options specified are consumed by an LSM and all that's left is an empty string. In this case cgroupfs should accept the string and not fail. How to reproduce (with SELinux enabled): # umount /sys/fs/cgroup/unified # mount -o context=system_u:object_r:cgroup_t:s0 -t cgroup2 cgroup2 /sys/fs/cgroup/unified mount: /sys/fs/cgroup/unified: wrong fs type, bad option, bad superblock on cgroup2, missing codepage or helper program, or other error. # dmesg | tail -n 1 [ 31.575952] cgroup: cgroup2: unknown option "" Fixes: 67e9c74b8a87 ("cgroup: replace __DEVEL__sane_behavior with cgroup2 fs type") [NOTE: should apply on top of commit 5136f6365ce3 ("cgroup: implement "nsdelegate" mount option"), older versions need manual rebase] Suggested-by: Stephen Smalley Signed-off-by: Ondrej Mosnacek Signed-off-by: Tejun Heo kernel/cgroup/cgroup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 14e92c5dc7a1a1d4a82fb7142b5642837fef962a Author: Steve French Date: Mon Dec 24 01:05:22 2018 -0600 cifs: Minor Kconfig clarification Clarify the use of the CONFIG_DFS_UPCALL for DNS name resolution when server ip addresses change (e.g. on long running mounts) Signed-off-by: Steve French fs/cifs/Kconfig | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 28eb24ff75c5ac130eb326b3b4d0dcecfc0f427d Author: Paulo Alcantara Date: Tue Nov 20 15:16:36 2018 -0200 cifs: Always resolve hostname before reconnecting In case a hostname resolves to a different IP address (e.g. long running mounts), make sure to resolve it every time prior to calling generic_ip_connect() in reconnect. Suggested-by: Steve French Signed-off-by: Paulo Alcantara Signed-off-by: Steve French fs/cifs/connect.c | 84 ++++++++++++++++++++++++++++++++++--------------------- 1 file changed, 52 insertions(+), 32 deletions(-) commit 08744015492fec5a30ab8e2779601ae2b1a5e431 Author: Paulo Alcantara Date: Wed Nov 14 17:24:29 2018 -0200 cifs: Add support for failover in cifs_reconnect_tcon() After a successful failover, the cifs_reconnect_tcon() function will make sure to reconnect every tcon to new target server. Same as previous commit but for SMB1 codepath. Signed-off-by: Paulo Alcantara Reviewed-by: Aurelien Aptel Signed-off-by: Steve French fs/cifs/cifssmb.c | 88 +++++++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 85 insertions(+), 3 deletions(-) commit a3a53b7603798fd875e2afbba7e2b9ba6b19c7c7 Author: Paulo Alcantara Date: Wed Nov 14 17:20:31 2018 -0200 cifs: Add support for failover in smb2_reconnect() After a successful failover in cifs_reconnect(), the smb2_reconnect() function will make sure to reconnect every tcon to new target server. For SMB2+. Signed-off-by: Paulo Alcantara Signed-off-by: Aurelien Aptel Signed-off-by: Steve French fs/cifs/cifsproto.h | 2 ++ fs/cifs/misc.c | 17 +++++++++++ fs/cifs/smb2pdu.c | 88 +++++++++++++++++++++++++++++++++++++++++++++++++++-- 3 files changed, 104 insertions(+), 3 deletions(-) commit 23324407143dd923660378fd9b40b9a711972269 Author: Paulo Alcantara Date: Tue Nov 20 14:37:18 2018 -0200 cifs: Only free DFS target list if we actually got one Fix potential NULL ptr deref when DFS target list is empty. Signed-off-by: Paulo Alcantara Reviewed-by: Aurelien Aptel Signed-off-by: Steve French fs/cifs/connect.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit e511d31753e3f7c13bbd402399ffac676d451a7c Author: Paulo Alcantara Date: Wed Nov 14 17:16:44 2018 -0200 cifs: start DFS cache refresher in cifs_mount() Start the DFS cache refresh worker per volume during cifs mount. Signed-off-by: Paulo Alcantara Reviewed-by: Aurelien Aptel Signed-off-by: Steve French fs/cifs/connect.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 2f0a617448945a2c63d68983212302e9f2f8ae2f Author: YueHaibing Date: Tue Dec 18 01:34:39 2018 +0000 cifs: Use GFP_ATOMIC when a lock is held in cifs_mount() A spin lock is held before kstrndup, it may sleep with holding the spinlock, so we should use GFP_ATOMIC instead. Fixes: e58c31d5e387 ("cifs: Add support for failover in cifs_reconnect()") Signed-off-by: YueHaibing Signed-off-by: Steve French Reviewed-by: Paulo Alcantara fs/cifs/connect.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 93d5cb517db39e8af8d1292f9e785e4983b7f708 Author: Paulo Alcantara Date: Wed Nov 14 17:13:25 2018 -0200 cifs: Add support for failover in cifs_reconnect() After failing to reconnect to original target, it will retry any target available from DFS cache. Signed-off-by: Paulo Alcantara Reviewed-by: Aurelien Aptel Signed-off-by: Steve French fs/cifs/cifs_fs_sb.h | 9 +++ fs/cifs/cifsglob.h | 7 ++ fs/cifs/connect.c | 189 ++++++++++++++++++++++++++++++++++++++++++++++++++- 3 files changed, 204 insertions(+), 1 deletion(-) commit 4a367dc0443566f87d73f2cdb94703b0e1374315 Author: Paulo Alcantara Date: Wed Nov 14 16:53:52 2018 -0200 cifs: Add support for failover in cifs_mount() This patch adds support for failover when failing to connect in cifs_mount(). Signed-off-by: Paulo Alcantara Reviewed-by: Aurelien Aptel Signed-off-by: Steve French fs/cifs/cifs_dfs_ref.c | 20 +++-- fs/cifs/connect.c | 228 ++++++++++++++++++++++++++++++++++++++++++++++--- fs/cifs/misc.c | 3 + 3 files changed, 236 insertions(+), 15 deletions(-) commit 5a650501eb8cb785593155441c5b0b9900edfcdf Author: YueHaibing Date: Tue Dec 18 01:35:29 2018 +0000 cifs: remove set but not used variable 'sep' Fixes gcc '-Wunused-but-set-variable' warning: fs/cifs/cifs_dfs_ref.c: In function 'cifs_dfs_do_automount': fs/cifs/cifs_dfs_ref.c:309:7: warning: variable 'sep' set but not used [-Wunused-but-set-variable] It never used since introdution in commit 0f56b277073c ("cifs: Make use of DFS cache to get new DFS referrals") Signed-off-by: YueHaibing Reviewed-by: Paulo Alcantara Signed-off-by: Steve French fs/cifs/cifs_dfs_ref.c | 3 --- 1 file changed, 3 deletions(-) commit 1c780228e9d47b966983a8bbf475dd45967bf0d5 Author: Paulo Alcantara Date: Wed Nov 14 16:24:03 2018 -0200 cifs: Make use of DFS cache to get new DFS referrals This patch will make use of DFS cache routines where appropriate and do not always request a new referral from server. Signed-off-by: Paulo Alcantara Reviewed-by: Aurelien Aptel Signed-off-by: Steve French fs/cifs/cifs_dfs_ref.c | 100 ++++++++++++++++++++++++++++++------------------- fs/cifs/cifsfs.c | 17 ++++++++- fs/cifs/cifsglob.h | 1 - fs/cifs/cifsproto.h | 19 +++++++--- fs/cifs/connect.c | 45 +++++++--------------- fs/cifs/smb1ops.c | 15 ++++---- 6 files changed, 113 insertions(+), 84 deletions(-) commit e8bcdfdbf91bf979afe6642a99b41cbc0a4916d0 Author: Steve French Date: Fri Dec 21 00:44:32 2018 -0600 cifs: minor updates to documentation Update cifs "TODO" file. Signed-off-by: Steve French Documentation/filesystems/cifs/TODO | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) commit 0544b324e62c177c3a9e9c3bdce22e6db9f34588 Author: Joe Perches Date: Thu Dec 20 23:50:48 2018 -0600 cifs: check kzalloc return kzalloc can return NULL so an additional check is needed. While there is a check for ret_buf there is no check for the allocation of ret_buf->crfid.fid - this check is thus added. Both call-sites of tconInfoAlloc() check for NULL return of tconInfoAlloc() so returning NULL on failure of kzalloc() here seems appropriate. As the kzalloc() is the only thing here that can fail it is moved to the beginning so as not to initialize other resources on failure of kzalloc. Fixes: 3d4ef9a15343 ("smb3: fix redundant opens on root") Signed-off-by: Joe Perches Signed-off-by: Steve French fs/cifs/misc.c | 34 ++++++++++++++++++++-------------- 1 file changed, 20 insertions(+), 14 deletions(-) commit 29cbfa1b2be2e51785f871351d321896861f2ce8 Author: YueHaibing Date: Tue Dec 18 02:51:51 2018 +0000 cifs: remove set but not used variable 'server' Fixes gcc '-Wunused-but-set-variable' warning: fs/cifs/smb2pdu.c: In function 'smb311_posix_mkdir': fs/cifs/smb2pdu.c:2040:26: warning: variable 'server' set but not used [-Wunused-but-set-variable] fs/cifs/smb2pdu.c: In function 'build_qfs_info_req': fs/cifs/smb2pdu.c:4067:26: warning: variable 'server' set but not used [-Wunused-but-set-variable] The first 'server' never used since commit bea851b8babe ("smb3: Fix mode on mkdir on smb311 mounts") And the second not used since commit 1fc6ad2f10ad ("cifs: remove header_preamble_size where it is always 0") Signed-off-by: YueHaibing Signed-off-by: Steve French fs/cifs/smb2pdu.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) commit 34bca9bbe7a81c4b53cacb20e996090ddf371c51 Author: Dan Carpenter Date: Thu Dec 20 14:32:43 2018 +0300 cifs: Use kzfree() to free password We should zero out the password before we free it. Fixes: 3d6cacbb5310 ("cifs: Add DFS cache routines") Signed-off-by: Dan Carpenter Signed-off-by: Steve French Reviewed-by: Paulo Alcantara fs/cifs/dfs_cache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3e80be0158ac67d936e65935db5b07663822c66d Author: Wei Yongjun Date: Tue Dec 18 06:37:02 2018 +0000 cifs: Fix to use kmem_cache_free() instead of kfree() memory allocated by kmem_cache_alloc() in alloc_cache_entry() should be freed using kmem_cache_free(), not kfree(). Fixes: 34a44fb160f9 ("cifs: Add DFS cache routines") Signed-off-by: Wei Yongjun Signed-off-by: Steve French Reviewed-by: Aurelien Aptel fs/cifs/dfs_cache.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 54e4f73cbe03dd0634548e40d12c442d377c36c4 Author: Stephen Rothwell Date: Mon Dec 17 20:11:46 2018 +1100 cifs: update for current_kernel_time64() removal Fixes cifs build failure after merge of the y2038 tree After merging the y2038 tree, today's linux-next build (x86_64 allmodconfig) failed like this: fs/cifs/dfs_cache.c: In function 'cache_entry_expired': fs/cifs/dfs_cache.c:106:7: error: implicit declaration of function 'current_kernel_time64'; did you mean 'core_kernel_text'? [-Werror=implicit-function-declaration] ts = current_kernel_time64(); ^~~~~~~~~~~~~~~~~~~~~ core_kernel_text fs/cifs/dfs_cache.c:106:5: error: incompatible types when assigning to type 'struct timespec64' from type 'int' ts = current_kernel_time64(); ^ fs/cifs/dfs_cache.c: In function 'get_expire_time': fs/cifs/dfs_cache.c:342:24: error: incompatible type for argument 1 of 'timespec64_add' return timespec64_add(current_kernel_time64(), ts); ^~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/restart_block.h:10, from include/linux/thread_info.h:13, from arch/x86/include/asm/preempt.h:7, from include/linux/preempt.h:78, from include/linux/rcupdate.h:40, from fs/cifs/dfs_cache.c:8: include/linux/time64.h:66:66: note: expected 'struct timespec64' but argument is of type 'int' static inline struct timespec64 timespec64_add(struct timespec64 lhs, ~~~~~~~~~~~~~~~~~~^~~ fs/cifs/dfs_cache.c:343:1: warning: control reaches end of non-void function [-Wreturn-type] } ^ Caused by: commit ccea641b6742 ("timekeeping: remove obsolete time accessors") interacting with: commit 34a44fb160f9 ("cifs: Add DFS cache routines") from the cifs tree. Signed-off-by: Stephen Rothwell Reviewed-by: Paulo Alcantara Acked-by: Arnd Bergmann Signed-off-by: Steve French fs/cifs/dfs_cache.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 54be1f6c1c37498bba557049df646cc239fa37e3 Author: Paulo Alcantara Date: Wed Nov 14 16:01:21 2018 -0200 cifs: Add DFS cache routines * Add new dfs_cache.[ch] files * Add new /proc/fs/cifs/dfscache file - dump current cache when read - clear current cache when writing "0" to it * Add delayed_work to periodically refresh cache entries The new interface will be used for caching DFS referrals, as well as supporting client target failover. The DFS cache is a hashtable that maps UNC paths to cache entries. A cache entry contains: - the UNC path it is mapped on - how much the the UNC path the entry consumes - flags - a Time-To-Live after which the entry expires - a list of possible targets (linked lists of UNC paths) - a "hint target" pointing the last known working target or the first target if none were tried. This hint lets cifs.ko remember and try working targets first. * Looking for an entry in the cache is done with dfs_cache_find() - if no valid entries are found, a DFS query is made, stored in the cache and returned - the full target list can be copied and returned to avoid race conditions and looped on with the help with the dfs_cache_tgt_iterator * Updating the target hint to the next target is done with dfs_cache_update_tgthint() These functions have a dfs_cache_noreq_XXX() version that doesn't fetches referrals if no entries are found. These versions don't require the tcp/ses/tcon/cifs_sb parameters as a result. Expired entries cannot be used and since they have a pretty short TTL [1] in order for them to be useful for failover the DFS cache adds a delayed work called periodically to keep them fresh. Since we might not have available connections to issue the referral request when refreshing we need to store volume_info structs with credentials and other needed info to be able to connect to the right server. 1: Windows defaults: 5mn for domain-based referrals, 30mn for regular links Signed-off-by: Paulo Alcantara Signed-off-by: Aurelien Aptel Signed-off-by: Steve French fs/cifs/Makefile | 2 +- fs/cifs/cifs_debug.c | 12 + fs/cifs/cifsglob.h | 5 + fs/cifs/cifsproto.h | 3 + fs/cifs/connect.c | 2 +- fs/cifs/dfs_cache.c | 1365 ++++++++++++++++++++++++++++++++++++++++++++++++++ fs/cifs/dfs_cache.h | 97 ++++ 7 files changed, 1484 insertions(+), 2 deletions(-) commit 21c7acc439b55d0569d7c2fc2eea5194b3910406 Author: Guenter Roeck Date: Thu Dec 27 08:46:38 2018 -0800 h8300: pci: Remove local declaration of pcibios_penalize_isa_irq h8300 builds fail with: In file included from drivers/of/address.c:11: include/linux/pci.h:1966:20: error: redefinition of 'pcibios_penalize_isa_irq' This is because CONFIG_PCI is not enabled, and pcibios_penalize_isa_irq() is now declared as inline static function in generic code if this is the case. Since h8300 does not support PCI to start with, fix the problem by removing the architecture specific pci.h. Fixes: 5d32a66541c46 ("PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set") Cc: Sinan Kaya Cc: Bjorn Helgaas Signed-off-by: Guenter Roeck Signed-off-by: Yoshinori Sato arch/h8300/include/asm/Kbuild | 1 + arch/h8300/include/asm/pci.h | 18 ------------------ 2 files changed, 1 insertion(+), 18 deletions(-) commit f222b7f43661c3dddd44ee493c16e04e8f231542 Author: Masahiro Yamada Date: Fri Dec 21 17:33:08 2018 +0900 kconfig: surround dbg_sym_flags with #ifdef DEBUG to fix gconf warning Fix the following warning: no previous prototype for ‘dbg_sym_flags’ [-Wmissing-prototypes] Signed-off-by: Masahiro Yamada scripts/kconfig/gconf.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 3b541978562a0f553b0c0253d927d55612dd97b1 Author: Masahiro Yamada Date: Fri Dec 21 17:33:07 2018 +0900 kconfig: split images.c out of qconf.cc/gconf.c to fix gconf warnings Currently, images.c is included by qconf.cc and gconf.c. qconf.cc uses all of xpm_* arrays, but gconf.c only some of them. Hence, lots of "... defined but not used" warnings are displayed while compiling gconf.c Splitting out images.c fixes the warnings. Signed-off-by: Masahiro Yamada scripts/kconfig/Makefile | 4 ++-- scripts/kconfig/gconf.c | 2 +- scripts/kconfig/images.c | 32 +++++++++++++++++--------------- scripts/kconfig/images.h | 33 +++++++++++++++++++++++++++++++++ scripts/kconfig/qconf.cc | 2 +- 5 files changed, 54 insertions(+), 19 deletions(-) commit 9abe42371b44ef3e10e068d3e461c3a97192fb46 Author: Masahiro Yamada Date: Fri Dec 21 17:33:06 2018 +0900 kconfig: add static qualifiers to fix gconf warnings Add "static" to functions that are locally used in gconf.c This fixes some "no previous prototype for ..." warnings. Signed-off-by: Masahiro Yamada scripts/kconfig/gconf.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) commit cbafbf7f551c3a03fb9440932f1ca13056ca40a6 Author: Masahiro Yamada Date: Fri Dec 21 17:33:05 2018 +0900 kconfig: split the lexer out of zconf.y Compile zconf.lex.c independently of the other files. Signed-off-by: Masahiro Yamada scripts/kconfig/Makefile | 8 ++------ scripts/kconfig/lkc.h | 3 +++ scripts/kconfig/zconf.l | 1 + scripts/kconfig/zconf.y | 2 -- 4 files changed, 6 insertions(+), 8 deletions(-) commit 558e78e3ce844c61ceffe32775dbefacf167b023 Author: Masahiro Yamada Date: Fri Dec 21 17:33:04 2018 +0900 kconfig: split some C files out of zconf.y I want to compile each C file independently instead of including all of them from zconf.y. Split out confdata.c, expr.c, symbol.c, and preprocess.c . These are low-hanging fruits. Signed-off-by: Masahiro Yamada scripts/kconfig/Makefile | 19 +++++++++---------- scripts/kconfig/confdata.c | 1 + scripts/kconfig/expr.c | 2 ++ scripts/kconfig/lkc.h | 1 + scripts/kconfig/preprocess.c | 2 ++ scripts/kconfig/symbol.c | 2 +- scripts/kconfig/zconf.y | 4 ---- 7 files changed, 16 insertions(+), 15 deletions(-) commit 0c874100108f03401cb3154801d2671bbad40ad4 Author: Masahiro Yamada Date: Tue Dec 18 21:13:35 2018 +0900 kconfig: convert to SPDX License Identifier All files in lxdialog/ are licensed under GPL-2.0+, and the rest are under GPL-2.0. I added GPL-2.0 tags to test scripts in tests/. Documentation/process/license-rules.rst does not suggest anything about the flex/bison files. Because flex does not accept the C++ comment style at the very top of a file, I used the C style for zconf.l, and so for zconf.y for consistency. Signed-off-by: Masahiro Yamada scripts/kconfig/conf.c | 2 +- scripts/kconfig/confdata.c | 2 +- scripts/kconfig/expr.c | 2 +- scripts/kconfig/expr.h | 2 +- scripts/kconfig/gconf.c | 5 +---- scripts/kconfig/images.c | 2 +- scripts/kconfig/lkc.h | 2 +- scripts/kconfig/lxdialog/checklist.c | 15 +-------------- scripts/kconfig/lxdialog/dialog.h | 15 +-------------- scripts/kconfig/lxdialog/inputbox.c | 15 +-------------- scripts/kconfig/lxdialog/menubox.c | 15 +-------------- scripts/kconfig/lxdialog/textbox.c | 15 +-------------- scripts/kconfig/lxdialog/util.c | 15 +-------------- scripts/kconfig/lxdialog/yesno.c | 15 +-------------- scripts/kconfig/mconf.c | 2 +- scripts/kconfig/menu.c | 2 +- scripts/kconfig/merge_config.sh | 11 ++--------- scripts/kconfig/nconf.c | 5 ++--- scripts/kconfig/nconf.gui.c | 5 ++--- scripts/kconfig/nconf.h | 5 ++--- scripts/kconfig/qconf.cc | 2 +- scripts/kconfig/qconf.h | 2 +- scripts/kconfig/streamline_config.pl | 2 +- scripts/kconfig/symbol.c | 2 +- scripts/kconfig/tests/auto_submenu/Kconfig | 2 ++ scripts/kconfig/tests/auto_submenu/__init__.py | 1 + scripts/kconfig/tests/choice/Kconfig | 2 ++ scripts/kconfig/tests/choice/__init__.py | 1 + scripts/kconfig/tests/choice_value_with_m_dep/Kconfig | 2 ++ scripts/kconfig/tests/choice_value_with_m_dep/__init__.py | 1 + scripts/kconfig/tests/err_recursive_inc/__init__.py | 1 + scripts/kconfig/tests/inter_choice/Kconfig | 2 ++ scripts/kconfig/tests/inter_choice/__init__.py | 1 + scripts/kconfig/tests/new_choice_with_dep/Kconfig | 2 ++ scripts/kconfig/tests/new_choice_with_dep/__init__.py | 1 + scripts/kconfig/tests/no_write_if_dep_unmet/Kconfig | 2 ++ scripts/kconfig/tests/no_write_if_dep_unmet/__init__.py | 1 + scripts/kconfig/tests/rand_nested_choice/Kconfig | 2 ++ scripts/kconfig/tests/rand_nested_choice/__init__.py | 1 + scripts/kconfig/util.c | 3 +-- scripts/kconfig/zconf.l | 8 ++++---- scripts/kconfig/zconf.y | 4 ++-- 42 files changed, 57 insertions(+), 140 deletions(-) commit 979f2b2f7936f4b71a3100baf2d16c8057f027eb Author: Masahiro Yamada Date: Tue Dec 11 20:01:10 2018 +0900 kconfig: remove keyword lookup table entirely Commit 7a88488bbc23 ("[PATCH] kconfig: use gperf for kconfig keywords") introduced gperf for the keyword lookup. Then, commit bb3290d91695 ("Remove gperf usage from toolchain") killed the gperf use. As a result, the linear keyword search was left behind. If we do not use gperf, there is no reason to have the separate table of the keywords. Move all keywords back to the lexer. I also refactored the lexer to remove the COMMAND and PARAM states. Signed-off-by: Masahiro Yamada scripts/kconfig/kconf_id.c | 49 --------------- scripts/kconfig/lkc.h | 9 --- scripts/kconfig/zconf.l | 153 ++++++++++++++++++++------------------------- scripts/kconfig/zconf.y | 5 -- 4 files changed, 69 insertions(+), 147 deletions(-) commit 4bcd2ffd214c1dad269c8ec40ac935770d208534 Merge: 221b35fedee1 cb6f4c2c3478 Author: Dave Airlie Date: Fri Dec 28 14:05:35 2018 +1000 Merge tag 'drm-intel-next-fixes-2018-12-27' of git://anongit.freedesktop.org/drm/drm-intel into drm-next GVT fixes for v4.21-rc1 Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/87imzfwh73.fsf@intel.com commit 4b5f747e82b12b6d8ab815fc259827a615c7f2c3 Merge: 37379cfc661e 3d9cbe37c16f Author: Dan Williams Date: Thu Dec 27 19:54:10 2018 -0800 Merge miscellaneous libnvdimm updates for 4.21 * Use common helpers, bitmap_zalloc() and kstrndup(), to replace open coded versions. * Clarify the comments around hotplug vs initial init case for the nfit driver. * Cleanup the libnvdimm init path. commit 4d71c6f8771a6bccb844244f09831fa4624b22c1 Merge: 1e7eacaf1db2 e9d81a1bc2c4 Author: Tejun Heo Date: Thu Dec 27 18:05:30 2018 -0800 Merge branch 'for-4.20-fixes' into for-4.21 commit 91bd2ffa9030191ad077e43be37c5bfc53640dc2 Author: Vasily Averin Date: Mon Dec 24 14:46:21 2018 +0300 nfs: minor typo in nfs4_callback_up_net() Closing ")" was lost in debug message. Signed-off-by: Vasily Averin Signed-off-by: J. Bruce Fields fs/nfs/callback.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9ac312888e8869481613a2c65bb8bf5ab6d15594 Author: Vasily Averin Date: Mon Dec 24 14:46:14 2018 +0300 sunrpc: fix debug message in svc_create_xprt() _svc_create_xprt() returns positive port number so its non-zero return value is not an error Reviewed-by: Jeff Layton Signed-off-by: Vasily Averin Signed-off-by: J. Bruce Fields net/sunrpc/svc_xprt.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 8f7766c805d27a56e37cf7e108c2208649b44569 Author: Vasily Averin Date: Mon Dec 24 14:46:08 2018 +0300 sunrpc: make visible processing error in bc_svc_process() Force bc_svc_process() to generate debug message after processing errors Signed-off-by: Vasily Averin Signed-off-by: J. Bruce Fields net/sunrpc/svc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 64e20ba204df539a76004114e08abf1156302e35 Author: Vasily Averin Date: Mon Dec 24 14:46:00 2018 +0300 sunrpc: remove unused xpo_prep_reply_hdr callback xpo_prep_reply_hdr are not used now. It was defined for tcp transport only, however it cannot be called indirectly, so let's move it to its caller and remove unused callback. Signed-off-by: Vasily Averin Signed-off-by: J. Bruce Fields include/linux/sunrpc/svc_rdma.h | 1 - include/linux/sunrpc/svc_xprt.h | 1 - net/sunrpc/svc.c | 11 +++++++++++ net/sunrpc/svcsock.c | 17 ----------------- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 4 ---- net/sunrpc/xprtrdma/svc_rdma_transport.c | 1 - 6 files changed, 11 insertions(+), 24 deletions(-) commit 7ef88ff85ff71dd167d29d47bdb91c63cedcd554 Author: Vasily Averin Date: Mon Dec 24 14:45:53 2018 +0300 sunrpc: remove svc_rdma_bc_class Remove svc_xprt_class svc_rdma_bc_class and related functions. Signed-off-by: Vasily Averin Signed-off-by: J. Bruce Fields net/sunrpc/xprtrdma/svc_rdma.c | 6 ---- net/sunrpc/xprtrdma/svc_rdma_transport.c | 57 -------------------------------- 2 files changed, 63 deletions(-) commit 7f391546098702bf8160038d8512a2502a0343ca Author: Vasily Averin Date: Mon Dec 24 14:45:46 2018 +0300 sunrpc: remove svc_tcp_bc_class Remove svc_xprt_class svc_tcp_bc_class and related functions Signed-off-by: Vasily Averin Signed-off-by: J. Bruce Fields net/sunrpc/svcsock.c | 101 --------------------------------------------------- 1 file changed, 101 deletions(-) commit 4aa5cffefa6f8af8f16490df58b8f0d827911b58 Author: Vasily Averin Date: Mon Dec 24 14:45:25 2018 +0300 sunrpc: remove unused bc_up operation from rpc_xprt_ops Signed-off-by: Vasily Averin Signed-off-by: J. Bruce Fields include/linux/sunrpc/xprt.h | 1 - net/sunrpc/xprtrdma/backchannel.c | 20 -------------------- net/sunrpc/xprtrdma/transport.c | 1 - net/sunrpc/xprtrdma/xprt_rdma.h | 1 - net/sunrpc/xprtsock.c | 12 ------------ 5 files changed, 35 deletions(-) commit a289ce5311f406bf846614591300a948ebc42062 Author: Vasily Averin Date: Mon Dec 24 14:45:04 2018 +0300 sunrpc: replace svc_serv->sv_bc_xprt by boolean flag svc_serv-> sv_bc_xprt is netns-unsafe and cannot be used as pointer. To prevent its misuse in future it is replaced by new boolean flag. Signed-off-by: Vasily Averin Signed-off-by: J. Bruce Fields fs/nfs/callback.c | 8 +++++--- include/linux/sunrpc/bc_xprt.h | 10 ++++------ include/linux/sunrpc/svc.h | 2 +- net/sunrpc/svcsock.c | 2 -- net/sunrpc/xprtrdma/svc_rdma_transport.c | 1 - 5 files changed, 10 insertions(+), 13 deletions(-) commit d4b09acf924b84bae77cad090a9d108e70b43643 Author: Vasily Averin Date: Mon Dec 24 14:44:52 2018 +0300 sunrpc: use-after-free in svc_process_common() if node have NFSv41+ mounts inside several net namespaces it can lead to use-after-free in svc_process_common() svc_process_common() /* Setup reply header */ rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr(rqstp); <<< HERE svc_process_common() can use incorrect rqstp->rq_xprt, its caller function bc_svc_process() takes it from serv->sv_bc_xprt. The problem is that serv is global structure but sv_bc_xprt is assigned per-netnamespace. According to Trond, the whole "let's set up rqstp->rq_xprt for the back channel" is nothing but a giant hack in order to work around the fact that svc_process_common() uses it to find the xpt_ops, and perform a couple of (meaningless for the back channel) tests of xpt_flags. All we really need in svc_process_common() is to be able to run rqstp->rq_xprt->xpt_ops->xpo_prep_reply_hdr() Bruce J Fields points that this xpo_prep_reply_hdr() call is an awfully roundabout way just to do "svc_putnl(resv, 0);" in the tcp case. This patch does not initialiuze rqstp->rq_xprt in bc_svc_process(), now it calls svc_process_common() with rqstp->rq_xprt = NULL. To adjust reply header svc_process_common() just check rqstp->rq_prot and calls svc_tcp_prep_reply_hdr() for tcp case. To handle rqstp->rq_xprt = NULL case in functions called from svc_process_common() patch intruduces net namespace pointer svc_rqst->rq_bc_net and adjust SVC_NET() definition. Some other function was also adopted to properly handle described case. Signed-off-by: Vasily Averin Cc: stable@vger.kernel.org Fixes: 23c20ecd4475 ("NFS: callback up - users counting cleanup") Signed-off-by: J. Bruce Fields include/linux/sunrpc/svc.h | 5 ++++- include/trace/events/sunrpc.h | 6 ++++-- net/sunrpc/svc.c | 9 +++++---- net/sunrpc/svc_xprt.c | 5 +++-- net/sunrpc/svcsock.c | 2 +- 5 files changed, 17 insertions(+), 10 deletions(-) commit b8be5674fa9a6f3677865ea93f7803c4212f3e10 Author: Vasily Averin Date: Mon Dec 24 14:44:42 2018 +0300 sunrpc: use SVC_NET() in svcauth_gss_* functions Signed-off-by: Vasily Averin Cc: stable@vger.kernel.org Signed-off-by: J. Bruce Fields net/sunrpc/auth_gss/svcauth_gss.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 8a68d3da50b952232bbb39f7582a9050c40a0d78 Author: Julia Lawall Date: Sun Dec 23 09:56:56 2018 +0100 nfsd: drop useless LIST_HEAD Drop LIST_HEAD where the variable it declares is never used. This was introduced in c5c707f96fc9a ("nfsd: implement pNFS layout recalls"), but was not used even in that commit. The semantic patch that fixes this problem is as follows: (http://coccinelle.lip6.fr/) // @@ identifier x; @@ - LIST_HEAD(x); ... when != x // Fixes: c5c707f96fc9a ("nfsd: implement pNFS layout recalls") Signed-off-by: Julia Lawall Signed-off-by: J. Bruce Fields fs/nfsd/nfs4layouts.c | 1 - 1 file changed, 1 deletion(-) commit 00c569b567c7f1f0da6162868fd02a9f29411805 Merge: f6b1495fba0b 052b8cfa4070 Author: Linus Torvalds Date: Thu Dec 27 17:12:30 2018 -0800 Merge tag 'locks-v4.21-1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux Pull file locking updates from Jeff Layton: "The main change in this set is Neil Brown's work to reduce the thundering herd problem when a heavily-contended file lock is released. Previously we'd always wake up all waiters when this occurred. With this set, we'll now we only wake up waiters that were blocked on the range being released" * tag 'locks-v4.21-1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux: locks: Use inode_is_open_for_write fs/locks: remove unnecessary white space. fs/locks: merge posix_unblock_lock() and locks_delete_block() fs/locks: create a tree of dependent requests. fs/locks: change all *_conflict() functions to return bool. fs/locks: always delete_block after waiting. fs/locks: allow a lock request to block other requests. fs/locks: use properly initialized file_lock when unlocking. ocfs2: properly initial file_lock used for unlock. gfs2: properly initial file_lock used for unlock. NFS: use locks_copy_lock() to copy locks. fs/locks: split out __locks_wake_up_blocks(). fs/locks: rename some lists and pointers. commit f6b1495fba0b66cfa05efa0ca2370513b79b45b6 Merge: bc77789a491c 18f2c4fcebf2 Author: Linus Torvalds Date: Thu Dec 27 17:09:41 2018 -0800 Merge tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 updates from Ted Ts'o: "All cleanups and bug fixes; most notably, fix some problems discovered in ext4's NFS support, and fix an ioctl (EXT4_IOC_GROUP_ADD) used by old versions of e2fsprogs which we accidentally broke a while back. Also fixed some error paths in ext4's quota and inline data support. Finally, improve tail latency in jbd2's commit code" * tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: check for shutdown and r/o file system in ext4_write_inode() ext4: force inode writes when nfsd calls commit_metadata() ext4: avoid declaring fs inconsistent due to invalid file handles ext4: include terminating u32 in size of xattr entries when expanding inodes ext4: compare old and new mode before setting update_mode flag ext4: fix EXT4_IOC_GROUP_ADD ioctl ext4: hard fail dax mount on unsupported devices jbd2: update locking documentation for transaction_t ext4: remove redundant condition check jbd2: clean up indentation issue, replace spaces with tab ext4: clean up indentation issues, remove extraneous tabs ext4: missing unlock/put_page() in ext4_try_to_write_inline_data() ext4: fix possible use after free in ext4_quota_enable jbd2: avoid long hold times of j_state_lock while committing a transaction ext4: add ext4_sb_bread() to disambiguate ENOMEM cases commit bc77789a491cdc6f47e5bbd1d04ddd283d64658b Merge: 47a43f2f0ce2 3cc31fa65d85 Author: Linus Torvalds Date: Thu Dec 27 17:07:35 2018 -0800 Merge tag 'iomap-4.21-merge-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull iomap update from Darrick Wong: "Fix a memory overflow bug for blocksize < pagesize" * tag 'iomap-4.21-merge-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: iomap: don't search past page end in iomap_is_partially_uptodate commit 47a43f2f0ce24bb75e3e4500118000585a3b496a Merge: e01799ac5630 65eed012d1f2 Author: Linus Torvalds Date: Thu Dec 27 17:04:23 2018 -0800 Merge tag 'xfs-4.21-merge-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull XFS updates from Darrick Wong: - Fix CoW remapping of extremely fragmented file areas - Fix a zero-length symlink verifier error - Constify some of the rmap owner structures for per-AG metadata - Precalculate inode geometry for later use - Fix scrub counting problems - Don't crash when rtsummary inode is null - Fix x32 ioctl operation - Fix enum->string mappings for ftrace output - Cache realtime summary information in memory * tag 'xfs-4.21-merge-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (24 commits) xfs: reallocate realtime summary cache on growfs xfs: stringify scrub types in ftrace output xfs: stringify btree cursor types in ftrace output xfs: move XFS_INODE_FORMAT_STR mappings to libxfs xfs: move XFS_AG_BTREE_CMP_FORMAT_STR mappings to libxfs xfs: fix symbolic enum printing in ftrace output xfs: fix function pointer type in ftrace format xfs: Fix x32 ioctls when cmd numbers differ from ia32. xfs: Fix bulkstat compat ioctls on x32 userspace. xfs: Align compat attrlist_by_handle with native implementation. xfs: require both realtime inodes to mount xfs: cache minimum realtime summary level xfs: count inode blocks correctly in inobt scrub xfs: precalculate cluster alignment in inodes and blocks xfs: precalculate inodes and blocks per inode cluster xfs: add a block to inode count converter xfs: remove xfs_rmap_ag_owner and friends xfs: const-ify xfs_owner_info arguments xfs: streamline defer op type handling xfs: idiotproof defer op type configuration ... commit e01799ac56306ab211f2edf1221a82dc57eab8f5 Merge: 4b0a383ad782 41c4f85cdac2 Author: Linus Torvalds Date: Thu Dec 27 17:00:35 2018 -0800 Merge tag 'fs_for_4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull ext2, udf, and quota update from Jan Kara: "Some ext2 cleanups, a fix for UDF crash on corrupted media, and one quota locking fix" * tag 'fs_for_4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: quota: Lock s_umount in exclusive mode for Q_XQUOTA{ON,OFF} quotactls. udf: Fix BUG on corrupted inode ext2: change reusable parameter to true when calling mb_cache_entry_create() ext2: remove redundant condition check ext2: avoid unnecessary operation in ext2_error() commit 4b0a383ad782d6028becea7602968d49a83ff5fc Merge: 4de3aea385f5 ac9498d68644 Author: Linus Torvalds Date: Thu Dec 27 16:55:37 2018 -0800 Merge tag 'fsnotify_for_v4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull fsnotify updates from Jan Kara: "Support for new FAN_OPEN_EXEC event and couple of cleanups around fsnotify" * tag 'fsnotify_for_v4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: fanotify: Use inode_is_open_for_write fanotify: Make sure to check event_len when copying fsnotify/fdinfo: include fdinfo.h for inotify_show_fdinfo() fanotify: introduce new event mask FAN_OPEN_EXEC_PERM fsnotify: refactor fsnotify_parent()/fsnotify() paired calls when event is on path fanotify: introduce new event mask FAN_OPEN_EXEC fanotify: return only user requested event types in event mask commit 4de3aea385f5a054885bc96ffdb9c7d0ea0c9486 Merge: 32ee34eddad1 3595c559326d Author: Linus Torvalds Date: Thu Dec 27 16:49:24 2018 -0800 Merge tag 'dlm-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm Pull dlm updates from David Teigland: "This set is entirely trivial fixes, mainly around correct cleanup on error paths and improved error checks. One patch adds scheduling in a potentially long recovery loop" * tag 'dlm-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm: dlm: fix invalid cluster name warning dlm: NULL check before some freeing functions is not needed dlm: NULL check before kmem_cache_destroy is not needed dlm: fix missing idr_destroy for recover_idr dlm: memory leaks on error path in dlm_user_request() dlm: lost put_lkb on error path in receive_convert() and receive_unlock() dlm: possible memory leak on error path in create_lkb() dlm: fixed memory leaks after failed ls_remove_names allocation dlm: fix possible call to kfree() for non-initialized pointer dlm: Don't swamp the CPU with callbacks queued during recovery dlm: don't leak kernel pointer to userspace dlm: don't allow zero length names dlm: fix invalid free commit 32ee34eddad13cd44ad0cb3e659fe6fd49143b62 Merge: 7bbbf2c2fc84 52042d8e82ff Author: Linus Torvalds Date: Thu Dec 27 16:44:40 2018 -0800 Merge tag 'for-4.21-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs updates from David Sterba: "New features: - swapfile support - after a long time it's here, with some limitations where COW design does not work well with the swap implementation (nodatacow file, no compression, cannot be snapshotted, not possible on multiple devices, ...), as this is the most restricted but working setup, we'll try to improve that in the future - metadata uuid - an optional incompat feature to assign a new filesystem UUID without overwriting all metadata blocks, stored only in superblock - more balance messages are printed to system log, initial is in the format of the command line that would be used to start it Fixes: - tag pages of a snapshot to better separate pages that are involved in the snapshot (and need to get synced) from newly dirtied pages that could slow down or even livelock the snapshot operation - improved check of filesystem id associated with a device during scan to detect duplicate devices that could be mixed up during mount - fix device replace state transitions, eg. when it ends up interrupted and reboot tries to restart balance too, or when start/cancel ioctls race - fix a crash due to a race when quotas are enabled during snapshot creation - GFP_NOFS/memalloc_nofs_* fixes due to GFP_KERNEL allocations in transaction context - fix fsync of files with multiple hard links in new directories - fix race of send with transaction commits that create snapshots Core changes: - cleanups: * further removals of now-dead fsync code * core function for finding free extent has been split and provides a base for further cleanups to make the logic more understandable * removed lot of indirect callbacks for data and metadata inodes * simplified refcounting and locking for cloned extent buffers * removed redundant function arguments * defines converted to enums where appropriate - separate reserve for delayed refs from global reserve, update logic to do less trickery and ad-hoc heuristics, move out some related expensive operations from transaction commit or file truncate - dev-replace switched from custom locking scheme to semaphore - remove first phase of balance that tried to make some space for the relocation by calling shrink and grow, this did not work as expected and only introduced more error states due to potential resize failures, slightly improves the runtime as the chunks on all devices are not needlessly enumerated - clone and deduplication now use generic helper that adds a few more checks that were missing from the original btrfs implementation of the ioctls" * tag 'for-4.21-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: (125 commits) btrfs: Fix typos in comments and strings btrfs: improve error handling of btrfs_add_link Btrfs: use generic_remap_file_range_prep() for cloning and deduplication btrfs: Refactor main loop in extent_readpages btrfs: Remove 1st shrink/grow phase from balance Btrfs: send, fix race with transaction commits that create snapshots Btrfs: use nofs context when initializing security xattrs to avoid deadlock btrfs: run delayed items before dropping the snapshot btrfs: catch cow on deleting snapshots btrfs: extent-tree: cleanup one-shot usage of @blocksize in do_walk_down Btrfs: scrub, move setup of nofs contexts higher in the stack btrfs: scrub: move scrub_setup_ctx allocation out of device_list_mutex btrfs: scrub: pass fs_info to scrub_setup_ctx btrfs: fix truncate throttling btrfs: don't run delayed refs in the end transaction logic btrfs: rework btrfs_check_space_for_delayed_refs btrfs: add new flushing states for the delayed refs rsv btrfs: update may_commit_transaction to use the delayed refs rsv btrfs: introduce delayed_refs_rsv btrfs: only track ref_heads in delayed_ref_updates ... commit 7bbbf2c2fc84dd24cae8615b11a0c6cac12cbe94 Merge: b71acb0e3721 bc0205612bbd Author: Linus Torvalds Date: Thu Dec 27 16:42:39 2018 -0800 Merge tag 'gfs2-4.21.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull gfs2 updates from Bob Peterson: - Enhancements and performance improvements to journal replay (Abhi Das) - Cleanup of gfs2_is_ordered and gfs2_is_writeback (Andreas Gruenbacher) - Fix a potential double-free in inode creation (Andreas Gruenbacher) - Fix the bitmap search loop that was searching too far (Andreas Gruenbacher) - Various cleanups (Andreas Gruenbacher, Bob Peterson) - Implement Steve Whitehouse's patch to dump nrpages for inodes (Bob Peterson) - Fix a withdraw bug where stuffed journaled data files didn't allocate enough journal space to be grown (Bob Peterson) * tag 'gfs2-4.21.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: gfs2: take jdata unstuff into account in do_grow gfs2: Dump nrpages for inodes and their glocks gfs2: Fix loop in gfs2_rbm_find gfs2: Get rid of potential double-freeing in gfs2_create_inode gfs2: Remove vestigial bd_ops gfs2: read journal in large chunks to locate the head gfs2: add a helper function to get_log_header that can be used elsewhere gfs2: changes to gfs2_log_XXX_bio gfs2: add more timing info to journal recovery process gfs2: Fix the gfs2_invalidatepage description gfs2: Clean up gfs2_is_{ordered,writeback} commit a3c9311f62b4943228ae90f769775dd3bcbfa7c0 Author: Robert P. J. Day Date: Thu Dec 27 16:10:59 2018 -0500 include/linux/phy/phy.h: fix minor kerneldoc errors Correct two minor kerneldoc errors: 1) missing reference to @mode in struct phy_ops 2) obsolete reference to @init_data in struct_phy_attrs, removed in dbc98635e0d42f0e62ea92813df1e0e4c90f8375 Signed-off-by: Robert P. J. Day Signed-off-by: David S. Miller include/linux/phy/phy.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d8de01b763e0d8b3b418d3606d26f203983b6637 Author: Robert P. J. Day Date: Wed Dec 26 06:35:23 2018 -0600 phy.h: fix obvious errors in doc and kerneldoc content 1) note that gianfar_phy.c was removed years ago 2) fix obvious copy and paste error in regular doc 3) change regular doc into kerneldoc for phy_modes() Signed-off-by: Robert P. J. Day Signed-off-by: David S. Miller include/linux/phy.h | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) commit 40752b3eae29f8ca2378e978a02bd6dbeeb06d16 Author: Wen Yang Date: Wed Dec 26 16:28:30 2018 +0800 net/wan/fsl_ucc_hdlc: Avoid double free in ucc_hdlc_probe() This patch fixes potential double frees if register_hdlc_device() fails. Signed-off-by: Wen Yang Reviewed-by: Peng Hao CC: Zhao Qiang CC: "David S. Miller" CC: netdev@vger.kernel.org CC: linuxppc-dev@lists.ozlabs.org CC: linux-kernel@vger.kernel.org Signed-off-by: David S. Miller drivers/net/wan/fsl_ucc_hdlc.c | 1 - 1 file changed, 1 deletion(-) commit 92ee77d148bf06d8c52664be4d1b862583fd5c0e Author: Kangjie Lu Date: Wed Dec 26 00:31:08 2018 -0600 net: marvell: fix a missing check of acpi_match_device When acpi_match_device fails, its return value is NULL. Directly using the return value without a check may result in a NULL-pointer dereference. The fix checks if acpi_match_device fails, and if so, returns -EINVAL. Signed-off-by: Kangjie Lu Signed-off-by: David S. Miller drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 2 ++ 1 file changed, 2 insertions(+) commit 46273cf7e009231d2b6bc10a926e82b8928a9fb2 Author: Kangjie Lu Date: Wed Dec 26 00:09:04 2018 -0600 tipc: fix a missing check of genlmsg_put genlmsg_put could fail. The fix inserts a check of its return value, and if it fails, returns -EMSGSIZE. Signed-off-by: Kangjie Lu Signed-off-by: David S. Miller net/tipc/netlink_compat.c | 2 ++ 1 file changed, 2 insertions(+) commit ff07d48d7bc0974d4f96a85a4df14564fb09f1ef Author: Kangjie Lu Date: Tue Dec 25 22:23:19 2018 -0600 atl1e: checking the status of atl1e_write_phy_reg atl1e_write_phy_reg() could fail. The fix issues an error message when it fails. Signed-off-by: Kangjie Lu Signed-off-by: David S. Miller drivers/net/ethernet/atheros/atl1e/atl1e_main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit e49505f7255be8ced695919c08a29bf2c3d79616 Author: Kangjie Lu Date: Tue Dec 25 22:08:18 2018 -0600 net: dsa: bcm_sf2: Propagate error value from mdio_write Both bcm_sf2_sw_indir_rw and mdiobus_write_nested could fail, so let's return their error codes upstream. Signed-off-by: Kangjie Lu Signed-off-by: David S. Miller drivers/net/dsa/bcm_sf2.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit f86a3b83833e7cfe558ca4d70b64ebc48903efec Author: Kangjie Lu Date: Tue Dec 25 20:57:14 2018 -0600 net: stmicro: fix a missing check of clk_prepare clk_prepare() could fail, so let's check its status, and if it fails, return its error code upstream. Signed-off-by: Kangjie Lu Signed-off-by: David S. Miller drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 2d822f2dbab7f4c820f72eb8570aacf3f35855bd Author: Kangjie Lu Date: Tue Dec 25 20:55:37 2018 -0600 net: (cpts) fix a missing check of clk_prepare clk_prepare() could fail, so let's check its status, and if it fails, return its error code upstream. Signed-off-by: Kangjie Lu Signed-off-by: David S. Miller drivers/net/ethernet/ti/cpts.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 26fd962bde0b15e54234fe762d86bc0349df1de4 Author: Kangjie Lu Date: Tue Dec 25 01:56:14 2018 -0600 niu: fix missing checks of niu_pci_eeprom_read niu_pci_eeprom_read() may fail, so we should check its return value before using the read data. Signed-off-by: Kangjie Lu Acked-by: Shannon Nelson Signed-off-by: David S. Miller drivers/net/ethernet/sun/niu.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) commit ca19fcb6285bfce1601c073bf4b9d2942e2df8d9 Author: Aditya Pakki Date: Mon Dec 24 15:21:21 2018 -0600 net: chelsio: Add a missing check on cudg_get_buffer cudbg_collect_hw_sched() could fail when the function cudg_get_buffer() returns an error. The fix adds a check to the latter function returning error on failure Signed-off-by: Aditya Pakki Signed-off-by: David S. Miller drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c | 4 ++++ 1 file changed, 4 insertions(+) commit f0fb9b288d0a7e9cc324ae362e2dfd2cc2217ded Author: Aditya Pakki Date: Mon Dec 24 10:30:17 2018 -0600 ipv6/route: Add a missing check on proc_dointvec While flushing the cache via ipv6_sysctl_rtcache_flush(), the call to proc_dointvec() may fail. The fix adds a check that returns the error, on failure. Signed-off-by: Aditya Pakki Signed-off-by: David S. Miller net/ipv6/route.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit dc4501ff287547dea7ca10f1c580c741291a8760 Author: Cong Wang Date: Sun Dec 23 21:45:56 2018 -0800 tipc: fix a double free in tipc_enable_bearer() bearer_disable() already calls kfree_rcu() to free struct tipc_bearer, we don't need to call kfree() again. Fixes: cb30a63384bc ("tipc: refactor function tipc_enable_bearer()") Reported-by: syzbot+b981acf1fb240c0c128b@syzkaller.appspotmail.com Cc: Ying Xue Cc: Jon Maloy Signed-off-by: Cong Wang Signed-off-by: David S. Miller net/tipc/bearer.c | 1 - 1 file changed, 1 deletion(-) commit b71acb0e372160167bf6d5500b88b30b52ccef6e Merge: e0c38a4d1f19 c79b411eaa72 Author: Linus Torvalds Date: Thu Dec 27 13:53:32 2018 -0800 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto updates from Herbert Xu: "API: - Add 1472-byte test to tcrypt for IPsec - Reintroduced crypto stats interface with numerous changes - Support incremental algorithm dumps Algorithms: - Add xchacha12/20 - Add nhpoly1305 - Add adiantum - Add streebog hash - Mark cts(cbc(aes)) as FIPS allowed Drivers: - Improve performance of arm64/chacha20 - Improve performance of x86/chacha20 - Add NEON-accelerated nhpoly1305 - Add SSE2 accelerated nhpoly1305 - Add AVX2 accelerated nhpoly1305 - Add support for 192/256-bit keys in gcmaes AVX - Add SG support in gcmaes AVX - ESN for inline IPsec tx in chcr - Add support for CryptoCell 703 in ccree - Add support for CryptoCell 713 in ccree - Add SM4 support in ccree - Add SM3 support in ccree - Add support for chacha20 in caam/qi2 - Add support for chacha20 + poly1305 in caam/jr - Add support for chacha20 + poly1305 in caam/qi2 - Add AEAD cipher support in cavium/nitrox" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (130 commits) crypto: skcipher - remove remnants of internal IV generators crypto: cavium/nitrox - Fix build with !CONFIG_DEBUG_FS crypto: salsa20-generic - don't unnecessarily use atomic walk crypto: skcipher - add might_sleep() to skcipher_walk_virt() crypto: x86/chacha - avoid sleeping under kernel_fpu_begin() crypto: cavium/nitrox - Added AEAD cipher support crypto: mxc-scc - fix build warnings on ARM64 crypto: api - document missing stats member crypto: user - remove unused dump functions crypto: chelsio - Fix wrong error counter increments crypto: chelsio - Reset counters on cxgb4 Detach crypto: chelsio - Handle PCI shutdown event crypto: chelsio - cleanup:send addr as value in function argument crypto: chelsio - Use same value for both channel in single WR crypto: chelsio - Swap location of AAD and IV sent in WR crypto: chelsio - remove set but not used variable 'kctx_len' crypto: ux500 - Use proper enum in hash_set_dma_transfer crypto: ux500 - Use proper enum in cryp_set_dma_transfer crypto: aesni - Add scatter/gather avx stubs, and use them in C crypto: aesni - Introduce partial block macro .. commit 940b241d9050fc354f68c182e99fc3da1ff36bc0 Author: Anton Ivanov Date: Tue Nov 13 15:08:02 2018 +0000 um: Remove obsolete reenable_XX calls reenable_fd has been a NOP since the introduction of the EPOLL based interrupt controller. reenable_channel() is no longer needed as the flow control is now handled via the write IRQs on the channel. Signed-off-by: Anton Ivanov Signed-off-by: Richard Weinberger arch/um/drivers/chan_kern.c | 10 ---------- arch/um/drivers/line.c | 10 ---------- arch/um/drivers/mconsole_kern.c | 2 -- arch/um/drivers/net_kern.c | 2 -- arch/um/drivers/port_kern.c | 1 - arch/um/drivers/random.c | 1 - arch/um/drivers/ubd_kern.c | 1 - arch/um/include/shared/irq_user.h | 1 - arch/um/kernel/irq.c | 6 ------ arch/um/kernel/sigio.c | 1 - 10 files changed, 35 deletions(-) commit b9794231737ab8c8a3a225b50aa168c4c7f9b9ec Author: Christoph Hellwig Date: Thu Dec 27 08:33:24 2018 +0100 um: writev needs vector_user.c doesn't compile without this for me. Signed-off-by: Christoph Hellwig Signed-off-by: Richard Weinberger arch/um/drivers/vector_user.c | 1 + 1 file changed, 1 insertion(+) commit 9de74842ee20b425d227ab66d865d5ec908fbc2c Author: Anton Ivanov Date: Tue Dec 18 14:01:44 2018 +0000 Add Anton Ivanov to UML maintainers Signed-off-by: Anton Ivanov Acked-by: Richard Weinberger Signed-off-by: Richard Weinberger MAINTAINERS | 1 + 1 file changed, 1 insertion(+) commit efe5f5be1e40be76d25da69f76f0b68dc6bafb8e Author: Masahiro Yamada Date: Sun Dec 16 23:37:06 2018 +0900 um: remove redundant generic-y This commit removes redundant generic-y defines in arch/um/include/asm/Kbuild. It is redundant to define generic-y when arch-specific implementation exists in arch/$(ARCH)/include/asm/*.h Remove the following generic-y: hardirq.h io.h Signed-off-by: Masahiro Yamada Signed-off-by: Richard Weinberger arch/um/include/asm/Kbuild | 2 -- 1 file changed, 2 deletions(-) commit 742f3c8193a3cb3e444887211214ef0721e3ef8d Author: Anton Ivanov Date: Fri Dec 7 09:05:53 2018 +0000 um: Optimize Flush TLB for force/fork case When UML handles a fork the page tables need to be brought up to date. That was done using brute force - full tlb flush. This is actually unnecessary, because the mapped-in mappings are all correct and the only mappings which need to be updated after a flush are any unmaps (so that paging works) as well as any pending protection changes. This optimization squeezes out up to 3% from a full kernel rebuild time under memory pressure. Signed-off-by: Anton Ivanov Signed-off-by: Richard Weinberger arch/um/kernel/tlb.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 8892d8545f2d0342b9c550defbfb165db237044b Author: Anton Ivanov Date: Wed Dec 5 12:37:41 2018 +0000 um: Avoid marking pages with "changed protection" Changing protection is a very high cost operation in UML because in addition to an extra syscall it also interrupts mmap merge sequences generated by the tlb. While the condition is not particularly common it is worth avoiding. Signed-off-by: Anton Ivanov Signed-off-by: Richard Weinberger arch/um/include/asm/pgtable.h | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit 38e3cbd9b82c815006c505ad2995013a61af143e Author: Anton Ivanov Date: Wed Dec 5 12:37:40 2018 +0000 um: Skip TLB flushing where not needed Skip TLB flushing for all cases where it is not needed, not just flush_tlb_mm_range Signed-off-by: Anton Ivanov Signed-off-by: Richard Weinberger arch/um/kernel/tlb.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) commit a9c52c2a2881ec69343a49ee32b2f3965e74ca98 Author: Anton Ivanov Date: Wed Dec 5 12:37:39 2018 +0000 um: Optimize TLB operations v2 Make the code to merge mmap/munmap/mprotect operations in tlb.c common for userspace and kernel. Kernel tlb operations can now be merged as well. Signed-off-by: Anton Ivanov Signed-off-by: Richard Weinberger arch/um/kernel/tlb.c | 85 +++++++++++++++++++++++++++++++++++----------------- 1 file changed, 57 insertions(+), 28 deletions(-) commit 747b254ca2649d0c206385c7902fb8ac97a2b0b4 Author: Anton Ivanov Date: Thu Nov 22 14:45:13 2018 +0000 um: Remove unnecessary faulted check in uaccess.c It is not necessary to check if a fault has occured or not after disabling pagefaults. kmap_atomic does that in all cases and we can disable it for 64 bit where kmap is not needed and a simple page_address would suffice. dd if=/dev/zero of=/dev/null bs=1M count=1M Before: 3.1GB/s. After: 3.5GB/s There is a noticeable difference for file disk read and write as well as less noticeable difference for network IO. Signed-off-by: Anton Ivanov Signed-off-by: Richard Weinberger arch/um/kernel/skas/uaccess.c | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) commit 50109b5a03b4024eb6b8df3ab8f427625f54fe92 Author: Anton Ivanov Date: Wed Nov 14 18:41:09 2018 +0000 um: Add support for DISCARD in the UBD Driver Support for DISCARD and WRITE_ZEROES in the ubd driver using fallocate. DISCARD is enabled by default and can be disabled using a new UBD command line flag. If the underlying fs on which the UBD image is stored does not support DISCARD the support for both DISCARD and WRITE_ZEROES is turned off. Signed-off-by: Anton Ivanov Signed-off-by: Richard Weinberger arch/um/drivers/ubd_kern.c | 65 +++++++++++++++++++++++++++++++++++++-------- arch/um/include/shared/os.h | 1 + arch/um/os-Linux/file.c | 10 +++++++ 3 files changed, 65 insertions(+), 11 deletions(-) commit a41421edb926fcc8f212742b2e7a1f21c9047853 Author: Anton Ivanov Date: Wed Nov 14 18:41:08 2018 +0000 um: Remove unsafe printks from the io thread Printk out of the io thread has been proven to be unsafe. This is not surprising as the thread is part of the UML hypervisor code. It is not supposed to invoke any kernel code/resources. It is necesssary to pass the error to the block IO layer and let it Signed-off-by: Anton Ivanov Signed-off-by: Richard Weinberger arch/um/drivers/ubd_kern.c | 42 +++++++++++++++++------------------------- 1 file changed, 17 insertions(+), 25 deletions(-) commit 53766defb8c860a47e2a965f5b4b05ed2848e2d0 Author: Anton Ivanov Date: Wed Nov 14 18:41:07 2018 +0000 um: Clean-up command processing in UML UBD driver Clean-up command processing and return BLK_STS_NOTSUP for uknown commands. Signed-off-by: Anton Ivanov Signed-off-by: Richard Weinberger arch/um/drivers/ubd_kern.c | 77 ++++++++++++++++++++++++++++------------------ 1 file changed, 47 insertions(+), 30 deletions(-) commit a43c83161a5ec1631a54338dd9b734b3cdce8d9a Author: Anton Ivanov Date: Wed Nov 14 18:41:06 2018 +0000 um: Switch to block-mq constants in the UML UBD driver Switch to block mq-constants for both commands, error codes and various computations. Signed-off-by: Anton Ivanov Signed-off-by: Richard Weinberger arch/um/drivers/ubd_kern.c | 66 ++++++++++++++++++++++++++-------------------- 1 file changed, 38 insertions(+), 28 deletions(-) commit 550ed0e2036663b35cec12374b835444f9c60454 Author: Richard Weinberger Date: Tue Oct 30 12:58:12 2018 +0100 um: Make GCOV depend on !KCOV Both do more or less the same thing and are mutually exclusive. If both are enabled the build will fail. Sooner or later we can kill UML's GCOV. Signed-off-by: Richard Weinberger arch/um/Kconfig.debug | 1 + 1 file changed, 1 insertion(+) commit 0053102a869f1b909904b1b85ac282e2744deaab Author: Richard Weinberger Date: Tue Oct 30 12:58:11 2018 +0100 um: Include sys/uio.h to have writev() sys/uio.h gives us writev(), otherwise the build might fail on some systems. Fixes: 49da7e64f33e ("High Performance UML Vector Network Driver") Signed-off-by: Richard Weinberger arch/um/drivers/vector_user.c | 1 + 1 file changed, 1 insertion(+) commit 0d76433c220391672848f2c0607f86f79d5e1a38 Author: Hernán Gonzalez Date: Tue Oct 30 12:58:10 2018 +0100 um: Add HAVE_DEBUG_BUGVERBOSE This option restores the DEBUG_BUGVERBOSE functionality as it was previous to commit 9a93848fe787 ("x86/debug: Implement __WARN() using UD0"). Signed-off-by: Hernán Gonzalez Signed-off-by: Richard Weinberger arch/um/Kconfig | 1 + 1 file changed, 1 insertion(+) commit dbd0be61fb5a03db59450b42fbb689faece8b0ad Author: Richard Weinberger Date: Thu Nov 1 22:27:01 2018 +0100 um: Update maintainers file entry - Remove stale fs/hppfs/ reference - Point to our patchwork queue Signed-off-by: Richard Weinberger MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e0c38a4d1f196a4b17d2eba36afff8f656a4f1de Merge: 7f9f852c75e7 90cadbbf341d Author: Linus Torvalds Date: Thu Dec 27 13:04:52 2018 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next Pull networking updates from David Miller: 1) New ipset extensions for matching on destination MAC addresses, from Stefano Brivio. 2) Add ipv4 ttl and tos, plus ipv6 flow label and hop limit offloads to nfp driver. From Stefano Brivio. 3) Implement GRO for plain UDP sockets, from Paolo Abeni. 4) Lots of work from Michał Mirosław to eliminate the VLAN_TAG_PRESENT bit so that we could support the entire vlan_tci value. 5) Rework the IPSEC policy lookups to better optimize more usecases, from Florian Westphal. 6) Infrastructure changes eliminating direct manipulation of SKB lists wherever possible, and to always use the appropriate SKB list helpers. This work is still ongoing... 7) Lots of PHY driver and state machine improvements and simplifications, from Heiner Kallweit. 8) Various TSO deferral refinements, from Eric Dumazet. 9) Add ntuple filter support to aquantia driver, from Dmitry Bogdanov. 10) Batch dropping of XDP packets in tuntap, from Jason Wang. 11) Lots of cleanups and improvements to the r8169 driver from Heiner Kallweit, including support for ->xmit_more. This driver has been getting some much needed love since he started working on it. 12) Lots of new forwarding selftests from Petr Machata. 13) Enable VXLAN learning in mlxsw driver, from Ido Schimmel. 14) Packed ring support for virtio, from Tiwei Bie. 15) Add new Aquantia AQtion USB driver, from Dmitry Bezrukov. 16) Add XDP support to dpaa2-eth driver, from Ioana Ciocoi Radulescu. 17) Implement coalescing on TCP backlog queue, from Eric Dumazet. 18) Implement carrier change in tun driver, from Nicolas Dichtel. 19) Support msg_zerocopy in UDP, from Willem de Bruijn. 20) Significantly improve garbage collection of neighbor objects when the table has many PERMANENT entries, from David Ahern. 21) Remove egdev usage from nfp and mlx5, and remove the facility completely from the tree as it no longer has any users. From Oz Shlomo and others. 22) Add a NETDEV_PRE_CHANGEADDR so that drivers can veto the change and therefore abort the operation before the commit phase (which is the NETDEV_CHANGEADDR event). From Petr Machata. 23) Add indirect call wrappers to avoid retpoline overhead, and use them in the GRO code paths. From Paolo Abeni. 24) Add support for netlink FDB get operations, from Roopa Prabhu. 25) Support bloom filter in mlxsw driver, from Nir Dotan. 26) Add SKB extension infrastructure. This consolidates the handling of the auxiliary SKB data used by IPSEC and bridge netfilter, and is designed to support the needs to MPTCP which could be integrated in the future. 27) Lots of XDP TX optimizations in mlx5 from Tariq Toukan. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1845 commits) net: dccp: fix kernel crash on module load drivers/net: appletalk/cops: remove redundant if statement and mask bnx2x: Fix NULL pointer dereference in bnx2x_del_all_vlans() on some hw net/net_namespace: Check the return value of register_pernet_subsys() net/netlink_compat: Fix a missing check of nla_parse_nested ieee802154: lowpan_header_create check must check daddr net/mlx4_core: drop useless LIST_HEAD mlxsw: spectrum: drop useless LIST_HEAD net/mlx5e: drop useless LIST_HEAD iptunnel: Set tun_flags in the iptunnel_metadata_reply from src net/mlx5e: fix semicolon.cocci warnings staging: octeon: fix build failure with XFRM enabled net: Revert recent Spectre-v1 patches. can: af_can: Fix Spectre v1 vulnerability packet: validate address length if non-zero nfc: af_nfc: Fix Spectre v1 vulnerability phonet: af_phonet: Fix Spectre v1 vulnerability net: core: Fix Spectre v1 vulnerability net: minor cleanup in skb_ext_add() net: drop the unused helper skb_ext_get() ... commit 7f9f852c75e7d776b078813586c76a2bc7dca993 Merge: 3f03bf93947f 93d77e7f1410 Author: Linus Torvalds Date: Thu Dec 27 12:08:33 2018 -0800 Merge tag 'modules-for-v4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux Pull modules updates from Jessica Yu: - Some modules-related kallsyms cleanups and a kallsyms fix for ARM. - Include keys from the secondary keyring in module signature verification. * tag 'modules-for-v4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux: ARM: module: Fix function kallsyms on Thumb-2 module: Overwrite st_size instead of st_info module: make it clearer when we're handling kallsyms symbols vs exported symbols modsign: use all trusted keys to verify module signature commit 3f03bf93947fa2a2b84fac56e93c65d4fffed7f1 Merge: fb2a624d5fe8 b49d564344f7 Author: Linus Torvalds Date: Thu Dec 27 12:04:52 2018 -0800 Merge branch 'next-general' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security Pull general security subsystem updates from James Morris: "The main changes here are Paul Gortmaker's removal of unneccesary module.h infrastructure" * 'next-general' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: security: integrity: partial revert of make ima_main explicitly non-modular security: fs: make inode explicitly non-modular security: audit and remove any unnecessary uses of module.h security: integrity: make evm_main explicitly non-modular keys: remove needless modular infrastructure from ecryptfs_format security: integrity: make ima_main explicitly non-modular tomoyo: fix small typo commit fb2a624d5fe8b9206d14bff52da7a368a3a8374c Merge: 047ce6d380e8 ee1a84fdfeed Author: Linus Torvalds Date: Thu Dec 27 12:01:58 2018 -0800 Merge tag 'selinux-pr-20181224' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux patches from Paul Moore: "I already used my best holiday pull request lines in the audit pull request, so this one is going to be a bit more boring, sorry about that. To make up for this, we do have a birthday of sorts to celebrate: SELinux turns 18 years old this December. Perhaps not the most exciting thing in the world for most people, but I think it's safe to say that anyone reading this email doesn't exactly fall into the "most people" category. Back to business and the pull request itself: Ondrej has five patches in this pull request and I lump them into three categories: one patch to always allow submounts (using similar logic to elsewhere in the kernel), one to fix some issues with the SELinux policydb, and the others to cleanup and improve the SELinux sidtab. The other patches from Alexey and Petr and trivial fixes that are adequately described in their respective subject lines. With this last pull request of the year, I want to thank everyone who has contributed patches, testing, and reviews to the SELinux project this year, and the past 18 years. Like any good open source effort, SELinux is only as good as the community which supports it, and I'm very happy that we have the community we do - thank you all!" * tag 'selinux-pr-20181224' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: overhaul sidtab to fix bug and improve performance selinux: use separate table for initial SID lookup selinux: make "selinux_policycap_names[]" const char * selinux: always allow mounting submounts selinux: refactor sidtab conversion Documentation: Update SELinux reference policy URL selinux: policydb - fix byte order and alignment issues commit 047ce6d380e8e66cfb6cbc22e873af89dd0c216c Merge: a3b5c1065f3f d406db524c32 Author: Linus Torvalds Date: Thu Dec 27 11:58:50 2018 -0800 Merge tag 'audit-pr-20181224' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit Pull audit updates from Paul Moore: "In the finest of holiday of traditions, I have a number of gifts to share today. While most of them are re-gifts from others, unlike the typical re-gift, these are things you will want in and around your tree; I promise. This pull request is perhaps a bit larger than our typical PR, but most of it comes from Jan's rework of audit's fanotify code; a very welcome improvement. We ran this through our normal regression tests, as well as some newly created stress tests and everything looks good. Richard added a few patches, mostly cleaning up a few things and and shortening some of the audit records that we send to userspace; a change the userspace folks are quite happy about. Finally YueHaibing and I kick in a few patches to simplify things a bit and make the code less prone to errors. Lastly, I want to say thanks one more time to everyone who has contributed patches, testing, and code reviews for the audit subsystem over the past year. The project is what it is due to your help and contributions - thank you" * tag 'audit-pr-20181224' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: (22 commits) audit: remove duplicated include from audit.c audit: shorten PATH cap values when zero audit: use current whenever possible audit: minimize our use of audit_log_format() audit: remove WATCH and TREE config options audit: use session_info helper audit: localize audit_log_session_info prototype audit: Use 'mark' name for fsnotify_mark variables audit: Replace chunk attached to mark instead of replacing mark audit: Simplify locking around untag_chunk() audit: Drop all unused chunk nodes during deletion audit: Guarantee forward progress of chunk untagging audit: Allocate fsnotify mark independently of chunk audit: Provide helper for dropping mark's chunk reference audit: Remove pointless check in insert_hash() audit: Factor out chunk replacement code audit: Make hash table insertion safe against concurrent lookups audit: Embed key into chunk audit: Fix possible tagging failures audit: Fix possible spurious -ENOSPC error ... commit a3b5c1065f3fb934a87dd07d23def99916023d6f Merge: c6f1b355d451 07c17732bd68 Author: Linus Torvalds Date: Thu Dec 27 11:24:43 2018 -0800 Merge tag 'printk-for-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk Pull printk updates from Petr Mladek: - Keep spinlocks busted until the end of panic() - Fix races between calculating number of messages that would fit into user space buffers, filling the buffers, and switching printk.time parameter - Some code clean up * tag 'printk-for-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk: printk: Remove print_prefix() calls with NULL buffer. printk: fix printk_time race. printk: Make printk_emit() local function. panic: avoid deadlocks in re-entrant console drivers commit c6f1b355d451680a45d63ce66cea67057c938a87 Merge: c06e9ef6918b 189af4657186 Author: Linus Torvalds Date: Thu Dec 27 11:19:07 2018 -0800 Merge tag 'gcc-plugins-v4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull gcc-plugins update from Kees Cook: "Both arm and arm64 are gaining per-task stack canaries (to match x86), but arm is being done with a gcc plugin, hence it going through the gcc-plugins tree. New gcc-plugin: - Enable per-task stack protector for ARM (Ard Biesheuvel)" * tag 'gcc-plugins-v4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: ARM: smp: add support for per-task stack canaries commit c06e9ef6918b1a6d183f1fef78ebc66f054a7b5a Merge: 8d6973327ee8 8665569e97dd Author: Linus Torvalds Date: Thu Dec 27 11:15:21 2018 -0800 Merge tag 'pstore-v4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull pstore updates from Kees Cook: "Improvements and refactorings: - Improve compression handling - Refactor argument handling during initialization - Avoid needless locking for saner EFI backend handling - Add more kern-doc and improve debugging output" * tag 'pstore-v4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: pstore/ram: Avoid NULL deref in ftrace merging failure path pstore: Convert buf_lock to semaphore pstore: Fix bool initialization/comparison pstore/ram: Do not treat empty buffers as valid pstore/ram: Simplify ramoops_get_next_prz() arguments pstore: Map PSTORE_TYPE_* to strings pstore: Replace open-coded << with BIT() pstore: Improve and update some comments and status output pstore/ram: Add kern-doc for struct persistent_ram_zone pstore/ram: Report backend assignments with finer granularity pstore/ram: Standardize module name in ramoops pstore: Avoid duplicate call of persistent_ram_zap() pstore: Remove needless lock during console writes pstore: Do not use crash buffer for decompression commit 8d6973327ee84c2f40dd9efd8928d4a1186c96e2 Merge: 6d101ba6be2a 12526b0d6c58 Author: Linus Torvalds Date: Thu Dec 27 10:43:24 2018 -0800 Merge tag 'powerpc-4.21-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc updates from Michael Ellerman: "Notable changes: - Mitigations for Spectre v2 on some Freescale (NXP) CPUs. - A large series adding support for pass-through of Nvidia V100 GPUs to guests on Power9. - Another large series to enable hardware assistance for TLB table walk on MPC8xx CPUs. - Some preparatory changes to our DMA code, to make way for further cleanups from Christoph. - Several fixes for our Transactional Memory handling discovered by fuzzing the signal return path. - Support for generating our system call table(s) from a text file like other architectures. - A fix to our page fault handler so that instead of generating a WARN_ON_ONCE, user accesses of kernel addresses instead print a ratelimited and appropriately scary warning. - A cosmetic change to make our unhandled page fault messages more similar to other arches and also more compact and informative. - Freescale updates from Scott: "Highlights include elimination of legacy clock bindings use from dts files, an 83xx watchdog handler, fixes to old dts interrupt errors, and some minor cleanup." And many clean-ups, reworks and minor fixes etc. Thanks to: Alexandre Belloni, Alexey Kardashevskiy, Andrew Donnellan, Aneesh Kumar K.V, Arnd Bergmann, Benjamin Herrenschmidt, Breno Leitao, Christian Lamparter, Christophe Leroy, Christoph Hellwig, Daniel Axtens, Darren Stevens, David Gibson, Diana Craciun, Dmitry V. Levin, Firoz Khan, Geert Uytterhoeven, Greg Kurz, Gustavo Romero, Hari Bathini, Joel Stanley, Kees Cook, Madhavan Srinivasan, Mahesh Salgaonkar, Markus Elfring, Mathieu Malaterre, Michal Suchánek, Naveen N. Rao, Nick Desaulniers, Oliver O'Halloran, Paul Mackerras, Ram Pai, Ravi Bangoria, Rob Herring, Russell Currey, Sabyasachi Gupta, Sam Bobroff, Satheesh Rajendran, Scott Wood, Segher Boessenkool, Stephen Rothwell, Tang Yuantian, Thiago Jung Bauermann, Yangtao Li, Yuantian Tang, Yue Haibing" * tag 'powerpc-4.21-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (201 commits) Revert "powerpc/fsl_pci: simplify fsl_pci_dma_set_mask" powerpc/zImage: Also check for stdout-path powerpc: Fix HMIs on big-endian with CONFIG_RELOCATABLE=y macintosh: Use of_node_name_{eq, prefix} for node name comparisons ide: Use of_node_name_eq for node name comparisons powerpc: Use of_node_name_eq for node name comparisons powerpc/pseries/pmem: Convert to %pOFn instead of device_node.name powerpc/mm: Remove very old comment in hash-4k.h powerpc/pseries: Fix node leak in update_lmb_associativity_index() powerpc/configs/85xx: Enable CONFIG_DEBUG_KERNEL powerpc/dts/fsl: Fix dtc-flagged interrupt errors clk: qoriq: add more compatibles strings powerpc/fsl: Use new clockgen binding powerpc/83xx: handle machine check caused by watchdog timer powerpc/fsl-rio: fix spelling mistake "reserverd" -> "reserved" powerpc/fsl_pci: simplify fsl_pci_dma_set_mask arch/powerpc/fsl_rmu: Use dma_zalloc_coherent vfio_pci: Add NVIDIA GV100GL [Tesla V100 SXM2] subdriver vfio_pci: Allow regions to add own capabilities vfio_pci: Allow mapping extra regions ... commit 6d101ba6be2a26a3e1f513b5e293f0fd2b79ec5c Author: Olof Johansson Date: Sun Nov 25 14:41:05 2018 -0800 sched/fair: Fix warning on non-SMP build Caused by making the variable static: kernel/sched/fair.c:119:21: warning: 'capacity_margin' defined but not used [-Wunused-variable] Seems easiest to just move it up under the existing ifdef CONFIG_SMP that's a few lines above. Fixes: ed8885a14433a ('sched/fair: Make some variables static') Signed-off-by: Olof Johansson Signed-off-by: Linus Torvalds kernel/sched/fair.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) commit d025bff1b6b923ce9c2f744d8278e0f2d6609eaf Author: Dengcheng Zhu Date: Wed Dec 26 22:08:52 2018 +0000 mailmap: Update name spelling and email for Dengcheng Zhu Change my first name spelling from Deng-Cheng to Dengcheng. Update email addresses. Signed-off-by: Dengcheng Zhu Signed-off-by: Paul Burton Cc: linux-mips@linux-mips.org .mailmap | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 88cc9fc41c7318565bcf28a843b1e4e3f2acf894 Author: Aisheng Dong Date: Tue Dec 18 15:22:54 2018 +0000 dt-bindings: arm: fsl-scu: add imx8qm pinctrl support Update binding doc to support imx8qm pinctrl. Cc: Rob Herring Cc: Stefan Agner Cc: Shawn Guo Cc: Sascha Hauer Cc: Fabio Estevam Cc: Mark Rutland Cc: devicetree@vger.kernel.org Cc: Pengutronix Kernel Team Signed-off-by: Dong Aisheng Signed-off-by: Linus Walleij .../devicetree/bindings/arm/freescale/fsl,scu.txt | 5 +- include/dt-bindings/pinctrl/pads-imx8qm.h | 960 +++++++++++++++++++++ 2 files changed, 964 insertions(+), 1 deletion(-) commit b09f629ce36d94381f96a03ea1507861d1d5de3b Author: Abel Vesa Date: Sun Dec 23 07:08:31 2018 +0000 pinctrl: freescale: Break dependency on SOC_IMX8MQ for i.MX8MQ The CONFIG_SOC_IMX8MQ will go away, so the dependency can be based on ARCH_MXC && ARM64. Signed-off-by: Abel Vesa Acked-by: Dong Aisheng Reviewed-by: Fabio Estevam Signed-off-by: Linus Walleij drivers/pinctrl/freescale/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit df50fcf5462cec45618bdb6013c84c469b73f3e5 Author: Guido Günther Date: Wed Dec 26 14:54:34 2018 +0100 pinctrl: imx-scu: Depend on IMX_SCU Otherwise building fails with only PINCTRL_IMX_SCU selected: aarch64-linux-gnu-ld: drivers/pinctrl/freescale/pinctrl-scu.o: in function `imx_pinctrl_sc_ipc_init': pinctrl-scu.c:(.text+0x10): undefined reference to `imx_scu_get_handle' aarch64-linux-gnu-ld: pinctrl-scu.c:(.text+0x10): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `imx_scu_get_handle' aarch64-linux-gnu-ld: drivers/pinctrl/freescale/pinctrl-scu.o: in function `imx_pinconf_get_scu': pinctrl-scu.c:(.text+0x64): undefined reference to `imx_scu_call_rpc' aarch64-linux-gnu-ld: pinctrl-scu.c:(.text+0x64): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `imx_scu_call_rpc' aarch64-linux-gnu-ld: drivers/pinctrl/freescale/pinctrl-scu.o: in function `imx_pinconf_set_scu': pinctrl-scu.c:(.text+0x104): undefined reference to `imx_scu_call_rpc' aarch64-linux-gnu-ld: pinctrl-scu.c:(.text+0x104): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `imx_scu_call_rpc' make: *** [Makefile:1038: vmlinux] Error 1 Signed-off-by: Guido Günther Reviewed-by: Fabio Estevam Signed-off-by: Linus Walleij drivers/pinctrl/freescale/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 64beba0558fce7b59e9a8a7afd77290e82a22163 Author: Jaegeuk Kim Date: Wed Dec 26 19:54:07 2018 -0800 f2fs: sanity check of xattr entry size There is a security report where f2fs_getxattr() has a hole to expose wrong memory region when the image is malformed like this. f2fs_getxattr: entry->e_name_len: 4, size: 12288, buffer_size: 16384, len: 4 Cc: Signed-off-by: Jaegeuk Kim fs/f2fs/xattr.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) commit fc2fd5f0f1aa85925be2322275ee2dc5ac3acdf4 Merge: e57d9f638af9 c04e55388a4f Author: Linus Torvalds Date: Wed Dec 26 18:42:51 2018 -0800 Merge branch 'x86-platform-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 platform update from Ingo Molnar: "An OLPC platform support simplification patch" * 'x86-platform-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/platform/olpc: Do not call of_platform_bus_probe() commit e57d9f638af9673f38d9f09de66fa0a28303127d Merge: d6e867a6ae13 6848ac7ca39a Author: Linus Torvalds Date: Wed Dec 26 18:08:18 2018 -0800 Merge branch 'x86-mm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 mm updates from Ingo Molnar: "The main changes in this cycle were: - Update and clean up x86 fault handling, by Andy Lutomirski. - Drop usage of __flush_tlb_all() in kernel_physical_mapping_init() and related fallout, by Dan Williams. - CPA cleanups and reorganization by Peter Zijlstra: simplify the flow and remove a few warts. - Other misc cleanups" * 'x86-mm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (29 commits) x86/mm/dump_pagetables: Use DEFINE_SHOW_ATTRIBUTE() x86/mm/cpa: Rename @addrinarray to @numpages x86/mm/cpa: Better use CLFLUSHOPT x86/mm/cpa: Fold cpa_flush_range() and cpa_flush_array() into a single cpa_flush() function x86/mm/cpa: Make cpa_data::numpages invariant x86/mm/cpa: Optimize cpa_flush_array() TLB invalidation x86/mm/cpa: Simplify the code after making cpa->vaddr invariant x86/mm/cpa: Make cpa_data::vaddr invariant x86/mm/cpa: Add __cpa_addr() helper x86/mm/cpa: Add ARRAY and PAGES_ARRAY selftests x86/mm: Drop usage of __flush_tlb_all() in kernel_physical_mapping_init() x86/mm: Validate kernel_physical_mapping_init() PTE population generic/pgtable: Introduce set_pte_safe() generic/pgtable: Introduce {p4d,pgd}_same() generic/pgtable: Make {pmd, pud}_same() unconditionally available x86/fault: Clean up the page fault oops decoder a bit x86/fault: Decode page fault OOPSes better x86/vsyscall/64: Use X86_PF constants in the simulated #PF error code x86/oops: Show the correct CS value in show_regs() x86/fault: Don't try to recover from an implicit supervisor access ... commit d6e867a6ae13bc02cd01c535764e5b051d26cf28 Merge: db2ab474c4a4 12209993e98c Author: Linus Torvalds Date: Wed Dec 26 17:37:51 2018 -0800 Merge branch 'x86-fpu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fpu updates from Ingo Molnar: "Misc preparatory changes for an upcoming FPU optimization that will delay the loading of FPU registers to return-to-userspace" * 'x86-fpu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/fpu: Don't export __kernel_fpu_{begin,end}() x86/fpu: Update comment for __raw_xsave_addr() x86/fpu: Add might_fault() to user_insn() x86/pkeys: Make init_pkru_value static x86/thread_info: Remove _TIF_ALLWORK_MASK x86/process/32: Remove asm/math_emu.h include x86/fpu: Use unsigned long long shift in xfeature_uncompacted_offset() commit db2ab474c4a434872e1794c2af8b2e561caa756e Merge: 312a46615510 aa02ef099cff Author: Linus Torvalds Date: Wed Dec 26 17:35:41 2018 -0800 Merge branch 'x86-cpu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cpu updates from Ingo Molnar: "Misc changes: - Fix nr_cpus= boot option interaction bug with logical package management - Clean up UMIP detection messages - Add WBNOINVD instruction detection - Remove the unused get_scattered_cpuid_leaf() function" * 'x86-cpu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/topology: Use total_cpus for max logical packages calculation x86/umip: Make the UMIP activated message generic x86/umip: Print UMIP line only once x86/cpufeatures: Add WBNOINVD feature definition x86/cpufeatures: Remove get_scattered_cpuid_leaf() commit 312a466155108329c458049dc76a21ad56106960 Merge: 6e54df001ac9 4b1bacab61aa Author: Linus Torvalds Date: Wed Dec 26 17:03:51 2018 -0800 Merge branch 'x86-cleanups-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cleanups from Ingo Molnar: "Misc cleanups" * 'x86-cleanups-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/kprobes: Remove trampoline_handler() prototype x86/kernel: Fix more -Wmissing-prototypes warnings x86: Fix various typos in comments x86/headers: Fix -Wmissing-prototypes warning x86/process: Avoid unnecessary NULL check in get_wchan() x86/traps: Complete prototype declarations x86/mce: Fix -Wmissing-prototypes warnings x86/gart: Rewrite early_gart_iommu_check() comment commit 6e54df001ac9262e3b78b34b87390fcb54677a0d Merge: 9a126e788af8 e4f752dda0de Author: Linus Torvalds Date: Wed Dec 26 16:57:27 2018 -0800 Merge branch 'x86-build-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 build updates from Ingo Molnar: - Resolve LLVM build bug by removing redundant GNU specific flag - Remove obsolete -funit-at-a-time and -fno-unit-at-a-time use from x86 PowerPC and UM. The UML change was seen and acked by UML maintainer Richard Weinberger. * 'x86-build-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/um/vdso: Drop implicit common-page-size linker flag x86, powerpc: Remove -funit-at-a-time compiler option entirely x86/um: Remove -fno-unit-at-a-time workaround for pre-4.0 GCC commit 9a126e788af8e0754d5d19cd98b3a2bc1711ff46 Merge: 38fabca18fc4 69be4efeb959 Author: Linus Torvalds Date: Wed Dec 26 16:56:00 2018 -0800 Merge branch 'x86-boot-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 boot updates from Ingo Molnar: "Two cleanups" * 'x86-boot-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/boot: Add missing va_end() to die() x86/boot: Simplify the detect_memory*() control flow commit 38fabca18fc4c832ea95e2d14fb1ecde8b7dcc56 Merge: 8465625ab470 29434801e7e9 Author: Linus Torvalds Date: Wed Dec 26 16:25:06 2018 -0800 Merge branch 'x86-asm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 asm updates from Ingo Molnar: "Two changes: - Remove (some) remnants of the vDSO's fake section table mechanism that were left behind when the vDSO build process reverted to using "objdump -S" to strip the userspace image. - Remove hardcoded POPCNT mnemonics now that the minimum binutils version supports the symbolic form" * 'x86-asm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/vdso: Remove a stale/misleading comment from the linker script x86/vdso: Remove obsolete "fake section table" reservation x86: Use POPCNT mnemonics in arch_hweight.h commit 8465625ab4700e3e1db506ed8a541f7796356d63 Merge: 17bf423a1f2d 210ba1201ff9 Author: Linus Torvalds Date: Wed Dec 26 16:12:50 2018 -0800 Merge branch 'x86-amd-nb-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 AMD northbridge updates from Ingo Molnar: "Update DF/SMN access and k10temp for AMD F17h M30h, by Brian Woods: 'Updates the data fabric/system management network code needed to get k10temp working for M30h. Since there are now processors which have multiple roots per DF/SMN interface, there needs to some logic which skips N-1 root complexes per DF/SMN interface. This is because the root complexes per interface are redundant (as far as DF/SMN goes). These changes shouldn't effect past processors and, for F17h M0Xh, the mappings stay the same.' The hwmon changes were seen and acked by hwmon maintainer Guenter Roeck" * 'x86-amd-nb-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: hwmon/k10temp: Add support for AMD family 17h, model 30h CPUs x86/amd_nb: Add PCI device IDs for family 17h, model 30h x86/amd_nb: Add support for newer PCI topologies hwmon/k10temp, x86/amd_nb: Consolidate shared device IDs commit 60aa4d5536ab7fe32433ca1173bd9d6633851f27 Author: Sahitya Tummala Date: Wed Dec 26 11:20:29 2018 +0530 f2fs: fix use-after-free issue when accessing sbi->stat_info iput() on sbi->node_inode can update sbi->stat_info in the below context, if the f2fs_write_checkpoint() has failed with error. f2fs_balance_fs_bg+0x1ac/0x1ec f2fs_write_node_pages+0x4c/0x260 do_writepages+0x80/0xbc __writeback_single_inode+0xdc/0x4ac writeback_single_inode+0x9c/0x144 write_inode_now+0xc4/0xec iput+0x194/0x22c f2fs_put_super+0x11c/0x1e8 generic_shutdown_super+0x70/0xf4 kill_block_super+0x2c/0x5c kill_f2fs_super+0x44/0x50 deactivate_locked_super+0x60/0x8c deactivate_super+0x68/0x74 cleanup_mnt+0x40/0x78 Fix this by moving f2fs_destroy_stats() further below iput() in both f2fs_put_super() and f2fs_fill_super() paths. Signed-off-by: Sahitya Tummala Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/super.c | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-) commit bae0ee7a767ceeea6d8e170da3f228fbc7480331 Author: Chao Yu Date: Tue Dec 25 17:43:42 2018 +0800 f2fs: check PageWriteback flag for ordered case For all ordered cases in f2fs_wait_on_page_writeback(), we need to check PageWriteback status, so let's clean up to relocate the check into f2fs_wait_on_page_writeback(). Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/checkpoint.c | 8 +++----- fs/f2fs/data.c | 9 ++++----- fs/f2fs/dir.c | 8 ++++---- fs/f2fs/f2fs.h | 2 +- fs/f2fs/file.c | 6 +++--- fs/f2fs/gc.c | 10 +++++----- fs/f2fs/inline.c | 16 ++++++++-------- fs/f2fs/inode.c | 4 ++-- fs/f2fs/node.c | 19 ++++++++----------- fs/f2fs/node.h | 2 +- fs/f2fs/recovery.c | 2 +- fs/f2fs/segment.c | 14 ++++++++------ fs/f2fs/xattr.c | 4 ++-- 13 files changed, 50 insertions(+), 54 deletions(-) commit 88960068f25fcc3759455d85460234dcc9d43fef Author: Martin Blumenstingl Date: Sat Dec 22 11:22:26 2018 +0100 f2fs: fix validation of the block count in sanity_check_raw_super Treat "block_count" from struct f2fs_super_block as 64-bit little endian value in sanity_check_raw_super() because struct f2fs_super_block declares "block_count" as "__le64". This fixes a bug where the superblock validation fails on big endian devices with the following error: F2FS-fs (sda1): Wrong segment_count / block_count (61439 > 0) F2FS-fs (sda1): Can't find valid F2FS filesystem in 1th superblock F2FS-fs (sda1): Wrong segment_count / block_count (61439 > 0) F2FS-fs (sda1): Can't find valid F2FS filesystem in 2th superblock As result of this the partition cannot be mounted. With this patch applied the superblock validation works fine and the partition can be mounted again: F2FS-fs (sda1): Mounted with checkpoint version = 7c84 My little endian x86-64 hardware was able to mount the partition without this fix. To confirm that mounting f2fs filesystems works on big endian machines again I tested this on a 32-bit MIPS big endian (lantiq) device. Fixes: 0cfe75c5b01199 ("f2fs: enhance sanity_check_raw_super() to avoid potential overflows") Cc: stable@vger.kernel.org Signed-off-by: Martin Blumenstingl Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/super.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 8f31b4665c14fe19593601a250275e58c7ad0ef1 Author: Jaegeuk Kim Date: Mon Dec 17 17:08:26 2018 -0800 f2fs: fix missing unlock(sbi->gc_mutex) This fixes missing unlock call. Cc: Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/super.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) commit b32e019049e959ee10ec359893c9dd5d057dad55 Author: Chao Yu Date: Tue Dec 18 19:20:17 2018 +0800 f2fs: fix to dirty inode synchronously If user change inode's i_flags via ioctl, let's add it into global dirty list, so that checkpoint can guarantee its persistence before fsync, it can make checkpoint keeping strong consistency. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c0362117c3b87322366865e8db000449e5ec2caf Author: Chao Yu Date: Tue Dec 18 19:20:16 2018 +0800 f2fs: clean up structure extent_node The union in struct extent_node wass only to indicate below fields struct rb_node rb_node; union { struct { unsigned int fofs; unsigned int len; ... ... can be parsed as fields in struct rb_entry, but they were never be used explicitly before, so let's remove them for cleanup. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/f2fs.h | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) commit 9249dded7b5cb539a8c8698b25d08a3c15261470 Author: Qiuyang Sun Date: Tue Dec 18 17:32:23 2018 +0800 f2fs: fix block address for __check_sit_bitmap Should use lstart (logical start address) instead of start (in dev) here. This fixes a bug in multi-device scenarios. Signed-off-by: Qiuyang Sun Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/segment.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e4589fa545e0020dbbc3c9bde35f35f949901392 Author: Sahitya Tummala Date: Tue Dec 18 16:39:24 2018 +0530 f2fs: fix sbi->extent_list corruption issue When there is a failure in f2fs_fill_super() after/during the recovery of fsync'd nodes, it frees the current sbi and retries again. This time the mount is successful, but the files that got recovered before retry, still holds the extent tree, whose extent nodes list is corrupted since sbi and sbi->extent_list is freed up. The list_del corruption issue is observed when the file system is getting unmounted and when those recoverd files extent node is being freed up in the below context. list_del corruption. prev->next should be fffffff1e1ef5480, but was (null) <...> kernel BUG at kernel/msm-4.14/lib/list_debug.c:53! lr : __list_del_entry_valid+0x94/0xb4 pc : __list_del_entry_valid+0x94/0xb4 <...> Call trace: __list_del_entry_valid+0x94/0xb4 __release_extent_node+0xb0/0x114 __free_extent_tree+0x58/0x7c f2fs_shrink_extent_tree+0xdc/0x3b0 f2fs_leave_shrinker+0x28/0x7c f2fs_put_super+0xfc/0x1e0 generic_shutdown_super+0x70/0xf4 kill_block_super+0x2c/0x5c kill_f2fs_super+0x44/0x50 deactivate_locked_super+0x60/0x8c deactivate_super+0x68/0x74 cleanup_mnt+0x40/0x78 __cleanup_mnt+0x1c/0x28 task_work_run+0x48/0xd0 do_notify_resume+0x678/0xe98 work_pending+0x8/0x14 Fix this by not creating extents for those recovered files if shrinker is not registered yet. Once mount is successful and shrinker is registered, those files can have extents again. Signed-off-by: Sahitya Tummala Signed-off-by: Jaegeuk Kim fs/f2fs/f2fs.h | 11 ++++++++++- fs/f2fs/shrinker.c | 2 +- 2 files changed, 11 insertions(+), 2 deletions(-) commit 8ec18bff7b90b56eba5986555c174721ebd5670b Author: Chao Yu Date: Wed Dec 12 18:12:32 2018 +0800 f2fs: clean up checkpoint flow This patch cleans up checkpoint flow a bit: - remove unneeded circulation of flushing meta pages. - don't flush nat_bits pages in prior to other checkpoint pages. - add bug_on to check remained meta pages after flushing. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/checkpoint.c | 18 +++++------------- 1 file changed, 5 insertions(+), 13 deletions(-) commit 76c7bfb3a89371aa87bda99c8ee2611ff5150434 Author: Jaegeuk Kim Date: Thu Dec 13 20:50:51 2018 -0800 f2fs: flush stale issued discard candidates Sometimes, I could observe # of issuing_discard to be 1 which blocks background jobs due to is_idle()=false. The only way to get out of it was to trigger gc_urgent. This patch avoids that by checking any candidates as done in the list. Signed-off-by: Jaegeuk Kim fs/f2fs/segment.c | 4 ++++ 1 file changed, 4 insertions(+) commit 72691af6dbd719349c559117652a70bfd4309ad2 Author: Jaegeuk Kim Date: Thu Dec 13 16:53:57 2018 -0800 f2fs: correct wrong spelling, issing_* Let's use "queued" instead of "issuing". Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/debug.c | 4 ++-- fs/f2fs/f2fs.h | 10 +++++----- fs/f2fs/segment.c | 26 +++++++++++++------------- 3 files changed, 20 insertions(+), 20 deletions(-) commit 5222595d093ebe80329d38d255d14316257afb3e Author: Jaegeuk Kim Date: Thu Dec 13 18:38:33 2018 -0800 f2fs: use kvmalloc, if kmalloc is failed One report says memalloc failure during mount. (unwind_backtrace) from [] (show_stack+0x10/0x14) (show_stack) from [] (dump_stack+0x8c/0xa0) (dump_stack) from [] (warn_alloc+0xc4/0x160) (warn_alloc) from [] (__alloc_pages_nodemask+0x3f4/0x10d0) (__alloc_pages_nodemask) from [] (kmalloc_order_trace+0x2c/0x120) (kmalloc_order_trace) from [] (build_node_manager+0x35c/0x688) (build_node_manager) from [] (f2fs_fill_super+0xf0c/0x16cc) (f2fs_fill_super) from [] (mount_bdev+0x15c/0x188) (mount_bdev) from [] (f2fs_mount+0x18/0x20) (f2fs_mount) from [] (mount_fs+0x158/0x19c) (mount_fs) from [] (vfs_kern_mount+0x78/0x134) (vfs_kern_mount) from [] (do_mount+0x474/0xca4) (do_mount) from [] (SyS_mount+0x94/0xbc) (SyS_mount) from [] (ret_fast_syscall+0x0/0x48) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/acl.c | 6 ++--- fs/f2fs/checkpoint.c | 2 +- fs/f2fs/data.c | 2 +- fs/f2fs/debug.c | 2 +- fs/f2fs/f2fs.h | 10 ++++++-- fs/f2fs/gc.c | 4 ++-- fs/f2fs/inline.c | 4 ++-- fs/f2fs/namei.c | 2 +- fs/f2fs/node.c | 10 ++++---- fs/f2fs/segment.c | 36 ++++++++++++++-------------- fs/f2fs/super.c | 68 ++++++++++++++++++++++++++-------------------------- 11 files changed, 76 insertions(+), 70 deletions(-) commit af56b4870865654dc9aca2c757b95dfe3e715603 Author: Yunlong Song Date: Thu Dec 13 17:43:11 2018 +0800 f2fs: remove redundant comment of unused wio_mutex Commit 089842de ("f2fs: remove codes of unused wio_mutex") removes codes of unused wio_mutex, but missing the comment, so delete it. Signed-off-by: Yunlong Song Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/f2fs.h | 1 - 1 file changed, 1 deletion(-) commit 17bf423a1f2d134187191f0ceb4b395173cc98a7 Merge: 116b081c285d 732cd75b8c92 Author: Linus Torvalds Date: Wed Dec 26 14:56:10 2018 -0800 Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler updates from Ingo Molnar: "The main changes in this cycle were: - Introduce "Energy Aware Scheduling" - by Quentin Perret. This is a coherent topology description of CPUs in cooperation with the PM subsystem, with the goal to schedule more energy-efficiently on asymetric SMP platform - such as waking up tasks to the more energy-efficient CPUs first, as long as the system isn't oversubscribed. For details of the design, see: https://lore.kernel.org/lkml/20180724122521.22109-1-quentin.perret@arm.com/ - Misc cleanups and smaller enhancements" * 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (23 commits) sched/fair: Select an energy-efficient CPU on task wake-up sched/fair: Introduce an energy estimation helper function sched/fair: Add over-utilization/tipping point indicator sched/fair: Clean-up update_sg_lb_stats parameters sched/toplogy: Introduce the 'sched_energy_present' static key sched/topology: Make Energy Aware Scheduling depend on schedutil sched/topology: Disable EAS on inappropriate platforms sched/topology: Add lowest CPU asymmetry sched_domain level pointer sched/topology: Reference the Energy Model of CPUs when available PM: Introduce an Energy Model management framework sched/cpufreq: Prepare schedutil for Energy Aware Scheduling sched/topology: Relocate arch_scale_cpu_capacity() to the internal header sched/core: Remove unnecessary unlikely() in push_*_task() sched/topology: Remove the ::smt_gain field from 'struct sched_domain' sched: Fix various typos in comments sched/core: Clean up the #ifdef block in add_nr_running() sched/fair: Make some variables static sched/core: Create task_has_idle_policy() helper sched/fair: Add lsub_positive() and use it consistently sched/fair: Mask UTIL_AVG_UNCHANGED usages ... commit 116b081c285d89dc6ece72eeecc6aa3979e8b54e Merge: 1eefdec18ede 883f4def8b77 Author: Linus Torvalds Date: Wed Dec 26 14:45:18 2018 -0800 Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf updates from Ingo Molnar: "The main changes in this cycle on the kernel side: - rework kprobes blacklist handling (Masami Hiramatsu) - misc cleanups on the tooling side these areas were the main focus: - 'perf trace' enhancements (Arnaldo Carvalho de Melo) - 'perf bench' enhancements (Davidlohr Bueso) - 'perf record' enhancements (Alexey Budankov) - 'perf annotate' enhancements (Jin Yao) - 'perf top' enhancements (Jiri Olsa) - Intel hw tracing enhancements (Adrian Hunter) - ARM hw tracing enhancements (Leo Yan, Mathieu Poirier) - ... plus lots of other enhancements, cleanups and fixes" * 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (171 commits) tools uapi asm: Update asm-generic/unistd.h copy perf symbols: Relax checks on perf-PID.map ownership perf trace: Wire up the fadvise 'advice' table generator perf beauty: Add generator for fadvise64's 'advice' arg constants tools headers uapi: Grab a copy of fadvise.h perf beauty mmap: Print mmap's 'offset' arg in hexadecimal perf beauty mmap: Print PROT_READ before PROT_EXEC to match strace output perf trace beauty: Beautify arch_prctl()'s arguments perf trace: When showing string prefixes show prefix + ??? for unknown entries perf trace: Move strarrays to beauty.h for further reuse perf beauty: Wire up the x86_arch prctl code table generator perf beauty: Add a string table generator for x86's 'arch_prctl' codes tools include arch: Grab a copy of x86's prctl.h perf trace: Show NULL when syscall pointer args are 0 perf trace: Enclose the errno strings with () perf augmented_raw_syscalls: Copy 'access' arg as well perf trace: Add alignment spaces after the closing parens perf trace beauty: Print O_RDONLY when (flags & O_ACCMODE) == 0 perf trace: Allow asking for not suppressing common string prefixes perf trace: Add a prefix member to the strarray class ... commit 1eefdec18eded41833401cfd64749643ff72e7da Merge: 684019dd1f00 80eb86576870 Author: Linus Torvalds Date: Wed Dec 26 14:25:52 2018 -0800 Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking updates from Ingo Molnar: "The main change in this cycle are initial preparatory bits of dynamic lockdep keys support from Bart Van Assche. There are also misc changes, a comment cleanup and a data structure cleanup" * 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/fair: Clean up comment in nohz_idle_balance() locking/lockdep: Stop using RCU primitives to access 'all_lock_classes' locking/lockdep: Make concurrent lockdep_reset_lock() calls safe locking/lockdep: Remove a superfluous INIT_LIST_HEAD() statement locking/lockdep: Introduce lock_class_cache_is_registered() locking/lockdep: Inline __lockdep_init_map() locking/lockdep: Declare local symbols static tools/lib/lockdep/tests: Test the lockdep_reset_lock() implementation tools/lib/lockdep: Add dummy print_irqtrace_events() implementation tools/lib/lockdep: Rename "trywlock" into "trywrlock" tools/lib/lockdep/tests: Run lockdep tests a second time under Valgrind tools/lib/lockdep/tests: Improve testing accuracy tools/lib/lockdep/tests: Fix shellcheck warnings tools/lib/lockdep/tests: Display compiler warning and error messages locking/lockdep: Remove ::version from lock_class structure commit 684019dd1f0092b4ffce4958c84aff0891deac83 Merge: 792bf4d871de 1debf0958fa2 Author: Linus Torvalds Date: Wed Dec 26 13:38:38 2018 -0800 Merge branch 'efi-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull EFI updates from Ingo Molnar: "The main changes in this cycle were: - Allocate the E820 buffer before doing the GetMemoryMap/ExitBootServices dance so we don't run out of space - Clear EFI boot services mappings when freeing the memory - Harden efivars against callers that invoke it on non-EFI boots - Reduce the number of memblock reservations resulting from extensive use of the new efi_mem_reserve_persistent() API - Other assorted fixes and cleanups" * 'efi-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/efi: Don't unmap EFI boot services code/data regions for EFI_OLD_MEMMAP and EFI_MIXED_MODE efi: Reduce the amount of memblock reservations for persistent allocations efi: Permit multiple entries in persistent memreserve data structure efi/libstub: Disable some warnings for x86{,_64} x86/efi: Move efi__boot_services() to arch/x86 x86/efi: Unmap EFI boot services code/data regions from efi_pgd x86/mm/pageattr: Introduce helper function to unmap EFI boot services efi/fdt: Simplify the get_fdt() flow efi/fdt: Indentation fix firmware/efi: Add NULL pointer checks in efivars API functions commit 792bf4d871dea8b69be2aaabdd320d7c6ed15985 Merge: eed9688f8513 4bbfd7467cfc Author: Linus Torvalds Date: Wed Dec 26 13:07:19 2018 -0800 Merge branch 'core-rcu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull RCU updates from Ingo Molnar: "The biggest RCU changes in this cycle were: - Convert RCU's BUG_ON() and similar calls to WARN_ON() and similar. - Replace calls of RCU-bh and RCU-sched update-side functions to their vanilla RCU counterparts. This series is a step towards complete removal of the RCU-bh and RCU-sched update-side functions. ( Note that some of these conversions are going upstream via their respective maintainers. ) - Documentation updates, including a number of flavor-consolidation updates from Joel Fernandes. - Miscellaneous fixes. - Automate generation of the initrd filesystem used for rcutorture testing. - Convert spin_is_locked() assertions to instead use lockdep. ( Note that some of these conversions are going upstream via their respective maintainers. ) - SRCU updates, especially including a fix from Dennis Krein for a bag-on-head-class bug. - RCU torture-test updates" * 'core-rcu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (112 commits) rcutorture: Don't do busted forward-progress testing rcutorture: Use 100ms buckets for forward-progress callback histograms rcutorture: Recover from OOM during forward-progress tests rcutorture: Print forward-progress test age upon failure rcutorture: Print time since GP end upon forward-progress failure rcutorture: Print histogram of CB invocation at OOM time rcutorture: Print GP age upon forward-progress failure rcu: Print per-CPU callback counts for forward-progress failures rcu: Account for nocb-CPU callback counts in RCU CPU stall warnings rcutorture: Dump grace-period diagnostics upon forward-progress OOM rcutorture: Prepare for asynchronous access to rcu_fwd_startat torture: Remove unnecessary "ret" variables rcutorture: Affinity forward-progress test to avoid housekeeping CPUs rcutorture: Break up too-long rcu_torture_fwd_prog() function rcutorture: Remove cbflood facility torture: Bring any extra CPUs online during kernel startup rcutorture: Add call_rcu() flooding forward-progress tests rcutorture/formal: Replace synchronize_sched() with synchronize_rcu() tools/kernel.h: Replace synchronize_sched() with synchronize_rcu() net/decnet: Replace rcu_barrier_bh() with rcu_barrier() ... commit eed9688f8513189295887e5a27ec7f576754b60e Merge: 72af84151fa7 72a8f089c382 Author: Linus Torvalds Date: Wed Dec 26 13:03:47 2018 -0800 Merge branch 'ras-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 RAS updates from Borislav Petkov: "This time around we have a subsystem reorganization to offer, with the new directory being arch/x86/kernel/cpu/mce/ and all compilation units' names streamlined under it" * 'ras-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mce: Restore MCE injector's module name x86/mce: Unify pr_* prefix x86/mce: Streamline MCE subsystem's naming commit 72af84151fa7e98720a0482b59de2d90ec7f10a7 Merge: a52fb43a5faa 2ffcbce39ea1 Author: Linus Torvalds Date: Wed Dec 26 12:55:57 2018 -0800 Merge branch 'x86-microcode-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 microcode loading updates from Borislav Petkov: "This update contains work started by Maciej to make the microcode container verification more robust against all kinds of corruption and also unify verification paths between early and late loading. The result is a set of verification routines which validate the microcode blobs before loading it on the CPU. In addition, the code is a lot more streamlined and unified. In the process, some of the aspects of patch handling and loading were simplified. All provided by Maciej S. Szmigiero and Borislav Petkov" * 'x86-microcode-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/microcode/AMD: Update copyright x86/microcode/AMD: Check the equivalence table size when scanning it x86/microcode/AMD: Convert CPU equivalence table variable into a struct x86/microcode/AMD: Check microcode container data in the late loader x86/microcode/AMD: Fix container size's type x86/microcode/AMD: Convert early parser to the new verification routines x86/microcode/AMD: Change verify_patch()'s return value x86/microcode/AMD: Move chipset-specific check into verify_patch() x86/microcode/AMD: Move patch family check to verify_patch() x86/microcode/AMD: Simplify patch family detection x86/microcode/AMD: Concentrate patch verification x86/microcode/AMD: Cleanup verify_patch_size() more x86/microcode/AMD: Clean up per-family patch size checks x86/microcode/AMD: Move verify_patch_size() up in the file x86/microcode/AMD: Add microcode container verification x86/microcode/AMD: Subtract SECTION_HDR_SIZE from file leftover length commit a52fb43a5faa40507cb164a793a7fa08da863ac7 Merge: 42b00f122cfb 52eb74339a62 Author: Linus Torvalds Date: Wed Dec 26 12:17:43 2018 -0800 Merge branch 'x86-cache-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cache control updates from Borislav Petkov: - The generalization of the RDT code to accommodate the addition of AMD's very similar implementation of the cache monitoring feature. This entails a subsystem move into a separate and generic arch/x86/kernel/cpu/resctrl/ directory along with adding vendor-specific initialization and feature detection helpers. Ontop of that is the unification of user-visible strings, both in the resctrl filesystem error handling and Kconfig. Provided by Babu Moger and Sherry Hurwitz. - Code simplifications and error handling improvements by Reinette Chatre. * 'x86-cache-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/resctrl: Fix rdt_find_domain() return value and checks x86/resctrl: Remove unnecessary check for cbm_validate() x86/resctrl: Use rdt_last_cmd_puts() where possible MAINTAINERS: Update resctrl filename patterns Documentation: Rename and update intel_rdt_ui.txt to resctrl_ui.txt x86/resctrl: Introduce AMD QOS feature x86/resctrl: Fixup the user-visible strings x86/resctrl: Add AMD's X86_FEATURE_MBA to the scattered CPUID features x86/resctrl: Rename the config option INTEL_RDT to RESCTRL x86/resctrl: Add vendor check for the MBA software controller x86/resctrl: Bring cbm_validate() into the resource structure x86/resctrl: Initialize the vendor-specific resource functions x86/resctrl: Move all the macros to resctrl/internal.h x86/resctrl: Re-arrange the RDT init code x86/resctrl: Rename the RDT functions and definitions x86/resctrl: Rename and move rdt files to a separate directory commit 42b00f122cfbfed79fc29b0b3610f3abbb1e3864 Merge: 460023a5d1d2 a0aea130afeb Author: Linus Torvalds Date: Wed Dec 26 11:46:28 2018 -0800 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM updates from Paolo Bonzini: "ARM: - selftests improvements - large PUD support for HugeTLB - single-stepping fixes - improved tracing - various timer and vGIC fixes x86: - Processor Tracing virtualization - STIBP support - some correctness fixes - refactorings and splitting of vmx.c - use the Hyper-V range TLB flush hypercall - reduce order of vcpu struct - WBNOINVD support - do not use -ftrace for __noclone functions - nested guest support for PAUSE filtering on AMD - more Hyper-V enlightenments (direct mode for synthetic timers) PPC: - nested VFIO s390: - bugfixes only this time" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (171 commits) KVM: x86: Add CPUID support for new instruction WBNOINVD kvm: selftests: ucall: fix exit mmio address guessing Revert "compiler-gcc: disable -ftracer for __noclone functions" KVM: VMX: Move VM-Enter + VM-Exit handling to non-inline sub-routines KVM: VMX: Explicitly reference RCX as the vmx_vcpu pointer in asm blobs KVM: x86: Use jmp to invoke kvm_spurious_fault() from .fixup MAINTAINERS: Add arch/x86/kvm sub-directories to existing KVM/x86 entry KVM/x86: Use SVM assembly instruction mnemonics instead of .byte streams KVM/MMU: Flush tlb directly in the kvm_zap_gfn_range() KVM/MMU: Flush tlb directly in kvm_set_pte_rmapp() KVM/MMU: Move tlb flush in kvm_set_pte_rmapp() to kvm_mmu_notifier_change_pte() KVM: Make kvm_set_spte_hva() return int KVM: Replace old tlb flush function with new one to flush a specified range. KVM/MMU: Add tlb flush with range helper function KVM/VMX: Add hv tlb range flush support x86/hyper-v: Add HvFlushGuestAddressList hypercall support KVM: Add tlb_remote_flush_with_range callback in kvm_x86_ops KVM: x86: Disable Intel PT when VMXON in L1 guest KVM: x86: Set intercept for Intel PT MSRs read/write KVM: x86: Implement Intel PT MSRs read/write emulation ... commit 460023a5d1d2aa0f733b6708b2fae5ea9f9dfec0 Merge: a5f2bd479f58 58f9d806d16a Author: Linus Torvalds Date: Wed Dec 26 11:35:07 2018 -0800 Merge tag 'for-linus-4.21-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen updates from Juergen Gross: "Xen features and fixes: - a series to enable KVM guests to be booted by qemu via the Xen PVH boot entry for speeding up KVM guest tests - a series for a common driver to be used by Xen PV frontends (right now drm and sound) - two other fixes in Xen related code" * tag 'for-linus-4.21-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: ALSA: xen-front: Use Xen common shared buffer implementation drm/xen-front: Use Xen common shared buffer implementation xen: Introduce shared buffer helpers for page directory... xen/pciback: Check dev_data before using it kprobes/x86/xen: blacklist non-attachable xen interrupt functions KVM: x86: Allow Qemu/KVM to use PVH entry point xen/pvh: Add memory map pointer to hvm_start_info struct xen/pvh: Move Xen code for getting mem map via hcall out of common file xen/pvh: Move Xen specific PVH VM initialization out of common file xen/pvh: Create a new file for Xen specific PVH code xen/pvh: Move PVH entry code out of Xen specific tree xen/pvh: Split CONFIG_XEN_PVH into CONFIG_PVH and CONFIG_XEN_PVH commit a5f2bd479f58f171a16a9a4f3b4e748ab3057c0f Merge: 89261c570213 930e12992ed3 Author: Linus Torvalds Date: Wed Dec 26 11:14:52 2018 -0800 Merge branch 'parisc-4.21-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc updates from Helge Deller: "The major change in this patchset is the new system call table generation support from Firoz Khan" * 'parisc-4.21-1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: syscalls: ignore nfsservctl for other architectures parisc: generate uapi header and system call table files parisc: add system call table generation support parisc: remove __NR_Linux from uapi header file. parisc: add __NR_syscalls along with __NR_Linux_syscalls parisc: move __IGNORE* entries to non uapi header parisc: Fix HP SDC hpa address output parisc: Fix serio address output parisc: Split out alternative live patching code commit 89261c57021352045c4af24522c6854c9ee90139 Merge: c2f1f3e0e17d adcc81f148d7 Author: Linus Torvalds Date: Wed Dec 26 10:45:33 2018 -0800 Merge tag 'mips_4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS updates from Paul Burton: "Here's the main MIPS pull for Linux 4.21. Core architecture changes include: - Syscall tables & definitions for unistd.h are now generated by scripts, providing greater consistency with other architectures & making it easier to add new syscalls. - Support for building kernels with no floating point support, upon which any userland attempting to use floating point instructions will receive a SIGILL. Mostly useful to shrink the kernel & as preparation for nanoMIPS support which does not yet include FP. - MIPS SIMD Architecture (MSA) vector register context is now exposed by ptrace via a new NT_MIPS_MSA regset. - ASIDs are now stored as 64b values even for MIPS32 kernels, expanding the ASID version field sufficiently that we don't need to worry about overflow & avoiding rare issues with reused ASIDs that have been observed in the wild. - The branch delay slot "emulation" page is now mapped without write permission for the user, preventing its use as a nice location for attacks to execute malicious code from. - Support for ioremap_prot(), primarily to allow gdb or other ptrace users the ability to view their tracee's memory using the same cache coherency attribute. - Optimizations to more cpu_has_* macros, allowing more to be compile-time constant where possible. - Enable building the whole kernel with UBSAN instrumentation. - Enable building the kernel with link-time dead code & data elimination. Platform specific changes include: - The Boston board gains a workaround for DMA prefetching issues with the EG20T Platform Controller Hub that it uses. - Cleanups to Cavium Octeon code removing about 20k lines of redundant code, mostly unused or duplicate register definitions in headers. - defconfig updates for the DECstation machines, including new defconfigs for r4k & 64b machines. - Further work on Loongson 3 support. - DMA fixes for SiByte machines" * tag 'mips_4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (95 commits) MIPS: math-emu: Write-protect delay slot emulation pages MIPS: Remove struct mm_context_t fp_mode_switching field mips: generate uapi header and system call table files mips: add system call table generation support mips: remove syscall table entries mips: add +1 to __NR_syscalls in uapi header mips: rename scall64-64.S to scall64-n64.S mips: remove unused macros mips: add __NR_syscalls along with __NR_Linux_syscalls MIPS: Expand MIPS32 ASIDs to 64 bits MIPS: OCTEON: delete redundant register definitions MIPS: OCTEON: cvmx_gmxx_inf_mode: use oldest forward compatible definition MIPS: OCTEON: cvmx_mio_fus_dat3: use oldest forward compatible definition MIPS: OCTEON: cvmx_pko_mem_debug8: use oldest forward compatible definition MIPS: OCTEON: octeon-usb: use common gpio_bit definition MIPS: OCTEON: enable all OCTEON drivers in defconfig mips: annotate implicit fall throughs MIPS: Hardcode cpu_has_mips* where target ISA allows MIPS: MT: Remove norps command line parameter MIPS: Only include mmzone.h when CONFIG_NEED_MULTIPLE_NODES=y ... commit c2f1f3e0e17d94ab0c66d83e669492cb9e9a3698 Merge: 9830afca9273 c23b8e7acea3 Author: Linus Torvalds Date: Wed Dec 26 10:32:18 2018 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-next Pull sparc updates from David Miller: - Automatic system call table generation, from Firoz Khan. - Clean up accesses to the OF device names by using full_name instead of path_component_name. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-next: ALSA: sparc: Use of_node_name_eq for node name comparisons sbus: Use of_node_name_eq for node name comparisons sparc: generate uapi header and system call table files sparc: add system call table generation support sparc: add __NR_syscalls along with NR_syscalls sparc: move __IGNORE* entries to non uapi header sparc: Use DT node full_name instead of name for resources sparc: Remove unused leon_trans_init sparc: Use device_type helpers to access the node type sparc: Use of_node_name_eq for node name comparisons sparc: Convert to using %pOFn instead of device_node.name sparc: prom: use property "name" directly to construct node names of: Drop full path from full_name for PDT systems sparc: Convert to using %pOF instead of full_name fs/openpromfs: Use of_node_name_eq for node name comparisons fs/openpromfs: use full_name instead of path_component_name commit 9830afca9273787f32e236ae5d0e4d3a378ae842 Merge: 30807ef2b76e 9b9afe4a0ef1 Author: Linus Torvalds Date: Wed Dec 26 10:29:47 2018 -0800 Merge tag 'riscv-for-linus-4.21-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/palmer/riscv-linux Pull RISC-V updates from Palmer Dabbelt: "We don't have many patches for this merge window, probably because everything has been a bit busy with the holidays and conferences. The only big user-visible change is to move over to an SBI-based earlycon instead of our arch-specific early printk support. The only outstanding patch set I know of is the audit patch set, which I've managed to make a mess of and will attempt to clean up" * tag 'riscv-for-linus-4.21-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/palmer/riscv-linux: RISC-V: Select GENERIC_SCHED_CLOCK for clocksource drivers RISC-V: lib: minor asm cleanup RISC-V: Update Kconfig to better handle CMDLINE riscv: remove unused variable in ftrace RISC-V: add of_node_put() RISC-V: Fix of_node_* refcount riscv, atomic: Add #define's for the atomic_{cmp,}xchg_*() variants RISC-V: Remove EARLY_PRINTK support RISC-V: defconfig: Enable RISC-V SBI earlycon support commit 30807ef2b76e01ea209fcad66a87e534ed1edb40 Merge: 507413a5f88a 19d111ccce9f Author: Linus Torvalds Date: Wed Dec 26 10:28:09 2018 -0800 Merge tag 'microblaze-v5.0-rc1' of git://git.monstr.eu/linux-2.6-microblaze Pull arch/microblaze updates from Michal Simek: - Fix multiple Kbuild/Makefile issues - Start to use system call table generation * tag 'microblaze-v5.0-rc1' of git://git.monstr.eu/linux-2.6-microblaze: microblaze: remove the explicit removal of system.dtb microblaze: fix race condition in building boot images microblaze: add linux.bin* and simpleImage.* to PHONY microblaze: fix multiple bugs in arch/microblaze/boot/Makefile microblaze: move "... is ready" messages to arch/microblaze/Makefile microblaze: adjust the help to the real behavior microblaze: generate uapi header and system call table files microblaze: add system call table generation support microblaze: move __NR_syscalls macro from asm/unistd.h microblaze: Typo s/use use/use/ commit 507413a5f88a2240b2c19cb4318166614e2349d9 Merge: 9947ab7bc3f5 2b3c5a99d5f3 Author: Linus Torvalds Date: Wed Dec 26 10:23:12 2018 -0800 Merge tag 'asm-generic-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic Pull arch/sh syscall table scripting from Arnd Bergmann: "I worked with Firoz Khan to change all architectures to have their system call tables (syscall.S and asm/unistd.h) generated by a script from a more readable input file the same way that we already had on x86, s390 and arm. I offered to take those conversions through the asm-generic tree that did not get picked up by the architecture maintainers, and fortunately all but one have now been accepted into arch maintainer trees, so this branch only contains the conversion for arch/sh/, with permission from Rich. The conversion does not include the old 64-bit sh5 architecture, which has never shipped and not even compiled in a long time. The table in include/uapi/asm/unistd.h is also not included here, as Firoz is still working on that one, it will have to wait for the next following merge window, hopefully together with the addition of the 64-bit time_t system calls for the y2038 work that led to the system call table rework" * tag 'asm-generic-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic: sh: generate uapi header and syscall table header files sh: add system call table generation support sh: add __NR_syscalls along with NR_syscalls commit 9947ab7bc3f5facb4e62c72d9db448f7ad52bc28 Merge: e0783bb42448 c51836246f97 Author: Linus Torvalds Date: Wed Dec 26 10:21:11 2018 -0800 Merge tag 'please-pull-y2038prep' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux Pull ia64 updates from Tony Luck: "Change ia64 to make it easier to update system call tables (in line with some other architectures). This is in preparation for y2038 changes which are forecasted to add several new system calls" * tag 'please-pull-y2038prep' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux: ia64: generate uapi header and system call table files ia64: add system call table generation support ia64: add an offset for system call number ia64: add __NR_syscalls along with NR_syscalls ia64: add __NR_old_getpagesize in uapi header file commit e0783bb42448a4f2a6bd405c890010a3950feada Merge: 5694cecdb092 005e13a96c0e Author: Linus Torvalds Date: Wed Dec 26 10:16:55 2018 -0800 Merge tag 'm68k-for-v4.21-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k updates from Geert Uytterhoeven: - Generate syscall headers - Small improvements and cleanups - defconfig updates * tag 'm68k-for-v4.21-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k: Generate uapi header and syscall table header files m68k: Add system call table generation support m68k: Add __NR_syscalls along with NR_syscalls m68k/defconfig: Update defconfigs for v4.20-rc1 m68k: Remove redundant 'default n' from Kconfig m68k: Unroll raw_outsb() loop commit 5ccedf1ccd710ba32f36986b49eeb764e53e7ef1 Author: Yan, Zheng Date: Thu Dec 13 16:34:11 2018 +0800 ceph: don't encode inode pathes into reconnect message mds hasn't used inode pathes since introducing inode backtrace. Signed-off-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov fs/ceph/mds_client.c | 94 +++++++++++++++++++++++++++------------------------- 1 file changed, 49 insertions(+), 45 deletions(-) commit d2f8bb27c87945ab696bdaea25b0465dee94fb6d Author: Yan, Zheng Date: Mon Dec 10 16:35:09 2018 +0800 ceph: update wanted caps after resuming stale session mds contains an optimization, it does not re-issue stale caps if client does not want any cap. A special case of the optimization is that client wants some caps, but skipped updating 'wanted'. For this case, client needs to update 'wanted' when stale session get renewed. Signed-off-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov fs/ceph/caps.c | 40 +++++++++++++++++++++++----------------- fs/ceph/mds_client.c | 35 ++++++++++++++++++++++++++--------- fs/ceph/mds_client.h | 16 +++++++++------- 3 files changed, 58 insertions(+), 33 deletions(-) commit fdac94fab7995ebc52ff9c5b6247133c67a7564a Author: Yan, Zheng Date: Thu Nov 22 15:26:01 2018 +0800 ceph: skip updating 'wanted' caps if caps are already issued When reading cached inode that already has Fscr caps, this can avoid two cap messages (one updats 'wanted' caps, one clears 'wanted' caps). Signed-off-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov fs/ceph/caps.c | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-) commit 8a2ac3a8e9c04018e2bbff9d6ff038507e443e75 Author: Yan, Zheng Date: Wed Dec 5 11:29:35 2018 +0800 ceph: don't request excl caps when mount is readonly Signed-off-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov fs/ceph/caps.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 3c1392d4c49962a31874af14ae9ff289cb2b3851 Author: Yan, Zheng Date: Thu Nov 29 11:22:50 2018 +0800 ceph: don't update importing cap's mseq when handing cap export Updating mseq makes client think importer mds has accepted all prior cap messages and importer mds knows what caps client wants. Actually some cap messages may have been dropped because of mseq mismatch. If mseq is left untouched, importing cap's mds_wanted later will get reset by cap import message. Cc: stable@vger.kernel.org Signed-off-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov fs/ceph/caps.c | 1 - 1 file changed, 1 deletion(-) commit 87349cdad963163b55cf7d327f5d47a647339838 Author: Ilya Dryomov Date: Wed Nov 21 18:56:40 2018 +0100 libceph: switch more to bool in ceph_tcp_sendmsg() Unlike in ceph_tcp_sendpage(), it's a bool. Signed-off-by: Ilya Dryomov net/ceph/messenger.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 433b0a12953bc1dfcb52febb186136395a65aad0 Author: Ilya Dryomov Date: Tue Nov 20 15:44:00 2018 +0100 libceph: use MSG_SENDPAGE_NOTLAST with ceph_tcp_sendpage() Prevent do_tcp_sendpages() from calling tcp_push() (at least) once per page. Instead, arrange for tcp_push() to be called (at least) once per data payload. This results in more MSS-sized packets and fewer packets overall (5-10% reduction in my tests with typical OSD request sizes). See commits 2f5338442425 ("tcp: allow splice() to build full TSO packets"), 35f9c09fe9c7 ("tcp: tcp_sendpages() should call tcp_push() once") and ae62ca7b0321 ("tcp: fix MSG_SENDPAGE_NOTLAST logic") for details. Here is an example of a packet size histogram for 128K OSD requests (MSS = 1448, top 5): Before: SIZE COUNT 1448 777700 952 127915 1200 39238 1219 9806 21 5675 After: SIZE COUNT 1448 897280 21 6201 1019 2797 643 2739 376 2479 We could do slightly better by explicitly corking the socket but it's not clear it's worth it. Signed-off-by: Ilya Dryomov net/ceph/messenger.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) commit 3239eb5215ebdef593a79316c9dbbdf8849166ec Author: Ilya Dryomov Date: Fri Nov 16 11:58:19 2018 +0100 libceph: use sock_no_sendpage() as a fallback in ceph_tcp_sendpage() sock_no_sendpage() makes the code cleaner. Also, don't set MSG_EOR. sendpage doesn't act on MSG_EOR on its own, it just honors the setting from the preceding sendmsg call by looking at ->eor in tcp_skb_can_collapse_to(). Signed-off-by: Ilya Dryomov net/ceph/messenger.c | 32 ++++++-------------------------- 1 file changed, 6 insertions(+), 26 deletions(-) commit 1f6b821aef78e3d79e8d598ae59fc7e23fb6c563 Author: Ilya Dryomov Date: Wed Nov 14 12:24:01 2018 +0100 libceph: drop last_piece logic from write_partial_message_data() last_piece is for the last piece in the current data item, not in the entire data payload of the message. This is harmful for messages with multiple data items. On top of that, we don't need to signal the end of a data payload either because it is always followed by a footer. We used to signal "more" unconditionally, until commit fe38a2b67bc6 ("libceph: start defining message data cursor"). Part of a large series, it introduced cursor->last_piece and also mistakenly inverted the hint by passing last_piece for "more". This was corrected with commit c2cfa1940097 ("libceph: Fix ceph_tcp_sendpage()'s more boolean usage"). As it is, last_piece is not helping at all: because Nagle algorithm is disabled, for a simple message with two 512-byte data items we end up emitting three packets: front + first data item, second data item and footer. Go back to the original pre-fe38a2b67bc6 behavior -- a single packet in most cases. Signed-off-by: Ilya Dryomov net/ceph/messenger.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) commit 0cab9f33d9c33f5ea94e5438fbc91bc8b7f48057 Author: Chengguang Xu Date: Thu Nov 15 22:27:01 2018 +0800 ceph: remove redundant assignment There is redundant assighment of variable i in ceph_mdsmap_get_random_mds(), just remvoe it. Signed-off-by: Chengguang Xu Signed-off-by: Ilya Dryomov fs/ceph/mdsmap.c | 1 - 1 file changed, 1 deletion(-) commit 2bf996ac48326645ffe5985edfca307838f8eafe Author: Yan, Zheng Date: Thu Oct 25 17:30:30 2018 +0800 ceph: cleanup splice_dentry() splice_dentry() may drop the original dentry and return other dentry. It relies on its caller to update pointer that points to the dropped dentry. This is error-prone. Signed-off-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov fs/ceph/inode.c | 60 +++++++++++++++++++++++---------------------------------- 1 file changed, 24 insertions(+), 36 deletions(-) commit f4747b9c68b8864cac32cddc45fdcfdfafb3397c Author: Colin Ian King Date: Sat Dec 22 12:43:33 2018 +0000 drivers: base: swnode: check if swnode is NULL before dereferencing it The to_software_mode() macro can potentially return NULL, so also add a NULL check on swnode before dereferencing it to avoid any NULL pointer dereferences. Detected by CoverityScan, CID#1476052 ("Explicit null dereferenced") Fixes: 59abd83672f7 (drivers: base: Introducing software nodes to the firmware node framework) Signed-off-by: Colin Ian King Signed-off-by: Rafael J. Wysocki drivers/base/swnode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 1d8f062ebc972053318c3a0e0470c7e0ddc1ebee Author: Colin Ian King Date: Sat Dec 22 12:49:39 2018 +0000 drivers: base: swnode: check if pointer p is NULL before dereferencing it The pointer p can be potentially NULL as macro to_software_node can return NULL. Add null check on p before dereferencing it to avoid any NULL pointer dereferences. Detected by CoverityScan, CID#1476039 ("Explicit null dereferenced") Fixes: 59abd83672f7 (drivers: base: Introducing software nodes to the firmware node framework) Signed-off-by: Colin Ian King Signed-off-by: Rafael J. Wysocki drivers/base/swnode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5694cecdb092656a822287a6691aa7ce668c8160 Merge: 13e1ad2be3a8 12f799c8c739 Author: Linus Torvalds Date: Tue Dec 25 17:41:56 2018 -0800 Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 festive updates from Will Deacon: "In the end, we ended up with quite a lot more than I expected: - Support for ARMv8.3 Pointer Authentication in userspace (CRIU and kernel-side support to come later) - Support for per-thread stack canaries, pending an update to GCC that is currently undergoing review - Support for kexec_file_load(), which permits secure boot of a kexec payload but also happens to improve the performance of kexec dramatically because we can avoid the sucky purgatory code from userspace. Kdump will come later (requires updates to libfdt). - Optimisation of our dynamic CPU feature framework, so that all detected features are enabled via a single stop_machine() invocation - KPTI whitelisting of Cortex-A CPUs unaffected by Meltdown, so that they can benefit from global TLB entries when KASLR is not in use - 52-bit virtual addressing for userspace (kernel remains 48-bit) - Patch in LSE atomics for per-cpu atomic operations - Custom preempt.h implementation to avoid unconditional calls to preempt_schedule() from preempt_enable() - Support for the new 'SB' Speculation Barrier instruction - Vectorised implementation of XOR checksumming and CRC32 optimisations - Workaround for Cortex-A76 erratum #1165522 - Improved compatibility with Clang/LLD - Support for TX2 system PMUS for profiling the L3 cache and DMC - Reflect read-only permissions in the linear map by default - Ensure MMIO reads are ordered with subsequent calls to Xdelay() - Initial support for memory hotplug - Tweak the threshold when we invalidate the TLB by-ASID, so that mremap() performance is improved for ranges spanning multiple PMDs. - Minor refactoring and cleanups" * tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (125 commits) arm64: kaslr: print PHYS_OFFSET in dump_kernel_offset() arm64: sysreg: Use _BITUL() when defining register bits arm64: cpufeature: Rework ptr auth hwcaps using multi_entry_cap_matches arm64: cpufeature: Reduce number of pointer auth CPU caps from 6 to 4 arm64: docs: document pointer authentication arm64: ptr auth: Move per-thread keys from thread_info to thread_struct arm64: enable pointer authentication arm64: add prctl control for resetting ptrauth keys arm64: perf: strip PAC when unwinding userspace arm64: expose user PAC bit positions via ptrace arm64: add basic pointer authentication support arm64/cpufeature: detect pointer authentication arm64: Don't trap host pointer auth use to EL2 arm64/kvm: hide ptrauth from guests arm64/kvm: consistently handle host HCR_EL2 flags arm64: add pointer authentication register bits arm64: add comments about EC exception levels arm64: perf: Treat EXCLUDE_EL* bit definitions as unsigned arm64: kpti: Whitelist Cortex-A CPUs that don't implement the CSV3 field arm64: enable per-task stack canaries ... commit 13e1ad2be3a85f5c0f76e82af9806b3d12a574d0 Merge: 9f687dddc4e1 20c3a2c33e9f Author: Linus Torvalds Date: Tue Dec 25 16:26:42 2018 -0800 Merge branch 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 pti updates from Thomas Gleixner: "No point in speculating what's in this parcel: - Drop the swap storage limit when L1TF is disabled so the full space is available - Add support for the new AMD STIBP always on mitigation mode - Fix a bunch of STIPB typos" * 'x86-pti-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/speculation: Add support for STIBP always-on preferred mode x86/speculation/l1tf: Drop the swap storage limit restriction when l1tf=off x86/speculation: Change misspelled STIPB to STIBP commit 9f687dddc4e1a3101f1ceb7fbaddbf93f93a7788 Merge: e4b99d415c39 bd2bcaa565a2 Author: Linus Torvalds Date: Tue Dec 25 15:44:08 2018 -0800 Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer updates from Thomas Gleixner: "The timer department delivers the following christmas presents: Core code: - Use proper seqcount initializer to make lockdep happy - SPDX annotations and cleanup of license boilerplates - Use DEFINE_SHOW_ATTRIBUTE() instead of open coding it - Minor cleanups Driver code: - Add the sched_clock for the arc timer (Alexey Brodkin) - Change the file timer names for riscv, rockchip, tegra20, sun4i and meson6 (Daniel Lezcano) - Add the DT bindings for r8a7796, r8a77470 and r8a774a1 (Biju Das) - Remove the early platform driver registration for timer-ti-dm (Bartosz Golaszewski) - Provide the sched_clock for the riscv timer (Anup Patel) - Add support for ARM64 for the imx-gpt and convert the imx-tpm to the timer-of API (Anson Huang) - Remove useless irq protection for the imx-gpt (Clément Péron) - Remove a duplicate function name for the vt8500 (Dan Carpenter) - Remove obsolete inclusion of for the tegra20 (Geert Uytterhoeven) - Demote the prcmu and the custom sched_clock for the dbx500 and the ux500 (Linus Walleij) - Add a new timer clock for the RDA8810PL (Manivannan Sadhasivam) - Rename the macro to stick to the register name and add the delay timer (Martin Blumenstingl) - Switch the bcm2835 to the SPDX identifier (Stefan Wahren) - Fix the interrupt register access on the fttmr010 (Tao Ren) - Add missing of_node_put in the initialization path on the integrator-ap (Yangtao Li)" * 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (39 commits) dt-bindings: timer: Document RDA8810PL SoC timer clocksource/drivers/rda: Add clock driver for RDA8810PL SoC clocksource/drivers/meson6: Change name meson6_timer timer-meson6 clocksource/drivers/sun4i: Change name sun4i_timer to timer-sun4i clocksource/drivers/tegra20: Change name tegra20_timer to timer-tegra20 clocksource/drivers/rockchip: Change name rockchip_timer to timer-rockchip clocksource/drivers/riscv: Change name riscv_timer to timer-riscv clocksource/drivers/riscv_timer: Provide the sched_clock clocksource/drivers/timer-imx-tpm: Specify clock name for timer-of clocksource/drivers/fttmr010: Fix invalid interrupt register access clocksource/drivers/integrator-ap: Add missing of_node_put() clocksource/drivers/bcm2835: Switch to SPDX identifier dt-bindings: timer: renesas, cmt: Document r8a774a1 CMT support clocksource/drivers/timer-imx-tpm: Convert the driver to timer-of clocksource/drivers/arc_timer: Utilize generic sched_clock dt-bindings: timer: renesas, cmt: Document r8a77470 CMT support dt-bindings: timer: renesas, cmt: Document r8a7796 CMT support clocksource/drivers/imx-gpt: Remove unnecessary irq protection clocksource/drivers/imx-gpt: Add support for ARM64 clocksource/drivers/meson6_timer: Implement the ARM delay timer ... commit e4b99d415c3908581d4703203e1e805f043a3e71 Merge: d8924c0d76aa c410abbbacb9 Author: Linus Torvalds Date: Tue Dec 25 15:17:51 2018 -0800 Merge branch 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq updates from Thomas Gleixner: "The interrupt department provides: Core updates: - Better spreading to NUMA nodes in the affinity management - Support for more than one set of interrupts to spread out to allow separate queues for separate functionality of a single device. - Decouple the non queue interrupts from being managed. Those are usually general interrupts for error handling etc. and those should never be shut down. This also a preparation to utilize the spreading mechanism for initial spreading of non-managed interrupts later. - Make the single CPU target selection in the matrix allocator more balanced so interrupts won't accumulate on single CPUs in certain situations. - A large spell checking patch so we don't end up fixing single typos over and over. Driver updates: - A bunch of new irqchip drivers (RDA8810PL, Madera, imx-irqsteer) - Updates for the 8MQ, F1C100s platform drivers - A number of SPDX cleanups - A workaround for a very broken GICv3 implementation on msm8996 which sports a botched register set. - A platform-msi fix to prevent memory leakage - Various cleanups" * 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (37 commits) genirq/affinity: Add is_managed to struct irq_affinity_desc genirq/core: Introduce struct irq_affinity_desc genirq/affinity: Remove excess indentation irqchip/stm32: protect configuration registers with hwspinlock dt-bindings: interrupt-controller: stm32: Document hwlock properties irqchip: Add driver for imx-irqsteer controller dt-bindings/irq: Add binding for Freescale IRQSTEER multiplexer irqchip: Add driver for Cirrus Logic Madera codecs genirq: Fix various typos in comments irqchip/irq-imx-gpcv2: Add IRQCHIP_DECLARE for i.MX8MQ compatible irqchip/irq-rda-intc: Fix return value check in rda8810_intc_init() irqchip/irq-imx-gpcv2: Silence "fall through" warning irqchip/gic-v3: Add quirk for msm8996 broken registers irqchip/gic: Add support to device tree based quirks dt-bindings/gic-v3: Add msm8996 compatible string irqchip/sun4i: Add support for Allwinner ARMv5 F1C100s irqchip/sun4i: Move IC specific register offsets to struct irqchip/sun4i: Add a struct to hold global variables dt-bindings: interrupt-controller: Add suniv interrupt-controller irqchip: Add RDA8810PL interrupt driver ... commit d8924c0d76aaa52e4811b5c64115d9a7f36cc73a Merge: 1fbb2dc6f0ce f569da8c994c Author: Linus Torvalds Date: Tue Dec 25 15:01:46 2018 -0800 Merge tag 'devprop-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull device properties framework updates from Rafael Wysocki: "This introduces 'software nodes' that are analogous to the DT and ACPI firmware nodes except that they can be created by drivers themselves and do a couple of assorted cleanups. Specifics: - Introduce "software nodes", analogous to the DT and ACPI firmware nodes except that they can be created by kernel code, in order to complement fwnodes representing real firmware nodes when they are incomplete (for example missing device properties) and to supply the primary fwnode when the firmware lacks hardware description for a device completely, and replace the "property_set" struct fwnode_handle type with software nodes (Heikki Krogerus). - Clean up the just introduced software nodes support and fix a commet in the graph-handling code (Colin Ian King, Marco Felsch)" * tag 'devprop-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: device property: fix fwnode_graph_get_next_endpoint() documentation drivers: base: swnode: remove need for a temporary string for the node name device property: Remove struct property_set device property: Move device_add_properties() to swnode.c drivers: base: Introducing software nodes to the firmware node framework ACPI / glue: Add acpi_platform_notify() function drivers core: Prepare support for multiple platform notifications driver core: platform: Remove duplicated device_remove_properties() call commit 1fbb2dc6f0ce95e73b9bd7e8e899089f5cebc99a Merge: 4e4390ad067a b677574bdf29 Author: Linus Torvalds Date: Tue Dec 25 14:57:37 2018 -0800 Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk updates from Stephen Boyd: "This round is dominated by NXP's i.MX clk drivers. We gained support for two or three i.MX SoCs in here and that mostly means a lot of driver code and data. Beyond that platform, there are some new Mediatek, Amlogic, and Qualcomm clk drivers added in here, and then we get to the long tail of driver updates and non-critical fixes all around, including code for vendors such as Renesas, Rockchip, Nvidia, and Allwinner. Overall, the driver updates look normal. Apart from the usual driver updates we have an update to make registering OF based clk providers a little simpler when they're devices created as a child of a device backed by a node in DT. Drivers don't have to jump through hoops to unregister the provider upon driver removal anymore because the API does the right thing and uses the parent device DT node. Summary: Core: - Make devm_of_clk_add_hw_provider() use parent dt node if necessary - Various SPDX taggings - Mark clk_ops const when possible New Drivers: - NXP i.MX7ULP SoC clock support - NXP i.MX8QXP SoC clock support - NXP i.MX8MQ SoC clock support - NXP QorIQ T1023 SoC support - Qualcomm SDM845 audio subsystem clks - Qualcomm SDM845 GPU clck controllers - Qualcomm QCS404 RPM clk support - Mediatek MT7629 SoC clk controllers - Allwinner F1c100s SoC clocks - Allwinner H6 display engine clocks - Amlogic GX video clocks - Support for Amlogic meson8b CPU frequency scaling - Amlogic Meson8b CPU post-divider clocks Updates: - Proper suspend/resume on VersaClock5 - Shrink code some with DEFINE_SHOW_ATTRIBUTE() - Register fixes for Rockchip rk3188 and rk3328 - One new critical clock for Rockchip rk3188 and a fixed clock id (double used number) - New clock id for Rockchip rk3328 - Amlogic Meson8/Meson8b video clock support - Amlogic got a clk-input helper and used it for the axg-audio clock driver - Sigma Delta modulation for the Allwinner A33 audio clocks - Support for CPEX (timer) clocks on various Renesas R-Car Gen3 and RZ/G2 SoCs - Support for SDHI HS400 clocks on early revisions of Renesas R-Car H3 and M3-W - Support for SDHI and USB clocks on Renesas RZ/A2 - Support for RPC (SPI Multi I/O Bus Controller) clocks on Renesas R-Car V3M - Qualcomm MSM8998 GCC driver improvements (resets, drop unused clks, etc)" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (172 commits) clk: imx: imx7ulp: add arm hsrun mode clocks support dt-bindings: clock: imx7ulp: add HSRUN mode related clocks clk: Use of_node_name_eq for node name comparisons clk: vc5: Add suspend/resume support clk: qcom: Drop unused 8998 clock clk: qcom: Leave mmss noc on for 8998 clk: tegra: Return the exact clock rate from clk_round_rate clk: tegra30: Use Tegra CPU powergate helper function soc/tegra: pmc: Drop SMP dependency from CPU APIs clk: tegra: Fix maximum audio sync clock for Tegra124/210 clk: tegra: get rid of duplicate defines clk: imx: add imx8qxp lpcg driver clk: imx: add lpcg clock support clk: imx: add imx8qxp clk driver clk: imx: Make the i.MX8MQ CCM clock driver CLK_IMX8MQ dependant clk: imx: add scu clock common part clk: imx: add configuration option for mmio clks dt-bindings: clock: add imx8qxp lpcg clock binding dt-bindings: clock: imx8qxp: add SCU clock IDs clk: qcom: Add missing msm8998 resets ... commit 4e4390ad067a61ce4e7607bd0df31f19a4caa36a Merge: b1669432b355 8146aace60c7 Author: Linus Torvalds Date: Tue Dec 25 14:52:50 2018 -0800 Merge tag 'leds-for-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds Pull LED updates from Jacek Anaszewski: "There are several few-liners, where most of them are fixes and improvments. One thing standing out is ground preparation for inititializing trigger parameters via Device Tree. We introduce LED_INIT_DEFAULT_TRIGGER flag for that purpose and set it when default trigger is matched. It indicates that trigger should parse DT properties to retrieve the initialization data when set as default one" * tag 'leds-for-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds: led: triggers: Initialize LED_INIT_DEFAULT_TRIGGER if trigger is brought after class led: triggers: Add LED_INIT_DEFAULT_TRIGGER flag led: triggers: Break the for loop after default trigger is found leds: pwm: Use OF variant of LED registering function leds: pwm: Simplify with resource-managed devm_led_classdev_register() leds: gpio: Drop unneeded manual of_node assignment leds: 88pm860x: Use of_node_name_eq for node name comparisons leds: powernv: add of_node_put() commit b1669432b3555954124ffd987a6ff2308344c88f Merge: 0051db82182b 58331d618bd9 Author: Linus Torvalds Date: Tue Dec 25 14:48:06 2018 -0800 Merge tag 'regmap-v4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap updates from Mark Brown: "This has been a busy release for the regmap-irq code, there's several new features been added, including an API cleanup for how we specify types that affected one existing driver (gpio-max77620): - Support for hardware that flags rising and falling edges on separate status bits from Bartosz Golaszewski. - Support for explicitly clearing interrupts before unmasking from Bartosz Golaszewski. - Support for level triggered IRQs from Matti Vaittinen" * tag 'regmap-v4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: irq: add an option to clear status registers on unmask regmap: regmap-irq/gpio-max77620: add level-irq support regmap: regmap-irq: Remove default irq type setting from core regmap: debugfs: convert to DEFINE_SHOW_ATTRIBUTE regmap: rbtree: convert to DEFINE_SHOW_ATTRIBUTE regmap: irq: handle HW using separate rising/falling edge interrupts regmap: add a new macro:REGMAP_IRQ_REG_LINE(_id, _reg_bits) commit 0051db82182bfd80d6c76982bcb36b09eb338a89 Merge: 79f20778fb22 74ff666bd7ba Author: Linus Torvalds Date: Tue Dec 25 14:43:54 2018 -0800 Merge tag 'spi-v4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi updates from Mark Brown: "The main thing this release has been a lot of work on the integration with SPI NOR flashes, there's been some specific support for a while for controller features designed to make them perform better but it's not worked out as well as hoped so the interface has been redesigned in a way that will hopefully do better - it's already been adopted by a number of additional controllers so things are looking good. Otherwise most of the work has been driver specific: - Support for better integration with NOR flashes from Boris Brezillon and Yogesh Narayan Gaur plus usage of it in several drivers. - A big cleanup of the Rockchip driver from Emil Renner Berthing. - Lots of performance improvements for bcm2835 from Lukas Wunner. - Slave mode support for pxa2xx from Lubomir Rintel. - Support for Macronix MXIC, Mediatek MT7629 and MT8183, NPCM PSPI, and Renesas r8a77470" * tag 'spi-v4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (90 commits) spi: sh-msiof: Reduce the number of times write to and perform the transmission from FIFO spi: sh-msiof: Add r8a774c0 support doc: lpspi: Document DT bindings for LPSPI slave mode spi: lpspi: Let watermark change with send data length spi: lpspi: Add slave mode support spi: lpspi: Replace all "master" with "controller" spi: imx: drop useless member speed_hz from driver data struct spi: imx: rename config callback and add useful parameters spi: imx: style fixes spi: imx: mx51-ecspi: Move some initialisation to prepare_message hook. spi: imx: add a device specific prepare_message callback mtd: atmel-quadspi: disallow building on ebsa110 spi: Update NPCM PSPI controller documentation spi: npcm: Modify pspi send function spi: Use of_node_name_eq for node name comparisons spi: dw-mmio: add ACPI support spi: bcm2835: Synchronize with callback on DMA termination spi: bcm2835: Speed up FIFO access if fill level is known spi: bcm2835: Polish transfer of DMA prologue spi: spi-mem: add support for octal mode I/O data transfer ... commit 79f20778fb228ae372cd7602745382fd4543ef31 Merge: d923fd6dc133 c3b572596522 Author: Linus Torvalds Date: Tue Dec 25 14:38:31 2018 -0800 Merge tag 'regulator-v4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator updates from Mark Brown: "This has been a very busy release for the core, some fixes, one large new feature and a big bit of refactoring to update the GPIO API: - Support for coupled regulators from Dmitry Osipenko based on a prior attempt by Maciej Purski, allowing us to handle situations where the voltages on two regulators can't be too far apart from each other. - Conversion of the GPIO support in both drivers and the core to use GPIO descriptors rather than numbers, part of the overall project to remove GPIO numbers. - Support for standby mode suspend states from Andrei Stefanescu. - New drivers for Allwinner AXP209, Cirrus Logic Lochnagar and Microchip MPC16502" * tag 'regulator-v4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (90 commits) regulator: tps65910: fix a missing check of return value regulator: mcp16502: Select REGMAP_I2C to fix build error regulator: convert to DEFINE_SHOW_ATTRIBUTE regulator: mcp16502: Fix missing n_voltages setting regulator: mcp16502: Use #ifdef CONFIG_PM_SLEEP around mcp16502_suspend/resume_noirq regulator: mcp16502: code cleanup regulator: act8945a-regulator: make symbol act8945a_pm static drivers/regulator: fix a missing check of return value regulator: act8945a-regulator: fix 'defined but not used' compiler warning regulator: axp20x: fix set_ramp_delay for AXP209/dcdc2 regulator: mcp16502: add support for suspend mfd: axp20x: use explicit bit defines mfd: axp20x: Clean up included headers regulator: dts: enable soft-start and ramp delay for the OLinuXino Lime2 dt-bindings: mfd: axp20x: Add software based soft_start for AXP209 LDO3 regulator: axp20x: add software based soft_start for AXP209 LDO3 dt-bindings: mfd: axp20x: add support for regulator-ramp-delay for AXP209 regulator: axp20x: add support for set_ramp_delay for AXP209 mfd: axp20x: name voltage ramping define properly regulator: mcp16502: add regulator driver for MCP16502 ... commit d923fd6dc133ee8d8fe800e4e4beb9175368b21b Merge: e6d131500638 e94b815524f8 Author: Linus Torvalds Date: Tue Dec 25 14:34:48 2018 -0800 Merge tag 'pwm/for-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm Pull pwm updates from Thierry Reding: "Not a lot going on this cycle. There's some more cleanup going on and new driver support that was not quite ready in time for v4.21-rc1, but here are a few fixes and improvements that are good to go. The Kona PWM driver can now be built on the Cygnus architecture and the i.MX driver gained support for hardware readback. Some small fixes are provided for the clks711x and lpc18xx-sct drivers. Finally, to round things off some drivers are switched to SPDX license identifiers" * tag 'pwm/for-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm: dt-bindings: pwm: rcar: Add r8a774c0 support pwm: imx: Add ipg clock operation pwm: clps711x: Switch to SPDX identifier pwm: clps711x: Fix period calculation pwm: bcm2835: Switch to SPDX identifier pwm: Enable Kona PWM to be built for the Cygnus architecture pwm: Drop legacy wrapper for changing polarity pwm: imx: Implement get_state() function for hardware readout pwm: imx: Use bitops and bitfield macros to define register values pwm: imx: Sort include files pwm: lpc18xx-sct: Don't reconfigure PWM in .request and .free commit e6d1315006383e525595bb3337d08bccec373ccc Merge: 1e2af254ef13 3eb85368460d Author: Linus Torvalds Date: Tue Dec 25 14:21:18 2018 -0800 Merge tag 'acpi-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI updates from Rafael Wysocki: "These update the ACPICA code in the kernel to the 20181213 upstream revision, make it possible to build the ACPI subsystem without PCI support, and a new OEM _OSI string, add a new device support to the ACPI driver for AMD SoCs and fix PM handling in the ACPI driver for Intel SoCs, fix the SPCR table handling and do some assorted fixes and cleanups. Specifics: - Update the ACPICA code in the kernel to the 20181213 upstream revision including: * New Windows _OSI strings (Bob Moore, Jung-uk Kim). * Buffers-to-string conversions update (Bob Moore). * Removal of support for expressions in package elements (Bob Moore). * New option to display method/object evaluation in debug output (Bob Moore). * Compiler improvements (Bob Moore, Erik Schmauss). * Minor debugger fix (Erik Schmauss). * Disassembler improvement (Erik Schmauss). * Assorted cleanups (Bob Moore, Colin Ian King, Erik Schmauss). - Add support for a new OEM _OSI string to indicate special handling of secondary graphics adapters on some systems (Alex Hung). - Make it possible to build the ACPI subystem without PCI support (Sinan Kaya). - Make the SPCR table handling regard baud rate 0 in accordance with the specification of it and make the DSDT override code support DSDT code names generated by recent ACPICA (Andy Shevchenko, Wang Dongsheng, Nathan Chancellor). - Add clock frequency for Hisilicon Hip08 SPI controller to the ACPI driver for AMD SoCs (APD) (Jay Fang). - Fix the PM handling during device init in the ACPI driver for Intel SoCs (LPSS) (Hans de Goede). - Avoid double panic()s by clearing the APEI GHES block_status before panic() (Lenny Szubowicz). - Clean up a function invocation in the ACPI core and get rid of some code duplication by using the DEFINE_SHOW_ATTRIBUTE macro in the APEI support code (Alexey Dobriyan, Yangtao Li)" * tag 'acpi-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (31 commits) ACPI / tables: Add an ifdef around amlcode and dsdt_amlcode ACPI/APEI: Clear GHES block_status before panic() ACPI: Make PCI slot detection driver depend on PCI ACPI/IORT: Stub out ACS functions when CONFIG_PCI is not set arm64: select ACPI PCI code only when both features are enabled PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set ACPICA: Remove PCI bits from ACPICA when CONFIG_PCI is unset ACPI: Allow CONFIG_PCI to be unset for reboot ACPI: Move PCI reset to a separate function ACPI / OSI: Add OEM _OSI string to enable dGPU direct output ACPI / tables: add DSDT AmlCode new declaration name support ACPICA: Update version to 20181213 ACPICA: change coding style to match ACPICA, no functional change ACPICA: Debug output: Add option to display method/object evaluation ACPICA: disassembler: disassemble OEMx tables as AML ACPICA: Add "Windows 2018.2" string in the _OSI support ACPICA: Expressions in package elements are not supported ACPICA: Update buffer-to-string conversions ACPICA: add comments, no functional change ACPICA: Remove defines that use deprecated flag ... commit 1e2af254ef130e37d9fb3cb1bc9bfbf6ea184b4a Merge: b271b2127e66 a465d38fa3dc Author: Linus Torvalds Date: Tue Dec 25 13:47:41 2018 -0800 Merge tag 'pm-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management updates from Rafael Wysocki: "These add sysadmin documentation for cpuidle, extend the cpuidle subsystem somewhat, improve the handling of performance states in the generic power domains (genpd) and operating performance points (OPP) frameworks, add a new cpufreq driver for Qualcomm SoCs, update some other cpufreq drivers, switch over the runtime PM framework to using high-res timers for device autosuspend, fix a problem with suspend-to-idle on ACPI-based platforms, add system-wide suspend and resume handling to the devfreq framework, do some janitorial cleanups all over and update some utilities. Specifics: - Add sysadmin documentation for cpuidle (Rafael Wysocki). - Make it possible to specify a cpuidle governor from kernel command line, add new cpuidle state sysfs attributes for governor evaluation, and improve the "polling" idle state handling (Rafael Wysocki). - Fix the handling of the "required-opps" DT property in the operating performance points (OPP) framework, improve the integration of it with the generic power domains (genpd) framework, improve the handling of performance states in them and clean up the idle states vs performance states separation in genpd (Viresh Kumar, Ulf Hansson). - Add a cpufreq driver called "qcom-hw" for Qualcomm SoCs using a hardware engine to control CPU frequency transitions along with DT bindings for it (Taniya Das). - Fix an intel_pstate driver issue related to CPU offline and update the documentation of it (Srinivas Pandruvada). - Clean up the imx6q cpufreq driver (Anson Huang). - Add SPDX license IDs to cpufreq schedutil governor files (Daniel Lezcano). - Switch over the runtime PM framework to using high-res timers for device autosuspend to allow the control of it to be more precise (Vincent Guittot). - Disable non-wakeup ACPI GPEs during suspend-to-idle so that they don't prevent the system from reaching the target low-power state and simplify the suspend-to-idle handling on ACPI platforms without full Low-Power S0 Idle (LPS0) support (Rafael Wysocki). - Add system-wide suspend and resume support to the devfreq framework (Lukasz Luba). - Clean up the SmartReflex adaptive voltage scaling (AVS) driver and add an SPDX license ID to it (Nishanth Menon, Uwe Kleine-König, Thomas Meyer). - Get rid of code duplication by using the DEFINE_SHOW_ATTRIBUTE macro in some places, fix some DT node refcount leaks, and do some other janitorial cleanups (Yangtao Li). - Update the cpupower, intel_pstate_tracer and turbosat utilities (Abhishek Goel, Doug Smythies, Len Brown)" * tag 'pm-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (54 commits) PM / Domains: remove define_genpd_open_function() and define_genpd_debugfs_fops() PM-runtime: Switch autosuspend over to using hrtimers cpufreq: qcom-hw: Add support for QCOM cpufreq HW driver dt-bindings: cpufreq: Introduce QCOM cpufreq firmware bindings ACPI: PM: Loop in full LPS0 mode only ACPI: EC / PM: Disable non-wakeup GPEs for suspend-to-idle tools/power/x86/intel_pstate_tracer: Fix non root execution for post processing a trace file tools/power turbostat: consolidate duplicate model numbers tools/power turbostat: fix goldmont C-state limit decoding PM / Domains: Propagate performance state updates PM / Domains: Factorize dev_pm_genpd_set_performance_state() PM / Domains: Save OPP table pointer in genpd OPP: Don't return 0 on error from of_get_required_opp_performance_state() OPP: Add dev_pm_opp_xlate_performance_state() helper OPP: Improve _find_table_of_opp_np() PM / Domains: Make genpd performance states orthogonal to the idlestates PM / sleep: convert to DEFINE_SHOW_ATTRIBUTE cpuidle: Add 'above' and 'below' idle state metrics PM / AVS: SmartReflex: Switch to SPDX Licence ID PM / AVS: SmartReflex: NULL check before some freeing functions is not needed ... commit b271b2127e6654a72dc1685f0825fe1cc2f36939 Merge: 8e61e7b5c4de 75dfa87035f9 Author: Linus Torvalds Date: Tue Dec 25 13:28:00 2018 -0800 Merge tag 'edac_for_4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp Pull EDAC updates from Borislav Petkov: - Support for ZynqMP DDR controller support to synopsys_edac along with a driver cleanup and generalization for the addition of support for the new IP. (Manish Narani) - Removal of the /sys/bus/edac devices hierarchy. This enabled us to get rid of the silly memory controllers maximum number notion. (Tony Luck and Borislav Petkov) - skx_edac improvements and fixes. (Qiuxu Zhuo and Tony Luck) - The usual garden variety of small cleanups and fixes. * tag 'edac_for_4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp: (25 commits) EDAC, fsl_ddr: Add LS1021A to the list of supported hardware EDAC, i5000: Remove set but not used local variables MAINTAINERS, EDAC: Drop bouncing email EDAC, i82975x: Fix spelling mistake "reserverd" -> "reserved" EDAC, fsl: Move error injection under CONFIG_EDAC_DEBUG EDAC, skx: Let EDAC core show the decoded result for debugfs EDAC, skx: Move debugfs node under EDAC's hierarchy EDAC, skx: Prepend hex formatting with '0x' EDAC, skx: Fix function calling order in skx_exit() EDAC: Drop per-memory controller buses EDAC: Don't add devices under /sys/bus/edac EDAC: Fix indentation issues in several EDAC drivers EDAC, skx: Fix randconfig builds in a better way EDAC, i82975x: Remove set but not used variable dtype EDAC, qcom_edac: Remove irq_handled local variable EDAC, synopsys: Add Error Injection support for ZynqMP DDR controller EDAC, synopsys: Add ECC support for ZynqMP DDR controller EDAC, synopsys: Add macro defines for ZynqMP DDRC dt: bindings: Document ZynqMP DDRC in Synopsys documentation EDAC, synopsys: Add error handling for the of_device_get_match_data() result ... commit 8e61e7b5c4de2bea534438bd7a008accd85492b0 Merge: 996680d461f8 d82b51c855a2 Author: Linus Torvalds Date: Tue Dec 25 13:19:10 2018 -0800 Merge tag 'sound-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound updates from Takashi Iwai: "There are no intensive changes in both ALSA and ASoC core parts while rather most of changes are a bunch of driver fixes and updates. A large diff pattern appears in ASoC TI part which now merges both OMAP and DaVinci stuff, but the rest spreads allover the places. Note that this pull request includes also some updates for LED trigger and platform drivers for mute LEDs, appearing in the diffstat as well. Some highlights: ASoC: - Preparatory work for merging the audio-graph and audio-graph-scu cards - A merge of TI OMAP and DaVinci directories, as both product lines get merged together. Also including a few architecture changes as well. - Major cleanups of the Maxim MAX9867 driver - Small fixes for tablets & co with Intel BYT/CHT chips - Lots of rsnd updates as usual - Support for Asahi Kaesi AKM4118, AMD ACP3x, Intel platforms with RT5660, Meson AXG S/PDIF inputs, several Qualcomm IPs and Xilinx I2S controllers HD-audio: - Introduce audio-mute LED trigger for replacing the former hackish dynamic binding - Huawei WMI hotkey and mute LED support - Refactoring of PM code and display power controls - Headset button support in the generic jack code - A few updates for Tegra - Fixups for HP EliteBook and ASUS UX391UA - Lots of updates for Intel ASoC HD-audio, including the improved DSP detection and the fallback binding from ASoC SST to legacy HD-audio controller drivers Others: - Updates for FireWire TASCAM and Fireface devices, some other fixes - A few potential Spectre v1 fixes that are all trivial" * tag 'sound-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (280 commits) ALSA: HD-Audio: SKL+: force HDaudio legacy or SKL+ driver selection ALSA: HD-Audio: SKL+: abort probe if DSP is present and Skylake driver selected ALSA: HDA: export process_unsol_events() ALSA: hda/realtek: Enable audio jacks of ASUS UX391UA with ALC294 ALSA: bebob: fix model-id of unit for Apogee Ensemble ALSA: emu10k1: Fix potential Spectre v1 vulnerabilities ALSA: rme9652: Fix potential Spectre v1 vulnerability ASoC: ti: Kconfig: Remove the deprecated options ARM: davinci_all_defconfig: Update the audio options ARM: omap1_defconfig: Do not select ASoC by default ARM: omap2plus_defconfig: Update the audio options ARM: davinci: dm365-evm: Update for the new ASoC Kcofnig options ARM: OMAP2: Update for new MCBSP Kconfig option ARM: OMAP1: Makefile: Update for new MCBSP Kconfig option MAINTAINERS: Add entry for sound/soc/ti and update the OMAP audio support ASoC: ti: Merge davinci and omap directories ALSA: hda: add mute LED support for HP EliteBook 840 G4 ALSA: fireface: code refactoring to handle model-specific registers ALSA: fireface: add support for packet streaming on Fireface 800 ALSA: fireface: allocate isochronous resources in mode-specific implementation ... commit 996680d461f8f759082e64f2395c1f7c25d9d549 Merge: 5813540b584c 38b11beb73c5 Author: Linus Torvalds Date: Tue Dec 25 13:11:30 2018 -0800 Merge tag 'media/v4.20-7' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull more media updates from Mauro Carvalho Chehab: "The Intel IPU3 camera driver" * tag 'media/v4.20-7' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (23 commits) media: staging/ipu3-imgu: Add MAINTAINERS entry media: staging/ipu3-imgu: Address documentation comments media: v4l: Add Intel IPU3 meta buffer formats media: doc-rst: Add Intel IPU3 documentation media: ipu3-imgu: Fix firmware binary location media: ipu3-imgu: Fix compiler warnings media: staging/intel-ipu3: Add dual pipe support media: staging/intel-ipu3: Add Intel IPU3 meta data uAPI media: staging/intel-ipu3: Add imgu top level pci device driver media: staging/intel-ipu3: Add v4l2 driver based on media framework media: staging/intel-ipu3: Add css pipeline programming media: staging/intel-ipu3: css: Initialize css hardware media: staging/intel-ipu3: css: Compute and program ccs media: staging/intel-ipu3: css: Add static settings for image pipeline media: staging/intel-ipu3: css: Add support for firmware management media: staging/intel-ipu3: css: Add dma buff pool utility functions media: staging/intel-ipu3: Implement DMA mapping functions media: staging/intel-ipu3: mmu: Implement driver media: staging/intel-ipu3: abi: Add structs media: staging/intel-ipu3: abi: Add register definitions and enum ... commit 5813540b584c3b1a507d1c61896bec164cad0905 Merge: eaa764997115 4bd46aa0353e Author: Linus Torvalds Date: Tue Dec 25 13:00:14 2018 -0800 Merge tag 'media/v4.20-6' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: "First set of media patches contains: - Three new platform drivers: aspeed-video seco-sed and sun5i-csi; - One new sensor driver: imx214; - Support for Xbox DVD Movie Playback kit remote controller; - Removal of the legacy friio driver. The functionalities were ported to another driver, already merged; - New staging driver: Rockchip VPU; - Added license text or SPDX tags to all media documentation files; - Usual set of cleanup, fixes and enhancements" * tag 'media/v4.20-6' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (263 commits) media: cx23885: only reset DMA on problematic CPUs media: ddbridge: Move asm includes after linux ones media: drxk_hard: check if parameter is not NULL media: docs: fix some GPL licensing ambiguity at the text media: platform: Add Aspeed Video Engine driver media: dt-bindings: media: Add Aspeed Video Engine binding documentation media: vimc: fix start stream when link is disabled media: v4l2-device: Link subdevices to their parent devices if available media: siano: Use kmemdup instead of duplicating its function media: rockchip vpu: remove some unused vars media: cedrus: don't initialize pointers with zero media: cetrus: return an error if alloc fails media: cedrus: Add device-tree compatible and variant for A64 support media: cedrus: Add device-tree compatible and variant for H5 support media: dt-bindings: media: cedrus: Add compatibles for the A64 and H5 media: video-i2c: check if chip struct has set_power function media: video-i2c: support runtime PM media: staging: media: imx: Use of_node_name_eq for node name comparisons media: v4l2-subdev: document controls need _FL_HAS_DEVNODE media: vivid: Improve timestamping ... commit eaa76499711535fd64d747cc4ef0d78ab0fd41c6 Merge: b3cc2bfe7244 f366d3854ec0 Author: Linus Torvalds Date: Tue Dec 25 12:49:46 2018 -0800 Merge tag 'mtd/for-4.21' of git://git.infradead.org/linux-mtd Pull mtd updates from Boris Brezillon: "SPI NOR Core changes: - Parse the 4BAIT SFDP section - Add a bunch of SPI NOR entries to the flash_info table - Add the concept of SFDP fixups and use it to fix a bug on MX25L25635F - A bunch of minor cleanups/comestic changes NAND core changes: - kernel-doc miscellaneous fixes. - Third batch of fixes/cleanup to the raw NAND core impacting various controller drivers (ams-delta, marvell, fsmc, denali, tegra, vf610): * Stop to pass mtd_info objects to internal functions * Reorganize code to avoid forward declarations * Drop useless test in nand_legacy_set_defaults() * Move nand_exec_op() to internal.h * Add nand_[de]select_target() helpers * Pass the CS line to be selected in struct nand_operation * Make ->select_chip() optional when ->exec_op() is implemented * Deprecate the ->select_chip() hook * Move the ->exec_op() method to nand_controller_ops * Move ->setup_data_interface() to nand_controller_ops * Deprecate the dummy_controller field * Fix JEDEC detection * Provide a helper for polling GPIO R/B pin Raw NAND chip drivers changes: - Macronix: * Flag 1.8V AC chips with a broken GET_FEATURES(TIMINGS) Raw NAND controllers drivers changes: - Ams-delta: * Fix the error path * SPDX tag added * May be compiled with COMPILE_TEST=y * Conversion to ->exec_op() interface * Drop .IOADDR_R/W use * Use GPIO API for data I/O - Denali: * Remove denali_reset_banks() * Remove ->dev_ready() hook * Include instead of * Changes to comply with the above fixes/cleanup done in the core. - FSMC: * Add an SPDX tag to replace the license text * Make conversion from chip to fsmc consistent * Fix unchecked return value in fsmc_read_page_hwecc * Changes to comply with the above fixes/cleanup done in the core. - Marvell: * Prevent timeouts on a loaded machine (fix) * Changes to comply with the above fixes/cleanup done in the core. - OMAP2: * Pass the parent of pdev to dma_request_chan() (fix) - R852: * Use generic DMA API - sh_flctl: * Convert to SPDX identifiers - Sunxi: * Write pageprog related opcodes to the right register: WCMD_SET (fix) - Tegra: * Stop implementing ->select_chip() - VF610: * Add an SPDX tag to replace the license text * Changes to comply with the above fixes/cleanup done in the core. - Various trivial/spelling/coding style fixes. SPI-NAND drivers changes: - Remove the depreacated mt29f_spinand driver from staging. - Add support for: * Toshiba TC58CVG2S0H * GigaDevice GD5FxGQ4xA * Winbond W25N01GV JFFS2 changes: - Fix a lockdep issue MTD changes: - Rework the physmap driver to merge gpio-addr-flash and physmap_of in it - Add a new compatible for RedBoot partitions - Make sub-partitions RW if the parent partition was RO because of a mis-alignment - Add pinctrl support to the - Addition of /* fall-through */ comments where appropriate - Various minor fixes and cleanups Other changes: - Update my email address" * tag 'mtd/for-4.21' of git://git.infradead.org/linux-mtd: (108 commits) mtd: rawnand: sunxi: Write pageprog related opcodes to WCMD_SET MAINTAINERS: Update my email address mtd: rawnand: marvell: prevent timeouts on a loaded machine mtd: rawnand: omap2: Pass the parent of pdev to dma_request_chan() mtd: rawnand: Fix JEDEC detection mtd: spi-nor: Add support for is25lp016d mtd: spi-nor: parse SFDP 4-byte Address Instruction Table mtd: spi-nor: Add 4B_OPCODES flag to is25lp256 mtd: spi-nor: Add an SPDX tag to spi-nor.{c,h} mtd: spi-nor: Make the enable argument passed to set_byte() a bool mtd: spi-nor: Stop passing flash_info around mtd: spi-nor: Avoid forward declaration of internal functions mtd: spi-nor: Drop inline on all internal helpers mtd: spi-nor: Add a post BFPT fixup for MX25L25635E mtd: spi-nor: Add a post BFPT parsing fixup hook mtd: spi-nor: Add the SNOR_F_4B_OPCODES flag mtd: spi-nor: cast to u64 to avoid uint overflows mtd: spi-nor: Add support for IS25LP032/064 mtd: spi-nor: add entry for mt35xu512aba flash mtd: spi-nor: add macros related to MICRON flash ... commit b3cc2bfe7244e848f5e8caa77bbdc72c04abd17c Merge: 4971f090aa7f 25ac3da61ba1 Author: Linus Torvalds Date: Tue Dec 25 12:26:34 2018 -0800 Merge tag 'i3c/for-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux Pull initial i3c support from Boris Brezillon: "Add initial support for I3C along with two I3C master controller drivers" * tag 'i3c/for-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux: i3c: master: cdns: fix I2C transfers in Cadence I3C master driver ic3: off by one in mode_show() i3c: fix an error code in i3c_master_add_i3c_dev_locked() i3c: master: dw: fix mask operation by using the correct operator MAINTAINERS: Add myself as the dw-i3c-master module maintainer dt-binding: i3c: Document Synopsys DesignWare I3C i3c: master: Add driver for Synopsys DesignWare IP i3c: master: Remove set but not used variable 'old_i3c_scl_lim' dt-bindings: i3c: Document Cadence I3C master bindings i3c: master: Add driver for Cadence IP MAINTAINERS: Add myself as the I3C subsystem maintainer dt-bindings: i3c: Document core bindings i3c: Add sysfs ABI spec docs: driver-api: Add I3C documentation i3c: Add core I3C infrastructure commit 4971f090aa7f6ce5daa094ce4334f6618f93a7eb Merge: c76cd634eb5b 2a3c83f5fe07 Author: Linus Torvalds Date: Tue Dec 25 11:48:26 2018 -0800 Merge tag 'drm-next-2018-12-14' of git://anongit.freedesktop.org/drm/drm Pull drm updates from Dave Airlie: "Core: - shared fencing staging removal - drop transactional atomic helpers and move helpers to new location - DP/MST atomic cleanup - Leasing cleanups and drop EXPORT_SYMBOL - Convert drivers to atomic helpers and generic fbdev. - removed deprecated obj_ref/unref in favour of get/put - Improve dumb callback documentation - MODESET_LOCK_BEGIN/END helpers panels: - CDTech panels, Banana Pi Panel, DLC1010GIG, - Olimex LCD-O-LinuXino, Samsung S6D16D0, Truly NT35597 WQXGA, - Himax HX8357D, simulated RTSM AEMv8. - GPD Win2 panel - AUO G101EVN010 vgem: - render node support ttm: - move global init out of drivers - fix LRU handling for ghost objects - Support for simultaneous submissions to multiple engines scheduler: - timeout/fault handling changes to help GPU recovery - helpers for hw with preemption support i915: - Scaler/Watermark fixes - DP MST + powerwell fixes - PSR fixes - Break long get/put shmemfs pages - Icelake fixes - Icelake DSI video mode enablement - Engine workaround improvements amdgpu: - freesync support - GPU reset enabled on CI, VI, SOC15 dGPUs - ABM support in DC - KFD support for vega12/polaris12 - SDMA paging queue on vega - More amdkfd code sharing - DCC scanout on GFX9 - DC kerneldoc - Updated SMU firmware for GFX8 chips - XGMI PSP + hive reset support - GPU reset - DC trace support - Powerplay updates for newer Polaris - Cursor plane update fast path - kfd dma-buf support virtio-gpu: - add EDID support vmwgfx: - pageflip with damage support nouveau: - Initial Turing TU104/TU106 modesetting support msm: - a2xx gpu support for apq8060 and imx5 - a2xx gpummu support - mdp4 display support for apq8060 - DPU fixes and cleanups - enhanced profiling support - debug object naming interface - get_iova/page pinning decoupling tegra: - Tegra194 host1x, VIC and display support enabled - Audio over HDMI for Tegra186 and Tegra194 exynos: - DMA/IOMMU refactoring - plane alpha + blend mode support - Color format fixes for mixer driver rcar-du: - R8A7744 and R8A77470 support - R8A77965 LVDS support imx: - fbdev emulation fix - multi-tiled scalling fixes - SPDX identifiers rockchip - dw_hdmi support - dw-mipi-dsi + dual dsi support - mailbox read size fix qxl: - fix cursor pinning vc4: - YUV support (scaling + cursor) v3d: - enable TFU (Texture Formatting Unit) mali-dp: - add support for linear tiled formats sun4i: - Display Engine 3 support - H6 DE3 mixer 0 support - H6 display engine support - dw-hdmi support - H6 HDMI phy support - implicit fence waiting - BGRX8888 support meson: - Overlay plane support - implicit fence waiting - HDMI 1.4 4k modes bridge: - i2c fixes for sii902x" * tag 'drm-next-2018-12-14' of git://anongit.freedesktop.org/drm/drm: (1403 commits) drm/amd/display: Add fast path for cursor plane updates drm/amdgpu: Enable GPU recovery by default for CI drm/amd/display: Fix duplicating scaling/underscan connector state drm/amd/display: Fix unintialized max_bpc state values Revert "drm/amd/display: Set RMX_ASPECT as default" drm/amdgpu: Fix stub function name drm/msm/dpu: Fix clock issue after bind failure drm/msm/dpu: Clean up dpu_media_info.h static inline functions drm/msm/dpu: Further cleanups for static inline functions drm/msm/dpu: Cleanup the debugfs functions drm/msm/dpu: Remove dpu_irq and unused functions drm/msm: Make irq_postinstall optional drm/msm/dpu: Cleanup callers of dpu_hw_blk_init drm/msm/dpu: Remove unused functions drm/msm/dpu: Remove dpu_crtc_is_enabled() drm/msm/dpu: Remove dpu_crtc_get_mixer_height drm/msm/dpu: Remove dpu_dbg drm/msm: dpu: Remove crtc_lock drm/msm: dpu: Remove vblank_requested flag from dpu_crtc drm/msm: dpu: Separate crtc assignment from vblank enable ... commit c76cd634eb5bfd497617ea224a54a03b545c8c4d Merge: 8fe28cb58bcb fb7255a92311 Author: Linus Torvalds Date: Tue Dec 25 11:04:17 2018 -0800 Merge tag 'platform-drivers-x86-v4.21-1' of git://git.infradead.org/linux-platform-drivers-x86 Pull x86 platform driver updates from Andy Shevchenko: - The USB Power Delivery discrete components now can be enumerated by i2c-multi-instantiate driver via several resources under single ACPI device node (ACPI ID is INT3515). - Touchscreen support is added for the Mediacom Flexbook Edge 11. - Mellanox driver got fixed due to updates in their firmware. - The power management stub driver for AtomISP v2 is fixed in order to support Intel Baytrail SoCs where same quirk is needed for S0ix to work. - Special key handling has been fixed for Favorites hotkey on Thinkpad, and Screen LOCK on ASUS. - Ideapad Yoga 2 13 has no HW rfkill switch, thus, driver has been updated to support this. - Few cleanups related to debugfs have been made in Intel IPS and Intel PMC drivers. Besides that Intel PMC has been extended to show more detailed information about Latency Tolerance * tag 'platform-drivers-x86-v4.21-1' of git://git.infradead.org/linux-platform-drivers-x86: (41 commits) platform/x86: mlx-platform: Convert to use SPDX identifier Documentation/ABI: Add new attribute for mlxreg-io sysfs interfaces platform/x86: mlx-platform: Allow mlxreg-io driver activation for new systems platform/x86: mlx-platform: Fix LED configuration platform/x86: mlx-platform: Fix tachometer registers platform/x86: mlx-platform: Rename new systems product names platform/x86: mlx-platform: Add definitions for new registers platform/x86: intel_telemetry: convert to DEFINE_SHOW_ATTRIBUTE platform/x86: intel_pmc_core: convert to DEFINE_SHOW_ATTRIBUTE platform/x86: thinkpad_acpi: Cleanup quirks macros platform/x86: touchscreen_dmi: Add info for the Mediacom Flexbook Edge 11 platform/x86: Fix config space access for intel_atomisp2_pm platform/x86: Add the VLV ISP PCI ID to atomisp2_pm platform/x86: intel_ips: Convert to use DEFINE_SHOW_ATTRIBUTE macro platform/x86: intel_ips: Remove never happen condition platform/x86: intel_ips: NULL check before some freeing functions is not needed platform/x86: intel_ips: remove unnecessary checks in ips_debugfs_init iio: inv_mpu6050: Use i2c_acpi_get_i2c_resource() helper ACPI / scan: Create platform device for INT3515 ACPI nodes platform/x86: i2c-multi-instantiate: Allow to have same slaves ... commit 574d356b7a02c7e1b01a1d9cba8a26b3c2888f45 Author: Dominique Martinet Date: Mon Nov 5 09:52:48 2018 +0100 9p/net: put a lower bound on msize If the requested msize is too small (either from command line argument or from the server version reply), we won't get any work done. If it's *really* too small, nothing will work, and this got caught by syzbot recently (on a new kmem_cache_create_usercopy() call) Just set a minimum msize to 4k in both code paths, until someone complains they have a use-case for a smaller msize. We need to check in both mount option and server reply individually because the msize for the first version request would be unchecked with just a global check on clnt->msize. Link: http://lkml.kernel.org/r/1541407968-31350-1-git-send-email-asmadeus@codewreck.org Reported-by: syzbot+0c1d61e4db7db94102ca@syzkaller.appspotmail.com Signed-off-by: Dominique Martinet Cc: Eric Van Hensbergen Cc: Latchesar Ionkov Cc: stable@vger.kernel.org net/9p/client.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) commit 2b08b1f12cd664dc7d5c84ead9ff25ae97ad5491 Author: Theodore Ts'o Date: Tue Dec 25 00:56:33 2018 -0500 ext4: fix a potential fiemap/page fault deadlock w/ inline_data The ext4_inline_data_fiemap() function calls fiemap_fill_next_extent() while still holding the xattr semaphore. This is not necessary and it triggers a circular lockdep warning. This is because fiemap_fill_next_extent() could trigger a page fault when it writes into page which triggers a page fault. If that page is mmaped from the inline file in question, this could very well result in a deadlock. This problem can be reproduced using generic/519 with a file system configuration which has the inline_data feature enabled. Signed-off-by: Theodore Ts'o Cc: stable@kernel.org fs/ext4/inline.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 812c0cab2c0dfad977605dbadf9148490ca5d93f Author: Theodore Ts'o Date: Mon Dec 24 20:27:08 2018 -0500 ext4: make sure enough credits are reserved for dioread_nolock writes There are enough credits reserved for most dioread_nolock writes; however, if the extent tree is sufficiently deep, and/or quota is enabled, the code was not allowing for all eventualities when reserving journal credits for the unwritten extent conversion. This problem can be seen using xfstests ext4/034: WARNING: CPU: 1 PID: 257 at fs/ext4/ext4_jbd2.c:271 __ext4_handle_dirty_metadata+0x10c/0x180 Workqueue: ext4-rsv-conversion ext4_end_io_rsv_work RIP: 0010:__ext4_handle_dirty_metadata+0x10c/0x180 ... EXT4-fs: ext4_free_blocks:4938: aborting transaction: error 28 in __ext4_handle_dirty_metadata EXT4: jbd2_journal_dirty_metadata failed: handle type 11 started at line 4921, credits 4/0, errcode -28 EXT4-fs error (device dm-1) in ext4_free_blocks:4950: error 28 Signed-off-by: Theodore Ts'o Cc: stable@kernel.org fs/ext4/inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 90cadbbf341dd5b2df991c33a6bd6341f3a53788 Merge: c92c81df93df 38355a5f9a22 Author: David S. Miller Date: Mon Dec 24 16:19:56 2018 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull in bug fixes before respinning my net-next pull request. Signed-off-by: David S. Miller commit c92c81df93df95dafbf6926613ce0b436227b007 Author: Peter Oskolkov Date: Mon Dec 24 12:57:17 2018 -0800 net: dccp: fix kernel crash on module load Patch eedbbb0d98b2 "net: dccp: initialize (addr,port) ..." added calling to inet_hashinfo2_init() from dccp_init(). However, inet_hashinfo2_init() is marked as __init(), and thus the kernel panics when dccp is loaded as module. Removing __init() tag from inet_hashinfo2_init() is not feasible because it calls into __init functions in mm. This patch adds inet_hashinfo2_init_mod() function that can be called after the init phase is done; changes dccp_init() to call the new function; un-marks inet_hashinfo2_init() as exported. Fixes: eedbbb0d98b2 ("net: dccp: initialize (addr,port) ...") Reported-by: kernel test robot Signed-off-by: Peter Oskolkov Signed-off-by: David S. Miller include/net/inet_hashtables.h | 1 + net/dccp/proto.c | 8 ++++---- net/ipv4/inet_hashtables.c | 34 ++++++++++++++++++++++++++-------- 3 files changed, 31 insertions(+), 12 deletions(-) commit bd437c99cf63b8adaea51156db383f9dfdd57503 Author: Colin Ian King Date: Mon Dec 24 19:41:46 2018 +0000 drivers/net: appletalk/cops: remove redundant if statement and mask The two different assignments for pkt_len are actually the same and so the if statement is redundant and can be removed. Masking a u8 return value from inb() with 0xFF is also redundant and can also be emoved. Similarly, the two different outb calls are identical as the mask of 0xff on the second outb is redundant since a u8 is being written, so the if statement is also redundant and can be also removed. Detected by CoverityScan, CID#1475639 ("Identical code for different branches") V2: Remove the if statement for the outb calls, thanks to David Miller for spotting this. Signed-off-by: Colin Ian King Signed-off-by: David S. Miller drivers/net/appletalk/cops.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) commit 38355a5f9a22bfa5bd5b1bb79805aca39fa53729 Author: Ivan Mironov Date: Mon Dec 24 20:13:05 2018 +0500 bnx2x: Fix NULL pointer dereference in bnx2x_del_all_vlans() on some hw This happened when I tried to boot normal Fedora 29 system with latest available kernel (from fedora rawhide, plus some unrelated custom patches): BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 PGD 0 P4D 0 Oops: 0010 [#1] SMP PTI CPU: 6 PID: 1422 Comm: libvirtd Tainted: G I 4.20.0-0.rc7.git3.hpsa2.1.fc29.x86_64 #1 Hardware name: HP ProLiant BL460c G6, BIOS I24 05/21/2018 RIP: 0010: (null) Code: Bad RIP value. RSP: 0018:ffffa47ccdc9fbe0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 00000000000003e8 RCX: ffffa47ccdc9fbf8 RDX: ffffa47ccdc9fc00 RSI: ffff97d9ee7b01f8 RDI: ffff97d9f0150b80 RBP: ffff97d9f0150b80 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000003 R13: ffff97d9ef1e53e8 R14: 0000000000000009 R15: ffff97d9f0ac6730 FS: 00007f4d224ef700(0000) GS:ffff97d9fa200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 00000011ece52006 CR4: 00000000000206e0 Call Trace: ? bnx2x_chip_cleanup+0x195/0x610 [bnx2x] ? bnx2x_nic_unload+0x1e2/0x8f0 [bnx2x] ? bnx2x_reload_if_running+0x24/0x40 [bnx2x] ? bnx2x_set_features+0x79/0xa0 [bnx2x] ? __netdev_update_features+0x244/0x9e0 ? netlink_broadcast_filtered+0x136/0x4b0 ? netdev_update_features+0x22/0x60 ? dev_disable_lro+0x1c/0xe0 ? devinet_sysctl_forward+0x1c6/0x211 ? proc_sys_call_handler+0xab/0x100 ? __vfs_write+0x36/0x1a0 ? rcu_read_lock_sched_held+0x79/0x80 ? rcu_sync_lockdep_assert+0x2e/0x60 ? __sb_start_write+0x14c/0x1b0 ? vfs_write+0x159/0x1c0 ? vfs_write+0xba/0x1c0 ? ksys_write+0x52/0xc0 ? do_syscall_64+0x60/0x1f0 ? entry_SYSCALL_64_after_hwframe+0x49/0xbe After some investigation I figured out that recently added cleanup code tries to call VLAN filtering de-initialization function which exist only for newer hardware. Corresponding function pointer is not set (== 0) for older hardware, namely these chips: #define CHIP_NUM_57710 0x164e #define CHIP_NUM_57711 0x164f #define CHIP_NUM_57711E 0x1650 And I have one of those in my test system: Broadcom Inc. and subsidiaries NetXtreme II BCM57711E 10-Gigabit PCIe [14e4:1650] Function bnx2x_init_vlan_mac_fp_objs() from drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h decides whether to initialize relevant pointers in bnx2x_sp_objs.vlan_obj or not. This regression was introduced after v4.20-rc7, and still exists in v4.20 release. Fixes: 04f05230c5c13 ("bnx2x: Remove configured vlans as part of unload sequence.") Signed-off-by: Ivan Mironov Signed-off-by: Ivan Mironov Acked-by: Sudarsana Kalluru Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) commit 0eb987c874dc93f9c9d85a6465dbde20fdd3884c Author: Aditya Pakki Date: Sun Dec 23 19:42:38 2018 -0600 net/net_namespace: Check the return value of register_pernet_subsys() In net_ns_init(), register_pernet_subsys() could fail while registering network namespace subsystems. The fix checks the return value and sends a panic() on failure. Signed-off-by: Aditya Pakki Reviewed-by: Kirill Tkhai Signed-off-by: David S. Miller net/core/net_namespace.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 89dfd0083751d00d5d7ead36f6d8b045bf89c5e1 Author: Aditya Pakki Date: Sun Dec 23 18:54:53 2018 -0600 net/netlink_compat: Fix a missing check of nla_parse_nested In tipc_nl_compat_sk_dump(), if nla_parse_nested() fails, it could return an error. To be consistent with other invocations of the function call, on error, the fix passes the return value upstream. Signed-off-by: Aditya Pakki Signed-off-by: David S. Miller net/tipc/netlink_compat.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 40c3ff6d5e0809505a067dd423c110c5658c478c Author: Willem de Bruijn Date: Sun Dec 23 12:52:18 2018 -0500 ieee802154: lowpan_header_create check must check daddr Packet sockets may call dev_header_parse with NULL daddr. Make lowpan_header_ops.create fail. Fixes: 87a93e4eceb4 ("ieee802154: change needed headroom/tailroom") Signed-off-by: Willem de Bruijn Acked-by: Alexander Aring Signed-off-by: David S. Miller net/ieee802154/6lowpan/tx.c | 3 +++ 1 file changed, 3 insertions(+) commit 61988bd281c9b08e0cc084f0b2da3b109c4c39c8 Author: Julia Lawall Date: Sun Dec 23 09:57:14 2018 +0100 net/mlx4_core: drop useless LIST_HEAD Drop LIST_HEAD where the variable it declares has never been used. The semantic patch that fixes this problem is as follows: (http://coccinelle.lip6.fr/) // @@ identifier x; @@ - LIST_HEAD(x); ... when != x // Fixes: c82e9aa0a8bc ("mlx4_core: resource tracking for HCA resources used by guests") Signed-off-by: Julia Lawall Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx4/resource_tracker.c | 5 ----- 1 file changed, 5 deletions(-) commit d0863792f805ffad7d98fb6bd484bc2fad59c8ea Author: Julia Lawall Date: Sun Dec 23 09:57:11 2018 +0100 mlxsw: spectrum: drop useless LIST_HEAD Drop LIST_HEAD where the variable it declares is never used. The uses were removed in 244cd96adb5f ("net_sched: remove list_head from tc_action"), but not the declaration. The semantic patch that fixes this problem is as follows: (http://coccinelle.lip6.fr/) // @@ identifier x; @@ - LIST_HEAD(x); ... when != x // Fixes: 244cd96adb5f ("net_sched: remove list_head from tc_action") Signed-off-by: Julia Lawall Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 1 - 1 file changed, 1 deletion(-) commit 2534f14a94c1fe48928a4b00a0e241fa7132d00b Author: Julia Lawall Date: Sun Dec 23 09:56:57 2018 +0100 net/mlx5e: drop useless LIST_HEAD Drop LIST_HEAD where the variable it declares is never used. These became useless in 244cd96adb5f ("net_sched: remove list_head from tc_action") The semantic patch that fixes this problem is as follows: (http://coccinelle.lip6.fr/) // @@ identifier x; @@ - LIST_HEAD(x); ... when != x // Fixes: 244cd96adb5f ("net_sched: remove list_head from tc_action") Signed-off-by: Julia Lawall Reviewed-by: Leon Romanovsky Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 3 --- 1 file changed, 3 deletions(-) commit 7bdca378b2301b1fc6a95c60d6d428408ae4e39e Author: wenxu Date: Sun Dec 23 16:18:39 2018 +0800 iptunnel: Set tun_flags in the iptunnel_metadata_reply from src ip l add tun type gretap external ip r a 10.0.0.2 encap ip id 1000 dst 172.168.0.2 key dev tun ip a a 10.0.0.1/24 dev tun The peer arp request to 10.0.0.1 with tunnel_id, but the arp reply only set the tun_id but not the tun_flags with TUNNEL_KEY. The arp reply packet don't contain tun_id field. Signed-off-by: wenxu Signed-off-by: David S. Miller net/ipv4/ip_tunnel_core.c | 1 + 1 file changed, 1 insertion(+) commit 5d1f7354faad4b6210fac9192d0ca4c16b00ae7e Author: kbuild test robot Date: Sat Dec 22 20:02:16 2018 +0800 net/mlx5e: fix semicolon.cocci warnings drivers/net/ethernet/mellanox/mlx5/core/en_rep.c:1339:57-58: Unneeded semicolon Remove unneeded semicolon. Generated by: scripts/coccinelle/misc/semicolon.cocci Fixes: 4c8fb2986d44 ("net/mlx5e: Increase VF representors' SQ size to 128") CC: Gavi Teitz Signed-off-by: kbuild test robot Reviewed-by: Leon Romanovsky Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8762cdcd1d5055017770a54e2755bed30dd4f8b6 Author: Florian Westphal Date: Fri Dec 21 21:57:26 2018 +0100 staging: octeon: fix build failure with XFRM enabled skb->sp doesn't exist anymore in the next-next tree, so mips defconfig no longer builds. Use helper instead to reset the secpath. Not even compile tested. Cc: Greg Kroah-Hartman Reported-by: Guenter Roeck Fixes: 4165079ba328d ("net: switch secpath to use skb extension infrastructure") Signed-off-by: Florian Westphal Signed-off-by: David S. Miller drivers/staging/octeon/ethernet-tx.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit dec28d8ea2f731b7ec68a2c9421e99a165d47b57 Author: Masahiro Yamada Date: Mon Dec 24 23:11:09 2018 +0900 kbuild: remove unused cmd_gentimeconst filechk_gentimeconst is always used instead of cmd_gentimeconst. Signed-off-by: Masahiro Yamada Kbuild | 4 ---- 1 file changed, 4 deletions(-) commit e3c21e088f8936a004a3d9f2f4e14b3f2bdd6ea9 Author: Andrew Lunn Date: Wed Dec 19 16:18:20 2018 +0100 watchdog: tqmx86: Add watchdog driver for the IO controller Some TQ-Systems ComExpress modules have an IO controller with a watchdog timer. Signed-off-by: Andrew Lunn Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/Kconfig | 12 ++++ drivers/watchdog/Makefile | 1 + drivers/watchdog/tqmx86_wdt.c | 126 ++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 139 insertions(+) commit 6797f292e4f59211c1763de87a69c9a55fd9caef Author: Fabrizio Castro Date: Thu Dec 13 20:18:53 2018 +0000 dt-bindings: watchdog: renesas-wdt: Document r8a774c0 support RZ/G2E (R8A774C0) watchdog implementation is compatible with R-Car Gen3, therefore add relevant documentation. Signed-off-by: Fabrizio Castro Reviewed-by: Geert Uytterhoeven Reviewed-by: Simon Horman Reviewed-by: Guenter Roeck Reviewed-by: Rob Herring Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck Documentation/devicetree/bindings/watchdog/renesas-wdt.txt | 1 + 1 file changed, 1 insertion(+) commit 2b6d86a73ec07f1ba95a274d8756fa1e67ef29c4 Author: Wolfram Sang Date: Mon Dec 17 20:14:11 2018 +0100 watchdog: docs: kernel-api: don't reference removed functions Those functions are not only deprecated, but gone for good. Fixes: 62cd1c40ce1c ("watchdog: kill unref/ref ops") Signed-off-by: Wolfram Sang Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck Documentation/watchdog/watchdog-kernel-api.txt | 4 ---- 1 file changed, 4 deletions(-) commit e536f7304badbf15e2099f08b5d47fbbf111a624 Author: Wolfram Sang Date: Mon Dec 17 20:33:14 2018 +0100 watchdog: add documentation for PM usage Add the first rule we recently agreed on. Signed-off-by: Wolfram Sang Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck Documentation/watchdog/watchdog-pm.txt | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) commit e94b815524f83536415d7d59cc1833ad05934d97 Author: Fabrizio Castro Date: Thu Dec 13 20:20:15 2018 +0000 dt-bindings: pwm: rcar: Add r8a774c0 support Document RZ/G2E (R8A774C0) SoC bindings. Signed-off-by: Fabrizio Castro Reviewed-by: Geert Uytterhoeven Reviewed-by: Simon Horman Signed-off-by: Thierry Reding Documentation/devicetree/bindings/pwm/renesas,pwm-rcar.txt | 1 + 1 file changed, 1 insertion(+) commit 9f4c8f9607c3147d291b70c13dd01c738ed41faf Author: Anson Huang Date: Wed Dec 19 05:24:58 2018 +0000 pwm: imx: Add ipg clock operation i.MX PWM module's ipg_clk_s is for PWM register access, on most of i.MX SoCs, this ipg_clk_s is from system ipg clock or perclk which is always enabled, but on i.MX7D, the ipg_clk_s is from PWM1_CLK_ROOT which is controlled by CCGR132, that means the CCGR132 MUST be enabled first before accessing PWM registers on i.MX7D. This patch adds ipg clock operation to make sure register access successfully on i.MX7D and it fixes Linux kernel boot up hang during PWM driver probe. Fixes: 4a23e6ee9f69 ("ARM: dts: imx7d-sdb: Restore pwm backlight support") Signed-off-by: Anson Huang Signed-off-by: Thierry Reding drivers/pwm/pwm-imx.c | 53 ++++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 48 insertions(+), 5 deletions(-) commit f236d188683667274824de662d124720198730b7 Author: Alexander Shiyan Date: Wed Dec 19 13:39:25 2018 +0300 pwm: clps711x: Switch to SPDX identifier Adopt the SPDX license identifier headers to ease license compliance management. Signed-off-by: Alexander Shiyan Signed-off-by: Thierry Reding drivers/pwm/pwm-clps711x.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) commit b0f17570b8203c22f139459c86cfbaa0311313ed Author: Alexander Shiyan Date: Wed Dec 19 13:39:24 2018 +0300 pwm: clps711x: Fix period calculation Commit e39c0df1be5a ("pwm: Introduce the pwm_args concept") has changed the variable for the period for clps711x-pwm driver, so now pwm_get/set_period() works with pwm->state.period variable instead of pwm->args.period. This patch changes the period variable in other places where it is used. Signed-off-by: Alexander Shiyan Signed-off-by: Thierry Reding drivers/pwm/pwm-clps711x.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit e747cbe257fdc08f1a8b19b4c9f75a377b6f783d Author: Stefan Wahren Date: Sat Nov 10 17:22:58 2018 +0100 pwm: bcm2835: Switch to SPDX identifier Adopt the SPDX license identifier headers to ease license compliance management. Cc: Bart Tanghe Signed-off-by: Stefan Wahren Reviewed-by: Eric Anholt Signed-off-by: Thierry Reding drivers/pwm/pwm-bcm2835.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) commit 88a053d2923479658e82621c4c642dc8a494392d Author: Clément Péron Date: Fri Nov 23 10:35:59 2018 +0100 pwm: Enable Kona PWM to be built for the Cygnus architecture The Cygnus architecture uses a Kona PWM. This is already present in the device tree but can't be built actually. Hence, allow the Kona PWM to be built for the Cygnus architecture. Signed-off-by: Clément Péron Reviewed-by: Florian Fainelli Reviewed-by: Scott Branden Acked-by: Uwe Kleine-König Signed-off-by: Thierry Reding drivers/pwm/Kconfig | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit c75ff001f4fe21a8c9f15aad799a8949aea109f7 Author: Deepak Rawat Date: Fri Dec 21 11:35:59 2018 -0800 drm: Put damage blob when destroy plane state Somehow the code to put the damage blob on destroy plane state and set the blob to NULL when duplicate plane state was not merged. May be because the files are refactored since the patch was written. With this fix add those. Cc: Daniel Vetter Signed-off-by: Deepak Rawat Reviewed-by: Thomas Hellstrom Fixes: d3b21767821e ("drm: Add a new plane property to send damage during plane update") Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20181221193559.4346-1-drawat@vmware.com drivers/gpu/drm/drm_atomic_state_helper.c | 3 +++ 1 file changed, 3 insertions(+) commit cbdd2663f4c801ad93f7111f93d9846589a0d530 Author: Colin Ian King Date: Sat Dec 22 13:00:46 2018 +0000 drm: fix null pointer dereference on null state pointer In the case where state cannot be allocated, the current exit path via label 'out' will dereference the null state pointer when calling drm_atomic_state_put. Fix this by adding a new error exit label and jumping to this to avoid the drm_atomic_state_put. Detected by CoverityScan, CID#1476034 ("Dereference after null check") Fixes: b9fc5e01d1ce ("drm: Add helper to implement legacy dirtyfb") Signed-off-by: Colin Ian King Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20181222130046.14083-1-colin.king@canonical.com drivers/gpu/drm/drm_damage_helper.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 598134ffcab5bfb1d342458732394487063e1b9e Author: Greg Kroah-Hartman Date: Mon Dec 24 09:18:00 2018 +0100 Revert "serial: 8250: Default SERIAL_OF_PLATFORM to SERIAL_8250" This reverts commit 6d11023c345e369bcb9d5a68b271764e362c1f6e. It causes issues with Guenter's test systems and since there seems to not be any agreement about _why_ this is a problem, but reverting it fixes things, let's revert until the root cause is found. Reported-by: Guenter Roeck Cc: Florian Fainelli Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/8250/Kconfig | 1 - 1 file changed, 1 deletion(-) commit d2b911db8b73bc6bfa163515b4ff142fb0dda66d Author: Linus Walleij Date: Sat Dec 22 11:12:31 2018 +0100 watchdog: mtx-1: Convert to use GPIO descriptor This converts the MTX-1 driver to grab a GPIO descriptor associated with the device instead of using a resource with a global GPIO number. Augment the driver and the boardfile. Cc: Ralf Baechle Cc: Paul Burton Cc: James Hogan Cc: linux-mips@linux-mips.org Cc: Florian Fainelli Reviewed-by: Florian Fainelli Signed-off-by: Linus Walleij Acked-by: Paul Burton Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck arch/mips/alchemy/board-mtx1.c | 18 +++++++++--------- drivers/watchdog/mtx-1_wdt.c | 19 +++++++++---------- 2 files changed, 18 insertions(+), 19 deletions(-) commit e7b602f43719fc6173ae86d2de8f6f07c6858ddd Author: Paulo Alcantara Date: Wed Nov 14 15:38:51 2018 -0200 cifs: Save TTL value when parsing DFS referrals This will be needed by DFS cache. Signed-off-by: Paulo Alcantara Reviewed-by: Aurelien Aptel Signed-off-by: Steve French fs/cifs/cifsglob.h | 1 + fs/cifs/misc.c | 2 ++ 2 files changed, 3 insertions(+) commit 5fc7fcd054adcf0f264446cbf778d33e30a45455 Author: Aurelien Aptel Date: Fri Nov 16 16:13:25 2018 +0100 cifs: auto disable 'serverino' in dfs mounts Different servers have different set of file ids. After failover, unique IDs will be different so we can't validate them. Signed-off-by: Aurelien Aptel Reviewed-by: Paulo Alcantara Signed-off-by: Steve French fs/cifs/connect.c | 6 ++++++ fs/cifs/inode.c | 42 +++++++++++++++++++----------------------- fs/cifs/misc.c | 12 ++++++++++-- 3 files changed, 35 insertions(+), 25 deletions(-) commit d9345e0ae7cff25e9aed39d21f092dbb482dffec Author: Paulo Alcantara Date: Wed Nov 14 14:18:22 2018 -0200 cifs: Make devname param optional in cifs_compose_mount_options() If we only want to get the mount options strings, do not return the devname. For DFS failover, we'll be passing the DFS full path down to cifs_mount() rather than the devname. Signed-off-by: Paulo Alcantara Reviewed-by: Aurelien Aptel Signed-off-by: Steve French fs/cifs/cifs_dfs_ref.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) commit c34fea5a636d98607ee6e41c78acc9d5ca8fb756 Author: Paulo Alcantara Date: Wed Nov 14 14:03:40 2018 -0200 cifs: Skip any trailing backslashes from UNC When extracting hostname from UNC, check for leading backslashes before trying to remove them. Signed-off-by: Paulo Alcantara Reviewed-by: Aurelien Aptel Signed-off-by: Steve French fs/cifs/connect.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 56c762eb9bee330bb4e6d11c589434f2904d3ab6 Author: Paulo Alcantara Date: Wed Nov 14 13:03:14 2018 -0200 cifs: Refactor out cifs_mount() * Split and refactor the very large function cifs_mount() in multiple functions: - tcp, ses and tcon setup to mount_get_conns() - tcp, ses and tcon cleanup in mount_put_conns() - tcon tlink setup to mount_setup_tlink() - remote path checking to is_path_remote() * Implement 2 version of cifs_mount() for DFS-enabled builds and non-DFS-enabled builds (CONFIG_CIFS_DFS_UPCALL). In preparation for DFS failover support. Signed-off-by: Paulo Alcantara Reviewed-by: Aurelien Aptel Signed-off-by: Steve French fs/cifs/cifsproto.h | 4 +- fs/cifs/connect.c | 441 ++++++++++++++++++++++++++++++---------------------- 2 files changed, 262 insertions(+), 183 deletions(-) commit 9a596f5b39593414c0ec80f71b94a226286f084e Author: Georgy A Bystrenin Date: Fri Dec 21 00:11:42 2018 -0600 CIFS: Fix error mapping for SMB2_LOCK command which caused OFD lock problem While resolving a bug with locks on samba shares found a strange behavior. When a file locked by one node and we trying to lock it from another node it fail with errno 5 (EIO) but in that case errno must be set to (EACCES | EAGAIN). This isn't happening when we try to lock file second time on same node. In this case it returns EACCES as expected. Also this issue not reproduces when we use SMB1 protocol (vers=1.0 in mount options). Further investigation showed that the mapping from status_to_posix_error is different for SMB1 and SMB2+ implementations. For SMB1 mapping is [NT_STATUS_LOCK_NOT_GRANTED to ERRlock] (See fs/cifs/netmisc.c line 66) but for SMB2+ mapping is [STATUS_LOCK_NOT_GRANTED to -EIO] (see fs/cifs/smb2maperror.c line 383) Quick changes in SMB2+ mapping from EIO to EACCES has fixed issue. BUG: https://bugzilla.kernel.org/show_bug.cgi?id=201971 Signed-off-by: Georgy A Bystrenin Reviewed-by: Pavel Shilovsky CC: Stable Signed-off-by: Steve French fs/cifs/smb2maperror.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 54e94ff94eac887ddb59cfd46b18896da5695e35 Author: Long Li Date: Sun Dec 16 22:41:07 2018 +0000 CIFS: return correct errors when pinning memory failed for direct I/O When pinning memory failed, we should return the correct error code and rewind the SMB credits. Reported-by: Murphy Zhou Signed-off-by: Long Li Cc: stable@vger.kernel.org Cc: Murphy Zhou Signed-off-by: Steve French fs/cifs/file.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit b6bc8a7b993e62f82415a5e3e4a6469e80fea19c Author: Long Li Date: Sun Dec 16 23:17:04 2018 +0000 CIFS: use the correct length when pinning memory for direct I/O for write The current code attempts to pin memory using the largest possible wsize based on the currect SMB credits. This doesn't cause kernel oops but this is not optimal as we may pin more pages then actually needed. Fix this by only pinning what are needed for doing this write I/O. Signed-off-by: Long Li Cc: stable@vger.kernel.org Signed-off-by: Steve French Reviewed-by: Joey Pabalinas fs/cifs/file.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 59a63e479ce36a3f24444c3a36efe82b78e4a8e0 Author: Ronnie Sahlberg Date: Thu Dec 13 08:06:16 2018 +1000 cifs: check ntwrk_buf_start for NULL before dereferencing it RHBZ: 1021460 There is an issue where when multiple threads open/close the same directory ntwrk_buf_start might end up being NULL, causing the call to smbCalcSize later to oops with a NULL deref. The real bug is why this happens and why this can become NULL for an open cfile, which should not be allowed. This patch tries to avoid a oops until the time when we fix the underlying issue. Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French fs/cifs/readdir.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit 52baa51d30573273341b78a3e3ed0d9a845d3e55 Author: Ronnie Sahlberg Date: Wed Dec 12 11:50:00 2018 +1000 cifs: remove coverity warning in calc_lanman_hash password_with_pad is a fixed size buffer of 16 bytes, it contains a password string, to be padded with \0 if shorter than 16 bytes but is just truncated if longer. It is not, and we do not depend on it to be, nul terminated. As such, do not use strncpy() to populate this buffer since the str* prefix suggests that this is a string, which it is not, and it also confuses coverity causing a false warning. Detected by CoverityScan CID#113743 ("Buffer not null terminated") Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French fs/cifs/cifsencrypt.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit 0f57451eebf1945790785df106497bf62812f62a Author: YueHaibing Date: Fri Dec 7 07:05:38 2018 +0000 cifs: remove set but not used variable 'smb_buf' Fixes gcc '-Wunused-but-set-variable' warning: fs/cifs/sess.c: In function '_sess_auth_rawntlmssp_assemble_req': fs/cifs/sess.c:1157:18: warning: variable 'smb_buf' set but not used [-Wunused-but-set-variable] It never used since commit cc87c47d9d7a ("cifs: Separate rawntlmssp auth from CIFS_SessSetup()") Signed-off-by: YueHaibing Signed-off-by: Steve French fs/cifs/sess.c | 2 -- 1 file changed, 2 deletions(-) commit 07fa6010ff939ef6c5a9ae0d230fdfd3bad82722 Author: Gustavo A. R. Silva Date: Tue Nov 27 10:01:51 2018 +1100 cifs: suppress some implicit-fallthrough warnings To avoid the warning: warning: this statement may fall through [-Wimplicit-fallthrough=] Signed-off-by: Gustavo A. R. Silva Reviewed-by: Stephen Rothwell Signed-off-by: Steve French fs/cifs/connect.c | 2 +- fs/cifs/sess.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit f9793b6fcc8ede4c2eb5f2d5816b1c8b4f927032 Author: Ronnie Sahlberg Date: Tue Nov 27 09:52:04 2018 +1000 cifs: change smb2_query_eas to use the compound query-info helper Reducing the number of network roundtrips improves the performance of query xattrs Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French fs/cifs/smb2ops.c | 105 +++++++++++++++++++++------------------------------- fs/cifs/smb2pdu.c | 12 ------ fs/cifs/smb2pdu.h | 1 - fs/cifs/smb2proto.h | 10 +++-- 4 files changed, 49 insertions(+), 79 deletions(-) commit 4a3b38aec5778f8eb37b2eb4701baffb1da4ccd5 Author: Kenneth D'souza Date: Sat Nov 17 10:33:30 2018 +0530 Add vers=3.0.2 as a valid option for SMBv3.0.2 Technically 3.02 is not the dialect name although that is more familiar to many, so we should also accept the official dialect name (3.0.2 vs. 3.02) in vers= Signed-off-by: Kenneth D'souza Signed-off-by: Steve French fs/cifs/cifsglob.h | 1 + fs/cifs/connect.c | 1 + 2 files changed, 2 insertions(+) commit 07d3b2e4264fb32bf82074311abc20c6de224d61 Author: Ronnie Sahlberg Date: Thu Dec 20 22:03:04 2018 -0600 cifs: create a helper function for compound query_info and convert statfs to use it. Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French fs/cifs/smb2ops.c | 82 +++++++++++++++++++++++++++++++++++++------------------ 1 file changed, 56 insertions(+), 26 deletions(-) commit 97aa495a89a631822431b789b8553b81e3460255 Author: Steve French Date: Thu Nov 15 00:33:05 2018 -0600 cifs: address trivial coverity warning This is not actually a bug but as Coverity points out we shouldn't be doing an "|=" on a value which hasn't been set (although technically it was memset to zero so isn't a bug) and so might as well change "|=" to "=" in this line Detected by CoverityScan, CID#728535 ("Unitialized scalar variable") Signed-off-by: Steve French Reviewed-by: Ronnie Sahlberg fs/cifs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f5942db5ef25531d53f2aa2ff84a46e1763b4196 Author: Steve French Date: Wed Nov 14 01:37:39 2018 -0600 cifs: smb2 commands can not be negative, remove confusing check As Coverity points out le16_to_cpu(midEntry->Command) can not be less than zero. Detected by CoverityScan, CID#1438650 ("Macro compares unsigned to 0") Signed-off-by: Steve French Reviewed-by: Ronnie Sahlberg fs/cifs/transport.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit 0967e5457954370cc4e9902bd47b142e9655365f Author: Ronnie Sahlberg Date: Tue Nov 6 22:52:43 2018 +1000 cifs: use a compound for setting an xattr Improve performance by reducing number of network round trips for set xattr. Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French fs/cifs/smb2ops.c | 88 +++++++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 70 insertions(+), 18 deletions(-) commit 5890255b83f3ce9ef9202804dfab744033c0e603 Author: Colin Ian King Date: Sat Nov 3 15:59:44 2018 +0000 cifs: clean up indentation, replace spaces with tab Trivial fix to clean up indentation, replace spaces with tab Signed-off-by: Colin Ian King Signed-off-by: Steve French fs/cifs/cifsencrypt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 12526b0d6c580df860b31e59d68e5696e16c6e5b Merge: 9bbc7e4ce47e 63d86876f324 Author: Michael Ellerman Date: Mon Dec 24 14:14:45 2018 +1100 Merge branch 'next' of https://git.kernel.org/pub/scm/linux/kernel/git/scottwood/linux into next Freescale updates from Scott: "Highlights include elimination of legacy clock bindings use from dts files, an 83xx watchdog handler, fixes to old dts interrupt errors, and some minor cleanup." commit 63d86876f32440a45b6f9d42ab2fb7f68b3a8bf7 Author: Scott Wood Date: Sun Dec 23 20:09:39 2018 -0600 Revert "powerpc/fsl_pci: simplify fsl_pci_dma_set_mask" This reverts commit c6e5485e0cb509292a14e880e1944143f99758c7 due to failures such as: e1000e 2000:01:00.0: Tx DMA map failed Signed-off-by: Scott Wood arch/powerpc/sysdev/fsl_pci.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit f2ab95814103314af3239d322e382c61c69a788d Author: David S. Miller Date: Sun Dec 23 16:01:35 2018 -0800 net: Revert recent Spectre-v1 patches. This reverts: 50d5258634ae ("net: core: Fix Spectre v1 vulnerability") d686026b1e6e ("phonet: af_phonet: Fix Spectre v1 vulnerability") a95386f0390a ("nfc: af_nfc: Fix Spectre v1 vulnerability") a3ac5817ffe8 ("can: af_can: Fix Spectre v1 vulnerability") After some discussion with Alexei Starovoitov these all seem to be completely unnecessary. Signed-off-by: David S. Miller net/can/af_can.c | 2 -- net/core/filter.c | 2 -- net/nfc/af_nfc.c | 2 -- net/phonet/af_phonet.c | 3 --- 4 files changed, 9 deletions(-) commit 0b15394475e3bcaf35ca4bf22fc55d56df67224e Author: Stefan Roese Date: Mon Dec 17 10:47:48 2018 +0100 MIPS: ralink: Select CONFIG_CPU_MIPSR2_IRQ_VI on MT7620/8 Testing has shown, that when using mainline U-Boot on MT7688 based boards, the system may hang or crash while mounting the root-fs. The main issue here is that mainline U-Boot configures EBase to a value near the end of system memory. And with CONFIG_CPU_MIPSR2_IRQ_VI disabled, trap_init() will not allocate a new area to place the exception handler. The original value will be used and the handler will be copied to this location, which might already be used by some userspace application. The MT7688 supports VI - its config3 register is 0x00002420, so VInt (Bit 5) is set. But without setting CONFIG_CPU_MIPSR2_IRQ_VI this bit will not be evaluated to result in "cpu_has_vi" being set. This patch now selects CONFIG_CPU_MIPSR2_IRQ_VI on MT7620/8 which results trap_init() to allocate some memory for the exception handler. Please note that this issue was not seen with the Mediatek U-Boot version, as it does not touch EBase (stays at default of 0x8000.0000). This is strictly also not correct as the kernel (_text) resides here. Signed-off-by: Stefan Roese [paul.burton@mips.com: s/beeing/being/] Signed-off-by: Paul Burton Cc: John Crispin Cc: Daniel Schwierzeck Cc: Ralf Baechle Cc: linux-mips@linux-mips.org arch/mips/ralink/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 9bd2f7eeaed129627a609b5c98098f0fd7805d24 Author: Alexandre Belloni Date: Tue Dec 18 15:26:36 2018 +0100 MAINTAINERS: Add a maintainer for MSCC MIPS SoCs Microsemi has been bought by Microchip and Microchip is supporting those SoCs. Signed-off-by: Alexandre Belloni Acked-by: Woojung Huh Signed-off-by: Paul Burton Cc: James Hogan Cc: Ralf Baechle Cc: linux-kernel@vger.kernel.org MAINTAINERS | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 994bc7fae916f8783ea7d357f1ccd6b3a67919f7 Author: Manuel Lauss Date: Wed Dec 19 08:08:03 2018 +0100 MIPS: Alchemy: update dma masks for devboard devices Fix the DMA masks for sound and mmc devices. Verified on DB1300 and DB1500. Signed-off-by: Manuel Lauss Signed-off-by: Paul Burton Cc: Linux-MIPS arch/mips/alchemy/devboards/db1000.c | 18 +++++++++++------- arch/mips/alchemy/devboards/db1200.c | 24 +++++++++++------------- arch/mips/alchemy/devboards/db1300.c | 23 +++++++++++++++++++---- arch/mips/alchemy/devboards/db1550.c | 13 +++++++++++-- 4 files changed, 52 insertions(+), 26 deletions(-) commit 7a3097be955efd979e96ced5edab651a4c09d42f Author: Manuel Lauss Date: Wed Dec 19 08:08:02 2018 +0100 MIPS: Alchemy: update cpu-feature-overrides No shiny new stuff for Alchemy. Tested on DB1300 and DB1500. Signed-off-by: Manuel Lauss Signed-off-by: Paul Burton Cc: Linux-MIPS arch/mips/include/asm/mach-au1x00/cpu-feature-overrides.h | 3 +++ 1 file changed, 3 insertions(+) commit e898d084eae086762406d487b3e81185c47de35d Author: Manuel Lauss Date: Wed Dec 19 08:08:01 2018 +0100 MIPS: Alchemy: drop DB1000 IrDA support bits The IrDA drivers are gone, drop the now unused DB1000 board support for it. Signed-off-by: Manuel Lauss Signed-off-by: Paul Burton Cc: Linux-MIPS arch/mips/alchemy/devboards/db1000.c | 58 ------------------------------------ 1 file changed, 58 deletions(-) commit bbb8a75208937beee3bba746da7addb194588619 Author: Manuel Lauss Date: Wed Dec 19 08:07:59 2018 +0100 MIPS: alchemy: cpu_all_mask is forbidden for clock event devices change alchemy clock event device cpu_all_mask to cpu_possible_mask. Gets rid of a warning, which then does the same substitution: WARNING: CPU: 0 PID: 0 at kernel/time/clockevents.c:468 clockevents_register_device+0x130/0x140 rtcmatch2 cpumask == cpu_all_mask, using cpu_possible_mask instead Signed-off-by: Manuel Lauss Signed-off-by: Paul Burton Cc: Linux-MIPS arch/mips/alchemy/common/time.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8a38dacf87180738d42b058334c951eba15d2d47 Author: Jonas Gorski Date: Mon Dec 10 12:40:38 2018 +0100 MIPS: BCM63XX: fix switch core reset on BCM6368 The Ethernet Switch core mask was set to 0, causing the switch core to be not reset on BCM6368 on boot. Provide the proper mask so the switch core gets reset to a known good state. Fixes: 799faa626c71 ("MIPS: BCM63XX: add core reset helper") Signed-off-by: Jonas Gorski Signed-off-by: Paul Burton Cc: linux-mips@vger.kernel.org Cc: Ralf Baechle Cc: James Hogan Cc: Florian Fainelli arch/mips/bcm63xx/reset.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c79b411eaa7257204f89c30651c45cea22278769 Author: Eric Biggers Date: Sun Dec 16 15:55:06 2018 -0800 crypto: skcipher - remove remnants of internal IV generators Remove dead code related to internal IV generators, which are no longer used since they've been replaced with the "seqiv" and "echainiv" templates. The removed code includes: - The "givcipher" (GIVCIPHER) algorithm type. No algorithms are registered with this type anymore, so it's unneeded. - The "const char *geniv" member of aead_alg, ablkcipher_alg, and blkcipher_alg. A few algorithms still set this, but it isn't used anymore except to show via /proc/crypto and CRYPTO_MSG_GETALG. Just hardcode "" or "" in those cases. - The 'skcipher_givcrypt_request' structure, which is never used. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu Documentation/crypto/api.rst | 9 ----- Documentation/crypto/architecture.rst | 31 +++----------- crypto/ablkcipher.c | 76 +---------------------------------- crypto/blkcipher.c | 6 +-- crypto/cryptd.c | 4 +- crypto/ctr.c | 2 - crypto/skcipher.c | 6 +-- drivers/crypto/bcm/cipher.c | 1 - drivers/crypto/chelsio/chcr_algo.c | 1 - drivers/crypto/ixp4xx_crypto.c | 5 --- drivers/crypto/nx/nx-aes-ctr.c | 1 - drivers/crypto/omap-aes.c | 1 - drivers/crypto/picoxcell_crypto.c | 3 +- drivers/crypto/talitos.c | 1 - include/crypto/aead.h | 3 -- include/crypto/internal/skcipher.h | 2 - include/crypto/skcipher.h | 13 ------ include/linux/crypto.h | 34 ++-------------- 18 files changed, 17 insertions(+), 182 deletions(-) commit dec5d0db0de7271c7616d713f6c434c6366c9bfb Author: Eric Biggers Date: Sun Dec 16 15:00:30 2018 -0800 crypto: cavium/nitrox - Fix build with !CONFIG_DEBUG_FS Fixes: cf718eaa8f9b ("crypto: cavium/nitrox - Enabled Mailbox support") Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu drivers/crypto/cavium/nitrox/nitrox_debugfs.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 101b53d91d57ebcc13cb5fbd437b1230457ba9e2 Author: Eric Biggers Date: Sat Dec 15 12:42:52 2018 -0800 crypto: salsa20-generic - don't unnecessarily use atomic walk salsa20-generic doesn't use SIMD instructions or otherwise disable preemption, so passing atomic=true to skcipher_walk_virt() is unnecessary. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu crypto/salsa20_generic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bb648291fc04c49197561939b8bfea0ada42bce3 Author: Eric Biggers Date: Sat Dec 15 12:41:53 2018 -0800 crypto: skcipher - add might_sleep() to skcipher_walk_virt() skcipher_walk_virt() can still sleep even with atomic=true, since that only affects the later calls to skcipher_walk_done(). But, skcipher_walk_virt() only has to allocate memory for some input data layouts, so incorrectly calling it with preemption disabled can go undetected. Use might_sleep() so that it's detected reliably. Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu crypto/skcipher.c | 2 ++ 1 file changed, 2 insertions(+) commit f9c9bdb5131eee60dc3b92e5126d4c0e291703e2 Author: Eric Biggers Date: Sat Dec 15 12:40:17 2018 -0800 crypto: x86/chacha - avoid sleeping under kernel_fpu_begin() Passing atomic=true to skcipher_walk_virt() only makes the later skcipher_walk_done() calls use atomic memory allocations, not skcipher_walk_virt() itself. Thus, we have to move it outside of the preemption-disabled region (kernel_fpu_begin()/kernel_fpu_end()). (skcipher_walk_virt() only allocates memory for certain layouts of the input scatterlist, hence why I didn't notice this earlier...) Reported-by: syzbot+9bf843c33f782d73ae7d@syzkaller.appspotmail.com Fixes: 4af78261870a ("crypto: x86/chacha20 - add XChaCha20 support") Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu arch/x86/crypto/chacha_glue.c | 33 ++++++++++++++++++++------------- 1 file changed, 20 insertions(+), 13 deletions(-) commit c9613335bf4fe259a654aa0e9701f0c4cddc12ba Author: Nagadheeraj Rottela Date: Fri Dec 14 11:19:51 2018 +0000 crypto: cavium/nitrox - Added AEAD cipher support Added support to offload AEAD ciphers to NITROX. Currently supported AEAD cipher is 'gcm(aes)'. Signed-off-by: Nagadheeraj Rottela Reviewed-by: Srikanth Jampala Signed-off-by: Herbert Xu drivers/crypto/cavium/nitrox/Makefile | 4 +- drivers/crypto/cavium/nitrox/nitrox_aead.c | 364 ++++++++++++++++ drivers/crypto/cavium/nitrox/nitrox_algs.c | 559 +------------------------ drivers/crypto/cavium/nitrox/nitrox_common.h | 6 +- drivers/crypto/cavium/nitrox/nitrox_req.h | 239 +++++++++-- drivers/crypto/cavium/nitrox/nitrox_reqmgr.c | 38 +- drivers/crypto/cavium/nitrox/nitrox_skcipher.c | 498 ++++++++++++++++++++++ 7 files changed, 1103 insertions(+), 605 deletions(-) commit 2326828ee40357b3d2b1359b8ca7526af201495b Author: Fabio Estevam Date: Thu Dec 13 07:52:32 2018 -0200 crypto: mxc-scc - fix build warnings on ARM64 The following build warnings are seen when building for ARM64 allmodconfig: drivers/crypto/mxc-scc.c:181:20: warning: format '%d' expects argument of type 'int', but argument 5 has type 'size_t' {aka 'long unsigned int'} [-Wformat=] drivers/crypto/mxc-scc.c:186:21: warning: format '%d' expects argument of type 'int', but argument 4 has type 'size_t' {aka 'long unsigned int'} [-Wformat=] drivers/crypto/mxc-scc.c:277:21: warning: format '%d' expects argument of type 'int', but argument 4 has type 'size_t' {aka 'long unsigned int'} [-Wformat=] drivers/crypto/mxc-scc.c:339:3: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] drivers/crypto/mxc-scc.c:340:3: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] Fix them by using the %zu specifier to print a size_t variable and using a plain %x to print the result of a readl(). Signed-off-by: Fabio Estevam Signed-off-by: Herbert Xu drivers/crypto/mxc-scc.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit bfad6cb3f8295559216690e1eb9c99003a79b3a0 Author: Corentin Labbe Date: Thu Dec 13 08:36:38 2018 +0000 crypto: api - document missing stats member This patchs adds missing member of stats documentation. Signed-off-by: Corentin Labbe Signed-off-by: Herbert Xu include/linux/crypto.h | 7 +++++++ 1 file changed, 7 insertions(+) commit 0c99c2a087c60b71e1fc90d070e2e16ca52defbe Author: Corentin Labbe Date: Thu Dec 13 08:36:37 2018 +0000 crypto: user - remove unused dump functions This patch removes unused dump functions for crypto_user_stats. There are remains of the copy/paste of crypto_user_base to crypto_user_stat and I forgot to remove them. Signed-off-by: Corentin Labbe Signed-off-by: Herbert Xu crypto/crypto_user_base.c | 4 +--- crypto/crypto_user_stat.c | 33 --------------------------------- include/crypto/internal/cryptouser.h | 12 ------------ 3 files changed, 1 insertion(+), 48 deletions(-) commit f31ba0f95f1998118098978dbfb25ecbec6b0891 Author: Harsh Jain Date: Tue Dec 11 16:21:42 2018 +0530 crypto: chelsio - Fix wrong error counter increments Fix error counter increment in AEAD decrypt operation when validation of tag is done in Driver instead of H/W. Signed-off-by: Harsh Jain Signed-off-by: Herbert Xu drivers/crypto/chelsio/chcr_algo.c | 9 +++++---- drivers/crypto/chelsio/chcr_core.c | 11 +++++------ 2 files changed, 10 insertions(+), 10 deletions(-) commit 6501ab5ed4d925cce4c2a1c49b63583c42e65bd8 Author: Harsh Jain Date: Tue Dec 11 16:21:41 2018 +0530 crypto: chelsio - Reset counters on cxgb4 Detach Reset the counters on receiving detach from Cxgb4. Signed-off-by: Atul Gupta Signed-off-by: Herbert Xu drivers/crypto/chelsio/chcr_core.c | 4 ++++ 1 file changed, 4 insertions(+) commit fef4912b66d6246d958d97382d20d0dd23bcf0bc Author: Harsh Jain Date: Tue Dec 11 16:21:40 2018 +0530 crypto: chelsio - Handle PCI shutdown event chcr receives "CXGB4_STATE_DETACH" event on PCI Shutdown. Wait for processing of inflight request and Mark the device unavailable. Signed-off-by: Harsh Jain Signed-off-by: Herbert Xu drivers/crypto/chelsio/chcr_algo.c | 157 ++++++++++++++++++++++++++------ drivers/crypto/chelsio/chcr_core.c | 180 ++++++++++++++++++++++++------------- drivers/crypto/chelsio/chcr_core.h | 34 +++++-- 3 files changed, 278 insertions(+), 93 deletions(-) commit c4f6d44d774eff382b6fc79a9fe1ff376b5ac6d7 Author: Harsh Jain Date: Tue Dec 11 16:21:39 2018 +0530 crypto: chelsio - cleanup:send addr as value in function argument Send dma address as value to function arguments instead of pointer. Signed-off-by: Harsh Jain Signed-off-by: Herbert Xu drivers/crypto/chelsio/chcr_algo.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) commit d5a4dfbdaf54cbd845755a5415cff57688bb983c Author: Harsh Jain Date: Tue Dec 11 16:21:38 2018 +0530 crypto: chelsio - Use same value for both channel in single WR Use tx_channel_id instead of rx_channel_id. Signed-off-by: Harsh Jain Signed-off-by: Herbert Xu drivers/crypto/chelsio/chcr_algo.c | 13 ++++++------- drivers/crypto/chelsio/chcr_core.h | 1 - 2 files changed, 6 insertions(+), 8 deletions(-) commit 1f479e4cfd08f20e48dfde07b27e3180e0901252 Author: Harsh Jain Date: Tue Dec 11 16:21:37 2018 +0530 crypto: chelsio - Swap location of AAD and IV sent in WR Send input as IV | AAD | Data. It will allow sending IV as Immediate Data and Creates space in Work request to add more dma mapped entries. Signed-off-by: Harsh Jain Signed-off-by: Herbert Xu drivers/crypto/chelsio/chcr_algo.c | 212 +++++++++++++++++------------------ drivers/crypto/chelsio/chcr_algo.h | 2 +- drivers/crypto/chelsio/chcr_crypto.h | 10 +- 3 files changed, 104 insertions(+), 120 deletions(-) commit 3cc04c160208ec55940db652343d236515d88af5 Author: YueHaibing Date: Tue Dec 11 08:11:59 2018 +0000 crypto: chelsio - remove set but not used variable 'kctx_len' Fixes gcc '-Wunused-but-set-variable' warning: drivers/crypto/chelsio/chcr_ipsec.c: In function 'chcr_ipsec_xmit': drivers/crypto/chelsio/chcr_ipsec.c:674:33: warning: variable 'kctx_len' set but not used [-Wunused-but-set-variable] unsigned int flits = 0, ndesc, kctx_len; It not used since commit 8362ea16f69f ("crypto: chcr - ESN for Inline IPSec Tx") Signed-off-by: YueHaibing Signed-off-by: Herbert Xu drivers/crypto/chelsio/chcr_ipsec.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 5ac93f808338f4dd465402e91869702eb87db241 Author: Nathan Chancellor Date: Mon Dec 10 16:49:54 2018 -0700 crypto: ux500 - Use proper enum in hash_set_dma_transfer Clang warns when one enumerated type is implicitly converted to another: drivers/crypto/ux500/hash/hash_core.c:169:4: warning: implicit conversion from enumeration type 'enum dma_data_direction' to different enumeration type 'enum dma_transfer_direction' [-Wenum-conversion] direction, DMA_CTRL_ACK | DMA_PREP_INTERRUPT); ^~~~~~~~~ 1 warning generated. dmaengine_prep_slave_sg expects an enum from dma_transfer_direction. We know that the only direction supported by this function is DMA_TO_DEVICE because of the check at the top of this function so we can just use the equivalent value from dma_transfer_direction. DMA_TO_DEVICE = DMA_MEM_TO_DEV = 1 Signed-off-by: Nathan Chancellor Reviewed-by: Nick Desaulniers Signed-off-by: Herbert Xu drivers/crypto/ux500/hash/hash_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9d880c5945c748d8edcac30965f3349a602158c4 Author: Nathan Chancellor Date: Mon Dec 10 16:49:29 2018 -0700 crypto: ux500 - Use proper enum in cryp_set_dma_transfer Clang warns when one enumerated type is implicitly converted to another: drivers/crypto/ux500/cryp/cryp_core.c:559:5: warning: implicit conversion from enumeration type 'enum dma_data_direction' to different enumeration type 'enum dma_transfer_direction' [-Wenum-conversion] direction, DMA_CTRL_ACK); ^~~~~~~~~ drivers/crypto/ux500/cryp/cryp_core.c:583:5: warning: implicit conversion from enumeration type 'enum dma_data_direction' to different enumeration type 'enum dma_transfer_direction' [-Wenum-conversion] direction, ^~~~~~~~~ 2 warnings generated. dmaengine_prep_slave_sg expects an enum from dma_transfer_direction. Because we know the value of the dma_data_direction enum from the switch statement, we can just use the proper value from dma_transfer_direction so there is no more conversion. DMA_TO_DEVICE = DMA_MEM_TO_DEV = 1 DMA_FROM_DEVICE = DMA_DEV_TO_MEM = 2 Signed-off-by: Nathan Chancellor Reviewed-by: Nick Desaulniers Signed-off-by: Herbert Xu drivers/crypto/ux500/cryp/cryp_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 603f8c3b0dbbe21fabb7e005f57883b21aaadd82 Author: Dave Watson Date: Mon Dec 10 19:59:59 2018 +0000 crypto: aesni - Add scatter/gather avx stubs, and use them in C Add the appropriate scatter/gather stubs to the avx asm. In the C code, we can now always use crypt_by_sg, since both sse and asm code now support scatter/gather. Introduce a new struct, aesni_gcm_tfm, that is initialized on startup to point to either the SSE, AVX, or AVX2 versions of the four necessary encryption/decryption routines. GENX_OPTSIZE is still checked at the start of crypt_by_sg. The total size of the data is checked, since the additional overhead is in the init function, calculating additional HashKeys. Signed-off-by: Dave Watson Signed-off-by: Herbert Xu arch/x86/crypto/aesni-intel_avx-x86_64.S | 181 +++++++++------- arch/x86/crypto/aesni-intel_glue.c | 349 +++++++++---------------------- 2 files changed, 198 insertions(+), 332 deletions(-) commit e044d5056396029cc12ed5354aa2a073b747195a Author: Dave Watson Date: Mon Dec 10 19:59:38 2018 +0000 crypto: aesni - Introduce partial block macro Before this diff, multiple calls to GCM_ENC_DEC will succeed, but only if all calls are a multiple of 16 bytes. Handle partial blocks at the start of GCM_ENC_DEC, and update aadhash as appropriate. The data offset %r11 is also updated after the partial block. Signed-off-by: Dave Watson Signed-off-by: Herbert Xu arch/x86/crypto/aesni-intel_avx-x86_64.S | 156 +++++++++++++++++++++++++++++-- 1 file changed, 150 insertions(+), 6 deletions(-) commit ec8c02d9a30b8324d7aae9e4e7a08973a8eaa8b4 Author: Dave Watson Date: Mon Dec 10 19:59:26 2018 +0000 crypto: aesni - Introduce READ_PARTIAL_BLOCK macro Introduce READ_PARTIAL_BLOCK macro, and use it in the two existing partial block cases: AAD and the end of ENC_DEC. In particular, the ENC_DEC case should be faster, since we read by 8/4 bytes if possible. This macro will also be used to read partial blocks between enc_update and dec_update calls. Signed-off-by: Dave Watson Signed-off-by: Herbert Xu arch/x86/crypto/aesni-intel_avx-x86_64.S | 102 ++++++++++++++++++------------- 1 file changed, 59 insertions(+), 43 deletions(-) commit 517a448e09846732d46e983a2195002d05857919 Author: Dave Watson Date: Mon Dec 10 19:59:11 2018 +0000 crypto: aesni - Move ghash_mul to GCM_COMPLETE Prepare to handle partial blocks between scatter/gather calls. For the last partial block, we only want to calculate the aadhash in GCM_COMPLETE, and a new partial block macro will handle both aadhash update and encrypting partial blocks between calls. Signed-off-by: Dave Watson Signed-off-by: Herbert Xu arch/x86/crypto/aesni-intel_avx-x86_64.S | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) commit a44b419fe5aee3bfe12c88698a023cb5c6067985 Author: Dave Watson Date: Mon Dec 10 19:58:56 2018 +0000 crypto: aesni - Fill in new context data structures Fill in aadhash, aadlen, pblocklen, curcount with appropriate values. pblocklen, aadhash, and pblockenckey are also updated at the end of each scatter/gather operation, to be carried over to the next operation. Signed-off-by: Dave Watson Signed-off-by: Herbert Xu arch/x86/crypto/aesni-intel_avx-x86_64.S | 51 +++++++++++++++++++++++--------- 1 file changed, 37 insertions(+), 14 deletions(-) commit 1cb1bcbb567d10bdd9de9d03964c5e2958f0d111 Author: Dave Watson Date: Mon Dec 10 19:58:38 2018 +0000 crypto: aesni - Merge avx precompute functions The precompute functions differ only by the sub-macros they call, merge them to a single macro. Later diffs add more code to fill in the gcm_context_data structure, this allows changes in a single place. Signed-off-by: Dave Watson Signed-off-by: Herbert Xu arch/x86/crypto/aesni-intel_avx-x86_64.S | 76 ++++++++++++-------------------- 1 file changed, 27 insertions(+), 49 deletions(-) commit 38003cd26c9f59da77d98927fb9af58732da207a Author: Dave Watson Date: Mon Dec 10 19:58:19 2018 +0000 crypto: aesni - Split AAD hash calculation to separate macro AAD hash only needs to be calculated once for each scatter/gather operation. Move it to its own macro, and call it from GCM_INIT instead of INITIAL_BLOCKS. Signed-off-by: Dave Watson Signed-off-by: Herbert Xu arch/x86/crypto/aesni-intel_avx-x86_64.S | 228 +++++++++++++------------------ arch/x86/crypto/aesni-intel_glue.c | 28 ++-- 2 files changed, 115 insertions(+), 141 deletions(-) commit e377bedb09d6970ad27d7714b0a6365ee7e4d732 Author: Dave Watson Date: Mon Dec 10 19:57:49 2018 +0000 crypto: aesni - Add GCM_COMPLETE macro Merge encode and decode tag calculations in GCM_COMPLETE macro. Scatter/gather routines will call this once at the end of encryption or decryption. Signed-off-by: Dave Watson Signed-off-by: Herbert Xu arch/x86/crypto/aesni-intel_avx-x86_64.S | 8 ++++++++ 1 file changed, 8 insertions(+) commit 5350b0f563433dacc134214a452fd316b36251d6 Author: Dave Watson Date: Mon Dec 10 19:57:36 2018 +0000 crypto: aesni - support 256 byte keys in avx asm Add support for 192/256-bit keys using the avx gcm/aes routines. The sse routines were previously updated in e31ac32d3b (Add support for 192 & 256 bit keys to AESNI RFC4106). Instead of adding an additional loop in the hotpath as in e31ac32d3b, this diff instead generates separate versions of the code using macros, and the entry routines choose which version once. This results in a 5% performance improvement vs. adding a loop to the hot path. This is the same strategy chosen by the intel isa-l_crypto library. The key size checks are removed from the c code where appropriate. Note that this diff depends on using gcm_context_data - 256 bit keys require 16 HashKeys + 15 expanded keys, which is larger than struct crypto_aes_ctx, so they are stored in struct gcm_context_data. Signed-off-by: Dave Watson Signed-off-by: Herbert Xu arch/x86/crypto/aesni-intel_avx-x86_64.S | 188 +++++++++++++++++++++++-------- arch/x86/crypto/aesni-intel_glue.c | 18 +-- 2 files changed, 145 insertions(+), 61 deletions(-) commit 2426f64bc51fc86951b735d2247d6eb89259d580 Author: Dave Watson Date: Mon Dec 10 19:57:12 2018 +0000 crypto: aesni - Macro-ify func save/restore Macro-ify function save and restore. These will be used in new functions added for scatter/gather update operations. Signed-off-by: Dave Watson Signed-off-by: Herbert Xu arch/x86/crypto/aesni-intel_avx-x86_64.S | 94 ++++++++++++-------------------- 1 file changed, 36 insertions(+), 58 deletions(-) commit de85fc46b1037099c78d2fec08a662079e568d62 Author: Dave Watson Date: Mon Dec 10 19:57:00 2018 +0000 crypto: aesni - Introduce gcm_context_data Add the gcm_context_data structure to the avx asm routines. This will be necessary to support both 256 bit keys and scatter/gather. The pre-computed HashKeys are now stored in the gcm_context_data struct, which is expanded to hold the greater number of hashkeys necessary for avx. Loads and stores to the new struct are always done unlaligned to avoid compiler issues, see e5b954e8 "Use unaligned loads from gcm_context_data" Signed-off-by: Dave Watson Signed-off-by: Herbert Xu arch/x86/crypto/aesni-intel_avx-x86_64.S | 378 +++++++++++++++---------------- arch/x86/crypto/aesni-intel_glue.c | 58 +++-- 2 files changed, 215 insertions(+), 221 deletions(-) commit f9b1d64678607e132051d232c7a2127f32947d64 Author: Dave Watson Date: Mon Dec 10 19:56:45 2018 +0000 crypto: aesni - Merge GCM_ENC_DEC The GCM_ENC_DEC routines for AVX and AVX2 are identical, except they call separate sub-macros. Pass the macros as arguments, and merge them. This facilitates additional refactoring, by requiring changes in only one place. The GCM_ENC_DEC macro was moved above the CONFIG_AS_AVX* ifdefs, since it will be used by both AVX and AVX2. Signed-off-by: Dave Watson Signed-off-by: Herbert Xu arch/x86/crypto/aesni-intel_avx-x86_64.S | 2481 +++++++++++++----------------- 1 file changed, 1083 insertions(+), 1398 deletions(-) commit 3d739c1f6156c70eb0548aa288dcfbac9e0bd162 Author: Steven Rostedt (VMware) Date: Fri Dec 21 23:10:26 2018 -0500 tracing: Use the return of str_has_prefix() to remove open coded numbers There are several locations that compare constants to the beginning of string variables to determine what commands should be done, then the constant length is used to index into the string. This is error prone as the hard coded numbers have to match the size of the constants. Instead, use the len returned from str_has_prefix() and remove the open coded string length sizes. Cc: Joe Perches Acked-by: Masami Hiramatsu (for trace_probe part) Acked-by: Namhyung Kim Signed-off-by: Steven Rostedt (VMware) kernel/trace/trace.c | 8 +++++--- kernel/trace/trace_probe.c | 17 +++++++++-------- kernel/trace/trace_stack.c | 6 ++++-- 3 files changed, 18 insertions(+), 13 deletions(-) commit 036876fa56204ae0fa59045bd6bbb2691a060633 Author: Steven Rostedt (VMware) Date: Fri Dec 21 18:40:46 2018 -0500 tracing: Have the historgram use the result of str_has_prefix() for len of prefix As str_has_prefix() returns the length on match, we can use that for the updating of the string pointer instead of recalculating the prefix size. Cc: Tom Zanussi Acked-by: Namhyung Kim Signed-off-by: Steven Rostedt (VMware) kernel/trace/trace_events_hist.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit b6b2735514bcd70ad1556a33892a636b20ece671 Author: Steven Rostedt (VMware) Date: Thu Dec 20 13:20:07 2018 -0500 tracing: Use str_has_prefix() instead of using fixed sizes There are several instances of strncmp(str, "const", 123), where 123 is the strlen of the const string to check if "const" is the prefix of str. But this can be error prone. Use str_has_prefix() instead. Acked-by: Namhyung Kim Signed-off-by: Steven Rostedt (VMware) kernel/trace/trace.c | 2 +- kernel/trace/trace_events.c | 2 +- kernel/trace/trace_events_hist.c | 2 +- kernel/trace/trace_probe.c | 4 ++-- kernel/trace/trace_stack.c | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) commit 754481e6954cbef53f8bc4412ad48dde611e21d3 Author: Steven Rostedt (VMware) Date: Wed Dec 19 22:38:21 2018 -0500 tracing: Use str_has_prefix() helper for histogram code The tracing histogram code contains a lot of instances of the construct: strncmp(str, "const", sizeof("const") - 1) This can be prone to bugs due to typos or bad cut and paste. Use the str_has_prefix() helper macro instead that removes the need for having two copies of the constant string. Cc: Tom Zanussi Acked-by: Namhyung Kim Signed-off-by: Steven Rostedt (VMware) kernel/trace/trace_events_hist.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) commit 72921427d46bf9731a1ab7864adc64c43dfae29f Author: Steven Rostedt (VMware) Date: Fri Dec 21 18:10:14 2018 -0500 string.h: Add str_has_prefix() helper function A discussion came up in the trace triggers thread about converting a bunch of: strncmp(str, "const", sizeof("const") - 1) use cases into a helper macro. It started with: strncmp(str, const, sizeof(const) - 1) But then Joe Perches mentioned that if a const is not used, the sizeof() will be the size of a pointer, which can be bad. And that gcc will optimize strlen("const") into "sizeof("const") - 1". Thinking about this more, a quick grep in the kernel tree found several (thousands!) of cases that use this construct. A quick grep also revealed that there's probably several bugs in that use case. Some are that people forgot the "- 1" (which I found) and others could be that the constant for the sizeof is different than the constant (although, I haven't found any of those, but I also didn't look hard). I figured the best thing to do is to create a helper macro and place it into include/linux/string.h. And go around and fix all the open coded versions of it later. Note, gcc appears to optimize this when we make it into an always_inline static function, which removes a lot of issues that a macro produces. Link: http://lkml.kernel.org/r/e3e754f2bd18e56eaa8baf79bee619316ebf4cfc.1545161087.git.tom.zanussi@linux.intel.com Link: http://lkml.kernel.org/r/20181219211615.2298e781@gandalf.local.home Link: http://lkml.kernel.org/r/CAHk-=wg_sR-UEC1ggmkZpypOUYanL5CMX4R7ceuaV4QMf5jBtg@mail.gmail.com Cc: Tom Zanussi Cc: Greg Kroah-Hartman Acked-by: Namhyung Kim Suggestions-by: Linus Torvalds Suggestions-by: Joe Perches Suggestions-by: Andreas Schwab Signed-off-by: Steven Rostedt (VMware) include/linux/string.h | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) commit a3ac5817ffe8f81dbe6be1522b499b48bc322e3a Author: Gustavo A. R. Silva Date: Fri Dec 21 15:22:29 2018 -0600 can: af_can: Fix Spectre v1 vulnerability protocol is indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. This issue was detected with the help of Smatch: net/can/af_can.c:115 can_get_proto() warn: potential spectre issue 'proto_tab' [w] Fix this by sanitizing protocol before using it to index proto_tab. Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 Signed-off-by: Gustavo A. R. Silva Signed-off-by: David S. Miller net/can/af_can.c | 2 ++ 1 file changed, 2 insertions(+) commit 11fda148040bb987949f9b957aceb483407e32cb Author: Masahiro Yamada Date: Sat Dec 22 18:50:35 2018 +0900 kbuild: remove $(obj)/ prefixes in ./Kbuild Adding $(obj)/ to file paths relative from the top objtree looks a bit redundant to me. This commit has no functional change since $(obj) is '.' in this file. Signed-off-by: Masahiro Yamada Kbuild | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 2c667d77fc02dd453c49b9c29d08a8bb55d60ebe Author: Masahiro Yamada Date: Sat Dec 22 18:50:34 2018 +0900 treewide: add intermediate .s files to targets Avoid unneeded recreation of these in the incremental build. Signed-off-by: Masahiro Yamada arch/arm/mach-at91/Makefile | 2 ++ arch/arm/mach-omap2/Makefile | 2 ++ arch/ia64/kernel/Makefile | 2 ++ arch/x86/um/Makefile | 1 + drivers/memory/Makefile.asm-offsets | 2 ++ samples/bpf/Makefile | 1 + 6 files changed, 10 insertions(+) commit 4d4b5c2e3b6e6137c36cc13fe0d03404205afbd0 Author: Masahiro Yamada Date: Sat Dec 22 18:50:33 2018 +0900 treewide: remove explicit rules for *offsets.s These explicit rules are unneeded because scripts/Makefile.build provides a pattern rule to create %.s from %.c Signed-off-by: Masahiro Yamada Kbuild | 9 +-------- arch/arm/mach-at91/Makefile | 3 --- arch/arm/mach-omap2/Makefile | 3 --- arch/ia64/kernel/Makefile | 5 ----- drivers/memory/Makefile.asm-offsets | 3 --- samples/bpf/Makefile | 3 --- 6 files changed, 1 insertion(+), 25 deletions(-) commit 3470d9eb638722212ac44787eaf13486823fa011 Author: Masahiro Yamada Date: Fri Dec 21 12:12:41 2018 +0900 firmware: refactor firmware/Makefile Clean up the Makefile. Equivalent *.gen.S files are still produced. - Use filechk to remove ugly wordsize_deps - Get FWNAME, FWSTR, ASM_WORD, ASM_ALIGN, and PROGBITS out of the recipe for readability - Remove 'mkdir' because filechk takes care of it Signed-off-by: Masahiro Yamada firmware/Makefile | 84 +++++++++++++++++++++---------------------------------- 1 file changed, 32 insertions(+), 52 deletions(-) commit 6b8d95f1795c42161dc0984b6863e95d6acf24ed Author: Willem de Bruijn Date: Sat Dec 22 16:53:45 2018 -0500 packet: validate address length if non-zero Validate packet socket address length if a length is given. Zero length is equivalent to not setting an address. Fixes: 99137b7888f4 ("packet: validate address length") Reported-by: Ido Schimmel Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller net/packet/af_packet.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit a95386f0390ab602904d11fe6bd7ea5ef9b136f8 Author: Gustavo A. R. Silva Date: Fri Dec 21 15:47:53 2018 -0600 nfc: af_nfc: Fix Spectre v1 vulnerability proto is indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. This issue was detected with the help of Smatch: net/nfc/af_nfc.c:42 nfc_sock_create() warn: potential spectre issue 'proto_tab' [w] (local cap) Fix this by sanitizing proto before using it to index proto_tab. Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 Signed-off-by: Gustavo A. R. Silva Signed-off-by: David S. Miller net/nfc/af_nfc.c | 2 ++ 1 file changed, 2 insertions(+) commit d686026b1e6ed4ea27d630d8f54f9a694db088b2 Author: Gustavo A. R. Silva Date: Fri Dec 21 15:41:17 2018 -0600 phonet: af_phonet: Fix Spectre v1 vulnerability protocol is indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. This issue was detected with the help of Smatch: net/phonet/af_phonet.c:48 phonet_proto_get() warn: potential spectre issue 'proto_tab' [w] (local cap) Fix this by sanitizing protocol before using it to index proto_tab. Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 Signed-off-by: Gustavo A. R. Silva Signed-off-by: David S. Miller net/phonet/af_phonet.c | 3 +++ 1 file changed, 3 insertions(+) commit f617e5ffe04fd46010b618c9eeadaa04588704c9 Author: Wei Yongjun Date: Sat Dec 22 10:30:30 2018 +0000 RDMA/srpt: Use kmem_cache_free() instead of kfree() memory allocated by kmem_cache_alloc() should be freed using kmem_cache_free(), not kfree(). Fixes: 5dabcd0456d7 ("RDMA/srpt: Add support for immediate data") Signed-off-by: Wei Yongjun Signed-off-by: Jason Gunthorpe drivers/infiniband/ulp/srpt/ib_srpt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 58f7c0bfb4e111006ba376df7ab266a6d42d64ba Author: Dan Carpenter Date: Sat Dec 22 10:43:32 2018 +0300 RDMA/mlx5: Signedness bug in UVERBS_HANDLER() The "num_actions" variable needs to be signed for the error handling to work. The maximum number of actions is less than 256 so int type is large enough for that. Fixes: cbfdd442c43e ("IB/uverbs: Add helper to get array size from ptr attribute") Signed-off-by: Dan Carpenter Acked-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/mlx5/flow.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 573671a5f6509c4139770452d4516720a84d5b61 Author: Dan Carpenter Date: Sat Dec 22 10:42:59 2018 +0300 IB/uverbs: Signedness bug in UVERBS_HANDLER() The "num_sge" variable needs to be signed for the error handling to work. The uverbs_attr_ptr_get_array_size() returns int so this change is safe. Fixes: ad8a4496757f ("IB/uverbs: Add support to advise_mr") Signed-off-by: Dan Carpenter Reviewed-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/core/uverbs_std_types_mr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 50d5258634aee2e62832aa086d2fb0de00e72b91 Author: Gustavo A. R. Silva Date: Fri Dec 21 14:49:01 2018 -0600 net: core: Fix Spectre v1 vulnerability flen is indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. This issue was detected with the help of Smatch: net/core/filter.c:1101 bpf_check_classic() warn: potential spectre issue 'filter' [w] Fix this by sanitizing flen before using it to index filter at line 1101: switch (filter[flen - 1].code) { and through pc at line 1040: const struct sock_filter *ftest = &filter[pc]; Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 Signed-off-by: Gustavo A. R. Silva Signed-off-by: David S. Miller net/core/filter.c | 2 ++ 1 file changed, 2 insertions(+) commit d52c499b476b2f82eebecdd5fc4be8318a4e8ef7 Author: Gustavo A. R. Silva Date: Sat Dec 22 01:39:52 2018 -0600 lightnvm: pblk: fix use-after-free bug Remove one of the calls to function bio_put(), so *bio* is only freed once. Notice that bio is being dereferenced in bio_put(), hence leading to a use-after-free bug once *bio* has already been freed. Addresses-Coverity-ID: 1475952 ("Use after free") Fixes: 55d8ec35398e ("lightnvm: pblk: support packed metadata") Signed-off-by: Gustavo A. R. Silva Signed-off-by: Jens Axboe drivers/lightnvm/pblk-recovery.c | 1 - 1 file changed, 1 deletion(-) commit 93f87a74fde682e0b53c90ea25e744003d294ae2 Author: Chengguang Xu Date: Sat Dec 22 20:47:56 2018 +0800 block: sunvdc: remove redundant code Code cleanup for removing redundant break in switch case. Signed-off-by: Chengguang Xu Signed-off-by: Jens Axboe drivers/block/sunvdc.c | 1 - 1 file changed, 1 deletion(-) commit c41103691b7fc4fda11f74a90a4fbd9d265c8cc9 Author: Chengguang Xu Date: Sat Dec 22 20:47:15 2018 +0800 block: loop: remove redundant code Code cleanup for removing redundant break in switch case. Signed-off-by: Chengguang Xu Signed-off-by: Jens Axboe drivers/block/loop.c | 1 - 1 file changed, 1 deletion(-) commit 1debf0958fa27b7c469dbf22754929ec59a7c0e7 Author: Sai Praneeth Prakhya Date: Fri Dec 21 18:22:34 2018 -0800 x86/efi: Don't unmap EFI boot services code/data regions for EFI_OLD_MEMMAP and EFI_MIXED_MODE The following commit: d5052a7130a6 ("x86/efi: Unmap EFI boot services code/data regions from efi_pgd") forgets to take two EFI modes into consideration, namely EFI_OLD_MEMMAP and EFI_MIXED_MODE: - EFI_OLD_MEMMAP is a legacy way of mapping EFI regions into swapper_pg_dir using ioremap() and init_memory_mapping(). This feature can be enabled by passing "efi=old_map" as kernel command line argument. But, efi_unmap_pages() unmaps EFI boot services code/data regions *only* from efi_pgd and hence cannot be used for unmapping EFI boot services code/data regions from swapper_pg_dir. Introduce a temporary fix to not unmap EFI boot services code/data regions when EFI_OLD_MEMMAP is enabled while working on a real fix. - EFI_MIXED_MODE is another feature where a 64-bit kernel runs on a 64-bit platform crippled by a 32-bit firmware. To support EFI_MIXED_MODE, all RAM (i.e. namely EFI regions like EFI_CONVENTIONAL_MEMORY, EFI_LOADER_, EFI_BOOT_SERVICES_ and EFI_RUNTIME_CODE/DATA regions) is mapped into efi_pgd all the time to facilitate EFI runtime calls access it's arguments in 1:1 mode. Hence, don't unmap EFI boot services code/data regions when booted in mixed mode. Signed-off-by: Sai Praneeth Prakhya Acked-by: Ard Biesheuvel Cc: Andy Lutomirski Cc: Bhupesh Sharma Cc: Borislav Petkov Cc: Dave Hansen Cc: Dave Hansen Cc: H. Peter Anvin Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Rik van Riel Cc: Thomas Gleixner Cc: linux-efi@vger.kernel.org Link: http://lkml.kernel.org/r/20181222022234.7573-1-sai.praneeth.prakhya@intel.com Signed-off-by: Ingo Molnar arch/x86/platform/efi/quirks.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) commit 37379cfc661e51607733f266d9f407b4f8aee16b Author: Dan Williams Date: Sat Dec 22 11:35:41 2018 -0800 libnvdimm/security: Quiet security operations The security implementation is too chatty. For example, the common case is that security is not enabled / setup, and booting a qemu configuration currently yields: nvdimm nmem0: request_key() found no key nvdimm nmem0: failed to unlock dimm: -126 nvdimm nmem1: request_key() found no key nvdimm nmem1: failed to unlock dimm: -126 Convert all security related log messages to debug level. Cc: Dave Jiang Signed-off-by: Dan Williams drivers/nvdimm/dimm.c | 2 +- drivers/nvdimm/security.c | 30 +++++++++++++++--------------- 2 files changed, 16 insertions(+), 16 deletions(-) commit 1cce377df1800154301525a8ee04100dd83c9633 Author: Mathieu Malaterre Date: Wed May 16 21:30:12 2018 +0200 tracing: Make function ‘ftrace_exports’ static In commit 478409dd683d ("tracing: Add hook to function tracing for other subsystems to use"), a new function ‘ftrace_exports’ was added. Since this function can be made static, make it so. Silence the following warning triggered using W=1: kernel/trace/trace.c:2451:6: warning: no previous prototype for ‘ftrace_exports’ [-Wmissing-prototypes] Link: http://lkml.kernel.org/r/20180516193012.25390-1-malat@debian.org Signed-off-by: Mathieu Malaterre Signed-off-by: Steven Rostedt (VMware) kernel/trace/trace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bea6957d5cd7cbb327083d3bcf080133ee63ef65 Author: Rasmus Villemoes Date: Mon Oct 29 23:35:42 2018 +0100 tracing: Simplify printf'ing in seq_print_sym trace_seq_printf(..., "%s", ...) can be done with trace_seq_puts() instead, avoiding printf overhead. In the second instance, the string we're copying was just created from an snprintf() to a stack buffer, so we might as well do that printf directly. This naturally leads to moving the declaration of the str buffer inside the CONFIG_KALLSYMS guard, which in turn will make gcc inline the function for !CONFIG_KALLSYMS (it only has a single caller, but the huge stack frame seems to make gcc not inline it for CONFIG_KALLSYMS). Link: http://lkml.kernel.org/r/20181029223542.26175-4-linux@rasmusvillemoes.dk Signed-off-by: Rasmus Villemoes Signed-off-by: Steven Rostedt (VMware) kernel/trace/trace_output.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit cc9f59fb3bc455984404dbab8be16f156a47d023 Author: Rasmus Villemoes Date: Mon Oct 29 23:35:41 2018 +0100 tracing: Avoid -Wformat-nonliteral warning Building with -Wformat-nonliteral, gcc complains kernel/trace/trace_output.c: In function ‘seq_print_sym’: kernel/trace/trace_output.c:356:3: warning: format not a string literal, argument types not checked [-Wformat-nonliteral] trace_seq_printf(s, fmt, name); But seq_print_sym only has a single caller which passes "%s" as fmt, so we might as well just use that directly. That also paves the way for further cleanups that will actually make that format string go away entirely. Link: http://lkml.kernel.org/r/20181029223542.26175-3-linux@rasmusvillemoes.dk Signed-off-by: Rasmus Villemoes Signed-off-by: Steven Rostedt (VMware) kernel/trace/trace_output.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) commit 59dd974bc079079c23b5429cba841696fa7fae41 Author: Rasmus Villemoes Date: Mon Oct 29 23:35:40 2018 +0100 tracing: Merge seq_print_sym_short() and seq_print_sym_offset() These two functions are nearly identical, so we can avoid some code duplication by moving the conditional into a common implementation. Link: http://lkml.kernel.org/r/20181029223542.26175-2-linux@rasmusvillemoes.dk Signed-off-by: Rasmus Villemoes Signed-off-by: Steven Rostedt (VMware) kernel/trace/trace_output.c | 34 +++++++--------------------------- 1 file changed, 7 insertions(+), 27 deletions(-) commit 05ddb25cb31491b0901d057c40ad50d01b3db783 Author: Tom Zanussi Date: Tue Dec 18 14:33:26 2018 -0600 tracing: Add hist trigger comments for variable-related fields Add a few comments to help clarify how variable and variable reference fields are used in the code. Link: http://lkml.kernel.org/r/ea857ce948531d7bec712bbb0f38360aa1d378ec.1545161087.git.tom.zanussi@linux.intel.com Acked-by: Namhyung Kim Reviewed-by: Masami Hiramatsu Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) kernel/trace/trace_events_hist.c | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) commit 912201345f7c39e6b0ac283207be2b6641fa47b9 Author: Tom Zanussi Date: Tue Dec 18 14:33:25 2018 -0600 tracing: Remove hist trigger synth_var_refs All var_refs are now handled uniformly and there's no reason to treat the synth_refs in a special way now, so remove them and associated functions. Link: http://lkml.kernel.org/r/b4d3470526b8f0426dcec125399dad9ad9b8589d.1545161087.git.tom.zanussi@linux.intel.com Acked-by: Namhyung Kim Reviewed-by: Masami Hiramatsu Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) kernel/trace/trace_events_hist.c | 18 ------------------ 1 file changed, 18 deletions(-) commit 656fe2ba85e81d00e4447bf77b8da2be3c47acb2 Author: Tom Zanussi Date: Tue Dec 18 14:33:24 2018 -0600 tracing: Use hist trigger's var_ref array to destroy var_refs Since every var ref for a trigger has an entry in the var_ref[] array, use that to destroy the var_refs, instead of piecemeal via the field expressions. This allows us to avoid having to keep and treat differently separate lists for the action-related references, which future patches will remove. Link: http://lkml.kernel.org/r/fad1a164f0e257c158e70d6eadbf6c586e04b2a2.1545161087.git.tom.zanussi@linux.intel.com Acked-by: Namhyung Kim Reviewed-by: Masami Hiramatsu Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) kernel/trace/trace_events_hist.c | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-) commit de40f033d4e84e843d6a12266e3869015ea9097c Author: Tom Zanussi Date: Tue Dec 18 14:33:23 2018 -0600 tracing: Remove open-coding of hist trigger var_ref management Have create_var_ref() manage the hist trigger's var_ref list, rather than having similar code doing it in multiple places. This cleans up the code and makes sure var_refs are always accounted properly. Also, document the var_ref-related functions to make what their purpose clearer. Link: http://lkml.kernel.org/r/05ddae93ff514e66fc03897d6665231892939913.1545161087.git.tom.zanussi@linux.intel.com Acked-by: Namhyung Kim Reviewed-by: Masami Hiramatsu Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) kernel/trace/trace_events_hist.c | 93 ++++++++++++++++++++++++++++++++-------- 1 file changed, 75 insertions(+), 18 deletions(-) commit e4f6d245031e04bdd12db390298acec0474a1a46 Author: Tom Zanussi Date: Wed Dec 19 13:09:16 2018 -0600 tracing: Use var_refs[] for hist trigger reference checking Since all the variable reference hist_fields are collected into hist_data->var_refs[] array, there's no need to go through all the fields looking for them, or in separate arrays like synth_var_refs[], which will be going away soon anyway. This also allows us to get rid of some unnecessary code and functions currently used for the same purpose. Link: http://lkml.kernel.org/r/1545246556.4239.7.camel@gmail.com Acked-by: Namhyung Kim Reviewed-by: Masami Hiramatsu Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) kernel/trace/trace_events_hist.c | 68 +++++++--------------------------------- 1 file changed, 11 insertions(+), 57 deletions(-) commit 2f31ed9308cc9e95c149078b276a47360ab507bb Author: Tom Zanussi Date: Tue Dec 18 14:33:21 2018 -0600 tracing: Change strlen to sizeof for hist trigger static strings There's no need to use strlen() for static strings when the length is already known, so update trace_events_hist.c with sizeof() for those cases. Link: http://lkml.kernel.org/r/e3e754f2bd18e56eaa8baf79bee619316ebf4cfc.1545161087.git.tom.zanussi@linux.intel.com Acked-by: Namhyung Kim Reviewed-by: Masami Hiramatsu Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) kernel/trace/trace_events_hist.c | 38 +++++++++++++++++++------------------- 1 file changed, 19 insertions(+), 19 deletions(-) commit 6801f0d5ca00bed159c7f87870cc6f5411837544 Author: Tom Zanussi Date: Tue Dec 18 14:33:20 2018 -0600 tracing: Remove unnecessary hist trigger struct field hist_field.var_idx is completely unused, so remove it. Link: http://lkml.kernel.org/r/d4e066c0f509f5f13ad3babc8c33ca6e7ddc439a.1545161087.git.tom.zanussi@linux.intel.com Acked-by: Namhyung Kim Reviewed-by: Masami Hiramatsu Signed-off-by: Tom Zanussi Signed-off-by: Steven Rostedt (VMware) kernel/trace/trace_events_hist.c | 1 - 1 file changed, 1 deletion(-) commit e8d086ddb5339d72c60e6c7b8d28810f26960f9a Author: Steven Rostedt (VMware) Date: Tue Dec 18 15:50:02 2018 -0500 tracing: Fix ftrace_graph_get_ret_stack() to use task and not current The function ftrace_graph_get_ret_stack() takes a task struct descriptor but uses current as the task to perform the operations on. In pretty much all cases the task decriptor is the same as current, so this wasn't an issue. But there is a case in the ARM architecture that passes in a task that is not current, and expects a result from that task, and this code breaks it. Fixes: 51584396cff5 ("arm64: Use ftrace_graph_get_ret_stack() instead of curr_ret_stack") Reported-by: James Morse Tested-by: James Morse Signed-off-by: Steven Rostedt (VMware) kernel/trace/fgraph.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 29924e5030969c55dbe68074215be5a1f14f1ff1 Author: Michael Ellerman Date: Fri Oct 19 15:21:09 2018 +1100 seq_buf: Use size_t for len in seq_buf_puts() Jann Horn points out that we're using unsigned int for len in seq_buf_puts(), which could potentially overflow if we're passed a UINT_MAX sized string. The rest of the code already uses size_t, so we should also use that in seq_buf_puts() to avoid any issues. Link: http://lkml.kernel.org/r/20181019042109.8064-2-mpe@ellerman.id.au Suggested-by: Jann Horn Signed-off-by: Michael Ellerman Signed-off-by: Steven Rostedt (VMware) lib/seq_buf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0464ed24380905d640030d368cd84a4e4d1e15e2 Author: Michael Ellerman Date: Fri Oct 19 15:21:08 2018 +1100 seq_buf: Make seq_buf_puts() null-terminate the buffer Currently seq_buf_puts() will happily create a non null-terminated string for you in the buffer. This is particularly dangerous if the buffer is on the stack. For example: char buf[8]; char secret = "secret"; struct seq_buf s; seq_buf_init(&s, buf, sizeof(buf)); seq_buf_puts(&s, "foo"); printk("Message is %s\n", buf); Can result in: Message is fooªªªªªsecret We could require all users to memset() their buffer to zero before use. But that seems likely to be forgotten and lead to bugs. Instead we can change seq_buf_puts() to always leave the buffer in a null-terminated state. The only downside is that this makes the buffer 1 character smaller for seq_buf_puts(), but that seems like a good trade off. Link: http://lkml.kernel.org/r/20181019042109.8064-1-mpe@ellerman.id.au Acked-by: Kees Cook Signed-off-by: Michael Ellerman Signed-off-by: Steven Rostedt (VMware) lib/seq_buf.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit a448276ce515c91cde4675be497364b91c764d95 Author: Steven Rostedt (VMware) Date: Fri Dec 7 13:13:28 2018 -0500 arm64: Use ftrace_graph_get_ret_stack() instead of curr_ret_stack The structure of the ret_stack array on the task struct is going to change, and accessing it directly via the curr_ret_stack index will no longer give the ret_stack entry that holds the return address. To access that, architectures must now use ftrace_graph_get_ret_stack() to get the associated ret_stack that matches the saved return address. Cc: linux-arm-kernel@lists.infradead.org Cc: Will Deacon Cc: Mark Rutland Cc: Catalin Marinas Signed-off-by: Steven Rostedt (VMware) arch/arm64/kernel/perf_callchain.c | 2 +- arch/arm64/kernel/process.c | 2 +- arch/arm64/kernel/return_address.c | 2 +- arch/arm64/kernel/stacktrace.c | 12 +++++++----- arch/arm64/kernel/time.c | 2 +- arch/arm64/kernel/traps.c | 2 +- 6 files changed, 12 insertions(+), 10 deletions(-) commit cec8d0e7f06e08b981e9d61bef267c8c36d536f5 Author: Steven Rostedt (VMware) Date: Fri Dec 7 13:06:04 2018 -0500 sh: ftrace: Use ftrace_graph_get_ret_stack() instead of curr_ret_stack The structure of the ret_stack array on the task struct is going to change, and accessing it directly via the curr_ret_stack index will no longer give the ret_stack entry that holds the return address. To access that, architectures must now use ftrace_graph_get_ret_stack() to get the associated ret_stack that matches the saved return address. Cc: linux-sh@vger.kernel.org Cc: Yoshinori Sato Cc: Rich Felker Signed-off-by: Steven Rostedt (VMware) arch/sh/kernel/dumpstack.c | 11 +++++++---- arch/sh/kernel/dwarf.c | 9 +++++---- 2 files changed, 12 insertions(+), 8 deletions(-) commit 945626db0961d8388543b2c96b6f16df57947392 Author: Steven Rostedt (VMware) Date: Fri Dec 7 12:51:27 2018 -0500 sparc64: Use ftrace_graph_get_ret_stack() instead of curr_ret_stack The structure of the ret_stack array on the task struct is going to change, and accessing it directly via the curr_ret_stack index will no longer give the ret_stack entry that holds the return address. To access that, architectures must now use ftrace_graph_get_ret_stack() to get the associated ret_stack that matches the saved return address. Cc: sparclinux@vger.kernel.org Acked-by: David S. Miller Signed-off-by: Steven Rostedt (VMware) arch/sparc/kernel/perf_event.c | 8 +++++--- arch/sparc/kernel/stacktrace.c | 8 +++++--- arch/sparc/kernel/traps_64.c | 7 ++++--- 3 files changed, 14 insertions(+), 9 deletions(-) commit 0fad8bfef7b08a68507178f8e278d013b60ff966 Author: Steven Rostedt (VMware) Date: Fri Dec 7 12:35:47 2018 -0500 powerpc/frace: Use ftrace_graph_get_ret_stack() instead of curr_ret_stack The structure of the ret_stack array on the task struct is going to change, and accessing it directly via the curr_ret_stack index will no longer give the ret_stack entry that holds the return address. To access that, architectures must now use ftrace_graph_get_ret_stack() to get the associated ret_stack that matches the saved return address. Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: linuxppc-dev@lists.ozlabs.org Acked-by: Michael Ellerman Signed-off-by: Steven Rostedt (VMware) arch/powerpc/kernel/process.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) commit 22ec9bb1cbcd613c73476ccd8f6a5e8c77793f66 Author: Linus Walleij Date: Sun Dec 2 12:04:10 2018 +0100 watchdog: mena21_wdt: Convert to GPIO descriptors This drops the old OF API use to look up global GPIO numbers and replace it with the GPIO descriptor API. Cc: Johannes Thumshirn Cc: Johannes Thumshirn Cc: Johannes Thumshirn Signed-off-by: Linus Walleij Acked-by: Johannes Thumshirn Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/mena21_wdt.c | 73 +++++++++++++++++++++---------------------- 1 file changed, 36 insertions(+), 37 deletions(-) commit 8d4d4f3267e1fcad56ca5aa4eabf72472e10965f Author: Loic Poulain Date: Fri Nov 23 09:44:37 2018 +0100 dt-bindings: watchdog: Add Qualcomm PM8916 watchdog Document support for the Watchdog Timer (WDT) Controller in the Qualcomm PM8916 PMIC module. Signed-off-by: Loic Poulain Reviewed-by: Rob Herring Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck .../bindings/watchdog/qcom,pm8916-wdt.txt | 28 ++++++++++++++++++++++ 1 file changed, 28 insertions(+) commit 969c0acc039f77c6b9d000ccb8b9d3afca4d3667 Author: Loic Poulain Date: Fri Nov 23 09:44:36 2018 +0100 watchdog: Add pm8916 watchdog driver The PM816 module is a versatile PMIC with many diverse functions integrated, including, a watchdog. This watchdog is subcomponent of the PON (Power On) peripheral, in the same way as pwrkey/resin buttons. It works with two timers (2-stages), the first one generates an IRQ to the main SoC (APQ8016/MSM8916), the second one performs the reset. This driver expects the following device hierarchy: [pm8916]->[pm8916-pon]->[pm8916-wdt] It uses the pm8916 regmap to access PM8916 registers. Signed-off-by: Loic Poulain Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/Kconfig | 8 ++ drivers/watchdog/Makefile | 1 + drivers/watchdog/pm8916_wdt.c | 211 ++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 220 insertions(+) commit 4d9c6e90166f1a4b0132e8d8520a2fcd6d081e6b Author: Ryder Lee Date: Wed Nov 7 15:10:36 2018 +0800 dt-bindings: watchdog: update bindings for MT7629 SoC This updates dt-binding documentation for MT7629 SoC Signed-off-by: Ryder Lee Reviewed-by: Rob Herring Reviewed-by: Guenter Roeck Acked-by: Matthias Brugger Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck Documentation/devicetree/bindings/watchdog/mtk-wdt.txt | 1 + 1 file changed, 1 insertion(+) commit 9077123c68074619177c9a8d3adce2527bd94179 Author: Wolfram Sang Date: Tue Dec 4 13:01:46 2018 +0100 watchdog: renesas_wdt: don't keep timer value during suspend/resume After discussing this mail thread [1] again, we concluded that giving userspace enough time to prepare is our favourite option. So, do not keep the time value when suspended but reset it when resuming. [1] https://patchwork.kernel.org/patch/10252209/ Signed-off-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Reviewed-by: Guenter Roeck Reviewed-by: Fabrizio Castro Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/renesas_wdt.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) commit 248e655b45ed2ce98aee9de439616fdd2b78b0f5 Author: Yangtao Li Date: Sat Dec 1 09:51:40 2018 -0500 watchdog: ie6xx_wdt: convert to DEFINE_SHOW_ATTRIBUTE Use DEFINE_SHOW_ATTRIBUTE macro to simplify the code. Signed-off-by: Yangtao Li Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/ie6xx_wdt.c | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-) commit 57808f448b3d2214df4cfa5ab046e09da2908cde Author: Yangtao Li Date: Sat Dec 1 09:51:39 2018 -0500 watchdog: bcm281xx: convert to DEFINE_SHOW_ATTRIBUTE Use DEFINE_SHOW_ATTRIBUTE macro to simplify the code. Signed-off-by: Yangtao Li Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/bcm_kona_wdt.c | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-) commit b1bbb0cb2c0ee6dccaf341f99dad9bdff5882acd Author: Colin Ian King Date: Thu Nov 29 23:25:00 2018 +0000 watchdog: asm9260_wdt: make array mode_name static, shrinks object size Don't populate the const array mode_name on the stack but instead make it static. Makes the object code smaller by 41 bytes: Before: text data bss dec hex filename 7699 1872 0 9571 2563 drivers/watchdog/asm9260_wdt.o After: text data bss dec hex filename 7594 1936 0 9530 253a drivers/watchdog/asm9260_wdt.o (gcc version 8.2.0 x86_64) Signed-off-by: Colin Ian King Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/asm9260_wdt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 437a3f8ea493ba9b80c9bb983e15f4297fc653de Author: Jerry Hoemann Date: Wed Dec 5 17:42:23 2018 -0700 watchdog/hpwdt: Update driver version. Bump version number to reflect recent minor changes. Signed-off-by: Jerry Hoemann Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/hpwdt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit de2cb0cc300ea9bdb7dee476d24c2b20d469c3f2 Author: Jerry Hoemann Date: Wed Dec 5 17:42:22 2018 -0700 watchdog/hpwdt: Do not claim unsupported hardware Do not claim when SSID 0x0289 as the watchdog features are not enabled/validated by the firmware. Signed-off-by: Jerry Hoemann Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/hpwdt.c | 1 + 1 file changed, 1 insertion(+) commit 94d6b80c45d3f436d993aa026aa080866cb4b87e Author: Jerry Hoemann Date: Wed Dec 5 17:42:21 2018 -0700 watchdog/hpwdt: Exclude via blacklist Instead of having explicit if statments excluding devices, use a pci_device_id table of devices to blacklist. Signed-off-by: Jerry Hoemann Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/hpwdt.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) commit e1b83a31c79811409023aac560d5b0fc2967bec9 Author: Hardik Singh Rathore Date: Sun Dec 9 16:17:26 2018 +0530 Watchdog: remove outdated comment The lock field doesn't exist in watchdog_device structure. It was added by commit f4e9c82f64b5 ("watchdog: Add Locking support") and removed by commit b4ffb1909843 ("watchdog: Separate and maintain variables based on variable lifetime") Signed-off-by: Hardik Singh Rathore Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck include/linux/watchdog.h | 3 --- 1 file changed, 3 deletions(-) commit 9bbc7e4ce47ecefa142fcba55eef7754af1b0213 Author: Oliver O'Halloran Date: Mon Mar 19 16:14:03 2018 +1100 powerpc/zImage: Also check for stdout-path The /chosen/linux,stdout-path is "deprecated" in favour of /chosen/stdout-path so we should be checking for both. Signed-off-by: Oliver O'Halloran Signed-off-by: Michael Ellerman arch/powerpc/boot/serial.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 505a314fb28ce122091691c51426fa85c084e115 Author: Benjamin Herrenschmidt Date: Mon Oct 8 15:08:31 2018 +1100 powerpc: Fix HMIs on big-endian with CONFIG_RELOCATABLE=y HMIs will crash the kernel due to BRANCH_LINK_TO_FAR(hmi_exception_realmode) Calling into the OPD instead of the actual code. Fixes: 2337d207288f ("powerpc/64: CONFIG_RELOCATABLE support for hmi interrupts") Signed-off-by: Benjamin Herrenschmidt [mpe: Use DOTSYM() rather than #ifdef] Signed-off-by: Michael Ellerman arch/powerpc/kernel/exceptions-64s.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f1e0addca8bd7386f8cabbc64c9988fff91c131f Author: Rob Herring Date: Wed Dec 5 13:50:28 2018 -0600 macintosh: Use of_node_name_{eq, prefix} for node name comparisons Convert string compares of DT node names to use of_node_name_{eq,prefix} helpers instead. This removes direct access to the node name pointer. This changes a single case insensitive node name comparison to case sensitive for "ata4". This is the only instance of a case insensitive comparison for all the open coded node name comparisons on powerpc. Searching the commit history, there doesn't appear to be any reason for it to be case insensitive. A couple of open coded iterating thru the child node names are converted to use for_each_child_of_node() instead. Signed-off-by: Rob Herring Signed-off-by: Michael Ellerman drivers/macintosh/ans-lcd.c | 2 +- drivers/macintosh/macio_asic.c | 33 ++++++++++++++----------------- drivers/macintosh/rack-meter.c | 13 ++++++------ drivers/macintosh/via-pmu.c | 4 ++-- drivers/macintosh/windfarm_lm87_sensor.c | 4 ++-- drivers/macintosh/windfarm_smu_controls.c | 4 ++-- drivers/macintosh/windfarm_smu_sensors.c | 2 +- 7 files changed, 30 insertions(+), 32 deletions(-) commit c1fa31b0fc90a80d64a334e5d35dca211f9187f6 Author: Rob Herring Date: Wed Dec 5 13:50:25 2018 -0600 ide: Use of_node_name_eq for node name comparisons Convert string compares of DT node names to use of_node_name_eq helper instead. This removes direct access to the node name pointer. Cc: "David S. Miller" Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Michael Ellerman Cc: linux-ide@vger.kernel.org Cc: linuxppc-dev@lists.ozlabs.org Signed-off-by: Rob Herring Signed-off-by: Michael Ellerman drivers/ide/pmac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2c8e65b595cf0bf7c1413404dff9b928a64d27cb Author: Rob Herring Date: Wed Dec 5 13:50:18 2018 -0600 powerpc: Use of_node_name_eq for node name comparisons Convert string compares of DT node names to use of_node_name_eq helper instead. This removes direct access to the node name pointer. A couple of open coded iterating thru the child node names are converted to use for_each_child_of_node() instead. Signed-off-by: Rob Herring Signed-off-by: Michael Ellerman arch/powerpc/kernel/legacy_serial.c | 7 +++---- arch/powerpc/platforms/44x/warp.c | 4 ++-- arch/powerpc/platforms/52xx/efika.c | 6 ++---- arch/powerpc/platforms/cell/setup.c | 2 +- arch/powerpc/platforms/cell/spu_manage.c | 10 ++-------- arch/powerpc/platforms/chrp/setup.c | 5 +---- arch/powerpc/platforms/powermac/feature.c | 11 +++++------ arch/powerpc/platforms/powermac/low_i2c.c | 4 ++-- arch/powerpc/platforms/powermac/pci.c | 27 +++++++++++---------------- arch/powerpc/platforms/powermac/pfunc_base.c | 7 +++---- arch/powerpc/platforms/powermac/pic.c | 4 ++-- arch/powerpc/platforms/powermac/setup.c | 10 ++-------- arch/powerpc/platforms/powermac/udbg_scc.c | 2 +- arch/powerpc/platforms/powernv/opal.c | 2 +- arch/powerpc/platforms/pseries/setup.c | 2 +- 15 files changed, 39 insertions(+), 64 deletions(-) commit 2dab3dd1fac72b982308265cb322e8d47450052b Author: Linus Walleij Date: Sat Dec 22 11:15:04 2018 +0100 pinctrl: ocelot: Add dependency on HAS_IOMEM As usual the build fails on UM Linux because that thing does not have IOMEM. Depend on HAS_IOMEM solves the build problem. Cc: Alexandre Belloni Signed-off-by: Linus Walleij drivers/pinctrl/Kconfig | 1 + 1 file changed, 1 insertion(+) commit a7c23f8d154f7919c5fcfceea6e0897be2d5ab71 Author: Linus Walleij Date: Sat Dec 22 11:04:55 2018 +0100 gpio: sama5d2-piobu: Depend on OF_GPIO This driver clearly needs OF_GPIO so depend on it. Fixes a build error. Cc: Andrei Stefanescu Signed-off-by: Linus Walleij drivers/gpio/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 0d1223dd9273b2ba3e965a81092a239405a4931c Author: Rob Herring Date: Wed Dec 5 13:50:17 2018 -0600 powerpc/pseries/pmem: Convert to %pOFn instead of device_node.name In preparation to remove the node name pointer from struct device_node, convert printf users to use the %pOFn format specifier. pmem.c was recently added and missed the initial conversion. Signed-off-by: Rob Herring Signed-off-by: Michael Ellerman arch/powerpc/platforms/pseries/pmem.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 423e2f94456404b49d89ef587c34022987a581e1 Author: Michael Ellerman Date: Tue Nov 27 19:18:05 2018 +1100 powerpc/mm: Remove very old comment in hash-4k.h This comment talks about PTEs being 64-bits and PMD/PGD being 32-bits, but that hasn't been true since 2005 when David Gibson implemented 4-level page tables in the commit titled "Four level pagetables for ppc64". Remove it. Signed-off-by: Michael Ellerman arch/powerpc/include/asm/book3s/64/hash-4k.h | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) commit 47918bc68b7427e961035949cc1501a864578a69 Author: Michael Ellerman Date: Tue Nov 27 19:16:44 2018 +1100 powerpc/pseries: Fix node leak in update_lmb_associativity_index() In update_lmb_associativity_index() we lookup dr_node using of_find_node_by_path() which takes a reference for us. In the non-error case we forget to drop the reference. Note that find_aa_index() does modify properties of the node, but doesn't need an extra reference held once it's returned. Signed-off-by: Michael Ellerman arch/powerpc/platforms/pseries/hotplug-memory.c | 1 + 1 file changed, 1 insertion(+) commit d69e11648e486ee0f21cb246f687b083f0d4e124 Author: Thierry Reding Date: Wed Nov 28 10:54:16 2018 +0100 mailbox: tegra-hsp: Use device-managed registration API In order to get rid of a lot of cleanup boilerplate code, use the device-managed registration API. Signed-off-by: Thierry Reding Signed-off-by: Jassi Brar drivers/mailbox/tegra-hsp.c | 30 ++++++------------------------ 1 file changed, 6 insertions(+), 24 deletions(-) commit a54d03ed01b4ed64c22d2b53d61d4049ec49a51f Author: Bartosz Golaszewski Date: Wed Nov 28 10:54:15 2018 +0100 mailbox: tegra-hsp: use devm_kstrdup_const() Use devm_kstrdup_const() in the tegra-hsp driver. This mostly serves as an example of how to use this new routine to shrink driver code. Also use devm_kzalloc() instead of regular kzalloc() to shrink the driver even more. Doorbell objects are only removed in the driver's remove callback so it's safe to convert all memory allocations to devres. Signed-off-by: Bartosz Golaszewski Signed-off-by: Thierry Reding Signed-off-by: Jassi Brar drivers/mailbox/tegra-hsp.c | 36 ++++-------------------------------- 1 file changed, 4 insertions(+), 32 deletions(-) commit 9a63f0f4059955210ae74c745513332a568e9738 Author: Thierry Reding Date: Wed Nov 28 10:54:14 2018 +0100 mailbox: tegra-hsp: Add suspend/resume support Upon resuming from a system sleep state, the interrupts for all active shared mailboxes need to be reenabled, otherwise they will not work. Signed-off-by: Thierry Reding Signed-off-by: Jassi Brar drivers/mailbox/tegra-hsp.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) commit 91b1b1c3da8a8fd9ee4538e00dd5e5fb5be1cdb4 Author: Thierry Reding Date: Wed Nov 28 10:54:13 2018 +0100 mailbox: tegra-hsp: Add support for shared mailboxes The Tegra HSP block supports 'shared mailboxes' that are simple 32-bit registers consisting of a FULL bit in MSB position and 31 bits of data. The hardware can be configured to trigger interrupts when a mailbox is empty or full. Add support for these shared mailboxes to the HSP driver. The initial use for the mailboxes is the Tegra Combined UART. For this purpose, we use interrupts to receive data, and spinning to wait for the transmit mailbox to be emptied to minimize unnecessary overhead. Based on work by Mikko Perttunen . Signed-off-by: Thierry Reding Signed-off-by: Jassi Brar drivers/mailbox/tegra-hsp.c | 504 ++++++++++++++++++++++++++++++++++++++------ 1 file changed, 443 insertions(+), 61 deletions(-) commit fed8b7e366e7c8f81e957ef91aa8f0a38e038c66 Author: Mikko Perttunen Date: Wed Nov 28 10:54:12 2018 +0100 dt-bindings: tegra186-hsp: Add shared mailboxes Shared mailboxes are a mechanism to transport data from one processor in the system to another. They are bidirectional links with both a producer and a consumer. Interrupts are used to let the consumer know when data was written to the mailbox by the producer, and to let the producer know when the consumer has read the data from the mailbox. These interrupts are mapped to one or more "shared interrupts". Typically each processor in the system owns one of these shared interrupts. Add documentation to the device tree bindings about how clients can use mailbox specifiers to request a specific shared mailbox and select which direction they drive. Also document how to specify the shared interrupts in addition to the existing doorbell interrupt. Signed-off-by: Mikko Perttunen Acked-by: Jon Hunter Reviewed-by: Rob Herring Acked-by: Thierry Reding Signed-off-by: Thierry Reding Signed-off-by: Jassi Brar .../bindings/mailbox/nvidia,tegra186-hsp.txt | 30 ++++++++++++++++++---- include/dt-bindings/mailbox/tegra186-hsp.h | 11 ++++++++ 2 files changed, 36 insertions(+), 5 deletions(-) commit 8ed82e23875e6014d9aa8e03bf4301b27d614050 Author: Mikko Perttunen Date: Wed Nov 28 10:54:11 2018 +0100 mailbox: Allow multiple controllers per device Look through the whole controller list when mapping device tree phandles to controllers instead of stopping at the first one. Each controller is intended to only contain one kind of mailbox, but some devices (like Tegra HSP) implement multiple kinds and use the same device tree node for all of them. As such, we need to allow multiple mbox_controllers per device tree node. Signed-off-by: Mikko Perttunen Signed-off-by: Jassi Brar drivers/mailbox/mailbox.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit a8803d7421cc2be2ac12a8155e5d824f04259eff Author: Thierry Reding Date: Wed Nov 28 10:54:10 2018 +0100 mailbox: Support blocking transfers in atomic context The mailbox framework supports blocking transfers via completions for clients that can sleep. In order to support blocking transfers in cases where the transmission is not permitted to sleep, add a new ->flush() callback that controller drivers can implement to busy loop until the transmission has been completed. A new mbox_flush() function can be called by mailbox consumers in atomic context to make sure a transfer has completed. Signed-off-by: Thierry Reding Signed-off-by: Jassi Brar drivers/mailbox/mailbox.c | 28 ++++++++++++++++++++++++++++ include/linux/mailbox_client.h | 1 + include/linux/mailbox_controller.h | 4 ++++ 3 files changed, 33 insertions(+) commit 5f470b3638a4ed03df79b993ece819cac2f4ca7e Author: Scott Wood Date: Fri Dec 21 22:07:54 2018 -0600 powerpc/configs/85xx: Enable CONFIG_DEBUG_KERNEL This is required for CONFIG_DEBUG_INFO to work. Signed-off-by: Scott Wood arch/powerpc/configs/fsl-emb-nonhw.config | 1 + 1 file changed, 1 insertion(+) commit ccdde478e8445adaa85f30e555de9fab564d742a Author: Scott Wood Date: Fri Dec 21 21:32:51 2018 -0600 powerpc/dts/fsl: Fix dtc-flagged interrupt errors mpc8641_hpcn was updated to 4-cell interrupt specifiers, but PCI interrupt-map was not updated. It was also missing #interrupt-cells on the outer PCI buses. p1020rdb-pc was updated to 4-cell interrupt specifiers, but the ethernet-phy nodes weren't updated. mpc832x_rdb had an invalid "interrupts = <0>" on the ethernet-phy nodes. Besides being the wrong number of cells, 0 is not a valid IPIC interrupt according to ipic.c. Presumably it was meant to indicate that these PHYs are not connected to an interrupt. Signed-off-by: Scott Wood arch/powerpc/boot/dts/fsl/mpc8641_hpcn.dts | 128 ++++++++++++------------- arch/powerpc/boot/dts/fsl/mpc8641_hpcn_36b.dts | 128 ++++++++++++------------- arch/powerpc/boot/dts/fsl/mpc8641si-post.dtsi | 2 + arch/powerpc/boot/dts/fsl/p1020rdb-pc.dtsi | 4 +- arch/powerpc/boot/dts/mpc832x_rdb.dts | 4 - 5 files changed, 132 insertions(+), 134 deletions(-) commit a6ee0c00a70b115e365d71eb5debcfb9de74dd1b Author: Yuantian Tang Date: Wed Oct 31 14:57:36 2018 +0800 clk: qoriq: add more compatibles strings Add more SoC compatible strings to support more chips. Signed-off-by: Yuantian Tang Reviewed-by: Rob Herring Acked-by: Stephen Boyd Signed-off-by: Scott Wood Documentation/devicetree/bindings/clock/qoriq-clock.txt | 6 ++++++ 1 file changed, 6 insertions(+) commit 54877957e95b0e41f472ee3a7e07100d61259de2 Author: Scott Wood Date: Wed Oct 31 14:57:35 2018 +0800 powerpc/fsl: Use new clockgen binding The driver retains compatibility with old device trees, but we don't want the old nodes lying around to be copied, or used as a reference (some of the mux options are incorrect), or even just being clutter. Signed-off-by: Scott Wood Signed-off-by: Tang Yuantian [scottwood: removed sysclk node added by Andy] Signed-off-by: Scott Wood arch/powerpc/boot/dts/fsl/b4420si-pre.dtsi | 4 +- arch/powerpc/boot/dts/fsl/b4860si-pre.dtsi | 8 +-- arch/powerpc/boot/dts/fsl/b4si-post.dtsi | 15 ------ arch/powerpc/boot/dts/fsl/p2041si-post.dtsi | 18 ------- arch/powerpc/boot/dts/fsl/p2041si-pre.dtsi | 8 +-- arch/powerpc/boot/dts/fsl/p3041si-post.dtsi | 18 ------- arch/powerpc/boot/dts/fsl/p3041si-pre.dtsi | 8 +-- arch/powerpc/boot/dts/fsl/p4080si-post.dtsi | 70 -------------------------- arch/powerpc/boot/dts/fsl/p4080si-pre.dtsi | 16 +++--- arch/powerpc/boot/dts/fsl/p5020si-pre.dtsi | 4 +- arch/powerpc/boot/dts/fsl/p5040si-post.dtsi | 18 ------- arch/powerpc/boot/dts/fsl/p5040si-pre.dtsi | 8 +-- arch/powerpc/boot/dts/fsl/qoriq-clockgen1.dtsi | 47 ----------------- arch/powerpc/boot/dts/fsl/qoriq-clockgen2.dtsi | 30 ----------- arch/powerpc/boot/dts/fsl/t1023si-post.dtsi | 16 ------ arch/powerpc/boot/dts/fsl/t102xsi-pre.dtsi | 4 +- arch/powerpc/boot/dts/fsl/t1040si-post.dtsi | 44 ---------------- arch/powerpc/boot/dts/fsl/t104xsi-pre.dtsi | 8 +-- arch/powerpc/boot/dts/fsl/t2081si-post.dtsi | 22 -------- arch/powerpc/boot/dts/fsl/t208xsi-pre.dtsi | 8 +-- arch/powerpc/boot/dts/fsl/t4240si-post.dtsi | 61 ---------------------- arch/powerpc/boot/dts/fsl/t4240si-pre.dtsi | 24 ++++----- 22 files changed, 50 insertions(+), 409 deletions(-) commit 0deae39cec6dab3a66794f3e9e83ca4dc30080f1 Author: Christophe Leroy Date: Mon Dec 10 11:41:29 2018 +0000 powerpc/83xx: handle machine check caused by watchdog timer When the watchdog timer is set in interrupt mode, it causes a machine check when it times out. The purpose of this mode is to ease debugging, not to crash the kernel and reboot the machine. This patch implements a special handling for that, in order to not crash the kernel if the watchdog times out while in interrupt or within the idle task. Signed-off-by: Christophe Leroy [scottwood: added missing #include] Signed-off-by: Scott Wood arch/powerpc/include/asm/cputable.h | 1 + arch/powerpc/include/asm/reg.h | 2 ++ arch/powerpc/kernel/cputable.c | 10 ++++++---- arch/powerpc/platforms/83xx/misc.c | 17 +++++++++++++++++ 4 files changed, 26 insertions(+), 4 deletions(-) commit 65eed012d1f2d0f0bf0ffc036826d58147de77b8 Author: Omar Sandoval Date: Fri Dec 21 18:45:18 2018 -0800 xfs: reallocate realtime summary cache on growfs At mount time, we allocate m_rsum_cache with the number of realtime bitmap blocks. However, xfs_growfs_rt() can increase the number of realtime bitmap blocks. Using the cache after this happens may access out of the bounds of the cache. Fix it by reallocating the cache in this case. Fixes: 355e3532132b ("xfs: cache minimum realtime summary level") Signed-off-by: Omar Sandoval Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/xfs_rtalloc.c | 44 ++++++++++++++++++++++++++++++++++++-------- 1 file changed, 36 insertions(+), 8 deletions(-) commit 01f45c8fb8b951e8d5cf648ce7ec16505ce303e7 Author: Alexandre Belloni Date: Tue Nov 20 16:12:30 2018 +0100 powerpc/fsl-rio: fix spelling mistake "reserverd" -> "reserved" Fix a spelling mistake in a register description. Signed-off-by: Alexandre Belloni Signed-off-by: Scott Wood arch/powerpc/sysdev/fsl_rio.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c6e5485e0cb509292a14e880e1944143f99758c7 Author: Christoph Hellwig Date: Wed Nov 14 09:23:07 2018 +0100 powerpc/fsl_pci: simplify fsl_pci_dma_set_mask swiotlb will only bounce buffer when the effective dma address for the device is smaller than the actual DMA range. Instead of flipping between the swiotlb and nommu ops for FSL SOCs that have the second outbound window just don't set the bus dma_mask in this case. Signed-off-by: Christoph Hellwig Signed-off-by: Scott Wood arch/powerpc/sysdev/fsl_pci.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) commit 7811eade247cdf90b26dd0951613e77614192771 Author: Sabyasachi Gupta Date: Mon Nov 5 07:52:48 2018 +0530 arch/powerpc/fsl_rmu: Use dma_zalloc_coherent Replaced dma_alloc_coherent + memset with dma_zalloc_coherent Signed-off-by: Sabyasachi Gupta Signed-off-by: Scott Wood arch/powerpc/sysdev/fsl_rmu.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit d52266fc74beacf2aefad934bd4011d62e9584e0 Author: Colin Ian King Date: Fri Dec 21 17:00:48 2018 -0800 Input: drv2667 - fix indentation issues There are some statements that are indented incorrectly, fix this by removing the extra tabs. Signed-off-by: Colin Ian King Signed-off-by: Dmitry Torokhov drivers/input/misc/drv2667.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 9aa3aa15f4c2f74f47afd6c5db4b420fadf3f315 Author: Kangjie Lu Date: Fri Dec 21 13:10:39 2018 -0600 hwmon: (lm80) fix a missing check of bus read in lm80 probe In lm80_probe(), if lm80_read_value() fails, it returns a negative error number which is stored to data->fan[f_min] and will be further used. We should avoid using the data if the read fails. The fix checks if lm80_read_value() fails, and if so, returns with the error number. Signed-off-by: Kangjie Lu Signed-off-by: Guenter Roeck drivers/hwmon/lm80.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) commit c9c63915519b1def7043b184680f33c24cd49d7b Author: Kangjie Lu Date: Fri Dec 21 13:01:33 2018 -0600 hwmon: (lm80) fix a missing check of the status of SMBus read If lm80_read_value() fails, it returns a negative number instead of the correct read data. Therefore, we should avoid using the data if it fails. The fix checks if lm80_read_value() fails, and if so, returns with the error number. Signed-off-by: Kangjie Lu [groeck: One variable for return values is enough] Signed-off-by: Guenter Roeck drivers/hwmon/lm80.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) commit ce28bb4453880759c5bdc2751629f1a865ea4a6e Merge: 64935310f2fc 6cafab50eea3 Author: David S. Miller Date: Fri Dec 21 15:06:20 2018 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net commit 2298a6f09f455f64bf253e6fb5c1ff72f38a6249 Author: Thierry Reding Date: Thu Dec 20 18:20:02 2018 +0100 mailbox: ti-msgmgr: Use device-managed registration API Get rid of some boilerplate driver removal code by using the newly added device-managed registration API. Signed-off-by: Thierry Reding Signed-off-by: Jassi Brar drivers/mailbox/ti-msgmgr.c | 13 +------------ 1 file changed, 1 insertion(+), 12 deletions(-) commit 368d7767b50154eb052938a13494879b00135ed3 Author: Thierry Reding Date: Thu Dec 20 18:20:01 2018 +0100 mailbox: stm32-ipcc: Use device-managed registration API Get rid of some boilerplate driver removal code by using the newly added device-managed registration API. Reviewed-by: Ludovic Barre Signed-off-by: Thierry Reding Signed-off-by: Jassi Brar drivers/mailbox/stm32-ipcc.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 08f2f88a3bbf3cdfdf3b890159d45519e2d5bbeb Author: Thierry Reding Date: Thu Dec 20 18:20:00 2018 +0100 mailbox: rockchip: Use device-managed registration API Get rid of some boilerplate driver removal code by using the newly added device-managed registration API. Reviewed-by: Caesar Wang Signed-off-by: Thierry Reding Signed-off-by: Jassi Brar drivers/mailbox/rockchip-mailbox.c | 15 +-------------- 1 file changed, 1 insertion(+), 14 deletions(-) commit 83dd44a17d40ab258aede6f560d27444e7dcfba7 Author: Thierry Reding Date: Thu Dec 20 18:19:59 2018 +0100 mailbox: qcom-apcs: Use device-managed registration API Get rid of some boilerplate driver removal code by using the newly added device-managed registration API. Reviewed-by: Bjorn Andersson Signed-off-by: Thierry Reding Signed-off-by: Jassi Brar drivers/mailbox/qcom-apcs-ipc-mailbox.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 85a555246e6db7b4e9803704e1e0c694dfe658a0 Author: Thierry Reding Date: Thu Dec 20 18:19:58 2018 +0100 mailbox: platform-mhu: Use device-managed registration API Get rid of some boilerplate driver removal code by using the newly added device-managed registration API. Acked-by: Neil Armstrong Signed-off-by: Thierry Reding Signed-off-by: Jassi Brar drivers/mailbox/platform_mhu.c | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) commit a3abf4363c7ec8f980a0ac1c880e2627349d8626 Author: Thierry Reding Date: Thu Dec 20 18:19:57 2018 +0100 mailbox: omap: Use device-managed registration API Get rid of some boilerplate driver removal code by using the newly added device-managed registration API. Signed-off-by: Thierry Reding Signed-off-by: Jassi Brar drivers/mailbox/omap-mailbox.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit ec1c674f0ae3905cd540ab2f30d9c4265981d7b4 Author: Thierry Reding Date: Thu Dec 20 18:19:56 2018 +0100 mailbox: mtk-cmdq: Remove needless devm_kfree() calls Memory allocated through device-managed functions doesn't need to be explicitly freed, so these calls can be removed. Signed-off-by: Thierry Reding Signed-off-by: Jassi Brar drivers/mailbox/mtk-cmdq-mailbox.c | 8 -------- 1 file changed, 8 deletions(-) commit 8aed5719557269807447b8bb936067b36a54b787 Author: Thierry Reding Date: Thu Dec 20 18:19:55 2018 +0100 mailbox: mtk-cmdq: Use device-managed registration API Get rid of some boilerplate driver removal code by using the newly added device-managed registration API. Signed-off-by: Thierry Reding Signed-off-by: Jassi Brar drivers/mailbox/mtk-cmdq-mailbox.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 0b7f5fe837f682dbb9f751afb513a4b28c7ceb56 Author: Thierry Reding Date: Thu Dec 20 18:19:54 2018 +0100 mailbox: xgene-slimpro: Use device-managed registration API Get rid of some boilerplate driver removal code by using the newly added device-managed registration API. Signed-off-by: Thierry Reding Signed-off-by: Jassi Brar drivers/mailbox/mailbox-xgene-slimpro.c | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) commit d0c196dbee7957ea446c4047c501537aeccf5fa0 Author: Thierry Reding Date: Thu Dec 20 18:19:53 2018 +0100 mailbox: sti: Use device-managed registration API Get rid of some boilerplate driver removal code by using the newly added device-managed registration API. Acked-by: Lee Jones Signed-off-by: Thierry Reding Signed-off-by: Jassi Brar drivers/mailbox/mailbox-sti.c | 13 +------------ 1 file changed, 1 insertion(+), 12 deletions(-) commit 87f63f578b734ca45cb8ebe251bd65560b89de26 Author: Thierry Reding Date: Thu Dec 20 18:19:52 2018 +0100 mailbox: altera: Use device-managed registration API Get rid of some boilerplate driver removal code by using the newly added device-managed registration API. Signed-off-by: Thierry Reding Signed-off-by: Jassi Brar drivers/mailbox/mailbox-altera.c | 15 +-------------- 1 file changed, 1 insertion(+), 14 deletions(-) commit 4013286c7231e05780c6e73b91d357678f819b4b Author: Thierry Reding Date: Thu Dec 20 18:19:51 2018 +0100 mailbox: imx: Use device-managed registration API Get rid of some boilerplate driver removal code by using the newly added device-managed registration API. Reviewed-by: Oleksij Rempel Signed-off-by: Thierry Reding Signed-off-by: Jassi Brar drivers/mailbox/imx-mailbox.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit ad3e7f9651ca344fc14b1709c7f91d9e570c389c Author: Thierry Reding Date: Thu Dec 20 18:19:50 2018 +0100 mailbox: hi6220: Use device-managed registration API Get rid of some boilerplate driver removal code by using the newly added device-managed registration API. Reviewed-by: Leo Yan Signed-off-by: Thierry Reding Signed-off-by: Jassi Brar drivers/mailbox/hi6220-mailbox.c | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) commit e73cb83c807b3a1c3c430b646668ce358b13ee74 Author: Thierry Reding Date: Thu Dec 20 18:19:49 2018 +0100 mailbox: hi3660: Use device-managed registration API Get rid of some boilerplate driver removal code by using the newly added device-managed registration API. Tested-by: Leo Yan Signed-off-by: Thierry Reding Signed-off-by: Jassi Brar drivers/mailbox/hi3660-mailbox.c | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) commit 6267ee6afae0a3c130dc585118dd60e090c6448b Author: Thierry Reding Date: Thu Dec 20 18:19:48 2018 +0100 mailbox: bcm-pdc: Use device-managed registration API Get rid of some boilerplate driver removal code by using the newly added device-managed registration API. Signed-off-by: Thierry Reding Signed-off-by: Jassi Brar drivers/mailbox/bcm-pdc-mailbox.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 0cafc12ab9cc163e6078db8ec978c200a632e88e Author: Thierry Reding Date: Thu Dec 20 18:19:47 2018 +0100 mailbox: bcm-flexrm: Use device-managed registration API Get rid of some boilerplate driver removal code by using the newly added device-managed registration API. Signed-off-by: Thierry Reding Acked-by: Scott Branden Signed-off-by: Jassi Brar drivers/mailbox/bcm-flexrm-mailbox.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 709cbeea1b34f92619140b20bf15602a7f1240d8 Author: Thierry Reding Date: Thu Dec 20 18:19:46 2018 +0100 mailbox: bcm2835: Use device-managed registration API Get rid of some boilerplate driver removal code by using the newly added device-managed registration API. Reviewed-by: Eric Anholt Signed-off-by: Thierry Reding Signed-off-by: Jassi Brar drivers/mailbox/bcm2835-mailbox.c | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) commit 6aba2f4aac1ac030edacc76a10043e4d1b885e3d Author: Thierry Reding Date: Thu Dec 20 18:19:45 2018 +0100 mailbox: arm-mhu: Use device-managed registration API Get rid of some boilerplate driver removal code by using the newly added device-managed registration API. Reviewed-by: Sudeep Holla Signed-off-by: Thierry Reding Signed-off-by: Jassi Brar drivers/mailbox/arm_mhu.c | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) commit e898d9cdd3a9f105863d63dd3b46443742a4757c Author: Thierry Reding Date: Thu Dec 20 18:19:44 2018 +0100 mailbox: Add device-managed registration functions Add device-managed equivalents of the mbox_controller_register() and mbox_controller_unregister() functions that can be used to have the devres infrastructure automatically unregister mailbox controllers on driver probe failure or driver removal. This can help remove a lot of boiler plate code from drivers. Reviewed-by: Bjorn Andersson Reviewed-by: Sudeep Holla Signed-off-by: Thierry Reding Signed-off-by: Jassi Brar drivers/mailbox/mailbox.c | 70 ++++++++++++++++++++++++++++++++++++++ include/linux/mailbox_controller.h | 5 +++ 2 files changed, 75 insertions(+) commit 1c3243f61fa7daea78de9866af2625f559ebf456 Author: Matt Turner Date: Fri Dec 21 11:17:55 2018 -0800 alpha: Remove some unused variables Fixes: 42a0cc347858 ("sys: don't hold uts_sem while accessing userspace memory") Signed-off-by: Matt Turner arch/alpha/kernel/osf_sys.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 1f4883f300da4f4d9d31eaa80f7debf6ce74843b Author: Dave Jiang Date: Mon Dec 10 13:36:14 2018 -0700 libnvdimm/security: Add documentation for nvdimm security support Add theory of operation for the security support that's going into libnvdimm. Signed-off-by: Dave Jiang Reviewed-by: Jing Lin Signed-off-by: Dan Williams Documentation/nvdimm/security.txt | 141 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 141 insertions(+) commit ecaa4a97b3908be0bf3ad12181ae8c44d1816d40 Author: Dave Jiang Date: Mon Dec 10 13:33:24 2018 -0700 tools/testing/nvdimm: add Intel DSM 1.8 support for nfit_test Adding test support for new Intel DSM from v1.8. The ability of simulating master passphrase update and master secure erase have been added to nfit_test. Signed-off-by: Dave Jiang Signed-off-by: Dan Williams tools/testing/nvdimm/test/nfit.c | 86 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 86 insertions(+) commit 926f74802cb1ce0ef0c3b9f806ea542beb57e50d Author: Dave Jiang Date: Mon Dec 10 13:32:16 2018 -0700 tools/testing/nvdimm: Add overwrite support for nfit_test With the implementation of Intel NVDIMM DSM overwrite, we are adding unit test to nfit_test for testing of overwrite operation. Signed-off-by: Dave Jiang Signed-off-by: Dan Williams tools/testing/nvdimm/test/nfit.c | 55 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) commit 3c13e2ac747a37e683597d3d875f839f2bc150e1 Author: Dave Jiang Date: Mon Dec 10 13:20:42 2018 -0700 tools/testing/nvdimm: Add test support for Intel nvdimm security DSMs Add nfit_test support for DSM functions "Get Security State", "Set Passphrase", "Disable Passphrase", "Unlock Unit", "Freeze Lock", and "Secure Erase" for the fake DIMMs. Also adding a sysfs knob in order to put the DIMMs in "locked" state. The order of testing DIMM unlocking would be. 1a. Disable DIMM X. 1b. Set Passphrase to DIMM X. 2. Write to /sys/devices/platform/nfit_test.0/nfit_test_dimm/test_dimmX/lock_dimm 3. Renable DIMM X 4. Check DIMM X state via sysfs "security" attribute for nmemX. Signed-off-by: Dave Jiang Signed-off-by: Dan Williams drivers/nvdimm/dimm_devs.c | 2 +- tools/testing/nvdimm/Kbuild | 1 + tools/testing/nvdimm/dimm_devs.c | 41 +++++++++ tools/testing/nvdimm/test/nfit.c | 180 +++++++++++++++++++++++++++++++++++++++ 4 files changed, 223 insertions(+), 1 deletion(-) commit 89fa9d8ea7bdfa841d19044485cec5f4171069e5 Author: Dave Jiang Date: Mon Dec 10 10:53:22 2018 -0700 acpi/nfit, libnvdimm/security: add Intel DSM 1.8 master passphrase support With Intel DSM 1.8 [1] two new security DSMs are introduced. Enable/update master passphrase and master secure erase. The master passphrase allows a secure erase to be performed without the user passphrase that is set on the NVDIMM. The commands of master_update and master_erase are added to the sysfs knob in order to initiate the DSMs. They are similar in opeartion mechanism compare to update and erase. [1]: http://pmem.io/documents/NVDIMM_DSM_Interface-V1.8.pdf Signed-off-by: Dave Jiang Signed-off-by: Dan Williams drivers/acpi/nfit/core.c | 2 ++ drivers/acpi/nfit/intel.c | 53 +++++++++++++++++++++++++++++++--------------- drivers/nvdimm/dimm_devs.c | 34 ++++++++++++++++++++--------- drivers/nvdimm/nd-core.h | 21 ++++++++++++------ drivers/nvdimm/security.c | 43 ++++++++++++++++++++++++++----------- include/linux/libnvdimm.h | 14 +++++++++--- 6 files changed, 118 insertions(+), 49 deletions(-) commit 7d988097c546187ada602cc9bccd0f03d473eb8f Author: Dave Jiang Date: Thu Dec 13 15:36:18 2018 -0700 acpi/nfit, libnvdimm/security: Add security DSM overwrite support Add support for the NVDIMM_FAMILY_INTEL "ovewrite" capability as described by the Intel DSM spec v1.7. This will allow triggering of overwrite on Intel NVDIMMs. The overwrite operation can take tens of minutes. When the overwrite DSM is issued successfully, the NVDIMMs will be unaccessible. The kernel will do backoff polling to detect when the overwrite process is completed. According to the DSM spec v1.7, the 128G NVDIMMs can take up to 15mins to perform overwrite and larger DIMMs will take longer. Given that overwrite puts the DIMM in an indeterminate state until it completes introduce the NDD_SECURITY_OVERWRITE flag to prevent other operations from executing when overwrite is happening. The NDD_WORK_PENDING flag is added to denote that there is a device reference on the nvdimm device for an async workqueue thread context. Signed-off-by: Dave Jiang Signed-off-by: Dan Williams drivers/acpi/nfit/core.c | 5 ++ drivers/acpi/nfit/intel.c | 90 +++++++++++++++++++++++++++++ drivers/nvdimm/bus.c | 21 ++++++- drivers/nvdimm/dimm_devs.c | 32 ++++++++++- drivers/nvdimm/nd-core.h | 14 +++++ drivers/nvdimm/region_devs.c | 5 ++ drivers/nvdimm/security.c | 133 +++++++++++++++++++++++++++++++++++++++++++ include/linux/libnvdimm.h | 9 +++ 8 files changed, 304 insertions(+), 5 deletions(-) commit 64e77c8c047fb91ea8c7800c1238108a72f0bf9c Author: Dave Jiang Date: Fri Dec 7 14:02:12 2018 -0700 acpi/nfit, libnvdimm: Add support for issue secure erase DSM to Intel nvdimm Add support to issue a secure erase DSM to the Intel nvdimm. The required passphrase is acquired from an encrypted key in the kernel user keyring. To trigger the action, "erase " is written to the "security" sysfs attribute. Signed-off-by: Dave Jiang Signed-off-by: Dan Williams drivers/acpi/nfit/intel.c | 47 ++++++++++++++++++++++++++++++++++++++++++++++ drivers/nvdimm/dimm_devs.c | 9 +++++++-- drivers/nvdimm/nd-core.h | 5 +++++ drivers/nvdimm/security.c | 41 ++++++++++++++++++++++++++++++++++++++++ include/linux/libnvdimm.h | 2 ++ 5 files changed, 102 insertions(+), 2 deletions(-) commit d2a4ac73f56a5d0709d28b41fec8d15e4500f8f1 Author: Dave Jiang Date: Fri Dec 7 13:29:09 2018 -0700 acpi/nfit, libnvdimm: Add enable/update passphrase support for Intel nvdimms Add support for enabling and updating passphrase on the Intel nvdimms. The passphrase is the an encrypted key in the kernel user keyring. We trigger the update via writing "update " to the sysfs attribute "security". If no exists (for enabling security) then a 0 should be used. Signed-off-by: Dave Jiang Signed-off-by: Dan Williams drivers/nvdimm/dimm_devs.c | 11 ++++++--- drivers/nvdimm/nd-core.h | 7 ++++++ drivers/nvdimm/security.c | 58 ++++++++++++++++++++++++++++++++++++++++++---- 3 files changed, 69 insertions(+), 7 deletions(-) commit 03b65b22ada8115a7a7bfdf0789f6a94adfd6070 Author: Dave Jiang Date: Fri Dec 7 10:33:30 2018 -0700 acpi/nfit, libnvdimm: Add disable passphrase support to Intel nvdimm. Add support to disable passphrase (security) for the Intel nvdimm. The passphrase used for disabling is pulled from an encrypted-key in the kernel user keyring. The action is triggered by writing "disable " to the sysfs attribute "security". Signed-off-by: Dave Jiang Signed-off-by: Dan Williams drivers/acpi/nfit/intel.c | 41 ++++++++++++++++++++++++++++++ drivers/nvdimm/dimm_devs.c | 47 +++++++++++++++++++++++++++++++--- drivers/nvdimm/nd-core.h | 9 +++++++ drivers/nvdimm/security.c | 63 ++++++++++++++++++++++++++++++++++++++++++++++ include/linux/libnvdimm.h | 2 ++ 5 files changed, 159 insertions(+), 3 deletions(-) commit f6653a0e0877572c87f6dab5351e7bd6b6b7100c Author: Alex Deucher Date: Thu Dec 20 10:08:46 2018 -0500 drm/amdgpu: Add new VegaM pci id Add a new pci id. Reviewed-by: Leo Liu Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 1 + 1 file changed, 1 insertion(+) commit 0f6be2c09af65a85d34653e609b5f45e25a9e95a Author: Michel Dänzer Date: Fri Nov 30 18:15:22 2018 +0100 drm/ttm: Use drm_debug_printer for all ttm_bo_mem_space_debug output No need for pr_err here, the pr_err message in ttm_bo_evict is enough to draw attention to something not going as planned. Reviewed-by: Christian König Reviewed-by: Junwei Zhang Signed-off-by: Michel Dänzer Signed-off-by: Alex Deucher drivers/gpu/drm/ttm/ttm_bo.c | 33 +++++++++++++++++---------------- 1 file changed, 17 insertions(+), 16 deletions(-) commit 06d6370e7b200882ab23bafd86a4024c7571c778 Author: Evan Quan Date: Thu Dec 20 22:44:54 2018 +0800 drm/amdgpu: add Vega20 PSP ASD firmware loading Add PSP ASD firmware loading on Vega20. Not sure why this was missing before. Signed-off-by: Evan Quan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/psp_v11_0.c | 40 ++++++++++++++++++++++++++-------- 1 file changed, 31 insertions(+), 9 deletions(-) commit d8a706414af4827fc0b4b1c0c631c607351938b9 Author: Dan Williams Date: Fri Dec 21 11:35:53 2018 -0800 dax: Use non-exclusive wait in wait_entry_unlocked() get_unlocked_entry() uses an exclusive wait because it is guaranteed to eventually obtain the lock and follow on with an unlock+wakeup cycle. The wait_entry_unlocked() path does not have the same guarantee. Rather than open-code an extra wakeup, just switch to a non-exclusive wait. Cc: Jan Kara Cc: Matthew Wilcox Reported-by: Linus Torvalds Signed-off-by: Dan Williams fs/dax.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) commit aa74be6eeade1caf3ef945ff1812059f3d7dc947 Author: Yishai Hadas Date: Sun Dec 9 12:52:36 2018 +0200 IB/mlx5: Allocate the per-port Q counter shared when DEVX is supported The per-port Q counter is some kernel resource and as such may be used by few UID(s) upon DEVX usage. To enable using it for QP/RQ when DEVX context is used need to allocate it with a sharing mode indication to let firmware allows its usage. The UID = 0xffff was chosen to mark it. Signed-off-by: Yishai Hadas Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/mlx5/cmd.c | 17 +++++++++++++++++ drivers/infiniband/hw/mlx5/cmd.h | 2 ++ drivers/infiniband/hw/mlx5/main.c | 9 +++++++-- 3 files changed, 26 insertions(+), 2 deletions(-) commit 5801169a2ed20003f771acecf3ac00574cf10a38 Author: Frank Rowand Date: Tue Dec 18 11:40:03 2018 -0800 of: __of_detach_node() - remove node from phandle cache Non-overlay dynamic devicetree node removal may leave the node in the phandle cache. Subsequent calls to of_find_node_by_phandle() will incorrectly find the stale entry. Remove the node from the cache. Add paranoia checks in of_find_node_by_phandle() as a second level of defense (do not return cached node if detached, do not add node to cache if detached). Fixes: 0b3ce78e90fc ("of: cache phandle nodes to reduce cost of of_find_node_by_phandle()") Reported-by: Michael Bringmann Cc: stable@vger.kernel.org # v4.17+ Signed-off-by: Frank Rowand Signed-off-by: Rob Herring drivers/of/base.c | 31 ++++++++++++++++++++++++++++++- drivers/of/dynamic.c | 3 +++ drivers/of/of_private.h | 4 ++++ 3 files changed, 37 insertions(+), 1 deletion(-) commit b8a9ac1a5b99a2fcbed19fd29d2d59270c281a31 Author: Frank Rowand Date: Tue Dec 18 11:40:02 2018 -0800 of: of_node_get()/of_node_put() nodes held in phandle cache The phandle cache contains struct device_node pointers. The refcount of the pointers was not incremented while in the cache, allowing use after free error after kfree() of the node. Add the proper increment and decrement of the use count. Fixes: 0b3ce78e90fc ("of: cache phandle nodes to reduce cost of of_find_node_by_phandle()") Cc: stable@vger.kernel.org # v4.17+ Signed-off-by: Frank Rowand Signed-off-by: Rob Herring drivers/of/base.c | 70 ++++++++++++++++++++++++++++++++++++------------------- 1 file changed, 46 insertions(+), 24 deletions(-) commit 75bf8a2a2f6b0def50009a631ea2f22f0143ba6c Author: Parav Pandit Date: Fri Dec 21 16:19:27 2018 +0200 IB/umad: Start using dev_groups of class Start using core defined dev_groups of a class which allows to add device attributes to the core kernel and simplify the umad module. Signed-off-by: Parav Pandit Reviewed-by: Jack Morgenstein Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/core/user_mad.c | 28 ++++++++++++---------------- 1 file changed, 12 insertions(+), 16 deletions(-) commit cdb53b65ae1b3beac2aaddf6c2d0cef798863466 Author: Parav Pandit Date: Fri Dec 21 16:19:26 2018 +0200 IB/umad: Use class_groups and let core create class file Use class->class_groups core kernel facility to create the abi version file instead of open coding. Signed-off-by: Parav Pandit Reviewed-by: Jack Morgenstein Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/core/user_mad.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) commit e9dd5daf884cf591f9c9a122351d2f9ccf7b97d3 Author: Parav Pandit Date: Fri Dec 21 16:19:25 2018 +0200 IB/umad: Refactor code to use cdev_device_add() Refactor code to use cdev_device_add() and do other minor refactors while modifying these functions as below. 1. Instead of returning generic -1, return an actual error for ib_umad_init_port(). 2. Introduce and use ib_umad_init_port_dev() for sm and umad char devices. 3. Instead of kobj, use more light weight kref to refcount ib_umad_device. 4. Use modern cdev_device_add() single code cut down three steps of cdev_add(), device_create(). This further helps to move device sysfs files to class attributes in subsequent patch. 5. Remove few empty lines while refactoring these functions. 6. Use sizeof() instead of sizeof to avoid checkpatch warning. 7. Use struct_size() for calculation of ib_umad_port. Signed-off-by: Parav Pandit Reviewed-by: Jack Morgenstein Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/core/user_mad.c | 171 +++++++++++++++++++------------------ 1 file changed, 86 insertions(+), 85 deletions(-) commit 594d1644cd59447f4fceb592448d5cd09eb09b5e Author: Chris Perl Date: Mon Dec 17 10:56:38 2018 -0500 NFS: nfs_compare_mount_options always compare auth flavors. This patch removes the check from nfs_compare_mount_options to see if a `sec' option was passed for the current mount before comparing auth flavors and instead just always compares auth flavors. Consider the following scenario: You have a server with the address 192.168.1.1 and two exports /export/a and /export/b. The first export supports `sys' and `krb5' security, the second just `sys'. Assume you start with no mounts from the server. The following results in EIOs being returned as the kernel nfs client incorrectly thinks it can share the underlying `struct nfs_server's: $ mkdir /tmp/{a,b} $ sudo mount -t nfs -o vers=3,sec=krb5 192.168.1.1:/export/a /tmp/a $ sudo mount -t nfs -o vers=3 192.168.1.1:/export/b /tmp/b $ df >/dev/null df: ‘/tmp/b’: Input/output error Signed-off-by: Chris Perl Signed-off-by: Anna Schumaker fs/nfs/super.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 64935310f2fc0128373bbbcfb5b8b49fd26e2ae8 Merge: 7fa4bd739fc0 682ec859518d Author: David S. Miller Date: Fri Dec 21 10:24:54 2018 -0800 Merge branch 'skb_ext-fixes' Paolo Abeni says: ==================== net: skb extension follow-ups This series includes some follow-up for the recently added skb extension. The first patch addresses an unlikely race while adding skb extensions, and the following two are just minor code clean-up. v1 -> v2: - be sure to flag the newly added extension as active in skb_ext_add() ==================== Signed-off-by: David S. Miller commit 682ec859518d73435cc924d816da2953343241c1 Author: Paolo Abeni Date: Fri Dec 21 19:03:15 2018 +0100 net: minor cleanup in skb_ext_add() When the extension to be added is already present, the only skb field we may need to update is 'extensions': we can reorder the code and avoid a branch. v1 -> v2: - be sure to flag the newly added extension as active Signed-off-by: Paolo Abeni Acked-by: Florian Westphal Signed-off-by: David S. Miller net/core/skbuff.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) commit d312d0a6846a4553bd955afd414f8f55398ece07 Author: Paolo Abeni Date: Fri Dec 21 19:03:14 2018 +0100 net: drop the unused helper skb_ext_get() Such helper is currently unused, and skb extension users are better off using skb_ext_add()/skb_ext_del(). So let's drop it. Signed-off-by: Paolo Abeni Acked-by: Florian Westphal Signed-off-by: David S. Miller include/linux/skbuff.h | 11 ----------- 1 file changed, 11 deletions(-) commit e94e50bd88f7ed2f2d40c32c06efd61c36c33ec8 Author: Paolo Abeni Date: Fri Dec 21 19:03:13 2018 +0100 net: fix possible user-after-free in skb_ext_add() On cow we can free the old extension: we must avoid dereferencing such extension after skb_ext_maybe_cow(). Since 'new' contents are always equal to 'old' after the copy, we can fix the above accessing the relevant data using 'new'. Fixes: df5042f4c5b9 ("sk_buff: add skb extension infrastructure") Signed-off-by: Paolo Abeni Acked-by: Florian Westphal Signed-off-by: David S. Miller net/core/skbuff.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit cf7ad3030271c55a7119a8c2162563e3f6e93879 Author: Parav Pandit Date: Fri Dec 21 16:19:24 2018 +0200 IB/umad: Avoid destroying device while it is accessed ib_umad_reg_agent2() and ib_umad_reg_agent() access the device name in dev_notice(), while concurrently, ib_umad_kill_port() can destroy the device using device_destroy(). cpu-0 cpu-1 ----- ----- ib_umad_ioctl() [...] ib_umad_kill_port() device_destroy(dev) ib_umad_reg_agent() dev_notice(dev) Therefore, first mark ib_dev as NULL, to block any further access in file ops, unregister the mad agent and destroy the device at the end after mutex is unlocked. This ensures that device doesn't get destroyed, while it may get accessed. Fixes: 0f29b46d49b0 ("IB/mad: add new ioctl to ABI to support new registration options") Signed-off-by: Parav Pandit Reviewed-by: Jack Morgenstein Reviewed-by: Ira Weiny Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/core/user_mad.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) commit 900d07c12d4ed0e2c237655b55383df8d2c715ff Author: Parav Pandit Date: Fri Dec 21 16:19:23 2018 +0200 IB/umad: Simplify and avoid dynamic allocation of class Simplify code to have a static structure instance for umad class allocation. This will allow to have class attributes defined along with class registration in subsequent patch and allows more class methods definition similar to ib_core module. Signed-off-by: Parav Pandit Reviewed-by: Jack Morgenstein Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/core/user_mad.c | 42 +++++++++++++++++++------------------- 1 file changed, 21 insertions(+), 21 deletions(-) commit 3030cf95ab2084678e9d2e0315d29cec80479eb0 Author: Alexandre Belloni Date: Sun Sep 9 23:15:04 2018 +0200 alpha: rtc: simplify alpha_rtc_init Use devm_rtc_allocate_device to simplify choosing the rtc_ops in alpha_rtc_init(). Signed-off-by: Alexandre Belloni Signed-off-by: Matt Turner arch/alpha/kernel/rtc.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-) commit a104d44b183ce34b645bbcc8483d9d39fd488c55 Author: Daniel Bristot de Oliveira Date: Tue Sep 25 20:31:48 2018 +0200 alpha: Fix a typo on ptrace.h - struct has as little information as possible. * I does not have* + struct has as little information as possible. *It does not have* Signed-off-by: Daniel Bristot de Oliveira Cc: Richard Henderson Cc: Ivan Kokshaysky Cc: Matt Turner Cc: Thomas Gleixner Cc: linux-alpha@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Matt Turner arch/alpha/include/uapi/asm/ptrace.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fb430b39dbb0def3c7fc47a79fb02c5dfcda9f9c Author: Colin Ian King Date: Fri Oct 12 15:53:14 2018 +0100 alpha: fix spelling mistake QSD_PORT_ACTUVE -> QSD_PORT_ACTIVE Trivial fix to spelling mistake in kernel error message Signed-off-by: Colin Ian King Signed-off-by: Matt Turner arch/alpha/kernel/core_wildfire.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a8faab540f0ab2a03afd12e361d3c6e463226fae Author: Firoz Khan Date: Tue Nov 13 15:01:53 2018 +0530 alpha: generate uapi header and syscall table header files System call table generation script must be run to gener- ate unistd_32.h and syscall_table.h files. This patch will have changes which will invokes the script. This patch will generate unistd_32.h and syscall_table.h files by the syscall table generation script invoked by alpha/Makefile and the generated files against the removed files must be identical. The generated uapi header file will be included in uapi/- asm/unistd.h and generated system call table header file will be included by kernel/systbls.S file. Signed-off-by: Firoz Khan Signed-off-by: Matt Turner arch/alpha/Makefile | 3 + arch/alpha/include/asm/Kbuild | 2 +- arch/alpha/include/uapi/asm/Kbuild | 1 + arch/alpha/include/uapi/asm/unistd.h | 467 +----------------------------- arch/alpha/kernel/systbls.S | 537 +---------------------------------- 5 files changed, 9 insertions(+), 1001 deletions(-) commit cabcebd33b8b80276d4cbbb1091e784dfbc516f8 Author: Firoz Khan Date: Tue Nov 13 15:01:52 2018 +0530 alpha: add system call table generation support The system call tables are in different format in all architecture and it will be difficult to manually add, modify or delete the syscall table entries in the res- pective files. To make it easy by keeping a script and which will generate the uapi header and syscall table file. This change will also help to unify the implemen- tation across all architectures. The system call table generation script is added in kernel/syscalls directory which contain the scripts to generate both uapi header file and system call table files. The syscall.tbl will be input for the scripts. syscall.tbl contains the list of available system calls along with system call number and corresponding entry point. Add a new system call in this architecture will be possible by adding new entry in the syscall.tbl file. Adding a new table entry consisting of: - System call number. - ABI. - System call name. - Entry point name. syscallhdr.sh and syscalltbl.sh will generate uapi header unistd_32.h and syscall_table.h files respectively. Both .sh files will parse the content syscall.tbl to generate the header and table files. unistd_32.h will be included by uapi/asm/unistd.h and syscall_table.h is included by kernel/syscall.S - the real system call table. ARM, s390 and x86 architecuture does have similar support. I leverage their implementation to come up with a generic solution. Signed-off-by: Firoz Khan Signed-off-by: Matt Turner arch/alpha/kernel/syscalls/Makefile | 38 +++ arch/alpha/kernel/syscalls/syscall.tbl | 453 +++++++++++++++++++++++++++++++ arch/alpha/kernel/syscalls/syscallhdr.sh | 36 +++ arch/alpha/kernel/syscalls/syscalltbl.sh | 32 +++ 4 files changed, 559 insertions(+) commit b67bfd298f4c7ab3762aebb354a0b16635c82211 Author: Firoz Khan Date: Tue Nov 13 15:01:51 2018 +0530 alpha: add __NR_syscalls along with NR_SYSCALLS NR_SYSCALLS macro holds the number of system call exist in alpha architecture. We have to change the value of NR- _SYSCALLS, if we add or delete a system call. One of the patch in this patch series has a script which will generate a uapi header based on syscall.tbl file. The syscall.tbl file contains the total number of system calls information. So we have two option to update NR_SY- CALLS value. 1. Update NR_SYSCALLS in asm/unistd.h manually by count- ing the no.of system calls. No need to update NR_SYS- CALLS until we either add a new system call or delete existing system call. 2. We can keep this feature it above mentioned script, that will count the number of syscalls and keep it in a generated file. In this case we don't need to expli- citly update NR_SYSCALLS in asm/unistd.h file. The 2nd option will be the recommended one. For that, I added the __NR_syscalls macro in uapi/asm/unistd.h along with NR_SYSCALLS asm/unistd.h. The macro __NR_syscalls also added for making the name convention same across all architecture. While __NR_syscalls isn't strictly part of the uapi, having it as part of the generated header to simplifies the implementation. We also need to enclose this macro with #ifdef __KERNEL__ to avoid side effects. Signed-off-by: Firoz Khan Signed-off-by: Matt Turner arch/alpha/include/asm/unistd.h | 2 +- arch/alpha/include/uapi/asm/unistd.h | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) commit d8bf616be5f05b955d3ee32ad92d4cdb87e30349 Author: Firoz Khan Date: Tue Nov 13 15:01:50 2018 +0530 alpha: remove CONFIG_OSF4_COMPAT flag from syscall table Remove CONFIG_OSF4_COMPAT config flag from system call table - systbls.S and to keep the same feature, add the flag in osf_sys.c. One of the patch in this patch series will generate the system call table file. In order to come up with a common implementation across all architecture, we need this change. Signed-off-by: Firoz Khan Signed-off-by: Matt Turner arch/alpha/kernel/osf_sys.c | 9 ++++++--- arch/alpha/kernel/systbls.S | 5 ----- 2 files changed, 6 insertions(+), 8 deletions(-) commit 150fbd536f9eb3044c2b048dc13ee648a78afb93 Author: Firoz Khan Date: Tue Nov 13 15:01:49 2018 +0530 alpha: move __IGNORE* entries to non uapi header All the __IGNORE* entries are resides in the uapi header file move to non uapi header asm/unistd.h as it is not used by any user space applications. It is correct to keep __IGNORE* entry in non uapi header asm/unistd.h while uapi/asm/unistd.h must hold information only useful for user space applications. One of the patch in this patch series will generate uapi header file. The information which directly used by the user space application must be present in uapi file. Signed-off-by: Firoz Khan Signed-off-by: Matt Turner arch/alpha/include/asm/unistd.h | 21 +++++++++++++++++++++ arch/alpha/include/uapi/asm/unistd.h | 21 --------------------- 2 files changed, 21 insertions(+), 21 deletions(-) commit 7fa4bd739fc0fa209fa5120383aab17f6e9600f7 Author: Daniel Borkmann Date: Fri Dec 21 14:04:46 2018 +0100 bpf: fix segfault in test_verifier selftest Minor fallout from merge resolution, test_verifier was segfaulting because the REJECT result was correct, but errstr was NULL. Properly fix it as in 339bbff2d6e0. Fixes: 339bbff2d6e0 ("Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next") Signed-off-by: Daniel Borkmann Signed-off-by: David S. Miller tools/testing/selftests/bpf/test_verifier.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 718c43038f287e843c2f63d946977de90014cb11 Author: Al Viro Date: Thu Dec 20 03:16:27 2018 -0500 mount_fs: suppress MAC on MS_SUBMOUNT as well as MS_KERNMOUNT Reviewed-by: David Howells Signed-off-by: Al Viro fs/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d2497e12e230c3f1be8ca6a0609a98c8c609fb80 Author: Al Viro Date: Sun Dec 16 01:37:06 2018 -0500 smack: rewrite smack_sb_eat_lsm_opts() make it use smack_add_opt() and avoid separate copies - gather non-LSM options by memmove() in place Reviewed-by: David Howells Signed-off-by: Al Viro security/smack/smack_lsm.c | 108 ++++++++++----------------------------------- 1 file changed, 23 insertions(+), 85 deletions(-) commit c3300aaf95fb4e5be41e731fa6427d0d996d32ac Author: Al Viro Date: Sun Dec 16 01:52:24 2018 -0500 smack: get rid of match_token() same issue as with selinux... [fix by Andrei Vagin folded in] Reviewed-by: David Howells Signed-off-by: Al Viro security/smack/smack_lsm.c | 56 +++++++++++++++++++++++++++++++--------------- 1 file changed, 38 insertions(+), 18 deletions(-) commit 55c0e5bd078eba2d41d76fa25d5d5e55f1ff09ee Author: Al Viro Date: Sun Dec 16 01:09:45 2018 -0500 smack: take the guts of smack_parse_opts_str() into a new helper smack_add_opt() adds an already matched option to growing smack_mnt_options Reviewed-by: David Howells Signed-off-by: Al Viro security/smack/smack_lsm.c | 114 ++++++++++++++++++++++----------------------- 1 file changed, 57 insertions(+), 57 deletions(-) commit 757cbe597fe8490c7c0a9650ebe5d60195f151d4 Author: Al Viro Date: Fri Dec 14 23:42:21 2018 -0500 LSM: new method: ->sb_add_mnt_opt() Adding options to growing mnt_opts. NFS kludge with passing context= down into non-text-options mount switched to it, and with that the last use of ->sb_parse_opts_str() is gone. Reviewed-by: David Howells Signed-off-by: Al Viro fs/nfs/super.c | 9 ++------- include/linux/lsm_hooks.h | 5 +++-- include/linux/security.h | 6 ++++-- security/security.c | 8 +++++--- security/selinux/hooks.c | 45 +++++++++++++++++++-------------------------- security/smack/smack_lsm.c | 1 - 6 files changed, 33 insertions(+), 41 deletions(-) commit 99dbbb593fe6b39153c15ea9b9c63ea911864cf2 Author: Al Viro Date: Fri Dec 14 21:56:23 2018 -0500 selinux: rewrite selinux_sb_eat_lsm_opts() make it use selinux_add_opt() and avoid separate copies - gather non-LSM options by memmove() in place Reviewed-by: David Howells Signed-off-by: Al Viro security/selinux/hooks.c | 146 ++++++++++++++++++----------------------------- 1 file changed, 54 insertions(+), 92 deletions(-) commit da3d76abb2e74c07b1cd620ee5e3b31227846c7c Author: Al Viro Date: Mon Dec 17 10:14:16 2018 -0500 selinux: regularize Opt_... names a bit Reviewed-by: David Howells Signed-off-by: Al Viro security/selinux/hooks.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) commit 169d68efb03b728588c209c682f14328eec485c0 Author: Al Viro Date: Fri Dec 14 22:44:50 2018 -0500 selinux: switch away from match_token() It's not a good fit, unfortunately, and the next step will make it even less so. Open-code what we need here. Reviewed-by: David Howells Signed-off-by: Al Viro security/selinux/hooks.c | 82 ++++++++++++++++++++++++++++++++---------------- 1 file changed, 55 insertions(+), 27 deletions(-) commit ba6418623385abf19a6c15cf0b1cfaacfdf9afc8 Author: Al Viro Date: Fri Dec 14 20:28:15 2018 -0500 selinux: new helper - selinux_add_opt() the guts of the loop in selinux_parse_opts_str() - takes one (already recognized) option and adds it to growing selinux_mnt_opts. Reviewed-by: David Howells Signed-off-by: Al Viro security/selinux/hooks.c | 126 ++++++++++++++++++++--------------------------- 1 file changed, 53 insertions(+), 73 deletions(-) commit 84d8c4a5ef696ca96fa7a8d64db9222658b9d142 Author: Al Viro Date: Thu Dec 13 15:18:44 2018 -0500 LSM: bury struct security_mnt_opts no users left Reviewed-by: David Howells Signed-off-by: Al Viro include/linux/security.h | 8 -------- 1 file changed, 8 deletions(-) commit 12085b14a4440a6d12ff7966702c010df87caef0 Author: Al Viro Date: Thu Dec 13 15:18:05 2018 -0500 smack: switch to private smack_mnt_opts Reviewed-by: David Howells Signed-off-by: Al Viro security/smack/smack_lsm.c | 157 ++++++++++++++++----------------------------- 1 file changed, 55 insertions(+), 102 deletions(-) commit bd3236557bb256d6491df125e5e9d0393c70e4d2 Author: Al Viro Date: Thu Dec 13 15:04:59 2018 -0500 selinux: switch to private struct selinux_mnt_opts none of the convolutions needed, just 4 strings, TYVM... Reviewed-by: David Howells Signed-off-by: Al Viro security/selinux/hooks.c | 262 ++++++++++++++++++----------------------------- 1 file changed, 101 insertions(+), 161 deletions(-) commit 204cc0ccf1d49c6292aeef4c8edd1b3d10ff933c Author: Al Viro Date: Thu Dec 13 13:41:47 2018 -0500 LSM: hide struct security_mnt_opts from any generic code Keep void * instead, allocate on demand (in parse_str_opts, at the moment). Eventually both selinux and smack will be better off with private structures with several strings in those, rather than this "counter and two pointers to dynamically allocated arrays" ugliness. This commit allows to do that at leisure, without disrupting anything outside of given module. Changes: * instead of struct security_mnt_opt use an opaque pointer initialized to NULL. * security_sb_eat_lsm_opts(), security_sb_parse_opts_str() and security_free_mnt_opts() take it as var argument (i.e. as void **); call sites are unchanged. * security_sb_set_mnt_opts() and security_sb_remount() take it by value (i.e. as void *). * new method: ->sb_free_mnt_opts(). Takes void *, does whatever freeing that needs to be done. * ->sb_set_mnt_opts() and ->sb_remount() might get NULL as mnt_opts argument, meaning "empty". Reviewed-by: David Howells Signed-off-by: Al Viro fs/btrfs/super.c | 10 ++++----- fs/namespace.c | 9 ++++---- fs/nfs/internal.h | 2 +- fs/nfs/super.c | 6 +++--- fs/super.c | 12 +++++------ include/linux/lsm_hooks.h | 11 +++++----- include/linux/security.h | 43 +++++++++----------------------------- security/security.c | 27 ++++++++++++++++-------- security/selinux/hooks.c | 52 +++++++++++++++++++++++++++++++++------------- security/smack/smack_lsm.c | 38 ++++++++++++++++++++++++++------- 10 files changed, 118 insertions(+), 92 deletions(-) commit e3489f8974e178d723259a842a1e61708dd7dc1e Author: Al Viro Date: Thu Dec 13 00:24:36 2018 -0500 selinux: kill selinux_sb_get_mnt_opts() it's much easier to just do the right thing in ->sb_show_options(), without bothering with allocating and populating arrays, etc. Reviewed-by: David Howells Signed-off-by: Al Viro security/selinux/hooks.c | 198 ++++++++++++----------------------------------- 1 file changed, 51 insertions(+), 147 deletions(-) commit 5b4002391153acebce2557af318bbdc17e235134 Author: Al Viro Date: Wed Dec 12 20:13:29 2018 -0500 LSM: turn sb_eat_lsm_opts() into a method Kill ->sb_copy_data() - it's used only in combination with immediately following ->sb_parse_opts_str(). Turn that combination into a new method. This is just a mechanical move - cleanups will be the next step. Reviewed-by: David Howells Signed-off-by: Al Viro include/linux/lsm_hooks.h | 4 ++-- security/security.c | 11 +---------- security/selinux/hooks.c | 16 +++++++++++++++- security/smack/smack_lsm.c | 16 +++++++++++++++- 4 files changed, 33 insertions(+), 14 deletions(-) commit 6a0440e5b7562512c021aa1b5a706fcc545773db Author: Al Viro Date: Mon Dec 10 17:30:41 2018 -0500 nfs_remount(): don't leak, don't ignore LSM options quietly * if mount(2) passes something like "context=foo" with MS_REMOUNT in flags (/sbin/mount.nfs will _not_ do that - you need to issue the syscall manually), you'll get leaked copies for LSM options. The reason is that instead of nfs_{alloc,free}_parsed_mount_data() nfs_remount() uses kzalloc/kfree, which lacks the needed cleanup. * selinux options are not changed on remount (as for any other fs), but in case of NFS the failure is quiet - they are not compared to what we used to have, with complaint in case of attempted changes. Trivially fixed by converting to use of security_sb_remount(). Reviewed-by: David Howells Signed-off-by: Al Viro fs/nfs/super.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit a65001e8a4d465693d0191297a6fd864c96b3147 Author: Al Viro Date: Mon Dec 10 17:19:21 2018 -0500 btrfs: sanitize security_mnt_opts use 1) keeping a copy in btrfs_fs_info is completely pointless - we never use it for anything. Getting rid of that allows for simpler calling conventions for setup_security_options() (caller is responsible for freeing mnt_opts in all cases). 2) on remount we want to use ->sb_remount(), not ->sb_set_mnt_opts(), same as we would if not for FS_BINARY_MOUNTDATA. Behaviours *are* close (in fact, selinux sb_set_mnt_opts() ought to punt to sb_remount() in "already initialized" case), but let's handle that uniformly. And the only reason why the original btrfs changes didn't go for security_sb_remount() in btrfs_remount() case is that it hadn't been exported. Let's export it for a while - it'll be going away soon anyway. Reviewed-by: David Howells Signed-off-by: Al Viro fs/btrfs/ctree.h | 4 ---- fs/btrfs/super.c | 63 ++++++++--------------------------------------------- security/security.c | 1 + 3 files changed, 10 insertions(+), 58 deletions(-) commit 8d64124a6a93ec68fda6f781e48a7b95d9dd17d9 Author: Al Viro Date: Mon Dec 10 15:34:12 2018 -0500 selinux; don't open-code a loop in sb_finish_set_opts() Reviewed-by: David Howells Signed-off-by: Al Viro security/selinux/hooks.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit a10d7c22b34bcf744679019269bfb33ebf0b75ee Author: Al Viro Date: Wed Dec 5 11:58:35 2018 -0500 LSM: split ->sb_set_mnt_opts() out of ->sb_kern_mount() ... leaving the "is it kernel-internal" logics in the caller. Reviewed-by: David Howells Signed-off-by: Al Viro fs/super.c | 8 +++++++- include/linux/lsm_hooks.h | 3 +-- include/linux/security.h | 6 ++---- security/security.c | 5 ++--- security/selinux/hooks.c | 10 +--------- security/smack/smack_lsm.c | 15 --------------- 6 files changed, 13 insertions(+), 34 deletions(-) commit f5c0c26d9008b355babb6d16f3d7c4de3bada0e7 Author: Al Viro Date: Sat Nov 17 12:09:18 2018 -0500 new helper: security_sb_eat_lsm_opts() combination of alloc_secdata(), security_sb_copy_data(), security_sb_parse_opt_str() and free_secdata(). Reviewed-by: David Howells Signed-off-by: Al Viro fs/btrfs/super.c | 15 +-------------- fs/namespace.c | 11 +---------- fs/nfs/super.c | 15 ++------------- fs/super.c | 13 +------------ include/linux/security.h | 28 +++------------------------- security/security.c | 15 ++++++++++++--- 6 files changed, 20 insertions(+), 77 deletions(-) commit c039bc3c2498724946304a8f964244a9b6af1043 Author: Al Viro Date: Sat Dec 1 23:06:57 2018 -0500 LSM: lift extracting and parsing LSM options into the caller of ->sb_remount() This paves the way for retaining the LSM options from a common filesystem mount context during a mount parameter parsing phase to be instituted prior to actual mount/reconfiguration actions. Reviewed-by: David Howells Signed-off-by: Al Viro fs/namespace.c | 19 ++++++++++++++++++- include/linux/lsm_hooks.h | 3 ++- include/linux/security.h | 5 +++-- security/security.c | 5 +++-- security/selinux/hooks.c | 47 ++++++++++++----------------------------------- 5 files changed, 38 insertions(+), 41 deletions(-) commit 6be8750b4cba8c37170f46b29841d112f1be749b Author: Al Viro Date: Sat Dec 1 22:42:44 2018 -0500 LSM: lift parsing LSM options into the caller of ->sb_kern_mount() This paves the way for retaining the LSM options from a common filesystem mount context during a mount parameter parsing phase to be instituted prior to actual mount/reconfiguration actions. Reviewed-by: David Howells Signed-off-by: Al Viro fs/super.c | 24 ++++++++++++++++-------- include/linux/lsm_hooks.h | 3 ++- include/linux/security.h | 6 ++++-- security/security.c | 5 +++-- security/selinux/hooks.c | 24 +++--------------------- security/smack/smack_lsm.c | 23 +++-------------------- 6 files changed, 31 insertions(+), 54 deletions(-) commit 6466f3d193a99426db067855345e763de2160f1c Author: Al Viro Date: Sat Dec 1 22:55:40 2018 -0500 smack: make smack_parse_opts_str() clean up on failure fixes e.g. a btrfs leak... Reviewed-by: David Howells Signed-off-by: Al Viro security/smack/smack_lsm.c | 1 + 1 file changed, 1 insertion(+) commit 31af12efd0a259de9b0d8ef626503911f13b584f Author: Darrick J. Wong Date: Fri Dec 21 08:42:51 2018 -0800 iomap: take responsibility for the filesystem iomap code XFS is the primary user of the filesystem iomap code, so we (the XFS community, specifically) will explicitly take responsibility for its maintenance. Signed-off-by: Darrick J. Wong Acked-by: Al Viro Reviewed-by: Dave Chinner Acked-by: Christoph Hellwig MAINTAINERS | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit 3cc31fa65d85610574c0f6a474e89f4c419923d5 Author: Eric Sandeen Date: Fri Dec 21 08:42:50 2018 -0800 iomap: don't search past page end in iomap_is_partially_uptodate iomap_is_partially_uptodate() is intended to check wither blocks within the selected range of a not-uptodate page are uptodate; if the range we care about is up to date, it's an optimization. However, the iomap implementation continues to check all blocks up to from+count, which is beyond the page, and can even be well beyond the iop->uptodate bitmap. I think the worst that will happen is that we may eventually find a zero bit and return "not partially uptodate" when it would have otherwise returned true, and skip the optimization. Still, it's clearly an invalid memory access that must be fixed. So: fix this by limiting the search to within the page as is done in the non-iomap variant, block_is_partially_uptodate(). Zorro noticed thiswhen KASAN went off for 512 byte blocks on a 64k page system: BUG: KASAN: slab-out-of-bounds in iomap_is_partially_uptodate+0x1a0/0x1e0 Read of size 8 at addr ffff800120c3a318 by task fsstress/22337 Reported-by: Zorro Lang Signed-off-by: Eric Sandeen Signed-off-by: Eric Sandeen Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/iomap.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) commit 9b9afe4a0ef149db2472f13d6fa3c705d2867c9c Author: Anup Patel Date: Tue Dec 4 15:59:51 2018 +0530 RISC-V: Select GENERIC_SCHED_CLOCK for clocksource drivers The riscv_timer driver can provide sched_clock using "rdtime" instruction but to achieve this we require generic sched_clock framework hence this patch selects GENERIC_SCHED_CLOCK for RISCV. Signed-off-by: Anup Patel Reviewed-by: Palmer Dabbelt Signed-off-by: Palmer Dabbelt arch/riscv/Kconfig | 1 + 1 file changed, 1 insertion(+) commit a266cdba17b36497da47055f31454995c5e50f43 Author: Olof Johansson Date: Tue Oct 30 23:47:08 2018 -0700 RISC-V: lib: minor asm cleanup Fix tab/space conversion and use ENTRY/ENDPROC macros. Signed-off-by: Olof Johansson Signed-off-by: Palmer Dabbelt arch/riscv/lib/tishift.S | 59 +++++++++++++++++++++++++----------------------- arch/riscv/lib/udivdi3.S | 42 ++++++++++++++++++---------------- 2 files changed, 53 insertions(+), 48 deletions(-) commit 358f3fff5271629f26261dadff73a9f8484aee12 Merge: 3aed8c43267e 7ba12bb676c2 Author: Palmer Dabbelt Date: Fri Dec 21 08:15:39 2018 -0800 RISC-V: Move from EARLY_PRINTK to SBI earlycon Now that we have earlycon support in the SBI console driver there is no reason to have our arch-specific early printk support. This patch set turns on SBI earlycon support and removes the old early printk. commit 3aed8c43267ebad70b5130d21155db6d9d7c8ebe Author: Nick Kossifidis Date: Sun Nov 18 02:06:56 2018 +0200 RISC-V: Update Kconfig to better handle CMDLINE Added a menu to choose how the built-in command line will be used and CMDLINE_EXTEND for compatibility with FDT code. v2: Improved help messages, removed references to bootloader and made them more descriptive. I also asked help from a friend who's a language expert just in case. v3: This time used the corrected text v4: Copy the config strings from the arm32 port. v5: Actually copy the config strings from the arm32 port. Signed-off-by: Nick Kossifidis Signed-off-by: Debbie Maliotaki Signed-off-by: Palmer Dabbelt arch/riscv/Kconfig | 57 +++++++++++++++++++++++++++++++----------------------- 1 file changed, 33 insertions(+), 24 deletions(-) commit 397182e0db56b8894a43631ce72de14d90a29834 Author: David Abdurachmanov Date: Thu Dec 6 11:26:26 2018 +0100 riscv: remove unused variable in ftrace Noticed while building kernel-4.20.0-0.rc5.git2.1.fc30 for Fedora 30/RISCV. [..] BUILDSTDERR: arch/riscv/kernel/ftrace.c: In function 'prepare_ftrace_return': BUILDSTDERR: arch/riscv/kernel/ftrace.c:135:6: warning: unused variable 'err' [-Wunused-variable] BUILDSTDERR: int err; BUILDSTDERR: ^~~ [..] Signed-off-by: David Abdurachmanov Fixes: e949b6db51dc1 ("riscv/function_graph: Simplify with function_graph_enter()") Reviewed-by: Olof Johansson Acked-by: Steven Rostedt (VMware) Signed-off-by: Palmer Dabbelt arch/riscv/kernel/ftrace.c | 1 - 1 file changed, 1 deletion(-) commit cd378dbb3dafbee16ef956d4101ede567f6ea2f7 Author: Yangtao Li Date: Tue Nov 20 09:11:02 2018 -0500 RISC-V: add of_node_put() use of_node_put() to release the refcount. Signed-off-by: Yangtao Li Signed-off-by: Palmer Dabbelt arch/riscv/kernel/time.c | 1 + 1 file changed, 1 insertion(+) commit 94f9bf118f1e294b3f2092f8bde02860f5e3ea3f Author: Atish Patra Date: Tue Nov 20 15:07:50 2018 -0800 RISC-V: Fix of_node_* refcount Fix of_node* refcount at various places by using of_node_put. Signed-off-by: Atish Patra Signed-off-by: Palmer Dabbelt arch/riscv/kernel/cacheinfo.c | 11 +++++++++++ arch/riscv/kernel/cpu.c | 1 + arch/riscv/kernel/cpufeature.c | 2 ++ arch/riscv/kernel/perf_event.c | 1 + arch/riscv/kernel/smpboot.c | 6 +++++- 5 files changed, 20 insertions(+), 1 deletion(-) commit 8b699616f399b58071cda41e5a1125d8480ac982 Author: Andrea Parri Date: Sat Dec 1 01:01:56 2018 +0100 riscv, atomic: Add #define's for the atomic_{cmp,}xchg_*() variants If an architecture does not define the atomic_{cmp,}xchg_*() variants, the generic implementation defaults them to the fully-ordered version. riscv's had its own variants since "the beginning", but it never told (#define-d these for) the generic implementation: it is time to do so. Signed-off-by: Andrea Parri Acked-by: Peter Zijlstra (Intel) Signed-off-by: Palmer Dabbelt arch/riscv/include/asm/atomic.h | 9 +++++++++ 1 file changed, 9 insertions(+) commit 3715917408f35395922d06a5a6868c278b0e5c17 Merge: fa2323325e8b 6277053afa34 Author: David S. Miller Date: Fri Dec 21 08:00:27 2018 -0800 Merge tag 'mlx5-XDP-100Mpps' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5-XDP-100Mpps This series from Tariq, mainly adds the support of mlx5 Multi Packet WQE (TX descriptor) - ConnectX-5 and above - for XDP TX, which allows us to overcome the 70Mpps PCIe bottleneck of conventional TX queues (single TX descriptor per packet), and achieve the 100Mpps milestone with the MPWQE approach. In the first five patches, Tariq did minor improvements to mlx5 tx path, for better debug-ability and code structuring. Next two patches lay down the foundation for MPWQE implementation to store the in-flight XDP TX information for multiple packets of one descriptor (WQE). Next: Support Enhanced Multi-Packet TX WQE for XDP In this patch we add support for the HW feature, which is supported starting from ConnectX-5. Performance: Tested packet rate for UDP 64Byte multi-stream over ConnectX-5 NICs. CPU: Intel(R) Xeon(R) CPU E5-2680 v3 @ 2.50GHz XDP_TX: We see a huge gain on single port ConnectX-5, and reach the 100 Mpps milestone. * Single-port HCA: Before: 70 Mpps After: 100 Mpps (+42.8%) * Dual-port HCA: Before: 51.7 Mpps After: 57.3 Mpps (+10.8%) * In both cases we tested traffic on one port and for now On Dual-port HCAs we see only a small gain, we are working to overcome this bottleneck, but for the moment only with experimental firmware on dual port HCAs we can reach the wanted numbers as seen on Single-port HCAs. XDP_REDIRECT: Redirect from (A) ConnectX-5 to (B) ConnectX-5. Due to a setup limitation, (A) and (B) are on different NUMA nodes, so absolute performance numbers are not optimal. - Note: Below is the transmit rate of (B), not the redirect rate of (A) which is in some cases higher. * (B) is single-port: Before: 77 Mpps After: 90 Mpps (+16.8%) * (B) is dual-port: Before: 61 Mpps After: 72 Mpps (+18%) Last patch adds a knob in mlx5 ethtool private flag to turn on/off XDP TX MPWQE. ==================== Signed-off-by: David S. Miller commit b239b4d65d6442fabd6db694f9d014268b8711c1 Author: Masahiro Yamada Date: Fri Dec 21 12:12:40 2018 +0900 firmware: remove unnecessary patterns from .gitignore Commit df85b2d767aa ("firmware: Restore support for built-in firmware") should not have restored this .gitignore blindly. *.gen.S is only pattern that should be ignored by git. Signed-off-by: Masahiro Yamada firmware/.gitignore | 5 ----- 1 file changed, 5 deletions(-) commit 2e5b2d7c408ed5fbe918b7409496b1acc84ff7bc Author: Christoph Hellwig Date: Thu Dec 20 18:36:20 2018 +0100 bsg: deprecate BIDI support in bsg Besides the OSD command set that never got traction, the only SCSI command using bidirectional buffers is XDWRITEREAD in the 10 and 32 byte variants, which is extremely esoteric and has been removed from the spec again as of SBC4r15. It probably doesn't make sense to keep the support code around just for that, so start deprecating the support. Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe block/bsg.c | 4 ++++ 1 file changed, 4 insertions(+) commit 6b4505352e4b1ee27faa97ae46b9baa8bc6a31f0 Author: Dennis Zhou Date: Wed Dec 19 16:43:53 2018 -0600 blkcg: remove unused __blkg_release_rcu() An earlier commit 7fcf2b033b84 ("blkcg: change blkg reference counting to use percpu_ref") moved around the release call from blkg_put() to be a part of the percpu_ref cleanup. Remove the additional unused code which should have been removed earlier. Signed-off-by: Dennis Zhou Signed-off-by: Jens Axboe block/blk-cgroup.c | 23 ----------------------- 1 file changed, 23 deletions(-) commit 6ab2187992f4b0112852e5a097a2b6c7d167e2e5 Author: Dennis Zhou Date: Wed Dec 19 16:43:21 2018 -0600 blkcg: clean up blkg_tryget_closest() The implementation of blkg_tryget_closest() wasn't super obvious and became a point of suspicion when debugging [1]. So let's clean it up so it's obviously not the problem. Also add missing RCU read locking to bio_clone_blkg_association(), which got exposed by adding the RCU read lock held check in blkg_tryget_closest(). [1] https://lore.kernel.org/linux-block/a7e97e4b-0dd8-3a54-23b7-a0f27b17fde8@kernel.dk/ Signed-off-by: Dennis Zhou Signed-off-by: Jens Axboe block/bio.c | 4 ++++ include/linux/blk-cgroup.h | 21 ++++++++++++++++----- 2 files changed, 20 insertions(+), 5 deletions(-) commit 4b2c01ad902ec02fa962b233decd2f14be3714ba Author: Jörgen Storvist Date: Fri Dec 21 14:40:44 2018 +0100 USB: serial: option: add Fibocom NL678 series Added USB serial option driver support for Fibocom NL678 series cellular module: VID 2cb7 and PIDs 0x0104 and 0x0105. Reserved network and ADB interfaces. T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2cb7 ProdID=0104 Rev=03.10 S: Manufacturer=Fibocom S: Product=Fibocom NL678-E Modem S: SerialNumber=12345678 C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2cb7 ProdID=0105 Rev=03.10 S: Manufacturer=Fibocom S: Product=Fibocom NL678-E Modem S: SerialNumber=12345678 C: #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 4 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether I: If#= 5 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) Signed-off-by: Jörgen Storvist Cc: stable Acked-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman drivers/usb/serial/option.c | 4 ++++ 1 file changed, 4 insertions(+) commit cd6a22310ec2a70092e136d0cd65bb77c1502521 Merge: 1e12a521d691 177c459b08a3 Author: Greg Kroah-Hartman Date: Fri Dec 21 16:46:08 2018 +0100 Merge USB 4.20-rc8 mergepoint into usb-next We need the USB changes in here for additional patches to be able to apply cleanly. Signed-off-by: Greg Kroah-Hartman commit 3c78c77bafb18bbbd22f6bda6f508699431ceb11 Author: Masahiro Yamada Date: Fri Dec 21 12:12:39 2018 +0900 scripts: remove unnecessary ihex2fw and check-lc_ctypes from .gitignore Commit c512d2544c68 ("gitignore: ignore scripts/ihex2fw") was unneeded. ihex2fw was generated in firmware/ instead of scripts/ at that time although ihex2fw.c was pushed back and forth between those directories in the past. check-lc_ctype was removed by commit cb43fb5775df ("docs: remove DocBook from the building system"). Signed-off-by: Masahiro Yamada scripts/.gitignore | 2 -- 1 file changed, 2 deletions(-) commit 733f4ef46d3ea31e44cebfec851528089a783f0f Author: Masahiro Yamada Date: Thu Dec 20 18:27:26 2018 +0900 um: remove unused filechk_gen_header in Makefile This is a leftover of commit ecba97d4aacf ("[PATCH] uml makefiles sanitized"). Signed-off-by: Masahiro Yamada arch/um/Makefile | 2 -- 1 file changed, 2 deletions(-) commit 4b31a32caf0a28e4726f1bf267ff8a804ed864e2 Author: Masahiro Yamada Date: Tue Dec 11 20:01:09 2018 +0900 kconfig: update current_pos in the second lexer To simplify the generated lexer, let the hand-made lexer update the file name and line number for the parser. I tested this with DEBUG_PARSE, and confirmed the same file names and line numbers were dumped. Signed-off-by: Masahiro Yamada scripts/kconfig/zconf.l | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) commit 824fa3b3b5e3647de0530328e8734c24418eec49 Author: Masahiro Yamada Date: Tue Dec 11 20:01:08 2018 +0900 kconfig: switch to ASSIGN_VAL state in the second lexer To simplify the generated lexer, switch to the ASSIGN_VAL state in the hand-made lexer. Signed-off-by: Masahiro Yamada scripts/kconfig/zconf.l | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) commit b3d1d9d3c36214a50c18ba377b47152c021768df Author: Masahiro Yamada Date: Tue Dec 11 20:01:07 2018 +0900 kconfig: stop associating kconf_id with yylval The lexer has conventionally associated kconf_id data with yylval to carry additional information to the parser. No token is relying on this any more. Signed-off-by: Masahiro Yamada scripts/kconfig/zconf.l | 2 -- scripts/kconfig/zconf.y | 41 ++++++++++++++++++++--------------------- 2 files changed, 20 insertions(+), 23 deletions(-) commit caaebb3c6de3493c7f11f79a5dddc6691a40e55f Author: Masahiro Yamada Date: Tue Dec 11 20:01:06 2018 +0900 kconfig: refactor end token rules T_ENDMENU, T_ENDCHOICE, T_ENDIF are the last users of kconf_id associated with yylval. Refactor them to not use it. Signed-off-by: Masahiro Yamada scripts/kconfig/zconf.y | 43 +++++++++++++++---------------------------- 1 file changed, 15 insertions(+), 28 deletions(-) commit f5451582c4e22ce8912aae4950810f3598c9b516 Author: Masahiro Yamada Date: Tue Dec 11 20:01:05 2018 +0900 kconfig: stop supporting '.' and '/' in unquoted words In my understanding, special characters such as '.' and '/' are supported in unquoted words to use bare file paths in the "source" statement. With the previous commit surrounding all file paths with double quotes, we can drop this. Signed-off-by: Masahiro Yamada scripts/kconfig/preprocess.c | 3 +-- scripts/kconfig/zconf.l | 4 ++-- 2 files changed, 3 insertions(+), 4 deletions(-) commit 8636a1f9677db4f883f29a072f401303acfc2edd Author: Masahiro Yamada Date: Tue Dec 11 20:01:04 2018 +0900 treewide: surround Kconfig file paths with double quotes The Kconfig lexer supports special characters such as '.' and '/' in the parameter context. In my understanding, the reason is just to support bare file paths in the source statement. I do not see a good reason to complicate Kconfig for the room of ambiguity. The majority of code already surrounds file paths with double quotes, and it makes sense since file paths are constant string literals. Make it treewide consistent now. Signed-off-by: Masahiro Yamada Acked-by: Wolfram Sang Acked-by: Geert Uytterhoeven Acked-by: Ingo Molnar arch/arm/Kconfig | 2 +- arch/arm/kvm/Kconfig | 2 +- arch/arm64/Kconfig | 2 +- arch/arm64/kvm/Kconfig | 2 +- arch/ia64/Kconfig | 2 +- arch/m68k/Kconfig | 6 +++--- arch/mips/kvm/Kconfig | 2 +- arch/openrisc/Kconfig | 2 +- arch/powerpc/Kconfig | 4 ++-- arch/powerpc/kvm/Kconfig | 2 +- arch/riscv/Kconfig | 2 +- arch/s390/Kconfig | 2 +- arch/s390/kvm/Kconfig | 2 +- arch/sh/Kconfig | 2 +- arch/sparc/Kconfig | 2 +- arch/x86/Kconfig | 2 +- arch/x86/kvm/Kconfig | 2 +- block/Kconfig | 2 +- crypto/Kconfig | 4 ++-- drivers/crypto/Kconfig | 2 +- drivers/gpu/drm/i915/Kconfig | 2 +- drivers/hwmon/Kconfig | 2 +- drivers/i2c/Kconfig | 6 +++--- drivers/pps/Kconfig | 4 ++-- drivers/ras/Kconfig | 2 +- drivers/thermal/Kconfig | 2 +- drivers/w1/Kconfig | 4 ++-- lib/Kconfig.debug | 4 ++-- security/Kconfig | 16 ++++++++-------- security/integrity/Kconfig | 4 ++-- 30 files changed, 47 insertions(+), 47 deletions(-) commit 48547bd23d0eeb2cf3a63ed588b46236eac5f2c3 Author: Masahiro Yamada Date: Tue Dec 11 20:01:03 2018 +0900 microblaze: surround string default in Kconfig with double quotes I guess this is a constant value instead of a symbol. Signed-off-by: Masahiro Yamada Acked-by: Michal Simek arch/microblaze/Kconfig.platform | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 171a515d080327b861d5e5fc9bbfa77f10cfddd7 Author: Masahiro Yamada Date: Tue Dec 11 20:01:02 2018 +0900 kconfig: use T_WORD instead of T_VARIABLE for variables There is no grammatical ambiguity by using T_WORD for variables. The parser can distinguish variables from symbols from the context. Signed-off-by: Masahiro Yamada scripts/kconfig/zconf.l | 4 ++-- scripts/kconfig/zconf.y | 3 +-- 2 files changed, 3 insertions(+), 4 deletions(-) commit c3d228713b10e6dd1bd44853168cec8e23ae7e0f Author: Masahiro Yamada Date: Tue Dec 11 20:01:01 2018 +0900 kconfig: use specific tokens instead of T_ASSIGN for assignments Currently, the lexer returns T_ASSIGN for all of =, :=, and += associating yylval with the flavor. I want to make the generated lexer as simple as possible. So, the lexer should convert keywords to tokens without thinking about the meaning. = -> T_EQUAL := -> T_COLON_EQUAL += -> T_PLUS_EQUAL Unfortunately, Kconfig uses = instead of == for the equal operator. So, the same token T_EQUAL is used for assignment and comparison. The parser can still distinguish them from the context. Signed-off-by: Masahiro Yamada scripts/kconfig/zconf.l | 6 +++--- scripts/kconfig/zconf.y | 12 ++++++++++-- 2 files changed, 13 insertions(+), 5 deletions(-) commit ce2164ab58316e27180034112f97608a764f5b37 Author: Masahiro Yamada Date: Tue Dec 11 20:01:00 2018 +0900 kconfig: refactor scanning and parsing "option" properties For the keywords "modules", "defconfig_list", and "allnoconfig_y", the lexer should pass specific tokens instead of generic T_WORD. This simplifies both the lexer and the parser. Signed-off-by: Masahiro Yamada scripts/kconfig/kconf_id.c | 3 --- scripts/kconfig/lkc.h | 9 +++------ scripts/kconfig/menu.c | 43 ++++++++++++++++++++----------------------- scripts/kconfig/zconf.l | 3 +++ scripts/kconfig/zconf.y | 35 +++++++++++++++-------------------- 5 files changed, 41 insertions(+), 52 deletions(-) commit 3c8f317d4cf15e7a67457cfdd1e63182a34bcb69 Author: Masahiro Yamada Date: Tue Dec 11 20:00:59 2018 +0900 kconfig: use distinct tokens for type and default properties This commit removes kconf_id::stype to prepare for the entire removal of kconf_id.c To simplify the lexer, I want keywords straight-mapped to tokens. Signed-off-by: Masahiro Yamada scripts/kconfig/kconf_id.c | 16 ++++++------ scripts/kconfig/lkc.h | 1 - scripts/kconfig/zconf.y | 62 +++++++++++++++++++++++++++++----------------- 3 files changed, 47 insertions(+), 32 deletions(-) commit 745d51dc8a29e00e9ba14e090aa3c8a41e7221d9 Author: Yangtao Li Date: Thu Nov 22 07:39:24 2018 -0500 ata: pata_macio: add of_node_put() of_find_node_by_path() acquires a reference to the node returned by it and that reference needs to be dropped by its caller. This place doesn't do that, so fix it. Acked-by: Bartlomiej Zolnierkiewicz Signed-off-by: Yangtao Li Signed-off-by: Jens Axboe drivers/ata/pata_macio.c | 2 ++ 1 file changed, 2 insertions(+) commit c3b5725965228014215de553eed3492dbd80a4bd Merge: b27d9668be60 8ff00ba79283 Author: Mark Brown Date: Fri Dec 21 13:43:35 2018 +0000 Merge remote-tracking branch 'regulator/topic/coupled' into regulator-next commit b27d9668be60d42904b71ab1a9e4d152c7b5c920 Merge: 67a2ab931e9f cd07e3701fa6 Author: Mark Brown Date: Fri Dec 21 13:43:32 2018 +0000 Merge branch 'regulator-4.21' into regulator-next commit 67a2ab931e9f79f516566e69c92e566b71fb20d1 Merge: 7566ec393f41 2bb166636933 Author: Mark Brown Date: Fri Dec 21 13:43:30 2018 +0000 Merge branch 'regulator-4.20' into regulator-linus commit a0aea130afebcd091d5396d13f25b9da24c9144a Author: Robert Hoo Date: Wed Dec 19 21:51:43 2018 +0800 KVM: x86: Add CPUID support for new instruction WBNOINVD Signed-off-by: Robert Hoo Signed-off-by: Paolo Bonzini arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/kvm/cpuid.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) commit 642fb53d350b3ff6a8c85062fcab271d61a56b75 Merge: da801ab56ad8 f83f97684a73 Author: Linus Walleij Date: Fri Dec 21 14:24:59 2018 +0100 Merge tag 'sh-pfc-for-v4.21-tag3' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into devel pinctrl: sh-pfc: Fixes for v4.21 - Miscellaneous fixes, - Build-time validation for pins/marks mismatches. commit 57d5edfe640edaaece9208cdbd7f464d255785cd Author: Andrew Jones Date: Fri Dec 21 12:22:22 2018 +0100 kvm: selftests: ucall: fix exit mmio address guessing Fix two more bugs in the exit_mmio address guessing. The first bug was that the start and step calculations were wrong since they were dividing the number of address bits instead of the address space. The second other bug was that the guessing algorithm wasn't considering the valid physical and virtual address ranges correctly for an identity map. Signed-off-by: Andrew Jones Signed-off-by: Paolo Bonzini tools/testing/selftests/kvm/lib/ucall.c | 30 +++++++++++++++++++----------- 1 file changed, 19 insertions(+), 11 deletions(-) commit b9b6a2ea2baf69204a6e5f311e0d24fe3b956f2e Author: Arnaldo Carvalho de Melo Date: Wed Dec 19 18:54:36 2018 -0300 perf trace: Do not hardcode the size of the tracepoint common_ fields We shouldn't hardcode the size of the tracepoint common_ fields, use the offset of the 'id'/'__syscallnr' field in the sys_enter event instead. This caused the augmented syscalls code to fail on a particular build of a PREEMPT_RT_FULL kernel where these extra 'common_migrate_disable' and 'common_padding' fields were before the syscall id one: # cat /sys/kernel/debug/tracing/events/raw_syscalls/sys_enter/format name: sys_enter ID: 22 format: field:unsigned short common_type; offset:0; size:2; signed:0; field:unsigned char common_flags; offset:2; size:1; signed:0; field:unsigned char common_preempt_count; offset:3; size:1; signed:0; field:int common_pid; offset:4; size:4; signed:1; field:unsigned short common_migrate_disable; offset:8; size:2; signed:0; field:unsigned short common_padding; offset:10; size:2; signed:0; field:long id; offset:16; size:8; signed:1; field:unsigned long args[6]; offset:24; size:48; signed:0; print fmt: "NR %ld (%lx, %lx, %lx, %lx, %lx, %lx)", REC->id, REC->args[0], REC->args[1], REC->args[2], REC->args[3], REC->args[4], REC->args[5] # All those 'common_' prefixed fields are zeroed when they hit a BPF tracepoint hook, we better just discard those, i.e. somehow pass an offset to the BPF program from the start of the ctx and make adjustments in the 'perf trace' handlers to adjust the offset of the syscall arg offsets obtained from tracefs. Till then, fix it the quick way and add this to the augmented_raw_syscalls.c to bet it to work in such kernels: diff --git a/tools/perf/examples/bpf/augmented_raw_syscalls.c b/tools/perf/examples/bpf/augmented_raw_syscalls.c index 53c233370fae..1f746f931e13 100644 --- a/tools/perf/examples/bpf/augmented_raw_syscalls.c +++ b/tools/perf/examples/bpf/augmented_raw_syscalls.c @@ -38,12 +38,14 @@ struct bpf_map SEC("maps") syscalls = { struct syscall_enter_args { unsigned long long common_tp_fields; + long rt_common_tp_fields; long syscall_nr; unsigned long args[6]; }; struct syscall_exit_args { unsigned long long common_tp_fields; + long rt_common_tp_fields; long syscall_nr; long ret; }; Just to check that this was the case. Fix it properly later, for now remove the hardcoding of the offset in the 'perf trace' side and document the situation with this patch. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-2pqavrktqkliu5b9nzouio21@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-trace.c | 73 +++++++++++++++++++++++++++++++++------------- 1 file changed, 52 insertions(+), 21 deletions(-) commit 14541b1e7e723859ff2c75c6fc10cdbbec6b8c34 Author: Stanislav Fomichev Date: Thu Nov 15 16:32:01 2018 -0800 perf build: Don't unconditionally link the libbfd feature test to -liberty and -lz Current libbfd feature test unconditionally links against -liberty and -lz. While it's required on some systems (e.g. opensuse), it's completely unnecessary on the others, where only -lbdf is sufficient (debian). This patch streamlines (and renames) the following feature checks: feature-libbfd - only link against -lbfd (debian), see commit 2cf9040714f3 ("perf tools: Fix bfd dependency libraries detection") feature-libbfd-liberty - link against -lbfd and -liberty feature-libbfd-liberty-z - link against -lbfd, -liberty and -lz (opensuse), see commit 280e7c48c3b8 ("perf tools: fix BFD detection on opensuse") (feature-liberty{,-z} were renamed to feature-libbfd-liberty{,z} for clarity) The main motivation is to fix this feature test for bpftool which is currently broken on debian (libbfd feature shows OFF, but we still unconditionally link against -lbfd and it works). Tested on debian with only -lbfd installed (without -liberty); I'd appreciate if somebody on the other systems can test this new detection method. Signed-off-by: Stanislav Fomichev Acked-by: Jiri Olsa Cc: Alexander Shishkin Cc: Mathieu Poirier Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/4dfc634cfcfb236883971b5107cf3c28ec8a31be.1542328222.git.sdf@google.com Signed-off-by: Arnaldo Carvalho de Melo tools/build/Makefile.feature | 4 ++-- tools/build/feature/Makefile | 10 +++++----- tools/perf/Makefile.config | 44 +++++++++++++++++++++++--------------------- 3 files changed, 30 insertions(+), 28 deletions(-) commit 5ce29d522e9b8cdc158329a8539bcd6206fc5bf4 Author: Arnaldo Carvalho de Melo Date: Wed Dec 19 10:10:51 2018 -0300 perf beauty mmap: PROT_WRITE should come before PROT_EXEC To match strace output: # cat mmap.c #include int main(void) { mmap(0, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0); return 0; } # strace -e mmap ./mmap |& grep -v ^+++ mmap(NULL, 103484, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f5bae400000 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f5bae3fe000 mmap(NULL, 3889792, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f5bade40000 mmap(0x7f5bae1ec000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1ac000) = 0x7f5bae1ec000 mmap(0x7f5bae1f2000, 14976, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f5bae1f2000 mmap(NULL, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f5bae419000 # trace -e mmap ./mmap |& grep -v ^+++ mmap(NULL, 103484, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f6646c25000 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS) = 0x7f6646c23000 mmap(NULL, 3889792, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f6646665000 mmap(0x7f6646a11000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1ac000) = 0x7f6646a11000 mmap(0x7f6646a17000, 14976, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS) = 0x7f6646a17000 mmap(NULL, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS) = 0x7f6646c3e000 # Reported-by: Namhyung Kim Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-nt49d6iqle80cw8f529ovaqi@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/trace/beauty/mmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f76214f93783f9f902954cf6e57fd818c4bffe29 Author: Arnaldo Carvalho de Melo Date: Wed Dec 19 10:01:20 2018 -0300 perf trace: Check if the raw_syscalls:sys_{enter,exit} are setup before setting tp filter While updating 'perf trace' on an machine with an old precompiled augmented_raw_syscalls.o that didn't setup the syscall map the new 'perf trace' codebase notices the augmented_raw_syscalls.o eBPF event, decides to use it instead of the old raw_syscalls:sys_{enter,exit} method, but then because we don't have the syscall map tries to set the tracepoint filter on the sys_{enter,exit} evsels, that are NULL, segfaulting. Make the code more robust by checking it those tracepoints have their respective evsels in place before trying to set the tp filter. With this we still get everything to work, just not setting up the syscall filters, which is better than a segfault. Now to update the precompiled augmented_raw_syscalls.o and continue development :-) Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-3ft5rjdl05wgz2pwpx2z8btu@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-trace.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 2bcbd406715dca256912b9c5ae449c7968f15705 Author: Sean Christopherson Date: Thu Dec 20 12:25:18 2018 -0800 Revert "compiler-gcc: disable -ftracer for __noclone functions" The -ftracer optimization was disabled in __noclone as a workaround to GCC duplicating a blob of inline assembly that happened to define a global variable. It has been pointed out that no amount of workarounds can guarantee the compiler won't duplicate inline assembly[1], and that disabling the -ftracer optimization has several unintended and nasty side effects[2][3]. Now that the offending KVM code which required the workaround has been properly fixed and no longer uses __noclone, remove the -ftracer optimization tweak from __noclone. [1] https://lore.kernel.org/lkml/ri6y38lo23g.fsf@suse.cz/T/#u [2] https://lore.kernel.org/lkml/20181218140105.ajuiglkpvstt3qxs@treble/T/#u [3] https://patchwork.kernel.org/patch/8707981/#21817015 This reverts commit 95272c29378ee7dc15f43fa2758cb28a5913a06d. Suggested-by: Andi Kleen Cc: Paolo Bonzini Cc: Nadav Amit Cc: Andi Kleen Cc: Josh Poimboeuf Cc: Martin Jambor Cc: Arnd Bergmann Cc: Steven Rostedt Cc: Miroslav Benes Signed-off-by: Sean Christopherson Reviewed-by: Andi Kleen Reviewed-by: Miguel Ojeda Signed-off-by: Paolo Bonzini include/linux/compiler_attributes.h | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) commit cd07e3701fa6a4c68f8493ee1d12caa18d46ec6a Author: Kangjie Lu Date: Fri Dec 21 00:29:19 2018 -0600 regulator: tps65910: fix a missing check of return value tps65910_reg_set_bits() may fail. The fix checks if it fails, and if so, returns with its error code. Signed-off-by: Kangjie Lu Signed-off-by: Mark Brown drivers/regulator/tps65910-regulator.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 453eafbe65f72c04fc7c74c5c95c04e78e907dfb Author: Sean Christopherson Date: Thu Dec 20 12:25:17 2018 -0800 KVM: VMX: Move VM-Enter + VM-Exit handling to non-inline sub-routines Transitioning to/from a VMX guest requires KVM to manually save/load the bulk of CPU state that the guest is allowed to direclty access, e.g. XSAVE state, CR2, GPRs, etc... For obvious reasons, loading the guest's GPR snapshot prior to VM-Enter and saving the snapshot after VM-Exit is done via handcoded assembly. The assembly blob is written as inline asm so that it can easily access KVM-defined structs that are used to hold guest state, e.g. moving the blob to a standalone assembly file would require generating defines for struct offsets. The other relevant aspect of VMX transitions in KVM is the handling of VM-Exits. KVM doesn't employ a separate VM-Exit handler per se, but rather treats the VMX transition as a mega instruction (with many side effects), i.e. sets the VMCS.HOST_RIP to a label immediately following VMLAUNCH/VMRESUME. The label is then exposed to C code via a global variable definition in the inline assembly. Because of the global variable, KVM takes steps to (attempt to) ensure only a single instance of the owning C function, e.g. vmx_vcpu_run, is generated by the compiler. The earliest approach placed the inline assembly in a separate noinline function[1]. Later, the assembly was folded back into vmx_vcpu_run() and tagged with __noclone[2][3], which is still used today. After moving to __noclone, an edge case was encountered where GCC's -ftracer optimization resulted in the inline assembly blob being duplicated. This was "fixed" by explicitly disabling -ftracer in the __noclone definition[4]. Recently, it was found that disabling -ftracer causes build warnings for unsuspecting users of __noclone[5], and more importantly for KVM, prevents the compiler for properly optimizing vmx_vcpu_run()[6]. And perhaps most importantly of all, it was pointed out that there is no way to prevent duplication of a function with 100% reliability[7], i.e. more edge cases may be encountered in the future. So to summarize, the only way to prevent the compiler from duplicating the global variable definition is to move the variable out of inline assembly, which has been suggested several times over[1][7][8]. Resolve the aforementioned issues by moving the VMLAUNCH+VRESUME and VM-Exit "handler" to standalone assembly sub-routines. Moving only the core VMX transition codes allows the struct indexing to remain as inline assembly and also allows the sub-routines to be used by nested_vmx_check_vmentry_hw(). Reusing the sub-routines has a happy side-effect of eliminating two VMWRITEs in the nested_early_check path as there is no longer a need to dynamically change VMCS.HOST_RIP. Note that callers to vmx_vmenter() must account for the CALL modifying RSP, e.g. must subtract op-size from RSP when synchronizing RSP with VMCS.HOST_RSP and "restore" RSP prior to the CALL. There are no great alternatives to fudging RSP. Saving RSP in vmx_enter() is difficult because doing so requires a second register (VMWRITE does not provide an immediate encoding for the VMCS field and KVM supports Hyper-V's memory-based eVMCS ABI). The other more drastic alternative would be to use eschew VMCS.HOST_RSP and manually save/load RSP using a per-cpu variable (which can be encoded as e.g. gs:[imm]). But because a valid stack is needed at the time of VM-Exit (NMIs aren't blocked and a user could theoretically insert INT3/INT1ICEBRK at the VM-Exit handler), a dedicated per-cpu VM-Exit stack would be required. A dedicated stack isn't difficult to implement, but it would require at least one page per CPU and knowledge of the stack in the dumpstack routines. And in most cases there is essentially zero overhead in dynamically updating VMCS.HOST_RSP, e.g. the VMWRITE can be avoided for all but the first VMLAUNCH unless nested_early_check=1, which is not a fast path. In other words, avoiding the VMCS.HOST_RSP by using a dedicated stack would only make the code marginally less ugly while requiring at least one page per CPU and forcing the kernel to be aware (and approve) of the VM-Exit stack shenanigans. [1] cea15c24ca39 ("KVM: Move KVM context switch into own function") [2] a3b5ba49a8c5 ("KVM: VMX: add the __noclone attribute to vmx_vcpu_run") [3] 104f226bfd0a ("KVM: VMX: Fold __vmx_vcpu_run() into vmx_vcpu_run()") [4] 95272c29378e ("compiler-gcc: disable -ftracer for __noclone functions") [5] https://lkml.kernel.org/r/20181218140105.ajuiglkpvstt3qxs@treble [6] https://patchwork.kernel.org/patch/8707981/#21817015 [7] https://lkml.kernel.org/r/ri6y38lo23g.fsf@suse.cz [8] https://lkml.kernel.org/r/20181218212042.GE25620@tassilo.jf.intel.com Suggested-by: Andi Kleen Suggested-by: Martin Jambor Cc: Paolo Bonzini Cc: Nadav Amit Cc: Andi Kleen Cc: Josh Poimboeuf Cc: Martin Jambor Cc: Arnd Bergmann Cc: Steven Rostedt Cc: Miroslav Benes Signed-off-by: Sean Christopherson Reviewed-by: Andi Kleen Signed-off-by: Paolo Bonzini arch/x86/kvm/Makefile | 2 +- arch/x86/kvm/vmx/nested.c | 30 ++++++++---------------- arch/x86/kvm/vmx/vmenter.S | 57 ++++++++++++++++++++++++++++++++++++++++++++++ arch/x86/kvm/vmx/vmx.c | 22 ++++++++---------- arch/x86/kvm/vmx/vmx.h | 1 - 5 files changed, 78 insertions(+), 34 deletions(-) commit 051a2d3e59e51ae49fd56aef34e472832897ce46 Author: Sean Christopherson Date: Thu Dec 20 12:25:16 2018 -0800 KVM: VMX: Explicitly reference RCX as the vmx_vcpu pointer in asm blobs Use '%% " _ASM_CX"' instead of '%0' to dereference RCX, i.e. the 'struct vcpu_vmx' pointer, in the VM-Enter asm blobs of vmx_vcpu_run() and nested_vmx_check_vmentry_hw(). Using the symbolic name means that adding/removing an output parameter(s) requires "rewriting" almost all of the asm blob, which makes it nearly impossible to understand what's being changed in even the most minor patches. Opportunistically improve the code comments. Signed-off-by: Sean Christopherson Reviewed-by: Andi Kleen Signed-off-by: Paolo Bonzini arch/x86/kvm/vmx/nested.c | 6 ++-- arch/x86/kvm/vmx/vmx.c | 86 ++++++++++++++++++++++++++--------------------- 2 files changed, 50 insertions(+), 42 deletions(-) commit 77ea906082dcfa63ad8a07ace6d5033d30c4175b Author: Axel Lin Date: Fri Dec 21 10:49:29 2018 +0800 regulator: mcp16502: Select REGMAP_I2C to fix build error Fix build error when CONFIG_REGMAP_I2C=m && CONFIG_REGULATOR_MCP16502=y. drivers/regulator/mcp16502.o: In function `mcp16502_probe': mcp16502.c:(.text+0xca): undefined reference to `__devm_regmap_init_i2c' Signed-off-by: Axel Lin Signed-off-by: Mark Brown drivers/regulator/Kconfig | 1 + 1 file changed, 1 insertion(+) commit da801ab56ad874897b0b255216767c983e665a4c Author: Alexandre Belloni Date: Thu Dec 20 15:44:31 2018 +0100 pinctrl: ocelot: add MSCC Jaguar2 support Jaguar2 has the same register layout as Ocelot but it has 64 pins, meaning that there are 2 registers instead of one. Signed-off-by: Alexandre Belloni Signed-off-by: Linus Walleij .../bindings/pinctrl/mscc,ocelot-pinctrl.txt | 3 +- drivers/pinctrl/Kconfig | 5 +- drivers/pinctrl/pinctrl-ocelot.c | 338 +++++++++++++++++---- 3 files changed, 282 insertions(+), 64 deletions(-) commit c6ad45973380af5ef43b708a54d7475d93f86638 Merge: e81434995081 ae59a7e1945b Author: Paolo Bonzini Date: Fri Dec 21 11:48:41 2018 +0100 Merge tag 'kvm-ppc-next-4.21-2' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc into kvm-next Second PPC KVM update for 4.21 This has 5 commits that fix page dirty tracking when running nested HV KVM guests, from Suraj Jitindar Singh. commit e81434995081fd7efb755fd75576b35dbb0850b1 Author: Sean Christopherson Date: Thu Dec 20 14:21:08 2018 -0800 KVM: x86: Use jmp to invoke kvm_spurious_fault() from .fixup ____kvm_handle_fault_on_reboot() provides a generic exception fixup handler that is used to cleanly handle faults on VMX/SVM instructions during reboot (or at least try to). If there isn't a reboot in progress, ____kvm_handle_fault_on_reboot() treats any exception as fatal to KVM and invokes kvm_spurious_fault(), which in turn generates a BUG() to get a stack trace and die. When it was originally added by commit 4ecac3fd6dc2 ("KVM: Handle virtualization instruction #UD faults during reboot"), the "call" to kvm_spurious_fault() was handcoded as PUSH+JMP, where the PUSH'd value is the RIP of the faulting instructing. The PUSH+JMP trickery is necessary because the exception fixup handler code lies outside of its associated function, e.g. right after the function. An actual CALL from the .fixup code would show a slightly bogus stack trace, e.g. an extra "random" function would be inserted into the trace, as the return RIP on the stack would point to no known function (and the unwinder will likely try to guess who owns the RIP). Unfortunately, the JMP was replaced with a CALL when the macro was reworked to not spin indefinitely during reboot (commit b7c4145ba2eb "KVM: Don't spin on virt instruction faults during reboot"). This causes the aforementioned behavior where a bogus function is inserted into the stack trace, e.g. my builds like to blame free_kvm_area(). Revert the CALL back to a JMP. The changelog for commit b7c4145ba2eb ("KVM: Don't spin on virt instruction faults during reboot") contains nothing that indicates the switch to CALL was deliberate. This is backed up by the fact that the PUSH was left intact. Note that an alternative to the PUSH+JMP magic would be to JMP back to the "real" code and CALL from there, but that would require adding a JMP in the non-faulting path to avoid calling kvm_spurious_fault() and would add no value, i.e. the stack trace would be the same. Using CALL: ------------[ cut here ]------------ kernel BUG at /home/sean/go/src/kernel.org/linux/arch/x86/kvm/x86.c:356! invalid opcode: 0000 [#1] SMP CPU: 4 PID: 1057 Comm: qemu-system-x86 Not tainted 4.20.0-rc6+ #75 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:kvm_spurious_fault+0x5/0x10 [kvm] Code: <0f> 0b 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 41 55 49 89 fd 41 RSP: 0018:ffffc900004bbcc8 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffffffffffff RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff888273fd8000 R08: 00000000000003e8 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000784 R12: ffffc90000371fb0 R13: 0000000000000000 R14: 000000026d763cf4 R15: ffff888273fd8000 FS: 00007f3d69691700(0000) GS:ffff888277800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f89bc56fe0 CR3: 0000000271a5a001 CR4: 0000000000362ee0 Call Trace: free_kvm_area+0x1044/0x43ea [kvm_intel] ? vmx_vcpu_run+0x156/0x630 [kvm_intel] ? kvm_arch_vcpu_ioctl_run+0x447/0x1a40 [kvm] ? kvm_vcpu_ioctl+0x368/0x5c0 [kvm] ? kvm_vcpu_ioctl+0x368/0x5c0 [kvm] ? __set_task_blocked+0x38/0x90 ? __set_current_blocked+0x50/0x60 ? __fpu__restore_sig+0x97/0x490 ? do_vfs_ioctl+0xa1/0x620 ? __x64_sys_futex+0x89/0x180 ? ksys_ioctl+0x66/0x70 ? __x64_sys_ioctl+0x16/0x20 ? do_syscall_64+0x4f/0x100 ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 Modules linked in: vhost_net vhost tap kvm_intel kvm irqbypass bridge stp llc ---[ end trace 9775b14b123b1713 ]--- Using JMP: ------------[ cut here ]------------ kernel BUG at /home/sean/go/src/kernel.org/linux/arch/x86/kvm/x86.c:356! invalid opcode: 0000 [#1] SMP CPU: 6 PID: 1067 Comm: qemu-system-x86 Not tainted 4.20.0-rc6+ #75 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:kvm_spurious_fault+0x5/0x10 [kvm] Code: <0f> 0b 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 41 55 49 89 fd 41 RSP: 0018:ffffc90000497cd0 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffffffffffff RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff88827058bd40 R08: 00000000000003e8 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000784 R12: ffffc90000369fb0 R13: 0000000000000000 R14: 00000003c8fc6642 R15: ffff88827058bd40 FS: 00007f3d7219e700(0000) GS:ffff888277900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f3d64001000 CR3: 0000000271c6b004 CR4: 0000000000362ee0 Call Trace: vmx_vcpu_run+0x156/0x630 [kvm_intel] ? kvm_arch_vcpu_ioctl_run+0x447/0x1a40 [kvm] ? kvm_vcpu_ioctl+0x368/0x5c0 [kvm] ? kvm_vcpu_ioctl+0x368/0x5c0 [kvm] ? __set_task_blocked+0x38/0x90 ? __set_current_blocked+0x50/0x60 ? __fpu__restore_sig+0x97/0x490 ? do_vfs_ioctl+0xa1/0x620 ? __x64_sys_futex+0x89/0x180 ? ksys_ioctl+0x66/0x70 ? __x64_sys_ioctl+0x16/0x20 ? do_syscall_64+0x4f/0x100 ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 Modules linked in: vhost_net vhost tap kvm_intel kvm irqbypass bridge stp llc ---[ end trace f9daedb85ab3ddba ]--- Fixes: b7c4145ba2eb ("KVM: Don't spin on virt instruction faults during reboot") Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini arch/x86/include/asm/kvm_host.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c2a7fad5fcd3267899803f07878f9f4ff719a120 Author: Sean Christopherson Date: Thu Dec 20 12:53:20 2018 -0800 MAINTAINERS: Add arch/x86/kvm sub-directories to existing KVM/x86 entry A series currently sitting in KVM's queue for 4.21 moves the bulk of KVM's VMX code to a dedicated VMX sub-directory[1]. As a result, get_maintainers.pl doesn't get any hits on the newly relocated VMX files when the script is run with --pattern-depth=1. Add all arch/x86/kvm sub-directories to the existing MAINTAINERS entry for KVM/x86 instead of arch/x86/kvm/vmx as other code, e.g. SVM, may get similar treatment in the near future. [1] https://patchwork.kernel.org/cover/10710751/ Signed-off-by: Sean Christopherson Signed-off-by: Paolo Bonzini MAINTAINERS | 1 + 1 file changed, 1 insertion(+) commit a49d784d5a8272d0f63c448fe8dc69e589db006e Author: Rafał Miłecki Date: Tue Dec 18 16:58:08 2018 +0100 pinctrl: bcm: ns: support updated DT binding as syscon subnode Documentation has been recently updated specifying that pinctrl should be subnode of the CRU "syscon". Support that by using parent node for regmap and reading "offset" property from the DT. Signed-off-by: Rafał Miłecki Signed-off-by: Linus Walleij drivers/pinctrl/bcm/pinctrl-ns.c | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-) commit 2ae80900f239484069569380e1fc4340fd6e0089 Author: Rafał Miłecki Date: Tue Dec 18 16:57:44 2018 +0100 dt-bindings: pinctrl: bcm4708-pinmux: rework binding to use syscon As pointed by Rob, CRU is a kind of block that can't be guaranteed to have everything exposed as subnodes. It's a set of various registers that aren't tied to any single device. It could be described much more accurately as MFD (Multi-Function Device). Some hardware blocks may indeed want to access a register or two of the CRU which requires describing it as the "syscon". While at it replace exmple node name with the standard "pinctrl" (also pointed out by Rob). Signed-off-by: Rafał Miłecki Signed-off-by: Linus Walleij .../devicetree/bindings/pinctrl/brcm,bcm4708-pinmux.txt | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) commit 72ab2f76319e15f7ad1f9d5f529df47099d4d271 Author: Jan Kotas Date: Tue Dec 18 16:10:42 2018 +0000 gpio: Add Cadence GPIO driver This patch adds a driver for Cadence GPIO controller. It can be enabled with GPIO_CADENCE Kconfig option. It uses generic GPIO infrastructure and works as an interrupt controller. At the moment it only supports level sensitive irqs. Signed-off-by: Jan Kotas Signed-off-by: Linus Walleij drivers/gpio/Kconfig | 8 ++ drivers/gpio/Makefile | 1 + drivers/gpio/gpio-cadence.c | 291 ++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 300 insertions(+) commit e4b194aa0bf522dad9ecf0568eb0fdd598a2713b Author: Jan Kotas Date: Tue Dec 18 16:10:41 2018 +0000 dt-bindings: gpio: Add bindings for Cadence GPIO This patch adds a DT binding documentation for Cadence GPIO controller. Signed-off-by: Jan Kotas Reviewed-by: Rob Herring [Removed interrupt-parent] Signed-off-by: Linus Walleij .../devicetree/bindings/gpio/cdns,gpio.txt | 43 ++++++++++++++++++++++ 1 file changed, 43 insertions(+) commit 6c905f91d8ae103cc0767267509a456f961a279d Author: Colin Ian King Date: Tue Dec 18 12:28:02 2018 +0000 gpiolib-acpi: remove unused variable 'err', cleans up build warning Variable err is defined but never used. Remove it. Cleans up warning: warning: unused variable ‘err’ [-Wunused-variable] Signed-off-by: Colin Ian King Acked-by: Mika Westerberg Signed-off-by: Linus Walleij drivers/gpio/gpiolib-acpi.c | 1 - 1 file changed, 1 deletion(-) commit f0df462f3ae1d10131f8ff7daa016ce1a8686727 Author: Uwe Kleine-König Date: Tue Dec 18 09:47:57 2018 +0100 gpio: mxs: read pin level directly instead of using .get Calling readl directly instead of going through another function that results in the same result to remove some overhead. I didn't try to measure the performance gain, but IMHO there is little benefit from abstracting a GPIO register access in the GPIO driver. Signed-off-by: Uwe Kleine-König Signed-off-by: Linus Walleij drivers/gpio/gpio-mxs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ac5ffda2447f033ddc44a87882dfcfed38d944dc Author: Uros Bizjak Date: Mon Nov 26 17:00:08 2018 +0100 KVM/x86: Use SVM assembly instruction mnemonics instead of .byte streams Recently the minimum required version of binutils was changed to 2.20, which supports all SVM instruction mnemonics. The patch removes all .byte #defines and uses real instruction mnemonics instead. Signed-off-by: Uros Bizjak Signed-off-by: Paolo Bonzini arch/x86/include/asm/svm.h | 7 ------- arch/x86/kvm/svm.c | 12 ++++++------ 2 files changed, 6 insertions(+), 13 deletions(-) commit 71883a62fcd6c70639fa12cda733378b4d997409 Author: Lan Tianyu Date: Thu Dec 6 21:21:13 2018 +0800 KVM/MMU: Flush tlb directly in the kvm_zap_gfn_range() Originally, flush tlb is done by slot_handle_level_range(). This patch moves the flush directly to kvm_zap_gfn_range() when range flush is available, so that only the requested range can be flushed. Signed-off-by: Lan Tianyu Signed-off-by: Paolo Bonzini arch/x86/kvm/mmu.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) commit 3cc5ea94de5f71dff0d3353f610e729308583e6b Author: Lan Tianyu Date: Thu Dec 6 21:21:12 2018 +0800 KVM/MMU: Flush tlb directly in kvm_set_pte_rmapp() This patch is to flush tlb directly in kvm_set_pte_rmapp() function when Hyper-V remote TLB flush is available, returning 0 so that kvm_mmu_notifier_change_pte() does not flush again. Signed-off-by: Lan Tianyu Signed-off-by: Paolo Bonzini arch/x86/kvm/mmu.c | 5 +++++ 1 file changed, 5 insertions(+) commit 0cf853c5e238edf503ebda2fe541e6f4a3d5bd40 Author: Lan Tianyu Date: Thu Dec 6 21:21:11 2018 +0800 KVM/MMU: Move tlb flush in kvm_set_pte_rmapp() to kvm_mmu_notifier_change_pte() This patch is to move tlb flush in kvm_set_pte_rmapp() to kvm_mmu_notifier_change_pte() in order to avoid redundant tlb flush. Signed-off-by: Lan Tianyu Signed-off-by: Paolo Bonzini arch/x86/kvm/mmu.c | 8 ++------ virt/kvm/kvm_main.c | 5 ++++- 2 files changed, 6 insertions(+), 7 deletions(-) commit 748c0e312fce983bd7854b369b192e24dce90878 Author: Lan Tianyu Date: Thu Dec 6 21:21:10 2018 +0800 KVM: Make kvm_set_spte_hva() return int The patch is to make kvm_set_spte_hva() return int and caller can check return value to determine flush tlb or not. Signed-off-by: Lan Tianyu Acked-by: Paul Mackerras Signed-off-by: Paolo Bonzini arch/arm/include/asm/kvm_host.h | 2 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/mips/include/asm/kvm_host.h | 2 +- arch/mips/kvm/mmu.c | 3 ++- arch/powerpc/include/asm/kvm_host.h | 2 +- arch/powerpc/kvm/book3s.c | 3 ++- arch/powerpc/kvm/e500_mmu_host.c | 3 ++- arch/x86/include/asm/kvm_host.h | 2 +- arch/x86/kvm/mmu.c | 3 ++- virt/kvm/arm/mmu.c | 6 ++++-- 10 files changed, 17 insertions(+), 11 deletions(-) commit c3134ce240eed2eaa9703579ef99c3099665236e Author: Lan Tianyu Date: Thu Dec 6 21:21:09 2018 +0800 KVM: Replace old tlb flush function with new one to flush a specified range. This patch is to replace kvm_flush_remote_tlbs() with kvm_flush_ remote_tlbs_with_address() in some functions without logic change. Signed-off-by: Lan Tianyu Signed-off-by: Paolo Bonzini arch/x86/kvm/mmu.c | 31 +++++++++++++++++++++---------- arch/x86/kvm/paging_tmpl.h | 3 ++- 2 files changed, 23 insertions(+), 11 deletions(-) commit 40ef75a758b291dc2cc88ecef36ffbb0eb095e00 Author: Lan Tianyu Date: Thu Dec 6 21:21:08 2018 +0800 KVM/MMU: Add tlb flush with range helper function This patch is to add wrapper functions for tlb_remote_flush_with_range callback and flush tlb directly in kvm_mmu_zap_collapsible_spte(). kvm_mmu_zap_collapsible_spte() returns flush request to the slot_handle_leaf() and the latter does flush on demand. When range flush is available, make kvm_mmu_zap_collapsible_spte() to flush tlb with range directly to avoid returning range back to slot_handle_leaf(). Signed-off-by: Lan Tianyu Signed-off-by: Paolo Bonzini arch/x86/kvm/mmu.c | 37 ++++++++++++++++++++++++++++++++++++- 1 file changed, 36 insertions(+), 1 deletion(-) commit 1f3a3e46cc49e81ab84d32710d3dae30697753a5 Author: Lan Tianyu Date: Thu Dec 6 21:21:07 2018 +0800 KVM/VMX: Add hv tlb range flush support This patch is to register tlb_remote_flush_with_range callback with hv tlb range flush interface. Signed-off-by: Lan Tianyu Signed-off-by: Paolo Bonzini arch/x86/kvm/vmx/vmx.c | 61 ++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 44 insertions(+), 17 deletions(-) commit cc4edae4b924b39877b5abb25074065930c5a6d5 Author: Lan Tianyu Date: Thu Dec 6 21:21:05 2018 +0800 x86/hyper-v: Add HvFlushGuestAddressList hypercall support Hyper-V provides HvFlushGuestAddressList() hypercall to flush EPT tlb with specified ranges. This patch is to add the hypercall support. Reviewed-by: Michael Kelley Signed-off-by: Lan Tianyu Signed-off-by: Paolo Bonzini arch/x86/hyperv/nested.c | 80 +++++++++++++++++++++++++++++++++++++ arch/x86/include/asm/hyperv-tlfs.h | 32 +++++++++++++++ arch/x86/include/asm/mshyperv.h | 15 +++++++ arch/x86/include/asm/trace/hyperv.h | 14 +++++++ 4 files changed, 141 insertions(+) commit a49b96352e68368c2e6784d13b0b4b7b8d830922 Author: Lan Tianyu Date: Thu Dec 6 21:21:04 2018 +0800 KVM: Add tlb_remote_flush_with_range callback in kvm_x86_ops Add flush range call back in the kvm_x86_ops and platform can use it to register its associated function. The parameter "kvm_tlb_range" accepts a single range and flush list which contains a list of ranges. Signed-off-by: Lan Tianyu Signed-off-by: Paolo Bonzini arch/x86/include/asm/kvm_host.h | 7 +++++++ 1 file changed, 7 insertions(+) commit ee85dec2fe9c860c40f6e2e1d53052b80f36cd58 Author: Luwei Kang Date: Wed Oct 24 16:05:16 2018 +0800 KVM: x86: Disable Intel PT when VMXON in L1 guest Currently, Intel Processor Trace do not support tracing in L1 guest VMX operation(IA32_VMX_MISC[bit 14] is 0). As mentioned in SDM, on these type of processors, execution of the VMXON instruction will clears IA32_RTIT_CTL.TraceEn and any attempt to write IA32_RTIT_CTL causes a general-protection exception (#GP). Signed-off-by: Luwei Kang Signed-off-by: Paolo Bonzini arch/x86/kvm/vmx/nested.c | 6 ++++++ arch/x86/kvm/vmx/vmx.c | 3 ++- 2 files changed, 8 insertions(+), 1 deletion(-) commit b08c28960f254bd246af8e30a468dfc7dd56e03b Author: Chao Peng Date: Wed Oct 24 16:05:15 2018 +0800 KVM: x86: Set intercept for Intel PT MSRs read/write To save performance overhead, disable intercept Intel PT MSRs read/write when Intel PT is enabled in guest. MSR_IA32_RTIT_CTL is an exception that will always be intercepted. Signed-off-by: Chao Peng Signed-off-by: Luwei Kang Signed-off-by: Paolo Bonzini arch/x86/kvm/vmx/vmx.c | 33 ++++++++++++++++++++++++++------- arch/x86/kvm/vmx/vmx.h | 1 + 2 files changed, 27 insertions(+), 7 deletions(-) commit bf8c55d8dc094c85a3f98cd302a4dddb720dd63f Author: Chao Peng Date: Wed Oct 24 16:05:14 2018 +0800 KVM: x86: Implement Intel PT MSRs read/write emulation This patch implement Intel Processor Trace MSRs read/write emulation. Intel PT MSRs read/write need to be emulated when Intel PT MSRs is intercepted in guest and during live migration. Signed-off-by: Chao Peng Signed-off-by: Luwei Kang Signed-off-by: Paolo Bonzini arch/x86/kvm/vmx/vmx.c | 184 +++++++++++++++++++++++++++++++++++++++++++++++++ arch/x86/kvm/x86.c | 33 ++++++++- 2 files changed, 216 insertions(+), 1 deletion(-) commit 6c0f0bba85a0de83b32ff8ccf3e5965815cc069b Author: Luwei Kang Date: Wed Oct 24 16:05:13 2018 +0800 KVM: x86: Introduce a function to initialize the PT configuration Initialize the Intel PT configuration when cpuid update. Include cpuid inforamtion, rtit_ctl bit mask and the number of address ranges. Signed-off-by: Luwei Kang Signed-off-by: Paolo Bonzini arch/x86/kvm/vmx/vmx.c | 73 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 73 insertions(+) commit 2ef444f1600bfc2d8522df0f537aafef79befa7e Author: Chao Peng Date: Wed Oct 24 16:05:12 2018 +0800 KVM: x86: Add Intel PT context switch for each vcpu Load/Store Intel Processor Trace register in context switch. MSR IA32_RTIT_CTL is loaded/stored automatically from VMCS. In Host-Guest mode, we need load/resore PT MSRs only when PT is enabled in guest. Signed-off-by: Chao Peng Signed-off-by: Luwei Kang Signed-off-by: Paolo Bonzini arch/x86/kvm/vmx/vmx.c | 74 ++++++++++++++++++++++++++++++++++++++++++++++++++ arch/x86/kvm/vmx/vmx.h | 21 ++++++++++++++ 2 files changed, 95 insertions(+) commit 86f5201df0d3e3efc78d3eac7fc5a59b813287cd Author: Chao Peng Date: Wed Oct 24 16:05:11 2018 +0800 KVM: x86: Add Intel Processor Trace cpuid emulation Expose Intel Processor Trace to guest only when the PT works in Host-Guest mode. Signed-off-by: Chao Peng Signed-off-by: Luwei Kang Signed-off-by: Paolo Bonzini arch/x86/include/asm/kvm_host.h | 1 + arch/x86/kvm/cpuid.c | 22 ++++++++++++++++++++-- arch/x86/kvm/svm.c | 6 ++++++ arch/x86/kvm/vmx/vmx.c | 6 ++++++ 4 files changed, 33 insertions(+), 2 deletions(-) commit f99e3daf94ff35dd4a878d32ff66e1fd35223ad6 Author: Chao Peng Date: Wed Oct 24 16:05:10 2018 +0800 KVM: x86: Add Intel PT virtualization work mode Intel Processor Trace virtualization can be work in one of 2 possible modes: a. System-Wide mode (default): When the host configures Intel PT to collect trace packets of the entire system, it can leave the relevant VMX controls clear to allow VMX-specific packets to provide information across VMX transitions. KVM guest will not aware this feature in this mode and both host and KVM guest trace will output to host buffer. b. Host-Guest mode: Host can configure trace-packet generation while in VMX non-root operation for guests and root operation for native executing normally. Intel PT will be exposed to KVM guest in this mode, and the trace output to respective buffer of host and guest. In this mode, tht status of PT will be saved and disabled before VM-entry and restored after VM-exit if trace a virtual machine. Signed-off-by: Chao Peng Signed-off-by: Luwei Kang Signed-off-by: Paolo Bonzini arch/x86/include/asm/msr-index.h | 1 + arch/x86/include/asm/vmx.h | 8 ++++++++ arch/x86/kvm/vmx/capabilities.h | 15 +++++++++++++++ arch/x86/kvm/vmx/vmx.c | 21 +++++++++++++++++++-- arch/x86/kvm/vmx/vmx.h | 9 ++++++++- 5 files changed, 51 insertions(+), 3 deletions(-) commit e0018afec50a4846789d92a1b7cd6cd7f816c448 Author: Luwei Kang Date: Wed Oct 24 16:05:09 2018 +0800 perf/x86/intel/pt: add new capability for Intel PT This adds support for "output to Trace Transport subsystem" capability of Intel PT. It means that PT can output its trace to an MMIO address range rather than system memory buffer. Acked-by: Song Liu Signed-off-by: Luwei Kang Reviewed-by: Thomas Gleixner Signed-off-by: Paolo Bonzini arch/x86/events/intel/pt.c | 1 + arch/x86/include/asm/intel_pt.h | 1 + 2 files changed, 2 insertions(+) commit 69843a913fc86b3d0ef503d6cc15886ef8943626 Author: Luwei Kang Date: Wed Oct 24 16:05:08 2018 +0800 perf/x86/intel/pt: Add new bit definitions for PT MSRs Add bit definitions for Intel PT MSRs to support trace output directed to the memeory subsystem and holds a count if packet bytes that have been sent out. These are required by the upcoming PT support in KVM guests for MSRs read/write emulation. Signed-off-by: Luwei Kang Signed-off-by: Paolo Bonzini arch/x86/include/asm/msr-index.h | 3 +++ 1 file changed, 3 insertions(+) commit 61be2998ca541f7d9f487479b2ec519d83328085 Author: Luwei Kang Date: Wed Oct 24 16:05:07 2018 +0800 perf/x86/intel/pt: Introduce intel_pt_validate_cap() intel_pt_validate_hw_cap() validates whether a given PT capability is supported by the hardware. It checks the PT capability array which reflects the capabilities of the hardware on which the code is executed. For setting up PT for KVM guests this is not correct as the capability array for the guest can be different from the host array. Provide a new function to check against a given capability array. Acked-by: Song Liu Signed-off-by: Luwei Kang Signed-off-by: Paolo Bonzini arch/x86/events/intel/pt.c | 12 +++++++++--- arch/x86/include/asm/intel_pt.h | 2 ++ 2 files changed, 11 insertions(+), 3 deletions(-) commit f6d079ce867d679e4dffef5b3112c7634215fd88 Author: Chao Peng Date: Wed Oct 24 16:05:06 2018 +0800 perf/x86/intel/pt: Export pt_cap_get() pt_cap_get() is required by the upcoming PT support in KVM guests. Export it and move the capabilites enum to a global header. As a global functions, "pt_*" is already used for ptrace and other things, so it makes sense to use "intel_pt_*" as a prefix. Acked-by: Song Liu Signed-off-by: Chao Peng Signed-off-by: Luwei Kang Signed-off-by: Paolo Bonzini arch/x86/events/intel/pt.c | 49 ++++++++++++++++++++++------------------- arch/x86/events/intel/pt.h | 21 ------------------ arch/x86/include/asm/intel_pt.h | 23 +++++++++++++++++++ 3 files changed, 49 insertions(+), 44 deletions(-) commit 887eda13b570f62a8b7d3eadc91734e44d95e636 Author: Chao Peng Date: Wed Oct 24 16:05:05 2018 +0800 perf/x86/intel/pt: Move Intel PT MSRs bit defines to global header The Intel Processor Trace (PT) MSR bit defines are in a private header. The upcoming support for PT virtualization requires these defines to be accessible from KVM code. Move them to the global MSR header file. Reviewed-by: Thomas Gleixner Signed-off-by: Chao Peng Signed-off-by: Luwei Kang Signed-off-by: Paolo Bonzini arch/x86/events/intel/pt.h | 37 ------------------------------------- arch/x86/include/asm/msr-index.h | 33 +++++++++++++++++++++++++++++++++ 2 files changed, 33 insertions(+), 37 deletions(-) commit 8cee58161efffcb5ba691c33fe4de3eb75cf46cb Author: Andrew Jones Date: Tue Nov 6 14:57:12 2018 +0100 kvm: selftests: aarch64: dirty_log_test: support greater than 40-bit IPAs When KVM has KVM_CAP_ARM_VM_IPA_SIZE we can test with > 40-bit IPAs by using the 'type' field of KVM_CREATE_VM. Signed-off-by: Andrew Jones Signed-off-by: Radim Krčmář tools/testing/selftests/kvm/dirty_log_test.c | 31 +++++++++++++++++++--- tools/testing/selftests/kvm/include/kvm_util.h | 2 ++ tools/testing/selftests/kvm/lib/kvm_util.c | 17 ++++++++---- .../testing/selftests/kvm/lib/kvm_util_internal.h | 1 + 4 files changed, 42 insertions(+), 9 deletions(-) commit cdbd2428482486bcb2ab86dd7d99e8adec2b7c39 Author: Andrew Jones Date: Tue Nov 6 14:57:11 2018 +0100 kvm: selftests: add pa-48/va-48 VM modes Signed-off-by: Andrew Jones Signed-off-by: Radim Krčmář tools/testing/selftests/kvm/include/kvm_util.h | 2 ++ .../testing/selftests/kvm/lib/aarch64/processor.c | 18 +++++++++++------ tools/testing/selftests/kvm/lib/kvm_util.c | 23 ++++++++++++++++++++-- 3 files changed, 35 insertions(+), 8 deletions(-) commit 696ade770f08a194b85dbf22d6f1613285905ae5 Author: Andrew Jones Date: Tue Nov 6 14:57:10 2018 +0100 kvm: selftests: dirty_log_test: improve mode param management Signed-off-by: Andrew Jones Signed-off-by: Radim Krčmář tools/testing/selftests/kvm/dirty_log_test.c | 48 +++++++++++++--------------- 1 file changed, 23 insertions(+), 25 deletions(-) commit fd3f6f813976620553e951eb10d3a11b673a8131 Author: Andrew Jones Date: Tue Nov 6 14:57:09 2018 +0100 kvm: selftests: dirty_log_test: reset guest test phys offset We need to reset the offset for each mode as it will change depending on the number of guest physical address bits. Signed-off-by: Andrew Jones Signed-off-by: Radim Krčmář tools/testing/selftests/kvm/dirty_log_test.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) commit 6498e1da84daec4b3ef97e2174b07ea0af3ff06e Author: Andrew Jones Date: Tue Nov 6 14:57:08 2018 +0100 kvm: selftests: dirty_log_test: always use -t There's no reason not to always test the topmost physical addresses, and if the user wants to try lower addresses then '-p' (used to be '-o before this patch) can be used. Let's remove the '-t' option and just always do what it did. Signed-off-by: Andrew Jones Signed-off-by: Radim Krčmář tools/testing/selftests/kvm/dirty_log_test.c | 36 +++++++++++++--------------- 1 file changed, 17 insertions(+), 19 deletions(-) commit d4df5a15602e8edc2e90f5ee880de3cf7dbd92cd Author: Andrew Jones Date: Tue Nov 6 14:57:07 2018 +0100 kvm: selftests: dirty_log_test: don't identity map the test mem It isn't necessary and can even cause problems when testing high guest physical addresses. This patch leaves the test memory id- mapped by default, but when using '-t' the test memory virtual addresses stay the same even though the physical addresses switch to the topmost valid addresses. Signed-off-by: Andrew Jones Signed-off-by: Radim Krčmář tools/testing/selftests/kvm/dirty_log_test.c | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-) commit b442324b581556e106010bb092dbb7e3ee25c94c Author: Andrew Jones Date: Tue Nov 6 14:57:06 2018 +0100 kvm: selftests: x86_64: dirty_log_test: fix -t Signed-off-by: Andrew Jones Signed-off-by: Radim Krčmář tools/testing/selftests/kvm/dirty_log_test.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit bdd303cb1bdb24e71eef8e4510b27166bfadf286 Author: Wei Yang Date: Mon Nov 5 14:45:03 2018 +0800 KVM: fix some typos Signed-off-by: Wei Yang [Preserved the iff and a probably intentional weird bracket notation. Also dropped the style change to make a single-purpose patch. - Radim] Signed-off-by: Radim Krčmář arch/x86/kvm/mmu.c | 2 +- arch/x86/kvm/x86.c | 2 +- virt/kvm/async_pf.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) commit 649472a1694fb72a9e586bc40bfcf9282a4e8ccc Author: Peng Hao Date: Fri Nov 2 17:05:17 2018 +0800 x86/kvmclock: convert to SPDX identifiers Update the verbose license text with the matching SPDX license identifier. Signed-off-by: Peng Hao [Changed deprecated GPL-2.0+ to GPL-2.0-or-later. - Radim] Signed-off-by: Radim Krčmář arch/x86/kernel/kvmclock.c | 15 +-------------- 1 file changed, 1 insertion(+), 14 deletions(-) commit 9b7ebff23cb8a8e126b3852ad0b1bfb284f25273 Author: Sean Christopherson Date: Mon Nov 5 10:44:32 2018 -0800 KVM: x86: Remove KF() macro placeholder Although well-intentioned, keeping the KF() definition as a hint for handling scattered CPUID features may be counter-productive. Simply redefining the bit position only works for directly manipulating the guest's CPUID leafs, e.g. it doesn't make guest_cpuid_has() magically work. Taking an alternative approach, e.g. ensuring the bit position is identical between the Linux-defined and hardware-defined features, may be a simpler and/or more effective method of exposing scattered features to the guest. Signed-off-by: Sean Christopherson Signed-off-by: Radim Krčmář arch/x86/kvm/cpuid.c | 3 --- 1 file changed, 3 deletions(-) commit 788fc1e9ad8e1d332d3a18692028d1faee6fabb0 Author: Jim Mattson Date: Fri Nov 9 09:35:11 2018 -0800 kvm: vmx: Allow guest read access to IA32_TSC Let the guest read the IA32_TSC MSR with the generic RDMSR instruction as well as the specific RDTSC(P) instructions. Note that the hardware applies the TSC multiplier and offset (when applicable) to the result of RDMSR(IA32_TSC), just as it does to the result of RDTSC(P). Signed-off-by: Jim Mattson Reviewed-by: Peter Shier Reviewed-by: Marc Orr Reviewed-by: Liran Alon Signed-off-by: Radim Krčmář arch/x86/kvm/vmx/vmx.c | 1 + 1 file changed, 1 insertion(+) commit 9ebdfe5230f2e50e3ba05c57723a06e90946815a Author: Jim Mattson Date: Mon Nov 26 11:22:32 2018 -0800 kvm: nVMX: NMI-window and interrupt-window exiting should wake L2 from HLT According to the SDM, "NMI-window exiting" VM-exits wake a logical processor from the same inactive states as would an NMI and "interrupt-window exiting" VM-exits wake a logical processor from the same inactive states as would an external interrupt. Specifically, they wake a logical processor from the shutdown state and from the states entered using the HLT and MWAIT instructions. Fixes: 6dfacadd5858 ("KVM: nVMX: Add support for activity state HLT") Signed-off-by: Jim Mattson Reviewed-by: Peter Shier Suggested-by: Sean Christopherson [Squashed comments of two Jim's patches and used the simplified code hunk provided by Sean. - Radim] Signed-off-by: Radim Krčmář arch/x86/kvm/vmx/nested.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) commit e081354d6aa7b67c6d0ef51ff8c428b6c261a6fe Author: Tambe, William Date: Tue Nov 13 16:51:20 2018 +0000 KVM: nSVM: Fix nested guest support for PAUSE filtering. Currently, the nested guest's PAUSE intercept intentions are not being honored. Instead, since the L0 hypervisor's pause_filter_count and pause_filter_thresh values are still in place, these values are used instead of those programmed in the VMCB by the L1 hypervisor. To honor the desired PAUSE intercept support of the L1 hypervisor, the L0 hypervisor must use the PAUSE filtering fields of the L1 hypervisor. This requires saving and restoring of both the L0 and L1 hypervisor's PAUSE filtering fields. Signed-off-by: William Tambe Signed-off-by: Radim Krčmář arch/x86/kvm/svm.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit 7a86dab8cf2f0fdf508f3555dddfc236623bff60 Author: Jim Mattson Date: Fri Dec 14 14:34:43 2018 -0800 kvm: Change offset in kvm_write_guest_offset_cached to unsigned Since the offset is added directly to the hva from the gfn_to_hva_cache, a negative offset could result in an out of bounds write. The existing BUG_ON only checks for addresses beyond the end of the gfn_to_hva_cache, not for addresses before the start of the gfn_to_hva_cache. Note that all current call sites have non-negative offsets. Fixes: 4ec6e8636256 ("kvm: Introduce kvm_write_guest_offset_cached()") Reported-by: Cfir Cohen Signed-off-by: Jim Mattson Reviewed-by: Cfir Cohen Reviewed-by: Peter Shier Reviewed-by: Krish Sadhukhan Reviewed-by: Sean Christopherson Signed-off-by: Radim Krčmář include/linux/kvm_host.h | 3 ++- virt/kvm/kvm_main.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) commit f1b9dd5eb86cec1fcf66aad17e7701d98d024a9a Author: Jim Mattson Date: Mon Dec 17 13:53:33 2018 -0800 kvm: Disallow wraparound in kvm_gfn_to_hva_cache_init Previously, in the case where (gpa + len) wrapped around, the entire region was not validated, as the comment claimed. It doesn't actually seem that wraparound should be allowed here at all. Furthermore, since some callers don't check the return code from this function, it seems prudent to clear ghc->memslot in the event of an error. Fixes: 8f964525a121f ("KVM: Allow cross page reads and writes from cached translations.") Reported-by: Cfir Cohen Signed-off-by: Jim Mattson Reviewed-by: Cfir Cohen Reviewed-by: Marc Orr Cc: Andrew Honig Signed-off-by: Radim Krčmář virt/kvm/kvm_main.c | 41 +++++++++++++++++++++-------------------- 1 file changed, 21 insertions(+), 20 deletions(-) commit ba7424b200d347fbbf9fadecaffb2a0feb740039 Author: YueHaibing Date: Tue Dec 18 01:01:49 2018 +0000 KVM: VMX: Remove duplicated include from vmx.c Remove duplicated include. Signed-off-by: YueHaibing Reviewed-by: David Hildenbrand Signed-off-by: Radim Krčmář arch/x86/kvm/vmx/vmx.c | 1 - 1 file changed, 1 deletion(-) commit b85c32dd27495075380350fcd5d614a6b45311b8 Author: Vitaly Kuznetsov Date: Wed Dec 19 12:15:18 2018 +0100 selftests: kvm: report failed stage when exit reason is unexpected When we get a report like ==== Test Assertion Failure ==== x86_64/state_test.c:157: run->exit_reason == KVM_EXIT_IO pid=955 tid=955 - Success 1 0x0000000000401350: main at state_test.c:154 2 0x00007fc31c9e9412: ?? ??:0 3 0x000000000040159d: _start at ??:? Unexpected exit reason: 8 (SHUTDOWN), it is not obvious which particular stage failed. Add the info. Signed-off-by: Vitaly Kuznetsov Signed-off-by: Radim Krčmář tools/testing/selftests/kvm/x86_64/evmcs_test.c | 4 ++-- tools/testing/selftests/kvm/x86_64/state_test.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) commit e87555e550cef4941579cd879759a7c0dee24e68 Author: Vitaly Kuznetsov Date: Wed Dec 19 12:06:13 2018 +0100 KVM: x86: svm: report MSR_IA32_MCG_EXT_CTL as unsupported AMD doesn't seem to implement MSR_IA32_MCG_EXT_CTL and svm code in kvm knows nothing about it, however, this MSR is among emulated_msrs and thus returned with KVM_GET_MSR_INDEX_LIST. The consequent KVM_GET_MSRS, of course, fails. Report the MSR as unsupported to not confuse userspace. Signed-off-by: Vitaly Kuznetsov Signed-off-by: Radim Krčmář arch/x86/kvm/svm.c | 7 +++++++ 1 file changed, 7 insertions(+) commit ed8e48122728acfaf7bfa904cba034d83905b43a Author: Paolo Bonzini Date: Fri Dec 21 11:25:59 2018 +0100 KVM: x86: fix size of x86_fpu_cache objects The memory allocation in b666a4b69739 ("kvm: x86: Dynamically allocate guest_fpu", 2018-11-06) is wrong, there are other members in struct fpu before the fpregs_state union and the patch should be doing something similar to the code in fpu__init_task_struct_size. It's enough to run a guest and then rmmod kvm to see slub errors which are actually caused by memory corruption. For now let's revert it to sizeof(struct fpu), which is conservative. I have plans to move fsave/fxsave/xsave directly in KVM, without using the kernel FPU helpers, and once it's done, the size of the object in the cache will be something like kvm_xstate_size. Signed-off-by: Paolo Bonzini arch/x86/kvm/x86.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6ac5af6ec12dadca37dd86f93a4125f6a04ffb4c Author: Ludovic Desroches Date: Thu Nov 8 14:14:42 2018 +0100 MAINTAINERS: merge at91 pinctrl entries In order to be aware of all changes related to at91 pinctrl drivers, merge the two entries. Make use of the opportunity to replace Atmel by Microchip. Signed-off-by: Ludovic Desroches Signed-off-by: Linus Walleij MAINTAINERS | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) commit a2161fd7c23cad7f9e962cb63d39ca2dbd41b960 Author: Aisheng Dong Date: Mon Dec 17 15:38:15 2018 +0000 pinctrl: imx8qxp: break the dependency on SOC_IMX8QXP ARM64 SoC does not encourage people to add more finegrained SoC config options rather than a single ARCH_ in arch Kconfig. So this patch aims to break the dependency on SOC_IMX8QXP. Cc: Linus Walleij Cc: Fabio Estevam Cc: Stefan Agner Cc: Pengutronix Kernel Team Acked-by: Shawn Guo Signed-off-by: Dong Aisheng Signed-off-by: Linus Walleij drivers/pinctrl/freescale/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8b78de956f31c5f210d190766cd23b9f1f6a8ee6 Author: Masahiro Yamada Date: Fri Dec 14 17:44:46 2018 +0900 pinctrl: uniphier: constify uniphier_pinctrl_socdata These are constant data. Signed-off-by: Masahiro Yamada Signed-off-by: Linus Walleij drivers/pinctrl/uniphier/pinctrl-uniphier-core.c | 4 ++-- drivers/pinctrl/uniphier/pinctrl-uniphier-ld11.c | 2 +- drivers/pinctrl/uniphier/pinctrl-uniphier-ld20.c | 2 +- drivers/pinctrl/uniphier/pinctrl-uniphier-ld4.c | 2 +- drivers/pinctrl/uniphier/pinctrl-uniphier-ld6b.c | 2 +- drivers/pinctrl/uniphier/pinctrl-uniphier-pro4.c | 2 +- drivers/pinctrl/uniphier/pinctrl-uniphier-pro5.c | 2 +- drivers/pinctrl/uniphier/pinctrl-uniphier-pxs2.c | 2 +- drivers/pinctrl/uniphier/pinctrl-uniphier-pxs3.c | 2 +- drivers/pinctrl/uniphier/pinctrl-uniphier-sld8.c | 2 +- drivers/pinctrl/uniphier/pinctrl-uniphier.h | 2 +- 11 files changed, 12 insertions(+), 12 deletions(-) commit b5af33df50e91f7c79c050ec73062577b9d0dae3 Author: Ryder Lee Date: Thu Dec 13 10:27:50 2018 +0800 pinctrl: mediatek: improve Kconfig dependencies Remove prompts to make all pinctrl cores to non-visible symbols and make sure the target SoCs would be coupled with the corresponding cores. Signed-off-by: Ryder Lee Tested-by: Kevin Hilman Signed-off-by: Linus Walleij drivers/pinctrl/mediatek/Kconfig | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) commit 533918b6f6ae7566b703adf0346dd15f2a60fe77 Author: Tao Ren Date: Wed Dec 12 13:53:05 2018 -0800 gpio: aspeed: remove duplicated statement Remove duplicated assignment statement from aspeed_gpio_probe() function. Signed-off-by: Tao Ren Acked-by: Joel Stanley Signed-off-by: Linus Walleij drivers/gpio/gpio-aspeed.c | 1 - 1 file changed, 1 deletion(-) commit d1040ea06f0004fe22e881a8fe88db12ef83b98c Author: Arnd Bergmann Date: Mon Dec 10 21:59:45 2018 +0100 pinctrl: msm: mark PM functions as __maybe_unused Without CONFIG_PM_SLEEP, we get annoying warnings about unused functions: drivers/pinctrl/qcom/pinctrl-msm.c:1082:12: error: 'msm_pinctrl_resume' defined but not used [-Werror=unused-function] static int msm_pinctrl_resume(struct device *dev) ^~~~~~~~~~~~~~~~~~ drivers/pinctrl/qcom/pinctrl-msm.c:1075:12: error: 'msm_pinctrl_suspend' defined but not used [-Werror=unused-function] static int msm_pinctrl_suspend(struct device *dev) Mark them as __maybe_unused to shut up the warning and silently drop the functions without having to add ugly #ifdefs. Fixes: 977d057ad346 ("pinctrl: msm: Add sleep pinctrl state transitions") Signed-off-by: Arnd Bergmann Reviewed-by: Evan Green Signed-off-by: Linus Walleij drivers/pinctrl/qcom/pinctrl-msm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit b766470b876409b9d821c5773a08a90f8cc50c76 Author: Maxime Ripard Date: Mon Dec 17 14:16:26 2018 +0100 dt-bindings: pinctrl: sunxi: Add supply properties The pinctrl node can have multiple regulators for each of its GPIO banks. Add the property descriptions. Signed-off-by: Maxime Ripard Signed-off-by: Linus Walleij .../devicetree/bindings/pinctrl/allwinner,sunxi-pinctrl.txt | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit 4dd3d60a5ecdaac13f728eccdf0d962bc34d18d4 Author: Martin Blumenstingl Date: Sun Dec 9 20:50:55 2018 +0100 pinctrl: meson: meson8b: add the missing GPIO_GROUPs for BOOT and CARD Add the BOOT and CARD pins as GROUP_GROUPs as well so they can be configured in devicetree using groups = BOOTx or groups = CARDx. This makes the behavior consistent with other pins inside the same driver as well as with the BOOT and CARD pins of the GXBB and GXL pinctrl drivers. Fixes: 0fefcb6876d0d6 ("pinctrl: Add support for Meson8b") Signed-off-by: Martin Blumenstingl Signed-off-by: Linus Walleij drivers/pinctrl/meson/pinctrl-meson8b.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) commit 619cdd17f60f18c034a111e773fb8f8220470a01 Author: Martin Blumenstingl Date: Sun Dec 9 20:50:54 2018 +0100 pinctrl: meson: meson8: add the missing GPIO_GROUPs for BOOT and CARD Add the BOOT and CARD pins as GROUP_GROUPs as well so they can be configured in devicetree using groups = BOOTx or groups = CARDx. This makes the behavior consistent with other pins inside the same driver as well as with the BOOT and CARD pins of the GXBB and GXL pinctrl drivers. Fixes: 6ac730951104a4 ("pinctrl: add driver for Amlogic Meson SoCs") Signed-off-by: Martin Blumenstingl Signed-off-by: Linus Walleij drivers/pinctrl/meson/pinctrl-meson8.c | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) commit 8e5ba8b8baffc3a17e96e3f72d1fd82a1675c251 Author: Martin Blumenstingl Date: Sun Dec 9 20:50:52 2018 +0100 pinctrl: meson: meson8: rename the "gpio" function to "gpio_periphs" Rename the existing "gpio" function to "gpio_periphs". This makes it consistent with the "gpio_aobus" function. Also GXBB and GXL are also using the "gpio_periphs" naming, so this makes the code here consistent with other Amlogic pinctrl drivers. No functional changes since thee "gpio" function is currently not used. Signed-off-by: Martin Blumenstingl Signed-off-by: Linus Walleij drivers/pinctrl/meson/pinctrl-meson8.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 54a9cbbfca53d0220a2f4bfc56da33ed12d6b5da Author: Martin Blumenstingl Date: Sun Dec 9 20:50:53 2018 +0100 pinctrl: meson: meson8: rename the "gpio" function to "gpio_periphs" Rename the existing "gpio" function to "gpio_periphs". This makes it consistent with the "gpio_aobus" function. Also GXBB and GXL are also using the "gpio_periphs" naming, so this makes the code here consistent with other Amlogic pinctrl drivers. No functional changes since thee "gpio" function is currently not used. Signed-off-by: Martin Blumenstingl Signed-off-by: Linus Walleij drivers/pinctrl/meson/pinctrl-meson8b.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 2b745ac3cceb8fc1d9985990c8241a821ea97e53 Author: Martin Blumenstingl Date: Sun Dec 9 20:50:51 2018 +0100 pinctrl: meson: meson8b: fix the GPIO function for the GPIOAO pins The GPIOAO pins (as well as the two exotic GPIO_BSD_EN and GPIO_TEST_N) only belong to the pin controller in the AO domain. With the current definition these pins cannot be referred to in .dts files as group (which is possible on GXBB and GXL for example). Add a separate "gpio_aobus" function to fix the mapping between the pin controller and the GPIO pins in the AO domain. This is similar to how the GXBB and GXL drivers implement this functionality. Fixes: 9dab1868ec0db4 ("pinctrl: amlogic: Make driver independent from two-domain configuration") Signed-off-by: Martin Blumenstingl Signed-off-by: Linus Walleij drivers/pinctrl/meson/pinctrl-meson8b.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) commit 42f9b48cc5402be11d2364275eb18c257d2a79e8 Author: Martin Blumenstingl Date: Sun Dec 9 20:50:50 2018 +0100 pinctrl: meson: meson8: fix the GPIO function for the GPIOAO pins The GPIOAO pins (as well as the two exotic GPIO_BSD_EN and GPIO_TEST_N) only belong to the pin controller in the AO domain. With the current definition these pins cannot be referred to in .dts files as group (which is possible on GXBB and GXL for example). Add a separate "gpio_aobus" function to fix the mapping between the pin controller and the GPIO pins in the AO domain. This is similar to how the GXBB and GXL drivers implement this functionality. Fixes: 9dab1868ec0db4 ("pinctrl: amlogic: Make driver independent from two-domain configuration") Signed-off-by: Martin Blumenstingl Signed-off-by: Linus Walleij drivers/pinctrl/meson/pinctrl-meson8.c | 3 +++ 1 file changed, 3 insertions(+) commit fb0b35d307b7109d245f45be780d15fb368f94c5 Author: Andrei.Stefanescu@microchip.com Date: Wed Dec 12 11:57:15 2018 +0000 gpio: add driver for SAMA5D2 PIOBU pins PIOBU pins do not lose their voltage during Backup/Self-refresh. This patch adds a simple GPIO controller for them and a maintainer for the driver. This driver adds support for using the pins as GPIO offering the possibility to read/set the voltage. Signed-off-by: Andrei Stefanescu Signed-off-by: Linus Walleij MAINTAINERS | 6 + drivers/gpio/Kconfig | 11 ++ drivers/gpio/Makefile | 1 + drivers/gpio/gpio-sama5d2-piobu.c | 253 ++++++++++++++++++++++++++++++++++++++ 4 files changed, 271 insertions(+) commit 6bd925a8b779b262b007d638171c80398cfbc217 Author: Andrei.Stefanescu@microchip.com Date: Wed Dec 12 11:57:11 2018 +0000 dt-bindings: arm: atmel: describe SECUMOD usage as a GPIO controller This patch describes the Security Module's usage as a GPIO controller for its PIOBU pins. These pins have the special property of maintaining their voltage during suspend-to-mem. Signed-off-by: Andrei Stefanescu Reviewed-by: Rob Herring Signed-off-by: Linus Walleij Documentation/devicetree/bindings/arm/atmel-sysregs.txt | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) commit 249d1bb22901a214f3e7265362057fba471b7204 Author: Hardik Singh Rathore Date: Fri Dec 21 01:06:42 2018 -0800 Input: touchscreen - fix coding style issue This patch fixes the coding style problem reported by checkpatch.pl as below: ERROR: foo* bar should be "foo *bar" Signed-off-by: Hardik Singh Rathore Signed-off-by: Dmitry Torokhov drivers/input/touchscreen/ad7879.c | 2 +- drivers/input/touchscreen/ektf2127.c | 2 +- drivers/input/touchscreen/gunze.c | 4 ++-- drivers/input/touchscreen/inexio.c | 4 ++-- drivers/input/touchscreen/mtouch.c | 4 ++-- 5 files changed, 8 insertions(+), 8 deletions(-) commit a465d38fa3dce6a0dc2d5814cb3aa7b0d2982c6b Merge: 442a5d000a4c 2c3b0463bb28 f9dca0f0675e 584923efe91f Author: Rafael J. Wysocki Date: Fri Dec 21 10:07:37 2018 +0100 Merge branches 'pm-devfreq', 'pm-avs' and 'pm-tools' * pm-devfreq: PM / devfreq: add devfreq_suspend/resume() functions PM / devfreq: add support for suspend/resume of a devfreq device PM / devfreq: refactor set_target frequency function * pm-avs: PM / AVS: SmartReflex: Switch to SPDX Licence ID PM / AVS: SmartReflex: NULL check before some freeing functions is not needed PM / AVS: SmartReflex: remove unused function * pm-tools: tools/power/x86/intel_pstate_tracer: Fix non root execution for post processing a trace file tools/power turbostat: consolidate duplicate model numbers tools/power turbostat: fix goldmont C-state limit decoding cpupower : Auto-completion for cpupower tool tools/power turbostat: reduce debug output tools/power turbosat: fix AMD APIC-id output commit 442a5d000a4cabe8330074ad874da0f5ea47bb4f Merge: 6f049e7c87fd 8234f6734c5d 96c6935212d6 d32dcc6c6970 943a10f85265 Author: Rafael J. Wysocki Date: Fri Dec 21 10:06:44 2018 +0100 Merge branches 'pm-core', 'pm-qos', 'pm-domains' and 'pm-sleep' * pm-core: PM-runtime: Switch autosuspend over to using hrtimers * pm-qos: PM / QoS: Change to use DEFINE_SHOW_ATTRIBUTE macro * pm-domains: PM / Domains: remove define_genpd_open_function() and define_genpd_debugfs_fops() * pm-sleep: PM / sleep: convert to DEFINE_SHOW_ATTRIBUTE commit 6f049e7c87fd60b9d2649c53e397741d50eb3d44 Merge: 3a56fe685dc9 bcbeef5f001c Author: Rafael J. Wysocki Date: Fri Dec 21 10:06:18 2018 +0100 Merge branch 'pm-opp' * pm-opp: PM / Domains: Propagate performance state updates PM / Domains: Factorize dev_pm_genpd_set_performance_state() PM / Domains: Save OPP table pointer in genpd OPP: Don't return 0 on error from of_get_required_opp_performance_state() OPP: Add dev_pm_opp_xlate_performance_state() helper OPP: Improve _find_table_of_opp_np() PM / Domains: Make genpd performance states orthogonal to the idlestates OPP: Fix missing debugfs supply directory for OPPs OPP: Use opp_table->regulators to verify no regulator case OPP: Remove of_dev_pm_opp_find_required_opp() OPP: Rename and relocate of_genpd_opp_to_performance_state() OPP: Configure all required OPPs OPP: Add dev_pm_opp_{set|put}_genpd_virt_dev() helper PM / Domains: Add genpd_opp_to_performance_state() OPP: Populate OPPs from "required-opps" property OPP: Populate required opp tables from "required-opps" property OPP: Separate out custom OPP handler specific code OPP: Identify and mark genpd OPP tables PM / Domains: Rename genpd virtual devices as virt_dev commit 3a56fe685dc96ee0adb5958787ab9a2e24347e5a Merge: 7edcbbf29006 04dab58a39d4 2849dd8bc72b 108c35a908d4 Author: Rafael J. Wysocki Date: Fri Dec 21 10:06:06 2018 +0100 Merge branches 'pm-cpuidle', 'pm-cpufreq' and 'pm-cpufreq-sched' * pm-cpuidle: cpuidle: Add 'above' and 'below' idle state metrics cpuidle: big.LITTLE: fix refcount leak cpuidle: Add cpuidle.governor= command line parameter cpuidle: poll_state: Disregard disable idle states Documentation: admin-guide: PM: Add cpuidle document * pm-cpufreq: cpufreq: qcom-hw: Add support for QCOM cpufreq HW driver dt-bindings: cpufreq: Introduce QCOM cpufreq firmware bindings cpufreq: nforce2: Remove meaningless return cpufreq: ia64: Remove unused header files cpufreq: imx6q: save one condition block for normal case of nvmem read cpufreq: imx6q: remove unused code cpufreq: pmac64: add of_node_put() cpufreq: powernv: add of_node_put() Documentation: intel_pstate: Clarify coordination of P-State limits cpufreq: intel_pstate: Force HWP min perf before offline cpufreq: s3c24xx: Change to use DEFINE_SHOW_ATTRIBUTE macro * pm-cpufreq-sched: sched/cpufreq: Add the SPDX tags commit 3eb85368460d942005ba305829e279d0fe4767e0 Merge: 4cd9da8ad1c9 5c6a1177826e Author: Rafael J. Wysocki Date: Fri Dec 21 10:04:23 2018 +0100 Merge branch 'acpi-pci' * acpi-pci: ACPI: Make PCI slot detection driver depend on PCI ACPI/IORT: Stub out ACS functions when CONFIG_PCI is not set arm64: select ACPI PCI code only when both features are enabled PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set ACPICA: Remove PCI bits from ACPICA when CONFIG_PCI is unset ACPI: Allow CONFIG_PCI to be unset for reboot ACPI: Move PCI reset to a separate function commit 4cd9da8ad1c98a2c9c2b30cbd5c40faba0047bae Merge: 1027fb0fb94a 1f000e1bfff4 1a2fa02f7489 98cff8b23ed1 f8c6d1402b89 Author: Rafael J. Wysocki Date: Fri Dec 21 10:04:14 2018 +0100 Merge branches 'acpi-tables', 'acpi-soc', 'acpi-apei' and 'acpi-misc' * acpi-tables: ACPI / tables: Add an ifdef around amlcode and dsdt_amlcode ACPI / tables: add DSDT AmlCode new declaration name support ACPI: SPCR: Consider baud rate 0 as preconfigured state * acpi-soc: ACPI / LPSS: Ignore acpi_device_fix_up_power() return value ACPI / APD: Add clock frequency for Hisilicon Hip08 SPI controller * acpi-apei: ACPI/APEI: Clear GHES block_status before panic() ACPI, APEI, EINJ: Change to use DEFINE_SHOW_ATTRIBUTE macro * acpi-misc: ACPI: fix acpi_find_child_device() invocation in acpi_preset_companion() commit 1027fb0fb94aaaaa36ad58193fc61c36efaced85 Merge: 28586a51eea6 3b15e830ba59 Author: Rafael J. Wysocki Date: Fri Dec 21 10:03:16 2018 +0100 Merge branch 'acpica' * acpica: ACPICA: Update version to 20181213 ACPICA: change coding style to match ACPICA, no functional change ACPICA: Debug output: Add option to display method/object evaluation ACPICA: disassembler: disassemble OEMx tables as AML ACPICA: Add "Windows 2018.2" string in the _OSI support ACPICA: Expressions in package elements are not supported ACPICA: Update buffer-to-string conversions ACPICA: add comments, no functional change ACPICA: Remove defines that use deprecated flag ACPICA: Add "Windows 2018" string in the _OSI support ACPICA: Update version to 20181031 ACPICA: iASL: Enhance error detection ACPICA: iASL: adding definition and disassembly for TPM2 revision 3 ACPICA: Use %d for signed int print formatting instead of %u ACPICA: Debugger: refactor to fix unused variable warning commit 0b9f28fed3f70ff9a0380fe308739dd72a30a6f6 Author: Nicolas Saenz Julienne Date: Fri Dec 21 00:47:40 2018 -0800 Input: add official Raspberry Pi's touchscreen driver Add's support to Raspberry Pi's 7" Touch device. Instead of using a conventional bus all information is copied into a memory mapped area by RPi's firmware. Based on the driver found in RPi's kernel repository. Signed-off-by: Nicolas Saenz Julienne Reviewed-by: Rob Herring Acked-by: Eric Anholt Signed-off-by: Dmitry Torokhov .../input/touchscreen/raspberrypi,firmware-ts.txt | 26 +++ drivers/input/touchscreen/Kconfig | 12 ++ drivers/input/touchscreen/Makefile | 1 + drivers/input/touchscreen/raspberrypi-ts.c | 227 +++++++++++++++++++++ 4 files changed, 266 insertions(+) commit 4d8f727b83bcd6702c2d210330872c9122d2d360 Author: Dan Carpenter Date: Fri Dec 21 00:38:30 2018 -0800 Input: nomadik-ske-keypad - fix a loop timeout test The loop exits with "timeout" set to -1 not to 0. Fixes: 1158f0f16224 ("Input: add support for Nomadik SKE keypad controller") Signed-off-by: Dan Carpenter Signed-off-by: Dmitry Torokhov drivers/input/keyboard/nomadik-ske-keypad.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1e12a521d6917004f8b95a3b5864b92edc2694c8 Merge: eafb27fa5283 8d503f206c33 Author: Greg Kroah-Hartman Date: Fri Dec 21 08:36:54 2018 +0100 Merge tag 'usb-serial-4.21-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-next Johan writes: USB-serial updates for 4.21-rc1 Here are the USB-serial updates for 4.21-rc1, including: - support for mos7840 3-port devices - improved ftdi baud-rate divisor calculations - support for a new class of f81534 devices Included are also various clean ups and some new pl2303 device ids. All have been in linux-next with no reported issues. Signed-off-by: Johan Hovold * tag 'usb-serial-4.21-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: pl2303: add ids for Hewlett-Packard HP POS pole displays USB: serial: mos7840: remove set but not used variables 'number, serial' USB: serial: mos7840: add a product ID for the new product USB: serial: mos7840: clean up register handling USB: serial: ftdi_sio: use rounding when calculating baud rate divisors USB: serial: f81534: fix reading old/new IC config USB: serial: mos7840: remove set but not used variables 'st, data1, iflag' USB: serial: quatech2: remove set but not used variable 'port_priv' commit fbc4904c287778ddb74bf6060ac9dec51992fc53 Author: Christian Brauner Date: Thu Dec 20 11:40:57 2018 +0100 MAINTAINERS: add another Android binder maintainer As briefly discussed with Greg and Todd, add Christian as maintainer for binder{fs}. Signed-off-by: Christian Brauner Acked-By: Martijn Coenen Signed-off-by: Greg Kroah-Hartman MAINTAINERS | 1 + 1 file changed, 1 insertion(+) commit 6277053afa34253eb8d8d147388e4426e615bae4 Author: Tariq Toukan Date: Tue Nov 20 11:50:30 2018 +0200 net/mlx5e: XDP, Add user control for XDP TX MPWQE feature Add ethtool private flag 'xdp_tx_mpwqe' to control the feature from userspace. Feature is set ON by default, if supported. Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 + .../net/ethernet/mellanox/mlx5/core/en_ethtool.c | 28 ++++++++++++++++++++++ drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 6 ++++- 3 files changed, 34 insertions(+), 1 deletion(-) commit 5e0d2eef771ee78b092bf93d040eac02a0965fea Author: Tariq Toukan Date: Wed Nov 21 14:08:06 2018 +0200 net/mlx5e: XDP, Support Enhanced Multi-Packet TX WQE Add support for the HW feature of multi-packet WQE in XDP xmit flow. The conventional TX descriptor (WQE, Work Queue Element) serves a single packet. Our HW has support for multi-packet WQE (MPWQE) in which a single descriptor serves multiple TX packets. This reduces both the PCI overhead and the CPU cycles wasted on writing them. In this patch we add support for the HW feature, which is supported starting from ConnectX-5. Performance: Tested packet rate for UDP 64Byte multi-stream over ConnectX-5 NICs. CPU: Intel(R) Xeon(R) CPU E5-2680 v3 @ 2.50GHz XDP_TX: We see a huge gain on single port ConnectX-5, and reach the 100 Mpps milestone. * Single-port HCA: Before: 70 Mpps After: 100 Mpps (+42.8%) * Dual-port HCA: Before: 51.7 Mpps After: 57.3 Mpps (+10.8%) * In both cases we tested traffic on one port and for now On Dual-port HCAs we see only small gain, we are working to overcome this bottleneck, but for the moment only with experimental firmware on dual port HCAs we can reach the wanted numbers as seen on Single-port HCAs. XDP_REDIRECT: Redirect from (A) ConnectX-5 to (B) ConnectX-5. Due to a setup limitation, (A) and (B) are on different NUMA nodes, so absolute performance numbers are not optimal. Note: Below is the transmit rate of (B), not the redirect rate of (A) which is in some cases higher. * (B) is single-port: Before: 77 Mpps After: 90 Mpps (+16.8%) * (B) is dual-port: Before: 61 Mpps After: 72 Mpps (+18%) Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en.h | 12 +++ drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c | 112 +++++++++++++++++++++- drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h | 29 +++++- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 47 +++++---- include/linux/mlx5/device.h | 1 + 5 files changed, 174 insertions(+), 27 deletions(-) commit 1feeab80078078186b5080fe15c51a5cce724a0e Author: Tariq Toukan Date: Sun Oct 14 14:46:57 2018 +0300 net/mlx5e: XDP, Add array for WQE info descriptors Each xdp_wqe_info instance describes the number of data-segments and WQEBBs of the WQE. This is useful for a downstream patch that adds support for Multi-Packet TX WQE feature. Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en.h | 6 +++ drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c | 58 +++++++++++++++-------- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 11 +++++ 3 files changed, 54 insertions(+), 21 deletions(-) commit fea28dd6a281045e18c1412ab5bba54436c11088 Author: Tariq Toukan Date: Sun Oct 14 14:37:48 2018 +0300 net/mlx5e: XDP, Maintain a FIFO structure for xdp_info instances This provides infrastructure to have multiple xdp_info instances for the same consumer index. Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en.h | 13 +++++++-- drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c | 32 +++++++++++------------ drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h | 15 +++++++++++ drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 29 +++++++++++++++----- 4 files changed, 65 insertions(+), 24 deletions(-) commit b8180392edd97cd5bfdf12270315a72fe601cf7e Author: Tariq Toukan Date: Wed Nov 21 14:06:02 2018 +0200 net/mlx5e: XDP, Replace boolean doorbell indication with segment pointer Instead of calculating the control segment to be used upon an XDP xmit doorbell, save it in SQ structure. Nullify when no pending doorbell. Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en.h | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c | 14 ++++---------- drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h | 11 ++++------- 3 files changed, 9 insertions(+), 18 deletions(-) commit db02a308cd724fd37416012c8077d3e0ea2bf386 Author: Tariq Toukan Date: Thu Nov 15 11:48:41 2018 +0200 net/mlx5e: XDP, Warn upon polling an error CQE Do not ignore the CQE opcode. This helps expose issues and debug them. Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c | 5 +++++ 1 file changed, 5 insertions(+) commit feb2ff9d74f76a174e284255b7e537b6c090c13c Author: Tariq Toukan Date: Wed Nov 21 14:04:45 2018 +0200 net/mlx5e: XDP, Change the XDP SQ redirect indication Do not maintain an SQ state bit to indicate whether an XDP SQ serves redirect operations. Instead, rely on the fact that such an XDP SQ doesn't reside in an RQ instance, while the others do. This info is not known to the XDP SQ functions themselves, and they rely on their callers to distinguish between the cases. Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 - drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c | 14 ++++---------- drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h | 4 ++-- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 12 +++++------- drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c | 13 +++++++------ 5 files changed, 18 insertions(+), 26 deletions(-) commit 4fb2f516186ea25dea326f97880431e14a5b9e9d Author: Tariq Toukan Date: Wed Nov 21 13:56:17 2018 +0200 net/mlx5e: XDP, Precede XDP-related operations in RQ poll by a loaded program check At the end of the RQ polling loop, some XDP-related operations might be required. Before checking them one by one, check if an XDP program is even loaded. Combine all the checks and operations in a single function in xdp files. This saves unnecessary checks for non-XDP flows. Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c | 15 +++++++++++++++ drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 12 ++---------- 3 files changed, 18 insertions(+), 11 deletions(-) commit e05b8d4fc30a68540e5c0eef3e2bacd1f27b8172 Author: Tariq Toukan Date: Thu Nov 15 11:48:41 2018 +0200 net/mlx5e: TX, Print opcode in error CQE warning The opcode indicates about the error reason. Printing it helps in debug. Signed-off-by: Tariq Toukan Reviewed-by: Eran Ben Elisha Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 7f92891778dff62303c070ac81de7b7d80de331a Author: Alexey Kardashevskiy Date: Thu Dec 20 12:10:36 2018 +1100 vfio_pci: Add NVIDIA GV100GL [Tesla V100 SXM2] subdriver POWER9 Witherspoon machines come with 4 or 6 V100 GPUs which are not pluggable PCIe devices but still have PCIe links which are used for config space and MMIO. In addition to that the GPUs have 6 NVLinks which are connected to other GPUs and the POWER9 CPU. POWER9 chips have a special unit on a die called an NPU which is an NVLink2 host bus adapter with p2p connections to 2 to 3 GPUs, 3 or 2 NVLinks to each. These systems also support ATS (address translation services) which is a part of the NVLink2 protocol. Such GPUs also share on-board RAM (16GB or 32GB) to the system via the same NVLink2 so a CPU has cache-coherent access to a GPU RAM. This exports GPU RAM to the userspace as a new VFIO device region. This preregisters the new memory as device memory as it might be used for DMA. This inserts pfns from the fault handler as the GPU memory is not onlined until the vendor driver is loaded and trained the NVLinks so doing this earlier causes low level errors which we fence in the firmware so it does not hurt the host system but still better be avoided; for the same reason this does not map GPU RAM into the host kernel (usual thing for emulated access otherwise). This exports an ATSD (Address Translation Shootdown) register of NPU which allows TLB invalidations inside GPU for an operating system. The register conveniently occupies a single 64k page. It is also presented to the userspace as a new VFIO device region. One NPU has 8 ATSD registers, each of them can be used for TLB invalidation in a GPU linked to this NPU. This allocates one ATSD register per an NVLink bridge allowing passing up to 6 registers. Due to the host firmware bug (just recently fixed), only 1 ATSD register per NPU was actually advertised to the host system so this passes that alone register via the first NVLink bridge device in the group which is still enough as QEMU collects them all back and presents to the guest via vPHB to mimic the emulated NPU PHB on the host. In order to provide the userspace with the information about GPU-to-NVLink connections, this exports an additional capability called "tgt" (which is an abbreviated host system bus address). The "tgt" property tells the GPU its own system address and allows the guest driver to conglomerate the routing information so each GPU knows how to get directly to the other GPUs. For ATS to work, the nest MMU (an NVIDIA block in a P9 CPU) needs to know LPID (a logical partition ID or a KVM guest hardware ID in other words) and PID (a memory context ID of a userspace process, not to be confused with a linux pid). This assigns a GPU to LPID in the NPU and this is why this adds a listener for KVM on an IOMMU group. A PID comes via NVLink from a GPU and NPU uses a PID wildcard to pass it through. This requires coherent memory and ATSD to be available on the host as the GPU vendor only supports configurations with both features enabled and other configurations are known not to work. Because of this and because of the ways the features are advertised to the host system (which is a device tree with very platform specific properties), this requires enabled POWERNV platform. The V100 GPUs do not advertise any of these capabilities via the config space and there are more than just one device ID so this relies on the platform to tell whether these GPUs have special abilities such as NVLinks. Signed-off-by: Alexey Kardashevskiy Acked-by: Alex Williamson Signed-off-by: Michael Ellerman drivers/vfio/pci/Kconfig | 6 + drivers/vfio/pci/Makefile | 1 + drivers/vfio/pci/trace.h | 102 ++++++++ drivers/vfio/pci/vfio_pci.c | 27 +- drivers/vfio/pci/vfio_pci_nvlink2.c | 482 ++++++++++++++++++++++++++++++++++++ drivers/vfio/pci/vfio_pci_private.h | 14 ++ include/uapi/linux/vfio.h | 42 ++++ 7 files changed, 672 insertions(+), 2 deletions(-) commit c2c0f1cde0ef56ba5d6f553db73f51e753d7550a Author: Alexey Kardashevskiy Date: Wed Dec 19 19:52:31 2018 +1100 vfio_pci: Allow regions to add own capabilities VFIO regions already support region capabilities with a limited set of fields. However the subdriver might have to report to the userspace additional bits. This adds an add_capability() hook to vfio_pci_regops. Signed-off-by: Alexey Kardashevskiy Acked-by: Alex Williamson Signed-off-by: Michael Ellerman drivers/vfio/pci/vfio_pci.c | 6 ++++++ drivers/vfio/pci/vfio_pci_private.h | 3 +++ 2 files changed, 9 insertions(+) commit a15b1883fee11e07e5db7f003a863cc419647e79 Author: Alexey Kardashevskiy Date: Wed Dec 19 19:52:30 2018 +1100 vfio_pci: Allow mapping extra regions So far we only allowed mapping of MMIO BARs to the userspace. However there are GPUs with on-board coherent RAM accessible via side channels which we also want to map to the userspace. The first client for this is NVIDIA V100 GPU with NVLink2 direct links to a POWER9 NPU-enabled CPU; such GPUs have 16GB RAM which is coherently mapped to the system address space, we are going to export these as an extra PCI region. We already support extra PCI regions and this adds support for mapping them to the userspace. Signed-off-by: Alexey Kardashevskiy Reviewed-by: David Gibson Acked-by: Alex Williamson Signed-off-by: Michael Ellerman drivers/vfio/pci/vfio_pci.c | 9 +++++++++ drivers/vfio/pci/vfio_pci_private.h | 3 +++ 2 files changed, 12 insertions(+) commit 58629c0dc34904d135af944d120eb23165ec3b61 Author: Alexey Kardashevskiy Date: Wed Dec 19 19:52:29 2018 +1100 powerpc/powernv/npu: Fault user page into the hypervisor's pagetable When a page fault happens in a GPU, the GPU signals the OS and the GPU driver calls the fault handler which populated a page table; this allows the GPU to complete an ATS request. On the bare metal get_user_pages() is enough as it adds a pte to the kernel page table but under KVM the partition scope tree does not get updated so ATS will still fail. This reads a byte from an effective address which causes HV storage interrupt and KVM updates the partition scope tree. Signed-off-by: Alexey Kardashevskiy Signed-off-by: Michael Ellerman arch/powerpc/platforms/powernv/npu-dma.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) commit 135ef954051b102870a8d47a8eb822af1f1b1ec1 Author: Alexey Kardashevskiy Date: Wed Dec 19 19:52:28 2018 +1100 powerpc/powernv/npu: Check mmio_atsd array bounds when populating A broken device tree might contain more than 8 values and introduce hard to debug memory corruption bug. This adds the boundary check. Signed-off-by: Alexey Kardashevskiy Signed-off-by: Michael Ellerman arch/powerpc/platforms/powernv/npu-dma.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 1b785611e1191751e1fb44ac3e89a0bd68ec7971 Author: Alexey Kardashevskiy Date: Wed Dec 19 19:52:27 2018 +1100 powerpc/powernv/npu: Add release_ownership hook In order to make ATS work and translate addresses for arbitrary LPID and PID, we need to program an NPU with LPID and allow PID wildcard matching with a specific MSR mask. This implements a helper to assign a GPU to LPAR and program the NPU with a wildcard for PID and a helper to do clean-up. The helper takes MSR (only DR/HV/PR/SF bits are allowed) to program them into NPU2 for ATS checkout requests support. This exports pnv_npu2_unmap_lpar_dev() as following patches will use it from the VFIO driver. Signed-off-by: Alexey Kardashevskiy Signed-off-by: Michael Ellerman arch/powerpc/platforms/powernv/npu-dma.c | 51 ++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) commit 0bd971676e68f14427406f4dbbdeb9586e4f24b3 Author: Alexey Kardashevskiy Date: Wed Dec 19 19:52:26 2018 +1100 powerpc/powernv/npu: Add compound IOMMU groups At the moment the powernv platform registers an IOMMU group for each PE. There is an exception though: an NVLink bridge which is attached to the corresponding GPU's IOMMU group making it a master. Now we have POWER9 systems with GPUs connected to each other directly bypassing PCI. At the moment we do not control state of these links so we have to put such interconnected GPUs to one IOMMU group which means that the old scheme with one GPU as a master won't work - there will be up to 3 GPUs in such group. This introduces a npu_comp struct which represents a compound IOMMU group made of multiple PEs - PCI PEs (for GPUs) and NPU PEs (for NVLink bridges). This converts the existing NVLink1 code to use the new scheme. >From now on, each PE must have a valid iommu_table_group_ops which will either be called directly (for a single PE group) or indirectly from a compound group handlers. This moves IOMMU group registration for NVLink-connected GPUs to npu-dma.c. For POWER8, this stores a new compound group pointer in the PE (so a GPU is still a master); for POWER9 the new group pointer is stored in an NPU (which is allocated per a PCI host controller). Signed-off-by: Alexey Kardashevskiy [mpe: Initialise npdev to NULL in pnv_try_setup_npu_table_group()] Signed-off-by: Michael Ellerman arch/powerpc/include/asm/pci.h | 1 + arch/powerpc/platforms/powernv/npu-dma.c | 291 +++++++++++++++++++++++++++--- arch/powerpc/platforms/powernv/pci-ioda.c | 159 +++++----------- arch/powerpc/platforms/powernv/pci.h | 7 + 4 files changed, 322 insertions(+), 136 deletions(-) commit 83fb8ccf975138283c7f6d3685d9c5e2292381dd Author: Alexey Kardashevskiy Date: Wed Dec 19 19:52:25 2018 +1100 powerpc/powernv/npu: Convert NPU IOMMU helpers to iommu_table_group_ops At the moment NPU IOMMU is manipulated directly from the IODA2 PCI PE code; PCI PE acts as a master to NPU PE. Soon we will have compound IOMMU groups with several PEs from several different PHB (such as interconnected GPUs and NPUs) so there will be no single master but a one big IOMMU group. This makes a first step and converts an NPU PE with a set of extern function to a table group. This should cause no behavioral change. Note that pnv_npu_release_ownership() has never been implemented. Signed-off-by: Alexey Kardashevskiy Reviewed-by: David Gibson Signed-off-by: Michael Ellerman arch/powerpc/platforms/powernv/npu-dma.c | 34 ++++++++++++++++++++++++------- arch/powerpc/platforms/powernv/pci-ioda.c | 10 ++++++--- arch/powerpc/platforms/powernv/pci.h | 5 ----- 3 files changed, 34 insertions(+), 15 deletions(-) commit b04149c2dd85ac2d7839ef859a82cc1871fcf6ce Author: Alexey Kardashevskiy Date: Wed Dec 19 19:52:24 2018 +1100 powerpc/powernv/npu: Move single TVE handling to NPU PE Normal PCI PEs have 2 TVEs, one per a DMA window; however NPU PE has only one which points to one of two tables of the corresponding PCI PE. So whenever a new DMA window is programmed to PEs, the NPU PE needs to release old table in order to use the new one. Commit d41ce7b1bcc3e ("powerpc/powernv/npu: Do not try invalidating 32bit table when 64bit table is enabled") did just that but in pci-ioda.c while it actually belongs to npu-dma.c. This moves the single TVE handling to npu-dma.c. This does not implement restoring though as it is highly unlikely that we can set the table to PCI PE and cannot to NPU PE and if that fails, we could only set 32bit table to NPU PE and this configuration is not really supported or wanted. Signed-off-by: Alexey Kardashevskiy Signed-off-by: Michael Ellerman arch/powerpc/platforms/powernv/npu-dma.c | 8 ++++++++ arch/powerpc/platforms/powernv/pci-ioda.c | 27 +++------------------------ 2 files changed, 11 insertions(+), 24 deletions(-) commit 847e6563aa8c6e335397b821b215ac4313580638 Author: Alexey Kardashevskiy Date: Wed Dec 19 19:52:23 2018 +1100 powerpc/powernv: Reference iommu_table while it is linked to a group The iommu_table pointer stored in iommu_table_group may get stale by accident, this adds referencing and removes a redundant comment about this. Signed-off-by: Alexey Kardashevskiy Reviewed-by: David Gibson Signed-off-by: Michael Ellerman arch/powerpc/platforms/powernv/pci-ioda-tce.c | 3 ++- arch/powerpc/platforms/powernv/pci-ioda.c | 4 ---- 2 files changed, 2 insertions(+), 5 deletions(-) commit 5eada8a3f087df74af1c2797770a3e2249374fe1 Author: Alexey Kardashevskiy Date: Wed Dec 19 19:52:22 2018 +1100 powerpc/iommu_api: Move IOMMU groups setup to a single place Registering new IOMMU groups and adding devices to them are separated in code and the latter is dug in the DMA setup code which it does not really belong to. This moved IOMMU groups setup to a separate helper which registers a group and adds devices as before. This does not make a difference as IOMMU groups are not used anyway; the only dependency here is that iommu_add_device() requires a valid pointer to an iommu_table (set by set_iommu_table_base()). To keep the old behaviour, this does not add new IOMMU groups for PEs with no DMA weight and also skips NVLink bridges which do not have pci_controller_ops::setup_bridge (the normal way of adding PEs). Signed-off-by: Alexey Kardashevskiy Reviewed-by: David Gibson Signed-off-by: Michael Ellerman arch/powerpc/platforms/powernv/pci-ioda.c | 82 +++++++++++++++++++++++++------ 1 file changed, 68 insertions(+), 14 deletions(-) commit c4e9d3c1e65aac3f65995e9cb1cede7330c594dc Author: Alexey Kardashevskiy Date: Wed Dec 19 19:52:21 2018 +1100 powerpc/powernv/pseries: Rework device adding to IOMMU groups The powernv platform registers IOMMU groups and adds devices to them from the pci_controller_ops::setup_bridge() hook except one case when virtual functions (SRIOV VFs) are added from a bus notifier. The pseries platform registers IOMMU groups from the pci_controller_ops::dma_bus_setup() hook and adds devices from the pci_controller_ops::dma_dev_setup() hook. The very same bus notifier used for powernv does not add devices for pseries though as __of_scan_bus() adds devices first, then it does the bus/dev DMA setup. Both platforms use iommu_add_device() which takes a device and expects it to have a valid IOMMU table struct with an iommu_table_group pointer which in turn points the iommu_group struct (which represents an IOMMU group). Although the helper seems easy to use, it relies on some pre-existing device configuration and associated data structures which it does not really need. This simplifies iommu_add_device() to take the table_group pointer directly. Pseries already has a table_group pointer handy and the bus notified is not used anyway. For powernv, this copies the existing bus notifier, makes it work for powernv only which means an easy way of getting to the table_group pointer. This was tested on VFs but should also support physical PCI hotplug. Since iommu_add_device() receives the table_group pointer directly, pseries does not do TCE cache invalidation (the hypervisor does) nor allow multiple groups per a VFIO container (in other words sharing an IOMMU table between partitionable endpoints), this removes iommu_table_group_link from pseries. Signed-off-by: Alexey Kardashevskiy Reviewed-by: David Gibson Signed-off-by: Michael Ellerman arch/powerpc/include/asm/iommu.h | 12 +++---- arch/powerpc/kernel/iommu.c | 58 ++----------------------------- arch/powerpc/platforms/powernv/pci-ioda.c | 10 +----- arch/powerpc/platforms/powernv/pci.c | 43 ++++++++++++++++++++++- arch/powerpc/platforms/pseries/iommu.c | 46 ++++++++++++------------ 5 files changed, 74 insertions(+), 95 deletions(-) commit c409c6316166993163e29312aeaaf1c0c300a04a Author: Alexey Kardashevskiy Date: Wed Dec 19 19:52:20 2018 +1100 powerpc/pseries: Remove IOMMU API support for non-LPAR systems The pci_dma_bus_setup_pSeries and pci_dma_dev_setup_pSeries hooks are registered for the pseries platform which does not have FW_FEATURE_LPAR; these would be pre-powernv platforms which we never supported PCI pass through for anyway so remove it. Signed-off-by: Alexey Kardashevskiy Reviewed-by: David Gibson Signed-off-by: Michael Ellerman arch/powerpc/platforms/pseries/iommu.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) commit 3be2df00e299821ad255498ac4411906a8d59cfa Author: Alexey Kardashevskiy Date: Wed Dec 19 19:52:19 2018 +1100 powerpc/pseries/npu: Enable platform support We already changed NPU API for GPUs to not to call OPAL and the remaining bit is initializing NPU structures. This searches for POWER9 NVLinks attached to any device on a PHB and initializes an NPU structure if any found. Signed-off-by: Alexey Kardashevskiy Signed-off-by: Michael Ellerman arch/powerpc/platforms/pseries/pci.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) commit 68c0449ea16d775e762b532afddb4d6a5f161877 Author: Alexey Kardashevskiy Date: Wed Dec 19 19:52:18 2018 +1100 powerpc/pseries/iommu: Use memory@ nodes in max RAM address calculation We might have memory@ nodes with "linux,usable-memory" set to zero (for example, to replicate powernv's behaviour for GPU coherent memory) which means that the memory needs an extra initialization but since it can be used afterwards, the pseries platform will try mapping it for DMA so the DMA window needs to cover those memory regions too; if the window cannot cover new memory regions, the memory onlining fails. This walks through the memory nodes to find the highest RAM address to let a huge DMA window cover that too in case this memory gets onlined later. Signed-off-by: Alexey Kardashevskiy Signed-off-by: Michael Ellerman arch/powerpc/platforms/pseries/iommu.c | 33 ++++++++++++++++++++++++++++++++- 1 file changed, 32 insertions(+), 1 deletion(-) commit 0e759bd75285e96fbb4013d1303b08fdb8ba58e1 Author: Alexey Kardashevskiy Date: Wed Dec 19 19:52:17 2018 +1100 powerpc/powernv/npu: Move OPAL calls away from context manipulation When introduced, the NPU context init/destroy helpers called OPAL which enabled/disabled PID (a userspace memory context ID) filtering in an NPU per a GPU; this was a requirement for P9 DD1.0. However newer chip revision added a PID wildcard support so there is no more need to call OPAL every time a new context is initialized. Also, since the PID wildcard support was added, skiboot does not clear wildcard entries in the NPU so these remain in the hardware till the system reboot. This moves LPID and wildcard programming to the PE setup code which executes once during the booting process so NPU2 context init/destroy won't need to do additional configuration. This replaces the check for FW_FEATURE_OPAL with a check for npu!=NULL as this is the way to tell if the NPU support is present and configured. This moves pnv_npu2_init() declaration as pseries should be able to use it. This keeps pnv_npu2_map_lpar() in powernv as pseries is not allowed to call that. This exports pnv_npu2_map_lpar_dev() as following patches will use it from the VFIO driver. While at it, replace redundant list_for_each_entry_safe() with a simpler list_for_each_entry(). Signed-off-by: Alexey Kardashevskiy Signed-off-by: Michael Ellerman arch/powerpc/include/asm/pci.h | 3 + arch/powerpc/platforms/powernv/npu-dma.c | 111 ++++++++++++++++-------------- arch/powerpc/platforms/powernv/pci-ioda.c | 15 +++- arch/powerpc/platforms/powernv/pci.h | 2 +- 4 files changed, 77 insertions(+), 54 deletions(-) commit 46a1449d9e39478a35d35d9d9025776f6cee24fb Author: Alexey Kardashevskiy Date: Wed Dec 19 19:52:16 2018 +1100 powerpc/powernv: Move npu struct from pnv_phb to pci_controller The powernv PCI code stores NPU data in the pnv_phb struct. The latter is referenced by pci_controller::private_data. We are going to have NPU2 support in the pseries platform as well but it does not store any private_data in in the pci_controller struct; and even if it did, it would be a different data structure. This makes npu a pointer and stores it one level higher in the pci_controller struct. Signed-off-by: Alexey Kardashevskiy Signed-off-by: Michael Ellerman arch/powerpc/include/asm/pci-bridge.h | 1 + arch/powerpc/platforms/powernv/npu-dma.c | 74 +++++++++++++++++++++++-------- arch/powerpc/platforms/powernv/pci-ioda.c | 2 +- arch/powerpc/platforms/powernv/pci.h | 16 ------- 4 files changed, 58 insertions(+), 35 deletions(-) commit c10c21efa4bccab486c2e6a047c13dfa6cf7426c Author: Alexey Kardashevskiy Date: Wed Dec 19 19:52:15 2018 +1100 powerpc/vfio/iommu/kvm: Do not pin device memory This new memory does not have page structs as it is not plugged to the host so gup() will fail anyway. This adds 2 helpers: - mm_iommu_newdev() to preregister the "memory device" memory so the rest of API can still be used; - mm_iommu_is_devmem() to know if the physical address is one of thise new regions which we must avoid unpinning of. This adds @mm to tce_page_is_contained() and iommu_tce_xchg() to test if the memory is device memory to avoid pfn_to_page(). This adds a check for device memory in mm_iommu_ua_mark_dirty_rm() which does delayed pages dirtying. Signed-off-by: Alexey Kardashevskiy Reviewed-by: Paul Mackerras Signed-off-by: Michael Ellerman arch/powerpc/include/asm/iommu.h | 5 +- arch/powerpc/include/asm/mmu_context.h | 11 ++++ arch/powerpc/kernel/iommu.c | 11 ++-- arch/powerpc/kvm/book3s_64_vio.c | 18 ++++--- arch/powerpc/mm/mmu_context_iommu.c | 93 ++++++++++++++++++++++++++++++---- drivers/vfio/vfio_iommu_spapr_tce.c | 29 +++++++---- 6 files changed, 135 insertions(+), 32 deletions(-) commit e0bf78b0f9594d47dfa7e364a9071442fc1d9445 Author: Alexey Kardashevskiy Date: Wed Dec 19 19:52:14 2018 +1100 powerpc/mm/iommu/vfio_spapr_tce: Change mm_iommu_get to reference a region Normally mm_iommu_get() should add a reference and mm_iommu_put() should remove it. However historically mm_iommu_find() does the referencing and mm_iommu_get() is doing allocation and referencing. We are going to add another helper to preregister device memory so instead of having mm_iommu_new() (which pre-registers the normal memory and references the region), we need separate helpers for pre-registering and referencing. This renames: - mm_iommu_get to mm_iommu_new; - mm_iommu_find to mm_iommu_get. This changes mm_iommu_get() to reference the region so the name now reflects what it does. This removes the check for exact match from mm_iommu_new() as we want it to fail on existing regions; mm_iommu_get() should be used instead. Signed-off-by: Alexey Kardashevskiy Reviewed-by: David Gibson Signed-off-by: Michael Ellerman arch/powerpc/include/asm/mmu_context.h | 4 ++-- arch/powerpc/mm/mmu_context_iommu.c | 19 +++++++++--------- drivers/vfio/vfio_iommu_spapr_tce.c | 35 ++++++++++++++++++++++------------ 3 files changed, 34 insertions(+), 24 deletions(-) commit ab7032e793f9ad799ca2692046fba5baed6d2a86 Author: Alexey Kardashevskiy Date: Wed Dec 19 19:52:13 2018 +1100 powerpc/ioda/npu: Call skiboot's hot reset hook when disabling NPU2 The skiboot firmware has a hot reset handler which fences the NVIDIA V100 GPU RAM on Witherspoons and makes accesses no-op instead of throwing HMIs: https://github.com/open-power/skiboot/commit/fca2b2b839a67 Now we are going to pass V100 via VFIO which most certainly involves KVM guests which are often terminated without getting a chance to offline GPU RAM so we end up with a running machine with misconfigured memory. Accessing this memory produces hardware management interrupts (HMI) which bring the host down. To suppress HMIs, this wires up this hot reset hook to vfio_pci_disable() via pci_disable_device() which switches NPU2 to a safe mode and prevents HMIs. Signed-off-by: Alexey Kardashevskiy Acked-by: Alistair Popple Reviewed-by: David Gibson Signed-off-by: Michael Ellerman arch/powerpc/platforms/powernv/pci-ioda.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit ffca395b11c4a5a6df6d6345f794b0e3d578e2d0 Author: Christophe Leroy Date: Wed Nov 28 09:27:04 2018 +0000 powerpc/mm: Fix reporting of kernel execute faults on the 8xx On the 8xx, no-execute is set via PPP bits in the PTE. Therefore a no-exec fault generates DSISR_PROTFAULT error bits, not DSISR_NOEXEC_OR_G. This patch adds DSISR_PROTFAULT in the test mask. Fixes: d3ca587404b3 ("powerpc/mm: Fix reporting of kernel execute faults") Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman arch/powerpc/mm/fault.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 623d154305c06c83924b8fd2afbfdeba3b396fb7 Author: Jason Gunthorpe Date: Thu Dec 20 16:39:26 2018 -0700 IB/mlx5: Fix wrong error unwind The destroy_workqueue on error unwind is missing, and the code jumps to the wrong exit label. Fixes: 813e90b1aeaa ("IB/mlx5: Add advise_mr() support") Acked-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/mlx5/main.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit e7c4d8e6045171896d763c551b90c672fb5ab42b Author: YueHaibing Date: Fri Dec 21 02:05:57 2018 +0000 IB/mlx4: Remove set but not used variable 'pd' Fixes gcc '-Wunused-but-set-variable' warning: drivers/infiniband/hw/mlx4/qp.c: In function '_mlx4_ib_destroy_qp': drivers/infiniband/hw/mlx4/qp.c:1612:22: warning: variable 'pd' set but not used [-Wunused-but-set-variable] Fixes: e00b64f7c54c ("RDMA: Cleanup undesired pd->uobject usage") Signed-off-by: YueHaibing Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/mlx4/qp.c | 3 --- 1 file changed, 3 deletions(-) commit ab66dcc76d6ab8fae9d69d149ae38c42605e7fc5 Author: Firoz Khan Date: Mon Dec 17 16:10:36 2018 +0530 powerpc: generate uapi header and system call table files System call table generation script must be run to gener- ate unistd_32/64.h and syscall_table_32/64/c32/spu.h files. This patch will have changes which will invokes the script. This patch will generate unistd_32/64.h and syscall_table- _32/64/c32/spu.h files by the syscall table generation script invoked by parisc/Makefile and the generated files against the removed files must be identical. The generated uapi header file will be included in uapi/- asm/unistd.h and generated system call table header file will be included by kernel/systbl.S file. Signed-off-by: Firoz Khan Signed-off-by: Michael Ellerman arch/powerpc/Makefile | 3 + arch/powerpc/include/asm/Kbuild | 4 + arch/powerpc/include/asm/systbl.h | 395 ---------------------------- arch/powerpc/include/uapi/asm/Kbuild | 2 + arch/powerpc/include/uapi/asm/unistd.h | 392 +-------------------------- arch/powerpc/kernel/Makefile | 10 - arch/powerpc/kernel/systbl.S | 52 +--- arch/powerpc/kernel/systbl_chk.c | 60 ----- arch/powerpc/platforms/cell/spu_callbacks.c | 17 +- 9 files changed, 26 insertions(+), 909 deletions(-) commit aff8503932004d10eec4d550ec3527117fe18724 Author: Firoz Khan Date: Mon Dec 17 16:10:34 2018 +0530 powerpc: add system call table generation support The system call tables are in different format in all architecture and it will be difficult to manually add or modify the system calls in the respective files. To make it easy by keeping a script and which will generate the uapi header and syscall table file. This change will also help to unify the implementation across all architectures. The system call table generation script is added in syscalls directory which contain the script to generate both uapi header file and system call table files. The syscall.tbl file will be the input for the scripts. syscall.tbl contains the list of available system calls along with system call number and corresponding entry point. Add a new system call in this architecture will be possible by adding new entry in the syscall.tbl file. Adding a new table entry consisting of: - System call number. - ABI. - System call name. - Entry point name. - Compat entry name, if required. syscallhdr.sh and syscalltbl.sh will generate uapi header- unistd_32/64.h and syscall_table_32/64/c32/spu.h files respectively. File syscall_table_32/64/c32/spu.h is incl- uded by syscall.S - the real system call table. Both *.sh files will parse the content syscall.tbl to generate the header and table files. ARM, s390 and x86 architecuture does have similar support. I leverage their implementation to come up with a generic solution. Signed-off-by: Firoz Khan Signed-off-by: Michael Ellerman arch/powerpc/kernel/syscalls/Makefile | 63 +++++ arch/powerpc/kernel/syscalls/syscall.tbl | 427 +++++++++++++++++++++++++++++ arch/powerpc/kernel/syscalls/syscallhdr.sh | 37 +++ arch/powerpc/kernel/syscalls/syscalltbl.sh | 36 +++ 4 files changed, 563 insertions(+) commit fbf508da744053ff289777d6dd6e11ca8682be49 Author: Firoz Khan Date: Mon Dec 17 16:10:35 2018 +0530 powerpc: split compat syscall table out from native table PowerPC uses a syscall table with native and compat calls interleaved, which is a slightly simpler way to define two matching tables. As we move to having the tables generated, that advantage is no longer important, but the interleaved table gets in the way of using the same scripts as on the other archit- ectures. Split out a new compat_sys_call_table symbol that contains all the compat calls, and leave the main table for the nat- ive calls, to more closely match the method we use every- where else. Suggested-by: Arnd Bergmann Signed-off-by: Firoz Khan Signed-off-by: Michael Ellerman arch/powerpc/include/asm/syscall.h | 3 +-- arch/powerpc/kernel/entry_64.S | 7 +++++-- arch/powerpc/kernel/systbl.S | 35 ++++++++++++++++++++++++++++------- arch/powerpc/kernel/vdso.c | 7 +++++-- 4 files changed, 39 insertions(+), 13 deletions(-) commit a11b763d617070a88267e2102e975b2cfc99b5a7 Author: Firoz Khan Date: Mon Dec 17 16:10:33 2018 +0530 powerpc: move macro definition from asm/systbl.h Move the macro definition for compat_sys_sigsuspend from asm/systbl.h to the file which it is getting included. One of the patch in this patch series is generating uapi header and syscall table files. In order to come up with a common implimentation across all architecture, we need to do this change. This change will simplify the implementation of system call table generation script and help to come up a common implementation across all architecture. Signed-off-by: Firoz Khan Signed-off-by: Michael Ellerman arch/powerpc/include/asm/systbl.h | 1 - arch/powerpc/kernel/systbl.S | 1 + 2 files changed, 1 insertion(+), 1 deletion(-) commit 8a19eeeab66dfdd7c67bc8e3048ac0064e8943d7 Author: Firoz Khan Date: Mon Dec 17 16:10:32 2018 +0530 powerpc: add __NR_syscalls along with NR_syscalls NR_syscalls macro holds the number of system call exist in powerpc architecture. We have to change the value of NR_syscalls, if we add or delete a system call. One of the patch in this patch series has a script which will generate a uapi header based on syscall.tbl file. The syscall.tbl file contains the number of system call information. So we have two option to update NR_syscalls value. 1. Update NR_syscalls in asm/unistd.h manually by count- ing the no.of system calls. No need to update NR_sys- calls until we either add a new system call or delete existing system call. 2. We can keep this feature in above mentioned script, that will count the number of syscalls and keep it in a generated file. In this case we don't need to expli- citly update NR_syscalls in asm/unistd.h file. The 2nd option will be the recommended one. For that, I added the __NR_syscalls macro in uapi/asm/unistd.h along with NR_syscalls asm/unistd.h. The macro __NR_syscalls also added for making the name convention same across all architecture. While __NR_syscalls isn't strictly part of the uapi, having it as part of the generated header to simplifies the implementation. We also need to enclose this macro with #ifdef __KERNEL__ to avoid side effects. Signed-off-by: Firoz Khan Signed-off-by: Michael Ellerman arch/powerpc/include/asm/unistd.h | 3 +-- arch/powerpc/include/uapi/asm/unistd.h | 5 ++++- 2 files changed, 5 insertions(+), 3 deletions(-) commit 2cd4bd192ee94848695c1c052d87913260e10f36 Author: Ram Pai Date: Thu Dec 20 12:03:30 2018 -0800 powerpc/pkeys: Fix handling of pkey state across fork() Protection key tracking information is not copied over to the mm_struct of the child during fork(). This can cause the child to erroneously allocate keys that were already allocated. Any allocated execute-only key is lost aswell. Add code; called by dup_mmap(), to copy the pkey state from parent to child explicitly. This problem was originally found by Dave Hansen on x86, which turns out to be a problem on powerpc aswell. Fixes: cf43d3b26452 ("powerpc: Enable pkey subsystem") Cc: stable@vger.kernel.org # v4.16+ Reviewed-by: Thiago Jung Bauermann Signed-off-by: Ram Pai Signed-off-by: Michael Ellerman arch/powerpc/include/asm/mmu_context.h | 15 +++++++++------ arch/powerpc/mm/pkeys.c | 10 ++++++++++ 2 files changed, 19 insertions(+), 6 deletions(-) commit 2f07229f02d4c55affccd11a61af4fd4b94dc436 Author: Greg Kurz Date: Tue Dec 11 18:58:21 2018 +0100 ocxl: Fix endiannes bug in read_afu_name() The AFU Descriptor Template in the PCI config space has a Name Space field which is a 24 Byte ASCII character string of descriptive name space for the AFU. The OCXL driver read the string four characters at a time with pci_read_config_dword(). This optimization is valid on a little-endian system since this is PCI, but a big-endian system ends up with each subset of four characters in reverse order. This could be fixed by switching to read characters one by one. Another option is to swap the bytes if we're big-endian. Go for the latter with le32_to_cpu(). Cc: stable@vger.kernel.org # v4.16 Signed-off-by: Greg Kurz Acked-by: Frederic Barrat Acked-by: Andrew Donnellan Signed-off-by: Michael Ellerman drivers/misc/ocxl/config.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 34642d70ac7e5609e31c36edbf3b19e0d8833be7 Author: Breno Leitao Date: Mon Nov 26 18:12:01 2018 -0200 selftests/powerpc: Add checks for transactional sigreturn This is a new test case that creates a signal and starts a suspended transaction inside the signal handler. It returns from the signal handler with the CPU at suspended state, but without setting user context MSR Transaction State (TS) field. The kernel signal handler code should be able to handle this discrepancy instead of crashing. This code could be compiled and used to test 32 and 64-bits signal handlers. Signed-off-by: Breno Leitao Signed-off-by: Gustavo Romero Signed-off-by: Michael Ellerman tools/testing/selftests/powerpc/tm/.gitignore | 1 + tools/testing/selftests/powerpc/tm/Makefile | 2 +- .../selftests/powerpc/tm/tm-signal-sigreturn-nt.c | 46 ++++++++++++++++++++++ 3 files changed, 48 insertions(+), 1 deletion(-) commit 6f5b9f018f4c7686fd944d920209d1382d320e4e Author: Breno Leitao Date: Mon Nov 26 18:12:00 2018 -0200 powerpc/tm: Unset MSR[TS] if not recheckpointing There is a TM Bad Thing bug that can be caused when you return from a signal context in a suspended transaction but with ucontext MSR[TS] unset. This forces regs->msr[TS] to be set at syscall entrance (since the CPU state is transactional). It also calls treclaim() to flush the transaction state, which is done based on the live (mfmsr) MSR state. Since user context MSR[TS] is not set, then restore_tm_sigcontexts() is not called, thus, not executing recheckpoint, keeping the CPU state as not transactional. When calling rfid, SRR1 will have MSR[TS] set, but the CPU state is non transactional, causing the TM Bad Thing with the following stack: [ 33.862316] Bad kernel stack pointer 3fffd9dce3e0 at c00000000000c47c cpu 0x8: Vector: 700 (Program Check) at [c00000003ff7fd40] pc: c00000000000c47c: fast_exception_return+0xac/0xb4 lr: 00003fff865f442c sp: 3fffd9dce3e0 msr: 8000000102a03031 current = 0xc00000041f68b700 paca = 0xc00000000fb84800 softe: 0 irq_happened: 0x01 pid = 1721, comm = tm-signal-sigre Linux version 4.9.0-3-powerpc64le (debian-kernel@lists.debian.org) (gcc version 6.3.0 20170516 (Debian 6.3.0-18) ) #1 SMP Debian 4.9.30-2+deb9u2 (2017-06-26) WARNING: exception is not recoverable, can't continue The same problem happens on 32-bits signal handler, and the fix is very similar, if tm_recheckpoint() is not executed, then regs->msr[TS] should be zeroed. This patch also fixes a sparse warning related to lack of indentation when CONFIG_PPC_TRANSACTIONAL_MEM is set. Fixes: 2b0a576d15e0e ("powerpc: Add new transactional memory state to the signal context") CC: Stable # 3.10+ Signed-off-by: Breno Leitao Tested-by: Michal Suchánek Signed-off-by: Michael Ellerman arch/powerpc/kernel/signal_32.c | 18 +++++++++++++----- arch/powerpc/kernel/signal_64.c | 20 ++++++++++++++++---- 2 files changed, 29 insertions(+), 9 deletions(-) commit 11be39584a2e283d2b2bc45f3202519aef703b7c Author: Breno Leitao Date: Mon Nov 26 18:11:59 2018 -0200 powerpc/tm: Print scratch value Usually a TM Bad Thing exception is raised due to three different problems. a) touching SPRs in an active transaction; b) using TM instruction with the facility disabled and c) setting a wrong MSR/SRR1 at RFID. The two initial cases are easy to identify by looking at the instructions. The latter case is harder, because the MSR is masked after RFID, so, it is very useful to look at the previous MSR (SRR1) before RFID as also the current and masked MSR. Since MSR is saved at paca just before RFID, this patch prints it if a TM Bad thing happen, helping to understand what is the invalid TM transition that is causing the exception. Signed-off-by: Breno Leitao Signed-off-by: Michael Ellerman arch/powerpc/kernel/traps.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 63a0d6b03b8e6fdd8c8ce5eec0ac04ef8e67d63f Author: Breno Leitao Date: Mon Nov 26 18:11:58 2018 -0200 powerpc/tm: Save MSR to PACA before RFID As other exit points, move SRR1 (MSR) into paca->tm_scratch, so, if there is a TM Bad Thing in RFID, it is easy to understand what was the SRR1 value being used. Signed-off-by: Breno Leitao Signed-off-by: Michael Ellerman arch/powerpc/kernel/entry_64.S | 4 ++++ 1 file changed, 4 insertions(+) commit e1c3743e1a20647c53b719dbf28b48f45d23f2cd Author: Breno Leitao Date: Wed Nov 21 17:21:09 2018 -0200 powerpc/tm: Set MSR[TS] just prior to recheckpoint On a signal handler return, the user could set a context with MSR[TS] bits set, and these bits would be copied to task regs->msr. At restore_tm_sigcontexts(), after current task regs->msr[TS] bits are set, several __get_user() are called and then a recheckpoint is executed. This is a problem since a page fault (in kernel space) could happen when calling __get_user(). If it happens, the process MSR[TS] bits were already set, but recheckpoint was not executed, and SPRs are still invalid. The page fault can cause the current process to be de-scheduled, with MSR[TS] active and without tm_recheckpoint() being called. More importantly, without TEXASR[FS] bit set also. Since TEXASR might not have the FS bit set, and when the process is scheduled back, it will try to reclaim, which will be aborted because of the CPU is not in the suspended state, and, then, recheckpoint. This recheckpoint will restore thread->texasr into TEXASR SPR, which might be zero, hitting a BUG_ON(). kernel BUG at /build/linux-sf3Co9/linux-4.9.30/arch/powerpc/kernel/tm.S:434! cpu 0xb: Vector: 700 (Program Check) at [c00000041f1576d0] pc: c000000000054550: restore_gprs+0xb0/0x180 lr: 0000000000000000 sp: c00000041f157950 msr: 8000000100021033 current = 0xc00000041f143000 paca = 0xc00000000fb86300 softe: 0 irq_happened: 0x01 pid = 1021, comm = kworker/11:1 kernel BUG at /build/linux-sf3Co9/linux-4.9.30/arch/powerpc/kernel/tm.S:434! Linux version 4.9.0-3-powerpc64le (debian-kernel@lists.debian.org) (gcc version 6.3.0 20170516 (Debian 6.3.0-18) ) #1 SMP Debian 4.9.30-2+deb9u2 (2017-06-26) enter ? for help [c00000041f157b30] c00000000001bc3c tm_recheckpoint.part.11+0x6c/0xa0 [c00000041f157b70] c00000000001d184 __switch_to+0x1e4/0x4c0 [c00000041f157bd0] c00000000082eeb8 __schedule+0x2f8/0x990 [c00000041f157cb0] c00000000082f598 schedule+0x48/0xc0 [c00000041f157ce0] c0000000000f0d28 worker_thread+0x148/0x610 [c00000041f157d80] c0000000000f96b0 kthread+0x120/0x140 [c00000041f157e30] c00000000000c0e0 ret_from_kernel_thread+0x5c/0x7c This patch simply delays the MSR[TS] set, so, if there is any page fault in the __get_user() section, it does not have regs->msr[TS] set, since the TM structures are still invalid, thus avoiding doing TM operations for in-kernel exceptions and possible process reschedule. With this patch, the MSR[TS] will only be set just before recheckpointing and setting TEXASR[FS] = 1, thus avoiding an interrupt with TM registers in invalid state. Other than that, if CONFIG_PREEMPT is set, there might be a preemption just after setting MSR[TS] and before tm_recheckpoint(), thus, this block must be atomic from a preemption perspective, thus, calling preempt_disable/enable() on this code. It is not possible to move tm_recheckpoint to happen earlier, because it is required to get the checkpointed registers from userspace, with __get_user(), thus, the only way to avoid this undesired behavior is delaying the MSR[TS] set. The 32-bits signal handler seems to be safe this current issue, but, it might be exposed to the preemption issue, thus, disabling preemption in this chunk of code. Changes from v2: * Run the critical section with preempt_disable. Fixes: 87b4e5393af7 ("powerpc/tm: Fix return of active 64bit signals") Cc: stable@vger.kernel.org (v3.9+) Signed-off-by: Breno Leitao Signed-off-by: Michael Ellerman arch/powerpc/kernel/signal_32.c | 20 ++++++++++++++++++- arch/powerpc/kernel/signal_64.c | 44 ++++++++++++++++++++++++++++------------- 2 files changed, 49 insertions(+), 15 deletions(-) commit d53ec8af56d5163f8a42e961ece3aeb5c560e79d Author: Steve Wise Date: Thu Dec 20 14:00:11 2018 -0800 RDMA/iwcm: Don't copy past the end of dev_name() string We now use dev_name(&ib_device->dev) instead of ib_device->name in iwpm messages. The name field in struct device is a const char *, where as ib_device->name is a char array of size IB_DEVICE_NAME_MAX, and it is pre-initialized to zeros. Since iw_cm_map() was using memcpy() to copy in the device name, and copying IWPM_DEVNAME_SIZE bytes, it ends up copying past the end of the source device name string and copying random bytes. This results in iwpmd failing the REGISTER_PID request from iwcm. Thus port mapping is broken. Validate the device and if names, and use strncpy() to inialize the entire message field. Fixes: 896de0090a85 ("RDMA/core: Use dev_name instead of ibdev->name") Cc: stable@vger.kernel.org Signed-off-by: Steve Wise Signed-off-by: Jason Gunthorpe drivers/infiniband/core/iwcm.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) commit ae59a7e1945bc2245bbb587071ca737e00daf443 Author: Suraj Jitindar Singh Date: Fri Dec 21 14:28:43 2018 +1100 KVM: PPC: Book3S HV: Keep rc bits in shadow pgtable in sync with host The rc bits contained in ptes are used to track whether a page has been accessed and whether it is dirty. The accessed bit is used to age a page and the dirty bit to track whether a page is dirty or not. Now that we support nested guests there are three ptes which track the state of the same page: - The partition-scoped page table in the L1 guest, mapping L2->L1 address - The partition-scoped page table in the host for the L1 guest, mapping L1->L0 address - The shadow partition-scoped page table for the nested guest in the host, mapping L2->L0 address The idea is to attempt to keep the rc state of these three ptes in sync, both when setting and when clearing rc bits. When setting the bits we achieve consistency by: - Initially setting the bits in the shadow page table as the 'and' of the other two. - When updating in software the rc bits in the shadow page table we ensure the state is consistent with the other two locations first, and update these before reflecting the change into the shadow page table. i.e. only set the bits in the L2->L0 pte if also set in both the L2->L1 and the L1->L0 pte. When clearing the bits we achieve consistency by: - The rc bits in the shadow page table are only cleared when discarding a pte, and we don't need to record this as if either bit is set then it must also be set in the pte mapping L1->L0. - When L1 clears an rc bit in the L2->L1 mapping it __should__ issue a tlbie instruction - This means we will discard the pte from the shadow page table meaning the mapping will have to be setup again. - When setup the pte again in the shadow page table we will ensure consistency with the L2->L1 pte. - When the host clears an rc bit in the L1->L0 mapping we need to also clear the bit in any ptes in the shadow page table which map the same gfn so we will be notified if a nested guest accesses the page. This case is what this patch specifically concerns. - We can search the nest_rmap list for that given gfn and clear the same bit from all corresponding ptes in shadow page tables. - If a nested guest causes either of the rc bits to be set by software in future then we will update the L1->L0 pte and maintain consistency. With the process outlined above we aim to maintain consistency of the 3 pte locations where we track rc for a given guest page. Signed-off-by: Suraj Jitindar Singh Signed-off-by: Paul Mackerras arch/powerpc/kvm/book3s_64_mmu_radix.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) commit 90165d3da0760a0353518740ac307f0d81c4e400 Author: Suraj Jitindar Singh Date: Fri Dec 21 14:28:42 2018 +1100 KVM: PPC: Book3S HV: Introduce kvmhv_update_nest_rmap_rc_list() Introduce a function kvmhv_update_nest_rmap_rc_list() which for a given nest_rmap list will traverse it, find the corresponding pte in the shadow page tables, and if it still maps the same host page update the rc bits accordingly. Signed-off-by: Suraj Jitindar Singh Signed-off-by: Paul Mackerras arch/powerpc/include/asm/kvm_book3s.h | 2 ++ arch/powerpc/include/asm/kvm_book3s_64.h | 3 ++ arch/powerpc/kvm/book3s_64_mmu_radix.c | 4 +-- arch/powerpc/kvm/book3s_hv_nested.c | 51 ++++++++++++++++++++++++++++++++ 4 files changed, 58 insertions(+), 2 deletions(-) commit 8b23eee4e55a32a2b51a180dfd27a8d214acc7a1 Author: Suraj Jitindar Singh Date: Fri Dec 21 14:28:41 2018 +1100 KVM: PPC: Book3S HV: Apply combination of host and l1 pte rc for nested guest The shadow page table contains ptes for translations from nested guest address to host address. Currently when creating these ptes we take the rc bits from the pte for the L1 guest address to host address translation. This is incorrect as we must also factor in the rc bits from the pte for the nested guest address to L1 guest address translation (as contained in the L1 guest partition table for the nested guest). By not calculating these bits correctly L1 may not have been correctly notified when it needed to update its rc bits in the partition table it maintains for its nested guest. Modify the code so that the rc bits in the resultant pte for the L2->L0 translation are the 'and' of the rc bits in the L2->L1 pte and the L1->L0 pte, also accounting for whether this was a write access when setting the dirty bit. Signed-off-by: Suraj Jitindar Singh Signed-off-by: Paul Mackerras arch/powerpc/kvm/book3s_hv_nested.c | 3 +++ 1 file changed, 3 insertions(+) commit 8400f8740651c1a3081c30b46004451c448f4d5f Author: Suraj Jitindar Singh Date: Fri Dec 21 14:28:40 2018 +1100 KVM: PPC: Book3S HV: Align gfn to L1 page size when inserting nest-rmap entry Nested rmap entries are used to store the translation from L1 gpa to L2 gpa when entries are inserted into the shadow (nested) page tables. This rmap list is located by indexing the rmap array in the memslot by L1 gfn. When we come to search for these entries we only know the L1 page size (which could be PAGE_SIZE, 2M or a 1G page) and so can only select a gfn aligned to that size. This means that when we insert the entry, so we can find it later, we need to align the gfn we use to select the rmap list in which to insert the entry to L1 page size as well. By not doing this we were missing nested rmap entries when modifying L1 ptes which were for a page also passed through to an L2 guest. Signed-off-by: Suraj Jitindar Singh Signed-off-by: Paul Mackerras arch/powerpc/kvm/book3s_hv_nested.c | 2 ++ 1 file changed, 2 insertions(+) commit bec6e03b5ea5618479548bce1da4e16088e25edc Author: Suraj Jitindar Singh Date: Fri Dec 21 14:28:39 2018 +1100 KVM: PPC: Book3S HV: Hold kvm->mmu_lock across updating nested pte rc bits We already hold the kvm->mmu_lock spin lock across updating the rc bits in the pte for the L1 guest. Continue to hold the lock across updating the rc bits in the pte for the nested guest as well to prevent invalidations from occurring. Signed-off-by: Suraj Jitindar Singh Signed-off-by: Paul Mackerras arch/powerpc/kvm/book3s_hv_nested.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) commit fa2323325e8b0c61ded1e3d2c6f12f3aa43c4e30 Author: Peter Oskolkov Date: Thu Dec 20 16:41:52 2018 -0800 selftests: net: reuseport_addr_any: silence clang warning Clang does not recognize that calls to error() terminate execution and complains about uninitialized variable use that happens after calls to error(). This noop patchset fixes this. Signed-off-by: Peter Oskolkov Signed-off-by: David S. Miller tools/testing/selftests/net/reuseport_addr_any.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit a02e8964eaf9271a8a5fcc0c55bd13f933bafc56 Author: Willem de Bruijn Date: Thu Dec 20 17:14:54 2018 -0500 virtio-net: ethtool configurable LRO Virtio-net devices negotiate LRO support with the host. Display the initially negotiated state with ethtool -k. Also allow configuring it with ethtool -K, reusing the existing virtnet_set_guest_offloads helper that configures LRO for XDP. This is conditional on VIRTIO_NET_F_CTRL_GUEST_OFFLOADS. Virtio-net negotiates TSO4 and TSO6 separately, but ethtool does not distinguish between the two. Display LRO as on only if any offload is active. RTNL is held while calling virtnet_set_features, same as on the path from virtnet_xdp_set. Changes v1 -> v2 - allow ethtool config (-K) only if VIRTIO_NET_F_CTRL_GUEST_OFFLOADS - show LRO as enabled if any LRO variant is enabled - do not allow configuration while XDP is active - differentiate current features from the capable set, to restore on XDP down only those features that were active on XDP up - move test out of VIRTIO_NET_F_CSUM/TSO branch, which is tx only Signed-off-by: Willem de Bruijn Acked-by: Michael S. Tsirkin Signed-off-by: David S. Miller drivers/net/virtio_net.c | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) commit c3e533692527046fb55020e7fac8c4272644ba45 Merge: 339bbff2d6e0 8527f9df04a8 Author: David S. Miller Date: Thu Dec 20 18:20:26 2018 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next Pablo Neira Ayuso says: ==================== Netfilter updates for net-next The following patchset contains Netfilter updates for net-next: 1) Support for destination MAC in ipset, from Stefano Brivio. 2) Disallow all-zeroes MAC address in ipset, also from Stefano. 3) Add IPSET_CMD_GET_BYNAME and IPSET_CMD_GET_BYINDEX commands, introduce protocol version number 7, from Jozsef Kadlecsik. A follow up patch to fix ip_set_byindex() is also included in this batch. 4) Honor CTA_MARK_MASK from ctnetlink, from Andreas Jaggi. 5) Statify nf_flow_table_iterate(), from Taehee Yoo. 6) Use nf_flow_table_iterate() to simplify garbage collection in nf_flow_table logic, also from Taehee Yoo. 7) Don't use _bh variants of call_rcu(), rcu_barrier() and synchronize_rcu_bh() in Netfilter, from Paul E. McKenney. 8) Remove NFC_* cache definition from the old caching infrastructure. 9) Remove layer 4 port rover in NAT helpers, use random port instead, from Florian Westphal. 10) Use strscpy() in ipset, from Qian Cai. 11) Remove NF_NAT_RANGE_PROTO_RANDOM_FULLY branch now that random port is allocated by default, from Xiaozhou Liu. 12) Ignore NF_NAT_RANGE_PROTO_RANDOM too, from Florian Westphal. 13) Limit port allocation selection routine in NAT to avoid softlockup splats when most ports are in use, from Florian. 14) Remove unused parameters in nf_ct_l4proto_unregister_sysctl() from Yafang Shao. 15) Direct call to nf_nat_l4proto_unique_tuple() instead of indirection, from Florian Westphal. 16) Several patches to remove all layer 4 NAT indirections, remove nf_nat_l4proto struct, from Florian Westphal. 17) Fix RTP/RTCP source port translation when SNAT is in place, from Alin Nastac. 18) Selective rule dump per chain, from Phil Sutter. 19) Revisit CLUSTERIP target, this includes a deadlock fix from netns path, sleep in atomic, remove bogus WARN_ON_ONCE() and disallow mismatching IP address and MAC address. Patchset from Taehee Yoo. 20) Update UDP timeout to stream after 2 seconds, from Florian. 21) Shrink UDP established timeout to 120 seconds like TCP timewait. 22) Sysctl knobs to set GRE timeouts, from Yafang Shao. 23) Move seq_print_acct() to conntrack core file, from Florian. 24) Add enum for conntrack sysctl knobs, also from Florian. 25) Place nf_conntrack_acct, nf_conntrack_helper, nf_conntrack_events and nf_conntrack_timestamp knobs in the core, from Florian Westphal. As a side effect, shrink netns_ct structure by removing obsolete sysctl anchors, also from Florian. ==================== Signed-off-by: David S. Miller commit 339bbff2d6e005a5586adeffc3d69a0eea50a764 Merge: e770454fabde 1cf4a0ccc506 Author: David S. Miller Date: Thu Dec 20 17:31:36 2018 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Daniel Borkmann says: ==================== pull-request: bpf-next 2018-12-21 The following pull-request contains BPF updates for your *net-next* tree. There is a merge conflict in test_verifier.c. Result looks as follows: [...] }, { "calls: cross frame pruning", .insns = { [...] .prog_type = BPF_PROG_TYPE_SOCKET_FILTER, .errstr_unpriv = "function calls to other bpf functions are allowed for root only", .result_unpriv = REJECT, .errstr = "!read_ok", .result = REJECT, }, { "jset: functional", .insns = { [...] { "jset: unknown const compare not taken", .insns = { BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_get_prandom_u32), BPF_JMP_IMM(BPF_JSET, BPF_REG_0, 1, 1), BPF_LDX_MEM(BPF_B, BPF_REG_8, BPF_REG_9, 0), BPF_EXIT_INSN(), }, .prog_type = BPF_PROG_TYPE_SOCKET_FILTER, .errstr_unpriv = "!read_ok", .result_unpriv = REJECT, .errstr = "!read_ok", .result = REJECT, }, [...] { "jset: range", .insns = { [...] }, .prog_type = BPF_PROG_TYPE_SOCKET_FILTER, .result_unpriv = ACCEPT, .result = ACCEPT, }, The main changes are: 1) Various BTF related improvements in order to get line info working. Meaning, verifier will now annotate the corresponding BPF C code to the error log, from Martin and Yonghong. 2) Implement support for raw BPF tracepoints in modules, from Matt. 3) Add several improvements to verifier state logic, namely speeding up stacksafe check, optimizations for stack state equivalence test and safety checks for liveness analysis, from Alexei. 4) Teach verifier to make use of BPF_JSET instruction, add several test cases to kselftests and remove nfp specific JSET optimization now that verifier has awareness, from Jakub. 5) Improve BPF verifier's slot_type marking logic in order to allow more stack slot sharing, from Jiong. 6) Add sk_msg->size member for context access and add set of fixes and improvements to make sock_map with kTLS usable with openssl based applications, from John. 7) Several cleanups and documentation updates in bpftool as well as auto-mount of tracefs for "bpftool prog tracelog" command, from Quentin. 8) Include sub-program tags from now on in bpf_prog_info in order to have a reliable way for user space to get all tags of the program e.g. needed for kallsyms correlation, from Song. 9) Add BTF annotations for cgroup_local_storage BPF maps and implement bpf fs pretty print support, from Roman. 10) Fix bpftool in order to allow for cross-compilation, from Ivan. 11) Update of bpftool license to GPLv2-only + BSD-2-Clause in order to be compatible with libbfd and allow for Debian packaging, from Jakub. 12) Remove an obsolete prog->aux sanitation in dump and get rid of version check for prog load, from Daniel. 13) Fix a memory leak in libbpf's line info handling, from Prashant. 14) Fix cpumap's frame alignment for build_skb() so that skb_shared_info does not get unaligned, from Jesper. 15) Fix test_progs kselftest to work with older compilers which are less smart in optimizing (and thus throwing build error), from Stanislav. 16) Cleanup and simplify AF_XDP socket teardown, from Björn. 17) Fix sk lookup in BPF kselftest's test_sock_addr with regards to netns_id argument, from Andrey. ==================== Signed-off-by: David S. Miller commit da7903092b880b25971ca9103cb0b934a44ace2b Author: Gustavo A. R. Silva Date: Tue Nov 27 22:30:27 2018 -0600 scsi: isci: request: mark expected switch fall-through In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Notice that, in this particular case, a dash is added as a token in order to separate the "Fall through" annotation from the rest of the comment on the same line, which is what GCC is expecting to find. Signed-off-by: Gustavo A. R. Silva Acked-by: Artur Paszkiewicz Signed-off-by: Martin K. Petersen drivers/scsi/isci/request.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 87be32b3ad27d7696cdc4340644894ba4c7a89e5 Author: Gustavo A. R. Silva Date: Tue Nov 27 22:30:11 2018 -0600 scsi: isci: remote_node_context: mark expected switch fall-throughs In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Notice that, in this particular case, a dash is added as a token in order to separate the "Fall through" annotations from the rest of the comment on the same line, which is what GCC is expecting to find. Signed-off-by: Gustavo A. R. Silva Acked-by: Artur Paszkiewicz Signed-off-by: Martin K. Petersen drivers/scsi/isci/remote_node_context.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 4f09ac9d96ceea2a0532e17b614b9b2835041c17 Author: Gustavo A. R. Silva Date: Tue Nov 27 22:30:01 2018 -0600 scsi: isci: remote_device: Mark expected switch fall-throughs In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Notice that, in this particular case, a dash is added as a token in order to separate the "fall through" annotations from the rest of the comment on the same line, which is what GCC is expecting to find. Signed-off-by: Gustavo A. R. Silva Acked-by: Artur Paszkiewicz Signed-off-by: Martin K. Petersen drivers/scsi/isci/remote_device.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 1aba50b880e1834a6f2f1cb0df23ccce3e84b8a8 Author: Gustavo A. R. Silva Date: Tue Nov 27 22:29:55 2018 -0600 scsi: isci: phy: Mark expected switch fall-through In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Addresses-Coverity-ID: 703127 ("Missing break in switch") Signed-off-by: Gustavo A. R. Silva Acked-by: Artur Paszkiewicz Signed-off-by: Martin K. Petersen drivers/scsi/isci/phy.c | 1 + 1 file changed, 1 insertion(+) commit c2332b004907229b19a5687004290464df7c3e9d Author: Fred Herard Date: Wed Nov 21 12:04:43 2018 -0500 scsi: iscsi: Capture iscsi debug messages using tracepoints This commit enhances iscsi initiator modules to capture iscsi debug messages using linux kernel tracepoint facility: https://www.kernel.org/doc/Documentation/trace/tracepoints.txt The following tracepoint events have been created under the iscsi tracepoint event group: iscsi_dbg_conn - to capture connection debug messages (libiscsi module) iscsi_dbg_session - to capture session debug messages (libiscsi module) iscsi_dbg_eh - to capture error handling debug messages (libiscsi module) iscsi_dbg_tcp - to capture iscsi tcp debug messages (libiscsi_tcp module) iscsi_dbg_sw_tcp - to capture iscsi sw tcp debug messages (iscsi_tcp module) iscsi_dbg_trans_session - to cpature iscsi transsport sess debug messages (scsi_transport_iscsi module) iscsi_dbg_trans_conn - to capture iscsi transport conn debug messages (scsi_transport_iscsi module) [mkp: typos] Signed-off-by: Fred Herard Reviewed-by: Rajan Shanmugavelu Reviewed-by: Lee Duncan Reviewed-by: Douglas Gilbert Signed-off-by: Martin K. Petersen drivers/scsi/iscsi_tcp.c | 4 ++ drivers/scsi/libiscsi.c | 10 ++++ drivers/scsi/libiscsi_tcp.c | 4 ++ drivers/scsi/scsi_transport_iscsi.c | 34 +++++++++++- include/trace/events/iscsi.h | 107 ++++++++++++++++++++++++++++++++++++ 5 files changed, 158 insertions(+), 1 deletion(-) commit e770454fabde2e0f8fb3e5039a2b6df8f128bc9b Merge: a6ae520defea cda261f421ba Author: David S. Miller Date: Thu Dec 20 17:01:17 2018 -0800 Merge branch 'expand-txtimestamp-selftest' Willem de Bruijn says: ==================== expand txtimestamp selftest Convert the existing txtimestamp test to run as part of kselftest and return a pass/fail. Also expand the variations of timestamping tested, including packet sockets, ipv6 raw and dgram and passing options using cmsg. These are enough changes to split across a few patches, even if all changes are only this one test. ==================== Signed-off-by: David S. Miller commit cda261f421ba2682e25f46beb229172706fc7fcd Author: Willem de Bruijn Date: Thu Dec 20 16:22:54 2018 -0500 selftests: add txtimestamp kselftest Run the transmit timestamp tests as part of kselftests. Add a txtimestamp.sh test script that runs most variants: ipv4/ipv6, tcp/udp/raw/raw_ipproto/pf_packet, data/nodata, setsockopt/cmsg. The script runs tests with netem delays. Refine txtimestamp.c to validate results. Take expected netem delays as input and compare against real timestamps. To run without dependencies, add a listener socket to be able to connect in the case of TCP. Add the timestamping directory to the kselftests Makefile. Build all the binaries. Only run verified txtimestamp.sh. Signed-off-by: Willem de Bruijn Acked-by: Soheil Hassas Yeganeh Signed-off-by: David S. Miller tools/testing/selftests/Makefile | 1 + .../selftests/networking/timestamping/Makefile | 5 +- .../selftests/networking/timestamping/config | 2 + .../networking/timestamping/txtimestamp.c | 136 +++++++++++++++++---- .../networking/timestamping/txtimestamp.sh | 57 +++++++++ 5 files changed, 173 insertions(+), 28 deletions(-) commit b52354aa068ee362a58ebb92e8bd0d0e18008364 Author: Willem de Bruijn Date: Thu Dec 20 16:22:53 2018 -0500 selftests: expand txtimestamp with ipv6 dgram + raw and pf_packet Expand the transmit timestamp regression test with support for missing protocols: ipv6 datagram and raw and pf_packet. Also refine resolve_hostname to independently request AF_INET or AF_INET6 addresses. Else, ipv4 addresses may be returned as AF_INET6. Signed-off-by: Willem de Bruijn Acked-by: Soheil Hassas Yeganeh Signed-off-by: David S. Miller .../networking/timestamping/txtimestamp.c | 189 ++++++++++++++++----- 1 file changed, 146 insertions(+), 43 deletions(-) commit 7085f47fcdc599cb387a472e4cd9def739954119 Author: Willem de Bruijn Date: Thu Dec 20 16:22:52 2018 -0500 selftests: expand txtimestamp with cmsg support Commit 3dd17e63f513 ("sock: accept SO_TIMESTAMPING flags in socket cmsg") added support for passing tx timestamping options per-call in sendmsg. Expand the txtimestamp test with support for this feature. Signed-off-by: Willem de Bruijn Acked-by: Soheil Hassas Yeganeh Signed-off-by: David S. Miller .../networking/timestamping/txtimestamp.c | 67 +++++++++++++++++----- 1 file changed, 53 insertions(+), 14 deletions(-) commit a6ae520defea9986a422032eda7f0bdbb1368a18 Author: Peter Oskolkov Date: Thu Dec 20 10:51:49 2018 -0800 net: seg6.h: remove an unused #include A minor code cleanup. Signed-off-by: Peter Oskolkov Signed-off-by: David S. Miller include/net/seg6.h | 1 - 1 file changed, 1 deletion(-) commit 4c5765e4851008812488686619e8592783b28b33 Author: Gustavo A. R. Silva Date: Tue Nov 27 22:32:52 2018 -0600 scsi: myrb: Mark expected switch fall-throughs In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Addresses-Coverity-ID: 1465234 ("Missing break in switch") Addresses-Coverity-ID: 1465238 ("Missing break in switch") Addresses-Coverity-ID: 1465242 ("Missing break in switch") Signed-off-by: Gustavo A. R. Silva Reviewed-by: Hannes Reinecke Signed-off-by: Martin K. Petersen drivers/scsi/myrb.c | 3 +++ 1 file changed, 3 insertions(+) commit 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 Author: Sam Protsenko Date: Thu Dec 20 20:29:20 2018 +0200 ppp: Move PFC decompression to PPP generic layer Extract "Protocol" field decompression code from transport protocols to PPP generic layer, where it actually belongs. As a consequence, this patch fixes incorrect place of PFC decompression in L2TP driver (when it's not PPPOX_BOUND) and also enables this decompression for other protocols, like PPPoE. Protocol field decompression also happens in PPP Multilink Protocol code and in PPP compression protocols implementations (bsd, deflate, mppe). It looks like there is no easy way to get rid of that, so it was decided to leave it as is, but provide those cases with appropriate comments instead. Changes in v2: - Fix the order of checking skb data room and proto decompression - Remove "inline" keyword from ppp_decompress_proto() - Don't split line before function name - Prefix ppp_decompress_proto() function with "__" - Add ppp_decompress_proto() function with skb data room checks - Add description for introduced functions - Fix comments (as per review on mailing list) Signed-off-by: Sam Protsenko Reviewed-by: Guillaume Nault Signed-off-by: David S. Miller drivers/net/ppp/ppp_async.c | 14 +++++------ drivers/net/ppp/ppp_generic.c | 54 ++++++++++++++++++++++++++++++++++++++++--- drivers/net/ppp/ppp_synctty.c | 9 ++++---- drivers/net/ppp/pptp.c | 5 ---- net/l2tp/l2tp_ppp.c | 4 ---- 5 files changed, 62 insertions(+), 24 deletions(-) commit c7a082e4242fd8cd21a441071e622f87c16bdacc Author: Qian Cai Date: Thu Dec 13 08:27:27 2018 -0500 scsi: megaraid: fix out-of-bound array accesses UBSAN reported those with MegaRAID SAS-3 3108, [ 77.467308] UBSAN: Undefined behaviour in drivers/scsi/megaraid/megaraid_sas_fp.c:117:32 [ 77.475402] index 255 is out of range for type 'MR_LD_SPAN_MAP [1]' [ 77.481677] CPU: 16 PID: 333 Comm: kworker/16:1 Not tainted 4.20.0-rc5+ #1 [ 77.488556] Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.50 06/01/2018 [ 77.495791] Workqueue: events work_for_cpu_fn [ 77.500154] Call trace: [ 77.502610] dump_backtrace+0x0/0x2c8 [ 77.506279] show_stack+0x24/0x30 [ 77.509604] dump_stack+0x118/0x19c [ 77.513098] ubsan_epilogue+0x14/0x60 [ 77.516765] __ubsan_handle_out_of_bounds+0xfc/0x13c [ 77.521767] mr_update_load_balance_params+0x150/0x158 [megaraid_sas] [ 77.528230] MR_ValidateMapInfo+0x2cc/0x10d0 [megaraid_sas] [ 77.533825] megasas_get_map_info+0x244/0x2f0 [megaraid_sas] [ 77.539505] megasas_init_adapter_fusion+0x9b0/0xf48 [megaraid_sas] [ 77.545794] megasas_init_fw+0x1ab4/0x3518 [megaraid_sas] [ 77.551212] megasas_probe_one+0x2c4/0xbe0 [megaraid_sas] [ 77.556614] local_pci_probe+0x7c/0xf0 [ 77.560365] work_for_cpu_fn+0x34/0x50 [ 77.564118] process_one_work+0x61c/0xf08 [ 77.568129] worker_thread+0x534/0xa70 [ 77.571882] kthread+0x1c8/0x1d0 [ 77.575114] ret_from_fork+0x10/0x1c [ 89.240332] UBSAN: Undefined behaviour in drivers/scsi/megaraid/megaraid_sas_fp.c:117:32 [ 89.248426] index 255 is out of range for type 'MR_LD_SPAN_MAP [1]' [ 89.254700] CPU: 16 PID: 95 Comm: kworker/u130:0 Not tainted 4.20.0-rc5+ #1 [ 89.261665] Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.50 06/01/2018 [ 89.268903] Workqueue: events_unbound async_run_entry_fn [ 89.274222] Call trace: [ 89.276680] dump_backtrace+0x0/0x2c8 [ 89.280348] show_stack+0x24/0x30 [ 89.283671] dump_stack+0x118/0x19c [ 89.287167] ubsan_epilogue+0x14/0x60 [ 89.290835] __ubsan_handle_out_of_bounds+0xfc/0x13c [ 89.295828] MR_LdRaidGet+0x50/0x58 [megaraid_sas] [ 89.300638] megasas_build_io_fusion+0xbb8/0xd90 [megaraid_sas] [ 89.306576] megasas_build_and_issue_cmd_fusion+0x138/0x460 [megaraid_sas] [ 89.313468] megasas_queue_command+0x398/0x3d0 [megaraid_sas] [ 89.319222] scsi_dispatch_cmd+0x1dc/0x8a8 [ 89.323321] scsi_request_fn+0x8e8/0xdd0 [ 89.327249] __blk_run_queue+0xc4/0x158 [ 89.331090] blk_execute_rq_nowait+0xf4/0x158 [ 89.335449] blk_execute_rq+0xdc/0x158 [ 89.339202] __scsi_execute+0x130/0x258 [ 89.343041] scsi_probe_and_add_lun+0x2fc/0x1488 [ 89.347661] __scsi_scan_target+0x1cc/0x8c8 [ 89.351848] scsi_scan_channel.part.3+0x8c/0xc0 [ 89.356382] scsi_scan_host_selected+0x130/0x1f0 [ 89.361002] do_scsi_scan_host+0xd8/0xf0 [ 89.364927] do_scan_async+0x9c/0x320 [ 89.368594] async_run_entry_fn+0x138/0x420 [ 89.372780] process_one_work+0x61c/0xf08 [ 89.376793] worker_thread+0x13c/0xa70 [ 89.380546] kthread+0x1c8/0x1d0 [ 89.383778] ret_from_fork+0x10/0x1c This is because when populating Driver Map using firmware raid map, all non-existing VDs set their ldTgtIdToLd to 0xff, so it can be skipped later. From drivers/scsi/megaraid/megaraid_sas_base.c , memset(instance->ld_ids, 0xff, MEGASAS_MAX_LD_IDS); From drivers/scsi/megaraid/megaraid_sas_fp.c , /* For non existing VDs, iterate to next VD*/ if (ld >= (MAX_LOGICAL_DRIVES_EXT - 1)) continue; However, there are a few places that failed to skip those non-existing VDs due to off-by-one errors. Then, those 0xff leaked into MR_LdRaidGet(0xff, map) and triggered the out-of-bound accesses. Fixes: 51087a8617fe ("megaraid_sas : Extended VD support") Signed-off-by: Qian Cai Acked-by: Sumit Saxena Signed-off-by: Martin K. Petersen drivers/scsi/megaraid/megaraid_sas_fp.c | 2 +- drivers/scsi/megaraid/megaraid_sas_fusion.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit a8cc10e232f1fc651b6465ee120e7ecec06dc2f7 Author: Gustavo A. R. Silva Date: Thu Dec 20 09:43:53 2018 -0600 scsi: mpt3sas: mpt3sas_scsih: Mark expected switch fall-through In preparation to enabling -Wimplicit-fallthrough, mark switch cases where we are expecting to fall through. Addresses-Coverity-ID: 1475400 ("Missing break in switch") Signed-off-by: Gustavo A. R. Silva Signed-off-by: Martin K. Petersen drivers/scsi/mpt3sas/mpt3sas_scsih.c | 1 + 1 file changed, 1 insertion(+) commit e69fbf31ca2cf6d6a2afedd0f8b30dcd10e76049 Merge: aa9d6e0f33ae fbbae71d374f Author: David S. Miller Date: Thu Dec 20 16:47:10 2018 -0800 Merge tag 'wireless-drivers-next-for-davem-2018-12-20' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next Kalle Valo says: ==================== wireless-drivers-next patches for 4.21 Last set of patches for 4.21. mt76 is still in very active development and having some refactoring as well as new features. But also other drivers got few new features and fixes. Major changes: ath10k * add amsdu support for QCA6174 monitor mode * report tx rate using the new ieee80211_tx_rate_update() API * wcn3990 support is not experimental anymore iwlwifi * support for FW version 43 for 9000 and 22000 series brcmfmac * add support for CYW43012 SDIO chipset * add the raw 4354 PCIe device ID for unprogrammed Cypress boards mwifiex * add NL80211_STA_INFO_RX_BITRATE support mt76 * use the same firmware for mt76x2e and mt76x2u * mt76x0e survey support * more unification between mt76x2 and mt76x0 * mt76x0e AP mode support * mt76x0e DFS support * rework and fix tx status handling for mt76x0 and mt76x2 ==================== Signed-off-by: David S. Miller commit 7223d80912d8977219b09f1605483026d79e704b Author: YueHaibing Date: Thu Dec 20 02:43:44 2018 +0000 scsi: fcoe: remove set but not used variable 'port' Fixes gcc '-Wunused-but-set-variable' warning: drivers/scsi/fcoe/fcoe.c: In function 'fcoe_recv_frame': drivers/scsi/fcoe/fcoe.c:1672:20: warning: variable 'port' set but not used [-Wunused-but-set-variable] drivers/scsi/fcoe/fcoe.c: In function 'fcoe_device_notification': drivers/scsi/fcoe/fcoe.c:1861:20: warning: variable 'port' set but not used [-Wunused-but-set-variable] Signed-off-by: YueHaibing Acked-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen drivers/scsi/fcoe/fcoe.c | 4 ---- 1 file changed, 4 deletions(-) commit aa9d6e0f33aea8a1879e7e53fe0e436943f9ce0c Author: Stephen Hemminger Date: Thu Dec 20 09:52:28 2018 -0800 linux/netlink.h: drop unnecessary extern prefix Don't need extern prefix before function prototypes. Checkpatch has complained about this for a couple of years. Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller include/linux/netlink.h | 48 ++++++++++++++++++++++++------------------------ 1 file changed, 24 insertions(+), 24 deletions(-) commit 7de333090a803a6678c3848d4eed1031bbc3dc95 Merge: 639c1b2625af 676f4bb168ca Author: David S. Miller Date: Thu Dec 20 16:42:39 2018 -0800 Merge branch 'ipv4-Prevent-user-triggerable-warning' Ido Schimmel says: ==================== net: ipv4: Prevent user triggerable warning Patch #1 prevents a user triaggerable warning in the flow dissector by setting 'skb->dev' in skbs used for IPv4 output route get requests. Patch #2 adds a test case that triggers the warning without the first patch. I have audited all the RTM_GETROUTE handlers and could not find any other callpath where an skb is passed to the flow dissector with both 'skb->dev' and 'skb->sk' cleared. ==================== Signed-off-by: David S. Miller commit 676f4bb168ca855adb957ad7f470984d9391c320 Author: Ido Schimmel Date: Thu Dec 20 17:03:29 2018 +0000 selftests: rtnetlink: Add a test case for multipath route get Without previous patch a warning would be generated upon multipath route get when FIB multipath hash policy is to use a 5-tuple for multipath hash calculation. Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller tools/testing/selftests/net/rtnetlink.sh | 15 +++++++++++++++ 1 file changed, 15 insertions(+) commit 21f9477537059344e4705719137f6695de93b662 Author: Ido Schimmel Date: Thu Dec 20 17:03:27 2018 +0000 net: ipv4: Set skb->dev for output route resolution When user requests to resolve an output route, the kernel synthesizes an skb where the relevant parameters (e.g., source address) are set. The skb is then passed to ip_route_output_key_hash_rcu() which might call into the flow dissector in case a multipath route was hit and a nexthop needs to be selected based on the multipath hash. Since both 'skb->dev' and 'skb->sk' are not set, a warning is triggered in the flow dissector [1]. The warning is there to prevent codepaths from silently falling back to the standard flow dissector instead of the BPF one. Therefore, instead of removing the warning, set 'skb->dev' to the loopback device, as its not used for anything but resolving the correct namespace. [1] WARNING: CPU: 1 PID: 24819 at net/core/flow_dissector.c:764 __skb_flow_dissect+0x314/0x16b0 ... RSP: 0018:ffffa0df41fdf650 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8bcded232000 RCX: 0000000000000000 RDX: ffffa0df41fdf7e0 RSI: ffffffff98e415a0 RDI: ffff8bcded232000 RBP: ffffa0df41fdf760 R08: 0000000000000000 R09: 0000000000000000 R10: ffffa0df41fdf7e8 R11: ffff8bcdf27a3000 R12: ffffffff98e415a0 R13: ffffa0df41fdf7e0 R14: ffffffff98dd2980 R15: ffffa0df41fdf7e0 FS: 00007f46f6897680(0000) GS:ffff8bcdf7a80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055933e95f9a0 CR3: 000000021e636000 CR4: 00000000001006e0 Call Trace: fib_multipath_hash+0x28c/0x2d0 ? fib_multipath_hash+0x28c/0x2d0 fib_select_path+0x241/0x32f ? __fib_lookup+0x6a/0xb0 ip_route_output_key_hash_rcu+0x650/0xa30 ? __alloc_skb+0x9b/0x1d0 inet_rtm_getroute+0x3f7/0xb80 ? __alloc_pages_nodemask+0x11c/0x2c0 rtnetlink_rcv_msg+0x1d9/0x2f0 ? rtnl_calcit.isra.24+0x120/0x120 netlink_rcv_skb+0x54/0x130 rtnetlink_rcv+0x15/0x20 netlink_unicast+0x20a/0x2c0 netlink_sendmsg+0x2d1/0x3d0 sock_sendmsg+0x39/0x50 ___sys_sendmsg+0x2a0/0x2f0 ? filemap_map_pages+0x16b/0x360 ? __handle_mm_fault+0x108e/0x13d0 __sys_sendmsg+0x63/0xa0 ? __sys_sendmsg+0x63/0xa0 __x64_sys_sendmsg+0x1f/0x30 do_syscall_64+0x5a/0x120 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fixes: d0e13a1488ad ("flow_dissector: lookup netns by skb->sk if skb->dev is NULL") Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller net/ipv4/route.c | 1 + 1 file changed, 1 insertion(+) commit 639c1b2625af66501b24c8082231a83d4f5ad56b Author: Steen Hegelund Date: Thu Dec 20 14:16:31 2018 +0100 net: mscc: ocelot: Register poll timeout should be wall time not attempts When doing indirect access in the Ocelot chip, a command is setup, issued and then we need to poll until the result is ready. The polling timeout is specified in milliseconds in the datasheet and not in register access attempts. It is not a bug on the currently supported platform, but we observed that the code does not work properly on other platforms that we want to support as the timing requirements there are different. Signed-off-by: Steen Hegelund Signed-off-by: David S. Miller drivers/net/ethernet/mscc/ocelot.c | 55 +++++++++++++++++++------------------- 1 file changed, 27 insertions(+), 28 deletions(-) commit e57b2945aa654e48f85a41e8917793c64ecb9de8 Author: Yanjiang Jin Date: Thu Dec 20 16:32:35 2018 +0800 scsi: smartpqi: call pqi_free_interrupts() in pqi_shutdown() We must free all irqs during shutdown, else kexec's 2nd kernel would hang in pqi_wait_for_completion_io() as below: Call trace: pqi_wait_for_completion_io pqi_submit_raid_request_synchronous.constprop.78+0x23c/0x310 [smartpqi] pqi_configure_events+0xec/0x1f8 [smartpqi] pqi_ctrl_init+0x814/0xca0 [smartpqi] pqi_pci_probe+0x400/0x46c [smartpqi] local_pci_probe+0x48/0xb0 pci_device_probe+0x14c/0x1b0 really_probe+0x218/0x3fc driver_probe_device+0x70/0x140 __driver_attach+0x11c/0x134 bus_for_each_dev+0x70/0xc8 driver_attach+0x30/0x38 bus_add_driver+0x1f0/0x294 driver_register+0x74/0x12c __pci_register_driver+0x64/0x70 pqi_init+0xd0/0x10000 [smartpqi] do_one_initcall+0x60/0x1d8 do_init_module+0x64/0x1f8 load_module+0x10ec/0x1350 __se_sys_finit_module+0xd4/0x100 __arm64_sys_finit_module+0x28/0x34 el0_svc_handler+0x104/0x160 el0_svc+0x8/0xc This happens only in the following combinations: 1. smartpqi is built as module, not built-in; 2. We have a disk connected to smartpqi card; 3. Both kexec's 1st and 2nd kernels use this disk as Rootfs' mount point. Signed-off-by: Yanjiang Jin Acked-by: Don Brace Signed-off-by: Martin K. Petersen drivers/scsi/smartpqi/smartpqi_init.c | 1 + 1 file changed, 1 insertion(+) commit 463561e6b9facf93ef90b65d2c75a80c7262d778 Author: Colin Ian King Date: Thu Dec 20 16:50:50 2018 +0000 neighbour: remove stray semicolon Currently the stray semicolon means that the final term in the addition is being missed. Fix this by removing it. Cleans up clang warning: net/core/neighbour.c:2821:9: warning: expression result unused [-Wunused-value] Fixes: 82cbb5c631a0 ("neighbour: register rtnl doit handler") Signed-off-by: Colin Ian King Acked-By: Roopa Prabhu Signed-off-by: David S. Miller net/core/neighbour.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e52c9e0710d2f5d54a521d620a230ac2ae646dc7 Author: Don Brace Date: Thu Dec 20 19:32:12 2018 -0500 scsi: smartpqi: fix build warnings Fix kbuild warning and fallout from linux-next -Wimplicit-fallthrough. [mkp: added fall through statements] Signed-off-by: Don Brace Signed-off-by: Martin K. Petersen drivers/scsi/smartpqi/smartpqi_init.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 0db6896ff6332ba694f1e61b93ae3b2640317633 Author: Mahesh Salgaonkar Date: Mon Aug 20 13:47:32 2018 +0530 powerpc/fadump: Do not allow hot-remove memory from fadump reserved area. For fadump to work successfully there should not be any holes in reserved memory ranges where kernel has asked firmware to move the content of old kernel memory in event of crash. Now that fadump uses CMA for reserved area, this memory area is now not protected from hot-remove operations unless it is cma allocated. Hence, fadump service can fail to re-register after the hot-remove operation, if hot-removed memory belongs to fadump reserved region. To avoid this make sure that memory from fadump reserved area is not hot-removable if fadump is registered. However, if user still wants to remove that memory, he can do so by manually stopping fadump service before hot-remove operation. Signed-off-by: Mahesh Salgaonkar Signed-off-by: Michael Ellerman arch/powerpc/include/asm/fadump.h | 2 +- arch/powerpc/kernel/fadump.c | 10 ++++++++-- arch/powerpc/platforms/pseries/hotplug-memory.c | 7 +++++-- 3 files changed, 14 insertions(+), 5 deletions(-) commit f86593be1e7f5405b980bb4b11640250ac81d7cb Author: Mahesh Salgaonkar Date: Mon Aug 20 13:47:24 2018 +0530 powerpc/fadump: Throw proper error message on fadump registration failure fadump fails to register when there are holes in reserved memory area. This can happen if user has hot-removed a memory that falls in the fadump reserved memory area. Throw a meaningful error message to the user in such case. Signed-off-by: Mahesh Salgaonkar [mpe: is_reserved_memory_area_contiguous() returns bool, unsplit string] Signed-off-by: Michael Ellerman arch/powerpc/kernel/fadump.c | 35 +++++++++++++++++++++++++++++++++-- 1 file changed, 33 insertions(+), 2 deletions(-) commit a4e92ce8e4c8275bacfe3529d6ac85d54a233d87 Author: Mahesh Salgaonkar Date: Mon Aug 20 13:47:17 2018 +0530 powerpc/fadump: Reservationless firmware assisted dump One of the primary issues with Firmware Assisted Dump (fadump) on Power is that it needs a large amount of memory to be reserved. On large systems with TeraBytes of memory, this reservation can be quite significant. In some cases, fadump fails if the memory reserved is insufficient, or if the reserved memory was DLPAR hot-removed. In the normal case, post reboot, the preserved memory is filtered to extract only relevant areas of interest using the makedumpfile tool. While the tool provides flexibility to determine what needs to be part of the dump and what memory to filter out, all supported distributions default this to "Capture only kernel data and nothing else". We take advantage of this default and the Linux kernel's Contiguous Memory Allocator (CMA) to fundamentally change the memory reservation model for fadump. Instead of setting aside a significant chunk of memory nobody can use, this patch uses CMA instead, to reserve a significant chunk of memory that the kernel is prevented from using (due to MIGRATE_CMA), but applications are free to use it. With this fadump will still be able to capture all of the kernel memory and most of the user space memory except the user pages that were present in CMA region. Essentially, on a P9 LPAR with 2 cores, 8GB RAM and current upstream: [root@zzxx-yy10 ~]# free -m total used free shared buff/cache available Mem: 7557 193 6822 12 541 6725 Swap: 4095 0 4095 With this patch: [root@zzxx-yy10 ~]# free -m total used free shared buff/cache available Mem: 8133 194 7464 12 475 7338 Swap: 4095 0 4095 Changes made here are completely transparent to how fadump has traditionally worked. Thanks to Aneesh Kumar and Anshuman Khandual for helping us understand CMA and its usage. TODO: - Handle case where CMA reservation spans nodes. Signed-off-by: Ananth N Mavinakayanahalli Signed-off-by: Mahesh Salgaonkar Signed-off-by: Hari Bathini Signed-off-by: Michael Ellerman Documentation/powerpc/firmware-assisted-dump.txt | 17 ++++- arch/powerpc/include/asm/fadump.h | 5 ++ arch/powerpc/kernel/fadump.c | 97 +++++++++++++++++++++--- 3 files changed, 108 insertions(+), 11 deletions(-) commit 08fb726df13778a54592aaa1deea6a154637c868 Author: Mahesh Salgaonkar Date: Thu Dec 13 11:17:31 2018 +0530 powerpc/powernv: Move opal_power_control_init() call in opal_init(). opal_power_control_init() depends on opal message notifier to be initialized, which is done in opal_init()->opal_message_init(). But both these initialization are called through machine initcalls and it all depends on in which order they being called. So far these are called in correct order (may be we got lucky) and never saw any issue. But it is clearer to control initialization order explicitly by moving opal_power_control_init() into opal_init(). Signed-off-by: Mahesh Salgaonkar Signed-off-by: Michael Ellerman arch/powerpc/include/asm/opal.h | 1 + arch/powerpc/platforms/powernv/opal-power.c | 3 +-- arch/powerpc/platforms/powernv/opal.c | 3 +++ 3 files changed, 5 insertions(+), 2 deletions(-) commit ae6263cc33742d1c179510b6aadd31108fe89a89 Author: Markus Elfring Date: Thu Jan 11 18:40:23 2018 +0100 powerpc/4xx: Delete an unnecessary return statement in two functions The script "checkpatch.pl" pointed information out like the following. WARNING: void function return statements are not generally useful Thus remove such a statement in the affected functions. Signed-off-by: Markus Elfring Signed-off-by: Michael Ellerman arch/powerpc/platforms/4xx/ocm.c | 2 -- arch/powerpc/platforms/4xx/pci.c | 1 - 2 files changed, 3 deletions(-) commit a8d5dadae59f5866ac3b68cb993d532c3bf761e4 Author: Markus Elfring Date: Thu Jan 11 18:28:54 2018 +0100 powerpc/4xx: Delete error message for a ENOMEM in two functions Omit an extra message for a memory allocation failure in these functions. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring Signed-off-by: Michael Ellerman arch/powerpc/platforms/4xx/ocm.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) commit 52930bc6e87191af3894bec302774f334e117f7b Author: Markus Elfring Date: Thu Jan 11 18:10:02 2018 +0100 powerpc/4xx: Use seq_putc() in ocm_debugfs_show() A single character (line break) should be put into a sequence. Thus use the corresponding function "seq_putc". This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring Signed-off-by: Michael Ellerman arch/powerpc/platforms/4xx/ocm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b52106a040e6f86848b05be1b4317479836e94d4 Author: Markus Elfring Date: Thu Jan 11 18:08:08 2018 +0100 powerpc/4xx: Combine four seq_printf() calls into two in ocm_debugfs_show() Some data were printed into a sequence by four separate function calls. Print the same data by two single function calls instead. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring Signed-off-by: Michael Ellerman arch/powerpc/platforms/4xx/ocm.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) commit 96d19d70e1012383365c68e271d99f833a2d85f3 Author: Christophe Leroy Date: Thu Dec 20 07:25:28 2018 +0000 powerpc/8xx: Allow pinning IMMR TLB when using early debug console CONFIG_EARLY_DEBUG_CPM requires IMMR area TLB to be pinned otherwise it doesn't survive MMU_init, and the boot fails. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman arch/powerpc/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5f639e5fad18f2673f1788cb04bde2bb2f8fe6da Author: Oliver O'Halloran Date: Wed Nov 14 17:19:58 2018 +1100 powerpc/powernv: Remove PCI_MSI ifdef checks CONFIG_PCI_MSI was made mandatory by commit a311e738b6d8 ("powerpc/powernv: Make PCI non-optional") so the #ifdef checks around CONFIG_PCI_MSI here can be removed entirely. Signed-off-by: Oliver O'Halloran Reviewed-by: Joel Stanley Signed-off-by: Michael Ellerman arch/powerpc/platforms/powernv/pci-ioda.c | 13 ------------- arch/powerpc/platforms/powernv/pci.c | 2 -- arch/powerpc/platforms/powernv/pci.h | 2 -- 3 files changed, 17 deletions(-) commit a083787680f80f2c16316a1d907bf8d3f6b42311 Author: Alexandre Belloni Date: Tue Nov 20 16:12:30 2018 +0100 powerpc/fsl-rio: fix spelling mistake "reserverd" -> "reserved" Fix a spelling mistake in a register description. Signed-off-by: Alexandre Belloni Signed-off-by: Michael Ellerman arch/powerpc/sysdev/fsl_rio.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0c9108b083706330cd5484d121fbb0ad67e8f647 Author: Ravi Bangoria Date: Wed Nov 21 09:26:37 2018 +0530 Powerpc/perf: Wire up PMI throttling Commit 14c63f17b1fde ("perf: Drop sample rate when sampling is too slow") introduced a way to throttle PMU interrupts if we're spending too much time just processing those. Wire up powerpc PMI handler to use this infrastructure. We have throttling of the *rate* of interrupts, but this adds throttling based on the *time taken* to process the interrupts. Signed-off-by: Ravi Bangoria Signed-off-by: Michael Ellerman arch/powerpc/perf/core-book3s.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) commit 962ad710f7d64d441c4e02c0e9e5fddd1aeb54b7 Author: Tristram Ha Date: Wed Dec 19 18:59:31 2018 -0800 net: dsa: microchip: fix unicast frame leak Port partitioning is done by enabling UNICAST_VLAN_BOUNDARY and changing the default port membership of 0x7f to other values such that there is no communication between ports. In KSZ9477 the member for port 1 is 0x41; port 2, 0x42; port 3, 0x44; port 4, 0x48; port 5, 0x50; and port 7, 0x60. Port 6 is the host port. Setting a zero value can be used to stop port from receiving. However, when UNICAST_VLAN_BOUNDARY is disabled and the unicast addresses are already learned in the dynamic MAC table, setting zero still allows devices connected to those ports to communicate. This does not apply to multicast and broadcast addresses though. To prevent these leaks and make the function of port membership consistent UNICAST_VLAN_BOUNDARY should never be disabled. Note that UNICAST_VLAN_BOUNDARY is enabled by default in KSZ9477. Fixes: b987e98e50ab90e5 ("dsa: add DSA switch driver for Microchip KSZ9477") Signed-off-by: Tristram Ha Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/dsa/microchip/ksz9477.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 3a6d528a5e0179b1e8b20033c5cb7384dd7a830d Author: David S. Miller Date: Thu Dec 20 16:14:22 2018 -0800 vxlan: Correct merge error. When resolving the conflict wrt. the vxlan_fdb_update call in vxlan_changelink() I made the last argument false instead of true. Fix this. Signed-off-by: David S. Miller drivers/net/vxlan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8527f9df04a8b5f6ee24ae7bdda5a94d73c7d243 Author: Florian Westphal Date: Tue Dec 18 23:04:50 2018 +0100 netfilter: netns: shrink netns_ct struct remove the obsolete sysctl anchors and move auto_assign_helper_warned to avoid/cover a hole. Reduces size by 40 bytes on 64 bit. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso include/net/netns/conntrack.h | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) commit e716431356df2bc935f6516b14ebcff9fd3cc0d0 Merge: c337680fc1f4 a64917446eaf Author: David S. Miller Date: Thu Dec 20 15:51:55 2018 -0800 Merge tag 'mlx5-updates-2018-12-19' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5-updates-2018-12-19 This series adds some misc updates and the support for tunnels over VLAN tc offloads. From Miroslav Lichvar, patches #1,2 1) Update timecounter at least twice per counter overflow 2) Extend PTP gettime function to read system clock From Gavi Teitz, patch #3 3) Increase VF representors' SQ size to 128 From Eli Britstein and Or Gerlitz, patches #4-10 4) Adds the capability to support tunnels over VLAN device. Patch 4 avoids crash for TC flow with egress upper devices Patch 5 refactors tunnel routing devs into a helper function Patch 6 avoids crash for TC encap flows with vlan on underlay Patches 7-8 refactor encap tunnel header preparing code. Patch 9 adds support for building VLAN tagged ETH header. Patch 10 adds support for tunnel routing to VLAN device. From Aviv, patches 11,12 to fix earlier VF lag series 5) Fix query_nic_sys_image_guid() error during init 6) Fix LAG requirement when CONFIG_MLX5_ESWITCH is off ==================== Signed-off-by: David S. Miller commit fc3893fd5cfc3c654ae4b9c8d7ee39ea70e4bdc6 Author: Florian Westphal Date: Tue Dec 18 23:04:49 2018 +0100 netfilter: conntrack: remove empty pernet fini stubs after moving sysctl handling into single place, the init functions can't fail anymore and some of the fini functions are empty. Remove them and change return type to void. This also simplifies error unwinding in conntrack module init path. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso include/net/netfilter/nf_conntrack_acct.h | 3 +-- include/net/netfilter/nf_conntrack_ecache.h | 7 ++----- include/net/netfilter/nf_conntrack_helper.h | 3 +-- include/net/netfilter/nf_conntrack_timestamp.h | 13 ++---------- net/netfilter/nf_conntrack_acct.c | 7 +------ net/netfilter/nf_conntrack_core.c | 28 ++++++-------------------- net/netfilter/nf_conntrack_ecache.c | 3 +-- net/netfilter/nf_conntrack_helper.c | 7 +------ net/netfilter/nf_conntrack_timestamp.c | 7 +------ 9 files changed, 16 insertions(+), 62 deletions(-) commit cb2833ed0044f910877b810077bc6da2ac5f09a2 Author: Florian Westphal Date: Tue Dec 18 23:04:48 2018 +0100 netfilter: conntrack: merge ecache and timestamp sysctl tables with main one Similar to previous change, this time for eache and timestamp. Unlike helper and acct, these can be disabled at build time, so they need ifdef guards. Next patch will remove a few (now obsolete) functions. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_conntrack_ecache.c | 65 +-------------------------------- net/netfilter/nf_conntrack_standalone.c | 33 +++++++++++++++++ net/netfilter/nf_conntrack_timestamp.c | 65 +-------------------------------- 3 files changed, 35 insertions(+), 128 deletions(-) commit d912dec124288553c734e25fef3ecfef92f894db Author: Florian Westphal Date: Tue Dec 18 23:04:47 2018 +0100 netfilter: conntrack: merge acct and helper sysctl table with main one Needless copy&paste, just handle all in one. Next patch will handle acct and timestamp, which have similar functions. Intentionally leaves cruft behind, will be cleaned up in a followup patch. The obsolete sysctl pointers in netns_ct struct are left in place and removed in a single change, as changes to netns trigger rebuild of almost all files. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_conntrack_acct.c | 65 +-------------------------------- net/netfilter/nf_conntrack_helper.c | 64 +------------------------------- net/netfilter/nf_conntrack_standalone.c | 21 ++++++++++- 3 files changed, 22 insertions(+), 128 deletions(-) commit 4a65798a94089f31883eee705f580e4b2d734ecf Author: Florian Westphal Date: Tue Dec 18 23:04:46 2018 +0100 netfilter: conntrack: add mnemonics for sysctl table Its a bit hard to see what table[3] really lines up with, so add human-readable mnemonics and use them for initialisation. This makes it easier to see e.g. which sysctls are not exported to unprivileged userns. objdiff shows no changes. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_conntrack_standalone.c | 31 ++++++++++++++++++++----------- 1 file changed, 20 insertions(+), 11 deletions(-) commit 4b216e21cfca77132ef0215f553eda91eb1d038b Author: Florian Westphal Date: Tue Dec 18 23:04:45 2018 +0100 netfilter: conntrack: un-export seq_print_acct Only one caller, just place it where its needed. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso include/net/netfilter/nf_conntrack_acct.h | 3 --- net/netfilter/nf_conntrack_acct.c | 19 ------------------- net/netfilter/nf_conntrack_standalone.c | 18 ++++++++++++++++++ 3 files changed, 18 insertions(+), 22 deletions(-) commit a0badcc6652f9871a9908d67297f910cba657b0f Author: Yafang Shao Date: Tue Dec 18 21:14:07 2018 +0800 netfilter: conntrack: register sysctl table for gre This patch adds two sysctl knobs for GRE: net.netfilter.nf_conntrack_gre_timeout = 30 net.netfilter.nf_conntrack_gre_timeout_stream = 180 Update the Documentation as well. Signed-off-by: Yafang Shao Signed-off-by: Pablo Neira Ayuso Documentation/networking/nf_conntrack-sysctl.txt | 9 +++++ net/netfilter/nf_conntrack_proto_gre.c | 42 +++++++++++++++++++++++- 2 files changed, 50 insertions(+), 1 deletion(-) commit c337680fc1f43a5e184099ee8784c868244f02e7 Merge: 6eea2db21012 03a84ea3d8c5 Author: David S. Miller Date: Thu Dec 20 15:48:55 2018 -0800 Merge branch 'mlxsw-Two-usability-improvements' Ido Schimmel says: ==================== mlxsw: Two usability improvements This patchset contains two small improvements in the mlxsw driver. The first one, in patches #1-#2, relieves the user from the need to configure a VLAN interface and only later the corresponding VXLAN tunnel. The issue is explained in detail in the first patch. The second improvement is described below and allows the user to make use of VID 1 by having the driver use the reserved 4095 VID for untagged traffic. VLAN entries on a given port can be associated with either a bridge or a router. For example, if swp1.10 is assigned an IP address and swp1.20 is enslaved to a VLAN-unaware bridge, then both {Port 1, VID 10} and {Port 1, VID 20} would be associated with a filtering identifier (FID) of the correct type. In case swp1 itself is assigned an IP address or enslaved to a VLAN-unaware bridge, then a FID would be associated with {Port 1, VID 1}. Using VID 1 for this purpose means that VLAN devices with VID 1 cannot be created over mlxsw ports, as this VID is (ab)used as the default VLAN. Instead of using VID 1 for this purpose, we can use VID 4095 which is reserved for internal use and cannot be configured by either the 8021q or the bridge driver. Patches #3-#7 perform small and non-functional changes that finally allow us to switch to VID 4095 as the default VID in patch #8. Patch #9 removes the limitation about creation of VLAN devices with VID 1 over mlxsw ports. Patches #10-#11 add test cases. ==================== Signed-off-by: David S. Miller commit 03a84ea3d8c537f04b862972e2132dff86a4e93d Author: Ido Schimmel Date: Thu Dec 20 19:42:37 2018 +0000 selftests: forwarding: Add router test with VID 1 Previous patches made it possible to setup VLAN devices with VID 1 over mlxsw ports. Verify this functionality actually works by conducting a simple router test over VID 1. Adding this test as a generic test since it can be run using veth pairs and it can also be useful for other physical devices where VID 1 was considered reserved (knowingly or not). Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller .../selftests/net/forwarding/router_vid_1.sh | 135 +++++++++++++++++++++ 1 file changed, 135 insertions(+) commit 29b1e34efd39ee9f6bc2db3fafad0e4615f15475 Author: Ido Schimmel Date: Thu Dec 20 19:42:35 2018 +0000 selftests: mlxsw: Adjust test regarding VID 1 Previous patches made it possible to create VLAN devices with VID 1 over mlxsw ports. Adjust the test to verify such an operation succeeds. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller tools/testing/selftests/drivers/net/mlxsw/rtnetlink.sh | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) commit d8a1f7ab2c1fb4ee53c16ad048ad045770d99f14 Author: Ido Schimmel Date: Thu Dec 20 19:42:34 2018 +0000 mlxsw: spectrum: Remove limitation regarding VID 1 VID 1 is not reserved anymore, so remove the check that prevented the creation of VLAN devices with this VID over mlxsw ports. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 5 ----- 1 file changed, 5 deletions(-) commit 0417d25e7dad2ab61a42afb07bb0b9512fd0e6df Author: Ido Schimmel Date: Thu Dec 20 19:42:33 2018 +0000 mlxsw: spectrum: Switch to VID 4095 as default VID There is no need to abuse VID 1 anymore and we can instead use VID 4095 as the default VLAN, which will be configured on the port throughout its lifetime. The OVS join / leave functions are changed to enable VIDs 1-4094 (inclusive) instead of 2-4095. This because VID 4095 is now the default VLAN instead of 1. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 15 ++++++--------- drivers/net/ethernet/mellanox/mlxsw/spectrum.h | 2 +- drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 15 ++++----------- 3 files changed, 11 insertions(+), 21 deletions(-) commit 16f6aceb72e7e27efae092c1020c5f0b312a4745 Author: Ido Schimmel Date: Thu Dec 20 19:42:32 2018 +0000 mlxsw: spectrum: Add an helper function to cleanup VLAN entries VLAN entries on a port can be associated with either a bridge VLAN or a router port. Before the VLAN entry is destroyed these associations need to be cleaned up. Currently, this is always invoked from the function which destroys the VLAN entry, but next patch is going to skip the destruction of the default entry when a port in unlinked from a LAG. The above does not mean that the associations should not be cleaned up, so add a helper that will be invoked from both call sites. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) commit 346fca3b58cbe0505f4328276e46e22ffc9a11d8 Author: Ido Schimmel Date: Thu Dec 20 19:42:30 2018 +0000 mlxsw: spectrum: Store pointer to default port VLAN in port struct Subsequent patches will need to access the default port VLAN. Since this VLAN will exist throughout the lifetime of the port, simply store it in the port's struct. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 1 + drivers/net/ethernet/mellanox/mlxsw/spectrum.h | 1 + 2 files changed, 2 insertions(+) commit ab6c3b79ec7b1d10cec411015eb5a7599e2b7e52 Author: Ido Schimmel Date: Thu Dec 20 19:42:29 2018 +0000 mlxsw: spectrum: Allow controlling destruction of default port VLAN The function allows flushing all the existing VLAN entries on a port. It is invoked when a port is destroyed and when it is unlinked from a LAG. In the latter case, when moving to the new default VLAN, there will not be a need to destroy the default VLAN entry. Therefore, add an argument that allows to control whether the default port VLAN should be destroyed or not. Currently it is always set to 'true'. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) commit 262e1ff91c3bc9d6b082c123fc7035c1e6347469 Author: Ido Schimmel Date: Thu Dec 20 19:42:27 2018 +0000 mlxsw: spectrum: Set PVID during port initialization Currently, the driver does not set the port's PVID when initializing a new port. This is because the driver is using VID 1 as PVID which is the firmware default. Subsequent patches are going to change the PVID the driver is setting when initializing a new port. Prepare for that by explicitly setting the port's PVID. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit a2d2a20553f0b74a2872fba58a152e93341eddd7 Author: Ido Schimmel Date: Thu Dec 20 19:42:26 2018 +0000 mlxsw: spectrum: Replace hard-coded default VID with a define Subsequent patches are going to replace the current default VID (1) with VLAN_N_VID - 1 (4095). Prepare for this conversion by replacing the hard-coded '1' with a define. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 14 ++++++++------ drivers/net/ethernet/mellanox/mlxsw/spectrum.h | 2 ++ drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 8 ++++---- drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 11 ++++++----- 4 files changed, 20 insertions(+), 15 deletions(-) commit 9d15dceb8a36919897d52ec8e4a6e6efa57f9f19 Author: Ido Schimmel Date: Thu Dec 20 19:42:25 2018 +0000 selftests: mlxsw: Add a test case for L3 VNI Previous patch added the ability to offload a VXLAN tunnel used for L3 VNI when it is present in the VLAN-aware bridge before the corresponding VLAN interface is configured. This patch adds a test case to verify that. Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller tools/testing/selftests/drivers/net/mlxsw/vxlan.sh | 60 ++++++++++++++++++++++ 1 file changed, 60 insertions(+) commit f40be47a3e409724104d370385817d90215149b4 Author: Ido Schimmel Date: Thu Dec 20 19:42:23 2018 +0000 mlxsw: spectrum_router: Do not force specific configuration order In symmetric routing, the only two members in the VLAN corresponding to the L3 VNI are the router port and the VXLAN tunnel. In case the VXLAN device is already enslaved to the bridge and only later the VLAN interface is configured, the tunnel will not be offloaded. The reason for this is that when the router interface (RIF) corresponding to the VLAN interface is configured, it calls the core fid_get() API which does not check if NVE should be enabled on the FID. Instead, call into the bridge code which will check if NVE should be enabled on the FID. This effectively means that the same code path is used to retrieve a FID when either a local port or a router port joins the FID. Signed-off-by: Ido Schimmel Acked-by: Jiri Pirko Reviewed-by: Petr Machata Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum.h | 4 ++++ drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 8 ++++++-- drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 14 ++++++++++++++ 3 files changed, 24 insertions(+), 2 deletions(-) commit 294304e4c522d797b7ea8200ab74354843fa68e9 Author: Florian Westphal Date: Tue Dec 18 00:05:29 2018 +0100 netfilter: conntrack: udp: set stream timeout to 2 minutes We have no explicit signal when a UDP stream has terminated, peers just stop sending. For suspected stream connections a timeout of two minutes is sane to keep NAT mapping alive a while longer. It matches tcp conntracks 'timewait' default timeout value. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso Documentation/networking/nf_conntrack-sysctl.txt | 2 +- net/netfilter/nf_conntrack_proto_udp.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit d535c8a69c1924e70186d80be0a9cecaf475f166 Author: Florian Westphal Date: Thu Dec 6 11:50:49 2018 +0100 netfilter: conntrack: udp: only extend timeout to stream mode after 2s Currently DNS resolvers that send both A and AAAA queries from same source port can trigger stream mode prematurely, which results in non-early-evictable conntrack entry for three minutes, even though DNS requests are done in a few milliseconds. Add a two second grace period where we continue to use the ordinary 30-second default timeout. Its enough for DNS request/response traffic, even if two request/reply packets are involved. ASSURED is still set, else conntrack (and thus a possible NAT mapping ...) gets zapped too in case conntrack table runs full. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso include/net/netfilter/nf_conntrack.h | 5 +++++ net/netfilter/nf_conntrack_proto_udp.c | 16 +++++++++++++--- 2 files changed, 18 insertions(+), 3 deletions(-) commit 6eea2db21012b287f880edeeffc42f49c3a057d7 Merge: 2be09de7d6a0 643bae17fd4c Author: David S. Miller Date: Thu Dec 20 15:34:30 2018 -0800 Merge branch '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/next-queue Jeff Kirsher says: ==================== Intel Wired LAN Driver Updates 2018-12-20 This series contains updates to e100, igb, ixgbe, i40e and ice drivers. I replaced spinlocks for mutex locks to reduce the latency on CPU0 for igb when updating the statistics. This work was based off a patch provided by Jan Jablonsky, which was against an older version of the igb driver. Jesus adjusts the receive packet buffer size from 32K to 30K when running in QAV mode, to stay within 60K for total packet buffer size for igb. Vinicius adds igb kernel documentation regarding the CBS algorithm and its implementation in the i210 family of NICs. YueHaibing from Huawei fixed the e100 driver that was potentially passing a NULL pointer, so use the kernel macro IS_ERR_OR_NULL() instead. Konstantin Khorenko fixes i40e where we were not setting up the neigh_priv_len in our net_device, which caused the driver to read beyond the neighbor entry allocated memory. Miroslav Lichvar extends the PTP gettime() to read the system clock by adding support for PTP_SYS_OFFSET_EXTENDED ioctl in i40e. Young Xiao fixed the ice driver to only enable NAPI on q_vectors that actually have transmit and receive rings. Kai-Heng Feng fixes an igb issue that when placed in suspend mode, the NIC does not wake up when a cable is plugged in. This was due to the driver not setting PME during runtime suspend. Stephen Douthit enables the ixgbe driver allow DSA devices to use the MII interface to talk to switches. ==================== Signed-off-by: David S. Miller commit bb7e22a8ab00ff9ba911a45ba8784cef9e6d6f7a Author: Huy Nguyen Date: Tue Dec 18 14:15:56 2018 +0200 IB/mlx5: Fix long EEH recover time with NVMe offloads On NVMe offloads connection with many IO queues, EEH takes long time to recover. The culprit is the synchronize_srcu in the destroy_mkey. The solution is to use synchronize_srcu only for ODP mkey. Fixes: b4cfe447d47b ("IB/mlx5: Implement on demand paging by adding support for MMU notifiers") Signed-off-by: Huy Nguyen Reviewed-by: Daniel Jurgens Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/mlx5/mr.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) commit 1cf4a0ccc506b5c027afc5eaf3fddc83f96f31e7 Merge: 77ea5f4cbe20 28cb6f1eaffd Author: Daniel Borkmann Date: Thu Dec 20 23:47:10 2018 +0100 Merge branch 'bpf-sockmap-fixes-and-improvements' John Fastabend says: ==================== Set of bpf fixes and improvements to make sockmap with kTLS usable with "real" applications. This set came as the fallout of pulling kTLS+sockmap into Cilium[1] and running in container environment. Roughly broken into three parts, Patches 1-3: resolve/improve handling of size field in sk_msg_md Patch 4: it became difficult to use this in Cilium when the SK_PASS verdict was not correctly handle. So handle the case correctly. Patch 5-8: Set of issues found while running OpenSSL TX kTLS enabled applications. This resolves the most obvious issues and gets applications using kTLS TX up and running with sock{map|has}. Other than the "sk_msg, zap ingress queue on psock down" (PATCH 6/8) which can potentially cause a WARNING the issues fixed in this series do not cause kernel side warnings, BUG, etc. but instead cause stalls and other odd behavior in the user space applications when using kTLS with BPF policies applied. Primarily tested with 'curl' compiled with latest openssl and also 'openssl s_client/s_server' containers using Cilium network plugin with docker/k8s. Some basic testing with httpd was also enabled. Cilium CI tests will be added shortly to cover these cases as well. We also have 'wrk' and other test and benchmarking tools we can run now. We have two more sets of patches currently under testing that will be sent shortly to address a few more issues. First the OpenSSL RX kTLS side breaks when both sk_msg and sk_skb_verdict programs are used with kTLS, the sk_skb_verdict programs are not enforced. Second skmsg needs to call into tcp stack to send to indicate consumed data. ==================== Signed-off-by: Daniel Borkmann commit 28cb6f1eaffdc5a6a9707cac55f4a43aa3fd7895 Author: John Fastabend Date: Thu Dec 20 11:35:36 2018 -0800 bpf: tls_sw, init TLS ULP removes BPF proto hooks The existing code did not expect users would initialize the TLS ULP without subsequently calling the TLS TX enabling socket option. If the application tries to send data after the TLS ULP enable op but before the TLS TX enable op the BPF sk_msg verdict program is skipped. This patch resolves this by converting the ipv4 sock ops to be calculated at init time the same way ipv6 ops are done. This pulls in any changes to the sock ops structure that have been made after the socket was created including the changes from adding the socket to a sock{map|hash}. This was discovered by running OpenSSL master branch which calls the TLS ULP setsockopt early in TLS handshake but only enables the TLS TX path once the handshake has completed. As a result the datapath missed the initial handshake messages. Fixes: 02c558b2d5d6 ("bpf: sockmap, support for msg_peek in sk_msg with redirect ingress") Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann net/tls/tls_main.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) commit 0608c69c9a805c6264689d7eab4203eab88cf1da Author: John Fastabend Date: Thu Dec 20 11:35:35 2018 -0800 bpf: sk_msg, sock{map|hash} redirect through ULP A sockmap program that redirects through a kTLS ULP enabled socket will not work correctly because the ULP layer is skipped. This fixes the behavior to call through the ULP layer on redirect to ensure any operations required on the data stream at the ULP layer continue to be applied. To do this we add an internal flag MSG_SENDPAGE_NOPOLICY to avoid calling the BPF layer on a redirected message. This is required to avoid calling the BPF layer multiple times (possibly recursively) which is not the current/expected behavior without ULPs. In the future we may add a redirect flag if users _do_ want the policy applied again but this would need to work for both ULP and non-ULP sockets and be opt-in to avoid breaking existing programs. Also to avoid polluting the flag space with an internal flag we reuse the flag space overlapping MSG_SENDPAGE_NOPOLICY with MSG_WAITFORONE. Here WAITFORONE is specific to recv path and SENDPAGE_NOPOLICY is only used for sendpage hooks. The last thing to verify is user space API is masked correctly to ensure the flag can not be set by user. (Note this needs to be true regardless because we have internal flags already in-use that user space should not be able to set). But for completeness we have two UAPI paths into sendpage, sendfile and splice. In the sendfile case the function do_sendfile() zero's flags, ./fs/read_write.c: static ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos, size_t count, loff_t max) { ... fl = 0; #if 0 /* * We need to debate whether we can enable this or not. The * man page documents EAGAIN return for the output at least, * and the application is arguably buggy if it doesn't expect * EAGAIN on a non-blocking file descriptor. */ if (in.file->f_flags & O_NONBLOCK) fl = SPLICE_F_NONBLOCK; #endif file_start_write(out.file); retval = do_splice_direct(in.file, &pos, out.file, &out_pos, count, fl); } In the splice case the pipe_to_sendpage "actor" is used which masks flags with SPLICE_F_MORE. ./fs/splice.c: static int pipe_to_sendpage(struct pipe_inode_info *pipe, struct pipe_buffer *buf, struct splice_desc *sd) { ... more = (sd->flags & SPLICE_F_MORE) ? MSG_MORE : 0; ... } Confirming what we expect that internal flags are in fact internal to socket side. Fixes: d3b18ad31f93 ("tls: add bpf support to sk_msg handling") Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann include/linux/socket.h | 1 + include/net/tls.h | 9 +++++++++ net/ipv4/tcp_bpf.c | 13 ++++++++++++- net/tls/tls_sw.c | 43 ++++++++++++++++++++++++++++++------------- 4 files changed, 52 insertions(+), 14 deletions(-) commit a136678c0bdbb650daff5df5eec1dab960e074a7 Author: John Fastabend Date: Thu Dec 20 11:35:34 2018 -0800 bpf: sk_msg, zap ingress queue on psock down In addition to releasing any cork'ed data on a psock when the psock is removed we should also release any skb's in the ingress work queue. Otherwise the skb's eventually get free'd but late in the tear down process so we see the WARNING due to non-zero sk_forward_alloc. void sk_stream_kill_queues(struct sock *sk) { ... WARN_ON(sk->sk_forward_alloc); ... } Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann net/core/skmsg.c | 1 + 1 file changed, 1 insertion(+) commit 552de91068828daef50a227a665068cf8dde835e Author: John Fastabend Date: Thu Dec 20 11:35:33 2018 -0800 bpf: sk_msg, fix socket data_ready events When a skb verdict program is in-use and either another BPF program redirects to that socket or the new SK_PASS support is used the data_ready callback does not wake up application. Instead because the stream parser/verdict is using the sk data_ready callback we wake up the stream parser/verdict block. Fix this by adding a helper to check if the stream parser block is enabled on the sk and if so call the saved pointer which is the upper layers wake up function. This fixes application stalls observed when an application is waiting for data in a blocking read(). Fixes: d829e9c4112b ("tls: convert to generic sk_msg interface") Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann include/linux/skmsg.h | 8 ++++++++ net/core/skmsg.c | 6 +++--- net/ipv4/tcp_bpf.c | 2 +- 3 files changed, 12 insertions(+), 4 deletions(-) commit 51199405f967207de372d9b60989eb87d7ae8809 Author: John Fastabend Date: Thu Dec 20 11:35:32 2018 -0800 bpf: skb_verdict, support SK_PASS on RX BPF path Add SK_PASS verdict support to SK_SKB_VERDICT programs. Now that support for redirects exists we can implement SK_PASS as a redirect to the same socket. This simplifies the BPF programs and avoids an extra map lookup on RX path for simple visibility cases. Further, reduces user (BPF programmer in this context) confusion when their program drops skb due to lack of support. Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann net/core/skmsg.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) commit 7a69c0f250568e6ab72f401b2c69aa0e666c94f2 Author: John Fastabend Date: Thu Dec 20 11:35:31 2018 -0800 bpf: skmsg, replace comments with BUILD bug Enforce comment on structure layout dependency with a BUILD_BUG_ON to ensure the condition is maintained. Suggested-by: Daniel Borkmann Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann include/linux/skmsg.h | 4 +--- net/core/filter.c | 3 +++ 2 files changed, 4 insertions(+), 3 deletions(-) commit bc1b4f013b5029b4c8b63fb9ba8d084119486d7b Author: John Fastabend Date: Thu Dec 20 11:35:30 2018 -0800 bpf: sk_msg, improve offset chk in _is_valid_access The check for max offset in sk_msg_is_valid_access uses sizeof() which is incorrect because it would allow accessing possibly past the end of the struct in the padded case. Further, it doesn't preclude accessing any padding that may be added in the middle of a struct. All told this makes it fragile to rely on. To fix this explicitly check offsets with fields using the bpf_ctx_range() and bpf_ctx_range_till() macros. For reference the current structure layout looks as follows (reported by pahole) struct sk_msg_md { union { void * data; /* 8 */ }; /* 0 8 */ union { void * data_end; /* 8 */ }; /* 8 8 */ __u32 family; /* 16 4 */ __u32 remote_ip4; /* 20 4 */ __u32 local_ip4; /* 24 4 */ __u32 remote_ip6[4]; /* 28 16 */ __u32 local_ip6[4]; /* 44 16 */ __u32 remote_port; /* 60 4 */ /* --- cacheline 1 boundary (64 bytes) --- */ __u32 local_port; /* 64 4 */ __u32 size; /* 68 4 */ /* size: 72, cachelines: 2, members: 10 */ /* last cacheline: 8 bytes */ }; So there should be no padding at the moment but fixing this now prevents future errors. Reported-by: Alexei Starovoitov Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann net/core/filter.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) commit 9ee79a65d176e5815877aa148acc956e4cc90c53 Author: John Fastabend Date: Thu Dec 20 11:35:29 2018 -0800 bpf: sk_msg, fix sk_msg_md access past end test Currently, the test to ensure reads past the end of the sk_msg_md data structure fail is incorrectly expecting success. Fix this typo and use correct expected error. Fixes: 945a47d87cee ("bpf: sk_msg, add tests for size field") Reported-by: Alexei Starovoitov Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann tools/testing/selftests/bpf/test_verifier.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 64711f9a47d4defa90417f5e8db8ed0060bc3275 Author: Max Filippov Date: Wed Dec 19 19:48:37 2018 -0800 xtensa: implement jump_label support Use 3-byte 'nop' and 'j' instructions that are always present. Don't let assembler mark a spot right after patchable 'j' instruction as unreachable and later put literals or padding bytes there. Add separate implementations of patch_text for SMP and UP cases, avoiding use of atomics on UP. Signed-off-by: Max Filippov .../features/core/jump-labels/arch-support.txt | 2 +- arch/xtensa/Kconfig | 1 + arch/xtensa/include/asm/jump_label.h | 65 ++++++++++++++ arch/xtensa/kernel/Makefile | 1 + arch/xtensa/kernel/jump_label.c | 99 ++++++++++++++++++++++ 5 files changed, 167 insertions(+), 1 deletion(-) commit 77ea5f4cbe2084db9ab021ba73fb7eadf1610884 Author: Jesper Dangaard Brouer Date: Wed Dec 19 17:00:23 2018 +0100 bpf/cpumap: make sure frame_size for build_skb is aligned if headroom isn't The frame_size passed to build_skb must be aligned, else it is possible that the embedded struct skb_shared_info gets unaligned. For correctness make sure that xdpf->headroom in included in the alignment. No upstream drivers can hit this, as all XDP drivers provide an aligned headroom. This was discovered when playing with implementing XDP support for mvneta, which have a 2 bytes DSA header, and this Marvell ARM64 platform didn't like doing atomic operations on an unaligned skb_shinfo(skb)->dataref addresses. Fixes: 1c601d829ab0 ("bpf: cpumap xdp_buff to skb conversion and allocation") Signed-off-by: Jesper Dangaard Brouer Signed-off-by: Daniel Borkmann kernel/bpf/cpumap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 842a9c837e2017127250a93204368f13e660ed9d Author: Or Gerlitz Date: Tue Dec 11 18:10:43 2018 +0200 IB/mlx5: Simplify netdev unbinding When dealing with netdev unregister events, we just need to know that this is our currently bounded netdev. There's no need to do any further checks/queries. This patch doesn't change any functionality. Signed-off-by: Or Gerlitz Reviewed-by: Mark Bloch Signed-off-by: Saeed Mahameed Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/mlx5/main.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) commit 641d1207d2ed0ef21ff5ad61e067d630028e2f62 Author: Michael Guralnik Date: Sun Dec 9 11:58:06 2018 +0200 IB/core: Move query port to ioctl Add a method for query port under the uverbs global methods. Current ib_port_attr struct is passed as a single attribute and port_cap_flags2 is added as a new attribute to the function. Signed-off-by: Michael Guralnik Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/core/uverbs.h | 25 +++++++ drivers/infiniband/core/uverbs_cmd.c | 53 +-------------- drivers/infiniband/core/uverbs_std_types_device.c | 79 ++++++++++++++++++++++- include/uapi/rdma/ib_user_ioctl_cmds.h | 7 ++ include/uapi/rdma/ib_user_ioctl_verbs.h | 7 ++ 5 files changed, 118 insertions(+), 53 deletions(-) commit 4fa2813d26c82680216e535c18a690ca0c4e860a Author: Michael Guralnik Date: Sun Dec 9 11:58:05 2018 +0200 RDMA/nldev: Expose port_cap_flags2 port_cap_flags2 represents IBTA PortInfo:CapabilityMask2. The field safely extends the RDMA_NLDEV_ATTR_CAP_FLAGS operand as it was exported as 64 bit to allow this kind of extension. Signed-off-by: Michael Guralnik Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/core/nldev.c | 9 ++++++--- include/uapi/rdma/rdma_netlink.h | 3 +++ 2 files changed, 9 insertions(+), 3 deletions(-) commit 2e8039c656224b4a21e1947f45946d32a59bae53 Author: Michael Guralnik Date: Sun Dec 9 11:58:04 2018 +0200 IB/core: uverbs copy to struct or zero helper Add a helper to zero fill fields before copying data to UVERBS_ATTR_STRUCT. As UVERBS_ATTR_STRUCT can be used as an extensible struct, we want to make sure that if the user supplies us with a struct that has new fields that we are not aware of, we return them zeroed to the user. This helper should be used when using UVERBS_ATTR_STRUCT for an extendable data structure and there is a need to make sure that extended members of the struct, that the kernel doesn't handle, are returned zeroed to the user. This is needed due to the fact that UVERBS_ATTR_STRUCT allows non-zero values for members after 'last' member. Signed-off-by: Michael Guralnik Reviewed-by: Majd Dibbiny Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/core/uverbs_ioctl.c | 11 +++++++++++ include/rdma/uverbs_ioctl.h | 8 ++++++++ 2 files changed, 19 insertions(+) commit 24ad02c48c69c37427cc3412f6597493091eca3c Author: Andreas Klinger Date: Fri Dec 14 20:48:25 2018 +0100 gpio-omap.txt: add reg and interrupts properties Document properties reg and interrupts for OMAP GPIO controller bindings Also add unit address in node name of the example Signed-off-by: Andreas Klinger Acked-by: Linus Walleij Signed-off-by: Rob Herring Documentation/devicetree/bindings/gpio/gpio-omap.txt | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) commit 485773d3c5c7fa1462c0a6b36187922c2dcba914 Author: Lubomir Rintel Date: Mon Dec 3 12:47:10 2018 +0100 dt-bindings: mrvl,intc: fix a trivial typo s/whold/whole/. Signed-off-by: Lubomir Rintel Signed-off-by: Rob Herring Documentation/devicetree/bindings/interrupt-controller/mrvl,intc.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f55c3ec42a97bca408f0208ec08e3382340c7be7 Author: Yuval Shaia Date: Fri Dec 14 08:05:49 2018 -0800 IB/rxe: Reuse code which sets port state Same code is executed in both rxe_param_set_add and rxe_notify functions. Make one function and call it from both places. Since both callers already have a rxe object use it directly instead of deriving it from the net device. Signed-off-by: Yuval Shaia Reviewed-by: Steve Wise   Reviewed-by: Bart Van Assche Signed-off-by: Jason Gunthorpe drivers/infiniband/sw/rxe/rxe.h | 1 + drivers/infiniband/sw/rxe/rxe_net.c | 13 +++++++++---- drivers/infiniband/sw/rxe/rxe_sysfs.c | 18 +----------------- 3 files changed, 11 insertions(+), 21 deletions(-) commit d5108e69fe013ff47ab815b849caba9cc33ca1e5 Author: Parav Pandit Date: Fri Dec 14 00:32:42 2018 -0600 IB/rxe: Make counters thread safe Current rxe device counters are not thread safe. When multiple QPs are used, they can be racy. Make them thread safe by making it atomic64. Fixes: 0b1e5b99a48b ("IB/rxe: Add port protocol stats") Signed-off-by: Parav Pandit Signed-off-by: Jason Gunthorpe drivers/infiniband/sw/rxe/rxe_hw_counters.c | 2 +- drivers/infiniband/sw/rxe/rxe_verbs.h | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) commit 6e3722baac048fdf95b867c5ee7e270718e8630d Author: Yishai Hadas Date: Wed Dec 19 16:28:15 2018 +0200 IB/mlx5: Use the correct commands for UMEM and UCTX allocation During testing the command format was changed to close a security hole. Revise the driver to use the command format that will actually be supported in GA firmware. Both the UMEM and UCTX are intended only for use by the kernel and cannot be executed using a general command. Since the UMEM and CTX are not part of the general object the caps bits were moved to be some log_xxx location in the general HCA caps. The firmware code was adapted as well to match the above. Fixes: a8b92ca1b0e5 ("IB/mlx5: Introduce DEVX") Signed-off-by: Yishai Hadas Reviewed-by: Achiad Shochat Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/mlx5/devx.c | 34 ++++++++++----------- include/linux/mlx5/mlx5_ifc.h | 62 ++++++++++++++++++++++++++------------- 2 files changed, 57 insertions(+), 39 deletions(-) commit 425518cc5ede0d7a71886816368e4bef60e418db Author: Yishai Hadas Date: Wed Dec 19 16:28:11 2018 +0200 IB/mlx5: Use uid as part of alloc/dealloc transport domain Use uid as part of alloc/dealloc transport domain to let firmware manages the resources correctly. Fixes: d2d19121ae2f ("IB/mlx5: Set uid as part of TD commands") Signed-off-by: Yishai Hadas Reviewed-by: Artemy Kovalyov Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/mlx5/cmd.c | 2 ++ 1 file changed, 2 insertions(+) commit 1f000e1bfff42e960e5d4562213a95016acc712f Author: Nathan Chancellor Date: Thu Dec 20 12:38:56 2018 -0700 ACPI / tables: Add an ifdef around amlcode and dsdt_amlcode Clang warns: drivers/acpi/tables.c:715:14: warning: unused variable 'amlcode' [-Wunused-variable] static void *amlcode __attribute__ ((weakref("AmlCode"))); ^ drivers/acpi/tables.c:716:14: warning: unused variable 'dsdt_amlcode' [-Wunused-variable] static void *dsdt_amlcode __attribute__ ((weakref("dsdt_aml_code"))); ^ 2 warnings generated. The only uses of these variables are hiddem behind CONFIG_ACPI_CUSTOM_DSDT so do the same thing here. Fixes: 82e4eb4e9653 (ACPI / tables: add DSDT AmlCode new declaration name support) Signed-off-by: Nathan Chancellor Signed-off-by: Rafael J. Wysocki drivers/acpi/tables.c | 2 ++ 1 file changed, 2 insertions(+) commit 98cff8b23ed1c763a029ee81ea300df0d153d07d Author: Lenny Szubowicz Date: Wed Dec 19 11:50:52 2018 -0500 ACPI/APEI: Clear GHES block_status before panic() In __ghes_panic() clear the block status in the APEI generic error status block for that generic hardware error source before calling panic() to prevent a second panic() in the crash kernel for exactly the same fatal error. Otherwise ghes_probe(), running in the crash kernel, would see an unhandled error in the APEI generic error status block and panic again, thereby precluding any crash dump. Signed-off-by: Lenny Szubowicz Signed-off-by: David Arcari Tested-by: Tyler Baicar Acked-by: Borislav Petkov Signed-off-by: Rafael J. Wysocki drivers/acpi/apei/ghes.c | 2 ++ 1 file changed, 2 insertions(+) commit ed50edfb72352c4bee489b5b27418a30177cf38f Merge: bd1c24ccf9eb 71bef2fd583b Author: Jason Gunthorpe Date: Thu Dec 20 13:24:50 2018 -0700 Merge branch 'mlx5-next' into rdma.git From git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux mlx5 updates taken for dependencies on following patches. * branche 'mlx5-next': (23 commits) IB/mlx5: Introduce uid as part of alloc/dealloc transport domain net/mlx5: Add shared Q counter bits net/mlx5: Continue driver initialization despite debugfs failure net/mlx5: Fold the modify lag code into function net/mlx5: Add lag affinity info to log net/mlx5: Split the activate lag function into two routines net/mlx5: E-Switch, Introduce flow counter affinity IB/mlx5: Unify e-switch representors load approach between uplink and VFs net/mlx5: Use lowercase 'X' for hex values net/mlx5: Remove duplicated include from eswitch.c net/mlx5: Remove the get protocol device interface entry net/mlx5: Support extended destination format in flow steering command net/mlx5: E-Switch, Change vhca id valid bool field to bit flag net/mlx5: Introduce extended destination fields net/mlx5: Revise gre and nvgre key formats net/mlx5: Add monitor commands layout and event data net/mlx5: Add support for plugged-disabled cable status in PME net/mlx5: Add support for PCIe power slot exceeded error in PME net/mlx5: Rework handling of port module events net/mlx5: Move flow counters data structures from flow steering header ... commit 643bae17fd4ccb503cdc6d99c1b4fbd2c4ca6a78 Author: Steve Douthit Date: Thu Dec 6 15:50:43 2018 +0000 ixgbe: use mii_bus to handle MII related ioctls Use the mii_bus callbacks to address the entire clause 22/45 address space. Enables userspace to poke switch registers instead of a single PHY address. The ixgbe firmware may be polling PHYs in a way that is not protected by the mii_bus lock. This isn't new behavior, but as Andrew Lunn pointed out there are more addresses available for conflicts. Signed-off-by: Stephen Douthit Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) commit 8fa10ef01260937eb540b4e9bbc3efa023595993 Author: Steve Douthit Date: Thu Dec 6 15:50:39 2018 +0000 ixgbe: register a mdiobus Most dsa devices expect a 'struct mii_bus' pointer to talk to switches via the MII interface. While this works for dsa devices, it will not work safely with Linux PHYs in all configurations since the firmware of the ixgbe device may be polling some PHY addresses in the background. Signed-off-by: Stephen Douthit Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/Kconfig | 1 + drivers/net/ethernet/intel/ixgbe/ixgbe.h | 2 + drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 5 + drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c | 299 ++++++++++++++++++++++++++ drivers/net/ethernet/intel/ixgbe/ixgbe_phy.h | 2 + 5 files changed, 309 insertions(+) commit 1fb3a7a75e2efcc83ef21f2434069cddd6fae6f5 Author: Kai-Heng Feng Date: Mon Dec 3 13:54:38 2018 +0800 igb: Fix an issue that PME is not enabled during runtime suspend I210 ethernet card doesn't wakeup when a cable gets plugged. It's because its PME is not set. Since commit 42eca2302146 ("PCI: Don't touch card regs after runtime suspend D3"), if the PCI state is saved, pci_pm_runtime_suspend() stops calling pci_finish_runtime_suspend(), which enables the PCI PME. To fix the issue, let's not to save PCI states when it's runtime suspend, to let the PCI subsystem enables PME. Fixes: 42eca2302146 ("PCI: Don't touch card regs after runtime suspend D3") Signed-off-by: Kai-Heng Feng Tested-by: Aaron Brown Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/igb/igb_main.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit eec903769b4ea476591ffff73bb7359f14f38c51 Author: Young Xiao Date: Thu Nov 29 01:54:10 2018 +0000 ice: Do not enable NAPI on q_vectors that have no rings If ice driver has q_vectors w/ active NAPI that has no rings, then this will result in a divide by zero error. To correct it I am updating the driver code so that we only support NAPI on q_vectors that have 1 or more rings allocated to them. See commit 13a8cd191a2b ("i40e: Do not enable NAPI on q_vectors that have no rings") for detail. Signed-off-by: Young Xiao Acked-by: Anirudh Venkataramanan Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/ice/ice_main.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) commit 9a2d57a7a0626783a62d205f255d8227b212c14b Author: Miroslav Lichvar Date: Wed Nov 28 17:07:49 2018 +0100 i40e: extend PTP gettime function to read system clock This adds support for the PTP_SYS_OFFSET_EXTENDED ioctl. Cc: Richard Cochran Cc: Jacob Keller Signed-off-by: Miroslav Lichvar Tested-by: Andrew Bowers Acked-by: Jacob Keller Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/i40e/i40e_ptp.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) commit 31389b53b3e0b535867af9090a5d19ec64768d55 Author: Konstantin Khorenko Date: Fri Nov 23 19:10:28 2018 +0300 i40e: define proper net_device::neigh_priv_len Out of bound read reported by KASan. i40iw_net_event() reads unconditionally 16 bytes from neigh->primary_key while the memory allocated for "neighbour" struct is evaluated in neigh_alloc() as tbl->entry_size + dev->neigh_priv_len where "dev" is a net_device. But the driver does not setup dev->neigh_priv_len and we read beyond the neigh entry allocated memory, so the patch in the next mail fixes this. Signed-off-by: Konstantin Khorenko Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/i40e/i40e_main.c | 3 +++ 1 file changed, 3 insertions(+) commit cd0d465bb697a9c7bf66a9fe940f7981232f1676 Author: YueHaibing Date: Mon Nov 19 20:48:19 2018 +0800 e100: Fix passing zero to 'PTR_ERR' warning in e100_load_ucode_wait Fix a static code checker warning: drivers/net/ethernet/intel/e100.c:1349 e100_load_ucode_wait() warn: passing zero to 'PTR_ERR' Signed-off-by: YueHaibing Tested-by: Aaron Brown Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/e100.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 2be09de7d6a06f58e768de1255a687c9aaa66606 Merge: 44a7b3b6e3a4 1d51b4b1d3f2 Author: David S. Miller Date: Thu Dec 20 10:53:28 2018 -0800 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Lots of conflicts, by happily all cases of overlapping changes, parallel adds, things of that nature. Thanks to Stephen Rothwell, Saeed Mahameed, and others for their guidance in these resolutions. Signed-off-by: David S. Miller commit bad87ee82f74707913a27f16d40cd8a1c340b47e Author: Vinicius Costa Gomes Date: Fri Nov 16 16:19:24 2018 -0800 Documentation: igb: Add a section about CBS Add some pointers to the definition of the CBS algorithm, and some notes about the limits of its implementation in the i210 family of controllers. Signed-off-by: Vinicius Costa Gomes Tested-by: Aaron Brown Signed-off-by: Jeff Kirsher Documentation/networking/device_drivers/intel/igb.rst | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) commit 6f9ae17530f996e90268dae5ee843e432e40ccb3 Author: Jesus Sanchez-Palencia Date: Fri Nov 16 16:19:23 2018 -0800 igb: Change RXPBSIZE size when setting Qav mode Section 4.5.9 of the datasheet says that the total size of all packet buffers combined (TxPB 0 + 1 + 2 + 3 + RxPB + BMC2OS + OS2BMC) must not exceed 60KB. Today we are configuring a total of 62KB, so reduce the RxPB from 32KB to 30KB in order to respect that. The choice of changing RxPBSIZE here is mainly because it seems more correct to give more priority to the transmit packet buffers over the receiver ones when running in Qav mode. Also, the BMC2OS and OS2BMC sizes are already too short. Signed-off-by: Jesus Sanchez-Palencia Tested-by: Aaron Brown Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/igb/e1000_defines.h | 1 + drivers/net/ethernet/intel/igb/igb_main.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) commit 00203ba40d40d7f33857416adfb18adaf0e40123 Author: Jens Axboe Date: Thu Dec 20 08:50:58 2018 -0700 kyber: use sbitmap add_wait_queue/list_del wait helpers sbq_wake_ptr() checks sbq->ws_active to know if it needs to loop the wait indexes or not. This requires the use of the sbitmap waitqueue wrappers, but kyber doesn't use those for its domain token waitqueue handling. Convert kyber to use the helpers. This fixes a hang with waiting for domain tokens. Fixes: 5d2ee7122c73 ("sbitmap: optimize wakeup check") Tested-by: Ming Lei Reported-by: Ming Lei Reviewed-by: Omar Sandoval Signed-off-by: Jens Axboe block/kyber-iosched.c | 28 +++++++++++++++------------- 1 file changed, 15 insertions(+), 13 deletions(-) commit 9f6b7ef6c3ebe35be77b0ae3cf12e4d25ae80420 Author: Jens Axboe Date: Thu Dec 20 08:49:00 2018 -0700 sbitmap: add helpers for add/del wait queue handling After commit 5d2ee7122c73, users of sbitmap that need wait queue handling must use the provided helpers. But we only added prepare_to_wait()/finish_wait() style helpers, add the equivalent add_wait_queue/list_del wrappers as we.. This is needed to ensure kyber plays by the sbitmap waitqueue rules. Tested-by: Ming Lei Reviewed-by: Omar Sandoval Signed-off-by: Jens Axboe include/linux/sbitmap.h | 16 ++++++++++++++-- lib/sbitmap.c | 30 ++++++++++++++++++++++++++---- 2 files changed, 40 insertions(+), 6 deletions(-) commit 59361316afcb08569af21e1af83e89c7051c055a Author: Jeff Kirsher Date: Thu Aug 2 10:13:10 2018 -0700 igb: reduce CPU0 latency when updating statistics This change is based off of the work and suggestion of Jan Jablonsky . The Watchdog workqueue in igb driver is scheduled every 2s for each network interface. That includes updating a statistics protected by spinlock. Function igb_update_stats in this case will be protected against preemption. According to number of a statistics registers (cca 60), processing this function might cause additional cpu load on CPU0. In case of statistics spinlock may be replaced with mutex, which reduce latency on CPU0. CC: Bernhard Kaindl CC: Jan Jablonsky Signed-off-by: Jeff Kirsher Tested-by: Aaron Brown Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/igb/igb.h | 2 +- drivers/net/ethernet/intel/igb/igb_ethtool.c | 4 ++-- drivers/net/ethernet/intel/igb/igb_main.c | 14 +++++++------- 3 files changed, 10 insertions(+), 10 deletions(-) commit 2122b40580dd9d0620398739c773d07a7b7939d0 Author: Noralf Trønnes Date: Thu Dec 20 19:13:09 2018 +0100 fbdev: fbcon: Fix unregister crash when more than one framebuffer When unregistering fbdev using unregister_framebuffer(), any bound console will unbind automatically. This is working fine if this is the only framebuffer, resulting in a switch to the dummy console. However if there is a fb0 and I unregister fb1 having a bound console, I eventually get a crash. The fastest way for me to trigger the crash is to do a reboot, resulting in this splat: [ 76.478825] WARNING: CPU: 0 PID: 527 at linux/kernel/workqueue.c:1442 __queue_work+0x2d4/0x41c [ 76.478849] Modules linked in: raspberrypi_hwmon gpio_backlight backlight bcm2835_rng rng_core [last unloaded: tinydrm] [ 76.478916] CPU: 0 PID: 527 Comm: systemd-udevd Not tainted 4.20.0-rc4+ #4 [ 76.478933] Hardware name: BCM2835 [ 76.478949] Backtrace: [ 76.478995] [] (dump_backtrace) from [] (show_stack+0x20/0x24) [ 76.479022] r6:00000000 r5:c0bc73be r4:00000000 r3:6fb5bf81 [ 76.479060] [] (show_stack) from [] (dump_stack+0x20/0x28) [ 76.479102] [] (dump_stack) from [] (__warn+0xec/0x12c) [ 76.479134] [] (__warn) from [] (warn_slowpath_null+0x4c/0x58) [ 76.479165] r9:c0eb6944 r8:00000001 r7:c0e927f8 r6:c0bc73be r5:000005a2 r4:c0139e84 [ 76.479197] [] (warn_slowpath_null) from [] (__queue_work+0x2d4/0x41c) [ 76.479222] r6:d7666a00 r5:c0e918ee r4:dbc4e700 [ 76.479251] [] (__queue_work) from [] (queue_work_on+0x60/0x88) [ 76.479281] r10:c0496bf8 r9:00000100 r8:c0e92ae0 r7:00000001 r6:d9403700 r5:d7666a00 [ 76.479298] r4:20000113 [ 76.479348] [] (queue_work_on) from [] (cursor_timer_handler+0x30/0x54) [ 76.479374] r7:d8a8fabc r6:c0e08088 r5:d8afdc5c r4:d8a8fabc [ 76.479413] [] (cursor_timer_handler) from [] (call_timer_fn+0x100/0x230) [ 76.479435] r4:c0e9192f r3:d758a340 [ 76.479465] [] (call_timer_fn) from [] (expire_timers+0x10c/0x12c) [ 76.479495] r10:40000000 r9:c0e9192f r8:c0e92ae0 r7:d8afdccc r6:c0e19280 r5:c0496bf8 [ 76.479513] r4:d8a8fabc [ 76.479541] [] (expire_timers) from [] (run_timer_softirq+0xa8/0x184) [ 76.479570] r9:00000001 r8:c0e19280 r7:00000000 r6:c0e08088 r5:c0e1a3e0 r4:c0e19280 [ 76.479603] [] (run_timer_softirq) from [] (__do_softirq+0x1ac/0x3fc) [ 76.479632] r10:c0e91680 r9:d8afc020 r8:0000000a r7:00000100 r6:00000001 r5:00000002 [ 76.479650] r4:c0eb65ec [ 76.479686] [] (__do_softirq) from [] (irq_exit+0xe8/0x168) [ 76.479716] r10:d8d1a9b0 r9:d8afc000 r8:00000001 r7:d949c000 r6:00000000 r5:c0e8b3f0 [ 76.479734] r4:00000000 [ 76.479764] [] (irq_exit) from [] (__handle_domain_irq+0x94/0xb0) [ 76.479793] [] (__handle_domain_irq) from [] (bcm2835_handle_irq+0x3c/0x48) [ 76.479823] r8:d8afdebc r7:d8afddfc r6:ffffffff r5:c0e089f8 r4:d8afddc8 r3:d8afddc8 [ 76.479851] [] (bcm2835_handle_irq) from [] (__irq_svc+0x70/0x98) The problem is in the console rebinding in fbcon_fb_unbind(). It uses the virtual console index as the new framebuffer index to bind the console(s) to. The correct way is to use the con2fb_map lookup table to find the framebuffer index. Fixes: cfafca8067c6 ("fbdev: fbcon: console unregistration from unregister_framebuffer") Signed-off-by: Noralf Trønnes Reviewed-by: Mikulas Patocka Acked-by: Daniel Vetter Signed-off-by: Bartlomiej Zolnierkiewicz drivers/video/fbdev/core/fbcon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e9462fffddad94ee4cb50f6000989133bd15fb96 Author: Geert Uytterhoeven Date: Thu Dec 20 19:13:09 2018 +0100 fbdev: Remove depends on HAS_DMA in case of platform dependency Remove dependencies on HAS_DMA where a Kconfig symbol depends on another symbol that implies HAS_DMA, and, optionally, on "|| COMPILE_TEST". In most cases this other symbol is an architecture or platform specific symbol, or PCI. Generic symbols and drivers without platform dependencies keep their dependencies on HAS_DMA, to prevent compiling subsystems or drivers that cannot work anyway. This simplifies the dependencies, and allows to improve compile-testing. Signed-off-by: Geert Uytterhoeven Reviewed-by: Mark Brown Acked-by: Robin Murphy Signed-off-by: Bartlomiej Zolnierkiewicz drivers/video/fbdev/Kconfig | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit da2648390ce3d409218b6bbbf2386d8ddeec2265 Author: Lubomir Rintel Date: Thu Dec 20 19:13:09 2018 +0100 pxa168fb: trivial typo fix A missing space in an error message. Signed-off-by: Lubomir Rintel Cc: Jiri Kosina Signed-off-by: Bartlomiej Zolnierkiewicz drivers/video/fbdev/pxa168fb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5c29085a724fb8b84bb492a6e2645e28d9bc3dae Author: Wen Yang Date: Thu Dec 20 19:13:08 2018 +0100 fbdev: fsl-diu: remove redundant null check on cmap The null check on &info->cmap is redundant since cmap is a struct inside fb_info and can never be null, so the check is always true. We may remove it. Signed-off-by: Wen Yang Acked-by: Timur Tabi Cc: zhong.weidong@zte.com.cn Signed-off-by: Bartlomiej Zolnierkiewicz drivers/video/fbdev/fsl-diu-fb.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 452f2d4934d23f32cd9246bc52cf2c0b80560e2f Author: Yangtao Li Date: Thu Dec 20 19:13:08 2018 +0100 fbdev: omap2: omapfb: convert to DEFINE_SHOW_ATTRIBUTE Use DEFINE_SHOW_ATTRIBUTE macro to simplify the code. Signed-off-by: Yangtao Li Cc: Fengguang Wu Cc: Mauro Carvalho Chehab Signed-off-by: Bartlomiej Zolnierkiewicz drivers/video/fbdev/omap2/omapfb/dss/core.c | 18 ++++-------------- 1 file changed, 4 insertions(+), 14 deletions(-) commit e0f5628bf2c163a815bb728fa7899e8dc0a4a82c Author: Colin Ian King Date: Thu Dec 20 19:13:08 2018 +0100 fbdev: uvesafb: fix spelling mistake "memoery" -> "memory" There is a spelling mistake in the module parameter description, fix it. Signed-off-by: Colin Ian King Cc: Michal Januszewski Signed-off-by: Bartlomiej Zolnierkiewicz drivers/video/fbdev/uvesafb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3d8b1933eb1c3c94ef8667996dbff6994d5d552f Author: Peter Rosin Date: Thu Dec 20 19:13:08 2018 +0100 fbdev: fbmem: add config option to center the bootup logo If there are extra logos (CONFIG_FB_LOGO_EXTRA) the heights of these extra logos are not considered when centering the first logo vertically. Signed-off-by: Peter Rosin Signed-off-by: Bartlomiej Zolnierkiewicz drivers/video/fbdev/core/fbmem.c | 25 ++++++++++++++++++++++++- drivers/video/logo/Kconfig | 9 +++++++++ 2 files changed, 33 insertions(+), 1 deletion(-) commit e41f184d83a3a1e12abbf00a829d9de579d6b0fe Author: Peter Rosin Date: Thu Dec 20 19:13:08 2018 +0100 fbdev: fbmem: make fb_show_logo_line return the end instead of the height In preparation for allowing centering of the bootup logo, make fb_show_logo_line return where the next free framebuffer line is, instead of returning the height of the shown logo. Signed-off-by: Peter Rosin Signed-off-by: Bartlomiej Zolnierkiewicz drivers/video/fbdev/core/fbmem.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 2607391882fca37463187e7f2a9c76dec286947e Author: YueHaibing Date: Thu Dec 20 19:13:08 2018 +0100 video: fbdev: pxafb: Fix "WARNING: invalid free of devm_ allocated data" 'info->modes' got allocated with devm_kcalloc in of_get_pxafb_display. This gives this error message: ./drivers/video/fbdev/pxafb.c:2238:2-7: WARNING: invalid free of devm_ allocated data Fixes: c8f96304ec8b4 ("video: fbdev: pxafb: switch to devm_* API") Cc: stable@kernel.org [v4.19+] Signed-off-by: YueHaibing Reviewed-by: Daniel Mack Cc: Robert Jarzmik Signed-off-by: Bartlomiej Zolnierkiewicz drivers/video/fbdev/pxafb.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit f75df8d4b4fabfad7e3cba2debfad12741c6fde7 Author: Peter Rosin Date: Thu Dec 20 19:13:07 2018 +0100 fbdev: fbmem: behave better with small rotated displays and many CPUs Blitting an image with "negative" offsets is not working since there is no clipping. It hopefully just crashes. For the bootup logo, there is protection so that blitting does not happen as the image is drawn further and further to the right (ROTATE_UR) or further and further down (ROTATE_CW). There is however no protection when drawing in the opposite directions (ROTATE_UD and ROTATE_CCW). Add back this protection. The regression is 20-odd years old but the mindless warning-killing mentality displayed in commit 34bdb666f4b2 ("fbdev: fbmem: remove positive test on unsigned values") is also to blame, methinks. Fixes: 448d479747b8 ("fbdev: fb_do_show_logo() updates") Signed-off-by: Peter Rosin Cc: Tomi Valkeinen Cc: Fabian Frederick Cc: Geert Uytterhoeven cc: Geoff Levand Cc: James Simmons Signed-off-by: Bartlomiej Zolnierkiewicz drivers/video/fbdev/core/fbmem.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit fdac751355cd76e049f628afe6acb8ff4b1399f7 Author: Alexey Khoroshilov Date: Thu Dec 20 19:13:07 2018 +0100 video: clps711x-fb: release disp device node in probe() clps711x_fb_probe() increments refcnt of disp device node by of_parse_phandle() and leaves it undecremented on both successful and error paths. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov Cc: Alexander Shiyan Signed-off-by: Bartlomiej Zolnierkiewicz drivers/video/fbdev/clps711x-fb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit b4a1ed0cd18b771e4279b4eb9cf39b565560eea6 Author: Rob Clark Date: Thu Dec 20 19:13:07 2018 +0100 fbdev: make FB_BACKLIGHT a tristate BACKLIGHT_CLASS_DEVICE is already tristate, but a dependency FB_BACKLIGHT prevents it from being built as a module. There doesn't seem to be any particularly good reason for this, so switch FB_BACKLIGHT over to tristate. Signed-off-by: Rob Clark Tested-by: Arnd Bergmann Cc: Simon Horman Cc: Geert Uytterhoeven Cc: Laurent Pinchart Cc: Daniel Vetter Cc: Ulf Magnusson Cc: Randy Dunlap Cc: Hans de Goede Signed-off-by: Bartlomiej Zolnierkiewicz drivers/video/fbdev/Kconfig | 2 +- drivers/video/fbdev/core/fbsysfs.c | 8 ++++---- include/linux/fb.h | 2 +- include/uapi/linux/fb.h | 2 -- 4 files changed, 6 insertions(+), 8 deletions(-) commit c143a559b073aeea688b9bb7c5b46f3cf322d569 Author: Dan Carpenter Date: Thu Dec 20 19:13:07 2018 +0100 udlfb: fix some inconsistent NULL checking In the current kernel, then kzalloc() can't fail for small allocations, but if it did fail then we would have a NULL dereference in the error handling. Also in dlfb_usb_disconnect() if "info" were NULL then it would cause an Oops inside the unregister_framebuffer() function but it can't be NULL so let's remove that check. Fixes: 68a958a915ca ("udlfb: handle unplug properly") Signed-off-by: Dan Carpenter Cc: Bernie Thompson Cc: Mikulas Patocka Cc: Alexey Khoroshilov Cc: Colin Ian King Cc: Wen Yang [b.zolnierkie: added "Fixes:" tag] Signed-off-by: Bartlomiej Zolnierkiewicz drivers/video/fbdev/udlfb.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) commit adcc81f148d733b7e8e641300c5590a2cdc13bf3 Author: Paul Burton Date: Thu Dec 20 17:45:43 2018 +0000 MIPS: math-emu: Write-protect delay slot emulation pages Mapping the delay slot emulation page as both writeable & executable presents a security risk, in that if an exploit can write to & jump into the page then it can be used as an easy way to execute arbitrary code. Prevent this by mapping the page read-only for userland, and using access_process_vm() with the FOLL_FORCE flag to write to it from mips_dsemul(). This will likely be less efficient due to copy_to_user_page() performing cache maintenance on a whole page, rather than a single line as in the previous use of flush_cache_sigtramp(). However this delay slot emulation code ought not to be running in any performance critical paths anyway so this isn't really a problem, and we can probably do better in copy_to_user_page() anyway in future. A major advantage of this approach is that the fix is small & simple to backport to stable kernels. Reported-by: Andy Lutomirski Signed-off-by: Paul Burton Fixes: 432c6bacbd0c ("MIPS: Use per-mm page to execute branch delay slot instructions") Cc: stable@vger.kernel.org # v4.8+ Cc: linux-mips@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: Rich Felker Cc: David Daney arch/mips/kernel/vdso.c | 4 ++-- arch/mips/math-emu/dsemul.c | 38 ++++++++++++++++++++------------------ 2 files changed, 22 insertions(+), 20 deletions(-) commit b49d564344f773d8afee982153c8493e5f2eaf38 Author: Paul Gortmaker Date: Fri Dec 14 16:48:07 2018 -0500 security: integrity: partial revert of make ima_main explicitly non-modular In commit 4f83d5ea643a ("security: integrity: make ima_main explicitly non-modular") I'd removed after assuming that the function is_module_sig_enforced() was an LSM function and not a core kernel module function. Unfortunately the typical .config selections used in build testing provide an implicit presence, and so normal/typical build testing did not immediately reveal my incorrect assumption. Cc: Mimi Zohar Cc: Dmitry Kasatkin Cc: James Morris Cc: "Serge E. Hallyn" Cc: linux-ima-devel@lists.sourceforge.net Cc: linux-security-module@vger.kernel.org Reported-by: Randy Dunlap Signed-off-by: Paul Gortmaker Signed-off-by: James Morris security/integrity/ima/ima_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 883f4def8b77e6870ce42be279564cca0256c611 Merge: ca46afdb2754 89a094898489 Author: Ingo Molnar Date: Thu Dec 20 18:51:47 2018 +0100 Merge tag 'perf-core-for-mingo-4.21-20181218' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/core Pull perf/core improvements and fixes from Arnaldo Carvalho de Melo: - Implement BPF based syscall filtering in 'perf trace', using BPF maps and the augmented_raw_syscalls.c BPF proggie (Arnaldo Carvalho de Melo) - Allow specifying in .perfconfig a set of events use in 'perf trace' in addition to any other specified from the command line. This initially will be used to always use the augmented_raw_syscalls.o precompiled BPF program for getting pointer contents. (Arnaldo Carvalho de Melo) - Allow fine grained control about how the syscall output should be formatted. This will be used to allow producing the same output produced by the 'strace' tool, to then use in regression tests comparing the output of 'perf trace' with the one produced from 'strace' (Arnaldo Carvalho de Melo) - Beautify the renameat2 olddirfd, newdirfd and flags arguments (Arnaldo Carvalho de Melo) - Beautify arch_prctl 'code' syscall arg (Arnaldo Carvalho de Melo) - Beautify fadvise64 'advice' syscall arg (Arnaldo Carvalho de Melo) - Relax checks on perf-PID.map ownership, resulting in symbols in executable anonymous maps setup by JITs in things like node.js to be resolved in a 'perf top' session run by root without the need for --force to be used (Arnaldo Carvalho de Melo) - Update asm-generic/unistd.h copy (Arnaldo Carvalho de Melo) - Do not use the first and last symbols when setting up address filters in auxtrace, this fails when we don't have a symbol table, filter the entire area based on the dso size. (Adrian Hunter) - Do not use kernel headers to build libsubcmd, we shouldn't use anything from outside tools/, fixes the build with the Android NDK (Arnaldo Carvalho de Melo) - Add several prototypes for systems lacking those, such as open_memstream(), sigqueue(), fixing warnings building with Android's bionic libc that were preventing the use of -Werror there (Arnaldo Carvalho de Melo) - Use LDFLAGS in the libtraceevent build commands, allowing developers to override its values (Jiri Olsa) - Link libperf-jvmti.so with LDFLAGS variable, allowing distro packages to propagate its settings when building this library (Jiri Olsa) - cs-etm (ARM CoreSight) fixes: (Leo Yan) - Correct packets swapping in cs_etm__flush() - Avoid stale branch samples when flush packet - Remove unused 'trace_on' in cs_etm_decoder - Refactor enumeration cs_etm_sample_type - Rename CS_ETM_TRACE_ON to CS_ETM_DISCONTINUITY - Treat NO_SYNC element as trace discontinuity - Treat EO_TRACE element as trace discontinuity - Generate branch sample for exception packet - Use shebangs in the 'perf test' shell scripts, making them identifiable as shell scripts (Michael Petlan) - Avoid segfaults caused by negated options in 'perf stat' (Michael Petlan) - Fix processing of dereferenced args in bprintk events in libtracevent (Steven Rostedt) Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit fbbae71d374f24887d78631e50210b7110fffb84 Merge: 19de2fa86e69 84758d4d43e9 Author: Kalle Valo Date: Thu Dec 20 19:25:43 2018 +0200 Merge ath-next from git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git ath.git patches for 4.21. Major changes: ath10k * add amsdu support for QCA6174 monitor mode * report tx rate using the new ieee80211_tx_rate_update() API * wcn3990 support is not experimental anymore commit 8c9d90eebd23b6d40ddf4ce5df5ca2b932336a06 Author: Jerry (Fangzhi) Zuo Date: Mon Dec 17 10:32:22 2018 -0500 drm/amd/display: Fix MST dp_blank REG_WAIT timeout Need to blank stream before deallocate MST payload. [drm:generic_reg_wait [amdgpu]] *ERROR* REG_WAIT timeout 10us * 3000 tries - dce110_stream_encoder_dp_blank line:944 ------------[ cut here ]------------ WARNING: CPU: 0 PID: 2201 at /var/lib/dkms/amdgpu/18.50-690240/build/amd/amdgpu/../display/dc/dc_helper.c:249 generic_reg_wait+0xe7/0x160 [amdgpu] Call Trace: dce110_stream_encoder_dp_blank+0x11c/0x180 [amdgpu] core_link_disable_stream+0x40/0x230 [amdgpu] ? generic_reg_update_ex+0xdb/0x130 [amdgpu] dce110_reset_hw_ctx_wrap+0xb7/0x1f0 [amdgpu] dce110_apply_ctx_to_hw+0x30/0x430 [amdgpu] ? dce110_apply_ctx_for_surface+0x206/0x260 [amdgpu] dc_commit_state+0x2ba/0x4d0 [amdgpu] amdgpu_dm_atomic_commit_tail+0x297/0xd70 [amdgpu] ? amdgpu_bo_pin_restricted+0x58/0x260 [amdgpu] ? wait_for_completion_timeout+0x1f/0x120 ? wait_for_completion_interruptible+0x1c/0x160 commit_tail+0x3d/0x60 [drm_kms_helper] drm_atomic_helper_commit+0xf6/0x100 [drm_kms_helper] drm_atomic_connector_commit_dpms+0xe5/0xf0 [drm] drm_mode_obj_set_property_ioctl+0x14f/0x250 [drm] drm_mode_connector_property_set_ioctl+0x2e/0x40 [drm] drm_ioctl+0x1e0/0x430 [drm] ? drm_mode_connector_set_obj_prop+0x70/0x70 [drm] ? ep_read_events_proc+0xb0/0xb0 ? ep_scan_ready_list.constprop.18+0x1e6/0x1f0 ? timerqueue_add+0x52/0x80 amdgpu_drm_ioctl+0x49/0x80 [amdgpu] do_vfs_ioctl+0x90/0x5f0 SyS_ioctl+0x74/0x80 do_syscall_64+0x74/0x140 entry_SYSCALL_64_after_hwframe+0x3d/0xa2 ---[ end trace 3ed7b77a97d60f72 ]--- Signed-off-by: Jerry (Fangzhi) Zuo Reviewed-by: Hersen Wu Acked-by: Harry Wentland Acked-by: Alex Deucher Tested-by: Lyude Paul Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/display/dc/core/dc_link.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 99b922f9ed6a6313c0d2247cde8aa1e4a0bd67e4 Author: Wenjing Liu Date: Wed Dec 5 12:14:45 2018 -0500 drm/amd/display: validate extended dongle caps [why] Some dongle doesn't have a valid extended dongle caps, but we still set the extended dongle caps to be valid. This causes validation fails for all timing. [how] If no dp_hdmi_max_pixel_clk is provided, don't use extended dongle caps. Signed-off-by: Wenjing Liu Reviewed-by: Aric Cyr Reviewed-by: Jun Lei Acked-by: Abdoulaye Berthe Acked-by: Leo Li Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 9136e81e986a7a44bd360a2d2abf19de886feaa8 Author: Nicholas Kazlauskas Date: Wed Dec 19 08:35:51 2018 -0500 drm/amd/display: Use div_u64 for flip timestamp ns to ms Resolves __udivdi3 missing errors when building for i386. Fixes: 6378ef012ddc ("drm/amd/display: Add below the range support for FreeSync") Signed-off-by: Nicholas Kazlauskas Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 2bf55d2e6b71c8d79a7960d4f88bebc03f0e9a00 Author: James Zhu Date: Tue Dec 18 16:03:22 2018 -0500 drm/amdgpu/uvd:Change uvd ring name convention Since umr tool can't handle bracket, change uvd ring name convention. Signed-off-by: James Zhu Reviewed-by: Alex Deucher Reviewed-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/uvd_v7_0.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit c1973a1078dee6e8c9bd77825f40f84c21be142f Author: Evan Quan Date: Tue Dec 18 19:06:53 2018 +0800 drm/amd/powerplay: add Vega20 LCLK DPM level setting support Support manual LCLK DPM level switch on Vega20. Signed-off-by: Evan Quan Acked-by: Alex Deucher Reviewed-by: Rex Zhu Reviewed-by: Feifei Xu Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c | 43 ++++++++++++++++++++++ 1 file changed, 43 insertions(+) commit 0346bfd9fe5ade369d9f946f82d6a43d113ba493 Author: Trigger Huang Date: Tue Dec 18 09:14:47 2018 +0800 drm/amdgpu: print process info when job timeout When a job is timeout, try to print the related process information for debugging Signed-off-by: Trigger Huang Reviewed-by: Christian König . Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 6 ++++++ 1 file changed, 6 insertions(+) commit e01f2d41895102d824c6b8f5e011dd5e286d5e8b Author: Alex Deucher Date: Wed Dec 19 18:05:41 2018 -0500 drm/amdgpu/nbio7.4: add hw bug workaround for vega20 Configure PCIE_CI_CNTL to work around a hw bug that affects some multi-GPU compute workloads. Acked-by: Feifei Xu Reviewed-by: Harish Kasiviswanathan Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/nbio_v7_4.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 40978ac636136aa0fb018a470008a717fd69c89c Author: Alex Deucher Date: Wed Dec 19 18:01:53 2018 -0500 drm/amdgpu/nbio6.1: add hw bug workaround for vega10/12 Configure PCIE_CI_CNTL to work around a hw bug that affects some multi-GPU compute workloads. Acked-by: Feifei Xu Reviewed-by: Harish Kasiviswanathan Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/nbio_v6_1.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 215852f4b8bbf7a8d6a534dfb367bb0f1a2d5011 Author: Jona Crasselt Date: Thu Dec 20 17:57:37 2018 +0100 staging: mt7621-mmc: Correct spelling mistakes in comments Changed "avaiable" to "available" and "interupt" to "interrupt". Signed-off-by: Jona Crasselt Signed-off-by: Felix Windsheimer Signed-off-by: Greg Kroah-Hartman drivers/staging/mt7621-mmc/sd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 84758d4d43e9e38f2bf9b5130b5f7db1c44f1e0b Author: Bhagavathi Perumal S Date: Thu Dec 20 14:26:00 2018 +0200 ath10k: add support to configure BB timing over wmi Add wmi configuration cmd to configure base band(BB) power amplifier(PA) off timing values in hardware. The default PA off timings were fine tuned to make proper DFS radar detection in QCA reference design. If ODM uses different PA in their design, then the same default PA off timing values cannot be used, it requires different settling time to detect radar pulses very sooner and avoid radar detection problems. In that case it provides provision to select proper PA off timing values based on the PA hardware used. The PA component is part of FEM hardware and new device tree entry "ext-fem-name" is used to indentify the FEM hardware. And this wmi configuration cmd is enabled via wmi service flag "WMI_SERVICE_BB_TIMING_CONFIG_SUPPORT". Other way is to apply these values through calibration data, but recalibration of all boards out there might not be feasible. This change tested on firmware ver 10.2.4-1.0-00042 in QCA988X chipset. Signed-off-by: Bhagavathi Perumal S Signed-off-by: Kalle Valo drivers/net/wireless/ath/ath10k/mac.c | 47 +++++++++++++++++++++++++++++++ drivers/net/wireless/ath/ath10k/wmi-ops.h | 20 +++++++++++++ drivers/net/wireless/ath/ath10k/wmi.c | 23 +++++++++++++++ drivers/net/wireless/ath/ath10k/wmi.h | 26 +++++++++++++++++ 4 files changed, 116 insertions(+) commit f3f587995c5af69b92693c2f5d40e3448ab6113d Author: Bhagavathi Perumal S Date: Thu Dec 20 14:25:43 2018 +0200 dt-bindings: net: ath10k: add new dt entry to identify external FEM This adds new dt entry ext-fem-name, it is used by ath10k driver to select correct timing parameters and configure it in target wifi hardware. The Front End Module(FEM) normally includes tx power amplifier(PA) and rx low noise amplifier(LNA). The default timing parameters like tx end to PA off timing values were fine tuned for internal FEM used in reference design. And these timing values can not be same if ODM modifies hardware design with different external FEM. This DT entry helps to choose correct timing values in driver if different external FEM hardware used. Signed-off-by: Bhagavathi Perumal S Reviewed-by: Rob Herring Signed-off-by: Kalle Valo Documentation/devicetree/bindings/net/wireless/qcom,ath10k.txt | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit e5404969a335e25e3eb822649a7f40e9c5ba2446 Author: Bhagavathi Perumal S Date: Thu Dec 20 14:25:32 2018 +0200 dt-bindings: net: ath10k: fix node name and device type in qcom ath10k example In qcom,ath10k documentation, ath10k is used as node name in the example of pci based device. Normally, node name should be class of device and not the model name, so fix it to node name "wifi". And remove the property device_type pci since only pci bridges should have this property. Signed-off-by: Bhagavathi Perumal S Reviewed-by: Rob Herring Signed-off-by: Kalle Valo Documentation/devicetree/bindings/net/wireless/qcom,ath10k.txt | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 386f97e3b201d18578abb0e7037b85a1ae50c0a3 Author: Zhi Chen Date: Thu Dec 20 14:25:18 2018 +0200 ath10k: fix tx_stats memory leak Memory of tx_stats was allocated when a STA was added. But it's not freed if the STA failed to be added to driver. This issue could be seen in MDK3 attack case when STA number reached the limit. Tested: QCA9984 with firmware ver 10.4-3.9.0.1-00005 Signed-off-by: Zhi Chen Signed-off-by: Kalle Valo drivers/net/wireless/ath/ath10k/mac.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) commit 2d3b55853b123c177037cf534c5aaa2650310094 Author: Zhi Chen Date: Thu Dec 20 14:24:43 2018 +0200 ath10k: fix peer stats null pointer dereference There was a race condition in SMP that an ath10k_peer was created but its member sta was null. Following are procedures of ath10k_peer creation and member sta access in peer statistics path. 1. Peer creation: ath10k_peer_create() =>ath10k_wmi_peer_create() =>ath10k_wait_for_peer_created() ... # another kernel path, RX from firmware ath10k_htt_t2h_msg_handler() =>ath10k_peer_map_event() =>wake_up() # ar->peer_map[id] = peer //add peer to map #wake up original path from waiting ... # peer->sta = sta //sta assignment 2. RX path of statistics ath10k_htt_t2h_msg_handler() =>ath10k_update_per_peer_tx_stats() =>ath10k_htt_fetch_peer_stats() # peer->sta //sta accessing Any access of peer->sta after peer was added to peer_map but before sta was assigned could cause a null pointer issue. And because these two steps are asynchronous, no proper lock can protect them. So both peer and sta need to be checked before access. Tested: QCA9984 with firmware ver 10.4-3.9.0.1-00005 Signed-off-by: Zhi Chen Signed-off-by: Kalle Valo drivers/net/wireless/ath/ath10k/debugfs_sta.c | 2 +- drivers/net/wireless/ath/ath10k/htt_rx.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) commit a3542d0c73cec6a45bde512ea2b43666c05a8c54 Author: Govind Singh Date: Thu Dec 20 14:24:23 2018 +0200 dt: bindings: ath10k: add bindings for wifi iommu node WCN3990 wifi module can optionally make use of the IOMMU. Add binding documentation for phandle to the IOMMU and the stream id of wifi iommu block. Signed-off-by: Govind Singh Reviewed-by: Rob Herring Reviewed-by: Brian Norris Tested-by: Brian Norris Signed-off-by: Kalle Valo Documentation/devicetree/bindings/net/wireless/qcom,ath10k.txt | 5 +++++ 1 file changed, 5 insertions(+) commit 5fac78aac91d89b4a04c1cbd92254f62935c2711 Author: Govind Singh Date: Thu Dec 20 14:24:10 2018 +0200 dt: bindings: ath10k: add missing dt properties for WCN3990 wifi node Add missing optional properties in WCN3990 wifi node. Signed-off-by: Govind Singh Reviewed-by: Rob Herring Reviewed-by: Brian Norris Tested-by: Brian Norris Signed-off-by: Kalle Valo .../bindings/net/wireless/qcom,ath10k.txt | 57 +++++++++++++--------- 1 file changed, 35 insertions(+), 22 deletions(-) commit 27120f2ac995d83fef383fb20e492037ecf09259 Author: Dan Carpenter Date: Thu Dec 20 09:53:45 2018 +0200 ath10k: remove an unnecessary NULL check The "survey" pointer is the address of an array element. We know that it can't be NULL so this check can be removed. Signed-off-by: Dan Carpenter Signed-off-by: Kalle Valo drivers/net/wireless/ath/ath10k/wmi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bd085be6ba9547795ddcbdc5cc0c78ea0201ba6e Author: Govind Singh Date: Thu Dec 20 09:53:43 2018 +0200 ath10k: move non-fatal warn logs to dbg level During driver load below warn logs are printed in the console. Since driver may not implement all wmi events sent by fw and all of them are non-fatal, move this log to debug level to remove un-necessary warn message on console. [ 361.887230] ath10k_snoc a000000.wifi: Unknown eventid: 16393 [ 361.907037] ath10k_snoc a000000.wifi: Unknown eventid: 237569 Signed-off-by: Govind Singh Signed-off-by: Kalle Valo drivers/net/wireless/ath/ath10k/wmi-tlv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c28dcbce0592a1a7e32975e28bdd80e5d8d2cfa3 Author: Dan Carpenter Date: Thu Dec 20 09:53:41 2018 +0200 ath10k: fix a NULL vs IS_ERR() check The devm_memremap() function doesn't return NULLs, it returns error pointers. Fixes: ba94c753ccb4 ("ath10k: add QMI message handshake for wcn3990 client") Signed-off-by: Dan Carpenter Signed-off-by: Kalle Valo drivers/net/wireless/ath/ath10k/qmi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 8765967592875f1b4b20a8541a325045e5f75a36 Author: Govind Singh Date: Thu Dec 20 09:53:36 2018 +0200 ath10k: remove work in progress logs from snoc driver All the necessary patches to make wifi running (over SNOC) are merged and tested on SDM845/QCS404 platform with WCN3990 wifi module, hence remove work in progress debug from snoc driver and Kconfig. Signed-off-by: Govind Singh Signed-off-by: Kalle Valo drivers/net/wireless/ath/ath10k/Kconfig | 3 +-- drivers/net/wireless/ath/ath10k/snoc.c | 1 - 2 files changed, 1 insertion(+), 3 deletions(-) commit a2864772f33aa0f22914049b7fe777b7d4ec05ee Author: Bhagavathi Perumal S Date: Thu Dec 20 09:53:34 2018 +0200 ath10k: fix warning due to msdu limit error Some hardwares variants (QCA99x0) are limiting msdu deaggregation with some threshold value(default limit in QCA99x0 is 64 msdus), it was introduced to avoid excessive MSDU-deaggregation in error cases. When number of sub frames exceeds the limit, target hardware will send all msdus starting from present msdu in RAW format as a single msdu packet and it will be indicated with error status bit "RX_MSDU_END_INFO0_MSDU_LIMIT_ERR" set in rx descriptor. This msdu frame is a partial raw MSDU and does't have first msdu and ieee80211 header. It caused below warning message. [ 320.151332] ------------[ cut here ]------------ [ 320.155006] WARNING: CPU: 0 PID: 3 at drivers/net/wireless/ath/ath10k/htt_rx.c:1188 In our issue case, MSDU limit error happened due to FCS error and generated this warning message. This fixes the warning by handling the MSDU limit error. If msdu limit error happens, driver adds first MSDU's ieee80211 header and sets A-MSDU present bit in QOS header so that upper layer processes this frame if it is valid or drop it if FCS error set. And removed the warning message, hence partial msdus without first msdu is expected in msdu limit error cases. Tested on QCA9984, Firmware 10.4-3.6-00104 Signed-off-by: Bhagavathi Perumal S Signed-off-by: Kalle Valo drivers/net/wireless/ath/ath10k/htt_rx.c | 41 ++++++++++++++++++++++++++++--- drivers/net/wireless/ath/ath10k/hw.c | 7 ++++++ drivers/net/wireless/ath/ath10k/hw.h | 10 ++++++++ drivers/net/wireless/ath/ath10k/rx_desc.h | 7 ++++++ 4 files changed, 61 insertions(+), 4 deletions(-) commit 68c295f21abc192163c416b333aca7c41a195075 Author: Sathishkumar Muruganandam Date: Thu Dec 20 09:53:30 2018 +0200 ath10k: disable 4addr source port learning in 10.4 FW by default Currently in 10.4 FW, all the received 4addr frames are processed for source port learning which is enabled by default. This learning can't be disabled by default in FW since it breaks backward compatibility. Since ath10k uses mac80211 based 4addr mode, source port learning done in 10.4 FW is redundant and also causes issues when 3addr frames are transmitted/received for a 4addr station. One such visible functional impact is when GTK rekey frame from hostapd based AP to 4addr STA is dropped in AP's 10.4 FW. This is since GTK rekey EAPOL frame is 3addr frame on AP interface and STA enabled with 4addr is already allowed for receiving 3addr EAPOL frames. Source port learning implementation in 10.4 FW drops this 3addr GTK rekey frame in AP destinated for 4addr STA causing disassociation and re-association for every GTK rekey session. GTK rekey issue is not seen when learning is disabled in FW. To prevent such issues without breaking backward compatibility, FW advertises new service bit making the source port learning configurable and this learning is being currently disabled during ath10k vdev creation. * Tested HW: QCA9984 * Tested FW: 10.4-3.6.0.1-00004 Signed-off-by: Sathishkumar Muruganandam Signed-off-by: Kalle Valo drivers/net/wireless/ath/ath10k/mac.c | 11 +++++++++++ drivers/net/wireless/ath/ath10k/wmi.c | 4 ++++ drivers/net/wireless/ath/ath10k/wmi.h | 21 ++++++++++++++++++++- 3 files changed, 35 insertions(+), 1 deletion(-) commit 9a9cf0e63f707303dd4bbd2e14f812b85116b8b5 Author: Anilkumar Kolli Date: Thu Dec 20 09:53:28 2018 +0200 ath10k: report tx rate using ieee80211_tx_rate_update() Mesh path metric needs tx rate information from ieee80211_tx_status() call but in ath10k there is no mechanism to report tx rate information via ieee80211_tx_status(), the tx rate is only accessible via sta_statiscs() op. Per peer tx stats has tx rate info available, Tx rate is available to ath10k driver after every 4 PPDU sent in the air. For each PPDU, ath10k driver updates rate informattion to mac80211 using ieee80211_tx_rate_update(). Per peer txrate information is updated through per peer statistics and is available for QCA9888/QCA9984/QCA4019/QCA998X only Tested on QCA9984 with firmware-5.bin_10.4-3.5.3-00053 Tested on QCA998X with firmware-5.bin_10.2.4-1.0-00036 Signed-off-by: Anilkumar Kolli Signed-off-by: Kalle Valo drivers/net/wireless/ath/ath10k/core.h | 1 + drivers/net/wireless/ath/ath10k/htt_rx.c | 67 +++++++++++++++++++++++++++++--- drivers/net/wireless/ath/ath10k/wmi.h | 1 + 3 files changed, 64 insertions(+), 5 deletions(-) commit e820d55cb99dd93ac2dc949cf486bb187e5cd70d Author: Guoqing Jiang Date: Wed Dec 19 14:19:25 2018 +0800 md: fix raid10 hang issue caused by barrier When both regular IO and resync IO happen at the same time, and if we also need to split regular. Then we can see tasks hang due to barrier. 1. resync thread [ 1463.757205] INFO: task md1_resync:5215 blocked for more than 480 seconds. [ 1463.757207] Not tainted 4.19.5-1-default #1 [ 1463.757209] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1463.757212] md1_resync D 0 5215 2 0x80000000 [ 1463.757216] Call Trace: [ 1463.757223] ? __schedule+0x29a/0x880 [ 1463.757231] ? raise_barrier+0x8d/0x140 [raid10] [ 1463.757236] schedule+0x78/0x110 [ 1463.757243] raise_barrier+0x8d/0x140 [raid10] [ 1463.757248] ? wait_woken+0x80/0x80 [ 1463.757257] raid10_sync_request+0x1f6/0x1e30 [raid10] [ 1463.757265] ? _raw_spin_unlock_irq+0x22/0x40 [ 1463.757284] ? is_mddev_idle+0x125/0x137 [md_mod] [ 1463.757302] md_do_sync.cold.78+0x404/0x969 [md_mod] [ 1463.757311] ? wait_woken+0x80/0x80 [ 1463.757336] ? md_rdev_init+0xb0/0xb0 [md_mod] [ 1463.757351] md_thread+0xe9/0x140 [md_mod] [ 1463.757358] ? _raw_spin_unlock_irqrestore+0x2e/0x60 [ 1463.757364] ? __kthread_parkme+0x4c/0x70 [ 1463.757369] kthread+0x112/0x130 [ 1463.757374] ? kthread_create_worker_on_cpu+0x40/0x40 [ 1463.757380] ret_from_fork+0x3a/0x50 2. regular IO [ 1463.760679] INFO: task kworker/0:8:5367 blocked for more than 480 seconds. [ 1463.760683] Not tainted 4.19.5-1-default #1 [ 1463.760684] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1463.760687] kworker/0:8 D 0 5367 2 0x80000000 [ 1463.760718] Workqueue: md submit_flushes [md_mod] [ 1463.760721] Call Trace: [ 1463.760731] ? __schedule+0x29a/0x880 [ 1463.760741] ? wait_barrier+0xdd/0x170 [raid10] [ 1463.760746] schedule+0x78/0x110 [ 1463.760753] wait_barrier+0xdd/0x170 [raid10] [ 1463.760761] ? wait_woken+0x80/0x80 [ 1463.760768] raid10_write_request+0xf2/0x900 [raid10] [ 1463.760774] ? wait_woken+0x80/0x80 [ 1463.760778] ? mempool_alloc+0x55/0x160 [ 1463.760795] ? md_write_start+0xa9/0x270 [md_mod] [ 1463.760801] ? try_to_wake_up+0x44/0x470 [ 1463.760810] raid10_make_request+0xc1/0x120 [raid10] [ 1463.760816] ? wait_woken+0x80/0x80 [ 1463.760831] md_handle_request+0x121/0x190 [md_mod] [ 1463.760851] md_make_request+0x78/0x190 [md_mod] [ 1463.760860] generic_make_request+0x1c6/0x470 [ 1463.760870] raid10_write_request+0x77a/0x900 [raid10] [ 1463.760875] ? wait_woken+0x80/0x80 [ 1463.760879] ? mempool_alloc+0x55/0x160 [ 1463.760895] ? md_write_start+0xa9/0x270 [md_mod] [ 1463.760904] raid10_make_request+0xc1/0x120 [raid10] [ 1463.760910] ? wait_woken+0x80/0x80 [ 1463.760926] md_handle_request+0x121/0x190 [md_mod] [ 1463.760931] ? _raw_spin_unlock_irq+0x22/0x40 [ 1463.760936] ? finish_task_switch+0x74/0x260 [ 1463.760954] submit_flushes+0x21/0x40 [md_mod] So resync io is waiting for regular write io to complete to decrease nr_pending (conf->barrier++ is called before waiting). The regular write io splits another bio after call wait_barrier which call nr_pending++, then the splitted bio would continue with raid10_write_request -> wait_barrier, so the splitted bio has to wait for barrier to be zero, then deadlock happens as follows. resync io regular io raise_barrier wait_barrier generic_make_request wait_barrier To resolve the issue, we need to call allow_barrier to decrease nr_pending before generic_make_request since regular IO is not issued to underlying devices, and wait_barrier is called again to ensure no internal IO happening. Fixes: fc9977dd069e ("md/raid10: simplify the splitting of requests.") Reported-and-tested-by: Siniša Bandin Signed-off-by: Guoqing Jiang Signed-off-by: Shaohua Li drivers/md/raid10.c | 4 ++++ 1 file changed, 4 insertions(+) commit caea3c47ad515210129f06b6bbe53f82f69efebe Author: Guoqing Jiang Date: Fri Dec 7 18:24:21 2018 +0800 raid10: refactor common wait code from regular read/write request Both raid10_read_request and raid10_write_request share the same code at the beginning of them, so introduce regular_request_wait to clean up code, and call it in both request functions. Signed-off-by: Guoqing Jiang Signed-off-by: Shaohua Li drivers/md/raid10.c | 72 +++++++++++++++++++---------------------------------- 1 file changed, 25 insertions(+), 47 deletions(-) commit 37b22c28946046e587c12b2b5bdaba7062e23f75 Author: Chengguang Xu Date: Wed Nov 14 07:33:09 2018 +0800 md: remvoe redundant condition check mempool_destroy() can handle NULL pointer correctly, so there is no need to check NULL pointer before calling mempool_destroy(). Signed-off-by: Chengguang Xu Signed-off-by: Shaohua Li drivers/md/md.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) commit be85f93ae2df32dea0b20908316f1d894c3e0f64 Author: Daniel Verkamp Date: Mon Nov 12 15:26:52 2018 -0800 lib/raid6: add option to skip algo benchmarking This is helpful for systems where fast startup time is important. It is especially nice to avoid benchmarking RAID functions that are never used (for example, BTRFS selects RAID6_PQ even if the parity RAID mode is not in use). This saves 250+ milliseconds of boot time on modern x86 and ARM systems with a dozen or more available implementations. The new option is defaulted to 'y' to match the previous behavior of always benchmarking on init. Signed-off-by: Daniel Verkamp Signed-off-by: Shaohua Li include/linux/raid/pq.h | 3 +++ lib/Kconfig | 8 ++++++++ lib/raid6/algos.c | 5 +++++ 3 files changed, 16 insertions(+) commit 0437de4fa09fe59b57d12b785e4afb73b0f34c05 Author: Daniel Verkamp Date: Mon Nov 12 15:26:51 2018 -0800 lib/raid6: sort algos in rough performance order Sort the list of RAID6 algorithms in roughly decreasing order of expected performance: newer instruction sets first (within each architecture) and wider unrollings first. This doesn't make any difference right now, since all functions are benchmarked; a follow-up change will make use of this by optionally choosing the first valid function rather than testing all of them. The Itanium raid6_intx{16,32} entries are also moved down to be near the other raid6_intx entries for clarity. Signed-off-by: Daniel Verkamp Signed-off-by: Shaohua Li lib/raid6/algos.c | 76 +++++++++++++++++++++++++++---------------------------- 1 file changed, 38 insertions(+), 38 deletions(-) commit 86919f9dd2dbb88bbbe4e381dc8e6b9e9a1b9eb5 Author: Daniel Verkamp Date: Mon Nov 12 15:22:18 2018 -0800 lib/raid6: check for assembler SSSE3 support Allow the x86 SSSE3 recovery function to be tested in raid6test. Signed-off-by: Daniel Verkamp Signed-off-by: Shaohua Li lib/raid6/test/Makefile | 3 +++ 1 file changed, 3 insertions(+) commit 58af3110a7c5d161f72f94a98c6f2b9b75bf5cf9 Author: Daniel Verkamp Date: Mon Nov 12 15:22:17 2018 -0800 lib/raid6: avoid __attribute_const__ redefinition This is defined in glibc's sys/cdefs.h on my system with the same definition as the raid6test fallback definition. Add a #ifndef check to avoid a compiler warning about redefining it. Signed-off-by: Daniel Verkamp Signed-off-by: Shaohua Li include/linux/raid/pq.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit e731f3e28b7e7d1c745b03084e01036ee00018eb Author: Daniel Verkamp Date: Mon Nov 12 15:22:16 2018 -0800 lib/raid6: add missing include for raid6test Add #include for gettimeofday() to fix the compiler warning about an implicitly defined functions. Signed-off-by: Daniel Verkamp Signed-off-by: Shaohua Li include/linux/raid/pq.h | 1 + 1 file changed, 1 insertion(+) commit f91389c8d2867d10a206273b8eb3b7955b65591e Author: Yue Haibing Date: Thu Nov 8 12:11:06 2018 +0000 md: remove set but not used variable 'bi_rdev' Fixes gcc '-Wunused-but-set-variable' warning: drivers/md/md.c: In function 'md_integrity_add_rdev': drivers/md/md.c:2149:24: warning: variable 'bi_rdev' set but not used [-Wunused-but-set-variable] It not used any more after commit 1501efadc524 ("md/raid: only permit hot-add of compatible integrity profiles") Signed-off-by: Yue Haibing Signed-off-by: Shaohua Li drivers/md/md.c | 2 -- 1 file changed, 2 deletions(-) commit 85bd0107c6cd445a33066a57658fc585244a1100 Author: Yu Wang Date: Thu Dec 20 09:53:26 2018 +0200 ath10k: add amsdu support for monitor mode When processing HTT_T2H_MSG_TYPE_RX_IN_ORD_PADDR_IND, if the length of a msdu is larger than the tailroom of the rx skb, skb_over_panic issue will happen when calling skb_put. In monitor mode, amsdu will be handled in this path, and msdu_len of the first msdu_desc is the length of the entire amsdu, which might be larger than the maximum length of a skb, in such case, it will hit the issue upon. To fix this issue, process msdu list separately for monitor mode. Successfully tested with: QCA6174 (FW version: RM.4.4.1.c2-00057-QCARMSWP-1). Signed-off-by: Yu Wang [kvalo@codeaurora.org: cosmetic cleanup] Signed-off-by: Kalle Valo drivers/net/wireless/ath/ath10k/htt_rx.c | 188 ++++++++++++++++++++++++++++++- 1 file changed, 186 insertions(+), 2 deletions(-) commit 5816a0932b4fd74257b8cc5785bc8067186a8723 Author: Nathan Chancellor Date: Thu Dec 20 17:23:44 2018 +0100 drbd: Change drbd_request_detach_interruptible's return type to int Clang warns when an implicit conversion is done between enumerated types: drivers/block/drbd/drbd_state.c:708:8: warning: implicit conversion from enumeration type 'enum drbd_ret_code' to different enumeration type 'enum drbd_state_rv' [-Wenum-conversion] rv = ERR_INTR; ~ ^~~~~~~~ drbd_request_detach_interruptible's only call site is in the return statement of adm_detach, which returns an int. Change the return type of drbd_request_detach_interruptible to match, silencing Clang's warning. Reported-by: Nick Desaulniers Reviewed-by: Nick Desaulniers Signed-off-by: Nathan Chancellor Signed-off-by: Jens Axboe drivers/block/drbd/drbd_state.c | 6 ++---- drivers/block/drbd/drbd_state.h | 3 +-- 2 files changed, 3 insertions(+), 6 deletions(-) commit a52c5a16cf19d8a85831bb1b915a221dd4ffae3c Author: Nathan Chancellor Date: Thu Dec 20 17:23:43 2018 +0100 drbd: Avoid Clang warning about pointless switch statment There are several warnings from Clang about no case statement matching the constant 0: In file included from drivers/block/drbd/drbd_receiver.c:48: In file included from drivers/block/drbd/drbd_int.h:48: In file included from ./include/linux/drbd_genl_api.h:54: In file included from ./include/linux/genl_magic_struct.h:236: ./include/linux/drbd_genl.h:321:1: warning: no case matching constant switch condition '0' GENL_struct(DRBD_NLA_HELPER, 24, drbd_helper_info, ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ./include/linux/genl_magic_struct.h:220:10: note: expanded from macro 'GENL_struct' switch (0) { ^ Silence this warning by adding a 'case 0:' statement. Additionally, adjust the alignment of the statements in the ct_assert_unique macro to avoid a checkpatch warning. This solution was originally sent by Arnd Bergmann with a default case statement: https://lore.kernel.org/patchwork/patch/756723/ Link: https://github.com/ClangBuiltLinux/linux/issues/43 Suggested-by: Lars Ellenberg Signed-off-by: Nathan Chancellor Signed-off-by: Jens Axboe include/linux/genl_magic_struct.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit f31e583aa2c20892aca3add26957dee6ab80a534 Author: Lars Ellenberg Date: Thu Dec 20 17:23:42 2018 +0100 drbd: introduce P_ZEROES (REQ_OP_WRITE_ZEROES on the "wire") And also re-enable partial-zero-out + discard aligned. With the introduction of REQ_OP_WRITE_ZEROES, we started to use that for both WRITE_ZEROES and DISCARDS, hoping that WRITE_ZEROES would "do what we want", UNMAP if possible, zero-out the rest. The example scenario is some LVM "thin" backend. While an un-allocated block on dm-thin reads as zeroes, on a dm-thin with "skip_block_zeroing=true", after a partial block write allocated that block, that same block may well map "undefined old garbage" from the backends on LBAs that have not yet been written to. If we cannot distinguish between zero-out and discard on the receiving side, to avoid "undefined old garbage" to pop up randomly at later times on supposedly zero-initialized blocks, we'd need to map all discards to zero-out on the receiving side. But that would potentially do a full alloc on thinly provisioned backends, even when the expectation was to unmap/trim/discard/de-allocate. We need to distinguish on the protocol level, whether we need to guarantee zeroes (and thus use zero-out, potentially doing the mentioned full-alloc), or if we want to put the emphasis on discard, and only do a "best effort zeroing" (by "discarding" blocks aligned to discard-granularity, and zeroing only potential unaligned head and tail clippings to at least *try* to avoid "false positives" in an online-verify later), hoping that someone set skip_block_zeroing=false. For some discussion regarding this on dm-devel, see also https://www.mail-archive.com/dm-devel%40redhat.com/msg07965.html https://www.redhat.com/archives/dm-devel/2018-January/msg00271.html For backward compatibility, P_TRIM means zero-out, unless the DRBD_FF_WZEROES feature flag is agreed upon during handshake. To have upper layers even try to submit WRITE ZEROES requests, we need to announce "efficient zeroout" independently. We need to fixup max_write_zeroes_sectors after blk_queue_stack_limits(): if we can handle "zeroes" efficiently on the protocol, we want to do that, even if our backend does not announce max_write_zeroes_sectors itself. Signed-off-by: Lars Ellenberg Signed-off-by: Jens Axboe drivers/block/drbd/drbd_debugfs.c | 2 + drivers/block/drbd/drbd_int.h | 11 ++- drivers/block/drbd/drbd_main.c | 11 ++- drivers/block/drbd/drbd_nl.c | 16 ++++ drivers/block/drbd/drbd_protocol.h | 47 ++++++++++ drivers/block/drbd/drbd_receiver.c | 171 +++++++++++++++++++++++++++++++++---- drivers/block/drbd/drbd_req.c | 19 +++-- drivers/block/drbd/drbd_req.h | 2 + drivers/block/drbd/drbd_worker.c | 2 +- include/linux/drbd.h | 2 +- 10 files changed, 252 insertions(+), 31 deletions(-) commit 9848b6ddd8c92305252f94592c5e278574e7a6ac Author: Lars Ellenberg Date: Thu Dec 20 17:23:41 2018 +0100 drbd: skip spurious timeout (ping-timeo) when failing promote If you try to promote a Secondary while connected to a Primary and allow-two-primaries is NOT set, we will wait for "ping-timeout" to give this node a chance to detect a dead primary, in case the cluster manager noticed faster than we did. But if we then are *still* connected to a Primary, we fail (after an additional timeout of ping-timout). This change skips the spurious second timeout. Most people won't notice really, since "ping-timeout" by default is half a second. But in some installations, ping-timeout may be 10 or 20 seconds or more, and spuriously delaying the error return becomes annoying. Signed-off-by: Lars Ellenberg Signed-off-by: Jens Axboe drivers/block/drbd/drbd_nl.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) commit 9049ccd46f1f39166c99861c2c59d01ce3e20fd6 Author: Lars Ellenberg Date: Thu Dec 20 17:23:40 2018 +0100 drbd: don't retry connection if peers do not agree on "authentication" settings emma: "Unexpected data packet AuthChallenge (0x0010)" ava: "expected AuthChallenge packet, received: ReportProtocol (0x000b)" "Authentication of peer failed, trying again." Pattern repeats. There is no point in retrying the handshake, if we expect to receive an AuthChallenge, but the peer is not even configured to expect or use a shared secret. Signed-off-by: Lars Ellenberg Signed-off-by: Jens Axboe drivers/block/drbd/drbd_receiver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2c38f035117331eb78d0504843c79ea7c7fabf37 Author: Luc Van Oostenryck Date: Thu Dec 20 17:23:39 2018 +0100 drbd: fix print_st_err()'s prototype to match the definition print_st_err() is defined with its 4th argument taking an 'enum drbd_state_rv' but its prototype use an int for it. Fix this by using 'enum drbd_state_rv' in the prototype too. Signed-off-by: Luc Van Oostenryck Signed-off-by: Roland Kammerer Signed-off-by: Lars Ellenberg Signed-off-by: Jens Axboe drivers/block/drbd/drbd_state.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit be80ff88356ab6f5529daf24d3052a4e3cc727ec Author: Lars Ellenberg Date: Thu Dec 20 17:23:38 2018 +0100 drbd: avoid spurious self-outdating with concurrent disconnect / down If peers are "simultaneously" told to disconnect from each other, either explicitly, or implicitly by taking down the resource, with bad timing, one side may see its disconnect "fail" with a result of "state change failed by peer", and interpret this as "please oudate yourself". Try to catch this by checking for current connection status, and possibly retry as local-only state change instead. Signed-off-by: Lars Ellenberg Signed-off-by: Jens Axboe drivers/block/drbd/drbd_nl.c | 7 +++++++ 1 file changed, 7 insertions(+) commit f708bd08ecbdc23d03aaedf5b3311ebe44cfdb50 Author: Lars Ellenberg Date: Thu Dec 20 17:23:37 2018 +0100 drbd: do not block when adjusting "disk-options" while IO is frozen "suspending" IO is overloaded. It can mean "do not allow new requests" (obviously), but it also may mean "must not complete pending IO", for example while the fencing handlers do their arbitration. When adjusting disk options, we suspend io (disallow new requests), then wait for the activity-log to become unused (drain all IO completions), and possibly replace it with a new activity log of different size. If the other "suspend IO" aspect is active, pending IO completions won't happen, and we would block forever (unkillable drbdsetup process). Fix this by skipping the activity log adjustment if the "al-extents" setting did not change. Also, in case it did change, fail early without blocking if it looks like we would block forever. Signed-off-by: Lars Ellenberg Signed-off-by: Jens Axboe drivers/block/drbd/drbd_nl.c | 37 +++++++++++++++++++++++++++++-------- 1 file changed, 29 insertions(+), 8 deletions(-) commit a2823ea92024e6cb8124bf49a055261a8508a795 Author: Lars Ellenberg Date: Thu Dec 20 17:23:36 2018 +0100 drbd: fix comment typos Signed-off-by: Lars Ellenberg Signed-off-by: Jens Axboe drivers/block/drbd/drbd_receiver.c | 2 +- drivers/block/drbd/drbd_state.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit fe43ed97bba3b11521abd934b83ed93143470e4f Author: Lars Ellenberg Date: Thu Dec 20 17:23:35 2018 +0100 drbd: reject attach of unsuitable uuids even if connected Multiple failure scenario: a) all good Connected Primary/Secondary UpToDate/UpToDate b) lose disk on Primary, Connected Primary/Secondary Diskless/UpToDate c) continue to write to the device, changes only make it to the Secondary storage. d) lose disk on Secondary, Connected Primary/Secondary Diskless/Diskless e) now try to re-attach on Primary This would have succeeded before, even though that is clearly the wrong data set to attach to (missing the modifications from c). Because we only compared our "effective" and the "to-be-attached" data generation uuid tags if (device->state.conn < C_CONNECTED). Fix: change that constraint to (device->state.pdsk != D_UP_TO_DATE) compare the uuids, and reject the attach. This patch also tries to improve the reverse scenario: first lose Secondary, then Primary disk, then try to attach the disk on Secondary. Before this patch, the attach on the Secondary succeeds, but since commit drbd: disconnect, if the wrong UUIDs are attached on a connected peer the Primary will notice unsuitable data, and drop the connection hard. Though unfortunately at a point in time during the handshake where we cannot easily abort the attach on the peer without more refactoring of the handshake. We now reject any attach to "unsuitable" uuids, as long as we can see a Primary role, unless we already have access to "good" data. Signed-off-by: Lars Ellenberg Signed-off-by: Jens Axboe drivers/block/drbd/drbd_nl.c | 6 +++--- drivers/block/drbd/drbd_receiver.c | 19 +++++++++++++++++++ 2 files changed, 22 insertions(+), 3 deletions(-) commit ad6e8979020628137478034dc5dce46d9dbd75b9 Author: Lars Ellenberg Date: Thu Dec 20 17:23:34 2018 +0100 drbd: attach on connected diskless peer must not shrink a consistent device If we would reject a new handshake, if the peer had attached first, and then connected, we should force disconnect if the peer first connects, and only then attaches. Signed-off-by: Lars Ellenberg Signed-off-by: Jens Axboe drivers/block/drbd/drbd_receiver.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) commit 4ef2a4f43f5e52c6ff50a53cb49cf468bacf8cc2 Author: Lars Ellenberg Date: Thu Dec 20 17:23:33 2018 +0100 drbd: fix confusing error message during attach If we attach a (consistent) backing device, which knows about a last-agreed effective size, and that effective size is *larger* than the currently requested size, we refused to attach with ERR_DISK_TOO_SMALL Failure: (111) Low.dev. smaller than requested DRBD-dev. size. which is confusing to say the least. This patch changes the error code in that case to ERR_IMPLICIT_SHRINK Failure: (170) Implicit device shrinking not allowed. See kernel log. additional info from kernel: To-be-attached device has last effective > current size, and is consistent (9999 > 7777 sectors). Refusing to attach. It also allows to attach with an explicit size. Signed-off-by: Lars Ellenberg Signed-off-by: Jens Axboe drivers/block/drbd/drbd_nl.c | 49 +++++++++++++++++++++++++++++++++++++++----- 1 file changed, 44 insertions(+), 5 deletions(-) commit b17b59602b6dcf8f97a7dc7bc489a48388d7063a Author: Lars Ellenberg Date: Thu Dec 20 17:23:32 2018 +0100 drbd: disconnect, if the wrong UUIDs are attached on a connected peer With "on-no-data-accessible suspend-io", DRBD requires the next attach or connect to be to the very same data generation uuid tag it lost last. If we first lost connection to the peer, then later lost connection to our own disk, we would usually refuse to re-connect to the peer, because it presents the wrong data set. However, if the peer first connects without a disk, and then attached its disk, we accepted that same wrong data set, which would be "unexpected" by any user of that DRBD and cause "undefined results" (read: very likely data corruption). The fix is to forcefully disconnect as soon as we notice that the peer attached to the "wrong" dataset. Signed-off-by: Lars Ellenberg Signed-off-by: Jens Axboe drivers/block/drbd/drbd_receiver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 94c43a13b8d6e3e0dd77b3536b5e04a84936b762 Author: Lars Ellenberg Date: Thu Dec 20 17:23:31 2018 +0100 drbd: ignore "all zero" peer volume sizes in handshake During handshake, if we are diskless ourselves, we used to accept any size presented by the peer. Which could be zero if that peer was just brought up and connected to us without having a disk attached first, in which case both peers would just "flip" their volume sizes. Now, even a diskless node will ignore "zero" sizes presented by a diskless peer. Also a currently Diskless Primary will refuse to shrink during handshake: it may be frozen, and waiting for a "suitable" local disk or peer to re-appear (on-no-data-accessible suspend-io). If the peer is smaller than what we used to be, it is not suitable. The logic for a diskless node during handshake is now supposed to be: believe the peer, if - I don't have a current size myself - we agree on the size anyways - I do have a current size, am Secondary, and he has the only disk - I do have a current size, am Primary, and he has the only disk, which is larger than my current size Signed-off-by: Lars Ellenberg Signed-off-by: Jens Axboe drivers/block/drbd/drbd_receiver.c | 33 ++++++++++++++++++++++++++++++--- 1 file changed, 30 insertions(+), 3 deletions(-) commit d5412e8d8e6311c09fddcd7f1a4030b8bbe0caf7 Author: Lars Ellenberg Date: Thu Dec 20 17:23:30 2018 +0100 drbd: centralize printk reporting of new size into drbd_set_my_capacity() Previously, some implicit resizes that happend during handshake have not been reported as prominently as explicit resize. Signed-off-by: Lars Ellenberg Signed-off-by: Jens Axboe drivers/block/drbd/drbd_int.h | 8 +------- drivers/block/drbd/drbd_main.c | 17 ++++++++++++++++- drivers/block/drbd/drbd_nl.c | 3 --- 3 files changed, 17 insertions(+), 11 deletions(-) commit 792c3fdd94a559b31c8d1477e37029c1ac881234 Author: Lars Ellenberg Date: Thu Dec 20 17:23:29 2018 +0100 drbd: must not use connection after kref_put(&connection->kref) Signed-off-by: Lars Ellenberg Signed-off-by: Jens Axboe drivers/block/drbd/drbd_state.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit d29e89e34952a9ad02c77109c71a80043544296e Author: Roland Kammerer Date: Thu Dec 20 17:23:28 2018 +0100 drbd: narrow rcu_read_lock in drbd_sync_handshake So far there was the possibility that we called genlmsg_new(GFP_NOIO)/mutex_lock() while holding an rcu_read_lock(). This included cases like: drbd_sync_handshake (acquire the RCU lock) drbd_asb_recover_1p drbd_khelper drbd_bcast_event genlmsg_new(GFP_NOIO) --> may sleep drbd_sync_handshake (acquire the RCU lock) drbd_asb_recover_1p drbd_khelper notify_helper genlmsg_new(GFP_NOIO) --> may sleep drbd_sync_handshake (acquire the RCU lock) drbd_asb_recover_1p drbd_khelper notify_helper mutex_lock --> may sleep While using GFP_ATOMIC whould have been possible in the first two cases, the real fix is to narrow the rcu_read_lock. Reported-by: Jia-Ju Bai Reviewed-by: Lars Ellenberg Signed-off-by: Roland Kammerer Signed-off-by: Jens Axboe drivers/block/drbd/drbd_receiver.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) commit 553a7cca769d551f1317186760631487c47e23bf Author: Karthikeyan Periyasamy Date: Thu Dec 20 09:53:17 2018 +0200 ath10k: fix kernel panic due to use after free This issue arise in a race condition between ath10k_sta_state() and ath10k_htt_fetch_peer_stats(), explained in below scenario Steps: 1. In ath10k_sta_state(), arsta->tx_stats get deallocated before peer deletion when the station moves from IEEE80211_STA_NONE to IEEE80211_STA_NOTEXIST state. 2. Meanwhile ath10k receive HTT_T2H_MSG_TYPE_PEER_STATS message. In ath10k_htt_fetch_peer_stats(), arsta->tx_stats get accessed after the peer validation check. Since arsta->tx_stats get freed before the peer deletion [1]. ath10k_htt_fetch_peer_stats() ended up in "use after free" situation. Fixed this issue by moving the arsta->tx_stats free handling after the peer deletion. so that ath10k_htt_fetch_peer_stats() will not end up in "use after free" situation. Kernel Panic: Unable to handle kernel NULL pointer dereference at virtual address 00000286 pgd = d8754000 [00000286] *pgd=00000000 Internal error: Oops: 5 [#1] PREEMPT SMP ARM ... CPU: 0 PID: 6245 Comm: hostapd Not tainted task: dc44cac0 ti: d4a38000 task.ti: d4a38000 PC is at kmem_cache_alloc+0x7c/0x114 LR is at ath10k_sta_state+0x190/0xd58 [ath10k_core] pc : [] lr : [] psr: 20000013 sp : d4a39b88 ip : 00000000 fp : 00000001 r10: 00000000 r9 : 1d3bc000 r8 : 00000dc0 r7 : 000080d0 r6 : d4a38000 r5 : dd401b00 r4 : 00000286 r3 : 00000000 r2 : d4a39ba0 r1 : 000080d0 r0 : dd401b00 Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 10c5787d Table: 5a75406a DAC: 00000015 Process hostapd (pid: 6245, stack limit = 0xd4a38238) Stack: (0xd4a39b88 to 0xd4a3a000) ... [] (kmem_cache_alloc) from [] (ath10k_sta_state+0x190/0xd58 [ath10k_core]) [] (ath10k_sta_state [ath10k_core]) from [] (sta_info_insert_rcu+0x418/0x61c [mac80211]) [] (sta_info_insert_rcu [mac80211]) from [] (ieee80211_add_station+0xf0/0x134 [mac80211]) [] (ieee80211_add_station [mac80211]) from [] (nl80211_new_station+0x330/0x36c [cfg80211]) [] (nl80211_new_station [cfg80211]) from [] (extack_doit+0x2c/0x74 [compat]) [] (extack_doit [compat]) from [] (genl_rcv_msg+0x274/0x30c) [] (genl_rcv_msg) from [] (netlink_rcv_skb+0x58/0xac) [] (netlink_rcv_skb) from [] (genl_rcv+0x20/0x34) [] (genl_rcv) from [] (netlink_unicast+0x11c/0x204) [] (netlink_unicast) from [] (netlink_sendmsg+0x30c/0x370) [] (netlink_sendmsg) from [] (sock_sendmsg+0x70/0x84) [] (sock_sendmsg) from [] (___sys_sendmsg.part.3+0x188/0x228) [] (___sys_sendmsg.part.3) from [] (__sys_sendmsg+0x4c/0x70) [] (__sys_sendmsg) from [] (ret_fast_syscall+0x0/0x44) Code: ebfffec1 e1a04000 ea00001b e5953014 (e7940003) ath10k_pci 0000:01:00.0: SWBA overrun on vdev 0, skipped old beacon Hardware tested: QCA9984 Firmware tested: 10.4-3.6.0.1-00004 Fixes: a904417fc ("ath10k: add extended per sta tx statistics support") Signed-off-by: Karthikeyan Periyasamy Signed-off-by: Kalle Valo drivers/net/wireless/ath/ath10k/mac.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 8b1cce9f5832a8eda17d37a3c49fb7dd2d650f46 Author: Thierry Reding Date: Thu Dec 20 17:35:47 2018 +0100 dma-mapping: fix inverted logic in dma_supported The cleanup in commit 356da6d0cde3 ("dma-mapping: bypass indirect calls for dma-direct") accidentally inverted the logic in the check for the presence of a ->dma_supported() callback. Switch this back to the way it was to prevent a crash on boot. Fixes: 356da6d0cde3 ("dma-mapping: bypass indirect calls for dma-direct") Signed-off-by: Thierry Reding Signed-off-by: Christoph Hellwig kernel/dma/mapping.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bff70e5f78e9708de18cbed003abe10349719ba5 Author: YueHaibing Date: Thu Dec 20 09:53:10 2018 +0200 ath10k: remove set but not used variable 'num_tdls_vifs' Fixes gcc '-Wunused-but-set-variable' warning: drivers/net/wireless/ath/ath10k/mac.c: In function 'ath10k_sta_state': drivers/net/wireless/ath/ath10k/mac.c:6238:7: warning: variable 'num_tdls_vifs' set but not used [-Wunused-but-set-variable] 'num_tdls_vifs' not used any more after 9a993cc1ea95 ("ath10k: fix the logic of limiting tdls peer counts") Also, remove the single called function ath10k_mac_tdls_vifs_count and ath10k_mac_tdls_vifs_count_iter. Signed-off-by: YueHaibing Signed-off-by: Kalle Valo drivers/net/wireless/ath/ath10k/mac.c | 26 -------------------------- 1 file changed, 26 deletions(-) commit 82c7b351be3fad005ba38a26f7f1ab7f0841e505 Author: Horia Geantă Date: Wed Dec 19 12:18:44 2018 +0200 Revert "arm64: defconfig: Enable FSL_MC_BUS and FSL_MC_DPIO" This reverts commit d9678adbe733a770428a98651beaa2817d503ed3. Received below report from Stefan. Revert the commit until CAAM driver dependency cycles are fixed. this patch in next-20181214 breaks "make modules_install" for arm64/defconfig on my Ubuntu machine: DEPMOD 4.20.0-rc6-next-20181214 depmod: ERROR: Found 6 modules in dependency cycles! depmod: ERROR: Cycle detected: caamalg_desc -> dpaa2_caam -> authenc depmod: ERROR: Cycle detected: caamalg_desc -> dpaa2_caam -> fsl_mc_dpio depmod: ERROR: Cycle detected: dpaa2_caam -> caamhash_desc -> dpaa2_caam depmod: ERROR: Cycle detected: caamalg_desc -> dpaa2_caam -> caamhash_desc -> error depmod: ERROR: Cycle detected: caamalg_desc -> dpaa2_caam -> caamhash_desc -> caamalg_desc Reported-by: Stefan Wahren Signed-off-by: Horia Geantă Signed-off-by: Arnd Bergmann arch/arm64/configs/defconfig | 3 --- 1 file changed, 3 deletions(-) commit 54518ed45734bb7ebf2773b1d32120c62338cc93 Merge: 8e22bce990b5 6f61a2c8f1f6 Author: Arnd Bergmann Date: Thu Dec 20 17:36:08 2018 +0100 Merge tag 'renesas-fixes2-for-v4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas into fixes Second Round of Renesas ARM Based SoC Fixes for v4.20 * R-Car D3 (r8a77995) SoC based Draak board - Correct CVBS input to allow probing of the VIN * tag 'renesas-fixes2-for-v4.20' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas: arm64: dts: renesas: draak: Fix CVBS input commit 17f3b556a3e3c9227549c3e7762c5c27a48e5c59 Author: Al Viro Date: Sat Nov 10 23:46:07 2018 -0500 selinux: expand superblock_doinit() calls Signed-off-by: Al Viro Reviewed-by: David Howells security/selinux/hooks.c | 54 +++++++++++++++++++++--------------------------- 1 file changed, 24 insertions(+), 30 deletions(-) commit 43f5e655eff7e124d4e484515689cba374ab698e Author: David Howells Date: Thu Nov 1 23:07:25 2018 +0000 vfs: Separate changing mount flags full remount Separate just the changing of mount flags (MS_REMOUNT|MS_BIND) from full remount because the mount data will get parsed with the new fs_context stuff prior to doing a remount - and this causes the syscall to fail under some circumstances. To quote Eric's explanation: [...] mount(..., MS_REMOUNT|MS_BIND, ...) now validates the mount options string, which breaks systemd unit files with ProtectControlGroups=yes (e.g. systemd-networkd.service) when systemd does the following to change a cgroup (v1) mount to read-only: mount(NULL, "/run/systemd/unit-root/sys/fs/cgroup/systemd", NULL, MS_RDONLY|MS_NOSUID|MS_NODEV|MS_NOEXEC|MS_REMOUNT|MS_BIND, NULL) ... when the kernel has CONFIG_CGROUPS=y but no cgroup subsystems enabled, since in that case the error "cgroup1: Need name or subsystem set" is hit when the mount options string is empty. Probably it doesn't make sense to validate the mount options string at all in the MS_REMOUNT|MS_BIND case, though maybe you had something else in mind. This is also worthwhile doing because we will need to add a mount_setattr() syscall to take over the remount-bind function. Reported-by: Eric Biggers Signed-off-by: David Howells Signed-off-by: Al Viro Reviewed-by: David Howells fs/namespace.c | 146 +++++++++++++++++++++++++++++++------------------- include/linux/mount.h | 2 +- 2 files changed, 93 insertions(+), 55 deletions(-) commit e262e32d6bde0f77fb0c95d977482fc872c51996 Author: David Howells Date: Thu Nov 1 23:07:23 2018 +0000 vfs: Suppress MS_* flag defs within the kernel unless explicitly enabled Only the mount namespace code that implements mount(2) should be using the MS_* flags. Suppress them inside the kernel unless uapi/linux/mount.h is included. Signed-off-by: David Howells Signed-off-by: Al Viro Reviewed-by: David Howells arch/arc/kernel/setup.c | 1 + arch/arm/kernel/atags_parse.c | 1 + arch/sh/kernel/setup.c | 1 + arch/sparc/kernel/setup_32.c | 1 + arch/sparc/kernel/setup_64.c | 1 + arch/x86/kernel/setup.c | 1 + drivers/base/devtmpfs.c | 1 + fs/namespace.c | 1 + fs/pnode.c | 1 + fs/super.c | 1 + include/uapi/linux/fs.h | 56 ++++------------------------------------- include/uapi/linux/mount.h | 58 +++++++++++++++++++++++++++++++++++++++++++ init/do_mounts.c | 1 + init/do_mounts_initrd.c | 1 + security/apparmor/lsm.c | 1 + security/apparmor/mount.c | 1 + security/selinux/hooks.c | 1 + security/tomoyo/mount.c | 1 + 18 files changed, 79 insertions(+), 51 deletions(-) commit d70f4ece9da12b7319a87d02d33a89353268c689 Merge: 9df95e8ec568 489c066cfdf1 Author: Daniel Borkmann Date: Thu Dec 20 17:28:29 2018 +0100 Merge branch 'bpf-jset-verifier' Jakub Kicinski says: ==================== This is a v2 of the patch set to teach the verifier about BPF_JSET instruction. There is also a number of tests include for both basic functioning of the instruction and the verifier logic. The NFP JIT handling of JSET is tweaked. Last patch adds missing file to gitignore. Reposting part of previous series without the dead code elimination. ==================== Signed-off-by: Daniel Borkmann commit 489c066cfdf1cad776c5e041f32a2e3cdb05050a Author: Jakub Kicinski Date: Wed Dec 19 22:13:09 2018 -0800 selftests: bpf: add missing executables to .gitignore commit 435f90a338ae ("selftests/bpf: add a test case for sock_ops perf-event notification") missed adding new test to gitignore. Signed-off-by: Jakub Kicinski Signed-off-by: Daniel Borkmann tools/testing/selftests/bpf/.gitignore | 1 + 1 file changed, 1 insertion(+) commit 4987eaccd2d1535eaa72d3bbe2b8bfc8267ba965 Author: Jakub Kicinski Date: Wed Dec 19 22:13:08 2018 -0800 nfp: bpf: optimize codegen for JSET with a constant The top word of the constant can only have bits set if sign extension set it to all-1, therefore we don't really have to mask the top half of the register. We can just OR it into the result as is. Signed-off-by: Jakub Kicinski Reviewed-by: Quentin Monnet Signed-off-by: Daniel Borkmann drivers/net/ethernet/netronome/nfp/bpf/jit.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-) commit 6e774845b321e729966fed7de4aa8ea59c2c3b2e Author: Jakub Kicinski Date: Wed Dec 19 22:13:07 2018 -0800 nfp: bpf: remove the trivial JSET optimization The verifier will now understand the JSET instruction, so don't mark the dead branch in the JIT as noop. We won't generate any code, anyway. Signed-off-by: Jakub Kicinski Reviewed-by: Quentin Monnet Signed-off-by: Daniel Borkmann drivers/net/ethernet/netronome/nfp/bpf/jit.c | 5 ----- 1 file changed, 5 deletions(-) commit 9b38c4056b2736bb5902e8b0911832db666fd19b Author: Jakub Kicinski Date: Wed Dec 19 22:13:06 2018 -0800 bpf: verifier: reorder stack size check with dead code sanitization Reorder the calls to check_max_stack_depth() and sanitize_dead_code() to separate functions which can rewrite instructions from pure checks. No functional changes. Signed-off-by: Jakub Kicinski Reviewed-by: Jiong Wang Signed-off-by: Daniel Borkmann kernel/bpf/verifier.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 14507e35bd9dedcd14c24f9e5e0e0dd48e972e53 Author: Jakub Kicinski Date: Wed Dec 19 22:13:05 2018 -0800 selftests: bpf: verifier: add tests for JSET interpretation Validate that the verifier reasons correctly about the bounds and removes dead code based on results of JSET instruction. Signed-off-by: Jakub Kicinski Signed-off-by: Daniel Borkmann tools/testing/selftests/bpf/test_verifier.c | 96 +++++++++++++++++++++++++++++ 1 file changed, 96 insertions(+) commit 960ea056561a08e2b837b2f02d22c53226414a84 Author: Jakub Kicinski Date: Wed Dec 19 22:13:04 2018 -0800 bpf: verifier: teach the verifier to reason about the BPF_JSET instruction Some JITs (nfp) try to optimize code on their own. It could make sense in case of BPF_JSET instruction which is currently not interpreted by the verifier, meaning for instance that dead could would not be detected if it was under BPF_JSET branch. Teach the verifier basics of BPF_JSET, JIT optimizations will be removed shortly. Signed-off-by: Jakub Kicinski Reviewed-by: Jiong Wang Acked-by: Edward Cree Signed-off-by: Daniel Borkmann kernel/bpf/verifier.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) commit 5a8d5209ac0228c9cf8f335dfdfffa71c54b3201 Author: Jakub Kicinski Date: Wed Dec 19 22:13:03 2018 -0800 selftests: bpf: add trivial JSET tests We seem to have no JSET instruction test, and LLVM does not generate it at all, so let's add a simple hand-coded test to make sure JIT implementations are correct. v2: - extend test_verifier to handle multiple inputs and add the sample there (Daniel) - add a sign extension case Signed-off-by: Jakub Kicinski Signed-off-by: Daniel Borkmann tools/testing/selftests/bpf/test_verifier.c | 209 +++++++++++++++++++++++----- 1 file changed, 178 insertions(+), 31 deletions(-) commit 44a7b3b6e3a458f9549c2cc28e74ecdc470e42f1 Merge: ac68a3d3c3eb 0c2ff8d79689 Author: David S. Miller Date: Thu Dec 20 08:26:16 2018 -0800 Merge branch 'bnxt_en-next' Michael Chan says: ==================== bnxt_en: Update for net-next. Three main changes in this series, besides the usual firmware spec update: 1. Add support for a new firmware communication channel direct to the firmware processor that handles flow offloads. This speeds up flow offload operations. 2. Use 64-bit internal flow handles to increase the number of flows that can be offloaded. 3. Add level-2 context memory paging so that we can configure more context memory for RDMA on the 57500 chips. Allocate more context memory if RDMA is enabled on the 57500 chips. ==================== Signed-off-by: David S. Miller commit 0c2ff8d796895448b3a23c9cf7f37e721daeea48 Author: Michael Chan Date: Thu Dec 20 03:38:53 2018 -0500 bnxt_en: Adjust default RX coalescing ticks to 10 us. For a little better performance on faster machines and faster link speeds. Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit abd43a13525db70926999ebe3e272c38119fdfbe Author: Venkat Duvvuru Date: Thu Dec 20 03:38:52 2018 -0500 bnxt_en: Support for 64-bit flow handle. Older firmware only supports 16-bit flow handle, because of which the number of flows that can be offloaded can’t scale beyond a point. Newer firmware supports 64-bit flow handle enabling the host to scale upto millions of flows. With the new 64-bit flow handle support, driver has to query flow stats in a different way compared to the older approach. This patch adds support for 64-bit flow handle and new way to query flow stats. Signed-off-by: Venkat Duvvuru Reviewed-by: Sriharsha Basavapatna Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 8 +++ drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 74 ++++++++++++++++++++++++---- drivers/net/ethernet/broadcom/bnxt/bnxt_tc.h | 5 ++ 4 files changed, 78 insertions(+), 10 deletions(-) commit cf6daed098d14760d6605268d28bfdf7b3bfa375 Author: Michael Chan Date: Thu Dec 20 03:38:51 2018 -0500 bnxt_en: Increase context memory allocations on 57500 chips for RDMA. If RDMA is supported on the 57500 chip, increase context memory allocations for the resources used by RDMA. Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 65 +++++++++++++++++++++++++++---- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 2 + 2 files changed, 59 insertions(+), 8 deletions(-) commit 08fe9d1816067170e167867d06009fb0f41cb411 Author: Michael Chan Date: Thu Dec 20 03:38:50 2018 -0500 bnxt_en: Add Level 2 context memory paging support. Add the new functions bnxt_alloc_ctx_pg_tbls()/bnxt_free_ctx_pg_tbls() to allocate and free pages for context memory. The new functions will handle the different levels of paging support and allocate/free the pages accordingly using the existing functions. Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 128 ++++++++++++++++++++++++------ drivers/net/ethernet/broadcom/bnxt/bnxt.h | 3 + 2 files changed, 108 insertions(+), 23 deletions(-) commit 4f49b2b8d4167b712ce876bff08bd9606a44f7a6 Author: Michael Chan Date: Thu Dec 20 03:38:49 2018 -0500 bnxt_en: Enhance bnxt_alloc_ring()/bnxt_free_ring(). To support level 2 context page memory structures, enhance the bnxt_ring_mem_info structure with a "depth" field to specify the page level and add a flag to specify using full pages for L1 and L2 page tables. This is needed to support RDMA functionality on 57500 chips since RDMA requires more context memory. Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 17 ++++++++++++----- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 5 ++++- 2 files changed, 16 insertions(+), 6 deletions(-) commit 760b6d33410cda351f236058585471cb0f417978 Author: Venkat Duvvuru Date: Thu Dec 20 03:38:48 2018 -0500 bnxt_en: Add support for 2nd firmware message channel. Earlier, some of the firmware commands (ex: CFA_FLOW_*) which are processed by KONG processor were sent to the CHIMP processor from the host. This approach was taken as there was no direct message channel to KONG. CHIMP in turn used to send them to KONG. Newer firmware supports a new message channel which the host can send messages directly to the KONG processor. This patch adds support for required changes needed in the driver to support direct KONG message channel. This speeds up flow related messages sent to the firmware for CLS_FLOWER offload. Signed-off-by: Venkat Duvvuru Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 62 +++++++++++++++++++++----- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 73 +++++++++++++++++++++++++++---- 2 files changed, 117 insertions(+), 18 deletions(-) commit 5c209fc82159f2f71e2772f28cd1d447b821e98d Author: Venkat Duvvuru Date: Thu Dec 20 03:38:47 2018 -0500 bnxt_en: Introduce bnxt_get_hwrm_resp_addr & bnxt_get_hwrm_seq_id routines. These routines will be enhanced in the subsequent patch to return the 2nd firmware comm. channel's hwrm response address & sequence id respectively. Signed-off-by: Venkat Duvvuru Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 13 ++++++----- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 13 +++++++++++ drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 34 +++++++++++++++++----------- 3 files changed, 41 insertions(+), 19 deletions(-) commit 89455017fb8dd5dff0d088ecb82bccf9f9b715cd Author: Venkat Duvvuru Date: Thu Dec 20 03:38:46 2018 -0500 bnxt_en: Avoid arithmetic on void * pointer. Typecast hwrm_cmd_resp_addr to (u8 *) from (void *) before doing arithmetic. Signed-off-by: Venkat Duvvuru Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit 2e9ee3987719148308ff1794aa91f8314f839ccd Author: Venkat Duvvuru Date: Thu Dec 20 03:38:45 2018 -0500 bnxt_en: Use macros for firmware message doorbell offsets. In preparation for adding a 2nd communication channel to firmware. Signed-off-by: Venkat Duvvuru Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 8 +++++--- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 8 +++++--- 2 files changed, 10 insertions(+), 6 deletions(-) commit fc718bb2d1efa4348995b4811c243ec59f913a59 Author: Venkat Duvvuru Date: Thu Dec 20 03:38:44 2018 -0500 bnxt_en: Set hwrm_intr_seq_id value to its inverted value. Set hwrm_intr_seq_id value to its inverted value instead of HWRM_SEQ_INVALID, when an hwrm completion of type CMPL_BASE_TYPE_HWRM_DONE is received. This will enable us to use the complete 16-bit sequence ID space. Signed-off-by: Venkat Duvvuru Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 8 +++++--- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 3 +-- 2 files changed, 6 insertions(+), 5 deletions(-) commit 3322479e6d17ea17b75848fd7c7702ccf82c9c35 Author: Michael Chan Date: Thu Dec 20 03:38:43 2018 -0500 bnxt_en: Update firmware interface spec. to 1.10.0.33. The major changes are in the flow offload firmware APIs. Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt_hsi.h | 614 +++++++++++++++++++++----- 1 file changed, 502 insertions(+), 112 deletions(-) commit ac68a3d3c3eba61c693d63a89223e1df8fe1f0c6 Merge: a9cd3439e3c6 fa89a4593b92 Author: David S. Miller Date: Thu Dec 20 08:21:47 2018 -0800 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next Steffen Klassert says: ==================== pull request (net-next): ipsec-next 2018-12-20 Two last patches for this release cycle: 1) Remove an unused variable in xfrm_policy_lookup_bytype(). From YueHaibing. 2) Fix possible infinite loop in __xfrm6_tunnel_alloc_spi(). Also from YueHaibing. Please pull or let me know if there are problems. ==================== Signed-off-by: David S. Miller commit 74ff666bd7ba2da563f99f2a8af7bf9f20008bc9 Merge: b3fc4e0e966e aa167f3fed0c 2a9d92fb3a12 Author: Mark Brown Date: Thu Dec 20 16:01:30 2018 +0000 Merge remote-tracking branches 'spi/topic/mem' and 'spi/topic/mtd' into spi-next commit b3fc4e0e966eaaf2f8afa1de3280770acd838b87 Merge: 2d54911644e4 916d9802e4b0 Author: Mark Brown Date: Thu Dec 20 16:01:28 2018 +0000 Merge branch 'spi-4.21' into spi-next commit 2d54911644e4d5ea1ba01500d3a46dabc3b1e75a Merge: 7566ec393f41 29bdedfd9cf4 Author: Mark Brown Date: Thu Dec 20 16:01:26 2018 +0000 Merge branch 'spi-4.20' into spi-linus commit 3f47de2c6b6068cf7d5221f8f307969e7e4f1fc5 Merge: bda090cfeb50 8ac686d7dfed Author: Arnd Bergmann Date: Thu Dec 20 16:59:42 2018 +0100 Merge tag 'samsung-dt-4.21-2' of git://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into next/dt Samsung DTS ARM changes for v4.21, part 2 1. Add missing CPUs in cooling maps for Odroid X2 (missed in previous round of fixups). 2. Fix clock configuration in audio subsystem on Odroid XU3/XU4. * tag 'samsung-dt-4.21-2' of git://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: ARM: dts: exynos: Specify I2S assigned clocks in proper node ARM: dts: exynos: Add missing CPUs in cooling maps for Odroid X2 Signed-off-by: Arnd Bergmann commit bda090cfeb502a650d887e6c66be9644286d815c Merge: 984199efb0be c266a2b4407a Author: Arnd Bergmann Date: Thu Dec 20 16:58:23 2018 +0100 Merge tag 'sunxi-dt64-for-4.21-2' of git://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into next/dt Allwinner arm64 DT changes for 4.21 - round 2 Bluetooth using a Broadcom (now Cypress) chip connected to an UART on the Bananapi M64 is enabled using serdev and the updated bindings for Broadcom Bluetooth. The patch series had been sitting on the mailing lists for a month, and the driver bits were just merged on 2018/12/19. * tag 'sunxi-dt64-for-4.21-2' of git://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: arm64: dts: allwinner: a64: bananapi-m64: Add Bluetooth device node Signed-off-by: Arnd Bergmann commit 984199efb0be4857ebe360205bda608b9e1aee9d Merge: f1a6caf73c66 afdd273e269c Author: Arnd Bergmann Date: Thu Dec 20 16:54:17 2018 +0100 Merge tag 'sunxi-dt-for-4.21-2' of git://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into next/dt Allwinner DT changes for 4.21 - round 2 This is a small pull request for some lingering things that didn't make the first round of patches. First, the new suniv device tree included device tree headers for the clock and reset indices. These header filers are going in through the clock tree. Thus with the dt and core branches in arm-soc alone, it doesn't build. One fix is included to remove the #include statements. The defined macros aren't used yet as they were properly removed during the review phase. Second, Bluetooth using Broadcom (now Cypress) chips connected to UARTs on various boards is enabled using serdev and the updated bindings for Broadcom Bluetooth. The patch series had been sitting on the mailing lists for a month, and the driver bits were just merged on 2018/12/19. * tag 'sunxi-dt-for-4.21-2' of git://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: ARM: dts: sunxi: Enable Broadcom-based Bluetooth for multiple boards ARM: dts: suniv: Fix improper bindings include patch Signed-off-by: Arnd Bergmann commit f1a6caf73c66226e78f297618288c8b3445d13c0 Merge: ea096315361b 30648e9f8647 Author: Arnd Bergmann Date: Thu Dec 20 16:47:25 2018 +0100 Merge tag 'imx-qspi-dt-clean' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into next/dt Freescale QSPI device tree cleanup for 4.21: - It contains a series from Schrempf Frieder that cleans up FSL QSPI device tree nodes. The current device trees are broken because they use an inconsistent scheme for assigning the reg properties. It becomes a problem with ongoing QSPI driver under SPI framework. So the cleanup is a preparation for new driver landing in the next cycle. * tag 'imx-qspi-dt-clean' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: arm64: dts: Add spi-[tx/rx]-bus-width for the FSL QSPI controller arm64: dts: Remove unused properties from FSL QSPI driver nodes ARM: dts: Add spi-[tx/rx]-bus-width for the FSL QSPI controller ARM: dts: imx6sx-sdb: Fix the reg properties for the FSL QSPI nodes ARM: dts: Remove unused properties from FSL QSPI driver nodes Signed-off-by: Arnd Bergmann commit 942104a21ce4951420ddf6c6b3179a0627301f7e Author: NeilBrown Date: Mon Dec 10 09:58:37 2018 +1100 docs: improve pathname-lookup document structure Get rid of some unneeded structural elements around the new (to RST) pathname-lookup document. Signed-off-by: NeilBrown [ jc: grabbed from email and changelog added ] Signed-off-by: Jonathan Corbet Documentation/filesystems/index.rst | 14 ++++++++++++-- Documentation/filesystems/path-lookup.rst | 15 --------------- 2 files changed, 12 insertions(+), 17 deletions(-) commit 6b5a49b46cf128c8360509ea5a8e6391cf6f1c43 Author: Helen Koike Date: Fri Dec 7 17:11:58 2018 -0200 configfs: fix wrong name of struct in documentation The name of the struct is configfs_bin_attribute instead of configfs_attribute Signed-off-by: Helen Koike Fixes: 03607ace807b ("configfs: implement binary attributes") Signed-off-by: Jonathan Corbet Documentation/filesystems/configfs/configfs.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ea096315361bbec7d0b40de4937e7e09fd85f8e7 Author: Maxime Ripard Date: Fri Dec 14 10:55:38 2018 +0100 ARM: dts: suniv: Fix improper bindings include patch The clock and reset bindings are going through different trees, and while the patch doesn't contain any value defined in that header, it still includes those files and result in a build breakage when building the DT without the matching clock and reset patches applied. Signed-off-by: Maxime Ripard Signed-off-by: Arnd Bergmann arch/arm/boot/dts/suniv-f1c100s.dtsi | 3 --- 1 file changed, 3 deletions(-) commit eafb27fa5283599ce6c5492ea18cf636a28222bb Author: Macpaul Lin Date: Wed Dec 19 12:11:03 2018 +0800 cdc-acm: fix abnormal DATA RX issue for Mediatek Preloader. Mediatek Preloader is a proprietary embedded boot loader for loading Little Kernel and Linux into device DRAM. This boot loader also handle firmware update. Mediatek Preloader will be enumerated as a virtual COM port when the device is connected to Windows or Linux OS via CDC-ACM class driver. When the USB enumeration has been done, Mediatek Preloader will send out handshake command "READY" to PC actively instead of waiting command from the download tool. Since Linux 4.12, the commit "tty: reset termios state on device registration" (93857edd9829e144acb6c7e72d593f6e01aead66) causes Mediatek Preloader receiving some abnoraml command like "READYXX" as it sent. This will be recognized as an incorrect response. The behavior change also causes the download handshake fail. This change only affects subsequent connects if the reconnected device happens to get the same minor number. By disabling the ECHO termios flag could avoid this problem. However, it cannot be done by user space configuration when download tool open /dev/ttyACM0. This is because the device running Mediatek Preloader will send handshake command "READY" immediately once the CDC-ACM driver is ready. This patch wants to fix above problem by introducing "DISABLE_ECHO" property in driver_info. When Mediatek Preloader is connected, the CDC-ACM driver could disable ECHO flag in termios to avoid the problem. Signed-off-by: Macpaul Lin Cc: stable@vger.kernel.org Reviewed-by: Johan Hovold Acked-by: Oliver Neukum Signed-off-by: Greg Kroah-Hartman drivers/usb/class/cdc-acm.c | 10 ++++++++++ drivers/usb/class/cdc-acm.h | 1 + 2 files changed, 11 insertions(+) commit 10f9d7fd56fec2244636dffb122673af663cf383 Merge: 826833df4e4b 5da94b50475a Author: Arnd Bergmann Date: Thu Dec 20 16:37:38 2018 +0100 Merge tag 'am654-for-v4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/kristo/linux into next/dt AM65x DT changes for 4.21. Includes: - Pinctrl support - I2C support - ECAP PWM support - Power domain handling for UARTs - McSPI support * tag 'am654-for-v4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/kristo/linux: arm64: dts: ti: k3-am654: Enable main domain McSPI0 arm64: dts: ti: k3-am654: Add McSPI DT nodes arm64: dts: ti: k3-am654: Populate power-domain property for UART nodes arm64: dts: ti: k3-am654-base-board: Enable ECAP PWM arm64: dts: ti: k3-am65-main: Add ECAP PWM node arm64: dts: ti: k3-am654-base-board: Add I2C nodes arm64: dts: ti: am654-base-board: Add pinmux for main uart0 arm64: dts: ti: k3-am65: Add pinctrl regions dt-bindings: pinctrl: k3: Introduce pinmux definitions arm64: dts: ti: k3-am654: Fix wakeup_uart reg address Signed-off-by: Arnd Bergmann commit 826833df4e4b396beef6420647aabe409bd84533 Merge: bc8bd33891d3 c7a851b7050e Author: Arnd Bergmann Date: Thu Dec 20 16:34:06 2018 +0100 Merge tag 'omap-for-v4.21/dt-ti-sysc-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into next/dt Add interconnect target module dts data for omaps for v4.21 This big set of changes adds SoC specific l4 interconnect target module device tree data for am335x, am437x, omap5 and dra7 SoCs. We also move existing devices to the right location in the l4 interconnect hierarcy. This is similar to what we've already done for omap4 l4 interconnects earlier, and follows what is documented in the ti-sysc driver dts binding in Documentation/devicetree/bindings/bus/ti-sysc.txt. These changes will essentially replace the struct ti_sysc and clock entries in the arch/arm/mach-omap2/omap_hwmod_*_data.c files. Then a few merge windows later, we can start dropping the built-in platform data from the omap_hwmod_*_data.c files in favor of the device tree data only. For now, we verify the device tree data module data against the built-in data and warn about changes to prevent regressions. With the device tree data, we are also probing devices with the ti-sysc interconnect target module instead of omap_device. This fixes up the handling for multiple device instances in a single interconnect target module that has caused trouble earlier. A custom wrapper driver has been needed earlier for such cases. And as the device tree data is organized by the l4 interconnect instances, we will be able to use genpd later on. This is because each interconnect instance is also often also a single power domain. This series of changes has been brewing for several months now. I did not want to send a pull request earlier as people were still seeing device specific issues until recently though. However, it turned out that all the issues were quite trivial to fix. I had missed adding device tree ranges for the l3 data port used on some devices, and I had missed converting the device addresses for a few devices. And some devices like needed fixes for deferred probe handling such as the EHCI PHY for built-in case on omap5. Anyways, in case of trouble, we can easily just revert changes for a single device if needed. * tag 'omap-for-v4.21/dt-ti-sysc-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: ARM: dts: Cosmetic fix for omap5 USB node names ARM: dts: Fix wrong address for omap5 sata phy ARM: dts: Add missing ranges for dra7 mcasp l3 ports ARM: dts: Fix ranges for am335x epwmss ARM: dts: Fix hsi gdd range for omap4 ARM: dts: Add am335x mcasp with l3 data port ranges ARM: dts: Add missing ranges for am437x mcasp l3 ports ARM: dts: dra7: Move the ti,no-idle quirk on proper gmac node ARM: dts: Revert am335x mcasp ti-sysc changes ARM: dts: omap5: Add l4 interconnect hierarchy and ti-sysc data ARM: dts: Use dra7 mcasp compatible for mcasp instances ARM: dts: dra7: Move l4 child devices to probe them with ti-sysc ARM: dts: dra7: Add l4 interconnect hierarchy and ti-sysc data ARM: dts: am335x: Move l4 child devices to probe them with ti-sysc ARM: dts: am335x: Add l4 interconnect hierarchy and ti-sysc data ARM: dts: am437x: Move l4 child devices to probe them with ti-sysc ARM: dts: am437x: Add l4 interconnect hierarchy and ti-sysc data ARM: dts: dra7: convert to use new clkctrl layout ARM: dts: am43xx: convert to use new clkctrl layout ARM: dts: am33xx: convert to use new clkctrl layout Signed-off-by: Arnd Bergmann commit 54a67c753610a762ec9f5de3a6fda76a3c3bdb8e Author: Mike Rapoport Date: Thu Dec 6 23:13:01 2018 +0200 docs/mm-api: link slab_common.c to "The Slab Cache" section Several functions in mm/slab_common.c have kernel-doc comments, it makes perfect sense to link them to the MM API reference. Signed-off-by: Mike Rapoport Signed-off-by: Jonathan Corbet Documentation/core-api/mm-api.rst | 3 +++ 1 file changed, 3 insertions(+) commit 16df1456aa858a86f398dbc7d27649eb6662b0cc Author: Dan Carpenter Date: Wed Dec 19 22:19:25 2018 +0300 mm, memory_hotplug: update a comment in unregister_memory() The remove_memory_block() function was renamed to in commit cc292b0b4302 ("drivers/base/memory.c: rename remove_memory_block() to remove_memory_section()"). Signed-off-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman drivers/base/memory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c0b8a8709ebe0f72523a1e76f30a1bde821c060c Author: Yangtao Li Date: Sat Dec 15 03:36:36 2018 -0500 component: convert to DEFINE_SHOW_ATTRIBUTE Use DEFINE_SHOW_ATTRIBUTE macro to simplify the code. Signed-off-by: Yangtao Li Signed-off-by: Greg Kroah-Hartman drivers/base/component.c | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) commit f496990f1f4b1dbf4f878f6864cbf4e303189177 Author: Mike Rapoport Date: Thu Dec 6 23:13:00 2018 +0200 slab: make kmem_cache_create{_usercopy} description proper kernel-doc Add the description for kmem_cache_create, fixup the return value paragraph and make both kmem_cache_create and add the second '*' to the comment opening. Signed-off-by: Mike Rapoport Signed-off-by: Jonathan Corbet mm/slab_common.c | 35 +++++++++++++++++++++++++++++++---- 1 file changed, 31 insertions(+), 4 deletions(-) commit bc8bd33891d3129e1ca0425879a30130cc80af1c Merge: 5385c226b63d ac1e507fe61d Author: Arnd Bergmann Date: Thu Dec 20 16:32:23 2018 +0100 Merge tag 'zynq-dt-for-v5.0' of https://github.com/Xilinx/linux-xlnx into next/dt arm: dts: zynq: DT changes for v5.0 - Fix mmc node name * tag 'zynq-dt-for-v5.0' of https://github.com/Xilinx/linux-xlnx: ARM: dts: Use mmc@ instead sdhci@ Signed-off-by: Arnd Bergmann commit c58eef061dda7d843dcc0ad6fea7e597d4c377c0 Author: Colin Ian King Date: Wed Dec 19 16:30:07 2018 +0000 staging: wilc1000: fix missing read_write setting when reading data Currently the cmd.read_write setting is not initialized so it contains garbage from the stack. Fix this by setting it to 0 to indicate a read is required. Detected by CoverityScan, CID#1357925 ("Uninitialized scalar variable") Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver") Signed-off-by: Colin Ian King Cc: stable Acked-by: Ajay Singh Signed-off-by: Greg Kroah-Hartman drivers/staging/wilc1000/wilc_sdio.c | 1 + 1 file changed, 1 insertion(+) commit 012c5e8d819ccb048c86df213f7d57a3d4043a2c Author: Jona Crasselt Date: Wed Dec 19 17:07:05 2018 +0100 mt7621-mmc: char * array declaration might be better as static const Issue reported by checkpatch.pl. Signed-off-by: Jona Crasselt Signed-off-by: Felix Windsheimer Signed-off-by: Greg Kroah-Hartman drivers/staging/mt7621-mmc/sd.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 515ba7e7f032a609b649d85aa10f4b258ff2edef Author: Jona Crasselt Date: Wed Dec 19 17:07:04 2018 +0100 mt7621-mmc: return statement in void function unnecessary Issue reported by checkpatch.pl. Signed-off-by: Jona Crasselt Signed-off-by: Felix Windsheimer Signed-off-by: Greg Kroah-Hartman drivers/staging/mt7621-mmc/sd.c | 2 -- 1 file changed, 2 deletions(-) commit 43c978a16eee76ac45ae3223ccafcfa6186bcc46 Author: Jona Crasselt Date: Wed Dec 19 17:07:03 2018 +0100 mt7621-mmc: Alignment should match open parenthesis Issue reported by checkpatch.pl. Signed-off-by: Jona Crasselt Signed-off-by: Felix Windsheimer Signed-off-by: Greg Kroah-Hartman drivers/staging/mt7621-mmc/sd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 71fbc630160f485dac04d35e7df81cc97d021628 Author: Jona Crasselt Date: Wed Dec 19 17:07:02 2018 +0100 mt7621-mmc: Removed unnecessary blank lines Issue reported by checkpatch.pl. Signed-off-by: Jona Crasselt Signed-off-by: Felix Windsheimer Signed-off-by: Greg Kroah-Hartman drivers/staging/mt7621-mmc/sd.c | 2 -- 1 file changed, 2 deletions(-) commit 641e96e03aa0444389daad7d0422c9d52faf2f15 Author: Jona Crasselt Date: Wed Dec 19 17:07:01 2018 +0100 mt7621-mmc: Fix some coding style issues Fix some comment-related issues reported by checkpatch.pl: - Block comments use * on subsequent lines - Block comments use a trailing */ on a separate line Signed-off-by: Jona Crasselt Signed-off-by: Felix Windsheimer Signed-off-by: Greg Kroah-Hartman drivers/staging/mt7621-mmc/sd.c | 31 +++++++++++++++++-------------- 1 file changed, 17 insertions(+), 14 deletions(-) commit 5385c226b63db5827814e381c5aa290814445c03 Merge: b125eb0bf469 d1d4445abffb Author: Arnd Bergmann Date: Thu Dec 20 16:30:59 2018 +0100 Merge tag 'zynqmp-dt-for-v5.0' of https://github.com/Xilinx/linux-xlnx into next/dt arm64: dts: zynqmp: DT changes for v5.0 - Fix node names - Fix wakeup-source - Wire ddrc - Label gpio controller (PS gpio) * tag 'zynqmp-dt-for-v5.0' of https://github.com/Xilinx/linux-xlnx: arm64: dts: zynqmp: Fix node names which contain "_" arm64: dts: zynqmp: Add missing gpio-controller to ps gpio arm64: dts: zynqmp: Add DDRC node arm64: dts: zynqmp: replace gpio-key,wakeup with wakeup-source property arm64: dts: zynqmp: Use mmc@ instead sdhci@ Signed-off-by: Arnd Bergmann commit efa0f49496be359ab3e068b0a75b15808c354b7f Author: Alexander Shiyan Date: Thu Dec 20 09:19:30 2018 +0300 serial: sccnxp: Allow to use non-standard baud rates This patch adds support for the use of non-standard baud rates. For these purposes, we use the built-in timer/counter. Signed-off-by: Alexander Shiyan Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/sccnxp.c | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) commit 4ce193fdba48516717a4840043abb83f71109ee2 Author: Alexander Shiyan Date: Thu Dec 20 09:19:29 2018 +0300 serial: sccnxp: Adds a delay between sequential read/write cycles This patch adds a delay between sequential read/write cycles, to ensure the required minimum inactive time (tRWD). A time value from the datasheet has been added for each type of supported chips. The “inline” compiler attribute has been removed from the read/write functions, simply allow the compiler to control this. Signed-off-by: Alexander Shiyan Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/sccnxp.c | 32 +++++++++++++++++++++++++++----- 1 file changed, 27 insertions(+), 5 deletions(-) commit 663abb1a7a7ff8fea9ab0145463de7fcff823755 Author: Ryan Case Date: Wed Dec 19 12:33:53 2018 -0800 tty: serial: qcom_geni_serial: Fix UART hang If a serial console write occured while a UART transmit command was waiting for a done signal then no further data would be sent until something new kicked the system into gear. If there is already data waiting in the circular buffer we must re-enable the tx watermark so we receive the expected interrupts. Signed-off-by: Ryan Case Reviewed-by: Evan Green Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/qcom_geni_serial.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 3c66eb4ba18dd1cab0d1bde651cde6d8bdb47696 Author: Matthias Kaehlcke Date: Wed Dec 19 10:17:47 2018 -0800 tty: serial: qcom_geni_serial: Fix wrap around of TX buffer Before commit a1fee899e5bed ("tty: serial: qcom_geni_serial: Fix softlock") the size of TX transfers was limited to the TX FIFO size, and wrap arounds of the UART circular buffer were split into two transfers. With the commit wrap around are allowed within a transfer. The TX FIFO of the geni serial port uses a word size of 4 bytes. In case of a circular buffer wrap within a transfer the driver currently may write an incomplete word to the FIFO, with some bytes containing data from the circular buffer and others being zero. Since the transfer isn't completed yet the zero bytes are sent as if they were actual data. Handle wrap arounds of the TX buffer properly and ensure that words written to the TX FIFO always contain valid data (unless the transfer is completed). Fixes: a1fee899e5bed ("tty: serial: qcom_geni_serial: Fix softlock") Signed-off-by: Matthias Kaehlcke Reviewed-by: Evan Green Tested-by: Ryan Case Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/qcom_geni_serial.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) commit 3e730e858139c3bed9587ca50ce0f2aa12fe9523 Merge: 9f23b7ba6379 16ad9501b1f2 Author: Arnd Bergmann Date: Thu Dec 20 16:11:02 2018 +0100 Merge tag 'qcom-drivers-for-4.21-2' of git://git.kernel.org/pub/scm/linux/kernel/git/agross/linux into next/drivers Qualcomm ARM Based Driver Updates for v4.21 Part 2 - Redo * Fix SCM compilation error * tag 'qcom-drivers-for-4.21-2' of git://git.kernel.org/pub/scm/linux/kernel/git/agross/linux: firmware: qcom: scm: fix compilation error when disabled Signed-off-by: Arnd Bergmann commit 9f23b7ba6379fd80f0857cf4750e9eda83fe5408 Merge: a6f119a06960 fee10bd22678 Author: Arnd Bergmann Date: Thu Dec 20 16:10:32 2018 +0100 Merge tag 'zynq-soc-for-v5.0' of https://github.com/Xilinx/linux-xlnx into next/drivers ARM: Xilinx Zynq SoC patches for v5.0 - Adding pl353 smc driver * tag 'zynq-soc-for-v5.0' of https://github.com/Xilinx/linux-xlnx: memory: pl353: Add driver for arm pl353 static memory controller dt-bindings: memory: Add pl353 smc controller devicetree binding information Signed-off-by: Arnd Bergmann commit 916d9802e4b0723c1e4650e58e04c0259c14b85c Author: Hoan Nguyen An Date: Thu Dec 20 17:48:42 2018 +0900 spi: sh-msiof: Reduce the number of times write to and perform the transmission from FIFO The current state of the spi-sh-msiof, in master transfer mode: if t-> bits_per_word <= 8, if the data length is divisible by 4 ((len & 3) = 0), the length of each word will be 32 bits In case of data length can not be divisible by 4 ((len & 3) != 0), always set each word to be 8 bits, this will increase the number of times that write to FIFO, increasing the number of times it should be transmitted. Assume that the number of bytes of data length more than 64 bytes, each transmission will write 64 times into the TFDR then transmit, a maximum one-time transmission will transmit 64 bytes if each word is 8 bits long. Switch to setting if t->bits_per_word <= 8, the word length will be 32 bits although the data length is not divisible by 4, then if leftover, will transmit the balance and the length of each words is 1 byte. The maximum each can transmit up to 64 x 4 (Data Size = 32 bits (4 bytes)) = 256 bytes. TMDR2 : Bits 28 to 24 BITLEN1[4:0] Data Size (8 to 32 bits) Bits 23 to 16 WDLEN1[7:0] Word Count (1 to 64 words) Signed-off-by: Hoan Nguyen An Signed-off-by: Mark Brown drivers/spi/spi-sh-msiof.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) commit 3e60b4fc86710cd2095628c67b296e7cc4b239c1 Author: Yangtao Li Date: Sat Dec 15 03:21:48 2018 -0500 regulator: convert to DEFINE_SHOW_ATTRIBUTE Use DEFINE_SHOW_ATTRIBUTE macro to simplify the code. Signed-off-by: Yangtao Li Signed-off-by: Mark Brown drivers/regulator/core.c | 37 +++++-------------------------------- drivers/regulator/dbx500-prcmu.c | 35 ++++------------------------------- 2 files changed, 9 insertions(+), 63 deletions(-) commit f4c8f980283b4832dad4d9ff4d5ecb3d7763efae Author: Axel Lin Date: Wed Dec 19 16:58:04 2018 +0800 regulator: mcp16502: Fix missing n_voltages setting The n_voltages setting is not set, fix it. Signed-off-by: Axel Lin Signed-off-by: Mark Brown drivers/regulator/mcp16502.c | 1 + 1 file changed, 1 insertion(+) commit 4906d09164c00979dcbb28060231d9ce46ab2061 Author: Axel Lin Date: Thu Dec 20 21:14:13 2018 +0800 regulator: mcp16502: Use #ifdef CONFIG_PM_SLEEP around mcp16502_suspend/resume_noirq mcp16502_suspend/resume_noirq is only used by SET_NOIRQ_SYSTEM_SLEEP_PM_OPS when CONFIG_PM_SLEEP is defined. So use #ifdef CONFIG_PM_SLEEP instead CONFIG_SUSPEND guard. Signed-off-by: Axel Lin Signed-off-by: Mark Brown drivers/regulator/mcp16502.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) commit 31d1b7710262fba12282b24083f20dc76e0efc93 Merge: 217188d9f985 7566ec393f41 Author: Bartlomiej Zolnierkiewicz Date: Thu Dec 20 15:35:07 2018 +0100 Merge tag 'v4.20-rc7' of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux into fbdev-for-next Linux 4.20-rc7 Sync with upstream (which now contains fbdev-v4.20 changes) to prepare a base for fbdev-v4.21 changes. commit cfdfaf4a86406f8eff7901de09f4910341eb9e31 Merge: e9f2e05a5f19 95d386c2d2e7 Author: Radim Krčmář Date: Thu Dec 20 14:54:09 2018 +0100 Merge tag 'kvm-ppc-next-4.21-1' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc PPC KVM update for 4.21 from Paul Mackerras The main new feature this time is support in HV nested KVM for passing a device that is emulated by a level 0 hypervisor and presented to level 1 as a PCI device through to a level 2 guest using VFIO. Apart from that there are improvements for migration of radix guests under HV KVM and some other fixes and cleanups. commit 704cfd7f5f71c6bc6cdfaa63a16ed0f72882b1a1 Author: Patrice Chotard Date: Thu Dec 20 14:32:15 2018 +0100 ARM: sti: remove pen_release and boot_lock The pen_release implementation was created for Versatile platforms to work around boot loaders that did not differentiate between the various different secondary CPUs on this ARM development platform. This should not be true of modern platforms where we send IPIs to specific CPUs to wake them up. Remove the pen_release stuff from SoCs that make use of the per-CPU IPI mechanism. The boot_lock is something that was required for ARM development platforms to ensure that the delay calibration worked properly. This is not necessary for modern platforms that have better bus bandwidth and do not need to calibrate the delay loop for secondary cores. Remove the boot_lock entirely. Due to pen_release and boot_lock removal, .smp_prepare_cpus and .smp_boot_secondary STi callbacks must be reworked properly to allow secondary CPU bring up. Secondary CPU is initialized and started by a U-BOOTROM firmware. Secondary CPU is spinning and waiting for a write at cpu_strt_ptr. Writing secondary_startup address at cpu_strt_ptr makes it to jump directly to secondary_startup(). This write must be done in .smp_boot_secondary callback and not in .smp_prepare_cpus as previously, this insures that secondary_data struct is populated in __cpu_up() (stack, pgdir and swapper_pg_dir fields). The IPI in sti_boot_secondary() is useless, so remove it. This patch is the merged of Russell's patch [1] and the rework of .smp_prepare_cpus and .smp_boot_secondary STi callbacks [2]. [1] https://patchwork.kernel.org/patch/10729435/ [2] https://patchwork.kernel.org/patch/10735795/ Signed-off-by: Russell King Signed-off-by: Patrice Chotard arch/arm/mach-sti/Makefile | 2 +- arch/arm/mach-sti/headsmp.S | 43 ---------------------- arch/arm/mach-sti/platsmp.c | 88 ++++++++------------------------------------- 3 files changed, 15 insertions(+), 118 deletions(-) commit a64917446eafc7212e962561622d697fce04e9a6 Author: Aviv Heller Date: Tue Dec 18 19:03:27 2018 +0200 net/mlx5: Fix LAG requirement when CONFIG_MLX5_ESWITCH is off If CONFIG_MLX5_ESWITCH is not defined, test for SR-IOV being disabled, instead of calling e-switch LAG prereq routine. Since LAG with SRIOV is allowed only when switchdev mode is on. Fixes: eff849b2c669 ("net/mlx5: Allow/disallow LAG according to pre-req only") Signed-off-by: Aviv Heller Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/lag.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) commit 0a5b589111c395f2b18c2a508e241207daaa8cca Author: Aviv Heller Date: Thu Dec 20 01:37:17 2018 +0200 net/mlx5: Fix query_nic_sys_image_guid() error during init vport system image guid should be queried using vport nic API for Ethernet ports, and vport hca API for Infiniband ports. Fixes: fadd59fc50d0 ("net/mlx5: Introduce inter-device communication mechanism") Signed-off-by: Aviv Heller Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/vport.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) commit e32ee6c78efa6a32bff782bbe7a9970b018996ca Author: Eli Britstein Date: Mon Dec 3 17:09:54 2018 +0200 net/mlx5e: Support tunnel encap over tagged Ethernet Generate encap header depending on the routed device to support native/tagged Ethernet header. Signed-off-by: Eli Britstein Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed .../net/ethernet/mellanox/mlx5/core/en/tc_tun.c | 44 ++++++++++++---------- 1 file changed, 24 insertions(+), 20 deletions(-) commit aa331450b81f071bc8d7b68d5baab1b78f93598a Author: Eli Britstein Date: Sun Dec 9 09:17:18 2018 +0200 net/mlx5e: Support VLAN encap ETH header generation Support generation of native or tagged Ethernet header for encap header, depending on provided net device. Signed-off-by: Eli Britstein Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) commit c7bcb277bda46d75819fb2d475fa817c10dc209b Author: Eli Britstein Date: Mon Dec 3 17:09:54 2018 +0200 net/mlx5e: Re-order route and encap header memory allocation Change the order to first route IPv4/6 and return if error. Only after successful route continue to allocate an encap header, with no functional change. Signed-off-by: Eli Britstein Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed .../net/ethernet/mellanox/mlx5/core/en/tc_tun.c | 62 ++++++++++++---------- 1 file changed, 34 insertions(+), 28 deletions(-) commit 05ada1adb65acd533f978651e7001e3568e7b98a Author: Eli Britstein Date: Sun Dec 9 09:17:18 2018 +0200 net/mlx5e: Tunnel encap ETH header helper function In tunnel encap we prepare the encap header for IPv4/6 cases, in two separate functions. For ETH header generation the code is almost duplicated. Move the ETH header generation code from IPv4/6 functions to a helper function, with no functional change. Signed-off-by: Eli Britstein Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed .../net/ethernet/mellanox/mlx5/core/en/tc_tun.c | 29 +++++++++++++--------- 1 file changed, 17 insertions(+), 12 deletions(-) commit b168cff0b9b216e68215cdb28db999f542482a56 Author: Eli Britstein Date: Wed Dec 19 09:29:10 2018 +0200 net/mlx5e: Fail attempt to offload e-switch TC encap flows with vlan on underlay Currently we don't support nor fail attempts to offload encap flows routed to vlan device on the underlay network. We wrongly consider a vlan underlay device to be on the same e-switch b/c the switchdev ID is retrieved recursively. Add explicit check for that and fail such attempts. Also align to a more strict check for the ingress and the underlay devices to practically be on the same eswitch. Fixes: ce99f6b97fcd ('net/mlx5e: Support SRIOV TC encapsulation offloads for IPv6 tunnels') Fixes: 3e621b19b0bb ('net/mlx5e: Support TC encapsulation offloads with upper devices') Signed-off-by: Eli Britstein Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 442e1228cbaccee8a9365624608544460155c5d1 Author: Eli Britstein Date: Tue Dec 18 09:46:00 2018 +0200 net/mlx5e: Tunnel routing output devs helper function For tunnel we determine the output devs for IPv4/6 cases, in two separate functions, with a duplicated code. Move that code from IPv4/6 functions to a helper function, with no functional change. Signed-off-by: Eli Britstein Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed .../net/ethernet/mellanox/mlx5/core/en/tc_tun.c | 70 +++++++++++----------- 1 file changed, 34 insertions(+), 36 deletions(-) commit a0646c88ed3ac527b71cf365b03ff4fc729d35b6 Author: Eli Britstein Date: Wed Dec 19 09:24:58 2018 +0200 net/mlx5e: Fail attempt to offload e-switch TC flows with egress upper devices We use the switchdev parent HW id helper to identify if the mirred device shares the same ASIC/port with the ingress device. This can get us wrong in the presence of upper devices such as vlan or bridge set over the HW devices (VF or uplink representors), b/c the switchdev ID is retrieved recursively. To fail offload attempts in such cases, we condition the check on the egress device to have not only the same switchdev ID but also the relevant mlx5 netdev ops. Fixes: 03a9d11e6eeb ('net/mlx5e: Add TC drop and mirred/redirect action parsing for SRIOV offloads') Signed-off-by: Eli Britstein Reviewed-by: Roi Dayan Acked-by: Or Gerlitz Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 9 +++++++++ drivers/net/ethernet/mellanox/mlx5/core/en_rep.h | 3 +++ drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 3 +++ 3 files changed, 15 insertions(+) commit 1ee4457c5c2a6172893eb1f464860c753c9b4e96 Author: Or Gerlitz Date: Tue Dec 18 13:32:46 2018 +0200 net/mlx5e: Allow vlans on e-switch uplink reps There are cases (e.g tunneling with vlan on underlay and potentially more) where this makes sense, so allow that. Signed-off-by: Or Gerlitz Reviewed-by: Eli Britstein Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 4c8fb2986d44c5a75949a88ac61deec0ed50a542 Author: Gavi Teitz Date: Wed Dec 12 21:23:18 2018 +0200 net/mlx5e: Increase VF representors' SQ size to 128 The default size for the VF representors' SQ was too small to handle high packet rates. Doubling the size from 64 to 128 drastically improves the packet rate under stress (by about 50%), whereas increasing the size beyond 128 has not shown to make any further difference. The impact of the SQ size was measured with UDP traffic, in the following topology: TG <-> PF <-> TC forwarding <-> VF representor <-> VF in VM over a single core processing bi-directional traffic, with the following results: SQ size of 64: SQ size of 128: Packet rate for 64B UDP packets: 860 [Kpps] 1280 [Kpps] Packet rate for 114B VxLan encapsulated UDP packets: 320 [Kpps] 500 [Kpps] Signed-off-by: Gavi Teitz Reviewed-by: Or Gerlitz Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 4a0475d57ad134429f9bb56068bb738b4afc5992 Author: Miroslav Lichvar Date: Mon Dec 3 13:59:42 2018 +0100 mlx5: extend PTP gettime function to read system clock Read the system time right before and immediately after reading the low register of the internal timer. This adds support for the PTP_SYS_OFFSET_EXTENDED ioctl. Cc: Richard Cochran Cc: Saeed Mahameed Signed-off-by: Miroslav Lichvar Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c | 20 ++++++++++++-------- drivers/net/ethernet/mellanox/mlx5/core/main.c | 11 +++++++++-- drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h | 4 +++- 3 files changed, 24 insertions(+), 11 deletions(-) commit 5d8678365c90b9ce1fd2243ff5ea562609f6cec1 Author: Miroslav Lichvar Date: Mon Dec 3 13:59:41 2018 +0100 mlx5: update timecounter at least twice per counter overflow The timecounter needs to be updated at least once in half of the cyclecounter interval to prevent timecounter_cyc2time() interpreting a new timestamp as an old value and causing a backward jump. This would be an issue if the timecounter multiplier was so small that the update interval would not be limited by the 64-bit overflow in multiplication. Shorten the calculated interval to make sure the timecounter is updated in time even when the system clock is slowed down by up to 10%, the multiplier is increased by up to 10%, and the scheduled overflow check is late by 15%. Cc: Richard Cochran Cc: Ariel Levkovich Cc: Saeed Mahameed Signed-off-by: Miroslav Lichvar Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 8c6c942d33f2a79439e86f8f406afae40a5bc767 Author: YueHaibing Date: Thu Dec 20 02:42:51 2018 +0000 powerpc/eeh: Fix debugfs_simple_attr.cocci warnings Use DEFINE_DEBUGFS_ATTRIBUTE rather than DEFINE_SIMPLE_ATTRIBUTE for debugfs files. Semantic patch information: Rationale: DEFINE_SIMPLE_ATTRIBUTE + debugfs_create_file() imposes some significant overhead as compared to DEFINE_DEBUGFS_ATTRIBUTE + debugfs_create_file_unsafe(). Generated by: scripts/coccinelle/api/debugfs/debugfs_simple_attr.cocci Signed-off-by: YueHaibing Acked-by: Russell Currey Signed-off-by: Michael Ellerman arch/powerpc/kernel/eeh.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) commit c20577014f85f36d4e137d3d52a1f61225b4a3d2 Author: Alexey Kardashevskiy Date: Mon Nov 19 15:25:17 2018 +1100 powerpc/powernv/eeh/npu: Fix uninitialized variables in opal_pci_eeh_freeze_status The current implementation of the OPAL_PCI_EEH_FREEZE_STATUS call in skiboot's NPU driver does not touch the pci_error_type parameter so it might have garbage but the powernv code analyzes it nevertheless. This initializes pcierr and fstate to zero in all call sites. Signed-off-by: Alexey Kardashevskiy Reviewed-by: Sam Bobroff Signed-off-by: Michael Ellerman arch/powerpc/platforms/powernv/eeh-powernv.c | 8 ++++---- arch/powerpc/platforms/powernv/pci-ioda.c | 4 ++-- arch/powerpc/platforms/powernv/pci.c | 4 ++-- 3 files changed, 8 insertions(+), 8 deletions(-) commit e59f5bd759b7dee57593c5b6c0441609bda5d530 Author: Diana Craciun Date: Wed Dec 12 16:03:10 2018 +0200 powerpc/fsl: Add FSL_PPC_BOOK3E as supported arch for nospectre_v2 boot arg Signed-off-by: Diana Craciun Signed-off-by: Michael Ellerman Documentation/admin-guide/kernel-parameters.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a25de7af340fcd19a59978ded2ff04ed329bca06 Author: Alexey Kardashevskiy Date: Tue Oct 16 13:34:09 2018 +1100 powerpc/powernv/ioda: Reduce a number of hooks in pnv_phb fixup_phb() is never used, this removes it. pick_m64_pe() and reserve_m64_pe() are always defined for all powernv PHBs: they are initialized by pnv_ioda_parse_m64_window() which is called unconditionally from pnv_pci_init_ioda_phb() which initializes all known PHB types on powernv so we can open code them. Signed-off-by: Alexey Kardashevskiy Signed-off-by: Michael Ellerman arch/powerpc/platforms/powernv/pci-ioda.c | 9 +++------ arch/powerpc/platforms/powernv/pci.h | 4 ---- 2 files changed, 3 insertions(+), 10 deletions(-) commit dfa88658fb0583abb92e062c7a9cd5a5b94f2a46 Author: Diana Craciun Date: Wed Dec 12 16:03:09 2018 +0200 powerpc/fsl: Update Spectre v2 reporting Report branch predictor state flush as a mitigation for Spectre variant 2. Signed-off-by: Diana Craciun Signed-off-by: Michael Ellerman arch/powerpc/kernel/security.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit f21b0a45e4e48eafca38f11612244c5bd454a6c2 Author: Alexey Kardashevskiy Date: Tue Oct 16 13:30:03 2018 +1100 powerpc/powernv/ioda1: Remove dead code for a single device PE At the moment PNV_IODA_PE_DEV is only used for NPU PEs which are not present on IODA1 machines (i.e. POWER7) so let's remove a piece of dead code. Signed-off-by: Alexey Kardashevskiy Reviewed-by: Sam Bobroff Signed-off-by: Michael Ellerman arch/powerpc/platforms/powernv/pci-ioda.c | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) commit 3bc8ea8603ae4c1e09aca8de229ad38b8091fcb3 Author: Diana Craciun Date: Wed Dec 12 16:03:08 2018 +0200 powerpc/fsl: Enable runtime patching if nospectre_v2 boot arg is used If the user choses not to use the mitigations, replace the code sequence with nops. Signed-off-by: Diana Craciun Signed-off-by: Michael Ellerman arch/powerpc/kernel/setup-common.c | 1 + 1 file changed, 1 insertion(+) commit 517ad4ae8aa93dccdb9a88c27257ecb421c9e848 Author: Alexey Kardashevskiy Date: Tue Oct 2 13:22:31 2018 +1000 vfio/spapr_tce: Get rid of possible infinite loop As a part of cleanup, the SPAPR TCE IOMMU subdriver releases preregistered memory. If there is a bug in memory release, the loop in tce_iommu_release() becomes infinite; this actually happened to me. This makes the loop finite and prints a warning on every failure to make the code more bug prone. Signed-off-by: Alexey Kardashevskiy Reviewed-by: David Gibson Acked-by: Alex Williamson Signed-off-by: Michael Ellerman drivers/vfio/vfio_iommu_spapr_tce.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) commit e7aa61f47b23afbec41031bc47ca8d6cb6516abc Author: Diana Craciun Date: Wed Dec 12 16:03:07 2018 +0200 powerpc/fsl: Flush branch predictor when entering KVM Switching from the guest to host is another place where the speculative accesses can be exploited. Flush the branch predictor when entering KVM. Signed-off-by: Diana Craciun Signed-off-by: Michael Ellerman arch/powerpc/kvm/bookehv_interrupts.S | 4 ++++ 1 file changed, 4 insertions(+) commit fa1ada78897f282917594ba8eba220a54f87dabb Author: Alexey Kardashevskiy Date: Fri Sep 28 16:48:25 2018 +1000 powerpc/powernv/npu: Remove unused headers and a macro. The macro and few headers are not used so remove them. Signed-off-by: Alexey Kardashevskiy Acked-by: Alistair Popple Signed-off-by: Michael Ellerman arch/powerpc/platforms/powernv/npu-dma.c | 13 ------------- 1 file changed, 13 deletions(-) commit 7fef436295bf6c05effe682c8797dfcb0deb112a Author: Diana Craciun Date: Wed Dec 12 16:03:06 2018 +0200 powerpc/fsl: Flush the branch predictor at each kernel entry (32 bit) In order to protect against speculation attacks on indirect branches, the branch predictor is flushed at kernel entry to protect for the following situations: - userspace process attacking another userspace process - userspace process attacking the kernel Basically when the privillege level change (i.e.the kernel is entered), the branch predictor state is flushed. Signed-off-by: Diana Craciun Signed-off-by: Michael Ellerman arch/powerpc/kernel/head_booke.h | 6 ++++++ arch/powerpc/kernel/head_fsl_booke.S | 15 +++++++++++++++ 2 files changed, 21 insertions(+) commit bdbf649efe21173cae63b4b71db84176420f9039 Author: Alexey Kardashevskiy Date: Fri Sep 28 16:45:39 2018 +1000 powerpc/powernv/ioda: Allocate indirect TCE levels of cached userspace addresses on demand The powernv platform maintains 2 TCE tables for VFIO - a hardware TCE table and a table with userspace addresses; the latter is used for marking pages dirty when corresponging TCEs are unmapped from the hardware table. a68bd1267b72 ("powerpc/powernv/ioda: Allocate indirect TCE levels on demand") enabled on-demand allocation of the hardware table, however it missed the other table so it has still been fully allocated at the boot time. This fixes the issue by allocating a single level, just like we do for the hardware table. Fixes: a68bd1267b72 ("powerpc/powernv/ioda: Allocate indirect TCE levels on demand") Signed-off-by: Alexey Kardashevskiy Reviewed-by: David Gibson Signed-off-by: Michael Ellerman arch/powerpc/platforms/powernv/pci-ioda-tce.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 10c5e83afd4a3f01712d97d3bb1ae34d5b74a185 Author: Diana Craciun Date: Wed Dec 12 16:03:05 2018 +0200 powerpc/fsl: Flush the branch predictor at each kernel entry (64bit) In order to protect against speculation attacks on indirect branches, the branch predictor is flushed at kernel entry to protect for the following situations: - userspace process attacking another userspace process - userspace process attacking the kernel Basically when the privillege level change (i.e. the kernel is entered), the branch predictor state is flushed. Signed-off-by: Diana Craciun Signed-off-by: Michael Ellerman arch/powerpc/kernel/entry_64.S | 5 +++++ arch/powerpc/kernel/exceptions-64e.S | 26 +++++++++++++++++++++++++- arch/powerpc/mm/tlb_low_64e.S | 7 +++++++ 3 files changed, 37 insertions(+), 1 deletion(-) commit f633a8ad636efb5d4bba1a047d4a0f1ef719aa06 Author: Diana Craciun Date: Wed Dec 12 16:03:04 2018 +0200 powerpc/fsl: Add nospectre_v2 command line argument When the command line argument is present, the Spectre variant 2 mitigations are disabled. Signed-off-by: Diana Craciun Signed-off-by: Michael Ellerman arch/powerpc/include/asm/setup.h | 5 +++++ arch/powerpc/kernel/security.c | 21 +++++++++++++++++++++ 2 files changed, 26 insertions(+) commit 98518c4d8728656db349f875fcbbc7c126d4c973 Author: Diana Craciun Date: Wed Dec 12 16:03:03 2018 +0200 powerpc/fsl: Emulate SPRN_BUCSR register In order to flush the branch predictor the guest kernel performs writes to the BUCSR register which is hypervisor privilleged. However, the branch predictor is flushed at each KVM entry, so the branch predictor has been already flushed, so just return as soon as possible to guest. Signed-off-by: Diana Craciun [mpe: Tweak comment formatting] Signed-off-by: Michael Ellerman arch/powerpc/kvm/e500_emulate.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 7d8bad99ba5a22892f0cad6881289fdc3875a930 Author: Diana Craciun Date: Wed Dec 12 16:03:02 2018 +0200 powerpc/fsl: Fix spectre_v2 mitigations reporting Currently for CONFIG_PPC_FSL_BOOK3E the spectre_v2 file is incorrect: $ cat /sys/devices/system/cpu/vulnerabilities/spectre_v2 "Mitigation: Software count cache flush" Which is wrong. Fix it to report vulnerable for now. Fixes: ee13cb249fab ("powerpc/64s: Add support for software count cache flush") Cc: stable@vger.kernel.org # v4.19+ Signed-off-by: Diana Craciun Signed-off-by: Michael Ellerman arch/powerpc/kernel/security.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1cbf8990d79ff69da8ad09e8a3df014e1494462b Author: Diana Craciun Date: Wed Dec 12 16:03:01 2018 +0200 powerpc/fsl: Add macro to flush the branch predictor The BUCSR register can be used to invalidate the entries in the branch prediction mechanisms. Signed-off-by: Diana Craciun Signed-off-by: Michael Ellerman arch/powerpc/include/asm/ppc_asm.h | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 76a5eaa38b15dda92cd6964248c39b5a6f3a4e9d Author: Diana Craciun Date: Wed Dec 12 16:03:00 2018 +0200 powerpc/fsl: Add infrastructure to fixup branch predictor flush In order to protect against speculation attacks (Spectre variant 2) on NXP PowerPC platforms, the branch predictor should be flushed when the privillege level is changed. This patch is adding the infrastructure to fixup at runtime the code sections that are performing the branch predictor flush depending on a boot arg parameter which is added later in a separate patch. Signed-off-by: Diana Craciun Signed-off-by: Michael Ellerman arch/powerpc/include/asm/feature-fixups.h | 12 ++++++++++++ arch/powerpc/include/asm/setup.h | 2 ++ arch/powerpc/kernel/vmlinux.lds.S | 8 ++++++++ arch/powerpc/lib/feature-fixups.c | 23 +++++++++++++++++++++++ 4 files changed, 45 insertions(+) commit 4bd46aa0353e022c2401a258e93b107880a66533 Author: Brad Love Date: Wed Dec 19 12:07:01 2018 -0500 media: cx23885: only reset DMA on problematic CPUs It is reported that commit 95f408bbc4e4 ("media: cx23885: Ryzen DMA related RiSC engine stall fixes") caused regresssions with other CPUs. Ensure that the quirk will be applied only for the CPUs that are known to cause problems. A module option is added for explicit control of the behaviour. Fixes: 95f408bbc4e4 ("media: cx23885: Ryzen DMA related RiSC engine stall fixes") Signed-off-by: Brad Love Signed-off-by: Mauro Carvalho Chehab drivers/media/pci/cx23885/cx23885-core.c | 55 ++++++++++++++++++++++++++++++-- drivers/media/pci/cx23885/cx23885.h | 2 ++ 2 files changed, 55 insertions(+), 2 deletions(-) commit e01b5781958de08942af341ce26768d5e0fbcdf5 Author: Anson Huang Date: Thu Dec 20 08:56:16 2018 +0000 rtc: add i.MX system controller RTC support i.MX8QXP is an ARMv8 SoC which has a Cortex-M4 system controller inside, the system controller is in charge of controlling power, clock and secure rtc etc.. This patch adds i.MX system controller RTC driver support, Linux kernel has to communicate with system controller via MU (message unit) IPC to set/get RTC time and other alarm functions, since the RTC set time needs to be done in secure EL3 mode (required by system controller firmware) and alarm functions needs to be done with general MU IRQ handle, these depend on other components which are NOT ready, so this patch ONLY enables the RTC time read. Signed-off-by: Anson Huang Signed-off-by: Alexandre Belloni drivers/rtc/Kconfig | 7 ++++ drivers/rtc/Makefile | 1 + drivers/rtc/rtc-imx-sc.c | 91 ++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 99 insertions(+) commit 2ea44ca1ffccf89cfb9e6755156843e278ec9645 Author: Anson Huang Date: Thu Dec 20 08:56:07 2018 +0000 dt-bindings: fsl: scu: add rtc binding NXP i.MX8QXP is an ARMv8 SoC with a Cortex-M4 core inside as system controller, the system controller is in charge of system power, clock and secure RTC etc. management, Linux kernel has to communicate with system controller via MU (message unit) IPC to do RTC operation, this patch adds binding doc for i.MX system controller RTC driver. Signed-off-by: Anson Huang Reviewed-by: Rob Herring Signed-off-by: Alexandre Belloni Documentation/devicetree/bindings/arm/freescale/fsl,scu.txt | 10 ++++++++++ 1 file changed, 10 insertions(+) commit bbb55cd708901dedbeeeb929c7012f35afea7882 Author: Nathan Chancellor Date: Mon Dec 10 18:35:14 2018 -0500 media: ddbridge: Move asm includes after linux ones Without this, cpumask_t and bool are not defined: In file included from drivers/media/pci/ddbridge/ddbridge-ci.c:19: In file included from drivers/media/pci/ddbridge/ddbridge.h:22: ./arch/arm/include/asm/irq.h:35:50: error: unknown type name 'cpumask_t' extern void arch_trigger_cpumask_backtrace(const cpumask_t *mask, ^ ./arch/arm/include/asm/irq.h:36:9: error: unknown type name 'bool' bool exclude_self); ^ Doing a survey of the kernel tree, this appears to be expected because '#include ' is always after the linux includes. This also fixes warnings of this variety (with Clang): In file included from drivers/media/pci/ddbridge/ddbridge-ci.c:19: In file included from drivers/media/pci/ddbridge/ddbridge.h:56: In file included from ./include/media/dvb_net.h:22: In file included from ./include/linux/netdevice.h:50: In file included from ./include/uapi/linux/neighbour.h:6: In file included from ./include/linux/netlink.h:9: In file included from ./include/net/scm.h:11: In file included from ./include/linux/sched/signal.h:6: ./include/linux/signal.h:87:11: warning: array index 3 is past the end of the array (which contains 2 elements) [-Warray-bounds] return (set->sig[3] | set->sig[2] | ^ ~ ./arch/arm/include/asm/signal.h:17:2: note: array 'sig' declared here unsigned long sig[_NSIG_WORDS]; ^ Fixes: b6973637c4cc ("media: ddbridge: remove another duplicate of io.h and sort includes") Signed-off-by: Nathan Chancellor Tested-by: Guenter Roeck Signed-off-by: Mauro Carvalho Chehab drivers/media/pci/ddbridge/ddbridge.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit f242e0ac95cadb27527d0b06c957723c9f63dd74 Author: Christophe Leroy Date: Mon Dec 17 14:18:27 2018 +0000 powerpc/prom: move the device tree if not in declared memory. If the device tree doesn't reside in the memory which is declared inside it, it has to be moved as well as this memory will not be mapped by the kernel. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman arch/powerpc/kernel/prom.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit ec2adcd8dd64588cb4bcd1c1e0b86304b9713e73 Author: Michael Ellerman Date: Mon Nov 5 20:01:01 2018 +1100 powerpc: Add some documentation of ISA versions Add some documentation on which CPU versions map to which ISA versions. This is all publicly available information, some of it already in the kernel source, but it's much nicer to have it all in one place. Signed-off-by: Michael Ellerman Documentation/powerpc/isa-versions.rst | 74 ++++++++++++++++++++++++++++++++++ 1 file changed, 74 insertions(+) commit 2b874a5c7b75fdc90fdd1e2ffaa3ec5a9d21e253 Author: Michael Ellerman Date: Sat Dec 15 00:57:11 2018 +1100 powerpc/configs: Don't enable PPC_EARLY_DEBUG in defconfigs This reverts the remains of commit b9ef7d6b11c1 ("powerpc: Update default configurations"). That commit was proceeded by a commit which added a config option to control use of BOOTX for early debug, ie. PPC_EARLY_DEBUG_BOOTX, and then the update of the defconfigs was intended to not change behaviour by then enabling the new config option. However enabling PPC_EARLY_DEBUG had other consequences, notably causing us to register the udbg console at the end of udbg_early_init(). This means on a system which doesn't have anything that BOOTX can use (most systems), we register the udbg console very early but the bootx code just throws everything away, meaning early boot messages are never printed to the console. What we want to happen is for the udbg console to only be registered later (from setup_arch()) once we've setup udbg_putc, and then all early boot messages will be replayed. Fixes: b9ef7d6b11c1 ("powerpc: Update default configurations") Reported-by: Torsten Duwe Signed-off-by: Michael Ellerman arch/powerpc/configs/g5_defconfig | 1 - arch/powerpc/configs/maple_defconfig | 1 - arch/powerpc/configs/pmac32_defconfig | 1 - arch/powerpc/configs/ppc64_defconfig | 1 - arch/powerpc/configs/ppc6xx_defconfig | 1 - 5 files changed, 5 deletions(-) commit 2fea82db113e4422ef5c8e6209908806e5fb6b63 Author: Arnd Bergmann Date: Mon Dec 10 22:51:57 2018 +0100 powerpc: eeh_event: convert semaphore to completion For this use case, completions and semaphores are equivalent, but semaphores are an awkward interface that should generally be avoided, so use the completion instead. Signed-off-by: Arnd Bergmann Signed-off-by: Michael Ellerman arch/powerpc/kernel/eeh_event.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) commit d1f75a96842b265ca2a89b7ed477a50637ea87f1 Author: Greg Kurz Date: Mon Dec 10 16:13:38 2018 +0100 ocxl/afu_irq: Don't include The AFU irq code doesn't need to reach out to the platform. Signed-off-by: Greg Kurz Acked-by: Andrew Donnellan Signed-off-by: Michael Ellerman drivers/misc/ocxl/afu_irq.c | 1 - 1 file changed, 1 deletion(-) commit 759bc01586535700fbb1aaf40dd727146e2e8b57 Author: Greg Kurz Date: Mon Dec 10 16:18:13 2018 +0100 ocxl: Clarify error path in setup_xsl_irq() Implementing rollback with goto and labels is a common practice that leads to prettier and more maintainable code. FWIW, this design pattern is already being used in alloc_link() a few lines below in this file. Do the same in setup_xsl_irq(). Signed-off-by: Greg Kurz Acked-by: Frederic Barrat Acked-by: Andrew Donnellan Signed-off-by: Michael Ellerman drivers/misc/ocxl/link.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) commit 3cfb9ebe906b51f2942b1e251009bb251efd2ba6 Author: Benjamin Herrenschmidt Date: Tue Dec 11 13:27:33 2018 +1100 powerpc/44x/bamboo: Fix PCI range The bamboo dts has a bug: it uses a non-naturally aligned range for PCI memory space. This isnt' supported by the code, thus causing PCI to break on this system. This is due to the fact that while the chip memory map has 1G reserved for PCI memory, it's only 512M aligned. The code doesn't know how to split that into 2 different PMMs and fails, so limit the region to 512M. Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Michael Ellerman arch/powerpc/boot/dts/bamboo.dts | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 51f4cc2047a4b7e9bf1b49acf06c110991fd4167 Author: Darren Stevens Date: Sun Aug 19 21:26:28 2018 +0100 powerpc/pasemi: Add Nemo board IRQ initroutine Add a IRQ init routine for the Nemo board which inits and attatches the i8259 found in the SB600, and a cascade routine to dispatch the interrupts. Signed-off-by: Darren Stevens Signed-off-by: Michael Ellerman arch/powerpc/platforms/pasemi/pci.c | 11 +++++++++++ arch/powerpc/platforms/pasemi/setup.c | 15 +++++++++++++++ 2 files changed, 26 insertions(+) commit 656fdf3ad8e0ae4c6c3d75af373df6cc9797bac1 Author: Darren Stevens Date: Sun Aug 19 21:23:57 2018 +0100 powerpc/pasemi: Add Nemo board device init code. Add routines for Nemo specific devices to init at boot time, these being board level power-off and SB600's rtc. Also add a run time variable to prevent these being activated if we boot on a reference board. Signed-off-by: Darren Stevens Signed-off-by: Michael Ellerman arch/powerpc/platforms/pasemi/setup.c | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) commit 0428a5f494a003c98c1d1fc98aae605c288dc066 Author: Darren Stevens Date: Sun Aug 19 21:21:47 2018 +0100 powerpc/pasemi: Add Nemo board IRQ initroutine Add a IRQ init routine for the Nemo board which inits and attatches the i8259 found in the SB600, and a cascade routine to dispatch the interrupts. Signed-off-by: Darren Stevens Signed-off-by: Michael Ellerman arch/powerpc/platforms/pasemi/setup.c | 37 +++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) commit 68f211a4d1e5882e881bbb84b6505908dde5f625 Author: Darren Stevens Date: Sun Aug 19 21:21:55 2018 +0100 powerpc/pasemi: Add PCI initialisation for Nemo board. The A-Eon Amigaone X1000's Nemo motherboard has an AMD SB600 connected to one of the PCI-e root ports on its PaSemi Pwrficient 1628M SoC. Normally the SB600 southbridge would be connected to a hidden PCI-e port on the system's northbridge, and as a result doesn't fully comply with the PCI-e spec. Add code to relax the PCI-e detection in both the root port and the Linux kernel allowing on board devices to be detected. Signed-off-by: Darren Stevens Signed-off-by: Michael Ellerman arch/powerpc/platforms/pasemi/pci.c | 55 +++++++++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) commit 49a502ea23bf9dec47f8f3c3960909ff409cd1bb Author: Christophe Leroy Date: Fri Dec 14 15:23:33 2018 +0000 powerpc/mm: Make NULL pointer deferences explicit on bad page faults. As several other arches including x86, this patch makes it explicit that a bad page fault is a NULL pointer dereference when the fault address is lower than PAGE_SIZE In the mean time, this page makes all bad_page_fault() messages shorter so that they remain on one single line. And it prefixes them by "BUG: " so that they get easily grepped. Signed-off-by: Christophe Leroy [mpe: Avoid pr_cont()] Signed-off-by: Michael Ellerman arch/powerpc/mm/fault.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) commit 8dbdec0bcb416d0ef0bfd737620d08f5160ac290 Author: Dmitry V. Levin Date: Sun Dec 16 20:28:28 2018 +0300 powerpc/ptrace: Combine SYSCALL_EMU & SYSCALL_TRACE handling Combine the SYSCALL_EMU and SYSCALL_TRACE handling so that we only call tracehook_report_syscall_entry() in one place. Signed-off-by: Dmitry V. Levin [mpe: Flesh out change log, s/cached_flags/flags/, reflow comments] Signed-off-by: Michael Ellerman arch/powerpc/kernel/ptrace.c | 54 +++++++++++++++++++++++++------------------- 1 file changed, 31 insertions(+), 23 deletions(-) commit 25078dc1f74be16b858e914f52cc8f4d03c2271a Author: Christoph Hellwig Date: Sun Dec 16 17:53:49 2018 +0100 powerpc: use mm zones more sensibly Powerpc has somewhat odd usage where ZONE_DMA is used for all memory on common 64-bit configfs, and ZONE_DMA32 is used for 31-bit schemes. Move to a scheme closer to what other architectures use (and I dare to say the intent of the system): - ZONE_DMA: optionally for memory < 31-bit (64-bit embedded only) - ZONE_NORMAL: everything addressable by the kernel - ZONE_HIGHMEM: memory > 32-bit for 32-bit kernels Also provide information on how ZONE_DMA is used by defining ARCH_ZONE_DMA_BITS. Contains various fixes from Benjamin Herrenschmidt. Signed-off-by: Christoph Hellwig Signed-off-by: Michael Ellerman arch/powerpc/Kconfig | 8 ++--- arch/powerpc/include/asm/page.h | 2 ++ arch/powerpc/include/asm/pgtable.h | 1 - arch/powerpc/kernel/dma-swiotlb.c | 6 +--- arch/powerpc/kernel/dma.c | 8 ++--- arch/powerpc/mm/mem.c | 47 ++++++++++----------------- arch/powerpc/platforms/85xx/corenet_generic.c | 10 ------ arch/powerpc/platforms/85xx/qemu_e500.c | 9 ----- include/linux/mmzone.h | 2 +- 9 files changed, 26 insertions(+), 67 deletions(-) commit f3e5a8579c70d591db8e772cab93af0ec7e39849 Author: Christoph Hellwig Date: Sun Dec 16 18:19:51 2018 +0100 cxl: drop the dma_set_mask callback from vphb The CXL code never even looks at the dma mask, so there is no good reason for this sanity check. Remove it because it gets in the way of the dma ops refactoring. Signed-off-by: Christoph Hellwig Acked-by: Andrew Donnellan Signed-off-by: Michael Ellerman drivers/misc/cxl/vphb.c | 12 ------------ 1 file changed, 12 deletions(-) commit 44a0337b322e0ee2b817e334436366d394654d07 Author: Christoph Hellwig Date: Sun Dec 16 18:19:50 2018 +0100 powerpc/dma: split the two __dma_alloc_coherent implementations The implemementation for the CONFIG_NOT_COHERENT_CACHE case doesn't share any code with the one for systems with coherent caches. Split it off and merge it with the helpers in dma-noncoherent.c that have no other callers. Signed-off-by: Christoph Hellwig Acked-by: Benjamin Herrenschmidt Signed-off-by: Michael Ellerman arch/powerpc/include/asm/dma-mapping.h | 5 ----- arch/powerpc/kernel/dma.c | 14 ++------------ arch/powerpc/mm/dma-noncoherent.c | 15 +++++++-------- arch/powerpc/platforms/44x/warp.c | 2 +- 4 files changed, 10 insertions(+), 26 deletions(-) commit 9c15a87cfc6ce34bc6f2a5cee5e3994c28307942 Author: Christoph Hellwig Date: Sun Dec 16 18:19:49 2018 +0100 powerpc/dma: remove the unused dma_iommu_ops export Signed-off-by: Christoph Hellwig Signed-off-by: Michael Ellerman arch/powerpc/kernel/dma-iommu.c | 2 -- 1 file changed, 2 deletions(-) commit acddff9dc4392b5445ca393254712db47ebb24cf Author: Christoph Hellwig Date: Sun Dec 16 18:19:48 2018 +0100 powerpc/dma: remove the unused ISA_DMA_THRESHOLD export Signed-off-by: Christoph Hellwig Acked-by: Benjamin Herrenschmidt Signed-off-by: Michael Ellerman arch/powerpc/kernel/setup_32.c | 1 - 1 file changed, 1 deletion(-) commit 0e652390fb95ae567fe709d2b388f4e9c792224c Author: Christoph Hellwig Date: Sun Dec 16 18:19:47 2018 +0100 powerpc/dma: remove the unused ARCH_HAS_DMA_MMAP_COHERENT define Signed-off-by: Christoph Hellwig Acked-by: Benjamin Herrenschmidt Signed-off-by: Michael Ellerman arch/powerpc/include/asm/dma-mapping.h | 2 -- 1 file changed, 2 deletions(-) commit 67d8208fba1324fa0198f9fc58a9edbe09596947 Author: Christoph Hellwig Date: Sun Dec 16 18:19:46 2018 +0100 crypto4xx_core: don't abuse __dma_sync_page This function is internal to the DMA API implementation. Instead use the DMA API to properly unmap. Note that the DMA API usage in this driver is a disaster and urgently needs some work - it is missing all the unmaps, seems to do a secondary map where it looks like it should to a unmap in one place to work around cache coherency and the directions passed in seem to be partially wrong. Signed-off-by: Christoph Hellwig Tested-by: Christian Lamparter Signed-off-by: Michael Ellerman drivers/crypto/amcc/crypto4xx_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0aeba2d0d27c7341c10aeae7f013ad5f034d8b2d Author: Christoph Hellwig Date: Sun Dec 16 18:19:45 2018 +0100 powerpc/dma: properly wire up the unmap_page and unmap_sg methods The unmap methods need to transfer memory ownership back from the device to the cpu by identical means as dma_sync_*_to_cpu. I'm not sure powerpc needs to do any work in this transfer direction, but given that it does invalidate the caches in dma_sync_*_to_cpu already we should make sure we also do so on unmapping. Signed-off-by: Christoph Hellwig [mpe: s/dir/direction in dma_nommu_unmap_page()] Signed-off-by: Michael Ellerman arch/powerpc/kernel/dma.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit 9286356907caa2d4737bd9dd8afe0b4ccaeea02b Author: Christoph Hellwig Date: Sun Dec 16 18:19:44 2018 +0100 powerpc: allow NOT_COHERENT_CACHE for amigaone AMIGAONE selects NOT_COHERENT_CACHE, so we better allow it. Signed-off-by: Christoph Hellwig Signed-off-by: Michael Ellerman arch/powerpc/platforms/Kconfig.cputype | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit b18f0ae92b0a1db565c3e505fa87b6971ad3b641 Author: Christophe Leroy Date: Fri Dec 14 10:27:47 2018 +0000 powerpc/prom: fix early DEBUG messages This patch fixes early DEBUG messages in prom.c: - Use %px instead of %p to see the addresses - Cast memblock_phys_mem_size() with (unsigned long long) to avoid build failure when phys_addr_t is not 64 bits. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman arch/powerpc/kernel/prom.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit e1e71e201703500f708bdeaf64660a2a178cb6a0 Author: Greg Kurz Date: Sun Dec 16 22:28:50 2018 +0100 ocxl: Fix endiannes bug in ocxl_link_update_pe() All fields in the PE are big-endian. Use cpu_to_be32() like everywhere else something is written to the PE. Otherwise a wrong TID will be used by the NPU. If this TID happens to point to an existing thread sharing the same mm, it could be woken up by error. This is highly improbable though. The likely outcome of this is the NPU not finding the target thread and forcing the AFU into sending an interrupt, which userspace is supposed to handle anyway. Fixes: e948e06fc63a ("ocxl: Expose the thread_id needed for wait on POWER9") Cc: stable@vger.kernel.org # v4.18 Signed-off-by: Greg Kurz Acked-by: Andrew Donnellan Signed-off-by: Michael Ellerman drivers/misc/ocxl/link.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 72e7bcc2cdf82bf03caaa5e6c9b0134c2fc2ee7d Author: Joel Stanley Date: Mon Nov 12 15:58:06 2018 +1030 powerpc/32: Avoid unsupported flags with clang When building for ppc32 with clang these flags are unsupported: -ffixed-r2 and -mmultiple llvm's lib/Target/PowerPC/PPCRegisterInfo.cpp marks r2 as reserved on when building for SVR4ABI and !ppc64: // The SVR4 ABI reserves r2 and r13 if (Subtarget.isSVR4ABI()) { // We only reserve r2 if we need to use the TOC pointer. If we have no // explicit uses of the TOC pointer (meaning we're a leaf function with // no constant-pool loads, etc.) and we have no potential uses inside an // inline asm block, then we can treat r2 has an ordinary callee-saved // register. const PPCFunctionInfo *FuncInfo = MF.getInfo(); if (!TM.isPPC64() || FuncInfo->usesTOCBasePtr() || MF.hasInlineAsm()) markSuperRegs(Reserved, PPC::R2); // System-reserved register markSuperRegs(Reserved, PPC::R13); // Small Data Area pointer register } This means we can safely omit -ffixed-r2 when building for 32-bit targets. The -mmultiple/-mno-multiple flags are not supported by clang, so platforms that might support multiple miss out on using multiple word instructions. We wrap these flags in cc-option so that when Clang gains support the kernel will be able use these flags. Clang 8 can then build a ppc44x_defconfig which boots in Qemu: make CC=clang-8 ARCH=powerpc CROSS_COMPILE=powerpc-linux-gnu- ppc44x_defconfig ./scripts/config -e CONFIG_DEVTMPFS -d DEVTMPFS_MOUNT make CC=clang-8 ARCH=powerpc CROSS_COMPILE=powerpc-linux-gnu- qemu-system-ppc -M bamboo \ -kernel arch/powerpc/boot/zImage \ -dtb arch/powerpc/boot/dts/bamboo.dtb \ -initrd ~/ppc32-440-rootfs.cpio \ -nographic -serial stdio -monitor pty -append "console=ttyS0" Link: https://github.com/ClangBuiltLinux/linux/issues/261 Link: https://bugs.llvm.org/show_bug.cgi?id=39556 Link: https://bugs.llvm.org/show_bug.cgi?id=39555 Signed-off-by: Joel Stanley Reviewed-by: Nick Desaulniers Signed-off-by: Michael Ellerman arch/powerpc/Makefile | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit e213574a449f7a57d4202c1869bbc7680b6b5521 Author: Joel Stanley Date: Fri Nov 2 11:14:55 2018 +1030 raid6/ppc: Fix build for clang We cannot build these files with clang as it does not allow altivec instructions in assembly when -msoft-float is passed. Jinsong Ji wrote: > We currently disable Altivec/VSX support when enabling soft-float. So > any usage of vector builtins will break. > > Enable Altivec/VSX with soft-float may need quite some clean up work, so > I guess this is currently a limitation. > > Removing -msoft-float will make it work (and we are lucky that no > floating point instructions will be generated as well). This is a workaround until the issue is resolved in clang. Link: https://bugs.llvm.org/show_bug.cgi?id=31177 Link: https://github.com/ClangBuiltLinux/linux/issues/239 Signed-off-by: Joel Stanley Reviewed-by: Nick Desaulniers Signed-off-by: Michael Ellerman lib/raid6/Makefile | 15 +++++++++++++++ 1 file changed, 15 insertions(+) commit 3757cba80affcef2ef670f0db3d3504ccf967830 Author: Madhavan Srinivasan Date: Sun Jun 10 19:57:02 2018 +0530 powerpc/perf: Remove l2 bus events from HW cache event array Remove PM_L2_ST_MISS and PM_L2_ST from HW cache event array since these are bus events. And these needs to be programmed in groups. Hence remove them. Fixes: f1fb60bfde65 ('powerpc/perf: Export Power9 generic and cache events to sysfs') Signed-off-by: Madhavan Srinivasan Signed-off-by: Michael Ellerman arch/powerpc/perf/power9-pmu.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) commit 59029136d75022cb8b7c7bebd1738ae70232416e Author: Madhavan Srinivasan Date: Sun Jun 10 19:57:01 2018 +0530 powerpc/perf: Add constraints for power9 l2/l3 bus events In previous generation processors, both bus events and direct events of performance monitoring unit can be individually programmabled and monitored in PMCs. But in Power9, L2/L3 bus events are always available as a "bank" of 4 events. To obtain the counts for any of the l2/l3 bus events in a given bank, the user will have to program PMC4 with corresponding l2/l3 bus event for that bank. Patch enforce two contraints incase of L2/L3 bus events. 1)Any L2/L3 event when programmed is also expected to program corresponding PMC4 event from that group. 2)PMC4 event should always been programmed first due to group constraint logic limitation For ex. consider these L3 bus events PM_L3_PF_ON_CHIP_MEM (0x460A0), PM_L3_PF_MISS_L3 (0x160A0), PM_L3_CO_MEM (0x260A0), PM_L3_PF_ON_CHIP_CACHE (0x360A0), 1) This is an INVALID group for L3 Bus event monitoring, since it is missing PMC4 event. perf stat -e "{r160A0,r260A0,r360A0}" < > And this is a VALID group for L3 Bus events: perf stat -e "{r460A0,r160A0,r260A0,r360A0}" < > 2) This is an INVALID group for L3 Bus event monitoring, since it is missing PMC4 event. perf stat -e "{r260A0,r360A0}" < > And this is a VALID group for L3 Bus events: perf stat -e "{r460A0,r260A0,r360A0}" < > 3) This is an INVALID group for L3 Bus event monitoring, since it is missing PMC4 event. perf stat -e "{r360A0}" < > And this is a VALID group for L3 Bus events: perf stat -e "{r460A0,r360A0}" < > Patch here implements group constraint logic suggested by Michael Ellerman. Signed-off-by: Madhavan Srinivasan Signed-off-by: Michael Ellerman arch/powerpc/include/asm/perf_event_server.h | 2 ++ arch/powerpc/perf/core-book3s.c | 20 +++++++++++++++----- arch/powerpc/perf/isa207-common.c | 28 ++++++++++++++++++---------- arch/powerpc/perf/isa207-common.h | 5 +++++ arch/powerpc/perf/power9-pmu.c | 2 ++ 5 files changed, 42 insertions(+), 15 deletions(-) commit 2d46d4877b1afd14059393a48bdb8ce27955174c Author: Madhavan Srinivasan Date: Mon Oct 9 19:42:40 2017 +0530 powerpc/perf: Fix unit_sel/cache_sel checks Raw event code has couple of fields "unit" and "cache" in it, to capture the "unit" to monitor for a given pmcxsel and cache reload qualifier to program in MMCR1. isa207_get_constraint() refers "unit" field to update the MMCRC (L2/L3) Event bus control fields with "cache" bits of the raw event code. These are power8 specific and not supported by PowerISA v3.0 pmu. So wrap the checks to be power8 specific. Also, "cache" bit field is referred to update MMCR1[16:17] and this check can be power8 specific. Fixes: 7ffd948fae4cd ('powerpc/perf: factor out power8 pmu functions') Signed-off-by: Madhavan Srinivasan Signed-off-by: Michael Ellerman arch/powerpc/perf/isa207-common.c | 25 ++++++++++++++++++------- arch/powerpc/perf/isa207-common.h | 4 ++-- 2 files changed, 20 insertions(+), 9 deletions(-) commit 8c31459d6138b07537346d976e7c30c760a1de01 Author: Madhavan Srinivasan Date: Mon Oct 9 19:42:39 2017 +0530 powerpc/perf: Cleanup cache_sel bits comment Update the raw event code comment in power9-pmu.c with respect to "cache" bits, since power9 MMCRC does not support these. Signed-off-by: Madhavan Srinivasan Signed-off-by: Michael Ellerman arch/powerpc/perf/power9-pmu.c | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) commit 333804dc3b7a92158ab63a48febff0d8ef89ada3 Author: Madhavan Srinivasan Date: Sun Dec 9 14:55:35 2018 +0530 powerpc/perf: Update perf_regs structure to include SIER On each sample, Sample Instruction Event Register (SIER) content is saved in pt_regs. SIER does not have a entry as-is in the pt_regs but instead, SIER content is saved in the "dar" register of pt_regs. Patch adds another entry to the perf_regs structure to include the "SIER" printing which internally maps to the "dar" of pt_regs. It also check for the SIER availability in the platform and present value accordingly Signed-off-by: Madhavan Srinivasan Signed-off-by: Michael Ellerman arch/powerpc/include/asm/perf_event.h | 3 +++ arch/powerpc/include/uapi/asm/perf_regs.h | 1 + arch/powerpc/perf/core-book3s.c | 8 ++++++++ arch/powerpc/perf/perf_regs.c | 7 +++++++ tools/arch/powerpc/include/uapi/asm/perf_regs.h | 1 + tools/perf/arch/powerpc/include/perf_regs.h | 3 ++- tools/perf/arch/powerpc/util/perf_regs.c | 1 + 7 files changed, 23 insertions(+), 1 deletion(-) commit 17cfccc91545682513541924245abb876d296063 Author: Madhavan Srinivasan Date: Sun Dec 9 14:48:15 2018 +0530 powerpc/perf: Fix thresholding counter data for unknown type MMCRA[34:36] and MMCRA[38:44] expose the thresholding counter value. Thresholding counter can be used to count latency cycles such as load miss to reload. But threshold counter value is not relevant when the sampled instruction type is unknown or reserved. Patch to fix the thresholding counter value to zero when sampled instruction type is unknown or reserved. Fixes: 170a315f41c6('powerpc/perf: Support to export MMCRA[TEC*] field to userspace') Signed-off-by: Madhavan Srinivasan Signed-off-by: Michael Ellerman arch/powerpc/perf/isa207-common.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 374f3f5979f9b28bfb5b5799208d82d08ef518a7 Author: Aneesh Kumar K.V Date: Mon Nov 26 20:05:04 2018 +0530 powerpc/mm/hash: Handle user access of kernel address gracefully In commit 2865d08dd9ea ("powerpc/mm: Move the DSISR_PROTFAULT sanity check") we moved the protection fault access check before the vma lookup. That means we hit that WARN_ON when user space accesses a kernel address. Before that commit this was handled by find_vma() not finding vma for the kernel address and considering that access as bad area access. Avoid the confusing WARN_ON and convert that to a ratelimited printk. With the patch we now get: for load: a.out[5997]: User access of kernel address (c00000000000dea0) - exploit attempt? (uid: 1000) a.out[5997]: segfault (11) at c00000000000dea0 nip 1317c0798 lr 7fff80d6441c code 1 in a.out[1317c0000+10000] a.out[5997]: code: 60000000 60420000 3c4c0002 38427790 4bffff20 3c4c0002 38427784 fbe1fff8 a.out[5997]: code: f821ffc1 7c3f0b78 60000000 e9228030 <89290000> 993f002f 60000000 383f0040 for exec: a.out[6067]: User access of kernel address (c00000000000dea0) - exploit attempt? (uid: 1000) a.out[6067]: segfault (11) at c00000000000dea0 nip c00000000000dea0 lr 129d507b0 code 1 a.out[6067]: Bad NIP, not dumping instructions. Fixes: 2865d08dd9ea ("powerpc/mm: Move the DSISR_PROTFAULT sanity check") Signed-off-by: Aneesh Kumar K.V Tested-by: Breno Leitao [mpe: Don't split printk() string across lines] Signed-off-by: Michael Ellerman arch/powerpc/mm/fault.c | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-) commit 5c6a1177826e5207306511a480b5aae79fd0fefb Author: Sinan Kaya Date: Wed Dec 19 22:46:59 2018 +0000 ACPI: Make PCI slot detection driver depend on PCI Since this is ACPI PCI slot detection driver for PCI, it doesn't make sense to compile this without PCI support in place. Signed-off-by: Sinan Kaya Signed-off-by: Rafael J. Wysocki drivers/acpi/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 43554cebba50e709b9207c55ceca6bc281748586 Author: Sinan Kaya Date: Wed Dec 19 22:46:58 2018 +0000 ACPI/IORT: Stub out ACS functions when CONFIG_PCI is not set Remove PCI dependent code out of iort.c when CONFIG_PCI is not defined. A quick search reveals the following functions: 1. pci_request_acs() 2. pci_domain_nr() 3. pci_is_root_bus() 4. to_pci_dev() Both pci_domain_nr() and pci_is_root_bus() are defined in linux/pci.h. pci_domain_nr() is a stub function when CONFIG_PCI is not set and pci_is_root_bus() just returns a reference to a structure member which is still valid without CONFIG_PCI set. to_pci_dev() is a macro that expands to container_of. pci_request_acs() is the only code that gets pulled in from drivers/pci/*.c Signed-off-by: Sinan Kaya Acked-by: Lorenzo Pieralisi Signed-off-by: Rafael J. Wysocki drivers/acpi/arm64/iort.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) commit 52146173a0333a8c9fbc1a3dd92958f376511b38 Author: Sinan Kaya Date: Wed Dec 19 22:46:57 2018 +0000 arm64: select ACPI PCI code only when both features are enabled ACPI and PCI are no longer coupled to each other. Specify requirements for both when pulling in code. Signed-off-by: Sinan Kaya Acked-by: Catalin Marinas Signed-off-by: Rafael J. Wysocki arch/arm64/Kconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 5d32a66541c4683456507481a0944ed2985e75c7 Author: Sinan Kaya Date: Wed Dec 19 22:46:56 2018 +0000 PCI/ACPI: Allow ACPI to be built without CONFIG_PCI set We are compiling PCI code today for systems with ACPI and no PCI device present. Remove the useless code and reduce the tight dependency. Signed-off-by: Sinan Kaya Acked-by: Bjorn Helgaas # PCI parts Acked-by: Ingo Molnar Signed-off-by: Rafael J. Wysocki arch/x86/include/asm/pci_x86.h | 7 +++++++ drivers/acpi/Kconfig | 1 - drivers/acpi/Makefile | 2 +- drivers/acpi/internal.h | 5 +++++ drivers/pci/Makefile | 2 +- include/acpi/acpi_drivers.h | 7 +++++++ include/linux/acpi.h | 7 +++++++ include/linux/pci.h | 4 ++++ 8 files changed, 32 insertions(+), 3 deletions(-) commit bd23fac3eaaa8bd79c02a2f139f68ac6424a9a7c Author: Sinan Kaya Date: Wed Dec 19 22:46:55 2018 +0000 ACPICA: Remove PCI bits from ACPICA when CONFIG_PCI is unset Allow ACPI to be built without PCI support in place. Signed-off-by: Sinan Kaya Signed-off-by: Rafael J. Wysocki drivers/acpi/acpica/Makefile | 2 +- drivers/acpi/acpica/achware.h | 9 +++++++++ drivers/acpi/acpica/evhandler.c | 8 ++++---- drivers/acpi/acpica/exregion.c | 4 ++++ drivers/acpi/osl.c | 2 ++ include/acpi/platform/aclinux.h | 4 ++++ 6 files changed, 24 insertions(+), 5 deletions(-) commit 86689776878f0c1aee77604b9c5fce2ffb9ec65e Author: Sinan Kaya Date: Wed Dec 19 22:46:54 2018 +0000 ACPI: Allow CONFIG_PCI to be unset for reboot Make PCI reboot conditional on CONFIG_PCI set on the kernel configuration. Signed-off-by: Sinan Kaya Signed-off-by: Rafael J. Wysocki drivers/acpi/reboot.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 36ad7d2b9e9bde9aeb097fcfd3c033b5c010f92a Author: Sinan Kaya Date: Wed Dec 19 22:46:53 2018 +0000 ACPI: Move PCI reset to a separate function Getting ready to factor out PCI specific code when CONFIG_PCI is unset. Create a acpi_pci_reset() that kick starts PCI specific reset. Signed-off-by: Sinan Kaya Signed-off-by: Rafael J. Wysocki drivers/acpi/reboot.c | 32 +++++++++++++++++++------------- 1 file changed, 19 insertions(+), 13 deletions(-) commit 03ebe48e235f17d70f34890d34d8153b8a84c02e Merge: 2713fe37153e b6d39cd82241 b65f501627ff 062e52a5af9c a6906a8b0ebf 69d24c6ed67c 6d68b88e0993 c12b08ebbe16 dc9de8a2b20f Author: Joerg Roedel Date: Thu Dec 20 10:05:20 2018 +0100 Merge branches 'iommu/fixes', 'arm/renesas', 'arm/mediatek', 'arm/tegra', 'arm/omap', 'arm/smmu', 'x86/vt-d', 'x86/amd' and 'core' into next commit dc9de8a2b20f495696330d60a289935f36407995 Author: Joerg Roedel Date: Thu Dec 20 10:02:20 2018 +0100 iommu: Check for iommu_ops == NULL in iommu_probe_device() This check needs to be there and got lost at some point during development. Add it again. Fixes: 641fb0efbff0 ('iommu/of: Don't call iommu_ops->add_device directly') Reported-by: Marek Szyprowski Reported-by: kernelci.org bot Signed-off-by: Joerg Roedel drivers/iommu/iommu.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit a9cd3439e3c6d777a05c63b4d06c3500d1d4074e Author: David Ahern Date: Wed Dec 19 20:02:36 2018 -0800 neighbor: Use nda_policy for validating attributes in adds and dump requests Add NDA_PROTOCOL to nda_policy and use the policy for attribute parsing and validation for adding neighbors and in dump requests. Remove the now duplicate checks on nla_len. Signed-off-by: David Ahern Signed-off-by: David S. Miller net/core/neighbour.c | 22 +++++----------------- 1 file changed, 5 insertions(+), 17 deletions(-) commit d129a45b5c9d9ad814adb795413d76be6b28a47e Merge: 754d5da63145 1154bb26c879 Author: David S. Miller Date: Wed Dec 19 23:47:59 2018 -0800 Merge branch 'hns3-next' Peng Li says: ==================== net: hns3: code optimizations & bugfixes for HNS3 driver This patchset includes bugfixes and code optimizations for the HNS3 ethernet controller driver ==================== Signed-off-by: David S. Miller commit 1154bb26c879fea51c20aee167ddce4345caa255 Author: Peng Li Date: Thu Dec 20 11:52:06 2018 +0800 net: hns3: remove redundant variable initialization This patch removes the redundant variable initialization, as driver will devm_kzalloc to set value to hdev soon. Signed-off-by: Peng Li Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 31a16f99e02c2e0b40a5fb05d66f5e56721027e2 Author: Peng Li Date: Thu Dec 20 11:52:05 2018 +0800 net: hns3: fix the descriptor index when get rss type Driver gets rss information from the last descriptor of the packet. When driver handle the rss type, ring->next_to_clean indicates the first descriptor of next packet. This patch fix the descriptor index with "ring->next_to_clean - 1". Fixes: 232fc64b6e62 ("net: hns3: Add HW RSS hash information to RX skb") Signed-off-by: Peng Li Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit 8edc2285b7285c5fbffe438dc8113260d3e76656 Author: Jian Shen Date: Thu Dec 20 11:52:04 2018 +0800 net: hns3: don't restore rules when flow director is disabled When user disables flow director, all the rules will be disabled. But when reset happens, it will restore all the rules again. It's not reasonable. This patch fixes it by add flow director status check before restore fules. Fixes: 6871af29b3ab ("net: hns3: Add reset handle for flow director") Fixes: c17852a8932f ("net: hns3: Add support for enable/disable flow director") Signed-off-by: Jian Shen Signed-off-by: Peng Li Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 ++++ 1 file changed, 4 insertions(+) commit 0285dbae5db842862d49f148cdcedad986447f34 Author: Jian Shen Date: Thu Dec 20 11:52:03 2018 +0800 net: hns3: fix vf id check issue when add flow director rule When add flow director fule for vf, the vf id is used as array subscript before valid checking, which may cause memory overflow. Fixes: dd74f815dd41 ("net: hns3: Add support for rule add/delete for flow director") Signed-off-by: Jian Shen Signed-off-by: Peng Li Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit 39cfbc9c4fc4a2888548c2624789e42e3f775721 Author: Huazhong Tan Date: Thu Dec 20 11:52:02 2018 +0800 net: hns3: reset tqp while doing DOWN operation While doing DOWN operation, the driver will reclaim the memory which has already used for TX. If the hardware is processing this memory, it will cause a RCB error to the hardware. According the hardware's description, the driver should reset the tqp before reclaim the memory during DOWN. Signed-off-by: Huazhong Tan Signed-off-by: Peng Li Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 ++++ drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 4 ++++ 2 files changed, 8 insertions(+) commit 75edb610860fda65ceedb017fc69afabd2806b8b Author: Jian Shen Date: Thu Dec 20 11:52:01 2018 +0800 net: hns3: add max vector number check for pf Each pf supports max 64 vectors and 128 tqps. For 2p/4p core scenario, there may be more than 64 cpus online. So the result of min_t(u16, num_Online_cpus(), tqp_num) may be more than 64. This patch adds check for the vector number. Fixes: dd38c72604dc ("net: hns3: fix for coalesce configuration lost during reset") Signed-off-by: Jian Shen Signed-off-by: Peng Li Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 4 ++++ 1 file changed, 4 insertions(+) commit 1b7d7b0581173219b82abbd81c88cf8aa7d402c2 Author: Peng Li Date: Thu Dec 20 11:52:00 2018 +0800 net: hns3: fix a bug caused by udelay udelay() in driver may always occupancy processor. If there is only one cpu in system, the VF driver may initialize fail when insmod PF and VF driver in the same system. This patch use msleep() to free cpu when VF wait PF message. Signed-off-by: Peng Li Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_mbx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit a298797532d9dc244abf349d7c2ed063732c6ba3 Author: Jian Shen Date: Thu Dec 20 11:51:59 2018 +0800 net: hns3: change default tc state to close In original codes, default tc value is set to the max tc. It's more reasonable to close tc by changing default tc value to 1. Users can enable it with lldp tool when they want to use tc. Signed-off-by: Jian Shen Signed-off-by: Peng Li Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8cdb992f0dc36d6382840b1a6320e0c327a7d644 Author: Jian Shen Date: Thu Dec 20 11:51:58 2018 +0800 net: hns3: refine the handle for hns3_nic_net_open/stop() When triggering nic down, there is a time window between bringing down the protocol stack and stopping the work task. If the net is up in the time window, it may bring up the protocol stack again. This patch fixes it by stop the work task at the beginning of hns3_nic_net_stop(). To keep symmetrical, start the work task at the end of hns3_nic_net_open(). Signed-off-by: Jian Shen Signed-off-by: Peng Li Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns3/hnae3.h | 1 + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 8 ++++++++ .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 22 +++++++++++++++------- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 18 ++++++++++++++---- 4 files changed, 38 insertions(+), 11 deletions(-) commit 3fe970e76b374bdb4a6232cb8b78945e3d2b478f Author: YueHaibing Date: Wed Dec 5 07:59:03 2018 +0000 wil6210: remove set but not used variable 'wdev' Fixes gcc '-Wunused-but-set-variable' warning: drivers/net/wireless/ath/wil6210/main.c: In function '_wil6210_disconnect': drivers/net/wireless/ath/wil6210/main.c:407:23: warning: variable 'wdev' set but not used [-Wunused-but-set-variable] It never used since commit ("e1b43407c034 wil6210: refactor disconnect flow") Signed-off-by: YueHaibing Reviewed-by: Maya Erez Signed-off-by: Kalle Valo drivers/net/wireless/ath/wil6210/main.c | 2 -- 1 file changed, 2 deletions(-) commit 986b834884647e31dc5a78b8d0a6da210ebda0b0 Author: Yangtao Li Date: Mon Dec 3 08:25:57 2018 -0500 wil6210: convert to DEFINE_SHOW_ATTRIBUTE Use DEFINE_SHOW_ATTRIBUTE macro to simplify the code. Signed-off-by: Yangtao Li Signed-off-by: Kalle Valo drivers/net/wireless/ath/wil6210/debugfs.c | 240 +++++------------------------ 1 file changed, 42 insertions(+), 198 deletions(-) commit 192a986d964c3ebd927da102adbf8bcc604c7cbc Author: Kyle Roeschley Date: Wed Dec 5 09:43:16 2018 +0200 ath6kl: Use debug instead of error message when disabled This is not an unexpected condition, so we don't need to be shouting to the world about it. Signed-off-by: Kyle Roeschley Signed-off-by: Kalle Valo drivers/net/wireless/ath/ath6kl/cfg80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5803c12816c43bd09e5f4247dd9313c2d9a2c41b Author: Kyle Roeschley Date: Wed Dec 5 09:43:13 2018 +0200 ath6kl: Fix off by one error in scan completion When ath6kl was reworked to share code between regular and scheduled scans in commit 3b8ffc6a22ba ("ath6kl: Configure probed SSID list consistently"), probed SSID entry changed from 1-index to 0-indexed. However, ath6kl_cfg80211_scan_complete_event() was missed in that change. Fix its indexing so that we correctly clear out the probed SSID list. Signed-off-by: Kyle Roeschley Signed-off-by: Kalle Valo drivers/net/wireless/ath/ath6kl/cfg80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fb376a495fbdb886f38cfaf5a3805401b9e46f13 Author: Kyle Roeschley Date: Wed Dec 5 09:43:11 2018 +0200 ath6kl: Only use match sets when firmware supports it Commit dd45b7598f1c ("ath6kl: Include match ssid list in scheduled scan") merged the probed and matched SSID lists before sending them to the firmware. In the process, it assumed match set support is always available in ath6kl_set_probed_ssids, which breaks scans for hidden SSIDs. Now, check that the firmware supports matching SSIDs in scheduled scans before setting MATCH_SSID_FLAG. Fixes: dd45b7598f1c ("ath6kl: Include match ssid list in scheduled scan") Signed-off-by: Kyle Roeschley Signed-off-by: Kalle Valo drivers/net/wireless/ath/ath6kl/cfg80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 19de2fa86e692e918eade4042989d7725039df89 Author: Shahar S Matityahu Date: Wed Dec 19 11:36:19 2018 +0200 iwlwifi: dbg_ini: fix bad ini tlv parsing Add a break at the end of the ini tlv case. Fix both the internal and external tlv parsing. Signed-off-by: Shahar S Matityahu Signed-off-by: Emmanuel Grumbach Signed-off-by: Kalle Valo drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 1 + drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 1 + 2 files changed, 2 insertions(+) commit 06d4dd2f2ce1cdb625f77c0676d5af6ba310c01d Author: Christoph Hellwig Date: Fri Dec 14 09:15:02 2018 +0100 dma-mapping: deprecate dma_zalloc_coherent We now always return zeroed memory from dma_alloc_coherent. Note that simply passing GFP_ZERO to dma_alloc_coherent wasn't always doing the right thing to start with given that various allocators are not backed by the page allocator and thus would ignore GFP_ZERO. Signed-off-by: Christoph Hellwig Documentation/DMA-API.txt | 9 --------- include/linux/dma-mapping.h | 7 ++++--- 2 files changed, 4 insertions(+), 12 deletions(-) commit 518a2f1925c3165befbf06b75e07636549d92c1c Author: Christoph Hellwig Date: Fri Dec 14 09:00:40 2018 +0100 dma-mapping: zero memory returned from dma_alloc_* If we want to map memory from the DMA allocator to userspace it must be zeroed at allocation time to prevent stale data leaks. We already do this on most common architectures, but some architectures don't do this yet, fix them up, either by passing GFP_ZERO when we use the normal page allocator or doing a manual memset otherwise. Signed-off-by: Christoph Hellwig Acked-by: Geert Uytterhoeven [m68k] Acked-by: Sam Ravnborg [sparc] arch/alpha/kernel/pci_iommu.c | 2 +- arch/arc/mm/dma.c | 2 +- arch/c6x/mm/dma-coherent.c | 5 ++++- arch/m68k/kernel/dma.c | 2 +- arch/microblaze/mm/consistent.c | 2 +- arch/openrisc/kernel/dma.c | 2 +- arch/parisc/kernel/pci-dma.c | 4 ++-- arch/s390/pci/pci_dma.c | 2 +- arch/sparc/kernel/ioport.c | 2 +- arch/sparc/mm/io-unit.c | 2 +- arch/sparc/mm/iommu.c | 2 +- arch/xtensa/kernel/pci-dma.c | 2 +- drivers/misc/mic/host/mic_boot.c | 2 +- kernel/dma/virt.c | 2 +- 14 files changed, 18 insertions(+), 15 deletions(-) commit 9517d448d543d8bd0f83e4edc29b4b53d74a7f71 Author: Luca Coelho Date: Wed Jun 13 15:26:37 2018 +0300 iwlwifi: bump the API version to 43 for 9000 and 22000 Bump the API version to 43 for 9000 and 22000 devices. Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo drivers/net/wireless/intel/iwlwifi/cfg/22000.c | 2 +- drivers/net/wireless/intel/iwlwifi/cfg/9000.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 2c47e5a1f25b1c894c9fe2f77c156c054ae8ffb7 Author: Sara Sharon Date: Thu Sep 6 10:03:22 2018 +0300 iwlwifi: dbg: add debug data to warning Add debug data to the warning issued when getting wrong region id from firmware. Signed-off-by: Sara Sharon Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 83ea00d6873fd7a6b7e94cf40f6dd0007593fb1e Author: Gustavo A. R. Silva Date: Thu Aug 23 20:15:40 2018 -0500 iwlwifi: mvm: d3: use struct_size() in kzalloc() One of the more common cases of allocation size calculations is finding the size of a structure that has a zero-sized array at the end, along with memory for some number of elements for that array. For example: struct foo { int stuff; void *entry[]; }; instance = kzalloc(sizeof(struct foo) + sizeof(void *) * count, GFP_KERNEL); Instead of leaving these open-coded and prone to type mistakes, we can now use the new struct_size() helper: instance = kzalloc(struct_size(instance, entry, count), GFP_KERNEL); This issue was detected with the help of Coccinelle. Signed-off-by: Gustavo A. R. Silva Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit b71a9c35f214dbd9e9e33d36219bd0383f861677 Author: Colin Ian King Date: Sun Aug 26 23:31:17 2018 +0100 iwlwifi: mvm: fix spelling mistake "Recieved" -> "Received" Trivial fix to spelling mistake in debug message. Signed-off-by: Colin Ian King Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2c34be6c1fc8a0c90073dead7bce13937661eadf Author: Emmanuel Grumbach Date: Mon Sep 3 14:32:48 2018 +0300 iwlwifi: mvm: set TWT responder capability bit in 11AX SoftAP mode This is needed to test TWT requester on the client side. Signed-off-by: Emmanuel Grumbach Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 8804351c17f90eb13684d13ea994e7600d2be846 Author: Luca Coelho Date: Thu Aug 30 15:07:03 2018 +0300 iwlwifi: remove unused and wrong PHY_CFG_* macros These macros are never used and are actually wrong, so it's very confusing. Remove them. Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo drivers/net/wireless/intel/iwlwifi/fw/api/config.h | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-) commit a06875a7f8fae2d5b4891abb28c2c4a44ee1ffe8 Author: Shahar S Matityahu Date: Tue Aug 28 16:15:55 2018 +0300 iwlwifi: wrt: add rt status and num of rx/tx fifos to dump Add the rt status of the last assert or 0 if the dump collection was not initiated by an assert. Add the number of rx and tx fifos in use. These fields are added to dump info lst file. Signed-off-by: Shahar S Matityahu Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 1 + drivers/net/wireless/intel/iwlwifi/fw/dbg.h | 1 + drivers/net/wireless/intel/iwlwifi/fw/error-dump.h | 3 +++ drivers/net/wireless/intel/iwlwifi/fw/runtime.h | 1 + drivers/net/wireless/intel/iwlwifi/mvm/utils.c | 3 +++ 5 files changed, 9 insertions(+) commit 35739348ba07186a6b186e3aae5728721ff57a9a Author: Sara Sharon Date: Wed Aug 22 10:50:49 2018 +0300 iwlwifi: mvm: clean up SSN incrementation Sometimes, due to SCD bug, we need to start the queue with an higher SSN. The queue allocation function currently increments the SSN in the packet itself, but it is pointless, since this value is overridden later by iwl_mvm_tx_mpdu with the value from mvmsta->tid_data[tid].seq_number. Updating tid data is sufficient. Signed-off-by: Sara Sharon Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) commit 3681729429f4626c85a4eb62e5ce76be0b626f87 Author: Sara Sharon Date: Mon Aug 27 14:07:20 2018 +0300 iwlwifi: pcie: lock txq a bit later in reclaim code In reclaim code, we don't need to take the queue lock for waking the queue. The code section is executed only when the tx path is stopped, and since the reclaim path is not executed in parallel to itself, no one can update the queue pointers, and accessing them is safe without a lock. Signed-off-by: Sara Sharon Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo drivers/net/wireless/intel/iwlwifi/pcie/tx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 83eabf1e9810f3753d6dafd9a0dc3849924d4fc0 Author: Sara Sharon Date: Mon Aug 27 13:56:41 2018 +0300 iwlwifi: mvm: take station lock later in the code There is no need to lock mvm station for transport reclaim. Move the locking down, after the reclaim. Signed-off-by: Sara Sharon Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit bf9dfedaad9e65f2f580d3a573401d521d48b932 Author: Shaul Triebitz Date: Mon Jul 23 11:40:30 2018 +0300 iwlwifi: mvm: handle RX no data notification Handle RX no data notification, which is used for advertising NDP to radiotap. Signed-off-by: Golan Ben Ami Signed-off-by: Shaul Triebitz Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo .../net/wireless/intel/iwlwifi/fw/api/datapath.h | 5 + drivers/net/wireless/intel/iwlwifi/fw/api/rx.h | 49 ++++++++ drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 2 + drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 2 + drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 126 ++++++++++++++++++++- 5 files changed, 183 insertions(+), 1 deletion(-) commit 57a3a454f30368f9b52ef406feff09571448e84e Author: Shaul Triebitz Date: Mon Aug 20 16:07:26 2018 +0300 iwlwifi: split HE capabilities between AP and STA HE capabilities differ between AP and STA. Signed-off-by: Shaul Triebitz Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | 289 ++++++++++++++------- 1 file changed, 188 insertions(+), 101 deletions(-) commit aca432f06b8a60a92b27fb46e6518a19b28ca93f Author: Luca Coelho Date: Mon Aug 27 13:02:19 2018 +0300 iwlwifi: make MVM and DVM depend on MAC80211 It's not the iwlwifi module that depends on mac80211, but iwlmvm and iwldvm. To reflect this better, make MVM and DVM Kconfig options depend on MAC80211 instead. Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo drivers/net/wireless/intel/iwlwifi/Kconfig | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 189b8d441b0f7825f0b4278851c52afaa0515ed2 Author: Naftali Goldstein Date: Wed Aug 22 12:18:19 2018 +0300 iwlwifi: mvm: fix setting HE ppe FW config The FW expects to get the ppe value for each NSS-BW pair in the same format as in the he phy capabilities IE, which means that a value of 0 implies ppe should be used for BPSK (mcs 0). If there are no PPE thresholds in the IE, or if for some NSS-RU pair there's no threshold set for it (this could happen because it's a variable-sized field), it means no PPE should not be used for that pair, so the value sent to FW should be 7 which corresponds to "none". Fixes: 514c30696fbc ("iwlwifi: add support for IEEE802.11ax") Signed-off-by: Naftali Goldstein Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo drivers/net/wireless/intel/iwlwifi/fw/api/mac.h | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 8 +++++++- 2 files changed, 8 insertions(+), 2 deletions(-) commit 4120e4a119ed8c8e28d20524713ab2e3df67a34d Author: Sara Sharon Date: Thu Aug 23 13:40:16 2018 +0300 iwlwifi: mvm: cleanup iwl_mvm_tx_skb_non_sta Make the coupling of station id and queue id clear. Group code together. Remove outdated comment. Never use an undefined hw queue as given from mac80211. Signed-off-by: Sara Sharon Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 42 ++++++++++++----------------- 1 file changed, 17 insertions(+), 25 deletions(-) commit a124caf8f3166cf1488bf606ccf70469ac76a9de Author: Sara Sharon Date: Thu Aug 23 11:03:17 2018 +0300 iwlwifi: mvm: remove pointless NULL assignment Assigning mvmsta to be NULL when we are about to exit the function is pointless. Remove it. Move the variable declaration to the scope it is used. Signed-off-by: Sara Sharon Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) commit 70dc179dd98622eda9809d02fa73b708d60e5e23 Author: Sara Sharon Date: Thu Aug 23 12:10:01 2018 +0300 iwlwifi: mvm: remove dead code In iwl_mvm_tx_skb_non_sta(), in case of managed interface, the AP station was supposed to be used for multicast frames instead of the auxiliary station to avoid frames possibly sent to an absent P2P GO. However, when moving to DQA mode, this was broken as no valid queue was assigned. This is fixed by a recent patch that directs all non-offchannel traffic to ap station earlier in the TX path. However, the broken, and now dead code, remained. Remove it. Signed-off-by: Sara Sharon Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 6 ------ 1 file changed, 6 deletions(-) commit dabb0983349d6320197b88eeb9bb91d3fa0ed855 Author: Sara Sharon Date: Mon Aug 20 10:34:04 2018 +0300 iwlwifi: pcie: use iwl_tx_cmd_gen2 and not iwl_tx_cmd When building AMSDU for gen2, code uses iwl_tx_cmd. The only updated field is len, which is in the same location, so it is not a bug. However, it is a bit confusing and error prone, so change it. Signed-off-by: Sara Sharon Signed-off-by: Luca Coelho Signed-off-by: Kalle Valo drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 90a8c74a8d7b0f3fdceadadb155da137e3b157cf Author: YueHaibing Date: Wed Dec 19 11:00:13 2018 +0800 ipw2x00: cleanup dead code Fix smatch warning: drivers/net/wireless/intel/ipw2x00/ipw2100.c:5606 shim__set_security() warn: always true condition '(sec->active_key <= 3) => (0-3 <= 3)' drivers/net/wireless/intel/ipw2x00/ipw2200.c:10725 shim__set_security() warn: always true condition '(sec->active_key <= 3) => (0-3 <= 3)' Signed-off-by: YueHaibing Signed-off-by: Kalle Valo drivers/net/wireless/intel/ipw2x00/ipw2100.c | 8 ++------ drivers/net/wireless/intel/ipw2x00/ipw2200.c | 7 ++----- 2 files changed, 4 insertions(+), 11 deletions(-) commit 4f68ef64cd7feb1220232bd8f501d8aad340a099 Author: Jia-Ju Bai Date: Fri Dec 14 11:55:21 2018 +0800 cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan() The function cw1200_bss_info_changed() and cw1200_hw_scan() can be concurrently executed. The two functions both access a possible shared variable "frame.skb". This shared variable is freed by dev_kfree_skb() in cw1200_upload_beacon(), which is called by cw1200_bss_info_changed(). The free operation is protected by a mutex lock "priv->conf_mutex" in cw1200_bss_info_changed(). In cw1200_hw_scan(), this shared variable is accessed without the protection of the mutex lock "priv->conf_mutex". Thus, concurrency use-after-free bugs may occur. To fix these bugs, the original calls to mutex_lock(&priv->conf_mutex) and mutex_unlock(&priv->conf_mutex) are moved to the places, which can protect the accesses to the shared variable. Signed-off-by: Jia-Ju Bai Signed-off-by: Kalle Valo drivers/net/wireless/st/cw1200/scan.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) commit 861cb5eb467f5e38dce1aabe4e8db379255bd89b Author: Stefan Wahren Date: Wed Dec 12 20:20:06 2018 +0100 brcmfmac: Fix access point mode Since commit 1204aa17f3b4 ("brcmfmac: set WIPHY_FLAG_HAVE_AP_SME flag") the Raspberry Pi 3 A+ (BCM43455) isn't able to operate in AP mode with hostapd (device_ap_sme=1 use_monitor=0): brcmfmac: brcmf_cfg80211_stop_ap: setting AP mode failed -52 So add the missing mgmt_stypes for AP mode to fix this. Fixes: 1204aa17f3b4 ("brcmfmac: set WIPHY_FLAG_HAVE_AP_SME flag") Suggested-by: Arend van Spriel Signed-off-by: Stefan Wahren Acked-by: Arend van Spriel Signed-off-by: Kalle Valo drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 8c892df41500469729e0d662816300196e4f463d Author: Stijn Tintel Date: Tue Dec 4 20:29:05 2018 +0200 brcmfmac: fix roamoff=1 modparam When the update_connect_param callback is set, nl80211 expects the flag WIPHY_FLAG_SUPPORTS_FW_ROAM to be set as well. However, this flag is only set when modparam roamoff=0, while the callback is set unconditionally. Since commit 7f9a3e150ec7 this causes a warning in wiphy_register, which breaks brcmfmac. Disable the update_connect_param callback when roamoff=0 to fix this. Fixes: 7f9a3e150ec7 ("nl80211: Update ERP info using NL80211_CMD_UPDATE_CONNECT_PARAMS") Cc: Stable # 4.19+ Signed-off-by: Jonas Gorski Signed-off-by: Stijn Tintel Signed-off-by: Kalle Valo drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 11 +++++++++-- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h | 2 +- drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 2 +- 3 files changed, 11 insertions(+), 4 deletions(-) commit cc4dc97ffc69c253d5aa2c0068545ed6c8bc0bde Author: Yangtao Li Date: Mon Dec 3 08:31:45 2018 -0500 cw1200: convert to DEFINE_SHOW_ATTRIBUTE Use DEFINE_SHOW_ATTRIBUTE macro to simplify the code. Signed-off-by: Yangtao Li Signed-off-by: Kalle Valo drivers/net/wireless/st/cw1200/debug.c | 32 ++++---------------------------- 1 file changed, 4 insertions(+), 28 deletions(-) commit 71bef2fd583be4a5e414faf193fc243f8447c51b Author: Yishai Hadas Date: Wed Dec 19 16:28:10 2018 +0200 IB/mlx5: Introduce uid as part of alloc/dealloc transport domain Introduce uid as part of alloc/dealloc transport domain to match the device specification. Signed-off-by: Yishai Hadas Reviewed-by: Artemy Kovalyov Signed-off-by: Leon Romanovsky include/linux/mlx5/mlx5_ifc.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit d2a68c4effd821f0871d20368f76b609349c8a3b Author: Steven Rostedt (VMware) Date: Sat Dec 8 12:58:51 2018 -0500 x86/ftrace: Do not call function graph from dynamic trampolines Since commit 79922b8009c07 ("ftrace: Optimize function graph to be called directly"), dynamic trampolines should not be calling the function graph tracer at the end. If they do, it could cause the function graph tracer to trace functions that it filtered out. Right now it does not cause a problem because there's a test to check if the function graph tracer is attached to the same function as the function tracer, which for now is true. But the function graph tracer is undergoing changes that can make this no longer true which will cause the function graph tracer to trace other functions. For example: # cd /sys/kernel/tracing/ # echo do_IRQ > set_ftrace_filter # mkdir instances/foo # echo ip_rcv > instances/foo/set_ftrace_filter # echo function_graph > current_tracer # echo function > instances/foo/current_tracer Would cause the function graph tracer to trace both do_IRQ and ip_rcv, if the current tests change. As the current tests prevent this from being a problem, this code does not need to be backported. But it does make the code cleaner. Cc: Thomas Gleixner Cc: Borislav Petkov Cc: "H. Peter Anvin" Cc: x86@kernel.org Signed-off-by: Steven Rostedt (VMware) arch/x86/kernel/ftrace.c | 41 ++++++++++++++++++++++------------------- arch/x86/kernel/ftrace_64.S | 8 ++++---- 2 files changed, 26 insertions(+), 23 deletions(-) commit 1923f851eb0baa79d11cd0574c6100c2de840d75 Author: Don Brace Date: Tue Dec 18 17:39:13 2018 -0600 scsi: smartpqi: update driver version - need to bump up the driver version because of the OFA patch and the fw status register read timeout patch. Reviewed-by: Gerry Morong Signed-off-by: Don Brace Signed-off-by: Martin K. Petersen drivers/scsi/smartpqi/smartpqi_init.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 4fd22c13ad4409ee44a121b54855bb48d2afd58a Author: Mahesh Rajashekhara Date: Tue Dec 18 17:39:07 2018 -0600 scsi: smartpqi: add ofa support - when OFA event occurs, driver will stop traffic to RAID/HBA path. Driver waits for all the outstanding requests to complete. - Driver sends OFA event acknowledgment to firmware. - Driver will wait until the new firmware is up and running. - Driver will free up the resources. - Driver calls SIS/PQI initialization and rescans the device list. - Driver will resume the traffic to RAID/HBA path. Reviewed-by: Murthy Bhat Signed-off-by: Mahesh Rajashekhara Signed-off-by: Don Brace Signed-off-by: Martin K. Petersen drivers/scsi/smartpqi/smartpqi.h | 76 ++++- drivers/scsi/smartpqi/smartpqi_init.c | 587 +++++++++++++++++++++++++++++++--- drivers/scsi/smartpqi/smartpqi_sis.c | 13 +- drivers/scsi/smartpqi/smartpqi_sis.h | 1 + 4 files changed, 634 insertions(+), 43 deletions(-) commit 65111785acccb836ec75263b03b0e33f21e74f47 Author: Mahesh Rajashekhara Date: Tue Dec 18 17:39:01 2018 -0600 scsi: smartpqi: increase fw status register read timeout Problem: - during the driver initialization, driver will poll fw for KERNEL_UP in a 30 seconds timeout. - if the firmware is not ready after 30 seconds, driver will not be loaded. Fix: - change timeout from 30 seconds to 3 minutes. Reported-by: Feng Li Reviewed-by: Ajish Koshy Reviewed-by: Murthy Bhat Reviewed-by: Dave Carroll Reviewed-by: Kevin Barnett Signed-off-by: Mahesh Rajashekhara Signed-off-by: Don Brace Signed-off-by: Martin K. Petersen drivers/scsi/smartpqi/smartpqi_sis.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f7cb8ac6e776158fab003d8dc6b7f564f005f502 Author: Don Brace Date: Fri Dec 7 16:30:12 2018 -0600 scsi: smartpqi: bump driver version Reviewed-by: Gerry Morong Reviewed-by: Dave Carroll Signed-off-by: Don Brace Signed-off-by: Martin K. Petersen drivers/scsi/smartpqi/smartpqi_init.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 3d46a59a191e81f7ada771b8db71553916b851da Author: Don Brace Date: Fri Dec 7 16:30:05 2018 -0600 scsi: smartpqi: add smp_utils support Reviewed-by: Scott Benesh Reviewed-by: Mahesh Rajashekhara Reviewed-by: Scott Teel Reviewed-by: Dave Carroll Reviewed-by: Kevin Barnett Signed-off-by: Don Brace Signed-off-by: Martin K. Petersen drivers/scsi/smartpqi/smartpqi.h | 89 ++++++++++++++ drivers/scsi/smartpqi/smartpqi_init.c | 131 ++++++++++++-------- drivers/scsi/smartpqi/smartpqi_sas_transport.c | 164 +++++++++++++++++++++++-- 3 files changed, 324 insertions(+), 60 deletions(-) commit 2ba55c9851d74eb015a554ef69ddf2ef061d5780 Author: Kevin Barnett Date: Fri Dec 7 16:29:51 2018 -0600 scsi: smartpqi: correct lun reset issues Problem: The Linux kernel takes a logical volume offline after a LUN reset. This is generally accompanied by this message in the dmesg output: Device offlined - not ready after error recovery Root Cause: The root cause is a "quirk" in the timeout handling in the Linux SCSI layer. The Linux kernel places a 30-second timeout on most media access commands (reads and writes) that it send to device drivers. When a media access command times out, the Linux kernel goes into error recovery mode for the LUN that was the target of the command that timed out. Every command that timed out is kept on a list inside of the Linux kernel to be retried later. The kernel attempts to recover the command(s) that timed out by issuing a LUN reset followed by a TEST UNIT READY. If the LUN reset and TEST UNIT READY commands are successful, the kernel retries the command(s) that timed out. Each SCSI command issued by the kernel has a result field associated with it. This field indicates the final result of the command (success or error). When a command times out, the kernel places a value in this result field indicating that the command timed out. The "quirk" is that after the LUN reset and TEST UNIT READY commands are completed, the kernel checks each command on the timed-out command list before retrying it. If the result field is still "timed out", the kernel treats that command as not having been successfully recovered for a retry. If the number of commands that are in this state are greater than two, the kernel takes the LUN offline. Fix: When our RAIDStack receives a LUN reset, it simply waits until all outstanding commands complete. Generally, all of these outstanding commands complete successfully. Therefore, the fix in the smartpqi driver is to always set the command result field to indicate success when a request completes successfully. This normally isn’t necessary because the result field is always initialized to success when the command is submitted to the driver. So when the command completes successfully, the result field is left untouched. But in this case, the kernel changes the result field behind the driver’s back and then expects the field to be changed by the driver as the commands that timed-out complete. Reviewed-by: Dave Carroll Reviewed-by: Scott Teel Signed-off-by: Kevin Barnett Signed-off-by: Don Brace Signed-off-by: Martin K. Petersen drivers/scsi/smartpqi/smartpqi_init.c | 3 +++ 1 file changed, 3 insertions(+) commit 7ff44499bafbd376115f0bb6b578d980f56ee13b Author: Dave Carroll Date: Fri Dec 7 16:29:45 2018 -0600 scsi: smartpqi: correct volume status - fix race condition when a unit is deleted after an RLL, and before we have gotten the LV_STATUS page of the unit. - In this case we will get a standard inquiry, rather than the desired page. This will result in a unit presented which no longer exists. - If we ask for LV_STATUS, insure we get LV_STATUS Reviewed-by: Murthy Bhat Reviewed-by: Mahesh Rajashekhara Reviewed-by: Scott Teel Reviewed-by: Kevin Barnett Signed-off-by: Dave Carroll Signed-off-by: Don Brace Signed-off-by: Martin K. Petersen drivers/scsi/smartpqi/smartpqi_init.c | 3 +++ 1 file changed, 3 insertions(+) commit a9a681017c3b43b9d9754dd87bebe5e0e244fe08 Author: Dave Carroll Date: Fri Dec 7 16:29:37 2018 -0600 scsi: smartpqi: do not offline disks for transient did no connect conditions Reviewed-by: Murthy Bhat Reviewed-by: Mahesh Rajashekhara Reviewed-by: Scott Teel Reviewed-by: Kevin Barnett Signed-off-by: Dave Carroll Signed-off-by: Don Brace Signed-off-by: Martin K. Petersen drivers/scsi/smartpqi/smartpqi_init.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit a91aaae0243b419e52e97990471208321222be33 Author: Ajish Koshy Date: Fri Dec 7 16:29:31 2018 -0600 scsi: smartpqi: allow for larger raid maps Reviewed-by: Murthy Bhat Reviewed-by: Mahesh Rajashekhara Reviewed-by: Dave Carroll Reviewed-by: Scott Teel Reviewed-by: Kevin Barnett Signed-off-by: Ajish Koshy Signed-off-by: Don Brace Signed-off-by: Martin K. Petersen drivers/scsi/smartpqi/smartpqi_init.c | 59 +++++++++++++++++------------------ 1 file changed, 28 insertions(+), 31 deletions(-) commit 1e46731efd9c9322cb4699f845c739d2ea68555c Author: Mahesh Rajashekhara Date: Fri Dec 7 16:29:24 2018 -0600 scsi: smartpqi: check for null device pointers - wait on all outstanding I/O to complete before the device is removed. - check for null device pointers in IO entry/completion functions. Reviewed-by: Scott Teel Reviewed-by: Murthy Bhat Reviewed-by: Dave Carroll Reviewed-by: Kevin Barnett Signed-off-by: Mahesh Rajashekhara Signed-off-by: Don Brace Signed-off-by: Martin K. Petersen drivers/scsi/smartpqi/smartpqi.h | 2 ++ drivers/scsi/smartpqi/smartpqi_init.c | 65 +++++++++++++++++++++++++++++++++-- 2 files changed, 64 insertions(+), 3 deletions(-) commit c1b104755b0b11579e292aa153c0605264c81648 Author: Ajish Koshy Date: Fri Dec 7 16:29:18 2018 -0600 scsi: smartpqi: add support for huawei controllers Reviewed-by: Murthy Bhat Reviewed-by: Mahesh Rajashekhara Reviewed-by: Dave Carroll Reviewed-by: Scott Teel Reviewed-by: Kevin Barnett Signed-off-by: Ajish Koshy Signed-off-by: Don Brace Signed-off-by: Martin K. Petersen drivers/scsi/smartpqi/smartpqi_init.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) commit 62dc51fb946697c896e47df7187862c310a3d21c Author: Sagar Biradar Date: Fri Dec 7 16:29:12 2018 -0600 scsi: smartpqi: enhance numa node detection - set pci_dev->dev to 0 only if the node is NO_NUMA_NODE. If not, do not reset the value but retain it. Reviewed-by: Murthy Bhat Reviewed-by: Mahesh Rajashekhara Reviewed-by: Dave Carroll Reviewed-by: Scott Teel Reviewed-by: Kevin Barnett Signed-off-by: Sagar Biradar Signed-off-by: Don Brace Signed-off-by: Martin K. Petersen drivers/scsi/smartpqi/smartpqi_init.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) commit 2b447f811c1f7f30e4caa5a817d0c95d06aff874 Author: Dave Carroll Date: Fri Dec 7 16:29:05 2018 -0600 scsi: smartpqi: wake up drives after os resumes from suspend - set allow_restart option during scsi_device init. This allows the kernel to send a START/STOP Unit command to the drive if it encounters a 4/2 check condition in sense data. Reviewed-by: Murthy Bhat Reviewed-by: Mahesh Rajashekhara Reviewed-by: Kevin Barnett Signed-off-by: Dave Carroll Signed-off-by: Don Brace Signed-off-by: Martin K. Petersen drivers/scsi/smartpqi/smartpqi_init.c | 2 ++ 1 file changed, 2 insertions(+) commit 5995b236c10a0af748ae7f4e4819307cf6bc3140 Author: Murthy Bhat Date: Fri Dec 7 16:28:59 2018 -0600 scsi: smartpqi: fix disk name mount point - fix a formatting issue. Reviewed-by: Mahesh Rajashekhara Reviewed-by: Scott Teel Reviewed-by: Dave Carroll Reviewed-by: Kevin Barnett Signed-off-by: Murthy Bhat Signed-off-by: Don Brace Signed-off-by: Martin K. Petersen drivers/scsi/smartpqi/smartpqi_init.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 84a77fefe0451bd9e6894362423d8fa6d14419ab Author: Murthy Bhat Date: Fri Dec 7 16:28:53 2018 -0600 scsi: smartpqi: add h3c ssid Reviewed-by: Scott Benesh Reviewed-by: Mahesh Rajashekhara Reviewed-by: Dave Carroll Reviewed-by: Scott Teel Reviewed-by: Kevin Barnett Signed-off-by: Murthy Bhat Signed-off-by: Don Brace Signed-off-by: Martin K. Petersen drivers/scsi/smartpqi/smartpqi_init.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit cd128244162c8afbf50e93b88daa02b05faa4c0a Author: Dave Carroll Date: Fri Dec 7 16:28:47 2018 -0600 scsi: smartpqi: add sysfs attributes - add sysfs device attributes, unique_id, lunid and path_info. Reviewed-by: Scott Teel Reviewed-by: Kevin Barnett Signed-off-by: Dave Carroll Signed-off-by: Don Brace Signed-off-by: Martin K. Petersen drivers/scsi/smartpqi/smartpqi.h | 3 + drivers/scsi/smartpqi/smartpqi_init.c | 232 ++++++++++++++++++++++++++++++++++ 2 files changed, 235 insertions(+) commit 02133b68d51d09bd91b0d2c1fa5318e2f23e4559 Author: Dave Carroll Date: Fri Dec 7 16:28:41 2018 -0600 scsi: smartpqi: refactor sending controller raid requests Clean up the common code which creates a raid path request for the controller LUNID and sends it synchronously, into a common routine; Reviewed-by: Murthy Bhat Reviewed-by: Mahesh Rajashekhara Reviewed-by: Scott Teel Reviewed-by: Kevin Barnett Signed-off-by: Dave Carroll Signed-off-by: Don Brace Signed-off-by: Martin K. Petersen drivers/scsi/smartpqi/smartpqi_init.c | 134 ++++++++++++---------------------- 1 file changed, 46 insertions(+), 88 deletions(-) commit 171c28653a2d9201e130863eb2408f404e4d6ed7 Author: Dave Carroll Date: Fri Dec 7 16:28:35 2018 -0600 scsi: smartpqi: turn off lun data caching for ptraid - allow update the luns for PTRAID devices. Reviewed-by: Ajish Koshy Reviewed-by: Murthy Bhat Reviewed-by: Mahesh Rajashekhara Reviewed-by: Justin Lindley Reviewed-by: Scott Teel Reviewed-by: Kevin Barnett Signed-off-by: Dave Carroll Signed-off-by: Don Brace Signed-off-by: Martin K. Petersen drivers/scsi/smartpqi/smartpqi.h | 6 +++ drivers/scsi/smartpqi/smartpqi_init.c | 79 ++++++++++++++++++++++++++++++++--- 2 files changed, 79 insertions(+), 6 deletions(-) commit b2346b5030cf9458f30a84028d9fe904b8c942a7 Author: Mahesh Rajashekhara Date: Fri Dec 7 16:28:29 2018 -0600 scsi: smartpqi: correct host serial num for ssa Reviewed-by: Scott Benesh Reviewed-by: Ajish Koshy Reviewed-by: Murthy Bhat Reviewed-by: Mahesh Rajashekhara Reviewed-by: Dave Carroll Reviewed-by: Scott Teel Reviewed-by: Kevin Barnett Signed-off-by: Mahesh Rajashekhara Signed-off-by: Don Brace Signed-off-by: Martin K. Petersen drivers/scsi/smartpqi/smartpqi_init.c | 3 +++ 1 file changed, 3 insertions(+) commit b6e2ef67ed8365d60a0cebc1313b57df8b9e909e Author: Dave Carroll Date: Fri Dec 7 16:28:23 2018 -0600 scsi: smartpqi: add no_write_same for logical volumes During slave_alloc, for logical volumes include no_write_same into the scsi_device structure. This will insure that WRITE_SAME will not be used for LD's. Reviewed-by: Ajish Koshy Reviewed-by: Murthy Bhat Reviewed-by: Mahesh Rajashekhara Reviewed-by: Justin Lindley Reviewed-by: Scott Benesh Reviewed-by: Scott Teel Reviewed-by: Kevin Barnett Signed-off-by: Dave Carroll Signed-off-by: Don Brace Signed-off-by: Martin K. Petersen drivers/scsi/smartpqi/smartpqi_init.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 3406384b76a77ea3b3bab7923c1a3bd4649318f5 Author: Mahesh Rajashekhara Date: Fri Dec 7 16:28:16 2018 -0600 scsi: smartpqi: Add retries for device reset Reviewed-by: Ajish Koshy Reviewed-by: Murthy Bhat Reviewed-by: Justin Lindley Reviewed-by: Scott Benesh Reviewed-by: Dave Carroll Reviewed-by: Scott Teel Reviewed-by: Kevin Barnett Signed-off-by: Mahesh Rajashekhara Signed-off-by: Don Brace Signed-off-by: Martin K. Petersen drivers/scsi/smartpqi/smartpqi.h | 1 + drivers/scsi/smartpqi/smartpqi_init.c | 14 +++++++++++++- 2 files changed, 14 insertions(+), 1 deletion(-) commit b212c2510d7ca15af8758eade5e4002ed5267d1b Author: Kevin Barnett Date: Fri Dec 7 16:28:10 2018 -0600 scsi: smartpqi: add support for PQI Config Table handshake Add support for new IUs and parsing of the Firmware Features section of the PQI Config Table to implement the "handshake" between the driver and firmware to communicate firmware features supported and enabled by the driver. Reviewed-by: Ajish Koshy Reviewed-by: Mahesh Rajashekhara Reviewed-by: Murthy Bhat Reviewed-by: Justin Lindley Reviewed-by: Scott Teel Signed-off-by: Kevin Barnett Signed-off-by: Don Brace Signed-off-by: Martin K. Petersen drivers/scsi/smartpqi/smartpqi.h | 43 ++++++ drivers/scsi/smartpqi/smartpqi_init.c | 254 +++++++++++++++++++++++++++++++++- 2 files changed, 293 insertions(+), 4 deletions(-) commit 9e1f03e4d318d3e49d4db1d711eb652db727b844 Author: James Smart Date: Thu Dec 13 15:17:58 2018 -0800 scsi: lpfc: Update lpfc version to 12.0.0.10 Update lpfc version to 12.0.0.10 Signed-off-by: Dick Kennedy Signed-off-by: James Smart Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc_version.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5021267af1327724a6f1859bb1594660a4c22bd3 Author: James Smart Date: Thu Dec 13 15:17:57 2018 -0800 scsi: lpfc: Adding ability to reset chip via pci bus reset This patch adds a "pci_bus_reset" option to the board_mode sysfs attribute. This option uses the pci_reset_bus() api to reset the PCIe link the adapter is on, which will reset the chip/adapter. Prior to issuing this option, all functions on the same chip must be placed in the offline state by the admin. After the reset, all of the instances may be brought online again. The primary purpose of this functionality is to support cases where firmware update required a chip reset but the admin did not want to reboot the machine in order to instantiate the firmware update. Sanity checks take place prior to the reset to ensure the adapter is the sole entity on the PCIe bus and that all functions are in the offline state. Signed-off-by: Dick Kennedy Signed-off-by: James Smart Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc_attr.c | 84 ++++++++++++++++++++++++++++- drivers/scsi/lpfc/lpfc_crtn.h | 1 + drivers/scsi/lpfc/lpfc_hw4.h | 12 +++++ drivers/scsi/lpfc/lpfc_scsi.c | 121 +++++++++++++++++++++++++++++++++++------- drivers/scsi/lpfc/lpfc_sli.c | 42 +++++++++++++-- 5 files changed, 233 insertions(+), 27 deletions(-) commit 72ca6b2220ed24c0f7b0dd4e3617e82dcda60ef1 Author: James Smart Date: Thu Dec 13 15:17:56 2018 -0800 scsi: lpfc: Add log messages to aid in debugging fc4type discovery issues Current messages report generic actions (like send GID_FT), but misses reporting for what protocol type the action is taken. Revise the messages to reflect the FC4 protocol type being worked on. [mkp: typo] Signed-off-by: Dick Kennedy Signed-off-by: James Smart Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc_ct.c | 48 ++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 45 insertions(+), 3 deletions(-) commit 00292e0306dc3b23e725acbc70fb0b2581b8b4b3 Author: James Smart Date: Thu Dec 13 15:17:55 2018 -0800 scsi: lpfc: Fix discovery failure when PLOGI is defered When a target's link dropped, an RSCN was received to communicate the change. The driver detected the loss of the target and issued and UNREG_RPI mailbox command. While that was being processed, another RSCN was received to communicate the port coming back. The driver deferred the PLOGI to the port until the mailbox command finishes. When the mailbox command completed it saw the pending port and called the routines to issue the PLOGI. However, it forgot to clear the UNREG_INP state flag, so the PLOGI xmt routine nooped the PLOGI request assuming it needed to wait for the mailbox command. At this point, login would never be re-attempted. Clear UNREG_INP before issuing the deferred PLOGI. Signed-off-by: Dick Kennedy Signed-off-by: James Smart Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc_hbadisc.c | 2 ++ drivers/scsi/lpfc/lpfc_sli.c | 8 ++++++-- 2 files changed, 8 insertions(+), 2 deletions(-) commit 529b3ddcfff580a2457eceeda9f248bc77c49246 Author: James Smart Date: Thu Dec 13 15:17:54 2018 -0800 scsi: lpfc: update fault value on successful trunk events. Currently, when a trunk link goes down due to some fault, the driver snapshots the fault code. If the link then comes back up, meaning there is no fault, the driver is not clearing the fault code so the sysfs link_state entry reports old/stale data. Revise the logic so that on successful link up the fault code is cleared. Signed-off-by: Dick Kennedy Signed-off-by: James Smart Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc_init.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) commit e817e5d7030c7fcc6e707dba7abe51ee5c47732f Author: James Smart Date: Thu Dec 13 15:17:53 2018 -0800 scsi: lpfc: Correct MDS loopback diagnostics support The existing MDS loopback diagnostics support processing received frames in the slowpath work thread. It caps the number of frames it will process at 64, before waiting for another event to indicate additional frame reception. The net-net is this results in very slow frame processing during loopback tests and sometimes orphans an io, causing the loopback test to report failure by the switch. Move MDS loopback frame processing out of the slow path worker thread and into the normal RQ processing routines. Signed-off-by: Dick Kennedy Signed-off-by: James Smart Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc_sli.c | 49 ++++++++++++++++++++++++++++++-------------- 1 file changed, 34 insertions(+), 15 deletions(-) commit 2977a09512c2867fba8b0e862cc96327dd93431d Author: James Smart Date: Thu Dec 13 15:17:52 2018 -0800 scsi: lpfc: Fix link state reporting for trunking when adapter is offline If the adapter is taken offline, the trunk link port attributes continue to report trunk links as up even though all links are down as the adapter is offline. Clear the trunk links state as part of taking the adapter offline. Signed-off-by: Dick Kennedy Signed-off-by: James Smart Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc_hbadisc.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) commit 009b7156149ab370ebd3b7477aac15a0fd3550e9 Author: Colin Ian King Date: Sat Dec 15 14:28:09 2018 +0000 scsi: bfa: clean up a couple of indentation issues There is a break statement with an extra space that needs removed and a call to bfa_trc that is indented one level too much. Fix these. Signed-off-by: Colin Ian King Signed-off-by: Martin K. Petersen drivers/scsi/bfa/bfa_ioc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit efad04623068c5def4551847ad5a6852daf273f7 Author: Colin Ian King Date: Sat Dec 15 14:17:08 2018 +0000 scsi: 3w-xxxx: fix indentation issue, add missing tab There is a tab missing on a return statement, add the missing tab. Signed-off-by: Colin Ian King Signed-off-by: Martin K. Petersen drivers/scsi/3w-xxxx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9934613edcb40b92a216122876cd3b7e76d08390 Author: Varun Prakash Date: Wed Dec 19 15:42:50 2018 +0530 scsi: csiostor: fix incorrect dma device in case of vport In case of ->vport_create() call scsi_add_host_with_dma() instead of scsi_add_host() to pass correct dma device. Signed-off-by: Varun Prakash Signed-off-by: Martin K. Petersen drivers/scsi/csiostor/csio_init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 34a3492171cc87d1c2a9e7c0fbf6bf4a0f4d57b0 Author: Christoph Hellwig Date: Wed Dec 19 08:34:55 2018 +0100 scsi: myrs: remove the dma_boundary_limit The old DAC960 driver was fine with merging over segment boundaries, so this new driver should be too. [mkp: typos] Signed-off-by: Christoph Hellwig Signed-off-by: Martin K. Petersen drivers/scsi/myrs.c | 1 - 1 file changed, 1 deletion(-) commit c3d6189ffd4ee5c205cd7f79c7a1533e10a92b9e Author: Christoph Hellwig Date: Wed Dec 19 08:34:54 2018 +0100 scsi: myrb: remove the dma_boundary limit The old DAC960 driver was fine with merging over segment boundaries, so this new driver should be too. [mkp: typos] Signed-off-by: Christoph Hellwig Signed-off-by: Martin K. Petersen drivers/scsi/myrb.c | 1 - 1 file changed, 1 deletion(-) commit 7b9e2d348c2af201e70346cdae052f387f713c49 Author: Shivasharan S Date: Tue Dec 18 05:59:55 2018 -0800 scsi: megaraid_sas: driver version update Signed-off-by: Shivasharan S Signed-off-by: Martin K. Petersen drivers/scsi/megaraid/megaraid_sas.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 894169db12463cea08d0e2a9e35f42b291340e5a Author: Shivasharan S Date: Tue Dec 18 05:59:54 2018 -0800 scsi: megaraid_sas: Use 63-bit DMA addressing Although MegaRAID controllers support 64-bit DMA addressing, as per hardware design, DMA address with all 64-bits set (0xFFFFFFFF-FFFFFFFF) results in a firmware fault. Driver will set 63-bit DMA mask to ensure the above address will not be used. Cc: stable@vger.kernel.org Signed-off-by: Shivasharan S Signed-off-by: Martin K. Petersen drivers/scsi/megaraid/megaraid_sas_base.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) commit 272652fcbf1adf6321efe288583fa4a30a15af31 Author: Shivasharan S Date: Mon Dec 17 00:47:40 2018 -0800 scsi: megaraid_sas: add retry logic in megasas_readl Due to hardware errata in Aero controllers, reads to certain fusion registers could intermittently return zero. This behavior is transient in nature and subsequent reads will return valid value. For Aero controllers, any calls to readl to read from certain registers will be retried for maximum three times, if read returns zero. Signed-off-by: Shivasharan S Signed-off-by: Martin K. Petersen drivers/scsi/megaraid/megaraid_sas_base.c | 39 +++++++++++++++++++++++------ drivers/scsi/megaraid/megaraid_sas_fusion.c | 28 +++++++++++++-------- 2 files changed, 49 insertions(+), 18 deletions(-) commit de516379e85f51c57ee54b113dbb442e5a862cd8 Author: Shivasharan S Date: Mon Dec 17 00:47:39 2018 -0800 scsi: megaraid_sas: changes to function prototypes Instead of the register address, pass the instance pointer to clear_intr and read_fw_status_reg functions. This is done in preparation for adding adapter type based checks in these functions in later patches of this series. Signed-off-by: Shivasharan S Signed-off-by: Martin K. Petersen drivers/scsi/megaraid/megaraid_sas.h | 4 +- drivers/scsi/megaraid/megaraid_sas_base.c | 67 +++++++++++++++-------------- drivers/scsi/megaraid/megaraid_sas_fusion.c | 48 ++++++++++----------- 3 files changed, 60 insertions(+), 59 deletions(-) commit 154a7cde9a895d87ecc9807b34651021d3e6e8a7 Author: Shivasharan S Date: Mon Dec 17 00:47:38 2018 -0800 scsi: megaraid_sas: Introduce new Aero adapter type Identify all Aero controller PCI IDs with new adapter type. Signed-off-by: Shivasharan S Signed-off-by: Martin K. Petersen drivers/scsi/megaraid/megaraid_sas.h | 1 + drivers/scsi/megaraid/megaraid_sas_base.c | 18 ++++++++++++------ 2 files changed, 13 insertions(+), 6 deletions(-) commit 630d42b70f5d5cdac94dc5d080fc6d389076bf6e Author: Shivasharan S Date: Mon Dec 17 00:47:37 2018 -0800 scsi: megaraid_sas: Fix Ventura series based checks In preparation for the new Aero series adapter type, all the places where we check adapter type for Ventura series needs to include any later adapter types. Signed-off-by: Shivasharan S Signed-off-by: Martin K. Petersen drivers/scsi/megaraid/megaraid_sas_base.c | 10 +++++----- drivers/scsi/megaraid/megaraid_sas_fp.c | 8 ++++---- drivers/scsi/megaraid/megaraid_sas_fusion.c | 22 +++++++++++----------- 3 files changed, 20 insertions(+), 20 deletions(-) commit 23c3828aa2f84edec7020c7397a22931e7a879e1 Author: Stephan Günther Date: Sun Dec 16 13:08:21 2018 +0100 scsi: mpt3sas: fix memory ordering on 64bit writes With commit 09c2f95ad404 ("scsi: mpt3sas: Swap I/O memory read value back to cpu endianness"), 64bit writes in _base_writeq() were rewritten to use __raw_writeq() instad of writeq(). This introduced a bug apparent on powerpc64 systems such as the Raptor Talos II that causes the HBA to drop from the PCIe bus under heavy load and being reinitialized after a couple of seconds. It can easily be triggered on affacted systems by using something like fio --name=random-write --iodepth=4 --rw=randwrite --bs=4k --direct=0 \ --size=128M --numjobs=64 --end_fsync=1 fio --name=random-write --iodepth=4 --rw=randwrite --bs=64k --direct=0 \ --size=128M --numjobs=64 --end_fsync=1 a couple of times. In my case I tested it on both a ZFS raidz2 and a btrfs raid6 using LSI 9300-8i and 9400-8i controllers. The fix consists in resembling the write ordering of writeq() by adding a mandatory write memory barrier before device access and a compiler barrier afterwards. The additional MMIO barrier is superfluous. Signed-off-by: Stephan Günther Reported-by: Matt Corallo Acked-by: Sreekanth Reddy Signed-off-by: Martin K. Petersen drivers/scsi/mpt3sas/mpt3sas_base.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 17b18eaa6f59044a5172db7d07149e31ede0f920 Author: Anatoliy Glagolev Date: Thu Dec 6 16:48:45 2018 -0700 scsi: qla2xxx: deadlock by configfs_depend_item The intent of invoking configfs_depend_item in commit 7474f52a82d51 ("tcm_qla2xxx: Perform configfs depend/undepend for base_tpg") was to prevent a physical Fibre Channel port removal when virtual (NPIV) ports announced through that physical port are active. The change does not work as expected: it makes enabled physical port dependent on target configfs subsystem (the port's parent), something the configfs guarantees anyway. Besides, scheduling work in a worker thread and waiting for the work's completion is not really a valid workaround for the requirement not to call configfs_depend_item from a configfs callback: the call occasionally deadlocks. Thus, removing configfs_depend_item calls does not break anything and fixes the deadlock problem. Signed-off-by: Anatoliy Glagolev Acked-by: Himanshu Madhani Signed-off-by: Martin K. Petersen drivers/scsi/qla2xxx/tcm_qla2xxx.c | 48 +++++++------------------------------- drivers/scsi/qla2xxx/tcm_qla2xxx.h | 3 --- 2 files changed, 8 insertions(+), 43 deletions(-) commit 754d5da63145852736f34cfc762164f5d8d6537b Author: David Ahern Date: Wed Dec 19 15:53:22 2018 -0800 neighbor: Initialize protocol when new pneigh_entry are created pneigh_lookup uses kmalloc versus kzalloc when new entries are allocated. Given that the newly added protocol field needs to be initialized. Fixes: df9b0e30d44c ("neighbor: Add protocol attribute") Signed-off-by: David Ahern Signed-off-by: David S. Miller net/core/neighbour.c | 1 + 1 file changed, 1 insertion(+) commit 9df95e8ec568f98d89fe2c72342714296ac6ce27 Author: Martin KaFai Lau Date: Wed Dec 19 13:30:54 2018 -0800 bpf: sparc64: Enable sparc64 jit to provide bpf_line_info This patch enables sparc64's bpf_int_jit_compile() to provide bpf_line_info by calling bpf_prog_fill_jited_linfo(). Signed-off-by: Martin KaFai Lau Acked-by: David S. Miller Signed-off-by: Daniel Borkmann arch/sparc/net/bpf_jit_comp_64.c | 1 + 1 file changed, 1 insertion(+) commit 3f2eadb10886340f4d67fe683c2e53b4df005461 Author: Peter Oskolkov Date: Wed Dec 19 10:20:09 2018 -0800 selftests: net: refactor reuseport_addr_any test This patch refactors reuseport_add_any selftest a bit: - makes it more modular (eliminates several copy/pasted blocks); - skips DCCP tests if DCCP is not supported V2: added "Signed-off-by" tag. Signed-off-by: Peter Oskolkov Signed-off-by: David S. Miller tools/testing/selftests/net/reuseport_addr_any.c | 121 +++++++---------------- 1 file changed, 38 insertions(+), 83 deletions(-) commit 9c7f37e5ca14f5b04894b1b699a9903885cdafa6 Author: Andrew Lunn Date: Wed Dec 19 18:28:54 2018 +0100 net: dsa: mv88e6xxx: Add missing watchdog ops for 6320 family The 6320 family of switches uses the same watchdog registers as the 6390. Signed-off-by: Andrew Lunn Reviewed-by: Vivien Didelot Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx/chip.c | 2 ++ 1 file changed, 2 insertions(+) commit dac9597606432574f3c64b68decaec3c56ca750f Merge: 24894bc6eabc 22a3a5403bbe Author: David S. Miller Date: Wed Dec 19 16:24:59 2018 -0800 Merge branch 'mt2712' Biao Huang says: ==================== add ethernet binding and modify ethernet driver for mt2712 changes in v3: resend this series base on the latest net-next tree. changes in v2 as comments from Sean: 1. fix typo. 2. use capital letters for RMII/MII/RGMII in driver and bindings. v1: This new series is the result of discussion in: http://lkml.org/lkml/2018/12/13/1007 http://lkml.org/lkml/2018/12/14/53 1. ethernet binding file move to this series. 2. remove fine tune property in device tree 3. remove fine tune flow in ethernet driver 4. set rgmii timing according to the value in device tree, and don't care whether phy insert internal delay or not. ==================== Signed-off-by: David S. Miller commit 22a3a5403bbefd520e19bb251ce49ce705b1e5e4 Author: Biao Huang Date: Wed Dec 19 15:22:41 2018 +0800 net-next: stmmac: dwmac-mediatek: remove fine-tune property 1. remove fine-tune property and related setting to simplify the timing adjustment flow. 2. set timing value according to the value from device tree, and will not care whether PHY insert internal delay. Signed-off-by: Biao Huang Signed-off-by: David S. Miller .../net/ethernet/stmicro/stmmac/dwmac-mediatek.c | 71 ++++++++-------------- 1 file changed, 24 insertions(+), 47 deletions(-) commit a32ed90be22aa565cf623da5a211b4a968dec6e0 Author: Biao Huang Date: Wed Dec 19 15:22:40 2018 +0800 net-next: dt-binding: dwmac-mediatek: remove fine-tune property remove fine-tune property in device tree, modify the corresponding description in dt-binding. Signed-off-by: Biao Huang Signed-off-by: David S. Miller .../devicetree/bindings/net/mediatek-dwmac.txt | 31 ++++++++-------------- 1 file changed, 11 insertions(+), 20 deletions(-) commit 6f1f78efbbdd2f65c25dafb4859001e0b1664be4 Merge: 9e88b9312acb e30f5640e324 Author: Alexei Starovoitov Date: Wed Dec 19 15:42:55 2018 -0800 Merge branch 'line_info-check-for-ld_imm64' Martin KaFai Lau says: ==================== This series ensures the line_info (passed by the userspace during bpf_prog_load) cannot have its line_info.insn_off pointing to a zero bpf insn code. F.e. a broken userspace tool might generate a line_info.insn_off that points to the second 8 bytes of a BPF_LD_IMM64. The first patch is the kernel change. The second patch is a new test case. ==================== Acked-by: Yonghong Song Signed-off-by: Alexei Starovoitov commit e30f5640e32455e02ba08983ebe0b46054f1f6f0 Author: Martin KaFai Lau Date: Wed Dec 19 13:01:02 2018 -0800 bpf: Add BPF_LD_IMM64 to the line_info test This patch adds a BPF_LD_IMM64 case to the line_info test to ensure the kernel rejects linfo_info.insn_off pointing to the 2nd 8 bytes of the BPF_LD_IMM64. Signed-off-by: Martin KaFai Lau Signed-off-by: Alexei Starovoitov tools/testing/selftests/bpf/test_btf.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) commit fdbaa0beb78b7c8847e261fe2c32816e9d1c54cc Author: Martin KaFai Lau Date: Wed Dec 19 13:01:01 2018 -0800 bpf: Ensure line_info.insn_off cannot point to insn with zero code This patch rejects a line_info if the bpf insn code referred by line_info.insn_off is 0. F.e. a broken userspace tool might generate a line_info.insn_off that points to the second 8 bytes of a BPF_LD_IMM64. Signed-off-by: Martin KaFai Lau Signed-off-by: Alexei Starovoitov kernel/bpf/verifier.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit bd1c24ccf9eb070510c5da2fe0b56899c9a52c96 Author: Devesh Sharma Date: Wed Dec 12 01:56:24 2018 -0800 RDMA/bnxt_re: Increase depth of control path command queue Increasing the depth of control path command queue to 8K entries to handle burst of commands. This feature needs support from FW and the driver/fw compatibility is checked from the interface version number. Signed-off-by: Devesh Sharma Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/bnxt_re/main.c | 1 + drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 34 +++++++++++------ drivers/infiniband/hw/bnxt_re/qplib_rcfw.h | 59 +++++++++++++++++++++++------- 3 files changed, 68 insertions(+), 26 deletions(-) commit 2b827ea1926b5ad7ac3e9ba8651ff99181d6c7f9 Author: Selvin Xavier Date: Wed Dec 12 01:56:23 2018 -0800 RDMA/bnxt_re: Query HWRM Interface version from FW Get HWRM interface major, minor, build and patch version from FW for checking the FW/Driver compatibility. Signed-off-by: Selvin Xavier Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/bnxt_re/main.c | 31 +++++++++++++++++++++++++++++++ drivers/infiniband/hw/bnxt_re/qplib_res.h | 1 + 2 files changed, 32 insertions(+) commit 8036e90f92aae2784b855a0007ae2d8154d28b3c Author: Parvi Kaustubhi Date: Tue Dec 11 14:15:42 2018 -0800 IB/usnic: Fix potential deadlock Acquiring the rtnl lock while holding usdev_lock could result in a deadlock. For example: usnic_ib_query_port() | mutex_lock(&us_ibdev->usdev_lock) | ib_get_eth_speed() | rtnl_lock() rtnl_lock() | usnic_ib_netdevice_event() | mutex_lock(&us_ibdev->usdev_lock) This commit moves the usdev_lock acquisition after the rtnl lock has been released. This is safe to do because usdev_lock is not protecting anything being accessed in ib_get_eth_speed(). Hence, the correct order of holding locks (rtnl -> usdev_lock) is not violated. Signed-off-by: Parvi Kaustubhi Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/usnic/usnic_ib_verbs.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) commit 50c582de1d39231af31c881a8444333bff6f11a8 Author: Gal Pressman Date: Wed Dec 12 11:09:08 2018 +0200 RDMA/bnxt_re: Make use of destroy AH sleepable flag When in a sleepable (non-atomic) context, wait for firmware completion instead of polling for it. Signed-off-by: Gal Pressman Acked-by: Selvin Xavier Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/bnxt_re/ib_verbs.c | 5 +++-- drivers/infiniband/hw/bnxt_re/qplib_sp.c | 5 +++-- drivers/infiniband/hw/bnxt_re/qplib_sp.h | 3 ++- 3 files changed, 8 insertions(+), 5 deletions(-) commit 90e3edd8cca453c6042bb99eff3515cb70cfb2ba Author: Gal Pressman Date: Wed Dec 12 11:09:07 2018 +0200 RDMA/bnxt_re: Make use of create AH sleepable flag When in a sleepable (non-atomic) context, wait for firmware completion instead of polling for it. Signed-off-by: Gal Pressman Acked-by: Selvin Xavier Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/bnxt_re/ib_verbs.c | 5 +++-- drivers/infiniband/hw/bnxt_re/qplib_sp.c | 5 +++-- drivers/infiniband/hw/bnxt_re/qplib_sp.h | 3 ++- 3 files changed, 8 insertions(+), 5 deletions(-) commit 2553ba217eea37dc6291635ecddb883fb5c36a8b Author: Gal Pressman Date: Wed Dec 12 11:09:06 2018 +0200 RDMA: Mark if destroy address handle is in a sleepable context Introduce a 'flags' field to destroy address handle callback and add a flag that marks whether the callback is executed in an atomic context or not. This will allow drivers to wait for completion instead of polling for it when it is allowed. Signed-off-by: Gal Pressman Signed-off-by: Jason Gunthorpe drivers/infiniband/core/agent.c | 4 ++-- drivers/infiniband/core/cm.c | 4 ++-- drivers/infiniband/core/mad_rmpp.c | 11 ++++++----- drivers/infiniband/core/sa_query.c | 2 +- drivers/infiniband/core/user_mad.c | 4 ++-- drivers/infiniband/core/uverbs_cmd.c | 2 +- drivers/infiniband/core/uverbs_std_types.c | 3 ++- drivers/infiniband/core/verbs.c | 6 ++++-- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 +- drivers/infiniband/hw/bnxt_re/ib_verbs.h | 2 +- drivers/infiniband/hw/hns/hns_roce_ah.c | 2 +- drivers/infiniband/hw/hns/hns_roce_device.h | 2 +- drivers/infiniband/hw/mlx4/ah.c | 2 +- drivers/infiniband/hw/mlx4/mad.c | 24 ++++++++++++------------ drivers/infiniband/hw/mlx4/mlx4_ib.h | 2 +- drivers/infiniband/hw/mlx5/ah.c | 2 +- drivers/infiniband/hw/mlx5/mlx5_ib.h | 2 +- drivers/infiniband/hw/mthca/mthca_mad.c | 5 +++-- drivers/infiniband/hw/mthca/mthca_provider.c | 2 +- drivers/infiniband/hw/ocrdma/ocrdma_ah.c | 2 +- drivers/infiniband/hw/ocrdma/ocrdma_ah.h | 2 +- drivers/infiniband/hw/qedr/verbs.c | 2 +- drivers/infiniband/hw/qedr/verbs.h | 2 +- drivers/infiniband/hw/qib/qib_mad.c | 3 ++- drivers/infiniband/hw/usnic/usnic_ib_verbs.c | 2 +- drivers/infiniband/hw/usnic/usnic_ib_verbs.h | 2 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 3 ++- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.h | 2 +- drivers/infiniband/sw/rdmavt/ah.c | 3 ++- drivers/infiniband/sw/rdmavt/ah.h | 2 +- drivers/infiniband/sw/rdmavt/mad.c | 3 ++- drivers/infiniband/sw/rxe/rxe_verbs.c | 2 +- drivers/infiniband/ulp/ipoib/ipoib_ib.c | 2 +- drivers/infiniband/ulp/opa_vnic/opa_vnic_vema.c | 6 +++--- drivers/infiniband/ulp/srpt/ib_srpt.c | 4 ++-- include/rdma/ib_verbs.h | 10 ++++++++-- 36 files changed, 75 insertions(+), 60 deletions(-) commit a691ffb46edd7cb12a17ff0965ab59dbc95f48de Author: wangyan Date: Thu Dec 13 09:10:14 2018 +0800 vhost: correct the related warning message Fixes: 'commit d588cf8f618d ("target: Fix se_tpg_tfo->tf_subsys regression + remove tf_subsystem")' 'commit cbbd26b8b1a6 ("[iov_iter] new primitives - copy_from_iter_full() and friends")' Signed-off-by: Yan Wang Reviewed-by: Jun Piao Signed-off-by: Michael S. Tsirkin drivers/vhost/scsi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 4b86713236e4bd6ea6c881a97711ae039fc4069b Author: Paolo Bonzini Date: Mon Dec 17 18:35:09 2018 +0100 vhost: split structs into a separate header file vhost structs are shared by vhost-kernel and vhost-user. Split them into a separate file to ease copying them into programs that implement either the server or the client side of vhost-user. Signed-off-by: Paolo Bonzini Signed-off-by: Michael S. Tsirkin include/uapi/linux/vhost.h | 113 +--------------------------------- include/uapi/linux/vhost_types.h | 128 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 130 insertions(+), 111 deletions(-) commit e8d26f29b7c48aa037a4796e2aa878c58a04609c Author: Dongli Zhang Date: Mon Dec 10 08:54:34 2018 +0800 virtio: remove deprecated VIRTIO_PCI_CONFIG() VIRTIO_PCI_CONFIG() is deprecated. Use VIRTIO_PCI_CONFIG_OFF() instead. Signed-off-by: Dongli Zhang Signed-off-by: Michael S. Tsirkin drivers/virtio/virtio_pci_legacy.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 6db3d8dc5d73b269987fae60745bb20eae97af61 Author: Stefan Hajnoczi Date: Mon Nov 5 17:33:22 2018 +0000 vhost/vsock: switch to a mutex for vhost_vsock_hash Now that there are no more data path users of vhost_vsock_lock, it can be turned into a mutex. It's only used by .release() and in the .ioctl() path. Depends-on: <20181105103547.22018-1-stefanha@redhat.com> Suggested-by: Jason Wang Signed-off-by: Stefan Hajnoczi Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang drivers/vhost/vsock.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) commit 1f23816b8eb8fdc39990abe166c10a18c16f6b21 Author: Changpeng Liu Date: Thu Nov 1 15:40:35 2018 -0700 virtio_blk: add discard and write zeroes support In commit 88c85538, "virtio-blk: add discard and write zeroes features to specification" (https://github.com/oasis-tcs/virtio-spec), the virtio block specification has been extended to add VIRTIO_BLK_T_DISCARD and VIRTIO_BLK_T_WRITE_ZEROES commands. This patch enables support for discard and write zeroes in the virtio-blk driver when the device advertises the corresponding features, VIRTIO_BLK_F_DISCARD and VIRTIO_BLK_F_WRITE_ZEROES. Signed-off-by: Changpeng Liu Signed-off-by: Daniel Verkamp Signed-off-by: Michael S. Tsirkin Reviewed-by: Stefan Hajnoczi drivers/block/virtio_blk.c | 83 ++++++++++++++++++++++++++++++++++++++++- include/uapi/linux/virtio_blk.h | 54 +++++++++++++++++++++++++++ 2 files changed, 135 insertions(+), 2 deletions(-) commit b090c4e3a07c33ffdf95fb7601551b38fc2a4bbb Author: Gal Pressman Date: Wed Dec 12 11:09:05 2018 +0200 RDMA: Mark if create address handle is in a sleepable context Introduce a 'flags' field to create address handle callback and add a flag that marks whether the callback is executed in an atomic context or not. This will allow drivers to wait for completion instead of polling for it when it is allowed. Signed-off-by: Gal Pressman Signed-off-by: Jason Gunthorpe drivers/infiniband/core/cm.c | 2 +- drivers/infiniband/core/sa_query.c | 3 ++- drivers/infiniband/core/verbs.c | 15 ++++++++++----- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 1 + drivers/infiniband/hw/bnxt_re/ib_verbs.h | 1 + drivers/infiniband/hw/hfi1/mad.c | 2 +- drivers/infiniband/hw/hns/hns_roce_ah.c | 1 + drivers/infiniband/hw/hns/hns_roce_device.h | 1 + drivers/infiniband/hw/mlx4/ah.c | 4 ++-- drivers/infiniband/hw/mlx4/mad.c | 4 ++-- drivers/infiniband/hw/mlx4/mlx4_ib.h | 2 +- drivers/infiniband/hw/mlx5/ah.c | 2 +- drivers/infiniband/hw/mlx5/mlx5_ib.h | 2 +- drivers/infiniband/hw/mthca/mthca_mad.c | 2 +- drivers/infiniband/hw/mthca/mthca_provider.c | 1 + drivers/infiniband/hw/ocrdma/ocrdma_ah.c | 2 +- drivers/infiniband/hw/ocrdma/ocrdma_ah.h | 2 +- drivers/infiniband/hw/qedr/verbs.c | 2 +- drivers/infiniband/hw/qedr/verbs.h | 2 +- drivers/infiniband/hw/qib/qib_verbs.c | 2 +- drivers/infiniband/hw/usnic/usnic_ib_verbs.c | 1 + drivers/infiniband/hw/usnic/usnic_ib_verbs.h | 1 + drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 3 ++- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.h | 2 +- drivers/infiniband/sw/rdmavt/ah.c | 2 ++ drivers/infiniband/sw/rdmavt/ah.h | 1 + drivers/infiniband/sw/rxe/rxe_verbs.c | 1 + drivers/infiniband/ulp/ipoib/ipoib_ib.c | 2 +- drivers/infiniband/ulp/opa_vnic/opa_vnic_vema.c | 2 +- include/rdma/ib_verbs.h | 11 +++++++++-- 30 files changed, 52 insertions(+), 27 deletions(-) commit 86d163dbfe2ac0b30fbb6e256301abbfa9e4549e Author: Darrick J. Wong Date: Tue Dec 18 14:32:31 2018 -0800 xfs: stringify scrub types in ftrace output Use __print_symbolic to print the scrub type in ftrace output. Signed-off-by: Darrick J. Wong Reviewed-by: Eric Sandeen fs/xfs/libxfs/xfs_types.h | 4 +- fs/xfs/scrub/trace.h | 103 ++++++++++++++++++++++++++++++++++------------ 2 files changed, 79 insertions(+), 28 deletions(-) commit c494213f30080423b70b24b6af7f6da554d9390f Author: Darrick J. Wong Date: Tue Dec 18 14:32:31 2018 -0800 xfs: stringify btree cursor types in ftrace output Use __print_symbolic to print the btree type in ftrace output. Signed-off-by: Darrick J. Wong Reviewed-by: Eric Sandeen fs/xfs/libxfs/xfs_types.h | 13 +++++++++++++ fs/xfs/scrub/trace.h | 38 ++++++++++++++++++++++++++------------ fs/xfs/xfs_trace.h | 12 ++++++++++-- 3 files changed, 49 insertions(+), 14 deletions(-) commit 0357d21a6c9be2870904598b4767c7d424524849 Author: Darrick J. Wong Date: Tue Dec 18 14:32:30 2018 -0800 xfs: move XFS_INODE_FORMAT_STR mappings to libxfs Move XFS_INODE_FORMAT_STR to libxfs so that we don't forget to keep it updated, and add necessary TRACE_DEFINE_ENUM. Signed-off-by: Darrick J. Wong Reviewed-by: Eric Sandeen fs/xfs/libxfs/xfs_format.h | 10 ++++++++++ fs/xfs/xfs_trace.h | 10 +++++----- 2 files changed, 15 insertions(+), 5 deletions(-) commit 05c753c4cf53f51a7e35fcfe684500113cf1fd13 Author: Darrick J. Wong Date: Tue Dec 18 14:32:30 2018 -0800 xfs: move XFS_AG_BTREE_CMP_FORMAT_STR mappings to libxfs Move XFS_AG_BTREE_CMP_FORMAT_STR to libxfs so that we don't forget to keep it updated, and TRACE_DEFINE_ENUM the values while we're at it. Signed-off-by: Darrick J. Wong Reviewed-by: Eric Sandeen fs/xfs/libxfs/xfs_types.h | 5 +++++ fs/xfs/xfs_trace.h | 4 ---- 2 files changed, 5 insertions(+), 4 deletions(-) commit 85f8dff00a3193fe5659aa4c91adde31723c0d3d Author: Darrick J. Wong Date: Tue Dec 18 14:32:29 2018 -0800 xfs: fix symbolic enum printing in ftrace output ftrace's __print_symbolic() has a (very poorly documented) requirement that any enum values used in the symbol to string translation table be wrapped in a TRACE_DEFINE_ENUM so that the enum value can be encoded in the ftrace ring buffer. Fix this unsatisfied requirement. Signed-off-by: Darrick J. Wong Reviewed-by: Eric Sandeen fs/xfs/libxfs/xfs_types.h | 4 ++++ fs/xfs/xfs_aops.h | 3 +++ fs/xfs/xfs_trace.h | 19 +++++++++++++++++++ 3 files changed, 26 insertions(+) commit 7af8150f9935634e3e0f47c14e049ff401c82fb4 Author: Darrick J. Wong Date: Tue Dec 18 14:32:29 2018 -0800 xfs: fix function pointer type in ftrace format Use %pS instead of %pF in ftrace strings so that we record the actual function address instead of the function descriptor. Signed-off-by: Darrick J. Wong Reviewed-by: Eric Sandeen fs/xfs/scrub/trace.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 24894bc6eabc43f55f5470767780ac07db18e797 Merge: 4ab0edecaf1d 8deecf3557cc Author: David S. Miller Date: Wed Dec 19 13:37:34 2018 -0800 Merge branch 'neigh-get-support' Roopa Prabhu says: ==================== neigh get support This series adds support for neigh get similar to route and recently added fdb get. v2: fix key len check. and some other fixes ==================== Signed-off-by: David S. Miller commit 8deecf3557cca7d80fb5157f0858b738f8eebbc7 Author: Roopa Prabhu Date: Wed Dec 19 12:51:39 2018 -0800 selftests: rtnetlink.sh: add testcase for neigh get Signed-off-by: Roopa Prabhu Reviewed-by: David Ahern Signed-off-by: David S. Miller tools/testing/selftests/net/rtnetlink.sh | 54 ++++++++++++++++++++++++++++++++ 1 file changed, 54 insertions(+) commit 82cbb5c631a07b3aa6df6eab644d55da9de5a645 Author: Roopa Prabhu Date: Wed Dec 19 12:51:38 2018 -0800 neighbour: register rtnl doit handler this patch registers neigh doit handler. The doit handler returns a neigh entry given dst and dev. This is similar to route and fdb doit (get) handlers. Also moves nda_policy declaration from rtnetlink.c to neighbour.c Signed-off-by: Roopa Prabhu Reviewed-by: David Ahern Signed-off-by: David S. Miller include/net/neighbour.h | 1 + net/core/neighbour.c | 204 +++++++++++++++++++++++++++++++++++++++++++++--- net/core/rtnetlink.c | 12 --- 3 files changed, 194 insertions(+), 23 deletions(-) commit e9f2e05a5f19ce2a21d79c765fd6bb7c03d4aaeb Merge: 8c5e14f438b8 7aedd9d48f2a Author: Paolo Bonzini Date: Wed Dec 19 22:17:09 2018 +0100 Merge tag 'kvm-s390-next-4.21-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD KVM: s390: Fixes for 4.21 Just two small fixes. commit 9e88b9312acb9b80554c48b58668fb144720333a Author: Ivan Babrou Date: Wed Dec 19 12:08:03 2018 -0800 tools: bpftool: do not force gcc as CC This allows transparent cross-compilation with CROSS_COMPILE by relying on 7ed1c1901fe5 ("tools: fix cross-compile var clobbering"). Signed-off-by: Ivan Babrou Signed-off-by: Daniel Borkmann tools/bpf/bpftool/Makefile | 2 -- 1 file changed, 2 deletions(-) commit e2ce3674883ecba2605370404208c9d4a07ae1c3 Author: Björn Töpel Date: Wed Dec 19 13:09:31 2018 +0100 xsk: simplify AF_XDP socket teardown Prior this commit, when the struct socket object was being released, the UMEM did not have its reference count decreased. Instead, this was done in the struct sock sk_destruct function. There is no reason to keep the UMEM reference around when the socket is being orphaned, so in this patch the xdp_put_mem is called in the xsk_release function. This results in that the xsk_destruct function can be removed! Note that, it still holds that a struct xsk_sock reference might still linger in the XSKMAP after the UMEM is released, e.g. if a user does not clear the XSKMAP prior to closing the process. This sock will be in a "released" zombie like state, until the XSKMAP is removed. Signed-off-by: Björn Töpel Signed-off-by: Daniel Borkmann net/xdp/xsk.c | 16 +--------------- 1 file changed, 1 insertion(+), 15 deletions(-) commit 4ab0edecaf1d9a4acb5bddc4a869b0f7efda634a Merge: 055722716c39 489c25f9a375 Author: David S. Miller Date: Wed Dec 19 12:28:08 2018 -0800 Merge branch 'mlxsw-Make-driver-more-robust' Ido Schimmel says: ==================== mlxsw: Make driver more robust In recent months we fixed several bugs in the driver that could have been avoided by re-evaluating some of the involved code paths and by introducing relevant and comprehensive test cases. This patchset tries to do that by introducing a set of small and mostly non-functional changes in addition to a new test. I have further improvements in mind, but they can be done in a different set. Patch #1 makes sure we correctly sanitize upper devices of a VLAN interface. Patch #2 removes an unexpected behavior from the driver, in which routes configured on a VLAN interface will cease being offloaded after certain operations. Patch #3 is a small cleanup. Patch #4 simplifies the driver by removing reference counting from VLAN entries configured on a port. Patches #5-#6 simplify linking/unlinking from a bridge, especially when LAG and VLAN devices are involved. They make both operations symmetric even when ports are unlinked from a bridged LAG device. Patch #7-#9 make router interface (RIF) deletion more robust by removing reliance on device chain to indicate whether a NETDEV_DOWN event in the inet{,6}addr notification chains should be processed. This is due to the fact that IP addresses can be flushed from a netdev after it was unlinked from its lower device. Patch #10 adds a new test to for valid and invalid configurations over mlxsw ports. Some of the test cases are derived from recent fixes. I expect that more test cases will be added over time. ==================== Signed-off-by: David S. Miller commit 489c25f9a375ba1e780dcf445ca74f6b3766d1b5 Author: Ido Schimmel Date: Wed Dec 19 06:08:51 2018 +0000 selftests: mlxsw: Add rtnetlink tests Add a new test that is focused on rtnetlink configuration. Its purpose is to test valid and invalid (as deemed by mlxsw) configurations and make sure that they succeed / fail without producing a trace. Some of the test cases are derived from recent fixes in order to make sure that the fixed bugs are not introduced again. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller .../selftests/drivers/net/mlxsw/rtnetlink.sh | 392 +++++++++++++++++++++ 1 file changed, 392 insertions(+) commit b61cd7c6f992cca57166d0cabe242c49b93609eb Author: Ido Schimmel Date: Wed Dec 19 06:08:50 2018 +0000 mlxsw: spectrum_router: Hold a reference on RIF's netdev Previous patches tried to make RIF deletion more robust and avoid use-after-free situations. As another precaution, hold a reference on a RIF's netdev and release it when the RIF is deleted. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 3 +++ 1 file changed, 3 insertions(+) commit 965fa8e600d28d98e7e0c7340517a9c139843ee3 Author: Ido Schimmel Date: Wed Dec 19 06:08:48 2018 +0000 mlxsw: spectrum_router: Make RIF deletion more robust In the past we had multiple instances where RIFs were not properly deleted. One of the reasons for leaking a RIF was that at the time when IP addresses were flushed from the respective netdev (prompting the destruction of the RIF), the netdev was no longer a mlxsw upper. This caused the inet{,6}addr notification blocks to ignore the NETDEV_DOWN event and leak the RIF. Instead of checking whether the netdev is our upper when an IP address is removed, we can instead check if the netdev has a RIF configured. To look up a RIF we need to access mlxsw private data, so the patch stores the notification blocks inside a mlxsw struct. This then allows us to use container_of() and extract the required private data. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 14 ------- drivers/net/ethernet/mellanox/mlxsw/spectrum.h | 4 -- .../net/ethernet/mellanox/mlxsw/spectrum_router.c | 49 ++++++++++++++-------- 3 files changed, 31 insertions(+), 36 deletions(-) commit 21ffedb6db5ac80b2081f425be358a976f5c14b7 Author: Ido Schimmel Date: Wed Dec 19 06:08:47 2018 +0000 mlxsw: spectrum_router: Propagate 'struct mlxsw_sp' further Next patch is going to make RIF deletion more robust by removing reliance on fragile mlxsw_sp_lower_get(). This is because a netdev is not necessarily our upper anymore when its IP addresses are flushed. The inet{,6}addr notification blocks are going to resolve 'struct mlxsw_sp' using container_of(), but the functions they call still use mlxsw_sp_lower_get(). As a preparation for the next patch, propagate 'struct mlxsw_sp' down to the functions called from the notification blocks and remove reliance on mlxsw_sp_lower_get(). Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller .../net/ethernet/mellanox/mlxsw/spectrum_router.c | 46 +++++++++++----------- 1 file changed, 24 insertions(+), 22 deletions(-) commit be2d6f421f680e01d58f7cd452646e0d8586d49b Author: Ido Schimmel Date: Wed Dec 19 06:08:45 2018 +0000 mlxsw: spectrum: Properly cleanup LAG uppers when removing port from LAG When a LAG device or a VLAN device on top of it is enslaved to a bridge, the driver propagates the CHANGEUPPER event to the LAG's slaves. This causes each physical port to increase the reference count of the internal representation of the bridge port by calling mlxsw_sp_port_bridge_join(). However, when a port is removed from a LAG, the corresponding leave() function is not called and the reference count is not decremented. This leads to ugly hacks such as mlxsw_sp_bridge_port_should_destroy() that try to understand if the bridge port should be destroyed even when its reference count is not 0. Instead, make sure that when a port is unlinked from a LAG it would see the same events as if the LAG (or its uppers) were unlinked from a bridge. The above is achieved by walking the LAG's uppers when a port is unlinked and calling mlxsw_sp_port_bridge_leave() for each upper that is enslaved to a bridge. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 23 ++++++++++++++++++ .../ethernet/mellanox/mlxsw/spectrum_switchdev.c | 27 +--------------------- 2 files changed, 24 insertions(+), 26 deletions(-) commit 635c8c8bba670db6b3b03890d4e24fc4b745aed7 Author: Ido Schimmel Date: Wed Dec 19 06:08:43 2018 +0000 mlxsw: spectrum: Remove reference count from VLAN entries Commit b3529af6bb0d ("spectrum: Reference count VLAN entries") started reference counting port-VLAN entries in a similar fashion to the 8021q driver. However, this is not actually needed and only complicates things. Instead, the driver should forbid the creation of a VLAN on a port if this VLAN already exists. This would also solve the issue fixed by the mentioned commit. Therefore, remove the get()/put() API and use create()/destroy() instead. One place that needs special attention is VLAN addition in a VLAN-aware bridge via switchdev operations. In case the VLAN flags (e.g., 'pvid') are toggled, then the VLAN entry already exists. To prevent the driver from wrongly returning EEXIST, the driver is changed to check in the prepare phase whether the entry already exists and only returns an error in case it is not associated with the correct bridge port. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 58 +++++++--------------- drivers/net/ethernet/mellanox/mlxsw/spectrum.h | 5 +- .../ethernet/mellanox/mlxsw/spectrum_switchdev.c | 41 +++++++++------ 3 files changed, 46 insertions(+), 58 deletions(-) commit e149113a74c35f0a28d1bfe17d2505a03563c1d5 Author: Ido Schimmel Date: Wed Dec 19 06:08:41 2018 +0000 mlxsw: spectrum: Handle VLAN device unlinking In commit 993107fea5ee ("mlxsw: spectrum_switchdev: Fix VLAN device deletion via ioctl") I fixed a bug caused by the fact that the driver views differently the deletion of a VLAN device when it is deleted via an ioctl and netlink. Instead of relying on a specific order of events (device being unregistered vs. VLAN filter being updated), simply make sure that the driver performs the necessary cleanup when the VLAN device is unlinked, which always happens before the other two events. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit f1d7c33d6ab585aba831a73a322070eb89724072 Author: Ido Schimmel Date: Wed Dec 19 06:08:40 2018 +0000 mlxsw: spectrum_fid: Remove unused function This function is no longer used. Remove it. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum.h | 1 - drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c | 5 ----- 2 files changed, 6 deletions(-) commit 32fd4b49a372bee72aab82ebf8e866fc3756896c Author: Ido Schimmel Date: Wed Dec 19 06:08:38 2018 +0000 mlxsw: spectrum_router: Do not destroy RIFs based on FID's reference count Currently, when a RIF is constructed on top of a FID, the RIF increments the FID's reference count and the RIF is destroyed when the FID's reference count drops to 1. This effectively means that when no local ports are member in the FID, the FID is destroyed regardless if the router port is a member in the FID or not. The above can lead to the unexpected behavior in which routes using a VLAN interface as their nexthop device are no longer offloaded after the last local port leaves the corresponding VLAN (FID). Example: # ip -4 route show dev br0.10 192.0.2.0/24 proto kernel scope link src 192.0.2.1 offload # bridge vlan del vid 10 dev swp3 # ip -4 route show dev br0.10 192.0.2.0/24 proto kernel scope link src 192.0.2.1 After the patch, the route is offloaded before and after the VLAN is removed from local port 'swp3', as the RIF corresponding to 'br0.10' continues to exists. In order to remove RIFs' reliance on the underlying FID's reference count, we need to add a reference count to sub-port RIFs, which are RIFs that correspond to physical ports and their uppers (e.g., LAG devices). In this case, each {Port, VID} ('struct mlxsw_sp_port_vlan') needs to hold a reference on the RIF. For example: bond0.10 | bond0 | +-------+ | | swp1 swp2 Both {Port 1, VID 10} and {Port 2, VID 10} will hold a reference on the RIF corresponding to 'bond0.10'. When the last reference is dropped, the RIF will be destroyed. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum.h | 2 +- drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c | 29 ++++----- .../net/ethernet/mellanox/mlxsw/spectrum_router.c | 70 +++++++++++++++------- 3 files changed, 65 insertions(+), 36 deletions(-) commit 927d0ef10a1071fba491b4858267fbb87ff19ed1 Author: Ido Schimmel Date: Wed Dec 19 06:08:37 2018 +0000 mlxsw: spectrum: Sanitize VLAN interface's uppers Currently, only VRF and macvlan uppers are supported on top of VLAN device configured over a bridge, so make sure the driver forbids other uppers. Note that enslavement to a VRF is handled earlier in the notification block, so there is no need to check for a VRF upper here. Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 45 ++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) commit 5dabcd0456d7ee17c2c7a17d7c2305444d2b9639 Author: Bart Van Assche Date: Mon Dec 17 13:20:46 2018 -0800 RDMA/srpt: Add support for immediate data Modify allocation of the non-SRQ receive queues such that immediate data is aligned on a 512 byte boundary. That alignment is necessary to pass the immediate data without copying to the block layer. When receiving an SRP_CMD with immediate data, postpone the ib_post_recv() call until target_execute_cmd() has finished. See also srpt_release_cmd(). Cc: Sergey Gorenko Cc: Max Gurtovoy Cc: Laurence Oberman Signed-off-by: Bart Van Assche Signed-off-by: Doug Ledford drivers/infiniband/ulp/srpt/ib_srpt.c | 205 ++++++++++++++++++++++++++-------- drivers/infiniband/ulp/srpt/ib_srpt.h | 33 +++++- 2 files changed, 189 insertions(+), 49 deletions(-) commit 82305f8235622a97f29ff6e82cc97cab6ac543ea Author: Bart Van Assche Date: Mon Dec 17 13:20:45 2018 -0800 RDMA/srpt: Rework the srpt_alloc_srq() error path This patch does not change any functionality but makes the next patch easier to read. Cc: Sergey Gorenko Cc: Max Gurtovoy Cc: Laurence Oberman Signed-off-by: Bart Van Assche Signed-off-by: Doug Ledford drivers/infiniband/ulp/srpt/ib_srpt.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit 6feb64ffda7c8efc0ea25bc81866515ba80cdc04 Author: Bart Van Assche Date: Mon Dec 17 13:20:44 2018 -0800 RDMA/srpt: Remove driver version and release date Neither a driver version number nor a release data is useful in an upstream driver. Remove the word "InfiniBand" from the driver description because recently RoCE support has been added to this driver. Cc: Sergey Gorenko Cc: Max Gurtovoy Cc: Laurence Oberman Signed-off-by: Bart Van Assche Signed-off-by: Doug Ledford drivers/infiniband/ulp/srpt/ib_srpt.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) commit c4bbe911c2ac86180657014fce8919ea0921a35b Author: Bart Van Assche Date: Mon Dec 17 13:20:43 2018 -0800 RDMA/srpt: Make kernel-doc headers complete Add documentation for those structure members for which it is missing. Cc: Sergey Gorenko Cc: Max Gurtovoy Cc: Laurence Oberman Signed-off-by: Bart Van Assche Signed-off-by: Doug Ledford drivers/infiniband/ulp/srpt/ib_srpt.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 75d79b801c5389928a05de6db117912a21190138 Author: Bart Van Assche Date: Mon Dec 17 13:20:42 2018 -0800 RDMA/srpt: Join split strings Make sure that long strings occur on a single line as required by the coding standard. Cc: Sergey Gorenko Cc: Max Gurtovoy Cc: Laurence Oberman Signed-off-by: Bart Van Assche Signed-off-by: Doug Ledford drivers/infiniband/ulp/srpt/ib_srpt.c | 29 ++++++++++++----------------- 1 file changed, 12 insertions(+), 17 deletions(-) commit ffd5980695d165f0b811b5f57accb23fce5c33af Author: Bart Van Assche Date: Mon Dec 17 13:20:41 2018 -0800 RDMA/srpt: Improve coding style conformance Use tabs instead of spaces for indentation. Make sure that multi-line expressions have the operator at the end of a line instead of the start. Avoid a complaint about a missing space in a ternary expression by changing '(boolean) ? 1: 0' into 'boolean'. Cc: Sergey Gorenko Cc: Max Gurtovoy Cc: Laurence Oberman Signed-off-by: Bart Van Assche Signed-off-by: Doug Ledford drivers/infiniband/ulp/srpt/ib_srpt.c | 10 +++++----- drivers/infiniband/ulp/srpt/ib_srpt.h | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) commit ed041919f0d23c109d52cde8da6ddc211c52d67e Author: Bart Van Assche Date: Mon Dec 17 13:20:40 2018 -0800 RDMA/srpt: Fix a use-after-free in the channel release code This patch avoids that KASAN sporadically reports the following: BUG: KASAN: use-after-free in rxe_run_task+0x1e/0x60 [rdma_rxe] Read of size 1 at addr ffff88801c50d8f4 by task check/24830 CPU: 4 PID: 24830 Comm: check Not tainted 4.20.0-rc6-dbg+ #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 Call Trace: dump_stack+0x86/0xca print_address_description+0x71/0x239 kasan_report.cold.5+0x242/0x301 __asan_load1+0x47/0x50 rxe_run_task+0x1e/0x60 [rdma_rxe] rxe_post_send+0x4bd/0x8d0 [rdma_rxe] srpt_zerolength_write+0xe1/0x160 [ib_srpt] srpt_close_ch+0x8b/0xe0 [ib_srpt] srpt_set_enabled+0xe7/0x150 [ib_srpt] srpt_tpg_enable_store+0xc0/0x100 [ib_srpt] configfs_write_file+0x157/0x1d0 __vfs_write+0xd7/0x3d0 vfs_write+0x102/0x290 ksys_write+0xab/0x130 __x64_sys_write+0x43/0x50 do_syscall_64+0x71/0x210 entry_SYSCALL_64_after_hwframe+0x49/0xbe Allocated by task 13856: save_stack+0x43/0xd0 kasan_kmalloc+0xc7/0xe0 kasan_slab_alloc+0x11/0x20 kmem_cache_alloc+0x105/0x320 rxe_alloc+0xff/0x1f0 [rdma_rxe] rxe_create_qp+0x9f/0x160 [rdma_rxe] ib_create_qp+0xf5/0x690 [ib_core] rdma_create_qp+0x6a/0x140 [rdma_cm] srpt_cm_req_recv.cold.59+0x1588/0x237b [ib_srpt] srpt_rdma_cm_req_recv.isra.35+0x1d5/0x220 [ib_srpt] srpt_rdma_cm_handler+0x6f/0x100 [ib_srpt] cma_listen_handler+0x59/0x60 [rdma_cm] cma_ib_req_handler+0xd5b/0x2570 [rdma_cm] cm_process_work+0x2e/0x110 [ib_cm] cm_work_handler+0x2aae/0x502b [ib_cm] process_one_work+0x481/0x9e0 worker_thread+0x67/0x5b0 kthread+0x1cf/0x1f0 ret_from_fork+0x24/0x30 Freed by task 3440: save_stack+0x43/0xd0 __kasan_slab_free+0x139/0x190 kasan_slab_free+0xe/0x10 kmem_cache_free+0xbc/0x330 rxe_elem_release+0x66/0xe0 [rdma_rxe] rxe_destroy_qp+0x3f/0x50 [rdma_rxe] ib_destroy_qp+0x140/0x360 [ib_core] srpt_release_channel_work+0xdc/0x310 [ib_srpt] process_one_work+0x481/0x9e0 worker_thread+0x67/0x5b0 kthread+0x1cf/0x1f0 ret_from_fork+0x24/0x30 Cc: Sergey Gorenko Cc: Max Gurtovoy Cc: Laurence Oberman Cc: Signed-off-by: Bart Van Assche Signed-off-by: Doug Ledford drivers/infiniband/ulp/srpt/ib_srpt.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) commit 882981f4a4112b44376ba21aa4d82dbdd5d8f148 Author: Bart Van Assche Date: Mon Dec 17 13:20:39 2018 -0800 RDMA/srp: Add support for immediate data Request permission to send immediate data during login. If the SRP target grants this request, send the payload of write requests <= 8 KB as immediate data. Cc: Sergey Gorenko Cc: Max Gurtovoy Cc: Laurence Oberman Signed-off-by: Bart Van Assche Signed-off-by: Doug Ledford drivers/infiniband/ulp/srp/ib_srp.c | 91 +++++++++++++++++++++++++++++++------ drivers/infiniband/ulp/srp/ib_srp.h | 12 +++++ 2 files changed, 89 insertions(+), 14 deletions(-) commit 513d5647116b2aaeb6d99471f70ab9c9f3f65663 Author: Bart Van Assche Date: Mon Dec 17 13:20:38 2018 -0800 RDMA/srp: Rework handling of the maximum information unit length Move the maximum initiator to target information unit length parameter from struct srp_target_port into struct srp_rdma_ch. This patch does not change any functionality but makes the next patch easier to read. Cc: Sergey Gorenko Cc: Max Gurtovoy Cc: Laurence Oberman Signed-off-by: Bart Van Assche Signed-off-by: Doug Ledford drivers/infiniband/ulp/srp/ib_srp.c | 40 +++++++++++++++++++++++++------------ drivers/infiniband/ulp/srp/ib_srp.h | 3 ++- 2 files changed, 29 insertions(+), 14 deletions(-) commit 4f6d498c360c31006dec8062ce3d4601e557e9df Author: Bart Van Assche Date: Mon Dec 17 13:20:37 2018 -0800 RDMA/srp: Move srp_rdma_ch.max_ti_iu_len declaration Since srp_rdma_ch.max_ti_iu_len is used in the hot path, move it to the section with data structure members used in the hot path. Cc: Sergey Gorenko Cc: Max Gurtovoy Cc: Laurence Oberman Signed-off-by: Bart Van Assche Signed-off-by: Doug Ledford drivers/infiniband/ulp/srp/ib_srp.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 2ee00f6a98c36f7e4ba07cc33f24cc5a69060cc9 Author: Bart Van Assche Date: Mon Dec 17 13:20:36 2018 -0800 RDMA/srp: Propagate ib_post_send() failures to the SCSI mid-layer This patch avoids that the SCSI mid-layer keeps retrying forever if ib_post_send() fails. This was discovered while testing immediate data support and passing a too large num_sge value to ib_post_send(). Cc: Sergey Gorenko Cc: Max Gurtovoy Cc: Laurence Oberman Signed-off-by: Bart Van Assche Signed-off-by: Doug Ledford drivers/infiniband/ulp/srp/ib_srp.c | 1 + 1 file changed, 1 insertion(+) commit 482fffc43c032ec09dd9ee792a546b36e973dcef Author: Bart Van Assche Date: Mon Dec 17 13:20:35 2018 -0800 RDMA/srp: Handle large SCSI CDBs correctly Reserve additional space for CDBs that contain more than sixteen bytes and set the add_cdb_len field for such CDBs as required. From the SRP standard: "The ADDITIONAL CDB LENGTH field contains the length in dwords of the ADDITIONAL CDB field." Cc: Sergey Gorenko Cc: Max Gurtovoy Cc: Laurence Oberman Signed-off-by: Bart Van Assche Signed-off-by: Doug Ledford drivers/infiniband/ulp/srp/ib_srp.c | 23 +++++++++++++++++------ drivers/infiniband/ulp/srp/ib_srp.h | 2 ++ 2 files changed, 19 insertions(+), 6 deletions(-) commit e37df2d5b569390e3b80ebed9a73fd5b9dcda010 Author: Bart Van Assche Date: Mon Dec 17 13:20:34 2018 -0800 RDMA/srp: Document srp_parse_in() arguments This patch avoids that a warning is reported when building with W=1. Cc: Sergey Gorenko Cc: Max Gurtovoy Cc: Laurence Oberman Signed-off-by: Bart Van Assche Signed-off-by: Doug Ledford drivers/infiniband/ulp/srp/ib_srp.c | 3 +++ 1 file changed, 3 insertions(+) commit 16d14e01b7a100911804768b3ae4df083da2b53d Author: Bart Van Assche Date: Mon Dec 17 13:20:33 2018 -0800 include/scsi/srp.h: Add support for immediate data Add constants and data structures to support immediate data. These changes conform to SRP2r04. Cc: Sergey Gorenko Cc: Max Gurtovoy Cc: Laurence Oberman Signed-off-by: Bart Van Assche Signed-off-by: Doug Ledford drivers/infiniband/ulp/srp/ib_srp.c | 5 +++++ include/scsi/srp.h | 19 ++++++++++++++++--- 2 files changed, 21 insertions(+), 3 deletions(-) commit feafa20433466d6193d5686b188999391c873165 Author: Bart Van Assche Date: Mon Dec 17 13:20:32 2018 -0800 include/scsi/srp.h: Move response flag definitions into this file This patch moves all constants that come from the SRP standard into the include/scsi/srp.h header file. Cc: Sergey Gorenko Cc: Max Gurtovoy Cc: Laurence Oberman Signed-off-by: Bart Van Assche Signed-off-by: Doug Ledford drivers/infiniband/ulp/srpt/ib_srpt.h | 4 ---- include/scsi/srp.h | 7 +++++++ 2 files changed, 7 insertions(+), 4 deletions(-) commit 055722716c396ac1c7fd36a828250a78db1f22bc Author: Hoang Le Date: Wed Dec 19 11:42:19 2018 +0700 tipc: fix uninitialized value for broadcast retransmission When sending broadcast message on high load system, there are a lot of unnecessary packets restranmission. That issue was caused by missing in initial criteria for retransmission. To prevent this happen, just initialize this criteria for retransmission in next 10 milliseconds. Fixes: 31c4f4cc32f7 ("tipc: improve broadcast retransmission algorithm") Acked-by: Ying Xue Acked-by: Jon Maloy Signed-off-by: Hoang Le Signed-off-by: David S. Miller net/tipc/link.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 013dc9d55c2ee47bb4a509e10c5cad404059b686 Merge: 4a54877ee767 cf5f55f7f013 Author: David S. Miller Date: Wed Dec 19 11:49:25 2018 -0800 Merge branch 'tipc-tracepoints' Tuong Lien says: ==================== tipc: tracepoints and trace_events in TIPC The patch series is the first step of introducing a tracing framework in TIPC, which will assist in collecting complete & plentiful data for post analysis, even in the case of a single failure occurrence e.g. when the failure is unreproducible. The tracing code in TIPC utilizes the powerful kernel tracepoints, trace events features along with particular dump functions to trace the TIPC object data and events (incl. bearer, link, socket, node, etc.). The tracing code should generate zero-load to TIPC when the trace events are not enabled. ==================== Signed-off-by: David S. Miller commit cf5f55f7f01397015dfa390256f2c20ceaabfcfb Author: Tuong Lien Date: Wed Dec 19 09:18:00 2018 +0700 tipc: add trace_events for tipc bearer The commit adds the new trace_event for TIPC bearer, L2 device event: trace_tipc_l2_device_event() Also, it puts the trace at the tipc_l2_device_event() function, then the device/bearer events and related info can be traced out during runtime when needed. Acked-by: Ying Xue Tested-by: Ying Xue Acked-by: Jon Maloy Signed-off-by: Tuong Lien Signed-off-by: David S. Miller net/tipc/bearer.c | 2 ++ net/tipc/trace.h | 43 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 45 insertions(+) commit eb18a510b5cd4daeb9736ad8db57a9fc49db185b Author: Tuong Lien Date: Wed Dec 19 09:17:59 2018 +0700 tipc: add trace_events for tipc node The commit adds the new trace_events for TIPC node object: trace_tipc_node_create() trace_tipc_node_delete() trace_tipc_node_lost_contact() trace_tipc_node_timeout() trace_tipc_node_link_up() trace_tipc_node_link_down() trace_tipc_node_reset_links() trace_tipc_node_fsm_evt() trace_tipc_node_check_state() Also, enables the traces for the following cases: - When a node is created/deleted; - When a node contact is lost; - When a node timer is timed out; - When a node link is up/down; - When all node links are reset; - When node state is changed; - When a skb comes and node state needs to be checked/updated. Acked-by: Ying Xue Tested-by: Ying Xue Acked-by: Jon Maloy Signed-off-by: Tuong Lien Signed-off-by: David S. Miller net/tipc/node.c | 15 +++++++++++++++ net/tipc/trace.h | 9 +++++++++ 2 files changed, 24 insertions(+) commit 01e661ebfbad40e6280fb8ec25f2861d39ba4387 Author: Tuong Lien Date: Wed Dec 19 09:17:58 2018 +0700 tipc: add trace_events for tipc socket The commit adds the new trace_events for TIPC socket object: trace_tipc_sk_create() trace_tipc_sk_poll() trace_tipc_sk_sendmsg() trace_tipc_sk_sendmcast() trace_tipc_sk_sendstream() trace_tipc_sk_filter_rcv() trace_tipc_sk_advance_rx() trace_tipc_sk_rej_msg() trace_tipc_sk_drop_msg() trace_tipc_sk_release() trace_tipc_sk_shutdown() trace_tipc_sk_overlimit1() trace_tipc_sk_overlimit2() Also, enables the traces for the following cases: - When user creates a TIPC socket; - When user calls poll() on TIPC socket; - When user sends a dgram/mcast/stream message. - When a message is put into the socket 'sk_receive_queue'; - When a message is released from the socket 'sk_receive_queue'; - When a message is rejected (e.g. due to no port, invalid, etc.); - When a message is dropped (e.g. due to wrong message type); - When socket is released; - When socket is shutdown; - When socket rcvq's allocation is overlimit (> 90%); - When socket rcvq + bklq's allocation is overlimit (> 90%); - When the 'TIPC_ERR_OVERLOAD/2' issue happens; Note: a) All the socket traces are designed to be able to trace on a specific socket by either using the 'event filtering' feature on a known socket 'portid' value or the sysctl file: /proc/sys/net/tipc/sk_filter The file determines a 'tuple' for what socket should be traced: (portid, sock type, name type, name lower, name upper) where: + 'portid' is the socket portid generated at socket creating, can be found in the trace outputs or the 'tipc socket list' command printouts; + 'sock type' is the socket type (1 = SOCK_TREAM, ...); + 'name type', 'name lower' and 'name upper' are the service name being connected to or published by the socket. Value '0' means 'ANY', the default tuple value is (0, 0, 0, 0, 0) i.e. the traces happen for every sockets with no filter. b) The 'tipc_sk_overlimit1/2' event is also a conditional trace_event which happens when the socket receive queue (and backlog queue) is about to be overloaded, when the queue allocation is > 90%. Then, when the trace is enabled, the last skbs leading to the TIPC_ERR_OVERLOAD/2 issue can be traced. The trace event is designed as an 'upper watermark' notification that the other traces (e.g. 'tipc_sk_advance_rx' vs 'tipc_sk_filter_rcv') or actions can be triggerred in the meanwhile to see what is going on with the socket queue. In addition, the 'trace_tipc_sk_dump()' is also placed at the 'TIPC_ERR_OVERLOAD/2' case, so the socket and last skb can be dumped for post-analysis. Acked-by: Ying Xue Tested-by: Ying Xue Acked-by: Jon Maloy Signed-off-by: Tuong Lien Signed-off-by: David S. Miller net/tipc/socket.c | 137 ++++++++++++++++++++++++++++++++++++++++++++++++++++-- net/tipc/socket.h | 2 + net/tipc/sysctl.c | 8 ++++ net/tipc/trace.c | 6 +++ net/tipc/trace.h | 32 +++++++++++-- 5 files changed, 176 insertions(+), 9 deletions(-) commit 26574db0c17fb29fac8b57f94ed1dfd46cc89887 Author: Tuong Lien Date: Wed Dec 19 09:17:57 2018 +0700 tipc: add trace_events for tipc link The commit adds the new trace_events for TIPC link object: trace_tipc_link_timeout() trace_tipc_link_fsm() trace_tipc_link_reset() trace_tipc_link_too_silent() trace_tipc_link_retrans() trace_tipc_link_bc_ack() trace_tipc_link_conges() And the traces for PROTOCOL messages at building and receiving: trace_tipc_proto_build() trace_tipc_proto_rcv() Note: a) The 'tipc_link_too_silent' event will only happen when the 'silent_intv_cnt' is about to reach the 'abort_limit' value (and the event is enabled). The benefit for this kind of event is that we can get an early indication about TIPC link loss issue due to timeout, then can do some necessary actions for troubleshooting. For example: To trigger the 'tipc_proto_rcv' when the 'too_silent' event occurs: echo 'enable_event:tipc:tipc_proto_rcv' > \ events/tipc/tipc_link_too_silent/trigger And disable it when TIPC link is reset: echo 'disable_event:tipc:tipc_proto_rcv' > \ events/tipc/tipc_link_reset/trigger b) The 'tipc_link_retrans' or 'tipc_link_bc_ack' event is useful to trace TIPC retransmission issues. In addition, the commit adds the 'trace_tipc_list/link_dump()' at the 'retransmission failure' case. Then, if the issue occurs, the link 'transmq' along with the link data can be dumped for post-analysis. These dump events should be enabled by default since it will only take effect when the failure happens. The same approach is also applied for the faulty case that the validation of protocol message is failed. Acked-by: Ying Xue Tested-by: Ying Xue Acked-by: Jon Maloy Signed-off-by: Tuong Lien Signed-off-by: David S. Miller net/tipc/link.c | 33 ++++++++++++++- net/tipc/link.h | 1 + net/tipc/node.c | 8 +++- net/tipc/trace.h | 124 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 164 insertions(+), 2 deletions(-) commit b4b9771bcbbd5839b0f77aba55e2f85989ed6779 Author: Tuong Lien Date: Wed Dec 19 09:17:56 2018 +0700 tipc: enable tracepoints in tipc As for the sake of debugging/tracing, the commit enables tracepoints in TIPC along with some general trace_events as shown below. It also defines some 'tipc_*_dump()' functions that allow to dump TIPC object data whenever needed, that is, for general debug purposes, ie. not just for the trace_events. The following trace_events are now available: - trace_tipc_skb_dump(): allows to trace and dump TIPC msg & skb data, e.g. message type, user, droppable, skb truesize, cloned skb, etc. - trace_tipc_list_dump(): allows to trace and dump any TIPC buffers or queues, e.g. TIPC link transmq, socket receive queue, etc. - trace_tipc_sk_dump(): allows to trace and dump TIPC socket data, e.g. sk state, sk type, connection type, rmem_alloc, socket queues, etc. - trace_tipc_link_dump(): allows to trace and dump TIPC link data, e.g. link state, silent_intv_cnt, gap, bc_gap, link queues, etc. - trace_tipc_node_dump(): allows to trace and dump TIPC node data, e.g. node state, active links, capabilities, link entries, etc. How to use: Put the trace functions at any places where we want to dump TIPC data or events. Note: a) The dump functions will generate raw data only, that is, to offload the trace event's processing, it can require a tool or script to parse the data but this should be simple. b) The trace_tipc_*_dump() should be reserved for a failure cases only (e.g. the retransmission failure case) or where we do not expect to happen too often, then we can consider enabling these events by default since they will almost not take any effects under normal conditions, but once the rare condition or failure occurs, we get the dumped data fully for post-analysis. For other trace purposes, we can reuse these trace classes as template but different events. c) A trace_event is only effective when we enable it. To enable the TIPC trace_events, echo 1 to 'enable' files in the events/tipc/ directory in the 'debugfs' file system. Normally, they are located at: /sys/kernel/debug/tracing/events/tipc/ For example: To enable the tipc_link_dump event: echo 1 > /sys/kernel/debug/tracing/events/tipc/tipc_link_dump/enable To enable all the TIPC trace_events: echo 1 > /sys/kernel/debug/tracing/events/tipc/enable To collect the trace data: cat trace or cat trace_pipe > /trace.out & To disable all the TIPC trace_events: echo 0 > /sys/kernel/debug/tracing/events/tipc/enable To clear the trace buffer: echo > trace d) Like the other trace_events, the feature like 'filter' or 'trigger' is also usable for the tipc trace_events. For more details, have a look at: Documentation/trace/ftrace.txt MAINTAINERS | add two new files 'trace.h' & 'trace.c' in tipc Acked-by: Ying Xue Tested-by: Ying Xue Acked-by: Jon Maloy Signed-off-by: Tuong Lien Signed-off-by: David S. Miller net/tipc/Makefile | 4 +- net/tipc/bearer.c | 7 +- net/tipc/bearer.h | 2 +- net/tipc/link.c | 120 ++++++++++++++++++++++++++++ net/tipc/link.h | 1 + net/tipc/node.c | 63 +++++++++++++++ net/tipc/node.h | 1 + net/tipc/socket.c | 90 +++++++++++++++++++++ net/tipc/socket.h | 2 + net/tipc/trace.c | 200 ++++++++++++++++++++++++++++++++++++++++++++++ net/tipc/trace.h | 231 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 11 files changed, 716 insertions(+), 5 deletions(-) commit 99c66bc051e7407fe0bf0607b142ec0be1a1d1dd Author: Kristian H. Kristensen Date: Wed Dec 19 08:57:41 2018 -0800 drm/msm: Unblock writer if reader closes file Prevents deadlock when fifo is full and reader closes file. Signed-off-by: Kristian H. Kristensen Signed-off-by: Rob Clark drivers/gpu/drm/msm/msm_rd.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 18f2c4fcebf2582f96cbd5f2238f4f354a0e4847 Author: Theodore Ts'o Date: Wed Dec 19 14:36:58 2018 -0500 ext4: check for shutdown and r/o file system in ext4_write_inode() If the file system has been shut down or is read-only, then ext4_write_inode() needs to bail out early. Also use jbd2_complete_transaction() instead of ext4_force_commit() so we only force a commit if it is needed. Signed-off-by: Theodore Ts'o Cc: stable@kernel.org fs/ext4/inode.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) commit 8c5e14f438b8cee47ff01fc1cadd15e3eed44b59 Merge: 5132411985e1 8c33df1afd86 Author: Paolo Bonzini Date: Wed Dec 19 20:33:55 2018 +0100 Merge tag 'kvmarm-for-v4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm updates for 4.21 - Large PUD support for HugeTLB - Single-stepping fixes - Improved tracing - Various timer and vgic fixups commit 4a54877ee767fe70a6966352c788fc5f405aa3c6 Merge: 8239d5790481 4165079ba328 Author: David S. Miller Date: Wed Dec 19 11:21:45 2018 -0800 Merge branch 'sk_buff-add-extension-infrastructure' Florian Westphal says: ==================== sk_buff: add extension infrastructure TL;DR: - objdiff shows no change if CONFIG_XFRM=n && BR_NETFILTER=n - small size reduction when one or both options are set - no changes in ipsec performance Changes since v1: - Allocate entire extension space from a kmem_cache. - Avoid atomic_dec_and_test operation on skb_ext_put() for refcnt == 1 case. (similar to kfree_skbmem() fclone_ref use). This adds an optional extension infrastructure, with ispec (xfrm) and bridge netfilter as first users. The third (future) user is Multipath TCP which is still out-of-tree. MPTCP needs to map logical mptcp sequence numbers to the tcp sequence numbers used by individual subflows. This DSS mapping is read/written from tcp option space on receive and written to tcp option space on transmitted tcp packets that are part of and MPTCP connection. Extending skb_shared_info or adding a private data field to skb fclones doesn't work for incoming skb, so a different DSS propagation method would be required for the receive side. mptcp has same requirements as secpath/bridge netfilter: 1. extension memory is released when the sk_buff is free'd. 2. data is shared after cloning an skb (clone inherits extension) 3. adding extension to an skb will COW the extension buffer if needed. Two new members are added to sk_buff: 1. 'active_extensions' byte (filling a hole), telling which extensions are available for this skb. This has two purposes. a) avoids the need to initialize the pointer. b) allows to "delete" an extension by clearing its bit value in ->active_extensions. While it would be possible to store the active_extensions byte in the extension struct instead of sk_buff, there is one problem with this: When an extension has to be disabled, we can always clear the bit in skb->active_extensions. But in case it would be stored in the extension buffer itself, we might have to COW it first, if we are dealing with a cloned skb. On kmalloc failure we would be unable to turn an extension off. 2. extension pointer, located at the end of the sk_buff. If the active_extensions byte is 0, the pointer is undefined, it is not initialized on skb allocation. This adds extra code to skb clone and free paths (to deal with refcount/free of extension area) but this replaces similar code that manages skb->nf_bridge and skb->sp structs in the followup patches of the series. It is possible to add support for extensions that are not preseved on clones/copies: 1. define a bitmask of all extensions that need copy/cow on clone 2. change __skb_ext_copy() to check ->active_extensions & SKB_EXT_PRESERVE_ON_CLONE 3. set clone->active_extensions to 0 if test is false. This isn't done here because all extensions that get added here need the copy/cow semantics. Last patch converts skb->sp, secpath information gets stored as new SKB_EXT_SEC_PATH, so the 'sp' pointer is removed from skbuff. Extra code added to skb clone and free paths (to deal with refcount/free of extension area) replaces the existing code that does the same for skb->nf_bridge and skb->secpath. I don't see any other in-tree users that could benefit from this infrastructure, it doesn't make sense to add an extension just for the sake of a single flag bit (like skb->nf_trace). Adding a new extension is a good fit if all of the following are true: 1. Data is related to the skb/packet aggregate 2. Data should be freed when the skb is free'd 3. Data is not going to be relevant/needed in normal case (udp, tcp, forwarding workloads, ...) 4. There are no fancy action(s) needed on clone/free, such as callbacks into kernel modules. ==================== Signed-off-by: David S. Miller commit 4165079ba328dd47262a2183049d3591f0a750b1 Author: Florian Westphal Date: Tue Dec 18 17:15:27 2018 +0100 net: switch secpath to use skb extension infrastructure Remove skb->sp and allocate secpath storage via extension infrastructure. This also reduces sk_buff by 8 bytes on x86_64. Total size of allyesconfig kernel is reduced slightly, as there is less inlined code (one conditional atomic op instead of two on skb_clone). No differences in throughput in following ipsec performance tests: - transport mode with aes on 10GB link - tunnel mode between two network namespaces with aes and null cipher Signed-off-by: Florian Westphal Signed-off-by: David S. Miller Documentation/networking/xfrm_device.txt | 7 ++-- include/linux/skbuff.h | 10 +++--- include/net/xfrm.h | 22 +------------ net/core/skbuff.c | 47 +++++++++++++++++++++++---- net/xfrm/xfrm_input.c | 56 +++++--------------------------- 5 files changed, 59 insertions(+), 83 deletions(-) commit a84e3f533324e40e4a99f50dee2188bf140d8098 Author: Florian Westphal Date: Tue Dec 18 17:15:26 2018 +0100 xfrm: prefer secpath_set over secpath_dup secpath_set is a wrapper for secpath_dup that will not perform an allocation if the secpath attached to the skb has a reference count of one, i.e., it doesn't need to be COW'ed. Also, secpath_dup doesn't attach the secpath to the skb, it leaves this to the caller. Use secpath_set in places that immediately assign the return value to skb. This allows to remove skb->sp without touching these spots again. secpath_dup can eventually be removed in followup patch. Signed-off-by: Florian Westphal Signed-off-by: David S. Miller drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 9 +++++---- drivers/net/ethernet/intel/ixgbevf/ipsec.c | 9 +++++---- drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c | 10 ++++++---- net/xfrm/Kconfig | 1 + net/xfrm/xfrm_output.c | 7 ++----- 5 files changed, 19 insertions(+), 17 deletions(-) commit a053c866496d0c3647727f6a282a1db3afea3ed7 Author: Florian Westphal Date: Tue Dec 18 17:15:25 2018 +0100 drivers: chelsio: use skb_sec_path helper reduce noise when skb->sp is removed later in the series. Signed-off-by: Florian Westphal Signed-off-by: David S. Miller drivers/crypto/chelsio/chcr_ipsec.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 26912e3756d0a13b188142d1ba0ab279cd3b657a Author: Florian Westphal Date: Tue Dec 18 17:15:24 2018 +0100 xfrm: use secpath_exist where applicable Will reduce noise when skb->sp is removed later in this series. Signed-off-by: Florian Westphal Signed-off-by: David S. Miller include/net/xfrm.h | 2 +- net/xfrm/xfrm_interface.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 56d1ac3260dadfc66c81ef2689bd1a09b05731a2 Author: Florian Westphal Date: Tue Dec 18 17:15:23 2018 +0100 drivers: net: netdevsim: use skb_sec_path helper ... so this won't have to be changed when skb->sp goes away. v2: no changes, preserve ack. Acked-by: Shannon Nelson Signed-off-by: Florian Westphal Signed-off-by: David S. Miller drivers/net/netdevsim/ipsec.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 6362a6a04031cacc8ff54b65b84385d9fbab853d Author: Florian Westphal Date: Tue Dec 18 17:15:22 2018 +0100 drivers: net: ethernet: mellanox: use skb_sec_path helper Will avoid touching this when sp pointer is removed from sk_buff struct. Signed-off-by: Florian Westphal Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 2fdb435bc0d7492b8137d4c9db6a465511154e29 Author: Florian Westphal Date: Tue Dec 18 17:15:21 2018 +0100 drivers: net: intel: use secpath helpers in more places Use skb_sec_path and secpath_exists helpers where possible. This reduces noise in followup patch that removes skb->sp pointer. v2: no changes, preseve acks from v1. Acked-by: Shannon Nelson Signed-off-by: Florian Westphal Signed-off-by: David S. Miller drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 6 ++++-- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 5 +++-- drivers/net/ethernet/intel/ixgbevf/ipsec.c | 6 ++++-- drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 2 +- 4 files changed, 12 insertions(+), 7 deletions(-) commit 2294be0f11e22b6197d025e5d3ab42888879ec4e Author: Florian Westphal Date: Tue Dec 18 17:15:20 2018 +0100 net: use skb_sec_path helper in more places skb_sec_path gains 'const' qualifier to avoid xt_policy.c: 'skb_sec_path' discards 'const' qualifier from pointer target type same reasoning as previous conversions: Won't need to touch these spots anymore when skb->sp is removed. Signed-off-by: Florian Westphal Signed-off-by: David S. Miller include/linux/skbuff.h | 2 +- include/net/xfrm.h | 6 ++++-- net/ipv4/esp4.c | 9 ++++++--- net/ipv4/esp4_offload.c | 4 +++- net/ipv6/esp6.c | 9 ++++++--- net/ipv6/esp6_offload.c | 4 +++- net/ipv6/xfrm6_input.c | 2 +- net/netfilter/nft_xfrm.c | 2 +- net/netfilter/xt_policy.c | 2 +- net/xfrm/xfrm_device.c | 4 +++- net/xfrm/xfrm_input.c | 16 ++++++++++------ net/xfrm/xfrm_policy.c | 19 +++++++++++-------- security/selinux/xfrm.c | 4 ++-- 13 files changed, 52 insertions(+), 31 deletions(-) commit 7af8f4ca314a592e2ba49cb5ea1de1325974998e Author: Florian Westphal Date: Tue Dec 18 17:15:19 2018 +0100 net: move secpath_exist helper to sk_buff.h Future patch will remove skb->sp pointer. To reduce noise in those patches, move existing helper to sk_buff and use it in more places to ease skb->sp replacement later. Signed-off-by: Florian Westphal Signed-off-by: David S. Miller include/linux/skbuff.h | 13 ++++++++++--- include/net/xfrm.h | 9 --------- net/netfilter/nft_meta.c | 2 +- 3 files changed, 11 insertions(+), 13 deletions(-) commit 0ca64da128b816b2826e9b469f47239c47f1df31 Author: Florian Westphal Date: Tue Dec 18 17:15:18 2018 +0100 xfrm: change secpath_set to return secpath struct, not error value It can only return 0 (success) or -ENOMEM. Change return value to a pointer to secpath struct. This avoids direct access to skb->sp: err = secpath_set(skb); if (!err) .. skb->sp-> ... Becomes: sp = secpath_set(skb) if (!sp) .. sp-> .. This reduces noise in followup patch which is going to remove skb->sp. Signed-off-by: Florian Westphal Signed-off-by: David S. Miller include/net/xfrm.h | 2 +- net/ipv4/esp4_offload.c | 11 ++++++----- net/ipv6/esp6_offload.c | 11 ++++++----- net/ipv6/xfrm6_input.c | 6 ++++-- net/xfrm/xfrm_input.c | 16 +++++++++------- 5 files changed, 26 insertions(+), 20 deletions(-) commit de8bda1d22d38b7d5cd08b33f86efd94d4c86630 Author: Florian Westphal Date: Tue Dec 18 17:15:17 2018 +0100 net: convert bridge_nf to use skb extension infrastructure This converts the bridge netfilter (calling iptables hooks from bridge) facility to use the extension infrastructure. The bridge_nf specific hooks in skb clone and free paths are removed, they have been replaced by the skb_ext hooks that do the same as the bridge nf allocations hooks did. Signed-off-by: Florian Westphal Signed-off-by: David S. Miller include/linux/netfilter_bridge.h | 4 ++-- include/linux/skbuff.h | 28 ++-------------------------- include/net/netfilter/br_netfilter.h | 8 ++++---- net/Kconfig | 1 + net/bridge/br_netfilter_hooks.c | 20 ++------------------ net/bridge/br_netfilter_ipv6.c | 4 ++-- net/core/skbuff.c | 3 --- 7 files changed, 13 insertions(+), 55 deletions(-) commit df5042f4c5b9326c593bf2e31ed859ebc3b4130a Author: Florian Westphal Date: Tue Dec 18 17:15:16 2018 +0100 sk_buff: add skb extension infrastructure This adds an optional extension infrastructure, with ispec (xfrm) and bridge netfilter as first users. objdiff shows no changes if kernel is built without xfrm and br_netfilter support. The third (planned future) user is Multipath TCP which is still out-of-tree. MPTCP needs to map logical mptcp sequence numbers to the tcp sequence numbers used by individual subflows. This DSS mapping is read/written from tcp option space on receive and written to tcp option space on transmitted tcp packets that are part of and MPTCP connection. Extending skb_shared_info or adding a private data field to skb fclones doesn't work for incoming skb, so a different DSS propagation method would be required for the receive side. mptcp has same requirements as secpath/bridge netfilter: 1. extension memory is released when the sk_buff is free'd. 2. data is shared after cloning an skb (clone inherits extension) 3. adding extension to an skb will COW the extension buffer if needed. The "MPTCP upstreaming" effort adds SKB_EXT_MPTCP extension to store the mapping for tx and rx processing. Two new members are added to sk_buff: 1. 'active_extensions' byte (filling a hole), telling which extensions are available for this skb. This has two purposes. a) avoids the need to initialize the pointer. b) allows to "delete" an extension by clearing its bit value in ->active_extensions. While it would be possible to store the active_extensions byte in the extension struct instead of sk_buff, there is one problem with this: When an extension has to be disabled, we can always clear the bit in skb->active_extensions. But in case it would be stored in the extension buffer itself, we might have to COW it first, if we are dealing with a cloned skb. On kmalloc failure we would be unable to turn an extension off. 2. extension pointer, located at the end of the sk_buff. If the active_extensions byte is 0, the pointer is undefined, it is not initialized on skb allocation. This adds extra code to skb clone and free paths (to deal with refcount/free of extension area) but this replaces similar code that manages skb->nf_bridge and skb->sp structs in the followup patches of the series. It is possible to add support for extensions that are not preseved on clones/copies. To do this, it would be needed to define a bitmask of all extensions that need copy/cow semantics, and change __skb_ext_copy() to check ->active_extensions & SKB_EXT_PRESERVE_ON_CLONE, then just set ->active_extensions to 0 on the new clone. This isn't done here because all extensions that get added here need the copy/cow semantics. v2: Allocate entire extension space using kmem_cache. Upside is that this allows better tracking of used memory, downside is that we will allocate more space than strictly needed in most cases (its unlikely that all extensions are active/needed at same time for same skb). The allocated memory (except the small extension header) is not cleared, so no additonal overhead aside from memory usage. Avoid atomic_dec_and_test operation on skb_ext_put() by using similar trick as kfree_skbmem() does with fclone_ref: If recount is 1, there is no concurrent user and we can free right away. Signed-off-by: Florian Westphal Signed-off-by: David S. Miller include/linux/skbuff.h | 111 ++++++++++++++++++++++++++++++++++- net/Kconfig | 3 + net/core/skbuff.c | 155 +++++++++++++++++++++++++++++++++++++++++++++++++ net/ipv4/ip_output.c | 1 + net/ipv6/ip6_output.c | 1 + 5 files changed, 270 insertions(+), 1 deletion(-) commit c4b0e771f906f5beb7d90c3d28fe55ff9dbd038c Author: Florian Westphal Date: Tue Dec 18 17:15:15 2018 +0100 netfilter: avoid using skb->nf_bridge directly This pointer is going to be removed soon, so use the existing helpers in more places to avoid noise when the removal happens. Signed-off-by: Florian Westphal Signed-off-by: David S. Miller include/linux/netfilter_bridge.h | 33 +++++++++++++++++------- include/net/netfilter/br_netfilter.h | 6 ----- net/bridge/br_netfilter_hooks.c | 19 ++++++++++---- net/ipv4/netfilter/nf_reject_ipv4.c | 6 +++-- net/ipv6/netfilter/nf_reject_ipv6.c | 10 +++++--- net/netfilter/nf_log_common.c | 20 +++++++-------- net/netfilter/nf_queue.c | 50 ++++++++++++++++++++++++------------ net/netfilter/nfnetlink_queue.c | 23 ++++++++--------- net/netfilter/xt_physdev.c | 2 +- 9 files changed, 103 insertions(+), 66 deletions(-) commit ec5b5ad6e272d8d6b92d1007f79574919862a2d2 Author: Alexander Shishkin Date: Wed Dec 19 17:19:22 2018 +0200 intel_th: msu: Fix an off-by-one in attribute store The 'nr_pages' attribute of the 'msc' subdevices parses a comma-separated list of window sizes, passed from userspace. However, there is a bug in the string parsing logic wherein it doesn't exclude the comma character from the range of characters as it consumes them. This leads to an out-of-bounds access given a sufficiently long list. For example: > # echo 8,8,8,8 > /sys/bus/intel_th/devices/0-msc0/nr_pages > ================================================================== > BUG: KASAN: slab-out-of-bounds in memchr+0x1e/0x40 > Read of size 1 at addr ffff8803ffcebcd1 by task sh/825 > > CPU: 3 PID: 825 Comm: npktest.sh Tainted: G W 4.20.0-rc1+ > Call Trace: > dump_stack+0x7c/0xc0 > print_address_description+0x6c/0x23c > ? memchr+0x1e/0x40 > kasan_report.cold.5+0x241/0x308 > memchr+0x1e/0x40 > nr_pages_store+0x203/0xd00 [intel_th_msu] Fix this by accounting for the comma character. Signed-off-by: Alexander Shishkin Fixes: ba82664c134ef ("intel_th: Add Memory Storage Unit driver") Cc: stable@vger.kernel.org # v4.4+ Signed-off-by: Greg Kroah-Hartman drivers/hwtracing/intel_th/msu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 4cdd41585c5196f75e1e496c4f64345b2c700e0b Author: Alexander Shishkin Date: Wed Dec 19 17:19:21 2018 +0200 stm class: Add a reference to the SyS-T document Commit 4cb3653df0cd ("stm class: Document the MIPI SyS-T protocol usage") added a document describing the SyS-T protocol usage, but forgot to add it to the directory index. Fix that. Signed-off-by: Alexander Shishkin Fixes: 4cb3653df0cd ("stm class: Document the MIPI SyS-T protocol usage") Signed-off-by: Greg Kroah-Hartman Documentation/trace/index.rst | 1 + 1 file changed, 1 insertion(+) commit c18614a1a11276837bdd44403d84d207c9951538 Author: Alexander Shishkin Date: Wed Dec 19 17:19:20 2018 +0200 stm class: Fix a module refcount leak in policy creation error path Commit c7fd62bc69d0 ("stm class: Introduce framing protocol drivers") adds a bug into the error path of policy creation, that would do a module_put() on a wrong module, if one tried to create a policy for an stm device which already has a policy, using a different protocol. IOW, | mkdir /config/stp-policy/dummy_stm.0:p_basic.test | mkdir /config/stp-policy/dummy_stm.0:p_sys-t.test # puts "p_basic" | mkdir /config/stp-policy/dummy_stm.0:p_sys-t.test # "p_basic" -> -1 throws: | general protection fault: 0000 [#1] SMP PTI | CPU: 3 PID: 2887 Comm: mkdir | RIP: 0010:module_put.part.31+0xe/0x90 | Call Trace: | module_put+0x13/0x20 | stm_put_protocol+0x11/0x20 [stm_core] | stp_policy_make+0xf1/0x210 [stm_core] | ? __kmalloc+0x183/0x220 | ? configfs_mkdir+0x10d/0x4c0 | configfs_mkdir+0x169/0x4c0 | vfs_mkdir+0x108/0x1c0 | do_mkdirat+0xe8/0x110 | __x64_sys_mkdir+0x1b/0x20 | do_syscall_64+0x5a/0x140 | entry_SYSCALL_64_after_hwframe+0x44/0xa9 Correct this sad mistake by calling calling 'put' on the correct reference, which happens to match another error path in the same function, so we consolidate the two at the same time. Signed-off-by: Alexander Shishkin Fixes: c7fd62bc69d0 ("stm class: Introduce framing protocol drivers") Reported-by: Ammy Yi Cc: stable Signed-off-by: Greg Kroah-Hartman drivers/hwtracing/stm/policy.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) commit fde872682e175743e0c3ef939c89e3c6008a1529 Author: Theodore Ts'o Date: Wed Dec 19 14:07:58 2018 -0500 ext4: force inode writes when nfsd calls commit_metadata() Some time back, nfsd switched from calling vfs_fsync() to using a new commit_metadata() hook in export_operations(). If the file system did not provide a commit_metadata() hook, it fell back to using sync_inode_metadata(). Unfortunately doesn't work on all file systems. In particular, it doesn't work on ext4 due to how the inode gets journalled --- the VFS writeback code will not always call ext4_write_inode(). So we need to provide our own ext4_nfs_commit_metdata() method which calls ext4_write_inode() directly. Google-Bug-Id: 121195940 Signed-off-by: Theodore Ts'o Cc: stable@kernel.org fs/ext4/super.c | 11 +++++++++++ include/trace/events/ext4.h | 20 ++++++++++++++++++++ 2 files changed, 31 insertions(+) commit 74fbc7d371d9a438b8e39d926d9d5012d2f762c4 Author: Song Hongyan Date: Tue Dec 11 09:58:23 2018 +0800 HID: intel-ish-hid: add MSI interrupt support Now ish hid ipc only support sideband interrupt but on some platforms they use MSI interrupt. In order to make the interrupt type coverage all the scenario add single MSI interrupt support, it can match all interrupt types. Signed-off-by: Song Hongyan Acked-by: Srinivas Pandruvada Signed-off-by: Jiri Kosina drivers/hid/intel-ish-hid/ipc/pci-ish.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 04d1532bd0b93cc4d0056f27da1591f086d341a6 Author: NeilBrown Date: Mon Dec 3 11:30:31 2018 +1100 SUNRPC discard cr_uid from struct rpc_cred. Just use ->cr_cred->fsuid directly. Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker include/linux/sunrpc/auth.h | 2 -- net/sunrpc/auth.c | 1 - net/sunrpc/auth_gss/auth_gss.c | 12 ++++++------ 3 files changed, 6 insertions(+), 9 deletions(-) commit 2edd8d746e51229705367528e95e5b49bccfa76e Author: NeilBrown Date: Mon Dec 3 11:30:31 2018 +1100 SUNRPC: simplify auth_unix. 1/ discard 'struct unx_cred'. We don't need any data that is not already in 'struct rpc_cred'. 2/ Don't keep these creds in a hash table. When a credential is needed, simply allocate it. When not needed, discard it. This can easily be faster than performing a lookup on a shared hash table. As the lookup can happen during write-out, use a mempool to ensure forward progress. This means that we cannot compare two credentials for equality by comparing the pointers, but we never do that anyway. Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker net/sunrpc/auth.c | 1 + net/sunrpc/auth_unix.c | 101 +++++++++++++++---------------------------------- 2 files changed, 32 insertions(+), 70 deletions(-) commit d6efccd97e6de25e002d658593675ce8e07ceb8c Author: NeilBrown Date: Mon Dec 3 11:30:31 2018 +1100 SUNRPC: remove crbind rpc_cred operation This now always just does get_rpccred(), so we don't need an operation pointer to know to do that. Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker include/linux/sunrpc/auth.h | 2 -- net/sunrpc/auth.c | 12 +----------- net/sunrpc/auth_gss/auth_gss.c | 2 -- net/sunrpc/auth_null.c | 1 - net/sunrpc/auth_unix.c | 1 - 5 files changed, 1 insertion(+), 17 deletions(-) commit 89a4f758d9f55f197c2a461f61ffa4a75127b30d Author: NeilBrown Date: Mon Dec 3 11:30:31 2018 +1100 SUNRPC: remove generic cred code. This is no longer used. Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker include/linux/sunrpc/auth.h | 6 -- net/sunrpc/Makefile | 2 +- net/sunrpc/auth.c | 18 +--- net/sunrpc/auth_generic.c | 199 -------------------------------------------- net/sunrpc/auth_null.c | 2 - 5 files changed, 2 insertions(+), 225 deletions(-) commit a52458b48af142bcc2b72fe810c0db20cfae7fdd Author: NeilBrown Date: Mon Dec 3 11:30:31 2018 +1100 NFS/NFSD/SUNRPC: replace generic creds with 'struct cred'. SUNRPC has two sorts of credentials, both of which appear as "struct rpc_cred". There are "generic credentials" which are supplied by clients such as NFS and passed in 'struct rpc_message' to indicate which user should be used to authorize the request, and there are low-level credentials such as AUTH_NULL, AUTH_UNIX, AUTH_GSS which describe the credential to be sent over the wires. This patch replaces all the generic credentials by 'struct cred' pointers - the credential structure used throughout Linux. For machine credentials, there is a special 'struct cred *' pointer which is statically allocated and recognized where needed as having a special meaning. A look-up of a low-level cred will map this to a machine credential. Signed-off-by: NeilBrown Acked-by: J. Bruce Fields Signed-off-by: Anna Schumaker fs/lockd/clntproc.c | 6 +- fs/nfs/blocklayout/blocklayout.c | 2 +- fs/nfs/delegation.c | 28 +++-- fs/nfs/delegation.h | 10 +- fs/nfs/flexfilelayout/flexfilelayout.c | 33 ++---- fs/nfs/flexfilelayout/flexfilelayout.h | 8 +- fs/nfs/flexfilelayout/flexfilelayoutdev.c | 16 +-- fs/nfs/inode.c | 11 +- fs/nfs/internal.h | 8 +- fs/nfs/nfs3proc.c | 18 +--- fs/nfs/nfs4_fs.h | 56 +++++----- fs/nfs/nfs4client.c | 4 +- fs/nfs/nfs4proc.c | 167 +++++++++++++----------------- fs/nfs/nfs4renewd.c | 4 +- fs/nfs/nfs4session.c | 5 +- fs/nfs/nfs4state.c | 92 ++++++++-------- fs/nfs/pagelist.c | 2 +- fs/nfs/pnfs.c | 14 +-- fs/nfs/pnfs.h | 10 +- fs/nfs/pnfs_dev.c | 4 +- fs/nfs/pnfs_nfs.c | 2 +- fs/nfs/proc.c | 9 +- fs/nfs/unlink.c | 15 +-- fs/nfs/write.c | 2 +- fs/nfsd/nfs4callback.c | 16 +-- fs/nfsd/state.h | 2 +- include/linux/nfs_fs.h | 6 +- include/linux/nfs_xdr.h | 14 +-- include/linux/sunrpc/auth.h | 18 +--- include/linux/sunrpc/sched.h | 2 +- net/sunrpc/auth.c | 14 ++- net/sunrpc/clnt.c | 4 +- net/sunrpc/sched.c | 2 +- 33 files changed, 261 insertions(+), 343 deletions(-) commit 684f39b4cf5186bb0660e686f94296688b24fb32 Author: NeilBrown Date: Mon Dec 3 11:30:30 2018 +1100 NFS: struct nfs_open_dir_context: convert rpc_cred pointer to cred. Use the common 'struct cred' to pass credentials for readdir. Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker fs/nfs/dir.c | 15 +++++---------- fs/nfs/nfs3proc.c | 11 +++++++++-- fs/nfs/nfs4proc.c | 13 ++++++++++--- fs/nfs/proc.c | 11 +++++++++-- include/linux/nfs_fs.h | 2 +- include/linux/nfs_xdr.h | 2 +- 6 files changed, 35 insertions(+), 19 deletions(-) commit b68572e07c58324cb8c274f1d84a20cad479c2d3 Author: NeilBrown Date: Mon Dec 3 11:30:30 2018 +1100 NFS: change access cache to use 'struct cred'. Rather than keying the access cache with 'struct rpc_cred', use 'struct cred'. Then use cred_fscmp() to compare credentials rather than comparing the raw pointer. A benefit of this approach is that in the common case we avoid the rpc_lookup_cred_nonblock() call which can be slow when the cred cache is large. This also keeps many fewer items pinned in the rpc cred cache, so the cred cache is less likely to get large. Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker fs/nfs/dir.c | 44 +++++++++++++++++++------------------------- fs/nfs/nfs3proc.c | 9 ++++++++- fs/nfs/nfs4proc.c | 16 ++++++++++++---- include/linux/nfs_fs.h | 4 ++-- 4 files changed, 41 insertions(+), 32 deletions(-) commit 354698b7d47165ed2f52d6c2bf682096a4cd71d1 Author: NeilBrown Date: Mon Dec 3 11:30:30 2018 +1100 SUNRPC: remove RPCAUTH_AUTH_NO_CRKEY_TIMEOUT This is no longer used. Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker include/linux/sunrpc/auth.h | 3 --- net/sunrpc/auth_null.c | 1 - net/sunrpc/auth_unix.c | 1 - 3 files changed, 5 deletions(-) commit ddf529eeed59184c49dcad1633c11831f822bf6b Author: NeilBrown Date: Mon Dec 3 11:30:30 2018 +1100 NFS: move credential expiry tracking out of SUNRPC into NFS. NFS needs to know when a credential is about to expire so that it can modify write-back behaviour to finish the write inside the expiry time. It currently uses functions in SUNRPC code which make use of a fairly complex callback scheme and flags in the generic credientials. As I am working to discard the generic credentials, this has to change. This patch moves the logic into NFS, in part by finding and caching the low-level credential in the open_context. We then make direct cred-api calls on that. This makes the code much simpler and removes a dependency on generic rpc credentials. Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker fs/nfs/inode.c | 2 ++ fs/nfs/write.c | 24 +++++++++++++-- include/linux/nfs_fs.h | 1 + include/linux/sunrpc/auth.h | 12 -------- net/sunrpc/auth.c | 23 -------------- net/sunrpc/auth_generic.c | 69 ------------------------------------------ net/sunrpc/auth_gss/auth_gss.c | 21 +++---------- 7 files changed, 28 insertions(+), 124 deletions(-) commit 1de7eea92946d7b581a8cd26084410913c80e594 Author: NeilBrown Date: Mon Dec 3 11:30:30 2018 +1100 SUNRPC: add side channel to use non-generic cred for rpc call. The credential passed in rpc_message.rpc_cred is always a generic credential except in one instance. When gss_destroying_context() calls rpc_call_null(), it passes a specific credential that it needs to destroy. In this case the RPC acts *on* the credential rather than being authorized by it. This special case deserves explicit support and providing that will mean that rpc_message.rpc_cred is *always* generic, allowing some optimizations. So add "tk_op_cred" to rpc_task and "rpc_op_cred" to the setup data. Use this to pass the cred down from rpc_call_null(), and have rpcauth_bindcred() notice it and bind it in place. Credit to kernel test robot for finding a bug in earlier version of this patch. Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker include/linux/sunrpc/sched.h | 2 ++ net/sunrpc/auth.c | 6 +++++- net/sunrpc/clnt.c | 2 +- net/sunrpc/sched.c | 3 +++ 4 files changed, 11 insertions(+), 2 deletions(-) commit a68a72e135ef55bce136a0b604413fd6b0f6d3fc Author: NeilBrown Date: Mon Dec 3 11:30:30 2018 +1100 SUNRPC: introduce RPC_TASK_NULLCREDS to request auth_none In almost all cases the credential stored in rpc_message.rpc_cred is a "generic" credential. One of the two expections is when an AUTH_NULL credential is used such as for RPC ping requests. To improve consistency, don't pass an explicit credential in these cases, but instead pass NULL and set a task flag, similar to RPC_TASK_ROOTCREDS, which requests that NULL credentials be used by default. Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker include/linux/sunrpc/sched.h | 1 + net/sunrpc/auth.c | 2 ++ net/sunrpc/clnt.c | 19 ++++++------------- 3 files changed, 9 insertions(+), 13 deletions(-) commit 5e16923b432bfe79fdfb7cd95ed8e63f6438b663 Author: NeilBrown Date: Mon Dec 3 11:30:30 2018 +1100 NFS/SUNRPC: don't lookup machine credential until rpcauth_bindcred(). When NFS creates a machine credential, it is a "generic" credential, not tied to any auth protocol, and is really just a container for the princpal name. This doesn't get linked to a genuine credential until rpcauth_bindcred() is called. The lookup always succeeds, so various places that test if the machine credential is NULL, are pointless. As a step towards getting rid of generic credentials, this patch gets rid of generic machine credentials. The nfs_client and rpc_client just hold a pointer to a constant principal name. When a machine credential is wanted, a special static 'struct rpc_cred' pointer is used. rpcauth_bindcred() recognizes this, finds the principal from the client, and binds the correct credential. Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker fs/nfs/client.c | 11 ++--------- fs/nfs/nfs4_fs.h | 9 +-------- fs/nfs/nfs4state.c | 21 ++++----------------- fs/nfsd/nfs4callback.c | 12 ++++-------- include/linux/nfs_fs_sb.h | 3 +-- include/linux/sunrpc/auth.h | 3 ++- include/linux/sunrpc/clnt.h | 1 + net/sunrpc/auth.c | 42 +++++++++++++++++++++++++++++++++++++++--- net/sunrpc/auth_generic.c | 21 --------------------- net/sunrpc/clnt.c | 1 + 10 files changed, 55 insertions(+), 69 deletions(-) commit ecd5f97e1c7cd6124e3c3053beb5f2239aeacf8e Author: NeilBrown Date: Mon Dec 3 11:30:30 2018 +1100 SUNRPC: discard RPC_DO_ROOTOVERRIDE() it is never used. Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker include/linux/sunrpc/sched.h | 1 - 1 file changed, 1 deletion(-) commit f15e1e8bc6427e4a0d38290937ccbfec1d1a2c44 Author: NeilBrown Date: Mon Dec 3 11:30:30 2018 +1100 NFSv4: don't require lock for get_renew_cred or get_machine_cred This lock is no longer necessary. If nfs4_get_renew_cred() needs to hunt through the open-state creds for a user cred, it still takes the lock to stablize the rbtree, but otherwise there are no races. Note that this completely removes the lock from nfs4_renew_state(). It appears that the original need for the locking here was removed long ago, and there is no longer anything to protect. Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker fs/nfs/nfs4_fs.h | 6 +++--- fs/nfs/nfs4proc.c | 4 ++-- fs/nfs/nfs4renewd.c | 5 +---- fs/nfs/nfs4state.c | 26 ++++++++++---------------- 4 files changed, 16 insertions(+), 25 deletions(-) commit a534ecb013bfc58a7f03653c7f2976bc341da98f Author: NeilBrown Date: Mon Dec 3 11:30:30 2018 +1100 NFSv4: add cl_root_cred for use when machine cred is not available. NFSv4 state management tries a root credential when no machine credential is available, as can happen with kerberos. It does this by replacing the cl_machine_cred with a root credential. This means that any user of the machine credential needs to take a lock while getting a reference to the machine credential, which is a little cumbersome. So introduce an explicit cl_root_cred, and never free either credential until client shutdown. This means that no locking is needed to reference these credentials. Future patches will make use of this. This is only a temporary addition. both cl_machine_cred and cl_root_cred will disappear later in the series. Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker fs/nfs/client.c | 2 ++ fs/nfs/nfs4state.c | 20 ++++++++++++-------- include/linux/nfs_fs_sb.h | 1 + 3 files changed, 15 insertions(+), 8 deletions(-) commit 1a80810fbf238e6dbaaaa5262a76d328ace21376 Author: NeilBrown Date: Mon Dec 3 11:30:30 2018 +1100 SUNRPC: remove machine_cred field from struct auth_cred The cred is a machine_cred iff ->principal is set, so there is no need for the extra flag. There is one case which deserves some explanation. nfs4_root_machine_cred() calls rpc_lookup_machine_cred() with a NULL principal name which results in not getting a machine credential, but getting a root credential instead. This appears to be what is expected of the caller, and is clearly the result provided by both auth_unix and auth_gss which already ignore the flag. Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker include/linux/sunrpc/auth.h | 3 +-- net/sunrpc/auth_generic.c | 12 ++++++------ net/sunrpc/auth_gss/auth_gss.c | 5 +---- 3 files changed, 8 insertions(+), 12 deletions(-) commit 8276c902bbe95d628f48a7fdc13c71e265992085 Author: NeilBrown Date: Mon Dec 3 11:30:30 2018 +1100 SUNRPC: remove uid and gid from struct auth_cred Use cred->fsuid and cred->fsgid instead. Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker fs/nfs/flexfilelayout/flexfilelayout.c | 14 ++++++++------ fs/nfsd/nfs4callback.c | 6 ++---- include/linux/sunrpc/auth.h | 3 --- net/sunrpc/auth.c | 6 +----- net/sunrpc/auth_generic.c | 23 ++++++++--------------- net/sunrpc/auth_gss/auth_gss.c | 9 ++++----- net/sunrpc/auth_unix.c | 12 ++++++------ 7 files changed, 29 insertions(+), 44 deletions(-) commit fc0664fd9bccafb00bd2dfe0d5218147994f81ee Author: NeilBrown Date: Mon Dec 3 11:30:30 2018 +1100 SUNRPC: remove groupinfo from struct auth_cred. We can use cred->groupinfo (from the 'struct cred') instead. Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker fs/nfs/flexfilelayout/flexfilelayout.c | 14 +------------- include/linux/sunrpc/auth.h | 1 - net/sunrpc/auth.c | 1 - net/sunrpc/auth_generic.c | 17 +++++++---------- net/sunrpc/auth_unix.c | 12 ++++++------ 5 files changed, 14 insertions(+), 31 deletions(-) commit 97f68c6b02e0225b38d327103c59cfe2ab5ecda7 Author: NeilBrown Date: Mon Dec 3 11:30:30 2018 +1100 SUNRPC: add 'struct cred *' to auth_cred and rpc_cred The SUNRPC credential framework was put together before Linux has 'struct cred'. Now that we have it, it makes sense to use it. This first step just includes a suitable 'struct cred *' pointer in every 'struct auth_cred' and almost every 'struct rpc_cred'. The rpc_cred used for auth_null has a NULL 'struct cred *' as nothing else really makes sense. For rpc_cred, the pointer is reference counted. For auth_cred it isn't. struct auth_cred are either allocated on the stack, in which case the thread owns a reference to the auth, or are part of 'struct generic_cred' in which case gc_base owns the reference, and "acred" shares it. Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker fs/nfs/flexfilelayout/flexfilelayout.c | 17 +++++++++++++++++ fs/nfsd/nfs4callback.c | 13 ++++++++++++- include/linux/sunrpc/auth.h | 2 ++ net/sunrpc/auth.c | 8 +++++++- net/sunrpc/auth_generic.c | 8 +++++++- net/sunrpc/auth_gss/auth_gss.c | 2 ++ net/sunrpc/auth_unix.c | 1 + 7 files changed, 48 insertions(+), 3 deletions(-) commit f06bc03339ad4c1baa964a5f0606247ac1c3c50b Author: NeilBrown Date: Mon Dec 3 11:30:30 2018 +1100 cred: allow get_cred() and put_cred() to be given NULL. It is common practice for helpers like this to silently, accept a NULL pointer. get_rpccred() and put_rpccred() used by NFS act this way and using the same interface will ease the conversion for NFS, and simplify the resulting code. Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker include/linux/cred.h | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) commit a6d8e7637faac93f362b694311bff64d5a8c701e Author: NeilBrown Date: Mon Dec 3 11:30:30 2018 +1100 cred: export get_task_cred(). There is no reason that modules should not be able to use this, and NFS will need it when converted to use 'struct cred'. Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker kernel/cred.c | 1 + 1 file changed, 1 insertion(+) commit 97d0fb239c041f5f99655af74812c3ab75cc4346 Author: NeilBrown Date: Mon Dec 3 11:30:30 2018 +1100 cred: add get_cred_rcu() Sometimes we want to opportunistically get a ref to a cred in an rcu_read_lock protected section. get_task_cred() does this, and NFS does as similar thing with its own credential structures. To prepare for NFS converting to use 'struct cred' more uniformly, define get_cred_rcu(), and use it in get_task_cred(). Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker include/linux/cred.h | 11 +++++++++++ kernel/cred.c | 2 +- 2 files changed, 12 insertions(+), 1 deletion(-) commit d89b22d46a40da3a1630ecea111beaf3ef10bc21 Author: NeilBrown Date: Mon Dec 3 11:30:30 2018 +1100 cred: add cred_fscmp() for comparing creds. NFS needs to compare to credentials, to see if they can be treated the same w.r.t. filesystem access. Sometimes an ordering is needed when credentials are used as a key to an rbtree. NFS currently has its own private credential management from before 'struct cred' existed. To move it over to more consistent use of 'struct cred' we need a comparison function. This patch adds that function. Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker include/linux/cred.h | 1 + kernel/cred.c | 55 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 56 insertions(+) commit 8e2e5b7c492639109b1137c286dbad529c2b35e1 Author: Ben Dooks Date: Wed Nov 28 15:05:58 2018 +0000 SUNRPC: allow /proc entries without CONFIG_SUNRPC_DEBUG If we want /proc/sys/sunrpc the current kernel also drags in other debug features which we don't really want. Instead, we should always show the following entries: /proc/sys/sunrpc/udp_slot_table_entries /proc/sys/sunrpc/tcp_slot_table_entries /proc/sys/sunrpc/tcp_max_slot_table_entries /proc/sys/sunrpc/min_resvport /proc/sys/sunrpc/max_resvport /proc/sys/sunrpc/tcp_fin_timeout Signed-off-by: Ben Dooks Signed-off-by: Thomas Preston Signed-off-by: Anna Schumaker net/sunrpc/xprtsock.c | 8 -------- 1 file changed, 8 deletions(-) commit ac0aa5e843ca06ae55886dbbd2a1032d9b78b6bc Author: Pavel Tikhomirov Date: Wed Nov 14 11:12:05 2018 +0300 nfs: fix comment to nfs_generic_pg_test which does the opposite Please see comment to filelayout_pg_test for reference. To: Trond Myklebust Cc: Anna Schumaker Cc: linux-nfs@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Pavel Tikhomirov Signed-off-by: Anna Schumaker fs/nfs/pagelist.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 069d5bf5ec2650cfabc4bea9f6d779094a80b400 Author: Olga Kornievskaia Date: Fri Oct 26 16:16:58 2018 -0400 NFSv4: cleanup remove unused nfs4_xdev_fs_type commit e8f25e6d6d19 "NFS: Remove the NFS v4 xdev mount function" removed the last use of this. Signed-off-by: Olga Kornievskaia Signed-off-by: Anna Schumaker fs/nfs/internal.h | 1 - 1 file changed, 1 deletion(-) commit c9e585ebdc28a334b8100e560c9aaad6d4525a6e Author: Doug Ledford Date: Wed Dec 19 13:43:17 2018 -0500 IB/mlx5: Fix compile issue when ODP disabled When CONFIG_INFINIBAND_ON_DEMAND_PAGING is not enabled, we were getting build failures for defined but not used code. Fix that. Fixes: 813e90b1aeaa ("IB/mlx5: Add advise_mr() support") Signed-off-by: Jason Gunthorpe Signed-off-by: Doug Ledford drivers/infiniband/hw/mlx5/mlx5_ib.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 308144ce8e51bb6f9bed0ff0e72e7864f5f405f3 Author: Andrei.Stefanescu@microchip.com Date: Mon Dec 17 11:44:59 2018 +0000 regulator: mcp16502: code cleanup This patch does the following: - align parameter with parenthesis - fix compile error If CONFIG_SUSPEND is not set the dummy pm_ops callbacks are named mcp16502_suspend and mcp16502_resume instead of mcp16502_suspend_noirq and mcp16502_resume_noirq. Excerpt from compile log (kbuild test robot): In file included from include/linux/device.h:23:0, from include/linux/gpio/driver.h:5, from include/asm-generic/gpio.h:13, from include/linux/gpio.h:62, from drivers/regulator/mcp16502.c:11: >> drivers/regulator/mcp16502.c:527:32: error: 'mcp16502_suspend_noirq' undeclared here (not in a function); did you mean 'mcp16502_suspend'? SET_NOIRQ_SYSTEM_SLEEP_PM_OPS(mcp16502_suspend_noirq, >> drivers/regulator/mcp16502.c:528:10: error: 'mcp16502_resume_noirq' undeclared here (not in a function); did you mean 'mcp16502_suspend_noirq'? mcp16502_resume_noirq) vim +527 drivers/regulator/mcp16502.c 524 525 #ifdef CONFIG_PM 526 static const struct dev_pm_ops mcp16502_pm_ops = { > 527 SET_NOIRQ_SYSTEM_SLEEP_PM_OPS(mcp16502_suspend_noirq, > 528 mcp16502_resume_noirq) 529 }; 530 #endif 531 static const struct i2c_device_id mcp16502_i2c_id[] = { 532 { "mcp16502", 0 }, 533 { } 534 }; 535 MODULE_DEVICE_TABLE(i2c, mcp16502_i2c_id); 536 Signed-off-by: Andrei Stefanescu Signed-off-by: Mark Brown drivers/regulator/mcp16502.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 58331d618bd9ced88a21a9b68c7743b84c2f4803 Merge: 9b268ebe25cd c82ea33ead18 Author: Mark Brown Date: Wed Dec 19 18:38:33 2018 +0000 Merge remote-tracking branch 'regmap/topic/irq' into regmap-next commit 9b268ebe25cd649c8760c19dc8b7bda606bfba22 Merge: 7566ec393f41 580d48573c43 Author: Mark Brown Date: Wed Dec 19 18:38:31 2018 +0000 Merge branch 'regmap-4.21' into regmap-next commit c82ea33ead18801605b236523f21e5c893c7c253 Author: Bartosz Golaszewski Date: Wed Dec 19 12:18:05 2018 +0100 regmap: irq: add an option to clear status registers on unmask Some interrupt controllers whose interrupts are acked on read will set the status bits for masked interrupts without changing the state of the IRQ line. Some chips have an additional "feature" where if those set bits are not cleared before unmasking their respective interrupts, the IRQ line will change the state and we'll interpret this as an interrupt although it actually fired when it was masked. Add a new field to the irq chip struct that tells the regmap irq chip code to always clear the status registers before actually changing the irq mask values. Signed-off-by: Bartosz Golaszewski Signed-off-by: Mark Brown drivers/base/regmap/regmap-irq.c | 23 +++++++++++++++++++++++ include/linux/regmap.h | 4 ++++ 2 files changed, 27 insertions(+) commit 8239d5790481bf2e4e09e202bfd4a8a5ea8ca3a1 Merge: 7b98f63ea777 610febc68ab7 Author: David S. Miller Date: Wed Dec 19 10:37:23 2018 -0800 Merge branch 'dpaa2-eth-add-QBMAN-statistics' Ioana Ciornei says: ==================== dpaa2-eth: add QBMAN statistics This patch set adds ethtool statistics for pending frames/bytes in Rx/Tx conf FQs and number of buffers in pool. The first patch adds support for the query APIs in the DPIO driver while the latter actually exposes the statistics through ethtool. ==================== Signed-off-by: David S. Miller commit 610febc68ab79863eccaf829946a3d9278666772 Author: Ioana Radulescu Date: Tue Dec 18 15:23:01 2018 +0000 dpaa2-eth: Add QBMAN related stats Add statistics for pending frames in Rx/Tx conf FQs and number of buffers in pool. Available through ethtool -S. Signed-off-by: Ioana Radulescu Signed-off-by: Ioana ciornei Signed-off-by: David S. Miller .../net/ethernet/freescale/dpaa2/dpaa2-ethtool.c | 41 ++++++++++++++++++++++ 1 file changed, 41 insertions(+) commit e80081c34b03587cf6e89c0a1ea16c71b40bccca Author: Roy Pledge Date: Tue Dec 18 15:23:01 2018 +0000 soc: fsl: dpio: Add BP and FQ query APIs Add FQ (Frame Queue) and BP (Buffer Pool) query APIs that users of QBMan can invoke to see the status of the queues and pools that they are using. Signed-off-by: Roy Pledge Signed-off-by: Ioana Radulescu Signed-off-by: Ioana Ciornei Signed-off-by: David S. Miller drivers/soc/fsl/dpio/dpio-service.c | 68 ++++++++++++++++++++++++++ drivers/soc/fsl/dpio/qbman-portal.c | 96 +++++++++++++++++++++++++++++++++++++ drivers/soc/fsl/dpio/qbman-portal.h | 58 ++++++++++++++++++++++ include/soc/fsl/dpaa2-io.h | 4 ++ 4 files changed, 226 insertions(+) commit 1c2928e3e3212252b505b746ec10951027a95813 Author: Matti Vaittinen Date: Tue Dec 18 13:59:31 2018 +0200 regmap: regmap-irq/gpio-max77620: add level-irq support Add level active IRQ support to regmap-irq irqchip. Change breaks existing regmap-irq type setting. Convert the existing drivers which use regmap-irq with trigger type setting (gpio-max77620) to work with this new approach. So we do not magically support level-active IRQs on gpio-max77620 - but add support to the regmap-irq for chips which support them =) We do not support distinguishing situation where HW supports rising and falling edge detection but not both. Separating this would require inventing yet another flags for IRQ types. Signed-off-by: Matti Vaittinen Signed-off-by: Mark Brown drivers/base/regmap/regmap-irq.c | 35 ++++++++++----- drivers/gpio/gpio-max77620.c | 96 ++++++++++++++++++++++++++-------------- include/linux/regmap.h | 27 ++++++++--- 3 files changed, 110 insertions(+), 48 deletions(-) commit 7b98f63ea777d90abaca41beadf71e3f62d180e0 Author: Raju Lakkaraju Date: Tue Dec 18 14:57:56 2018 +0530 net: phy: mscc: Fix the VSC 8531/41 Chip Init sequence - Turn on Broadcast writes - UNH 1.8.1 clear bias for UNH 1000BT distortion - UNH 1.8.7 optimize pre-emphasis for 100BasTx UNH 100W fix - Enable Token-ring during 'Coma Mode' Signed-off-by: Raju Lakkaraju Signed-off-by: David S. Miller drivers/net/phy/mscc.c | 55 +++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 54 insertions(+), 1 deletion(-) commit 78e6fbf321a9b4cb46b17d83f25abcd318859c70 Author: Wei Yongjun Date: Tue Dec 18 07:10:21 2018 +0000 regulator: act8945a-regulator: make symbol act8945a_pm static Fixes the following sparse warning: drivers/regulator/act8945a-regulator.c:340:1: warning: symbol 'act8945a_pm' was not declared. Should it be static? Fixes: 7482d6ecc68e ("regulator: act8945a-regulator: Implement PM functionalities") Signed-off-by: Wei Yongjun Signed-off-by: Mark Brown drivers/regulator/act8945a-regulator.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 84267d1b18abee0c141553396f52a23db71660d3 Author: Matti Vaittinen Date: Tue Dec 18 12:58:13 2018 +0200 regmap: regmap-irq: Remove default irq type setting from core The common code should not set IRQ type. Read HW defaults to the cache at startup instead of forcing type to EDGE_BOTH. If default setting is needed this should be done via normal mechanisms or by chip specific code if normal mechanisms are not suitable for some reason. Common regmap-irq code should not have defaults hard-coded but keep the HW/boot defaults untouched. Signed-off-by: Matti Vaittinen Tested-by: Bartosz Golaszewski Signed-off-by: Mark Brown drivers/base/regmap/regmap-irq.c | 22 ++++++++-------------- 1 file changed, 8 insertions(+), 14 deletions(-) commit 8c33df1afd86c611da8473dc6fc5f3af3dabe984 Author: Marc Zyngier Date: Wed Dec 19 08:31:54 2018 +0000 arm: KVM: Add S2_PMD_{MASK,SIZE} constants They were missing, and it turns out that we do need them now. Acked-by: Christoffer Dall Signed-off-by: Marc Zyngier arch/arm/include/asm/stage2_pgtable.h | 3 +++ 1 file changed, 3 insertions(+) commit 58466766cd35754a061414c0c93225db2962948e Author: Marc Zyngier Date: Wed Dec 19 08:28:38 2018 +0000 arm/arm64: KVM: Add ARM_EXCEPTION_IS_TRAP macro 32 and 64bit use different symbols to identify the traps. 32bit has a fine grained approach (prefetch abort, data abort and HVC), while 64bit is pretty happy with just "trap". This has been fine so far, except that we now need to decode some of that in tracepoints that are common to both architectures. Introduce ARM_EXCEPTION_IS_TRAP which abstracts the trap symbols and make the tracepoint use it. Acked-by: Christoffer Dall Signed-off-by: Marc Zyngier arch/arm/include/asm/kvm_asm.h | 4 ++++ arch/arm64/include/asm/kvm_asm.h | 1 + virt/kvm/arm/trace.h | 2 +- 3 files changed, 6 insertions(+), 1 deletion(-) commit df655b75c43fba0f2621680ab261083297fd6d16 Author: Will Deacon Date: Thu Dec 13 16:06:14 2018 +0000 arm64: KVM: Avoid setting the upper 32 bits of VTCR_EL2 to 1 Although bit 31 of VTCR_EL2 is RES1, we inadvertently end up setting all of the upper 32 bits to 1 as well because we define VTCR_EL2_RES1 as signed, which is sign-extended when assigning to kvm->arch.vtcr. Lucky for us, the architecture currently treats these upper bits as RES0 so, whilst we've been naughty, we haven't set fire to anything yet. Cc: Cc: Marc Zyngier Cc: Christoffer Dall Signed-off-by: Will Deacon Signed-off-by: Marc Zyngier arch/arm64/include/asm/kvm_arm.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6794ad5443a2118243e13879f94228524a1a2b92 Author: Christoffer Dall Date: Fri Nov 2 08:53:22 2018 +0100 KVM: arm/arm64: Fix unintended stage 2 PMD mappings There are two things we need to take care of when we create block mappings in the stage 2 page tables: (1) The alignment within a PMD between the host address range and the guest IPA range must be the same, since otherwise we end up mapping pages with the wrong offset. (2) The head and tail of a memory slot may not cover a full block size, and we have to take care to not map those with block descriptors, since we could expose memory to the guest that the host did not intend to expose. So far, we have been taking care of (1), but not (2), and our commentary describing (1) was somewhat confusing. This commit attempts to factor out the checks of both into a common function, and if we don't pass the check, we won't attempt any PMD mappings for neither hugetlbfs nor THP. Note that we used to only check the alignment for THP, not for hugetlbfs, but as far as I can tell the check needs to be applied to both scenarios. Cc: Ralph Palutke Cc: Lukas Braun Reported-by: Lukas Braun Signed-off-by: Christoffer Dall Signed-off-by: Marc Zyngier virt/kvm/arm/mmu.c | 86 ++++++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 64 insertions(+), 22 deletions(-) commit 107352a24900fb458152b92a4e72fbdc83fd5510 Author: Marc Zyngier Date: Tue Dec 18 14:59:09 2018 +0000 arm/arm64: KVM: vgic: Force VM halt when changing the active state of GICv3 PPIs/SGIs We currently only halt the guest when a vCPU messes with the active state of an SPI. This is perfectly fine for GICv2, but isn't enough for GICv3, where all vCPUs can access the state of any other vCPU. Let's broaden the condition to include any GICv3 interrupt that has an active state (i.e. all but LPIs). Cc: stable@vger.kernel.org Reviewed-by: Christoffer Dall Signed-off-by: Marc Zyngier virt/kvm/arm/vgic/vgic-mmio.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 599d79dcd18fa0f88ae15b7042c9d6b011a678b2 Author: Marc Zyngier Date: Tue Dec 4 10:44:22 2018 +0000 arm64: KVM: Add trapped system register access tracepoint We're pretty blind when it comes to system register tracing, and rely on the ESR value displayed by kvm_handle_sys, which isn't much. Instead, let's add an actual name to the sysreg entries, so that we can finally print it as we're about to perform the access itself. The new tracepoint is conveniently called kvm_sys_access. Signed-off-by: Marc Zyngier arch/arm64/kvm/sys_regs.c | 2 ++ arch/arm64/kvm/sys_regs.h | 4 ++++ arch/arm64/kvm/trace.h | 35 +++++++++++++++++++++++++++++++++++ 3 files changed, 41 insertions(+) commit da6f16662a6eba3de0d1a39f3b8913d38754bb2b Author: Christoffer Dall Date: Thu Nov 29 12:20:01 2018 +0100 KVM: arm64: Make vcpu const in vcpu_read_sys_reg vcpu_read_sys_reg should not be modifying the VCPU structure. Eventually, to handle EL2 sysregs for nested virtualization, we will call vcpu_read_sys_reg from places that have a const vcpu pointer, which will complain about the lack of the const modifier on the read path. Signed-off-by: Christoffer Dall Signed-off-by: Marc Zyngier arch/arm64/include/asm/kvm_host.h | 2 +- arch/arm64/kvm/sys_regs.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 6e14ef1d12dc26ab4f6bef9d47e6906002f0a1ba Author: Christoffer Dall Date: Tue Dec 11 09:54:11 2018 +0100 KVM: arm/arm64: arch_timer: Simplify kvm_timer_vcpu_terminate kvm_timer_vcpu_terminate can only be called in two scenarios: 1. As part of cleanup during a failed VCPU create 2. As part of freeing the whole VM (struct kvm refcount == 0) In the first case, we cannot have programmed any timers or mapped any IRQs, and therefore we do not have to cancel anything or unmap anything. In the second case, the VCPU will have gone through kvm_timer_vcpu_put, which will have canceled the emulated physical timer's hrtimer, and we do not need to that here as well. We also do not care if the irq is recorded as mapped or not in the VGIC data structure, because the whole VM is going away. That leaves us only with having to ensure that we cancel the bg_timer if we were blocking the last time we called kvm_timer_vcpu_put(). Signed-off-by: Christoffer Dall Signed-off-by: Marc Zyngier virt/kvm/arm/arch_timer.c | 3 --- 1 file changed, 3 deletions(-) commit 8a411b060f820140e9894239fde5819bb213bef0 Author: Christoffer Dall Date: Tue Nov 27 13:48:08 2018 +0100 KVM: arm/arm64: Remove arch timer workqueue The use of a work queue in the hrtimer expire function for the bg_timer is a leftover from the time when we would inject interrupts when the bg_timer expired. Since we are no longer doing that, we can instead call kvm_vcpu_wake_up() directly from the hrtimer function and remove all workqueue functionality from the arch timer code. Signed-off-by: Marc Zyngier Signed-off-by: Christoffer Dall Signed-off-by: Marc Zyngier include/kvm/arm_arch_timer.h | 4 ---- virt/kvm/arm/arch_timer.c | 34 +++++++--------------------------- 2 files changed, 7 insertions(+), 31 deletions(-) commit 71a7e47f39a2fb971ef9934e98ba089581eff641 Author: Christoffer Dall Date: Mon Dec 3 21:31:24 2018 +0100 KVM: arm/arm64: Fixup the kvm_exit tracepoint The kvm_exit tracepoint strangely always reported exits as being IRQs. This seems to be because either the __print_symbolic or the tracepoint macros use a variable named idx. Take this chance to update the fields in the tracepoint to reflect the concepts in the arm64 architecture that we pass to the tracepoint and move the exception type table to the same location and header files as the exits code. We also clear out the exception code to 0 for IRQ exits (which translates to UNKNOWN in text) to make it slighyly less confusing to parse the trace output. Signed-off-by: Christoffer Dall Signed-off-by: Marc Zyngier arch/arm64/include/asm/kvm_arm.h | 4 ---- arch/arm64/include/asm/kvm_asm.h | 6 ++++++ virt/kvm/arm/trace.h | 18 +++++++++--------- 3 files changed, 15 insertions(+), 13 deletions(-) commit 9009782a4937ad0f4a4be6945080d7fa77fa4092 Author: Christoffer Dall Date: Sat Dec 1 13:21:47 2018 -0800 KVM: arm/arm64: vgic: Consider priority and active state for pending irq When checking if there are any pending IRQs for the VM, consider the active state and priority of the IRQs as well. Otherwise we could be continuously scheduling a guest hypervisor without it seeing an IRQ. Signed-off-by: Christoffer Dall Signed-off-by: Marc Zyngier virt/kvm/arm/vgic/vgic.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit c23b2e6fc4ca346018618266bcabd335c0a8a49e Author: Gustavo A. R. Silva Date: Wed Dec 12 14:11:23 2018 -0600 KVM: arm/arm64: vgic: Fix off-by-one bug in vgic_get_irq() When using the nospec API, it should be taken into account that: "...if the CPU speculates past the bounds check then * array_index_nospec() will clamp the index within the range of [0, * size)." The above is part of the header for macro array_index_nospec() in linux/nospec.h Now, in this particular case, if intid evaluates to exactly VGIC_MAX_SPI or to exaclty VGIC_MAX_PRIVATE, the array_index_nospec() macro ends up returning VGIC_MAX_SPI - 1 or VGIC_MAX_PRIVATE - 1 respectively, instead of VGIC_MAX_SPI or VGIC_MAX_PRIVATE, which, based on the original logic: /* SGIs and PPIs */ if (intid <= VGIC_MAX_PRIVATE) return &vcpu->arch.vgic_cpu.private_irqs[intid]; /* SPIs */ if (intid <= VGIC_MAX_SPI) return &kvm->arch.vgic.spis[intid - VGIC_NR_PRIVATE_IRQS]; are valid values for intid. Fix this by calling array_index_nospec() macro with VGIC_MAX_PRIVATE + 1 and VGIC_MAX_SPI + 1 as arguments for its parameter size. Fixes: 41b87599c743 ("KVM: arm/arm64: vgic: fix possible spectre-v1 in vgic_get_irq()") Cc: stable@vger.kernel.org Signed-off-by: Gustavo A. R. Silva [dropped the SPI part which was fixed separately] Signed-off-by: Marc Zyngier virt/kvm/arm/vgic/vgic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8a363970d1dc38c4ec4ad575c862f776f468d057 Author: Theodore Ts'o Date: Wed Dec 19 12:29:13 2018 -0500 ext4: avoid declaring fs inconsistent due to invalid file handles If we receive a file handle, either from NFS or open_by_handle_at(2), and it points at an inode which has not been initialized, and the file system has metadata checksums enabled, we shouldn't try to get the inode, discover the checksum is invalid, and then declare the file system as being inconsistent. This can be reproduced by creating a test file system via "mke2fs -t ext4 -O metadata_csum /tmp/foo.img 8M", mounting it, cd'ing into that directory, and then running the following program. #define _GNU_SOURCE #include struct handle { struct file_handle fh; unsigned char fid[MAX_HANDLE_SZ]; }; int main(int argc, char **argv) { struct handle h = {{8, 1 }, { 12, }}; open_by_handle_at(AT_FDCWD, &h.fh, O_RDONLY); return 0; } Google-Bug-Id: 120690101 Signed-off-by: Theodore Ts'o Cc: stable@kernel.org fs/ext4/ext4.h | 15 +++++++++++++-- fs/ext4/ialloc.c | 2 +- fs/ext4/inode.c | 54 +++++++++++++++++++++++++++++++++++++----------------- fs/ext4/ioctl.c | 2 +- fs/ext4/namei.c | 4 ++-- fs/ext4/resize.c | 5 +++-- fs/ext4/super.c | 19 +++++-------------- fs/ext4/xattr.c | 5 +++-- 8 files changed, 65 insertions(+), 41 deletions(-) commit a805622a757b6d7f65def4141d29317d8e37b8a1 Author: Theodore Ts'o Date: Wed Dec 19 12:28:13 2018 -0500 ext4: include terminating u32 in size of xattr entries when expanding inodes In ext4_expand_extra_isize_ea(), we calculate the total size of the xattr header, plus the xattr entries so we know how much of the beginning part of the xattrs to move when expanding the inode extra size. We need to include the terminating u32 at the end of the xattr entries, or else if there is uninitialized, non-zero bytes after the xattr entries and before the xattr values, the list of xattr entries won't be properly terminated. Reported-by: Steve Graham Signed-off-by: Theodore Ts'o Cc: stable@kernel.org fs/ext4/xattr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d82b51c855a20eb456ac09f2f40ea98312373263 Author: Pierre-Louis Bossart Date: Sat Dec 15 14:07:23 2018 -0600 ALSA: HD-Audio: SKL+: force HDaudio legacy or SKL+ driver selection For HDaudio and Skylake drivers, add module parameter "pci_binding" When pci_binding == 0 (AUTO), the PCI class/subclass info is used to select drivers based on the presence of the DSP. pci_binding == 1 (LEGACY) forces the use of the HDAudio legacy driver, even if the DSP is present. pci_binding == 2 (ASOC) forces the use of the ASOC driver. The information on the DSP presence is bypassed. The value for the module parameter needs to be identical for both drivers. This parameter is intended as a back-up solution if the automatic detection fails or when the DSP usage fails. Such cases should be reported on the alsa-devel mailing list for analysis. Signed-off-by: Pierre-Louis Bossart Signed-off-by: Takashi Iwai include/sound/hdaudio.h | 6 ++++++ sound/pci/hda/hda_intel.c | 26 ++++++++++++++++++++--- sound/soc/intel/skylake/skl.c | 48 +++++++++++++++++++++++++++++-------------- 3 files changed, 62 insertions(+), 18 deletions(-) commit c337104b1a16becc486fdc95d544c835b17021db Author: Pierre-Louis Bossart Date: Sat Dec 15 14:07:22 2018 -0600 ALSA: HD-Audio: SKL+: abort probe if DSP is present and Skylake driver selected Now that the SST/Skylake driver supports per platform selectors, we can add logic to automatically select the right driver. If the Skylake driver is selected for a specific platform, and the DSP is detected at run-time based on the PCI class/subclass/prog-if information, the legacy HDaudio driver aborts the probe. This will result in a single driver probing and remove the need for modprobe blacklists. Follow-up patches will add a module parameter to bypass the logic if this automatic detection fails, or if the Skylake driver is unable to actually support the platform (firmware authentication, missing topology file, hardware issue, etc). The same mechanism will be used to conflicts generated by the same PCI ID being registered by both legacy HDAuudio and SOF drivers for Intel platforms. In other words SOF will not require changes to the HDaudio legacy. Signed-off-by: Pierre-Louis Bossart Signed-off-by: Takashi Iwai sound/pci/hda/Kconfig | 62 ++++++++++++++++++++++++++++++++++++++++++ sound/pci/hda/hda_controller.h | 2 +- sound/pci/hda/hda_intel.c | 34 ++++++++++++++++++----- sound/soc/intel/Kconfig | 6 ++++ 4 files changed, 96 insertions(+), 8 deletions(-) commit 18d43c9b88eb335440c5e769eb6c2d5bc908dc61 Author: Keyon Jie Date: Tue Dec 11 15:30:27 2018 -0600 ALSA: HDA: export process_unsol_events() The SOF implementation does not rely on the hdac_bus library, however for HDMI and HDaudio codec support it does need to deal with unsolicited events. Instead of re-inventing the wheel, export this symbol to reuse this part of the library directly. Signed-off-by: Keyon Jie Signed-off-by: Pierre-Louis Bossart Signed-off-by: Takashi Iwai include/sound/hdaudio.h | 1 + sound/hda/hdac_bus.c | 7 +++---- 2 files changed, 4 insertions(+), 4 deletions(-) commit 6c503d0d88db9d57c1dc4c87175c94766b6a6c61 Author: Christoph Hellwig Date: Sun Dec 16 10:23:28 2018 +0100 sparc/iommu: fix ->map_sg return value Just decrementing the sz value will lead to an incorrect return value. Instead of just introducing a local variable switch to the standard for_each_sg helper and standard naming of the arguments. Fixes: ce65d36f3e ("sparc: remove the sparc32_dma_ops indirection") Reported-by: Guenter Roeck Signed-off-by: Christoph Hellwig Acked-by: Sam Ravnborg arch/sparc/mm/iommu.c | 39 ++++++++++++++++++--------------------- 1 file changed, 18 insertions(+), 21 deletions(-) commit 1e2934ad7f93476e92039d4b8914d9f71789448f Author: Christoph Hellwig Date: Sun Dec 16 10:20:04 2018 +0100 sparc/io-unit: fix ->map_sg return value Just decrementing the sz value will lead to an incorrect return value. Instead of just introducing a local variable switch to the standard for_each_sg helper and standard naming of the arguments. Fixes: ce65d36f3e ("sparc: remove the sparc32_dma_ops indirection") Reported-by: Guenter Roeck Signed-off-by: Christoph Hellwig Acked-by: Sam Ravnborg arch/sparc/mm/io-unit.c | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-) commit 9ab91e7c5c514b675470d9b57393cbe455722060 Author: Christoph Hellwig Date: Fri Dec 14 15:18:08 2018 +0100 arm64: default to the direct mapping in get_arch_dma_ops Otherwise the direct mapping won't work at all given that a NULL dev->dma_ops causes a fallback. Note that we already explicitly set dev->dma_ops to dma_dummy_ops for dma-incapable devices, so this fallback should not be needed anyway. Fixes: 356da6d0cd ("dma-mapping: bypass indirect calls for dma-direct") Signed-off-by: Christoph Hellwig Reported-by: Marek Szyprowski Tested-by: Marek Szyprowski Reviewed-by: Robin Murphy arch/arm64/include/asm/dma-mapping.h | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) commit 2b3c5a99d5f314960e00950c1782eac9361de30f Author: Firoz Khan Date: Wed Nov 14 10:02:10 2018 +0530 sh: generate uapi header and syscall table header files System call table generation script must be run to gener- ate unistd_32.h and syscall_table.h files. This patch will have changes which will invokes the script. This patch will generate unistd_32.h and syscall_table.h files by the syscall table generation script invoked by sh/Makefile and the generated files against the removed files must be identical. The generated uapi header file will be included in uapi/- asm/unistd.h and generated system call table header file will be included by kernel/syscall_32.S file. Signed-off-by: Firoz Khan Signed-off-by: Arnd Bergmann arch/sh/Makefile | 3 + arch/sh/include/asm/Kbuild | 1 + arch/sh/include/uapi/asm/Kbuild | 1 + arch/sh/kernel/syscalls_32.S | 387 +--------------------------------------- 4 files changed, 8 insertions(+), 384 deletions(-) commit a0239c8eb9363d4c2c6d6411bff4e3ea744e3164 Author: Firoz Khan Date: Thu Nov 1 19:18:49 2018 +0530 sh: add system call table generation support The system call tables are in different format in all architecture and it will be difficult to manually add, modify or delete the syscall table entries in the res- pective files. To make it easy by keeping a script and which will generate the uapi header and syscall table file. This change will also help to unify the implemen- tation across all architectures. The system call table generation script is added in kernel/syscalls directory which contain the scripts to generate both uapi header file and system call table files. The syscall.tbl will be input for the scripts. syscall.tbl contains the list of available system calls along with system call number and corresponding entry point. Add a new system call in this architecture will be possible by adding new entry in the syscall.tbl file. Adding a new table entry consisting of: - System call number. - ABI. - System call name. - Entry point name. syscallhdr.sh and syscalltbl.sh will generate uapi header unistd_32.h and syscall_table.h files respectively. Both .sh files will parse the content syscall.tbl to generate the header and table files. unistd_32.h will be included by uapi/asm/unistd.h and syscall_table.h is included by kernel/syscall_32.S - the real system call table. Please note, this support is only available for 32-bit kernel, not 64-bit kernel. As I came across the 64-bit kernel is not active for long time. ARM, s390 and x86 architecuture does have similar support. I leverage their implementation to come up with a generic solution. Signed-off-by: Firoz Khan Signed-off-by: Arnd Bergmann arch/sh/kernel/syscalls/Makefile | 38 ++++ arch/sh/kernel/syscalls/syscall.tbl | 392 ++++++++++++++++++++++++++++++++++ arch/sh/kernel/syscalls/syscallhdr.sh | 36 ++++ arch/sh/kernel/syscalls/syscalltbl.sh | 32 +++ 4 files changed, 498 insertions(+) commit 8a79633b4928cbb7cb575aa62dda0c49d37c2387 Author: Firoz Khan Date: Wed Nov 14 10:02:08 2018 +0530 sh: add __NR_syscalls along with NR_syscalls NR_syscalls macro holds the number of system call exist in sh architecture. We have to change the value of NR- _syscalls, if we add or delete a system call. One of the patch in this patch series has a script which will generate a uapi header based on syscall.tbl file. The syscall.tbl file contains the total number of system calls information. So we have two option to update NR_sy- scalls value. 1. Update NR_syscalls in asm/unistd.h manually by count- ing the no.of system calls. No need to update NR_sys- calls until we either add a new system call or delete existing system call. 2. We can keep this feature it above mentioned script, that will count the number of syscalls and keep it in a generated file. In this case we don't need to expli- citly update NR_syscalls in asm/unistd.h file. The 2nd option will be the recommended one. For that, I added the __NR_syscalls macro in uapi/asm/unistd_32/64.h along with NR_syscalls which is moved to asm/unistd.h. The macro __NR_syscalls also added for making the name convention same across all architecture. While __NR_sys- calls isn't strictly part of the uapi, having it as part of the generated header to simplifies the implementation. We also need to enclose this macro with #ifdef __KERNEL__ to avoid side effects. Signed-off-by: Firoz Khan Signed-off-by: Arnd Bergmann arch/sh/include/asm/unistd.h | 2 ++ arch/sh/include/uapi/asm/unistd_32.h | 4 +++- arch/sh/include/uapi/asm/unistd_64.h | 4 +++- 3 files changed, 8 insertions(+), 2 deletions(-) commit 29d3c047b7038d7efce4f279e4d4165d69f6ccb9 Merge: 5a862f86b8e8 1629db9c7534 Author: David S. Miller Date: Wed Dec 19 08:41:45 2018 -0800 Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next Johan Hedberg says: ==================== pull request: bluetooth-next 2018-12-19 Here's the main bluetooth-next pull request for 4.21: - Multiple fixes & improvements for Broadcom-based controllers - New USB ID for an Intel controller - Support for new Broadcom controller variants - Use DEFINE_SHOW_ATTRIBUTE to simplify debugfs code - Eliminate confusing "last event is not cmd complete" warning message - Added vendor suspend/resume support for H:5 (3-Wire UART) controllers - Various other smaller improvements & fixes Please let me know if there are any issues pulling. Thanks. ==================== Signed-off-by: David S. Miller commit 5a862f86b8e86562fc8532160c5530a13e1e944b Merge: 33f18c96afdf d359bbce0601 Author: David S. Miller Date: Wed Dec 19 08:36:18 2018 -0800 Merge tag 'mac80211-next-for-davem-2018-12-19' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next Johannes Berg says: ==================== This time we have too many changes to list, highlights: * virt_wifi - wireless control simulation on top of another network interface * hwsim configurability to test capabilities similar to real hardware * various mesh improvements * various radiotap vendor data fixes in mac80211 * finally the nl_set_extack_cookie_u64() we talked about previously, used for * peer measurement APIs, right now only with FTM (flight time measurement) for location * made nl80211 radio/interface announcements more complete * various new HE (802.11ax) things: updates, TWT support, ... ==================== Signed-off-by: David S. Miller commit 3a762de55b4ede47a5369f57d0f92979738be638 Author: Ming Lei Date: Thu Dec 20 00:29:15 2018 +0800 block: save irq state in blkg_lookup_create() blkg_lookup_create() may be called from pool_map() in which irq state is saved, so we have to do that in blkg_lookup_create(). Otherwise, the following lockdep warning can be triggered: [ 104.258537] ================================ [ 104.259129] WARNING: inconsistent lock state [ 104.259725] 4.20.0-rc6+ #545 Not tainted [ 104.260268] -------------------------------- [ 104.260865] inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. [ 104.261727] swapper/49/0 [HC0[0]:SC1[1]:HE0:SE0] takes: [ 104.262444] 00000000db365b5d (&(&pool->lock)->rlock#3){+.?.}, at: thin_endio+0xcf/0x2a3 [dm_thin_pool] [ 104.263747] {SOFTIRQ-ON-W} state was registered at: [ 104.264417] _raw_spin_unlock_irq+0x29/0x4c [ 104.265014] blkg_lookup_create+0xdc/0xe6 [ 104.265609] bio_associate_blkg_from_css+0xd3/0x13f [ 104.266312] bio_associate_blkg+0x15a/0x1bb [ 104.266913] pool_map+0xe8/0x103 [dm_thin_pool] [ 104.267572] __map_bio+0x98/0x29c [dm_mod] [ 104.268162] __split_and_process_non_flush+0x29e/0x306 [dm_mod] [ 104.269003] __split_and_process_bio+0x16a/0x25b [dm_mod] [ 104.269971] __dm_make_request.isra.14+0xdc/0x124 [dm_mod] [ 104.270973] generic_make_request+0x3f5/0x68b [ 104.271676] process_prepared_mapping+0x166/0x1ef [dm_thin_pool] [ 104.272531] schedule_zero+0x239/0x273 [dm_thin_pool] [ 104.273245] process_cell+0x60c/0x6f1 [dm_thin_pool] [ 104.273967] do_worker+0x60c/0xca8 [dm_thin_pool] [ 104.274635] process_one_work+0x4eb/0x834 [ 104.275203] worker_thread+0x318/0x484 [ 104.275740] kthread+0x1d1/0x1e1 [ 104.276203] ret_from_fork+0x3a/0x50 [ 104.276714] irq event stamp: 170003 [ 104.277201] hardirqs last enabled at (170002): [] _raw_spin_unlock_irqrestore+0x44/0x6b [ 104.278535] hardirqs last disabled at (170003): [] _raw_spin_lock_irqsave+0x20/0x55 [ 104.280273] softirqs last enabled at (169978): [] irq_enter+0x4c/0x73 [ 104.281617] softirqs last disabled at (169979): [] irq_exit+0x7e/0x11d [ 104.282744] [ 104.282744] other info that might help us debug this: [ 104.283640] Possible unsafe locking scenario: [ 104.283640] [ 104.284452] CPU0 [ 104.284803] ---- [ 104.285150] lock(&(&pool->lock)->rlock#3); [ 104.285762] [ 104.286130] lock(&(&pool->lock)->rlock#3); [ 104.286750] [ 104.286750] *** DEADLOCK *** [ 104.286750] [ 104.287564] no locks held by swapper/49/0. [ 104.288129] [ 104.288129] stack backtrace: [ 104.288738] CPU: 49 PID: 0 Comm: swapper/49 Not tainted 4.20.0-rc6+ #545 [ 104.289700] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.10.2-2.fc27 04/01/2014 [ 104.290858] Call Trace: [ 104.291204] [ 104.291502] dump_stack+0x9a/0xe6 [ 104.291968] mark_lock+0x56c/0x7a6 [ 104.292442] ? check_usage_backwards+0x209/0x209 [ 104.293086] __lock_acquire+0x400/0x15bf [ 104.293662] ? check_chain_key+0x150/0x1aa [ 104.294236] lock_acquire+0x1a6/0x1e3 [ 104.294768] ? thin_endio+0xcf/0x2a3 [dm_thin_pool] [ 104.295444] ? _raw_spin_unlock_irqrestore+0x44/0x6b [ 104.296143] ? process_prepared_discard_fail+0x36/0x36 [dm_thin_pool] [ 104.297031] _raw_spin_lock_irqsave+0x46/0x55 [ 104.297659] ? thin_endio+0xcf/0x2a3 [dm_thin_pool] [ 104.298335] thin_endio+0xcf/0x2a3 [dm_thin_pool] [ 104.298997] ? process_prepared_discard_fail+0x36/0x36 [dm_thin_pool] [ 104.299886] ? check_flags+0x20a/0x20a [ 104.300408] ? lock_acquire+0x1a6/0x1e3 [ 104.300954] ? process_prepared_discard_fail+0x36/0x36 [dm_thin_pool] [ 104.301865] clone_endio+0x1bb/0x22d [dm_mod] [ 104.302491] ? disable_write_zeroes+0x20/0x20 [dm_mod] [ 104.303200] ? bio_disassociate_blkg+0xc6/0x15f [ 104.303836] ? bio_endio+0x2b2/0x2da [ 104.304349] clone_endio+0x1f3/0x22d [dm_mod] [ 104.304978] ? disable_write_zeroes+0x20/0x20 [dm_mod] [ 104.305709] ? bio_disassociate_blkg+0xc6/0x15f [ 104.306333] ? bio_endio+0x2b2/0x2da [ 104.306853] clone_endio+0x1f3/0x22d [dm_mod] [ 104.307476] ? disable_write_zeroes+0x20/0x20 [dm_mod] [ 104.308185] ? bio_disassociate_blkg+0xc6/0x15f [ 104.308817] ? bio_endio+0x2b2/0x2da [ 104.309319] blk_update_request+0x2de/0x4cc [ 104.309927] blk_mq_end_request+0x2a/0x183 [ 104.310498] blk_done_softirq+0x16a/0x1a6 [ 104.311051] ? blk_softirq_cpu_dead+0xe2/0xe2 [ 104.311653] ? __lock_is_held+0x2a/0x87 [ 104.312186] __do_softirq+0x250/0x4e8 [ 104.312705] irq_exit+0x7e/0x11d [ 104.313157] call_function_single_interrupt+0xf/0x20 [ 104.313860] [ 104.314163] RIP: 0010:native_safe_halt+0x2/0x3 [ 104.314792] Code: 63 02 df f0 83 44 24 fc 00 48 89 df e8 cc 3f 7a ff 48 8b 03 a8 08 74 0b 65 81 25 9d 31 45 7e ff ff ff 7f 5b 5d 41 5c c3 fb f4 f4 c3 0f 1f 44 00 00 41 56 41 55 41 54 55 53 e8 a2 0d 5c ff e8 [ 104.317339] RSP: 0018:ffff888106c9fdc0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff04 [ 104.318390] RAX: 1ffff11020d92100 RBX: 0000000000000000 RCX: ffffffff81159ac7 [ 104.319366] RDX: 1ffffffff05d5e69 RSI: 0000000000000007 RDI: ffff888106c90d1c [ 104.320339] RBP: 0000000000000000 R08: dffffc0000000000 R09: 0000000000000001 [ 104.321313] R10: ffffed1025d57ba0 R11: ffffed1025d57b9f R12: 1ffff11020d93fbf [ 104.322328] R13: 0000000000000031 R14: ffff888106c90040 R15: 0000000000000000 [ 104.323307] ? lockdep_hardirqs_on+0x26b/0x278 [ 104.323927] default_idle+0xd9/0x1a8 [ 104.324427] do_idle+0x162/0x2b2 [ 104.324891] ? arch_cpu_idle_exit+0x28/0x28 [ 104.325467] ? mark_held_locks+0x28/0x7f [ 104.326031] ? _raw_spin_unlock_irqrestore+0x44/0x6b [ 104.326719] cpu_startup_entry+0x1d/0x1f [ 104.327261] start_secondary+0x2cb/0x308 [ 104.327806] ? set_cpu_sibling_map+0x8a3/0x8a3 [ 104.328421] secondary_startup_64+0xa4/0xb0 Fixes: b978962ad4f7f9 ("blkcg: update blkg_lookup_create() to do locking") Cc: Mike Snitzer Cc: Dennis Zhou Signed-off-by: Ming Lei Signed-off-by: Jens Axboe block/blk-cgroup.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit dbe3ece1287dafe4113c64ada3113c39f344c64a Author: Jens Axboe Date: Wed Dec 19 09:13:34 2018 -0700 dm: don't reuse bio for flushes DM currently has a statically allocated bio that it uses to issue empty flushes. It doesn't submit this bio, it just uses it for maintaining state while setting up clones. Multiple users can access this bio at the same time. This wasn't previously an issue, even if it was a bit iffy, but with the blkg associations it can become one. We setup the blkg association, then clone bio's and submit, then remove the blkg assocation again. But since we can have multiple tasks doing this at the same time, against multiple blkg's, then we can either lose references to a blkg, or put it twice. The latter causes complaints on the percpu ref being <= 0 when released, and can cause use-after-free as well. Ming reports that xfstest generic/475 triggers this: ------------[ cut here ]------------ percpu ref (blkg_release) <= 0 (0) after switching to atomic WARNING: CPU: 13 PID: 0 at lib/percpu-refcount.c:155 percpu_ref_switch_to_atomic_rcu+0x2c9/0x4a0 Switch to just using an on-stack bio for this, and get rid of the embedded bio. Fixes: 5cdf2e3fea5e ("blkcg: associate blkg when associating a device") Reported-by: Ming Lei Tested-by: Ming Lei Reviewed-by: Mike Snitzer Signed-off-by: Jens Axboe drivers/md/dm-core.h | 3 --- drivers/md/dm.c | 35 +++++++++++++++++++++++++---------- 2 files changed, 25 insertions(+), 13 deletions(-) commit 499aeb45b2e225e423ef333ec68bd9b33a42c8be Merge: cd19181bf9ad 604c01d567cb Author: Jens Axboe Date: Wed Dec 19 08:08:41 2018 -0700 Merge branch 'nvme-4.21' of git://git.infradead.org/nvme into for-4.21/block Pull last batch of NVMe updates for 4.21 from Christoph: "This contains a series from Sagi to restore poll support for nvme-rdma, a new tracepoint from yupeng and various fixes." * 'nvme-4.21' of git://git.infradead.org/nvme: nvme-pci: trace SQ status on completions nvme-rdma: implement polling queue map nvme-fabrics: allow user to pass in nr_poll_queues nvme-fabrics: allow nvmf_connect_io_queue to poll nvme-core: optionally poll sync commands block: make request_to_qc_t public nvme-tcp: fix spelling mistake "attepmpt" -> "attempt" nvme-tcp: fix endianess annotations nvmet-tcp: fix endianess annotations nvme-pci: refactor nvme_poll_irqdisable to make sparse happy nvme-pci: only set nr_maps to 2 if poll queues are supported nvmet: use a macro for default error location nvmet: fix comparison of a u16 with -1 commit 57ce8ba0fd3a95bf29ed741df1c52bd591bf43ff Author: Geert Uytterhoeven Date: Mon Dec 3 13:20:47 2018 +0100 openrisc: Fix broken paths to arch/or32 OpenRISC was mainlined as "openrisc", not "or32". vmlinux.lds is generated from vmlinux.lds.S. Signed-off-by: Geert Uytterhoeven Signed-off-by: Stafford Horne arch/openrisc/kernel/entry.S | 2 +- arch/openrisc/kernel/head.S | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 4f4b374332ec0ae9c738ff8ec9bed5cd97ff9adc Author: Daniel Vetter Date: Wed Dec 19 13:39:09 2018 +0100 sysfs: Disable lockdep for driver bind/unbind files This is the much more correct fix for my earlier attempt at: https://lkml.org/lkml/2018/12/10/118 Short recap: - There's not actually a locking issue, it's just lockdep being a bit too eager to complain about a possible deadlock. - Contrary to what I claimed the real problem is recursion on kn->count. Greg pointed me at sysfs_break_active_protection(), used by the scsi subsystem to allow a sysfs file to unbind itself. That would be a real deadlock, which isn't what's happening here. Also, breaking the active protection means we'd need to manually handle all the lifetime fun. - With Rafael we discussed the task_work approach, which kinda works, but has two downsides: It's a functional change for a lockdep annotation issue, and it won't work for the bind file (which needs to get the errno from the driver load function back to userspace). - Greg also asked why this never showed up: To hit this you need to unregister a 2nd driver from the unload code of your first driver. I guess only gpus do that. The bug has always been there, but only with a recent patch series did we add more locks so that lockdep built a chain from unbinding the snd-hda driver to the acpi_video_unregister call. Full lockdep splat: [12301.898799] ============================================ [12301.898805] WARNING: possible recursive locking detected [12301.898811] 4.20.0-rc7+ #84 Not tainted [12301.898815] -------------------------------------------- [12301.898821] bash/5297 is trying to acquire lock: [12301.898826] 00000000f61c6093 (kn->count#39){++++}, at: kernfs_remove_by_name_ns+0x3b/0x80 [12301.898841] but task is already holding lock: [12301.898847] 000000005f634021 (kn->count#39){++++}, at: kernfs_fop_write+0xdc/0x190 [12301.898856] other info that might help us debug this: [12301.898862] Possible unsafe locking scenario: [12301.898867] CPU0 [12301.898870] ---- [12301.898874] lock(kn->count#39); [12301.898879] lock(kn->count#39); [12301.898883] *** DEADLOCK *** [12301.898891] May be due to missing lock nesting notation [12301.898899] 5 locks held by bash/5297: [12301.898903] #0: 00000000cd800e54 (sb_writers#4){.+.+}, at: vfs_write+0x17f/0x1b0 [12301.898915] #1: 000000000465e7c2 (&of->mutex){+.+.}, at: kernfs_fop_write+0xd3/0x190 [12301.898925] #2: 000000005f634021 (kn->count#39){++++}, at: kernfs_fop_write+0xdc/0x190 [12301.898936] #3: 00000000414ef7ac (&dev->mutex){....}, at: device_release_driver_internal+0x34/0x240 [12301.898950] #4: 000000003218fbdf (register_count_mutex){+.+.}, at: acpi_video_unregister+0xe/0x40 [12301.898960] stack backtrace: [12301.898968] CPU: 1 PID: 5297 Comm: bash Not tainted 4.20.0-rc7+ #84 [12301.898974] Hardware name: Hewlett-Packard HP EliteBook 8460p/161C, BIOS 68SCF Ver. F.01 03/11/2011 [12301.898982] Call Trace: [12301.898989] dump_stack+0x67/0x9b [12301.898997] __lock_acquire+0x6ad/0x1410 [12301.899003] ? kernfs_remove_by_name_ns+0x3b/0x80 [12301.899010] ? find_held_lock+0x2d/0x90 [12301.899017] ? mutex_spin_on_owner+0xe4/0x150 [12301.899023] ? find_held_lock+0x2d/0x90 [12301.899030] ? lock_acquire+0x90/0x180 [12301.899036] lock_acquire+0x90/0x180 [12301.899042] ? kernfs_remove_by_name_ns+0x3b/0x80 [12301.899049] __kernfs_remove+0x296/0x310 [12301.899055] ? kernfs_remove_by_name_ns+0x3b/0x80 [12301.899060] ? kernfs_name_hash+0xd/0x80 [12301.899066] ? kernfs_find_ns+0x6c/0x100 [12301.899073] kernfs_remove_by_name_ns+0x3b/0x80 [12301.899080] bus_remove_driver+0x92/0xa0 [12301.899085] acpi_video_unregister+0x24/0x40 [12301.899127] i915_driver_unload+0x42/0x130 [i915] [12301.899160] i915_pci_remove+0x19/0x30 [i915] [12301.899169] pci_device_remove+0x36/0xb0 [12301.899176] device_release_driver_internal+0x185/0x240 [12301.899183] unbind_store+0xaf/0x180 [12301.899189] kernfs_fop_write+0x104/0x190 [12301.899195] __vfs_write+0x31/0x180 [12301.899203] ? rcu_read_lock_sched_held+0x6f/0x80 [12301.899209] ? rcu_sync_lockdep_assert+0x29/0x50 [12301.899216] ? __sb_start_write+0x13c/0x1a0 [12301.899221] ? vfs_write+0x17f/0x1b0 [12301.899227] vfs_write+0xb9/0x1b0 [12301.899233] ksys_write+0x50/0xc0 [12301.899239] do_syscall_64+0x4b/0x180 [12301.899247] entry_SYSCALL_64_after_hwframe+0x49/0xbe [12301.899253] RIP: 0033:0x7f452ac7f7a4 [12301.899259] Code: 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 80 00 00 00 00 8b 05 aa f0 2c 00 48 63 ff 85 c0 75 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 f3 c3 66 90 55 53 48 89 d5 48 89 f3 48 83 [12301.899273] RSP: 002b:00007ffceafa6918 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [12301.899282] RAX: ffffffffffffffda RBX: 000000000000000d RCX: 00007f452ac7f7a4 [12301.899288] RDX: 000000000000000d RSI: 00005612a1abf7c0 RDI: 0000000000000001 [12301.899295] RBP: 00005612a1abf7c0 R08: 000000000000000a R09: 00005612a1c46730 [12301.899301] R10: 000000000000000a R11: 0000000000000246 R12: 000000000000000d [12301.899308] R13: 0000000000000001 R14: 00007f452af4a740 R15: 000000000000000d Looking around I've noticed that usb and i2c already handle similar recursion problems, where a sysfs file can unbind the same type of sysfs somewhere else in the hierarchy. Relevant commits are: commit 356c05d58af05d582e634b54b40050c73609617b Author: Alan Stern Date: Mon May 14 13:30:03 2012 -0400 sysfs: get rid of some lockdep false positives commit e9b526fe704812364bca07edd15eadeba163ebfb Author: Alexander Sverdlin Date: Fri May 17 14:56:35 2013 +0200 i2c: suppress lockdep warning on delete_device Implement the same trick for driver bind/unbind. v2: Put the macro into bus.c (Greg). Reviewed-by: Rafael J. Wysocki Cc: Ramalingam C Cc: Arend van Spriel Cc: Andy Shevchenko Cc: Geert Uytterhoeven Cc: Bartosz Golaszewski Cc: Heikki Krogerus Cc: Vivek Gautam Cc: Joe Perches Signed-off-by: Daniel Vetter Signed-off-by: Greg Kroah-Hartman drivers/base/bus.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit b30204640192234d18f9168f19f9cd693485b86d Author: Tom Roeder Date: Tue Dec 18 14:49:07 2018 -0800 scripts: add a tool to produce a compile_commands.json file The LLVM/Clang project provides many tools for analyzing C source code. Many of these tools are based on LibTooling (https://clang.llvm.org/docs/LibTooling.html), which depends on a database of compiler flags. The standard container for this database is compile_commands.json, which consists of a list of JSON objects, each with "directory", "file", and "command" fields. Some build systems, like cmake or bazel, produce this compilation information directly. Naturally, Makefiles don't. However, the kernel makefiles already create ..o.cmd files that contain all the information needed to build a compile_commands.json file. So, this commit adds scripts/gen_compile_commands.py, which recursively searches through a directory for ..o.cmd files and extracts appropriate compile commands from them. It writes a compile_commands.json file that LibTooling-based tools can use. By default, gen_compile_commands.py starts its search in its working directory and (over)writes compile_commands.json in the working directory. However, it also supports --output and --directory flags for out-of-tree use. Note that while gen_compile_commands.py enables the use of clang-based tools, it does not require the kernel to be compiled with clang. E.g., the following sequence of commands produces a compile_commands.json file that works correctly with LibTooling. make defconfig make scripts/gen_compile_commands.py Also note that this script is written to work correctly in both Python 2 and Python 3, so it does not specify the Python version in its first line. For an example of the utility of this script: after running gen_compile_commands.json on the latest kernel version, I was able to use Vim + the YouCompleteMe pluging + clangd to automatically jump to definitions and declarations. Obviously, cscope and ctags provide some of this functionality; the advantage of supporting LibTooling is that it opens the door to many other clang-based tools that understand the code directly and do not rely on regular expressions and heuristics. Tested: Built several recent kernel versions and ran the script against them, testing tools like clangd (for editor/LSP support) and clang-check (for static analysis). Also extracted some test .cmd files from a kernel build and wrote a test script to check that the script behaved correctly with all permutations of the --output and --directory flags. Signed-off-by: Tom Roeder Signed-off-by: Masahiro Yamada scripts/gen_compile_commands.py | 151 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 151 insertions(+) commit 9cf6533e8060d3896b88ea14b27f620e6504b84b Author: Wandrille RONCE Date: Wed Dec 19 14:52:44 2018 +0100 ALSA: hda/realtek: Enable audio jacks of ASUS UX391UA with ALC294 By default, there is no sound on Asus UX391UA on Linux. This patch adds sound support on Asus UX391UA. Tested working by three different users. The problem has also been described at https://bugs.launchpad.net/ubuntu/+source/alsa-driver/+bug/1784485 Signed-off-by: Wandrille RONCE Cc: Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) commit 1629db9c75342325868243d6bca5853017d91cf8 Author: Johan Hedberg Date: Tue Nov 27 11:37:46 2018 +0200 Bluetooth: Fix unnecessary error message for HCI request completion In case a command which completes in Command Status was sent using the hci_cmd_send-family of APIs there would be a misleading error in the hci_get_cmd_complete function, since the code would be trying to fetch the Command Complete parameters when there are none. Avoid the misleading error and silently bail out from the function in case the received event is a command status. Signed-off-by: Johan Hedberg Acked-by: Luiz Augusto von Dentz Signed-off-by: Marcel Holtmann net/bluetooth/hci_event.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 644b2e97405b0b74845e1d3c2b4fe4c34858062b Author: Takashi Sakamoto Date: Wed Dec 19 20:00:42 2018 +0900 ALSA: bebob: fix model-id of unit for Apogee Ensemble This commit fixes hard-coded model-id for an unit of Apogee Ensemble with a correct value. This unit uses DM1500 ASIC produced ArchWave AG (formerly known as BridgeCo AG). I note that this model supports three modes in the number of data channels in tx/rx streams; 8 ch pairs, 10 ch pairs, 18 ch pairs. The mode is switched by Vendor-dependent AV/C command, like: $ cd linux-firewire-utils $ ./firewire-request /dev/fw1 fcp 0x00ff000003dbeb0600000000 (8ch pairs) $ ./firewire-request /dev/fw1 fcp 0x00ff000003dbeb0601000000 (10ch pairs) $ ./firewire-request /dev/fw1 fcp 0x00ff000003dbeb0602000000 (18ch pairs) When switching between different mode, the unit disappears from IEEE 1394 bus, then appears on the bus with different combination of stream formats. In a mode of 18 ch pairs, available sampling rate is up to 96.0 kHz, else up to 192.0 kHz. $ ./hinawa-config-rom-printer /dev/fw1 { 'bus-info': { 'adj': False, 'bmc': True, 'chip_ID': 21474898341, 'cmc': True, 'cyc_clk_acc': 100, 'generation': 2, 'imc': True, 'isc': True, 'link_spd': 2, 'max_ROM': 1, 'max_rec': 512, 'name': '1394', 'node_vendor_ID': 987, 'pmc': False}, 'root-directory': [ ['HARDWARE_VERSION', 19], [ 'NODE_CAPABILITIES', { 'addressing': {'64': True, 'fix': True, 'prv': False}, 'misc': {'int': False, 'ms': False, 'spt': True}, 'state': { 'atn': False, 'ded': False, 'drq': True, 'elo': False, 'init': False, 'lst': True, 'off': False}, 'testing': {'bas': False, 'ext': False}}], ['VENDOR', 987], ['DESCRIPTOR', 'Apogee Electronics'], ['MODEL', 126702], ['DESCRIPTOR', 'Ensemble'], ['VERSION', 5297], [ 'UNIT', [ ['SPECIFIER_ID', 41005], ['VERSION', 65537], ['MODEL', 126702], ['DESCRIPTOR', 'Ensemble']]], [ 'DEPENDENT_INFO', [ ['SPECIFIER_ID', 2037], ['VERSION', 1], [(58, 'IMMEDIATE'), 16777159], [(59, 'IMMEDIATE'), 1048576], [(60, 'IMMEDIATE'), 16777159], [(61, 'IMMEDIATE'), 6291456]]]]} Signed-off-by: Takashi Sakamoto Signed-off-by: Takashi Iwai sound/firewire/bebob/bebob.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5ae4f61f012a097df93de2285070ec8e34716d29 Author: Gustavo A. R. Silva Date: Tue Dec 18 11:52:16 2018 -0600 ALSA: emu10k1: Fix potential Spectre v1 vulnerabilities ipcm->substream is indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. This issue was detected with the help of Smatch: sound/pci/emu10k1/emufx.c:1031 snd_emu10k1_ipcm_poke() warn: potential spectre issue 'emu->fx8010.pcm' [r] (local cap) sound/pci/emu10k1/emufx.c:1075 snd_emu10k1_ipcm_peek() warn: potential spectre issue 'emu->fx8010.pcm' [r] (local cap) Fix this by sanitizing ipcm->substream before using it to index emu->fx8010.pcm Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 Cc: stable@vger.kernel.org Signed-off-by: Gustavo A. R. Silva Signed-off-by: Takashi Iwai sound/pci/emu10k1/emufx.c | 5 +++++ 1 file changed, 5 insertions(+) commit 0b84304ef5da92add8dc75a1b07879c5374cdb05 Author: Gustavo A. R. Silva Date: Tue Dec 18 11:18:34 2018 -0600 ALSA: rme9652: Fix potential Spectre v1 vulnerability info->channel is indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. This issue was detected with the help of Smatch: sound/pci/rme9652/hdsp.c:4100 snd_hdsp_channel_info() warn: potential spectre issue 'hdsp->channel_map' [r] (local cap) Fix this by sanitizing info->channel before using it to index hdsp->channel_map Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. Also, notice that I refactored the code a bit in order to get rid of the following checkpatch warning: ERROR: do not use assignment in if condition FILE: sound/pci/rme9652/hdsp.c:4103: if ((mapped_channel = hdsp->channel_map[info->channel]) < 0) [1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 Cc: stable@vger.kernel.org Signed-off-by: Gustavo A. R. Silva Signed-off-by: Takashi Iwai sound/pci/rme9652/hdsp.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit 8c32d47b151b675291ca4278bfce0ec3eb46fad8 Author: Yangtao Li Date: Fri Nov 30 21:49:51 2018 -0500 HID: debug: Change to use DEFINE_SHOW_ATTRIBUTE macro Use DEFINE_SHOW_ATTRIBUTE macro to simplify the code. Signed-off-by: Yangtao Li Signed-off-by: Jiri Kosina drivers/hid/hid-debug.c | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) commit a8da3c7873ea57acb8f9cea58c0af477522965aa Author: Alexander Shiyan Date: Wed Dec 19 14:19:20 2018 +0300 serial: max310x: Fix tx_empty() callback Function max310x_tx_empty() accesses the IRQSTS register, which is cleared by IC when reading, so if there is an interrupt status, we will lose it. This patch implement the transmitter check only by the current FIFO level. Signed-off-by: Alexander Shiyan Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/max310x.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) commit 22bba80500fdf624a7cfbb65fdfa97a038ae224d Author: Jonathan Bakker Date: Wed Dec 19 12:22:28 2018 +0100 Bluetooth: hci_bcm: Handle specific unknown packets after firmware loading The Broadcom controller on aries S5PV210 boards sends out a couple of unknown packets after the firmware is loaded. This will cause logging of errors such as: Bluetooth: hci0: Frame reassembly failed (-84) This is probably also the case with other boards, as there are related Android userspace patches for custom ROMs such as https://review.lineageos.org/#/c/LineageOS/android_system_bt/+/142721/ Since this appears to be intended behaviour, treated them as diagnostic packets. Note that this is another variant of commit 01d5e44ace8a ("Bluetooth: hci_bcm: Handle empty packet after firmware loading") Signed-off-by: Jonathan Bakker Signed-off-by: Paweł Chmiel Signed-off-by: Marcel Holtmann drivers/bluetooth/hci_bcm.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) commit e3ca60d06cf37ea57d77eb834dca418f9c2dea81 Author: Paweł Chmiel Date: Wed Dec 19 12:22:46 2018 +0100 Bluetooth: btbcm: Add entry for BCM4329B1 UART bluetooth This patch adds the device ID for the BCM 4329 combo module used in the Samsung Aries based phones (Galaxy S and it's variants). ``` [ 11.508980] Bluetooth: hci0: BCM: chip id 41 [ 11.518975] Bluetooth: hci0: BCM: features 0x04 [ 11.550132] Bluetooth: hci0: BCM4329B1 [ 11.557046] Bluetooth: hci0: BCM4329B1 (002.002.023) build 0000 [ 13.737071] Bluetooth: hci0: BCM4329B1 (002.002.023) build 0744 ``` Output from hciconfig ``` hci0: Type: Primary Bus: UART BD Address: 43:29:B1:55:00:00 ACL MTU: 1021:6 SCO MTU: 64:1 UP RUNNING RX bytes:1675 acl:0 sco:0 events:145 errors:0 TX bytes:20426 acl:0 sco:0 commands:146 errors:0 Features: 0xbf 0xfe 0x8f 0xfe 0x9b 0xff 0x79 0x83 Packet type: DM1 DM3 DM5 DH1 DH3 DH5 HV1 HV2 HV3 Link policy: RSWITCH SNIFF Link mode: SLAVE ACCEPT Name: 'aries' Class: 0x000000 Service Classes: Unspecified Device Class: Miscellaneous, HCI Version: 2.1 (0x4) Revision: 0x2e8 LMP Version: 2.1 (0x4) Subversion: 0x4217 Manufacturer: Broadcom Corporation (15) ``` Signed-off-by: Paweł Chmiel Signed-off-by: Marcel Holtmann drivers/bluetooth/btbcm.c | 1 + 1 file changed, 1 insertion(+) commit 966e927bf8cc6a44f8b72582a1d6d3ffc73b12ad Author: Kangjie Lu Date: Tue Dec 18 23:04:13 2018 -0600 drivers/regulator: fix a missing check of return value If palmas_smps_read() fails, we should not use the read data in "reg" which may contain random value. The fix inserts a check for the return value of palmas_smps_read(): If it fails, we return the error code upstream and stop using "reg". Signed-off-by: Kangjie Lu Signed-off-by: Mark Brown drivers/regulator/palmas-regulator.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit fa89a4593b927b3f59c3b69379f31d3b22272e4e Author: YueHaibing Date: Wed Dec 19 14:45:09 2018 +0800 xfrm6_tunnel: Fix spi check in __xfrm6_tunnel_alloc_spi gcc warn this: net/ipv6/xfrm6_tunnel.c:143 __xfrm6_tunnel_alloc_spi() warn: always true condition '(spi <= 4294967295) => (0-u32max <= u32max)' 'spi' is u32, which always not greater than XFRM6_TUNNEL_SPI_MAX because of wrap around. So the second forloop will never reach. Signed-off-by: YueHaibing Signed-off-by: Steffen Klassert net/ipv6/xfrm6_tunnel.c | 3 +++ 1 file changed, 3 insertions(+) commit cc4acb1b6a86563ef5b6dc7c35d99f66d7b82557 Author: YueHaibing Date: Wed Dec 19 01:12:20 2018 +0000 xfrm: policy: remove set but not used variable 'priority' Fixes gcc '-Wunused-but-set-variable' warning: net/xfrm/xfrm_policy.c: In function 'xfrm_policy_lookup_bytype': net/xfrm/xfrm_policy.c:2079:6: warning: variable 'priority' set but not used [-Wunused-but-set-variable] It not used since commit 6be3b0db6db8 ("xfrm: policy: add inexact policy search tree infrastructure") Signed-off-by: YueHaibing Acked-by: Florian Westphal Signed-off-by: Steffen Klassert net/xfrm/xfrm_policy.c | 3 --- 1 file changed, 3 deletions(-) commit 75dfa87035f9a2659dd0c48af6b4d9899e79cdc9 Author: Patrick Havelange Date: Wed Dec 19 11:43:23 2018 +0100 EDAC, fsl_ddr: Add LS1021A to the list of supported hardware The Freescale ddr driver also works on the LS1021A board. Signed-off-by: Patrick Havelange Signed-off-by: Borislav Petkov Cc: Mauro Carvalho Chehab Cc: York Sun Cc: arnout.vandecappelle@essensium.com Cc: linux-edac Cc: matthew.weber@rockwellcollins.com Cc: patrick.havelange@essensium.com Link: https://lkml.kernel.org/r/20181219104323.10324-1-patrick.havelange@essensium.com drivers/edac/fsl_ddr_edac.c | 4 ++-- drivers/edac/fsl_ddr_edac.h | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) commit bd2bcaa565a2c07dd0492f6172f3ab6ad27c1acc Merge: 615740fd6b0c 2e64d317e197 Author: Thomas Gleixner Date: Wed Dec 19 11:34:49 2018 +0100 Merge branch 'clockevents/4.21' of http://git.linaro.org/people/daniel.lezcano/linux into timers/core Pull clockevents/source update from Daniel Lezcano: - Add dt-bindings for RDA8810PL SoC (Manivannan Sadhasivam) commit c410abbbacb9b378365ba17a30df08b4b9eec64f Author: Dou Liyang Date: Tue Dec 4 23:51:21 2018 +0800 genirq/affinity: Add is_managed to struct irq_affinity_desc Devices which use managed interrupts usually have two classes of interrupts: - Interrupts for multiple device queues - Interrupts for general device management Currently both classes are treated the same way, i.e. as managed interrupts. The general interrupts get the default affinity mask assigned while the device queue interrupts are spread out over the possible CPUs. Treating the general interrupts as managed is both a limitation and under certain circumstances a bug. Assume the following situation: default_irq_affinity = 4..7 So if CPUs 4-7 are offlined, then the core code will shut down the device management interrupts because the last CPU in their affinity mask went offline. It's also a limitation because it's desired to allow manual placement of the general device interrupts for various reasons. If they are marked managed then the interrupt affinity setting from both user and kernel space is disabled. That limitation was reported by Kashyap and Sumit. Expand struct irq_affinity_desc with a new bit 'is_managed' which is set for truly managed interrupts (queue interrupts) and cleared for the general device interrupts. [ tglx: Simplify code and massage changelog ] Reported-by: Kashyap Desai Reported-by: Sumit Saxena Signed-off-by: Dou Liyang Signed-off-by: Thomas Gleixner Cc: linux-pci@vger.kernel.org Cc: shivasharan.srikanteshwara@broadcom.com Cc: ming.lei@redhat.com Cc: hch@lst.de Cc: bhelgaas@google.com Cc: douliyang1@huawei.com Link: https://lkml.kernel.org/r/20181204155122.6327-3-douliyangs@gmail.com include/linux/interrupt.h | 1 + kernel/irq/affinity.c | 4 ++++ kernel/irq/irqdesc.c | 13 ++++++++----- 3 files changed, 13 insertions(+), 5 deletions(-) commit bec04037e4e484f41ee4d9409e40616874169d20 Author: Dou Liyang Date: Tue Dec 4 23:51:20 2018 +0800 genirq/core: Introduce struct irq_affinity_desc The interrupt affinity management uses straight cpumask pointers to convey the automatically assigned affinity masks for managed interrupts. The core interrupt descriptor allocation also decides based on the pointer being non NULL whether an interrupt is managed or not. Devices which use managed interrupts usually have two classes of interrupts: - Interrupts for multiple device queues - Interrupts for general device management Currently both classes are treated the same way, i.e. as managed interrupts. The general interrupts get the default affinity mask assigned while the device queue interrupts are spread out over the possible CPUs. Treating the general interrupts as managed is both a limitation and under certain circumstances a bug. Assume the following situation: default_irq_affinity = 4..7 So if CPUs 4-7 are offlined, then the core code will shut down the device management interrupts because the last CPU in their affinity mask went offline. It's also a limitation because it's desired to allow manual placement of the general device interrupts for various reasons. If they are marked managed then the interrupt affinity setting from both user and kernel space is disabled. To remedy that situation it's required to convey more information than the cpumasks through various interfaces related to interrupt descriptor allocation. Instead of adding yet another argument, create a new data structure 'irq_affinity_desc' which for now just contains the cpumask. This struct can be expanded to convey auxilliary information in the next step. No functional change, just preparatory work. [ tglx: Simplified logic and clarified changelog ] Suggested-by: Thomas Gleixner Suggested-by: Bjorn Helgaas Signed-off-by: Dou Liyang Signed-off-by: Thomas Gleixner Cc: linux-pci@vger.kernel.org Cc: kashyap.desai@broadcom.com Cc: shivasharan.srikanteshwara@broadcom.com Cc: sumit.saxena@broadcom.com Cc: ming.lei@redhat.com Cc: hch@lst.de Cc: douliyang1@huawei.com Link: https://lkml.kernel.org/r/20181204155122.6327-2-douliyangs@gmail.com drivers/pci/msi.c | 9 ++++----- include/linux/interrupt.h | 14 ++++++++++++-- include/linux/irq.h | 6 ++++-- include/linux/irqdomain.h | 6 ++++-- include/linux/msi.h | 4 ++-- kernel/irq/affinity.c | 22 ++++++++++++---------- kernel/irq/devres.c | 4 ++-- kernel/irq/irqdesc.c | 17 +++++++++-------- kernel/irq/irqdomain.c | 4 ++-- kernel/irq/msi.c | 8 ++++---- 10 files changed, 55 insertions(+), 39 deletions(-) commit c2899c3470de04823870b28646981695c0046efe Author: Thomas Gleixner Date: Tue Dec 18 16:06:53 2018 +0100 genirq/affinity: Remove excess indentation Plus other coding style issues which stood out while staring at that code. Signed-off-by: Thomas Gleixner kernel/irq/affinity.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) commit 7e6d5cd88a6f4961ed2968799ef98528c13ac5f8 Author: Kunihiko Hayashi Date: Fri Dec 7 09:53:12 2018 +0900 PCI: uniphier: Add UniPhier PCIe host controller support This introduces specific glue layer for UniPhier platform to support PCIe host controller that is based on the DesignWare PCIe core, and this driver supports Root Complex (host) mode. Signed-off-by: Kunihiko Hayashi Signed-off-by: Lorenzo Pieralisi MAINTAINERS | 7 + drivers/pci/controller/dwc/Kconfig | 10 + drivers/pci/controller/dwc/Makefile | 1 + drivers/pci/controller/dwc/pcie-uniphier.c | 471 +++++++++++++++++++++++++++++ 4 files changed, 489 insertions(+) commit db67cdb04234899d0c1a734beef4bfea4c38efef Author: Kunihiko Hayashi Date: Fri Dec 7 09:53:11 2018 +0900 dt-bindings: PCI: Add UniPhier PCIe host controller description Add DT bindings for PCIe controller implemented in UniPhier SoCs when configured in Root Complex (host) mode. This controller is based on the DesignWare PCIe core. Signed-off-by: Kunihiko Hayashi Signed-off-by: Lorenzo Pieralisi Reviewed-by: Rob Herring .../devicetree/bindings/pci/uniphier-pcie.txt | 81 ++++++++++++++++++++++ 1 file changed, 81 insertions(+) commit 9c0ef6d34fdbfb4f948b96d7611f0fd47649044e Author: Yue Wang Date: Tue Dec 18 16:04:46 2018 +0800 PCI: amlogic: Add the Amlogic Meson PCIe controller driver The Amlogic Meson PCIe host controller is based on the Synopsys DesignWare PCI core. This patch adds the driver support for Meson PCIe controller. Link: https://lore.kernel.org/linux-pci/20181218224708.GB22610@google.com/ Signed-off-by: Yue Wang Signed-off-by: Hanjie Lin [lorenzo.pieralisi@arm.com: updated coding/comment style] Signed-off-by: Lorenzo Pieralisi MAINTAINERS | 7 + drivers/pci/controller/dwc/Kconfig | 10 + drivers/pci/controller/dwc/Makefile | 1 + drivers/pci/controller/dwc/pci-meson.c | 592 +++++++++++++++++++++++++++++++++ 4 files changed, 610 insertions(+) commit 7cd2103911018ecc6f3d2e6239ab5e00fb684d76 Author: Yue Wang Date: Tue Dec 18 16:04:45 2018 +0800 dt-bindings: PCI: meson: add DT bindings for Amlogic Meson PCIe controller The Amlogic Meson PCIe host controller is based on the Synopsys DesignWare PCI core. This patch adds documentation for the DT bindings in Meson PCIe controller. Signed-off-by: Yue Wang Signed-off-by: Hanjie Lin Signed-off-by: Lorenzo Pieralisi Reviewed-by: Rob Herring .../devicetree/bindings/pci/amlogic,meson-pcie.txt | 70 ++++++++++++++++++++++ 1 file changed, 70 insertions(+) commit a88c4736ea36396f4a7b1460202a8caa434238db Author: Fabrizio Castro Date: Wed Dec 19 10:06:25 2018 +0000 dt-bindings: serial: sh-sci: Document r8a774c0 bindings RZ/G2E (R8A774C0) SoC also has the R-Car Gen3 compatible SCIF and HSCIF ports, so document the SoC specific bindings. Signed-off-by: Fabrizio Castro Reviewed-by: Geert Uytterhoeven Reviewed-by: Simon Horman Reviewed-by: Rob Herring Signed-off-by: Greg Kroah-Hartman Documentation/devicetree/bindings/serial/renesas,sci-serial.txt | 2 ++ 1 file changed, 2 insertions(+) commit 6c4d975812677fdacfe657b8a1fae11de2fb4a37 Author: Fabrizio Castro Date: Wed Dec 19 10:06:24 2018 +0000 dt-bindings: serial: sh-sci: Document r8a774a1 bindings RZ/G2M (R8A774A1) SoC also has the R-Car Gen3 compatible SCIF and HSCIF ports, so document the SoC specific bindings. While at it, update the RZ/G1 and RZ/G2 family specific strings description as outdated. Signed-off-by: Fabrizio Castro Reviewed-by: Biju Das Reviewed-by: Rob Herring Reviewed-by: Simon Horman Signed-off-by: Greg Kroah-Hartman .../devicetree/bindings/serial/renesas,sci-serial.txt | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) commit 2e64d317e197ec390e3914773489fcade7bbbf15 Author: Manivannan Sadhasivam Date: Mon Dec 10 23:05:44 2018 +0530 dt-bindings: timer: Document RDA8810PL SoC timer Document RDA Micro RDA8810PL SoC timer. Signed-off-by: Manivannan Sadhasivam Reviewed-by: Rob Herring Signed-off-by: Daniel Lezcano .../devicetree/bindings/timer/rda,8810pl-timer.txt | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) commit ac8b6f148fc97e9e10b48bd337ef571b1d1136aa Author: Amanoel Dawod Date: Wed Dec 5 18:56:37 2018 -0500 Fonts: New Terminus large console font This patch adds an option to compile-in a high resolution and large Terminus (ter16x32) bitmap console font for use with HiDPI and Retina screens. The font was convereted from standard Terminus ter-i32b.psf (size 16x32) with the help of psftools and minor hand editing deleting useless characters. This patch is non-intrusive, no options are enabled by default so most users won't notice a thing. I am placing my changes under the GPL 2.0 just as source Terminus font. Signed-off-by: Amanoel Dawod Signed-off-by: Greg Kroah-Hartman include/linux/font.h | 4 +- lib/fonts/Kconfig | 10 + lib/fonts/Makefile | 1 + lib/fonts/font_ter16x32.c | 2072 +++++++++++++++++++++++++++++++++++++++++++++ lib/fonts/fonts.c | 4 + 5 files changed, 2090 insertions(+), 1 deletion(-) commit 1de24f362f32b1d290385558b4f94990e36f670e Author: Daniel Bovensiepen Date: Thu Dec 6 15:52:43 2018 +0000 staging: android: ashmem: doc: Fix spelling Fixed spelling in comment section. Signed-off-by: Daniel Bovensiepen Acked-by: Joel Fernandes (Google) Signed-off-by: Greg Kroah-Hartman drivers/staging/android/ashmem.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit fdfaef212694a139ebd5119f9a07f2e8e24be8a6 Author: Sudip Mukherjee Date: Fri Dec 7 14:27:34 2018 +0000 char: lp: use new parport device model Modify lp driver to use the new parallel port device model. Signed-off-by: Sudip Mukherjee Signed-off-by: Greg Kroah-Hartman drivers/char/lp.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) commit e379c1a46068969a2b822a15dbc9a37577e1e04f Author: Sudip Mukherjee Date: Fri Dec 7 14:27:33 2018 +0000 char: lp: properly count the lp devices When the parallel port is usb based and the lp attaches to it based on LP_PARPORT_AUTO, we do get /dev/lp0 and when we remove the usb device /dev/lp0 is unregistered. If we now reconnect the usb device we get our /dev/lp0 back. But if we now disconnect and reconnect eight times we donot get any lp device and dmesg shows: lp: ignoring parallel port (max. 8) Decrement the lp_count when the device detaches as this represents the number of lp devices connected to the system. Signed-off-by: Sudip Mukherjee Signed-off-by: Greg Kroah-Hartman drivers/char/lp.c | 1 + 1 file changed, 1 insertion(+) commit dc34da42860d8ce01f64ac11752eecccf53c1a6c Author: Sudip Mukherjee Date: Fri Dec 7 14:27:32 2018 +0000 char: lp: use first unused lp number while registering When the parallel port is usb based and the lp attaches to it based on LP_PARPORT_AUTO, we do get /dev/lp0 and when we remove the usb device /dev/lp0 is unregistered. But if we now reconnect the usb device we get /dev/lp1, another disconnection and reconnection and we get /dev/lp2. Use the port number array to find the first unused lp number and use that to register the lp device with the parallel port. Signed-off-by: Sudip Mukherjee Signed-off-by: Greg Kroah-Hartman drivers/char/lp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit d6318c0e8318c200aa95b50769d3635907381c08 Author: Sudip Mukherjee Date: Fri Dec 7 14:27:31 2018 +0000 char: lp: detach the device when parallel port is removed When the parallel port is usb based and the lp attaches to it, we do get /dev/lp0, but when we remove the usb device and the parallel port is gone, we are still left with /dev/lp0. Unregister the device properly in the detach routine based on the port number it has connected to. Signed-off-by: Sudip Mukherjee Signed-off-by: Greg Kroah-Hartman drivers/char/lp.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) commit 0edf39d2c7dbb4947358dd102b6ff35eaaa92d68 Author: Sudip Mukherjee Date: Fri Dec 7 14:27:30 2018 +0000 char: lp: introduce list to save port number When we are registering lp in LP_PARPORT_AUTO mode, we are not keeping any record of the parallel port number to which lp is connecting. Add an array to save the port number to it. Signed-off-by: Sudip Mukherjee Signed-off-by: Greg Kroah-Hartman drivers/char/lp.c | 4 ++++ 1 file changed, 4 insertions(+) commit 2e79c1874968b8fdbf578a2a364ec9b6263c77ca Author: YueHaibing Date: Mon Dec 10 15:25:13 2018 +0800 bus: qcom: remove duplicated include from qcom-ebi2.c Remove duplicated include. Signed-off-by: YueHaibing Acked-by: Linus Walleij Signed-off-by: Greg Kroah-Hartman drivers/bus/qcom-ebi2.c | 1 - 1 file changed, 1 deletion(-) commit d32dcc6c6970667e438e2b1fec92816d98dcb29f Author: Yangtao Li Date: Sat Dec 15 03:45:26 2018 -0500 PM / Domains: remove define_genpd_open_function() and define_genpd_debugfs_fops() We already have the DEFINE_SHOW_ATTRIBUTE, There is no need to define such a macro, so remove define_genpd_open_function and define_genpd_debugfs_fops. Convert them to DEFINE_SHOW_ATTRIBUTE. Signed-off-by: Yangtao Li Acked-by: Ulf Hansson Signed-off-by: Rafael J. Wysocki drivers/base/power/domain.c | 71 +++++++++++++++------------------------------ 1 file changed, 24 insertions(+), 47 deletions(-) commit 8234f6734c5d74ac794e5517437f51c57d65f865 Author: Vincent Guittot Date: Fri Dec 14 15:22:25 2018 +0100 PM-runtime: Switch autosuspend over to using hrtimers PM-runtime uses the timer infrastructure for autosuspend. This implies that the minimum time before autosuspending a device is in the range of 1 tick included to 2 ticks excluded -On arm64 this means between 4ms and 8ms with default jiffies configuration -And on arm, it is between 10ms and 20ms These values are quite high for embedded systems which sometimes want the duration to be in the range of 1 ms. It is possible to switch autosuspend over to using hrtimers to get finer granularity for short durations and take advantage of slack to retain some margins and get long timeouts with minimum wakeups. On an arm64 platform that uses 1ms for autosuspending timeout of its GPU, idle power is reduced by 10% with hrtimer. The latency impact on arm64 hikey octo cores is: - mark_last_busy: from 1.11 us to 1.25 us - rpm_suspend: from 15.54 us to 15.38 us [Only the code path of rpm_suspend() that starts hrtimer has been measured.] arm64 image (arm64 default defconfig) decreases by around 3KB with following details: $ size vmlinux-timer text data bss dec hex filename 12034646 6869268 386840 19290754 1265a82 vmlinux $ size vmlinux-hrtimer text data bss dec hex filename 12030550 6870164 387032 19287746 1264ec2 vmlinux The latency impact on arm 32bits snowball dual cores is : - mark_last_busy: from 0.31 us usec to 0.77 us - rpm_suspend: from 6.83 us to 6.67 usec The increase of the image for snowball platform that I used for testing performance impact, is neglictable (244B). $ size vmlinux-timer text data bss dec hex filename 7157961 2119580 264120 9541661 91981d build-ux500/vmlinux size vmlinux-hrtimer text data bss dec hex filename 7157773 2119884 264248 9541905 919911 vmlinux-hrtimer And arm 32bits image (multi_v7_defconfig) increases by around 1.7KB with following details: $ size vmlinux-timer text data bss dec hex filename 13304443 6803420 402768 20510631 138f7a7 vmlinux $ size vmlinux-hrtimer text data bss dec hex filename 13304299 6805276 402768 20512343 138fe57 vmlinux Signed-off-by: Vincent Guittot Reviewed-by: Ulf Hansson Signed-off-by: Rafael J. Wysocki drivers/base/power/runtime.c | 63 ++++++++++++++++++++++++-------------------- include/linux/pm.h | 5 ++-- include/linux/pm_runtime.h | 6 ++--- 3 files changed, 40 insertions(+), 34 deletions(-) commit 8995fa1e1c9bcb76d407b860770e640b60ed8c76 Author: Wen Yang Date: Mon Dec 10 19:36:07 2018 +0800 VMCI: Use memdup_user() rather than duplicating its implementation Reuse existing functionality from memdup_user() instead of keeping duplicate source code. This issue was detected by using the Coccinelle software. Signed-off-by: Wen Yang CC: Arnd Bergmann CC: Greg Kroah-Hartman CC: linux-kernel@vger.kernel.org Signed-off-by: Greg Kroah-Hartman drivers/misc/vmw_vmci/vmci_host.c | 18 ++++-------------- 1 file changed, 4 insertions(+), 14 deletions(-) commit f88fd666051b08eb3f3118e2dd8508bf0247af4c Author: Rob Herring Date: Wed Dec 5 13:50:19 2018 -0600 char/rtc: Use of_node_name_eq for node name comparisons Convert string compares of DT node names to use of_node_name_eq helper instead. This removes direct access to the node name pointer. The open coded iterating thru the child node names is converted to use for_each_child_of_node() instead. Cc: Arnd Bergmann Cc: Greg Kroah-Hartman Signed-off-by: Rob Herring Signed-off-by: Greg Kroah-Hartman drivers/char/rtc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 15b3048aeed8bf8232156456c884ae94ed52d6cd Author: Wenwen Wang Date: Tue Dec 4 09:16:41 2018 -0600 misc: mic: fix a DMA pool free failure In _scif_prog_signal(), a DMA pool is allocated if the MIC Coprocessor is not X100, i.e., the boolean variable 'x100' is false. This DMA pool will be freed eventually through the callback function scif_prog_signal_cb() with the parameter of 'status', which actually points to the start of DMA pool. Specifically, in scif_prog_signal_cb(), the 'ep' field and the 'src_dma_addr' field of 'status' are used to free the DMA pool by invoking dma_pool_free(). Given that 'status' points to the start address of the DMA pool, both 'status->ep' and 'status->src_dma_addr' are in the DMA pool. And so, the device has the permission to access them. Even worse, a malicious device can modify them. As a result, dma_pool_free() will not succeed. To avoid the above issue, this patch introduces a new data structure, i.e., scif_cb_arg, to store the arguments required by the call back function. A variable 'cb_arg' is allocated in _scif_prog_signal() to pass the arguments. 'cb_arg' will be freed after dma_pool_free() in scif_prog_signal_cb(). Signed-off-by: Wenwen Wang Signed-off-by: Greg Kroah-Hartman drivers/misc/mic/scif/scif_fence.c | 22 +++++++++++++++++----- drivers/misc/mic/scif/scif_rma.h | 13 +++++++++++++ 2 files changed, 30 insertions(+), 5 deletions(-) commit afdd273e269ca8dee3c70c150d96b4de4f83d39e Author: Chen-Yu Tsai Date: Mon Dec 17 12:04:48 2018 +0800 ARM: dts: sunxi: Enable Broadcom-based Bluetooth for multiple boards This patch adds the Bluetooth node, and the underlying UART node if it's missing, to the board device tree file for several boards. The LPO clock is also added to the WiFi side's power sequencing node if it's missing, to correctly represent the shared connections. There is also a PCM connection for Bluetooth, but this is not covered in this patch. These boards all have a WiFi+BT module from AMPAK, which contains one or two Broadcom chips, depending on the model. The older AP6210 contains two, while the newer AP6212 and AP6330 contain just one, as they use two-in-one combo chips. The Bluetooth side of the module is always connected to a UART on the same pingroup as the SDIO pins for the WiFi side, in a 4 wire configuration. Power to the VBAT and VDDIO pins are provided either by the PMIC, using one or several of its regulator outputs, or other fixed regulators on the board. The VBAT and VDDIO pins are shared with the WiFi side, which would correspond to vmmc-supply and vqmmc-supply in the mmc host node. A clock output from the SoC or the external X-Powers RTC provides the LPO low power clock at 32.768 kHz. All the boards covered in this patch are ones that do not require extra changes to the SoC's dtsi file. For the remaining boards that I have worked on, properties or device nodes for the LPO clock's source are missing. For the Cubietruck, the LPO clock is fed from CLK_OUT_A, which needs to be muxed on pin PI12. This can be represented in multiple ways. This patch puts the pinctrl property in the pin controller node. This is due to limitations in Linux, where pinmux settings, even the same one, can not be shared by multiple devices. Thus we cannot put it in both the WiFi and Bluetooth device nodes. Putting it the CCU node is another option, but Linux's CCU driver does not handle pinctrl. Also the pin controller is guaranteed to be initialized after the CCU, when clocks are available. And any other devices that use muxed pins are guaranteed to be initialized after the pin controller. Thus having the CLK_OUT_A pinmux reference be in the pin controller node is a good choice without having to deal with implementation issues. Acked-by: Maxime Ripard Signed-off-by: Chen-Yu Tsai arch/arm/boot/dts/sun7i-a20-cubietruck.dts | 25 ++++++++++++++++++++++++ arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts | 18 +++++++++++++++++ arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts | 18 +++++++++++++++++ arch/arm/boot/dts/sun8i-r16-bananapi-m2m.dts | 14 +++++++++++++ 4 files changed, 75 insertions(+) commit c266a2b4407af7a6fc39f449782aa5c0be48be5a Author: Chen-Yu Tsai Date: Mon Dec 17 12:04:49 2018 +0800 arm64: dts: allwinner: a64: bananapi-m64: Add Bluetooth device node The AP6212 is based on the Broadcom BCM43430 or BCM43438. The WiFi side identifies as BCM43430, while the Bluetooth side identifies as BCM43438. The Bluetooth side is connected to UART1 in a 4 wire configuration. Same as the WiFi side, due to being the same chip and package, DLDO2 provides overall power via VBAT, and DLDO4 provides I/O power via VDDIO. The RTC clock output provides the LPO low power clock at 32.768 kHz. This patch enables Bluetooth on this board, and also adds the missing LPO clock on the WiFi side. There is also a PCM connection for Bluetooth, but this is not covered here. Acked-by: Maxime Ripard Signed-off-by: Chen-Yu Tsai arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts | 14 ++++++++++++++ 1 file changed, 14 insertions(+) commit b9d93594c7679c108ea41dec731df6f986786a19 Author: Dan Carpenter Date: Fri Dec 7 09:00:46 2018 +0300 ptp: fix an IS_ERR() vs NULL check We recently modified pps_register_source() to return error pointers instead of NULL but it seems like there was a merge issue and part of the commit was lost. Anyway, the ptp_clock_register() function needs to be updated to check for IS_ERR() as well. Fixes: 3b1ad360acad ("pps: using ERR_PTR instead of NULL while pps_register_source fails") Signed-off-by: Dan Carpenter Acked-by: Richard Cochran Signed-off-by: Greg Kroah-Hartman drivers/ptp/ptp_clock.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit b7b69fb840f50d7037b3ab0fd95a3a89086c8fad Author: Maxime Ripard Date: Fri Dec 14 10:55:38 2018 +0100 ARM: dts: suniv: Fix improper bindings include patch The clock and reset bindings are going through different trees, and while the patch doesn't contain any value defined in that header, it still includes those files and result in a build breakage when building the DT without the matching clock and reset patches applied. Signed-off-by: Maxime Ripard Signed-off-by: Chen-Yu Tsai arch/arm/boot/dts/suniv-f1c100s.dtsi | 3 --- 1 file changed, 3 deletions(-) commit 5215b2e952f3f94d74cac1a59494eb8ac647e216 Author: jjian zhou Date: Tue Dec 18 20:33:18 2018 +0800 mmc: mediatek: Add MMC_CAP_SDIO_IRQ support This patch enables support SDIO IRQs. It enables MMC_CAP_SDIO_IRQ & MMC_CAP2_SDIO_IRQ_NOTHREAD and implement the ->ack_sdio_irq callback. Signed-off-by: Jjian Zhou Signed-off-by: Chaotian Jing Signed-off-by: Yong Mao Signed-off-by: Ulf Hansson drivers/mmc/host/mtk-sd.c | 53 ++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 50 insertions(+), 3 deletions(-) commit fdd669684655c07dacbdb0d753fd13833de69a33 Author: Christian Borntraeger Date: Wed Dec 12 14:45:18 2018 +0100 genwqe: Fix size check Calling the test program genwqe_cksum with the default buffer size of 2MB triggers the following kernel warning on s390: WARNING: CPU: 30 PID: 9311 at mm/page_alloc.c:3189 __alloc_pages_nodemask+0x45c/0xbe0 CPU: 30 PID: 9311 Comm: genwqe_cksum Kdump: loaded Not tainted 3.10.0-957.el7.s390x #1 task: 00000005e5d13980 ti: 00000005e7c6c000 task.ti: 00000005e7c6c000 Krnl PSW : 0704c00180000000 00000000002780ac (__alloc_pages_nodemask+0x45c/0xbe0) R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:0 PM:0 EA:3 Krnl GPRS: 00000000002932b8 0000000000b73d7c 0000000000000010 0000000000000009 0000000000000041 00000005e7c6f9b8 0000000000000001 00000000000080d0 0000000000000000 0000000000b70500 0000000000000001 0000000000000000 0000000000b70528 00000000007682c0 0000000000277df2 00000005e7c6f9a0 Krnl Code: 000000000027809e: de7195001000 ed 1280(114,%r9),0(%r1) 00000000002780a4: a774fead brc 7,277dfe #00000000002780a8: a7f40001 brc 15,2780aa >00000000002780ac: 92011000 mvi 0(%r1),1 00000000002780b0: a7f4fea7 brc 15,277dfe 00000000002780b4: 9101c6b6 tm 1718(%r12),1 00000000002780b8: a784ff3a brc 8,277f2c 00000000002780bc: a7f4fe2e brc 15,277d18 Call Trace: ([<0000000000277df2>] __alloc_pages_nodemask+0x1a2/0xbe0) [<000000000013afae>] s390_dma_alloc+0xfe/0x310 [<000003ff8065f362>] __genwqe_alloc_consistent+0xfa/0x148 [genwqe_card] [<000003ff80658f7a>] genwqe_mmap+0xca/0x248 [genwqe_card] [<00000000002b2712>] mmap_region+0x4e2/0x778 [<00000000002b2c54>] do_mmap+0x2ac/0x3e0 [<0000000000292d7e>] vm_mmap_pgoff+0xd6/0x118 [<00000000002b081c>] SyS_mmap_pgoff+0xdc/0x268 [<00000000002b0a34>] SyS_old_mmap+0x8c/0xb0 [<000000000074e518>] sysc_tracego+0x14/0x1e [<000003ffacf87dc6>] 0x3ffacf87dc6 turns out the check in __genwqe_alloc_consistent uses "> MAX_ORDER" while the mm code uses ">= MAX_ORDER". Fix genwqe. Cc: stable@vger.kernel.org Signed-off-by: Christian Borntraeger Signed-off-by: Frank Haverkamp Signed-off-by: Greg Kroah-Hartman drivers/misc/genwqe/card_utils.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e121a833745b4708b660e3fe6776129c2956b041 Author: Rafael J. Wysocki Date: Thu Dec 13 19:27:47 2018 +0100 driver core: Add missing dev->bus->need_parent_lock checks __device_release_driver() has to check dev->bus->need_parent_lock before dropping the parent lock and acquiring it again as it may attempt to drop a lock that hasn't been acquired or lock a device that shouldn't be locked and create a lock imbalance. Fixes: 8c97a46af04b (driver core: hold dev's parent lock when needed) Signed-off-by: Rafael J. Wysocki Cc: stable Reviewed-by: Daniel Vetter Signed-off-by: Greg Kroah-Hartman drivers/base/dd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit d359bbce0601c6a19203a4b813a7e3910fcba282 Author: Ilan Peer Date: Sat Dec 15 11:03:25 2018 +0200 mac80211: Properly access radiotap vendor data The radiotap vendor data might be placed after some other radiotap elements, and thus when accessing it, need to access the correct offset in the skb data. Fix the code accordingly. Signed-off-by: Ilan Peer Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg net/mac80211/rx.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 93bc8ac49e82a329160604556b805b7fa614ff9e Author: Johannes Berg Date: Sat Dec 15 11:03:16 2018 +0200 cfg80211: fix ieee80211_get_vht_max_nss() Fix two bugs in ieee80211_get_vht_max_nss(): * the spec says we should round down (reported by Nissim) * there's a double condition, the first one is wrong, supp_width == 0 / ext_nss_bw == 2 is valid in 80+80 (found by smatch) Fixes: b0aa75f0b1b2 ("ieee80211: add new VHT capability fields/parsing") Reported-by: Nissim Bendanan Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg net/wireless/util.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) commit 3ad20fe393b31025bebfc2d76964561f65df48aa Author: Christian Brauner Date: Fri Dec 14 13:11:14 2018 +0100 binder: implement binderfs As discussed at Linux Plumbers Conference 2018 in Vancouver [1] this is the implementation of binderfs. /* Abstract */ binderfs is a backwards-compatible filesystem for Android's binder ipc mechanism. Each ipc namespace will mount a new binderfs instance. Mounting binderfs multiple times at different locations in the same ipc namespace will not cause a new super block to be allocated and hence it will be the same filesystem instance. Each new binderfs mount will have its own set of binder devices only visible in the ipc namespace it has been mounted in. All devices in a new binderfs mount will follow the scheme binder%d and numbering will always start at 0. /* Backwards compatibility */ Devices requested in the Kconfig via CONFIG_ANDROID_BINDER_DEVICES for the initial ipc namespace will work as before. They will be registered via misc_register() and appear in the devtmpfs mount. Specifically, the standard devices binder, hwbinder, and vndbinder will all appear in their standard locations in /dev. Mounting or unmounting the binderfs mount in the initial ipc namespace will have no effect on these devices, i.e. they will neither show up in the binderfs mount nor will they disappear when the binderfs mount is gone. /* binder-control */ Each new binderfs instance comes with a binder-control device. No other devices will be present at first. The binder-control device can be used to dynamically allocate binder devices. All requests operate on the binderfs mount the binder-control device resides in. Assuming a new instance of binderfs has been mounted at /dev/binderfs via mount -t binderfs binderfs /dev/binderfs. Then a request to create a new binder device can be made as illustrated in [2]. Binderfs devices can simply be removed via unlink(). /* Implementation details */ - dynamic major number allocation: When binderfs is registered as a new filesystem it will dynamically allocate a new major number. The allocated major number will be returned in struct binderfs_device when a new binder device is allocated. - global minor number tracking: Minor are tracked in a global idr struct that is capped at BINDERFS_MAX_MINOR. The minor number tracker is protected by a global mutex. This is the only point of contention between binderfs mounts. - struct binderfs_info: Each binderfs super block has its own struct binderfs_info that tracks specific details about a binderfs instance: - ipc namespace - dentry of the binder-control device - root uid and root gid of the user namespace the binderfs instance was mounted in - mountable by user namespace root: binderfs can be mounted by user namespace root in a non-initial user namespace. The devices will be owned by user namespace root. - binderfs binder devices without misc infrastructure: New binder devices associated with a binderfs mount do not use the full misc_register() infrastructure. The misc_register() infrastructure can only create new devices in the host's devtmpfs mount. binderfs does however only make devices appear under its own mountpoint and thus allocates new character device nodes from the inode of the root dentry of the super block. This will have the side-effect that binderfs specific device nodes do not appear in sysfs. This behavior is similar to devpts allocated pts devices and has no effect on the functionality of the ipc mechanism itself. [1]: https://goo.gl/JL2tfX [2]: program to allocate a new binderfs binder device: #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include int main(int argc, char *argv[]) { int fd, ret, saved_errno; size_t len; struct binderfs_device device = { 0 }; if (argc < 2) exit(EXIT_FAILURE); len = strlen(argv[1]); if (len > BINDERFS_MAX_NAME) exit(EXIT_FAILURE); memcpy(device.name, argv[1], len); fd = open("/dev/binderfs/binder-control", O_RDONLY | O_CLOEXEC); if (fd < 0) { printf("%s - Failed to open binder-control device\n", strerror(errno)); exit(EXIT_FAILURE); } ret = ioctl(fd, BINDER_CTL_ADD, &device); saved_errno = errno; close(fd); errno = saved_errno; if (ret < 0) { printf("%s - Failed to allocate new binder device\n", strerror(errno)); exit(EXIT_FAILURE); } printf("Allocated new binder device with major %d, minor %d, and " "name %s\n", device.major, device.minor, device.name); exit(EXIT_SUCCESS); } Cc: Martijn Coenen Cc: Greg Kroah-Hartman Signed-off-by: Christian Brauner Acked-by: Todd Kjos Signed-off-by: Greg Kroah-Hartman drivers/android/Kconfig | 12 + drivers/android/Makefile | 1 + drivers/android/binder.c | 25 +- drivers/android/binder_internal.h | 49 +++ drivers/android/binderfs.c | 544 ++++++++++++++++++++++++++++++++ include/uapi/linux/android/binder_ctl.h | 35 ++ include/uapi/linux/magic.h | 1 + 7 files changed, 650 insertions(+), 17 deletions(-) commit 80cd795630d6526ba729a089a435bf74a57af927 Author: Todd Kjos Date: Fri Dec 14 15:58:21 2018 -0800 binder: fix use-after-free due to ksys_close() during fdget() 44d8047f1d8 ("binder: use standard functions to allocate fds") exposed a pre-existing issue in the binder driver. fdget() is used in ksys_ioctl() as a performance optimization. One of the rules associated with fdget() is that ksys_close() must not be called between the fdget() and the fdput(). There is a case where this requirement is not met in the binder driver which results in the reference count dropping to 0 when the device is still in use. This can result in use-after-free or other issues. If userpace has passed a file-descriptor for the binder driver using a BINDER_TYPE_FDA object, then kys_close() is called on it when handling a binder_ioctl(BC_FREE_BUFFER) command. This violates the assumptions for using fdget(). The problem is fixed by deferring the close using task_work_add(). A new variant of __close_fd() was created that returns a struct file with a reference. The fput() is deferred instead of using ksys_close(). Fixes: 44d8047f1d87a ("binder: use standard functions to allocate fds") Suggested-by: Al Viro Signed-off-by: Todd Kjos Cc: stable Signed-off-by: Greg Kroah-Hartman drivers/android/binder.c | 63 ++++++++++++++++++++++++++++++++++++++++++++++-- fs/file.c | 29 ++++++++++++++++++++++ include/linux/fdtable.h | 1 + 3 files changed, 91 insertions(+), 2 deletions(-) commit efc38dd7d5fa5c8cdd0c917c5d00947aa0539443 Author: Johannes Berg Date: Sat Dec 15 11:03:12 2018 +0200 mac80211: fix radiotap vendor presence bitmap handling Due to the alignment handling, it actually matters where in the code we add the 4 bytes for the presence bitmap to the length; the first field is the timestamp with 8 byte alignment so we need to add the space for the extra vendor namespace presence bitmap *before* we do any alignment for the fields. Move the presence bitmap length accounting to the right place to fix the alignment for the data properly. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg net/mac80211/rx.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 385e89d5b20f5a7c33fd7c1904da0e6a8e1b366f Author: Christophe Leroy Date: Wed Nov 28 17:21:10 2018 +0000 powerpc/mm: add exec protection on powerpc 603 The 603 doesn't have a HASH table, TLB misses are handled by software. It is then possible to generate page fault when _PAGE_EXEC is not set like in nohash/32. There is one "reserved" PTE bit available, this patch uses it for _PAGE_EXEC. In order to support it, set_pte_filter() and set_access_flags_filter() are made common, and the handling is made dependent on MMU_FTR_HPTE_TABLE Signed-off-by: Christophe Leroy Reviewed-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman arch/powerpc/include/asm/book3s/32/hash.h | 1 + arch/powerpc/include/asm/book3s/32/pgtable.h | 18 +++++++++--------- arch/powerpc/include/asm/cputable.h | 8 ++++---- arch/powerpc/kernel/head_32.S | 2 +- arch/powerpc/mm/dump_linuxpagetables-generic.c | 2 -- arch/powerpc/mm/pgtable.c | 20 +++++++++++--------- 6 files changed, 26 insertions(+), 25 deletions(-) commit badb9687cec50bdba59746532de1969d6d26f3a7 Author: Christophe Leroy Date: Mon Dec 10 12:23:05 2018 +0000 powerpc/mm: define an empty slice_init_new_context_exec() Define slice_init_new_context_exec() at all time to avoid Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman arch/powerpc/include/asm/slice.h | 14 +++++++++----- arch/powerpc/mm/mmu_context_nohash.c | 2 -- 2 files changed, 9 insertions(+), 7 deletions(-) commit 05a4ab823983d9136a460b7b5e0d49ee709a6f86 Author: Christophe Leroy Date: Mon Dec 10 06:50:09 2018 +0000 powerpc/uaccess: fix warning/error with access_ok() With the following piece of code, the following compilation warning is encountered: if (_IOC_DIR(ioc) != _IOC_NONE) { int verify = _IOC_DIR(ioc) & _IOC_READ ? VERIFY_WRITE : VERIFY_READ; if (!access_ok(verify, ioarg, _IOC_SIZE(ioc))) { drivers/platform/test/dev.c: In function 'my_ioctl': drivers/platform/test/dev.c:219:7: warning: unused variable 'verify' [-Wunused-variable] int verify = _IOC_DIR(ioc) & _IOC_READ ? VERIFY_WRITE : VERIFY_READ; This patch fixes it by referencing 'type' in the macro allthough doing nothing with it. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman arch/powerpc/include/asm/uaccess.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c62ce9ef97ba8af4120c766c32e230215dd4df04 Author: Christophe Leroy Date: Tue Dec 4 17:59:15 2018 +0000 powerpc: remove remaining bits from CONFIG_APUS commit f21f49ea639a ("[POWERPC] Remove the dregs of APUS support from arch/powerpc") removed CONFIG_APUS, but forgot to remove the logic which adapts tophys() and tovirt() for it. This patch removes the last stale pieces. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman arch/powerpc/include/asm/ppc_asm.h | 19 ++----------------- arch/powerpc/kernel/vmlinux.lds.S | 6 ------ 2 files changed, 2 insertions(+), 23 deletions(-) commit 32c8c4c621897199e690760c2d57054f8b84b6e6 Author: Christophe Leroy Date: Fri Nov 16 17:31:08 2018 +0000 powerpc/xmon: fix dump_segments() mfsrin() takes segment num from bits 31-28 (IBM bits 0-3). Signed-off-by: Christophe Leroy [mpe: Clarify bit numbering] Signed-off-by: Michael Ellerman arch/powerpc/xmon/xmon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0ed5b55884f8b1fa368454d47cc6ecf9790b8b99 Author: Christophe Leroy Date: Tue Nov 27 17:38:16 2018 +0000 powerpc/8xx: add exception frame marker This patch adds STACK_FRAME_REGS_MARKER in the stack at exception entry in order to see interrupts in call traces as below: [ 0.013964] Call Trace: [ 0.014014] [c0745db0] [c007a9d4] tick_periodic.constprop.5+0xd8/0x104 (unreliable) [ 0.014086] [c0745dc0] [c007aa20] tick_handle_periodic+0x20/0x9c [ 0.014181] [c0745de0] [c0009cd0] timer_interrupt+0xa0/0x264 [ 0.014258] [c0745e10] [c000e484] ret_from_except+0x0/0x14 [ 0.014390] --- interrupt: 901 at console_unlock.part.7+0x3f4/0x528 [ 0.014390] LR = console_unlock.part.7+0x3f0/0x528 [ 0.014455] [c0745ee0] [c0050334] console_unlock.part.7+0x114/0x528 (unreliable) [ 0.014542] [c0745f30] [c00524e0] register_console+0x3d8/0x44c [ 0.014625] [c0745f60] [c0675aac] cpm_uart_console_init+0x18/0x2c [ 0.014709] [c0745f70] [c06614f4] console_init+0x114/0x1cc [ 0.014795] [c0745fb0] [c0658b68] start_kernel+0x300/0x3d8 [ 0.014864] [c0745ff0] [c00022cc] start_here+0x44/0x98 Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman arch/powerpc/kernel/head_8xx.S | 3 +++ 1 file changed, 3 insertions(+) commit e93ba1b7eb5b188c749052df7af1c90821c5f320 Author: Christophe Leroy Date: Fri Nov 16 17:27:42 2018 +0000 powerpc/book3s/32: fix number of bats in p/v_block_mapped() This patch fixes the loop in p_block_mapped() and v_block_mapped() to scan the entire bat_addrs[] array. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman arch/powerpc/mm/ppc_mmu_32.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 712877f8740471d96f703647d813d8a74fccc816 Author: Christophe Leroy Date: Fri Nov 16 17:08:03 2018 +0000 powerpc/mm: Eliminate not possible mmu features at compile time Depending on the CONFIG selected, many of the MMU features are not possible. Lets only get the possible ones in MMU_FTRS_POSSIBLE. This allows gcc to get rid at compile time of code related to not possible features. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman arch/powerpc/include/asm/mmu.h | 31 ++++++++++++++++++++++++++----- 1 file changed, 26 insertions(+), 5 deletions(-) commit 8a01960fb5bd95b920657133de52259227ee6ad7 Author: Christophe Leroy Date: Fri Nov 9 17:33:32 2018 +0000 powerpc/smp: Use code patching to restore reset vector Instead of hardcoding reset vector restore, use patch_instruction() Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman arch/powerpc/platforms/86xx/mpc86xx_smp.c | 3 +-- arch/powerpc/platforms/powermac/smp.c | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) commit 6c16816b91a64a33033930fbe2ae3f02e012d8bd Author: Christophe Leroy Date: Fri Nov 9 17:33:30 2018 +0000 powerpc/44x: use patch_sites for TLB handlers patching Use patch sites and associated helpers to manage TLB handlers patching instead of hardcoding. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman arch/powerpc/include/asm/nohash/32/mmu-44x.h | 3 +++ arch/powerpc/kernel/head_44x.S | 11 +++++------ arch/powerpc/mm/44x_mmu.c | 14 +++----------- 3 files changed, 11 insertions(+), 17 deletions(-) commit d16952a629129ce3f20ff7299de87c4d63b27a30 Author: Christophe Leroy Date: Fri Nov 9 17:33:28 2018 +0000 powerpc/signal: Use code patching instead of hardcoding Instead of hardcoding code modifications, use code patching functions. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman arch/powerpc/include/asm/ppc-opcode.h | 1 + arch/powerpc/kernel/signal_32.c | 12 ++++++------ arch/powerpc/kernel/signal_64.c | 7 ++++--- 3 files changed, 11 insertions(+), 9 deletions(-) commit 002cdfc2c78642deef24a77fab400a7f88781266 Author: Christophe Leroy Date: Fri Nov 9 17:33:26 2018 +0000 powerpc/8xx: use modify_instruction_site() Instead of hardcoding the TLB handlers patching, use the newly created modify_instruction_site() helper. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman arch/powerpc/mm/8xx_mmu.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) commit 9efc74ff52952c854f4a1a3c1bc8cd82df6b9c9e Author: Christophe Leroy Date: Fri Nov 9 17:33:24 2018 +0000 powerpc/book3s/32: Use patch_site to patch hash functions Use patch_sites and the new modify_instruction_site() function instead of hardcoding hash functions patching. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman arch/powerpc/include/asm/book3s/32/mmu-hash.h | 6 +++++ arch/powerpc/mm/hash_low_32.S | 33 ++++++++++++++----------- arch/powerpc/mm/ppc_mmu_32.c | 35 ++++++++------------------- 3 files changed, 35 insertions(+), 39 deletions(-) commit 4a3a224c5ae31fc9dc86bc9d8011f6bdc0e0c48d Author: Christophe Leroy Date: Fri Nov 9 17:33:22 2018 +0000 powerpc/book3s/32: Use MMU_FTR_HPTE_TABLE in head_32.S Instead of manually patching a blr at hash_page() entry in MMU_init_hw(), this patch adds a features section in head_32.S Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman arch/powerpc/kernel/head_32.S | 4 ++++ arch/powerpc/mm/ppc_mmu_32.c | 12 +----------- 2 files changed, 5 insertions(+), 11 deletions(-) commit 04b0a72f2807ba40b155fc1689e38569779527ca Author: Christophe Leroy Date: Fri Nov 9 17:33:20 2018 +0000 powerpc/32: use patch_site_addr() in machine_init() Use patch_site_addr() instead of hardcoding the address calculation in machine_init() Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman arch/powerpc/kernel/setup_32.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 36b08b431e2e282f78d09921ca55652d2c55eee5 Author: Christophe Leroy Date: Fri Nov 9 17:33:17 2018 +0000 powerpc: add modify_instruction() and modify_instruction_site() Add two helpers to avoid hardcoding of instructions modifications. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman arch/powerpc/include/asm/code-patching.h | 11 +++++++++++ 1 file changed, 11 insertions(+) commit 45090c26614fe991d9d5a2cd08e65c4d6680549a Author: Christophe Leroy Date: Fri Nov 9 17:33:15 2018 +0000 powerpc: simplify patch_instruction_site() and patch_branch_site() Using patch_site_addr() helper, patch_instruction_site() and patch_branch_site() can be simplified and inlined. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman arch/powerpc/include/asm/code-patching.h | 12 ++++++++++-- arch/powerpc/lib/code-patching.c | 16 ---------------- 2 files changed, 10 insertions(+), 18 deletions(-) commit 584dbc7727a22459dfcb6e4c9faef6467d08ab5e Author: Christophe Leroy Date: Thu Oct 18 05:22:06 2018 +0000 powerpc/mm: remove unused variable In file included from ./include/linux/hugetlb.h:445:0, from arch/powerpc/kernel/setup-common.c:37: ./arch/powerpc/include/asm/hugetlb.h: In function ‘huge_ptep_clear_flush’: ./arch/powerpc/include/asm/hugetlb.h:154:8: error: variable ‘pte’ set but not used [-Werror=unused-but-set-variable] Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman arch/powerpc/include/asm/hugetlb.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 6bf752daca07c85c181159f75dcf65b12056883b Author: Christophe Leroy Date: Wed Dec 19 07:09:39 2018 +0000 powerpc: implement CONFIG_DEBUG_VIRTUAL This patch implements CONFIG_DEBUG_VIRTUAL to warn about incorrect use of virt_to_phys() and page_to_phys() Below is the result of test_debug_virtual: [ 1.438746] WARNING: CPU: 0 PID: 1 at ./arch/powerpc/include/asm/io.h:808 test_debug_virtual_init+0x3c/0xd4 [ 1.448156] CPU: 0 PID: 1 Comm: swapper Not tainted 4.20.0-rc5-00560-g6bfb52e23a00-dirty #532 [ 1.457259] NIP: c066c550 LR: c0650ccc CTR: c066c514 [ 1.462257] REGS: c900bdb0 TRAP: 0700 Not tainted (4.20.0-rc5-00560-g6bfb52e23a00-dirty) [ 1.471184] MSR: 00029032 CR: 48000422 XER: 20000000 [ 1.477811] [ 1.477811] GPR00: c0650ccc c900be60 c60d0000 00000000 006000c0 c9000000 00009032 c7fa0020 [ 1.477811] GPR08: 00002400 00000001 09000000 00000000 c07b5d04 00000000 c00037d8 00000000 [ 1.477811] GPR16: 00000000 00000000 00000000 00000000 c0760000 c0740000 00000092 c0685bb0 [ 1.477811] GPR24: c065042c c068a734 c0685b8c 00000006 00000000 c0760000 c075c3c0 ffffffff [ 1.512711] NIP [c066c550] test_debug_virtual_init+0x3c/0xd4 [ 1.518315] LR [c0650ccc] do_one_initcall+0x8c/0x1cc [ 1.523163] Call Trace: [ 1.525595] [c900be60] [c0567340] 0xc0567340 (unreliable) [ 1.530954] [c900be90] [c0650ccc] do_one_initcall+0x8c/0x1cc [ 1.536551] [c900bef0] [c0651000] kernel_init_freeable+0x1f4/0x2cc [ 1.542658] [c900bf30] [c00037ec] kernel_init+0x14/0x110 [ 1.547913] [c900bf40] [c000e1d0] ret_from_kernel_thread+0x14/0x1c [ 1.553971] Instruction dump: [ 1.556909] 3ca50100 bfa10024 54a5000e 3fa0c076 7c0802a6 3d454000 813dc204 554893be [ 1.564566] 7d294010 7d294910 90010034 39290001 <0f090000> 7c3e0b78 955e0008 3fe0c062 [ 1.572425] ---[ end trace 6f6984225b280ad6 ]--- [ 1.577467] PA: 0x09000000 for VA: 0xc9000000 [ 1.581799] PA: 0x061e8f50 for VA: 0xc61e8f50 Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman arch/powerpc/Kconfig | 1 + arch/powerpc/include/asm/io.h | 13 ++++++++++++- arch/powerpc/mm/pgtable_32.c | 2 +- 3 files changed, 14 insertions(+), 2 deletions(-) commit 604c01d567cb9ee7d19dc598272cb90ab6229a8a Author: yupeng Date: Tue Dec 18 17:59:53 2018 +0100 nvme-pci: trace SQ status on completions Export the disk name, queue id, sq_head, sq_tail to a trace event in completion handling. Usage example: cd /sys/kernel/debug/tracing/events/nvme/nvme_sq echo 'disk=="nvme1n1"' > filter echo 1 > enable cat /sys/kernel/debug/tracing/trace_pipe Signed-off-by: yupeng Reviewed-by: Sagi Grimberg Reviewed-by: Keith Busch [hch: slight formatting tweaks, use standard nvme tracepoint conventions] Signed-off-by: Christoph Hellwig wip drivers/nvme/host/pci.c | 2 ++ drivers/nvme/host/trace.c | 3 +++ drivers/nvme/host/trace.h | 23 +++++++++++++++++++++++ 3 files changed, 28 insertions(+) commit 0fe6dc4d689286ef81fbc2f4833398fac89d798e Author: Michael Straube Date: Tue Dec 18 19:34:51 2018 +0100 staging: rtl8188eu: cleanup brace coding style issues Cleanup brace coding style issues reported by checkpatch. ERROR: space required before the open brace '{' WARNING: braces {} are not necessary for single statement blocks CHECK: Unbalanced braces around else statement Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8188eu/core/rtw_cmd.c | 3 +-- drivers/staging/rtl8188eu/core/rtw_security.c | 4 ++-- drivers/staging/rtl8188eu/hal/phy.c | 4 ++-- drivers/staging/rtl8188eu/hal/rtl8188e_cmd.c | 7 +++---- drivers/staging/rtl8188eu/hal/rtl8188e_hal_init.c | 3 +-- 5 files changed, 9 insertions(+), 12 deletions(-) commit 241e15dbfc9fe40a8ae1f046fa8a96e839a71161 Author: Michael Straube Date: Tue Dec 18 19:34:50 2018 +0100 staging: rtl8188eu: add spaces around '&' in rtw_mlme_ext.c Add spaces around '&' to follow kernel coding style. Reported by checkpatch. Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8188eu/core/rtw_mlme_ext.c | 90 +++++++++++++-------------- 1 file changed, 45 insertions(+), 45 deletions(-) commit e54a823e90fe9a49cd6573dda99440045c164851 Author: Michael Straube Date: Tue Dec 18 19:34:49 2018 +0100 staging: rtl8188eu: change return type of is_basicrate() to bool The function is_basicrate() returns true or false, so change the return type from int to bool. Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8188eu/core/rtw_wlan_util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 79ebad324b487729d4aabddcb81e80c94b6f11c3 Author: Michael Straube Date: Tue Dec 18 19:34:48 2018 +0100 staging: rtl8188eu: simplify null array initializations Simplfy initialization of null arrays to improve readability and save some lines. Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8188eu/core/rtw_mlme_ext.c | 4 ++-- drivers/staging/rtl8188eu/core/rtw_xmit.c | 6 ++---- 2 files changed, 4 insertions(+), 6 deletions(-) commit b7d54304d92facd3df766d1a1aa283379d719d96 Author: Michael Straube Date: Tue Dec 18 19:34:47 2018 +0100 staging: rtl8188eu: change order of declarations to improve readability Change the order of array declarations in rtw_mlme_ext.c to improve readability. Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8188eu/core/rtw_mlme_ext.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7a6394398f4e2305ca91020683080e4da5dbbaca Author: Michael Straube Date: Tue Dec 18 19:34:46 2018 +0100 staging: rtl8188eu: make some arrays static in rtw_mlme_ext.c Make some arrays that are only used in rtw_mlme_ext.c static and remove the corresponding extern declarations from rtw_mlme_ext.h. Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8188eu/core/rtw_mlme_ext.c | 6 +++--- drivers/staging/rtl8188eu/include/rtw_mlme_ext.h | 5 ----- 2 files changed, 3 insertions(+), 8 deletions(-) commit 03449acb77fd8bdfb8b7101a2eb429b1cffe67c2 Author: Michael Straube Date: Tue Dec 18 19:34:45 2018 +0100 staging: rtl8188eu: constify some arrays The values of these arrays in rtw_mlme_ext.c and rtw_wlan_util.c are never changed, so make them const. Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8188eu/core/rtw_mlme_ext.c | 14 ++++++------- drivers/staging/rtl8188eu/core/rtw_wlan_util.c | 26 ++++++++++++------------ drivers/staging/rtl8188eu/include/rtw_mlme.h | 4 ++-- drivers/staging/rtl8188eu/include/rtw_mlme_ext.h | 10 ++++----- 4 files changed, 27 insertions(+), 27 deletions(-) commit 0ef9f86b935274a00d781a0245cb16d62eda501a Author: Michael Straube Date: Tue Dec 18 19:34:44 2018 +0100 staging: rtl8188eu: convert unsigned char arrays to u8 Change the type of some arrays from unsigned char to u8. Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8188eu/core/rtw_mlme_ext.c | 16 ++++++++-------- drivers/staging/rtl8188eu/core/rtw_wlan_util.c | 22 +++++++++++----------- drivers/staging/rtl8188eu/include/rtw_mlme.h | 6 +++--- drivers/staging/rtl8188eu/include/rtw_mlme_ext.h | 10 +++++----- 4 files changed, 27 insertions(+), 27 deletions(-) commit 55fc57809a2b741a6b2a0779bb9544f60f410b71 Author: Michael Straube Date: Tue Dec 18 19:34:43 2018 +0100 staging: rtl8188eu: remove redundant declaration in rtw_mlme_ext.c The array REALTEK_96B_IE is already declared in rtw_mlme.h, so remove the declaration in rtw_mlme_ext.c. Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8188eu/core/rtw_mlme_ext.c | 2 -- 1 file changed, 2 deletions(-) commit 4f1a961ae15cb416219ed5488627490f3f0ff358 Author: Michael Straube Date: Tue Dec 18 19:34:42 2018 +0100 staging: rtl8188eu: remove unused arrays WFD_OUI and WMM_INFO_OUI The arrays WFD_OUI and WMM_INFO_OUI are not used anywhere, so remove them. Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8188eu/core/rtw_mlme_ext.c | 2 -- drivers/staging/rtl8188eu/include/rtw_mlme_ext.h | 2 -- 2 files changed, 4 deletions(-) commit 25c641ec2aa1b6952f6e1e193a9ecb65c88db89c Author: Michael Straube Date: Tue Dec 18 19:34:41 2018 +0100 staging: rtl8188eu: remove unnecessary parentheses in rtw_mlme_ext.c Remove unnecessary parentheses, most of them reported by checkpatch. Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8188eu/core/rtw_mlme_ext.c | 322 +++++++++++++------------- 1 file changed, 161 insertions(+), 161 deletions(-) commit 011844addf0f6c272133c680ebf0406f47cfd09b Author: Michael Straube Date: Tue Dec 18 19:34:40 2018 +0100 staging: rtl8188eu: remove unnecessary comments in rtw_mlme_ext.c Remove comments from 'endif's where the corresponding 'if' is just a few lines above to improve readability. Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8188eu/core/rtw_mlme_ext.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 7acaed81abe13a279b375cfd2a863223baa97e55 Author: Michael Straube Date: Tue Dec 18 19:34:39 2018 +0100 staging: rtl8188eu: add blank line after declarations Add a missing blank line after declarations in rtw_mlme_ext.c. Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8188eu/core/rtw_mlme_ext.c | 1 + 1 file changed, 1 insertion(+) commit f20ac243ff745f0e8a4d125ad9dcf50640b73fb7 Author: Michael Straube Date: Tue Dec 18 19:34:38 2018 +0100 staging: rtl8188eu: remove blank lines between declarations Remove blank lines between declarations in rtw_mlme_ext.c. Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8188eu/core/rtw_mlme_ext.c | 2 -- 1 file changed, 2 deletions(-) commit 83691365f1845754251e25619bae185f96279005 Author: Michael Straube Date: Tue Dec 18 19:34:37 2018 +0100 staging: rtl8188eu: remove commented declarations in rtw_mlme_ext.c Remove unused/commented declarations. Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8188eu/core/rtw_mlme_ext.c | 3 --- 1 file changed, 3 deletions(-) commit 1673616a006aa04758c17ad78f6d5286d6eed091 Author: Michael Straube Date: Tue Dec 18 19:34:36 2018 +0100 staging: rtl8188eu: replace tabs with spaces in rtw_mlme_ext.c Replace tabs with spaces where appropriate. Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8188eu/core/rtw_mlme_ext.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 502b90d4c68751bc0635f997fd33e92a57d250cf Author: Michael Straube Date: Tue Dec 18 19:34:35 2018 +0100 staging: rtl8188eu: cleanup declarations in rtw_mlme_ext.c Replace tabs with spaces and/or remove spaces in declarations. Signed-off-by: Michael Straube Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8188eu/core/rtw_mlme_ext.c | 482 +++++++++++++------------- 1 file changed, 241 insertions(+), 241 deletions(-) commit b57f944785c5764725a7a6eff548a70bafb41a2a Author: YueHaibing Date: Tue Dec 18 22:28:21 2018 +0800 staging: fbtft: fix strncmp() size warning strncmp() stops comparing when either the end of one of the first two arguments is reached or when 'n' characters have been compared, whichever comes first.That means that strncmp(s1, s2, n) is equivalent to strcmp(s1, s2) if n exceeds the length of s1 or the length of s2. This patch avoids that the following warning is reported by smatch: drivers/staging/fbtft/fbtft_device.c:1458 fbtft_device_init() error: strncmp() '"list"' too small (5 vs 32) Signed-off-by: YueHaibing Signed-off-by: Greg Kroah-Hartman drivers/staging/fbtft/fbtft_device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a86028f8e3eea59517cb47895faad04b6ae8d8e1 Author: Colin Ian King Date: Tue Dec 18 11:35:52 2018 +0000 staging: most: sound: replace snprintf with strscpy Using snprintf without a format specifier is potentially risky if the string device_name contains format specifiers. Replace this with the safer and more efficient strscpy. Cleans up clang warning: drivers/staging/most/sound/sound.c:673:41: warning: format string is not a string literal (potentially insecure) [-Wformat-security] Signed-off-by: Colin Ian King Signed-off-by: Greg Kroah-Hartman drivers/staging/most/sound/sound.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9d84d3e6bd6871a0c410fc1c0571fa025236bf7e Author: Aisheng Dong Date: Mon Dec 17 15:00:51 2018 +0000 dt-bindings: serial: lpuart: add imx8qxp compatible string Add imx8qxp compatible string Cc: Mark Rutland Cc: linux-serial@vger.kernel.org Cc: devicetree@vger.kernel.org Cc: Greg Kroah-Hartman Reviewed-by: Rob Herring Signed-off-by: Dong Aisheng Signed-off-by: Greg Kroah-Hartman Documentation/devicetree/bindings/serial/fsl-lpuart.txt | 2 ++ 1 file changed, 2 insertions(+) commit 260683137ab5276113fc322fdbbc578024185fee Author: Nava kishore Manne Date: Tue Dec 18 13:18:42 2018 +0100 serial: uartps: Fix interrupt mask issue to handle the RX interrupts properly This patch Correct the RX interrupt mask value to handle the RX interrupts properly. Fixes: c8dbdc842d30 ("serial: xuartps: Rewrite the interrupt handling logic") Signed-off-by: Nava kishore Manne Cc: stable Signed-off-by: Michal Simek Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/xilinx_uartps.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 32cf21ac4edd6c0d5b9614368a83bcdc68acb031 Author: Michal Simek Date: Tue Dec 18 13:18:41 2018 +0100 serial: uartps: Fix error path when alloc failed When cdns_uart_console allocation failed there is a need to also clear ID from ID list. Fixes: ae1cca3fa347 ("serial: uartps: Change uart ID port allocation") Signed-off-by: Michal Simek Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/xilinx_uartps.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 82b1b2ec5d4057af11395ac03209884369418a0d Author: Shubhrajyoti Datta Date: Tue Dec 18 13:18:40 2018 +0100 serial: uartps: Check if the device is a console While checking for console_suspend_enabled also check if the device is a console. Signed-off-by: Shubhrajyoti Datta Signed-off-by: Michal Simek Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/xilinx_uartps.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 86df8dd147233fd1705b9f7a8541d1501d4c5295 Author: Shubhrajyoti Datta Date: Tue Dec 18 13:18:39 2018 +0100 serial: uartps: Add the device_init_wakeup Initialise the device wakeup. The device_init_wakeup is needed for the wakeup to work by default. Uart can be configured as the primary wakeup source so it is good to enable wakeup by default. The same functionality is enabled also by 8250_omap, atmel_serial, omap-serial and stm32-usart. Signed-off-by: Shubhrajyoti Datta Signed-off-by: Michal Simek Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/xilinx_uartps.c | 2 ++ 1 file changed, 2 insertions(+) commit c85400f886e3d41e69966470879f635a2b50084c Author: Jia-Ju Bai Date: Tue Dec 18 20:04:25 2018 +0800 usb: r8a66597: Fix a possible concurrency use-after-free bug in r8a66597_endpoint_disable() The function r8a66597_endpoint_disable() and r8a66597_urb_enqueue() may be concurrently executed. The two functions both access a possible shared variable "hep->hcpriv". This shared variable is freed by r8a66597_endpoint_disable() via the call path: r8a66597_endpoint_disable kfree(hep->hcpriv) (line 1995 in Linux-4.19) This variable is read by r8a66597_urb_enqueue() via the call path: r8a66597_urb_enqueue spin_lock_irqsave(&r8a66597->lock) init_pipe_info enable_r8a66597_pipe pipe = hep->hcpriv (line 802 in Linux-4.19) The read operation is protected by a spinlock, but the free operation is not protected by this spinlock, thus a concurrency use-after-free bug may occur. To fix this bug, the spin-lock and spin-unlock function calls in r8a66597_endpoint_disable() are moved to protect the free operation. Signed-off-by: Jia-Ju Bai Cc: stable Signed-off-by: Greg Kroah-Hartman drivers/usb/host/r8a66597-hcd.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit c710d0bb76ff0795d8b6c1cda1e01e6e1e661a4a Author: Kyle Tso Date: Mon Dec 17 21:22:13 2018 +0800 usb: typec: tcpm: Extend the matching rules on PPS APDO selection Current matching rules ensure that the voltage range of selected Source Capability is entirely within the range defined in one of the Sink Capabilities. This is reasonable but not practical because Sink may not support wide range of voltage when sinking power while Source could advertise its capabilities in relatively wider range. For example, a Source PDO advertising 3.3V-11V@3A (9V Prog of Fixed Nominal Voltage) will not be selected if the Sink requires 5V-12V@3A PPS power. However, the Sink could work well if the requested voltage range in RDOs is 5V-11V@3A. Currently accepted: |--------- source -----| |----------- sink ---------------| Currently not accepted: |--------- source -----| |----------- sink ---------------| |--------- source -----| |----------- sink ---------------| |--------- source -----------------| |------ sink -------| To improve the usability, change the matching rules to what listed below: a. The Source PDO is selectable if any portion of the voltage range overlaps one of the Sink PDO's voltage range. b. The maximum operational voltage will be the lower one between the selected Source PDO and the matching Sink PDO. c. The maximum power will be the maximum operational voltage times the maximum current defined in the selected Source PDO d. Select the Source PDO with the highest maximum power Signed-off-by: Kyle Tso Acked-by: Adam Thomson Reviewed-by: Heikki Krogerus Signed-off-by: Greg Kroah-Hartman drivers/usb/typec/tcpm/tcpm.c | 35 ++++++++++++++++++++--------------- 1 file changed, 20 insertions(+), 15 deletions(-) commit 28ce553985fa23815d942e8ad4294dec30645e5b Author: Heikki Krogerus Date: Tue Dec 18 13:53:08 2018 +0300 usb: typec: Improve Alt Mode documentation Adding the document to the usb index file and fixing a few references. Also, exposing the code examples as "literal blocks" so they are more easy to read. Signed-off-by: Heikki Krogerus Signed-off-by: Greg Kroah-Hartman Documentation/driver-api/usb/index.rst | 1 + Documentation/driver-api/usb/typec.rst | 1 + Documentation/driver-api/usb/typec_bus.rst | 24 ++++++++++++------------ 3 files changed, 14 insertions(+), 12 deletions(-) commit 2da711bcebe81209a9f2f90e145600eb1bae2b71 Author: Raghuram Hegde Date: Wed Dec 19 11:42:18 2018 +0530 Bluetooth: btusb: Add support for Intel bluetooth device 8087:0029 Include the new USB product ID for Intel Bluetooth device 22260 family(CcPeak) The /sys/kernel/debug/usb/devices portion for this device is: T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#= 2 Spd=12 MxCh= 0 D: Ver= 2.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=8087 ProdID=0029 Rev= 0.01 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms Signed-off-by: Raghuram Hegde Signed-off-by: Chethan T N Signed-off-by: Marcel Holtmann drivers/bluetooth/btusb.c | 72 ++++++++++++++++++++++++----------------------- 1 file changed, 37 insertions(+), 35 deletions(-) commit 33f18c96afdf4da20014f834874e2820ee880cde Author: Heiner Kallweit Date: Wed Dec 19 00:43:58 2018 +0100 net: ethernet: don't set phylib state CHANGELINK in drivers After phy_start() phylib takes care of all needed actions, including aneg settings and checking link state. There's no need to set state PHY_CHANGELINK in drivers. Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller drivers/net/ethernet/amd/au1000_eth.c | 5 +---- drivers/net/ethernet/ti/cpmac.c | 1 - 2 files changed, 1 insertion(+), 5 deletions(-) commit 2acc7957dbc354f3349261c2ebc6f56aff5829e7 Author: Leon Romanovsky Date: Thu Dec 6 14:40:11 2018 +0200 net/mlx5: Add shared Q counter bits Updated HW specification file with needed bits to allow sharing of Q counters between DEVX contexts and kernel. Signed-off-by: Leon Romanovsky include/linux/mlx5/mlx5_ifc.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 624b66f8c9945504232c253e64f7c28e5a5c04d6 Author: Alexandre Belloni Date: Tue Dec 18 15:25:39 2018 +0100 MAINTAINERS: Add a maintainer for Microsemi switches Microsemi has been bought by Microchip and Microchip is supporting those switches. Signed-off-by: Alexandre Belloni Acked-by: Woojung Huh Signed-off-by: David S. Miller MAINTAINERS | 1 + 1 file changed, 1 insertion(+) commit 5679ee784c89793537d233022b55a331a64aed9d Author: Zhenbo Gao Date: Tue Dec 18 17:43:52 2018 +0800 tipc: handle broadcast NAME_DISTRIBUTOR packet when receiving it NAME_DISTRIBUTOR messages are transmitted through unicast link on TIPC 2.0, by contrast, the messages are delivered through broadcast link on TIPC 1.7. But at present, NAME_DISTRIBUTOR messages received by broadcast link cannot be handled in tipc_rcv() until an unicast message arrives, which may lead to a significant delay to update name table. To avoid this delay, we will also deal with broadcast NAME_DISTRIBUTOR message on broadcast receive path. Signed-off-by: Zhenbo Gao Reviewed-by: Ying Xue Signed-off-by: David S. Miller net/tipc/node.c | 4 ++++ 1 file changed, 4 insertions(+) commit 935b8a59ac80bf3d3caae6460fb95d028f7c92c8 Author: Heiner Kallweit Date: Mon Dec 17 23:43:25 2018 +0100 net: phy: remove unused code in phy_probe 3c1bcc8614db ("net: ethernet: Convert phydev advertize and supported from u32 to link mode") left some unused code in phy_probe(), remove it. Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller drivers/net/phy/phy_device.c | 2 -- 1 file changed, 2 deletions(-) commit 38417468d4f05cfed62fca8f407d2df0cbe3fcc8 Author: Christoph Hellwig Date: Thu Dec 13 16:17:10 2018 +0100 scsi: block: remove the cluster flag Now that the the SCSI layer replaced the use of the cluster flag with segment size limits and the DMA boundary we can remove the cluster flag from the block layer. Signed-off-by: Christoph Hellwig Reviewed-by: Jens Axboe Signed-off-by: Martin K. Petersen block/blk-merge.c | 18 +++++++----------- block/blk-settings.c | 3 --- block/blk-sysfs.c | 5 +---- include/linux/blkdev.h | 6 ------ 4 files changed, 8 insertions(+), 24 deletions(-) commit d6a9000b81befd436fe4bcdae76322928bda724c Author: Xiang Chen Date: Mon Dec 17 22:40:07 2018 +0800 scsi: hisi_sas: Add support for DIF feature for v2 hw For v3 hw, we support DIF operation for SAS, but not SATA. In addition, DIF CRC16 is supported. This patchset adds the SW support for the described features. The main components are as follows: - Get protection mask from module param - Fill PI fields - Fill related to DIF in DQ and protection iu memories Signed-off-by: Xiang Chen Signed-off-by: John Garry Signed-off-by: Martin K. Petersen drivers/scsi/hisi_sas/hisi_sas.h | 8 ++ drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 132 ++++++++++++++++++++++++++++++++- 2 files changed, 137 insertions(+), 3 deletions(-) commit 4e87eb2f46ea547d12a276b2e696ab934d16cfb6 Author: Ewan D. Milne Date: Thu Dec 13 15:25:16 2018 -0500 scsi: lpfc: do not set queue->page_count to 0 if pc_sli4_params.wqpcnt is invalid Certain older adapters such as the OneConnect OCe10100 may not have a valid wqpcnt value. In this case, do not set queue->page_count to 0 in lpfc_sli4_queue_alloc() as this will prevent the driver from initializing. Fixes: 895427bd01 ("scsi: lpfc: NVME Initiator: Base modifications") Cc: stable@vger.kernel.org # 4.11+ Signed-off-by: Ewan D. Milne Reviewed-by: Laurence Oberman Tested-by: Laurence Oberman Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc_sli.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 4af14d113bcf95c12d1462ba623b7e7117bd3fb3 Author: Christoph Hellwig Date: Thu Dec 13 16:17:09 2018 +0100 scsi: remove the use_clustering flag The same effects can be achieved by setting the dma_boundary to PAGE_SIZE - 1 and the max_segment_size to PAGE_SIZE, so shift those settings into the drivers. Note that in many cases the setting might be bogus, but this keeps the status quo. [mkp: fix myrs and myrb] Signed-off-by: Christoph Hellwig Signed-off-by: Martin K. Petersen Documentation/scsi/scsi_mid_low_api.txt | 2 -- arch/ia64/hp/sim/simscsi.c | 2 +- drivers/scsi/a2091.c | 2 +- drivers/scsi/advansys.c | 4 ++-- drivers/scsi/aha152x.c | 2 +- drivers/scsi/arm/acornscsi.c | 2 +- drivers/scsi/arm/arxescsi.c | 2 +- drivers/scsi/arm/cumana_1.c | 2 +- drivers/scsi/arm/oak.c | 2 +- drivers/scsi/atari_scsi.c | 2 +- drivers/scsi/cxgbi/cxgb3i/cxgb3i.c | 2 +- drivers/scsi/cxgbi/cxgb4i/cxgb4i.c | 2 +- drivers/scsi/dc395x.c | 2 +- drivers/scsi/dmx3191d.c | 2 +- drivers/scsi/g_NCR5380.c | 2 +- drivers/scsi/gvp11.c | 2 +- drivers/scsi/hosts.c | 1 - drivers/scsi/ips.c | 1 - drivers/scsi/iscsi_tcp.c | 2 +- drivers/scsi/mac_esp.c | 2 +- drivers/scsi/mac_scsi.c | 2 +- drivers/scsi/mvumi.c | 2 +- drivers/scsi/myrb.c | 2 +- drivers/scsi/myrs.c | 2 +- drivers/scsi/nsp32.c | 2 +- drivers/scsi/pcmcia/nsp_cs.c | 2 +- drivers/scsi/pcmcia/qlogic_stub.c | 2 +- drivers/scsi/qlogicfas.c | 2 +- drivers/scsi/scsi_debug.c | 3 ++- drivers/scsi/scsi_lib.c | 3 --- drivers/scsi/sgiwd93.c | 2 +- drivers/scsi/stex.c | 2 +- drivers/scsi/sun3_scsi.c | 2 +- drivers/scsi/ufs/ufshcd.c | 2 +- drivers/target/loopback/tcm_loop.c | 2 +- drivers/usb/storage/uas.c | 2 +- include/scsi/scsi_host.h | 13 ------------- 37 files changed, 34 insertions(+), 53 deletions(-) commit 1c3726ad30938725a53f471d7967abfd6838330f Author: Christoph Hellwig Date: Thu Dec 13 16:17:08 2018 +0100 scsi: mac53c94: remove DISABLE_CLUSTERING mac53c94 has no limitations on crossing pages for segments. Just make the 65535 byte segment size limit explicit, even if it matches the current block layer limit. Signed-off-by: Christoph Hellwig Tested-by: Paul Mackerras Signed-off-by: Martin K. Petersen drivers/scsi/mac53c94.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5bd6cd54bd01171176e8be510d429720a3fd2dce Author: Christoph Hellwig Date: Thu Dec 13 16:17:07 2018 +0100 scsi: mesh: remove DISABLE_CLUSTERING mesh has no limitations on crossing pages for segments. Just make the 65535 byte segment size limit explicit, even if it matches the current block layer limit. Signed-off-by: Christoph Hellwig Tested-by: Paul Mackerras Signed-off-by: Martin K. Petersen drivers/scsi/mesh.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e08ea3009f539e62280eca98a70b5d26d29b62cf Author: Christoph Hellwig Date: Thu Dec 13 16:17:06 2018 +0100 scsi: xen-scsifront: remove DISABLE_CLUSTERING There is no such limitation in the protocol or implementation, so remove it. Signed-off-by: Christoph Hellwig Reviewed-by: Juergen Gross Signed-off-by: Martin K. Petersen drivers/scsi/xen-scsifront.c | 1 - 1 file changed, 1 deletion(-) commit 7b44047bce9c9d2c5020f5fb3dc94dd7b88cc355 Author: Christoph Hellwig Date: Thu Dec 13 16:17:05 2018 +0100 scsi: powertec: remove the explicit use_clustering setting This driver already sets the dma_boundary to PAGE_SIZE - 1, which has the same result. Signed-off-by: Christoph Hellwig Signed-off-by: Martin K. Petersen drivers/scsi/arm/eesox.c | 1 - 1 file changed, 1 deletion(-) commit 736c23d6caa5a1383391e1d45537829cebf92257 Author: Christoph Hellwig Date: Thu Dec 13 16:17:04 2018 +0100 scsi: cumana_2: remove the explicit use_clustering setting This driver already sets the dma_boundary to PAGE_SIZE - 1, which has the same result. Signed-off-by: Christoph Hellwig Signed-off-by: Martin K. Petersen drivers/scsi/arm/cumana_2.c | 1 - 1 file changed, 1 deletion(-) commit 50c2e9107f176a82e14567b39c5d0f2a208cc82c Author: Christoph Hellwig Date: Thu Dec 13 16:17:03 2018 +0100 scsi: introduce a max_segment_size host_template parameters This allows the host driver to indicate the maximum supported segment size in a nice an easy way, so that the driver doesn't have to worry about DMA-layer imposed limitations. Signed-off-by: Christoph Hellwig Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen drivers/scsi/be2iscsi/be_main.c | 8 +------- drivers/scsi/hosts.c | 5 +++++ drivers/scsi/scsi_debug.c | 2 +- drivers/scsi/scsi_lib.c | 3 ++- include/scsi/scsi_host.h | 6 ++++++ 5 files changed, 15 insertions(+), 9 deletions(-) commit 2a3d4eb8e228061c09d5ca8bf39e7f00c2091213 Author: Christoph Hellwig Date: Thu Dec 13 16:17:02 2018 +0100 scsi: flip the default on use_clustering Most SCSI drivers want to enable "clustering", that is merging of segments so that they might span more than a single page. Remove the ENABLE_CLUSTERING define, and require drivers to explicitly set DISABLE_CLUSTERING to disable this feature. Signed-off-by: Christoph Hellwig Signed-off-by: Martin K. Petersen drivers/firewire/sbp2.c | 1 - drivers/infiniband/ulp/iser/iscsi_iser.c | 1 - drivers/infiniband/ulp/srp/ib_srp.c | 1 - drivers/message/fusion/mptfc.c | 1 - drivers/message/fusion/mptsas.c | 1 - drivers/message/fusion/mptspi.c | 1 - drivers/s390/scsi/zfcp_scsi.c | 1 - drivers/scsi/3w-9xxx.c | 1 - drivers/scsi/3w-sas.c | 1 - drivers/scsi/3w-xxxx.c | 1 - drivers/scsi/53c700.c | 1 - drivers/scsi/BusLogic.c | 1 - drivers/scsi/a100u2w.c | 1 - drivers/scsi/a3000.c | 1 - drivers/scsi/aacraid/linit.c | 1 - drivers/scsi/advansys.c | 8 -------- drivers/scsi/aha1542.c | 1 - drivers/scsi/aha1740.c | 1 - drivers/scsi/aic7xxx/aic79xx_osm.c | 1 - drivers/scsi/aic7xxx/aic7xxx_osm.c | 1 - drivers/scsi/aic94xx/aic94xx_init.c | 1 - drivers/scsi/arcmsr/arcmsr_hba.c | 1 - drivers/scsi/arm/powertec.c | 1 - drivers/scsi/atp870u.c | 1 - drivers/scsi/be2iscsi/be_main.c | 1 - drivers/scsi/bfa/bfad_im.c | 2 -- drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 1 - drivers/scsi/bnx2i/bnx2i_iscsi.c | 1 - drivers/scsi/csiostor/csio_scsi.c | 2 -- drivers/scsi/cxlflash/main.c | 1 - drivers/scsi/dpt_i2o.c | 1 - drivers/scsi/esas2r/esas2r_main.c | 1 - drivers/scsi/esp_scsi.c | 1 - drivers/scsi/fcoe/fcoe.c | 1 - drivers/scsi/fnic/fnic_main.c | 1 - drivers/scsi/gdth.c | 1 - drivers/scsi/hisi_sas/hisi_sas_v1_hw.c | 1 - drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 1 - drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 1 - drivers/scsi/hpsa.c | 1 - drivers/scsi/hptiop.c | 1 - drivers/scsi/ibmvscsi/ibmvfc.c | 1 - drivers/scsi/ibmvscsi/ibmvscsi.c | 1 - drivers/scsi/imm.c | 1 - drivers/scsi/initio.c | 1 - drivers/scsi/ipr.c | 1 - drivers/scsi/ips.c | 1 - drivers/scsi/isci/init.c | 1 - drivers/scsi/lpfc/lpfc_scsi.c | 4 ---- drivers/scsi/megaraid.c | 1 - drivers/scsi/megaraid/megaraid_mbox.c | 1 - drivers/scsi/megaraid/megaraid_sas_base.c | 1 - drivers/scsi/mpt3sas/mpt3sas_scsih.c | 2 -- drivers/scsi/mvme147.c | 1 - drivers/scsi/mvsas/mv_init.c | 1 - drivers/scsi/ncr53c8xx.c | 1 - drivers/scsi/pcmcia/sym53c500_cs.c | 1 - drivers/scsi/pm8001/pm8001_init.c | 1 - drivers/scsi/pmcraid.c | 1 - drivers/scsi/ppa.c | 1 - drivers/scsi/ps3rom.c | 1 - drivers/scsi/qedf/qedf_main.c | 1 - drivers/scsi/qedi/qedi_iscsi.c | 1 - drivers/scsi/qla1280.c | 1 - drivers/scsi/qla2xxx/qla_os.c | 1 - drivers/scsi/qla4xxx/ql4_os.c | 1 - drivers/scsi/qlogicpti.c | 1 - drivers/scsi/scsi_debug.c | 5 ++--- drivers/scsi/scsi_lib.c | 2 +- drivers/scsi/smartpqi/smartpqi_init.c | 1 - drivers/scsi/snic/snic_main.c | 1 - drivers/scsi/storvsc_drv.c | 1 - drivers/scsi/sym53c8xx_2/sym_glue.c | 1 - drivers/scsi/virtio_scsi.c | 1 - drivers/scsi/vmw_pvscsi.c | 1 - drivers/scsi/wd719x.c | 1 - drivers/staging/rts5208/rtsx.c | 6 ------ drivers/staging/unisys/visorhba/visorhba_main.c | 1 - drivers/usb/image/microtek.c | 1 - drivers/usb/storage/scsiglue.c | 7 ------- include/linux/libata.h | 2 -- include/scsi/scsi_host.h | 3 +-- 82 files changed, 4 insertions(+), 110 deletions(-) commit 4dd4130a722fb046e941010cf5576aed252bb58a Author: Christoph Hellwig Date: Thu Dec 13 16:17:01 2018 +0100 scsi: make sure all drivers set the use_clustering flag A few drivers were not setting the use_clustering flag at all and thus default to disable. Fix them up to explicitly set this field in preparation for additional cleanups. Signed-off-by: Christoph Hellwig Signed-off-by: Martin K. Petersen drivers/scsi/mvumi.c | 1 + drivers/scsi/myrb.c | 1 + drivers/scsi/myrs.c | 1 + drivers/scsi/stex.c | 1 + drivers/scsi/ufs/ufshcd.c | 1 + drivers/usb/storage/uas.c | 1 + 6 files changed, 6 insertions(+) commit 8b2db98e814a5ec45e8800fc22ca9000ae0a517b Author: Wei Yongjun Date: Mon Dec 17 12:19:53 2018 +0000 scsi: target/core: Use kmem_cache_free() instead of kfree() memory allocated by kmem_cache_alloc() should be freed using kmem_cache_free(), not kfree(). Fixes: ad669505c4e9 ("scsi: target/core: Make sure that target_wait_for_sess_cmds() waits long enough") Signed-off-by: Wei Yongjun Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen drivers/target/target_core_transport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c29d7d10cd1ed04eb2fa6baef8af65f1fded6ea6 Author: Bart Van Assche Date: Fri Dec 14 09:35:11 2018 -0800 scsi: virtio_scsi: Remove per-target data because it is no longer used Commit b5b6e8c8d3b4 ("scsi: virtio_scsi: fix IO hang caused by automatic irq vector affinity") removed all virtio_scsi hostdata users. Since the SCSI host data is no longer used, also remove the host data itself. Cc: Paolo Bonzini Cc: Christoph Hellwig Cc: Ming Lei Cc: Hannes Reinecke Signed-off-by: Bart Van Assche Reviewed-by: Christoph Hellwig Reviewed-by: Ming Lei Signed-off-by: Martin K. Petersen drivers/scsi/virtio_scsi.c | 52 ---------------------------------------------- 1 file changed, 52 deletions(-) commit e00b64f7c54c4cbd88143bbd43e7c3d61a090e5c Author: Shamir Rabinovitch Date: Mon Dec 17 17:15:18 2018 +0200 RDMA: Cleanup undesired pd->uobject usage Drivers should be using udata to determine if a method is invoked from user space or kernel space. A pd does not necessarily say a different objects is kernel or user. Transforming the tests to use udata eliminates a large number of uobject references from the drivers. Signed-off-by: Shamir Rabinovitch Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/bnxt_re/ib_verbs.c | 4 +-- drivers/infiniband/hw/cxgb3/iwch_provider.c | 2 +- drivers/infiniband/hw/cxgb4/qp.c | 4 +-- drivers/infiniband/hw/hns/hns_roce_hw_v1.c | 2 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 4 +-- drivers/infiniband/hw/hns/hns_roce_qp.c | 18 +++++------ drivers/infiniband/hw/hns/hns_roce_srq.c | 2 +- drivers/infiniband/hw/i40iw/i40iw_verbs.c | 45 +++++++++++++-------------- drivers/infiniband/hw/mlx4/qp.c | 20 ++++++------ drivers/infiniband/hw/mlx4/srq.c | 10 +++--- drivers/infiniband/hw/mlx5/qp.c | 10 +++--- drivers/infiniband/hw/mlx5/srq.c | 8 ++--- drivers/infiniband/hw/mthca/mthca_dev.h | 9 ++++-- drivers/infiniband/hw/mthca/mthca_provider.c | 16 +++++----- drivers/infiniband/hw/mthca/mthca_qp.c | 22 +++++++------ drivers/infiniband/hw/mthca/mthca_srq.c | 29 +++++++++-------- drivers/infiniband/hw/nes/nes_verbs.c | 4 +-- drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 7 +++-- drivers/infiniband/hw/qedr/verbs.c | 9 +++--- drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c | 2 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c | 2 +- drivers/infiniband/sw/rxe/rxe_loc.h | 2 +- drivers/infiniband/sw/rxe/rxe_qp.c | 5 +-- drivers/infiniband/sw/rxe/rxe_verbs.c | 2 +- 24 files changed, 125 insertions(+), 113 deletions(-) commit 6c86bc23421ec7949d91b359d831bf8fcfa80ce5 Merge: a26d94bff4d5 ff9b85de5d5d Author: David S. Miller Date: Tue Dec 18 16:44:45 2018 -0800 Merge tag 'mlx5-uplink-rep-2018-12-15' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed: ==================== mlx5-uplink-rep-2018-12-15 Or Gerlitz says: This series is essentially a cleanup to align with the rest of the NIC switchdev drivers and make us more robust and clear/n: currently the PF netdev serves as the mlx5 e-switch uplink netdev representor when going into switchdev mode and back as plain NIC netdev when going out. This causes some irregularities and misc troubles. Move to use dedicated uplink rep, as we have for the VF vports. The uplink rep netdev does has sysfs link and supports the sriov vf mac ndo, these two are in use by libvirt and other orchestrators, It also has richer ethtool support to allow controlling the port link & mtu along with supporting dcb and plugging into the mlx5 lag logic. ==================== Signed-off-by: David S. Miller commit a26d94bff4d5af7c9bf5d5e779282e2258966ec3 Author: YueHaibing Date: Mon Dec 17 17:46:23 2018 +0800 net: bridge: remove unneeded variable 'err' function br_multicast_toggle now always return 0, so the variable 'err' is unneeded. Also cleanup dead branch in br_changelink. Signed-off-by: YueHaibing Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller net/bridge/br_multicast.c | 3 +-- net/bridge/br_netlink.c | 4 +--- 2 files changed, 2 insertions(+), 5 deletions(-) commit 8937388acb09d6bf0f263fa8551d3e2b4e84de25 Author: YueHaibing Date: Mon Dec 17 17:27:16 2018 +0800 qlcnic: remove set but not used variables 'op, cmd_op' Fixes gcc '-Wunused-but-set-variable' warning: drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c:1070:5: warning: variable 'op' set but not used [-Wunused-but-set-variable] drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c:1342:5: warning: variable 'cmd_op' set but not used [-Wunused-but-set-variable] 'op' never used since introduction in commit 7cb03b2347d5 ("qlcnic: Support VF-PF communication channel commands.") 'cmd_op' not used since commit 6226204bcf20 ("qlcnic: Fix operation type and command type.") Signed-off-by: YueHaibing Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) commit 8589086f4efd5756d20cedd844b865e5d20164ec Author: Hans de Goede Date: Tue Oct 30 14:17:23 2018 +0100 Bluetooth: hci_h5: Turn off RTL8723BS on suspend, reprobe on resume On many devices the RTL8723BS device gets reset during suspend/resume, causing it to lose its firmware and all state. Testing has shown it drops back to communicating at 115200 bps and sends sync-request packages, indicating it has been fully reset. This commit fixes this by queueing a reprobe on resume. This mirrors how USB RTL BT devices, which have the same problem, are handled in the btusb driver, there we set the USB_QUIRK_RESET_RESUME for all RTL devices, which also causes a reprobe on resume. The only difference is that here we need to do the reprobe ourselves. Since we are doing a full reprobe on resume now, we can also turn off the device on suspend to save power while suspended. Signed-off-by: Hans de Goede Signed-off-by: Marcel Holtmann drivers/bluetooth/hci_h5.c | 52 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+) commit 28a75e4c813c7ae7de5b4baf4c29369769247cc6 Author: Hans de Goede Date: Tue Oct 30 14:17:22 2018 +0100 Bluetooth: hci_h5: Add suspend / resume ops Add support for vendor specific suspend / resume callbacks. Signed-off-by: Hans de Goede Signed-off-by: Marcel Holtmann drivers/bluetooth/hci_h5.c | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) commit 76c43ae84e3f455e0b460ed0c43799e018d09ee9 Author: Yonghong Song Date: Tue Dec 18 13:43:58 2018 -0800 bpf: log struct/union attribute for forward type Current btf internal verbose logger logs fwd type as [2] FWD A type_id=0 where A is the type name. Commit 9d5f9f701b18 ("bpf: btf: fix struct/union/fwd types with kind_flag") introduced kind_flag which can be used to distinguish whether a forward type is a struct or union. Also, "type_id=0" does not carry any meaningful information for fwd type as btf_type.type = 0 is simply enforced during btf verification and is not used anywhere else. This commit changed the log to [2] FWD A struct if kind_flag = 0, or [2] FWD A union if kind_flag = 1. Acked-by: Martin KaFai Lau Signed-off-by: Yonghong Song Signed-off-by: Daniel Borkmann kernel/bpf/btf.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 7086b36b8080e6252162cf5d681f521738e7ced5 Author: Colin Ian King Date: Tue Oct 30 11:34:19 2018 +0000 Bluetooth: hci_intel: clean an indentation issue, remove extraneous spaces Trivial fix to clean up an indentation issue, remove spaces Signed-off-by: Colin Ian King Signed-off-by: Marcel Holtmann drivers/bluetooth/hci_intel.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 75edd1f2f916f06248cd6a6e8ea706b44431d3eb Author: Colin Ian King Date: Fri Nov 9 13:27:36 2018 +0000 Bluetooth: clean an indentation issue, remove extraneous space Trivial fix to clean up an indentation issue Signed-off-by: Colin Ian King Signed-off-by: Marcel Holtmann net/bluetooth/hci_request.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cba736465e5cbae22027789de748b8500e647555 Author: Balakrishna Godavarthi Date: Thu Nov 22 18:20:47 2018 +0530 Bluetooth: hci_serdev: Remove setting of HCI_QUIRK_RESET_ON_CLOSE. HCI_QUIRK_RESET_ON_CLOSE quirk is required for BT v1.0 based devices, to send a reset command to the chip during hci device close. Serdev architecture is used for the latest BT chips, which doesn't require to send the reset command during close. If still chips required reset command during close, it would be better enabling it in the vendor probes or in proto setup. Signed-off-by: Balakrishna Godavarthi Signed-off-by: Marcel Holtmann drivers/bluetooth/hci_serdev.c | 3 --- 1 file changed, 3 deletions(-) commit dff6d593b10fc04a24e07650c459947e9d6ff3c3 Author: Andrea Parri Date: Tue Nov 27 12:22:25 2018 +0100 Bluetooth: Remove unnecessary smp_mb__after_atomic() barriers The barriers are redundant because atomic_test_and_clear_bit() already provides the required full ordering for the cases in question (that is, when the bit is cleared). Signed-off-by: Andrea Parri Signed-off-by: Marcel Holtmann drivers/bluetooth/btusb.c | 8 ++------ drivers/bluetooth/hci_intel.c | 16 ++++------------ 2 files changed, 6 insertions(+), 18 deletions(-) commit dd4bfda9cfd1b0b4aad8760fc027cc81e0c6787f Merge: 0bae2d4d62d5 945a47d87cee Author: Daniel Borkmann Date: Wed Dec 19 00:27:24 2018 +0100 Merge branch 'bpf-sk-msg-size-member' John Fastabend says: ==================== This adds a size field to the sk_msg_md data structure used by SK_MSG programs. Without this in the zerocopy case and in the copy case where multiple iovs are in use its difficult to know how much data can be pulled in. The normal method of reading data and data_end only give the current contiguous buffer. BPF programs can attempt to pull in extra data but have to guess if it exists. This can result in multiple "guesses" its much better if we know upfront the size of the sk_msg. ==================== Acked-by: Martin KaFai Lau Signed-off-by: Daniel Borkmann commit 0697607acab976723bf67de95d7b87167c30abf8 Author: Chen-Yu Tsai Date: Mon Dec 17 12:04:47 2018 +0800 Bluetooth: btbcm: Add default address for BCM43430A0 The BCM43430A0 has the default MAC address 43:43:A0:12:1F:AC if none is given. This address was found when enabling Bluetooth on a bunch of boards with the AMPAK AP6210 module, all sharing the same address. It also contains the sequence 4343A0, which is suspicious as that is also the name the chip identifies itself as. Add this to the list of default MAC addresses and leave it to the user to configure a valid one. Signed-off-by: Chen-Yu Tsai Signed-off-by: Marcel Holtmann drivers/bluetooth/btbcm.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 66904555191cbcefa8aa552df018b4f56d94e3ae Author: Chen-Yu Tsai Date: Mon Dec 17 12:04:46 2018 +0800 Bluetooth: hci_bcm: Add compatible string for BCM4330 The BCM4330 chip is a 802.11 a/b/g/n + Bluetooth 4.0 + HS controller. This patch adds a compatible string match to the serdev driver for the Bluetooth part of the chip. Signed-off-by: Chen-Yu Tsai Signed-off-by: Marcel Holtmann drivers/bluetooth/hci_bcm.c | 1 + 1 file changed, 1 insertion(+) commit 92ffe0db3c858ca568cf480899396e63344eab86 Author: Maxime Ripard Date: Mon Dec 17 12:04:45 2018 +0800 Bluetooth: hci_bcm: Add BCM20702A1 variant The BCM20702A1 chip is a single-chip Bluetooth 4.0 controller and transceiver. It is found in the AMPAK AP6210 WiFi+BT package. Signed-off-by: Maxime Ripard Tested-by: Ondrej Jirman Signed-off-by: Chen-Yu Tsai Signed-off-by: Marcel Holtmann drivers/bluetooth/btbcm.c | 6 ++++++ drivers/bluetooth/hci_bcm.c | 1 + 2 files changed, 7 insertions(+) commit 91927a9b351f9779e323be1fb4e219a5951b1649 Author: Chen-Yu Tsai Date: Mon Dec 17 12:04:44 2018 +0800 Bluetooth: hci_bcm: Wait for device to come out of reset after power on The datasheets for BCM20702 and BCM43438 both have power up time sequence graphs, however they are slightly different. Both chips also have an internal power-on-reset, which holds the chip in reset for a short time after the regulators are enabled. For the BCM20702, the time period from when the regulators are enabled, until the chip settles and comes out of sleep state, is 6564 ~ 8171 us. For the BCM43438, the graph only shows the time period from when the regulators are enabled until the chip responds by driving the host's CTS line low, assuming the host has already driven its RTS line low. This is shown to be 6.5 sleep cycles, with the sleep clock at 32.768 kHz. This is around 2 ms. Wait a full 10 ms after the regulators are enabled to account for signal rising times. Tested-by: Ondrej Jirman Signed-off-by: Chen-Yu Tsai Signed-off-by: Marcel Holtmann drivers/bluetooth/hci_bcm.c | 3 +++ 1 file changed, 3 insertions(+) commit 75d11676dccb643de1e850c8a29f5e9aa58157c0 Author: Chen-Yu Tsai Date: Mon Dec 17 12:04:43 2018 +0800 Bluetooth: hci_bcm: Add support for regulator supplies The Broadcom Bluetooth chips have two power inputs, VBAT and VDDIO. The former provides overall power for the chip, while the latter powers the I/O pins and buffers. Model these two as regulator supplies, and let the driver manage them in the same way as it does the clock supply. Tested-by: Ondrej Jirman Signed-off-by: Chen-Yu Tsai Signed-off-by: Marcel Holtmann drivers/bluetooth/hci_bcm.c | 39 ++++++++++++++++++++++++++++++--------- 1 file changed, 30 insertions(+), 9 deletions(-) commit 90bc07cc59ac32f37d6de78a501246575c8866bf Author: Chen-Yu Tsai Date: Mon Dec 17 12:04:42 2018 +0800 Bluetooth: hci_bcm: Add support for LPO clock The Broadcom Bluetooth controllers support a secondary LPO clock at 32.768 kHz. This external clock provides low power timing, and also a way to detect the frequency of the main reference clock. On many designs without NVRAM and a non-default reference clock, this must be used or the controller will not function correctly. Tested-by: Ondrej Jirman Signed-off-by: Chen-Yu Tsai Signed-off-by: Marcel Holtmann drivers/bluetooth/hci_bcm.c | 41 ++++++++++++++++++++++++++++++++++++----- 1 file changed, 36 insertions(+), 5 deletions(-) commit 55dbfcd0f621a745acfd8e3221c41be181b5b128 Author: Chen-Yu Tsai Date: Mon Dec 17 12:04:41 2018 +0800 Bluetooth: hci_bcm: Use "txco" and "extclk" to get clock reference Originally the device tree binding only specified one clock reference, with the name "extclk". The driver simply retrieves the clock without bothering to specify a name. Since we added a second clock to the binding, we need to fetch the clocks by name now. First we try the new name "txco", then fall back to the old name "extclk", and finally try retrieving a clock without using any name, to cover any instances where a bad device tree or firmware worked by accident. In the last case, we should take care that we don't get the same clock twice when we add support for the "lpo" clock. Tested-by: Ondrej Jirman Signed-off-by: Chen-Yu Tsai Signed-off-by: Marcel Holtmann drivers/bluetooth/hci_bcm.c | 41 ++++++++++++++++++++++++++++++----------- 1 file changed, 30 insertions(+), 11 deletions(-) commit 8c08947b7c4f4496e7c23be970121280fcb6cbf5 Author: Chen-Yu Tsai Date: Mon Dec 17 12:04:40 2018 +0800 Bluetooth: hci_bcm: Simplify clk_get error handling The driver currently checks the clk pointer for an error condition, as returned by clk_get, before every invocation of the clk consumer API. This is redundant if the goal is simply to ignore the errors, thereby making the clk optional. The clk consumer API already checks if the pointer is NULL or not. Simplify the code a bit by assigning NULL to the clk pointer if the error condition is one we want to ignore, which is every error except deferred probing. Tested-by: Ondrej Jirman Signed-off-by: Chen-Yu Tsai Signed-off-by: Marcel Holtmann drivers/bluetooth/hci_bcm.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) commit 28ac03b9ac3f784c2f048a910c8d0a7a87483b66 Author: Chen-Yu Tsai Date: Mon Dec 17 12:04:39 2018 +0800 Bluetooth: hci_bcm: Handle deferred probing for the clock supply On some systems that actually have the bluetooth controller wired up with an extra clock signal, it's possible the bluetooth controller probes before the clock provider. clk_get would return a defer probe error, which was not handled by this driver. Handle this properly, so that these systems can work reliably. Tested-by: Ondrej Jirman Signed-off-by: Chen-Yu Tsai Signed-off-by: Marcel Holtmann drivers/bluetooth/hci_bcm.c | 4 ++++ 1 file changed, 4 insertions(+) commit 31f20f5f6d14ffe8d9a87c0ef58ee7ed72a3db63 Author: Chen-Yu Tsai Date: Mon Dec 17 12:04:38 2018 +0800 dt-bindings: net: broadcom-bluetooth: Add BCM4330 compatible string The BCM4330 is a 802.11 a/b/g/n WiFi + Bluetooth 4.0 chip from Broadcom. It is found in the Ampak AP6330 WiFi+BT module. The partiular one I have identifies as BCM4330B1 for Bluetooth and BCM4330/4 for WiFi. It is unclear if the AP6330 module uses this revision of the BCM4330, or if there are multiple revisions. The module does not have revision markings. This patch elects to use just BCM4330 for the compatible string. Reviewed-by: Rob Herring Signed-off-by: Chen-Yu Tsai Signed-off-by: Marcel Holtmann Documentation/devicetree/bindings/net/broadcom-bluetooth.txt | 1 + 1 file changed, 1 insertion(+) commit bfbc47bd5901168f0fdb337e9be1759bedf8ff4e Author: Chen-Yu Tsai Date: Mon Dec 17 12:04:37 2018 +0800 dt-bindings: net: broadcom-bluetooth: Add BCM20702A1 compatible string The BCM20702A1 is a Bluetooth 4.0 chip from Broadcom. It is found in the Ampak AP6210 WiFi+BT module, identified from the read verbose config info command response. However the Bluetooth firmware provided by vendors uses the name BCM20710. This patch elects to use the chip ID returned by the chip for the compatible string. Reviewed-by: Rob Herring Tested-by: Ondrej Jirman Signed-off-by: Chen-Yu Tsai Signed-off-by: Marcel Holtmann Documentation/devicetree/bindings/net/broadcom-bluetooth.txt | 1 + 1 file changed, 1 insertion(+) commit 061a8aaf4c0f2885f1fa1dd6bf8ea27ab5059fa9 Author: Chen-Yu Tsai Date: Mon Dec 17 12:04:36 2018 +0800 dt-bindings: net: broadcom-bluetooth: Add VBAT and VDDIO supplies The Broadcom Bluetooth chips have two power inputs, VBAT and VDDIO. The former provides overall power for the chip, while the latter powers the I/O pins and buffers. This patch adds properties for the two so we can describe the power supply relationships. Reviewed-by: Rob Herring Tested-by: Ondrej Jirman Signed-off-by: Chen-Yu Tsai Signed-off-by: Marcel Holtmann Documentation/devicetree/bindings/net/broadcom-bluetooth.txt | 2 ++ 1 file changed, 2 insertions(+) commit 6ae81eebdef97109c32e545e90865bc5b14178f1 Author: Chen-Yu Tsai Date: Mon Dec 17 12:04:35 2018 +0800 dt-bindings: net: broadcom-bluetooth: Fix external clock names The Broadcom Bluetooth controllers can take up to two external clocks: an external frequency reference, substituting the main crystal, and a LPO clock at 32.768 kHz substituting the internal LPO clock. In particular, the external LPO clock must be used when the controller does not have NVRAM connected, and the main reference frequency is not the default 20 MHz. This is described in detail in the datasheet. The original "extclk" clock name is ambiguous as to which of these it refers to, and some designs might even require both. This patch deprecates the existing name, and adds "txco" and "lpo". Tested-by: Ondrej Jirman Signed-off-by: Chen-Yu Tsai Signed-off-by: Marcel Holtmann Documentation/devicetree/bindings/net/broadcom-bluetooth.txt | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 8e2924e383b714748e5891ac9ff2f5c945666891 Author: Yangtao Li Date: Mon Nov 5 09:56:19 2018 -0500 Bluetooth: Change to use DEFINE_SHOW_ATTRIBUTE macro Use DEFINE_SHOW_ATTRIBUTE macro to simplify the code. Signed-off-by: Yangtao Li Reviewed-by: Kees Cook Signed-off-by: Marcel Holtmann net/bluetooth/l2cap_core.c | 12 +----------- net/bluetooth/rfcomm/core.c | 12 +----------- net/bluetooth/rfcomm/sock.c | 12 +----------- net/bluetooth/sco.c | 12 +----------- 4 files changed, 4 insertions(+), 44 deletions(-) commit f79ba4300202210eb10b3d41f70ef2b8538fa5c4 Author: Yangtao Li Date: Sat Dec 15 02:22:17 2018 -0500 6lowpan: convert to DEFINE_SHOW_ATTRIBUTE Use DEFINE_SHOW_ATTRIBUTE macro to simplify the code. Signed-off-by: Yangtao Li Signed-off-by: Marcel Holtmann net/6lowpan/debugfs.c | 13 +------------ 1 file changed, 1 insertion(+), 12 deletions(-) commit 945a47d87cee24a95e11fdc0cd868b872f9b9616 Author: John Fastabend Date: Sun Dec 16 15:47:06 2018 -0800 bpf: sk_msg, add tests for size field This adds tests to read the size field to test_verifier. Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann tools/testing/selftests/bpf/test_verifier.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) commit 584e46813e689ff1a348343b73122c43d81d0ef7 Author: John Fastabend Date: Sun Dec 16 15:47:05 2018 -0800 bpf: add tools lib/include support sk_msg_md size field Add the size field to sk_msg_md for tools. Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann tools/include/uapi/linux/bpf.h | 1 + 1 file changed, 1 insertion(+) commit 3bdbd0228e7555ec745e08469b98e5a0966409d6 Author: John Fastabend Date: Sun Dec 16 15:47:04 2018 -0800 bpf: sockmap, metadata support for reporting size of msg This adds metadata to sk_msg_md for BPF programs to read the sk_msg size. When the SK_MSG program is running under an application that is using sendfile the data is not copied into sk_msg buffers by default. Rather the BPF program uses sk_msg_pull_data to read the bytes in. This avoids doing the costly memcopy instructions when they are not in fact needed. However, if we don't know the size of the sk_msg we have to guess if needed bytes are available by doing a pull request which may fail. By including the size of the sk_msg BPF programs can check the size before issuing sk_msg_pull_data requests. Additionally, the same applies for sendmsg calls when the application provides multiple iovs. Here the BPF program needs to pull in data to update data pointers but its not clear where the data ends without a size parameter. In many cases "guessing" is not easy to do and results in multiple calls to pull and without bounded loops everything gets fairly tricky. Clean this up by including a u32 size field. Note, all writes into sk_msg_md are rejected already from sk_msg_is_valid_access so nothing additional is needed there. Signed-off-by: John Fastabend Signed-off-by: Daniel Borkmann include/linux/skmsg.h | 3 +++ include/uapi/linux/bpf.h | 1 + net/core/filter.c | 6 ++++++ 3 files changed, 10 insertions(+) commit c2c2ce1e9623fdce429c7df84ee8564074d84846 Author: Yongqiang Sun Date: Fri Dec 7 10:38:05 2018 -0500 drm/amd/display: Optimize passive update planes. [Why] passive update planes still spends a litte more time on some cases. [How] Remove unnecessary trace which involving in some register read. Disable debug output for release build. Signed-off-by: Yongqiang Sun Reviewed-by: Tony Cheng Acked-by: Leo Li Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/core/dc.c | 3 --- 1 file changed, 3 deletions(-) commit 1ae62f3114a95982f2f4cbe5c7bd14b81233597a Author: Wenjing Liu Date: Mon Dec 3 17:26:15 2018 -0500 drm/amd/display: verify lane status before exiting verify link cap [why] DP LL CTS1.4 4.3.2.1 test failure. [how] The failure is caused by not handling DP link loss hpd short pusle during set mode. The change is to read link status before set mode link training. If link is lost, re-verify link caps. Signed-off-by: Wenjing Liu Reviewed-by: Jun Lei Acked-by: Leo Li Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 243 +++++++++++---------- drivers/gpu/drm/amd/display/dc/core/dc_link_hwss.c | 3 +- 2 files changed, 127 insertions(+), 119 deletions(-) commit fd0853567cdf2eeddf22ba9021deedf6b1f90f7a Author: SivapiriyanKumarasamy Date: Thu Nov 29 07:18:29 2018 -0500 drm/amd/display: Fix bug with not updating VSP infoframe [WHY] Currently, when the VSP infopacket is rebuilt in DM, it is not updated when being programmed in encoder. [HOW] Add new VSP case for update_info_frame Signed-off-by: SivapiriyanKumarasamy Reviewed-by: Anthony Koo Acked-by: Krunoslav Kovac Acked-by: Leo Li Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/core/dc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit bd4905a9583c760da31ded7256dca6f71483c3dc Author: Paul Hsieh Date: Thu Nov 22 18:43:45 2018 +0800 drm/amd/display: Add retry to read ddc_clock pin [WHY] On customer board, there is one pluse (1v , < 1ms) on DDC_CLK pin when plug / unplug DP cable. Driver will read it and config DP to HDMI/DVI dongle. [HOW] If there is a real dongle, DDC_CLK should be always pull high. Try to read again to recovery this special case. Retry times = 3. Need additional 3ms to detect DP passive dongle(3 failures) Signed-off-by: Paul Hsieh Reviewed-by: Eric Yang Acked-by: Leo Li Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/core/dc_link.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) commit 80adaebd2d411b7d6872a097634848a71eb13d20 Author: Eric Yang Date: Fri Nov 23 05:55:20 2018 -0500 drm/amd/display: Don't skip link training for empty dongle [Why] Skipping initial link training will result in no verified link cap for mode enumeration. Some versions of the BIOS seem to have PHY programming sequence issue as well if initial link training is skipped, resulting in a softlock in BIOS command table. [How] Identify the empty dongle hotplug case, and still do initial link training. Signed-off-by: Eric Yang Reviewed-by: Tony Cheng Acked-by: Leo Li Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/core/dc_link.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) commit 0a6414e75d231ee1bb7ffb2f5eb246b682a884cd Author: Dale Zhao Date: Thu Nov 22 17:13:46 2018 +0800 drm/amd/display: Wait edp HPD to high in detect_sink [Why] In 99% user case, edp will be post by vbios. In 1% / current case: Lenovo don't light up edp panel in vbios post stage, vbios won't be lit up. Thus in dal when we init DCN 10 hw, we power up edp, then we start detect_sink, but internal time is too short, when we detect it, HPD is still low, so we don't detect the edp, and edp shows black. [How] When we init hw, we wait edp HPD to high after power up edp. Signed-off-by: Dale Zhao Reviewed-by: Eric Yang Acked-by: Leo Li Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/core/dc_link.c | 3 +++ 1 file changed, 3 insertions(+) commit 6fd3583b92318d6d8367cc3f325a81a222cdbc55 Author: Dmytro Laktyushkin Date: Mon Nov 19 16:25:23 2018 -0500 drm/amd/display: fix surface update sequence An earlier change added update of interdependent dlg/ttu params for pipes not being updated in the current call. The code fails to check if the other pipes are actually active yet causing an assert. This change adds a check for surface presence on the pipes before updating the interdepenednt params. Signed-off-by: Dmytro Laktyushkin Reviewed-by: Nikola Cornij Acked-by: Leo Li Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 12750d1647f118496f1da727146f255f5e44d500 Author: Eric Yang Date: Thu Nov 22 02:07:06 2018 -0500 drm/amd/display: fix YCbCr420 blank color [Why] YCbCr420 packing format uses two chanels for luma, and 1 channel for both chroma component. Our previous implementation did not account for this and results in every other pixel having very high luma value, showing greyish color instead of black. YCbCr444 = ; ..... YCbCr420 = ; ..... [How] Program the second channel with the black color value for luma as well. Signed-off-by: Eric Yang Reviewed-by: Hugo Hu Acked-by: Leo Li Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c | 11 ++++++++++- drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 9 +++++++++ 2 files changed, 19 insertions(+), 1 deletion(-) commit d71589f290a13bc2aa0d3d847aa8991d815d2f9e Author: David Francis Date: Wed Nov 21 10:44:07 2018 -0500 drm/amd/display: Warn instead of error on REG_WAIT timeout [Why] DC warns when a REG_WAIT takes a while and full-on errors with stack dump on REG_WAIT timeout. Most of the time it isn't a real issue. [How] Make DC cool its jets - taking a while is a debug message (because it is not something that normal users should need to be aware of), and timeouts are warnings (because it technically shouldn't happen, but it's not a big deal if it does) Signed-off-by: David Francis Reviewed-by: Harry Wentland Acked-by: Leo Li Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dc_helper.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 3a3cd1dfaf161ccbbf6d35ee92985d1b0285951e Author: Dmytro Laktyushkin Date: Mon Oct 22 14:41:40 2018 -0400 drm/amd/display: move AYCrCb8888 format to video section This is a dual channel format and should be treated like other video formats Signed-off-by: Dmytro Laktyushkin Reviewed-by: Eric Bernstein Acked-by: Leo Li Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dc_hw_types.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d3302424e04d0c5ed478d80c0ff53783091f31f4 Author: Harry Wentland Date: Tue Dec 4 14:10:58 2018 -0500 drm/amd/display: Don't log error if we have no connectors [Why] In certain configurations, such as PX configs or some Vega20 parts DC gets created without connectors. [How] Drop the dm_error print when no connectors. Signed-off-by: Harry Wentland Reviewed-by: Nicholas Kazlauskas Acked-by: Leo Li Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/core/dc.c | 4 ---- 1 file changed, 4 deletions(-) commit 809c67059162e7ba85c61a83ad7547b4ffbb1e6e Author: Arnd Bergmann Date: Sun Dec 16 20:48:21 2018 +0100 test_rhashtable: remove semaphore usage This is one of only two files that initialize a semaphore to a negative value. We don't really need the two semaphores here at all, but can do the same thing in more conventional and more effient way, by using a single waitqueue and an atomic thread counter. This gets us a little bit closer to eliminating classic semaphores from the kernel. It also fixes a corner case where we fail to continue after one of the threads fails to start up. An alternative would be to use a split kthread_create()+wake_up_process() and completely eliminate the separate synchronization. Acked-by: Phil Sutter Signed-off-by: Arnd Bergmann Acked-by: Herbert Xu Signed-off-by: David S. Miller lib/test_rhashtable.c | 32 +++++++++++++++++++------------- 1 file changed, 19 insertions(+), 13 deletions(-) commit fa7b28c11bbf389617327ad4dd69bbbbbc16a8b4 Author: Heiner Kallweit Date: Sun Dec 16 19:18:26 2018 +0100 net: phy: print stack trace in phy_error So far phy_error() silently stops the PHY state machine. If the network driver doesn't inform about a MDIO error then the user may wonder why his network is down. Let's print the stack trace to facilitate search for the root cause of the error. Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller drivers/net/phy/phy.c | 2 ++ 1 file changed, 2 insertions(+) commit 2b3e88ea65287ba738a798622405b15344871085 Author: Heiner Kallweit Date: Sun Dec 16 18:30:14 2018 +0100 net: phy: improve phy state checking Add helpers phy_is_started() and __phy_is_started() to avoid open-coded checks whether PHY has been started. To make the check easier move PHY_HALTED before PHY_UP in enum phy_state. Further improvements: phy_start_aneg(): Return -EBUSY and print warning if function is called from a non-started state (DOWN, READY, HALTED). Better check because function is exported and drivers may use it incorrectly. phy_interrupt(): Return IRQ_NONE also if state is DOWN or READY. We should never receive an interrupt in one of these states, but better play safe. phy_stop(): Just return and print a warning if PHY is in a non-started state. This warning should help to identify drivers with unbalanced calls to phy_start() / phy_stop(). phy_state_machine(): Schedule state machine run only if PHY is in a started state. E.g. if state is READY we don't need the state machine, it will be started by phy_start(). v2: - don't use __func__ within phy_warn_state v3: - use WARN() instead of printing error message to facilitate debugging Signed-off-by: Heiner Kallweit Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/phy/phy.c | 34 +++++++++++++++++++++------------- include/linux/phy.h | 24 +++++++++++++++++++++++- 2 files changed, 44 insertions(+), 14 deletions(-) commit 72a8f089c382c078f8c7c1c759cb726de80d4284 Author: Borislav Petkov Date: Tue Dec 18 19:25:46 2018 +0100 x86/mce: Restore MCE injector's module name It was mce-inject.ko but it turned into inject.ko since the containing source file got renamed. Restore it. Fixes: 21afaf181362 ("x86/mce: Streamline MCE subsystem's naming") Signed-off-by: Borislav Petkov Signed-off-by: Thomas Gleixner Cc: linux-edac Cc: Tony Luck Link: https://lkml.kernel.org/r/20181218182546.GA21386@zn.tnic arch/x86/kernel/cpu/mce/Makefile | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 2429f13870d3d2abbe200807d0462272e16ec830 Author: Heiner Kallweit Date: Sun Dec 16 15:00:40 2018 +0100 net: fec: remove workaround to restart phylib state machine on MDIO timeout There's a workaround to restart the phylib state machine in case of a MDIO access timeout. Seems it was introduced to deal with the consequences of a too small MDIO timeout. See also commit message of c3b084c24c8a ("net: fec: Adjust ENET MDIO timeouts") which increased the timeout value later. Due to the later timeout value fix it seems to be safe to remove the workaround. Signed-off-by: Heiner Kallweit Signed-off-by: David S. Miller drivers/net/ethernet/freescale/fec.h | 1 - drivers/net/ethernet/freescale/fec_main.c | 12 ------------ 2 files changed, 13 deletions(-) commit 3379b3bfb71de154f44bca297f3aa039c5b12852 Author: Colin Ian King Date: Sun Dec 16 13:33:15 2018 +0000 bonding: fix indentation issues, remove extra spaces There are two statements that are indented too much by one space each, fix these. Signed-off-by: Colin Ian King Signed-off-by: David S. Miller drivers/net/bonding/bond_3ad.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 0bae2d4d62d523f06ff1a8e88ce38b45400acd28 Author: Jiong Wang Date: Sat Dec 15 03:34:40 2018 -0500 bpf: correct slot_type marking logic to allow more stack slot sharing Verifier is supposed to support sharing stack slot allocated to ptr with SCALAR_VALUE for privileged program. However this doesn't happen for some cases. The reason is verifier is not clearing slot_type STACK_SPILL for all bytes, it only clears part of them, while verifier is using: slot_type[0] == STACK_SPILL as a convention to check one slot is ptr type. So, the consequence of partial clearing slot_type is verifier could treat a partially overridden ptr slot, which should now be a SCALAR_VALUE slot, still as ptr slot, and rejects some valid programs. Before this patch, test_xdp_noinline.o under bpf selftests, bpf_lxc.o and bpf_netdev.o under Cilium bpf repo, when built with -mattr=+alu32 are rejected due to this issue. After this patch, they all accepted. There is no processed insn number change before and after this patch on Cilium bpf programs. Reviewed-by: Jakub Kicinski Signed-off-by: Jiong Wang Reviewed-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov kernel/bpf/verifier.c | 5 +++++ tools/testing/selftests/bpf/test_verifier.c | 34 +++++++++++++++++++++++++++-- 2 files changed, 37 insertions(+), 2 deletions(-) commit 2849dd8bc72b62a315854863c84c523176bd55ce Author: Taniya Das Date: Fri Dec 14 09:40:24 2018 +0530 cpufreq: qcom-hw: Add support for QCOM cpufreq HW driver The CPUfreq HW present in some QCOM chipsets offloads the steps necessary for changing the frequency of CPUs. The driver implements the cpufreq driver interface for this hardware engine. Signed-off-by: Saravana Kannan Signed-off-by: Taniya Das Reviewed-by: Stephen Boyd Tested-by: Stephen Boyd Acked-by: Viresh Kumar Tested-by: Amit Kucheria Signed-off-by: Rafael J. Wysocki drivers/cpufreq/Kconfig.arm | 11 ++ drivers/cpufreq/Makefile | 1 + drivers/cpufreq/qcom-cpufreq-hw.c | 308 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 320 insertions(+) commit 0a3b0c7f979563c97a136c51e43ef724121e83ed Author: Taniya Das Date: Fri Dec 14 09:40:23 2018 +0530 dt-bindings: cpufreq: Introduce QCOM cpufreq firmware bindings Add QCOM cpufreq firmware device bindings for Qualcomm Technology Inc's SoCs. This is required for managing the cpu frequency transitions which are controlled by the hardware engine. Signed-off-by: Taniya Das Reviewed-by: Stephen Boyd Acked-by: Viresh Kumar Tested-by: Amit Kucheria Reviewed-by: Rob Herring Signed-off-by: Rafael J. Wysocki .../bindings/cpufreq/cpufreq-qcom-hw.txt | 172 +++++++++++++++++++++ 1 file changed, 172 insertions(+) commit 1c01a45a86ed6991953e74be63b6a7e33b387954 Author: Leo Li Date: Wed Oct 31 17:07:41 2018 -0400 drm/amd/display: Add functionality to get XGMI SS info [Why] When XGMI is enabled, the DP reference clock needs to be adjusted according to the XGMI spread spectrum percentage and mode. But first, we need the ability to fetch this info. [How] Within the BIOS parser, Read from vBIOS when XGMI SS info is requested. In addition, diags build uses include_legacy/atomfirmware.h for the smu_info_v3_3 table headers. Update that as well. Signed-off-by: Leo Li Reviewed-by: Nicholas Kazlauskas Acked-by: Tony Cheng Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 15 +++++++++++++++ drivers/gpu/drm/amd/display/include/bios_parser_types.h | 1 + 2 files changed, 16 insertions(+) commit b8b6ce89016485cb92fdf2f527b40249aefbc470 Author: Leo Li Date: Wed Oct 31 16:56:54 2018 -0400 drm/amd/display: Add DCE_VERSION_12_1 enum for Vega 20 [Why] We'll need a way to differentiate Vega 20 in DC [How] Add a DCE_VERSION_12_1 enum, which will be returned as the DC version if the ASIC used is a Vega 20. Signed-off-by: Leo Li Reviewed-by: David Francis Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/bios/command_table_helper2.c | 1 + drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 6 +++++- drivers/gpu/drm/amd/display/dc/gpio/hw_factory.c | 1 + drivers/gpu/drm/amd/display/dc/gpio/hw_translate.c | 1 + drivers/gpu/drm/amd/display/dc/i2caux/i2caux.c | 1 + drivers/gpu/drm/amd/display/include/dal_types.h | 1 + 6 files changed, 10 insertions(+), 1 deletion(-) commit f569da8c994c2254a106bdb537aa271399e288ec Author: Marco Felsch Date: Tue Dec 18 16:52:39 2018 +0100 device property: fix fwnode_graph_get_next_endpoint() documentation Sync documentation with code. Fixes: 07bb80d40b0e (device property: Add support for remote endpoints) Signed-off-by: Marco Felsch Acked-by: Sakari Ailus Signed-off-by: Rafael J. Wysocki drivers/base/property.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 180db303ff466a3887c841e805568b92233e2d0e Author: Nicholas Kazlauskas Date: Wed Dec 5 12:08:56 2018 -0500 drm/amd/display: Add below the range support for FreeSync [Why] When the flip-rate is below the minimum supported variable refresh rate range for the monitor the front porch wait will timeout and be frequently misaligned resulting in stuttering and/or flickering. The FreeSync module can still maintain a smooth and flicker free image when the monitor has a refresh rate range such that the maximum refresh > 2 * minimum refresh by utilizing low framerate compensation, "below the range". [How] Hook up the pre-flip and post-flip handlers from the FreeSync module. These adjust the minimum/maximum vrr range to duplicate frames when appropriate by tracking flip timestamps. Signed-off-by: Nicholas Kazlauskas Acked-by: Leo Li Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 80 ++++++++++++++++++----- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 2 +- 2 files changed, 63 insertions(+), 19 deletions(-) commit 8cd61c313d8b5a813a38b615796ea50563f3afae Author: Roman Li Date: Tue Nov 20 16:50:29 2018 -0500 drm/amd/display: Raise dispclk value for Polaris [Why] The visual corruption due to low display clock value observed on some systems [How] There was earlier patch for dspclk: 'drm/amd/display: Raise dispclk value for dce_update_clocks' Adding +15% workaround also to to dce112_update_clocks Signed-off-by: Roman Li Reviewed-by: Leo Li Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/dc/dce/dce_clk_mgr.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 77acd1cd912987ffd62dad6a09275a1fb406f0c2 Author: Nicholas Kazlauskas Date: Fri Dec 14 12:26:58 2018 -0500 drm/amd/display: Skip fast cursor updates for fb changes [Why] The behavior of drm_atomic_helper_cleanup_planes differs depending on whether the commit was asynchronous or not. When it's called from amdgpu_dm_atomic_commit_tail during a typical atomic commit the plane state has been swapped so it calls cleanup_fb on the old plane state. However, in the asynchronous commit codepath the call to drm_atomic_helper_commit also calls dm_plane_helper_cleanup_fb after atomic_async_update has been called. Since the plane state is updated in place and has not been swapped the cleanup_fb call affects the new plane state. This results in a use after free for the given sequence: - Fast update, fb1 pin/ref, fb1 unpin/unref - Fast update, fb2 pin/ref, fb2 unpin/unref - Slow update, fb1 pin/ref, fb2 unpin/unref - Fast update, fb2 pin/ref -> use after free. bug [How] Disallow framebuffer changes in the fast path. Since this includes a NULL framebuffer, this means that only framebuffers that have been previously pin+ref at least once will be used, preventing a use after free. This has a significant throughput reduction for cursor updates where the framebuffer changes. For most desktop usage this isn't a problem, but it does introduce performance regressions for two specific IGT tests: - cursor-vs-flip-toggle - cursor-vs-flip-varying-size Fixes: 2cc751931afc ("drm/amd/display: Add fast path for cursor plane updates") Signed-off-by: Nicholas Kazlauskas Reviewed-by: Andrey Grodzovsky Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 379c237e392e4cec09ff5853b5c0724a1e5d51b0 Author: Evan Quan Date: Mon Dec 17 17:51:22 2018 +0800 drm/amdgpu: correct the return value for error case It should not return 0 for error case as '0' is actually a special value for index. Signed-off-by: Evan Quan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h | 12 ++++++------ drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c | 15 +++++++++++++-- drivers/gpu/drm/amd/amdgpu/psp_v11_0.c | 20 ++++++++++++-------- 3 files changed, 31 insertions(+), 16 deletions(-) commit e98bdb8061305ec00ca9c11231a606e849477bc8 Author: Felix Kuehling Date: Fri Dec 14 11:57:02 2018 -0500 drm/amdkfd: Fix handling of return code of dma_buf_get On errors, dma_buf_get returns a negative error code, rather than NULL. Reported-by: Dan Carpenter Signed-off-by: Felix Kuehling Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 7ab3f021bbc8078e7fbd1d06b6b3105dc010dc0e Author: James Zhu Date: Mon Dec 17 08:35:05 2018 -0500 drm/amdgpu:Improves robustness of SOC15_WAIT_ON_RREG If register value is updating, reset timeout counter. It improves robustness of SOC15_WAIT_ON_RREG. Signed-off-by: James Zhu Reviewed-by: Leo Liu Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/soc15_common.h | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) commit 9194fb22ddd8e178e4e83e656b0c2346124ba9ec Author: James Zhu Date: Wed Dec 12 14:57:12 2018 -0500 drm/amdgpu/vcn:Remove bit 31 for scratch2 to indicate the WA is active Remove bit 31 for scratch2 to indicate the Hardware bug work around is active. Signed-off-by: James Zhu Acked-by: Leo Liu Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 12e8b30186b9682dc7e267ab988652b74abfa081 Author: James Zhu Date: Wed Dec 12 14:53:12 2018 -0500 drm/amdgpu/vcn:Scan enc/jpeg fences to init dpg pause new state Scan enc/jpeg fences to init dpg pause new state in begin use. It will help set dpg mode to desire state actively. Signed-off-by: James Zhu Acked-by: Leo Liu Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) commit 8411f7dc5f61be650b6a26736cea5b1c318fc1f3 Author: James Zhu Date: Wed Dec 12 14:50:03 2018 -0500 drm/amdgpu/vcn:Always check all vcn ring status during dpg mode stop Always check all vcn ring status during dpg mode stop, it will help identify which vcn ring may cause the issue. Signed-off-by: James Zhu Acked-by: Leo Liu Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-) commit e0d460a4d2d160afbfad4ac2b9acd17ccb3d110b Author: James Zhu Date: Wed Dec 12 14:48:33 2018 -0500 drm/amdgpu/vcn:Update ring point to JPEG before init JPEG wptr It is a bug fix. Signed-off-by: James Zhu Acked-by: Leo Liu Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit af8d70375d562034d375ca7a8b08997422223258 Author: Shamir Rabinovitch Date: Mon Dec 17 17:15:16 2018 +0200 RDMA/restrack: Resource-tracker should not use uobject pointers Having uobject pointer embedded in ib core objects is not aligned with a future shared ib_x model. The resource tracker only does this to keep track of user/kernel objects - track this directly instead. Signed-off-by: Shamir Rabinovitch Signed-off-by: Jason Gunthorpe drivers/infiniband/core/cma.c | 2 +- drivers/infiniband/core/core_priv.h | 5 ++- drivers/infiniband/core/cq.c | 2 +- drivers/infiniband/core/restrack.c | 50 +++++++++++++-------------- drivers/infiniband/core/uverbs_cmd.c | 8 ++--- drivers/infiniband/core/uverbs_std_types_cq.c | 2 +- drivers/infiniband/core/verbs.c | 6 ++-- include/rdma/restrack.h | 13 +++---- 8 files changed, 46 insertions(+), 42 deletions(-) commit 5d65cab6c614f95549b19416b2aad824c6d9283a Author: James Zhu Date: Wed Dec 12 14:46:10 2018 -0500 drm/amdgpu/vcn:Always gate vcn block during hw finishing Under Dynamic Power Gate mode, UVD_STATUS needn't be checked. Signed-off-by: James Zhu Acked-by: Leo Liu Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit f9872f100aefd3b80eb4a61dbea326ee28cdc94a Author: James Zhu Date: Mon Dec 3 22:04:28 2018 -0500 drm/amdgpu/vcn: Update vcn.cur_state during suspend Replace vcn_v1_0_stop with vcn_v1_0_set_powergating_state during suspend, to keep adev->vcn.cur_state update. It will fix VCN S3 hung issue. Signed-off-by: James Zhu Reviewed-by: Leo Liu Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 813e90b1aeaa550641332625174d57edb15bc8bd Author: Moni Shoua Date: Tue Dec 11 13:37:53 2018 +0200 IB/mlx5: Add advise_mr() support The verb advise_mr() is used to give advice to the kernel about an address range that belongs to a MR. Implement the verb and register it on the device. The current implementation supports the only known advice to date, prefetch. Signed-off-by: Moni Shoua Reviewed-by: Guy Levi Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/mlx5/main.c | 8 +++ drivers/infiniband/hw/mlx5/mlx5_ib.h | 18 +++++ drivers/infiniband/hw/mlx5/mr.c | 15 +++++ drivers/infiniband/hw/mlx5/odp.c | 125 ++++++++++++++++++++++++++++++++--- 4 files changed, 157 insertions(+), 9 deletions(-) commit ad8a4496757f6f7344011a20a07195bd27e3989c Author: Moni Shoua Date: Tue Dec 11 13:37:52 2018 +0200 IB/uverbs: Add support to advise_mr Add new ioctl method for the MR object - ADVISE_MR. This command can be used by users to give an advice or directions to the kernel about an address range that belongs to memory regions. A new ib_device callback, advise_mr(), is introduced here to suupport the new command. This command takes the following arguments: - pd: The protection domain to which all memory regions belong - advice: The type of the advice * IB_UVERBS_ADVISE_MR_ADVICE_PREFETCH - Pre-fetch a range of an on-demand paging MR * IB_UVERBS_ADVISE_MR_ADVICE_PREFETCH_WRITE - Pre-fetch a range of an on-demand paging MR with write intention - flags: The properties of the advice * IB_UVERBS_ADVISE_MR_FLAG_FLUSH - Operation must end before return to the caller - sg_list: The list of memory ranges - num_sge: The number of memory ranges in the list - attrs: More attributes to be parsed by the provider Signed-off-by: Moni Shoua Reviewed-by: Guy Levi Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/core/uverbs_std_types_mr.c | 56 ++++++++++++++++++++++++++- include/rdma/ib_verbs.h | 4 ++ include/uapi/rdma/ib_user_ioctl_cmds.h | 8 ++++ include/uapi/rdma/ib_user_ioctl_verbs.h | 9 +++++ 4 files changed, 76 insertions(+), 1 deletion(-) commit cbfdd442c43eab8c62bf2ea5127511cd39e9046d Author: Moni Shoua Date: Tue Dec 11 13:37:51 2018 +0200 IB/uverbs: Add helper to get array size from ptr attribute When the parser of an ioctl command has the knowledge that a ptr attribute in a bundle represents an array of structures, it is useful for it to know the number of elements in the array. This is done by dividing the attribute length with the element size. Signed-off-by: Moni Shoua Reviewed-by: Guy Levi Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/mlx5/flow.c | 12 +++++------- include/rdma/uverbs_ioctl.h | 22 ++++++++++++++++++++++ 2 files changed, 27 insertions(+), 7 deletions(-) commit a38d1107f937ca95dcf820161ef44ea683d6a0b1 Author: Matt Mullins Date: Wed Dec 12 16:42:37 2018 -0800 bpf: support raw tracepoints in modules Distributions build drivers as modules, including network and filesystem drivers which export numerous tracepoints. This enables bpf(BPF_RAW_TRACEPOINT_OPEN) to attach to those tracepoints. Signed-off-by: Matt Mullins Acked-by: Martin KaFai Lau Signed-off-by: Alexei Starovoitov include/linux/module.h | 4 ++ include/linux/trace_events.h | 8 +++- kernel/bpf/syscall.c | 11 +++-- kernel/module.c | 5 +++ kernel/trace/bpf_trace.c | 99 +++++++++++++++++++++++++++++++++++++++++++- 5 files changed, 120 insertions(+), 7 deletions(-) commit bbc13cda37711eb7baa4091017887a57074f5410 Author: Parav Pandit Date: Fri Nov 30 13:16:48 2018 +0200 RDMA/uverbs: Add an ioctl method to destroy an object Add an ioctl method to destroy the PD, MR, MW, AH, flow, RWQ indirection table and XRCD objects by handle which doesn't require any output response during destruction. Signed-off-by: Parav Pandit Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/core/uverbs_std_types.c | 60 ++++++++++++++++++++++++--- drivers/infiniband/core/uverbs_std_types_mr.c | 10 ++++- include/uapi/rdma/ib_user_ioctl_cmds.h | 52 +++++++++++++++++++++++ 3 files changed, 115 insertions(+), 7 deletions(-) commit 615740fd6b0c44e6ba1beaa87ddbdf7ead57ecf4 Merge: 07daef8b41e0 7f83a1327962 Author: Thomas Gleixner Date: Tue Dec 18 22:57:38 2018 +0100 Merge branch 'clockevents/4.21' of http://git.linaro.org/people/daniel.lezcano/linux into timers/core Pull clocksource/event changes from Daniel Lezcano: - Add the sched_clock for the arc timer (Alexey Brodkin) - Change the file timer names for riscv, rockchip, tegra20, sun4i and meson6 (Daniel Lezcano) - Add the DT bindings for r8a7796, r8a77470 and r8a774a1 (Biju Das) - Remove the early platform driver registration for timer-ti-dm (Bartosz Golaszewski) - Provide the sched_clock for the riscv timer (Anup Patel) - Add support for ARM64 for the imx-gpt and convert the imx-tpm to the timer-of API (Anson Huang) - Remove useless irq protection for the imx-gpt (Clément Péron) - Remove a duplicate function name for the vt8500 (Dan Carpenter) - Remove obsolete inclusion of for the tegra20 (Geert Uytterhoeven) - Demote the prcmu and the custom sched_clock for the dbx500 and the ux500 (Linus Walleij) - Add a new timer clock for the RDA8810PL (Manivannan Sadhasivam) - Rename the macro to stick to the register name and add the delay timer (Martin Blumenstingl) - Switch the bcm2835 to the SPDX identifier (Stefan Wahren) - Fix the interrupt register access on the fttmr010 (Tao Ren) - Add missing of_node_put in the initialization path on the integrator-ap (Yangtao Li) commit 149d3845f4a548dbc83932fab3491aeb0b070b3a Author: Jason Gunthorpe Date: Fri Nov 30 13:16:47 2018 +0200 RDMA/uverbs: Add a method to introspect handles in a context Introduce a helper function gather_objects_handle() to copy object handles under a spin lock. Expose these objects handles via the uverbs ioctl interface. Signed-off-by: Jason Gunthorpe Signed-off-by: Parav Pandit Signed-off-by: Leon Romanovsky drivers/infiniband/core/uverbs_std_types_device.c | 89 ++++++++++++++++++++++- include/uapi/rdma/ib_user_ioctl_cmds.h | 7 ++ 2 files changed, 95 insertions(+), 1 deletion(-) commit 3c3d71013c7655b9cc4043c9f8845f0c4402d71d Author: Alexandre Belloni Date: Tue Dec 18 22:42:23 2018 +0100 rtc: pcf2123: Add Microcrystal rv2123 Add a compatible string for Microcrystal rv2123 as the reset procedure seem to be differing. However, the current driver works just fine. Signed-off-by: Alexandre Belloni Documentation/devicetree/bindings/rtc/nxp,rtc-2123.txt | 1 + drivers/rtc/rtc-pcf2123.c | 1 + 2 files changed, 2 insertions(+) commit a26944149374c19d92f785108b6980f2e54bb517 Author: Alexandre Belloni Date: Tue Dec 18 22:15:58 2018 +0100 rtc: class: reimplement devm_rtc_device_register Implement devm_rtc_device_register using devm_rtc_allocate_device and __rtc_register_device so there is only one path left to register rtc devices. Also mark it as deprecated so new drivers will hopefully use devm_rtc_allocate_device and rtc_register_device that are less race prone and allow avoiding the 2038, 2070, 2100 and 2106 bugs properly. Signed-off-by: Alexandre Belloni drivers/rtc/class.c | 157 ++++++++++++---------------------------------------- 1 file changed, 36 insertions(+), 121 deletions(-) commit 9a03201170d3de1da47c1b7e2d514e0b15477881 Author: Alexandre Belloni Date: Tue Dec 18 22:11:26 2018 +0100 rtc: enforce rtc_timer_init private_data type All the remaining users of rtc_timers are passing the rtc_device as private data. Enforce that and rename private_data to rtc. Suggested-by: Arnd Bergmann Signed-off-by: Alexandre Belloni drivers/rtc/class.c | 4 ++-- drivers/rtc/interface.c | 19 +++++++++---------- include/linux/rtc.h | 14 ++++++++------ 3 files changed, 19 insertions(+), 18 deletions(-) commit ffe1c5a2d4271a0e04e2576ab0a53ac09a14e065 Author: Marek Vasut Date: Fri Dec 7 18:40:53 2018 +0100 rtc: abx80x: Implement RTC_VL_READ,CLR ioctls Implement standard ioctls for polling the battery status and clearing the battery low indication from userspace. Signed-off-by: Marek Vasut Cc: Alexandre Belloni Signed-off-by: Alexandre Belloni drivers/rtc/rtc-abx80x.c | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) commit 350b4c8ac1b4c07909ab7f8ad4303fff2505ab7c Author: Yuval Shaia Date: Tue Dec 11 10:36:47 2018 +0200 IB/mlx4: Utilize macro to calculate SQ spare size The macro MLX4_IB_SQ_HEADROOM calculates the spare room needed to be left. Use it instead of hard-coding the HW prefetch size. Signed-off-by: Yuval Shaia Reviewed-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/mlx4/qp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7f83a1327962b9b3712866db8cbafbdee239cce4 Author: Manivannan Sadhasivam Date: Mon Dec 10 23:05:46 2018 +0530 clocksource/drivers/rda: Add clock driver for RDA8810PL SoC Add clock driver for RDA Micro RDA8810PL SoC supporting OSTIMER and HWTIMER. RDA8810PL has two independent timers: OSTIMER (56 bit) and HWTIMER (64 bit). Each timer provides optional interrupt support. In this driver, OSTIMER is used for clockevents and HWTIMER is used for clocksource. Signed-off-by: Andreas Färber Signed-off-by: Manivannan Sadhasivam Signed-off-by: Daniel Lezcano drivers/clocksource/Kconfig | 8 ++ drivers/clocksource/Makefile | 1 + drivers/clocksource/timer-rda.c | 195 ++++++++++++++++++++++++++++++++++++++++ 3 files changed, 204 insertions(+) commit adab4ec3c2341d0939a3a83b81320a934c64c3e2 Author: Daniel Lezcano Date: Sun Dec 9 17:40:14 2018 +0100 clocksource/drivers/meson6: Change name meson6_timer timer-meson6 In order to unify the names in this directory, let's rename the driver to be prefixed with timer-* Signed-off-by: Daniel Lezcano drivers/clocksource/Makefile | 2 +- drivers/clocksource/{meson6_timer.c => timer-meson6.c} | 0 2 files changed, 1 insertion(+), 1 deletion(-) commit 493d09b7a7f5b23f176b00f944ad77e9e0c84672 Author: Daniel Lezcano Date: Sun Dec 9 17:38:54 2018 +0100 clocksource/drivers/sun4i: Change name sun4i_timer to timer-sun4i In order to unify the names in this directory, let's rename the driver to be prefixed with timer-* Signed-off-by: Daniel Lezcano drivers/clocksource/Makefile | 2 +- drivers/clocksource/{sun4i_timer.c => timer-sun4i.c} | 0 2 files changed, 1 insertion(+), 1 deletion(-) commit f155ae2c35c9ea8ce52f3ac670ced0eb23eded19 Author: Daniel Lezcano Date: Sun Dec 9 17:37:13 2018 +0100 clocksource/drivers/tegra20: Change name tegra20_timer to timer-tegra20 In order to unify the names in this directory, let's rename the driver to be prefixed with timer-* Signed-off-by: Daniel Lezcano drivers/clocksource/Makefile | 2 +- drivers/clocksource/{tegra20_timer.c => timer-tegra20.c} | 0 2 files changed, 1 insertion(+), 1 deletion(-) commit 2d3bc644dd161c6c3e92dac74a4112c0411d4698 Author: Daniel Lezcano Date: Sun Dec 9 17:35:44 2018 +0100 clocksource/drivers/rockchip: Change name rockchip_timer to timer-rockchip In order to unify the names in this directory, let's rename the driver to be prefixed with timer-* Signed-off-by: Daniel Lezcano drivers/clocksource/Makefile | 2 +- drivers/clocksource/{rockchip_timer.c => timer-rockchip.c} | 0 2 files changed, 1 insertion(+), 1 deletion(-) commit 3d42b32b1d6bdee161f6d629fc850fdf0c0fb2a1 Author: Daniel Lezcano Date: Sun Dec 9 17:34:04 2018 +0100 clocksource/drivers/riscv: Change name riscv_timer to timer-riscv In order to unify the names in this directory, let's rename the driver to be prefixed with timer-* Reviewed-by: Palmer Dabbelt Signed-off-by: Daniel Lezcano drivers/clocksource/Makefile | 2 +- drivers/clocksource/{riscv_timer.c => timer-riscv.c} | 0 2 files changed, 1 insertion(+), 1 deletion(-) commit 92e0d143fdef1faa7560c93fb0d6cd6c61da88ee Author: Anup Patel Date: Tue Dec 4 15:59:52 2018 +0530 clocksource/drivers/riscv_timer: Provide the sched_clock Currently, we don't have a sched_clock registered for RISC-V systems. This means Linux time keeping will use jiffies (running at HZ) as the default sched_clock. To avoid this, we explicity provide sched_clock using RISC-V rdtime instruction (similar to riscv_timer clocksource). Signed-off-by: Anup Patel Reviewed-by: Palmer Dabbelt Signed-off-by: Daniel Lezcano drivers/clocksource/Kconfig | 2 +- drivers/clocksource/riscv_timer.c | 9 +++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) commit 4f352d1fc5a8d3220e29766a26172eff34867014 Author: Anson Huang Date: Fri Dec 7 06:05:36 2018 +0000 clocksource/drivers/timer-imx-tpm: Specify clock name for timer-of i.MX TPM needs "ipg" clock for register access and "per" clock for timer function, the driver gets "ipg" clock by searching the clock name, but timer-of initialization will get first clock in device tree TPM node since no clock name specified in of_clk, that means the "per" clock MUST be the first clock entry in device tree TPM node, this patch specifies clock name for of_clk to avoid this restriction, it makes TPM driver work properly with different sequence of clock entries in device tree TPM node. Signed-off-by: Anson Huang Signed-off-by: Daniel Lezcano drivers/clocksource/timer-imx-tpm.c | 3 +++ 1 file changed, 3 insertions(+) commit 86fe57fc47b17b3528fa5497fc57e158d846c4ea Author: Tao Ren Date: Wed Oct 3 14:53:50 2018 -0700 clocksource/drivers/fttmr010: Fix invalid interrupt register access TIMER_INTR_MASK register (Base Address of Timer + 0x38) is not designed for masking interrupts on ast2500 chips, and it's not even listed in ast2400 datasheet, so it's not safe to access TIMER_INTR_MASK on aspeed chips. Similarly, TIMER_INTR_STATE register (Base Address of Timer + 0x34) is not interrupt status register on ast2400 and ast2500 chips. Although there is no side effect to reset the register in fttmr010_common_init(), it's just misleading to do so. Besides, "count_down" is renamed to "is_aspeed" in "fttmr010" structure, and more comments are added so the code is more readble. Signed-off-by: Tao Ren Reviewed-by: Linus Walleij Signed-off-by: Daniel Lezcano drivers/clocksource/timer-fttmr010.c | 73 +++++++++++++++++++++--------------- 1 file changed, 42 insertions(+), 31 deletions(-) commit 5eb73c831171115d3b4347e1e7124a5a35d8086c Author: Yangtao Li Date: Sun Nov 25 00:00:49 2018 -0500 clocksource/drivers/integrator-ap: Add missing of_node_put() The function of_find_node_by_path() acquires a reference to the node returned by it and that reference needs to be dropped by its caller. integrator_ap_timer_init_of() doesn't do that. The pri_node and the sec_node are used as an identifier to compare against the current node, so we can directly drop the refcount after getting the node from the path as it is not used as pointer. By dropping the refcount right after getting it, a single variable is needed instead of two. Fix this by use a single variable and drop the refcount right after of_find_node_by_path(). Signed-off-by: Yangtao Li Signed-off-by: Daniel Lezcano drivers/clocksource/timer-integrator-ap.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-) commit 64db8bb157cb8108ae017f00c2d47f03d4ebe8a6 Author: Stefan Wahren Date: Sat Nov 10 16:28:39 2018 +0100 clocksource/drivers/bcm2835: Switch to SPDX identifier Adopt the SPDX license identifier headers to ease license compliance management. Also drop the FSF address. Cc: Simon Arlott Signed-off-by: Stefan Wahren Reviewed-by: Eric Anholt Acked-by: Daniel Lezcano Signed-off-by: Daniel Lezcano drivers/clocksource/bcm2835_timer.c | 15 +-------------- 1 file changed, 1 insertion(+), 14 deletions(-) commit e5a805202c8ebb3b27cd8ad1b227158ae9cb9464 Author: Biju Das Date: Mon Nov 19 16:14:13 2018 +0000 dt-bindings: timer: renesas, cmt: Document r8a774a1 CMT support Document SoC specific bindings for RZ/G2M (r8a774a1) SoC. Signed-off-by: Biju Das Reviewed-by: Simon Horman Signed-off-by: Daniel Lezcano Documentation/devicetree/bindings/timer/renesas,cmt.txt | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit 3825603a8076738d95b430d36896a760d7fc4909 Author: Anson Huang Date: Tue Nov 6 05:15:58 2018 +0000 clocksource/drivers/timer-imx-tpm: Convert the driver to timer-of Convert the driver to use the timer_of helpers. This allows to handle timer base, clock and irq using common timer_of driver and it simplifies the code. Signed-off-by: Anson Huang Signed-off-by: Daniel Lezcano drivers/clocksource/timer-imx-tpm.c | 136 +++++++++++++++--------------------- 1 file changed, 55 insertions(+), 81 deletions(-) commit bf287607c80f24387fedb431a346dc67f25be12c Author: Alexey Brodkin Date: Mon Nov 19 14:29:17 2018 +0300 clocksource/drivers/arc_timer: Utilize generic sched_clock It turned out we used to use default implementation of sched_clock() from kernel/sched/clock.c which was as precise as 1/HZ, i.e. by default we had 10 msec granularity of time measurement. Now given ARC built-in timers are clocked with the same frequency as CPU cores we may get much higher precision of time tracking. Thus we switch to generic sched_clock which really reads ARC hardware counters. This is especially helpful for measuring short events. That's what we used to have: ------------------------------>8------------------------ $ perf stat /bin/sh -c /root/lmbench-master/bin/arc/hello > /dev/null Performance counter stats for '/bin/sh -c /root/lmbench-master/bin/arc/hello': 10.000000 task-clock (msec) # 2.832 CPUs utilized 1 context-switches # 0.100 K/sec 1 cpu-migrations # 0.100 K/sec 63 page-faults # 0.006 M/sec 3049480 cycles # 0.305 GHz 1091259 instructions # 0.36 insn per cycle 256828 branches # 25.683 M/sec 27026 branch-misses # 10.52% of all branches 0.003530687 seconds time elapsed 0.000000000 seconds user 0.010000000 seconds sys ------------------------------>8------------------------ And now we'll see: ------------------------------>8------------------------ $ perf stat /bin/sh -c /root/lmbench-master/bin/arc/hello > /dev/null Performance counter stats for '/bin/sh -c /root/lmbench-master/bin/arc/hello': 3.004322 task-clock (msec) # 0.865 CPUs utilized 1 context-switches # 0.333 K/sec 1 cpu-migrations # 0.333 K/sec 63 page-faults # 0.021 M/sec 2986734 cycles # 0.994 GHz 1087466 instructions # 0.36 insn per cycle 255209 branches # 84.947 M/sec 26002 branch-misses # 10.19% of all branches 0.003474829 seconds time elapsed 0.003519000 seconds user 0.000000000 seconds sys ------------------------------>8------------------------ Note how much more meaningful is the second output - time spent for execution pretty much matches number of cycles spent (we're runnign @ 1GHz here). Signed-off-by: Alexey Brodkin Cc: Daniel Lezcano Cc: Vineet Gupta Cc: Thomas Gleixner Cc: stable@vger.kernel.org Acked-by: Vineet Gupta Signed-off-by: Daniel Lezcano arch/arc/Kconfig | 1 + drivers/clocksource/Kconfig | 1 + drivers/clocksource/arc_timer.c | 22 ++++++++++++++++++++++ 3 files changed, 24 insertions(+) commit 2bbaf54216448486def1153486778a975a73041d Author: Biju Das Date: Fri Oct 26 09:36:13 2018 +0100 dt-bindings: timer: renesas, cmt: Document r8a77470 CMT support Document SoC specific compatible strings for r8a77470. No driver change is needed as the fallback strings will activate the right code. Signed-off-by: Biju Das Reviewed-by: Fabrizio Castro Reviewed-by: Simon Horman Reviewed-by: Rob Herring Signed-off-by: Daniel Lezcano Documentation/devicetree/bindings/timer/renesas,cmt.txt | 2 ++ 1 file changed, 2 insertions(+) commit f9135ffa8a272bde9928e75ce14d02d4496159ae Author: Biju Das Date: Fri Oct 26 09:01:44 2018 +0100 dt-bindings: timer: renesas, cmt: Document r8a7796 CMT support Document SoC specific bindings for R-Car M3-W (r8a7796) SoC. Signed-off-by: Biju Das Reviewed-by: Fabrizio Castro Reviewed-by: Simon Horman Reviewed-by: Rob Herring Signed-off-by: Daniel Lezcano Documentation/devicetree/bindings/timer/renesas,cmt.txt | 2 ++ 1 file changed, 2 insertions(+) commit ec3372f28f7bf589388780df5eda945d4cdd7c4b Author: Clément Péron Date: Mon Nov 5 15:15:11 2018 +0100 clocksource/drivers/imx-gpt: Remove unnecessary irq protection shutdown and oneshot are already protected against irq interruptions Signed-off-by: Clément Péron Signed-off-by: Daniel Lezcano drivers/clocksource/timer-imx-gpt.c | 17 ----------------- 1 file changed, 17 deletions(-) commit df181e38281602bb404c5c8158a87317274dc653 Author: Anson Huang Date: Mon Nov 5 01:10:27 2018 +0000 clocksource/drivers/imx-gpt: Add support for ARM64 This patch allows building and compile-testing the i.MX GPT driver also for ARM64. The delay_timer is only supported on ARMv7. Signed-off-by: Anson Huang Signed-off-by: Daniel Lezcano drivers/clocksource/Kconfig | 2 +- drivers/clocksource/timer-imx-gpt.c | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) commit fa83c6f45aa560f814adfdf1a0bf523c1157dfe1 Author: Martin Blumenstingl Date: Thu Nov 15 23:46:57 2018 +0100 clocksource/drivers/meson6_timer: Implement the ARM delay timer Implement an ARM delay timer to be used for udelay(). This allows us to skip the delay loop calibration at boot. With this patch udelay() is now independent of CPU frequency changes. This is a good thing on Meson8, Meson8b and Meson8m2 because changing the CPU frequency requires running the CPU clock off the XTAL while changing the PLL or it's dividers. After changing the CPU clocks we need to wait a few usecs for the clock to become stable. So having an udelay() implementation that doesn't depend on the CPU frequency is beneficial. Suggested-by: Jianxin Pan Signed-off-by: Martin Blumenstingl Signed-off-by: Daniel Lezcano drivers/clocksource/meson6_timer.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) commit bed8fc137e20df7dabcaff0bf2bfe494766aa556 Author: Martin Blumenstingl Date: Thu Nov 15 23:46:56 2018 +0100 clocksource/drivers/meson6_timer: Use register names from the datasheet This makes the driver use the names from S805 datasheet for the preprocessor #defines. This makes it easier to spot that the driver currently only supports Timer A (as clockevent with interrupt support) and Timer E (as clocksource without interrupts). Timer B, C and D (which are similar to Timer A) are currently not supported by the driver. While here, this also removes the internal "CED_ID" and "CSD_ID" defines which are used to identify the timer. These IDs are not described in the datasheet and thus make it harder to compare the code to what's written in the datasheet. Signed-off-by: Martin Blumenstingl Signed-off-by: Daniel Lezcano drivers/clocksource/meson6_timer.c | 108 ++++++++++++++++++++++--------------- 1 file changed, 64 insertions(+), 44 deletions(-) commit 7b59263801077e480be79e5f9a3a3bcdefeb05b8 Author: Geert Uytterhoeven Date: Thu Nov 15 11:00:37 2018 +0100 clockevents/drivers/tegra20: Remove obsolete inclusion of As of commit da4a686a2cfb077a ("ARM: smp_twd: convert to use CLKSRC_OF init"), this header file is no longer used. Signed-off-by: Geert Uytterhoeven Acked-by: Thierry Reding Signed-off-by: Daniel Lezcano drivers/clocksource/tegra20_timer.c | 1 - 1 file changed, 1 deletion(-) commit 63136299721b4bfbd51ddd41181ab3a5897958bb Author: Bartosz Golaszewski Date: Wed Nov 14 10:53:12 2018 +0100 clocksource/drivers/timer-ti-dm: Remove the early platform driver registration This driver is no longer used as an early platform driver. Remove the registration macro. Signed-off-by: Bartosz Golaszewski Signed-off-by: Daniel Lezcano drivers/clocksource/timer-ti-dm.c | 1 - 1 file changed, 1 deletion(-) commit 85b6fcadcf6626ad520376eacfb2b77090e782ab Author: Linus Walleij Date: Thu Nov 15 14:32:03 2018 +0100 clocksource/drivers/ux500: Drop Ux500 custom SCHED_CLOCK The two drivers used for Ux500 sched_clock use two Kconfig symbols to select which of the two gets used as sched_clock. This isn't right: the workaround is trying to make sure that the NONSTOP timer is used for sched_clock in order to keep that clock ticking consistently over a suspend/resume cycle. (Otherwise sched_clock simply stops during suspend and continues after resume). This will notably affect any timetstamped debug prints, so that they show the absolute number of seconds since the system was booted and does not loose wall-clock time during suspend and resume as if time stood still. The real way to fix this problem is to make sched_clock take advantage of any NONSTOP clock source on the system and adjust accordingly, not to try to work around this by using a different sched_clock depending on what system we are compiling for. This can solve the problem for everyone instead of providing a local solution. Cc: Baolin Wang Signed-off-by: Linus Walleij Signed-off-by: Daniel Lezcano drivers/clocksource/Kconfig | 13 ------------- drivers/clocksource/clksrc-dbx500-prcmu.c | 18 ------------------ drivers/clocksource/nomadik-mtu.c | 4 ---- 3 files changed, 35 deletions(-) commit bc0750e464d41e1234f56471b8f626b8d945b1a8 Author: Linus Walleij Date: Thu Nov 15 14:32:02 2018 +0100 clocksource/drivers/dbx500: Demote dbx500 PRCMU clocksource Demote the DBx500 PRCMU clocksource to quality 100 and mark it as NONSTOP so it will still be used for timekeeping across suspend/resume. The Nomadik MTU timer which has higher precision will be used when the system is up and running, thanks to the recent changes properly utilizing the suspend clocksources. This was discussed back in 2011 when the driver was written, but the infrastructure was not available upstream to use this timer properly. Now the infrastructure is there, so let's finalize the work. Cc: Baolin Wang Signed-off-by: Linus Walleij Reviewed-by: Baolin Wang Signed-off-by: Daniel Lezcano drivers/clocksource/clksrc-dbx500-prcmu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 30a85eb64347ef16aefba3aa96cb7f2c1615290a Author: Dan Carpenter Date: Sat Oct 13 13:22:22 2018 +0300 clocksource/drivers/timer-vt8500: Remove duplicate function name We print the function name twice in a row in the error message so I've removed one. Signed-off-by: Dan Carpenter Signed-off-by: Daniel Lezcano drivers/clocksource/timer-vt8500.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e9dfa53a399545056cf97cf8c996d71dcebb4d7e Author: Dan Carpenter Date: Mon Dec 17 10:08:15 2018 +0300 RDMA/hns: Fix an error code in hns_roce_create_srq() The function accidentally returns success on this error path. Fixes: c7bcb13442e1 ("RDMA/hns: Add SRQ support for hip08 kernel mode") Signed-off-by: Dan Carpenter Acked-by: Lijun Ou Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/hns/hns_roce_srq.c | 1 + 1 file changed, 1 insertion(+) commit 5050ae5fa3d54c8e83e1e447cc7e3591110a7f57 Author: Dan Carpenter Date: Mon Dec 17 10:05:36 2018 +0300 IB/qib: Fix an error code in qib_sdma_verbs_send() We accidentally return success on this error path. Fixes: f931551bafe1 ("IB/qib: Add new qib driver for QLogic PCIe InfiniBand adapters") Signed-off-by: Dan Carpenter Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/qib/qib_sdma.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit be5914c124bc3179536e5c4598f59aeb4b880517 Author: Parav Pandit Date: Tue Dec 18 14:16:00 2018 +0200 RDMA/core: Delete RoCE GID in hw when corresponding IP is deleted Currently a RoCE GID entry is removed from the hardware when all references to the GID entry drop to zero. This is a change in behavior from before the fixed patch. The GID entry should be removed from the hardware when GID entry deletion is requested. This allows the driver terminate ongoing traffic through the RoCE GID. While a GID is deleted from the hardware, GID slot in the software GID cache is not freed. GID slot is freed once all references of such GID are dropped. This continue to ensure that such GID slot of hardware is not allocated to new GID entry allocation request. It is allocated once all references to GID entry drop. This approach allows drivers to put a tombestone of some kind on the HW GID index to block the traffic. Fixes: b150c3862d21 ("IB/core: Introduce GID entry reference counts") Signed-off-by: Parav Pandit Reviewed-by: Mark Bloch Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe drivers/infiniband/core/cache.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit ac2f7e623d47fd68d2517f191696fbc96a5d7270 Author: Gal Pressman Date: Tue Dec 18 17:57:32 2018 +0200 RDMA/mlx5: Fix function name typo 'fileds' -> 'fields' Fix typo in 'set_mr_fileds' -> 'set_mr_fields'. Signed-off-by: Gal Pressman Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/mlx5/mr.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit b81a327dbc0d07c219ac48b7daf155ea6a51672b Author: Kamal Heib Date: Tue Dec 18 22:55:07 2018 +0200 RDMA/i40iw: Make sure to initialize ib_device_ops The initialization of the ib_device_ops was dropped by mistake when rebasing the ib_device_ops series, this patch fixes that. Fixes: 15644f57cb66 ("RDMA/i40iw: Initialize ib_device_ops struct") Signed-off-by: Kamal Heib Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/i40iw/i40iw_verbs.c | 1 + 1 file changed, 1 insertion(+) commit 8e3b688301863fba914883e3531b406c68cb7501 Author: Leon Romanovsky Date: Wed Dec 12 19:45:53 2018 +0200 RDMA/mlx5: Delete unreachable handle_atomic code by simplifying SW completion Handle atomic was left as unimplemented from 2013, remove the code till this part will be developed. Remove the dead code by simplifying SW completion logic which is supposed to be the same for send and receive paths. Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters") Reported-by: Stephen Rothwell Signed-off-by: Leon Romanovsky Tested-by: Stephen Rothwell # compile tested Signed-off-by: Jason Gunthorpe drivers/infiniband/hw/mlx5/cq.c | 102 ++--------------------------------- drivers/infiniband/hw/mlx5/mlx5_ib.h | 2 - drivers/infiniband/hw/mlx5/qp.c | 1 - 3 files changed, 5 insertions(+), 100 deletions(-) commit a01aa7680e3dea204c64bb245dc7a6c46e2e15f9 Merge: 77c7a7b3e7da af854724e51e Author: David S. Miller Date: Tue Dec 18 12:01:02 2018 -0800 Merge branch 'hns3-next' Peng Li says: ==================== net: hns3: code optimizations & bugfixes for HNS3 driver This patchset includes bugfixes and code optimizations for the HNS3 ethernet controller driver ==================== Signed-off-by: David S. Miller commit af854724e51e4047f534ac6d19b3ef9fb3c35c49 Author: Yunsheng Lin Date: Tue Dec 18 19:37:59 2018 +0800 net: hns3: fix a SSU buffer checking bug When caculating the SSU buffer, it first allocate tx and rx private buffer, then the remaining buffer is for rx shared buffer. The remaining buffer size should be at least bigger than or equal to the shared_std, which is the minimum shared buffer size required by the driver, but currently if the remaining buffer size is equal to the shared_std, it returns failure, which causes SSU buffer allocation failure problem. This patch fixes this problem by rounding up shared_std before checking the the remaining buffer size bigger than or equal to the shared_std. Fixes: 46a3df9f9718 ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support") Signed-off-by: Yunsheng Lin Signed-off-by: Peng Li Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit b9a400ac295728b2d47445e09814e1880409b311 Author: Yunsheng Lin Date: Tue Dec 18 19:37:58 2018 +0800 net: hns3: aligning buffer size in SSU to 256 bytes The hardware expects the buffer size set to SSU is aligned to 256 bytes, this patch aligns the buffer size to 256 byte using roundup or rounddown function. Signed-off-by: Yunsheng Lin Signed-off-by: Peng Li Signed-off-by: David S. Miller .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 43 +++++++++++++--------- 1 file changed, 26 insertions(+), 17 deletions(-) commit 368686be234daf365ef184a6ee1c4a6c18ede3b1 Author: Yunsheng Lin Date: Tue Dec 18 19:37:57 2018 +0800 net: hns3: getting tx and dv buffer size through firmware This patch adds support of getting tx and dv buffer size through firmware, because different version of hardware requires different size of tx and dv buffer. This patch also add dv_buf_size to tc' private buffer size even if pfc is not enable for the tc. Signed-off-by: Yunsheng Lin Signed-off-by: Peng Li Signed-off-by: David S. Miller .../net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 5 ++- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 41 ++++++++++++++++------ .../ethernet/hisilicon/hns3/hns3pf/hclge_main.h | 3 ++ 3 files changed, 38 insertions(+), 11 deletions(-) commit 0ad5ea5dbd6cb1e62bac547db5e61bab15af4f44 Author: Peng Li Date: Tue Dec 18 19:37:56 2018 +0800 net: hns3: synchronize speed and duplex from phy when phy link up Driver calls phy_connect_direct and registers hclge_mac_adjust_link to synchronize mac speed and duplex from phy. It is better to synchronize mac speed and duplex from phy when phy link up. Signed-off-by: Peng Li Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c | 4 ++++ 1 file changed, 4 insertions(+) commit 8362089d787724bb252f13f942921051943369c7 Author: Fuyun Liang Date: Tue Dec 18 19:37:55 2018 +0800 net: hns3: remove 1000M/half support of phy Our phy does not support 1000M/half, this patch removes 1000M/half from PHY_SUPPORTED_FEATURES. Signed-off-by: Fuyun Liang Signed-off-by: Peng Li Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7445565cd064679421e3cf4d440589ee723f6c08 Author: Peng Li Date: Tue Dec 18 19:37:54 2018 +0800 net: hns3: update coalesce param per second coalesce param updates every 100 napi times, it may update a little late if ping test after a high rate flow, may over napi poll is called 100 times as ping test sends packets every second. This patch updates coalesce param every second, instead with every 100 napi times. It can not update the param 100% in time, but the lag time is very short. Signed-off-by: Peng Li Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 8 +++----- drivers/net/ethernet/hisilicon/hns3/hns3_enet.h | 4 ---- 2 files changed, 3 insertions(+), 9 deletions(-) commit ae6017a71115ebc4e5c1a3f0f451319ab3f5c447 Author: Huazhong Tan Date: Tue Dec 18 19:37:53 2018 +0800 net: hns3: fix incomplete uninitialization of IRQ in the hns3_nic_uninit_vector_data() In the hns3_nic_uninit_vector_data(), the procedure of uninitializing the tqp_vector's IRQ has not set affinity_notify to NULL and changes its init flag. This patch fixes it. And for simplificaton, local variable tqp_vector is used instead of priv->tqp_vector[i]. Fixes: 424eb834a9be ("net: hns3: Unified HNS3 {VF|PF} Ethernet Driver for hip08 SoC") Signed-off-by: Huazhong Tan Signed-off-by: Peng Li Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit b51c366df70da0100193d13975980f1990a2d47b Author: Huazhong Tan Date: Tue Dec 18 19:37:52 2018 +0800 net: hns3: remove unnecessary configuration recapture while resetting When doing reset, it is unnecessary to get the hardware's default configuration again, otherwise, the user's configuration will be overwritten. Fixes: 4ed340ab8f49 ("net: hns3: Add reset process in hclge_main") Signed-off-by: Huazhong Tan Signed-off-by: Peng Li Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 13 ------------- 1 file changed, 13 deletions(-) commit b644a8d4cb18305d31383188da75615490b2c6ef Author: Huazhong Tan Date: Tue Dec 18 19:37:51 2018 +0800 net: hns3: update some variables while hclge_reset()/hclgevf_reset() done When hclge_reset() completes successfully, it should update the last_reset_time, set reset_fail_cnt to 0, and set reset_type of hnae3_ae_dev to HNAE3_NONE_RESET. Also when hclgevf_reset() completes successfully, it should update the last_reset_time, and set reset_type of hnae3_ae_dev to HNAE3_NONE_RESET. Signed-off-by: Huazhong Tan Signed-off-by: Peng Li Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 5 ++++- drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 3 +++ 2 files changed, 7 insertions(+), 1 deletion(-) commit 531eba0fe2b5172ed0ab1cc6a311b2b6b9e6b402 Author: Huazhong Tan Date: Tue Dec 18 19:37:50 2018 +0800 net: hns3: fix napi_disable not return problem While doing DOWN, the calling of napi_disable() may not return, since the napi_complete() in the hns3_nic_common_poll() will never be called when HNS3_NIC_STATE_DOWN is set. So we need to call napi_complete() before checking HNS3_NIC_STETE_DOWN. Fixes: ff0699e04b97 ("net: hns3: stop napi polling when HNS3_NIC_STATE_DOWN is set") Signed-off-by: Huazhong Tan Signed-off-by: Peng Li Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit e3338205f0c700caae52a36cd0e3a815e6efd281 Author: Huazhong Tan Date: Tue Dec 18 19:37:49 2018 +0800 net: hns3: uninitialize pci in the hclgevf_uninit In the hclgevf_pci_reset(), it only uninitialize and initialize the msi, so if the initialization fails, hclgevf_uninit_hdev() does not need to uninitialize the msi, but needs to uninitialize the pci, otherwise it will cause pci resource not free. Fixes: 862d969a3a4d ("net: hns3: do VF's pci re-initialization while PF doing FLR") Signed-off-by: Huazhong Tan Signed-off-by: Peng Li Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cda69d244585bc4497d3bb878c22fe2b6ad647c1 Author: Huazhong Tan Date: Tue Dec 18 19:37:48 2018 +0800 net: hns3: fix error handling int the hns3_get_vector_ring_chain When hns3_get_vector_ring_chain() failed in the hns3_nic_init_vector_data(), it should do the error handling instead of return directly. Also, cur_chain should be freed instead of chain and head->next should be set to NULL in error handling of hns3_get_vector_ring_chain. This patch fixes them. Fixes: 73b907a083b8 ("net: hns3: bugfix for buffer not free problem during resetting") Signed-off-by: Huazhong Tan Signed-off-by: Peng Li Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit c6d6e9b0f6b4201c77f2cea3964dd122697e3543 Author: Jaegeuk Kim Date: Tue Dec 18 09:25:37 2018 -0800 dm: do not allow readahead to limit IO size Update DM to set the bdi's io_pages. This fixes reads to be capped at the device's max request size (even if user's read IO exceeds the established readahead setting). Fixes: 9491ae4a ("mm: don't cap request size based on read-ahead setting") Cc: stable@vger.kernel.org Reviewed-by: Jens Axboe Signed-off-by: Jaegeuk Kim Signed-off-by: Mike Snitzer drivers/md/dm-table.c | 3 +++ 1 file changed, 3 insertions(+) commit 89a0948984896352cac1ebe079cb3d64d6c3adc6 Author: Arnaldo Carvalho de Melo Date: Tue Dec 18 12:53:06 2018 -0300 tools uapi asm: Update asm-generic/unistd.h copy To get the change in: b7d624ab4312 ("asm-generic: unistd.h: fixup broken macro include.") That doesn't imply in any changes in the tools. This silences the following perf build warning: Warning: Kernel ABI header at 'tools/include/uapi/asm-generic/unistd.h' differs from latest version at 'include/uapi/asm-generic/unistd.h' diff -u tools/include/uapi/asm-generic/unistd.h include/uapi/asm-generic/unistd.h Cc: Adrian Hunter Cc: Arnd Bergmann Cc: Guo Ren Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-2e7xwm5i2qcc88jp2lyawdyd@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/include/uapi/asm-generic/unistd.h | 4 ++++ 1 file changed, 4 insertions(+) commit bc055c54b887961bc3545c54e61c844fd4499c2b Author: Arnaldo Carvalho de Melo Date: Tue Dec 18 12:39:08 2018 -0300 perf symbols: Relax checks on perf-PID.map ownership Those are simple enough, and usually not produced by root, instead by whatever user is running java, rust, Node.js JIT code that end up generating those /tmp/perf-PID.map for resolution of symbols in the anonymous executable maps. Having to use --force to resolve symbols in 'perf top' is a distraction, as recently I experienced when node.js symbols were not being resolved by 'perf top'. Acked-by: Ingo Molnar Cc: Adrian Hunter Cc: Frederic Weisbecker Cc: Hítalo Silva Cc: Jiri Olsa Cc: Namhyung Kim Cc: Pekka Enberg Cc: Peter Zijlstra Link: https://lkml.kernel.org/n/tip-tk2jgo2v4v2yjuj28axbpppo@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/symbol.c | 11 ----------- 1 file changed, 11 deletions(-) commit 42337cb768ad9536150603b206acd6bbd320e75e Author: Arnaldo Carvalho de Melo Date: Tue Dec 18 11:54:31 2018 -0300 perf trace: Wire up the fadvise 'advice' table generator That ends up generating this: $ cat /tmp/build/perf/trace/beauty/generated/fadvise_advice_array.c static const char *fadvise_advices[] = { [0] = "NORMAL", [1] = "RANDOM", [2] = "SEQUENTIAL", [3] = "WILLNEED", [4] = "DONTNEED", [5] = "NOREUSE", }; $ Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-zwbslubagram8a8zdc003u8h@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/Makefile.perf | 8 ++++++++ 1 file changed, 8 insertions(+) commit 069c1c6cc3646454f9c8e83084a25f8eb8cab7ae Author: Arnaldo Carvalho de Melo Date: Tue Dec 18 11:49:58 2018 -0300 perf beauty: Add generator for fadvise64's 'advice' arg constants $ tools/perf/trace/beauty/fadvise.sh static const char *fadvise_advices[] = { [0] = "NORMAL", [1] = "RANDOM", [2] = "SEQUENTIAL", [3] = "WILLNEED", [4] = "DONTNEED", [5] = "NOREUSE", }; $ This has a hack wrt the s390 difference. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-tb7jguv01u8p570piq13eioh@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/trace/beauty/fadvise.sh | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) commit f9cdd63e79946d2f635d5c23d76811c2d710aa5c Author: Arnaldo Carvalho de Melo Date: Tue Dec 18 16:15:53 2018 -0300 tools headers uapi: Grab a copy of fadvise.h Will be used to generate the string table for fadvise64's 'advice' argument. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-muswpnft8q9krktv052yrgsc@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/include/uapi/linux/fadvise.h | 22 ++++++++++++++++++++++ tools/perf/check-headers.sh | 1 + 2 files changed, 23 insertions(+) commit a66313408a08a9758e3007fe9a6cfe47b0dec88b Author: Arnaldo Carvalho de Melo Date: Tue Dec 18 11:25:08 2018 -0300 perf beauty mmap: Print mmap's 'offset' arg in hexadecimal Also to make it match 'strace' output, for regression testing. Both now produce this option, when 'perf trace' uses a .perfconfig asking for the strace like output: mmap(0x7faf66e6a000, 1363968, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x22000) = 0x7faf66e6a000 Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-27qhouo1kaac2iyl85nfnsf5@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-trace.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 1355e09ab04bc583df9c4b2b68d445c535c8b66b Author: Arnaldo Carvalho de Melo Date: Tue Dec 18 11:22:34 2018 -0300 perf beauty mmap: Print PROT_READ before PROT_EXEC to match strace output Helps with comparing 'strace' and 'perf trace' output, for mutual regression testing. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-va0qe95xbhep5hy52aq5qe0v@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/trace/beauty/mmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fb7068e73d2c24ba381938004ed0f285341ef1ba Author: Arnaldo Carvalho de Melo Date: Tue Dec 18 11:05:56 2018 -0300 perf trace beauty: Beautify arch_prctl()'s arguments This actually so far, AFAIK is available only in x86, so the code was put in place with x86 prefixes, in arches where it is not available it will just not be called, so no further mechanisms are needed at this time. Later, when other arches wire this up, we'll just look at the uname (live sessions) or perf_env data in the perf.data header to auto-wire the right beautifier. With this the output is the same as produced by 'strace' when used with the following ~/.perfconfig: # cat ~/.perfconfig [llvm] dump-obj = true [trace] add_events = /home/acme/git/perf/tools/perf/examples/bpf/augmented_raw_syscalls.o show_zeros = yes show_duration = no no_inherit = yes show_timestamp = no show_arg_names = no args_alignment = -40 show_prefix = yes # And, on fedora 29, since the string tables are generated from the kernel sources, we don't know about 0x3001, just like strace: --- /tmp/strace 2018-12-17 11:22:08.707586721 -0300 +++ /tmp/trace 2018-12-18 11:11:32.037512729 -0300 @@ -1,49 +1,49 @@ -arch_prctl(0x3001 /* ARCH_??? */, 0x7ffc8a92dc80) = -1 EINVAL (Invalid argument) +arch_prctl(0x3001 /* ARCH_??? */, 0x7ffe4eb93ae0) = -1 EINVAL (Invalid argument) -arch_prctl(ARCH_SET_FS, 0x7faf6700f540) = 0 +arch_prctl(ARCH_SET_FS, 0x7fb507364540) = 0 And that seems to be related to the CET/Shadow Stack feature, that userland in Fedora 29 (glibc 2.28) are querying the kernel about, that 0x3001 seems to be ARCH_CET_STATUS, I'll check the situation and test with a fedora 29 kernel to see if the other codes are used. A diff that ignores the different pointers for different runs needs to be put in place in the upcoming regression tests comparing 'perf trace's output to strace's. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-73a9prs8ktkrt97trtdmdjs8@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-trace.c | 5 ++++- tools/perf/trace/beauty/Build | 1 + tools/perf/trace/beauty/arch_prctl.c | 33 +++++++++++++++++++++++++++++++++ tools/perf/trace/beauty/beauty.h | 3 +++ 4 files changed, 41 insertions(+), 1 deletion(-) commit 9614b8d697350d529743702f095b3db3f6d5a889 Author: Arnaldo Carvalho de Melo Date: Tue Dec 18 10:54:19 2018 -0300 perf trace: When showing string prefixes show prefix + ??? for unknown entries To match 'strace' output, like in: arch_prctl(0x3001 /* ARCH_??? */, 0x7ffc8a92dc80) = -1 EINVAL (Invalid argument) Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-kx59j2dk5l1x04ou57mt99ck@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-trace.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) commit 1f2d085e0f25a40eeb0ac032fd399be94f866adb Author: Arnaldo Carvalho de Melo Date: Tue Dec 18 10:25:28 2018 -0300 perf trace: Move strarrays to beauty.h for further reuse We'll use it in the upcoming arch_prctl() 'code' arg beautifier. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-6e4tj2fjen8qa73gy4u49vav@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-trace.c | 26 ++++++++++---------------- tools/perf/trace/beauty/beauty.h | 12 ++++++++++++ 2 files changed, 22 insertions(+), 16 deletions(-) commit 40714e8b37723c31aa1b48dd2f346c3827059957 Author: Arnaldo Carvalho de Melo Date: Mon Dec 17 17:00:14 2018 -0300 perf beauty: Wire up the x86_arch prctl code table generator $ cat /tmp/build/perf/trace/beauty/generated/x86_arch_prctl_code_array.c #define x86_arch_prctl_codes_1_offset 0x1001 static const char *x86_arch_prctl_codes_1[] = { [0x1001 - 0x1001]= "SET_GS", [0x1002 - 0x1001]= "SET_FS", [0x1003 - 0x1001]= "GET_FS", [0x1004 - 0x1001]= "GET_GS", [0x1011 - 0x1001]= "GET_CPUID", [0x1012 - 0x1001]= "SET_CPUID", }; #define x86_arch_prctl_codes_2_offset 0x2001 static const char *x86_arch_prctl_codes_2[] = { [0x2001 - 0x2001]= "MAP_VDSO_X32", [0x2002 - 0x2001]= "MAP_VDSO_32", [0x2003 - 0x2001]= "MAP_VDSO_64", }; $ Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-3r9blij6n8wdlsyd5dujx86r@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/Makefile.perf | 9 +++++++++ 1 file changed, 9 insertions(+) commit ff4cb769bc2dcc9a74a1c29e403bcfaf789365ef Author: Arnaldo Carvalho de Melo Date: Mon Dec 17 16:11:37 2018 -0300 perf beauty: Add a string table generator for x86's 'arch_prctl' codes $ tools/perf/trace/beauty/x86_arch_prctl.sh #define x86_arch_prctl_codes_1_offset 0x1001 static const char *x86_arch_prctl_codes_1[] = { [0x1001 - 0x1001]= "SET_GS", [0x1002 - 0x1001]= "SET_FS", [0x1003 - 0x1001]= "GET_FS", [0x1004 - 0x1001]= "GET_GS", [0x1011 - 0x1001]= "GET_CPUID", [0x1012 - 0x1001]= "SET_CPUID", }; #define x86_arch_prctl_codes_2_offset 0x2001 static const char *x86_arch_prctl_codes_2[] = { [0x2001 - 0x2001]= "MAP_VDSO_X32", [0x2002 - 0x2001]= "MAP_VDSO_32", [0x2003 - 0x2001]= "MAP_VDSO_64", }; $ Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-w0fux1psivphhx6rve8kn3vq@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/trace/beauty/x86_arch_prctl.sh | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) commit c22e2683c0cbfb8dcac84529d29386b094cd78cf Author: Arnaldo Carvalho de Melo Date: Mon Dec 17 16:15:27 2018 -0300 tools include arch: Grab a copy of x86's prctl.h We need it to generate the tables for the 'code' arch_prctl's syscall argument. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-vu890pi18fpd4eyz61cazckj@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/arch/x86/include/uapi/asm/prctl.h | 17 +++++++++++++++++ tools/perf/check-headers.sh | 1 + 2 files changed, 18 insertions(+) commit ce05539f20b337221d3310baf73b45317dab067c Author: Arnaldo Carvalho de Melo Date: Mon Dec 17 12:21:09 2018 -0300 perf trace: Show NULL when syscall pointer args are 0 Matching strace's output format. The 'format' file for the syscall tracepoints have an indication if the arg is a pointer, with some exceptions like 'mmap' that has its first arg as an 'unsigned long', so use a heuristic using the argument name, i.e. if it contains the 'addr' substring, format it with the pointer formatter. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-ddghemr8qrm6i0sb8awznbze@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-trace.c | 28 ++++++++++++---------------- tools/perf/trace/beauty/beauty.h | 3 +++ 2 files changed, 15 insertions(+), 16 deletions(-) commit 2c83dfae021306d528b21dceb8d128ca16524c5a Author: Arnaldo Carvalho de Melo Date: Mon Dec 17 12:06:34 2018 -0300 perf trace: Enclose the errno strings with () To match strace, now both emit the same line for calls like: access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-krxl6klsqc9qyktoaxyih942@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-trace.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit c48ee107bb387f76b089e0c30e1fed26e8d921f0 Author: Arnaldo Carvalho de Melo Date: Mon Dec 17 11:59:35 2018 -0300 perf augmented_raw_syscalls: Copy 'access' arg as well This will all come from userspace, but to test the changes to make 'perf trace' output similar to strace's, do this one more now manually. To update the precompiled augmented_raw_syscalls.o binary I just run: # perf record -e ~acme/git/perf/tools/perf/examples/bpf/augmented_raw_syscalls.c sleep 1 LLVM: dumping /home/acme/git/perf/tools/perf/examples/bpf/augmented_raw_syscalls.o [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.022 MB perf.data ] # Because to have augmented_raw_syscalls to be always used and a fast startup and remove the need to have the llvm toolchain installed, I'm using: # perf config | grep add_events trace.add_events=/home/acme/git/perf/tools/perf/examples/bpf/augmented_raw_syscalls.o # So when doing changes to augmented_raw_syscals.c one needs to rebuild the .o file. This will be done automagically later, i.e. have a 'make' behaviour of recompiling when the .c gets changed. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-lw3i2atyq8549fpqwmszn3qp@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/examples/bpf/augmented_raw_syscalls.c | 2 ++ 1 file changed, 2 insertions(+) commit 4b8a240ed5e0a4e6b53c994ddfcff86a06879a66 Author: Arnaldo Carvalho de Melo Date: Mon Dec 17 11:48:46 2018 -0300 perf trace: Add alignment spaces after the closing parens To use strace's style, helping in comparing the output of 'perf trace' with the one from 'strace', to help in upcoming regression tests. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-mw6peotz4n84rga0fk78buff@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-trace.c | 37 ++++++++++++++++++++++++++----------- 1 file changed, 26 insertions(+), 11 deletions(-) commit 4785860e04bc8d7e244b25257168e1cf8a5529ab Author: Jason Gunthorpe Date: Fri Nov 30 13:06:21 2018 +0200 RDMA/uverbs: Implement an ioctl that can call write and write_ex handlers Now that the handlers do not process their own udata we can make a sensible ioctl that wrappers them. The ioctl follows the same format as the write_ex() and has the user explicitly specify the core and driver in/out opaque structures and a command number. This works for all forms of write commands. Signed-off-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/core/Makefile | 2 +- drivers/infiniband/core/rdma_core.h | 5 ++ drivers/infiniband/core/uverbs.h | 1 - drivers/infiniband/core/uverbs_ioctl.c | 40 ++++++++------- drivers/infiniband/core/uverbs_std_types.c | 3 -- drivers/infiniband/core/uverbs_std_types_device.c | 60 +++++++++++++++++++++++ drivers/infiniband/core/uverbs_uapi.c | 1 + include/uapi/rdma/ib_user_ioctl_cmds.h | 10 ++++ include/uapi/rdma/ib_user_verbs.h | 2 +- 9 files changed, 100 insertions(+), 24 deletions(-) commit 601d66d43309534eb7a268bdc42c205521014645 Author: Arnaldo Carvalho de Melo Date: Mon Dec 17 11:55:57 2018 -0300 perf trace beauty: Print O_RDONLY when (flags & O_ACCMODE) == 0 And there are more flags, to match strace's output. openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3 Also to help with regression tests. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-ofovpmvdli3bwch30936xn7t@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/trace/beauty/open_flags.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit c65c83ffe904590162bd762be185ac4d53ce5a85 Author: Arnaldo Carvalho de Melo Date: Fri Dec 14 17:06:47 2018 -0300 perf trace: Allow asking for not suppressing common string prefixes So far we've been suppressing common stuff such as "MAP_" in the mmap flags, showing "SHARED" instead of "MAP_SHARED", allow for those prefixes (and a few suffixes) to be shown: # trace -e *map,open*,*seek sleep 1 openat("/etc/ld.so.cache", CLOEXEC) = 3 mmap(0, 109093, READ, PRIVATE, 3, 0) = 0x7ff61c695000 openat("/lib64/libc.so.6", CLOEXEC) = 3 lseek(3, 792, SET) = 792 mmap(0, 8192, READ|WRITE, PRIVATE|ANONYMOUS) = 0x7ff61c693000 lseek(3, 792, SET) = 792 lseek(3, 864, SET) = 864 mmap(0, 1857568, READ, PRIVATE|DENYWRITE, 3, 0) = 0x7ff61c4cd000 mmap(0x7ff61c4ef000, 1363968, EXEC|READ, PRIVATE|FIXED|DENYWRITE, 3, 139264) = 0x7ff61c4ef000 mmap(0x7ff61c63c000, 311296, READ, PRIVATE|FIXED|DENYWRITE, 3, 1503232) = 0x7ff61c63c000 mmap(0x7ff61c689000, 24576, READ|WRITE, PRIVATE|FIXED|DENYWRITE, 3, 1814528) = 0x7ff61c689000 mmap(0x7ff61c68f000, 14368, READ|WRITE, PRIVATE|FIXED|ANONYMOUS) = 0x7ff61c68f000 munmap(0x7ff61c695000, 109093) = 0 openat("/usr/lib/locale/locale-archive", CLOEXEC) = 3 mmap(0, 217749968, READ, PRIVATE, 3, 0) = 0x7ff60f523000 # # vim ~/.perfconfig # # perf config llvm.dump-obj=true trace.add_events=/home/acme/git/perf/tools/perf/examples/bpf/augmented_raw_syscalls.o trace.show_zeros=yes trace.show_duration=no trace.no_inherit=yes trace.show_timestamp=no trace.show_arg_names=no trace.args_alignment=0 trace.string_quote=" trace.show_prefix=yes # # # trace -e *map,open*,*seek sleep 1 openat(AT_FDCWD, "/etc/ld.so.cache", O_CLOEXEC) = 3 mmap(0, 109093, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f7ebbe59000 openat(AT_FDCWD, "/lib64/libc.so.6", O_CLOEXEC) = 3 lseek(3, 792, SEEK_SET) = 792 mmap(0, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS) = 0x7f7ebbe57000 lseek(3, 792, SEEK_SET) = 792 lseek(3, 864, SEEK_SET) = 864 mmap(0, 1857568, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f7ebbc91000 mmap(0x7f7ebbcb3000, 1363968, PROT_EXEC|PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 139264) = 0x7f7ebbcb3000 mmap(0x7f7ebbe00000, 311296, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 1503232) = 0x7f7ebbe00000 mmap(0x7f7ebbe4d000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 1814528) = 0x7f7ebbe4d000 mmap(0x7f7ebbe53000, 14368, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS) = 0x7f7ebbe53000 munmap(0x7f7ebbe59000, 109093) = 0 openat(AT_FDCWD, "/usr/lib/locale/locale-archive", O_CLOEXEC) = 3 mmap(0, 217749968, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f7eaece7000 # Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-mtn1i4rjowjl72trtnbmvjd4@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/Documentation/perf-config.txt | 4 ++++ tools/perf/builtin-trace.c | 30 ++++++++++++++++++++---------- tools/perf/trace/beauty/beauty.h | 8 +++++--- tools/perf/trace/beauty/clone.c | 7 ++++--- tools/perf/trace/beauty/eventfd.c | 4 +++- tools/perf/trace/beauty/fcntl.c | 20 +++++++++++--------- tools/perf/trace/beauty/flock.c | 4 +++- tools/perf/trace/beauty/futex_op.c | 8 +++++--- tools/perf/trace/beauty/futex_val3.c | 3 ++- tools/perf/trace/beauty/ioctl.c | 15 +++++++++------ tools/perf/trace/beauty/kcmp.c | 6 +++--- tools/perf/trace/beauty/mmap.c | 16 ++++++++++------ tools/perf/trace/beauty/mode_t.c | 4 +++- tools/perf/trace/beauty/mount_flags.c | 6 +++--- tools/perf/trace/beauty/msg_flags.c | 4 +++- tools/perf/trace/beauty/open_flags.c | 11 ++++++----- tools/perf/trace/beauty/perf_event_open.c | 4 +++- tools/perf/trace/beauty/pkey_alloc.c | 12 ++++++------ tools/perf/trace/beauty/prctl.c | 12 ++++++------ tools/perf/trace/beauty/renameat.c | 6 +++--- tools/perf/trace/beauty/sched_policy.c | 6 ++++-- tools/perf/trace/beauty/seccomp.c | 8 ++++++-- tools/perf/trace/beauty/signum.c | 4 +++- tools/perf/trace/beauty/sockaddr.c | 2 +- tools/perf/trace/beauty/socket.c | 6 +++--- tools/perf/trace/beauty/socket_type.c | 4 +++- tools/perf/trace/beauty/statx.c | 10 +++++++--- tools/perf/trace/beauty/waitid_options.c | 4 +++- 28 files changed, 142 insertions(+), 86 deletions(-) commit 2e3d7fac9db5e80d1cc26bb1453b85245c26d657 Author: Arnaldo Carvalho de Melo Date: Fri Dec 14 15:08:40 2018 -0300 perf trace: Add a prefix member to the strarray class So that the user, in an upcoming patch, can select printing it to get the full string as used in the source code, not one with a common prefix chopped off so as to make the output more compact. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-zypczc88gzbmeqx7b372s138@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-trace.c | 21 +++++++++++---------- tools/perf/trace/beauty/beauty.h | 7 +++++-- tools/perf/trace/beauty/fcntl.c | 2 +- tools/perf/trace/beauty/ioctl.c | 16 ++++++++-------- tools/perf/trace/beauty/kcmp.c | 2 +- tools/perf/trace/beauty/mmap.c | 4 ++-- tools/perf/trace/beauty/mount_flags.c | 2 +- tools/perf/trace/beauty/pkey_alloc.c | 2 +- tools/perf/trace/beauty/prctl.c | 4 ++-- tools/perf/trace/beauty/renameat.c | 2 +- tools/perf/trace/beauty/sockaddr.c | 2 +- tools/perf/trace/beauty/socket.c | 2 +- 12 files changed, 35 insertions(+), 31 deletions(-) commit 721f5326fb35dcba18ee4d9ef2b32394f86d403e Author: Arnaldo Carvalho de Melo Date: Fri Dec 14 14:02:03 2018 -0300 perf trace: Enclose strings with double quotes To match 'strace' output, helping with upcoming regression tests comparing both outputs. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-jab52t1dcuh6vlztqle9g7u9@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-trace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9ed45d59aeae2211933b032acc4e5b40a1a2fcd3 Author: Arnaldo Carvalho de Melo Date: Fri Dec 14 13:40:49 2018 -0300 perf trace: Make the alignment of the syscall args be configurable Since the start 'perf trace' aligns the parens enclosing the list of syscall args to align the syscall results, allow this to be configurable, keeping the default of 70. Using: # perf config llvm.dump-obj=true trace.add_events=/home/acme/git/perf/tools/perf/examples/bpf/augmented_raw_syscalls.o trace.show_zeros=yes trace.show_duration=no trace.no_inherit=yes trace.show_timestamp=no trace.show_arg_names=no trace.args_alignment=0 # trace -e open*,close,*sleep sleep 1 openat(CWD, /etc/ld.so.cache, CLOEXEC) = 3 close(3) = 0 openat(CWD, /lib64/libc.so.6, CLOEXEC) = 3 close(3) = 0 openat(CWD, /usr/lib/locale/locale-archive, CLOEXEC) = 3 close(3) = 0 nanosleep(0x7ffc00de66f0, 0) = 0 close(1) = 0 close(2) = 0 # Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-r8cbhoz1lr5npq9tutpvoigr@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/Documentation/perf-config.txt | 4 ++++ tools/perf/builtin-trace.c | 12 +++++++++--- 2 files changed, 13 insertions(+), 3 deletions(-) commit f366d3854ec0fec0f9949dac46431598614a956b Merge: ccec4a4a4f27 b422847877e3 Author: Boris Brezillon Date: Tue Dec 18 20:00:52 2018 +0100 Merge tag 'spi-nor/for-4.21' of git://git.infradead.org/linux-mtd into mtd/next Core changes: - Parse the 4BAIT SFDP section - Add a bunch of SPI NOR entries to the flash_info table - Add the concept of SFDP fixups and use it to fix a bug on MX25L25635F - A bunch of minor cleanups/comestic changes commit ccec4a4a4f27b22e51ec6a143319db49b7570581 Merge: 7677ea0e8843 732774437ae0 Author: Boris Brezillon Date: Tue Dec 18 19:59:16 2018 +0100 Merge tag 'nand/for-4.21' of git://git.infradead.org/linux-mtd into mtd/next NAND core changes: - kernel-doc miscellaneous fixes. - Third batch of fixes/cleanup to the raw NAND core impacting various controller drivers (ams-delta, marvell, fsmc, denali, tegra, vf610): * Stopping to pass mtd_info objects to internal functions * Reorganizing code to avoid forward declarations * Dropping useless test in nand_legacy_set_defaults() * Moving nand_exec_op() to internal.h * Adding nand_[de]select_target() helpers * Passing the CS line to be selected in struct nand_operation * Making ->select_chip() optional when ->exec_op() is implemented * Deprecating the ->select_chip() hook * Moving the ->exec_op() method to nand_controller_ops * Moving ->setup_data_interface() to nand_controller_ops * Deprecating the dummy_controller field * Fixing JEDEC detection * Providing a helper for polling GPIO R/B pin Raw NAND chip drivers changes: - Macronix: * Flagging 1.8V AC chips with a broken GET_FEATURES(TIMINGS) Raw NAND controllers drivers changes: - Ams-delta: * Fixing the error path * SPDX tag added * May be compiled with COMPILE_TEST=y * Conversion to ->exec_op() interface * Dropping .IOADDR_R/W use * Use GPIO API for data I/O - Denali: * Removing denali_reset_banks() * Removing ->dev_ready() hook * Including instead of * Changes to comply with the above fixes/cleanup done in the core. - FSMC: * Adding an SPDX tag to replace the license text * Making conversion from chip to fsmc consistent * Fixing unchecked return value in fsmc_read_page_hwecc * Changes to comply with the above fixes/cleanup done in the core. - Marvell: * Preventing timeouts on a loaded machine (fix) * Changes to comply with the above fixes/cleanup done in the core. - OMAP2: * Pass the parent of pdev to dma_request_chan() (fix) - R852: * Use generic DMA API - sh_flctl: * Converting to SPDX identifiers - Sunxi: * Write pageprog related opcodes to the right register: WCMD_SET (fix) - Tegra: * Stop implementing ->select_chip() - VF610: * Adding an SPDX tag to replace the license text * Changes to comply with the above fixes/cleanup done in the core. - Various trivial/spelling/coding style fixes. SPI-NAND drivers changes: - Removing the depreacated mt29f_spinand driver from staging. - Adding support for: * Toshiba TC58CVG2S0H * GigaDevice GD5FxGQ4xA * Winbond W25N01GV commit a9d25bde1e9b24161dd798e1d23eb7eb9674012a Author: Nick Bowler Date: Mon Dec 17 09:35:27 2018 -0800 xfs: Fix x32 ioctls when cmd numbers differ from ia32. Several ioctl structs change size between native 32-bit (ia32) and x32 applications, because x32 follows the native 64-bit (amd64) integer alignment rules and uses 64-bit time_t. In these instances, the ioctl number changes so userspace simply gets -ENOTTY. This scenario can be handled by simply adding more cases. Looking at the different ioctls implemented here: - All the ones marked 'No size or alignment issue on any arch' should presumably all be fine. - All the ones under BROKEN_X86_ALIGNMENT are different under integer alignment rules. Since x32 matches amd64 here, we just need both sets of cases handled. - XFS_IOC_SWAPEXT has both integer alignment differences and time_t differences. Since x32 matches amd64 here, we need to add a case which calls the native implementation. - The remaining ioctls have neither 64-bit integers nor time_t, so x32 matches ia32 here and no change is required at this level. The bulkstat ioctl implementations have some pointer chasing which is handled separately. Signed-off-by: Nick Bowler Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/xfs_ioctl32.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) commit 7ca860e3c1a74ad6bd8949364073ef1044cad758 Author: Nick Bowler Date: Mon Dec 17 09:35:27 2018 -0800 xfs: Fix bulkstat compat ioctls on x32 userspace. The bulkstat family of ioctls are problematic on x32, because there is a mixup of native 32-bit and 64-bit conventions. The xfs_fsop_bulkreq struct contains pointers and 32-bit integers so that matches the native 32-bit layout, and that means the ioctl implementation goes into the regular compat path on x32. However, the 'ubuffer' member of that struct in turn refers to either struct xfs_inogrp or xfs_bstat (or an array of these). On x32, those structures match the native 64-bit layout. The compat implementation writes out the 32-bit version of these structures. This is not the expected format for x32 userspace, causing problems. Fortunately the functions which actually output these xfs_inogrp and xfs_bstat structures have an easy way to select which output format is required, so we just need a little tweak to select the right format on x32. Signed-off-by: Nick Bowler Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/xfs_ioctl32.c | 34 ++++++++++++++++++++++++++++++---- 1 file changed, 30 insertions(+), 4 deletions(-) commit c456d64449efe37da50832b63d91652a85ea1d20 Author: Nick Bowler Date: Mon Dec 17 09:35:27 2018 -0800 xfs: Align compat attrlist_by_handle with native implementation. While inspecting the ioctl implementations, I noticed that the compat implementation of XFS_IOC_ATTRLIST_BY_HANDLE does not do exactly the same thing as the native implementation. Specifically, the "cursor" does not appear to be written out to userspace on the compat path, like it is on the native path. This adjusts the compat implementation to copy out the cursor just like the native implementation does. The attrlist cursor does not require any special compat handling. This fixes xfstests xfs/269 on both IA-32 and x32 userspace, when running on an amd64 kernel. Signed-off-by: Nick Bowler Fixes: 0facef7fb053b ("xfs: in _attrlist_by_handle, copy the cursor back to userspace") Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/xfs_ioctl32.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 74694bcbdf7e28a5ad548cdda9ac56d30be00d13 Author: Heinz Mauelshagen Date: Tue Dec 18 17:35:41 2018 +0100 dm raid: fix false -EBUSY when handling check/repair message Sending a check/repair message infrequently leads to -EBUSY instead of properly identifying an active resync. This occurs because raid_message() is testing recovery bits in a racy way. Fix by calling decipher_sync_action() from raid_message() to properly identify the idle state of the RAID device. Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer drivers/md/dm-raid.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit ff3730a497cd636e53d4cac5cbb9652b76de9ef5 Merge: c5f48c0a7aa1 fb94109b764e Author: Thomas Gleixner Date: Tue Dec 18 18:37:27 2018 +0100 Merge tag 'irqchip-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms into irq/core Pull irqchip updates from Marc Zyngier: - A bunch of new irqchip drivers (RDA8810PL, Madera, imx-irqsteer) - Updates for new (and old) platforms (i.MX8MQ, F1C100s) - A number of SPDX cleanups - A workaround for a very broken GICv3 implementation - A platform-msi fix - Various cleanups commit 41c4f85cdac280d356df1f483000ecec4a8868be Author: Javier Barrio Date: Thu Dec 13 01:06:29 2018 +0100 quota: Lock s_umount in exclusive mode for Q_XQUOTA{ON,OFF} quotactls. Commit 1fa5efe3622db58cb8c7b9a50665e9eb9a6c7e97 (ext4: Use generic helpers for quotaon and quotaoff) made possible to call quotactl(Q_XQUOTAON/OFF) on ext4 filesystems with sysfile quota support. This leads to calling dquot_enable/disable without s_umount held in excl. mode, because quotactl_cmd_onoff checks only for Q_QUOTAON/OFF. The following WARN_ON_ONCE triggers (in this case for dquot_enable, ext4, latest Linus' tree): [ 117.807056] EXT4-fs (dm-0): mounted filesystem with ordered data mode. Opts: quota,prjquota [...] [ 155.036847] WARNING: CPU: 0 PID: 2343 at fs/quota/dquot.c:2469 dquot_enable+0x34/0xb9 [ 155.036851] Modules linked in: quota_v2 quota_tree ipv6 af_packet joydev mousedev psmouse serio_raw pcspkr i2c_piix4 intel_agp intel_gtt e1000 ttm drm_kms_helper drm agpgart fb_sys_fops syscopyarea sysfillrect sysimgblt i2c_core input_leds kvm_intel kvm irqbypass qemu_fw_cfg floppy evdev parport_pc parport button crc32c_generic dm_mod ata_generic pata_acpi ata_piix libata loop ext4 crc16 mbcache jbd2 usb_storage usbcore sd_mod scsi_mod [ 155.036901] CPU: 0 PID: 2343 Comm: qctl Not tainted 4.20.0-rc6-00025-gf5d582777bcb #9 [ 155.036903] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 [ 155.036911] RIP: 0010:dquot_enable+0x34/0xb9 [ 155.036915] Code: 41 56 41 55 41 54 55 53 4c 8b 6f 28 74 02 0f 0b 4d 8d 7d 70 49 89 fc 89 cb 41 89 d6 89 f5 4c 89 ff e8 23 09 ea ff 85 c0 74 0a <0f> 0b 4c 89 ff e8 8b 09 ea ff 85 db 74 6a 41 8b b5 f8 00 00 00 0f [ 155.036918] RSP: 0018:ffffb09b00493e08 EFLAGS: 00010202 [ 155.036922] RAX: 0000000000000001 RBX: 0000000000000008 RCX: 0000000000000008 [ 155.036924] RDX: 0000000000000001 RSI: 0000000000000002 RDI: ffff9781b67cd870 [ 155.036926] RBP: 0000000000000002 R08: 0000000000000000 R09: 61c8864680b583eb [ 155.036929] R10: ffffb09b00493e48 R11: ffffffffff7ce7d4 R12: ffff9781b7ee8d78 [ 155.036932] R13: ffff9781b67cd800 R14: 0000000000000004 R15: ffff9781b67cd870 [ 155.036936] FS: 00007fd813250b88(0000) GS:ffff9781ba000000(0000) knlGS:0000000000000000 [ 155.036939] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 155.036942] CR2: 00007fd812ff61d6 CR3: 000000007c882000 CR4: 00000000000006b0 [ 155.036951] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 155.036953] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 155.036955] Call Trace: [ 155.037004] dquot_quota_enable+0x8b/0xd0 [ 155.037011] kernel_quotactl+0x628/0x74e [ 155.037027] ? do_mprotect_pkey+0x2a6/0x2cd [ 155.037034] __x64_sys_quotactl+0x1a/0x1d [ 155.037041] do_syscall_64+0x55/0xe4 [ 155.037078] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 155.037105] RIP: 0033:0x7fd812fe1198 [ 155.037109] Code: 02 77 0d 48 89 c1 48 c1 e9 3f 75 04 48 8b 04 24 48 83 c4 50 5b c3 48 83 ec 08 49 89 ca 48 63 d2 48 63 ff b8 b3 00 00 00 0f 05 <48> 89 c7 e8 c1 eb ff ff 5a c3 48 63 ff b8 bb 00 00 00 0f 05 48 89 [ 155.037112] RSP: 002b:00007ffe8cd7b050 EFLAGS: 00000206 ORIG_RAX: 00000000000000b3 [ 155.037116] RAX: ffffffffffffffda RBX: 00007ffe8cd7b148 RCX: 00007fd812fe1198 [ 155.037119] RDX: 0000000000000000 RSI: 00007ffe8cd7cea9 RDI: 0000000000580102 [ 155.037121] RBP: 00007ffe8cd7b0f0 R08: 000055fc8eba8a9d R09: 0000000000000000 [ 155.037124] R10: 00007ffe8cd7b074 R11: 0000000000000206 R12: 00007ffe8cd7b168 [ 155.037126] R13: 000055fc8eba8897 R14: 0000000000000000 R15: 0000000000000000 [ 155.037131] ---[ end trace 210f864257175c51 ]--- and then the syscall proceeds without s_umount locking. This patch locks the superblock ->s_umount sem. in exclusive mode for all Q_XQUOTAON/OFF quotactls too in addition to Q_QUOTAON/OFF. AFAICT, other than ext4, only xfs and ocfs2 are affected by this change. The VFS will now call in xfs_quota_* functions with s_umount held, which wasn't the case before. This looks good to me but I can not say for sure. Ext4 and ocfs2 where already beeing called with s_umount exclusive via quota_quotaon/off which is basically the same. Signed-off-by: Javier Barrio Signed-off-by: Jan Kara fs/quota/quota.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 58f9d806d16a38ed3bae11e2ada83393436a4956 Author: Oleksandr Andrushchenko Date: Fri Nov 30 09:42:05 2018 +0200 ALSA: xen-front: Use Xen common shared buffer implementation Use page directory based shared buffer implementation now available as common code for Xen frontend drivers. Signed-off-by: Oleksandr Andrushchenko Reviewed-by: Takashi Iwai Signed-off-by: Boris Ostrovsky sound/xen/Kconfig | 1 + sound/xen/Makefile | 1 - sound/xen/xen_snd_front.c | 7 +- sound/xen/xen_snd_front.h | 4 +- sound/xen/xen_snd_front_alsa.c | 102 +++++++++++++++------ sound/xen/xen_snd_front_shbuf.c | 194 ---------------------------------------- sound/xen/xen_snd_front_shbuf.h | 36 -------- 7 files changed, 84 insertions(+), 261 deletions(-) commit 5641f19bdfc4193f1c2d5a829896c25dd5c0ec3d Author: Oleksandr Andrushchenko Date: Fri Nov 30 09:42:04 2018 +0200 drm/xen-front: Use Xen common shared buffer implementation Use page directory based shared buffer implementation now available as common code for Xen frontend drivers. Remove flushing of shared buffer on page flip as this workaround needs a proper fix. Signed-off-by: Oleksandr Andrushchenko Reviewed-by: Noralf Trønnes Signed-off-by: Boris Ostrovsky drivers/gpu/drm/xen/Kconfig | 1 + drivers/gpu/drm/xen/Makefile | 1 - drivers/gpu/drm/xen/xen_drm_front.c | 65 ++--- drivers/gpu/drm/xen/xen_drm_front_gem.c | 1 - drivers/gpu/drm/xen/xen_drm_front_shbuf.c | 414 ------------------------------ drivers/gpu/drm/xen/xen_drm_front_shbuf.h | 64 ----- 6 files changed, 26 insertions(+), 520 deletions(-) commit b3383974fee272ad0d444a2d083f456879447cd8 Author: Oleksandr Andrushchenko Date: Fri Nov 30 09:42:03 2018 +0200 xen: Introduce shared buffer helpers for page directory... based frontends. Currently the frontends which implement similar code for sharing big buffers between frontend and backend are para-virtualized DRM and sound drivers. Both define the same way to share grant references of a data buffer with the corresponding backend with little differences. Move shared code into a helper module, so there is a single implementation of the same functionality for all. This patch introduces code which is used by sound and display frontend drivers without functional changes with the intention to remove shared code from the corresponding drivers. Signed-off-by: Oleksandr Andrushchenko Acked-by: Boris Ostrovsky Signed-off-by: Boris Ostrovsky drivers/xen/Kconfig | 3 + drivers/xen/Makefile | 1 + drivers/xen/xen-front-pgdir-shbuf.c | 553 ++++++++++++++++++++++++++++++++++++ include/xen/xen-front-pgdir-shbuf.h | 89 ++++++ 4 files changed, 646 insertions(+) commit 6ab7d47bcbf0144a8cb81536c2cead4cde18acfe Author: Dennis Zhou Date: Tue Dec 18 08:42:27 2018 -0800 percpu: convert spin_lock_irq to spin_lock_irqsave. From Michael Cree: "Bisection lead to commit b38d08f3181c ("percpu: restructure locking") as being the cause of lockups at initial boot on the kernel built for generic Alpha. On a suggestion by Tejun Heo that: So, the only thing I can think of is that it's calling spin_unlock_irq() while irq handling isn't set up yet. Can you please try the followings? 1. Convert all spin_[un]lock_irq() to spin_lock_irqsave/unlock_irqrestore()." Fixes: b38d08f3181c ("percpu: restructure locking") Reported-and-tested-by: Michael Cree Acked-by: Tejun Heo Signed-off-by: Dennis Zhou mm/percpu-km.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit ff8519f9e91170cd24ed503aa77d144e71bd4d92 Author: Sagi Grimberg Date: Fri Dec 14 11:06:10 2018 -0800 nvme-rdma: implement polling queue map When passed with nr_poll_queues setup additional queues with cq polling context IB_POLL_DIRECT (no interrupts) and make sure to set QUEUE_FLAG_POLL on the connect_q. In addition add the third queue mapping for polling queues. nvmf connect on this queue is polled for like all other requests so make nvmf_connect_io_queue poll for polling queues. Signed-off-by: Sagi Grimberg Signed-off-by: Christoph Hellwig drivers/nvme/host/rdma.c | 49 ++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 43 insertions(+), 6 deletions(-) commit 89d43802b0e7298bc0b464bdb5fff864074e2218 Author: Sagi Grimberg Date: Fri Dec 14 11:06:09 2018 -0800 nvme-fabrics: allow user to pass in nr_poll_queues This argument will specify how many polling I/O queues to connect when creating the controller. These I/O queues will host I/O that is set with REQ_HIPRI. Reviewed-by: Steve Wise Signed-off-by: Sagi Grimberg Signed-off-by: Christoph Hellwig drivers/nvme/host/fabrics.c | 13 +++++++++++++ drivers/nvme/host/fabrics.h | 3 +++ 2 files changed, 16 insertions(+) commit 26c682274e0a7d055e123499eac8ec39d0e04283 Author: Sagi Grimberg Date: Fri Dec 14 11:06:08 2018 -0800 nvme-fabrics: allow nvmf_connect_io_queue to poll Preparation for polling support for fabrics. Polling support means that our completion queues are not generating any interrupts which means we need to poll for the nvmf io queue connect as well. Reviewed by Steve Wise Signed-off-by: Sagi Grimberg Signed-off-by: Christoph Hellwig drivers/nvme/host/fabrics.c | 4 ++-- drivers/nvme/host/fabrics.h | 2 +- drivers/nvme/host/fc.c | 2 +- drivers/nvme/host/rdma.c | 2 +- drivers/nvme/host/tcp.c | 2 +- drivers/nvme/target/loop.c | 2 +- 6 files changed, 7 insertions(+), 7 deletions(-) commit 6287b51c77e6d8f05f772931cf51d80e81651a9f Author: Sagi Grimberg Date: Fri Dec 14 11:06:07 2018 -0800 nvme-core: optionally poll sync commands Pass poll bool to indicate that we need it to poll. This prepares us for polling support in nvmf since connect is an I/O that will be queued and has to be polled in order to complete. If poll is passed, we call nvme_execute_rq_polled which sends the requests and polls for its completion. Signed-off-by: Sagi Grimberg Signed-off-by: Christoph Hellwig drivers/nvme/host/core.c | 38 +++++++++++++++++++++++++++++++++----- drivers/nvme/host/fabrics.c | 10 +++++----- drivers/nvme/host/nvme.h | 2 +- 3 files changed, 39 insertions(+), 11 deletions(-) commit 7b7ab780a048699d2b9f416bf2d5c089d8d1028c Author: Sagi Grimberg Date: Fri Dec 14 11:06:06 2018 -0800 block: make request_to_qc_t public block consumers will need it for polling requests that are sent with blk_execute_rq_nowait. Also, get rid of blk_tag_to_qc_t and open-code it instead. Reviewed-by: Jens Axboe Signed-off-by: Sagi Grimberg Signed-off-by: Christoph Hellwig block/blk-mq.c | 8 -------- include/linux/blk-mq.h | 10 ++++++++++ include/linux/blk_types.h | 11 ----------- 3 files changed, 10 insertions(+), 19 deletions(-) commit 56a77d26d6316a3936497236c7e3a6a98fad950c Author: Colin Ian King Date: Fri Dec 14 11:42:43 2018 +0000 nvme-tcp: fix spelling mistake "attepmpt" -> "attempt" There is a spelling mistake in a dev_info message, fix it. Signed-off-by: Colin Ian King Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig drivers/nvme/host/tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a7273d40232fbc1f89212b973d588aeaa61161b2 Author: Christoph Hellwig Date: Thu Dec 13 09:46:59 2018 +0100 nvme-tcp: fix endianess annotations Signed-off-by: Christoph Hellwig Reviewed-by: Sagi Grimberg drivers/nvme/host/tcp.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit f4d10b5c85b5f118c6e55288afd053f5c8c5fc98 Author: Christoph Hellwig Date: Thu Dec 13 09:41:15 2018 +0100 nvmet-tcp: fix endianess annotations Signed-off-by: Christoph Hellwig Acked-by: Sagi Grimberg drivers/nvme/target/tcp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 91a509f8b7a8a518723e1755b876b46c537baaef Author: Christoph Hellwig Date: Thu Dec 13 09:48:00 2018 +0100 nvme-pci: refactor nvme_poll_irqdisable to make sparse happy By duplicating the nvme_process_cq in both branches we keep the sparse lock context checking happy, so do it. Signed-off-by: Christoph Hellwig Reviewed-by: Sagi Grimberg drivers/nvme/host/pci.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit ed92ad37e88555864f1f830db4037b9535b3392c Author: Christoph Hellwig Date: Fri Dec 14 14:06:59 2018 +0100 nvme-pci: only set nr_maps to 2 if poll queues are supported The block layer now enables polling support on a queue if nr_maps includes the poll map, so we should only set that if we actually support poll queues. Fixes: 6544d229bf ("block: enable polling by default if a poll map is initalized") Signed-off-by: Christoph Hellwig Reviewed-by: Jens Axboe Reviewed-by: Sagi Grimberg drivers/nvme/host/pci.c | 3 +++ 1 file changed, 3 insertions(+) commit 5698b805fbf09a5dfa60829f5a179c0568a8dc3b Author: Chaitanya Kulkarni Date: Mon Dec 17 18:35:29 2018 -0800 nvmet: use a macro for default error location This patch defines a new macro NVMET_NO_ERROR_LOC to represent the default error location value in the nvme-error-log-page. This is a pure cleanup patch and it does not change any functionality. Signed-off-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig drivers/nvme/target/core.c | 4 ++-- drivers/nvme/target/nvmet.h | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) commit 66c6afbd7321983be4c4160aff4d79e52af84a60 Author: Colin Ian King Date: Fri Dec 14 18:31:21 2018 +0000 nvmet: fix comparison of a u16 with -1 Currently the u16 req->error_loc is being compared to -1 which will always be false. Fix this by casting -1 to u16 to fix this. Detected by clang: warning: result of comparison of constant -1 with expression of type 'u16' (aka 'unsigned short') is always false [-Wtautological-constant-out-of-range-compare] Fixes: 76574f37bf4c ("nvmet: add interface to update error-log page") Signed-off-by: Colin Ian King Signed-off-by: Christoph Hellwig drivers/nvme/target/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 77c7a7b3e7da2c97c182c7e57a16d16c6b555c24 Merge: b12c97d45cd0 77990464bb39 Author: David S. Miller Date: Tue Dec 18 08:49:48 2018 -0800 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next Steffen Klassert says: ==================== pull request (net-next): ipsec-next 2018-12-18 1) Add xfrm policy selftest scripts. From Florian Westphal. 2) Split inexact policies into four different search list classes and use the rbtree infrastructure to store/lookup the policies. This is to improve the policy lookup performance after the flowcache removal. Patches from Florian Westphal. 3) Various coding style fixes, from Colin Ian King. 4) Fix policy lookup logic after adding the inexact policy search tree infrastructure. From Florian Westphal. 5) Remove a useless remove BUG_ON from xfrm6_dst_ifdown. From Li RongQing. 6) Use the correct policy direction for lookups on hash rebuilding. From Florian Westphal. Please pull or let me know if there are problems. ==================== Signed-off-by: David S. Miller commit bc0205612bbd4dd4026d4ba6287f5643c37366ec Author: Bob Peterson Date: Tue Dec 18 08:29:32 2018 -0600 gfs2: take jdata unstuff into account in do_grow Before this patch, function do_grow would not reserve enough journal blocks in the transaction to unstuff jdata files while growing them. This patch adds the logic to add one more block if the file to grow is jdata. Signed-off-by: Bob Peterson Reviewed-by: Andreas Gruenbacher fs/gfs2/bmap.c | 2 ++ 1 file changed, 2 insertions(+) commit fb94109b764e7676fa63834b9033ba97175877a0 Author: Benjamin Gaignard Date: Mon Dec 17 15:22:14 2018 +0100 irqchip/stm32: protect configuration registers with hwspinlock If a hwspinlock is defined in device tree use it to protect configuration registers. Do not request for hwspinlock during the exti driver init since the hwspinlock driver is not probed yet at that stage and the exti driver does not support deferred probe. Instead of this, postpone the hwspinlock request at the first time the hwspinlock is actually needed. Use the hwspin_trylock_raw() API which is the most appropriated here Indeed: - hwspin_lock_() calls are under spin_lock protection (chip_data->rlock or gc->lock). - the _timeout() API relies on jiffies count which won't work if IRQs are disabled which is the case here (a large part of the IRQ setup is done atomically (see irq/manage.c)) As a consequence implement the retry/timeout lock from here. And since all of this is done atomically, reduce the timeout delay to 1 ms. Signed-off-by: Benjamin Gaignard Signed-off-by: Fabien Dessenne Signed-off-by: Marc Zyngier drivers/irqchip/irq-stm32-exti.c | 116 +++++++++++++++++++++++++++++++++------ 1 file changed, 100 insertions(+), 16 deletions(-) commit 897898a69451dc31950d200c0fcdba24428a6482 Author: Benjamin Gaignard Date: Mon Dec 17 15:22:13 2018 +0100 dt-bindings: interrupt-controller: stm32: Document hwlock properties Add hwlocks as optional property Reviewed-by: Rob Herring Signed-off-by: Benjamin Gaignard Signed-off-by: Marc Zyngier .../devicetree/bindings/interrupt-controller/st,stm32-exti.txt | 4 ++++ 1 file changed, 4 insertions(+) commit 0136afa08967f6e160b9b4e85a7a70e4180a8333 Author: Lucas Stach Date: Mon Dec 17 15:01:20 2018 +0100 irqchip: Add driver for imx-irqsteer controller The irqsteer block is a interrupt multiplexer/remapper found on the i.MX8 line of SoCs. Signed-off-by: Fugang Duan Signed-off-by: Lucas Stach Signed-off-by: Marc Zyngier drivers/irqchip/Kconfig | 8 ++ drivers/irqchip/Makefile | 1 + drivers/irqchip/irq-imx-irqsteer.c | 261 +++++++++++++++++++++++++++++++++++++ 3 files changed, 270 insertions(+) commit ff63495eff8139af1d33e9733d74b399fc8a84e7 Author: Lucas Stach Date: Mon Dec 17 15:01:19 2018 +0100 dt-bindings/irq: Add binding for Freescale IRQSTEER multiplexer This adds the DT binding for the Freescale IRQSTEER interrupt multiplexer found in the i.MX8 familiy SoCs. Reviewed-by: Rob Herring Signed-off-by: Lucas Stach Signed-off-by: Marc Zyngier .../bindings/interrupt-controller/fsl,irqsteer.txt | 34 ++++++++++++++++++++++ 1 file changed, 34 insertions(+) commit 584923efe91f29b01697b6cd7519c92bde9e11da Merge: 663546903c83 f5a4c76ad7de Author: Rafael J. Wysocki Date: Tue Dec 18 16:32:12 2018 +0100 Merge branch 'turbostat' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux Pull turbostat utility updates for v4.21 from Len Brown: "A couple of random fixes that were sitting in the queue." * 'turbostat' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux: tools/power turbostat: consolidate duplicate model numbers tools/power turbostat: fix goldmont C-state limit decoding tools/power turbostat: reduce debug output tools/power turbosat: fix AMD APIC-id output commit 875736bb3f3ded168469f6a14df7a938416a99d5 Author: Jens Axboe Date: Tue Nov 20 20:06:23 2018 -0700 aio: abstract out io_event filler helper Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe fs/aio.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) commit 88a6f18b950e2e4dce57d31daa151105f4f3dcff Author: Jens Axboe Date: Sat Nov 24 14:46:14 2018 -0700 aio: split out iocb copy from io_submit_one() In preparation of handing in iocbs in a different fashion as well. Also make it clear that the iocb being passed in isn't modified, by marking it const throughout. Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe fs/aio.c | 68 ++++++++++++++++++++++++++++++++++++---------------------------- 1 file changed, 38 insertions(+), 30 deletions(-) commit 71ebc6fef0f53459f37fb39e1466792232fa52ee Author: Jens Axboe Date: Sat Nov 24 21:33:09 2018 -0700 aio: use iocb_put() instead of open coding it Replace the percpu_ref_put() + kmem_cache_free() with a call to iocb_put() instead. Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe fs/aio.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit a79d40e9b0f309dcddc4e0bf5b64e51e28153e55 Author: Jens Axboe Date: Tue Dec 4 09:45:32 2018 -0700 aio: only use blk plugs for > 2 depth submissions Plugging is meant to optimize submission of a string of IOs, if we don't have more than 2 being submitted, don't bother setting up a plug. Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe fs/aio.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) commit 2bc4ca9bb600cbe36941da2b2a67189fc4302a04 Author: Jens Axboe Date: Tue Dec 4 09:44:49 2018 -0700 aio: don't zero entire aio_kiocb aio_get_req() It's 192 bytes, fairly substantial. Most items don't need to be cleared, especially not upfront. Clear the ones we do need to clear, and leave the other ones for setup when the iocb is prepared and submitted. Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe fs/aio.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) commit 432c79978c33ecef91b1b04cea6936c20810da29 Author: Christoph Hellwig Date: Mon Nov 19 15:57:42 2018 -0700 aio: separate out ring reservation from req allocation This is in preparation for certain types of IO not needing a ring reserveration. Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe fs/aio.c | 30 +++++++++++++++++------------- 1 file changed, 17 insertions(+), 13 deletions(-) commit bc9bff61624ac33b7c95861abea1af24ee7a94fc Author: Jens Axboe Date: Tue Nov 6 14:27:13 2018 -0700 aio: use assigned completion handler We know this is a read/write request, but in preparation for having different kinds of those, ensure that we call the assigned handler instead of assuming it's aio_complete_rq(). Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe fs/aio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4b9254328254bed12a4ac449cdff2c332e630837 Merge: 1a9430db2835 cd19181bf9ad Author: Jens Axboe Date: Tue Dec 18 08:29:53 2018 -0700 Merge branch 'for-4.21/block' into for-4.21/aio * for-4.21/block: (351 commits) blk-mq: enable IO poll if .nr_queues of type poll > 0 blk-mq: change blk_mq_queue_busy() to blk_mq_queue_inflight() blk-mq: skip zero-queue maps in blk_mq_map_swqueue block: fix blk-iolatency accounting underflow blk-mq: fix dispatch from sw queue block: mq-deadline: Fix write completion handling nvme-pci: don't share queue maps blk-mq: only dispatch to non-defauly queue maps if they have queues blk-mq: export hctx->type in debugfs instead of sysfs blk-mq: fix allocation for queue mapping table blk-wbt: export internal state via debugfs blk-mq-debugfs: support rq_qos block: update sysfs documentation block: loop: check error using IS_ERR instead of IS_ERR_OR_NULL in loop_add() aoe: add __exit annotation block: clear REQ_HIPRI if polling is not supported blk-mq: replace and kill blk_mq_request_issue_directly blk-mq: issue directly with bypass 'false' in blk_mq_sched_insert_requests blk-mq: refactor the code of issue request directly block: remove the bio_integrity_advance export ... commit 9d6dc178f0c9e40e61f45d2ac86baa8ad77cb052 Author: Arnaldo Carvalho de Melo Date: Fri Dec 14 11:32:02 2018 -0300 perf trace: Allow suppressing the syscall argument names To show just the values: Default: # trace -e open*,close,*sleep sleep 1 openat(dfd: CWD, filename: /etc/ld.so.cache, flags: CLOEXEC ) = 3 close(fd: 3 ) = 0 openat(dfd: CWD, filename: /lib64/libc.so.6, flags: CLOEXEC ) = 3 close(fd: 3 ) = 0 openat(dfd: CWD, filename: /usr/lib/locale/locale-archive, flags: CLOEXEC) = 3 close(fd: 3 ) = 0 nanosleep(rqtp: 0x7ffc0c4ea0d0, rmtp: 0 ) = 0 close(fd: 1 ) = 0 close(fd: 2 ) = 0 # Remove it: # perf config trace.show_arg_names=no # trace -e open*,close,*sleep sleep 1 openat(CWD, /etc/ld.so.cache, CLOEXEC ) = 3 close(3 ) = 0 openat(CWD, /lib64/libc.so.6, CLOEXEC ) = 3 close(3 ) = 0 openat(CWD, /usr/lib/locale/locale-archive, CLOEXEC ) = 3 close(3 ) = 0 nanosleep(0x7ffced3a8c40, 0 ) = 0 close(1 ) = 0 close(2 ) = 0 # Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-ta9tbdwgodpw719sr2bjm8eb@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/Documentation/perf-config.txt | 4 ++++ tools/perf/builtin-trace.c | 22 ++++++++++++++++++---- 2 files changed, 22 insertions(+), 4 deletions(-) commit b036146fd0f99209e87877115d090c69da2ab747 Author: Arnaldo Carvalho de Melo Date: Fri Dec 14 11:17:19 2018 -0300 perf trace: Allow configuring if the syscall start timestamp should be printed # trace -e open*,close,*sleep sleep 1 0.000 openat(dfd: CWD, filename: /etc/ld.so.cache, flags: CLOEXEC ) = 3 0.016 close(fd: 3 ) = 0 0.024 openat(dfd: CWD, filename: /lib64/libc.so.6, flags: CLOEXEC ) = 3 0.074 close(fd: 3 ) = 0 0.235 openat(dfd: CWD, filename: /usr/lib/locale/locale-archive, flags: CLOEXEC) = 3 0.251 close(fd: 3 ) = 0 0.285 nanosleep(rqtp: 0x7ffd68e6d620, rmtp: 0 ) = 0 1000.386 close(fd: 1 ) = 0 1000.395 close(fd: 2 ) = 0 # # perf config trace.show_timestamp=no # trace -e open*,close,*sleep sleep 1 openat(dfd: CWD, filename: /etc/ld.so.cache, flags: CLOEXEC ) = 3 close(fd: 3 ) = 0 openat(dfd: CWD, filename: /lib64/libc.so.6, flags: CLOEXEC ) = 3 close(fd: 3 ) = 0 openat(dfd: CWD, filename: , flags: CLOEXEC ) = 3 close(fd: 3 ) = 0 nanosleep(rqtp: 0x7fffa79c38e0, rmtp: 0 ) = 0 close(fd: 1 ) = 0 close(fd: 2 ) = 0 # Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-mjjnicy48367jah6ls4k0nk8@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/Documentation/perf-config.txt | 3 +++ tools/perf/builtin-trace.c | 9 ++++++++- 2 files changed, 11 insertions(+), 1 deletion(-) commit d32de87e734191698dd1834146ee65ebd0f5e240 Author: Arnaldo Carvalho de Melo Date: Fri Dec 14 11:06:16 2018 -0300 perf trace: Allow configuring default for perf_event_attr.inherit I.f. if children should inherit the parent perf_event configuration, i.e. if we should trace children as well or just the parent. The default is to follow children, to disable this and have a behaviour similar to strace, set this config option or use the --no_inherit 'perf trace' option. E.g.: Default: # perf config trace.no_inherit # trace -e clone,*sleep time sleep 1 0.000 time/21107 clone(clone_flags: CHILD_CLEARTID|CHILD_SETTID|0x11, newsp: 0, child_tidptr: 0x7f7b8f9ae810) = 21108 (time) ? time/21108 ... [continued]: clone() 0.691 sleep/21108 nanosleep(rqtp: 0x7ffed01d0540, rmtp: 0 ) = 0 0.00user 0.00system 0:01.00elapsed 0%CPU (0avgtext+0avgdata 1988maxresident)k 0inputs+0outputs (0major+76minor)pagefaults 0swaps # Disable it: # trace -e clone,*sleep time sleep 1 0.000 clone(clone_flags: CHILD_CLEARTID|CHILD_SETTID|0x11, newsp: 0, child_tidptr: 0x7ff41e100810) = 21414 (time) 0.00user 0.00system 0:01.00elapsed 0%CPU (0avgtext+0avgdata 1964maxresident)k 0inputs+0outputs (0major+76minor)pagefaults 0swaps # Notice that since there is just one thread, the "comm/TID" column is suppressed. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-thd8s16pagyza71ufi5vjlan@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/Documentation/perf-config.txt | 3 +++ tools/perf/builtin-trace.c | 2 ++ 2 files changed, 5 insertions(+) commit 41e0d040c475251eea14c8b92ea3a01c5e269856 Author: Arnaldo Carvalho de Melo Date: Fri Dec 14 10:29:44 2018 -0300 perf config: Show the configuration when no arguments are provided More convenient thah having to recall what letter is about showing/listing/dumping the configuration, i.e. no arguments means -l/--list: # perf config llvm.dump-obj=true trace.default_events=/home/acme/git/perf/tools/perf/examples/bpf/augmented_raw_syscalls.o trace.show_zeros=yes trace.show_duration=no # perf config -l llvm.dump-obj=true trace.default_events=/home/acme/git/perf/tools/perf/examples/bpf/augmented_raw_syscalls.o trace.show_zeros=yes trace.show_duration=no # perf config -h Usage: perf config [] [options] [section.name[=value] ...] -l, --list show current config variables --system use system config file --user use user config file # Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Taeung Song Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-z2n63avz6tliqb5gmu4l1dti@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-config.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit 42e4a52d01d087e7ce069049799e3e336eaec101 Author: Arnaldo Carvalho de Melo Date: Fri Dec 14 10:22:18 2018 -0300 perf trace: Allow configuring if the syscall duration should be printed # perf config trace.show_duration=no # perf config -l | grep trace trace.default_events=/home/acme/git/perf/tools/perf/examples/bpf/augmented_raw_syscalls.o trace.show_zeros=true trace.show_duration=no # trace -e *sleep sleep 1 0.000 sleep/8729 nanosleep(rqtp: 0x7ffcb0b4c940, rmtp: 0) = 0 # perf config trace.show_duration=yes # trace -e *sleep sleep 1 0.000 (1000.212 ms): sleep/8735 nanosleep(rqtp: 0x7ffca15fa770, rmtp: 0) = 0 # Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-2c7h1m8fhzb9puxtj9nlevi8@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/Documentation/perf-config.txt | 4 ++++ tools/perf/builtin-trace.c | 9 +++++++-- 2 files changed, 11 insertions(+), 2 deletions(-) commit e7c634fcc6ff921d725ba988cdb198ca8b59a39f Author: Arnaldo Carvalho de Melo Date: Fri Dec 14 10:12:09 2018 -0300 perf trace: Allow configuring if zeroed syscall args should be printed The default so far, since we show argument names followed by its values, was to make the output more compact by suppressing most zeroed args. Make this configurable so that users can choose what best suit their needs. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-q0gxws02ygodh94o0hzim5xd@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/Documentation/perf-config.txt | 2 ++ tools/perf/builtin-trace.c | 6 +++++- 2 files changed, 7 insertions(+), 1 deletion(-) commit ac96287cae0851797262da37347b83797db931b3 Author: Arnaldo Carvalho de Melo Date: Thu Dec 13 17:30:20 2018 -0300 perf trace: Allow specifying a set of events to add in perfconfig To add augmented_raw_syscalls to the events speficied by the user, or be the only one if no events were specified by the user, one can add this to perfconfig: # cat ~/.perfconfig [trace] add_events = /home/acme/git/perf/tools/perf/examples/bpf/augmented_raw_syscalls.o # I.e. pre-compile the augmented_raw_syscalls.c BPF program and make it always load, this way: # perf trace -e open* cat /etc/passwd > /dev/null 0.000 ( 0.013 ms): cat/31557 openat(dfd: CWD, filename: /etc/ld.so.cache, flags: CLOEXEC) = 3 0.035 ( 0.007 ms): cat/31557 openat(dfd: CWD, filename: /lib64/libc.so.6, flags: CLOEXEC) = 3 0.353 ( 0.009 ms): cat/31557 openat(dfd: CWD, filename: /usr/lib/locale/locale-archive, flags: CLOEXEC) = 3 0.424 ( 0.006 ms): cat/31557 openat(dfd: CWD, filename: /etc/passwd) = 3 # Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-0lgj7vh64hg3ce44gsmvj7ud@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/Documentation/perf-config.txt | 8 ++++++++ tools/perf/builtin-trace.c | 20 ++++++++++++++++++++ 2 files changed, 28 insertions(+) commit 4623ce405d0871e648ba72fdb9c561016e2cc41d Author: Arnaldo Carvalho de Melo Date: Thu Dec 13 15:05:43 2018 -0300 perf augmented_raw_syscalls: Do not include stdio.h We're not using that puts() thing, and thus we don't need to define the __bpf_stdout__ map, reducing the setup time. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Luis Cláudio Gonçalves Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-3452xgatncpil7v22minkwbo@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/examples/bpf/augmented_raw_syscalls.c | 1 - 1 file changed, 1 deletion(-) commit 7100b12cf474f575658e6e4a834f0e8a0b3c9867 Author: Leo Yan Date: Tue Dec 11 15:38:28 2018 +0800 perf cs-etm: Generate branch sample for exception packet The exception packet appears as one element with 'elem_type' == OCSD_GEN_TRC_ELEM_EXCEPTION or OCSD_GEN_TRC_ELEM_EXCEPTION_RET, which is present for exception entry and exit respectively. The decoder sets the packet fields 'packet->exc' and 'packet->exc_ret' to indicate the exception packets; but exception packets don't have a dedicated sample type and shares the same sample type CS_ETM_RANGE with normal instruction packets. As a result, the exception packets are taken as normal instruction packets and this introduces confusion in mixing different packet types. Furthermore, these instruction range packets will be processed for branch samples only when 'packet->last_instr_taken_branch' is true, otherwise they will be omitted, this can introduce a mess for exception and exception returning due to not having the complete address range info for context switching. To process exception packets properly, this patch introduces two new sample types: CS_ETM_EXCEPTION and CS_ETM_EXCEPTION_RET; these two types of packets will be handled by cs_etm__exception(). The function cs_etm__exception() forces setting the previous CS_ETM_RANGE packet flag 'prev_packet->last_instr_taken_branch' to true, this matches well with the program flow when the exception is trapped from user space to kernel space, no matter if the most recent flow has branch taken or not; this is also safe for returning to user space after exception handling. After exception packets have their own sample type, the packet fields 'packet->exc' and 'packet->exc_ret' aren't needed anymore, so remove them. Signed-off-by: Leo Yan Reviewed-by: Mathieu Poirier Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mike Leach Cc: Namhyung Kim Cc: Robert Walker Cc: coresight ml Cc: linux-arm-kernel@lists.infradead.org Link: http://lkml.kernel.org/r/1544513908-16805-9-git-send-email-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/cs-etm-decoder/cs-etm-decoder.c | 26 +++++++++++++++++------ tools/perf/util/cs-etm-decoder/cs-etm-decoder.h | 4 ++-- tools/perf/util/cs-etm.c | 28 +++++++++++++++++++++++++ 3 files changed, 50 insertions(+), 8 deletions(-) commit 02e7e2509e939b50f4f1b14c08b97f60256df3ea Author: Leo Yan Date: Tue Dec 11 15:38:27 2018 +0800 perf cs-etm: Treat EO_TRACE element as trace discontinuity If the decoder outputs an EO_TRACE element, it means the end of the trace buffer; this is a discontinuity and in this case the end of trace data needs to be saved. This patch generates a CS_ETM_DISCONTINUITY packet for the EO_TRACE element hereby flushing the end of trace data in cs-etm.c. Signed-off-by: Leo Yan Reviewed-by: Mathieu Poirier Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mike Leach Cc: Namhyung Kim Cc: Robert Walker Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Link: http://lkml.kernel.org/r/1544513908-16805-8-git-send-email-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/cs-etm-decoder/cs-etm-decoder.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 37bb37168dc1b1f5e3ac791aeecd14ef980764fd Author: Leo Yan Date: Tue Dec 11 15:38:26 2018 +0800 perf cs-etm: Treat NO_SYNC element as trace discontinuity The CoreSight tracer driver might insert barrier packets between different buffers, thus the decoder can spot the boundaries based on the barrier packet; it is possible for the decoder to hit a barrier packet and emit a NO_SYNC element, then the decoder will find a periodic synchronisation point inside that next trace block that starts the trace again but does not have the TRACE_ON element as indicator - usually because this trace block has wrapped the buffer so we have lost the original point when the trace was enabled. In the first case it causes the insertion of a OCSD_GEN_TRC_ELEM_NO_SYNC in the middle of the tracing stream, but as we were not handling the NO_SYNC element properly this ends up making users miss the discontinuity indications. Though OCSD_GEN_TRC_ELEM_NO_SYNC is different from CS_ETM_TRACE_ON when output from the decoder, both indicate that the trace data is discontinuous; this patch treats OCSD_GEN_TRC_ELEM_NO_SYNC as a trace discontinuity and generates a CS_ETM_DISCONTINUITY packet for it, so cs-etm can handle the discontinuity for this case, finally it saves the last trace data for the previous trace block and restart samples for the new block. Signed-off-by: Leo Yan Reviewed-by: Mathieu Poirier Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mike Leach Cc: Namhyung Kim Cc: Robert Walker Cc: coresight ml Cc: linux-arm-kernel@lists.infradead.org Link: http://lkml.kernel.org/r/1544513908-16805-7-git-send-email-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/cs-etm-decoder/cs-etm-decoder.c | 1 - 1 file changed, 1 deletion(-) commit 49ccf87bfb9e8517ab2f019e95845760c4c3a562 Author: Leo Yan Date: Tue Dec 11 15:38:25 2018 +0800 perf cs-etm: Rename CS_ETM_TRACE_ON to CS_ETM_DISCONTINUITY TRACE_ON element is used at the beginning of trace, it also can be appeared in the middle of trace data to indicate discontinuity; for example, it's possible to see multiple TRACE_ON elements in the trace stream if the trace is being limited by address range filtering. Furthermore, except TRACE_ON element is for discontinuity, NO_SYNC and EO_TRACE also can be used to indicate discontinuity, though they are used for different scenarios for which the trace is interrupted. This patch renames sample type CS_ETM_TRACE_ON to CS_ETM_DISCONTINUITY, firstly the new name describes more closely the purpose of the packet; secondly this is a preparation for other output elements which also cause the trace discontinuity thus they can share the same one packet type. Signed-off-by: Leo Yan Reviewed-by: Mathieu Poirier Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mike Leach Cc: Namhyung Kim Cc: Robert Walker Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Link: http://lkml.kernel.org/r/1544513908-16805-6-git-send-email-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/cs-etm-decoder/cs-etm-decoder.c | 10 +++++----- tools/perf/util/cs-etm-decoder/cs-etm-decoder.h | 2 +- tools/perf/util/cs-etm.c | 12 ++++++------ 3 files changed, 12 insertions(+), 12 deletions(-) commit cfc1d4276b0453a752d8b31daf34f7f2dbd55e82 Author: Leo Yan Date: Tue Dec 11 15:38:24 2018 +0800 perf cs-etm: Refactor enumeration cs_etm_sample_type The values in enumeration cs_etm_sample_type are defined with setting bit N for each packet type, this is not suggested in the usual case. This patch refactor cs_etm_sample_type by converting from bit shifting values to continuous numbers. Signed-off-by: Leo Yan Reviewed-by: Mathieu Poirier Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mike Leach Cc: Namhyung Kim Cc: Robert Walker Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Link: http://lkml.kernel.org/r/1544513908-16805-5-git-send-email-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/cs-etm-decoder/cs-etm-decoder.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit cee7a6a212ddb514d6e2ac1f9733501c43d63d0a Author: Leo Yan Date: Tue Dec 11 15:38:23 2018 +0800 perf cs-etm: Remove unused 'trace_on' in cs_etm_decoder cs_etm_decoder::trace_on is being assigned when TRACE_ON or NO_SYNC element is coming, but it is never used hence it is redundant and can be removed. So let's remove 'trace_on' field from cs_etm_decoder struct. Suggested-by: Mathieu Poirier Signed-off-by: Leo Yan Reviewed-by: Mathieu Poirier Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mathieu Poirier Cc: Mike Leach Cc: Namhyung Kim Cc: Robert Walker Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Link: http://lkml.kernel.org/r/1544513908-16805-4-git-send-email-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/cs-etm-decoder/cs-etm-decoder.c | 3 --- 1 file changed, 3 deletions(-) commit 24fff5eb2b937951af5dce6cdb7a1e679ac8e751 Author: Leo Yan Date: Tue Dec 11 15:38:22 2018 +0800 perf cs-etm: Avoid stale branch samples when flush packet At the end of trace buffer handling, function cs_etm__flush() is invoked to flush any remaining branch stack entries. As a side effect, it also generates branch sample, because the 'etmq->packet' doesn't contains any new coming packet but point to one stale packet after packets swapping, so it wrongly makes synthesize branch samples with stale packet info. We could review below detailed flow which causes issue: Packet1: start_addr=0xffff000008b1fbf0 end_addr=0xffff000008b1fbfc Packet2: start_addr=0xffff000008b1fb5c end_addr=0xffff000008b1fb6c step 1: cs_etm__sample(): sample: ip=(0xffff000008b1fbfc-4) addr=0xffff000008b1fb5c step 2: flush packet in cs_etm__run_decoder(): cs_etm__run_decoder() `-> err = cs_etm__flush(etmq, false); sample: ip=(0xffff000008b1fb6c-4) addr=0xffff000008b1fbf0 Packet1 and packet2 are two continuous packets, when packet2 is the new coming packet, cs_etm__sample() generates branch sample for these two packets and use [packet1::end_addr - 4 => packet2::start_addr] as branch jump flow, thus we can see the first generated branch sample in step 1. At the end of cs_etm__sample() it swaps packets so 'etm->prev_packet'= packet2 and 'etm->packet'=packet1, so far it's okay for branch sample. If packet2 is the last one packet in trace buffer, even there have no any new coming packet, cs_etm__run_decoder() invokes cs_etm__flush() to flush branch stack entries as expected, but it also generates branch samples by taking 'etm->packet' as a new coming packet, thus the branch jump flow is as [packet2::end_addr - 4 => packet1::start_addr]; this is the second sample which is generated in step 2. So actually the second sample is a stale sample and we should not generate it. This patch introduces a new function cs_etm__end_block(), at the end of trace block this function is invoked to only flush branch stack entries and thus can avoid to generate branch sample for stale packet. Signed-off-by: Leo Yan Reviewed-by: Mathieu Poirier Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mike Leach Cc: Namhyung Kim Cc: Robert Walker Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Link: http://lkml.kernel.org/r/1544513908-16805-3-git-send-email-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/cs-etm.c | 35 ++++++++++++++++++++++++++++++++++- 1 file changed, 34 insertions(+), 1 deletion(-) commit 43fd56669c28cd354e9228bdb58e4bca1c1a8b66 Author: Leo Yan Date: Tue Dec 11 15:38:21 2018 +0800 perf cs-etm: Correct packets swapping in cs_etm__flush() The structure cs_etm_queue uses 'prev_packet' to point to previous packet, this can be used to combine with new coming packet to generate samples. In function cs_etm__flush() it swaps packets only when the flag 'etm->synth_opts.last_branch' is true, this means that it will not swap packets if without option '--itrace=il' to generate last branch entries; thus for this case the 'prev_packet' doesn't point to the correct previous packet and the stale packet still will be used to generate sequential sample. Thus if dump trace with 'perf script' command we can see the incorrect flow with the stale packet's address info. This patch corrects packets swapping in cs_etm__flush(); except using the flag 'etm->synth_opts.last_branch' it also checks the another flag 'etm->sample_branches', if any flag is true then it swaps packets so can save correct content to 'prev_packet'. Finally this can fix the wrong program flow dumping issue. The patch has a minor refactoring to use 'etm->synth_opts.last_branch' instead of 'etmq->etm->synth_opts.last_branch' for condition checking, this is consistent with that is done in cs_etm__sample(). Signed-off-by: Leo Yan Reviewed-by: Mathieu Poirier Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Mike Leach Cc: Namhyung Kim Cc: Robert Walker Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Link: http://lkml.kernel.org/r/1544513908-16805-2-git-send-email-leo.yan@linaro.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/cs-etm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bbab50dda724309eccec92132d3f36cb262e8728 Author: Arnaldo Carvalho de Melo Date: Wed Dec 12 16:54:09 2018 -0300 perf trace: Switch to using a struct for the aumented_raw_syscalls syscalls map values We'll start adding more perf-syscall stuff, so lets do this prep step so that the next ones are just about adding more fields. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-vac4sn1ns1vj4y07lzj7y4b8@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-trace.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) commit 27f2992e7bb12ca28e886e48838ba740d2eb95f4 Author: Arnaldo Carvalho de Melo Date: Wed Dec 12 16:46:13 2018 -0300 perf augmented_syscalls: Switch to using a struct for the syscalls map values We'll start adding more perf-syscall stuff, so lets do this prep step so that the next ones are just about adding more fields. Run it with the .c file once to cache the .o file: # trace --filter-pids 2834,2199 -e openat,augmented_raw_syscalls.c LLVM: dumping augmented_raw_syscalls.o 0.000 ( 0.021 ms): tmux: server/4952 openat(dfd: CWD, filename: /proc/5691/cmdline ) = 11 349.807 ( 0.040 ms): DNS Res~er #39/11082 openat(dfd: CWD, filename: /etc/hosts, flags: CLOEXEC ) = 44 4988.759 ( 0.052 ms): gsd-color/2431 openat(dfd: CWD, filename: /etc/localtime ) = 18 4988.976 ( 0.029 ms): gsd-color/2431 openat(dfd: CWD, filename: /etc/localtime ) = 18 ^C[root@quaco bpf]# From now on, we can use just the newly built .o file, skipping the compilation step for a faster startup: # trace --filter-pids 2834,2199 -e openat,augmented_raw_syscalls.o 0.000 ( 0.046 ms): DNS Res~er #39/11088 openat(dfd: CWD, filename: /etc/hosts, flags: CLOEXEC ) = 44 1946.408 ( 0.190 ms): systemd/1 openat(dfd: CWD, filename: /proc/1071/cgroup, flags: CLOEXEC ) = 20 1946.792 ( 0.215 ms): systemd/1 openat(dfd: CWD, filename: /proc/954/cgroup, flags: CLOEXEC ) = 20 ^C# Now on to do the same in the builtin-trace.c side of things. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-k8mwu04l8es29rje5loq9vg7@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/examples/bpf/augmented_raw_syscalls.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) commit 61d007138a44dc69265cf948eadd1759edbd3875 Author: Arnaldo Carvalho de Melo Date: Wed Dec 12 15:31:28 2018 -0300 perf bpf: Move perf_event_output() from stdio.h to bpf.h So that we don't always carry that __bpf_output__ map, leaving that to the scripts wanting to use that facility. 'perf trace' will be changed to look if that map is present and only setup the bpf-output events if so. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-azwys8irxqx9053vpajr0k5h@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/include/bpf/bpf.h | 2 ++ tools/perf/include/bpf/stdio.h | 3 --- 2 files changed, 2 insertions(+), 3 deletions(-) commit b27b38ed9427b32e0194e03281e3a79dd49887b2 Author: Arnaldo Carvalho de Melo Date: Wed Dec 12 13:39:24 2018 -0300 perf trace: Implement syscall filtering in augmented_syscalls Just another map, this time an BPF_MAP_TYPE_ARRAY, stating with one bool per syscall, stating if it should be filtered or not. So, with a pre-built augmented_raw_syscalls.o file, we use: # perf trace -e open*,augmented_raw_syscalls.o 0.000 ( 0.016 ms): DNS Res~er #37/29652 openat(dfd: CWD, filename: /etc/hosts, flags: CLOEXEC ) = 138 187.039 ( 0.048 ms): gsd-housekeepi/2436 openat(dfd: CWD, filename: /etc/fstab, flags: CLOEXEC ) = 11 187.348 ( 0.041 ms): gsd-housekeepi/2436 openat(dfd: CWD, filename: /proc/self/mountinfo, flags: CLOEXEC ) = 11 188.793 ( 0.036 ms): gsd-housekeepi/2436 openat(dfd: CWD, filename: /proc/self/mountinfo, flags: CLOEXEC ) = 11 189.803 ( 0.029 ms): gsd-housekeepi/2436 openat(dfd: CWD, filename: /proc/self/mountinfo, flags: CLOEXEC ) = 11 190.774 ( 0.027 ms): gsd-housekeepi/2436 openat(dfd: CWD, filename: /proc/self/mountinfo, flags: CLOEXEC ) = 11 284.620 ( 0.149 ms): DataStorage/3076 openat(dfd: CWD, filename: /home/acme/.mozilla/firefox/ina67tev.default/SiteSecurityServiceState.txt, flags: CREAT|TRUNC|WRONLY, mode: IRUGO|IWUSR|IWGRP) = 167 ^C# What is it that this gsd-housekeeping thingy needs to open /proc/self/mountinfo four times periodically? :-) This map will be extended to tell per-syscall parameters, i.e. how many bytes to copy per arg, using the function signature to get the types and then the size of those types, via BTF. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-cy222g9ucvnym3raqvxp0hpg@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-trace.c | 66 ++++++++++++++++++++++++ tools/perf/examples/bpf/augmented_raw_syscalls.c | 26 +++++++++- 2 files changed, 91 insertions(+), 1 deletion(-) commit 0df50e0b0e0f315c0d5e2ce8556aafe1403b4a4b Author: Arnaldo Carvalho de Melo Date: Wed Dec 12 13:47:40 2018 -0300 perf trace: Avoid using raw_syscalls in duplicity with eBPF augmentation So when we do something like: # perf trace -e open*,augmented_raw_syscalls.o We need to set trace->trace_syscalls because there is logic that use that when mixing strace-like output with other events, such as scheduler tracepoints, but with that set we ended up having multiple raw_syscalls:sys_{enter,exit} setup, which garbled the output, so check if trace->augmented_raw_syscalls is set and avoid the two extra tracepoints. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-kjmnbrlgu0c38co1ye8egbsb@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-trace.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) commit 246fbe03edaab9dfa5bd1f0e223c7c960d987982 Author: Arnaldo Carvalho de Melo Date: Wed Dec 12 11:06:53 2018 -0300 perf trace: Rename set_ev_qualifier_filter to clarify its a tracepoint filter Rename it to trace__set_ev_qualifier_tp_filter(), as this just sets up tracepoint filters on the raw_syscalls:sys_{enter,exit} tracepoints, and since we're going to do the same for the augmented_raw_syscalls codepath, when used, rename it to clarify. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: https://lkml.kernel.org/n/tip-8bjsul8x7osw7nxjodnyfn14@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-trace.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 3f643937aaab04881236b5aabec00f9802c1eda8 Author: Jiri Olsa Date: Wed Dec 12 14:29:40 2018 +0100 perf tools: Link libperf-jvmti.so with LDFLAGS variable So we could propagate distro flags into libperf-jvmti.so library. Signed-off-by: Jiri Olsa Cc: Alexander Shishkin Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/20181212132940.840-1-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/Makefile.perf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 41fa483aeee567cc34f9fc4c2e7035f2df25299d Author: Jiri Olsa Date: Wed Dec 12 10:12:14 2018 +0100 tools lib traceevent: Use LDFLAGS in the build commands So that the user can specify outside LDFLAGS values. Keeping the CFLAGS in there as well, so we don't break existing scripts. Signed-off-by: Jiri Olsa Acked-by: Steven Rostedt (VMware) Cc: Herton Krzesinski Cc: Tzvetomir Stoyanov (VMware) Link: http://lkml.kernel.org/r/20181212091214.GC17489@krava Signed-off-by: Arnaldo Carvalho de Melo tools/lib/traceevent/Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 866053bb644f754d1a93aaa9db9998fecf7a8978 Author: Arnaldo Carvalho de Melo Date: Tue Dec 11 16:43:40 2018 -0300 perf tools: Cast off_t to s64 to avoid warning on bionic libc To avoid this warning: CC /tmp/build/perf/util/s390-cpumsf.o util/s390-cpumsf.c: In function 's390_cpumsf_samples': util/s390-cpumsf.c:508:3: warning: format '%llx' expects argument of type 'long long unsigned int', but argument 4 has type 'off_t' [-Wformat=] pr_err("[%#08" PRIx64 "] Invalid AUX trailer entry TOD clock base\n", ^ Now the various Android cross toolchains used in the perf tools container test builds are all clean and we can remove this: export EXTRA_MAKE_ARGS="WERROR=0" Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Cc: Thomas Richter Link: https://lkml.kernel.org/n/tip-5rav4ccyb0sjciysz2i4p3sx@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/s390-cpumsf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d7a8c4a6a055097a67ccfa3ca7c9ff1b64603a70 Author: Arnaldo Carvalho de Melo Date: Tue Dec 11 16:31:19 2018 -0300 perf tools: Add missing open_memstream() prototype for systems lacking it There are systems such as the Android NDK API level 24 has the open_memstream() function but doesn't provide a prototype, adding noise to the build: builtin-timechart.c: In function 'cat_backtrace': builtin-timechart.c:486:2: warning: implicit declaration of function 'open_memstream' [-Wimplicit-function-declaration] FILE *f = open_memstream(&p, &p_len); ^ builtin-timechart.c:486:2: warning: nested extern declaration of 'open_memstream' [-Wnested-externs] builtin-timechart.c:486:12: warning: initialization makes pointer from integer without a cast FILE *f = open_memstream(&p, &p_len); ^ Define a LACKS_OPEN_MEMSTREAM_PROTOTYPE define so that code needing that can get a prototype. Checked in the bionic git repo to be available since level 23: https://android.googlesource.com/platform/bionic/+/master/libc/include/stdio.h#241 FILE* open_memstream(char** __ptr, size_t* __size_ptr) __INTRODUCED_IN(23); Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-343ashae97e5bq6vizusyfno@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/Makefile.config | 1 + tools/perf/builtin-timechart.c | 4 ++++ 2 files changed, 5 insertions(+) commit 0afcf29bab35d3785204cd9bd51693b231ad7181 Author: Arnaldo Carvalho de Melo Date: Tue Dec 11 16:11:54 2018 -0300 perf header: Fix up argument to ctime() Reducing this noise when cross building to the Android NDK: util/header.c: In function 'perf_header__fprintf_info': util/header.c:2710:45: warning: pointer targets in passing argument 1 of 'ctime' differ in signedness [-Wpointer-sign] fprintf(fp, "# captured on : %s", ctime(&st.st_ctime)); ^ In file included from util/../perf.h:5:0, from util/evlist.h:11, from util/header.c:22: /opt/android-ndk-r15c/platforms/android-26/arch-arm/usr/include/time.h:81:14: note: expected 'const time_t *' but argument is of type 'long unsigned int *' extern char* ctime(const time_t*) __LIBC_ABI_PUBLIC__; ^ Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-6bz74zp080yhmtiwb36enso9@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/header.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 748fe0889c1ff12d378946bd5326e8ee8eacf5cf Author: Arnaldo Carvalho de Melo Date: Tue Dec 11 15:48:47 2018 -0300 perf tools: Add missing sigqueue() prototype for systems lacking it There are systems such as the Android NDK API level 24 has the sigqueue() function but doesn't provide a prototype, adding noise to the build: util/evlist.c: In function 'perf_evlist__prepare_workload': util/evlist.c:1494:4: warning: implicit declaration of function 'sigqueue' [-Wimplicit-function-declaration] if (sigqueue(getppid(), SIGUSR1, val)) ^ util/evlist.c:1494:4: warning: nested extern declaration of 'sigqueue' [-Wnested-externs] Define a LACKS_SIGQUEUE_PROTOTYPE define so that code needing that can get a prototype. Checked in the bionic git repo to be available since level 23: https://android.googlesource.com/platform/bionic/+/master/libc/include/signal.h#123 int sigqueue(pid_t __pid, int __signal, const union sigval __value) __INTRODUCED_IN(23); Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-lmhpev1uni9kdrv7j29glyov@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/Makefile.config | 1 + tools/perf/util/evlist.c | 4 ++++ 2 files changed, 5 insertions(+) commit ece9804985b57e1ccd83b1fb6288520955a29d51 Author: Arnaldo Carvalho de Melo Date: Tue Dec 11 15:00:52 2018 -0300 tools lib subcmd: Don't add the kernel sources to the include path At some point we decided not to directly include kernel sources files when building tools/perf/, but when tools/lib/subcmd/ was forked from tools/perf it somehow ended up adding it via these two lines in its Makefile: CFLAGS += -I$(srctree)/include/uapi CFLAGS += -I$(srctree)/include As $(srctree) points to the kernel sources. Removing those lines and keeping just: CFLAGS += -I$(srctree)/tools/include/ Is enough to build tools/perf and tools/objtool. This fixes the build when building from the sources in environments such as the Android NDK crossbuilding from a fedora:26 system: subcmd-util.h:11:15: error: expected ',' or ';' before 'void' static inline void report(const char *prefix, const char *err, va_list params) ^ In file included from /git/perf/include/uapi/linux/stddef.h:2:0, from /git/perf/include/uapi/linux/posix_types.h:5, from /opt/android-ndk-r12b/platforms/android-24/arch-arm/usr/include/sys/types.h:36, from /opt/android-ndk-r12b/platforms/android-24/arch-arm/usr/include/unistd.h:33, from run-command.c:2: subcmd-util.h:18:17: error: '__no_instrument_function__' attribute applies only to functions The /opt/android-ndk-r12b/platforms/android-24/arch-arm/usr/include/sys/types.h file that includes linux/posix_types.h ends up getting the one in the kernel sources causing the breakage. Fix it. Test built tools/objtool/ too. Reported-by: Jiri Olsa Tested-by: Jiri Olsa Cc: Adrian Hunter Cc: Josh Poimboeuf Cc: Namhyung Kim Fixes: 4b6ab94eabe4 ("perf subcmd: Create subcmd library") Link: https://lkml.kernel.org/n/tip-5lhaoecrj12t0bqwvpiu14sm@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/lib/subcmd/Makefile | 2 -- 1 file changed, 2 deletions(-) commit 436651caa1ca3fd1d61e8daaff57453881f35a14 Author: Arnaldo Carvalho de Melo Date: Tue Dec 11 11:19:23 2018 -0300 perf trace beauty: renameat's newdirfd may also be AT_FDCWD Noticed while working on renameat2. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-8omchrcjcvlwoxxv6wrjehfh@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-trace.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit ca7ff2c8e7add62b661c414257e7ef12cd40a950 Author: Arnaldo Carvalho de Melo Date: Tue Dec 11 10:39:30 2018 -0300 perf trace: Beautify renameat2's flags argument # strace -e renameat2 -f perf trace -e rename* mv c /tmp strace: Process 10824 attached [pid 10824] renameat2(AT_FDCWD, "c", AT_FDCWD, "/tmp", RENAME_NOREPLACE) = -1 EXDEV (Invalid cross-device link) [pid 10824] renameat2(AT_FDCWD, "c", AT_FDCWD, "/tmp/c", RENAME_NOREPLACE) = -1 EEXIST (File exists) 1.857 ( 0.008 ms): mv/10824 renameat2(olddfd: CWD, oldname: 0x7ffc72ff3d81, newdfd: CWD, newname: 0x7ffc72ff3d83, flags: NOREPLACE) = -1 EXDEV Invalid cross-device link 2.002 ( 0.006 ms): mv/10824 renameat2(olddfd: CWD, oldname: 0x7ffc72ff3d81, newdfd: CWD, newname: 0x55ad609efcc0, flags: NOREPLACE) = -1 EEXIST File exists mv: 'c' and '/tmp/c' are the same file [pid 10824] +++ exited with 1 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=10824, si_uid=0, si_status=1, si_utime=0, si_stime=0} --- +++ exited with 0 +++ # Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-glyt6nzlt1yx56m5bshy6g83@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-trace.c | 3 ++- tools/perf/trace/beauty/Build | 1 + tools/perf/trace/beauty/beauty.h | 3 +++ tools/perf/trace/beauty/renameat.c | 19 +++++++++++++++++++ 4 files changed, 25 insertions(+), 1 deletion(-) commit 5a1cb7edfbf6ee8087b75d32461775501213a8e9 Author: Arnaldo Carvalho de Melo Date: Tue Dec 11 10:26:13 2018 -0300 perf beauty: Wire up the renameat flags table generator to the Makefile Now when we run 'make -C tools/perf O=/tmp/build/perf' we end up with: $ cat /tmp/build/perf/trace/beauty/generated/rename_flags_array.c static const char *rename_flags[] = { [0 + 1] = "NOREPLACE", [1 + 1] = "EXCHANGE", [2 + 1] = "WHITEOUT", }; $ Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-4fad4xahrn04y06o0lc49clm@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/Makefile.perf | 8 ++++++++ 1 file changed, 8 insertions(+) commit bdc2a9d64a4c4c77c63ce2561bd644d233fcb1fc Author: Arnaldo Carvalho de Melo Date: Tue Dec 11 10:16:42 2018 -0300 perf beauty: Add a string table generator for renameat2's flags constants Using the already copied tools/include/uapi/linux/fs.h file: $ tools/perf/trace/beauty/rename_flags.sh static const char *rename_flags[] = { [0 + 1] = "NOREPLACE", [1 + 1] = "EXCHANGE", [2 + 1] = "WHITEOUT", }; $ Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-ta2jbh03spkymp4sbdh489g8@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/trace/beauty/rename_flags.sh | 15 +++++++++++++++ 1 file changed, 15 insertions(+) commit 84a835412cdc36f3821a1daa10853f9c9aa3fc7c Author: Arnaldo Carvalho de Melo Date: Tue Dec 11 09:53:21 2018 -0300 perf trace beauty: Beautify renameat2's fd arg wrt AT_FDCWD Just like is done with the 'renameat' syscall. # strace -e renameat2 -f perf trace -e rename* mv c /tmp [pid 12334] renameat2(AT_FDCWD, "c", AT_FDCWD, "/tmp", RENAME_NOREPLACE) = -1 EXDEV (Invalid cross-device link) [pid 12334] renameat2(AT_FDCWD, "c", AT_FDCWD, "/tmp/c", RENAME_NOREPLACE) = -1 EEXIST (File exists) 1.947 ( 0.007 ms): mv/12334 renameat2(olddfd: CWD, oldname: 0x7ffce8b7fd81, newdfd: CWD, newname: 0x7ffce8b7fd83, flags: 1) = -1 EXDEV Invalid cross-device link 2.073 ( 0.009 ms): mv/12334 renameat2(olddfd: CWD, oldname: 0x7ffce8b7fd81, newdfd: CWD, newname: 0x55ce7f0a1cc0, flags: 1mv: ) = -1 EEXIST File exists'c' and '/tmp/c' are the same file # Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-8q9l92eh9eee3y2bwyqku3tc@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-trace.c | 3 +++ 1 file changed, 3 insertions(+) commit a761a8d102e2a6edfef3ad5bb22baeb715f93abd Author: Arnaldo Carvalho de Melo Date: Mon Dec 10 16:27:33 2018 -0300 perf trace: Allow selecting use the use of the ordered_events code I was trigger happy on this one, as using ordered_events as implemented by Jiri for use with the --block code under discussion on lkml incurs in delaying processing to form batches that then get ordered and then printed. With 'perf trace' we want to process the events as they go, without that delay, and doing it that way works well for the common case which is to trace a thread or a workload started by 'perf trace'. So revert back to not using ordered_events but add an option to select that mode so that users can experiment with their particular use case to see if works better, i.e. if the added delay is not a problem and the ordering helps. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-8ki7sld6rusnjhhtaly26i5o@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/Documentation/perf-trace.txt | 6 ++++++ tools/perf/builtin-trace.c | 25 +++++++++++++++++++------ 2 files changed, 25 insertions(+), 6 deletions(-) commit 7ba61524fa0337a919b2ec5fcce26db23c611ca7 Author: Arnaldo Carvalho de Melo Date: Mon Dec 10 16:09:51 2018 -0300 perf trace: Rename delivery functions to ease making ordered_events selectable Just hide a bit more how events gets delivered, hiding ordered_events details from the main loop. Cc: Adrian Hunter Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lkml.kernel.org/n/tip-lxwwf3238ta4neq2zh1y1h45@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-trace.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit f024cf085c423bac7512479f45c34ee9a24af7ce Author: Steven Rostedt (VMware) Date: Mon Dec 10 13:45:22 2018 -0500 tools lib traceevent: Fix processing of dereferenced args in bprintk events In the case that a bprintk event has a dereferenced pointer that is stored as a string, and there's more values to process (more args), the arg was not updated to point to the next arg after processing the dereferenced pointer, and it screwed up what was to be displayed. Signed-off-by: Steven Rostedt (VMware) Cc: Jiri Olsa Cc: Namhyung Kim Cc: linux-trace-devel@vger.kernel.org Cc: stable@vger.kernel.org Fixes: 37db96bb49629 ("tools lib traceevent: Handle new pointer processing of bprint strings") Link: http://lkml.kernel.org/r/20181210134522.3f71e2ca@gandalf.local.home Signed-off-by: Arnaldo Carvalho de Melo tools/lib/traceevent/event-parse.c | 1 + 1 file changed, 1 insertion(+) commit 51433ead1460fb3f46e1c34f68bb22fd2dd0f5d0 Author: Michael Petlan Date: Mon Dec 10 11:00:04 2018 -0500 perf stat: Avoid segfaults caused by negated options Some 'perf stat' options do not make sense to be negated (event, cgroup), some do not have negated path implemented (metrics). Due to that, it is better to disable the "no-" prefix for them, since otherwise, the later opt-parsing segfaults. Before: $ perf stat --no-metrics -- ls Segmentation fault (core dumped) After: $ perf stat --no-metrics -- ls Error: option `no-metrics' isn't available Usage: perf stat [] [] Signed-off-by: Michael Petlan Tested-by: Arnaldo Carvalho de Melo LPU-Reference: 1485912065.62416880.1544457604340.JavaMail.zimbra@redhat.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-stat.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 4eaf97e8c5b13d01dd3c3b00181b6eed208aec01 Author: Michael Petlan Date: Wed Nov 21 16:39:18 2018 -0500 perf tests: Use shebangs in the shell scripts Since the first line was used as a test identification, it needs to be skipped by shell_test__description() function now. Further notes from Hendrik: It might be worth to note that adding the shebang is necessary to spot them as scripts. Using /bin/sh looks fine to. Just briefly checked whether the scripts contains some bash-specifics, which is not the case. Signed-off-by: Michael Petlan Reviewed-by: Hendrik Brueckner Cc: Jiri Olsa LPU-Reference: 2127419430.57657104.1542836358464.JavaMail.zimbra@redhat.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/tests/builtin-test.c | 3 +++ tools/perf/tests/shell/probe_vfs_getname.sh | 1 + tools/perf/tests/shell/record+probe_libc_inet_pton.sh | 1 + tools/perf/tests/shell/record+script_probe_vfs_getname.sh | 1 + tools/perf/tests/shell/trace+probe_vfs_getname.sh | 1 + 5 files changed, 7 insertions(+) commit 571766010ea6bf9726b288eb2db1abb59b1841af Author: Adrian Hunter Date: Tue Nov 27 10:46:34 2018 +0200 perf auxtrace: Alter addr_filter__entire_dso() to work if there are no symbols addr_filter__entire_dso() uses the first and last symbols from a dso, and so does not work when there are no symbols. Alter it to filter the whole file instead. Signed-off-by: Adrian Hunter Cc: Jiri Olsa Cc: Masami Hiramatsu Cc: Mathieu Poirier Fixes: 1b36c03e3569 ("perf record: Add support for using symbols in address filters") Link: http://lkml.kernel.org/r/20181127084634.12469-1-adrian.hunter@intel.com [ split from a larger patch ] Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/auxtrace.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) commit b5c2161cc415babb84d2b49599df8bd03b2b9b69 Author: Adrian Hunter Date: Tue Nov 27 10:46:34 2018 +0200 perf dso: Export data_file_size() method there are no symbols Will be used outside dso.c in a followup patch, so rename it and make it non-static. Signed-off-by: Adrian Hunter Cc: Jiri Olsa Link: http://lkml.kernel.org/r/20181127084634.12469-1-adrian.hunter@intel.com [ split from a larger patch ] Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/dso.c | 6 +++--- tools/perf/util/dso.h | 1 + 2 files changed, 4 insertions(+), 3 deletions(-) commit bea2ef803ade3359026d5d357348842bca9edcf1 Author: Marc Zyngier Date: Tue Dec 4 17:11:19 2018 +0000 KVM: arm/arm64: vgic: Cap SPIs to the VM-defined maximum SPIs should be checked against the VMs specific configuration, and not the architectural maximum. Cc: stable@vger.kernel.org Signed-off-by: Marc Zyngier virt/kvm/arm/vgic/vgic.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 6992195cc6c6c4d673a3266ae59cbeeb746d61af Author: Christoffer Dall Date: Tue Nov 6 13:33:38 2018 +0100 KVM: arm64: Clarify explanation of STAGE2_PGTABLE_LEVELS In attempting to re-construct the logic for our stage 2 page table layout I found the reasoning in the comment explaining how we calculate the number of levels used for stage 2 page tables a bit backwards. This commit attempts to clarify the comment, to make it slightly easier to read without having the Arm ARM open on the right page. While we're at it, fixup a typo in a comment that was recently changed. Reviewed-by: Suzuki K Poulose Signed-off-by: Christoffer Dall Signed-off-by: Marc Zyngier arch/arm64/include/asm/stage2_pgtable.h | 16 +++++++--------- virt/kvm/arm/mmu.c | 2 +- 2 files changed, 8 insertions(+), 10 deletions(-) commit 2e2f6c3c0b08eed3fcf7de3c7684c940451bdeb1 Author: Julien Thierry Date: Mon Nov 26 18:26:44 2018 +0000 KVM: arm/arm64: vgic: Do not cond_resched_lock() with IRQs disabled To change the active state of an MMIO, halt is requested for all vcpus of the affected guest before modifying the IRQ state. This is done by calling cond_resched_lock() in vgic_mmio_change_active(). However interrupts are disabled at this point and we cannot reschedule a vcpu. We actually don't need any of this, as kvm_arm_halt_guest ensures that all the other vcpus are out of the guest. Let's just drop that useless code. Signed-off-by: Julien Thierry Suggested-by: Christoffer Dall Cc: stable@vger.kernel.org Signed-off-by: Marc Zyngier virt/kvm/arm/vgic/vgic-mmio.c | 21 --------------------- 1 file changed, 21 deletions(-) commit b8e0ba7c8bea994011aff3b4c35256b180fab874 Author: Punit Agrawal Date: Tue Dec 11 17:10:41 2018 +0000 KVM: arm64: Add support for creating PUD hugepages at stage 2 KVM only supports PMD hugepages at stage 2. Now that the various page handling routines are updated, extend the stage 2 fault handling to map in PUD hugepages. Addition of PUD hugepage support enables additional page sizes (e.g., 1G with 4K granule) which can be useful on cores that support mapping larger block sizes in the TLB entries. Signed-off-by: Punit Agrawal Reviewed-by: Christoffer Dall Cc: Russell King Cc: Catalin Marinas Cc: Will Deacon [ Replace BUG() => WARN_ON(1) for arm32 PUD helpers ] Signed-off-by: Suzuki Poulose Signed-off-by: Marc Zyngier arch/arm/include/asm/kvm_mmu.h | 20 +++++++ arch/arm/include/asm/stage2_pgtable.h | 5 ++ arch/arm64/include/asm/kvm_mmu.h | 16 +++++ arch/arm64/include/asm/pgtable-hwdef.h | 2 + arch/arm64/include/asm/pgtable.h | 2 + virt/kvm/arm/mmu.c | 104 +++++++++++++++++++++++++++++++-- 6 files changed, 143 insertions(+), 6 deletions(-) commit 35a63966194dd994f44150f07398c62f8dca011e Author: Punit Agrawal Date: Tue Dec 11 17:10:40 2018 +0000 KVM: arm64: Update age handlers to support PUD hugepages In preparation for creating larger hugepages at Stage 2, add support to the age handling notifiers for PUD hugepages when encountered. Provide trivial helpers for arm32 to allow sharing code. Signed-off-by: Punit Agrawal Reviewed-by: Christoffer Dall Cc: Russell King Cc: Catalin Marinas Cc: Will Deacon [ Replaced BUG() => WARN_ON(1) for arm32 PUD helpers ] Signed-off-by: Suzuki K Poulose Signed-off-by: Marc Zyngier arch/arm/include/asm/kvm_mmu.h | 6 ++++++ arch/arm64/include/asm/kvm_mmu.h | 5 +++++ arch/arm64/include/asm/pgtable.h | 1 + virt/kvm/arm/mmu.c | 39 ++++++++++++++++++++------------------- 4 files changed, 32 insertions(+), 19 deletions(-) commit eb3f0624ea082def887acc79e97934e27d0188b7 Author: Punit Agrawal Date: Tue Dec 11 17:10:39 2018 +0000 KVM: arm64: Support handling access faults for PUD hugepages In preparation for creating larger hugepages at Stage 2, extend the access fault handling at Stage 2 to support PUD hugepages when encountered. Provide trivial helpers for arm32 to allow sharing of code. Signed-off-by: Punit Agrawal Reviewed-by: Christoffer Dall Cc: Russell King Cc: Catalin Marinas Cc: Will Deacon [ Replaced BUG() => WARN_ON(1) in PUD helpers ] Signed-off-by: Suzuki K Poulose Signed-off-by: Marc Zyngier arch/arm/include/asm/kvm_mmu.h | 9 +++++++++ arch/arm64/include/asm/kvm_mmu.h | 7 +++++++ arch/arm64/include/asm/pgtable.h | 6 ++++++ virt/kvm/arm/mmu.c | 22 +++++++++++----------- 4 files changed, 33 insertions(+), 11 deletions(-) commit 86d1c55ea605025f78d026e7fc3a2bb4c3fc2d6a Author: Punit Agrawal Date: Tue Dec 11 17:10:38 2018 +0000 KVM: arm64: Support PUD hugepage in stage2_is_exec() In preparation for creating PUD hugepages at stage 2, add support for detecting execute permissions on PUD page table entries. Faults due to lack of execute permissions on page table entries is used to perform i-cache invalidation on first execute. Provide trivial implementations of arm32 helpers to allow sharing of code. Signed-off-by: Punit Agrawal Reviewed-by: Christoffer Dall Cc: Russell King Cc: Catalin Marinas Cc: Will Deacon [ Replaced BUG() => WARN_ON(1) in arm32 PUD helpers ] Signed-off-by: Suzuki K Poulose Signed-off-by: Marc Zyngier arch/arm/include/asm/kvm_mmu.h | 6 ++++ arch/arm64/include/asm/kvm_mmu.h | 5 ++++ arch/arm64/include/asm/pgtable-hwdef.h | 2 ++ virt/kvm/arm/mmu.c | 53 ++++++++++++++++++++++++++++++---- 4 files changed, 61 insertions(+), 5 deletions(-) commit 4ea5af53114091e23a8fc279f25637e6c4e892c6 Author: Punit Agrawal Date: Tue Dec 11 17:10:37 2018 +0000 KVM: arm64: Support dirty page tracking for PUD hugepages In preparation for creating PUD hugepages at stage 2, add support for write protecting PUD hugepages when they are encountered. Write protecting guest tables is used to track dirty pages when migrating VMs. Also, provide trivial implementations of required kvm_s2pud_* helpers to allow sharing of code with arm32. Signed-off-by: Punit Agrawal Reviewed-by: Christoffer Dall Cc: Russell King Cc: Catalin Marinas Cc: Will Deacon [ Replaced BUG() => WARN_ON() in arm32 pud helpers ] Signed-off-by: Suzuki K Poulose Signed-off-by: Marc Zyngier arch/arm/include/asm/kvm_mmu.h | 15 +++++++++++++++ arch/arm64/include/asm/kvm_mmu.h | 10 ++++++++++ virt/kvm/arm/mmu.c | 11 +++++++---- 3 files changed, 32 insertions(+), 4 deletions(-) commit f8df73388ee25b5e5f1d26249202e7126ca8139d Author: Punit Agrawal Date: Tue Dec 11 17:10:36 2018 +0000 KVM: arm/arm64: Introduce helpers to manipulate page table entries Introduce helpers to abstract architectural handling of the conversion of pfn to page table entries and marking a PMD page table entry as a block entry. The helpers are introduced in preparation for supporting PUD hugepages at stage 2 - which are supported on arm64 but do not exist on arm. Signed-off-by: Punit Agrawal Reviewed-by: Suzuki K Poulose Acked-by: Christoffer Dall Cc: Russell King Cc: Catalin Marinas Cc: Will Deacon Reviewed-by: Marc Zyngier Signed-off-by: Suzuki K Poulose Signed-off-by: Marc Zyngier arch/arm/include/asm/kvm_mmu.h | 5 +++++ arch/arm64/include/asm/kvm_mmu.h | 5 +++++ virt/kvm/arm/mmu.c | 14 ++++++++------ 3 files changed, 18 insertions(+), 6 deletions(-) commit 6396b852e46e562f4742ed0a9042b537eb26b8aa Author: Punit Agrawal Date: Tue Dec 11 17:10:35 2018 +0000 KVM: arm/arm64: Re-factor setting the Stage 2 entry to exec on fault Stage 2 fault handler marks a page as executable if it is handling an execution fault or if it was a permission fault in which case the executable bit needs to be preserved. The logic to decide if the page should be marked executable is duplicated for PMD and PTE entries. To avoid creating another copy when support for PUD hugepages is introduced refactor the code to share the checks needed to mark a page table entry as executable. Signed-off-by: Punit Agrawal Reviewed-by: Suzuki K Poulose Reviewed-by: Christoffer Dall Signed-off-by: Suzuki K Poulose Signed-off-by: Marc Zyngier virt/kvm/arm/mmu.c | 28 +++++++++++++++------------- 1 file changed, 15 insertions(+), 13 deletions(-) commit 3f58bf63455588a260b6abc8761c48bc8977b919 Author: Punit Agrawal Date: Tue Dec 11 17:10:34 2018 +0000 KVM: arm/arm64: Share common code in user_mem_abort() The code for operations such as marking the pfn as dirty, and dcache/icache maintenance during stage 2 fault handling is duplicated between normal pages and PMD hugepages. Instead of creating another copy of the operations when we introduce PUD hugepages, let's share them across the different pagesizes. Signed-off-by: Punit Agrawal Reviewed-by: Suzuki K Poulose Reviewed-by: Christoffer Dall Signed-off-by: Suzuki K Poulose Signed-off-by: Marc Zyngier virt/kvm/arm/mmu.c | 49 ++++++++++++++++++++++++++++++------------------- 1 file changed, 30 insertions(+), 19 deletions(-) commit 60c3ab30d8c2ff3a52606df03f05af2aae07dc6b Author: Christoffer Dall Date: Tue Dec 11 12:51:03 2018 +0100 KVM: arm/arm64: vgic-v2: Set active_source to 0 when restoring state When restoring the active state from userspace, we don't know which CPU was the source for the active state, and this is not architecturally exposed in any of the register state. Set the active_source to 0 in this case. In the future, we can expand on this and exposse the information as additional information to userspace for GICv2 if anyone cares. Cc: stable@vger.kernel.org Signed-off-by: Christoffer Dall Signed-off-by: Marc Zyngier virt/kvm/arm/vgic/vgic-mmio.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) commit d1878af3a5a6ac00bc8a3edfecf80539ee9c546e Author: Mark Rutland Date: Thu Dec 6 12:31:44 2018 +0000 KVM: arm/arm64: Log PSTATE for unhandled sysregs When KVM traps an unhandled sysreg/coproc access from a guest, it logs the guest PC. To aid debugging, it would be helpful to know which exception level the trap came from, along with other PSTATE/CPSR bits, so let's log the PSTATE/CPSR too. Acked-by: Christoffer Dall Signed-off-by: Mark Rutland Signed-off-by: Marc Zyngier arch/arm/kvm/coproc.c | 4 ++-- arch/arm64/kvm/sys_regs.c | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) commit fb544d1ca65a89f7a3895f7531221ceeed74ada7 Author: Christoffer Dall Date: Tue Dec 11 13:23:57 2018 +0100 KVM: arm/arm64: Fix VMID alloc race by reverting to lock-less We recently addressed a VMID generation race by introducing a read/write lock around accesses and updates to the vmid generation values. However, kvm_arch_vcpu_ioctl_run() also calls need_new_vmid_gen() but does so without taking the read lock. As far as I can tell, this can lead to the same kind of race: VM 0, VCPU 0 VM 0, VCPU 1 ------------ ------------ update_vttbr (vmid 254) update_vttbr (vmid 1) // roll over read_lock(kvm_vmid_lock); force_vm_exit() local_irq_disable need_new_vmid_gen == false //because vmid gen matches enter_guest (vmid 254) kvm_arch.vttbr = : read_unlock(kvm_vmid_lock); enter_guest (vmid 1) Which results in running two VCPUs in the same VM with different VMIDs and (even worse) other VCPUs from other VMs could now allocate clashing VMID 254 from the new generation as long as VCPU 0 is not exiting. Attempt to solve this by making sure vttbr is updated before another CPU can observe the updated VMID generation. Cc: stable@vger.kernel.org Fixes: f0cf47d939d0 "KVM: arm/arm64: Close VMID generation race" Reviewed-by: Julien Thierry Signed-off-by: Christoffer Dall Signed-off-by: Marc Zyngier virt/kvm/arm/arm.c | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-) commit e4b92b108c6cd6b311e4b6e85d6a87a34599a6e3 Author: Arnd Bergmann Date: Fri Dec 7 13:45:54 2018 +0100 timekeeping: remove obsolete time accessors There are no more remaining users of these deprecated wrappers, so let's remove them before new users have a chance to make it in. See Documentation/core-api/timekeeping.rst for replacements when porting old drivers that contain calls to this function. Signed-off-by: Arnd Bergmann Acked-by: John Stultz include/linux/timekeeping.h | 14 -------------- include/linux/timekeeping32.h | 9 --------- 2 files changed, 23 deletions(-) commit d651d1607f22fd0cd249cb045627569f8028092b Author: Arnd Bergmann Date: Wed Dec 5 11:14:27 2018 +1100 vfs: replace current_kernel_time64 with ktime equivalent current_time is the last remaining caller of current_kernel_time64(), which is a wrapper around ktime_get_coarse_real_ts64(). This calls the latter directly for consistency with the rest of the kernel that is moving to the ktime_get_ family of time accessors, as now documented in Documentation/core-api/timekeeping.rst. An open questions is whether we may want to actually call the more accurate ktime_get_real_ts64() for file systems that save high-resolution timestamps in their on-disk format. This would add a small overhead to each update of the inode stamps but lead to inode timestamps to actually have a usable resolution better than one jiffy (1 to 10 milliseconds normally). Experiments on a variety of hardware platforms show a typical time of around 100 CPU cycles to read the cycle counter and calculate the accurate time from that. On old platforms without a cycle counter, this can be signiciantly higher, up to several microseconds to access a hardware clock, but those have become very rare by now. I traced the original addition of the current_kernel_time() call to set the nanosecond fields back to linux-2.5.48, where Andi Kleen added a patch with subject "nanosecond stat timefields". Andi explains that the motivation was to introduce as little overhead as possible back then. At this time, reading the clock hardware was also more expensive when most architectures did not have a cycle counter. One side effect of having more accurate inode timestamp would be having to write out the inode every time that mtime/ctime/atime get touched on most systems, whereas many file systems today only write it when the timestamps have changed, i.e. at most once per jiffy unless something else changes as well. That change would certainly be noticed in some workloads, which is enough reason to not do it without a good reason, regardless of the cost of reading the time. One thing we could still consider however would be to round the timestamps from current_time() to multiples of NSEC_PER_JIFFY, e.g. full milliseconds rather than having six or seven meaningless but confusing digits at the end of the timestamp. Link: http://lkml.kernel.org/r/20180726130820.4174359-1-arnd@arndb.de Signed-off-by: Arnd Bergmann fs/inode.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 437e78d3fd6d35e6d56230962e6d03bb5dcda7f6 Author: Arnd Bergmann Date: Fri Dec 7 13:41:02 2018 +0100 timekeeping: remove timespec_add/timespec_del The last users were removed a while ago since everyone moved to ktime_t, so we can remove the two unused interfaces for old timespec structures. With those two gone, set_normalized_timespec() is also unused, so remove that as well. Signed-off-by: Arnd Bergmann Acked-by: John Stultz include/linux/time32.h | 25 ------------------------- kernel/time/time.c | 36 ------------------------------------ 2 files changed, 61 deletions(-) commit 926617889dc8383a120c66a2ecf7959a69f96950 Author: Arnd Bergmann Date: Tue Aug 14 14:15:23 2018 +0200 timekeeping: remove unused {read,update}_persistent_clock After arch/sh has removed the last reference to these functions, we can remove them completely and just rely on the 64-bit time_t based versions. This cleans up a rather ugly use of __weak functions. Signed-off-by: Arnd Bergmann Acked-by: John Stultz include/linux/timekeeping32.h | 6 ------ kernel/time/ntp.c | 10 +--------- kernel/time/timekeeping.c | 12 ++---------- 3 files changed, 3 insertions(+), 25 deletions(-) commit 19f48591e67c83e74e1b612f180b96ce7f1eaf85 Author: Arnd Bergmann Date: Fri Apr 20 17:46:39 2018 +0200 sh: remove board_time_init() callback The only remaining user of board_time_init() is the of-generic machine, and that just calls the global timer_init() function. Calling that one has no effect on non-DT platforms, so we can simply call it unconditionally in place of board_time_init(). Signed-off-by: Arnd Bergmann Documentation/sh/new-machine.txt | 8 -------- arch/sh/boards/of-generic.c | 8 -------- arch/sh/include/asm/rtc.h | 1 - arch/sh/kernel/time.c | 5 +---- 4 files changed, 1 insertion(+), 21 deletions(-) commit 07df7800c6cd0bfc3bfcbfc5f12ebbd73423a5ec Author: Arnd Bergmann Date: Wed Jan 24 16:18:50 2018 +0100 sh: remove unused rtc_sh_get/set_time infrastructure All platforms are now converted to RTC drivers, so this has become obsolete. The board_time_init() callback still has one caller, but could otherwise also get killed. This removes one more usage of the deprecated timespec structure, which overflows in y2038. Signed-off-by: Arnd Bergmann arch/sh/include/asm/rtc.h | 2 -- arch/sh/kernel/time.c | 69 ----------------------------------------------- 2 files changed, 71 deletions(-) commit 09e81263e5013ce5add177d50c0b1da0725ce266 Author: Arnd Bergmann Date: Wed Jan 24 16:08:13 2018 +0100 sh: sh03: rtc: push down rtc class ops into driver The SH RTC support has an extra level of indirection to provide either the old read_persistent_clock/update_persistent_clock interface or the rtc-generic device for hctosys/systohc. By removing the indirection and always using the RTC_CLASS interface, we can avoid the lossy double conversion between rtc_time and timespec, so we end up supporting the entire range of 'year' values, and clarifying the rtc_set_time callback. I did not change the behavior of sh03_rtc_settimeofday(), which keeps just updating the seconds/minutes by calling set_rtc_mmss(), this could be improved if anyone cares. Also, the file should ideally be moved into drivers/rtc and not use rtc-generic. Signed-off-by: Arnd Bergmann arch/sh/boards/mach-sh03/Makefile | 3 ++- arch/sh/boards/mach-sh03/rtc.c | 51 ++++++++++++++++++++++++--------------- arch/sh/boards/mach-sh03/setup.c | 9 ------- arch/sh/configs/sh03_defconfig | 2 ++ 4 files changed, 35 insertions(+), 30 deletions(-) commit b0495e4b67b230cdb8a7ba244cd260e529c53b84 Author: Arnd Bergmann Date: Wed Jan 24 15:04:31 2018 +0100 sh: dreamcast: rtc: push down rtc class ops into driver The SH RTC support has an extra level of indirection to provide either the old read_persistent_clock/update_persistent_clock interface or the rtc-generic device for hctosys/systohc. Both do the same thing for dreamcast, so we can do away with the abstraction and simply let the RTC core code to take care of it. Signed-off-by: Arnd Bergmann arch/sh/boards/mach-dreamcast/Makefile | 4 +-- arch/sh/boards/mach-dreamcast/rtc.c | 45 ++++++++++++++++++--------- arch/sh/boards/mach-dreamcast/setup.c | 1 - arch/sh/configs/dreamcast_defconfig | 2 ++ arch/sh/include/mach-dreamcast/mach/sysasic.h | 1 - 5 files changed, 35 insertions(+), 18 deletions(-) commit 2367c4b5fa09b2947d03c5cd23d7bc0200b7fe4f Author: Arnd Bergmann Date: Wed Apr 18 16:18:35 2018 +0200 y2038: signal: Add compat_sys_rt_sigtimedwait_time64 Now that 32-bit architectures have two variants of sys_rt_sigtimedwaid() for 32-bit and 64-bit time_t, we also need to have a second compat system call entry point on the corresponding 64-bit architectures. The traditional system call keeps getting handled by compat_sys_rt_sigtimedwait(), and this adds a new compat_sys_rt_sigtimedwait_time64() that differs only in the timeout argument type. The naming remains a bit asymmetric for the moment. Ideally we would want to have compat_sys_rt_sigtimedwait_time32() for the old version and compat_sys_rt_sigtimedwait() for the new one to mirror the names of the native entry points, but renaming the existing system call tables causes unnecessary churn. I would suggest renaming all such system calls together at a later point. Signed-off-by: Arnd Bergmann include/linux/compat.h | 3 +++ kernel/signal.c | 32 ++++++++++++++++++++++++++++++++ 2 files changed, 35 insertions(+) commit df8522a340ee4ccb725036e1f9145f5646939aed Author: Arnd Bergmann Date: Wed Apr 18 16:15:37 2018 +0200 y2038: signal: Add sys_rt_sigtimedwait_time32 Once sys_rt_sigtimedwait() gets changed to a 64-bit time_t, we have to provide compatibility support for existing binaries. An earlier version of this patch reused the compat_sys_rt_sigtimedwait entry point to avoid code duplication, but this newer approach duplicates the existing native entry point instead, which seems a bit cleaner. Signed-off-by: Arnd Bergmann include/linux/syscalls.h | 4 ++++ kernel/signal.c | 33 +++++++++++++++++++++++++++++++++ 2 files changed, 37 insertions(+) commit e11d4284e2f4de5048c6d1787c82226f0a198292 Author: Arnd Bergmann Date: Wed Apr 18 13:43:52 2018 +0200 y2038: socket: Add compat_sys_recvmmsg_time64 recvmmsg() takes two arguments to pointers of structures that differ between 32-bit and 64-bit architectures: mmsghdr and timespec. For y2038 compatbility, we are changing the native system call from timespec to __kernel_timespec with a 64-bit time_t (in another patch), and use the existing compat system call on both 32-bit and 64-bit architectures for compatibility with traditional 32-bit user space. As we now have two variants of recvmmsg() for 32-bit tasks that are both different from the variant that we use on 64-bit tasks, this means we also require two compat system calls! The solution I picked is to flip things around: The existing compat_sys_recvmmsg() call gets moved from net/compat.c into net/socket.c and now handles the case for old user space on all architectures that have set CONFIG_COMPAT_32BIT_TIME. A new compat_sys_recvmmsg_time64() call gets added in the old place for 64-bit architectures only, this one handles the case of a compat mmsghdr structure combined with __kernel_timespec. In the indirect sys_socketcall(), we now need to call either do_sys_recvmmsg() or __compat_sys_recvmmsg(), depending on what kind of architecture we are on. For compat_sys_socketcall(), no such change is needed, we always call __compat_sys_recvmmsg(). I decided to not add a new SYS_RECVMMSG_TIME64 socketcall: Any libc implementation for 64-bit time_t will need significant changes including an updated asm/unistd.h, and it seems better to consistently use the separate syscalls that configuration, leaving the socketcall only for backward compatibility with 32-bit time_t based libc. The naming is asymmetric for the moment, so both existing syscalls entry points keep their names, while the new ones are recvmmsg_time32 and compat_recvmmsg_time64 respectively. I expect that we will rename the compat syscalls later as we start using generated syscall tables everywhere and add these entry points. Signed-off-by: Arnd Bergmann include/linux/compat.h | 3 +++ include/linux/socket.h | 9 ++++--- include/linux/syscalls.h | 3 +++ kernel/sys_ni.c | 2 ++ net/compat.c | 34 ++++++++++---------------- net/socket.c | 62 +++++++++++++++++++++++++++++++++++------------- 6 files changed, 72 insertions(+), 41 deletions(-) commit 54578ee883e34d2d1c518d48f1c1e2dd3f387188 Author: Bin Liu Date: Tue Dec 18 07:58:05 2018 -0600 usb: musb: dsps: fix runtime pm for peripheral mode Since the runtime PM support was added in musb, dsps relies on the timer calling otg_timer() to activate the usb subsystem. However the driver doesn't enable the timer for peripheral port, then the peripheral port is unable to be enumerated by a host if the other usb port is disabled or in peripheral mode too. So let's start the timer for peripheral port too. Fixes: ea2f35c01d5e ("usb: musb: Fix sleeping function called from invalid context for hdrc glue") Acked-by: Tony Lindgren Signed-off-by: Bin Liu Signed-off-by: Greg Kroah-Hartman drivers/usb/musb/musb_dsps.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) commit 6010abf2c2c0e382d7e8ee44bd11f343aae90cce Author: Bin Liu Date: Tue Dec 18 07:58:04 2018 -0600 usb: musb: dsps: fix otg state machine Due to lack of ID pin interrupt event on AM335x devices, the musb dsps driver uses polling to detect usb device attach for dual-role port. But in the case if a micro-A cable adapter is attached without a USB device attached to the cable, the musb state machine gets stuck in a_wait_vrise state waiting for the MUSB_CONNECT interrupt which won't happen due to the usb device is not attached. The state is stuck in a_wait_vrise even after the micro-A cable is detached, which could cause VBUS retention if then the dual-role port is attached to a host port. To fix the problem, make a_wait_vrise as a transient state, then move the state to either a_wait_bcon for host port or a_idle state for dual-role port, if no usb device is attached to the port. Signed-off-by: Bin Liu Signed-off-by: Greg Kroah-Hartman drivers/usb/musb/musb_dsps.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) commit bd7d95cafb499e24903b7d21f9eeb2c5208160c2 Author: Mark Rutland Date: Fri Nov 9 15:07:11 2018 +0000 arm64: KVM: Consistently advance singlestep when emulating instructions When we emulate a guest instruction, we don't advance the hardware singlestep state machine, and thus the guest will receive a software step exception after a next instruction which is not emulated by the host. We bodge around this in an ad-hoc fashion. Sometimes we explicitly check whether userspace requested a single step, and fake a debug exception from within the kernel. Other times, we advance the HW singlestep state rely on the HW to generate the exception for us. Thus, the observed step behaviour differs for host and guest. Let's make this simpler and consistent by always advancing the HW singlestep state machine when we skip an instruction. Thus we can rely on the hardware to generate the singlestep exception for us, and never need to explicitly check for an active-pending step, nor do we need to fake a debug exception from the guest. Cc: Peter Maydell Reviewed-by: Alex Bennée Reviewed-by: Christoffer Dall Signed-off-by: Mark Rutland Signed-off-by: Marc Zyngier arch/arm/include/asm/kvm_host.h | 5 ---- arch/arm64/include/asm/kvm_emulate.h | 35 ++++++++++++++++++++------ arch/arm64/include/asm/kvm_host.h | 1 - arch/arm64/kvm/debug.c | 21 ---------------- arch/arm64/kvm/handle_exit.c | 14 +---------- arch/arm64/kvm/hyp/switch.c | 43 +++----------------------------- arch/arm64/kvm/hyp/vgic-v2-cpuif-proxy.c | 12 ++++++--- virt/kvm/arm/arm.c | 2 -- virt/kvm/arm/hyp/vgic-v3-sr.c | 6 ++++- 9 files changed, 46 insertions(+), 93 deletions(-) commit 0d640732dbebed0f10f18526de21652931f0b2f2 Author: Mark Rutland Date: Fri Nov 9 15:07:10 2018 +0000 arm64: KVM: Skip MMIO insn after emulation When we emulate an MMIO instruction, we advance the CPU state within decode_hsr(), before emulating the instruction effects. Having this logic in decode_hsr() is opaque, and advancing the state before emulation is problematic. It gets in the way of applying consistent single-step logic, and it prevents us from being able to fail an MMIO instruction with a synchronous exception. Clean this up by only advancing the CPU state *after* the effects of the instruction are emulated. Cc: Peter Maydell Reviewed-by: Alex Bennée Reviewed-by: Christoffer Dall Signed-off-by: Mark Rutland Signed-off-by: Marc Zyngier virt/kvm/arm/mmio.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) commit da0abe1a04110491697ca9ff146e1107f40b4808 Author: Richard Fitzgerald Date: Fri Dec 14 14:44:16 2018 +0000 irqchip: Add driver for Cirrus Logic Madera codecs The Cirrus Logic Madera codecs (Cirrus Logic CS47L35/85/90/91 and WM1840) are highly complex devices containing up to 7 programmable DSPs and many other internal sources of interrupts plus a number of GPIOs that can be used as interrupt inputs. The large number (>150) of internal interrupt sources are managed by an on-board interrupt controller. This driver provides the handling for the interrupt controller. As the codec is accessed via regmap, we can make use of the generic IRQ functionality from regmap to do most of the work. Only around half of the possible interrupt source are currently of interest from the driver so only this subset is defined. Others can be added in future if needed. The KConfig options are not user-configurable because this driver is mandatory so is automatically included when the parent MFD driver is selected. Signed-off-by: Richard Fitzgerald Signed-off-by: Charles Keepax Signed-off-by: Marc Zyngier MAINTAINERS | 2 + drivers/irqchip/Kconfig | 3 + drivers/irqchip/Makefile | 1 + drivers/irqchip/irq-madera.c | 256 +++++++++++++++++++++++++++++++++++++ include/linux/irqchip/irq-madera.h | 132 +++++++++++++++++++ 5 files changed, 394 insertions(+) commit 34743bfddef2c50af20234ae873324ca49320a55 Author: Mike Snitzer Date: Mon Dec 10 11:55:56 2018 -0500 dm rq: cleanup leftover code from recently removed q->mq_ops branching When commit 6a23e05c2fe3c6 ("dm: remove legacy request-based IO path") removed some q->mq_ops branching from map_request() it left in place a goto that was only needed if that branching (and conditional 'r' assignment) existed. Now that the branching is gone map_request()'s goto can be removed too. Signed-off-by: Mike Snitzer drivers/md/dm-rq.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit bbf6a566920e1b0244b27b5f9882fb7f8bc83a31 Author: Eric Biggers Date: Wed Dec 5 20:54:13 2018 -0800 dm verity: log the hash algorithm implementation Log the hash algorithm's driver name when a dm-verity target is created. This will help people determine whether the expected implementation is being used. It can make an enormous difference; e.g., SHA-256 on ARM can be 8x faster with the crypto extensions than without. It can also be useful to know if an implementation using an external crypto accelerator is being used instead of a software implementation. Example message: [ 35.281945] device-mapper: verity: sha256 using implementation "sha256-ce" We've already found the similar message in fs/crypto/keyinfo.c to be very useful. Signed-off-by: Eric Biggers Signed-off-by: Mike Snitzer drivers/md/dm-verity-target.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit af331ebae7e10699a023fcce4f0671a01419ee3c Author: Eric Biggers Date: Wed Dec 5 20:53:00 2018 -0800 dm crypt: log the encryption algorithm implementation Log the encryption algorithm's driver name when a dm-crypt target is created. This will help people determine whether the expected implementation is being used. In some cases we've seen people do benchmarks and reject using encryption for performance reasons, when in fact they used a much slower implementation than was possible on the hardware. It can make an enormous difference; e.g., AES-XTS on ARM can be over 10x faster with the crypto extensions than without. It can also be useful to know if an implementation using an external crypto accelerator is being used instead of a software implementation. Example message: [ 29.307629] device-mapper: crypt: xts(aes) using implementation "xts-aes-ce" We've already found the similar message in fs/crypto/keyinfo.c to be very useful. Signed-off-by: Eric Biggers Signed-off-by: Mike Snitzer drivers/md/dm-crypt.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit e8c2566f83527f6bcced86739adc5cd5262e2dd2 Author: Colin Ian King Date: Wed Nov 28 15:15:31 2018 +0000 dm integrity: fix spelling mistake in workqueue name Rename the workqueue from dm-intergrity-recalc to dm-integrity-recalc. Signed-off-by: Colin Ian King Signed-off-by: Mike Snitzer drivers/md/dm-integrity.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a00f5276e26636cbf72f24f79831026d2e2868e7 Author: Sweet Tea Date: Tue Nov 13 08:04:24 2018 -0500 dm flakey: Properly corrupt multi-page bios. The flakey target is documented to be able to corrupt the Nth byte in a bio, but does not corrupt byte indices after the first biovec in the bio. Change the corrupting function to actually corrupt the Nth byte no matter in which biovec that index falls. A test device generating two-page bios, atop a flakey device configured to corrupt a byte index on the second page, verified both the failure to corrupt before this patch and the expected corruption after this change. Signed-off-by: John Dorminy Signed-off-by: Mike Snitzer drivers/md/dm-flakey.c | 33 ++++++++++++++++++++++----------- 1 file changed, 22 insertions(+), 11 deletions(-) commit ef87bfc24f9b8da82c89aff493df20f078bc9cb1 Author: Milan Broz Date: Wed Nov 7 22:24:55 2018 +0100 dm: Check for device sector overflow if CONFIG_LBDAF is not set Reference to a device in device-mapper table contains offset in sectors. If the sector_t is 32bit integer (CONFIG_LBDAF is not set), then several device-mapper targets can overflow this offset and validity check is then performed on a wrong offset and a wrong table is activated. See for example (on 32bit without CONFIG_LBDAF) this overflow: # dmsetup create test --table "0 2048 linear /dev/sdg 4294967297" # dmsetup table test 0 2048 linear 8:96 1 This patch adds explicit check for overflow if the offset is sector_t type. Signed-off-by: Milan Broz Reviewed-by: Mikulas Patocka Signed-off-by: Mike Snitzer drivers/md/dm-crypt.c | 2 +- drivers/md/dm-delay.c | 2 +- drivers/md/dm-flakey.c | 2 +- drivers/md/dm-linear.c | 2 +- drivers/md/dm-raid1.c | 3 ++- drivers/md/dm-unstripe.c | 2 +- 6 files changed, 7 insertions(+), 6 deletions(-) commit 8d683dcd65c037efc9fb38c696ec9b65b306e573 Author: AliOS system security Date: Mon Nov 5 15:31:42 2018 +0800 dm crypt: use u64 instead of sector_t to store iv_offset The iv_offset in the mapping table of crypt target is a 64bit number when IV algorithm is plain64, plain64be, essiv or benbi. It will be assigned to iv_offset of struct crypt_config, cc_sector of struct convert_context and iv_sector of struct dm_crypt_request. These structures members are defined as a sector_t. But sector_t is 32bit when CONFIG_LBDAF is not set in 32bit kernel. In this situation sector_t is not big enough to store the 64bit iv_offset. Here is a reproducer. Prepare test image and device (loop is automatically allocated by cryptsetup): # dd if=/dev/zero of=tst.img bs=1M count=1 # echo "tst"|cryptsetup open --type plain -c aes-xts-plain64 \ --skip 500000000000000000 tst.img test On 32bit system (use IV offset value that overflows to 64bit; CONFIG_LBDAF if off) and device checksum is wrong: # dmsetup table test --showkeys 0 2048 crypt aes-xts-plain64 dfa7cfe3c481f2239155739c42e539ae8f2d38f304dcc89d20b26f69daaf0933 3551657984 7:0 0 # sha256sum /dev/mapper/test 533e25c09176632b3794f35303488c4a8f3f965dffffa6ec2df347c168cb6c19 /dev/mapper/test On 64bit system (and on 32bit system with the patch), table and checksum is now correct: # dmsetup table test --showkeys 0 2048 crypt aes-xts-plain64 dfa7cfe3c481f2239155739c42e539ae8f2d38f304dcc89d20b26f69daaf0933 500000000000000000 7:0 0 # sha256sum /dev/mapper/test 5d16160f9d5f8c33d8051e65fdb4f003cc31cd652b5abb08f03aa6fce0df75fc /dev/mapper/test Signed-off-by: AliOS system security Tested-and-Reviewed-by: Milan Broz Signed-off-by: Mike Snitzer drivers/md/dm-crypt.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit d7e6b8dfc7bcb3f4f3a18313581f67486a725b52 Author: Nikos Tsironis Date: Wed Oct 31 17:53:09 2018 -0400 dm kcopyd: Fix bug causing workqueue stalls When using kcopyd to run callbacks through dm_kcopyd_do_callback() or submitting copy jobs with a source size of 0, the jobs are pushed directly to the complete_jobs list, which could be under processing by the kcopyd thread. As a result, the kcopyd thread can continue running completed jobs indefinitely, without releasing the CPU, as long as someone keeps submitting new completed jobs through the aforementioned paths. Processing of work items, queued for execution on the same CPU as the currently running kcopyd thread, is thus stalled for excessive amounts of time, hurting performance. Running the following test, from the device mapper test suite [1], dmtest run --suite snapshot -n parallel_io_to_many_snaps_N , with 8 active snapshots, we get, in dmesg, messages like the following: [68899.948523] BUG: workqueue lockup - pool cpus=0 node=0 flags=0x0 nice=0 stuck for 95s! [68899.949282] Showing busy workqueues and worker pools: [68899.949288] workqueue events: flags=0x0 [68899.949295] pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=2/256 [68899.949306] pending: vmstat_shepherd, cache_reap [68899.949331] workqueue mm_percpu_wq: flags=0x8 [68899.949337] pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 [68899.949345] pending: vmstat_update [68899.949387] workqueue dm_bufio_cache: flags=0x8 [68899.949392] pwq 4: cpus=2 node=0 flags=0x0 nice=0 active=1/256 [68899.949400] pending: work_fn [dm_bufio] [68899.949423] workqueue kcopyd: flags=0x8 [68899.949429] pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 [68899.949437] pending: do_work [dm_mod] [68899.949452] workqueue kcopyd: flags=0x8 [68899.949458] pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=2/256 [68899.949466] in-flight: 13:do_work [dm_mod] [68899.949474] pending: do_work [dm_mod] [68899.949487] workqueue kcopyd: flags=0x8 [68899.949493] pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 [68899.949501] pending: do_work [dm_mod] [68899.949515] workqueue kcopyd: flags=0x8 [68899.949521] pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 [68899.949529] pending: do_work [dm_mod] [68899.949541] workqueue kcopyd: flags=0x8 [68899.949547] pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 [68899.949555] pending: do_work [dm_mod] [68899.949568] pool 0: cpus=0 node=0 flags=0x0 nice=0 hung=95s workers=4 idle: 27130 27223 1084 Fix this by splitting the complete_jobs list into two parts: A user facing part, named callback_jobs, and one used internally by kcopyd, retaining the name complete_jobs. dm_kcopyd_do_callback() and dispatch_job() now push their jobs to the callback_jobs list, which is spliced to the complete_jobs list once, every time the kcopyd thread wakes up. This prevents kcopyd from hogging the CPU indefinitely and causing workqueue stalls. Re-running the aforementioned test: * Workqueue stalls are eliminated * The maximum writing time among all targets is reduced from 09m37.10s to 06m04.85s and the total run time of the test is reduced from 10m43.591s to 7m19.199s [1] https://github.com/jthornber/device-mapper-test-suite Signed-off-by: Nikos Tsironis Signed-off-by: Ilias Tsitsimpis Signed-off-by: Mike Snitzer drivers/md/dm-kcopyd.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) commit 721b1d98fb517ae99ab3b757021cf81db41e67be Author: Nikos Tsironis Date: Wed Oct 31 17:53:08 2018 -0400 dm snapshot: Fix excessive memory usage and workqueue stalls kcopyd has no upper limit to the number of jobs one can allocate and issue. Under certain workloads this can lead to excessive memory usage and workqueue stalls. For example, when creating multiple dm-snapshot targets with a 4K chunk size and then writing to the origin through the page cache. Syncing the page cache causes a large number of BIOs to be issued to the dm-snapshot origin target, which itself issues an even larger (because of the BIO splitting taking place) number of kcopyd jobs. Running the following test, from the device mapper test suite [1], dmtest run --suite snapshot -n many_snapshots_of_same_volume_N , with 8 active snapshots, results in the kcopyd job slab cache growing to 10G. Depending on the available system RAM this can lead to the OOM killer killing user processes: [463.492878] kthreadd invoked oom-killer: gfp_mask=0x6040c0(GFP_KERNEL|__GFP_COMP), nodemask=(null), order=1, oom_score_adj=0 [463.492894] kthreadd cpuset=/ mems_allowed=0 [463.492948] CPU: 7 PID: 2 Comm: kthreadd Not tainted 4.19.0-rc7 #3 [463.492950] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 [463.492952] Call Trace: [463.492964] dump_stack+0x7d/0xbb [463.492973] dump_header+0x6b/0x2fc [463.492987] ? lockdep_hardirqs_on+0xee/0x190 [463.493012] oom_kill_process+0x302/0x370 [463.493021] out_of_memory+0x113/0x560 [463.493030] __alloc_pages_slowpath+0xf40/0x1020 [463.493055] __alloc_pages_nodemask+0x348/0x3c0 [463.493067] cache_grow_begin+0x81/0x8b0 [463.493072] ? cache_grow_begin+0x874/0x8b0 [463.493078] fallback_alloc+0x1e4/0x280 [463.493092] kmem_cache_alloc_node+0xd6/0x370 [463.493098] ? copy_process.part.31+0x1c5/0x20d0 [463.493105] copy_process.part.31+0x1c5/0x20d0 [463.493115] ? __lock_acquire+0x3cc/0x1550 [463.493121] ? __switch_to_asm+0x34/0x70 [463.493129] ? kthread_create_worker_on_cpu+0x70/0x70 [463.493135] ? finish_task_switch+0x90/0x280 [463.493165] _do_fork+0xe0/0x6d0 [463.493191] ? kthreadd+0x19f/0x220 [463.493233] kernel_thread+0x25/0x30 [463.493235] kthreadd+0x1bf/0x220 [463.493242] ? kthread_create_on_cpu+0x90/0x90 [463.493248] ret_from_fork+0x3a/0x50 [463.493279] Mem-Info: [463.493285] active_anon:20631 inactive_anon:4831 isolated_anon:0 [463.493285] active_file:80216 inactive_file:80107 isolated_file:435 [463.493285] unevictable:0 dirty:51266 writeback:109372 unstable:0 [463.493285] slab_reclaimable:31191 slab_unreclaimable:3483521 [463.493285] mapped:526 shmem:4903 pagetables:1759 bounce:0 [463.493285] free:33623 free_pcp:2392 free_cma:0 ... [463.493489] Unreclaimable slab info: [463.493513] Name Used Total [463.493522] bio-6 1028KB 1028KB [463.493525] bio-5 1028KB 1028KB [463.493528] dm_snap_pending_exception 236783KB 243789KB [463.493531] dm_exception 41KB 42KB [463.493534] bio-4 1216KB 1216KB [463.493537] bio-3 439396KB 439396KB [463.493539] kcopyd_job 6973427KB 6973427KB ... [463.494340] Out of memory: Kill process 1298 (ruby2.3) score 1 or sacrifice child [463.494673] Killed process 1298 (ruby2.3) total-vm:435740kB, anon-rss:20180kB, file-rss:4kB, shmem-rss:0kB [463.506437] oom_reaper: reaped process 1298 (ruby2.3), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kB Moreover, issuing a large number of kcopyd jobs results in kcopyd hogging the CPU, while processing them. As a result, processing of work items, queued for execution on the same CPU as the currently running kcopyd thread, is stalled for long periods of time, hurting performance. Running the aforementioned test we get, in dmesg, messages like the following: [67501.194592] BUG: workqueue lockup - pool cpus=4 node=0 flags=0x0 nice=0 stuck for 27s! [67501.195586] Showing busy workqueues and worker pools: [67501.195591] workqueue events: flags=0x0 [67501.195597] pwq 8: cpus=4 node=0 flags=0x0 nice=0 active=1/256 [67501.195611] pending: cache_reap [67501.195641] workqueue mm_percpu_wq: flags=0x8 [67501.195645] pwq 8: cpus=4 node=0 flags=0x0 nice=0 active=1/256 [67501.195656] pending: vmstat_update [67501.195682] workqueue kblockd: flags=0x18 [67501.195687] pwq 5: cpus=2 node=0 flags=0x0 nice=-20 active=1/256 [67501.195698] pending: blk_timeout_work [67501.195753] workqueue kcopyd: flags=0x8 [67501.195757] pwq 8: cpus=4 node=0 flags=0x0 nice=0 active=1/256 [67501.195768] pending: do_work [dm_mod] [67501.195802] workqueue kcopyd: flags=0x8 [67501.195806] pwq 8: cpus=4 node=0 flags=0x0 nice=0 active=1/256 [67501.195817] pending: do_work [dm_mod] [67501.195834] workqueue kcopyd: flags=0x8 [67501.195838] pwq 8: cpus=4 node=0 flags=0x0 nice=0 active=1/256 [67501.195848] pending: do_work [dm_mod] [67501.195881] workqueue kcopyd: flags=0x8 [67501.195885] pwq 8: cpus=4 node=0 flags=0x0 nice=0 active=1/256 [67501.195896] pending: do_work [dm_mod] [67501.195920] workqueue kcopyd: flags=0x8 [67501.195924] pwq 8: cpus=4 node=0 flags=0x0 nice=0 active=2/256 [67501.195935] in-flight: 67:do_work [dm_mod] [67501.195945] pending: do_work [dm_mod] [67501.195961] pool 8: cpus=4 node=0 flags=0x0 nice=0 hung=27s workers=3 idle: 129 23765 The root cause for these issues is the way dm-snapshot uses kcopyd. In particular, the lack of an explicit or implicit limit to the maximum number of in-flight COW jobs. The merging path is not affected because it implicitly limits the in-flight kcopyd jobs to one. Fix these issues by using a semaphore to limit the maximum number of in-flight kcopyd jobs. We grab the semaphore before allocating a new kcopyd job in start_copy() and start_full_bio() and release it after the job finishes in copy_callback(). The initial semaphore value is configurable through a module parameter, to allow fine tuning the maximum number of in-flight COW jobs. Setting this parameter to zero initializes the semaphore to INT_MAX. A default value of 2048 maximum in-flight kcopyd jobs was chosen. This value was decided experimentally as a trade-off between memory consumption, stalling the kernel's workqueues and maintaining a high enough throughput. Re-running the aforementioned test: * Workqueue stalls are eliminated * kcopyd's job slab cache uses a maximum of 130MB * The time taken by the test to write to the snapshot-origin target is reduced from 05m20.48s to 03m26.38s [1] https://github.com/jthornber/device-mapper-test-suite Signed-off-by: Nikos Tsironis Signed-off-by: Ilias Tsitsimpis Signed-off-by: Mike Snitzer drivers/md/dm-snap.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) commit ef9923739e6d2233dc16aba70b7d81767d85cfcb Author: Shenghui Wang Date: Tue Oct 30 15:35:54 2018 +0800 dm bufio: update comment in dm-bufio.c * Hashtable has been replaced by rbtree to manage buffers. Update the comment. * Fix typo in the comment for dm_bufio_issue_flush Signed-off-by: Shenghui Wang Signed-off-by: Mike Snitzer drivers/md/dm-bufio.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit e8ea141a0f5e1d7b23f47d10c480d4fc55caaf14 Author: Shenghui Wang Date: Wed Oct 24 16:04:36 2018 +0800 dm writecache: fix typo in error msg for creating writecache_flush_thread The error msg should be "flush thread" instead of "endio thread" for writecache_flush_thread. Signed-off-by: Shenghui Wang Signed-off-by: Mike Snitzer drivers/md/dm-writecache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 53b471687012c80a8c03250cecf7121ffa8781f8 Author: Mike Snitzer Date: Mon Dec 3 17:00:54 2018 -0500 dm: remove indirect calls from __send_changing_extent_only() No need to be so fancy. Signed-off-by: Mike Snitzer drivers/md/dm.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) commit 935fcc56abc321ca828f2d1fbb732fd478fd3449 Author: wuzhouhui Date: Thu Mar 22 22:22:38 2018 +0800 dm mpath: only flush workqueue when needed The workqueues are shared by many multipath devices, only flush whole workqueue when necessary. Otherwise, we just flush works as needed. Signed-off-by: wuzhouhui Signed-off-by: Mike Snitzer drivers/md/dm-mpath.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 2adc5c559a0770ef75d1647fbf557c7f56194ef8 Author: Mike Snitzer Date: Thu Nov 8 14:59:41 2018 -0500 dm rq: remove unused arguments from rq_completed() Signed-off-by: Mike Snitzer drivers/md/dm-rq.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) commit 24113d4878439baf1f23c1a33dfcc340fba66e97 Author: Mikulas Patocka Date: Tue Nov 6 22:34:59 2018 +0100 dm: avoid indirect call in __dm_make_request Indirect calls are inefficient because of retpolines that are used for spectre workaround. This patch replaces an indirect call with a condition (that can be predicted by the branch predictor). Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer drivers/md/dm.c | 29 ++++++----------------------- 1 file changed, 6 insertions(+), 23 deletions(-) commit ed49e839199e73966b9ff5946c3e87759827b40e Merge: 40906ebe3af6 a7a850dba824 Author: Takashi Iwai Date: Tue Dec 18 14:59:56 2018 +0100 Merge tag 'asoc-v4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-next ASoC: Updates for v4.21 Not much work on the core this time around but we've seen quite a bit of driver work, including on the generic DT drivers. There's also a large part of the diff from a merge of the DaVinci and OMAP directories, along with some active development there: - Preparatory work from Morimoto-san for merging the audio-graph and audio-graph-scu cards. - A merge of the TI OMAP and DaVinci directories, the OMAP product line has been merged into the DaVinci product line so there is now a lot of IP sharing which meant that the split directories just got in the way. This has pulled in a few architecture changes as well. - A big cleanup of the Maxim MAX9867 driver from Ladislav Michl. - Support for Asahi Kaesi AKM4118, AMD ACP3x, Intel platforms with RT5660, Meson AXG S/PDIF inputs, several Qualcomm IPs and Xilinx I2S controllers. commit 46b14eef59a8157138dc02f916a7f97c73b3ec53 Author: Peter Hutterer Date: Thu Dec 13 11:28:51 2018 +1000 HID: doc: fix wrong data structure reference for UHID_OUTPUT Signed-off-by: Peter Hutterer Signed-off-by: Jiri Kosina Documentation/hid/uhid.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 41c5c5b0e7c8a0fd03722f2b061e1d492e359d45 Author: Honghui Zhang Date: Fri Dec 14 09:25:42 2018 +0800 arm64: dts: mt7622: Remove un-used property for PCIe The "num-lanes" property for PCIe is not used, remove it. Signed-off-by: Honghui Zhang Signed-off-by: Lorenzo Pieralisi arch/arm64/boot/dts/mediatek/mt7622.dtsi | 2 -- 1 file changed, 2 deletions(-) commit ebcd631df106561aa3906801053775e5f15a8e34 Author: Honghui Zhang Date: Fri Dec 14 09:25:41 2018 +0800 arm: dts: mt7623: Remove un-used property for PCIe The "num-lanes" property for PCIe is not used, remove it. Signed-off-by: Honghui Zhang Signed-off-by: Lorenzo Pieralisi arch/arm/boot/dts/mt7623.dtsi | 3 --- 1 file changed, 3 deletions(-) commit f2bb7d6a82da32bfd59c65540758fd2a01cccf74 Author: Honghui Zhang Date: Fri Dec 14 09:25:40 2018 +0800 dt-bindings: PCI: MediaTek: Remove un-used property The "num-lanes" property is not used, remove it. Signed-off-by: Honghui Zhang Signed-off-by: Lorenzo Pieralisi Documentation/devicetree/bindings/pci/mediatek-pcie.txt | 8 -------- 1 file changed, 8 deletions(-) commit 7b96dc91be5e86f94e950ffd947874839a8aee9d Author: Honghui Zhang Date: Fri Dec 14 09:25:39 2018 +0800 PCI: mediatek: Remove un-used variant in struct mtk_pcie_port The "lane" variant in struct mtk_pcie_port is not used, remove it. Signed-off-by: Honghui Zhang Signed-off-by: Lorenzo Pieralisi drivers/pci/controller/pcie-mediatek.c | 8 -------- 1 file changed, 8 deletions(-) commit a137401d85129953a1713d443216eb6b1074c12e Merge: 0d7410ea6efc 33221307c3f9 Author: Daniel Borkmann Date: Tue Dec 18 14:47:18 2018 +0100 Merge branch 'bpf-bpftool-mount-tracefs' Quentin Monnet says: ==================== This series focus on mounting (or not mounting) tracefs with bpftool. First patch makes bpftool attempt to mount tracefs if tracefs is not found when running "bpftool prog tracelog". Second patch adds an option to bpftool to prevent it from attempting to mount any file system (tracefs or bpffs), in case this behaviour is undesirable for some users. ==================== Signed-off-by: Daniel Borkmann commit 33221307c3f993500a9cfc6900811058c6bfc152 Author: Quentin Monnet Date: Tue Dec 18 10:13:19 2018 +0000 tools: bpftool: add an option to prevent auto-mount of bpffs, tracefs In order to make life easier for users, bpftool automatically attempts to mount the BPF virtual file system, if it is not mounted already, before trying to pin objects in it. Similarly, it attempts to mount tracefs if necessary before trying to dump the trace pipe to the console. While mounting file systems on-the-fly can improve user experience, some administrators might prefer to avoid that. Let's add an option to block these mount attempts. Note that it does not prevent automatic mounting of tracefs by debugfs for the "bpftool prog tracelog" command. Signed-off-by: Quentin Monnet Reviewed-by: Jakub Kicinski Signed-off-by: Daniel Borkmann tools/bpf/bpftool/Documentation/bpftool-map.rst | 4 ++++ tools/bpf/bpftool/Documentation/bpftool-prog.rst | 4 ++++ tools/bpf/bpftool/Documentation/bpftool.rst | 4 ++++ tools/bpf/bpftool/common.c | 6 ++++++ tools/bpf/bpftool/main.c | 8 +++++++- tools/bpf/bpftool/main.h | 4 +++- tools/bpf/bpftool/tracelog.c | 3 +++ 7 files changed, 31 insertions(+), 2 deletions(-) commit be3245e22d227ad68ab97785d506561374daa028 Author: Quentin Monnet Date: Tue Dec 18 10:13:18 2018 +0000 tools: bpftool: attempt to mount tracefs if required for tracelog cmd As a follow-up to commit 30da46b5dc3a ("tools: bpftool: add a command to dump the trace pipe"), attempt to mount the tracefs virtual file system if it is not detected on the system before trying to dump content of the tracing pipe on an invocation of "bpftool prog tracelog". Usually, tracefs in automatically mounted by debugfs when the user tries to access it (e.g. "ls /sys/kernel/debug/tracing" mounts the tracefs). So if we failed to find it, it is probably that debugfs is not here either. Therefore, we just attempt a single mount, at a location that does not involve debugfs: /sys/kernel/tracing. Suggested-by: Daniel Borkmann Signed-off-by: Quentin Monnet Reviewed-by: Jakub Kicinski Signed-off-by: Daniel Borkmann tools/bpf/bpftool/common.c | 25 ++++++++++++++++++++----- tools/bpf/bpftool/main.h | 2 ++ tools/bpf/bpftool/tracelog.c | 20 +++++++++++++------- 3 files changed, 35 insertions(+), 12 deletions(-) commit 0d7410ea6efcdfda56773999f692bbd5d4e4bc00 Author: Yonghong Song Date: Mon Dec 17 17:31:57 2018 -0800 tools/bpf: check precise {func, line, jited_line}_info_rec_size in test_btf Current btf func_info, line_info and jited_line are designed to be extensible. The record sizes for {func,line}_info are passed to kernel, and the record sizes for {func,line,jited_line}_info are returned to userspace during bpf_prog_info query. In bpf selftests test_btf.c, when testing whether kernel returns a legitimate {func,line, jited_line)_info rec_size, the test only compares to the minimum allowed size. If the returned rec_size is smaller than the minimum allowed size, it is considered incorrect. The minimum allowed size for these three info sizes are equal to current value of sizeof(struct bpf_func_info), sizeof(struct bpf_line_info) and sizeof(__u64). The original thinking was that in the future when rec_size is increased in kernel, the same test should run correctly. But this sacrificed the precision of testing under the very kernel the test is shipped with, and bpf selftest is typically run with the same repo kernel. So this patch changed the testing of rec_size such that the kernel returned value should be equal to the size defined by tools uapi header bpf.h which syncs with kernel uapi header. Martin discovered a bug in one of rec_size comparisons. Instead of comparing to minimum func_info rec_size 8, it compares to 4. This patch fixed that issue as well. Fixes: 999d82cbc044 ("tools/bpf: enhance test_btf file testing to test func info") Fixes: 05687352c600 ("bpf: Refactor and bug fix in test_func_type in test_btf.c") Fixes: 4d6304c76355 ("bpf: Add unit tests for bpf_line_info") Suggested-by: Martin KaFai Lau Acked-by: Martin KaFai Lau Signed-off-by: Yonghong Song Signed-off-by: Daniel Borkmann tools/testing/selftests/bpf/test_btf.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit ca46afdb2754dbb4a5d5772332fa16957d9bc618 Merge: 8162b3d1a728 028713aa8389 Author: Ingo Molnar Date: Tue Dec 18 14:39:00 2018 +0100 Merge tag 'perf-core-for-mingo-4.21-20181217' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/core Pull perf/core improvements and fixes from Arnaldo Carvalho de Melo: - Introduce 'perf record --aio' to use asynchronous IO trace writing, disabled by default (Alexey Budankov) - Add fallback routines to be used in places where we don't have the CPU mode (kernel/userspace/hypervisor) and thus must first fallback lookups looking at all map trees when trying to resolve symbols (Adrian Hunter) - Fix error with config term "pt=0", where we should just force "pt=1" and warn the user about the former being nonsensical (Adrian Hunter) - Fix 'perf test' entry where we expect 'sleep' to come in a PERF_RECORD_COMM but instead we get 'coreutils' when sleep is provided by some versions of the 'coreutils' package (Adrian Hunter) - Introduce 'perf top --kallsyms file' to match 'perf report --kallsyms', useful when dealing with BPF, where symbol resolution happens via kallsyms, not via the default vmlinux ELF symtabs (Arnaldo Carvalho de Melo) - Support 'srccode' output field in 'perf script' (Andi Kleen) - Introduce basic 'perf annotation' support for the ARC architecture (Eugeniy Paltsev) - Compute and display average IPC and IPC coverage per symbol in 'perf annotate' and 'perf report' (Jin Yao) - Make 'perf top' use ordered_events and process histograms in a separate thread (Jiri Olsa) - Make 'perf trace' use ordered_events (Jiri Olsa) - Add support for ETMv3 and PTMv1.1 decoding in cs-etm (Mathieu Poirier) - Support for ARM A32/T32 instruction sets in CoreSight trace (cs-etm) (Robert Walker) - Fix 'perf stat' shadow stats for clock events. (Ravi Bangoria) - Remove needless rb_tree extra indirection from map__find() (Eric Saint-Etienne) - Fix CSV mode column output for non-cgroup events in 'perf stat' (Stephane Eranian) - Add sanity check to libtraceevent's is_timestamp_in_us() (Tzvetomir Stoyanov) - Use ERR_CAST instead of ERR_PTR(PTR_ERR()) (Wen Yang) - Fix Load_Miss_Real_Latency on SKL/SKX intel vendor event files (Andi Kleen) - strncpy() fixes triggered by new warnings on gcc 8.2.0 (Arnaldo Carvalho de Melo) - Handle tracefs syscall tracepoint older 'nr' field in 'perf trace', that got renamed to '__syscall_nr' to work in older kernels (Arnaldo Carvalho de Melo) - Give better hint about devel package for libssl (Arnaldo Carvalho de Melo) - Fix the 'perf trace' build in architectures lacking explicit mmap.h file (Arnaldo Carvalho de Melo) - Remove extra rb_tree traversal indirection from map__find() (Eric Saint-Etienne) - Disable breakpoint tests for 32-bit ARM (Florian Fainelli) - Fix typos all over the place, mostly in comments, but also in some debug messages and JSON files (Ingo Molnar) - Allow specifying proc-map-timeout in config file (Mark Drayton) - Fix mmap_flags table generation script (Sihyeon Jang) - Fix 'size' parameter to snprintf in the 'perf config' code (Sihyeon Jang) - More libtraceevent renames to make it a proper library (Tzvetomir Stoyanov) - Implement new API tep_get_ref() in libtraceevent (Tzvetomir Stoyanov) - Added support for pkg-config in libtraceevent (Tzvetomir Stoyanov) Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit 221b35fedee1b38b9cee99320f0c60263d229e14 Merge: 272c1a9b4939 801c7a1e5286 Author: Daniel Vetter Date: Tue Dec 18 14:24:52 2018 +0100 Merge branch 'etnaviv/next' of https://git.pengutronix.de/git/lst/linux into drm-next Lucas writes: "nothing major this time, mostly some cleanups that were found on the way of reworking the code in preparation for new feature additions." Small conflict in drivers/gpu/drm/etnaviv/etnaviv_drv.c because drm-misc-next also has a patch to switch over to _put() functions. Signed-off-by: Daniel Vetter From: Lucas Stach Link: https://patchwork.freedesktop.org/patch/msgid/1545130845.5874.23.camel@pengutronix.de commit c5f48c0a7aa1a8c82d81cdf27e63aa0a5544c6e6 Author: Ingo Molnar Date: Mon Dec 3 11:44:51 2018 +0100 genirq: Fix various typos in comments Go over the IRQ subsystem source code (including irqchip drivers) and fix common typos in comments. No change in functionality intended. Signed-off-by: Ingo Molnar Cc: Thomas Gleixner Cc: Jason Cooper Cc: Marc Zyngier Cc: Peter Zijlstra Cc: Linus Torvalds Cc: linux-kernel@vger.kernel.org drivers/irqchip/irq-dw-apb-ictl.c | 2 +- drivers/irqchip/irq-gic.c | 6 +++--- drivers/irqchip/irq-renesas-h8s.c | 2 +- drivers/irqchip/irq-s3c24xx.c | 2 +- include/linux/irqchip.h | 4 ++-- kernel/irq/chip.c | 2 +- kernel/irq/ipi.c | 4 ++-- kernel/irq/manage.c | 2 +- kernel/irq/spurious.c | 6 +++--- 9 files changed, 15 insertions(+), 15 deletions(-) commit dc7eb0f2c23f58bc0e15574bda2dc8498d30a833 Author: Shaul Triebitz Date: Sat Dec 15 11:03:20 2018 +0200 mac80211: do not advertise HE cap IE if HE disabled When disabling HE due to the lack of HT/VHT, do it at an earlier stage to avoid advertising HE capabilities IE. Also, at this point, no need to check if AP supports HE, since it is already checked earlier (in ieee80211_prep_channel). Signed-off-by: Shaul Triebitz Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg net/mac80211/mlme.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) commit 002245ec20b273bc1e31ed8fbee01396955a0f19 Author: Shaul Triebitz Date: Sat Dec 15 11:03:19 2018 +0200 mac80211: set STA flag DISABLE_HE if HE is not supported Up until now, the IEEE80211_STA_DISABLE_HE flag was set only based on whether the AP has advertised HE capabilities. This flag should be set also if STA does not support HE (regardless of the AP support). Signed-off-by: Shaul Triebitz Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg net/mac80211/mlme.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 2e249fc320862e3f75fd255a21554d6de90fb55a Author: Shaul Triebitz Date: Sat Dec 15 11:03:15 2018 +0200 mac80211: update driver when MU EDCA params change Similar to WMM IE, if MU_EDCA IE parameters changed (or ceased to exist) tell the Driver about it. Signed-off-by: Shaul Triebitz Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg net/mac80211/ieee80211_i.h | 1 + net/mac80211/mlme.c | 12 ++++++++++-- net/mac80211/util.c | 2 ++ 3 files changed, 13 insertions(+), 2 deletions(-) commit daa5b83513a7a85491ffa03e7aabd9d7348e97d5 Author: Shaul Triebitz Date: Sat Dec 15 11:03:05 2018 +0200 mac80211: update HE operation fields to D3.0 HE Operation element has changed in 11ax D3.0. Update the fields accordingly. Signed-off-by: Shaul Triebitz Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg include/linux/ieee80211.h | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) commit 55ebd6e6c765cce4697a6fbb97acf6eec9ad7a51 Author: Emmanuel Grumbach Date: Sat Dec 15 11:03:04 2018 +0200 mac80211: propagate the support for TWT to the driver TWT is a feature that was added in 11ah and enhanced in 11ax. There are two bits that need to be set if we want to use the feature in 11ax: one in the HE Capability IE and one in the Extended Capability IE. This is because of backward compatibility between 11ah and 11ax. In order to simplify the flow for the low level driver in managed mode, aggregate the two bits and add a boolean that tells whether TWT is supported or not, but only if 11ax is supported. Signed-off-by: Emmanuel Grumbach Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg include/net/mac80211.h | 3 +++ net/mac80211/mlme.c | 16 ++++++++++++++++ 2 files changed, 19 insertions(+) commit fdb313e3182094939b34234bdade0fbce28dfb2c Author: Emmanuel Grumbach Date: Sat Dec 15 11:03:03 2018 +0200 ieee80211: add bits for TWT in Extended Capabilities IE These bits are defined in ieee802.11ax to advertise support for TWT in addition to the bits in the HE IE. Signed-off-by: Emmanuel Grumbach Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg include/linux/ieee80211.h | 4 ++++ 1 file changed, 4 insertions(+) commit 20c3a2c33e9fdc82e9e8e8d2a6445b3256d20191 Author: Thomas Lendacky Date: Thu Dec 13 23:03:54 2018 +0000 x86/speculation: Add support for STIBP always-on preferred mode Different AMD processors may have different implementations of STIBP. When STIBP is conditionally enabled, some implementations would benefit from having STIBP always on instead of toggling the STIBP bit through MSR writes. This preference is advertised through a CPUID feature bit. When conditional STIBP support is requested at boot and the CPU advertises STIBP always-on mode as preferred, switch to STIBP "on" support. To show that this transition has occurred, create a new spectre_v2_user_mitigation value and a new spectre_v2_user_strings message. The new mitigation value is used in spectre_v2_user_select_mitigation() to print the new mitigation message as well as to return a new string from stibp_state(). Signed-off-by: Tom Lendacky Signed-off-by: Thomas Gleixner Cc: Andrea Arcangeli Cc: Konrad Rzeszutek Wilk Cc: Jiri Kosina Cc: Borislav Petkov Cc: Tim Chen Cc: David Woodhouse Link: https://lkml.kernel.org/r/20181213230352.6937.74943.stgit@tlendack-t1.amdoffice.net arch/x86/include/asm/cpufeatures.h | 1 + arch/x86/include/asm/nospec-branch.h | 1 + arch/x86/kernel/cpu/bugs.c | 28 ++++++++++++++++++++++------ 3 files changed, 24 insertions(+), 6 deletions(-) commit 30c63115e20b70f89b7cfb66b35e2a0ef4b0ef07 Author: Sriram R Date: Tue Dec 4 17:46:52 2018 +0530 nl80211: Add support to notify radar event info received from STA Currently radar detection and corresponding channel switch is handled at the AP device. STA ignores these detected radar events since the radar signal can be seen mostly by the AP as well. But in scenarios where a radar signal is seen only at STA, notifying this event to the AP which can trigger a channel switch can be useful. Stations can report such radar events autonomously through Spectrum management (Measurement Report) action frame to its AP. The userspace on processing the report can notify the kernel with the use of the added NL80211_CMD_NOTIFY_RADAR to indicate the detected event and inturn adding the reported channel to NOL. Signed-off-by: Sriram R Signed-off-by: Johannes Berg include/uapi/linux/nl80211.h | 7 +++++ net/wireless/nl80211.c | 62 ++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 69 insertions(+) commit 8ca66b7ccf3c9aeb3b6796967bf48f776bfd5523 Author: Lucas Stach Date: Fri Dec 14 13:15:28 2018 +0100 irqchip/irq-imx-gpcv2: Add IRQCHIP_DECLARE for i.MX8MQ compatible The GPC node on i.MX8MQ can not claim to be compatible with the i.MX7D GPC, as the power gating part has some significant differences. Thus we can not rely on the irqchip being probed with the old compatible. Signed-off-by: Lucas Stach Signed-off-by: Marc Zyngier drivers/irqchip/irq-imx-gpcv2.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 1fb51c975a80eab6b36fec203a178852fbb37665 Author: Wei Yongjun Date: Mon Dec 17 11:58:18 2018 +0000 irqchip/irq-rda-intc: Fix return value check in rda8810_intc_init() In case of error, the function of_io_request_and_map() returns ERR_PTR() and never returns NULL. The NULL test in the return value check should be replaced with IS_ERR(). Fixes: d852e62ad689 ("irqchip: Add RDA8810PL interrupt driver") Acked-by: Manivannan Sadhasivam Signed-off-by: Wei Yongjun Signed-off-by: Marc Zyngier drivers/irqchip/irq-rda-intc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit aa02ef099cff042c2a9109782ec2bf1bffc955d4 Author: Hui Wang Date: Wed Nov 7 10:36:43 2018 +0800 x86/topology: Use total_cpus for max logical packages calculation nr_cpu_ids can be limited on the command line via nr_cpus=. This can break the logical package management because it results in a smaller number of packages while in kdump kernel. Check below case: There is a two sockets system, each socket has 8 cores, which has 16 logical cpus while HT was turn on. 0 1 2 3 4 5 6 7 | 16 17 18 19 20 21 22 23 cores on socket 0 threads on socket 0 8 9 10 11 12 13 14 15 | 24 25 26 27 28 29 30 31 cores on socket 1 threads on socket 1 While starting the kdump kernel with command line option nr_cpus=16 panic was triggered on one of the cpus 24-31 eg. 26, then online cpu will be 1-15, 26(cpu 0 was disabled in kdump), ncpus will be 16 and __max_logical_packages will be 1, but actually two packages were booted on. This issue can reproduced by set kdump option nr_cpus=, and then trigger panic on last socket's thread, for example: taskset -c 26 echo c > /proc/sysrq-trigger Use total_cpus which will not be limited by nr_cpus command line to calculate the value of __max_logical_packages. Signed-off-by: Hui Wang Signed-off-by: Thomas Gleixner Cc: Cc: Cc: Cc: Link: https://lkml.kernel.org/r/20181107023643.22174-1-john.wanghui@huawei.com arch/x86/kernel/smpboot.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a7a850dba82498a1e050d8d153cae67ce0edb3b2 Merge: c5fd9e77be44 0f4967bc21de Author: Mark Brown Date: Tue Dec 18 12:23:59 2018 +0000 Merge branch 'asoc-4.21' into asoc-next commit c5fd9e77be44360b4827069c59f524815517917b Merge: 7566ec393f41 a01b8d1d2445 Author: Mark Brown Date: Tue Dec 18 12:23:57 2018 +0000 Merge branch 'asoc-4.20' into asoc-linus commit 0f4967bc21de0bb9e107f9ad3ced852daf66acd2 Author: Peter Ujfalusi Date: Mon Dec 17 14:21:42 2018 +0200 ASoC: ti: Kconfig: Remove the deprecated options We no longer have these options used anywhere. Signed-off-by: Peter Ujfalusi Acked-by: Tony Lindgren Signed-off-by: Mark Brown sound/soc/ti/Kconfig | 159 --------------------------------------------------- 1 file changed, 159 deletions(-) commit 41e95652ee225f121d38916d8d6849e3c15a924a Author: Peter Ujfalusi Date: Mon Dec 17 14:21:41 2018 +0200 ARM: davinci_all_defconfig: Update the audio options Use the new options for default audio support. Signed-off-by: Peter Ujfalusi Acked-by: Tony Lindgren Signed-off-by: Mark Brown arch/arm/configs/davinci_all_defconfig | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit eab5b50a13de4717cad5eda3d26d889f2f4ea37d Author: Peter Ujfalusi Date: Mon Dec 17 14:21:40 2018 +0200 ARM: omap1_defconfig: Do not select ASoC by default No audio support is enabled by default via ASoC, disable the code as well. Signed-off-by: Peter Ujfalusi Acked-by: Tony Lindgren Signed-off-by: Mark Brown arch/arm/configs/omap1_defconfig | 2 -- 1 file changed, 2 deletions(-) commit 3162b05fb74cd107b2a66f20485c62514b20048f Author: Peter Ujfalusi Date: Mon Dec 17 14:21:39 2018 +0200 ARM: omap2plus_defconfig: Update the audio options Use the new options for default audio support and enable Nokia n900 audio as well. Signed-off-by: Peter Ujfalusi Acked-by: Tony Lindgren Signed-off-by: Mark Brown arch/arm/configs/omap2plus_defconfig | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit 4d8c1e7efb9f915034c3dba2bc85ed1f8509ae0c Author: Peter Ujfalusi Date: Mon Dec 17 14:21:38 2018 +0200 ARM: davinci: dm365-evm: Update for the new ASoC Kcofnig options The codec selection config options for DMA365 has been changed. Signed-off-by: Peter Ujfalusi Acked-by: Tony Lindgren Signed-off-by: Mark Brown arch/arm/mach-davinci/board-dm365-evm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 558eb0bfb271323cfd9f864f34d3253a65f352dd Author: Peter Ujfalusi Date: Mon Dec 17 14:21:37 2018 +0200 ARM: OMAP2: Update for new MCBSP Kconfig option The MCBSP config option has been changed. Signed-off-by: Peter Ujfalusi Acked-by: Tony Lindgren Signed-off-by: Mark Brown arch/arm/mach-omap2/Makefile | 2 +- arch/arm/mach-omap2/pdata-quirks.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) commit c27ace2e95a29c3b359123363d4f88864452917d Author: Peter Ujfalusi Date: Mon Dec 17 14:21:36 2018 +0200 ARM: OMAP1: Makefile: Update for new MCBSP Kconfig option The MCBSP config option has been changed. Signed-off-by: Peter Ujfalusi Acked-by: Tony Lindgren Signed-off-by: Mark Brown arch/arm/mach-omap1/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ca1c4d6535249ad43068834687f78d0db82d9e2e Author: Peter Ujfalusi Date: Mon Dec 17 14:21:35 2018 +0200 MAINTAINERS: Add entry for sound/soc/ti and update the OMAP audio support The sound/soc/davinci and omap directories are merged under sound/soc/ti. Add myself as maintainer and update the OMAP audio support section with the new path and file names. Signed-off-by: Peter Ujfalusi Acked-by: Tony Lindgren Signed-off-by: Mark Brown MAINTAINERS | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) commit f2055e145f2975a75dace8e386fad9364828cdb4 Author: Peter Ujfalusi Date: Mon Dec 17 14:21:34 2018 +0200 ASoC: ti: Merge davinci and omap directories Create new directory to contain all Texas Instruments specific DAI, platform and machine drivers instead of scattering them under davinci and omap directories. There is already inter dependency between the two directories becasue of McASP (on dra7x it is serviced by sDMA, not EDMA). With the upcoming AM654 we will need to introduce new platform driver for UDMA and it does not fit under davinci, nor under omap. With the move I have restructured the Kconfig to be more usable in the era of simple-sound-card: CPU DAIs can be selected individually and they will select the platform driver they can be served with. To avoid breakage, I have moved over deprecated Kconfig options so defconfig builds will work without regression. Signed-off-by: Peter Ujfalusi For sound/soc/{omap => ti}: Tested-by: Jarkko Nikula Acked-by: Jarkko Nikula Acked-by: Tony Lindgren Signed-off-by: Mark Brown sound/soc/Kconfig | 3 +- sound/soc/Makefile | 3 +- sound/soc/davinci/Kconfig | 106 ------ sound/soc/davinci/Makefile | 16 - sound/soc/omap/Kconfig | 120 ------- sound/soc/omap/Makefile | 30 -- sound/soc/ti/Kconfig | 368 +++++++++++++++++++++ sound/soc/ti/Makefile | 44 +++ sound/soc/{omap => ti}/ams-delta.c | 0 sound/soc/{davinci => ti}/davinci-evm.c | 4 +- sound/soc/{davinci => ti}/davinci-i2s.c | 0 sound/soc/{davinci => ti}/davinci-i2s.h | 0 sound/soc/{davinci => ti}/davinci-mcasp.c | 14 +- sound/soc/{davinci => ti}/davinci-mcasp.h | 0 sound/soc/{davinci => ti}/davinci-vcif.c | 0 sound/soc/{davinci => ti}/edma-pcm.c | 0 sound/soc/{davinci => ti}/edma-pcm.h | 4 +- sound/soc/{omap => ti}/n810.c | 0 sound/soc/{omap => ti}/omap-abe-twl6040.c | 0 sound/soc/{omap => ti}/omap-dmic.c | 0 sound/soc/{omap => ti}/omap-dmic.h | 0 .../soc/{omap/omap-hdmi-audio.c => ti/omap-hdmi.c} | 0 sound/soc/{omap => ti}/omap-mcbsp-priv.h | 0 sound/soc/{omap => ti}/omap-mcbsp-st.c | 0 sound/soc/{omap => ti}/omap-mcbsp.c | 0 sound/soc/{omap => ti}/omap-mcbsp.h | 0 sound/soc/{omap => ti}/omap-mcpdm.c | 0 sound/soc/{omap => ti}/omap-mcpdm.h | 0 sound/soc/{omap => ti}/omap-twl4030.c | 0 sound/soc/{omap => ti}/omap3pandora.c | 0 sound/soc/{omap => ti}/osk5912.c | 0 sound/soc/{omap => ti}/rx51.c | 0 sound/soc/{omap => ti}/sdma-pcm.c | 0 sound/soc/{omap => ti}/sdma-pcm.h | 4 +- 34 files changed, 427 insertions(+), 289 deletions(-) commit 344f8e00933da8c275fa293caadfc62680d46d21 Author: Sara Sharon Date: Sat Dec 15 11:03:07 2018 +0200 mac80211: don't build AMSDU from GSO packets If we build AMSDU from GSO packets, it can lead to bad results if anyone tries to call skb_gso_segment on the packets. Signed-off-by: Sara Sharon Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg net/mac80211/tx.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit fca1279f090b8e38eadb95c3914d51e544142e74 Author: Johannes Berg Date: Sat Dec 15 11:03:08 2018 +0200 mac80211: document RCU requirements for ieee80211_tx_dequeue() In the iwlwifi conversion, we sometimes call this from outside of the wake_tx_queue() method, and in those cases must be in an RCU critical section. Document this requirement. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg include/net/mac80211.h | 8 ++++++++ 1 file changed, 8 insertions(+) commit 233e98dc9c3009943aa34d58925d94ac9330e17b Author: Johannes Berg Date: Sat Dec 15 11:03:09 2018 +0200 mac80211: remove superfluous NULL check At the place where this code lives now, the skb can never be NULL, so we can remove the pointless NULL check. It seems to exist because this code was moved around a few times and originally came from a place where it could in fact be NULL. Signed-off-by: Johannes Berg net/mac80211/tx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit dd665d23c1e94ad81d8720e90666030c5714a158 Author: Johannes Berg Date: Sat Dec 15 11:03:11 2018 +0200 mac80211: never pass NULL params to ieee80211_if_add() This isn't really a problem now, but it means that the function has a few NULL checks that are only relevant when coming from the initial interface added in mac80211, and that's confusing. Just pass non-NULL (but equivalently empty) in that case and remove all the NULL checks. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg net/mac80211/iface.c | 10 ++++------ net/mac80211/main.c | 4 +++- 2 files changed, 7 insertions(+), 7 deletions(-) commit 8020919a9b99d6c990dc6a50e8215e291fbbe5a6 Author: Ilan Peer Date: Sat Dec 15 11:03:17 2018 +0200 mac80211: Properly handle SKB with radiotap only The monitor interface Rx handling of SKBs that contain only radiotap information was buggy as it tried to access the SKB assuming it contains a frame. To fix this, check the RX_FLAG_NO_PSDU flag in the Rx status (indicting that the SKB contains only radiotap information), and do not perform data path specific processing when the flag is set. Signed-off-by: Ilan Peer Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg net/mac80211/rx.c | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-) commit 925b5978cdc7287ba08ed21bf27970131f147720 Author: Luca Coelho Date: Sat Dec 15 11:03:21 2018 +0200 cfg80211: add some missing fall through annotations There are talks about enabling -Wimplicit-fallthrough warnings in the mainline and it is already enabled in linux-next. Add all the missing annotations to prevent warnings when this happens. And in one case, remove the extra text from the annotation so that the compiler recognizes it. Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg net/wireless/chan.c | 3 +++ net/wireless/nl80211.c | 9 +++++++++ net/wireless/scan.c | 2 +- 3 files changed, 13 insertions(+), 1 deletion(-) commit 30db641ef4f68054db9b191b6c0200fb1a96d458 Author: Johannes Berg Date: Sat Dec 15 11:03:23 2018 +0200 cfg80211: clarify LCI/civic location documentation The older code and current userspace assumed that this data is the content of the Measurement Report element, starting with the Measurement Token. Clarify this in the documentation. Signed-off-by: Johannes Berg include/net/cfg80211.h | 6 ++++-- include/uapi/linux/nl80211.h | 16 ++++++++++++---- 2 files changed, 16 insertions(+), 6 deletions(-) commit 554be8333088e4a40f4b522c2b36ab23fb22f4be Author: Johannes Berg Date: Sat Dec 15 11:03:24 2018 +0200 mac80211: ftm responder: remove pointless defensive coding The pointer and corresponding length is always set in pairs in cfg80211, so no need to have this strange defensive check that also confuses static checkers. Clean it up. Signed-off-by: Johannes Berg net/mac80211/cfg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 3453de98145fa1a9453d18a42406bb7a47bec269 Author: Randy Dunlap Date: Thu Dec 6 12:58:30 2018 -0800 wireless: FTM: fix kernel-doc "cannot understand" warnings Fix kernel-doc warnings in FTM due to missing "struct" keyword. Fixes 109 warnings from : ../include/net/cfg80211.h:2838: warning: cannot understand function prototype: 'struct cfg80211_ftm_responder_stats ' and fixes 88 warnings from : ../include/net/mac80211.h:477: warning: cannot understand function prototype: 'struct ieee80211_ftm_responder_params ' Fixes: 81e54d08d9d8 ("cfg80211: support FTM responder configuration/statistics") Fixes: bc847970f432 ("mac80211: support FTM responder configuration/statistics") Signed-off-by: Randy Dunlap Cc: Pradeep Kumar Chitrapu Cc: Johannes Berg Cc: David Spinadel Signed-off-by: Johannes Berg include/net/cfg80211.h | 2 +- include/net/mac80211.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 3e8bf5234e4e23b66e49da636dc2ab165c8c91a0 Author: Linus Walleij Date: Wed Dec 12 10:19:50 2018 +0100 rfkill: gpio: Remove unused include The legacy header is no longer in use by the rfkill driver, so drop this include. Signed-off-by: Linus Walleij Signed-off-by: Johannes Berg net/rfkill/rfkill-gpio.c | 1 - 1 file changed, 1 deletion(-) commit 68406a9807e4db562a157df9a958b3b6e2cedb38 Author: James Prestwood Date: Tue Dec 11 16:52:14 2018 -0800 mac80211_hwsim: fix overwriting of if_combination Moved setting if_combination.num_different_channels/radar_detect_widths into an else after use_chanctx. In the case of use_chanctx, these two settings were getting overwritten. Signed-off-by: James Prestwood Signed-off-by: Johannes Berg drivers/net/wireless/mac80211_hwsim.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) commit 6848ac7ca39a226ede5df7af0efcc4ef0611e99c Author: Yangtao Li Date: Mon Nov 19 10:43:34 2018 -0500 x86/mm/dump_pagetables: Use DEFINE_SHOW_ATTRIBUTE() Use DEFINE_SHOW_ATTRIBUTE() instead of open coding it. Signed-off-by: Yangtao Li Signed-off-by: Thomas Gleixner Reviewed-by: Dave Hansen Cc: keescook@chromium.org Cc: luto@kernel.org Cc: peterz@infradead.org Cc: bp@alien8.de Cc: hpa@zytor.com Link: https://lkml.kernel.org/r/20181119154334.18265-1-tiny.windzz@gmail.com arch/x86/mm/debug_pagetables.c | 58 +++++------------------------------------- 1 file changed, 7 insertions(+), 51 deletions(-) commit ffeccc22d59cd585ce2b176c1e65d833e8ddc890 Author: Lorenzo Pieralisi Date: Thu Nov 29 18:23:54 2018 +0000 MAINTAINERS: Remove Jianguo Sun from HiSilicon STB DWC entry Jianguo Sun's email address reported in MAINTAINERS is not active any longer, remove it from the DWC HiSilicon STB entry. Signed-off-by: Lorenzo Pieralisi Cc: Bjorn Helgaas Cc: Shawn Guo Acked-by: Shawn Guo MAINTAINERS | 1 - 1 file changed, 1 deletion(-) commit 6d6b05e3d5337f645a411cdf72f1a083e495acb8 Author: Stephen Warren Date: Fri Nov 30 11:37:19 2018 -0700 PCI: dwc: Don't hard-code DBI/ATU offset The DWC PCIe core contains various separate register spaces: DBI, DBI2, ATU, DMA, etc. The relationship between the addresses of these register spaces is entirely determined by the implementation of the IP block, not by the IP block design itself. Hence, the DWC driver must not make assumptions that one register space can be accessed at a fixed offset from any other register space. To avoid such assumptions, introduce an explicit/separate register pointer for the ATU register space. In particular, the current assumption is not valid for NVIDIA's T194 SoC. The ATU register space is only used on systems that require unrolled ATU access. This property is detected at run-time for host controllers, and when this is detected, this patch provides a default value for atu_base that matches the previous assumption re: register layout. An alternative would be to update all drivers for HW that requires unrolled access to explicitly set atu_base. However, it's hard to tell which drivers would require atu_base to be set. The unrolled property is not detected for endpoint systems, and so any endpoint driver that requires unrolled access must explicitly set the iatu_unroll_enabled flag (none do at present), and so a check is added to require the driver to also set atu_base while at it. Signed-off-by: Stephen Warren Signed-off-by: Lorenzo Pieralisi Acked-by: Gustavo Pimentel Acked-by: Vidya Sagar drivers/pci/controller/dwc/pcie-designware-ep.c | 4 ++++ drivers/pci/controller/dwc/pcie-designware-host.c | 3 +++ drivers/pci/controller/dwc/pcie-designware.c | 8 +++---- drivers/pci/controller/dwc/pcie-designware.h | 28 +++++++++++++++++++---- 4 files changed, 35 insertions(+), 8 deletions(-) commit 9e56f0df3684bd752347e7c3df5e8ed1fc55d139 Author: Leonard Crestez Date: Wed Nov 7 13:57:03 2018 +0000 PCI: imx: Add imx6sx suspend/resume support Enable PCI suspend/resume support on imx6sx SOCs. This is similar to imx7d with a few differences: * The PM_Turn_Off bit is exposed through an IOMUX GPR, like all other pcie control bits on 6sx. * The pcie_inbound_axi clk needs to be turned off in suspend. On resume it is restored via resume -> deassert_core_reset -> enable_ref_clk. Most of the resume logic is shared with the initial reset after probe. Signed-off-by: Leonard Crestez Signed-off-by: Lorenzo Pieralisi Reviewed-by: Andrey Smirnov Acked-by: Lucas Stach drivers/pci/controller/dwc/pci-imx6.c | 44 +++++++++++++++++++++++++---- include/linux/mfd/syscon/imx6q-iomuxc-gpr.h | 1 + 2 files changed, 40 insertions(+), 5 deletions(-) commit 3d71746c420c1c1c27cf5c4e48f8fa0a6cfdc185 Author: Baruch Siach Date: Wed Oct 3 15:49:43 2018 +0300 PCI: armada8k: Add support for gpio controlled reset signal Add support for the gpio reset signal binding as described in the designware-pcie.txt DT binding document. Both the documented 'reset-gpio' property name and the more standard 'reset-gpios' name are supported. Signed-off-by: Baruch Siach Signed-off-by: Lorenzo Pieralisi Acked-by: Thomas Petazzoni drivers/pci/controller/dwc/pcie-armada8k.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) commit a3ed1446520ef68466ba75b774152d789710ea95 Author: Trent Piepho Date: Fri Nov 16 00:08:33 2018 +0000 PCI: dwc: Adjust Kconfig to allow IMX6 PCIe host on IMX7 The IMX6 PCI-e host driver also supports the IMX7d. However, the Kconfig dependencies of the driver prevented it from being enabled unless the kernel was built with both IMX6 and IMX7 support. It works fine to build with only IMX7 support enabled therefore adjust the Kconfig entry to allow this configuration. Signed-off-by: Trent Piepho Signed-off-by: Lorenzo Pieralisi Reviewed-by: Lucas Stach Cc: Andrey Smirnov drivers/pci/controller/dwc/Kconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit edfd39f0a417111365442f07c04150d2950f3a25 Author: Stefan Agner Date: Mon Nov 19 11:00:22 2018 +0100 PCI: dwc: layerscape: Constify driver data Constify driver data since they do not get changed at runtime. Signed-off-by: Stefan Agner Signed-off-by: Lorenzo Pieralisi drivers/pci/controller/dwc/pci-layerscape.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 3f7cceeab895fcc17ac8db0d9a5e8ca2954b4661 Author: Leonard Crestez Date: Mon Oct 8 18:06:21 2018 +0000 PCI: imx: Add multi-pd support On some chips the PCIe and PCIE_PHY blocks are in separate power domains which can be power-gated independently. The PCI driver needs to handle this by keeping both domain active. This is intended for imx6sx where PCIe is in DISPLAY and PCIE_PHY in its own domain. Defining the DISPLAY domain requires a way for PCIe to keep it active or it will break when displays are off. The power-domains on imx6sx are meant to look like this: power-domains = <&pd_disp>, <&pd_pci>; power-domain-names = "pcie", "pcie_phy"; Signed-off-by: Leonard Crestez [lorenzo.pieralisi@arm.com: updated commit log] Signed-off-by: Lorenzo Pieralisi Reviewed-by: Ulf Hansson drivers/pci/controller/dwc/pci-imx6.c | 48 +++++++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) commit 07daef8b41e0d9e7802a448f6766504e7641a234 Author: YueHaibing Date: Sun Dec 9 14:22:25 2018 +0800 ntp: Remove duplicated include Signed-off-by: YueHaibing Signed-off-by: Thomas Gleixner Cc: Cc: Link: https://lkml.kernel.org/r/20181209062225.4344-1-yuehaibing@huawei.com kernel/time/ntp.c | 1 - 1 file changed, 1 deletion(-) commit 801c7a1e528623f073c4007cb04d9a817e33b3a4 Author: Lucas Stach Date: Thu Nov 22 15:29:27 2018 +0100 drm/etnaviv: remove lastctx member from gpu struct It only written and we don't infer any useful information from it anymore. Remove it. Signed-off-by: Lucas Stach Reviewed-by: Christian Gmeiner drivers/gpu/drm/etnaviv/etnaviv_buffer.c | 2 -- drivers/gpu/drm/etnaviv/etnaviv_drv.c | 8 +------- drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 2 -- drivers/gpu/drm/etnaviv/etnaviv_gpu.h | 1 - 4 files changed, 1 insertion(+), 12 deletions(-) commit f9d255f4549e9798dce30408f25645710b5eed58 Author: Lucas Stach Date: Mon Oct 15 12:49:07 2018 +0200 drm/etnaviv: replace header include with forward declaration The etnaviv_gpu header only needs to know about the pointer types, so replace by a forward declaration and only include the headers where needed. Signed-off-by: Lucas Stach Reviewed-by: Christian Gmeiner drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 2 ++ drivers/gpu/drm/etnaviv/etnaviv_gpu.h | 5 ++--- 2 files changed, 4 insertions(+), 3 deletions(-) commit 5a23144cb507bda66b98666e46b8b677df14c2e7 Author: Lucas Stach Date: Wed Sep 12 12:55:42 2018 +0200 drm/etnaviv: remove unnecessary local irq disable The only event function that is called from IRQ context is event_free, which is already using atomic bitmap operations, so we can avoid taking the event spinlock in this function completely. As other the other functions still using the event spinlock are all called from normal process context, we can avoid disabling IRQs while holding the spinlock. Signed-off-by: Lucas Stach Reviewed-by: Christian Gmeiner drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 18 +++++------------- 1 file changed, 5 insertions(+), 13 deletions(-) commit f83f97684a737f66c9a10437544c92e3436ca4e0 Author: Geert Uytterhoeven Date: Wed Dec 12 13:38:59 2018 +0100 pinctrl: sh-pfc: Make pinmux_cfg_reg.var_field_width[] variable-length pinmux_cfg_reg.var_field_width[] is actually a variable-length array, terminated by a zero, and counting at most r_width entries. Usually the number of entries is much smaller than r_width, so the ability to catch bugs at compile time through an "excess elements in array initializer" warning is fairly limited. Hence make the array variable-length, decreasing kernel size slightly. Signed-off-by: Geert Uytterhoeven Reviewed-by: Simon Horman drivers/pinctrl/sh-pfc/sh_pfc.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit ce16e8dd0db2701265e6dfdb4fbed632b6ff61c2 Author: Geert Uytterhoeven Date: Thu Dec 13 15:20:13 2018 +0100 pinctrl: sh-pfc: Print actual field width for variable-width fields The debug code in sh_pfc_write_config_reg() prints the width of the field being modified. However, registers with a variable-width field layout are identified by pinmux_cfg_reg.field_width being zero, hence zeroes are printed instead of the actual field widths. Fix this by printing the Hamming weight of the field mask instead, which is correct for both fixed-width and variable-width fields. Signed-off-by: Geert Uytterhoeven Reviewed-by: Simon Horman drivers/pinctrl/sh-pfc/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 054f2400f706327f96770219c3065b5131f8f154 Author: Geert Uytterhoeven Date: Thu Dec 13 14:41:11 2018 +0100 pinctrl: sh-pfc: sh7734: Fix shifted values in IPSR10 Some values in the Peripheral Function Select Register 10 descriptor are shifted by one position, which may cause a peripheral function to be programmed incorrectly. Fixing this makes all HSCIF0 pins use Function 4 (value 3), like was already the case for the HSCK0 pin in field IP10[5:3]. Fixes: ac1ebc2190f575fc ("sh-pfc: Add sh7734 pinmux support") Signed-off-by: Geert Uytterhoeven Reviewed-by: Simon Horman drivers/pinctrl/sh-pfc/pfc-sh7734.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) commit 4d374bacd7c9665179f9752a52d5d602c45d8190 Author: Geert Uytterhoeven Date: Thu Dec 13 14:32:34 2018 +0100 pinctrl: sh-pfc: sh7734: Remove bogus IPSR10 value The IP10[5:3] field in Peripheral Function Select Register 10 has a width of 3 bits, i.e. it allows programming one out of 8 different configurations. However, 9 values are provided instead of 8, overflowing into the subsequent field in the register, and thus breaking the configuration of the latter. Fix this by dropping a bogus zero value. Fixes: ac1ebc2190f575fc ("sh-pfc: Add sh7734 pinmux support") Signed-off-by: Geert Uytterhoeven Reviewed-by: Simon Horman drivers/pinctrl/sh-pfc/pfc-sh7734.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9540cbdfcd861caf67a6f0e4bb7f46d41c4aad86 Author: Geert Uytterhoeven Date: Thu Dec 13 14:27:56 2018 +0100 pinctrl: sh-pfc: sh7269: Add missing PCIOR0 field The Port C I/O Register 0 contains 7 reserved bits, but the descriptor contains only dummy configuration values for 6 reserved bits, thus breaking the configuration of all subsequent fields in the register. Fix this by adding the two missing configuration values. Fixes: f5e811f2a43117b2 ("sh-pfc: Add sh7269 pinmux support") Signed-off-by: Geert Uytterhoeven Reviewed-by: Simon Horman drivers/pinctrl/sh-pfc/pfc-sh7269.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1b99d0c80bbe1810572c2cb77b90f67886adfa8d Author: Geert Uytterhoeven Date: Thu Dec 13 14:09:56 2018 +0100 pinctrl: sh-pfc: sh7264: Fix PFCR3 and PFCR0 register configuration The Port F Control Register 3 (PFCR3) contains only a single field. However, counting from left to right, it is the fourth field, not the first field. Insert the missing dummy configuration values (3 fields of 16 values) to fix this. The descriptor for the Port F Control Register 0 (PFCR0) lacks the description for the 4th field (PF0 Mode, PF0MD[2:0]). Add the missing configuration values to fix this. Fixes: a8d42fc4217b1ea1 ("sh-pfc: Add sh7264 pinmux support") Signed-off-by: Geert Uytterhoeven Reviewed-by: Simon Horman drivers/pinctrl/sh-pfc/pfc-sh7264.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) commit e28dc3f09c9d2555a9bd982f0847988591052226 Author: Geert Uytterhoeven Date: Thu Dec 13 13:59:42 2018 +0100 pinctrl: sh-pfc: r8a77995: Remove bogus SEL_PWM[0-3]_3 configurations While the SEL_PWM[0-3] fields in the Module Select Register 0 support 4 possible configurations per PWM pin, only the first 3 are valid. Replace the invalid and unused configurations for SEL_PWM[0-3]_3 by dummies. Fixes: 794a6711764658a1 ("pinctrl: sh-pfc: Initial R8A77995 PFC support") Signed-off-by: Geert Uytterhoeven Reviewed-by: Simon Horman drivers/pinctrl/sh-pfc/pfc-r8a77995.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 755a5b805fa7ff22e2934d67501efd92109f41ea Author: Geert Uytterhoeven Date: Thu Dec 13 10:53:11 2018 +0100 pinctrl: sh-pfc: r8a77990: Fix MOD_SEL0 SEL_I2C1 field width The SEL_I2C1 (MOD_SEL0[21:20]) field in Module Select Register 0 has a width of 2 bits, i.e. it allows programming one out of 4 different configurations. However, the MOD_SEL0_21_20 macro contains 8 values instead of 4, overflowing into the subsequent fields in the register, and thus breaking the configuration of the latter. Fix this by dropping the bogus last 4 values, including the non-existent SEL_I2C1_4 configuration. Fixes: 6d4036a1e3b3ac0f ("pinctrl: sh-pfc: Initial R8A77990 PFC support") Signed-off-by: Geert Uytterhoeven Reviewed-by: Simon Horman drivers/pinctrl/sh-pfc/pfc-r8a77990.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 94482af7055e1ffa211c1135256b85590ebcac99 Author: Geert Uytterhoeven Date: Wed Dec 12 14:42:16 2018 +0100 pinctrl: sh-pfc: sh7734: Add missing IPSR11 field The Peripheral Function Select Register 11 contains 3 reserved bits and 15 variable-width fields, but the variable field descriptor does not contain the 3-bit field IP11[25:23]. Fixes: 856cb4bb337ee504 ("sh: Add support pinmux for SH7734") Signed-off-by: Geert Uytterhoeven Reviewed-by: Simon Horman drivers/pinctrl/sh-pfc/pfc-sh7734.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b0f77269f6bba385f1f4dce44e7756cf8fbc0176 Author: Geert Uytterhoeven Date: Wed Dec 12 14:36:54 2018 +0100 pinctrl: sh-pfc: r8a77980: Add missing MOD_SEL0 field The Module Select Register 0 contains 20 (= 5 x 4) reserved bits, and 12 single-bit fields, but the variable field descriptor lacks a field of 4 reserved bits. Fixes: f59125248a691dfe ("pinctrl: sh-pfc: Add R8A77980 PFC support") Signed-off-by: Geert Uytterhoeven Reviewed-by: Simon Horman drivers/pinctrl/sh-pfc/pfc-r8a77980.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 67d7745bc78e16ec6b3af02bc1da6c8c868cbd89 Author: Geert Uytterhoeven Date: Wed Dec 12 14:29:02 2018 +0100 pinctrl: sh-pfc: r8a77970: Add missing MOD_SEL0 field The Module Select Register 0 contains 20 (= 5 x 4) reserved bits, and 12 single-bit fields, but the variable field descriptor lacks a field of 4 reserved bits. Fixes: b92ac66a1819602b ("pinctrl: sh-pfc: Add R8A77970 PFC support") Signed-off-by: Geert Uytterhoeven Reviewed-by: Simon Horman drivers/pinctrl/sh-pfc/pfc-r8a77970.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6a6c195d98a1a5e70faa87f594d7564af1dd1bed Author: Geert Uytterhoeven Date: Wed Dec 12 14:21:16 2018 +0100 pinctrl: sh-pfc: r8a7794: Remove bogus IPSR9 field The Peripheral Function Select Register 9 contains 12 fields, but the variable field descriptor contains a 13th bogus field of 3 bits. Fixes: 43c4436e2f1890a7 ("pinctrl: sh-pfc: add R8A7794 PFC support") Signed-off-by: Geert Uytterhoeven Reviewed-by: Simon Horman drivers/pinctrl/sh-pfc/pfc-r8a7794.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9925e879572680125c5d00ad8b807aec720b1cb6 Author: Geert Uytterhoeven Date: Wed Dec 12 12:01:45 2018 +0100 pinctrl: sh-pfc: Validate pins/marks in pin groups at build time Add a build-time check, to ensure the number of pins and pin marks in a pin group matches. This helps catching bugs early. Signed-off-by: Geert Uytterhoeven Reviewed-by: Simon Horman drivers/pinctrl/sh-pfc/sh_pfc.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 124cde98f856b6206b804acbdec3b7c80f8c3427 Author: Geert Uytterhoeven Date: Wed Dec 12 11:20:14 2018 +0100 pinctrl: sh-pfc: sh73a0: Add missing TO pin to tpu4_to3 group The tpu4_to3_mux[] array contains the TPU4TO3 pin mark, but the tpu4_to3_pins[] array lacks the corresponding pin number. Add the missing pin number, for non-GPIO pin F26. Fixes: 5da4eb049de803c7 ("sh-pfc: sh73a0: Add TPU pin groups and functions") Signed-off-by: Geert Uytterhoeven Reviewed-by: Simon Horman drivers/pinctrl/sh-pfc/pfc-sh73a0.c | 1 + 1 file changed, 1 insertion(+) commit 0d6256cb880166a4111bebce35790019e56b6e1b Author: Geert Uytterhoeven Date: Wed Dec 12 11:12:20 2018 +0100 pinctrl: sh-pfc: r8a7791: Remove bogus marks from vin1_b_data18 group The vin1_b_data18_mux[] arrays contains pin marks for the 2 LSB bits of the color components. The vin1_b_data18_pins[] array rightfully does not include the corresponding pin numbers, as RGB18 is subset of RGB24, containing only the 6 MSB bits of each component. Fixes: 8e32c9671f84acd8 ("pinctrl: sh-pfc: r8a7791: Add VIN pins") Signed-off-by: Geert Uytterhoeven Reviewed-by: Simon Horman drivers/pinctrl/sh-pfc/pfc-r8a7791.c | 3 --- 1 file changed, 3 deletions(-) commit 884fa25fb6e5e63ab970d612a628313bb68f37cc Author: Geert Uytterhoeven Date: Wed Dec 12 11:05:57 2018 +0100 pinctrl: sh-pfc: r8a7791: Remove bogus ctrl marks from qspi_data4_b group The qspi_data4_b_mux[] array contains pin marks for the clock and chip select pins. The qspi_data4_b_pins[] array rightfully does not contain the corresponding pin numbers, as the control pins are provided by a separate group (qspi_ctrl_b). Fixes: 2d0c386f135e4186 ("pinctrl: sh-pfc: r8a7791: Add QSPI pin groups") Signed-off-by: Geert Uytterhoeven Reviewed-by: Simon Horman drivers/pinctrl/sh-pfc/pfc-r8a7791.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 96bb2a6ab4eca10e5b6490b3f0738e9f7ec22c2b Author: Geert Uytterhoeven Date: Wed Dec 12 11:00:27 2018 +0100 pinctrl: sh-pfc: r8a7740: Add missing LCD0 marks to lcd0_data24_1 group The lcd0_data24_1_pins[] array contains the LCD0 D1[2-5] pin numbers, but the lcd0_data24_1_mux[] array lacks the corresponding pin marks. Fixes: 06c7dd866da70f6c ("sh-pfc: r8a7740: Add LCDC0 and LCDC1 pin groups and functions") Signed-off-by: Geert Uytterhoeven Reviewed-by: Simon Horman drivers/pinctrl/sh-pfc/pfc-r8a7740.c | 1 + 1 file changed, 1 insertion(+) commit 1ebc589a7786f17f97b9e87b44e0fb4d0290d8f8 Author: Geert Uytterhoeven Date: Wed Dec 12 10:57:27 2018 +0100 pinctrl: sh-pfc: r8a7740: Add missing REF125CK pin to gether_gmii group The gether_gmii_mux[] array contains the REF125CK pin mark, but the gether_gmii_pins[] array lacks the corresponding pin number. Fixes: bae11d30d0cafdc5 ("sh-pfc: r8a7740: Add GETHER pin groups and functions") Signed-off-by: Geert Uytterhoeven Reviewed-by: Simon Horman drivers/pinctrl/sh-pfc/pfc-r8a7740.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 117774fbe6beae3fd4f1fed5b7f596acdd90a2ed Author: Geert Uytterhoeven Date: Wed Dec 12 11:35:35 2018 +0100 pinctrl: sh-pfc: r8a77990: Fix IOCTRL reg state after s2ram on R-Car E3 Due to an interaction with commit 9f2b76a2db3c4387 ("pinctrl: sh-pfc: r8a77990: Add R8A774C0 PFC support"), the state of the I/O Control Registers is saved/restored during s2ram on RZ/G2E, but not on R-Car E3. Hence on R-Car E3, SDHI voltage state is lost after system resume. Fix this by registering the I/O Control Registers on R-Car E3, too. Fixes: 33847a71373cd6ae ("pinctrl: sh-pfc: r8a77990: Add voltage switch operations for SDHI") Signed-off-by: Geert Uytterhoeven Reviewed-by: Wolfram Sang Reviewed-by: Simon Horman drivers/pinctrl/sh-pfc/pfc-r8a77990.c | 1 + 1 file changed, 1 insertion(+) commit db221412cd2014506642967155698825ad80f6b6 Author: Nicholas Mc Guire Date: Fri Dec 7 11:34:27 2018 +0100 pinctrl: rza1: Handle devm_kasprintf() failure cases devm_kasprintf() may return NULL on failure of internal allocation thus the assignments are not safe if not checked. On error rza1_pinctrl_register() respectively rza1_parse_gpiochip() return negative values so -ENOMEM in the (unlikely) failure case of devm_kasprintf() should be fine here. Signed-off-by: Nicholas Mc Guire Fixes: 5a49b644b307 ("pinctrl: Renesas RZ/A1 pin and gpio controller") Signed-off-by: Geert Uytterhoeven drivers/pinctrl/pinctrl-rza1.c | 5 +++++ 1 file changed, 5 insertions(+) commit 28586a51eea666d5531bcaef2f68e4abbd87242c Author: Alex Hung Date: Tue Dec 18 12:00:54 2018 +0800 ACPI / OSI: Add OEM _OSI string to enable dGPU direct output For HP Inc. mobile workstation with hybrid graphics support, dGPU can directly output to external monitors; however, Nvidia and AMD's Linux drivers aren't able to support this feature. The OEM _OSI string "Linux-HPI-Hybrid-Graphics" is used by BIOS to implement dGPU direct output to external monitors. The form of the OEM _OSI strings is defined by each OEMs and is discussed in Documentation/acpi/osi.txt. Signed-off-by: Alex Hung Signed-off-by: Rafael J. Wysocki drivers/acpi/osi.c | 7 +++++++ 1 file changed, 7 insertions(+) commit f4caa6ee736fa8a46c806ba4382c16f7e5a20248 Author: Geert Uytterhoeven Date: Thu Dec 6 17:30:39 2018 +0100 pinctrl: sh-pfc: r8a77990: Add support for pull-up only pins The R-Car Gen3 HardWare Manual Errata for Rev. 1.00 (Jul 2, 2018) states that the USB30_OVC pin supports pull-up only. It has a bit assigned in the pull-enable register (PUEN5), but not in the pull-up/down control register (PUD5). Add a check for this, to prevent configuring a prohibited setting. Reported-by: Yoshihiro Shimoda Fixes: 83f6941a42a5e773 ("pinctrl: sh-pfc: r8a77990: Add bias pinconf support") Signed-off-by: Geert Uytterhoeven Reviewed-by: Simon Horman drivers/pinctrl/sh-pfc/pfc-r8a77990.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-) commit 7edcbbf29006be46d5dbce5bac9aae73f3056d14 Author: Rafael J. Wysocki Date: Mon Dec 17 12:22:43 2018 +0100 ACPI: PM: Loop in full LPS0 mode only After a previous change, all non-wakeup GPEs are disabled for suspend-to-idle unless full Low-Power S0 (LPS0) mode is in use, so it is not necessary to do anything in acpi_s2idle_wake() unless in full LPS0 mode, which is only when lps0_device_handle is set. Modify the code accordingly. Tested-by: Mika Westerberg Signed-off-by: Rafael J. Wysocki drivers/acpi/sleep.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit f941d3e41da7f86bdb9dcc1977c2bcc6b89bfe47 Author: Rafael J. Wysocki Date: Mon Dec 17 12:21:55 2018 +0100 ACPI: EC / PM: Disable non-wakeup GPEs for suspend-to-idle There are systems in which non-wakeup GPEs fire during the "noirq" suspend stage of suspending devices and that effectively prevents the system that tries to suspend to idle from entering any low-power state at all. If the offending GPE fires regularly and often enough, the system appears to be suspended, but in fact it is in a tight loop over "noirq" suspend and "noirq" resume of devices all the time. To prevent that from happening, disable all non-wakeup GPEs except for the EC GPE for suspend-to-idle (the EC GPE is special, because on some systems it has to be enabled for power button wakeup events to be generated as expected). Fixes: 147a7d9d25ca (ACPI / PM: Do not reconfigure GPEs for suspend-to-idle) Link: https://bugzilla.kernel.org/show_bug.cgi?id=201987 Reported-by: Zhang Rui Tested-by: Mika Westerberg Tested-by: Zhang Rui Signed-off-by: Rafael J. Wysocki drivers/acpi/ec.c | 12 ++++++++++++ drivers/acpi/internal.h | 2 ++ drivers/acpi/sleep.c | 11 +++++++++++ 3 files changed, 25 insertions(+) commit 663546903c835fe46308b1b1e53d32d1f2b33da9 Author: Doug Smythies Date: Mon Dec 17 23:34:04 2018 -0800 tools/power/x86/intel_pstate_tracer: Fix non root execution for post processing a trace file This script is supposed to be allowed to run with regular user privileges if a previously captured trace is being post processed. Commit fbe313884d7d (tools/power/x86/intel_pstate_tracer: Free the trace buffer memory) introduced a bug that breaks that option. Commit 35459105deb2 (tools/power/x86/intel_pstate_tracer: Add optional setting of trace buffer memory allocation) moved the code but kept the bug. This patch fixes the issue. Fixes: 35459105deb2 (tools/power/x86/intel_pstate_tracer: Add optional ...) Signed-off-by: Doug Smythies Signed-off-by: Rafael J. Wysocki tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 67e4eb30ea833e1a97f70e3aba00c6b165fd298c Merge: 7566ec393f41 901d32bc69f3 Author: Rafael J. Wysocki Date: Tue Dec 18 10:32:01 2018 +0100 Merge tag 'linux-cpupower-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux Pull cpupower utility updates for v4.21 from Shuah Khan: "This cpupower update Linux 4.21 adds support for auto-completion for cpupower tool from Abhishek Goel." * tag 'linux-cpupower-4.21-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux: cpupower : Auto-completion for cpupower tool commit 5f30b2e823484ce6a79f2b59901b6351c15effa6 Author: Nicholas Mc Guire Date: Fri Dec 14 17:56:10 2018 +0100 livepatch: check kzalloc return values kzalloc() return should always be checked - notably in example code where this may be seen as reference. On failure of allocation in livepatch_fix1_dummy_alloc() respectively dummy_alloc() previous allocation is freed (thanks to Petr Mladek for catching this) and NULL returned. Signed-off-by: Nicholas Mc Guire Fixes: 439e7271dc2b ("livepatch: introduce shadow variable API") Acked-by: Joe Lawrence Reviewed-by: Petr Mladek Acked-by: Miroslav Benes Signed-off-by: Jiri Kosina samples/livepatch/livepatch-shadow-fix1.c | 5 +++++ samples/livepatch/livepatch-shadow-mod.c | 4 ++++ 2 files changed, 9 insertions(+) commit 8d503f206c336677954160ac62f0c7d9c219cd89 Author: Scott Chen Date: Thu Dec 13 06:01:47 2018 -0500 USB: serial: pl2303: add ids for Hewlett-Packard HP POS pole displays Add device ids to pl2303 for the HP POS pole displays: LM920: 03f0:026b TD620: 03f0:0956 LD960TA: 03f0:4439 LD220TA: 03f0:4349 LM940: 03f0:5039 Signed-off-by: Scott Chen Cc: stable Signed-off-by: Johan Hovold drivers/usb/serial/pl2303.c | 5 +++++ drivers/usb/serial/pl2303.h | 5 +++++ 2 files changed, 10 insertions(+) commit 7aedd9d48f2a8332c2c51a40d2dca8c097f0dcdb Author: Michael Mueller Date: Mon Dec 3 10:20:22 2018 +0100 KVM: s390: fix kmsg component kvm-s390 Relocate #define statement for kvm related kernel messages before the include of printk to become effective. Signed-off-by: Michael Mueller Acked-by: Christian Borntraeger Signed-off-by: Christian Borntraeger arch/s390/kvm/kvm-s390.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit 308c3e6673b012beecb96ef04cc65f4a0e7cdd99 Author: Michael Mueller Date: Fri Nov 30 15:32:06 2018 +0100 KVM: s390: unregister debug feature on failing arch init Make sure the debug feature and its allocated resources get released upon unsuccessful architecture initialization. A related indication of the issue will be reported as kernel message. Signed-off-by: Michael Mueller Reviewed-by: Cornelia Huck Reviewed-by: Pierre Morel Reviewed-by: David Hildenbrand Message-Id: <20181130143215.69496-2-mimu@linux.ibm.com> Signed-off-by: Christian Borntraeger arch/s390/kvm/kvm-s390.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) commit b12c97d45cd061862b79fe02aa41a73d685ec7a1 Author: John Hurley Date: Mon Dec 17 19:18:39 2018 -0800 nfp: flower: fix cb_ident duplicate in indirect block register Previously the identifier used for indirect block callback registry and for block rule cb registry (when done via indirect blocks) was the pointer to the netdev we were interested in receiving updates on. This worked fine if a single app existed that registered one callback per netdev of interest. However, if multiple cards are in place and, in turn, multiple apps, then each app may register the same callback with the same identifier to both the netdev's indirect block cb list and to a block's cb list. This can lead to EEXIST errors and/or incorrect cb deletions. Prevent this conflict by using the app pointer as the identifier for netdev indirect block cb registry, allowing each app to register a unique callback per netdev. For block cb registry, the same app may register multiple cbs to the same block if using TC shared blocks. Instead of the app, use the pointer to the allocated cb_priv data as the identifier here. This means that there can be a unique block callback for each app/netdev combo. Fixes: 3166dd07a9cb ("nfp: flower: offload tunnel decap rules via indirect TC blocks") Reported-by: Edward Cree Signed-off-by: John Hurley Reviewed-by: Jakub Kicinski Signed-off-by: David S. Miller drivers/net/ethernet/netronome/nfp/flower/offload.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) commit d1675a16029610505895b60fc3e96c9dbac02d97 Author: Shalom Toledo Date: Tue Dec 18 07:31:31 2018 +0000 mlxsw: spectrum: Update the supported firmware to version 13.1910.622 This new firmware contains: * New packet traps for discarded packets * Secure firmware flash bug fix * Fence mechanism bug fix * TCAM RMA bug fix Signed-off-by: Shalom Toledo Signed-off-by: Ido Schimmel Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit f5c6dfdefb21708aa0f382c1dc36d4e82c6c3ed5 Author: David Ahern Date: Mon Dec 17 15:36:11 2018 -0800 ip6mr: Drop mfc6_cache argument to ip6mr_forward2 mfc6_cache is not needed by ip6mr_forward2 so drop it from the input argument list. Signed-off-by: David Ahern Signed-off-by: David S. Miller net/ipv6/ip6mr.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit 6e0735d1f7e573da0976d8b7447a82b09d8ec949 Author: David Ahern Date: Mon Dec 17 15:34:48 2018 -0800 ipmr: Drop mfc_cache argument to ipmr_queue_xmit mfc_cache is not needed by ipmr_queue_xmit so drop it from the input argument list. Signed-off-by: David Ahern Signed-off-by: David S. Miller net/ipv4/ipmr.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) commit eedbbb0d98b2a89250a8bb83d9c71b77881e5247 Author: Peter Oskolkov Date: Sun Dec 16 15:42:48 2018 -0800 net: dccp: initialize (addr,port) listening hashtable Commit d9fbc7f6431f "net: tcp: prefer listeners bound to an address" removes port-only listener lookups. This caused segfaults in DCCP lookups because DCCP did not initialize the (addr,port) hashtable. This patch adds said initialization. The only non-trivial issue here is the size of the new hashtable. It seemed reasonable to make it match the size of the port-only hashtable (= INET_LHTABLE_SIZE) that was used previously. Other parameters to inet_hashinfo2_init() match those used in TCP. V2 changes: marked inet_hashinfo2_init as an exported symbol so that DCCP compiles when configured as a module. Tested: syzcaller issues fixed; the second patch in the patchset tests that DCCP lookups work correctly. Fixes: d9fbc7f6431f "net: tcp: prefer listeners bound to an address" Reported-by: syzcaller Signed-off-by: Peter Oskolkov Signed-off-by: David S. Miller net/dccp/proto.c | 3 +++ net/ipv4/inet_hashtables.c | 1 + 2 files changed, 4 insertions(+) commit 6a95147c513190b8932c5ea695cb653272cf2c14 Merge: 11789039da53 56d374624778 Author: David S. Miller Date: Mon Dec 17 23:08:54 2018 -0800 Merge branch 'bnxt_en-next' Michael Chan says: ==================== bnxt_en: Updates for net-next. Two main changes in this seris plus some miscellaneous changes. 1. Improvements and fixes for resource accounting which are required for enabling SR-IOV and RDMA on the new 57500 chips. Only SR-IOV for 57500 chips is enabled in this series. 2. New statistics counters and improvements to keep the basic counters and port counters during IFDOWN. 3. Msic. small changes for ETS, returning proper error codes when flashing NVRAM, and a link speed related fix for ethtool loopback selftest. ==================== Signed-off-by: David S. Miller commit 56d374624778652d2a999e18c87a25338b127b41 Author: Vasundhara Volam Date: Sun Dec 16 18:46:31 2018 -0500 bnxt_en: query force speeds before disabling autoneg mode. With autoneg enabled, PHY loopback test fails. To disable autoneg, driver needs to send a valid forced speed to FW. FW is not sending async event for invalid speeds. To fix this, query forced speeds and send the correct speed when disabling autoneg mode. Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) commit fd3ab1c70e0b953f4f772142051d215bffada718 Author: Michael Chan Date: Sun Dec 16 18:46:30 2018 -0500 bnxt_en: Do not free port statistics buffer when device is down. Port statistics which include RDMA counters are useful even when the netdevice is down. Do not free the port statistics DMA buffers when the netdevice is down. This is keep the snapshot of the port statistics and counters will just continue counting when the netdevice goes back up. Split the bnxt_free_stats() function into 2 functions. The port statistics buffers will only be freed when the netdevice is removed. Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 23 ++++++++++++++++++++--- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 7 +++++-- 2 files changed, 25 insertions(+), 5 deletions(-) commit b8875ca356f1c0b17ec68be6666269373a62288e Author: Michael Chan Date: Sun Dec 16 18:46:29 2018 -0500 bnxt_en: Save ring statistics before reset. With the current driver, the statistics reported by .ndo_get_stats64() are reset when the device goes down. Store a snapshot of the rtnl_link_stats64 before shutdown. This snapshot is added to the current counters in .ndo_get_stats64() so that the counters will not get reset when the device is down. Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 57 +++++++++++++++++++++++-------- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + 2 files changed, 44 insertions(+), 14 deletions(-) commit 7c675421afef18253a86ffc383f57bc15ef32ea8 Author: Vasundhara Volam Date: Sun Dec 16 18:46:28 2018 -0500 bnxt_en: Return linux standard errors in bnxt_ethtool.c Currently firmware specific errors are returned directly in flash_device and reset ethtool hooks. Modify it to return linux standard errors to userspace when flashing operations fail. Signed-off-by: Vasundhara Volam Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 56 ++++++++++++++++------- 1 file changed, 39 insertions(+), 17 deletions(-) commit 24654f095ed68eafcdfdbfccbe6324ad1475c1bb Author: Michael Chan Date: Sun Dec 16 18:46:27 2018 -0500 bnxt_en: Don't set ETS on unused TCs. Currently, the code allows ETS bandwidth weight 0 to be set on unused TCs. We should not set any DCB parameters on unused TCs at all. Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit e37fed790335631c57477e7bee952a039ccb7a50 Author: Michael Chan Date: Sun Dec 16 18:46:26 2018 -0500 bnxt_en: Add ethtool -S priority counters. Display the CoS counters as additional priority counters by looking up the priority to CoS queue mapping. If the TX extended port statistics block size returned by firmware is big enough to cover the CoS counters, then we will display the new priority counters. We call firmware to get the up-to-date pri2cos mapping to convert the CoS counters to priority counters. Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 29 ++++++ drivers/net/ethernet/broadcom/bnxt/bnxt.h | 2 + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 114 +++++++++++++++++++++- 3 files changed, 144 insertions(+), 1 deletion(-) commit b16b68918674af5e7beccb567fe7ebd8b44744b8 Author: Michael Chan Date: Sun Dec 16 18:46:25 2018 -0500 bnxt_en: Add SR-IOV support for 57500 chips. There are some minor differences when assigning VF resources on the new chips. The MSIX (NQ) resource has to be assigned and ring group is not needed on the new chips. Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bn