commit 6f7da290413ba713f0cdd9ff1a2a9bb129ef4f6c Author: Linus Torvalds Date: Sun Jul 2 16:07:02 2017 -0700 Linux 4.12 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 401e000ab90d7b81d8ea0735e3ff909548754876 Author: Sylvain 'ythier' Hitier Date: Sun Jul 2 15:21:56 2017 +0200 moduleparam: fix doc: hwparam_irq configures an IRQ Signed-off-by: Sylvain 'ythier' Hitier Signed-off-by: Linus Torvalds include/linux/moduleparam.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 79c496816963aa0561868b43c2c950dfeb282639 Merge: 3a61a54 8542363 Author: Linus Torvalds Date: Sun Jul 2 11:53:44 2017 -0700 Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus Pull MIPS fixes from Ralf Baechle: "Here's a final round of fixes for 4.12: - Fix misordered instructions in assembly code making kenel startup via UHB unreliable. - Fix special case of MADDF and MADDF emulation. - Fix alignment issue in address calculation in pm-cps on 64 bit. - Fix IRQ tracing & lockdep when rescheduling - Systems with MAARs require post-DMA cache flushes. The reordering fix and the MADDF/MSUBF fix have sat in linux-next for a number of days. The others haven't propagated from my pull tree to linux-next yet but all have survived manual testing and Imagination's automated test system and there are no pending bug reports" * 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus: MIPS: Avoid accidental raw backtrace MIPS: Perform post-DMA cache flushes on systems with MAARs MIPS: Fix IRQ tracing & lockdep when rescheduling MIPS: pm-cps: Drop manual cache-line alignment of ready_count MIPS: math-emu: Handle zero accumulator case in MADDF and MSUBF separately MIPS: head: Reorder instructions missing a delay slot commit 3a61a54cd72c93afa3b7246e3ed06f26ed37fde7 Merge: e18aca0 9e25ebf Author: Linus Torvalds Date: Sun Jul 2 10:09:40 2017 -0700 Merge branch 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM fix from Russell King: "One final fix for 4.12 - Doug found a boot failure case triggered by requesting a non-even MB vmalloc size" * 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm: ARM: 8685/1: ensure memblock-limit is pmd-aligned commit e18aca0236a2dac4a134ace4685e97ad09d3605b Merge: a527bf6 79298ac Author: Linus Torvalds Date: Sat Jul 1 09:10:17 2017 -0700 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Thomas Gleixner: "Fixlets for x86: - Prevent kexec crash when KASLR is enabled, which was caused by an address calculation bug - Restore the freeing of PUDs on memory hot remove - Correct a negated pointer check in the intel uncore performance monitoring driver - Plug a memory leak in an error exit path in the RDT code" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/intel_rdt: Fix memory leak on mount failure x86/boot/KASLR: Fix kexec crash due to 'virt_addr' calculation bug x86/boot/KASLR: Add checking for the offset of kernel virtual address randomization perf/x86/intel/uncore: Fix wrong box pointer check x86/mm/hotplug: Fix BUG_ON() after hot-remove by not freeing PUD commit a527bf61404cd36fedd81dc165a03b6f5529092e Merge: 46589d7 e3c2c4f Author: Linus Torvalds Date: Sat Jul 1 08:46:52 2017 -0700 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fix from Thomas Gleixner: "The last fix for perf for this cycles: - Prevent a segfault when kernel.kptr_restrict=2 is set by avoiding a null pointer dereference" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf machine: Fix segfault for kernel.kptr_restrict=2 commit 46589d7ab79a4b5f4d3183fafe1c8fb011f82210 Merge: fc93274 1d80df9 Author: Linus Torvalds Date: Sat Jul 1 08:39:13 2017 -0700 Merge tag 'pinctrl-v4.12-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pinctrl fix from Linus Walleij: "Brian noticed that this regression has not got a proper fix for the entire merge window and consequently we need to revert the offending commit. It's part of the RT-mainstream work, the dance goes like this, two steps forward, one step back. Summary: - A last fix for v4.12, an IRQ problem reported early in the merge window appears not to have been properly fixed, so the offending commit will be reverted and we will find the proper fix for v4.13. Hopefully" * tag 'pinctrl-v4.12-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: Revert "pinctrl: rockchip: avoid hardirq-unsafe functions in irq_chip" commit fc93274ab5a455b1e31aea5d2c9e8ba1f699fded Merge: c0a0c7a c06632e Author: Linus Torvalds Date: Sat Jul 1 08:24:54 2017 -0700 Merge tag 'gpio-v4.12-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull last minute fixes for GPIO from Linus Walleij: - Fix another ACPI problem with broken BIOSes. - Filter out the right GPIO events, making a very user-visible bug go away. * tag 'gpio-v4.12-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: gpio: acpi: Skip _AEI entries without a handler rather then aborting the scan gpiolib: fix filtering out unwanted events commit c0a0c7a4e1200bfea439b9444e6d6b4bede9db23 Merge: fbd57629 9e52b32 Author: Linus Torvalds Date: Fri Jun 30 17:18:57 2017 -0700 Merge tag 'trace-v4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull last-minute tracing fixes from Steven Rostedt: "Two fixes: One is for a crash when using the :mod: trace probe command into stack_trace_filter. This bug was introduced during the last merge window. The other was there forever. It's a small bug that makes it impossible to name a module function for kprobes when the module starts with a digit" * tag 'trace-v4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing/kprobes: Allow to create probe with a module name starting with a digit ftrace: Fix regression with module command in stack_trace_filter commit fbd576295d6f98b20356d1e6efbc8f976b17c8af Author: Zack Weinberg Date: Wed Jun 14 08:14:28 2017 -0700 uapi/linux/a.out.h: don't use deprecated system-specific predefines. uapi/linux/a.out.h uses a number of predefined macros that are deprecated because they're in the application namespace (e.g. '#ifdef linux' instead of '#ifdef __linux__'). This patch either corrects or just removes them if they are not applicable to Linux. The primary reason this is worth bothering to fix, considering how obsolete a.out binary support is, is that the GCC build process considers this such a severe error that it will copy the header into a private directory and change the macro names, which causes future updates to the header to be masked. This header probably doesn't get updated very often anymore, but it is the _only_ uapi header that gets this treatment, so IMHO it is worth patching just to drive that number all the way to zero. Signed-off-by: Zack Weinberg [hch: removed dead conditionals] Signed-off-by: Christoph Hellwig Signed-off-by: Linus Torvalds include/uapi/linux/a.out.h | 26 +------------------------- 1 file changed, 1 insertion(+), 25 deletions(-) commit dbd1877754338dc98818d200cd25cf398d8b5d9e Author: Jakub Kicinski Date: Wed Jun 28 21:25:48 2017 -0700 hashtable: remove repeated phrase from a comment "in a rcu enabled hashtable" is repeated twice in a comment. Signed-off-by: Jakub Kicinski Signed-off-by: Linus Torvalds include/linux/hashtable.h | 1 - 1 file changed, 1 deletion(-) commit 79298acc4ba097e9ab78644e3e38902d73547c92 Author: Vikas Shivappa Date: Mon Jun 26 11:55:49 2017 -0700 x86/intel_rdt: Fix memory leak on mount failure If mount fails, the kn_info directory is not freed causing memory leak. Add the missing error handling path. Fixes: 4e978d06dedb ("x86/intel_rdt: Add "info" files to resctrl file system") Signed-off-by: Vikas Shivappa Signed-off-by: Thomas Gleixner Cc: ravi.v.shankar@intel.com Cc: tony.luck@intel.com Cc: fenghua.yu@intel.com Cc: peterz@infradead.org Cc: vikas.shivappa@intel.com Cc: andi.kleen@intel.com Cc: stable@vger.kernel.org Link: http://lkml.kernel.org/r/1498503368-20173-3-git-send-email-vikas.shivappa@linux.intel.com arch/x86/kernel/cpu/intel_rdt_rdtgroup.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit b4df2e3537bef7d867338063da56b557c50f68f2 Merge: 27ab862 d6bd819 Author: Linus Torvalds Date: Fri Jun 30 10:55:34 2017 -0700 Merge tag 'powerpc-4.12-8' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: "Hopefully the last two powerpc fixes for 4.12. The CXL one is larger than I'd usually send at rc7, but it fixes new code this cycle, so better to have it working for the release. It was actually sent a few weeks back but got blocked in testing behind another fix that was causing issues. We are still tracking one crash in v4.12-rc7, but only one person has reproduced it and the commit identified by bisect doesn't touch any of the relevant code, so I think it's 50/50 whether that commit is actually the problem or it's some code layout / toolchain issue. Two fixes for code we merged this cycle: - cxl: Fixes for Coherent Accelerator Interface Architecture 2.0 - Avoid miscompilation w/GCC 4.6.3 on 32-bit - don't inline copy_to/from_user() Thanks to Al Viro, Larry Finger, Christophe Lombard" * tag 'powerpc-4.12-8' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/32: Avoid miscompilation w/GCC 4.6.3 - don't inline copy_to/from_user() cxl: Fixes for Coherent Accelerator Interface Architecture 2.0 commit 27ab862a3afdd7a0285b69a7475f8af7bd2434c4 Merge: 4adc6b9 84a21db Author: Linus Torvalds Date: Fri Jun 30 10:37:48 2017 -0700 Merge tag 'iommu-fixes-v4.12-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull IOMMU fixes from Joerg Roedel: "Two fixes: - A fix for AMD IOMMU interrupt remapping code when IRQs are forwarded directly to KVM guests - Fixed check in the recently merged code to allow tboot with Intel VT-d disabled" * tag 'iommu-fixes-v4.12-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/amd: Fix interrupt remapping when disable guest_mode iommu/vt-d: Correctly disable Intel IOMMU force on commit 4adc6b9382d5a2c1f39fa44b1e6ff29467e844e5 Merge: 86c3e00 d94815f Author: Linus Torvalds Date: Fri Jun 30 10:30:26 2017 -0700 Merge tag 'sound-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Two last-minute HD-audio fixes" * tag 'sound-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda - Fix endless loop of codec configure ALSA: hda - set input_path bitmap to zero after moving it to new place commit 86c3e00afd64a507aef954cd581547f28807e51a Merge: 4d8a991 fbaf94e Author: Linus Torvalds Date: Fri Jun 30 10:22:59 2017 -0700 Merge branch 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs Pull overlayfs fixes from Miklos Szeredi: "Fix two bugs in copy-up code. One introduced in 4.11 and one in 4.12-rc" * 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs: ovl: don't set origin on broken lower hardlink ovl: copy-up: don't unlock between lookup and link commit 8eabf42ae5237e6b699aeac687b5b629e3537c8d Author: Baoquan He Date: Tue Jun 27 20:39:06 2017 +0800 x86/boot/KASLR: Fix kexec crash due to 'virt_addr' calculation bug Kernel text KASLR is separated into physical address and virtual address randomization. And for virtual address randomization, we only randomiza to get an offset between 16M and KERNEL_IMAGE_SIZE. So the initial value of 'virt_addr' should be LOAD_PHYSICAL_ADDR, but not the original kernel loading address 'output'. The bug will cause kernel boot failure if kernel is loaded at a different position than the address, 16M, which is decided at compiled time. Kexec/kdump is such practical case. To fix it, just assign LOAD_PHYSICAL_ADDR to virt_addr as initial value. Tested-by: Dave Young Signed-off-by: Baoquan He Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Fixes: 8391c73 ("x86/KASLR: Randomize virtual address separately") Link: http://lkml.kernel.org/r/1498567146-11990-3-git-send-email-bhe@redhat.com Signed-off-by: Ingo Molnar arch/x86/boot/compressed/kaslr.c | 3 --- arch/x86/boot/compressed/misc.c | 4 ++-- arch/x86/boot/compressed/misc.h | 2 -- 3 files changed, 2 insertions(+), 7 deletions(-) commit b892cb873ced2af57dc5a018557d128c53ed6ae0 Author: Baoquan He Date: Tue Jun 27 20:39:05 2017 +0800 x86/boot/KASLR: Add checking for the offset of kernel virtual address randomization For kernel text KASLR, the virtual address is confined to area of 1G, [0xffffffff80000000, 0xffffffffc0000000). For the implemenataion of virtual address randomization, we only randomize to get an offset between 16M and 1G, then add this offset to the starting address, 0xffffffff80000000. Here 16M is the offset which is decided at linking stage. So the amount of the local variable 'virt_addr' which respresents the offset plus the kernel output size can not exceed KERNEL_IMAGE_SIZE. Add a debug check for the offset. If out of bounds, print error message and hang there. Suggested-by: Ingo Molnar Signed-off-by: Baoquan He Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/1498567146-11990-2-git-send-email-bhe@redhat.com Signed-off-by: Ingo Molnar arch/x86/boot/compressed/misc.c | 2 ++ 1 file changed, 2 insertions(+) commit 9e52b32567126fe146f198971364f68d3bc5233f Author: Sabrina Dubroca Date: Thu Jun 22 11:24:42 2017 +0200 tracing/kprobes: Allow to create probe with a module name starting with a digit Always try to parse an address, since kstrtoul() will safely fail when given a symbol as input. If that fails (which will be the case for a symbol), try to parse a symbol instead. This allows creating a probe such as: p:probe/vlan_gro_receive 8021q:vlan_gro_receive+0 Which is necessary for this command to work: perf probe -m 8021q -a vlan_gro_receive Link: http://lkml.kernel.org/r/fd72d666f45b114e2c5b9cf7e27b91de1ec966f1.1498122881.git.sd@queasysnail.net Cc: stable@vger.kernel.org Fixes: 413d37d1e ("tracing: Add kprobe-based event tracer") Acked-by: Masami Hiramatsu Signed-off-by: Sabrina Dubroca Signed-off-by: Steven Rostedt (VMware) kernel/trace/trace_kprobe.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) commit 854236363370995a609a10b03e35fd3dc5e9e4a1 Author: James Hogan Date: Thu Jun 29 15:05:04 2017 +0100 MIPS: Avoid accidental raw backtrace Since commit 81a76d7119f6 ("MIPS: Avoid using unwind_stack() with usermode") show_backtrace() invokes the raw backtracer when cp0_status & ST0_KSU indicates user mode to fix issues on EVA kernels where user and kernel address spaces overlap. However this is used by show_stack() which creates its own pt_regs on the stack and leaves cp0_status uninitialised in most of the code paths. This results in the non deterministic use of the raw back tracer depending on the previous stack content. show_stack() deals exclusively with kernel mode stacks anyway, so explicitly initialise regs.cp0_status to KSU_KERNEL (i.e. 0) to ensure we get a useful backtrace. Fixes: 81a76d7119f6 ("MIPS: Avoid using unwind_stack() with usermode") Signed-off-by: James Hogan Cc: linux-mips@linux-mips.org Cc: # 3.15+ Patchwork: https://patchwork.linux-mips.org/patch/16656/ Signed-off-by: Ralf Baechle arch/mips/kernel/traps.c | 2 ++ 1 file changed, 2 insertions(+) commit cad482c1b1844136fc6d9e33f10d3386344fb045 Author: Paul Burton Date: Tue Jun 13 10:01:08 2017 -0700 MIPS: Perform post-DMA cache flushes on systems with MAARs Recent CPUs from Imagination Technologies such as the I6400 or P6600 are able to speculatively fetch data from memory into caches. This means that if used in a system with non-coherent DMA they require that caches be invalidated after a device performs DMA, and before the CPU reads the DMA'd data, in order to ensure that stale values weren't speculatively prefetched. Such CPUs also introduced Memory Accessibility Attribute Registers (MAARs) in order to control the regions in which they are allowed to speculate. Thus we can use the presence of MAARs as a good indication that the CPU requires the above cache maintenance. Use the presence of MAARs to determine the result of cpu_needs_post_dma_flush() in the default case, in order to handle these recent CPUs correctly. Note that the return type of cpu_needs_post_dma_flush() is changed to bool, such that it's clearer what's happening when cpu_has_maar is cast to bool for the return value. If this patch were backported to a pre-v4.7 kernel then MIPS_CPU_MAAR was 1ull<<34, so when cast to an int we would incorrectly return 0. It so happens that MIPS_CPU_MAAR is currently 1ull<<30, so when truncated to an int gives a non-zero value anyway, but even so the implicit conversion from long long int to bool makes it clearer to understand what will happen than the implicit conversion from long long int to int would. The bool return type also fits this usage better semantically, so seems like an all-round win. Thanks to Ed for spotting the issue for pre-v4.7 kernels & suggesting the return type change. Signed-off-by: Paul Burton Reviewed-by: Bryan O'Donoghue Tested-by: Bryan O'Donoghue Cc: Ed Blake Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/16363/ Signed-off-by: Ralf Baechle arch/mips/mm/dma-default.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-) commit d8550860d910c6b7b70f830f59003b33daaa52c9 Author: Paul Burton Date: Fri Mar 3 15:26:05 2017 -0800 MIPS: Fix IRQ tracing & lockdep when rescheduling When the scheduler sets TIF_NEED_RESCHED & we call into the scheduler from arch/mips/kernel/entry.S we disable interrupts. This is true regardless of whether we reach work_resched from syscall_exit_work, resume_userspace or by looping after calling schedule(). Although we disable interrupts in these paths we don't call trace_hardirqs_off() before calling into C code which may acquire locks, and we therefore leave lockdep with an inconsistent view of whether interrupts are disabled or not when CONFIG_PROVE_LOCKING & CONFIG_DEBUG_LOCKDEP are both enabled. Without tracing this interrupt state lockdep will print warnings such as the following once a task returns from a syscall via syscall_exit_partial with TIF_NEED_RESCHED set: [ 49.927678] ------------[ cut here ]------------ [ 49.934445] WARNING: CPU: 0 PID: 1 at kernel/locking/lockdep.c:3687 check_flags.part.41+0x1dc/0x1e8 [ 49.946031] DEBUG_LOCKS_WARN_ON(current->hardirqs_enabled) [ 49.946355] CPU: 0 PID: 1 Comm: init Not tainted 4.10.0-00439-gc9fd5d362289-dirty #197 [ 49.963505] Stack : 0000000000000000 ffffffff81bb5d6a 0000000000000006 ffffffff801ce9c4 [ 49.974431] 0000000000000000 0000000000000000 0000000000000000 000000000000004a [ 49.985300] ffffffff80b7e487 ffffffff80a24498 a8000000ff160000 ffffffff80ede8b8 [ 49.996194] 0000000000000001 0000000000000000 0000000000000000 0000000077c8030c [ 50.007063] 000000007fd8a510 ffffffff801cd45c 0000000000000000 a8000000ff127c88 [ 50.017945] 0000000000000000 ffffffff801cf928 0000000000000001 ffffffff80a24498 [ 50.028827] 0000000000000000 0000000000000001 0000000000000000 0000000000000000 [ 50.039688] 0000000000000000 a8000000ff127bd0 0000000000000000 ffffffff805509bc [ 50.050575] 00000000140084e0 0000000000000000 0000000000000000 0000000000040a00 [ 50.061448] 0000000000000000 ffffffff8010e1b0 0000000000000000 ffffffff805509bc [ 50.072327] ... [ 50.076087] Call Trace: [ 50.079869] [] show_stack+0x80/0xa8 [ 50.086577] [] dump_stack+0x10c/0x190 [ 50.093498] [] __warn+0xf0/0x108 [ 50.099889] [] warn_slowpath_fmt+0x3c/0x48 [ 50.107241] [] check_flags.part.41+0x1dc/0x1e8 [ 50.114961] [] lock_is_held_type+0x8c/0xb0 [ 50.122291] [] __schedule+0x8c0/0x10f8 [ 50.129221] [] schedule+0x30/0x98 [ 50.135659] [] work_resched+0x8/0x34 [ 50.142397] ---[ end trace 0cb4f6ef5b99fe21 ]--- [ 50.148405] possible reason: unannotated irqs-off. [ 50.154600] irq event stamp: 400463 [ 50.159566] hardirqs last enabled at (400463): [] _raw_spin_unlock_irqrestore+0x40/0xa8 [ 50.171981] hardirqs last disabled at (400462): [] _raw_spin_lock_irqsave+0x30/0xb0 [ 50.183897] softirqs last enabled at (400450): [] __do_softirq+0x4ac/0x6a8 [ 50.195015] softirqs last disabled at (400425): [] irq_exit+0x110/0x128 Fix this by using the TRACE_IRQS_OFF macro to call trace_hardirqs_off() when CONFIG_TRACE_IRQFLAGS is enabled. This is done before invoking schedule() following the work_resched label because: 1) Interrupts are disabled regardless of the path we take to reach work_resched() & schedule(). 2) Performing the tracing here avoids the need to do it in paths which disable interrupts but don't call out to C code before hitting a path which uses the RESTORE_SOME macro that will call trace_hardirqs_on() or trace_hardirqs_off() as appropriate. We call trace_hardirqs_on() using the TRACE_IRQS_ON macro before calling syscall_trace_leave() for similar reasons, ensuring that lockdep has a consistent view of state after we re-enable interrupts. Signed-off-by: Paul Burton Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: linux-mips@linux-mips.org Cc: stable Patchwork: https://patchwork.linux-mips.org/patch/15385/ Signed-off-by: Ralf Baechle arch/mips/kernel/entry.S | 3 +++ 1 file changed, 3 insertions(+) commit 161c51ccb7a6faf45ffe09aa5cf1ad85ccdad503 Author: Paul Burton Date: Thu Mar 2 14:02:40 2017 -0800 MIPS: pm-cps: Drop manual cache-line alignment of ready_count We allocate memory for a ready_count variable per-CPU, which is accessed via a cached non-coherent TLB mapping to perform synchronisation between threads within the core using LL/SC instructions. In order to ensure that the variable is contained within its own data cache line we allocate 2 lines worth of memory & align the resulting pointer to a line boundary. This is however unnecessary, since kmalloc is guaranteed to return memory which is at least cache-line aligned (see ARCH_DMA_MINALIGN). Stop the redundant manual alignment. Besides cleaning up the code & avoiding needless work, this has the side effect of avoiding an arithmetic error found by Bryan on 64 bit systems due to the 32 bit size of the former dlinesz. This led the ready_count variable to have its upper 32b cleared erroneously for MIPS64 kernels, causing problems when ready_count was later used on MIPS64 via cpuidle. Signed-off-by: Paul Burton Fixes: 3179d37ee1ed ("MIPS: pm-cps: add PM state entry code for CPS systems") Reported-by: Bryan O'Donoghue Reviewed-by: Bryan O'Donoghue Tested-by: Bryan O'Donoghue Cc: linux-mips@linux-mips.org Cc: stable # v3.16+ Patchwork: https://patchwork.linux-mips.org/patch/15383/ Signed-off-by: Ralf Baechle arch/mips/kernel/pm-cps.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) commit 9e25ebfe56ece7541cd10a20d715cbdd148a2e06 Author: Doug Berger Date: Thu Jun 29 18:41:36 2017 +0100 ARM: 8685/1: ensure memblock-limit is pmd-aligned The pmd containing memblock_limit is cleared by prepare_page_table() which creates the opportunity for early_alloc() to allocate unmapped memory if memblock_limit is not pmd aligned causing a boot-time hang. Commit 965278dcb8ab ("ARM: 8356/1: mm: handle non-pmd-aligned end of RAM") attempted to resolve this problem, but there is a path through the adjust_lowmem_bounds() routine where if all memory regions start and end on pmd-aligned addresses the memblock_limit will be set to arm_lowmem_limit. Since arm_lowmem_limit can be affected by the vmalloc early parameter, the value of arm_lowmem_limit may not be pmd-aligned. This commit corrects this oversight such that memblock_limit is always rounded down to pmd-alignment. Fixes: 965278dcb8ab ("ARM: 8356/1: mm: handle non-pmd-aligned end of RAM") Signed-off-by: Doug Berger Suggested-by: Mark Rutland Signed-off-by: Russell King arch/arm/mm/mmu.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 4d8a991d460d4fa4829beaffdcba45a217ca0fa7 Merge: 27bc344 d58299a Author: Linus Torvalds Date: Thu Jun 29 14:30:07 2017 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) Need to access netdev->num_rx_queues behind an accessor in netvsc driver otherwise the build breaks with some configs, from Arnd Bergmann. 2) Add dummy xfrm_dev_event() so that build doesn't fail when CONFIG_XFRM_OFFLOAD is not set. From Hangbin Liu. 3) Don't OOPS when pfkey_msg2xfrm_state() signals an erros, from Dan Carpenter. 4) Fix MCDI command size for filter operations in sfc driver, from Martin Habets. 5) Fix UFO segmenting so that we don't calculate incorrect checksums, from Michal Kubecek. 6) When ipv6 datagram connects fail, reset destination address and port. From Wei Wang. 7) TCP disconnect must reset the cached receive DST, from WANG Cong. 8) Fix sign extension bug on 32-bit in dev_get_stats(), from Eric Dumazet. 9) fman driver has to depend on HAS_DMA, from Madalin Bucur. 10) Fix bpf pointer leak with xadd in verifier, from Daniel Borkmann. 11) Fix negative page counts with GFO, from Michal Kubecek. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (41 commits) sfc: fix attempt to translate invalid filter ID net: handle NAPI_GRO_FREE_STOLEN_HEAD case also in napi_frags_finish() bpf: prevent leaking pointer via xadd on unpriviledged arcnet: com20020-pci: add missing pdev setup in netdev structure arcnet: com20020-pci: fix dev_id calculation arcnet: com20020: remove needless base_addr assignment Trivial fix to spelling mistake in arc_printk message arcnet: change irq handler to lock irqsave rocker: move dereference before free mlxsw: spectrum_router: Fix NULL pointer dereference net: sched: Fix one possible panic when no destroy callback virtio-net: serialize tx routine during reset net: usb: asix88179_178a: Add support for the Belkin B2B128 fsl/fman: add dependency on HAS_DMA net: prevent sign extension in dev_get_stats() tcp: reset sk_rx_dst in tcp_disconnect() net: ipv6: reset daddr and dport in sk if connect() fails bnx2x: Don't log mc removal needlessly bnxt_en: Fix netpoll handling. bnxt_en: Add missing logic to handle TPA end error conditions. ... commit 27bc344014289a298a9fad4b828fcf61daa60aff Merge: 374bf88 00a0ea3 Author: Linus Torvalds Date: Thu Jun 29 14:23:02 2017 -0700 Merge tag 'for-4.12/dm-fixes-5' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: - dm thinp fix for crash that will occur when metadata device failure races with discard passdown to the underlying data device. - dm raid fix to not access the superblock's >= 1.9.0 'sectors' member unconditionally. * tag 'for-4.12/dm-fixes-5' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm thin: do not queue freed thin mapping for next stage processing dm raid: fix oops on upgrading to extended superblock format commit 374bf8831aa99a445d6d26c56a65fb35db747d91 Merge: 6474924 9ae3b3f Author: Linus Torvalds Date: Thu Jun 29 14:10:37 2017 -0700 Merge branch 'for-linus' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "Two fixes that should go into this release. One is an nvme regression fix from Keith, fixing a missing queue freeze if the controller is being reset. This causes the reset to hang. The other is a fix for a leak of the bio protection info, if smaller sized O_DIRECT is used. This fix should be more involved as we have other problematic paths in the kernel, but given as this isn't a regression in this series, we'll tackle those for 4.13" * 'for-linus' of git://git.kernel.dk/linux-block: block: provide bio_uninit() free freeing integrity/task associations nvme/pci: Fix stuck nvme reset commit d58299a478c416c0b48e4b31c6332fe7beb63000 Author: Edward Cree Date: Thu Jun 29 16:50:06 2017 +0100 sfc: fix attempt to translate invalid filter ID When filter insertion fails with no rollback, we were trying to convert EFX_EF10_FILTER_ID_INVALID to an id to store in 'ids' (which is either vlan->uc or vlan->mc). This would WARN_ON_ONCE and then record a bogus filter ID of 0x1fff, neither of which is a good thing. Fixes: 0ccb998bf46d ("sfc: fix filter_id misinterpretation in edge case") Signed-off-by: Edward Cree Signed-off-by: David S. Miller drivers/net/ethernet/sfc/ef10.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit e44699d2c28067f69698ccb68dd3ddeacfebc434 Author: Michal Kubeček Date: Thu Jun 29 11:13:36 2017 +0200 net: handle NAPI_GRO_FREE_STOLEN_HEAD case also in napi_frags_finish() Recently I started seeing warnings about pages with refcount -1. The problem was traced to packets being reused after their head was merged into a GRO packet by skb_gro_receive(). While bisecting the issue pointed to commit c21b48cc1bbf ("net: adjust skb->truesize in ___pskb_trim()") and I have never seen it on a kernel with it reverted, I believe the real problem appeared earlier when the option to merge head frag in GRO was implemented. Handling NAPI_GRO_FREE_STOLEN_HEAD state was only added to GRO_MERGED_FREE branch of napi_skb_finish() so that if the driver uses napi_gro_frags() and head is merged (which in my case happens after the skb_condense() call added by the commit mentioned above), the skb is reused including the head that has been merged. As a result, we release the page reference twice and eventually end up with negative page refcount. To fix the problem, handle NAPI_GRO_FREE_STOLEN_HEAD in napi_frags_finish() the same way it's done in napi_skb_finish(). Fixes: d7e8883cfcf4 ("net: make GRO aware of skb->head_frag") Signed-off-by: Michal Kubecek Signed-off-by: David S. Miller net/core/dev.c | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) commit 6bdf6abc56b53103324dfd270a86580306e1a232 Author: Daniel Borkmann Date: Thu Jun 29 03:04:59 2017 +0200 bpf: prevent leaking pointer via xadd on unpriviledged Leaking kernel addresses on unpriviledged is generally disallowed, for example, verifier rejects the following: 0: (b7) r0 = 0 1: (18) r2 = 0xffff897e82304400 3: (7b) *(u64 *)(r1 +48) = r2 R2 leaks addr into ctx Doing pointer arithmetic on them is also forbidden, so that they don't turn into unknown value and then get leaked out. However, there's xadd as a special case, where we don't check the src reg for being a pointer register, e.g. the following will pass: 0: (b7) r0 = 0 1: (7b) *(u64 *)(r1 +48) = r0 2: (18) r2 = 0xffff897e82304400 ; map 4: (db) lock *(u64 *)(r1 +48) += r2 5: (95) exit We could store the pointer into skb->cb, loose the type context, and then read it out from there again to leak it eventually out of a map value. Or more easily in a different variant, too: 0: (bf) r6 = r1 1: (7a) *(u64 *)(r10 -8) = 0 2: (bf) r2 = r10 3: (07) r2 += -8 4: (18) r1 = 0x0 6: (85) call bpf_map_lookup_elem#1 7: (15) if r0 == 0x0 goto pc+3 R0=map_value(ks=8,vs=8,id=0),min_value=0,max_value=0 R6=ctx R10=fp 8: (b7) r3 = 0 9: (7b) *(u64 *)(r0 +0) = r3 10: (db) lock *(u64 *)(r0 +0) += r6 11: (b7) r0 = 0 12: (95) exit from 7 to 11: R0=inv,min_value=0,max_value=0 R6=ctx R10=fp 11: (b7) r0 = 0 12: (95) exit Prevent this by checking xadd src reg for pointer types. Also add a couple of test cases related to this. Fixes: 1be7f75d1668 ("bpf: enable non-root eBPF programs") Fixes: 17a5267067f3 ("bpf: verifier (add verifier core)") Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Acked-by: Martin KaFai Lau Acked-by: Edward Cree Signed-off-by: David S. Miller kernel/bpf/verifier.c | 5 +++ tools/testing/selftests/bpf/test_verifier.c | 66 +++++++++++++++++++++++++++++ 2 files changed, 71 insertions(+) commit 80c65fdb4c6920e332a9781a3de5877594b07522 Author: Kan Liang Date: Thu Jun 29 12:09:26 2017 -0700 perf/x86/intel/uncore: Fix wrong box pointer check Should not init a NULL box. It will cause system crash. The issue looks like caused by a typo. This was not noticed because there is no NULL box. Also, for most boxes, they are enabled by default. The init code is not critical. Fixes: fff4b87e594a ("perf/x86/intel/uncore: Make package handling more robust") Signed-off-by: Kan Liang Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: http://lkml.kernel.org/r/20170629190926.2456-1-kan.liang@intel.com arch/x86/events/intel/uncore.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 00778f7cadd393630a23e83ffaf60b70fe460879 Merge: acb4b7d 2a0ea04 Author: David S. Miller Date: Thu Jun 29 15:18:38 2017 -0400 Merge branch 'arcnet-fixes' Michael Grzeschik says: ==================== arcnet: Collection of latest fixes Here we sum up the recent fixes I collected on the way to use and stabilise the framework. Part of it is an possible deadlock that we prevent as well to fix the calculation of the dev_id that can be setup by an rotary encoder. Beside that we added an trivial spelling patch and fix some wrong and missing assignments that improves the code footprint. ==================== Signed-off-by: David S. Miller commit 2a0ea04c83ab82c3852c9171d2fa5cd9a1432c9b Author: Michael Grzeschik Date: Wed Jun 28 18:28:37 2017 +0200 arcnet: com20020-pci: add missing pdev setup in netdev structure We add the pdev data to the pci devices netdev structure. This way the interface get consistent device names in the userspace (udev). Signed-off-by: Michael Grzeschik Signed-off-by: David S. Miller drivers/net/arcnet/com20020-pci.c | 1 + 1 file changed, 1 insertion(+) commit cb108619f2fc77846bf7a7543517f3487f455b24 Author: Michael Grzeschik Date: Wed Jun 28 18:28:36 2017 +0200 arcnet: com20020-pci: fix dev_id calculation The dev_id was miscalculated. Only the two bits 4-5 are relevant for the MA1 card. PCIARC1 and PCIFB2 use the four bits 4-7 for id selection. Signed-off-by: Michael Grzeschik Signed-off-by: David S. Miller drivers/net/arcnet/com20020-pci.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 0d494fcf867f95040b5b67e4bc5af739bcda37da Author: Michael Grzeschik Date: Wed Jun 28 18:28:35 2017 +0200 arcnet: com20020: remove needless base_addr assignment The assignment is superfluous. Signed-off-by: Michael Grzeschik Signed-off-by: David S. Miller drivers/net/arcnet/com20020.c | 2 -- 1 file changed, 2 deletions(-) commit 06908d7aee8d62a80cabfd134d0354dc4d2794bc Author: Colin Ian King Date: Wed Jun 28 18:28:34 2017 +0200 Trivial fix to spelling mistake in arc_printk message Signed-off-by: Colin Ian King Signed-off-by: Michael Grzeschik Signed-off-by: David S. Miller drivers/net/arcnet/capmode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5b85840320151f61e04d83a23ef2567a07094503 Author: Michael Grzeschik Date: Wed Jun 28 18:28:33 2017 +0200 arcnet: change irq handler to lock irqsave This patch prevents the arcnet driver from the following deadlock. [ 41.273910] ====================================================== [ 41.280397] [ INFO: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected ] [ 41.287433] 4.4.0-00034-gc0ae784 #536 Not tainted [ 41.292366] ------------------------------------------------------ [ 41.298863] arcecho/233 [HC0[0]:SC0[2]:HE0:SE0] is trying to acquire: [ 41.305628] (&(&lp->lock)->rlock){+.+...}, at: [] arcnet_send_packet+0x60/0x1c0 [arcnet] [ 41.315199] [ 41.315199] and this task is already holding: [ 41.321324] (_xmit_ARCNET#2){+.-...}, at: [] packet_direct_xmit+0xfc/0x1c8 [ 41.329593] which would create a new lock dependency: [ 41.334893] (_xmit_ARCNET#2){+.-...} -> (&(&lp->lock)->rlock){+.+...} [ 41.341801] [ 41.341801] but this new dependency connects a SOFTIRQ-irq-safe lock: [ 41.350108] (_xmit_ARCNET#2){+.-...} ... which became SOFTIRQ-irq-safe at: [ 41.357539] [] _raw_spin_lock+0x30/0x40 [ 41.362677] [] dev_watchdog+0x5c/0x264 [ 41.367723] [] call_timer_fn+0x6c/0xf4 [ 41.372759] [] run_timer_softirq+0x154/0x210 [ 41.378340] [] __do_softirq+0x144/0x298 [ 41.383469] [] irq_exit+0xcc/0x130 [ 41.388138] [] __handle_domain_irq+0x60/0xb4 [ 41.393728] [] __irq_svc+0x58/0x78 [ 41.398402] [] arch_cpu_idle+0x24/0x3c [ 41.403443] [] cpu_startup_entry+0x1f8/0x25c [ 41.409029] [] start_kernel+0x3c0/0x3cc [ 41.414170] [ 41.414170] to a SOFTIRQ-irq-unsafe lock: [ 41.419931] (&(&lp->lock)->rlock){+.+...} ... which became SOFTIRQ-irq-unsafe at: [ 41.427996] ... [] _raw_spin_lock+0x30/0x40 [ 41.433409] [] arcnet_interrupt+0x2c/0x800 [arcnet] [ 41.439646] [] handle_nested_irq+0x8c/0xec [ 41.445063] [] regmap_irq_thread+0x190/0x314 [ 41.450661] [] irq_thread_fn+0x1c/0x34 [ 41.455700] [] irq_thread+0x13c/0x1dc [ 41.460649] [] kthread+0xe4/0xf8 [ 41.465158] [] ret_from_fork+0x14/0x24 [ 41.470207] [ 41.470207] other info that might help us debug this: [ 41.470207] [ 41.478627] Possible interrupt unsafe locking scenario: [ 41.478627] [ 41.485763] CPU0 CPU1 [ 41.490521] ---- ---- [ 41.495279] lock(&(&lp->lock)->rlock); [ 41.499414] local_irq_disable(); [ 41.505636] lock(_xmit_ARCNET#2); [ 41.511967] lock(&(&lp->lock)->rlock); [ 41.518741] [ 41.521490] lock(_xmit_ARCNET#2); [ 41.525356] [ 41.525356] *** DEADLOCK *** [ 41.525356] [ 41.531587] 1 lock held by arcecho/233: [ 41.535617] #0: (_xmit_ARCNET#2){+.-...}, at: [] packet_direct_xmit+0xfc/0x1c8 [ 41.544355] the dependencies between SOFTIRQ-irq-safe lock and the holding lock: [ 41.552362] -> (_xmit_ARCNET#2){+.-...} ops: 27 { [ 41.557357] HARDIRQ-ON-W at: [ 41.560664] [] _raw_spin_lock+0x30/0x40 [ 41.567445] [] dev_deactivate_many+0x114/0x304 [ 41.574866] [] dev_deactivate+0x24/0x38 [ 41.581646] [] linkwatch_do_dev+0x40/0x74 [ 41.588613] [] __linkwatch_run_queue+0xec/0x140 [ 41.596120] [] linkwatch_event+0x2c/0x34 [ 41.602991] [] process_one_work+0x188/0x40c [ 41.610131] [] worker_thread+0x4c/0x480 [ 41.616912] [] kthread+0xe4/0xf8 [ 41.623048] [] ret_from_fork+0x14/0x24 [ 41.629735] IN-SOFTIRQ-W at: [ 41.633039] [] _raw_spin_lock+0x30/0x40 [ 41.639820] [] dev_watchdog+0x5c/0x264 [ 41.646508] [] call_timer_fn+0x6c/0xf4 [ 41.653190] [] run_timer_softirq+0x154/0x210 [ 41.660425] [] __do_softirq+0x144/0x298 [ 41.667201] [] irq_exit+0xcc/0x130 [ 41.673518] [] __handle_domain_irq+0x60/0xb4 [ 41.680754] [] __irq_svc+0x58/0x78 [ 41.687077] [] arch_cpu_idle+0x24/0x3c [ 41.693769] [] cpu_startup_entry+0x1f8/0x25c [ 41.701006] [] start_kernel+0x3c0/0x3cc [ 41.707791] INITIAL USE at: [ 41.711003] [] _raw_spin_lock+0x30/0x40 [ 41.717696] [] dev_deactivate_many+0x114/0x304 [ 41.725026] [] dev_deactivate+0x24/0x38 [ 41.731718] [] linkwatch_do_dev+0x40/0x74 [ 41.738593] [] __linkwatch_run_queue+0xec/0x140 [ 41.746011] [] linkwatch_event+0x2c/0x34 [ 41.752789] [] process_one_work+0x188/0x40c [ 41.759847] [] worker_thread+0x4c/0x480 [ 41.766541] [] kthread+0xe4/0xf8 [ 41.772596] [] ret_from_fork+0x14/0x24 [ 41.779198] } [ 41.780945] ... key at: [] netdev_xmit_lock_key+0x38/0x1c8 [ 41.788192] ... acquired at: [ 41.791309] [] lock_acquire+0x70/0x90 [ 41.796361] [] _raw_spin_lock_irqsave+0x40/0x54 [ 41.802324] [] arcnet_send_packet+0x60/0x1c0 [arcnet] [ 41.808844] [] packet_direct_xmit+0x130/0x1c8 [ 41.814622] [] packet_sendmsg+0x3b8/0x680 [ 41.820034] [] sock_sendmsg+0x14/0x24 [ 41.825091] [] SyS_sendto+0xb8/0xe0 [ 41.829956] [] SyS_send+0x18/0x20 [ 41.834638] [] ret_fast_syscall+0x0/0x1c [ 41.839954] [ 41.841514] the dependencies between the lock to be acquired and SOFTIRQ-irq-unsafe lock: [ 41.850302] -> (&(&lp->lock)->rlock){+.+...} ops: 5 { [ 41.855644] HARDIRQ-ON-W at: [ 41.858945] [] _raw_spin_lock+0x30/0x40 [ 41.865726] [] arcnet_interrupt+0x2c/0x800 [arcnet] [ 41.873607] [] handle_nested_irq+0x8c/0xec [ 41.880666] [] regmap_irq_thread+0x190/0x314 [ 41.887901] [] irq_thread_fn+0x1c/0x34 [ 41.894593] [] irq_thread+0x13c/0x1dc [ 41.901195] [] kthread+0xe4/0xf8 [ 41.907338] [] ret_from_fork+0x14/0x24 [ 41.914025] SOFTIRQ-ON-W at: [ 41.917328] [] _raw_spin_lock+0x30/0x40 [ 41.924106] [] arcnet_interrupt+0x2c/0x800 [arcnet] [ 41.931981] [] handle_nested_irq+0x8c/0xec [ 41.939028] [] regmap_irq_thread+0x190/0x314 [ 41.946264] [] irq_thread_fn+0x1c/0x34 [ 41.952954] [] irq_thread+0x13c/0x1dc [ 41.959548] [] kthread+0xe4/0xf8 [ 41.965689] [] ret_from_fork+0x14/0x24 [ 41.972379] INITIAL USE at: [ 41.975595] [] _raw_spin_lock+0x30/0x40 [ 41.982283] [] arcnet_interrupt+0x2c/0x800 [arcnet] [ 41.990063] [] handle_nested_irq+0x8c/0xec [ 41.997027] [] regmap_irq_thread+0x190/0x314 [ 42.004172] [] irq_thread_fn+0x1c/0x34 [ 42.010766] [] irq_thread+0x13c/0x1dc [ 42.017267] [] kthread+0xe4/0xf8 [ 42.023314] [] ret_from_fork+0x14/0x24 [ 42.029903] } [ 42.031648] ... key at: [] __key.42091+0x0/0xfffff0f8 [arcnet] [ 42.039255] ... acquired at: [ 42.042372] [] lock_acquire+0x70/0x90 [ 42.047413] [] _raw_spin_lock_irqsave+0x40/0x54 [ 42.053364] [] arcnet_send_packet+0x60/0x1c0 [arcnet] [ 42.059872] [] packet_direct_xmit+0x130/0x1c8 [ 42.065634] [] packet_sendmsg+0x3b8/0x680 [ 42.071030] [] sock_sendmsg+0x14/0x24 [ 42.076069] [] SyS_sendto+0xb8/0xe0 [ 42.080926] [] SyS_send+0x18/0x20 [ 42.085601] [] ret_fast_syscall+0x0/0x1c [ 42.090918] [ 42.092481] [ 42.092481] stack backtrace: [ 42.097065] CPU: 0 PID: 233 Comm: arcecho Not tainted 4.4.0-00034-gc0ae784 #536 [ 42.104751] Hardware name: Generic AM33XX (Flattened Device Tree) [ 42.111183] [] (unwind_backtrace) from [] (show_stack+0x10/0x14) [ 42.119337] [] (show_stack) from [] (dump_stack+0x8c/0x9c) [ 42.126937] [] (dump_stack) from [] (check_usage+0x4bc/0x63c) [ 42.134815] [] (check_usage) from [] (check_irq_usage+0x58/0xb0) [ 42.142964] [] (check_irq_usage) from [] (__lock_acquire+0x1524/0x20b0) [ 42.151740] [] (__lock_acquire) from [] (lock_acquire+0x70/0x90) [ 42.159886] [] (lock_acquire) from [] (_raw_spin_lock_irqsave+0x40/0x54) [ 42.168768] [] (_raw_spin_lock_irqsave) from [] (arcnet_send_packet+0x60/0x1c0 [arcnet]) [ 42.179115] [] (arcnet_send_packet [arcnet]) from [] (packet_direct_xmit+0x130/0x1c8) [ 42.189182] [] (packet_direct_xmit) from [] (packet_sendmsg+0x3b8/0x680) [ 42.198059] [] (packet_sendmsg) from [] (sock_sendmsg+0x14/0x24) [ 42.206199] [] (sock_sendmsg) from [] (SyS_sendto+0xb8/0xe0) [ 42.213978] [] (SyS_sendto) from [] (SyS_send+0x18/0x20) [ 42.221388] [] (SyS_send) from [] (ret_fast_syscall+0x0/0x1c) Signed-off-by: Michael Grzeschik --- v1 -> v2: removed unneeded zero assignment of flags Signed-off-by: David S. Miller drivers/net/arcnet/arcnet.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit acb4b7df48b539cb391287921de57e4e5fae3460 Author: Dan Carpenter Date: Wed Jun 28 14:44:21 2017 +0300 rocker: move dereference before free My static checker complains that ofdpa_neigh_del() can sometimes free "found". It just makes sense to use it first before deleting it. Fixes: ecf244f753e0 ("rocker: fix maybe-uninitialized warning") Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller drivers/net/ethernet/rocker/rocker_ofdpa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6b27c8adf27edf1dabe2cdcfaa101ef7e2712415 Author: Ido Schimmel Date: Wed Jun 28 09:03:12 2017 +0300 mlxsw: spectrum_router: Fix NULL pointer dereference In case a VLAN device is enslaved to a bridge we shouldn't create a router interface (RIF) for it when it's configured with an IP address. This is already handled by the driver for other types of netdevs, such as physical ports and LAG devices. If this IP address is then removed and the interface is subsequently unlinked from the bridge, a NULL pointer dereference can happen, as the original 802.1d FID was replaced with an rFID which was then deleted. To reproduce: $ ip link set dev enp3s0np9 up $ ip link add name enp3s0np9.111 link enp3s0np9 type vlan id 111 $ ip link set dev enp3s0np9.111 up $ ip link add name br0 type bridge $ ip link set dev br0 up $ ip link set enp3s0np9.111 master br0 $ ip address add dev enp3s0np9.111 192.168.0.1/24 $ ip address del dev enp3s0np9.111 192.168.0.1/24 $ ip link set dev enp3s0np9.111 nomaster Fixes: 99724c18fc66 ("mlxsw: spectrum: Introduce support for router interfaces") Signed-off-by: Ido Schimmel Reported-by: Petr Machata Tested-by: Petr Machata Reviewed-by: Petr Machata Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 3 +++ 1 file changed, 3 insertions(+) commit c1a4872ebfb83b1af7144f7b29ac8c4b344a12a8 Author: Gao Feng Date: Wed Jun 28 12:53:54 2017 +0800 net: sched: Fix one possible panic when no destroy callback When qdisc fail to init, qdisc_create would invoke the destroy callback to cleanup. But there is no check if the callback exists really. So it would cause the panic if there is no real destroy callback like the qdisc codel, fq, and so on. Take codel as an example following: When a malicious user constructs one invalid netlink msg, it would cause codel_init->codel_change->nla_parse_nested failed. Then kernel would invoke the destroy callback directly but qdisc codel doesn't define one. It causes one panic as a result. Now add one the check for destroy to avoid the possible panic. Fixes: 87b60cfacf9f ("net_sched: fix error recovery at qdisc creation") Signed-off-by: Gao Feng Acked-by: Eric Dumazet Signed-off-by: David S. Miller net/sched/sch_api.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 713a98d90c5ea072c1bb00ef40617aee2cef2232 Author: Jason Wang Date: Wed Jun 28 09:51:03 2017 +0800 virtio-net: serialize tx routine during reset We don't hold any tx lock when trying to disable TX during reset, this would lead a use after free since ndo_start_xmit() tries to access the virtqueue which has already been freed. Fix this by using netif_tx_disable() before freeing the vqs, this could make sure no tx after vq freeing. Reported-by: Jean-Philippe Menil Tested-by: Jean-Philippe Menil Fixes commit f600b6905015 ("virtio_net: Add XDP support") Cc: John Fastabend Signed-off-by: Jason Wang Acked-by: Michael S. Tsirkin Acked-by: Robert McCabe Signed-off-by: David S. Miller drivers/net/virtio_net.c | 1 + 1 file changed, 1 insertion(+) commit 0f17976568b3f72e676450af0c0db6f8752253d6 Author: Steven Rostedt (VMware) Date: Thu Jun 29 10:05:45 2017 -0400 ftrace: Fix regression with module command in stack_trace_filter When doing the following command: # echo ":mod:kvm_intel" > /sys/kernel/tracing/stack_trace_filter it triggered a crash. This happened with the clean up of probes. It required all callers to the regex function (doing ftrace filtering) to have ops->private be a pointer to a trace_array. But for the stack tracer, that is not the case. Allow for the ops->private to be NULL, and change the function command callbacks to handle the trace_array pointer being NULL as well. Fixes: d2afd57a4b96 ("tracing/ftrace: Allow instances to have their own function probes") Signed-off-by: Steven Rostedt (VMware) kernel/trace/ftrace.c | 3 --- kernel/trace/trace.c | 3 +++ kernel/trace/trace_functions.c | 12 ++++++++++++ kernel/trace/trace_stack.c | 6 ++++-- 4 files changed, 19 insertions(+), 5 deletions(-) commit 1d80df93d9d170eba8c3654719e5857307efd077 Author: Brian Norris Date: Fri Jun 23 13:59:11 2017 -0700 Revert "pinctrl: rockchip: avoid hardirq-unsafe functions in irq_chip" This reverts commit 88bb94216f59e10802aaf78c858a4146085faf18. It introduced a new CONFIG_DEBUG_ATOMIC_SLEEP warning in v4.12-rc1: [ 7226.716713] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:238 [ 7226.716716] in_atomic(): 0, irqs_disabled(): 0, pid: 1708, name: bash [ 7226.716722] CPU: 1 PID: 1708 Comm: bash Not tainted 4.12.0-rc6+ #1213 [ 7226.716724] Hardware name: Google Kevin (DT) [ 7226.716726] Call trace: [ 7226.716738] [] dump_backtrace+0x0/0x24c [ 7226.716743] [] show_stack+0x20/0x28 [ 7226.716749] [] dump_stack+0x90/0xb0 [ 7226.716755] [] ___might_sleep+0x10c/0x124 [ 7226.716760] [] __might_sleep+0x78/0x88 [ 7226.716765] [] mutex_lock+0x2c/0x64 [ 7226.716771] [] rockchip_irq_bus_lock+0x30/0x3c [ 7226.716777] [] __irq_get_desc_lock+0x78/0x98 [ 7226.716782] [] irq_set_irq_wake+0x44/0x12c [ 7226.716787] [] dev_pm_arm_wake_irq+0x4c/0x58 [ 7226.716792] [] device_wakeup_arm_wake_irqs+0x3c/0x58 [ 7226.716796] [] dpm_suspend_noirq+0xf8/0x3a0 [ 7226.716800] [] suspend_devices_and_enter+0x1a4/0x9a8 [ 7226.716803] [] pm_suspend+0x664/0x6a4 [ 7226.716807] [] state_store+0xd4/0xf8 ... It was reported on -rc1, and it's still not fixed in -rc6, so it should just be reverted. Cc: John Keeping Signed-off-by: Brian Norris Reviewed-by: Heiko Stuebner Signed-off-by: Linus Walleij drivers/pinctrl/pinctrl-rockchip.c | 44 ++++---------------------------------- 1 file changed, 4 insertions(+), 40 deletions(-) commit c06632ea054c49510efacb42c52aab693c45b7ba Author: Hans de Goede Date: Fri Jun 23 09:26:13 2017 +0200 gpio: acpi: Skip _AEI entries without a handler rather then aborting the scan acpi_walk_resources will stop as soon as the callback passed in returns an error status. On a x86 tablet I have the first GpioInt in the _AEI resource list has no handler defined in the DSDT, causing acpi_walk_resources to abort scanning the rest of the resource list, which does define valid ACPI GPIO events. This commit changes the return for not finding a handler from AE_BAD_PARAMETER to AE_OK so that the rest of the resource list will get scanned normally in case of missing event handlers. Signed-off-by: Hans de Goede Acked-by: Mika Westerberg Acked-by: Andy Shevchenko Signed-off-by: Linus Walleij drivers/gpio/gpiolib-acpi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ad537b822577fcc143325786cd6ad50d7b9df31c Author: Bartosz Golaszewski Date: Fri Jun 23 13:45:16 2017 +0200 gpiolib: fix filtering out unwanted events GPIOEVENT_REQUEST_BOTH_EDGES is not a single flag, but a binary OR of GPIOEVENT_REQUEST_RISING_EDGE and GPIOEVENT_REQUEST_FALLING_EDGE. The expression 'le->eflags & GPIOEVENT_REQUEST_BOTH_EDGES' we'll get evaluated to true even if only one event type was requested. Fix it by checking both RISING & FALLING flags explicitly. Cc: stable@vger.kernel.org Fixes: 61f922db7221 ("gpio: userspace ABI for reading GPIO line events") Signed-off-by: Bartosz Golaszewski Signed-off-by: Linus Walleij drivers/gpio/gpiolib.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 6474924e2b5ddb0030c355558966adcbe3b49022 Author: Tobias Klauser Date: Wed Jun 28 15:30:02 2017 +0200 arch: remove unused macro/function thread_saved_pc() The only user of thread_saved_pc() in non-arch-specific code was removed in commit 8243d5597793 ("sched/core: Remove pointless printout in sched_show_task()"). Remove the implementations as well. Some architectures use thread_saved_pc() in their arch-specific code. Leave their thread_saved_pc() intact. Signed-off-by: Tobias Klauser Acked-by: Geert Uytterhoeven Cc: Ingo Molnar Signed-off-by: Linus Torvalds arch/arc/include/asm/processor.h | 2 -- arch/blackfin/include/asm/processor.h | 5 ----- arch/c6x/include/asm/processor.h | 5 ----- arch/cris/arch-v10/kernel/process.c | 8 -------- arch/cris/arch-v32/kernel/process.c | 8 -------- arch/cris/include/asm/processor.h | 2 -- arch/frv/include/asm/processor.h | 5 ----- arch/frv/kernel/process.c | 9 --------- arch/h8300/include/asm/processor.h | 4 ---- arch/h8300/kernel/process.c | 5 ----- arch/hexagon/include/asm/processor.h | 3 --- arch/hexagon/kernel/process.c | 8 -------- arch/ia64/include/asm/processor.h | 17 ----------------- arch/m32r/include/asm/processor.h | 2 -- arch/m32r/kernel/process.c | 8 -------- arch/m68k/include/asm/processor.h | 2 -- arch/m68k/kernel/process.c | 14 -------------- arch/microblaze/include/asm/processor.h | 6 ------ arch/microblaze/kernel/process.c | 17 ----------------- arch/mn10300/include/asm/processor.h | 5 ----- arch/mn10300/kernel/process.c | 8 -------- arch/nios2/include/asm/processor.h | 3 --- arch/openrisc/include/asm/processor.h | 5 ----- arch/openrisc/kernel/process.c | 5 ----- arch/parisc/include/asm/processor.h | 5 ----- arch/parisc/kernel/process.c | 5 ----- arch/powerpc/include/asm/processor.h | 6 ------ arch/s390/include/asm/processor.h | 5 ----- arch/s390/kernel/process.c | 25 ------------------------- arch/score/include/asm/processor.h | 1 - arch/score/kernel/process.c | 5 ----- arch/sparc/include/asm/processor_32.h | 3 --- arch/sparc/include/asm/processor_64.h | 2 -- arch/sparc/kernel/process_32.c | 8 -------- arch/sparc/kernel/process_64.c | 19 ------------------- arch/tile/include/asm/processor.h | 7 ------- arch/um/include/asm/processor-generic.h | 2 -- arch/um/kernel/um_arch.c | 6 ------ arch/x86/include/asm/processor.h | 2 -- arch/x86/kernel/process.c | 11 ----------- arch/xtensa/include/asm/processor.h | 2 -- 41 files changed, 270 deletions(-) commit 9ae3b3f52c62ddd5eb12c57f195f4f38121faa01 Author: Jens Axboe Date: Wed Jun 28 15:30:13 2017 -0600 block: provide bio_uninit() free freeing integrity/task associations Wen reports significant memory leaks with DIF and O_DIRECT: "With nvme devive + T10 enabled, On a system it has 256GB and started logging /proc/meminfo & /proc/slabinfo for every minute and in an hour it increased by 15968128 kB or ~15+GB.. Approximately 256 MB / minute leaking. /proc/meminfo | grep SUnreclaim... SUnreclaim: 6752128 kB SUnreclaim: 6874880 kB SUnreclaim: 7238080 kB .... SUnreclaim: 22307264 kB SUnreclaim: 22485888 kB SUnreclaim: 22720256 kB When testcases with T10 enabled call into __blkdev_direct_IO_simple, code doesn't free memory allocated by bio_integrity_alloc. The patch fixes the issue. HTX has been run with +60 hours without failure." Since __blkdev_direct_IO_simple() allocates the bio on the stack, it doesn't go through the regular bio free. This means that any ancillary data allocated with the bio through the stack is not freed. Hence, we can leak the integrity data associated with the bio, if the device is using DIF/DIX. Fix this by providing a bio_uninit() and export it, so that we can use it to free this data. Note that this is a minimal fix for this issue. Any current user of bio's that are allocated outside of bio_alloc_bioset() suffers from this issue, most notably some drivers. We will fix those in a more comprehensive patch for 4.13. This also means that the commit marked as being fixed by this isn't the real culprit, it's just the most obvious one out there. Fixes: 542ff7bf18c6 ("block: new direct I/O implementation") Reported-by: Wen Xiong Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe block/bio.c | 12 +++++++++--- fs/block_dev.c | 5 ++++- include/linux/bio.h | 1 + 3 files changed, 14 insertions(+), 4 deletions(-) commit e547204f1f4f314a7352f7b93332fdc1a2e4b24c Merge: 5a37be4 2e31b4c Author: Linus Torvalds Date: Wed Jun 28 13:27:15 2017 -0700 Merge tag 'nfs-for-4.12-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs Pull NFS client bugfixes from Trond Myklebust: "Bugfixes include: - stable fix for exclusive create if the server supports the umask attribute - trunking detection should handle ERESTARTSYS/EINTR - stable fix for a race in the LAYOUTGET function - stable fix to revert "nfs_rename() handle -ERESTARTSYS dentry left behind" - nfs4_callback_free_slot() cannot call nfs4_slot_tbl_drain_complete()" * tag 'nfs-for-4.12-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: NFSv4.1: nfs4_callback_free_slot() cannot call nfs4_slot_tbl_drain_complete() Revert "NFS: nfs_rename() handle -ERESTARTSYS dentry left behind" NFSv4.1: Fix a race in nfs4_proc_layoutget NFS: Trunking detection should handle ERESTARTSYS/EINTR NFSv4.2: Don't send mode again in post-EXCLUSIVE4_1 SETATTR with umask commit 5a37be4b51bbf85e37cdb5831899c330505faf03 Merge: cf72349 9ff1beb Author: Linus Torvalds Date: Wed Jun 28 13:22:26 2017 -0700 Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux Pull drm fixes from Dave Airlie: "This is the final set of fixes for -rc8, just a few i915 and one vmwgfx ones. I'm off on holidays for a week, so if anything shows up for fixes I've asked Daniel or Sean Paul to herd it in the right direction" [ The additional etnaviv fixes were already herded towards me as seen in my previous pull - Linus ] * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: drm/vmwgfx: Free hash table allocated by cmdbuf managed res mgr drm/i915: Disable EXEC_OBJECT_ASYNC when doing relocations drm/i915: Hold struct_mutex for per-file stats in debugfs/i915_gem_object drm/i915: Retire the VMA's fence tracker before unbinding commit cf723497f2b0dfd688dd27949f1d6e26a5aec44c Merge: 3c2bfba 426ef1b Author: Linus Torvalds Date: Wed Jun 28 13:13:48 2017 -0700 Merge branch 'etnaviv/fixes' of git://git.pengutronix.de/git/lst/linux Pull drm/etnaviv fixes from Lucas Stach: "I realized I just missed the cut-off point for the final drm fixes pull, but I have 2 more etnaviv fixes that need to go into 4.12, as they fix fallout from the explicit sync work introduced in the last merge window" [ Pulling directly because Dave is on vacation. Noted by Daniel Vetter, and acked by Dave Airlie - Linus ] * 'etnaviv/fixes' of git://git.pengutronix.de/git/lst/linux: drm/etnaviv: Fix implicit/explicit sync sense inversion drm/etnaviv: fix submit flags getting overwritten by BO content commit 84a21dbdef0b96d773599c33c2afbb002198d303 Author: Suravee Suthikulpanit Date: Mon Jun 26 04:28:04 2017 -0500 iommu/amd: Fix interrupt remapping when disable guest_mode Pass-through devices to VM guest can get updated IRQ affinity information via irq_set_affinity() when not running in guest mode. Currently, AMD IOMMU driver in GA mode ignores the updated information if the pass-through device is setup to use vAPIC regardless of guest_mode. This could cause invalid interrupt remapping. Also, the guest_mode bit should be set and cleared only when SVM updates posted-interrupt interrupt remapping information. Signed-off-by: Suravee Suthikulpanit Cc: Joerg Roedel Fixes: d98de49a53e48 ('iommu/amd: Enable vAPIC interrupt remapping mode by default') Signed-off-by: Joerg Roedel drivers/iommu/amd_iommu.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit fbaf94ee3cd5cfa85fe2d4d04be968820cb00556 Author: Miklos Szeredi Date: Wed Jun 28 13:41:22 2017 +0200 ovl: don't set origin on broken lower hardlink When copying up a file that has multiple hard links we need to break any association with the origin file. This makes copy-up be essentially an atomic replace. The new file has nothing to do with the old one (except having the same data and metadata initially), so don't set the overlay.origin attribute. We can relax this in the future when we are able to index upper object by origin. Signed-off-by: Miklos Szeredi Fixes: 3a1e819b4e80 ("ovl: store file handle of lower inode on copy up") fs/overlayfs/copy_up.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit e85f82ff9b8ef503923a3be8ca6b5fd1908a7f3f Author: Miklos Szeredi Date: Wed Jun 28 13:41:22 2017 +0200 ovl: copy-up: don't unlock between lookup and link Nothing prevents mischief on upper layer while we are busy copying up the data. Move the lookup right before the looked up dentry is actually used. Signed-off-by: Miklos Szeredi Fixes: 01ad3eb8a073 ("ovl: concurrent copy up of regular files") Cc: # v4.11 fs/overlayfs/copy_up.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) commit d94815f917da770d42c377786dc428f542e38f71 Author: Takashi Iwai Date: Wed Jun 28 12:02:02 2017 +0200 ALSA: hda - Fix endless loop of codec configure azx_codec_configure() loops over the codecs found on the given controller via a linked list. The code used to work in the past, but in the current version, this may lead to an endless loop when a codec binding returns an error. The culprit is that the snd_hda_codec_configure() unregisters the device upon error, and this eventually deletes the given codec object from the bus. Since the list is initialized via list_del_init(), the next object points to the same device itself. This behavior change was introduced at splitting the HD-audio code code, and forgotten to adapt it here. For fixing this bug, just use a *_safe() version of list iteration. Fixes: d068ebc25e6e ("ALSA: hda - Move some codes up to hdac_bus struct") Reported-by: Daniel Vetter Cc: Signed-off-by: Takashi Iwai sound/pci/hda/hda_codec.h | 2 ++ sound/pci/hda/hda_controller.c | 8 ++++++-- 2 files changed, 8 insertions(+), 2 deletions(-) commit 426ef1bb40a3bd99ccd16d629bd1294805e96fc6 Author: Daniel Stone Date: Thu Jun 22 12:22:22 2017 +0100 drm/etnaviv: Fix implicit/explicit sync sense inversion We were reading the no-implicit sync flag the wrong way around, synchronizing too much for the explicit case, and not at all for the implicit case. Oops. Signed-off-by: Daniel Stone Signed-off-by: Lucas Stach drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f4a4381ba4944603905167d044d865990356ba22 Author: Lucas Stach Date: Tue Jun 27 16:02:51 2017 +0200 drm/etnaviv: fix submit flags getting overwritten by BO content The addition of the flags member to etnaviv_gem_submit structure didn't take into account that the last member of this structure is a variable length array. Signed-off-by: Lucas Stach drivers/gpu/drm/etnaviv/etnaviv_gem.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 9ff1beb1d19ffe2b26bf9cd2d33e6073d4f4b5fe Merge: 5193c08 611cdf3 Author: Dave Airlie Date: Wed Jun 28 17:07:15 2017 +1000 Merge tag 'drm-intel-fixes-2017-06-27' of git://anongit.freedesktop.org/git/drm-intel into drm-fixes Just a few minor fixes. Important one is the execbuf async fix (aka ANDROID_native_sync). There was another patch for a display coherency corner case on APL, but we've random-walked in that space too much, and the cherry-pick looked really invasive. * tag 'drm-intel-fixes-2017-06-27' of git://anongit.freedesktop.org/git/drm-intel: drm/i915: Disable EXEC_OBJECT_ASYNC when doing relocations drm/i915: Hold struct_mutex for per-file stats in debugfs/i915_gem_object drm/i915: Retire the VMA's fence tracker before unbinding commit 5193c08c7e82248cb6b1e5d672d261c4da6bb47b Merge: c0bc126 82fcee5 Author: Dave Airlie Date: Wed Jun 28 17:06:58 2017 +1000 Merge branch 'vmwgfx-fixes-4.12' of git://people.freedesktop.org/~thomash/linux into drm-fixes Single vmwgfx fix * 'vmwgfx-fixes-4.12' of git://people.freedesktop.org/~thomash/linux: drm/vmwgfx: Free hash table allocated by cmdbuf managed res mgr commit a8f20fd25bdce81a8e41767c39f456d346b63427 Author: Hui Wang Date: Wed Jun 28 08:59:16 2017 +0800 ALSA: hda - set input_path bitmap to zero after moving it to new place Recently we met a problem, the codec has valid adcs and input pins, and they can form valid input paths, but the driver does not build valid controls for them like "Mic boost", "Capture Volume" and "Capture Switch". Through debugging, I found the driver needs to shrink the invalid adcs and input paths for this machine, so it will move the whole column bitmap value to the previous column, after moving it, the driver forgets to set the original column bitmap value to zero, as a result, the driver will invalidate the path whose index value is the original colume bitmap value. After executing this function, all valid input paths are invalidated by a mistake, there are no any valid input paths, so the driver won't build controls for them. Fixes: 3a65bcdc577a ("ALSA: hda - Fix inconsistent input_paths after ADC reduction") Cc: Signed-off-by: Hui Wang Signed-off-by: Takashi Iwai sound/pci/hda/hda_generic.c | 1 + 1 file changed, 1 insertion(+) commit 2e31b4cb895ae78db31dffb860cd255d86c6561c Author: Trond Myklebust Date: Tue Jun 27 17:40:50 2017 -0400 NFSv4.1: nfs4_callback_free_slot() cannot call nfs4_slot_tbl_drain_complete() The current code works only for the case where we have exactly one slot, which is no longer true. nfs4_free_slot() will automatically declare the callback channel to be drained when all slots have been returned. Signed-off-by: Trond Myklebust fs/nfs/callback_xdr.c | 1 - 1 file changed, 1 deletion(-) commit d9f2950006f110f54444a10442752372ee568289 Author: Benjamin Coddington Date: Fri Jun 16 11:12:59 2017 -0400 Revert "NFS: nfs_rename() handle -ERESTARTSYS dentry left behind" This reverts commit 920b4530fb80430ff30ef83efe21ba1fa5623731 which could call d_move() without holding the directory's i_mutex, and reverts commit d4ea7e3c5c0e341c15b073016dbf3ab6c65f12f3 "NFS: Fix old dentry rehash after move", which was a follow-up fix. Signed-off-by: Benjamin Coddington Fixes: 920b4530fb80 ("NFS: nfs_rename() handle -ERESTARTSYS dentry left behind") Cc: stable@vger.kernel.org # v4.10+ Reviewed-by: Jeff Layton Signed-off-by: Trond Myklebust fs/nfs/dir.c | 51 ++++++++++++++++++++++++--------------------------- 1 file changed, 24 insertions(+), 27 deletions(-) commit bd171930e6a3de4f5cffdafbb944e50093dfb59b Author: Trond Myklebust Date: Tue Jun 27 17:33:38 2017 -0400 NFSv4.1: Fix a race in nfs4_proc_layoutget If the task calling layoutget is signalled, then it is possible for the calls to nfs4_sequence_free_slot() and nfs4_layoutget_prepare() to race, in which case we leak a slot. The fix is to move the call to nfs4_sequence_free_slot() into the nfs4_layoutget_release() so that it gets called at task teardown time. Fixes: 2e80dbe7ac51 ("NFSv4.1: Close callback races for OPEN, LAYOUTGET...") Cc: stable@vger.kernel.org # v4.8+ Signed-off-by: Trond Myklebust fs/nfs/nfs4proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 898fc11bb2bd4fbcefb685872d9fffaba2c8edaf Author: Trond Myklebust Date: Wed Jun 21 10:16:56 2017 -0400 NFS: Trunking detection should handle ERESTARTSYS/EINTR Currently, it will return EIO in those cases. Signed-off-by: Trond Myklebust fs/nfs/nfs4state.c | 2 ++ 1 file changed, 2 insertions(+) commit ddbfff7429a75d954bf5bdff9f2222bceb4c236a Author: Aleksandar Markovic Date: Mon Jun 19 17:50:12 2017 +0200 MIPS: math-emu: Handle zero accumulator case in MADDF and MSUBF separately If accumulator value is zero, just return the value of previously calculated product. This brings logic in MADDF/MSUBF implementation closer to the logic in ADD/SUB case. Signed-off-by: Miodrag Dinic Signed-off-by: Goran Ferenc Signed-off-by: Aleksandar Markovic Cc: James.Hogan@imgtec.com Cc: Paul.Burton@imgtec.com Cc: Raghu.Gandham@imgtec.com Cc: Leonid.Yegoshin@imgtec.com Cc: Douglas.Leung@imgtec.com Cc: Petar.Jovanovic@imgtec.com Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/16512/ Signed-off-by: Ralf Baechle arch/mips/math-emu/dp_maddf.c | 5 ++++- arch/mips/math-emu/sp_maddf.c | 5 ++++- 2 files changed, 8 insertions(+), 2 deletions(-) commit ebef7368571d88f0f80b817e6898075c62265b4e Author: Keith Busch Date: Tue Jun 27 17:44:05 2017 -0600 nvme/pci: Fix stuck nvme reset The controller state is set to resetting prior to disabling the controller, so this patch accounts for that state when deciding if it needs to freeze the queues. Without this, an 'nvme reset /dev/nvme0' blocks forever because the queues were never frozen. Fixes: 82b057caefaf ("nvme-pci: fix multiple ctrl removal scheduling") Signed-off-by: Keith Busch Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe drivers/nvme/host/pci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 25d8b92e0af75d72ce8b99e63e5a449cc0888efa Author: Karl Beldan Date: Tue Jun 27 19:22:16 2017 +0000 MIPS: head: Reorder instructions missing a delay slot In this sequence the 'move' is assumed in the delay slot of the 'beq', but head.S is in reorder mode and the former gets pushed one 'nop' farther by the assembler. The corrected behavior made booting with an UHI supplied dtb erratic. Fixes: 15f37e158892 ("MIPS: store the appended dtb address in a variable") Signed-off-by: Karl Beldan Reviewed-by: James Hogan Cc: Jonas Gorski Cc: linux-mips@linux-mips.org Cc: linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org Patchwork: https://patchwork.linux-mips.org/patch/16614/ Signed-off-by: Ralf Baechle arch/mips/kernel/head.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e20bd60bf62a2448be873653c7febca1d4d73afc Author: Andrew F. Davis Date: Mon Jun 26 12:41:20 2017 -0500 net: usb: asix88179_178a: Add support for the Belkin B2B128 The Belkin B2B128 is a USB 3.0 Hub + Gigabit Ethernet Adapter, the Ethernet adapter uses the ASIX AX88179 USB 3.0 to Gigabit Ethernet chip supported by this driver, add the USB ID for the same. This patch is based on work by Geoffrey Tran who has indicated they would like this upstreamed by someone more familiar with the upstreaming process. Signed-off-by: Andrew F. Davis Signed-off-by: David S. Miller drivers/net/usb/ax88179_178a.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) commit 85688d9adf68557233d974ef28971e69b89fb690 Author: Madalin Bucur Date: Mon Jun 26 18:47:00 2017 +0300 fsl/fman: add dependency on HAS_DMA A previous commit (5567e989198b5a8d) inserted a dependency on DMA API that requires HAS_DMA to be added in Kconfig. Signed-off-by: Madalin Bucur Signed-off-by: David S. Miller drivers/net/ethernet/freescale/fman/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 00a0ea33b495ee6149bf5a77ac5807ce87323abb Author: Vallish Vaidyeshwara Date: Fri Jun 23 18:53:06 2017 +0000 dm thin: do not queue freed thin mapping for next stage processing process_prepared_discard_passdown_pt1() should cleanup dm_thin_new_mapping in cases of error. dm_pool_inc_data_range() can fail trying to get a block reference: metadata operation 'dm_pool_inc_data_range' failed: error = -61 When dm_pool_inc_data_range() fails, dm thin aborts current metadata transaction and marks pool as PM_READ_ONLY. Memory for thin mapping is released as well. However, current thin mapping will be queued onto next stage as part of queue_passdown_pt2() or passdown_endio(). This dangling thin mapping memory when processed and accessed in next stage will lead to device mapper crashing. Code flow without fix: -> process_prepared_discard_passdown_pt1(m) -> dm_thin_remove_range() -> discard passdown --> passdown_endio(m) queues m onto next stage -> dm_pool_inc_data_range() fails, frees memory m but does not remove it from next stage queue -> process_prepared_discard_passdown_pt2(m) -> processes freed memory m and crashes One such stack: Call Trace: [] dm_cell_release_no_holder+0x2f/0x70 [dm_bio_prison] [] cell_defer_no_holder+0x3c/0x80 [dm_thin_pool] [] process_prepared_discard_passdown_pt2+0x4b/0x90 [dm_thin_pool] [] process_prepared+0x81/0xa0 [dm_thin_pool] [] do_worker+0xc5/0x820 [dm_thin_pool] [] ? __schedule+0x244/0x680 [] ? pwq_activate_delayed_work+0x42/0xb0 [] process_one_work+0x153/0x3f0 [] worker_thread+0x12b/0x4b0 [] ? rescuer_thread+0x350/0x350 [] kthread+0xca/0xe0 [] ? kthread_park+0x60/0x60 [] ret_from_fork+0x25/0x30 The fix is to first take the block ref count for discarded block and then do a passdown discard of this block. If block ref count fails, then bail out aborting current metadata transaction, mark pool as PM_READ_ONLY and also free current thin mapping memory (existing error handling code) without queueing this thin mapping onto next stage of processing. If block ref count succeeds, then passdown discard of this block. Discard callback of passdown_endio() will queue this thin mapping onto next stage of processing. Code flow with fix: -> process_prepared_discard_passdown_pt1(m) -> dm_thin_remove_range() -> dm_pool_inc_data_range() --> if fails, free memory m and bail out -> discard passdown --> passdown_endio(m) queues m onto next stage Cc: stable # v4.9+ Reviewed-by: Eduardo Valentin Reviewed-by: Cristian Gafton Reviewed-by: Anchal Agarwal Signed-off-by: Vallish Vaidyeshwara Reviewed-by: Joe Thornber Signed-off-by: Mike Snitzer drivers/md/dm-thin.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) commit 6f64ec74515925cced6df4571638b5a099a49aae Author: Eric Dumazet Date: Tue Jun 27 07:02:20 2017 -0700 net: prevent sign extension in dev_get_stats() Similar to the fix provided by Dominik Heidler in commit 9b3dc0a17d73 ("l2tp: cast l2tp traffic counter to unsigned") we need to take care of 32bit kernels in dev_get_stats(). When using atomic_long_read(), we add a 'long' to u64 and might misinterpret high order bit, unless we cast to unsigned. Fixes: caf586e5f23ce ("net: add a core netdev->rx_dropped counter") Fixes: 015f0688f57ca ("net: net: add a core netdev->tx_dropped counter") Fixes: 6e7333d315a76 ("net: add rx_nohandler stat counter") Signed-off-by: Eric Dumazet Cc: Jarod Wilson Signed-off-by: David S. Miller net/core/dev.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 3c2bfbaadff6e0c257bb6b16c9c97f43618b13dc Merge: da8b14e d360a68 Author: Linus Torvalds Date: Tue Jun 27 08:56:52 2017 -0700 Merge branch 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM fixes from Russell King: "Three more fixes: - Fix the previous fix merged in the last pull for the Thumb2 decompressor. - A fix from Vladimir to correctly identify the V7M cache type. - The optimised 3G vmsplit case does not work with LPAE, so don't allow this to be selected for LPAE configurations" * 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm: ARM: 8682/1: V7M: Set cacheid iff DminLine or IminLine is nonzero ARM: 8681/1: make VMSPLIT_3G_OPT depends on !ARM_LPAE ARM: 8680/1: boot/compressed: fix inappropriate Thumb2 mnemonic for __nop commit e3c2c4fb524b548e58108a8820c0ac7787667584 Merge: c0bc126 3f938ee Author: Ingo Molnar Date: Tue Jun 27 09:17:02 2017 +0200 Merge tag 'perf-urgent-for-mingo-4.12-20170626' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/urgent fix from Arnaldo Carvalho de Melo: - Fix segfault for kernel.kptr_restrict=2 (Jiri Olsa) Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit da8b14e45c8b8234cb9a609c947f7e4d15f8dbef Merge: 9d646c9 91ebcd1 Author: Linus Torvalds Date: Mon Jun 26 12:25:59 2017 -0700 Merge tag 'for-linus' of git://linux-c6x.org/git/projects/linux-c6x-upstreaming Pull c6x fixlet from Mark Salter: "Update maintainer email" * tag 'for-linus' of git://linux-c6x.org/git/projects/linux-c6x-upstreaming: MAINTAINERS: update email address for C6x maintainer commit 9d646c97e1abf777cf229031365860e7bc1c588c Merge: c0bc126 4130b28 Author: Linus Torvalds Date: Mon Jun 26 11:58:21 2017 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 bugfix from Martin Schwidefsky: "One last s390 patch for 4.12 Revert the re-IPL semantics back to the v4.7 state. It turned out that the memory layout may change due to memory hotplug if load-normal is used" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/ipl: revert Load Normal semantics for LPAR CCW-type re-IPL commit 3f938ee2f6c4fff8d95b24636a0964b5a93cf547 Author: Jiri Olsa Date: Mon Jun 26 11:51:53 2017 +0200 perf machine: Fix segfault for kernel.kptr_restrict=2 Michael reported the segfault when kernel.kptr_restrict=2 is set. $ perf record ls ... perf: Segmentation fault Obtained 16 stack frames. ./perf(dump_stack+0x2d) [0x5068df] ./perf(sighandler_dump_stack+0x2d) [0x5069bf] ./perf() [0x43e47b] /lib64/libc.so.6(+0x3594f) [0x7f762004794f] /lib64/libc.so.6(strlen+0x26) [0x7f762009ef86] /lib64/libc.so.6(__strdup+0xd) [0x7f762009ecbd] ./perf(maps__set_kallsyms_ref_reloc_sym+0x4d) [0x51590f] ./perf(machine__create_kernel_maps+0x136) [0x50a7de] ./perf(perf_session__create_kernel_maps+0x2c) [0x510a81] ./perf(perf_session__new+0x13d) [0x510e23] ./perf() [0x43fd61] ./perf(cmd_record+0x704) [0x441823] ./perf() [0x4bc1a0] ./perf() [0x4bc40d] ./perf() [0x4bc55f] ./perf(main+0x2d5) [0x4bc939] Segmentation fault (core dumped) The reason is that with kernel.kptr_restrict=2, we don't get the symbol from machine__get_running_kernel_start, which we want to use in maps__set_kallsyms_ref_reloc_sym and we crash. Check the symbol name value before calling maps__set_kallsyms_ref_reloc_sym() and succeed without ref_reloc_sym being set. It's safe because we check its existence before we use it. Reported-by: Michael Petlan Signed-off-by: Jiri Olsa Tested-by: Arnaldo Carvalho de Melo Cc: David Ahern Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/20170626095153.553-1-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/machine.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit d6bd8194e2867e85ac2de63486d3b83ccfae4e62 Author: Michael Ellerman Date: Mon Jun 26 11:30:57 2017 +1000 powerpc/32: Avoid miscompilation w/GCC 4.6.3 - don't inline copy_to/from_user() Larry Finger reported that his Powerbook G4 was no longer booting with v4.12-rc, userspace was up but giving weird errors such as: udevd[64]: starting version 175 udevd[64]: Unable to receive ctrl message: Bad address. modprobe: chdir(4.12-rc1): No such file or directory He bisected the problem to commit 3448890c32c3 ("powerpc: get rid of zeroing, switch to RAW_COPY_USER"). Al identified that the problem is actually a miscompilation by GCC 4.6.3, which is exposed by the above commit. Al also pointed out that inlining copy_to/from_user() is probably of little or no benefit, which is correct. Using Anton's copy_to_user benchmark, with a pathological single byte copy, we see a small increase in performance by *removing* inlining: Before (inlined): # time ./copy_to_user -w -l 1 -i 10000000 ( x 3 ) real 0m22.063s real 0m22.059s real 0m22.076s After: # time ./copy_to_user -w -l 1 -i 10000000 ( x 3 ) real 0m21.325s real 0m21.299s real 0m21.364s So as a small performance improvement and to avoid the miscompilation, drop inlining copy_to/from_user() on 32-bit. Fixes: 3448890c32c3 ("powerpc: get rid of zeroing, switch to RAW_COPY_USER") Reported-by: Larry Finger Suggested-by: Al Viro Signed-off-by: Michael Ellerman arch/powerpc/include/asm/uaccess.h | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) commit 82fcee526ba8ca2c5d378bdf51b21b7eb058fe3a Author: Deepak Rawat Date: Mon Jun 26 14:39:08 2017 +0200 drm/vmwgfx: Free hash table allocated by cmdbuf managed res mgr The hash table created during vmw_cmdbuf_res_man_create was never freed. This causes memory leak in context creation. Added the corresponding drm_ht_remove in vmw_cmdbuf_res_man_destroy. Tested for memory leak by running piglit overnight and kernel memory is not inflated which earlier was. Cc: Signed-off-by: Deepak Rawat Reviewed-by: Sinclair Yeh Signed-off-by: Thomas Hellstrom drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c | 1 + 1 file changed, 1 insertion(+) commit 98fe3633c5a44e5ee3d642907739eb0210407886 Author: Jérôme Glisse Date: Sat Jun 24 14:05:14 2017 -0400 x86/mm/hotplug: Fix BUG_ON() after hot-remove by not freeing PUD Since commit: af2cf278ef4f ("x86/mm/hotplug: Don't remove PGD entries in remove_pagetable()") we no longer free PUDs so that we do not have to synchronize all PGDs on hot-remove/vfree(). But the new 5-level page table patchset reverted that for 4-level page tables, in the following commit: f2a6a7050109: ("x86: Convert the rest of the code to support p4d_t") This patch restores the damage and disables free_pud() if we are in the 4-level page table case, thus avoiding BUG_ON() after hot-remove. Signed-off-by: Jérôme Glisse [ Clarified the changelog and the code comments. ] Reviewed-by: Kirill A. Shutemov Cc: Andrew Morton Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Logan Gunthorpe Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-mm@kvack.org Link: http://lkml.kernel.org/r/20170624180514.3821-1-jglisse@redhat.com Signed-off-by: Ingo Molnar arch/x86/mm/init_64.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 611cdf3695a307fdca3ff3779a1e6cca935e2d31 Author: Chris Wilson Date: Fri Jun 16 15:05:18 2017 +0100 drm/i915: Disable EXEC_OBJECT_ASYNC when doing relocations If we write a relocation into the buffer, we require our own implicit synchronisation added after the start of the execbuf, outside of the user's control. As we may end up clflushing, or doing the patch itself on the GPU, asynchronously we need to look at the implicit serialisation on obj->resv and hence need to disable EXEC_OBJECT_ASYNC for this object. If the user does trigger a stall for relocations, we make sure the stall is complete enough so that the batch is not submitted before we complete those relocations. Fixes: 77ae9957897d ("drm/i915: Enable userspace to opt-out of implicit fencing") Signed-off-by: Chris Wilson Cc: Joonas Lahtinen Cc: Jason Ekstrand Reviewed-by: Joonas Lahtinen (cherry picked from commit 071750e550af46b5d3a84ad56c2a108c3e136284) [danvet: Resolve conflicts, resolution reviewed by Tvrtko on irc.] Signed-off-by: Daniel Vetter drivers/gpu/drm/i915/i915_gem_execbuffer.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) commit 2c7367626733e27d6f6d9906db7a31ada587566b Author: Chris Wilson Date: Sat Jun 17 12:57:44 2017 +0100 drm/i915: Hold struct_mutex for per-file stats in debugfs/i915_gem_object As we walk the obj->vma_list in per_file_stats(), we need to hold struct_mutex to prevent alteration of that list. Fixes: 1d2ac403ae3b ("drm: Protect dev->filelist with its own mutex") Fixes: c84455b4bacc ("drm/i915: Move debug only per-request pid tracking from request to ctx") Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=101460 Signed-off-by: Chris Wilson Cc: Daniel Vetter Cc: Joonas Lahtinen Link: http://patchwork.freedesktop.org/patch/msgid/20170617115744.4452-1-chris@chris-wilson.co.uk Reviewed-by: Tvrtko Ursulin (cherry picked from commit 0caf81b5c53d9bd332a95dbcb44db8de0b397a7c) Signed-off-by: Daniel Vetter drivers/gpu/drm/i915/i915_debugfs.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit d8462d0ad350ccd399899de051060ee562a5e537 Author: Chris Wilson Date: Tue Jun 20 13:43:19 2017 +0100 drm/i915: Retire the VMA's fence tracker before unbinding Since we may track unfenced access (GPU access to the vma that explicitly requires no fence), vma->last_fence may be set without any attached fence (vma->fence) and so will not be flushed when we call i915_vma_put_fence(). Since we stopped doing a full retire of the activity trackers for unbind, we need to explicitly retire each tracker. Fixes: b0decaf75bd9 ("drm/i915: Track active vma requests") Signed-off-by: Chris Wilson Cc: Joonas Lahtinen Cc: Tvrtko Ursulin Link: http://patchwork.freedesktop.org/patch/msgid/20170620124321.1108-1-chris@chris-wilson.co.uk Reviewed-by: Tvrtko Ursulin (cherry picked from commit 760a898d8069111704e1bd43f00ebf369ae46e57) Signed-off-by: Daniel Vetter drivers/gpu/drm/i915/i915_vma.c | 5 +++++ 1 file changed, 5 insertions(+) commit c0bc126f97fb929b3ae02c1c62322645d70eb408 Author: Linus Torvalds Date: Sun Jun 25 18:30:05 2017 -0700 Linux 4.12-rc7 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a4fd8b3accf43d407472e34403d4b0a4df5c0e71 Merge: 5f4b37d 26fcd95 Author: Linus Torvalds Date: Sun Jun 25 12:01:56 2017 -0700 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Thomas Gleixner: "A single fix to unbreak the vdso32 build for 64bit kernels caused by excess #includes in the mshyperv header" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mshyperv: Remove excess #includes from mshyperv.h commit 5f4b37d8784da4217ede8f8bcd301686853dcf8c Merge: 35d8d5d 8e6cec1c Author: Linus Torvalds Date: Sun Jun 25 11:59:19 2017 -0700 Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fixes from Thomas Gleixner: "A few fixes for timekeeping and timers: - Plug a subtle race due to a missing READ_ONCE() in the timekeeping code where reloading of a pointer results in an inconsistent callback argument being supplied to the clocksource->read function. - Correct the CLOCK_MONOTONIC_RAW sub-nanosecond accounting in the time keeping core code, to prevent a possible discontuity. - Apply a similar fix to the arm64 vdso clock_gettime() implementation - Add missing includes to clocksource drivers, which relied on indirect includes which fails in certain configs. - Use the proper iomem pointer for read/iounmap in a probe function" * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: arm64/vdso: Fix nsec handling for CLOCK_MONOTONIC_RAW time: Fix CLOCK_MONOTONIC_RAW sub-nanosecond accounting time: Fix clock->read(clock) race around clocksource changes clocksource: Explicitly include linux/clocksource.h when needed clocksource/drivers/arm_arch_timer: Fix read and iounmap of incorrect variable commit 35d8d5d47c0ef066197f629f71cdd6039693b86d Merge: 1a8cca1 977282e Author: Linus Torvalds Date: Sun Jun 25 11:55:21 2017 -0700 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Thomas Gleixner: "Three fixlets for perf: - Return the proper error code if aux buffers for a event are not supported. - Calculate the probe offset for inlined functions correctly - Update the Skylake DTLB load/store miss event so it can count 1G TLB entries as well" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf probe: Fix probe definition for inlined functions perf/x86/intel: Add 1G DTLB load/store miss support for SKL perf/aux: Correct return code of rb_alloc_aux() if !has_aux(ev) commit 1a8cca1880e6127a22cf6604b3c4ccd8b27cbf65 Merge: 412572b 9f93d87 Author: Linus Torvalds Date: Sun Jun 25 11:53:36 2017 -0700 Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fix from Thomas Gleixner: "A single fix for the MIPS GIC to prevent ftrace recursion" * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/mips-gic: Mark count and compare accessors notrace commit 412572bffa9d1bc0f3ebae39291a815dad1d0418 Merge: d5d5c18 9768935 Author: Linus Torvalds Date: Sun Jun 25 10:39:43 2017 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - a quirk to i8042 to ignore timeout bit on Lifebook AH544 - a fixup to Synaptics RMI function 54 that was breaking some Dells - a fix for memory leak in soc_button_array driver * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: synaptics-rmi4 - only read the F54 query registers which are used Input: i8042 - add Fujitsu Lifebook AH544 to notimeout list Input: soc_button_array - fix leaking the ACPI button descriptor buffer commit d5d5c1825e85a144e67448ad777eff441ddb907f Merge: bb9b8fd abb85a9 Author: Linus Torvalds Date: Sun Jun 25 10:36:44 2017 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending Pull SCSI target fixes from Nicholas Bellinger: "Here are the target-pending fixes for v4.12-rc7 that have been queued up for the last 2 weeks. This includes: - Fix a TMR related kref underflow detected by the recent refcount_t conversion in upstream. - Fix a iscsi-target corner case during explicit connection logout timeout failure. - Address last fallout in iscsi-target immediate data handling from v4.4 target-core now allowing control CDB payload underflow" * git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending: iscsi-target: Reject immediate data underflow larger than SCSI transfer length iscsi-target: Fix delayed logout processing greater than SECONDS_FOR_LOGOUT_COMP target: Fix kref->refcount underflow in transport_cmd_finish_abort commit d747a7a51b00984127a88113cdbbc26f91e9d815 Author: WANG Cong Date: Sat Jun 24 23:50:30 2017 -0700 tcp: reset sk_rx_dst in tcp_disconnect() We have to reset the sk->sk_rx_dst when we disconnect a TCP connection, because otherwise when we re-connect it this dst reference is simply overridden in tcp_finish_connect(). This fixes a dst leak which leads to a loopback dev refcnt leak. It is a long-standing bug, Kevin reported a very similar (if not same) bug before. Thanks to Andrei for providing such a reliable reproducer which greatly narrows down the problem. Fixes: 41063e9dd119 ("ipv4: Early TCP socket demux.") Reported-by: Andrei Vagin Reported-by: Kevin Xu Signed-off-by: Cong Wang Signed-off-by: David S. Miller net/ipv4/tcp.c | 2 ++ 1 file changed, 2 insertions(+) commit 85cb73ff9b74785a7fc752875d7f0fe17ca3ea7c Author: Wei Wang Date: Fri Jun 23 15:25:37 2017 -0700 net: ipv6: reset daddr and dport in sk if connect() fails In __ip6_datagram_connect(), reset sk->sk_v6_daddr and inet->dport if error occurs. In udp_v6_early_demux(), check for sk_state to make sure it is in TCP_ESTABLISHED state. Together, it makes sure unconnected UDP socket won't be considered as a valid candidate for early demux. v3: add TCP_ESTABLISHED state check in udp_v6_early_demux() v2: fix compilation error Fixes: 5425077d73e0 ("net: ipv6: Add early demux handler for UDP unicast") Signed-off-by: Wei Wang Acked-by: Maciej Żenczykowski Signed-off-by: David S. Miller net/ipv6/datagram.c | 8 +++++++- net/ipv6/udp.c | 3 ++- 2 files changed, 9 insertions(+), 2 deletions(-) commit d0c32a16235aeacd32c9de6ff90f9219614d7e4e Author: Mintz, Yuval Date: Sat Jun 24 15:37:00 2017 +0300 bnx2x: Don't log mc removal needlessly When mc configuration changes bnx2x_config_mcast() can return 0 for success, negative for failure and positive for benign reason preventing its immediate work, e.g., when the command awaits the completion of a previously sent command. When removing all configured macs on a 578xx adapter, if a positive value would be returned driver would errneously log it as an error. Fixes: c7b7b483ccc9 ("bnx2x: Don't flush multicast MACs") Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bb9b8fd26b50c9ec822805b9d877bec9d88acff4 Merge: f65013d ad81810 Author: Linus Torvalds Date: Sat Jun 24 16:18:00 2017 -0700 Merge tag 'kbuild-fixes-v4.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fixes from Masahiro Yamada: "Nothing scary, just some random fixes: - fix warnings of host programs - fix "make tags" when COMPILED_SOURCE=1 is specified along with O= - clarify help message of C=1 option - fix dependency for ncurses compatibility check - fix "make headers_install" for fakechroot environment" * tag 'kbuild-fixes-v4.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kconfig: fix sparse warnings in nconfig kbuild: fix header installation under fakechroot environment kconfig: Check for libncurses before menuconfig Kbuild: tiny correction on `make help` tags: honor COMPILED_SOURCE with apart output directory genksyms: add printf format attribute to error_with_pos() commit f65013d655ac9639f37d3b54189f6468f672e60b Merge: 94a6df2 57db7e4 Author: Linus Torvalds Date: Sat Jun 24 02:24:53 2017 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace Pull timer fix from Eric Biederman: "This fixes an issue of confusing injected signals with the signals from posix timers that has existed since posix timers have been in the kernel. This patch is slightly simpler than my earlier version of this patch as I discovered in testing that I had misspelled "#ifdef CONFIG_POSIX_TIMERS". So I deleted that unnecessary test and made setting of resched_timer uncondtional. I have tested this and verified that without this patch there is a nasty hang that is easy to trigger, and with this patch everything works properly" Thomas Gleixner dixit: "It fixes the problem at hand and covers the ptrace case as well, which I missed. Reviewed-and-tested-by: Thomas Gleixner " * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: signal: Only reschedule timers on signals timers have sent commit 26fcd952d5c977a94ac64bb44ed409e37607b2c9 Author: Thomas Gleixner Date: Fri Jun 23 10:50:38 2017 +0200 x86/mshyperv: Remove excess #includes from mshyperv.h A recent commit included linux/slab.h in linux/irq.h. This breaks the build of vdso32 on a 64-bit kernel. The reason is that linux/irq.h gets included into the vdso code via linux/interrupt.h which is included from asm/mshyperv.h. That makes the 32-bit vdso compile fail, because slab.h includes the pgtable headers for 64-bit on a 64-bit build. Neither linux/clocksource.h nor linux/interrupt.h are needed in the mshyperv.h header file itself - it has a dependency on . Remove the includes and unbreak the build. Reported-by: Ingo Molnar Signed-off-by: Thomas Gleixner Cc: K. Y. Srinivasan Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Vitaly Kuznetsov Cc: devel@linuxdriverproject.org Fixes: dee863b571b0 ("hv: export current Hyper-V clocksource") Link: http://lkml.kernel.org/r/alpine.DEB.2.20.1706231038460.2647@nanos Signed-off-by: Ingo Molnar arch/x86/include/asm/mshyperv.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 94a6df251dd08c6436ebd6d10c68f03659148ce1 Merge: cd5545a 34f19ff Author: Linus Torvalds Date: Fri Jun 23 17:53:16 2017 -0700 Merge tag 'powerpc-4.12-7' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: "Some more powerpc fixes for 4.12. Most of these actually came in last week but got held up for some more testing. - three fixes for kprobes/ftrace/livepatch interactions. - properly handle data breakpoints when using the Radix MMU. - fix for perf sampling of registers during call_usermodehelper(). - properly initialise the thread_info on our emergency stacks - add an explicit flush when doing TLB invalidations for a process using NPU2. Thanks to: Alistair Popple, Naveen N. Rao, Nicholas Piggin, Ravi Bangoria, Masami Hiramatsu" * tag 'powerpc-4.12-7' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/64: Initialise thread_info for emergency stacks powerpc/powernv/npu-dma: Add explicit flush when sending an ATSD powerpc/perf: Fix oops when kthread execs user process powerpc/64s: Handle data breakpoints in Radix mode powerpc/kprobes: Skip livepatch_handler() for jprobes powerpc/ftrace: Pass the correct stack pointer for DYNAMIC_FTRACE_WITH_REGS powerpc/kprobes: Pause function_graph tracing during jprobes handling commit cd5545ae87ed9ca76dba7753b436713ce8df2872 Merge: ba6cbdb e4330d8b Author: Linus Torvalds Date: Fri Jun 23 17:49:12 2017 -0700 Merge tag 'acpi-4.12-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fix from Rafael Wysocki: "This fixes the ACPI-based enumeration of some I2C and SPI devices broken in 4.11. Specifics: - I2C and SPI devices are expected to be enumerated by the I2C and SPI subsystems, respectively, but due to a change made during the 4.11 cycle, in some cases the ACPI core marks them as already enumerated which causes the I2C and SPI subsystems to overlook them, so fix that (Jarkko Nikula)" * tag 'acpi-4.12-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI / scan: Fix enumeration for special SPI and I2C devices commit ba6cbdb673c287cee87a965266419fd2111e20c4 Merge: 25b2398 6c782a5 Author: Linus Torvalds Date: Fri Jun 23 17:46:10 2017 -0700 Merge branch 'i2c/for-current-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fix from Wolfram Sang. * 'i2c/for-current-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: imx: Use correct function to write to register commit 25b2398f5c0167accd6d0ab18db0561ac22ca6cc Merge: 51c933f 6c7515c Author: Linus Torvalds Date: Fri Jun 23 17:40:41 2017 -0700 Merge tag 'gpio-v4.12-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO fix from Linus Walleij: "A single GPIO patch fixing the compatible string for the MVEBU PWM controller embedded in the GPIO controller before we release v4.12. Hopefully" * tag 'gpio-v4.12-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: gpio: mvebu: change compatible string for PWM support commit 51c933f208c51b3e5371779ba3c246bde144ed11 Merge: 311548f c7ecb90 Author: Linus Torvalds Date: Fri Jun 23 17:37:56 2017 -0700 Merge tag 'sound-4.12-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Nothing exciting here, just a few stable fixes: - suppress spurious kernel WARNING in PCM core - fix potential spin deadlock at error handling in firewire - HD-audio PCI ID addition / fixup" * tag 'sound-4.12-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda - Apply quirks to Broxton-T, too ALSA: firewire-lib: Fix stall of process context at packet error ALSA: pcm: Don't treat NULL chmap as a fatal error ALSA: hda - Add Coffelake PCI ID commit 311548f173ff53bd4c7407eaf52097d00d2ea4de Merge: 7139a06 33ce756 Author: Linus Torvalds Date: Fri Jun 23 17:35:57 2017 -0700 Merge tag 'drm-fixes-for-v4.12-rc7' of git://people.freedesktop.org/~airlied/linux Pull drm fixes from Dave Airlie: "A varied bunch of fixes, one for an API regression with connectors. Otherwise amdgpu and i915 have a bunch of varied fixes, the shrinker ones being the most important" * tag 'drm-fixes-for-v4.12-rc7' of git://people.freedesktop.org/~airlied/linux: drm: Fix GETCONNECTOR regression drm/radeon: add a quirk for Toshiba Satellite L20-183 drm/radeon: add a PX quirk for another K53TK variant drm/amdgpu: adjust default display clock drm/amdgpu/atom: fix ps allocation size for EnableDispPowerGating drm/amdgpu: add Polaris12 DID drm/i915: Don't enable backlight at setup time. drm/i915: Plumb the correct acquire ctx into intel_crtc_disable_noatomic() drm/i915: Fix deadlock witha the pipe A quirk during resume drm/i915: Remove __GFP_NORETRY from our buffer allocator drm/i915: Encourage our shrinker more when our shmemfs allocations fails drm/i915: Differentiate between sw write location into ring and last hw read commit 7139a06b1637fa09d826997d6b869c59d40ac5c1 Merge: 7ec2f7e 4a072c7 Author: Linus Torvalds Date: Fri Jun 23 17:33:46 2017 -0700 Merge tag 'random_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/random Pull random fixes from Ted Ts'o: "Fix some locking and gcc optimization issues from the most recent random_for_linus_stable pull request" * tag 'random_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/random: random: silence compiler warnings and fix race commit 7ec2f7e8d9b5d4186e407cdc0a3a84a932bc52f5 Merge: 337c6ba feb7695 Author: Linus Torvalds Date: Fri Jun 23 17:32:05 2017 -0700 Merge tag 'for-4.12/dm-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: - a revert of a DM mirror commit that has proven to make the code prone to crash - a DM io reference count fix that resolves a NULL pointer seen when issuing discards to a DM mirror target's device whose mirror legs do not all support discards - a couple DM integrity fixes * tag 'for-4.12/dm-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm io: fix duplicate bio completion due to missing ref count dm integrity: fix to not disable/enable interrupts from interrupt context Revert "dm mirror: use all available legs on multiple failures" dm integrity: reject mappings too large for device commit 337c6ba2d8691596bcada9e73eb40f612e4f5735 Merge: 2592d2e 98da7d0 Author: Linus Torvalds Date: Fri Jun 23 16:30:52 2017 -0700 Merge branch 'akpm' (patches from Andrew) Merge misc fixes from Andrew Morton: "8 fixes" * emailed patches from Andrew Morton : fs/exec.c: account for argv/envp pointers ocfs2: fix deadlock caused by recursive locking in xattr slub: make sysfs file removal asynchronous lib/cmdline.c: fix get_options() overflow while parsing ranges fs/dax.c: fix inefficiency in dax_writeback_mapping_range() autofs: sanity check status reported with AUTOFS_DEV_IOCTL_FAIL mm/vmalloc.c: huge-vmap: fail gracefully on unexpected huge vmap mappings mm, thp: remove cond_resched from __collapse_huge_page_copy commit 98da7d08850fb8bdeb395d6368ed15753304aa0c Author: Kees Cook Date: Fri Jun 23 15:08:57 2017 -0700 fs/exec.c: account for argv/envp pointers When limiting the argv/envp strings during exec to 1/4 of the stack limit, the storage of the pointers to the strings was not included. This means that an exec with huge numbers of tiny strings could eat 1/4 of the stack limit in strings and then additional space would be later used by the pointers to the strings. For example, on 32-bit with a 8MB stack rlimit, an exec with 1677721 single-byte strings would consume less than 2MB of stack, the max (8MB / 4) amount allowed, but the pointers to the strings would consume the remaining additional stack space (1677721 * 4 == 6710884). The result (1677721 + 6710884 == 8388605) would exhaust stack space entirely. Controlling this stack exhaustion could result in pathological behavior in setuid binaries (CVE-2017-1000365). [akpm@linux-foundation.org: additional commenting from Kees] Fixes: b6a2fea39318 ("mm: variable length argument support") Link: http://lkml.kernel.org/r/20170622001720.GA32173@beast Signed-off-by: Kees Cook Acked-by: Rik van Riel Acked-by: Michal Hocko Cc: Alexander Viro Cc: Qualys Security Advisory Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/exec.c | 28 ++++++++++++++++++++++++---- 1 file changed, 24 insertions(+), 4 deletions(-) commit 8818efaaacb78c60a9d90c5705b6c99b75d7d442 Author: Eric Ren Date: Fri Jun 23 15:08:55 2017 -0700 ocfs2: fix deadlock caused by recursive locking in xattr Another deadlock path caused by recursive locking is reported. This kind of issue was introduced since commit 743b5f1434f5 ("ocfs2: take inode lock in ocfs2_iop_set/get_acl()"). Two deadlock paths have been fixed by commit b891fa5024a9 ("ocfs2: fix deadlock issue when taking inode lock at vfs entry points"). Yes, we intend to fix this kind of case in incremental way, because it's hard to find out all possible paths at once. This one can be reproduced like this. On node1, cp a large file from home directory to ocfs2 mountpoint. While on node2, run setfacl/getfacl. Both nodes will hang up there. The backtraces: On node1: __ocfs2_cluster_lock.isra.39+0x357/0x740 [ocfs2] ocfs2_inode_lock_full_nested+0x17d/0x840 [ocfs2] ocfs2_write_begin+0x43/0x1a0 [ocfs2] generic_perform_write+0xa9/0x180 __generic_file_write_iter+0x1aa/0x1d0 ocfs2_file_write_iter+0x4f4/0xb40 [ocfs2] __vfs_write+0xc3/0x130 vfs_write+0xb1/0x1a0 SyS_write+0x46/0xa0 On node2: __ocfs2_cluster_lock.isra.39+0x357/0x740 [ocfs2] ocfs2_inode_lock_full_nested+0x17d/0x840 [ocfs2] ocfs2_xattr_set+0x12e/0xe80 [ocfs2] ocfs2_set_acl+0x22d/0x260 [ocfs2] ocfs2_iop_set_acl+0x65/0xb0 [ocfs2] set_posix_acl+0x75/0xb0 posix_acl_xattr_set+0x49/0xa0 __vfs_setxattr+0x69/0x80 __vfs_setxattr_noperm+0x72/0x1a0 vfs_setxattr+0xa7/0xb0 setxattr+0x12d/0x190 path_setxattr+0x9f/0xb0 SyS_setxattr+0x14/0x20 Fix this one by using ocfs2_inode_{lock|unlock}_tracker, which is exported by commit 439a36b8ef38 ("ocfs2/dlmglue: prepare tracking logic to avoid recursive cluster lock"). Link: http://lkml.kernel.org/r/20170622014746.5815-1-zren@suse.com Fixes: 743b5f1434f5 ("ocfs2: take inode lock in ocfs2_iop_set/get_acl()") Signed-off-by: Eric Ren Reported-by: Thomas Voegtle Tested-by: Thomas Voegtle Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/ocfs2/dlmglue.c | 4 ++++ fs/ocfs2/xattr.c | 23 +++++++++++++---------- 2 files changed, 17 insertions(+), 10 deletions(-) commit 3b7b314053d021601940c50b07f5f1423ae67e21 Author: Tejun Heo Date: Fri Jun 23 15:08:52 2017 -0700 slub: make sysfs file removal asynchronous Commit bf5eb3de3847 ("slub: separate out sysfs_slab_release() from sysfs_slab_remove()") made slub sysfs file removals synchronous to kmem_cache shutdown. Unfortunately, this created a possible ABBA deadlock between slab_mutex and sysfs draining mechanism triggering the following lockdep warning. ====================================================== [ INFO: possible circular locking dependency detected ] 4.10.0-test+ #48 Not tainted ------------------------------------------------------- rmmod/1211 is trying to acquire lock: (s_active#120){++++.+}, at: [] kernfs_remove+0x23/0x40 but task is already holding lock: (slab_mutex){+.+.+.}, at: [] kmem_cache_destroy+0x41/0x2d0 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (slab_mutex){+.+.+.}: lock_acquire+0xf6/0x1f0 __mutex_lock+0x75/0x950 mutex_lock_nested+0x1b/0x20 slab_attr_store+0x75/0xd0 sysfs_kf_write+0x45/0x60 kernfs_fop_write+0x13c/0x1c0 __vfs_write+0x28/0x120 vfs_write+0xc8/0x1e0 SyS_write+0x49/0xa0 entry_SYSCALL_64_fastpath+0x1f/0xc2 -> #0 (s_active#120){++++.+}: __lock_acquire+0x10ed/0x1260 lock_acquire+0xf6/0x1f0 __kernfs_remove+0x254/0x320 kernfs_remove+0x23/0x40 sysfs_remove_dir+0x51/0x80 kobject_del+0x18/0x50 __kmem_cache_shutdown+0x3e6/0x460 kmem_cache_destroy+0x1fb/0x2d0 kvm_exit+0x2d/0x80 [kvm] vmx_exit+0x19/0xa1b [kvm_intel] SyS_delete_module+0x198/0x1f0 entry_SYSCALL_64_fastpath+0x1f/0xc2 other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(slab_mutex); lock(s_active#120); lock(slab_mutex); lock(s_active#120); *** DEADLOCK *** 2 locks held by rmmod/1211: #0: (cpu_hotplug.dep_map){++++++}, at: [] get_online_cpus+0x37/0x80 #1: (slab_mutex){+.+.+.}, at: [] kmem_cache_destroy+0x41/0x2d0 stack backtrace: CPU: 3 PID: 1211 Comm: rmmod Not tainted 4.10.0-test+ #48 Hardware name: Hewlett-Packard HP Compaq Pro 6300 SFF/339A, BIOS K01 v02.05 05/07/2012 Call Trace: print_circular_bug+0x1be/0x210 __lock_acquire+0x10ed/0x1260 lock_acquire+0xf6/0x1f0 __kernfs_remove+0x254/0x320 kernfs_remove+0x23/0x40 sysfs_remove_dir+0x51/0x80 kobject_del+0x18/0x50 __kmem_cache_shutdown+0x3e6/0x460 kmem_cache_destroy+0x1fb/0x2d0 kvm_exit+0x2d/0x80 [kvm] vmx_exit+0x19/0xa1b [kvm_intel] SyS_delete_module+0x198/0x1f0 ? SyS_delete_module+0x5/0x1f0 entry_SYSCALL_64_fastpath+0x1f/0xc2 It'd be the cleanest to deal with the issue by removing sysfs files without holding slab_mutex before the rest of shutdown; however, given the current code structure, it is pretty difficult to do so. This patch punts sysfs file removal to a work item. Before commit bf5eb3de3847, the removal was punted to a RCU delayed work item which is executed after release. Now, we're punting to a different work item on shutdown which still maintains the goal removing the sysfs files earlier when destroying kmem_caches. Link: http://lkml.kernel.org/r/20170620204512.GI21326@htj.duckdns.org Fixes: bf5eb3de3847 ("slub: separate out sysfs_slab_release() from sysfs_slab_remove()") Signed-off-by: Tejun Heo Reported-by: Steven Rostedt (VMware) Tested-by: Steven Rostedt (VMware) Cc: Christoph Lameter Cc: Pekka Enberg Cc: David Rientjes Cc: Joonsoo Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/slub_def.h | 1 + mm/slub.c | 40 ++++++++++++++++++++++++++-------------- 2 files changed, 27 insertions(+), 14 deletions(-) commit a91e0f680bcd9e10c253ae8b62462a38bd48f09f Author: Ilya Matveychikov Date: Fri Jun 23 15:08:49 2017 -0700 lib/cmdline.c: fix get_options() overflow while parsing ranges When using get_options() it's possible to specify a range of numbers, like 1-100500. The problem is that it doesn't track array size while calling internally to get_range() which iterates over the range and fills the memory with numbers. Link: http://lkml.kernel.org/r/2613C75C-B04D-4BFF-82A6-12F97BA0F620@gmail.com Signed-off-by: Ilya V. Matveychikov Cc: Jonathan Corbet Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds lib/cmdline.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 1eb643d02b21412e603b42cdd96010a2ac31c05f Author: Jan Kara Date: Fri Jun 23 15:08:46 2017 -0700 fs/dax.c: fix inefficiency in dax_writeback_mapping_range() dax_writeback_mapping_range() fails to update iteration index when searching radix tree for entries needing cache flushing. Thus each pagevec worth of entries is searched starting from the start which is inefficient and prone to livelocks. Update index properly. Link: http://lkml.kernel.org/r/20170619124531.21491-1-jack@suse.cz Fixes: 9973c98ecfda3 ("dax: add support for fsync/sync") Signed-off-by: Jan Kara Reviewed-by: Ross Zwisler Cc: Dan Williams Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/dax.c | 1 + 1 file changed, 1 insertion(+) commit 9fa4eb8e490a28de40964b1b0e583d8db4c7e57c Author: NeilBrown Date: Fri Jun 23 15:08:43 2017 -0700 autofs: sanity check status reported with AUTOFS_DEV_IOCTL_FAIL If a positive status is passed with the AUTOFS_DEV_IOCTL_FAIL ioctl, autofs4_d_automount() will return ERR_PTR(status) with that status to follow_automount(), which will then dereference an invalid pointer. So treat a positive status the same as zero, and map to ENOENT. See comment in systemd src/core/automount.c::automount_send_ready(). Link: http://lkml.kernel.org/r/871sqwczx5.fsf@notabene.neil.brown.name Signed-off-by: NeilBrown Cc: Ian Kent Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/autofs4/dev-ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 029c54b09599573015a5c18dbe59cbdf42742237 Author: Ard Biesheuvel Date: Fri Jun 23 15:08:41 2017 -0700 mm/vmalloc.c: huge-vmap: fail gracefully on unexpected huge vmap mappings Existing code that uses vmalloc_to_page() may assume that any address for which is_vmalloc_addr() returns true may be passed into vmalloc_to_page() to retrieve the associated struct page. This is not un unreasonable assumption to make, but on architectures that have CONFIG_HAVE_ARCH_HUGE_VMAP=y, it no longer holds, and we need to ensure that vmalloc_to_page() does not go off into the weeds trying to dereference huge PUDs or PMDs as table entries. Given that vmalloc() and vmap() themselves never create huge mappings or deal with compound pages at all, there is no correct answer in this case, so return NULL instead, and issue a warning. When reading /proc/kcore on arm64, you will hit an oops as soon as you hit the huge mappings used for the various segments that make up the mapping of vmlinux. With this patch applied, you will no longer hit the oops, but the kcore contents willl be incorrect (these regions will be zeroed out) We are fixing this for kcore specifically, so it avoids vread() for those regions. At least one other problematic user exists, i.e., /dev/kmem, but that is currently broken on arm64 for other reasons. Link: http://lkml.kernel.org/r/20170609082226.26152-1-ard.biesheuvel@linaro.org Signed-off-by: Ard Biesheuvel Acked-by: Mark Rutland Reviewed-by: Laura Abbott Cc: Michal Hocko Cc: zhong jiang Cc: Dave Hansen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/vmalloc.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) commit c891d9f6bf2a78c9c657656872a60807820db4c8 Author: David Rientjes Date: Fri Jun 23 15:08:38 2017 -0700 mm, thp: remove cond_resched from __collapse_huge_page_copy This is a partial revert of commit 338a16ba1549 ("mm, thp: copying user pages must schedule on collapse") which added a cond_resched() to __collapse_huge_page_copy(). On x86 with CONFIG_HIGHPTE, __collapse_huge_page_copy is called in atomic context and thus scheduling is not possible. This is only a possible config on arm and i386. Although need_resched has been shown to be set for over 100 jiffies while doing the iteration in __collapse_huge_page_copy, this is better than doing if (in_atomic()) cond_resched() to cover only non-CONFIG_HIGHPTE configs. Link: http://lkml.kernel.org/r/alpine.DEB.2.10.1706191341550.97821@chino.kir.corp.google.com Signed-off-by: David Rientjes Reported-by: Larry Finger Tested-by: Larry Finger Acked-by: Michal Hocko Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/khugepaged.c | 1 - 1 file changed, 1 deletion(-) commit 2592d2ef0448e24878fce24c3fc0ca525f65f286 Merge: 7b249bd 02d94e0 Author: Linus Torvalds Date: Fri Jun 23 12:25:37 2017 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Two fixes to remove spurious WARN_ONs from the new(ish) qedi driver. The driver already prints a warning message, there's no need to panic users by printing something that looks like an oops as well" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: qedi: Remove WARN_ON from clear task context. scsi: qedi: Remove WARN_ON for untracked cleanup. commit 7b249bdc3dec656b87bc569d4adcccbfbd525ec1 Merge: a38371c eb5e248 Author: Linus Torvalds Date: Fri Jun 23 12:23:06 2017 -0700 Merge tag 'xfs-4.12-fixes-5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Darrick Wong: "I have one more bugfix for you for 4.12-rc7 to fix a disk corruption problem: - don't allow swapon on files on the realtime device, because the swap code will swap pages out to blocks on the data device, thereby corrupting the filesystem" * tag 'xfs-4.12-fixes-5' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: don't allow bmap on rt files commit 92cc8a5105e1236584e92288595ddbd2149bb6cf Merge: db9d8b2 2270bc5 Author: David S. Miller Date: Fri Jun 23 14:48:28 2017 -0400 Merge branch 'bnxt_en-fixes' Michael Chan says: ==================== bnxt_en: Error handling and netpoll fixes. Add missing error handling and fix netpoll handling. The current code handles RX and TX events in netpoll mode and is causing lots of warnings and errors in the RX code path in netpoll mode. The fix is to only handle TX events in netpoll mode. ==================== Signed-off-by: David S. Miller commit 2270bc5da34979454e6f2eb133d800b635156174 Author: Michael Chan Date: Fri Jun 23 14:01:01 2017 -0400 bnxt_en: Fix netpoll handling. To handle netpoll properly, the driver must only handle TX packets during NAPI. Handling RX events cause warnings and errors in netpoll mode. The ndo_poll_controller() method should call napi_schedule() directly so that a NAPI weight of zero will be used during netpoll mode. The bnxt_en driver supports 2 ring modes: combined, and separate rx/tx. In separate rx/tx mode, the ndo_poll_controller() method will only process the tx rings. In combined mode, the rx and tx completion entries are mixed in the completion ring and we need to drop the rx entries and recycle the rx buffers. Add a function bnxt_force_rx_discard() to handle this in netpoll mode when we see rx entries in combined ring mode. Reported-by: Calvin Owens Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 54 +++++++++++++++++++++++++++---- 1 file changed, 48 insertions(+), 6 deletions(-) commit 69c149e2e39e8d66437c9034bb4926ef2c1f7c23 Author: Michael Chan Date: Fri Jun 23 14:01:00 2017 -0400 bnxt_en: Add missing logic to handle TPA end error conditions. When we get a TPA_END completion to handle a completed LRO packet, it is possible that hardware would indicate errors. The current code is not checking for the error condition. Define the proper error bits and the macro to check for this error and abort properly. Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 7 ++++--- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 6 +++++- 2 files changed, 9 insertions(+), 4 deletions(-) commit db9d8b29d19d2801793e4419f4c6272bf8951c62 Author: Richard Cochran Date: Fri Jun 23 17:51:31 2017 +0200 net: dp83640: Avoid NULL pointer dereference. The function, skb_complete_tx_timestamp(), used to allow passing in a NULL pointer for the time stamps, but that was changed in commit 62bccb8cdb69051b95a55ab0c489e3cab261c8ef ("net-timestamp: Make the clone operation stand-alone from phy timestamping"), and the existing call sites, all of which are in the dp83640 driver, were fixed up. Even though the kernel-doc was subsequently updated in commit 7a76a021cd5a292be875fbc616daf03eab1e6996 ("net-timestamp: Update skb_complete_tx_timestamp comment"), still a bug fix from Manfred Rudigier came into the driver using the old semantics. Probably Manfred derived that patch from an older kernel version. This fix should be applied to the stable trees as well. Fixes: 81e8f2e930fe ("net: dp83640: Fix tx timestamp overflow handling.") Signed-off-by: Richard Cochran Signed-off-by: David S. Miller drivers/net/phy/dp83640.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 43b786c6765945310cabc61a5e29b97ced85f7f0 Merge: 0ccc22f ca3a1b8 Author: David S. Miller Date: Fri Jun 23 14:11:26 2017 -0400 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2017-06-23 1) Fix xfrm garbage collecting when unregistering a netdevice. From Hangbin Liu. 2) Fix NULL pointer derefernce when exiting a network namespace. From Hangbin Liu. 3) Fix some error codes in pfkey to prevent a NULL pointer derefernce. From Dan Carpenter. 4) Fix NULL pointer derefernce on allocation failure in pfkey. From Dan Carpenter. 5) Adjust IPv6 payload_len to include extension headers. Otherwise we corrupt the packets when doing ESP GRO on transport mode. From Yossi Kuperman. 6) Set nhoff to the proper offset of the IPv6 nexthdr when doing ESP GRO. From Yossi Kuperman. Please pull or let me know if there are problems. ==================== Signed-off-by: David S. Miller commit 0ccc22f425e56c4ede9c66f1945846de8ac1f352 Author: WANG Cong Date: Thu Jun 22 15:29:33 2017 -0700 sit: use __GFP_NOWARN for user controlled allocation The memory allocation size is controlled by user-space, if it is too large just fail silently and return NULL, not to mention there is a fallback allocation later. Reported-by: Andrey Konovalov Signed-off-by: Cong Wang Tested-by: Andrey Konovalov Signed-off-by: David S. Miller net/ipv6/sit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a5cb659bbc1c8644efa0c3138a757a1e432a4880 Author: Michal Kubeček Date: Mon Jun 19 13:03:43 2017 +0200 net: account for current skb length when deciding about UFO Our customer encountered stuck NFS writes for blocks starting at specific offsets w.r.t. page boundary caused by networking stack sending packets via UFO enabled device with wrong checksum. The problem can be reproduced by composing a long UDP datagram from multiple parts using MSG_MORE flag: sendto(sd, buff, 1000, MSG_MORE, ...); sendto(sd, buff, 1000, MSG_MORE, ...); sendto(sd, buff, 3000, 0, ...); Assume this packet is to be routed via a device with MTU 1500 and NETIF_F_UFO enabled. When second sendto() gets into __ip_append_data(), this condition is tested (among others) to decide whether to call ip_ufo_append_data(): ((length + fragheaderlen) > mtu) || (skb && skb_is_gso(skb)) At the moment, we already have skb with 1028 bytes of data which is not marked for GSO so that the test is false (fragheaderlen is usually 20). Thus we append second 1000 bytes to this skb without invoking UFO. Third sendto(), however, has sufficient length to trigger the UFO path so that we end up with non-UFO skb followed by a UFO one. Later on, udp_send_skb() uses udp_csum() to calculate the checksum but that assumes all fragments have correct checksum in skb->csum which is not true for UFO fragments. When checking against MTU, we need to add skb->len to length of new segment if we already have a partially filled skb and fragheaderlen only if there isn't one. In the IPv6 case, skb can only be null if this is the first segment so that we have to use headersize (length of the first IPv6 header) rather than fragheaderlen (length of IPv6 header of further fragments) for skb == NULL. Fixes: e89e9cf539a2 ("[IPv4/IPv6]: UFO Scatter-gather approach") Fixes: e4c5e13aa45c ("ipv6: Should use consistent conditional judgement for ip6 fragment between __ip6_append_data and ip6_finish_output") Signed-off-by: Michal Kubecek Acked-by: Vlad Yasevich Signed-off-by: David S. Miller net/ipv4/ip_output.c | 3 ++- net/ipv6/ip6_output.c | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) commit c4d097d13052d1e6f29b8798264aed6135d99568 Author: Heinz Mauelshagen Date: Fri Jun 23 17:27:01 2017 +0200 dm raid: fix oops on upgrading to extended superblock format When a RAID set was created on dm-raid version < 1.9.0 (old RAID superblock format), all of the new 1.9.0 members of the superblock are uninitialized (zero) -- including the device sectors member needed to support shrinking. All the other accesses to superblock fields new in 1.9.0 were reviewed and verified to be properly guarded against invalid use. The 'sectors' member was the only one used when the superblock version is < 1.9. Don't access the superblock's >= 1.9.0 'sectors' member unconditionally. Also add respective comments. Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer drivers/md/dm-raid.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) commit 977282ed17a0213c84d59498a1e3f7088e211470 Merge: fb3a505 7598f8b Author: Ingo Molnar Date: Fri Jun 23 10:03:27 2017 +0200 Merge tag 'perf-urgent-for-mingo-4.12-20170622' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull 'perf probe' fix from Arnaldo Carvalho de Melo: - Do not double the offset of inline expansions when using 'perf probe' on inlined functions (Björn Töpel) Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit 9768935264c4f0e4afd788a185d8e8d89c28e41d Author: Andrew Duggan Date: Fri Jun 23 00:04:51 2017 -0700 Input: synaptics-rmi4 - only read the F54 query registers which are used The F54 driver is currently only using the first 6 bytes of F54 so there is no need to read all 27 bytes. Some Dell systems (Dell XP13 9333 and similar) have an issue with the touchpad or I2C bus when reading reports larger then 16 bytes. Reads larger then 16 bytes are reported in two HID reports. Something about the back to back reports seems to cause the next read to report incorrect data. This results in F30 failing to load and the click button failing to work. Previous issues with the I2C controller or touchpad were addressed in: commit 5b65c2a02966 ("HID: rmi: check sanity of the incoming report") Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=195949 Signed-off-by: Andrew Duggan Reviewed-by: Benjamin Tissoires Reviewed-by: Nick Dyer Signed-off-by: Dmitry Torokhov drivers/input/rmi4/rmi_f54.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) commit 797625deaedd9a0621376817db2813244b3246e3 Author: Christophe Lombard Date: Tue Jun 13 17:41:05 2017 +0200 cxl: Fixes for Coherent Accelerator Interface Architecture 2.0 A previous set of patches "cxl: Add support for Coherent Accelerator Interface Architecture 2.0" has introduced a new support for the CAPI cards. These patches have been tested on Simulation environment and quite a bit of them have been tested on real hardware. This patch brings new fixes after a series of tests carried out on new equipment: - Add POWER9 definition. - Re-enable any masked interrupts when the AFU is not activated after resetting the AFU. - Remove the api cxl_is_psl8/9 which is no longer useful. - Do not dump CAPI1 registers. - Rewrite cxl_is_page_fault() function. - Do not register slb callack on P9. Fixes: f24be42aab37 ("cxl: Add psl9 specific code") Signed-off-by: Christophe Lombard Acked-by: Frederic Barrat Signed-off-by: Michael Ellerman drivers/misc/cxl/context.c | 6 +++--- drivers/misc/cxl/cxl.h | 18 +++++------------- drivers/misc/cxl/fault.c | 23 +++++++++++++++-------- drivers/misc/cxl/main.c | 17 +++++++++++++---- drivers/misc/cxl/native.c | 29 +++++++++++++++++------------ drivers/misc/cxl/pci.c | 11 ++++------- 6 files changed, 57 insertions(+), 47 deletions(-) commit 34f19ff1b5a0d11e46df479623d6936460105c9f Author: Nicholas Piggin Date: Wed Jun 21 15:58:29 2017 +1000 powerpc/64: Initialise thread_info for emergency stacks Emergency stacks have their thread_info mostly uninitialised, which in particular means garbage preempt_count values. Emergency stack code runs with interrupts disabled entirely, and is used very rarely, so this has been unnoticed so far. It was found by a proposed new powerpc watchdog that takes a soft-NMI directly from the masked_interrupt handler and using the emergency stack. That crashed at BUG_ON(in_nmi()) in nmi_enter(). preempt_count()s were found to be garbage. To fix this, zero the entire THREAD_SIZE allocation, and initialize the thread_info. Cc: stable@vger.kernel.org Reported-by: Abdul Haleem Signed-off-by: Nicholas Piggin [mpe: Move it all into setup_64.c, use a function not a macro. Fix crashes on Cell by setting preempt_count to 0 not HARDIRQ_OFFSET] Signed-off-by: Michael Ellerman arch/powerpc/kernel/setup_64.c | 31 ++++++++++++++++++++++++++++--- 1 file changed, 28 insertions(+), 3 deletions(-) commit 33ce7563a4858430fdf38bb867513d3fbc3dda65 Merge: 816b4e4 e94ac35 Author: Dave Airlie Date: Fri Jun 23 11:44:51 2017 +1000 Merge tag 'drm-misc-fixes-2017-06-22' of git://anongit.freedesktop.org/git/drm-misc into drm-fixes UAPI Changes: - drm: Fix regression in GETCONNECTOR ioctl returning stale properties (Daniel) Cc: Daniel Vetter * tag 'drm-misc-fixes-2017-06-22' of git://anongit.freedesktop.org/git/drm-misc: drm: Fix GETCONNECTOR regression commit ad8181060788c80c0ad75b583f24c22fa962a7a6 Author: Randy Dunlap Date: Mon May 22 18:44:57 2017 -0700 kconfig: fix sparse warnings in nconfig Fix sparse warnings in scripts/kconfig/nconf* ('make nconfig'): ../scripts/kconfig/nconf.c:1071:32: warning: Using plain integer as NULL pointer ../scripts/kconfig/nconf.c:1238:30: warning: Using plain integer as NULL pointer ../scripts/kconfig/nconf.c:511:51: warning: Using plain integer as NULL pointer ../scripts/kconfig/nconf.c:1460:6: warning: symbol 'setup_windows' was not declared. Should it be static? ../scripts/kconfig/nconf.c:274:12: warning: symbol 'current_instructions' was not declared. Should it be static? ../scripts/kconfig/nconf.c:308:22: warning: symbol 'function_keys' was not declared. Should it be static? ../scripts/kconfig/nconf.gui.c:132:17: warning: non-ANSI function declaration of function 'set_colors' ../scripts/kconfig/nconf.gui.c:195:24: warning: Using plain integer as NULL pointer nconf.gui.o before/after files are the same. nconf.o before/after files are the same until the 'static' function declarations are added. Signed-off-by: Randy Dunlap Signed-off-by: Masahiro Yamada scripts/kconfig/nconf.c | 12 ++++++------ scripts/kconfig/nconf.gui.c | 4 ++-- 2 files changed, 8 insertions(+), 8 deletions(-) commit 7598f8bc1383ffd77686cb4e92e749bef3c75937 Author: Björn Töpel Date: Wed Jun 21 18:41:34 2017 +0200 perf probe: Fix probe definition for inlined functions In commit 613f050d68a8 ("perf probe: Fix to probe on gcc generated functions in modules"), the offset from symbol is, incorrectly, added to the trace point address. This leads to incorrect probe trace points for inlined functions and when using relative line number on symbols. Prior this patch: $ perf probe -m nf_nat -D in_range p:probe/in_range nf_nat:in_range.isra.9+0 $ perf probe -m i40e -D i40e_clean_rx_irq p:probe/i40e_clean_rx_irq i40e:i40e_napi_poll+2212 $ perf probe -m i40e -D i40e_clean_rx_irq:16 p:probe/i40e_clean_rx_irq i40e:i40e_lan_xmit_frame+626 After: $ perf probe -m nf_nat -D in_range p:probe/in_range nf_nat:in_range.isra.9+0 $ perf probe -m i40e -D i40e_clean_rx_irq p:probe/i40e_clean_rx_irq i40e:i40e_napi_poll+1106 $ perf probe -m i40e -D i40e_clean_rx_irq:16 p:probe/i40e_clean_rx_irq i40e:i40e_napi_poll+2665 Committer testing: Using 'pfunct', a tool found in the 'dwarves' package [1], one can ask what are the functions that while not being explicitely marked as inline, were inlined by the compiler: # pfunct --cc_inlined /lib/modules/4.12.0-rc4+/kernel/drivers/net/ethernet/intel/e1000e/e1000e.ko | head __ew32 e1000_regdump e1000e_dump_ps_pages e1000_desc_unused e1000e_systim_to_hwtstamp e1000e_rx_hwtstamp e1000e_update_rdt_wa e1000e_update_tdt_wa e1000_put_txbuf e1000_consume_page Then ask 'perf probe' to produce the kprobe_tracer probe definitions for two of them: # perf probe -m e1000e -D e1000e_rx_hwtstamp p:probe/e1000e_rx_hwtstamp e1000e:e1000_receive_skb+74 # perf probe -m e1000e -D e1000_consume_page p:probe/e1000_consume_page e1000e:e1000_clean_jumbo_rx_irq+876 p:probe/e1000_consume_page_1 e1000e:e1000_clean_jumbo_rx_irq+1506 p:probe/e1000_consume_page_2 e1000e:e1000_clean_rx_irq_ps+1074 Now lets concentrate on the 'e1000_consume_page' one, that was inlined twice in e1000_clean_jumbo_rx_irq(), lets see what readelf says about the DWARF tags for that function: $ readelf -wi /lib/modules/4.12.0-rc4+/kernel/drivers/net/ethernet/intel/e1000e/e1000e.ko <1><13e27b>: Abbrev Number: 121 (DW_TAG_subprogram) <13e27c> DW_AT_name : (indirect string, offset: 0xa8945): e1000_clean_jumbo_rx_irq <13e287> DW_AT_low_pc : 0x17a30 <3><13e6ef>: Abbrev Number: 119 (DW_TAG_inlined_subroutine) <13e6f0> DW_AT_abstract_origin: <0x13ed2c> <13e6f4> DW_AT_low_pc : 0x17be6 <1><13ed2c>: Abbrev Number: 142 (DW_TAG_subprogram) <13ed2e> DW_AT_name : (indirect string, offset: 0xa54c3): e1000_consume_page So, the first time in e1000_clean_jumbo_rx_irq() where e1000_consume_page() is inlined is at PC 0x17be6, which subtracted from e1000_clean_jumbo_rx_irq()'s address, gives us the offset we should use in the probe definition: 0x17be6 - 0x17a30 = 438 but above we have 876, which is twice as much. Lets see the second inline expansion of e1000_consume_page() in e1000_clean_jumbo_rx_irq(): <3><13e86e>: Abbrev Number: 119 (DW_TAG_inlined_subroutine) <13e86f> DW_AT_abstract_origin: <0x13ed2c> <13e873> DW_AT_low_pc : 0x17d21 0x17d21 - 0x17a30 = 753 So we where adding it at twice the offset from the containing function as we should. And then after this patch: # perf probe -m e1000e -D e1000e_rx_hwtstamp p:probe/e1000e_rx_hwtstamp e1000e:e1000_receive_skb+37 # perf probe -m e1000e -D e1000_consume_page p:probe/e1000_consume_page e1000e:e1000_clean_jumbo_rx_irq+438 p:probe/e1000_consume_page_1 e1000e:e1000_clean_jumbo_rx_irq+753 p:probe/e1000_consume_page_2 e1000e:e1000_clean_jumbo_rx_irq+1353 # Which matches the two first expansions and shows that because we were doubling the offset it would spill over the next function: readelf -sw /lib/modules/4.12.0-rc4+/kernel/drivers/net/ethernet/intel/e1000e/e1000e.ko 673: 0000000000017a30 1626 FUNC LOCAL DEFAULT 2 e1000_clean_jumbo_rx_irq 674: 0000000000018090 2013 FUNC LOCAL DEFAULT 2 e1000_clean_rx_irq_ps This is the 3rd inline expansion of e1000_consume_page() in e1000_clean_jumbo_rx_irq(): <3><13ec77>: Abbrev Number: 119 (DW_TAG_inlined_subroutine) <13ec78> DW_AT_abstract_origin: <0x13ed2c> <13ec7c> DW_AT_low_pc : 0x17f79 0x17f79 - 0x17a30 = 1353 So: 0x17a30 + 2 * 1353 = 0x184c2 And: 0x184c2 - 0x18090 = 1074 Which explains the bogus third expansion for e1000_consume_page() to end up at: p:probe/e1000_consume_page_2 e1000e:e1000_clean_rx_irq_ps+1074 All fixed now :-) [1] https://git.kernel.org/pub/scm/devel/pahole/pahole.git/ Signed-off-by: Björn Töpel Tested-by: Arnaldo Carvalho de Melo Acked-by: Magnus Karlsson Acked-by: Masami Hiramatsu Cc: stable@vger.kernel.org Fixes: 613f050d68a8 ("perf probe: Fix to probe on gcc generated functions in modules") Link: http://lkml.kernel.org/r/20170621164134.5701-1-bjorn.topel@gmail.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/probe-event.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a38371cba67539ce6a5d5324db34bc2ddaf66cc1 Merge: 3f7ba7e 517a6e4 Author: Linus Torvalds Date: Thu Jun 22 11:16:55 2017 -0700 Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs fixes from Steve French: "Various small fixes for stable" * 'for-next' of git://git.samba.org/sfrench/cifs-2.6: CIFS: Fix some return values in case of error in 'crypt_message' cifs: remove redundant return in cifs_creation_time_get CIFS: Improve readdir verbosity CIFS: check if pages is null rather than bv for a failed allocation CIFS: Set ->should_dirty in cifs_user_readv() commit 3f7ba7e13e70bbcba1af568dc105c1a4243b33c7 Merge: 4f92f0e c8401dd Author: Linus Torvalds Date: Thu Jun 22 11:03:09 2017 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM fixes from Radim Krčmář: "MIPS: - Fix build with KVM, DYNAMIC_DEBUG and JUMP_LABEL. PPC: - Fix host crashes/hangs on POWER9. - Properly restore userspace state after KVM_RUN ioctl. s390: - Fix address translation in odd-ball cases (real-space designation ASCEs). x86: - Fix privilege escalation in 64-bit Windows guests All patches are for stable and the x86 also has a CVE" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: x86: fix singlestepping over syscall KVM: s390: gaccess: fix real-space designation asce handling for gmap shadows KVM: MIPS: Fix maybe-uninitialized build failure KVM: PPC: Book3S HV: Ignore timebase offset on POWER9 DD1 KVM: PPC: Book3S HV: Save/restore host values of debug registers KVM: PPC: Book3S HV: Preserve userspace HTM state properly KVM: PPC: Book3S HV: Restore critical SPRs to host values on guest exit KVM: PPC: Book3S HV: Context-switch EBB registers properly KVM: PPC: Book3S HV: Cope with host using large decrementer mode commit 4f92f0e25a48212ae06e0761504ee0c9c23776ee Merge: 8d829b9 9e69672 Author: Linus Torvalds Date: Thu Jun 22 10:47:29 2017 -0700 Merge tag 'mfd-fixes-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD fixes from Lee Jones: - arizona: use address passed in, rather than hard coded value - correct STM32 clock-names value in DT binding documentation * tag 'mfd-fixes-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: dt-bindings: mfd: Update STM32 timers clock names mfd: arizona: Fix typo using hard-coded register commit bb53f4d4f5116d3dae76bb12fb16bc73771f958a Author: Martin Habets Date: Thu Jun 22 10:50:41 2017 +0100 sfc: Fix MCDI command size for filter operations The 8000 series adapters uses catch-all filters for encapsulated traffic to support filtering VXLAN, NVGRE and GENEVE traffic. This new filter functionality requires a longer MCDI command. This patch increases the size of buffers on stack that were missed, which fixes a kernel panic from the stack protector. Fixes: 9b41080125176 ("sfc: insert catch-all filters for encapsulated traffic") Signed-off-by: Martin Habets Acked-by: Edward Cree Acked-by: Bert Kenward bkenward@solarflare.com Signed-off-by: David S. Miller drivers/net/ethernet/sfc/ef10.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit b92b7d3312033a08cae2c879b9243c42ad7de94b Author: Arnd Bergmann Date: Thu Jun 22 00:16:37 2017 +0200 netvsc: don't access netdev->num_rx_queues directly This structure member is hidden behind CONFIG_SYSFS, and we get a build error when that is disabled: drivers/net/hyperv/netvsc_drv.c: In function 'netvsc_set_channels': drivers/net/hyperv/netvsc_drv.c:754:49: error: 'struct net_device' has no member named 'num_rx_queues'; did you mean 'num_tx_queues'? drivers/net/hyperv/netvsc_drv.c: In function 'netvsc_set_rxfh': drivers/net/hyperv/netvsc_drv.c:1181:25: error: 'struct net_device' has no member named 'num_rx_queues'; did you mean 'num_tx_queues'? As the value is only set once to the argument of alloc_netdev_mq(), we can compare against that constant directly. Fixes: ff4a44199012 ("netvsc: allow get/set of RSS indirection table") Fixes: 2b01888d1b45 ("netvsc: allow more flexible setting of number of channels") Signed-off-by: Arnd Bergmann Reviewed-by: Haiyang Zhang Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller drivers/net/hyperv/netvsc_drv.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 60abc0be96e00ca71bac083215ac91ad2e575096 Author: WANG Cong Date: Wed Jun 21 14:34:58 2017 -0700 ipv6: avoid unregistering inet6_dev for loopback The per netns loopback_dev->ip6_ptr is unregistered and set to NULL when its mtu is set to smaller than IPV6_MIN_MTU, this leads to that we could set rt->rt6i_idev NULL after a rt6_uncached_list_flush_dev() and then crash after another call. In this case we should just bring its inet6_dev down, rather than unregistering it, at least prior to commit 176c39af29bc ("netns: fix addrconf_ifdown kernel panic") we always override the case for loopback. Thanks a lot to Andrey for finding a reliable reproducer. Fixes: 176c39af29bc ("netns: fix addrconf_ifdown kernel panic") Reported-by: Andrey Konovalov Cc: Andrey Konovalov Cc: Daniel Lezcano Cc: David Ahern Signed-off-by: Cong Wang Acked-by: David Ahern Tested-by: Andrey Konovalov Signed-off-by: David S. Miller net/ipv6/addrconf.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 8c4354ef590ec8b3b10eb7f29d8c8ae56709b96b Merge: dfa523a 18c8c54 Author: David S. Miller Date: Thu Jun 22 11:17:43 2017 -0400 Merge branch 'macvlan-Fix-some-issues-with-changing-mac-addresses' Vladislav Yasevich says: ==================== macvlan: Fix some issues with changing mac addresses There are some issues in macvlan wrt to changing it's mac address. * An error is returned in the specified address is the same as an already assigned address. * In passthru mode, the mac address of the macvlan device doesn't change. * After changing the mac address of a passthru macvlan and then removing it, the mac address of the physical device remains changed. This patch series attempts to resolve these issues. V2: Address a small issue in p4 where we save the address from the lowerdev (from girish.moodalbail@oracle.com) ==================== Signed-off-by: David S. Miller commit 18c8c54de9a619ba5533419e0170433e20c0ee3e Author: Vlad Yasevich Date: Wed Jun 21 07:59:19 2017 -0400 macvlan: Let passthru macvlan correctly restore lower mac address Passthru macvlans directly change the mac address of the lower level device. That's OK, but after the macvlan is deleted, the lower device is left with changed address and one needs to reboot to bring back the origina HW addresses. This scenario is actually quite common with passthru macvtap devices. This patch attempts to solve this, by storing the mac address of the lower device in macvlan_port structure and keeping track of it through the changes. After this patch, any changes to the lower device mac address done trough the macvlan device, will be reverted back. Any changs done directly to the lower device mac address will be kept. Signed-off-by: Vladislav Yasevich Signed-off-by: David S. Miller drivers/net/macvlan.c | 47 ++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 44 insertions(+), 3 deletions(-) commit 43c2d578a0ce0d6067a02b46461811aced551425 Author: Vlad Yasevich Date: Wed Jun 21 07:59:18 2017 -0400 macvlan: convert port passthru to flags. Convert the port passthru boolean into flags with accesor functions. Signed-off-by: Vladislav Yasevich Signed-off-by: David S. Miller drivers/net/macvlan.c | 37 ++++++++++++++++++++++++------------- 1 file changed, 24 insertions(+), 13 deletions(-) commit e696cda7bd091411705a4e868ce480eaa3082dbf Author: Vlad Yasevich Date: Wed Jun 21 07:59:17 2017 -0400 macvlan: Fix passthru macvlan mac address inheritance When a lower device of the passthru macvlan changes it's address, passthru macvlan is supposed to change it's own address as well. However, that doesn't happen correctly because the check in macvlan_addr_busy() will catch the fact that the lower level (port) mac address is the same as the address we are trying to assign to the macvlan, and return an error. As a reasult, the address of the passthru macvlan device is never changed. The same thing happens when the user attempts to change the mac address of the passthru macvlan. The simple solution appers to be to not check against the lower device in case of passthru macvlan device, since the 2 addresses are _supposed_ to be the same. Signed-off-by: Vladislav Yasevich Signed-off-by: David S. Miller drivers/net/macvlan.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit e26f43faa0d79dd06e9e94829696b68b9940c2ee Author: Vlad Yasevich Date: Wed Jun 21 07:59:16 2017 -0400 macvlan: Do not return error when setting the same mac address The user currently gets an EBUSY error when attempting to set the mac address on a macvlan device to the same value. This should really be a no-op as nothing changes. Catch the condition and return early. Signed-off-by: Vladislav Yasevich Signed-off-by: David S. Miller drivers/net/macvlan.c | 4 ++++ 1 file changed, 4 insertions(+) commit dfa523ae9f2542bee4cddaea37b3be3e157f6e6b Author: Wei Liu Date: Wed Jun 21 10:21:22 2017 +0100 xen-netback: correctly schedule rate-limited queues Add a flag to indicate if a queue is rate-limited. Test the flag in NAPI poll handler and avoid rescheduling the queue if true, otherwise we risk locking up the host. The rescheduling will be done in the timer callback function. Reported-by: Jean-Louis Dupond Signed-off-by: Wei Liu Tested-by: Jean-Louis Dupond Reviewed-by: Paul Durrant Signed-off-by: David S. Miller drivers/net/xen-netback/common.h | 1 + drivers/net/xen-netback/interface.c | 6 +++++- drivers/net/xen-netback/netback.c | 6 +++++- 3 files changed, 11 insertions(+), 2 deletions(-) commit 191cdb3822e5df6b3c8b9f8cb8c4bf93f6cc90c7 Author: Serhey Popovych Date: Wed Jun 21 12:12:24 2017 +0300 veth: Be more robust on network device creation when no attributes There are number of problems with configuration peer network device in absence of IFLA_VETH_PEER attributes where attributes for main network device shared with peer. First it is not feasible to configure both network devices with same MAC address since this makes communication in such configuration problematic. This case can be reproduced with following sequence: # ip link add address 02:11:22:33:44:55 type veth # ip li sh ... 26: veth0@veth1: mtu 1500 qdisc \ noop state DOWN mode DEFAULT qlen 1000 link/ether 00:11:22:33:44:55 brd ff:ff:ff:ff:ff:ff 27: veth1@veth0: mtu 1500 qdisc \ noop state DOWN mode DEFAULT qlen 1000 link/ether 00:11:22:33:44:55 brd ff:ff:ff:ff:ff:ff Second it is not possible to register both main and peer network devices with same name, that happens when name for main interface is given with IFLA_IFNAME and same attribute reused for peer. This case can be reproduced with following sequence: # ip link add dev veth1a type veth RTNETLINK answers: File exists To fix both of the cases check if corresponding netlink attributes are taken from peer_tb when valid or name based on rtnl ops kind and random address is used. Signed-off-by: Serhey Popovych Signed-off-by: David S. Miller drivers/net/veth.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit b88ff4f8c9ef0279f82bca0a83ed860b654f0f8d Author: Lokesh Vutla Date: Wed Jun 21 14:12:04 2017 +0530 drivers: net: cpsw-common: Fix reading of mac address for am43 SoCs cpsw driver tries to get macid for am43xx SoCs using the compatible ti,am4372. But not all variants of am43x uses this complatible like epos evm uses ti,am438x. So use a generic compatible ti,am43 to get macid for all am43 based platforms. Reviewed-by: Dave Gerlach Signed-off-by: Lokesh Vutla Signed-off-by: David S. Miller drivers/net/ethernet/ti/cpsw-common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 76da0704507bbc51875013f6557877ab308cfd0a Author: WANG Cong Date: Tue Jun 20 11:42:27 2017 -0700 ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER In commit 242d3a49a2a1 ("ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf") I assumed NETDEV_REGISTER and NETDEV_UNREGISTER are paired, unfortunately, as reported by jeffy, netdev_wait_allrefs() could rebroadcast NETDEV_UNREGISTER event until all refs are gone. We have to add an additional check to avoid this corner case. For netdev_wait_allrefs() dev->reg_state is NETREG_UNREGISTERED, for dev_change_net_namespace(), dev->reg_state is NETREG_REGISTERED. So check for dev->reg_state != NETREG_UNREGISTERED. Fixes: 242d3a49a2a1 ("ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf") Reported-by: jeffy Cc: David Ahern Signed-off-by: Cong Wang Acked-by: David Ahern Signed-off-by: David S. Miller net/ipv6/route.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit b866203d872d5deeafcecd25ea429d6748b5bd56 Author: Zach Brown Date: Tue Jun 20 12:48:11 2017 -0500 net/phy: micrel: configure intterupts after autoneg workaround The commit ("net/phy: micrel: Add workaround for bad autoneg") fixes an autoneg failure case by resetting the hardware. This turns off intterupts. Things will work themselves out if the phy polls, as it will figure out it's state during a poll. However if the phy uses only intterupts, the phy will stall, since interrupts are off. This patch fixes the issue by calling config_intr after resetting the phy. Fixes: d2fd719bcb0e ("net/phy: micrel: Add workaround for bad autoneg ") Signed-off-by: Zach Brown Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/phy/micrel.c | 2 ++ 1 file changed, 2 insertions(+) commit c8401dda2f0a00cd25c0af6a95ed50e478d25de4 Author: Paolo Bonzini Date: Wed Jun 7 15:13:14 2017 +0200 KVM: x86: fix singlestepping over syscall TF is handled a bit differently for syscall and sysret, compared to the other instructions: TF is checked after the instruction completes, so that the OS can disable #DB at a syscall by adding TF to FMASK. When the sysret is executed the #DB is taken "as if" the syscall insn just completed. KVM emulates syscall so that it can trap 32-bit syscall on Intel processors. Fix the behavior, otherwise you could get #DB on a user stack which is not nice. This does not affect Linux guests, as they use an IST or task gate for #DB. This fixes CVE-2017-7518. Cc: stable@vger.kernel.org Reported-by: Andy Lutomirski Signed-off-by: Paolo Bonzini Signed-off-by: Radim Krčmář arch/x86/include/asm/kvm_emulate.h | 1 + arch/x86/kvm/emulate.c | 1 + arch/x86/kvm/x86.c | 62 ++++++++++++++++++++------------------ 3 files changed, 34 insertions(+), 30 deletions(-) commit d6aa07c16941dcf438bd526a56dcf227991c5907 Merge: e27a9ec addb63c Author: Radim Krčmář Date: Thu Jun 22 16:13:06 2017 +0200 Merge tag 'kvm-s390-master-4.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux KVM: s390: fix shadow table handling for nested guests Some odd-ball cases (real-space designation ASCEs) are handled wrong for the shadow page tables. Fix it. commit bbd5ff50afffcf4a01d05367524736c57607a478 Author: Alistair Popple Date: Tue Jun 20 18:37:28 2017 +1000 powerpc/powernv/npu-dma: Add explicit flush when sending an ATSD NPU2 requires an extra explicit flush to an active GPU PID when sending address translation shoot downs (ATSDs) to reliably flush the GPU TLB. This patch adds just such a flush at the end of each sequence of ATSDs. We can safely use PID 0 which is always reserved and active on the GPU. PID 0 is only used for init_mm which will never be a user mm on the GPU. To enforce this we add a check in pnv_npu2_init_context() just in case someone tries to use PID 0 on the GPU. Signed-off-by: Alistair Popple [mpe: Use true/false for bool literals] Signed-off-by: Michael Ellerman arch/powerpc/platforms/powernv/npu-dma.c | 94 ++++++++++++++++++++++---------- 1 file changed, 65 insertions(+), 29 deletions(-) commit addb63c18a0d52a9ce2611d039f981f7b6148d2b Author: Heiko Carstens Date: Mon Jun 19 08:02:28 2017 +0200 KVM: s390: gaccess: fix real-space designation asce handling for gmap shadows For real-space designation asces the asce origin part is only a token. The asce token origin must not be used to generate an effective address for storage references. This however is erroneously done within kvm_s390_shadow_tables(). Furthermore within the same function the wrong parts of virtual addresses are used to generate a corresponding real address (e.g. the region second index is used as region first index). Both of the above can result in incorrect address translations. Only for real space designations with a token origin of zero and addresses below one megabyte the translation was correct. Furthermore replace a "!asce.r" statement with a "!*fake" statement to make it more obvious that a specific condition has nothing to do with the architecture, but with the fake handling of real space designations. Fixes: 3218f7094b6b ("s390/mm: support real-space for gmap shadows") Cc: David Hildenbrand Cc: stable@vger.kernel.org Signed-off-by: Heiko Carstens Reviewed-by: Martin Schwidefsky Signed-off-by: Christian Borntraeger arch/s390/kvm/gaccess.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) commit fb3a5055cd7098f8d1dd0cd38d7172211113255f Author: Kan Liang Date: Mon Jun 19 07:26:09 2017 -0700 perf/x86/intel: Add 1G DTLB load/store miss support for SKL Current DTLB load/store miss events (0x608/0x649) only counts 4K,2M and 4M page size. Need to extend the events to support any page size (4K/2M/4M/1G). The complete DTLB load/store miss events are: DTLB_LOAD_MISSES.WALK_COMPLETED 0xe08 DTLB_STORE_MISSES.WALK_COMPLETED 0xe49 Signed-off-by: Kan Liang Cc: Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: eranian@google.com Link: http://lkml.kernel.org/r/20170619142609.11058-1-kan.liang@intel.com Signed-off-by: Ingo Molnar arch/x86/events/intel/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 6c782a5ea56a799658e213a78dc1455264938afa Author: Michail Georgios Etairidis Date: Tue Jun 20 10:20:42 2017 +0200 i2c: imx: Use correct function to write to register The i2c-imx driver incorrectly uses readb()/writeb() to read and write to the appropriate registers when performing a repeated start. The appropriate imx_i2c_read_reg()/imx_i2c_write_reg() functions should be used instead. Performing a repeated start results in a kernel panic. The platform is imx. Signed-off-by: Michail G Etairidis Fixes: ce1a78840ff7 ("i2c: imx: add DMA support for freescale i2c driver") Fixes: 054b62d9f25c ("i2c: imx: fix the i2c bus hang issue when do repeat restart") Acked-by: Fugang Duan Acked-by: Uwe Kleine-König Signed-off-by: Wolfram Sang drivers/i2c/busses/i2c-imx.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit ca3a1b856636f596c691ab5b3764045a142186db Author: Yossi Kuperman Date: Thu Jun 22 11:37:11 2017 +0300 esp6_offload: Fix IP6CB(skb)->nhoff for ESP GRO IP6CB(skb)->nhoff is the offset of the nexthdr field in an IPv6 header, unless there are extension headers present, in which case nhoff points to the nexthdr field of the last extension header. In non-GRO code path, nhoff is set by ipv6_rcv before any XFRM code is executed. Conversely, in GRO code path (when esp6_offload is loaded), nhoff is not set. The following functions fail to read the correct value and eventually the packet is dropped: xfrm6_transport_finish xfrm6_tunnel_input xfrm6_rcv_tnl Set nhoff to the proper offset of nexthdr in esp6_gro_receive. Fixes: 7785bba299a8 ("esp: Add a software GRO codepath") Signed-off-by: Yossi Kuperman Signed-off-by: Steffen Klassert net/ipv6/esp6_offload.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) commit 7c88e21aefcf86fb41b48b2e04528db5a30fbe18 Author: Yossi Kuperman Date: Thu Jun 22 11:37:10 2017 +0300 xfrm6: Fix IPv6 payload_len in xfrm6_transport_finish IPv6 payload length indicates the size of the payload, including any extension headers. In xfrm6_transport_finish, ipv6_hdr(skb)->payload_len is set to the payload size only, regardless of the presence of any extension headers. After ESP GRO transport mode decapsulation, ipv6_rcv trims the packet according to the wrong payload_len, thus corrupting the packet. Set payload_len to account for extension headers as well. Fixes: 7785bba299a8 ("esp: Add a software GRO codepath") Signed-off-by: Yossi Kuperman Signed-off-by: Steffen Klassert net/ipv6/xfrm6_input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8d829b9bb878904f3419af8003176a12910b94e8 Merge: 48b6bbe 8e8320c Author: Linus Torvalds Date: Wed Jun 21 22:15:00 2017 -0700 Merge branch 'for-linus' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "This contains a set of fixes for xen-blkback by way of Konrad, and a performance regression fix for blk-mq for shared tags. The latter could account for as much as a 50x reduction in performance, with the test case from the user with 500 name spaces. A more realistic setup on my end with 32 drives showed a 3.5x drop. The fix has been thoroughly tested before being committed" * 'for-linus' of git://git.kernel.dk/linux-block: blk-mq: fix performance regression with shared tags xen-blkback: don't leak stack data via response ring xen/blkback: don't use xen_blkif_get() in xen-blkback kthread xen/blkback: don't free be structure too early xen/blkback: fix disconnect while I/Os in flight commit eb5e248d502bec191bd99f04cae8b49992b3abde Author: Darrick J. Wong Date: Wed Jun 21 20:27:35 2017 -0700 xfs: don't allow bmap on rt files bmap returns a dumb LBA address but not the block device that goes with that LBA. Swapfiles don't care about this and will blindly assume that the data volume is the correct blockdev, which is totally bogus for files on the rt subvolume. This results in the swap code doing IOs to arbitrary locations on the data device(!) if the passed in mapping is a realtime file, so just turn off bmap for rt files. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig fs/xfs/xfs_aops.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 2f263d145140ea4b9f5762b15886ae26195a764a Author: Richard Genoud Date: Thu Jun 15 10:36:22 2017 +0200 kbuild: fix header installation under fakechroot environment Since commit fcc8487d477a ("uapi: export all headers under uapi directories") fakechroot make bindeb-pkg fails, mismatching files for directories: touch: cannot touch 'usr/include/video/uvesafb.h/.install': Not a directory This due to a bug in fakechroot: when using the function $(wildcard $(srcdir)/*/.) in a makefile, under a fakechroot environment, not only directories but also files are returned. To circumvent that, we are using the functions: $(sort $(dir $(wildcard $(srcdir)/*/)))) Fixes: fcc8487d477a ("uapi: export all headers under uapi directories") Signed-off-by: Richard Genoud Signed-off-by: Masahiro Yamada scripts/Makefile.headersinst | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) commit e4330d8bf669139a983255d1801733b64c2ae841 Author: Jarkko Nikula Date: Mon Jun 19 15:53:01 2017 +0300 ACPI / scan: Fix enumeration for special SPI and I2C devices Commit f406270bf73d ("ACPI / scan: Set the visited flag for all enumerated devices") caused that two group of special SPI or I2C devices do not enumerate. SPI and I2C devices are expected to be enumerated by the SPI and I2C subsystems but change caused that acpi_bus_attach() marks those devices with acpi_device_set_enumerated(). First group of devices are matched using Device Tree compatible property with special _HID "PRP0001". Those devices have matched scan handler, acpi_scan_attach_handler() retuns 1 and acpi_bus_attach() marks them with acpi_device_set_enumerated(). Second group of devices without valid _HID such as "LNXVIDEO" have device->pnp.type.platform_id set to zero and change again marks them with acpi_device_set_enumerated(). Fix this by flagging the SPI and I2C devices during struct acpi_device object initialization time and let the code in acpi_bus_attach() to go through the device_attach() and acpi_default_enumeration() path for all SPI and I2C devices. Fixes: f406270bf73d (ACPI / scan: Set the visited flag for all enumerated devices) Signed-off-by: Jarkko Nikula Acked-by: Mika Westerberg Cc: 4.11+ # 4.11+ Signed-off-by: Rafael J. Wysocki drivers/acpi/scan.c | 67 +++++++++++++++++++++++++++---------------------- include/acpi/acpi_bus.h | 3 ++- 2 files changed, 39 insertions(+), 31 deletions(-) commit 48b6bbef9a1789f0365c1a385879a1fea4460016 Merge: ce879b6 b4846fc Author: Linus Torvalds Date: Wed Jun 21 12:40:20 2017 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) Fix refcounting wrt timers which hold onto inet6 address objects, from Xin Long. 2) Fix an ancient bug in wireless wext ioctls, from Johannes Berg. 3) Firmware handling fixes in brcm80211 driver, from Arend Van Spriel. 4) Several mlx5 driver fixes (firmware readiness, timestamp cap reporting, devlink command validity checking, tc offloading, etc.) From Eli Cohen, Maor Dickman, Chris Mi, and Or Gerlitz. 5) Fix dst leak in IP/IP6 tunnels, from Haishuang Yan. 6) Fix dst refcount bug in decnet, from Wei Wang. 7) Netdev can be double freed in register_vlan_device(). Fix from Gao Feng. 8) Don't allow object to be destroyed while it is being dumped in SCTP, from Xin Long. 9) Fix dpaa_eth build when modular, from Madalin Bucur. 10) Fix throw route leaks, from Serhey Popovych. 11) IFLA_GROUP missing from if_nlmsg_size() and ifla_policy[] table, also from Serhey Popovych. 12) Fix premature TX SKB free in stmmac, from Niklas Cassel. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (36 commits) igmp: add a missing spin_lock_init() net: stmmac: free an skb first when there are no longer any descriptors using it sfc: remove duplicate up_write on VF filter_sem rtnetlink: add IFLA_GROUP to ifla_policy ipv6: Do not leak throw route references dt-bindings: net: sms911x: Add missing optional VDD regulators dpaa_eth: reuse the dma_ops provided by the FMan MAC device fsl/fman: propagate dma_ops net/core: remove explicit do_softirq() from busy_poll_stop() fib_rules: Resolve goto rules target on delete sctp: ensure ep is not destroyed before doing the dump net/hns:bugfix of ethtool -t phy self_test net: 8021q: Fix one possible panic caused by BUG_ON in free_netdev cxgb4: notify uP to route ctrlq compl to rdma rspq ip6_tunnel: Correct tos value in collect_md mode decnet: always not take dst->__refcnt when inserting dst into hash table ip6_tunnel: fix potential issue in __ip6_tnl_rcv ip_tunnel: fix potential issue in ip_tunnel_rcv brcmfmac: fix uninitialized warning in brcmf_usb_probe_phase2() net/mlx5e: Avoid doing a cleanup call if the profile doesn't have it ... commit ce879b64a7be347a315bce6785318e9662e31cb5 Merge: db1b5cc b7c747d Author: Linus Torvalds Date: Wed Jun 21 12:16:12 2017 -0700 Merge tag 'pinctrl-v4.12-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull more pin control fixes from Linus Walleij: "Some late arriving fixes. I should have sent earlier, just swamped with work as usual. Thomas patch makes AMD systems usable despite firmware bugs so it is fairly important. - Make the AMD driver use a regular interrupt rather than a chained one, so the system does not lock up. - Fix a function call error deep inside the STM32 driver" * tag 'pinctrl-v4.12-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: stm32: Fix bad function call pinctrl/amd: Use regular interrupt instead of chained commit db1b5ccd27a37840af5c868f82f36d5d33430b96 Merge: dcba710 900a88e Author: Linus Torvalds Date: Wed Jun 21 12:06:29 2017 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid Pull HID fixes from Jiri Kosina: - revert of a commit to magicmouse driver that regressess certain devices, from Daniel Stone - quirk for a specific Dell mouse, from Sebastian Parschauer * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: Revert "HID: magicmouse: Set multi-touch keybits for Magic Mouse" HID: Add quirk for Dell PIXART OEM mouse commit dcba71086e0d1abf4f00cd381530b11d0db7fa1d Merge: 021f601 842c088 Author: Linus Torvalds Date: Wed Jun 21 12:02:48 2017 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/livepatching Pull livepatching fix from Jiri Kosina: "Fix the way how livepatches are being stacked with respect to RCU, from Petr Mladek" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/livepatching: livepatch: Fix stacking of patches with respect to RCU commit 021f601980ccf07e65bc03e40d0321243f782d34 Merge: bd726c9 77e9ce3 Author: Linus Torvalds Date: Wed Jun 21 11:30:52 2017 -0700 Merge branch 'ufs-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull more ufs fixes from Al Viro: "More UFS fixes, unfortunately including build regression fix for the 64-bit s_dsize commit. Fixed in this pile: - trivial bug in signedness of 32bit timestamps on ufs1 - ESTALE instead of ufs_error() when doing open-by-fhandle on something deleted - build regression on 32bit in ufs_new_fragments() - calculating that many percents of u64 pulls libgcc stuff on some of those. Mea culpa. - fix hysteresis loop broken by typo in 2.4.14.7 (right next to the location of previous bug). - fix the insane limits of said hysteresis loop on filesystems with very low percentage of reserved blocks. If it's 5% or less, just use the OPTSPACE policy. - calculate those limits once and mount time. This tree does pass xfstests clean (both ufs1 and ufs2) and it _does_ survive cross-builds. Again, my apologies for missing that, especially since I have noticed a related percentage-of-64bit issue in earlier patches (when dealing with amount of reserved blocks). Self-LART applied..." * 'ufs-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: ufs: fix the logics for tail relocation ufs_iget(): fail with -ESTALE on deleted inode fix signedness of timestamps on ufs1 commit bd726c90b6b8ce87602208701b208a208e6d5600 Author: Helge Deller Date: Mon Jun 19 17:34:05 2017 +0200 Allow stack to grow up to address space limit Fix expand_upwards() on architectures with an upward-growing stack (parisc, metag and partly IA-64) to allow the stack to reliably grow exactly up to the address space limit given by TASK_SIZE. Signed-off-by: Helge Deller Acked-by: Hugh Dickins Signed-off-by: Linus Torvalds mm/mmap.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) commit f4cb767d76cf7ee72f97dd76f6cfa6c76a5edc89 Author: Hugh Dickins Date: Tue Jun 20 02:10:44 2017 -0700 mm: fix new crash in unmapped_area_topdown() Trinity gets kernel BUG at mm/mmap.c:1963! in about 3 minutes of mmap testing. That's the VM_BUG_ON(gap_end < gap_start) at the end of unmapped_area_topdown(). Linus points out how MAP_FIXED (which does not have to respect our stack guard gap intentions) could result in gap_end below gap_start there. Fix that, and the similar case in its alternative, unmapped_area(). Cc: stable@vger.kernel.org Fixes: 1be7107fbe18 ("mm: larger stack guard gap, between vmas") Reported-by: Dave Jones Debugged-by: Linus Torvalds Signed-off-by: Hugh Dickins Acked-by: Michal Hocko Signed-off-by: Linus Torvalds mm/mmap.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 8e8320c9315c47a6a090188720ccff32a6a6ba18 Author: Jens Axboe Date: Tue Jun 20 17:56:13 2017 -0600 blk-mq: fix performance regression with shared tags If we have shared tags enabled, then every IO completion will trigger a full loop of every queue belonging to a tag set, and every hardware queue for each of those queues, even if nothing needs to be done. This causes a massive performance regression if you have a lot of shared devices. Instead of doing this huge full scan on every IO, add an atomic counter to the main queue that tracks how many hardware queues have been marked as needing a restart. With that, we can avoid looking for restartable queues, if we don't have to. Max reports that this restores performance. Before this patch, 4K IOPS was limited to 22-23K IOPS. With the patch, we are running at 950-970K IOPS. Fixes: 6d8c6c0f97ad ("blk-mq: Restart a single queue if tag sets are shared") Reported-by: Max Gurtovoy Tested-by: Max Gurtovoy Reviewed-by: Bart Van Assche Tested-by: Bart Van Assche Signed-off-by: Jens Axboe block/blk-mq-sched.c | 58 +++++++++++++++++++++++++++++++++++++++----------- block/blk-mq-sched.h | 9 -------- block/blk-mq.c | 16 +++++++++++--- include/linux/blkdev.h | 2 ++ 4 files changed, 61 insertions(+), 24 deletions(-) commit feb7695fe9fb83084aa29de0094774f4c9d4c9fc Author: Mike Snitzer Date: Tue Jun 20 19:14:30 2017 -0400 dm io: fix duplicate bio completion due to missing ref count If only a subset of the devices associated with multiple regions support a given special operation (eg. DISCARD) then the dec_count() that is used to set error for the region must increment the io->count. Otherwise, when the dec_count() is called it can cause the dm-io caller's bio to be completed multiple times. As was reported against the dm-mirror target that had mirror legs with a mix of discard capabilities. Bug: https://bugzilla.kernel.org/show_bug.cgi?id=196077 Reported-by: Zhang Yi Signed-off-by: Mike Snitzer drivers/md/dm-io.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 7def52b78a5fda14864aab9b6fd14f09a4d4ff72 Author: Mike Snitzer Date: Mon Jun 19 10:55:47 2017 -0400 dm integrity: fix to not disable/enable interrupts from interrupt context Use spin_lock_irqsave and spin_unlock_irqrestore rather than spin_{lock,unlock}_irq in submit_flush_bio(). Otherwise lockdep issues the following warning: DEBUG_LOCKS_WARN_ON(current->hardirq_context) WARNING: CPU: 1 PID: 0 at kernel/locking/lockdep.c:2748 trace_hardirqs_on_caller+0x107/0x180 Reported-by: Ondrej Kozina Tested-by: Ondrej Kozina Signed-off-by: Mike Snitzer Acked-by: Mikulas Patocka drivers/md/dm-integrity.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 8a1898db51a3390241cd5fae267dc8aaa9db0f8b Author: Hendrik Brueckner Date: Tue Jun 20 12:26:39 2017 +0200 perf/aux: Correct return code of rb_alloc_aux() if !has_aux(ev) If the event for which an AUX area is about to be allocated, does not support setting up an AUX area, rb_alloc_aux() return -ENOTSUPP. This error condition is being returned unfiltered to the user space, and, for example, the perf tools fails with: failed to mmap with 524 (INTERNAL ERROR: strerror_r(524, 0x3fff497a1c8, 512)=22) This error can be easily seen with "perf record -m 128,256 -e cpu-clock". The 524 error code maps to -ENOTSUPP (in rb_alloc_aux()). The -ENOTSUPP error code shall be only used within the kernel. So the correct error code would then be -EOPNOTSUPP. With this commit, the perf tool then reports: failed to mmap with 95 (Operation not supported) which is more clear. Signed-off-by: Hendrik Brueckner Acked-by: Alexander Shishkin Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Pu Hou Cc: Thomas Gleixner Cc: Thomas-Mich Richter Cc: acme@kernel.org Cc: linux-s390@vger.kernel.org Link: http://lkml.kernel.org/r/1497954399-6355-1-git-send-email-brueckner@linux.vnet.ibm.com Signed-off-by: Ingo Molnar kernel/events/ring_buffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e94ac3510b6a0f696f2c442c4fc4051c8101ef12 Author: Daniel Vetter Date: Tue Jun 20 22:28:37 2017 +0200 drm: Fix GETCONNECTOR regression In commit 91eefc05f0ac71902906b2058360e61bd25137fe Author: Daniel Vetter Date: Wed Dec 14 00:08:10 2016 +0100 drm: Tighten locking in drm_mode_getconnector I reordered the logic a bit in that IOCTL, but that broke userspace since it'll get the new mode list, but not the new property values. Fix that again. v2: Fix up the error path handling when copy_to_user for the modes failes (Dhinakaran). Fixes: 91eefc05f0ac ("drm: Tighten locking in drm_mode_getconnector") Cc: Sean Paul Cc: Daniel Vetter Cc: Jani Nikula Cc: David Airlie Cc: dri-devel@lists.freedesktop.org Reported-by: "H.J. Lu" Tested-by: "H.J. Lu" Cc: # v4.11+ Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=100576 Cc: "H.J. Lu" Cc: "Pandiyan, Dhinakaran" Reviewed-by: Sean Paul Reviewed-by: Dhinakaran Pandiyan Signed-off-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/20170620202837.1701-1-daniel.vetter@ffwll.ch drivers/gpu/drm/drm_connector.c | 38 ++++++++++++++++++++------------------ 1 file changed, 20 insertions(+), 18 deletions(-) commit 517a6e43c4872c89794af5b377fa085e47345952 Author: Christophe Jaillet Date: Sun Jun 11 09:12:47 2017 +0200 CIFS: Fix some return values in case of error in 'crypt_message' 'rc' is known to be 0 at this point. So if 'init_sg' or 'kzalloc' fails, we should return -ENOMEM instead. Also remove a useless 'rc' in a debug message as it is meaningless here. Fixes: 026e93dc0a3ee ("CIFS: Encrypt SMB3 requests before sending") Signed-off-by: Christophe JAILLET Reviewed-by: Pavel Shilovsky Reviewed-by: Aurelien Aptel Signed-off-by: Steve French CC: Stable fs/cifs/smb2ops.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 816b4e448c72cc388cdd0f6ea22302a47cd752a2 Merge: 09da4ba acfd6ee Author: Dave Airlie Date: Wed Jun 21 11:23:35 2017 +1000 Merge branch 'drm-fixes-4.12' of git://people.freedesktop.org/~agd5f/linux into drm-fixes A few fixes for 4.12: - Add a new Polaris12 pci id - A stack corruption fix - Suspend/resume fix - PX fix - Display flickering fix * 'drm-fixes-4.12' of git://people.freedesktop.org/~agd5f/linux: drm/radeon: add a quirk for Toshiba Satellite L20-183 drm/radeon: add a PX quirk for another K53TK variant drm/amdgpu: adjust default display clock drm/amdgpu/atom: fix ps allocation size for EnableDispPowerGating drm/amdgpu: add Polaris12 DID commit 09da4baa4d502833a1ac79aea4ff85d08bb48871 Merge: 41f1830 a8ae0a7 Author: Dave Airlie Date: Wed Jun 21 11:22:34 2017 +1000 Merge tag 'drm-intel-fixes-2017-06-20' of git://anongit.freedesktop.org/git/drm-intel into drm-fixes drm/i915 fixes for v4.12-rc7 * tag 'drm-intel-fixes-2017-06-20' of git://anongit.freedesktop.org/git/drm-intel: drm/i915: Don't enable backlight at setup time. drm/i915: Plumb the correct acquire ctx into intel_crtc_disable_noatomic() drm/i915: Fix deadlock witha the pipe A quirk during resume drm/i915: Remove __GFP_NORETRY from our buffer allocator drm/i915: Encourage our shrinker more when our shmemfs allocations fails drm/i915: Differentiate between sw write location into ring and last hw read commit e125f5284f81bbb765a504494622b45c02faf978 Author: Colin Ian King Date: Wed Jun 7 00:33:45 2017 +0100 cifs: remove redundant return in cifs_creation_time_get There is a redundant return in function cifs_creation_time_get that appears to be old vestigial code than can be removed. So remove it. Detected by CoverityScan, CID#1361924 ("Structurally dead code") Signed-off-by: Colin Ian King Signed-off-by: Steve French fs/cifs/xattr.c | 2 -- 1 file changed, 2 deletions(-) commit dcd87838c06f05ab7650b249ebf0d5b57ae63e1e Author: Pavel Shilovsky Date: Tue Jun 6 16:58:58 2017 -0700 CIFS: Improve readdir verbosity Downgrade the loglevel for SMB2 to prevent filling the log with messages if e.g. readdir was interrupted. Also make SMB2 and SMB1 codepaths do the same logging during readdir. Signed-off-by: Pavel Shilovsky Signed-off-by: Steve French CC: Stable fs/cifs/smb1ops.c | 9 +++++++-- fs/cifs/smb2ops.c | 4 ++-- 2 files changed, 9 insertions(+), 4 deletions(-) commit ecf3411a121e7a653e309ff50a820ffa87c537f8 Author: Colin Ian King Date: Wed May 17 19:24:15 2017 +0100 CIFS: check if pages is null rather than bv for a failed allocation pages is being allocated however a null check on bv is being used to see if the allocation failed. Fix this by checking if pages is null. Detected by CoverityScan, CID#1432974 ("Logically dead code") Fixes: ccf7f4088af2dd ("CIFS: Add asynchronous context to support kernel AIO") Signed-off-by: Colin Ian King Reviewed-by: Pavel Shilovsky Signed-off-by: Steve French fs/cifs/misc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8a7b0d8e8d9962ec3b2ae64dd4e86d68a6fb9220 Author: Dan Carpenter Date: Fri May 5 08:30:40 2017 +0300 CIFS: Set ->should_dirty in cifs_user_readv() The current code causes a static checker warning because ITER_IOVEC is zero so the condition is never true. Fixes: 6685c5e2d1ac ("CIFS: Add asynchronous read support through kernel AIO") Signed-off-by: Dan Carpenter Signed-off-by: Steve French fs/cifs/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b4846fc3c8559649277e3e4e6b5cec5348a8d208 Author: WANG Cong Date: Tue Jun 20 10:46:27 2017 -0700 igmp: add a missing spin_lock_init() Andrey reported a lockdep warning on non-initialized spinlock: INFO: trying to register non-static key. the code is fine but needs lockdep annotation. turning off the locking correctness validator. CPU: 1 PID: 4099 Comm: a.out Not tainted 4.12.0-rc6+ #9 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:16 dump_stack+0x292/0x395 lib/dump_stack.c:52 register_lock_class+0x717/0x1aa0 kernel/locking/lockdep.c:755 ? 0xffffffffa0000000 __lock_acquire+0x269/0x3690 kernel/locking/lockdep.c:3255 lock_acquire+0x22d/0x560 kernel/locking/lockdep.c:3855 __raw_spin_lock_bh ./include/linux/spinlock_api_smp.h:135 _raw_spin_lock_bh+0x36/0x50 kernel/locking/spinlock.c:175 spin_lock_bh ./include/linux/spinlock.h:304 ip_mc_clear_src+0x27/0x1e0 net/ipv4/igmp.c:2076 igmpv3_clear_delrec+0xee/0x4f0 net/ipv4/igmp.c:1194 ip_mc_destroy_dev+0x4e/0x190 net/ipv4/igmp.c:1736 We miss a spin_lock_init() in igmpv3_add_delrec(), probably because previously we never use it on this code path. Since we already unlink it from the global mc_tomb list, it is probably safe not to acquire this spinlock here. It does not harm to have it although, to avoid conditional locking. Fixes: c38b7d327aaf ("igmp: acquire pmc lock for ip_mc_clear_src()") Reported-by: Andrey Konovalov Signed-off-by: Cong Wang Signed-off-by: David S. Miller net/ipv4/igmp.c | 1 + 1 file changed, 1 insertion(+) commit 9f93d87cba63e3d18629261243b1f633519eabb5 Author: Marcin Nowakowski Date: Fri Jun 9 09:04:05 2017 +0200 irqchip/mips-gic: Mark count and compare accessors notrace gic_read_count(), gic_write_compare() and gic_write_cpu_compare() are often used in a sequence to update the compare register with a count value increased by a small offset. With small delta values used to update the compare register, the time to update function trace for these operations may be longer than the update timeout leading to update failure. Signed-off-by: Marcin Nowakowski Signed-off-by: Thomas Gleixner Cc: Marc Zyngier Cc: linux-mips@linux-mips.org Cc: Jason Cooper Link: http://lkml.kernel.org/r/1496991845-27031-1-git-send-email-marcin.nowakowski@imgtec.com drivers/irqchip/irq-mips-gic.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit afd64631f86c0c0ad440dcac09ed4a44968372d6 Merge: 05cf0d1 35abcd4 Author: David S. Miller Date: Tue Jun 20 15:41:56 2017 -0400 Merge tag 'wireless-drivers-for-davem-2017-06-20' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== wireless-drivers fixes for 4.12 Two important fixes for brcmfmac. The rest of the brcmfmac patches are either code preparation and fixing a new build warning. brcmfmac * fix a NULL pointer dereference during resume * fix a NULL pointer dereference with USB devices, a regression from v4.12-rc1 ==================== Signed-off-by: David S. Miller commit 05cf0d1bf4ed722aefff92775244dbe9e1bb4679 Author: Niklas Cassel Date: Tue Jun 20 14:32:41 2017 +0200 net: stmmac: free an skb first when there are no longer any descriptors using it When having the skb pointer in the first descriptor, stmmac_tx_clean can get called at a moment where the IP has only cleared the own bit of the first descriptor, thus freeing the skb, even though there can be several descriptors whose buffers point into the same skb. By simply moving the skb pointer from the first descriptor to the last descriptor, a skb will get freed only when the IP has cleared the own bit of all the descriptors that are using that skb. Signed-off-by: Niklas Cassel Signed-off-by: David S. Miller drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) commit 57f0c9cf58ff7fe479137ab847a886d0eed3ad1d Author: Edward Cree Date: Tue Jun 20 13:08:51 2017 +0100 sfc: remove duplicate up_write on VF filter_sem Somehow two copies of the line 'up_write(&vf->efx->filter_sem);' got into efx_ef10_sriov_set_vf_vlan(). This would put the mutex in a bad state and cause all subsequent down attempts to hang. Fixes: 671b53eec2ed ("sfc: Ensure down_write(&filter_sem) and up_write() are matched before calling efx_net_open()") Signed-off-by: Edward Cree Signed-off-by: David S. Miller drivers/net/ethernet/sfc/ef10_sriov.c | 2 -- 1 file changed, 2 deletions(-) commit db833d40ad3263b2ee3b59a1ba168bb3cfed8137 Author: Serhey Popovych Date: Tue Jun 20 14:35:23 2017 +0300 rtnetlink: add IFLA_GROUP to ifla_policy Network interface groups support added while ago, however there is no IFLA_GROUP attribute description in policy and netlink message size calculations until now. Add IFLA_GROUP attribute to the policy. Fixes: cbda10fa97d7 ("net_device: add support for network device groups") Signed-off-by: Serhey Popovych Signed-off-by: David S. Miller net/core/rtnetlink.c | 2 ++ 1 file changed, 2 insertions(+) commit 07f615574f8ac499875b21c1142f26308234a92c Author: Serhey Popovych Date: Tue Jun 20 13:29:25 2017 +0300 ipv6: Do not leak throw route references While commit 73ba57bfae4a ("ipv6: fix backtracking for throw routes") does good job on error propagation to the fib_rules_lookup() in fib rules core framework that also corrects throw routes handling, it does not solve route reference leakage problem happened when we return -EAGAIN to the fib_rules_lookup() and leave routing table entry referenced in arg->result. If rule with matched throw route isn't last matched in the list we overwrite arg->result losing reference on throw route stored previously forever. We also partially revert commit ab997ad40839 ("ipv6: fix the incorrect return value of throw route") since we never return routing table entry with dst.error == -EAGAIN when CONFIG_IPV6_MULTIPLE_TABLES is on. Also there is no point to check for RTF_REJECT flag since it is always set throw route. Fixes: 73ba57bfae4a ("ipv6: fix backtracking for throw routes") Signed-off-by: Serhey Popovych Signed-off-by: David S. Miller net/ipv6/fib6_rules.c | 22 ++++++---------------- net/ipv6/ip6_fib.c | 3 +-- 2 files changed, 7 insertions(+), 18 deletions(-) commit 7e113321eccba2b52c0e9d11129d370c9511e4db Author: Krzysztof Kozlowski Date: Mon Jun 19 18:05:41 2017 +0200 dt-bindings: net: sms911x: Add missing optional VDD regulators The lan911x family of devices require supplying from 3.3 V power supplies (connected to VDD_IO, VDD_A and VREG_3.3 pins). The existing driver however obtains only VDD_IO and VDD_A regulators in an optional way so document this in bindings. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Linus Walleij Signed-off-by: David S. Miller Documentation/devicetree/bindings/net/smsc911x.txt | 1 + 1 file changed, 1 insertion(+) commit 73b098d6fa175e4ecd98e6c1fe53c77ebf6b3eaa Merge: fe420d8 fb52728 Author: David S. Miller Date: Tue Jun 20 13:46:54 2017 -0400 Merge branch 'net-fix-loadable-module-for-DPAA-Ethernet' Madalin Bucur says: ==================== net: fix loadable module for DPAA Ethernet The DPAA Ethernet makes use of a symbol that is not exported. Address the issue by propagating the dma_ops rather than calling arch_setup_dma_ops(). ==================== Signed-off-by: David S. Miller commit fb52728a9294d97de808795b8e3f60fb8de50c00 Author: Madalin Bucur Date: Mon Jun 19 18:04:17 2017 +0300 dpaa_eth: reuse the dma_ops provided by the FMan MAC device Remove the use of arch_setup_dma_ops() that was not exported and was breaking loadable module compilation. Signed-off-by: Madalin Bucur Signed-off-by: David S. Miller drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5567e989198b5a8d78f9b5868e48fc9f4726bdd5 Author: Madalin Bucur Date: Mon Jun 19 18:04:16 2017 +0300 fsl/fman: propagate dma_ops Make sure dma_ops are set, to be later used by the Ethernet driver. Signed-off-by: Madalin Bucur Signed-off-by: David S. Miller drivers/net/ethernet/freescale/fman/mac.c | 2 ++ 1 file changed, 2 insertions(+) commit fe420d87bbc234015b4195dd239b7d3052b140ea Author: Sebastian Siewior Date: Fri Jun 16 19:24:00 2017 +0200 net/core: remove explicit do_softirq() from busy_poll_stop() Since commit 217f69743681 ("net: busy-poll: allow preemption in sk_busy_loop()") there is an explicit do_softirq() invocation after local_bh_enable() has been invoked. I don't understand why we need this because local_bh_enable() will invoke do_softirq() once the softirq counter reached zero and we have softirq-related work pending. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: David S. Miller net/core/dev.c | 2 -- 1 file changed, 2 deletions(-) commit bdaf32c3ced3d111b692f0af585f880f82d686c5 Author: Serhey Popovych Date: Fri Jun 16 15:44:47 2017 +0300 fib_rules: Resolve goto rules target on delete We should avoid marking goto rules unresolved when their target is actually reachable after rule deletion. Consolder following sample scenario: # ip -4 ru sh 0: from all lookup local 32000: from all goto 32100 32100: from all lookup main 32100: from all lookup default 32766: from all lookup main 32767: from all lookup default # ip -4 ru del pref 32100 table main # ip -4 ru sh 0: from all lookup local 32000: from all goto 32100 [unresolved] 32100: from all lookup default 32766: from all lookup main 32767: from all lookup default After removal of first rule with preference 32100 we mark all goto rules as unreachable, even when rule with same preference as removed one still present. Check if next rule with same preference is available and make all rules with goto action pointing to it. Signed-off-by: Serhey Popovych Signed-off-by: David S. Miller net/core/fib_rules.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) commit acfd6ee4fa7ebeee75511825fe02be3f7ac1d668 Author: Alex Deucher Date: Mon Jun 19 15:59:58 2017 -0400 drm/radeon: add a quirk for Toshiba Satellite L20-183 Fixes resume from suspend. bug: https://bugzilla.kernel.org/show_bug.cgi?id=196121 Reported-by: Przemek Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/radeon/radeon_combios.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 4eb59793cca00b0e629b6d55b5abb5acb82c5868 Author: Alex Deucher Date: Mon Jun 19 12:52:47 2017 -0400 drm/radeon: add a PX quirk for another K53TK variant Disable PX on these systems. bug: https://bugs.freedesktop.org/show_bug.cgi?id=101491 Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org Signed-off-by: Alex Deucher drivers/gpu/drm/radeon/radeon_device.c | 4 ++++ 1 file changed, 4 insertions(+) commit 52b482b0f4fd6d5267faf29fe91398e203f3c230 Author: Alex Deucher Date: Thu Jun 15 11:12:28 2017 -0400 drm/amdgpu: adjust default display clock Increase the default display clock on newer asics to accomodate some high res modes with really high refresh rates. bug: https://bugs.freedesktop.org/show_bug.cgi?id=93826 Acked-by: Chunming Zhou Acked-by: Christian König Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 4 ++++ 1 file changed, 4 insertions(+) commit 05b4017b37f1fce4b7185f138126dd8decdb381f Author: Alex Deucher Date: Thu Jun 15 10:55:11 2017 -0400 drm/amdgpu/atom: fix ps allocation size for EnableDispPowerGating We were using the wrong structure which lead to an overflow on some boards. bug: https://bugs.freedesktop.org/show_bug.cgi?id=101387 Acked-by: Chunming Zhou Acked-by: Christian König Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/atombios_crtc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 9e69672e90ccff10dab6f0c9545226a886e5973c Author: Fabrice Gasnier Date: Wed Jun 14 17:13:14 2017 +0200 dt-bindings: mfd: Update STM32 timers clock names Clock name has been updated during driver/DT binding review: https://lkml.org/lkml/2016/12/13/718 Update DT binding doc to reflect this. Fixes: 8f9359c6c6a0 (dt-bindings: mfd: Add bindings for STM32 Timers driver) Signed-off-by: Fabrice Gasnier Acked-by: Benjamin Gaignard Signed-off-by: Lee Jones Documentation/devicetree/bindings/mfd/stm32-timers.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e27a9eca5d4a392b96ce5d5238c8d637bcb0a52c Author: James Cowgill Date: Tue Jun 20 10:57:51 2017 +0100 KVM: MIPS: Fix maybe-uninitialized build failure This commit fixes a "maybe-uninitialized" build failure in arch/mips/kvm/tlb.c when KVM, DYNAMIC_DEBUG and JUMP_LABEL are all enabled. The failure is: In file included from ./include/linux/printk.h:329:0, from ./include/linux/kernel.h:13, from ./include/asm-generic/bug.h:15, from ./arch/mips/include/asm/bug.h:41, from ./include/linux/bug.h:4, from ./include/linux/thread_info.h:11, from ./include/asm-generic/current.h:4, from ./arch/mips/include/generated/asm/current.h:1, from ./include/linux/sched.h:11, from arch/mips/kvm/tlb.c:13: arch/mips/kvm/tlb.c: In function ‘kvm_mips_host_tlb_inv’: ./include/linux/dynamic_debug.h:126:3: error: ‘idx_kernel’ may be used uninitialized in this function [-Werror=maybe-uninitialized] __dynamic_pr_debug(&descriptor, pr_fmt(fmt), \ ^~~~~~~~~~~~~~~~~~ arch/mips/kvm/tlb.c:169:16: note: ‘idx_kernel’ was declared here int idx_user, idx_kernel; ^~~~~~~~~~ There is a similar error relating to "idx_user". Both errors were observed with GCC 6. As far as I can tell, it is impossible for either idx_user or idx_kernel to be uninitialized when they are later read in the calls to kvm_debug, but to satisfy the compiler, add zero initializers to both variables. Signed-off-by: James Cowgill Fixes: 57e3869cfaae ("KVM: MIPS/TLB: Generalise host TLB invalidate to kernel ASID") Cc: # 4.11+ Acked-by: James Hogan Signed-off-by: Radim Krčmář arch/mips/kvm/tlb.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit ec2f0fadde446e0ebe28c779ffcac655228b8f1e Merge: dc9edc4 089bc01 Author: Jens Axboe Date: Tue Jun 20 07:09:27 2017 -0600 Merge branch 'stable/for-jens-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen into for-linus Pull xen-blkback fixes from Konrad: "Security and memory leak fixes in xen block driver." commit c72544d85fd6e46cfca6056ba775a17dc272d810 Merge: 41f1830 3d3efb6 Author: Radim Krčmář Date: Tue Jun 20 14:32:57 2017 +0200 Merge branch 'kvm-ppc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc * fix problems that could cause hangs or crashes in the host on POWER9 * fix problems that could allow guests to potentially affect or disrupt the execution of the controlling userspace commit 6c7515c61ffa0985c57abd8892c7928b52b9a306 Author: Ralph Sennhauser Date: Thu Jun 1 22:08:20 2017 +0200 gpio: mvebu: change compatible string for PWM support As it turns out more than just Armada 370 and XP support using GPIO lines as PWM lines. For example the Armada 38x family has the same hardware support. As such "marvell,armada-370-xp-gpio" for the compatible string is a misnomer. Change the compatible string to "marvell,armada-370-gpio" before the driver makes it out of the -rc stage. This also follows the practice of using only the first device family supported as part of the name. Also update the documentation and comments in the code accordingly. Fixes: 757642f9a584 ("gpio: mvebu: Add limited PWM support") Signed-off-by: Ralph Sennhauser Acked-by: Gregory CLEMENT Acked-by: Rob Herring Signed-off-by: Linus Walleij Documentation/devicetree/bindings/gpio/gpio-mvebu.txt | 6 +++--- drivers/gpio/gpio-mvebu.c | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) commit 8e6cec1c7c5afa489687c90be15d6ed82c742975 Merge: dbb236c 459fa24 Author: Thomas Gleixner Date: Tue Jun 20 12:50:32 2017 +0200 Merge branch 'clockevents/4.12-fixes' of https://git.linaro.org/people/daniel.lezcano/linux into timers/urgent Pull clockevents fixes from Daniel Lezcano: - Fixed wrong iomem area unmapped in the arch_arm_timer (Frank Rowand) - Added missing includes for sun5i and cadence-ttc (Stephen Rothwell) commit 900a88ef348803cd2ad2aeb13ffe06e807c6ce65 Merge: 0ca4cd7 53145c2 Author: Jiri Kosina Date: Tue Jun 20 10:52:46 2017 +0200 Merge branch 'for-4.12/upstream-fixes' into for-linus commit 842c08846420baa619fe3cb8c9af538efdb89428 Author: Petr Mladek Date: Wed Jun 14 10:54:52 2017 +0200 livepatch: Fix stacking of patches with respect to RCU rcu_read_(un)lock(), list_*_rcu(), and synchronize_rcu() are used for a secure access and manipulation of the list of patches that modify the same function. In particular, it is the variable func_stack that is accessible from the ftrace handler via struct ftrace_ops and klp_ops. Of course, it synchronizes also some states of the patch on the top of the stack, e.g. func->transition in klp_ftrace_handler. At the same time, this mechanism guards also the manipulation of task->patch_state. It is modified according to the state of the transition and the state of the process. Now, all this works well as long as RCU works well. Sadly livepatching might get into some corner cases when this is not true. For example, RCU is not watching when rcu_read_lock() is taken in idle threads. It is because they might sleep and prevent reaching the grace period for too long. There are ways how to make RCU watching even in idle threads, see rcu_irq_enter(). But there is a small location inside RCU infrastructure when even this does not work. This small problematic location can be detected either before calling rcu_irq_enter() by rcu_irq_enter_disabled() or later by rcu_is_watching(). Sadly, there is no safe way how to handle it. Once we detect that RCU was not watching, we might see inconsistent state of the function stack and the related variables in klp_ftrace_handler(). Then we could do a wrong decision, use an incompatible implementation of the function and break the consistency of the system. We could warn but we could not avoid the damage. Fortunately, ftrace has similar problems and they seem to be solved well there. It uses a heavy weight implementation of some RCU operations. In particular, it replaces: + rcu_read_lock() with preempt_disable_notrace() + rcu_read_unlock() with preempt_enable_notrace() + synchronize_rcu() with schedule_on_each_cpu(sync_work) My understanding is that this is RCU implementation from a stone age. It meets the core RCU requirements but it is rather ineffective. Especially, it does not allow to batch or speed up the synchronize calls. On the other hand, it is very trivial. It allows to safely trace and/or livepatch even the RCU core infrastructure. And the effectiveness is a not a big issue because using ftrace or livepatches on productive systems is a rare operation. The safety is much more important than a negligible extra load. Note that the alternative implementation follows the RCU principles. Therefore, we could and actually must use list_*_rcu() variants when manipulating the func_stack. These functions allow to access the pointers in the right order and with the right barriers. But they do not use any other information that would be set only by rcu_read_lock(). Also note that there are actually two problems solved in ftrace: First, it cares about the consistency of RCU read sections. It is being solved the way as described and used in this patch. Second, ftrace needs to make sure that nobody is inside the dynamic trampoline when it is being freed. For this, it also calls synchronize_rcu_tasks() in preemptive kernel in ftrace_shutdown(). Livepatch has similar problem but it is solved by ftrace for free. klp_ftrace_handler() is a good guy and never sleeps. In addition, it is registered with FTRACE_OPS_FL_DYNAMIC. It causes that unregister_ftrace_function() calls: * schedule_on_each_cpu(ftrace_sync) - always * synchronize_rcu_tasks() - in preemptive kernel The effect is that nobody is neither inside the dynamic trampoline nor inside the ftrace handler after unregister_ftrace_function() returns. [jkosina@suse.cz: reformat changelog, fix comment] Signed-off-by: Petr Mladek Acked-by: Josh Poimboeuf Acked-by: Miroslav Benes Signed-off-by: Jiri Kosina kernel/livepatch/patch.c | 8 ++++++-- kernel/livepatch/transition.c | 36 +++++++++++++++++++++++++++++++----- 2 files changed, 37 insertions(+), 7 deletions(-) commit dbb236c1ceb697a559e0694ac4c9e7b9131d0b16 Author: Will Deacon Date: Thu Jun 8 16:44:22 2017 -0700 arm64/vdso: Fix nsec handling for CLOCK_MONOTONIC_RAW Recently vDSO support for CLOCK_MONOTONIC_RAW was added in 49eea433b326 ("arm64: Add support for CLOCK_MONOTONIC_RAW in clock_gettime() vDSO"). Noticing that the core timekeeping code never set tkr_raw.xtime_nsec, the vDSO implementation didn't bother exposing it via the data page and instead took the unshifted tk->raw_time.tv_nsec value which was then immediately shifted left in the vDSO code. Unfortunately, by accellerating the MONOTONIC_RAW clockid, it uncovered potential 1ns time inconsistencies caused by the timekeeping core not handing sub-ns resolution. Now that the core code has been fixed and is actually setting tkr_raw.xtime_nsec, we need to take that into account in the vDSO by adding it to the shifted raw_time value, in order to fix the user-visible inconsistency. Rather than do that at each use (and expand the data page in the process), instead perform the shift/addition operation when populating the data page and remove the shift from the vDSO code entirely. [jstultz: minor whitespace tweak, tried to improve commit message to make it more clear this fixes a regression] Reported-by: John Stultz Signed-off-by: Will Deacon Signed-off-by: John Stultz Tested-by: Daniel Mentz Acked-by: Kevin Brodsky Cc: Prarit Bhargava Cc: Richard Cochran Cc: Stephen Boyd Cc: "stable #4 . 8+" Cc: Miroslav Lichvar Link: http://lkml.kernel.org/r/1496965462-20003-4-git-send-email-john.stultz@linaro.org Signed-off-by: Thomas Gleixner arch/arm64/kernel/vdso.c | 5 +++-- arch/arm64/kernel/vdso/gettimeofday.S | 1 - 2 files changed, 3 insertions(+), 3 deletions(-) commit 3d88d56c5873f6eebe23e05c3da701960146b801 Author: John Stultz Date: Thu Jun 8 16:44:21 2017 -0700 time: Fix CLOCK_MONOTONIC_RAW sub-nanosecond accounting Due to how the MONOTONIC_RAW accumulation logic was handled, there is the potential for a 1ns discontinuity when we do accumulations. This small discontinuity has for the most part gone un-noticed, but since ARM64 enabled CLOCK_MONOTONIC_RAW in their vDSO clock_gettime implementation, we've seen failures with the inconsistency-check test in kselftest. This patch addresses the issue by using the same sub-ns accumulation handling that CLOCK_MONOTONIC uses, which avoids the issue for in-kernel users. Since the ARM64 vDSO implementation has its own clock_gettime calculation logic, this patch reduces the frequency of errors, but failures are still seen. The ARM64 vDSO will need to be updated to include the sub-nanosecond xtime_nsec values in its calculation for this issue to be completely fixed. Signed-off-by: John Stultz Tested-by: Daniel Mentz Cc: Prarit Bhargava Cc: Kevin Brodsky Cc: Richard Cochran Cc: Stephen Boyd Cc: Will Deacon Cc: "stable #4 . 8+" Cc: Miroslav Lichvar Link: http://lkml.kernel.org/r/1496965462-20003-3-git-send-email-john.stultz@linaro.org Signed-off-by: Thomas Gleixner include/linux/timekeeper_internal.h | 4 ++-- kernel/time/timekeeping.c | 19 ++++++++++--------- 2 files changed, 12 insertions(+), 11 deletions(-) commit ceea5e3771ed2378668455fa21861bead7504df5 Author: John Stultz Date: Thu Jun 8 16:44:20 2017 -0700 time: Fix clock->read(clock) race around clocksource changes In tests, which excercise switching of clocksources, a NULL pointer dereference can be observed on AMR64 platforms in the clocksource read() function: u64 clocksource_mmio_readl_down(struct clocksource *c) { return ~(u64)readl_relaxed(to_mmio_clksrc(c)->reg) & c->mask; } This is called from the core timekeeping code via: cycle_now = tkr->read(tkr->clock); tkr->read is the cached tkr->clock->read() function pointer. When the clocksource is changed then tkr->clock and tkr->read are updated sequentially. The code above results in a sequential load operation of tkr->read and tkr->clock as well. If the store to tkr->clock hits between the loads of tkr->read and tkr->clock, then the old read() function is called with the new clock pointer. As a consequence the read() function dereferences a different data structure and the resulting 'reg' pointer can point anywhere including NULL. This problem was introduced when the timekeeping code was switched over to use struct tk_read_base. Before that, it was theoretically possible as well when the compiler decided to reload clock in the code sequence: now = tk->clock->read(tk->clock); Add a helper function which avoids the issue by reading tk_read_base->clock once into a local variable clk and then issue the read function via clk->read(clk). This guarantees that the read() function always gets the proper clocksource pointer handed in. Since there is now no use for the tkr.read pointer, this patch also removes it, and to address stopping the fast timekeeper during suspend/resume, it introduces a dummy clocksource to use rather then just a dummy read function. Signed-off-by: John Stultz Acked-by: Ingo Molnar Cc: Prarit Bhargava Cc: Richard Cochran Cc: Stephen Boyd Cc: stable Cc: Miroslav Lichvar Cc: Daniel Mentz Link: http://lkml.kernel.org/r/1496965462-20003-2-git-send-email-john.stultz@linaro.org Signed-off-by: Thomas Gleixner include/linux/timekeeper_internal.h | 1 - kernel/time/timekeeping.c | 52 +++++++++++++++++++++++++------------ 2 files changed, 36 insertions(+), 17 deletions(-) commit 53145c2e354b5a5ed031cec7472b4f16bab060c7 Author: Daniel Stone Date: Thu Jun 15 13:35:50 2017 +0100 Revert "HID: magicmouse: Set multi-touch keybits for Magic Mouse" Setting these bits causes libinput to fail to initialize the device; setting BTN_TOUCH and BTN_TOOL_FINGER causes it to treat the mouse as a touchpad, and it then refuses to continue when it discovers ABS_X is not set. This breaks all known Wayland compositors, as well as Xorg when the libinput driver is being used. This reverts commit f4b65b9563216b3e01a5cc844c3ba68901d9b195. Signed-off-by: Daniel Stone Cc: Che-Liang Chiou Cc: Thierry Escande Cc: Jiri Kosina Cc: Benjamin Tissoires Acked-by: Benjamin Tissoires Signed-off-by: Jiri Kosina drivers/hid/hid-magicmouse.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) commit c7ecb9068e6772c43941ce609f08bc53f36e1dce Author: Takashi Iwai Date: Wed Jun 14 07:37:14 2017 +0200 ALSA: hda - Apply quirks to Broxton-T, too Broxton-T was a forgotten child and we didn't apply the quirks for Skylake+ properly. Meanwhile, a quirk for reducing the DMA latency seems specific to the early Broxton model, so we leave as is. Cc: Signed-off-by: Takashi Iwai sound/pci/hda/hda_intel.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 817ae460c784f32cd45e60b2b1b21378c3c6a847 Author: Daniel Drake Date: Mon Jun 19 19:48:52 2017 -0700 Input: i8042 - add Fujitsu Lifebook AH544 to notimeout list Without this quirk, the touchpad is not responsive on this product, with the following message repeated in the logs: psmouse serio1: bad data from KBC - timeout Add it to the notimeout list alongside other similar Fujitsu laptops. Signed-off-by: Daniel Drake Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov drivers/input/serio/i8042-x86ia64io.h | 7 +++++++ 1 file changed, 7 insertions(+) commit 9705596d08ac87c18aee32cc97f2783b7d14624e Merge: 865be78 949bdfe Author: Linus Torvalds Date: Tue Jun 20 11:02:29 2017 +0800 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "One build fix for an Amlogic clk driver and a handful of Allwinner clk driver fixes for some DT bindings and a randconfig build error that all came in this merge window" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: sunxi-ng: a64: Export PLL_PERIPH0 clock for the PRCM clk: sunxi-ng: h3: Export PLL_PERIPH0 clock for the PRCM dt-bindings: clock: sunxi-ccu: Add pll-periph to PRCM's needed clocks clk: sunxi-ng: sun5i: Fix ahb_bist_clk definition clk: sunxi-ng: enable SUNXI_CCU_MP for PRCM clk: meson: gxbb: fix build error without RESET_CONTROLLER clk: sunxi-ng: v3s: Fix usb otg device reset bit clk: sunxi-ng: a31: Correct lcd1-ch1 clock register offset commit 865be78022e9ae8151c755d01201012ccf5e3232 Merge: 41f1830 88931ec Author: Linus Torvalds Date: Tue Jun 20 10:57:06 2017 +0800 Merge tag 'ntb-4.12-bugfixes' of git://github.com/jonmason/ntb Pull NTB fixes from Jon Mason: "NTB bug fixes to address the modinfo in ntb_perf, a couple of bugs in the NTB transport QP calculations, skx doorbells, and sleeping in ntb_async_tx_submit" * tag 'ntb-4.12-bugfixes' of git://github.com/jonmason/ntb: ntb: no sleep in ntb_async_tx_submit ntb: ntb_hw_intel: Skylake doorbells should be 32bits, not 64bits ntb_transport: fix bug calculating num_qps_mw ntb_transport: fix qp count bug NTB: ntb_test: fix bug printing ntb_perf results ntb: Correct modinfo usage statement for ntb_perf commit 02d94e04747c5df55410c7b19f3cf72a1a11899b Author: Manish Rangankar Date: Thu Jun 15 00:10:40 2017 -0700 scsi: qedi: Remove WARN_ON from clear task context. Signed-off-by: Manish Rangankar Reviewed-by: Lee Duncan Signed-off-by: Martin K. Petersen drivers/scsi/qedi/qedi_main.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 6ebf81536d3be327c4f5f59bae3b841d62322343 Author: Manish Rangankar Date: Thu Jun 15 00:10:39 2017 -0700 scsi: qedi: Remove WARN_ON for untracked cleanup. Signed-off-by: Manish Rangankar Reviewed-by: Lee Duncan Signed-off-by: Martin K. Petersen drivers/scsi/qedi/qedi_fw.c | 1 - 1 file changed, 1 deletion(-) commit 4a072c71f49b0a0e495ea13423bdb850da73c58c Author: Jason A. Donenfeld Date: Thu Jun 15 00:45:26 2017 +0200 random: silence compiler warnings and fix race Odd versions of gcc for the sh4 architecture will actually warn about flags being used while uninitialized, so we set them to zero. Non crazy gccs will optimize that out again, so it doesn't make a difference. Next, over aggressive gccs could inline the expression that defines use_lock, which could then introduce a race resulting in a lock imbalance. By using READ_ONCE, we prevent that fate. Finally, we make that assignment const, so that gcc can still optimize a nice amount. Finally, we fix a potential deadlock between primary_crng.lock and batched_entropy_reset_lock, where they could be called in opposite order. Moving the call to invalidate_batched_entropy to outside the lock rectifies this issue. Fixes: b169c13de473a85b3c859bb36216a4cb5f00a54a Signed-off-by: Jason A. Donenfeld Signed-off-by: Theodore Ts'o Cc: stable@vger.kernel.org drivers/char/random.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 6e88491cf2a3b17199c78bd53348b39dc6a88275 Author: Junshan Fang Date: Thu Jun 15 14:02:20 2017 +0800 drm/amdgpu: add Polaris12 DID Signed-off-by: Junshan Fang Reviewed-by: Roger.He Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 1 + 1 file changed, 1 insertion(+) commit a8ae0a773d38b4b1d4566b0edcb6bb63f4a9d22f Author: Dhinakaran Pandiyan Date: Mon Jun 19 11:08:28 2017 -0700 drm/i915: Don't enable backlight at setup time. Maarten and Ville noticed that we are enabling backlight via DP aux very early in the modeset_init path via the intel_dp_aux_setup_backlight() function, since commit e7156c833903 ("drm/i915: Add Backlight Control using DPCD for eDP connectors (v9)"). Looks like all we need to do during _setup_backlight() is read the current brightness state instead of modifying it. v2: Rewrote commit message. Cc: Ville Syrjala Cc: Maarten Lankhorst Cc: Jani Nikula Cc: Yetunde Adebisi Signed-off-by: Dhinakaran Pandiyan Reviewed-by: Maarten Lankhorst Acked-by: Jani Nikula Tested-by: Puthikorn Voravootivat Fixes: e7156c833903 ("drm/i915: Add Backlight Control using DPCD for eDP connectors (v9)") Link: http://patchwork.freedesktop.org/patch/msgid/1497384239-2965-1-git-send-email-dhinakaran.pandiyan@intel.com Signed-off-by: Ville Syrjälä (cherry picked from commit f6262bda462e81e959b80a96dac799bd9df27f73) Signed-off-by: Jani Nikula Link: http://patchwork.freedesktop.org/patch/msgid/1497895708-19422-1-git-send-email-dhinakaran.pandiyan@intel.com drivers/gpu/drm/i915/intel_dp_aux_backlight.c | 2 -- 1 file changed, 2 deletions(-) commit 86fdb3448cc1ffe0e9f55380f1410f1d12c35f95 Author: Xin Long Date: Sat Jun 17 16:10:27 2017 +0800 sctp: ensure ep is not destroyed before doing the dump Now before dumping a sock in sctp_diag, it only holds the sock while the ep may be already destroyed. It can cause a use-after-free panic when accessing ep->asocs. This patch is to set sctp_sk(sk)->ep NULL in sctp_endpoint_destroy, and check if this ep is already destroyed before dumping this ep. Suggested-by: Marcelo Ricardo Leitner Signed-off-by: Xin Long Acked-by: Neil Horman Signed-off-by: David S. Miller net/sctp/endpointola.c | 1 + net/sctp/sctp_diag.c | 5 +++-- 2 files changed, 4 insertions(+), 2 deletions(-) commit 88931ec3dc11e7dbceb3b0df455693873b508fbe Author: Allen Hubbe Date: Fri Jun 9 18:06:36 2017 -0400 ntb: no sleep in ntb_async_tx_submit Do not sleep in ntb_async_tx_submit, which could deadlock. This reverts commit "8c874cc140d667f84ae4642bb5b5e0d6396d2ca4" Fixes: 8c874cc140d6 ("NTB: Address out of DMA descriptor issue with NTB") Reported-by: Jia-Ju Bai Signed-off-by: Allen Hubbe Acked-by: Dave Jiang Signed-off-by: Jon Mason drivers/ntb/ntb_transport.c | 50 +++++++-------------------------------------- 1 file changed, 7 insertions(+), 43 deletions(-) commit 5eb449e15d2396785a8eb15baf42cea33db9ae13 Author: Dave Jiang Date: Thu Jun 8 12:46:45 2017 -0700 ntb: ntb_hw_intel: Skylake doorbells should be 32bits, not 64bits Fixing doorbell register length to 32bits per spec. On Skylake NTB, the doorbell registers are 32bit write only registers. The source for the doorbell is a 64bit register that shows the interrupt bits. Signed-off-by: Dave Jiang Fixes: 783dfa6cc41b ("ntb: Adding Skylake Xeon NTB support") Acked-by: Allen Hubbe Signed-off-by: Jon Mason drivers/ntb/hw/intel/ntb_hw_intel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8e8496e0e9564b66165f5219a4e8ed20b0d3fc6b Author: Logan Gunthorpe Date: Mon Jun 5 14:00:53 2017 -0600 ntb_transport: fix bug calculating num_qps_mw A divide by zero error occurs if qp_count is less than mw_count because num_qps_mw is calculated to be zero. The calculation appears to be incorrect. The requirement is for num_qps_mw to be set to qp_count / mw_count with any remainder divided among the earlier mws. For example, if mw_count is 5 and qp_count is 12 then mws 0 and 1 will have 3 qps per window and mws 2 through 4 will have 2 qps per window. Thus, when mw_num < qp_count % mw_count, num_qps_mw is 1 higher than when mw_num >= qp_count. Signed-off-by: Logan Gunthorpe Fixes: e26a5843f7f5 ("NTB: Split ntb_hw_intel and ntb_transport drivers") Acked-by: Allen Hubbe Signed-off-by: Jon Mason drivers/ntb/ntb_transport.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit cb827ee6ccc3e480f0d9c0e8e53eef55be5b0414 Author: Logan Gunthorpe Date: Mon Jun 5 14:00:52 2017 -0600 ntb_transport: fix qp count bug In cases where there are more mw's than spads/2-2, the mw count gets reduced to match the limitation. ntb_transport also tries to ensure that there are fewer qps than mws but uses the full mw count instead of the reduced one. When this happens, the math in 'ntb_transport_setup_qp_mw' will get confused and result in a kernel paging request bug. This patch fixes the bug by reducing qp_count to the reduced mw count instead of the full mw count. Signed-off-by: Logan Gunthorpe Fixes: e26a5843f7f5 ("NTB: Split ntb_hw_intel and ntb_transport drivers") Acked-by: Allen Hubbe Signed-off-by: Jon Mason drivers/ntb/ntb_transport.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 07b0b22b3e58824f70b9188d085d400069ca3240 Author: Logan Gunthorpe Date: Mon Jun 5 10:13:24 2017 -0600 NTB: ntb_test: fix bug printing ntb_perf results The code mistakenly prints the local perf results for the remote test so the script reports identical results for both directions. Fix this by ensuring we print the remote result. Signed-off-by: Logan Gunthorpe Fixes: a9c59ef77458 ("ntb_test: Add a selftest script for the NTB subsystem") Acked-by: Allen Hubbe Signed-off-by: Jon Mason tools/testing/selftests/ntb/ntb_test.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 94fc795454f461134cdffb88bef4eb9f788c0b5d Author: Gary R Hook Date: Thu May 4 11:36:52 2017 -0500 ntb: Correct modinfo usage statement for ntb_perf The order parameters are powers of 2; adjust the usage information to use correct mathematical representations. Signed-off-by: Gary R Hook Fixes: 8a7b6a778a85 ("ntb: ntb perf tool") Acked-by: Dave Jiang Signed-off-by: Jon Mason drivers/ntb/test/ntb_perf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 7fe5b914313ff67d71cb2b5aa4b850e0884e75dd Author: Lin Yun Sheng Date: Fri Jun 16 17:24:51 2017 +0800 net/hns:bugfix of ethtool -t phy self_test This patch fixes the phy loopback self_test failed issue. when Marvell Phy Module is loaded, it will powerdown fiber when doing phy loopback self test, which cause phy loopback self_test fail. Signed-off-by: Lin Yun Sheng Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns/hns_ethtool.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) commit 9745e362add89432d2c951272a99b0a5fe4348a9 Author: Gao Feng Date: Fri Jun 16 15:00:02 2017 +0800 net: 8021q: Fix one possible panic caused by BUG_ON in free_netdev The register_vlan_device would invoke free_netdev directly, when register_vlan_dev failed. It would trigger the BUG_ON in free_netdev if the dev was already registered. In this case, the netdev would be freed in netdev_run_todo later. So add one condition check now. Only when dev is not registered, then free it directly. The following is the part coredump when netdev_upper_dev_link failed in register_vlan_dev. I removed the lines which are too long. [ 411.237457] ------------[ cut here ]------------ [ 411.237458] kernel BUG at net/core/dev.c:7998! [ 411.237484] invalid opcode: 0000 [#1] SMP [ 411.237705] [last unloaded: 8021q] [ 411.237718] CPU: 1 PID: 12845 Comm: vconfig Tainted: G E 4.12.0-rc5+ #6 [ 411.237737] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/02/2015 [ 411.237764] task: ffff9cbeb6685580 task.stack: ffffa7d2807d8000 [ 411.237782] RIP: 0010:free_netdev+0x116/0x120 [ 411.237794] RSP: 0018:ffffa7d2807dbdb0 EFLAGS: 00010297 [ 411.237808] RAX: 0000000000000002 RBX: ffff9cbeb6ba8fd8 RCX: 0000000000001878 [ 411.237826] RDX: 0000000000000001 RSI: 0000000000000282 RDI: 0000000000000000 [ 411.237844] RBP: ffffa7d2807dbdc8 R08: 0002986100029841 R09: 0002982100029801 [ 411.237861] R10: 0004000100029980 R11: 0004000100029980 R12: ffff9cbeb6ba9000 [ 411.238761] R13: ffff9cbeb6ba9060 R14: ffff9cbe60f1a000 R15: ffff9cbeb6ba9000 [ 411.239518] FS: 00007fb690d81700(0000) GS:ffff9cbebb640000(0000) knlGS:0000000000000000 [ 411.239949] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 411.240454] CR2: 00007f7115624000 CR3: 0000000077cdf000 CR4: 00000000003406e0 [ 411.240936] Call Trace: [ 411.241462] vlan_ioctl_handler+0x3f1/0x400 [8021q] [ 411.241910] sock_ioctl+0x18b/0x2c0 [ 411.242394] do_vfs_ioctl+0xa1/0x5d0 [ 411.242853] ? sock_alloc_file+0xa6/0x130 [ 411.243465] SyS_ioctl+0x79/0x90 [ 411.243900] entry_SYSCALL_64_fastpath+0x1e/0xa9 [ 411.244425] RIP: 0033:0x7fb69089a357 [ 411.244863] RSP: 002b:00007ffcd04e0fc8 EFLAGS: 00000202 ORIG_RAX: 0000000000000010 [ 411.245445] RAX: ffffffffffffffda RBX: 00007ffcd04e2884 RCX: 00007fb69089a357 [ 411.245903] RDX: 00007ffcd04e0fd0 RSI: 0000000000008983 RDI: 0000000000000003 [ 411.246527] RBP: 00007ffcd04e0fd0 R08: 0000000000000000 R09: 1999999999999999 [ 411.246976] R10: 000000000000053f R11: 0000000000000202 R12: 0000000000000004 [ 411.247414] R13: 00007ffcd04e1128 R14: 00007ffcd04e2888 R15: 0000000000000001 [ 411.249129] RIP: free_netdev+0x116/0x120 RSP: ffffa7d2807dbdb0 Signed-off-by: Gao Feng Signed-off-by: David S. Miller net/8021q/vlan.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 4a9bfafc64f44ef83de4e00ca1b57352af6cd8c2 Author: Takashi Sakamoto Date: Sun Jun 11 16:08:21 2017 +0900 ALSA: firewire-lib: Fix stall of process context at packet error At Linux v3.5, packet processing can be done in process context of ALSA PCM application as well as software IRQ context for OHCI 1394. Below is an example of the callgraph (some calls are omitted). ioctl(2) with e.g. HWSYNC (sound/core/pcm_native.c) ->snd_pcm_common_ioctl1() ->snd_pcm_hwsync() ->snd_pcm_stream_lock_irq (sound/core/pcm_lib.c) ->snd_pcm_update_hw_ptr() ->snd_pcm_udpate_hw_ptr0() ->struct snd_pcm_ops.pointer() (sound/firewire/*) = Each handler on drivers in ALSA firewire stack (sound/firewire/amdtp-stream.c) ->amdtp_stream_pcm_pointer() (drivers/firewire/core-iso.c) ->fw_iso_context_flush_completions() ->struct fw_card_driver.flush_iso_completion() (drivers/firewire/ohci.c) = flush_iso_completions() ->struct fw_iso_context.callback.sc (sound/firewire/amdtp-stream.c) = in_stream_callback() or out_stream_callback() ->... ->snd_pcm_stream_unlock_irq When packet queueing error occurs or detecting invalid packets in 'in_stream_callback()' or 'out_stream_callback()', 'snd_pcm_stop_xrun()' is called on local CPU with disabled IRQ. (sound/firewire/amdtp-stream.c) in_stream_callback() or out_stream_callback() ->amdtp_stream_pcm_abort() ->snd_pcm_stop_xrun() ->snd_pcm_stream_lock_irqsave() ->snd_pcm_stop() ->snd_pcm_stream_unlock_irqrestore() The process is stalled on the CPU due to attempt to acquire recursive lock. [ 562.630853] INFO: rcu_sched detected stalls on CPUs/tasks: [ 562.630861] 2-...: (1 GPs behind) idle=37d/140000000000000/0 softirq=38323/38323 fqs=7140 [ 562.630862] (detected by 3, t=15002 jiffies, g=21036, c=21035, q=5933) [ 562.630866] Task dump for CPU 2: [ 562.630867] alsa-source-OXF R running task 0 6619 1 0x00000008 [ 562.630870] Call Trace: [ 562.630876] ? vt_console_print+0x79/0x3e0 [ 562.630880] ? msg_print_text+0x9d/0x100 [ 562.630883] ? up+0x32/0x50 [ 562.630885] ? irq_work_queue+0x8d/0xa0 [ 562.630886] ? console_unlock+0x2b6/0x4b0 [ 562.630888] ? vprintk_emit+0x312/0x4a0 [ 562.630892] ? dev_vprintk_emit+0xbf/0x230 [ 562.630895] ? do_sys_poll+0x37a/0x550 [ 562.630897] ? dev_printk_emit+0x4e/0x70 [ 562.630900] ? __dev_printk+0x3c/0x80 [ 562.630903] ? _raw_spin_lock+0x20/0x30 [ 562.630909] ? snd_pcm_stream_lock+0x31/0x50 [snd_pcm] [ 562.630914] ? _snd_pcm_stream_lock_irqsave+0x2e/0x40 [snd_pcm] [ 562.630918] ? snd_pcm_stop_xrun+0x16/0x70 [snd_pcm] [ 562.630922] ? in_stream_callback+0x3e6/0x450 [snd_firewire_lib] [ 562.630925] ? handle_ir_packet_per_buffer+0x8e/0x1a0 [firewire_ohci] [ 562.630928] ? ohci_flush_iso_completions+0xa3/0x130 [firewire_ohci] [ 562.630932] ? fw_iso_context_flush_completions+0x15/0x20 [firewire_core] [ 562.630935] ? amdtp_stream_pcm_pointer+0x2d/0x40 [snd_firewire_lib] [ 562.630938] ? pcm_capture_pointer+0x19/0x20 [snd_oxfw] [ 562.630943] ? snd_pcm_update_hw_ptr0+0x47/0x3d0 [snd_pcm] [ 562.630945] ? poll_select_copy_remaining+0x150/0x150 [ 562.630947] ? poll_select_copy_remaining+0x150/0x150 [ 562.630952] ? snd_pcm_update_hw_ptr+0x10/0x20 [snd_pcm] [ 562.630956] ? snd_pcm_hwsync+0x45/0xb0 [snd_pcm] [ 562.630960] ? snd_pcm_common_ioctl1+0x1ff/0xc90 [snd_pcm] [ 562.630962] ? futex_wake+0x90/0x170 [ 562.630966] ? snd_pcm_capture_ioctl1+0x136/0x260 [snd_pcm] [ 562.630970] ? snd_pcm_capture_ioctl+0x27/0x40 [snd_pcm] [ 562.630972] ? do_vfs_ioctl+0xa3/0x610 [ 562.630974] ? vfs_read+0x11b/0x130 [ 562.630976] ? SyS_ioctl+0x79/0x90 [ 562.630978] ? entry_SYSCALL_64_fastpath+0x1e/0xad This commit fixes the above bug. This assumes two cases: 1. Any error is detected in software IRQ context of OHCI 1394 context. In this case, PCM substream should be aborted in packet handler. On the other hand, it should not be done in any process context. TO distinguish these two context, use 'in_interrupt()' macro. 2. Any error is detect in process context of ALSA PCM application. In this case, PCM substream should not be aborted in packet handler because PCM substream lock is acquired. The task to abort PCM substream should be done in ALSA PCM core. For this purpose, SNDRV_PCM_POS_XRUN is returned at 'struct snd_pcm_ops.pointer()'. Suggested-by: Clemens Ladisch Fixes: e9148dddc3c7("ALSA: firewire-lib: flush completed packets when reading PCM position") Cc: # 4.9+ Signed-off-by: Takashi Sakamoto Signed-off-by: Takashi Iwai sound/firewire/amdtp-stream.c | 8 ++++++-- sound/firewire/amdtp-stream.h | 2 +- 2 files changed, 7 insertions(+), 3 deletions(-) commit dec6b33163d24e2c19ba521c89fffbaab53ae986 Author: Raju Rangoju Date: Mon Jun 19 19:46:00 2017 +0530 cxgb4: notify uP to route ctrlq compl to rdma rspq During the module initialisation there is a possible race (basically race between uld and lld) where neither the uld nor lld notifies the uP about where to route the ctrl queue completions. LLD skips notifying uP as the rdma queues were not created by then (will leave it to ULD to notify the uP). As the ULD comes up, it also skips notifying the uP as the flag FULL_INIT_DONE is not set yet (ULD assumes that the interface is not up yet). Consequently, this race between uld and lld leaves uP unnotified about where to send the ctrl queue completions to, leading to iwarp RI_RES WR failure. Here is the race: CPU 0 CPU1 - allocates nic rx queus - t4_sge_alloc_ctrl_txq() (if rdma rsp queues exists, tell uP to route ctrl queue compl to rdma rspq) - acquires the mutex_lock - allocates rdma response queues - if FULL_INIT_DONE set, tell uP to route ctrl queue compl to rdma rspq - relinquishes mutex_lock - acquires the mutex_lock - enable_rx() - set FULL_INIT_DONE - relinquishes mutex_lock This patch fixes the above issue. Fixes: e7519f9926f1('cxgb4: avoid enabling napi twice to the same queue') Signed-off-by: Raju Rangoju Acked-by: Steve Wise CC: Stable # 4.9+ Signed-off-by: Ganesh Goudar Signed-off-by: David S. Miller drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit 41f1830f5a7af77cf5c86359aba3cbd706687e52 Author: Linus Torvalds Date: Mon Jun 19 22:19:37 2017 +0800 Linux 4.12-rc6 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1be7107fbe18eed3e319a6c3e83c78254b693acb Author: Hugh Dickins Date: Mon Jun 19 04:03:24 2017 -0700 mm: larger stack guard gap, between vmas Stack guard page is a useful feature to reduce a risk of stack smashing into a different mapping. We have been using a single page gap which is sufficient to prevent having stack adjacent to a different mapping. But this seems to be insufficient in the light of the stack usage in userspace. E.g. glibc uses as large as 64kB alloca() in many commonly used functions. Others use constructs liks gid_t buffer[NGROUPS_MAX] which is 256kB or stack strings with MAX_ARG_STRLEN. This will become especially dangerous for suid binaries and the default no limit for the stack size limit because those applications can be tricked to consume a large portion of the stack and a single glibc call could jump over the guard page. These attacks are not theoretical, unfortunatelly. Make those attacks less probable by increasing the stack guard gap to 1MB (on systems with 4k pages; but make it depend on the page size because systems with larger base pages might cap stack allocations in the PAGE_SIZE units) which should cover larger alloca() and VLA stack allocations. It is obviously not a full fix because the problem is somehow inherent, but it should reduce attack space a lot. One could argue that the gap size should be configurable from userspace, but that can be done later when somebody finds that the new 1MB is wrong for some special case applications. For now, add a kernel command line option (stack_guard_gap) to specify the stack gap size (in page units). Implementation wise, first delete all the old code for stack guard page: because although we could get away with accounting one extra page in a stack vma, accounting a larger gap can break userspace - case in point, a program run with "ulimit -S -v 20000" failed when the 1MB gap was counted for RLIMIT_AS; similar problems could come with RLIMIT_MLOCK and strict non-overcommit mode. Instead of keeping gap inside the stack vma, maintain the stack guard gap as a gap between vmas: using vm_start_gap() in place of vm_start (or vm_end_gap() in place of vm_end if VM_GROWSUP) in just those few places which need to respect the gap - mainly arch_get_unmapped_area(), and and the vma tree's subtree_gap support for that. Original-patch-by: Oleg Nesterov Original-patch-by: Michal Hocko Signed-off-by: Hugh Dickins Acked-by: Michal Hocko Tested-by: Helge Deller # parisc Signed-off-by: Linus Torvalds Documentation/admin-guide/kernel-parameters.txt | 7 ++ arch/arc/mm/mmap.c | 2 +- arch/arm/mm/mmap.c | 4 +- arch/frv/mm/elf-fdpic.c | 2 +- arch/mips/mm/mmap.c | 2 +- arch/parisc/kernel/sys_parisc.c | 15 ++- arch/powerpc/mm/hugetlbpage-radix.c | 2 +- arch/powerpc/mm/mmap.c | 4 +- arch/powerpc/mm/slice.c | 2 +- arch/s390/mm/mmap.c | 4 +- arch/sh/mm/mmap.c | 4 +- arch/sparc/kernel/sys_sparc_64.c | 4 +- arch/sparc/mm/hugetlbpage.c | 2 +- arch/tile/mm/hugetlbpage.c | 2 +- arch/x86/kernel/sys_x86_64.c | 4 +- arch/x86/mm/hugetlbpage.c | 2 +- arch/xtensa/kernel/syscall.c | 2 +- fs/hugetlbfs/inode.c | 2 +- fs/proc/task_mmu.c | 4 - include/linux/mm.h | 53 ++++----- mm/gup.c | 5 - mm/memory.c | 38 ------ mm/mmap.c | 149 ++++++++++++++---------- 23 files changed, 152 insertions(+), 163 deletions(-) commit 1132d5e7b64445b3fa3cb982e6723e33318f7655 Merge: 3696e4f a1858df Author: Linus Torvalds Date: Mon Jun 19 16:50:09 2017 +0800 Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC fixes from Olof Johansson: "Stream of fixes has slowed down, only a few this week: - Some DT fixes for Allwinner platforms, and addition of a clock to the R_CCU clock controller that had been missed. - A couple of small DT fixes for am335x-sl50" * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: arm64: allwinner: a64: Add PLL_PERIPH0 clock to the R_CCU ARM: sunxi: h3-h5: Add PLL_PERIPH0 clock to the R_CCU ARM: dts: am335x-sl50: Fix cannot claim requested pins for spi0 ARM: dts: am335x-sl50: Fix card detect pin for mmc1 arm64: allwinner: h5: Remove syslink to shared DTSI ARM: sunxi: h3/h5: fix the compatible of R_CCU commit b7f5dd36e0c5cb9ca1070a5e0f22f666bcff07ef Author: Ville Syrjälä Date: Thu Jun 1 17:36:14 2017 +0300 drm/i915: Plumb the correct acquire ctx into intel_crtc_disable_noatomic() If intel_crtc_disable_noatomic() were to ever get called during resume we'd end up deadlocking since resume has its own acqcuire_ctx but intel_crtc_disable_noatomic() still tries to use the mode_config.acquire_ctx. Pass down the correct acquire ctx from the top. Cc: stable@vger.kernel.org Cc: Maarten Lankhorst Fixes: e2c8b8701e2d ("drm/i915: Use atomic helpers for suspend, v2.") Signed-off-by: Ville Syrjälä Link: http://patchwork.freedesktop.org/patch/msgid/20170601143619.27840-3-ville.syrjala@linux.intel.com Reviewed-by: Maarten Lankhorst (cherry picked from commit da1d0e265535634bba80d44510b864c620549bee) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_display.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 17b206c27366f3cee816eaf86fafc6a11f628ecf Author: Ville Syrjälä Date: Thu Jun 1 17:36:13 2017 +0300 drm/i915: Fix deadlock witha the pipe A quirk during resume Pass down the correct acquire context to the pipe A quirk load detect hack during display resume. Avoids deadlocking the entire thing. Cc: stable@vger.kernel.org Cc: Maarten Lankhorst Fixes: e2c8b8701e2d ("drm/i915: Use atomic helpers for suspend, v2.") Signed-off-by: Ville Syrjälä Link: http://patchwork.freedesktop.org/patch/msgid/20170601143619.27840-2-ville.syrjala@linux.intel.com Reviewed-by: Maarten Lankhorst (cherry picked from commit aecd36b8a16b2302b33f49ba3fa24c955f1e32f7) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_display.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) commit ce2c58724f7d07e76dadfeba53d6877a9e67341d Author: Chris Wilson Date: Fri Jun 9 12:03:47 2017 +0100 drm/i915: Remove __GFP_NORETRY from our buffer allocator I tried __GFP_NORETRY in the belief that __GFP_RECLAIM was effective. It struggles with handling reclaim of our dirty buffers and relies on reclaim via kswapd. As a result, a single pass of direct reclaim is unreliable when i915 occupies the majority of available memory, and the only means of effectively waiting on kswapd to amke progress is by not setting the __GFP_NORETRY flag and lopping. That leaves us with the dilemma of invoking the oomkiller instead of propagating the allocation failure back to userspace where it can be handled more gracefully (one hopes). In the future we may have __GFP_MAYFAIL to allow repeats up until we genuinely run out of memory and the oomkiller would have been invoked. Until then, let the oomkiller wreck havoc. v2: Stop playing with side-effects of gfp flags and await __GFP_MAYFAIL v3: Update comments that direct reclaim only appears to be ignoring our dirty buffers! Fixes: 24f8e00a8a2e ("drm/i915: Prefer to report ENOMEM rather than incur the oom for gfx allocations") Testcase: igt/gem_tiled_swapping Signed-off-by: Chris Wilson Cc: Mika Kuoppala Cc: Joonas Lahtinen Cc: Daniel Vetter Cc: Michal Hocko Link: http://patchwork.freedesktop.org/patch/msgid/20170609110350.1767-2-chris@chris-wilson.co.uk Reviewed-by: Joonas Lahtinen (cherry picked from commit eaf41801559a687cc7511c04dc712984765c9dd7) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_gem.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) commit b8d5a9ccfba5fc084b50b00b9f5b587a8e64b72c Author: Chris Wilson Date: Fri Jun 9 12:03:46 2017 +0100 drm/i915: Encourage our shrinker more when our shmemfs allocations fails Commit 24f8e00a8a2e ("drm/i915: Prefer to report ENOMEM rather than incur the oom for gfx allocations") made the bold decision to try and avoid the oomkiller by reporting -ENOMEM to userspace if our allocation failed after attempting to free enough buffer objects. In short, it appears we were giving up too easily (even before we start wondering if one pass of reclaim is as strong as we would like). Part of the problem is that if we only shrink just enough pages for our expected allocation, the likelihood of those pages becoming available to us is less than 100% To counter-act that we ask for twice the number of pages to be made available. Furthermore, we allow the shrinker to pull pages from the active list in later passes. v2: Be a little more cautious in paging out gfx buffers, and leave that to a more balanced approach from shrink_slab(). Important when combined with "drm/i915: Start writeback from the shrinker" as anything shrunk is immediately swapped out and so should be more conservative. Fixes: 24f8e00a8a2e ("drm/i915: Prefer to report ENOMEM rather than incur the oom for gfx allocations") Signed-off-by: Chris Wilson Cc: Mika Kuoppala Cc: Joonas Lahtinen Cc: Daniel Vetter Reviewed-by: Joonas Lahtinen Link: http://patchwork.freedesktop.org/patch/msgid/20170609110350.1767-1-chris@chris-wilson.co.uk (cherry picked from commit 4846bf0ca8cb4304dde6140eff33a92b3fe8ef24) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_gem.c | 50 ++++++++++++++++++++++++----------------- 1 file changed, 29 insertions(+), 21 deletions(-) commit a21ef715fbb8210c50b1d684145f8acdf2339596 Author: Chris Wilson Date: Thu Jun 15 14:11:29 2017 +0100 drm/i915: Differentiate between sw write location into ring and last hw read We need to keep track of the last location we ask the hw to read up to (RING_TAIL) separately from our last write location into the ring, so that in the event of a GPU reset we do not tell the HW to proceed into a partially written request (which can happen if that request is waiting for an external signal before being executed). v2: Refactor intel_ring_reset() (Mika) Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=100144 Testcase: igt/gem_exec_fence/await-hang Fixes: 821ed7df6e2a ("drm/i915: Update reset path to fix incomplete requests") Fixes: d55ac5bf97c6 ("drm/i915: Defer transfer onto execution timeline to actual hw submission") Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Cc: Mika Kuoppala Link: http://patchwork.freedesktop.org/patch/msgid/20170425130049.26147-1-chris@chris-wilson.co.uk Reviewed-by: Mika Kuoppala (cherry picked from commit e6ba9992de6c63fe86c028b4876338e1cb7dac34) Signed-off-by: Jani Nikula Link: http://patchwork.freedesktop.org/patch/msgid/20170615131129.3061-1-chris@chris-wilson.co.uk drivers/gpu/drm/i915/i915_gem_request.c | 2 +- drivers/gpu/drm/i915/i915_guc_submission.c | 4 +-- drivers/gpu/drm/i915/intel_lrc.c | 6 ++--- drivers/gpu/drm/i915/intel_ringbuffer.c | 41 ++++++++++++++++++++---------- drivers/gpu/drm/i915/intel_ringbuffer.h | 19 ++++++++++++-- 5 files changed, 48 insertions(+), 24 deletions(-) commit 4b153ca989a9bf61f622ded32e1d689df88edaa5 Merge: 46f8cd9 68dd02d Author: David S. Miller Date: Mon Jun 19 00:03:51 2017 -0400 Merge tag 'mac80211-for-davem-2017-06-16' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== Here's just the fix for that ancient bug: * remove wext calling ndo_do_ioctl, since nobody needs that now and it makes the type change easier * use struct iwreq instead of struct ifreq almost everywhere in wireless extensions code * copy only struct iwreq from userspace in dev_ioctl for the wireless extensions, since it's smaller than struct ifreq ==================== Signed-off-by: David S. Miller commit 46f8cd9d2fc1e4e8b82b53a0007f6c92e80c930b Author: Haishuang Yan Date: Sat Jun 17 11:38:05 2017 +0800 ip6_tunnel: Correct tos value in collect_md mode Same as ip_gre, geneve and vxlan, use key->tos as traffic class value. CC: Peter Dawson Fixes: 0e9a709560db ("ip6_tunnel, ip6_gre: fix setting of DSCP on encapsulated packets”) Signed-off-by: Haishuang Yan Acked-by: Peter Dawson Signed-off-by: David S. Miller net/ipv6/ip6_tunnel.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit a1858df975edf6706e7a5a3ae000e52d81076807 Merge: 51b6e28 f74994a Author: Olof Johansson Date: Sun Jun 18 20:42:21 2017 -0700 Merge tag 'sunxi-fixes-for-4.12' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into fixes Allwinner fixes for 4.12 A few fixes around the PRCM support that got in 4.12 with a wrong compatible, and a missing clock in the binding. * tag 'sunxi-fixes-for-4.12' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: arm64: allwinner: a64: Add PLL_PERIPH0 clock to the R_CCU ARM: sunxi: h3-h5: Add PLL_PERIPH0 clock to the R_CCU arm64: allwinner: h5: Remove syslink to shared DTSI ARM: sunxi: h3/h5: fix the compatible of R_CCU Signed-off-by: Olof Johansson commit 51b6e2813ca1d7cb530d5f834ea22f1ae52b7e35 Merge: 151d1d7 db145db Author: Olof Johansson Date: Sun Jun 18 18:55:12 2017 -0700 Merge tag 'omap-for-v4.12/fixes-sl50' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes Two fixes for am335x-sl50 to fix a boot time error for claiming SPI pins, and to fix a SDIO card detect pin for production version of the device. * tag 'omap-for-v4.12/fixes-sl50' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: ARM: dts: am335x-sl50: Fix cannot claim requested pins for spi0 ARM: dts: am335x-sl50: Fix card detect pin for mmc1 Signed-off-by: Olof Johansson commit 3696e4f0b0072eb9753ffa1387be1dd2ebe2cb8f Merge: 7d62d94 e41b135 Author: Linus Torvalds Date: Mon Jun 19 09:25:05 2017 +0900 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio bugfix from Michael Tsirkin: "It turns out balloon does not handle IOMMUs correctly. We should fix that at some point, for now let's just disable this configuration" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: virtio_balloon: disable VIOMMU support commit 7d62d947605640b403fcb75d7928241d34231b4a Merge: b3ee4ed 17e8354 Author: Linus Torvalds Date: Mon Jun 19 09:20:25 2017 +0900 Merge branch 'i2c/for-current-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "Two driver bugfixes" * 'i2c/for-current-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: ismt: fix wrong device address when unmap the data buffer i2c: rcar: use correct length when unmapping DMA commit b3ee4edd8a18a5ff7c077b6b112692f1d6e9dd16 Merge: edf9364 bcd7c45 Author: Linus Torvalds Date: Mon Jun 19 09:01:01 2017 +0900 Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus Pull MIPS fixes from Ralf Baechle: - Three highmem fixes: + Fixed mapping initialization + Adjust the pkmap location + Ensure we use at most one page for PTEs - Fix makefile dependencies for .its targets to depend on vmlinux - Fix reversed condition in BNEZC and JIALC software branch emulation - Only flush initialized flush_insn_slot to avoid NULL pointer dereference - perf: Remove incorrect odd/even counter handling for I6400 - ftrace: Fix init functions tracing * 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus: MIPS: .its targets depend on vmlinux MIPS: Fix bnezc/jialc return address calculation MIPS: kprobes: flush_insn_slot should flush only if probe initialised MIPS: ftrace: fix init functions tracing MIPS: mm: adjust PKMAP location MIPS: highmem: ensure that we don't use more than one page for PTEs MIPS: mm: fixed mappings: correct initialisation MIPS: perf: Remove incorrect odd/even counter handling for I6400 commit 779f19ac9d5858a2c159030c0c166f7da46b74ae Author: Hans de Goede Date: Sun Jun 18 15:10:26 2017 -0700 Input: soc_button_array - fix leaking the ACPI button descriptor buffer We are passing a buffer with ACPI_ALLOCATE_BUFFER set to acpi_evaluate_object, so we must free it when we are done with it. Signed-off-by: Hans de Goede Signed-off-by: Dmitry Torokhov drivers/input/misc/soc_button_array.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) commit e41b1355508debe45fda33ef8c03ff3ba5d206b9 Author: Michael S. Tsirkin Date: Tue Jun 13 20:56:44 2017 +0300 virtio_balloon: disable VIOMMU support virtio balloon bypasses the DMA API entirely so does not support the VIOMMU right now. It's not clear we need that support, for now let's just make sure we don't pretend to support it. Cc: stable@vger.kernel.org Cc: Wei Wang Fixes: 1a937693993f ("virtio: new feature to detect IOMMU device quirk") Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang drivers/virtio/virtio_balloon.c | 7 +++++++ 1 file changed, 7 insertions(+) commit edf9364d3f924aff6f77176b8e52a4b68e5c30d6 Merge: 4f51d57 d9ee35a Author: Linus Torvalds Date: Sun Jun 18 18:49:12 2017 +0900 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Thomas Gleixner: "Two fixlets for x86: - Handle WARN_ONs proper with the new UD based WARN implementation - Disable 1G mappings when 2M mappings are disabled by kmemleak or debug_pagealloc. Otherwise 1G mappings might still be used, confusing the debug mechanisms" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mm: Disable 1GB direct mappings when disabling 2MB mappings x86/debug: Handle early WARN_ONs proper commit 4f51d57f3ff0f30bd805ff5bd04587a6145e1f73 Merge: 0be5255 94114c3 Author: Linus Torvalds Date: Sun Jun 18 18:46:51 2017 +0900 Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fixes from Thomas Gleixner: "Three fixlets for timers: - Two hot-fixes for the alarmtimer based posix timers, which prevent a nasty DOS by self rescheduling timers. The proper cleanup of that mess is queued for 4.13 - Make a function static" * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: tick/broadcast: Make tick_broadcast_setup_oneshot() static alarmtimer: Rate limit periodic intervals alarmtimer: Prevent overflow of relative timers commit 0be5255c88dace8b4e0ef19f2a9c3d0f3598c6e6 Merge: a1ff31d 252d2a4 Author: Linus Torvalds Date: Sun Jun 18 18:45:17 2017 +0900 Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Thomas Gleixner: "Two small fixes for the schedulre core: - Use the proper switch_mm() variant in idle_task_exit() because that code is not called with interrupts disabled. - Fix a confusing typo in a printk" * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/core: Idle_task_exit() shouldn't use switch_mm_irqs_off() sched/fair: Fix typo in printk message commit a1ff31d74663077524aae3c2e90a76590c5002e8 Merge: 2277ba7 531c221 Author: Linus Torvalds Date: Sun Jun 18 18:42:31 2017 +0900 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Thomas Gleixner: "Three fixes for the perf user space side: - Fix the probing of precise_ip level, which got broken recently for x86. - Unbreak the ARCH=x86_64 build - Report module before trying to unwind into the module code, which avoids broken stack frames displayed" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf unwind: Report module before querying isactivation in dwfl unwind perf tools: Fix build with ARCH=x86_64 perf evsel: Fix probing of precise_ip level for default cycles event commit 2277ba7cfd43c557eab882757b64755eb0a8ea95 Merge: 0cbf341 fa07ab7 Author: Linus Torvalds Date: Sun Jun 18 18:40:41 2017 +0900 Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fix from Thomas Gleixner: "Add a missing resource release to an error path" * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: genirq: Release resources in __setup_irq() error path commit 0cbf3415087c9ec997300b8ba15c12d26ac28e0a Merge: 374d801 92b0a14 Author: Linus Torvalds Date: Sun Jun 18 18:38:42 2017 +0900 Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull objtool fix from Thomas Gleixner: "A single fix which adds fortify_panic to the list of no return functions" * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: objtool: Add fortify_panic as __noreturn function commit 374d801522fb4a809395c188b1a867c5ebcda752 Merge: 19ea9d6 436c4c45 Author: Linus Torvalds Date: Sun Jun 18 08:51:35 2017 +0900 Merge tag 'led_fixes_for_4.12-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds Pull LED fixes from Jacek Anaszewski: "Two LED fixes: - fix signal source assignment for leds-bcm6328 - revert patch that intended to fix LED behavior on suspend but it had a side effect preventing suspend at all due to uevent being sent on trigger removal" * tag 'led_fixes_for_4.12-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds: Revert "leds: handle suspend/resume in heartbeat trigger" leds: bcm6328: fix signal source assignment for leds 4 to 7 commit 19ea9d668a1f9f1e5e6752549150795a6693e6ad Merge: 1be627d f16443a Author: Linus Torvalds Date: Sun Jun 18 08:39:54 2017 +0900 Merge tag 'usb-4.12-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some small gadget and xhci USB fixes for 4.12-rc6. Nothing major, but one of the gadget patches does fix a reported oops, and the xhci ones resolve reported problems. All have been in linux-next with no reported issues" * tag 'usb-4.12-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: USB: gadgetfs, dummy-hcd, net2280: fix locking for callbacks usb: xhci: ASMedia ASM1042A chipset need shorts TX quirk usb: xhci: Fix USB 3.1 supported protocol parsing USB: gadget: fix GPF in gadgetfs usb: gadget: composite: make sure to reactivate function on unbind commit 1be627dfa74d9eee1eca1bc48653e461366a2bb9 Merge: 6e20350 ed6456a Author: Linus Torvalds Date: Sun Jun 18 08:36:30 2017 +0900 Merge tag 'staging-4.12-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging and IIO fixes from Greg KH: "Here are some small staging and IIO driver fixes for 4.12-rc6. Nothing huge, just a few small driver fixes for reported issues. All have been in linux-next with no reported issues" * tag 'staging-4.12-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: Staging: rtl8723bs: fix an error code in isFileReadable() iio: buffer-dmaengine: Add missing header buffer_impl.h iio: buffer-dma: Add missing header buffer_impl.h iio: adc: meson-saradc: fix potential crash in meson_sar_adc_clear_fifo iio: adc: mxs-lradc: Fix return value check in mxs_lradc_adc_probe() iio: imu: inv_mpu6050: add accel lpf setting for chip >= MPU6500 staging: iio: ad7152: Fix deadlock in ad7152_write_raw_samp_freq() commit 6e203506599bdd1e73f4850d94ccc762980fd9cd Merge: adc3110 4ca2fea Author: Linus Torvalds Date: Sun Jun 18 08:23:02 2017 +0900 Merge tag 'ceph-for-4.12-rc6' of git://github.com/ceph/ceph-client Pull ceph fixes from Ilya Dryomov: "A fix for an old ceph ->fh_to_* bug from Luis and two timestamp fixups from Zheng, prompted by the ongoing y2038 work" * tag 'ceph-for-4.12-rc6' of git://github.com/ceph/ceph-client: ceph: unify inode i_ctime update ceph: use current_kernel_time() to get request time stamp ceph: check i_nlink while converting a file handle to dentry commit 77e9ce327d9b607cd6e57c0f4524a654dc59c4b1 Author: Al Viro Date: Sat Jun 17 15:44:06 2017 -0400 ufs: fix the logics for tail relocation * original hysteresis loop got broken by typo back in 2002; now it never switches out of OPTTIME state. Fixed. * critical levels for switching from OPTTIME to OPTSPACE and back ought to be calculated once, at mount time. * we should use mul_u64_u32_div() for those calculations, now that ->s_dsize is 64bit. * to quote Kirk McKusick (in 1995 FreeBSD commit message): The threshold for switching from time-space and space-time is too small when minfree is 5%...so make it stay at space in this case. Signed-off-by: Al Viro fs/ufs/balloc.c | 22 ++++++---------------- fs/ufs/super.c | 9 +++++++++ fs/ufs/ufs_fs.h | 2 ++ 3 files changed, 17 insertions(+), 16 deletions(-) commit 57db7e4a2d92c2d3dfbca4ef8057849b2682436b Author: Eric W. Biederman Date: Tue Jun 13 04:31:16 2017 -0500 signal: Only reschedule timers on signals timers have sent Thomas Gleixner wrote: > The CRIU support added a 'feature' which allows a user space task to send > arbitrary (kernel) signals to itself. The changelog says: > > The kernel prevents sending of siginfo with positive si_code, because > these codes are reserved for kernel. I think we can allow a task to > send such a siginfo to itself. This operation should not be dangerous. > > Quite contrary to that claim, it turns out that it is outright dangerous > for signals with info->si_code == SI_TIMER. The following code sequence in > a user space task allows to crash the kernel: > > id = timer_create(CLOCK_XXX, ..... signo = SIGX); > timer_set(id, ....); > info->si_signo = SIGX; > info->si_code = SI_TIMER: > info->_sifields._timer._tid = id; > info->_sifields._timer._sys_private = 2; > rt_[tg]sigqueueinfo(..., SIGX, info); > sigemptyset(&sigset); > sigaddset(&sigset, SIGX); > rt_sigtimedwait(sigset, info); > > For timers based on CLOCK_PROCESS_CPUTIME_ID, CLOCK_THREAD_CPUTIME_ID this > results in a kernel crash because sigwait() dequeues the signal and the > dequeue code observes: > > info->si_code == SI_TIMER && info->_sifields._timer._sys_private != 0 > > which triggers the following callchain: > > do_schedule_next_timer() -> posix_cpu_timer_schedule() -> arm_timer() > > arm_timer() executes a list_add() on the timer, which is already armed via > the timer_set() syscall. That's a double list add which corrupts the posix > cpu timer list. As a consequence the kernel crashes on the next operation > touching the posix cpu timer list. > > Posix clocks which are internally implemented based on hrtimers are not > affected by this because hrtimer_start() can handle already armed timers > nicely, but it's a reliable way to trigger the WARN_ON() in > hrtimer_forward(), which complains about calling that function on an > already armed timer. This problem has existed since the posix timer code was merged into 2.5.63. A few releases earlier in 2.5.60 ptrace gained the ability to inject not just a signal (which linux has supported since 1.0) but the full siginfo of a signal. The core problem is that the code will reschedule in response to signals getting dequeued not just for signals the timers sent but for other signals that happen to a si_code of SI_TIMER. Avoid this confusion by testing to see if the queued signal was preallocated as all timer signals are preallocated, and so far only the timer code preallocates signals. Move the check for if a timer needs to be rescheduled up into collect_signal where the preallocation check must be performed, and pass the result back to dequeue_signal where the code reschedules timers. This makes it clear why the code cares about preallocated timers. Cc: stable@vger.kernel.org Reported-by: Thomas Gleixner History Tree: https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git Reference: 66dd34ad31e5 ("signal: allow to send any siginfo to itself") Reference: 1669ce53e2ff ("Add PTRACE_GETSIGINFO and PTRACE_SETSIGINFO") Fixes: db8b50ba75f2 ("[PATCH] POSIX clocks & timers") Signed-off-by: "Eric W. Biederman" kernel/signal.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) commit c0ef65d2928249e822b813beb41b6c1478c556ab Author: Al Viro Date: Fri Jun 16 23:54:47 2017 -0400 ufs_iget(): fail with -ESTALE on deleted inode Signed-off-by: Al Viro fs/ufs/inode.c | 21 ++++++++------------- 1 file changed, 8 insertions(+), 13 deletions(-) commit 23ac7cba73bb2c6e80f9cdebeb39dc3dad34ebb3 Author: Al Viro Date: Fri Jun 16 23:49:17 2017 -0400 fix signedness of timestamps on ufs1 Signed-off-by: Al Viro fs/ufs/inode.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit adc311034c356e884d180df25deb046cef3e8c75 Merge: c8636b9 95989c4 Author: Linus Torvalds Date: Sat Jun 17 17:34:41 2017 +0900 Merge tag 'xfs-4.12-fixes-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fix from Darrick Wong: "One more bugfix for you for 4.12-rc6 to fix something that came up in an earlier rc: - Fix some bogus ASSERT failures on CONFIG_SMP=n and CONFIG_XFS_DEBUG=y" * tag 'xfs-4.12-fixes-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: fix spurious spin_is_locked() assert failures on non-smp kernels commit c8636b90a091331beb0a26c455a0c87b93aa774a Merge: ccd3d90 a8fad98 Author: Linus Torvalds Date: Sat Jun 17 17:30:07 2017 +0900 Merge branch 'ufs-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull ufs fixes from Al Viro: "Fix assorted ufs bugs: a couple of deadlocks, fs corruption in truncate(), oopsen on tail unpacking and truncate when racing with vmscan, mild fs corruption (free blocks stats summary buggered, *BSD fsck would complain and fix), several instances of broken logics around reserved blocks (starting with "check almost never triggers when it should" and then there are issues with sufficiently large UFS2)" [ Note: ufs hasn't gotten any loving in a long time, because nobody really seems to use it. These ufs fixes are triggered by people actually caring now, not some sudden influx of new bugs. - Linus ] * 'ufs-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: ufs_truncate_blocks(): fix the case when size is in the last direct block ufs: more deadlock prevention on tail unpacking ufs: avoid grabbing ->truncate_mutex if possible ufs_get_locked_page(): make sure we have buffer_heads ufs: fix s_size/s_dsize users ufs: fix reserved blocks check ufs: make ufs_freespace() return signed ufs: fix logics in "ufs: make fsck -f happy" commit ccd3d905f74abbfef4960d6262f057fbb4a02903 Merge: 1439ccf 4068367 Author: Linus Torvalds Date: Sat Jun 17 17:26:53 2017 +0900 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs fixes from Al Viro: "A couple of fixes; a leak in mntns_install() caught by Andrei (this cycle regression) + d_invalidate() softlockup fix - that had been reported by a bunch of people lately, but the problem is pretty old" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: fs: don't forget to put old mntns in mntns_install Hang/soft lockup in d_invalidate with simultaneous calls commit 1439ccf73d9c07654fdd5b4969fd53c2feb8684d Merge: 3a44829 98dbf5a Author: Linus Torvalds Date: Sat Jun 17 06:53:20 2017 +0900 Merge tag 'pci-v4.12-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI fixes from Bjorn Helgaas: - fix another PCI_ENDPOINT build error (merged for v4.12) - fix error codes added to config accessors for v4.12 * tag 'pci-v4.12-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: PCI: endpoint: Select CRC32 to fix test build error PCI: Make error code types consistent in pci_{read,write}_config_* commit 3a448294b79ace48cf8ecbbffdeceae49bae00cc Merge: 162f73f b429f96 Author: Linus Torvalds Date: Sat Jun 17 06:51:25 2017 +0900 Merge tag 'fbdev-v4.12-rc6' of git://github.com/bzolnier/linux Pull fbdev fixes from Bartlomiej Zolnierkiewicz: - fix udlfb driver to stop spamming logs (Mike Gerow) - add missing endianness conversions in smscufx & udlfb drivers (Johan Hovold) - fix few gcc warnings/errors (Arnd Bergmann) * tag 'fbdev-v4.12-rc6' of git://github.com/bzolnier/linux: video: fbdev: udlfb: drop log level for blanking video: fbdev: via: remove possibly unused variables video: fbdev: add missing USB-descriptor endianness conversions video: fbdev: avoid int-in-bool-context warning commit 162f73f4b974aa08ab37e9d59f0428edfa8dbc51 Merge: 5ac447d d7143e3 Author: Linus Torvalds Date: Sat Jun 17 06:49:34 2017 +0900 Merge branch 'akpm' (patches from Andrew) Merge misc fixes from Andrew Morton: "5 fixes" * emailed patches from Andrew Morton : mm: correct the comment when reclaimed pages exceed the scanned pages userfaultfd: shmem: handle coredumping in handle_userfault() mm: numa: avoid waiting on freed migrated pages swap: cond_resched in swap_cgroup_prepare() mm/memory-failure.c: use compound_head() flags for huge pages commit d7143e31259cb029e207619209b31aa7520f8e28 Author: zhongjiang Date: Fri Jun 16 14:02:40 2017 -0700 mm: correct the comment when reclaimed pages exceed the scanned pages Commit e1587a494540 ("mm: vmpressure: fix sending wrong events on underflow") declared that reclaimed pages exceed the scanned pages due to the thp reclaim. That is incorrect because THP will be spilt to normal page and loop again, which will result in the scanned pages increment. [akpm@linux-foundation.org: tweak comment text] Link: http://lkml.kernel.org/r/1496824266-25235-1-git-send-email-zhongjiang@huawei.com Signed-off-by: zhongjiang Acked-by: Minchan Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/vmpressure.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 64c2b20301f62c697352c8028c569b1b2bdd8e82 Author: Andrea Arcangeli Date: Fri Jun 16 14:02:37 2017 -0700 userfaultfd: shmem: handle coredumping in handle_userfault() Anon and hugetlbfs handle FOLL_DUMP set by get_dump_page() internally to __get_user_pages(). shmem as opposed has no special FOLL_DUMP handling there so handle_mm_fault() is invoked without mmap_sem and ends up calling handle_userfault() that isn't expecting to be invoked without mmap_sem held. This makes handle_userfault() fail immediately if invoked through shmem_vm_ops->fault during coredumping and solves the problem. The side effect is a BUG_ON with no lock held triggered by the coredumping process which exits. Only 4.11 is affected, pre-4.11 anon memory holes are skipped in __get_user_pages by checking FOLL_DUMP explicitly against empty pagetables (mm/gup.c:no_page_table()). It's zero cost as we already had a check for current->flags to prevent futex to trigger userfaults during exit (PF_EXITING). Link: http://lkml.kernel.org/r/20170615214838.27429-1-aarcange@redhat.com Signed-off-by: Andrea Arcangeli Reported-by: "Dr. David Alan Gilbert" Cc: [4.11+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/userfaultfd.c | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-) commit 3c226c637b69104f6b9f1c6ec5b08d7b741b3229 Author: Mark Rutland Date: Fri Jun 16 14:02:34 2017 -0700 mm: numa: avoid waiting on freed migrated pages In do_huge_pmd_numa_page(), we attempt to handle a migrating thp pmd by waiting until the pmd is unlocked before we return and retry. However, we can race with migrate_misplaced_transhuge_page(): // do_huge_pmd_numa_page // migrate_misplaced_transhuge_page() // Holds 0 refs on page // Holds 2 refs on page vmf->ptl = pmd_lock(vma->vm_mm, vmf->pmd); /* ... */ if (pmd_trans_migrating(*vmf->pmd)) { page = pmd_page(*vmf->pmd); spin_unlock(vmf->ptl); ptl = pmd_lock(mm, pmd); if (page_count(page) != 2)) { /* roll back */ } /* ... */ mlock_migrate_page(new_page, page); /* ... */ spin_unlock(ptl); put_page(page); put_page(page); // page freed here wait_on_page_locked(page); goto out; } This can result in the freed page having its waiters flag set unexpectedly, which trips the PAGE_FLAGS_CHECK_AT_PREP checks in the page alloc/free functions. This has been observed on arm64 KVM guests. We can avoid this by having do_huge_pmd_numa_page() take a reference on the page before dropping the pmd lock, mirroring what we do in __migration_entry_wait(). When we hit the race, migrate_misplaced_transhuge_page() will see the reference and abort the migration, as it may do today in other cases. Fixes: b8916634b77bffb2 ("mm: Prevent parallel splits during THP migration") Link: http://lkml.kernel.org/r/1497349722-6731-2-git-send-email-will.deacon@arm.com Signed-off-by: Mark Rutland Signed-off-by: Will Deacon Acked-by: Steve Capper Acked-by: Kirill A. Shutemov Acked-by: Vlastimil Babka Cc: Mel Gorman Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/huge_memory.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit ef70762948dde012146926720b70e79736336764 Author: Yu Zhao Date: Fri Jun 16 14:02:31 2017 -0700 swap: cond_resched in swap_cgroup_prepare() I saw need_resched() warnings when swapping on large swapfile (TBs) because continuously allocating many pages in swap_cgroup_prepare() took too long. We already cond_resched when freeing page in swap_cgroup_swapoff(). Do the same for the page allocation. Link: http://lkml.kernel.org/r/20170604200109.17606-1-yuzhao@google.com Signed-off-by: Yu Zhao Acked-by: Michal Hocko Acked-by: Vladimir Davydov Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/swap_cgroup.c | 3 +++ 1 file changed, 3 insertions(+) commit 7258ae5c5a2ce2f5969e8b18b881be40ab55433d Author: James Morse Date: Fri Jun 16 14:02:29 2017 -0700 mm/memory-failure.c: use compound_head() flags for huge pages memory_failure() chooses a recovery action function based on the page flags. For huge pages it uses the tail page flags which don't have anything interesting set, resulting in: > Memory failure: 0x9be3b4: Unknown page state > Memory failure: 0x9be3b4: recovery action for unknown page: Failed Instead, save a copy of the head page's flags if this is a huge page, this means if there are no relevant flags for this tail page, we use the head pages flags instead. This results in the me_huge_page() recovery action being called: > Memory failure: 0x9b7969: recovery action for huge page: Delayed For hugepages that have not yet been allocated, this allows the hugepage to be dequeued. Fixes: 524fca1e7356 ("HWPOISON: fix misjudgement of page_action() for errors on mlocked pages") Link: http://lkml.kernel.org/r/20170524130204.21845-1-james.morse@arm.com Signed-off-by: James Morse Tested-by: Punit Agrawal Acked-by: Punit Agrawal Acked-by: Naoya Horiguchi Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/memory-failure.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 5ac447d268601f88264ad18a13e7177a455007bb Merge: ab2789b a093c92 Author: Linus Torvalds Date: Sat Jun 17 05:57:54 2017 +0900 Merge tag 'powerpc-4.12-6' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: "Three small fixes for recently merged code: - remove a spurious WARN_ON when a PCI device has no of_node, it's allowed in some circumstances for there to be no of_node. - fix the offset for store EOI MMIOs in the XIVE interrupt controller. - fix non-const WARN_ONs which were becoming BUGs due to them losing BUGFLAG_WARNING in a recent cleanup patch. Thanks to: Alexey Kardashevskiy, Alistair Popple, Benjamin Herrenschmidt" * tag 'powerpc-4.12-6' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/debug: Add missing warn flag to WARN_ON's non-builtin path powerpc/xive: Fix offset for store EOI MMIOs powerpc/npu-dma: Remove spurious WARN_ON when a PCI device has no of_node commit 531c221df182af5a7fc2bf7ba7eee89354fe9a10 Merge: 63f700a 9126cbb Author: Ingo Molnar Date: Fri Jun 16 21:33:48 2017 +0200 Merge tag 'perf-urgent-for-mingo-4.12-20170616' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/urgent fixes from Arnaldo Carvalho de Melo: - Fix probing of precise_ip level for default cycles event, that got broken recently on x86_64 when its arch code started considering invalid requesting precise samples when not sampling (i.e. when attr.sample_period == 0). This also fixes another problem in s/390 where the precision probing with sample_period == 0 returned precise_ip > 0, that then, when setting up the real cycles event (not probing) would return EOPNOTSUPP for precise_ip > 0 (as determined previously by probing) and sample_period > 0. These problems resulted in attr_precise not being set to the highest precision available on x86.64 when no event was specified, i.e. the canonical: perf record ./workload would end up using attr.precise_ip = 0. As a workaround this would need to be done: perf record -e cycles:P ./workload And on s/390 it would plain not work, requiring using: perf record -e cycles ./workload as a workaround. (Arnaldo Carvalho de Melo) - Fix perf build with ARCH=x86_64, when ARCH should be transformed into ARCH=x86, just like with the main kernel Makefile and tools/objtool's, i.e. use SRCARCH. (Jiada Wang) - Avoid accessing uninitialized data structures when unwinding with elfutils's libdw, making it more closely mimic libunwind's unwinder. (Milian Wolff) Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit 76371d2e3ad1f84426a30ebcd8c3b9b98f4c724f Author: Wei Wang Date: Fri Jun 16 10:46:37 2017 -0700 decnet: always not take dst->__refcnt when inserting dst into hash table In the existing dn_route.c code, dn_route_output_slow() takes dst->__refcnt before calling dn_insert_route() while dn_route_input_slow() does not take dst->__refcnt before calling dn_insert_route(). This makes the whole routing code very buggy. In dn_dst_check_expire(), dnrt_free() is called when rt expires. This makes the routes inserted by dn_route_output_slow() not able to be freed as the refcnt is not released. In dn_dst_gc(), dnrt_drop() is called to release rt which could potentially cause the dst->__refcnt to be dropped to -1. In dn_run_flush(), dst_free() is called to release all the dst. Again, it makes the dst inserted by dn_route_output_slow() not able to be released and also, it does not wait on the rcu and could potentially cause crash in the path where other users still refer to this dst. This patch makes sure both input and output path do not take dst->__refcnt before calling dn_insert_route() and also makes sure dnrt_free()/dst_free() is called when removing dst from the hash table. The only difference between those 2 calls is that dnrt_free() waits on the rcu while dst_free() does not. Signed-off-by: Wei Wang Acked-by: Martin KaFai Lau Signed-off-by: David S. Miller net/decnet/dn_route.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) commit 9126cbbacecb8917bd0418809ef1d26616b2061e Author: Milian Wolff Date: Fri Jun 2 16:37:53 2017 +0200 perf unwind: Report module before querying isactivation in dwfl unwind The PC returned by dwfl_frame_pc() may map into a not-yet-reported module. We have to report it before we continue unwinding. But when we query for the isactivation flag in dwfl_frame_pc, libdw will actually do one more unwinding step internally which can then break and lead to missed frames or broken stacks. With libunwind we get e.g.: ~~~~~ heaptrack_gui 2228 135073.400474: 613969 cycles: 108c8e [unknown] (/usr/lib/libQt5Core.so.5.8.0) 1093bc [unknown] (/usr/lib/libQt5Core.so.5.8.0) 109e7b QLocale::QLocale (/usr/lib/libQt5Core.so.5.8.0) 1470ff [unknown] (/usr/lib/libQt5Core.so.5.8.0) 147f67 QSystemLocale::query (/usr/lib/libQt5Core.so.5.8.0) 109fbf QLocalePrivate::updateSystemPrivate (/usr/lib/libQt5Core.so.5.8.0) 10aa27 QLocale::QLocale (/usr/lib/libQt5Core.so.5.8.0) 1e02c3 [unknown] (/usr/lib/libQt5Core.so.5.8.0) 2113bb [unknown] (/usr/lib/libQt5Core.so.5.8.0) 211505 [unknown] (/usr/lib/libQt5Core.so.5.8.0) 1b5df0 QFileInfo::exists (/usr/lib/libQt5Core.so.5.8.0) 92eb2 [unknown] (/usr/lib/libQt5Core.so.5.8.0) 93423 [unknown] (/usr/lib/libQt5Core.so.5.8.0) 93d2a QLibraryInfo::location (/usr/lib/libQt5Core.so.5.8.0) 2170af [unknown] (/usr/lib/libQt5Core.so.5.8.0) 297c53 QCoreApplicationPrivate::init (/usr/lib/libQt5Core.so.5.8.0) f7cde QGuiApplicationPrivate::init (/usr/lib/libQt5Gui.so.5.8.0) 1589e8 QApplicationPrivate::init (/usr/lib/libQt5Widgets.so.5.8.0) 78622 main (/home/milian/projects/compiled/other/bin/heaptrack_gui) 20439 __libc_start_main (/usr/lib/libc-2.25.so) 78299 _start (/home/milian/projects/compiled/other/bin/heaptrack_gui) heaptrack_gui 2228 135073.401156: 569521 cycles: 131633 QString::endsWith (/usr/lib/libQt5Core.so.5.8.0) 1a0701 QDir::cleanPath (/usr/lib/libQt5Core.so.5.8.0) 21b82d [unknown] (/usr/lib/libQt5Core.so.5.8.0) 1b3727 QFileInfo::canonicalFilePath (/usr/lib/libQt5Core.so.5.8.0) 2780c7 QFactoryLoader::update (/usr/lib/libQt5Core.so.5.8.0) 279525 QFactoryLoader::QFactoryLoader (/usr/lib/libQt5Core.so.5.8.0) e5bd0 QPlatformIntegrationFactory::create (/usr/lib/libQt5Gui.so.5.8.0) f5a1c QGuiApplicationPrivate::createPlatformIntegration (/usr/lib/libQt5Gui.so.5.8.0) f650c QGuiApplicationPrivate::createEventDispatcher (/usr/lib/libQt5Gui.so.5.8.0) 298524 QCoreApplicationPrivate::init (/usr/lib/libQt5Core.so.5.8.0) f7cde QGuiApplicationPrivate::init (/usr/lib/libQt5Gui.so.5.8.0) 1589e8 QApplicationPrivate::init (/usr/lib/libQt5Widgets.so.5.8.0) 78622 main (/home/milian/projects/compiled/other/bin/heaptrack_gui) 20439 __libc_start_main (/usr/lib/libc-2.25.so) 78299 _start (/home/milian/projects/compiled/other/bin/heaptrack_gui) ~~~~~ Note the two frames 1589e8 and 78622 in the first sample. These are missing when unwinding with libdw. The second sample's breakage is more obvious: ~~~~~ heaptrack_gui 2228 135073.400474: 613969 cycles: 108c8e [unknown] (/usr/lib/libQt5Core.so.5.8.0) 1093bc [unknown] (/usr/lib/libQt5Core.so.5.8.0) 109e7b QLocale::QLocale (/usr/lib/libQt5Core.so.5.8.0) 1470ff [unknown] (/usr/lib/libQt5Core.so.5.8.0) 147f67 QSystemLocale::query (/usr/lib/libQt5Core.so.5.8.0) 109fbf QLocalePrivate::updateSystemPrivate (/usr/lib/libQt5Core.so.5.8.0) 10aa27 QLocale::QLocale (/usr/lib/libQt5Core.so.5.8.0) 1e02c3 [unknown] (/usr/lib/libQt5Core.so.5.8.0) 2113bb [unknown] (/usr/lib/libQt5Core.so.5.8.0) 211505 [unknown] (/usr/lib/libQt5Core.so.5.8.0) 1b5df0 QFileInfo::exists (/usr/lib/libQt5Core.so.5.8.0) 92eb2 [unknown] (/usr/lib/libQt5Core.so.5.8.0) 93423 [unknown] (/usr/lib/libQt5Core.so.5.8.0) 93d2a QLibraryInfo::location (/usr/lib/libQt5Core.so.5.8.0) 2170af [unknown] (/usr/lib/libQt5Core.so.5.8.0) 297c53 QCoreApplicationPrivate::init (/usr/lib/libQt5Core.so.5.8.0) f7cde QGuiApplicationPrivate::init (/usr/lib/libQt5Gui.so.5.8.0) 20439 __libc_start_main (/usr/lib/libc-2.25.so) 78299 _start (/home/milian/projects/compiled/other/bin/heaptrack_gui) heaptrack_gui 2228 135073.401156: 569521 cycles: 131633 QString::endsWith (/usr/lib/libQt5Core.so.5.8.0) 1a0701 QDir::cleanPath (/usr/lib/libQt5Core.so.5.8.0) 21b82d [unknown] (/usr/lib/libQt5Core.so.5.8.0) 1b3727 QFileInfo::canonicalFilePath (/usr/lib/libQt5Core.so.5.8.0) 2780c7 QFactoryLoader::update (/usr/lib/libQt5Core.so.5.8.0) 279525 QFactoryLoader::QFactoryLoader (/usr/lib/libQt5Core.so.5.8.0) e5bd0 QPlatformIntegrationFactory::create (/usr/lib/libQt5Gui.so.5.8.0) 723dbf [unknown] ([unknown]) ~~~~~ This patch fixes this issue and the libdw unwinder mimicks the libunwind behavior more closely. Signed-off-by: Milian Wolff Acked-by: Jan Kratochvil Cc: Jiri Olsa Cc: Namhyung Kim Link: http://lkml.kernel.org/r/20170602143753.16907-2-milian.wolff@kdab.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/unwind-libdw.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit f1925ca50deb48eddafc01bc12c2a17bfbf54425 Author: Haishuang Yan Date: Thu Jun 15 10:29:30 2017 +0800 ip6_tunnel: fix potential issue in __ip6_tnl_rcv When __ip6_tnl_rcv fails, the tun_dst won't be freed, so call dst_release to free it in error code path. Fixes: 8d79266bc48c ("ip6_tunnel: add collect_md mode to IPv6 tunnels") CC: Alexei Starovoitov Tested-by: Zhang Shengju Signed-off-by: Haishuang Yan Signed-off-by: David S. Miller net/ipv6/ip6_tunnel.c | 2 ++ 1 file changed, 2 insertions(+) commit 469f87e158628fe66dcbbce9dd5e7b7acfe934a9 Author: Haishuang Yan Date: Thu Jun 15 10:29:29 2017 +0800 ip_tunnel: fix potential issue in ip_tunnel_rcv When ip_tunnel_rcv fails, the tun_dst won't be freed, so call dst_release to free it in error code path. Fixes: 2e15ea390e6f ("ip_gre: Add support to collect tunnel metadata.") Acked-by: Eric Dumazet Acked-by: Pravin B Shelar Tested-by: Zhang Shengju Signed-off-by: Haishuang Yan Signed-off-by: David S. Miller net/ipv4/ip_tunnel.c | 2 ++ 1 file changed, 2 insertions(+) commit bf05fc25f268cd62f147f368fe65ad3e5b04fe9f Author: Ravi Bangoria Date: Thu Jun 15 19:16:48 2017 +0530 powerpc/perf: Fix oops when kthread execs user process When a kthread calls call_usermodehelper() the steps are: 1. allocate current->mm 2. load_elf_binary() 3. populate current->thread.regs While doing this, interrupts are not disabled. If there is a perf interrupt in the middle of this process (i.e. step 1 has completed but not yet reached to step 3) and if perf tries to read userspace regs, kernel oops with following log: Unable to handle kernel paging request for data at address 0x00000000 Faulting instruction address: 0xc0000000000da0fc ... Call Trace: perf_output_sample_regs+0x6c/0xd0 perf_output_sample+0x4e4/0x830 perf_event_output_forward+0x64/0x90 __perf_event_overflow+0x8c/0x1e0 record_and_restart+0x220/0x5c0 perf_event_interrupt+0x2d8/0x4d0 performance_monitor_exception+0x54/0x70 performance_monitor_common+0x158/0x160 --- interrupt: f01 at avtab_search_node+0x150/0x1a0 LR = avtab_search_node+0x100/0x1a0 ... load_elf_binary+0x6e8/0x15a0 search_binary_handler+0xe8/0x290 do_execveat_common.isra.14+0x5f4/0x840 call_usermodehelper_exec_async+0x170/0x210 ret_from_kernel_thread+0x5c/0x7c Fix it by setting abi to PERF_SAMPLE_REGS_ABI_NONE when userspace pt_regs are not set. Fixes: ed4a4ef85cf5 ("powerpc/perf: Add support for sampling interrupt register state") Cc: stable@vger.kernel.org # v4.7+ Signed-off-by: Ravi Bangoria Acked-by: Naveen N. Rao Signed-off-by: Michael Ellerman arch/powerpc/perf/perf_regs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit d89ba5353f301971dd7d2f9fdf25c4432728f38e Author: Naveen N. Rao Date: Wed Jun 14 00:12:00 2017 +0530 powerpc/64s: Handle data breakpoints in Radix mode On Power9, trying to use data breakpoints throws the splat shown below. This is because the check for a data breakpoint in DSISR is in do_hash_page(), which is not called when in Radix mode. Unable to handle kernel paging request for data at address 0xc000000000e19218 Faulting instruction address: 0xc0000000001155e8 cpu 0x0: Vector: 300 (Data Access) at [c0000000ef1e7b20] pc: c0000000001155e8: find_pid_ns+0x48/0xe0 lr: c000000000116ac4: find_task_by_vpid+0x44/0x90 sp: c0000000ef1e7da0 msr: 9000000000009033 dar: c000000000e19218 dsisr: 400000 Move the check to handle_page_fault() so as to catch data breakpoints in both Hash and Radix MMU modes. We have to change the check in do_hash_page() against 0xa410 to use 0xa450, so as to include the value of (DSISR_DABRMATCH << 16). There are two sites that call handle_page_fault() when in Radix, both already pass DSISR in r4. Fixes: caca285e5ab4 ("powerpc/mm/radix: Use STD_MMU_64 to properly isolate hash related code") Cc: stable@vger.kernel.org # v4.7+ Reported-by: Shriya R. Kulkarni Signed-off-by: Naveen N. Rao [mpe: Fix the fall-through case on hash, we need to reload DSISR] Signed-off-by: Michael Ellerman arch/powerpc/kernel/exceptions-64s.S | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) commit c05b8c4474c03026aaa7f8872e78369f69f1bb08 Author: Naveen N. Rao Date: Thu Jun 1 16:18:17 2017 +0530 powerpc/kprobes: Skip livepatch_handler() for jprobes ftrace_caller() depends on a modified regs->nip to detect if a certain function has been livepatched. However, with KPROBES_ON_FTRACE, it is possible for regs->nip to have been modified by the kprobes pre_handler (jprobes, for instance). In this case, we do not want to invoke the livepatch_handler so as not to consume the livepatch stack. To distinguish between the two (kprobes and livepatch), we check if there is an active kprobe on the current function. If there is, then we know for sure that it must have modified the NIP as we don't support livepatching a kprobe'd function. In this case, we simply skip the livepatch_handler and branch to the new NIP. Otherwise, the livepatch_handler is invoked. Fixes: ead514d5fb30 ("powerpc/kprobes: Add support for KPROBES_ON_FTRACE") Signed-off-by: Naveen N. Rao Reviewed-by: Masami Hiramatsu Signed-off-by: Michael Ellerman arch/powerpc/include/asm/kprobes.h | 1 + arch/powerpc/kernel/kprobes.c | 6 ++++ arch/powerpc/kernel/trace/ftrace_64_mprofile.S | 39 ++++++++++++++++++++++---- 3 files changed, 41 insertions(+), 5 deletions(-) commit a4979a7e71eb8da976cbe4a0a1fa50636e76b04f Author: Naveen N. Rao Date: Thu Jun 1 16:18:16 2017 +0530 powerpc/ftrace: Pass the correct stack pointer for DYNAMIC_FTRACE_WITH_REGS For DYNAMIC_FTRACE_WITH_REGS, we should be passing-in the original set of registers in pt_regs, to capture the state _before_ ftrace_caller. However, we are instead passing the stack pointer *after* allocating a stack frame in ftrace_caller. Fix this by saving the proper value of r1 in pt_regs. Also, use SAVE_10GPRS() to simplify the code. Fixes: 153086644fd1 ("powerpc/ftrace: Add support for -mprofile-kernel ftrace ABI") Cc: stable@vger.kernel.org # v4.6+ Signed-off-by: Naveen N. Rao Signed-off-by: Michael Ellerman arch/powerpc/kernel/trace/ftrace_64_mprofile.S | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) commit a9f8553e935f26cb5447f67e280946b0923cd2dc Author: Naveen N. Rao Date: Thu Jun 1 16:18:15 2017 +0530 powerpc/kprobes: Pause function_graph tracing during jprobes handling This fixes a crash when function_graph and jprobes are used together. This is essentially commit 237d28db036e ("ftrace/jprobes/x86: Fix conflict between jprobes and function graph tracing"), but for powerpc. Jprobes breaks function_graph tracing since the jprobe hook needs to use jprobe_return(), which never returns back to the hook, but instead to the original jprobe'd function. The solution is to momentarily pause function_graph tracing before invoking the jprobe hook and re-enable it when returning back to the original jprobe'd function. Fixes: 6794c78243bf ("powerpc64: port of the function graph tracer") Cc: stable@vger.kernel.org # v2.6.30+ Signed-off-by: Naveen N. Rao Acked-by: Masami Hiramatsu Acked-by: Steven Rostedt (VMware) Signed-off-by: Michael Ellerman arch/powerpc/kernel/kprobes.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit ab2789b72df3cf7a01e30636ea86cbbf44ba2e99 Merge: 20223f0 19e72d3 Author: Linus Torvalds Date: Fri Jun 16 18:45:47 2017 +0900 Merge tag 'configfs-for-4.12' of git://git.infradead.org/users/hch/configfs Pull configfs updates from Christoph Hellwig: "A fix from Nic for a race seen in production (including a stable tag). And while I'm sending you this I'm also sneaking in a trivial new helper from Bart so that we don't need inter-tree dependencies for the next merge window" * tag 'configfs-for-4.12' of git://git.infradead.org/users/hch/configfs: configfs: Introduce config_item_get_unless_zero() configfs: Fix race between create_link and configfs_rmdir commit 20223f0f39ea9d31ece08f04ac79f8c4e8d98246 Author: Christoph Hellwig Date: Fri Jun 16 11:08:24 2017 +0200 fs: pass on flags in compat_writev Fixes: 793b80ef14af ("vfs: pass a flags argument to vfs_readv/vfs_writev") Signed-off-by: Christoph Hellwig Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds fs/read_write.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 35abcd4f9f303ac4f10f99b3f7e993e5f2e6fa37 Author: Arend Van Spriel Date: Fri Jun 16 09:36:35 2017 +0100 brcmfmac: fix uninitialized warning in brcmf_usb_probe_phase2() This fixes the following warning: drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c: In function 'brcmf_usb_probe_phase2': drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c:1198:2: warning: 'devinfo' may be used uninitialized in this function [-Wmaybe-uninitialized] mutex_unlock(&devinfo->dev_init_lock); Fixes: 6d0507a777fb ("brcmfmac: add parameter to pass error code in firmware callback") Cc: Stephen Rothwell Reported-by: Kalle Valo Signed-off-by: Arend van Spriel Signed-off-by: Kalle Valo drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 92b0a1416be587b87c8ff489b6a74fd929048ca7 Author: Kees Cook Date: Thu Jun 15 08:20:35 2017 -0500 objtool: Add fortify_panic as __noreturn function CONFIG_FORTIFY_SOURCE=y implements fortify_panic() as a __noreturn function, so objtool needs to know about it too. Suggested-by: Daniel Micay Tested-by: Stephen Rothwell Signed-off-by: Kees Cook Signed-off-by: Josh Poimboeuf Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/1497532835-32704-1-git-send-email-jpoimboe@redhat.com Signed-off-by: Ingo Molnar tools/objtool/builtin-check.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 3bee1970b32d0c9d1ce986df4b4b58e5e8185c80 Merge: db96d58 2483561 Author: Linus Torvalds Date: Fri Jun 16 17:49:52 2017 +0900 Merge tag 'mmc-v4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fix from Ulf Hansson: "MMC meson-gx host: work around broken SDIO with certain WiFi chips" * tag 'mmc-v4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: meson-gx: work around broken SDIO with certain WiFi chips commit db96d5853e7d55f1d469d51a93ab38ce3bd72daa Merge: 51ce5f3 7119dbd Author: Linus Torvalds Date: Fri Jun 16 17:46:47 2017 +0900 Merge tag 'drm-fixes-for-v4.12-rc6' of git://people.freedesktop.org/~airlied/linux Pull drm fixes from Dave Airlie: "This is the main fixes pull for 4.12-rc6, all pretty normal for this stage, nothing really stands out. The mxsfb one is probably the largest and it's for a black screen boot problem. AMD, i915, mgag200, msxfb, tegra fixes" * tag 'drm-fixes-for-v4.12-rc6' of git://people.freedesktop.org/~airlied/linux: drm: mxsfb_crtc: Reset the eLCDIF controller drm/mgag200: Fix to always set HiPri for G200e4 V2 drm/tegra: Correct idr_alloc() minimum id drm/tegra: Fix lockup on a use of staging API gpu: host1x: Fix error handling drm/radeon: Fix overflow of watermark calcs at > 4k resolutions. drm/amdgpu: Fix overflow of watermark calcs at > 4k resolutions. drm/radeon: fix "force the UVD DPB into VRAM as well" drm/i915: Fix GVT-g PVINFO version compatibility check drm/i915: Fix SKL+ watermarks for 90/270 rotation drm/i915: Fix scaling check for 90/270 degree plane rotation drm: dw-hdmi: Fix compilation breakage by selecting REGMAP_MMIO commit 51ce5f332940ea114426db57772fe0ed18cc2790 Merge: f69d64d d470264 Author: Linus Torvalds Date: Fri Jun 16 17:38:23 2017 +0900 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma Pull rdma fixes from Doug Ledford: "I had thought at the time of the last pull request that there wouldn't be much more to go, but several things just kept trickling in over the last week. Instead of just the six patches to bnxt_re that I had anticipated, there are another five IPoIB patches, two qedr patches, and a few other miscellaneous patches. The bnxt_re patches are more lines of diff than I like to submit this late in the game. That's mostly because of the first two patches in the series of six. I almost dropped them just because of the lines of churn, but on a close review, a lot of the churn came from removing duplicated code sections and consolidating them into callable routines. I felt like this made the number of lines of change more acceptable, and they address problems, so I left them. The remainder of the patches are all small, well contained, and well understood. These have passed 0day testing, but have not been submitted to linux-next (but a local merge test with your current master was without any conflicts). Summary: - A fix for fix eea40b8f624 ("infiniband: call ipv6 route lookup via the stub interface") - Six patches against bnxt_re...the first two are considerably larger than I would like, but as they address real issues I went ahead and submitted them (it also helped that a good deal of the churn was removing code repeated in multiple places and consolidating it to one common function) - Two fixes against qedr that just came in - One fix against rxe that took a few revisions to get right plus time to get the proper reviews - Five late breaking IPoIB fixes - One late cxgb4 fix" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma: rdma/cxgb4: Fix memory leaks during module exit IB/ipoib: Fix memory leak in create child syscall IB/ipoib: Fix access to un-initialized napi struct IB/ipoib: Delete napi in device uninit default IB/ipoib: Limit call to free rdma_netdev for capable devices IB/ipoib: Fix memory leaks for child interfaces priv rxe: Fix a sleep-in-atomic bug in post_one_send RDMA/qedr: Add 64KB PAGE_SIZE support to user-space queues RDMA/qedr: Initialize byte_len in WC of READ and SEND commands RDMA/bnxt_re: Remove FMR support RDMA/bnxt_re: Fix RQE posting logic RDMA/bnxt_re: Add HW workaround for avoiding stall for UD QPs RDMA/bnxt_re: Dereg MR in FW before freeing the fast_reg_page_list RDMA/bnxt_re: HW workarounds for handling specific conditions RDMA/bnxt_re: Fixing the Control path command and response handling IB/addr: Fix setting source address in addr6_resolve() commit f69d64deedc19ed1345d5e75176671a84e0cccdc Merge: e78e462 bf5d008 Author: Linus Torvalds Date: Fri Jun 16 17:30:44 2017 +0900 Merge tag 'platform-drivers-x86-v4.12-2' of git://git.infradead.org/linux-platform-drivers-x86 Pull x86 platform driver fix from Darren Hart: "Just a single patch to fix an oops in the intel_telemetry_debugfs module load/unload" * tag 'platform-drivers-x86-v4.12-2' of git://git.infradead.org/linux-platform-drivers-x86: platform/x86: intel_telemetry_debugfs: fix oops when load/unload module commit e78e4626d43ce3143cb6d2942735d75595be7d1e Merge: cbfb749 dc9edc4 Author: Linus Torvalds Date: Fri Jun 16 17:26:10 2017 +0900 Merge branch 'for-linus' of git://git.kernel.dk/linux-block Pull block layer fix from Jens Axboe: "Just a single fix this week, fixing a regression introduced in this release. When we put the final reference to the queue, we may need to block. Ensure that we can safely do so. From Bart" * 'for-linus' of git://git.kernel.dk/linux-block: block: Fix a blk_exit_rl() regression commit cbfb74973753e109f28705f6b98c8c8cc381b047 Merge: 550ad8e a814c35 Author: Linus Torvalds Date: Fri Jun 16 17:13:06 2017 +0900 Merge branch 'dmi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging Pull dmi fixes from Jean Delvare. * 'dmi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging: firmware: dmi_scan: Check DMI structure length firmware: dmi: Fix permissions of product_family firmware: dmi_scan: Make dmi_walk and dmi_walk_early return real error codes firmware: dmi_scan: Look for SMBIOS 3 entry point first commit 550ad8ef390cbd4c2efc7a8e398add2e753abe7e Merge: a090bd4 023f108 Author: Linus Torvalds Date: Fri Jun 16 17:00:29 2017 +0900 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security Pull selinux fix from James Morris: "Fix for a double free bug in SELinux" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: selinux: fix double free in selinux_parse_opts_str() commit a093c92dc7f96a15de98ec8cfe38e6f7610a5969 Author: Alexey Kardashevskiy Date: Wed Jun 14 13:01:25 2017 +1000 powerpc/debug: Add missing warn flag to WARN_ON's non-builtin path When trapped on WARN_ON(), report_bug() is expected to return BUG_TRAP_TYPE_WARN so the caller will increment NIP by 4 and continue. The __builtin_constant_p() path of the PPC's WARN_ON() calls (indirectly) __WARN_FLAGS() which has BUGFLAG_WARNING set, however the other branch does not which makes report_bug() report a bug rather than a warning. Fixes: f26dee15103f ("debug: Avoid setting BUGFLAG_WARNING twice") Signed-off-by: Alexey Kardashevskiy Signed-off-by: Michael Ellerman arch/powerpc/include/asm/bug.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3d3efb68c19e539f0535c93a5258c1299270215f Author: Paul Mackerras Date: Tue Jun 6 14:35:30 2017 +1000 KVM: PPC: Book3S HV: Ignore timebase offset on POWER9 DD1 POWER9 DD1 has an erratum where writing to the TBU40 register, which is used to apply an offset to the timebase, can cause the timebase to lose counts. This results in the timebase on some CPUs getting out of sync with other CPUs, which then results in misbehaviour of the timekeeping code. To work around the problem, we make KVM ignore the timebase offset for all guests on POWER9 DD1 machines. This means that live migration cannot be supported on POWER9 DD1 machines. Cc: stable@vger.kernel.org # v4.10+ Signed-off-by: Paul Mackerras arch/powerpc/kvm/book3s_hv.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit be56a099e0f990532e10c940a3778303cc5a0d91 Merge: 3b1bbaf 31ac933 Author: David S. Miller Date: Thu Jun 15 22:22:23 2017 -0400 Merge tag 'mlx5-fixes-2017-06-14' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== Mellanox mlx5 fixes 2017-06-14 This series contains some fixes for the mlx5 core and netdev driver. Please pull and let me know if there's any problem. For -stable: ("net/mlx5: Wait for FW readiness before initializing command interface") kernels >= 4.4 ("net/mlx5e: Fix timestamping capabilities reporting") kernels >= 4.5 ("net/mlx5e: Avoid doing a cleanup call if the profile doesn't have it") kernels >= 4.9 ("net/mlx5e: Fix min inline value for VF rep SQs") kernels >= 4.11 The "net/mlx5e: Fix min inline .." (a oneliner patch) doesn't cleanly apply to 4.11, it hits a contextual conflict and can be easily resolved by: + mlx5_query_min_inline(mdev, &priv->params.tx_min_inline_mode); to the end of mlx5e_build_rep_netdev_priv. Note the 2nd parameter of mlx5_query_min_inline is slightly different from the original one. ==================== Signed-off-by: David S. Miller commit 7ceaa6dcd8c6f59588428cec37f3c8093dd1011f Author: Paul Mackerras Date: Fri Jun 16 11:53:19 2017 +1000 KVM: PPC: Book3S HV: Save/restore host values of debug registers At present, HV KVM on POWER8 and POWER9 machines loses any instruction or data breakpoint set in the host whenever a guest is run. Instruction breakpoints are currently only used by xmon, but ptrace and the perf_event subsystem can set data breakpoints as well as xmon. To fix this, we save the host values of the debug registers (CIABR, DAWR and DAWRX) before entering the guest and restore them on exit. To provide space to save them in the stack frame, we expand the stack frame allocated by kvmppc_hv_entry() from 112 to 144 bytes. Fixes: b005255e12a3 ("KVM: PPC: Book3S HV: Context-switch new POWER8 SPRs", 2014-01-08) Cc: stable@vger.kernel.org # v3.14+ Signed-off-by: Paul Mackerras arch/powerpc/kvm/book3s_hv_rmhandlers.S | 45 +++++++++++++++++++++++---------- 1 file changed, 32 insertions(+), 13 deletions(-) commit 7119dbdf7c52042acb1b02f116fa3257e97659ea Merge: 91c0719 c380f68 Author: Dave Airlie Date: Fri Jun 16 10:01:52 2017 +1000 Merge tag 'drm-intel-fixes-2017-06-15' of git://anongit.freedesktop.org/git/drm-intel into drm-fixes drm/i915 fixes for v4.12-rc6 * tag 'drm-intel-fixes-2017-06-15' of git://anongit.freedesktop.org/git/drm-intel: drm/i915: Fix GVT-g PVINFO version compatibility check drm/i915: Fix SKL+ watermarks for 90/270 rotation drm/i915: Fix scaling check for 90/270 degree plane rotation commit 91c0719c695a1fcba6a9728eb013eb6e3c7f3487 Merge: 1b22f6d7 0f93332 Author: Dave Airlie Date: Fri Jun 16 10:01:04 2017 +1000 Merge tag 'drm-misc-fixes-2017-06-15' of git://anongit.freedesktop.org/git/drm-misc into drm-fixes Driver Changes: - dw-hdmi: Fix compilation error if REGMAP_MMIO not selected (Laurent) - host1x: Fix incorrect return value (Christophe) - tegra: Shore up idr API usage in tegra staging code (Dmitry) - mgag200: Always use HiPri mode for G200e4v2 and limit max bandwidth (Mathieu) - mxsfb: Ensure display can be lit up without bootloader initialization (Fabio) Cc: Laurent Pinchart Cc: Christophe JAILLET Cc: Dmitry Osipenko Cc: Mathieu Larouche Cc: Fabio Estevam * tag 'drm-misc-fixes-2017-06-15' of git://anongit.freedesktop.org/git/drm-misc: drm: mxsfb_crtc: Reset the eLCDIF controller drm/mgag200: Fix to always set HiPri for G200e4 V2 drm/tegra: Correct idr_alloc() minimum id drm/tegra: Fix lockup on a use of staging API gpu: host1x: Fix error handling drm: dw-hdmi: Fix compilation breakage by selecting REGMAP_MMIO commit 1b22f6d72ab45e0a1912bc7af2efd43e70a5ab59 Merge: 32c1431 55f61a0 Author: Dave Airlie Date: Fri Jun 16 10:00:11 2017 +1000 Merge branch 'drm-fixes-4.12' of git://people.freedesktop.org/~agd5f/linux into drm-fixes A few fixes for 4.12: - fix a UVD regression on SI - fix overflow in watermark calcs on large modes * 'drm-fixes-4.12' of git://people.freedesktop.org/~agd5f/linux: drm/radeon: Fix overflow of watermark calcs at > 4k resolutions. drm/amdgpu: Fix overflow of watermark calcs at > 4k resolutions. drm/radeon: fix "force the UVD DPB into VRAM as well" commit 91ebcd1b97aea87172e8ae8871f1f328b9fa9c05 Author: Aurelien Jacquiot Date: Thu Jun 15 11:41:17 2017 +0200 MAINTAINERS: update email address for C6x maintainer Aurelien has moved. Signed-off-by: Aurelien Jacquiot Signed-off-by: Mark Salter MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 31ac93386d135a6c96de9c8bab406f5ccabf5a4d Author: Or Gerlitz Date: Thu Jun 15 20:08:32 2017 +0300 net/mlx5e: Avoid doing a cleanup call if the profile doesn't have it The error flow of mlx5e_create_netdev calls the cleanup call of the given profile without checking if it exists, fix that. Currently the VF reps don't register that callback and we crash if getting into error -- can be reproduced by the user doing ctrl^C while attempting to change the sriov mode from legacy to switchdev. Fixes: 26e59d8077a3 '(net/mlx5e: Implement mlx5e interface attach/detach callbacks') Signed-off-by: Or Gerlitz Reported-by: Sabrina Dubroca Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 9cfb4f719264f3eeb68122371ad70fd5bf2e10bb Author: Or Gerlitz Date: Sun Jun 11 19:32:12 2017 +0300 net/mlx5e: Remove TC header re-write offloading of ip tos Currently the firmware API is partial and allows to offload only the dscp part of the tos, also, ipv6 support isn't there yet. As such, remove the offloading option of ipv4 dscp till the FW APIs are more comprehensive. Fixes: d79b6df6b10a ('net/mlx5e: Add parsing of TC pedit actions to HW format') Signed-off-by: Or Gerlitz Reviewed-by: Paul Blakey Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 1 - 1 file changed, 1 deletion(-) commit 9d1cef196b2687e9338c4268a3aa0ca521686bc9 Author: Or Gerlitz Date: Sun Jun 4 19:36:17 2017 +0300 net/mlx5: Properly check applicability of devlink eswitch commands Currently we don't check that the link type is Eth and hence crash on IB ports when attempting to deref esw->xxx, fix that. To avoid repeating this check over and over, put the existing checks and the one on link type in a single helper. Fixes: 7768d1971de6 ('net/mlx5: E-Switch, Add control for encapsulation') Signed-off-by: Or Gerlitz Reported-by: Mohamad Badarnah Reviewed-by: Roi Dayan Signed-off-by: Saeed Mahameed .../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 77 +++++++++++----------- 1 file changed, 40 insertions(+), 37 deletions(-) commit 5f195c2c5cba60241004146cd12d71451d6b0fc4 Author: Chris Mi Date: Tue May 16 07:07:11 2017 -0400 net/mlx5e: Fix min inline value for VF rep SQs The offending commit only changed the code path for PF/VF, but it didn't take care of VF representors. As a result, since params->tx_min_inline_mode for VF representors is kzalloced to 0 (MLX5_INLINE_MODE_NONE), all VF reps SQs were set to that mode. This actually works on CX5 by default but broke CX4. Fix that by adding a call to query the min inline mode from the VF rep build up code. Fixes: a6f402e49901 ("net/mlx5e: Tx, no inline copy on ConnectX-5") Signed-off-by: Chris Mi Reviewed-by: Or Gerlitz Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 2 ++ 1 file changed, 2 insertions(+) commit f0b381178b01b831f9907d72f467d6443afdea67 Author: Maor Dickman Date: Thu May 18 15:15:08 2017 +0300 net/mlx5e: Fix timestamping capabilities reporting Misuse of (BIT) macro caused to report wrong flags for "Hardware Transmit Timestamp Modes" and "Hardware Receive Filter Modes" Fixes: ef9814deafd0 ('net/mlx5e: Add HW timestamping (TS) support') Signed-off-by: Maor Dickman Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 6c780a0267b8a1075f40b39851132eeaefefcff5 Author: Eli Cohen Date: Thu Jun 8 11:33:16 2017 -0500 net/mlx5: Wait for FW readiness before initializing command interface Before attempting to initialize the command interface we must wait till the fw_initializing bit is clear. If we fail to meet this condition the hardware will drop our configuration, specifically the descriptors page address. This scenario can happen when the firmware is still executing an FLR flow and did not finish yet so the driver needs to wait for that to finish. Fixes: e3297246c2c8 ('net/mlx5_core: Wait for FW readiness on startup') Signed-off-by: Eli Cohen Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/main.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) commit f16443a034c7aa359ddf6f0f9bc40d01ca31faea Author: Alan Stern Date: Tue Jun 13 15:23:42 2017 -0400 USB: gadgetfs, dummy-hcd, net2280: fix locking for callbacks Using the syzkaller kernel fuzzer, Andrey Konovalov generated the following error in gadgetfs: > BUG: KASAN: use-after-free in __lock_acquire+0x3069/0x3690 > kernel/locking/lockdep.c:3246 > Read of size 8 at addr ffff88003a2bdaf8 by task kworker/3:1/903 > > CPU: 3 PID: 903 Comm: kworker/3:1 Not tainted 4.12.0-rc4+ #35 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > Workqueue: usb_hub_wq hub_event > Call Trace: > __dump_stack lib/dump_stack.c:16 [inline] > dump_stack+0x292/0x395 lib/dump_stack.c:52 > print_address_description+0x78/0x280 mm/kasan/report.c:252 > kasan_report_error mm/kasan/report.c:351 [inline] > kasan_report+0x230/0x340 mm/kasan/report.c:408 > __asan_report_load8_noabort+0x19/0x20 mm/kasan/report.c:429 > __lock_acquire+0x3069/0x3690 kernel/locking/lockdep.c:3246 > lock_acquire+0x22d/0x560 kernel/locking/lockdep.c:3855 > __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] > _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:151 > spin_lock include/linux/spinlock.h:299 [inline] > gadgetfs_suspend+0x89/0x130 drivers/usb/gadget/legacy/inode.c:1682 > set_link_state+0x88e/0xae0 drivers/usb/gadget/udc/dummy_hcd.c:455 > dummy_hub_control+0xd7e/0x1fb0 drivers/usb/gadget/udc/dummy_hcd.c:2074 > rh_call_control drivers/usb/core/hcd.c:689 [inline] > rh_urb_enqueue drivers/usb/core/hcd.c:846 [inline] > usb_hcd_submit_urb+0x92f/0x20b0 drivers/usb/core/hcd.c:1650 > usb_submit_urb+0x8b2/0x12c0 drivers/usb/core/urb.c:542 > usb_start_wait_urb+0x148/0x5b0 drivers/usb/core/message.c:56 > usb_internal_control_msg drivers/usb/core/message.c:100 [inline] > usb_control_msg+0x341/0x4d0 drivers/usb/core/message.c:151 > usb_clear_port_feature+0x74/0xa0 drivers/usb/core/hub.c:412 > hub_port_disable+0x123/0x510 drivers/usb/core/hub.c:4177 > hub_port_init+0x1ed/0x2940 drivers/usb/core/hub.c:4648 > hub_port_connect drivers/usb/core/hub.c:4826 [inline] > hub_port_connect_change drivers/usb/core/hub.c:4999 [inline] > port_event drivers/usb/core/hub.c:5105 [inline] > hub_event+0x1ae1/0x3d40 drivers/usb/core/hub.c:5185 > process_one_work+0xc08/0x1bd0 kernel/workqueue.c:2097 > process_scheduled_works kernel/workqueue.c:2157 [inline] > worker_thread+0xb2b/0x1860 kernel/workqueue.c:2233 > kthread+0x363/0x440 kernel/kthread.c:231 > ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:424 > > Allocated by task 9958: > save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59 > save_stack+0x43/0xd0 mm/kasan/kasan.c:513 > set_track mm/kasan/kasan.c:525 [inline] > kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:617 > kmem_cache_alloc_trace+0x87/0x280 mm/slub.c:2745 > kmalloc include/linux/slab.h:492 [inline] > kzalloc include/linux/slab.h:665 [inline] > dev_new drivers/usb/gadget/legacy/inode.c:170 [inline] > gadgetfs_fill_super+0x24f/0x540 drivers/usb/gadget/legacy/inode.c:1993 > mount_single+0xf6/0x160 fs/super.c:1192 > gadgetfs_mount+0x31/0x40 drivers/usb/gadget/legacy/inode.c:2019 > mount_fs+0x9c/0x2d0 fs/super.c:1223 > vfs_kern_mount.part.25+0xcb/0x490 fs/namespace.c:976 > vfs_kern_mount fs/namespace.c:2509 [inline] > do_new_mount fs/namespace.c:2512 [inline] > do_mount+0x41b/0x2d90 fs/namespace.c:2834 > SYSC_mount fs/namespace.c:3050 [inline] > SyS_mount+0xb0/0x120 fs/namespace.c:3027 > entry_SYSCALL_64_fastpath+0x1f/0xbe > > Freed by task 9960: > save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59 > save_stack+0x43/0xd0 mm/kasan/kasan.c:513 > set_track mm/kasan/kasan.c:525 [inline] > kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:590 > slab_free_hook mm/slub.c:1357 [inline] > slab_free_freelist_hook mm/slub.c:1379 [inline] > slab_free mm/slub.c:2961 [inline] > kfree+0xed/0x2b0 mm/slub.c:3882 > put_dev+0x124/0x160 drivers/usb/gadget/legacy/inode.c:163 > gadgetfs_kill_sb+0x33/0x60 drivers/usb/gadget/legacy/inode.c:2027 > deactivate_locked_super+0x8d/0xd0 fs/super.c:309 > deactivate_super+0x21e/0x310 fs/super.c:340 > cleanup_mnt+0xb7/0x150 fs/namespace.c:1112 > __cleanup_mnt+0x1b/0x20 fs/namespace.c:1119 > task_work_run+0x1a0/0x280 kernel/task_work.c:116 > exit_task_work include/linux/task_work.h:21 [inline] > do_exit+0x18a8/0x2820 kernel/exit.c:878 > do_group_exit+0x14e/0x420 kernel/exit.c:982 > get_signal+0x784/0x1780 kernel/signal.c:2318 > do_signal+0xd7/0x2130 arch/x86/kernel/signal.c:808 > exit_to_usermode_loop+0x1ac/0x240 arch/x86/entry/common.c:157 > prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline] > syscall_return_slowpath+0x3ba/0x410 arch/x86/entry/common.c:263 > entry_SYSCALL_64_fastpath+0xbc/0xbe > > The buggy address belongs to the object at ffff88003a2bdae0 > which belongs to the cache kmalloc-1024 of size 1024 > The buggy address is located 24 bytes inside of > 1024-byte region [ffff88003a2bdae0, ffff88003a2bdee0) > The buggy address belongs to the page: > page:ffffea0000e8ae00 count:1 mapcount:0 mapping: (null) > index:0x0 compound_mapcount: 0 > flags: 0x100000000008100(slab|head) > raw: 0100000000008100 0000000000000000 0000000000000000 0000000100170017 > raw: ffffea0000ed3020 ffffea0000f5f820 ffff88003e80efc0 0000000000000000 > page dumped because: kasan: bad access detected > > Memory state around the buggy address: > ffff88003a2bd980: fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > ffff88003a2bda00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc > >ffff88003a2bda80: fc fc fc fc fc fc fc fc fc fc fc fc fb fb fb fb > ^ > ffff88003a2bdb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > ffff88003a2bdb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > ================================================================== What this means is that the gadgetfs_suspend() routine was trying to access dev->lock after it had been deallocated. The root cause is a race in the dummy_hcd driver; the dummy_udc_stop() routine can race with the rest of the driver because it contains no locking. And even when proper locking is added, it can still race with the set_link_state() function because that function incorrectly drops the private spinlock before invoking any gadget driver callbacks. The result of this race, as seen above, is that set_link_state() can invoke a callback in gadgetfs even after gadgetfs has been unbound from dummy_hcd's UDC and its private data structures have been deallocated. include/linux/usb/gadget.h documents that the ->reset, ->disconnect, ->suspend, and ->resume callbacks may be invoked in interrupt context. In general this is necessary, to prevent races with gadget driver removal. This patch fixes dummy_hcd to retain the spinlock across these calls, and it adds a spinlock acquisition to dummy_udc_stop() to prevent the race. The net2280 driver makes the same mistake of dropping the private spinlock for its ->disconnect and ->reset callback invocations. The patch fixes it too. Lastly, since gadgetfs_suspend() may be invoked in interrupt context, it cannot assume that interrupts are enabled when it runs. It must use spin_lock_irqsave() instead of spin_lock_irq(). The patch fixes that bug as well. Signed-off-by: Alan Stern Reported-and-tested-by: Andrey Konovalov CC: Acked-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman drivers/usb/gadget/legacy/inode.c | 5 +++-- drivers/usb/gadget/udc/dummy_hcd.c | 13 ++++--------- drivers/usb/gadget/udc/net2280.c | 9 +-------- 3 files changed, 8 insertions(+), 19 deletions(-) commit 3b1bbafbfd14474fee61487552c9916ec1b25c58 Author: xypron.glpk@gmx.de Date: Thu Jun 15 20:59:57 2017 +0200 Doc: net: dsa: b53: update location of referenced dsa.txt The referenced file dsa.txt is located at Documentation/devicetree/bindings/net/dsa/dsa.txt Reviewed-by: Florian Fainelli Signed-off-by: Heinrich Schuchardt Signed-off-by: David S. Miller Documentation/devicetree/bindings/net/dsa/b53.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 988c7322116970696211e902b468aefec95b6ec4 Author: Xin Long Date: Thu Jun 15 17:49:08 2017 +0800 sctp: return next obj by passing pos + 1 into sctp_transport_get_idx In sctp_for_each_transport, pos is used to save how many objs it has dumped. Now it gets the last obj by sctp_transport_get_idx, then gets the next obj by sctp_transport_get_next. The issue is that in the meanwhile if some objs in transport hashtable are removed and the objs nums are less than pos, sctp_transport_get_idx would return NULL and hti.walker.tbl is NULL as well. At this moment it should stop hti, instead of continue getting the next obj. Or it would cause a NULL pointer dereference in sctp_transport_get_next. This patch is to pass pos + 1 into sctp_transport_get_idx to get the next obj directly, even if pos > objs nums, it would return NULL and stop hti. Fixes: 626d16f50f39 ("sctp: export some apis or variables for sctp_diag and reuse some for proc") Signed-off-by: Xin Long Signed-off-by: David S. Miller net/sctp/socket.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 0f933328f018c118ded2035f12068bbdfdef399d Author: Fabio Estevam Date: Fri May 5 15:01:41 2017 -0300 drm: mxsfb_crtc: Reset the eLCDIF controller According to the eLCDIF initialization steps listed in the MX6SX Reference Manual the eLCDIF block reset is mandatory. Without performing the eLCDIF reset the display shows garbage content when the kernel boots. In earlier tests this issue has not been observed because the bootloader was previously showing a splash screen and the bootloader display driver does properly implement the eLCDIF reset. Add the eLCDIF reset to the driver, so that it can operate correctly independently of the bootloader. Tested on a imx6sx-sdb board. Cc: Signed-off-by: Fabio Estevam Signed-off-by: Sean Paul Link: http://patchwork.freedesktop.org/patch/msgid/1494007301-14535-1-git-send-email-fabio.estevam@nxp.com drivers/gpu/drm/mxsfb/mxsfb_crtc.c | 42 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) commit 5f2f97656ada8d811d3c1bef503ced266fcd53a0 Author: David Howells Date: Thu Jun 15 00:12:24 2017 +0100 rxrpc: Fix several cases where a padded len isn't checked in ticket decode This fixes CVE-2017-7482. When a kerberos 5 ticket is being decoded so that it can be loaded into an rxrpc-type key, there are several places in which the length of a variable-length field is checked to make sure that it's not going to overrun the available data - but the data is padded to the nearest four-byte boundary and the code doesn't check for this extra. This could lead to the size-remaining variable wrapping and the data pointer going over the end of the buffer. Fix this by making the various variable-length data checks use the padded length. Reported-by: 石磊 Signed-off-by: David Howells Reviewed-by: Marc Dionne Reviewed-by: Dan Carpenter Signed-off-by: David S. Miller net/rxrpc/key.c | 64 ++++++++++++++++++++++++++++++--------------------------- 1 file changed, 34 insertions(+), 30 deletions(-) commit 0cbb738108927916a659b5b0b96e386fcd7cc6e1 Author: Mathieu Larouche Date: Wed Jun 14 10:39:42 2017 -0400 drm/mgag200: Fix to always set HiPri for G200e4 V2 - Changed the HiPri value for G200e4 to always be 0. - Added Bandwith limitation to block resolution above 1920x1200x60Hz Signed-off-by: Mathieu Larouche Acked-by: Dave Airlie [seanpaul removed some trailing whitespace from the patch] Signed-off-by: Sean Paul Link: http://patchwork.freedesktop.org/patch/msgid/ec0f8568d7ec41904dfe593c5deccf3f062d7bd8.1497450944.git.mathieu.larouche@matrox.com drivers/gpu/drm/mgag200/mgag200_mode.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit a2b7a622d6292b693544d7c94bb5d11c3f4676f8 Author: Arend Van Spriel Date: Mon Jun 12 12:56:35 2017 +0100 brcmfmac: fix brcmf_fws_add_interface() for USB devices USB devices rely on queuing functionality provided by the fwsignal module regardless the mode fwsignal is operating in. For this some data structure needs to be reserved which is tied to the interface, which is done by brcmf_fws_add_interface(). However, it checks the mode. Replace that by checking result from brcmf_fws_queue_skbs(). Otherwise the driver will crash in a null pointer dereference when data is transmitted on the interface. Fixes: fc0471e3e884 ("brcmfmac: ignore interfaces when fwsignal is disabled") Reviewed-by: Franky Lin Signed-off-by: Arend van Spriel Signed-off-by: Kalle Valo drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7a51461fc2da82a6c565a3ee65c41c197f28225d Author: Arend Van Spriel Date: Mon Jun 12 12:47:34 2017 +0100 brcmfmac: unbind all devices upon failure in firmware callback When request firmware fails, brcmf_ops_sdio_remove is being called and brcmf_bus freed. In such circumstancies if you do a suspend/resume cycle the kernel hangs on resume due a NULL pointer dereference in resume function. So in brcmf_sdio_firmware_callback() we need to unbind the driver from both sdio_func devices when firmware load failure is indicated. Cc: stable@vger.kernel.org # 4.9.x- Tested-by: Enric Balletbo i Serra Reviewed-by: Hante Meuleman Reviewed-by: Pieter-Paul Giesberts Reviewed-by: Franky Lin Signed-off-by: Arend van Spriel Signed-off-by: Kalle Valo drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 03fb0e8393fae8ebb6710a99387853ed0becbc8e Author: Arend Van Spriel Date: Mon Jun 12 12:47:33 2017 +0100 brcmfmac: use firmware callback upon failure to load When firmware loading failed the code used to unbind the device provided by the calling code. However, for the sdio driver two devices are bound and both need to be released upon failure. The callback has been extended with parameter to pass error code so add that in this commit upon firmware loading failure. Cc: stable@vger.kernel.org # 4.9.x- Reviewed-by: Hante Meuleman Reviewed-by: Pieter-Paul Giesberts Reviewed-by: Franky Lin Signed-off-by: Arend van Spriel Signed-off-by: Kalle Valo .../broadcom/brcm80211/brcmfmac/firmware.c | 27 +++++++++++----------- 1 file changed, 13 insertions(+), 14 deletions(-) commit 6d0507a777fbc533f7f1bf5664a81982dd50dece Author: Arend Van Spriel Date: Mon Jun 12 12:47:32 2017 +0100 brcmfmac: add parameter to pass error code in firmware callback Extend the parameters in the firmware callback so it can be called upon success and failure. This allows the caller to properly clear all resources in the failure path. Right now the error code is always zero, ie. success. Cc: stable@vger.kernel.org # 4.9.x- Reviewed-by: Hante Meuleman Reviewed-by: Pieter-Paul Giesberts Reviewed-by: Franky Lin Signed-off-by: Arend van Spriel Signed-off-by: Kalle Valo .../net/wireless/broadcom/brcm80211/brcmfmac/firmware.c | 10 +++++----- .../net/wireless/broadcom/brcm80211/brcmfmac/firmware.h | 4 ++-- drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 17 ++++++++++++----- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 17 +++++++++++------ drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 6 ++++-- 5 files changed, 34 insertions(+), 20 deletions(-) commit f8a894b218138888542a5058d0e902378fd0d4ec Author: Xin Long Date: Thu Jun 15 16:33:58 2017 +0800 ipv6: fix calling in6_ifa_hold incorrectly for dad work Now when starting the dad work in addrconf_mod_dad_work, if the dad work is idle and queued, it needs to hold ifa. The problem is there's one gap in [1], during which if the pending dad work is removed elsewhere. It will miss to hold ifa, but the dad word is still idea and queue. if (!delayed_work_pending(&ifp->dad_work)) in6_ifa_hold(ifp); <--------------[1] mod_delayed_work(addrconf_wq, &ifp->dad_work, delay); An use-after-free issue can be caused by this. Chen Wei found this issue when WARN_ON(!hlist_unhashed(&ifp->addr_lst)) in net6_ifa_finish_destroy was hit because of it. As Hannes' suggestion, this patch is to fix it by holding ifa first in addrconf_mod_dad_work, then calling mod_delayed_work and putting ifa if the dad_work is already in queue. Note that this patch did not choose to fix it with: if (!mod_delayed_work(delay)) in6_ifa_hold(ifp); As with it, when delay == 0, dad_work would be scheduled immediately, all addrconf_mod_dad_work(0) callings had to be moved under ifp->lock. Reported-by: Wei Chen Suggested-by: Hannes Frederic Sowa Acked-by: Hannes Frederic Sowa Signed-off-by: Xin Long Signed-off-by: David S. Miller net/ipv6/addrconf.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 7304e8f28bb2f3cb2baf37c1bb2caa0f54ca4e43 Author: Shaohua Li Date: Thu Jun 8 11:27:14 2017 -0700 iommu/vt-d: Correctly disable Intel IOMMU force on I made a mistake in commit bfd20f1. We should skip the force on with the option enabled instead of vice versa. Not sure why this passed our performance test, sorry. Fixes: bfd20f1cc850 ('x86, iommu/vt-d: Add an option to disable Intel IOMMU force on') Signed-off-by: Shaohua Li Signed-off-by: Joerg Roedel arch/x86/kernel/tboot.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 17e83549e199d89aace7788a9f11c108671eecf5 Author: Liwei Song Date: Tue Jun 13 00:59:53 2017 -0400 i2c: ismt: fix wrong device address when unmap the data buffer Fix the following kernel bug: kernel BUG at drivers/iommu/intel-iommu.c:3260! invalid opcode: 0000 [#5] PREEMPT SMP Hardware name: Intel Corp. Harcuvar/Server, BIOS HAVLCRB0.X64.0013.D39.1608311820 08/31/2016 task: ffff880175389950 ti: ffff880176bec000 task.ti: ffff880176bec000 RIP: 0010:[] [] intel_unmap+0x25b/0x260 RSP: 0018:ffff880176bef5e8 EFLAGS: 00010296 RAX: 0000000000000024 RBX: ffff8800773c7c88 RCX: 000000000000ce04 RDX: 0000000080000000 RSI: 0000000000000000 RDI: 0000000000000009 RBP: ffff880176bef638 R08: 0000000000000010 R09: 0000000000000004 R10: ffff880175389c78 R11: 0000000000000a4f R12: ffff8800773c7868 R13: 00000000ffffac88 R14: ffff8800773c7818 R15: 0000000000000001 FS: 00007fef21258700(0000) GS:ffff88017b5c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000066d6d8 CR3: 000000007118c000 CR4: 00000000003406e0 Stack: 00000000ffffac88 ffffffff8199867f ffff880176bef5f8 ffff880100000030 ffff880176bef668 ffff8800773c7c88 ffff880178288098 ffff8800772c0010 ffff8800773c7818 0000000000000001 ffff880176bef648 ffffffff8150a86e Call Trace: [] ? printk+0x46/0x48 [] intel_unmap_page+0xe/0x10 [] ismt_access+0x27b/0x8fa [i2c_ismt] [] ? __pm_runtime_suspend+0xa0/0xa0 [] ? pm_suspend_timer_fn+0x80/0x80 [] ? __pm_runtime_suspend+0xa0/0xa0 [] ? pm_suspend_timer_fn+0x80/0x80 [] ? pci_bus_read_dev_vendor_id+0xf0/0xf0 [] i2c_smbus_xfer+0xec/0x4b0 [] ? vprintk_emit+0x345/0x530 [] i2cdev_ioctl_smbus+0x12b/0x240 [i2c_dev] [] ? vprintk_default+0x29/0x40 [] i2cdev_ioctl+0x63/0x1ec [i2c_dev] [] do_vfs_ioctl+0x328/0x5d0 [] ? vfs_write+0x11c/0x190 [] ? rt_up_read+0x19/0x20 [] SyS_ioctl+0x81/0xa0 [] system_call_fastpath+0x16/0x6e This happen When run "i2cdetect -y 0" detect SMBus iSMT adapter. After finished I2C block read/write, when unmap the data buffer, a wrong device address was pass to dma_unmap_single(). To fix this, give dma_unmap_single() the "dev" parameter, just like what dma_map_single() does, then unmap can find the right devices. Fixes: 13f35ac14cd0 ("i2c: Adding support for Intel iSMT SMBus 2.0 host controller") Signed-off-by: Liwei Song Reviewed-by: Andy Shevchenko Signed-off-by: Wolfram Sang drivers/i2c/busses/i2c-ismt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 916335036d4fe33f9806240cb0d1900f4975b959 Author: Wolfram Sang Date: Sun May 28 09:52:17 2017 +0200 i2c: rcar: use correct length when unmapping DMA Because we need to transfer some bytes with PIO, the msg length is not the length of the DMA buffer. Use the correct value which we used when doing the mapping. Fixes: 73e8b0528346e8 ("i2c: rcar: add DMA support") Signed-off-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Reviewed-by: Niklas Söderlund Signed-off-by: Wolfram Sang drivers/i2c/busses/i2c-rcar.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 25642705b2359a705784bbbf1655c25a8f8efde2 Author: Benjamin Herrenschmidt Date: Wed Jun 14 10:19:25 2017 +1000 powerpc/xive: Fix offset for store EOI MMIOs Architecturally we should apply a 0x400 offset for these. Not doing it will break future HW implementations. The offset of 0 is supposed to remain for "triggers" though not all sources support both trigger and store EOI, and in P9 specifically, some sources will treat 0 as a store EOI. But future chips will not. So this makes us use the properly architected offset which should work always. Fixes: 243e25112d06 ("powerpc/xive: Native exploitation of the XIVE interrupt controller") Signed-off-by: Benjamin Herrenschmidt Signed-off-by: Michael Ellerman arch/powerpc/include/asm/xive.h | 12 +++++++----- arch/powerpc/kvm/book3s_xive_template.c | 4 ++-- arch/powerpc/sysdev/xive/common.c | 2 +- 3 files changed, 10 insertions(+), 8 deletions(-) commit cd15fb64ee56192760ad5c1e2ad97a65e735b18b Author: Mike Snitzer Date: Thu Jun 15 08:39:15 2017 -0400 Revert "dm mirror: use all available legs on multiple failures" This reverts commit 12a7cf5ba6c776a2621d8972c7d42e8d3d959d20. This commit apparently attempted to fix an issue that didn't really exist, furthermore: this commit is the source of deadlocks and crashes seen in multiple cases related to failing the primary mirror dev while syncing. Reported-by: Jonathan Brassow Signed-off-by: Mike Snitzer drivers/md/dm-raid1.c | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) commit d6c153ec85856f5ad29adc20739ec28edeb7c042 Author: Dmitry Osipenko Date: Thu Jun 15 02:18:25 2017 +0300 drm/tegra: Correct idr_alloc() minimum id The client ID 0 is reserved by the host1x/cdma to mark the timeout timer work as already been scheduled and context ID is used as the clients one. This fixes spurious CDMA timeouts. Fixes: bdd2f9cd10eb ("drm/tegra: Don't leak kernel pointer to userspace") Signed-off-by: Dmitry Osipenko Reviewed-by: Mikko Perttunen Signed-off-by: Thierry Reding Link: http://patchwork.freedesktop.org/patch/msgid/9c19a44219acd988e678cf9abe21363911184625.1497480754.git.digetx@gmail.com drivers/gpu/drm/tegra/drm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1066a8959d04785b9d2e9cbb91aaef922b710c4a Author: Dmitry Osipenko Date: Thu Jun 15 02:18:24 2017 +0300 drm/tegra: Fix lockup on a use of staging API Commit bdd2f9cd10eb ("Don't leak kernel pointer to userspace") added a mutex around staging IOCTL's, some of those mutexes are taken twice. Fixes: bdd2f9cd10eb ("drm/tegra: Don't leak kernel pointer to userspace") Signed-off-by: Dmitry Osipenko Reviewed-by: Mikko Perttunen Reviewed-by: Erik Faye-Lund Signed-off-by: Thierry Reding Link: http://patchwork.freedesktop.org/patch/msgid/7b70a506a9d2355ea6ff19a8c4f4d726b67719b3.1497480754.git.digetx@gmail.com drivers/gpu/drm/tegra/drm.c | 20 ++++---------------- 1 file changed, 4 insertions(+), 16 deletions(-) commit 59e04bc20de4bd1bd5bfa810bf04a4e50a27b9c1 Author: Christophe JAILLET Date: Mon Apr 10 22:29:22 2017 +0200 gpu: host1x: Fix error handling If 'devm_reset_control_get' returns an error, then we erroneously return success because error code is taken from 'host->clk' instead of 'host->rst'. Fixes: b386c6b73ac6 ("gpu: host1x: Support module reset") Signed-off-by: Christophe JAILLET Reviewed-by: Mikko Perttunen Signed-off-by: Thierry Reding Link: http://patchwork.freedesktop.org/patch/msgid/20170410202922.17665-1-christophe.jaillet@wanadoo.fr drivers/gpu/host1x/dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a814c3597a6b6040e2ef9459748081a6d5b7312d Author: Jean Delvare Date: Thu Jun 15 13:46:01 2017 +0200 firmware: dmi_scan: Check DMI structure length Before accessing DMI data to record it for later, we should ensure that the DMI structures are large enough to contain the data in question. Signed-off-by: Jean Delvare Reviewed-by: Mika Westerberg Cc: Dmitry Torokhov Cc: Andy Shevchenko Cc: Linus Walleij drivers/firmware/dmi_scan.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) commit e0733e975385d25d88c1384dafb8ea4dcf7513c0 Author: Jean Delvare Date: Thu Jun 15 13:46:01 2017 +0200 firmware: dmi: Fix permissions of product_family This is not sensitive information like serial numbers, we can allow all users to read it. Fix odd alignment while we're here. Signed-off-by: Jean Delvare Fixes: c61872c9833d ("firmware: dmi: Add DMI_PRODUCT_FAMILY identification string") Reviewed-by: Andy Shevchenko Reviewed-by: Mika Westerberg Cc: Dmitry Torokhov Cc: Linus Walleij drivers/firmware/dmi-id.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit c926820085437a27b27e78996b2c7a5ad94e8055 Author: Andy Lutomirski Date: Thu Jun 15 13:46:00 2017 +0200 firmware: dmi_scan: Make dmi_walk and dmi_walk_early return real error codes Currently they return -1 on error, which will confuse callers if they try to interpret it as a normal negative error code. Signed-off-by: Andy Lutomirski Signed-off-by: Darren Hart (VMware) Signed-off-by: Jean Delvare drivers/firmware/dmi_scan.c | 9 +++++---- include/linux/dmi.h | 2 +- 2 files changed, 6 insertions(+), 5 deletions(-) commit c9aba14362a6eec583819ec8f4b872c1816f5cbe Author: Jean Delvare Date: Thu Jun 15 13:46:00 2017 +0200 firmware: dmi_scan: Look for SMBIOS 3 entry point first Since version 3.0.0 of the SMBIOS specification, there can be multiple entry points in memory, pointing to one or two DMI tables. If both a 32-bit ("_SM_") entry point and a 64-bit ("_SM3_") entry point are present, the specification requires that the latter points to a table which is a super-set of the table pointed to by the former. Therefore we should give preference to the 64-bit ("_SM3_") entry point. However, currently the code is picking the first valid entry point it finds. Per specification, we should look for a 64-bit ("_SM3_") entry point first, and if we can't find any, look for a 32-bit ("_SM_" or "_DMI_") entry point. Modify the code to do that. Signed-off-by: Jean Delvare drivers/firmware/dmi_scan.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) commit 4068367c9ca7b515a209f9c0c8741309a1e90495 Author: Andrei Vagin Date: Thu Jun 8 17:32:29 2017 -0700 fs: don't forget to put old mntns in mntns_install Fixes: 4f757f3cbf54 ("make sure that mntns_install() doesn't end up with referral for root") Cc: Al Viro Signed-off-by: Andrei Vagin Signed-off-by: Al Viro fs/namespace.c | 2 ++ 1 file changed, 2 insertions(+) commit 81be24d263dbeddaba35827036d6f6787a59c2c3 Author: Al Viro Date: Sat Jun 3 07:20:09 2017 +0100 Hang/soft lockup in d_invalidate with simultaneous calls It's not hard to trigger a bunch of d_invalidate() on the same dentry in parallel. They end up fighting each other - any dentry picked for removal by one will be skipped by the rest and we'll go for the next iteration through the entire subtree, even if everything is being skipped. Morevoer, we immediately go back to scanning the subtree. The only thing we really need is to dissolve all mounts in the subtree and as soon as we've nothing left to do, we can just unhash the dentry and bugger off. Signed-off-by: Al Viro fs/dcache.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) commit bcd7c45e0d5a82be9a64b90050f0e09d41a50758 Author: Paul Burton Date: Fri Jun 2 12:02:08 2017 -0700 MIPS: .its targets depend on vmlinux The .its targets require information about the kernel binary, such as its entry point, which is extracted from the vmlinux ELF. We therefore require that the ELF is built before the .its files are generated. Declare this requirement in the Makefile such that make will ensure this is always the case, otherwise in corner cases we can hit issues as the .its is generated with an incorrect (either invalid or stale) entry point. Signed-off-by: Paul Burton Fixes: cf2a5e0bb4c6 ("MIPS: Support generating Flattened Image Trees (.itb)") Cc: linux-mips@linux-mips.org Cc: stable # v4.9+ Patchwork: https://patchwork.linux-mips.org/patch/16179/ Signed-off-by: Ralf Baechle arch/mips/boot/Makefile | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 1a73d9310e093fc3adffba4d0a67b9fab2ee3f63 Author: Paul Burton Date: Fri Jun 2 11:35:01 2017 -0700 MIPS: Fix bnezc/jialc return address calculation The code handling the pop76 opcode (ie. bnezc & jialc instructions) in __compute_return_epc_for_insn() needs to set the value of $31 in the jialc case, which is encoded with rs = 0. However its check to differentiate bnezc (rs != 0) from jialc (rs = 0) was unfortunately backwards, meaning that if we emulate a bnezc instruction we clobber $31 & if we emulate a jialc instruction it actually behaves like a jic instruction. Fix this by inverting the check of rs to match the way the instructions are actually encoded. Signed-off-by: Paul Burton Fixes: 28d6f93d201d ("MIPS: Emulate the new MIPS R6 BNEZC and JIALC instructions") Cc: stable # v4.0+ Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/16178/ Signed-off-by: Ralf Baechle arch/mips/kernel/branch.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit a090bd4ff8387c409732a8e059fbf264ea0bdd56 Merge: 54ed0f7 640f93c Author: Linus Torvalds Date: Thu Jun 15 18:09:47 2017 +0900 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) The netlink attribute passed in to dev_set_alias() is not necessarily NULL terminated, don't use strlcpy() on it. From Alexander Potapenko. 2) Fix implementation of atomics in arm64 bpf JIT, from Daniel Borkmann. 3) Correct the release of netdevs and driver private data in certain circumstances. 4) Sanitize netlink message length properly in decnet, from Mateusz Jurczyk. 5) Don't leak kernel data in rtnl_fill_vfinfo() netlink blobs. From Yuval Mintz. 6) Hash secret is never initialized in ipv6 ILA translation code, from Arnd Bergmann. I guess those clang warnings about unused inline functions are useful for something! 7) Fix endian selection in bpf_endian.h, from Daniel Borkmann. 8) Sanitize sockaddr length before dereferncing any fields in AF_UNIX and CAIF. From Mateusz Jurczyk. 9) Fix timestamping for GMAC3 chips in stmmac driver, from Mario Molitor. 10) Do not leak netdev on dev_alloc_name() errors in mac80211, from Johannes Berg. 11) Fix locking in sctp_for_each_endpoint(), from Xin Long. 12) Fix wrong memset size on 32-bit in snmp6, from Christian Perle. 13) Fix use after free in ip_mc_clear_src(), from WANG Cong. 14) Fix regressions caused by ICMP rate limiting changes in 4.11, from Jesper Dangaard Brouer. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (91 commits) i40e: Fix a sleep-in-atomic bug net: don't global ICMP rate limit packets originating from loopback net/act_pedit: fix an error code net: update undefined ->ndo_change_mtu() comment net_sched: move tcf_lock down after gen_replace_estimator() caif: Add sockaddr length check before accessing sa_family in connect handler qed: fix dump of context data qmi_wwan: new Telewell and Sierra device IDs net: phy: Fix MDIO_THUNDER dependencies netconsole: Remove duplicate "netconsole: " logging prefix igmp: acquire pmc lock for ip_mc_clear_src() r8152: give the device version net: rps: fix uninitialized symbol warning mac80211: don't send SMPS action frame in AP mode when not needed mac80211/wpa: use constant time memory comparison for MACs mac80211: set bss_info data before configuring the channel mac80211: remove 5/10 MHz rate code from station MLME mac80211: Fix incorrect condition when checking rx timestamp mac80211: don't look at the PM bit of BAR frames i40e: fix handling of HW ATR eviction ... commit 54ed0f71f0a0cbf3218e2503a50364f178b1e855 Merge: 35e60a6 d41519a Author: Linus Torvalds Date: Thu Jun 15 17:54:51 2017 +0900 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: "This fixes a bug on sparc where we may dereference freed stack memory" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: Work around deallocated stack frame reference gcc bug on sparc. commit 35e60a6b7577218ac7eb7777c8849822a080e127 Merge: 92091c4 9522933 Author: Linus Torvalds Date: Thu Jun 15 17:51:19 2017 +0900 Merge tag 'acpi-4.12-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "These revert an ACPICA commit from the 4.11 cycle that causes problems to happen on some systems and add a protection against possible kernel crashes due to table reference counter imbalance. Specifics: - Revert a 4.11 ACPICA change that made assumptions which are not satisfied on some systems and caused the enumeration of resources to fail on them (Rafael Wysocki). - Add a mechanism to prevent tables from being unmapped prematurely due to reference counter overflows (Lv Zheng)" * tag 'acpi-4.12-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPICA: Tables: Mechanism to handle late stage acpi_get_table() imbalance Revert "ACPICA: Disassembler: Enhance resource descriptor detection" commit 92091c438bad93ba2591e8c4ba86126227327be2 Merge: b45edc2 f63e4f7 Author: Linus Torvalds Date: Thu Jun 15 17:47:46 2017 +0900 Merge tag 'pm-4.12-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These revert a recent cpufreq schedutil governor change that turned out to be problematic and fix a few minor issues in cpufreq, cpuidle and the Exynos devfreq drivers. Specifics: - Revert a recent cpufreq schedutil governor change that caused some systems to behave undesirably (Rafael Wysocki). - Fix a cpufreq conservative governor issue introduced during the 3.10 cycle that prevents it from working as expected in some situations (Tomasz Wilczyński). - Fix an error code path in the generic cpuidle driver for DT-based systems (Christophe Jaillet). - Fix three minor issues in devfreq drivers for Exynos (Arvind Yadav, Krzysztof Kozlowski)" * tag 'pm-4.12-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpuidle: dt: Add missing 'of_node_put()' cpufreq: conservative: Allow down_threshold to take values from 1 to 10 Revert "cpufreq: schedutil: Reduce frequencies slower" PM / devfreq: exynos-ppmu: Staticize event list PM / devfreq: exynos-ppmu: Handle return value of clk_prepare_enable PM / devfreq: exynos-nocp: Handle return value of clk_prepare_enable commit b45edc2d02d50ba4657f29c0e2380e337d324aef Merge: 906e0c5 0ca4cd7 Author: Linus Torvalds Date: Thu Jun 15 17:44:41 2017 +0900 Merge branch 'for-4.12/driver-matching-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid Pull HID fix from Jiri Kosina: - ifdef-based bandaid for a long-standing issue with HID driver matching, avoiding regressions in cases where specific driver is not enabled in kernel .config, from Jiri Kosina * 'for-4.12/driver-matching-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: HID: let generic driver yield control iff specific driver has been enabled commit 906e0c5b9f1261b516487f37a6d35eb48426786f Merge: 63f700a f9f314f Author: Linus Torvalds Date: Thu Jun 15 17:37:40 2017 +0900 Merge tag 'media/v4.12-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: - some build dependency issues at CEC core with randconfigs - fix an off by one error at vb2 - a race fix at cec core - driver fixes at tc358743, sir_ir and rainshadow-cec * tag 'media/v4.12-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: [media] media/cec.h: use IS_REACHABLE instead of IS_ENABLED [media] cec: race fix: don't return -ENONET in cec_receive() [media] sir_ir: infinite loop in interrupt handler [media] cec-notifier.h: handle unreachable CONFIG_CEC_CORE [media] cec: improve MEDIA_CEC_RC dependencies [media] vb2: Fix an off by one error in 'vb2_plane_vaddr' [media] rainshadow-cec: Fix missing spin_lock_init() [media] tc358743: fix register i2c_rd/wr function fix commit a8fad984833832d5ca11a9ed64ddc55646da30e3 Author: Al Viro Date: Thu Jun 15 03:57:46 2017 -0400 ufs_truncate_blocks(): fix the case when size is in the last direct block The logics when deciding whether we need to do anything with direct blocks is broken when new size is within the last direct block. It's better to find the path to the last byte _not_ to be removed and use that instead of the path to the beginning of the first block to be freed... Signed-off-by: Al Viro fs/ufs/inode.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) commit 46a704f8409f79fd66567ad3f8a7304830a84293 Author: Paul Mackerras Date: Thu Jun 15 16:10:27 2017 +1000 KVM: PPC: Book3S HV: Preserve userspace HTM state properly If userspace attempts to call the KVM_RUN ioctl when it has hardware transactional memory (HTM) enabled, the values that it has put in the HTM-related SPRs TFHAR, TFIAR and TEXASR will get overwritten by guest values. To fix this, we detect this condition and save those SPR values in the thread struct, and disable HTM for the task. If userspace goes to access those SPRs or the HTM facility in future, a TM-unavailable interrupt will occur and the handler will reload those SPRs and re-enable HTM. If userspace has started a transaction and suspended it, we would currently lose the transactional state in the guest entry path and would almost certainly get a "TM Bad Thing" interrupt, which would cause the host to crash. To avoid this, we detect this case and return from the KVM_RUN ioctl with an EINVAL error, with the KVM exit reason set to KVM_EXIT_FAIL_ENTRY. Fixes: b005255e12a3 ("KVM: PPC: Book3S HV: Context-switch new POWER8 SPRs", 2014-01-08) Cc: stable@vger.kernel.org # v3.14+ Signed-off-by: Paul Mackerras arch/powerpc/kvm/book3s_hv.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) commit 4c3bb4ccd074e1a0552078c0bf94c662367a1658 Author: Paul Mackerras Date: Thu Jun 15 15:43:17 2017 +1000 KVM: PPC: Book3S HV: Restore critical SPRs to host values on guest exit This restores several special-purpose registers (SPRs) to sane values on guest exit that were missed before. TAR and VRSAVE are readable and writable by userspace, and we need to save and restore them to prevent the guest from potentially affecting userspace execution (not that TAR or VRSAVE are used by any known program that run uses the KVM_RUN ioctl). We save/restore these in kvmppc_vcpu_run_hv() rather than on every guest entry/exit. FSCR affects userspace execution in that it can prohibit access to certain facilities by userspace. We restore it to the normal value for the task on exit from the KVM_RUN ioctl. IAMR is normally 0, and is restored to 0 on guest exit. However, with a radix host on POWER9, it is set to a value that prevents the kernel from executing user-accessible memory. On POWER9, we save IAMR on guest entry and restore it on guest exit to the saved value rather than 0. On POWER8 we continue to set it to 0 on guest exit. PSPB is normally 0. We restore it to 0 on guest exit to prevent userspace taking advantage of the guest having set it non-zero (which would allow userspace to set its SMT priority to high). UAMOR is normally 0. We restore it to 0 on guest exit to prevent the AMR from being used as a covert channel between userspace processes, since the AMR is not context-switched at present. Fixes: b005255e12a3 ("KVM: PPC: Book3S HV: Context-switch new POWER8 SPRs", 2014-01-08) Cc: stable@vger.kernel.org # v3.14+ Signed-off-by: Paul Mackerras arch/powerpc/kvm/book3s_hv.c | 11 +++++++++-- arch/powerpc/kvm/book3s_hv_rmhandlers.S | 9 ++++++++- 2 files changed, 17 insertions(+), 3 deletions(-) commit 289dec5b895a7ecefb2f49da109e6aed9b0f1754 Author: Al Viro Date: Thu Jun 15 00:42:56 2017 -0400 ufs: more deadlock prevention on tail unpacking ->s_lock is not needed for ufs_change_blocknr() Signed-off-by: Al Viro fs/ufs/balloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 09bf4f5b6e6013f0ad6b090d4a8deebd4e56d878 Author: Al Viro Date: Thu Jun 15 00:17:30 2017 -0400 ufs: avoid grabbing ->truncate_mutex if possible tail unpacking is done in a wrong place; the deadlocks galore is best dealt with by doing that in ->write_iter() (and switching to iomap, while we are at it), but that's rather painful to backport. The trouble comes from grabbing pages that cover the beginning of tail from inside of ufs_new_fragments(); ongoing pageout of any of those is going to deadlock on ->truncate_mutex with process that got around to extending the tail holding that and waiting for page to get unlocked, while ->writepage() on that page is waiting on ->truncate_mutex. The thing is, we don't need ->truncate_mutex when the fragment we are trying to map is within the tail - the damn thing is allocated (tail can't contain holes). Let's do a plain lookup and if the fragment is present, we can just pretend that we'd won the race in almost all cases. The only exception is a fragment between the end of tail and the end of block containing tail. Protect ->i_lastfrag with ->meta_lock - read_seqlock_excl() is sufficient. Signed-off-by: Al Viro fs/ufs/balloc.c | 10 ++++++---- fs/ufs/inode.c | 26 ++++++++++++++++++++------ 2 files changed, 26 insertions(+), 10 deletions(-) commit 640f93cc6ea7327588be3cc0849d1342aac0393a Author: Jia-Ju Bai Date: Wed Jun 14 16:35:31 2017 -0700 i40e: Fix a sleep-in-atomic bug The driver may sleep under a spin lock, and the function call path is: i40e_ndo_set_vf_port_vlan (acquire the lock by spin_lock_bh) i40e_vsi_remove_pvid i40e_vlan_stripping_disable i40e_aq_update_vsi_params i40e_asq_send_command mutex_lock --> may sleep To fixed it, the spin lock is released before "i40e_vsi_remove_pvid", and the lock is acquired again after this function. Signed-off-by: Jia-Ju Bai Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 2 ++ 1 file changed, 2 insertions(+) commit 267309f394bf3cd8db001992890b1fa52b97974e Author: Al Viro Date: Wed Jun 14 23:32:19 2017 -0400 ufs_get_locked_page(): make sure we have buffer_heads callers rely upon that, but find_lock_page() racing with attempt of page eviction by memory pressure might have left us with * try_to_free_buffers() successfully done * __remove_mapping() failed, leaving the page in our mapping * find_lock_page() returning an uptodate page with no buffer_heads attached. Signed-off-by: Al Viro fs/ufs/util.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) commit 9522933454f4c4bd5bedf3d71c538708b7c5de5b Merge: 32c1431 83848fb Author: Rafael J. Wysocki Date: Thu Jun 15 01:52:32 2017 +0200 Merge branch 'acpica-fixes' * acpica-fixes: ACPICA: Tables: Mechanism to handle late stage acpi_get_table() imbalance Revert "ACPICA: Disassembler: Enhance resource descriptor detection" commit f63e4f7d4179c9157c51bbe82af7c8f6b5fb39dd Merge: b8e11f7 b2cdd8e 74b2c98 Author: Rafael J. Wysocki Date: Thu Jun 15 01:51:33 2017 +0200 Merge branches 'pm-cpufreq', 'pm-cpuidle' and 'pm-devfreq' * pm-cpufreq: cpufreq: conservative: Allow down_threshold to take values from 1 to 10 Revert "cpufreq: schedutil: Reduce frequencies slower" * pm-cpuidle: cpuidle: dt: Add missing 'of_node_put()' * pm-devfreq: PM / devfreq: exynos-ppmu: Staticize event list PM / devfreq: exynos-ppmu: Handle return value of clk_prepare_enable PM / devfreq: exynos-nocp: Handle return value of clk_prepare_enable commit 949bdfed4b0f74215da60992e9f5e14c9ecbb064 Merge: 658a7568 d85da22 Author: Stephen Boyd Date: Wed Jun 14 16:48:03 2017 -0700 Merge tag 'sunxi-clk-fixes-for-4.12' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into clk-fixes Allwinner clock fixes for 4.12 Some fixes that fix some bindings that went in 4.12, fix a few reset and clock offsets and a build error fix * tag 'sunxi-clk-fixes-for-4.12' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: clk: sunxi-ng: a64: Export PLL_PERIPH0 clock for the PRCM clk: sunxi-ng: h3: Export PLL_PERIPH0 clock for the PRCM dt-bindings: clock: sunxi-ccu: Add pll-periph to PRCM's needed clocks clk: sunxi-ng: enable SUNXI_CCU_MP for PRCM clk: sunxi-ng: v3s: Fix usb otg device reset bit clk: sunxi-ng: a31: Correct lcd1-ch1 clock register offset commit c596961d1b4ccc6f15754fe5a49c37ac6da57145 Author: Al Viro Date: Wed Jun 14 16:36:29 2017 -0400 ufs: fix s_size/s_dsize users For UFS2 we need 64bit variants; we even store them in uspi, but use 32bit ones instead. One wrinkle is in handling of reserved space - recalculating it every time had been stupid all along, but now it would become really ugly. Just calculate it once... Signed-off-by: Al Viro fs/ufs/balloc.c | 2 +- fs/ufs/super.c | 23 ++++++++++++----------- fs/ufs/ufs_fs.h | 7 +++---- fs/ufs/util.h | 11 +++-------- 4 files changed, 19 insertions(+), 24 deletions(-) commit b451cec4bbd913688f5381efad407762a64a92ce Author: Al Viro Date: Wed Jun 14 15:41:17 2017 -0400 ufs: fix reserved blocks check a) honour ->s_minfree; don't just go with default (5) b) don't bother with capability checks until we know we'll need them Signed-off-by: Al Viro fs/ufs/balloc.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit fffd70f58864f5a48b2c17d02730a460f86d4254 Author: Al Viro Date: Wed Jun 14 15:36:31 2017 -0400 ufs: make ufs_freespace() return signed as it is, checking that its return value is <= 0 is useless and that's how it's being used. Signed-off-by: Al Viro fs/ufs/util.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 849a44de91636c24cea799cb8ad8c36433feb913 Author: Jesper Dangaard Brouer Date: Wed Jun 14 13:27:37 2017 +0200 net: don't global ICMP rate limit packets originating from loopback Florian Weimer seems to have a glibc test-case which requires that loopback interfaces does not get ICMP ratelimited. This was broken by commit c0303efeab73 ("net: reduce cycles spend on ICMP replies that gets rate limited"). An ICMP response will usually be routed back-out the same incoming interface. Thus, take advantage of this and skip global ICMP ratelimit when the incoming device is loopback. In the unlikely event that the outgoing it not loopback, due to strange routing policy rules, ICMP rate limiting still works via peer ratelimiting via icmpv4_xrlim_allow(). Thus, we should still comply with RFC1812 (section 4.3.2.8 "Rate Limiting"). This seems to fix the reproducer given by Florian. While still avoiding to perform expensive and unneeded outgoing route lookup for rate limited packets (in the non-loopback case). Fixes: c0303efeab73 ("net: reduce cycles spend on ICMP replies that gets rate limited") Reported-by: Florian Weimer Reported-by: "H.J. Lu" Signed-off-by: Jesper Dangaard Brouer Signed-off-by: David S. Miller net/ipv4/icmp.c | 8 ++++++-- net/ipv6/icmp.c | 2 +- 2 files changed, 7 insertions(+), 3 deletions(-) commit dc9edc44de6cd7cc8cc7f5b36c1adb221eda3207 Author: Bart Van Assche Date: Wed Jun 14 13:27:50 2017 -0600 block: Fix a blk_exit_rl() regression Avoid that the following complaint is reported: BUG: sleeping function called from invalid context at kernel/workqueue.c:2790 in_atomic(): 1, irqs_disabled(): 0, pid: 41, name: rcuop/3 1 lock held by rcuop/3/41: #0: (rcu_callback){......}, at: [] rcu_nocb_kthread+0x282/0x500 Call Trace: dump_stack+0x86/0xcf ___might_sleep+0x174/0x260 __might_sleep+0x4a/0x80 flush_work+0x7e/0x2e0 __cancel_work_timer+0x143/0x1c0 cancel_work_sync+0x10/0x20 blk_throtl_exit+0x25/0x60 blkcg_exit_queue+0x35/0x40 blk_release_queue+0x42/0x130 kobject_put+0xa9/0x190 This happens since we invoke callbacks that need to block from the queue release handler. Fix this by pushing the final release to a workqueue. Reported-by: Ross Zwisler Fixes: commit b425e5049258 ("block: Avoid that blk_exit_rl() triggers a use-after-free") Signed-off-by: Bart Van Assche Tested-by: Ross Zwisler Updated changelog Signed-off-by: Jens Axboe block/blk-sysfs.c | 34 ++++++++++++++++++++++------------ include/linux/blkdev.h | 2 ++ 2 files changed, 24 insertions(+), 12 deletions(-) commit d4702645838c8e04893383b50406249382b4e6bf Author: Raju Rangoju Date: Fri Jun 9 22:17:49 2017 +0530 rdma/cxgb4: Fix memory leaks during module exit Fix memory leaks of iw_cxgb4 module in the exit path Signed-off-by: Raju Rangoju Reviewed-by: Steve Wise Signed-off-by: Doug Ledford drivers/infiniband/hw/cxgb4/device.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) commit c4f65b09b459c6f0ec27b1a1a65302f7fea5c96f Author: Dan Carpenter Date: Wed Jun 14 13:29:31 2017 +0300 net/act_pedit: fix an error code I'm reviewing static checker warnings where we do ERR_PTR(0), which is the same as NULL. I'm pretty sure we intended to return ERR_PTR(-EINVAL) here. Sometimes these bugs lead to a NULL dereference but I don't immediately see that problem here. Fixes: 71d0ed7079df ("net/act_pedit: Support using offset relative to the conventional network headers") Signed-off-by: Dan Carpenter Acked-by: Amir Vadai Signed-off-by: David S. Miller net/sched/act_pedit.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 96ecff14225ad40a29f4d5cfa6bd9266c8e1e89a Author: Al Viro Date: Wed Jun 14 15:17:32 2017 -0400 ufs: fix logics in "ufs: make fsck -f happy" Storing stats _only_ at new locations is wrong for UFS1; old locations should always be kept updated. The check for "has been converted to use of new locations" is also wrong - it should be "->fs_maxbsize is equal to ->fs_bsize". Signed-off-by: Al Viro fs/ufs/super.c | 41 ++++++++++++++++++++++++++++------------- 1 file changed, 28 insertions(+), 13 deletions(-) commit 4542d66bb26f2d021c70a78e46f183c6675fc4c9 Author: Feras Daoud Date: Wed Jun 14 09:59:09 2017 +0300 IB/ipoib: Fix memory leak in create child syscall The flow of creating a new child goes through ipoib_vlan_add which allocates a new interface and checks the rtnl_lock. If the lock is taken, restart_syscall will be called to restart the system call again. In this case we are not releasing the already allocated interface, causing a leak. Fixes: 9baa0b036410 ("IB/ipoib: Add rtnl_link_ops support") Signed-off-by: Feras Daoud Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/ulp/ipoib/ipoib_vlan.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 560b7c3ffec1ca7d5de250d8ca7b1ca2349e98a4 Author: Alex Vesker Date: Wed Jun 14 09:59:08 2017 +0300 IB/ipoib: Fix access to un-initialized napi struct There is no need to re-enable napi since we set the initialized flag before calling ipoib_ib_dev_stop which will disable napi, disabling napi twice is harmless in case it was already disabled. One more reason for this fix is that when using IPoIB new device driver napi is not added to priv, this can lead to kernel panic when rn_ops ndo_open fails. [ 289.755840] invalid opcode: 0000 [#1] SMP [ 289.757111] task: ffff880036964440 ti: ffff880178ee8000 task.ti: ffff880178ee8000 [ 289.757111] RIP: 0010:[] [] napi_enable.part.24+0x4/0x6 [ib_ipoib] [ 289.757111] RSP: 0018:ffff880178eeb6d8 EFLAGS: 00010246 [ 289.757111] RAX: 0000000000000000 RBX: ffff880177a80010 RCX: 000000007fffffff [ 289.757111] RDX: ffffffff81d5f118 RSI: 0000000000000000 RDI: ffff880177a80010 [ 289.757111] RBP: ffff880178eeb6d8 R08: 0000000000000082 R09: 0000000000000283 [ 289.757111] R10: 0000000000000000 R11: 0000000000000000 R12: ffff880175a00000 [ 289.757111] R13: ffff880177a80080 R14: 0000000000000000 R15: 0000000000000001 [ 289.757111] FS: 00007fe2ee346880(0000) GS:ffff88017fc00000(0000) knlGS:0000000000000000 [ 289.757111] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 289.757111] CR2: 00007fffca979020 CR3: 00000001792e4000 CR4: 00000000000006f0 [ 289.757111] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 289.757111] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 289.757111] Stack: [ 289.796027] ffff880178eeb6f0 ffffffffa05251f5 ffff880177a80000 ffff880178eeb718 [ 289.796027] ffffffffa0528505 ffff880175a00000 ffff880177a80000 0000000000000000 [ 289.796027] ffff880178eeb748 ffffffffa051f0ab ffff880175a00000 ffffffffa0537d60 [ 289.796027] Call Trace: [ 289.796027] [] napi_enable+0x25/0x30 [ib_ipoib] [ 289.796027] [] ipoib_ib_dev_open+0x175/0x190 [ib_ipoib] [ 289.796027] [] ipoib_open+0x4b/0x160 [ib_ipoib] [ 289.796027] [] _dev_open+0xbf/0x130 [ 289.796027] [] __dev_change_flags+0x9d/0x170 [ 289.796027] [] dev_change_flags+0x29/0x60 [ 289.796027] [] do_setlink+0x397/0xa40 Fixes: cd565b4b51e5 ('IB/IPoIB: Support acceleration options callbacks') Signed-off-by: Alex Vesker Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/ulp/ipoib/ipoib_ib.c | 1 - 1 file changed, 1 deletion(-) commit b53d4566cc117d9ab8d20b365ba7c2a519439725 Author: Alex Vesker Date: Wed Jun 14 09:59:07 2017 +0300 IB/ipoib: Delete napi in device uninit default This patch mekas init_default and uninit_default symmetric with a call to delete napi. Additionally, the uninit_default gained delete napi call in case of init_default fails. Fixes: 515ed4f3aab4 ('IB/IPoIB: Separate control and data related initializations') Signed-off-by: Alex Vesker Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/ulp/ipoib/ipoib_main.c | 3 +++ 1 file changed, 3 insertions(+) commit 022d038a163f9e889428789d681b97bf07730fb7 Author: Alex Vesker Date: Wed Jun 14 09:59:06 2017 +0300 IB/ipoib: Limit call to free rdma_netdev for capable devices Limit calls to free_rdma_netdev() for capable devices only. Fixes: cd565b4b51e5 ('IB/IPoIB: Support acceleration options callbacks') Signed-off-by: Alex Vesker Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/hw/mlx5/main.c | 6 ++++-- drivers/infiniband/ulp/ipoib/ipoib_main.c | 5 ++++- 2 files changed, 8 insertions(+), 3 deletions(-) commit ab156afd3eeb68ce7b875ec8d9ff4f64d1427776 Author: Alex Vesker Date: Wed Jun 14 09:59:05 2017 +0300 IB/ipoib: Fix memory leaks for child interfaces priv There is a need to free priv explicitly and not just to release the device, child priv is freed explicitly on remove flow and this patch also includes priv free on error flow in P_key creation and also in add_port. Fixes: cd565b4b51e5 ('IB/IPoIB: Support acceleration options callbacks') Signed-off-by: Alex Vesker Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/ulp/ipoib/ipoib_main.c | 7 ++++++- drivers/infiniband/ulp/ipoib/ipoib_vlan.c | 5 ++++- 2 files changed, 10 insertions(+), 2 deletions(-) commit db46a0e1be7eac45d0bb1bdcd438b8d47c920451 Author: Magnus Damm Date: Wed Jun 14 16:15:24 2017 +0900 net: update undefined ->ndo_change_mtu() comment Update ->ndo_change_mtu() callback comment to remove text about returning error in case of undefined callback. This change makes the comment match the existing code behavior. Signed-off-by: Magnus Damm Signed-off-by: David S. Miller include/linux/netdevice.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 7a759cd8e8272ee18922838ee711219c7c796a31 Author: Jiada Wang Date: Sun Apr 9 20:02:37 2017 -0700 perf tools: Fix build with ARCH=x86_64 With commit: 0a943cb10ce78 (tools build: Add HOSTARCH Makefile variable) when building for ARCH=x86_64, ARCH=x86_64 is passed to perf instead of ARCH=x86, so the perf build process searchs header files from tools/arch/x86_64/include, which doesn't exist. The following build failure is seen: In file included from util/event.c:2:0: tools/include/uapi/linux/mman.h:4:27: fatal error: uapi/asm/mman.h: No such file or directory compilation terminated. Fix this issue by using SRCARCH instead of ARCH in perf, just like the main kernel Makefile and tools/objtool's. Signed-off-by: Jiada Wang Tested-by: Arnaldo Carvalho de Melo Acked-by: Jiri Olsa Cc: Alexander Shishkin Cc: Andi Kleen Cc: Eugeniu Rosca Cc: Jan Stancek Cc: Masami Hiramatsu Cc: Peter Zijlstra Cc: Ravi Bangoria Cc: Rui Teng Cc: Sukadev Bhattiprolu Cc: Wang Nan Fixes: 0a943cb10ce7 ("tools build: Add HOSTARCH Makefile variable") Link: http://lkml.kernel.org/r/1491793357-14977-2-git-send-email-jiada_wang@mentor.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/Makefile.config | 38 +++++++++++++++++++------------------- tools/perf/Makefile.perf | 2 +- tools/perf/arch/Build | 2 +- tools/perf/pmu-events/Build | 4 ++-- tools/perf/tests/Build | 2 +- tools/perf/util/header.c | 2 +- 6 files changed, 25 insertions(+), 25 deletions(-) commit 7a1ac110c22eb726684c837544a2d42c33e07be7 Author: Arnaldo Carvalho de Melo Date: Fri Jun 9 16:54:28 2017 -0300 perf evsel: Fix probing of precise_ip level for default cycles event Since commit 18e7a45af91a ("perf/x86: Reject non sampling events with precise_ip") returns -EINVAL for sys_perf_event_open() with an attribute with (attr.precise_ip > 0 && attr.sample_period == 0), just like is done in the routine used to probe the max precise level when no events were passed to 'perf record' or 'perf top', i.e.: perf_evsel__new_cycles() perf_event_attr__set_max_precise_ip() The x86 code, in x86_pmu_hw_config(), which is called all the way from sys_perf_event_open() did, starting with the aforementioned commit: /* There's no sense in having PEBS for non sampling events: */ if (!is_sampling_event(event)) return -EINVAL; Which makes it fail for cycles:ppp, cycles:pp and cycles:p, always using just the non precise cycles variant. To make sure that this is the case, I tested it, before this patch, with: # perf probe -L x86_pmu_hw_config 0 int x86_pmu_hw_config(struct perf_event *event) 1 { 2 if (event->attr.precise_ip) { 17 if (event->attr.precise_ip > precise) 18 return -EOPNOTSUPP; /* There's no sense in having PEBS for non sampling events: */ 21 if (!is_sampling_event(event)) 22 return -EINVAL; } # perf probe x86_pmu_hw_config:22 Added new events: probe:x86_pmu_hw_config (on x86_pmu_hw_config:22) probe:x86_pmu_hw_config_1 (on x86_pmu_hw_config:22) You can now use it in all perf tools, such as: perf record -e probe:x86_pmu_hw_config_1 -aR sleep 1 # perf trace -e perf_event_open,probe:x86_pmu_hwconfig*/max-stack=16/ perf record usleep 1 0.000 ( 0.015 ms): perf/4150 perf_event_open(attr_uptr: 0x7ffebc8ba110, cpu: -1, group_fd: -1 ) ... 0.015 ( ): probe:x86_pmu_hw_config:(ffffffff9c0065e1)) x86_pmu_hw_config ([kernel.kallsyms]) hsw_hw_config ([kernel.kallsyms]) x86_pmu_event_init ([kernel.kallsyms]) perf_try_init_event ([kernel.kallsyms]) perf_event_alloc ([kernel.kallsyms]) SYSC_perf_event_open ([kernel.kallsyms]) sys_perf_event_open ([kernel.kallsyms]) do_syscall_64 ([kernel.kallsyms]) return_from_SYSCALL_64 ([kernel.kallsyms]) syscall (/usr/lib64/libc-2.24.so) perf_event_attr__set_max_precise_ip (/home/acme/bin/perf) perf_evsel__new_cycles (/home/acme/bin/perf) perf_evlist__add_default (/home/acme/bin/perf) cmd_record (/home/acme/bin/perf) run_builtin (/home/acme/bin/perf) handle_internal_command (/home/acme/bin/perf) 0.000 ( 0.021 ms): perf/4150 ... [continued]: perf_event_open()) = -1 EINVAL Invalid argument 0.023 ( 0.002 ms): perf/4150 perf_event_open(attr_uptr: 0x7ffebc8ba110, cpu: -1, group_fd: -1 ) ... 0.025 ( ): probe:x86_pmu_hw_config:(ffffffff9c0065e1)) x86_pmu_hw_config ([kernel.kallsyms]) hsw_hw_config ([kernel.kallsyms]) x86_pmu_event_init ([kernel.kallsyms]) perf_try_init_event ([kernel.kallsyms]) perf_event_alloc ([kernel.kallsyms]) SYSC_perf_event_open ([kernel.kallsyms]) sys_perf_event_open ([kernel.kallsyms]) do_syscall_64 ([kernel.kallsyms]) return_from_SYSCALL_64 ([kernel.kallsyms]) syscall (/usr/lib64/libc-2.24.so) perf_event_attr__set_max_precise_ip (/home/acme/bin/perf) perf_evsel__new_cycles (/home/acme/bin/perf) perf_evlist__add_default (/home/acme/bin/perf) cmd_record (/home/acme/bin/perf) run_builtin (/home/acme/bin/perf) handle_internal_command (/home/acme/bin/perf) 0.023 ( 0.004 ms): perf/4150 ... [continued]: perf_event_open()) = -1 EINVAL Invalid argument 0.028 ( 0.002 ms): perf/4150 perf_event_open(attr_uptr: 0x7ffebc8ba110, cpu: -1, group_fd: -1 ) ... 0.030 ( ): probe:x86_pmu_hw_config:(ffffffff9c0065e1)) x86_pmu_hw_config ([kernel.kallsyms]) hsw_hw_config ([kernel.kallsyms]) x86_pmu_event_init ([kernel.kallsyms]) perf_try_init_event ([kernel.kallsyms]) perf_event_alloc ([kernel.kallsyms]) SYSC_perf_event_open ([kernel.kallsyms]) sys_perf_event_open ([kernel.kallsyms]) do_syscall_64 ([kernel.kallsyms]) return_from_SYSCALL_64 ([kernel.kallsyms]) syscall (/usr/lib64/libc-2.24.so) perf_event_attr__set_max_precise_ip (/home/acme/bin/perf) perf_evsel__new_cycles (/home/acme/bin/perf) perf_evlist__add_default (/home/acme/bin/perf) cmd_record (/home/acme/bin/perf) run_builtin (/home/acme/bin/perf) handle_internal_command (/home/acme/bin/perf) 0.028 ( 0.004 ms): perf/4150 ... [continued]: perf_event_open()) = -1 EINVAL Invalid argument 41.018 ( 0.012 ms): perf/4150 perf_event_open(attr_uptr: 0x7ffebc8b5dd0, pid: -1, group_fd: -1, flags: FD_CLOEXEC) = 4 41.065 ( 0.011 ms): perf/4150 perf_event_open(attr_uptr: 0x3c7db78, pid: -1, group_fd: -1, flags: FD_CLOEXEC) = 4 41.080 ( 0.006 ms): perf/4150 perf_event_open(attr_uptr: 0x3c7db78, pid: -1, group_fd: -1, flags: FD_CLOEXEC) = 4 41.103 ( 0.010 ms): perf/4150 perf_event_open(attr_uptr: 0x3c4e748, pid: 4151 (perf), group_fd: -1, flags: FD_CLOEXEC) = 4 41.115 ( 0.006 ms): perf/4150 perf_event_open(attr_uptr: 0x3c4e748, pid: 4151 (perf), cpu: 1, group_fd: -1, flags: FD_CLOEXEC) = 5 41.122 ( 0.004 ms): perf/4150 perf_event_open(attr_uptr: 0x3c4e748, pid: 4151 (perf), cpu: 2, group_fd: -1, flags: FD_CLOEXEC) = 6 41.128 ( 0.008 ms): perf/4150 perf_event_open(attr_uptr: 0x3c4e748, pid: 4151 (perf), cpu: 3, group_fd: -1, flags: FD_CLOEXEC) = 8 [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.017 MB perf.data (2 samples) ] # I.e. that return -EINVAL in x86_pmu_hw_config() is hit three times. So fix it by just setting attr.sample_period Now, after this patch: # perf trace --max-stack=2 -e perf_event_open,probe:x86_pmu_hw_config* perf record usleep 1 [ perf record: Woken up 1 times to write data ] 0.000 ( 0.017 ms): perf/8469 perf_event_open(attr_uptr: 0x7ffe36c27d10, pid: -1, cpu: 3, group_fd: -1, flags: FD_CLOEXEC) = 4 syscall (/usr/lib64/libc-2.24.so) perf_event_open_cloexec_flag (/home/acme/bin/perf) 0.050 ( 0.031 ms): perf/8469 perf_event_open(attr_uptr: 0x24ebb78, pid: -1, group_fd: -1, flags: FD_CLOEXEC) = 4 syscall (/usr/lib64/libc-2.24.so) perf_evlist__config (/home/acme/bin/perf) 0.092 ( 0.040 ms): perf/8469 perf_event_open(attr_uptr: 0x24ebb78, pid: -1, group_fd: -1, flags: FD_CLOEXEC) = 4 syscall (/usr/lib64/libc-2.24.so) perf_evlist__config (/home/acme/bin/perf) 0.143 ( 0.007 ms): perf/8469 perf_event_open(attr_uptr: 0x24bc748, cpu: -1, group_fd: -1 ) = 4 syscall (/usr/lib64/libc-2.24.so) perf_event_attr__set_max_precise_ip (/home/acme/bin/perf) 0.161 ( 0.007 ms): perf/8469 perf_event_open(attr_uptr: 0x24bc748, pid: 8470 (perf), group_fd: -1, flags: FD_CLOEXEC) = 4 syscall (/usr/lib64/libc-2.24.so) perf_evsel__open (/home/acme/bin/perf) 0.171 ( 0.005 ms): perf/8469 perf_event_open(attr_uptr: 0x24bc748, pid: 8470 (perf), cpu: 1, group_fd: -1, flags: FD_CLOEXEC) = 5 syscall (/usr/lib64/libc-2.24.so) perf_evsel__open (/home/acme/bin/perf) 0.180 ( 0.007 ms): perf/8469 perf_event_open(attr_uptr: 0x24bc748, pid: 8470 (perf), cpu: 2, group_fd: -1, flags: FD_CLOEXEC) = 6 syscall (/usr/lib64/libc-2.24.so) perf_evsel__open (/home/acme/bin/perf) 0.190 ( 0.005 ms): perf/8469 perf_event_open(attr_uptr: 0x24bc748, pid: 8470 (perf), cpu: 3, group_fd: -1, flags: FD_CLOEXEC) = 8 syscall (/usr/lib64/libc-2.24.so) perf_evsel__open (/home/acme/bin/perf) [ perf record: Captured and wrote 0.017 MB perf.data (7 samples) ] # The probe one called from perf_event_attr__set_max_precise_ip() works the first time, with attr.precise_ip = 3, wit hthe next ones being the per cpu ones for the cycles:ppp event. And here is the text from a report and alternative proposed patch by Thomas-Mich Richter: --- On s390 the counter and sampling facility do not support a precise IP skid level and sometimes returns EOPNOTSUPP when structure member precise_ip in struct perf_event_attr is not set to zero. On s390 commnd 'perf record -- true' fails with error EOPNOTSUPP. This happens only when no events are specified on command line. The functions called are ... --> perf_evlist__add_default --> perf_evsel__new_cycles --> perf_event_attr__set_max_precise_ip The last function determines the value of structure member precise_ip by invoking the perf_event_open() system call and checking the return code. The first successful open is the value for precise_ip. However the value is determined without setting member sample_period and indicates no sampling. On s390 the counter facility and sampling facility are different. The above procedure determines a precise_ip value of 3 using the counter facility. Later it uses the sampling facility with a value of 3 and fails with EOPNOTSUPP. --- v2: Older compilers (e.g. gcc 4.4.7) don't support referencing members of unnamed union members in the container struct initialization, so move from: struct perf_event_attr attr = { ... .sample_period = 1, }; to right after it as: struct perf_event_attr attr = { ... }; attr.sample_period = 1; v3: We need to reset .sample_period to 0 to let the users of perf_evsel__new_cycles() to properly setup attr.sample_period or attr.sample_freq. Reported by Ingo Molnar. Reported-and-Acked-by: Thomas-Mich Richter Acked-by: Hendrik Brueckner Acked-by: Jiri Olsa Cc: Adrian Hunter Cc: Alexander Shishkin Cc: David Ahern Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Wang Nan Fixes: 18e7a45af91a ("perf/x86: Reject non sampling events with precise_ip") Link: http://lkml.kernel.org/n/tip-yv6nnkl7tzqocrm0hl3x7vf1@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/tests/task-exit.c | 2 +- tools/perf/util/evsel.c | 12 ++++++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) commit 74030603dfd9f76c0f279f19f1dd1ee3028fee7a Author: WANG Cong Date: Tue Jun 13 13:36:24 2017 -0700 net_sched: move tcf_lock down after gen_replace_estimator() Laura reported a sleep-in-atomic kernel warning inside tcf_act_police_init() which calls gen_replace_estimator() with spinlock protection. It is not necessary in this case, we already have RTNL lock here so it is enough to protect concurrent writers. For the reader, i.e. tcf_act_police(), it needs to make decision based on this rate estimator, in the worst case we drop more/less packets than necessary while changing the rate in parallel, it is still acceptable. Reported-by: Laura Abbott Reported-by: Nick Huber Cc: Jamal Hadi Salim Signed-off-by: Cong Wang Acked-by: Jamal Hadi Salim Signed-off-by: David S. Miller net/sched/act_police.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) commit 4ca2fea6f8277ab381bd08b996d641255b6f7b00 Author: Yan, Zheng Date: Thu Jun 1 17:08:00 2017 +0800 ceph: unify inode i_ctime update Current __ceph_setattr() can set inode's i_ctime to current_time(), req->r_stamp or attr->ia_ctime. These time stamps may have minor differences. It may cause potential problem. Signed-off-by: "Yan, Zheng" Acked-by: Arnd Bergmann Signed-off-by: Ilya Dryomov fs/ceph/acl.c | 1 + fs/ceph/inode.c | 5 ++--- 2 files changed, 3 insertions(+), 3 deletions(-) commit 56199016e8672feb7b903eda003a863d5bf2b8c4 Author: Yan, Zheng Date: Thu Jun 1 16:44:53 2017 +0800 ceph: use current_kernel_time() to get request time stamp ceph uses ktime_get_real_ts() to get request time stamp. In most other cases, current_kernel_time() is used to get time stamp for filesystem operations (called by current_time()). There is granularity difference between ktime_get_real_ts() and current_kernel_time(). The later one can be up to one jiffy behind the former one. This can causes inode's ctime to go back. Signed-off-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov fs/ceph/mds_client.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 03f219041fdbeb31cecff41bb1cb4e1018f9cf75 Author: Luis Henriques Date: Wed May 17 12:21:07 2017 +0100 ceph: check i_nlink while converting a file handle to dentry Converting a file handle to a dentry can be done call after the inode unlink. This means that __fh_to_dentry() requires an extra check to verify the number of links is not 0. The issue can be easily reproduced using xfstest generic/426, which does something like: name_to_handle_at(&fh) echo 3 > /proc/sys/vm/drop_caches unlink() open_by_handle_at(&fh) The call to open_by_handle_at() should fail, as the file doesn't exist anymore. Link: http://tracker.ceph.com/issues/19958 Signed-off-by: Luis Henriques Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov fs/ceph/export.c | 4 ++++ 1 file changed, 4 insertions(+) commit 07d432bb97f19dd5e784175152f9fce3b2646133 Author: Jia-Ju Bai Date: Mon Jun 5 20:23:40 2017 +0800 rxe: Fix a sleep-in-atomic bug in post_one_send The driver may sleep under a spin lock, and the function call path is: post_one_send (acquire the lock by spin_lock_irqsave) init_send_wqe copy_from_user --> may sleep There is no flow that makes "qp->is_user" true, and copy_from_user may cause bug when a non-user pointer is used. So the lines of copy_from_user and check of "qp->is_user" are removed. Signed-off-by: Jia-Ju Bai Reviewed-by: Leon Romanovsky Acked-by: Moni Shoua Signed-off-by: Doug Ledford drivers/infiniband/sw/rxe/rxe_verbs.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) commit e57bb6be5e095351086d3e6de9853a0763342535 Author: Ram Amrani Date: Mon Jun 5 16:32:27 2017 +0300 RDMA/qedr: Add 64KB PAGE_SIZE support to user-space queues Add 64KB PAGE_SIZE support to user-space CQ, SQ and RQ queues. De-facto it means that code was added to translate 64KB pages to smaller 4KB pages that the FW can handle. Otherwise, the FW would wrap (or jump to the next page) when reaching 4KB while the user space library will continue on the same large page. Note that MR code remains as is since the FW supports larger pages for MRs. Signed-off-by: Ram Amrani Signed-off-by: Michal Kalderon Signed-off-by: Doug Ledford drivers/infiniband/hw/qedr/qedr.h | 5 ++- drivers/infiniband/hw/qedr/verbs.c | 64 ++++++++++++++++++++++---------------- 2 files changed, 41 insertions(+), 28 deletions(-) commit dac2738607de3d2bb99bae91c9054a2d753af18b Author: Michal Kalderon Date: Mon Jun 5 16:32:26 2017 +0300 RDMA/qedr: Initialize byte_len in WC of READ and SEND commands Initialize byte_len in work completion of RDMA_READ and RDMA_SEND. Exposed by uDAPL application. Signed-off-by: Michal Kalderon Signed-off-by: Doug Ledford drivers/infiniband/hw/qedr/verbs.c | 4 ++++ 1 file changed, 4 insertions(+) commit 86816a00ca57caf7e4bf5d30e20eb683f5a3ae35 Author: Selvin Xavier Date: Mon May 22 03:15:44 2017 -0700 RDMA/bnxt_re: Remove FMR support Some issues observed with FMR implementation while running stress traffic. So removing the FMR verbs support for now. Signed-off-by: Selvin Xavier Acked-by: Christoph Hellwig Reviewed-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/hw/bnxt_re/ib_verbs.c | 98 +------------------------------- drivers/infiniband/hw/bnxt_re/ib_verbs.h | 6 -- drivers/infiniband/hw/bnxt_re/main.c | 4 -- 3 files changed, 2 insertions(+), 106 deletions(-) commit 018cf5995d69d25be7330c3b8bef4c31bf2b273b Author: Devesh Sharma Date: Mon May 22 03:15:40 2017 -0700 RDMA/bnxt_re: Fix RQE posting logic This patch adds code to ring RQ Doorbell aggressively so that the adapter can DMA RQ buffers sooner, instead of DMA all WQEs in the post_recv WR list together at the end of the post_recv verb. Also use spinlock to serialize RQ posting Signed-off-by: Kalesh AP Signed-off-by: Devesh Sharma Signed-off-by: Selvin Xavier Signed-off-by: Doug Ledford drivers/infiniband/hw/bnxt_re/bnxt_re.h | 2 ++ drivers/infiniband/hw/bnxt_re/ib_verbs.c | 18 +++++++++++++++++- drivers/infiniband/hw/bnxt_re/ib_verbs.h | 1 + 3 files changed, 20 insertions(+), 1 deletion(-) commit 3fb755b3d58084001c89e5f0fd558552bdef9051 Author: Somnath Kotur Date: Mon May 22 03:15:36 2017 -0700 RDMA/bnxt_re: Add HW workaround for avoiding stall for UD QPs HW stalls out after 0x800000 WQEs are posted for UD QPs. To workaround this problem, driver will send a modify_qp cmd to the HW at around the halfway mark(0x400000) so that FW can accordingly modify the QP context in the HW to prevent this stall. This workaround needs to be done for UD, QP1 and Raw Ethertype packets. Added a counter to keep track of WQEs posted during post_send. Signed-off-by: Somnath Kotur Signed-off-by: Selvin Xavier Signed-off-by: Doug Ledford drivers/infiniband/hw/bnxt_re/bnxt_re.h | 2 ++ drivers/infiniband/hw/bnxt_re/ib_verbs.c | 18 ++++++++++++++++++ drivers/infiniband/hw/bnxt_re/qplib_fp.c | 3 +++ drivers/infiniband/hw/bnxt_re/qplib_fp.h | 1 + 4 files changed, 24 insertions(+) commit 1c980b010f06696c9093c5d6a5ac7b5145f89a04 Author: Selvin Xavier Date: Mon May 22 03:15:34 2017 -0700 RDMA/bnxt_re: Dereg MR in FW before freeing the fast_reg_page_list If the host buffers are freed before destroying MR in HW, HW could try accessing these buffers. This could cause a host crash. Fixing the code to avoid this condition. Signed-off-by: Selvin Xavier Signed-off-by: Doug Ledford drivers/infiniband/hw/bnxt_re/ib_verbs.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 9152e0b722b29092115da3bfbf63d26be1a461df Author: Eddie Wai Date: Wed Jun 14 03:26:23 2017 -0700 RDMA/bnxt_re: HW workarounds for handling specific conditions This patch implements the following HW workarounds 1. The SQ depth needs to be augmented by 128 + 1 to avoid running into an Out of order CQE issue 2. Workaround to handle the problem where the HW fast path engine continues to access DMA memory in retranmission mode even after the WQE has already been completed. If the HW reports this condition, driver detects it and posts a Fence WQE. The driver stops reporting the completions to stack until it receives completion for Fence WQE. Signed-off-by: Eddie Wai Signed-off-by: Sriharsha Basavapatna Signed-off-by: Selvin Xavier Reviewed-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/hw/bnxt_re/ib_verbs.c | 373 ++++++++++++++++++++++++++---- drivers/infiniband/hw/bnxt_re/ib_verbs.h | 15 ++ drivers/infiniband/hw/bnxt_re/qplib_fp.c | 166 +++++++++++-- drivers/infiniband/hw/bnxt_re/qplib_fp.h | 17 +- drivers/infiniband/hw/bnxt_re/qplib_res.h | 1 - drivers/infiniband/hw/bnxt_re/qplib_sp.c | 5 + drivers/infiniband/hw/bnxt_re/qplib_sp.h | 2 + 7 files changed, 509 insertions(+), 70 deletions(-) commit 2deaeaf102d692cb6f764123b1df7aa118a8e97c Author: Takashi Iwai Date: Wed Jun 14 16:20:32 2017 +0200 ALSA: pcm: Don't treat NULL chmap as a fatal error The standard PCM chmap helper callbacks treat the NULL info->chmap as a fatal error and spews the kernel warning with stack trace when CONFIG_SND_DEBUG is on. This was OK, originally it was supposed to be always static and non-NULL. But, as the recent addition of Intel LPE audio driver shows, the chmap content may vary dynamically, and it can be even NULL when disconnected. The user still sees the kernel warning unnecessarily. For clearing such a confusion, this patch simply removes the snd_BUG_ON() in each place, just returns an error without warning. Cc: # v4.11+ Signed-off-by: Takashi Iwai sound/core/pcm_lib.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 4130b28f568688f79539b732797a1dc04b048442 Author: Heiko Carstens Date: Tue Jun 6 13:55:42 2017 +0200 s390/ipl: revert Load Normal semantics for LPAR CCW-type re-IPL This reverts the two commits 7afbeb6df2aa ("s390/ipl: always use load normal for CCW-type re-IPL") 0f7451ff3ab8 ("s390/ipl: use load normal for LPAR re-ipl") The two commits did not take into account that behavior of standby memory changes fundamentally if the re-IPL method is changed from Load Clear to Load Normal. In case of the old re-IPL clear method all memory that was initially in standby state will be put into standby state again within the re-IPL process. Or in other words: memory that was brought online before a re-IPL will be offline again after a reboot. Given that we use different re-IPL methods depending on the hypervisor and CCW-type vs SCSI re-IPL it is not easy to tell in advance when and why memory will stay online or will be offline after a re-IPL. This does also have other side effects, since memory that is online from the beginning will be in ZONE_NORMAL by default vs ZONE_MOVABLE for memory that is offline. Therefore, before the change, a user could online and offline memory easily since standby memory was always in ZONE_NORMAL. After the change, and a re-IPL, this depended on which memory parts were online before the re-IPL. From a usability point of view the current behavior is more than suboptimal. Therefore revert these changes until we have a better solution and get back to a consistent behavior. The bad thing about this is that the time required for a re-IPL will be significantly increased for configurations with several 100GB or 1TB of memory. Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky arch/s390/kernel/ipl.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) commit 55f61a040e1b1ea0ba962e53ae341b4c51915bd1 Author: Mario Kleiner Date: Tue Jun 13 07:17:11 2017 +0200 drm/radeon: Fix overflow of watermark calcs at > 4k resolutions. Commit e6b9a6c84b93 ("drm/radeon: Make display watermark calculations more accurate") made watermark calculations more accurate, but not for > 4k resolutions on 32-Bit architectures, as it introduced an integer overflow for those setups and resolutions. Fix this by proper u64 casting and division. Signed-off-by: Mario Kleiner Reported-by: Ben Hutchings Fixes: e6b9a6c84b93 ("drm/radeon: Make display watermark calculations more accurate") Cc: Ben Hutchings Cc: Alex Deucher Cc: stable@vger.kernel.org Signed-off-by: Alex Deucher drivers/gpu/drm/radeon/cik.c | 7 +++++-- drivers/gpu/drm/radeon/evergreen.c | 7 +++++-- drivers/gpu/drm/radeon/si.c | 7 +++++-- 3 files changed, 15 insertions(+), 6 deletions(-) commit bea10413934dcf98cb9b2dfcdc56e1d28f192897 Author: Mario Kleiner Date: Tue Jun 13 07:17:10 2017 +0200 drm/amdgpu: Fix overflow of watermark calcs at > 4k resolutions. Commit d63c277dc672e0 ("drm/amdgpu: Make display watermark calculations more accurate") made watermark calculations more accurate, but not for > 4k resolutions on 32-Bit architectures, as it introduced an integer overflow for those setups and resolutions. Fix this by proper u64 casting and division. Signed-off-by: Mario Kleiner Reported-by: Ben Hutchings Fixes: d63c277dc672 ("drm/amdgpu: Make display watermark calculations more accurate") Cc: Ben Hutchings Cc: Alex Deucher Cc: stable@vger.kernel.org Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/dce_v10_0.c | 7 +++++-- drivers/gpu/drm/amd/amdgpu/dce_v11_0.c | 7 +++++-- drivers/gpu/drm/amd/amdgpu/dce_v6_0.c | 7 +++++-- drivers/gpu/drm/amd/amdgpu/dce_v8_0.c | 7 +++++-- 4 files changed, 20 insertions(+), 8 deletions(-) commit c0f83da96b906ea331e2eea2bd5d2e7f221d27ab Author: Christian König Date: Thu May 18 10:31:01 2017 +0200 drm/radeon: fix "force the UVD DPB into VRAM as well" The DPB must be in VRAM, but not in the first segment. Signed-off-by: Christian König Tested-by: Arthur Marsh Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/radeon/radeon_uvd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 68dd02d19c811ca8ea60220a9d73e13b4bdad73a Author: Johannes Berg Date: Wed Jun 14 09:28:11 2017 +0200 dev_ioctl: copy only the smaller struct iwreq for wext Unfortunately, struct iwreq isn't a proper subset of struct ifreq, but is still handled by the same code path. Robert reported that then applications may (randomly) fault if the struct iwreq they pass happens to land within 8 bytes of the end of a mapping (the struct is only 32 bytes, vs. struct ifreq's 40 bytes). To fix this, pull out the code handling wireless extension ioctls and copy only the smaller structure in this case. This bug goes back a long time, I tracked that it was introduced into mainline in 2.1.15, over 20 years ago! This fixes https://bugzilla.kernel.org/show_bug.cgi?id=195869 Reported-by: Robert O'Callahan Signed-off-by: Johannes Berg include/net/wext.h | 4 ++-- net/core/dev_ioctl.c | 19 ++++++++++++++++--- net/wireless/wext-core.c | 6 +++--- 3 files changed, 21 insertions(+), 8 deletions(-) commit 4f39a1f5870104b1670df2c09c831ac281896545 Author: Johannes Berg Date: Wed Jun 14 09:21:58 2017 +0200 wireless: wext: use struct iwreq earlier in the call chain To make it clear that we never use struct ifreq, cast from it directly in the wext entrypoint and use struct iwreq from there on. The next patch will remove the cast again and pass the correct struct from the beginning. Signed-off-by: Johannes Berg net/wireless/wext-core.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) commit ed6456afef0da57edfd87ce9142813d08a571137 Author: Dan Carpenter Date: Wed Jun 14 12:10:56 2017 +0300 Staging: rtl8723bs: fix an error code in isFileReadable() The caller only cares about zero vs non-zero so this code actually works fine but we should be returning a negative error code instead of a valid pointer casted to int. Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver") Signed-off-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8723bs/os_dep/osdep_service.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e747f64336fc15e1c823344942923195b800aa1e Author: Dan Carpenter Date: Wed Jun 14 13:35:37 2017 +0300 xfrm: NULL dereference on allocation failure The default error code in pfkey_msg2xfrm_state() is -ENOBUFS. We added a new call to security_xfrm_state_alloc() which sets "err" to zero so there several places where we can return ERR_PTR(0) if kmalloc() fails. The caller is expecting error pointers so it leads to a NULL dereference. Fixes: df71837d5024 ("[LSM-IPSec]: Security association restriction.") Signed-off-by: Dan Carpenter Signed-off-by: Steffen Klassert net/key/af_key.c | 1 + 1 file changed, 1 insertion(+) commit 1e3d0c2c70cd3edb5deed186c5f5c75f2b84a633 Author: Dan Carpenter Date: Wed Jun 14 13:34:05 2017 +0300 xfrm: Oops on error in pfkey_msg2xfrm_state() There are some missing error codes here so we accidentally return NULL instead of an error pointer. It results in a NULL pointer dereference. Fixes: df71837d5024 ("[LSM-IPSec]: Security association restriction.") Signed-off-by: Dan Carpenter Signed-off-by: Steffen Klassert net/key/af_key.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) commit b429f96aa5cb4023b915de9c2aa6e7720a939856 Author: Mike Gerow Date: Wed Jun 14 12:40:36 2017 +0200 video: fbdev: udlfb: drop log level for blanking Drop log level for blanking from info to debug. Xorg likes to habitually unblank when already unblanked and this can fill up logs over a long period of time. Signed-off-by: Mike Gerow Cc: bernie@plugable.com Signed-off-by: Bartlomiej Zolnierkiewicz drivers/video/fbdev/udlfb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 484c7bbf2649831714da3a0fa30213977458e9b5 Author: Arnd Bergmann Date: Wed Jun 14 12:40:36 2017 +0200 video: fbdev: via: remove possibly unused variables When CONFIG_PROC_FS is disabled, we get warnings about unused variables as remove_proc_entry() evaluates to an empty macro. drivers/video/fbdev/via/viafbdev.c: In function 'viafb_remove_proc': drivers/video/fbdev/via/viafbdev.c:1635:4: error: unused variable 'iga2_entry' [-Werror=unused-variable] drivers/video/fbdev/via/viafbdev.c:1634:4: error: unused variable 'iga1_entry' [-Werror=unused-variable] These are easy to avoid by using the pointer from the structure. Signed-off-by: Arnd Bergmann Cc: Florian Tobias Schandinat Signed-off-by: Bartlomiej Zolnierkiewicz drivers/video/fbdev/via/viafbdev.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) commit 1235185521ba0d9528052578e27c2f4999d489c6 Author: Johan Hovold Date: Wed Jun 14 12:40:36 2017 +0200 video: fbdev: add missing USB-descriptor endianness conversions Add the missing endianness conversions when printing the USB device-descriptor idVendor, idProduct and bcdDevice fields during probe. Signed-off-by: Johan Hovold Cc: Steve Glendinning Cc: Bernie Thompson Signed-off-by: Bartlomiej Zolnierkiewicz drivers/video/fbdev/smscufx.c | 5 +++-- drivers/video/fbdev/udlfb.c | 5 +++-- 2 files changed, 6 insertions(+), 4 deletions(-) commit c544ad18bd47ee989eb433f09b6574a7f6d415c7 Author: Arnd Bergmann Date: Wed Jun 14 12:40:36 2017 +0200 video: fbdev: avoid int-in-bool-context warning gcc-7 suspects this code might be wrong because we use the result of a multiplication as a bool: drivers/video/fbdev/core/fbmon.c: In function 'fb_edid_add_monspecs': drivers/video/fbdev/core/fbmon.c:1051:84: error: '*' in boolean context, suggest '&&' instead [-Werror=int-in-bool-context] It's actually fine, so let's add a comparison to zero to make that clear to the compiler too. Signed-off-by: Arnd Bergmann Cc: Andrew Morton Signed-off-by: Bartlomiej Zolnierkiewicz drivers/video/fbdev/core/fbmon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 64c667fe29ea697af0fce94857f26ae857951843 Merge: 32c1431 7981dc0 Author: Greg Kroah-Hartman Date: Wed Jun 14 12:00:41 2017 +0200 Merge tag 'iio-fixes-for-4.12b' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus Jonathan writes: Second set of IIO fixes for the 4.12 cycle. * buffer-dma / buffer-dmaengine - Fix missing include of buffer_impl.h after the split of buffer.h. No driver in mainline is currently using these buffers so it wasn't picked up by automated build tests. * ad7152 - Fix a deadlock in ad7152_write_raw_samp_freq as the chip_state lock was already held. * inv_mpu6050 - Add low pass filter setting for chips newer than the MPU6500. None of use previously picked up no the fact it was different on these newer chips. It is separately set for the acceleration on these parts. There is no normal reason to set it differently so the userspace interface remains the same as for early parts. * meson-saradc: - Fix a potential crash by NULL pointer dereference in meson_sar_adc_clear_fifo. * mxs-lradc - Fix a return value check where IS_ERR is used on a function that returns NULL on error commit e79b0006c45c9b0b22f3ea54ff6e256b34c1f208 Author: Megha Dey Date: Wed Jun 14 09:51:56 2017 +0530 ALSA: hda - Add Coffelake PCI ID Coffelake is another Intel part, so need to add PCI ID for it. Signed-off-by: Megha Dey Signed-off-by: Subhransu S. Prusty Acked-by: Vinod Koul Cc: Signed-off-by: Takashi Iwai sound/pci/hda/hda_intel.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 8bfb3676606454ffec836f56c5dc3e69dfc0956a Author: Johannes Berg Date: Wed Jun 14 09:17:38 2017 +0200 wireless: wext: remove ndo_do_ioctl fallback There are no longer any drivers (in the tree proper, I didn't check all the staging drivers) that take WEXT ioctls through this API, the only remaining ones that even have ndo_do_ioctl are using it only for private ioctls. Therefore, we can remove this call. Signed-off-by: Johannes Berg net/wireless/wext-core.c | 3 --- 1 file changed, 3 deletions(-) commit 377aa6b0efbaa29cfeecd8b9244641217f9544ca Author: Alistair Popple Date: Wed Jun 14 14:47:50 2017 +1000 powerpc/npu-dma: Remove spurious WARN_ON when a PCI device has no of_node Commit 4c3b89effc28 ("powerpc/powernv: Add sanity checks to pnv_pci_get_{gpu|npu}_dev") introduced explicit warnings in pnv_pci_get_npu_dev() when a PCIe device has no associated device-tree node. However not all PCIe devices have an of_node and pnv_pci_get_npu_dev() gets indirectly called at least once for every PCIe device in the system. This results in spurious WARN_ON()'s so remove it. The same situation should not exist for pnv_pci_get_gpu_dev() as any NPU based PCIe device requires a device-tree node. Fixes: 4c3b89effc28 ("powerpc/powernv: Add sanity checks to pnv_pci_get_{gpu|npu}_dev") Reported-by: Alexey Kardashevskiy Signed-off-by: Alistair Popple Signed-off-by: Michael Ellerman arch/powerpc/platforms/powernv/npu-dma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 089bc0143f489bd3a4578bdff5f4ca68fb26f341 Author: Jan Beulich Date: Tue Jun 13 16:28:27 2017 -0400 xen-blkback: don't leak stack data via response ring Rather than constructing a local structure instance on the stack, fill the fields directly on the shared ring, just like other backends do. Build on the fact that all response structure flavors are actually identical (the old code did make this assumption too). This is XSA-216. Cc: stable@vger.kernel.org Signed-off-by: Jan Beulich Reviewed-by: Konrad Rzeszutek Wilk Signed-off-by: Konrad Rzeszutek Wilk drivers/block/xen-blkback/blkback.c | 23 ++++++++++++----------- drivers/block/xen-blkback/common.h | 25 +++++-------------------- 2 files changed, 17 insertions(+), 31 deletions(-) commit a24fa22ce22ae302b3bf8f7008896d52d5d57b8d Author: Juergen Gross Date: Thu May 18 17:28:49 2017 +0200 xen/blkback: don't use xen_blkif_get() in xen-blkback kthread There is no need to use xen_blkif_get()/xen_blkif_put() in the kthread of xen-blkback. Thread stopping is synchronous and using the blkif reference counting in the kthread will avoid to ever let the reference count drop to zero at the end of an I/O running concurrent to disconnecting and multiple rings. Setting ring->xenblkd to NULL after stopping the kthread isn't needed as the kthread does this already. Signed-off-by: Juergen Gross Tested-by: Steven Haigh Acked-by: Roger Pau Monné Signed-off-by: Konrad Rzeszutek Wilk drivers/block/xen-blkback/blkback.c | 3 --- drivers/block/xen-blkback/xenbus.c | 1 - 2 files changed, 4 deletions(-) commit 20a3d5bf5e5b13c02450ab6178ec374abd830686 Author: Mateusz Jurczyk Date: Tue Jun 13 20:06:12 2017 +0200 caif: Add sockaddr length check before accessing sa_family in connect handler Verify that the caller-provided sockaddr structure is large enough to contain the sa_family field, before accessing it in the connect() handler of the AF_CAIF socket. Since the syscall doesn't enforce a minimum size of the corresponding memory region, very short sockaddrs (zero or one byte long) result in operating on uninitialized memory while referencing sa_family. Signed-off-by: Mateusz Jurczyk Signed-off-by: David S. Miller net/caif/caif_socket.c | 4 ++++ 1 file changed, 4 insertions(+) commit 71df1d7ccad1c36f7321d6b3b48f2ea42681c363 Author: Juergen Gross Date: Thu May 18 17:28:48 2017 +0200 xen/blkback: don't free be structure too early The be structure must not be freed when freeing the blkif structure isn't done. Otherwise a use-after-free of be when unmapping the ring used for communicating with the frontend will occur in case of a late call of xenblk_disconnect() (e.g. due to an I/O still active when trying to disconnect). Signed-off-by: Juergen Gross Tested-by: Steven Haigh Acked-by: Roger Pau Monné Signed-off-by: Konrad Rzeszutek Wilk drivers/block/xen-blkback/xenbus.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit cc1ec769b87c7dea9092fb537c512e0b6b7a5dac Author: Devesh Sharma Date: Mon May 22 03:15:31 2017 -0700 RDMA/bnxt_re: Fixing the Control path command and response handling Fixing a concurrency issue with creq handling. Each caller was given a globally managed crsq element, which was accessed outside a lock. This could result in corruption, if lot of applications are simultaneously issuing Control Path commands. Now, each caller will provide its own response buffer and the responses will be copied under a lock. Also, Fixing the queue full condition check for the CMDQ. As a part of these changes, the control path code is refactored to remove the code replication in the response status checking. Signed-off-by: Devesh Sharma Signed-off-by: Selvin Xavier Signed-off-by: Doug Ledford drivers/infiniband/hw/bnxt_re/qplib_fp.c | 215 +++++-------------- drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 314 ++++++++++++++------------- drivers/infiniband/hw/bnxt_re/qplib_rcfw.h | 61 ++---- drivers/infiniband/hw/bnxt_re/qplib_res.h | 5 + drivers/infiniband/hw/bnxt_re/qplib_sp.c | 328 +++++++---------------------- 5 files changed, 318 insertions(+), 605 deletions(-) commit 46464411307746e6297a034a9983a22c9dfc5a0c Author: Juergen Gross Date: Thu May 18 17:28:47 2017 +0200 xen/blkback: fix disconnect while I/Os in flight Today disconnecting xen-blkback is broken in case there are still I/Os in flight: xen_blkif_disconnect() will bail out early without releasing all resources in the hope it will be called again when the last request has terminated. This, however, won't happen as xen_blkif_free() won't be called on termination of the last running request: xen_blkif_put() won't decrement the blkif refcnt to 0 as xen_blkif_disconnect() didn't finish before thus some xen_blkif_put() calls in xen_blkif_disconnect() didn't happen. To solve this deadlock xen_blkif_disconnect() and xen_blkif_alloc_rings() shouldn't use xen_blkif_put() and xen_blkif_get() but use some other way to do their accounting of resources. This at once fixes another error in xen_blkif_disconnect(): when it returned early with -EBUSY for another ring than 0 it would call xen_blkif_put() again for already handled rings on a subsequent call. This will lead to inconsistencies in the refcnt handling. Cc: stable@vger.kernel.org Signed-off-by: Juergen Gross Tested-by: Steven Haigh Acked-by: Roger Pau Monné Signed-off-by: Konrad Rzeszutek Wilk drivers/block/xen-blkback/common.h | 1 + drivers/block/xen-blkback/xenbus.c | 7 +++++-- 2 files changed, 6 insertions(+), 2 deletions(-) commit 7981dc07fe317e3506d706e5ef91b94da02656f4 Author: Phil Reid Date: Tue Jun 13 13:12:35 2017 +0800 iio: buffer-dmaengine: Add missing header buffer_impl.h Add buffer_impl.h as buffer.h was split into interface for using and for internals. Without this industrialio-buffer-dmaengine.c fails to compile. Fixes: commit 33dd94cb972175249258329c4aaffddcc82c2005 ("iio:buffer.h - split into buffer.h and buffer_impl.h") Signed-off-by: Phil Reid Signed-off-by: Jonathan Cameron drivers/iio/buffer/industrialio-buffer-dmaengine.c | 1 + 1 file changed, 1 insertion(+) commit 838519b89fa7e162f7190c70d888a65ee7889e12 Author: Phil Reid Date: Tue Jun 13 10:31:36 2017 +0800 iio: buffer-dma: Add missing header buffer_impl.h Add buffer_impl.h as buffer.h was split into interface for using and for internals. Without this industrialio-buffer-dma.c fails to compile. Fixes: commit 33dd94cb972175249258329c4aaffddcc82c2005 ("iio:buffer.h - split into buffer.h and buffer_impl.h") Signed-off-by: Phil Reid Signed-off-by: Jonathan Cameron drivers/iio/buffer/industrialio-buffer-dma.c | 1 + 1 file changed, 1 insertion(+) commit 436c4c45b5b9562b59cedbb51b7343ab4a6dd8cc Author: Zhang Bo Date: Tue Jun 13 10:39:20 2017 +0800 Revert "leds: handle suspend/resume in heartbeat trigger" This reverts commit 5ab92a7cb82c66bf30685583a38a18538e3807db. System cannot enter suspend mode because of heartbeat led trigger. In autosleep_wq, try_to_suspend function will try to enter suspend mode in specific period. it will get wakeup_count then call pm_notifier chain callback function and freeze processes. Heartbeat_pm_notifier is called and it call led_trigger_unregister to change the trigger of led device to none. It will send uevent message and the wakeup source count changed. As wakeup_count changed, suspend will abort. Fixes: 5ab92a7cb82c ("leds: handle suspend/resume in heartbeat trigger") Signed-off-by: Zhang Bo Acked-by: Pavel Machek Reviewed-by: Linus Walleij Signed-off-by: Jacek Anaszewski drivers/leds/trigger/ledtrig-heartbeat.c | 31 ------------------------------- 1 file changed, 31 deletions(-) commit 4f02b50ece11dcf75263fb7a4cfe8a5df1cfabea Author: Jonas Gorski Date: Fri Jun 2 14:17:05 2017 +0200 leds: bcm6328: fix signal source assignment for leds 4 to 7 Each nibble represents 4 LEDs, and in case of the higher register, bit 0 represents LED 4, so we need to use modulus for the LED number as well. Fixes: fd7b025a238d0a5440bfa26c585eb78097bf48dc ("leds: add BCM6328 LED driver") Signed-off-by: Jonas Gorski Acked-by: Álvaro Fernández Rojas Signed-off-by: Jacek Anaszewski drivers/leds/leds-bcm6328.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit bf5d008164dd84d671ca2dd569a1676051f9faff Author: Priyalee Kushwaha Date: Sat Jun 3 10:21:24 2017 -0700 platform/x86: intel_telemetry_debugfs: fix oops when load/unload module This fixes an oops found while testing load/unload of the intel_telemetry_debugfs module. module_init uses register_pm_notifier for PM callbacks, but unregister_pm_notifier was missing from module_exit. [ 97.481860] BUG: unable to handle kernel paging request at ffffffffa006f010 [ 97.489742] IP: blocking_notifier_chain_register+0x3a/0xa0 [ 97.495898] PGD 2e0a067 [ 97.495899] PUD 2e0b063 [ 97.498737] PMD 179e29067 [ 97.501573] PTE 0 [ 97.508423] Oops: 0000 1 PREEMPT SMP [ 97.512724] Modules linked in: intel_telemetry_debugfs intel_rapl gpio_keys dwc3 udc_core intel_telemetry_pltdrv intel_punit_ipc intel_telemetry_core rtc_cmos efivars x86_pkg_temp_thermal iwlwifi snd_hda_codec_hdmi soc_button_array btusb cfg80211 btrtl mei_me hci_uart btbcm mei btintel i915 bluetooth intel_pmc_ipc snd_hda_intel spi_pxa2xx_platform snd_hda_codec dwc3_pci snd_hda_core tpm_tis tpm_tis_core tpm efivarfs [ 97.558453] CPU: 0 PID: 889 Comm: modprobe Not tainted 4.11.0-rc6-intel-dev-bkc #1 [ 97.566950] Hardware name: Intel Corp. Joule DVT3/SDS, BIOS GTPP181A.X64.0143.B30.1701132137 01/13/2017 [ 97.577518] task: ffff8801793a21c0 task.stack: ffff8801793f0000 [ 97.584162] RIP: 0010:blocking_notifier_chain_register+0x3a/0xa0 [ 97.590903] RSP: 0018:ffff8801793f3c58 EFLAGS: 00010286 [ 97.596802] RAX: ffffffffa006f000 RBX: ffffffff81e3ea20 RCX: 0000000000000000 [ 97.604812] RDX: ffff880179eaf210 RSI: ffffffffa0131000 RDI: ffffffff81e3ea20 [ 97.612821] RBP: ffff8801793f3c68 R08: 0000000000000006 R09: 000000000000005c [ 97.620847] R10: 0000000000000000 R11: 0000000000000006 R12: ffffffffa0131000 [ 97.628855] R13: 0000000000000000 R14: ffff880176e35f48 R15: ffff8801793f3ea8 [ 97.636865] FS: 00007f7eeba07700(0000) GS:ffff88017fc00000(0000) knlGS:0000000000000000 [ 97.645948] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 97.652423] CR2: ffffffffa006f010 CR3: 00000001775ef000 CR4: 00000000003406f0 [ 97.660423] Call Trace: [ 97.663166] ? 0xffffffffa0031000 [ 97.666885] register_pm_notifier+0x18/0x20 [ 97.671581] telemetry_debugfs_init+0x92/0x1000 Signed-off-by: Priyalee Kushwaha Signed-off-by: Andy Shevchenko Signed-off-by: Darren Hart (VMware) drivers/platform/x86/intel_telemetry_debugfs.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) commit 7de84403a2020874714f6f40170f5ef9fc7ab58e Merge: c5549ee a1a745e Author: David S. Miller Date: Tue Jun 13 13:46:01 2017 -0400 Merge tag 'batadv-net-for-davem-20170613' of git://git.open-mesh.org/linux-merge Simon Wunderlich says: ==================== Here are two batman-adv bugfixes: - fix rx packet counters for local ARP replies, by Sven Eckelmann - fix memory leaks for unicast packetes received from another gateway in bridge loop avoidance, by Andreas Pape ==================== Signed-off-by: David S. Miller commit c5549ee40112f2511a794c9aad7eb6ac5f18b0eb Merge: ace17c3 b3dd827 Author: David S. Miller Date: Tue Jun 13 13:34:13 2017 -0400 Merge tag 'mac80211-for-davem-2017-06-13' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== Some fixes: * Avi fixes some fallout from my mac80211 RX flags changes * Emmanuel fixes an issue with adhering to the spec, and an oversight in the SMPS management code * Jason's patch makes mac80211 use constant-time memory comparisons for message authentication, to avoid having potentially observable timing differences * my fix makes mac80211 set the basic rates bitmap before the channel so the next update to the driver has more consistent data - this required another rework patch to remove some useless 5/10 MHz code that can never be hit ==================== Signed-off-by: David S. Miller commit ace17c369295f088dc8ac8ff468602646fa5cced Author: Tayar, Tomer Date: Tue Jun 13 12:15:59 2017 +0300 qed: fix dump of context data Currently when dumping a context data only word number '1' is read for the entire context. Fixes: c965db444629 ("qed: Add support for debug data collection") Signed-off-by: Tomer Tayar Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_debug.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 60cfe1eaccb8af598ebe1bdc44e157ea30fcdd81 Author: Bjørn Mork Date: Tue Jun 13 19:10:18 2017 +0200 qmi_wwan: new Telewell and Sierra device IDs A new Sierra Wireless EM7305 device ID used in a Toshiba laptop, and two Longcheer device IDs entries used by Telewell TW-3G HSPA+ branded modems. Reported-by: Petr Kloc Reported-by: Teemu Likonen Signed-off-by: Bjørn Mork Signed-off-by: David S. Miller drivers/net/usb/qmi_wwan.c | 4 ++++ 1 file changed, 4 insertions(+) commit 665fff2923323e348728e03a7cdb0ce56f316d39 Author: Florian Fainelli Date: Mon Jun 12 17:18:51 2017 -0700 net: phy: Fix MDIO_THUNDER dependencies After commit 90eff9096c01 ("net: phy: Allow splitting MDIO bus/device support from PHYs") we could create a configuration where MDIO_DEVICE=y and PHYLIB=m which leads to the following undefined references: drivers/built-in.o: In function `thunder_mdiobus_pci_remove': >> mdio-thunder.c:(.text+0x2a212f): undefined reference to >> `mdiobus_unregister' >> mdio-thunder.c:(.text+0x2a2138): undefined reference to >> `mdiobus_free' drivers/built-in.o: In function `thunder_mdiobus_pci_probe': mdio-thunder.c:(.text+0x2a22e7): undefined reference to `devm_mdiobus_alloc_size' mdio-thunder.c:(.text+0x2a236f): undefined reference to `of_mdiobus_register' Reported-by: kbuild test robot Fixes: 90eff9096c01 ("net: phy: Allow splitting MDIO bus/device support from PHYs") Signed-off-by: Florian Fainelli Tested-by: Randy Dunlap Signed-off-by: David S. Miller drivers/net/phy/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 4a6a97e2650c7dd7b1380ba763e9038c814e220c Author: Joe Perches Date: Mon Jun 12 16:39:51 2017 -0700 netconsole: Remove duplicate "netconsole: " logging prefix It's already added by pr_fmt so remove the explicit use. Signed-off-by: Joe Perches Signed-off-by: David S. Miller drivers/net/netconsole.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c38b7d327aafd1e3ad7ff53eefac990673b65667 Author: WANG Cong Date: Mon Jun 12 09:52:26 2017 -0700 igmp: acquire pmc lock for ip_mc_clear_src() Andrey reported a use-after-free in add_grec(): for (psf = *psf_list; psf; psf = psf_next) { ... psf_next = psf->sf_next; where the struct ip_sf_list's were already freed by: kfree+0xe8/0x2b0 mm/slub.c:3882 ip_mc_clear_src+0x69/0x1c0 net/ipv4/igmp.c:2078 ip_mc_dec_group+0x19a/0x470 net/ipv4/igmp.c:1618 ip_mc_drop_socket+0x145/0x230 net/ipv4/igmp.c:2609 inet_release+0x4e/0x1c0 net/ipv4/af_inet.c:411 sock_release+0x8d/0x1e0 net/socket.c:597 sock_close+0x16/0x20 net/socket.c:1072 This happens because we don't hold pmc->lock in ip_mc_clear_src() and a parallel mr_ifc_timer timer could jump in and access them. The RCU lock is there but it is merely for pmc itself, this spinlock could actually ensure we don't access them in parallel. Thanks to Eric and Long for discussion on this bug. Reported-by: Andrey Konovalov Cc: Eric Dumazet Cc: Xin Long Signed-off-by: Cong Wang Reviewed-by: Xin Long Signed-off-by: David S. Miller net/ipv4/igmp.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) commit eb3c28c15555212227cfa8b9a3baa21ad5982a19 Author: Oliver Neukum Date: Mon Jun 12 13:56:51 2017 +0200 r8152: give the device version Getting the device version out of the driver really aids debugging. Signed-off-by: Oliver Neukum Signed-off-by: David S. Miller drivers/net/usb/r8152.c | 2 ++ 1 file changed, 2 insertions(+) commit 459fa246d8fa4a543ed9a3331f15c8fe1caf9937 Author: Stephen Rothwell Date: Sun Jun 11 15:22:10 2017 +1000 clocksource: Explicitly include linux/clocksource.h when needed The kbuild test robot reported errors in these files when doing an ia64 allmodconfig build. drivers/clocksource/timer-sun5i.c:52:21: error: field 'clksrc' has incomplete type struct clocksource clksrc; ^~~~~~ drivers/clocksource/cadence_ttc_timer.c:92:21: error: field 'cs' has incomplete type struct clocksource cs; ^~ (and many more errors for these files) Cc: Michal Simek Cc: "Sören Brinkmann" Cc: Daniel Lezcano Cc: Thomas Gleixner Cc: Maxime Ripard Cc: Chen-Yu Tsai Reported-by: kbuild test robot Signed-off-by: Stephen Rothwell Acked-by: Michal Simek Signed-off-by: Daniel Lezcano drivers/clocksource/cadence_ttc_timer.c | 1 + drivers/clocksource/timer-sun5i.c | 1 + 2 files changed, 2 insertions(+) commit 97d8b6e3b8538198aefb0003342920a82e062147 Author: Ashwanth Goli Date: Tue Jun 13 16:54:55 2017 +0530 net: rps: fix uninitialized symbol warning This patch fixes uninitialized symbol warning that got introduced by the following commit 773fc8f6e8d6 ("net: rps: send out pending IPI's on CPU hotplug") Signed-off-by: Ashwanth Goli Signed-off-by: David S. Miller net/core/dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0ca4cd7bccf0b82d2c10069f295772bb7b76d006 Author: Jiri Kosina Date: Fri Jun 9 13:15:37 2017 +0200 HID: let generic driver yield control iff specific driver has been enabled There are many situations where generic HID driver provides some basic level of support for certain device, but later this support (usually by implementing vendor-specific extensions of HID protocol) is extended and the support moved over to a separate (usually per-vendor) specific driver. This might bring a rather unpleasant suprise for users, as all of a sudden there is a new config option they have to enable in order to get any support for their device whatsoever, although previous kernel versions provided basic support through the generic driver. Which is rightfully seen as a regression. Fix this by including the entry for a particular device in hid_have_special_driver[] iff the specific config option has been specified, and let generic driver handle the device otherwise. Also make the behavior of hid_scan_report() (where the same decision is being taken on a per-report level) consistent. While at it, reshuffle the hid_have_special_driver[] a bit to restore the alphabetical ordering (first order by config option, and within those sections order by VID). This is considered a short-term solution, before generic way of giving precedence to special drivers and falling back to generic driver is figured out. While at it, fixup a missing entry for GFRM driver; thanks to Hans de Geode for spotting this (and for discovering a few issues in the conversion). Signed-off-by: Jiri Kosina drivers/hid/hid-core.c | 282 ++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 221 insertions(+), 61 deletions(-) commit b3dd8279659f14f3624bb32559782d699fa6f7d1 Author: Emmanuel Grumbach Date: Sat Jun 10 13:52:45 2017 +0300 mac80211: don't send SMPS action frame in AP mode when not needed mac80211 allows to modify the SMPS state of an AP both, when it is started, and after it has been started. Such a change will trigger an action frame to all the peers that are currently connected, and will be remembered so that new peers will get notified as soon as they connect (since the SMPS setting in the beacon may not be the right one). This means that we need to remember the SMPS state currently requested as well as the SMPS state that was configured initially (and advertised in the beacon). The former is bss->req_smps and the latter is sdata->smps_mode. Initially, the AP interface could only be started with SMPS_OFF, which means that sdata->smps_mode was SMPS_OFF always. Later, a nl80211 API was added to be able to start an AP with a different AP mode. That code forgot to update bss->req_smps and because of that, if the AP interface was started with SMPS_DYNAMIC, we had: sdata->smps_mode = SMPS_DYNAMIC bss->req_smps = SMPS_OFF That configuration made mac80211 think it needs to fire off an action frame to any new station connecting to the AP in order to let it know that the actual SMPS configuration is SMPS_OFF. Fix that by properly setting bss->req_smps in ieee80211_start_ap. Fixes: f69931748730 ("mac80211: set smps_mode according to ap params") Signed-off-by: Emmanuel Grumbach Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg net/mac80211/cfg.c | 2 ++ 1 file changed, 2 insertions(+) commit 98c67d187db7808b1f3c95f2110dd4392d034182 Author: Jason A. Donenfeld Date: Sat Jun 10 04:59:12 2017 +0200 mac80211/wpa: use constant time memory comparison for MACs Otherwise, we enable all sorts of forgeries via timing attack. Signed-off-by: Jason A. Donenfeld Cc: Johannes Berg Cc: linux-wireless@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Johannes Berg net/mac80211/wpa.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit c87905bec5dad66aa6bb43d11502cafdb33e07db Author: Johannes Berg Date: Sat Jun 10 13:52:43 2017 +0300 mac80211: set bss_info data before configuring the channel When mac80211 changes the channel, it also calls into the driver's bss_info_changed() callback, e.g. with BSS_CHANGED_IDLE. The driver may, like iwlwifi does, access more data from bss_info in that case and iwlwifi accesses the basic_rates bitmap, but if changing from a band with more (basic) rates to one with fewer, an out-of-bounds access of the rate array may result. While we can't avoid having invalid data at some point in time, we can avoid having it while we call the driver - so set up all the data before configuring the channel, and then apply it afterwards. This fixes https://bugzilla.kernel.org/show_bug.cgi?id=195677 Reported-by: Johannes Hirte Tested-by: Johannes Hirte Debugged-by: Emmanuel Grumbach Signed-off-by: Johannes Berg net/mac80211/mlme.c | 38 ++++++++++++++++++++++++++++---------- 1 file changed, 28 insertions(+), 10 deletions(-) commit 44f6d42cbd6e4c1d4d25f19502dd5f27aedf89d4 Author: Johannes Berg Date: Sat Jun 10 13:52:44 2017 +0300 mac80211: remove 5/10 MHz rate code from station MLME There's no need for the station MLME code to handle bitrates for 5 or 10 MHz channels when it can't ever create such a configuration. Remove the unnecessary code. Signed-off-by: Johannes Berg net/mac80211/mlme.c | 24 +++--------------------- 1 file changed, 3 insertions(+), 21 deletions(-) commit 204a7dbcb27bc4b461f42d7f96fdc875eb677f2f Author: Avraham Stern Date: Mon Jun 12 10:44:58 2017 +0300 mac80211: Fix incorrect condition when checking rx timestamp If the driver reports the rx timestamp at PLCP start, mac80211 can only handle legacy encoding, but the code checks that the encoding is not legacy. Fix this. Fixes: da6a4352e7c8 ("mac80211: separate encoding/bandwidth from flags") Signed-off-by: Avraham Stern Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg net/mac80211/ieee80211_i.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 769dc04db3ed8484798aceb015b94deacc2ba557 Author: Emmanuel Grumbach Date: Thu Jun 8 14:00:49 2017 +0300 mac80211: don't look at the PM bit of BAR frames When a peer sends a BAR frame with PM bit clear, we should not modify its PM state as madated by the spec in 802.11-20012 10.2.1.2. Cc: stable@vger.kernel.org Signed-off-by: Emmanuel Grumbach Signed-off-by: Johannes Berg net/mac80211/rx.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit c380f681245d7ae57f17d9ebbbe8f8f1557ee1fb Author: Zhenyu Wang Date: Fri Jun 9 15:48:05 2017 +0800 drm/i915: Fix GVT-g PVINFO version compatibility check Current it's strictly checked if PVINFO version matches 1.0 for GVT-g i915 guest which doesn't help for compatibility at all and forces GVT-g host can't extend PVINFO easily with version bump for real compatibility check. This fixes that to check minimal required PVINFO version instead. v2: - drop unneeded version macro - use only major version for sanity check v3: - fix up PVInfo value with kernel type - one indent fix Reviewed-by: Joonas Lahtinen Cc: Chuanxiao Dong Cc: Joonas Lahtinen Cc: stable@vger.kernel.org # v4.10+ Signed-off-by: Zhenyu Wang Signed-off-by: Joonas Lahtinen Link: http://patchwork.freedesktop.org/patch/msgid/20170609074805.5101-1-zhenyuw@linux.intel.com (cherry picked from commit 0c8792d00d38de85b6ceb1dd67d3ee009d7c8e42) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_pvinfo.h | 8 ++------ drivers/gpu/drm/i915/i915_vgpu.c | 10 ++++------ 2 files changed, 6 insertions(+), 12 deletions(-) commit 1c2d6bbf0433ddf7c978ac5f2bd582e9e7d34687 Author: Ville Syrjälä Date: Thu Jun 8 17:40:02 2017 +0300 drm/i915: Fix SKL+ watermarks for 90/270 rotation skl_check_plane_surface() already rotates the clipped plane source coordinates to match the scanout direction because that's the way the GTT mapping is set up. Thus we no longer need to rotate the coordinates in the watermark code. For cursors we use the non-clipped coordinates which are not rotated appropriately, but that doesn't actually matter since cursors don't even support 90/270 degree rotation. v2: Resolve conflicts from SKL+ wm rework Cc: stable@vger.kernel.org Cc: Tvrtko Ursulin Fixes: b63a16f6cd89 ("drm/i915: Compute display surface offset in the plane check hook for SKL+") Signed-off-by: Ville Syrjälä Link: http://patchwork.freedesktop.org/patch/msgid/20170331180056.14086-3-ville.syrjala@linux.intel.com Tested-by: Tvrtko Ursulin Reviewed-by: Maarten Lankhorst (cherry picked from commit fce5adf568abb1e8264d677156e2e0deb529194d) Signed-off-by: Jani Nikula Link: http://patchwork.freedesktop.org/patch/msgid/20170608144002.1605-2-ville.syrjala@linux.intel.com drivers/gpu/drm/i915/intel_pm.c | 36 ++++++++++++++++++++++++------------ 1 file changed, 24 insertions(+), 12 deletions(-) commit 9a775e0308b575e3a17c66a586ed049b07f48199 Author: Ville Syrjälä Date: Thu Jun 8 17:40:01 2017 +0300 drm/i915: Fix scaling check for 90/270 degree plane rotation Starting from commit b63a16f6cd89 ("drm/i915: Compute display surface offset in the plane check hook for SKL+") we've already rotated the src coordinates by 270 degrees by the time we check if a scaler is needed or not, so we must not account for the rotation a second time. Previously we did these steps in the opposite order and hence the scaler check had to deal with rotation itself. The double rotation handling causes us to enable a scaler pretty much every time 90/270 degree plane rotation is requested, leading to fuzzier fonts and whatnot. v2: s/unsigned/unsigned int/ to appease checkpatch v3: s/DRM_ROTATE_0/DRM_MODE_ROTATE_0/ Cc: stable@vger.kernel.org Cc: Tvrtko Ursulin Reported-by: Tvrtko Ursulin Tested-by: Tvrtko Ursulin Fixes: b63a16f6cd89 ("drm/i915: Compute display surface offset in the plane check hook for SKL+") Signed-off-by: Ville Syrjälä Link: http://patchwork.freedesktop.org/patch/msgid/20170331180056.14086-2-ville.syrjala@linux.intel.com Reviewed-by: Maarten Lankhorst (cherry picked from commit d96a7d2adb040a67e163a82dad6316f9f572498a) Signed-off-by: Jani Nikula Link: http://patchwork.freedesktop.org/patch/msgid/20170608144002.1605-1-ville.syrjala@linux.intel.com drivers/gpu/drm/i915/intel_display.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) commit 023f108dcc187e34ef864bf10ed966cf25e14e2a Author: Paul Moore Date: Wed Jun 7 16:48:19 2017 -0400 selinux: fix double free in selinux_parse_opts_str() This patch is based on a discussion generated by an earlier patch from Tetsuo Handa: * https://marc.info/?t=149035659300001&r=1&w=2 The double free problem involves the mnt_opts field of the security_mnt_opts struct, selinux_parse_opts_str() frees the memory on error, but doesn't set the field to NULL so if the caller later attempts to call security_free_mnt_opts() we trigger the problem. In order to play it safe we change selinux_parse_opts_str() to call security_free_mnt_opts() on error instead of free'ing the memory directly. This should ensure that everything is handled correctly, regardless of what the caller may do. Fixes: e0007529893c1c06 ("LSM/SELinux: Interfaces to allow FS to control mount options") Cc: stable@vger.kernel.org Cc: Tetsuo Handa Reported-by: Dmitry Vyukov Signed-off-by: Paul Moore Signed-off-by: James Morris security/selinux/hooks.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit d9ee35acfabbc909c3be4360cd5655a006628b2e Author: Vlastimil Babka Date: Mon Jun 12 09:21:30 2017 +0200 x86/mm: Disable 1GB direct mappings when disabling 2MB mappings The kmemleak and debug_pagealloc features both disable using huge pages for direct mappings so they can do cpa() on page level granularity in any context. However they only do that for 2MB pages, which means 1GB pages can still be used if the CPU supports it, unless disabled by a boot param, which is non-obvious. Disable also 1GB pages when disabling 2MB pages. Signed-off-by: Vlastimil Babka Cc: Christian Borntraeger Cc: Linus Torvalds Cc: Pekka Enberg Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Vegard Nossum Cc: linux-mm@kvack.org Link: http://lkml.kernel.org/r/2be70c78-6130-855d-3dfa-d87bd1dd4fda@suse.cz Signed-off-by: Ingo Molnar arch/x86/mm/init.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 63f700aab4c11d46626de3cd051dae56cf7e9056 Merge: 2ab99b0 e5c8667 Author: Linus Torvalds Date: Tue Jun 13 15:09:10 2017 +0900 Merge tag 'xtensa-20170612' of git://github.com/jcmvbkbc/linux-xtensa Pull Xtensa fixes from Max Filippov: - don't use linux IRQ #0 in legacy irq domains: fixes timer interrupt assignment when it's hardware IRQ # is 0 and the kernel is built w/o device tree support - reduce reservation size for double exception vector literals from 48 to 20 bytes: fixes build on cores with small user exception vector - cleanups: use kmalloc_array instead of kmalloc in simdisk_init and seq_puts instead of seq_printf in c_show. * tag 'xtensa-20170612' of git://github.com/jcmvbkbc/linux-xtensa: xtensa: don't use linux IRQ #0 xtensa: reduce double exception literal reservation xtensa: ISS: Use kmalloc_array() in simdisk_init() xtensa: Use seq_puts() in c_show() commit 2ab99b001dea71c25bcf34f746f5781c880151bb Merge: 32c1431 16ddcc3 Author: Linus Torvalds Date: Tue Jun 13 15:07:11 2017 +0900 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Martin Schwidefsky: - A fix for KVM to avoid kernel oopses in case of host protection faults due to runtime instrumentation - A fix for the AP bus to avoid dead devices after unbind / bind - A fix for a compile warning merged from the vfio_ccw tree - Updated default configurations * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390: update defconfig s390/zcrypt: Fix blocking queue device after unbind/bind. s390/vfio_ccw: make some symbols static s390/kvm: do not rely on the ILC on kvm host protection fauls commit ca8efa1df1d15a1795a2da57f9f6aada6ed6b946 Author: Paul Mackerras Date: Tue Jun 6 16:47:22 2017 +1000 KVM: PPC: Book3S HV: Context-switch EBB registers properly This adds code to save the values of three SPRs (special-purpose registers) used by userspace to control event-based branches (EBBs), which are essentially interrupts that get delivered directly to userspace. These registers are loaded up with guest values when entering the guest, and their values are saved when exiting the guest, but we were not saving the host values and restoring them before going back to userspace. On POWER8 this would only affect userspace programs which explicitly request the use of EBBs and also use the KVM_RUN ioctl, since the only source of EBBs on POWER8 is the PMU, and there is an explicit enable bit in the PMU registers (and those PMU registers do get properly context-switched between host and guest). On POWER9 there is provision for externally-generated EBBs, and these are not subject to the control in the PMU registers. Since these registers only affect userspace, we can save them when we first come in from userspace and restore them before returning to userspace, rather than saving/restoring the host values on every guest entry/exit. Similarly, we don't need to worry about their values on offline secondary threads since they execute in the context of the idle task, which never executes in userspace. Fixes: b005255e12a3 ("KVM: PPC: Book3S HV: Context-switch new POWER8 SPRs", 2014-01-08) Cc: stable@vger.kernel.org # v3.14+ Signed-off-by: Paul Mackerras arch/powerpc/kvm/book3s_hv.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) commit 6964e53f55837b0c49ed60d36656d2e0ee4fc27b Author: Jacob Keller Date: Mon Jun 12 15:38:36 2017 -0700 i40e: fix handling of HW ATR eviction A recent commit to refactor the driver and remove the hw_disabled_flags field accidentally introduced two regressions. First, we overwrote pf->flags which removed various key flags including the MSI-X settings. Additionally, it was intended that we have now two flags, HW_ATR_EVICT_CAPABLE and HW_ATR_EVICT_ENABLED, but this was not done, and we accidentally were mis-using HW_ATR_EVICT_CAPABLE everywhere. This patch adds the missing piece, HW_ATR_EVICT_ENABLED, and safely updates pf->flags instead of overwriting it. Without this patch we will have many problems including disabling MSI-X support, and we'll attempt to use HW ATR eviction on devices which do not support it. Fixes: 47994c119a36 ("i40e: remove hw_disabled_flags in favor of using separate flag bits", 2017-04-19) Signed-off-by: Jacob Keller Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher Signed-off-by: David S. Miller drivers/net/ethernet/intel/i40e/i40e.h | 1 + drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 4 ++-- drivers/net/ethernet/intel/i40e/i40e_main.c | 7 ++++--- drivers/net/ethernet/intel/i40e/i40e_txrx.c | 4 ++-- 4 files changed, 9 insertions(+), 7 deletions(-) commit fa07ab72cbb0d843429e61bf179308aed6cbe0dd Author: Heiner Kallweit Date: Sun Jun 11 00:38:36 2017 +0200 genirq: Release resources in __setup_irq() error path In case __irq_set_trigger() fails the resources requested via irq_request_resources() are not released. Add the missing release call into the error handling path. Fixes: c1bacbae8192 ("genirq: Provide irq_request/release_resources chip callbacks") Signed-off-by: Heiner Kallweit Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: http://lkml.kernel.org/r/655538f5-cb20-a892-ff15-fbd2dd1fa4ec@gmail.com kernel/irq/manage.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 2ad50606f847a902303a5364b7cad64bdd6246f6 Author: Ondrej Mosnáček Date: Mon Jun 5 17:52:39 2017 +0200 dm integrity: reject mappings too large for device dm-integrity would successfully create mappings with the number of sectors greater than the provided data sector count. Attempts to read sectors of this mapping that were beyond the provided data sector count would then yield run-time messages of the form "device-mapper: integrity: Too big sector number: ...". Fix this by emitting an error when the requested mapping size is bigger than the provided data sector count. Signed-off-by: Ondrej Mosnacek Acked-by: Mikulas Patocka Signed-off-by: Mike Snitzer drivers/md/dm-integrity.c | 5 +++++ 1 file changed, 5 insertions(+) commit 98dbf5af4fdd142f6184dbb4e4164a8d1850d526 Author: Randy Dunlap Date: Mon Jun 12 15:43:03 2017 -0500 PCI: endpoint: Select CRC32 to fix test build error The PCI endpoint test driver uses crc32_le() so it should select CRC32. Fixes this build error (when CRC32=m): drivers/built-in.o: In function `pci_epf_test_cmd_handler': pci-epf-test.c:(.text+0x2d98d): undefined reference to `crc32_le' Fixes: 349e7a85b25f ("PCI: endpoint: functions: Add an EP function to test PCI") Reported-by: kbuild test robot Signed-off-by: Randy Dunlap Signed-off-by: Bjorn Helgaas Acked-by: Kishon Vijay Abraham I drivers/pci/endpoint/functions/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 675c8da049fd6556eb2d6cdd745fe812752f07a8 Author: Karicheri, Muralidharan Date: Mon Jun 12 15:06:26 2017 -0400 hsr: fix incorrect warning When HSR interface is setup using ip link command, an annoying warning appears with the trace as below:- [ 203.019828] hsr_get_node: Non-HSR frame [ 203.019833] Modules linked in: [ 203.019848] CPU: 0 PID: 158 Comm: sd-resolve Tainted: G W 4.12.0-rc3-00052-g9fa6bf70 #2 [ 203.019853] Hardware name: Generic DRA74X (Flattened Device Tree) [ 203.019869] [] (unwind_backtrace) from [] (show_stack+0x10/0x14) [ 203.019880] [] (show_stack) from [] (dump_stack+0xac/0xe0) [ 203.019894] [] (dump_stack) from [] (__warn+0xd8/0x104) [ 203.019907] [] (__warn) from [] (warn_slowpath_fmt+0x34/0x44) root@am57xx-evm:~# [ 203.019921] [] (warn_slowpath_fmt) from [] (hsr_get_node+0x148/0x170) [ 203.019932] [] (hsr_get_node) from [] (hsr_forward_skb+0x110/0x7c0) [ 203.019942] [] (hsr_forward_skb) from [] (hsr_dev_xmit+0x2c/0x34) [ 203.019954] [] (hsr_dev_xmit) from [] (dev_hard_start_xmit+0xc4/0x3bc) [ 203.019963] [] (dev_hard_start_xmit) from [] (__dev_queue_xmit+0x7c4/0x98c) [ 203.019974] [] (__dev_queue_xmit) from [] (ip6_finish_output2+0x330/0xc1c) [ 203.019983] [] (ip6_finish_output2) from [] (ip6_output+0x58/0x454) [ 203.019994] [] (ip6_output) from [] (mld_sendpack+0x420/0x744) As this is an expected path to hsr_get_node() with frame coming from the master interface, add a check to ensure packet is not from the master port and then warn. Signed-off-by: Murali Karicheri Signed-off-by: David S. Miller net/hsr/hsr_forward.c | 3 +-- net/hsr/hsr_framereg.c | 9 +++++++-- net/hsr/hsr_framereg.h | 2 +- 3 files changed, 9 insertions(+), 5 deletions(-) commit 8a524f803a3e0290cdba6d373361b2cef9752934 Author: Peter Zijlstra Date: Mon Jun 12 13:52:46 2017 +0200 x86/debug: Handle early WARN_ONs proper Hans managed to trigger a WARN very early in the boot which killed his (Virtual) box. The reason is that the recent rework of WARN() to use UD0 forgot to add the fixup_bug() call to early_fixup_exception(). As a result the kernel does not handle the WARN_ON injected UD0 exception and panics. Add the missing fixup call, so early UD's injected by WARN() get handled. Fixes: 9a93848fe787 ("x86/debug: Implement __WARN() using UD0") Reported-and-tested-by: Hans de Goede Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Cc: Linus Torvalds Cc: Frank Mehnert Cc: Hans de Goede Cc: Michael Thayer Link: http://lkml.kernel.org/r/20170612180108.w4vgu2ckucmllf3a@hirez.programming.kicks-ass.net arch/x86/include/asm/extable.h | 1 + arch/x86/kernel/traps.c | 2 +- arch/x86/mm/extable.c | 3 +++ 3 files changed, 5 insertions(+), 1 deletion(-) commit 94114c367553f3301747e47f6947cabde947575f Author: Stephen Boyd Date: Wed Jun 7 23:36:03 2017 -0700 tick/broadcast: Make tick_broadcast_setup_oneshot() static This function isn't used outside of tick-broadcast.c, so let's mark it static. Signed-off-by: Stephen Boyd Link: http://lkml.kernel.org/r/20170608063603.13276-1-sboyd@codeaurora.org Signed-off-by: Thomas Gleixner kernel/time/tick-broadcast.c | 4 +++- kernel/time/tick-internal.h | 2 -- 2 files changed, 3 insertions(+), 3 deletions(-) commit d360a687d99577110c181e67ebfb9a1b6fed63a2 Author: Vladimir Murzin Date: Mon Jun 12 13:35:52 2017 +0100 ARM: 8682/1: V7M: Set cacheid iff DminLine or IminLine is nonzero Cache support is optional feature in M-class cores, thus DminLine or IminLine of Cache Type Register is zero if caches are not implemented, but we check the whole CTR which has other features encoded there. Let's be more precise and check for DminLine and IminLine of CTR before we set cacheid. Signed-off-by: Vladimir Murzin Signed-off-by: Russell King arch/arm/kernel/setup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bbeedfda8eee0b17ea16e4e157c596095458676a Author: Yisheng Xie Date: Fri Jun 9 15:28:18 2017 +0100 ARM: 8681/1: make VMSPLIT_3G_OPT depends on !ARM_LPAE When both enable CONFIG_ARM_LPAE=y and CONFIG_VMSPLIT_3G_OPT=y, which means use PAGE_OFFSET=0xB0000000 with ARM_LPAE, the kernel will boot fail and stop after uncompressed: Starting kernel ... Uart base = 0x20001000 watchdog reg = 0x20013000 dtb addr = 0x80840308 Uncompressing Linux... done, booting the kernel. For ARM_LPAE only support 3:1, 2:2, 1:3 split of TTBR1, which mention in: http://elinux.org/images/6/6a/Elce11_marinas.pdf - p16 So we should make VMSPLIT_3G_OPT depends on !ARM_LPAE to avoid trigger this bug. Acked-by: Nicolas Pitre Signed-off-by: Yisheng Xie Signed-off-by: Russell King arch/arm/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 60ce2858514ed9ccaf00dc7e9f4dc219537e9855 Author: Ard Biesheuvel Date: Fri Jun 9 10:14:53 2017 +0100 ARM: 8680/1: boot/compressed: fix inappropriate Thumb2 mnemonic for __nop Commit 06a4b6d009a1 ("ARM: 8677/1: boot/compressed: fix decompressor header layout for v7-M") fixed an issue in the layout of the header of the compressed kernel image that was caused by the assembler emitting narrow opcodes for 'mov r0, r0', and for this reason, the mnemonic was updated to use the W() macro, which will append the .w suffix (which forces a wide encoding) if required, i.e., when building the kernel in Thumb2 mode. However, this failed to take into account that on Thumb2 kernels built for CPUs that are also ARM capable, the entry point is entered in ARM mode, and so the instructions emitted here will be ARM instructions that only exist in a wide encoding to begin with, which is why the assembler rejects the .w suffix here and aborts the build with the following message: head.S: Assembler messages: head.S:132: Error: width suffixes are invalid in ARM mode -- `mov.w r0,r0' So replace the W(mov) with separate ARM and Thumb2 instructions, where the latter will only be used for THUMB2_ONLY builds. Fixes: 06a4b6d009a1 ("ARM: 8677/1: boot/compressed: fix decompressor ...") Reported-by: Arnd Bergmann Acked-by: Arnd Bergmann Signed-off-by: Ard Biesheuvel Signed-off-by: Russell King arch/arm/boot/compressed/efi-header.S | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit d2f48f05cd2a2a0a708fbfa45f1a00a87660d937 Author: Corentin Labbe Date: Fri Jun 9 14:48:41 2017 +0300 usb: xhci: ASMedia ASM1042A chipset need shorts TX quirk When plugging an USB webcam I see the following message: [106385.615559] xhci_hcd 0000:04:00.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk? [106390.583860] handle_tx_event: 913 callbacks suppressed With this patch applied, I get no more printing of this message. Cc: Signed-off-by: Corentin Labbe Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman drivers/usb/host/xhci-pci.c | 3 +++ 1 file changed, 3 insertions(+) commit b72eb8435b25be3a1880264cf32ac91e626ba5ba Author: YD Tseng Date: Fri Jun 9 14:48:40 2017 +0300 usb: xhci: Fix USB 3.1 supported protocol parsing xHCI host controllers can have both USB 3.1 and 3.0 extended speed protocol lists. If the USB3.1 speed is parsed first and 3.0 second then the minor revision supported will be overwritten by the 3.0 speeds and the USB3 roothub will only show support for USB 3.0 speeds. This was the case with a xhci controller with the supported protocol capability listed below. In xhci-mem.c, the USB 3.1 speed is parsed first, the min_rev of usb3_rhub is set as 0x10. And then USB 3.0 is parsed. However, the min_rev of usb3_rhub will be changed to 0x00. If USB 3.1 device is connected behind this host controller, the speed of USB 3.1 device just reports 5G speed using lsusb. 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 00 01 08 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 02 08 10 03 55 53 42 20 01 02 00 00 00 00 00 00 //USB 3.1 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 02 08 00 03 55 53 42 20 03 06 00 00 00 00 00 00 //USB 3.0 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 02 08 00 02 55 53 42 20 09 0E 19 00 00 00 00 00 //USB 2.0 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 This patch fixes the issue by only owerwriting the minor revision if it is higher than the existing one. [reword commit message -Mathias] Cc: Signed-off-by: YD Tseng Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman drivers/usb/host/xhci-mem.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 8ada5f3ae96b0336145e453740b9168a56a0fc1d Merge: 32c1431 f50b878 Author: Greg Kroah-Hartman Date: Mon Jun 12 16:02:19 2017 +0200 Merge tag 'fixes-for-v4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus Felipe writes: usb: fixes for v4.12-rc5 Alan Stern fixed a GPF in gadgetfs found by the kernel fuzzying project composite.c learned that if it deactivates a function during bind, it must reactivate it during unbind. commit 3500cd73dff48f28f4ba80c171c4c80034d40f76 Author: Christian Perle Date: Mon Jun 12 10:06:57 2017 +0200 proc: snmp6: Use correct type in memset Reading /proc/net/snmp6 yields bogus values on 32 bit kernels. Use "u64" instead of "unsigned long" in sizeof(). Fixes: 4a4857b1c81e ("proc: Reduce cache miss in snmp6_seq_show") Signed-off-by: Christian Perle Signed-off-by: David S. Miller net/ipv6/proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3db1200ca21f3c63c9044185dc5762ef996848cb Author: Frank Rowand Date: Fri Jun 9 17:26:32 2017 -0700 clocksource/drivers/arm_arch_timer: Fix read and iounmap of incorrect variable Fix boot warning 'Trying to vfree() nonexistent vm area' from arch_timer_mem_of_init(). Refactored code attempts to read and iounmap using address frame instead of address ioremap(frame->cntbase). Fixes: c389d701dfb70 ("clocksource: arm_arch_timer: split MMIO timer probing.") Signed-off-by: Frank Rowand Reviewed-by: Fu Wei Acked-by: Marc Zyngier Signed-off-by: Daniel Lezcano drivers/clocksource/arm_arch_timer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 74b2c983960b1af193eafe6b4ea3bb1bf77e2650 Merge: 32c1431 6b1355f Author: Rafael J. Wysocki Date: Mon Jun 12 14:40:08 2017 +0200 Merge branch 'for-next' of https://git.kernel.org/pub/scm/linux/kernel/git/mzx/devfreq Pull devfreq fixes from MyungJoo Ham. * 'for-next' of https://git.kernel.org/pub/scm/linux/kernel/git/mzx/devfreq: PM / devfreq: exynos-ppmu: Staticize event list PM / devfreq: exynos-ppmu: Handle return value of clk_prepare_enable PM / devfreq: exynos-nocp: Handle return value of clk_prepare_enable commit b2cdd8e1b54849477a32d820acc2e87828a38f3d Author: Christophe Jaillet Date: Sun Jun 11 14:28:54 2017 +0200 cpuidle: dt: Add missing 'of_node_put()' 'of_node_put()' should be called on pointer returned by 'of_parse_phandle()' when done. In this function this is done in all path except this 'continue', so add it. Fixes: 97735da074fd (drivers: cpuidle: Add status property to ARM idle states) Signed-off-by: Christophe Jaillet Signed-off-by: Rafael J. Wysocki drivers/cpuidle/dt_idle_states.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit b8e11f7d2791bd9320be1c6e772a60b2aa093e45 Author: Tomasz Wilczyński Date: Sun Jun 11 17:28:39 2017 +0900 cpufreq: conservative: Allow down_threshold to take values from 1 to 10 Commit 27ed3cd2ebf4 (cpufreq: conservative: Fix the logic in frequency decrease checking) removed the 10 point substraction when comparing the load against down_threshold but did not remove the related limit for the down_threshold value. As a result, down_threshold lower than 11 is not allowed even though values from 1 to 10 do work correctly too. The comment ("cannot be lower than 11 otherwise freq will not fall") also does not apply after removing the substraction. For this reason, allow down_threshold to take any value from 1 to 99 and fix the related comment. Fixes: 27ed3cd2ebf4 (cpufreq: conservative: Fix the logic in frequency decrease checking) Signed-off-by: Tomasz Wilczyński Acked-by: Viresh Kumar Cc: 3.10+ # 3.10+ Signed-off-by: Rafael J. Wysocki drivers/cpufreq/cpufreq_conservative.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit ff0a6d6f932ff4b9eb8e8140f98cc1cf763d0d78 Author: Rafael J. Wysocki Date: Mon Jun 12 14:16:16 2017 +0200 Revert "cpufreq: schedutil: Reduce frequencies slower" Revert commit 39b64aa1c007 (cpufreq: schedutil: Reduce frequencies slower) that introduced unintentional changes in behavior leading to adverse effects on some systems. Reported-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki kernel/sched/cpufreq_schedutil.c | 3 --- 1 file changed, 3 deletions(-) commit 83848fbe7e6af978c080a88c130a67178b1ac0e4 Author: Lv Zheng Date: Wed Jun 7 12:54:58 2017 +0800 ACPICA: Tables: Mechanism to handle late stage acpi_get_table() imbalance Considering this case: 1. A program opens a sysfs table file 65535 times, it can increase validation_count and first increment cause the table to be mapped: validation_count = 65535 2. AML execution causes "Load" to be executed on the same table, this time it cannot increase validation_count, so validation_count remains: validation_count = 65535 3. The program closes sysfs table file 65535 times, it can decrease validation_count and the last decrement cause the table to be unmapped: validation_count = 0 4. AML code still accessing the loaded table, kernel crash can be observed. To prevent that from happening, add a validation_count threashold. When it is reached, the validation_count can no longer be incremented/decremented to invalidate the table descriptor (means preventing table unmappings) Note that code added in acpi_tb_put_table() is actually a no-op but changes the warning message into a "warn once" one. Lv Zheng. Signed-off-by: Lv Zheng [ rjw: Changelog, comments ] Signed-off-by: Rafael J. Wysocki drivers/acpi/acpica/tbutils.c | 34 +++++++++++++++++++++++++--------- include/acpi/actbl.h | 14 ++++++++++++++ 2 files changed, 39 insertions(+), 9 deletions(-) commit 19e72d3abb63cb16d021a4066ce1a18880509e99 Author: Bart Van Assche Date: Thu Feb 9 17:28:50 2017 -0800 configfs: Introduce config_item_get_unless_zero() Signed-off-by: Bart Van Assche [hch: minor style tweak] Signed-off-by: Christoph Hellwig fs/configfs/item.c | 8 ++++++++ include/linux/configfs.h | 3 ++- 2 files changed, 10 insertions(+), 1 deletion(-) commit ba80aa909c99802c428682c352b0ee0baac0acd3 Author: Nicholas Bellinger Date: Thu Jun 8 04:51:54 2017 +0000 configfs: Fix race between create_link and configfs_rmdir This patch closes a long standing race in configfs between the creation of a new symlink in create_link(), while the symlink target's config_item is being concurrently removed via configfs_rmdir(). This can happen because the symlink target's reference is obtained by config_item_get() in create_link() before the CONFIGFS_USET_DROPPING bit set by configfs_detach_prep() during configfs_rmdir() shutdown is actually checked.. This originally manifested itself on ppc64 on v4.8.y under heavy load using ibmvscsi target ports with Novalink API: [ 7877.289863] rpadlpar_io: slot U8247.22L.212A91A-V1-C8 added [ 7879.893760] ------------[ cut here ]------------ [ 7879.893768] WARNING: CPU: 15 PID: 17585 at ./include/linux/kref.h:46 config_item_get+0x7c/0x90 [configfs] [ 7879.893811] CPU: 15 PID: 17585 Comm: targetcli Tainted: G O 4.8.17-customv2.22 #12 [ 7879.893812] task: c00000018a0d3400 task.stack: c0000001f3b40000 [ 7879.893813] NIP: d000000002c664ec LR: d000000002c60980 CTR: c000000000b70870 [ 7879.893814] REGS: c0000001f3b43810 TRAP: 0700 Tainted: G O (4.8.17-customv2.22) [ 7879.893815] MSR: 8000000000029033 CR: 28222242 XER: 00000000 [ 7879.893820] CFAR: d000000002c664bc SOFTE: 1 GPR00: d000000002c60980 c0000001f3b43a90 d000000002c70908 c0000000fbc06820 GPR04: c0000001ef1bd900 0000000000000004 0000000000000001 0000000000000000 GPR08: 0000000000000000 0000000000000001 d000000002c69560 d000000002c66d80 GPR12: c000000000b70870 c00000000e798700 c0000001f3b43ca0 c0000001d4949d40 GPR16: c00000014637e1c0 0000000000000000 0000000000000000 c0000000f2392940 GPR20: c0000001f3b43b98 0000000000000041 0000000000600000 0000000000000000 GPR24: fffffffffffff000 0000000000000000 d000000002c60be0 c0000001f1dac490 GPR28: 0000000000000004 0000000000000000 c0000001ef1bd900 c0000000f2392940 [ 7879.893839] NIP [d000000002c664ec] config_item_get+0x7c/0x90 [configfs] [ 7879.893841] LR [d000000002c60980] check_perm+0x80/0x2e0 [configfs] [ 7879.893842] Call Trace: [ 7879.893844] [c0000001f3b43ac0] [d000000002c60980] check_perm+0x80/0x2e0 [configfs] [ 7879.893847] [c0000001f3b43b10] [c000000000329770] do_dentry_open+0x2c0/0x460 [ 7879.893849] [c0000001f3b43b70] [c000000000344480] path_openat+0x210/0x1490 [ 7879.893851] [c0000001f3b43c80] [c00000000034708c] do_filp_open+0xfc/0x170 [ 7879.893853] [c0000001f3b43db0] [c00000000032b5bc] do_sys_open+0x1cc/0x390 [ 7879.893856] [c0000001f3b43e30] [c000000000009584] system_call+0x38/0xec [ 7879.893856] Instruction dump: [ 7879.893858] 409d0014 38210030 e8010010 7c0803a6 4e800020 3d220000 e94981e0 892a0000 [ 7879.893861] 2f890000 409effe0 39200001 992a0000 <0fe00000> 4bffffd0 60000000 60000000 [ 7879.893866] ---[ end trace 14078f0b3b5ad0aa ]--- To close this race, go ahead and obtain the symlink's target config_item reference only after the existing CONFIGFS_USET_DROPPING check succeeds. This way, if configfs_rmdir() wins create_link() will return -ENONET, and if create_link() wins configfs_rmdir() will return -EBUSY. Reported-by: Bryant G. Ly Tested-by: Bryant G. Ly Signed-off-by: Nicholas Bellinger Signed-off-by: Christoph Hellwig Cc: stable@vger.kernel.org fs/configfs/symlink.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 138437f591dd9a42d53c6fed1a3c85e02678851c Author: Hangbin Liu Date: Sun Jun 11 09:44:20 2017 +0800 xfrm: move xfrm_garbage_collect out of xfrm_policy_flush Now we will force to do garbage collection if any policy removed in xfrm_policy_flush(). But during xfrm_net_exit(). We call flow_cache_fini() first and set set fc->percpu to NULL. Then after we call xfrm_policy_fini() -> frxm_policy_flush() -> flow_cache_flush(), we will get NULL pointer dereference when check percpu_empty. The code path looks like: flow_cache_fini() - fc->percpu = NULL xfrm_policy_fini() - xfrm_policy_flush() - xfrm_garbage_collect() - flow_cache_flush() - flow_cache_percpu_empty() - fcp = per_cpu_ptr(fc->percpu, cpu) To reproduce, just add ipsec in netns and then remove the netns. v2: As Xin Long suggested, since only two other places need to call it. move xfrm_garbage_collect() outside xfrm_policy_flush(). v3: Fix subject mismatch after v2 fix. Fixes: 35db06912189 ("xfrm: do the garbage collection after flushing policy") Signed-off-by: Hangbin Liu Reviewed-by: Xin Long Signed-off-by: Steffen Klassert net/key/af_key.c | 2 ++ net/xfrm/xfrm_policy.c | 4 ---- net/xfrm/xfrm_user.c | 1 + 3 files changed, 3 insertions(+), 4 deletions(-) commit 24835611a96e9b41ad57dd5024915106293be7e9 Author: Heiner Kallweit Date: Sat Jun 10 13:36:38 2017 +0200 mmc: meson-gx: work around broken SDIO with certain WiFi chips There have been reports about SDIO failing with certain WiFi chips in descriptor chain mode. SD / eMMC are working fine. So let's fall back to bounce buffer mode for command SD_IO_RW_EXTENDED. This was reported to fix the error. Fixes: 79ed05e329c3 "mmc: meson-gx: add support for descriptor chain mode" Signed-off-by: Heiner Kallweit Tested-by: Martin Blumenstingl Signed-off-by: Ulf Hansson drivers/mmc/host/meson-gx-mmc.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit d758619ba6a5d250914b06b2b923a65e48bdd002 Author: Laurent Pinchart Date: Sat Jun 10 11:59:43 2017 +0300 drm: dw-hdmi: Fix compilation breakage by selecting REGMAP_MMIO The dw-hdmi driver switched to regmap-mmio, but lacks the dependency in Kconfig. This can result in compilation breakages. Fix it by selecting REGMAP_MMIO. Fixes: 80e2f97968b5 ("drm: bridge: dw-hdmi: Switch to regmap for register access") Reported-by: kbuild test robot Signed-off-by: Laurent Pinchart Signed-off-by: Archit Taneja Link: http://patchwork.freedesktop.org/patch/msgid/20170610085943.15788-1-laurent.pinchart+renesas@ideasonboard.com drivers/gpu/drm/bridge/synopsys/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 6b1355f9ace06a65443c607e1b70872a5f613f80 Author: Krzysztof Kozlowski Date: Wed Jun 7 20:12:28 2017 +0200 PM / devfreq: exynos-ppmu: Staticize event list The ppmu_events array is accessed only in this compilation unit so it can be made static. Signed-off-by: Krzysztof Kozlowski Acked-by: Chanwoo Choi Signed-off-by: MyungJoo Ham drivers/devfreq/event/exynos-ppmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 97a6ba5bd0b54544fabe090711fabefc7a703a5f Author: Arvind Yadav Date: Fri May 19 16:26:04 2017 +0530 PM / devfreq: exynos-ppmu: Handle return value of clk_prepare_enable clk_prepare_enable() can fail here and we must check its return value. Signed-off-by: Arvind Yadav Signed-off-by: MyungJoo Ham drivers/devfreq/event/exynos-ppmu.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 973a27c7464231282489b2f14581e33cf29024b8 Author: Arvind Yadav Date: Fri May 19 16:20:35 2017 +0530 PM / devfreq: exynos-nocp: Handle return value of clk_prepare_enable clk_prepare_enable() can fail here and we must check its return value. Signed-off-by: Arvind Yadav Signed-off-by: MyungJoo Ham drivers/devfreq/event/exynos-nocp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 32c1431eea4881a6b17bd7c639315010aeefa452 Author: Linus Torvalds Date: Sun Jun 11 16:48:20 2017 -0700 Linux 4.12-rc5 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 32627645e9e89b58e0e2fcf6f5f6755b9bd046bb Merge: 6d53cef 92347cf Author: Linus Torvalds Date: Sun Jun 11 16:17:29 2017 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security Pull key subsystem fixes from James Morris: "Here are a bunch of fixes for Linux keyrings, including: - Fix up the refcount handling now that key structs use the refcount_t type and the refcount_t ops don't allow a 0->1 transition. - Fix a potential NULL deref after error in x509_cert_parse(). - Don't put data for the crypto algorithms to use on the stack. - Fix the handling of a null payload being passed to add_key(). - Fix incorrect cleanup an uninitialised key_preparsed_payload in key_update(). - Explicit sanitisation of potentially secure data before freeing. - Fixes for the Diffie-Helman code" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (23 commits) KEYS: fix refcount_inc() on zero KEYS: Convert KEYCTL_DH_COMPUTE to use the crypto KPP API crypto : asymmetric_keys : verify_pefile:zero memory content before freeing KEYS: DH: add __user annotations to keyctl_kdf_params KEYS: DH: ensure the KDF counter is properly aligned KEYS: DH: don't feed uninitialized "otherinfo" into KDF KEYS: DH: forbid using digest_null as the KDF hash KEYS: sanitize key structs before freeing KEYS: trusted: sanitize all key material KEYS: encrypted: sanitize all key material KEYS: user_defined: sanitize key payloads KEYS: sanitize add_key() and keyctl() key payloads KEYS: fix freeing uninitialized memory in key_update() KEYS: fix dereferencing NULL payload with nonzero length KEYS: encrypted: use constant-time HMAC comparison KEYS: encrypted: fix race causing incorrect HMAC calculations KEYS: encrypted: fix buffer overread in valid_master_desc() KEYS: encrypted: avoid encrypting/decrypting stack buffers KEYS: put keyring if install_session_keyring_to_cred() fails KEYS: Delete an error message for a failed memory allocation in get_derived_key() ... commit 6d53cefb18e4646fb4bf62ccb6098fb3808486df Author: Linus Torvalds Date: Sun Jun 11 15:51:56 2017 -0700 compiler, clang: properly override 'inline' for clang Commit abb2ea7dfd82 ("compiler, clang: suppress warning for unused static inline functions") just caused more warnings due to re-defining the 'inline' macro. So undef it before re-defining it, and also add the 'notrace' attribute like the gcc version that this is overriding does. Maybe this makes clang happier. Signed-off-by: Linus Torvalds include/linux/compiler-clang.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 4b1f0d33db7d5bf92b5623e3ea2066e2de3999e3 Author: Donald Sharp Date: Sat Jun 10 16:30:17 2017 -0400 net: ipmr: Fix some mroute forwarding issues in vrf's This patch fixes two issues: 1) When forwarding on *,G mroutes that are in a vrf, the kernel was dropping information about the actual incoming interface when calling ip_mr_forward from ip_mr_input. This caused ip_mr_forward to send the multicast packet back out the incoming interface. Fix this by modifying ip_mr_forward to be handed the correctly resolved dev. 2) When a unresolved cache entry is created we store the incoming skb on the unresolved cache entry and upon mroute resolution from the user space daemon, we attempt to forward the packet. Again we were not resolving to the correct incoming device for a vrf scenario, before calling ip_mr_forward. Fix this by resolving to the correct interface and calling ip_mr_forward with the result. Fixes: e58e41596811 ("net: Enable support for VRF with ipv4 multicast") Signed-off-by: Donald Sharp Acked-by: David Ahern Acked-by: Nikolay Aleksandrov Reviewed-by: Yotam Gigi Signed-off-by: David S. Miller net/ipv4/ipmr.c | 32 +++++++++++++++----------------- 1 file changed, 15 insertions(+), 17 deletions(-) commit 062bb997d290879ea711d149189daf485bd777b3 Merge: 77a6bb5 91828bd Author: David S. Miller Date: Sun Jun 11 16:40:52 2017 -0400 Merge tag 'mlx5-fixes-2017-06-11' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== Mellanox mlx5 fixes 2017-06-11 This series contains some fixes for the mlx5 core and netdev driver. Please pull and let me know if there's any problem. For -stable: ("net/mlx5e: Added BW check for DIM decision mechanism") kernels >= 4.9 ("net/mlx5e: Fix wrong indications in DIM due to counter wraparound") kernels >= 4.9 ("net/mlx5: Remove several module events out of ethtool stats") kernels >= 4.10 ("net/mlx5: Enable 4K UAR only when page size is bigger than 4K") kernels >= 4.11 *all patches apply with no issue on their -stable. ==================== Signed-off-by: David S. Miller commit 77a6bb5ac00dd48934dae0df4a24461cc7893d64 Merge: b87fa0f e7ff7ef Author: David S. Miller Date: Sun Jun 11 16:36:48 2017 -0400 Merge branch 'ena-fixes' Netanel Belgazal says: ==================== Bugs fixes in ena ethernet driver This patchset contains fixes for the bugs that were discovered so far. ==================== Signed-off-by: David S. Miller commit e7ff7efae5708513a795e329909ccbe2ac367b1a Author: Netanel Belgazal Date: Sun Jun 11 15:42:51 2017 +0300 net: ena: update ena driver to version 1.1.7 Signed-off-by: Netanel Belgazal Signed-off-by: David S. Miller drivers/net/ethernet/amazon/ena/ena_netdev.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 800c55cb76be6617232ef50a2be29830f3aa8e5c Author: Netanel Belgazal Date: Sun Jun 11 15:42:50 2017 +0300 net: ena: bug fix in lost tx packets detection mechanism check_for_missing_tx_completions() is called from a timer task and looking for lost tx packets. The old implementation accumulate all the lost tx packets and did not check if those packets were retrieved on a later stage. This cause to a situation where the driver reset the device for no reason. Fixes: 1738cd3ed342 ("Add a driver for Amazon Elastic Network Adapters (ENA)") Signed-off-by: Netanel Belgazal Signed-off-by: David S. Miller drivers/net/ethernet/amazon/ena/ena_ethtool.c | 1 - drivers/net/ethernet/amazon/ena/ena_netdev.c | 66 +++++++++++++++------------ drivers/net/ethernet/amazon/ena/ena_netdev.h | 14 +++++- 3 files changed, 50 insertions(+), 31 deletions(-) commit a2cc5198dac102775b21787752a2e0afe44ad311 Author: Netanel Belgazal Date: Sun Jun 11 15:42:49 2017 +0300 net: ena: disable admin msix while working in polling mode Fixes: 1738cd3ed342 ("Add a driver for Amazon Elastic Network Adapters (ENA)") Signed-off-by: Netanel Belgazal Signed-off-by: David S. Miller drivers/net/ethernet/amazon/ena/ena_com.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit a3af7c18cfe545a711e5df7491b7d6df71eba2ff Author: Netanel Belgazal Date: Sun Jun 11 15:42:48 2017 +0300 net: ena: fix theoretical Rx hang on low memory systems For the rare case where the device runs out of free rx buffer descriptors (in case of pressure on kernel memory), and the napi handler continuously fail to refill new Rx descriptors until device rx queue totally runs out of all free rx buffers to post incoming packet, leading to a deadlock: * The device won't send interrupts since all the new Rx packets will be dropped. * The napi handler won't try to allocate new Rx descriptors since allocation is part of NAPI that's not being invoked any more The fix involves detecting this scenario and rescheduling NAPI (to refill buffers) by the keepalive/watchdog task. Fixes: 1738cd3ed342 ("Add a driver for Amazon Elastic Network Adapters (ENA)") Signed-off-by: Netanel Belgazal Signed-off-by: David S. Miller drivers/net/ethernet/amazon/ena/ena_ethtool.c | 1 + drivers/net/ethernet/amazon/ena/ena_netdev.c | 55 +++++++++++++++++++++++++++ drivers/net/ethernet/amazon/ena/ena_netdev.h | 2 + 3 files changed, 58 insertions(+) commit 0857d92f71b6cb75281fde913554b2d5436c394b Author: Netanel Belgazal Date: Sun Jun 11 15:42:47 2017 +0300 net: ena: add missing unmap bars on device removal This patch also change the mapping functions to devm_ functions Fixes: 1738cd3ed342 ("Add a driver for Amazon Elastic Network Adapters (ENA)") Signed-off-by: Netanel Belgazal Signed-off-by: David S. Miller drivers/net/ethernet/amazon/ena/ena_netdev.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) commit 661d2b0ccef6a63f48b61105cf7be17403d1db01 Author: Netanel Belgazal Date: Sun Jun 11 15:42:46 2017 +0300 net: ena: fix race condition between submit and completion admin command Bug: "Completion context is occupied" error printout will be noticed in dmesg. This error will cause the admin command to fail, which will lead to an ena_probe() failure or a watchdog reset (depends on which admin command failed). Root cause: __ena_com_submit_admin_cmd() is the function that submits new entries to the admin queue. The function have a check that makes sure the queue is not full and the function does not override any outstanding command. It uses head and tail indexes for this check. The head is increased by ena_com_handle_admin_completion() which runs from interrupt context, and the tail index is increased by the submit function (the function is running under ->q_lock, so there is no risk of multithread increment). Each command is associated with a completion context. This context allocated before call to __ena_com_submit_admin_cmd() and freed by ena_com_wait_and_process_admin_cq_interrupts(), right after the command was completed. This can lead to a state where the head was increased, the check passed, but the completion context is still in use. Solution: Use the atomic variable ->outstanding_cmds instead of using the head and the tail indexes. This variable is safe for use since it is bumped in get_comp_ctx() in __ena_com_submit_admin_cmd() and is freed by comp_ctxt_release() Fixes: 1738cd3ed342 ("Add a driver for Amazon Elastic Network Adapters (ENA)") Signed-off-by: Netanel Belgazal Signed-off-by: David S. Miller drivers/net/ethernet/amazon/ena/ena_com.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 2d2c600a917127f16f179d5a88fc44ba3ed263ed Author: Netanel Belgazal Date: Sun Jun 11 15:42:45 2017 +0300 net: ena: add missing return when ena_com_get_io_handlers() fails Fixes: 1738cd3ed342 ("Add a driver for Amazon Elastic Network Adapters (ENA)") Signed-off-by: Netanel Belgazal Signed-off-by: David S. Miller drivers/net/ethernet/amazon/ena/ena_netdev.c | 2 ++ 1 file changed, 2 insertions(+) commit 418df30f7e9e8f4795fb2f3abf9744e5886df5ca Author: Netanel Belgazal Date: Sun Jun 11 15:42:44 2017 +0300 net: ena: fix bug that might cause hang after consecutive open/close interface. Fixing a bug that the driver does not unmask the IO interrupts in ndo_open(): occasionally, the MSI-X interrupt (for one or more IO queues) can be masked when ndo_close() was called. If that is followed by ndo open(), then the MSI-X will be still masked so no interrupt will be received by the driver. Fixes: 1738cd3ed342 ("Add a driver for Amazon Elastic Network Adapters (ENA)") Signed-off-by: Netanel Belgazal Signed-off-by: David S. Miller drivers/net/ethernet/amazon/ena/ena_netdev.c | 41 ++++++++++++++++++---------- 1 file changed, 26 insertions(+), 15 deletions(-) commit a77c1aafcc906f657d1a0890c1d898be9ee1d5c9 Author: Netanel Belgazal Date: Sun Jun 11 15:42:43 2017 +0300 net: ena: fix rare uncompleted admin command false alarm The current flow to detect admin completion is: while (command_not_completed) { if (timeout) error check_for_completion() sleep() } So in case the sleep took more than the timeout (in case the thread/workqueue was not scheduled due to higher priority task or prolonged VMexit), the driver can detect a stall even if the completion is present. The fix changes the order of this function to first check for completion and only after that check if the timeout expired. Fixes: 1738cd3ed342 ("Add a driver for Amazon Elastic Network Adapters (ENA)") Signed-off-by: Netanel Belgazal Signed-off-by: David S. Miller drivers/net/ethernet/amazon/ena/ena_com.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) commit 5ad9345d2321eb1442794098506d136d01cf8345 Merge: 5e38b72 b169c13 Author: Linus Torvalds Date: Sun Jun 11 12:02:01 2017 -0700 Merge tag 'random_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/random Pull randomness fixes from Ted Ts'o: "Improve performance by using a lockless update mechanism suggested by Linus, and make sure we refresh per-CPU entropy returned get_random_* as soon as the CRNG is initialized" * tag 'random_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/random: random: invalidate batched entropy after crng init random: use lockless method of accessing and updating f->reg_idx commit 5e38b72ac1b0000f1d7bd2b62fba7ee9053f5b94 Merge: f986e31 67a7d5f Author: Linus Torvalds Date: Sun Jun 11 11:57:47 2017 -0700 Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 fixes from Ted Ts'o: "Fix various bug fixes in ext4 caused by races and memory allocation failures" * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: fix fdatasync(2) after extent manipulation operations ext4: fix data corruption for mmap writes ext4: fix data corruption with EXT4_GET_BLOCKS_ZERO ext4: fix quota charging for shared xattr blocks ext4: remove redundant check for encrypted file on dio write path ext4: remove unused d_name argument from ext4_search_dir() et al. ext4: fix off-by-one error when writing back pages before dio read ext4: fix off-by-one on max nr_pages in ext4_find_unwritten_pgoff() ext4: keep existing extra fields when inode expands ext4: handle the rest of ext4_mb_load_buddy() ENOMEM errors ext4: fix off-by-in in loop termination in ext4_find_unwritten_pgoff() ext4: fix SEEK_HOLE jbd2: preserve original nofs flag during journal restart ext4: clear lockdep subtype for quota files on quota off commit f986e31bb4d0dba0a10adc51308bf9de2d0e7e4a Merge: 9cd9cb0 fc7a906 Author: Linus Torvalds Date: Sun Jun 11 11:34:27 2017 -0700 Merge tag 'gpio-v4.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO fixes from Linus Walleij: "A few overdue GPIO patches for the v4.12 kernel. - Fix debounce logic on the Aspeed platform. - Fix the "virtual gpio" things on the Intel Crystal Cove. - Fix the blink counter selection on the MVEBU platform" * tag 'gpio-v4.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: gpio: mvebu: fix gpio bank registration when pwm is used gpio: mvebu: fix blink counter register selection MAINTAINERS: remove self from GPIO maintainers gpio: crystalcove: Do not write regular gpio registers for virtual GPIOs gpio: aspeed: Don't attempt to debounce if disabled commit 9cd9cb0ba3e9e55120d25be3a45ffafd299b1b14 Merge: 21c9eb7 ed45509 Author: Linus Torvalds Date: Sun Jun 11 11:29:15 2017 -0700 Merge tag 'char-misc-4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are some small driver fixes for 4.12-rc5. Nothing major here, just some small bugfixes found by people testing, and a MAINTAINERS file update for the genwqe driver. All have been in linux-next with no reported issues" [ The cxl driver fix came in through the powerpc tree earlier ] * tag 'char-misc-4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: cxl: Avoid double free_irq() for psl,slice interrupts mei: make sysfs modalias format similar as uevent modalias drivers: char: mem: Fix wraparound check to allow mappings up to the end MAINTAINERS: Change maintainer of genwqe driver goldfish_pipe: use GFP_ATOMIC under spin lock firmware: vpd: do not leak kobjects firmware: vpd: avoid potential use-after-free when destroying section firmware: vpd: do not leave freed section attributes to the list commit 21c9eb7ca32be43a1c6fcb8194cf2d1aea771772 Merge: 246baac 26f4b1f Author: Linus Torvalds Date: Sun Jun 11 11:25:51 2017 -0700 Merge tag 'staging-4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging/IIO fixes from Greg KH: "These are mostly all IIO driver fixes, resolving a number of tiny issues. There's also a ccree and lustre fix in here as well, both fix problems found in those codebases. All have been in linux-next with no reported issues" * tag 'staging-4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: ccree: fix buffer copy staging/lustre/lov: remove set_fs() call from lov_getstripe() staging: ccree: add CRYPTO dependency iio: adc: sun4i-gpadc-iio: fix parent device being used in devm function iio: light: ltr501 Fix interchanged als/ps register field iio: adc: bcm_iproc_adc: swap primary and secondary isr handler's iio: trigger: fix NULL pointer dereference in iio_trigger_write_current() iio: adc: max9611: Fix attribute measure unit iio: adc: ti_am335x_adc: allocating too much in probe iio: adc: sun4i-gpadc-iio: Fix module autoload when OF devices are registered iio: adc: sun4i-gpadc-iio: Fix module autoload when PLATFORM devices are registered iio: proximity: as3935: fix iio_trigger_poll issue iio: proximity: as3935: fix AS3935_INT mask iio: adc: Max9611: checking for ERR_PTR instead of NULL in probe iio: proximity: as3935: recalibrate RCO after resume commit 246baac2fd2917259ba5dd34f3be7d6d195cbeb8 Merge: ef918d3 29532e7 Author: Linus Torvalds Date: Sun Jun 11 11:23:10 2017 -0700 Merge tag 'usb-4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some small USB fixes for 4.12-rc5 They are for some reported issues in the chipidea and gadget drivers. Nothing major. All have been in linux-next for a while with no reported issues" * tag 'usb-4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: gadget: udc: renesas_usb3: Fix PN_INT_ENA disabling timing usb: gadget: udc: renesas_usb3: lock for PN_ registers access usb: gadget: udc: renesas_usb3: fix deadlock by spinlock usb: gadget: udc: renesas_usb3: fix pm_runtime functions calling usb: gadget: f_mass_storage: Serialize wake and sleep execution usb: dwc2: add support for the DWC2 controller on Meson8 SoCs phy: qualcomm: phy-qcom-qmp: fix application of sizeof to pointer usb: musb: dsps: keep VBUS on for host-only mode usb: chipidea: core: check before accessing ci_role in ci_role_show usb: chipidea: debug: check before accessing ci_role phy: qcom-qmp: fix return value check in qcom_qmp_phy_create() usb: chipidea: udc: fix NULL pointer dereference if udc_start failed usb: chipidea: imx: Do not access CLKONOFF on i.MX51 commit ef918d3c80f5e2c42076f2b23c7ec4767b5ec925 Merge: 8f56821 e0f8e8c Author: Linus Torvalds Date: Sun Jun 11 11:21:08 2017 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "This is a set of user visible fixes (excepting one format string change). Four of the qla2xxx fixes only affect the firmware dump path, but it's still important to the enterprise. The rest are various NULL pointer crash conditions or outright driver hangs" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: cxgb4i: libcxgbi: in error case RST tcp conn scsi: scsi_debug: Avoid PI being disabled when TPGS is enabled scsi: qla2xxx: Fix extraneous ref on sp's after adapter break scsi: lpfc: prevent potential null pointer dereference scsi: lpfc: Avoid NULL pointer dereference in lpfc_els_abort() scsi: lpfc: nvmet_fc: fix format string scsi: qla2xxx: Fix crash due to NULL pointer dereference of ctx scsi: qla2xxx: Fix mailbox pointer error in fwdump capture scsi: qla2xxx: Set bit 15 for DIAG_ECHO_TEST MBC scsi: qla2xxx: Modify T262 FW dump template to specify same start/end to debug customer issues scsi: qla2xxx: Fix crash due to mismatch mumber of Q-pair creation for Multi queue scsi: qla2xxx: Fix NULL pointer access due to redundant fc_host_port_name call scsi: qla2xxx: Fix recursive loop during target mode configuration for ISP25XX leaving system unresponsive scsi: bnx2fc: fix race condition in bnx2fc_get_host_stats() scsi: qla2xxx: don't disable a not previously enabled PCI device commit 8f56821d1db34b980ebe027a1b6fff2233471062 Merge: 9d66af6 b9d39d1 Author: Linus Torvalds Date: Sun Jun 11 11:15:09 2017 -0700 Merge branch 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm fix from Dan Williams: "We expanded the device-dax fs type in 4.12 to be a generic provider of a struct dax_device with an embedded inode. However, Sasha found some basic negative testing was not run to verify that this fs cleanly handles being mounted directly. Note that the fresh rebase was done to remove an unnecessary Cc: tag, but this commit otherwise had a build success notification from the 0day robot." * 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: device-dax: fix 'dax' device filesystem inode destruction crash commit 9d66af6bbf94d520e65e58a98543f67693ea4145 Merge: 9d0eb46 4d801cc Author: Linus Torvalds Date: Sun Jun 11 11:09:15 2017 -0700 Merge tag 'hexagon-for-linus-v4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hexagon fix from Guenter Roeck: "This fixes a build error seen when building hexagon images. Richard sent me an Ack, but didn't reply when asked if he wants me to send the patch to you directly, so I figured I'd just do it" * tag 'hexagon-for-linus-v4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hexagon: Use raw_copy_to_user commit 9d0eb4624601ac978b9e89be4aeadbd51ab2c830 Merge: 5faab9e 9bc1f09 Author: Linus Torvalds Date: Sun Jun 11 11:07:25 2017 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM fixes from Paolo Bonzini: "Bug fixes (ARM, s390, x86)" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: async_pf: avoid async pf injection when in guest mode KVM: cpuid: Fix read/write out-of-bounds vulnerability in cpuid emulation arm: KVM: Allow unaligned accesses at HYP arm64: KVM: Allow unaligned accesses at EL2 arm64: KVM: Preserve RES1 bits in SCTLR_EL2 KVM: arm/arm64: Handle possible NULL stage2 pud when ageing pages KVM: nVMX: Fix exception injection kvm: async_pf: fix rcu_irq_enter() with irqs enabled KVM: arm/arm64: vgic-v3: Fix nr_pre_bits bitfield extraction KVM: s390: fix ais handling vs cpu model KVM: arm/arm64: Fix isues with GICv2 on GICv3 migration commit 103a07d4278203d6299798cd74cdc4d209801cac Author: Martin Blumenstingl Date: Sun Jun 4 15:28:23 2017 +0200 iio: adc: meson-saradc: fix potential crash in meson_sar_adc_clear_fifo meson_sar_adc_clear_fifo passes a 0 as value-pointer to regmap_read(). In case of the meson-saradc driver this ends up in regmap_mmio_read(), where the value-pointer is de-referenced unconditionally to assign the value which was read. Fix this by passing an actual pointer, even though all we want to do is to discard the value. As a side-effect this fixes a sparse warning ("Using plain integer as NULL pointer") as reported by Paolo Cretaro. Fixes: 3adbf3427330 ("iio: adc: add a driver for the SAR ADC found in Amlogic Meson SoCs") Reported-by: Paolo Cretaro Signed-off-by: Martin Blumenstingl Cc: Signed-off-by: Jonathan Cameron drivers/iio/adc/meson_saradc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 91828bd89940e8145f91751a015bc11bc486aad0 Author: Majd Dibbiny Date: Sun May 28 14:47:56 2017 +0300 net/mlx5: Enable 4K UAR only when page size is bigger than 4K When the page size isn't bigger than 4K, there is no added value of enabling 4K UAR feature in the Firmware. Modified the condition of enabling the 4K UAR accordingly. Fixes: f502d834950a ("net/mlx5: Activate support for 4K UARs") Signed-off-by: Majd Dibbiny Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 53acd76ce571e3b71f9205f2d49ab285a9f1aad8 Author: Tal Gilboa Date: Mon May 29 17:02:55 2017 +0300 net/mlx5e: Fix wrong indications in DIM due to counter wraparound DIM (Dynamically-tuned Interrupt Moderation) is a mechanism designed for changing the channel interrupt moderation values in order to reduce CPU overhead for all traffic types. Each iteration of the algorithm, DIM calculates the difference in throughput, packet rate and interrupt rate from last iteration in order to make a decision. DIM relies on counters for each metric. When these counters get to their type's max value they wraparound. In this case the delta between 'end' and 'start' samples is negative and when translated to unsigned integers - very high. This results in a false indication to the algorithm and might result in a wrong decision. The fix calculates the 'distance' between 'end' and 'start' samples in a cyclic way around the relevant type's max value. It can also be viewed as an absolute value around the type's max value instead of around 0. Testing show higher stability in DIM profile selection and no wraparound issues. Fixes: cb3c7fd4f839 ("net/mlx5e: Support adaptive RX coalescing") Signed-off-by: Tal Gilboa Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en.h | 8 ++++---- drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c | 10 +++++++--- 2 files changed, 11 insertions(+), 7 deletions(-) commit c3164d2fc48fd4fa0477ab658b644559c3fe9073 Author: Tal Gilboa Date: Mon May 15 14:13:16 2017 +0300 net/mlx5e: Added BW check for DIM decision mechanism DIM (Dynamically-tuned Interrupt Moderation) is a mechanism designed for changing the channel interrupt moderation values in order to reduce CPU overhead for all traffic types. Until now only interrupt and packet rate were sampled. We found a scenario on which we get a false indication since a change in DIM caused more aggregation and reduced packet rate while increasing BW. We now regard a change as succesfull iff: current_BW > (prev_BW + threshold) or current_BW ~= prev_BW and current_PR > (prev_PR + threshold) or current_BW ~= prev_BW and current_PR ~= prev_PR and current_IR < (prev_IR - threshold) Where BW = Bandwidth, PR = Packet rate and IR = Interrupt rate Improvements (ConnectX-4Lx 25GbE, single RX queue, LRO off) -------------------------------------------------- packet size | before[Mb/s] | after[Mb/s] | gain | 2B | 343.4 | 359.4 | 4.5% | 16B | 2739.7 | 2814.8 | 2.7% | 64B | 9739 | 10185.3 | 4.5% | Fixes: cb3c7fd4f839 ("net/mlx5e: Support adaptive RX coalescing") Signed-off-by: Tal Gilboa Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en.h | 2 ++ drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c | 37 ++++++++++++---------- 2 files changed, 22 insertions(+), 17 deletions(-) commit f729860a177d097ac44321fb2f7d927a0c54c5a3 Author: Huy Nguyen Date: Mon May 8 11:46:50 2017 -0500 net/mlx5: Remove several module events out of ethtool stats Remove the following module event counters out of ethtool stats. The reason for removing these event counters is that these events do not occur without techinician's intervention. module_pwr_budget_exd module_long_range module_no_eeprom module_enforce_part module_unknown_id module_unknown_status module_plug Fixes: bedb7c909c19 ("net/mlx5e: Add port module event counters to ethtool stats") Signed-off-by: Huy Nguyen Reviewed by: Gal Pressman Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_stats.h | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) commit 3fece5d676939f42f434c63dfe1bd42d7d94e6f0 Author: Mohamad Haj Yahia Date: Sun Apr 9 17:19:37 2017 +0300 net/mlx5: Continue health polling until it is explicitly stopped The issue is that when we get an assert we will stop polling the health and thus we cant enter error state when we have a real health issue. Fixes: fd76ee4da55a ('net/mlx5_core: Fix internal error detection conditions') Signed-off-by: Mohamad Haj Yahia Reviewed-by: Daniel Jurgens Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/health.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) commit 57f35c93a2072c1f66ab1728a77a9ee4bc33bf42 Author: Mohamad Haj Yahia Date: Thu May 25 16:46:14 2017 +0300 net/mlx5: Fix create vport flow table flow Send vport number to the create flow table inner method instead of ignoring the vport argument and sending always 0. Fixes: b3ba51498bdd ('net/mlx5: Refactor create flow table method to accept underlay QP') Signed-off-by: Mohamad Haj Yahia Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 252d2a4117bc181b287eeddf848863788da733ae Author: Andy Lutomirski Date: Fri Jun 9 11:49:15 2017 -0700 sched/core: Idle_task_exit() shouldn't use switch_mm_irqs_off() idle_task_exit() can be called with IRQs on x86 on and therefore should use switch_mm(), not switch_mm_irqs_off(). This doesn't seem to cause any problems right now, but it will confuse my upcoming TLB flush changes. Nonetheless, I think it should be backported because it's trivial. There won't be any meaningful performance impact because idle_task_exit() is only used when offlining a CPU. Signed-off-by: Andy Lutomirski Cc: Borislav Petkov Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: stable@vger.kernel.org Fixes: f98db6013c55 ("sched/core: Add switch_mm_irqs_off() and use it in the scheduler") Link: http://lkml.kernel.org/r/ca3d1a9fa93a0b49f5a8ff729eda3640fb6abdf9.1497034141.git.luto@kernel.org Signed-off-by: Ingo Molnar kernel/sched/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f67abed585efe251edda52dc9690020d6441890f Author: Marcin Nowakowski Date: Fri Jun 9 10:00:29 2017 +0200 sched/fair: Fix typo in printk message 'schedstats' kernel parameter should be set to enable/disable, so correct the printk hint saying that it should be set to 'enable' rather than 'enabled' to enable scheduler tracepoints. Signed-off-by: Marcin Nowakowski Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/1496995229-31245-1-git-send-email-marcin.nowakowski@imgtec.com Signed-off-by: Ingo Molnar kernel/sched/fair.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9bc1f09f6fa76fdf31eb7d6a4a4df43574725f93 Author: Wanpeng Li Date: Thu Jun 8 20:13:40 2017 -0700 KVM: async_pf: avoid async pf injection when in guest mode INFO: task gnome-terminal-:1734 blocked for more than 120 seconds. Not tainted 4.12.0-rc4+ #8 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. gnome-terminal- D 0 1734 1015 0x00000000 Call Trace: __schedule+0x3cd/0xb30 schedule+0x40/0x90 kvm_async_pf_task_wait+0x1cc/0x270 ? __vfs_read+0x37/0x150 ? prepare_to_swait+0x22/0x70 do_async_page_fault+0x77/0xb0 ? do_async_page_fault+0x77/0xb0 async_page_fault+0x28/0x30 This is triggered by running both win7 and win2016 on L1 KVM simultaneously, and then gives stress to memory on L1, I can observed this hang on L1 when at least ~70% swap area is occupied on L0. This is due to async pf was injected to L2 which should be injected to L1, L2 guest starts receiving pagefault w/ bogus %cr2(apf token from the host actually), and L1 guest starts accumulating tasks stuck in D state in kvm_async_pf_task_wait() since missing PAGE_READY async_pfs. This patch fixes the hang by doing async pf when executing L1 guest. Cc: Paolo Bonzini Cc: Radim Krčmář Cc: stable@vger.kernel.org Signed-off-by: Wanpeng Li Signed-off-by: Paolo Bonzini arch/x86/kvm/mmu.c | 7 +++++-- arch/x86/kvm/mmu.h | 1 + arch/x86/kvm/x86.c | 3 +-- 3 files changed, 7 insertions(+), 4 deletions(-) commit 4d801cca0bb7011699c2d29f0139902dcfb3482d Author: Guenter Roeck Date: Tue May 2 20:44:16 2017 -0700 hexagon: Use raw_copy_to_user Commit ac4691fac8ad ("hexagon: switch to RAW_COPY_USER") replaced __copy_to_user_hexagon() with raw_copy_to_user(), but did not catch all callers, resulting in the following build error. arch/hexagon/mm/uaccess.c: In function '__clear_user_hexagon': arch/hexagon/mm/uaccess.c:40:3: error: implicit declaration of function '__copy_to_user_hexagon' Fixes: ac4691fac8ad ("hexagon: switch to RAW_COPY_USER") Cc: Al Viro Acked-by: Al Viro Acked-by: Richard Kuo Signed-off-by: Guenter Roeck arch/hexagon/mm/uaccess.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit b87fa0fafef4b16495740432f4eb8262efa500d0 Merge: 343eba6 a704bb5 Author: David S. Miller Date: Sat Jun 10 18:22:56 2017 -0400 Merge branch 'mvpp2-fixes' Thomas Petazzoni says: ==================== net: mvpp2: driver fixes As requested, here is a series of patches containing only bug fixes for the mvpp2 driver. It is based on the latest "net" branch. Changes since v1: - Fixed a build breakage that occurred when only PATCH 1 was only, and not later patches in the series. Was reported by the kbuild report on the first submission. - Added Tested-by from Marc Zyngier on PATCH 2. ==================== Signed-off-by: David S. Miller commit a704bb5c052bbd6b77c6530a2e83cef42486e335 Author: Thomas Petazzoni Date: Sat Jun 10 23:18:22 2017 +0200 net: mvpp2: use {get, put}_cpu() instead of smp_processor_id() smp_processor_id() should not be used in migration-enabled contexts. We originally thought it was OK in the specific situation of this driver, but it was wrong, and calling smp_processor_id() in a migration-enabled context prints a big fat warning when CONFIG_DEBUG_PREEMPT=y. Therefore, this commit replaces the smp_processor_id() in migration-enabled contexts by the appropriate get_cpu/put_cpu sections. Reported-by: Marc Zyngier Fixes: a786841df72e ("net: mvpp2: handle register mapping and access for PPv2.2") Signed-off-by: Thomas Petazzoni Tested-by: Marc Zyngier Signed-off-by: David S. Miller drivers/net/ethernet/marvell/mvpp2.c | 27 +++++++++++++++++++-------- 1 file changed, 19 insertions(+), 8 deletions(-) commit 56b8aae959499508090b2d2db6961ed905f38164 Author: Thomas Petazzoni Date: Sat Jun 10 23:18:21 2017 +0200 net: mvpp2: remove mvpp2_bm_cookie_{build,pool_get} This commit removes the useless remove mvpp2_bm_cookie_{build,pool_get} functions. All what mvpp2_bm_cookie_build() was doing is compute a 32-bit value by concatenating the pool number and the CPU number... only to get the pool number re-extracted by mvpp2_bm_cookie_pool_get() later on. Instead, just get the pool number directly from RX descriptor status, and pass it to mvpp2_pool_refill() and mvpp2_rx_refill(). This has the added benefit of dropping a smp_processor_id() call in a migration-enabled context, which is wrong, and is the original motivation for making this change. Fixes: 3f518509dedc9 ("ethernet: Add new driver for Marvell Armada 375 network unit") Signed-off-by: Thomas Petazzoni Signed-off-by: David S. Miller drivers/net/ethernet/marvell/mvpp2.c | 47 +++++++++++------------------------- 1 file changed, 14 insertions(+), 33 deletions(-) commit 343eba69c6968190d8654b857aea952fed9a6749 Author: Jia-Ju Bai Date: Sat Jun 10 17:03:35 2017 +0800 net: tipc: Fix a sleep-in-atomic bug in tipc_msg_reverse The kernel may sleep under a rcu read lock in tipc_msg_reverse, and the function call path is: tipc_l2_rcv_msg (acquire the lock by rcu_read_lock) tipc_rcv tipc_sk_rcv tipc_msg_reverse pskb_expand_head(GFP_KERNEL) --> may sleep tipc_node_broadcast tipc_node_xmit_skb tipc_node_xmit tipc_sk_rcv tipc_msg_reverse pskb_expand_head(GFP_KERNEL) --> may sleep To fix it, "GFP_KERNEL" is replaced with "GFP_ATOMIC". Signed-off-by: Jia-Ju Bai Signed-off-by: David S. Miller net/tipc/msg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f146e872eb12ebbe92d8e583b2637e0741440db3 Author: Jia-Ju Bai Date: Sat Jun 10 16:49:39 2017 +0800 net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx The kernel may sleep under a rcu read lock in cfpkt_create_pfx, and the function call path is: cfcnfg_linkup_rsp (acquire the lock by rcu_read_lock) cfctrl_linkdown_req cfpkt_create cfpkt_create_pfx alloc_skb(GFP_KERNEL) --> may sleep cfserl_receive (acquire the lock by rcu_read_lock) cfpkt_split cfpkt_create_pfx alloc_skb(GFP_KERNEL) --> may sleep There is "in_interrupt" in cfpkt_create_pfx to decide use "GFP_KERNEL" or "GFP_ATOMIC". In this situation, "GFP_KERNEL" is used because the function is called under a rcu read lock, instead in interrupt. To fix it, only "GFP_ATOMIC" is used in cfpkt_create_pfx. Signed-off-by: Jia-Ju Bai Signed-off-by: David S. Miller net/caif/cfpkt_skbuff.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) commit 5aa32f53ab93175442dffbd95a231d0798cab4d1 Author: David S. Miller Date: Sat Jun 10 16:44:28 2017 -0400 Revert "net: fec: Add a fec_enet_clear_ethtool_stats() stub for CONFIG_M5272" This reverts commit bf292f1b2c813f1d6ac49b04bd1a9863d8314266. It belongs in 'net-next' not 'net'. Signed-off-by: David S. Miller drivers/net/ethernet/freescale/fec_main.c | 4 ---- 1 file changed, 4 deletions(-) commit 581409dacc9176b0de1f6c4ca8d66e13aa8e1b29 Author: Xin Long Date: Sat Jun 10 14:48:14 2017 +0800 sctp: disable BH in sctp_for_each_endpoint Now sctp holds read_lock when foreach sctp_ep_hashtable without disabling BH. If CPU schedules to another thread A at this moment, the thread A may be trying to hold the write_lock with disabling BH. As BH is disabled and CPU cannot schedule back to the thread holding the read_lock, while the thread A keeps waiting for the read_lock. A dead lock would be triggered by this. This patch is to fix this dead lock by calling read_lock_bh instead to disable BH when holding the read_lock in sctp_for_each_endpoint. Fixes: 626d16f50f39 ("sctp: export some apis or variables for sctp_diag and reuse some for proc") Reported-by: Xiumei Mu Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller net/sctp/socket.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit bf292f1b2c813f1d6ac49b04bd1a9863d8314266 Author: Fabio Estevam Date: Fri Jun 9 22:37:22 2017 -0300 net: fec: Add a fec_enet_clear_ethtool_stats() stub for CONFIG_M5272 Commit 2b30842b23b9 ("net: fec: Clear and enable MIB counters on imx51") introduced fec_enet_clear_ethtool_stats(), but missed to add a stub for the CONFIG_M5272=y case, causing build failure for the m5272c3_defconfig. Add the missing empty stub to fix the build failure. Reported-by: Paul Gortmaker Signed-off-by: Fabio Estevam Signed-off-by: David S. Miller drivers/net/ethernet/freescale/fec_main.c | 4 ++++ 1 file changed, 4 insertions(+) commit 9b3dc0a17d7388c4fb83736ca45253a93e994ce4 Author: Dominik Heidler Date: Fri Jun 9 16:29:47 2017 +0200 l2tp: cast l2tp traffic counter to unsigned This fixes a counter problem on 32bit systems: When the rx_bytes counter reached 2 GiB, it jumpd to (2^64 Bytes - 2GiB) Bytes. rtnl_link_stats64 has __u64 type and atomic_long_read returns atomic_long_t which is signed. Due to the conversation we get an incorrect value on 32bit systems if the MSB of the atomic_long_t value is set. CC: Tom Parkin Fixes: 7b7c0719cd7a ("l2tp: avoid deadlock in l2tp stats update") Signed-off-by: Dominik Heidler Signed-off-by: David S. Miller net/l2tp/l2tp_eth.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) commit d8dba51de5dfb55225b169653bbd7379ac0d0c63 Author: Philippe Reynes Date: Fri Jun 9 23:50:57 2017 +0200 net: aquantia: atlantic: remove declaration of hw_atl_utils_hw_set_power This function is not defined, so no need to declare it. As I don't have the hardware, I'd be very pleased if someone may test this patch. Signed-off-by: Philippe Reynes Signed-off-by: David S. Miller drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.h | 3 --- 1 file changed, 3 deletions(-) commit d9a8d6a1023bb82ceadbd65f7cc54beb747fbfec Merge: f6d4c71 3523882 Author: David S. Miller Date: Sat Jun 10 16:02:56 2017 -0400 Merge branch 'bnx2x-Fix-malicious-VFs-indication' Yuval Mintz says: ==================== bnx2x: Fix malicious VFs indication It was discovered that for a VF there's a simple [yet uncommon] scenario which would cause device firmware to declare that VF as malicious - Add a vlan interface on top of a VF and disable txvlan offloading for that VF [causing VF to transmit packets where vlan is on payload]. Patch #1 corrects driver transmission to prevent this issue. Patch #2 is a by-product correcting PF behavior once a VF is declared malicious. ==================== Signed-off-by: David S. Miller commit 3523882229b903e967de05665b871dab87c5df0f Author: Mintz, Yuval Date: Fri Jun 9 17:17:02 2017 +0300 bnx2x: Don't post statistics to malicious VFs Once firmware indicates that a given VF is malicious and until that VF passes an FLR all bets are off - PF can't know anything is happening to the VF [since VF can't communicate anything to its PF]. But PF is currently still periodically asking device to collect statistics for the VF which might in turn fill logs by IOMMU blocking memory access done by the VF's PCI function [in the case VF has unmapped its buffers]. Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c | 13 ++++++++++++- drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h | 1 + 2 files changed, 13 insertions(+), 1 deletion(-) commit 92f85f05caa51d844af6ea14ffbc7a786446a644 Author: Mintz, Yuval Date: Fri Jun 9 17:17:01 2017 +0300 bnx2x: Allow vfs to disable txvlan offload VF clients are configured as enforced, meaning firmware is validating the correctness of their ethertype/vid during transmission. Once txvlan is disabled, VF would start getting SKBs for transmission here vlan is on the payload - but it'll pass the packet's ethertype instead of the vid, leading to firmware declaring it as malicious. Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) commit 5faab9e0f03c4eef97886b45436015e107f79f5f Merge: 66cea28 67a7001 Author: Linus Torvalds Date: Sat Jun 10 11:09:23 2017 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull UFS fixes from Al Viro: "This is just the obvious backport fodder; I'm pretty sure that there will be more - definitely so wrt performance and quite possibly correctness as well" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: ufs: we need to sync inode before freeing it excessive checks in ufs_write_failed() and ufs_evict_inode() ufs_getfrag_block(): we only grab ->truncate_mutex on block creation path ufs_extend_tail(): fix the braino in calling conventions of ufs_new_fragments() ufs: set correct ->s_maxsize ufs: restore maintaining ->i_blocks fix ufs_isblockset() ufs: restore proper tail allocation commit 66cea28a947739343ba3f804641de5cdf388cffa Merge: ac1a14a 70e7af2 Author: Linus Torvalds Date: Sat Jun 10 11:06:05 2017 -0700 Merge branch 'for-linus-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs Pull btrfs fixes from Chris Mason: "Some fixes that Dave Sterba collected. We've been hitting an early enospc problem on production machines that Omar tracked down to an old int->u64 mistake. I waited a bit on this pull to make sure it was really the problem from production, but it's on ~2100 hosts now and I think we're good. Omar also noticed a commit in the queue would make new early ENOSPC problems. I pulled that out for now, which is why the top three commits are younger than the rest. Otherwise these are all fixes, some explaining very old bugs that we've been poking at for a while" * 'for-linus-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs: Btrfs: fix delalloc accounting leak caused by u32 overflow Btrfs: clear EXTENT_DEFRAG bits in finish_ordered_io btrfs: tree-log.c: Wrong printk information about namelen btrfs: fix race with relocation recovery and fs_root setup btrfs: fix memory leak in update_space_info failure path btrfs: use correct types for page indices in btrfs_page_exists_in_range btrfs: fix incorrect error return ret being passed to mapping_set_error btrfs: Make flush bios explicitely sync btrfs: fiemap: Cache and merge fiemap extent before submit it to user commit ac1a14a239bb1a871dbd20daea4946aa5d289a1d Merge: 45b44f0 5b0bc9a Author: Linus Torvalds Date: Sat Jun 10 10:51:25 2017 -0700 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "Misc fixes: a Geode fix plus a microcode loader fix" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/microcode/intel: Clear patch pointer before jettisoning the initrd x86/cpu/cyrix: Add alternative Device ID of Geode GX1 SoC commit 45b44f0f287d6d396b78466e13be1d1ea3d3097b Merge: 6b7ed45 40da1b1 Author: Linus Torvalds Date: Sat Jun 10 10:49:42 2017 -0700 Merge branch 'smp-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull CPU hotplug fix from Ingo Molnar: "An error handling corner case fix" * 'smp-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: cpu/hotplug: Drop the device lock on error commit 6b7ed4588ce681222534f901ce825d1ead31882a Merge: f701d86 8affb06 Author: Linus Torvalds Date: Sat Jun 10 10:22:35 2017 -0700 Merge branch 'rcu-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull RCU fixes from Ingo Molnar: "Fix an SRCU bug affecting KVM IRQ injection" * 'rcu-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: srcu: Allow use of Classic SRCU from both process and interrupt context srcu: Allow use of Tiny/Tree SRCU from both process and interrupt context commit f701d860af381265639244fb84b07797fbb5efca Merge: 9376906 47c1ded Author: Linus Torvalds Date: Sat Jun 10 10:15:47 2017 -0700 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Ingo Molnar: "This is mostly tooling fixes, plus an instruction pointer filtering fix. It's more fixes than usual - Arnaldo got back from a longer vacation and there was a backlog" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (27 commits) perf symbols: Kill dso__build_id_is_kmod() perf symbols: Keep DSO->symtab_type after decompress perf tests: Decompress kernel module before objdump perf tools: Consolidate error path in __open_dso() perf tools: Decompress kernel module when reading DSO data perf annotate: Use dso__decompress_kmodule_path() perf tools: Introduce dso__decompress_kmodule_{fd,path} perf tools: Fix a memory leak in __open_dso() perf annotate: Fix symbolic link of build-id cache perf/core: Drop kernel samples even though :u is specified perf script python: Remove dups in documentation examples perf script python: Updated trace_unhandled() signature perf script python: Fix wrong code snippets in documentation perf script: Fix documentation errors perf script: Fix outdated comment for perf-trace-python perf probe: Fix examples section of documentation perf report: Ensure the perf DSO mapping matches what libdw sees perf report: Include partial stacks unwound with libdw perf annotate: Add missing powerpc triplet perf test: Disable breakpoint signal tests for powerpc ... commit 9376906c17fa975bf6a7ea9dd124be697bcda289 Merge: 179145e 792ef14 Author: Linus Torvalds Date: Sat Jun 10 10:12:14 2017 -0700 Merge branch 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull EFI fix from Ingo Molnar: "A boot crash fix for certain systems where the kernel would trust a piece of firmware data it should not have" * 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: efi: Fix boot panic because of invalid BGRT image address commit 67a70017fa0a152657bc7e337e69bb9c9f5549bf Author: Al Viro Date: Sat Jun 10 12:01:50 2017 -0400 ufs: we need to sync inode before freeing it Signed-off-by: Al Viro fs/ufs/inode.c | 1 + 1 file changed, 1 insertion(+) commit 179145e6312b1ccb1731841360d7fcaf2f4abc7a Merge: c7a1aef d3e01c5 Author: Linus Torvalds Date: Fri Jun 9 22:30:55 2017 -0700 Merge tag 'iommu-fixes-v4.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull IOMMU fixes from Joerg Roedel: - another compile-fix for my header cleanup - a couple of fixes for the recently merged IOMMU probe deferal code - fixes for ACPI/IORT code necessary with IOMMU probe deferal * tag 'iommu-fixes-v4.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: arm: dma-mapping: Reset the device's dma_ops ACPI/IORT: Move the check to get iommu_ops from translated fwspec ARM: dma-mapping: Don't tear down third-party mappings ACPI/IORT: Ignore all errors except EPROBE_DEFER iommu/of: Ignore all errors except EPROBE_DEFER iommu/of: Fix check for returning EPROBE_DEFER iommu/dma: Fix function declaration commit c7a1aefc47cc17b754180a18f77f508f2f210d2c Merge: 2833b7e a0897d5 Author: Linus Torvalds Date: Fri Jun 9 22:28:33 2017 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - mark "guest" RMI device as pass-through port to avoid "phantom" ALPS toouchpad on newer Lenovo Carbons - add two more laptops to the Elantech's lists of devices using CRC mode * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: synaptics-rmi4 - register F03 port as pass-through serio Input: elantech - add Fujitsu Lifebook E546/E557 to force crc_enabled commit 2833b7e913327855c2c0c842c37ca1d90602139e Merge: 42211f6 a415c0f Author: Linus Torvalds Date: Fri Jun 9 22:24:23 2017 -0700 Merge tag 'md/4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md Pull MD bugfix from Shaohua Li: "One bug fix from Neil Brown for MD. The bug was introduced in this cycle" * tag 'md/4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md: md: initialise ->writes_pending in personality modules. commit 42211f6cb6d7c3a39fe9b2892a93e4c065149d5f Merge: 39e4edf 8f9bebc Author: Linus Torvalds Date: Fri Jun 9 22:18:41 2017 -0700 Merge branch 'for-linus' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "A set of fixes in the area of block IO, that should go into the next -rc release. This contains: - An OOPS fix from Dmitry, fixing a regression with the bio integrity code in this series. - Fix truncation of elevator io context cache name, from Eric Biggers. - NVMe pull from Christoph includes FC fixes from James, APST fixes/tweaks from Kai-Heng, removal fix from Rakesh, and an RDMA fix from Sagi. - Two tweaks for the block throttling code. One from Joseph Qi, fixing an oops from the timer code, and one from Shaohua, improving the behavior on rotatonal storage. - Two blk-mq fixes from Ming, fixing corner cases with the direct issue code. - Locking fix for bfq cgroups from Paolo" * 'for-linus' of git://git.kernel.dk/linux-block: block, bfq: access and cache blkg data only when safe Fix loop device flush before configure v3 blk-throttle: set default latency baseline for harddisk blk-throttle: fix NULL pointer dereference in throtl_schedule_pending_timer nvme: relax APST default max latency to 100ms nvme: only consider exit latency when choosing useful non-op power states nvme-fc: fix missing put reference on controller create failure nvme-fc: on lldd/transport io error, terminate association nvme-rdma: fast fail incoming requests while we reconnect nvme-pci: fix multiple ctrl removal scheduling nvme: fix hang in remove path elevator: fix truncation of icq_cache_name blk-mq: fix direct issue blk-mq: pass correct hctx to blk_mq_try_issue_directly bio-integrity: Do not allocate integrity context for bio w/o data commit 39e4edfdf5016bb28438093d030a0ef90ce2d30a Merge: 6107cc5 ba3021b Author: Linus Torvalds Date: Fri Jun 9 22:15:08 2017 -0700 Merge tag 'sound-4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "This update contains a slightly hight amount of changes due to the pending ASoC fixes: - ALSA timer core got a couple of fixes for races between read and ioctl, leading to potential read of uninitialized kmalloced memory - ASoC core fixed the de-registration pattern for use-after-free bug - The rewrite of probe code in ASoC Intel Skylake for i915 component - ASoC R-snd got a series of fixes for SSI - ASoC simple-card, atmel, da7213, and rt286 trivial fixes - HD-audio ALC269 quirk and rearrangement of quirk table" * tag 'sound-4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: timer: Fix missing queue indices reset at SNDRV_TIMER_IOCTL_SELECT ALSA: timer: Fix race between read and ioctl ALSA: hda/realtek - Reorder ALC269 ASUS quirk entries ALSA: hda/realtek: Fix mic and headset jack sense on Asus X705UD ASoC: rsnd: fixup parent_clk_name of AUDIO_CLKOUTx ASoC: Intel: Skylake: Fix to parse consecutive string tkns in manifest ASoC: Intel: Skylake: Fix IPC rx_list corruption ASoC: rsnd: SSI PIO adjust to 24bit mode MAINTAINERS: Update email address for patches to Wolfson parts ASoC: Fix use-after-free at card unregistration ASoC: simple-card: fix mic jack initialization ASoC: rsnd: don't call free_irq() on Parent SSI ASoC: atmel-classd: sync regcache when resuming ASoC: rsnd: don't use PDTA bit for 24bit on SSI ASoC: da7213: Fix incorrect usage of bitwise '&' operator for SRM check rt286: add Thinkpad Helix 2 to force_combo_jack_table ASoC: Intel: Skylake: Move i915 registration to worker thread commit 6107cc58f33c0581d4bbd847ed9145b76e61d57c Merge: eb4125d 6e88007 Author: Linus Torvalds Date: Fri Jun 9 22:12:06 2017 -0700 Merge tag 'drm-fixes-for-v4.12-rc5' of git://people.freedesktop.org/~airlied/linux Pull drm fixes from Dave Airlie: "Intel, nouveau, rockchip, vmwgfx, imx, meson, mediatek and core fixes. Bit more spread out fixes this time, fixes for 7 drivers + a couple of core fixes. i915 and vmwgfx are the main ones. The vmwgfx ones fix a bunch of regressions in their atomic rework, and a few fixes destined for stable. i915 has some 4.12 regressions and older things that need to be fixed in stable as well. nouveau also has some runtime pm fixes and a timer list handling fix, otherwise a couple of core and small driver regression fixes" * tag 'drm-fixes-for-v4.12-rc5' of git://people.freedesktop.org/~airlied/linux: (37 commits) drm/i915: fix warning for unused variable drm/meson: Fix driver bind when only CVBS is available drm/i915: Fix 90/270 rotated coordinates for FBC drm/i915: Restore has_fbc=1 for ILK-M drm/i915: Workaround VLV/CHV DSI scanline counter hardware fail drm/i915: Fix logical inversion for gen4 quirking drm/i915: Guard against i915_ggtt_disable_guc() being invoked unconditionally drm/i915: Always recompute watermarks when distrust_bios_wm is set, v2. drm/i915: Prevent the system suspend complete optimization drm/i915/psr: disable psr2 for resolution greater than 32X20 drm/i915: Hold a wakeref for probing the ring registers drm/i915: Short-circuit i915_gem_wait_for_idle() if already idle drm/i915: Disable decoupled MMIO drm/i915/guc: Remove stale comment for q_fail drm/vmwgfx: Bump driver minor and date drm/vmwgfx: Remove unused legacy cursor functions drm/vmwgfx: fix spelling mistake "exeeds" -> "exceeds" drm/vmwgfx: Fix large topology crash drm/vmwgfx: Make sure to update STDU when FB is updated drm/vmwgfx: Make sure backup_handle is always valid ... commit babef37dccbaa49249a22bae9150686815d7be71 Author: Al Viro Date: Fri Jun 9 16:20:34 2017 -0400 excessive checks in ufs_write_failed() and ufs_evict_inode() As it is, short copy in write() to append-only file will fail to truncate the excessive allocated blocks. As the matter of fact, all checks in ufs_truncate_blocks() are either redundant or wrong for that caller. As for the only other caller (ufs_evict_inode()), we only need the file type checks there. Cc: stable@vger.kernel.org Signed-off-by: Al Viro fs/ufs/inode.c | 18 +++++------------- 1 file changed, 5 insertions(+), 13 deletions(-) commit 006351ac8ead0d4a67dd3845e3ceffe650a23212 Author: Al Viro Date: Thu Jun 8 23:28:53 2017 -0400 ufs_getfrag_block(): we only grab ->truncate_mutex on block creation path Cc: stable@vger.kernel.org Signed-off-by: Al Viro fs/ufs/inode.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 940ef1a0ed939c2ca029fca715e25e7778ce1e34 Author: Al Viro Date: Thu Jun 8 23:27:12 2017 -0400 ufs_extend_tail(): fix the braino in calling conventions of ufs_new_fragments() ... and it really needs splitting into "new" and "extend" cases, but that's for later Cc: stable@vger.kernel.org Signed-off-by: Al Viro fs/ufs/inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 6b0d144fa758869bdd652c50aa41aaf601232550 Author: Al Viro Date: Thu Jun 8 21:15:45 2017 -0400 ufs: set correct ->s_maxsize Cc: stable@vger.kernel.org Signed-off-by: Al Viro fs/ufs/super.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) commit eb315d2ae614493fd1ebb026c75a80573d84f7ad Author: Al Viro Date: Thu Jun 8 21:15:03 2017 -0400 ufs: restore maintaining ->i_blocks Cc: stable@vger.kernel.org Signed-off-by: Al Viro fs/stat.c | 1 + fs/ufs/balloc.c | 26 +++++++++++++++++++++++++- 2 files changed, 26 insertions(+), 1 deletion(-) commit 414cf7186dbec29bd946c138d6b5c09da5955a08 Author: Al Viro Date: Thu Jun 8 18:15:18 2017 -0400 fix ufs_isblockset() Cc: stable@vger.kernel.org Signed-off-by: Al Viro fs/ufs/util.h | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) commit 8785d84d002c2ce0f68fbcd6c2c86be859802c7e Author: Al Viro Date: Thu Jun 8 02:42:03 2017 -0400 ufs: restore proper tail allocation Cc: stable@vger.kernel.org Signed-off-by: Al Viro fs/ufs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 70e7af244f24c94604ef6eca32ad297632018583 Author: Omar Sandoval Date: Fri Jun 2 01:20:01 2017 -0700 Btrfs: fix delalloc accounting leak caused by u32 overflow btrfs_calc_trans_metadata_size() does an unsigned 32-bit multiplication, which can overflow if num_items >= 4 GB / (nodesize * BTRFS_MAX_LEVEL * 2). For a nodesize of 16kB, this overflow happens at 16k items. Usually, num_items is a small constant passed to btrfs_start_transaction(), but we also use btrfs_calc_trans_metadata_size() for metadata reservations for extent items in btrfs_delalloc_{reserve,release}_metadata(). In drop_outstanding_extents(), num_items is calculated as inode->reserved_extents - inode->outstanding_extents. The difference between these two counters is usually small, but if many delalloc extents are reserved and then the outstanding extents are merged in btrfs_merge_extent_hook(), the difference can become large enough to overflow in btrfs_calc_trans_metadata_size(). The overflow manifests itself as a leak of a multiple of 4 GB in delalloc_block_rsv and the metadata bytes_may_use counter. This in turn can cause early ENOSPC errors. Additionally, these WARN_ONs in extent-tree.c will be hit when unmounting: WARN_ON(fs_info->delalloc_block_rsv.size > 0); WARN_ON(fs_info->delalloc_block_rsv.reserved > 0); WARN_ON(space_info->bytes_pinned > 0 || space_info->bytes_reserved > 0 || space_info->bytes_may_use > 0); Fix it by casting nodesize to a u64 so that btrfs_calc_trans_metadata_size() does a full 64-bit multiplication. While we're here, do the same in btrfs_calc_trunc_metadata_size(); this can't overflow with any existing uses, but it's better to be safe here than have another hard-to-debug problem later on. Cc: stable@vger.kernel.org Signed-off-by: Omar Sandoval Reviewed-by: David Sterba Signed-off-by: Chris Mason fs/btrfs/ctree.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 452e62b71fbbefe2646fad3a968371a026936c6d Author: Liu Bo Date: Fri May 26 17:44:23 2017 -0600 Btrfs: clear EXTENT_DEFRAG bits in finish_ordered_io Before this, we use 'filled' mode here, ie. if all range has been filled with EXTENT_DEFRAG bits, get to clear it, but if the defrag range joins the adjacent delalloc range, then we'll have EXTENT_DEFRAG bits in extent_state until releasing this inode's pages, and that prevents extent_data from being freed. This clears the bit if any was found within the ordered extent. Signed-off-by: Liu Bo Reviewed-by: David Sterba Signed-off-by: David Sterba Signed-off-by: Chris Mason fs/btrfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 286b92f43c0d0ae2c29a61769b66219fe5ae6701 Author: Su Yue Date: Wed May 24 09:31:32 2017 +0800 btrfs: tree-log.c: Wrong printk information about namelen In verify_dir_item, it wants to printk name_len of dir_item but printk data_len acutally. Fix it by calling btrfs_dir_name_len instead of btrfs_dir_data_len. Signed-off-by: Su Yue Reviewed-by: David Sterba Signed-off-by: David Sterba Signed-off-by: Chris Mason fs/btrfs/dir-item.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f6d4c7133257bb2d6f66723d11b19f1c49cdf2f7 Merge: c7a61cb 97edec3 Author: David S. Miller Date: Fri Jun 9 15:41:57 2017 -0400 Merge tag 'linux-can-fixes-for-4.12-20170609' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2017-06-09 this is a pull request of 6 patches for net/master. There's a patch by Stephane Grosjean that fixes an uninitialized symbol warning in the peak_canfd driver. A patch by Johan Hovold to fix the product-id endianness in an error message in the the peak_usb driver. A patch by Oliver Hartkopp to enable CAN FD for virtual CAN devices by default. Three patches by me, one makes the helper function can_change_state() robust to be called with cf == NULL. The next patch fixes a memory leak in the gs_usb driver. And the last one fixes a lockdep splat by properly initialize the per-net can_rcvlists_lock spin_lock. ==================== Signed-off-by: David S. Miller commit c7a61cba71fd151cc7d9ebe53a090e0e61eeebf3 Author: Johannes Berg Date: Fri Jun 9 21:33:09 2017 +0200 mac80211: free netdev on dev_alloc_name() error The change to remove free_netdev() from ieee80211_if_free() erroneously didn't add the necessary free_netdev() for when ieee80211_if_free() is called directly in one place, rather than as the priv_destructor. Add the missing call. Fixes: cf124db566e6 ("net: Fix inconsistent teardown and release of private netdev state.") Signed-off-by: Johannes Berg Signed-off-by: David S. Miller net/mac80211/iface.c | 1 + 1 file changed, 1 insertion(+) commit 773fc8f6e8d63ec9d840588e161cbb73a01cfc45 Author: ashwanth@codeaurora.org Date: Fri Jun 9 14:24:58 2017 +0530 net: rps: send out pending IPI's on CPU hotplug IPI's from the victim cpu are not handled in dev_cpu_callback. So these pending IPI's would be sent to the remote cpu only when NET_RX is scheduled on the victim cpu and since this trigger is unpredictable it would result in packet latencies on the remote cpu. This patch add support to send the pending ipi's of victim cpu. Signed-off-by: Ashwanth Goli Signed-off-by: David S. Miller net/core/dev.c | 31 ++++++++++++++++++++++--------- 1 file changed, 22 insertions(+), 9 deletions(-) commit eb4125dfdb1f64a5e41da8315bff48f67e5d1712 Merge: a92f63c 753c09b Author: Linus Torvalds Date: Fri Jun 9 09:59:51 2017 -0700 Merge tag 'for-linus-4.12b-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fix from Juergen Gross: "A fix for Xen on ARM when dealing with 64kB page size of a guest" * tag 'for-linus-4.12b-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/privcmd: Support correctly 64KB page granularity when mapping memory commit a0897d5f2c2d884d20840c82aea517e8a7801441 Author: Dmitry Torokhov Date: Tue Jun 6 13:05:03 2017 -0700 Input: synaptics-rmi4 - register F03 port as pass-through serio The 5th generation Thinkpad X1 Carbons use Synaptics touchpads accessible over SMBus/RMI, combined with ALPS or Elantech trackpoint devices instead of classic IBM/Lenovo trackpoints. Unfortunately there is no way for ALPS driver to detect whether it is dealing with touchpad + trackpoint combination or just a trackpoint, so we end up with a "phantom" dualpoint ALPS device in addition to real touchpad and trackpoint. Given that we do not have any special advanced handling for ALPS or Elantech trackpoints (unlike IBM trackpoints that have separate driver and a host of options) we are better off keeping the trackpoints in PS/2 emulation mode. We achieve that by setting serio type to SERIO_PS_PSTHRU, which will limit number of protocols psmouse driver will try. In addition to getting rid of the "phantom" touchpads, this will also speed up probing of F03 pass-through port. Reported-by: Damjan Georgievski Suggested-by: Benjamin Tissoires Acked-by: Benjamin Tissoires Signed-off-by: Dmitry Torokhov drivers/input/rmi4/rmi_f03.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a92f63cd13776e35d3ccb63187d1d95ab16f24a5 Merge: 788a73f c6ee9619 Author: Linus Torvalds Date: Fri Jun 9 09:44:46 2017 -0700 Merge tag 'powerpc-4.12-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: "Mostly fairly minor, of note are: - Fix percpu allocations to be NUMA aware - Limit 4k page size config to 64TB virtual address space - Avoid needlessly restoring FP and vector registers Thanks to Aneesh Kumar K.V, Breno Leitao, Christophe Leroy, Frederic Barrat, Madhavan Srinivasan, Michael Bringmann, Nicholas Piggin, Vaibhav Jain" * tag 'powerpc-4.12-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/book3s64: Move PPC_DT_CPU_FTRs and enable it by default powerpc/mm/4k: Limit 4k page size config to 64TB virtual address space cxl: Fix error path on bad ioctl powerpc/perf: Fix Power9 test_adder fields powerpc/numa: Fix percpu allocations to be NUMA aware cxl: Avoid double free_irq() for psl,slice interrupts powerpc/kernel: Initialize load_tm on task creation powerpc/kernel: Fix FP and vector register restoration powerpc/64: Reclaim CPU_FTR_SUBCORE powerpc/hotplug-mem: Fix missing endian conversion of aa_index powerpc/sysdev/simple_gpio: Fix oops in gpio save_regs function powerpc/spufs: Fix coredump of SPU contexts powerpc/64s: Add dt_cpu_ftrs boot time setup option commit 788a73f4e5c8f606a500a6c3fa35c6d9b2cd9979 Merge: 0d22df9 151d1d7 Author: Linus Torvalds Date: Fri Jun 9 09:40:08 2017 -0700 Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC fixes from Olof Johansson: "Been sitting on these for a couple of weeks waiting on some larger batches to come in but it's been pretty quiet. Just your garden variety fixes here: - A few maintainers updates (ep93xx, Exynos, TI, Marvell) - Some PM fixes for Atmel/at91 and Marvell - A few DT fixes for Marvell, Versatile, TI Keystone, bcm283x - A reset driver patch to set module license for symbol access" * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: MAINTAINERS: EP93XX: Update maintainership MAINTAINERS: remove kernel@stlinux.com obsolete mailing list ARM: dts: versatile: use #include "..." to include local DT MAINTAINERS: add device-tree files to TI DaVinci entry ARM: at91: select CONFIG_ARM_CPU_SUSPEND ARM: dts: keystone-k2l: fix broken Ethernet due to disabled OSR arm64: defconfig: enable some core options for 64bit Rockchip socs arm64: marvell: dts: fix interrupts in 7k/8k crypto nodes reset: hi6220: Set module license so that it can be loaded MAINTAINERS: add irqchip related drivers to Marvell EBU maintainers MAINTAINERS: sort F entries for Marvell EBU maintainers ARM: davinci: PM: Do not free useful resources in normal path in 'davinci_pm_init' ARM: davinci: PM: Free resources in error handling path in 'davinci_pm_init' ARM: dts: bcm283x: Reserve first page for firmware memory: atmel-ebi: mark PM ops as __maybe_unused MAINTAINERS: Remove Javier Martinez Canillas as reviewer for Exynos commit 33d4c4821323729b463e45d0b2d32f6a87dcba5b Author: Mario Molitor Date: Thu Jun 8 23:03:09 2017 +0200 stmmac: fix for hw timestamp of GMAC3 unit 1.) Bugfix of function stmmac_get_tx_hwtstamp. Corrected the tx timestamp available check (same as 4.8 and older) Change printout from info syslevel to debug. 2.) Bugfix of function stmmac_get_rx_hwtstamp. Corrected the rx timestamp available check (same as 4.8 and older) Change printout from info syslevel to debug. Fixes: ba1ffd74df74 ("stmmac: fix PTP support for GMAC4") Signed-off-by: Mario Molitor Signed-off-by: David S. Miller drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c | 11 +++++++---- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 10 +++++----- 2 files changed, 12 insertions(+), 9 deletions(-) commit fd6720aefde06eacf17404eed2cad65c6ec103e1 Author: Mario Molitor Date: Thu Jun 8 22:41:02 2017 +0200 stmmac: fix ptp header for GMAC3 hw timestamp According the CYCLON V documention only the bit 16 of snaptypesel should set. (more information see Table 17-20 (cv_5v4.pdf) : Timestamp Snapshot Dependency on Register Bits) Fixes: d2042052a0aa ("stmmac: update the PTP header file") Signed-off-by: Mario Molitor Signed-off-by: David S. Miller drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 15 ++++++++++++--- drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h | 3 ++- 2 files changed, 14 insertions(+), 4 deletions(-) commit ff85a1a80e00349dc7783c8dc4d6233d9a709283 Author: Borislav Petkov Date: Sun May 21 11:44:47 2017 +0200 kconfig: Check for libncurses before menuconfig There is a check and a nice user-friendly message when the curses library is not present on the system and the user wants to do "make menuconfig". It doesn't get issued, though. Instead, we fail the build when mconf.c doesn't find the curses.h header: HOSTCC scripts/kconfig/mconf.o In file included from scripts/kconfig/mconf.c:23:0: scripts/kconfig/lxdialog/dialog.h:38:20: fatal error: curses.h: No such file or directory #include CURSES_LOC ^ compilation terminated. Make that check a prerequisite to mconf so that the user sees the error message instead: $ make menuconfig *** Unable to find the ncurses libraries or the *** required header files. *** 'make menuconfig' requires the ncurses libraries. *** *** Install ncurses (ncurses-devel) and try again. *** scripts/kconfig/Makefile:203: recipe for target 'scripts/kconfig/dochecklxdialog' failed make[1]: *** [scripts/kconfig/dochecklxdialog] Error 1 Makefile:548: recipe for target 'menuconfig' failed make: *** [menuconfig] Error 2 Signed-off-by: Borislav Petkov Signed-off-by: Masahiro Yamada scripts/kconfig/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f186ce61bb8235d80068c390dc2aad7ca427a4c2 Author: Krister Johansen Date: Thu Jun 8 13:12:38 2017 -0700 Fix an intermittent pr_emerg warning about lo becoming free. It looks like this: Message from syslogd@flamingo at Apr 26 00:45:00 ... kernel:unregister_netdevice: waiting for lo to become free. Usage count = 4 They seem to coincide with net namespace teardown. The message is emitted by netdev_wait_allrefs(). Forced a kdump in netdev_run_todo, but found that the refcount on the lo device was already 0 at the time we got to the panic. Used bcc to check the blocking in netdev_run_todo. The only places where we're off cpu there are in the rcu_barrier() and msleep() calls. That behavior is expected. The msleep time coincides with the amount of time we spend waiting for the refcount to reach zero; the rcu_barrier() wait times are not excessive. After looking through the list of callbacks that the netdevice notifiers invoke in this path, it appears that the dst_dev_event is the most interesting. The dst_ifdown path places a hold on the loopback_dev as part of releasing the dev associated with the original dst cache entry. Most of our notifier callbacks are straight-forward, but this one a) looks complex, and b) places a hold on the network interface in question. I constructed a new bcc script that watches various events in the liftime of a dst cache entry. Note that dst_ifdown will take a hold on the loopback device until the invalidated dst entry gets freed. [ __dst_free] on DST: ffff883ccabb7900 IF tap1008300eth0 invoked at 1282115677036183 __dst_free rcu_nocb_kthread kthread ret_from_fork Acked-by: Eric Dumazet Signed-off-by: David S. Miller net/core/dst.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) commit b9d39d17e4819ca2e69ad1f14acaad12240a1de5 Author: Dan Williams Date: Fri Jun 9 08:50:49 2017 -0700 device-dax: fix 'dax' device filesystem inode destruction crash The inode destruction path for the 'dax' device filesystem incorrectly assumes that the inode was initialized through 'alloc_dax()'. However, if someone attempts to directly mount the dax filesystem with 'mount -t dax dax mnt' that will bypass 'alloc_dax()' and the following failure signatures may occur as a result: kill_dax() must be called before final iput() WARNING: CPU: 2 PID: 1188 at drivers/dax/super.c:243 dax_destroy_inode+0x48/0x50 RIP: 0010:dax_destroy_inode+0x48/0x50 Call Trace: destroy_inode+0x3b/0x60 evict+0x139/0x1c0 iput+0x1f9/0x2d0 dentry_unlink_inode+0xc3/0x160 __dentry_kill+0xcf/0x180 ? dput+0x37/0x3b0 dput+0x3a3/0x3b0 do_one_tree+0x36/0x40 shrink_dcache_for_umount+0x2d/0x90 generic_shutdown_super+0x1f/0x120 kill_anon_super+0x12/0x20 deactivate_locked_super+0x43/0x70 deactivate_super+0x4e/0x60 general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC RIP: 0010:kfree+0x6d/0x290 Call Trace: dax_i_callback+0x22/0x60 ? dax_destroy_inode+0x50/0x50 rcu_process_callbacks+0x298/0x740 ida_remove called for id=0 which is not allocated. WARNING: CPU: 0 PID: 0 at lib/idr.c:383 ida_remove+0x110/0x120 [..] Call Trace: ida_simple_remove+0x2b/0x50 ? dax_destroy_inode+0x50/0x50 dax_i_callback+0x3c/0x60 rcu_process_callbacks+0x298/0x740 Add missing initialization of the 'struct dax_device' and inode so that the destruction path does not kfree() or ida_simple_remove() uninitialized data. Fixes: 7b6be8444e0f ("dax: refactor dax-fs into a generic provider of 'struct dax_device' instances") Reported-by: Sasha Levin Signed-off-by: Dan Williams drivers/dax/super.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) commit defbcf2decc903a28d8398aa477b6881e711e3ea Author: Mateusz Jurczyk Date: Thu Jun 8 11:13:36 2017 +0200 af_unix: Add sockaddr length checks before accessing sa_family in bind and connect handlers Verify that the caller-provided sockaddr structure is large enough to contain the sa_family field, before accessing it in bind() and connect() handlers of the AF_UNIX socket. Since neither syscall enforces a minimum size of the corresponding memory region, very short sockaddrs (zero or one byte long) result in operating on uninitialized memory while referencing .sa_family. Signed-off-by: Mateusz Jurczyk Signed-off-by: David S. Miller net/unix/af_unix.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit fc5b775da468e359154795afeb27be79b509b76d Author: Joe Perches Date: Fri Jun 9 15:45:32 2017 +0200 net: phy: add missing SPEED_14000 Fixes: 0d7e2d2166f6 ("IB/ipoib: add get_link_ksettings in ethtool") Signed-off-by: Joe Perches Signed-off-by: Nicolas Dichtel Signed-off-by: David S. Miller drivers/net/phy/phy.c | 2 ++ 1 file changed, 2 insertions(+) commit f50b878fed33e360d01dcdc31a8eeb1815d033d5 Author: Alan Stern Date: Thu Jun 8 13:55:59 2017 -0400 USB: gadget: fix GPF in gadgetfs A NULL-pointer dereference bug in gadgetfs was uncovered by syzkaller: > kasan: GPF could be caused by NULL-ptr deref or user memory access > general protection fault: 0000 [#1] SMP KASAN > Dumping ftrace buffer: > (ftrace buffer empty) > Modules linked in: > CPU: 2 PID: 4820 Comm: syz-executor0 Not tainted 4.12.0-rc4+ #5 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > task: ffff880039542dc0 task.stack: ffff88003bdd0000 > RIP: 0010:__list_del_entry_valid+0x7e/0x170 lib/list_debug.c:51 > RSP: 0018:ffff88003bdd6e50 EFLAGS: 00010246 > RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000010000 > RDX: 0000000000000000 RSI: ffffffff86504948 RDI: ffffffff86504950 > RBP: ffff88003bdd6e68 R08: ffff880039542dc0 R09: ffffffff8778ce00 > R10: ffff88003bdd6e68 R11: dffffc0000000000 R12: 0000000000000000 > R13: dffffc0000000000 R14: 1ffff100077badd2 R15: ffffffff864d2e40 > FS: 0000000000000000(0000) GS:ffff88006dc00000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 000000002014aff9 CR3: 0000000006022000 CR4: 00000000000006e0 > Call Trace: > __list_del_entry include/linux/list.h:116 [inline] > list_del include/linux/list.h:124 [inline] > usb_gadget_unregister_driver+0x166/0x4c0 drivers/usb/gadget/udc/core.c:1387 > dev_release+0x80/0x160 drivers/usb/gadget/legacy/inode.c:1187 > __fput+0x332/0x7f0 fs/file_table.c:209 > ____fput+0x15/0x20 fs/file_table.c:245 > task_work_run+0x19b/0x270 kernel/task_work.c:116 > exit_task_work include/linux/task_work.h:21 [inline] > do_exit+0x18a3/0x2820 kernel/exit.c:878 > do_group_exit+0x149/0x420 kernel/exit.c:982 > get_signal+0x77f/0x1780 kernel/signal.c:2318 > do_signal+0xd2/0x2130 arch/x86/kernel/signal.c:808 > exit_to_usermode_loop+0x1a7/0x240 arch/x86/entry/common.c:157 > prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline] > syscall_return_slowpath+0x3ba/0x410 arch/x86/entry/common.c:263 > entry_SYSCALL_64_fastpath+0xbc/0xbe > RIP: 0033:0x4461f9 > RSP: 002b:00007fdac2b1ecf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca > RAX: fffffffffffffe00 RBX: 00000000007080c8 RCX: 00000000004461f9 > RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000007080c8 > RBP: 00000000007080a8 R08: 0000000000000000 R09: 0000000000000000 > R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 > R13: 0000000000000000 R14: 00007fdac2b1f9c0 R15: 00007fdac2b1f700 > Code: 00 00 00 00 ad de 49 39 c4 74 6a 48 b8 00 02 00 00 00 00 ad de > 48 89 da 48 39 c3 74 74 48 c1 ea 03 48 b8 00 00 00 00 00 fc ff df <80> > 3c 02 00 0f 85 92 00 00 00 48 8b 13 48 39 f2 75 66 49 8d 7c > RIP: __list_del_entry_valid+0x7e/0x170 lib/list_debug.c:51 RSP: ffff88003bdd6e50 > ---[ end trace 30e94b1eec4831c8 ]--- > Kernel panic - not syncing: Fatal exception The bug was caused by dev_release() failing to turn off its gadget_registered flag after unregistering the gadget driver. As a result, when a later user closed the device file before writing a valid set of descriptors, dev_release() thought the gadget had been registered and tried to unregister it, even though it had not been. This led to the NULL pointer dereference. The fix is simple: turn off the flag when the gadget is unregistered. Signed-off-by: Alan Stern Reported-and-tested-by: Andrey Konovalov CC: Signed-off-by: Felipe Balbi drivers/usb/gadget/legacy/inode.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 792ef14df5c585c19b2831673a077504a09e5203 Author: Dave Young Date: Fri Jun 9 08:45:58 2017 +0000 efi: Fix boot panic because of invalid BGRT image address Maniaxx reported a kernel boot crash in the EFI code, which I emulated by using same invalid phys addr in code: BUG: unable to handle kernel paging request at ffffffffff280001 IP: efi_bgrt_init+0xfb/0x153 ... Call Trace: ? bgrt_init+0xbc/0xbc acpi_parse_bgrt+0xe/0x12 acpi_table_parse+0x89/0xb8 acpi_boot_init+0x445/0x4e2 ? acpi_parse_x2apic+0x79/0x79 ? dmi_ignore_irq0_timer_override+0x33/0x33 setup_arch+0xb63/0xc82 ? early_idt_handler_array+0x120/0x120 start_kernel+0xb7/0x443 ? early_idt_handler_array+0x120/0x120 x86_64_start_reservations+0x29/0x2b x86_64_start_kernel+0x154/0x177 secondary_startup_64+0x9f/0x9f There is also a similar bug filed in bugzilla.kernel.org: https://bugzilla.kernel.org/show_bug.cgi?id=195633 The crash is caused by this commit: 7b0a911478c7 efi/x86: Move the EFI BGRT init code to early init code The root cause is the firmware on those machines provides invalid BGRT image addresses. In a kernel before above commit BGRT initializes late and uses ioremap() to map the image address. Ioremap validates the address, if it is not a valid physical address ioremap() just fails and returns. However in current kernel EFI BGRT initializes early and uses early_memremap() which does not validate the image address, and kernel panic happens. According to ACPI spec the BGRT image address should fall into EFI_BOOT_SERVICES_DATA, see the section 5.2.22.4 of below document: http://www.uefi.org/sites/default/files/resources/ACPI_6_1.pdf Fix this issue by validating the image address in efi_bgrt_init(). If the image address does not fall into any EFI_BOOT_SERVICES_DATA areas we just bail out with a warning message. Reported-by: Maniaxx Signed-off-by: Dave Young Signed-off-by: Ard Biesheuvel Cc: Linus Torvalds Cc: Matt Fleming Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-efi@vger.kernel.org Fixes: 7b0a911478c7 ("efi/x86: Move the EFI BGRT init code to early init code") Link: http://lkml.kernel.org/r/20170609084558.26766-2-ard.biesheuvel@linaro.org Signed-off-by: Ingo Molnar drivers/firmware/efi/efi-bgrt.c | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) commit 97edec3a11cf6f73f2e45c3035b5ff8e4c3543dd Author: Oliver Hartkopp Date: Fri Jun 2 19:37:30 2017 +0200 can: enable CAN FD for virtual CAN devices by default CAN FD capable CAN interfaces can handle (classic) CAN 2.0 frames too. New users usually fail at their first attempt to explore CAN FD on virtual CAN interfaces due to the current CAN_MTU default. Set the MTU to CANFD_MTU by default to reduce this confusion. If someone *really* needs a 'classic CAN'-only device this can be set with the 'ip' tool with e.g. 'ip link set vcan0 mtu 16' as before. Signed-off-by: Oliver Hartkopp Signed-off-by: Marc Kleine-Budde drivers/net/can/vcan.c | 2 +- drivers/net/can/vxcan.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 74b7b490886852582d986a33443c2ffa50970169 Author: Marc Kleine-Budde Date: Tue Jun 6 13:53:16 2017 +0200 can: af_can: namespace support: fix lockdep splat: properly initialize spin_lock This patch uses spin_lock_init() instead of __SPIN_LOCK_UNLOCKED() to initialize the per namespace net->can.can_rcvlists_lock lock to fix this lockdep warning: | INFO: trying to register non-static key. | the code is fine but needs lockdep annotation. | turning off the locking correctness validator. | CPU: 0 PID: 186 Comm: candump Not tainted 4.12.0-rc3+ #47 | Hardware name: Marvell Kirkwood (Flattened Device Tree) | [] (unwind_backtrace) from [] (show_stack+0x18/0x1c) | [] (show_stack) from [] (register_lock_class+0x1e4/0x55c) | [] (register_lock_class) from [] (__lock_acquire+0x148/0x1990) | [] (__lock_acquire) from [] (lock_acquire+0x174/0x210) | [] (lock_acquire) from [] (_raw_spin_lock+0x50/0x88) | [] (_raw_spin_lock) from [] (can_rx_register+0x94/0x15c [can]) | [] (can_rx_register [can]) from [] (raw_enable_filters+0x60/0xc0 [can_raw]) | [] (raw_enable_filters [can_raw]) from [] (raw_enable_allfilters+0x2c/0xa0 [can_raw]) | [] (raw_enable_allfilters [can_raw]) from [] (raw_bind+0xb0/0x250 [can_raw]) | [] (raw_bind [can_raw]) from [] (SyS_bind+0x70/0xac) | [] (SyS_bind) from [] (ret_fast_syscall+0x0/0x1c) Cc: Mario Kicherer Acked-by: Oliver Hartkopp Signed-off-by: Marc Kleine-Budde net/can/af_can.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 5cda3ee5138e91ac369ed9d0b55eab0dab077686 Author: Marc Kleine-Budde Date: Sun Jun 4 14:03:42 2017 +0200 can: gs_usb: fix memory leak in gs_cmd_reset() This patch adds the missing kfree() in gs_cmd_reset() to free the memory that is not used anymore after usb_control_msg(). Cc: linux-stable Cc: Maximilian Schneider Signed-off-by: Marc Kleine-Budde drivers/net/can/usb/gs_usb.c | 2 ++ 1 file changed, 2 insertions(+) commit dadcd398b3f059a0aa9de1cac8030a1d5a3791a5 Author: Johan Hovold Date: Fri May 12 12:09:25 2017 +0200 can: peak_usb: fix product-id endianness in error message Make sure to use the USB device product-id stored in host-byte order in a probe error message. Also remove a redundant reassignment of the local usb_dev variable which had already been used to retrieve the product id. Signed-off-by: Johan Hovold Signed-off-by: Marc Kleine-Budde drivers/net/can/usb/peak_usb/pcan_usb_core.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit f2a918b40cea994f9524ace67fd05ef42a8d9e5b Author: Stephane Grosjean Date: Wed May 3 10:35:04 2017 +0200 can: peak_canfd: fix uninitialized symbol warnings This patch fixes two uninitialized symbol warnings in the new code adding support of the PEAK-System PCAN-PCI Express FD boards, in the socket-CAN network protocol family. Signed-off-by: Stephane Grosjean Reported-by: Dan Carpenter Signed-off-by: Marc Kleine-Budde drivers/net/can/peak_canfd/peak_canfd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ff3416fb5b02cfae94591ef4395b0b4dc793f25e Author: Marc Kleine-Budde Date: Thu May 18 10:22:22 2017 +0200 can: dev: make can_change_state() robust to be called with cf == NULL In OOM situations where no skb can be allocated, can_change_state() may be called with cf == NULL. As this function updates the state and error statistics it's not an option to skip the call to can_change_state() in OOM situations. This patch makes can_change_state() robust, so that it can be called with cf == NULL. Signed-off-by: Marc Kleine-Budde drivers/net/can/dev.c | 3 +++ 1 file changed, 3 insertions(+) commit ed45509b550488f6a71a4b6cc5b12265e8c1f85d Author: Vaibhav Jain Date: Fri Jun 2 22:26:48 2017 +0530 cxl: Avoid double free_irq() for psl,slice interrupts During an eeh call to cxl_remove can result in double free_irq of psl,slice interrupts. This can happen if perst_reloads_same_image == 1 and call to cxl_configure_adapter() fails during slot_reset callback. In such a case we see a kernel oops with following back-trace: Oops: Kernel access of bad area, sig: 11 [#1] Call Trace: free_irq+0x88/0xd0 (unreliable) cxl_unmap_irq+0x20/0x40 [cxl] cxl_native_release_psl_irq+0x78/0xd8 [cxl] pci_deconfigure_afu+0xac/0x110 [cxl] cxl_remove+0x104/0x210 [cxl] pci_device_remove+0x6c/0x110 device_release_driver_internal+0x204/0x2e0 pci_stop_bus_device+0xa0/0xd0 pci_stop_and_remove_bus_device+0x28/0x40 pci_hp_remove_devices+0xb0/0x150 pci_hp_remove_devices+0x68/0x150 eeh_handle_normal_event+0x140/0x580 eeh_handle_event+0x174/0x360 eeh_event_handler+0x1e8/0x1f0 This patch fixes the issue of double free_irq by checking that variables that hold the virqs (err_hwirq, serr_hwirq, psl_virq) are not '0' before un-mapping and resetting these variables to '0' when they are un-mapped. Cc: stable@vger.kernel.org Signed-off-by: Vaibhav Jain Signed-off-by: Greg Kroah-Hartman drivers/misc/cxl/native.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) commit b7c747d4627462f25b3daabf49c18895a6722faa Author: Alexandre TORGUE Date: Tue May 30 16:43:04 2017 +0200 pinctrl: stm32: Fix bad function call In stm32_pconf_parse_conf function, stm32_pmx_gpio_set_direction is called with wrong parameter value. Indeed, using NULL value for range will raise an oops. Fixes: aceb16dc2da5 ("pinctrl: Add STM32 MCUs support") Reported-by: Dan Carpenter Signed-off-by: Alexandre TORGUE Signed-off-by: Linus Walleij drivers/pinctrl/stm32/pinctrl-stm32.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ba714a9c1dea85e0bf2899d02dfeb9c70040427c Author: Thomas Gleixner Date: Tue May 23 23:23:32 2017 +0200 pinctrl/amd: Use regular interrupt instead of chained The AMD pinctrl driver uses a chained interrupt to demultiplex the GPIO interrupts. Kevin Vandeventer reported, that his new AMD Ryzen locks up hard on boot when the AMD pinctrl driver is initialized. The reason is an interrupt storm. It's not clear whether that's caused by hardware or firmware or both. Using chained interrupts on X86 is a dangerous endavour. If a system is misconfigured or the hardware buggy there is no safety net to catch an interrupt storm. Convert the driver to use a regular interrupt for the demultiplex handler. This allows the interrupt storm detector to catch the malfunction and lets the system boot up. This should be backported to stable because it's likely that more users run into this problem as the AMD Ryzen machines are spreading. Reported-by: Kevin Vandeventer Link: https://bugzilla.suse.com/show_bug.cgi?id=1034261 Signed-off-by: Thomas Gleixner Signed-off-by: Linus Walleij drivers/pinctrl/pinctrl-amd.c | 91 +++++++++++++++++++------------------------ 1 file changed, 41 insertions(+), 50 deletions(-) commit fc7a90686777e7d2da7a08cf0202c21f3b96febb Author: Richard Genoud Date: Thu Jun 1 14:18:26 2017 +0200 gpio: mvebu: fix gpio bank registration when pwm is used If more than one gpio bank has the "pwm" property, only one will be registered successfully, all the others will fail with: mvebu-gpio: probe of f1018140.gpio failed with error -17 That's because in alloc_pwms(), the chip->base (aka "int pwm"), was not set (thus, ==0) ; and 0 is a meaningful start value in alloc_pwm(). What was intended is mvpwm->chip->base = -1. Like that, the numbering will be done auto-magically Moreover, as the region might be already occupied by another pwm, we shouldn't force: mvpwm->chip->base = 0 nor mvpwm->chip->base = id * MVEBU_MAX_GPIO_PER_BANK; Tested on clearfog-pro (Marvell 88F6828) Fixes: 757642f9a584 ("gpio: mvebu: Add limited PWM support") Signed-off-by: Richard Genoud Reviewed-by: Gregory CLEMENT Signed-off-by: Linus Walleij drivers/gpio/gpio-mvebu.c | 7 +++++++ 1 file changed, 7 insertions(+) commit c528eb27a3be2600e724c8a57cb69eab1fd9afa2 Author: Richard Genoud Date: Thu Jun 1 14:18:25 2017 +0200 gpio: mvebu: fix blink counter register selection The blink counter A was always selected because 0 was forced in the blink select counter register. The variable 'set' was obviously there to be used as the register value, selecting the B counter when id==1 and A counter when id==0. Tested on clearfog-pro (Marvell 88F6828) Fixes: 757642f9a584 ("gpio: mvebu: Add limited PWM support") Reviewed-by: Gregory CLEMENT Reviewed-by: Ralph Sennhauser Signed-off-by: Richard Genoud Signed-off-by: Linus Walleij drivers/gpio/gpio-mvebu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8affb06737ae565722764c2b309eb0e892538344 Merge: b29794e 1123a60 Author: Ingo Molnar Date: Fri Jun 9 08:17:10 2017 +0200 Merge branch 'rcu/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu into rcu/urgent Pull RCU fix from Paul E. McKenney: " This series enables srcu_read_lock() and srcu_read_unlock() to be used from interrupt handlers, which fixes a bug in KVM's use of SRCU in delivery of interrupts to guest OSes. " Signed-off-by: Ingo Molnar commit abb85a9b512e8ca7ad04a5a8a6db9664fe644974 Author: Nicholas Bellinger Date: Wed Jun 7 20:29:50 2017 -0700 iscsi-target: Reject immediate data underflow larger than SCSI transfer length When iscsi WRITE underflow occurs there are two different scenarios that can happen. Normally in practice, when an EDTL vs. SCSI CDB TRANSFER LENGTH underflow is detected, the iscsi immediate data payload is the smaller SCSI CDB TRANSFER LENGTH. That is, when a host fabric LLD is using a fixed size EDTL for a specific control CDB, the SCSI CDB TRANSFER LENGTH and actual SCSI payload ends up being smaller than EDTL. In iscsi, this means the received iscsi immediate data payload matches the smaller SCSI CDB TRANSFER LENGTH, because there is no more SCSI payload to accept beyond SCSI CDB TRANSFER LENGTH. However, it's possible for a malicous host to send a WRITE underflow where EDTL is larger than SCSI CDB TRANSFER LENGTH, but incoming iscsi immediate data actually matches EDTL. In the wild, we've never had a iscsi host environment actually try to do this. For this special case, it's wrong to truncate part of the control CDB payload and continue to process the command during underflow when immediate data payload received was larger than SCSI CDB TRANSFER LENGTH, so go ahead and reject and drop the bogus payload as a defensive action. Note this potential bug was originally relaxed by the following for allowing WRITE underflow in MSFT FCP host environments: commit c72c5250224d475614a00c1d7e54a67f77cd3410 Author: Roland Dreier Date: Wed Jul 22 15:08:18 2015 -0700 target: allow underflow/overflow for PR OUT etc. commands Cc: Roland Dreier Cc: Mike Christie Cc: Hannes Reinecke Cc: Martin K. Petersen Cc: # v4.3+ Signed-off-by: Nicholas Bellinger drivers/target/iscsi/iscsi_target.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit 105fa2f44e504c830697b0c794822112d79808dc Author: Nicholas Bellinger Date: Sat Jun 3 05:35:47 2017 -0700 iscsi-target: Fix delayed logout processing greater than SECONDS_FOR_LOGOUT_COMP This patch fixes a BUG() in iscsit_close_session() that could be triggered when iscsit_logout_post_handler() execution from within tx thread context was not run for more than SECONDS_FOR_LOGOUT_COMP (15 seconds), and the TCP connection didn't already close before then forcing tx thread context to automatically exit. This would manifest itself during explicit logout as: [33206.974254] 1 connection(s) still exist for iSCSI session to iqn.1993-08.org.debian:01:3f5523242179 [33206.980184] INFO: NMI handler (kgdb_nmi_handler) took too long to run: 2100.772 msecs [33209.078643] ------------[ cut here ]------------ [33209.078646] kernel BUG at drivers/target/iscsi/iscsi_target.c:4346! Normally when explicit logout attempt fails, the tx thread context exits and iscsit_close_connection() from rx thread context does the extra cleanup once it detects conn->conn_logout_remove has not been cleared by the logout type specific post handlers. To address this special case, if the logout post handler in tx thread context detects conn->tx_thread_active has already been cleared, simply return and exit in order for existing iscsit_close_connection() logic from rx thread context do failed logout cleanup. Reported-by: Bart Van Assche Tested-by: Bart Van Assche Cc: Mike Christie Cc: Hannes Reinecke Cc: Sagi Grimberg Cc: stable@vger.kernel.org # 3.14+ Tested-by: Gary Guo Tested-by: Chu Yuan Lin Signed-off-by: Nicholas Bellinger drivers/target/iscsi/iscsi_target.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) commit 73d4e580ccc5c3e05cea002f18111f66c9c07034 Author: Nicholas Bellinger Date: Fri Jun 2 20:00:17 2017 -0700 target: Fix kref->refcount underflow in transport_cmd_finish_abort This patch fixes a se_cmd->cmd_kref underflow during CMD_T_ABORTED when a fabric driver drops it's second reference from below the target_core_tmr.c based callers of transport_cmd_finish_abort(). Recently with the conversion of kref to refcount_t, this bug was manifesting itself as: [705519.601034] refcount_t: underflow; use-after-free. [705519.604034] INFO: NMI handler (kgdb_nmi_handler) took too long to run: 20116.512 msecs [705539.719111] ------------[ cut here ]------------ [705539.719117] WARNING: CPU: 3 PID: 26510 at lib/refcount.c:184 refcount_sub_and_test+0x33/0x51 Since the original kref atomic_t based kref_put() didn't check for underflow and only invoked the final callback when zero was reached, this bug did not manifest in practice since all se_cmd memory is using preallocated tags. To address this, go ahead and propigate the existing return from transport_put_cmd() up via transport_cmd_finish_abort(), and change transport_cmd_finish_abort() + core_tmr_handle_tas_abort() callers to only do their local target_put_sess_cmd() if necessary. Reported-by: Bart Van Assche Tested-by: Bart Van Assche Cc: Mike Christie Cc: Hannes Reinecke Cc: Christoph Hellwig Cc: Himanshu Madhani Cc: Sagi Grimberg Cc: stable@vger.kernel.org # 3.14+ Tested-by: Gary Guo Tested-by: Chu Yuan Lin Signed-off-by: Nicholas Bellinger drivers/target/target_core_internal.h | 2 +- drivers/target/target_core_tmr.c | 16 ++++++++-------- drivers/target/target_core_transport.c | 9 ++++++--- 3 files changed, 15 insertions(+), 12 deletions(-) commit 92347cfd62c174ab91ad97dd4bfbaa1d4aa28e67 Author: Mark Rutland Date: Thu Jun 8 14:47:41 2017 +0100 KEYS: fix refcount_inc() on zero If a key's refcount is dropped to zero between key_lookup() peeking at the refcount and subsequently attempting to increment it, refcount_inc() will see a zero refcount. Here, refcount_inc() will WARN_ONCE(), and will *not* increment the refcount, which will remain zero. Once key_lookup() drops key_serial_lock, it is possible for the key to be freed behind our back. This patch uses refcount_inc_not_zero() to perform the peek and increment atomically. Fixes: fff292914d3a2f1e ("security, keys: convert key.usage from atomic_t to refcount_t") Signed-off-by: Mark Rutland Signed-off-by: David Howells Cc: David Windsor Cc: Elena Reshetova Cc: Hans Liljestrand Cc: James Morris Cc: Kees Cook Cc: Peter Zijlstra Signed-off-by: James Morris security/keys/key.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) commit 7cbe0932c2f2014d6e24e716e79ea3910b468950 Author: Mat Martineau Date: Thu Jun 8 14:50:11 2017 +0100 KEYS: Convert KEYCTL_DH_COMPUTE to use the crypto KPP API The initial Diffie-Hellman computation made direct use of the MPI library because the crypto module did not support DH at the time. Now that KPP is implemented, KEYCTL_DH_COMPUTE should use it to get rid of duplicate code and leverage possible hardware acceleration. This fixes an issue whereby the input to the KDF computation would include additional uninitialized memory when the result of the Diffie-Hellman computation was shorter than the input prime number. Signed-off-by: Mat Martineau Signed-off-by: David Howells Signed-off-by: James Morris security/keys/Kconfig | 2 +- security/keys/dh.c | 272 +++++++++++++++++++++++++++++++------------------- 2 files changed, 171 insertions(+), 103 deletions(-) commit da7798a7b6714cf35ea6084ad6b1fe0497566cf2 Author: Loganaden Velvindron Date: Thu Jun 8 14:50:04 2017 +0100 crypto : asymmetric_keys : verify_pefile:zero memory content before freeing Signed-off-by: Loganaden Velvindron Signed-off-by: Yasir Auleear Signed-off-by: David Howells Signed-off-by: James Morris crypto/asymmetric_keys/verify_pefile.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit a77395447b0aeab9473a066ff28fbee01130206b Author: Eric Biggers Date: Thu Jun 8 14:49:57 2017 +0100 KEYS: DH: add __user annotations to keyctl_kdf_params Signed-off-by: Eric Biggers Signed-off-by: David Howells Acked-by: Stephan Mueller Signed-off-by: James Morris include/uapi/linux/keyctl.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 0ddd9f1a6b7e5746b52959f645fc66859b805e88 Author: Eric Biggers Date: Thu Jun 8 14:49:49 2017 +0100 KEYS: DH: ensure the KDF counter is properly aligned Accessing a 'u8[4]' through a '__be32 *' violates alignment rules. Just make the counter a __be32 instead. Signed-off-by: Eric Biggers Signed-off-by: David Howells Acked-by: Stephan Mueller Signed-off-by: James Morris security/keys/dh.c | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-) commit 281590b4221779dbc4a5e2c33c0c5b0239cfe794 Author: Eric Biggers Date: Thu Jun 8 14:49:42 2017 +0100 KEYS: DH: don't feed uninitialized "otherinfo" into KDF If userspace called KEYCTL_DH_COMPUTE with kdf_params containing NULL otherinfo but nonzero otherinfolen, the kernel would allocate a buffer for the otherinfo, then feed it into the KDF without initializing it. Fix this by always doing the copy from userspace (which will fail with EFAULT in this scenario). Signed-off-by: Eric Biggers Signed-off-by: David Howells Acked-by: Stephan Mueller Signed-off-by: James Morris security/keys/dh.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bbe240454d86be95151e0ecfd6ac55fe5ef5a6f5 Author: Eric Biggers Date: Thu Jun 8 14:49:34 2017 +0100 KEYS: DH: forbid using digest_null as the KDF hash Requesting "digest_null" in the keyctl_kdf_params caused an infinite loop in kdf_ctr() because the "null" hash has a digest size of 0. Fix it by rejecting hash algorithms with a digest size of 0. Signed-off-by: Eric Biggers Signed-off-by: David Howells Acked-by: Stephan Mueller Signed-off-by: James Morris security/keys/dh.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) commit 0620fddb56dfaf0e1034eeb69d79c73b361debbf Author: Eric Biggers Date: Thu Jun 8 14:49:26 2017 +0100 KEYS: sanitize key structs before freeing While a 'struct key' itself normally does not contain sensitive information, Documentation/security/keys.txt actually encourages this: "Having a payload is not required; and the payload can, in fact, just be a value stored in the struct key itself." In case someone has taken this advice, or will take this advice in the future, zero the key structure before freeing it. We might as well, and as a bonus this could make it a bit more difficult for an adversary to determine which keys have recently been in use. This is safe because the key_jar cache does not use a constructor. Signed-off-by: Eric Biggers Signed-off-by: David Howells Signed-off-by: James Morris include/linux/key.h | 1 - security/keys/gc.c | 4 +--- 2 files changed, 1 insertion(+), 4 deletions(-) commit ee618b4619b72527aaed765f0f0b74072b281159 Author: Eric Biggers Date: Thu Jun 8 14:49:18 2017 +0100 KEYS: trusted: sanitize all key material As the previous patch did for encrypted-keys, zero sensitive any potentially sensitive data related to the "trusted" key type before it is freed. Notably, we were not zeroing the tpm_buf structures in which the actual key is stored for TPM seal and unseal, nor were we zeroing the trusted_key_payload in certain error paths. Cc: Mimi Zohar Cc: David Safford Signed-off-by: Eric Biggers Signed-off-by: David Howells Signed-off-by: James Morris security/keys/trusted.c | 50 ++++++++++++++++++++++--------------------------- 1 file changed, 22 insertions(+), 28 deletions(-) commit a9dd74b252e04b7e41ffe78d418b896b33b70a13 Author: Eric Biggers Date: Thu Jun 8 14:49:11 2017 +0100 KEYS: encrypted: sanitize all key material For keys of type "encrypted", consistently zero sensitive key material before freeing it. This was already being done for the decrypted payloads of encrypted keys, but not for the master key and the keys derived from the master key. Out of an abundance of caution and because it is trivial to do so, also zero buffers containing the key payload in encrypted form, although depending on how the encrypted-keys feature is used such information does not necessarily need to be kept secret. Cc: Mimi Zohar Cc: David Safford Signed-off-by: Eric Biggers Signed-off-by: David Howells Signed-off-by: James Morris security/keys/encrypted-keys/encrypted.c | 31 +++++++++++++------------------ 1 file changed, 13 insertions(+), 18 deletions(-) commit 6966c74932b328b3d6df92b11b083bfbcd067986 Author: Eric Biggers Date: Thu Jun 8 14:49:04 2017 +0100 KEYS: user_defined: sanitize key payloads Zero the payloads of user and logon keys before freeing them. This prevents sensitive key material from being kept around in the slab caches after a key is released. Signed-off-by: Eric Biggers Signed-off-by: David Howells Signed-off-by: James Morris security/keys/user_defined.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) commit 57070c850a03ee0cea654fc22cb8032fc3139d39 Author: Eric Biggers Date: Thu Jun 8 14:48:57 2017 +0100 KEYS: sanitize add_key() and keyctl() key payloads Before returning from add_key() or one of the keyctl() commands that takes in a key payload, zero the temporary buffer that was allocated to hold the key payload copied from userspace. This may contain sensitive key material that should not be kept around in the slab caches. Signed-off-by: Eric Biggers Signed-off-by: David Howells Signed-off-by: James Morris security/keys/keyctl.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) commit 63a0b0509e700717a59f049ec6e4e04e903c7fe2 Author: Eric Biggers Date: Thu Jun 8 14:48:47 2017 +0100 KEYS: fix freeing uninitialized memory in key_update() key_update() freed the key_preparsed_payload even if it was not initialized first. This would cause a crash if userspace called keyctl_update() on a key with type like "asymmetric" that has a ->preparse() method but not an ->update() method. Possibly it could even be triggered for other key types by racing with keyctl_setperm() to make the KEY_NEED_WRITE check fail (the permission was already checked, so normally it wouldn't fail there). Reproducer with key type "asymmetric", given a valid cert.der: keyctl new_session keyid=$(keyctl padd asymmetric desc @s < cert.der) keyctl setperm $keyid 0x3f000000 keyctl update $keyid data [ 150.686666] BUG: unable to handle kernel NULL pointer dereference at 0000000000000001 [ 150.687601] IP: asymmetric_key_free_kids+0x12/0x30 [ 150.688139] PGD 38a3d067 [ 150.688141] PUD 3b3de067 [ 150.688447] PMD 0 [ 150.688745] [ 150.689160] Oops: 0000 [#1] SMP [ 150.689455] Modules linked in: [ 150.689769] CPU: 1 PID: 2478 Comm: keyctl Not tainted 4.11.0-rc4-xfstests-00187-ga9f6b6b8cd2f #742 [ 150.690916] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-20170228_101828-anatol 04/01/2014 [ 150.692199] task: ffff88003b30c480 task.stack: ffffc90000350000 [ 150.692952] RIP: 0010:asymmetric_key_free_kids+0x12/0x30 [ 150.693556] RSP: 0018:ffffc90000353e58 EFLAGS: 00010202 [ 150.694142] RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000004 [ 150.694845] RDX: ffffffff81ee3920 RSI: ffff88003d4b0700 RDI: 0000000000000001 [ 150.697569] RBP: ffffc90000353e60 R08: ffff88003d5d2140 R09: 0000000000000000 [ 150.702483] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 [ 150.707393] R13: 0000000000000004 R14: ffff880038a4d2d8 R15: 000000000040411f [ 150.709720] FS: 00007fcbcee35700(0000) GS:ffff88003fd00000(0000) knlGS:0000000000000000 [ 150.711504] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 150.712733] CR2: 0000000000000001 CR3: 0000000039eab000 CR4: 00000000003406e0 [ 150.714487] Call Trace: [ 150.714975] asymmetric_key_free_preparse+0x2f/0x40 [ 150.715907] key_update+0xf7/0x140 [ 150.716560] ? key_default_cmp+0x20/0x20 [ 150.717319] keyctl_update_key+0xb0/0xe0 [ 150.718066] SyS_keyctl+0x109/0x130 [ 150.718663] entry_SYSCALL_64_fastpath+0x1f/0xc2 [ 150.719440] RIP: 0033:0x7fcbce75ff19 [ 150.719926] RSP: 002b:00007ffd5d167088 EFLAGS: 00000206 ORIG_RAX: 00000000000000fa [ 150.720918] RAX: ffffffffffffffda RBX: 0000000000404d80 RCX: 00007fcbce75ff19 [ 150.721874] RDX: 00007ffd5d16785e RSI: 000000002866cd36 RDI: 0000000000000002 [ 150.722827] RBP: 0000000000000006 R08: 000000002866cd36 R09: 00007ffd5d16785e [ 150.723781] R10: 0000000000000004 R11: 0000000000000206 R12: 0000000000404d80 [ 150.724650] R13: 00007ffd5d16784d R14: 00007ffd5d167238 R15: 000000000040411f [ 150.725447] Code: 83 c4 08 31 c0 5b 41 5c 41 5d 41 5e 41 5f 5d c3 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 85 ff 74 23 55 48 89 e5 53 48 89 fb <48> 8b 3f e8 06 21 c5 ff 48 8b 7b 08 e8 fd 20 c5 ff 48 89 df e8 [ 150.727489] RIP: asymmetric_key_free_kids+0x12/0x30 RSP: ffffc90000353e58 [ 150.728117] CR2: 0000000000000001 [ 150.728430] ---[ end trace f7f8fe1da2d5ae8d ]--- Fixes: 4d8c0250b841 ("KEYS: Call ->free_preparse() even after ->preparse() returns an error") Cc: stable@vger.kernel.org # 3.17+ Signed-off-by: Eric Biggers Signed-off-by: David Howells Signed-off-by: James Morris security/keys/key.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 5649645d725c73df4302428ee4e02c869248b4c5 Author: Eric Biggers Date: Thu Jun 8 14:48:40 2017 +0100 KEYS: fix dereferencing NULL payload with nonzero length sys_add_key() and the KEYCTL_UPDATE operation of sys_keyctl() allowed a NULL payload with nonzero length to be passed to the key type's ->preparse(), ->instantiate(), and/or ->update() methods. Various key types including asymmetric, cifs.idmap, cifs.spnego, and pkcs7_test did not handle this case, allowing an unprivileged user to trivially cause a NULL pointer dereference (kernel oops) if one of these key types was present. Fix it by doing the copy_from_user() when 'plen' is nonzero rather than when '_payload' is non-NULL, causing the syscall to fail with EFAULT as expected when an invalid buffer is specified. Cc: stable@vger.kernel.org # 2.6.10+ Signed-off-by: Eric Biggers Signed-off-by: David Howells Signed-off-by: James Morris security/keys/keyctl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 0f534e4a13496b02ae284f50fcb0263f6ea37007 Author: Eric Biggers Date: Thu Jun 8 14:48:32 2017 +0100 KEYS: encrypted: use constant-time HMAC comparison MACs should, in general, be compared using crypto_memneq() to prevent timing attacks. Cc: Mimi Zohar Cc: Herbert Xu Signed-off-by: Eric Biggers Signed-off-by: David Howells Signed-off-by: James Morris security/keys/encrypted-keys/encrypted.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 64d107d3acca1565c39c044c459fd18f70943534 Author: Eric Biggers Date: Thu Jun 8 14:48:25 2017 +0100 KEYS: encrypted: fix race causing incorrect HMAC calculations The encrypted-keys module was using a single global HMAC transform, which could be rekeyed by multiple threads concurrently operating on different keys, causing incorrect HMAC values to be calculated. Fix this by allocating a new HMAC transform whenever we need to calculate a HMAC. Also simplify things a bit by allocating the shash_desc's using SHASH_DESC_ON_STACK() for both the HMAC and unkeyed hashes. The following script reproduces the bug: keyctl new_session keyctl add user master "abcdefghijklmnop" @s for i in $(seq 2); do ( set -e for j in $(seq 1000); do keyid=$(keyctl add encrypted desc$i "new user:master 25" @s) datablob="$(keyctl pipe $keyid)" keyctl unlink $keyid > /dev/null keyid=$(keyctl add encrypted desc$i "load $datablob" @s) keyctl unlink $keyid > /dev/null done ) & done Output with bug: [ 439.691094] encrypted_key: bad hmac (-22) add_key: Invalid argument add_key: Invalid argument Cc: Mimi Zohar Cc: Herbert Xu Signed-off-by: Eric Biggers Signed-off-by: David Howells Signed-off-by: James Morris security/keys/encrypted-keys/encrypted.c | 115 +++++++++---------------------- 1 file changed, 32 insertions(+), 83 deletions(-) commit 794b4bc292f5d31739d89c0202c54e7dc9bc3add Author: Eric Biggers Date: Thu Jun 8 14:48:18 2017 +0100 KEYS: encrypted: fix buffer overread in valid_master_desc() With the 'encrypted' key type it was possible for userspace to provide a data blob ending with a master key description shorter than expected, e.g. 'keyctl add encrypted desc "new x" @s'. When validating such a master key description, validate_master_desc() could read beyond the end of the buffer. Fix this by using strncmp() instead of memcmp(). [Also clean up the code to deduplicate some logic.] Cc: Mimi Zohar Signed-off-by: Eric Biggers Signed-off-by: David Howells Signed-off-by: James Morris security/keys/encrypted-keys/encrypted.c | 31 +++++++++++++++---------------- 1 file changed, 15 insertions(+), 16 deletions(-) commit e9ff56ac352446f55141aaef1553cee662b2e310 Author: Eric Biggers Date: Thu Jun 8 14:48:10 2017 +0100 KEYS: encrypted: avoid encrypting/decrypting stack buffers Since v4.9, the crypto API cannot (normally) be used to encrypt/decrypt stack buffers because the stack may be virtually mapped. Fix this for the padding buffers in encrypted-keys by using ZERO_PAGE for the encryption padding and by allocating a temporary heap buffer for the decryption padding. Tested with CONFIG_DEBUG_SG=y: keyctl new_session keyctl add user master "abcdefghijklmnop" @s keyid=$(keyctl add encrypted desc "new user:master 25" @s) datablob="$(keyctl pipe $keyid)" keyctl unlink $keyid keyid=$(keyctl add encrypted desc "load $datablob" @s) datablob2="$(keyctl pipe $keyid)" [ "$datablob" = "$datablob2" ] && echo "Success!" Cc: Andy Lutomirski Cc: Herbert Xu Cc: Mimi Zohar Cc: stable@vger.kernel.org # 4.9+ Signed-off-by: Eric Biggers Signed-off-by: David Howells Signed-off-by: James Morris security/keys/encrypted-keys/encrypted.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) commit d636bd9f12a66ea3775c9fabbf3f8e118253467a Author: Eric Biggers Date: Thu Jun 8 14:48:03 2017 +0100 KEYS: put keyring if install_session_keyring_to_cred() fails In join_session_keyring(), if install_session_keyring_to_cred() were to fail, we would leak the keyring reference, just like in the bug fixed by commit 23567fd052a9 ("KEYS: Fix keyring ref leak in join_session_keyring()"). Fortunately this cannot happen currently, but we really should be more careful. Do this by adding and using a new error label at which the keyring reference is dropped. Signed-off-by: Eric Biggers Signed-off-by: David Howells Signed-off-by: James Morris security/keys/process_keys.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 41f1c53e0d7d6e79087d5f5e18c467747126a3fc Author: Markus Elfring Date: Thu Jun 8 14:47:56 2017 +0100 KEYS: Delete an error message for a failed memory allocation in get_derived_key() Omit an extra message for a memory allocation failure in this function. This issue was detected by using the Coccinelle software. Link: http://events.linuxfoundation.org/sites/events/files/slides/LCJ16-Refactor_Strings-WSang_0.pdf Signed-off-by: Markus Elfring Signed-off-by: David Howells Signed-off-by: James Morris security/keys/encrypted-keys/encrypted.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 4e880168e9ffb1cdbdb72b3b48ab0324b30c2d62 Author: Dan Carpenter Date: Thu Jun 8 14:47:49 2017 +0100 X.509: Fix error code in x509_cert_parse() We forgot to set the error code on this path so it could result in returning NULL which leads to a NULL dereference. Fixes: db6c43bd2132 ("crypto: KEYS: convert public key and digsig asym to the akcipher api") Signed-off-by: Dan Carpenter Signed-off-by: David Howells Signed-off-by: James Morris crypto/asymmetric_keys/x509_cert_parser.c | 1 + 1 file changed, 1 insertion(+) commit 381f20fceba8ea540aef5241a9099f4552700d0c Author: Davidlohr Bueso Date: Thu Jun 8 14:47:34 2017 +0100 security: use READ_ONCE instead of deprecated ACCESS_ONCE With the new standardized functions, we can replace all ACCESS_ONCE() calls across relevant security/keyrings/. ACCESS_ONCE() does not work reliably on non-scalar types. For example gcc 4.6 and 4.7 might remove the volatile tag for such accesses during the SRA (scalar replacement of aggregates) step: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=58145 Update the new calls regardless of if it is a scalar type, this is cleaner than having three alternatives. Signed-off-by: Davidlohr Bueso Signed-off-by: David Howells Signed-off-by: James Morris security/keys/keyring.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 47b2c3fff4932e6fc17ce13d51a43c6969714e20 Author: Bilal Amarni Date: Thu Jun 8 14:47:26 2017 +0100 security/keys: add CONFIG_KEYS_COMPAT to Kconfig CONFIG_KEYS_COMPAT is defined in arch-specific Kconfigs and is missing for several 64-bit architectures : mips, parisc, tile. At the moment and for those architectures, calling in 32-bit userspace the keyctl syscall would return an ENOSYS error. This patch moves the CONFIG_KEYS_COMPAT option to security/keys/Kconfig, to make sure the compatibility wrapper is registered by default for any 64-bit architecture as long as it is configured with CONFIG_COMPAT. [DH: Modified to remove arm64 compat enablement also as requested by Eric Biggers] Signed-off-by: Bilal Amarni Signed-off-by: David Howells Reviewed-by: Arnd Bergmann cc: Eric Biggers Signed-off-by: James Morris arch/arm64/Kconfig | 4 ---- arch/powerpc/Kconfig | 5 ----- arch/s390/Kconfig | 3 --- arch/sparc/Kconfig | 3 --- arch/x86/Kconfig | 4 ---- security/keys/Kconfig | 4 ++++ 6 files changed, 4 insertions(+), 19 deletions(-) commit 6e88007e224ce51969ccf9afeec645146c638816 Merge: 3d76917 1929e66 Author: Dave Airlie Date: Fri Jun 9 13:12:02 2017 +1000 Merge branch 'vmwgfx-fixes-4.12' of git://people.freedesktop.org/~thomash/linux into drm-fixes A bunch of fixes for vmwgfx 4.12 regressions and older stuff. In the latter case either trivial, cc'd stable or requiring backports for stable. * 'vmwgfx-fixes-4.12' of git://people.freedesktop.org/~thomash/linux: drm/vmwgfx: Bump driver minor and date drm/vmwgfx: Remove unused legacy cursor functions drm/vmwgfx: fix spelling mistake "exeeds" -> "exceeds" drm/vmwgfx: Fix large topology crash drm/vmwgfx: Make sure to update STDU when FB is updated drm/vmwgfx: Make sure backup_handle is always valid drm/vmwgfx: Handle vmalloc() failure in vmw_local_fifo_reserve() drm/vmwgfx: Don't create proxy surface for cursor drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl() commit 3d76917f50a38870dc2d960287b07e239b3da2c3 Merge: b62dba5 ef6c4d7 Author: Dave Airlie Date: Fri Jun 9 12:18:07 2017 +1000 Merge tag 'drm-intel-fixes-2017-06-08' of git://anongit.freedesktop.org/git/drm-intel into drm-fixes drm/i915 fixes for v4.12-rc5 * tag 'drm-intel-fixes-2017-06-08' of git://anongit.freedesktop.org/git/drm-intel: drm/i915: fix warning for unused variable drm/i915: Fix 90/270 rotated coordinates for FBC drm/i915: Restore has_fbc=1 for ILK-M drm/i915: Workaround VLV/CHV DSI scanline counter hardware fail drm/i915: Fix logical inversion for gen4 quirking drm/i915: Guard against i915_ggtt_disable_guc() being invoked unconditionally drm/i915: Always recompute watermarks when distrust_bios_wm is set, v2. drm/i915: Prevent the system suspend complete optimization drm/i915/psr: disable psr2 for resolution greater than 32X20 drm/i915: Hold a wakeref for probing the ring registers drm/i915: Short-circuit i915_gem_wait_for_idle() if already idle drm/i915: Disable decoupled MMIO drm/i915/guc: Remove stale comment for q_fail drm/i915: Serialize GTT/Aperture accesses on BXT commit b62dba55779d9216128dc651204438be898fd16f Merge: 97f607f 8604889 Author: Dave Airlie Date: Fri Jun 9 12:17:27 2017 +1000 Merge tag 'drm-misc-fixes-2017-06-07' of git://anongit.freedesktop.org/git/drm-misc into drm-fixes Driver Changes: - kirin: Use correct dt port for the bridge (John) - meson: Fix regression caused by adding HDMI support to allow board configurations without HDMI (Neil) Cc: John Stultz Cc: Neil Armstrong * tag 'drm-misc-fixes-2017-06-07' of git://anongit.freedesktop.org/git/drm-misc: drm/meson: Fix driver bind when only CVBS is available drm: kirin: Fix drm_of_find_panel_or_bridge conversion commit 97f607fe0d4e8c49e4ee3251bda853f7b6aa75d0 Merge: dd44c95 014580f Author: Dave Airlie Date: Fri Jun 9 12:17:00 2017 +1000 Merge branch 'mediatek-drm-fixes-4.12-rc1' of https://github.com/ckhu-mediatek/linux.git-tags into drm-fixes mediatek fixes * 'mediatek-drm-fixes-4.12-rc1' of https://github.com/ckhu-mediatek/linux.git-tags: drm/mediatek: fix mtk_hdmi_setup_vendor_specific_infoframe mistake drm/mediatek: fix a timeout loop commit dd44c95739dffafac0e52076dd750911180295d4 Merge: e5b4ab1 b7dfee24 Author: Dave Airlie Date: Fri Jun 9 12:16:25 2017 +1000 Merge tag 'imx-drm-fixes-2017-06-08' of git://git.pengutronix.de/git/pza/linux into drm-fixes imx-drm: PRE clock gating, panelless LDB, and VDIC CSI selection fixes - Keep the external clock input to the PRE ungated and only use the internal soft reset to keep the module in low power state, to avoid sporadic startup failures. - Ignore -ENODEV return values from drm_of_find_panel_or_bridge in the LDB driver to fix probing for devices that still do not specify a panel in the device tree. - Fix the CSI input selection to the VDIC. According to experiments, the real behaviour differs a bit from the documentation. * tag 'imx-drm-fixes-2017-06-08' of git://git.pengutronix.de/git/pza/linux: gpu: ipu-v3: Fix CSI selection for VDIC drm/imx: imx-ldb: Accept drm_of_find_panel_or_bridge failure gpu: ipu-v3: pre: only use internal clock gating commit 0d22df90c7eadeaf852caca49ae8df9b2c3075a4 Merge: aea4156 fbd78af Author: Linus Torvalds Date: Thu Jun 8 17:40:32 2017 -0700 Merge tag 'pm-4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These revert one problematic commit related to system sleep and fix one recent intel_pstate regression. Specifics: - Revert a recent commit that attempted to avoid spurious wakeups from suspend-to-idle via ACPI SCI, but introduced regressions on some systems (Rafael Wysocki). We will get back to the problem it tried to address in the next cycle. - Fix a possible division by 0 during intel_pstate initialization due to a missing check (Rafael Wysocki)" * tag 'pm-4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: Revert "ACPI / sleep: Ignore spurious SCI wakeups from suspend-to-idle" cpufreq: intel_pstate: Avoid division by 0 in min_perf_pct_min() commit aea4156c308670699d74dedb182ebceffb633185 Merge: dc0cf5a 462c5a8 Author: Linus Torvalds Date: Thu Jun 8 16:28:49 2017 -0700 Merge tag 'modules-for-v4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux Pull module maintainer address change from Jessica Yu: "A single patch that advertises my email address change" * tag 'modules-for-v4.12-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux: MAINTAINERS: update email address for Jessica Yu commit 097d3c9508dc58286344e4a22b300098cf0c1566 Author: David Ahern Date: Thu Jun 8 11:31:11 2017 -0600 net: vrf: Make add_fib_rules per network namespace flag Commit 1aa6c4f6b8cd8 ("net: vrf: Add l3mdev rules on first device create") adds the l3mdev FIB rule the first time a VRF device is created. However, it only creates the rule once and only in the namespace the first device is created - which may not be init_net. Fix by using the net_generic capability to make the add_fib_rules flag per network namespace. Fixes: 1aa6c4f6b8cd8 ("net: vrf: Add l3mdev rules on first device create") Reported-by: Petr Machata Signed-off-by: David Ahern Signed-off-by: David S. Miller drivers/net/vrf.c | 36 ++++++++++++++++++++++++++++++++---- 1 file changed, 32 insertions(+), 4 deletions(-) commit fbd78afe34d9cc3a86aff7cc214d9f06e815e63e Merge: 3c2993b 57caf4e f3b7eaa Author: Rafael J. Wysocki Date: Fri Jun 9 01:25:16 2017 +0200 Merge branches 'intel_pstate' and 'pm-sleep' * intel_pstate: cpufreq: intel_pstate: Avoid division by 0 in min_perf_pct_min() * pm-sleep: Revert "ACPI / sleep: Ignore spurious SCI wakeups from suspend-to-idle" commit 47c1ded7fef108c730b803cd386241beffcdd15c Merge: cc1582c b89fe63 Author: Ingo Molnar Date: Fri Jun 9 00:41:33 2017 +0200 Merge tag 'perf-urgent-for-mingo-4.12-20170608' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/urgent fixes from Arnaldo Carvalho de Melo: - Fixes for handling compressed kernel modules (Namhyung Kim) - Fix handling old style build-id cache ($HOME/.debug/) (Namhyung Kim) - 'perf script' python/perl documentation fixes: outdated comments, invalid code snippets, etc (SeongJae Park) Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit 78a5a93c1eeb4e6933d1f62b33e5496d53b46c5a Author: Daniel Borkmann Date: Thu Jun 8 19:06:25 2017 +0200 bpf, tests: fix endianness selection I noticed that test_l4lb was failing in selftests: # ./test_progs test_pkt_access:PASS:ipv4 77 nsec test_pkt_access:PASS:ipv6 44 nsec test_xdp:PASS:ipv4 2933 nsec test_xdp:PASS:ipv6 1500 nsec test_l4lb:PASS:ipv4 377 nsec test_l4lb:PASS:ipv6 544 nsec test_l4lb:FAIL:stats 6297600000 200000 test_tcp_estats:PASS: 0 nsec Summary: 7 PASSED, 1 FAILED Tracking down the issue actually revealed that endianness selection in bpf_endian.h is broken when compiled with clang with bpf target. test_pkt_access.c, test_l4lb.c is compiled with __BYTE_ORDER as __BIG_ENDIAN, test_xdp.c as __LITTLE_ENDIAN! test_l4lb noticeably fails, because the test accounts bytes via bpf_ntohs(ip6h->payload_len) and bpf_ntohs(iph->tot_len), and compares them against a defined value and given a wrong endianness, the test outcome is different, of course. Turns out that there are actually two bugs: i) when we do __BYTE_ORDER comparison with __LITTLE_ENDIAN/__BIG_ENDIAN, then depending on the include order we see different outcomes. Reason is that __BYTE_ORDER is undefined due to missing endian.h include. Before we include the asm/byteorder.h (e.g. through linux/in.h), then __BYTE_ORDER equals __LITTLE_ENDIAN since both are undefined, after the include which correctly pulls in linux/byteorder/little_endian.h, __LITTLE_ENDIAN is defined, but given __BYTE_ORDER is still undefined, we match on __BYTE_ORDER equals to __BIG_ENDIAN since __BIG_ENDIAN is also undefined at that point, sigh. ii) But even that would be wrong, since when compiling the test cases with clang, one can select between bpfeb and bpfel targets for cross compilation. Hence, we can also not rely on what the system's endian.h provides, but we need to look at the compiler's defined endianness. The compiler defines __BYTE_ORDER__, and we can match __ORDER_LITTLE_ENDIAN__ and __ORDER_BIG_ENDIAN__, which also reflects targets bpf (native), bpfel, bpfeb correctly, thus really only rely on that. After patch: # ./test_progs test_pkt_access:PASS:ipv4 74 nsec test_pkt_access:PASS:ipv6 42 nsec test_xdp:PASS:ipv4 2340 nsec test_xdp:PASS:ipv6 1461 nsec test_l4lb:PASS:ipv4 400 nsec test_l4lb:PASS:ipv6 530 nsec test_tcp_estats:PASS: 0 nsec Summary: 7 PASSED, 0 FAILED Fixes: 43bcf707ccdc ("bpf: fix _htons occurences in test_progs") Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: David S. Miller tools/testing/selftests/bpf/bpf_endian.h | 41 +++++++++++++++++++++++--------- 1 file changed, 30 insertions(+), 11 deletions(-) commit 297fb414d0d190ca82bf0b46fb19d7fda1598737 Author: Nicolas Dichtel Date: Thu Jun 8 11:18:13 2017 +0200 ethtool.h: remind to update 802.3ad when adding new speeds Each time a new speed is added, the bonding 802.3ad isn't updated. Add a comment to remind the developer to update this driver. Signed-off-by: Nicolas Dichtel Acked-by: Andy Gospodarek Signed-off-by: David S. Miller include/uapi/linux/ethtool.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 3fcd64cfa0e9cb72b99aaba5c6bc13af9c03417f Author: Nicolas Dichtel Date: Thu Jun 8 11:18:12 2017 +0200 bonding: fix 802.3ad support for 14G speed This patch adds 14 Gbps enum definition, and fixes aggregated bandwidth calculation based on above slave links. Fixes: 0d7e2d2166f6 ("IB/ipoib: add get_link_ksettings in ethtool") Signed-off-by: Nicolas Dichtel Acked-by: Andy Gospodarek Signed-off-by: David S. Miller drivers/net/bonding/bond_3ad.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit c7c550670afda2e16f9e2d06a1473885312eb6b5 Author: Thibaut Collet Date: Thu Jun 8 11:18:11 2017 +0200 bonding: fix 802.3ad support for 5G and 50G speeds This patch adds [5|50] Gbps enum definition, and fixes aggregated bandwidth calculation based on above slave links. Fixes: c9a70d43461d ("net-next: ethtool: Added port speed macros.") Signed-off-by: Thibaut Collet Signed-off-by: Nicolas Dichtel Acked-by: Andy Gospodarek Signed-off-by: David S. Miller drivers/net/bonding/bond_3ad.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) commit daa6630a310fe2ad90ce5f7d2d196cd0353ef4fa Author: Nicolas Dichtel Date: Thu Jun 8 10:37:45 2017 +0200 openvswitch: warn about missing first netlink attribute The first netlink attribute (value 0) must always be defined as none/unspec. Because we cannot change an existing UAPI, I add a comment to point the mistake and avoid to propagate it in a new ovs API in the future. Signed-off-by: Nicolas Dichtel Signed-off-by: David S. Miller include/uapi/linux/openvswitch.h | 1 + 1 file changed, 1 insertion(+) commit f9f314f323951a33d8b4a4f63f7d04b7f3bc0603 Author: Hans Verkuil Date: Thu Jun 8 15:37:44 2017 -0300 [media] media/cec.h: use IS_REACHABLE instead of IS_ENABLED Fix messages like this: adv7842.c:(.text+0x2edadd): undefined reference to `cec_unregister_adapter' when CEC_CORE=m but the driver including media/cec.h is built-in. In that case the static inlines provided in media/cec.h should be used by that driver. Reported-by: Randy Dunlap Reported-by: kbuild test robot Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab include/media/cec.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0db47e3d323411beeb6ea97f2c4d19395c91fd8b Author: Arnd Bergmann Date: Thu Jun 8 09:54:24 2017 +0200 ila_xlat: add missing hash secret initialization While discussing the possible merits of clang warning about unused initialized functions, I found one function that was clearly meant to be called but never actually is. __ila_hash_secret_init() initializes the hash value for the ila locator, apparently this is intended to prevent hash collision attacks, but this ends up being a read-only zero constant since there is no caller. I could find no indication of why it was never called, the earliest patch submission for the module already was like this. If my interpretation is right, we certainly want to backport the patch to stable kernels as well. I considered adding it to the ila_xlat_init callback, but for best effect the random data is read as late as possible, just before it is first used. The underlying net_get_random_once() is already highly optimized to avoid overhead when called frequently. Fixes: 7f00feaf1076 ("ila: Add generic ILA translation facility") Cc: stable@vger.kernel.org Link: https://www.spinics.net/lists/kernel/msg2527243.html Signed-off-by: Arnd Bergmann Signed-off-by: David S. Miller net/ipv6/ila/ila_xlat.c | 1 + 1 file changed, 1 insertion(+) commit b89fe63fbafe307fb72546f7a2320380bf41bdd4 Author: Namhyung Kim Date: Thu Jun 8 16:31:09 2017 +0900 perf symbols: Kill dso__build_id_is_kmod() The commit e7ee40475760 ("perf symbols: Fix symbols searching for module in buildid-cache") added the function to check kernel modules reside in the build-id cache. This was because there's no way to identify a DSO which is actually a kernel module. So it searched linkname of the file and find ".ko" suffix. But this does not work for compressed kernel modules and now such DSOs hCcave correct symtab_type now. So no need to check it anymore. This patch essentially reverts the commit. Signed-off-by: Namhyung Kim Acked-by: Jiri Olsa Cc: Adrian Hunter Cc: David Ahern Cc: Peter Zijlstra Cc: Wang Nan Cc: kernel-team@lge.com Link: http://lkml.kernel.org/r/20170608073109.30699-10-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/build-id.c | 45 --------------------------------------------- tools/perf/util/build-id.h | 1 - tools/perf/util/symbol.c | 4 ---- 3 files changed, 50 deletions(-) commit c25ec42f846f702f8f532fbc890171e3a1f6ec85 Author: Namhyung Kim Date: Thu Jun 8 16:31:08 2017 +0900 perf symbols: Keep DSO->symtab_type after decompress The symsrc__init() overwrites dso->symtab_type as symsrc->type in dso__load_sym(). But for compressed kernel modules in the build-id cache, it should have original symtab type to be decompressed as needed. This fixes perf annotate to show disassembly of the function properly. Signed-off-by: Namhyung Kim Acked-by: Jiri Olsa Cc: Adrian Hunter Cc: David Ahern Cc: Peter Zijlstra Cc: Wang Nan Cc: kernel-team@lge.com Link: http://lkml.kernel.org/r/20170608073109.30699-9-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/symbol-elf.c | 2 ++ 1 file changed, 2 insertions(+) commit 94df1040b1e6aacd8dec0ba3c61d7e77cd695f26 Author: Namhyung Kim Date: Thu Jun 8 16:31:07 2017 +0900 perf tests: Decompress kernel module before objdump If a kernel modules is compressed, it should be decompressed before running objdump to parse binary data correctly. This fixes a failure of object code reading test for me. Signed-off-by: Namhyung Kim Acked-by: Adrian Hunter Acked-by: Jiri Olsa Cc: David Ahern Cc: Peter Zijlstra Cc: Wang Nan Cc: kernel-team@lge.com Link: http://lkml.kernel.org/r/20170608073109.30699-8-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/tests/code-reading.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) commit 8ba29adf9a7cdff3c7283d5fc0dcf5e777d3b40f Author: Namhyung Kim Date: Thu Jun 8 16:31:06 2017 +0900 perf tools: Consolidate error path in __open_dso() On failure, it should free the 'name', so clean up the error path using goto. Signed-off-by: Namhyung Kim Suggested-by: Arnaldo Carvalho de Melo Acked-by: Jiri Olsa Cc: Adrian Hunter Cc: David Ahern Cc: Peter Zijlstra Cc: Wang Nan Cc: kernel-team@lge.com Link: http://lkml.kernel.org/r/20170608073109.30699-7-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/dso.c | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) commit 1d6b3c9ba756a5134fd7ad1959acac776d17404b Author: Namhyung Kim Date: Thu Jun 8 16:31:05 2017 +0900 perf tools: Decompress kernel module when reading DSO data Currently perf decompresses kernel modules when loading the symbol table but it missed to do it when reading raw data. Signed-off-by: Namhyung Kim Acked-by: Jiri Olsa Cc: Adrian Hunter Cc: David Ahern Cc: Peter Zijlstra Cc: Wang Nan Cc: kernel-team@lge.com Link: http://lkml.kernel.org/r/20170608073109.30699-6-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/dso.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) commit 3c84fd53044f98017271101b59a21ddb20fb312b Author: Namhyung Kim Date: Thu Jun 8 16:31:04 2017 +0900 perf annotate: Use dso__decompress_kmodule_path() Convert open-coded decompress routine to use the function. Signed-off-by: Namhyung Kim Acked-by: Jiri Olsa Cc: Adrian Hunter Cc: David Ahern Cc: Peter Zijlstra Cc: Wang Nan Cc: kernel-team@lge.com Link: http://lkml.kernel.org/r/20170608073109.30699-5-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/annotate.c | 27 +++------------------------ 1 file changed, 3 insertions(+), 24 deletions(-) commit 42b3fa670825983fc8bd0ac7b80cc84ae3abb75b Author: Namhyung Kim Date: Thu Jun 8 16:31:03 2017 +0900 perf tools: Introduce dso__decompress_kmodule_{fd,path} Move decompress_kmodule() to util/dso.c and split it into two functions returning fd and (decompressed) file path. The existing user only wants the fd version but the path version will be used soon. Signed-off-by: Namhyung Kim Acked-by: Jiri Olsa Cc: Adrian Hunter Cc: David Ahern Cc: Peter Zijlstra Cc: Wang Nan Cc: kernel-team@lge.com Link: http://lkml.kernel.org/r/20170608073109.30699-4-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/dso.c | 58 ++++++++++++++++++++++++++++++++++++++++++++ tools/perf/util/dso.h | 6 +++++ tools/perf/util/symbol-elf.c | 36 +-------------------------- 3 files changed, 65 insertions(+), 35 deletions(-) commit 44ad6b8852529eb39066edbedc027a6901da6803 Author: Namhyung Kim Date: Thu Jun 8 16:31:02 2017 +0900 perf tools: Fix a memory leak in __open_dso() The 'name' variable should be freed on the error path. Signed-off-by: Namhyung Kim Acked-by: Jiri Olsa Cc: Adrian Hunter Cc: David Ahern Cc: Peter Zijlstra Cc: Wang Nan Cc: kernel-team@lge.com Link: http://lkml.kernel.org/r/20170608073109.30699-3-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/dso.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 3619ef76b37d4803bc9daee9d03d82c8526db378 Author: Namhyung Kim Date: Thu Jun 8 16:31:01 2017 +0900 perf annotate: Fix symbolic link of build-id cache The commit 6ebd2547dd24 ("perf annotate: Fix a bug following symbolic link of a build-id file") changed to use dirname to follow the symlink. But it only considers new-style build-id cache names so old names fail on readlink() and force to use system path which might not available. Signed-off-by: Namhyung Kim Acked-by: Jiri Olsa Cc: Adrian Hunter Cc: David Ahern Cc: Peter Zijlstra Cc: Taeung Song Cc: Wang Nan Cc: kernel-team@lge.com Fixes: 6ebd2547dd24 ("perf annotate: Fix a bug following symbolic link of a build-id file") Link: http://lkml.kernel.org/r/20170608073109.30699-2-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/annotate.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) commit dc0cf5a77db9d200284f54a60994c1f6d2fbfc5f Merge: d0aab7d dac8bbb Author: Linus Torvalds Date: Thu Jun 8 10:50:04 2017 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk Pull printk fix from Petr Mladek: "This reverts a fix added into 4.12-rc1. It caused the kernel log to be printed on another console when two consoles of the same type were defined, e.g. console=ttyS0 console=ttyS1. This configuration was never supported by kernel itself, but it started to make sense with systemd. In other words, the commit broke userspace" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk: Revert "printk: fix double printing with earlycon" commit d0aab7d4e93e0fd5df3e892e0f2087d7a5371b1a Merge: b29794e f3ad587 Author: Linus Torvalds Date: Thu Jun 8 10:02:58 2017 -0700 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: "This fixes a couple of places in the crypto code that were doing interruptible sleeps dangerously. They have been converted to use non-interruptible sleeps. This also fixes a bug in asymmetric_keys where it would trigger a use-after-free if a request returned EBUSY due to a full device queue" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: gcm - wait for crypto op not signal safe crypto: drbg - wait for crypto op not signal safe crypto: asymmetric_keys - handle EBUSY due to backlog correctly commit 0bed865060836dc5f26b68052de0a504d66d9fae Author: David S. Miller Date: Thu Jun 8 11:51:59 2017 -0400 net: Fix build regression in rtl8723bs staging driver. drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c: In function ‘rtw_cfg80211_add_monitor_if’: drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c:2670:10: error: ‘struct net_device’ has no member named ‘destructor’ mon_ndev->destructor = rtw_ndev_destructor; ^ Signed-off-by: David S. Miller drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 3 ++- drivers/staging/rtl8723bs/os_dep/os_intfs.c | 2 -- 2 files changed, 2 insertions(+), 3 deletions(-) commit 8f9bebc33dd718283183582fc4a762e178552fb8 Author: Paolo Valente Date: Mon Jun 5 10:11:15 2017 +0200 block, bfq: access and cache blkg data only when safe In blk-cgroup, operations on blkg objects are protected with the request_queue lock. This is no more the lock that protects I/O-scheduler operations in blk-mq. In fact, the latter are now protected with a finer-grained per-scheduler-instance lock. As a consequence, although blkg lookups are also rcu-protected, blk-mq I/O schedulers may see inconsistent data when they access blkg and blkg-related objects. BFQ does access these objects, and does incur this problem, in the following case. The blkg_lookup performed in bfq_get_queue, being protected (only) through rcu, may happen to return the address of a copy of the original blkg. If this is the case, then the blkg_get performed in bfq_get_queue, to pin down the blkg, is useless: it does not prevent blk-cgroup code from destroying both the original blkg and all objects directly or indirectly referred by the copy of the blkg. BFQ accesses these objects, which typically causes a crash for NULL-pointer dereference of memory-protection violation. Some additional protection mechanism should be added to blk-cgroup to address this issue. In the meantime, this commit provides a quick temporary fix for BFQ: cache (when safe) blkg data that might disappear right after a blkg_lookup. In particular, this commit exploits the following facts to achieve its goal without introducing further locks. Destroy operations on a blkg invoke, as a first step, hooks of the scheduler associated with the blkg. And these hooks are executed with bfqd->lock held for BFQ. As a consequence, for any blkg associated with the request queue an instance of BFQ is attached to, we are guaranteed that such a blkg is not destroyed, and that all the pointers it contains are consistent, while that instance is holding its bfqd->lock. A blkg_lookup performed with bfqd->lock held then returns a fully consistent blkg, which remains consistent until this lock is held. In more detail, this holds even if the returned blkg is a copy of the original one. Finally, also the object describing a group inside BFQ needs to be protected from destruction on the blkg_free of the original blkg (which invokes bfq_pd_free). This commit adds private refcounting for this object, to let it disappear only after no bfq_queue refers to it any longer. This commit also removes or updates some stale comments on locking issues related to blk-cgroup operations. Reported-by: Tomas Konir Reported-by: Lee Tibbert Reported-by: Marco Piazza Signed-off-by: Paolo Valente Tested-by: Tomas Konir Tested-by: Lee Tibbert Tested-by: Marco Piazza Signed-off-by: Jens Axboe block/bfq-cgroup.c | 116 +++++++++++++++++++++++++++++++++++++++++----------- block/bfq-iosched.c | 2 +- block/bfq-iosched.h | 23 +++++------ 3 files changed, 105 insertions(+), 36 deletions(-) commit bcdaa2b8a640d6e3d29d3257434fe741fcba4a9c Merge: 8397ed3 4f19c0d Author: David S. Miller Date: Thu Jun 8 11:45:49 2017 -0400 Merge branch 'netvsc-bug-fixes' Stephen Hemminger says: ==================== netvsc: bug fixes These are bugfixes for netvsc driver in 4.12. ==================== Signed-off-by: David S. Miller commit 4f19c0d8070cd4aa8e85bbf8a19d9ef5bef77c90 Author: stephen hemminger Date: Wed Jun 7 15:53:49 2017 -0700 netvsc: move filter setting to rndis_device The work queue and handling of network filter parameters should be in rndis_device. This gets rid of warning from RCU checks, eliminates a race and cleans up code. Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller drivers/net/hyperv/hyperv_net.h | 5 +++-- drivers/net/hyperv/netvsc_drv.c | 33 ++------------------------------- drivers/net/hyperv/rndis_filter.c | 30 +++++++++++++++++++++++++++++- 3 files changed, 34 insertions(+), 34 deletions(-) commit a5ecd43992a7cd9f91d5f98b0082ae44df5e543c Author: stephen hemminger Date: Wed Jun 7 15:53:48 2017 -0700 netvsc: fix net poll mode The ndo_poll_controller function needs to schedule NAPI to pick up arriving packets and send completions. Otherwise no data will ever be received. For simple case of netconsole, it also will allow send completions to happen. Without this netpoll will eventually get stuck. Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller drivers/net/hyperv/netvsc_drv.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) commit fbd4c7e768f1719bea340e40148800279d230922 Author: stephen hemminger Date: Wed Jun 7 15:53:47 2017 -0700 netvsc: fix rcu dereference warning from ethtool The ethtool info command calls the netvsc get_sset_count with RTNL but not with RCU. Which causes warning: drivers/net/hyperv/netvsc_drv.c:1010 suspicious rcu_dereference_check() usage! Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller drivers/net/hyperv/netvsc_drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1123a6041654e8f889014659593bad4168e542c2 Author: Paolo Bonzini Date: Wed May 31 14:03:11 2017 +0200 srcu: Allow use of Classic SRCU from both process and interrupt context Linu Cherian reported a WARN in cleanup_srcu_struct() when shutting down a guest running iperf on a VFIO assigned device. This happens because irqfd_wakeup() calls srcu_read_lock(&kvm->irq_srcu) in interrupt context, while a worker thread does the same inside kvm_set_irq(). If the interrupt happens while the worker thread is executing __srcu_read_lock(), updates to the Classic SRCU ->lock_count[] field or the Tree SRCU ->srcu_lock_count[] field can be lost. The docs say you are not supposed to call srcu_read_lock() and srcu_read_unlock() from irq context, but KVM interrupt injection happens from (host) interrupt context and it would be nice if SRCU supported the use case. KVM is using SRCU here not really for the "sleepable" part, but rather due to its IPI-free fast detection of grace periods. It is therefore not desirable to switch back to RCU, which would effectively revert commit 719d93cd5f5c ("kvm/irqchip: Speed up KVM_SET_GSI_ROUTING", 2014-01-16). However, the docs are overly conservative. You can have an SRCU instance only has users in irq context, and you can mix process and irq context as long as process context users disable interrupts. In addition, __srcu_read_unlock() actually uses this_cpu_dec() on both Tree SRCU and Classic SRCU. For those two implementations, only srcu_read_lock() is unsafe. When Classic SRCU's __srcu_read_unlock() was changed to use this_cpu_dec(), in commit 5a41344a3d83 ("srcu: Simplify __srcu_read_unlock() via this_cpu_dec()", 2012-11-29), __srcu_read_lock() did two increments. Therefore it kept __this_cpu_inc(), with preempt_disable/enable in the caller. Tree SRCU however only does one increment, so on most architectures it is more efficient for __srcu_read_lock() to use this_cpu_inc(), and any performance differences appear to be down in the noise. Cc: stable@vger.kernel.org Fixes: 719d93cd5f5c ("kvm/irqchip: Speed up KVM_SET_GSI_ROUTING") Reported-by: Linu Cherian Suggested-by: Linu Cherian Cc: kvm@vger.kernel.org Signed-off-by: Paolo Bonzini Cc: Linus Torvalds Signed-off-by: Paul E. McKenney include/linux/srcu.h | 2 -- kernel/rcu/srcu.c | 5 ++--- 2 files changed, 2 insertions(+), 5 deletions(-) commit cdf7abc4610a7f1c43d06cda246c5f748a4fd267 Author: Paolo Bonzini Date: Wed May 31 14:03:10 2017 +0200 srcu: Allow use of Tiny/Tree SRCU from both process and interrupt context Linu Cherian reported a WARN in cleanup_srcu_struct() when shutting down a guest running iperf on a VFIO assigned device. This happens because irqfd_wakeup() calls srcu_read_lock(&kvm->irq_srcu) in interrupt context, while a worker thread does the same inside kvm_set_irq(). If the interrupt happens while the worker thread is executing __srcu_read_lock(), updates to the Classic SRCU ->lock_count[] field or the Tree SRCU ->srcu_lock_count[] field can be lost. The docs say you are not supposed to call srcu_read_lock() and srcu_read_unlock() from irq context, but KVM interrupt injection happens from (host) interrupt context and it would be nice if SRCU supported the use case. KVM is using SRCU here not really for the "sleepable" part, but rather due to its IPI-free fast detection of grace periods. It is therefore not desirable to switch back to RCU, which would effectively revert commit 719d93cd5f5c ("kvm/irqchip: Speed up KVM_SET_GSI_ROUTING", 2014-01-16). However, the docs are overly conservative. You can have an SRCU instance only has users in irq context, and you can mix process and irq context as long as process context users disable interrupts. In addition, __srcu_read_unlock() actually uses this_cpu_dec() on both Tree SRCU and Classic SRCU. For those two implementations, only srcu_read_lock() is unsafe. When Classic SRCU's __srcu_read_unlock() was changed to use this_cpu_dec(), in commit 5a41344a3d83 ("srcu: Simplify __srcu_read_unlock() via this_cpu_dec()", 2012-11-29), __srcu_read_lock() did two increments. Therefore it kept __this_cpu_inc(), with preempt_disable/enable in the caller. Tree SRCU however only does one increment, so on most architectures it is more efficient for __srcu_read_lock() to use this_cpu_inc(), and any performance differences appear to be down in the noise. Unlike Classic and Tree SRCU, Tiny SRCU does increments and decrements on a single variable. Therefore, as Peter Zijlstra pointed out, Tiny SRCU's implementation already supports mixed-context use of srcu_read_lock() and srcu_read_unlock(), at least as long as uses of srcu_read_lock() and srcu_read_unlock() in each handler are nested and paired properly. In other words, it is still illegal to (say) invoke srcu_read_lock() in an interrupt handler and to invoke the matching srcu_read_unlock() in a softirq handler. Therefore, the only change required for Tiny SRCU is to its comments. Fixes: 719d93cd5f5c ("kvm/irqchip: Speed up KVM_SET_GSI_ROUTING") Reported-by: Linu Cherian Suggested-by: Linu Cherian Cc: kvm@vger.kernel.org Signed-off-by: Paolo Bonzini Cc: Linus Torvalds Signed-off-by: Paul E. McKenney Tested-by: Paolo Bonzini kernel/rcu/srcutiny.c | 7 ++++--- kernel/rcu/srcutree.c | 5 ++--- 2 files changed, 6 insertions(+), 6 deletions(-) commit 95989c46d2a156365867b1d795fdefce71bce378 Author: Brian Foster Date: Thu Jun 8 08:23:07 2017 -0700 xfs: fix spurious spin_is_locked() assert failures on non-smp kernels The 0-day kernel test robot reports assertion failures on !CONFIG_SMP kernels due to failed spin_is_locked() checks. As it turns out, spin_is_locked() is hardcoded to return zero on !CONFIG_SMP kernels and so this function cannot be relied on to verify spinlock state in this configuration. To avoid this problem, replace the associated asserts with lockdep variants that do the right thing regardless of kernel configuration. Drop the one assert that checks for an unlocked lock as there is no suitable lockdep variant for that case. This moves the spinlock checks from XFS debug code to lockdep, but generally provides the same level of protection. Reported-by: kbuild test robot Signed-off-by: Brian Foster Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/xfs_buf.c | 2 +- fs/xfs/xfs_icache.c | 5 ++--- 2 files changed, 3 insertions(+), 4 deletions(-) commit 8397ed36b7c585f8d3e06c431f4137309124f78f Author: David Ahern Date: Wed Jun 7 12:26:23 2017 -0600 net: ipv6: Release route when device is unregistering Roopa reported attempts to delete a bond device that is referenced in a multipath route is hanging: $ ifdown bond2 # ifupdown2 command that deletes virtual devices unregister_netdevice: waiting for bond2 to become free. Usage count = 2 Steps to reproduce: echo 1 > /proc/sys/net/ipv6/conf/all/ignore_routes_with_linkdown ip link add dev bond12 type bond ip link add dev bond13 type bond ip addr add 2001:db8:2::0/64 dev bond12 ip addr add 2001:db8:3::0/64 dev bond13 ip route add 2001:db8:33::0/64 nexthop via 2001:db8:2::2 nexthop via 2001:db8:3::2 ip link del dev bond12 ip link del dev bond13 The root cause is the recent change to keep routes on a linkdown. Update the check to detect when the device is unregistering and release the route for that case. Fixes: a1a22c12060e4 ("net: ipv6: Keep nexthop of multipath route on admin down") Reported-by: Roopa Prabhu Signed-off-by: David Ahern Acked-by: Roopa Prabhu Signed-off-by: David S. Miller include/linux/netdevice.h | 5 +++++ net/ipv6/route.c | 1 + 2 files changed, 6 insertions(+) commit 0eed9cf58446b28b233388b7f224cbca268b6986 Author: Mintz, Yuval Date: Wed Jun 7 21:00:33 2017 +0300 net: Zero ifla_vf_info in rtnl_fill_vfinfo() Some of the structure's fields are not initialized by the rtnetlink. If driver doesn't set those in ndo_get_vf_config(), they'd leak memory to user. Signed-off-by: Yuval Mintz CC: Michal Schmidt Reviewed-by: Greg Rose Signed-off-by: David S. Miller net/core/rtnetlink.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit dd0da17b209ed91f39872766634ca967c170ada1 Author: Mateusz Jurczyk Date: Wed Jun 7 16:14:29 2017 +0200 decnet: dn_rtmsg: Improve input length sanitization in dnrmg_receive_user_skb Verify that the length of the socket buffer is sufficient to cover the nlmsghdr structure before accessing the nlh->nlmsg_len field for further input sanitization. If the client only supplies 1-3 bytes of data in sk_buff, then nlh->nlmsg_len remains partially uninitialized and contains leftover memory from the corresponding kernel allocation. Operating on such data may result in indeterminate evaluation of the nlmsg_len < sizeof(*nlh) expression. The bug was discovered by a runtime instrumentation designed to detect use of uninitialized memory in the kernel. The patch prevents this and other similar tools (e.g. KMSAN) from flagging this behavior in the future. Signed-off-by: Mateusz Jurczyk Signed-off-by: David S. Miller net/decnet/netfilter/dn_rtmsg.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit c164772dd32343ee19e276ce0137830557517834 Author: David S. Miller Date: Thu Jun 8 10:50:18 2017 -0400 Revert "decnet: dn_rtmsg: Improve input length sanitization in dnrmg_receive_user_skb" This reverts commit 85eac2ba35a2dbfbdd5767c7447a4af07444a5b4. There is an updated version of this fix which we should use instead. Signed-off-by: David S. Miller net/decnet/netfilter/dn_rtmsg.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 9065bc386fcf52dee8f697450ddeb788e1bd514c Author: Christian Lamparter Date: Wed Jun 7 15:51:16 2017 +0200 net: emac: fix and unify emac_mdio functions emac_mdio_read_link() was not copying the requested phy settings back into the emac driver's own phy api. This has caused a link speed mismatch issue for the AR8035 as the emac driver kept trying to connect with 10/100MBps on a 1GBit/s link. This patch also unifies shared code between emac_setup_aneg() and emac_mdio_setup_forced(). And furthermore it removes a chunk of emac_mdio_init_phy(), that was copying the same data into itself. Signed-off-by: Christian Lamparter Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/ethernet/ibm/emac/core.c | 41 ++++++++++++++++-------------------- 1 file changed, 18 insertions(+), 23 deletions(-) commit 19d90ece81da802207a9b91ce95a29fbdc40626e Author: Christian Lamparter Date: Wed Jun 7 15:51:15 2017 +0200 net: emac: fix reset timeout with AR8035 phy This patch fixes a problem where the AR8035 PHY can't be detected on an Cisco Meraki MR24, if the ethernet cable is not connected on boot. Russell Senior provided steps to reproduce the issue: |Disconnect ethernet cable, apply power, wait until device has booted, |plug in ethernet, check for interfaces, no eth0 is listed. | |This appears to be a problem during probing of the AR8035 Phy chip. |When ethernet has no link, the phy detection fails, and eth0 is not |created. Plugging ethernet later has no effect, because there is no |interface as far as the kernel is concerned. The relevant part of |the boot log looks like this: |this is the failing case: | |[ 0.876611] /plb/opb/emac-rgmii@ef601500: input 0 in RGMII mode |[ 0.882532] /plb/opb/ethernet@ef600c00: reset timeout |[ 0.888546] /plb/opb/ethernet@ef600c00: can't find PHY! |and the succeeding case: | |[ 0.876672] /plb/opb/emac-rgmii@ef601500: input 0 in RGMII mode |[ 0.883952] eth0: EMAC-0 /plb/opb/ethernet@ef600c00, MAC 00:01:.. |[ 0.890822] eth0: found Atheros 8035 Gigabit Ethernet PHY (0x01) Based on the comment and the commit message of commit 23fbb5a87c56 ("emac: Fix EMAC soft reset on 460EX/GT"). This is because the AR8035 PHY doesn't provide the TX Clock, if the ethernet cable is not attached. This causes the reset to timeout and the PHY detection code in emac_init_phy() is unable to detect the AR8035 PHY. As a result, the emac driver bails out early and the user left with no ethernet. In order to stay compatible with existing configurations, the driver tries the current reset approach at first. Only if the first attempt timed out, it does perform one more retry with the clock temporarily switched to the internal source for just the duration of the reset. LEDE-Bug: #687 Cc: Chris Blake Reported-by: Russell Senior Fixes: 23fbb5a87c56e98 ("emac: Fix EMAC soft reset on 460EX/GT") Signed-off-by: Christian Lamparter Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/ethernet/ibm/emac/core.c | 26 ++++++++++++++++++++++---- 1 file changed, 22 insertions(+), 4 deletions(-) commit 85eac2ba35a2dbfbdd5767c7447a4af07444a5b4 Author: Mateusz Jurczyk Date: Wed Jun 7 15:14:29 2017 +0200 decnet: dn_rtmsg: Improve input length sanitization in dnrmg_receive_user_skb Verify that the length of the socket buffer is sufficient to cover the entire nlh->nlmsg_len field before accessing that field for further input sanitization. If the client only supplies 1-3 bytes of data in sk_buff, then nlh->nlmsg_len remains partially uninitialized and contains leftover memory from the corresponding kernel allocation. Operating on such data may result in indeterminate evaluation of the nlmsg_len < sizeof(*nlh) expression. The bug was discovered by a runtime instrumentation designed to detect use of uninitialized memory in the kernel. The patch prevents this and other similar tools (e.g. KMSAN) from flagging this behavior in the future. Signed-off-by: Mateusz Jurczyk Signed-off-by: David S. Miller net/decnet/netfilter/dn_rtmsg.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 9e53932d888b7f32475db72f859f8f38cc2135fb Merge: a364163 1ba15b2 Author: Paolo Bonzini Date: Thu Jun 8 16:35:18 2017 +0200 Merge tag 'kvm-s390-master-4.12-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD KVM: s390: Fix for master (4.12) - The newly created AIS capability enables the feature unconditionally and ignores the cpu model commit 85d0331aedff4646b2a2b14561c8be3678ffcee2 Merge: 6460495 9947d6a Author: Jens Axboe Date: Thu Jun 8 08:33:45 2017 -0600 Merge branch 'nvme-4.12' of git://git.infradead.org/nvme into for-linus Christoph writes: "A few NVMe fixes for 4.12-rc, PCIe reset fixes and APST fixes, a RDMA reconnect fix, two FC fixes and a general controller removal fix." commit ed66e50d9587fc0bb032e276a2563c0068a5b63a Author: David S. Miller Date: Thu Jun 8 10:16:05 2017 -0400 hsi: Fix build regression due to netdev destructor fix. > ../drivers/hsi/clients/ssi_protocol.c:1069:5: error: 'struct net_device' has no member named 'destructor' Reported-by: Mark Brown Reported-by: Stephen Rothwell Signed-off-by: David S. Miller drivers/hsi/clients/ssi_protocol.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cd1997f6c11483da819a7719aa013093b8003743 Author: Stephen Rothwell Date: Thu Jun 8 19:06:29 2017 +1000 net: s390: fix up for "Fix inconsistent teardown and release of private netdev state" Signed-off-by: Stephen Rothwell Signed-off-by: David S. Miller drivers/s390/net/netiucv.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit ef6c4d75e35345f8f362d6754bcd9a28292a897c Author: Jani Nikula Date: Thu Jun 8 16:58:23 2017 +0300 drm/i915: fix warning for unused variable drivers/gpu/drm/i915/intel_engine_cs.c: In function ‘intel_engine_is_idle’: drivers/gpu/drm/i915/intel_engine_cs.c:1103:27: error: unused variable ‘dev_priv’ [-Werror=unused-variable] struct drm_i915_private *dev_priv = engine->i915; ^~~~~~~~ Reviewed-by: Chris Wilson Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_engine_cs.c | 2 -- 1 file changed, 2 deletions(-) commit 6460495709aeb651896bc8e5c134b2e4ca7d34a8 Author: James Wang Date: Thu Jun 8 14:52:51 2017 +0800 Fix loop device flush before configure v3 While installing SLES-12 (based on v4.4), I found that the installer will stall for 60+ seconds during LVM disk scan. The root cause was determined to be the removal of a bound device check in loop_flush() by commit b5dd2f6047ca ("block: loop: improve performance via blk-mq"). Restoring this check, examining ->lo_state as set by loop_set_fd() eliminates the bad behavior. Test method: modprobe loop max_loop=64 dd if=/dev/zero of=disk bs=512 count=200K for((i=0;i<4;i++))do losetup -f disk; done mkfs.ext4 -F /dev/loop0 for((i=0;i<4;i++))do mkdir t$i; mount /dev/loop$i t$i;done for f in `ls /dev/loop[0-9]*|sort`; do \ echo $f; dd if=$f of=/dev/null bs=512 count=1; \ done Test output: stock patched /dev/loop0 18.1217e-05 8.3842e-05 /dev/loop1 6.1114e-05 0.000147979 /dev/loop10 0.414701 0.000116564 /dev/loop11 0.7474 6.7942e-05 /dev/loop12 0.747986 8.9082e-05 /dev/loop13 0.746532 7.4799e-05 /dev/loop14 0.480041 9.3926e-05 /dev/loop15 1.26453 7.2522e-05 Note that from loop10 onward, the device is not mounted, yet the stock kernel consumes several orders of magnitude more wall time than it does for a mounted device. (Thanks for Mike Galbraith , give a changelog review.) Reviewed-by: Hannes Reinecke Reviewed-by: Ming Lei Signed-off-by: James Wang Fixes: b5dd2f6047ca ("block: loop: improve performance via blk-mq") Signed-off-by: Jens Axboe drivers/block/loop.c | 3 +++ 1 file changed, 3 insertions(+) commit 16ddcc34b8bde5d9257114a16565fac73237bef9 Author: Martin Schwidefsky Date: Tue Jan 17 12:32:15 2017 +0100 s390: update defconfig Signed-off-by: Martin Schwidefsky arch/s390/configs/default_defconfig | 39 ++++++++++++++++++++++++++++----- arch/s390/configs/gcov_defconfig | 28 +++++++++++++++++++---- arch/s390/configs/performance_defconfig | 27 +++++++++++++++++++---- arch/s390/configs/zfcpdump_defconfig | 6 +++-- arch/s390/defconfig | 8 +++---- 5 files changed, 87 insertions(+), 21 deletions(-) commit 698b851073ddf5a894910d63ca04605e0473414e Author: Marcin Nowakowski Date: Thu Jun 8 15:20:32 2017 +0200 MIPS: kprobes: flush_insn_slot should flush only if probe initialised When ftrace is used with kprobes, it is possible for a kprobe to contain an invalid location (ie. only initialised to 0 and not to a specific location in the code). Trying to perform a cache flush on such location leads to a crash r4k_flush_icache_range(). Fixes: c1bf207d6ee1 ("MIPS: kprobe: Add support.") Signed-off-by: Marcin Nowakowski Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/16296/ Signed-off-by: Ralf Baechle arch/mips/include/asm/kprobes.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit a3641631d14571242eec0d30c9faa786cbf52d44 Author: Wanpeng Li Date: Thu Jun 8 01:22:07 2017 -0700 KVM: cpuid: Fix read/write out-of-bounds vulnerability in cpuid emulation If "i" is the last element in the vcpu->arch.cpuid_entries[] array, it potentially can be exploited the vulnerability. this will out-of-bounds read and write. Luckily, the effect is small: /* when no next entry is found, the current entry[i] is reselected */ for (j = i + 1; ; j = (j + 1) % nent) { struct kvm_cpuid_entry2 *ej = &vcpu->arch.cpuid_entries[j]; if (ej->function == e->function) { It reads ej->maxphyaddr, which is user controlled. However... ej->flags |= KVM_CPUID_FLAG_STATE_READ_NEXT; After cpuid_entries there is int maxphyaddr; struct x86_emulate_ctxt emulate_ctxt; /* 16-byte aligned */ So we have: - cpuid_entries at offset 1B50 (6992) - maxphyaddr at offset 27D0 (6992 + 3200 = 10192) - padding at 27D4...27DF - emulate_ctxt at 27E0 And it writes in the padding. Pfew, writing the ops field of emulate_ctxt would have been much worse. This patch fixes it by modding the index to avoid the out-of-bounds access. Worst case, i == j and ej->function == e->function, the loop can bail out. Reported-by: Moguofang Cc: Paolo Bonzini Cc: Radim Krčmář Cc: Guofang Mo Cc: stable@vger.kernel.org Signed-off-by: Wanpeng Li Signed-off-by: Paolo Bonzini arch/x86/kvm/cpuid.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) commit 38a4f43d5698daec601f4c5652ec287e594faf84 Merge: d491221 33b5c38 Author: Paolo Bonzini Date: Thu Jun 8 15:04:38 2017 +0200 Merge tag 'kvm-arm-for-v4.12-rc5-take2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/ARM Fixes for v4.12-rc5 - Take 2 Changes include: - Fix an issue with migrating GICv2 VMs on GICv3 systems. - Squashed a bug for gicv3 when figuring out preemption levels. - Fix a potential null pointer derefence in KVM happening under memory pressure. - Maintain RES1 bits in the SCTLR_EL2 to make sure KVM works on new architecture revisions. - Allow unaligned accesses at EL2/HYP commit 87051ec120bb9abd9e57aecf2569c00d587b6f33 Author: Marcin Nowakowski Date: Tue May 23 12:56:43 2017 +0200 MIPS: ftrace: fix init functions tracing Since introduction of tracing for init functions the in_kernel_space() check is no longer correct, as it ignores the init sections. As a result, when probes are inserted (and disabled) in the init functions, a branch instruction is inserted instead of a nop, which is likely to result in random crashes during boot. Remove the MIPS-specific in_kernel_space() method and replace it with a generic core_kernel_text() that also checks for init sections during system boot stage. Fixes: 42c269c88dc1 ("ftrace: Allow for function tracing to record init functions on boot up") Signed-off-by: Marcin Nowakowski Tested-by: Matt Redfearn Cc: Steven Rostedt Cc: Ingo Molnar Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/16092/ Signed-off-by: Ralf Baechle arch/mips/kernel/ftrace.c | 24 +++++------------------- 1 file changed, 5 insertions(+), 19 deletions(-) commit c56e7a4c3e77f6fbd9b55c06c14eda65aae58958 Author: Marcin Nowakowski Date: Tue Apr 11 09:00:36 2017 +0200 MIPS: mm: adjust PKMAP location Space reserved for PKMap should span from PKMAP_BASE to FIXADDR_START. For large page sizes this is not the case as eg. for 64k pages the range currently defined is from 0xfe000000 to 0x102000000(!!) which obviously isn't right. Remove the hardcoded location and set the BASE address as an offset from FIXADDR_START. Since all PKMAP ptes have to be placed in a contiguous memory, ensure that this is the case by placing them all in a single page. This is achieved by aligning the end address to pkmap pages count pages. Signed-off-by: Marcin Nowakowski Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/15950/ Signed-off-by: Ralf Baechle arch/mips/include/asm/pgtable-32.h | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 725a269b3dd149f36c206c218253336774ef26f5 Author: Marcin Nowakowski Date: Tue Apr 11 09:00:35 2017 +0200 MIPS: highmem: ensure that we don't use more than one page for PTEs All PTEs used by PKMAP should be allocated in a contiguous memory area, but we do not currently have a mechanism to enforce that, so ensure that we don't try to allocate more entries than would fit in a single page. Current fixed value of 1024 would not work with XPA enabled when sizeof(pte_t)==8 and we need two pages to store pte tables. Signed-off-by: Marcin Nowakowski Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/15949/ Signed-off-by: Ralf Baechle arch/mips/include/asm/highmem.h | 5 +++++ 1 file changed, 5 insertions(+) commit 71eb989ab5a110df8bcbb9609bacde73feacbedd Author: Marcin Nowakowski Date: Tue Apr 11 09:00:34 2017 +0200 MIPS: mm: fixed mappings: correct initialisation fixrange_init operates at PMD-granularity and expects the addresses to be PMD-size aligned, but currently that might not be the case for PKMAP_BASE unless it is defined properly, so ensure a correct alignment is used before passing the address to fixrange_init. fixed mappings: only align the start address that is passed to fixrange_init rather than the value before adding the size, as we may end up with uninitialised upper part of the range. Signed-off-by: Marcin Nowakowski Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/15948/ Signed-off-by: Ralf Baechle arch/mips/mm/pgtable-32.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit f7a31b5e7874f77464a4eae0a8ba84b9ae0b3a54 Author: Marcin Nowakowski Date: Wed Apr 19 14:07:43 2017 +0200 MIPS: perf: Remove incorrect odd/even counter handling for I6400 All performance counters on I6400 (odd and even) are capable of counting any of the available events, so drop current logic of using the extra bit to determine which counter to use. Signed-off-by: Marcin Nowakowski Fixes: 4e88a8621301 ("MIPS: Add cases for CPU_I6400") Fixes: fd716fca10fc ("MIPS: perf: Fix I6400 event numbers") Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/15991/ Signed-off-by: Ralf Baechle arch/mips/kernel/perf_event_mipsxx.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit c6ee9619e2edd9912316f7e2eaf9ffa14fafe9f9 Author: Michael Ellerman Date: Thu Jun 8 16:29:59 2017 +1000 powerpc/book3s64: Move PPC_DT_CPU_FTRs and enable it by default The PPC_DT_CPU_FTRs is a bit misplaced in menuconfig, it shows up with other general kernel options. It's really more at home in the "Platform Support" section, so move it there. Also enable it by default, for Book3s 64. It does mostly nothing unless the device tree properties are found, and we will want it enabled eventually in distro kernels, so turn it on to start getting more testing. Fixes: 5a61ef74f269 ("powerpc/64s: Support new device tree binding for discovering CPU features") Signed-off-by: Michael Ellerman arch/powerpc/Kconfig | 11 ----------- arch/powerpc/platforms/Kconfig | 11 +++++++++++ 2 files changed, 11 insertions(+), 11 deletions(-) commit 92d9dfda8b547cc292af27e11e11c9eff3bb574f Author: Aneesh Kumar K.V Date: Thu Jun 1 20:05:04 2017 +0530 powerpc/mm/4k: Limit 4k page size config to 64TB virtual address space Supporting 512TB requires us to do a order 3 allocation for level 1 page table (pgd). This results in page allocation failures with certain workloads. For now limit 4k linux page size config to 64TB. Fixes: f6eedbba7a26 ("powerpc/mm/hash: Increase VA range to 128TB") Reported-by: Hugh Dickins Signed-off-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman arch/powerpc/include/asm/book3s/64/hash-4k.h | 2 +- arch/powerpc/include/asm/processor.h | 25 ++++++++++++------------- arch/powerpc/kernel/setup-common.c | 2 +- arch/powerpc/mm/mmu_context_book3s64.c | 2 +- 4 files changed, 15 insertions(+), 16 deletions(-) commit cec422c11caeeccae709e9942058b6b644ce434c Author: Frederic Barrat Date: Tue Jun 6 11:43:41 2017 +0200 cxl: Fix error path on bad ioctl Fix error path if we can't copy user structure on CXL_IOCTL_START_WORK ioctl. We shouldn't unlock the context status mutex as it was not locked (yet). Fixes: 0712dc7e73e5 ("cxl: Fix issues when unmapping contexts") Cc: stable@vger.kernel.org # v3.19+ Signed-off-by: Frederic Barrat Reviewed-by: Vaibhav Jain Reviewed-by: Andrew Donnellan Signed-off-by: Michael Ellerman drivers/misc/cxl/file.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) commit b94aac64a4c17c5af92f9b4ba7164c5b384d5c02 Author: Hans Verkuil Date: Wed Jun 7 12:07:51 2017 -0300 [media] cec: race fix: don't return -ENONET in cec_receive() When calling CEC_RECEIVE do not check if the adapter is configured. Typically CEC_RECEIVE is called after a select() and if that indicates that there are messages in the receive queue, then you should always be able to dequeue a message. The race condition here is that a message has been received and is queued, so select() tells userspace that a message is available. But before the application calls CEC_RECEIVE the adapter is unconfigured (e.g. the HDMI cable is removed). Now select will always report that there is a message, but calling CEC_RECEIVE will always return -ENONET because the adapter is no longer configured and so will never actually dequeue the message. There is really no need for this check, and in fact the ENONET error code was never documented for CEC_RECEIVE. This may have been a left-over of old code that was never updated. Signed-off-by: Hans Verkuil Cc: # for v4.10 and up Signed-off-by: Mauro Carvalho Chehab drivers/media/cec/cec-api.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) commit dac8bbbae1d0ccba96402d25deeed3a2e87992c6 Author: Petr Mladek Date: Thu Jun 8 12:01:30 2017 +0200 Revert "printk: fix double printing with earlycon" This reverts commit cf39bf58afdaabc0b86f141630fb3fd18190294e. The commit regression to users that define both console=ttyS1 and console=ttyS0 on the command line, see https://lkml.kernel.org/r/20170509082915.GA13236@bistromath.localdomain The kernel log messages always appeared only on one serial port. It is even documented in Documentation/admin-guide/serial-console.rst: "Note that you can only define one console per device type (serial, video)." The above mentioned commit changed the order in which the command line parameters are searched. As a result, the kernel log messages go to the last mentioned ttyS* instead of the first one. We long thought that using two console=ttyS* on the command line did not make sense. But then we realized that console= parameters were handled also by systemd, see http://0pointer.de/blog/projects/serial-console.html "By default systemd will instantiate one serial-getty@.service on the main kernel console, if it is not a virtual terminal." where "[4] If multiple kernel consoles are used simultaneously, the main console is the one listed first in /sys/class/tty/console/active, which is the last one listed on the kernel command line." This puts the original report into another light. The system is running in qemu. The first serial port is used to store the messages into a file. The second one is used to login to the system via a socket. It depends on systemd and the historic kernel behavior. By other words, systemd causes that it makes sense to define both console=ttyS1 console=ttyS0 on the command line. The kernel fix caused regression related to userspace (systemd) and need to be reverted. In addition, it went out that the fix helped only partially. The messages still were duplicated when the boot console was removed early by late_initcall(printk_late_init). Then the entire log was replayed when the same console was registered as a normal one. Link: 20170606160339.GC7604@pathway.suse.cz Cc: Aleksey Makarov Cc: Sabrina Dubroca Cc: Sudeep Holla Cc: Greg Kroah-Hartman Cc: Peter Hurley Cc: Jiri Slaby Cc: Robin Murphy , Cc: Steven Rostedt Cc: "Nair, Jayachandran" Cc: linux-serial@vger.kernel.org Cc: linux-kernel@vger.kernel.org Reported-by: Sabrina Dubroca Acked-by: Sergey Senozhatsky Signed-off-by: Petr Mladek kernel/printk/printk.c | 46 ++++++++++------------------------------------ 1 file changed, 10 insertions(+), 36 deletions(-) commit d41519a69b35b10af7fda867fb9100df24fdf403 Author: David Miller Date: Fri Jun 2 11:28:54 2017 -0400 crypto: Work around deallocated stack frame reference gcc bug on sparc. On sparc, if we have an alloca() like situation, as is the case with SHASH_DESC_ON_STACK(), we can end up referencing deallocated stack memory. The result can be that the value is clobbered if a trap or interrupt arrives at just the right instruction. It only occurs if the function ends returning a value from that alloca() area and that value can be placed into the return value register using a single instruction. For example, in lib/libcrc32c.c:crc32c() we end up with a return sequence like: return %i7+8 lduw [%o5+16], %o0 ! MEM[(u32 *)__shash_desc.1_10 + 16B], %o5 holds the base of the on-stack area allocated for the shash descriptor. But the return released the stack frame and the register window. So if an intererupt arrives between 'return' and 'lduw', then the value read at %o5+16 can be corrupted. Add a data compiler barrier to work around this problem. This is exactly what the gcc fix will end up doing as well, and it absolutely should not change the code generated for other cpus (unless gcc on them has the same bug :-) With crucial insight from Eric Sandeen. Cc: Reported-by: Anatoly Pugachev Signed-off-by: David S. Miller Signed-off-by: Herbert Xu drivers/infiniband/sw/rxe/rxe.h | 5 ++++- fs/btrfs/hash.c | 5 ++++- fs/f2fs/f2fs.h | 5 ++++- lib/libcrc32c.c | 6 ++++-- 4 files changed, 16 insertions(+), 5 deletions(-) commit cc1582c231ea041fbc68861dfaf957eaf902b829 Author: Jin Yao Date: Thu May 25 18:09:07 2017 +0800 perf/core: Drop kernel samples even though :u is specified When doing sampling, for example: perf record -e cycles:u ... On workloads that do a lot of kernel entry/exits we see kernel samples, even though :u is specified. This is due to skid existing. This might be a security issue because it can leak kernel addresses even though kernel sampling support is disabled. The patch drops the kernel samples if exclude_kernel is specified. For example, test on Haswell desktop: perf record -e cycles:u perf report --stdio Before patch applied: 99.77% mgen mgen [.] buf_read 0.20% mgen mgen [.] rand_buf_init 0.01% mgen [kernel.vmlinux] [k] apic_timer_interrupt 0.00% mgen mgen [.] last_free_elem 0.00% mgen libc-2.23.so [.] __random_r 0.00% mgen libc-2.23.so [.] _int_malloc 0.00% mgen mgen [.] rand_array_init 0.00% mgen [kernel.vmlinux] [k] page_fault 0.00% mgen libc-2.23.so [.] __random 0.00% mgen libc-2.23.so [.] __strcasestr 0.00% mgen ld-2.23.so [.] strcmp 0.00% mgen ld-2.23.so [.] _dl_start 0.00% mgen libc-2.23.so [.] sched_setaffinity@@GLIBC_2.3.4 0.00% mgen ld-2.23.so [.] _start We can see kernel symbols apic_timer_interrupt and page_fault. After patch applied: 99.79% mgen mgen [.] buf_read 0.19% mgen mgen [.] rand_buf_init 0.00% mgen libc-2.23.so [.] __random_r 0.00% mgen mgen [.] rand_array_init 0.00% mgen mgen [.] last_free_elem 0.00% mgen libc-2.23.so [.] vfprintf 0.00% mgen libc-2.23.so [.] rand 0.00% mgen libc-2.23.so [.] __random 0.00% mgen libc-2.23.so [.] _int_malloc 0.00% mgen libc-2.23.so [.] _IO_doallocbuf 0.00% mgen ld-2.23.so [.] do_lookup_x 0.00% mgen ld-2.23.so [.] open_verify.constprop.7 0.00% mgen ld-2.23.so [.] _dl_important_hwcaps 0.00% mgen libc-2.23.so [.] sched_setaffinity@@GLIBC_2.3.4 0.00% mgen ld-2.23.so [.] _start There are only userspace symbols. Signed-off-by: Jin Yao Signed-off-by: Peter Zijlstra (Intel) Cc: Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Thomas Gleixner Cc: Vince Weaver Cc: acme@kernel.org Cc: jolsa@kernel.org Cc: kan.liang@intel.com Cc: mark.rutland@arm.com Cc: will.deacon@arm.com Cc: yao.jin@intel.com Link: http://lkml.kernel.org/r/1495706947-3744-1-git-send-email-yao.jin@linux.intel.com Signed-off-by: Ingo Molnar kernel/events/core.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) commit 5b0bc9ac2ce4881ee318a21f31140584ce4dbdad Author: Dominik Brodowski Date: Wed Jun 7 11:58:19 2017 +0200 x86/microcode/intel: Clear patch pointer before jettisoning the initrd During early boot, load_ucode_intel_ap() uses __load_ucode_intel() to obtain a pointer to the relevant microcode patch (embedded in the initrd), and stores this value in 'intel_ucode_patch' to speed up the microcode patch application for subsequent CPUs. On resuming from suspend-to-RAM, however, load_ucode_ap() calls load_ucode_intel_ap() for each non-boot-CPU. By then the initramfs is long gone so the pointer stored in 'intel_ucode_patch' no longer points to a valid microcode patch. Clear that pointer so that we effectively fall back to the CPU hotplug notifier callbacks to update the microcode. Signed-off-by: Dominik Brodowski [ Edit and massage commit message. ] Signed-off-by: Borislav Petkov Cc: # 4.10.. Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/20170607095819.9754-1-bp@alien8.de Signed-off-by: Ingo Molnar arch/x86/kernel/cpu/microcode/intel.c | 3 +++ 1 file changed, 3 insertions(+) commit 462c5a826eba39fad819ccef916f9943ff42bf0d Author: Jessica Yu Date: Wed Jun 7 23:52:36 2017 -0700 MAINTAINERS: update email address for Jessica Yu I will be traveling in the upcoming months and it'll be much easier for me to access my kernel.org email rather than my work one. Change my email address in the MAINTAINERS file from jeyu@redhat.com to jeyu@kernel.org. Signed-off-by: Jessica Yu MAINTAINERS | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit b169c13de473a85b3c859bb36216a4cb5f00a54a Author: Jason A. Donenfeld Date: Wed Jun 7 19:45:31 2017 -0400 random: invalidate batched entropy after crng init It's possible that get_random_{u32,u64} is used before the crng has initialized, in which case, its output might not be cryptographically secure. For this problem, directly, this patch set is introducing the *_wait variety of functions, but even with that, there's a subtle issue: what happens to our batched entropy that was generated before initialization. Prior to this commit, it'd stick around, supplying bad numbers. After this commit, we force the entropy to be re-extracted after each phase of the crng has initialized. In order to avoid a race condition with the position counter, we introduce a simple rwlock for this invalidation. Since it's only during this awkward transition period, after things are all set up, we stop using it, so that it doesn't have an impact on performance. Signed-off-by: Jason A. Donenfeld Cc: Greg Kroah-Hartman Signed-off-by: Theodore Ts'o Cc: stable@vger.kernel.org # v4.11+ drivers/char/random.c | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) commit 14fc42fa1b3e7ea5160c84d0e686a3a0c1ffe619 Author: SeongJae Park Date: Tue May 30 20:18:25 2017 +0900 perf script python: Remove dups in documentation examples Few shell command examples in perf-script-python.txt has few nitpicks include: - tools/perf/scripts/python directory listing command is unnecessarily repeated. - few examples contain additional information in command prompt unnecessarily and inconsistently. This commit fixes them to enhance readability of the document. Signed-off-by: SeongJae Park Cc: Alexander Shishkin Cc: Frederic Weisbecker Cc: Peter Zijlstra Cc: Tom Zanussi Fixes: cff68e582237 ("perf/scripts: Add perf-trace-python Documentation") Link: http://lkml.kernel.org/r/20170530111827.21732-4-sj38.park@gmail.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/Documentation/perf-script-python.txt | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 1bf8d5a4a5da19b1f6e7958fe67db4118fa7a1c1 Author: SeongJae Park Date: Tue May 30 20:18:27 2017 +0900 perf script python: Updated trace_unhandled() signature Default function signature of trace_unhandled() got changed to include a field dict, but its documentation, perf-script-python.txt has not been updated. Fix it. Signed-off-by: SeongJae Park Cc: Alexander Shishkin Cc: Peter Zijlstra Cc: Pierre Tardy Fixes: c02514850d67 ("perf scripts python: Give field dict to unhandled callback") Link: http://lkml.kernel.org/r/20170530111827.21732-6-sj38.park@gmail.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/Documentation/perf-script-python.txt | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) commit 26ddb8722df865aa67fbe459107d2f3f8e5c6829 Author: SeongJae Park Date: Tue May 30 20:18:26 2017 +0900 perf script python: Fix wrong code snippets in documentation This commit fixes wrong code snippets for trace_begin() and trace_end() function example definition. Signed-off-by: SeongJae Park Cc: Alexander Shishkin Cc: Frederic Weisbecker Cc: Peter Zijlstra Cc: Tom Zanussi Fixes: cff68e582237 ("perf/scripts: Add perf-trace-python Documentation") Link: http://lkml.kernel.org/r/20170530111827.21732-5-sj38.park@gmail.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/Documentation/perf-script-python.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 34d4453dac257be53c21abf2f713c992fb692b5c Author: SeongJae Park Date: Tue May 30 20:18:24 2017 +0900 perf script: Fix documentation errors This commit fixes two errors in documents for perf-script-python and perf-script-perl as below: - /sys/kernel/debug/tracing events -> /sys/kernel/debug/tracing/events/ - trace_handled -> trace_unhandled Signed-off-by: SeongJae Park Cc: Alexander Shishkin Cc: Frederic Weisbecker Cc: Peter Zijlstra Cc: Tom Zanussi Fixes: cff68e582237 ("perf/scripts: Add perf-trace-python Documentation") Link: http://lkml.kernel.org/r/20170530111827.21732-3-sj38.park@gmail.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/Documentation/perf-script-perl.txt | 2 +- tools/perf/Documentation/perf-script-python.txt | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) commit c76132dc5182776b98e946d674cb41c421661ea9 Author: SeongJae Park Date: Tue May 30 20:18:23 2017 +0900 perf script: Fix outdated comment for perf-trace-python Script generated by the '--gen-script' option contains an outdated comment. It mentions a 'perf-trace-python' document while it has been renamed to 'perf-script-python'. Fix it. Signed-off-by: SeongJae Park Cc: Alexander Shishkin Cc: Peter Zijlstra Cc: Thomas Gleixner Fixes: 133dc4c39c57 ("perf: Rename 'perf trace' to 'perf script'") Link: http://lkml.kernel.org/r/20170530111827.21732-2-sj38.park@gmail.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/scripting-engines/trace-event-python.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d89269a89ebb6a74512f3f40e89cd12017f60a75 Author: SeongJae Park Date: Sun May 7 19:36:42 2017 +0900 perf probe: Fix examples section of documentation An example in perf-probe documentation for pattern of function name based probe addition is not providing example command for that case. This commit fixes the example to give appropriate example command. Signed-off-by: SeongJae Park Acked-by: Masami Hiramatsu Cc: Peter Zijlstra Cc: Taeung Song Fixes: ee391de876ae ("perf probe: Update perf probe document") Link: http://lkml.kernel.org/r/20170507103642.30560-1-sj38.park@gmail.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/Documentation/perf-probe.txt | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 92e75428ffc90e2a0321062379f883f3671cfebe Author: Theodore Ts'o Date: Wed Jun 7 19:01:32 2017 -0400 random: use lockless method of accessing and updating f->reg_idx Linus pointed out that there is a much more efficient way of avoiding the problem that we were trying to address in commit 9dfa7bba35ac0: "fix race in drivers/char/random.c:get_reg()". Signed-off-by: Theodore Ts'o drivers/char/random.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit cf124db566e6b036b8bcbe8decbed740bdfac8c6 Author: David S. Miller Date: Mon May 8 12:52:56 2017 -0400 net: Fix inconsistent teardown and release of private netdev state. Network devices can allocate reasources and private memory using netdev_ops->ndo_init(). However, the release of these resources can occur in one of two different places. Either netdev_ops->ndo_uninit() or netdev->destructor(). The decision of which operation frees the resources depends upon whether it is necessary for all netdev refs to be released before it is safe to perform the freeing. netdev_ops->ndo_uninit() presumably can occur right after the NETDEV_UNREGISTER notifier completes and the unicast and multicast address lists are flushed. netdev->destructor(), on the other hand, does not run until the netdev references all go away. Further complicating the situation is that netdev->destructor() almost universally does also a free_netdev(). This creates a problem for the logic in register_netdevice(). Because all callers of register_netdevice() manage the freeing of the netdev, and invoke free_netdev(dev) if register_netdevice() fails. If netdev_ops->ndo_init() succeeds, but something else fails inside of register_netdevice(), it does call ndo_ops->ndo_uninit(). But it is not able to invoke netdev->destructor(). This is because netdev->destructor() will do a free_netdev() and then the caller of register_netdevice() will do the same. However, this means that the resources that would normally be released by netdev->destructor() will not be. Over the years drivers have added local hacks to deal with this, by invoking their destructor parts by hand when register_netdevice() fails. Many drivers do not try to deal with this, and instead we have leaks. Let's close this hole by formalizing the distinction between what private things need to be freed up by netdev->destructor() and whether the driver needs unregister_netdevice() to perform the free_netdev(). netdev->priv_destructor() performs all actions to free up the private resources that used to be freed by netdev->destructor(), except for free_netdev(). netdev->needs_free_netdev is a boolean that indicates whether free_netdev() should be done at the end of unregister_netdevice(). Now, register_netdevice() can sanely release all resources after ndo_ops->ndo_init() succeeds, by invoking both ndo_ops->ndo_uninit() and netdev->priv_destructor(). And at the end of unregister_netdevice(), we invoke netdev->priv_destructor() and optionally call free_netdev(). Signed-off-by: David S. Miller drivers/net/bonding/bond_main.c | 6 +++--- drivers/net/caif/caif_hsi.c | 2 +- drivers/net/caif/caif_serial.c | 2 +- drivers/net/caif/caif_spi.c | 2 +- drivers/net/caif/caif_virtio.c | 2 +- drivers/net/can/slcan.c | 7 +++---- drivers/net/can/vcan.c | 2 +- drivers/net/can/vxcan.c | 2 +- drivers/net/dummy.c | 4 ++-- drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 2 +- drivers/net/geneve.c | 2 +- drivers/net/gtp.c | 2 +- drivers/net/hamradio/6pack.c | 2 +- drivers/net/hamradio/bpqether.c | 2 +- drivers/net/ifb.c | 4 ++-- drivers/net/ipvlan/ipvlan_main.c | 2 +- drivers/net/loopback.c | 4 ++-- drivers/net/macsec.c | 4 ++-- drivers/net/macvlan.c | 2 +- drivers/net/nlmon.c | 2 +- drivers/net/slip/slip.c | 7 +++---- drivers/net/team/team.c | 4 ++-- drivers/net/tun.c | 4 ++-- drivers/net/usb/cdc-phonet.c | 2 +- drivers/net/usb/qmi_wwan.c | 2 +- drivers/net/veth.c | 4 ++-- drivers/net/vrf.c | 2 +- drivers/net/vsockmon.c | 2 +- drivers/net/vxlan.c | 2 +- drivers/net/wan/dlci.c | 2 +- drivers/net/wan/hdlc_fr.c | 2 +- drivers/net/wan/lapbether.c | 2 +- drivers/net/wireless/ath/ath6kl/main.c | 2 +- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 1 - drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 3 ++- drivers/net/wireless/intersil/hostap/hostap_main.c | 2 +- drivers/net/wireless/mac80211_hwsim.c | 2 +- drivers/net/wireless/marvell/mwifiex/main.c | 2 +- drivers/staging/rtl8188eu/os_dep/mon.c | 2 +- drivers/usb/gadget/function/f_phonet.c | 2 +- include/linux/netdevice.h | 7 ++++--- net/8021q/vlan_dev.c | 4 ++-- net/batman-adv/soft-interface.c | 5 ++--- net/bluetooth/6lowpan.c | 2 +- net/bridge/br_device.c | 2 +- net/caif/chnl_net.c | 4 ++-- net/core/dev.c | 8 ++++++-- net/hsr/hsr_device.c | 4 ++-- net/ieee802154/6lowpan/core.c | 2 +- net/ipv4/ip_tunnel.c | 4 ++-- net/ipv4/ipmr.c | 2 +- net/ipv6/ip6_gre.c | 9 +++++---- net/ipv6/ip6_tunnel.c | 8 ++++---- net/ipv6/ip6_vti.c | 8 ++++---- net/ipv6/ip6mr.c | 2 +- net/ipv6/sit.c | 6 +++--- net/irda/irlan/irlan_eth.c | 2 +- net/l2tp/l2tp_eth.c | 2 +- net/mac80211/iface.c | 6 +++--- net/mac802154/iface.c | 7 +++---- net/openvswitch/vport-internal_dev.c | 4 ++-- net/phonet/pep-gprs.c | 2 +- 62 files changed, 105 insertions(+), 103 deletions(-) commit 7005cade1bdbb423413f8aafcbf17a1ec614a585 Author: Daniel Borkmann Date: Wed Jun 7 13:45:37 2017 +0200 bpf, arm64: use separate register for state in stxr Will reported that in BPF_XADD we must use a different register in stxr instruction for the status flag due to otherwise CONSTRAINED UNPREDICTABLE behavior per architecture. Reference manual says [1]: If s == t, then one of the following behaviors must occur: * The instruction is UNDEFINED. * The instruction executes as a NOP. * The instruction performs the store to the specified address, but the value stored is UNKNOWN. Thus, use a different temporary register for the status flag to fix it. Disassembly extract from test 226/STX_XADD_DW from test_bpf.ko: [...] 0000003c: c85f7d4b ldxr x11, [x10] 00000040: 8b07016b add x11, x11, x7 00000044: c80c7d4b stxr w12, x11, [x10] 00000048: 35ffffac cbnz w12, 0x0000003c [...] [1] https://static.docs.arm.com/ddi0487/b/DDI0487B_a_armv8_arm.pdf, p.6132 Fixes: 85f68fe89832 ("bpf, arm64: implement jiting of BPF_XADD") Reported-by: Will Deacon Signed-off-by: Daniel Borkmann Acked-by: Will Deacon Signed-off-by: David S. Miller arch/arm64/net/bpf_jit_comp.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit e173db36e3090d90651d97ab4bc45ace7f8cc0c6 Author: Antoine Ténart Date: Wed Jun 7 08:17:50 2017 +0200 net: mvpp2: do not bypass the mvpp22_port_mii_set function The mvpp22_port_mii_set() function was added by 2697582144dd, but the function directly returns without doing anything. This return was used when debugging and wasn't removed before sending the patch. Fix this. Fixes: 2697582144dd ("net: mvpp2: handle misc PPv2.1/PPv2.2 differences") Signed-off-by: Antoine Tenart Acked-by: Thomas Petazzoni Signed-off-by: David S. Miller drivers/net/ethernet/marvell/mvpp2.c | 2 -- 1 file changed, 2 deletions(-) commit 3a807b751c66e76bff39da4a9bd9828d7866d025 Author: John Allen Date: Tue Jun 6 16:55:52 2017 -0500 ibmvnic: Return failure on attempted mtu change Changing the mtu is currently not supported in the ibmvnic driver. Implement .ndo_change_mtu in the driver so that attempting to use ifconfig to change the mtu will fail and present the user with an error message. Signed-off-by: John Allen Signed-off-by: David S. Miller drivers/net/ethernet/ibm/ibmvnic.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 79e25959403e6a79552db28a87abed34de32a1df Author: Roland Dreier Date: Tue Jun 6 09:22:00 2017 -0700 IB/addr: Fix setting source address in addr6_resolve() Commit eea40b8f624f ("infiniband: call ipv6 route lookup via the stub interface") introduced a regression in address resolution when connecting to IPv6 destination addresses. The old code called ip6_route_output(), while the new code calls ipv6_stub->ipv6_dst_lookup(). The two are almost the same, except that ipv6_dst_lookup() also calls ip6_route_get_saddr() if the source address is in6addr_any. This means that the test of ipv6_addr_any(&fl6.saddr) now never succeeds, and so we never copy the source address out. This ends up causing rdma_resolve_addr() to fail, because without a resolved source address, cma_acquire_dev() will fail to find an RDMA device to use. For me, this causes connecting to an NVMe over Fabrics target via RoCE / IPv6 to fail. Fix this by copying out fl6.saddr if ipv6_addr_any() is true for the original source address passed into addr6_resolve(). We can drop our call to ipv6_dev_get_saddr() because ipv6_dst_lookup() already does that work. Fixes: eea40b8f624 ("infiniband: call ipv6 route lookup via the stub interface") Cc: # 3.12+ Signed-off-by: Roland Dreier Acked-by: Paolo Abeni Signed-off-by: Doug Ledford drivers/infiniband/core/addr.c | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) commit 47eb0c8b4d9eb6368941c6a9bb443f00847a46d7 Author: Ulrik De Bie Date: Wed Jun 7 10:30:57 2017 -0700 Input: elantech - add Fujitsu Lifebook E546/E557 to force crc_enabled The Lifebook E546 and E557 touchpad were also not functioning and worked after running: echo "1" > /sys/devices/platform/i8042/serio2/crc_enabled Add them to the list of machines that need this workaround. Signed-off-by: Ulrik De Bie Reviewed-by: Arjan Opmeer Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov drivers/input/mouse/elantech.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) commit e4061d572cef1f990bb7761f45d00342daa27fbd Author: Michael S. Tsirkin Date: Tue Jun 6 19:01:37 2017 +0300 net: fix up hash documentation commit 61b905da33 ("net: Rename skb->rxhash to skb->hash") didn't update the documentation, fix this up. Cc: Tom Herbert Signed-off-by: Michael S. Tsirkin Signed-off-by: David S. Miller Documentation/networking/scaling.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 996652c7050c70008e4434af108be6f15f20fbd0 Author: Michal Schmidt Date: Tue Jun 6 16:30:31 2017 +0200 bnx2x: fix pf2vf bulletin DMA mapping leak When freeing VF's DMA mappings, an already NULLed pointer was checked again due to an apparent copy&paste error. Consequently, the pf2vf bulletin DMA mapping was not freed. Signed-off-by: Michal Schmidt Acked-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c28294b941232931fbd714099798eb7aa7e865d7 Author: Alexander Potapenko Date: Tue Jun 6 15:56:54 2017 +0200 net: don't call strlen on non-terminated string in dev_set_alias() KMSAN reported a use of uninitialized memory in dev_set_alias(), which was caused by calling strlcpy() (which in turn called strlen()) on the user-supplied non-terminated string. Signed-off-by: Alexander Potapenko Signed-off-by: David S. Miller net/core/dev.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 3e411b0ee7c7bf0cbe2bd5961f84a02f0451ad57 Merge: ba7b238 2538b9e Author: Ingo Molnar Date: Wed Jun 7 17:50:19 2017 +0200 Merge tag 'perf-urgent-for-mingo-4.12-20170606' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/urgent fixes from Arnaldo Carvalho de Melo: - Only print NMI watchdog hint in 'perf stat' when it is enabled (Andi Kleen) - Fix sys_mmap/sys_old_mmap shandling in s390 in 'perf trace' (Jiri Olsa) - Disable breakpoint signal tests in powerpc, that lacks the perf kernel glue to set breakpoint events and makes 'perf test' always fail (Jiri Olsa) - Fix 'perf annotate' for branch instruction with multiple operands (Kim Phillips) - Add missing powerpc triplet when disassembling with 'objdump' in 'perf annotate' (Kim Phillips) - Do not trow away partial unwound stacks when using libdw, making callchains produced with it similar to those produced when linked with the other DWARF unwind library supported in perf, libunwind (Milian Wolff) - Fixes to properly handle kernel modules when processing build-id meta events (Namhyung Kim) - Fix handling of compressed modules in the build-id cache (Namhyung Kim) - Fix 'perf annotate' failure when filename has special chars (Ravi Bangoria) Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit 6679a90c4b0dc2563383df1fe0eb170736952a2e Author: Shaohua Li Date: Tue Jun 6 12:40:43 2017 -0700 blk-throttle: set default latency baseline for harddisk hard disk IO latency varies a lot depending on spindle move. The latency range could be from several microseconds to several milliseconds. It's pretty hard to get the baseline latency used by io.low. We will use a different stragety here. The idea is only using IO with spindle move to determine if cgroup IO is in good state. For HD, if io latency is small (< 1ms), we ignore the IO. Such IO is likely from sequential IO, and is helpless to help determine if a cgroup's IO is impacted by other cgroups. With this, we only account IO with big latency. Then we can choose a hardcoded baseline latency for HD (4ms, which is typical IO latency with seek). With all these settings, the io.low latency works for both HD and SSD. Signed-off-by: Shaohua Li Signed-off-by: Jens Axboe block/blk-throttle.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) commit 8604889f83381cac42b849acc6c420af6df9b35b Author: Neil Armstrong Date: Mon May 29 16:15:52 2017 +0200 drm/meson: Fix driver bind when only CVBS is available While introducing HDMI support, component matching on connectors node were bypassed since no driver would actually bind on the DT node. But when only a CVBS connector is present, only a single node is found in the graph, but ignored and a NULL match table is given to the component code. This code permits bypassing the components framework by binding directly the DRM driver when no components needs to be loaded. Fixes: a41e82e6c457 ("drm/meson: Add support for components") Signed-off-by: Neil Armstrong Signed-off-by: Sean Paul Link: http://patchwork.freedesktop.org/patch/msgid/1496067352-8733-1-git-send-email-narmstrong@baylibre.com drivers/gpu/drm/meson/meson_drv.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) commit a41b816c174409417d91b4ceef0145c9f0bef67c Author: Joseph Qi Date: Wed Jun 7 11:36:14 2017 +0800 blk-throttle: fix NULL pointer dereference in throtl_schedule_pending_timer I have encountered a NULL pointer dereference in throtl_schedule_pending_timer: [ 413.735396] BUG: unable to handle kernel NULL pointer dereference at 0000000000000038 [ 413.735535] IP: [] throtl_schedule_pending_timer+0x3f/0x210 [ 413.735643] PGD 22c8cf067 PUD 22cb34067 PMD 0 [ 413.735713] Oops: 0000 [#1] SMP ...... This is caused by the following case: blk_throtl_bio throtl_schedule_next_dispatch <= sq is top level one without parent throtl_schedule_pending_timer sq_to_tg(sq)->td->throtl_slice <= sq_to_tg(sq) returns NULL Fix it by using sq_to_td instead of sq_to_tg(sq)->td, which will always return a valid td. Fixes: 297e3d854784 ("blk-throttle: make throtl_slice tunable") Signed-off-by: Joseph Qi Reviewed-by: Shaohua Li Signed-off-by: Jens Axboe block/blk-throttle.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1065467ed8e2601bf2d7018cf47c557ccbea3769 Author: Ville Syrjälä Date: Fri Mar 31 21:00:56 2017 +0300 drm/i915: Fix 90/270 rotated coordinates for FBC The clipped src coordinates have already been rotated by 270 degrees for when the plane rotation is 90/270 degrees, hence the FBC code should no longer swap the width and height. Cc: stable@vger.kernel.org Cc: Tvrtko Ursulin Cc: Paulo Zanoni Fixes: b63a16f6cd89 ("drm/i915: Compute display surface offset in the plane check hook for SKL+") Signed-off-by: Ville Syrjälä Link: http://patchwork.freedesktop.org/patch/msgid/20170331180056.14086-4-ville.syrjala@linux.intel.com Reviewed-by: Paulo Zanoni Tested-by: Tvrtko Ursulin Reviewed-by: Maarten Lankhorst (cherry picked from commit 73714c05df97d7527e7eaaa771472ef2ede46fa3) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_fbc.c | 19 +++++++------------ 1 file changed, 7 insertions(+), 12 deletions(-) commit 27fe407cb5122f12cfe976813686e8206425c32a Author: Ville Syrjälä Date: Tue Jun 6 16:32:29 2017 +0300 drm/i915: Restore has_fbc=1 for ILK-M Restore the lost has_fbc flag for mobile ILK. Cc: Carlos Santa Cc: Rodrigo Vivi Fixes: a13233804686 ("drm/i915: Introduce GEN5_FEATURES for device info") Signed-off-by: Ville Syrjälä Link: http://patchwork.freedesktop.org/patch/msgid/20170606133229.12439-1-ville.syrjala@linux.intel.com Reviewed-by: Rodrigo Vivi (cherry picked from commit c2d1a0ced2603c4a17fa9c53c37e415905cf5a6d) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8f4d38099b3098eae75f7755e1801931f8141350 Author: Ville Syrjälä Date: Thu Dec 15 19:47:34 2016 +0200 drm/i915: Workaround VLV/CHV DSI scanline counter hardware fail The scanline counter is bonkers on VLV/CHV DSI. The scanline counter increment is not lined up with the start of vblank like it is on every other platform and output type. This causes problems for both the vblank timestamping and atomic update vblank evasion. On my FFRD8 machine at least, the scanline counter increment happens about 1/3 of a scanline ahead of the start of vblank (which is where all register latching happens still). That means we can't trust the scanline counter to tell us whether we're in vblank or not while we're on that particular line. In order to keep vblank timestamping in working condition when called from the vblank irq, we'll leave scanline_offset at one, which means that the entire line containing the start of vblank is considered to be inside the vblank. For the vblank evasion we'll need to consider that entire line to be bad, since we can't tell whether the registers already got latched or not. And we can't actually use the start of vblank interrupt to get us past that line as the interrupt would fire too soon, and then we'd up waiting for the next start of vblank instead. One way around that would using the frame start interrupt instead since that wouldn't fire until the next scanline, but that would require some bigger changes in the interrupt code. So for simplicity we'll just poll until we get past the bad line. v2: Adjust the comments a bit Cc: stable@vger.kernel.org Cc: Jonas Aaberg Tested-by: Jonas Aaberg Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=99086 Signed-off-by: Ville Syrjälä Link: http://patchwork.freedesktop.org/patch/msgid/20161215174734.28779-1-ville.syrjala@linux.intel.com Tested-by: Mika Kahola Reviewed-by: Mika Kahola (cherry picked from commit ec1b4ee2834e66884e5b0d3d465f347ff212e372) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_display.c | 9 +++++++++ drivers/gpu/drm/i915/intel_sprite.c | 21 +++++++++++++++++++++ 2 files changed, 30 insertions(+) commit 5857dbfabc15ae9e17fd5a355c4920b46295ff1f Author: Chris Wilson Date: Sun May 21 13:40:14 2017 +0100 drm/i915: Fix logical inversion for gen4 quirking The assertion that we want to make before disabling the pin of the pages for the unknown swizzling quirk is that the quirk is indeed active, and that the quirk is disabled before we do apply it to the pages. Fixes: 2c3a3f44dc13 ("drm/i915: Fix pages pin counting around swizzle quirk") Fixes: 957870f93412 ("drm/i915: Split out i915_gem_object_set_tiling()") Signed-off-by: Chris Wilson Cc: Chris Wilson Cc: Joonas Lahtinen Cc: Tvrtko Ursulin Link: http://patchwork.freedesktop.org/patch/msgid/20170521124014.27678-1-chris@chris-wilson.co.uk Reviewed-bhy: Joonas Lahtinen (cherry picked from commit 20bb377106af69d16269b1837e9a945b9f508a2e) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_gem_tiling.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d90c98905afd00c15d5d255d845b646a37173ce9 Author: Chris Wilson Date: Wed May 31 20:05:14 2017 +0100 drm/i915: Guard against i915_ggtt_disable_guc() being invoked unconditionally Commit 7c3f86b6dc51 ("drm/i915: Invalidate the guc ggtt TLB upon insertion") added the restoration of the invalidation routine after the GuC was disabled, but missed that the GuC was unconditionally disabled when not used. This then overwrites the invalidate routine for the older chipsets, causing havoc and breaking resume as the most obvious victim. We place the guard inside i915_ggtt_disable_guc() to be backport friendly (the bug was introduced into v4.11) but it would be preferred to be in more control over when this was guard (i.e. do not try and teardown the data structures before we have enabled them). That should be true with the reorganisation of the guc loaders. Reported-by: Ville Syrjälä Signed-off-by: Chris Wilson Fixes: 7c3f86b6dc51 ("drm/i915: Invalidate the guc ggtt TLB upon insertion") Cc: Tvrtko Ursulin Cc: Joonas Lahtinen Cc: Oscar Mateo Cc: Daniele Ceraolo Spurio Cc: Michal Wajdeczko Cc: Arkadiusz Hiler Cc: # v4.11+ Link: http://patchwork.freedesktop.org/patch/msgid/20170531190514.3691-1-chris@chris-wilson.co.uk Reviewed-by: Michel Thierry (cherry picked from commit cb60606d835ca8b2f744835116bcabe64ce88849) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_gem_gtt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 4e3aed844547f63614363a386de126e6304e55fb Author: Maarten Lankhorst Date: Wed May 31 17:42:36 2017 +0200 drm/i915: Always recompute watermarks when distrust_bios_wm is set, v2. On some systems there can be a race condition in which no crtc state is added to the first atomic commit. This results in all crtc's having a null DDB allocation, causing a FIFO underrun on any update until the first modeset. Changes since v1: - Do not take the connection_mutex, this is already done below. Reported-by: Maarten Lankhorst Inspired-by: Mahesh Kumar Signed-off-by: Maarten Lankhorst Fixes: 98d39494d375 ("drm/i915/gen9: Compute DDB allocation at atomic check time (v4)") Cc: # v4.8+ Cc: Mahesh Kumar Cc: Matt Roper Link: http://patchwork.freedesktop.org/patch/msgid/20170531154236.27180-1-maarten.lankhorst@linux.intel.com Reviewed-by: Mahesh Kumar Reviewed-by: Matt Roper (cherry picked from commit 367d73d2806085bb507ab44c1f532640917fd5ca) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_pm.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit 6ab92afc95c9bd6877cb42e7b24f65be887a5440 Author: Imre Deak Date: Tue May 2 15:04:09 2017 +0300 drm/i915: Prevent the system suspend complete optimization Since commit bac2a909a096c9110525c18cbb8ce73c660d5f71 Author: Rafael J. Wysocki Date: Wed Jan 21 02:17:42 2015 +0100 PCI / PM: Avoid resuming PCI devices during system suspend PCI devices will default to allowing the system suspend complete optimization where devices are not woken up during system suspend if they were already runtime suspended. This however breaks the i915/HDA drivers for two reasons: - The i915 driver has system suspend specific steps that it needs to run, that bring the device to a different state than its runtime suspended state. - The HDA driver's suspend handler requires power that it will request from the i915 driver's power domain handler. This in turn requires the i915 driver to runtime resume itself, but this won't be possible if the suspend complete optimization is in effect: in this case the i915 runtime PM is disabled and trying to get an RPM reference returns -EACCESS. Solve this by requiring the PCI/PM core to resume the device during system suspend which in effect disables the suspend complete optimization. Regardless of the above commit the optimization stayed disabled for DRM devices until commit d14d2a8453d650bea32a1c5271af1458cd283a0f Author: Lukas Wunner Date: Wed Jun 8 12:49:29 2016 +0200 drm: Remove dev_pm_ops from drm_class so this patch is in practice a fix for this commit. Another reason for the bug staying hidden for so long is that the optimization for a device is disabled if it's disabled for any of its children devices. i915 may have a backlight device as its child which doesn't support runtime PM and so doesn't allow the optimization either. So if this backlight device got registered the bug stayed hidden. Credits to Marta, Tomi and David who enabled pstore logging, that caught one instance of this issue across a suspend/ resume-to-ram and Ville who rememberd that the optimization was enabled for some devices at one point. The first WARN triggered by the problem: [ 6250.746445] WARNING: CPU: 2 PID: 17384 at drivers/gpu/drm/i915/intel_runtime_pm.c:2846 intel_runtime_pm_get+0x6b/0xd0 [i915] [ 6250.746448] pm_runtime_get_sync() failed: -13 [ 6250.746451] Modules linked in: snd_hda_intel i915 vgem snd_hda_codec_hdmi x86_pkg_temp_thermal intel_powerclamp coretemp crct10dif_pclmul crc32_pclmul snd_hda_codec_realtek snd_hda_codec_generic ghash_clmulni_intel e1000e snd_hda_codec snd_hwdep snd_hda_core ptp mei_me pps_core snd_pcm lpc_ich mei prime_ numbers i2c_hid i2c_designware_platform i2c_designware_core [last unloaded: i915] [ 6250.746512] CPU: 2 PID: 17384 Comm: kworker/u8:0 Tainted: G U W 4.11.0-rc5-CI-CI_DRM_334+ #1 [ 6250.746515] Hardware name: /NUC5i5RYB, BIOS RYBDWi35.86A.0362.2017.0118.0940 01/18/2017 [ 6250.746521] Workqueue: events_unbound async_run_entry_fn [ 6250.746525] Call Trace: [ 6250.746530] dump_stack+0x67/0x92 [ 6250.746536] __warn+0xc6/0xe0 [ 6250.746542] ? pci_restore_standard_config+0x40/0x40 [ 6250.746546] warn_slowpath_fmt+0x46/0x50 [ 6250.746553] ? __pm_runtime_resume+0x56/0x80 [ 6250.746584] intel_runtime_pm_get+0x6b/0xd0 [i915] [ 6250.746610] intel_display_power_get+0x1b/0x40 [i915] [ 6250.746646] i915_audio_component_get_power+0x15/0x20 [i915] [ 6250.746654] snd_hdac_display_power+0xc8/0x110 [snd_hda_core] [ 6250.746661] azx_runtime_resume+0x218/0x280 [snd_hda_intel] [ 6250.746667] pci_pm_runtime_resume+0x76/0xa0 [ 6250.746672] __rpm_callback+0xb4/0x1f0 [ 6250.746677] ? pci_restore_standard_config+0x40/0x40 [ 6250.746682] rpm_callback+0x1f/0x80 [ 6250.746686] ? pci_restore_standard_config+0x40/0x40 [ 6250.746690] rpm_resume+0x4ba/0x740 [ 6250.746698] __pm_runtime_resume+0x49/0x80 [ 6250.746703] pci_pm_suspend+0x57/0x140 [ 6250.746709] dpm_run_callback+0x6f/0x330 [ 6250.746713] ? pci_pm_freeze+0xe0/0xe0 [ 6250.746718] __device_suspend+0xf9/0x370 [ 6250.746724] ? dpm_watchdog_set+0x60/0x60 [ 6250.746730] async_suspend+0x1a/0x90 [ 6250.746735] async_run_entry_fn+0x34/0x160 [ 6250.746741] process_one_work+0x1f2/0x6d0 [ 6250.746749] worker_thread+0x49/0x4a0 [ 6250.746755] kthread+0x107/0x140 [ 6250.746759] ? process_one_work+0x6d0/0x6d0 [ 6250.746763] ? kthread_create_on_node+0x40/0x40 [ 6250.746768] ret_from_fork+0x2e/0x40 [ 6250.746778] ---[ end trace 102a62fd2160f5e6 ]--- v2: - Use the new pci_dev->needs_resume flag, to avoid any overhead during the ->pm_prepare hook. (Rafael) v3: - Update commit message to reference the actual regressing commit. (Lukas) v4: - Rebase on v4 of patch 1/2. Fixes: d14d2a8453d6 ("drm: Remove dev_pm_ops from drm_class") References: https://bugs.freedesktop.org/show_bug.cgi?id=100378 References: https://bugs.freedesktop.org/show_bug.cgi?id=100770 Cc: Rafael J. Wysocki Cc: Marta Lofstedt Cc: David Weinehall Cc: Tomi Sarvela Cc: Ville Syrjälä Cc: Mika Kuoppala Cc: Chris Wilson Cc: Takashi Iwai Cc: Bjorn Helgaas Cc: Lukas Wunner Cc: linux-pci@vger.kernel.org Cc: # v4.10.x: 4d071c3 - PCI/PM: Add needs_resume flag Cc: # v4.10.x Signed-off-by: Imre Deak Reviewed-by: Chris Wilson Reported-and-tested-by: Marta Lofstedt Link: http://patchwork.freedesktop.org/patch/msgid/1493726649-32094-2-git-send-email-imre.deak@intel.com (cherry picked from commit adfdf85d795f4d4f487b61ee0b169d64c6e19081) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_drv.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit bd709898a50184de4fe418bf85486c5b1e002901 Author: Nagaraju, Vathsala Date: Thu May 25 22:13:29 2017 +0530 drm/i915/psr: disable psr2 for resolution greater than 32X20 psr1 is also disabled for panel resolution greater than 32X20. Added psr2 check to disable only for psr2 panels having resolution greater than 32X20. issue was introduced by commit-id : "acf45d11050abd751dcec986ab121cb2367dcbba" commit message: "PSR2 is restricted to work with panel resolutions upto 3200x2000, move the check to intel_psr_match_conditions and fully block psr." v2: (Rodrigo) Add previous commit details which introduced the issue Fixes: acf45d11050a ("drm/i915/psr: disable psr2 for resolution greater than 32X20") Cc: Rodrigo Vivi Cc: Jim Bride Cc: Yaroslav Shabalin Reported-by: Yaroslav Shabalin Reviewed-by: Rodrigo Vivi Signed-off-by: vathsala nagaraju Signed-off-by: Rodrigo Vivi Link: http://patchwork.freedesktop.org/patch/msgid/49935bdff896ee3140bed471012b9f9110a863a4.1495729964.git.vathsala.nagaraju@intel.com (cherry picked from commit bef8c056fba09aa4629fe5a2d3efe64068d049db) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_psr.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit d9533f19d8401b7072da2d484a9514af0d473148 Author: Chris Wilson Date: Tue May 30 13:13:33 2017 +0100 drm/i915: Hold a wakeref for probing the ring registers Allow intel_engine_is_idle() to be called outside of the GT wakeref by acquiring the device runtime pm for ourselves. This allows the function to act as check after we assume the engine is idle and we release the GT wakeref held whilst we have requests. At the moment, we do not call it outside of an awake context but taking the wakeref as required makes it more convenient to use for quick debugging in future. [ 2613.401647] RPM wakelock ref not held during HW access [ 2613.401684] ------------[ cut here ]------------ [ 2613.401720] WARNING: CPU: 5 PID: 7739 at drivers/gpu/drm/i915/intel_drv.h:1787 gen6_read32+0x21f/0x2b0 [i915] [ 2613.401731] Modules linked in: snd_hda_intel i915 vgem snd_hda_codec_hdmi x86_pkg_temp_thermal intel_powerclamp snd_hda_codec_realtek coretemp snd_hda_codec_generic crct10dif_pclmul crc32_pclmul ghash_clmulni_intel snd_hda_codec snd_hwdep snd_hda_core snd_pcm r8169 mii mei_me lpc_ich mei prime_numbers [last unloaded: i915] [ 2613.401823] CPU: 5 PID: 7739 Comm: drv_missed_irq Tainted: G U 4.12.0-rc2-CI-CI_DRM_421+ #1 [ 2613.401825] Hardware name: MSI MS-7924/Z97M-G43(MS-7924), BIOS V1.12 02/15/2016 [ 2613.401840] task: ffff880409e3a740 task.stack: ffffc900084dc000 [ 2613.401861] RIP: 0010:gen6_read32+0x21f/0x2b0 [i915] [ 2613.401863] RSP: 0018:ffffc900084dfce8 EFLAGS: 00010292 [ 2613.401869] RAX: 000000000000002a RBX: ffff8804016a8000 RCX: 0000000000000006 [ 2613.401871] RDX: 0000000000000006 RSI: ffffffff81cbf2d9 RDI: ffffffff81c9e3a7 [ 2613.401874] RBP: ffffc900084dfd18 R08: ffff880409e3afc8 R09: 0000000000000000 [ 2613.401877] R10: 000000008a1c483f R11: 0000000000000000 R12: 000000000000209c [ 2613.401879] R13: 0000000000000001 R14: ffff8804016a8000 R15: ffff8804016ac150 [ 2613.401882] FS: 00007f39ef3dd8c0(0000) GS:ffff88041fb40000(0000) knlGS:0000000000000000 [ 2613.401885] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2613.401887] CR2: 00000000023717c8 CR3: 00000002e7b34000 CR4: 00000000001406e0 [ 2613.401889] Call Trace: [ 2613.401912] intel_engine_is_idle+0x76/0x90 [i915] [ 2613.401931] i915_gem_wait_for_idle+0xe6/0x1e0 [i915] [ 2613.401951] fault_irq_set+0x40/0x90 [i915] [ 2613.401970] i915_ring_test_irq_set+0x42/0x50 [i915] [ 2613.401976] simple_attr_write+0xc7/0xe0 [ 2613.401981] full_proxy_write+0x4f/0x70 [ 2613.401987] __vfs_write+0x23/0x120 [ 2613.401992] ? rcu_read_lock_sched_held+0x75/0x80 [ 2613.401996] ? rcu_sync_lockdep_assert+0x2a/0x50 [ 2613.401999] ? __sb_start_write+0xfa/0x1f0 [ 2613.402004] vfs_write+0xc5/0x1d0 [ 2613.402008] ? trace_hardirqs_on_caller+0xe7/0x1c0 [ 2613.402013] SyS_write+0x44/0xb0 [ 2613.402020] entry_SYSCALL_64_fastpath+0x1c/0xb1 [ 2613.402022] RIP: 0033:0x7f39eded6670 [ 2613.402025] RSP: 002b:00007fffdcdcb1a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2613.402030] RAX: ffffffffffffffda RBX: ffffffff81470203 RCX: 00007f39eded6670 [ 2613.402033] RDX: 0000000000000001 RSI: 000000000041bc33 RDI: 0000000000000006 [ 2613.402036] RBP: ffffc900084dff88 R08: 00007f39ef3dd8c0 R09: 0000000000000001 [ 2613.402038] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000041bc33 [ 2613.402041] R13: 0000000000000006 R14: 0000000000000000 R15: 0000000000000000 [ 2613.402046] ? __this_cpu_preempt_check+0x13/0x20 [ 2613.402052] Code: 01 9b fa e0 0f ff e9 28 fe ff ff 80 3d 6a dd 0e 00 00 0f 85 29 fe ff ff 48 c7 c7 48 19 29 a0 c6 05 56 dd 0e 00 01 e8 da 9a fa e0 <0f> ff e9 0f fe ff ff b9 01 00 00 00 ba 01 00 00 00 44 89 e6 48 [ 2613.402199] ---[ end trace 31f0cfa93ab632bf ]--- Fixes: 5400367a864d ("drm/i915: Ensure the engine is idle before manually changing HWS") Signed-off-by: Chris Wilson Cc: Mika Kuoppala Cc: Joonas Lahtinen Cc: Tvrtko Ursulin Link: http://patchwork.freedesktop.org/patch/msgid/20170530121334.17364-2-chris@chris-wilson.co.uk Reviewed-by: Tvrtko Ursulin (cherry picked from commit a091d4ee931b16ce4fef945d39a20b851a7e17b7) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_engine_cs.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) commit e0da1963fe84ee86b59dc4b9ff1a69cb4e1275c7 Author: Chris Wilson Date: Tue May 30 13:13:32 2017 +0100 drm/i915: Short-circuit i915_gem_wait_for_idle() if already idle If the device is asleep (no GT wakeref), we know the GPU is already idle. If we add an early return, we can avoid touching registers and checking hw state outside of the assumed GT wakelock. This prevents causing such errors whilst debugging: [ 2613.401647] RPM wakelock ref not held during HW access [ 2613.401684] ------------[ cut here ]------------ [ 2613.401720] WARNING: CPU: 5 PID: 7739 at drivers/gpu/drm/i915/intel_drv.h:1787 gen6_read32+0x21f/0x2b0 [i915] [ 2613.401731] Modules linked in: snd_hda_intel i915 vgem snd_hda_codec_hdmi x86_pkg_temp_thermal intel_powerclamp snd_hda_codec_realtek coretemp snd_hda_codec_generic crct10dif_pclmul crc32_pclmul ghash_clmulni_intel snd_hda_codec snd_hwdep snd_hda_core snd_pcm r8169 mii mei_me lpc_ich mei prime_numbers [last unloaded: i915] [ 2613.401823] CPU: 5 PID: 7739 Comm: drv_missed_irq Tainted: G U 4.12.0-rc2-CI-CI_DRM_421+ #1 [ 2613.401825] Hardware name: MSI MS-7924/Z97M-G43(MS-7924), BIOS V1.12 02/15/2016 [ 2613.401840] task: ffff880409e3a740 task.stack: ffffc900084dc000 [ 2613.401861] RIP: 0010:gen6_read32+0x21f/0x2b0 [i915] [ 2613.401863] RSP: 0018:ffffc900084dfce8 EFLAGS: 00010292 [ 2613.401869] RAX: 000000000000002a RBX: ffff8804016a8000 RCX: 0000000000000006 [ 2613.401871] RDX: 0000000000000006 RSI: ffffffff81cbf2d9 RDI: ffffffff81c9e3a7 [ 2613.401874] RBP: ffffc900084dfd18 R08: ffff880409e3afc8 R09: 0000000000000000 [ 2613.401877] R10: 000000008a1c483f R11: 0000000000000000 R12: 000000000000209c [ 2613.401879] R13: 0000000000000001 R14: ffff8804016a8000 R15: ffff8804016ac150 [ 2613.401882] FS: 00007f39ef3dd8c0(0000) GS:ffff88041fb40000(0000) knlGS:0000000000000000 [ 2613.401885] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2613.401887] CR2: 00000000023717c8 CR3: 00000002e7b34000 CR4: 00000000001406e0 [ 2613.401889] Call Trace: [ 2613.401912] intel_engine_is_idle+0x76/0x90 [i915] [ 2613.401931] i915_gem_wait_for_idle+0xe6/0x1e0 [i915] [ 2613.401951] fault_irq_set+0x40/0x90 [i915] [ 2613.401970] i915_ring_test_irq_set+0x42/0x50 [i915] [ 2613.401976] simple_attr_write+0xc7/0xe0 [ 2613.401981] full_proxy_write+0x4f/0x70 [ 2613.401987] __vfs_write+0x23/0x120 [ 2613.401992] ? rcu_read_lock_sched_held+0x75/0x80 [ 2613.401996] ? rcu_sync_lockdep_assert+0x2a/0x50 [ 2613.401999] ? __sb_start_write+0xfa/0x1f0 [ 2613.402004] vfs_write+0xc5/0x1d0 [ 2613.402008] ? trace_hardirqs_on_caller+0xe7/0x1c0 [ 2613.402013] SyS_write+0x44/0xb0 [ 2613.402020] entry_SYSCALL_64_fastpath+0x1c/0xb1 [ 2613.402022] RIP: 0033:0x7f39eded6670 [ 2613.402025] RSP: 002b:00007fffdcdcb1a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2613.402030] RAX: ffffffffffffffda RBX: ffffffff81470203 RCX: 00007f39eded6670 [ 2613.402033] RDX: 0000000000000001 RSI: 000000000041bc33 RDI: 0000000000000006 [ 2613.402036] RBP: ffffc900084dff88 R08: 00007f39ef3dd8c0 R09: 0000000000000001 [ 2613.402038] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000041bc33 [ 2613.402041] R13: 0000000000000006 R14: 0000000000000000 R15: 0000000000000000 [ 2613.402046] ? __this_cpu_preempt_check+0x13/0x20 [ 2613.402052] Code: 01 9b fa e0 0f ff e9 28 fe ff ff 80 3d 6a dd 0e 00 00 0f 85 29 fe ff ff 48 c7 c7 48 19 29 a0 c6 05 56 dd 0e 00 01 e8 da 9a fa e0 <0f> ff e9 0f fe ff ff b9 01 00 00 00 ba 01 00 00 00 44 89 e6 48 [ 2613.402199] ---[ end trace 31f0cfa93ab632bf ]--- Fixes: 25112b64b3d2 ("drm/i915: Wait for all engines to be idle as part of i915_gem_wait_for_idle()") Signed-off-by: Chris Wilson Cc: Joonas Lahtinen Cc: Tvrtko Ursulin Link: http://patchwork.freedesktop.org/patch/msgid/20170530121334.17364-1-chris@chris-wilson.co.uk Reviewed-by: Joonas Lahtinen (cherry picked from commit 863e9fde1a7061dad09bb299c65bed5f1ccb44ff) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_gem.c | 4 ++++ 1 file changed, 4 insertions(+) commit 4c4c565513cca1c53a12956640b5915727431631 Author: Kai Chen Date: Tue May 23 14:58:11 2017 -0700 drm/i915: Disable decoupled MMIO The decoupled MMIO feature doesn't work as intended by HW team. Enabling it with forcewake will only make debugging efforts more difficult, so let's disable it. Fixes: 85ee17ebeedd ("drm/i915/bxt: Broxton decoupled MMIO") Cc: Zhe Wang Cc: Praveen Paneri Cc: Tvrtko Ursulin Cc: Daniel Vetter Cc: Jani Nikula Cc: intel-gfx@lists.freedesktop.org Cc: # v4.10+ Signed-off-by: Kai Chen Reviewed-by: Tvrtko Ursulin Signed-off-by: Jani Nikula Link: http://patchwork.freedesktop.org/patch/msgid/20170523215812.18328-2-kai.chen@intel.com (cherry picked from commit 0051c10acabb631cfd439eae73289e6e4c39b2b7) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_pci.c | 1 - 1 file changed, 1 deletion(-) commit 4ca9a5821972b431cb94c6a1ac69a64aefe1c17d Author: Michal Wajdeczko Date: Thu May 18 11:31:02 2017 +0000 drm/i915/guc: Remove stale comment for q_fail This member was dropped long time ago. Fixes: 774439e1 ("drm/i915/guc: re-optimise i915_guc_client layout") Signed-off-by: Michal Wajdeczko Cc: Tvrtko Ursulin Link: http://patchwork.freedesktop.org/patch/msgid/20170518113104.54400-1-michal.wajdeczko@intel.com Reviewed-by: Chris Wilson Signed-off-by: Chris Wilson (cherry picked from commit 4afc67be8e203ee8f5e95e829c0777eae7a14702) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_uc.h | 2 -- 1 file changed, 2 deletions(-) commit 1929e6610bddf0cc44f0859fc72d4016cba0c1fa Author: Thomas Hellstrom Date: Wed Jun 7 14:46:15 2017 +0200 drm/vmwgfx: Bump driver minor and date While the atomic modesetting capability is signaled also elsewhere, also reflect it by a driver minor bump. Signed-off-by: Thomas Hellstrom drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit f470a7740f8c7577df1db5923ec89d890cf32040 Author: Sinclair Yeh Date: Wed Jun 7 14:24:08 2017 +0200 drm/vmwgfx: Remove unused legacy cursor functions These function implementations and/or declarations are no longer used now that atomic is enabled. Signed-off-by: Sinclair Yeh Reported-by: Daniel Vetter Reviewed-by: Thomas Hellstrom drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 114 ------------------------------------ drivers/gpu/drm/vmwgfx/vmwgfx_kms.h | 15 ----- 2 files changed, 129 deletions(-) commit a2e5a3e2f8cc48cc9ed10a919ae582ab0222da80 Author: Colin Ian King Date: Sat May 27 19:52:30 2017 +0100 drm/vmwgfx: fix spelling mistake "exeeds" -> "exceeds" Trivial fix to spelling mistake in DRM_ERROR error message. Signed-off-by: Colin Ian King Reviewed-by: Sinclair Yeh drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a1ac633912305168bf432c3d47979d43b16164f8 Author: Sinclair Yeh Date: Fri Jun 2 07:55:50 2017 +0200 drm/vmwgfx: Fix large topology crash The previous attempt at this had an issue with with num_clips > 1 because it would always end up using the coordinates of the last clip while using width and height calculated from the bounding box of all the clips. So if the last clip happens to be not at the top-left corner of the bounding box, the CPU blit operation would go out of bounds. The original intent was to coalesce all the clips into one blit, and to do that we need to also track the starting point of the content buffer. Signed-off-by: Sinclair Yeh Reviewed-by: Thomas Hellstrom drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) commit 8a309c8a2d0619efe29ec652c163d6b89eff9f9f Author: Sinclair Yeh Date: Fri Jun 2 07:53:27 2017 +0200 drm/vmwgfx: Make sure to update STDU when FB is updated When a new FB is bound, we have to send an update command otherwise the new FB may not be shown Signed-off-by: Sinclair Yeh Reviewed-by: Thomas Hellstrom drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c | 5 +++++ 1 file changed, 5 insertions(+) commit 07678eca2cf9c9a18584e546c2b2a0d0c9a3150c Author: Sinclair Yeh Date: Fri Jun 2 07:50:57 2017 +0200 drm/vmwgfx: Make sure backup_handle is always valid When vmw_gb_surface_define_ioctl() is called with an existing buffer, we end up returning an uninitialized variable in the backup_handle. The fix is to first initialize backup_handle to 0 just to be sure, and second, when a user-provided buffer is found, we will use the req->buffer_handle as the backup_handle. Cc: Reported-by: Murray McAllister Signed-off-by: Sinclair Yeh Reviewed-by: Deepak Rawat drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) commit f0c62e9878024300319ba2438adc7b06c6b9c448 Author: Dan Carpenter Date: Thu Apr 27 12:12:08 2017 +0300 drm/vmwgfx: Handle vmalloc() failure in vmw_local_fifo_reserve() If vmalloc() fails then we need to a bit of cleanup before returning. Cc: Fixes: fb1d9738ca05 ("drm/vmwgfx: Add DRM driver for VMware Virtual GPU") Signed-off-by: Dan Carpenter Reviewed-by: Sinclair Yeh drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c | 2 ++ 1 file changed, 2 insertions(+) commit bbd5fefeea59412af4b4a325c2743f53a1d6c417 Author: Sinclair Yeh Date: Fri Jun 2 07:44:53 2017 +0200 drm/vmwgfx: Don't create proxy surface for cursor With atomic, the cursor surface is treated like a FB. Creating a proxy surface for cursor doesn't gain us much benefit. This fixes the issue on atomic enabled 2D VMs where the cursor disappears. Signed-off-by: Sinclair Yeh Reviewed-by: Thomas Hellstrom drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 1 + 1 file changed, 1 insertion(+) commit ee9c4e681ec4f58e42a83cb0c22a0289ade1aacf Author: Vladis Dronov Date: Fri Jun 2 07:42:09 2017 +0200 drm/vmwgfx: limit the number of mip levels in vmw_gb_surface_define_ioctl() The 'req->mip_levels' parameter in vmw_gb_surface_define_ioctl() is a user-controlled 'uint32_t' value which is used as a loop count limit. This can lead to a kernel lockup and DoS. Add check for 'req->mip_levels'. References: https://bugzilla.redhat.com/show_bug.cgi?id=1437431 Cc: Signed-off-by: Vladis Dronov Reviewed-by: Sinclair Yeh drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 3 +++ 1 file changed, 3 insertions(+) commit d86b18a06cf361e12ccdf61ae240d432182d8d6b Author: Jon Bloomfield Date: Wed May 24 08:54:11 2017 -0700 drm/i915: Serialize GTT/Aperture accesses on BXT BXT has a H/W issue with IOMMU which can lead to system hangs when Aperture accesses are queued within the GAM behind GTT Accesses. This patch avoids the condition by wrapping all GTT updates in stop_machine and using a flushing read prior to restarting the machine. The stop_machine guarantees no new Aperture accesses can begin while the PTE writes are being emmitted. The flushing read ensures that any following Aperture accesses cannot begin until the PTE writes have been cleared out of the GAM's fifo. Only FOLLOWING Aperture accesses need to be separated from in flight PTE updates. PTE Writes may follow tightly behind already in flight Aperture accesses, so no flushing read is required at the start of a PTE update sequence. This issue was reproduced by running igt/gem_readwrite and igt/gem_render_copy simultaneously from different processes, each in a tight loop, with INTEL_IOMMU enabled. This patch was originally published as: drm/i915: Serialize GTT Updates on BXT [Note: This will cause a performance penalty for some use cases, but avoiding hangs trumps performance hits. This may need to be worked around in Mesa to recover the lost performance.] v2: Move bxt/iommu detection into static function Remove #ifdef CONFIG_INTEL_IOMMU protection Make function names more reflective of purpose Move flushing read into static function v3: Tidy up for checkpatch.pl Testcase: igt/gem_concurrent_blit Signed-off-by: Jon Bloomfield Cc: John Harrison Cc: Chris Wilson Cc: Daniel Vetter Cc: Tvrtko Ursulin Cc: stable@vger.kernel.org Link: http://patchwork.freedesktop.org/patch/msgid/1495641251-30022-1-git-send-email-jon.bloomfield@intel.com Reviewed-by: Tvrtko Ursulin Signed-off-by: Chris Wilson (cherry picked from commit 0ef34ad6222abfa513117515fec720c33a58f105) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_drv.h | 10 ++++ drivers/gpu/drm/i915/i915_gem_gtt.c | 103 ++++++++++++++++++++++++++++++++++++ 2 files changed, 113 insertions(+) commit 753c09b5652bb4fe53e2db648002ec64b32b8827 Author: Julien Grall Date: Wed May 31 14:03:57 2017 +0100 xen/privcmd: Support correctly 64KB page granularity when mapping memory Commit 5995a68 "xen/privcmd: Add support for Linux 64KB page granularity" did not go far enough to support 64KB in mmap_batch_fn. The variable 'nr' is the number of 4KB chunk to map. However, when Linux is using 64KB page granularity the array of pages (vma->vm_private_data) contain one page per 64KB. Fix it by incrementing st->index correctly. Furthermore, st->va is not correctly incremented as PAGE_SIZE != XEN_PAGE_SIZE. Fixes: 5995a68 ("xen/privcmd: Add support for Linux 64KB page granularity") CC: stable@vger.kernel.org Reported-by: Feng Kan Signed-off-by: Julien Grall Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross drivers/xen/privcmd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 9947d6a09cd71937dade2fc14640e4843ae19802 Author: Kai-Heng Feng Date: Wed Jun 7 15:25:43 2017 +0800 nvme: relax APST default max latency to 100ms Christoph Hellwig suggests we should to make APST work out of the box. Hence relax the the default max latency to make them able to enter deepest power state on default. Here are id-ctrl excerpts from two high latency NVMes: vid : 0x14a4 ssvid : 0x1b4b mn : CX2-GB1024-Q11 NVMe LITEON 1024GB ps 3 : mp:0.1000W non-operational enlat:5000 exlat:5000 rrt:3 rrl:3 rwt:3 rwl:3 idle_power:- active_power:- ps 4 : mp:0.0100W non-operational enlat:50000 exlat:100000 rrt:4 rrl:4 rwt:4 rwl:4 idle_power:- active_power:- vid : 0x15b7 ssvid : 0x1b4b mn : A400 NVMe SanDisk 512GB ps 3 : mp:0.0500W non-operational enlat:51000 exlat:10000 rrt:0 rrl:0 rwt:0 rwl:0 idle_power:- active_power:- ps 4 : mp:0.0055W non-operational enlat:1000000 exlat:100000 rrt:0 rrl:0 rwt:0 rwl:0 idle_power:- active_power:- Signed-off-by: Kai-Heng Feng Signed-off-by: Christoph Hellwig drivers/nvme/host/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit da87591bea92204fcb921bac927666eb7141908e Author: Kai-Heng Feng Date: Wed Jun 7 15:25:42 2017 +0800 nvme: only consider exit latency when choosing useful non-op power states When a NVMe is in non-op states, the latency is exlat. The latency will be enlat + exlat only when the NVMe tries to transit from operational state right atfer it begins to transit to non-operational state, which should be a rare case. Therefore, as Andy Lutomirski suggests, use exlat only when deciding power states to trainsit to. Signed-off-by: Kai-Heng Feng Signed-off-by: Christoph Hellwig drivers/nvme/host/core.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) commit 24b7f0592f738a1127c72dbf5b72a83997dd6997 Author: James Smart Date: Mon Jun 5 15:03:42 2017 -0700 nvme-fc: fix missing put reference on controller create failure The failure case, of a create controller request, called nvme_uninit_ctrl() but didn't do a put to allow the nvme controller to be deleted. Signed-off-by: James Smart Signed-off-by: Christoph Hellwig drivers/nvme/host/fc.c | 1 + 1 file changed, 1 insertion(+) commit f874d5d079ec35158fa1a1509554c9d641bd5770 Author: James Smart Date: Thu Jun 1 22:54:21 2017 -0700 nvme-fc: on lldd/transport io error, terminate association Per FC-NVME, when lldd or transport detects an i/o error, the connection must be terminated, which in turn requires the association to be termianted. Currently the transport simply creates a nvme completion status of transport error and returns the io. The FC-NVME spec makes the mandate as initiator and host, depending on the error, can get out of sync on outstanding io counts (sqhd/sqtail). Implement the association teardown on lldd or transport detected errors. Signed-off-by: James Smart Signed-off-by: Christoph Hellwig Reviewed-by: Sagi Grimberg drivers/nvme/host/fc.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) commit e818a5b487fea20494b0e48548c1085634abdc0d Author: Sagi Grimberg Date: Mon Jun 5 20:35:56 2017 +0300 nvme-rdma: fast fail incoming requests while we reconnect When we encounter an transport/controller errors, error recovery kicks in which performs: 1. stops io/admin queues 2. moves transport queues out of LIVE state 3. fast fail pending io 4. schedule periodic reconnects. But we also need to fast fail incoming IO taht enters after we already scheduled. Given that our queue is not LIVE anymore, simply restart the request queues to fail in .queue_rq Reported-by: Alex Turin Reported-by: shahar.salzman Signed-off-by: Sagi Grimberg Signed-off-by: Christoph Hellwig Cc: stable@vger.kernel.org drivers/nvme/host/rdma.c | 44 +++++++++++++++++++++++++++++--------------- 1 file changed, 29 insertions(+), 15 deletions(-) commit 82b057caefaff2a891f821a617d939f46e03e844 Author: Rakesh Pandit Date: Mon Jun 5 14:43:11 2017 +0300 nvme-pci: fix multiple ctrl removal scheduling Commit c5f6ce97c1210 tries to address multiple resets but fails as work_busy doesn't involve any synchronization and can fail. This is reproducible easily as can be seen by WARNING below which is triggered with line: WARN_ON(dev->ctrl.state == NVME_CTRL_RESETTING) Allowing multiple resets can result in multiple controller removal as well if different conditions inside nvme_reset_work fail and which might deadlock on device_release_driver. [ 480.327007] WARNING: CPU: 3 PID: 150 at drivers/nvme/host/pci.c:1900 nvme_reset_work+0x36c/0xec0 [ 480.327008] Modules linked in: rfcomm fuse nf_conntrack_netbios_ns nf_conntrack_broadcast... [ 480.327044] btusb videobuf2_core ghash_clmulni_intel snd_hwdep cfg80211 acer_wmi hci_uart.. [ 480.327065] CPU: 3 PID: 150 Comm: kworker/u16:2 Not tainted 4.12.0-rc1+ #13 [ 480.327065] Hardware name: Acer Predator G9-591/Mustang_SLS, BIOS V1.10 03/03/2016 [ 480.327066] Workqueue: nvme nvme_reset_work [ 480.327067] task: ffff880498ad8000 task.stack: ffffc90002218000 [ 480.327068] RIP: 0010:nvme_reset_work+0x36c/0xec0 [ 480.327069] RSP: 0018:ffffc9000221bdb8 EFLAGS: 00010246 [ 480.327070] RAX: 0000000000460000 RBX: ffff880498a98128 RCX: dead000000000200 [ 480.327070] RDX: 0000000000000001 RSI: ffff8804b1028020 RDI: ffff880498a98128 [ 480.327071] RBP: ffffc9000221be50 R08: 0000000000000000 R09: 0000000000000000 [ 480.327071] R10: ffffc90001963ce8 R11: 000000000000020d R12: ffff880498a98000 [ 480.327072] R13: ffff880498a53500 R14: ffff880498a98130 R15: ffff880498a98128 [ 480.327072] FS: 0000000000000000(0000) GS:ffff8804c1cc0000(0000) knlGS:0000000000000000 [ 480.327073] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 480.327074] CR2: 00007ffcf3c37f78 CR3: 0000000001e09000 CR4: 00000000003406e0 [ 480.327074] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 480.327075] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 480.327075] Call Trace: [ 480.327079] ? __switch_to+0x227/0x400 [ 480.327081] process_one_work+0x18c/0x3a0 [ 480.327082] worker_thread+0x4e/0x3b0 [ 480.327084] kthread+0x109/0x140 [ 480.327085] ? process_one_work+0x3a0/0x3a0 [ 480.327087] ? kthread_park+0x60/0x60 [ 480.327102] ret_from_fork+0x2c/0x40 [ 480.327103] Code: e8 5a dc ff ff 85 c0 41 89 c1 0f..... This patch addresses the problem by using state of controller to decide whether reset should be queued or not as state change is synchronizated using controller spinlock. Also cancel_work_sync is used to make sure remove cancels the reset_work and waits for it to finish. This patch also changes return value from -ENODEV to more appropriate -EBUSY if nvme_reset fails to change state. Fixes: c5f6ce97c1210 ("nvme: don't schedule multiple resets") Signed-off-by: Rakesh Pandit Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig drivers/nvme/host/pci.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) commit 82654b6b8ef8b93ee87a97fc562f87f081fc2f91 Author: Ming Lei Date: Fri Jun 2 16:32:08 2017 +0800 nvme: fix hang in remove path We need to start admin queues too in nvme_kill_queues() for avoiding hang in remove path[1]. This patch is very similar with 806f026f9b901eaf(nvme: use blk_mq_start_hw_queues() in nvme_kill_queues()). [1] hang stack trace [] blk_execute_rq+0x56/0x80 [] __nvme_submit_sync_cmd+0x89/0xf0 [] nvme_set_features+0x5e/0x90 [] nvme_configure_apst+0x166/0x200 [] nvme_set_latency_tolerance+0x35/0x50 [] apply_constraint+0xb1/0xc0 [] dev_pm_qos_constraints_destroy+0xf4/0x1f0 [] dpm_sysfs_remove+0x2a/0x60 [] device_del+0x101/0x320 [] device_unregister+0x1a/0x60 [] device_destroy+0x3c/0x50 [] nvme_uninit_ctrl+0x45/0xa0 [] nvme_remove+0x78/0x110 [] pci_device_remove+0x39/0xb0 [] device_release_driver_internal+0x155/0x210 [] device_release_driver+0x12/0x20 [] nvme_remove_dead_ctrl_work+0x6b/0x70 [] process_one_work+0x18c/0x3a0 [] worker_thread+0x4e/0x3b0 [] kthread+0x109/0x140 [] ret_from_fork+0x2c/0x40 [] 0xffffffffffffffff Fixes: c5552fde102fc("nvme: Enable autonomous power state transitions") Reported-by: Rakesh Pandit Tested-by: Rakesh Pandit Reviewed-by: Sagi Grimberg Signed-off-by: Ming Lei Signed-off-by: Christoph Hellwig drivers/nvme/host/core.c | 4 ++++ 1 file changed, 4 insertions(+) commit ba3021b2c79b2fa9114f92790a99deb27a65b728 Author: Takashi Iwai Date: Fri Jun 2 17:26:56 2017 +0200 ALSA: timer: Fix missing queue indices reset at SNDRV_TIMER_IOCTL_SELECT snd_timer_user_tselect() reallocates the queue buffer dynamically, but it forgot to reset its indices. Since the read may happen concurrently with ioctl and snd_timer_user_tselect() allocates the buffer via kmalloc(), this may lead to the leak of uninitialized kernel-space data, as spotted via KMSAN: BUG: KMSAN: use of unitialized memory in snd_timer_user_read+0x6c4/0xa10 CPU: 0 PID: 1037 Comm: probe Not tainted 4.11.0-rc5+ #2739 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:16 dump_stack+0x143/0x1b0 lib/dump_stack.c:52 kmsan_report+0x12a/0x180 mm/kmsan/kmsan.c:1007 kmsan_check_memory+0xc2/0x140 mm/kmsan/kmsan.c:1086 copy_to_user ./arch/x86/include/asm/uaccess.h:725 snd_timer_user_read+0x6c4/0xa10 sound/core/timer.c:2004 do_loop_readv_writev fs/read_write.c:716 __do_readv_writev+0x94c/0x1380 fs/read_write.c:864 do_readv_writev fs/read_write.c:894 vfs_readv fs/read_write.c:908 do_readv+0x52a/0x5d0 fs/read_write.c:934 SYSC_readv+0xb6/0xd0 fs/read_write.c:1021 SyS_readv+0x87/0xb0 fs/read_write.c:1018 This patch adds the missing reset of queue indices. Together with the previous fix for the ioctl/read race, we cover the whole problem. Reported-by: Alexander Potapenko Tested-by: Alexander Potapenko Cc: Signed-off-by: Takashi Iwai sound/core/timer.c | 1 + 1 file changed, 1 insertion(+) commit d11662f4f798b50d8c8743f433842c3e40fe3378 Author: Takashi Iwai Date: Fri Jun 2 15:03:38 2017 +0200 ALSA: timer: Fix race between read and ioctl The read from ALSA timer device, the function snd_timer_user_tread(), may access to an uninitialized struct snd_timer_user fields when the read is concurrently performed while the ioctl like snd_timer_user_tselect() is invoked. We have already fixed the races among ioctls via a mutex, but we seem to have forgotten the race between read vs ioctl. This patch simply applies (more exactly extends the already applied range of) tu->ioctl_lock in snd_timer_user_tread() for closing the race window. Reported-by: Alexander Potapenko Tested-by: Alexander Potapenko Cc: Signed-off-by: Takashi Iwai sound/core/timer.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit b81f884a547b5c264c13fdfaa3b65cf994bf1dcf Author: Hangbin Liu Date: Thu Jun 1 14:57:56 2017 +0800 xfrm: fix xfrm_dev_event() missing when compile without CONFIG_XFRM_OFFLOAD In commit d77e38e612a0 ("xfrm: Add an IPsec hardware offloading API") we make xfrm_device.o only compiled when enable option CONFIG_XFRM_OFFLOAD. But this will make xfrm_dev_event() missing if we only enable default XFRM options. Then if we set down and unregister an interface with IPsec on it. there will no xfrm_garbage_collect(), which will cause dev usage count hold and get error like: unregister_netdevice: waiting for to become free. Usage count = 4 Fixes: d77e38e612a0 ("xfrm: Add an IPsec hardware offloading API") Signed-off-by: Hangbin Liu Signed-off-by: Steffen Klassert include/net/xfrm.h | 7 ++----- net/xfrm/Makefile | 3 +-- net/xfrm/xfrm_device.c | 2 ++ 3 files changed, 5 insertions(+), 7 deletions(-) commit 151d1d752bb681f29898c68c966f6e17b446456c Author: Alexander Sverdlin Date: Mon May 22 15:30:21 2017 +0200 MAINTAINERS: EP93XX: Update maintainership As agreed with Ryan, change the maintainership. Signed-off-by: Alexander Sverdlin Acked-by: Ryan Mallon Acked-by: H Hartley Sweeten Signed-off-by: Olof Johansson MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f3b7eaae1b35eb8077610eb7c7db042c9b0645e1 Author: Rafael J. Wysocki Date: Wed Jun 7 00:57:37 2017 +0200 Revert "ACPI / sleep: Ignore spurious SCI wakeups from suspend-to-idle" Revert commit eed4d47efe95 (ACPI / sleep: Ignore spurious SCI wakeups from suspend-to-idle) as it turned out to be premature and triggered a number of different issues on various systems. That includes, but is not limited to, premature suspend-to-RAM aborts on Dell XPS 13 (9343) reported by Dominik. The issue the commit in question attempted to address is real and will need to be taken care of going forward, but evidently more work is needed for this purpose. Reported-by: Dominik Brodowski Signed-off-by: Rafael J. Wysocki drivers/acpi/battery.c | 2 +- drivers/acpi/button.c | 5 ++--- drivers/acpi/device_pm.c | 3 +-- drivers/acpi/sleep.c | 28 ---------------------------- drivers/base/power/main.c | 5 +++++ drivers/base/power/wakeup.c | 18 ++++++------------ include/linux/suspend.h | 7 ++----- kernel/power/process.c | 2 +- kernel/power/suspend.c | 29 ++++------------------------- 9 files changed, 22 insertions(+), 77 deletions(-) commit b29794ec95c6856b316c2295904208bf11ffddd9 Merge: e87f327 1d3028f Author: Linus Torvalds Date: Tue Jun 6 14:30:17 2017 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) Made TCP congestion control documentation match current reality, from Anmol Sarma. 2) Various build warning and failure fixes from Arnd Bergmann. 3) Fix SKB list leak in ipv6_gso_segment(). 4) Use after free in ravb driver, from Eugeniu Rosca. 5) Don't use udp_poll() in ping protocol driver, from Eric Dumazet. 6) Don't crash in PCI error recovery of cxgb4 driver, from Guilherme Piccoli. 7) _SRC_NAT_DONE_BIT needs to be cleared using atomics, from Liping Zhang. 8) Use after free in vxlan deletion, from Mark Bloch. 9) Fix ordering of NAPI poll enabled in ethoc driver, from Max Filippov. 10) Fix stmmac hangs with TSO, from Niklas Cassel. 11) Fix crash in CALIPSO ipv6, from Richard Haines. 12) Clear nh_flags properly on mpls link up. From Roopa Prabhu. 13) Fix regression in sk_err socket error queue handling, noticed by ping applications. From Soheil Hassas Yeganeh. 14) Update mlx4/mlx5 MAINTAINERS information. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (78 commits) net: stmmac: fix a broken u32 less than zero check net: stmmac: fix completely hung TX when using TSO net: ethoc: enable NAPI before poll may be scheduled net: bridge: fix a null pointer dereference in br_afspec ravb: Fix use-after-free on `ifconfig eth0 down` net/ipv6: Fix CALIPSO causing GPF with datagram support net: stmmac: ensure jumbo_frm error return is correctly checked for -ve value Revert "sit: reload iphdr in ipip6_rcv" i40e/i40evf: proper update of the page_offset field i40e: Fix state flags for bit set and clean operations of PF iwlwifi: fix host command memory leaks iwlwifi: fix min API version for 7265D, 3168, 8000 and 8265 iwlwifi: mvm: clear new beacon command template struct iwlwifi: mvm: don't fail when removing a key from an inexisting sta iwlwifi: pcie: only use d0i3 in suspend/resume if system_pm is set to d0i3 iwlwifi: mvm: fix firmware debug restart recording iwlwifi: tt: move ucode_loaded check under mutex iwlwifi: mvm: support ibss in dqa mode iwlwifi: mvm: Fix command queue number on d0i3 flow iwlwifi: mvm: rs: start using LQ command color ... commit e87f327ecd166e6cf0205e4e9b8003ec535add51 Merge: abb2ea7 b3aefc2 Author: Linus Torvalds Date: Tue Jun 6 14:28:18 2017 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc Pull sparc fixes from David Miller: 1) Fix TLB context wrap races, from Pavel Tatashin. 2) Cure some gcc-7 build issues. 3) Handle invalid setup_hugepagesz command line values properly, from Liam R Howlett. 4) Copy TSB using the correct address shift for the huge TSB, from Mike Kravetz. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc: sparc64: delete old wrap code sparc64: new context wrap sparc64: add per-cpu mm of secondary contexts sparc64: redefine first version sparc64: combine activate_mm and switch_mm sparc64: reset mm cpumask after wrap sparc/mm/hugepages: Fix setup_hugepagesz for invalid values. sparc: Machine description indices can vary sparc64: mm: fix copy_tsb to correctly copy huge page TSBs arch/sparc: support NR_CPUS = 4096 sparc64: Add __multi3 for gcc 7.x and later. sparc64: Fix build warnings with gcc 7. arch/sparc: increase CONFIG_NODES_SHIFT on SPARC64 to 5 commit abb2ea7dfd82451d85ce669b811310c05ab5ca46 Author: David Rientjes Date: Tue Jun 6 13:36:24 2017 -0700 compiler, clang: suppress warning for unused static inline functions GCC explicitly does not warn for unused static inline functions for -Wunused-function. The manual states: Warn whenever a static function is declared but not defined or a non-inline static function is unused. Clang does warn for static inline functions that are unused. It turns out that suppressing the warnings avoids potentially complex #ifdef directives, which also reduces LOC. Suppress the warning for clang. Signed-off-by: David Rientjes Signed-off-by: Linus Torvalds include/linux/compiler-clang.h | 7 +++++++ 1 file changed, 7 insertions(+) commit b3aefc2fbdff2576d0c5aca09b963c40f0299664 Merge: f322980 0197e41 Author: David S. Miller Date: Tue Jun 6 13:45:48 2017 -0700 Merge branch 'sparc64-context-wrap-fixes' Pavel Tatashin says: ==================== sparc64: context wrap fixes This patch series contains fixes for context wrap: when we are out of context ids, and need to get a new version. It fixes memory corruption issues which happen when more than number of context ids (currently set to 8K) number of processes are started simultaneously, and processes can get a wrong context. sparc64: new context wrap: - contains explanation of new wrap method, and also explanation of races that it solves sparc64: reset mm cpumask after wrap - explains issue of not reseting cpu mask on a wrap ==================== Signed-off-by: David S. Miller commit 0197e41ce70511dc3b71f7fefa1a676e2b5cd60b Author: Pavel Tatashin Date: Wed May 31 11:25:25 2017 -0400 sparc64: delete old wrap code The old method that is using xcall and softint to get new context id is deleted, as it is replaced by a method of using per_cpu_secondary_mm without xcall to perform the context wrap. Signed-off-by: Pavel Tatashin Reviewed-by: Bob Picco Reviewed-by: Steven Sistare Signed-off-by: David S. Miller arch/sparc/include/asm/mmu_context_64.h | 6 ------ arch/sparc/include/asm/pil.h | 1 - arch/sparc/kernel/kernel.h | 1 - arch/sparc/kernel/smp_64.c | 31 ------------------------------- arch/sparc/kernel/ttable_64.S | 2 +- arch/sparc/mm/ultra.S | 5 ----- 6 files changed, 1 insertion(+), 45 deletions(-) commit a0582f26ec9dfd5360ea2f35dd9a1b026f8adda0 Author: Pavel Tatashin Date: Wed May 31 11:25:24 2017 -0400 sparc64: new context wrap The current wrap implementation has a race issue: it is called outside of the ctx_alloc_lock, and also does not wait for all CPUs to complete the wrap. This means that a thread can get a new context with a new version and another thread might still be running with the same context. The problem is especially severe on CPUs with shared TLBs, like sun4v. I used the following test to very quickly reproduce the problem: - start over 8K processes (must be more than context IDs) - write and read values at a memory location in every process. Very quickly memory corruptions start happening, and what we read back does not equal what we wrote. Several approaches were explored before settling on this one: Approach 1: Move smp_new_mmu_context_version() inside ctx_alloc_lock, and wait for every process to complete the wrap. (Note: every CPU must WAIT before leaving smp_new_mmu_context_version_client() until every one arrives). This approach ends up with deadlocks, as some threads own locks which other threads are waiting for, and they never receive softint until these threads exit smp_new_mmu_context_version_client(). Since we do not allow the exit, deadlock happens. Approach 2: Handle wrap right during mondo interrupt. Use etrap/rtrap to enter into into C code, and issue new versions to every CPU. This approach adds some overhead to runtime: in switch_mm() we must add some checks to make sure that versions have not changed due to wrap while we were loading the new secondary context. (could be protected by PSTATE_IE but that degrades performance as on M7 and older CPUs as it takes 50 cycles for each access). Also, we still need a global per-cpu array of MMs to know where we need to load new contexts, otherwise we can change context to a thread that is going way (if we received mondo between switch_mm() and switch_to() time). Finally, there are some issues with window registers in rtrap() when context IDs are changed during CPU mondo time. The approach in this patch is the simplest and has almost no impact on runtime. We use the array with mm's where last secondary contexts were loaded onto CPUs and bump their versions to the new generation without changing context IDs. If a new process comes in to get a context ID, it will go through get_new_mmu_context() because of version mismatch. But the running processes do not need to be interrupted. And wrap is quicker as we do not need to xcall and wait for everyone to receive and complete wrap. Signed-off-by: Pavel Tatashin Reviewed-by: Bob Picco Reviewed-by: Steven Sistare Signed-off-by: David S. Miller arch/sparc/mm/init_64.c | 81 ++++++++++++++++++++++++++++++++----------------- 1 file changed, 54 insertions(+), 27 deletions(-) commit 7a5b4bbf49fe86ce77488a70c5dccfe2d50d7a2d Author: Pavel Tatashin Date: Wed May 31 11:25:23 2017 -0400 sparc64: add per-cpu mm of secondary contexts The new wrap is going to use information from this array to figure out mm's that currently have valid secondary contexts setup. Signed-off-by: Pavel Tatashin Reviewed-by: Bob Picco Reviewed-by: Steven Sistare Signed-off-by: David S. Miller arch/sparc/include/asm/mmu_context_64.h | 5 +++-- arch/sparc/mm/init_64.c | 1 + 2 files changed, 4 insertions(+), 2 deletions(-) commit c4415235b2be0cc791572e8e7f7466ab8f73a2bf Author: Pavel Tatashin Date: Wed May 31 11:25:22 2017 -0400 sparc64: redefine first version CTX_FIRST_VERSION defines the first context version, but also it defines first context. This patch redefines it to only include the first context version. Signed-off-by: Pavel Tatashin Reviewed-by: Bob Picco Reviewed-by: Steven Sistare Signed-off-by: David S. Miller arch/sparc/include/asm/mmu_64.h | 2 +- arch/sparc/mm/init_64.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) commit 14d0334c6748ff2aedb3f2f7fdc51ee90a9b54e7 Author: Pavel Tatashin Date: Wed May 31 11:25:21 2017 -0400 sparc64: combine activate_mm and switch_mm The only difference between these two functions is that in activate_mm we unconditionally flush context. However, there is no need to keep this difference after fixing a bug where cpumask was not reset on a wrap. So, in this patch we combine these. Signed-off-by: Pavel Tatashin Reviewed-by: Bob Picco Reviewed-by: Steven Sistare Signed-off-by: David S. Miller arch/sparc/include/asm/mmu_context_64.h | 21 +-------------------- 1 file changed, 1 insertion(+), 20 deletions(-) commit 588974857359861891f478a070b1dc7ae04a3880 Author: Pavel Tatashin Date: Wed May 31 11:25:20 2017 -0400 sparc64: reset mm cpumask after wrap After a wrap (getting a new context version) a process must get a new context id, which means that we would need to flush the context id from the TLB before running for the first time with this ID on every CPU. But, we use mm_cpumask to determine if this process has been running on this CPU before, and this mask is not reset after a wrap. So, there are two possible fixes for this issue: 1. Clear mm cpumask whenever mm gets a new context id 2. Unconditionally flush context every time process is running on a CPU This patch implements the first solution Signed-off-by: Pavel Tatashin Reviewed-by: Bob Picco Reviewed-by: Steven Sistare Signed-off-by: David S. Miller arch/sparc/mm/init_64.c | 2 ++ 1 file changed, 2 insertions(+) commit f322980b74a15e08f8c70a34a5864ecdbf957251 Author: Liam R. Howlett Date: Tue May 30 15:45:00 2017 -0400 sparc/mm/hugepages: Fix setup_hugepagesz for invalid values. hugetlb_bad_size needs to be called on invalid values. Also change the pr_warn to a pr_err to better align with other platforms. Signed-off-by: Liam R. Howlett Signed-off-by: David S. Miller arch/sparc/mm/init_64.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit c982aa9c304bf0b9a7522fd118fed4afa5a0263c Author: James Clarke Date: Mon May 29 20:17:56 2017 +0100 sparc: Machine description indices can vary VIO devices were being looked up by their index in the machine description node block, but this often varies over time as devices are added and removed. Instead, store the ID and look up using the type, config handle and ID. Signed-off-by: James Clarke Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=112541 Signed-off-by: David S. Miller arch/sparc/include/asm/vio.h | 1 + arch/sparc/kernel/vio.c | 68 +++++++++++++++++++++++++++++++++++++++++--- 2 files changed, 65 insertions(+), 4 deletions(-) commit 654f4807624a657f364417c2a7454f0df9961734 Author: Mike Kravetz Date: Fri Jun 2 14:51:12 2017 -0700 sparc64: mm: fix copy_tsb to correctly copy huge page TSBs When a TSB grows beyond its current capacity, a new TSB is allocated and copy_tsb is called to copy entries from the old TSB to the new. A hash shift based on page size is used to calculate the index of an entry in the TSB. copy_tsb has hard coded PAGE_SHIFT in these calculations. However, for huge page TSBs the value REAL_HPAGE_SHIFT should be used. As a result, when copy_tsb is called for a huge page TSB the entries are placed at the incorrect index in the newly allocated TSB. When doing hardware table walk, the MMU does not match these entries and we end up in the TSB miss handling code. This code will then create and write an entry to the correct index in the TSB. We take a performance hit for the table walk miss and recreation of these entries. Pass a new parameter to copy_tsb that is the page size shift to be used when copying the TSB. Suggested-by: Anthony Yznaga Signed-off-by: Mike Kravetz Signed-off-by: David S. Miller arch/sparc/kernel/tsb.S | 11 +++++++---- arch/sparc/mm/tsb.c | 7 +++++-- 2 files changed, 12 insertions(+), 6 deletions(-) commit c79a13734d104b5b147d7cb0870276ccdd660dae Author: Jane Chu Date: Tue Jun 6 14:32:29 2017 -0600 arch/sparc: support NR_CPUS = 4096 Linux SPARC64 limits NR_CPUS to 4064 because init_cpu_send_mondo_info() only allocates a single page for NR_CPUS mondo entries. Thus we cannot use all 4096 CPUs on some SPARC platforms. To fix, allocate (2^order) pages where order is set according to the size of cpu_list for possible cpus. Since cpu_list_pa and cpu_mondo_block_pa are not used in asm code, there are no imm13 offsets from the base PA that will break because they can only reach one page. Orabug: 25505750 Signed-off-by: Jane Chu Reviewed-by: Bob Picco Reviewed-by: Atish Patra Signed-off-by: David S. Miller arch/sparc/Kconfig | 4 ++-- arch/sparc/kernel/irq_64.c | 17 +++++++++++++---- 2 files changed, 15 insertions(+), 6 deletions(-) commit 1d3028f4c16487d63861ab6c68451768a7a109df Author: Colin Ian King Date: Tue Jun 6 14:10:49 2017 +0100 net: stmmac: fix a broken u32 less than zero check The check that queue is less or equal to zero is always true because queue is a u32; queue is decremented and will wrap around and never go -ve. Fix this by making queue an int. Detected by CoverityScan, CID#1428988 ("Unsigned compared against 0") Signed-off-by: Colin Ian King Signed-off-by: David S. Miller drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 426849e6611f2092553f8d53372ae310818a6292 Author: Niklas Cassel Date: Tue Jun 6 09:25:00 2017 +0200 net: stmmac: fix completely hung TX when using TSO stmmac_tso_allocator can fail to set the Last Descriptor bit on a descriptor that actually was the last descriptor. This happens when the buffer of the last descriptor ends up having a size of exactly TSO_MAX_BUFF_SIZE. When the IP eventually reaches the next last descriptor, which actually has the bit set, the DMA will hang. When the DMA hangs, we get a tx timeout, however, since stmmac does not do a complete reset of the IP in stmmac_tx_timeout, we end up in a state with completely hung TX. Signed-off-by: Niklas Cassel Acked-by: Giuseppe Cavallaro Acked-by: Alexandre TORGUE Signed-off-by: David S. Miller drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d220b942a4b6a0640aee78841608f4aa5e8e185e Author: Max Filippov Date: Mon Jun 5 18:31:16 2017 -0700 net: ethoc: enable NAPI before poll may be scheduled ethoc_reset enables device interrupts, ethoc_interrupt may schedule a NAPI poll before NAPI is enabled in the ethoc_open, which results in device being unable to send or receive anything until it's closed and reopened. In case the device is flooded with ingress packets it may be unable to recover at all. Move napi_enable above ethoc_reset in the ethoc_open to fix that. Fixes: a1702857724f ("net: Add support for the OpenCores 10/100 Mbps Ethernet MAC.") Signed-off-by: Max Filippov Reviewed-by: Tobias Klauser Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/ethernet/ethoc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 33b5c38852b29736f3b472dd095c9a18ec22746f Author: Marc Zyngier Date: Tue Jun 6 19:08:35 2017 +0100 arm: KVM: Allow unaligned accesses at HYP We currently have the HSCTLR.A bit set, trapping unaligned accesses at HYP, but we're not really prepared to deal with it. Since the rest of the kernel is pretty happy about that, let's follow its example and set HSCTLR.A to zero. Modern CPUs don't really care. Cc: stable@vger.kernel.org Signed-off-by: Marc Zyngier Signed-off-by: Christoffer Dall arch/arm/kvm/init.S | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 78fd6dcf11468a5a131b8365580d0c613bcc02cb Author: Marc Zyngier Date: Tue Jun 6 19:08:34 2017 +0100 arm64: KVM: Allow unaligned accesses at EL2 We currently have the SCTLR_EL2.A bit set, trapping unaligned accesses at EL2, but we're not really prepared to deal with it. So far, this has been unnoticed, until GCC 7 started emitting those (in particular 64bit writes on a 32bit boundary). Since the rest of the kernel is pretty happy about that, let's follow its example and set SCTLR_EL2.A to zero. Modern CPUs don't really care. Cc: stable@vger.kernel.org Reported-by: Alexander Graf Signed-off-by: Marc Zyngier Signed-off-by: Christoffer Dall arch/arm64/kvm/hyp-init.S | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit d68c1f7fd1b7148dab5fe658321d511998969f2d Author: Marc Zyngier Date: Tue Jun 6 19:08:33 2017 +0100 arm64: KVM: Preserve RES1 bits in SCTLR_EL2 __do_hyp_init has the rather bad habit of ignoring RES1 bits and writing them back as zero. On a v8.0-8.2 CPU, this doesn't do anything bad, but may end-up being pretty nasty on future revisions of the architecture. Let's preserve those bits so that we don't have to fix this later on. Cc: stable@vger.kernel.org Signed-off-by: Marc Zyngier Signed-off-by: Christoffer Dall arch/arm64/include/asm/sysreg.h | 4 ++++ arch/arm64/kvm/hyp-init.S | 10 ++++++---- 2 files changed, 10 insertions(+), 4 deletions(-) commit 1020ce3108cc26fbf09d70550ea2937cb1a211d2 Author: Nikolay Aleksandrov Date: Tue Jun 6 01:26:24 2017 +0300 net: bridge: fix a null pointer dereference in br_afspec We might call br_afspec() with p == NULL which is a valid use case if the action is on the bridge device itself, but the bridge tunnel code dereferences the p pointer without checking, so check if p is null first. Reported-by: Gustavo A. R. Silva Fixes: efa5356b0d97 ("bridge: per vlan dst_metadata netlink support") Signed-off-by: Nikolay Aleksandrov Acked-by: Roopa Prabhu Signed-off-by: David S. Miller net/bridge/br_netlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 79514ef670e9e575a1fe36922268c439d0f0ca8a Author: Eugeniu Rosca Date: Tue Jun 6 00:08:10 2017 +0200 ravb: Fix use-after-free on `ifconfig eth0 down` Commit a47b70ea86bd ("ravb: unmap descriptors when freeing rings") has introduced the issue seen in [1] reproduced on H3ULCB board. Fix this by relocating the RX skb ringbuffer free operation, so that swiotlb page unmapping can be done first. Freeing of aligned TX buffers is not relevant to the issue seen in [1]. Still, reposition TX free calls as well, to have all kfree() operations performed consistently _after_ dma_unmap_*()/dma_free_*(). [1] Console screenshot with the problem reproduced: salvator-x login: root root@salvator-x:~# ifconfig eth0 up Micrel KSZ9031 Gigabit PHY e6800000.ethernet-ffffffff:00: \ attached PHY driver [Micrel KSZ9031 Gigabit PHY] \ (mii_bus:phy_addr=e6800000.ethernet-ffffffff:00, irq=235) IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready root@salvator-x:~# root@salvator-x:~# ifconfig eth0 down ================================================================== BUG: KASAN: use-after-free in swiotlb_tbl_unmap_single+0xc4/0x35c Write of size 1538 at addr ffff8006d884f780 by task ifconfig/1649 CPU: 0 PID: 1649 Comm: ifconfig Not tainted 4.12.0-rc4-00004-g112eb07287d1 #32 Hardware name: Renesas H3ULCB board based on r8a7795 (DT) Call trace: [] dump_backtrace+0x0/0x3a4 [] show_stack+0x14/0x1c [] dump_stack+0xf8/0x150 [] print_address_description+0x7c/0x330 [] kasan_report+0x2e0/0x2f4 [] check_memory_region+0x20/0x14c [] memcpy+0x48/0x68 [] swiotlb_tbl_unmap_single+0xc4/0x35c [] unmap_single+0x90/0xa4 [] swiotlb_unmap_page+0xc/0x14 [] __swiotlb_unmap_page+0xcc/0xe4 [] ravb_ring_free+0x514/0x870 [] ravb_close+0x288/0x36c [] __dev_close_many+0x14c/0x174 [] __dev_close+0xc8/0x144 [] __dev_change_flags+0xd8/0x194 [] dev_change_flags+0x60/0xb0 [] devinet_ioctl+0x484/0x9d4 [] inet_ioctl+0x190/0x194 [] sock_do_ioctl+0x78/0xa8 [] sock_ioctl+0x110/0x3c4 [] vfs_ioctl+0x90/0xa0 [] do_vfs_ioctl+0x148/0xc38 [] SyS_ioctl+0x44/0x74 [] el0_svc_naked+0x24/0x28 The buggy address belongs to the page: page:ffff7e001b6213c0 count:0 mapcount:0 mapping: (null) index:0x0 flags: 0x4000000000000000() raw: 4000000000000000 0000000000000000 0000000000000000 00000000ffffffff raw: 0000000000000000 ffff7e001b6213e0 0000000000000000 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8006d884f680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff8006d884f700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff8006d884f780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff8006d884f800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff8006d884f880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== Disabling lock debugging due to kernel taint root@salvator-x:~# Fixes: a47b70ea86bd ("ravb: unmap descriptors when freeing rings") Signed-off-by: Eugeniu Rosca Acked-by: Sergei Shtylyov Signed-off-by: David S. Miller drivers/net/ethernet/renesas/ravb_main.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) commit e3ebdb20fddacded2740a333ff66781e0d28b05c Author: Richard Haines Date: Mon Jun 5 16:44:40 2017 +0100 net/ipv6: Fix CALIPSO causing GPF with datagram support When using CALIPSO with IPPROTO_UDP it is possible to trigger a GPF as the IP header may have moved. Also update the payload length after adding the CALIPSO option. Signed-off-by: Richard Haines Acked-by: Paul Moore Signed-off-by: Huw Davies Signed-off-by: David S. Miller net/ipv6/calipso.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 594238158bf748c285f0a73222cd9b7ccf3c525d Author: Colin Ian King Date: Mon Jun 5 10:04:52 2017 +0100 net: stmmac: ensure jumbo_frm error return is correctly checked for -ve value The current comparison of entry < 0 will never be true since entry is an unsigned integer. Make entry an int to ensure -ve error return values from the call to jumbo_frm are correctly being caught. Detected by CoverityScan, CID#1238760 ("Macro compares unsigned to 0") Signed-off-by: Colin Ian King Signed-off-by: David S. Miller drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit dd8038ec56c18680ddddf948247f53d427054f45 Merge: 4eab0ea 7327a94 Author: Takashi Iwai Date: Tue Jun 6 20:03:46 2017 +0200 Merge tag 'asoc-fix-v4.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v4.12 This is the usual collection of device specific fixes, all accumilated since the merge window, plus one fix from Takashi for a nasty use after free bug that bit some things with deferred probe and an update to the maintainer address for the former Wolfson parts. commit 9bd2bbc01d17ddd567cc0f81f77fe1163e497462 Author: Eric Biggers Date: Fri Jun 2 20:35:51 2017 -0700 elevator: fix truncation of icq_cache_name gcc 7.1 reports the following warning: block/elevator.c: In function ‘elv_register’: block/elevator.c:898:5: warning: ‘snprintf’ output may be truncated before the last format character [-Wformat-truncation=] "%s_io_cq", e->elevator_name); ^~~~~~~~~~ block/elevator.c:897:3: note: ‘snprintf’ output between 7 and 22 bytes into a destination of size 21 snprintf(e->icq_cache_name, sizeof(e->icq_cache_name), ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "%s_io_cq", e->elevator_name); ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The bug is that the name of the icq_cache is 6 characters longer than the elevator name, but only ELV_NAME_MAX + 5 characters were reserved for it --- so in the case of a maximum-length elevator name, the 'q' character in "_io_cq" would be truncated by snprintf(). Fix it by reserving ELV_NAME_MAX + 6 characters instead. Signed-off-by: Eric Biggers Reviewed-by: Bart Van Assche Signed-off-by: Jens Axboe include/linux/elevator.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7b868fed00f6c72d3e0270bcb057b4f26c09e809 Merge: 80971df dc89481 Author: David S. Miller Date: Tue Jun 6 12:53:20 2017 -0400 Merge tag 'wireless-drivers-for-davem-2017-06-06' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers Kalle Valo says: ==================== wireless-drivers fixes for 4.12 It has been a slow start of cycle and this the first set of fixes for 4.12. Nothing really major here. wcn36xx * fix an issue with module reload brcmfmac * fix aligment regression on 64 bit systems iwlwifi * fixes for memory leaks, runtime PM, memory initialisation and other smaller problems * fix IBSS on devices using DQA mode (7260 and up) * fix the minimum firmware API requirement for 7265D, 3168, 8000 and 8265 ==================== Signed-off-by: David S. Miller commit 84c6c3035b1de00271362a9550389c605c7d28a0 Merge: ba7b238 963761a Author: Linus Torvalds Date: Tue Jun 6 09:37:44 2017 -0700 Merge tag 'media/v4.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: "Some bug fixes: - Don't fail build if atomisp has warnings - Some CEC Kconfig changes to allow it to be used by DRM without media dependencies - A race fix at RC initialization code - A driver fix at rainshadow-cec IMHO, the one that affects most people in this series is a build fix: if you try to build the Kernel with W=1 or using gcc7 and all[yes|mod]config, build will fail due to -Werror at atomisp makefiles" * tag 'media/v4.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: [media] rc-core: race condition during ir_raw_event_register() [media] cec: drop MEDIA_CEC_DEBUG [media] cec: rename MEDIA_CEC_NOTIFIER to CEC_NOTIFIER [media] cec: select CEC_CORE instead of depend on it [media] rainshadow-cec: ensure exit_loop is intialized [media] atomisp: don't treat warnings as errors commit 80971dfbf047c25b4160f708711fed7e3b28c372 Merge: f4eb17e 2aae918 Author: David S. Miller Date: Tue Jun 6 12:12:57 2017 -0400 Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-queue Jeff Kirsher says: ==================== Intel Wired LAN Driver Updates 2017-06-06 This series contains fixes to i40e and i40evf only. Mauro S. M. Rodrigues fixes a flood in the kernel log which was introduced in a previous commit because of a mistaken substitution of __I40E_VSI_DOWN instead of __I40E_DOWN when testing the state of the PF. Björn Töpel fixes an issue introduced in a previous commit where the offset was incorrect and could lead to data corruption for architectures using PAGE_SIZE larger than 8191. Fixed the issue by updating the page_offset correctly using the proper setting for truesize. ==================== Signed-off-by: David S. Miller commit d964f04a8fde84d978eff0d96561faa6e8de24de Author: Ming Lei Date: Tue Jun 6 23:22:00 2017 +0800 blk-mq: fix direct issue If queue is stopped, we shouldn't dispatch request into driver and hardware, unfortunately the check is removed in bd166ef183c2(blk-mq-sched: add framework for MQ capable IO schedulers). This patch fixes the issue by moving the check back into __blk_mq_try_issue_directly(). This patch fixes request use-after-free[1][2] during canceling requets of NVMe in nvme_dev_disable(), which can be triggered easily during NVMe reset & remove test. [1] oops kernel log when CONFIG_BLK_DEV_INTEGRITY is on [ 103.412969] BUG: unable to handle kernel NULL pointer dereference at 000000000000000a [ 103.412980] IP: bio_integrity_advance+0x48/0xf0 [ 103.412981] PGD 275a88067 [ 103.412981] P4D 275a88067 [ 103.412982] PUD 276c43067 [ 103.412983] PMD 0 [ 103.412984] [ 103.412986] Oops: 0000 [#1] SMP [ 103.412989] Modules linked in: vfat fat intel_rapl sb_edac x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel crypto_simd cryptd ipmi_ssif iTCO_wdt iTCO_vendor_support mxm_wmi glue_helper dcdbas ipmi_si mei_me pcspkr mei sg ipmi_devintf lpc_ich ipmi_msghandler shpchp acpi_power_meter wmi nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c sd_mod mgag200 i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm drm crc32c_intel nvme ahci nvme_core libahci libata tg3 i2c_core megaraid_sas ptp pps_core dm_mirror dm_region_hash dm_log dm_mod [ 103.413035] CPU: 0 PID: 102 Comm: kworker/0:2 Not tainted 4.11.0+ #1 [ 103.413036] Hardware name: Dell Inc. PowerEdge R730xd/072T6D, BIOS 2.2.5 09/06/2016 [ 103.413041] Workqueue: events nvme_remove_dead_ctrl_work [nvme] [ 103.413043] task: ffff9cc8775c8000 task.stack: ffffc033c252c000 [ 103.413045] RIP: 0010:bio_integrity_advance+0x48/0xf0 [ 103.413046] RSP: 0018:ffffc033c252fc10 EFLAGS: 00010202 [ 103.413048] RAX: 0000000000000000 RBX: ffff9cc8720a8cc0 RCX: ffff9cca72958240 [ 103.413049] RDX: ffff9cca72958000 RSI: 0000000000000008 RDI: ffff9cc872537f00 [ 103.413049] RBP: ffffc033c252fc28 R08: 0000000000000000 R09: ffffffffb963a0d5 [ 103.413050] R10: 000000000000063e R11: 0000000000000000 R12: ffff9cc8720a8d18 [ 103.413051] R13: 0000000000001000 R14: ffff9cc872682e00 R15: 00000000fffffffb [ 103.413053] FS: 0000000000000000(0000) GS:ffff9cc877c00000(0000) knlGS:0000000000000000 [ 103.413054] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 103.413055] CR2: 000000000000000a CR3: 0000000276c41000 CR4: 00000000001406f0 [ 103.413056] Call Trace: [ 103.413063] bio_advance+0x2a/0xe0 [ 103.413067] blk_update_request+0x76/0x330 [ 103.413072] blk_mq_end_request+0x1a/0x70 [ 103.413074] blk_mq_dispatch_rq_list+0x370/0x410 [ 103.413076] ? blk_mq_flush_busy_ctxs+0x94/0xe0 [ 103.413080] blk_mq_sched_dispatch_requests+0x173/0x1a0 [ 103.413083] __blk_mq_run_hw_queue+0x8e/0xa0 [ 103.413085] __blk_mq_delay_run_hw_queue+0x9d/0xa0 [ 103.413088] blk_mq_start_hw_queue+0x17/0x20 [ 103.413090] blk_mq_start_hw_queues+0x32/0x50 [ 103.413095] nvme_kill_queues+0x54/0x80 [nvme_core] [ 103.413097] nvme_remove_dead_ctrl_work+0x1f/0x40 [nvme] [ 103.413103] process_one_work+0x149/0x360 [ 103.413105] worker_thread+0x4d/0x3c0 [ 103.413109] kthread+0x109/0x140 [ 103.413111] ? rescuer_thread+0x380/0x380 [ 103.413113] ? kthread_park+0x60/0x60 [ 103.413120] ret_from_fork+0x2c/0x40 [ 103.413121] Code: 08 4c 8b 63 50 48 8b 80 80 00 00 00 48 8b 90 d0 03 00 00 31 c0 48 83 ba 40 02 00 00 00 48 8d 8a 40 02 00 00 48 0f 45 c1 c1 ee 09 <0f> b6 48 0a 0f b6 40 09 41 89 f5 83 e9 09 41 d3 ed 44 0f af e8 [ 103.413145] RIP: bio_integrity_advance+0x48/0xf0 RSP: ffffc033c252fc10 [ 103.413146] CR2: 000000000000000a [ 103.413157] ---[ end trace cd6875d16eb5a11e ]--- [ 103.455368] Kernel panic - not syncing: Fatal exception [ 103.459826] Kernel Offset: 0x37600000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 103.850916] ---[ end Kernel panic - not syncing: Fatal exception [ 103.857637] sched: Unexpected reschedule of offline CPU#1! [ 103.863762] ------------[ cut here ]------------ [2] kernel hang in blk_mq_freeze_queue_wait() when CONFIG_BLK_DEV_INTEGRITY is off [ 247.129825] INFO: task nvme-test:1772 blocked for more than 120 seconds. [ 247.137311] Not tainted 4.12.0-rc2.upstream+ #4 [ 247.142954] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 247.151704] Call Trace: [ 247.154445] __schedule+0x28a/0x880 [ 247.158341] schedule+0x36/0x80 [ 247.161850] blk_mq_freeze_queue_wait+0x4b/0xb0 [ 247.166913] ? remove_wait_queue+0x60/0x60 [ 247.171485] blk_freeze_queue+0x1a/0x20 [ 247.175770] blk_cleanup_queue+0x7f/0x140 [ 247.180252] nvme_ns_remove+0xa3/0xb0 [nvme_core] [ 247.185503] nvme_remove_namespaces+0x32/0x50 [nvme_core] [ 247.191532] nvme_uninit_ctrl+0x2d/0xa0 [nvme_core] [ 247.196977] nvme_remove+0x70/0x110 [nvme] [ 247.201545] pci_device_remove+0x39/0xc0 [ 247.205927] device_release_driver_internal+0x141/0x200 [ 247.211761] device_release_driver+0x12/0x20 [ 247.216531] pci_stop_bus_device+0x8c/0xa0 [ 247.221104] pci_stop_and_remove_bus_device_locked+0x1a/0x30 [ 247.227420] remove_store+0x7c/0x90 [ 247.231320] dev_attr_store+0x18/0x30 [ 247.235409] sysfs_kf_write+0x3a/0x50 [ 247.239497] kernfs_fop_write+0xff/0x180 [ 247.243867] __vfs_write+0x37/0x160 [ 247.247757] ? selinux_file_permission+0xe5/0x120 [ 247.253011] ? security_file_permission+0x3b/0xc0 [ 247.258260] vfs_write+0xb2/0x1b0 [ 247.261964] ? syscall_trace_enter+0x1d0/0x2b0 [ 247.266924] SyS_write+0x55/0xc0 [ 247.270540] do_syscall_64+0x67/0x150 [ 247.274636] entry_SYSCALL64_slow_path+0x25/0x25 [ 247.279794] RIP: 0033:0x7f5c96740840 [ 247.283785] RSP: 002b:00007ffd00e87ee8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 247.292238] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f5c96740840 [ 247.300194] RDX: 0000000000000002 RSI: 00007f5c97060000 RDI: 0000000000000001 [ 247.308159] RBP: 00007f5c97060000 R08: 000000000000000a R09: 00007f5c97059740 [ 247.316123] R10: 0000000000000001 R11: 0000000000000246 R12: 00007f5c96a14400 [ 247.324087] R13: 0000000000000002 R14: 0000000000000001 R15: 0000000000000000 [ 370.016340] INFO: task nvme-test:1772 blocked for more than 120 seconds. Fixes: 12d70958a2e8(blk-mq: don't fail allocating driver tag for stopped hw queue) Cc: stable@vger.kernel.org Signed-off-by: Ming Lei Reviewed-by: Bart Van Assche Signed-off-by: Jens Axboe block/blk-mq.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) commit dad7a3be4960e5545882a0cd8d7613af22874314 Author: Ming Lei Date: Tue Jun 6 23:21:59 2017 +0800 blk-mq: pass correct hctx to blk_mq_try_issue_directly When direct issue is done on request picked up from plug list, the hctx need to be updated with the actual hw queue, otherwise wrong hctx is used and may hurt performance, especially when wrong SRCU readlock is acquired/released Reported-by: Bart Van Assche Signed-off-by: Ming Lei Signed-off-by: Jens Axboe block/blk-mq.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit f4eb17e1efe538d4da7d574bedb00a8dafcc26b7 Author: David S. Miller Date: Tue Jun 6 11:34:06 2017 -0400 Revert "sit: reload iphdr in ipip6_rcv" This reverts commit b699d0035836f6712917a41e7ae58d84359b8ff9. As per Eric Dumazet, the pskb_may_pull() is a NOP in this particular case, so the 'iph' reload is unnecessary. Signed-off-by: David S. Miller net/ipv6/sit.c | 1 - 1 file changed, 1 deletion(-) commit 9ba26a7283f56100eb08a2df48f17da600f60d52 Author: Cao jin Date: Tue Jun 6 17:07:53 2017 +0800 Kbuild: tiny correction on `make help` The help info of `make C=1` is little confusing, make it clear. Signed-off-by: Cao jin Signed-off-by: Masahiro Yamada Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b2cc3c8071bee6e3defa54b701671d310cb94f3c Author: John Stultz Date: Tue May 23 09:40:26 2017 -0700 drm: kirin: Fix drm_of_find_panel_or_bridge conversion This fixes a regression introduced by ebc944613567 ("drm: convert drivers to use drm_of_find_panel_or_bridge") that was recently merged, causing HDMI output to not work. For the kirin driver, the port value should be 1 instead of 0, so this oneline patch fixes it and gets graphics working again. Cc: Rob Herring Cc: Archit Taneja Cc: Philipp Zabel Cc: Maxime Ripard Cc: Sean Paul Cc: Dave Airlie Cc: Xinliang Liu Fix-suggested-by: Rob Herring Signed-off-by: John Stultz Reviewed-by: Xinliang Liu Signed-off-by: Sean Paul Link: http://patchwork.freedesktop.org/patch/msgid/1495557626-25285-1-git-send-email-john.stultz@linaro.org drivers/gpu/drm/hisilicon/kirin/dw_drm_dsi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 26f4b1f7a8da3eaa6c32e12f87c9f5388196dc67 Author: Gilad Ben-Yossef Date: Tue Jun 6 11:00:45 2017 +0300 staging: ccree: fix buffer copy Fix a bug where the copying of scatterlist buffers incorrectly ignored bytes to skip in a scatterlist and ended 1 byte short. This fixes testmgr hmac and hash test failures currently obscured by hash import/export not being supported. Fixes: abefd6741d ("staging: ccree: introduce CryptoCell HW driver"). Signed-off-by: Gilad Ben-Yossef Signed-off-by: Greg Kroah-Hartman drivers/staging/ccree/ssi_buffer_mgr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit d6dbdd3c8558cad3b6d74cc357b408622d122331 Author: Marc Zyngier Date: Mon Jun 5 19:17:18 2017 +0100 KVM: arm/arm64: Handle possible NULL stage2 pud when ageing pages Under memory pressure, we start ageing pages, which amounts to parsing the page tables. Since we don't want to allocate any extra level, we pass NULL for our private allocation cache. Which means that stage2_get_pud() is allowed to fail. This results in the following splat: [ 1520.409577] Unable to handle kernel NULL pointer dereference at virtual address 00000008 [ 1520.417741] pgd = ffff810f52fef000 [ 1520.421201] [00000008] *pgd=0000010f636c5003, *pud=0000010f56f48003, *pmd=0000000000000000 [ 1520.429546] Internal error: Oops: 96000006 [#1] PREEMPT SMP [ 1520.435156] Modules linked in: [ 1520.438246] CPU: 15 PID: 53550 Comm: qemu-system-aar Tainted: G W 4.12.0-rc4-00027-g1885c397eaec #7205 [ 1520.448705] Hardware name: FOXCONN R2-1221R-A4/C2U4N_MB, BIOS G31FB12A 10/26/2016 [ 1520.463726] task: ffff800ac5fb4e00 task.stack: ffff800ce04e0000 [ 1520.469666] PC is at stage2_get_pmd+0x34/0x110 [ 1520.474119] LR is at kvm_age_hva_handler+0x44/0xf0 [ 1520.478917] pc : [] lr : [] pstate: 40000145 [ 1520.486325] sp : ffff800ce04e33d0 [ 1520.489644] x29: ffff800ce04e33d0 x28: 0000000ffff40064 [ 1520.494967] x27: 0000ffff27e00000 x26: 0000000000000000 [ 1520.500289] x25: ffff81051ba65008 x24: 0000ffff40065000 [ 1520.505618] x23: 0000ffff40064000 x22: 0000000000000000 [ 1520.510947] x21: ffff810f52b20000 x20: 0000000000000000 [ 1520.516274] x19: 0000000058264000 x18: 0000000000000000 [ 1520.521603] x17: 0000ffffa6fe7438 x16: ffff000008278b70 [ 1520.526940] x15: 000028ccd8000000 x14: 0000000000000008 [ 1520.532264] x13: ffff7e0018298000 x12: 0000000000000002 [ 1520.537582] x11: ffff000009241b93 x10: 0000000000000940 [ 1520.542908] x9 : ffff0000092ef800 x8 : 0000000000000200 [ 1520.548229] x7 : ffff800ce04e36a8 x6 : 0000000000000000 [ 1520.553552] x5 : 0000000000000001 x4 : 0000000000000000 [ 1520.558873] x3 : 0000000000000000 x2 : 0000000000000008 [ 1520.571696] x1 : ffff000008fd5000 x0 : ffff0000080b149c [ 1520.577039] Process qemu-system-aar (pid: 53550, stack limit = 0xffff800ce04e0000) [...] [ 1521.510735] [] stage2_get_pmd+0x34/0x110 [ 1521.516221] [] kvm_age_hva_handler+0x44/0xf0 [ 1521.522054] [] handle_hva_to_gpa+0xb8/0xe8 [ 1521.527716] [] kvm_age_hva+0x44/0xf0 [ 1521.532854] [] kvm_mmu_notifier_clear_flush_young+0x70/0xc0 [ 1521.539992] [] __mmu_notifier_clear_flush_young+0x88/0xd0 [ 1521.546958] [] page_referenced_one+0xf0/0x188 [ 1521.552881] [] rmap_walk_anon+0xec/0x250 [ 1521.558370] [] rmap_walk+0x78/0xa0 [ 1521.563337] [] page_referenced+0x164/0x180 [ 1521.569002] [] shrink_active_list+0x178/0x3b8 [ 1521.574922] [] shrink_node_memcg+0x328/0x600 [ 1521.580758] [] shrink_node+0xc4/0x328 [ 1521.585986] [] do_try_to_free_pages+0xc0/0x340 [ 1521.592000] [] try_to_free_pages+0xcc/0x240 [...] The trivial fix is to handle this NULL pud value early, rather than dereferencing it blindly. Cc: stable@vger.kernel.org Signed-off-by: Marc Zyngier Reviewed-by: Christoffer Dall Signed-off-by: Christoffer Dall virt/kvm/arm/mmu.c | 3 +++ 1 file changed, 3 insertions(+) commit d4912215d1031e4fb3d1038d2e1857218dba0d0a Author: Wanpeng Li Date: Mon Jun 5 05:19:09 2017 -0700 KVM: nVMX: Fix exception injection WARNING: CPU: 3 PID: 2840 at arch/x86/kvm/vmx.c:10966 nested_vmx_vmexit+0xdcd/0xde0 [kvm_intel] CPU: 3 PID: 2840 Comm: qemu-system-x86 Tainted: G OE 4.12.0-rc3+ #23 RIP: 0010:nested_vmx_vmexit+0xdcd/0xde0 [kvm_intel] Call Trace: ? kvm_check_async_pf_completion+0xef/0x120 [kvm] ? rcu_read_lock_sched_held+0x79/0x80 vmx_queue_exception+0x104/0x160 [kvm_intel] ? vmx_queue_exception+0x104/0x160 [kvm_intel] kvm_arch_vcpu_ioctl_run+0x1171/0x1ce0 [kvm] ? kvm_arch_vcpu_load+0x47/0x240 [kvm] ? kvm_arch_vcpu_load+0x62/0x240 [kvm] kvm_vcpu_ioctl+0x384/0x7b0 [kvm] ? kvm_vcpu_ioctl+0x384/0x7b0 [kvm] ? __fget+0xf3/0x210 do_vfs_ioctl+0xa4/0x700 ? __fget+0x114/0x210 SyS_ioctl+0x79/0x90 do_syscall_64+0x81/0x220 entry_SYSCALL64_slow_path+0x25/0x25 This is triggered occasionally by running both win7 and win2016 in L2, in addition, EPT is disabled on both L1 and L2. It can't be reproduced easily. Commit 0b6ac343fc (KVM: nVMX: Correct handling of exception injection) mentioned that "KVM wants to inject page-faults which it got to the guest. This function assumes it is called with the exit reason in vmcs02 being a #PF exception". Commit e011c663 (KVM: nVMX: Check all exceptions for intercept during delivery to L2) allows to check all exceptions for intercept during delivery to L2. However, there is no guarantee the exit reason is exception currently, when there is an external interrupt occurred on host, maybe a time interrupt for host which should not be injected to guest, and somewhere queues an exception, then the function nested_vmx_check_exception() will be called and the vmexit emulation codes will try to emulate the "Acknowledge interrupt on exit" behavior, the warning is triggered. Reusing the exit reason from the L2->L0 vmexit is wrong in this case, the reason must always be EXCEPTION_NMI when injecting an exception into L1 as a nested vmexit. Cc: Paolo Bonzini Cc: Radim Krčmář Signed-off-by: Wanpeng Li Fixes: e011c663b9c7 ("KVM: nVMX: Check all exceptions for intercept during delivery to L2") Signed-off-by: Radim Krčmář arch/x86/kvm/vmx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3db28271f0feae129262d30e41384a7c4c767987 Author: Sebastian Parschauer Date: Tue Jun 6 13:53:13 2017 +0200 HID: Add quirk for Dell PIXART OEM mouse This mouse is also known under other IDs. It needs the quirk ALWAYS_POLL or will disconnect in runlevel 1 or 3. Signed-off-by: Sebastian Parschauer CC: stable@vger.kernel.org Signed-off-by: Jiri Kosina drivers/hid/hid-ids.h | 3 +++ drivers/hid/usbhid/hid-quirks.c | 1 + 2 files changed, 4 insertions(+) commit bbaf0e2b1c1b4f88abd6ef49576f0efb1734eae5 Author: Paolo Bonzini Date: Wed Apr 26 16:56:26 2017 +0200 kvm: async_pf: fix rcu_irq_enter() with irqs enabled native_safe_halt enables interrupts, and you just shouldn't call rcu_irq_enter() with interrupts enabled. Reorder the call with the following local_irq_disable() to respect the invariant. Reported-by: Ross Zwisler Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini Acked-by: Paul E. McKenney Tested-by: Wanpeng Li Signed-off-by: Radim Krčmář arch/x86/kernel/kvm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0e3e97526a850f97c9fe8b646937b3a2bef58290 Author: Felipe Balbi Date: Tue Jun 6 14:47:29 2017 +0300 usb: gadget: composite: make sure to reactivate function on unbind If a function sets bind_deactivated flag, upon removal we will be left with an unbalanced deactivation. Let's make sure that we conditionally call usb_function_activate() from usb_remove_function() and make sure usb_remove_function() is called from remove_config(). Signed-off-by: Felipe Balbi drivers/usb/gadget/composite.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) commit 8c218578fcbbbdb10416c8614658bf32e3bf1655 Author: Madhavan Srinivasan Date: Fri May 26 13:38:27 2017 +0530 powerpc/perf: Fix Power9 test_adder fields Commit 8d911904f3ce4 ('powerpc/perf: Add restrictions to PMC5 in power9 DD1') was added to restrict the use of PMC5 in Power9 DD1. Intention was to disable the use of PMC5 using raw event code. But instead of updating the power9_isa207_pmu structure (used on DD1), the commit incorrectly updated the power9_pmu structure. Fix it. Fixes: 8d911904f3ce ("powerpc/perf: Add restrictions to PMC5 in power9 DD1") Reported-by: Shriya Signed-off-by: Madhavan Srinivasan Tested-by: Shriya Signed-off-by: Michael Ellerman arch/powerpc/perf/power9-pmu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit ba4a648f12f4cd0a8003dd229b6ca8a53348ee4b Author: Michael Ellerman Date: Tue Jun 6 20:23:57 2017 +1000 powerpc/numa: Fix percpu allocations to be NUMA aware In commit 8c272261194d ("powerpc/numa: Enable USE_PERCPU_NUMA_NODE_ID"), we switched to the generic implementation of cpu_to_node(), which uses a percpu variable to hold the NUMA node for each CPU. Unfortunately we neglected to notice that we use cpu_to_node() in the allocation of our percpu areas, leading to a chicken and egg problem. In practice what happens is when we are setting up the percpu areas, cpu_to_node() reports that all CPUs are on node 0, so we allocate all percpu areas on node 0. This is visible in the dmesg output, as all pcpu allocs being in group 0: pcpu-alloc: [0] 00 01 02 03 [0] 04 05 06 07 pcpu-alloc: [0] 08 09 10 11 [0] 12 13 14 15 pcpu-alloc: [0] 16 17 18 19 [0] 20 21 22 23 pcpu-alloc: [0] 24 25 26 27 [0] 28 29 30 31 pcpu-alloc: [0] 32 33 34 35 [0] 36 37 38 39 pcpu-alloc: [0] 40 41 42 43 [0] 44 45 46 47 To fix it we need an early_cpu_to_node() which can run prior to percpu being setup. We already have the numa_cpu_lookup_table we can use, so just plumb it in. With the patch dmesg output shows two groups, 0 and 1: pcpu-alloc: [0] 00 01 02 03 [0] 04 05 06 07 pcpu-alloc: [0] 08 09 10 11 [0] 12 13 14 15 pcpu-alloc: [0] 16 17 18 19 [0] 20 21 22 23 pcpu-alloc: [1] 24 25 26 27 [1] 28 29 30 31 pcpu-alloc: [1] 32 33 34 35 [1] 36 37 38 39 pcpu-alloc: [1] 40 41 42 43 [1] 44 45 46 47 We can also check the data_offset in the paca of various CPUs, with the fix we see: CPU 0: data_offset = 0x0ffe8b0000 CPU 24: data_offset = 0x1ffe5b0000 And we can see from dmesg that CPU 24 has an allocation on node 1: node 0: [mem 0x0000000000000000-0x0000000fffffffff] node 1: [mem 0x0000001000000000-0x0000001fffffffff] Cc: stable@vger.kernel.org # v3.16+ Fixes: 8c272261194d ("powerpc/numa: Enable USE_PERCPU_NUMA_NODE_ID") Signed-off-by: Michael Ellerman Reviewed-by: Nicholas Piggin Signed-off-by: Michael Ellerman arch/powerpc/include/asm/topology.h | 14 ++++++++++++++ arch/powerpc/kernel/setup_64.c | 4 ++-- 2 files changed, 16 insertions(+), 2 deletions(-) commit 4eab0ea196f569ed2085a0fa3729f60eb8edaad1 Author: Takashi Iwai Date: Tue Jun 6 12:33:17 2017 +0200 ALSA: hda/realtek - Reorder ALC269 ASUS quirk entries A disorder is found in some ALC269 quirk entries for ASUS (1043:xxxx), which should have been sorted in PCI SSID order. Rearrange them, so that I won't overlook the already existing entry like I did a couple of times in the past... Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 28e8af8a163ed6afe9498f1d499a5061c2214755 Author: Chris Chiu Date: Mon Jun 5 15:05:30 2017 -0600 ALSA: hda/realtek: Fix mic and headset jack sense on Asus X705UD The ASUS X705UD laptop requires the known fixup ALC256_FIXUP_ASUS_MIC in order to fix headphone jack sensing and to enable use of the internal microphone. Unfortunately jack sensing for the headset mic is still not working. [rearranged the position to keep the PCI SSID order -- tiwai] Signed-off-by: Chris Chiu Signed-off-by: Daniel Drake Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) commit f8c627fbabbe9ed6ae68dcfefb7519bd153a7ac0 Author: Sean Young Date: Tue May 16 04:56:14 2017 -0300 [media] sir_ir: infinite loop in interrupt handler Since this driver does no detection of hardware, it might be used with a non-sir port. Escape out if we are spinning. Reported-by: kbuild test robot Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab drivers/media/rc/sir_ir.c | 6 ++++++ 1 file changed, 6 insertions(+) commit ae8eb443a17331a07579bc04817accaaaa62b78e Author: Arnd Bergmann Date: Fri May 12 16:39:21 2017 -0300 [media] cec-notifier.h: handle unreachable CONFIG_CEC_CORE Fix a link error in this specific combination of config options: CONFIG_MEDIA_CEC_SUPPORT=y CONFIG_CEC_CORE=m CONFIG_MEDIA_CEC_NOTIFIER=y CONFIG_VIDEO_STI_HDMI_CEC=m CONFIG_DRM_STI=y drivers/gpu/drm/sti/sti_hdmi.o: In function `sti_hdmi_remove': sti_hdmi.c:(.text.sti_hdmi_remove+0x10): undefined reference to `cec_notifier_set_phys_addr' sti_hdmi.c:(.text.sti_hdmi_remove+0x34): undefined reference to `cec_notifier_put' drivers/gpu/drm/sti/sti_hdmi.o: In function `sti_hdmi_connector_get_modes': sti_hdmi.c:(.text.sti_hdmi_connector_get_modes+0x4a): undefined reference to `cec_notifier_set_phys_addr_from_edid' drivers/gpu/drm/sti/sti_hdmi.o: In function `sti_hdmi_probe': sti_hdmi.c:(.text.sti_hdmi_probe+0x204): undefined reference to `cec_notifier_get' drivers/gpu/drm/sti/sti_hdmi.o: In function `sti_hdmi_connector_detect': sti_hdmi.c:(.text.sti_hdmi_connector_detect+0x36): undefined reference to `cec_notifier_set_phys_addr' drivers/gpu/drm/sti/sti_hdmi.o: In function `sti_hdmi_disable': sti_hdmi.c:(.text.sti_hdmi_disable+0xc0): undefined reference to `cec_notifier_set_phys_addr' The version below seems to work, though I don't particularly like the IS_REACHABLE() addition since that can be confusing to users. Signed-off-by: Arnd Bergmann Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab include/media/cec-notifier.h | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 2302e5591a4ad2d66107c75b6be170121bff5ccd Author: Arnd Bergmann Date: Fri Apr 21 07:52:17 2017 -0300 [media] cec: improve MEDIA_CEC_RC dependencies Changing the IS_REACHABLE() into a plain #ifdef broke the case of CONFIG_MEDIA_RC=m && CONFIG_MEDIA_CEC=y: drivers/media/cec/cec-core.o: In function `cec_unregister_adapter': cec-core.c:(.text.cec_unregister_adapter+0x18): undefined reference to `rc_unregister_device' drivers/media/cec/cec-core.o: In function `cec_delete_adapter': cec-core.c:(.text.cec_delete_adapter+0x54): undefined reference to `rc_free_device' drivers/media/cec/cec-core.o: In function `cec_register_adapter': cec-core.c:(.text.cec_register_adapter+0x94): undefined reference to `rc_register_device' cec-core.c:(.text.cec_register_adapter+0xa4): undefined reference to `rc_free_device' cec-core.c:(.text.cec_register_adapter+0x110): undefined reference to `rc_unregister_device' drivers/media/cec/cec-core.o: In function `cec_allocate_adapter': cec-core.c:(.text.cec_allocate_adapter+0x234): undefined reference to `rc_allocate_device' drivers/media/cec/cec-adap.o: In function `cec_received_msg': cec-adap.c:(.text.cec_received_msg+0x734): undefined reference to `rc_keydown' cec-adap.c:(.text.cec_received_msg+0x768): undefined reference to `rc_keyup' This adds an additional dependency to explicitly forbid this combination. Fixes: 5f2c467c54f5 ("[media] cec: add MEDIA_CEC_RC config option") Signed-off-by: Arnd Bergmann Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab drivers/media/cec/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 5ebb6dd36c9f5fb37b1077b393c254d70a14cb46 Author: Christophe JAILLET Date: Fri Apr 28 01:51:40 2017 -0300 [media] vb2: Fix an off by one error in 'vb2_plane_vaddr' We should ensure that 'plane_no' is '< vb->num_planes' as done in 'vb2_plane_cookie' just a few lines below. Fixes: e23ccc0ad925 ("[media] v4l: add videobuf2 Video for Linux 2 driver framework") Cc: stable@vger.kernel.org Signed-off-by: Christophe JAILLET Reviewed-by: Sakari Ailus Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab drivers/media/v4l2-core/videobuf2-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e0f2e5eb14668dc798942ff5f4241d9bd17f9655 Author: Wei Yongjun Date: Tue Apr 25 00:12:46 2017 -0300 [media] rainshadow-cec: Fix missing spin_lock_init() The driver allocates the spinlock but not initialize it. Use spin_lock_init() on it to initialize it correctly. This is detected by Coccinelle semantic patch. Fixes: 0f314f6c2e77 ("[media] rainshadow-cec: new RainShadow Tech HDMI CEC driver") Signed-off-by: Wei Yongjun Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab drivers/media/usb/rainshadow-cec/rainshadow-cec.c | 1 + 1 file changed, 1 insertion(+) commit 4b0755e90ae03ba40174842af6fa810355960fbc Author: Philipp Zabel Date: Thu May 4 12:20:17 2017 -0300 [media] tc358743: fix register i2c_rd/wr function fix The below mentioned fix contains a small but severe bug, fix it to make the driver work again. Fixes: 3538aa6ecfb2 ("[media] tc358743: fix register i2c_rd/wr functions") Cc: Hans Verkuil Cc: Mauro Carvalho Chehab Signed-off-by: Philipp Zabel Acked-by: Arnd Bergmann Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab drivers/media/i2c/tc358743.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2aae918c7a21fb8388ab30b8abd4d9240e8ebd7f Author: Björn Töpel Date: Mon May 15 06:52:00 2017 +0200 i40e/i40evf: proper update of the page_offset field In f8b45b74cc62 ("i40e/i40evf: Use build_skb to build frames") i40e_build_skb updates the page_offset field with an incorrect offset, which can lead to data corruption. This patch updates page_offset correctly, by properly setting truesize. Note that the bug only appears on architectures where PAGE_SIZE is 8192 or larger. Fixes: f8b45b74cc62 ("i40e/i40evf: Use build_skb to build frames") Signed-off-by: Björn Töpel Acked-by: Alexander Duyck Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/i40e/i40e_txrx.c | 3 ++- drivers/net/ethernet/intel/i40evf/i40e_txrx.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) commit 9e6c9c0f2ce67534fda1fdd305fb5da3defece3e Author: Mauro S. M. Rodrigues Date: Fri May 12 23:26:56 2017 -0300 i40e: Fix state flags for bit set and clean operations of PF Commit 0da36b9774cc ("i40e: use DECLARE_BITMAP for state fields") introduced changes in the way i40e works with state flags converting them to bitmaps using kernel bitmap API. This change introduced a regression due to a mistaken substitution using __I40E_VSI_DOWN instead of __I40E_DOWN when testing state of a PF at i40e_reset_subtask() function. This caused a flood in the kernel log with the follow message: [49.013] i40e 0002:01:00.0: bad reset request 0x00000020 Commit d19cb64b9222 ("i40e: separate PF and VSI state flags") also introduced some misuse of the VSI and PF flags, so both could be considered as the offenders. This patch simply fixes the flags where it makes sense by changing __I40E_VSI_DOWN to __I40E_DOWN. Fixes: 0da36b9774cc ("i40e: use DECLARE_BITMAP for state fields") Fixes: d19cb64b9222 ("i40e: separate PF and VSI state flags") Reviewed-by: "Guilherme G. Piccoli" Signed-off-by: "Mauro S. M. Rodrigues" Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/i40e/i40e_main.c | 36 ++++++++++++++--------------- 1 file changed, 18 insertions(+), 18 deletions(-) commit 27fef9f8ecb0495d302deba210606a32e54db37a Author: Charles Keepax Date: Tue Jun 6 09:46:33 2017 +0100 mfd: arizona: Fix typo using hard-coded register A hardcoded register is accidentally used instead of the register address passed into the function. Correct this and use the appropriate variable. This would cause minor issues on wm5102, but all other devices using this driver would have been unaffected. Fixes: commit ef84f885e037 ("mfd: arizona: Refactor arizona_poll_reg") Reported-by: Andrzej Hajda Signed-off-by: Charles Keepax Signed-off-by: Lee Jones drivers/mfd/arizona-core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit b3aa20ba2ba8072b73bd799605b8c98927b7056c Author: Vaibhav Jain Date: Fri Jun 2 22:26:48 2017 +0530 cxl: Avoid double free_irq() for psl,slice interrupts During an eeh call to cxl_remove can result in double free_irq of psl,slice interrupts. This can happen if perst_reloads_same_image == 1 and call to cxl_configure_adapter() fails during slot_reset callback. In such a case we see a kernel oops with following back-trace: Oops: Kernel access of bad area, sig: 11 [#1] Call Trace: free_irq+0x88/0xd0 (unreliable) cxl_unmap_irq+0x20/0x40 [cxl] cxl_native_release_psl_irq+0x78/0xd8 [cxl] pci_deconfigure_afu+0xac/0x110 [cxl] cxl_remove+0x104/0x210 [cxl] pci_device_remove+0x6c/0x110 device_release_driver_internal+0x204/0x2e0 pci_stop_bus_device+0xa0/0xd0 pci_stop_and_remove_bus_device+0x28/0x40 pci_hp_remove_devices+0xb0/0x150 pci_hp_remove_devices+0x68/0x150 eeh_handle_normal_event+0x140/0x580 eeh_handle_event+0x174/0x360 eeh_event_handler+0x1e8/0x1f0 This patch fixes the issue of double free_irq by checking that variables that hold the virqs (err_hwirq, serr_hwirq, psl_virq) are not '0' before un-mapping and resetting these variables to '0' when they are un-mapped. Cc: stable@vger.kernel.org Signed-off-by: Vaibhav Jain Reviewed-by: Andrew Donnellan Acked-by: Frederic Barrat Signed-off-by: Michael Ellerman drivers/misc/cxl/native.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) commit 7f22ced4377628074e2ac25f41a88f98eb3b03f1 Author: Breno Leitao Date: Mon Jun 5 11:40:59 2017 -0300 powerpc/kernel: Initialize load_tm on task creation Currently tsk->thread.load_tm is not initialized in the task creation and can contain garbage on a new task. This is an undesired behaviour, since it affects the timing to enable and disable the transactional memory laziness (disabling and enabling the MSR TM bit, which affects TM reclaim and recheckpoint in the scheduling process). Fixes: 5d176f751ee3 ("powerpc: tm: Enable transactional memory (TM) lazily for userspace") Cc: stable@vger.kernel.org # v4.9+ Signed-off-by: Breno Leitao Signed-off-by: Michael Ellerman arch/powerpc/kernel/process.c | 1 + 1 file changed, 1 insertion(+) commit b7dfee2433576f1f030cb84cdb04b70f36554992 Author: Marek Vasut Date: Sat Jun 3 11:57:21 2017 -0700 gpu: ipu-v3: Fix CSI selection for VDIC The description of the CSI_SEL bit in the i.MX6 reference manual is incorrect. It states "This bit defines which CSI is the input to the IC. This bit is effective only if IC_INPUT is bit cleared". From experiment it was found this is in fact not correct. The CSI_SEL bit selects which CSI is input to _both_ the VDIC _and_ the IC. If the IC_INPUT bit is set so that the IC is receiving from the VDIC, the IC ignores the CSI_SEL bit, but CSI_SEL still selects which CSI the VDIC receives from in that case. Signed-off-by: Marek Vasut Signed-off-by: Steve Longerbeam Signed-off-by: Philipp Zabel drivers/gpu/ipu-v3/ipu-common.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) commit e36aecba54bf24387271f2d7b989cc686a389931 Author: Leonard Crestez Date: Wed May 10 16:17:13 2017 +0300 drm/imx: imx-ldb: Accept drm_of_find_panel_or_bridge failure Not having an endpoint bound in DT should not cause a failure here, there are fallbacks. So explicitly accept a missing endpoint. This behavior change was introduced by refactoring in drm_of parsing code and it should not require dts changes. In particular this fixes imx6qdl-sabreauto boards. Link: https://lists.freedesktop.org/archives/dri-devel/2017-May/141233.html Fixes: ebc944613567 ("drm: convert drivers to use drm_of_find_panel_or_bridge") Signed-off-by: Leonard Crestez Signed-off-by: Philipp Zabel drivers/gpu/drm/imx/imx-ldb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 47c298f792992c6eda26fc4e4630c7ca54dcec47 Author: Lucas Stach Date: Wed May 3 10:38:18 2017 +0200 gpu: ipu-v3: pre: only use internal clock gating By setting the SFTRST bit, the PRE will be held in the lowest power state with clocks to the internal blocks gated. When external clock gating is used (from the external clock controller, or by setting the CLKGATE bit) the PRE will sporadically fail to start. Signed-off-by: Lucas Stach Fixes: d2a34232580a ("gpu: ipu-v3: add driver for Prefetch Resolve Engine") Signed-off-by: Philipp Zabel drivers/gpu/ipu-v3/ipu-pre.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) commit d68356cc51e304ff9a389f006b6249d41f2c2319 Author: Christoffer Dall Date: Sun Jun 4 22:17:02 2017 +0200 KVM: arm/arm64: vgic-v3: Fix nr_pre_bits bitfield extraction We used to extract PRIbits from the ICH_VT_EL2 which was the upper field in the register word, so a mask wasn't necessary, but as we switched to looking at PREbits, which is bits 26 through 28 with the PRIbits field being potentially non-zero, we really need to mask off the field value, otherwise fun things may happen. Signed-off-by: Christoffer Dall Acked-by: Marc Zyngier virt/kvm/arm/hyp/vgic-v3-sr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e5b4ab1ffbe2553ee278cb1b6bcb671a31d86518 Merge: 1f779cd 75fb636 Author: Dave Airlie Date: Tue Jun 6 16:52:15 2017 +1000 Merge tag 'drm-misc-fixes-2017-06-02' of git://anongit.freedesktop.org/git/drm-misc into drm-fixes Core Changes: - Grab locks in drm_atomic_helper_resume() (Daniel) - Fix oops when unplugging USB device (expand cleanup in drm_unplug_dev) (Hans) Driver Changes: - rockchip: Don't output 10-bit format to 8-bit encoders (Mark) Cc: Mark yao Cc: Daniel Vetter Cc: Hans de Goede * tag 'drm-misc-fixes-2017-06-02' of git://anongit.freedesktop.org/git/drm-misc: drm: Fix oops + Xserver hang when unplugging USB drm devices drm: Fix locking in drm_atomic_helper_resume drm/rockchip: Correct vop out_mode configure commit 1f779cd74507d7cc3ea16087163f0509e74ef022 Merge: 3c2993b b4e382c Author: Dave Airlie Date: Tue Jun 6 16:10:16 2017 +1000 Merge branch 'linux-4.12' of git://github.com/skeggsb/linux into drm-fixes 4 nouveau regression fixes. * 'linux-4.12' of git://github.com/skeggsb/linux: drm/nouveau/tmr: fully separate alarm execution/pending lists drm/nouveau: enable autosuspend only when it'll actually be used drm/nouveau: replace multiple open-coded runpm support checks with function drm/nouveau/kms/nv50: add null check before pointer dereference commit b4e382ca7586a63b6c1e5221ce0863ff867c2df6 Author: Ben Skeggs Date: Mon Jun 5 17:23:32 2017 +1000 drm/nouveau/tmr: fully separate alarm execution/pending lists Reusing the list_head for both is a bad idea. Callback execution is done with the lock dropped so that alarms can be rescheduled from the callback, which means that with some unfortunate timing, lists can get corrupted. The execution list should not require its own locking, the single function that uses it can only be called from a single context. Signed-off-by: Ben Skeggs Cc: stable@vger.kernel.org drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h | 1 + drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c | 7 ++++--- 2 files changed, 5 insertions(+), 3 deletions(-) commit 8fa4338acca96cbc231e4125229632e879476464 Author: Ben Skeggs Date: Fri Jun 2 14:49:45 2017 +1000 drm/nouveau: enable autosuspend only when it'll actually be used This prevents a deadlock that somehow results from the suspend() -> forbid() -> resume() callchain. [ 125.266960] [drm] Initialized nouveau 1.3.1 20120801 for 0000:02:00.0 on minor 1 [ 370.120872] INFO: task kworker/4:1:77 blocked for more than 120 seconds. [ 370.120920] Tainted: G O 4.12.0-rc3 #20 [ 370.120947] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 370.120982] kworker/4:1 D13808 77 2 0x00000000 [ 370.120998] Workqueue: pm pm_runtime_work [ 370.121004] Call Trace: [ 370.121018] __schedule+0x2bf/0xb40 [ 370.121025] ? mark_held_locks+0x5f/0x90 [ 370.121038] schedule+0x3d/0x90 [ 370.121044] rpm_resume+0x107/0x870 [ 370.121052] ? finish_wait+0x90/0x90 [ 370.121065] ? pci_pm_runtime_resume+0xa0/0xa0 [ 370.121070] pm_runtime_forbid+0x4c/0x60 [ 370.121129] nouveau_pmops_runtime_suspend+0xaf/0xc0 [nouveau] [ 370.121139] pci_pm_runtime_suspend+0x5f/0x170 [ 370.121147] ? pci_pm_runtime_resume+0xa0/0xa0 [ 370.121152] __rpm_callback+0xb9/0x1e0 [ 370.121159] ? pci_pm_runtime_resume+0xa0/0xa0 [ 370.121166] rpm_callback+0x24/0x80 [ 370.121171] ? pci_pm_runtime_resume+0xa0/0xa0 [ 370.121176] rpm_suspend+0x138/0x6e0 [ 370.121192] pm_runtime_work+0x7b/0xc0 [ 370.121199] process_one_work+0x253/0x6a0 [ 370.121216] worker_thread+0x4d/0x3b0 [ 370.121229] kthread+0x133/0x150 [ 370.121234] ? process_one_work+0x6a0/0x6a0 [ 370.121238] ? kthread_create_on_node+0x70/0x70 [ 370.121246] ret_from_fork+0x2a/0x40 [ 370.121283] Showing all locks held in the system: [ 370.121291] 2 locks held by kworker/4:1/77: [ 370.121298] #0: ("pm"){.+.+.+}, at: [] process_one_work+0x1d0/0x6a0 [ 370.121315] #1: ((&dev->power.work)){+.+.+.}, at: [] process_one_work+0x1d0/0x6a0 [ 370.121330] 1 lock held by khungtaskd/81: [ 370.121333] #0: (tasklist_lock){.+.+..}, at: [] debug_show_all_locks+0x3d/0x1a0 [ 370.121355] 1 lock held by dmesg/1639: [ 370.121358] #0: (&user->lock){+.+.+.}, at: [] devkmsg_read+0x4d/0x360 [ 370.121377] ============================================= Signed-off-by: Ben Skeggs drivers/gpu/drm/nouveau/nouveau_drm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 321f5c5f2c494f3c94cec2289c8add678657ba2d Author: Ben Skeggs Date: Fri Jun 2 14:38:07 2017 +1000 drm/nouveau: replace multiple open-coded runpm support checks with function Signed-off-by: Ben Skeggs drivers/gpu/drm/nouveau/nouveau_drm.c | 34 +++++++++++++++------------------- drivers/gpu/drm/nouveau/nouveau_drv.h | 3 +-- drivers/gpu/drm/nouveau/nouveau_vga.c | 13 ++----------- 3 files changed, 18 insertions(+), 32 deletions(-) commit 86276921a17ee3090749c9f38f57dcfb73733bd4 Author: Gustavo A. R. Silva Date: Mon May 22 14:12:37 2017 -0500 drm/nouveau/kms/nv50: add null check before pointer dereference Add null check before dereferencing pointer asyc Addresses-Coverity-ID: 1397932 Signed-off-by: Gustavo A. R. Silva Signed-off-by: Ben Skeggs drivers/gpu/drm/nouveau/nv50_display.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit e5c86679d5e864947a52fb31e45a425dea3e7fa9 Author: Max Filippov Date: Mon Jun 5 02:43:51 2017 -0700 xtensa: don't use linux IRQ #0 Linux IRQ #0 is reserved for error reporting and may not be used. Increase NR_IRQS for one additional slot and increase irq_domain_add_legacy parameter first_irq value to 1, so that linux IRQ #0 is not associated with hardware IRQ #0 in legacy IRQ domains. Introduce macro XTENSA_PIC_LINUX_IRQ for static translation of xtensa PIC hardware IRQ # to linux IRQ #. Use this macro in XTFPGA platform data definitions. This fixes inability to use hardware IRQ #0 in configurations that don't use device tree and allows for non-identity mapping between linux IRQ # and hardware IRQ #. Cc: stable@vger.kernel.org Signed-off-by: Max Filippov arch/xtensa/include/asm/irq.h | 3 ++- arch/xtensa/kernel/irq.c | 5 ----- arch/xtensa/platforms/xtfpga/include/platform/hardware.h | 6 ++++-- arch/xtensa/platforms/xtfpga/setup.c | 10 +++++----- drivers/irqchip/irq-xtensa-mx.c | 2 +- drivers/irqchip/irq-xtensa-pic.c | 2 +- 6 files changed, 13 insertions(+), 15 deletions(-) commit cbf52a3e6a8a92beec6e0c70abf4111cd8f8faf7 Author: Robert Jarzmik Date: Mon Jun 5 13:59:15 2017 +0200 tags: honor COMPILED_SOURCE with apart output directory When the kernel is compiled with an "O=" argument, the object files are not in the source tree, but in the build tree. This patch fixes O= build by looking for object files in the build tree. Fixes: 923e02ecf3f8 ("scripts/tags.sh: Support compiled source") Signed-off-by: Robert Jarzmik Signed-off-by: Masahiro Yamada scripts/tags.sh | 1 + 1 file changed, 1 insertion(+) commit a415c0f10627913793709ddb75add09d2ea334dc Author: NeilBrown Date: Mon Jun 5 16:05:13 2017 +1000 md: initialise ->writes_pending in personality modules. The new per-cpu counter for writes_pending is initialised in md_alloc(), which is not called by dm-raid. So dm-raid fails when md_write_start() is called. Move the initialization to the personality modules that need it. This way it is always initialised when needed, but isn't unnecessarily initialized (requiring memory allocation) when the personality doesn't use writes_pending. Reported-by: Heinz Mauelshagen Fixes: 4ad23a976413 ("MD: use per-cpu counter for writes_pending") Signed-off-by: NeilBrown Signed-off-by: Shaohua Li drivers/md/md.c | 16 ++++++++++++---- drivers/md/md.h | 1 + drivers/md/raid1.c | 2 ++ drivers/md/raid10.c | 3 +++ drivers/md/raid5.c | 3 +++ 5 files changed, 21 insertions(+), 4 deletions(-) commit ba7b2387ad239a519041f2a2d35a1902bdd03dfb Merge: e543c8a 41c2570 Author: Linus Torvalds Date: Mon Jun 5 15:37:03 2017 -0700 Merge branch 'for-4.12-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: "Two cgroup fixes. One to address RCU delay of cpuset removal affecting userland visible behaviors. The other fixes a race condition between controller disable and cgroup removal" * 'for-4.12-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cpuset: consider dying css as offline cgroup: Prevent kill_css() from being called more than once commit e543c8a92fb6eca8dd554561fa55bba5f2a90d09 Merge: 112eb07 f7cf69a Author: Linus Torvalds Date: Mon Jun 5 15:31:14 2017 -0700 Merge branch 'for-4.12-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata Pull libata fixes from Tejun Heo: - Revert of sata_mv devm_ioremap_resource() conversion. It made init fail if there are overlapping resources which led to detection failures on some setups. - A workaround for an Acer laptop which sometimes reports corrupt port map. - Other non-critical fixes. * 'for-4.12-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata: libata: fix error checking in in ata_parse_force_one() Revert "ata: sata_mv: Convert to devm_ioremap_resource()" ata: libahci: properly propagate return value of platform_get_irq() ata: sata_rcar: Handle return value of clk_prepare_enable ahci: Acer SA5-271 SSD Not Detected Fix commit 186f0a0d8e083505bd5cd23baa82b2205224d9ad Author: Rafael J. Wysocki Date: Mon Jun 5 23:33:39 2017 +0200 Revert "ACPICA: Disassembler: Enhance resource descriptor detection" Revert commit da28e1955d7f (ACPICA: Disassembler: Enhance resource descriptor detection) as it is based on an assumption that doesn't hold all the time and causes problems to happen because of that. Reported-by: Linda Knippers Signed-off-by: Rafael J. Wysocki drivers/acpi/acpica/utresrc.c | 9 --------- 1 file changed, 9 deletions(-) commit dc89481bb4c9af0700423e21c8371379d3d943b1 Merge: 1dbf647 dc1cd1d Author: Kalle Valo Date: Mon Jun 5 22:21:25 2017 +0300 Merge tag 'iwlwifi-for-kalle-2017-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes Fixes for 4.12: * Some memory leaks; * IBSS support; * Some bugzilla bugs; * Some runtime PM fixes; * Rate-scaling issues; * Some locking problems; commit 6bf28969f617f0131e94deb5476f4c45f43fd847 Author: Max Filippov Date: Mon Jun 5 11:25:07 2017 -0700 xtensa: reduce double exception literal reservation Double exception vector only needs 20 bytes of space for 5 literals, not 48. Reduce the reservation for double exception vector literals accordingly. This fixes build for configurations with small user exception vector size. Signed-off-by: Max Filippov arch/xtensa/kernel/vmlinux.lds.S | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit dc1cd1d5ac22dbcd158c3de62b76ebb80e55d46b Author: Shahar S Matityahu Date: Thu Apr 6 13:35:38 2017 +0300 iwlwifi: fix host command memory leaks Sending host command with CMD_WANT_SKB flag demands the release of the response buffer with iwl_free_resp function. The patch adds the memory release in all the relevant places Signed-off-by: Shahar S Matityahu Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 15098803d38778070b8edfa5a3d5fc4fef10d0a1 Author: Luca Coelho Date: Tue Apr 25 10:18:10 2017 +0300 iwlwifi: fix min API version for 7265D, 3168, 8000 and 8265 In a previous commit, we removed support for API versions earlier than 22 for these NICs. By mistake, the *_UCODE_API_MIN definitions were set to 17. Fix that. Fixes: 4b87e5af638b ("iwlwifi: remove support for fw older than -17 and -22") Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/iwl-7000.c | 4 ++-- drivers/net/wireless/intel/iwlwifi/iwl-8000.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) commit 40cbeca3c09965f3084d591476559cbb3df150ec Author: Johannes Berg Date: Fri Mar 31 10:47:35 2017 +0200 iwlwifi: mvm: clear new beacon command template struct Clear the struct so that all reserved fields are zero when we send the struct down to the device. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 71793b7d3eb0897ca0dc4a109ede608d3e2c70ed Author: Luca Coelho Date: Thu Mar 30 12:04:47 2017 +0300 iwlwifi: mvm: don't fail when removing a key from an inexisting sta The iwl_mvm_remove_sta_key() function handles removing a key when the sta doesn't exist anymore. Mistakenly, this was changed to return an error while fixing another bug. If the mvm_sta doesn't exist, we continue normally, but just don't try to remove the igtk key. Fixes: cd4d23c1ea9b ("iwlwifi: mvm: Fix removal of IGTK") Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) commit e4c49c4937951de1cdbe35572ade40c948dec1e1 Author: Luca Coelho Date: Fri Mar 24 11:01:45 2017 +0200 iwlwifi: pcie: only use d0i3 in suspend/resume if system_pm is set to d0i3 We only need to handle d0i3 entry and exit during suspend resume if system_pm is set to IWL_PLAT_PM_MODE_D0I3, otherwise d0i3 entry failures will cause suspend to fail. This fixes https://bugzilla.kernel.org/show_bug.cgi?id=194791 Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit addce854f164a68da9cb158e2e7e447705068549 Author: Emmanuel Grumbach Date: Wed Mar 29 10:21:09 2017 +0300 iwlwifi: mvm: fix firmware debug restart recording When we want to stop the recording of the firmware debug and restart it later without reloading the firmware we don't need to resend the configuration that comes with host commands. Sending those commands confused the hardware and led to an NMI 0x66. Change the flow as following: * read the relevant registers (DBGC_IN_SAMPLE, DBGC_OUT_CTRL) * clear those registers * wait for the hardware to complete its write to the buffer * get the data * restore the value of those registers (to restart the recording) For early start (where the configuration is already compiled in the firmware), we don't need to set those registers after the firmware has been loaded, but only when we want to restart the recording without having restarted the firmware. Signed-off-by: Emmanuel Grumbach Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/iwl-prph.h | 1 + drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c | 12 +--------- drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 1 + drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 32 ++++++++++++++++++------- 4 files changed, 27 insertions(+), 19 deletions(-) commit d9954405758a0cbbe258d9b4d4dc12a06fa48a28 Author: Johannes Berg Date: Wed Mar 22 22:00:10 2017 +0100 iwlwifi: tt: move ucode_loaded check under mutex The ucode_loaded check should be under the mutex, since it can otherwise change state after we looked at it and before we got the mutex. Fix that. Fixes: 5c89e7bc557e ("iwlwifi: mvm: add registration to cooling device") Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/mvm/tt.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit ee48b72211f844a58a06819e9ccceee6acf04b2d Author: Liad Kaufman Date: Tue Mar 21 17:13:16 2017 +0200 iwlwifi: mvm: support ibss in dqa mode Allow working IBSS also when working in DQA mode. This is done by setting it to treat the queues the same as a BSS AP treats the queues. Fixes: 7948b87308a4 ("iwlwifi: mvm: enable dynamic queue allocation mode") Signed-off-by: Liad Kaufman Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) commit c72c37b7f392ad7edc10b6092fa48c632ba6f4ed Author: Haim Dreyfuss Date: Thu Mar 16 17:26:03 2017 +0200 iwlwifi: mvm: Fix command queue number on d0i3 flow During d0i3 flow we flush all the queue except from the command queue. Currently, in this flow the command queue is hard coded to 9. In DQA the command queue number has changed from 9 to 0. Fix that. This fixes a problem in runtime PM resume flow. Fixes: 097129c9e625 ("iwlwifi: mvm: move cmd queue to be #0 in dqa mode") Signed-off-by: Haim Dreyfuss Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit ea42d1cbe3f067fb714c3ec3e1792fa273b99561 Author: Gregory Greenman Date: Mon Mar 6 11:15:41 2017 +0200 iwlwifi: mvm: rs: start using LQ command color Up until now, the driver was comparing the rate reported by the FW and the rate of the latest LQ command to avoid processing data belonging to the old LQ command. Recently, FW changed the meaning of the initial rate field in tx response and it holds the actual rate (which is not necessarily the initial rate of LQ's rate table). Use instead LQ cmd color to be able to filter out tx responses/BA notifications which where sent during earlier LQ commands' time frame. This fixes some throughput degradation in noisy environments. Signed-off-by: Gregory Greenman Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/mvm/fw-api-rs.h | 5 +++ drivers/net/wireless/intel/iwlwifi/mvm/fw-api-tx.h | 3 ++ drivers/net/wireless/intel/iwlwifi/mvm/rs.c | 46 ++++++---------------- drivers/net/wireless/intel/iwlwifi/mvm/rs.h | 15 +++++++ drivers/net/wireless/intel/iwlwifi/mvm/sta.h | 2 + drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 12 +++++- 6 files changed, 47 insertions(+), 36 deletions(-) commit 1b4af13ff2cc6897557bb0b8d9e2fad4fa4d67aa Author: David S. Miller Date: Mon Jun 5 11:28:57 2017 -0700 sparc64: Add __multi3 for gcc 7.x and later. Reported-by: Waldemar Brodkorb Signed-off-by: David S. Miller arch/sparc/lib/Makefile | 1 + arch/sparc/lib/multi3.S | 35 +++++++++++++++++++++++++++++++++++ 2 files changed, 36 insertions(+) commit 112eb07287d10bef6ec74e36f1ffd24f19bdd0a0 Merge: 3c2993b 06a4b6d Author: Linus Torvalds Date: Mon Jun 5 11:19:40 2017 -0700 Merge branch 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM fixes from Russell King: "Three fixes this time around: - Two fixes for noMMU, fixing the decompressor header layout, and preventing a build error with some configurations. - Fixing the hyp-stub updates that went in during the merge window for platforms that use MCPM" * 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm: ARM: 8677/1: boot/compressed: fix decompressor header layout for v7-M ARM: 8676/1: NOMMU: provide pgprot_device() macro ARM: 8675/1: MCPM: ensure not to enter __hyp_soft_restart from loopback and cpu_power_down commit 2538b9e2450ae255337c04356e9e0f8cb9ec48d9 Author: Milian Wolff Date: Fri Jun 2 16:37:52 2017 +0200 perf report: Ensure the perf DSO mapping matches what libdw sees In some situations the libdw unwinder stopped working properly. I.e. with libunwind we see: ~~~~~ heaptrack_gui 2228 135073.400112: 641314 cycles: e8ed _dl_fixup (/usr/lib/ld-2.25.so) 15f06 _dl_runtime_resolve_sse_vex (/usr/lib/ld-2.25.so) ed94c KDynamicJobTracker::KDynamicJobTracker (/home/milian/projects/compiled/kf5/lib64/libKF5KIOWidgets.so.5.35.0) 608f3 _GLOBAL__sub_I_kdynamicjobtracker.cpp (/home/milian/projects/compiled/kf5/lib64/libKF5KIOWidgets.so.5.35.0) f199 call_init.part.0 (/usr/lib/ld-2.25.so) f2a5 _dl_init (/usr/lib/ld-2.25.so) db9 _dl_start_user (/usr/lib/ld-2.25.so) ~~~~~ But with libdw and without this patch this sample is not properly unwound: ~~~~~ heaptrack_gui 2228 135073.400112: 641314 cycles: e8ed _dl_fixup (/usr/lib/ld-2.25.so) 15f06 _dl_runtime_resolve_sse_vex (/usr/lib/ld-2.25.so) ed94c KDynamicJobTracker::KDynamicJobTracker (/home/milian/projects/compiled/kf5/lib64/libKF5KIOWidgets.so.5.35.0) ~~~~~ Debug output showed me that libdw found a module for the last frame address, but it thinks it belongs to /usr/lib/ld-2.25.so. This patch double-checks what libdw sees and what perf knows. If the mappings mismatch, we now report the elf known to perf. This fixes the situation above, and the libdw unwinder produces the same stack as libunwind. Signed-off-by: Milian Wolff Cc: Jiri Olsa Cc: Namhyung Kim Link: http://lkml.kernel.org/r/20170602143753.16907-1-milian.wolff@kdab.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/unwind-libdw.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 5ea0416f51cc93436bbe497c62ab49fd9cb245b6 Author: Milian Wolff Date: Thu Jun 1 23:00:21 2017 +0200 perf report: Include partial stacks unwound with libdw So far the whole stack was thrown away when any error occurred before the maximum stack depth was unwound. This is actually a very common scenario though. The stacks that got unwound so far are still interesting. This removes a large chunk of differences when comparing perf script output for libunwind and libdw perf unwinding. E.g. with libunwind: ~~~~~ heaptrack_gui 2228 135073.388524: 479408 cycles: ffffffff811749ed perf_iterate_ctx ([kernel.kallsyms]) ffffffff81181662 perf_event_mmap ([kernel.kallsyms]) ffffffff811cf5ed mmap_region ([kernel.kallsyms]) ffffffff811cfe6b do_mmap ([kernel.kallsyms]) ffffffff811b0dca vm_mmap_pgoff ([kernel.kallsyms]) ffffffff811cdb0c sys_mmap_pgoff ([kernel.kallsyms]) ffffffff81033acb sys_mmap ([kernel.kallsyms]) ffffffff81631d37 entry_SYSCALL_64_fastpath ([kernel.kallsyms]) 192ca mmap64 (/usr/lib/ld-2.25.so) 59a9 _dl_map_object_from_fd (/usr/lib/ld-2.25.so) 83d0 _dl_map_object (/usr/lib/ld-2.25.so) cda1 openaux (/usr/lib/ld-2.25.so) 1834f _dl_catch_error (/usr/lib/ld-2.25.so) cfe2 _dl_map_object_deps (/usr/lib/ld-2.25.so) 3481 dl_main (/usr/lib/ld-2.25.so) 17387 _dl_sysdep_start (/usr/lib/ld-2.25.so) 4d37 _dl_start (/usr/lib/ld-2.25.so) d87 _start (/usr/lib/ld-2.25.so) heaptrack_gui 2228 135073.388677: 611329 cycles: 1a3e0 strcmp (/usr/lib/ld-2.25.so) 82b2 _dl_map_object (/usr/lib/ld-2.25.so) cda1 openaux (/usr/lib/ld-2.25.so) 1834f _dl_catch_error (/usr/lib/ld-2.25.so) cfe2 _dl_map_object_deps (/usr/lib/ld-2.25.so) 3481 dl_main (/usr/lib/ld-2.25.so) 17387 _dl_sysdep_start (/usr/lib/ld-2.25.so) 4d37 _dl_start (/usr/lib/ld-2.25.so) d87 _start (/usr/lib/ld-2.25.so) ~~~~~ With libdw without this patch: ~~~~~ heaptrack_gui 2228 135073.388524: 479408 cycles: ffffffff811749ed perf_iterate_ctx ([kernel.kallsyms]) ffffffff81181662 perf_event_mmap ([kernel.kallsyms]) ffffffff811cf5ed mmap_region ([kernel.kallsyms]) ffffffff811cfe6b do_mmap ([kernel.kallsyms]) ffffffff811b0dca vm_mmap_pgoff ([kernel.kallsyms]) ffffffff811cdb0c sys_mmap_pgoff ([kernel.kallsyms]) ffffffff81033acb sys_mmap ([kernel.kallsyms]) ffffffff81631d37 entry_SYSCALL_64_fastpath ([kernel.kallsyms]) heaptrack_gui 2228 135073.388677: 611329 cycles: ~~~~~ With this patch applied, the libdw unwinder will produce the same output as the libunwind unwinder. Signed-off-by: Milian Wolff Cc: Jiri Olsa Cc: Namhyung Kim Link: http://lkml.kernel.org/r/20170601210021.20046-1-milian.wolff@kdab.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/unwind-libdw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6db47fdec7562b02703e346c10f7f4efdda6af5a Author: Kim Phillips Date: Mon May 29 14:27:54 2017 -0500 perf annotate: Add missing powerpc triplet On an Ubuntu xenial system, 'perf annotate' says to install powerpc objdump on a system that already has binutils-powerpc-linux-gnu installed. Make perf aware of the missing triplet for the powerpc-linux-gnu target. Signed-off-by: Kim Phillips Cc: Alexander Shishkin Cc: He Kuang Cc: Jiri Olsa Cc: Peter Zijlstra Cc: Ravi Bangoria Link: http://lkml.kernel.org/r/20170529142754.7fbfb1152fd8f2663de0ea70@arm.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/arch/common.c | 1 + 1 file changed, 1 insertion(+) commit 598762cf91532e6e86dd21199b5e7f803df73f49 Author: Jiri Olsa Date: Thu Jun 1 22:54:50 2017 +0200 perf test: Disable breakpoint signal tests for powerpc The following tests are failing on powerpc: # perf test break 18: Breakpoint overflow signal handler : FAILED! 19: Breakpoint overflow sampling : FAILED! The powerpc kenel so far does not have support to even create instruction breakpoints using the perf event interface, so those tests fail early in the config phase. I added a '->is_supported()' callback to test struct to be able to disable specific tests. It seems better than putting ifdefs directly to the test array. Signed-off-by: Jiri Olsa Cc: David Ahern Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/20170601205450.GA398@krava Signed-off-by: Arnaldo Carvalho de Melo tools/perf/tests/bp_signal.c | 14 ++++++++++++++ tools/perf/tests/builtin-test.c | 7 +++++++ tools/perf/tests/tests.h | 3 +++ 3 files changed, 24 insertions(+) commit a09935b878dc8efd4b030ed1ffa0553fc9011fb8 Author: Namhyung Kim Date: Wed May 31 21:01:05 2017 +0900 perf symbols: Use correct filename for compressed modules in build-id cache The decompress_kmodule() decompresses kernel modules in order to load symbols from it. In the DSO_BINARY_TYPE__BUILD_ID_CACHE case, it needs the full file path to extract the file extension to determine the decompression method. But overwriting 'name' will fail the decompression since it might point to a non-existing old file. Instead, use dso->long_name for having the correct extension and use the real filename to decompress. In the DSO_BINARY_TYPE__SYSTEM_PATH_KMODULE_COMP case, both names should be the same. This allows resolving symbols in the old modules. Before: $ perf report -i perf.data.old | grep scsi_mod 0.00% cc1 [scsi_mod] [k] 0x0000000000004aa6 0.00% as [scsi_mod] [k] 0x00000000000099e1 0.00% cc1 [scsi_mod] [k] 0x0000000000009830 0.00% cc1 [scsi_mod] [k] 0x0000000000001b8f After: 0.00% cc1 [scsi_mod] [k] scsi_handle_queue_ramp_up 0.00% as [scsi_mod] [k] scsi_sg_alloc 0.00% cc1 [scsi_mod] [k] scsi_setup_cmnd 0.00% cc1 [scsi_mod] [k] scsi_get_command Signed-off-by: Namhyung Kim Acked-by: Jiri Olsa Cc: Andi Kleen Cc: David Ahern Cc: Peter Zijlstra Cc: kernel-team@lge.com Link: http://lkml.kernel.org/r/20170531120105.21731-3-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/symbol-elf.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) commit 6b335e8f545591c07df0f34231bd7ff7506c98c1 Author: Namhyung Kim Date: Wed May 31 21:01:04 2017 +0900 perf symbols: Set module info when build-id event found Like machine__findnew_module_dso(), it should set necessary info for kernel modules to find symbol info from the file. Factor out dso__set_module_info() to do it. This is needed for dso__needs_decompress() to detect such DSOs. Signed-off-by: Namhyung Kim Acked-by: Jiri Olsa Cc: Andi Kleen Cc: David Ahern Cc: Peter Zijlstra Cc: kernel-team@lge.com Link: http://lkml.kernel.org/r/20170531120105.21731-2-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/dso.c | 15 +++++++++++++++ tools/perf/util/dso.h | 3 +++ tools/perf/util/header.c | 2 +- tools/perf/util/machine.c | 11 +---------- 4 files changed, 20 insertions(+), 11 deletions(-) commit 1deec1bd96ccd8beb04d2112a6d12fe20505c3a6 Author: Namhyung Kim Date: Wed May 31 21:01:03 2017 +0900 perf header: Set proper module name when build-id event found When perf processes build-id event, it creates DSOs with the build-id. But it didn't set the module short name (like '[module-name]') so when processing a kernel mmap event of the module, it cannot found the DSO as it only checks the short names. That leads for perf to create a same DSO without the build-id info and it'll lookup the system path even if the DSO is already in the build-id cache. After kernel was updated, perf cannot find the DSO and cannot show symbols in it anymore. You can see this if you have an old data file (w/ old kernel version): $ perf report -i perf.data.old -v |& grep scsi_mod build id event received for /lib/modules/3.19.2-1-ARCH/kernel/drivers/scsi/scsi_mod.ko.gz : cafe1ce6ca13a98a5d9ed3425cde249e57a27fc1 Failed to open /lib/modules/3.19.2-1-ARCH/kernel/drivers/scsi/scsi_mod.ko.gz, continuing without symbols ... The second message didn't show the build-id. With this patch: $ perf report -i perf.data.old -v |& grep scsi_mod build id event received for /lib/modules/3.19.2-1-ARCH/kernel/drivers/scsi/scsi_mod.ko.gz: cafe1ce6ca13a98a5d9ed3425cde249e57a27fc1 /lib/modules/3.19.2-1-ARCH/kernel/drivers/scsi/scsi_mod.ko.gz with build id cafe1ce6ca13a98a5d9ed3425cde249e57a27fc1 not found, continuing without symbols ... Now it shows the build-id but still cannot load the symbol table. This is a different problem which will be fixed in the next patch. Signed-off-by: Namhyung Kim Acked-by: Jiri Olsa Cc: Andi Kleen Cc: David Ahern Cc: Peter Zijlstra Cc: kernel-team@lge.com Link: http://lkml.kernel.org/r/20170531120105.21731-1-namhyung@kernel.org [ Fix the build on older compilers (debian <= 8, fedora <= 21, etc) wrt kmod_path var init ] Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/header.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) commit 501e7a4689378f8b1690089bfdd4f1e12ec22903 Author: Benjamin Coddington Date: Fri Jun 2 11:21:34 2017 -0400 NFSv4.2: Don't send mode again in post-EXCLUSIVE4_1 SETATTR with umask Now that we have umask support, we shouldn't re-send the mode in a SETATTR following an exclusive CREATE, or we risk having the same problem fixed in commit 5334c5bdac92 ("NFS: Send attributes in OPEN request for NFS4_CREATE_EXCLUSIVE4_1"), which is that files with S_ISGID will have that bit stripped away. Signed-off-by: Benjamin Coddington Fixes: dff25ddb4808 ("nfs: add support for the umask attribute") Cc: stable@vger.kernel.org # v4.10+ Signed-off-by: Trond Myklebust fs/nfs/nfs4proc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 3def03441e53e29eed3afd9009974a5a42bf124a Author: Nicolas Iooss Date: Sat May 20 13:27:00 2017 +0200 genksyms: add printf format attribute to error_with_pos() When compiling with -Wsuggest-attribute=format in HOSTCFLAGS, gcc complains that error_with_pos() may be declared with a printf format attribute: scripts/genksyms/genksyms.c:726:3: warning: function might be possible candidate for ‘gnu_printf’ format attribute [-Wsuggest-attribute=format] vfprintf(stderr, fmt, args); ^~~~~~~~ This would allow catching printf-format errors at compile time in callers to error_with_pos(). Add this attribute. Signed-off-by: Nicolas Iooss Signed-off-by: Masahiro Yamada scripts/genksyms/genksyms.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 269f9883fe254d109afdfc657875c456d6fabb08 Author: Ido Shamay Date: Mon Jun 5 10:44:56 2017 +0300 net/mlx4: Check if Granular QoS per VF has been enabled before updating QP qos_vport The Granular QoS per VF feature must be enabled in FW before it can be used. Thus, the driver cannot modify a QP's qos_vport value (via the UPDATE_QP FW command) if the feature has not been enabled -- the FW returns an error if this is attempted. Fixes: 08068cd5683f ("net/mlx4: Added qos_vport QP configuration in VST mode") Signed-off-by: Ido Shamay Signed-off-by: Jack Morgenstein Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx4/qp.c | 6 ++++++ drivers/net/ethernet/mellanox/mlx4/resource_tracker.c | 16 +++++++++++----- 2 files changed, 17 insertions(+), 5 deletions(-) commit 6c6ab3e73b391b38c9749c77775bf21479ed7d60 Author: Randy Dunlap Date: Sun Jun 4 19:46:53 2017 -0700 net: phy: fix kernel-doc warnings Fix kernel-doc warnings (typo) in drivers/net/phy/phy.c: ..//drivers/net/phy/phy.c:259: warning: No description found for parameter 'features' ..//drivers/net/phy/phy.c:259: warning: Excess function parameter 'feature' description in 'phy_lookup_setting' Signed-off-by: Randy Dunlap Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/phy/phy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6044bd4a7d580d4459b992bc6631c817486a1514 Author: Haishuang Yan Date: Mon Jun 5 08:57:21 2017 +0800 devlink: fix potential memort leak We must free allocated skb when genlmsg_put() return fails. Fixes: 1555d204e743 ("devlink: Support for pipeline debug (dpipe)") Signed-off-by: Haishuang Yan Acked-by: Jiri Pirko Signed-off-by: David S. Miller net/core/devlink.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 1e0ce2a1ee0d5fb334e82e80600f1e8e77df525c Author: Anmol Sarma Date: Sat Jun 3 17:40:54 2017 +0530 net: Update TCP congestion control documentation Update tcp.txt to fix mandatory congestion control ops and default CCA selection. Also, fix comment in tcp.h for undo_cwnd. Signed-off-by: Anmol Sarma Signed-off-by: David S. Miller Documentation/networking/tcp.txt | 31 +++++++++++++------------------ include/net/tcp.h | 2 +- 2 files changed, 14 insertions(+), 19 deletions(-) commit 57caf4ec2b8bfbcb4f738ab5a12eedf3a8786045 Author: Rafael J. Wysocki Date: Mon Jun 5 14:51:18 2017 +0200 cpufreq: intel_pstate: Avoid division by 0 in min_perf_pct_min() Commit c5a2ee7dde89 (cpufreq: intel_pstate: Active mode P-state limits rework) incorrectly assumed that pstate.turbo_pstate would always be nonzero for CPU0 in min_perf_pct_min() if cpufreq_register_driver() had succeeded which may not be the case in virtualized environments. If that assumption doesn't hold, it leads to an early crash on boot in intel_pstate_register_driver(), so add a sanity check to min_perf_pct_min() to prevent the crash from happening. Fixes: c5a2ee7dde89 (cpufreq: intel_pstate: Active mode P-state limits rework) Reported-and-tested-by: Jongman Heo Signed-off-by: Rafael J. Wysocki drivers/cpufreq/intel_pstate.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 06a4b6d009a1b74a6ec46c5418b46cc53a79fcb8 Author: Ard Biesheuvel Date: Wed May 24 15:31:57 2017 +0100 ARM: 8677/1: boot/compressed: fix decompressor header layout for v7-M As reported by Patrice, the header layout of the decompressor is incorrect when building for v7-M. In this case, the __nop macro resolves to 'mov r0, r0', which is emitted as a narrow encoding, resulting in the header data fields to end up at lower offsets than required. Given the variety of targets we need to support with the same code, the startup sequence is a bit of a jumble, and uses instructions and macros whose encoding widths cannot be specified (badr), or only exist in a narrow encoding (bx) So force the use of a wide encoding in __nop, and replace the start sequence with a simple jump to the label marking the start of code, preceded by a Thumb2 mode switch if required (using explicit wide encodings where appropriate). The label itself can be moved to the start of code [where it belongs] due to the larger range of branch instructions as compared to adr instructions. Reported-by: Patrice CHOTARD Acked-by: Nicolas Pitre Signed-off-by: Ard Biesheuvel Signed-off-by: Russell King arch/arm/boot/compressed/efi-header.S | 4 +--- arch/arm/boot/compressed/head.S | 17 ++++++++++------- 2 files changed, 11 insertions(+), 10 deletions(-) commit 7ef4783e19a84fe1e8b58f4c27b858dfdcaef207 Author: Vladimir Murzin Date: Wed May 24 10:30:18 2017 +0100 ARM: 8676/1: NOMMU: provide pgprot_device() macro NOMMU build leads to the following error: CC drivers/pci/mmap.o drivers/pci/mmap.c: In function 'pci_mmap_resource_range': drivers/pci/mmap.c:60:3: error: implicit declaration of function 'pgprot_device' [-Werror=implicit-function-declaration] vma->vm_page_prot = pgprot_device(vma->vm_page_prot); ^ cc1: some warnings being treated as errors scripts/Makefile.build:302: recipe for target 'drivers/pci/mmap.o' failed make[2]: *** [drivers/pci/mmap.o] Error 1 scripts/Makefile.build:561: recipe for target 'drivers/pci' failed make[1]: *** [drivers/pci] Error 2 Makefile:1016: recipe for target 'drivers' failed make: *** [drivers] Error 2 Fix it with support of pgprot_device() macro for NOMMU. Fixes: 00d2904ffeac ("ARM/PCI: Use generic pci_mmap_resource_range()") Signed-off-by: Vladimir Murzin Signed-off-by: Russell King arch/arm/include/asm/pgtable-nommu.h | 1 + 1 file changed, 1 insertion(+) commit ae1d557d8f30cb097b4d1f2ab04fa294588ee1cf Author: Christian Sünkenberg Date: Sun Jun 4 19:18:39 2017 +0200 x86/cpu/cyrix: Add alternative Device ID of Geode GX1 SoC A SoC variant of Geode GX1, notably NSC branded SC1100, seems to report an inverted Device ID in its DIR0 configuration register, specifically 0xb instead of the expected 0x4. Catch this presumably quirky version so it's properly recognized as GX1 and has its cache switched to write-back mode, which provides a significant performance boost in most workloads. SC1100's datasheet "Geode™ SC1100 Information Appliance On a Chip", states in section 1.1.7.1 "Device ID" that device identification values are specified in SC1100's device errata. These, however, seem to not have been publicly released. Wading through a number of boot logs and /proc/cpuinfo dumps found on pastebin and blogs, this patch should mostly be relevant for a number of now admittedly aging Soekris NET4801 and PC Engines WRAP devices, the latter being the platform this issue was discovered on. Performance impact was verified using "openssl speed", with write-back caching scaling throughput between -3% and +41%. Signed-off-by: Christian Sünkenberg Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/1496596719.26725.14.camel@student.kit.edu Signed-off-by: Ingo Molnar arch/x86/kernel/cpu/cyrix.c | 1 + 1 file changed, 1 insertion(+) commit 1195892c091a15cc862f4e202482a36adc924e12 Author: Breno Leitao Date: Fri Jun 2 18:43:30 2017 -0300 powerpc/kernel: Fix FP and vector register restoration Currently tsk->thread->load_vec and load_fp are not initialized during task creation, which can lead to garbage values in these variables (non-zero values). These variables will be checked later in restore_math() to validate if the FP and vector registers are being utilized. Since these values might be non-zero, the restore_math() will continue to save the FP and vectors even if they were never utilized by the userspace application. load_fp and load_vec counters will then overflow (they wrap at 255) and the FP and Altivec will be finally disabled, but before that condition is reached (counter overflow) several context switches will have restored FP and vector registers without need, causing a performance degradation. Fixes: 70fe3d980f5f ("powerpc: Restore FPU/VEC/VSX if previously used") Cc: stable@vger.kernel.org # v4.6+ Signed-off-by: Breno Leitao Signed-off-by: Gustavo Romero Acked-by: Anton Blanchard Signed-off-by: Michael Ellerman arch/powerpc/kernel/process.c | 2 ++ 1 file changed, 2 insertions(+) commit 6dc06c08bef1c746ff8da33dab677cfbacdcad32 Author: Talat Batheesh Date: Sun Jun 4 14:30:07 2017 +0300 net/mlx4: Fix the check in attaching steering rules Our previous patch (cited below) introduced a regression for RAW Eth QPs. Fix it by checking if the QP number provided by user-space exists, hence allowing steering rules to be added for valid QPs only. Fixes: 89c557687a32 ("net/mlx4_en: Avoid adding steering rules with invalid ring") Reported-by: Or Gerlitz Signed-off-by: Talat Batheesh Signed-off-by: Tariq Toukan Acked-by: Or Gerlitz Reviewed-by: Leon Romanovsky Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 5 ----- drivers/net/ethernet/mellanox/mlx4/mcg.c | 15 +++++++++++---- drivers/net/ethernet/mellanox/mlx4/qp.c | 13 +++++++++++++ include/linux/mlx4/qp.h | 1 + 4 files changed, 25 insertions(+), 9 deletions(-) commit b699d0035836f6712917a41e7ae58d84359b8ff9 Author: Haishuang Yan Date: Sun Jun 4 14:43:43 2017 +0800 sit: reload iphdr in ipip6_rcv Since iptunnel_pull_header() can call pskb_may_pull(), we must reload any pointer that was related to skb->head. Fixes: a09a4c8dd1ec ("tunnels: Remove encapsulation offloads on decap") Signed-off-by: Haishuang Yan Signed-off-by: David S. Miller net/ipv6/sit.c | 1 + 1 file changed, 1 insertion(+) commit 77d4b1d36926a9b8387c6b53eeba42bcaaffcea3 Author: Eric Dumazet Date: Sat Jun 3 09:29:25 2017 -0700 net: ping: do not abuse udp_poll() Alexander reported various KASAN messages triggered in recent kernels The problem is that ping sockets should not use udp_poll() in the first place, and recent changes in UDP stack finally exposed this old bug. Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind") Fixes: 6d0bfe226116 ("net: ipv6: Add IPv6 support to the ping socket.") Signed-off-by: Eric Dumazet Reported-by: Sasha Levin Cc: Solar Designer Cc: Vasiliy Kulikov Cc: Lorenzo Colitti Acked-By: Lorenzo Colitti Tested-By: Lorenzo Colitti Signed-off-by: David S. Miller include/net/ipv6.h | 1 + net/ipv4/af_inet.c | 2 +- net/ipv6/ping.c | 2 +- net/ipv6/raw.c | 2 +- 4 files changed, 4 insertions(+), 3 deletions(-) commit b07ac9894644202614ca87c69f3f45e424a82fef Author: Florian Fainelli Date: Fri Jun 2 22:05:23 2017 -0700 net: dsa: Fix stale cpu_switch reference after unbind then bind Commit 9520ed8fb841 ("net: dsa: use cpu_switch instead of ds[0]") replaced the use of dst->ds[0] with dst->cpu_switch since that is functionally equivalent, however, we can now run into an use after free scenario after unbinding then rebinding the switch driver. The use after free happens because we do correctly initialize dst->cpu_switch the first time we probe in dsa_cpu_parse(), then we unbind the driver: dsa_dst_unapply() is called, and we rebind again. dst->cpu_switch now points to a freed "ds" structure, and so when we finally dereference it in dsa_cpu_port_ethtool_setup(), we oops. To fix this, simply set dst->cpu_switch to NULL in dsa_dst_unapply() which guarantees that we always correctly re-assign dst->cpu_switch in dsa_cpu_parse(). Fixes: 9520ed8fb841 ("net: dsa: use cpu_switch instead of ds[0]") Signed-off-by: Florian Fainelli Reviewed-by: Vivien Didelot Signed-off-by: David S. Miller net/dsa/dsa2.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit e3e86b5119f81e5e2499bea7ea1ebe8ac6aab789 Author: David S. Miller Date: Sun Jun 4 21:41:10 2017 -0400 ipv6: Fix leak in ipv6_gso_segment(). If ip6_find_1stfragopt() fails and we return an error we have to free up 'segs' because nobody else is going to. Fixes: 2423496af35d ("ipv6: Prevent overrun when parsing v6 header options") Reported-by: Ben Hutchings Signed-off-by: David S. Miller net/ipv6/ip6_offload.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 9a1c44d989bff4c992b8b9a112d9fda275ea5515 Author: Eric Garver Date: Fri Jun 2 14:54:10 2017 -0400 geneve: fix needed_headroom and max_mtu for collect_metadata Since commit 9b4437a5b870 ("geneve: Unify LWT and netdev handling.") when using COLLECT_METADATA geneve devices are created with too small of a needed_headroom and too large of a max_mtu. This is because ip_tunnel_info_af() is not valid with the device level info when using COLLECT_METADATA and we mistakenly fall into the IPv4 case. For COLLECT_METADATA, always use the worst case of ipv6 since both sockets are created. Fixes: 9b4437a5b870 ("geneve: Unify LWT and netdev handling.") Signed-off-by: Eric Garver Acked-by: Pravin B Shelar Signed-off-by: David S. Miller drivers/net/geneve.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 38b257938ac6655d0d6333743303231b9c465ec1 Author: Soheil Hassas Yeganeh Date: Fri Jun 2 12:38:22 2017 -0400 sock: reset sk_err when the error queue is empty Prior to f5f99309fa74 (sock: do not set sk_err in sock_dequeue_err_skb), sk_err was reset to the error of the skb on the head of the error queue. Applications, most notably ping, are relying on this behavior to reset sk_err for ICMP packets. Set sk_err to the ICMP error when there is an ICMP packet at the head of the error queue. Fixes: f5f99309fa74 (sock: do not set sk_err in sock_dequeue_err_skb) Reported-by: Cyril Hrubis Tested-by: Cyril Hrubis Signed-off-by: Soheil Hassas Yeganeh Signed-off-by: Eric Dumazet Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller net/core/skbuff.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit a7c0b8bee212e22725196fda8389bff9ade3ac68 Author: Michal Hocko Date: Fri Jun 2 17:54:08 2017 +0200 amd-xgbe: use PAGE_ALLOC_COSTLY_ORDER in xgbe_map_rx_buffer xgbe_map_rx_buffer is rather confused about what PAGE_ALLOC_COSTLY_ORDER means. It uses PAGE_ALLOC_COSTLY_ORDER-1 assuming that PAGE_ALLOC_COSTLY_ORDER is the first costly order which is not the case actually because orders larger than that are costly. And even that applies only to sleeping allocations which is not the case here. We simply do not perform any costly operations like reclaim or compaction for those. Simplify the code by dropping the order calculation and use PAGE_ALLOC_COSTLY_ORDER directly. Signed-off-by: Michal Hocko Acked-by: Tom Lendacky Signed-off-by: David S. Miller drivers/net/ethernet/amd/xgbe/xgbe-desc.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 5f733ee68f9a4df94775299ac6a7ab260704f6ed Author: Liam McBirnie Date: Thu Jun 1 15:36:01 2017 +1000 ip6_tunnel: fix traffic class routing for tunnels ip6_route_output() requires that the flowlabel contains the traffic class for policy routing. Commit 0e9a709560db ("ip6_tunnel, ip6_gre: fix setting of DSCP on encapsulated packets") removed the code which previously added the traffic class to the flowlabel. The traffic class is added here because only route lookup needs the flowlabel to contain the traffic class. Fixes: 0e9a709560db ("ip6_tunnel, ip6_gre: fix setting of DSCP on encapsulated packets") Signed-off-by: Liam McBirnie Acked-by: Peter Dawson Signed-off-by: David S. Miller net/ipv6/ip6_tunnel.c | 3 +++ 1 file changed, 3 insertions(+) commit 3c2993b8c6143d8a5793746a54eba8f86f95240f Author: Linus Torvalds Date: Sun Jun 4 16:47:43 2017 -0700 Linux 4.12-rc4 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 239e250e4acbc0104d514307029c0839e834a51a Author: Richard Narron Date: Sun Jun 4 16:23:18 2017 -0700 fs/ufs: Set UFS default maximum bytes per file This fixes a problem with reading files larger than 2GB from a UFS-2 file system: https://bugzilla.kernel.org/show_bug.cgi?id=195721 The incorrect UFS s_maxsize limit became a problem as of commit c2a9737f45e2 ("vfs,mm: fix a dead loop in truncate_inode_pages_range()") which started using s_maxbytes to avoid a page index overflow in do_generic_file_read(). That caused files to be truncated on UFS-2 file systems because the default maximum file size is 2GB (MAX_NON_LFS) and UFS didn't update it. Here I simply increase the default to a common value used by other file systems. Signed-off-by: Richard Narron Cc: Al Viro Cc: Will B Cc: Theodore Ts'o Cc: # v4.9 and backports of c2a9737f45e2 Signed-off-by: Linus Torvalds fs/ufs/super.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 246096690be0742d9bb5f3456d2cb95b68f7b46d Author: Timur Tabi Date: Thu Jun 1 16:08:13 2017 -0500 net: qcom/emac: do not use hardware mdio automatic polling Use software polling (PHY_POLL) to check for link state changes instead of relying on the EMAC's hardware polling feature. Some PHY drivers are unable to get a functioning link because the HW polling is not robust enough. The EMAC is able to poll the PHY on the MDIO bus looking for link state changes (via the Link Status bit in the Status Register at address 0x1). When the link state changes, the EMAC triggers an interrupt and tells the driver what the new state is. The feature eliminates the need for software to poll the MDIO bus. Unfortunately, this feature is incompatible with phylib, because it ignores everything that the PHY core and PHY drivers are trying to do. In particular: 1. It assumes a compatible register set, so PHYs with different registers may not work. 2. It doesn't allow for hardware errata that have work-arounds implemented in the PHY driver. 3. It doesn't support multiple register pages. If the PHY core switches the register set to another page, the EMAC won't know the page has changed and will still attempt to read the same PHY register. 4. It only checks the copper side of the link, not the SGMII side. Some PHY drivers (e.g. at803x) may also check the SGMII side, and report the link as not ready during autonegotiation if the SGMII link is still down. Phylib then waits for another interrupt to query the PHY again, but the EMAC won't send another interrupt because it thinks the link is up. Cc: stable@vger.kernel.org # 4.11.x Tested-by: Manoj Iyer Signed-off-by: Timur Tabi Signed-off-by: David S. Miller drivers/net/ethernet/qualcomm/emac/emac-mac.c | 2 +- drivers/net/ethernet/qualcomm/emac/emac-phy.c | 75 ++------------------------- drivers/net/ethernet/qualcomm/emac/emac.c | 22 +------- 3 files changed, 6 insertions(+), 93 deletions(-) commit 125f42b0e226d201a2118b79a6c7f1ddb9aabe1d Merge: 3c06e6c 4f253e1 Author: Linus Torvalds Date: Sun Jun 4 11:56:53 2017 -0700 Merge tag 'nfs-for-4.12-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs Pull NFS client bugfixes from Trond Myklebust: "Bugfixes include: - Fix a typo in commit e092693443b ("NFS append COMMIT after synchronous COPY") that breaks copy offload - Fix the connect error propagation in xs_tcp_setup_socket() - Fix a lock leak in nfs40_walk_client_list - Verify that pNFS requests lie within the offset range of the layout segment" * tag 'nfs-for-4.12-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: nfs: Mark unnecessarily extern functions as static SUNRPC: ensure correct error is reported by xs_tcp_setup_socket() NFSv4.0: Fix a lock leak in nfs40_walk_client_list pnfs: Fix the check for requests in range of layout segment xprtrdma: Delete an error message for a failed memory allocation in xprt_rdma_bc_setup() pNFS/flexfiles: missing error code in ff_layout_alloc_lseg() NFS fix COMMIT after COPY commit 3c06e6cbdb6a3faa73fbdfd9022e23f82d24c372 Merge: e00811b fc098af Author: Linus Torvalds Date: Sun Jun 4 11:41:41 2017 -0700 Merge tag 'tty-4.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty fix from Greg KH: "Here is a single tty core fix for 4.12-rc4. It reverts a patch that a lot of people reported as causing lockdep and other warnings. Right after I reverted this in my tree, it seems like another "correct" fix might have shown up, but it's too late in the release cycle to be messing with tty core locking, so let's just revert this for now to go back how things always have been and try it again for 4.13. This has not been in linux-next as I only reverted it a few hours ago" * tag 'tty-4.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: Revert "tty: fix port buffer locking" commit e00811b4ca520e5a876baf41c6831de4bc276d3e Merge: 9f03b2c 0fd5f22 Author: Linus Torvalds Date: Sun Jun 4 11:37:42 2017 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input subsystem fixes from Dmitry Torokhov: - a couple of regression fixes in synaptics and axp20x-pek drivers - try to ease transition from PS/2 to RMI for Synaptics touchpad users by ensuring we do not try to activate RMI mode when RMI SMBus support is not enabled, and nag users a bit to enable it - plus a couple of other changes that seemed worthwhile for this release * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: axp20x-pek - switch to acpi_dev_present and check for ACPI0011 too Input: axp20x-pek - only check for "INTCFD9" ACPI device on Cherry Trail Input: tm2-touchkey - use LEN_ON as boolean value instead of LED_FULL Input: synaptics - tell users to report when they should be using rmi-smbus Input: synaptics - warn the users when there is a better mode Input: synaptics - keep PS/2 around when RMI4_SMB is not enabled Input: synaptics - clear device info before filling in Input: silead - disable interrupt during suspend commit 9f03b2c7c576bbc427b4c214b2c548f3539b17a2 Merge: 1f915b7 6ceec69 Author: Linus Torvalds Date: Sun Jun 4 11:29:32 2017 -0700 Merge tag 'rtc-4.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC fixlet from Alexandre Belloni: "A single patch, not really a fix but I don't think there is any reason to delay it. Change the mailing list address" * tag 'rtc-4.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: MAINTAINERS: update RTC mailing list commit 963761a0b2e85663ee4a5630f72930885a06598a Author: Sean Young Date: Wed May 24 06:24:51 2017 -0300 [media] rc-core: race condition during ir_raw_event_register() A rc device can call ir_raw_event_handle() after rc_allocate_device(), but before rc_register_device() has completed. This is racey because rcdev->raw is set before rcdev->raw->thread has a valid value. Cc: stable@kernel.org Reported-by: kbuild test robot Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab drivers/media/rc/rc-ir-raw.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) commit 20249f84238e006ef7b726d3211a70de7454d045 Author: Hans Verkuil Date: Sun May 28 05:52:16 2017 -0300 [media] cec: drop MEDIA_CEC_DEBUG Just depend on DEBUG_FS, no need to invent a new kernel config. Especially since CEC can be enabled by drm without enabling MEDIA_SUPPORT. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab drivers/media/cec/Kconfig | 6 ------ drivers/media/cec/cec-adap.c | 2 +- drivers/media/cec/cec-core.c | 4 ++-- 3 files changed, 3 insertions(+), 9 deletions(-) commit e94c32818d865b620c9bbd2656ab3199259ef9ec Author: Hans Verkuil Date: Sun May 28 05:58:04 2017 -0300 [media] cec: rename MEDIA_CEC_NOTIFIER to CEC_NOTIFIER This config option is strictly speaking independent of the media subsystem since it can be used by drm as well. Besides, it looks odd when drivers select CEC_CORE and MEDIA_CEC_NOTIFIER, that's inconsistent naming. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab drivers/media/Kconfig | 2 +- drivers/media/cec/Makefile | 2 +- drivers/media/cec/cec-core.c | 4 ++-- drivers/media/platform/Kconfig | 4 ++-- include/media/cec-notifier.h | 2 +- include/media/cec.h | 4 ++-- 6 files changed, 9 insertions(+), 9 deletions(-) commit 9177e51d1434076a91f9bfb693deae8b955d6d57 Author: Hans Verkuil Date: Sun May 28 05:48:37 2017 -0300 [media] cec: select CEC_CORE instead of depend on it The CEC framework is used by both drm and media. That makes it tricky to get the dependencies right. This patch moves the CEC_CORE and MEDIA_CEC_NOTIFIER config options out of the media menu and instead drivers that want to use CEC should select CEC_CORE and MEDIA_CEC_NOTIFIER (if needed). Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab drivers/media/Kconfig | 6 ++++++ drivers/media/Makefile | 4 ++-- drivers/media/cec/Kconfig | 8 -------- drivers/media/i2c/Kconfig | 9 ++++++--- drivers/media/platform/Kconfig | 6 ++++-- drivers/media/platform/vivid/Kconfig | 3 ++- drivers/media/usb/pulse8-cec/Kconfig | 3 ++- drivers/media/usb/rainshadow-cec/Kconfig | 3 ++- 8 files changed, 24 insertions(+), 18 deletions(-) commit ca33784ba4949856a94a545c91429aae5c8b658d Author: Colin Ian King Date: Fri May 19 14:45:15 2017 -0300 [media] rainshadow-cec: ensure exit_loop is intialized exit_loop is not being initialized, so it contains garbage. Ensure it is initialized to false. Detected by CoverityScan, CID#1436409 ("Uninitialized scalar variable") Fixes: ea6a69defd3311 ("[media] rainshadow-cec: avoid -Wmaybe-uninitialized warning") Signed-off-by: Colin Ian King Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab drivers/media/usb/rainshadow-cec/rainshadow-cec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f224c5768c78cb42f582636c4720a4d81d452778 Author: Mauro Carvalho Chehab Date: Thu May 18 05:40:18 2017 -0300 [media] atomisp: don't treat warnings as errors Several atomisp files use: ccflags-y += -Werror As, on media, our usual procedure is to use W=1, and atomisp has *a lot* of warnings with such flag enabled,like: ./drivers/staging/media/atomisp/pci/atomisp2/css2400/hive_isp_css_common/host/system_local.h:62:26: warning: 'DDR_BASE' defined but not used [-Wunused-const-variable=] At the end, it causes our build to fail, impacting our workflow. So, remove this crap. If one wants to force -Werror, he can still build with it enabled by passing a parameter to make. Signed-off-by: Mauro Carvalho Chehab drivers/staging/media/atomisp/i2c/Makefile | 2 -- drivers/staging/media/atomisp/i2c/imx/Makefile | 2 -- drivers/staging/media/atomisp/i2c/ov5693/Makefile | 2 -- drivers/staging/media/atomisp/pci/atomisp2/Makefile | 2 +- 4 files changed, 1 insertion(+), 7 deletions(-) commit 1f915b7fedd605d69baa581130abc5a38334eaa5 Merge: 55cbdaf 75b6125 Author: Linus Torvalds Date: Sun Jun 4 11:15:43 2017 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "This is nine fixes, seven of which are for the qedi driver (new as of 4.10) the other two are a use after free in the cxgbi drivers and a potential NULL dereference in the rdac device handler" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: libcxgbi: fix skb use after free scsi: qedi: Fix endpoint NULL panic during recovery. scsi: qedi: set max_fin_rt default value scsi: qedi: Set firmware tcp msl timer value. scsi: qedi: Fix endpoint NULL panic in qedi_set_path. scsi: qedi: Set dma_boundary to 0xfff. scsi: qedi: Correctly set firmware max supported BDs. scsi: qedi: Fix bad pte call trace when iscsiuio is stopped. scsi: scsi_dh_rdac: Use ctlr directly in rdac_failover_get() commit 55cbdaf6399de16b61d40d49b6c8bb739a877dea Merge: ea094f3 d3957b86 Author: Linus Torvalds Date: Sun Jun 4 10:41:32 2017 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma Pull rdma fixes from Doug Ledford: "For the most part this is just a minor -rc cycle for the rdma subsystem. Even given that this is all of the -rc patches since the merge window closed, it's still only about 25 patches: - Multiple i40iw, nes, iw_cxgb4, hfi1, qib, mlx4, mlx5 fixes - A few upper layer protocol fixes (IPoIB, iSER, SRP) - A modest number of core fixes" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma: (26 commits) RDMA/SA: Fix kernel panic in CMA request handler flow RDMA/umem: Fix missing mmap_sem in get umem ODP call RDMA/core: not to set page dirty bit if it's already set. RDMA/uverbs: Declare local function static and add brackets to sizeof RDMA/netlink: Reduce exposure of RDMA netlink functions RDMA/srp: Fix NULL deref at srp_destroy_qp() RDMA/IPoIB: Limit the ipoib_dev_uninit_default scope RDMA/IPoIB: Replace netdev_priv with ipoib_priv for ipoib_get_link_ksettings RDMA/qedr: add null check before pointer dereference RDMA/mlx5: set UMR wqe fence according to HCA cap net/mlx5: Define interface bits for fencing UMR wqe RDMA/mlx4: Fix MAD tunneling when SRIOV is enabled RDMA/qib,hfi1: Fix MR reference count leak on write with immediate RDMA/hfi1: Defer setting VL15 credits to link-up interrupt RDMA/hfi1: change PCI bar addr assignments to Linux API functions RDMA/hfi1: fix array termination by appending NULL to attr array RDMA/iw_cxgb4: fix the calculation of ipv6 header size RDMA/iw_cxgb4: calculate t4_eq_status_entries properly RDMA/iw_cxgb4: Avoid touch after free error in ARP failure handlers RDMA/nes: ACK MPA Reply frame ... commit ff86bf0c65f14346bf2440534f9ba5ac232c39a0 Author: Thomas Gleixner Date: Tue May 30 23:15:35 2017 +0200 alarmtimer: Rate limit periodic intervals The alarmtimer code has another source of potentially rearming itself too fast. Interval timers with a very samll interval have a similar CPU hog effect as the previously fixed overflow issue. The reason is that alarmtimers do not implement the normal protection against this kind of problem which the other posix timer use: timer expires -> queue signal -> deliver signal -> rearm timer This scheme brings the rearming under scheduler control and prevents permanently firing timers which hog the CPU. Bringing this scheme to the alarm timer code is a major overhaul because it lacks all the necessary mechanisms completely. So for a quick fix limit the interval to one jiffie. This is not problematic in practice as alarmtimers are usually backed by an RTC for suspend which have 1 second resolution. It could be therefor argued that the resolution of this clock should be set to 1 second in general, but that's outside the scope of this fix. Signed-off-by: Thomas Gleixner Cc: Peter Zijlstra Cc: Kostya Serebryany Cc: syzkaller Cc: John Stultz Cc: Dmitry Vyukov Cc: stable@vger.kernel.org Link: http://lkml.kernel.org/r/20170530211655.896767100@linutronix.de kernel/time/alarmtimer.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit f4781e76f90df7aec400635d73ea4c35ee1d4765 Author: Thomas Gleixner Date: Tue May 30 23:15:34 2017 +0200 alarmtimer: Prevent overflow of relative timers Andrey reported a alartimer related RCU stall while fuzzing the kernel with syzkaller. The reason for this is an overflow in ktime_add() which brings the resulting time into negative space and causes immediate expiry of the timer. The following rearm with a small interval does not bring the timer back into positive space due to the same issue. This results in a permanent firing alarmtimer which hogs the CPU. Use ktime_add_safe() instead which detects the overflow and clamps the result to KTIME_SEC_MAX. Reported-by: Andrey Konovalov Signed-off-by: Thomas Gleixner Cc: Peter Zijlstra Cc: Kostya Serebryany Cc: syzkaller Cc: John Stultz Cc: Dmitry Vyukov Cc: stable@vger.kernel.org Link: http://lkml.kernel.org/r/20170530211655.802921648@linutronix.de kernel/time/alarmtimer.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit fc098af16b9ff6d470d779d8ddcfb2d91869045a Author: Greg Kroah-Hartman Date: Sun Jun 4 10:23:25 2017 +0200 Revert "tty: fix port buffer locking" This reverts commit 925bb1ce47f429f69aad35876df7ecd8c53deb7e. It causes lots of warnings and problems so for now, let's just revert it. Reported-by: Reported-by: Russell King Reported-by: Sergey Senozhatsky Reported-by: Geert Uytterhoeven Reported-by: Jiri Slaby Reported-by: Andrey Konovalov Acked-by: Vegard Nossum Signed-off-by: Greg Kroah-Hartman drivers/tty/tty_port.c | 2 -- 1 file changed, 2 deletions(-) commit 4f253e1eb628f5adf7ca4f43aab4bbb1bfffa081 Author: Jan Kara Date: Tue May 16 12:18:11 2017 +0200 nfs: Mark unnecessarily extern functions as static nfs_initialise_sb() and nfs_clone_super() are declared as extern even though they are used only in fs/nfs/super.c. Mark them as static. Also remove explicit 'inline' directive from nfs_initialise_sb() and leave it upto compiler to decide whether inlining is worth it. Signed-off-by: Jan Kara Signed-off-by: Trond Myklebust fs/nfs/internal.h | 2 -- fs/nfs/super.c | 5 +++-- 2 files changed, 3 insertions(+), 4 deletions(-) commit ea094f3c830a67f252677aacba5d04ebcf55c4d9 Merge: cc54874 5f348fa Author: Linus Torvalds Date: Sat Jun 3 08:45:03 2017 -0700 Merge tag 'hwmon-for-linus-v4.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: "A couple of patches for the aspeed pwm fan driver" * tag 'hwmon-for-linus-v4.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (aspeed-pwm-tacho) make fan/pwm names start with index 1 hwmon: (aspeed-pwm-tacho) Call of_node_put() on a node not claimed hwmon: (aspeed-pwm-tacho) On read failure return -ETIMEDOUT hwmon: (aspeed-pwm-tacho) Select REGMAP commit cc54874055c007cd599138a394d1f039e4e0764b Merge: 104c08b 05e97a9 Author: Linus Torvalds Date: Sat Jun 3 08:42:30 2017 -0700 Merge tag 'for-linus-20170602' of git://git.infradead.org/linux-mtd Pull MTD fixes from Brian Norris: "NAND updates from Boris: tango fixes: - Add missing MODULE_DEVICE_TABLE() in tango_nand.c - Update the number of corrected bitflips core fixes: - Fix a long standing memory leak in nand_scan_tail() - Fix several bugs introduced by the per-vendor init/detection infrastructure (introduced in 4.12) - Add a static specifier to nand_ooblayout_lp_hamming_ops definition" * tag 'for-linus-20170602' of git://git.infradead.org/linux-mtd: mtd: nand: make nand_ooblayout_lp_hamming_ops static mtd: nand: tango: Update ecc_stats.corrected mtd: nand: tango: Export OF device ID table as module aliases mtd: nand: samsung: warn about un-parseable ECC info mtd: nand: free vendor-specific resources in init failure paths mtd: nand: drop unneeded module.h include mtd: nand: don't leak buffers when ->scan_bbt() fails commit 3116a23bb30272d74ea81baf5d0ee23f602dd15b Author: Dmitry Monakhov Date: Wed May 10 19:20:44 2017 +0400 bio-integrity: Do not allocate integrity context for bio w/o data If bio has no data, such as ones from blkdev_issue_flush(), then we have nothing to protect. This patch prevent bugon like follows: kfree_debugcheck: out of range ptr ac1fa1d106742a5ah kernel BUG at mm/slab.c:2773! invalid opcode: 0000 [#1] SMP Modules linked in: bcache CPU: 0 PID: 4428 Comm: xfs_io Tainted: G W 4.11.0-rc4-ext4-00041-g2ef0043-dirty #43 Hardware name: Virtuozzo KVM, BIOS seabios-1.7.5-11.vz7.4 04/01/2014 task: ffff880137786440 task.stack: ffffc90000ba8000 RIP: 0010:kfree_debugcheck+0x25/0x2a RSP: 0018:ffffc90000babde0 EFLAGS: 00010082 RAX: 0000000000000034 RBX: ac1fa1d106742a5a RCX: 0000000000000007 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88013f3ccb40 RBP: ffffc90000babde8 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000fcb76420 R11: 00000000725172ed R12: 0000000000000282 R13: ffffffff8150e766 R14: ffff88013a145e00 R15: 0000000000000001 FS: 00007fb09384bf40(0000) GS:ffff88013f200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fd0172f9e40 CR3: 0000000137fa9000 CR4: 00000000000006f0 Call Trace: kfree+0xc8/0x1b3 bio_integrity_free+0xc3/0x16b bio_free+0x25/0x66 bio_put+0x14/0x26 blkdev_issue_flush+0x7a/0x85 blkdev_fsync+0x35/0x42 vfs_fsync_range+0x8e/0x9f vfs_fsync+0x1c/0x1e do_fsync+0x31/0x4a SyS_fsync+0x10/0x14 entry_SYSCALL_64_fastpath+0x1f/0xc2 Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Reviewed-by: Martin K. Petersen Signed-off-by: Dmitry Monakhov Signed-off-by: Jens Axboe block/bio-integrity.c | 3 +++ 1 file changed, 3 insertions(+) commit 5f348fa35a28b19cf7ee1eaa420757341a724c86 Author: Stefan Schaeckeler Date: Fri Jun 2 12:43:28 2017 -0700 hwmon: (aspeed-pwm-tacho) make fan/pwm names start with index 1 Make fan and pwm names in sysfs start with index 1 in accordance to Documentation/hwmon/sysfs-interface conventions. Current implementation starts with index 0, making tools such as sensors(1) skip the first fan. Signed-off-by: Stefan Schaeckeler Fixes: 2d7a548a3eff ("drivers: hwmon: Support for ASPEED PWM/Fan tach") Signed-off-by: Guenter Roeck drivers/hwmon/aspeed-pwm-tacho.c | 52 ++++++++++++++++++++-------------------- 1 file changed, 26 insertions(+), 26 deletions(-) commit 4d58e7329fdd87d37f04b319d6a5165aaff5d75c Author: Stefan Schaeckeler Date: Fri Jun 2 12:42:08 2017 -0700 hwmon: (aspeed-pwm-tacho) Call of_node_put() on a node not claimed Call of_node_put() on a node claimed with of_node_get() or by any other means such as for_each_child_of_node(). Signed-off-by: Stefan Schaeckeler Fixes: 2d7a548a3eff ("drivers: hwmon: Support for ASPEED PWM/Fan tach") Signed-off-by: Guenter Roeck drivers/hwmon/aspeed-pwm-tacho.c | 1 - 1 file changed, 1 deletion(-) commit 6f9193ec044a8f72d8b6ae94a5c4ab6e8b0f00ca Author: Pratyush Anand Date: Mon May 29 22:08:24 2017 +0300 mei: make sysfs modalias format similar as uevent modalias modprobe is not able to resolve sysfs modalias for mei devices. # cat /sys/class/watchdog/watchdog0/device/watchdog/watchdog0/device/modalias mei::05b79a6f-4628-4d7f-899d-a91514cb32ab: # modprobe --set-version 4.9.6-200.fc25.x86_64 -R mei::05b79a6f-4628-4d7f-899d-a91514cb32ab: modprobe: FATAL: Module mei::05b79a6f-4628-4d7f-899d-a91514cb32ab: not found in directory /lib/modules/4.9.6-200.fc25.x86_64 # cat /lib/modules/4.9.6-200.fc25.x86_64/modules.alias | grep 05b79a6f-4628-4d7f-899d-a91514cb32ab alias mei:*:05b79a6f-4628-4d7f-899d-a91514cb32ab:*:* mei_wdt commit b26864cad1c9 ("mei: bus: add client protocol version to the device alias"), however sysfs modalias is still in formmat mei:S:uuid:*. This patch equates format of uevent and sysfs modalias so that modprobe is able to resolve the aliases. Cc: 4.7+ Fixes: commit b26864cad1c9 ("mei: bus: add client protocol version to the device alias") Signed-off-by: Pratyush Anand Signed-off-by: Tomas Winkler Signed-off-by: Greg Kroah-Hartman drivers/misc/mei/bus.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 32829da54d9368103a2f03269a5120aa9ee4d5da Author: Julius Werner Date: Fri Jun 2 15:36:39 2017 -0700 drivers: char: mem: Fix wraparound check to allow mappings up to the end A recent fix to /dev/mem prevents mappings from wrapping around the end of physical address space. However, the check was written in a way that also prevents a mapping reaching just up to the end of physical address space, which may be a valid use case (especially on 32-bit systems). This patch fixes it by checking the last mapped address (instead of the first address behind that) for overflow. Fixes: b299cde245 ("drivers: char: mem: Check for address space wraparound with mmap()") Cc: Reported-by: Nico Huber Signed-off-by: Julius Werner Signed-off-by: Greg Kroah-Hartman drivers/char/mem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1454e15bc28ba94aa5d6b31a83a42d5c03af2a6d Author: Wei Yongjun Date: Tue May 16 15:26:12 2017 +0000 iio: adc: mxs-lradc: Fix return value check in mxs_lradc_adc_probe() In case of error, the function devm_ioremap() returns NULL pointer not ERR_PTR(). The IS_ERR() test in the return value check should be replaced with NULL test. Also add NULL test for iores. Signed-off-by: Wei Yongjun Signed-off-by: Jonathan Cameron drivers/iio/adc/mxs-lradc-adc.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 948588e25b8af5e66962ed3f53e1cae1656fa5af Author: Jean-Baptiste Maneyrol Date: Mon May 29 09:59:40 2017 +0000 iio: imu: inv_mpu6050: add accel lpf setting for chip >= MPU6500 Starting from MPU6500, accelerometer dlpf is set in a separate register named ACCEL_CONFIG_2. Add this new register in the map and set it for the corresponding chips. Signed-off-by: Jean-Baptiste Maneyrol Cc: stable@vger.kernel.org Signed-off-by: Jonathan Cameron drivers/iio/imu/inv_mpu6050/inv_mpu_core.c | 39 +++++++++++++++++++++++++++--- drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h | 3 +++ 2 files changed, 39 insertions(+), 3 deletions(-) commit 0a33252e060e97ed3fbdcec9517672f1e91aaef3 Author: Oleg Drokin Date: Fri May 26 23:40:33 2017 -0400 staging/lustre/lov: remove set_fs() call from lov_getstripe() lov_getstripe() calls set_fs(KERNEL_DS) so that it can handle a struct lov_user_md pointer from user- or kernel-space. This changes the behavior of copy_from_user() on SPARC and may result in a misaligned access exception which in turn oopses the kernel. In fact the relevant argument to lov_getstripe() is never called with a kernel-space pointer and so changing the address limits is unnecessary and so we remove the calls to save, set, and restore the address limits. Signed-off-by: John L. Hammond Reviewed-on: http://review.whamcloud.com/6150 Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-3221 Reviewed-by: Andreas Dilger Reviewed-by: Li Wei Signed-off-by: Oleg Drokin Cc: stable Signed-off-by: Greg Kroah-Hartman drivers/staging/lustre/lustre/lov/lov_pack.c | 9 --------- 1 file changed, 9 deletions(-) commit 40da1b11f01e43aad1aa6cea64681b6125e8a2a7 Author: Sebastian Andrzej Siewior Date: Fri Jun 2 16:27:14 2017 +0200 cpu/hotplug: Drop the device lock on error If a custom CPU target is specified and that one is not available _or_ can't be interrupted then the code returns to userland without dropping a lock as notices by lockdep: |echo 133 > /sys/devices/system/cpu/cpu7/hotplug/target | ================================================ | [ BUG: lock held when returning to user space! ] | ------------------------------------------------ | bash/503 is leaving the kernel with locks still held! | 1 lock held by bash/503: | #0: (device_hotplug_lock){+.+...}, at: [] lock_device_hotplug_sysfs+0x10/0x40 So release the lock then. Fixes: 757c989b9994 ("cpu/hotplug: Make target state writeable") Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: http://lkml.kernel.org/r/20170602142714.3ogo25f2wbq6fjpj@linutronix.de kernel/cpu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit f74994a94063bc85ac1d6ad677ed06b5279c101f Author: Chen-Yu Tsai Date: Wed May 31 15:58:24 2017 +0800 arm64: allwinner: a64: Add PLL_PERIPH0 clock to the R_CCU The AR100 clock within the R_CCU (PRCM) has the PLL_PERIPH0 as one of its parents. This adds the reference in the device tree describing this relationship. This patch uses a raw number for the clock index to ease merging by avoiding cross tree dependencies. Signed-off-by: Chen-Yu Tsai Signed-off-by: Maxime Ripard arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 77125a701adb21bfc03a2af211f472f8b490a084 Author: Chen-Yu Tsai Date: Wed May 31 15:58:22 2017 +0800 ARM: sunxi: h3-h5: Add PLL_PERIPH0 clock to the R_CCU The AR100 clock within the R_CCU (PRCM) has the PLL_PERIPH0 as one of its parents. This adds the reference in the device tree describing this relationship. This patch uses a raw number for the clock index to ease merging by avoiding cross tree dependencies. Signed-off-by: Chen-Yu Tsai Signed-off-by: Maxime Ripard arch/arm/boot/dts/sunxi-h3-h5.dtsi | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 29532e7b67f0ce0576e56f8ab0eeda311cde3b4b Merge: b132e4a2 9605bc4 Author: Greg Kroah-Hartman Date: Sat Jun 3 09:55:59 2017 +0900 Merge tag 'phy-for-4.12-rc-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/kishon/linux-phy into usb-linus Kishon writes: phy: for 4.12-rc *) Fix return value check in phy-qcom-qmp driver *) Fix memory allocation bug in phy-qcom-qmp driver Signed-off-by: Kishon Vijay Abraham I commit 0fd5f221093870d93edb696f6903b058c4d75411 Author: Hans de Goede Date: Fri Jun 2 17:50:22 2017 -0700 Input: axp20x-pek - switch to acpi_dev_present and check for ACPI0011 too acpi_dev_found checks that there is a matching ACPI node, but it may be disabled (_STA method returns 0) in which case the soc_button_array driver will not bind to it and axp20x-pek should handle the power-button. This commit switches from acpi_dev_found to acpi_dev_present to avoid not registering an input-dev for the powerbutton when there is a disabled PNP0C40 device. The ACPI-6.0 standard defines a standard gpio button device using the ACPI0011 HID replacing the custom PNP0C40 gpio device, many newer devices define both PNP0C40 and ACPI0011 devices enabling one or the other depending on whether the BIOS thinks it is going to boot Android or Windows. This commit adds a check for the ACPI0011 device, so that if either device is present *and* enabled we don't register an input-dev for the powerbutton. Signed-off-by: Hans de Goede Signed-off-by: Dmitry Torokhov drivers/input/misc/axp20x-pek.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 8d4b31376974855cd4fb176e5d63ba8e0407928e Author: Hans de Goede Date: Fri Jun 2 17:18:47 2017 -0700 Input: axp20x-pek - only check for "INTCFD9" ACPI device on Cherry Trail Commit 9b13a4ca8d2c ("Input: axp20x-pek - do not register input device on some systems") added a check for the INTCFD9 ACPI device which also handles the powerbutton as on some systems the powerbutton is connected to both the PMIC, handled by axp20x-pek, and to a gpio on the SoC, handled by soc_button_array which attaches itself to the INTCFD9 ACPI device. Testing + comparing DSDTs has shown that this only happens on Cherry Trail devices with an AXP288 PMIC, the AXP288 PMIC is also used on Bay Trail devices but there the power button is only connected to the PMIC and not handled by soc_button_array. This means that the INTCFD9 check has caused a regression on Bay Trail devices, causing power-button presses to no longer be seen. This commit fixes this by limiting the check to devices where the ACPI node for the AXP288 contains a _HRV (hardware revision) attribute with a value of 3 which indicates we are dealing with a Cherry Trail platform. Fixes: 9b13a4ca8d2c ("Input: axp20x-pek - do not register input ...") Reported-by: Сергей Трусов Signed-off-by: Hans de Goede Signed-off-by: Dmitry Torokhov drivers/input/misc/axp20x-pek.c | 43 ++++++++++++++++++++++++++++++++++------- 1 file changed, 36 insertions(+), 7 deletions(-) commit eadcbfa58ae8693f0d6a0f591d8f51d55cf068e1 Merge: c4beedb 5ed02db Author: Dmitry Torokhov Date: Fri Jun 2 17:49:10 2017 -0700 Merge tag 'v4.12-rc3' into for-linus Merge with mainline to get acpi_dev_present() needed by patches to axp20x-pek driver. commit b132e4a25dccf5d5857e6ce2d96541be51aa9c5e Merge: b3addcf afbbc79 Author: Greg Kroah-Hartman Date: Sat Jun 3 09:47:16 2017 +0900 Merge tag 'fixes-for-v4.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus Felipe writes: usb: fixes for v4.12-rc4 A fix to a really old synchronization bug on mass storage gadget. Support for Meson8 SoCs on dwc2 Synchronization fixes on renesas USB driver. commit 104c08ba8e921ef97abfdc10408d54921a6d9003 Merge: 89af529 6031913 Author: Linus Torvalds Date: Fri Jun 2 16:36:23 2017 -0700 Merge tag 'acpi-4.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "These revert one more problematic commit related to the ACPI-based handling of laptop lids and make some unuseful error messages coming from ACPICA go away. Specifics: - Revert one more commit related to the ACPI-based handling of laptop lids that changed the default behavior on laptops that booted with closed lids and introduced a regression there (Benjamin Tissoires). - Add a missing acpi_put_table() to the code implementing the /sys/firmware/acpi/tables interface to prevent a counter in the ACPICA core from overflowing (Dan Williams). - Drop error messages printed by ACPICA on acpi_get_table() reference counting mismatches as they need not indicate real errors at this point (Lv Zheng)" * tag 'acpi-4.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPICA: Tables: Fix regression introduced by a too early mechanism enabling Revert "ACPI / button: Change default behavior to lid_init_state=open" ACPI / sysfs: fix acpi_get_table() leak / acpi-sysfs denial of service commit 89af529a6469d612258fce5745a7d45430f316ce Merge: 5a4829b bb5710e Author: Linus Torvalds Date: Fri Jun 2 16:33:33 2017 -0700 Merge tag 'pm-4.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix two bugs in error code paths in the cpufreq core and in the kirkwood-cpufreq driver. Specifics: - Make cpufreq_register_driver() return an error if the ->init() calls fail for all CPUs to prevent non-functional drivers from hanging around for no reason (David Arcari). - Make kirkwood-cpufreq check the return value of clk_prepare_enable() (which may fail) as appropriate (Arvind Yadav)" * tag 'pm-4.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: kirkwood-cpufreq:- Handle return value of clk_prepare_enable() cpufreq: cpufreq_register_driver() should return -ENODEV if init fails commit 5a4829b564d2f69574dc55bba2ada3ee72022187 Merge: f219764 9dfa7bb Author: Linus Torvalds Date: Fri Jun 2 16:19:47 2017 -0700 Merge tag 'random_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/random Pull /dev/random bug fix from Ted Ts'o: "Fix a race on architectures with prioritized interrupts (such as m68k) which can causes crashes in drivers/char/random.c:get_reg()" * tag 'random_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/random: fix race in drivers/char/random.c:get_reg() commit f219764920c3d235713566013375cc01decd3d49 Merge: e6e6d07 d6c9708 Author: Linus Torvalds Date: Fri Jun 2 15:49:46 2017 -0700 Merge branch 'akpm' (patches from Andrew) Merge misc fixes from Andrew Morton: "15 fixes" * emailed patches from Andrew Morton : scripts/gdb: make lx-dmesg command work (reliably) mm: consider memblock reservations for deferred memory initialization sizing mm/hugetlb: report -EHWPOISON not -EFAULT when FOLL_HWPOISON is specified mlock: fix mlock count can not decrease in race condition mm/migrate: fix refcount handling when !hugepage_migration_supported() dax: fix race between colliding PMD & PTE entries mm: avoid spurious 'bad pmd' warning messages mm/page_alloc.c: make sure OOM victim can try allocations with no watermarks once pcmcia: remove left-over %Z format slub/memcg: cure the brainless abuse of sysfs attributes initramfs: fix disabling of initramfs (and its compression) mm: clarify why we want kmalloc before falling backto vmallock frv: declare jiffies to be located in the .data section include/linux/gfp.h: fix ___GFP_NOLOCKDEP value ksm: prevent crash after write_protect_page fails commit d6c9708737c2107c38bd75f133d14d5801b8d6d5 Author: André Draszik Date: Fri Jun 2 14:46:51 2017 -0700 scripts/gdb: make lx-dmesg command work (reliably) lx-dmesg needs access to the log_buf symbol from printk.c. Unfortunately, the symbol log_buf also exists in BPF's verifier.c and hence gdb can pick one or the other. If it happens to pick BPF's log_buf, lx-dmesg doesn't work: (gdb) lx-dmesg Python Exception Cannot access memory at address 0x0: Error occurred in Python command: Cannot access memory at address 0x0 (gdb) p log_buf $15 = 0x0 Luckily, GDB has a way to deal with this, see https://sourceware.org/gdb/onlinedocs/gdb/Symbols.html (gdb) info variables ^log_buf$ All variables matching regular expression "^log_buf$": File /kernel/bpf/verifier.c: static char *log_buf; File /kernel/printk/printk.c: static char *log_buf; (gdb) p 'verifier.c'::log_buf $1 = 0x0 (gdb) p 'printk.c'::log_buf $2 = 0x811a6aa0 <__log_buf> "" (gdb) p &log_buf $3 = (char **) 0x8120fe40 (gdb) p &'verifier.c'::log_buf $4 = (char **) 0x8120fe40 (gdb) p &'printk.c'::log_buf $5 = (char **) 0x8048b7d0 By being explicit about the location of the symbol, we can make lx-dmesg work again. While at it, do the same for the other symbols we need from printk.c Link: http://lkml.kernel.org/r/20170526112222.3414-1-git@andred.net Signed-off-by: André Draszik Tested-by: Kieran Bingham Acked-by: Jan Kiszka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds scripts/gdb/linux/dmesg.py | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 864b9a393dcb5aed09b8fd31b9bbda0fdda99374 Author: Michal Hocko Date: Fri Jun 2 14:46:49 2017 -0700 mm: consider memblock reservations for deferred memory initialization sizing We have seen an early OOM killer invocation on ppc64 systems with crashkernel=4096M: kthreadd invoked oom-killer: gfp_mask=0x16040c0(GFP_KERNEL|__GFP_COMP|__GFP_NOTRACK), nodemask=7, order=0, oom_score_adj=0 kthreadd cpuset=/ mems_allowed=7 CPU: 0 PID: 2 Comm: kthreadd Not tainted 4.4.68-1.gd7fe927-default #1 Call Trace: dump_stack+0xb0/0xf0 (unreliable) dump_header+0xb0/0x258 out_of_memory+0x5f0/0x640 __alloc_pages_nodemask+0xa8c/0xc80 kmem_getpages+0x84/0x1a0 fallback_alloc+0x2a4/0x320 kmem_cache_alloc_node+0xc0/0x2e0 copy_process.isra.25+0x260/0x1b30 _do_fork+0x94/0x470 kernel_thread+0x48/0x60 kthreadd+0x264/0x330 ret_from_kernel_thread+0x5c/0xa4 Mem-Info: active_anon:0 inactive_anon:0 isolated_anon:0 active_file:0 inactive_file:0 isolated_file:0 unevictable:0 dirty:0 writeback:0 unstable:0 slab_reclaimable:5 slab_unreclaimable:73 mapped:0 shmem:0 pagetables:0 bounce:0 free:0 free_pcp:0 free_cma:0 Node 7 DMA free:0kB min:0kB low:0kB high:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:52428800kB managed:110016kB mlocked:0kB dirty:0kB writeback:0kB mapped:0kB shmem:0kB slab_reclaimable:320kB slab_unreclaimable:4672kB kernel_stack:1152kB pagetables:0kB unstable:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? yes lowmem_reserve[]: 0 0 0 0 Node 7 DMA: 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB 0*8192kB 0*16384kB = 0kB 0 total pagecache pages 0 pages in swap cache Swap cache stats: add 0, delete 0, find 0/0 Free swap = 0kB Total swap = 0kB 819200 pages RAM 0 pages HighMem/MovableOnly 817481 pages reserved 0 pages cma reserved 0 pages hwpoisoned the reason is that the managed memory is too low (only 110MB) while the rest of the the 50GB is still waiting for the deferred intialization to be done. update_defer_init estimates the initial memoty to initialize to 2GB at least but it doesn't consider any memory allocated in that range. In this particular case we've had Reserving 4096MB of memory at 128MB for crashkernel (System RAM: 51200MB) so the low 2GB is mostly depleted. Fix this by considering memblock allocations in the initial static initialization estimation. Move the max_initialise to reset_deferred_meminit and implement a simple memblock_reserved_memory helper which iterates all reserved blocks and sums the size of all that start below the given address. The cumulative size is than added on top of the initial estimation. This is still not ideal because reset_deferred_meminit doesn't consider holes and so reservation might be above the initial estimation whihch we ignore but let's make the logic simpler until we really need to handle more complicated cases. Fixes: 3a80a7fa7989 ("mm: meminit: initialise a subset of struct pages if CONFIG_DEFERRED_STRUCT_PAGE_INIT is set") Link: http://lkml.kernel.org/r/20170531104010.GI27783@dhcp22.suse.cz Signed-off-by: Michal Hocko Acked-by: Mel Gorman Tested-by: Srikar Dronamraju Cc: [4.2+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/memblock.h | 8 ++++++++ include/linux/mmzone.h | 1 + mm/memblock.c | 23 +++++++++++++++++++++++ mm/page_alloc.c | 33 ++++++++++++++++++++++----------- 4 files changed, 54 insertions(+), 11 deletions(-) commit 9a291a7c9428155e8e623e4a3989f8be47134df5 Author: James Morse Date: Fri Jun 2 14:46:46 2017 -0700 mm/hugetlb: report -EHWPOISON not -EFAULT when FOLL_HWPOISON is specified KVM uses get_user_pages() to resolve its stage2 faults. KVM sets the FOLL_HWPOISON flag causing faultin_page() to return -EHWPOISON when it finds a VM_FAULT_HWPOISON. KVM handles these hwpoison pages as a special case. (check_user_page_hwpoison()) When huge pages are involved, this doesn't work so well. get_user_pages() calls follow_hugetlb_page(), which stops early if it receives VM_FAULT_HWPOISON from hugetlb_fault(), eventually returning -EFAULT to the caller. The step to map this to -EHWPOISON based on the FOLL_ flags is missing. The hwpoison special case is skipped, and -EFAULT is returned to user-space, causing Qemu or kvmtool to exit. Instead, move this VM_FAULT_ to errno mapping code into a header file and use it from faultin_page() and follow_hugetlb_page(). With this, KVM works as expected. This isn't a problem for arm64 today as we haven't enabled MEMORY_FAILURE, but I can't see any reason this doesn't happen on x86 too, so I think this should be a fix. This doesn't apply earlier than stable's v4.11.1 due to all sorts of cleanup. [james.morse@arm.com: add vm_fault_to_errno() call to faultin_page()] suggested. Link: http://lkml.kernel.org/r/20170525171035.16359-1-james.morse@arm.com [akpm@linux-foundation.org: coding-style fixes] Link: http://lkml.kernel.org/r/20170524160900.28786-1-james.morse@arm.com Signed-off-by: James Morse Acked-by: Punit Agrawal Acked-by: Naoya Horiguchi Cc: "Kirill A . Shutemov" Cc: [4.11.1+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/mm.h | 11 +++++++++++ mm/gup.c | 20 ++++++++------------ mm/hugetlb.c | 5 +++++ 3 files changed, 24 insertions(+), 12 deletions(-) commit 70feee0e1ef331b22cc51f383d532a0d043fbdcc Author: Yisheng Xie Date: Fri Jun 2 14:46:43 2017 -0700 mlock: fix mlock count can not decrease in race condition Kefeng reported that when running the follow test, the mlock count in meminfo will increase permanently: [1] testcase linux:~ # cat test_mlockal grep Mlocked /proc/meminfo for j in `seq 0 10` do for i in `seq 4 15` do ./p_mlockall >> log & done sleep 0.2 done # wait some time to let mlock counter decrease and 5s may not enough sleep 5 grep Mlocked /proc/meminfo linux:~ # cat p_mlockall.c #include #include #include #define SPACE_LEN 4096 int main(int argc, char ** argv) { int ret; void *adr = malloc(SPACE_LEN); if (!adr) return -1; ret = mlockall(MCL_CURRENT | MCL_FUTURE); printf("mlcokall ret = %d\n", ret); ret = munlockall(); printf("munlcokall ret = %d\n", ret); free(adr); return 0; } In __munlock_pagevec() we should decrement NR_MLOCK for each page where we clear the PageMlocked flag. Commit 1ebb7cc6a583 ("mm: munlock: batch NR_MLOCK zone state updates") has introduced a bug where we don't decrement NR_MLOCK for pages where we clear the flag, but fail to isolate them from the lru list (e.g. when the pages are on some other cpu's percpu pagevec). Since PageMlocked stays cleared, the NR_MLOCK accounting gets permanently disrupted by this. Fix it by counting the number of page whose PageMlock flag is cleared. Fixes: 1ebb7cc6a583 (" mm: munlock: batch NR_MLOCK zone state updates") Link: http://lkml.kernel.org/r/1495678405-54569-1-git-send-email-xieyisheng1@huawei.com Signed-off-by: Yisheng Xie Reported-by: Kefeng Wang Tested-by: Kefeng Wang Cc: Vlastimil Babka Cc: Joern Engel Cc: Mel Gorman Cc: Michel Lespinasse Cc: Hugh Dickins Cc: Rik van Riel Cc: Johannes Weiner Cc: Michal Hocko Cc: Xishi Qiu Cc: zhongjiang Cc: Hanjun Guo Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/mlock.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 30809f559a0d348c2dfd7ab05e9a451e2384962e Author: Punit Agrawal Date: Fri Jun 2 14:46:40 2017 -0700 mm/migrate: fix refcount handling when !hugepage_migration_supported() On failing to migrate a page, soft_offline_huge_page() performs the necessary update to the hugepage ref-count. But when !hugepage_migration_supported() , unmap_and_move_hugepage() also decrements the page ref-count for the hugepage. The combined behaviour leaves the ref-count in an inconsistent state. This leads to soft lockups when running the overcommitted hugepage test from mce-tests suite. Soft offlining pfn 0x83ed600 at process virtual address 0x400000000000 soft offline: 0x83ed600: migration failed 1, type 1fffc00000008008 (uptodate|head) INFO: rcu_preempt detected stalls on CPUs/tasks: Tasks blocked on level-0 rcu_node (CPUs 0-7): P2715 (detected by 7, t=5254 jiffies, g=963, c=962, q=321) thugetlb_overco R running task 0 2715 2685 0x00000008 Call trace: dump_backtrace+0x0/0x268 show_stack+0x24/0x30 sched_show_task+0x134/0x180 rcu_print_detail_task_stall_rnp+0x54/0x7c rcu_check_callbacks+0xa74/0xb08 update_process_times+0x34/0x60 tick_sched_handle.isra.7+0x38/0x70 tick_sched_timer+0x4c/0x98 __hrtimer_run_queues+0xc0/0x300 hrtimer_interrupt+0xac/0x228 arch_timer_handler_phys+0x3c/0x50 handle_percpu_devid_irq+0x8c/0x290 generic_handle_irq+0x34/0x50 __handle_domain_irq+0x68/0xc0 gic_handle_irq+0x5c/0xb0 Address this by changing the putback_active_hugepage() in soft_offline_huge_page() to putback_movable_pages(). This only triggers on systems that enable memory failure handling (ARCH_SUPPORTS_MEMORY_FAILURE) but not hugepage migration (!ARCH_ENABLE_HUGEPAGE_MIGRATION). I imagine this wasn't triggered as there aren't many systems running this configuration. [akpm@linux-foundation.org: remove dead comment, per Naoya] Link: http://lkml.kernel.org/r/20170525135146.32011-1-punit.agrawal@arm.com Reported-by: Manoj Iyer Tested-by: Manoj Iyer Suggested-by: Naoya Horiguchi Signed-off-by: Punit Agrawal Cc: Joonsoo Kim Cc: Wanpeng Li Cc: Christoph Lameter Cc: Mel Gorman Cc: [3.14+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/memory-failure.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) commit e2093926a098a8ccf0f1d10f6df8dad452cb28d3 Author: Ross Zwisler Date: Fri Jun 2 14:46:37 2017 -0700 dax: fix race between colliding PMD & PTE entries We currently have two related PMD vs PTE races in the DAX code. These can both be easily triggered by having two threads reading and writing simultaneously to the same private mapping, with the key being that private mapping reads can be handled with PMDs but private mapping writes are always handled with PTEs so that we can COW. Here is the first race: CPU 0 CPU 1 (private mapping write) __handle_mm_fault() create_huge_pmd() - FALLBACK handle_pte_fault() passes check for pmd_devmap() (private mapping read) __handle_mm_fault() create_huge_pmd() dax_iomap_pmd_fault() inserts PMD dax_iomap_pte_fault() does a PTE fault, but we already have a DAX PMD installed in our page tables at this spot. Here's the second race: CPU 0 CPU 1 (private mapping read) __handle_mm_fault() passes check for pmd_none() create_huge_pmd() dax_iomap_pmd_fault() inserts PMD (private mapping write) __handle_mm_fault() create_huge_pmd() - FALLBACK (private mapping read) __handle_mm_fault() passes check for pmd_none() create_huge_pmd() handle_pte_fault() dax_iomap_pte_fault() inserts PTE dax_iomap_pmd_fault() inserts PMD, but we already have a PTE at this spot. The core of the issue is that while there is isolation between faults to the same range in the DAX fault handlers via our DAX entry locking, there is no isolation between faults in the code in mm/memory.c. This means for instance that this code in __handle_mm_fault() can run: if (pmd_none(*vmf.pmd) && transparent_hugepage_enabled(vma)) { ret = create_huge_pmd(&vmf); But by the time we actually get to run the fault handler called by create_huge_pmd(), the PMD is no longer pmd_none() because a racing PTE fault has installed a normal PMD here as a parent. This is the cause of the 2nd race. The first race is similar - there is the following check in handle_pte_fault(): } else { /* See comment in pte_alloc_one_map() */ if (pmd_devmap(*vmf->pmd) || pmd_trans_unstable(vmf->pmd)) return 0; So if a pmd_devmap() PMD (a DAX PMD) has been installed at vmf->pmd, we will bail and retry the fault. This is correct, but there is nothing preventing the PMD from being installed after this check but before we actually get to the DAX PTE fault handlers. In my testing these races result in the following types of errors: BUG: Bad rss-counter state mm:ffff8800a817d280 idx:1 val:1 BUG: non-zero nr_ptes on freeing mm: 15 Fix this issue by having the DAX fault handlers verify that it is safe to continue their fault after they have taken an entry lock to block other racing faults. [ross.zwisler@linux.intel.com: improve fix for colliding PMD & PTE entries] Link: http://lkml.kernel.org/r/20170526195932.32178-1-ross.zwisler@linux.intel.com Link: http://lkml.kernel.org/r/20170522215749.23516-2-ross.zwisler@linux.intel.com Signed-off-by: Ross Zwisler Reported-by: Pawel Lebioda Reviewed-by: Jan Kara Cc: "Darrick J. Wong" Cc: Alexander Viro Cc: Christoph Hellwig Cc: Dan Williams Cc: Dave Hansen Cc: Matthew Wilcox Cc: "Kirill A . Shutemov" Cc: Pawel Lebioda Cc: Dave Jiang Cc: Xiong Zhou Cc: Eryu Guan Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/dax.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) commit d0f0931de936a0a468d7e59284d39581c16d3a73 Author: Ross Zwisler Date: Fri Jun 2 14:46:34 2017 -0700 mm: avoid spurious 'bad pmd' warning messages When the pmd_devmap() checks were added by 5c7fb56e5e3f ("mm, dax: dax-pmd vs thp-pmd vs hugetlbfs-pmd") to add better support for DAX huge pages, they were all added to the end of if() statements after existing pmd_trans_huge() checks. So, things like: - if (pmd_trans_huge(*pmd)) + if (pmd_trans_huge(*pmd) || pmd_devmap(*pmd)) When further checks were added after pmd_trans_unstable() checks by commit 7267ec008b5c ("mm: postpone page table allocation until we have page to map") they were also added at the end of the conditional: + if (pmd_trans_unstable(fe->pmd) || pmd_devmap(*fe->pmd)) This ordering is fine for pmd_trans_huge(), but doesn't work for pmd_trans_unstable(). This is because DAX huge pages trip the bad_pmd() check inside of pmd_none_or_trans_huge_or_clear_bad() (called by pmd_trans_unstable()), which prints out a warning and returns 1. So, we do end up doing the right thing, but only after spamming dmesg with suspicious looking messages: mm/pgtable-generic.c:39: bad pmd ffff8808daa49b88(84000001006000a5) Reorder these checks in a helper so that pmd_devmap() is checked first, avoiding the error messages, and add a comment explaining why the ordering is important. Fixes: commit 7267ec008b5c ("mm: postpone page table allocation until we have page to map") Link: http://lkml.kernel.org/r/20170522215749.23516-1-ross.zwisler@linux.intel.com Signed-off-by: Ross Zwisler Reviewed-by: Jan Kara Cc: Pawel Lebioda Cc: "Darrick J. Wong" Cc: Alexander Viro Cc: Christoph Hellwig Cc: Dan Williams Cc: Dave Hansen Cc: Matthew Wilcox Cc: "Kirill A . Shutemov" Cc: Dave Jiang Cc: Xiong Zhou Cc: Eryu Guan Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/memory.c | 40 ++++++++++++++++++++++++++++++---------- 1 file changed, 30 insertions(+), 10 deletions(-) commit c288983dddf714216428774e022ad78f48dd8cb1 Author: Tetsuo Handa Date: Fri Jun 2 14:46:31 2017 -0700 mm/page_alloc.c: make sure OOM victim can try allocations with no watermarks once Roman Gushchin has reported that the OOM killer can trivially selects next OOM victim when a thread doing memory allocation from page fault path was selected as first OOM victim. allocate invoked oom-killer: gfp_mask=0x14280ca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO), nodemask=(null), order=0, oom_score_adj=0 allocate cpuset=/ mems_allowed=0 CPU: 1 PID: 492 Comm: allocate Not tainted 4.12.0-rc1-mm1+ #181 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 Call Trace: oom_kill_process+0x219/0x3e0 out_of_memory+0x11d/0x480 __alloc_pages_slowpath+0xc84/0xd40 __alloc_pages_nodemask+0x245/0x260 alloc_pages_vma+0xa2/0x270 __handle_mm_fault+0xca9/0x10c0 handle_mm_fault+0xf3/0x210 __do_page_fault+0x240/0x4e0 trace_do_page_fault+0x37/0xe0 do_async_page_fault+0x19/0x70 async_page_fault+0x28/0x30 ... Out of memory: Kill process 492 (allocate) score 899 or sacrifice child Killed process 492 (allocate) total-vm:2052368kB, anon-rss:1894576kB, file-rss:4kB, shmem-rss:0kB allocate: page allocation failure: order:0, mode:0x14280ca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO), nodemask=(null) allocate cpuset=/ mems_allowed=0 CPU: 1 PID: 492 Comm: allocate Not tainted 4.12.0-rc1-mm1+ #181 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 Call Trace: __alloc_pages_slowpath+0xd32/0xd40 __alloc_pages_nodemask+0x245/0x260 alloc_pages_vma+0xa2/0x270 __handle_mm_fault+0xca9/0x10c0 handle_mm_fault+0xf3/0x210 __do_page_fault+0x240/0x4e0 trace_do_page_fault+0x37/0xe0 do_async_page_fault+0x19/0x70 async_page_fault+0x28/0x30 ... oom_reaper: reaped process 492 (allocate), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kB ... allocate invoked oom-killer: gfp_mask=0x0(), nodemask=(null), order=0, oom_score_adj=0 allocate cpuset=/ mems_allowed=0 CPU: 1 PID: 492 Comm: allocate Not tainted 4.12.0-rc1-mm1+ #181 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 Call Trace: oom_kill_process+0x219/0x3e0 out_of_memory+0x11d/0x480 pagefault_out_of_memory+0x68/0x80 mm_fault_error+0x8f/0x190 ? handle_mm_fault+0xf3/0x210 __do_page_fault+0x4b2/0x4e0 trace_do_page_fault+0x37/0xe0 do_async_page_fault+0x19/0x70 async_page_fault+0x28/0x30 ... Out of memory: Kill process 233 (firewalld) score 10 or sacrifice child Killed process 233 (firewalld) total-vm:246076kB, anon-rss:20956kB, file-rss:0kB, shmem-rss:0kB There is a race window that the OOM reaper completes reclaiming the first victim's memory while nothing but mutex_trylock() prevents the first victim from calling out_of_memory() from pagefault_out_of_memory() after memory allocation for page fault path failed due to being selected as an OOM victim. This is a side effect of commit 9a67f6488eca926f ("mm: consolidate GFP_NOFAIL checks in the allocator slowpath") because that commit silently changed the behavior from /* Avoid allocations with no watermarks from looping endlessly */ to /* * Give up allocations without trying memory reserves if selected * as an OOM victim */ in __alloc_pages_slowpath() by moving the location to check TIF_MEMDIE flag. I have noticed this change but I didn't post a patch because I thought it is an acceptable change other than noise by warn_alloc() because !__GFP_NOFAIL allocations are allowed to fail. But we overlooked that failing memory allocation from page fault path makes difference due to the race window explained above. While it might be possible to add a check to pagefault_out_of_memory() that prevents the first victim from calling out_of_memory() or remove out_of_memory() from pagefault_out_of_memory(), changing pagefault_out_of_memory() does not suppress noise by warn_alloc() when allocating thread was selected as an OOM victim. There is little point with printing similar backtraces and memory information from both out_of_memory() and warn_alloc(). Instead, if we guarantee that current thread can try allocations with no watermarks once when current thread looping inside __alloc_pages_slowpath() was selected as an OOM victim, we can follow "who can use memory reserves" rules and suppress noise by warn_alloc() and prevent memory allocations from page fault path from calling pagefault_out_of_memory(). If we take the comment literally, this patch would do - if (test_thread_flag(TIF_MEMDIE)) - goto nopage; + if (alloc_flags == ALLOC_NO_WATERMARKS || (gfp_mask & __GFP_NOMEMALLOC)) + goto nopage; because gfp_pfmemalloc_allowed() returns false if __GFP_NOMEMALLOC is given. But if I recall correctly (I couldn't find the message), the condition is meant to apply to only OOM victims despite the comment. Therefore, this patch preserves TIF_MEMDIE check. Fixes: 9a67f6488eca926f ("mm: consolidate GFP_NOFAIL checks in the allocator slowpath") Link: http://lkml.kernel.org/r/201705192112.IAF69238.OQOHSJLFOFFMtV@I-love.SAKURA.ne.jp Signed-off-by: Tetsuo Handa Reported-by: Roman Gushchin Tested-by: Roman Gushchin Acked-by: Michal Hocko Cc: Johannes Weiner Cc: Vladimir Davydov Cc: [4.11] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/page_alloc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit ff5a20169b98d84ad8d7f99f27c5ebbb008204d6 Author: Nicolas Iooss Date: Fri Jun 2 14:46:28 2017 -0700 pcmcia: remove left-over %Z format Commit 5b5e0928f742 ("lib/vsprintf.c: remove %Z support") removed some usages of format %Z but forgot "%.2Zx". This makes clang 4.0 reports a -Wformat-extra-args warning because it does not know about %Z. Replace %Z with %z. Link: http://lkml.kernel.org/r/20170520090946.22562-1-nicolas.iooss_linux@m4x.org Signed-off-by: Nicolas Iooss Cc: Harald Welte Cc: Alexey Dobriyan Cc: [4.11+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/char/pcmcia/cm4040_cs.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 478fe3037b2278d276d4cd9cd0ab06c4cb2e9b32 Author: Thomas Gleixner Date: Fri Jun 2 14:46:25 2017 -0700 slub/memcg: cure the brainless abuse of sysfs attributes memcg_propagate_slab_attrs() abuses the sysfs attribute file functions to propagate settings from the root kmem_cache to a newly created kmem_cache. It does that with: attr->show(root, buf); attr->store(new, buf, strlen(bug); Aside of being a lazy and absurd hackery this is broken because it does not check the return value of the show() function. Some of the show() functions return 0 w/o touching the buffer. That means in such a case the store function is called with the stale content of the previous show(). That causes nonsense like invoking kmem_cache_shrink() on a newly created kmem_cache. In the worst case it would cause handing in an uninitialized buffer. This should be rewritten proper by adding a propagate() callback to those slub_attributes which must be propagated and avoid that insane conversion to and from ASCII, but that's too large for a hot fix. Check at least the return value of the show() function, so calling store() with stale content is prevented. Steven said: "It can cause a deadlock with get_online_cpus() that has been uncovered by recent cpu hotplug and lockdep changes that Thomas and Peter have been doing. Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(cpu_hotplug.lock); lock(slab_mutex); lock(cpu_hotplug.lock); lock(slab_mutex); *** DEADLOCK ***" Link: http://lkml.kernel.org/r/alpine.DEB.2.20.1705201244540.2255@nanos Signed-off-by: Thomas Gleixner Reported-by: Steven Rostedt Acked-by: David Rientjes Cc: Johannes Weiner Cc: Michal Hocko Cc: Peter Zijlstra Cc: Christoph Lameter Cc: Pekka Enberg Cc: Joonsoo Kim Cc: Christoph Hellwig Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/slub.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 57ddfdaa9a72fe726a44d26d99db31bc137dbeff Author: Florian Fainelli Date: Fri Jun 2 14:46:22 2017 -0700 initramfs: fix disabling of initramfs (and its compression) Commit db2aa7fd15e8 ("initramfs: allow again choice of the embedded initram compression algorithm") introduced the possibility to select the initramfs compression algorithm from Kconfig and while this is a nice feature it broke the use case described below. Here is what my build system does: - kernel is initially configured not to have an initramfs included - build the user space root file system - re-configure the kernel to have an initramfs included (CONFIG_INITRAMFS_SOURCE="/path/to/romfs") and set relevant CONFIG_INITRAMFS options, in my case, no compression option (CONFIG_INITRAMFS_COMPRESSION_NONE) - kernel is re-built with these options -> kernel+initramfs image is copied - kernel is re-built again without these options -> kernel image is copied Building a kernel without an initramfs means setting this option: CONFIG_INITRAMFS_SOURCE="" (and this one only) whereas building a kernel with an initramfs means setting these options: CONFIG_INITRAMFS_SOURCE="/home/fainelli/work/uclinux-rootfs/romfs /home/fainelli/work/uclinux-rootfs/misc/initramfs.dev" CONFIG_INITRAMFS_ROOT_UID=1000 CONFIG_INITRAMFS_ROOT_GID=1000 CONFIG_INITRAMFS_COMPRESSION_NONE=y CONFIG_INITRAMFS_COMPRESSION="" Commit db2aa7fd15e85 ("initramfs: allow again choice of the embedded initram compression algorithm") is problematic because CONFIG_INITRAMFS_COMPRESSION which is used to determine the initramfs_data.cpio extension/compression is a string, and due to how Kconfig works it will evaluate in order, how to assign it. Setting CONFIG_INITRAMFS_COMPRESSION_NONE with CONFIG_INITRAMFS_SOURCE="" cannot possibly work (because of the depends on INITRAMFS_SOURCE!="" imposed on CONFIG_INITRAMFS_COMPRESSION ) yet we still get CONFIG_INITRAMFS_COMPRESSION assigned to ".gz" because CONFIG_RD_GZIP=y is set in my kernel, even when there is no initramfs being built. So we basically end-up generating two initramfs_data.cpio* files, one without extension, and one with .gz. This causes usr/Makefile to track usr/initramfs_data.cpio.gz, and not usr/initramfs_data.cpio anymore, that is also largely problematic after 9e3596b0c6539e ("kbuild: initramfs cleanup, set target from Kconfig") because we used to track all possible initramfs_data files in the $(targets) variable before that commit. The end result is that the kernel with an initramfs clearly does not contain what we expect it to, it has a stale initramfs_data.cpio file built into it, and we keep re-generating an initramfs_data.cpio.gz file which is not the one that we want to include in the kernel image proper. The fix consists in hiding CONFIG_INITRAMFS_COMPRESSION when CONFIG_INITRAMFS_SOURCE="". This puts us back in a state to the pre-4.10 behavior where we can properly disable and re-enable initramfs within the same kernel .config file, and be in control of what CONFIG_INITRAMFS_COMPRESSION is set to. Fixes: db2aa7fd15e8 ("initramfs: allow again choice of the embedded initram compression algorithm") Fixes: 9e3596b0c653 ("kbuild: initramfs cleanup, set target from Kconfig") Link: http://lkml.kernel.org/r/20170521033337.6197-1-f.fainelli@gmail.com Signed-off-by: Florian Fainelli Acked-by: Nicholas Piggin Cc: P J P Cc: Paul Bolle Cc: Michal Marek Cc: Daniel Thompson Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds usr/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 4f4f2ba9c531b3d7cee293dd3654ba3b86e7d220 Author: Michal Hocko Date: Fri Jun 2 14:46:19 2017 -0700 mm: clarify why we want kmalloc before falling backto vmallock While converting drm_[cm]alloc* helpers to kvmalloc* variants Chris Wilson has wondered why we want to try kmalloc before vmalloc fallback even for larger allocations requests. Let's clarify that one larger physically contiguous block is less likely to fragment memory than many scattered pages which can prevent more large blocks from being created. [akpm@linux-foundation.org: coding-style fixes] Link: http://lkml.kernel.org/r/20170517080932.21423-1-mhocko@kernel.org Signed-off-by: Michal Hocko Suggested-by: Chris Wilson Reviewed-by: Chris Wilson Acked-by: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/util.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 60b0a8c3d2480f3b57282b47b7cae7ee71c48635 Author: Matthias Kaehlcke Date: Fri Jun 2 14:46:16 2017 -0700 frv: declare jiffies to be located in the .data section Commit 7c30f352c852 ("jiffies.h: declare jiffies and jiffies_64 with ____cacheline_aligned_in_smp") removed a section specification from the jiffies declaration that caused conflicts on some platforms. Unfortunately this change broke the build for frv: kernel/built-in.o: In function `__do_softirq': (.text+0x6460): relocation truncated to fit: R_FRV_GPREL12 against symbol `jiffies' defined in *ABS* section in .tmp_vmlinux1 kernel/built-in.o: In function `__do_softirq': (.text+0x6574): relocation truncated to fit: R_FRV_GPREL12 against symbol `jiffies' defined in *ABS* section in .tmp_vmlinux1 kernel/built-in.o: In function `pwq_activate_delayed_work': workqueue.c:(.text+0x15b9c): relocation truncated to fit: R_FRV_GPREL12 against symbol `jiffies' defined in *ABS* section in .tmp_vmlinux1 ... Add __jiffy_arch_data to the declaration of jiffies and use it on frv to include the section specification. For all other platforms __jiffy_arch_data (currently) has no effect. Fixes: 7c30f352c852 ("jiffies.h: declare jiffies and jiffies_64 with ____cacheline_aligned_in_smp") Link: http://lkml.kernel.org/r/20170516221333.177280-1-mka@chromium.org Signed-off-by: Matthias Kaehlcke Reported-by: Guenter Roeck Tested-by: Guenter Roeck Reviewed-by: David Howells Cc: Sudip Mukherjee Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/frv/include/asm/timex.h | 6 ++++++ include/linux/jiffies.h | 6 +++++- 2 files changed, 11 insertions(+), 1 deletion(-) commit 1bde33e051233f0ed93a8bc67137016ab38c3d2d Author: Michal Hocko Date: Fri Jun 2 14:46:13 2017 -0700 include/linux/gfp.h: fix ___GFP_NOLOCKDEP value Igor Stoppa has noticed that __GFP_NOLOCKDEP can use a lower bit. At the time commit 7e7844226f10 ("lockdep: allow to disable reclaim lockup detection") was written we still had __GFP_OTHER_NODE but I have removed it in commit 41b6167e8f74 ("mm: get rid of __GFP_OTHER_NODE") and forgot to lower the bit value. The current value is outside of __GFP_BITS_SHIFT so it cannot be used actually. Fixes: 7e7844226f10 ("lockdep: allow to disable reclaim lockup detection") Signed-off-by: Michal Hocko Reported-by: Igor Stoppa Acked-by: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/gfp.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a7306c3436e9c8e584a4b9fad5f3dc91be2a6076 Author: Andrea Arcangeli Date: Fri Jun 2 14:46:11 2017 -0700 ksm: prevent crash after write_protect_page fails "err" needs to be left set to -EFAULT if split_huge_page succeeds. Otherwise if "err" gets clobbered with zero and write_protect_page fails, try_to_merge_one_page() will succeed instead of returning -EFAULT and then try_to_merge_with_ksm_page() will continue thinking kpage is a PageKsm when in fact it's still an anonymous page. Eventually it'll crash in page_add_anon_rmap. This has been reproduced on Fedora25 kernel but I can reproduce with upstream too. The bug was introduced in commit f765f540598a ("ksm: prepare to new THP semantics") introduced in v4.5. page:fffff67546ce1cc0 count:4 mapcount:2 mapping:ffffa094551e36e1 index:0x7f0f46673 flags: 0x2ffffc0004007c(referenced|uptodate|dirty|lru|active|swapbacked) page dumped because: VM_BUG_ON_PAGE(!PageLocked(page)) page->mem_cgroup:ffffa09674bf0000 ------------[ cut here ]------------ kernel BUG at mm/rmap.c:1222! CPU: 1 PID: 76 Comm: ksmd Not tainted 4.9.3-200.fc25.x86_64 #1 RIP: do_page_add_anon_rmap+0x1c4/0x240 Call Trace: page_add_anon_rmap+0x18/0x20 try_to_merge_with_ksm_page+0x50b/0x780 ksm_scan_thread+0x1211/0x1410 ? prepare_to_wait_event+0x100/0x100 ? try_to_merge_with_ksm_page+0x780/0x780 kthread+0xd9/0xf0 ? kthread_park+0x60/0x60 ret_from_fork+0x25/0x30 Fixes: f765f54059 ("ksm: prepare to new THP semantics") Link: http://lkml.kernel.org/r/20170513131040.21732-1-aarcange@redhat.com Signed-off-by: Andrea Arcangeli Reported-by: Federico Simoncelli Acked-by: Kirill A. Shutemov Cc: Hugh Dickins Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/ksm.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 60319130254084b337e02439d3b4ec301b6328bb Merge: 5ed02db 878d8db0 2ea6532 0de0e19 Author: Rafael J. Wysocki Date: Sat Jun 3 00:03:29 2017 +0200 Merge branches 'acpi-button', 'acpica' and 'acpi-sysfs' * acpi-button: Revert "ACPI / button: Change default behavior to lid_init_state=open" * acpica: ACPICA: Tables: Fix regression introduced by a too early mechanism enabling * acpi-sysfs: ACPI / sysfs: fix acpi_get_table() leak / acpi-sysfs denial of service commit bb5710e72c217e5bbdf0969a2fd84f5f5ad7fc2b Merge: 5ed02db 7575f82 Author: Rafael J. Wysocki Date: Sat Jun 3 00:01:45 2017 +0200 Merge branch 'pm-cpufreq' * pm-cpufreq: cpufreq: kirkwood-cpufreq:- Handle return value of clk_prepare_enable() cpufreq: cpufreq_register_driver() should return -ENODEV if init fails commit e6e6d074369c839e84071c3b056adf20ead8da6e Merge: b939c51 63db7c8 Author: Linus Torvalds Date: Fri Jun 2 12:29:03 2017 -0700 Merge tag 'xfs-4.12-fixes-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull XFS fix from Darrick Wong: "I've one more bugfix for you for 4.12-rc4: Fix an unmount hang due to a race in io buffer accounting" * tag 'xfs-4.12-fixes-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: use ->b_state to fix buffer I/O accounting release race commit b939c51445f0542e80a8f910014c418d04b5de6e Merge: 65d0332 cb7cf77 Author: Linus Torvalds Date: Fri Jun 2 12:06:27 2017 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: "ACPI-related fixes for arm64: - GICC MADT entry validity check fix - Skip IRQ registration with pmu=off in an ACPI guest - struct acpi_pci_root_ops freeing on error path" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: ARM64/ACPI: Fix BAD_MADT_GICC_ENTRY() macro implementation drivers/perf: arm_pmu_acpi: avoid perf IRQ init when guest PMU is off ARM64: PCI: Fix struct acpi_pci_root_ops allocation failure path commit 65d03328aace31043be98f807f6e20332cdb19c8 Merge: 60c42a3 6ac5695 Author: Linus Torvalds Date: Fri Jun 2 12:03:07 2017 -0700 Merge tag 'ceph-for-4.12-rc4' of git://github.com/ceph/ceph-client Pull ceph fix from Ilya Dryomov: "A small fix for rbd FALLOC_FL_ZERO_RANGE/PUNCH_HOLE handling breakage introduced in -rc1" * tag 'ceph-for-4.12-rc4' of git://github.com/ceph/ceph-client: rbd: implement REQ_OP_WRITE_ZEROES commit e0f8e8cf3bf9305f36155a5ac6e16b3b910e6cec Author: Varun Prakash Date: Sat May 27 20:22:51 2017 +0530 scsi: cxgb4i: libcxgbi: in error case RST tcp conn If logout response is not received and ->ep_disconnect() is called then close tcp conn by RST instead of FIN to cleanup conn resources immediately. Also move ->csk_push_tx_frames() above 'done:' to avoid calling ->csk_push_tx_frames() in error cases. Signed-off-by: Varun Prakash Signed-off-by: Martin K. Petersen drivers/scsi/cxgbi/cxgb4i/cxgb4i.c | 1 - drivers/scsi/cxgbi/libcxgbi.c | 29 ++++++++++++++++++++++------- drivers/scsi/cxgbi/libcxgbi.h | 1 + 3 files changed, 23 insertions(+), 8 deletions(-) commit 60c42a31dc0fd307098486221dcb43b59057110f Merge: 6f37fa4 ff0361b Author: Linus Torvalds Date: Fri Jun 2 11:50:37 2017 -0700 Merge tag 'for-4.12/dm-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: - a DM verity fix for a mode when no salt is used - a fix to DM to account for the possibility that PREFLUSH or FUA are used without the SYNC flag if the underlying storage doesn't have a volatile write-cache - a DM ioctl memory allocation flag fix to use __GFP_HIGH to allow emergency forward progress (by using memory reserves as last resort) - a small DM integrity cleanup to use kvmalloc() instead of duplicating the same * tag 'for-4.12/dm-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm: make flush bios explicitly sync dm ioctl: restore __GFP_HIGH in copy_params() dm integrity: use kvmalloc() instead of dm_integrity_kvmalloc() dm verity: fix no salt use case commit 6f37fa4364a1099b59f73d1a71538895fd2ef975 Merge: bb32985 5a8948f Author: Linus Torvalds Date: Fri Jun 2 11:47:24 2017 -0700 Merge tag 'md/4.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md Pull MD fixes from Shaohua Li: "Several patches for MD. One notable is making flush bios sync, others fix small issues" * tag 'md/4.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md: md: Make flush bios explicitely sync md: report sector of stripes with check mismatches md: uuid debug statement now in processor byte order. md-cluster: fix potential lock issue in add_new_disk commit bb329859effa06736c39adf6ce622e86e38fc274 Merge: 4635694 b425e50 Author: Linus Torvalds Date: Fri Jun 2 11:44:46 2017 -0700 Merge branch 'for-linus' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "A set of fixes that should go into the next -rc. This contains: - A use-after-free in the request_list exit for the legacy IO path, from Bart. - A fix for CFQ, fixing a recent regression with the conversion to higher resolution timing for iops mode. From Hou Tao. - A single fix for nbd, split in two patches, fixing a leak of a data structure. - A regression fix from Keith, ensuring that callers of blk_mq_update_nr_hw_queues() hold the right lock" * 'for-linus' of git://git.kernel.dk/linux-block: block: Avoid that blk_exit_rl() triggers a use-after-free cfq-iosched: fix the delay of cfq_group's vdisktime under iops mode blk-mq: Take tagset lock when updating hw queues nbd: don't leak nbd_config nbd: nbd_reset() call in nbd_dev_add() is redundant commit 46356945fc2bc932dd224af60c12ece2672479be Merge: c531577 28904ee Author: Linus Torvalds Date: Fri Jun 2 11:32:38 2017 -0700 Merge tag 'drm-dp-quirk-for-v4.12-rc4' of git://people.freedesktop.org/~airlied/linux Pull drm displayport quirk support: "DP quirk for usb c dongles. As mentioned I have a separate request for fixing a regression, but also keeping the broken hw working, for certain USB-C DP adapters they require a minimised n/m parameters, but an attempt to do this generically has failed, we need to quirk these specific adapters. However doing it generically regressed some eDP panels. This pull adds the infrastructure and a quirk for the adapter" * tag 'drm-dp-quirk-for-v4.12-rc4' of git://people.freedesktop.org/~airlied/linux: drm/i915: Detect USB-C specific dongles before reducing M and N drm/dp: start a DPCD based DP sink/branch device quirk database drm/i915: use drm DP helper to read DPCD desc drm/dp: add helper for reading DP sink/branch device desc from DPCD commit f0c3192ceee3c16154e70dfb373f66ed86c6fea9 Author: Michael S. Tsirkin Date: Fri Jun 2 17:54:33 2017 +0300 virtio_net: lower limit on buffer size commit d85b758f72b0 ("virtio_net: fix support for small rings") was supposed to increase the buffer size for small rings but had an unintentional side effect of decreasing it for large rings. This seems to break some setups - it's not yet clear why, but increasing buffer size back to what it was before helps. Fixes: d85b758f72b0 ("virtio_net: fix support for small rings") Reported-by: Mikulas Patocka Reported-by: "J. Bruce Fields" Tested-by: Mikulas Patocka Tested-by: "J. Bruce Fields" Signed-off-by: Michael S. Tsirkin Signed-off-by: David S. Miller drivers/net/virtio_net.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 4bd7ef0b033721b659b9357057e76d1ced95c1da Author: Chopra, Manish Date: Fri Jun 2 06:52:54 2017 -0700 qlcnic: Fix tunnel offload for 82xx adapters Qlogic's 82xx series adapter doesn't support tunnel offloads, driver incorrectly assumes that it is supported and causes firmware hang while running tunnel IO. This patch fixes this by not advertising tunnel offloads for 82xx adapters. Signed-off-by: Manish Chopra Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qlcnic/qlcnic.h | 26 ++++++++++++++++++++-- .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | 2 ++ drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c | 2 ++ .../ethernet/qlogic/qlcnic/qlcnic_sriov_common.c | 2 ++ 4 files changed, 30 insertions(+), 2 deletions(-) commit a53cb29b0af346af44e4abf13d7e59f807fba690 Author: Mark Bloch Date: Fri Jun 2 03:24:08 2017 +0300 vxlan: fix use-after-free on deletion Adding a vxlan interface to a socket isn't symmetrical, while adding is done in vxlan_open() the deletion is done in vxlan_dellink(). This can cause a use-after-free error when we close the vxlan interface before deleting it. We add vxlan_vs_del_dev() to match vxlan_vs_add_dev() and call it from vxlan_stop() to match the call from vxlan_open(). Fixes: 56ef9c909b40 ("vxlan: Move socket initialization to within rtnl scope") Acked-by: Jiri Benc Tested-by: Roi Dayan Signed-off-by: Mark Bloch Acked-by: Roopa Prabhu Signed-off-by: David S. Miller drivers/net/vxlan.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) commit 78b07ac1e4c8acc9daf6b7f7b579300328673640 Author: Thomas Falcon Date: Thu Jun 1 15:32:34 2017 -0500 ibmvnic: Remove module author mailing address The original author left the project and so far has not responded to emails sent to the listed address. Signed-off-by: John Allen Signed-off-by: Thomas Falcon Signed-off-by: David S. Miller drivers/net/ethernet/ibm/ibmvnic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 77032732d0e89b83c3bca75b857a1f63e9efb44b Author: Thor Thayer Date: Wed May 31 14:28:47 2017 -0500 net: ethernet: stmmac: Fix altr_tse_pcs SGMII Initialization Fix NETDEV WATCHDOG timeout on startup by adding missing register writes that properly setup SGMII. Signed-off-by: Thor Thayer Acked-by: Giuseppe Cavallaro Signed-off-by: David S. Miller drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 44abafc4cc094214a99f860f778c48ecb23422fc Author: Yuchung Cheng Date: Wed May 31 11:21:27 2017 -0700 tcp: disallow cwnd undo when switching congestion control When the sender switches its congestion control during loss recovery, if the recovery is spurious then it may incorrectly revert cwnd and ssthresh to the older values set by a previous congestion control. Consider a congestion control (like BBR) that does not use ssthresh and keeps it infinite: the connection may incorrectly revert cwnd to an infinite value when switching from BBR to another congestion control. This patch fixes it by disallowing such cwnd undo operation upon switching congestion control. Note that undo_marker is not reset s.t. the packets that were incorrectly marked lost would be corrected. We only avoid undoing the cwnd in tcp_undo_cwnd_reduction(). Signed-off-by: Yuchung Cheng Signed-off-by: Soheil Hassas Yeganeh Signed-off-by: Neal Cardwell Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller net/ipv4/tcp_cong.c | 1 + 1 file changed, 1 insertion(+) commit e7519f9926f1d0d11c776eb0475eb098c7760f68 Author: Ganesh Goudar Date: Wed May 31 18:26:28 2017 +0530 cxgb4: avoid enabling napi twice to the same queue Take uld mutex to avoid race between cxgb_up() and cxgb4_register_uld() to enable napi for the same uld queue. Signed-off-by: Ganesh Goudar Signed-off-by: David S. Miller drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 4 ++++ 1 file changed, 4 insertions(+) commit 6e80ac5cc992ab6256c3dae87f7e57db15e1a58c Author: Ben Hutchings Date: Wed May 31 13:15:41 2017 +0100 ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt() xfrm6_find_1stfragopt() may now return an error code and we must not treat it as a length. Fixes: 2423496af35d ("ipv6: Prevent overrun when parsing v6 header options") Signed-off-by: Ben Hutchings Acked-by: Craig Gallek Signed-off-by: David S. Miller net/ipv6/xfrm6_mode_ro.c | 2 ++ net/ipv6/xfrm6_mode_transport.c | 2 ++ 2 files changed, 4 insertions(+) commit c531577bcdac51225f50033e0c89644873f4dc6d Merge: f8e72db d2c3b14 Author: Linus Torvalds Date: Fri Jun 2 09:40:47 2017 -0700 Merge tag 'sound-4.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "This contains the fixes for a few reported regression for HD-audio and USB-audio. All small, trivial, and boring" * tag 'sound-4.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda - Fix applying MSI dual-codec mobo quirk ALSA: usb: Avoid VLA in mixer_us16x08.c ALSA: usb: Fix a typo in Tascam US-16x08 mixer element Revert "ALSA: usb-audio: purge needless variable length array" commit f8e72db3452227e49fde563a528eb875b6c3c9b4 Merge: 6df62e7 ebcdaee Author: Linus Torvalds Date: Fri Jun 2 09:26:42 2017 -0700 Merge tag 'dmaengine-fix-4.12-rc4' of git://git.infradead.org/users/vkoul/slave-dma Pull dmaengine fixes from Vinod Koul: "Here is the dmaengine fixes request for 4.12. Fixes bunch of issues in the driver, npthing exciting though.. - mv_xor_v2 driver fixes for handling descriptors, tx_submit implementation, removing interrupt coalescing and setting DMA mask properly - fix usb-dmac DMAOR AE bit definition - fix ep93xx start buffer from BASE0 and not drain the transfers in terminate_all - fix rcar-dmac to use right descriptor pointer for residue calculation - pl330 fix warn for irq freeup" * tag 'dmaengine-fix-4.12-rc4' of git://git.infradead.org/users/vkoul/slave-dma: dmaengine: pl330: fix warning in pl330_remove rcar-dmac: fixup descriptor pointer for descriptor mode dmaengine: ep93xx: Don't drain the transfers in terminate_all() dmaengine: ep93xx: Always start from BASE0 dmaengine: usb-dmac: Fix DMAOR AE bit definition dmaengine: mv_xor_v2: set DMA mask to 40 bits dmaengine: mv_xor_v2: remove interrupt coalescing dmaengine: mv_xor_v2: fix tx_submit() implementation dmaengine: mv_xor_v2: enable XOR engine after its configuration dmaengine: mv_xor_v2: do not use descriptors not acked by async_tx dmaengine: mv_xor_v2: properly handle wrapping in the array of HW descriptors dmaengine: mv_xor_v2: handle mv_xor_v2_prep_sw_desc() error properly commit 6df62e7916befd2c04ac63180b4ddeae2f7639f2 Merge: 035f145 715e944 Author: Linus Torvalds Date: Fri Jun 2 09:23:56 2017 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid Pull HID fixes from Jiri Kosina: - corner-case oops fixes for Asus and Wacom drivers from Carlo Caione and Jason Gerecke - power management fix (reported on SIS0817 touchscreen) for i2c-hid devices from Hans de Goede - device-id-specific fixes and quirks from Hans de Goede, Diego Elio Pettenò and Che-Liang Chiou * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: HID: asus: Stop underlying hardware on remove HID: i2c: Call acpi_device_fix_up_power for ACPI-enumerated devices HID: asus: Add support for T100 keyboard HID: elecom: extend to fix the descriptor for DEFT trackballs HID: magicmouse: Set multi-touch keybits for Magic Mouse HID: wacom: Have wacom_tpc_irq guard against possible NULL dereference commit 035f1456f9ed256cd1a92ae1b81cc24413359e61 Merge: f2a025d 5720acf Author: Linus Torvalds Date: Fri Jun 2 08:59:17 2017 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/livepatching Pull livepatching fix from Jiri Kosina: "Kconfig dependency fix for livepatching infrastructure from Miroslav Benes" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/livepatching: livepatch: Make livepatch dependent on !TRIM_UNUSED_KSYMS commit f2a025defd804be938f8acffe62e4801a3ed1601 Merge: f56f88e c08d517 Author: Linus Torvalds Date: Fri Jun 2 08:53:42 2017 -0700 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "Misc fixes: - revert a broken PAT commit that broke a number of systems - fix two preemptability warnings/bugs that can trigger under certain circumstances, in the debug code and in the microcode loader" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: Revert "x86/PAT: Fix Xorg regression on CPUs that don't support PAT" x86/debug/32: Convert a smp_processor_id() call to raw to avoid DEBUG_PREEMPT warning x86/microcode/AMD: Change load_microcode_amd()'s param to bool to fix preemptibility bug commit f56f88ee3fa1c3080f6ba122a597e75f0d5ab969 Merge: 3b1e342 7425826 Author: Linus Torvalds Date: Fri Jun 2 08:51:53 2017 -0700 Merge branch 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull EFI fixes from Ingo Molnar: "Misc fixes: - three boot crash fixes for uncommon configurations - silence a boot warning under virtualization - plus a GCC 7 related (harmless) build warning fix" * 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: efi/bgrt: Skip efi_bgrt_init() in case of non-EFI boot x86/efi: Correct EFI identity mapping under 'efi=old_map' when KASLR is enabled x86/efi: Disable runtime services on kexec kernel if booted with efi=old_map efi: Remove duplicate 'const' specifiers efi: Don't issue error message when booted under Xen commit 75fb636324a839c2c31be9f81644034c6142e469 Author: Hans de Goede Date: Thu Jun 1 13:54:30 2017 +0200 drm: Fix oops + Xserver hang when unplugging USB drm devices commit a39be606f99d ("drm: Do a full device unregister when unplugging") causes backtraces like this one when unplugging an usb drm device while it is in use: usb 2-3: USB disconnect, device number 25 ------------[ cut here ]------------ WARNING: CPU: 0 PID: 242 at drivers/gpu/drm/drm_mode_config.c:424 drm_mode_config_cleanup+0x220/0x280 [drm] ... RIP: 0010:drm_mode_config_cleanup+0x220/0x280 [drm] ... Call Trace: gm12u320_modeset_cleanup+0xe/0x10 [gm12u320] gm12u320_driver_unload+0x35/0x70 [gm12u320] drm_dev_unregister+0x3c/0xe0 [drm] drm_unplug_dev+0x12/0x60 [drm] gm12u320_usb_disconnect+0x36/0x40 [gm12u320] usb_unbind_interface+0x72/0x280 device_release_driver_internal+0x158/0x210 device_release_driver+0x12/0x20 bus_remove_device+0x104/0x180 device_del+0x1d2/0x350 usb_disable_device+0x9f/0x270 usb_disconnect+0xc6/0x260 ... [drm:drm_mode_config_cleanup [drm]] *ERROR* connector Unknown-1 leaked! ------------[ cut here ]------------ WARNING: CPU: 0 PID: 242 at drivers/gpu/drm/drm_mode_config.c:458 drm_mode_config_cleanup+0x268/0x280 [drm] ... ---[ end trace 80df975dae439ed6 ]--- general protection fault: 0000 [#1] SMP ... Call Trace: ? __switch_to+0x225/0x450 drm_mode_rmfb_work_fn+0x55/0x70 [drm] process_one_work+0x193/0x3c0 worker_thread+0x4a/0x3a0 ... RIP: drm_framebuffer_remove+0x62/0x3f0 [drm] RSP: ffffb776c39dfd98 ---[ end trace 80df975dae439ed7 ]--- After which the system is unusable this is caused by drm_dev_unregister getting called immediately on unplug, which calls the drivers unload function which calls drm_mode_config_cleanup which removes the framebuffer object while userspace is still holding a reference to it. Reverting commit a39be606f99d ("drm: Do a full device unregister when unplugging") leads to the following oops on unplug instead, when userspace closes the last fd referencing the drm_dev: sysfs group 'power' not found for kobject 'card1-Unknown-1' ------------[ cut here ]------------ WARNING: CPU: 0 PID: 2459 at fs/sysfs/group.c:237 sysfs_remove_group+0x80/0x90 ... RIP: 0010:sysfs_remove_group+0x80/0x90 ... Call Trace: dpm_sysfs_remove+0x57/0x60 device_del+0xfd/0x350 device_unregister+0x1a/0x60 drm_sysfs_connector_remove+0x39/0x50 [drm] drm_connector_unregister+0x5a/0x70 [drm] drm_connector_unregister_all+0x45/0xa0 [drm] drm_modeset_unregister_all+0x12/0x30 [drm] drm_dev_unregister+0xca/0xe0 [drm] drm_put_dev+0x32/0x60 [drm] drm_release+0x2f3/0x380 [drm] __fput+0xdf/0x1e0 ... ---[ end trace ecfb91ac85688bbe ]--- BUG: unable to handle kernel NULL pointer dereference at 00000000000000a8 IP: down_write+0x1f/0x40 ... Call Trace: debugfs_remove_recursive+0x55/0x1b0 drm_debugfs_connector_remove+0x21/0x40 [drm] drm_connector_unregister+0x62/0x70 [drm] drm_connector_unregister_all+0x45/0xa0 [drm] drm_modeset_unregister_all+0x12/0x30 [drm] drm_dev_unregister+0xca/0xe0 [drm] drm_put_dev+0x32/0x60 [drm] drm_release+0x2f3/0x380 [drm] __fput+0xdf/0x1e0 ... ---[ end trace ecfb91ac85688bbf ]--- This is caused by the revert moving back to drm_unplug_dev calling drm_minor_unregister which does: device_del(minor->kdev); dev_set_drvdata(minor->kdev, NULL); /* safety belt */ drm_debugfs_cleanup(minor); Causing the sysfs entries to already be removed even though we still have references to them in e.g. drm_connector. Note we must call drm_minor_unregister to notify userspace of the unplug of the device, so calling drm_dev_unregister is not completely wrong the problem is that drm_dev_unregister does too much. This commit fixes drm_unplug_dev by not only reverting commit a39be606f99d ("drm: Do a full device unregister when unplugging") but by also adding a call to drm_modeset_unregister_all before the drm_minor_unregister calls to make sure all sysfs entries are removed before calling device_del(minor->kdev) thereby also fixing the second set of oopses caused by just reverting the commit. Fixes: a39be606f99d ("drm: Do a full device unregister when unplugging") Cc: stable@vger.kernel.org Cc: Chris Wilson Cc: Jeffy Cc: Marco Diego Aurélio Mesquita Reported-by: Marco Diego Aurélio Mesquita Signed-off-by: Hans de Goede Reviewed-by: Chris Wilson Signed-off-by: Sean Paul Link: http://patchwork.freedesktop.org/patch/msgid/20170601115430.4113-1-hdegoede@redhat.com drivers/gpu/drm/drm_drv.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 13fb6c2c7fe10ce39a5549c268e35341d83f2b3d Merge: ac2629a e165bc0 Author: David S. Miller Date: Fri Jun 2 10:37:11 2017 -0400 Merge tag 'mac80211-for-davem-2017-06-02' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== Just two fixes: * fix the per-CPU drop counters to not be added to the rx_packets counter, but really the drop counter * fix TX aggregation start/stop callback races by setting bits instead of allocating and queueing an skb ==================== Signed-off-by: David S. Miller commit ac2629a4797fdc839f7a4775cc141e6f53e064cf Author: Florian Fainelli Date: Thu Jun 1 19:53:04 2017 -0700 net: dsa: Move dsa_switch_{suspend,resume} out of legacy.c dsa_switch_suspend() and dsa_switch_resume() are functions that belong in net/dsa/dsa.c and are not part of the legacy platform support code. Fixes: a6a71f19fe5e ("net: dsa: isolate legacy code") Signed-off-by: Florian Fainelli Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller net/dsa/dsa.c | 47 +++++++++++++++++++++++++++++++++++++++++++++++ net/dsa/legacy.c | 47 ----------------------------------------------- 2 files changed, 47 insertions(+), 47 deletions(-) commit d31353cd753c443ace5723d6878a39f393a0c136 Author: Florian Fainelli Date: Thu Jun 1 18:02:39 2017 -0700 net: systemport: Fix missing Wake-on-LAN interrupt for SYSTEMPORT Lite On SYSTEMPORT Lite, since we have the main interrupt source in the first cell, the second cell is the Wake-on-LAN interrupt, yet the code was not properly updated to fetch the second cell, and instead looked at the third and non-existing cell for Wake-on-LAN. Fixes: 44a4524c54af ("net: systemport: Add support for SYSTEMPORT Lite") Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bcmsysport.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 918c7b062a0f9198d9503cfece0210c1743c0f88 Author: Andi Kleen Date: Mon May 22 18:00:16 2017 -0700 perf stat: Only print NMI watchdog hint when enabled Only print the NMI watchdog hint when that watchdog it actually enabled. This avoids printing these unnecessarily. Signed-off-by: Andi Kleen Acked-by: Jiri Olsa Link: http://lkml.kernel.org/n/tip-lnw7edxnqsphkmeew857wz1i@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-stat.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit cb7cf772d83d2d4e6995c5bb9e0fb59aea8f7080 Author: Lorenzo Pieralisi Date: Fri May 26 17:40:02 2017 +0100 ARM64/ACPI: Fix BAD_MADT_GICC_ENTRY() macro implementation The BAD_MADT_GICC_ENTRY() macro checks if a GICC MADT entry passes muster from an ACPI specification standpoint. Current macro detects the MADT GICC entry length through ACPI firmware version (it changed from 76 to 80 bytes in the transition from ACPI 5.1 to ACPI 6.0 specification) but always uses (erroneously) the ACPICA (latest) struct (ie struct acpi_madt_generic_interrupt - that is 80-bytes long) length to check if the current GICC entry memory record exceeds the MADT table end in memory as defined by the MADT table header itself, which may result in false negatives depending on the ACPI firmware version and how the MADT entries are laid out in memory (ie on ACPI 5.1 firmware MADT GICC entries are 76 bytes long, so by adding 80 to a GICC entry start address in memory the resulting address may well be past the actual MADT end, triggering a false negative). Fix the BAD_MADT_GICC_ENTRY() macro by reshuffling the condition checks and update them to always use the firmware version specific MADT GICC entry length in order to carry out boundary checks. Fixes: b6cfb277378e ("ACPI / ARM64: add BAD_MADT_GICC_ENTRY() macro") Reported-by: Julien Grall Acked-by: Will Deacon Acked-by: Marc Zyngier Signed-off-by: Lorenzo Pieralisi Cc: Julien Grall Cc: Hanjun Guo Cc: Al Stone Signed-off-by: Catalin Marinas arch/arm64/include/asm/acpi.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit e385050873d1e19e40481d8cd868c9f60ebe46ac Author: Harald Freudenberger Date: Wed May 24 10:26:29 2017 +0200 s390/zcrypt: Fix blocking queue device after unbind/bind. When the association between a queue device and the driver is released via unbind and later re-associated the queue device was not operational any more. Reason was a wrong administration of the card/queue lists within the ap device driver. This patch introduces revised card/queue list handling within the ap device driver: when an ap device is detected it is initial not added to the card/queue list any more. With driver probe the card device is added to the card list/the queue device is added to the queue list within a card. With driver remove the device is removed from the card/queue list. Additionally there are some situations within the ap device live where the lists need update upon card/queue device release (for example device hot unplug or suspend/resume). Signed-off-by: Harald Freudenberger Signed-off-by: Martin Schwidefsky drivers/s390/crypto/ap_bus.c | 38 ++++++++++++++++++++++++-------------- drivers/s390/crypto/ap_card.c | 9 ++++++++- drivers/s390/crypto/ap_queue.c | 9 ++++++++- 3 files changed, 40 insertions(+), 16 deletions(-) commit 715e944f8a7a1059db5d61ebf197e6f348d747e2 Author: Carlo Caione Date: Tue May 30 22:39:46 2017 +0200 HID: asus: Stop underlying hardware on remove We are missing a call to hid_hw_stop() on the remove hook. Among other things this is causing an Oops when (re-)starting GNOME / upowerd / ... after the module has been already rmmod-ed. Signed-off-by: Carlo Caione Reviewed-by: Benjamin Tissoires Signed-off-by: Jiri Kosina drivers/hid/hid-asus.c | 2 ++ 1 file changed, 2 insertions(+) commit afbbc7913a288c29616bd31ae612548f6475151a Author: Yoshihiro Shimoda Date: Wed Apr 26 20:50:10 2017 +0900 usb: gadget: udc: renesas_usb3: Fix PN_INT_ENA disabling timing The PN_INT_ENA register should be used after usb3_pn_change() is called. So, this patch moves the access from renesas_usb3_stop_controller() to usb3_disable_pipe_n(). Fixes: 746bfe63bba3 ("usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller") Signed-off-by: Yoshihiro Shimoda Signed-off-by: Felipe Balbi drivers/usb/gadget/udc/renesas_usb3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 940f538a100c84c6e72813e4ac88bd1753a86945 Author: Yoshihiro Shimoda Date: Wed Apr 26 20:50:09 2017 +0900 usb: gadget: udc: renesas_usb3: lock for PN_ registers access This controller disallows to change the PIPE until reading/writing a packet finishes. However. the previous code is not enough to hold the lock in some functions. So, this patch fixes it. Fixes: 746bfe63bba3 ("usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller") Signed-off-by: Yoshihiro Shimoda Signed-off-by: Felipe Balbi drivers/usb/gadget/udc/renesas_usb3.c | 28 +++++++++++++++++++++++++--- 1 file changed, 25 insertions(+), 3 deletions(-) commit 067d6fdc558d2c43f0bfdc7af99630dd5eb08dc5 Author: Yoshihiro Shimoda Date: Wed Apr 26 20:50:08 2017 +0900 usb: gadget: udc: renesas_usb3: fix deadlock by spinlock This patch fixes an issue that this driver is possible to cause deadlock by double-spinclocked in renesas_usb3_stop_controller(). So, this patch removes spinlock API calling in renesas_usb3_stop(). (In other words, the previous code had a redundant lock.) Fixes: 746bfe63bba3 ("usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller") Signed-off-by: Yoshihiro Shimoda Signed-off-by: Felipe Balbi drivers/usb/gadget/udc/renesas_usb3.c | 3 --- 1 file changed, 3 deletions(-) commit cdc876877ebc3f0677b267756d4564e2a429e730 Author: Yoshihiro Shimoda Date: Wed Apr 26 20:50:07 2017 +0900 usb: gadget: udc: renesas_usb3: fix pm_runtime functions calling This patch fixes an issue that this driver is possible to access the registers before pm_runtime_get_sync() if a gadget driver is installed first. After that, oops happens on R-Car Gen3 environment. To avoid it, this patch changes the pm_runtime call timing from probe/remove to udc_start/udc_stop. Fixes: 746bfe63bba3 ("usb: gadget: renesas_usb3: add support for Renesas USB3.0 peripheral controller") Signed-off-by: Yoshihiro Shimoda Signed-off-by: Felipe Balbi drivers/usb/gadget/udc/renesas_usb3.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit dc9217b69dd6089dcfeb86ed4b3c671504326087 Author: Thinh Nguyen Date: Thu May 11 17:26:48 2017 -0700 usb: gadget: f_mass_storage: Serialize wake and sleep execution f_mass_storage has a memorry barrier issue with the sleep and wake functions that can cause a deadlock. This results in intermittent hangs during MSC file transfer. The host will reset the device after receiving no response to resume the transfer. This issue is seen when dwc3 is processing 2 transfer-in-progress events at the same time, invoking completion handlers for CSW and CBW. Also this issue occurs depending on the system timing and latency. To increase the chance to hit this issue, you can force dwc3 driver to wait and process those 2 events at once by adding a small delay (~100us) in dwc3_check_event_buf() whenever the request is for CSW and read the event count again. Avoid debugging with printk and ftrace as extra delays and memory barrier will mask this issue. Scenario which can lead to failure: ----------------------------------- 1) The main thread sleeps and waits for the next command in get_next_command(). 2) bulk_in_complete() wakes up main thread for CSW. 3) bulk_out_complete() tries to wake up the running main thread for CBW. 4) thread_wakeup_needed is not loaded with correct value in sleep_thread(). 5) Main thread goes to sleep again. The pattern is shown below. Note the 2 critical variables. * common->thread_wakeup_needed * bh->state CPU 0 (sleep_thread) CPU 1 (wakeup_thread) ============================== =============================== bh->state = BH_STATE_FULL; smp_wmb(); thread_wakeup_needed = 0; thread_wakeup_needed = 1; smp_rmb(); if (bh->state != BH_STATE_FULL) sleep again ... As pointed out by Alan Stern, this is an R-pattern issue. The issue can be seen when there are two wakeups in quick succession. The thread_wakeup_needed can be overwritten in sleep_thread, and the read of the bh->state maybe reordered before the write to thread_wakeup_needed. This patch applies full memory barrier smp_mb() in both sleep_thread() and wakeup_thread() to ensure the order which the thread_wakeup_needed and bh->state are written and loaded. However, a better solution in the future would be to use wait_queue method that takes care of managing memory barrier between waker and waiter. Cc: Acked-by: Alan Stern Signed-off-by: Thinh Nguyen Signed-off-by: Felipe Balbi drivers/usb/gadget/function/f_mass_storage.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) commit 55b644fd2431cfd28d04cc28f092d49e7bea3433 Author: Martin Blumenstingl Date: Sat May 6 19:37:45 2017 +0200 usb: dwc2: add support for the DWC2 controller on Meson8 SoCs USB support in the Meson8 SoCs is provided by a DWC2 controller which works with the same settings as Meson8b and GXBB. Using the generic "snps,dwc2" binding results in an endless stream of "Overcurrent change detected" messages. Acked-by: Rob Herring Signed-off-by: Martin Blumenstingl Signed-off-by: Felipe Balbi Documentation/devicetree/bindings/usb/dwc2.txt | 1 + drivers/usb/dwc2/params.c | 2 ++ 2 files changed, 3 insertions(+) commit ebcdaee4cebb3a8d0d702ab5e9392373672ec1de Author: Jean-Philippe Brucker Date: Thu Jun 1 19:22:01 2017 +0100 dmaengine: pl330: fix warning in pl330_remove When removing a device with less than 9 IRQs (AMBA_NR_IRQS), we'll get a big WARN_ON from devres.c because pl330_remove calls devm_free_irqs for unallocated irqs. Similarly to pl330_probe, check that IRQ number is present before calling devm_free_irq. Signed-off-by: Jean-Philippe Brucker Signed-off-by: Vinod Koul drivers/dma/pl330.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit c4beedb8a914af9c8c1b6e67c753adf411e05160 Author: Andi Shyti Date: Thu Jun 1 22:05:40 2017 -0700 Input: tm2-touchkey - use LEN_ON as boolean value instead of LED_FULL Commit 4e552c8cb5bc ("leds: add LED_ON brightness as boolean value") has introduced the LED_ON enumeration value that can be used instead of LED_FULL which has more of a linear value. Because the tm2-touchscreen doesn't have brightness levels, but it's a simple on/off led, use LED_ON instead of LED_FULL. Signed-off-by: Andi Shyti Reviewed-by: Jaechul Lee Tested-by: Jaechul Lee Signed-off-by: Dmitry Torokhov drivers/input/keyboard/tm2-touchkey.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 28904eeced2c6cf6d315c675e79e1700ef7507ac Merge: 400129f b31e85e Author: Dave Airlie Date: Fri Jun 2 12:57:32 2017 +1000 Merge tag 'topic/dp-quirks-2017-05-31' of git://anongit.freedesktop.org/git/drm-intel into drm-fixes DP sink specific quirks * tag 'topic/dp-quirks-2017-05-31' of git://anongit.freedesktop.org/git/drm-intel: drm/i915: Detect USB-C specific dongles before reducing M and N drm/dp: start a DPCD based DP sink/branch device quirk database drm/i915: use drm DP helper to read DPCD desc drm/dp: add helper for reading DP sink/branch device desc from DPCD commit 243f6aa0090234f5d279060d0f8c2baf968f9de2 Merge: c883af2 f434b1c Author: Olof Johansson Date: Thu Jun 1 17:05:36 2017 -0700 Merge tag 'davinci-fixes-for-v4.12-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/nsekhar/linux-davinci into fixes A fix to MAINTAINERS file adding relevant device-tree files to mach-davinci entry. * tag 'davinci-fixes-for-v4.12-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/nsekhar/linux-davinci: MAINTAINERS: add device-tree files to TI DaVinci entry Signed-off-by: Olof Johansson commit c883af2f2bd1139f4d102cbebc3d66ea447ca08a Merge: 1ba2eaa 1cb0b57 Author: Olof Johansson Date: Thu Jun 1 16:59:55 2017 -0700 Merge tag 'mvebu-fixes-non-critical-4.12-1' of git://git.infradead.org/linux-mvebu into fixes mvebu non critical fixes for 4.12 Update MAINTAINER file for irqchip related drivers to Marvell EBU * tag 'mvebu-fixes-non-critical-4.12-1' of git://git.infradead.org/linux-mvebu: MAINTAINERS: add irqchip related drivers to Marvell EBU maintainers MAINTAINERS: sort F entries for Marvell EBU maintainers Signed-off-by: Olof Johansson commit 1ba2eaaacd2cb3e3e0d753d62dae515c6dec8035 Merge: 7306988 44f73dc Author: Olof Johansson Date: Thu Jun 1 16:56:06 2017 -0700 Merge tag 'mvebu-fixes-4.12-1' of git://git.infradead.org/linux-mvebu into fixes mvebu fixes for 4.12 Fix the interrupt description of the crypto node for device tree of the Armada 7K/8K SoCs * tag 'mvebu-fixes-4.12-1' of git://git.infradead.org/linux-mvebu: (316 commits) arm64: marvell: dts: fix interrupts in 7k/8k crypto nodes + Linux 4.12-rc2 Signed-off-by: Olof Johansson commit 73069883c017d454737d07a5aeab2b1639fcfeca Author: Patrice Chotard Date: Mon May 29 17:17:54 2017 +0200 MAINTAINERS: remove kernel@stlinux.com obsolete mailing list The STMicroelectronics dedicated mailing list kernel@stlinux.com is no more available, remove it to avoid bouncing mails. Several request to create a new mailing list has been send by Benjamin Gaignard and me but without any answers. Signed-off-by: Patrice Chotard Signed-off-by: Olof Johansson MAINTAINERS | 2 -- 1 file changed, 2 deletions(-) commit 84d40c0b73966a62c4d0f40288636a2f66cac3df Merge: da3d1d4 4497a22 Author: Olof Johansson Date: Thu Jun 1 16:54:14 2017 -0700 Merge tag 'reset-fixes-for-4.12' of git://git.pengutronix.de/git/pza/linux into fixes Reset controller fixes for v4.12 - Set hi6220_reset driver module license to GPL v2 to fix module loading. * tag 'reset-fixes-for-4.12' of git://git.pengutronix.de/git/pza/linux: reset: hi6220: Set module license so that it can be loaded Signed-off-by: Olof Johansson commit da3d1d4a4e6c554237466db060d53abbf0620605 Merge: cf5cde2 cc7a938 Author: Olof Johansson Date: Thu Jun 1 16:53:38 2017 -0700 Merge tag 'at91-4.12-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux into fixes Fixes for 4.12: Fix two compilation issues * tag 'at91-4.12-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: ARM: at91: select CONFIG_ARM_CPU_SUSPEND memory: atmel-ebi: mark PM ops as __maybe_unused Signed-off-by: Olof Johansson commit cf5cde2199058f1aed33f8b5f637c02a95936031 Author: Masahiro Yamada Date: Wed May 24 14:10:10 2017 +0900 ARM: dts: versatile: use #include "..." to include local DT Most of DT files in ARM use #include "..." to make pre-processor include DT in the same directory, but this is one of the exceptional files that use #include <...> for that. Fix it to remove -I$(srctree)/arch/$(SRCARCH)/boot/dts path from dtc_cpp_flags. ARM: dts: versatile: use #include "..." to include DT in the same directory Most of DT files in ARM use #include "..." to make pre-processor include DT in the same directory, but we have 3 exceptional files that use #include <...> for that. They must be fixed to remove -I$(srctree)/arch/$(SRCARCH)/boot/dts path from dtc_cpp_flags. Signed-off-by: Masahiro Yamada Signed-off-by: Olof Johansson arch/arm/boot/dts/versatile-pb.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3b1e342be265f7df915c68c7c6e450956d8865aa Merge: 2f48641 9a30740 Author: Linus Torvalds Date: Thu Jun 1 16:24:48 2017 -0700 Merge tag 'nfsd-4.12-1' of git://linux-nfs.org/~bfields/linux Pull nfsd fixes from Bruce Fields: "Revert patch accidentally included in the merge window pull request, and fix a crash that was likely a result of buggy client behavior" * tag 'nfsd-4.12-1' of git://linux-nfs.org/~bfields/linux: nfsd4: fix null dereference on replay nfsd: Revert "nfsd: check for oversized NFSv2/v3 arguments" commit 2f48641cfc83c3e1fdc81204382e05edf182691a Merge: 9ea15a5 243dd05 Author: Linus Torvalds Date: Thu Jun 1 16:17:42 2017 -0700 Merge tag 'gcc-plugins-v4.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull gcc-plugin prepwork from Kees Cook: "Use designated initializers for mtk-vcodec, powerplay, amdgpu, and sgi-xp. Use ERR_CAST() to avoid cross-structure cast in ocf2, ntfs, and NFS. Christoph Hellwig recommended that I send these fixes now, rather than waiting for the v4.13 merge window. These are all initializer and cast fixes needed for the future randstruct plugin that haven't been picked up by the respective maintainers" * tag 'gcc-plugins-v4.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: mtk-vcodec: Use designated initializers drm/amd/powerplay: Use designated initializers drm/amdgpu: Use designated initializers sgi-xp: Use designated initializers ocfs2: Use ERR_CAST() to avoid cross-structure cast ntfs: Use ERR_CAST() to avoid cross-structure cast NFS: Use ERR_CAST() to avoid cross-structure cast commit d3957b86a40612826ef935f474b31359d66cbdca Author: Majd Dibbiny Date: Sun May 21 19:09:54 2017 +0300 RDMA/SA: Fix kernel panic in CMA request handler flow Commit 9fdca4da4d8c (IB/SA: Split struct sa_path_rec based on IB and ROCE specific fields) moved the service_id to be specific attribute for IB and OPA SA Path Record, and thus wasn't assigned for RoCE. This caused to the following kernel panic in the CMA request handler flow: [ 27.074594] BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 [ 27.074731] IP: __radix_tree_lookup+0x1d/0xe0 ... [ 27.075356] Workqueue: ib_cm cm_work_handler [ib_cm] [ 27.075401] task: ffff88022e3b8000 task.stack: ffffc90001298000 [ 27.075449] RIP: 0010:__radix_tree_lookup+0x1d/0xe0 ... [ 27.075979] Call Trace: [ 27.076015] radix_tree_lookup+0xd/0x10 [ 27.076055] cma_ps_find+0x59/0x70 [rdma_cm] [ 27.076097] cma_id_from_event+0xd2/0x470 [rdma_cm] [ 27.076144] ? ib_init_ah_from_path+0x39a/0x590 [ib_core] [ 27.076193] cma_req_handler+0x25/0x480 [rdma_cm] [ 27.076237] cm_process_work+0x25/0x120 [ib_cm] [ 27.076280] ? cm_get_bth_pkey.isra.62+0x3c/0xa0 [ib_cm] [ 27.076350] cm_req_handler+0xb03/0xd40 [ib_cm] [ 27.076430] ? sched_clock_cpu+0x11/0xb0 [ 27.076478] cm_work_handler+0x194/0x1588 [ib_cm] [ 27.076525] process_one_work+0x160/0x410 [ 27.076565] worker_thread+0x137/0x4a0 [ 27.076614] kthread+0x112/0x150 [ 27.076684] ? max_active_store+0x60/0x60 [ 27.077642] ? kthread_park+0x90/0x90 [ 27.078530] ret_from_fork+0x2c/0x40 This patch moves it back to the common SA Path Record structure and removes the redundant setter and getter. Tested on Connect-IB and Connect-X4 in Infiniband and RoCE respectively. Fixes: 9fdca4da4d8c (IB/SA: Split struct sa_path_rec based on IB ands ROCE specific fields) Signed-off-by: Majd Dibbiny Reviewed-by: Parav Pandit Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/core/cm.c | 4 ++-- drivers/infiniband/core/cma.c | 13 ++++++------- drivers/infiniband/core/sa_query.c | 6 +++--- drivers/infiniband/ulp/srp/ib_srp.c | 2 +- include/rdma/ib_sa.h | 25 +++---------------------- 5 files changed, 15 insertions(+), 35 deletions(-) commit 79bb5b7ee1776a244484a1be6671d89fbd7c0c9f Author: Leon Romanovsky Date: Sun May 21 19:08:09 2017 +0300 RDMA/umem: Fix missing mmap_sem in get umem ODP call Add mmap_sem lock around VMA inspection in ib_umem_odp_get(). Fixes: 0008b84ea9af ('IB/umem: Add support to huge ODP') Signed-off-by: Artemy Kovalyov Reviewed-by: Eli Cohen Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/core/umem_odp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 53376fedb9da54c0d3b0bd3a6edcbeb681692909 Author: Qing Huang Date: Thu May 18 16:33:53 2017 -0700 RDMA/core: not to set page dirty bit if it's already set. This change will optimize kernel memory deregistration operations. __ib_umem_release() used to call set_page_dirty_lock() against every writable page in its memory region. Its purpose is to keep data synced between CPU and DMA device when swapping happens after mem deregistration ops. Now we choose not to set page dirty bit if it's already set by kernel prior to calling __ib_umem_release(). This reduces memory deregistration time by half or even more when we ran application simulation test program. Signed-off-by: Qing Huang Signed-off-by: Doug Ledford drivers/infiniband/core/umem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f937d93a9122d1510ca6e4bb8d860aedcf9408c3 Author: Leon Romanovsky Date: Thu May 18 07:40:33 2017 +0300 RDMA/uverbs: Declare local function static and add brackets to sizeof Commit 57520751445b ("IB/SA: Add OPA path record type") introduced new local function __ib_copy_path_rec_to_user, but didn't limit its scope. This produces the following sparse warning: drivers/infiniband/core/uverbs_marshall.c:99:6: warning: symbol '__ib_copy_path_rec_to_user' was not declared. Should it be static? In addition, it used sizeof ... notations instead of sizeof(...), which is correct in C, but a little bit misleading. Let's change it too. Fixes: 57520751445b ("IB/SA: Add OPA path record type") Reviewed-by: Yuval Shaia Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/core/uverbs_marshall.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 233c1955835bd8649003be9bb3d8e79788b08be1 Author: Leon Romanovsky Date: Sun May 14 15:49:57 2017 +0300 RDMA/netlink: Reduce exposure of RDMA netlink functions RDMA netlink is part of ib_core, hence ibnl_chk_listeners(), ibnl_init() and ibnl_cleanup() don't need to be published in public header file. Let's remove EXPORT_SYMBOL from ibnl_chk_listeners() and move all these functions to private header file. CC: Yuval Shaia Signed-off-by: Leon Romanovsky Reviewed-by: Yuval Shaia Signed-off-by: Doug Ledford drivers/infiniband/core/core_priv.h | 10 ++++++++++ drivers/infiniband/core/netlink.c | 2 +- include/rdma/rdma_netlink.h | 10 ---------- 3 files changed, 11 insertions(+), 11 deletions(-) commit 95c2ef50c726a51d580c35ae8dccd383abaa8701 Author: Israel Rukshin Date: Thu May 11 18:52:36 2017 +0300 RDMA/srp: Fix NULL deref at srp_destroy_qp() If srp_init_qp() fails at srp_create_ch_ib() then ch->send_cq may be NULL. Calling directly to ib_destroy_qp() is sufficient because no work requests were posted on the created qp. Fixes: 9294000d6d89 ("IB/srp: Drain the send queue before destroying a QP") Cc: Signed-off-by: Israel Rukshin Reviewed-by: Max Gurtovoy Reviewed-by: Bart van Assche -- Signed-off-by: Doug Ledford drivers/infiniband/ulp/srp/ib_srp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0a1a972630c77edb39adf310699e404b8bf9176e Author: Leon Romanovsky Date: Sun May 14 13:32:06 2017 +0300 RDMA/IPoIB: Limit the ipoib_dev_uninit_default scope ipoib_dev_uninit_default() call is used in ipoib_main.c file only and it generates the following warning from smatch tool: drivers/infiniband/ulp/ipoib/ipoib_main.c:1593:6: warning: symbol 'ipoib_dev_uninit_default' was not declared. Should it be static? so let's declare that function as static. Signed-off-by: Leon Romanovsky Reviewed-by: Yuval Shaia Signed-off-by: Doug Ledford drivers/infiniband/ulp/ipoib/ipoib_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8c490669deb0133dfb6bfe7a80d7cfef3bbbd92f Author: Honggang Li Date: Thu May 11 20:14:28 2017 +0800 RDMA/IPoIB: Replace netdev_priv with ipoib_priv for ipoib_get_link_ksettings ipoib_dev_init accesses the wrong private data for the IPoIB device. Commit cd565b4b51e5 (IB/IPoIB: Support acceleration options callbacks) changed ipoib_priv from being identical to netdev_priv to being an area inside of, but not the same pointer as, the netdev_priv pointer. As such, the struct we want is the ipoib_priv area, not the netdev_priv area, so use the right accessor, otherwise we kernel panic. [ 27.271938] IPv6: ADDRCONF(NETDEV_CHANGE): mlx5_ib0.8006: link becomes ready [ 28.156790] BUG: unable to handle kernel NULL pointer dereference at 000000000000067c [ 28.166309] IP: ib_query_port+0x30/0x180 [ib_core] ... [ 28.306282] RIP: 0010:ib_query_port+0x30/0x180 [ib_core] ... [ 28.393337] Call Trace: [ 28.397594] ipoib_get_link_ksettings+0x66/0xe0 [ib_ipoib] [ 28.405274] __ethtool_get_link_ksettings+0xa0/0x1c0 [ 28.412353] speed_show+0x74/0xa0 [ 28.417503] dev_attr_show+0x20/0x50 [ 28.422922] ? mutex_lock+0x12/0x40 [ 28.428179] sysfs_kf_seq_show+0xbf/0x1a0 [ 28.434002] kernfs_seq_show+0x21/0x30 [ 28.439470] seq_read+0x116/0x3b0 [ 28.444445] ? do_filp_open+0xa5/0x100 [ 28.449774] kernfs_fop_read+0xff/0x180 [ 28.455220] __vfs_read+0x37/0x150 [ 28.460167] ? security_file_permission+0x9d/0xc0 [ 28.466560] vfs_read+0x8c/0x130 [ 28.471318] SyS_read+0x55/0xc0 [ 28.475950] do_syscall_64+0x67/0x150 [ 28.481163] entry_SYSCALL64_slow_path+0x25/0x25 ... [ 28.584493] ---[ end trace 3549968a4bf0aa5d ]--- Fixes: cd565b4b51e5 (IB/IPoIB: Support acceleration options callbacks) Fixes: 0d7e2d2166f6 (IB/ipoib: add get_link_ksettings in ethtool) Signed-off-by: Honggang Li Reviewed-by: Yuval Shaia Reviewed-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/ulp/ipoib/ipoib_ethtool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d38d7fdafaf89d1756f27e9b4054dd19a1d2f545 Author: Gustavo A. R. Silva Date: Mon May 22 13:30:15 2017 -0500 RDMA/qedr: add null check before pointer dereference Add null check before dereferencing pointer sgid_attr.ndev inside function rdma_vlan_dev_vlan_id(). Addresses-Coverity-ID: 1373979 Signed-off-by: Gustavo A. R. Silva Acked-by: Ram Amrani Signed-off-by: Doug Ledford drivers/infiniband/hw/qedr/qedr_cm.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit 6e8484c5cf07c7ee632587e98c1a12d319dacb7c Author: Max Gurtovoy Date: Sun May 28 10:53:11 2017 +0300 RDMA/mlx5: set UMR wqe fence according to HCA cap Cache the needed umr_fence and set the wqe ctrl segmennt accordingly. Signed-off-by: Max Gurtovoy Acked-by: Leon Romanovsky Reviewed-by: Sagi Grimberg Signed-off-by: Doug Ledford drivers/infiniband/hw/mlx5/main.c | 14 +++++++++ drivers/infiniband/hw/mlx5/mlx5_ib.h | 3 +- drivers/infiniband/hw/mlx5/qp.c | 59 ++++++++++++++---------------------- 3 files changed, 39 insertions(+), 37 deletions(-) commit 1410a90ae449061b7e1ae19d275148f36948801b Author: Max Gurtovoy Date: Sun May 28 10:53:10 2017 +0300 net/mlx5: Define interface bits for fencing UMR wqe HW can implement UMR wqe re-transmission in various ways. Thus, add HCA cap to distinguish the needed fence for UMR to make sure that the wqe wouldn't fail on mkey checks. Signed-off-by: Max Gurtovoy Acked-by: Leon Romanovsky Reviewed-by: Christoph Hellwig Signed-off-by: Doug Ledford include/linux/mlx5/mlx5_ifc.h | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) commit eed7624552ca55c346a4e9ccaa9ab0723841aee6 Author: Jack Morgenstein Date: Sun May 21 19:11:13 2017 +0300 RDMA/mlx4: Fix MAD tunneling when SRIOV is enabled The cited patch added a type field to structures ib_ah and rdma_ah_attr. Function mlx4_ib_query_ah() builds an rdma_ah_attr structure from the data in an mlx4_ib_ah structure (which contains both an ib_ah structure and an address vector). For mlx4_ib_query_ah() to work properly, the type field in the contained ib_ah structure must be set correctly. In the outgoing MAD tunneling flow, procedure mlx4_ib_multiplex_mad() paravirtualizes a MAD received from a slave and sends the processed mad out over the wire. During this processing, it populates an mlx4_ib_ah structure and calls mlx4_ib_query_ah(). The cited commit overlooked setting the type field in the contained ib_ah structure before invoking mlx4_ib_query_ah(). As a result, the type field remained uninitialized, and the rdma_ah_attr structure was incorrectly built. This resulted in improperly built MADs being sent out over the wire. This patch properly initializes the type field in the contained ib_ah structure before calling mlx4_ib_query_ah(). The rdma_ah_attr structure is then generated correctly. Fixes: 44c58487d51a ("IB/core: Define 'ib' and 'roce' rdma_ah_attr types") Signed-off-by: Jack Morgenstein Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/hw/mlx4/mad.c | 1 + 1 file changed, 1 insertion(+) commit 1feb40067cf04ae48d65f728d62ca255c9449178 Author: Mike Marciniszyn Date: Fri May 12 09:02:00 2017 -0700 RDMA/qib,hfi1: Fix MR reference count leak on write with immediate The handling of IB_RDMA_WRITE_ONLY_WITH_IMMEDIATE will leak a memory reference when a buffer cannot be allocated for returning the immediate data. The issue is that the rkey validation has already occurred and the RNR nak fails to release the reference that was fruitlessly gotten. The the peer will send the identical single packet request when its RNR timer pops. The fix is to release the held reference prior to the rnr nak exit. This is the only sequence the requires both rkey validation and the buffer allocation on the same packet. Cc: Stable # 4.7+ Tested-by: Tadeusz Struk Reviewed-by: Dennis Dalessandro Signed-off-by: Mike Marciniszyn Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/rc.c | 5 ++++- drivers/infiniband/hw/qib/qib_rc.c | 4 +++- 2 files changed, 7 insertions(+), 2 deletions(-) commit b3e6b4bdbb609762d8401ac4a959d590b4e4e3b8 Author: Byczkowski, Jakub Date: Fri May 12 09:01:37 2017 -0700 RDMA/hfi1: Defer setting VL15 credits to link-up interrupt Keep VL15 credits at 0 during LNI, before link-up. Store VL15 credits value during verify cap interrupt and set in after link-up. This addresses an issue where VL15 MAD packets could be sent by one side of the link before the other side is ready to receive them. Reviewed-by: Mike Marciniszyn Reviewed-by: Dean Luick Reviewed-by: Dennis Dalessandro Signed-off-by: Jakub Byczkowski Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/chip.c | 67 +++++++++++++++++++++-------- drivers/infiniband/hw/hfi1/chip_registers.h | 2 + drivers/infiniband/hw/hfi1/hfi.h | 11 ++++- drivers/infiniband/hw/hfi1/intr.c | 3 +- 4 files changed, 64 insertions(+), 19 deletions(-) commit e4785b0633574a607daaa04bf2fe43550055194f Author: Steven L. Roberts Date: Wed May 10 14:58:13 2017 -0500 RDMA/hfi1: change PCI bar addr assignments to Linux API functions The Omni-Path adapter driver fails to load on the ppc64le platform due to invalid PCI setup. This patch makes the PCI configuration more robust and will fix 64 bit addressing for ppc64le. Signed-off-by: Steven L Roberts Acked-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/pcie.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit c4dd4b69f55abcc8dd079f8de55d9d8c2ddbefce Author: Steven L. Roberts Date: Wed May 10 10:54:12 2017 -0500 RDMA/hfi1: fix array termination by appending NULL to attr array This fixes a kernel panic when loading the hfi driver as a dynamic module. Signed-off-by: Steven L Roberts Reviewed-by: Leon Romanovsky Acked-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/sysfs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 98b80a2a73a26f0e259632da519ccedb0cf37617 Author: Raju Rangoju Date: Wed May 31 12:06:58 2017 +0530 RDMA/iw_cxgb4: fix the calculation of ipv6 header size Take care of ipv6 checks while computing header length for deducing mtu size of ipv6 servers. Due to the incorrect header length computation for ipv6 servers, wrong mss is reported to the peer (client). Signed-off-by: Raju Rangoju Signed-off-by: Ganesh Goudar Acked-by: Steve Wise Signed-off-by: Doug Ledford drivers/infiniband/hw/cxgb4/cm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 4bbfabede50849f87b913a1fc07c02ecc96b6c57 Author: Ganesh Goudar Date: Fri May 19 14:48:42 2017 +0530 RDMA/iw_cxgb4: calculate t4_eq_status_entries properly use egrstatuspagesize to calculate t4_eq_status_entries. Fixes: bb58d07964f2 ("cxgb4: Update IngPad and IngPack values") Reported-by: Logan Gunthorpe Signed-off-by: Potnuri Bharat Teja Signed-off-by: Ganesh Goudar Acked-by: Steve Wise Signed-off-by: Doug Ledford drivers/infiniband/hw/cxgb4/device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1dad0ebeea1cd890b8892523f736916e245b0aef Author: Raju Rangoju Date: Mon May 15 06:40:39 2017 +0000 RDMA/iw_cxgb4: Avoid touch after free error in ARP failure handlers The patch 761e19a504af (RDMA/iw_cxgb4: Handle return value of c4iw_ofld_send() in abort_arp_failure()) from May 6, 2016 leads to the following static checker warning: drivers/infiniband/hw/cxgb4/cm.c:575 abort_arp_failure() warn: passing freed memory 'skb' Also fixes skb leak when l2t resolution fails Fixes: 761e19a504afa55 (RDMA/iw_cxgb4: Handle return value of c4iw_ofld_send() in abort_arp_failure()) Reported-by: Dan Carpenter Cc: Dan Carpenter Signed-off-by: Raju Rangoju Reviewed-by: Steve Wise Signed-off-by: Doug Ledford drivers/infiniband/hw/cxgb4/cm.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit f863de7de34025ee536cb3cc382bfc3cafaa9f0a Author: Tatyana Nikolova Date: Wed May 10 16:46:40 2017 -0500 RDMA/nes: ACK MPA Reply frame Explicitly ACK the MPA Reply frame so the peer does not retransmit the frame. Signed-off-by: Tatyana Nikolova Signed-off-by: Doug Ledford drivers/infiniband/hw/nes/nes_cm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0e5fc903513a652a2cf890a3d3b91c1779e16e97 Author: Tatyana Nikolova Date: Wed May 10 16:46:39 2017 -0500 RDMA/nes: Don't set 0-length FULPDU RTR indication control flag Don't set control flag for 0-length FULPDU (Send) RTR indication in the enhanced MPA Request/Reply frames, because it isn't supported. Signed-off-by: Tatyana Nikolova Signed-off-by: Doug Ledford drivers/infiniband/hw/nes/nes_cm.c | 1 - 1 file changed, 1 deletion(-) commit e80bd98d1ff011beec872a8ebbb73930507d6a13 Author: Gustavo A. R. Silva Date: Thu May 18 13:11:17 2017 -0500 RDMA/i40iw: fix duplicated code for different branches Refactor code to avoid identical code for different branches. Addresses-Coverity-ID: 1357356 Reviewed-by: Yuval Shaia Signed-off-by: Gustavo A. R. Silva Acked-by: Shiraz Saleem Signed-off-by: Doug Ledford drivers/infiniband/hw/i40iw/i40iw_virtchnl.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) commit f300ba2d1ef1cb8411daa5e1ae44acfa7b88236c Author: Shiraz Saleem Date: Fri May 19 16:14:02 2017 -0500 RDMA/i40iw: Remove MSS change support MSS change on active QPs is not supported. Store new MSS value for new QPs only. Remove code to modify MSS on the fly. This also resolves a crash on QP modify to QP 0. BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 IP: i40iw_sc_qp_modify+0x22/0x280 [i40iw] Oops: 0000 [#1] SMP KASAN CPU: 2 PID: 1236 Comm: kworker/u16:4 Not tainted 4.12.0-rc1 #5 Hardware name: Gigabyte Technology Co., Ltd. To be filled by O.E.M./Q87M-D2H, BIOS F7 01/17/2014 Workqueue: l2params i40iw_l2params_worker [i40iw] task: ffff88070f5a9b40 task.stack: ffff88070f5a0000 RIP: 0010:i40iw_sc_qp_modify+0x22/0x280 [i40iw] ... Call Trace: i40iw_exec_cqp_cmd+0x2ce/0x410 [i40iw] ? _raw_spin_lock_irqsave+0x6f/0x80 ? i40iw_process_cqp_cmd+0x1d/0x80 [i40iw] i40iw_process_cqp_cmd+0x7c/0x80 [i40iw] i40iw_handle_cqp_op+0x2f/0x200 [i40iw] ? trace_hardirqs_off+0xd/0x10 ? _raw_spin_unlock_irqrestore+0x46/0x50 i40iw_hw_modify_qp+0x5e/0x90 [i40iw] i40iw_qp_mss_modify+0x52/0x60 [i40iw] i40iw_change_l2params+0x145/0x160 [i40iw] i40iw_l2params_worker+0x1f/0x40 [i40iw] process_one_work+0x1f5/0x650 ? process_one_work+0x161/0x650 worker_thread+0x48/0x3b0 kthread+0x112/0x150 ? process_one_work+0x650/0x650 ? kthread_create_on_node+0x40/0x40 ret_from_fork+0x2e/0x40 Code: 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 56 41 55 41 89 cd 41 54 49 89 fc 53 48 89 f3 48 89 d6 48 83 ec 08 48 8b 87 10 01 00 00 <48> 8b 40 08 4c 8b b0 40 04 00 00 4c 89 f7 e8 1b e5 ff ff 48 85 RIP: i40iw_sc_qp_modify+0x22/0x280 [i40iw] RSP: ffff88070f5a7c28 CR2: 0000000000000008 ---[ end trace 77a405931e296060 ]--- Reported-by: Stefan Assmann Signed-off-by: Shiraz Saleem Signed-off-by: Doug Ledford drivers/infiniband/hw/i40iw/i40iw_ctrl.c | 12 +----------- drivers/infiniband/hw/i40iw/i40iw_osdep.h | 1 - drivers/infiniband/hw/i40iw/i40iw_type.h | 2 -- drivers/infiniband/hw/i40iw/i40iw_utils.c | 17 ----------------- 4 files changed, 1 insertion(+), 31 deletions(-) commit c0c643e16f9b00332cbbf3954556652dfa4ed5a3 Author: Mustafa Ismail Date: Wed May 10 23:32:14 2017 -0500 RDMA/i40iw: Fix device initialization error path Some error paths in i40iw_initialize_dev are doing additional and unnecessary work before exiting. Correctly free resources allocated prior to error and return with correct status code. Signed-off-by: Mustafa Ismail Signed-off-by: Henry Orosco Signed-off-by: Doug Ledford drivers/infiniband/hw/i40iw/i40iw_main.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) commit b117f4796306a750ec1ffb928acc5f55bdb1fc7b Author: Tatyana Nikolova Date: Fri May 5 12:05:17 2017 -0500 RDMA/i40iw: ACK MPA Reject frame Explicitly ACK the MPA Reject frame so the peer does not retransmit the frame. Signed-off-by: Tatyana Nikolova Signed-off-by: Henry Orosco Signed-off-by: Doug Ledford drivers/infiniband/hw/i40iw/i40iw_cm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5a27fec21b70c2c41efbfe30a0fbb0f005b9f7e5 Author: Tatyana Nikolova Date: Fri May 5 12:05:16 2017 -0500 RDMA/i40iw: Don't set 0-length FULPDU RTR indication control flag Don't set control flag for 0-length FULPDU (Send) RTR indication in the enhanced MPA Request/Reply frames, because it isn't supported. Signed-off-by: Tatyana Nikolova Signed-off-by: Henry Orosco Signed-off-by: Doug Ledford drivers/infiniband/hw/i40iw/i40iw_cm.c | 1 - 1 file changed, 1 deletion(-) commit e165bc02a02c70e40d5c811c705ba269aeca0497 Author: Johannes Berg Date: Thu Jun 1 21:26:03 2017 +0200 mac80211: fix dropped counter in multiqueue RX In the commit enabling per-CPU station statistics, I inadvertedly copy-pasted some code to update rx_packets and forgot to change it to update rx_dropped_misc. Fix that. This addresses https://bugzilla.kernel.org/show_bug.cgi?id=195953. Fixes: c9c5962b56c1 ("mac80211: enable collecting station statistics per-CPU") Reported-by: Petru-Florin Mihancea Signed-off-by: Johannes Berg net/mac80211/sta_info.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b425e50492583b10cceb388af36ef0bd3bdf842a Author: Bart Van Assche Date: Wed May 31 14:43:45 2017 -0700 block: Avoid that blk_exit_rl() triggers a use-after-free Since the introduction of .init_rq_fn() and .exit_rq_fn() it is essential that the memory allocated for struct request_queue stays around until all blk_exit_rl() calls have finished. Hence make blk_init_rl() take a reference on struct request_queue. This patch fixes the following crash: general protection fault: 0000 [#2] SMP CPU: 3 PID: 28 Comm: ksoftirqd/3 Tainted: G D 4.12.0-rc2-dbg+ #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.0.0-prebuilt.qemu-project.org 04/01/2014 task: ffff88013a108040 task.stack: ffffc9000071c000 RIP: 0010:free_request_size+0x1a/0x30 RSP: 0018:ffffc9000071fd38 EFLAGS: 00010202 RAX: 6b6b6b6b6b6b6b6b RBX: ffff880067362a88 RCX: 0000000000000003 RDX: ffff880067464178 RSI: ffff880067362a88 RDI: ffff880135ea4418 RBP: ffffc9000071fd40 R08: 0000000000000000 R09: 0000000100180009 R10: ffffc9000071fd38 R11: ffffffff81110800 R12: ffff88006752d3d8 R13: ffff88006752d3d8 R14: ffff88013a108040 R15: 000000000000000a FS: 0000000000000000(0000) GS:ffff88013fd80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa8ec1edb00 CR3: 0000000138ee8000 CR4: 00000000001406e0 Call Trace: mempool_destroy.part.10+0x21/0x40 mempool_destroy+0xe/0x10 blk_exit_rl+0x12/0x20 blkg_free+0x4d/0xa0 __blkg_release_rcu+0x59/0x170 rcu_process_callbacks+0x260/0x4e0 __do_softirq+0x116/0x250 smpboot_thread_fn+0x123/0x1e0 kthread+0x109/0x140 ret_from_fork+0x31/0x40 Fixes: commit e9c787e65c0c ("scsi: allocate scsi_cmnd structures as part of struct request") Signed-off-by: Bart Van Assche Acked-by: Tejun Heo Reviewed-by: Hannes Reinecke Reviewed-by: Christoph Hellwig Cc: Jan Kara Cc: # v4.11+ Signed-off-by: Jens Axboe block/blk-cgroup.c | 2 +- block/blk-core.c | 10 ++++++++-- block/blk-sysfs.c | 2 +- block/blk.h | 2 +- 4 files changed, 11 insertions(+), 5 deletions(-) commit 58a6960663a112b97ccfcf0814b489f8ac0cdf9a Merge: 93818da 79e498a Author: David S. Miller Date: Thu Jun 1 15:02:31 2017 -0400 Merge branch 'ARM-imx6ul-14x14-evk-Fix-suspend-over-nfs-by-phy' Leonard Crestez says: ==================== ARM: imx6ul-14x14-evk: Fix suspend over nfs by phy Right now attempting doing suspend/resume while root is mounted over NFS hangs on imx6ul-14x14-evk. This is happening because ksz8081 phy fixups are lost on resume. Fix this by using equivalent devicetree properties instead of a phy fixup and handling those properties on resume in the micrel driver. In theory it might now be possible to remove the phy fixup from mach-imx6ul entirely but it is possible that this would break other imx6ul boards which use the same phy. The solution would be to patch their dts but it's not clear how to identify affected boards. This code is shared with imx6ull-14x14-evk but 6ull suspend needs an unrelated patch: https://lkml.org/lkml/2017/5/30/584 This is something of a corner case so there is no CC: stable. Changes since v1: https://lkml.org/lkml/2017/5/30/672 * Split a kszphy_config_reset function for stuff shared between config_init and resume. Calling config_init directly could be an option but on some HW variants it does extra stuff like parsing devicetree options. That would not be appropriate for resume code. ==================== Signed-off-by: David S. Miller commit 79e498a9c7da0737829ff864aae44df434105676 Author: Leonard Crestez Date: Wed May 31 13:29:30 2017 +0300 net: phy: micrel: Restore led_mode and clk_sel on resume These bits seem to be lost after a suspend/resume cycle so just set them again. Do this by splitting the handling of these bits into a function that is also called on resume. This patch fixes ethernet suspend/resume on imx6ul-14x14-evk boards. Signed-off-by: Leonard Crestez Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/phy/micrel.c | 42 ++++++++++++++++++++++++++++-------------- 1 file changed, 28 insertions(+), 14 deletions(-) commit e6f4292ae0a1e73fae26ced57de13a48f71ad1fa Author: Leonard Crestez Date: Wed May 31 13:29:29 2017 +0300 ARM: dts: imx6ul-14x14-evk: Add ksz8081 phy properties Right now mach-imx6ul registers a fixup for the ksz8081 phy. The same register values can be set through the micrel phy driver by using dts properties. This seems preferable and allows cleanly fixing suspend/resume. Signed-off-by: Leonard Crestez Reviewed-by: Fabio Estevam Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller arch/arm/boot/dts/imx6ul-14x14-evk.dts | 6 ++++++ 1 file changed, 6 insertions(+) commit 93818da5eed63fbc17b64080406ea53b86b23309 Author: Jia-Ju Bai Date: Wed May 31 15:08:25 2017 +0800 mISDN: Fix a sleep-in-atomic bug The driver may sleep under a read spin lock, and the function call path is: send_socklist (acquire the lock by read_lock) skb_copy(GFP_KERNEL) --> may sleep To fix it, the "GFP_KERNEL" is replaced with "GFP_ATOMIC". Signed-off-by: Jia-Ju Bai Signed-off-by: David S. Miller drivers/isdn/mISDN/stack.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 35cf2845563c1aaa01d27bd34d64795c4ae72700 Author: Lance Richardson Date: Mon May 29 13:25:57 2017 -0400 vxlan: eliminate cached dst leak After commit 0c1d70af924b ("net: use dst_cache for vxlan device"), cached dst entries could be leaked when more than one remote was present for a given vxlan_fdb entry, causing subsequent netns operations to block indefinitely and "unregister_netdevice: waiting for lo to become free." messages to appear in the kernel log. Fix by properly releasing cached dst and freeing resources in this case. Fixes: 0c1d70af924b ("net: use dst_cache for vxlan device") Signed-off-by: Lance Richardson Acked-by: Paolo Abeni Signed-off-by: David S. Miller drivers/net/vxlan.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) commit 05e97a9eda72d58dba293857df6aac62584ef99a Merge: 2ea659a d4ed3b9 Author: Brian Norris Date: Thu Jun 1 10:53:55 2017 -0700 Merge tag 'nand/fixes-for-4.12-rc3' of git://git.infradead.org/linux-mtd into MTD From Boris: """ This pull request contains several fixes to the core and the tango driver. tango fixes: * Add missing MODULE_DEVICE_TABLE() in tango_nand.c * Update the number of corrected bitflips core fixes: * Fix a long standing memory leak in nand_scan_tail() * Fix several bugs introduced by the per-vendor init/detection infrastructure (introduced in 4.12) * Add a static specifier to nand_ooblayout_lp_hamming_ops definition """ commit b13bbeee5ee606cfb57ddcf47e66802f9aa7273e Author: Kim Phillips Date: Thu Jun 1 09:29:59 2017 -0500 perf annotate: Fix branch instruction with multiple operands 'perf annotate' is dropping the cr* fields from branch instructions. Fix it by adding support to display branch instructions having multiple operands. Power Arch objdump of int_sqrt: 20.36 | c0000000004d2694: subf r10,r10,r3 | c0000000004d2698: v bgt cr6,c0000000004d26a0 1.82 | c0000000004d269c: mr r3,r10 29.18 | c0000000004d26a0: mr r10,r8 | c0000000004d26a4: v bgt cr7,c0000000004d26ac | c0000000004d26a8: mr r10,r7 Power Arch Before Patch: 20.36 | subf r10,r10,r3 | v bgt 40 1.82 | mr r3,r10 29.18 | 40: mr r10,r8 | v bgt 4c | mr r10,r7 Power Arch After patch: 20.36 | subf r10,r10,r3 | v bgt cr6,40 1.82 | mr r3,r10 29.18 | 40: mr r10,r8 | v bgt cr7,4c | mr r10,r7 Also support AArch64 conditional branch instructions, which can have up to three operands: Aarch64 Non-simplified (raw objdump) view: │ffff0000083cd11c: ↑ cbz w0, ffff0000083cd100 Tested-by: Ravi Bangoria Reported-by: Anton Blanchard Reported-by: Robin Murphy Signed-off-by: Kim Phillips Cc: Alexander Shishkin Cc: Christian Borntraeger Cc: Mark Rutland Cc: Peter Zijlstra Cc: Taeung Song Link: http://lkml.kernel.org/r/20170601092959.f60d98912e8a1b66fd1e4c0e@arm.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/annotate.c | 33 ++++++++++++++++++++++++++++++--- 1 file changed, 30 insertions(+), 3 deletions(-) commit 9ea15a59c39d6395160274d8829bb8b7e185dd56 Merge: 0bb2303 47a66ee Author: Linus Torvalds Date: Thu Jun 1 10:48:09 2017 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM fixes from Paolo Bonzini: "Many small x86 bug fixes: SVM segment registers access rights, nested VMX, preempt notifiers, LAPIC virtual wire mode, NMI injection" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: x86: Fix nmi injection failure when vcpu got blocked KVM: SVM: do not zero out segment attributes if segment is unusable or not present KVM: SVM: ignore type when setting segment registers KVM: nVMX: fix nested_vmx_check_vmptr failure paths under debugging KVM: x86: Fix virtual wire mode KVM: nVMX: Fix handling of lmsw instruction KVM: X86: Fix preempt the preemption timer cancel commit 0bb230399fd337cc9a838d47a0c9ec3433aa612e Merge: 393bcfa d8747d6 Author: Linus Torvalds Date: Thu Jun 1 10:45:27 2017 -0700 Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull Reiserfs and GFS2 fixes from Jan Kara: "Fixes to GFS2 & Reiserfs for the fallout of the recent WRITE_FUA cleanup from Christoph. Fixes for other filesystems were already merged by respective maintainers." * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: reiserfs: Make flush bios explicitely sync gfs2: Make flush bios explicitely sync commit 393bcfaeb8be7f46a4cd7d673e33541ebee76b12 Merge: a374846 5e0cf5e Author: Linus Torvalds Date: Thu Jun 1 10:40:41 2017 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending Pull SCSI target fixes from Nicholas Bellinger: "Here are the target-pending fixes for v4.12-rc4: - ibmviscsis ABORT_TASK handling fixes that missed the v4.12 merge window. (Bryant Ly and Michael Cyr) - Re-add a target-core check enforcing WRITE overflow reject that was relaxed in v4.3, to avoid unsupported iscsi-target immediate data overflow. (nab) - Fix a target-core-user OOPs during device removal. (MNC + Bryant Ly) - Fix a long standing iscsi-target potential issue where kthread exit did not wait for kthread_should_stop(). (Jiang Yi) - Fix a iscsi-target v3.12.y regression OOPs involving initial login PDU processing during asynchronous TCP connection close. (MNC + nab) This is a little larger than usual for an -rc4, primarily due to the iscsi-target v3.12.y regression OOPs bug-fix. However, it's an important patch as MNC + Hannes where both able to trigger it using a reduced iscsi initiator login timeout combined with a backend taking a long time to complete I/Os during iscsi login driven session reinstatement" * git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending: iscsi-target: Always wait for kthread_should_stop() before kthread exit iscsi-target: Fix initial login PDU asynchronous socket close OOPs tcmu: fix crash during device removal target: Re-add check to reject control WRITEs with overflow data ibmvscsis: Fix the incorrect req_lim_delta ibmvscsis: Clear left-over abort_cmd pointers commit 0fde7ad71ee371ede73b3f326e58f9e8d102feb6 Author: David S. Miller Date: Thu Jun 1 09:42:46 2017 -0700 sparc64: Fix build warnings with gcc 7. arch/sparc/kernel/ds.c: In function ‘register_services’: arch/sparc/kernel/ds.c:912:3: error: ‘strcpy’: writing at least 1 byte into a region of size 0 overflows the destination Reported-by: Anatoly Pugachev Signed-off-by: David S. Miller arch/sparc/kernel/ds.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit aeb073241fe7a2b932e04e20c60e47718332877f Author: Nikolay Aleksandrov Date: Thu Jun 1 18:07:55 2017 +0300 net: bridge: start hello timer only if device is up When the transition of NO_STP -> KERNEL_STP was fixed by always calling mod_timer in br_stp_start, it introduced a new regression which causes the timer to be armed even when the bridge is down, and since we stop the timers in its ndo_stop() function, they never get disabled if the device is destroyed before it's upped. To reproduce: $ while :; do ip l add br0 type bridge hello_time 100; brctl stp br0 on; ip l del br0; done; CC: Xin Long CC: Ivan Vecera CC: Sebastian Ott Reported-by: Sebastian Ott Fixes: 6d18c732b95c ("bridge: start hello_timer when enabling KERNEL_STP in br_stp_start") Signed-off-by: Nikolay Aleksandrov Signed-off-by: David S. Miller net/bridge/br_stp_if.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 3968d38917eb9bd0cd391265f6c9c538d9b33ffa Author: Mintz, Yuval Date: Thu Jun 1 15:57:56 2017 +0300 bnx2x: Fix Multi-Cos Apparently multi-cos isn't working for bnx2x quite some time - driver implements ndo_select_queue() to allow queue-selection for FCoE, but the regular L2 flow would cause it to modulo the fallback's result by the number of queues. The fallback would return a queue matching the needed tc [via __skb_tx_hash()], but since the modulo is by the number of TSS queues where number of TCs is not accounted, transmission would always be done by a queue configured into using TC0. Fixes: ada7c19e6d27 ("bnx2x: use XPS if possible for bnx2x_select_queue instead of pure hash") Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2b7ea64f94347b72235e563fedd6ef1ead4d11ec Author: Ganesh Goudar Date: Thu Jun 1 17:11:30 2017 +0530 cxgb4: update latest firmware version supported Change t4fw_version.h to update latest firmware version number to 1.16.45.0. Signed-off-by: Ganesh Goudar Signed-off-by: David S. Miller drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 7212462fa6fdae61f7f40a4ead048def45bb23cb Author: Nicolas Dichtel Date: Thu Jun 1 10:00:07 2017 +0200 netlink: don't send unknown nsid The NETLINK_F_LISTEN_ALL_NSID otion enables to listen all netns that have a nsid assigned into the netns where the netlink socket is opened. The nsid is sent as metadata to userland, but the existence of this nsid is checked only for netns that are different from the socket netns. Thus, if no nsid is assigned to the socket netns, NETNSA_NSID_NOT_ASSIGNED is reported to the userland. This value is confusing and useless. After this patch, only valid nsid are sent to userland. Reported-by: Flavio Leitner Signed-off-by: Nicolas Dichtel Signed-off-by: David S. Miller net/netlink/af_netlink.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 5ea6d691aac6c93b790f0905e3460d44cc4c449b Author: Jia-Ju Bai Date: Thu Jun 1 16:18:10 2017 +0800 qlcnic: Fix a sleep-in-atomic bug in qlcnic_82xx_hw_write_wx_2M and qlcnic_82xx_hw_read_wx_2M The driver may sleep under a write spin lock, and the function call path is: qlcnic_82xx_hw_write_wx_2M (acquire the lock by write_lock_irqsave) crb_win_lock qlcnic_pcie_sem_lock usleep_range qlcnic_82xx_hw_read_wx_2M (acquire the lock by write_lock_irqsave) crb_win_lock qlcnic_pcie_sem_lock usleep_range To fix it, the usleep_range is replaced with udelay. Signed-off-by: Jia-Ju Bai Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a9b3311ef36b670909ea4443f306c8318082c8f0 Author: Jeff Mahoney Date: Wed May 17 11:38:34 2017 -0400 btrfs: fix race with relocation recovery and fs_root setup If we have to recover relocation during mount, we'll ultimately have to evict the orphan inode. That goes through the reservation dance, where priority_reclaim_metadata_space and flush_space expect fs_info->fs_root to be valid. That's the next thing to be set up during mount, so we crash, almost always in flush_space trying to join the transaction but priority_reclaim_metadata_space is possible as well. This call path has been problematic in the past WRT whether ->fs_root is valid yet. Commit 957780eb278 (Btrfs: introduce ticketed enospc infrastructure) added new users that are called in the direct path instead of the async path that had already been worked around. The thing is that we don't actually need the fs_root, specifically, for anything. We either use it to determine whether the root is the chunk_root for use in choosing an allocation profile or as a root to pass btrfs_join_transaction before immediately committing it. Anything that isn't the chunk root works in the former case and any root works in the latter. A simple fix is to use a root we know will always be there: the extent_root. Cc: # v4.8+ Fixes: 957780eb278 (Btrfs: introduce ticketed enospc infrastructure) Signed-off-by: Jeff Mahoney Reviewed-by: Liu Bo Signed-off-by: David Sterba fs/btrfs/extent-tree.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 896533a7da929136d0432713f02a3edffece2826 Author: Jeff Mahoney Date: Wed May 17 09:49:37 2017 -0400 btrfs: fix memory leak in update_space_info failure path If we fail to add the space_info kobject, we'll leak the memory for the percpu counter. Fixes: 6ab0a2029c (btrfs: publish allocation data in sysfs) Cc: # v3.14+ Signed-off-by: Jeff Mahoney Reviewed-by: Liu Bo Signed-off-by: David Sterba fs/btrfs/extent-tree.c | 1 + 1 file changed, 1 insertion(+) commit cc2b702c52094b637a351d7491ac5200331d0445 Author: David Sterba Date: Fri May 12 01:03:52 2017 +0200 btrfs: use correct types for page indices in btrfs_page_exists_in_range Variables start_idx and end_idx are supposed to hold a page index derived from the file offsets. The int type is not the right one though, offsets larger than 1 << 44 will get silently trimmed off the high bits. (1 << 44 is 16TiB) What can go wrong, if start is below the boundary and end gets trimmed: - if there's a page after start, we'll find it (radix_tree_gang_lookup_slot) - the final check "if (page->index <= end_idx)" will unexpectedly fail The function will return false, ie. "there's no page in the range", although there is at least one. btrfs_page_exists_in_range is used to prevent races in: * in hole punching, where we make sure there are not pages in the truncated range, otherwise we'll wait for them to finish and redo truncation, but we're going to replace the pages with holes anyway so the only problem is the intermediate state * lock_extent_direct: we want to make sure there are no pages before we lock and start DIO, to prevent stale data reads For practical occurence of the bug, there are several constaints. The file must be quite large, the affected range must cross the 16TiB boundary and the internal state of the file pages and pending operations must match. Also, we must not have started any ordered data in the range, otherwise we don't even reach the buggy function check. DIO locking tries hard in several places to avoid deadlocks with buffered IO and avoids waiting for ranges. The worst consequence seems to be stale data read. CC: Liu Bo CC: stable@vger.kernel.org # 3.16+ Fixes: fc4adbff823f7 ("btrfs: Drop EXTENT_UPTODATE check in hole punching and direct locking") Reviewed-by: Liu Bo Signed-off-by: David Sterba fs/btrfs/inode.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit c08d517480ea342cc43acdacc5cf4a795e18151d Author: Ingo Molnar Date: Thu Jun 1 15:52:23 2017 +0200 Revert "x86/PAT: Fix Xorg regression on CPUs that don't support PAT" This reverts commit cbed27cdf0e3f7ea3b2259e86b9e34df02be3fe4. As Andy Lutomirski observed: "I think this patch is bogus. pat_enabled() sure looks like it's supposed to return true if PAT is *enabled*, and these days PAT is 'enabled' even if there's no HW PAT support." Reported-by: Bernhard Held Reported-by: Chris Wilson Acked-by: Andy Lutomirski Cc: Andrew Morton Cc: Borislav Petkov Cc: Brian Gerst Cc: Denys Vlasenko Cc: H. Peter Anvin Cc: Josh Poimboeuf Cc: Linus Torvalds Cc: Luis R. Rodriguez Cc: Mikulas Patocka Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Toshi Kani Cc: stable@vger.kernel.org # v4.2+ Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar arch/x86/mm/pat.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) commit 54265664c15a68905d8d67d19205e9a767636434 Author: Jiri Olsa Date: Wed May 31 13:35:57 2017 +0200 perf trace: Add mmap alias for s390 The s390 architecture maps sys_mmap (nr 90) into sys_old_mmap. For this reason perf trace can't find the proper syscall event to get args format from and displays it wrongly as 'continued'. To fix that fill the "alias" field with "old_mmap" for trace's mmap record to get the correct translation. Before: 0.042 ( 0.011 ms): vest/43052 fstat(statbuf: 0x3ffff89fd90 ) = 0 0.042 ( 0.028 ms): vest/43052 ... [continued]: mmap()) = 0x3fffd6e2000 0.072 ( 0.025 ms): vest/43052 read(buf: 0x3fffd6e2000, count: 4096 ) = 6 After: 0.045 ( 0.011 ms): fstat(statbuf: 0x3ffff8a0930 ) = 0 0.057 ( 0.018 ms): mmap(arg: 0x3ffff8a0858 ) = 0x3fffd14a000 0.076 ( 0.025 ms): read(buf: 0x3fffd14a000, count: 4096 ) = 6 Signed-off-by: Jiri Olsa Cc: David Ahern Cc: Namhyung Kim Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/20170531113557.19175-1-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-trace.c | 4 ++++ 1 file changed, 4 insertions(+) commit 0e5e7f5e9700661c3ddd95501743fb52fec1ab07 Author: Michael Ellerman Date: Thu May 25 16:33:52 2017 +1000 powerpc/64: Reclaim CPU_FTR_SUBCORE We are running low on CPU feature bits, so we only want to use them when it's really necessary. CPU_FTR_SUBCORE is only used in one place, and only in C, so we don't need it in order to make asm patching work. It can only be set on "Power8" CPUs, which in practice means POWER8, POWER8E and POWER8NVL. There are no plans to implement it on future CPUs, but if there ever were we could retrofit it then. Although KVM uses subcores, it never looks at the CPU feature, it either looks at the ISA level or the threads_per_subcore value. So drop the CPU feature and do a PVR check instead. Drop the device tree "subcore" feature as we no longer support doing anything with it, and we will drop it from skiboot too. Signed-off-by: Michael Ellerman arch/powerpc/include/asm/cputable.h | 3 +-- arch/powerpc/kernel/dt_cpu_ftrs.c | 1 - arch/powerpc/platforms/powernv/subcore.c | 8 +++++++- 3 files changed, 8 insertions(+), 4 deletions(-) commit dc421b200f91930c9c6a9586810ff8c232cf10fc Author: Michael Bringmann Date: Mon May 22 15:44:37 2017 -0500 powerpc/hotplug-mem: Fix missing endian conversion of aa_index When adding or removing memory, the aa_index (affinity value) for the memblock must also be converted to match the endianness of the rest of the 'ibm,dynamic-memory' property. Otherwise, subsequent retrieval of the attribute will likely lead to non-existent nodes, followed by using the default node in the code inappropriately. Fixes: 5f97b2a0d176 ("powerpc/pseries: Implement memory hotplug add in the kernel") Cc: stable@vger.kernel.org # v4.1+ Signed-off-by: Michael Bringmann Signed-off-by: Michael Ellerman arch/powerpc/platforms/pseries/hotplug-memory.c | 2 ++ 1 file changed, 2 insertions(+) commit 6f553912eedafae13ff20b322a65e471fe7f5236 Author: Christophe Leroy Date: Wed May 24 10:01:55 2017 +0200 powerpc/sysdev/simple_gpio: Fix oops in gpio save_regs function of_mm_gpiochip_add_data() generates an oops for NULL pointer dereference. of_mm_gpiochip_add_data() calls mm_gc->save_regs() before setting the data, therefore ->save_regs() cannot use gpiochip_get_data() Fixes: 937daafca774 ("powerpc: simple-gpio: use gpiochip data pointer") Cc: stable@vger.kernel.org # v4.7+ Signed-off-by: Christophe Leroy Reviewed-by: Linus Walleij Signed-off-by: Michael Ellerman arch/powerpc/sysdev/simple_gpio.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 99acc9bede06bbb2662aafff51f5b9e529fa845e Author: Michael Ellerman Date: Mon May 29 20:26:07 2017 +1000 powerpc/spufs: Fix coredump of SPU contexts If a process dumps core while it has SPU contexts active then we have code to also dump information about the SPU contexts. Unfortunately it's been broken for 3 1/2 years, and we didn't notice. In commit 7b1f4020d0d1 ("spufs: get rid of dump_emit() wrappers") the nread variable was removed and rc used instead. That means when the loop exits successfully, rc has the number of bytes read, but it's then used as the return value for the function, which should return 0 on success. So fix it by setting rc = 0 before returning in the success case. Fixes: 7b1f4020d0d1 ("spufs: get rid of dump_emit() wrappers") Signed-off-by: Michael Ellerman Acked-by: Jeremy Kerr Signed-off-by: Michael Ellerman arch/powerpc/platforms/cell/spufs/coredump.c | 2 ++ 1 file changed, 2 insertions(+) commit a2b05b7aa60e1e9b60faf01dfb1cca35638d1ab1 Author: Nicholas Piggin Date: Thu May 11 21:24:41 2017 +1000 powerpc/64s: Add dt_cpu_ftrs boot time setup option Provide a dt_cpu_ftrs= cmdline option to disable the dt_cpu_ftrs CPU feature discovery, and fall back to the "cputable" based version. Also allow control of advertising unknown features to userspace and with this parameter, and remove the clunky CONFIG option. Signed-off-by: Nicholas Piggin [mpe: Add explicit early check of bootargs in dt_cpu_ftrs_init()] Signed-off-by: Michael Ellerman Documentation/admin-guide/kernel-parameters.txt | 9 ++++ arch/powerpc/Kconfig | 5 --- arch/powerpc/kernel/dt_cpu_ftrs.c | 57 +++++++++++++++++++++---- 3 files changed, 57 insertions(+), 14 deletions(-) commit 9605bc46433d54f89b12d443a3d9aabf8070824b Author: Fengguang Wu Date: Tue May 16 20:41:45 2017 +0800 phy: qualcomm: phy-qcom-qmp: fix application of sizeof to pointer drivers/phy/qualcomm/phy-qcom-qmp.c:847:37-43: ERROR: application of sizeof to pointer sizeof when applied to a pointer typed expression gives the size of the pointer Generated by: scripts/coccinelle/misc/noderef.cocci CC: Vivek Gautam Signed-off-by: Fengguang Wu Signed-off-by: Kishon Vijay Abraham I drivers/phy/phy-qcom-qmp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 47a66eed99e6f231f4a1d261a9d493f4eee94829 Author: ZhuangYanying Date: Fri May 26 13:16:48 2017 +0800 KVM: x86: Fix nmi injection failure when vcpu got blocked When spin_lock_irqsave() deadlock occurs inside the guest, vcpu threads, other than the lock-holding one, would enter into S state because of pvspinlock. Then inject NMI via libvirt API "inject-nmi", the NMI could not be injected into vm. The reason is: 1 It sets nmi_queued to 1 when calling ioctl KVM_NMI in qemu, and sets cpu->kvm_vcpu_dirty to true in do_inject_external_nmi() meanwhile. 2 It sets nmi_queued to 0 in process_nmi(), before entering guest, because cpu->kvm_vcpu_dirty is true. It's not enough just to check nmi_queued to decide whether to stay in vcpu_block() or not. NMI should be injected immediately at any situation. Add checking nmi_pending, and testing KVM_REQ_NMI replaces nmi_queued in vm_vcpu_has_events(). Do the same change for SMIs. Signed-off-by: Zhuang Yanying Signed-off-by: Paolo Bonzini arch/x86/kvm/x86.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit d9c1b5431d5f0e07575db785a022bce91051ac1d Author: Roman Pen Date: Thu Jun 1 10:55:03 2017 +0200 KVM: SVM: do not zero out segment attributes if segment is unusable or not present This is a fix for the problem [1], where VMCB.CPL was set to 0 and interrupt was taken on userspace stack. The root cause lies in the specific AMD CPU behaviour which manifests itself as unusable segment attributes on SYSRET. The corresponding work around for the kernel is the following: 61f01dd941ba ("x86_64, asm: Work around AMD SYSRET SS descriptor attribute issue") In other turn virtualization side treated unusable segment incorrectly and restored CPL from SS attributes, which were zeroed out few lines above. In current patch it is assured only that P bit is cleared in VMCB.save state and segment attributes are not zeroed out if segment is not presented or is unusable, therefore CPL can be safely restored from DPL field. This is only one part of the fix, since QEMU side should be fixed accordingly not to zero out attributes on its side. Corresponding patch will follow. [1] Message id: CAJrWOzD6Xq==b-zYCDdFLgSRMPM-NkNuTSDFEtX=7MreT45i7Q@mail.gmail.com Signed-off-by: Roman Pen Signed-off-by: Mikhail Sennikovskii Cc: Paolo Bonzini Cc: Radim KrÄmář Cc: kvm@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Paolo Bonzini arch/x86/kvm/svm.c | 24 +++++++++++------------- 1 file changed, 11 insertions(+), 13 deletions(-) commit 1dbf647f31751a4e94fa0435c34f0f5ad5ce0adc Author: Arend Van Spriel Date: Fri May 26 13:02:55 2017 +0200 brcmfmac: fix alignment configuration on host using 64-bit DMA For SDIO the alignment requirement for transfers from device to host is configured in firmware. This configuration is limited to minimum of 4-byte alignment. However, this is not correct for platforms using 64-bit DMA when the minimum alignment should be 8 bytes. This issue appeared when the ALIGNMENT definition was set according the DMA configuration. The configuration in firmware was not using that macro defintion, but a hardcoded value of 4. Hence the driver reported alignment failures for data coming from the device and causing transfers to fail. Fixes: 6e84ab604bde ("brcmfmac: properly align buffers on certain platforms Reported-by: Hans de Goede Tested-by: Hans de Goede Reviewed-by: Hante Meuleman Reviewed-by: Pieter-Paul Giesberts Reviewed-by: Franky Lin Signed-off-by: Arend van Spriel Signed-off-by: Hans de Goede Signed-off-by: Kalle Valo drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d2c3b14e1f0dcebdb695617c0c1342a36b914a47 Author: Takashi Iwai Date: Thu Jun 1 09:35:30 2017 +0200 ALSA: hda - Fix applying MSI dual-codec mobo quirk The previous commit [63691587f7b0: ALSA: hda - Apply dual-codec quirk for MSI Z270-Gaming mobo] attempted to apply the existing dual-codec quirk for a MSI mobo. But it turned out that this isn't applied properly due to the MSI-vendor quirk before this entry. I overlooked such two MSI entries just because they were put in the wrong position, although we have a list ordered by PCI SSID numbers. This patch fixes it by rearranging the unordered entries. Fixes: 63691587f7b0 ("ALSA: hda - Apply dual-codec quirk for MSI Z270-Gaming mobo") Reported-by: Rudolf Schmidt Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit a37484638ca5e0aa7c205ecb91c9ace92e83c32c Merge: d602fb6 400129f Author: Linus Torvalds Date: Wed May 31 21:53:49 2017 -0700 Merge tag 'drm-fixes-for-v4.12-rc4' of git://people.freedesktop.org/~airlied/linux Pull drm fixes from Dave Airlie: "This is the main set of fixes for rc4, one amdgpu fix, some exynos regression fixes, some msm fixes and some i915 and GVT fixes. I've got a second regression fix for some DP chips that might be a bit large, but I think we'd like to land it now, I'll send it along tomorrow, once you are happy with this set" * tag 'drm-fixes-for-v4.12-rc4' of git://people.freedesktop.org/~airlied/linux: (24 commits) drm/amdgpu: Program ring for vce instance 1 at its register space drm/exynos: clean up description of exynos_drm_crtc drm/exynos: dsi: Remove bridge node reference in removal drm/exynos: dsi: Fix the parse_dt function drm/exynos: Merge pre/postclose hooks drm/msm: Fix the check for the command size drm/msm: Take the mutex before calling msm_gem_new_impl drm/msm: for array in-fences, check if all backing fences are from our own context before waiting drm/msm: constify irq_domain_ops drm/msm/mdp5: release hwpipe(s) for unused planes drm/msm: Reuse dma_fence_release. drm/msm: Expose our reservation object when exporting a dmabuf. drm/msm/gpu: check legacy clk names in get_clocks() drm/msm/mdp5: use __drm_atomic_helper_plane_duplicate_state() drm/msm: select PM_OPP drm/i915: Stop pretending to mask/unmask LPE audio interrupts drm/i915/selftests: Silence compiler warning in igt_ctx_exec Revert "drm/i915: Restore lost "Initialized i915" welcome message" drm/i915/gvt: clean up unsubmited workloads before destroying kmem cache drm/i915/gvt: Disable compression workaround for Gen9 ... commit 70bdf2026d905b8bfa0a455d35018df3e9777a6c Author: Martin K. Petersen Date: Fri May 19 12:39:36 2017 -0400 scsi: scsi_debug: Avoid PI being disabled when TPGS is enabled It was not possible to enable both T10 PI and TPGS because they share the same byte in the INQUIRY response. Logically OR the TPGS value instead of using assignment. Reported-by: Ritika Srivastava Reviewed-by: Bart Van Assche Reviewed-by: Ewan D. Milne Signed-off-by: Martin K. Petersen drivers/scsi/scsi_debug.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4cd3b6ebff8510b2139d64024411207090cfe0a9 Author: Bill Kuzeja Date: Thu May 25 15:26:31 2017 -0400 scsi: qla2xxx: Fix extraneous ref on sp's after adapter break Hung task timeouts can result if a qlogic board breaks unexpectedly while running I/O. These tasks become hung because command srb reference counts are not going to zero, hence the affected srbs and commands do not get freed. This fix accounts for this extra reference in the srbs in the case of a board failure. Fixes: a465537ad1a4 ("qla2xxx: Disable the adapter and skip error recovery in case of register disconnect") Signed-off-by: Bill Kuzeja Acked-by: Himanshu Madhani Signed-off-by: Martin K. Petersen drivers/scsi/qla2xxx/qla_os.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit e6ef6a77f51e403a1400241b9d029ecaba45a834 Author: Gustavo A. R. Silva Date: Tue May 23 10:09:28 2017 -0500 scsi: lpfc: prevent potential null pointer dereference Null check at line 966: if (ndlp) {, implies that ndlp might be NULL. Functions lpfc_nlp_set_state() and lpfc_issue_els_prli() dereference pointer ndlp. Include these function calls inside the IF block that tests pointer ndlp. Addresses-Coverity-ID: 1401856 Signed-off-by: Gustavo A. R. Silva Acked-by: James Smart Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc_ct.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 7c9fdfb7000715df2d187df251d11e4850ce94c8 Author: Guilherme G. Piccoli Date: Wed May 24 18:48:51 2017 -0300 scsi: lpfc: Avoid NULL pointer dereference in lpfc_els_abort() We might have a NULL pring in lpfc_els_abort(), for example on error recovery path, since queues are destroyed during error recovery mechanism. In this case, we should just drop the abort since the queues will be recreated anyway. This patch just verifies for NULL pointer and stop the abortion of the queue in case of a NULL pring. Also, this patch converts return type of lpfc_els_abort() from int to void, since it's not checked anywhere. Reported-by: Harsha Thyagaraja Reported-by: Naresh Bannoth Tested-by: Raphael Silva Signed-off-by: Guilherme G. Piccoli Reviewed-by: Johannes Thumshirn Acked-by: James Smart Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc_crtn.h | 2 +- drivers/scsi/lpfc/lpfc_nportdisc.c | 7 +++++-- 2 files changed, 6 insertions(+), 3 deletions(-) commit 9094367a9161858004eacb7373aa2bf48c51c16d Author: Arnd Bergmann Date: Fri May 19 10:04:31 2017 +0200 scsi: lpfc: nvmet_fc: fix format string The lpfc_nvmeio_data() tracing helper always takes a format string and three additional arguments. The latest caller has a format string with only two integer arguments, causing this harmless warning: drivers/scsi/lpfc/lpfc_nvmet.c: In function 'lpfc_nvmet_xmt_fcp_release': drivers/scsi/lpfc/lpfc_nvmet.c:802:25: error: too many arguments for format [-Werror=format-extra-args] lpfc_nvmeio_data(phba, "NVMET FCP FREE: xri x%x ste %d\n", ctxp->oxid, We could add a dummy argument here, but it seems reasonable to print the 'abort' flag as the third argument. Fixes: 19b58d9473e8 ("nvmet_fc: add req_release to lldd api") Signed-off-by: Arnd Bergmann Acked-by: James Smart Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc_nvmet.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 400129f0a3ae989c30b37104bbc23b35c9d7a9a4 Merge: 8ef6fcc e379cbe Author: Dave Airlie Date: Thu Jun 1 12:07:48 2017 +1000 Merge tag 'exynos-drm-fixes-for-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes - Fix a regression to description of exynos_drm_crtc - Remove preclose hook of Exynos . This was a exynos change of the patch series[1] merged already. - Fix one dt broken issue - Make sure to release bridge_node of Exynos MIPI-DSI driver. [1] https://lists.freedesktop.org/archives/dri-devel/2017-March/135111.html * tag 'exynos-drm-fixes-for-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos: drm/exynos: clean up description of exynos_drm_crtc drm/exynos: dsi: Remove bridge node reference in removal drm/exynos: dsi: Fix the parse_dt function drm/exynos: Merge pre/postclose hooks commit 8ef6fcc8eebbea8c90735ef362b96bf1cafcd45f Merge: 58b58f6 45cc658 Author: Dave Airlie Date: Thu Jun 1 12:07:18 2017 +1000 Merge branch 'drm-fixes-4.12' of git://people.freedesktop.org/~agd5f/linux into drm-fixes * 'drm-fixes-4.12' of git://people.freedesktop.org/~agd5f/linux: drm/amdgpu: Program ring for vce instance 1 at its register space commit 58b58f6ef582426710724a2b01ac230a0d542b5f Merge: 25f480e d72fea5 Author: Dave Airlie Date: Thu Jun 1 12:06:34 2017 +1000 Merge branch 'msm-fixes-4.12-rc4' of git://people.freedesktop.org/~robclark/linux into drm-fixes a few fixes for 4.12.. * 'msm-fixes-4.12-rc4' of git://people.freedesktop.org/~robclark/linux: drm/msm: Fix the check for the command size drm/msm: Take the mutex before calling msm_gem_new_impl drm/msm: for array in-fences, check if all backing fences are from our own context before waiting drm/msm: constify irq_domain_ops drm/msm/mdp5: release hwpipe(s) for unused planes drm/msm: Reuse dma_fence_release. drm/msm: Expose our reservation object when exporting a dmabuf. drm/msm/gpu: check legacy clk names in get_clocks() drm/msm/mdp5: use __drm_atomic_helper_plane_duplicate_state() drm/msm: select PM_OPP commit 25f480e89a022d382ddc5badc23b49426e89eabc Merge: 5ed02db 9bd9590 Author: Dave Airlie Date: Thu Jun 1 11:53:34 2017 +1000 Merge tag 'drm-intel-fixes-2017-05-29' of git://anongit.freedesktop.org/git/drm-intel into drm-fixes drm/i915 fixes for v4.12-rc4 * tag 'drm-intel-fixes-2017-05-29' of git://anongit.freedesktop.org/git/drm-intel: drm/i915: Stop pretending to mask/unmask LPE audio interrupts drm/i915/selftests: Silence compiler warning in igt_ctx_exec Revert "drm/i915: Restore lost "Initialized i915" welcome message" drm/i915/gvt: clean up unsubmited workloads before destroying kmem cache drm/i915/gvt: Disable compression workaround for Gen9 drm/i915: set initialised only when init_context callback is NULL drm/i915: Fix new -Wint-in-bool-context gcc compiler warning drm/i915: use vma->size for appgtt allocate_va_range drm/i915: Do not sync RCU during shrinking commit 5e0cf5e6c43b9e19fc0284f69e5cd2b4a47523b0 Author: Jiang Yi Date: Tue May 16 17:57:55 2017 +0800 iscsi-target: Always wait for kthread_should_stop() before kthread exit There are three timing problems in the kthread usages of iscsi_target_mod: - np_thread of struct iscsi_np - rx_thread and tx_thread of struct iscsi_conn In iscsit_close_connection(), it calls send_sig(SIGINT, conn->tx_thread, 1); kthread_stop(conn->tx_thread); In conn->tx_thread, which is iscsi_target_tx_thread(), when it receive SIGINT the kthread will exit without checking the return value of kthread_should_stop(). So if iscsi_target_tx_thread() exit right between send_sig(SIGINT...) and kthread_stop(...), the kthread_stop() will try to stop an already stopped kthread. This is invalid according to the documentation of kthread_stop(). (Fix -ECONNRESET logout handling in iscsi_target_tx_thread and early iscsi_target_rx_thread failure case - nab) Signed-off-by: Jiang Yi Cc: # v3.12+ Signed-off-by: Nicholas Bellinger drivers/target/iscsi/iscsi_target.c | 30 ++++++++++++++++++++++++------ drivers/target/iscsi/iscsi_target_erl0.c | 6 +++++- drivers/target/iscsi/iscsi_target_erl0.h | 2 +- drivers/target/iscsi/iscsi_target_login.c | 4 ++++ 4 files changed, 34 insertions(+), 8 deletions(-) commit 25cdda95fda78d22d44157da15aa7ea34be3c804 Author: Nicholas Bellinger Date: Wed May 24 21:47:09 2017 -0700 iscsi-target: Fix initial login PDU asynchronous socket close OOPs This patch fixes a OOPs originally introduced by: commit bb048357dad6d604520c91586334c9c230366a14 Author: Nicholas Bellinger Date: Thu Sep 5 14:54:04 2013 -0700 iscsi-target: Add sk->sk_state_change to cleanup after TCP failure which would trigger a NULL pointer dereference when a TCP connection was closed asynchronously via iscsi_target_sk_state_change(), but only when the initial PDU processing in iscsi_target_do_login() from iscsi_np process context was blocked waiting for backend I/O to complete. To address this issue, this patch makes the following changes. First, it introduces some common helper functions used for checking socket closing state, checking login_flags, and atomically checking socket closing state + setting login_flags. Second, it introduces a LOGIN_FLAGS_INITIAL_PDU bit to know when a TCP connection has dropped via iscsi_target_sk_state_change(), but the initial PDU processing within iscsi_target_do_login() in iscsi_np context is still running. For this case, it sets LOGIN_FLAGS_CLOSED, but doesn't invoke schedule_delayed_work(). The original NULL pointer dereference case reported by MNC is now handled by iscsi_target_do_login() doing a iscsi_target_sk_check_close() before transitioning to FFP to determine when the socket has already closed, or iscsi_target_start_negotiation() if the login needs to exchange more PDUs (eg: iscsi_target_do_login returned 0) but the socket has closed. For both of these cases, the cleanup up of remaining connection resources will occur in iscsi_target_start_negotiation() from iscsi_np process context once the failure is detected. Finally, to handle to case where iscsi_target_sk_state_change() is called after the initial PDU procesing is complete, it now invokes conn->login_work -> iscsi_target_do_login_rx() to perform cleanup once existing iscsi_target_sk_check_close() checks detect connection failure. For this case, the cleanup of remaining connection resources will occur in iscsi_target_do_login_rx() from delayed workqueue process context once the failure is detected. Reported-by: Mike Christie Reviewed-by: Mike Christie Tested-by: Mike Christie Cc: Mike Christie Reported-by: Hannes Reinecke Cc: Hannes Reinecke Cc: Sagi Grimberg Cc: Varun Prakash Cc: # v3.12+ Signed-off-by: Nicholas Bellinger drivers/target/iscsi/iscsi_target_nego.c | 194 +++++++++++++++++++++---------- include/target/iscsi/iscsi_target_core.h | 1 + 2 files changed, 133 insertions(+), 62 deletions(-) commit d85da227c3ae43d9ca513d60f244213cb4e55485 Author: Chen-Yu Tsai Date: Wed May 31 15:58:23 2017 +0800 clk: sunxi-ng: a64: Export PLL_PERIPH0 clock for the PRCM The PRCM takes PLL_PERIPH0 as one of its parents for the AR100 clock. As such we need to be able to describe this relationship in the device tree. Export the PLL_PERIPH0 clock so we can reference it in the PRCM node. Signed-off-by: Chen-Yu Tsai Signed-off-by: Maxime Ripard drivers/clk/sunxi-ng/ccu-sun50i-a64.h | 4 +++- include/dt-bindings/clock/sun50i-a64-ccu.h | 2 ++ 2 files changed, 5 insertions(+), 1 deletion(-) commit c4be8c68e6900b1811bc64f74cb13d5032a389ce Author: Chen-Yu Tsai Date: Wed May 31 15:58:21 2017 +0800 clk: sunxi-ng: h3: Export PLL_PERIPH0 clock for the PRCM The PRCM takes PLL_PERIPH0 as one of its parents for the AR100 clock. As such we need to be able to describe this relationship in the device tree. Export the PLL_PERIPH0 clock so we can reference it in the PRCM node. Signed-off-by: Chen-Yu Tsai Signed-off-by: Maxime Ripard drivers/clk/sunxi-ng/ccu-sun8i-h3.h | 4 +++- include/dt-bindings/clock/sun8i-h3-ccu.h | 2 ++ 2 files changed, 5 insertions(+), 1 deletion(-) commit a91afc974ee8441940241e3c39c75d7b8f38e911 Author: Chen-Yu Tsai Date: Wed May 31 15:58:19 2017 +0800 dt-bindings: clock: sunxi-ccu: Add pll-periph to PRCM's needed clocks The AR100 clock in the PRCM has parents, one of which is pll-periph from the main CCU. Add it to the list of required clocks for the PRCM CCU. Signed-off-by: Chen-Yu Tsai Signed-off-by: Maxime Ripard Documentation/devicetree/bindings/clock/sunxi-ccu.txt | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit c2e8471d98f072f0f18acdd7df5b401ed0d29a2c Author: Roopa Prabhu Date: Tue May 30 23:50:36 2017 -0700 mpls: fix clearing of dead nh_flags on link up recent fixes to use WRITE_ONCE for nh_flags on link up, accidently ended up leaving the deadflags on a nh. This patch fixes the WRITE_ONCE to use freshly evaluated nh_flags. Fixes: 39eb8cd17588 ("net: mpls: rt_nhn_alive and nh_flags should be accessed using READ_ONCE") Reported-by: Satish Ashok Signed-off-by: Roopa Prabhu Acked-by: David Ahern Signed-off-by: David S. Miller net/mpls/af_mpls.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e8f4ae85439f34bec3b0ab69223a41809dab28c9 Author: Jia-Ju Bai Date: Wed May 31 09:40:11 2017 +0800 isdn: Fix a sleep-in-atomic bug The driver may sleep under a spin lock, the function call path is: isdn_ppp_mp_receive (acquire the lock) isdn_ppp_mp_reassembly isdn_ppp_push_higher isdn_ppp_decompress isdn_ppp_ccp_reset_trans isdn_ppp_ccp_reset_alloc_state kzalloc(GFP_KERNEL) --> may sleep To fixed it, the "GFP_KERNEL" is replaced with "GFP_ATOMIC". Signed-off-by: Jia-Ju Bai Signed-off-by: David S. Miller drivers/isdn/i4l/isdn_ppp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f7cf69ae171592d133c69b9adaa5de7cfb6038ea Author: Tejun Heo Date: Wed May 31 14:26:26 2017 -0400 libata: fix error checking in in ata_parse_force_one() ata_parse_force_one() was incorrectly comparing @p to @endp when it should have been comparing @id. The only consequence is that it may end up using an invalid port number in "libata.force" module param instead of rejecting it. Signed-off-by: Tejun Heo Reported-by: Petru-Florin Mihancea Link: https://bugzilla.kernel.org/show_bug.cgi?id=195785 drivers/ata/libata-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 06d2d6431bc8d41ef5ffd8bd4b52cea9f72aed22 Author: Gustavo A. R. Silva Date: Tue May 30 17:38:43 2017 -0500 net: freescale: fix potential null pointer dereference Add NULL check before dereferencing pointer _id_ in order to avoid a potential NULL pointer dereference. Addresses-Coverity-ID: 1397995 Signed-off-by: Gustavo A. R. Silva Signed-off-by: David S. Miller drivers/net/ethernet/freescale/fsl_pq_mdio.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit 1b8f8694bb4992135dac150bf44a6c139e573970 Author: Russell King Date: Tue May 30 21:38:18 2017 +0100 net: fix auto-loading of Marvell DSA driver Auto-loading of the Marvell DSA driver has stopped working with recent kernels. This seems to be due to the change of binding for DSA devices, moving them from the platform bus to the MDIO bus. In order for module auto-loading to work, we need to provide a MODALIAS string in the uevent file for the device. However, the device core does not automatically provide this, and needs each bus_type to implement a uevent method to generate these strings. The MDIO bus does not provide such a method, so no MODALIAS string is provided: .# cat /sys/bus/mdio_bus/devices/f1072004.mdio-mii\:04/uevent DRIVER=mv88e6085 OF_NAME=switch OF_FULLNAME=/soc/internal-regs/mdio@72004/switch@4 OF_COMPATIBLE_0=marvell,mv88e6085 OF_COMPATIBLE_N=1 In the case of OF-based devices, the solution is easy - of_device_uevent_modalias() does the work for us. After this is done, the uevent file looks like this: .# cat /sys/bus/mdio_bus/devices/f1072004.mdio-mii\:04/uevent DRIVER=mv88e6085 OF_NAME=switch OF_FULLNAME=/soc/internal-regs/mdio@72004/switch@4 OF_COMPATIBLE_0=marvell,mv88e6085 OF_COMPATIBLE_N=1 MODALIAS=of:NswitchTCmarvell,mv88e6085 which results in auto-loading of the Marvell DSA driver on Clearfog platforms. Fixes: c0405563a613 ("ARM: dts: armada-388-clearfog: Utilize new DSA binding") Signed-off-by: Russell King Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/phy/mdio_bus.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit 1ba15b24f07c44f68067959522639226c963e212 Author: Christian Borntraeger Date: Wed May 31 10:18:55 2017 +0200 KVM: s390: fix ais handling vs cpu model If ais is disabled via cpumodel, we must act accordingly, even if KVM_CAP_S390_AIS was enabled. Signed-off-by: Christian Borntraeger Reviewed-by: Pierre Morel Reviewed-by: Yi Min Zhao Reviewed-by: Halil Pasic Reviewed-by: Eric Farman arch/s390/include/asm/kvm_host.h | 1 - arch/s390/kvm/interrupt.c | 4 ++-- arch/s390/kvm/kvm-s390.c | 2 -- 3 files changed, 2 insertions(+), 5 deletions(-) commit 898805e0cdf7fd860ec21bf661d3a0285a3defbd Author: Russell King Date: Tue May 30 16:21:51 2017 +0100 net: phy: fix marvell phy status reading The Marvell driver incorrectly provides phydev->lp_advertising as the logical and of the link partner's advert and our advert. This is incorrect - this field is supposed to store the link parter's unmodified advertisment. This allows ethtool to report the correct link partner auto-negotiation status. Fixes: be937f1f89ca ("Marvell PHY m88e1111 driver fix") Signed-off-by: Russell King Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/phy/marvell.c | 2 -- 1 file changed, 2 deletions(-) commit 45cc6586b7a73e84a8806881122b6ec306cdc9e7 Author: Leo Liu Date: Mon May 29 13:13:59 2017 -0400 drm/amdgpu: Program ring for vce instance 1 at its register space We need program ring buffer on instance 1 register space domain, when only if instance 1 available, with two instances or instance 0, and we need only program instance 0 regsiter space domain for ring. Signed-off-by: Leo Liu Reviewed-by: Alex Deucher Cc: stable@vger.kernel.org Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/vce_v3_0.c | 95 +++++++++++++++++++++++++---------- 1 file changed, 68 insertions(+), 27 deletions(-) commit 15e5651525c2e580a523568ed207e4a3fb11cc33 Author: Douglas Caetano dos Santos Date: Fri May 26 14:28:00 2017 -0300 tcp: reinitialize MTU probing when setting MSS in a TCP repair MTU probing initialization occurred only at connect() and at SYN or SYN-ACK reception, but the former sets MSS to either the default or the user set value (through TCP_MAXSEG sockopt) and the latter never happens with repaired sockets. The result was that, with MTU probing enabled and unless TCP_MAXSEG sockopt was used before connect(), probing would be stuck at tcp_base_mss value until tcp_probe_interval seconds have passed. Signed-off-by: Douglas Caetano dos Santos Signed-off-by: David S. Miller net/ipv4/tcp.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 6ea44adce91526700535b3150f77f8639ae8c82d Author: NeilBrown Date: Thu May 25 17:00:32 2017 +1000 SUNRPC: ensure correct error is reported by xs_tcp_setup_socket() If you attempt a TCP mount from an host that is unreachable in a way that triggers an immediate error from kernel_connect(), that error does not propagate up, instead EAGAIN is reported. This results in call_connect_status receiving the wrong error. A case that it easy to demonstrate is to attempt to mount from an address that results in ENETUNREACH, but first deleting any default route. Without this patch, the mount.nfs process is persistently runnable and is hard to kill. With this patch it exits as it should. The problem is caused by the fact that xs_tcp_force_close() eventually calls xprt_wake_pending_tasks(xprt, -EAGAIN); which causes an error return of -EAGAIN. so when xs_tcp_setup_sock() calls xprt_wake_pending_tasks(xprt, status); the status is ignored. Fixes: 4efdd92c9211 ("SUNRPC: Remove TCP client connection reset hack") Signed-off-by: NeilBrown Signed-off-by: Trond Myklebust net/sunrpc/xprtsock.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 5a8948f8a32ba56c17b3fb75d318ac98157f3ba5 Author: Jan Kara Date: Wed May 31 09:44:33 2017 +0200 md: Make flush bios explicitely sync Commit b685d3d65ac7 "block: treat REQ_FUA and REQ_PREFLUSH as synchronous" removed REQ_SYNC flag from WRITE_{FUA|PREFLUSH|...} definitions. generic_make_request_checks() however strips REQ_FUA and REQ_PREFLUSH flags from a bio when the storage doesn't report volatile write cache and thus write effectively becomes asynchronous which can lead to performance regressions Fix the problem by making sure all bios which are synchronous are properly marked with REQ_SYNC. CC: linux-raid@vger.kernel.org CC: Shaohua Li Fixes: b685d3d65ac791406e0dfd8779cc9b3707fea5a3 CC: stable@vger.kernel.org Signed-off-by: Jan Kara Signed-off-by: Shaohua Li drivers/md/md.c | 2 +- drivers/md/raid5-cache.c | 4 ++-- drivers/md/raid5-ppl.c | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) commit d602fb6844940b23afb64d4bf70bb963c15571ee Merge: f511c0b a082c6f Author: Linus Torvalds Date: Wed May 31 08:29:02 2017 -0700 Merge branch 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs Pull overlayfs fixes from Miklos Szeredi: "Fix regressions: - missing CONFIG_EXPORTFS dependency - failure if upper fs doesn't support xattr - bad error cleanup This also adds the concept of "impure" directories complementing the "origin" marking introduced in -rc1. Together they enable getting consistent st_ino and d_ino for directory listings. And there's a bug fix and a cleanup as well" * 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs: ovl: filter trusted xattr for non-admin ovl: mark upper merge dir with type origin entries "impure" ovl: mark upper dir with type origin entries "impure" ovl: remove unused arg from ovl_lookup_temp() ovl: handle rename when upper doesn't support xattr ovl: don't fail copy-up if upper doesn't support xattr ovl: check on mount time if upper fs supports setting xattr ovl: fix creds leak in copy up error path ovl: select EXPORTFS commit 5be6b75610cefd1e21b98a218211922c2feb6e08 Author: Hou Tao Date: Wed Mar 1 09:02:33 2017 +0800 cfq-iosched: fix the delay of cfq_group's vdisktime under iops mode When adding a cfq_group into the cfq service tree, we use CFQ_IDLE_DELAY as the delay of cfq_group's vdisktime if there have been other cfq_groups already. When cfq is under iops mode, commit 9a7f38c42c2b ("cfq-iosched: Convert from jiffies to nanoseconds") could result in a large iops delay and lead to an abnormal io schedule delay for the added cfq_group. To fix it, we just need to revert to the old CFQ_IDLE_DELAY value: HZ / 5 when iops mode is enabled. Despite having the same value, the delay of a cfq_queue in idle class and the delay of cfq_group are different things, so I define two new macros for the delay of a cfq_group under time-slice mode and iops mode. Fixes: 9a7f38c42c2b ("cfq-iosched: Convert from jiffies to nanoseconds") Cc: # 4.8+ Signed-off-by: Hou Tao Acked-by: Jan Kara Signed-off-by: Jens Axboe block/cfq-iosched.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) commit 63db7c815bc0997c29e484d2409684fdd9fcd93b Author: Brian Foster Date: Wed May 31 08:22:52 2017 -0700 xfs: use ->b_state to fix buffer I/O accounting release race We've had user reports of unmount hangs in xfs_wait_buftarg() that analysis shows is due to btp->bt_io_count == -1. bt_io_count represents the count of in-flight asynchronous buffers and thus should always be >= 0. xfs_wait_buftarg() waits for this value to stabilize to zero in order to ensure that all untracked (with respect to the lru) buffers have completed I/O processing before unmount proceeds to tear down in-core data structures. The value of -1 implies an I/O accounting decrement race. Indeed, the fact that xfs_buf_ioacct_dec() is called from xfs_buf_rele() (where the buffer lock is no longer held) means that bp->b_flags can be updated from an unsafe context. While a user-level reproducer is currently not available, some intrusive hacks to run racing buffer lookups/ioacct/releases from multiple threads was used to successfully manufacture this problem. Existing callers do not expect to acquire the buffer lock from xfs_buf_rele(). Therefore, we can not safely update ->b_flags from this context. It turns out that we already have separate buffer state bits and associated serialization for dealing with buffer LRU state in the form of ->b_state and ->b_lock. Therefore, replace the _XBF_IN_FLIGHT flag with a ->b_state variant, update the I/O accounting wrappers appropriately and make sure they are used with the correct locking. This ensures that buffer in-flight state can be modified at buffer release time without racing with modifications from a buffer lock holder. Fixes: 9c7504aa72b6 ("xfs: track and serialize in-flight async buffers against unmount") Cc: # v4.8+ Signed-off-by: Brian Foster Reviewed-by: Nikolay Borisov Tested-by: Libor Pechacek Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/xfs_buf.c | 38 ++++++++++++++++++++++++++------------ fs/xfs/xfs_buf.h | 5 ++--- 2 files changed, 28 insertions(+), 15 deletions(-) commit ff0361b34ac63ef80c785c32d62e0e9d89a2cf89 Author: Jan Kara Date: Wed May 31 09:44:32 2017 +0200 dm: make flush bios explicitly sync Commit b685d3d65ac7 ("block: treat REQ_FUA and REQ_PREFLUSH as synchronous") removed REQ_SYNC flag from WRITE_{FUA|PREFLUSH|...} definitions. generic_make_request_checks() however strips REQ_FUA and REQ_PREFLUSH flags from a bio when the storage doesn't report volatile write cache and thus write effectively becomes asynchronous which can lead to performance regressions. Fix the problem by making sure all bios which are synchronous are properly marked with REQ_SYNC. Fixes: b685d3d65ac7 ("block: treat REQ_FUA and REQ_PREFLUSH as synchronous") Cc: stable@vger.kernel.org Signed-off-by: Jan Kara Signed-off-by: Mike Snitzer drivers/md/dm-bufio.c | 2 +- drivers/md/dm-integrity.c | 3 ++- drivers/md/dm-raid1.c | 2 +- drivers/md/dm-snap-persistent.c | 3 ++- drivers/md/dm.c | 2 +- 5 files changed, 7 insertions(+), 5 deletions(-) commit 869e188a35c93f1bad7bf16c32f34a6feb5f79f1 Author: Daniel Vetter Date: Wed May 31 10:38:13 2017 +0200 drm: Fix locking in drm_atomic_helper_resume In the conversion to drop drm_modeset_lock_all and the magic implicit context I failed to realize that _resume starts out with a pile of state copies, but not with the locks. And hence drm_atomic_commit won't grab these for us. v2: Add locking checks in helpers to make sure we catch this in the future. Note we can only require the locks in the atomic_check phase, not in the commit phase. But since any commit is guaranteed to first run the checks (even for the resume stuff where we use stored duplicated old state) this should give us full coverage. Requested by Maarten. Cc: Jyri Sarha Fixes: a5b8444e289c ("drm/atomic-helper: remove modeset_lock_all from helper_resume") Cc: Maarten Lankhorst Reviewed-by: Maarten Lankhorst Cc: Daniel Vetter Cc: Jani Nikula Cc: Sean Paul Signed-off-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/20170531083813.1390-1-daniel.vetter@ffwll.ch drivers/gpu/drm/drm_atomic_helper.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit e49a14fa36aeb72476e038fcde96c151b7e4ecc8 Author: Takashi Iwai Date: Tue May 30 23:24:45 2017 +0200 ALSA: usb: Avoid VLA in mixer_us16x08.c This is another attempt to work around the VLA used in mixer_us16x08.c. Basically the temporary array is used individually for two cases, and we can declare locally in each block, instead of hackish max() usage. Signed-off-by: Takashi Iwai sound/usb/mixer_us16x08.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit 617163fc2580da3d489b6c1bacb6312e0e2aac02 Author: Takashi Iwai Date: Tue May 30 23:21:07 2017 +0200 ALSA: usb: Fix a typo in Tascam US-16x08 mixer element A mixer element created in a quirk for Tascam US-16x08 contains a typo: it should be "EQ MidLow Q" instead of "EQ MidQLow Q". Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=195875 Fixes: d2bb390a2081 ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk") Cc: # v4.11+ Signed-off-by: Takashi Iwai sound/usb/mixer_us16x08.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 64188cfbe5245d412de2139a3864e4e00b4136f0 Author: Takashi Iwai Date: Tue May 30 09:23:41 2017 +0200 Revert "ALSA: usb-audio: purge needless variable length array" This reverts commit 89b593c30e83 ("ALSA: usb-audio: purge needless variable length array"). The patch turned out to cause a severe regression, triggering an Oops at snd_usb_ctl_msg(). It was overseen that snd_usb_ctl_msg() writes back the response to the given buffer, while the patch changed it to a read-only const buffer. (One should always double-check when an extra pointer cast is present...) As a simple fix, just revert the affected commit. It was merely a cleanup. Although it brings VLA again, it's clearer as a fix. We'll address the VLA later in another patch. Fixes: 89b593c30e83 ("ALSA: usb-audio: purge needless variable length array") Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=195875 Cc: # v4.11+ Signed-off-by: Takashi Iwai sound/usb/mixer_us16x08.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit efd11cc8fa1a6d8aba16bd6aaa774ecc3d02145f Author: Mark yao Date: Sat May 27 19:43:36 2017 +0800 drm/rockchip: Correct vop out_mode configure Force vop output mode on encoder driver seem not a good idea, EDP, HDMI, DisplayPort all have 10bit input on rk3399, On non-10bit vop, vop 8bit output bit[0-7] connect to the encoder high 8bit [2-9]. So force RGB10 to RGB888 on vop driver would be better. And another problem, EDP check crtc id on atomic_check, but encoder maybe NULL, so out_mode configure would fail, it cause edp no display. Signed-off-by: Mark Yao Reviewed-by: Jeffy Chen Link: http://patchwork.freedesktop.org/patch/msgid/1495885416-22216-1-git-send-email-mark.yao@rock-chips.com drivers/gpu/drm/rockchip/analogix_dp-rockchip.c | 12 ------------ drivers/gpu/drm/rockchip/cdn-dp-core.c | 9 ++------- drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 8 ++++++++ drivers/gpu/drm/rockchip/rockchip_drm_vop.h | 3 +++ drivers/gpu/drm/rockchip/rockchip_vop_reg.c | 2 ++ 5 files changed, 15 insertions(+), 19 deletions(-) commit 7ed1c5e5ddbb87aef9df7f8a8a714bcffe90f0eb Author: Patrick Venture Date: Tue May 30 12:42:01 2017 -0700 hwmon: (aspeed-pwm-tacho) On read failure return -ETIMEDOUT When the controller fails to provide an RPM reading within the alloted time; the driver returns -ETIMEDOUT and no file contents. Signed-off-by: Patrick Venture Fixes: 2d7a548a3eff ("drivers: hwmon: Support for ASPEED PWM/Fan tach") Signed-off-by: Guenter Roeck drivers/hwmon/aspeed-pwm-tacho.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) commit 08fd5e76c268b7a5353302825b6b63a6027ddd0a Author: Guenter Roeck Date: Sat May 27 06:50:05 2017 -0700 hwmon: (aspeed-pwm-tacho) Select REGMAP The driver uses regmap and thus has to select it to avoid build errors such as the following. drivers/hwmon/aspeed-pwm-tacho.c:337:21: error: variable 'aspeed_pwm_tacho_regmap_config' has initializer but incomplete type Reported-by: kbuild test robot Acked-by: Joel Stanley Fixes: 2d7a548a3eff ("drivers: hwmon: Support for ASPEED PWM/Fan tach") Signed-off-by: Guenter Roeck drivers/hwmon/Kconfig | 1 + 1 file changed, 1 insertion(+) commit f511c0b17b081562dca8ac5061dfa86db4c66cc2 Author: Linus Torvalds Date: Tue May 30 12:38:59 2017 -0700 "Yes, people use FOLL_FORCE ;)" This effectively reverts commit 8ee74a91ac30 ("proc: try to remove use of FOLL_FORCE entirely") It turns out that people do depend on FOLL_FORCE for the /proc//mem case, and we're talking not just debuggers. Talking to the affected people, the use-cases are: Keno Fischer: "We used these semantics as a hardening mechanism in the julia JIT. By opening /proc/self/mem and using these semantics, we could avoid needing RWX pages, or a dual mapping approach. We do have fallbacks to these other methods (though getting EIO here actually causes an assert in released versions - we'll updated that to make sure to take the fall back in that case). Nevertheless the /proc/self/mem approach was our favored approach because it a) Required an attacker to be able to execute syscalls which is a taller order than getting memory write and b) didn't double the virtual address space requirements (as a dual mapping approach would). I think in general this feature is very useful for anybody who needs to precisely control the execution of some other process. Various debuggers (gdb/lldb/rr) certainly fall into that category, but there's another class of such processes (wine, various emulators) which may want to do that kind of thing. Now, I suspect most of these will have the other process under ptrace control, so maybe allowing (same_mm || ptraced) would be ok, but at least for the sandbox/remote-jit use case, it would be perfectly reasonable to not have the jit server be a ptracer" Robert O'Callahan: "We write to readonly code and data mappings via /proc/.../mem in lots of different situations, particularly when we're adjusting program state during replay to match the recorded execution. Like Julia, we can add workarounds, but they could be expensive." so not only do people use FOLL_FORCE for both reads and writes, but they use it for both the local mm and remote mm. With these comments in mind, we likely also cannot add the "are we actively ptracing" check either, so this keeps the new code organization and does not do a real revert that would add back the original comment about "Maybe we should limit FOLL_FORCE to actual ptrace users?" Reported-by: Keno Fischer Reported-by: Robert O'Callahan Cc: Kees Cook Cc: Andy Lutomirski Cc: Eric Biederman Signed-off-by: Linus Torvalds fs/proc/base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e4dc2b32df5573b077f6723e01cf761d236d5113 Author: Keith Busch Date: Tue May 30 14:39:11 2017 -0400 blk-mq: Take tagset lock when updating hw queues The tagset lock needs to be held when iterating the tag_list, so a lockdep assert was added when updating number of hardware queues. The drivers calling this API, however, were unaware of the new requirement, so are failing the assertion. This patch takes the lock within the blk-mq function so the drivers do not have to be modified in order to be safe. Fixes: 705cda97e ("blk-mq: Make it safe to use RCU to iterate over blk_mq_tag_set.tag_list") Reported-by: Gabriel Krisman Bertazi Reviewed-by: Bart Van Assche Signed-off-by: Keith Busch Signed-off-by: Jens Axboe block/blk-mq.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) commit b9565077ae6c8695e3668071b109aecfbf8537c3 Merge: f0d7ae9 1775675 Author: David S. Miller Date: Tue May 30 14:18:16 2017 -0400 Merge branch 'mlx4-mlx5-MAINTAINERS-update' Tariq Toukan says: ==================== MAINTAINERS updates This patchset contains updates to the MAINTAINERS file. In the first patch, I replace Yishai as the maintainer of the mlx4_core driver. In the other two patches we move an RDMA header file from the list of the mlx4/mlx5 core driver into the respective IB driver, where it belongs. Series generated against net commit: 468b0df61a51 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf ==================== Signed-off-by: David S. Miller commit 177567580aa1c3ec6e900b25280a52f02f93469f Author: Tariq Toukan Date: Tue May 30 11:44:06 2017 +0300 MAINTAINERS: Move mlx5 rdma header file to IB driver charge It belongs there, should not be under mlx5 Core driver. Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 39acf4e242621bd2b5d992a7ef2fd3358065d576 Author: Tariq Toukan Date: Tue May 30 11:44:05 2017 +0300 MAINTAINERS: Move mlx4 rdma header file to IB driver charge It belongs there, should not be under mlx4 Core driver. Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5a1d08726230ead4817e9c22f2736b9ff21bf6af Author: Tariq Toukan Date: Tue May 30 11:44:04 2017 +0300 MAINTAINERS: Update MELLANOX MLX4 core VPI driver maintainer Add myself as a maintainer for mlx4 core driver, replacing Yishai Hadas. Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f0d7ae95fff4ab444b8433f07afc4b077ef1a285 Author: Arnd Bergmann Date: Mon May 29 15:00:17 2017 +0200 net/mlx5: avoid build warning for uniprocessor Building the driver with CONFIG_SMP disabled results in a harmless warning: ethernet/mellanox/mlx5/core/main.c: In function 'mlx5_irq_set_affinity_hint': ethernet/mellanox/mlx5/core/main.c:615:6: error: unused variable 'irq' [-Werror=unused-variable] It's better to express the conditional compilation using IS_ENABLED() here, as that lets the compiler see what the intented use for the variable is, and that it can be silently discarded. Fixes: b665d98edc9a ("net/mlx5: Tolerate irq_set_affinity_hint() failures") Signed-off-by: Arnd Bergmann Acked-by: Saeed Mahameed Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx5/core/main.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 59b2c3140f329e5817197f84860f3fa61a742fdf Author: Arnd Bergmann Date: Mon May 29 14:56:01 2017 +0200 net: dsa: mv88e6xxx: Add missing static to stub functions 'static' was not enough, the helpers must be 'static inline' net/dsa/mv88e6xxx/global2.h:123:12: error: 'mv88e6xxx_g2_misc_4_bit_port' defined but not used [-Werror=unused-function] net/dsa/mv88e6xxx/global2.h:117:12: error: 'mv88e6xxx_g2_pvt_write' defined but not used [-Werror=unused-function] Fixes: c21fbe29f858 ("net: dsa: mv88e6xxx: Add missing static to stub functions") Signed-off-by: Arnd Bergmann Reviewed-by: Vivien Didelot Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx/global2.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 512c7840cd692fdac0333684249753ebf3c819f9 Author: Mintz, Yuval Date: Mon May 29 11:24:49 2017 +0300 qed: Don't log missing periodic stats by default Current implementation lacks the logic for providing management firmware with RDMA-related statistics; [much] worse than that - it logs such events by default to system logs. Since the statistics' gathering is done periodically, using sufficiently new management firmware the system logs would get filled with these unnecessary prints. For now, reduce the verbosity of the log so that it would not be logged by default. Fixes: 6c75424612a7 ("qed: Add support for NCSI statistics") Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 5ee6842cd8aff517701549463927cb1e5eb50b01 Author: Madalin Bucur Date: Mon May 29 09:22:06 2017 +0300 Documentation: networking: add DPAA Ethernet document Signed-off-by: Madalin Bucur Signed-off-by: Camelia Groza Signed-off-by: David S. Miller Documentation/networking/dpaa.txt | 194 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 194 insertions(+) commit 025d0973a0ec2121c6fd0da59e8cc3829fbb221e Author: Guilherme G. Piccoli Date: Sun May 28 23:07:01 2017 -0300 cxgb4: avoid crash on PCI error recovery path During PCI error recovery process, specifically on eeh_err_detected() we might have a NULL netdev struct, hence a direct dereference will lead to a kernel oops. This was observed with latest upstream kernel (v4.12-rc2) on Chelsio adapter T422-CR in PowerPC machines. This patch checks for NULL pointer and avoids the crash, both in eeh_err_detected() and eeh_resume(). Also, we avoid to trigger a fatal error or to try disabling interrupts on FW during PCI error recovery, because: (a) driver might not be able to accurately access PCI regions in this case, and (b) trigger a fatal error _during_ the recovery steps is a mistake that could prevent the recovery path to complete successfully. Reported-by: Harsha Thyagaraja Signed-off-by: Guilherme G. Piccoli Signed-off-by: David S. Miller drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 21 +++++++++++++-------- drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 9 +++++++-- 2 files changed, 20 insertions(+), 10 deletions(-) commit 8eae9570d1d3887487be0b355d12656b46fac226 Author: Gioh Kim Date: Tue May 30 15:24:45 2017 +0200 KVM: SVM: ignore type when setting segment registers Commit 19bca6ab75d8 ("KVM: SVM: Fix cross vendor migration issue with unusable bit") added checking type when setting unusable. So unusable can be set if present is 0 OR type is 0. According to the AMD processor manual, long mode ignores the type value in segment descriptor. And type can be 0 if it is read-only data segment. Therefore type value is not related to unusable flag. This patch is based on linux-next v4.12.0-rc3. Signed-off-by: Gioh Kim Signed-off-by: Paolo Bonzini arch/x86/kvm/svm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cbf712792b6e61317b93dd56dd5c0784363c9ac9 Author: Radim Krčmář Date: Fri May 19 15:48:51 2017 +0200 KVM: nVMX: fix nested_vmx_check_vmptr failure paths under debugging kvm_skip_emulated_instruction() will return 0 if userspace is single-stepping the guest. kvm_skip_emulated_instruction() uses return status convention of exit handler: 0 means "exit to userspace" and 1 means "continue vm entries". The problem is that nested_vmx_check_vmptr() return status means something else: 0 is ok, 1 is error. This means we would continue executing after a failure. Static checker noticed it because vmptr was not initialized. Reported-by: Dan Carpenter Fixes: 6affcbedcac7 ("KVM: x86: Add kvm_skip_emulated_instruction and use it.") Signed-off-by: Radim Krčmář Signed-off-by: Paolo Bonzini arch/x86/kvm/vmx.c | 140 ++++++++++++++++++++++------------------------------- 1 file changed, 57 insertions(+), 83 deletions(-) commit fa9765323a93473d3853d04c9903958453c92ad4 Author: Ilya Dryomov Date: Tue May 23 17:49:55 2017 +0200 nbd: don't leak nbd_config nbd_config is allocated in nbd_alloc_config(), but never freed. Fixes: 5ea8d10802ec ("nbd: separate out the config information") Signed-off-by: Ilya Dryomov Reviewed-by: Josef Bacik Signed-off-by: Jens Axboe drivers/block/nbd.c | 1 + 1 file changed, 1 insertion(+) commit af622b86665881ffa96bc77fb89c94fae02cfa6b Author: Ilya Dryomov Date: Tue May 23 17:49:54 2017 +0200 nbd: nbd_reset() call in nbd_dev_add() is redundant There is nothing to clear -- nbd_device has just been allocated. Fold nbd_reset() into its other caller, nbd_config_put(). Signed-off-by: Ilya Dryomov Reviewed-by: Josef Bacik Signed-off-by: Jens Axboe drivers/block/nbd.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) commit 477c50e8dc1c7b5004e099b8b74ca8b70be2f4fd Author: Wei Huang Date: Tue May 30 11:56:22 2017 +0100 drivers/perf: arm_pmu_acpi: avoid perf IRQ init when guest PMU is off We saw perf IRQ init failures when running Linux kernel in an ACPI guest without PMU (i.e. pmu=off). This is because perf IRQ is not present when pmu=off, but arm_pmu_acpi still tries to register or unregister GSI. This patch addresses the problem by checking gicc->performance_interrupt. If it is 0, which is the value set by qemu when pmu=off, we skip the IRQ register/unregister process. [ 4.069470] bc00: 0000000000040b00 ffff0000089db190 [ 4.070267] [] enable_percpu_irq+0xdc/0xe4 [ 4.071192] [] arm_perf_starting_cpu+0x108/0x10c [ 4.072200] [] cpuhp_invoke_callback+0x14c/0x4ac [ 4.073210] [] cpuhp_thread_fun+0xd4/0x11c [ 4.074132] [] smpboot_thread_fn+0x1b4/0x1c4 [ 4.075081] [] kthread+0x10c/0x138 [ 4.075921] [] ret_from_fork+0x10/0x50 [ 4.076947] genirq: Setting trigger mode 4 for irq 43 failed (gic_set_type+0x0/0x74) Signed-off-by: Wei Huang [will: add comment justifying deviation from ACPI spec, removed redundant hunk] Signed-off-by: Will Deacon Signed-off-by: Catalin Marinas drivers/perf/arm_pmu_acpi.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit f434b1c4aba5cc4e5bae4399a965b5fd14011d69 Author: Sekhar Nori Date: Thu May 25 15:08:07 2017 +0530 MAINTAINERS: add device-tree files to TI DaVinci entry Add device-tree files relevant to TI DaVinci platform to its entry so mach-davinci sub-arch maintainers get copied on patches with device-tree file updates. Signed-off-by: Sekhar Nori MAINTAINERS | 1 + 1 file changed, 1 insertion(+) commit d3e01c51598b2639a4830549058500e5f2ace86f Author: Sricharan R Date: Sat May 27 19:17:45 2017 +0530 arm: dma-mapping: Reset the device's dma_ops arch_teardown_dma_ops() being the inverse of arch_setup_dma_ops() ,dma_ops should be cleared in the teardown path. Currently, only the device's iommu mapping structures are cleared in arch_teardown_dma_ops, but not the dma_ops. So on the next reprobe, dma_ops left in place is stale from the first IOMMU setup, but iommu mappings has been disposed of. This is a problem when the probe of the device is deferred and recalled with the IOMMU probe deferral. So for fixing this, slightly refactor by moving the code from __arm_iommu_detach_device to arm_iommu_detach_device and cleanup the former. This takes care of resetting the dma_ops in the teardown path. Fixes: 09515ef5ddad ("of/acpi: Configure dma operations at probe time for platform/amba/pci bus devices") Reviewed-by: Laurent Pinchart Signed-off-by: Sricharan R Signed-off-by: Joerg Roedel arch/arm/mm/dma-mapping.c | 25 ++++++++++--------------- 1 file changed, 10 insertions(+), 15 deletions(-) commit 4dac3210c54a04be9c187dd31b4debb46e3d792b Author: Lorenzo Pieralisi Date: Sat May 27 19:17:44 2017 +0530 ACPI/IORT: Move the check to get iommu_ops from translated fwspec With IOMMU probe deferral, iort_iommu_configure can be called multiple times for the same device. Hence we have a check to see if the device's fwspec is already translated and return the iommu_ops from that directly. But the check is wrongly placed in iort_iommu_xlate, which breaks devices with multiple sids. Move the check to iort_iommu_configure. Fixes: 5a1bb638d567 ("drivers: acpi: Handle IOMMU lookup failure with deferred probing or error") Tested-by: Nate Watterson Signed-off-by: Lorenzo Pieralisi Signed-off-by: Joerg Roedel drivers/acpi/arm64/iort.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) commit a93a121a96531b99d6feb8db96417b49e1bb28e8 Author: Laurent Pinchart Date: Sat May 27 19:17:43 2017 +0530 ARM: dma-mapping: Don't tear down third-party mappings arch_setup_dma_ops() is used in device probe code paths to create an IOMMU mapping and attach it to the device. The function assumes that the device is attached to a device-specific IOMMU instance (or at least a device-specific TLB in a shared IOMMU instance) and thus creates a separate mapping for every device. On several systems (Renesas R-Car Gen2 being one of them), that assumption is not true, and IOMMU mappings must be shared between multiple devices. In those cases the IOMMU driver knows better than the generic ARM dma-mapping layer and attaches mapping to devices manually with arm_iommu_attach_device(), which sets the DMA ops for the device. The arch_setup_dma_ops() function takes this into account and bails out immediately if the device already has DMA ops assigned. However, the corresponding arch_teardown_dma_ops() function, called from driver unbind code paths (including probe deferral), will tear the mapping down regardless of who created it. When the device is reprobed arch_setup_dma_ops() will be called again but won't perform any operation as the DMA ops will still be set. We need to reset the DMA ops in arch_teardown_dma_ops() to fix this. However, we can't do so unconditionally, as then a new mapping would be created by arch_setup_dma_ops() when the device is reprobed, regardless of whether the device needs to share a mapping or not. We must thus keep track of whether arch_setup_dma_ops() created the mapping, and only in that case tear it down in arch_teardown_dma_ops(). Keep track of that information in the dev_archdata structure. As the structure is embedded in all instances of struct device let's not grow it, but turn the existing dma_coherent bool field into a bitfield that can be used for other purposes. Fixes: 09515ef5ddad ("of/acpi: Configure dma operations at probe time for platform/amba/pci bus devices") Reviewed-by: Robin Murphy Signed-off-by: Laurent Pinchart Signed-off-by: Joerg Roedel arch/arm/include/asm/device.h | 3 ++- arch/arm/mm/dma-mapping.c | 4 ++++ 2 files changed, 6 insertions(+), 1 deletion(-) commit 058f8c3fb44d028ba44c2e3635d8bee9787018d6 Author: Sricharan R Date: Sat May 27 19:17:42 2017 +0530 ACPI/IORT: Ignore all errors except EPROBE_DEFER While deferring the probe of IOMMU masters, xlate and add_device callbacks called from iort_iommu_configure can pass back error values like -ENODEV, which means the IOMMU cannot be connected with that master for real reasons. Before the IOMMU probe deferral, all such errors were ignored. Now all those errors are propagated back, killing the master's probe for such errors. Instead ignore all the errors except EPROBE_DEFER, which is the only one of concern and let the master work without IOMMU, thus restoring the old behavior. Also make explicit that acpi_dma_configure handles only -EPROBE_DEFER from iort_iommu_configure. Fixes: 5a1bb638d567 ("drivers: acpi: Handle IOMMU lookup failure with deferred probing or error") Signed-off-by: Sricharan R Signed-off-by: Joerg Roedel drivers/acpi/arm64/iort.c | 6 ++++++ drivers/acpi/scan.c | 4 ++-- 2 files changed, 8 insertions(+), 2 deletions(-) commit a37b19a384914c60b7e1264a6c21e7bf96b637e8 Author: Sricharan R Date: Sat May 27 19:17:41 2017 +0530 iommu/of: Ignore all errors except EPROBE_DEFER While deferring the probe of IOMMU masters, xlate and add_device callbacks called from of_iommu_configure can pass back error values like -ENODEV, which means the IOMMU cannot be connected with that master for real reasons. Before the IOMMU probe deferral, all such errors were ignored. Now all those errors are propagated back, killing the master's probe for such errors. Instead ignore all the errors except EPROBE_DEFER, which is the only one of concern and let the master work without IOMMU, thus restoring the old behavior. Also make explicit that of_dma_configure handles only -EPROBE_DEFER from of_iommu_configure. Fixes: 7b07cbefb68d ("iommu: of: Handle IOMMU lookup failure with deferred probing or error") Reported-by: Geert Uytterhoeven Tested-by: Magnus Damn Signed-off-by: Sricharan R Signed-off-by: Joerg Roedel drivers/iommu/of_iommu.c | 6 ++++++ drivers/of/device.c | 4 ++-- 2 files changed, 8 insertions(+), 2 deletions(-) commit 573d41757c47cb71cd572236685d4c9e6cacc06c Author: Sricharan R Date: Sat May 27 19:17:40 2017 +0530 iommu/of: Fix check for returning EPROBE_DEFER Now with IOMMU probe deferral, we return -EPROBE_DEFER for masters that are connected to an IOMMU which is not probed yet, but going to get probed, so that we can attach the correct dma_ops. So while trying to defer the probe of the master, check if the of_iommu node that it is connected to is marked in DT as 'status=disabled', then the IOMMU is never is going to get probed. So simply return NULL and let the master work without an IOMMU. Fixes: 7b07cbefb68d ("iommu: of: Handle IOMMU lookup failure with deferred probing or error") Reported-by: Geert Uytterhoeven Reviewed-by: Laurent Pinchart Tested-by: Will Deacon Tested-by: Magnus Damn Acked-by: Will Deacon Signed-off-by: Sricharan R Signed-off-by: Joerg Roedel drivers/iommu/of_iommu.c | 1 + 1 file changed, 1 insertion(+) commit 4b1c88984c8ac894c2c411570757bed7fa5f3226 Author: Arnd Bergmann Date: Thu May 18 15:13:57 2017 +0200 iommu/dma: Fix function declaration Newly added code in the ipmmu-vmsa driver showed a small mistake in a header file that can't be included by itself without CONFIG_IOMMU_DMA enabled: In file included from drivers/iommu/ipmmu-vmsa.c:13:0: include/linux/dma-iommu.h:105:94: error: 'struct device' declared inside parameter list will not be visible outside of this definition or declaration [-Werror] This adds a forward declaration for 'struct device', similar to how we treat the other struct types in this case. Fixes: 3ae47292024f ("iommu/ipmmu-vmsa: Add new IOMMU_DOMAIN_DMA ops") Fixes: 273df9635385 ("iommu/dma: Make PCI window reservation generic") Signed-off-by: Arnd Bergmann Acked-by: Robin Murphy Signed-off-by: Joerg Roedel include/linux/dma-iommu.h | 1 + 1 file changed, 1 insertion(+) commit 7a7c0a6438b8e7636d5a22e572892cc234f68297 Author: Johannes Berg Date: Sat May 27 00:27:25 2017 +0200 mac80211: fix TX aggregation start/stop callback race When starting or stopping an aggregation session, one of the steps is that the driver calls back to mac80211 that the start/stop can proceed. This is handled by queueing up a fake SKB and processing it from the normal iface/sdata work. Since this isn't flushed when disassociating, the following race is possible: * associate * start aggregation session * driver callback * disassociate * associate again to the same AP * callback processing runs, leading to a WARN_ON() that the TID hadn't requested aggregation If the second association isn't to the same AP, there would only be a message printed ("Could not find station: "), but the same race could happen. Fix this by not going the whole detour with a fake SKB etc. but simply looking up the aggregation session in the driver callback, marking it with a START_CB/STOP_CB bit and then scheduling the regular aggregation work that will now process these bits as well. This also simplifies the code and gets rid of the whole problem with allocation failures of said skb, which could have left the session in limbo. Reported-by: Jouni Malinen Signed-off-by: Johannes Berg net/mac80211/agg-tx.c | 128 ++++++++++++++++++--------------------------- net/mac80211/ht.c | 16 ++++-- net/mac80211/ieee80211_i.h | 14 ++--- net/mac80211/iface.c | 11 +--- net/mac80211/sta_info.h | 2 + 5 files changed, 71 insertions(+), 100 deletions(-) commit 56b177055adb246cdeca174331dbf92fc49bfccd Author: Kuninori Morimoto Date: Tue May 23 07:08:43 2017 +0000 rcar-dmac: fixup descriptor pointer for descriptor mode In descriptor mode, the descriptor running pointer is not maintained by the interrupt handler, thus, driver finds the running descriptor from the descriptor pointer field in the CHCRB register. But, CHCRB::DPTR indicates *next* descriptor pointer, not current. Thus, The residue calculation will be missed. This patch fixup it. Signed-off-by: Kuninori Morimoto Signed-off-by: Vinod Koul drivers/dma/sh/rcar-dmac.c | 3 +++ 1 file changed, 3 insertions(+) commit 468b0df61a5146e79f63380ad6c36228fd30619c Merge: c21fbe2 fefa926 Author: David S. Miller Date: Mon May 29 23:16:54 2017 -0400 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for your net tree, they are: 1) Conntrack SCTP CRC32c checksum mangling may operate on non-linear skbuff, patch from Davide Caratti. 2) nf_tables rb-tree set backend does not handle element re-addition after deletion in the same transaction, leading to infinite loop. 3) Atomically unclear the IPS_SRC_NAT_DONE_BIT on nat module removal, from Liping Zhang. 4) Conntrack hashtable resizing while ctnetlink dump is progress leads to a dead reference to released objects in the lists, also from Liping. ==================== Signed-off-by: David S. Miller commit 2fef826e45c6a1e63f55ab72546f7d795300d9a8 Author: Benjamin Tissoires Date: Fri May 26 16:51:19 2017 -0700 Input: synaptics - tell users to report when they should be using rmi-smbus Users should really consider switching to rmi-smbus instead of plain PS/2. Notify them that they should report a missing pnpID in the file. Signed-off-by: Benjamin Tissoires Signed-off-by: Dmitry Torokhov drivers/input/mouse/synaptics.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) commit f4101ff87dafd22fbcc3547fd3a3a3717d3d72d3 Author: Benjamin Tissoires Date: Fri May 26 16:21:36 2017 -0700 Input: synaptics - warn the users when there is a better mode The Synaptics touchpads are now either using i2c-hid or rmi-smbus. Warn the users if they are missing the rmi-smbus modules and have no chance of reporting correct data. Signed-off-by: Benjamin Tissoires Signed-off-by: Dmitry Torokhov drivers/input/mouse/synaptics.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) commit f4947d79a7080b25829997eeee38d4d65137c161 Author: Benjamin Tissoires Date: Tue May 23 14:15:24 2017 -0700 Input: synaptics - keep PS/2 around when RMI4_SMB is not enabled Or the user might have the touchpad unbound from PS/2 but never picked up by rmi-smbus.ko Signed-off-by: Benjamin Tissoires Signed-off-by: Dmitry Torokhov drivers/input/mouse/synaptics.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 2755551188d240f0098cdc6f1a2984f8a1785689 Author: Eric Biggers Date: Mon May 29 19:57:19 2017 -0700 Input: synaptics - clear device info before filling in synaptics_query_hardware() was being passed a 'struct synaptics_device_info' in uninitialized stack memory, then not always initializing all fields. This caused garbage to show up in certain fields, making the touchpad unusable. Fix by zeroing the device info, so all fields default to 0. Fixes: 6c53694fb222 ("Input: synaptics - split device info into a separate structure") Signed-off-by: Eric Biggers Signed-off-by: Dmitry Torokhov drivers/input/mouse/synaptics.c | 2 ++ 1 file changed, 2 insertions(+) commit 1943d1723e7a7ee1a7b9b0ba4878dde0dc100671 Author: Hans de Goede Date: Fri May 26 16:09:48 2017 -0700 Input: silead - disable interrupt during suspend When we put the touchscreen controller in low-power mode the irq pin may trigger (float) and if we then try to read a data packet we get the following error in dmesg: [ 478.801017] silead_ts i2c-MSSL1680:00: Data read error -121 This commit disables the irq during suspend/resume fixing this error. Signed-off-by: Hans de Goede Signed-off-by: Dmitry Torokhov drivers/input/touchscreen/silead.c | 3 +++ 1 file changed, 3 insertions(+) commit 7575f8257279f9dd24b3fc950aa2c7e98564a103 Author: Arvind Yadav Date: Wed May 17 12:20:35 2017 +0530 cpufreq: kirkwood-cpufreq:- Handle return value of clk_prepare_enable() clk_prepare_enable() can fail here and we must check its return value. Signed-off-by: Arvind Yadav Acked-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki drivers/cpufreq/kirkwood-cpufreq.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) commit 6c77003677d5f1ce15f26d24360cb66c0bc07bb3 Author: David Arcari Date: Fri May 26 11:37:31 2017 -0400 cpufreq: cpufreq_register_driver() should return -ENODEV if init fails For a driver that does not set the CPUFREQ_STICKY flag, if all of the ->init() calls fail, cpufreq_register_driver() should return an error. This will prevent the driver from loading. Fixes: ce1bcfe94db8 (cpufreq: check cpufreq_policy_list instead of scanning policies for all CPUs) Cc: 4.0+ # 4.0+ Signed-off-by: David Arcari Acked-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki drivers/cpufreq/cpufreq.c | 1 + 1 file changed, 1 insertion(+) commit 2ea65321b83539afc1d45c1bea39c55ab42af62b Author: Lv Zheng Date: Tue May 9 13:57:31 2017 +0800 ACPICA: Tables: Fix regression introduced by a too early mechanism enabling In the Linux kernel, acpi_get_table() "clones" haven't been fully balanced by acpi_put_table() invocations. In upstream ACPICA, due to the design change, there are also unbalanced acpi_get_table_by_index() invocations requiring special care. acpi_get_table() reference counting mismatches may occor due to that and printing error messages related to them is not useful at this point. The strict balanced validation count check should only be enabled after confirming that all invocations are safe and aligned with their designed purposes. Thus this patch removes the error value returned by acpi_tb_get_table() in that case along with the accompanying error message to fix the issue. Fixes: 174cc7187e6f (ACPICA: Tables: Back port acpi_get_table_with_size() and early_acpi_os_unmap_memory() from Linux kernel) Cc: 4.10+ # 4.10+ Reported-by: Anush Seetharaman Reported-by: Dan Williams Signed-off-by: Lv Zheng [ rjw: Changelog ] Signed-off-by: Rafael J. Wysocki drivers/acpi/acpica/tbutils.c | 4 ---- 1 file changed, 4 deletions(-) commit 878d8db039daac0938238e9a40a5bd6e50ee3c9b Author: Benjamin Tissoires Date: Wed May 10 18:12:40 2017 +0200 Revert "ACPI / button: Change default behavior to lid_init_state=open" Revert commit 77e9a4aa9de1 (ACPI / button: Change default behavior to lid_init_state=open) which changed the kernel's behavior on laptops that boot with closed lids and expect the lid switch state to be reported accurately by the kernel. If you boot or resume your laptop with the lid closed on a docking station while using an external monitor connected to it, both internal and external displays will light on, while only the external should. There is a design choice in gdm to only provide the greeter on the internal display when lit on, so users only see a gray area on the external monitor. Also, the cursor will not show up as it's by default on the internal display too. To "fix" that, users have to open the laptop once and close it once again to sync the state of the switch with the hardware state. Even if the "method" operation mode implementation can be buggy on some platforms, the "open" choice is worse. It breaks docking stations basically and there is no way to have a user-space hwdb to fix that. On the contrary, it's rather easy in user-space to have a hwdb with the problematic platforms. Then, libinput (1.7.0+) can fix the state of the lid switch for us: you need to set the udev property LIBINPUT_ATTR_LID_SWITCH_RELIABILITY to 'write_open'. When libinput detects internal keyboard events, it will overwrite the state of the switch to open, making it reliable again. Given that logind only checks the lid switch value after a timeout, we can assume the user will use the internal keyboard before this timeout expires. For example, such a hwdb entry is: libinput:name:*Lid Switch*:dmi:*svnMicrosoftCorporation:pnSurface3:* LIBINPUT_ATTR_LID_SWITCH_RELIABILITY=write_open Link: https://bugzilla.gnome.org/show_bug.cgi?id=782380 Cc: 4.11+ # 4.11+ Signed-off-by: Benjamin Tissoires Signed-off-by: Rafael J. Wysocki drivers/acpi/button.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 67a7d5f561f469ad2fa5154d2888258ab8e6df7c Author: Jan Kara Date: Mon May 29 13:24:55 2017 -0400 ext4: fix fdatasync(2) after extent manipulation operations Currently, extent manipulation operations such as hole punch, range zeroing, or extent shifting do not record the fact that file data has changed and thus fdatasync(2) has a work to do. As a result if we crash e.g. after a punch hole and fdatasync, user can still possibly see the punched out data after journal replay. Test generic/392 fails due to these problems. Fix the problem by properly marking that file data has changed in these operations. CC: stable@vger.kernel.org Fixes: a4bb6b64e39abc0e41ca077725f2a72c868e7622 Signed-off-by: Jan Kara Signed-off-by: Theodore Ts'o fs/ext4/extents.c | 5 +++++ fs/ext4/inode.c | 2 ++ 2 files changed, 7 insertions(+) commit 3f173bde7e4320211e77a83f936fb754e7591006 Merge: b0f5a8f 7903d4f Author: Linus Torvalds Date: Mon May 29 10:05:19 2017 -0700 Merge tag 'pinctrl-v4.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: "Here is an overdue pull request for pin control fixes, the most prominent feature is to make Intel Chromebooks (and I suspect any other Cherryview-based Intel thing) happy again, which we really want to see. There is a patch hitting drivers/firmware/* that I was uncertain to who actually manages, but I got Andy Shevchenko's and Dmitry Torokov's review tags on it and I trust them both 100% to do the right thing for Intel platform drivers. Summary: - Make a few Intel Chromebooks with Cherryview DMI firmware work smoothly. - A fix for some bogus allocations in the generic group management code. - Some GPIO descriptor lookup table stubs. Merged through the pin control tree for administrative reasons. - Revert the "bi-directional" and "output-enable" generic properties: we need more discussions around this. It seems other SoCs are using input/output gate enablement and these terms are not correct. - Fix mux and drive strength atomically in the MXS driver. - Fix the SPDIF function on sunxi A83T. - OF table terminators and other small fixes" * tag 'pinctrl-v4.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: sunxi: Fix SPDIF function name for A83T pinctrl: mxs: atomically switch mux and drive strength config pinctrl: cherryview: Extend the Chromebook DMI quirk to Intel_Strago systems firmware: dmi: Add DMI_PRODUCT_FAMILY identification string pinctrl: core: Fix warning by removing bogus code gpiolib: Add stubs for gpiod lookup table interface Revert "pinctrl: generic: Add bi-directional and output-enable" pinctrl: cherryview: Add terminate entry for dmi_system_id tables commit b0f5a8f32e8bbdaae1abb8abe2d3cbafaba57e08 Author: Vegard Nossum Date: Mon May 29 09:22:07 2017 +0200 kthread: fix boot hang (regression) on MIPS/OpenRISC This fixes a regression in commit 4d6501dce079 where I didn't notice that MIPS and OpenRISC were reinitialising p->{set,clear}_child_tid to NULL after our initialisation in copy_process(). We can simply get rid of the arch-specific initialisation here since it is now always done in copy_process() before hitting copy_thread{,_tls}(). Review notes: - As far as I can tell, copy_process() is the only user of copy_thread_tls(), which is the only caller of copy_thread() for architectures that don't implement copy_thread_tls(). - After this patch, there is no arch-specific code touching p->set_child_tid or p->clear_child_tid whatsoever. - It may look like MIPS/OpenRISC wanted to always have these fields be NULL, but that's not true, as copy_process() would unconditionally set them again _after_ calling copy_thread_tls() before commit 4d6501dce079. Fixes: 4d6501dce079c1eb6bf0b1d8f528a5e81770109e ("kthread: Fix use-after-free if kthread fork fails") Reported-by: Guenter Roeck Tested-by: Guenter Roeck # MIPS only Acked-by: Stafford Horne Acked-by: Oleg Nesterov Cc: Ralf Baechle Cc: linux-mips@linux-mips.org Cc: Jonas Bonn Cc: Stefan Kristiansson Cc: openrisc@lists.librecores.org Cc: Jamie Iles Cc: Thomas Gleixner Signed-off-by: Vegard Nossum Signed-off-by: Linus Torvalds arch/mips/kernel/process.c | 1 - arch/openrisc/kernel/process.c | 2 -- 2 files changed, 3 deletions(-) commit a082c6f680da298cf075886ff032f32ccb7c5e1a Author: Miklos Szeredi Date: Mon May 29 15:15:27 2017 +0200 ovl: filter trusted xattr for non-admin Filesystems filter out extended attributes in the "trusted." domain for unprivlieged callers. Overlay calls underlying filesystem's method with elevated privs, so need to do the filtering in overlayfs too. Signed-off-by: Miklos Szeredi fs/overlayfs/inode.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) commit f3d3eab667de62572376abb1aa26316191c39929 Author: Hans de Goede Date: Tue May 9 10:04:36 2017 +0200 HID: i2c: Call acpi_device_fix_up_power for ACPI-enumerated devices For ACPI devices which do not have a _PSC method, the ACPI subsys cannot query their initial state at boot, so these devices are assumed to have been put in D0 by the BIOS, but for touchscreens that is not always true. This commit adds a call to acpi_device_fix_up_power to explicitly put devices without a _PSC method into D0 state (for devices with a _PSC method it is a nop). Note we only need to do this on probe, after a resume the ACPI subsys knows the device is in D3 and will properly put it in D0. This fixes the SIS0817 i2c-hid touchscreen on a Peaq C1010 2-in-1 device failing to probe with a "hid_descr_cmd failed" error. Acked-by: Benjamin Tissoires Signed-off-by: Hans de Goede Signed-off-by: Jiri Kosina drivers/hid/i2c-hid/i2c-hid.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit b31e85eda38c58cae986162ae2c462b53b0a2065 Author: Jani Nikula Date: Thu May 18 14:10:25 2017 +0300 drm/i915: Detect USB-C specific dongles before reducing M and N The Analogix 7737 DP to HDMI converter requires reduced M and N values when to operate correctly at HBR2. We tried to reduce the M/N values for all devices in commit 9a86cda07af2 ("drm/i915/dp: reduce link M/N parameters"), but that regressed some other sinks. Detect this IC by its OUI value of 0x0022B9 via the DPCD quirk list, and only reduce the M/N values for that. v2 by Jani: Rebased on the DP quirk database v3 by Jani: Rebased on the reworked DP quirk database v4 by Jani: Improve commit message (Daniel) Fixes: 9a86cda07af2 ("drm/i915/dp: reduce link M/N parameters") Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=93578 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=100755 Cc: Jani Nikula Cc: Dhinakaran Pandiyan Cc: Ville Syrjälä Reviewed-by: Daniel Vetter Signed-off-by: Clint Taylor Signed-off-by: Jani Nikula Link: http://patchwork.freedesktop.org/patch/msgid/2d2e30f8f47d3f28c9b74ca2612336a54585c3ec.1495105635.git.jani.nikula@intel.com drivers/gpu/drm/i915/i915_drv.h | 3 ++- drivers/gpu/drm/i915/intel_display.c | 22 ++++++++++++++-------- drivers/gpu/drm/i915/intel_dp.c | 8 ++++++-- drivers/gpu/drm/i915/intel_dp_mst.c | 5 ++++- 4 files changed, 26 insertions(+), 12 deletions(-) commit 76fa998acd86b6b40d0217e12af39c2406bdcd2b Author: Jani Nikula Date: Thu May 18 14:10:24 2017 +0300 drm/dp: start a DPCD based DP sink/branch device quirk database Face the fact, there are Display Port sink and branch devices out there in the wild that don't follow the Display Port specifications, or they have bugs, or just otherwise require special treatment. Start a common quirk database the drivers can query based on the DP device identification. At least for now, we leave the workarounds for the drivers to implement as they see fit. For starters, add a branch device that can't handle full 24-bit main link Mdiv and Ndiv main link attributes properly. Naturally, the workaround of reducing main link attributes for all devices ended up in regressions for other devices. So here we are. v2: Rebase on DRM DP desc read helpers v3: Fix the OUI memcmp blunder (Clint) Cc: Ville Syrjälä Cc: Dhinakaran Pandiyan Cc: Clint Taylor Cc: Adam Jackson Cc: Harry Wentland Tested-by: Clinton Taylor Reviewed-by: Clinton Taylor Reviewed-by: Daniel Vetter # v2 Signed-off-by: Jani Nikula Link: http://patchwork.freedesktop.org/patch/msgid/91ec198dd95258dbf3bee2f6be739e0da73b4fdd.1495105635.git.jani.nikula@intel.com drivers/gpu/drm/drm_dp_helper.c | 52 +++++++++++++++++++++++++++++++++++++++-- include/drm/drm_dp_helper.h | 32 +++++++++++++++++++++++++ 2 files changed, 82 insertions(+), 2 deletions(-) commit 84c367533bd24108e5392b355280647a4a2893ac Author: Jani Nikula Date: Thu May 18 14:10:23 2017 +0300 drm/i915: use drm DP helper to read DPCD desc Switch to using the common DP helpers instead of using our own. v2: also remove leftover struct intel_dp_desc (Daniel) Reviewed-by: Daniel Vetter Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_dp.c | 37 ++++--------------------------------- drivers/gpu/drm/i915/intel_drv.h | 13 +------------ drivers/gpu/drm/i915/intel_lspcon.c | 2 +- 3 files changed, 6 insertions(+), 46 deletions(-) commit 118b90f3f18e733c99f0e8b98ea31a815ffc4d14 Author: Jani Nikula Date: Thu May 18 14:10:22 2017 +0300 drm/dp: add helper for reading DP sink/branch device desc from DPCD Reviewed-by: Daniel Vetter Signed-off-by: Jani Nikula Link: http://patchwork.freedesktop.org/patch/msgid/acba54da7d80eafea9e59a893e27e3c31028c0ba.1495105635.git.jani.nikula@intel.com drivers/gpu/drm/drm_dp_helper.c | 35 +++++++++++++++++++++++++++++++++++ include/drm/drm_dp_helper.h | 19 +++++++++++++++++++ 2 files changed, 54 insertions(+) commit f3a1568582cc207663a4d5e37da790334372855b Author: Amir Goldstein Date: Wed May 24 15:29:33 2017 +0300 ovl: mark upper merge dir with type origin entries "impure" An upper dir is marked "impure" to let ovl_iterate() know that this directory may contain non pure upper entries whose d_ino may need to be read from the origin inode. We already mark a non-merge dir "impure" when moving a non-pure child entry inside it, to let ovl_iterate() know not to iterate the non-merge dir directly. Mark also a merge dir "impure" when moving a non-pure child entry inside it and when copying up a child entry inside it. This can be used to optimize ovl_iterate() to perform a "pure merge" of upper and lower directories, merging the content of the directories, without having to read d_ino from origin inodes. Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi fs/overlayfs/copy_up.c | 5 +++++ fs/overlayfs/dir.c | 31 +++++-------------------------- fs/overlayfs/namei.c | 20 -------------------- fs/overlayfs/overlayfs.h | 15 +++++++++++---- fs/overlayfs/super.c | 5 ++++- fs/overlayfs/util.c | 42 +++++++++++++++++++++++++++++++++++------- 6 files changed, 60 insertions(+), 58 deletions(-) commit 6ac56951dc10232e24419f6972fc8131dd0166e0 Author: Ilya Dryomov Date: Mon May 22 19:59:24 2017 +0200 rbd: implement REQ_OP_WRITE_ZEROES Commit 93c1defedcae ("rbd: remove the discard_zeroes_data flag") explicitly didn't implement REQ_OP_WRITE_ZEROES for rbd, while the following commit 48920ff2a5a9 ("block: remove the discard_zeroes_data flag") dropped ->discard_zeroes_data in favor of REQ_OP_WRITE_ZEROES. rbd does support efficient zeroing via CEPH_OSD_OP_ZERO opcode and will release either some or all blocks depending on whether the zeroing request is rbd_obj_bytes() aligned. This is how we currently implement discards, so REQ_OP_WRITE_ZEROES can be identical to REQ_OP_DISCARD for now. Caveats: - REQ_NOUNMAP is ignored, but AFAICT that's true of at least two other current implementations - nvme and loop - there is no ->write_zeroes_alignment and blk_bio_write_zeroes_split() is hence less helpful than blk_bio_discard_split(), but this can (and should) be fixed on the rbd side In the future we will split these into two code paths to respect REQ_NOUNMAP on zeroout and save on zeroing blocks that couldn't be released on discard. Fixes: 93c1defedcae ("rbd: remove the discard_zeroes_data flag") Signed-off-by: Ilya Dryomov Reviewed-by: Jason Dillaman Reviewed-by: Christoph Hellwig drivers/block/rbd.c | 2 ++ 1 file changed, 2 insertions(+) commit cc7a938f5f308eeb6f8fe3cec28e1800aa81facb Author: Arnd Bergmann Date: Wed May 24 17:39:03 2017 +0200 ARM: at91: select CONFIG_ARM_CPU_SUSPEND The reference to cpu_resume requires the corresponding generic code to be enabled when CONFIG_PM is set: arch/arm/mach-at91/pm.o: In function `sama5d2_pm_init': pm.c:(.init.text+0x5e8): undefined reference to `cpu_resume' Fixes: 24a0f5c539f9 ("ARM: at91: pm: Add sama5d2 backup mode") Signed-off-by: Arnd Bergmann Signed-off-by: Alexandre Belloni arch/arm/mach-at91/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 5d9070b1f0fc9a159a9a3240c43004828408444b Author: Borislav Petkov Date: Sun May 28 11:03:42 2017 +0200 x86/debug/32: Convert a smp_processor_id() call to raw to avoid DEBUG_PREEMPT warning ... to raw_smp_processor_id() to not trip the BUG: using smp_processor_id() in preemptible [00000000] code: swapper/0/1 check. The reasoning behind it is that __warn() already uses the raw_ variants but the show_regs() path on 32-bit doesn't. Signed-off-by: Borislav Petkov Cc: Josh Poimboeuf Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/20170528092212.fiod7kygpjm23m3o@pd.tnic Signed-off-by: Ingo Molnar arch/x86/kernel/process_32.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit dac6ca243c4c49a9ca7507d3d66140ebfac8b04b Author: Borislav Petkov Date: Sun May 28 22:04:14 2017 +0200 x86/microcode/AMD: Change load_microcode_amd()'s param to bool to fix preemptibility bug With CONFIG_DEBUG_PREEMPT enabled, I get: BUG: using smp_processor_id() in preemptible [00000000] code: swapper/0/1 caller is debug_smp_processor_id CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.12.0-rc2+ #2 Call Trace: dump_stack check_preemption_disabled debug_smp_processor_id save_microcode_in_initrd_amd ? microcode_init save_microcode_in_initrd ... because, well, it says it above, we're using smp_processor_id() in preemptible code. But passing the CPU number is not really needed. It is only used to determine whether we're on the BSP, and, if so, to save the microcode patch for early loading. [ We don't absolutely need to do it on the BSP but we do that customarily there. ] Instead, convert that function parameter to a boolean which denotes whether the patch should be saved or not, thereby avoiding the use of smp_processor_id() in preemptible code. Signed-off-by: Borislav Petkov Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/20170528200414.31305-1-bp@alien8.de Signed-off-by: Ingo Molnar arch/x86/kernel/cpu/microcode/amd.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) commit 2f2724630f7a8d582470f03ee56b96746767d270 Author: Paul Mackerras Date: Mon May 22 16:25:14 2017 +1000 KVM: PPC: Book3S HV: Cope with host using large decrementer mode POWER9 introduces a new mode for the decrementer register, called large decrementer mode, in which the decrementer counter is 56 bits wide rather than 32, and reads are sign-extended rather than zero-extended. For the decrementer, this new mode is optional and controlled by a bit in the LPCR. The hypervisor decrementer (HDEC) is 56 bits wide on POWER9 and has no mode control. Since KVM code reads and writes the decrementer and hypervisor decrementer registers in a few places, it needs to be aware of the need to treat the decrementer value as a 64-bit quantity, and only do a 32-bit sign extension when large decrementer mode is not in effect. Similarly, the HDEC should always be treated as a 64-bit quantity on POWER9. We define a new EXTEND_HDEC macro to encapsulate the feature test for POWER9 and the sign extension. To enable the sign extension to be removed in large decrementer mode, we test the LPCR_LD bit in the host LPCR image stored in the struct kvm for the guest. If is set then large decrementer mode is enabled and the sign extension should be skipped. This is partly based on an earlier patch by Oliver O'Halloran. Cc: stable@vger.kernel.org # v4.10+ Signed-off-by: Paul Mackerras arch/powerpc/kvm/book3s_hv_interrupts.S | 12 +++++++++++- arch/powerpc/kvm/book3s_hv_rmhandlers.S | 23 +++++++++++++++++------ 2 files changed, 28 insertions(+), 7 deletions(-) commit e379cbee79a8abb8e9b4da63187884939852ddb4 Author: Inki Dae Date: Mon May 29 09:59:05 2017 +0900 drm/exynos: clean up description of exynos_drm_crtc This patch removes unnecessary descriptions on exynos_drm_crtc structure and adds one description which specifies what pipe_clk member does. pipe_clk support had been added by below patch without any description, drm/exynos: add support for pipeline clock to the framework Commit-id : f26b9343f582f44ec920474d71b4b2220b1ed9a8 Signed-off-by: Inki Dae drivers/gpu/drm/exynos/exynos_drm_drv.h | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) commit 70505c2ef94b7584dc24d6eaaeb0fc335b99813a Author: Hoegeun Kwon Date: Fri May 26 10:02:01 2017 +0900 drm/exynos: dsi: Remove bridge node reference in removal Since bridge node is referenced during in the probe, it should be released on removal. Suggested-by: Andrzej Hajda Signed-off-by: Hoegeun Kwon Signed-off-by: Inki Dae drivers/gpu/drm/exynos/exynos_drm_dsi.c | 4 ++++ 1 file changed, 4 insertions(+) commit f2921d8c4899a3d9d7c6326315c24efea2c9efd9 Author: Hoegeun Kwon Date: Thu Apr 13 15:05:26 2017 +0900 drm/exynos: dsi: Fix the parse_dt function The dsi + panel is a parental relationship, so OF grpah is not needed. Therefore, the current dsi_parse_dt function will throw an error, because there is no linked OF graph for the case fimd + dsi + panel. Parse the Pll burst and esc clock frequency properties in dsi_parse_dt() and create a bridge_node only if there is an OF graph associated with dsi. Signed-off-by: Hoegeun Kwon Reviewed-by: Andrzej Hajda Reviewed-by: Andi Shyti Signed-off-by: Inki Dae drivers/gpu/drm/exynos/exynos_drm_dsi.c | 22 +++++----------------- 1 file changed, 5 insertions(+), 17 deletions(-) commit 4013ef48798ae954530bdb8971d3794333e46526 Author: Daniel Vetter Date: Wed Mar 8 15:12:53 2017 +0100 drm/exynos: Merge pre/postclose hooks Again no apparent explanation for the split except hysterical raisins. Cc: Inki Dae Cc: Joonyoung Shim Cc: Seung-Woo Kim Cc: Kyungmin Park Signed-off-by: Daniel Vetter Signed-off-by: Inki Dae drivers/gpu/drm/exynos/exynos_drm_drv.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) commit 5ed02dbb497422bf225783f46e6eadd237d23d6b Author: Linus Torvalds Date: Sun May 28 17:20:53 2017 -0700 Linux 4.12-rc3 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d09bc680ca42ddf3e7b862b95c59af6ef4477840 Merge: 249f1ef a54c518 Author: Linus Torvalds Date: Sun May 28 16:18:27 2017 -0700 Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal Pull thermal SoC management fixes from Eduardo Valentin: - fixes to TI SoC driver, Broadcom, qoriq - small sparse warning fix on thermal core * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal: thermal: broadcom: ns-thermal: default on iProc SoCs ti-soc-thermal: Fix a typo in a comment line ti-soc-thermal: Delete error messages for failed memory allocations in ti_bandgap_build() ti-soc-thermal: Use devm_kcalloc() in ti_bandgap_build() thermal: core: make thermal_emergency_poweroff static thermal: qoriq: remove useless call for of_thermal_get_trip_points() commit 243dd05d39aa14fac2ffde75cc66dee3270896f8 Author: Kees Cook Date: Sat May 6 01:10:06 2017 -0700 mtk-vcodec: Use designated initializers The randstruct plugin requires designated initializers for structures that are entirely function pointers. Cc: Wu-Cheng Li Cc: Tiffany Lin Cc: Hans Verkuil Cc: Mauro Carvalho Chehab Signed-off-by: Kees Cook drivers/media/platform/mtk-vcodec/vdec/vdec_h264_if.c | 8 ++++---- drivers/media/platform/mtk-vcodec/vdec/vdec_vp8_if.c | 8 ++++---- drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c | 8 ++++---- 3 files changed, 12 insertions(+), 12 deletions(-) commit 3ddd396f6b57cbd5cb034498b5c4cd3dd920cf15 Author: Kees Cook Date: Sat May 6 01:09:00 2017 -0700 drm/amd/powerplay: Use designated initializers The randstruct plugin requires designated initializers for structures that are entirely function pointers. Cc: Christian König Cc: Eric Huang Cc: Alex Deucher Signed-off-by: Kees Cook drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) commit 2a9d6d26e2b76eee1064d221b49f3ec527546c53 Author: Kees Cook Date: Sat May 6 00:54:07 2017 -0700 drm/amdgpu: Use designated initializers The randstruct plugin requires structures that are entirely function pointers be initialized using designated initializers. Cc: Alex Deucher Cc: Christian König Signed-off-by: Kees Cook drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 234041dfe5ca83d5c8122ec1999eaf3f00335d7b Author: Kees Cook Date: Tue Apr 4 22:07:10 2017 -0700 sgi-xp: Use designated initializers Prepare to mark sensitive kernel structures for randomization by making sure they're using designated initializers. In this case, no initializers are needed (they can be NULL initialized and callers adjusted to check for NULL, which is more efficient than an indirect call). Cc: Robin Holt Signed-off-by: Kees Cook Reviewed-by: Christoph Hellwig drivers/misc/sgi-xp/xp.h | 12 +++++++++++- drivers/misc/sgi-xp/xp_main.c | 36 +++++++----------------------------- 2 files changed, 18 insertions(+), 30 deletions(-) commit 7585d12f6555fdf4faaefec34ac58b28555b27d0 Author: Kees Cook Date: Mon May 8 14:49:27 2017 -0700 ocfs2: Use ERR_CAST() to avoid cross-structure cast When trying to propagate an error result, the error return path attempts to retain the error, but does this with an open cast across very different types, which the upcoming structure layout randomization plugin flags as being potentially dangerous in the face of randomization. This is a false positive, but what this code actually wants to do is use ERR_CAST() to retain the error value. Cc: Mark Fasheh Cc: Joel Becker Signed-off-by: Kees Cook fs/ocfs2/export.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fee2aa753823860f2b8dfe58d98cafe8e4840855 Author: Kees Cook Date: Mon May 8 14:45:26 2017 -0700 ntfs: Use ERR_CAST() to avoid cross-structure cast When trying to propagate an error result, the error return path attempts to retain the error, but does this with an open cast across very different types, which the upcoming structure layout randomization plugin flags as being potentially dangerous in the face of randomization. This is a false positive, but what this code actually wants to do is use ERR_CAST() to retain the error value. Cc: Anton Altaparmakov Cc: Andrew Morton Signed-off-by: Kees Cook fs/ntfs/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fe3b81b446d4ecb954f1b9dd191164a78fd278ad Author: Kees Cook Date: Tue Apr 4 17:08:42 2017 -0700 NFS: Use ERR_CAST() to avoid cross-structure cast When the call to nfs_devname() fails, the error path attempts to retain the error via the mnt variable, but this requires a cast across very different types (char * to struct vfsmount *), which the upcoming structure layout randomization plugin flags as being potentially dangerous in the face of randomization. This is a false positive, but what this code actually wants to do is retain the error value, so this patch explicitly sets it, instead of using what seems to be an unexpected cast. Signed-off-by: Kees Cook Acked-by: Trond Myklebust Reviewed-by: Christoph Hellwig fs/nfs/namespace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c21fbe29f8588991b4fbf209ad4f6ecd4b550cdb Author: Andrew Lunn Date: Sun May 28 17:25:14 2017 +0200 net: dsa: mv88e6xxx: Add missing static to stub functions Stub functions in header files need to be static, or we can have multiple definitions errors. Reported-by: kbuild test robot Fixes: 6335e9f2446b ("net: dsa: mv88e6xxx: mv88e6390X SERDES support") Signed-off-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx/global2.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 95264c8c6a9040e84edda883dbbe9d193c41f46c Author: Alexey Khoroshilov Date: Sat May 27 01:53:04 2017 +0300 staging: iio: ad7152: Fix deadlock in ad7152_write_raw_samp_freq() ad7152_write_raw_samp_freq() is called by ad7152_write_raw() with chip->state_lock held. So, there is unavoidable deadlock when ad7152_write_raw_samp_freq() locks the mutex itself. The patch removes unneeded locking. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov Fixes: 6572389bcc11 ("staging: iio: cdc: ad7152: Implement IIO_CHAN_INFO_SAMP_FREQ attribute") Acked-by: Lars-Peter Clausen Cc: Signed-off-by: Jonathan Cameron drivers/staging/iio/cdc/ad7152.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) commit 7425826f4f7ac60f2538b06a7f0a5d1006405159 Author: Dave Young Date: Fri May 26 12:36:51 2017 +0100 efi/bgrt: Skip efi_bgrt_init() in case of non-EFI boot Sabrina Dubroca reported an early panic: BUG: unable to handle kernel paging request at ffffffffff240001 IP: efi_bgrt_init+0xdc/0x134 [...] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ... which was introduced by: 7b0a911478c7 ("efi/x86: Move the EFI BGRT init code to early init code") The cause is that on this machine the firmware provides the EFI ACPI BGRT table even on legacy non-EFI bootups - which table should be EFI only. The garbage BGRT data causes the efi_bgrt_init() panic. Add a check to skip efi_bgrt_init() in case non-EFI bootup to work around this firmware bug. Tested-by: Sabrina Dubroca Signed-off-by: Dave Young Signed-off-by: Ard Biesheuvel Signed-off-by: Matt Fleming Cc: # v4.11+ Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-efi@vger.kernel.org Fixes: 7b0a911478c7 ("efi/x86: Move the EFI BGRT init code to early init code") Link: http://lkml.kernel.org/r/20170526113652.21339-6-matt@codeblueprint.co.uk [ Rewrote the changelog to be more readable. ] Signed-off-by: Ingo Molnar drivers/firmware/efi/efi-bgrt.c | 3 +++ 1 file changed, 3 insertions(+) commit 94133e46a0f5ca3f138479806104ab4a8cb0455e Author: Baoquan He Date: Fri May 26 12:36:50 2017 +0100 x86/efi: Correct EFI identity mapping under 'efi=old_map' when KASLR is enabled For EFI with the 'efi=old_map' kernel option specified, the kernel will panic when KASLR is enabled: BUG: unable to handle kernel paging request at 000000007febd57e IP: 0x7febd57e PGD 1025a067 PUD 0 Oops: 0010 [#1] SMP Call Trace: efi_enter_virtual_mode() start_kernel() x86_64_start_reservations() x86_64_start_kernel() start_cpu() The root cause is that the identity mapping is not built correctly in the 'efi=old_map' case. On 'nokaslr' kernels, PAGE_OFFSET is 0xffff880000000000 which is PGDIR_SIZE aligned. We can borrow the PUD table from the direct mappings safely. Given a physical address X, we have pud_index(X) == pud_index(__va(X)). However, on KASLR kernels, PAGE_OFFSET is PUD_SIZE aligned. For a given physical address X, pud_index(X) != pud_index(__va(X)). We can't just copy the PGD entry from direct mapping to build identity mapping, instead we need to copy the PUD entries one by one from the direct mapping. Fix it. Signed-off-by: Baoquan He Signed-off-by: Matt Fleming Cc: Ard Biesheuvel Cc: Bhupesh Sharma Cc: Borislav Petkov Cc: Dave Young Cc: Frank Ramsay Cc: Kees Cook Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Russ Anderson Cc: Thomas Garnier Cc: Thomas Gleixner Cc: linux-efi@vger.kernel.org Link: http://lkml.kernel.org/r/20170526113652.21339-5-matt@codeblueprint.co.uk [ Fixed and reworded the changelog and code comments to be more readable. ] Signed-off-by: Ingo Molnar arch/x86/platform/efi/efi_64.c | 79 +++++++++++++++++++++++++++++++++++++----- 1 file changed, 71 insertions(+), 8 deletions(-) commit 4e52797d2efefac3271abdc54439a3435abd77b9 Author: Sai Praneeth Date: Fri May 26 12:36:49 2017 +0100 x86/efi: Disable runtime services on kexec kernel if booted with efi=old_map Booting kexec kernel with "efi=old_map" in kernel command line hits kernel panic as shown below. BUG: unable to handle kernel paging request at ffff88007fe78070 IP: virt_efi_set_variable.part.7+0x63/0x1b0 PGD 7ea28067 PUD 7ea2b067 PMD 7ea2d067 PTE 0 [...] Call Trace: virt_efi_set_variable() efi_delete_dummy_variable() efi_enter_virtual_mode() start_kernel() x86_64_start_reservations() x86_64_start_kernel() start_cpu() [ efi=old_map was never intended to work with kexec. The problem with using efi=old_map is that the virtual addresses are assigned from the memory region used by other kernel mappings; vmalloc() space. Potentially there could be collisions when booting kexec if something else is mapped at the virtual address we allocated for runtime service regions in the initial boot - Matt Fleming ] Since kexec was never intended to work with efi=old_map, disable runtime services in kexec if booted with efi=old_map, so that we don't panic. Tested-by: Lee Chun-Yi Signed-off-by: Sai Praneeth Prakhya Signed-off-by: Matt Fleming Acked-by: Dave Young Cc: Ard Biesheuvel Cc: Borislav Petkov Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Ravi Shankar Cc: Ricardo Neri Cc: Thomas Gleixner Cc: linux-efi@vger.kernel.org Link: http://lkml.kernel.org/r/20170526113652.21339-4-matt@codeblueprint.co.uk Signed-off-by: Ingo Molnar arch/x86/platform/efi/efi.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 684e3f965d0be8c26fedefe94f637374242aba08 Author: Arnd Bergmann Date: Fri May 26 12:36:48 2017 +0100 efi: Remove duplicate 'const' specifiers gcc-7 shows these harmless warnings: drivers/firmware/efi/libstub/secureboot.c:19:27: error: duplicate 'const' declaration specifier [-Werror=duplicate-decl-specifier] static const efi_char16_t const efi_SecureBoot_name[] = { drivers/firmware/efi/libstub/secureboot.c:22:27: error: duplicate 'const' declaration specifier [-Werror=duplicate-decl-specifier] Removing one of the specifiers gives us the expected behavior. Signed-off-by: Arnd Bergmann Signed-off-by: Matt Fleming Reviewed-by: David Howells Acked-by: Ard Biesheuvel Cc: Josh Boyer Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-efi@vger.kernel.org Fixes: de8cb458625c ("efi: Get and store the secure boot status") Link: http://lkml.kernel.org/r/20170526113652.21339-3-matt@codeblueprint.co.uk Signed-off-by: Ingo Molnar drivers/firmware/efi/libstub/secureboot.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 1ea34adb87c969b89dfd83f1905a79161e9ada26 Author: Juergen Gross Date: Fri May 26 12:36:47 2017 +0100 efi: Don't issue error message when booted under Xen When booted as Xen dom0 there won't be an EFI memmap allocated. Avoid issuing an error message in this case: [ 0.144079] efi: Failed to allocate new EFI memmap Signed-off-by: Juergen Gross Signed-off-by: Matt Fleming Cc: # v4.9+ Cc: Ard Biesheuvel Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-efi@vger.kernel.org Link: http://lkml.kernel.org/r/20170526113652.21339-2-matt@codeblueprint.co.uk Signed-off-by: Ingo Molnar arch/x86/platform/efi/quirks.c | 3 +++ 1 file changed, 3 insertions(+) commit fb3ce90b7d7761b6f7f28f0ff5c456ef6b5229a1 Author: Firo Yang Date: Fri May 26 22:37:38 2017 +0800 hdlcdrv: Fix divide by zero in hdlcdrv_ioctl syszkaller fuzzer triggered a divide by zero, when set calibration through ioctl(). To fix it, test 'bitrate' if it is negative or 0, just return -EINVAL. Reported-by: Andrey Konovalov Signed-off-by: Firo Yang Signed-off-by: David S. Miller drivers/net/hamradio/hdlcdrv.c | 2 ++ 1 file changed, 2 insertions(+) commit 6c713a3a23154f4f0c2217ea39811ebe443dafaa Author: Andrew Lunn Date: Fri May 26 01:44:43 2017 +0200 net: dsa: mv88e6xxx: Add eeprom-length to binding The binding documentation for the mv88e6xxx switch is missing the eeprom-length property, which has been implemented since May 2016, commit f8cd8753def0 ("dsa: mv88e6xxx: Handle eeprom-length property") Signed-off-by: Andrew Lunn Signed-off-by: David S. Miller Documentation/devicetree/bindings/net/dsa/marvell.txt | 4 ++++ 1 file changed, 4 insertions(+) commit d72fea538fe6d783c1e63a2fc304019abf4be93a Author: Jordan Crouse Date: Mon May 8 14:34:58 2017 -0600 drm/msm: Fix the check for the command size The overrun check for the size of submitted commands is off by one. It should allow the offset plus the size to be equal to the size of the memory object when the command stream is very tightly constructed. Signed-off-by: Jordan Crouse Signed-off-by: Rob Clark drivers/gpu/drm/msm/msm_gem_submit.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 90dd57de4a043f642179b1323a31ca3ced826611 Author: Jordan Crouse Date: Mon May 8 14:34:57 2017 -0600 drm/msm: Take the mutex before calling msm_gem_new_impl Amongst its other duties, msm_gem_new_impl adds the newly created GEM object to the shared inactive list which may also be actively modifiying the list during submission. All the paths to modify the list are protected by the mutex except for the one through msm_gem_import which can end up causing list corruption. Signed-off-by: Jordan Crouse [add extra WARN_ON(!mutex_is_locked(&dev->struct_mutex))] Signed-off-by: Rob Clark drivers/gpu/drm/msm/msm_gem.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 3cfac69cbd56e1a57a70bfbdb07560b788030404 Author: Philipp Zabel Date: Fri Mar 17 19:38:40 2017 +0100 drm/msm: for array in-fences, check if all backing fences are from our own context before waiting Use the dma_fence_match_context helper to check if all backing fences are from our own context, in which case we don't have to wait. Signed-off-by: Philipp Zabel Cc: Rob Clark Cc: Gustavo Padovan [rebased on code-motion] Signed-off-by: Rob Clark drivers/gpu/drm/msm/msm_gem_submit.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) commit c43dd227f411359802427da7aebe5da5b0e48e0e Author: Tobias Klauser Date: Wed May 24 18:12:19 2017 +0200 drm/msm: constify irq_domain_ops struct irq_domain_ops is not modified, so it can be made const. Signed-off-by: Tobias Klauser Signed-off-by: Rob Clark drivers/gpu/drm/msm/mdp/mdp5/mdp5_mdss.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit adcbae310f9ed84ef139e3fa6d7a7743d96c44c8 Author: Rob Clark Date: Sun May 21 12:05:07 2017 -0400 drm/msm/mdp5: release hwpipe(s) for unused planes Otherwise, if userspace doesn't re-use a given plane, it's hwpipe(s) could stay permanently assigned. Signed-off-by: Rob Clark drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c | 4 ++++ 1 file changed, 4 insertions(+) commit 3c30cc41a87880db86c343b8c9cc8bc2d3d36055 Author: Eric Anholt Date: Wed Apr 12 12:12:00 2017 -0700 drm/msm: Reuse dma_fence_release. If we follow the typical pattern of the base class being the first member, we can use the default dma_fence_free function. Signed-off-by: Eric Anholt Cc: Rob Clark Cc: linux-arm-msm@vger.kernel.org Cc: freedreno@lists.freedesktop.org Reviewed-by: Rob Clark Signed-off-by: Rob Clark drivers/gpu/drm/msm/msm_fence.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) commit 43523eba79bda8f5b4c27f8ffe20ea078d20113a Author: Eric Anholt Date: Wed Apr 12 12:11:58 2017 -0700 drm/msm: Expose our reservation object when exporting a dmabuf. Without this, polling on the dma-buf (and presumably other devices synchronizing against our rendering) would return immediately, even while the BO was busy. Signed-off-by: Eric Anholt Reviewed-by: Daniel Vetter Cc: stable@vger.kernel.org Cc: Rob Clark Cc: linux-arm-msm@vger.kernel.org Cc: freedreno@lists.freedesktop.org Reviewed-by: Rob Clark Signed-off-by: Rob Clark drivers/gpu/drm/msm/msm_drv.c | 1 + drivers/gpu/drm/msm/msm_drv.h | 1 + drivers/gpu/drm/msm/msm_gem_prime.c | 7 +++++++ 3 files changed, 9 insertions(+) commit 134ccada7ac59156761ce05afd1c0b1d02ebd928 Author: Rob Clark Date: Wed May 3 10:43:14 2017 -0400 drm/msm/gpu: check legacy clk names in get_clocks() Otherwise if someone was using old bindings with "core_clk" instead of "core" as the clock name, we'd never find it and gpu would be stuck at 27MHz (or whatever it's slowest rate is). Fixes: 98db803 ("msm/drm: gpu: Dynamically locate the clocks from the device tree") Signed-off-by: Rob Clark drivers/gpu/drm/msm/msm_gpu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 786813c343cb619d23cb0990e152e350b826d810 Author: Rob Clark Date: Wed May 3 10:04:48 2017 -0400 drm/msm/mdp5: use __drm_atomic_helper_plane_duplicate_state() Somehow the helper was never retrofitted for mdp5. Which meant when plane_state->fence was added, it could get copied into new state in mdp5_plane_duplicate_state(). If an update to disable the plane (for example on rmfb) managed to sneak in after an nonblock update had swapped state, but before it was committed, we'd get a splat: WARNING: CPU: 1 PID: 69 at ../drivers/gpu/drm/drm_atomic_helper.c:1061 drm_atomic_helper_wait_for_fences+0xe0/0xf8 Modules linked in: CPU: 1 PID: 69 Comm: kworker/1:1 Tainted: G W 4.11.0-rc8+ #1187 Hardware name: Qualcomm Technologies, Inc. APQ 8016 SBC (DT) Workqueue: events drm_mode_rmfb_work_fn task: ffffffc036560d00 task.stack: ffffffc036550000 PC is at drm_atomic_helper_wait_for_fences+0xe0/0xf8 LR is at complete_commit.isra.1+0x44/0x1c0 pc : [] lr : [] pstate: 20000145 sp : ffffffc036553b60 x29: ffffffc036553b60 x28: ffffffc0264e6a00 x27: ffffffc035659000 x26: 0000000000000000 x25: ffffffc0240e8000 x24: 0000000000000038 x23: 0000000000000000 x22: ffffff800858f200 x21: ffffffc0240e8000 x20: ffffffc02f56a800 x19: 0000000000000000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: ffffffc00a192700 x13: 0000000000000004 x12: 0000000000000000 x11: ffffff80089a1690 x10: 00000000000008f0 x9 : ffffffc036553b20 x8 : ffffffc036561650 x7 : ffffffc03fe6cb40 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000002 x3 : ffffffc035659000 x2 : ffffffc0240e8c80 x1 : 0000000000000000 x0 : ffffffc02adbe588 ---[ end trace 13aeec77c3fb55e2 ]--- Call trace: Exception stack(0xffffffc036553990 to 0xffffffc036553ac0) 3980: 0000000000000000 0000008000000000 39a0: ffffffc036553b60 ffffff80084f6040 0000000000004ff0 0000000000000038 39c0: ffffffc0365539d0 ffffff800857e098 ffffffc036553a00 ffffff800857e1b0 39e0: ffffffc036553a10 ffffff800857c554 ffffffc0365e8400 ffffffc0365e8400 3a00: ffffffc036553a20 ffffff8008103358 000000000001aad7 ffffff800851b72c 3a20: ffffffc036553a50 ffffff80080e9228 ffffffc02adbe588 0000000000000000 3a40: ffffffc0240e8c80 ffffffc035659000 0000000000000002 0000000000000001 3a60: 0000000000000000 ffffffc03fe6cb40 ffffffc036561650 ffffffc036553b20 3a80: 00000000000008f0 ffffff80089a1690 0000000000000000 0000000000000004 3aa0: ffffffc00a192700 0000000000000000 0000000000000000 0000000000000000 [] drm_atomic_helper_wait_for_fences+0xe0/0xf8 [] complete_commit.isra.1+0x44/0x1c0 [] msm_atomic_commit+0x32c/0x350 [] drm_atomic_commit+0x50/0x60 [] drm_atomic_remove_fb+0x158/0x250 [] drm_framebuffer_remove+0x50/0x158 [] drm_mode_rmfb_work_fn+0x40/0x58 [] process_one_work+0x1d0/0x378 [] worker_thread+0x244/0x488 [] kthread+0xfc/0x128 [] ret_from_fork+0x10/0x50 Fixes: 9626014 ("drm/fence: add in-fences support") Cc: stable@vger.kernel.org Reviewed-by: Daniel Vetter Reported-by: Stanimir Varbanov Signed-off-by: Rob Clark drivers/gpu/drm/msm/mdp/mdp5/mdp5_plane.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit ac20fa0a96c32ff40c8a127dfd58140f1df44a9b Author: Rob Clark Date: Tue May 2 12:39:53 2017 -0400 drm/msm: select PM_OPP Otherwise, if nothing else enabled selects it, dev_pm_opp_of_add_table() will return -ENOTSUPP. Fixes: e2af8b6 ("drm/msm: gpu: Use OPP tables if we can") Signed-off-by: Rob Clark drivers/gpu/drm/msm/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 249f1efd8e3d58f86469fc305b0eda39db18d7ce Merge: 6f68a6a 59fe2cc Author: Linus Torvalds Date: Sat May 27 09:39:09 2017 -0700 Merge tag 'tty-4.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial fixes from Greg KH: "Here are some serial and tty fixes for 4.12-rc3. They are a bit bigger than normal, which is why I had them bake in linux-next for a few weeks and didn't send them to you for -rc2. They revert a few of the serdev patches from 4.12-rc1, and bring things back to how they were in 4.11, to try to make things a bit more stable there. Rob and Johan both agree that this is the way forward, so this isn't people squabbling over semantics. Other than that, just a few minor serial driver fixes that people have had problems with. All of these have been in linux-next for a few weeks with no reported issues" * tag 'tty-4.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial: altera_uart: call iounmap() at driver remove serial: imx: ensure UCR3 and UFCR are setup correctly MAINTAINERS/serial: Change maintainer of jsm driver serial: enable serdev support tty/serdev: add serdev registration interface serdev: Restore serdev_device_write_buf for atomic context serial: core: fix crash in uart_suspend_port tty: fix port buffer locking tty: ehv_bytechan: clean up init error handling serial: ifx6x60: fix use-after-free on module unload serial: altera_jtaguart: adding iounmap() serial: exar: Fix stuck MSIs serial: efm32: Fix parity management in 'efm32_uart_console_get_options()' serdev: fix tty-port client deregistration Revert "tty_port: register tty ports with serdev bus" drivers/tty: 8250: only call fintek_8250_probe when doing port I/O commit 6f68a6ae1f0ea2fd87e26dc345866e928b5850a8 Merge: 38e6bf2 a4700a2 Author: Linus Torvalds Date: Sat May 27 09:28:34 2017 -0700 Merge tag 'powerpc-4.12-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: "Fix running SPU programs on Cell, and a few other minor fixes. Thanks to Alistair Popple, Jeremy Kerr, Michael Neuling, Nicholas Piggin" * tag 'powerpc-4.12-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc: Add PPC_FEATURE userspace bits for SCV and DARN instructions powerpc/spufs: Fix hash faults for kernel regions powerpc: Fix booting P9 hash with CONFIG_PPC_RADIX_MMU=N powerpc/powernv/npu-dma.c: Fix opal_npu_destroy_context() call selftests/powerpc: Fix TM resched DSCR test with some compilers commit 38e6bf238daa2514a543f76ec8d1cc0f488ac422 Merge: 39b8ab3 702644e Author: Linus Torvalds Date: Sat May 27 09:17:58 2017 -0700 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Thomas Gleixner: "A series of fixes for X86: - The final fix for the end-of-stack issue in the unwinder - Handle non PAT systems gracefully - Prevent access to uninitiliazed memory - Move early delay calaibration after basic init - Fix Kconfig help text - Fix a cross compile issue - Unbreak older make versions" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/timers: Move simple_udelay_calibration past init_hypervisor_platform x86/alternatives: Prevent uninitialized stack byte read in apply_alternatives() x86/PAT: Fix Xorg regression on CPUs that don't support PAT x86/watchdog: Fix Kconfig help text file path reference to lockup watchdog documentation x86/build: Permit building with old make versions x86/unwind: Add end-of-stack check for ftrace handlers Revert "x86/entry: Fix the end of the stack for newly forked tasks" x86/boot: Use CROSS_COMPILE prefix for readelf commit 39b8ab31bced71486b3aa077a7cf828b1a18fbce Merge: de0b9d7 43fe8b8 Author: Linus Torvalds Date: Sat May 27 09:14:24 2017 -0700 Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fixlet from Thomas Gleixner: "Silence dmesg spam by making the posix cpu timer printks depend on print_fatal_signals" * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: posix-timers: Make signal printks conditional commit de0b9d751b9cd4cfedd0112722e84d0b5abaac73 Merge: fac3fca fc08a47 Author: Linus Torvalds Date: Sat May 27 09:06:43 2017 -0700 Merge branch 'ras-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull RAS fixes from Thomas Gleixner: "Two fixlets for RAS: - Export memory_error() so the NFIT module can utilize it - Handle memory errors in NFIT correctly" * 'ras-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: acpi, nfit: Fix the memory error check in nfit_handle_mce() x86/MCE: Export memory_error() commit fac3fcae3244d6d8af61f04d2c10b4fd5ee03933 Merge: 805f286 6e30437 Author: Linus Torvalds Date: Sat May 27 09:02:41 2017 -0700 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf tooling fixes from Thomas Gleixner: - Synchronization of tools and kernel headers - A series of fixes for perf report addressing various failures: * Handle invalid maps proper * Plug a memory leak * Handle frames and callchain order correctly - Fixes for handling inlines and children mode * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: tools/include: Sync kernel ABI headers with tooling headers perf tools: Put caller above callee in --children mode perf report: Do not drop last inlined frame perf report: Always honor callchain order for inlined nodes perf script: Add --inline option for debugging perf report: Fix off-by-one for non-activation frames perf report: Fix memory leak in addr2line when called by addr2inlines perf report: Don't crash on invalid maps in `-g srcline` mode commit 805f286907ace68bef37db20bbdfa8f4a1908ed9 Merge: d024baa 04dc1b2 Author: Linus Torvalds Date: Sat May 27 08:59:37 2017 -0700 Merge branch 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fix from Thomas Gleixner: "A fix for a state leak which was introduced in the recent rework of futex/rtmutex interaction" * 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: futex,rt_mutex: Fix rt_mutex_cleanup_proxy_lock() commit d024baa58a4a7e5eb6058017771d15b9e47b56db Merge: 77d6465 4d6501d Author: Linus Torvalds Date: Sat May 27 08:52:27 2017 -0700 Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull kthread fix from Thomas Gleixner: "A single fix which prevents a use after free when kthread fork fails" * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: kthread: Fix use-after-free if kthread fork fails commit 77d64656950b299f5e7c70f1e3a0bdc991b51497 Merge: c86daad 6ee98ff Author: Linus Torvalds Date: Sat May 27 08:30:30 2017 -0700 Merge tag 'trace-v4.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull ftrace fixes from Steven Rostedt: "There's been a few memory issues found with ftrace. One was simply a memory leak where not all was being freed that should have been in releasing a file pointer on set_graph_function. Then Thomas found that the ftrace trampolines were marked for read/write as well as execute. To shrink the possible attack surface, he added calls to set them to ro. Which also uncovered some other issues with freeing module allocated memory that had its permissions changed. Kprobes had a similar issue which is fixed and a selftest was added to trigger that issue again" * tag 'trace-v4.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: x86/ftrace: Make sure that ftrace trampolines are not RWX x86/mm/ftrace: Do not bug in early boot on irqs_disabled in cpu_flush_range() selftests/ftrace: Add a testcase for many kprobe events kprobes/x86: Fix to set RWX bits correctly before releasing trampoline ftrace: Fix memory leak in ftrace_graph_release() commit 7b4500bc519686712471924972022df88b12ff93 Author: Ravi Bangoria Date: Fri May 5 15:44:17 2017 +0530 perf annotate: Fix failure when filename has special chars When filename contains special chars, perf annotate fails with an error: $ perf annotate --vmlinux ./vmlinux\(test\) --stdio native_safe_halt sh: -c: line 0: syntax error near unexpected token `(' sh: -c: line 0: `objdump --start-address=0xffffffff8184e840 --stop-address=0xffffffff8184e848 -l -d --no-show-raw -S -C ./vmlinux(test) 2>/dev/null|grep -v ./vmlinux(test):|expand' Fix it by surrounding filename in double quotes. Signed-off-by: Ravi Bangoria Cc: Adam Stylinski Cc: Alexander Shishkin Cc: Christian Borntraeger Cc: Peter Zijlstra Cc: Taeung Song Link: http://lkml.kernel.org/r/20170505101417.2117-1-ravi.bangoria@linux.vnet.ibm.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/annotate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b3addcf0d1f04f53fcc302577d5a5e964c18531a Author: Bin Liu Date: Thu May 25 13:42:39 2017 -0500 usb: musb: dsps: keep VBUS on for host-only mode Currently VBUS is turned off while a usb device is detached, and turned on again by the polling routine. This short period VBUS loss prevents usb modem to switch mode. VBUS should be constantly on for host-only mode, so this changes the driver to not turn off VBUS for host-only mode. Fixes: 2f3fd2c5bde1 ("usb: musb: Prepare dsps glue layer for PM runtime support") Cc: stable@vger.kernel.org #v4.11 Reported-by: Moreno Bartalucci Acked-by: Tony Lindgren Signed-off-by: Bin Liu Signed-off-by: Greg Kroah-Hartman drivers/usb/musb/musb_dsps.c | 5 +++++ 1 file changed, 5 insertions(+) commit 6ee98ffeea0bc9e072e419497d78697d8afcdd6d Author: Thomas Gleixner Date: Thu May 25 10:57:51 2017 +0200 x86/ftrace: Make sure that ftrace trampolines are not RWX ftrace use module_alloc() to allocate trampoline pages. The mapping of module_alloc() is RWX, which makes sense as the memory is written to right after allocation. But nothing makes these pages RO after writing to them. Add proper set_memory_rw/ro() calls to protect the trampolines after modification. Link: http://lkml.kernel.org/r/alpine.DEB.2.20.1705251056410.1862@nanos Signed-off-by: Thomas Gleixner Signed-off-by: Steven Rostedt (VMware) arch/x86/kernel/ftrace.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) commit a53276e2826010338478ed94310874001a8097fa Author: Steven Rostedt (VMware) Date: Fri May 26 10:14:11 2017 -0400 x86/mm/ftrace: Do not bug in early boot on irqs_disabled in cpu_flush_range() With function tracing starting in early bootup and having its trampoline pages being read only, a bug triggered with the following: kernel BUG at arch/x86/mm/pageattr.c:189! invalid opcode: 0000 [#1] SMP Modules linked in: CPU: 0 PID: 0 Comm: swapper Not tainted 4.12.0-rc2-test+ #3 Hardware name: MSI MS-7823/CSM-H87M-G43 (MS-7823), BIOS V1.6 02/22/2014 task: ffffffffb4222500 task.stack: ffffffffb4200000 RIP: 0010:change_page_attr_set_clr+0x269/0x302 RSP: 0000:ffffffffb4203c88 EFLAGS: 00010046 RAX: 0000000000000046 RBX: 0000000000000000 RCX: 00000001b6000000 RDX: ffffffffb4203d40 RSI: 0000000000000000 RDI: ffffffffb4240d60 RBP: ffffffffb4203d18 R08: 00000001b6000000 R09: 0000000000000001 R10: ffffffffb4203aa8 R11: 0000000000000003 R12: ffffffffc029b000 R13: ffffffffb4203d40 R14: 0000000000000001 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff9a639ea00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff9a636b384000 CR3: 00000001ea21d000 CR4: 00000000000406b0 Call Trace: change_page_attr_clear+0x1f/0x21 set_memory_ro+0x1e/0x20 arch_ftrace_update_trampoline+0x207/0x21c ? ftrace_caller+0x64/0x64 ? 0xffffffffc029b000 ftrace_startup+0xf4/0x198 register_ftrace_function+0x26/0x3c function_trace_init+0x5e/0x73 tracer_init+0x1e/0x23 tracing_set_tracer+0x127/0x15a register_tracer+0x19b/0x1bc init_function_trace+0x90/0x92 early_trace_init+0x236/0x2b3 start_kernel+0x200/0x3f5 x86_64_start_reservations+0x29/0x2b x86_64_start_kernel+0x17c/0x18f secondary_startup_64+0x9f/0x9f ? secondary_startup_64+0x9f/0x9f Interrupts should not be enabled at this early in the boot process. It is also fine to leave interrupts enabled during this time as there's only one CPU running, and on_each_cpu() means to only run on the current CPU. If early_boot_irqs_disabled is set, it is safe to run cpu_flush_range() with interrupts disabled. Don't trigger a BUG_ON() in that case. Link: http://lkml.kernel.org/r/20170526093717.0be3b849@gandalf.local.home Suggested-by: Thomas Gleixner Signed-off-by: Steven Rostedt (VMware) arch/x86/mm/pageattr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bdd7e3d68492bfb7ade574f8c64b87bea499ca2e Author: Masami Hiramatsu Date: Fri May 26 13:44:54 2017 +0900 selftests/ftrace: Add a testcase for many kprobe events Add a testcase to test kprobes via ftrace interface with many concurrent kprobe events. This tries to add many kprobe events (up to 256) on kernel functions. To avoid making ftrace-based kprobes (kprobes on fentry), it skips first N bytes (on x86 N=5, on ppc or arm N=4) of function entry. After that, it enables all those events, disable it, and remove it. Since the unoptimization buffer reclaiming will be delayed, after removing events, it will wait enough time. Link: http://lkml.kernel.org/r/149577388470.11702.11832460851769204511.stgit@devbox Signed-off-by: Masami Hiramatsu Suggested-by: Steven Rostedt Signed-off-by: Steven Rostedt (VMware) .../ftrace/test.d/kprobe/multiple_kprobes.tc | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) commit c93f5cf571e7795f97d49ef51b766cf25e328545 Author: Masami Hiramatsu Date: Thu May 25 19:38:17 2017 +0900 kprobes/x86: Fix to set RWX bits correctly before releasing trampoline Fix kprobes to set(recover) RWX bits correctly on trampoline buffer before releasing it. Releasing readonly page to module_memfree() crash the kernel. Without this fix, if kprobes user register a bunch of kprobes in function body (since kprobes on function entry usually use ftrace) and unregister it, kernel hits a BUG and crash. Link: http://lkml.kernel.org/r/149570868652.3518.14120169373590420503.stgit@devbox Signed-off-by: Masami Hiramatsu Fixes: d0381c81c2f7 ("kprobes/x86: Set kprobes pages read-only") Signed-off-by: Steven Rostedt (VMware) arch/x86/kernel/kprobes/core.c | 9 +++++++++ kernel/kprobes.c | 2 +- 2 files changed, 10 insertions(+), 1 deletion(-) commit f9797c2f20c0160edd718aa467101f3301e57e59 Author: Luis Henriques Date: Thu May 25 16:20:38 2017 +0100 ftrace: Fix memory leak in ftrace_graph_release() ftrace_hash is being kfree'ed in ftrace_graph_release(), however the ->buckets field is not. This results in a memory leak that is easily captured by kmemleak: unreferenced object 0xffff880038afe000 (size 8192): comm "trace-cmd", pid 238, jiffies 4294916898 (age 9.736s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] kmemleak_alloc+0x4e/0xb0 [] __kmalloc+0x12d/0x1a0 [] alloc_ftrace_hash+0x51/0x80 [] __ftrace_graph_open.isra.39.constprop.46+0xa3/0x100 [] ftrace_graph_open+0x68/0xa0 [] do_dentry_open.isra.1+0x1bd/0x2d0 [] vfs_open+0x47/0x60 [] path_openat+0x2a5/0x1020 [] do_filp_open+0x8a/0xf0 [] do_sys_open+0x12f/0x200 [] SyS_open+0x1e/0x20 [] entry_SYSCALL_64_fastpath+0x13/0x94 [] 0xffffffffffffffff Link: http://lkml.kernel.org/r/20170525152038.7661-1-lhenriques@suse.com Cc: stable@vger.kernel.org Fixes: b9b0c831bed2 ("ftrace: Convert graph filter to use hash tables") Signed-off-by: Luis Henriques Signed-off-by: Steven Rostedt (VMware) kernel/trace/ftrace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c86daad2c25bfd4a33d48b7691afaa96d9c5ab46 Merge: e2a9aa5 a04f144 Author: Linus Torvalds Date: Fri May 26 16:45:13 2017 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input layer fixes from Dmitry Torokhov: "Just a few fixups to a couple of drivers" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: elan_i2c - ignore signals when finishing updating firmware Input: elan_i2c - clear INT before resetting controller Input: atmel_mxt_ts - add T100 as a readable object Input: edt-ft5x06 - increase allowed data range for threshold parameter commit 5720acf4bfc142ba568d5b6782fceaf62ed15e0b Author: Miroslav Benes Date: Fri May 26 14:45:21 2017 +0200 livepatch: Make livepatch dependent on !TRIM_UNUSED_KSYMS If TRIM_UNUSED_KSYMS is enabled, all unneeded exported symbols are made unexported. Two-pass build of the kernel is done to find out which symbols are needed based on a configuration. This effectively complicates things for out-of-tree modules. Livepatch exports functions to (un)register and enable/disable a live patch. The only in-tree module which uses these functions is a sample in samples/livepatch/. If the sample is disabled, the functions are trimmed and out-of-tree live patches cannot be built. Note that live patches are intended to be built out-of-tree. Suggested-by: Michal Marek Acked-by: Josh Poimboeuf Acked-by: Jessica Yu Signed-off-by: Miroslav Benes Signed-off-by: Jiri Kosina kernel/livepatch/Kconfig | 1 + 1 file changed, 1 insertion(+) commit a056bdaae7a181f7dcc876cfab2f94538e508709 Author: Jan Kara Date: Fri May 26 17:45:45 2017 -0400 ext4: fix data corruption for mmap writes mpage_submit_page() can race with another process growing i_size and writing data via mmap to the written-back page. As mpage_submit_page() samples i_size too early, it may happen that ext4_bio_write_page() zeroes out too large tail of the page and thus corrupts user data. Fix the problem by sampling i_size only after the page has been write-protected in page tables by clear_page_dirty_for_io() call. Reported-by: Michael Zimmer CC: stable@vger.kernel.org Fixes: cb20d5188366f04d96d2e07b1240cc92170ade40 Signed-off-by: Jan Kara Signed-off-by: Theodore Ts'o fs/ext4/inode.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) commit 4f8caa60a5a13a78f26198618f21774bd6aa6498 Author: Jan Kara Date: Fri May 26 17:40:52 2017 -0400 ext4: fix data corruption with EXT4_GET_BLOCKS_ZERO When ext4_map_blocks() is called with EXT4_GET_BLOCKS_ZERO to zero-out allocated blocks and these blocks are actually converted from unwritten extent the following race can happen: CPU0 CPU1 page fault page fault ... ... ext4_map_blocks() ext4_ext_map_blocks() ext4_ext_handle_unwritten_extents() ext4_ext_convert_to_initialized() - zero out converted extent ext4_zeroout_es() - inserts extent as initialized in status tree ext4_map_blocks() ext4_es_lookup_extent() - finds initialized extent write data ext4_issue_zeroout() - zeroes out new extent overwriting data This problem can be reproduced by generic/340 for the fallocated case for the last block in the file. Fix the problem by avoiding zeroing out the area we are mapping with ext4_map_blocks() in ext4_ext_convert_to_initialized(). It is pointless to zero out this area in the first place as the caller asked us to convert the area to initialized because he is just going to write data there before the transaction finishes. To achieve this we delete the special case of zeroing out full extent as that will be handled by the cases below zeroing only the part of the extent that needs it. We also instruct ext4_split_extent() that the middle of extent being split contains data so that ext4_split_extent_at() cannot zero out full extent in case of ENOSPC. CC: stable@vger.kernel.org Fixes: 12735f881952c32b31bc4e433768f18489f79ec9 Signed-off-by: Jan Kara Signed-off-by: Theodore Ts'o fs/ext4/extents.c | 80 +++++++++++++++++++++++++------------------------------ 1 file changed, 37 insertions(+), 43 deletions(-) commit 449e2f9e95d803961635d725f6482e5e995b7554 Author: Brian Norris Date: Tue May 23 12:36:58 2017 -0700 PCI: Make error code types consistent in pci_{read,write}_config_* Callers normally treat the config space accessors as returning PCBIOS_* error codes, not Linux error codes (or they don't look at them at all). We have pcibios_err_to_errno() in case the error code needs to be translated. Fixes: 4b1038834739 ("PCI: Don't attempt config access to disconnected devices") Signed-off-by: Brian Norris Signed-off-by: Bjorn Helgaas Reviewed-by: Keith Busch drivers/pci/access.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit e2a9aa5ab2a4d1fb05fcdfa9661d54e437093297 Merge: 6741d51 aace34c Author: Linus Torvalds Date: Fri May 26 14:02:30 2017 -0700 Merge tag 'led_fixes_for_4-12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds Pull LED fix from Jacek Anaszewski: "A single LED fix for 4.12-rc3. leds-pca955x driver uses only i2c_smbus API and thus it should pass I2C_FUNC_SMBUS_BYTE_DATA flag to i2c_check_functionality" * tag 'led_fixes_for_4-12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds: leds: pca955x: Correct I2C Functionality commit 6741d51699ac9ef21f1fac14c63ecd31d3a7c278 Merge: cdbe020 3fb07da Author: Linus Torvalds Date: Fri May 26 13:51:01 2017 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) Fix state pruning in bpf verifier wrt. alignment, from Daniel Borkmann. 2) Handle non-linear SKBs properly in SCTP ICMP parsing, from Davide Caratti. 3) Fix bit field definitions for rss_hash_type of descriptors in mlx5 driver, from Jesper Brouer. 4) Defer slave->link updates until bonding is ready to do a full commit to the new settings, from Nithin Sujir. 5) Properly reference count ipv4 FIB metrics to avoid use after free situations, from Eric Dumazet and several others including Cong Wang and Julian Anastasov. 6) Fix races in llc_ui_bind(), from Lin Zhang. 7) Fix regression of ESP UDP encapsulation for TCP packets, from Steffen Klassert. 8) Fix mdio-octeon driver Kconfig deps, from Randy Dunlap. 9) Fix regression in setting DSCP on ipv6/GRE encapsulation, from Peter Dawson. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (43 commits) ipv4: add reference counting to metrics net: ethernet: ax88796: don't call free_irq without request_irq first ip6_tunnel, ip6_gre: fix setting of DSCP on encapsulated packets sctp: fix ICMP processing if skb is non-linear net: llc: add lock_sock in llc_ui_bind to avoid a race condition bonding: Don't update slave->link until ready to commit test_bpf: Add a couple of tests for BPF_JSGE. bpf: add various verifier test cases bpf: fix wrong exposure of map_flags into fdinfo for lpm bpf: add bpf_clone_redirect to bpf_helper_changes_pkt_data bpf: properly reset caller saved regs after helper call and ld_abs/ind bpf: fix incorrect pruning decision when alignment must be tracked arp: fixed -Wuninitialized compiler warning tcp: avoid fastopen API to be used on AF_UNSPEC net: move somaxconn init from sysctl code net: fix potential null pointer dereference geneve: fix fill_info when using collect_metadata virtio-net: enable TSO/checksum offloads for Q-in-Q vlans be2net: Fix offload features for Q-in-Q packets vlan: Fix tcp checksum offloads in Q-in-Q vlans ... commit cdbe0206783b4e86abb0150303f137e448b5e531 Merge: 1b8f2ff a54fba8 Author: Linus Torvalds Date: Fri May 26 12:13:08 2017 -0700 Merge tag 'xfs-4.12-fixes-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull XFS fixes from Darrick Wong: "A few miscellaneous bug fixes & cleanups: - Fix indlen block reservation accounting bug when splitting delalloc extent - Fix warnings about unused variables that appeared in -rc1. - Don't spew errors when bmapping a local format directory - Fix an off-by-one error in a delalloc eof assertion - Make fsmap only return inode information for CAP_SYS_ADMIN - Fix a potential mount time deadlock recovering cow extents - Fix unaligned memory access in _btree_visit_blocks - Fix various SEEK_HOLE/SEEK_DATA bugs" * tag 'xfs-4.12-fixes-2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: Move handling of missing page into one place in xfs_find_get_desired_pgoff() xfs: Fix off-by-in in loop termination in xfs_find_get_desired_pgoff() xfs: Fix missed holes in SEEK_HOLE implementation xfs: fix off-by-one on max nr_pages in xfs_find_get_desired_pgoff() xfs: fix unaligned access in xfs_btree_visit_blocks xfs: avoid mount-time deadlock in CoW extent recovery xfs: only return detailed fsmap info if the caller has CAP_SYS_ADMIN xfs: bad assertion for delalloc an extent that start at i_size xfs: fix warnings about unused stack variables xfs: BMAPX shouldn't barf on inline-format directories xfs: fix indlen accounting error on partial delalloc conversion commit 3fb07daff8e99243366a081e5129560734de4ada Author: Eric Dumazet Date: Thu May 25 14:27:35 2017 -0700 ipv4: add reference counting to metrics Andrey Konovalov reported crashes in ipv4_mtu() I could reproduce the issue with KASAN kernels, between 10.246.7.151 and 10.246.7.152 : 1) 20 concurrent netperf -t TCP_RR -H 10.246.7.152 -l 1000 & 2) At the same time run following loop : while : do ip ro add 10.246.7.152 dev eth0 src 10.246.7.151 mtu 1500 ip ro del 10.246.7.152 dev eth0 src 10.246.7.151 mtu 1500 done Cong Wang attempted to add back rt->fi in commit 82486aa6f1b9 ("ipv4: restore rt->fi for reference counting") but this proved to add some issues that were complex to solve. Instead, I suggested to add a refcount to the metrics themselves, being a standalone object (in particular, no reference to other objects) I tried to make this patch as small as possible to ease its backport, instead of being super clean. Note that we believe that only ipv4 dst need to take care of the metric refcount. But if this is wrong, this patch adds the basic infrastructure to extend this to other families. Many thanks to Julian Anastasov for reviewing this patch, and Cong Wang for his efforts on this problem. Fixes: 2860583fe840 ("ipv4: Kill rt->fi") Signed-off-by: Eric Dumazet Reported-by: Andrey Konovalov Reviewed-by: Julian Anastasov Acked-by: Cong Wang Signed-off-by: David S. Miller include/net/dst.h | 8 +++++++- include/net/ip_fib.h | 10 +++++----- net/core/dst.c | 23 ++++++++++++++--------- net/ipv4/fib_semantics.c | 17 ++++++++++------- net/ipv4/route.c | 10 +++++++++- 5 files changed, 45 insertions(+), 23 deletions(-) commit 82533ad9a1ce3a7a6863849a552c2cc041b55e0d Author: Uwe Kleine-König Date: Thu May 25 22:54:53 2017 +0200 net: ethernet: ax88796: don't call free_irq without request_irq first The function ax_init_dev (which is called only from the driver's .probe function) calls free_irq in the error path without having requested the irq in the first place. So drop the free_irq call in the error path. Fixes: 825a2ff1896e ("AX88796 network driver") Signed-off-by: Uwe Kleine-König Signed-off-by: David S. Miller drivers/net/ethernet/8390/ax88796.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) commit 0e9a709560dbcfbace8bf4019dc5298619235891 Author: Peter Dawson Date: Fri May 26 06:35:18 2017 +1000 ip6_tunnel, ip6_gre: fix setting of DSCP on encapsulated packets This fix addresses two problems in the way the DSCP field is formulated on the encapsulating header of IPv6 tunnels. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=195661 1) The IPv6 tunneling code was manipulating the DSCP field of the encapsulating packet using the 32b flowlabel. Since the flowlabel is only the lower 20b it was incorrect to assume that the upper 12b containing the DSCP and ECN fields would remain intact when formulating the encapsulating header. This fix handles the 'inherit' and 'fixed-value' DSCP cases explicitly using the extant dsfield u8 variable. 2) The use of INET_ECN_encapsulate(0, dsfield) in ip6_tnl_xmit was incorrect and resulted in the DSCP value always being set to 0. Commit 90427ef5d2a4 ("ipv6: fix flow labels when the traffic class is non-0") caused the regression by masking out the flowlabel which exposed the incorrect handling of the DSCP portion of the flowlabel in ip6_tunnel and ip6_gre. Fixes: 90427ef5d2a4 ("ipv6: fix flow labels when the traffic class is non-0") Signed-off-by: Peter Dawson Signed-off-by: David S. Miller net/ipv6/ip6_gre.c | 13 +++++++------ net/ipv6/ip6_tunnel.c | 21 +++++++++++++-------- 2 files changed, 20 insertions(+), 14 deletions(-) commit 7485af89a6fd48f7e6fab2505d2364d1817723e6 Author: Jane Chu Date: Thu May 25 13:51:20 2017 -0600 arch/sparc: increase CONFIG_NODES_SHIFT on SPARC64 to 5 SPARC M6-32 platform has (2^5) NUMA nodes, so need to bump up the CONFIG_NODES_SHIFT to 5. Orabug: 25577754 Signed-off-by: Jane Chu Reviewed-by: Bob Picco Reviewed-by: Atish Patra Signed-off-by: David S. Miller arch/sparc/Kconfig | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 804ec7ebe8ea003999ca8d1bfc499edc6a9e07df Author: Davide Caratti Date: Thu May 25 19:14:56 2017 +0200 sctp: fix ICMP processing if skb is non-linear sometimes ICMP replies to INIT chunks are ignored by the client, even if the encapsulated SCTP headers match an open socket. This happens when the ICMP packet is carried by a paged skb: use skb_header_pointer() to read packet contents beyond the SCTP header, so that chunk header and initiate tag are validated correctly. v2: - don't use skb_header_pointer() to read the transport header, since icmp_socket_deliver() already puts these 8 bytes in the linear area. - change commit message to make specific reference to INIT chunks. Signed-off-by: Davide Caratti Acked-by: Marcelo Ricardo Leitner Acked-by: Vlad Yasevich Reviewed-by: Xin Long Signed-off-by: David S. Miller net/sctp/input.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) commit 0908cf4dfef35fc6ac12329007052ebe93ff1081 Author: linzhang Date: Thu May 25 14:07:18 2017 +0800 net: llc: add lock_sock in llc_ui_bind to avoid a race condition There is a race condition in llc_ui_bind if two or more processes/threads try to bind a same socket. If more processes/threads bind a same socket success that will lead to two problems, one is this action is not what we expected, another is will lead to kernel in unstable status or oops(in my simple test case, cause llc2.ko can't unload). The current code is test SOCK_ZAPPED bit to avoid a process to bind a same socket twice but that is can't avoid more processes/threads try to bind a same socket at the same time. So, add lock_sock in llc_ui_bind like others, such as llc_ui_connect. Signed-off-by: Lin Zhang Signed-off-by: David S. Miller net/llc/af_llc.c | 3 +++ 1 file changed, 3 insertions(+) commit 1b8f2ffc79279712e9402fb297c07911ae15180f Merge: 6ce4782 8aa6382 Author: Linus Torvalds Date: Fri May 26 11:05:22 2017 -0700 Merge branch 'for-linus' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "A collection of fixes that should go into this series. This contains: - A set of NVMe fixes, pulled from Christoph. This includes a set of fixes for the fiber channel bits from James Smart, rdma queue depth fix from Marta, controller removal fixes from Ming, and some more APST quirk updates from Andy. - A blk-mq debugfs fix from Bart, fixing a problem with the untangling of the sysfs and debugfs blk-mq bits that was added in this series. - Error code fix in add_partition() from Dan. - A small series of fixes for the new blk-throttle code from Shaohua" * 'for-linus' of git://git.kernel.dk/linux-block: (21 commits) blk-mq: Only register debugfs attributes for blk-mq queues nvme: Quirk APST on Intel 600P/P3100 devices nvme: only setup block integrity if supported by the driver nvme: replace is_flags field in nvme_ctrl_ops with a flags field nvme-pci: consistencly use ctrl->device for logging partitions/msdos: FreeBSD UFS2 file systems are not recognized block: fix an error code in add_partition() blk-throttle: force user to configure all settings for io.low blk-throttle: respect 0 bps/iops settings for io.low blk-throttle: output some debug info in trace blk-throttle: add hierarchy support for latency target and idle time nvme_fc: remove extra controller reference taken on reconnect nvme_fc: correct nvme status set on abort nvme_fc: set logging level on resets/deletes nvme_fc: revise comment on teardown nvme_fc: Support ctrl_loss_tmo nvme_fc: get rid of local reconnect_delay blk-mq: remove blk_mq_abort_requeue_list() nvme: avoid to use blk_mq_abort_requeue_list() nvme: use blk_mq_start_hw_queues() in nvme_kill_queues() ... commit 6ce47829113772b1d6b9046f5eaf00e154f0f9de Merge: 80941b2 4d071c3 Author: Linus Torvalds Date: Fri May 26 10:51:18 2017 -0700 Merge tag 'pci-v4.12-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI fixes from Bjorn Helgaas: - fix PCI_ENDPOINT build error (merged for v4.12) - fix Switchtec driver (merged for v4.12) - fix imx6 config read timeouts, fallout from changing to non-postable reads - add PM "needs_resume" flag for i915 suspend issue * tag 'pci-v4.12-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: PCI/PM: Add needs_resume flag to avoid suspend complete optimization PCI: imx6: Fix config read timeout handling switchtec: Fix minor bug with partition ID register switchtec: Use new cdev_device_add() helper function PCI: endpoint: Make PCI_ENDPOINT depend on HAS_DMA commit 80941b2aebd3433594886d7774220c71c2d7ceec Merge: a38b461 42c99fc Author: Linus Torvalds Date: Fri May 26 09:35:22 2017 -0700 Merge tag 'ceph-for-4.12-rc3' of git://github.com/ceph/ceph-client Pul ceph fixes from Ilya Dryomov: "A bunch of make W=1 and static checker fixups, a RECONNECT_SEQ messenger patch from Zheng and Luis' fallocate fix" * tag 'ceph-for-4.12-rc3' of git://github.com/ceph/ceph-client: ceph: check that the new inode size is within limits in ceph_fallocate() libceph: cleanup old messages according to reconnect seq libceph: NULL deref on crush_decode() error path libceph: fix error handling in process_one_ticket() libceph: validate blob_struct_v in process_one_ticket() libceph: drop version variable from ceph_monmap_decode() libceph: make ceph_msg_data_advance() return void libceph: use kbasename() and kill ceph_file_part() commit a38b461ed5329d4c09c36dbc0084fc16f0adeb20 Merge: e95806d ea45267 Author: Linus Torvalds Date: Fri May 26 09:05:35 2017 -0700 Merge tag 'mmc-v4.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: "This contains fixes to make the WiFi work again for the ARM64 Hikey board. Together with a couple of DTS updates for the Hikey board we have also extended the mmc pwrseq_simple, to support a new power-off-delay-us DT property, as that was required to enable a graceful power off sequence for the WiFi chip" * tag 'mmc-v4.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: arm64: dts: hikey: Fix WiFi support arm64: dts: hi6220: Move board data from the dwmmc nodes to hikey dts arm64: dts: hikey: Add the SYS_5V and the VDD_3V3 regulators arm64: dts: hi6220: Move the fixed_5v_hub regulator to the hikey dts arm64: dts: hikey: Add clock for the pmic mfd mfd: dts: hi655x: Add clock binding for the pmic mmc: pwrseq_simple: Parse DTS for the power-off-delay-us property mmc: dt: pwrseq-simple: Invent power-off-delay-us commit e95806dffc2f2d632c7891e71fc9ef7e1ba0ce97 Merge: 876ca8f 1fc2e41 Author: Linus Torvalds Date: Fri May 26 09:03:09 2017 -0700 Merge tag 'sound-4.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "This contains a few HD-audio device-specific quirks and an endianess fix for USB-audio, as well as the update of quirk model list document. All fixes are small and trivial. The document update could have been postponed, but it's a good thing for user and has absolutely zero risk of breakage, so included here" * tag 'sound-4.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda - apply STAC_9200_DELL_M22 quirk for Dell Latitude D430 ALSA: hda - Update the list of quirk models ALSA: hda - Provide dual-codecs model option for a few Realtek codecs ALSA: hda - Apply dual-codec quirk for MSI Z270-Gaming mobo ALSA: hda - No loopback on ALC299 codec ALSA: usb-audio: fix Amanero Combo384 quirk on big-endian hosts commit 52b5419016997f2960e9c8b6584c4acb3875d126 Author: Jan H. Schönherr Date: Sat May 20 13:24:32 2017 +0200 KVM: x86: Fix virtual wire mode Intel SDM says, that at most one LAPIC should be configured with ExtINT delivery. KVM configures all LAPICs this way. This causes pic_unlock() to kick the first available vCPU from the internal KVM data structures. If this vCPU is not the BSP, but some not-yet-booted AP, the BSP may never realize that there is an interrupt. Fix that by enabling ExtINT delivery only for the BSP. This allows booting a Linux guest without a TSC in the above situation. Otherwise the BSP gets stuck in calibrate_delay_converge(). Signed-off-by: Jan H. Schönherr Reviewed-by: Wanpeng Li Signed-off-by: Paolo Bonzini arch/x86/kvm/lapic.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit e1d39b17e044e8ae819827810d87d809ba5f58c0 Author: Jan H. Schönherr Date: Sat May 20 13:22:56 2017 +0200 KVM: nVMX: Fix handling of lmsw instruction The decision whether or not to exit from L2 to L1 on an lmsw instruction is based on bogus values: instead of using the information encoded within the exit qualification, it uses the data also used for the mov-to-cr instruction, which boils down to using whatever is in %eax at that point. Use the correct values instead. Without this fix, an L1 may not get notified when a 32-bit Linux L2 switches its secondary CPUs to protected mode; the L1 is only notified on the next modification of CR0. This short time window poses a problem, when there is some other reason to exit to L1 in between. Then, L2 will be resumed in real mode and chaos ensues. Signed-off-by: Jan H. Schönherr Reviewed-by: Wanpeng Li Signed-off-by: Paolo Bonzini arch/x86/kvm/vmx.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 876ca8f3d0855043833602b9da9d1470f2a7e03f Merge: 83b4605 bc1f0e0 Author: Linus Torvalds Date: Fri May 26 08:54:06 2017 -0700 Merge tag 'drm-fixes-for-v4.12-rc3' of git://people.freedesktop.org/~airlied/linux Pull drm fixes from Dave Airlie: "Not a whole lot happening here, a set of amdgpu fixes and one core deadlock fix, and some misc drivers fixes" * tag 'drm-fixes-for-v4.12-rc3' of git://people.freedesktop.org/~airlied/linux: drm/amdgpu: fix null point error when rmmod amdgpu. drm/amd/powerplay: fix a signedness bugs drm/amdgpu: fix NULL pointer panic of emit_gds_switch drm/radeon: Unbreak HPD handling for r600+ drm/amd/powerplay/smu7: disable mclk switching for high refresh rates drm/amd/powerplay/smu7: add vblank check for mclk switching (v2) drm/radeon/ci: disable mclk switching for high refresh rates (v2) drm/amdgpu/ci: disable mclk switching for high refresh rates (v2) drm/amdgpu: fix fundamental suspend/resume issue drm/gma500/psb: Actually use VBT mode when it is found drm: Fix deadlock retry loop in page_flip_ioctl drm: qxl: Delay entering atomic context during cursor update drm/radeon: Fix oops upon driver load on PowerXpress laptops commit 5acc1ca4fb15f00bfa3d4046e35ca381bc25d580 Author: Wanpeng Li Date: Sat May 20 20:32:32 2017 -0700 KVM: X86: Fix preempt the preemption timer cancel Preemption can occur during cancel preemption timer, and there will be inconsistent status in lapic, vmx and vmcs field. CPU0 CPU1 preemption timer vmexit handle_preemption_timer(vCPU0) kvm_lapic_expired_hv_timer vmx_cancel_hv_timer vmx->hv_deadline_tsc = -1 vmcs_clear_bits /* hv_timer_in_use still true */ sched_out sched_in kvm_arch_vcpu_load vmx_set_hv_timer write vmx->hv_deadline_tsc vmcs_set_bits /* back in kvm_lapic_expired_hv_timer */ hv_timer_in_use = false ... vmx_vcpu_run vmx_arm_hv_run write preemption timer deadline spurious preemption timer vmexit handle_preemption_timer(vCPU0) kvm_lapic_expired_hv_timer WARN_ON(!apic->lapic_timer.hv_timer_in_use); This can be reproduced sporadically during boot of L2 on a preemptible L1, causing a splat on L1. WARNING: CPU: 3 PID: 1952 at arch/x86/kvm/lapic.c:1529 kvm_lapic_expired_hv_timer+0xb5/0xd0 [kvm] CPU: 3 PID: 1952 Comm: qemu-system-x86 Not tainted 4.12.0-rc1+ #24 RIP: 0010:kvm_lapic_expired_hv_timer+0xb5/0xd0 [kvm] Call Trace: handle_preemption_timer+0xe/0x20 [kvm_intel] vmx_handle_exit+0xc9/0x15f0 [kvm_intel] ? lock_acquire+0xdb/0x250 ? lock_acquire+0xdb/0x250 ? kvm_arch_vcpu_ioctl_run+0xdf3/0x1ce0 [kvm] kvm_arch_vcpu_ioctl_run+0xe55/0x1ce0 [kvm] kvm_vcpu_ioctl+0x384/0x7b0 [kvm] ? kvm_vcpu_ioctl+0x384/0x7b0 [kvm] ? __fget+0xf3/0x210 do_vfs_ioctl+0xa4/0x700 ? __fget+0x114/0x210 SyS_ioctl+0x79/0x90 do_syscall_64+0x8f/0x750 ? trace_hardirqs_on_thunk+0x1a/0x1c entry_SYSCALL64_slow_path+0x25/0x25 This patch fixes it by disabling preemption while cancelling preemption timer. This way cancel_hv_timer is atomic with respect to kvm_arch_vcpu_load. Cc: Paolo Bonzini Cc: Radim Krčmář Signed-off-by: Wanpeng Li Signed-off-by: Paolo Bonzini arch/x86/kvm/lapic.c | 2 ++ 1 file changed, 2 insertions(+) commit 83b4605b0c16cde5b00c8cf192408d51eab75402 Author: Christoph Hellwig Date: Sat May 20 18:59:54 2017 +0200 PCI/msi: fix the pci_alloc_irq_vectors_affinity stub We need to return an error for any call that asks for MSI / MSI-X vectors only, so that non-trivial fallback logic can work properly. Also valid dev->irq and use the "correct" errno value based on feedback from Linus. Signed-off-by: Christoph Hellwig Reported-by: Steven Rostedt Fixes: aff17164 ("PCI: Provide sensible IRQ vector alloc/free routines") Signed-off-by: Linus Torvalds include/linux/pci.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit db145db99f5bf30acc12d7450b9ad0707072a7be Author: Enric Balletbo i Serra Date: Mon May 22 11:01:53 2017 +0200 ARM: dts: am335x-sl50: Fix cannot claim requested pins for spi0 We don't need to bitbang these pins anymore, instead we muxed these pins as SPI, after this change, done in commit 6c69f726, we introduced the following error: pinctrl-single 44e10800.pinmux: pin PIN85 already requested \ by 44e10800.pinmux; cannot claim for 48030000.spi pinctrl-single 44e10800.pinmux: pin-85 (48030000.spi) status -22 Fixes: 6c69f726 ("ARM: dts: am335x-sl50: Enable SPI0 interface and Flash Memory") Cc: # 4.11 Signed-off-by: Enric Balletbo i Serra Signed-off-by: Tony Lindgren arch/arm/boot/dts/am335x-sl50.dts | 4 ---- 1 file changed, 4 deletions(-) commit 56b74ed9c1e8050408b9beeee25888a49a458997 Author: Enric Balletbo i Serra Date: Mon May 22 11:01:52 2017 +0200 ARM: dts: am335x-sl50: Fix card detect pin for mmc1 The second version of the hardware moved the card detect pin from gpio0_6 to gpio1_9, as we won't support the first hardware version fix the pinmux configuration of this pin. Fixes: 8584d4fc ("ARM: dts: am335x-sl50: Add Toby-Churchill SL50 board support.") Cc: # 4.11 Signed-off-by: Enric Balletbo i Serra Signed-off-by: Tony Lindgren arch/arm/boot/dts/am335x-sl50.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 8aa6382907fa495e6b8b8184b53e36d142ffd8da Merge: a8ecdd7 50af47d Author: Jens Axboe Date: Fri May 26 09:11:19 2017 -0600 Merge branch 'nvme-4.12' of git://git.infradead.org/nvme into for-linus Christoph writes: "A couple of fixes for the next rc on the nvme front. Various FC fixes from James, controller removal fixes from Ming (including a block layer patch), a APST related device quirk from Andy, a RDMA fix for small queue depth device from Marta, as well as fixes for the lack of metadata support in non-PCIe drivers and the printk logging format from me." commit a8ecdd7117ee68fe27009acc8021423870c1dcd7 Author: Bart Van Assche Date: Thu May 25 16:38:06 2017 -0700 blk-mq: Only register debugfs attributes for blk-mq queues The code in blk-mq-debugfs.c assumes that it is working on a blk-mq queue and is not intended to work on a blk-sq queue. Hence only register blk-mq debugfs attributes for blk-mq queues. Fixes: commit 9c1051aacde8 ("blk-mq: untangle debugfs and sysfs") Signed-off-by: Bart Van Assche Cc: Christoph Hellwig Cc: Ming Lei Reviewed-by: Omar Sandoval Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe block/blk-sysfs.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 7327a946a3b921d60d48924d34ac99eae2fae57d Merge: 6a9905e fe0dfd6 Author: Mark Brown Date: Fri May 26 12:42:28 2017 +0100 Merge remote-tracking branch 'asoc/fix/rt286' into asoc-linus commit 6a9905e52c15bc44c791700ba58f2c2d3551363f Merge: 7a7ef5b 61abce1 3a1672b 14f814f 4efda5f f746aa5 Author: Mark Brown Date: Fri May 26 12:42:25 2017 +0100 Merge remote-tracking branches 'asoc/fix/atmel', 'asoc/fix/cirrus', 'asoc/fix/da7213', 'asoc/fix/free' and 'asoc/fix/jack' into asoc-linus commit 7a7ef5b9d563abd1f7b97b909aa38fa08b4e9d97 Merge: 5e8338d e8a3ce1 Author: Mark Brown Date: Fri May 26 12:42:24 2017 +0100 Merge remote-tracking branch 'asoc/fix/rcar' into asoc-linus commit 5e8338db849fae05ef910de4213976a9d37e9b15 Merge: 0833289 0a71677 Author: Mark Brown Date: Fri May 26 12:42:24 2017 +0100 Merge remote-tracking branch 'asoc/fix/intel' into asoc-linus commit e8a3ce1130134046e9da132aa4d043566df8237d Author: Kuninori Morimoto Date: Fri May 26 01:44:19 2017 +0000 ASoC: rsnd: fixup parent_clk_name of AUDIO_CLKOUTx commit 25165f79adc7 ("ASoC: rsnd: enable clock-frequency for both 44.1kHz/48kHz") supported both 44.1kHz/48kHz for AUDIO_CLKOUTx, but it didn't care its parent clock name. This patch fixes it. Signed-off-by: Kuninori Morimoto Signed-off-by: Mark Brown sound/soc/sh/rcar/adg.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 702644ec1cab10ffefcebb4060d4da46d4ef2c7f Author: Jan Kiszka Date: Wed May 24 20:04:41 2017 +0200 x86/timers: Move simple_udelay_calibration past init_hypervisor_platform This ensures that adjustments to x86_platform done by the hypervisor setup is already respected by this simple calibration. The current user of this, introduced by 1b5aeebf3a92 ("x86/earlyprintk: Add support for earlyprintk via USB3 debug port"), comes much later into play. Fixes: dd759d93f4dd ("x86/timers: Add simple udelay calibration") Signed-off-by: Jan Kiszka Signed-off-by: Thomas Gleixner Acked-by: Lu Baolu Link: http://lkml.kernel.org/r/5e89fe60-aab3-2c1c-aba8-32f8ad376189@siemens.com arch/x86/kernel/setup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 50af47d04ca530544b27affffb0722f158e2bb9c Author: Andy Lutomirski Date: Wed May 24 15:06:31 2017 -0700 nvme: Quirk APST on Intel 600P/P3100 devices They have known firmware bugs. A fix is apparently in the works -- once fixed firmware is available, someone from Intel (Hi, Keith!) can adjust the quirk accordingly. Cc: stable@vger.kernel.org # v4.11 Cc: Kai-Heng Feng Cc: Mario Limonciello Signed-off-by: Andy Lutomirski Signed-off-by: Christoph Hellwig drivers/nvme/host/pci.c | 2 ++ 1 file changed, 2 insertions(+) commit 9bd9590997b92fbd79fd028f704f6c584b4439d7 Author: Ville Syrjälä Date: Thu Apr 27 19:02:22 2017 +0300 drm/i915: Stop pretending to mask/unmask LPE audio interrupts vlv_display_irq_postinstall() enables the LPE audio interrupts regardless of whether the LPE audio irq chip has masked/unmasked them. Also the irqchip masking/unmasking doesn't consider the state of the display power well or the device, and hence just leads to dmesg spew when it tries to access the hardware while it's powered down. If the current way works, then we don't need to do anything in the mask/unmask hooks. If it doesn't work, well, then we'd need to properly track whether the irqchip has masked/unmasked the interrupts when we enable display interrupts. And the mask/unmask hooks would need to check whether display interrupts are even enabled before frobbing with he registers. So let's just assume the current way works and neuter the mask/unmask hooks. Also clean up vlv_display_irq_postinstall() a bit and stop it from trying to unmask/enable the LPE C interrupt on VLV since it doesn't exist. Cc: Takashi Iwai Cc: Pierre-Louis Bossart Signed-off-by: Ville Syrjälä Link: http://patchwork.freedesktop.org/patch/msgid/20170427160231.13337-4-ville.syrjala@linux.intel.com Reviewed-by: Takashi Iwai (cherry picked from commit ebf5f921478b9b55ed4e634b994571dd23a8fca3) Reference: http://mid.mail-archive.com/874cf6d3-4e45-d4cf-e662-eb972490d2ce@redhat.com Tested-by: Hans de Goede Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_irq.c | 15 ++++++-------- drivers/gpu/drm/i915/intel_lpe_audio.c | 36 ---------------------------------- 2 files changed, 6 insertions(+), 45 deletions(-) commit 12ea39f8daf206eaaf926adf8f162b2f230bfb38 Merge: 2e0bb5b e274086 Author: Jani Nikula Date: Fri May 26 11:12:35 2017 +0300 Merge tag 'gvt-fixes-2017-05-25' of https://github.com/01org/gvt-linux into drm-intel-fixes gvt-fixes-2017-05-25 - workload cleanup fix for vGPU destroy (Changbin) - disable compression workaround to fix vGPU hang (Chuanxiao) Signed-off-by: Jani Nikula Link: http://patchwork.freedesktop.org/patch/msgid/20170525083802.ae4uwx2qks2ho35b@zhen-hp.sh.intel.com commit 791229f1d530a0f0a680a4c09f98199792485f33 Author: Murali Karicheri Date: Wed Mar 29 16:02:18 2017 +0530 ARM: dts: keystone-k2l: fix broken Ethernet due to disabled OSR Ethernet networking on K2L has been broken since v4.11-rc1. This was caused by commit 32a34441a9bd ("ARM: keystone: dts: fix netcp clocks and add names"). This commit inadvertently moves on-chip static RAM clock to the end of list of clocks provided for netcp. Since keystone PM domain support does not have a list of recognized con_ids, only the first clock in the list comes under runtime PM management. This means the OSR (On-chip Static RAM) clock remains disabled and that broke networking on K2L. The OSR is used by QMSS on K2L as an external linking RAM. However this is a standalone RAM that can be used for non-QMSS usage (as well as from DSP side). So add a SRAM device node for the same and add the OSR clock to the node. Remove the now redundant OSR clock node from netcp. To manage all clocks defined for netCP's use by runtime PM needs keystone generic power domain (genpd) driver support which is under works. Meanwhile, this patch restores K2L networking and is correct irrespective of any future genpd work since OSR is an independent module and not part of NetCP anyway. Signed-off-by: Murali Karicheri Acked-by: Tero Kristo [nsekhar@ti.com: commit message updates, port to latest mainline] Signed-off-by: Sekhar Nori Cc: stable@vger.kernel.org # for 4.11 Acked-by: Santosh Shilimkar Signed-off-by: Arnd Bergmann arch/arm/boot/dts/keystone-k2l-netcp.dtsi | 4 ++-- arch/arm/boot/dts/keystone-k2l.dtsi | 8 ++++++++ 2 files changed, 10 insertions(+), 2 deletions(-) commit c81bfba9983fc44210d3eb5971e0faac597bf50d Author: Christoph Hellwig Date: Sat May 20 15:14:45 2017 +0200 nvme: only setup block integrity if supported by the driver Currently only the PCIe driver supports metadata, so we should not claim integrity support for the other drivers. This prevents nasty crashes with targets that advertise metadata support on fabrics. Also use the opportunity to factor out some code into a separate helper that isn't even compiled if CONFIG_BLK_DEV_INTEGRITY is disabled. Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch drivers/nvme/host/core.c | 50 ++++++++++++++++++++++++++++++------------------ drivers/nvme/host/nvme.h | 1 + drivers/nvme/host/pci.c | 1 + 3 files changed, 33 insertions(+), 19 deletions(-) commit d3d5b87ddde09bade512526f6df90e8c06c28230 Author: Christoph Hellwig Date: Sat May 20 15:14:44 2017 +0200 nvme: replace is_flags field in nvme_ctrl_ops with a flags field So that we can have more flags for transport-specific behavior. Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch drivers/nvme/host/core.c | 2 +- drivers/nvme/host/fc.c | 2 +- drivers/nvme/host/nvme.h | 3 ++- drivers/nvme/host/rdma.c | 2 +- drivers/nvme/target/loop.c | 2 +- 5 files changed, 6 insertions(+), 5 deletions(-) commit 9bdcfb10f221e796c9619fe48655e0f1272f1d92 Author: Christoph Hellwig Date: Sat May 20 15:14:43 2017 +0200 nvme-pci: consistencly use ctrl->device for logging This is what most of the code already does and gives much more useful prefixes than the device embedded in the pci_dev. Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch drivers/nvme/host/pci.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit bc1f0e04da20473d6fea4444b0cd9ac638a348d5 Merge: 538fd19 b62ce39 Author: Dave Airlie Date: Fri May 26 11:51:55 2017 +1000 Merge branch 'drm-fixes-4.12' of git://people.freedesktop.org/~agd5f/linux into drm-fixes A bunch of bug fixes: - Fix display flickering on some chips at high refresh rates - suspend/resume fix - hotplug fix - a couple of segfault fixes for certain cases * 'drm-fixes-4.12' of git://people.freedesktop.org/~agd5f/linux: drm/amdgpu: fix null point error when rmmod amdgpu. drm/amd/powerplay: fix a signedness bugs drm/amdgpu: fix NULL pointer panic of emit_gds_switch drm/radeon: Unbreak HPD handling for r600+ drm/amd/powerplay/smu7: disable mclk switching for high refresh rates drm/amd/powerplay/smu7: add vblank check for mclk switching (v2) drm/radeon/ci: disable mclk switching for high refresh rates (v2) drm/amdgpu/ci: disable mclk switching for high refresh rates (v2) drm/amdgpu: fix fundamental suspend/resume issue commit 538fd19ed7e24728b469704f702c2826281578b4 Merge: 0833289 82bc9a4 Author: Dave Airlie Date: Fri May 26 11:51:28 2017 +1000 Merge tag 'drm-misc-fixes-2017-05-25' of git://anongit.freedesktop.org/git/drm-misc into drm-fixes Core Changes: - Don't drop vblank reference more than once in cases of ww retry (Daniel) Driver Changes: - radeon: Fix oops during radeon probe trying to reference wrong device (Lukas) - qxl: Avoid sleeping while in atomic context on cursor update (Gabriel) - gma500: Use VBT mode instead of pre-programmed mode for LVDS (Patrik) Cc: Lukas Wunner Cc: Gabriel Krisman Bertazi Cc: Daniel Vetter Cc: Patrik Jakobsson * tag 'drm-misc-fixes-2017-05-25' of git://anongit.freedesktop.org/git/drm-misc: drm/gma500/psb: Actually use VBT mode when it is found drm: Fix deadlock retry loop in page_flip_ioctl drm: qxl: Delay entering atomic context during cursor update drm/radeon: Fix oops upon driver load on PowerXpress laptops commit 5612ac83b9d7a32a7f2967d9f6f97e7f3428dfd2 Merge: 962ef41 1c005f9 Author: Olof Johansson Date: Thu May 25 17:04:44 2017 -0700 Merge tag 'samsung-fixes-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into fixes Update of maintainers entry for Samsung SoC. * tag 'samsung-fixes-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: MAINTAINERS: Remove Javier Martinez Canillas as reviewer for Exynos Signed-off-by: Olof Johansson commit 962ef410d933dcf92303470484e101f4661d58cc Merge: 5711ea1 6c0c57a Author: Olof Johansson Date: Thu May 25 17:02:05 2017 -0700 Merge tag 'arm-soc/for-4.12/devicetree-fixes-2' of http://github.com/Broadcom/stblinux into fixes This pull request contains Broadcom ARM-based SoCs Device Tree fixes for 4.12, please pull the following: - Phil provides a fix for the BCM283x (Raspberry Pi) by flagging the first 4KiB of physical memory as a reserved region in order to let the secondary cores successfully spin until they are brought online * tag 'arm-soc/for-4.12/devicetree-fixes-2' of http://github.com/Broadcom/stblinux: ARM: dts: bcm283x: Reserve first page for firmware Signed-off-by: Olof Johansson commit 5711ea1b5421cbc3f0e35162e3d9611b1a57544c Author: Heiko Stuebner Date: Thu May 25 01:06:50 2017 +0200 arm64: defconfig: enable some core options for 64bit Rockchip socs Enable some very core config options used on 64bit Rockchip socs. As built-in driver enable the Rockchip spi driver as well as the cros-ec-spi and cros-ec keyboard driver, as this may be helpful in case an initrd does not work as expected and drops the user into a shell. Another built-in is the fan53555 regulator driver, as it and its register-compatible cousins Silergy syr827 and syr828 are often used on Rockchip socs as cpu-supply next to regular pmic. The rest can be enabled as modules and contains the pcie host controller and its phy, the sucessive approximation adc (saradc) that gets often used for additional buttons on Rockchip boards as well as the adc-keys Keyboard driver for these keys. The cros-ec-pwm also can be a module, as it is normally only used to drive display backlights as well as the Rockchip thermal controller that allows to read the cpu and gpu temperatures and affect frequency scaling if necessary. Signed-off-by: Heiko Stuebner Signed-off-by: Olof Johansson arch/arm64/configs/defconfig | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 3616aa198fdc3c673ce920a138913b933c1f31a7 Merge: 6bf1c2d 95d7c1f Author: Olof Johansson Date: Thu May 25 16:59:43 2017 -0700 Merge tag 'davinci-fixes-for-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/nsekhar/linux-davinci into fixes These fix issues with power management initialization code on DaVinci. Some resources were getting freed prematurely. And there was an issue with resources not being on error. * tag 'davinci-fixes-for-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/nsekhar/linux-davinci: ARM: davinci: PM: Do not free useful resources in normal path in 'davinci_pm_init' ARM: davinci: PM: Free resources in error handling path in 'davinci_pm_init' Signed-off-by: Olof Johansson commit 658a7568030e287215b069a9c383c0fd0c5f57d5 Merge: 370d919 dbed87a Author: Michael Turquette Date: Thu May 25 14:11:11 2017 -0700 Merge tag 'meson-clk-fixes-for-4.12-rc2' of git://github.com/baylibre/clk-meson into clk-fixes KConfig fix: - clk: meson: gxbb: fix build error without RESET_CONTROLLER commit 370d9192719e6c174167888cf9240df2542e3b4b Author: Boris Brezillon Date: Wed May 24 18:34:29 2017 +0200 clk: sunxi-ng: sun5i: Fix ahb_bist_clk definition AHB BIST gate is actually controlled with bit 7. This bug was detected while trying to use the NAND controller which is using the DMA engine to transfer data to the NAND. Since the ahb_bist_clk gate bit conflicts with the ahb_dma_clk gate bit, the core was disabling the DMA engine clock as part of its 'disable unused clks' procedure, which was causing all DMA transfers to fail after this point. Fixes: 5e73761786d6 ("clk: sunxi-ng: Add sun5i CCU driver") Cc: stable@vger.kernel.org Reported-by: Angus Ainslie Signed-off-by: Boris Brezillon Tested-by: Angus Ainslie Reviewed-by: Chen-Yu Tsai Signed-off-by: Michael Turquette Link: lkml.kernel.org/r/1495643669-28221-1-git-send-email-boris.brezillon@free-electrons.com drivers/clk/sunxi-ng/ccu-sun5i.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 797a93647a48d6cb8a20641a86a71713a947f786 Author: Nithin Sujir Date: Wed May 24 19:45:17 2017 -0700 bonding: Don't update slave->link until ready to commit In the loadbalance arp monitoring scheme, when a slave link change is detected, the slave->link is immediately updated and slave_state_changed is set. Later down the function, the rtnl_lock is acquired and the changes are committed, updating the bond link state. However, the acquisition of the rtnl_lock can fail. The next time the monitor runs, since slave->link is already updated, it determines that link is unchanged. This results in the bond link state permanently out of sync with the slave link. This patch modifies bond_loadbalance_arp_mon() to handle link changes identical to bond_ab_arp_{inspect/commit}(). The new link state is maintained in slave->new_link until we're ready to commit at which point it's copied into slave->link. NOTE: miimon_{inspect/commit}() has a more complex state machine requiring the use of the bond_{propose,commit}_link_state() functions which maintains the intermediate state in slave->link_new_state. The arp monitors don't require that. Testing: This bug is very easy to reproduce with the following steps. 1. In a loop, toggle a slave link of a bond slave interface. 2. In a separate loop, do ifconfig up/down of an unrelated interface to create contention for rtnl_lock. Within a few iterations, the bond link goes out of sync with the slave link. Signed-off-by: Nithin Nayak Sujir Cc: Mahesh Bandewar Cc: Jay Vosburgh Acked-by: Mahesh Bandewar Signed-off-by: David S. Miller drivers/net/bonding/bond_main.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) commit 791caeb084c57e3a4d648cf1ee799d1f70c0ef4e Author: David Daney Date: Wed May 24 16:35:49 2017 -0700 test_bpf: Add a couple of tests for BPF_JSGE. Some JITs can optimize comparisons with zero. Add a couple of BPF_JSGE tests against immediate zero. Signed-off-by: David Daney Acked-by: Daniel Borkmann Signed-off-by: David S. Miller lib/test_bpf.c | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) commit ae08ea976862dcd058af89fcddc2ef4790b4a2bd Merge: 5990baa 614d0d7 Author: David S. Miller Date: Thu May 25 13:44:29 2017 -0400 Merge branch 'bpf-fixes' Daniel Borkmann says: ==================== Various BPF fixes Follow-up to fix incorrect pruning when alignment tracking is in use and to properly clear regs after call to not leave stale data behind, also a fix that adds bpf_clone_redirect to the bpf_helper_changes_pkt_data helper and exposes correct map_flags for lpm map into fdinfo. For details, please see individual patches. v1 -> v2: - Reworked first patch so that env->strict_alignment is the final indicator on whether we have to deal with strict alignment rather than having CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS checks on various locations, so only checking env->strict_alignment is sufficient after that. Thanks for spotting, Dave! - Added patch 3 and 4. - Rest as is. ==================== Signed-off-by: David S. Miller commit 614d0d77b49a9b131e58b77473698ab5b2c525b7 Author: Daniel Borkmann Date: Thu May 25 01:05:09 2017 +0200 bpf: add various verifier test cases This patch adds various verifier test cases: 1) A test case for the pruning issue when tracking alignment is used. 2) Various PTR_TO_MAP_VALUE_OR_NULL tests to make sure pointer arithmetic turns such register into UNKNOWN_VALUE type. 3) Test cases for the special treatment of LD_ABS/LD_IND to make sure verifier doesn't break calling convention here. Latter is needed, since f.e. arm64 JIT uses r1 - r5 for storing temporary data, so they really must be marked as NOT_INIT. Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: David S. Miller include/linux/filter.h | 10 ++ tools/include/linux/filter.h | 10 ++ tools/testing/selftests/bpf/test_verifier.c | 239 +++++++++++++++++++++++++++- 3 files changed, 255 insertions(+), 4 deletions(-) commit a316338cb71a3260201490e615f2f6d5c0d8fb2c Author: Daniel Borkmann Date: Thu May 25 01:05:08 2017 +0200 bpf: fix wrong exposure of map_flags into fdinfo for lpm trie_alloc() always needs to have BPF_F_NO_PREALLOC passed in via attr->map_flags, since it does not support preallocation yet. We check the flag, but we never copy the flag into trie->map.map_flags, which is later on exposed into fdinfo and used by loaders such as iproute2. Latter uses this in bpf_map_selfcheck_pinned() to test whether a pinned map has the same spec as the one from the BPF obj file and if not, bails out, which is currently the case for lpm since it exposes always 0 as flags. Also copy over flags in array_map_alloc() and stack_map_alloc(). They always have to be 0 right now, but we should make sure to not miss to copy them over at a later point in time when we add actual flags for them to use. Fixes: b95a5c4db09b ("bpf: add a longest prefix match trie map implementation") Reported-by: Jarno Rajahalme Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: David S. Miller kernel/bpf/arraymap.c | 1 + kernel/bpf/lpm_trie.c | 1 + kernel/bpf/stackmap.c | 1 + 3 files changed, 3 insertions(+) commit 41703a731066fde79c3e5ccf3391cf77a98aeda5 Author: Daniel Borkmann Date: Thu May 25 01:05:07 2017 +0200 bpf: add bpf_clone_redirect to bpf_helper_changes_pkt_data The bpf_clone_redirect() still needs to be listed in bpf_helper_changes_pkt_data() since we call into bpf_try_make_head_writable() from there, thus we need to invalidate prior pkt regs as well. Fixes: 36bbef52c7eb ("bpf: direct packet write and access for helpers for clsact progs") Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: David S. Miller net/core/filter.c | 1 + 1 file changed, 1 insertion(+) commit a9789ef9afcb4fb0193f8dd94f2665ba3ad71e79 Author: Daniel Borkmann Date: Thu May 25 01:05:06 2017 +0200 bpf: properly reset caller saved regs after helper call and ld_abs/ind Currently, after performing helper calls, we clear all caller saved registers, that is r0 - r5 and fill r0 depending on struct bpf_func_proto specification. The way we reset these regs can affect pruning decisions in later paths, since we only reset register's imm to 0 and type to NOT_INIT. However, we leave out clearing of other variables such as id, min_value, max_value, etc, which can later on lead to pruning mismatches due to stale data. Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: David S. Miller kernel/bpf/verifier.c | 37 ++++++++++++++++--------------------- 1 file changed, 16 insertions(+), 21 deletions(-) commit 1ad2f5838d345e1c102bd1cd27c4f4c1349b0dc8 Author: Daniel Borkmann Date: Thu May 25 01:05:05 2017 +0200 bpf: fix incorrect pruning decision when alignment must be tracked Currently, when we enforce alignment tracking on direct packet access, the verifier lets the following program pass despite doing a packet write with unaligned access: 0: (61) r2 = *(u32 *)(r1 +76) 1: (61) r3 = *(u32 *)(r1 +80) 2: (61) r7 = *(u32 *)(r1 +8) 3: (bf) r0 = r2 4: (07) r0 += 14 5: (25) if r7 > 0x1 goto pc+4 R0=pkt(id=0,off=14,r=0) R1=ctx R2=pkt(id=0,off=0,r=0) R3=pkt_end R7=inv,min_value=0,max_value=1 R10=fp 6: (2d) if r0 > r3 goto pc+1 R0=pkt(id=0,off=14,r=14) R1=ctx R2=pkt(id=0,off=0,r=14) R3=pkt_end R7=inv,min_value=0,max_value=1 R10=fp 7: (63) *(u32 *)(r0 -4) = r0 8: (b7) r0 = 0 9: (95) exit from 6 to 8: R0=pkt(id=0,off=14,r=0) R1=ctx R2=pkt(id=0,off=0,r=0) R3=pkt_end R7=inv,min_value=0,max_value=1 R10=fp 8: (b7) r0 = 0 9: (95) exit from 5 to 10: R0=pkt(id=0,off=14,r=0) R1=ctx R2=pkt(id=0,off=0,r=0) R3=pkt_end R7=inv,min_value=2 R10=fp 10: (07) r0 += 1 11: (05) goto pc-6 6: safe <----- here, wrongly found safe processed 15 insns However, if we enforce a pruning mismatch by adding state into r8 which is then being mismatched in states_equal(), we find that for the otherwise same program, the verifier detects a misaligned packet access when actually walking that path: 0: (61) r2 = *(u32 *)(r1 +76) 1: (61) r3 = *(u32 *)(r1 +80) 2: (61) r7 = *(u32 *)(r1 +8) 3: (b7) r8 = 1 4: (bf) r0 = r2 5: (07) r0 += 14 6: (25) if r7 > 0x1 goto pc+4 R0=pkt(id=0,off=14,r=0) R1=ctx R2=pkt(id=0,off=0,r=0) R3=pkt_end R7=inv,min_value=0,max_value=1 R8=imm1,min_value=1,max_value=1,min_align=1 R10=fp 7: (2d) if r0 > r3 goto pc+1 R0=pkt(id=0,off=14,r=14) R1=ctx R2=pkt(id=0,off=0,r=14) R3=pkt_end R7=inv,min_value=0,max_value=1 R8=imm1,min_value=1,max_value=1,min_align=1 R10=fp 8: (63) *(u32 *)(r0 -4) = r0 9: (b7) r0 = 0 10: (95) exit from 7 to 9: R0=pkt(id=0,off=14,r=0) R1=ctx R2=pkt(id=0,off=0,r=0) R3=pkt_end R7=inv,min_value=0,max_value=1 R8=imm1,min_value=1,max_value=1,min_align=1 R10=fp 9: (b7) r0 = 0 10: (95) exit from 6 to 11: R0=pkt(id=0,off=14,r=0) R1=ctx R2=pkt(id=0,off=0,r=0) R3=pkt_end R7=inv,min_value=2 R8=imm1,min_value=1,max_value=1,min_align=1 R10=fp 11: (07) r0 += 1 12: (b7) r8 = 0 13: (05) goto pc-7 <----- mismatch due to r8 7: (2d) if r0 > r3 goto pc+1 R0=pkt(id=0,off=15,r=15) R1=ctx R2=pkt(id=0,off=0,r=15) R3=pkt_end R7=inv,min_value=2 R8=imm0,min_value=0,max_value=0,min_align=2147483648 R10=fp 8: (63) *(u32 *)(r0 -4) = r0 misaligned packet access off 2+15+-4 size 4 The reason why we fail to see it in states_equal() is that the third test in compare_ptrs_to_packet() ... if (old->off <= cur->off && old->off >= old->range && cur->off >= cur->range) return true; ... will let the above pass. The situation we run into is that old->off <= cur->off (14 <= 15), meaning that prior walked paths went with smaller offset, which was later used in the packet access after successful packet range check and found to be safe already. For example: Given is R0=pkt(id=0,off=0,r=0). Adding offset 14 as in above program to it, results in R0=pkt(id=0,off=14,r=0) before the packet range test. Now, testing this against R3=pkt_end with 'if r0 > r3 goto out' will transform R0 into R0=pkt(id=0,off=14,r=14) for the case when we're within bounds. A write into the packet at offset *(u32 *)(r0 -4), that is, 2 + 14 -4, is valid and aligned (2 is for NET_IP_ALIGN). After processing this with all fall-through paths, we later on check paths from branches. When the above skb->mark test is true, then we jump near the end of the program, perform r0 += 1, and jump back to the 'if r0 > r3 goto out' test we've visited earlier already. This time, R0 is of type R0=pkt(id=0,off=15,r=0), and we'll prune that part because this time we'll have a larger safe packet range, and we already found that with off=14 all further insn were already safe, so it's safe as well with a larger off. However, the problem is that the subsequent write into the packet with 2 + 15 -4 is then unaligned, and not caught by the alignment tracking. Note that min_align, aux_off, and aux_off_align were all 0 in this example. Since we cannot tell at this time what kind of packet access was performed in the prior walk and what minimal requirements it has (we might do so in the future, but that requires more complexity), fix it to disable this pruning case for strict alignment for now, and let the verifier do check such paths instead. With that applied, the test cases pass and reject the program due to misalignment. Fixes: d1174416747d ("bpf: Track alignment of register values in the verifier.") Reference: http://patchwork.ozlabs.org/patch/761909/ Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: David S. Miller kernel/bpf/verifier.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) commit 5990baaa6d7b437dfcf58b7021ca56b1d6b35869 Author: Ihar Hrachyshka Date: Wed May 24 15:19:35 2017 -0700 arp: fixed -Wuninitialized compiler warning Commit 7d472a59c0e5ec117220a05de6b370447fb6cb66 ("arp: always override existing neigh entries with gratuitous ARP") introduced a compiler warning: net/ipv4/arp.c:880:35: warning: 'addr_type' may be used uninitialized in this function [-Wmaybe-uninitialized] While the code logic seems to be correct and doesn't allow the variable to be used uninitialized, and the warning is not consistently reproducible, it's still worth fixing it for other people not to waste time looking at the warning in case it pops up in the build environment. Yes, compiler is probably at fault, but we will need to accommodate. Fixes: 7d472a59c0e5 ("arp: always override existing neigh entries with gratuitous ARP") Signed-off-by: Ihar Hrachyshka Signed-off-by: David S. Miller net/ipv4/arp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ba615f675281d76fd19aa03558777f81fb6b6084 Author: Wei Wang Date: Wed May 24 09:59:31 2017 -0700 tcp: avoid fastopen API to be used on AF_UNSPEC Fastopen API should be used to perform fastopen operations on the TCP socket. It does not make sense to use fastopen API to perform disconnect by calling it with AF_UNSPEC. The fastopen data path is also prone to race conditions and bugs when using with AF_UNSPEC. One issue reported and analyzed by Vegard Nossum is as follows: +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Thread A: Thread B: ------------------------------------------------------------------------ sendto() - tcp_sendmsg() - sk_stream_memory_free() = 0 - goto wait_for_sndbuf - sk_stream_wait_memory() - sk_wait_event() // sleep | sendto(flags=MSG_FASTOPEN, dest_addr=AF_UNSPEC) | - tcp_sendmsg() | - tcp_sendmsg_fastopen() | - __inet_stream_connect() | - tcp_disconnect() //because of AF_UNSPEC | - tcp_transmit_skb()// send RST | - return 0; // no reconnect! | - sk_stream_wait_connect() | - sock_error() | - xchg(&sk->sk_err, 0) | - return -ECONNRESET - ... // wake up, see sk->sk_err == 0 - skb_entail() on TCP_CLOSE socket If the connection is reopened then we will send a brand new SYN packet after thread A has already queued a buffer. At this point I think the socket internal state (sequence numbers etc.) becomes messed up. When the new connection is closed, the FIN-ACK is rejected because the sequence number is outside the window. The other side tries to retransmit, but __tcp_retransmit_skb() calls tcp_trim_head() on an empty skb which corrupts the skb data length and hits a BUG() in copy_and_csum_bits(). +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Hence, this patch adds a check for AF_UNSPEC in the fastopen data path and return EOPNOTSUPP to user if such case happens. Fixes: cf60af03ca4e7 ("tcp: Fast Open client - sendmsg(MSG_FASTOPEN)") Reported-by: Vegard Nossum Signed-off-by: Wei Wang Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller net/ipv4/tcp.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 7c3f1875c66fbc19762760097cabc91849ea0bbb Author: Roman Kapl Date: Wed May 24 10:22:22 2017 +0200 net: move somaxconn init from sysctl code The default value for somaxconn is set in sysctl_core_net_init(), but this function is not called when kernel is configured without CONFIG_SYSCTL. This results in the kernel not being able to accept TCP connections, because the backlog has zero size. Usually, the user ends up with: "TCP: request_sock_TCP: Possible SYN flooding on port 7. Dropping request. Check SNMP counters." If SYN cookies are not enabled the connection is rejected. Before ef547f2ac16 (tcp: remove max_qlen_log), the effects were less severe, because the backlog was always at least eight slots long. Signed-off-by: Roman Kapl Signed-off-by: David S. Miller net/core/net_namespace.c | 19 +++++++++++++++++++ net/core/sysctl_net_core.c | 2 -- 2 files changed, 19 insertions(+), 2 deletions(-) commit a04f144059ac09f2c3da50b5707df589044aad66 Author: KT Liao Date: Tue May 23 13:41:47 2017 -0700 Input: elan_i2c - ignore signals when finishing updating firmware Use wait_for_completion_timeout() instead of wait_for_completion_interruptible_timeout() to avoid stray signals ruining firmware update. Our timeout is only 300 msec so we are fine simply letting it expire in case device misbehaves. Signed-off-by: KT Liao Signed-off-by: Dmitry Torokhov drivers/input/mouse/elan_i2c_i2c.c | 21 ++++++++------------- 1 file changed, 8 insertions(+), 13 deletions(-) commit 4b3c7dbbfff0673e8a89575414b864d8b001d3bb Author: KT Liao Date: Thu May 25 10:06:21 2017 -0700 Input: elan_i2c - clear INT before resetting controller Some old touchpad FWs need to have interrupt cleared before issuing reset command after updating firmware. We clear interrupt by attempting to read full report from the controller, and discarding any data read. Signed-off-by: KT Liao Signed-off-by: Dmitry Torokhov drivers/input/mouse/elan_i2c_i2c.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit 65d786c21bf8140dac83563306f46fe0b13a9aaa Author: Gustavo A. R. Silva Date: Tue May 23 18:18:37 2017 -0500 net: fix potential null pointer dereference Add null check to avoid a potential null pointer dereference. Addresses-Coverity-ID: 1408831 Signed-off-by: Gustavo A. R. Silva Acked-by: Pablo Neira Ayuso Signed-off-by: David S. Miller drivers/net/gtp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b62ce397675502325d4282924bf70cfb6a005c3a Author: Rex Zhu Date: Mon May 22 13:11:41 2017 +0800 drm/amdgpu: fix null point error when rmmod amdgpu. this bug happened when amdgpu load failed. [ 75.740951] BUG: unable to handle kernel paging request at 00000000000031c0 [ 75.748167] IP: [] amdgpu_fbdev_restore_mode+0x20/0x60 [amdgpu] [ 75.755774] PGD 0 [ 75.759185] Oops: 0000 [#1] SMP [ 75.762408] Modules linked in: amdgpu(OE-) ttm(OE) drm_kms_helper(OE) drm(OE) i2c_algo_bit(E) fb_sys_fops(E) syscopyarea(E) sysfillrect(E) sysimgblt(E) rpcsec_gss_krb5(E) nfsv4(E) nfs(E) fscache(E) eeepc_wmi(E) asus_wmi(E) sparse_keymap(E) intel_rapl(E) snd_hda_codec_hdmi(E) snd_hda_codec_realtek(E) snd_hda_codec_generic(E) snd_hda_intel(E) snd_hda_codec(E) snd_hda_core(E) x86_pkg_temp_thermal(E) intel_powerclamp(E) snd_hwdep(E) snd_pcm(E) snd_seq_midi(E) coretemp(E) kvm_intel(E) snd_seq_midi_event(E) snd_rawmidi(E) kvm(E) snd_seq(E) joydev(E) snd_seq_device(E) snd_timer(E) irqbypass(E) crct10dif_pclmul(E) crc32_pclmul(E) mei_me(E) ghash_clmulni_intel(E) snd(E) aesni_intel(E) mei(E) soundcore(E) aes_x86_64(E) shpchp(E) serio_raw(E) lrw(E) acpi_pad(E) gf128mul(E) glue_helper(E) ablk_helper(E) mac_hid(E) [ 75.835574] cryptd(E) parport_pc(E) ppdev(E) lp(E) nfsd(E) parport(E) auth_rpcgss(E) nfs_acl(E) lockd(E) grace(E) sunrpc(E) autofs4(E) hid_generic(E) usbhid(E) mxm_wmi(E) psmouse(E) e1000e(E) ptp(E) pps_core(E) ahci(E) libahci(E) wmi(E) video(E) i2c_hid(E) hid(E) [ 75.858489] CPU: 5 PID: 1603 Comm: rmmod Tainted: G OE 4.9.0-custom #2 [ 75.866183] Hardware name: System manufacturer System Product Name/Z170-A, BIOS 0901 08/31/2015 [ 75.875050] task: ffff88045d1bbb80 task.stack: ffffc90002de4000 [ 75.881094] RIP: 0010:[] [] amdgpu_fbdev_restore_mode+0x20/0x60 [amdgpu] [ 75.891238] RSP: 0018:ffffc90002de7d48 EFLAGS: 00010286 [ 75.896648] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000001 [ 75.903933] RDX: 0000000000000000 RSI: ffff88045d1bbb80 RDI: 0000000000000286 [ 75.911183] RBP: ffffc90002de7d50 R08: 0000000000000502 R09: 0000000000000004 [ 75.918449] R10: 0000000000000000 R11: 0000000000000001 R12: ffff880464bf0000 [ 75.925675] R13: ffffffffa0853000 R14: 0000000000000000 R15: 0000564e44f88210 [ 75.932980] FS: 00007f13d5400700(0000) GS:ffff880476540000(0000) knlGS:0000000000000000 [ 75.941238] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 75.947088] CR2: 00000000000031c0 CR3: 000000045fd0b000 CR4: 00000000003406e0 [ 75.954332] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 75.961566] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 75.968834] Stack: [ 75.970881] ffff880464bf0000 ffffc90002de7d60 ffffffffa0636592 ffffc90002de7d80 [ 75.978454] ffffffffa059015f ffff880464bf0000 ffff880464bf0000 ffffc90002de7da8 [ 75.986076] ffffffffa0595216 ffff880464bf0000 ffff880460f4d000 ffffffffa0853000 [ 75.993692] Call Trace: [ 75.996177] [] amdgpu_driver_lastclose_kms+0x12/0x20 [amdgpu] [ 76.003700] [] drm_lastclose+0x2f/0xd0 [drm] [ 76.009777] [] drm_dev_unregister+0x16/0xd0 [drm] [ 76.016255] [] drm_put_dev+0x34/0x70 [drm] [ 76.022139] [] amdgpu_pci_remove+0x15/0x20 [amdgpu] [ 76.028800] [] pci_device_remove+0x39/0xc0 [ 76.034661] [] __device_release_driver+0x9a/0x140 [ 76.041121] [] driver_detach+0xb8/0xc0 [ 76.046575] [] bus_remove_driver+0x55/0xd0 [ 76.052401] [] driver_unregister+0x2c/0x50 [ 76.058244] [] pci_unregister_driver+0x29/0x90 [ 76.064466] [] drm_pci_exit+0x9e/0xb0 [drm] [ 76.070507] [] amdgpu_exit+0x1c/0x32 [amdgpu] [ 76.076609] [] SyS_delete_module+0x1a0/0x200 [ 76.082627] [] ? rcu_eqs_enter.isra.36+0x4a/0x50 [ 76.089001] [] do_syscall_64+0x6e/0x180 [ 76.094583] [] entry_SYSCALL64_slow_path+0x25/0x25 [ 76.101114] Code: 94 c0 c3 31 c0 5d c3 0f 1f 40 00 0f 1f 44 00 00 55 31 c0 48 89 e5 53 48 89 fb 48 c7 c7 1d 21 84 a0 e8 ab 77 b3 e0 e8 fc 8b d7 e0 <48> 8b bb c0 31 00 00 48 85 ff 74 09 e8 ff eb fc ff 85 c0 75 03 [ 76.121432] RIP [] amdgpu_fbdev_restore_mode+0x20/0x60 [amdgpu] Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 11387fe4a98f75d1f4cdb3efe3b42b19205c9df5 Author: Eric Garver Date: Tue May 23 18:37:27 2017 -0400 geneve: fix fill_info when using collect_metadata Since 9b4437a5b870 ("geneve: Unify LWT and netdev handling.") fill_info does not return UDP_ZERO_CSUM6_RX when using COLLECT_METADATA. This is because it uses ip_tunnel_info_af() with the device level info, which is not valid for COLLECT_METADATA. Fix by checking for the presence of the actual sockets. Fixes: 9b4437a5b870 ("geneve: Unify LWT and netdev handling.") Signed-off-by: Eric Garver Acked-by: Pravin B Shelar Signed-off-by: David S. Miller drivers/net/geneve.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit a54fba8f5a0dc36161cacdf2aa90f007f702ec1a Author: Jan Kara Date: Thu May 18 16:36:24 2017 -0700 xfs: Move handling of missing page into one place in xfs_find_get_desired_pgoff() Currently several places in xfs_find_get_desired_pgoff() handle the case of a missing page. Make them all handled in one place after the loop has terminated. Signed-off-by: Jan Kara Reviewed-by: Brian Foster Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/xfs_file.c | 38 ++++++++------------------------------ 1 file changed, 8 insertions(+), 30 deletions(-) commit d7fd24257aa60316bf81093f7f909dc9475ae974 Author: Jan Kara Date: Thu May 18 16:36:23 2017 -0700 xfs: Fix off-by-in in loop termination in xfs_find_get_desired_pgoff() There is an off-by-one error in loop termination conditions in xfs_find_get_desired_pgoff() since 'end' may index a page beyond end of desired range if 'endoff' is page aligned. It doesn't have any visible effects but still it is good to fix it. Signed-off-by: Jan Kara Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/xfs_file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5375023ae1266553a7baa0845e82917d8803f48c Author: Jan Kara Date: Thu May 18 16:36:22 2017 -0700 xfs: Fix missed holes in SEEK_HOLE implementation XFS SEEK_HOLE implementation could miss a hole in an unwritten extent as can be seen by the following command: xfs_io -c "falloc 0 256k" -c "pwrite 0 56k" -c "pwrite 128k 8k" -c "seek -h 0" file wrote 57344/57344 bytes at offset 0 56 KiB, 14 ops; 0.0000 sec (49.312 MiB/sec and 12623.9856 ops/sec) wrote 8192/8192 bytes at offset 131072 8 KiB, 2 ops; 0.0000 sec (70.383 MiB/sec and 18018.0180 ops/sec) Whence Result HOLE 139264 Where we can see that hole at offset 56k was just ignored by SEEK_HOLE implementation. The bug is in xfs_find_get_desired_pgoff() which does not properly detect the case when pages are not contiguous. Fix the problem by properly detecting when found page has larger offset than expected. CC: stable@vger.kernel.org Fixes: d126d43f631f996daeee5006714fed914be32368 Signed-off-by: Jan Kara Reviewed-by: Brian Foster Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/xfs_file.c | 29 +++++++++-------------------- 1 file changed, 9 insertions(+), 20 deletions(-) commit 8affebe16d79ebefb1d9d6d56a46dc89716f9453 Author: Eryu Guan Date: Tue May 23 08:30:46 2017 -0700 xfs: fix off-by-one on max nr_pages in xfs_find_get_desired_pgoff() xfs_find_get_desired_pgoff() is used to search for offset of hole or data in page range [index, end] (both inclusive), and the max number of pages to search should be at least one, if end == index. Otherwise the only page is missed and no hole or data is found, which is not correct. When block size is smaller than page size, this can be demonstrated by preallocating a file with size smaller than page size and writing data to the last block. E.g. run this xfs_io command on a 1k block size XFS on x86_64 host. # xfs_io -fc "falloc 0 3k" -c "pwrite 2k 1k" \ -c "seek -d 0" /mnt/xfs/testfile wrote 1024/1024 bytes at offset 2048 1 KiB, 1 ops; 0.0000 sec (33.675 MiB/sec and 34482.7586 ops/sec) Whence Result DATA EOF Data at offset 2k was missed, and lseek(2) returned ENXIO. This is uncovered by generic/285 subtest 07 and 08 on ppc64 host, where pagesize is 64k. Because a recent change to generic/285 reduced the preallocated file size to smaller than 64k. Cc: stable@vger.kernel.org # v3.7+ Signed-off-by: Eryu Guan Reviewed-by: Jan Kara Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/xfs_file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a4d768e702de224cc85e0c8eac9311763403b368 Author: Eric Sandeen Date: Mon May 22 19:54:10 2017 -0700 xfs: fix unaligned access in xfs_btree_visit_blocks This structure copy was throwing unaligned access warnings on sparc64: Kernel unaligned access at TPC[1043c088] xfs_btree_visit_blocks+0x88/0xe0 [xfs] xfs_btree_copy_ptrs does a memcpy, which avoids it. Signed-off-by: Eric Sandeen Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/libxfs/xfs_btree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cdc1daca1b9b9ea3809009af944ade641dc32e86 Author: Guilherme G. Piccoli Date: Thu May 18 16:53:20 2017 -0300 MAINTAINERS: Change maintainer of genwqe driver Gabriel won't maintain this driver anymore. So, I'll maintain it with Frank. Thanks Gabriel for all your work on genwqe. Signed-off-by: Guilherme G. Piccoli Acked-by: Gabriel Krisman Bertazi Acked-by: Frank Haverkamp Signed-off-by: Greg Kroah-Hartman MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3eff8ecd271d941b2326dba7defd0ca7c4c0baf5 Author: Wei Yongjun Date: Sun May 21 00:45:46 2017 +0000 goldfish_pipe: use GFP_ATOMIC under spin lock The function get_free_pipe_id_locked() is called from goldfish_pipe_open() with a lock is held, so we should use GFP_ATOMIC instead of GFP_KERNEL. Signed-off-by: Wei Yongjun Signed-off-by: Greg Kroah-Hartman drivers/platform/goldfish/goldfish_pipe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 717902cc93118119a6fce7765da6cf2786987418 Author: Timmy Li Date: Mon May 22 16:48:28 2017 +0100 ARM64: PCI: Fix struct acpi_pci_root_ops allocation failure path Commit 093d24a20442 ("arm64: PCI: Manage controller-specific data on per-controller basis") added code to allocate ACPI PCI root_ops dynamically on a per host bridge basis but failed to update the corresponding memory allocation failure path in pci_acpi_scan_root() leading to a potential memory leakage. Fix it by adding the required kfree call. Fixes: 093d24a20442 ("arm64: PCI: Manage controller-specific data on per-controller basis") Reviewed-by: Tomasz Nowicki Signed-off-by: Timmy Li [lorenzo.pieralisi@arm.com: refactored code, rewrote commit log] Signed-off-by: Lorenzo Pieralisi CC: Will Deacon CC: Bjorn Helgaas Signed-off-by: Catalin Marinas arch/arm64/kernel/pci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 2ee1cc70552e5520a275254427c0c37fc81728d2 Author: Dmitry Torokhov Date: Tue May 23 17:07:44 2017 -0700 firmware: vpd: do not leak kobjects kobject_del() only unlinks kobject, we need to use kobject_put() to make sure kobject will go away completely. Fixes: 049a59db34eb ("firmware: Google VPD sysfs driver") Signed-off-by: Dmitry Torokhov Reviewed-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman drivers/firmware/google/vpd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit ce57cba37f3721c21e46adf21c61292dfd7a9c04 Author: Dmitry Torokhov Date: Tue May 23 17:07:43 2017 -0700 firmware: vpd: avoid potential use-after-free when destroying section We should not free info->key before we remove sysfs attribute that uses this data as its name. Fixes: 049a59db34eb ("firmware: Google VPD sysfs driver") Signed-off-by: Dmitry Torokhov Reviewed-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman drivers/firmware/google/vpd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7f53de2069c801776f0f5d1a1d665324967a4fab Author: Dmitry Torokhov Date: Tue May 23 17:07:41 2017 -0700 firmware: vpd: do not leave freed section attributes to the list We should only add section attribute to the list of section attributes if we successfully created corresponding sysfs attribute. Fixes: 049a59db34eb ("firmware: Google VPD sysfs driver") Signed-off-by: Dmitry Torokhov Reviewed-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman drivers/firmware/google/vpd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a4700a26107241cc7b9ac8528b2c6714ff99983d Author: Nicholas Piggin Date: Sat May 20 14:29:49 2017 +1000 powerpc: Add PPC_FEATURE userspace bits for SCV and DARN instructions Providing "scv" support to userspace requires kernel support, so it must be advertised as independently to the base ISA 3 instruction set. The darn instruction relies on firmware enablement, so it has been decided to split this out from the core ISA 3 feature as well. Signed-off-by: Nicholas Piggin Acked-by: Benjamin Herrenschmidt Signed-off-by: Michael Ellerman arch/powerpc/include/uapi/asm/cputable.h | 2 ++ arch/powerpc/kernel/cputable.c | 3 ++- 2 files changed, 4 insertions(+), 1 deletion(-) commit d75e4919cc0b6fbcbc8d6654ef66d87a9dbf1526 Author: Jeremy Kerr Date: Wed May 24 16:49:59 2017 +1000 powerpc/spufs: Fix hash faults for kernel regions Commit ac29c64089b7 ("powerpc/mm: Replace _PAGE_USER with _PAGE_PRIVILEGED") swapped _PAGE_USER for _PAGE_PRIVILEGED, and introduced check_pte_access() which denied kernel access to non-_PAGE_PRIVILEGED pages. However, it didn't add _PAGE_PRIVILEGED to the hash fault handler for spufs' kernel accesses, so the DMAs required to establish SPE memory no longer work. This change adds _PAGE_PRIVILEGED to the hash fault handler for kernel accesses. Fixes: ac29c64089b7 ("powerpc/mm: Replace _PAGE_USER with _PAGE_PRIVILEGED") Cc: stable@vger.kernel.org # v4.7+ Signed-off-by: Jeremy Kerr Reported-by: Sombat Tragolgosol Reviewed-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman arch/powerpc/platforms/cell/spu_base.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit d957fb4d173647640a2b83e7c7e56a580e7fc7e7 Author: Michael Neuling Date: Wed May 24 17:03:26 2017 +1000 powerpc: Fix booting P9 hash with CONFIG_PPC_RADIX_MMU=N Currently if you disable CONFIG_PPC_RADIX_MMU you'll crash on boot on a P9. This is because we still set MMU_FTR_TYPE_RADIX via ibm,pa-features and MMU_FTR_TYPE_RADIX is what's used for code patching in much of the asm code (ie. slb_miss_realmode) This patch fixes the problem by stopping MMU_FTR_TYPE_RADIX from being set from ibm.pa-features. We may eventually end up removing the CONFIG_PPC_RADIX_MMU option completely but until then this fixes the issue. Fixes: 17a3dd2f5fc7 ("powerpc/mm/radix: Use firmware feature to enable Radix MMU") Cc: stable@vger.kernel.org # v4.7+ Signed-off-by: Michael Neuling Signed-off-by: Michael Ellerman arch/powerpc/kernel/prom.c | 2 ++ 1 file changed, 2 insertions(+) commit 415ba3c157b9de7edc59468d19d48c1d15972a75 Author: Alistair Popple Date: Sat May 20 06:56:35 2017 +1000 powerpc/powernv/npu-dma.c: Fix opal_npu_destroy_context() call opal_npu_destroy_context() should be called with the NPU PHB, not the PCIe PHB. Fixes: 1ab66d1fbada ("powerpc/powernv: Introduce address translation services for Nvlink2") Signed-off-by: Alistair Popple Signed-off-by: Michael Ellerman arch/powerpc/platforms/powernv/npu-dma.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 3d51b956267343a65498704ada854c33c0f5e946 Author: Arnd Bergmann Date: Fri May 19 10:04:01 2017 +0200 staging: ccree: add CRYPTO dependency A rare randconfig build error shows up when we have CONFIG_CRYPTO=m in combination with a built-in CCREE driver: crypto/hmac.o: In function `hmac_update': hmac.c:(.text.hmac_update+0x28): undefined reference to `crypto_shash_update' crypto/hmac.o: In function `hmac_setkey': hmac.c:(.text.hmac_setkey+0x90): undefined reference to `crypto_shash_digest' hmac.c:(.text.hmac_setkey+0x154): undefined reference to `crypto_shash_update' drivers/staging/ccree/ssi_cipher.o: In function `ssi_blkcipher_setkey': ssi_cipher.c:(.text.ssi_blkcipher_setkey+0x350): undefined reference to `crypto_shash_digest' drivers/staging/ccree/ssi_cipher.o: In function `ssi_blkcipher_exit': ssi_cipher.c:(.text.ssi_blkcipher_exit+0xd4): undefined reference to `crypto_destroy_tfm' drivers/staging/ccree/ssi_cipher.o: In function `ssi_blkcipher_init': ssi_cipher.c:(.text.ssi_blkcipher_init+0x1b0): undefined reference to `crypto_alloc_shash' drivers/staging/ccree/ssi_cipher.o: In function `ssi_ablkcipher_free': ssi_cipher.c:(.text.ssi_ablkcipher_free+0x48): undefined reference to `crypto_unregister_alg' drivers/staging/ccree/ssi_cipher.o: In function `ssi_ablkcipher_alloc': ssi_cipher.c:(.text.ssi_ablkcipher_alloc+0x138): undefined reference to `crypto_register_alg' ssi_cipher.c:(.text.ssi_ablkcipher_alloc+0x274): undefined reference to `crypto_blkcipher_type' We actually need to depend on both CRYPTO and CRYPTO_HW here to avoid the problem, since CRYPTO_HW is a bool symbol and by itself that does not force CCREE to be a loadable module when the core cryto support is modular. Fixes: 50cfbbb7e627 ("staging: ccree: add ahash support") Signed-off-by: Arnd Bergmann Acked-By: Gilad Ben-Yossef Signed-off-by: Greg Kroah-Hartman drivers/staging/ccree/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 59fe2cc8b1c32dd139da80fc8222b5b3290b7a09 Author: Tobias Klauser Date: Fri May 19 13:59:20 2017 +0200 serial: altera_uart: call iounmap() at driver remove The driver calls ioremap() in the probe function but doesn't call iounmap() in the remove function correspondingly. Do so now. Follow commit 5c9d6abed9e0 ("serial: altera_jtaguart: adding iounmap()") Cc: Alexey Khoroshilov Signed-off-by: Tobias Klauser Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/altera_uart.c | 1 + 1 file changed, 1 insertion(+) commit 6df765dca378bddf994cfd2044acafa501bd800f Author: Uwe Kleine-König Date: Wed May 24 21:38:46 2017 +0200 serial: imx: ensure UCR3 and UFCR are setup correctly Commit e61c38d85b73 ("serial: imx: setup DCEDTE early and ensure DCD and RI irqs to be off") has a flaw: While UCR3 and UFCR were modified using read-modify-write before it switched to write register values independent of the previous state. That's a good idea in principle (and that's why I did it) but needs more care. This patch reinstates read-modify-write for UFCR and for UCR3 ensures that RXDMUXSEL and ADNIMP are set for post imx1. Fixes: e61c38d85b73 ("serial: imx: setup DCEDTE early and ensure DCD and RI irqs to be off") Signed-off-by: Uwe Kleine-König Acked-by: Mika Penttilä Tested-by: Mika Penttilä Acked-by: Steve Twiss Tested-by: Steve Twiss Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/imx.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) commit be941bf2e6a32605935865972df7abf74087944f Merge: 2426125 1bad6c4 Author: Linus Torvalds Date: Wed May 24 20:29:53 2017 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "This is quite a big update because it includes a rework of the lpfc driver to separate the NVMe part from the FC part. The reason for doing this is because two separate trees (the nvme and scsi trees respectively) want to update the individual components and this separation will prevent a really nasty cross tree entanglement by the time we reach the next merge window. The rest of the fixes are the usual minor sort with no significant security implications" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (25 commits) scsi: zero per-cmd private driver data for each MQ I/O scsi: csiostor: fix use after free in csio_hw_use_fwconfig() scsi: ufs: Clean up some rpm/spm level SysFS nodes upon remove scsi: lpfc: fix build issue if NVME_FC_TARGET is not defined scsi: lpfc: Fix NULL pointer dereference during PCI error recovery scsi: lpfc: update version to 11.2.0.14 scsi: lpfc: Add MDS Diagnostic support. scsi: lpfc: Fix NVMEI's handling of NVMET's PRLI response attributes scsi: lpfc: Cleanup entry_repost settings on SLI4 queues scsi: lpfc: Fix debugfs root inode "lpfc" not getting deleted on driver unload. scsi: lpfc: Fix NVME I+T not registering NVME as a supported FC4 type scsi: lpfc: Added recovery logic for running out of NVMET IO context resources scsi: lpfc: Separate NVMET RQ buffer posting from IO resources SGL/iocbq/context scsi: lpfc: Separate NVMET data buffer pool fir ELS/CT. scsi: lpfc: Fix NMI watchdog assertions when running nvmet IOPS tests scsi: lpfc: Fix NVMEI driver not decrementing counter causing bad rport state. scsi: lpfc: Fix nvmet RQ resource needs for large block writes. scsi: lpfc: Adding additional stats counters for nvme. scsi: lpfc: Fix system crash when port is reset. scsi: lpfc: Fix used-RPI accounting problem. ... commit d5ff0eed3a6621f6fd6c14f042c30a6eacfa77f1 Author: Joe Carnuccio Date: Wed May 24 18:06:24 2017 -0700 scsi: qla2xxx: Fix crash due to NULL pointer dereference of ctx Fixes following signature in the stack trace: BUG: unable to handle kernel NULL pointer dereference at 0000000000000374 IP: [] qla2x00_sp_free_dma+0xeb/0x2a0 [qla2xxx] Cc: # v4.10+ Signed-off-by: Joe Carnuccio Signed-off-by: Himanshu Madhani Signed-off-by: Martin K. Petersen drivers/scsi/qla2xxx/qla_inline.h | 26 +++++++------------------- drivers/scsi/qla2xxx/qla_os.c | 30 +++++++++++++++++++----------- drivers/scsi/qla2xxx/qla_target.c | 8 +++++--- 3 files changed, 31 insertions(+), 33 deletions(-) commit 74939a0bc772d642b1c12827966c4c3a3c90ea2c Author: Joe Carnuccio Date: Wed May 24 18:06:23 2017 -0700 scsi: qla2xxx: Fix mailbox pointer error in fwdump capture Cc: # v4.10+ Signed-off-by: Joe Carnuccio Signed-off-by: Himanshu Madhani Signed-off-by: Martin K. Petersen drivers/scsi/qla2xxx/qla_dbg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 1d63496516c61e2e1351f10e6becbfc9ee511395 Author: Joe Carnuccio Date: Wed May 24 18:06:22 2017 -0700 scsi: qla2xxx: Set bit 15 for DIAG_ECHO_TEST MBC Set bit (BIT_15) to send right ECHO payload information for Diagnostic Echo Test command. Cc: # v4.10+ Signed-off-by: Joe Carnuccio Signed-off-by: Himanshu Madhani Signed-off-by: Martin K. Petersen drivers/scsi/qla2xxx/qla_bsg.c | 9 +++++---- drivers/scsi/qla2xxx/qla_mbx.c | 4 ++-- 2 files changed, 7 insertions(+), 6 deletions(-) commit ce6c668b146cc4f4442111e2bcee4c3af94e1ddf Author: Joe Carnuccio Date: Wed May 24 18:06:21 2017 -0700 scsi: qla2xxx: Modify T262 FW dump template to specify same start/end to debug customer issues Firmware dump allows for debugging customer issues. This patch fixes start/end pointer calculation to capture T262 template entry for dump tool. Cc: # v4.10+ Signed-off-by: Joe Carnuccio Signed-off-by: Himanshu Madhani Signed-off-by: Martin K. Petersen drivers/scsi/qla2xxx/qla_tmpl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b95b9452aacf80659ea67bf0948cbfa7e28e5e0b Author: Sawan Chandak Date: Wed May 24 18:06:20 2017 -0700 scsi: qla2xxx: Fix crash due to mismatch mumber of Q-pair creation for Multi queue when driver is loaded with Multi Queue enabled, it was noticed that there was one less queue pair created. Following message would indicate this: "No resources to create additional q pair." The result of one less queue pair means that system can crash, if the block mq layer thinks there is an extra hardware queue available, and the driver will use a NULL ptr qpair in that instance. Following stack trace is seen in one of the crash: irq_create_affinity_masks+0x98/0x530 irq_create_affinity_masks+0x98/0x530 __pci_enable_msix+0x321/0x4e0 mutex_lock+0x12/0x40 pci_alloc_irq_vectors_affinity+0xb5/0x140 qla24xx_enable_msix+0x79/0x530 [qla2xxx] qla2x00_request_irqs+0x61/0x2d0 [qla2xxx] qla2x00_probe_one+0xc73/0x2390 [qla2xxx] ida_simple_get+0x98/0x100 kernfs_next_descendant_post+0x40/0x50 local_pci_probe+0x45/0xa0 pci_device_probe+0xfc/0x140 driver_probe_device+0x2c5/0x470 __driver_attach+0xdd/0xe0 driver_probe_device+0x470/0x470 bus_for_each_dev+0x6c/0xc0 driver_attach+0x1e/0x20 bus_add_driver+0x45/0x270 driver_register+0x60/0xe0 __pci_register_driver+0x4c/0x50 qla2x00_module_init+0x1ce/0x21e [qla2xxx] Cc: # v4.10+ Signed-off-by: Sawan Chandak Signed-off-by: Himanshu Madhani Signed-off-by: Martin K. Petersen drivers/scsi/qla2xxx/qla_def.h | 1 + drivers/scsi/qla2xxx/qla_init.c | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-) commit 0ea88662b5c6404a8f7af6b040b3cf1f0e8c3a66 Author: Quinn Tran Date: Wed May 24 18:06:19 2017 -0700 scsi: qla2xxx: Fix NULL pointer access due to redundant fc_host_port_name call Remove redundant fc_host_port_name calls to prevent early access of scsi_host->shost_data buffer. This prevent null pointer access. Following stack trace is seen: BUG: unable to handle kernel NULL pointer dereference at 00000000000008 IP: qla24xx_report_id_acquisition+0x22d/0x3a0 [qla2xxx] Cc: # v4.11+ Signed-off-by: Quinn Tran Signed-off-by: Himanshu Madhani Signed-off-by: Martin K. Petersen drivers/scsi/qla2xxx/qla_mbx.c | 9 --------- 1 file changed, 9 deletions(-) commit cb590700e04d4f59179c44f360217f5ad04ae262 Author: himanshu.madhani@cavium.com Date: Wed May 24 18:06:18 2017 -0700 scsi: qla2xxx: Fix recursive loop during target mode configuration for ISP25XX leaving system unresponsive Following messages are seen into system logs qla2xxx [0000:09:00.0]-00af:9: Performing ISP error recovery - ha=ffff98315ee30000. qla2xxx [0000:09:00.0]-504b:9: RISC paused -- HCCR=40, Dumping firmware. qla2xxx [0000:09:00.0]-d009:9: Firmware has been previously dumped (ffffba488c001000) -- ignoring request. qla2xxx [0000:09:00.0]-504b:9: RISC paused -- HCCR=40, Dumping firmware. See Bugzilla for details https://bugzilla.kernel.org/show_bug.cgi?id=195285 Fixes: d74595278f4ab ("scsi: qla2xxx: Add multiple queue pair functionality.") Cc: # v4.10+ Reported-by: Laurence Oberman Reported-by: Anthony Bloodoff Tested-by: Laurence Oberman Tested-by: Anthony Bloodoff Signed-off-by: Himanshu Madhani Signed-off-by: Giridhar Malavali Signed-off-by: Martin K. Petersen drivers/scsi/qla2xxx/qla_isr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e153903686deac9ea8c499b49516126f1a844fdb Author: Nix Date: Tue May 16 10:13:31 2017 +0100 md: report sector of stripes with check mismatches This makes it possible, with appropriate filesystem support, for a sysadmin to tell what is affected by the mismatch, and whether it should be ignored (if it's inside a swap partition, for instance). We ratelimit to prevent log flooding: if there are so many mismatches that ratelimiting is necessary, the individual messages are relatively unlikely to be important (either the machine is swapping like crazy or something is very wrong with the disk). Signed-off-by: Nick Alcock Signed-off-by: Shaohua Li drivers/md/raid5.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) commit 4179bc30b2fe85f827d93e0ae7ae8f49ad3afc02 Author: Kyungchan Koh Date: Wed May 24 10:16:27 2017 -0700 md: uuid debug statement now in processor byte order. Previously, the uuid debug statements were printed in little-endian format, which wasn't consistent in machines that might not be in little-endian byte order. With this change, the output will be consistent for all machines with different byte-ordering. Signed-off-by: Kyungchan Koh Signed-off-by: Shaohua Li drivers/md/bitmap.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit b8cb5a545c3dd8b975aad19ea020eabe0a888e8d Author: Tahsin Erdogan Date: Wed May 24 18:24:07 2017 -0400 ext4: fix quota charging for shared xattr blocks ext4_xattr_block_set() calls dquot_alloc_block() to charge for an xattr block when new references are made. However if dquot_initialize() hasn't been called on an inode, request for charging is effectively ignored because ext4_inode_info->i_dquot is not initialized yet. Add dquot_initialize() to call paths that lead to ext4_xattr_block_set(). Signed-off-by: Tahsin Erdogan Signed-off-by: Theodore Ts'o Reviewed-by: Jan Kara fs/ext4/acl.c | 4 ++++ fs/ext4/super.c | 3 +++ fs/ext4/xattr.c | 8 ++++++++ fs/quota/dquot.c | 16 ++++++++++++++++ include/linux/quotaops.h | 6 ++++++ 5 files changed, 37 insertions(+) commit c41d342b39f15acbdc61948bab0cb3c567ec992a Author: Eric Biggers Date: Wed May 24 18:20:31 2017 -0400 ext4: remove redundant check for encrypted file on dio write path Currently we don't allow direct I/O on encrypted regular files, so in such cases we return 0 early in ext4_direct_IO(). There was also an additional BUG_ON() check in ext4_direct_IO_write(), but it can never be hit because of the earlier check for the exact same condition in ext4_direct_IO(). There was also no matching check on the read path, which made the write path specific check seem very ad-hoc. Just remove the unnecessary BUG_ON(). Signed-off-by: Eric Biggers Signed-off-by: Theodore Ts'o Reviewed-by: David Gstir Reviewed-by: Jan Kara fs/ext4/inode.c | 3 --- 1 file changed, 3 deletions(-) commit d6b975504e7e71fc29fcd14530433e816d7f5aac Author: Eric Biggers Date: Wed May 24 18:10:49 2017 -0400 ext4: remove unused d_name argument from ext4_search_dir() et al. Now that we are passing a struct ext4_filename, we do not need to pass around the original struct qstr too. Signed-off-by: Eric Biggers Signed-off-by: Theodore Ts'o Reviewed-by: Jan Kara fs/ext4/ext4.h | 2 -- fs/ext4/inline.c | 5 ++--- fs/ext4/namei.c | 13 +++++-------- 3 files changed, 7 insertions(+), 13 deletions(-) commit e5465795cac48233c9b606a7a419f4190a91851e Author: Eric Biggers Date: Wed May 24 18:05:29 2017 -0400 ext4: fix off-by-one error when writing back pages before dio read The 'lend' argument of filemap_write_and_wait_range() is inclusive, so we need to subtract 1 from pos + count. Note that 'count' is guaranteed to be nonzero since ext4_file_read_iter() returns early when given a 0 count. Fixes: 16c54688592c ("ext4: Allow parallel DIO reads") Signed-off-by: Eric Biggers Signed-off-by: Theodore Ts'o Reviewed-by: Jan Kara fs/ext4/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 624327f8794704c5066b11a52f9da6a09dce7f9a Author: Eryu Guan Date: Wed May 24 18:02:20 2017 -0400 ext4: fix off-by-one on max nr_pages in ext4_find_unwritten_pgoff() ext4_find_unwritten_pgoff() is used to search for offset of hole or data in page range [index, end] (both inclusive), and the max number of pages to search should be at least one, if end == index. Otherwise the only page is missed and no hole or data is found, which is not correct. When block size is smaller than page size, this can be demonstrated by preallocating a file with size smaller than page size and writing data to the last block. E.g. run this xfs_io command on a 1k block size ext4 on x86_64 host. # xfs_io -fc "falloc 0 3k" -c "pwrite 2k 1k" \ -c "seek -d 0" /mnt/ext4/testfile wrote 1024/1024 bytes at offset 2048 1 KiB, 1 ops; 0.0000 sec (42.459 MiB/sec and 43478.2609 ops/sec) Whence Result DATA EOF Data at offset 2k was missed, and lseek(2) returned ENXIO. This is unconvered by generic/285 subtest 07 and 08 on ppc64 host, where pagesize is 64k. Because a recent change to generic/285 reduced the preallocated file size to smaller than 64k. Signed-off-by: Eryu Guan Signed-off-by: Theodore Ts'o Reviewed-by: Jan Kara fs/ext4/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9dfa7bba35ac08a63565d58c454dccb7e1bb0a08 Author: Michael Schmitz Date: Sun Apr 30 19:49:21 2017 +1200 fix race in drivers/char/random.c:get_reg() get_reg() can be reentered on architectures with prioritized interrupts (m68k in this case), causing f->reg_index to be incremented after the range check. Out of bounds memory access past the pt_regs struct results. This will go mostly undetected unless access is beyond end of memory. Prevent the race by disabling interrupts in get_reg(). Tested on m68k (Atari Falcon, and ARAnyM emulator). Kudos to Geert Uytterhoeven for helping to trace this race. Signed-off-by: Michael Schmitz Signed-off-by: Theodore Ts'o drivers/char/random.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 3083696a1ee68f4845f8e9a21b91e343ff25eff3 Author: Dan Carpenter Date: Tue May 23 13:13:45 2017 +0800 drm/amd/powerplay: fix a signedness bugs Smatch complains about a signedness bug here: vega10_hwmgr.c:4202 vega10_force_clock_level() warn: always true condition '(i >= 0) => (0-u32max >= 0)' Fixes: 7b52db39a4c2 ("drm/amd/powerplay: fix bug sclk/mclk level can't be set on vega10.") Signed-off-by: Dan Carpenter Reviewed-by: Eric Huang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7c4378f4523d4af05b5941ea906e7032631eb753 Author: Chunming Zhou Date: Thu May 11 18:22:17 2017 +0800 drm/amdgpu: fix NULL pointer panic of emit_gds_switch [ 338.384770] BUG: unable to handle kernel NULL pointer dereference at (null) [ 338.384817] IP: [< (null)>] (null) [ 338.385505] RIP: 0010:[<0000000000000000>] [< (null)>] (null) [ 338.385950] Call Trace: [ 338.385993] [] ? amdgpu_vm_flush+0x283/0x400 [amdgpu] [ 338.386025] [] ? printk+0x4d/0x4f [ 338.386074] [] amdgpu_ib_schedule+0x4a6/0x4d0 [amdgpu] [ 338.386140] [] amdgpu_job_run+0x64/0x180 [amdgpu] [ 338.386203] [] amd_sched_main+0x2e9/0x4a0 [amdgpu] [ 338.386232] [] ? prepare_to_wait_event+0x110/0x110 [ 338.386295] [] ? amd_sched_select_entity+0xe0/0xe0 [amdgpu] [ 338.386327] [] kthread+0xd3/0xf0 [ 338.386349] [] ? kthread_park+0x60/0x60 [ 338.386376] [] ret_from_fork+0x25/0x30 [ 338.386401] Code: Bad RIP value. [ 338.386420] RIP [< (null)>] (null) [ 338.386443] RSP [ 338.386458] CR2: 0000000000000000 [ 338.398508] ---[ end trace 4c66fcdc74b9a0a2 ]--- Signed-off-by: Chunming Zhou Reviewed-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3d18e33735a02b1a90aecf14410bf3edbfd4d3dc Author: Lyude Date: Thu May 11 19:31:12 2017 -0400 drm/radeon: Unbreak HPD handling for r600+ We end up reading the interrupt register for HPD5, and then writing it to HPD6 which on systems without anything using HPD5 results in permanently disabling hotplug on one of the display outputs after the first time we acknowledge a hotplug interrupt from the GPU. This code is really bad. But for now, let's just fix this. I will hopefully have a large patch series to refactor all of this soon. Reviewed-by: Christian König Signed-off-by: Lyude Cc: stable@vger.kernel.org Signed-off-by: Alex Deucher drivers/gpu/drm/radeon/cik.c | 4 ++-- drivers/gpu/drm/radeon/evergreen.c | 4 ++-- drivers/gpu/drm/radeon/r600.c | 2 +- drivers/gpu/drm/radeon/si.c | 4 ++-- 4 files changed, 7 insertions(+), 7 deletions(-) commit 2275a3a2fe9914ba6d76c8ea490da3c08342bd19 Author: Alex Deucher Date: Thu May 11 13:57:41 2017 -0400 drm/amd/powerplay/smu7: disable mclk switching for high refresh rates Even if the vblank period would allow it, it still seems to be problematic on some cards. bug: https://bugs.freedesktop.org/show_bug.cgi?id=96868 Cc: stable@vger.kernel.org Acked-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 09be4a5219610a6fae3215d4f51f948d6f5d2609 Author: Alex Deucher Date: Thu May 11 13:46:12 2017 -0400 drm/amd/powerplay/smu7: add vblank check for mclk switching (v2) Check to make sure the vblank period is long enough to support mclk switching. v2: drop needless initial assignment (Nils) bug: https://bugs.freedesktop.org/show_bug.cgi?id=96868 Cc: stable@vger.kernel.org Acked-by: Christian König Reviewed-by: Rex Zhu Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 31 +++++++++++++++++++++--- 1 file changed, 27 insertions(+), 4 deletions(-) commit 58d7e3e427db1bd68f33025519a9468140280a75 Author: Alex Deucher Date: Thu May 11 13:14:14 2017 -0400 drm/radeon/ci: disable mclk switching for high refresh rates (v2) Even if the vblank period would allow it, it still seems to be problematic on some cards. v2: fix logic inversion (Nils) bug: https://bugs.freedesktop.org/show_bug.cgi?id=96868 Cc: stable@vger.kernel.org Acked-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/radeon/ci_dpm.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 0a646f331db0eb9efc8d3a95a44872036d441d58 Author: Alex Deucher Date: Thu May 11 13:10:02 2017 -0400 drm/amdgpu/ci: disable mclk switching for high refresh rates (v2) Even if the vblank period would allow it, it still seems to be problematic on some cards. v2: fix logic inversion (Nils) bug: https://bugs.freedesktop.org/show_bug.cgi?id=96868 Cc: stable@vger.kernel.org Acked-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/ci_dpm.c | 6 ++++++ 1 file changed, 6 insertions(+) commit e6a88e4ba88f3dd9d772f0ff7a88837939264883 Merge: f289978 2836b4f Author: David S. Miller Date: Wed May 24 16:27:22 2017 -0400 Merge branch 'q-in-q-checksums' Daniel Borkmann says: ==================== BPF pruning follow-up Follow-up to fix incorrect pruning when alignment tracking is in use and to properly clear regs after call to not leave stale data behind. For details, please see individual patches. ==================== Signed-off-by: David S. Miller commit 2836b4f224d4fd7d1a2b23c3eecaf0f0ae199a74 Author: Vlad Yasevich Date: Tue May 23 13:38:43 2017 -0400 virtio-net: enable TSO/checksum offloads for Q-in-Q vlans Since virtio does not provide it's own ndo_features_check handler, TSO, and now checksum offload, are disabled for stacked vlans. Re-enable the support and let the host take care of it. This restores/improves Guest-to-Guest performance over Q-in-Q vlans. Acked-by: Jason Wang Acked-by: Michael S. Tsirkin Signed-off-by: Vladislav Yasevich Signed-off-by: David S. Miller drivers/net/virtio_net.c | 1 + 1 file changed, 1 insertion(+) commit cc6e9de62a7f84c9293a2ea41bc412b55bb46e85 Author: Vlad Yasevich Date: Tue May 23 13:38:42 2017 -0400 be2net: Fix offload features for Q-in-Q packets At least some of the be2net cards do not seem to be capabled of performing checksum offload computions on Q-in-Q packets. In these case, the recevied checksum on the remote is invalid and TCP syn packets are dropped. This patch adds a call to check disbled acceleration features on Q-in-Q tagged traffic. CC: Sathya Perla CC: Ajit Khaparde CC: Sriharsha Basavapatna CC: Somnath Kotur Signed-off-by: Vladislav Yasevich Signed-off-by: David S. Miller drivers/net/ethernet/emulex/benet/be_main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 35d2f80b07bbe03fb358afb0bdeff7437a7d67ff Author: Vlad Yasevich Date: Tue May 23 13:38:41 2017 -0400 vlan: Fix tcp checksum offloads in Q-in-Q vlans It appears that TCP checksum offloading has been broken for Q-in-Q vlans. The behavior was execerbated by the series commit afb0bc972b52 ("Merge branch 'stacked_vlan_tso'") that that enabled accleleration features on stacked vlans. However, event without that series, it is possible to trigger this issue. It just requires a lot more specialized configuration. The root cause is the interaction between how netdev_intersect_features() works, the features actually set on the vlan devices and HW having the ability to run checksum with longer headers. The issue starts when netdev_interesect_features() replaces NETIF_F_HW_CSUM with a combination of NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM, if the HW advertises IP|IPV6 specific checksums. This happens for tagged and multi-tagged packets. However, HW that enables IP|IPV6 checksum offloading doesn't gurantee that packets with arbitrarily long headers can be checksummed. This patch disables IP|IPV6 checksums on the packet for multi-tagged packets. CC: Toshiaki Makita CC: Michal Kubecek Signed-off-by: Vladislav Yasevich Acked-by: Toshiaki Makita Signed-off-by: David S. Miller include/linux/if_vlan.h | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) commit b3c85a0fb2c79f2c945fa1305b39974d0acf3105 Author: Christian König Date: Wed May 10 20:06:58 2017 +0200 drm/amdgpu: fix fundamental suspend/resume issue Reinitializing the VM manager during suspend/resume is a very very bad idea since all the VMs are still active and kicking. This can lead to random VM faults after resume when new processes become the same client ID assigned. Signed-off-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 22 +++++++++++++++++++++- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 1 + drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c | 15 ++------------- drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c | 15 ++------------- drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c | 15 ++------------- drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 16 ++-------------- 6 files changed, 30 insertions(+), 54 deletions(-) commit f2899788353c13891412b273fdff5f02d49aa40f Author: Andrew Lunn Date: Tue May 23 17:49:13 2017 +0200 net: phy: marvell: Limit errata to 88m1101 The 88m1101 has an errata when configuring autoneg. However, it was being applied to many other Marvell PHYs as well. Limit its scope to just the 88m1101. Fixes: 76884679c644 ("phylib: Add support for Marvell 88e1111S and 88e1145") Reported-by: Daniel Walker Signed-off-by: Andrew Lunn Acked-by: Harini Katakam Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/phy/marvell.c | 66 ++++++++++++++++++++++++++--------------------- 1 file changed, 37 insertions(+), 29 deletions(-) commit cd47512e51190efc34a6b90d5c6b54de036ea421 Author: Randy Dunlap Date: Tue May 23 08:19:49 2017 -0700 net/phy: fix mdio-octeon dependency and build Fix build errors by making this driver depend on OF_MDIO, like several other similar drivers do. drivers/built-in.o: In function `octeon_mdiobus_remove': mdio-octeon.c:(.text+0x196ee0): undefined reference to `mdiobus_unregister' mdio-octeon.c:(.text+0x196ee8): undefined reference to `mdiobus_free' drivers/built-in.o: In function `octeon_mdiobus_probe': mdio-octeon.c:(.text+0x196f1d): undefined reference to `devm_mdiobus_alloc_size' mdio-octeon.c:(.text+0x196ffe): undefined reference to `of_mdiobus_register' mdio-octeon.c:(.text+0x197010): undefined reference to `mdiobus_free' Signed-off-by: Randy Dunlap Cc: Andrew Lunn Cc: Florian Fainelli Signed-off-by: David S. Miller drivers/net/phy/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3f6b123bcc666a1766167065c2eb5a708f55651e Merge: 029c581 b665d98 Author: David S. Miller Date: Wed May 24 15:43:57 2017 -0400 Merge tag 'mlx5-fixes-2017-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5-fixes-2017-05-23 Some TC offloads fixes from Or Gerlitz. From Erez, mlx5 IPoIB RX fix to improve GRO. From Mohamad, Command interface fix to improve mitigation against FW commands timeouts. From Tariq, Driver load Tolerance against affinity settings failures. ==================== Signed-off-by: David S. Miller commit 029c58178b9aa0a293a86ee0da3355611ac99d07 Merge: 0ff50e8 1b57b62 Author: David S. Miller Date: Wed May 24 15:31:39 2017 -0400 Merge tag 'mac80211-for-davem-2017-05-23' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== Just two fixes this time: * fix the scheduled scan "BUG: scheduling while atomic" * check mesh address extension flags more strictly ==================== Signed-off-by: David S. Miller commit 0ff50e83b5122e836ca492fefb11656b225ac29c Author: Alexander Potapenko Date: Tue May 23 13:20:28 2017 +0200 net: rtnetlink: bail out from rtnl_fdb_dump() on parse error rtnl_fdb_dump() failed to check the result of nlmsg_parse(), which led to contents of |ifm| being uninitialized because nlh->nlmsglen was too small to accommodate |ifm|. The uninitialized data may affect some branches and result in unwanted effects, although kernel data doesn't seem to leak to the userspace directly. The bug has been detected with KMSAN and syzkaller. For the record, here is the KMSAN report: ================================================================== BUG: KMSAN: use of unitialized memory in rtnl_fdb_dump+0x5dc/0x1000 CPU: 0 PID: 1039 Comm: probe Not tainted 4.11.0-rc5+ #2727 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:16 dump_stack+0x143/0x1b0 lib/dump_stack.c:52 kmsan_report+0x12a/0x180 mm/kmsan/kmsan.c:1007 __kmsan_warning_32+0x66/0xb0 mm/kmsan/kmsan_instr.c:491 rtnl_fdb_dump+0x5dc/0x1000 net/core/rtnetlink.c:3230 netlink_dump+0x84f/0x1190 net/netlink/af_netlink.c:2168 __netlink_dump_start+0xc97/0xe50 net/netlink/af_netlink.c:2258 netlink_dump_start ./include/linux/netlink.h:165 rtnetlink_rcv_msg+0xae9/0xb40 net/core/rtnetlink.c:4094 netlink_rcv_skb+0x339/0x5a0 net/netlink/af_netlink.c:2339 rtnetlink_rcv+0x83/0xa0 net/core/rtnetlink.c:4110 netlink_unicast_kernel net/netlink/af_netlink.c:1272 netlink_unicast+0x13b7/0x1480 net/netlink/af_netlink.c:1298 netlink_sendmsg+0x10b8/0x10f0 net/netlink/af_netlink.c:1844 sock_sendmsg_nosec net/socket.c:633 sock_sendmsg net/socket.c:643 ___sys_sendmsg+0xd4b/0x10f0 net/socket.c:1997 __sys_sendmsg net/socket.c:2031 SYSC_sendmsg+0x2c6/0x3f0 net/socket.c:2042 SyS_sendmsg+0x87/0xb0 net/socket.c:2038 do_syscall_64+0x102/0x150 arch/x86/entry/common.c:285 entry_SYSCALL64_slow_path+0x25/0x25 arch/x86/entry/entry_64.S:246 RIP: 0033:0x401300 RSP: 002b:00007ffc3b0e6d58 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00000000004002b0 RCX: 0000000000401300 RDX: 0000000000000000 RSI: 00007ffc3b0e6d80 RDI: 0000000000000003 RBP: 00007ffc3b0e6e00 R08: 000000000000000b R09: 0000000000000004 R10: 000000000000000d R11: 0000000000000246 R12: 0000000000000000 R13: 00000000004065a0 R14: 0000000000406630 R15: 0000000000000000 origin: 000000008fe00056 save_stack_trace+0x59/0x60 arch/x86/kernel/stacktrace.c:59 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:352 kmsan_internal_poison_shadow+0xb1/0x1a0 mm/kmsan/kmsan.c:247 kmsan_poison_shadow+0x6d/0xc0 mm/kmsan/kmsan.c:260 slab_alloc_node mm/slub.c:2743 __kmalloc_node_track_caller+0x1f4/0x390 mm/slub.c:4349 __kmalloc_reserve net/core/skbuff.c:138 __alloc_skb+0x2cd/0x740 net/core/skbuff.c:231 alloc_skb ./include/linux/skbuff.h:933 netlink_alloc_large_skb net/netlink/af_netlink.c:1144 netlink_sendmsg+0x934/0x10f0 net/netlink/af_netlink.c:1819 sock_sendmsg_nosec net/socket.c:633 sock_sendmsg net/socket.c:643 ___sys_sendmsg+0xd4b/0x10f0 net/socket.c:1997 __sys_sendmsg net/socket.c:2031 SYSC_sendmsg+0x2c6/0x3f0 net/socket.c:2042 SyS_sendmsg+0x87/0xb0 net/socket.c:2038 do_syscall_64+0x102/0x150 arch/x86/entry/common.c:285 return_from_SYSCALL_64+0x0/0x6a arch/x86/entry/entry_64.S:246 ================================================================== and the reproducer: ================================================================== #include #include #include #include int main() { int sock = socket(PF_NETLINK, SOCK_DGRAM | SOCK_NONBLOCK, 0); struct msghdr msg; memset(&msg, 0, sizeof(msg)); char nlmsg_buf[32]; memset(nlmsg_buf, 0, sizeof(nlmsg_buf)); struct nlmsghdr *nlmsg = nlmsg_buf; nlmsg->nlmsg_len = 0x11; nlmsg->nlmsg_type = 0x1e; // RTM_NEWROUTE = RTM_BASE + 0x0e // type = 0x0e = 1110b // kind = 2 nlmsg->nlmsg_flags = 0x101; // NLM_F_ROOT | NLM_F_REQUEST nlmsg->nlmsg_seq = 0; nlmsg->nlmsg_pid = 0; nlmsg_buf[16] = (char)7; struct iovec iov; iov.iov_base = nlmsg_buf; iov.iov_len = 17; msg.msg_iov = &iov; msg.msg_iovlen = 1; sendmsg(sock, &msg, 0); return 0; } ================================================================== Signed-off-by: Alexander Potapenko Signed-off-by: David S. Miller net/core/rtnetlink.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 159a07604a99bd01e7db112de08d53dc4fcad109 Author: Quentin Schulz Date: Tue May 23 11:48:08 2017 +0200 net: fec: add post PHY reset delay DT property Some PHY require to wait for a bit after the reset GPIO has been toggled. This adds support for the DT property `phy-reset-post-delay` which gives the delay in milliseconds to wait after reset. If the DT property is not given, no delay is observed. Post reset delay greater than 1000ms are invalid. Signed-off-by: Quentin Schulz Reviewed-by: Andrew Lunn Acked-by: Fugang Duan Signed-off-by: David S. Miller Documentation/devicetree/bindings/net/fsl-fec.txt | 4 ++++ drivers/net/ethernet/freescale/fec_main.c | 16 +++++++++++++++- 2 files changed, 19 insertions(+), 1 deletion(-) commit 11d3c949b4ca37124fcace1ee3a5c2db0737a268 Merge: 12e8b57 7e06297 Author: David S. Miller Date: Wed May 24 15:21:05 2017 -0400 Merge branch 'sctp-dupcookie-fixes' Xin Long says: ==================== sctp: a bunch of fixes for processing dupcookie After introducing transport hashtable and per stream info into sctp, some regressions were caused when processing dupcookie, this patchset is to fix them. ==================== Signed-off-by: David S. Miller commit 7e06297768886337707f5833942b3bd524a6d3d5 Author: Xin Long Date: Tue May 23 13:28:55 2017 +0800 sctp: set new_asoc temp when processing dupcookie After sctp changed to use transport hashtable, a transport would be added into global hashtable when adding the peer to an asoc, then the asoc can be got by searching the transport in the hashtbale. The problem is when processing dupcookie in sctp_sf_do_5_2_4_dupcook, a new asoc would be created. A peer with the same addr and port as the one in the old asoc might be added into the new asoc, but fail to be added into the hashtable, as they also belong to the same sk. It causes that sctp's dupcookie processing can not really work. Since the new asoc will be freed after copying it's information to the old asoc, it's more like a temp asoc. So this patch is to fix it by setting it as a temp asoc to avoid adding it's any transport into the hashtable and also avoid allocing assoc_id. An extra thing it has to do is to also alloc stream info for any temp asoc, as sctp dupcookie process needs it to update old asoc. But I don't think it would hurt something, as a temp asoc would always be freed after finishing processing cookie echo packet. Reported-by: Jianwen Ji Signed-off-by: Xin Long Acked-by: Neil Horman Acked-by: Vlad Yasevich Signed-off-by: David S. Miller net/sctp/sm_make_chunk.c | 13 ++++--------- net/sctp/sm_statefuns.c | 3 +++ 2 files changed, 7 insertions(+), 9 deletions(-) commit 3ab2137915aea0ce7b3ec02e0f260ecc0f1c289d Author: Xin Long Date: Tue May 23 13:28:54 2017 +0800 sctp: fix stream update when processing dupcookie Since commit 3dbcc105d556 ("sctp: alloc stream info when initializing asoc"), stream and stream.out info are always alloced when creating an asoc. So it's not correct to check !asoc->stream before updating stream info when processing dupcookie, but would be better to check asoc state instead. Fixes: 3dbcc105d556 ("sctp: alloc stream info when initializing asoc") Signed-off-by: Xin Long Acked-by: Neil Horman Acked-by: Vlad Yasevich Signed-off-by: David S. Miller net/sctp/associola.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit c2dd893a3b0772d1c680e109b9d5715d7f73022b Author: Maurizio Lombardi Date: Wed May 24 14:09:44 2017 +0200 scsi: bnx2fc: fix race condition in bnx2fc_get_host_stats() If multiple tasks attempt to read the stats, it may happen that the start_req_done completion is re-initialized while still being used by another task, causing a list corruption. This patch fixes the bug by adding a mutex to serialize the calls to bnx2fc_get_host_stats(). WARNING: at lib/list_debug.c:48 list_del+0x6e/0xa0() (Not tainted) Hardware name: PowerEdge R820 list_del corruption. prev->next should be ffff882035627d90, but was ffff884069541588 Pid: 40267, comm: perl Not tainted 2.6.32-642.3.1.el6.x86_64 #1 Call Trace: [] ? warn_slowpath_common+0x91/0xe0 [] ? warn_slowpath_fmt+0x46/0x60 [] ? list_del+0x6e/0xa0 [] ? wait_for_common+0x14d/0x180 [] ? default_wake_function+0x0/0x20 [] ? wait_for_completion_timeout+0x13/0x20 [] ? bnx2fc_get_host_stats+0xa1/0x280 [bnx2fc] [] ? fc_stat_show+0x90/0xc0 [scsi_transport_fc] [] ? show_fcstat_tx_frames+0x16/0x20 [scsi_transport_fc] [] ? dev_attr_show+0x27/0x50 [] ? __get_free_pages+0xe/0x50 [] ? sysfs_read_file+0x111/0x200 [] ? vfs_read+0xb5/0x1a0 [] ? fget_light_pos+0x16/0x50 [] ? sys_read+0x51/0xb0 [] ? __audit_syscall_exit+0x25e/0x290 [] ? system_call_fastpath+0x16/0x1b Signed-off-by: Maurizio Lombardi Acked-by: Chad Dupuis Signed-off-by: Martin K. Petersen drivers/scsi/bnx2fc/bnx2fc.h | 1 + drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 10 ++++++++-- 2 files changed, 9 insertions(+), 2 deletions(-) commit ddff7ed45edce4a4c92949d3c61cd25d229c4a14 Author: Johannes Thumshirn Date: Tue May 23 16:50:47 2017 +0200 scsi: qla2xxx: don't disable a not previously enabled PCI device When pci_enable_device() or pci_enable_device_mem() fail in qla2x00_probe_one() we bail out but do a call to pci_disable_device(). This causes the dev_WARN_ON() in pci_disable_device() to trigger, as the device wasn't enabled previously. So instead of taking the 'probe_out' error path we can directly return *iff* one of the pci_enable_device() calls fails. Additionally rename the 'probe_out' goto label's name to the more descriptive 'disable_device'. Signed-off-by: Johannes Thumshirn Fixes: e315cd28b9ef ("[SCSI] qla2xxx: Code changes for qla data structure refactoring") Cc: Reviewed-by: Bart Van Assche Reviewed-by: Giridhar Malavali Signed-off-by: Martin K. Petersen drivers/scsi/qla2xxx/qla_os.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 0a716776914ed9d7ca90b48041e6767693bfb672 Author: Shreyas NC Date: Mon May 15 19:44:30 2017 +0530 ASoC: Intel: Skylake: Fix to parse consecutive string tkns in manifest Element size in the manifest should be updated for each token, so that the loop can parse all the string elements in the manifest. This was not happening when more than two string elements appear consecutively, as it is not updated with correct string element size. Fixed with this patch. Signed-off-by: Shreyas NC Signed-off-by: Subhransu S. Prusty Acked-by: Vinod Koul Signed-off-by: Mark Brown sound/soc/intel/skylake/skl-topology.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5cd1f5c32132101955d7f0e1955249a84f9b6fd9 Author: Pardha Saradhi K Date: Mon May 15 19:44:29 2017 +0530 ASoC: Intel: Skylake: Fix IPC rx_list corruption In SKL+ platforms, all IPC commands are serialised, i.e. the driver sends a new IPC to DSP, only after receiving a reply from the firmware for the current IPC. Hence it seems apparent that there is only a single modifier of the IPC RX List. However, during an IPC timeout case in a multithreaded environment, there is a possibility of the list element being deleted two times if not properly protected. So, use spin lock save/restore to prevent rx_list corruption. Signed-off-by: Pardha Saradhi K Signed-off-by: Subhransu S. Prusty Acked-by: Vinod Koul Signed-off-by: Mark Brown sound/soc/intel/skylake/skl-sst-ipc.c | 5 +++++ 1 file changed, 5 insertions(+) commit 7819a942de7b993771bd9377babc80485fe7606b Author: Kuninori Morimoto Date: Wed May 24 01:17:10 2017 +0000 ASoC: rsnd: SSI PIO adjust to 24bit mode commit 90431eb49bff ("ASoC: rsnd: don't use PDTA bit for 24bit on SSI") fixups 24bit mode data alignment, but PIO was not cared. This patch fixes PIO mode 24bit data alignment Signed-off-by: Kuninori Morimoto Signed-off-by: Mark Brown sound/soc/sh/rcar/ssi.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) commit 3a1672bb0186e940fc8521d19069f57690e850c2 Author: Charles Keepax Date: Wed May 24 11:01:32 2017 +0100 MAINTAINERS: Update email address for patches to Wolfson parts A somewhat overdue update of the address for sending patches on Wolfson parts to since our acquision a couple of years ago by Cirrus Logic. Signed-off-by: Charles Keepax Signed-off-by: Mark Brown MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4efda5f2130da033aeedc5b3205569893b910de2 Author: Takashi Iwai Date: Wed May 24 10:19:45 2017 +0200 ASoC: Fix use-after-free at card unregistration soc_cleanup_card_resources() call snd_card_free() at the last of its procedure. This turned out to lead to a use-after-free. PCM runtimes have been already removed via soc_remove_pcm_runtimes(), while it's dereferenced later in soc_pcm_free() called via snd_card_free(). The fix is simple: just move the snd_card_free() call to the beginning of the whole procedure. This also gives another benefit: it guarantees that all operations have been shut down before actually releasing the resources, which was racy until now. Reported-and-tested-by: Robert Jarzmik Signed-off-by: Takashi Iwai Signed-off-by: Mark Brown Cc: sound/soc/soc-core.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 41c25707d21716826e3c1f60967f5550610ec1c9 Author: Tejun Heo Date: Wed May 24 12:03:48 2017 -0400 cpuset: consider dying css as offline In most cases, a cgroup controller don't care about the liftimes of cgroups. For the controller, a css becomes online when ->css_online() is called on it and offline when ->css_offline() is called. However, cpuset is special in that the user interface it exposes cares whether certain cgroups exist or not. Combined with the RCU delay between cgroup removal and css offlining, this can lead to user visible behavior oddities where operations which should succeed after cgroup removals fail for some time period. The effects of cgroup removals are delayed when seen from userland. This patch adds css_is_dying() which tests whether offline is pending and updates is_cpuset_online() so that the function returns false also while offline is pending. This gets rid of the userland visible delays. Signed-off-by: Tejun Heo Reported-by: Daniel Jordan Link: http://lkml.kernel.org/r/327ca1f5-7957-fbb9-9e5f-9ba149d40ba2@oracle.com Cc: stable@vger.kernel.org Signed-off-by: Tejun Heo include/linux/cgroup.h | 20 ++++++++++++++++++++ kernel/cgroup/cpuset.c | 4 ++-- 2 files changed, 22 insertions(+), 2 deletions(-) commit 46e3813d72abb018f0cd6e72389004db8728c738 Author: Guilherme G. Piccoli Date: Thu May 18 18:34:35 2017 -0300 MAINTAINERS/serial: Change maintainer of jsm driver Gabriel will no longer maintain this driver, so I'm adding myself as maintainer. Thanks for all your work on jsm driver Gabriel. Signed-off-by: Guilherme G. Piccoli Acked-by: Gabriel Krisman Bertazi Signed-off-by: Greg Kroah-Hartman MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 42c99fc4c7069371da7b04b9099319dd1c633ee2 Author: Luis Henriques Date: Fri May 5 18:28:44 2017 +0100 ceph: check that the new inode size is within limits in ceph_fallocate() Currently the ceph client doesn't respect the rlimit in fallocate. This means that a user can allocate a file with size > RLIMIT_FSIZE. This patch adds the call to inode_newsize_ok() to verify filesystem limits and ulimits. This should make ceph successfully run xfstest generic/228. Signed-off-by: Luis Henriques Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov fs/ceph/file.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 0a2ad541071f99eaf4589c3551176fca191c1ee2 Author: Yan, Zheng Date: Fri May 5 18:47:37 2017 +0800 libceph: cleanup old messages according to reconnect seq when reopen a connection, use 'reconnect seq' to clean up messages that have already been received by peer. Link: http://tracker.ceph.com/issues/18690 Signed-off-by: "Yan, Zheng" Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov net/ceph/messenger.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) commit 2426125ab4ebdfc70fcdbaff8af8d50e34084616 Merge: 590d4b3 c70d9d8 Author: Linus Torvalds Date: Wed May 24 08:28:59 2017 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace Pull ptrace fix from Eric Biederman: "This fixes a brown paper bag bug. When I fixed the ptrace interaction with user namespaces I added a new field ptracer_cred in struct_task and I failed to properly initialize it on fork. This dangling pointer wound up breaking runing setuid applications run from the enlightenment window manager. As this is the worst sort of bug. A regression breaking user space for no good reason let's get this fixed" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: ptrace: Properly initialize ptracer_cred on fork commit 590d4b333d12cbf85dae37257d81960a280232df Merge: 56fff1b f5f968f Author: Linus Torvalds Date: Wed May 24 08:21:56 2017 -0700 Merge tag 'mmc-v4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: "A couple of MMC host fixes intended for v4.12 rc3: - sdhci-xenon: Don't free data for phy allocated by devm* - sdhci-iproc: Suppress spurious interrupts - cavium: Fix probing race with regulator - cavium: Prevent crash with incomplete DT - cavium-octeon: Use proper GPIO name for power control - cavium-octeon: Fix interrupt enable code" * tag 'mmc-v4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: sdhci-iproc: suppress spurious interrupt with Multiblock read mmc: cavium: Fix probing race with regulator of/platform: Make of_platform_device_destroy globally visible mmc: cavium: Prevent crash with incomplete DT mmc: cavium-octeon: Use proper GPIO name for power control mmc: cavium-octeon: Fix interrupt enable code mmc: sdhci-xenon: kill xenon_clean_phy() commit 44f73dc42c11398d7b84e94365a485ebd6420798 Author: Antoine Tenart Date: Wed May 24 16:10:32 2017 +0200 arm64: marvell: dts: fix interrupts in 7k/8k crypto nodes The cryptographic engine nodes have an interrupt which is configured as both edge and level, which makes no sense at all. Fix this by configuring it the right way (level). Signed-off-by: Antoine Tenart Signed-off-by: Gregory CLEMENT arch/arm64/boot/dts/marvell/armada-cp110-master.dtsi | 3 +-- arch/arm64/boot/dts/marvell/armada-cp110-slave.dtsi | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) commit 3e4240da0e3673637c1c995bdd14cfdbc8f4dc4c Author: Andrew Lunn Date: Wed May 24 01:39:35 2017 +0200 Revert "ata: sata_mv: Convert to devm_ioremap_resource()" This reverts commit 368e5fbdfc60732643f34f538823ed4bc8829827. devm_ioremap_resource() enforces that there are no overlapping resources, where as devm_ioremap() does not. The sata phy driver needs a subset of the sata IO address space, so maps some of the sata address space. As a result, sata_mv now fails to probe, reporting it cannot get its resources, and so we don't have any SATA disks. Signed-off-by: Andrew Lunn Acked-by: Gregory CLEMENT Cc: stable@vger.kernel.org # v4.11+ Signed-off-by: Tejun Heo drivers/ata/sata_mv.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) commit fc152d22d6e9fac95a9a990e6c29510bdf1b9425 Author: Mateusz Jurczyk Date: Wed May 24 15:55:00 2017 +0200 x86/alternatives: Prevent uninitialized stack byte read in apply_alternatives() In the current form of the code, if a->replacementlen is 0, the reference to *insnbuf for comparison touches potentially garbage memory. While it doesn't affect the execution flow due to the subsequent a->replacementlen comparison, it is (rightly) detected as use of uninitialized memory by a runtime instrumentation currently under my development, and could be detected as such by other tools in the future, too (e.g. KMSAN). Fix the "false-positive" by reordering the conditions to first check the replacement instruction length before referencing specific opcode bytes. Signed-off-by: Mateusz Jurczyk Reviewed-by: Borislav Petkov Cc: Andy Lutomirski Link: http://lkml.kernel.org/r/20170524135500.27223-1-mjurczyk@google.com Signed-off-by: Thomas Gleixner arch/x86/kernel/alternative.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) commit 2e0bb5b38f32eb21fe25e845721a205370adeffe Author: Chris Wilson Date: Tue May 23 20:44:12 2017 +0100 drm/i915/selftests: Silence compiler warning in igt_ctx_exec The compiler doesn't always spot the guard that object is allocated on the first pass, leading to: drivers/gpu/drm/i915/selftests/i915_gem_context.c: warning: 'obj' may be used uninitialized in this function [-Wuninitialized]: => 370:8 v2: Make it more obvious by setting obj to NULL on the first pass and any later pass where we need to reallocate. Reported-by: Geert Uytterhoeven Fixes: 791ff39ae32a ("drm/i915: Live testing for context execution") Signed-off-by: Chris Wilson Cc: Joonas Lahtinen Cc: Tvrtko Ursulin Cc: Matthew Auld c: # v4.12-rc1+ Link: http://patchwork.freedesktop.org/patch/msgid/20170523194412.1195-1-chris@chris-wilson.co.uk Reviewed-by: Tvrtko Ursulin (cherry picked from commit ca83d5840cb641b2efb04db0b70fa56955dd1453) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/selftests/i915_gem_context.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit d38162e4b5c643733792f32be4ea107c831827b4 Author: Daniel Vetter Date: Wed May 17 15:15:57 2017 +0200 Revert "drm/i915: Restore lost "Initialized i915" welcome message" This reverts commit bc5ca47c0af4f949ba889e666b7da65569e36093. Gabriel put this back into generic code with commit 75f6dfe3e652e1adef8cc1b073c89f3e22103a8f Author: Gabriel Krisman Bertazi Date: Wed Dec 28 12:32:11 2016 -0200 drm: Deduplicate driver initialization message but somehow he missed Chris' patch to add the message meanwhile. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=101025 Fixes: 75f6dfe3e652 ("drm: Deduplicate driver initialization message") Cc: Gabriel Krisman Bertazi Cc: Daniel Vetter Cc: Jani Nikula Cc: Chris Wilson Cc: # v4.11+ Reviewed-by: Gabriel Krisman Bertazi Signed-off-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/20170517131557.7836-1-daniel.vetter@ffwll.ch (cherry picked from commit 6bdba81979b2c3c8fed0be62ca31c32c3129d85f) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_drv.c | 4 ---- 1 file changed, 4 deletions(-) commit b49c15f97c936ef5a536821f97e4dd8568369802 Author: Trond Myklebust Date: Wed May 24 07:55:44 2017 -0400 NFSv4.0: Fix a lock leak in nfs40_walk_client_list Xiaolong Ye's kernel test robot detected the following Oops: [ 299.158991] BUG: scheduling while atomic: mount.nfs/9387/0x00000002 [ 299.169587] 2 locks held by mount.nfs/9387: [ 299.176165] #0: (nfs_clid_init_mutex){......}, at: [] nfs4_discover_server_trunking+0x47/0x1fc [ 299.201802] #1: (&(&nn->nfs_client_lock)->rlock){......}, at: [] nfs40_walk_client_list+0x2e9/0x338 [ 299.221979] CPU: 0 PID: 9387 Comm: mount.nfs Not tainted 4.11.0-rc7-00021-g14d1bbb #45 [ 299.235584] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.9.3-20161025_171302-gandalf 04/01/2014 [ 299.251176] Call Trace: [ 299.255192] dump_stack+0x61/0x7e [ 299.260416] __schedule_bug+0x65/0x74 [ 299.266208] __schedule+0x5d/0x87c [ 299.271883] schedule+0x89/0x9a [ 299.276937] schedule_timeout+0x232/0x289 [ 299.283223] ? detach_if_pending+0x10b/0x10b [ 299.289935] schedule_timeout_uninterruptible+0x2a/0x2c [ 299.298266] ? put_rpccred+0x3e/0x115 [ 299.304327] ? schedule_timeout_uninterruptible+0x2a/0x2c [ 299.312851] msleep+0x1e/0x22 [ 299.317612] nfs4_discover_server_trunking+0x102/0x1fc [ 299.325644] nfs4_init_client+0x13f/0x194 It looks as if we recently added a spin_lock() leak to nfs40_walk_client_list() when cleaning up the code. Reported-by: kernel test robot Fixes: 14d1bbb0ca42 ("NFS: Create a common nfs4_match_client() function") Cc: Anna Schumaker Signed-off-by: Trond Myklebust fs/nfs/nfs4client.c | 1 - 1 file changed, 1 deletion(-) commit 08cb5b0f058a325fcb5305e33f572ff6d6dfa289 Author: Benjamin Coddington Date: Mon May 22 20:20:23 2017 -0400 pnfs: Fix the check for requests in range of layout segment It's possible and acceptable for NFS to attempt to add requests beyond the range of the current pgio->pg_lseg, a case which should be caught and limited by the pg_test operation. However, the current handling of this case replaces pgio->pg_lseg with a new layout segment (after a WARN) within that pg_test operation. That will cause all the previously added requests to be submitted with this new layout segment, which may not be valid for those requests. Fix this problem by only returning zero for the number of bytes to coalesce from pg_test for this case which allows any previously added requests to complete on the current layout segment. The check for requests starting out of range of the layout segment moves to pg_init, so that the replacement of pgio->pg_lseg will be done when the next request is added. Signed-off-by: Benjamin Coddington Signed-off-by: Trond Myklebust fs/nfs/pnfs.c | 25 +++++++++++++++++-------- fs/nfs/pnfs.h | 10 ++++++++++ 2 files changed, 27 insertions(+), 8 deletions(-) commit d2c23c0075d7091bf749411bd2ee757cf4ec356c Author: Markus Elfring Date: Mon May 22 22:18:28 2017 +0200 xprtrdma: Delete an error message for a failed memory allocation in xprt_rdma_bc_setup() Omit an extra message for a memory allocation failure in this function. This issue was detected by using the Coccinelle software. Link: http://events.linuxfoundation.org/sites/events/files/slides/LCJ16-Refactor_Strings-WSang_0.pdf Signed-off-by: Markus Elfring Reviewed-by: Chuck Lever Signed-off-by: Trond Myklebust net/sunrpc/xprtrdma/backchannel.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 662f9a105b4322b8559d448f86110e6ec24b8738 Author: Dan Carpenter Date: Sat May 20 00:31:12 2017 +0300 pNFS/flexfiles: missing error code in ff_layout_alloc_lseg() If xdr_inline_decode() fails then we end up returning ERR_PTR(0). The caller treats NULL returns as -ENOMEM so it doesn't really hurt runtime, but obviously we intended to set an error code here. Fixes: d67ae825a59d ("pnfs/flexfiles: Add the FlexFile Layout Driver") Signed-off-by: Dan Carpenter Signed-off-by: Trond Myklebust fs/nfs/flexfilelayout/flexfilelayout.c | 1 + 1 file changed, 1 insertion(+) commit 6d3b5d8d8dd1c14f991ccab84b40f8425f1ae91b Author: Olga Kornievskaia Date: Tue May 16 12:00:15 2017 -0400 NFS fix COMMIT after COPY Fix a typo in the commit e092693443b995c8e3a565a73b5fdb05f1260f9b "NFS append COMMIT after synchronous COPY" Reported-by: Eryu Guan Fixes: e092693443b ("NFS append COMMIT after synchronous COPY") Signed-off-by: Olga Kornievskaia Tested-by: Eryu Guan Signed-off-by: Trond Myklebust fs/nfs/nfs42proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d8747d642ec4ce96adf17ae35652a5e4015cfe02 Author: Jan Kara Date: Tue May 2 13:16:18 2017 +0200 reiserfs: Make flush bios explicitely sync Commit b685d3d65ac7 "block: treat REQ_FUA and REQ_PREFLUSH as synchronous" removed REQ_SYNC flag from WRITE_{FUA|PREFLUSH|...} definitions. generic_make_request_checks() however strips REQ_FUA and REQ_PREFLUSH flags from a bio when the storage doesn't report volatile write cache and thus write effectively becomes asynchronous which can lead to performance regressions Fix the problem by making sure all bios which are synchronous are properly marked with REQ_SYNC. Fixes: b685d3d65ac791406e0dfd8779cc9b3707fea5a3 CC: reiserfs-devel@vger.kernel.org CC: stable@vger.kernel.org Signed-off-by: Jan Kara fs/reiserfs/journal.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 0f0b9b63e14fc3f66e4d342df016c9b071c5abed Author: Jan Kara Date: Tue May 2 13:14:13 2017 +0200 gfs2: Make flush bios explicitely sync Commit b685d3d65ac7 "block: treat REQ_FUA and REQ_PREFLUSH as synchronous" removed REQ_SYNC flag from WRITE_{FUA|PREFLUSH|...} definitions. generic_make_request_checks() however strips REQ_FUA and REQ_PREFLUSH flags from a bio when the storage doesn't report volatile write cache and thus write effectively becomes asynchronous which can lead to performance regressions Fix the problem by making sure all bios which are synchronous are properly marked with REQ_SYNC. Fixes: b685d3d65ac791406e0dfd8779cc9b3707fea5a3 CC: Steven Whitehouse CC: cluster-devel@redhat.com CC: stable@vger.kernel.org Acked-by: Bob Peterson Signed-off-by: Jan Kara fs/gfs2/log.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fefa92679dbe0c613e62b6c27235dcfbe9640ad1 Author: Liping Zhang Date: Sun May 21 07:22:49 2017 +0800 netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize If nf_conntrack_htable_size was adjusted by the user during the ct dump operation, we may invoke nf_ct_put twice for the same ct, i.e. the "last" ct. This will cause the ct will be freed but still linked in hash buckets. It's very easy to reproduce the problem by the following commands: # while : ; do echo $RANDOM > /proc/sys/net/netfilter/nf_conntrack_buckets done # while : ; do conntrack -L done # iperf -s 127.0.0.1 & # iperf -c 127.0.0.1 -P 60 -t 36000 After a while, the system will hang like this: NMI watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [bash:20184] NMI watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [iperf:20382] ... So at last if we find cb->args[1] is equal to "last", this means hash resize happened, then we can set cb->args[1] to 0 to fix the above issue. Fixes: d205dc40798d ("[NETFILTER]: ctnetlink: fix deadlock in table dumping") Signed-off-by: Liping Zhang Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_conntrack_netlink.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 4497a224f759cd8350e07382307b55f870ef0df2 Author: Jeremy Linton Date: Sat Apr 8 02:18:40 2017 -0500 reset: hi6220: Set module license so that it can be loaded The hi6220_reset driver can be built as a standalone module yet it cannot be loaded because it depends on GPL exported symbols. Lets set the module license so that the module loads, and things like the on-board kirin drm starts working. Signed-off-by: Jeremy Linton Reviewed-by: Xinliang Liu Signed-off-by: Philipp Zabel drivers/reset/hisilicon/hi6220_reset.c | 2 ++ 1 file changed, 2 insertions(+) commit cbed27cdf0e3f7ea3b2259e86b9e34df02be3fe4 Author: Mikulas Patocka Date: Tue Apr 18 15:07:11 2017 -0400 x86/PAT: Fix Xorg regression on CPUs that don't support PAT In the file arch/x86/mm/pat.c, there's a '__pat_enabled' variable. The variable is set to 1 by default and the function pat_init() sets __pat_enabled to 0 if the CPU doesn't support PAT. However, on AMD K6-3 CPUs, the processor initialization code never calls pat_init() and so __pat_enabled stays 1 and the function pat_enabled() returns true, even though the K6-3 CPU doesn't support PAT. The result of this bug is that a kernel warning is produced when attempting to start the Xserver and the Xserver doesn't start (fork() returns ENOMEM). Another symptom of this bug is that the framebuffer driver doesn't set the K6-3 MTRR registers: x86/PAT: Xorg:3891 map pfn expected mapping type uncached-minus for [mem 0xe4000000-0xe5ffffff], got write-combining ------------[ cut here ]------------ WARNING: CPU: 0 PID: 3891 at arch/x86/mm/pat.c:1020 untrack_pfn+0x5c/0x9f ... x86/PAT: Xorg:3891 map pfn expected mapping type uncached-minus for [mem 0xe4000000-0xe5ffffff], got write-combining To fix the bug change pat_enabled() so that it returns true only if PAT initialization was actually done. Also, I changed boot_cpu_has(X86_FEATURE_PAT) to this_cpu_has(X86_FEATURE_PAT) in pat_ap_init(), so that we check the PAT feature on the processor that is being initialized. Signed-off-by: Mikulas Patocka Cc: Andrew Morton Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Brian Gerst Cc: Denys Vlasenko Cc: H. Peter Anvin Cc: Josh Poimboeuf Cc: Linus Torvalds Cc: Luis R. Rodriguez Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Toshi Kani Cc: stable@vger.kernel.org # v4.2+ Link: http://lkml.kernel.org/r/alpine.LRH.2.02.1704181501450.26399@file01.intranet.prod.int.rdu2.redhat.com Signed-off-by: Ingo Molnar arch/x86/mm/pat.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 28232a4317be7ad615f0f1b69dc8583fd580a8e3 Author: Christoffer Dall Date: Sat May 20 14:12:34 2017 +0200 KVM: arm/arm64: Fix isues with GICv2 on GICv3 migration We have been a little loose with our intermediate VMCR representation where we had a 'ctlr' field, but we failed to differentiate between the GICv2 GICC_CTLR and ICC_CTLR_EL1 layouts, and therefore ended up mapping the wrong bits into the individual fields of the ICH_VMCR_EL2 when emulating a GICv2 on a GICv3 system. Fix this by using explicit fields for the VMCR bits instead. Cc: Eric Auger Reported-by: wanghaibin Signed-off-by: Christoffer Dall Reviewed-by: Marc Zyngier Tested-by: Marc Zyngier arch/arm64/kvm/vgic-sys-reg-v3.c | 10 ++++---- include/linux/irqchip/arm-gic-v3.h | 4 ++++ include/linux/irqchip/arm-gic.h | 28 ++++++++++++++++++++--- virt/kvm/arm/vgic/vgic-mmio-v2.c | 16 +++++++++++-- virt/kvm/arm/vgic/vgic-v2.c | 28 ++++++++++++++++++++--- virt/kvm/arm/vgic/vgic-v3.c | 47 ++++++++++++++++++++++++++------------ virt/kvm/arm/vgic/vgic.h | 12 ++++++---- 7 files changed, 114 insertions(+), 31 deletions(-) commit 8b77b0cfa99edbc4993139aab7592a2315c7bff4 Merge: 0833289 cbb22eb Author: Greg Kroah-Hartman Date: Wed May 24 09:19:43 2017 +0200 Merge tag 'usb-ci-v4.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/usb into usb-linus Peter writes: Some small bugs commit c9525a3fab63fbe091007494f8b7a06438eea6a7 Author: Benjamin Peterson Date: Sat May 20 17:20:16 2017 -0700 x86/watchdog: Fix Kconfig help text file path reference to lockup watchdog documentation Signed-off-by: Benjamin Peterson Acked-by: Thomas Gleixner Cc: Linus Torvalds Cc: Peter Zijlstra Fixes: 9919cba7ff71147803c988521cc1ceb80e7f0f6d ("watchdog: Update documentation") Link: http://lkml.kernel.org/r/20170521002016.13258-1-bp@benjamin.pe Signed-off-by: Ingo Molnar arch/x86/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7e6091209f7f73e2a81943020793b5ad26d645c6 Author: Jan Kiszka Date: Tue May 23 18:27:54 2017 +0200 x86/build: Permit building with old make versions At least Make 3.82 dislikes the tab in front of the $(warning) function: arch/x86/Makefile:162: *** recipe commences before first target. Stop. Let's be gentle. Signed-off-by: Jan Kiszka Acked-by: Thomas Gleixner Cc: Josh Poimboeuf Cc: Linus Torvalds Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/1944fcd8-e3df-d1f7-c0e4-60aeb1917a24@siemens.com Signed-off-by: Ingo Molnar arch/x86/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 519fb5c3350d1b5225b27b1cac55144f79351718 Author: Josh Poimboeuf Date: Tue May 23 10:37:30 2017 -0500 x86/unwind: Add end-of-stack check for ftrace handlers Dave Jones and Steven Rostedt reported unwinder warnings like the following: WARNING: kernel stack frame pointer at ffff8800bda0ff30 in sshd:1090 has bad value 000055b32abf1fa8 In both cases, the unwinder was attempting to unwind from an ftrace handler into entry code. The callchain was something like: syscall entry code C function ftrace handler save_stack_trace() The problem is that the unwinder's end-of-stack logic gets confused by the way ftrace lays out the stack frame (with fentry enabled). I was able to recreate this warning with: echo call_usermodehelper_exec_async:stacktrace > /sys/kernel/debug/tracing/set_ftrace_filter (exit login session) I considered fixing this by changing the ftrace code to rewrite the stack to make the unwinder happy. But that seemed too intrusive after I implemented it. Instead, just add another check to the unwinder's end-of-stack logic to detect this special case. Side note: We could probably get rid of these end-of-stack checks by encoding the frame pointer for syscall entry just like we do for interrupt entry. That would be simpler, but it would also be a lot more intrusive since it would slightly affect the performance of every syscall. Reported-by: Dave Jones Reported-by: Steven Rostedt Signed-off-by: Josh Poimboeuf Acked-by: Thomas Gleixner Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Petr Mladek Cc: live-patching@vger.kernel.org Fixes: c32c47c68a0a ("x86/unwind: Warn on bad frame pointer") Link: http://lkml.kernel.org/r/671ba22fbc0156b8f7e0cfa5ab2a795e08bc37e1.1495553739.git.jpoimboe@redhat.com Signed-off-by: Ingo Molnar arch/x86/kernel/unwind_frame.c | 49 ++++++++++++++++++++++++++++++++++-------- 1 file changed, 40 insertions(+), 9 deletions(-) commit ebd574994c63164d538a197172157318f58ac647 Author: Josh Poimboeuf Date: Tue May 23 10:37:29 2017 -0500 Revert "x86/entry: Fix the end of the stack for newly forked tasks" Petr Mladek reported the following warning when loading the livepatch sample module: WARNING: CPU: 1 PID: 3699 at arch/x86/kernel/stacktrace.c:132 save_stack_trace_tsk_reliable+0x133/0x1a0 ... Call Trace: __schedule+0x273/0x820 schedule+0x36/0x80 kthreadd+0x305/0x310 ? kthread_create_on_cpu+0x80/0x80 ? icmp_echo.part.32+0x50/0x50 ret_from_fork+0x2c/0x40 That warning means the end of the stack is no longer recognized as such for newly forked tasks. The problem was introduced with the following commit: ff3f7e2475bb ("x86/entry: Fix the end of the stack for newly forked tasks") ... which was completely misguided. It only partially fixed the reported issue, and it introduced another bug in the process. None of the other entry code saves the frame pointer before calling into C code, so it doesn't make sense for ret_from_fork to do so either. Contrary to what I originally thought, the original issue wasn't related to newly forked tasks. It was actually related to ftrace. When entry code calls into a function which then calls into an ftrace handler, the stack frame looks different than normal. The original issue will be fixed in the unwinder, in a subsequent patch. Reported-by: Petr Mladek Signed-off-by: Josh Poimboeuf Acked-by: Thomas Gleixner Cc: Dave Jones Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Steven Rostedt Cc: live-patching@vger.kernel.org Fixes: ff3f7e2475bb ("x86/entry: Fix the end of the stack for newly forked tasks") Link: http://lkml.kernel.org/r/f350760f7e82f0750c8d1dd093456eb212751caa.1495553739.git.jpoimboe@redhat.com Signed-off-by: Ingo Molnar arch/x86/entry/entry_32.S | 30 +++++++++++++++++++----------- arch/x86/entry/entry_64.S | 11 ++++------- 2 files changed, 23 insertions(+), 18 deletions(-) commit 6e30437bd42c4d4e9cfc4c40efda00eb83a11cde Author: Ingo Molnar Date: Wed May 24 08:57:21 2017 +0200 tools/include: Sync kernel ABI headers with tooling headers Sync (copy) the following v4.12 kernel headers to the tooling headers: arch/x86/include/asm/disabled-features.h: arch/x86/include/uapi/asm/kvm.h: arch/powerpc/include/uapi/asm/kvm.h: arch/s390/include/uapi/asm/kvm.h: arch/arm/include/uapi/asm/kvm.h: arch/arm64/include/uapi/asm/kvm.h: - 'struct kvm_sync_regs' got changed in an ABI-incompatible way, fortunately none of the (in-kernel) tooling relied on it - new KVM_DEV calls added arch/x86/include/asm/required-features.h: - 5-level paging hardware ABI detail added arch/x86/include/asm/cpufeatures.h: - new CPU feature added arch/x86/include/uapi/asm/vmx.h: - new VMX exit conditions None of the changes requires fixes in the tooling source code. This addresses the following warnings: Warning: include/uapi/linux/stat.h differs from kernel Warning: arch/x86/include/asm/disabled-features.h differs from kernel Warning: arch/x86/include/asm/required-features.h differs from kernel Warning: arch/x86/include/asm/cpufeatures.h differs from kernel Warning: arch/x86/include/uapi/asm/kvm.h differs from kernel Warning: arch/x86/include/uapi/asm/vmx.h differs from kernel Warning: arch/powerpc/include/uapi/asm/kvm.h differs from kernel Warning: arch/s390/include/uapi/asm/kvm.h differs from kernel Warning: arch/arm/include/uapi/asm/kvm.h differs from kernel Warning: arch/arm64/include/uapi/asm/kvm.h differs from kernel Cc: Arnaldo Carvalho de Melo Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Jiri Olsa Cc: Linus Torvalds Cc: Milian Wolff Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Yao Jin Cc: kernel-team@lge.com Link: http://lkml.kernel.org/r/20170524065721.j2mlch6bgk5klgbc@gmail.com Signed-off-by: Ingo Molnar tools/arch/arm/include/uapi/asm/kvm.h | 10 +++++++++- tools/arch/arm64/include/uapi/asm/kvm.h | 10 +++++++++- tools/arch/powerpc/include/uapi/asm/kvm.h | 3 +++ tools/arch/s390/include/uapi/asm/kvm.h | 26 ++++++++++++++++++++++++-- tools/arch/x86/include/asm/cpufeatures.h | 2 ++ tools/arch/x86/include/asm/disabled-features.h | 8 +++++++- tools/arch/x86/include/asm/required-features.h | 8 +++++++- tools/arch/x86/include/uapi/asm/kvm.h | 3 +++ tools/arch/x86/include/uapi/asm/vmx.h | 25 ++++++++++++++++++------- tools/include/uapi/linux/stat.h | 8 ++------ 10 files changed, 84 insertions(+), 19 deletions(-) commit 7111ffff60a68f55d864200cd6c7677319e5c242 Author: Namhyung Kim Date: Wed May 24 15:21:29 2017 +0900 perf tools: Put caller above callee in --children mode The __hpp__sort_acc() sorts entries using callchain depth in order to put callers above in children mode. But it assumed the callchain order was callee-first. Now default (for children) is caller-first so the order of entries is reverted. For example, consider following case: $ perf report --no-children ..l # Overhead Command Shared Object Symbol # ........ ....... ................... .......................... # 99.44% a.out a.out [.] main | ---main __libc_start_main _start Then children mode should show 'start' above '__libc_start_main' since it's the caller (parent) of the __libc_start_main. But it's reversed: # Children Self Command Shared Object Symbol # ........ ........ ....... ............... ..................... # 99.61% 0.00% a.out libc-2.25.so [.] __libc_start_main 99.61% 0.00% a.out a.out [.] _start 99.54% 99.44% a.out a.out [.] main This patch fixes it. # Children Self Command Shared Object Symbol # ........ ........ ....... ............... ..................... # 99.61% 0.00% a.out a.out [.] _start 99.61% 0.00% a.out libc-2.25.so [.] __libc_start_main 99.54% 99.44% a.out a.out [.] main Signed-off-by: Namhyung Kim Acked-by: Jiri Olsa Cc: Arnaldo Carvalho de Melo Cc: Arnaldo Carvalho de Melo Cc: Frederic Weisbecker Cc: Jiri Olsa Cc: Linus Torvalds Cc: Milian Wolff Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Yao Jin Cc: kernel-team@lge.com Link: http://lkml.kernel.org/r/20170524062129.32529-8-namhyung@kernel.org Signed-off-by: Ingo Molnar tools/perf/ui/hist.c | 2 ++ 1 file changed, 2 insertions(+) commit 4d53b9d546f9f4505e6e3d58c8eed894d6f684e7 Author: Milian Wolff Date: Wed May 24 15:21:28 2017 +0900 perf report: Do not drop last inlined frame The very last inlined frame, i.e. the one furthest away from the non-inlined frame, was silently dropped. This is apparent when comparing the output of `perf script` and `addr2line`: ~~~~~~ $ perf script --inline ... a.out 26722 80836.309329: 72425 cycles: 21561 __hypot_finite (/usr/lib/libm-2.25.so) ace3 hypot (/usr/lib/libm-2.25.so) a4a main (a.out) std::abs std::_Norm_helper::_S_do_it std::norm main 20510 __libc_start_main (/usr/lib/libc-2.25.so) bd9 _start (a.out) $ addr2line -a -f -i -e /tmp/a.out a4a | c++filt 0x0000000000000a4a std::__complex_abs(doublecomplex ) /usr/include/c++/6.3.1/complex:589 double std::abs(std::complex const&) /usr/include/c++/6.3.1/complex:597 double std::_Norm_helper::_S_do_it(std::complex const&) /usr/include/c++/6.3.1/complex:654 double std::norm(std::complex const&) /usr/include/c++/6.3.1/complex:664 main /tmp/inlining.cpp:14 ~~~~~ Note how `std::__complex_abs` is missing from the `perf script` output. This is similarly showing up in `perf report`. The patch here fixes this issue, and the output becomes: ~~~~~ a.out 26722 80836.309329: 72425 cycles: 21561 __hypot_finite (/usr/lib/libm-2.25.so) ace3 hypot (/usr/lib/libm-2.25.so) a4a main (a.out) std::__complex_abs std::abs std::_Norm_helper::_S_do_it std::norm main 20510 __libc_start_main (/usr/lib/libc-2.25.so) bd9 _start (a.out) ~~~~~ Signed-off-by: Milian Wolff Signed-off-by: Namhyung Kim Cc: Arnaldo Carvalho de Melo Cc: Arnaldo Carvalho de Melo Cc: David Ahern Cc: Jiri Olsa Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Yao Jin Cc: kernel-team@lge.com Link: http://lkml.kernel.org/r/20170524062129.32529-7-namhyung@kernel.org Signed-off-by: Ingo Molnar tools/perf/util/srcline.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) commit 28071f51839e393f697d0d1df0b223a4bc373606 Author: Milian Wolff Date: Wed May 24 15:21:27 2017 +0900 perf report: Always honor callchain order for inlined nodes So far, the inlined nodes where only reversed when we built perf against libbfd. If that was not available, the addr2line fallback code path was missing the inline_list__reverse call. Now we always add the nodes in the correct order within inline_list__append. This removes the need to reverse the list and also ensures that all callers construct the list in the right order. Signed-off-by: Milian Wolff Signed-off-by: Namhyung Kim Cc: Arnaldo Carvalho de Melo Cc: Arnaldo Carvalho de Melo Cc: David Ahern Cc: Jiri Olsa Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Yao Jin Cc: kernel-team@lge.com Link: http://lkml.kernel.org/r/20170524062129.32529-6-namhyung@kernel.org Signed-off-by: Ingo Molnar tools/perf/util/srcline.c | 18 ++++-------------- 1 file changed, 4 insertions(+), 14 deletions(-) commit 325fbff51f961491adff4037d0e0a94d6132bd9b Author: Namhyung Kim Date: Wed May 24 15:21:26 2017 +0900 perf script: Add --inline option for debugging The --inline option is to show inlined functions in callchains. For example: $ perf script a.out 5644 11611.467597: 309961 cycles:u: 790 main (/home/namhyung/tmp/perf/a.out) 20511 __libc_start_main (/usr/lib/libc-2.25.so) 8ba _start (/home/namhyung/tmp/perf/a.out) ... $ perf script --inline a.out 5644 11611.467597: 309961 cycles:u: 790 main (/home/namhyung/tmp/perf/a.out) std::__detail::_Adaptor, double>::operator() std::uniform_real_distribution::operator() > std::uniform_real_distribution::operator() > main 20511 __libc_start_main (/usr/lib/libc-2.25.so) 8ba _start (/home/namhyung/tmp/perf/a.out) ... Reviewed-and-tested-by: Milian Wolff Signed-off-by: Namhyung Kim Cc: Arnaldo Carvalho de Melo Cc: Arnaldo Carvalho de Melo Cc: Jin Yao Cc: Jiri Olsa Cc: Jiri Olsa Cc: Linus Torvalds Cc: Milian Wolff Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: kernel-team@lge.com Link: http://lkml.kernel.org/r/20170524062129.32529-5-namhyung@kernel.org Signed-off-by: Ingo Molnar tools/perf/Documentation/perf-script.txt | 4 ++++ tools/perf/builtin-script.c | 2 ++ tools/perf/util/evsel_fprintf.c | 33 ++++++++++++++++++++++++++++++++ 3 files changed, 39 insertions(+) commit 1982ad48fc82c284a5cc55697a012d3357e84d01 Author: Milian Wolff Date: Wed May 24 15:21:25 2017 +0900 perf report: Fix off-by-one for non-activation frames As the documentation for dwfl_frame_pc says, frames that are no activation frames need to have their program counter decremented by one to properly find the function of the caller. This fixes many cases where perf report currently attributes the cost to the next line. I.e. I have code like this: ~~~~~~~~~~~~~~~ #include #include using namespace std; int main() { this_thread::sleep_for(chrono::milliseconds(1000)); this_thread::sleep_for(chrono::milliseconds(100)); this_thread::sleep_for(chrono::milliseconds(10)); return 0; } ~~~~~~~~~~~~~~~ Now compile and record it: ~~~~~~~~~~~~~~~ g++ -std=c++11 -g -O2 test.cpp echo 1 | sudo tee /proc/sys/kernel/sched_schedstats perf record \ --event sched:sched_stat_sleep \ --event sched:sched_process_exit \ --event sched:sched_switch --call-graph=dwarf \ --output perf.data.raw \ ./a.out echo 0 | sudo tee /proc/sys/kernel/sched_schedstats perf inject --sched-stat --input perf.data.raw --output perf.data ~~~~~~~~~~~~~~~ Before this patch, the report clearly shows the off-by-one issue. Most notably, the last sleep invocation is incorrectly attributed to the "return 0;" line: ~~~~~~~~~~~~~~~ Overhead Source:Line ........ ........... 100.00% core.c:0 | ---__schedule core.c:0 schedule do_nanosleep hrtimer.c:0 hrtimer_nanosleep sys_nanosleep entry_SYSCALL_64_fastpath .tmp_entry_64.o:0 __nanosleep_nocancel .:0 std::this_thread::sleep_for > thread:323 | |--90.08%--main test.cpp:9 | __libc_start_main | _start | |--9.01%--main test.cpp:10 | __libc_start_main | _start | --0.91%--main test.cpp:13 __libc_start_main _start ~~~~~~~~~~~~~~~ With this patch here applied, the issue is fixed. The report becomes much more usable: ~~~~~~~~~~~~~~~ Overhead Source:Line ........ ........... 100.00% core.c:0 | ---__schedule core.c:0 schedule do_nanosleep hrtimer.c:0 hrtimer_nanosleep sys_nanosleep entry_SYSCALL_64_fastpath .tmp_entry_64.o:0 __nanosleep_nocancel .:0 std::this_thread::sleep_for > thread:323 | |--90.08%--main test.cpp:8 | __libc_start_main | _start | |--9.01%--main test.cpp:9 | __libc_start_main | _start | --0.91%--main test.cpp:10 __libc_start_main _start ~~~~~~~~~~~~~~~ Similarly it works for signal frames: ~~~~~~~~~~~~~~~ __noinline void bar(void) { volatile long cnt = 0; for (cnt = 0; cnt < 100000000; cnt++); } __noinline void foo(void) { bar(); } void sig_handler(int sig) { foo(); } int main(void) { signal(SIGUSR1, sig_handler); raise(SIGUSR1); foo(); return 0; } ~~~~~~~~~~~~~~~~ Before, the report wrongly points to `signal.c:29` after raise(): ~~~~~~~~~~~~~~~~ $ perf report --stdio --no-children -g srcline -s srcline ... 100.00% signal.c:11 | ---bar signal.c:11 | |--50.49%--main signal.c:29 | __libc_start_main | _start | --49.51%--0x33a8f raise .:0 main signal.c:29 __libc_start_main _start ~~~~~~~~~~~~~~~~ With this patch in, the issue is fixed and we instead get: ~~~~~~~~~~~~~~~~ 100.00% signal signal [.] bar | ---bar signal.c:11 | |--50.49%--main signal.c:29 | __libc_start_main | _start | --49.51%--0x33a8f raise .:0 main signal.c:27 __libc_start_main _start ~~~~~~~~~~~~~~~~ Note how this patch fixes this issue for both unwinding methods, i.e. both dwfl and libunwind. The former case is straight-forward thanks to dwfl_frame_pc(). For libunwind, we replace the functionality via unw_is_signal_frame() for any but the very first frame. Signed-off-by: Milian Wolff Signed-off-by: Namhyung Kim Cc: Arnaldo Carvalho de Melo Cc: Arnaldo Carvalho de Melo Cc: David Ahern Cc: Jiri Olsa Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Yao Jin Cc: kernel-team@lge.com Link: http://lkml.kernel.org/r/20170524062129.32529-4-namhyung@kernel.org Signed-off-by: Ingo Molnar tools/perf/util/unwind-libdw.c | 6 +++++- tools/perf/util/unwind-libunwind-local.c | 11 +++++++++++ 2 files changed, 16 insertions(+), 1 deletion(-) commit b21cc97810932a551f7aac46f0b89c469c828b3f Author: Milian Wolff Date: Wed May 24 15:21:24 2017 +0900 perf report: Fix memory leak in addr2line when called by addr2inlines When a filename was found in addr2line it was duplicated via strdup() but never freed. Now we pass NULL and handle this gracefully in addr2line. Detected by Valgrind: ==16331== 1,680 bytes in 21 blocks are definitely lost in loss record 148 of 220 ==16331== at 0x4C2AF1F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==16331== by 0x672FA69: strdup (in /usr/lib/libc-2.25.so) ==16331== by 0x52769F: addr2line (srcline.c:256) ==16331== by 0x52769F: addr2inlines (srcline.c:294) ==16331== by 0x52769F: dso__parse_addr_inlines (srcline.c:502) ==16331== by 0x574D7A: inline__fprintf (hist.c:41) ==16331== by 0x574D7A: ipchain__fprintf_graph (hist.c:147) ==16331== by 0x57518A: __callchain__fprintf_graph (hist.c:212) ==16331== by 0x5753CF: callchain__fprintf_graph.constprop.6 (hist.c:337) ==16331== by 0x57738E: hist_entry__fprintf (hist.c:628) ==16331== by 0x57738E: hists__fprintf (hist.c:882) ==16331== by 0x44A20F: perf_evlist__tty_browse_hists (builtin-report.c:399) ==16331== by 0x44A20F: report__browse_hists (builtin-report.c:491) ==16331== by 0x44A20F: __cmd_report (builtin-report.c:624) ==16331== by 0x44A20F: cmd_report (builtin-report.c:1054) ==16331== by 0x4A49CE: run_builtin (perf.c:296) ==16331== by 0x4A4CC0: handle_internal_command (perf.c:348) ==16331== by 0x434371: run_argv (perf.c:392) ==16331== by 0x434371: main (perf.c:530) Signed-off-by: Milian Wolff Signed-off-by: Namhyung Kim Cc: Arnaldo Carvalho de Melo Cc: Arnaldo Carvalho de Melo Cc: David Ahern Cc: Jiri Olsa Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Yao Jin Cc: kernel-team@lge.com Link: http://lkml.kernel.org/r/20170524062129.32529-3-namhyung@kernel.org Signed-off-by: Ingo Molnar tools/perf/util/srcline.c | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) commit 7d4df089d77306914426a604c890175f91a9a459 Author: Milian Wolff Date: Wed May 24 15:21:23 2017 +0900 perf report: Don't crash on invalid maps in `-g srcline` mode I just hit a segfault when doing `perf report -g srcline`. Valgrind pointed me at this code as the culprit: ==8359== Invalid read of size 8 ==8359== at 0x3096D9: map__rip_2objdump (map.c:430) ==8359== by 0x2FC1A3: match_chain_srcline (callchain.c:645) ==8359== by 0x2FC1A3: match_chain (callchain.c:700) ==8359== by 0x2FC1A3: append_chain (callchain.c:895) ==8359== by 0x2FC1A3: append_chain_children (callchain.c:846) ==8359== by 0x2FF719: callchain_append (callchain.c:944) ==8359== by 0x2FF719: hist_entry__append_callchain (callchain.c:1058) ==8359== by 0x32FA06: iter_add_single_cumulative_entry (hist.c:908) ==8359== by 0x33195C: hist_entry_iter__add (hist.c:1050) ==8359== by 0x258F65: process_sample_event (builtin-report.c:204) ==8359== by 0x30D60C: perf_session__deliver_event (session.c:1310) ==8359== by 0x30D60C: ordered_events__deliver_event (session.c:119) ==8359== by 0x310D12: __ordered_events__flush (ordered-events.c:210) ==8359== by 0x310D12: ordered_events__flush.part.3 (ordered-events.c:277) ==8359== by 0x30DD3C: perf_session__process_user_event (session.c:1349) ==8359== by 0x30DD3C: perf_session__process_event (session.c:1475) ==8359== by 0x30FC3C: __perf_session__process_events (session.c:1867) ==8359== by 0x30FC3C: perf_session__process_events (session.c:1921) ==8359== by 0x25A985: __cmd_report (builtin-report.c:575) ==8359== by 0x25A985: cmd_report (builtin-report.c:1054) ==8359== by 0x2B9A80: run_builtin (perf.c:296) ==8359== Address 0x70 is not stack'd, malloc'd or (recently) free'd This patch fixes the issue. Signed-off-by: Milian Wolff [ Remove dependency from another change ] Signed-off-by: Namhyung Kim Cc: Arnaldo Carvalho de Melo Cc: Arnaldo Carvalho de Melo Cc: David Ahern Cc: Jiri Olsa Cc: Jiri Olsa Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Yao Jin Cc: kernel-team@lge.com Link: http://lkml.kernel.org/r/20170524062129.32529-2-namhyung@kernel.org Signed-off-by: Ingo Molnar tools/perf/util/callchain.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) commit 98f9de366fccee7572c646af226b2d4b4841e3b5 Author: Alexander Sverdlin Date: Mon May 22 16:05:23 2017 +0200 dmaengine: ep93xx: Don't drain the transfers in terminate_all() Draining the transfers in terminate_all callback happens with IRQs disabled, therefore induces huge latency: irqsoff latency trace v1.1.5 on 4.11.0 -------------------------------------------------------------------- latency: 39770 us, #57/57, CPU#0 | (M:preempt VP:0, KP:0, SP:0 HP:0) ----------------- | task: process-129 (uid:0 nice:0 policy:2 rt_prio:50) ----------------- => started at: _snd_pcm_stream_lock_irqsave => ended at: snd_pcm_stream_unlock_irqrestore _------=> CPU# / _-----=> irqs-off | / _----=> need-resched || / _---=> hardirq/softirq ||| / _--=> preempt-depth |||| / delay cmd pid ||||| time | caller \ / ||||| \ | / process-129 0d.s. 3us : _snd_pcm_stream_lock_irqsave process-129 0d.s1 9us : snd_pcm_stream_lock <-_snd_pcm_stream_lock_irqsave process-129 0d.s1 15us : preempt_count_add <-snd_pcm_stream_lock process-129 0d.s2 22us : preempt_count_add <-snd_pcm_stream_lock process-129 0d.s3 32us : snd_pcm_update_hw_ptr0 <-snd_pcm_period_elapsed process-129 0d.s3 41us : soc_pcm_pointer <-snd_pcm_update_hw_ptr0 process-129 0d.s3 50us : dmaengine_pcm_pointer <-soc_pcm_pointer process-129 0d.s3 58us+: snd_dmaengine_pcm_pointer_no_residue <-dmaengine_pcm_pointer process-129 0d.s3 96us : update_audio_tstamp <-snd_pcm_update_hw_ptr0 process-129 0d.s3 103us : snd_pcm_update_state <-snd_pcm_update_hw_ptr0 process-129 0d.s3 112us : xrun <-snd_pcm_update_state process-129 0d.s3 119us : snd_pcm_stop <-xrun process-129 0d.s3 126us : snd_pcm_action <-snd_pcm_stop process-129 0d.s3 134us : snd_pcm_action_single <-snd_pcm_action process-129 0d.s3 141us : snd_pcm_pre_stop <-snd_pcm_action_single process-129 0d.s3 150us : snd_pcm_do_stop <-snd_pcm_action_single process-129 0d.s3 157us : soc_pcm_trigger <-snd_pcm_do_stop process-129 0d.s3 166us : snd_dmaengine_pcm_trigger <-soc_pcm_trigger process-129 0d.s3 175us : ep93xx_dma_terminate_all <-snd_dmaengine_pcm_trigger process-129 0d.s3 182us : preempt_count_add <-ep93xx_dma_terminate_all process-129 0d.s4 189us*: m2p_hw_shutdown <-ep93xx_dma_terminate_all process-129 0d.s4 39472us : m2p_hw_setup <-ep93xx_dma_terminate_all ... rest skipped... process-129 0d.s. 40080us : => ep93xx_dma_tasklet => tasklet_action => __do_softirq => irq_exit => __handle_domain_irq => vic_handle_irq => __irq_usr => 0xb66c6668 Just abort the transfers and warn if the HW state is not what we expect. Move draining into device_synchronize callback. Signed-off-by: Alexander Sverdlin Cc: stable@vger.kernel.org Signed-off-by: Vinod Koul drivers/dma/ep93xx_dma.c | 37 +++++++++++++++++++++++++++++++++---- 1 file changed, 33 insertions(+), 4 deletions(-) commit 0037ae47812b1f431cc602100d1d51f37d77b61e Author: Alexander Sverdlin Date: Mon May 22 16:05:22 2017 +0200 dmaengine: ep93xx: Always start from BASE0 The current buffer is being reset to zero on device_free_chan_resources() but not on device_terminate_all(). It could happen that HW is restarted and expects BASE0 to be used, but the driver is not synchronized and will start from BASE1. One solution is to reset the buffer explicitly in m2p_hw_setup(). Signed-off-by: Alexander Sverdlin Cc: stable@vger.kernel.org Signed-off-by: Vinod Koul drivers/dma/ep93xx_dma.c | 2 ++ 1 file changed, 2 insertions(+) commit a54c51863ed1294078a435151e625313b4365ac5 Author: Jon Mason Date: Fri Apr 28 16:11:30 2017 -0400 thermal: broadcom: ns-thermal: default on iProc SoCs Tweak the Kconfig description to mention support for NSP and make the default on for iProc based platforms. Signed-off-by: Jon Mason Signed-off-by: Eduardo Valentin drivers/thermal/broadcom/Kconfig | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 8b8656d64c0cce9007e062273190d8e97096f0ac Author: Markus Elfring Date: Wed Apr 26 17:11:28 2017 +0200 ti-soc-thermal: Fix a typo in a comment line Add a missing character in this description for a function. Acked-by: Keerthy Tested-by: Keerthy Signed-off-by: Markus Elfring Signed-off-by: Eduardo Valentin drivers/thermal/ti-soc-thermal/ti-bandgap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 57e521151b56ee0c5164c442b7928c66711bfbc4 Author: Markus Elfring Date: Wed Apr 26 17:03:07 2017 +0200 ti-soc-thermal: Delete error messages for failed memory allocations in ti_bandgap_build() The script "checkpatch.pl" pointed information out like the following. WARNING: Possible unnecessary 'out of memory' message Thus remove such statements here. Link: http://events.linuxfoundation.org/sites/events/files/slides/LCJ16-Refactor_Strings-WSang_0.pdf Acked-by: Keerthy Tested-by: Keerthy Signed-off-by: Markus Elfring Signed-off-by: Eduardo Valentin drivers/thermal/ti-soc-thermal/ti-bandgap.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) commit 748c23d88610b5df378d86e7192e4bd1f58adb35 Author: Markus Elfring Date: Wed Apr 26 16:45:25 2017 +0200 ti-soc-thermal: Use devm_kcalloc() in ti_bandgap_build() A multiplication for the size determination of a memory allocation indicated that an array data structure should be processed. Thus use the corresponding function "devm_kcalloc". This issue was detected by using the Coccinelle software. Acked-by: Keerthy Tested-by: Keerthy Signed-off-by: Markus Elfring Signed-off-by: Eduardo Valentin drivers/thermal/ti-soc-thermal/ti-bandgap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit c4b379d0640a35b6c87200c3bdac0df2e6137022 Author: Colin Ian King Date: Mon May 8 11:36:43 2017 +0100 thermal: core: make thermal_emergency_poweroff static Making thermal_emergency_poweroff static fixes sparse warning: drivers/thermal/thermal_core.c:6: warning: symbol 'thermal_emergency_poweroff' was not declared. Should it be static? Fixes: ef1d87e06ab4 ("thermal: core: Add a back up thermal shutdown mechanism") Acked-by: Keerthy Signed-off-by: Colin Ian King Signed-off-by: Eduardo Valentin drivers/thermal/thermal_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0e774888675d7ec693379a228490ce611135cbc2 Author: Masahiro Yamada Date: Wed Apr 26 10:50:02 2017 +0900 thermal: qoriq: remove useless call for of_thermal_get_trip_points() Building this driver with W=1 reports: warning: variable 'trip' set but not used [-Wunused-but-set-variable] The call for of_thermal_get_trip_points() is useless. Signed-off-by: Masahiro Yamada Signed-off-by: Eduardo Valentin drivers/thermal/qoriq_thermal.c | 3 --- 1 file changed, 3 deletions(-) commit f3cdbe39b2ab0636dec0d5d43b54f1061ce7566c Author: Mike Christie Date: Wed May 17 04:34:37 2017 -0500 tcmu: fix crash during device removal We currently do tcmu_free_device ->tcmu_netlink_event(TCMU_CMD_REMOVED_DEVICE) -> uio_unregister_device -> kfree(tcmu_dev). The problem is that the kernel does not wait for userspace to do the close() on the uio device before freeing the tcmu_dev. We can then hit a race where the kernel frees the tcmu_dev before userspace does close() and so when close() -> release -> tcmu_release is done, we try to access a freed tcmu_dev. This patch made over the target-pending master branch moves the freeing of the tcmu_dev to when the last reference has been dropped. This also fixes a leak where if tcmu_configure_device was not called on a device we did not free udev->name which was allocated at tcmu_alloc_device time. Signed-off-by: Mike Christie Signed-off-by: Nicholas Bellinger drivers/target/target_core_user.c | 46 ++++++++++++++++++++++++++++----------- 1 file changed, 33 insertions(+), 13 deletions(-) commit 75b61250bf687c686ba6850c34eccc1303b0b827 Author: Varun Prakash Date: Tue May 16 19:23:44 2017 +0530 scsi: libcxgbi: fix skb use after free skb->data is assigned to task->hdr in cxgbi_conn_alloc_pdu(), skb gets freed after tx but task->hdr is still dereferenced in iscsi_tcp_task_xmit() to avoid this call skb_get() after allocating skb and free the skb in cxgbi_cleanup_task() or before allocating new skb in cxgbi_conn_alloc_pdu(). Signed-off-by: Varun Prakash Signed-off-by: Martin K. Petersen drivers/scsi/cxgbi/libcxgbi.c | 25 ++++++++++++++++++------- drivers/scsi/cxgbi/libcxgbi.h | 16 ++++++++-------- 2 files changed, 26 insertions(+), 15 deletions(-) commit e274086e473c0cbea18051ae0a78a05f8d658f47 Author: Changbin Du Date: Mon May 22 17:46:58 2017 +0800 drm/i915/gvt: clean up unsubmited workloads before destroying kmem cache This is to fix a memory leak issue caused by unfreed gvtg workload objects. Walk through the workload list and free all of the remained workloads before destroying kmem cache. [179.885211] INFO: Object 0xffff9cef10003b80 @offset=7040 [179.885657] kmem_cache_destroy gvt-g_vgpu_workload: Slab cache still has objects [179.886146] CPU: 2 PID: 2318 Comm: win_lucas Tainted: G    B   W       4.11.0+ #1 [179.887223] Call Trace: [179.887394] dump_stack+0x63/0x90 [179.887617] kmem_cache_destroy+0x1cf/0x1e0 [179.887960] intel_vgpu_clean_execlist+0x15/0x20 [i915] [179.888365] intel_gvt_destroy_vgpu+0x4c/0xd0 [i915] [179.888688] intel_vgpu_remove+0x2a/0x30 [kvmgt] [179.888988] mdev_device_remove_ops+0x23/0x50 [mdev] [179.889309] mdev_device_remove+0xe4/0x190 [mdev] [179.889615] remove_store+0x7d/0xb0 [mdev] [179.889885] dev_attr_store+0x18/0x30 [179.890129] sysfs_kf_write+0x37/0x40 [179.890371] kernfs_fop_write+0x107/0x180 [179.890632] __vfs_write+0x37/0x160 [179.890865] ? kmem_cache_alloc+0xd7/0x1b0 [179.891116] ? apparmor_file_permission+0x1a/0x20 [179.891372] ? security_file_permission+0x3b/0xc0 [179.891628] vfs_write+0xb8/0x1b0 [179.891812] SyS_write+0x55/0xc0 [179.891992] entry_SYSCALL_64_fastpath+0x1e/0xad Signed-off-by: Changbin Du Signed-off-by: Zhenyu Wang drivers/gpu/drm/i915/gvt/execlist.c | 30 ++++++++++++++++++++---------- 1 file changed, 20 insertions(+), 10 deletions(-) commit b19775e4785996503b106e59d9d3a8839e677afd Author: manish.rangankar@cavium.com Date: Fri May 19 01:33:21 2017 -0700 scsi: qedi: Fix endpoint NULL panic during recovery. Signed-off-by: Manish Rangankar Signed-off-by: Martin K. Petersen drivers/scsi/qedi/qedi_fw.c | 2 ++ 1 file changed, 2 insertions(+) commit 3d61a3132212d6b1c8c6914700d5f6456712ac08 Author: Nilesh Javali Date: Fri May 19 01:33:20 2017 -0700 scsi: qedi: set max_fin_rt default value max_fin_rt is the maximum re-transmission of FIN packets as part of the termination flow. After reaching this value the FW will send a single RESET. Signed-off-by: Nilesh Javali Signed-off-by: Manish Rangankar Signed-off-by: Martin K. Petersen drivers/scsi/qedi/qedi_main.c | 1 + 1 file changed, 1 insertion(+) commit 962ea1c0df6c5a36f4477aa4a10f4acc0f5f56bd Author: manish.rangankar@cavium.com Date: Fri May 19 01:33:19 2017 -0700 scsi: qedi: Set firmware tcp msl timer value. Signed-off-by: Manish Rangankar Signed-off-by: Martin K. Petersen drivers/scsi/qedi/qedi_main.c | 1 + 1 file changed, 1 insertion(+) commit 0ea9314f4e6c69f8d732e0a9310114c2de35ada8 Author: manish.rangankar@cavium.com Date: Fri May 19 01:33:18 2017 -0700 scsi: qedi: Fix endpoint NULL panic in qedi_set_path. RIP: 0010:qedi_set_path+0x114/0x570 [qedi] Call Trace: [] iscsi_if_recv_msg+0x623/0x14a0 [] ? rhashtable_lookup_compare+0x36/0x70 [] iscsi_if_rx+0x8e/0x1f0 [] netlink_unicast+0xed/0x1b0 [] netlink_sendmsg+0x330/0x770 [] sock_sendmsg+0xb0/0xf0 [] ? __switch_to+0x17b/0x4b0 [] ? __schedule+0x2d8/0x900 [] ___sys_sendmsg+0x3a9/0x3c0 [] ? get_futex_key+0x1c8/0x2b0 [] ? futex_wake+0x80/0x160 Signed-off-by: Manish Rangankar Signed-off-by: Martin K. Petersen drivers/scsi/qedi/qedi_iscsi.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit d0788a528d9e09d7c17f05dd61c4cc492181f817 Author: manish.rangankar@cavium.com Date: Fri May 19 01:33:17 2017 -0700 scsi: qedi: Set dma_boundary to 0xfff. Signed-off-by: Manish Rangankar Signed-off-by: Martin K. Petersen drivers/scsi/qedi/qedi.h | 1 + drivers/scsi/qedi/qedi_iscsi.c | 1 + 2 files changed, 2 insertions(+) commit fc2fbf0d422b54b487c5e7413acd54cbac6d4151 Author: manish.rangankar@cavium.com Date: Fri May 19 01:33:16 2017 -0700 scsi: qedi: Correctly set firmware max supported BDs. Signed-off-by: Manish Rangankar Signed-off-by: Martin K. Petersen drivers/scsi/qedi/qedi.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5e901d0b15c0cba8c5ba55e4be46fc5a0e2f3cb9 Author: Arun Easi Date: Fri May 19 01:33:15 2017 -0700 scsi: qedi: Fix bad pte call trace when iscsiuio is stopped. munmap done by iscsiuio during a stop of the service triggers a "bad pte" warning sometimes. munmap kernel path goes through the mmapped pages and has a validation check for mapcount (in struct page) to be zero or above. kzalloc, which we had used to allocate udev->ctrl, uses slab allocations, which re-uses mapcount (union) for other purposes that can make the mapcount look negative. Avoid all these trouble by invoking one of the __get_free_pages wrappers to be used instead of kzalloc for udev->ctrl. BUG: Bad page map in process iscsiuio pte:80000000aa624067 pmd:3e6777067 page:ffffea0002a98900 count:2 mapcount:-2143289280 mapping: (null) index:0xffff8800aa624e00 page flags: 0x10075d00000090(dirty|slab) page dumped because: bad pte addr:00007fcba70a3000 vm_flags:0c0400fb anon_vma: (null) mapping:ffff8803edf66e90 index:0 Call Trace: dump_stack+0x19/0x1b print_bad_pte+0x1af/0x250 unmap_page_range+0x7a7/0x8a0 unmap_single_vma+0x81/0xf0 unmap_vmas+0x49/0x90 unmap_region+0xbe/0x140 ? vma_rb_erase+0x121/0x220 do_munmap+0x245/0x420 vm_munmap+0x41/0x60 SyS_munmap+0x22/0x30 tracesys+0xdd/0xe2 Signed-off-by: Arun Easi Signed-off-by: Manish Rangankar Signed-off-by: Martin K. Petersen drivers/scsi/qedi/qedi_main.c | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-) commit 0648a07c9b22acc33ead0645cf8f607b0c9c7e32 Author: Artem Savkov Date: Sat May 20 09:58:10 2017 +0200 scsi: scsi_dh_rdac: Use ctlr directly in rdac_failover_get() rdac_failover_get references struct rdac_controller as ctlr->ms_sdev->handler_data->ctlr for no apparent reason. Besides being inefficient this also introduces a null-pointer dereference as send_mode_select() sets ctlr->ms_sdev to NULL before calling rdac_failover_get(): [ 18.432550] device-mapper: multipath service-time: version 0.3.0 loaded [ 18.436124] BUG: unable to handle kernel NULL pointer dereference at 0000000000000790 [ 18.436129] IP: send_mode_select+0xca/0x560 [ 18.436129] PGD 0 [ 18.436130] P4D 0 [ 18.436130] [ 18.436132] Oops: 0000 [#1] SMP [ 18.436133] Modules linked in: dm_service_time sd_mod dm_multipath amdkfd amd_iommu_v2 radeon(+) i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm qla2xxx drm serio_raw scsi_transport_fc bnx2 i2c_core dm_mirror dm_region_hash dm_log dm_mod [ 18.436143] CPU: 4 PID: 443 Comm: kworker/u16:2 Not tainted 4.12.0-rc1.1.el7.test.x86_64 #1 [ 18.436144] Hardware name: IBM BladeCenter LS22 -[79013SG]-/Server Blade, BIOS -[L8E164AUS-1.07]- 05/25/2011 [ 18.436145] Workqueue: kmpath_rdacd send_mode_select [ 18.436146] task: ffff880225116a40 task.stack: ffffc90002bd8000 [ 18.436148] RIP: 0010:send_mode_select+0xca/0x560 [ 18.436148] RSP: 0018:ffffc90002bdbda8 EFLAGS: 00010246 [ 18.436149] RAX: 0000000000000000 RBX: ffffc90002bdbe08 RCX: ffff88017ef04a80 [ 18.436150] RDX: ffffc90002bdbe08 RSI: ffff88017ef04a80 RDI: ffff8802248e4388 [ 18.436151] RBP: ffffc90002bdbe48 R08: 0000000000000000 R09: ffffffff81c104c0 [ 18.436151] R10: 00000000000001ff R11: 000000000000035a R12: ffffc90002bdbdd8 [ 18.436152] R13: ffff8802248e4390 R14: ffff880225152800 R15: ffff8802248e4400 [ 18.436153] FS: 0000000000000000(0000) GS:ffff880227d00000(0000) knlGS:0000000000000000 [ 18.436154] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 18.436154] CR2: 0000000000000790 CR3: 000000042535b000 CR4: 00000000000006e0 [ 18.436155] Call Trace: [ 18.436159] ? rdac_activate+0x14e/0x150 [ 18.436161] ? refcount_dec_and_test+0x11/0x20 [ 18.436162] ? kobject_put+0x1c/0x50 [ 18.436165] ? scsi_dh_activate+0x6f/0xd0 [ 18.436168] process_one_work+0x149/0x360 [ 18.436170] worker_thread+0x4d/0x3c0 [ 18.436172] kthread+0x109/0x140 [ 18.436173] ? rescuer_thread+0x380/0x380 [ 18.436174] ? kthread_park+0x60/0x60 [ 18.436176] ret_from_fork+0x2c/0x40 [ 18.436177] Code: 49 c7 46 20 00 00 00 00 4c 89 ef c6 07 00 0f 1f 40 00 45 31 ed c7 45 b0 05 00 00 00 44 89 6d b4 4d 89 f5 4c 8b 75 a8 49 8b 45 20 <48> 8b b0 90 07 00 00 48 8b 56 10 8b 42 10 48 8d 7a 28 85 c0 0f [ 18.436192] RIP: send_mode_select+0xca/0x560 RSP: ffffc90002bdbda8 [ 18.436192] CR2: 0000000000000790 [ 18.436198] ---[ end trace 40f3e4dca1ffabdd ]--- [ 18.436199] Kernel panic - not syncing: Fatal exception [ 18.436222] Kernel Offset: disabled [-- MARK -- Thu May 18 11:45:00 2017] Fixes: 327825574132 scsi_dh_rdac: switch to scsi_execute_req_flags() Cc: stable@vger.kernel.org Signed-off-by: Artem Savkov Reviewed-by: Christoph Hellwig Signed-off-by: Martin K. Petersen drivers/scsi/device_handler/scsi_dh_rdac.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) commit 43fe8b8eb81eee713400340716cf945f59d21496 Author: Thomas Gleixner Date: Tue May 23 23:27:38 2017 +0200 posix-timers: Make signal printks conditional A recent commit added extra printks for CPU/RT limits. This can result in excessive spam in dmesg. Make the printks conditional on print_fatal_signals. Fixes: e7ea7c9806a2 ("rlimits: Print more information when CPU/RT limits are exceeded") Reported-by: Dave Jones Signed-off-by: Thomas Gleixner Cc: Arun Raghavan kernel/time/posix-cpu-timers.c | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-) commit 124dffea9e8e372509e055aebd118e85518fd644 Author: Liping Zhang Date: Sun May 21 22:38:11 2017 +0800 netfilter: nat: use atomic bit op to clear the _SRC_NAT_DONE_BIT We need to clear the IPS_SRC_NAT_DONE_BIT to indicate that the ct has been removed from nat_bysource table. But unfortunately, we use the non-atomic bit operation: "ct->status &= ~IPS_NAT_DONE_MASK". So there's a race condition that we may clear the _DYING_BIT set by another CPU unexpectedly. Since we don't care about the IPS_DST_NAT_DONE_BIT, so just using clear_bit to clear the IPS_SRC_NAT_DONE_BIT is enough. Also note, this is the last user which use the non-atomic bit operation to update the confirmed ct->status. Reported-by: Florian Westphal Signed-off-by: Liping Zhang Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_nat_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d2df92e98a34a5619dadd29c6291113c009181e7 Author: Pablo Neira Ayuso Date: Sun May 21 00:37:10 2017 +0200 netfilter: nft_set_rbtree: handle element re-addition after deletion The existing code selects no next branch to be inspected when re-inserting an inactive element into the rb-tree, looping endlessly. This patch restricts the check for active elements to the EEXIST case only. Fixes: e701001e7cbe ("netfilter: nft_rbtree: allow adjacent intervals with dynamic updates") Reported-by: Wolfgang Bumiller Tested-by: Wolfgang Bumiller Signed-off-by: Pablo Neira Ayuso net/netfilter/nft_set_rbtree.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) commit f3c0eb05e258c6a48c2d1ef2fa71ffb6ff63cd18 Author: Davide Caratti Date: Thu May 18 18:01:43 2017 +0200 netfilter: conntrack: fix false CRC32c mismatch using paged skb sctp_compute_cksum() implementation assumes that at least the SCTP header is in the linear part of skb: modify conntrack error callback to avoid false CRC32c mismatch, if the transport header is partially/entirely paged. Fixes: cf6e007eef83 ("netfilter: conntrack: validate SCTP crc32c in PREROUTING") Signed-off-by: Davide Caratti Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_conntrack_proto_sctp.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 82bc9a42cf854fdf63155759c0aa790bd1f361b0 Author: Patrik Jakobsson Date: Tue Apr 18 13:43:32 2017 +0200 drm/gma500/psb: Actually use VBT mode when it is found With LVDS we were incorrectly picking the pre-programmed mode instead of the prefered mode provided by VBT. Make sure we pick the VBT mode if one is provided. It is likely that the mode read-out code is still wrong but this patch fixes the immediate problem on most machines. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=78562 Cc: Signed-off-by: Patrik Jakobsson Link: http://patchwork.freedesktop.org/patch/msgid/20170418114332.12183-1-patrik.r.jakobsson@gmail.com drivers/gpu/drm/gma500/psb_intel_lvds.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) commit 4d071c3238987325b9e50e33051a40d1cce311cc Author: Imre Deak Date: Tue May 23 14:18:17 2017 -0500 PCI/PM: Add needs_resume flag to avoid suspend complete optimization Some drivers - like i915 - may not support the system suspend direct complete optimization due to differences in their runtime and system suspend sequence. Add a flag that when set resumes the device before calling the driver's system suspend handlers which effectively disables the optimization. Needed by a future patch fixing suspend/resume on i915. Suggested by Rafael. Signed-off-by: Imre Deak Signed-off-by: Bjorn Helgaas Acked-by: Rafael J. Wysocki Cc: stable@vger.kernel.org drivers/pci/pci.c | 3 ++- include/linux/pci.h | 5 +++++ 2 files changed, 7 insertions(+), 1 deletion(-) commit 293dffaad8d500e1a5336eeb90d544cf40d4fbd8 Author: Dan Carpenter Date: Tue May 23 17:25:10 2017 +0300 libceph: NULL deref on crush_decode() error path If there is not enough space then ceph_decode_32_safe() does a goto bad. We need to return an error code in that situation. The current code returns ERR_PTR(0) which is NULL. The callers are not expecting that and it results in a NULL dereference. Fixes: f24e9980eb86 ("ceph: OSD client") Signed-off-by: Dan Carpenter Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov net/ceph/osdmap.c | 1 + 1 file changed, 1 insertion(+) commit b51456a6096ebf9f4ceb2cc7e176b471d4b70af0 Author: Ilya Dryomov Date: Fri May 19 14:24:36 2017 +0200 libceph: fix error handling in process_one_ticket() Don't leak key internals after new_session_key is populated. Signed-off-by: Ilya Dryomov Reviewed-by: Alex Elder net/ceph/auth_x.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit d18a1247c4070390fc0c2d83d89a72afe921882e Author: Ilya Dryomov Date: Fri May 19 12:21:56 2017 +0200 libceph: validate blob_struct_v in process_one_ticket() None of these are validated in userspace, but since we do validate reply_struct_v in ceph_x_proc_ticket_reply(), tkt_struct_v (first) and CephXServiceTicket struct_v (second) in process_one_ticket(), validate CephXTicketBlob struct_v as well. Signed-off-by: Ilya Dryomov Reviewed-by: Alex Elder net/ceph/auth_x.c | 3 +++ 1 file changed, 3 insertions(+) commit f3b4e55ded9b3c52831a7d2ab9e511293c99fc11 Author: Ilya Dryomov Date: Fri May 19 11:59:22 2017 +0200 libceph: drop version variable from ceph_monmap_decode() It's set but not used: CEPH_FEATURE_MONNAMES feature bit isn't advertised, which guarantees a v1 MonMap. Signed-off-by: Ilya Dryomov Reviewed-by: Alex Elder net/ceph/mon_client.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 1759f7b0e3fab1d1882d7c680af9d12c5c111b0e Author: Ilya Dryomov Date: Fri May 19 11:38:17 2017 +0200 libceph: make ceph_msg_data_advance() return void Both callers ignore the returned bool. Signed-off-by: Ilya Dryomov Reviewed-by: Alex Elder net/ceph/messenger.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) commit 6f4dbd149d2a151b89d1a5bbf7530ee5546c7908 Author: Ilya Dryomov Date: Fri May 19 11:33:16 2017 +0200 libceph: use kbasename() and kill ceph_file_part() Signed-off-by: Ilya Dryomov Reviewed-by: Alex Elder include/linux/ceph/ceph_debug.h | 6 +++--- net/ceph/ceph_common.c | 13 ------------- 2 files changed, 3 insertions(+), 16 deletions(-) commit 9a307403d374b993061f5992a6e260c944920d0b Author: J. Bruce Fields Date: Tue May 23 12:24:40 2017 -0400 nfsd4: fix null dereference on replay if we receive a compound such that: - the sessionid, slot, and sequence number in the SEQUENCE op match a cached succesful reply with N ops, and - the Nth operation of the compound is a PUTFH, PUTPUBFH, PUTROOTFH, or RESTOREFH, then nfsd4_sequence will return 0 and set cstate->status to nfserr_replay_cache. The current filehandle will not be set. This will cause us to call check_nfsd_access with first argument NULL. To nfsd4_compound it looks like we just succesfully executed an operation that set a filehandle, but the current filehandle is not set. Fix this by moving the nfserr_replay_cache earlier. There was never any reason to have it after the encode_op label, since the only case where he hit that is when opdesc->op_func sets it. Note that there are two ways we could hit this case: - a client is resending a previously sent compound that ended with one of the four PUTFH-like operations, or - a client is sending a *new* compound that (incorrectly) shares sessionid, slot, and sequence number with a previously sent compound, and the length of the previously sent compound happens to match the position of a PUTFH-like operation in the new compound. The second is obviously incorrect client behavior. The first is also very strange--the only purpose of a PUTFH-like operation is to set the current filehandle to be used by the following operation, so there's no point in having it as the last in a compound. So it's likely this requires a buggy or malicious client to reproduce. Reported-by: Scott Mayhew Cc: stable@kernel.vger.org Signed-off-by: J. Bruce Fields fs/nfsd/nfs4proc.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) commit 56fff1bb0f31358bf81a3c64a8dcd6da0dc44263 Merge: fde8e33 e2c8249 Author: Linus Torvalds Date: Tue May 23 09:57:39 2017 -0700 Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "Fix the i2c-designware regression of rc2. Also, a DMA buffer fix for the tiny-usb driver where the USB core now loudly complains about the non DMA-capable buffer" [ I had cherry-picked the designware fix separately because it hit my laptop, but here is the proper sync with the i2c tree - Linus ] * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: designware: Fix bogus sda_hold_time due to uninitialized vars i2c: i2c-tiny-usb: fix buffer not being DMA capable commit 29226b198bb26f8e23985d011a9301cee5550da8 Author: Sudeep Holla Date: Thu May 18 17:09:59 2017 +0100 ARM: 8675/1: MCPM: ensure not to enter __hyp_soft_restart from loopback and cpu_power_down Commit 9da5ac236de6 ("ARM: soft-reboot into same mode that we entered the kernel") added support to enter the new kernel in the same processor mode as the previous one when we soft-reboot from one kernel into another by pass a flag to cpu_reset() so it knows what to do exactly. However it missed to make similar changes in MCPM code. Due to the missing flag, the CPUs enter HYP mode which is not supported with MCPM. MCPM works only in secure mode as it manages CCI. This patch aligns the cpu_reset call in MCPM with other changes in the above mentioned commit by making phys_reset_t to follow the prototype of cpu_reset(). Fixes: 9da5ac236de6 ("ARM: soft-reboot into same mode that we entered the kernel") Acked-by: Nicolas Pitre Signed-off-by: Sudeep Holla Signed-off-by: Russell King arch/arm/common/mcpm_entry.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit efad8396e906d095521791e0408293c101543e50 Author: Bjorn Andersson Date: Mon May 8 21:36:37 2017 -0700 wcn36xx: Close SMD channel on device removal The SMD channel is not the primary WCNSS channel and must explicitly be closed as the device is removed, or the channel will already by open on a subsequent probe call in e.g. the case of reloading the kernel module. This issue was introduced because I simplified the underlying SMD implementation while the SMD adaptions of the driver sat on the mailing list, but missed to update these patches. The patch does however only apply back to the transition to rpmsg, hence the limited Fixes. Fixes: 5052de8deff5 ("soc: qcom: smd: Transition client drivers from smd to rpmsg") Reported-by: Eyal Ilsar Signed-off-by: Bjorn Andersson Signed-off-by: Kalle Valo drivers/net/wireless/ath/wcn36xx/main.c | 2 ++ 1 file changed, 2 insertions(+) commit 223220356d5ebc05ead9a8d697abb0c0a906fc81 Author: Richard Date: Sun May 21 12:27:00 2017 -0700 partitions/msdos: FreeBSD UFS2 file systems are not recognized The code in block/partitions/msdos.c recognizes FreeBSD, OpenBSD and NetBSD partitions and does a reasonable job picking out OpenBSD and NetBSD UFS subpartitions. But for FreeBSD the subpartitions are always "bad". Kernel: Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe block/partitions/msdos.c | 2 ++ 1 file changed, 2 insertions(+) commit 12e8b570e732eaa5eae3a2895ba3fbcf91bde2b4 Author: Jesper Dangaard Brouer Date: Mon May 22 20:13:07 2017 +0200 mlx5: fix bug reading rss_hash_type from CQE Masks for extracting part of the Completion Queue Entry (CQE) field rss_hash_type was swapped, namely CQE_RSS_HTYPE_IP and CQE_RSS_HTYPE_L4. The bug resulted in setting skb->l4_hash, even-though the rss_hash_type indicated that hash was NOT computed over the L4 (UDP or TCP) part of the packet. Added comments from the datasheet, to make it more clear what these masks are selecting. Signed-off-by: Jesper Dangaard Brouer Acked-by: Saeed Mahameed Signed-off-by: David S. Miller include/linux/mlx5/device.h | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) commit 7f65b1f5adc5f8496ca8bec4947de66fefe36220 Author: Oliver Neukum Date: Mon May 22 14:50:30 2017 +0200 cdc-ether: divorce initialisation with a filter reset and a generic method Some devices need their multicast filter reset but others are crashed by that. So the methods need to be separated. Signed-off-by: Oliver Neukum Reported-by: "Ridgway, Keith" Signed-off-by: David S. Miller drivers/net/usb/cdc_ether.c | 31 ++++++++++++++++++++++++------- include/linux/usb/usbnet.h | 1 + 2 files changed, 25 insertions(+), 7 deletions(-) commit 2f9bfd3399920440edec724bee626b87070def4a Merge: fadd2ce a486cd2 Author: David S. Miller Date: Tue May 23 10:51:32 2017 -0400 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2017-05-23 1) Fix wrong header offset for esp4 udpencap packets. 2) Fix a stack access out of bounds when creating a bundle with sub policies. From Sabrina Dubroca. 3) Fix slab-out-of-bounds in pfkey due to an incorrect sadb_x_sec_len calculation. 4) We checked the wrong feature flags when taking down an interface with IPsec offload enabled. Fix from Ilan Tayari. 5) Copy the anti replay sequence numbers when doing a state migration, otherwise we get out of sync with the sequence numbers. Fix from Antony Antony. Please pull or let me know if there are problems. ==================== Signed-off-by: David S. Miller commit 7bd897cfce1eb373892d35d7f73201b0f9b221c4 Author: Dan Carpenter Date: Tue May 23 17:28:36 2017 +0300 block: fix an error code in add_partition() We don't set an error code on this path. It means that we return NULL instead of an error pointer and the caller does a NULL dereference. Fixes: 6d1d8050b4bc ("block, partition: add partition_meta_info to hd_struct") Signed-off-by: Dan Carpenter Signed-off-by: Jens Axboe block/partition-generic.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 1cb0b57fec06a616d98deaeda1924f8e45e1e4de Author: Thomas Petazzoni Date: Thu May 18 14:58:53 2017 +0200 MAINTAINERS: add irqchip related drivers to Marvell EBU maintainers This commit updates the MAINTAINERS file so that the Marvell EBU maintainers are also responsible for their irqchip drivers in drivers/irqchip/. Signed-off-by: Thomas Petazzoni Acked-by: Jason Cooper Signed-off-by: Gregory CLEMENT MAINTAINERS | 2 ++ 1 file changed, 2 insertions(+) commit e7c1572f6565d8b2b2e3be9cffa022a8cd6a6643 Author: Thomas Petazzoni Date: Thu May 18 14:58:52 2017 +0200 MAINTAINERS: sort F entries for Marvell EBU maintainers This commit sorts alphabetically the file entries of the Marvell EBU maintainers in the MAINTAINERS file. Signed-off-by: Thomas Petazzoni Acked-by: Jason Cooper Signed-off-by: Gregory CLEMENT MAINTAINERS | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit b665d98edc9ab295169be2fc5bb4e89a46de0a1a Author: Tariq Toukan Date: Thu May 18 13:34:43 2017 +0300 net/mlx5: Tolerate irq_set_affinity_hint() failures Add tolerance to failures of irq_set_affinity_hint(). Its role is to give hints that optimizes performance, and should not block the driver load. In non-SMP systems, functionality is not available as there is a single core, and all these calls definitely fail. Hence, do not call the function and avoid the warning prints. Fixes: db058a186f98 ("net/mlx5_core: Set irq affinity hints") Signed-off-by: Tariq Toukan Cc: kernel-team@fb.com Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/main.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) commit 73dd3a4839c1d27c36d4dcc92e1ff44225ecbeb7 Author: Mohamad Haj Yahia Date: Thu Feb 23 11:19:36 2017 +0200 net/mlx5: Avoid using pending command interface slots Currently when firmware command gets stuck or it takes long time to complete, the driver command will get timeout and the command slot is freed and can be used for new commands, and if the firmware receive new command on the old busy slot its behavior is unexpected and this could be harmful. To fix this when the driver command gets timeout we return failure, but we don't free the command slot and we wait for the firmware to explicitly respond to that command. Once all the entries are busy we will stop processing new firmware commands. Fixes: 9cba4ebcf374 ('net/mlx5: Fix potential deadlock in command mode change') Signed-off-by: Mohamad Haj Yahia Cc: kernel-team@fb.com Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 41 +++++++++++++++++++++--- drivers/net/ethernet/mellanox/mlx5/core/eq.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/health.c | 2 +- include/linux/mlx5/driver.h | 7 +++- 4 files changed, 44 insertions(+), 8 deletions(-) commit b57fe691961cc8f00541f9a435c70df45d41e514 Author: Erez Shitrit Date: Thu Apr 27 17:59:00 2017 +0300 net/mlx5e: IPoIB, handle RX packet correctly IPoIB packet contains the pseudo header area, we need to pull it prior to reset_mac_header in order to let the GRO work well. In more details: GRO checks the mac address of the new coming packet, it does that by comparing the hard_header_len size of the current packet to the previous one in that session, the comparison is over hard_header_len size. Now, the driver prepares that area in the skb by allocating area from the reserved part and resetting the correct mac header to it. Fixes: 9d6bd752c63c ("net/mlx5e: IPoIB, RX handler") Signed-off-by: Erez Shitrit Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit e3ca4e0583a02a04503d9c827fb5c5d50abc4ff5 Author: Or Gerlitz Date: Tue May 9 13:37:26 2017 +0300 net/mlx5e: Fix warnings around parsing of TC pedit actions The sparse tool emits these correct complaints: drivers/net/ethernet/mellanox/mlx5/core//en_tc.c:1005:25: warning: cast to restricted __be32 drivers/net/ethernet/mellanox/mlx5/core//en_tc.c:1007:25: warning: cast to restricted __be16 The value is provided from user-space in network order, but there's no way for them to realize that, avoid the warnings by casting to the appropriate type. Fixes: d79b6df6b10a ('net/mlx5e: Add parsing of TC pedit actions to HW format') Signed-off-by: Or Gerlitz Reported-by: Leon Romanovsky Reviewed-by: Paul Blakey Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit d824bf3fe2d352fc2c52b7ede05b1a0e95d946be Author: Or Gerlitz Date: Tue May 9 19:02:42 2017 +0300 net/mlx5e: Properly enforce disallowing of partial field re-write offload Currently we don't support partial header re-writes through TC pedit action offloading. However, the code that enforces that wasn't err-ing on cases where the first and last bits of the mask are set but there is some zero bit between them, such as in the below example, fix that! tc filter add dev enp1s0 protocol ip parent ffff: prio 10 flower ip_proto udp dst_port 2001 skip_sw action pedit munge ip src set 1.0.0.1 retain 0xff0000ff Fixes: d79b6df6b10a ('net/mlx5e: Add parsing of TC pedit actions to HW format') Signed-off-by: Or Gerlitz Reviewed-by: Paul Blakey Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 26c02749936f064abf771a0f5f49b280fcfd8b66 Author: Or Gerlitz Date: Wed May 10 13:59:54 2017 +0300 net/mlx5e: Allow TC csum offload if applied together with pedit action When offloading header re-writes, the HW re-calculates the relevant L3/L4 checksums. Hence, when upper layers (as done by OVS) ask for TC checksum action offload together with pedit offload, don't err. This command now works: tc filter add dev ens1f0 protocol ip parent ffff: prio 20 flower skip_sw ip_proto tcp dst_port 9001 action pedit ex munge tcp dport set 0x1234 pipe action csum tcp Signed-off-by: Or Gerlitz Reported-by: Paul Blakey Reviewed-by: Paul Blakey Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 39 +++++++++++++++++++++++++ 1 file changed, 39 insertions(+) commit 3aa4266405a6c2e03eb0ff12d7c573d3d903da4c Author: Or Gerlitz Date: Wed May 10 13:48:41 2017 +0300 net/sched: act_csum: Add accessors for offloading drivers Add the accessors for realizing if this is a csum action, and for which fields checksum is needed. Signed-off-by: Or Gerlitz Reviewed-by: Paul Blakey Signed-off-by: Saeed Mahameed include/net/tc_act/tc_csum.h | 15 +++++++++++++++ 1 file changed, 15 insertions(+) commit cdc5a7f363be34287ac6c2345e5d1d3b37cf4a23 Author: Or Gerlitz Date: Tue May 9 20:45:06 2017 +0300 net/mlx5e: Use the correct delete call on offloaded TC encap entry detach We wrongly direcly invoke hlist_del_rcu() and not hash_del_rcu() which does a slightly different call now and may change later, fix that. Fixes: a54e20b4fcae ('net/mlx5e: Add basic TC tunnel set action for SRIOV offloads') Signed-off-by: Or Gerlitz Reported-by: Paul Blakey Reviewed-by: Paul Blakey Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c70d9d809fdeecedb96972457ee45c49a232d97f Author: Eric W. Biederman Date: Mon May 22 15:40:12 2017 -0500 ptrace: Properly initialize ptracer_cred on fork When I introduced ptracer_cred I failed to consider the weirdness of fork where the task_struct copies the old value by default. This winds up leaving ptracer_cred set even when a process forks and the child process does not wind up being ptraced. Because ptracer_cred is not set on non-ptraced processes whose parents were ptraced this has broken the ability of the enlightenment window manager to start setuid children. Fix this by properly initializing ptracer_cred in ptrace_init_task This must be done with a little bit of care to preserve the current value of ptracer_cred when ptrace carries through fork. Re-reading the ptracer_cred from the ptracing process at this point is inconsistent with how PT_PTRACE_CAP has been maintained all of these years. Tested-by: Takashi Iwai Fixes: 64b875f7ac8a ("ptrace: Capture the ptracer's creds not PT_PTRACE_CAP") Signed-off-by: "Eric W. Biederman" include/linux/ptrace.h | 7 +++++-- kernel/ptrace.c | 20 +++++++++++++------- 2 files changed, 18 insertions(+), 9 deletions(-) commit 1b57b6210f4e52904393be97c62122aae69bc8aa Author: Arend Van Spriel Date: Tue May 23 09:58:07 2017 +0100 cfg80211: make cfg80211_sched_scan_results() work from atomic context Drivers should be able to call cfg80211_sched_scan_results() from atomic context. However, with the introduction of multiple scheduled scan feature this requirement was not taken into account resulting in regression shown below. [ 119.021594] BUG: scheduling while atomic: irq/47-iwlwifi/517/0x00000200 [ 119.021604] Modules linked in: [...] [ 119.021759] CPU: 1 PID: 517 Comm: irq/47-iwlwifi Not tainted 4.12.0-rc2-t440s-20170522+ #1 [ 119.021763] Hardware name: LENOVO 20AQS03H00/20AQS03H00, BIOS GJET91WW (2.41 ) 09/21/2016 [ 119.021766] Call Trace: [ 119.021778] ? dump_stack+0x5c/0x84 [ 119.021784] ? __schedule_bug+0x4c/0x70 [ 119.021792] ? __schedule+0x496/0x5c0 [ 119.021798] ? schedule+0x2d/0x80 [ 119.021804] ? schedule_preempt_disabled+0x5/0x10 [ 119.021810] ? __mutex_lock.isra.0+0x18e/0x4c0 [ 119.021817] ? __wake_up+0x2f/0x50 [ 119.021833] ? cfg80211_sched_scan_results+0x19/0x60 [cfg80211] [ 119.021844] ? cfg80211_sched_scan_results+0x19/0x60 [cfg80211] [ 119.021859] ? iwl_mvm_rx_lmac_scan_iter_complete_notif+0x17/0x30 [iwlmvm] [ 119.021869] ? iwl_pcie_rx_handle+0x2a9/0x7e0 [iwlwifi] [ 119.021878] ? iwl_pcie_irq_handler+0x17c/0x730 [iwlwifi] [ 119.021884] ? irq_forced_thread_fn+0x60/0x60 [ 119.021887] ? irq_thread_fn+0x16/0x40 [ 119.021892] ? irq_thread+0x109/0x180 [ 119.021896] ? wake_threads_waitq+0x30/0x30 [ 119.021901] ? kthread+0xf2/0x130 [ 119.021905] ? irq_thread_dtor+0x90/0x90 [ 119.021910] ? kthread_create_on_node+0x40/0x40 [ 119.021915] ? ret_from_fork+0x26/0x40 Fixes: b34939b98369 ("cfg80211: add request id to cfg80211_sched_scan_*() api") Reported-by: Sander Eikelenboom Signed-off-by: Arend van Spriel Signed-off-by: Johannes Berg net/wireless/scan.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit ea452678734eb782126f999bf5c4fb3e71d3b196 Author: Ulf Hansson Date: Wed May 3 16:11:33 2017 +0200 arm64: dts: hikey: Fix WiFi support The description of the connection between the dwmmc (SDIO) controller and the Wifi chip, which is attached to the SDIO bus is wrong. Currently the SDIO card can't be detected and thus the Wifi doesn't work. Let's fix this by assigning the correct vmmc supply, which is the always on regulator VDD_3V3 and remove the WLAN enable regulator altogether. Then to properly deal with the power on/off sequence, add a mmc-pwrseq node to describe the resources needed to detect the SDIO card. Except for the WLAN enable GPIO and its corresponding assert/de-assert delays, the mmc-pwrseq node also contains a handle to a clock provided by the hi655x pmic. This clock is also needed to be able to turn on the WiFi chip. Signed-off-by: Ulf Hansson Acked-by: Arnd Bergmann arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts | 26 +++++++++++--------------- 1 file changed, 11 insertions(+), 15 deletions(-) commit 76f1dfb687150e852aa74573962cfc158a9570cc Author: Ulf Hansson Date: Wed May 3 14:18:26 2017 +0200 arm64: dts: hi6220: Move board data from the dwmmc nodes to hikey dts Move the board specific descriptions for the dwmmc nodes in the hi6220 SoC dtsi, into the hikey dts as it's there these belongs. While changing this, let's take the opportunity to drop the use of the "ti,non-removable" binding for one of the dwmmc device nodes, as it's not a valid binding and not used. Drop also the unnecessary use of "num-slots = <0x1>" for all of the dwmmc nodes, as there is no need to set this since when default number of slots is one. Signed-off-by: Ulf Hansson Acked-by: Daniel Lezcano Acked-by: Arnd Bergmann arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts | 23 ++++++++++++++++++++++- arch/arm64/boot/dts/hisilicon/hi6220.dtsi | 19 ------------------- 2 files changed, 22 insertions(+), 20 deletions(-) commit 84f7c60b31f10e3a438153bc7408ad536f585641 Author: Ulf Hansson Date: Wed May 3 13:51:27 2017 +0200 arm64: dts: hikey: Add the SYS_5V and the VDD_3V3 regulators Add these regulators to better describe the HW, but also because those is needed in following changes. Signed-off-by: Ulf Hansson Acked-by: Daniel Lezcano Acked-by: Arnd Bergmann arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) commit 1b32a5ff98fbb271d2235ddcfe3b58f514f8260a Author: Ulf Hansson Date: Wed May 3 12:46:55 2017 +0200 arm64: dts: hi6220: Move the fixed_5v_hub regulator to the hikey dts The regulator is a part of the hikey board, therefore let's move it from the hi6220 SoC dtsi file into the hikey dts file . Let's also rename the regulator according to the datasheet (5V_HUB) to better reflect the HW. Signed-off-by: Ulf Hansson Acked-by: Daniel Lezcano Acked-by: Arnd Bergmann arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts | 10 ++++++++++ arch/arm64/boot/dts/hisilicon/hi6220.dtsi | 12 +----------- 2 files changed, 11 insertions(+), 11 deletions(-) commit 307ded8968868e55343e063fbe96cff1efd77eb6 Author: Daniel Lezcano Date: Mon Apr 24 22:40:22 2017 +0200 arm64: dts: hikey: Add clock for the pmic mfd The hi655x PMIC provides the regulators but also a clock. The latter is missing so let's add it. This clock is used by WiFi/Bluetooth chip, but that connection is done in a separate change on top of this one. Signed-off-by: Daniel Lezcano Acked-by: Rob Herring Acked-by: Lee Jones [Ulf: Split patch and updated changelog] Signed-off-by: Ulf Hansson Acked-by: Arnd Bergmann arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts | 1 + 1 file changed, 1 insertion(+) commit f74ac688c981138c914f9afba50b646146e35585 Author: Daniel Lezcano Date: Mon Apr 24 22:40:22 2017 +0200 mfd: dts: hi655x: Add clock binding for the pmic The hi655x PMIC provides the regulators but also a clock. The latter is missing in the definition, so extend the documentation to include this as well. Signed-off-by: Daniel Lezcano Acked-by: Rob Herring Acked-by: Lee Jones [Ulf: Split patch and updated changelog] Signed-off-by: Ulf Hansson Acked-by: Arnd Bergmann Documentation/devicetree/bindings/mfd/hisilicon,hi655x.txt | 6 ++++++ 1 file changed, 6 insertions(+) commit e9256e142f597edf90c68cec22db4c4aebaa27de Author: Ulf Hansson Date: Sat May 6 11:43:05 2017 +0200 mmc: pwrseq_simple: Parse DTS for the power-off-delay-us property If the optional power-off-delay-us property is found, insert the corresponding delay after asserting the GPIO during power off. This enables a graceful shutdown sequence for some devices. Cc: linux-mmc@vger.kernel.org Signed-off-by: Ulf Hansson Acked-by: Arnd Bergmann drivers/mmc/core/pwrseq_simple.c | 7 +++++++ 1 file changed, 7 insertions(+) commit c477ebe21fabe0010a2ed324ce3a1762c757d867 Author: Ulf Hansson Date: Sat May 6 11:41:30 2017 +0200 mmc: dt: pwrseq-simple: Invent power-off-delay-us During power off, after the GPIO pin has been asserted, some devices like the Wifi chip from TI, Wl18xx, needs a delay before the host continues with clock gating and turning off regulators as to follow a graceful shutdown sequence. Therefore invent an optional power-off-delay-us DT binding for mmc-pwrseq-simple, to allow us to support this constraint. Cc: devicetree@vger.kernel.org Cc: Rob Herring Cc: linux-mmc@vger.kernel.org Signed-off-by: Ulf Hansson Acked-by: Arnd Bergmann Documentation/devicetree/bindings/mmc/mmc-pwrseq-simple.txt | 2 ++ 1 file changed, 2 insertions(+) commit 7903d4f5e1dec53963cba9b1bc472a76a3532e07 Author: Chen-Yu Tsai Date: Mon May 22 14:25:49 2017 +0800 pinctrl: sunxi: Fix SPDIF function name for A83T We use well known standard names for functions that have name, such as I2C, SPI, SPDIF, etc.. Fix the function name of SPDIF, which was named OWA (One Wire Audio) based on Allwinner datasheets. Fixes: 4730f33f0d82 ("pinctrl: sunxi: add allwinner A83T PIO controller support") Signed-off-by: Chen-Yu Tsai Acked-by: Maxime Ripard Signed-off-by: Linus Walleij drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit da6c2addf66d7ff7d0b090d6267d4292f951e4e6 Author: Uwe Kleine-König Date: Thu May 18 11:23:55 2017 +0200 pinctrl: mxs: atomically switch mux and drive strength config To set the mux mode of a pin two bits must be set. Up to now this is implemented using the following idiom: writel(mask, reg + CLR); writel(value, reg + SET); . This however results in the mux mode being 0 between the two writes. On my machine there is an IC's reset pin connected to LCD_D20. The bootloader configures this pin as GPIO output-high (i.e. not holding the IC in reset). When Linux reconfigures the pin to GPIO the short time LCD_D20 is muxed as LCD_D20 instead of GPIO_1_20 is enough to confuse the connected IC. The same problem is present for the pin's drive strength setting which is reset to low drive strength before using the right value. So instead of relying on the hardware to modify the register setting using two writes implement the bit toggling using read-modify-write. Fixes: 17723111e64f ("pinctrl: add pinctrl-mxs support") Signed-off-by: Uwe Kleine-König Acked-by: Shawn Guo Signed-off-by: Linus Walleij drivers/pinctrl/freescale/pinctrl-mxs.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) commit 0377f49fb4f83edf40a6ff355eb8df6697491ea1 Author: Alexandre Courbot Date: Fri May 12 10:01:18 2017 -0700 MAINTAINERS: remove self from GPIO maintainers I have not been able to dedicate time to the GPIO subsystem since quite some time, and I don't see the situation improving in the near future. Update the maintainers list to reflect this unfortunate fact. Signed-off-by: Alexandre Courbot Signed-off-by: Linus Walleij MAINTAINERS | 1 - 1 file changed, 1 deletion(-) commit 2a8209fa68236ad65363dba03db5dbced520268a Author: Mika Westerberg Date: Wed May 17 13:25:14 2017 +0300 pinctrl: cherryview: Extend the Chromebook DMI quirk to Intel_Strago systems It turns out there are quite many Chromebooks out there that have the same keyboard issue than Acer Chromebook. All of them are based on Intel_Strago reference and report their DMI_PRODUCT_FAMILY as "Intel_Strago" (Samsung Chromebook 3 and Cyan Chromebooks are exceptions for which we add separate entries). Instead of adding each machine to the quirk table, we use DMI_PRODUCT_FAMILY of "Intel_Strago" that hopefully covers most of the machines out there currently. Link: https://bugzilla.kernel.org/show_bug.cgi?id=194945 Suggested: Dmitry Torokhov Signed-off-by: Mika Westerberg Reviewed-by: Andy Shevchenko Signed-off-by: Linus Walleij drivers/pinctrl/intel/pinctrl-cherryview.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) commit c61872c9833d17d3807fb999096917c1f9eaada0 Author: Mika Westerberg Date: Wed May 17 13:25:12 2017 +0300 firmware: dmi: Add DMI_PRODUCT_FAMILY identification string Sometimes it is more convenient to be able to match a whole family of products, like in case of bunch of Chromebooks based on Intel_Strago to apply a driver quirk instead of quirking each machine one-by-one. This adds support for DMI_PRODUCT_FAMILY identification string and also exports it to the userspace through sysfs attribute just like the existing ones. Suggested-by: Dmitry Torokhov Signed-off-by: Mika Westerberg Reviewed-by: Andy Shevchenko Signed-off-by: Linus Walleij drivers/firmware/dmi-id.c | 2 ++ drivers/firmware/dmi_scan.c | 1 + include/linux/mod_devicetable.h | 1 + 3 files changed, 4 insertions(+) commit 9a752b4c9ab924033bfdb8784c680d50b2bd5684 Author: Hans de Goede Date: Sat May 13 14:39:53 2017 +0200 gpio: crystalcove: Do not write regular gpio registers for virtual GPIOs The Crystal Cove PMIC has 16 real GPIOs but the ACPI code for devices with this PMIC may address up to 95 GPIOs, these extra GPIOs are called virtual GPIOs and are used by the ACPI code as a method of accessing various non GPIO bits of PMIC. Commit dcdc3018d635 ("gpio: crystalcove: support virtual GPIO") added dummy support for these to avoid a bunch of ACPI errors, but instead of ignoring writes / reads to them by doing: if (gpio >= CRYSTALCOVE_GPIO_NUM) return 0; It accidentally introduced the following wrong check: if (gpio > CRYSTALCOVE_VGPIO_NUM) return 0; Which means that attempts by the ACPI code to access these gpios causes some arbitrary gpio to get touched through for example GPIO1P0CTLO + gpionr % 8. Since we do support input/output (but not interrupts) on the 0x5e virtual GPIO, this commit makes to_reg return -ENOTSUPP for unsupported virtual GPIOs so as to not have to check for (gpio >= CRYSTALCOVE_GPIO_NUM && gpio != 0x5e) everywhere and to make it easier to add support for more virtual GPIOs in the future. It then adds a check for to_reg returning an error to all callers where this may happen fixing the ACPI code accessing virtual GPIOs accidentally causing changes to real GPIOs. Fixes: dcdc3018d635 ("gpio: crystalcove: support virtual GPIO") Cc: Aaron Lu Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Signed-off-by: Linus Walleij drivers/gpio/gpio-crystalcove.c | 54 +++++++++++++++++++++++++++-------------- 1 file changed, 36 insertions(+), 18 deletions(-) commit f928543404bdf6bb4e8d6a6c3ced5edebd0d6f38 Author: Daniel Vetter Date: Mon May 22 15:59:45 2017 +0200 drm: Fix deadlock retry loop in page_flip_ioctl I failed to properly onion-wrap the unwind code: We acquire the vblank reference before we start with the wait-wound locking dance, hence we must make sure we retry before we drop the reference. Oops. v2: The vblank_put must be after the frambuffer_put (Michel). I suck at unwrapping code that doesn't use separate labels for each stage, but checks each pointer first ... While re-reading everything I also realized that we must clean up the fb refcounts, and specifically plane->old_fb before we drop the locks, either in the final unlocking, or in the w/w retry path. Hence the correct fix is to drop the vblank_put to the very bottom. Fixes: 29dc0d1de182 ("drm: Roll out acquire context for the page_flip ioctl") Cc: Harry Wentland Cc: Daniel Vetter Cc: Jani Nikula Cc: Sean Paul Cc: David Airlie Cc: dri-devel@lists.freedesktop.org Reported-by: Tommi Rantala Cc: Tommi Rantala Cc: Michel Dänzer Tested-by: Tommi Rantala Reviewed-by: Michel Dänzer Signed-off-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/20170522135945.28831-1-daniel.vetter@ffwll.ch drivers/gpu/drm/drm_plane.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 429030bc944ee9a8bbe5d9bb23dcda0ae2205450 Author: Gabriel Krisman Bertazi Date: Fri May 19 14:58:19 2017 -0300 drm: qxl: Delay entering atomic context during cursor update qxl_release_map will enter an atomic context, but since we still need to alloc memory for BOs, we better delay that until we have everything we need, in case we need to sleep inside the allocation. This avoids the Sleep in atomic state below, which was reported by Mike. [ 43.910362] BUG: sleeping function called from invalid context at mm/slab.h:432 [ 43.910955] in_atomic(): 1, irqs_disabled(): 0, pid: 2077, name: Xorg [ 43.911472] Preemption disabled at: [ 43.911478] [] qxl_bo_kmap_atomic_page+0xa5/0x100 [qxl] [ 43.912103] CPU: 0 PID: 2077 Comm: Xorg Tainted: G E 4.12.0-master #38 [ 43.912550] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.1-0-g4adadbd-20161202_174313-build11a 04/01/2014 [ 43.913202] Call Trace: [ 43.913371] dump_stack+0x65/0x89 [ 43.913581] ? qxl_bo_kmap_atomic_page+0xa5/0x100 [qxl] [ 43.913876] ___might_sleep+0x11a/0x190 [ 43.914095] __might_sleep+0x4a/0x80 [ 43.914319] ? qxl_bo_create+0x50/0x190 [qxl] [ 43.914565] kmem_cache_alloc_trace+0x46/0x180 [ 43.914836] qxl_bo_create+0x50/0x190 [qxl] [ 43.915082] ? refcount_dec_and_test+0x11/0x20 [ 43.915332] ? ttm_mem_io_reserve+0x41/0xe0 [ttm] [ 43.915595] qxl_alloc_bo_reserved+0x37/0xb0 [qxl] [ 43.915884] qxl_cursor_atomic_update+0x8f/0x260 [qxl] [ 43.916172] ? drm_atomic_helper_update_legacy_modeset_state+0x1d6/0x210 [drm_kms_helper] [ 43.916623] drm_atomic_helper_commit_planes+0xec/0x230 [drm_kms_helper] [ 43.916995] drm_atomic_helper_commit_tail+0x2b/0x60 [drm_kms_helper] [ 43.917398] commit_tail+0x65/0x70 [drm_kms_helper] [ 43.917693] drm_atomic_helper_commit+0xa9/0x100 [drm_kms_helper] [ 43.918039] drm_atomic_commit+0x4b/0x50 [drm] [ 43.918334] drm_atomic_helper_update_plane+0xf1/0x110 [drm_kms_helper] [ 43.918902] __setplane_internal+0x19f/0x280 [drm] [ 43.919240] drm_mode_cursor_universal+0x101/0x1c0 [drm] [ 43.919541] drm_mode_cursor_common+0x15b/0x1d0 [drm] [ 43.919858] drm_mode_cursor2_ioctl+0xe/0x10 [drm] [ 43.920157] drm_ioctl+0x211/0x460 [drm] [ 43.920383] ? drm_mode_cursor_ioctl+0x50/0x50 [drm] [ 43.920664] ? handle_mm_fault+0x93/0x160 [ 43.920893] do_vfs_ioctl+0x96/0x6e0 [ 43.921117] ? __fget+0x73/0xa0 [ 43.921322] SyS_ioctl+0x41/0x70 [ 43.921545] entry_SYSCALL_64_fastpath+0x1a/0xa5 [ 43.922188] RIP: 0033:0x7f1145804bc7 [ 43.922526] RSP: 002b:00007ffcd3e50508 EFLAGS: 00003246 ORIG_RAX: 0000000000000010 [ 43.923367] RAX: ffffffffffffffda RBX: 0000000000000040 RCX: 00007f1145804bc7 [ 43.923852] RDX: 00007ffcd3e50540 RSI: 00000000c02464bb RDI: 000000000000000b [ 43.924299] RBP: 0000000000000040 R08: 0000000000000040 R09: 000000000000000c [ 43.924694] R10: 00007ffcd3e50340 R11: 0000000000003246 R12: 0000000000000018 [ 43.925128] R13: 00000000022bc390 R14: 0000000000000040 R15: 00007ffcd3e5062c Reported-by: Mike Galbraith Signed-off-by: Gabriel Krisman Bertazi Link: http://patchwork.freedesktop.org/patch/msgid/20170519175819.15682-1-krisman@collabora.co.uk Signed-off-by: Gerd Hoffmann drivers/gpu/drm/qxl/qxl_display.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 1fc2e41f7af4572b07190f9dec28396b418e9a36 Author: Alexander Tsoy Date: Mon May 22 20:58:11 2017 +0300 ALSA: hda - apply STAC_9200_DELL_M22 quirk for Dell Latitude D430 This model is actually called 92XXM2-8 in Windows driver. But since pin configs for M22 and M28 are identical, just reuse M22 quirk. Fixes external microphone (tested) and probably docking station ports (not tested). Signed-off-by: Alexander Tsoy Cc: Signed-off-by: Takashi Iwai sound/pci/hda/patch_sigmatel.c | 2 ++ 1 file changed, 2 insertions(+) commit 698be5d6ee26127818d6033c32aa7967034496bd Merge: c0e7bb3 5bf1853 Author: Martin Schwidefsky Date: Tue May 23 07:33:57 2017 +0200 Merge tag 'vfio-ccw-20170522' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/vfio-ccw into fixes Pull vfio-ccw fix from Conelia Huck: "vfio-ccw: one patch" * Make some symbols in vfio-ccw static, as detected by sparse. commit 1999f108c983a7287a847b09e29dac25b9301dee Author: Chuanxiao Dong Date: Wed May 17 15:49:01 2017 +0800 drm/i915/gvt: Disable compression workaround for Gen9 With enabling this workaround, can observe GPU hang issue on Gen9. As currently host side doesn't have this workaround, disable it from GVT side. v2: - Fix indent error.(Zhenyu) Cc: Zhenyu Wang Signed-off-by: Chuanxiao Dong Signed-off-by: Zhenyu Wang drivers/gpu/drm/i915/gvt/handlers.c | 30 +++++++++++++++++++++--------- 1 file changed, 21 insertions(+), 9 deletions(-) commit f3ad587070d6bd961ab942b3fd7a85d00dfc934b Author: Gilad Ben-Yossef Date: Thu May 18 16:29:25 2017 +0300 crypto: gcm - wait for crypto op not signal safe crypto_gcm_setkey() was using wait_for_completion_interruptible() to wait for completion of async crypto op but if a signal occurs it may return before DMA ops of HW crypto provider finish, thus corrupting the data buffer that is kfree'ed in this case. Resolve this by using wait_for_completion() instead. Reported-by: Eric Biggers Signed-off-by: Gilad Ben-Yossef CC: stable@vger.kernel.org Signed-off-by: Herbert Xu crypto/gcm.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit a5dfefb1c3f3db81662556393fd9283511e08430 Author: Gilad Ben-Yossef Date: Thu May 18 16:29:24 2017 +0300 crypto: drbg - wait for crypto op not signal safe drbg_kcapi_sym_ctr() was using wait_for_completion_interruptible() to wait for completion of async crypto op but if a signal occurs it may return before DMA ops of HW crypto provider finish, thus corrupting the output buffer. Resolve this by using wait_for_completion() instead. Reported-by: Eric Biggers Signed-off-by: Gilad Ben-Yossef CC: stable@vger.kernel.org Signed-off-by: Herbert Xu crypto/drbg.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit e68368aed56324e2e38d4f6b044bb8cf82077fc2 Author: Gilad Ben-Yossef Date: Thu May 18 16:29:23 2017 +0300 crypto: asymmetric_keys - handle EBUSY due to backlog correctly public_key_verify_signature() was passing the CRYPTO_TFM_REQ_MAY_BACKLOG flag to akcipher_request_set_callback() but was not handling correctly the case where a -EBUSY error could be returned from the call to crypto_akcipher_verify() if backlog was used, possibly casuing data corruption due to use-after-free of buffers. Resolve this by handling -EBUSY correctly. Signed-off-by: Gilad Ben-Yossef CC: stable@vger.kernel.org Signed-off-by: Herbert Xu crypto/asymmetric_keys/public_key.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fde8e33d106846b081b0e6cd5e283af7146eb7e4 Merge: fadd2ce 9933e11 Author: Linus Torvalds Date: Mon May 22 21:30:20 2017 -0700 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: "This fixes a regression in the skcipher interface that allows bogus key parameters to hit underlying implementations which can cause crashes" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: skcipher - Add missing API setkey checks commit fadd2ce5a3680fb265694f573cbfb8bcb7d6c9d5 Merge: 74a9e7d c10e803 Author: Linus Torvalds Date: Mon May 22 19:31:07 2017 -0700 Merge tag 'pstore-v4.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull pstore fix from Kees Cook: "Marta noticed another misbehavior in EFI pstore, which this fixes. Hopefully this is the last of the v4.12 fixes for pstore!" * tag 'pstore-v4.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: efi-pstore: Fix write/erase id tracking commit 74a9e7dbbc4a45ee78560f36903f3c3b1f553928 Merge: 801099b e3170cc Author: Linus Torvalds Date: Mon May 22 19:26:33 2017 -0700 Merge tag 'acpi-4.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "These revert a 4.11 change that turned out to be problematic and add a .gitignore file. Specifics: - Revert a 4.11 commit related to the ACPI-based handling of laptop lids that made changes incompatible with existing user space stacks and broke things there (Lv Zheng). - Add .gitignore to the ACPI tools directory (Prarit Bhargava)" * tag 'acpi-4.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: Revert "ACPI / button: Remove lid_init_state=method mode" tools/power/acpi: Add .gitignore file commit 801099bed082c89fb434671a42c50eccc49f0789 Merge: ad258fb bb47e96 Author: Linus Torvalds Date: Mon May 22 19:24:32 2017 -0700 Merge tag 'pm-4.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix RTC wakeup from suspend-to-idle broken recently, fix CPU idleness detection condition in the schedutil cpufreq governor, fix a cpufreq driver build failure, fix an error code path in the power capping framework, clean up the hibernate core and update the intel_pstate documentation. Specifics: - Fix RTC wakeup from suspend-to-idle broken by the recent rework of ACPI wakeup handling (Rafael Wysocki). - Update intel_pstate driver documentation to reflect the current code and explain how it works in more detail (Rafael Wysocki). - Fix an issue related to CPU idleness detection on systems with shared cpufreq policies in the schedutil governor (Juri Lelli). - Fix a possible build issue in the dbx500 cpufreq driver (Arnd Bergmann). - Fix a function in the power capping framework core to return an error code instead of 0 when there's an error (Dan Carpenter). - Clean up variable definition in the hibernation core (Pushkar Jambhlekar)" * tag 'pm-4.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: dbx500: add a Kconfig symbol PM / hibernate: Declare variables as static PowerCap: Fix an error code in powercap_register_zone() RTC: rtc-cmos: Fix wakeup from suspend-to-idle PM / wakeup: Fix up wakeup_source_report_event() cpufreq: intel_pstate: Document the current behavior and user interface cpufreq: schedutil: use now as reference when aggregating shared policy requests commit ad258fb918dae8b1ec79a85b4c7f518e4f902869 Author: Jan Kiszka Date: Mon May 22 07:46:55 2017 +0200 i2c: designware: Fix bogus sda_hold_time due to uninitialized vars We need to initializes those variables to 0 for platforms that do not provide ACPI parameters. Otherwise, we set sda_hold_time to random values, breaking e.g. Galileo and IOT2000 boards. Reported-and-tested-by: Linus Torvalds Reported-by: Tobias Klausmann Fixes: 9d6408433019 ("i2c: designware: don't infer timings described by ACPI from clock rate") Signed-off-by: Jan Kiszka Reviewed-by: Ard Biesheuvel Acked-by: Jarkko Nikula Signed-off-by: Wolfram Sang Signed-off-by: Linus Torvalds drivers/i2c/busses/i2c-designware-platdrv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cbb22ebcfb9920380ed69854a7095d497798063d Author: Michael Thalmeier Date: Fri May 19 10:32:09 2017 +0200 usb: chipidea: core: check before accessing ci_role in ci_role_show ci_role BUGs when the role is >= CI_ROLE_END. This is the case while the role is changing. Signed-off-by: Michael Thalmeier Signed-off-by: Peter Chen drivers/usb/chipidea/core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 0340ff83cd4475261e7474033a381bc125b45244 Author: Michael Thalmeier Date: Thu May 18 16:14:14 2017 +0200 usb: chipidea: debug: check before accessing ci_role ci_role BUGs when the role is >= CI_ROLE_END. Cc: stable@vger.kernel.org #v3.10+ Signed-off-by: Michael Thalmeier Signed-off-by: Peter Chen drivers/usb/chipidea/debug.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 089b50d95948f691589cca4d81f1f8761747dbaa Author: Maxime Roussin-Bélanger Date: Fri May 19 14:59:03 2017 -0700 Input: atmel_mxt_ts - add T100 as a readable object When using the 'object' sysfs attribute, T100 is not displayed in the output. Signed-off-by: Maxime Roussin-Bélanger Signed-off-by: Dmitry Torokhov drivers/input/touchscreen/atmel_mxt_ts.c | 1 + 1 file changed, 1 insertion(+) commit aa3d4409b664813ceb86a24bd09458cdd29cbb8a Author: Martin Kepplinger Date: Mon May 22 17:19:45 2017 -0700 Input: edt-ft5x06 - increase allowed data range for threshold parameter The datasheet and application note does not mention an allowed range for the M09_REGISTER_THRESHOLD parameter. One of our customers needs to set lower values than 20 and they seem to work just fine on EDT EP0xx0M09 with T5x06 touch. So, lacking a known lower limit, we increase the range for thresholds, and set the lower limit to 0. The documentation is updated accordingly. Signed-off-by: Schoefegger Stefan Signed-off-by: Manfred Schlaegl Signed-off-by: Martin Kepplinger Acked-by: Rob Herring Signed-off-by: Dmitry Torokhov Documentation/devicetree/bindings/input/touchscreen/edt-ft5x06.txt | 2 +- Documentation/input/devices/edt-ft5x06.rst | 2 +- drivers/input/touchscreen/edt-ft5x06.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) commit c10e8031d5b34cde06b039ca2e8af87a33d5ba11 Author: Kees Cook Date: Thu May 18 13:07:49 2017 -0700 efi-pstore: Fix write/erase id tracking Prior to the pstore interface refactoring, the "id" generated during a backend pstore_write() was only retained by the internal pstore inode tracking list. Additionally the "part" was ignored, so EFI would encode this in the id. This corrects the misunderstandings and correctly sets "id" during pstore_write(), and uses "part" directly during pstore_erase(). Reported-by: Marta Lofstedt Fixes: 76cc9580e3fb ("pstore: Replace arguments for write() API") Fixes: a61072aae693 ("pstore: Replace arguments for erase() API") Signed-off-by: Kees Cook Tested-by: Marta Lofstedt drivers/firmware/efi/efi-pstore.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) commit 8c1e2162f27b319da913683143c0c6c09b083ebb Author: Junaid Shahid Date: Thu May 18 12:00:51 2017 -0700 dm ioctl: restore __GFP_HIGH in copy_params() Commit d224e9381897 ("drivers/md/dm-ioctl.c: use kvmalloc rather than opencoded variant") left out the __GFP_HIGH flag when converting from __vmalloc to kvmalloc. This can cause the DM ioctl to fail in some low memory situations where it wouldn't have failed earlier. Add __GFP_HIGH back to avoid any potential regression. Fixes: d224e9381897 ("drivers/md/dm-ioctl.c: use kvmalloc rather than opencoded variant") Signed-off-by: Junaid Shahid Signed-off-by: Mikulas Patocka Acked-by: David Rientjes Signed-off-by: Mike Snitzer drivers/md/dm-ioctl.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 415b6185c541dc0a21457ff307cdb61950a6eb9f Author: Lucas Stach Date: Mon May 22 17:06:30 2017 -0500 PCI: imx6: Fix config read timeout handling Commit cc7b0d495589 ("PCI: designware: Update PCI config space remap function") made PCI configuration requests non-posted, which means we now get a synchronous abort when the CFG space read to probe for downstream devices times out. Synchronous aborts need to be handled differently from the async aborts we were getting before, in particular the PC needs to be advanced when resolving the abort. This is mostly a copy of what other PCI drivers do on ARM to handle those aborts. [bhelgaas: changelog, "Fixes"] Fixes: cc7b0d495589 ("PCI: designware: Update PCI config space remap function") Tested-by: Fabio Estevam Tested-by: Peter Senna Tschudin Signed-off-by: Lucas Stach Signed-off-by: Bjorn Helgaas Acked-by: Richard Zhu drivers/pci/dwc/pci-imx6.c | 33 ++++++++++++++++++++++++++++++--- 1 file changed, 30 insertions(+), 3 deletions(-) commit 9871e9bb5cf6ff0b51457ca74c270c5c5230b224 Author: Logan Gunthorpe Date: Mon May 22 16:52:30 2017 -0500 switchtec: Fix minor bug with partition ID register When a switch endpoint is configured without NTB, the mmio_ntb registers will read all zeros. However, in corner case configurations where the partition ID is not zero and NTB is not enabled, the code will have the wrong partition ID and this causes the driver to use the wrong set of drivers. To fix this we simply take the partition ID from the system info region. Reported-by: Dingbao Chen Signed-off-by: Logan Gunthorpe Signed-off-by: Bjorn Helgaas drivers/pci/switch/switchtec.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit e40cf640b8f632091a30ef0b030c83546f07c902 Author: Logan Gunthorpe Date: Mon May 22 16:52:24 2017 -0500 switchtec: Use new cdev_device_add() helper function Convert from "cdev_add() + device_add()" to cdev_device_add(), and from "device_del() + cdev_del()" to cdev_device_del(). [bhelgaas: changelog] Signed-off-by: Logan Gunthorpe Signed-off-by: Bjorn Helgaas drivers/pci/switch/switchtec.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) commit c849e55178f559c4bbed43efb113cb7602aade89 Author: Geert Uytterhoeven Date: Tue May 16 19:21:08 2017 +0200 PCI: endpoint: Make PCI_ENDPOINT depend on HAS_DMA If NO_DMA=y: drivers/built-in.o: In function `__pci_epc_create': (.text+0xef4e): undefined reference to `bad_dma_ops' drivers/built-in.o: In function `pci_epc_add_epf': (.text+0xf676): undefined reference to `bad_dma_ops' drivers/built-in.o: In function `pci_epf_alloc_space': (.text+0xfa32): undefined reference to `bad_dma_ops' drivers/built-in.o: In function `pci_epf_free_space': (.text+0xfac4): undefined reference to `bad_dma_ops' Add a dependency on HAS_DMA to fix this. Signed-off-by: Geert Uytterhoeven Signed-off-by: Bjorn Helgaas drivers/pci/endpoint/Kconfig | 1 + 1 file changed, 1 insertion(+) commit b4f428ef2844e9fa8154f2faaca249aa74e222a7 Author: Shaohua Li Date: Wed May 17 13:07:27 2017 -0700 blk-throttle: force user to configure all settings for io.low Default value of io.low limit is 0. If user doesn't configure the limit, last patch makes cgroup be throttled to very tiny bps/iops, which could stall the system. A cgroup with default settings of io.low limit really means nothing, so we force user to configure all settings, otherwise io.low limit doesn't take effect. With this stragety, default setting of latency/idle isn't important, so just set them to very conservative and safe value. Signed-off-by: Shaohua Li Acked-by: Tejun Heo Signed-off-by: Jens Axboe block/blk-throttle.c | 80 ++++++++++++++++++++++++---------------------------- 1 file changed, 37 insertions(+), 43 deletions(-) commit 9bb67aeb96784527dbc784c7a1b234461299363c Author: Shaohua Li Date: Wed May 17 13:07:26 2017 -0700 blk-throttle: respect 0 bps/iops settings for io.low If a cgroup with low limit 0 for both bps/iops, the cgroup's low limit is ignored and we throttle the cgroup with its max limit. In this way, other cgroups with a low limit will not get protected. To fix this, we don't do the exception any more. cgroup will be throttled to a limit 0 if it uese default setting. To avoid completed stall, we give such cgroup tiny IO resources. Signed-off-by: Shaohua Li Acked-by: Tejun Heo Signed-off-by: Jens Axboe block/blk-throttle.c | 41 +++++++++++++++++++++++++++++------------ 1 file changed, 29 insertions(+), 12 deletions(-) commit 4cff729f62d1bd433178f1ffe09db5718835e925 Author: Shaohua Li Date: Wed May 17 13:07:25 2017 -0700 blk-throttle: output some debug info in trace These info are important to understand what's happening and help debug. Signed-off-by: Shaohua Li Acked-by: Tejun Heo Signed-off-by: Jens Axboe block/blk-throttle.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) commit 5b81fc3cc625e857275573cb4240bbab553f919c Author: Shaohua Li Date: Wed May 17 13:07:24 2017 -0700 blk-throttle: add hierarchy support for latency target and idle time For idle time, children's setting should not be bigger than parent's. For latency target, children's setting should not be smaller than parent's. The leaf nodes will adjust their settings according to the hierarchy and compare their IO with the settings and do upgrade/downgrade. parents nodes don't need to track their IO latency/idle time. Signed-off-by: Shaohua Li Acked-by: Tejun Heo Signed-off-by: Jens Axboe block/blk-throttle.c | 50 ++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 36 insertions(+), 14 deletions(-) commit 4d6501dce079c1eb6bf0b1d8f528a5e81770109e Author: Vegard Nossum Date: Tue May 9 09:39:59 2017 +0200 kthread: Fix use-after-free if kthread fork fails If a kthread forks (e.g. usermodehelper since commit 1da5c46fa965) but fails in copy_process() between calling dup_task_struct() and setting p->set_child_tid, then the value of p->set_child_tid will be inherited from the parent and get prematurely freed by free_kthread_struct(). kthread() - worker_thread() - process_one_work() | - call_usermodehelper_exec_work() | - kernel_thread() | - _do_fork() | - copy_process() | - dup_task_struct() | - arch_dup_task_struct() | - tsk->set_child_tid = current->set_child_tid // implied | - ... | - goto bad_fork_* | - ... | - free_task(tsk) | - free_kthread_struct(tsk) | - kfree(tsk->set_child_tid) - ... - schedule() - __schedule() - wq_worker_sleeping() - kthread_data(task)->flags // UAF The problem started showing up with commit 1da5c46fa965 since it reused ->set_child_tid for the kthread worker data. A better long-term solution might be to get rid of the ->set_child_tid abuse. The comment in set_kthread_struct() also looks slightly wrong. Debugged-by: Jamie Iles Fixes: 1da5c46fa965 ("kthread: Make struct kthread kmalloc'ed") Signed-off-by: Vegard Nossum Acked-by: Oleg Nesterov Cc: Peter Zijlstra Cc: Greg Kroah-Hartman Cc: Andy Lutomirski Cc: Frederic Weisbecker Cc: Jamie Iles Cc: stable@vger.kernel.org Link: http://lkml.kernel.org/r/20170509073959.17858-1-vegard.nossum@oracle.com Signed-off-by: Thomas Gleixner kernel/fork.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) commit 04dc1b2fff4e96cb4142227fbdc63c8871ad4ed9 Author: Peter Zijlstra Date: Fri May 19 17:48:50 2017 +0200 futex,rt_mutex: Fix rt_mutex_cleanup_proxy_lock() Markus reported that the glibc/nptl/tst-robustpi8 test was failing after commit: cfafcd117da0 ("futex: Rework futex_lock_pi() to use rt_mutex_*_proxy_lock()") The following trace shows the problem: ld-linux-x86-64-2161 [019] .... 410.760971: SyS_futex: 00007ffbeb76b028: 80000875 op=FUTEX_LOCK_PI ld-linux-x86-64-2161 [019] ...1 410.760972: lock_pi_update_atomic: 00007ffbeb76b028: curval=80000875 uval=80000875 newval=80000875 ret=0 ld-linux-x86-64-2165 [011] .... 410.760978: SyS_futex: 00007ffbeb76b028: 80000875 op=FUTEX_UNLOCK_PI ld-linux-x86-64-2165 [011] d..1 410.760979: do_futex: 00007ffbeb76b028: curval=80000875 uval=80000875 newval=80000871 ret=0 ld-linux-x86-64-2165 [011] .... 410.760980: SyS_futex: 00007ffbeb76b028: 80000871 ret=0000 ld-linux-x86-64-2161 [019] .... 410.760980: SyS_futex: 00007ffbeb76b028: 80000871 ret=ETIMEDOUT Task 2165 does an UNLOCK_PI, assigning the lock to the waiter task 2161 which then returns with -ETIMEDOUT. That wrecks the lock state, because now the owner isn't aware it acquired the lock and removes the pending robust list entry. If 2161 is killed, the robust list will not clear out this futex and the subsequent acquire on this futex will then (correctly) result in -ESRCH which is unexpected by glibc, triggers an internal assertion and dies. Task 2161 Task 2165 rt_mutex_wait_proxy_lock() timeout(); /* T2161 is still queued in the waiter list */ return -ETIMEDOUT; futex_unlock_pi() spin_lock(hb->lock); rtmutex_unlock() remove_rtmutex_waiter(T2161); mark_lock_available(); /* Make the next waiter owner of the user space side */ futex_uval = 2161; spin_unlock(hb->lock); spin_lock(hb->lock); rt_mutex_cleanup_proxy_lock() if (rtmutex_owner() !== current) ... return FAIL; .... return -ETIMEOUT; This means that rt_mutex_cleanup_proxy_lock() needs to call try_to_take_rt_mutex() so it can take over the rtmutex correctly which was assigned by the waker. If the rtmutex is owned by some other task then this call is harmless and just confirmes that the waiter is not able to acquire it. While there, fix what looks like a merge error which resulted in rt_mutex_cleanup_proxy_lock() having two calls to fixup_rt_mutex_waiters() and rt_mutex_wait_proxy_lock() not having any. Both should have one, since both potentially touch the waiter list. Fixes: 38d589f2fd08 ("futex,rt_mutex: Restructure rt_mutex_finish_proxy_lock()") Reported-by: Markus Trippelsdorf Bug-Spotted-by: Thomas Gleixner Signed-off-by: Peter Zijlstra (Intel) Cc: Florian Weimer Cc: Darren Hart Cc: Sebastian Andrzej Siewior Cc: Markus Trippelsdorf Link: http://lkml.kernel.org/r/20170519154850.mlomgdsd26drq5j6@hirez.programming.kicks-ass.net Signed-off-by: Thomas Gleixner kernel/locking/rtmutex.c | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) commit 5a4733df7ef255446a213ee84efa5713a9765688 Merge: 0833289 82237f2 Author: Greg Kroah-Hartman Date: Mon May 22 21:53:09 2017 +0200 Merge tag 'iio-fixes-for-4.12a' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus Jonathan writes: First set of IIO fixes in the 4.12 cycle. Matt finally set up the lightning storm he needed to test the as3935. * core - Fix a null pointer deference in iio_trigger_write_current when changing from a non existent trigger to another non existent trigger. * a3935 - Recalibrate the RCO after resume. - Fix interrupt mask so that we actually get some interrupts. - Use iio_trigger_poll_chained as we aren't in interrupt context. * am335x - Fix wrong allocation size provided for private data to iio_device_alloc. * bcm_iproc - Swapped primary and secondary isr handlers. * ltr501 - Fix swapped als/ps register fields when enabling interrupts * max9611 - Wrong scale factor for the shunt_resistor attribute. * sun4-gpadc - Module autoloading fixes by adding the device table declarations. - Fix parent device being used in devm functions. commit 86ca984cef98a499a7c7572376502b745a9ca369 Merge: 0833289 2d76b2f Author: Linus Torvalds Date: Mon May 22 12:42:02 2017 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: "Mostly netfilter bug fixes in here, but we have some bits elsewhere as well. 1) Don't do SNAT replies for non-NATed connections in IPVS, from Julian Anastasov. 2) Don't delete conntrack helpers while they are still in use, from Liping Zhang. 3) Fix zero padding in xtables's xt_data_to_user(), from Willem de Bruijn. 4) Add proper RCU protection to nf_tables_dump_set() because we cannot guarantee that we hold the NFNL_SUBSYS_NFTABLES lock. From Liping Zhang. 5) Initialize rcv_mss in tcp_disconnect(), from Wei Wang. 6) smsc95xx devices can't handle IPV6 checksums fully, so don't advertise support for offloading them. From Nisar Sayed. 7) Fix out-of-bounds access in __ip6_append_data(), from Eric Dumazet. 8) Make atl2_probe() propagate the error code properly on failures, from Alexey Khoroshilov. 9) arp_target[] in bond_check_params() is used uninitialized. This got changes from a global static to a local variable, which is how this mistake happened. Fix from Jarod Wilson. 10) Fix fallout from unnecessary NULL check removal in cls_matchall, from Jiri Pirko. This is definitely brown paper bag territory..." * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (26 commits) net: sched: cls_matchall: fix null pointer dereference vsock: use new wait API for vsock_stream_sendmsg() bonding: fix randomly populated arp target array net: Make IP alignment calulations clearer. bonding: fix accounting of active ports in 3ad net: atheros: atl2: don't return zero on failure path in atl2_probe() ipv6: fix out of bound writes in __ip6_append_data() bridge: start hello_timer when enabling KERNEL_STP in br_stp_start smsc95xx: Support only IPv4 TCP/UDP csum offload arp: always override existing neigh entries with gratuitous ARP arp: postpone addr_type calculation to as late as possible arp: decompose is_garp logic into a separate function arp: fixed error in a comment tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0 netfilter: xtables: fix build failure from COMPAT_XT_ALIGN outside CONFIG_COMPAT ebtables: arpreply: Add the standard target sanity check netfilter: nf_tables: revisit chain/object refcounting from elements netfilter: nf_tables: missing sanitization in data from userspace netfilter: nf_tables: can't assume lock is acquired when dumping set elems netfilter: synproxy: fix conntrackd interaction ... commit aace34c0bb8ea3c8bdcec865b6a4be4db0a68e33 Author: Tin Huynh Date: Mon May 22 16:19:20 2017 +0700 leds: pca955x: Correct I2C Functionality The driver checks an incorrect flag of functionality of adapter. When a driver requires i2c_smbus_read_byte_data and i2c_smbus_write_byte_data, it should check I2C_FUNC_SMBUS_BYTE_DATA instead I2C_FUNC_I2C. This patch fixes the problem. Signed-off-by: Tin Huynh Signed-off-by: Jacek Anaszewski drivers/leds/leds-pca955x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2cb657bc0242dfdca20869685bf179774ef1a6fb Author: James Smart Date: Mon May 15 17:10:22 2017 -0700 nvme_fc: remove extra controller reference taken on reconnect fix extra controller reference taken on reconnect by moving reference to initial controller create Signed-off-by: James Smart Reviewed-by: Hannes Reinecke Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig drivers/nvme/host/fc.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit e392e1f1f408fe8baf1046c970d05cbf1f0ec945 Author: James Smart Date: Mon May 15 17:10:24 2017 -0700 nvme_fc: correct nvme status set on abort correct nvme status set on abort. Patch that changed status to being actual nvme status crossed in the night with the patch that added abort values. Signed-off-by: James Smart Reviewed-by: Hannes Reinecke Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig drivers/nvme/host/fc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 589ff7753bb54edd3ee4a9399ccc3ac48d9b22d7 Author: James Smart Date: Mon May 15 17:10:19 2017 -0700 nvme_fc: set logging level on resets/deletes Per the review by Sagi on: http://lists.infradead.org/pipermail/linux-nvme/2017-April/009261.html Looked at existing warn vs info vs err dev_xxx levels for the messages printed on reconnects and deletes: - Resets due to error and resets transitioned to deletes are dev_warn - Other reset/disconnect messages are dev_info - Removed chatty io queue related messages Signed-off-by: James Smart Reviewed-by: Hannes Reinecke Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig drivers/nvme/host/fc.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) commit a5321aa5efea05ae748dc5b3e8053584213325ca Author: James Smart Date: Mon May 15 17:10:18 2017 -0700 nvme_fc: revise comment on teardown Per the recommendation by Sagi on: http://lists.infradead.org/pipermail/linux-nvme/2017-April/009261.html An extra reference was pointed out. There's no issue with the references, but rather a literal interpretation of what the comment is saying. Reword the comment to avoid confusion. Signed-off-by: James Smart Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Signed-off-by: Christoph Hellwig drivers/nvme/host/fc.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 5bbecdbc8e7ffaaf47ac1f02014bf3bedda3fd11 Author: James Smart Date: Mon May 15 17:10:16 2017 -0700 nvme_fc: Support ctrl_loss_tmo Sync with Sagi's recent addition of ctrl_loss_tmo in the core fabrics layer. Remove local connect limits and connect_attempts variable. Use fabrics new nr_connects variable and use of nvmf_should_reconnect() Refactor duplicate reconnect failure code. Addresses review comment by Sagi on controller reset support: http://lists.infradead.org/pipermail/linux-nvme/2017-April/009261.html Signed-off-by: James Smart Reviewed-by: Hannes Reinecke Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig drivers/nvme/host/fc.c | 116 +++++++++++++++++++++---------------------------- 1 file changed, 49 insertions(+), 67 deletions(-) commit 0ce872bf8b5c4d425a41940a523ff1b8daa0b275 Author: James Smart Date: Mon May 15 17:10:15 2017 -0700 nvme_fc: get rid of local reconnect_delay Remove the local copy of reconnect_delay. Use the value in the controller options directly. Signed-off-by: James Smart Reviewed-by: Hannes Reinecke Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig drivers/nvme/host/fc.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) commit 2d76b2f8b54abd16225cd80afca36ed43f113c41 Author: Jiri Pirko Date: Mon May 22 16:46:13 2017 +0200 net: sched: cls_matchall: fix null pointer dereference Since the head is guaranteed by the check above to be null, the call_rcu would explode. Remove the previously logically dead code that was made logically very much alive and kicking. Fixes: 985538eee06f ("net/sched: remove redundant null check on head") Signed-off-by: Jiri Pirko Signed-off-by: David S. Miller net/sched/cls_matchall.c | 1 - 1 file changed, 1 deletion(-) commit 7254a50a5db40ca6739ddf37e0a45e6912532b2c Author: Ming Lei Date: Mon May 22 23:05:05 2017 +0800 blk-mq: remove blk_mq_abort_requeue_list() No one uses it any more, so remove it. Reviewed-by: Keith Busch Reviewed-by: Johannes Thumshirn Signed-off-by: Ming Lei Signed-off-by: Christoph Hellwig block/blk-mq.c | 19 ------------------- include/linux/blk-mq.h | 1 - 2 files changed, 20 deletions(-) commit 986f75c876dbafed98eba7cb516c5118f155db23 Author: Ming Lei Date: Mon May 22 23:05:04 2017 +0800 nvme: avoid to use blk_mq_abort_requeue_list() NVMe may add request into requeue list simply and not kick off the requeue if hw queues are stopped. Then blk_mq_abort_requeue_list() is called in both nvme_kill_queues() and nvme_ns_remove() for dealing with this issue. Unfortunately blk_mq_abort_requeue_list() is absolutely a race maker, for example, one request may be requeued during the aborting. So this patch just calls blk_mq_kick_requeue_list() in nvme_kill_queues() to handle this issue like what nvme_start_queues() does. Now all requests in requeue list when queues are stopped will be handled by blk_mq_kick_requeue_list() when queues are restarted, either in nvme_start_queues() or in nvme_kill_queues(). Cc: stable@vger.kernel.org Reported-by: Zhang Yi Reviewed-by: Keith Busch Reviewed-by: Johannes Thumshirn Signed-off-by: Ming Lei Signed-off-by: Christoph Hellwig drivers/nvme/host/core.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 806f026f9b901eaf1a6baeb48b5da18d6a4f818e Author: Ming Lei Date: Mon May 22 23:05:03 2017 +0800 nvme: use blk_mq_start_hw_queues() in nvme_kill_queues() Inside nvme_kill_queues(), we have to start hw queues for draining requests in sw queues, .dispatch list and requeue list, so use blk_mq_start_hw_queues() instead of blk_mq_start_stopped_hw_queues() which only run queues if queues are stopped, but the queues may have been started already, for example nvme_start_queues() is called in reset work function. blk_mq_start_hw_queues() run hw queues in current context, instead of running asynchronously like before. Given nvme_kill_queues() is run from either remove context or reset worker context, both are fine to run hw queue directly. And the mutex of namespaces_mutex isn't a problem too becasue nvme_start_freeze() runs hw queue in this way already. Cc: stable@vger.kernel.org Reported-by: Zhang Yi Reviewed-by: Keith Busch Reviewed-by: Johannes Thumshirn Signed-off-by: Ming Lei Signed-off-by: Christoph Hellwig drivers/nvme/host/core.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 0544f5494a03b8846db74e02be5685d1f32b06c9 Author: Marta Rybczynska Date: Mon Apr 10 17:12:34 2017 +0200 nvme-rdma: support devices with queue size < 32 In the case of small NVMe-oF queue size (<32) we may enter a deadlock caused by the fact that the IB completions aren't sent waiting for 32 and the send queue will fill up. The error is seen as (using mlx5): [ 2048.693355] mlx5_0:mlx5_ib_post_send:3765:(pid 7273): [ 2048.693360] nvme nvme1: nvme_rdma_post_send failed with error code -12 This patch changes the way the signaling is done so that it depends on the queue depth now. The magic define has been removed completely. Cc: stable@vger.kernel.org Signed-off-by: Marta Rybczynska Signed-off-by: Samuel Jones Acked-by: Sagi Grimberg Signed-off-by: Christoph Hellwig drivers/nvme/host/rdma.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) commit 499fde662f1957e3cb8d192a94a099ebe19c714b Author: WANG Cong Date: Fri May 19 11:21:59 2017 -0700 vsock: use new wait API for vsock_stream_sendmsg() As reported by Michal, vsock_stream_sendmsg() could still sleep at vsock_stream_has_space() after prepare_to_wait(): vsock_stream_has_space vmci_transport_stream_has_space vmci_qpair_produce_free_space qp_lock qp_acquire_queue_mutex mutex_lock Just switch to the new wait API like we did for commit d9dc8b0f8b4e ("net: fix sleeping for sk_wait_event()"). Reported-by: Michal Kubecek Cc: Stefan Hajnoczi Cc: Jorgen Hansen Cc: "Michael S. Tsirkin" Cc: Claudio Imbrenda Signed-off-by: Cong Wang Reviewed-by: Stefan Hajnoczi Signed-off-by: David S. Miller net/vmw_vsock/af_vsock.c | 21 ++++++++------------- 1 file changed, 8 insertions(+), 13 deletions(-) commit 72ccc471e13b8266d2ee2104521df5b92ba08e9c Author: Jarod Wilson Date: Fri May 19 14:46:46 2017 -0400 bonding: fix randomly populated arp target array In commit dc9c4d0fe023, the arp_target array moved from a static global to a local variable. By the nature of static globals, the array used to be initialized to all 0. At present, it's full of random data, which that gets interpreted as arp_target values, when none have actually been specified. Systems end up booting with spew along these lines: [ 32.161783] IPv6: ADDRCONF(NETDEV_UP): lacp0: link is not ready [ 32.168475] IPv6: ADDRCONF(NETDEV_UP): lacp0: link is not ready [ 32.175089] 8021q: adding VLAN 0 to HW filter on device lacp0 [ 32.193091] IPv6: ADDRCONF(NETDEV_UP): lacp0: link is not ready [ 32.204892] lacp0: Setting MII monitoring interval to 100 [ 32.211071] lacp0: Removing ARP target 216.124.228.17 [ 32.216824] lacp0: Removing ARP target 218.160.255.255 [ 32.222646] lacp0: Removing ARP target 185.170.136.184 [ 32.228496] lacp0: invalid ARP target 255.255.255.255 specified for removal [ 32.236294] lacp0: option arp_ip_target: invalid value (-255.255.255.255) [ 32.243987] lacp0: Removing ARP target 56.125.228.17 [ 32.249625] lacp0: Removing ARP target 218.160.255.255 [ 32.255432] lacp0: Removing ARP target 15.157.233.184 [ 32.261165] lacp0: invalid ARP target 255.255.255.255 specified for removal [ 32.268939] lacp0: option arp_ip_target: invalid value (-255.255.255.255) [ 32.276632] lacp0: Removing ARP target 16.0.0.0 [ 32.281755] lacp0: Removing ARP target 218.160.255.255 [ 32.287567] lacp0: Removing ARP target 72.125.228.17 [ 32.293165] lacp0: Removing ARP target 218.160.255.255 [ 32.298970] lacp0: Removing ARP target 8.125.228.17 [ 32.304458] lacp0: Removing ARP target 218.160.255.255 None of these were actually specified as ARP targets, and the driver does seem to clean up the mess okay, but it's rather noisy and confusing, leaks values to userspace, and the 255.255.255.255 spew shows up even when debug prints are disabled. The fix: just zero out arp_target at init time. While we're in here, init arp_all_targets_value in the right place. Fixes: dc9c4d0fe023 ("bonding: reduce scope of some global variables") CC: Mahesh Bandewar CC: Jay Vosburgh CC: Veaceslav Falico CC: Andy Gospodarek CC: netdev@vger.kernel.org CC: stable@vger.kernel.org Signed-off-by: Jarod Wilson Acked-by: Andy Gospodarek Signed-off-by: David S. Miller drivers/net/bonding/bond_main.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit bb47e964175e5fb4c163066e4373fac055fe5da0 Merge: 079c181 0bae5fd 216c4e9 Author: Rafael J. Wysocki Date: Mon May 22 20:32:05 2017 +0200 Merge branches 'pm-sleep' and 'powercap' * pm-sleep: PM / hibernate: Declare variables as static RTC: rtc-cmos: Fix wakeup from suspend-to-idle PM / wakeup: Fix up wakeup_source_report_event() * powercap: PowerCap: Fix an error code in powercap_register_zone() commit e3170cc04d7ccf0e644ee3e3263e2df7a7685936 Merge: 0833289 f369fdf bdce57e Author: Rafael J. Wysocki Date: Mon May 22 20:29:06 2017 +0200 Merge branches 'acpi-button' and 'acpi-tools' * acpi-button: Revert "ACPI / button: Remove lid_init_state=method mode" * acpi-tools: tools/power/acpi: Add .gitignore file commit 079c1812a2848539b61351fe4b08902187e19019 Merge: 0833289 33fc30b be0408d d86ab9c Author: Rafael J. Wysocki Date: Mon May 22 20:28:22 2017 +0200 Merge branches 'intel_pstate', 'pm-cpufreq' and 'pm-cpufreq-sched' * intel_pstate: cpufreq: intel_pstate: Document the current behavior and user interface * pm-cpufreq: cpufreq: dbx500: add a Kconfig symbol * pm-cpufreq-sched: cpufreq: schedutil: use now as reference when aggregating shared policy requests commit 702a6204f804bad946c455e7cd8d50d79c9d1629 Author: Mikulas Patocka Date: Sat May 20 14:56:21 2017 -0400 dm integrity: use kvmalloc() instead of dm_integrity_kvmalloc() Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer drivers/md/dm-integrity.c | 27 ++++++--------------------- 1 file changed, 6 insertions(+), 21 deletions(-) commit f52236e0b0a0820e938e16a776309e76b7bd6c43 Author: Gilad Ben-Yossef Date: Thu May 18 13:47:25 2017 +0300 dm verity: fix no salt use case DM-Verity has an (undocumented) mode where no salt is used. This was never handled directly by the DM-Verity code, instead working due to the fact that calling crypto_shash_update() with a zero length data is an implicit noop. This is no longer the case now that we have switched to crypto_ahash_update(). Fix the issue by introducing explicit handling of the no salt use case to DM-Verity. Signed-off-by: Gilad Ben-Yossef Reported-by: Marian Csontos Fixes: d1ac3ff ("dm verity: switch to using asynchronous hash crypto API") Tested-by: Milan Broz Signed-off-by: Mike Snitzer drivers/md/dm-verity-target.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit e4eda884db7930cee434828759064b4711604078 Author: David S. Miller Date: Mon May 22 12:27:07 2017 -0400 net: Make IP alignment calulations clearer. The assignmnet: ip_align = strict ? 2 : NET_IP_ALIGN; in compare_pkt_ptr_alignment() trips up Coverity because we can only get to this code when strict is true, therefore ip_align will always be 2 regardless of NET_IP_ALIGN's value. So just assign directly to '2' and explain the situation in the comment above. Reported-by: "Gustavo A. R. Silva" Signed-off-by: David S. Miller kernel/bpf/verifier.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) commit f5f968f2371ccdebb8a365487649673c9af68d09 Author: Srinath Mannam Date: Thu May 18 22:27:40 2017 +0530 mmc: sdhci-iproc: suppress spurious interrupt with Multiblock read The stingray SDHCI hardware supports ACMD12 and automatically issues after multi block transfer completed. If ACMD12 in SDHCI is disabled, spurious tx done interrupts are seen on multi block read command with below error message: Got data interrupt 0x00000002 even though no data operation was in progress. This patch uses SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12 to enable ACM12 support in SDHCI hardware and suppress spurious interrupt. Signed-off-by: Srinath Mannam Reviewed-by: Ray Jui Reviewed-by: Scott Branden Acked-by: Adrian Hunter Fixes: b580c52d58d9 ("mmc: sdhci-iproc: add IPROC SDHCI driver") Cc: Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-iproc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 751da2a69b7cc82d83dc310ed7606225f2d6e014 Author: Jarod Wilson Date: Fri May 19 19:43:45 2017 -0400 bonding: fix accounting of active ports in 3ad As of 7bb11dc9f59d and 0622cab0341c, bond slaves in a 3ad bond are not removed from the aggregator when they are down, and the active slave count is NOT equal to number of ports in the aggregator, but rather the number of ports in the aggregator that are still enabled. The sysfs spew for bonding_show_ad_num_ports() has a comment that says "Show number of active 802.3ad ports.", but it's currently showing total number of ports, both active and inactive. Remedy it by using the same logic introduced in 0622cab0341c in __bond_3ad_get_active_agg_info(), so sysfs, procfs and netlink all report the number of active ports. Note that this means that IFLA_BOND_AD_INFO_NUM_PORTS really means NUM_ACTIVE_PORTS instead of NUM_PORTS, and thus perhaps should be renamed for clarity. Lightly tested on a dual i40e lacp bond, simulating link downs with an ip link set dev down, was able to produce the state where I could see both in the same aggregator, but a number of ports count of 1. MII Status: up Active Aggregator Info: Aggregator ID: 1 Number of ports: 2 <--- Slave Interface: ens10 MII Status: up <--- Aggregator ID: 1 Slave Interface: ens11 MII Status: up Aggregator ID: 1 MII Status: up Active Aggregator Info: Aggregator ID: 1 Number of ports: 1 <--- Slave Interface: ens10 MII Status: down <--- Aggregator ID: 1 Slave Interface: ens11 MII Status: up Aggregator ID: 1 CC: Jay Vosburgh CC: Veaceslav Falico CC: Andy Gospodarek CC: netdev@vger.kernel.org Signed-off-by: Jarod Wilson Signed-off-by: David S. Miller drivers/net/bonding/bond_3ad.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bd703a1524e851b8d6d646be9dafd794d4eb6045 Author: Alexey Khoroshilov Date: Sat May 20 01:52:11 2017 +0300 net: atheros: atl2: don't return zero on failure path in atl2_probe() If dma mask checks fail in atl2_probe(), it breaks off initialization, deallocates all resources, but returns zero. The patch adds proper error code return value and make error code setup unified. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov Signed-off-by: David S. Miller drivers/net/ethernet/atheros/atlx/atl2.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 8fb83b142823cdd1f85f78dcf9e861e9033919f9 Author: Jan Glauber Date: Mon May 22 13:09:21 2017 +0200 mmc: cavium: Fix probing race with regulator If the regulator probing is not yet finished this driver might catch a -EPROBE_DEFER. Returning after this condition did not remove the created platform device. On a repeated call to the probe function the of_platform_device_create fails. Calling of_platform_device_destroy after EPROBE_DEFER resolves this bug. Signed-off-by: Jan Glauber Signed-off-by: Ulf Hansson drivers/mmc/host/cavium-octeon.c | 11 ++++++++++- drivers/mmc/host/cavium-thunderx.c | 6 ++++++ 2 files changed, 16 insertions(+), 1 deletion(-) commit c2372c20425bd75a5527b3e2204059762190f6ca Author: Jan Glauber Date: Mon May 22 13:09:20 2017 +0200 of/platform: Make of_platform_device_destroy globally visible of_platform_device_destroy is the counterpart to of_platform_device_create which is a non-static function. After creating a platform device it might be neccessary to destroy it to deal with -EPROBE_DEFER where a repeated of_platform_device_create call would fail otherwise. Therefore also make of_platform_device_destroy globally visible. Signed-off-by: Jan Glauber Acked-by: Rob Herring Signed-off-by: Ulf Hansson drivers/of/platform.c | 3 ++- include/linux/of_platform.h | 1 + 2 files changed, 3 insertions(+), 1 deletion(-) commit 9e7b9a25e170722f15ed54f5b963e9867f79195d Author: Jan Glauber Date: Mon May 22 13:09:19 2017 +0200 mmc: cavium: Prevent crash with incomplete DT In case the DT specifies neither a regulator nor a gpio for the shared power the driver will crash accessing the regulator. Prevent the crash by checking the regulator before use. Use mmc_regulator_get_supply() instead of open coding the same logic. Signed-off-by: Jan Glauber Signed-off-by: Ulf Hansson drivers/mmc/host/cavium.c | 25 ++++++++++--------------- 1 file changed, 10 insertions(+), 15 deletions(-) commit 232cd35d0804cc241eb887bb8d4d9b3b9881c64a Author: Eric Dumazet Date: Fri May 19 14:17:48 2017 -0700 ipv6: fix out of bound writes in __ip6_append_data() Andrey Konovalov and idaifish@gmail.com reported crashes caused by one skb shared_info being overwritten from __ip6_append_data() Andrey program lead to following state : copy -4200 datalen 2000 fraglen 2040 maxfraglen 2040 alloclen 2048 transhdrlen 0 offset 0 fraggap 6200 The skb_copy_and_csum_bits(skb_prev, maxfraglen, data + transhdrlen, fraggap, 0); is overwriting skb->head and skb_shared_info Since we apparently detect this rare condition too late, move the code earlier to even avoid allocating skb and risking crashes. Once again, many thanks to Andrey and syzkaller team. Signed-off-by: Eric Dumazet Reported-by: Andrey Konovalov Tested-by: Andrey Konovalov Reported-by: Signed-off-by: David S. Miller net/ipv6/ip6_output.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) commit 664b7c4728821767e0228ee161bab87db2be58f1 Author: Tony Lindgren Date: Fri May 12 08:47:57 2017 -0700 pinctrl: core: Fix warning by removing bogus code Andre Przywara noticed that we can get the following warning with -EPROBE_DEFER: "WARNING: CPU: 1 PID: 89 at drivers/base/dd.c:349 driver_probe_device+0x2ac/0x2e8" Let's fix the issue by removing the indices as suggested by Tejun Heo . All we have to do here is kill the radix tree. I probably ended up with the indices after grepping for removal of all entries using radix_tree_for_each_slot() and the first match found was gmap_radix_tree_free(). Anyways, no need for indices here, and we can just do remove all the entries using radix_tree_for_each_slot() along how the item_kill_tree() test case does. Fixes: c7059c5ac70a ("pinctrl: core: Add generic pinctrl functions for managing groups") Fixes: a76edc89b100 ("pinctrl: core: Add generic pinctrl functions for managing groups") Reported-by: Andre Przywara Signed-off-by: Tony Lindgren Reviewed-by: Andre Przywara Tested-by: Andre Przywara Signed-off-by: Linus Walleij drivers/pinctrl/core.c | 20 +++----------------- drivers/pinctrl/pinmux.c | 21 ++++----------------- 2 files changed, 7 insertions(+), 34 deletions(-) commit a79e7df97592b2326be81d5dae286bdb5c529a01 Author: Takashi Iwai Date: Mon May 22 16:41:24 2017 +0200 ALSA: hda - Update the list of quirk models I've forgotten to sync the documentation with the actually available options for some time. Now all updated. Signed-off-by: Takashi Iwai Documentation/sound/hd-audio/models.rst | 114 ++++++++++++++++++-------------- 1 file changed, 65 insertions(+), 49 deletions(-) commit ba90d6a6b00a84f2a18112145c113e5ef628e561 Author: Takashi Iwai Date: Mon May 22 16:38:47 2017 +0200 ALSA: hda - Provide dual-codecs model option for a few Realtek codecs Recently some laptops and mobos are equipped with the dual Realtek codecs that require special quirks. For making the debugging easier, add the model "dual-codecs" to be passed via module option. Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 3 +++ 1 file changed, 3 insertions(+) commit 63691587f7b0028326ddd1226c378aaaeca4d4e4 Author: Takashi Iwai Date: Mon May 22 16:32:46 2017 +0200 ALSA: hda - Apply dual-codec quirk for MSI Z270-Gaming mobo MSI Z270-Gamin mobo has also two ALC1220 codecs like Gigabyte AZ370- Gaming mobo. Apply the same quirk to this one. Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) commit 5bf185366bfca4ab7730c607f530188e1591a4c0 Author: Sebastian Ott Date: Mon May 15 17:28:34 2017 +0200 s390/vfio_ccw: make some symbols static Make some symbols static to fix sparse warnings like: drivers/s390/cio/vfio_ccw_ops.c:73:1: warning: symbol 'mdev_type_attr_name' was not declared. Should it be static? Signed-off-by: Sebastian Ott Reviewed-by: Dong Jia Shi Signed-off-by: Cornelia Huck drivers/s390/cio/vfio_ccw_ops.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 76dd1fbebbaebab294dc09230960238746b883b1 Author: Hans de Goede Date: Mon May 15 09:31:41 2017 +0200 HID: asus: Add support for T100 keyboard The keyboard dock used with the Asus Transformer T100 series, uses the same vendor-defined 0xff31 usage-page as some other Asus keyboards. But with a small twist, it has a small descriptor bug which needs to be fixed up for things to work. This commit adds the USB-ID for this keyboard to the hid-asus driver and makes asus_report_fixup fix the descriptor issue, fixing various special function keys on this keyboard not working. Signed-off-by: Hans de Goede Reviewed-by: Benjamin Tissoires Signed-off-by: Jiri Kosina drivers/hid/hid-asus.c | 10 ++++++++++ drivers/hid/hid-core.c | 1 + drivers/hid/hid-ids.h | 1 + 3 files changed, 12 insertions(+) commit 020e0b1c8f19f1fc3bce23beeccd80c574ca0e49 Author: Anatolij Gustschin Date: Thu May 11 20:24:31 2017 +0200 gpiolib: Add stubs for gpiod lookup table interface Add stubs for gpiod_add_lookup_table() and gpiod_remove_lookup_table() for the !GPIOLIB case to prevent build errors. Signed-off-by: Anatolij Gustschin Reviewed-by: Andy Shevchenko Signed-off-by: Linus Walleij include/linux/gpio/machine.h | 7 +++++++ 1 file changed, 7 insertions(+) commit b4d2ea2af95cb77e2f320e24da526280d4aa2f6b Author: Linus Walleij Date: Mon May 8 10:48:21 2017 +0200 Revert "pinctrl: generic: Add bi-directional and output-enable" This reverts commit 8c58f1a7a4b6d1d723bf25fef9d842d5a11200d0. It turns out that applying these generic properties was premature: the properties used in the driver using this are of unclear electrical nature and the subject need to be discussed. Signed-off-by: Linus Walleij Documentation/devicetree/bindings/pinctrl/pinctrl-bindings.txt | 2 -- drivers/pinctrl/pinconf-generic.c | 3 --- include/linux/pinctrl/pinconf-generic.h | 3 --- 3 files changed, 8 deletions(-) commit a9de080bbcd5c4e213a3d7bbb1e314d60980e943 Author: Wei Yongjun Date: Tue Apr 25 06:22:05 2017 +0000 pinctrl: cherryview: Add terminate entry for dmi_system_id tables Make sure dmi_system_id tables are NULL terminated. Fixes: 703650278372 ("pinctrl: cherryview: Add a quirk to make Acer Chromebook keyboard work again") Signed-off-by: Wei Yongjun Acked-by: Mika Westerberg Signed-off-by: Linus Walleij drivers/pinctrl/intel/pinctrl-cherryview.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit df563c85de690ec0a1c7e49bd1d43ff743dfb1ce Author: Joel Stanley Date: Tue May 2 15:38:24 2017 +0930 gpio: aspeed: Don't attempt to debounce if disabled We warn the user at driver probe time that debouncing is disabled. However, if they request debouncing later on we print a confusing error message: gpio_aspeed 1e780000.gpio: Failed to convert 5000us to cycles at 0Hz: -524 Instead bail out when the clock is not present. Fixes: 5ae4cb94b3133 (gpio: aspeed: Add debounce support) Signed-off-by: Joel Stanley Signed-off-by: Linus Walleij drivers/gpio/gpio-aspeed.c | 3 +++ 1 file changed, 3 insertions(+) commit e2c824924cdb41528932c550647406ad81336b18 Author: Jan Kiszka Date: Mon May 22 07:46:55 2017 +0200 i2c: designware: Fix bogus sda_hold_time due to uninitialized vars We need to initializes those variables to 0 for platforms that do not provide ACPI parameters. Otherwise, we set sda_hold_time to random values, breaking e.g. Galileo and IOT2000 boards. Fixes: 9d6408433019 ("i2c: designware: don't infer timings described by ACPI from clock rate") Signed-off-by: Jan Kiszka Reviewed-by: Ard Biesheuvel Acked-by: Jarkko Nikula Signed-off-by: Wolfram Sang drivers/i2c/busses/i2c-designware-platdrv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5165da5923d6c7df6f2927b0113b2e4d9288661e Author: Sebastian Reichel Date: Fri May 5 11:06:50 2017 +0200 i2c: i2c-tiny-usb: fix buffer not being DMA capable Since v4.9 i2c-tiny-usb generates the below call trace and longer works, since it can't communicate with the USB device. The reason is, that since v4.9 the USB stack checks, that the buffer it should transfer is DMA capable. This was a requirement since v2.2 days, but it usually worked nevertheless. [ 17.504959] ------------[ cut here ]------------ [ 17.505488] WARNING: CPU: 0 PID: 93 at drivers/usb/core/hcd.c:1587 usb_hcd_map_urb_for_dma+0x37c/0x570 [ 17.506545] transfer buffer not dma capable [ 17.507022] Modules linked in: [ 17.507370] CPU: 0 PID: 93 Comm: i2cdetect Not tainted 4.11.0-rc8+ #10 [ 17.508103] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 [ 17.509039] Call Trace: [ 17.509320] ? dump_stack+0x5c/0x78 [ 17.509714] ? __warn+0xbe/0xe0 [ 17.510073] ? warn_slowpath_fmt+0x5a/0x80 [ 17.510532] ? nommu_map_sg+0xb0/0xb0 [ 17.510949] ? usb_hcd_map_urb_for_dma+0x37c/0x570 [ 17.511482] ? usb_hcd_submit_urb+0x336/0xab0 [ 17.511976] ? wait_for_completion_timeout+0x12f/0x1a0 [ 17.512549] ? wait_for_completion_timeout+0x65/0x1a0 [ 17.513125] ? usb_start_wait_urb+0x65/0x160 [ 17.513604] ? usb_control_msg+0xdc/0x130 [ 17.514061] ? usb_xfer+0xa4/0x2a0 [ 17.514445] ? __i2c_transfer+0x108/0x3c0 [ 17.514899] ? i2c_transfer+0x57/0xb0 [ 17.515310] ? i2c_smbus_xfer_emulated+0x12f/0x590 [ 17.515851] ? _raw_spin_unlock_irqrestore+0x11/0x20 [ 17.516408] ? i2c_smbus_xfer+0x125/0x330 [ 17.516876] ? i2c_smbus_xfer+0x125/0x330 [ 17.517329] ? i2cdev_ioctl_smbus+0x1c1/0x2b0 [ 17.517824] ? i2cdev_ioctl+0x75/0x1c0 [ 17.518248] ? do_vfs_ioctl+0x9f/0x600 [ 17.518671] ? vfs_write+0x144/0x190 [ 17.519078] ? SyS_ioctl+0x74/0x80 [ 17.519463] ? entry_SYSCALL_64_fastpath+0x1e/0xad [ 17.519959] ---[ end trace d047c04982f5ac50 ]--- Cc: Signed-off-by: Sebastian Reichel Reviewed-by: Greg Kroah-Hartman Acked-by: Till Harbaum Signed-off-by: Wolfram Sang drivers/i2c/busses/i2c-tiny-usb.c | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-) commit d4ed3b9015b5eebc90d629579d9e7944607cbae5 Author: Colin Ian King Date: Thu May 4 13:11:00 2017 +0100 mtd: nand: make nand_ooblayout_lp_hamming_ops static nand_ooblayout_lp_hamming_ops can be made static as it does not need to be in global scope. Signed-off-by: Colin Ian King Acked-by: Boris Brezillon Signed-off-by: Boris Brezillon drivers/mtd/nand/nand_base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 60cf0ce14b09b54e7ee79dc3ef498de6ef0e41e9 Author: Marc Gonzalez Date: Fri May 12 17:34:01 2017 +0200 mtd: nand: tango: Update ecc_stats.corrected According to Boris, some user-space tools expect MTD drivers to update ecc_stats.corrected, and it's better to provide a lower bound than to provide no information at all. Fixes: 6956e2385a16 ("mtd: nand: add tango NAND flash controller support") Cc: stable@vger.kernel.org Reported-by: Pavel Machek Signed-off-by: Marc Gonzalez Signed-off-by: Boris Brezillon drivers/mtd/nand/tango_nand.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) commit 2761b4f12b017f6d3e5add386733a700a490df47 Author: Andres Galacho Date: Mon May 1 16:30:15 2017 -0400 mtd: nand: tango: Export OF device ID table as module aliases The device table is required to load modules based on modaliases. After adding MODULE_DEVICE_TABLE, below entries for example will be added to module.alias: alias: of:N*T*Csigma,smp8758-nandC* alias: of:N*T*Csigma,smp8758-nand Fixes: 6956e2385a16 ("mtd: nand: add tango NAND flash controller support") Cc: stable@vger.kernel.org Signed-off-by: Andres Galacho Acked-by: Brian Norris Signed-off-by: Boris Brezillon drivers/mtd/nand/tango_nand.c | 1 + 1 file changed, 1 insertion(+) commit d24197907454b902908e025bce4b8bc677d3ba6b Author: Brian Norris Date: Mon May 1 17:04:55 2017 -0700 mtd: nand: samsung: warn about un-parseable ECC info We don't handle cases larger than 7. We probably shouldn't pretend we know the ECC step size in this case, and it's probably also good to WARN() like we do in many other similar cases. Fixes: 8fc82d456e40 ("mtd: nand: samsung: Retrieve ECC requirements from extended ID") Signed-off-by: Brian Norris Signed-off-by: Boris Brezillon drivers/mtd/nand/nand_samsung.c | 3 +++ 1 file changed, 3 insertions(+) commit 787710492911e21148975e1d1914c7409fb32c7e Author: Brian Norris Date: Mon May 1 17:04:53 2017 -0700 mtd: nand: free vendor-specific resources in init failure paths If we fail any time after calling nand_detect(), then we don't call the vendor-specific ->cleanup() callback, and we'll leak any resources the vendor-specific code might have allocated. Mark the "fix" against the first commit that started allocating anything in ->init(). Fixes: 626994e07480 ("mtd: nand: hynix: Add read-retry support for 1x nm MLC NANDs") Signed-off-by: Brian Norris Signed-off-by: Boris Brezillon drivers/mtd/nand/nand_base.c | 38 +++++++++++++++++++++++++++++--------- 1 file changed, 29 insertions(+), 9 deletions(-) commit 0545c1720277dd246bd682b23aee425f3830a14f Author: Brian Norris Date: Mon May 1 17:04:52 2017 -0700 mtd: nand: drop unneeded module.h include nand_ids isn't a separate module anymore and doesn't need this header. Signed-off-by: Brian Norris Signed-off-by: Boris Brezillon drivers/mtd/nand/nand_ids.c | 1 - 1 file changed, 1 deletion(-) commit 44d4182e23c555cbfa8b8a0ad2d94664d23850d3 Author: Brian Norris Date: Mon May 1 17:04:50 2017 -0700 mtd: nand: don't leak buffers when ->scan_bbt() fails This bug seems to have been here forever, although we came close to fixing all of them in [1]! [1] 11eaf6df1cce ("mtd: nand: Remove BUG() abuse in nand_scan_tail") Signed-off-by: Brian Norris Acked-by: Ezequiel Garcia Signed-off-by: Boris Brezillon drivers/mtd/nand/nand_base.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 014580ffab654bb83256783a2b185cf6c06dffaa Author: YYS Date: Tue Mar 21 16:27:03 2017 +0800 drm/mediatek: fix mtk_hdmi_setup_vendor_specific_infoframe mistake mtk_hdmi_setup_vendor_specific_infoframe will return before handle mtk_hdmi_hw_send_info_frame.Because hdmi_vendor_infoframe_pack returns the number of bytes packed into the binary buffer or a negative error code on failure. So correct it. Fixes: 8f83f26891e1 ("drm/mediatek: Add HDMI support") Signed-off-by: Nickey Yang Signed-off-by: CK Hu drivers/gpu/drm/mediatek/mtk_hdmi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f752413e26bdc9f73a8a12e280770646555c82fc Author: Dan Carpenter Date: Fri Apr 21 13:51:43 2017 +0300 drm/mediatek: fix a timeout loop This code causes a static checker warning because it treats "i == 0" as a timeout but, because it's a post-op, the loop actually ends with "i" set to -1. Philipp Zabel points out that it would be cleaner to use readl_poll_timeout() instead. Fixes: 21898816831f ("drm/mediatek: add dsi transfer function") Signed-off-by: Dan Carpenter Signed-off-by: CK Hu Reviewed-by: Philipp Zabel drivers/gpu/drm/mediatek/mtk_dsi.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) commit e480eabae232b92ff44ce63678280373713920a4 Author: Lukas Wunner Date: Thu May 18 21:33:44 2017 +0200 drm/radeon: Fix oops upon driver load on PowerXpress laptops Nicolai Stange reports the following oops which is caused by dereferencing rdev->pdev before it's subsequently set by radeon_device_init(). Fix it. BUG: unable to handle kernel NULL pointer dereference at 00000000000007cb IP: radeon_driver_load_kms+0xeb/0x230 [radeon] ... Call Trace: drm_dev_register+0x146/0x1d0 [drm] drm_get_pci_dev+0x9a/0x180 [drm] radeon_pci_probe+0xb8/0xe0 [radeon] local_pci_probe+0x45/0xa0 pci_device_probe+0x14f/0x1a0 driver_probe_device+0x29c/0x450 __driver_attach+0xdf/0xf0 ? driver_probe_device+0x450/0x450 bus_for_each_dev+0x6c/0xc0 driver_attach+0x1e/0x20 bus_add_driver+0x170/0x270 driver_register+0x60/0xe0 ? 0xffffffffc0508000 __pci_register_driver+0x4c/0x50 drm_pci_init+0xeb/0x100 [drm] ? vga_switcheroo_register_handler+0x6a/0x90 ? 0xffffffffc0508000 radeon_init+0x98/0xb6 [radeon] do_one_initcall+0x52/0x1a0 ? __vunmap+0x81/0xb0 ? kmem_cache_alloc_trace+0x159/0x1b0 ? do_init_module+0x27/0x1f8 do_init_module+0x5f/0x1f8 load_module+0x27ce/0x2be0 SYSC_finit_module+0xdf/0x110 ? SYSC_finit_module+0xdf/0x110 SyS_finit_module+0xe/0x10 do_syscall_64+0x67/0x150 entry_SYSCALL64_slow_path+0x25/0x25 Fixes: 7ffb0ce31cf9 ("drm/radeon: Don't register Thunderbolt eGPU with vga_switcheroo") Reported-and-tested-by: Nicolai Stange Signed-off-by: Lukas Wunner Link: http://patchwork.freedesktop.org/patch/msgid/cfb91ba052af06117137eec0637543a2626a7979.1495135190.git.lukas@wunner.de drivers/gpu/drm/radeon/radeon_kms.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2dffdc0724004f38f5e39907747b53e4b0d80e59 Author: Guoqing Jiang Date: Tue May 16 14:01:25 2017 +0800 md-cluster: fix potential lock issue in add_new_disk The add_new_disk returns with communication locked if __sendmsg returns failure, fix it with call unlock_comm before return. Reported-by: Dan Carpenter CC: Goldwyn Rodrigues Signed-off-by: Guoqing Jiang Signed-off-by: Shaohua Li drivers/md/md-cluster.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 887a9730614727c4fff7cb756711b190593fc1df Author: Konstantin Khlebnikov Date: Sun May 21 22:36:23 2017 -0400 ext4: keep existing extra fields when inode expands ext4_expand_extra_isize() should clear only space between old and new size. Fixes: 6dd4ee7cab7e # v2.6.23 Cc: stable@vger.kernel.org Signed-off-by: Konstantin Khlebnikov Signed-off-by: Theodore Ts'o fs/ext4/inode.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 9651e6b2e20648d04d5e1fe6479a3056047e8781 Author: Konstantin Khlebnikov Date: Sun May 21 22:35:23 2017 -0400 ext4: handle the rest of ext4_mb_load_buddy() ENOMEM errors I've got another report about breaking ext4 by ENOMEM error returned from ext4_mb_load_buddy() caused by memory shortage in memory cgroup. This time inside ext4_discard_preallocations(). This patch replaces ext4_error() with ext4_warning() where errors returned from ext4_mb_load_buddy() are not fatal and handled by caller: * ext4_mb_discard_group_preallocations() - called before generating ENOSPC, we'll try to discard other group or return ENOSPC into user-space. * ext4_trim_all_free() - just stop trimming and return ENOMEM from ioctl. Some callers cannot handle errors, thus __GFP_NOFAIL is used for them: * ext4_discard_preallocations() * ext4_mb_discard_lg_preallocations() Fixes: adb7ef600cc9 ("ext4: use __GFP_NOFAIL in ext4_free_blocks()") Signed-off-by: Konstantin Khlebnikov Signed-off-by: Theodore Ts'o fs/ext4/mballoc.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) commit 3f1d5bad3fae983da07be01cff2fde13293bb7b9 Author: Jan Kara Date: Sun May 21 22:34:23 2017 -0400 ext4: fix off-by-in in loop termination in ext4_find_unwritten_pgoff() There is an off-by-one error in loop termination conditions in ext4_find_unwritten_pgoff() since 'end' may index a page beyond end of desired range if 'endoff' is page aligned. It doesn't have any visible effects but still it is good to fix it. Signed-off-by: Jan Kara Signed-off-by: Theodore Ts'o fs/ext4/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7d95eddf313c88b24f99d4ca9c2411a4b82fef33 Author: Jan Kara Date: Sun May 21 22:33:23 2017 -0400 ext4: fix SEEK_HOLE Currently, SEEK_HOLE implementation in ext4 may both return that there's a hole at some offset although that offset already has data and skip some holes during a search for the next hole. The first problem is demostrated by: xfs_io -c "falloc 0 256k" -c "pwrite 0 56k" -c "seek -h 0" file wrote 57344/57344 bytes at offset 0 56 KiB, 14 ops; 0.0000 sec (2.054 GiB/sec and 538461.5385 ops/sec) Whence Result HOLE 0 Where we can see that SEEK_HOLE wrongly returned offset 0 as containing a hole although we have written data there. The second problem can be demonstrated by: xfs_io -c "falloc 0 256k" -c "pwrite 0 56k" -c "pwrite 128k 8k" -c "seek -h 0" file wrote 57344/57344 bytes at offset 0 56 KiB, 14 ops; 0.0000 sec (1.978 GiB/sec and 518518.5185 ops/sec) wrote 8192/8192 bytes at offset 131072 8 KiB, 2 ops; 0.0000 sec (2 GiB/sec and 500000.0000 ops/sec) Whence Result HOLE 139264 Where we can see that hole at offsets 56k..128k has been ignored by the SEEK_HOLE call. The underlying problem is in the ext4_find_unwritten_pgoff() which is just buggy. In some cases it fails to update returned offset when it finds a hole (when no pages are found or when the first found page has higher index than expected), in some cases conditions for detecting hole are just missing (we fail to detect a situation where indices of returned pages are not contiguous). Fix ext4_find_unwritten_pgoff() to properly detect non-contiguous page indices and also handle all cases where we got less pages then expected in one place and handle it properly there. CC: stable@vger.kernel.org Fixes: c8c0df241cc2719b1262e627f999638411934f60 CC: Zheng Liu Signed-off-by: Jan Kara Signed-off-by: Theodore Ts'o fs/ext4/file.c | 50 ++++++++++++++------------------------------------ 1 file changed, 14 insertions(+), 36 deletions(-) commit b4709067ac0944e4a5b94eabdc26155c6f2efbd7 Author: Tahsin Erdogan Date: Sun May 21 22:32:23 2017 -0400 jbd2: preserve original nofs flag during journal restart When a transaction starts, start_this_handle() saves current PF_MEMALLOC_NOFS value so that it can be restored at journal stop time. Journal restart is a special case that calls start_this_handle() without stopping the transaction. start_this_handle() isn't aware that the original value is already stored so it overwrites it with current value. For instance, a call sequence like below leaves PF_MEMALLOC_NOFS flag set at the end: jbd2_journal_start() jbd2__journal_restart() jbd2_journal_stop() Make jbd2__journal_restart() restore the original value before calling start_this_handle(). Fixes: 81378da64de6 ("jbd2: mark the transaction context with the scope GFP_NOFS context") Signed-off-by: Tahsin Erdogan Signed-off-by: Theodore Ts'o Reviewed-by: Jan Kara fs/jbd2/transaction.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 964edf66bf9ab70cb387b27946c0aef7b94c4d1b Author: Jan Kara Date: Sun May 21 22:31:23 2017 -0400 ext4: clear lockdep subtype for quota files on quota off Quota files have special ranking of i_data_sem lock. We inform lockdep about it when turning on quotas however when turning quotas off, we don't clear the lockdep subclass from i_data_sem lock and thus when the inode gets later reused for a normal file or directory, lockdep gets confused and complains about possible deadlocks. Fix the problem by resetting lockdep subclass of i_data_sem on quota off. Cc: stable@vger.kernel.org Fixes: daf647d2dd58cec59570d7698a45b98e580f2076 Reported-and-tested-by: Ross Zwisler Reviewed-by: Andreas Dilger Signed-off-by: Jan Kara Signed-off-by: Theodore Ts'o fs/ext4/super.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) commit 08332893e37af6ae779367e78e444f8f9571511d Author: Linus Torvalds Date: Sun May 21 19:30:23 2017 -0700 Linux 4.12-rc2 Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 33c9e9729033387ef0521324c62e7eba529294af Author: Linus Torvalds Date: Sun May 21 18:26:54 2017 -0700 x86: fix 32-bit case of __get_user_asm_u64() The code to fetch a 64-bit value from user space was entirely buggered, and has been since the code was merged in early 2016 in commit b2f680380ddf ("x86/mm/32: Add support for 64-bit __get_user() on 32-bit kernels"). Happily the buggered routine is almost certainly entirely unused, since the normal way to access user space memory is just with the non-inlined "get_user()", and the inlined version didn't even historically exist. The normal "get_user()" case is handled by external hand-written asm in arch/x86/lib/getuser.S that doesn't have either of these issues. There were two independent bugs in __get_user_asm_u64(): - it still did the STAC/CLAC user space access marking, even though that is now done by the wrapper macros, see commit 11f1a4b9755f ("x86: reorganize SMAP handling in user space accesses"). This didn't result in a semantic error, it just means that the inlined optimized version was hugely less efficient than the allegedly slower standard version, since the CLAC/STAC overhead is quite high on modern Intel CPU's. - the double register %eax/%edx was marked as an output, but the %eax part of it was touched early in the asm, and could thus clobber other inputs to the asm that gcc didn't expect it to touch. In particular, that meant that the generated code could look like this: mov (%eax),%eax mov 0x4(%eax),%edx where the load of %edx obviously was _supposed_ to be from the 32-bit word that followed the source of %eax, but because %eax was overwritten by the first instruction, the source of %edx was basically random garbage. The fixes are trivial: remove the extraneous STAC/CLAC entries, and mark the 64-bit output as early-clobber to let gcc know that no inputs should alias with the output register. Cc: Al Viro Cc: Benjamin LaHaise Cc: Ingo Molnar Cc: stable@kernel.org # v4.8+ Signed-off-by: Linus Torvalds arch/x86/include/asm/uaccess.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 334a023ee50997b45ffb8fbcc8bc875519040aac Author: Linus Torvalds Date: Sun May 21 15:25:46 2017 -0700 Clean up x86 unsafe_get/put_user() type handling Al noticed that unsafe_put_user() had type problems, and fixed them in commit a7cc722fff0b ("fix unsafe_put_user()"), which made me look more at those functions. It turns out that unsafe_get_user() had a type issue too: it limited the largest size of the type it could handle to "unsigned long". Which is fine with the current users, but doesn't match our existing normal get_user() semantics, which can also handle "u64" even when that does not fit in a long. While at it, also clean up the type cast in unsafe_put_user(). We actually want to just make it an assignment to the expected type of the pointer, because we actually do want warnings from types that don't convert silently. And it makes the code more readable by not having that one very long and complex line. [ This patch might become stable material if we ever end up back-porting any new users of the unsafe uaccess code, but as things stand now this doesn't matter for any current existing uses. ] Cc: Al Viro Signed-off-by: Linus Torvalds arch/x86/include/asm/uaccess.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit fc08a4703a418a398bbb575ac311d36d110ac786 Author: Vishal Verma Date: Fri May 19 11:39:10 2017 +0200 acpi, nfit: Fix the memory error check in nfit_handle_mce() The check for an MCE being a memory error in the NFIT mce handler was bogus. Use the new mce_is_memory_error() helper to detect the error properly. Reported-by: Tony Luck Signed-off-by: Vishal Verma Signed-off-by: Borislav Petkov Cc: Link: http://lkml.kernel.org/r/20170519093915.15413-3-bp@alien8.de Signed-off-by: Thomas Gleixner drivers/acpi/nfit/mce.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2d1f406139ec20320bf38bcd2461aa8e358084b5 Author: Borislav Petkov Date: Fri May 19 11:39:09 2017 +0200 x86/MCE: Export memory_error() Export the function which checks whether an MCE is a memory error to other users so that we can reuse the logic. Drop the boot_cpu_data use, while at it, as mce.cpuvendor already has the CPU vendor in there. Integrate a piece from a patch from Vishal Verma to export it for modules (nfit). The main reason we're exporting it is that the nfit handler nfit_handle_mce() needs to detect a memory error properly before doing its recovery actions. Signed-off-by: Borislav Petkov Cc: Tony Luck Cc: Vishal Verma Cc: Link: http://lkml.kernel.org/r/20170519093915.15413-2-bp@alien8.de Signed-off-by: Thomas Gleixner arch/x86/include/asm/mce.h | 1 + arch/x86/kernel/cpu/mcheck/mce.c | 13 ++++++------- 2 files changed, 7 insertions(+), 7 deletions(-) commit f3926e4c2a4b53c25a998de168d4eef6d0360369 Merge: 970c305 a8c3954 Author: Linus Torvalds Date: Sun May 21 12:06:44 2017 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull misc uaccess fixes from Al Viro: "Fix for unsafe_put_user() (no callers currently in mainline, but anyone starting to use it will step into that) + alpha osf_wait4() infoleak fix" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: osf_wait4(): fix infoleak fix unsafe_put_user() commit 970c305aa802346aaa741ab241f6f3f63d623cc0 Merge: e7a3d62 8663eff Author: Linus Torvalds Date: Sun May 21 11:52:00 2017 -0700 Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Thomas Gleixner: "A single scheduler fix: Prevent idle task from ever being preempted. That makes sure that synchronize_rcu_tasks() which is ignoring idle task does not pretend that no task is stuck in preempted state. If that happens and idle was preempted on a ftrace trampoline the machine crashes due to inconsistent state" * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/core: Call __schedule() from do_idle() without enabling preemption commit e7a3d62749183576854cdc961b8b1cddf1aed71e Merge: 56f410c 2c4569c Author: Linus Torvalds Date: Sun May 21 11:45:26 2017 -0700 Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Thomas Gleixner: "A set of small fixes for the irq subsystem: - Cure a data ordering problem with chained interrupts - Three small fixlets for the mbigen irq chip" * 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: genirq: Fix chained interrupt data ordering irqchip/mbigen: Fix the clear register offset calculation irqchip/mbigen: Fix potential NULL dereferencing irqchip/mbigen: Fix memory mapping code commit 6d18c732b95c0a9d35e9f978b4438bba15412284 Author: Xin Long Date: Fri May 19 22:20:29 2017 +0800 bridge: start hello_timer when enabling KERNEL_STP in br_stp_start Since commit 76b91c32dd86 ("bridge: stp: when using userspace stp stop kernel hello and hold timers"), bridge would not start hello_timer if stp_enabled is not KERNEL_STP when br_dev_open. The problem is even if users set stp_enabled with KERNEL_STP later, the timer will still not be started. It causes that KERNEL_STP can not really work. Users have to re-ifup the bridge to avoid this. This patch is to fix it by starting br->hello_timer when enabling KERNEL_STP in br_stp_start. As an improvement, it's also to start hello_timer again only when br->stp_enabled is KERNEL_STP in br_hello_timer_expired, there is no reason to start the timer again when it's NO_STP. Fixes: 76b91c32dd86 ("bridge: stp: when using userspace stp stop kernel hello and hold timers") Reported-by: Haidong Li Signed-off-by: Xin Long Acked-by: Nikolay Aleksandrov Reviewed-by: Ivan Vecera Signed-off-by: David S. Miller net/bridge/br_stp_if.c | 1 + net/bridge/br_stp_timer.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) commit fe0cd8ca1b82983db24b173bb8518ea646c02d25 Author: Nisar Sayed Date: Fri May 19 14:00:25 2017 +0000 smsc95xx: Support only IPv4 TCP/UDP csum offload When TX checksum offload is used, if the computed checksum is 0 the LAN95xx device do not alter the checksum to 0xffff. In the case of ipv4 UDP checksum, it indicates to receiver that no checksum is calculated. Under ipv6, UDP checksum yields a result of zero must be changed to 0xffff. Hence disabling checksum offload for ipv6 packets. Signed-off-by: Nisar Sayed Reported-by: popcorn mix Signed-off-by: David S. Miller drivers/net/usb/smsc95xx.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) commit 776ee323ddf1167435f2cae0d7f8a6955383b5aa Merge: 499350a 7d472a5 Author: David S. Miller Date: Sun May 21 13:26:46 2017 -0400 Merge branch 'arp-always-override-existing-neigh-entries-with-gratuitous-ARP' Ihar Hrachyshka says: ==================== arp: always override existing neigh entries with gratuitous ARP This patchset is spurred by discussion started at https://patchwork.ozlabs.org/patch/760372/ where we figured that there is no real reason for enforcing override by gratuitous ARP packets only when arp_accept is 1. Same should happen when it's 0 (the default value). changelog v2: handled review comments by Julian Anastasov - fixed a mistake in a comment; - postponed addr_type calculation to as late as possible. ==================== Signed-off-by: David S. Miller commit 7d472a59c0e5ec117220a05de6b370447fb6cb66 Author: Ihar Hrachyshka Date: Thu May 18 12:41:21 2017 -0700 arp: always override existing neigh entries with gratuitous ARP Currently, when arp_accept is 1, we always override existing neigh entries with incoming gratuitous ARP replies. Otherwise, we override them only if new replies satisfy _locktime_ conditional (packets arrive not earlier than _locktime_ seconds since the last update to the neigh entry). The idea behind locktime is to pick the very first (=> close) reply received in a unicast burst when ARP proxies are used. This helps to avoid ARP thrashing where Linux would switch back and forth from one proxy to another. This logic has nothing to do with gratuitous ARP replies that are generally not aligned in time when multiple IP address carriers send them into network. This patch enforces overriding of existing neigh entries by all incoming gratuitous ARP packets, irrespective of their time of arrival. This will make the kernel honour all incoming gratuitous ARP packets. Signed-off-by: Ihar Hrachyshka Signed-off-by: David S. Miller net/ipv4/arp.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit d9ef2e7bf99f59179b89d5c1c4d5b4919375daee Author: Ihar Hrachyshka Date: Thu May 18 12:41:20 2017 -0700 arp: postpone addr_type calculation to as late as possible The addr_type retrieval can be costly, so it's worth trying to avoid its calculation as much as possible. This patch makes it calculated only for gratuitous ARP packets. This is especially important since later we may want to move is_garp calculation outside of arp_accept block, at which point the costly operation will be executed for all setups. The patch is the result of a discussion in net-dev: http://marc.info/?l=linux-netdev&m=149506354216994 Suggested-by: Julian Anastasov Signed-off-by: Ihar Hrachyshka Signed-off-by: David S. Miller net/ipv4/arp.c | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) commit 6fd05633bdafc0ae6ec0d55e61af10780d4d3530 Author: Ihar Hrachyshka Date: Thu May 18 12:41:19 2017 -0700 arp: decompose is_garp logic into a separate function The code is quite involving already to earn a separate function for itself. If anything, it helps arp_process readability. Signed-off-by: Ihar Hrachyshka Signed-off-by: David S. Miller net/ipv4/arp.c | 35 +++++++++++++++++++++++------------ 1 file changed, 23 insertions(+), 12 deletions(-) commit 34eb5fe07831458cf8238d54c1fc847dedeaf68c Author: Ihar Hrachyshka Date: Thu May 18 12:41:18 2017 -0700 arp: fixed error in a comment the is_garp code deals just with gratuitous ARP packets, not every unsolicited packet. This patch is a result of a discussion in netdev: http://marc.info/?l=linux-netdev&m=149506354216994 Suggested-by: Julian Anastasov Signed-off-by: Ihar Hrachyshka Signed-off-by: David S. Miller net/ipv4/arp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 499350a5a6e7512d9ed369ed63a4244b6536f4f8 Author: Wei Wang Date: Thu May 18 11:22:33 2017 -0700 tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0 When tcp_disconnect() is called, inet_csk_delack_init() sets icsk->icsk_ack.rcv_mss to 0. This could potentially cause tcp_recvmsg() => tcp_cleanup_rbuf() => __tcp_select_window() call path to have division by 0 issue. So this patch initializes rcv_mss to TCP_MIN_MSS instead of 0. Reported-by: Andrey Konovalov Signed-off-by: Wei Wang Signed-off-by: Eric Dumazet Signed-off-by: Neal Cardwell Signed-off-by: Yuchung Cheng Signed-off-by: David S. Miller net/ipv4/tcp.c | 4 ++++ 1 file changed, 4 insertions(+) commit a8c39544a6eb2093c04afd5005b6192bd0e880c6 Author: Al Viro Date: Sun May 14 21:47:25 2017 -0400 osf_wait4(): fix infoleak failing sys_wait4() won't fill struct rusage... Cc: stable@vger.kernel.org Signed-off-by: Al Viro arch/alpha/kernel/osf_sys.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit a7cc722fff0b32bcd28bf4722dff816b0b695f7d Author: Al Viro Date: Sun May 21 13:08:42 2017 -0400 fix unsafe_put_user() __put_user_size() relies upon its first argument having the same type as what the second one points to; the only other user makes sure of that and unsafe_put_user() should do the same. Signed-off-by: Al Viro arch/x86/include/asm/uaccess.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 23416e230416a9201561f1db553b1515e9959f6a Merge: 8b4822d 751a9c7 Author: David S. Miller Date: Sun May 21 13:00:02 2017 -0400 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter/IPVS fixes for net The following patchset contains Netfilter/IPVS fixes for your net tree, they are: 1) When using IPVS in direct-routing mode, normal traffic from the LVS host to a back-end server is sometimes incorrectly NATed on the way back into the LVS host. Patch to fix this from Julian Anastasov. 2) Calm down clang compilation warning in ctnetlink due to type mismatch, from Matthias Kaehlcke. 3) Do not re-setup NAT for conntracks that are already confirmed, this is fixing a problem that was introduced in the previous nf-next batch. Patch from Liping Zhang. 4) Do not allow conntrack helper removal from userspace cthelper infrastructure if already in used. This comes with an initial patch to introduce nf_conntrack_helper_put() that is required by this fix. From Liping Zhang. 5) Zero the pad when copying data to userspace, otherwise iptables fails to remove rules. This is a follow up on the patchset that sorts out the internal match/target structure pointer leak to userspace. Patch from the same author, Willem de Bruijn. This also comes with a build failure when CONFIG_COMPAT is not on, coming in the last patch of this series. 6) SYNPROXY crashes with conntrack entries that are created via ctnetlink, more specifically via conntrackd state sync. Patch from Eric Leblond. 7) RCU safe iteration on set element dumping in nf_tables, from Liping Zhang. 8) Missing sanitization of immediate date for the bitwise and cmp expressions in nf_tables. 9) Refcounting logic for chain and objects from set elements does not integrate into the nf_tables 2-phase commit protocol. 10) Missing sanitization of target verdict in ebtables arpreply target, from Gao Feng. ==================== Signed-off-by: David S. Miller commit 82237f268281d338aa35cd014be8ffb0b5445482 Author: Quentin Schulz Date: Thu May 18 08:36:07 2017 +0200 iio: adc: sun4i-gpadc-iio: fix parent device being used in devm function For the sake of DT binding stability, this IIO driver is a child of an MFD driver for Allwinner A10, A13 and A31 because there already exists a DT binding for this IP. The MFD driver has a DT node but the IIO driver does not. The IIO device registers the temperature sensor in the thermal framework using the DT node of the parent, the MFD device, so the thermal framework could match the phandle to the MFD device in the DT and the struct device used to register in the thermal framework. devm_thermal_zone_of_sensor_register was previously used to register the thermal sensor with the parent struct device of the IIO device, representing the MFD device. By doing so, we registered actually the parent in the devm routine and not the actual IIO device. This lead to the devm unregister function not being called when the IIO module driver is removed. It resulted in the thermal framework still polling the get_temp function of the IIO module while the device doesn't exist anymore, thus generated a kernel panic. Use the non-devm function instead and do the unregister manually in the remove function. Fixes: d1caa9905538 ("iio: adc: add support for Allwinner SoCs ADC") Signed-off-by: Quentin Schulz Reported-by: Corentin Labbe Reviewed-by: Maxime Ripard Signed-off-by: Jonathan Cameron drivers/iio/adc/sun4i-gpadc-iio.c | 36 ++++++++++++++++++++++-------------- 1 file changed, 22 insertions(+), 14 deletions(-) commit 7cc3bff4efe6164a0c8163331c8aa55454799f42 Author: Franziska Naepelt Date: Wed May 17 12:41:19 2017 +0200 iio: light: ltr501 Fix interchanged als/ps register field The register mapping for the IIO driver for the Liteon Light and Proximity sensor LTR501 interrupt mode is interchanged (ALS/PS). There is a register called INTERRUPT register (address 0x8F) Bit 0 represents PS measurement trigger. Bit 1 represents ALS measurement trigger. This two bit fields are interchanged within the driver. see datasheet page 24: http://optoelectronics.liteon.com/upload/download/DS86-2012-0006/S_110_LTR-501ALS-01_PrelimDS_ver1%5B1%5D.pdf Signed-off-by: Franziska Naepelt Fixes: 7ac702b3144b6 ("iio: ltr501: Add interrupt support") Acked-by: Peter Meerwald-Stadler Cc: Signed-off-by: Jonathan Cameron drivers/iio/light/ltr501.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit f7d86ecf83cb66d3c4c6ac4edb1dd50c0919aa2b Author: Raveendra Padasalagi Date: Tue May 16 12:22:42 2017 +0530 iio: adc: bcm_iproc_adc: swap primary and secondary isr handler's The third argument of devm_request_threaded_irq() is the primary handler. It is called in hardirq context and checks whether the interrupt is relevant to the device. If the primary handler returns IRQ_WAKE_THREAD, the secondary handler (a.k.a. handler thread) is scheduled to run in process context. bcm_iproc_adc.c uses the secondary handler as the primary one and the other way around. So this patch fixes the same, along with re-naming the secondary handler and primary handler names properly. Tested on the BCM9583XX iProc SoC based boards. Fixes: 4324c97ecedc ("iio: Add driver for Broadcom iproc-static-adc") Reported-by: Pavel Roskin Signed-off-by: Raveendra Padasalagi Cc: stable@vger.kernel.org Signed-off-by: Jonathan Cameron drivers/iio/adc/bcm_iproc_adc.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 4eecbe81885180c9f6217ecfd679b1f285967218 Author: Marcin Niestroj Date: Thu May 18 09:12:06 2017 +0200 iio: trigger: fix NULL pointer dereference in iio_trigger_write_current() In case oldtrig == trig == NULL (which happens when we set none trigger, when there is already none set) there is a NULL pointer dereference during iio_trigger_put(trig). Below is kernel output when this occurs: [ 26.741790] Unable to handle kernel NULL pointer dereference at virtual address 00000000 [ 26.750179] pgd = cacc0000 [ 26.752936] [00000000] *pgd=8adc6835, *pte=00000000, *ppte=00000000 [ 26.759531] Internal error: Oops: 17 [#1] SMP ARM [ 26.764261] Modules linked in: usb_f_ncm u_ether usb_f_acm u_serial usb_f_fs libcomposite configfs evbug [ 26.773844] CPU: 0 PID: 152 Comm: synchro Not tainted 4.12.0-rc1 #2 [ 26.780128] Hardware name: Freescale i.MX6 Ultralite (Device Tree) [ 26.786329] task: cb1de200 task.stack: cac92000 [ 26.790892] PC is at iio_trigger_write_current+0x188/0x1f4 [ 26.796403] LR is at lock_release+0xf8/0x20c [ 26.800696] pc : [] lr : [] psr: 600d0013 [ 26.800696] sp : cac93e30 ip : cac93db0 fp : cac93e5c [ 26.812193] r10: c0e64fe8 r9 : 00000000 r8 : 00000001 [ 26.817436] r7 : cb190810 r6 : 00000010 r5 : 00000001 r4 : 00000000 [ 26.823982] r3 : 00000000 r2 : 00000000 r1 : cb1de200 r0 : 00000000 [ 26.830528] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none [ 26.837683] Control: 10c5387d Table: 8acc006a DAC: 00000051 [ 26.843448] Process synchro (pid: 152, stack limit = 0xcac92210) [ 26.849475] Stack: (0xcac93e30 to 0xcac94000) [ 26.853857] 3e20: 00000001 c0736dac c054033c cae6b680 [ 26.862060] 3e40: cae6b680 00000000 00000001 cb3f8610 cac93e74 cac93e60 c054035c c0736db8 [ 26.870264] 3e60: 00000001 c054033c cac93e94 cac93e78 c029bf34 c0540348 00000000 00000000 [ 26.878469] 3e80: cb3f8600 cae6b680 cac93ed4 cac93e98 c029b320 c029bef0 00000000 00000000 [ 26.886672] 3ea0: 00000000 cac93f78 cb2d41fc caed3280 c029b214 cac93f78 00000001 000e20f8 [ 26.894874] 3ec0: 00000001 00000000 cac93f44 cac93ed8 c0221dcc c029b220 c0e1ca39 cb2d41fc [ 26.903079] 3ee0: cac93f04 cac93ef0 c0183ef0 c0183ab0 cb2d41fc 00000000 cac93f44 cac93f08 [ 26.911282] 3f00: c0225eec c0183ebc 00000001 00000000 c0223728 00000000 c0245454 00000001 [ 26.919485] 3f20: 00000001 caed3280 000e20f8 cac93f78 000e20f8 00000001 cac93f74 cac93f48 [ 26.927690] 3f40: c0223680 c0221da4 c0246520 c0245460 caed3283 caed3280 00000000 00000000 [ 26.935893] 3f60: 000e20f8 00000001 cac93fa4 cac93f78 c0224520 c02235e4 00000000 00000000 [ 26.944096] 3f80: 00000001 000e20f8 00000001 00000004 c0107f84 cac92000 00000000 cac93fa8 [ 26.952299] 3fa0: c0107de0 c02244e8 00000001 000e20f8 0000000e 000e20f8 00000001 fbad2484 [ 26.960502] 3fc0: 00000001 000e20f8 00000001 00000004 beb6b698 00064260 0006421c beb6b4b4 [ 26.968705] 3fe0: 00000000 beb6b450 b6f219a0 b6e2f268 800d0010 0000000e cac93ff4 cac93ffc [ 26.976896] Backtrace: [ 26.979388] [] (iio_trigger_write_current) from [] (dev_attr_store+0x20/0x2c) [ 26.988289] r10:cb3f8610 r9:00000001 r8:00000000 r7:cae6b680 r6:cae6b680 r5:c054033c [ 26.996138] r4:c0736dac r3:00000001 [ 26.999747] [] (dev_attr_store) from [] (sysfs_kf_write+0x50/0x54) [ 27.007686] r5:c054033c r4:00000001 [ 27.011290] [] (sysfs_kf_write) from [] (kernfs_fop_write+0x10c/0x224) [ 27.019579] r7:cae6b680 r6:cb3f8600 r5:00000000 r4:00000000 [ 27.025271] [] (kernfs_fop_write) from [] (__vfs_write+0x34/0x120) [ 27.033214] r10:00000000 r9:00000001 r8:000e20f8 r7:00000001 r6:cac93f78 r5:c029b214 [ 27.041059] r4:caed3280 [ 27.043622] [] (__vfs_write) from [] (vfs_write+0xa8/0x170) [ 27.050959] r9:00000001 r8:000e20f8 r7:cac93f78 r6:000e20f8 r5:caed3280 r4:00000001 [ 27.058731] [] (vfs_write) from [] (SyS_write+0x44/0x98) [ 27.065806] r9:00000001 r8:000e20f8 r7:00000000 r6:00000000 r5:caed3280 r4:caed3283 [ 27.073582] [] (SyS_write) from [] (ret_fast_syscall+0x0/0x1c) [ 27.081179] r9:cac92000 r8:c0107f84 r7:00000004 r6:00000001 r5:000e20f8 r4:00000001 [ 27.088947] Code: 1a000009 e1a04009 e3a06010 e1a05008 (e5943000) [ 27.095244] ---[ end trace 06d1dab86d6e6bab ]--- To fix that problem call iio_trigger_put(trig) only when trig is not NULL. Fixes: d5d24bcc0a10 ("iio: trigger: close race condition in acquiring trigger reference") Signed-off-by: Marcin Niestroj Cc: Signed-off-by: Jonathan Cameron drivers/iio/industrialio-trigger.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 3780578761921f094179c6289072a74b2228c602 Author: Rob Landley Date: Sat May 20 15:03:29 2017 -0500 x86/boot: Use CROSS_COMPILE prefix for readelf The boot code Makefile contains a straight 'readelf' invocation. This causes build warnings in cross compile environments, when there is no unprefixed readelf accessible via $PATH. Add the missing $(CROSS_COMPILE) prefix. [ tglx: Rewrote changelog ] Fixes: 98f78525371b ("x86/boot: Refuse to build with data relocations") Signed-off-by: Rob Landley Acked-by: Kees Cook Cc: Jiri Kosina Cc: Paul Bolle Cc: "H.J. Lu" Cc: stable@vger.kernel.org Link: http://lkml.kernel.org/r/ced18878-693a-9576-a024-113ef39a22c0@landley.net Signed-off-by: Thomas Gleixner arch/x86/boot/compressed/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 56f410cf45a1c1f68f77741990e0435b06a07676 Merge: 894e216 a33d7d9 Author: Linus Torvalds Date: Sat May 20 23:39:03 2017 -0700 Merge tag 'trace-v4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fixes from Steven Rostedt: - Fix a bug caused by not cleaning up the new instance unique triggers when deleting an instance. It also creates a selftest that triggers that bug. - Fix the delayed optimization happening after kprobes boot up self tests being removed by freeing of init memory. - Comment kprobes on why the delay optimization is not a problem for removal of modules, to keep other developers from searching that riddle. - Fix another case of rcu not watching in stack trace tracing. * tag 'trace-v4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing: Make sure RCU is watching before calling a stack trace kprobes: Document how optimized kprobes are removed from module unload selftests/ftrace: Add test to remove instance with active event triggers selftests/ftrace: Fix bashisms ftrace: Remove #ifdef from code and add clear_ftrace_function_probes() stub ftrace/instances: Clear function triggers when removing instances ftrace: Simplify glob handling in unregister_ftrace_function_probe_func() tracing/kprobes: Enforce kprobes teardown after testing tracing: Move postpone selftests to core from early_initcall commit 894e21642dde19184f059c485c49abd7ecdd6ec9 Merge: ef82f1a 549f01a Author: Linus Torvalds Date: Sat May 20 16:12:30 2017 -0700 Merge branch 'for-linus' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "A small collection of fixes that should go into this cycle. - a pull request from Christoph for NVMe, which ended up being manually applied to avoid pulling in newer bits in master. Mostly fibre channel fixes from James, but also a few fixes from Jon and Vijay - a pull request from Konrad, with just a single fix for xen-blkback from Gustavo. - a fuseblk bdi fix from Jan, fixing a regression in this series with the dynamic backing devices. - a blktrace fix from Shaohua, replacing sscanf() with kstrtoull(). - a request leak fix for drbd from Lars, fixing a regression in the last series with the kref changes. This will go to stable as well" * 'for-linus' of git://git.kernel.dk/linux-block: nvmet: release the sq ref on rdma read errors nvmet-fc: remove target cpu scheduling flag nvme-fc: stop queues on error detection nvme-fc: require target or discovery role for fc-nvme targets nvme-fc: correct port role bits nvme: unmap CMB and remove sysfs file in reset path blktrace: fix integer parse fuseblk: Fix warning in super_setup_bdi_name() block: xen-blkback: add null check to avoid null pointer dereference drbd: fix request leak introduced by locking/atomic, kref: Kill kref_sub() commit 549f01ae7b913355bea76100d3f17694bc9ec769 Author: Vijay Immanuel Date: Mon May 8 16:38:35 2017 -0700 nvmet: release the sq ref on rdma read errors On rdma read errors, release the sq ref that was taken when the req was initialized. This avoids a hang in nvmet_sq_destroy() when the queue is being freed. Signed-off-by: Vijay Immanuel Reviewed-by: Sagi Grimberg Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe drivers/nvme/target/core.c | 6 ++++++ drivers/nvme/target/nvmet.h | 1 + drivers/nvme/target/rdma.c | 1 + 3 files changed, 8 insertions(+) commit 4b8ba5fa525bc8bdaaed2a5c5433f0f2008d7bc5 Author: James Smart Date: Tue Apr 25 16:23:09 2017 -0700 nvmet-fc: remove target cpu scheduling flag Remove NVMET_FCTGTFEAT_NEEDS_CMD_CPUSCHED. It's unnecessary. Signed-off-by: James Smart Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe drivers/nvme/target/fc.c | 4 +--- drivers/nvme/target/fcloop.c | 1 - drivers/scsi/lpfc/lpfc_nvmet.c | 1 - include/linux/nvme-fc-driver.h | 12 ++---------- 4 files changed, 3 insertions(+), 15 deletions(-) commit 2952a879bacbfae8b03fd886754e64fe14b8041e Author: James Smart Date: Tue Apr 25 15:32:01 2017 -0700 nvme-fc: stop queues on error detection Per the recommendation by Sagi on: http://lists.infradead.org/pipermail/linux-nvme/2017-April/009261.html Rather than waiting for reset work thread to stop queues and abort the ios, immediately stop the queues on error detection. Reset thread will restop the queues (as it's called on other paths), but it does not appear to have a side effect. Signed-off-by: James Smart Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe drivers/nvme/host/fc.c | 4 ++++ 1 file changed, 4 insertions(+) commit 85e6a6adf8de7f992e01d2c3c59d9875d658b276 Author: James Smart Date: Fri May 5 16:13:15 2017 -0700 nvme-fc: require target or discovery role for fc-nvme targets In order to create an association, the remoteport must be serving either a target role or a discovery role. Signed-off-by: James Smart Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe drivers/nvme/host/fc.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 4123109050a869a8871e58a50f28f383d41e49ad Author: James Smart Date: Fri May 5 16:13:02 2017 -0700 nvme-fc: correct port role bits FC Port roles is a bit mask, not individual values. Correct nvme definitions to unique bits. Signed-off-by: James Smart Reviewed-by: Johannes Thumshirn Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe include/linux/nvme-fc-driver.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit f63572dff1421b6ca6abce71d46e03411e605c94 Author: Jon Derrick Date: Fri May 5 14:52:06 2017 -0600 nvme: unmap CMB and remove sysfs file in reset path CMB doesn't get unmapped until removal while getting remapped on every reset. Add the unmapping and sysfs file removal to the reset path in nvme_pci_disable to match the mapping path in nvme_pci_enable. Fixes: 202021c1a ("nvme : Add sysfs entry for NVMe CMBs when appropriate") Signed-off-by: Jon Derrick Acked-by: Keith Busch Reviewed-By: Stephen Bates Cc: # 4.9+ Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe drivers/nvme/host/pci.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit ef82f1ad2e3f4509807c83e7eff4ec7c735076e8 Merge: 3202629 66ea597 Author: Linus Torvalds Date: Sat May 20 09:02:27 2017 -0700 Merge tag 'staging-4.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fixes from Greg KH: "Here are a number of staging driver fixes for 4.12-rc2 Most of them are typec driver fixes found by reviewers and users of the code. There are also some removals of files no longer needed in the tree due to the ion driver rewrite in 4.12-rc1, as well as some wifi driver fixes. And to round it out, a MAINTAINERS file update. All have been in linux-next with no reported issues" * tag 'staging-4.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (22 commits) MAINTAINERS: greybus-dev list is members-only staging: fsl-dpaa2/eth: add ETHERNET dependency staging: typec: fusb302: refactor resume retry mechanism staging: typec: fusb302: reset i2c_busy state in error staging: rtl8723bs: remove re-positioned call to kfree in os_dep/ioctl_cfg80211.c staging: rtl8192e: GetTs Fix invalid TID 7 warning. staging: rtl8192e: rtl92e_get_eeprom_size Fix read size of EPROM_CMD. staging: rtl8192e: fix 2 byte alignment of register BSSIDR. staging: rtl8192e: rtl92e_fill_tx_desc fix write to mapped out memory. staging: vc04_services: Fix bulk cache maintenance staging: ccree: remove extraneous spin_unlock_bh() in error handler staging: typec: Fix sparse warnings about incorrect types staging: typec: fusb302: do not free gpio from managed resource staging: typec: tcpm: Fix Port Power Role field in PS_RDY messages staging: typec: tcpm: Respond to Discover Identity commands staging: typec: tcpm: Set correct flags in PD request messages staging: typec: tcpm: Drop duplicate PD messages staging: typec: fusb302: Fix chip->vbus_present init value staging: typec: fusb302: Fix module autoload staging: typec: tcpci: declare private structure as static ... commit 32026293452a49b8395ec8a17d7f07304307af63 Merge: 331da10 b51e0ce Author: Linus Torvalds Date: Sat May 20 08:52:34 2017 -0700 Merge tag 'usb-4.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are a number of small USB fixes for 4.12-rc2 Most of them come from Johan, in his valiant quest to fix up all drivers that could be affected by "malicious" USB devices. There's also some fixes for more "obscure" drivers to handle some of the vmalloc stack fallout (which for USB drivers, was always the case, but very few people actually ran those systems...) Other than that, the normal set of xhci and gadget and musb driver fixes as well. All have been in linux-next with no reported issues" * tag 'usb-4.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (42 commits) usb: musb: tusb6010_omap: Do not reset the other direction's packet size usb: musb: Fix trying to suspend while active for OTG configurations usb: host: xhci-plat: propagate return value of platform_get_irq() xhci: Fix command ring stop regression in 4.11 xhci: remove GFP_DMA flag from allocation USB: xhci: fix lock-inversion problem usb: host: xhci-ring: don't need to clear interrupt pending for MSI enabled hcd usb: host: xhci-mem: allocate zeroed Scratchpad Buffer xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton usb: xhci: trace URB before giving it back instead of after USB: serial: qcserial: add more Lenovo EM74xx device IDs USB: host: xhci: use max-port define USB: hub: fix SS max number of ports USB: hub: fix non-SS hub-descriptor handling USB: hub: fix SS hub-descriptor handling USB: usbip: fix nonconforming hub descriptor USB: gadget: dummy_hcd: fix hub-descriptor removable fields doc-rst: fixed kernel-doc directives in usb/typec.rst USB: core: of: document reference taken by companion helper USB: ehci-platform: fix companion-device leak ... commit 331da109ec20d352a6f59ba8cd68aa7835c68fa1 Merge: ec53c02 9434cec Author: Linus Torvalds Date: Sat May 20 08:44:22 2017 -0700 Merge tag 'char-misc-4.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are five small bugfixes for reported issues with 4.12-rc1 and earlier kernels. Nothing huge here, just a lp, mem, vpd, and uio driver fix, along with a Kconfig fixup for one of the misc drivers. All of these have been in linux-next with no reported issues" * tag 'char-misc-4.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: firmware: Google VPD: Fix memory allocation error handling drivers: char: mem: Check for address space wraparound with mmap() uio: fix incorrect memory leak cleanup misc: pci_endpoint_test: select CRC32 char: lp: fix possible integer overflow in lp_setup() commit ec53c027f3e6b0ee82a5d18de7b0d8bfae3ec374 Merge: cf80a6f fedf266f Author: Linus Torvalds Date: Sat May 20 08:35:27 2017 -0700 Merge git://www.linux-watchdog.org/linux-watchdog Pull watchdog fixes from Wim Van Sebroeck: - orion_wdt compile-test dependencies - sama5d4_wdt: WDDIS handling and a race confition - pcwd_usb: fix NULL-deref at probe - cadence_wdt: fix timeout setting - wdt_pci: fix build error if SOFTWARE_REBOOT is defined - iTCO_wdt: all versions count down twice - zx2967: remove redundant dev_err call in zx2967_wdt_probe() - bcm281xx: Fix use of uninitialized spinlock * git://www.linux-watchdog.org/linux-watchdog: watchdog: bcm281xx: Fix use of uninitialized spinlock. watchdog: zx2967: remove redundant dev_err call in zx2967_wdt_probe() iTCO_wdt: all versions count down twice watchdog: wdt_pci: fix build error if define SOFTWARE_REBOOT watchdog: cadence_wdt: fix timeout setting watchdog: pcwd_usb: fix NULL-deref at probe watchdog: sama5d4: fix race condition watchdog: sama5d4: fix WDDIS handling watchdog: orion: fix compile-test dependencies commit cf80a6fbca377516628ea50507eded0a51e88d8c Merge: 6fe1de4 d51aff1 Author: Linus Torvalds Date: Sat May 20 08:29:30 2017 -0700 Merge tag 'drm-fixes-for-v4.12-rc2' of git://people.freedesktop.org/~airlied/linux Pull drm fixes from Dave Airlie: "Mostly nouveau and i915, fairly quiet as usual for rc2" * tag 'drm-fixes-for-v4.12-rc2' of git://people.freedesktop.org/~airlied/linux: drm/atmel-hlcdc: Fix output initialization gpu: host1x: select IOMMU_IOVA drm/nouveau/fifo/gk104-: Silence a locking warning drm/nouveau/secboot: plug memory leak in ls_ucode_img_load_gr() error path drm/nouveau: Fix drm poll_helper handling drm/i915: don't do allocate_va_range again on PIN_UPDATE drm/i915: Fix rawclk readout for g4x drm/i915: Fix runtime PM for LPE audio drm/i915/glk: Fix DSI "*ERROR* ULPS is still active" messages drm/i915/gvt: avoid unnecessary vgpu switch drm/i915/gvt: not to restore in-context mmio drm/etnaviv: don't put fence in case of submit failure drm/i915/gvt: fix typo: "supporte" -> "support" drm: hdlcd: Fix the calculation of the scanout start address commit 623d8c095cb3351564d4dd8e3b449163a07cbd47 Author: Maxime Ripard Date: Mon May 15 10:50:00 2017 +0200 arm64: allwinner: h5: Remove syslink to shared DTSI The arm64 H5 and arm H3 SoCs share roughly the same base, and therefore share a significant part of their device tree. The approach we took was to add a symlink from the arm64 DTSI to the arm DTSI. Now that the arm DT folder is exposed in the include path, we can just use it and remove our symlink. Acked-by: Chen-Yu Tsai Signed-off-by: Maxime Ripard arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi | 2 +- arch/arm64/boot/dts/allwinner/sunxi-h3-h5.dtsi | 1 - 2 files changed, 1 insertion(+), 2 deletions(-) commit 6fe1de43c5f6ba9174540422b29ea06f32af09f8 Merge: 8c3fc16 b77b36c Author: Linus Torvalds Date: Fri May 19 17:46:51 2017 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "This is the first sweep of mostly minor fixes. There's one security one: the read past the end of a buffer in qedf, and a panic fix for lpfc SLI-3 adapters, but the rest are a set of include and build dependency tidy ups and assorted other small fixes and updates" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: pmcraid: remove redundant check to see if request_size is less than zero scsi: lpfc: ensure els_wq is being checked before destroying it scsi: cxlflash: Select IRQ_POLL scsi: qedf: Avoid reading past end of buffer scsi: qedf: Cleanup the type of io_log->op scsi: lpfc: double lock typo in lpfc_ns_rsp() scsi: qedf: properly update arguments position in function call scsi: scsi_lib: Add #include scsi: MAINTAINERS: update OSD entries scsi: Skip deleted devices in __scsi_device_lookup scsi: lpfc: Fix panic on BFS configuration scsi: libfc: do not flood console with messages 'libfc: queue full ...' commit 8c3fc1643d13ff70110701d08beaf77dc20c7c0a Merge: 0bdc6fd f5705aa8c Author: Linus Torvalds Date: Fri May 19 17:35:34 2017 -0700 Merge branch 'libnvdimm-for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm fixes from Dan Williams: "A couple of compile fixes. With the removal of the ->direct_access() method from block_device_operations in favor of a new dax_device + dax_operations we broke two configurations. The CONFIG_BLOCK=n case is fixed by compiling out the block+dax helpers in the dax core. Configurations with FS_DAX=n EXT4=y / XFS=y and DAX=m fail due to the helpers the builtin filesystem needs being in a module, so we stub out the helpers in the FS_DAX=n case." * 'libnvdimm-for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: dax, xfs, ext4: compile out iomap-dax paths in the FS_DAX=n case dax: fix false CONFIG_BLOCK dependency commit 0bdc6fd2329e51b9659d5192f4281493c15e95b3 Merge: d4c6cd1 9d64084 Author: Linus Torvalds Date: Fri May 19 17:33:08 2017 -0700 Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fix from Wolfram Sang: "A regression fix for I2C that would be great to have in rc2" * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: designware: don't infer timings described by ACPI from clock rate commit d4c6cd157a77645b9f8bff348b57aafa551f2d79 Merge: 4217fdd 745b6e7 Author: Linus Torvalds Date: Fri May 19 17:27:28 2017 -0700 Merge tag 'iommu-fixes-v4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull IOMMU fixes from Joerg Roedel: - another compile-fix as a fallout of the recent header-file cleanup - add a missing IO/TLB flush to the Intel VT-d kdump code path - a fix for ARM64 dma code to only access initialized iova_domain members * tag 'iommu-fixes-v4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: iommu/mediatek: Include linux/dma-mapping.h iommu/vt-d: Flush the IOTLB to get rid of the initial kdump mappings iommu/dma: Don't touch invalid iova_domain members commit 4217fdde34a574f1bbdd5f34f64e499465a157ba Merge: 9e856e4 92ceb76 Author: Linus Torvalds Date: Fri May 19 15:13:13 2017 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM fixes from Radim Krčmář: "ARM: - a fix for a build failure introduced in -rc1 when tracepoints are enabled on 32-bit ARM. - disable use of stack pointer protection in the hyp code which can cause panics. - a handful of VGIC fixes. - a fix to the init of the redistributors on GICv3 systems that prevented boot with kvmtool on GICv3 systems introduced in -rc1. - a number of race conditions fixed in our MMU handling code. - a fix for the guest being able to program the debug extensions for the host on the 32-bit side. PPC: - fixes for build failures with PR KVM configurations. - a fix for a host crash that can occur on POWER9 with radix guests. x86: - fixes for nested PML and nested EPT. - a fix for crashes caused by reserved bits in SSE MXCSR that could have been set by userspace. - an optimization of halt polling that fixes high CPU overhead. - fixes for four reports from Dan Carpenter's static checker. - a protection around code that shouldn't have been preemptible. - a fix for port IO emulation" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (27 commits) KVM: x86: prevent uninitialized variable warning in check_svme() KVM: x86/vPMU: fix undefined shift in intel_pmu_refresh() KVM: x86: zero base3 of unusable segments KVM: X86: Fix read out-of-bounds vulnerability in kvm pio emulation KVM: x86: Fix potential preemption when get the current kvmclock timestamp KVM: Silence underflow warning in avic_get_physical_id_entry() KVM: arm/arm64: Hold slots_lock when unregistering kvm io bus devices KVM: arm/arm64: Fix bug when registering redist iodevs KVM: x86: lower default for halt_poll_ns kvm: arm/arm64: Fix use after free of stage2 page table kvm: arm/arm64: Force reading uncached stage2 PGD KVM: nVMX: fix EPT permissions as reported in exit qualification KVM: VMX: Don't enable EPT A/D feature if EPT feature is disabled KVM: x86: Fix load damaged SSEx MXCSR register kvm: nVMX: off by one in vmx_write_pml_buffer() KVM: arm: rename pm_fake handler to trap_raz_wi KVM: arm: plug potential guest hardware debug leakage kvm: arm/arm64: Fix race in resetting stage2 PGD KVM: arm/arm64: vgic-v3: Use PREbits to infer the number of ICH_APxRn_EL2 registers KVM: arm/arm64: vgic-v3: Do not use Active+Pending state for a HW interrupt ... commit 9e856e4b475502270f2cfdd7b289075c1924786b Merge: 1fbbed4 c71e6d8 Author: Linus Torvalds Date: Fri May 19 15:06:48 2017 -0700 Merge tag 'for-linus-4.12b-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: "Some fixes for the new Xen 9pfs frontend and some minor cleanups" * tag 'for-linus-4.12b-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen: make xen_flush_tlb_all() static xen: cleanup pvh leftovers from pv-only sources xen/9pfs: p9_trans_xen_init and p9_trans_xen_exit can be static xen/9pfs: fix return value check in xen_9pfs_front_probe() commit 1fbbed4137de93e02fc62776b8bf08a2d9ae1141 Merge: f538a82 49e67dd Author: Linus Torvalds Date: Fri May 19 15:03:24 2017 -0700 Merge tag 'devicetree-fixes-for-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull DeviceTree fixes from Rob Herring: - fix missing allocation failure handling in fdt code - fix dtc compile error on 32-bit hosts - revert bad sparse changes causing GCC7 warnings * tag 'devicetree-fixes-for-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: of: fdt: add missing allocation-failure check dtc: check.c fix compile error Partially Revert "of: fix sparse warnings in fdt, irq, reserved mem, and resolver code" commit f538a82c075ba3d31e7691a361f28795eff0a786 Merge: 2fe296a 6bf1c2d Author: Linus Torvalds Date: Fri May 19 13:36:56 2017 -0700 Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC fixes from Olof Johansson: "We had a small batch of fixes before -rc1, but here is a larger one. It contains a backmerge of 4.12-rc1 since some of the downstream branches we merge had that as base; at the same time we already had merged contents before -rc1 and rebase wasn't the right solution. A mix of random smaller fixes and a few things worth pointing out: - We've started telling people to avoid cross-tree shared branches if all they're doing is picking up one or two DT-used constants from a shared include file, and instead to use the numeric values on first submission. Follow-up moving over to symbolic names are sent in right after -rc1, i.e. here. It's only a few minor patches of this type. - Linus Walleij and others are resurrecting the 'Gemini' platform, and wanted a cut-down platform-specific defconfig for it. So I picked that up for them. - Rob Herring ran 'savedefconfig' on arm64, it's a bit churny but it helps people to prepare patches since it's a pain when defconfig and current savedefconfig contents differs too much. - Devicetree additions for some pinctrl drivers for Armada that were merged this window. I'd have preferred to see those earlier but it's not a huge deail. The biggest change worth pointing out though since it's touching other parts of the tree: We added prefixes to be used when cross-including DT contents between arm64 and arm, allowing someone to #include from arm64, and likewise. As part of that, we needed arm/foo.dtsi to work on arm as well. The way I suggested this to Heiko resulted in a recursive symlink. Instead, I've now moved it out of arch/*/boot/dts/include, into a shared location under scripts/dtc. While I was at it, I consolidated so all architectures now behave the same way in this manner. Rob Herring (DT maintainer) has acked it. I cc:d most other arch maintainers but nobody seems to care much; it doesn't really affect them since functionality is unchanged for them by default" * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (29 commits) arm64: dts: rockchip: fix include reference firmware: ti_sci: fix strncat length check ARM: remove duplicate 'const' annotations' arm64: defconfig: enable options needed for QCom DB410c board arm64: defconfig: sync with savedefconfig ARM: configs: add a gemini defconfig devicetree: Move include prefixes from arch to separate directory ARM: dts: dra7: Reduce cpu thermal shutdown temperature memory: omap-gpmc: Fix debug output for access width ARM: dts: LogicPD Torpedo: Fix camera pin mux ARM: dts: omap4: enable CEC pin for Pandaboard A4 and ES ARM: dts: gta04: fix polarity of clocks for mcbsp4 ARM: dts: dra7: Add power hold and power controller properties to palmas soc: imx: add PM dependency for IMX7_PM_DOMAINS ARM: dts: imx6sx-sdb: Remove OPP override ARM: dts: imx53-qsrb: Pulldown PMIC IRQ pin soc: bcm: brcmstb: Correctly match 7435 SoC tee: add ARM_SMCCC dependency ARM: omap2+: make omap4_get_cpu1_ns_pa_addr declaration usable ARM64: dts: mediatek: configure some fixed mmc parameters ... commit 2fe296a61a4e2ec11efc41cb8d645c52e0113f55 Merge: e5a489a 63a1e1c Author: Linus Torvalds Date: Fri May 19 13:34:34 2017 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes/cleanups from Catalin Marinas: - Avoid taking a mutex in the secondary CPU bring-up path when interrupts are disabled - Ignore perf exclude_hv when the kernel is running in Hyp mode - Remove redundant instruction in cmpxchg * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64/cpufeature: don't use mutex in bringup path arm64: perf: Ignore exclude_hv when kernel is running in HYP arm64: Remove redundant mov from LL/SC cmpxchg commit d51aff16e821a755c242e14168f5d4601199eafd Merge: 4fd8922 1de3cd4 Author: Dave Airlie Date: Sat May 20 06:00:49 2017 +1000 Merge branch 'for-upstream/hdlcd' of git://linux-arm.org/linux-ld into drm-fixes single hdlcd fix * 'for-upstream/hdlcd' of git://linux-arm.org/linux-ld: drm: hdlcd: Fix the calculation of the scanout start address commit e5a489abcfd216d07ad6b33ea0d191e61d0f25ea Merge: 8b4822d e41e53c Author: Linus Torvalds Date: Fri May 19 11:31:38 2017 -0700 Merge tag 'powerpc-4.12-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Michael Ellerman: "The headliner is a fix for FP/VMX register corruption when using transactional memory, and a new selftest to go with it. Then there's the virt_addr_valid() fix, currently HARDENDED_USERCOPY is tripping on that causing some machines to crash. A few other fairly minor fixes for long tail things, and a couple of fixes for code we just merged. Thanks to: Breno Leitao, Gautham Shenoy, Michael Neuling, Naveen Rao. Nicholas Piggin, Paul Mackerras" * tag 'powerpc-4.12-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/mm: Fix virt_addr_valid() etc. on 64-bit hash powerpc/mm: Fix crash in page table dump with huge pages powerpc/kprobes: Fix handling of instruction emulation on probe re-entry powerpc/powernv: Set NAPSTATELOST after recovering paca on P9 DD1 selftests/powerpc: Test TM and VMX register state powerpc/tm: Fix FP and VMX register corruption powerpc/modules: If mprofile-kernel is enabled add it to vermagic commit 6c0c57ac0951a3166f318b82055b6e60eeaada14 Merge: b155f05 b0804ed Author: Florian Fainelli Date: Fri May 19 11:15:10 2017 -0700 Merge tag 'bcm2835-dt-fixes-2017-05-16' into devicetree/fixes This pull request brings in a fix for booting on SMP Raspberry Pis, particularly with maxcpus=1 Signed-off-by: Florian Fainelli commit 92ceb7679ab8807d3b7fbcc6daf2279036954ef5 Author: Radim Krčmář Date: Thu May 18 19:37:32 2017 +0200 KVM: x86: prevent uninitialized variable warning in check_svme() get_msr() of MSR_EFER is currently always going to succeed, but static checker doesn't see that far. Don't complicate stuff and just use 0 for the fallback -- it means that the feature is not present. Reported-by: Dan Carpenter Reviewed-by: Paolo Bonzini Reviewed-by: David Hildenbrand Signed-off-by: Radim Krčmář arch/x86/kvm/emulate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 34b0dadbdf698f9b277a31b2747b625b9a75ea1f Author: Radim Krčmář Date: Thu May 18 19:37:31 2017 +0200 KVM: x86/vPMU: fix undefined shift in intel_pmu_refresh() Static analysis noticed that pmu->nr_arch_gp_counters can be 32 (INTEL_PMC_MAX_GENERIC) and therefore cannot be used to shift 'int'. I didn't add BUILD_BUG_ON for it as we have a better checker. Reported-by: Dan Carpenter Fixes: 25462f7f5295 ("KVM: x86/vPMU: Define kvm_pmu_ops to support vPMU function dispatch") Reviewed-by: Paolo Bonzini Reviewed-by: David Hildenbrand Signed-off-by: Radim Krčmář arch/x86/kvm/pmu_intel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f0367ee1d64d27fa08be2407df5c125442e885e3 Author: Radim Krčmář Date: Thu May 18 19:37:30 2017 +0200 KVM: x86: zero base3 of unusable segments Static checker noticed that base3 could be used uninitialized if the segment was not present (useable). Random stack values probably would not pass VMCS entry checks. Reported-by: Dan Carpenter Fixes: 1aa366163b8b ("KVM: x86 emulator: consolidate segment accessors") Reviewed-by: Paolo Bonzini Reviewed-by: David Hildenbrand Signed-off-by: Radim Krčmář arch/x86/kvm/x86.c | 2 ++ 1 file changed, 2 insertions(+) commit cbfc6c9184ce71b52df4b1d82af5afc81a709178 Author: Wanpeng Li Date: Fri May 19 02:46:56 2017 -0700 KVM: X86: Fix read out-of-bounds vulnerability in kvm pio emulation Huawei folks reported a read out-of-bounds vulnerability in kvm pio emulation. - "inb" instruction to access PIT Mod/Command register (ioport 0x43, write only, a read should be ignored) in guest can get a random number. - "rep insb" instruction to access PIT register port 0x43 can control memcpy() in emulator_pio_in_emulated() to copy max 0x400 bytes but only read 1 bytes, which will disclose the unimportant kernel memory in host but no crash. The similar test program below can reproduce the read out-of-bounds vulnerability: void hexdump(void *mem, unsigned int len) { unsigned int i, j; for(i = 0; i < len + ((len % HEXDUMP_COLS) ? (HEXDUMP_COLS - len % HEXDUMP_COLS) : 0); i++) { /* print offset */ if(i % HEXDUMP_COLS == 0) { printf("0x%06x: ", i); } /* print hex data */ if(i < len) { printf("%02x ", 0xFF & ((char*)mem)[i]); } else /* end of block, just aligning for ASCII dump */ { printf(" "); } /* print ASCII dump */ if(i % HEXDUMP_COLS == (HEXDUMP_COLS - 1)) { for(j = i - (HEXDUMP_COLS - 1); j <= i; j++) { if(j >= len) /* end of block, not really printing */ { putchar(' '); } else if(isprint(((char*)mem)[j])) /* printable char */ { putchar(0xFF & ((char*)mem)[j]); } else /* other char */ { putchar('.'); } } putchar('\n'); } } } int main(void) { int i; if (iopl(3)) { err(1, "set iopl unsuccessfully\n"); return -1; } static char buf[0x40]; /* test ioport 0x40,0x41,0x42,0x43,0x44,0x45 */ memset(buf, 0xab, sizeof(buf)); asm volatile("push %rdi;"); asm volatile("mov %0, %%rdi;"::"q"(buf)); asm volatile ("mov $0x40, %rdx;"); asm volatile ("in %dx,%al;"); asm volatile ("stosb;"); asm volatile ("mov $0x41, %rdx;"); asm volatile ("in %dx,%al;"); asm volatile ("stosb;"); asm volatile ("mov $0x42, %rdx;"); asm volatile ("in %dx,%al;"); asm volatile ("stosb;"); asm volatile ("mov $0x43, %rdx;"); asm volatile ("in %dx,%al;"); asm volatile ("stosb;"); asm volatile ("mov $0x44, %rdx;"); asm volatile ("in %dx,%al;"); asm volatile ("stosb;"); asm volatile ("mov $0x45, %rdx;"); asm volatile ("in %dx,%al;"); asm volatile ("stosb;"); asm volatile ("pop %rdi;"); hexdump(buf, 0x40); printf("\n"); /* ins port 0x40 */ memset(buf, 0xab, sizeof(buf)); asm volatile("push %rdi;"); asm volatile("mov %0, %%rdi;"::"q"(buf)); asm volatile ("mov $0x20, %rcx;"); asm volatile ("mov $0x40, %rdx;"); asm volatile ("rep insb;"); asm volatile ("pop %rdi;"); hexdump(buf, 0x40); printf("\n"); /* ins port 0x43 */ memset(buf, 0xab, sizeof(buf)); asm volatile("push %rdi;"); asm volatile("mov %0, %%rdi;"::"q"(buf)); asm volatile ("mov $0x20, %rcx;"); asm volatile ("mov $0x43, %rdx;"); asm volatile ("rep insb;"); asm volatile ("pop %rdi;"); hexdump(buf, 0x40); printf("\n"); return 0; } The vcpu->arch.pio_data buffer is used by both in/out instrutions emulation w/o clear after using which results in some random datas are left over in the buffer. Guest reads port 0x43 will be ignored since it is write only, however, the function kernel_pio() can't distigush this ignore from successfully reads data from device's ioport. There is no new data fill the buffer from port 0x43, however, emulator_pio_in_emulated() will copy the stale data in the buffer to the guest unconditionally. This patch fixes it by clearing the buffer before in instruction emulation to avoid to grant guest the stale data in the buffer. In addition, string I/O is not supported for in kernel device. So there is no iteration to read ioport %RCX times for string I/O. The function kernel_pio() just reads one round, and then copy the io size * %RCX to the guest unconditionally, actually it copies the one round ioport data w/ other random datas which are left over in the vcpu->arch.pio_data buffer to the guest. This patch fixes it by introducing the string I/O support for in kernel device in order to grant the right ioport datas to the guest. Before the patch: 0x000000: fe 38 93 93 ff ff ab ab .8...... 0x000008: ab ab ab ab ab ab ab ab ........ 0x000010: ab ab ab ab ab ab ab ab ........ 0x000018: ab ab ab ab ab ab ab ab ........ 0x000020: ab ab ab ab ab ab ab ab ........ 0x000028: ab ab ab ab ab ab ab ab ........ 0x000030: ab ab ab ab ab ab ab ab ........ 0x000038: ab ab ab ab ab ab ab ab ........ 0x000000: f6 00 00 00 00 00 00 00 ........ 0x000008: 00 00 00 00 00 00 00 00 ........ 0x000010: 00 00 00 00 4d 51 30 30 ....MQ00 0x000018: 30 30 20 33 20 20 20 20 00 3 0x000020: ab ab ab ab ab ab ab ab ........ 0x000028: ab ab ab ab ab ab ab ab ........ 0x000030: ab ab ab ab ab ab ab ab ........ 0x000038: ab ab ab ab ab ab ab ab ........ 0x000000: f6 00 00 00 00 00 00 00 ........ 0x000008: 00 00 00 00 00 00 00 00 ........ 0x000010: 00 00 00 00 4d 51 30 30 ....MQ00 0x000018: 30 30 20 33 20 20 20 20 00 3 0x000020: ab ab ab ab ab ab ab ab ........ 0x000028: ab ab ab ab ab ab ab ab ........ 0x000030: ab ab ab ab ab ab ab ab ........ 0x000038: ab ab ab ab ab ab ab ab ........ After the patch: 0x000000: 1e 02 f8 00 ff ff ab ab ........ 0x000008: ab ab ab ab ab ab ab ab ........ 0x000010: ab ab ab ab ab ab ab ab ........ 0x000018: ab ab ab ab ab ab ab ab ........ 0x000020: ab ab ab ab ab ab ab ab ........ 0x000028: ab ab ab ab ab ab ab ab ........ 0x000030: ab ab ab ab ab ab ab ab ........ 0x000038: ab ab ab ab ab ab ab ab ........ 0x000000: d2 e2 d2 df d2 db d2 d7 ........ 0x000008: d2 d3 d2 cf d2 cb d2 c7 ........ 0x000010: d2 c4 d2 c0 d2 bc d2 b8 ........ 0x000018: d2 b4 d2 b0 d2 ac d2 a8 ........ 0x000020: ab ab ab ab ab ab ab ab ........ 0x000028: ab ab ab ab ab ab ab ab ........ 0x000030: ab ab ab ab ab ab ab ab ........ 0x000038: ab ab ab ab ab ab ab ab ........ 0x000000: 00 00 00 00 00 00 00 00 ........ 0x000008: 00 00 00 00 00 00 00 00 ........ 0x000010: 00 00 00 00 00 00 00 00 ........ 0x000018: 00 00 00 00 00 00 00 00 ........ 0x000020: ab ab ab ab ab ab ab ab ........ 0x000028: ab ab ab ab ab ab ab ab ........ 0x000030: ab ab ab ab ab ab ab ab ........ 0x000038: ab ab ab ab ab ab ab ab ........ Reported-by: Moguofang Cc: Paolo Bonzini Cc: Radim Krčmář Cc: Moguofang Signed-off-by: Wanpeng Li Cc: stable@vger.kernel.org Signed-off-by: Radim Krčmář arch/x86/kvm/x86.c | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) commit e2c2206a18993bc9f62393d49c7b2066c3845b25 Author: Wanpeng Li Date: Thu May 11 18:12:05 2017 -0700 KVM: x86: Fix potential preemption when get the current kvmclock timestamp BUG: using __this_cpu_read() in preemptible [00000000] code: qemu-system-x86/2809 caller is __this_cpu_preempt_check+0x13/0x20 CPU: 2 PID: 2809 Comm: qemu-system-x86 Not tainted 4.11.0+ #13 Call Trace: dump_stack+0x99/0xce check_preemption_disabled+0xf5/0x100 __this_cpu_preempt_check+0x13/0x20 get_kvmclock_ns+0x6f/0x110 [kvm] get_time_ref_counter+0x5d/0x80 [kvm] kvm_hv_process_stimers+0x2a1/0x8a0 [kvm] ? kvm_hv_process_stimers+0x2a1/0x8a0 [kvm] ? kvm_arch_vcpu_ioctl_run+0xac9/0x1ce0 [kvm] kvm_arch_vcpu_ioctl_run+0x5bf/0x1ce0 [kvm] kvm_vcpu_ioctl+0x384/0x7b0 [kvm] ? kvm_vcpu_ioctl+0x384/0x7b0 [kvm] ? __fget+0xf3/0x210 do_vfs_ioctl+0xa4/0x700 ? __fget+0x114/0x210 SyS_ioctl+0x79/0x90 entry_SYSCALL_64_fastpath+0x23/0xc2 RIP: 0033:0x7f9d164ed357 ? __this_cpu_preempt_check+0x13/0x20 This can be reproduced by run kvm-unit-tests/hyperv_stimer.flat w/ CONFIG_PREEMPT and CONFIG_DEBUG_PREEMPT enabled. Safe access to per-CPU data requires a couple of constraints, though: the thread working with the data cannot be preempted and it cannot be migrated while it manipulates per-CPU variables. If the thread is preempted, the thread that replaces it could try to work with the same variables; migration to another CPU could also cause confusion. However there is no preemption disable when reads host per-CPU tsc rate to calculate the current kvmclock timestamp. This patch fixes it by utilizing get_cpu/put_cpu pair to guarantee both __this_cpu_read() and rdtsc() are not preempted. Cc: Paolo Bonzini Cc: Radim Krčmář Signed-off-by: Wanpeng Li Reviewed-by: Paolo Bonzini Cc: stable@vger.kernel.org Signed-off-by: Radim Krčmář arch/x86/kvm/x86.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) commit f746aa5e8636c83e53bbb2d988bb614f732b2b80 Author: Stefan Agner Date: Mon May 15 14:00:31 2017 -0700 ASoC: simple-card: fix mic jack initialization Initialize asoc_simple_card_init_mic with the correct struct asoc_simple_jack. Fixes: 9eac361877b3 ("ASoC: simple-card: add new asoc_simple_jack and use it") Signed-off-by: Stefan Agner Acked-by: Kuninori Morimoto Signed-off-by: Mark Brown sound/soc/generic/simple-card.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1f8754d4daea5f257370a52a30fcb22798c54516 Author: Kuninori Morimoto Date: Tue May 16 01:48:24 2017 +0000 ASoC: rsnd: don't call free_irq() on Parent SSI If SSI uses shared pin, some SSI will be used as parent SSI. Then, normal SSI's remove and Parent SSI's remove (these are same SSI) will be called when unbind or remove timing. In this case, free_irq() will be called twice. This patch solve this issue. Signed-off-by: Kuninori Morimoto Tested-by: Hiroyuki Yokoyama Reported-by: Hiroyuki Yokoyama Signed-off-by: Mark Brown sound/soc/sh/rcar/ssi.c | 5 +++++ 1 file changed, 5 insertions(+) commit 5f3394530fbe90d3bcd1c204618960bc50236578 Author: Shaohua Li Date: Fri May 19 08:04:59 2017 -0700 blktrace: fix integer parse sscanf is a very poor way to parse integer. For example, I input "discard" for act_mask, it gets 0xd and completely messes up. Using correct API to do integer parse. This patch also makes attributes accept any base of integer. Signed-off-by: Shaohua Li Signed-off-by: Jens Axboe kernel/trace/blktrace.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 3ecb3ac7b950ff8f6c6a61e8b7b0d6e3546429a0 Author: Darrick J. Wong Date: Mon May 15 19:16:15 2017 -0700 xfs: avoid mount-time deadlock in CoW extent recovery If a malicious user corrupts the refcount btree to cause a cycle between different levels of the tree, the next mount attempt will deadlock in the CoW recovery routine while grabbing buffer locks. We can use the ability to re-grab a buffer that was previous locked to a transaction to avoid deadlocks, so do that here. Signed-off-by: Darrick J. Wong Reviewed-by: Brian Foster fs/xfs/libxfs/xfs_refcount.c | 43 +++++++++++++++++++++++++++++++------------ 1 file changed, 31 insertions(+), 12 deletions(-) commit 9d6408433019bfae15e2d0d5f4498c4ff70b86c0 Author: Ard Biesheuvel Date: Fri May 19 09:56:40 2017 +0100 i2c: designware: don't infer timings described by ACPI from clock rate Commit bd698d24b1b57 ("i2c: designware: Get selected speed mode sda-hold-time via ACPI") updated the logic that reads the timing parameters for various I2C bus rates from the DSDT, to only read the timing parameters for the currently selected mode. This causes a WARN_ON() splat on platforms that legally omit the clock frequency from the ACPI description, because in the new situation, the core I2C designware driver still accesses the fields in the driver struct that we no longer populate, and proceeds to calculate them from the clock frequency. Since the clock frequency is unspecified, the driver complains loudly using a WARN_ON(). So revert back to the old situation, where the struct fields for all timings are populated, but retain the new logic which chooses the SDA hold time from the timing mode that is currently in use. Fixes: bd698d24b1b57 ("i2c: designware: Get selected speed mode ...") Signed-off-by: Ard Biesheuvel Reported-by: Lorenzo Pieralisi Acked-by: Jarkko Nikula Signed-off-by: Wolfram Sang drivers/i2c/busses/i2c-designware-platdrv.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) commit 6bf1c2d26716dcd483699cc62474e49d164c5563 Author: Arnd Bergmann Date: Fri May 19 14:12:00 2017 +0200 arm64: dts: rockchip: fix include reference The way we handle include paths for DT has changed a bit, which broke a file that had an unconventional way to reference a common header file: arch/arm64/boot/dts/rockchip/rk3399-gru-kevin.dts:47:10: fatal error: include/dt-bindings/input/linux-event-codes.h: No such file or directory This removes the leading "include/" from the path name, which fixes it. Fixes: d5d332d3f7e8 ("devicetree: Move include prefixes from arch to separate directory") Signed-off-by: Arnd Bergmann arch/arm64/boot/dts/rockchip/rk3399-gru-kevin.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a486cd23661c9387fb076c3f6ae8b2aa9d20d54a Author: Antony Antony Date: Fri May 19 12:47:00 2017 +0200 xfrm: fix state migration copy replay sequence numbers During xfrm migration copy replay and preplay sequence numbers from the previous state. Here is a tcpdump output showing the problem. 10.0.10.46 is running vanilla kernel, is the IKE/IPsec responder. After the migration it sent wrong sequence number, reset to 1. The migration is from 10.0.0.52 to 10.0.0.53. IP 10.0.0.52.4500 > 10.0.10.46.4500: UDP-encap: ESP(spi=0x43ef462d,seq=0x7cf), length 136 IP 10.0.10.46.4500 > 10.0.0.52.4500: UDP-encap: ESP(spi=0xca1c282d,seq=0x7cf), length 136 IP 10.0.0.52.4500 > 10.0.10.46.4500: UDP-encap: ESP(spi=0x43ef462d,seq=0x7d0), length 136 IP 10.0.10.46.4500 > 10.0.0.52.4500: UDP-encap: ESP(spi=0xca1c282d,seq=0x7d0), length 136 IP 10.0.0.53.4500 > 10.0.10.46.4500: NONESP-encap: isakmp: child_sa inf2[I] IP 10.0.10.46.4500 > 10.0.0.53.4500: NONESP-encap: isakmp: child_sa inf2[R] IP 10.0.0.53.4500 > 10.0.10.46.4500: NONESP-encap: isakmp: child_sa inf2[I] IP 10.0.10.46.4500 > 10.0.0.53.4500: NONESP-encap: isakmp: child_sa inf2[R] IP 10.0.0.53.4500 > 10.0.10.46.4500: UDP-encap: ESP(spi=0x43ef462d,seq=0x7d1), length 136 NOTE: next sequence is wrong 0x1 IP 10.0.10.46.4500 > 10.0.0.53.4500: UDP-encap: ESP(spi=0xca1c282d,seq=0x1), length 136 IP 10.0.0.53.4500 > 10.0.10.46.4500: UDP-encap: ESP(spi=0x43ef462d,seq=0x7d2), length 136 IP 10.0.10.46.4500 > 10.0.0.53.4500: UDP-encap: ESP(spi=0xca1c282d,seq=0x2), length 136 Signed-off-by: Antony Antony Reviewed-by: Richard Guy Briggs Signed-off-by: Steffen Klassert net/xfrm/xfrm_state.c | 2 ++ 1 file changed, 2 insertions(+) commit a1a745ef980a1b48299ead4ea7990e62c0516f6e Author: Andreas Pape Date: Fri May 19 10:01:42 2017 +0200 batman-adv: fix memory leak when dropping packet from other gateway The skb must be released in the receive handler since b91a2543b4c1 ("batman-adv: Consume skb in receive handlers"). Just returning NET_RX_DROP will no longer automatically free the memory. This results in memory leaks when unicast packets from other backbones must be dropped because they share a common backbone. Fixes: 9e794b6bf4a2 ("batman-adv: drop unicast packets from other backbone gw") Signed-off-by: Andreas Pape [sven@narfation.org: adjust commit message] Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich net/batman-adv/routing.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 36d4d68cd658d914ef73ac845705c4a89e7d9e2f Author: Sven Eckelmann Date: Wed Apr 5 16:26:17 2017 +0200 batman-adv: Fix rx packet/bytes stats on local ARP reply The stats are generated by batadv_interface_stats and must not be stored directly in the net_device stats member variable. The batadv_priv bat_counters information is assembled when ndo_get_stats is called. The stats previously stored in net_device::stats is then overwritten. The batman-adv counters must therefore be increased when an ARP packet is answered locally via the distributed arp table. Fixes: c384ea3ec930 ("batman-adv: Distributed ARP Table - add snooping functions for ARP messages") Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich net/batman-adv/distributed-arp-table.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit fe06fe860250a4f01d0eaf70a2563b1997174a74 Author: Michael Ellerman Date: Fri May 19 11:29:04 2017 +1000 selftests/powerpc: Fix TM resched DSCR test with some compilers The tm-resched-dscr test has started failing sometimes, depending on what compiler it's built with, eg: test: tm_resched_dscr Check DSCR TM context switch: tm-resched-dscr: tm-resched-dscr.c:76: test_body: Assertion `rv' failed. !! child died by signal 6 When it fails we see that the compiler doesn't initialise rv to 1 before entering the inline asm block. Although that's counter intuitive, it is allowed because we tell the compiler that the inline asm will write to rv (using "=r"), meaning the original value is irrelevant. Marking it as a read/write parameter would presumably work, but it seems simpler to fix it by setting the initial value of rv in the inline asm. Fixes: 96d016108640 ("powerpc: Correct DSCR during TM context switch") Signed-off-by: Michael Ellerman Acked-by: Michael Neuling tools/testing/selftests/powerpc/tm/tm-resched-dscr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 46cd902f6d9a746f0da816cbdfb04b9baf6d7967 Author: Chuanxiao Dong Date: Thu May 11 18:07:42 2017 +0800 drm/i915: set initialised only when init_context callback is NULL During execlist_context_deferred_alloc() we presumed that the context is uninitialised (we only just allocated the state object for it!) and chose to optimise away the later call to engine->init_context() if engine->init_context were NULL. This breaks with GVT's contexts that are marked as pre-initialised to avoid us annoyingly calling engine->init_context(). The fix is to not override ce->initialised if it is already true. Cc: Chris Wilson Signed-off-by: Chuanxiao Dong Link: http://patchwork.freedesktop.org/patch/msgid/1494497262-24855-1-git-send-email-chuanxiao.dong@intel.com Reviewed-by: Chris Wilson Signed-off-by: Chris Wilson (cherry picked from commit 0d402a24df8c8160727af934d83293f3d44d31a3) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_lrc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 53bf9590151e06e3f74212fea8da2eca2385db76 Author: Wei Yongjun Date: Tue Apr 25 03:14:54 2017 +0000 phy: qcom-qmp: fix return value check in qcom_qmp_phy_create() In case of error, the function of_iomap() returns NULL pointer not ERR_PTR(). The IS_ERR() test in the return value check should be replaced with NULL test. Fixes: e78f3d15e115 ("phy: qcom-qmp: new qmp phy driver for qcom-chipsets") Reviewed-by: Vivek Gautam Signed-off-by: Wei Yongjun Signed-off-by: Kishon Vijay Abraham I drivers/phy/phy-qcom-qmp.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit fedf266f9955d9a019643cde199a2fd9a0259f6f Author: Eric Anholt Date: Thu Apr 27 18:02:32 2017 -0700 watchdog: bcm281xx: Fix use of uninitialized spinlock. The bcm_kona_wdt_set_resolution_reg() call takes the spinlock, so initialize it earlier. Fixes a warning at boot with lock debugging enabled. Fixes: 6adb730dc208 ("watchdog: bcm281xx: Watchdog Driver") Signed-off-by: Eric Anholt Reviewed-by: Florian Fainelli Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/bcm_kona_wdt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 07441a7dd11f6855bcf55fbbfc6abba42258b2c6 Author: Wei Yongjun Date: Tue Apr 25 16:17:33 2017 +0000 watchdog: zx2967: remove redundant dev_err call in zx2967_wdt_probe() There is a error message within devm_ioremap_resource already, so remove the dev_err call to avoid redundant error message. Signed-off-by: Wei Yongjun Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/zx2967_wdt.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 1fccb73011ea8a5fa0c6d357c33fa29c695139ea Author: Paolo Bonzini Date: Wed Apr 5 13:41:15 2017 +0200 iTCO_wdt: all versions count down twice The ICH9 is listed as having TCO v2, and indeed the behavior in the datasheet corresponds to v2 (for example the NO_REBOOT flag is accessible via the 16KiB-aligned Root Complex Base Address). However, the TCO counts twice just like in v1; the documentation of the SECOND_TO_STS bit says: "ICH9 sets this bit to 1 to indicate that the TIMEOUT bit had been (or is currently) set and a second timeout occurred before the TCO_RLD register was written. If this bit is set and the NO_REBOOT config bit is 0, then the ICH9 will reboot the system after the second timeout. The same can be found in the BayTrail (Atom E3800) datasheet, and even HOWTOs around the Internet say that it will reboot after _twice_ the specified heartbeat. I did not find the Apollo Lake datasheet, but because v4/v5 has a SECOND_TO_STS bit just like the previous version I'm enabling this for Apollo Lake as well. Cc: linux-watchdog@vger.kernel.org Reviewed-by: Andy Shevchenko Signed-off-by: Paolo Bonzini Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck Documentation/watchdog/watchdog-parameters.txt | 2 +- drivers/watchdog/iTCO_wdt.c | 22 ++++++++++------------ 2 files changed, 11 insertions(+), 13 deletions(-) commit 76cefef8e838304a71725a0b5007c375619d78fb Author: Arnd Bergmann Date: Wed Jan 11 12:53:05 2017 +0100 firmware: ti_sci: fix strncat length check gcc-7 notices that the length we pass to strncat is wrong: drivers/firmware/ti_sci.c: In function 'ti_sci_probe': drivers/firmware/ti_sci.c:204:32: error: specified bound 50 equals the size of the destination [-Werror=stringop-overflow=] Instead of the total length, we must pass the length of the remaining space here. Fixes: aa276781a64a ("firmware: Add basic support for TI System Control Interface (TI-SCI) protocol") Cc: stable@vger.kernel.org Acked-by: Nishanth Menon Acked-by: Santosh Shilimkar Signed-off-by: Arnd Bergmann drivers/firmware/ti_sci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 0527873b29b077fc8e656acd63e1866b429fef55 Author: Arnd Bergmann Date: Thu May 11 13:50:16 2017 +0200 ARM: remove duplicate 'const' annotations' gcc-7 warns about some declarations that are more 'const' than necessary: arch/arm/mach-at91/pm.c:338:34: error: duplicate 'const' declaration specifier [-Werror=duplicate-decl-specifier] static const struct of_device_id const ramc_ids[] __initconst = { arch/arm/mach-bcm/bcm_kona_smc.c:36:34: error: duplicate 'const' declaration specifier [-Werror=duplicate-decl-specifier] static const struct of_device_id const bcm_kona_smc_ids[] __initconst = { arch/arm/mach-spear/time.c:207:34: error: duplicate 'const' declaration specifier [-Werror=duplicate-decl-specifier] static const struct of_device_id const timer_of_match[] __initconst = { arch/arm/mach-omap2/prm_common.c:714:34: error: duplicate 'const' declaration specifier [-Werror=duplicate-decl-specifier] static const struct of_device_id const omap_prcm_dt_match_table[] __initconst = { arch/arm/mach-omap2/vc.c:562:35: error: duplicate 'const' declaration specifier [-Werror=duplicate-decl-specifier] static const struct i2c_init_data const omap4_i2c_timing_data[] __initconst = { The ones in arch/arm were apparently all introduced accidentally by one commit that correctly marked a lot of variables as __initconst. Fixes: 19c233b79d1a ("ARM: appropriate __init annotation for const data") Acked-by: Alexandre Belloni Acked-by: Tony Lindgren Acked-by: Nicolas Pitre Acked-by: Florian Fainelli Acked-by: Viresh Kumar Acked-by: Krzysztof Hałasa Signed-off-by: Arnd Bergmann arch/arm/mach-at91/pm.c | 2 +- arch/arm/mach-bcm/bcm_kona_smc.c | 2 +- arch/arm/mach-cns3xxx/core.c | 2 +- arch/arm/mach-omap2/prm_common.c | 2 +- arch/arm/mach-omap2/vc.c | 2 +- arch/arm/mach-spear/time.c | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) commit b51e0ceed1f93a1eda3cbee328a396a188ec79e3 Merge: 6df2b42 8d7a10d Author: Greg Kroah-Hartman Date: Fri May 19 10:10:07 2017 +0200 Merge tag 'usb-serial-4.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB-serial fixes for v4.12-rc2 Here's a fix for a long-standing issue in the ftdi_sio driver that prevented unprivileged users from updating the low-latency flag, something which became apparent after a recent change that restored the older setting of not using low-latency mode by default. A run of sparse revealed a couple of endianness issues that are now fixed, and addressed is also a user-triggerable division-by-zero in io_ti when debugging is enabled. Finally there are some new device ids, including a simplification of how we deal with a couple of older Olimex JTAG adapters. All have been in linux-next with no reported issues. Signed-off-by: Johan Hovold commit ee1d6d37b6b884383b501089be93ce94f2153028 Author: Amir Goldstein Date: Thu May 11 16:42:26 2017 +0300 ovl: mark upper dir with type origin entries "impure" When moving a merge dir or non-dir with copy up origin into a non-merge upper dir (a.k.a pure upper dir), we are marking the target parent dir "impure". ovl_iterate() iterates pure upper dirs directly, because there is no need to filter out whiteouts and merge dir content with lower dir. But for the case of an "impure" upper dir, ovl_iterate() will not be able to iterate the real upper dir directly, because it will need to lookup the origin inode and use it to fill d_ino. Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi fs/overlayfs/dir.c | 45 +++++++++++++++++++++++++++++++++++++++++++++ fs/overlayfs/namei.c | 18 ++++++++++++++++-- fs/overlayfs/overlayfs.h | 3 +++ fs/overlayfs/ovl_entry.h | 1 + fs/overlayfs/util.c | 14 ++++++++++++++ 5 files changed, 79 insertions(+), 2 deletions(-) commit 3d27573ce32b47ba54e6680c77c26a700d67cc16 Author: Miklos Szeredi Date: Fri May 19 09:33:49 2017 +0200 ovl: remove unused arg from ovl_lookup_temp() Signed-off-by: Miklos Szeredi fs/overlayfs/copy_up.c | 2 +- fs/overlayfs/dir.c | 8 ++++---- fs/overlayfs/overlayfs.h | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) commit 21a228781104ae6fed7e720137ab024575071feb Author: Amir Goldstein Date: Wed May 17 00:12:41 2017 +0300 ovl: handle rename when upper doesn't support xattr On failure to set opaque/redirect xattr on rename, skip setting xattr and return -EXDEV. On failure to set opaque xattr when creating a new directory, -EIO is returned instead of -EOPNOTSUPP. Any failure to set those xattr will be recorded in super block and then setting any xattr on upper won't be attempted again. Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi fs/overlayfs/dir.c | 29 +++++++++++++++++++---------- fs/overlayfs/overlayfs.h | 1 - fs/overlayfs/util.c | 9 +-------- 3 files changed, 20 insertions(+), 19 deletions(-) commit 899e4aad15e93315fa18ab9e9c88904ad237cfa0 Author: David Daney Date: Tue May 16 11:36:52 2017 +0200 mmc: cavium-octeon: Use proper GPIO name for power control The devm_gpiod_get_optional() function appends a "-gpios" to the string passed to it, so if we want to find the "power-gpios" signal, we must pass "power" to this function. Fixes: 01d95843335c ("mmc: cavium: Add MMC support for Octeon SOCs.") Signed-off-by: David Daney [jglauber@cavium.com: removed point after subject line] Signed-off-by: Jan Glauber Signed-off-by: Ulf Hansson drivers/mmc/host/cavium-octeon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit aca69344c8a99e7374d913e42ba9120c398ee16f Author: David Daney Date: Tue May 16 11:36:51 2017 +0200 mmc: cavium-octeon: Fix interrupt enable code OCTEON SoCs with CIU3 do not have interrupt masking local to the MMC bus interface. Unfortunately, some even have a diagnostic register at the same address of the enable register, which causes the interrupts to fire immediately if stored to, thus breaking the driver. The proper action on these SoCs is not to touch this register. Fixes: 01d95843335c ("mmc: cavium: Add MMC support for Octeon SOCs.") Signed-off-by: David Daney [jglauber@cavium.com: removed point after subject line] Signed-off-by: Jan Glauber Signed-off-by: Ulf Hansson drivers/mmc/host/cavium-octeon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ec16187a631d410157791997cb29901466420485 Merge: 6a3538c bca5238 Author: Olof Johansson Date: Fri May 19 00:02:16 2017 -0700 Merge tag 'omap-for-v4.12/fixes-v2-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes Fixes for omaps for v4.12-rc cycle most consisting of few minor dts fixes for various devices. Also included is a memory controller (GPMC) debug output fix as without that the shown bootloader configured GPMC bus width will be wrong and won't work for kernel timings: - Add dra7 powerhold configuration to be able to shut down pmic correctly - Fix polarity for gta04 mcbsp4 clocks for modem - Fix Pandaboard CEC pin pull making it usable - Fix LogicPD Torpedo camera pin mux - Fix GPMC debug bus width - Reduce cpu thermal shutdown temperature * tag 'omap-for-v4.12/fixes-v2-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: ARM: dts: dra7: Reduce cpu thermal shutdown temperature memory: omap-gpmc: Fix debug output for access width ARM: dts: LogicPD Torpedo: Fix camera pin mux ARM: dts: omap4: enable CEC pin for Pandaboard A4 and ES ARM: dts: gta04: fix polarity of clocks for mcbsp4 ARM: dts: dra7: Add power hold and power controller properties to palmas Signed-off-by: Olof Johansson commit 6a3538c1744b1a45e723dc94efa6931e96ce5713 Merge: f4e506c e23c7f7 Author: Olof Johansson Date: Fri May 19 00:02:04 2017 -0700 Merge tag 'imx-fixes-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into fixes i.MX fixes for 4.12: - A fix on GPCv2 power domain driver Kconfig which causes a build failure when CONFIG_PM is not set. - Pull down PMIC IRQ pin for imx53-qsrb board to prevent spurious PMIC interrupts from happening. - Remove board level OPP override for imx6sx-sdb to fix a boot crash seen on Rev.C boards. * tag 'imx-fixes-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: soc: imx: add PM dependency for IMX7_PM_DOMAINS ARM: dts: imx6sx-sdb: Remove OPP override ARM: dts: imx53-qsrb: Pulldown PMIC IRQ pin Signed-off-by: Olof Johansson commit f4e506c5a3a026a28c99ca2cbc1c79aeca1a1b68 Author: Rob Herring Date: Wed May 17 16:52:30 2017 -0500 arm64: defconfig: enable options needed for QCom DB410c board Enable Qualcomm drivers needed to boot Dragonboard 410c with HDMI. This enables support for clocks, regulators, and USB PHY. Cc: Bjorn Andersson Cc: John Stultz Signed-off-by: Rob Herring [Olof: Turned off _RPM configs per follow-up email] Signed-off-by: Olof Johansson arch/arm64/configs/defconfig | 7 +++++++ 1 file changed, 7 insertions(+) commit bae3dee0992dcb336a591468376b046e5447997b Author: Jisheng Zhang Date: Tue May 16 14:17:20 2017 +0800 mmc: sdhci-xenon: kill xenon_clean_phy() Currently, the xenon_clean_phy() is only used for freeing phy_params. The phy_params is allocated by devm_kzalloc(), there's no need to free is explicitly. Signed-off-by: Jisheng Zhang Acked-by: Hu Ziji Acked-by: Adrian Hunter drivers/mmc/host/sdhci-xenon-phy.c | 14 +------------- drivers/mmc/host/sdhci-xenon.c | 6 +----- drivers/mmc/host/sdhci-xenon.h | 1 - 3 files changed, 2 insertions(+), 19 deletions(-) commit eb1e6716cc9c6fd22e706379ab082b4ac198a1b1 Author: Rob Herring Date: Wed May 17 16:52:29 2017 -0500 arm64: defconfig: sync with savedefconfig Sync the defconfig with savedefconfig as config options change/move over time. Generated with the following commands: make defconfig make savedefconfig cp defconfig arch/arm64/configs/defconfig Signed-off-by: Rob Herring Signed-off-by: Olof Johansson arch/arm64/configs/defconfig | 103 ++++++++++++++++++------------------------- 1 file changed, 42 insertions(+), 61 deletions(-) commit 877dd4b1f7986bd7ca31b1e69589289e4aa3e066 Author: Linus Walleij Date: Sun May 14 23:45:02 2017 +0200 ARM: configs: add a gemini defconfig It makes sense to have a stripped-down defconfig for just Gemini, as it is a pretty small platform used in NAS etc, and will use appended device tree. It is also quick to compile and test. Hopefully this defconfig can be a good base for distributions such as OpenWRT. I plan to add in the config options needed for the different variants of Gemini as we go along. Cc: Janos Laube Cc: Paulius Zaleckas Cc: Hans Ulli Kroll Cc: Florian Fainelli Signed-off-by: Linus Walleij Signed-off-by: Olof Johansson arch/arm/configs/gemini_defconfig | 68 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 68 insertions(+) commit 3d2ba3fb544385f335ddb34afd97e480acabb87e Merge: 5cb1ac0 31d848a Author: Olof Johansson Date: Thu May 18 23:56:26 2017 -0700 Merge tag 'arm-soc/for-4.12/drivers-fixes' of http://github.com/Broadcom/stblinux into fixes This pull request contains Broadcom SoC drivers fixes for 4.12, please pull the following: - Florian removes the duplicate compatible string matched by the SUN_TOP_CTRL driver and instead uses the correct one for 7435 * tag 'arm-soc/for-4.12/drivers-fixes' of http://github.com/Broadcom/stblinux: soc: bcm: brcmstb: Correctly match 7435 SoC Signed-off-by: Olof Johansson commit 5cb1ac0f7906cea3d978e54023e9432e910579c8 Merge: d5d332d b155f05 Author: Olof Johansson Date: Thu May 18 23:55:53 2017 -0700 Merge tag 'arm-soc/for-4.12/devicetree-fixes' of http://github.com/Broadcom/stblinux into fixes This pull request contains Broadcom ARM-based SoC Device Tree fixes for 4.12, please pull the following: - Baruch provides several fixes for the Raspberry Pi (BCM2835) Device Tree source include file: uart0 pinctrl node names, pin number for i2c0, uart0 rts/cts pins and invalid uart1 pin, missing numbers for ethernet aliases * tag 'arm-soc/for-4.12/devicetree-fixes' of http://github.com/Broadcom/stblinux: ARM: dts: bcm2835: add index to the ethernet alias ARM: dts: bcm2835: fix uart0/uart1 pins ARM: dts: bcm2835: fix i2c0 pins ARM: dts: bcm2835: fix uart0 pinctrl node names Signed-off-by: Olof Johansson commit d5d332d3f7e8435e264a71b90178dee69428d630 Author: Olof Johansson Date: Fri May 12 20:13:26 2017 -0700 devicetree: Move include prefixes from arch to separate directory We use a directory under arch/$ARCH/boot/dts as an include path that has links outside of the subtree to find dt-bindings from under include/dt-bindings. That's been working well, but new DT architectures haven't been adding them by default. Recently there's been a desire to share some of the DT material between arm and arm64, which originally caused developers to create symlinks or relative includes between the subtrees. This isn't ideal -- it breaks if the DT files aren't stored in the exact same hierarchy as the kernel tree, and generally it's just icky. As a somewhat cleaner solution we decided to add a $ARCH/ prefix link once, and allow DTS files to reference dtsi (and dts) files in other architectures that way. Original approach was to create these links under each architecture, but it lead to the problem of recursive symlinks. As a remedy, move the include link directories out of the architecture trees into a common location. At the same time, they can now share one directory and one dt-bindings/ link as well. Fixes: 4027494ae6e3 ('ARM: dts: add arm/arm64 include symlinks') Reported-by: Russell King Reported-by: Omar Sandoval Reviewed-by: Heiko Stuebner Reviewed-by: Masahiro Yamada Tested-by: Heiko Stuebner Acked-by: Rob Herring Cc: Heiko Stuebner Cc: Mark Rutland Cc: Russell King Cc: Catalin Marinas Cc: Will Deacon Cc: Mikael Starvik Cc: Jesper Nilsson Cc: James Hogan Cc: Ralf Baechle Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Michael Ellerman Cc: Frank Rowand Cc: linux-arch Signed-off-by: Olof Johansson arch/arm/boot/dts/include/arm | 1 - arch/arm/boot/dts/include/arm64 | 1 - arch/arm/boot/dts/include/dt-bindings | 1 - arch/arm64/boot/dts/include/arm | 1 - arch/arm64/boot/dts/include/arm64 | 1 - arch/arm64/boot/dts/include/dt-bindings | 1 - arch/cris/boot/dts/include/dt-bindings | 1 - arch/metag/boot/dts/include/dt-bindings | 1 - arch/mips/boot/dts/include/dt-bindings | 1 - arch/powerpc/boot/dts/include/dt-bindings | 1 - scripts/Makefile.lib | 2 +- scripts/dtc/include-prefixes/arc | 1 + scripts/dtc/include-prefixes/arm | 1 + scripts/dtc/include-prefixes/arm64 | 1 + scripts/dtc/include-prefixes/c6x | 1 + scripts/dtc/include-prefixes/cris | 1 + scripts/dtc/include-prefixes/dt-bindings | 1 + scripts/dtc/include-prefixes/h8300 | 1 + scripts/dtc/include-prefixes/metag | 1 + scripts/dtc/include-prefixes/microblaze | 1 + scripts/dtc/include-prefixes/mips | 1 + scripts/dtc/include-prefixes/nios2 | 1 + scripts/dtc/include-prefixes/openrisc | 1 + scripts/dtc/include-prefixes/powerpc | 1 + scripts/dtc/include-prefixes/sh | 1 + scripts/dtc/include-prefixes/xtensa | 1 + 26 files changed, 16 insertions(+), 11 deletions(-) commit 5252d73756f318f182f2316acd78a6532041414d Merge: e841888 2ea659a Author: Olof Johansson Date: Thu May 18 23:54:47 2017 -0700 Merge tag 'v4.12-rc1' into fixes We've received a few fixes branches with -rc1 as base, but our contents was still at pre-rc1. Merge it in expliticly to make 'git merge --log' clear on hat was actually merged. Signed-off-by: Olof Johansson commit c71e6d804c88168ecf02aaf14e1fd5773d683b5f Author: Juergen Gross Date: Thu May 18 17:46:48 2017 +0200 xen: make xen_flush_tlb_all() static xen_flush_tlb_all() is used in arch/x86/xen/mmu.c only. Make it static. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross arch/x86/xen/mmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 989513a735f51407280acd91e436d83eb48514cd Author: Juergen Gross Date: Tue May 16 09:41:06 2017 +0200 xen: cleanup pvh leftovers from pv-only sources There are some leftovers testing for pvh guest mode in pv-only source files. Remove them. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross arch/x86/xen/enlighten_pv.c | 15 ++----- arch/x86/xen/mmu_pv.c | 102 +++++++++++++++++--------------------------- 2 files changed, 42 insertions(+), 75 deletions(-) commit a33d7d94eed92b23fbbc7b0de06a41b2bbaa49e3 Author: Steven Rostedt (VMware) Date: Fri May 12 13:15:45 2017 -0400 tracing: Make sure RCU is watching before calling a stack trace As stack tracing now requires "rcu watching", force RCU to be watching when recording a stack trace. Link: http://lkml.kernel.org/r/20170512172449.879684501@goodmis.org Acked-by: Paul E. McKenney Signed-off-by: Steven Rostedt (VMware) kernel/trace/trace.c | 31 ++++++++++++++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-) commit e41e53cd4fe331d0d1f06f8e4ed7e2cc63ee2c34 Author: Michael Ellerman Date: Thu May 18 20:37:31 2017 +1000 powerpc/mm: Fix virt_addr_valid() etc. on 64-bit hash virt_addr_valid() is supposed to tell you if it's OK to call virt_to_page() on an address. What this means in practice is that it should only return true for addresses in the linear mapping which are backed by a valid PFN. We are failing to properly check that the address is in the linear mapping, because virt_to_pfn() will return a valid looking PFN for more or less any address. That bug is actually caused by __pa(), used in virt_to_pfn(). eg: __pa(0xc000000000010000) = 0x10000 # Good __pa(0xd000000000010000) = 0x10000 # Bad! __pa(0x0000000000010000) = 0x10000 # Bad! This started happening after commit bdbc29c19b26 ("powerpc: Work around gcc miscompilation of __pa() on 64-bit") (Aug 2013), where we changed the definition of __pa() to work around a GCC bug. Prior to that we subtracted PAGE_OFFSET from the value passed to __pa(), meaning __pa() of a 0xd or 0x0 address would give you something bogus back. Until we can verify if that GCC bug is no longer an issue, or come up with another solution, this commit does the minimal fix to make virt_addr_valid() work, by explicitly checking that the address is in the linear mapping region. Fixes: bdbc29c19b26 ("powerpc: Work around gcc miscompilation of __pa() on 64-bit") Signed-off-by: Michael Ellerman Reviewed-by: Paul Mackerras Reviewed-by: Balbir Singh Tested-by: Breno Leitao arch/powerpc/include/asm/page.h | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit 1bad6c4a57efda0d5f5bf8a2403b21b1ed24875c Author: Long Li Date: Thu May 18 15:40:05 2017 -0700 scsi: zero per-cmd private driver data for each MQ I/O In lower layer driver's (LLD) scsi_host_template, the driver may optionally ask SCSI to allocate its private driver memory for each command, by specifying cmd_size. This memory is allocated at the end of scsi_cmnd by SCSI. Later when SCSI queues a command, the LLD can use scsi_cmd_priv to get to its private data. Some LLD, e.g. hv_storvsc, doesn't clear its private data before use. In this case, the LLD may get to stale or uninitialized data in its private driver memory. This may result in unexpected driver and hardware behavior. Fix this problem by also zeroing the private driver memory before passing them to LLD. Signed-off-by: Long Li Reviewed-by: Bart Van Assche Reviewed-by: KY Srinivasan Reviewed-by: Christoph Hellwig CC: # 4.11+ Signed-off-by: Martin K. Petersen drivers/scsi/scsi_lib.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a351e40b6de550049423a26f7ded7b639e363d89 Author: Varun Prakash Date: Wed May 17 20:30:43 2017 +0530 scsi: csiostor: fix use after free in csio_hw_use_fwconfig() mbp pointer is passed to csio_hw_validate_caps() so call mempool_free() after calling csio_hw_validate_caps(). Signed-off-by: Varun Prakash Fixes: 541c571fa2fd ("csiostor:Use firmware version from cxgb4/t4fw_version.h") Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen drivers/scsi/csiostor/csio_hw.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 463f620b1256e0488d932088e04a372817e8c42e Author: Michał Potomski Date: Fri May 12 08:36:27 2017 +0200 scsi: ufs: Clean up some rpm/spm level SysFS nodes upon remove When reloading module these two attributes aren't cleaned up properly and they persist causing warnings when trying to load module again. Additionally they are not recreated properly due to that. Signed-off-by: Michał Potomski Reviewed-by: Subhash Jadavani Signed-off-by: Martin K. Petersen drivers/scsi/ufs/ufshcd.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 4fd8922689c9d73edc93473552987ea81e11463e Merge: e629612 2f720aa Author: Dave Airlie Date: Fri May 19 10:23:14 2017 +1000 Merge tag 'drm-intel-fixes-2017-05-18-1' of git://anongit.freedesktop.org/git/drm-intel into drm-fixes drm/i915 fixes for v4.12-rc2 * tag 'drm-intel-fixes-2017-05-18-1' of git://anongit.freedesktop.org/git/drm-intel: drm/i915: don't do allocate_va_range again on PIN_UPDATE drm/i915: Fix rawclk readout for g4x drm/i915: Fix runtime PM for LPE audio drm/i915/glk: Fix DSI "*ERROR* ULPS is still active" messages drm/i915/gvt: avoid unnecessary vgpu switch drm/i915/gvt: not to restore in-context mmio drm/i915/gvt: fix typo: "supporte" -> "support" commit e62961262141bd94341ae0dcb75d16a38542cc99 Merge: 6de92ab 2579b8b Author: Dave Airlie Date: Fri May 19 10:21:41 2017 +1000 Merge branch 'linux-4.12' of git://github.com/skeggsb/linux into drm-fixes misc nouveau fixes. * 'linux-4.12' of git://github.com/skeggsb/linux: drm/nouveau/fifo/gk104-: Silence a locking warning drm/nouveau/secboot: plug memory leak in ls_ucode_img_load_gr() error path drm/nouveau: Fix drm poll_helper handling commit 6de92ab875c201553a7c48e131d99fc78406a197 Merge: 389cf70 6bee9b7 Author: Dave Airlie Date: Fri May 19 10:20:53 2017 +1000 Merge tag 'drm-misc-fixes-2017-05-18' of git://anongit.freedesktop.org/git/drm-misc into drm-fixes Driver Changes: - host1x: Fix link error when host1x is built-in and iova is a module (Arnd) - hlcdc: Fix arguments passed to drm_of_find_panel_or_bridge (Boris) Cc: Arnd Bergmann Cc: Boris Brezillon * tag 'drm-misc-fixes-2017-05-18' of git://anongit.freedesktop.org/git/drm-misc: drm/atmel-hlcdc: Fix output initialization gpu: host1x: select IOMMU_IOVA commit 389cf7080c062eb5fae525858d2e70aea0422d89 Merge: 8b4822d 657314b Author: Dave Airlie Date: Fri May 19 10:16:06 2017 +1000 Merge branch 'etnaviv/fixes' of https://git.pengutronix.de/git/lst/linux into drm-fixes one etnaviv fence leak fix. * 'etnaviv/fixes' of https://git.pengutronix.de/git/lst/linux: drm/etnaviv: don't put fence in case of submit failure commit 8b4822de59d5d9919b9b045183a36c673ce20b73 Merge: 667f867 d82dd0e Author: Linus Torvalds Date: Thu May 18 12:04:41 2017 -0700 Merge tag 'md/4.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md Pull MD fixes from Shaohua Li: - Several bug fixes for raid5-cache from Song Liu, mainly handle journal disk error - Fix bad block handling in choosing raid1 disk from Tomasz Majchrzak - Simplify external metadata array sysfs handling from Artur Paszkiewicz - Optimize raid0 discard handling from me, now raid0 will dispatch large discard IO directly to underlayer disks. * tag 'md/4.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md: raid1: prefer disk without bad blocks md/r5cache: handle sync with data in write back cache md/r5cache: gracefully handle journal device errors for writeback mode md/raid1/10: avoid unnecessary locking md/raid5-cache: in r5l_do_submit_io(), submit io->split_bio first md/md0: optimize raid0 discard handling md: don't return -EAGAIN in md_allow_write for external metadata arrays md/raid5: make use of spin_lock_irq over local_irq_disable + spin_lock commit aaf0475a0b3f445000c50f7fc75d5e846bf7ee7b Author: Wei Yongjun Date: Thu May 18 15:22:41 2017 +0000 xen/9pfs: p9_trans_xen_init and p9_trans_xen_exit can be static Fixes the following sparse warnings: net/9p/trans_xen.c:528:5: warning: symbol 'p9_trans_xen_init' was not declared. Should it be static? net/9p/trans_xen.c:540:6: warning: symbol 'p9_trans_xen_exit' was not declared. Should it be static? Signed-off-by: Wei Yongjun Reviewed-by: Stefano Stabellini net/9p/trans_xen.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 14e3995e63759b80eb22a3c06958d105db4d3f79 Author: Wei Yongjun Date: Tue May 16 14:22:47 2017 +0000 xen/9pfs: fix return value check in xen_9pfs_front_probe() In case of error, the function xenbus_read() returns ERR_PTR() and never returns NULL. The NULL test in the return value check should be replaced with IS_ERR(). Fixes: 71ebd71921e4 ("xen/9pfs: connect to the backend") Signed-off-by: Wei Yongjun Reviewed-by: Stefano Stabellini net/9p/trans_xen.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 667f867c93d0117dec83bc5be9018d1a3a94044d Merge: a58a260 c0e01ea Author: Linus Torvalds Date: Thu May 18 11:40:21 2017 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) Don't allow negative TCP reordering values, from Soheil Hassas Yeganeh. 2) Don't overflow while parsing ipv6 header options, from Craig Gallek. 3) Handle more cleanly the case where an individual route entry during a dump will not fit into the allocated netlink SKB, from David Ahern. 4) Add missing CONFIG_INET dependency for mlx5e, from Arnd Bergmann. 5) Allow neighbour updates to converge more quickly via gratuitous ARPs, from Ihar Hrachyshka. 6) Fix compile error from CONFIG_INET is disabled, from Eric Dumazet. 7) Fix use after free in x25 protocol init, from Lin Zhang. 8) Valid VLAN pvid ranges passed into br_validate(), from Tobias Jungel. 9) NULL out address lists in child sockets in SCTP, this is similar to the fix we made for inet connection sockets last week. From Eric Dumazet. 10) Fix NULL deref in mlxsw driver, from Ido Schimmel. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (27 commits) mlxsw: spectrum: Avoid possible NULL pointer dereference sh_eth: Do not print an error message for probe deferral sh_eth: Use platform device for printing before register_netdev() mlxsw: spectrum_router: Fix rif counter freeing routine mlxsw: spectrum_dpipe: Fix incorrect entry index cxgb4: update latest firmware version supported qmi_wwan: add another Lenovo EM74xx device ID sctp: do not inherit ipv6_{mc|ac|fl}_list from parent udp: make *udp*_queue_rcv_skb() functions static bridge: netlink: check vlan_default_pvid range net: ethernet: faraday: To support device tree usage. net: x25: fix one potential use-after-free issue bpf: adjust verifier heuristics ipv6: Check ip6_find_1stfragopt() return value properly. selftests/bpf: fix broken build due to types.h bnxt_en: Check status of firmware DCBX agent before setting DCB_CAP_DCBX_HOST. bnxt_en: Call bnxt_dcb_init() after getting firmware DCBX configuration. net: fix compile error in skb_orphan_partial() ipv6: Prevent overrun when parsing v6 header options neighbour: update neigh timestamps iff update is effective ... commit a58a260fd96b7217b7abc49d107874206f3c55e3 Merge: 5396a01 48078d2 Author: Linus Torvalds Date: Thu May 18 11:21:10 2017 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc Pull sparc fixes from David Miller: "Three sparc bug fixes" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc: sparc/ftrace: Fix ftrace graph time measurement sparc: Fix -Wstringop-overflow warning sparc64: Fix mapping of 64k pages with MAP_FIXED commit 5396a018f3e0793204985c205622711f61afadfd Merge: 16d95c4 05d8cba Author: Linus Torvalds Date: Thu May 18 11:17:34 2017 -0700 Merge tag 'kbuild-fixes-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild fix from Masahiro Yamada: "Fix headers_install to not delete pre-existing headers in the install destination" * tag 'kbuild-fixes-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: kbuild: skip install/check of headers right under uapi directories commit 16d95c43965d287987505bbd875e59e5b3c9b131 Merge: af5d285 3fd3722 Author: Linus Torvalds Date: Thu May 18 10:04:42 2017 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace Pull pid namespace fixes from Eric Biederman: "These are two bugs that turn out to have simple fixes that were reported during the merge window. Both of these issues have existed for a while and it just happens that they both were reported at almost the same time" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: pid_ns: Fix race between setns'ed fork() and zap_pid_ns_processes() pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes commit 455a9a60b6d4afb293b0e63ec75cc8e82912a767 Author: Shile Zhang Date: Mon Apr 10 22:39:33 2017 +0800 watchdog: wdt_pci: fix build error if define SOFTWARE_REBOOT To fix following build error when SOFTWARE_REBOOT is defined: CC [M] driver/watchdog/wdt_pci.o driver/watchdog/wdt_pci.c: In function 'wdtpci_interrupt': driver/watchdog/wdt_pci.c:335:3: error: too many arguments to function 'emergency_restart' emergency_restart(NULL); ^ In file included from driver/watchdog/wdt_pci.c:51:0: include/linux/reboot.h:80:13: note: declared here extern void emergency_restart(void); ^ Signed-off-by: Shile Zhang Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/wdt_pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0ddad77b90cb52075b5a9498f0621e3e265cc19f Author: Tomas Melin Date: Mon Mar 20 09:29:31 2017 +0200 watchdog: cadence_wdt: fix timeout setting wdt_timeout must not be initialized to CDNS_WDT_DEFAULT_TIMEOUT in order to allow the value to be overriddden by a device tree setting. This way, the default timeout value will be used only in case module_param has not been set, or device tree timeout-sec has not been defined. Signed-off-by: Tomas Melin Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/cadence_wdt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 46c319b848268dab3f0e7c4a5b6e9146d3bca8a4 Author: Johan Hovold Date: Mon Mar 13 13:49:45 2017 +0100 watchdog: pcwd_usb: fix NULL-deref at probe Make sure to check the number of endpoints to avoid dereferencing a NULL-pointer should a malicious device lack endpoints. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable Signed-off-by: Johan Hovold Reviewed-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/pcwd_usb.c | 3 +++ 1 file changed, 3 insertions(+) commit ddd6d240b26dcb8b8dc98bd493eba944dd97ebc8 Author: Alexandre Belloni Date: Thu Mar 2 18:31:12 2017 +0100 watchdog: sama5d4: fix race condition WDT_MR and WDT_CR must not updated within three slow clock periods after the last ping (write to WDT_CR or WDT_MR). Ensure enough time has elapsed before writing those registers. wdt_write() waits for 4 periods to ensure at least 3 edges are seen by the IP. Signed-off-by: Alexandre Belloni Acked-by: Wenyou.Yang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/sama5d4_wdt.c | 33 +++++++++++++++++++++++++++++---- 1 file changed, 29 insertions(+), 4 deletions(-) commit 015b528644a84b0018d3286ecd6ea5f82dce0180 Author: Alexandre Belloni Date: Thu Mar 2 18:31:11 2017 +0100 watchdog: sama5d4: fix WDDIS handling The datasheet states: "When setting the WDDIS bit, and while it is set, the fields WDV and WDD must not be modified." Because the whole configuration is already cached inside .mr, wait for the user to enable the watchdog to configure it so it is enabled and configured at the same time (what the IP is actually expecting). When the watchdog is already enabled, it is not an issue to reconfigure it. Signed-off-by: Alexandre Belloni Acked-by: Wenyou.Yang Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/sama5d4_wdt.c | 48 ++++++++++++++++++++++++++---------------- 1 file changed, 30 insertions(+), 18 deletions(-) commit d8f1deaa5256aba3296025e103e8abb96f3e6479 Author: Arnd Bergmann Date: Thu Mar 2 13:09:52 2017 +0100 watchdog: orion: fix compile-test dependencies I ran into one corner case with the orion watchdog using the atomic_io_modify interface: drivers/watchdog/orion_wdt.o: In function `orion_stop': orion_wdt.c:(.text.orion_stop+0x28): undefined reference to `atomic_io_modify' drivers/watchdog/orion_wdt.o: In function `armada375_stop': orion_wdt.c:(.text.armada375_stop+0x28): undefined reference to `atomic_io_modify' This function is available on all 32-bit ARM builds except for ebsa110, so we have to specifically exclude that from compile-testing. Fixes: da2a68b3eb47 ("watchdog: Enable COMPILE_TEST where possible") Signed-off-by: Arnd Bergmann Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck drivers/watchdog/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit af5d28565f5822fb6a280d2de07315dad487f1f1 Merge: dac94e2 90b4f30 Author: Linus Torvalds Date: Thu May 18 09:38:09 2017 -0700 Merge tag 'hwmon-for-linus-v4.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fix from Guenter Roeck: "Fix problem with hotplug state machine in coretemp driver" * tag 'hwmon-for-linus-v4.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (coretemp) Handle frozen hotplug state correctly commit da4c279942b05727088774df224c0734688b4cbc Author: Johan Hovold Date: Thu May 18 17:33:01 2017 +0200 serial: enable serdev support Enable serdev support by using the new device-registration helpers. Reviewed-by: Rob Herring Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/serial_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 8cde11b2baa1d02eb2eb955dfd47d9f2a12f12cf Author: Johan Hovold Date: Thu May 18 17:33:00 2017 +0200 tty/serdev: add serdev registration interface Add a new interface for registering a serdev controller and clients, and a helper function to deregister serdev devices (or a tty device) that were previously registered using the new interface. Once every driver currently using the tty_port_register_device() helpers have been vetted and converted to use the new serdev registration interface (at least for deregistration), we can move serdev registration to the current helpers and get rid of the serdev-specific functions. Reviewed-by: Rob Herring Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman drivers/tty/serdev/serdev-ttyport.c | 6 ++- drivers/tty/tty_port.c | 75 +++++++++++++++++++++++++++++++++++++ include/linux/serdev.h | 7 +++- include/linux/tty.h | 9 +++++ 4 files changed, 93 insertions(+), 4 deletions(-) commit c0e01eac7ada785fdeaea1ae5476ec1cf3b00374 Author: Ido Schimmel Date: Thu May 18 13:03:52 2017 +0200 mlxsw: spectrum: Avoid possible NULL pointer dereference In case we got an FDB notification for a port that doesn't exist we execute an FDB entry delete to prevent it from re-appearing the next time we poll for notifications. If the operation failed we would trigger a NULL pointer dereference as 'mlxsw_sp_port' is NULL. Fix it by reporting the error using the underlying bus device instead. Fixes: 12f1501e7511 ("mlxsw: spectrum: remove FDB entry in case we get unknown object notification") Signed-off-by: Ido Schimmel Signed-off-by: Jiri Pirko Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit b7ce520e9f71ff65d0aa0ad86223f94ae4095fae Author: Geert Uytterhoeven Date: Thu May 18 15:01:35 2017 +0200 sh_eth: Do not print an error message for probe deferral EPROBE_DEFER is not an error, hence printing an error message like sh-eth ee700000.ethernet: failed to initialise MDIO may confuse the user. To fix this, suppress the error message in case of probe deferral. While at it, shorten the message, and add the actual error code. Signed-off-by: Geert Uytterhoeven Reviewed-by: Laurent Pinchart Signed-off-by: David S. Miller drivers/net/ethernet/renesas/sh_eth.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 5f5c5449acad0cd3322e53e1ac68c044483b0aa5 Author: Geert Uytterhoeven Date: Thu May 18 15:01:34 2017 +0200 sh_eth: Use platform device for printing before register_netdev() The MDIO initialization failure message is printed using the network device, before it has been registered, leading to: (null): failed to initialise MDIO Use the platform device instead to fix this: sh-eth ee700000.ethernet: failed to initialise MDIO Fixes: daacf03f0bbfefee ("sh_eth: Register MDIO bus before registering the network device") Signed-off-by: Geert Uytterhoeven Reviewed-by: Laurent Pinchart Signed-off-by: David S. Miller drivers/net/ethernet/renesas/sh_eth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b16c4c48390eb14a1bb4a06702a8c65b837c4566 Merge: 1ac91bf 6b1206b Author: David S. Miller Date: Thu May 18 11:04:00 2017 -0400 Merge branch 'mlxsw-fixes' Jiri Pirko says: ==================== mlxsw: couple of fixes Couple of fixes from Arkadi ==================== Signed-off-by: David S. Miller commit 6b1206bbbce6092b2ec412125300889e6e551bc2 Author: Arkadi Sharshevsky Date: Thu May 18 09:18:53 2017 +0200 mlxsw: spectrum_router: Fix rif counter freeing routine During rif counter freeing the counter index can be invalid. Add check of validity before freeing the counter. Fixes: e0c0afd8aa4e ("mlxsw: spectrum: Support for counters on router interfaces") Signed-off-by: Arkadi Sharshevsky Signed-off-by: Jiri Pirko Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 3 +++ 1 file changed, 3 insertions(+) commit 6dd4aba36f2dca00c3b6976a0d59c5cee16ad545 Author: Arkadi Sharshevsky Date: Thu May 18 09:18:52 2017 +0200 mlxsw: spectrum_dpipe: Fix incorrect entry index In case of disabled counters the entry index will be incorrect. Fix this by moving the entry index set before the counter status check. Fixes: 2ba5999f009d ("mlxsw: spectrum: Add Support for erif table entries access") Signed-off-by: Arkadi Sharshevsky Reviewed-by: Ido Schimmel Signed-off-by: Jiri Pirko Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum_dpipe.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 9434cec130a941e8a0698d598dfa5499dbdeb949 Author: Christophe JAILLET Date: Fri May 5 21:08:44 2017 +0200 firmware: Google VPD: Fix memory allocation error handling This patch fixes several issues: - if the 1st 'kzalloc' fails, we dereference a NULL pointer - if the 2nd 'kzalloc' fails, there is a memory leak - if 'sysfs_create_bin_file' fails there is also a memory leak Fix it by adding a test after the first memory allocation and some error handling paths to correctly free memory if needed. Signed-off-by: Christophe JAILLET Signed-off-by: Greg Kroah-Hartman drivers/firmware/google/vpd.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) commit 6bee9b78a7a5ea257b24d93974538938c82b1169 Author: Boris Brezillon Date: Thu May 18 14:35:21 2017 +0200 drm/atmel-hlcdc: Fix output initialization drm_of_find_panel_or_bridge() is expecting np to point to the encoder node, not the bridge or panel this encoder is feeding. Moreover, the endpoint parameter passed to drm_of_find_panel_or_bridge() is always set to zero, which prevents us from probing all outputs. We also move the atmel_hlcdc_rgb_output allocation after the panel/bridge detection to avoid useless allocations. Reported-by: Alexandre Belloni Fixes: ebc944613567 ("drm: convert drivers to use drm_of_find_panel_or_bridge") Signed-off-by: Boris Brezillon Tested-by: Alexandre Belloni Signed-off-by: Sean Paul Link: http://patchwork.freedesktop.org/patch/msgid/1495110921-4032-1-git-send-email-boris.brezillon@free-electrons.com drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_output.c | 36 +++++++++--------------- 1 file changed, 14 insertions(+), 22 deletions(-) commit b299cde245b0b76c977f4291162cf668e087b408 Author: Julius Werner Date: Fri May 12 14:42:58 2017 -0700 drivers: char: mem: Check for address space wraparound with mmap() /dev/mem currently allows mmap() mappings that wrap around the end of the physical address space, which should probably be illegal. It circumvents the existing STRICT_DEVMEM permission check because the loop immediately terminates (as the start address is already higher than the end address). On the x86_64 architecture it will then cause a panic (from the BUG(start >= end) in arch/x86/mm/pat.c:reserve_memtype()). This patch adds an explicit check to make sure offset + size will not wrap around in the physical address type. Signed-off-by: Julius Werner Cc: stable Signed-off-by: Greg Kroah-Hartman drivers/char/mem.c | 5 +++++ 1 file changed, 5 insertions(+) commit 6bdc00d01e202ae11fa1cae0dacbef895434483d Author: Stefan Wahren Date: Fri Apr 28 13:47:21 2017 +0200 serdev: Restore serdev_device_write_buf for atomic context Starting with commit 6fe729c4bdae ("serdev: Add serdev_device_write subroutine") the function serdev_device_write_buf cannot be used in atomic context anymore (mutex_lock is sleeping). So restore the old behavior. Signed-off-by: Stefan Wahren Fixes: 6fe729c4bdae ("serdev: Add serdev_device_write subroutine") Acked-by: Rob Herring Reviewed-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman drivers/tty/serdev/core.c | 12 ++++++++++++ include/linux/serdev.h | 14 +++++++------- 2 files changed, 19 insertions(+), 7 deletions(-) commit 88e2582e90bb89fe895ff0dceeb5d5ab65d07997 Author: Lucas Stach Date: Thu May 11 12:56:14 2017 +0200 serial: core: fix crash in uart_suspend_port With serdev we might end up with serial ports that have no cdev exported to userspace, as they are used as the bus interface to other devices. In that case serial_match_port() won't be able to find a matching tty_dev. Skip the irq wakeup enabling in that case, as serdev will make sure to keep the port active, as long as there are devices depending on it. Fixes: 8ee3fde04758 (tty_port: register tty ports with serdev bus) Signed-off-by: Lucas Stach Cc: stable Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/serial_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 925bb1ce47f429f69aad35876df7ecd8c53deb7e Author: Vegard Nossum Date: Thu May 11 12:18:52 2017 +0200 tty: fix port buffer locking tty_insert_flip_string_fixed_flag() is racy against itself when called from the ioctl(TCXONC, TCION/TCIOFF) path [1] and the flush_to_ldisc() workqueue path [2]. The problem is that port->buf.tail->used is modified without consistent locking; the ioctl path takes tty->atomic_write_lock, whereas the workqueue path takes ldata->output_lock. We cannot simply take ldata->output_lock, since that is specific to the N_TTY line discipline. It might seem natural to try to take port->buf.lock inside tty_insert_flip_string_fixed_flag() and friends (where port->buf is actually used/modified), but this creates problems for flush_to_ldisc() which takes it before grabbing tty->ldisc_sem, o_tty->termios_rwsem, and ldata->output_lock. Therefore, the simplest solution for now seems to be to take tty->atomic_write_lock inside tty_port_default_receive_buf(). This lock is also used in the write path [3] with a consistent ordering. [1]: Call Trace: tty_insert_flip_string_fixed_flag pty_write tty_send_xchar // down_read(&o_tty->termios_rwsem) // mutex_lock(&tty->atomic_write_lock) n_tty_ioctl_helper n_tty_ioctl tty_ioctl // down_read(&tty->ldisc_sem) do_vfs_ioctl SyS_ioctl [2]: Workqueue: events_unbound flush_to_ldisc Call Trace: tty_insert_flip_string_fixed_flag pty_write tty_put_char __process_echoes commit_echoes // mutex_lock(&ldata->output_lock) n_tty_receive_buf_common n_tty_receive_buf2 tty_ldisc_receive_buf // down_read(&o_tty->termios_rwsem) tty_port_default_receive_buf // down_read(&tty->ldisc_sem) flush_to_ldisc // mutex_lock(&port->buf.lock) process_one_work [3]: Call Trace: tty_insert_flip_string_fixed_flag pty_write n_tty_write // mutex_lock(&ldata->output_lock) // down_read(&tty->termios_rwsem) do_tty_write (inline) // mutex_lock(&tty->atomic_write_lock) tty_write // down_read(&tty->ldisc_sem) __vfs_write vfs_write SyS_write The bug can result in about a dozen different crashes depending on what exactly gets corrupted when port->buf.tail->used points outside the buffer. The patch passes my LOCKDEP/PROVE_LOCKING testing but more testing is always welcome. Found using syzkaller. Cc: Signed-off-by: Vegard Nossum Signed-off-by: Greg Kroah-Hartman drivers/tty/tty_port.c | 2 ++ 1 file changed, 2 insertions(+) commit 11d4d32158eeaf36fe1073a4a260193d7a19ccf1 Author: Johan Hovold Date: Wed Apr 26 12:30:04 2017 +0200 tty: ehv_bytechan: clean up init error handling Straighten out the initcall error handling to avoid deregistering a never-registered tty driver (something which would lead to a NULL-pointer dereference) in the most unlikely event that driver registration fails (e.g. we've run out of major numbers). Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman drivers/tty/ehv_bytechan.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) commit 1e948479b3d63e3ac0ecca13cbf4921c7d17c168 Author: Johan Hovold Date: Wed Apr 26 12:24:21 2017 +0200 serial: ifx6x60: fix use-after-free on module unload Make sure to deregister the SPI driver before releasing the tty driver to avoid use-after-free in the SPI remove callback where the tty devices are deregistered. Fixes: 72d4724ea54c ("serial: ifx6x60: Add modem power off function in the platform reboot process") Cc: stable # 3.8 Cc: Jun Chen Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/ifx6x60.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5c9d6abed9e0a061de252a53ab687a1171502e81 Author: Alexey Khoroshilov Date: Sat May 13 00:36:22 2017 +0300 serial: altera_jtaguart: adding iounmap() The driver does ioremap(port->mapbase, ALTERA_JTAGUART_SIZE), but there is no any iounmap(). Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov Acked-by: Tobias Klauser Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/altera_jtaguart.c | 1 + 1 file changed, 1 insertion(+) commit 2c0ac5b48a3586f612b85755b041ed7733dc8e6b Author: Jan Kiszka Date: Mon Apr 24 12:30:15 2017 +0200 serial: exar: Fix stuck MSIs After migrating 8250_exar to MSI in 172c33cb61da, we can get stuck without further interrupts because of the special wake-up event these chips send. They are only cleared by reading INT0. As we fail to do so during startup and shutdown, we can leave the interrupt line asserted, which is fatal with edge-triggered MSIs. Add the required reading of INT0 to startup and shutdown. Also account for the fact that a pending wake-up interrupt means we have to return 1 from exar_handle_irq. Drop the unneeded reading of INT1..3 along with this - those never reset anything. An alternative approach would have been disabling the wake-up interrupt. Unfortunately, this feature (REGB[17] = 1) is not available on the XR17D15X. Fixes: 172c33cb61da ("serial: exar: Enable MSI support") Signed-off-by: Jan Kiszka Reviewed-by: Andy Shevchenko Cc: stable Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/8250/8250_port.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) commit be40597a1bc173bf9dadccdf5388b956f620ae8f Author: Christophe JAILLET Date: Fri May 12 16:35:45 2017 +0200 serial: efm32: Fix parity management in 'efm32_uart_console_get_options()' UARTn_FRAME_PARITY_ODD is 0x0300 UARTn_FRAME_PARITY_EVEN is 0x0200 So if the UART is configured for EVEN parity, it would be reported as ODD. Fix it by correctly testing if the 2 bits are set. Fixes: 3afbd89c9639 ("serial/efm32: add new driver") Signed-off-by: Christophe JAILLET Acked-by: Uwe Kleine-König Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/efm32-uart.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit aee5da7838787f8ed47f825dbe09e2812acdf97b Author: Johan Hovold Date: Tue Apr 11 19:07:29 2017 +0200 serdev: fix tty-port client deregistration The port client data must be set when registering the serdev controller or client deregistration will fail (and the serdev devices are left registered and allocated) if the port was never opened in between. Make sure to clear the port client data on any probe errors to avoid a use-after-free when the client is later deregistered unconditionally (e.g. in a tty-port deregistration helper). Also move port client operation initialisation to registration. Note that the client ops must be restored on failed probe. Fixes: bed35c6dfa6a ("serdev: add a tty port controller driver") Signed-off-by: Johan Hovold Reviewed-by: Rob Herring Cc: stable Signed-off-by: Greg Kroah-Hartman drivers/tty/serdev/serdev-ttyport.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) commit d3ba126a226a6b6da021ebfea444a2a807cde945 Author: Johan Hovold Date: Tue Apr 11 19:07:28 2017 +0200 Revert "tty_port: register tty ports with serdev bus" This reverts commit 8ee3fde047589dc9c201251f07d0ca1dc776feca. The new serdev bus hooked into the tty layer in tty_port_register_device() by registering a serdev controller instead of a tty device whenever a serdev client is present, and by deregistering the controller in the tty-port destructor. This is broken in several ways: Firstly, it leads to a NULL-pointer dereference whenever a tty driver later deregisters its devices as no corresponding character device will exist. Secondly, far from every tty driver uses tty-port refcounting (e.g. serial core) so the serdev devices might never be deregistered or deallocated. Thirdly, deregistering at tty-port destruction is too late as the underlying device and structures may be long gone by then. A port is not released before an open tty device is closed, something which a registered serdev client can prevent from ever happening. A driver callback while the device is gone typically also leads to crashes. Many tty drivers even keep their ports around until the driver is unloaded (e.g. serial core), something which even if a late callback never happens, leads to leaks if a device is unbound from its driver and is later rebound. The right solution here is to add a new tty_port_unregister_device() helper and to never call tty_device_unregister() whenever the port has been claimed by serdev, but since this requires modifying just about every tty driver (and multiple subsystems) it will need to be done incrementally. Reverting the offending patch is the first step in fixing the broken lifetime assumptions. A follow-up patch will add a new pair of tty-device registration helpers, which a vetted tty driver can use to support serdev (initially serial core). When every tty driver uses the serdev helpers (at least for deregistration), we can add serdev registration to tty_port_register_device() again. Note that this also fixes another issue with serdev, which currently allocates and registers a serdev controller for every tty device registered using tty_port_device_register() only to immediately deregister and deallocate it when the corresponding OF node or serdev child node is missing. This should be addressed before enabling serdev for hot-pluggable buses. Signed-off-by: Johan Hovold Reviewed-by: Rob Herring Cc: stable Signed-off-by: Greg Kroah-Hartman drivers/tty/tty_port.c | 12 ------------ 1 file changed, 12 deletions(-) commit 52499a6ad2aef20f7baf5872e97988c385170f1b Author: Arnd Bergmann Date: Wed Apr 19 20:24:41 2017 +0200 gpu: host1x: select IOMMU_IOVA When IOMMU_IOVA is not built-in but host1x is, we get a link error: drivers/gpu/host1x/dev.o: In function `host1x_remove': dev.c:(.text.host1x_remove+0x50): undefined reference to `put_iova_domain' drivers/gpu/host1x/dev.o: In function `host1x_probe': dev.c:(.text.host1x_probe+0x31c): undefined reference to `init_iova_domain' dev.c:(.text.host1x_probe+0x38c): undefined reference to `put_iova_domain' drivers/gpu/host1x/cdma.o: In function `host1x_cdma_init': cdma.c:(.text.host1x_cdma_init+0x238): undefined reference to `alloc_iova' cdma.c:(.text.host1x_cdma_init+0x2c0): undefined reference to `__free_iova' drivers/gpu/host1x/cdma.o: In function `host1x_cdma_deinit': cdma.c:(.text.host1x_cdma_deinit+0xb0): undefined reference to `free_iova' This adds the same select statement that we have for drm_tegra. Fixes: 404bfb78daf3 ("gpu: host1x: Add IOMMU support") Signed-off-by: Arnd Bergmann Reviewed-by: Mikko Perttunen Signed-off-by: Sean Paul Link: http://patchwork.freedesktop.org/patch/msgid/20170419182449.885312-1-arnd@arndb.de drivers/gpu/host1x/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 4c4fc90964b1cf205a67df566cc82ea1731bcb00 Author: Ard Biesheuvel Date: Thu May 18 12:29:55 2017 +0100 drivers/tty: 8250: only call fintek_8250_probe when doing port I/O Commit fa01e2ca9f53 ("serial: 8250: Integrate Fintek into 8250_base") modified the probing logic for PNP0501 devices, to remove a collision between the generic 16550A driver and the Fintek driver, which reused the same ACPI _HID. The Fintek device probe is now incorporated into the common 8250 probe path, and gets called for all discovered 16550A compatible devices, including ones that are MMIO mapped rather than IO mapped. However, the Fintek driver assumes the port base is a I/O address, and proceeds to probe some arbitrary offsets above it. This is generally a wrong thing to do, but on ARM systems (having no native port I/O), this may result in faulting accesses of completely unrelated MMIO regions in the PCI I/O space. Given that this is at serial probe time, this results in hard to diagnose crashes at boot. So let's restrict the Fintek probe to devices that we know are using port I/O in the first place. Fixes: fa01e2ca9f53 ("serial: 8250: Integrate Fintek into 8250_base") Suggested-by: Arnd Bergmann Reviewed-by: Ricardo Ribalda Signed-off-by: Ard Biesheuvel Cc: stable Signed-off-by: Greg Kroah-Hartman drivers/tty/serial/8250/8250_port.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1ac91bff9c65d4a5e0da244495ea6275fd514c5a Author: Ganesh Goudar Date: Thu May 18 00:08:16 2017 +0530 cxgb4: update latest firmware version supported Change t4fw_version.h to update latest firmware version number to 1.16.43.0. Signed-off-by: Ganesh Goudar Signed-off-by: David S. Miller drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 486181bcb3248e2f1977f4e69387a898234a4e1e Author: Bjørn Mork Date: Wed May 17 16:31:41 2017 +0200 qmi_wwan: add another Lenovo EM74xx device ID In their infinite wisdom, and never ending quest for end user frustration, Lenovo has decided to use a new USB device ID for the wwan modules in their 2017 laptops. The actual hardware is still the Sierra Wireless EM7455 or EM7430, depending on region. Signed-off-by: Bjørn Mork Signed-off-by: David S. Miller drivers/net/usb/qmi_wwan.c | 2 ++ 1 file changed, 2 insertions(+) commit fdcee2cbb8438702ea1b328fb6e0ac5e9a40c7f8 Author: Eric Dumazet Date: Wed May 17 07:16:40 2017 -0700 sctp: do not inherit ipv6_{mc|ac|fl}_list from parent SCTP needs fixes similar to 83eaddab4378 ("ipv6/dccp: do not inherit ipv6_mc_list from parent"), otherwise bad things can happen. Signed-off-by: Eric Dumazet Reported-by: Andrey Konovalov Tested-by: Andrey Konovalov Signed-off-by: David S. Miller net/sctp/ipv6.c | 3 +++ 1 file changed, 3 insertions(+) commit a3f96c47c8d4c38be71fdbb440a99968c764ba62 Author: Paolo Abeni Date: Wed May 17 14:52:16 2017 +0200 udp: make *udp*_queue_rcv_skb() functions static Since the udp memory accounting refactor, we don't need any more to export the *udp*_queue_rcv_skb(). Make them static and fix a couple of sparse warnings: net/ipv4/udp.c:1615:5: warning: symbol 'udp_queue_rcv_skb' was not declared. Should it be static? net/ipv6/udp.c:572:5: warning: symbol 'udpv6_queue_rcv_skb' was not declared. Should it be static? Fixes: 850cbaddb52d ("udp: use it's own memory accounting schema") Fixes: c915fe13cbaa ("udplite: fix NULL pointer dereference") Signed-off-by: Paolo Abeni Signed-off-by: David S. Miller net/ipv4/udp.c | 4 ++-- net/ipv4/udp_impl.h | 1 - net/ipv6/udp.c | 4 ++-- net/ipv6/udp_impl.h | 1 - 4 files changed, 4 insertions(+), 6 deletions(-) commit a285860211bf257b0e6d522dac6006794be348af Author: Tobias Jungel Date: Wed May 17 09:29:12 2017 +0200 bridge: netlink: check vlan_default_pvid range Currently it is allowed to set the default pvid of a bridge to a value above VLAN_VID_MASK (0xfff). This patch adds a check to br_validate and returns -EINVAL in case the pvid is out of bounds. Reproduce by calling: [root@test ~]# ip l a type bridge [root@test ~]# ip l a type dummy [root@test ~]# ip l s bridge0 type bridge vlan_filtering 1 [root@test ~]# ip l s bridge0 type bridge vlan_default_pvid 9999 [root@test ~]# ip l s dummy0 master bridge0 [root@test ~]# bridge vlan port vlan ids bridge0 9999 PVID Egress Untagged dummy0 9999 PVID Egress Untagged Fixes: 0f963b7592ef ("bridge: netlink: add support for default_pvid") Acked-by: Nikolay Aleksandrov Signed-off-by: Tobias Jungel Acked-by: Sabrina Dubroca Signed-off-by: David S. Miller net/bridge/br_netlink.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 6266d465bde044a105f6c2d4e244680f951a2d70 Author: Miklos Szeredi Date: Thu May 18 16:11:24 2017 +0200 ovl: don't fail copy-up if upper doesn't support xattr Signed-off-by: Miklos Szeredi fs/overlayfs/copy_up.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 82b749b2c65e9d108c1c5598dc0a5f436b525f42 Author: Amir Goldstein Date: Wed May 17 00:12:40 2017 +0300 ovl: check on mount time if upper fs supports setting xattr xattr are needed by overlayfs for setting opaque dir, redirect dir and copy up origin. Check at mount time by trying to set the overlay.opaque xattr on the workdir and if that fails issue a warning message. Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi fs/overlayfs/overlayfs.h | 3 +++ fs/overlayfs/ovl_entry.h | 1 + fs/overlayfs/super.c | 13 +++++++++++++ fs/overlayfs/util.c | 21 +++++++++++++++++++++ 4 files changed, 38 insertions(+) commit 8137ae26d25303e7b5cfb418fd28b976461e5b6e Author: Amir Goldstein Date: Tue May 16 08:45:46 2017 +0300 ovl: fix creds leak in copy up error path Fixes: 42f269b92540 ("ovl: rearrange code in ovl_copy_up_locked()") Cc: # v4.11 Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi fs/overlayfs/copy_up.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) commit 47ab37a19a8112670e63474016d5fbf86bc8737f Author: Greentime Hu Date: Wed May 17 15:28:19 2017 +0800 net: ethernet: faraday: To support device tree usage. To support device tree usage for ftmac100. Signed-off-by: Greentime Hu Signed-off-by: David S. Miller drivers/net/ethernet/faraday/ftmac100.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 64df6d525fcff1630098db9238bfd2b3e092d5c1 Author: linzhang Date: Wed May 17 12:05:07 2017 +0800 net: x25: fix one potential use-after-free issue The function x25_init is not properly unregister related resources on error handler.It is will result in kernel oops if x25_init init failed, so add properly unregister call on error handler. Also, i adjust the coding style and make x25_register_sysctl properly return failure. Signed-off-by: linzhang Signed-off-by: David S. Miller include/net/x25.h | 4 ++-- net/x25/af_x25.c | 24 ++++++++++++++++-------- net/x25/sysctl_net_x25.c | 5 ++++- 3 files changed, 22 insertions(+), 11 deletions(-) commit 66ea5974b36b73129bbdc129847ec73cecb3f14d Author: Randy Dunlap Date: Mon May 15 10:16:30 2017 -0700 MAINTAINERS: greybus-dev list is members-only The greybus-dev mailing list is a members-only list and is moderated for non-subscribers. Signed-off-by: Randy Dunlap Acked-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6df2b42f7c040d57d9ecb67244e04e905ab87ac6 Author: Peter Ujfalusi Date: Wed May 17 11:23:11 2017 -0500 usb: musb: tusb6010_omap: Do not reset the other direction's packet size We have one register for each EP to set the maximum packet size for both TX and RX. If for example an RX programming would happen before the previous TX transfer finishes we would reset the TX packet side. To fix this issue, only modify the TX or RX part of the register. Fixes: 550a7375fe72 ("USB: Add MUSB and TUSB support") Signed-off-by: Peter Ujfalusi Tested-by: Tony Lindgren Signed-off-by: Bin Liu Cc: stable Signed-off-by: Greg Kroah-Hartman drivers/usb/musb/tusb6010_omap.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) commit 3c50ffef25855a9d9e4b07b02d756a8cdd653069 Author: Tony Lindgren Date: Wed May 17 11:23:10 2017 -0500 usb: musb: Fix trying to suspend while active for OTG configurations Commit d8e5f0eca1e8 ("usb: musb: Fix hardirq-safe hardirq-unsafe lock order error") caused a regression where musb keeps trying to enable host mode with no cable connected. This seems to be caused by the fact that now phy is enabled earlier, and we are wrongly trying to force USB host mode on an OTG port. The errors we are getting are "trying to suspend as a_idle while active". For ports configured as OTG, we should not need to do anything to try to force USB host mode on it's OTG port. Trying to force host mode in this case just seems to completely confuse the musb state machine. Let's fix the issue by making musb_host_setup() attempt to force the mode only if port_mode is configured for host mode. Fixes: d8e5f0eca1e8 ("usb: musb: Fix hardirq-safe hardirq-unsafe lock order error") Cc: Johan Hovold Cc: stable Reported-by: Laurent Pinchart Reported-by: Peter Ujfalusi Tested-by: Peter Ujfalusi Signed-off-by: Tony Lindgren Signed-off-by: Bin Liu Signed-off-by: Greg Kroah-Hartman drivers/usb/musb/musb_host.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 4b148d5144d64ee135b8924350cb0b3a7fd21150 Author: Thomas Petazzoni Date: Wed May 17 18:32:06 2017 +0300 usb: host: xhci-plat: propagate return value of platform_get_irq() platform_get_irq() returns an error code, but the xhci-plat driver ignores it and always returns -ENODEV. This is not correct, and prevents -EPROBE_DEFER from being propagated properly. CC: Signed-off-by: Thomas Petazzoni Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman drivers/usb/host/xhci-plat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 604d02a2a66ab7f93fd3b2bde3698c29ef057b65 Author: Mathias Nyman Date: Wed May 17 18:32:05 2017 +0300 xhci: Fix command ring stop regression in 4.11 In 4.11 TRB completion codes were renamed to match spec. Completion codes for command ring stopped and endpoint stopped were mixed, leading to failures while handling a stopped command ring. Use the correct completion code for command ring stopped events. Fixes: 0b7c105a04ca ("usb: host: xhci: rename completion codes to match spec") Cc: # 4.11 Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman drivers/usb/host/xhci-hub.c | 2 +- drivers/usb/host/xhci-ring.c | 8 ++++---- drivers/usb/host/xhci.c | 8 ++++---- 3 files changed, 9 insertions(+), 9 deletions(-) commit 5db851cf20857c5504b146046e97cb7781f2a743 Author: Matthias Lange Date: Wed May 17 18:32:04 2017 +0300 xhci: remove GFP_DMA flag from allocation There is no reason to restrict allocations to the first 16MB ISA DMA addresses. It is causing problems in a virtualization setup with enabled IOMMU (x86_64). The result is that USB is not working in the VM. CC: Signed-off-by: Matthias Lange Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman drivers/usb/host/xhci-mem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 63aea0dbab90a2461faaae357cbc8cfd6c8de9fe Author: Alan Stern Date: Wed May 17 18:32:03 2017 +0300 USB: xhci: fix lock-inversion problem With threaded interrupts, bottom-half handlers are called with interrupts enabled. Therefore they can't safely use spin_lock(); they have to use spin_lock_irqsave(). Lockdep warns about a violation occurring in xhci_irq(): ========================================================= [ INFO: possible irq lock inversion dependency detected ] 4.11.0-rc8-dbg+ #1 Not tainted --------------------------------------------------------- swapper/7/0 just changed the state of lock: (&(&ehci->lock)->rlock){-.-...}, at: [] ehci_hrtimer_func+0x29/0xc0 [ehci_hcd] but this lock took another, HARDIRQ-unsafe lock in the past: (hcd_urb_list_lock){+.....} and interrupts could create inverse lock ordering between them. other info that might help us debug this: Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(hcd_urb_list_lock); local_irq_disable(); lock(&(&ehci->lock)->rlock); lock(hcd_urb_list_lock); lock(&(&ehci->lock)->rlock); *** DEADLOCK *** no locks held by swapper/7/0. the shortest dependencies between 2nd lock and 1st lock: -> (hcd_urb_list_lock){+.....} ops: 252 { HARDIRQ-ON-W at: __lock_acquire+0x602/0x1280 lock_acquire+0xd5/0x1c0 _raw_spin_lock+0x2f/0x40 usb_hcd_unlink_urb_from_ep+0x1b/0x60 [usbcore] xhci_giveback_urb_in_irq.isra.45+0x70/0x1b0 [xhci_hcd] finish_td.constprop.60+0x1d8/0x2e0 [xhci_hcd] xhci_irq+0xdd6/0x1fa0 [xhci_hcd] usb_hcd_irq+0x26/0x40 [usbcore] irq_forced_thread_fn+0x2f/0x70 irq_thread+0x149/0x1d0 kthread+0x113/0x150 ret_from_fork+0x2e/0x40 This patch fixes the problem. Signed-off-by: Alan Stern Reported-and-tested-by: Bart Van Assche CC: Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman drivers/usb/host/xhci-ring.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 6a29beef9d1b16c762e469d77e28c3de3f5c3dbb Author: Peter Chen Date: Wed May 17 18:32:02 2017 +0300 usb: host: xhci-ring: don't need to clear interrupt pending for MSI enabled hcd According to xHCI spec Figure 30: Interrupt Throttle Flow Diagram If PCI Message Signaled Interrupts (MSI or MSI-X) are enabled, then the assertion of the Interrupt Pending (IP) flag in Figure 30 generates a PCI Dword write. The IP flag is automatically cleared by the completion of the PCI write. the MSI enabled HCs don't need to clear interrupt pending bit, but hcd->irq = 0 doesn't equal to MSI enabled HCD. At some Dual-role controller software designs, it sets hcd->irq as 0 to avoid HCD requesting interrupt, and they want to decide when to call usb_hcd_irq by software. Signed-off-by: Peter Chen Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman drivers/usb/host/xhci-ring.c | 5 +---- drivers/usb/host/xhci.c | 5 +++-- include/linux/usb/hcd.h | 1 + 3 files changed, 5 insertions(+), 6 deletions(-) commit 7480d912d549f414e0ce39331870899e89a5598c Author: Peter Chen Date: Wed May 17 18:32:01 2017 +0300 usb: host: xhci-mem: allocate zeroed Scratchpad Buffer According to xHCI ch4.20 Scratchpad Buffers, the Scratchpad Buffer needs to be zeroed. ... The following operations take place to allocate Scratchpad Buffers to the xHC: ... b. Software clears the Scratchpad Buffer to '0' Cc: stable Signed-off-by: Peter Chen Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman drivers/usb/host/xhci-mem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a0c16630d35a874e82bdf2088f58ecaca1024315 Author: Mathias Nyman Date: Wed May 17 18:32:00 2017 +0300 xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton Intel Denverton microserver is Atom based and need the PME and CAS quirks as well. Cc: stable Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman drivers/usb/host/xhci-pci.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 7bc5d5aff356f3ba16c4d1e9eaf95cc99b7574ab Author: Mathias Nyman Date: Wed May 17 18:31:59 2017 +0300 usb: xhci: trace URB before giving it back instead of after Don't access any members of a URB after giving it back. URB might be freed by then already. Signed-off-by: Mathias Nyman Signed-off-by: Greg Kroah-Hartman drivers/usb/host/xhci-ring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d3e7dec054174fdddae33eaa0032a82c3f42181d Author: Dan Carpenter Date: Thu May 18 10:38:53 2017 +0300 KVM: Silence underflow warning in avic_get_physical_id_entry() Smatch complains that we check cap the upper bound of "index" but don't check for negatives. It's a false positive because "index" is never negative. But it's also simple enough to make it unsigned which makes the code easier to audit. Signed-off-by: Dan Carpenter Signed-off-by: Radim Krčmář arch/x86/kvm/svm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit d8db7ae4eeebb278aa68a231a003e7102f635a4d Author: Hans de Goede Date: Thu May 18 13:06:44 2017 +0200 drm/i915: Fix new -Wint-in-bool-context gcc compiler warning This commit fixes the following compiler warning: drivers/gpu/drm/i915/intel_dsi.c: In function ‘intel_dsi_prepare’: drivers/gpu/drm/i915/intel_dsi.c:1487:23: warning: ?: using integer constants in boolean context [-Wint-in-bool-context] PORT_A ? PORT_C : PORT_A), Fixes: f4c3a88e5f04 ("drm/i915: Tighten mmio arrays for MIPI_PORT") Signed-off-by: Hans de Goede Signed-off-by: Jani Nikula Link: http://patchwork.freedesktop.org/patch/msgid/20170518110644.9902-1-hdegoede@redhat.com (cherry picked from commit 0ad4dc887d4168448e8c801aa4edd8fe1e0bd534) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_reg.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 55c315ee09d3bd37f9d71e85e54d6ebe675b6462 Merge: b401ee0 fa472fa Author: Radim Krčmář Date: Thu May 18 14:40:32 2017 +0200 Merge tag 'kvm-arm-for-v4.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm KVM/ARM Fixes for v4.12-rc2. Includes: - A fix for a build failure introduced in -rc1 when tracepoints are enabled on 32-bit ARM. - Disabling use of stack pointer protection in the hyp code which can cause panics. - A handful of VGIC fixes. - A fix to the init of the redistributors on GICv3 systems that prevented boot with kvmtool on GICv3 systems introduced in -rc1. - A number of race conditions fixed in our MMU handling code. - A fix for the guest being able to program the debug extensions for the host on the 32-bit side. commit 171d8b9363725e122b164e6b9ef2acf2f751e387 Author: Matthew Auld Date: Tue May 16 09:55:14 2017 +0100 drm/i915: use vma->size for appgtt allocate_va_range For the aliasing ppgtt we clear the va range up to vma->size, but seem to allocate up to vma->node.size, which is a little inconsistent given that vma->node.size >= vma->size. Not that is really matters all that much since we preallocate anyway, but for consistency just use vma->size. Fixes: ff685975d97f ("drm/i915: Move allocate_va_range to GTT") Signed-off-by: Matthew Auld Cc: Chris Wilson Link: http://patchwork.freedesktop.org/patch/msgid/20170516085514.5853-1-matthew.auld@intel.com Reviewed-by: Chris Wilson Signed-off-by: Chris Wilson (cherry picked from commit d567232cbd9ec2a289ddffea4013b7265bbcc3d5) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_gem_gtt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4681ee21d62cfed4364e09ec50ee8e88185dd628 Author: Joonas Lahtinen Date: Thu May 18 11:49:39 2017 +0300 drm/i915: Do not sync RCU during shrinking Due to the complex dependencies between workqueues and RCU, which are not easily detected by lockdep, do not synchronize RCU during shrinking. On low-on-memory systems (mem=1G for example), the RCU sync leads to all system workqueus freezing and unrelated lockdep splats are displayed according to reports. GIT bisecting done by J. R. Okajima points to the commit where RCU syncing was extended. RCU sync gains us very little benefit in real life scenarios where the amount of memory used by object backing storage is dominant over the metadata under RCU, so drop it altogether. " Yeeeaah, if core could just, go ahead and reclaim RCU queues, that'd be great. " - Chris Wilson, 2016 (0eafec6d3244) v2: More information to commit message. v3: Remove "grep _rcu_" escapee from i915_gem_shrink_all (Andrea) Fixes: c053b5a506d3 ("drm/i915: Don't call synchronize_rcu_expedited under struct_mutex") Suggested-by: Chris Wilson Reported-by: J. R. Okajima Signed-off-by: Joonas Lahtinen Reviewed-by: Chris Wilson Tested-by: Hugh Dickins Tested-by: Andrea Arcangeli Cc: Chris Wilson Cc: Tvrtko Ursulin Cc: J. R. Okajima Cc: Andrea Arcangeli Cc: Hugh Dickins Cc: Jani Nikula Cc: # v4.11+ (cherry picked from commit 73cc0b9aa9afa5ba65d92e46ded61d29430d72a4) Signed-off-by: Jani Nikula Link: http://patchwork.freedesktop.org/patch/msgid/1495097379-573-1-git-send-email-joonas.lahtinen@linux.intel.com drivers/gpu/drm/i915/i915_gem_shrinker.c | 5 ----- 1 file changed, 5 deletions(-) commit 751a9c763849f5859cb69ea44b0430d00672f637 Author: Willem de Bruijn Date: Wed May 17 11:24:47 2017 -0400 netfilter: xtables: fix build failure from COMPAT_XT_ALIGN outside CONFIG_COMPAT The patch in the Fixes references COMPAT_XT_ALIGN in the definition of XT_DATA_TO_USER, outside an #ifdef CONFIG_COMPAT block. Split XT_DATA_TO_USER into separate compat and non compat variants and define the first inside an CONFIG_COMPAT block. This simplifies both variants by removing branches inside the macro. Fixes: 324318f0248c ("netfilter: xtables: zero padding in data_to_user") Reported-by: Stephen Rothwell Signed-off-by: Willem de Bruijn Signed-off-by: Pablo Neira Ayuso net/netfilter/x_tables.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) commit fa472fa91a5a0b241f5ddae927d2e235d07545df Author: Christoffer Dall Date: Wed May 17 21:16:09 2017 +0200 KVM: arm/arm64: Hold slots_lock when unregistering kvm io bus devices We were not holding the kvm->slots_lock as required when calling kvm_io_bus_unregister_dev() as required. This only affects the error path, but still, let's do our due diligence. Reported by: Eric Auger Signed-off-by: Christoffer Dall Reviewed-by: Eric Auger virt/kvm/arm/vgic/vgic-mmio-v3.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 552c9f47f8d451830a6b47151c6d2db77f77cc3e Author: Christoffer Dall Date: Wed May 17 13:12:51 2017 +0200 KVM: arm/arm64: Fix bug when registering redist iodevs If userspace creates the VCPUs after initializing the VGIC, then we end up in a situation where we trigger a bug in kvm_vcpu_get_idx(), because it is called prior to adding the VCPU into the vcpus array on the VM. There is no tight coupling between the VCPU index and the area of the redistributor region used for the VCPU, so we can simply ensure that all creations of redistributors are serialized per VM, and increment an offset when we successfully add a redistributor. The vgic_register_redist_iodev() function can be called from two paths: vgic_redister_all_redist_iodev() which is called via the kvm_vgic_addr() device attribute handler. This patch already holds the kvm->lock mutex. The other path is via kvm_vgic_vcpu_init, which is called through a longer chain from kvm_vm_ioctl_create_vcpu(), which releases the kvm->lock mutex just before calling kvm_arch_vcpu_create(), so we can simply take this mutex again later for our purposes. Fixes: ab6f468c10 ("KVM: arm/arm64: Register iodevs when setting redist base and creating VCPUs") Signed-off-by: Christoffer Dall Tested-by: Jean-Philippe Brucker Reviewed-by: Eric Auger include/kvm/arm_vgic.h | 5 ++++- virt/kvm/arm/vgic/vgic-init.c | 5 ++++- virt/kvm/arm/vgic/vgic-mmio-v3.c | 9 ++++++--- 3 files changed, 14 insertions(+), 5 deletions(-) commit f36afd38c5372a7cd5b363786fd62076c8b28427 Author: Arnd Bergmann Date: Wed May 17 23:19:01 2017 +0200 clk: sunxi-ng: enable SUNXI_CCU_MP for PRCM The newly added PRCM CCU driver uses SUNXI_CCU_MP_WITH_MUX_GATE, which causes a link error when no other driver enables SUNXI_CCU_MP: drivers/clk/built-in.o:(.data+0x5c8c8): undefined reference to `ccu_mp_ops' This adds an explicit 'select' statement for it. Signed-off-by: Arnd Bergmann Reviewed-by: Chen-Yu Tsai Signed-off-by: Maxime Ripard drivers/clk/sunxi-ng/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 9933e113c2e87a9f46a40fde8dafbf801dca1ab9 Author: Herbert Xu Date: Wed May 10 03:48:23 2017 +0800 crypto: skcipher - Add missing API setkey checks The API setkey checks for key sizes and alignment went AWOL during the skcipher conversion. This patch restores them. Cc: Fixes: 4e6c3df4d729 ("crypto: skcipher - Add low-level skcipher...") Reported-by: Baozeng Signed-off-by: Herbert Xu crypto/skcipher.c | 40 +++++++++++++++++++++++++++++++++++++++- 1 file changed, 39 insertions(+), 1 deletion(-) commit 3c2ce60bdd3d57051bf85615deec04a694473840 Author: Daniel Borkmann Date: Thu May 18 03:00:06 2017 +0200 bpf: adjust verifier heuristics Current limits with regards to processing program paths do not really reflect today's needs anymore due to programs becoming more complex and verifier smarter, keeping track of more data such as const ALU operations, alignment tracking, spilling of PTR_TO_MAP_VALUE_ADJ registers, and other features allowing for smarter matching of what LLVM generates. This also comes with the side-effect that we result in fewer opportunities to prune search states and thus often need to do more work to prove safety than in the past due to different register states and stack layout where we mismatch. Generally, it's quite hard to determine what caused a sudden increase in complexity, it could be caused by something as trivial as a single branch somewhere at the beginning of the program where LLVM assigned a stack slot that is marked differently throughout other branches and thus causing a mismatch, where verifier then needs to prove safety for the whole rest of the program. Subsequently, programs with even less than half the insn size limit can get rejected. We noticed that while some programs load fine under pre 4.11, they get rejected due to hitting limits on more recent kernels. We saw that in the vast majority of cases (90+%) pruning failed due to register mismatches. In case of stack mismatches, majority of cases failed due to different stack slot types (invalid, spill, misc) rather than differences in spilled registers. This patch makes pruning more aggressive by also adding markers that sit at conditional jumps as well. Currently, we only mark jump targets for pruning. For example in direct packet access, these are usually error paths where we bail out. We found that adding these markers, it can reduce number of processed insns by up to 30%. Another option is to ignore reg->id in probing PTR_TO_MAP_VALUE_OR_NULL registers, which can help pruning slightly as well by up to 7% observed complexity reduction as stand-alone. Meaning, if a previous path with register type PTR_TO_MAP_VALUE_OR_NULL for map X was found to be safe, then in the current state a PTR_TO_MAP_VALUE_OR_NULL register for the same map X must be safe as well. Last but not least the patch also adds a scheduling point and bumps the current limit for instructions to be processed to a more adequate value. Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: David S. Miller kernel/bpf/verifier.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) commit 7dd7eb9513bd02184d45f000ab69d78cb1fa1531 Author: David S. Miller Date: Wed May 17 22:54:11 2017 -0400 ipv6: Check ip6_find_1stfragopt() return value properly. Do not use unsigned variables to see if it returns a negative error or not. Fixes: 2423496af35d ("ipv6: Prevent overrun when parsing v6 header options") Reported-by: Julia Lawall Signed-off-by: David S. Miller net/ipv6/ip6_offload.c | 9 ++++----- net/ipv6/ip6_output.c | 7 +++---- net/ipv6/udp_offload.c | 8 +++++--- 3 files changed, 12 insertions(+), 12 deletions(-) commit 545a028190dae4437aac4f86da7c8ab20857647c Author: Steven Rostedt (VMware) Date: Tue May 16 14:58:35 2017 -0400 kprobes: Document how optimized kprobes are removed from module unload Thomas discovered a bug where the kprobe trace tests had a race condition where the kprobe_optimizer called from a delayed work queue that does the optimizing and "unoptimizing" of a kprobe, can try to modify the text after it has been freed by the init code. The kprobe trace selftest is a special case, and Thomas and myself investigated to see if there's a chance that this could also be a bug with module unloading, as the code is not obvious to how it handles this. After adding lots of printks, I figured it out. Thomas suggested that this should be commented so that others will not have to go through this exercise again. Link: http://lkml.kernel.org/r/20170516145835.3827d3aa@gandalf.local.home Acked-by: Masami Hiramatsu Suggested-by: Thomas Gleixner Signed-off-by: Steven Rostedt (VMware) kernel/kprobes.c | 6 ++++++ 1 file changed, 6 insertions(+) commit b172296b90b799c8b634521c248e9316581c8154 Author: Naveen N. Rao Date: Tue May 16 23:21:28 2017 +0530 selftests/ftrace: Add test to remove instance with active event triggers Add a test to ensure we clean up properly when removing an instance with active event triggers. Link: http://lkml.kernel.org/r/c479465b2009397708d6c52c8561e1523c22cd31.1494956770.git.naveen.n.rao@linux.vnet.ibm.com Signed-off-by: Naveen N. Rao Signed-off-by: Steven Rostedt (VMware) tools/testing/selftests/ftrace/test.d/instances/instance-event.tc | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit d2ffb8d3cc3458e2102b2f067a2e82c84947deea Author: Naveen N. Rao Date: Tue May 16 23:21:27 2017 +0530 selftests/ftrace: Fix bashisms Fix a few bashisms in ftrace selftests. Link: http://lkml.kernel.org/r/5fbf4613eef0766918fa04e3ff537cae271223ee.1494956770.git.naveen.n.rao@linux.vnet.ibm.com Acked-by: Masami Hiramatsu Signed-off-by: Naveen N. Rao Signed-off-by: Steven Rostedt (VMware) tools/testing/selftests/ftrace/ftracetest | 2 +- tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc | 2 +- tools/testing/selftests/ftrace/test.d/functions | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) commit 8a49f3e03c8ac52fe1b706fffb13142295fa0c47 Author: Steven Rostedt (VMware) Date: Wed May 17 21:53:32 2017 -0400 ftrace: Remove #ifdef from code and add clear_ftrace_function_probes() stub No need to add ugly #ifdefs in the code. Having a standard stub file is much prettier. Signed-off-by: Steven Rostedt (VMware) kernel/trace/trace.c | 2 -- kernel/trace/trace.h | 4 ++++ 2 files changed, 4 insertions(+), 2 deletions(-) commit a0e6369e4bac8844825ae1a66ccd122b290dcc86 Author: Naveen N. Rao Date: Tue May 16 23:21:26 2017 +0530 ftrace/instances: Clear function triggers when removing instances If instance directories are deleted while there are registered function triggers: # cd /sys/kernel/debug/tracing/instances # mkdir test # echo "schedule:enable_event:sched:sched_switch" > test/set_ftrace_filter # rmdir test Unable to handle kernel paging request for data at address 0x00000008 Unable to handle kernel paging request for data at address 0x00000008 Faulting instruction address: 0xc0000000021edde8 Oops: Kernel access of bad area, sig: 11 [#1] SMP NR_CPUS=2048 NUMA pSeries Modules linked in: iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ipt_REJECT nf_reject_ipv4 xt_tcpudp tun bridge stp llc kvm iptable_filter fuse binfmt_misc pseries_rng rng_core vmx_crypto ib_iser rdma_cm iw_cm ib_cm ib_core libiscsi scsi_transport_iscsi ip_tables x_tables autofs4 btrfs raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c multipath virtio_net virtio_blk virtio_pci crc32c_vpmsum virtio_ring virtio CPU: 8 PID: 8694 Comm: rmdir Not tainted 4.11.0-nnr+ #113 task: c0000000bab52800 task.stack: c0000000baba0000 NIP: c0000000021edde8 LR: c0000000021f0590 CTR: c000000002119620 REGS: c0000000baba3870 TRAP: 0300 Not tainted (4.11.0-nnr+) MSR: 8000000000009033 CR: 22002422 XER: 20000000 CFAR: 00007fffabb725a8 DAR: 0000000000000008 DSISR: 40000000 SOFTE: 0 GPR00: c00000000220f750 c0000000baba3af0 c000000003157e00 0000000000000000 GPR04: 0000000000000040 00000000000000eb 0000000000000040 0000000000000000 GPR08: 0000000000000000 0000000000000113 0000000000000000 c00000000305db98 GPR12: c000000002119620 c00000000fd42c00 0000000000000000 0000000000000000 GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 GPR20: 0000000000000000 0000000000000000 c0000000bab52e90 0000000000000000 GPR24: 0000000000000000 00000000000000eb 0000000000000040 c0000000baba3bb0 GPR28: c00000009cb06eb0 c0000000bab52800 c00000009cb06eb0 c0000000baba3bb0 NIP [c0000000021edde8] ring_buffer_lock_reserve+0x8/0x4e0 LR [c0000000021f0590] trace_event_buffer_lock_reserve+0xe0/0x1a0 Call Trace: [c0000000baba3af0] [c0000000021f96c8] trace_event_buffer_commit+0x1b8/0x280 (unreliable) [c0000000baba3b60] [c00000000220f750] trace_event_buffer_reserve+0x80/0xd0 [c0000000baba3b90] [c0000000021196b8] trace_event_raw_event_sched_switch+0x98/0x180 [c0000000baba3c10] [c0000000029d9980] __schedule+0x6e0/0xab0 [c0000000baba3ce0] [c000000002122230] do_task_dead+0x70/0xc0 [c0000000baba3d10] [c0000000020ea9c8] do_exit+0x828/0xd00 [c0000000baba3dd0] [c0000000020eaf70] do_group_exit+0x60/0x100 [c0000000baba3e10] [c0000000020eb034] SyS_exit_group+0x24/0x30 [c0000000baba3e30] [c00000000200bcec] system_call+0x38/0x54 Instruction dump: 60000000 60420000 7d244b78 7f63db78 4bffaa09 393efff8 793e0020 39200000 4bfffecc 60420000 3c4c00f7 3842a020 <81230008> 2f890000 409e02f0 a14d0008 ---[ end trace b917b8985d0e650b ]--- Unable to handle kernel paging request for data at address 0x00000008 Faulting instruction address: 0xc0000000021edde8 Unable to handle kernel paging request for data at address 0x00000008 Faulting instruction address: 0xc0000000021edde8 Faulting instruction address: 0xc0000000021edde8 To address this, let's clear all registered function probes before deleting the ftrace instance. Link: http://lkml.kernel.org/r/c5f1ca624043690bd94642bb6bffd3f2fc504035.1494956770.git.naveen.n.rao@linux.vnet.ibm.com Reported-by: Michael Ellerman Signed-off-by: Naveen N. Rao Signed-off-by: Steven Rostedt (VMware) kernel/trace/ftrace.c | 8 ++++++++ kernel/trace/trace.c | 3 +++ kernel/trace/trace.h | 1 + 3 files changed, 12 insertions(+) commit cbab567c3dc7d6f443b4c84eab76e8967d5c1dee Author: Naveen N. Rao Date: Tue May 16 23:21:25 2017 +0530 ftrace: Simplify glob handling in unregister_ftrace_function_probe_func() Handle a NULL glob properly and simplify the check. Link: http://lkml.kernel.org/r/5df74d4ffb4721db6d5a22fa08ca031d62ead493.1494956770.git.naveen.n.rao@linux.vnet.ibm.com Reviewed-by: Masami Hiramatsu Signed-off-by: Naveen N. Rao Signed-off-by: Steven Rostedt (VMware) kernel/trace/ftrace.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 30e7d894c1478c88d50ce94ddcdbd7f9763d9cdd Author: Thomas Gleixner Date: Wed May 17 10:19:49 2017 +0200 tracing/kprobes: Enforce kprobes teardown after testing Enabling the tracer selftest triggers occasionally the warning in text_poke(), which warns when the to be modified page is not marked reserved. The reason is that the tracer selftest installs kprobes on functions marked __init for testing. These probes are removed after the tests, but that removal schedules the delayed kprobes_optimizer work, which will do the actual text poke. If the work is executed after the init text is freed, then the warning triggers. The bug can be reproduced reliably when the work delay is increased. Flush the optimizer work and wait for the optimizing/unoptimizing lists to become empty before returning from the kprobes tracer selftest. That ensures that all operations which were queued due to the probes removal have completed. Link: http://lkml.kernel.org/r/20170516094802.76a468bb@gandalf.local.home Signed-off-by: Thomas Gleixner Acked-by: Masami Hiramatsu Cc: stable@vger.kernel.org Fixes: 6274de498 ("kprobes: Support delayed unoptimizing") Signed-off-by: Steven Rostedt (VMware) include/linux/kprobes.h | 3 +++ kernel/kprobes.c | 2 +- kernel/trace/trace_kprobe.c | 5 +++++ 3 files changed, 9 insertions(+), 1 deletion(-) commit b9ef0326c05a008c3c576bd4d676208b50c344d5 Author: Steven Rostedt Date: Wed May 17 11:14:35 2017 -0400 tracing: Move postpone selftests to core from early_initcall I hit the following lockdep splat when booting with ftrace selftests enabled, as well as CONFIG_PREEMPT and LOCKDEP. Testing dynamic ftrace ops #1: (1 0 1 0 0) (1 1 2 0 0) (2 1 3 0 169) (2 2 4 0 50066) ------------[ cut here ]------------ WARNING: CPU: 0 PID: 13 at kernel/rcu/srcutree.c:202 check_init_srcu_struct+0x60/0x70 Modules linked in: CPU: 0 PID: 13 Comm: rcu_tasks_kthre Not tainted 4.12.0-rc1-test+ #587 Hardware name: Hewlett-Packard HP Compaq Pro 6300 SFF/339A, BIOS K01 v02.05 05/07/2012 task: ffff880119628040 task.stack: ffffc900006a4000 RIP: 0010:check_init_srcu_struct+0x60/0x70 RSP: 0000:ffffc900006a7d98 EFLAGS: 00010246 RAX: 0000000000000246 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff880119628040 RSI: 00000000ffffffff RDI: ffffffff81e5fb40 RBP: ffffc900006a7e20 R08: 00000023b403c000 R09: 0000000000000001 R10: ffffc900006a7e40 R11: 0000000000000000 R12: ffffffff81e5fb40 R13: 0000000000000286 R14: ffff880119628040 R15: ffffc900006a7e98 FS: 0000000000000000(0000) GS:ffff88011ea00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff88011edff000 CR3: 0000000001e0f000 CR4: 00000000001406f0 Call Trace: ? __synchronize_srcu+0x6e/0x140 ? lock_acquire+0xdc/0x1d0 ? ktime_get_mono_fast_ns+0x5d/0xb0 synchronize_srcu+0x6f/0x110 ? synchronize_srcu+0x6f/0x110 rcu_tasks_kthread+0x20a/0x540 kthread+0x114/0x150 ? __rcu_read_unlock+0x70/0x70 ? kthread_create_on_node+0x40/0x40 ret_from_fork+0x2e/0x40 Code: f6 83 70 06 00 00 03 49 89 c5 74 0d be 01 00 00 00 48 89 df e8 42 fa ff ff 4c 89 ee 4c 89 e7 e8 b7 42 75 00 5b 41 5c 41 5d 5d c3 <0f> ff eb aa 66 90 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 ---[ end trace 5c3f4206ce50f6ac ]--- What happens is that the selftests include a creating of a dynamically allocated ftrace_ops, which requires the use of synchronize_rcu_tasks() which uses srcu, and triggers the above warning. It appears that synchronize_rcu_tasks() is not set up at early_initcall(), but it is at core_initcall(). By moving the tests down to that location works out properly. Link: http://lkml.kernel.org/r/20170517111435.7388c033@gandalf.local.home Acked-by: "Paul E. McKenney" Signed-off-by: Steven Rostedt (VMware) kernel/trace/trace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit aa1f058d7d9244423b8c5a75b9484b1115df7f02 Author: Jisheng Zhang Date: Mon Apr 24 12:35:51 2017 +0000 usb: chipidea: udc: fix NULL pointer dereference if udc_start failed Fix below NULL pointer dereference. we set ci->roles[CI_ROLE_GADGET] too early in ci_hdrc_gadget_init(), if udc_start() fails due to some reason, the ci->roles[CI_ROLE_GADGET] check in ci_hdrc_gadget_destroy can't protect us. We fix this issue by only setting ci->roles[CI_ROLE_GADGET] if udc_start() succeed. [ 1.398550] Unable to handle kernel NULL pointer dereference at virtual address 00000000 ... [ 1.448600] PC is at dma_pool_free+0xb8/0xf0 [ 1.453012] LR is at dma_pool_free+0x28/0xf0 [ 2.113369] [] dma_pool_free+0xb8/0xf0 [ 2.118857] [] destroy_eps+0x4c/0x68 [ 2.124165] [] ci_hdrc_gadget_destroy+0x28/0x50 [ 2.130461] [] ci_hdrc_probe+0x588/0x7e8 [ 2.136129] [] platform_drv_probe+0x50/0xb8 [ 2.142066] [] driver_probe_device+0x1fc/0x2a8 [ 2.148270] [] __device_attach_driver+0x9c/0xf8 [ 2.154563] [] bus_for_each_drv+0x58/0x98 [ 2.160317] [] __device_attach+0xc4/0x138 [ 2.166072] [] device_initial_probe+0x10/0x18 [ 2.172185] [] bus_probe_device+0x94/0xa0 [ 2.177940] [] device_add+0x3f0/0x560 [ 2.183337] [] platform_device_add+0x180/0x240 [ 2.189541] [] ci_hdrc_add_device+0x440/0x4f8 [ 2.195654] [] ci_hdrc_usb2_probe+0x13c/0x2d8 [ 2.201769] [] platform_drv_probe+0x50/0xb8 [ 2.207705] [] driver_probe_device+0x1fc/0x2a8 [ 2.213910] [] __driver_attach+0xac/0xb0 [ 2.219575] [] bus_for_each_dev+0x60/0xa0 [ 2.225329] [] driver_attach+0x20/0x28 [ 2.230816] [] bus_add_driver+0x1d0/0x238 [ 2.236571] [] driver_register+0x60/0xf8 [ 2.242237] [] __platform_driver_register+0x44/0x50 [ 2.248891] [] ci_hdrc_usb2_driver_init+0x18/0x20 [ 2.255365] [] do_one_initcall+0x38/0x128 [ 2.261121] [] kernel_init_freeable+0x1ac/0x250 [ 2.267414] [] kernel_init+0x10/0x100 [ 2.272810] [] ret_from_fork+0x10/0x50 Cc: stable Fixes: 3f124d233e97 ("usb: chipidea: add role init and destroy APIs") Signed-off-by: Jisheng Zhang Signed-off-by: Peter Chen drivers/usb/chipidea/udc.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 62b97d502bb76c6e8d589e42e02bfcb7bdff0453 Author: Andrey Smirnov Date: Mon May 15 06:48:58 2017 -0700 usb: chipidea: imx: Do not access CLKONOFF on i.MX51 Unlike i.MX53, i.MX51's USBOH3 register file does not implemenent registers past offset 0x018, which includes MX53_USB_CLKONOFF_CTRL_OFFSET and trying to access that register on said platform results in external abort. Fix it by enabling CLKONOFF accessing codepath only for i.MX53. Cc: stable Fixes 3be3251db088 ("usb: chipidea: imx: Disable internal 60Mhz clock with ULPI PHY") Cc: cphealy@gmail.com Cc: Greg Kroah-Hartman Cc: linux-usb@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Andrey Smirnov Signed-off-by: Peter Chen drivers/usb/chipidea/usbmisc_imx.c | 41 +++++++++++++++++++++++++++++--------- 1 file changed, 32 insertions(+), 9 deletions(-) commit eeeb51d834d76c66784e7fe1a9ace3ce3f8d2af1 Author: James Smart Date: Tue May 16 20:52:29 2017 -0700 scsi: lpfc: fix build issue if NVME_FC_TARGET is not defined fix build issue if NVME_FC_TARGET is not defined. noop the code. The code will never be invoked if target mode is not enabled. Signed-off-by: Dick Kennedy Signed-off-by: James Smart Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc_nvmet.c | 2 ++ 1 file changed, 2 insertions(+) commit 53cf29d3b1bc5b86fcff5fdc52f873d79d908ef4 Author: Guilherme G. Piccoli Date: Wed May 17 19:02:17 2017 -0300 scsi: lpfc: Fix NULL pointer dereference during PCI error recovery Recent commit on patchset "lpfc updates for 11.2.0.14" fixed an issue about dereferencing a NULL pointer on port reset. The specific commit, named "lpfc: Fix system crash when port is reset.", is missing a check against NULL pointer on lpfc_els_flush_cmd() though. Since we destroy the queues on adapter resets, like in PCI error recovery path, we need the validation present on this patch in order to avoid a NULL pointer dereference when trying to flush commands of ELS wq, after it has been destroyed (which would lead to a kernel oops). Tested-by: Raphael Silva Signed-off-by: Guilherme G. Piccoli Acked-by: James Smart Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc_els.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 579f1d926c66cc0bd3bd87b1fe2e091084b07430 Author: Yonghong Song Date: Wed May 17 15:18:05 2017 -0700 selftests/bpf: fix broken build due to types.h Commit 0a5539f66133 ("bpf: Provide a linux/types.h override for bpf selftests.") caused a build failure for tools/testing/selftest/bpf because of some missing types: $ make -C tools/testing/selftests/bpf/ ... In file included from /home/yhs/work/net-next/tools/testing/selftests/bpf/test_pkt_access.c:8: ../../../include/uapi/linux/bpf.h:170:3: error: unknown type name '__aligned_u64' __aligned_u64 key; ... /usr/include/linux/swab.h:160:8: error: unknown type name '__always_inline' static __always_inline __u16 __swab16p(const __u16 *p) ... The type __aligned_u64 is defined in linux:include/uapi/linux/types.h. The fix is to copy missing type definition into tools/testing/selftests/bpf/include/uapi/linux/types.h. Adding additional include "string.h" resolves __always_inline issue. Fixes: 0a5539f66133 ("bpf: Provide a linux/types.h override for bpf selftests.") Signed-off-by: Yonghong Song Signed-off-by: David S. Miller tools/testing/selftests/bpf/include/uapi/linux/types.h | 16 ++++++++++++++++ tools/testing/selftests/bpf/test_pkt_access.c | 1 + 2 files changed, 17 insertions(+) commit dac94e29110cd606dec37673644caf2cf6fd1dde Merge: 243bfd2 7e1b952 Author: Linus Torvalds Date: Wed May 17 14:21:15 2017 -0700 Merge tag 'for-4.12/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: - a couple DM thin provisioning fixes - a few request-based DM and DM multipath fixes for issues that were made when merging Christoph's changes with Bart's changes for 4.12 - a DM bufio unsigned overflow fix - a couple pure fixes for the DM cache target. - various very small tweaks to the DM cache target that enable considerable speed improvements in the face of continuous IO. Given that the cache target was significantly reworked for 4.12 I see no reason to sit on these advances until 4.13 considering the favorable results associated with such minimalist tweaks. * tag 'for-4.12/dm-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm cache: handle kmalloc failure allocating background_tracker struct dm bufio: make the parameter "retain_bytes" unsigned long dm mpath: multipath_clone_and_map must not return -EIO dm mpath: don't return -EIO from dm_report_EIO dm rq: add a missing break to map_request dm space map disk: fix some book keeping in the disk space map dm thin metadata: call precommit before saving the roots dm cache policy smq: don't do any writebacks unless IDLE dm cache: simplify the IDLE vs BUSY state calculation dm cache: track all IO to the cache rather than just the origin device's IO dm cache policy smq: stop preemptively demoting blocks dm cache policy smq: put newly promoted entries at the top of the multiqueue dm cache policy smq: be more aggressive about triggering a writeback dm cache policy smq: only demote entries in bottom half of the clean multiqueue dm cache: fix incorrect 'idle_time' reset in IO tracker commit 243bfd2c052dafe9e59fb0170434bfe706439156 Merge: b23afd3 83345d5 Author: Linus Torvalds Date: Wed May 17 14:13:44 2017 -0700 Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: "Here are some bugfixes from I2C, especially removing a wrongly displayed error message for all i2c muxes" * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: xgene: Set ACPI_COMPANION_I2C i2c: mv64xxx: don't override deferred probing when getting irq i2c: mux: only print failure message on error i2c: mux: reg: rename label to indicate what it does i2c: mux: reg: put away the parent i2c adapter on probe failure commit 33c35aa4817864e056fd772230b0c6b552e36ea2 Author: Waiman Long Date: Mon May 15 09:34:06 2017 -0400 cgroup: Prevent kill_css() from being called more than once The kill_css() function may be called more than once under the condition that the css was killed but not physically removed yet followed by the removal of the cgroup that is hosting the css. This patch prevents any harmm from being done when that happens. Signed-off-by: Waiman Long Signed-off-by: Tejun Heo Cc: stable@vger.kernel.org # v4.5+ include/linux/cgroup-defs.h | 1 + kernel/cgroup/cgroup.c | 5 +++++ 2 files changed, 6 insertions(+) commit f917174caf71a470e520fbee0daf9d9e62da3ef6 Merge: 9142e900 f667724 Author: David S. Miller Date: Wed May 17 15:12:50 2017 -0400 Merge branch 'bnxt_en-DCBX-fixes' Michael Chan says: ==================== bnxt_en: DCBX fixes. 2 bug fixes for the case where the NIC's firmware DCBX agent is enabled. With these fixes, we will return the proper information to lldpad. ==================== Signed-off-by: David S. Miller commit f667724b99ad1afc91f16064d8fb293d2805bd57 Author: Michael Chan Date: Tue May 16 16:39:44 2017 -0400 bnxt_en: Check status of firmware DCBX agent before setting DCB_CAP_DCBX_HOST. Otherwise, all the host based DCBX settings from lldpad will fail if the firmware DCBX agent is running. Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 87fe603274aa9889c05cca3c3e45675e1997cb13 Author: Michael Chan Date: Tue May 16 16:39:43 2017 -0400 bnxt_en: Call bnxt_dcb_init() after getting firmware DCBX configuration. In the current code, bnxt_dcb_init() is called too early before we determine if the firmware DCBX agent is running or not. As a result, we are not setting the DCB_CAP_DCBX_HOST and DCB_CAP_DCBX_LLD_MANAGED flags properly to report to DCBNL. Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 9142e9007f2d7ab58a587a1e1d921b0064a339aa Author: Eric Dumazet Date: Tue May 16 13:27:53 2017 -0700 net: fix compile error in skb_orphan_partial() If CONFIG_INET is not set, net/core/sock.c can not compile : net/core/sock.c: In function ‘skb_orphan_partial’: net/core/sock.c:1810:2: error: implicit declaration of function ‘skb_is_tcp_pure_ack’ [-Werror=implicit-function-declaration] if (skb_is_tcp_pure_ack(skb)) ^ Fix this by always including Fixes: f6ba8d33cfbb ("netem: fix skb_orphan_partial()") Signed-off-by: Eric Dumazet Reported-by: Paul Gortmaker Reported-by: Randy Dunlap Reported-by: Stephen Rothwell Signed-off-by: David S. Miller net/core/sock.c | 3 --- 1 file changed, 3 deletions(-) commit 48078d2dac0a26f84f5f3ec704f24f7c832cce14 Author: Liam R. Howlett Date: Wed May 17 11:47:00 2017 -0400 sparc/ftrace: Fix ftrace graph time measurement The ftrace function_graph time measurements of a given function is not accurate according to those recorded by ftrace using the function filters. This change pulls the x86_64 fix from 'commit 722b3c746953 ("ftrace/graph: Trace function entry before updating index")' into the sparc specific prepare_ftrace_return which stops ftrace from counting interrupted tasks in the time measurement. Example measurements for select_task_rq_fair running "hackbench 100 process 1000": | tracing/trace_stat/function0 | function_graph Before patch | 2.802 us | 4.255 us After patch | 2.749 us | 3.094 us Signed-off-by: Liam R. Howlett Signed-off-by: David S. Miller arch/sparc/kernel/ftrace.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) commit deba804c90642c8ed0f15ac1083663976d578f54 Author: Orlando Arias Date: Tue May 16 15:34:00 2017 -0400 sparc: Fix -Wstringop-overflow warning Greetings, GCC 7 introduced the -Wstringop-overflow flag to detect buffer overflows in calls to string handling functions [1][2]. Due to the way ``empty_zero_page'' is declared in arch/sparc/include/setup.h, this causes a warning to trigger at compile time in the function mem_init(), which is subsequently converted to an error. The ensuing patch fixes this issue and aligns the declaration of empty_zero_page to that of other architectures. Thank you. Cheers, Orlando. [1] https://gcc.gnu.org/ml/gcc-patches/2016-10/msg02308.html [2] https://gcc.gnu.org/gcc-7/changes.html Signed-off-by: Orlando Arias -------------------------------------------------------------------------------- Signed-off-by: David S. Miller arch/sparc/include/asm/pgtable_32.h | 4 ++-- arch/sparc/include/asm/setup.h | 2 +- arch/sparc/mm/init_32.c | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) commit b6c41cb050d5debc7e4eaa0a81cbdbad72588891 Author: Nitin Gupta Date: Mon May 15 16:28:17 2017 -0700 sparc64: Fix mapping of 64k pages with MAP_FIXED An incorrect huge page alignment check caused mmap failure for 64K pages when MAP_FIXED is used with address not aligned to HPAGE_SIZE. Orabug: 25885991 Fixes: dcd1912d21a0 ("sparc64: Add 64K page size support") Signed-off-by: Nitin Gupta Signed-off-by: David S. Miller arch/sparc/include/asm/hugetlb.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 2423496af35d94a87156b063ea5cedffc10a70a1 Author: Craig Gallek Date: Tue May 16 14:36:23 2017 -0400 ipv6: Prevent overrun when parsing v6 header options The KASAN warning repoted below was discovered with a syzkaller program. The reproducer is basically: int s = socket(AF_INET6, SOCK_RAW, NEXTHDR_HOP); send(s, &one_byte_of_data, 1, MSG_MORE); send(s, &more_than_mtu_bytes_data, 2000, 0); The socket() call sets the nexthdr field of the v6 header to NEXTHDR_HOP, the first send call primes the payload with a non zero byte of data, and the second send call triggers the fragmentation path. The fragmentation code tries to parse the header options in order to figure out where to insert the fragment option. Since nexthdr points to an invalid option, the calculation of the size of the network header can made to be much larger than the linear section of the skb and data is read outside of it. This fix makes ip6_find_1stfrag return an error if it detects running out-of-bounds. [ 42.361487] ================================================================== [ 42.364412] BUG: KASAN: slab-out-of-bounds in ip6_fragment+0x11c8/0x3730 [ 42.365471] Read of size 840 at addr ffff88000969e798 by task ip6_fragment-oo/3789 [ 42.366469] [ 42.366696] CPU: 1 PID: 3789 Comm: ip6_fragment-oo Not tainted 4.11.0+ #41 [ 42.367628] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.1-1ubuntu1 04/01/2014 [ 42.368824] Call Trace: [ 42.369183] dump_stack+0xb3/0x10b [ 42.369664] print_address_description+0x73/0x290 [ 42.370325] kasan_report+0x252/0x370 [ 42.370839] ? ip6_fragment+0x11c8/0x3730 [ 42.371396] check_memory_region+0x13c/0x1a0 [ 42.371978] memcpy+0x23/0x50 [ 42.372395] ip6_fragment+0x11c8/0x3730 [ 42.372920] ? nf_ct_expect_unregister_notifier+0x110/0x110 [ 42.373681] ? ip6_copy_metadata+0x7f0/0x7f0 [ 42.374263] ? ip6_forward+0x2e30/0x2e30 [ 42.374803] ip6_finish_output+0x584/0x990 [ 42.375350] ip6_output+0x1b7/0x690 [ 42.375836] ? ip6_finish_output+0x990/0x990 [ 42.376411] ? ip6_fragment+0x3730/0x3730 [ 42.376968] ip6_local_out+0x95/0x160 [ 42.377471] ip6_send_skb+0xa1/0x330 [ 42.377969] ip6_push_pending_frames+0xb3/0xe0 [ 42.378589] rawv6_sendmsg+0x2051/0x2db0 [ 42.379129] ? rawv6_bind+0x8b0/0x8b0 [ 42.379633] ? _copy_from_user+0x84/0xe0 [ 42.380193] ? debug_check_no_locks_freed+0x290/0x290 [ 42.380878] ? ___sys_sendmsg+0x162/0x930 [ 42.381427] ? rcu_read_lock_sched_held+0xa3/0x120 [ 42.382074] ? sock_has_perm+0x1f6/0x290 [ 42.382614] ? ___sys_sendmsg+0x167/0x930 [ 42.383173] ? lock_downgrade+0x660/0x660 [ 42.383727] inet_sendmsg+0x123/0x500 [ 42.384226] ? inet_sendmsg+0x123/0x500 [ 42.384748] ? inet_recvmsg+0x540/0x540 [ 42.385263] sock_sendmsg+0xca/0x110 [ 42.385758] SYSC_sendto+0x217/0x380 [ 42.386249] ? SYSC_connect+0x310/0x310 [ 42.386783] ? __might_fault+0x110/0x1d0 [ 42.387324] ? lock_downgrade+0x660/0x660 [ 42.387880] ? __fget_light+0xa1/0x1f0 [ 42.388403] ? __fdget+0x18/0x20 [ 42.388851] ? sock_common_setsockopt+0x95/0xd0 [ 42.389472] ? SyS_setsockopt+0x17f/0x260 [ 42.390021] ? entry_SYSCALL_64_fastpath+0x5/0xbe [ 42.390650] SyS_sendto+0x40/0x50 [ 42.391103] entry_SYSCALL_64_fastpath+0x1f/0xbe [ 42.391731] RIP: 0033:0x7fbbb711e383 [ 42.392217] RSP: 002b:00007ffff4d34f28 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 42.393235] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fbbb711e383 [ 42.394195] RDX: 0000000000001000 RSI: 00007ffff4d34f60 RDI: 0000000000000003 [ 42.395145] RBP: 0000000000000046 R08: 00007ffff4d34f40 R09: 0000000000000018 [ 42.396056] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000400aad [ 42.396598] R13: 0000000000000066 R14: 00007ffff4d34ee0 R15: 00007fbbb717af00 [ 42.397257] [ 42.397411] Allocated by task 3789: [ 42.397702] save_stack_trace+0x16/0x20 [ 42.398005] save_stack+0x46/0xd0 [ 42.398267] kasan_kmalloc+0xad/0xe0 [ 42.398548] kasan_slab_alloc+0x12/0x20 [ 42.398848] __kmalloc_node_track_caller+0xcb/0x380 [ 42.399224] __kmalloc_reserve.isra.32+0x41/0xe0 [ 42.399654] __alloc_skb+0xf8/0x580 [ 42.400003] sock_wmalloc+0xab/0xf0 [ 42.400346] __ip6_append_data.isra.41+0x2472/0x33d0 [ 42.400813] ip6_append_data+0x1a8/0x2f0 [ 42.401122] rawv6_sendmsg+0x11ee/0x2db0 [ 42.401505] inet_sendmsg+0x123/0x500 [ 42.401860] sock_sendmsg+0xca/0x110 [ 42.402209] ___sys_sendmsg+0x7cb/0x930 [ 42.402582] __sys_sendmsg+0xd9/0x190 [ 42.402941] SyS_sendmsg+0x2d/0x50 [ 42.403273] entry_SYSCALL_64_fastpath+0x1f/0xbe [ 42.403718] [ 42.403871] Freed by task 1794: [ 42.404146] save_stack_trace+0x16/0x20 [ 42.404515] save_stack+0x46/0xd0 [ 42.404827] kasan_slab_free+0x72/0xc0 [ 42.405167] kfree+0xe8/0x2b0 [ 42.405462] skb_free_head+0x74/0xb0 [ 42.405806] skb_release_data+0x30e/0x3a0 [ 42.406198] skb_release_all+0x4a/0x60 [ 42.406563] consume_skb+0x113/0x2e0 [ 42.406910] skb_free_datagram+0x1a/0xe0 [ 42.407288] netlink_recvmsg+0x60d/0xe40 [ 42.407667] sock_recvmsg+0xd7/0x110 [ 42.408022] ___sys_recvmsg+0x25c/0x580 [ 42.408395] __sys_recvmsg+0xd6/0x190 [ 42.408753] SyS_recvmsg+0x2d/0x50 [ 42.409086] entry_SYSCALL_64_fastpath+0x1f/0xbe [ 42.409513] [ 42.409665] The buggy address belongs to the object at ffff88000969e780 [ 42.409665] which belongs to the cache kmalloc-512 of size 512 [ 42.410846] The buggy address is located 24 bytes inside of [ 42.410846] 512-byte region [ffff88000969e780, ffff88000969e980) [ 42.411941] The buggy address belongs to the page: [ 42.412405] page:ffffea000025a780 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 [ 42.413298] flags: 0x100000000008100(slab|head) [ 42.413729] raw: 0100000000008100 0000000000000000 0000000000000000 00000001800c000c [ 42.414387] raw: ffffea00002a9500 0000000900000007 ffff88000c401280 0000000000000000 [ 42.415074] page dumped because: kasan: bad access detected [ 42.415604] [ 42.415757] Memory state around the buggy address: [ 42.416222] ffff88000969e880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 42.416904] ffff88000969e900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 42.417591] >ffff88000969e980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 42.418273] ^ [ 42.418588] ffff88000969ea00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.419273] ffff88000969ea80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 42.419882] ================================================================== Reported-by: Andrey Konovalov Signed-off-by: Craig Gallek Signed-off-by: David S. Miller net/ipv6/ip6_offload.c | 2 ++ net/ipv6/ip6_output.c | 4 ++++ net/ipv6/output_core.c | 14 ++++++++------ net/ipv6/udp_offload.c | 2 ++ 4 files changed, 16 insertions(+), 6 deletions(-) commit 05d8cba4a1e8c7e2d1f91a24a2f3d26852938a04 Author: Masahiro Yamada Date: Tue May 16 14:15:03 2017 +0900 kbuild: skip install/check of headers right under uapi directories Since commit 61562f981e92 ("uapi: export all arch specifics directories"), "make INSTALL_HDR_PATH=$root/usr headers_install" deletes standard glibc headers and others in $(root)/usr/include. The cause of the issue is that headers_install now starts descending from arch/$(hdr-arch)/include/uapi with $(root)/usr/include for its destination when installing asm headers. So, headers already there are assumed to be unwanted. When headers_install starts descending from include/uapi with $(root)/usr/include for its destination, it works around the problem by creating an dummy destination $(root)/usr/include/uapi, but this is tricky. To fix the problem in a clean way is to skip headers install/check in include/uapi and arch/$(hdr-arch)/include/uapi because we know there are only sub-directories in uapi directories. A good side effect is the empty destination $(root)/usr/include/uapi will go away. I am also removing the trailing slash in the headers_check target to skip checking in arch/$(hdr-arch)/include/uapi. Fixes: 61562f981e92 ("uapi: export all arch specifics directories") Reported-by: Dan Williams Signed-off-by: Masahiro Yamada Tested-by: Dan Williams Acked-by: Nicolas Dichtel Makefile | 2 +- scripts/Makefile.headersinst | 43 +++++++++++++++++++++++++++---------------- 2 files changed, 28 insertions(+), 17 deletions(-) commit 49e67dd17649b60b4d54966e18ec9c80198227f0 Author: Johan Hovold Date: Wed May 17 17:29:09 2017 +0200 of: fdt: add missing allocation-failure check The memory allocator passed to __unflatten_device_tree() (e.g. a wrapped kzalloc) can fail so add the missing sanity check to avoid dereferencing a NULL pointer. Fixes: fe14042358fa ("of/flattree: Refactor unflatten_device_tree and add fdt_unflatten_tree") Cc: stable # 2.6.38 Signed-off-by: Johan Hovold Signed-off-by: Rob Herring drivers/of/fdt.c | 3 +++ 1 file changed, 3 insertions(+) commit 828d4cdd012c8ffbf76625c3ff164312e8666784 Author: Shuah Khan Date: Tue May 16 10:08:08 2017 -0600 dtc: check.c fix compile error Fix the following compile error found on odroid-xu4: checks.c: In function ‘check_simple_bus_reg’: checks.c:876:41: error: format ‘%lx’ expects argument of type ‘long unsigned int’, but argument 4 has type ‘uint64_t{aka long long unsigned int}’ [-Werror=format=] snprintf(unit_addr, sizeof(unit_addr), "%lx", reg); ^ checks.c:876:41: error: format ‘%lx’ expects argument of type ‘long unsigned int’, but argument 4 has type ‘uint64_t {aka long long unsigned int}’ [-Werror=format=] cc1: all warnings being treated as errors Makefile:304: recipe for target 'checks.o' failed make: *** [checks.o] Error 1 Signed-off-by: Shuah Khan [dwg: Correct new format to be correct in general] Signed-off-by: David Gibson [robh: cherry-picked from upstream dtc commit 2a42b14d0d03] Signed-off-by: Rob Herring scripts/dtc/checks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 63a1e1c95e60e798fa09ab3c536fb555aa5bbf2b Author: Mark Rutland Date: Tue May 16 15:18:05 2017 +0100 arm64/cpufeature: don't use mutex in bringup path Currently, cpus_set_cap() calls static_branch_enable_cpuslocked(), which must take the jump_label mutex. We call cpus_set_cap() in the secondary bringup path, from the idle thread where interrupts are disabled. Taking a mutex in this path "is a NONO" regardless of whether it's contended, and something we must avoid. We didn't spot this until recently, as ___might_sleep() won't warn for this case until all CPUs have been brought up. This patch avoids taking the mutex in the secondary bringup path. The poking of static keys is deferred until enable_cpu_capabilities(), which runs in a suitable context on the boot CPU. To account for the static keys being set later, cpus_have_const_cap() is updated to use another static key to check whether the const cap keys have been initialised, falling back to the caps bitmap until this is the case. This means that users of cpus_have_const_cap() gain should only gain a single additional NOP in the fast path once the const caps are initialised, but should always see the current cap value. The hyp code should never dereference the caps array, since the caps are initialized before we run the module initcall to initialise hyp. A check is added to the hyp init code to document this requirement. This change will sidestep a number of issues when the upcoming hotplug locking rework is merged. Signed-off-by: Mark Rutland Reviewed-by: Marc Zyniger Reviewed-by: Suzuki Poulose Acked-by: Will Deacon Cc: Christoffer Dall Cc: Peter Zijlstra Cc: Sebastian Sewior Cc: Thomas Gleixner Signed-off-by: Catalin Marinas arch/arm64/include/asm/cpufeature.h | 12 ++++++++++-- arch/arm64/include/asm/kvm_host.h | 8 ++++++-- arch/arm64/kernel/cpufeature.c | 23 +++++++++++++++++++++-- 3 files changed, 37 insertions(+), 6 deletions(-) commit 77d7123342dcf6442341b67816321d71da8b2b16 Author: Ihar Hrachyshka Date: Tue May 16 08:44:24 2017 -0700 neighbour: update neigh timestamps iff update is effective It's a common practice to send gratuitous ARPs after moving an IP address to another device to speed up healing of a service. To fulfill service availability constraints, the timing of network peers updating their caches to point to a new location of an IP address can be particularly important. Sometimes neigh_update calls won't touch neither lladdr nor state, for example if an update arrives in locktime interval. The neigh->updated value is tested by the protocol specific neigh code, which in turn will influence whether NEIGH_UPDATE_F_OVERRIDE gets set in the call to neigh_update() or not. As a result, we may effectively ignore the update request, bailing out of touching the neigh entry, except that we still bump its timestamps inside neigh_update. This may be a problem for updates arriving in quick succession. For example, consider the following scenario: A service is moved to another device with its IP address. The new device sends three gratuitous ARP requests into the network with ~1 seconds interval between them. Just before the first request arrives to one of network peer nodes, its neigh entry for the IP address transitions from STALE to DELAY. This transition, among other things, updates neigh->updated. Once the kernel receives the first gratuitous ARP, it ignores it because its arrival time is inside the locktime interval. The kernel still bumps neigh->updated. Then the second gratuitous ARP request arrives, and it's also ignored because it's still in the (new) locktime interval. Same happens for the third request. The node eventually heals itself (after delay_first_probe_time seconds since the initial transition to DELAY state), but it just wasted some time and require a new ARP request/reply round trip. This unfortunate behaviour both puts more load on the network, as well as reduces service availability. This patch changes neigh_update so that it bumps neigh->updated (as well as neigh->confirmed) only once we are sure that either lladdr or entry state will change). In the scenario described above, it means that the second gratuitous ARP request will actually update the entry lladdr. Ideally, we would update the neigh entry on the very first gratuitous ARP request. The locktime mechanism is designed to ignore ARP updates in a short timeframe after a previous ARP update was honoured by the kernel layer. This would require tracking timestamps for state transitions separately from timestamps when actual updates are received. This would probably involve changes in neighbour struct. Therefore, the patch doesn't tackle the issue of the first gratuitous APR ignored, leaving it for a follow-up. Signed-off-by: Ihar Hrachyshka Signed-off-by: David S. Miller net/core/neighbour.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) commit 23d268eb240954e6e78f7cfab04f2b1e79f84489 Author: Ihar Hrachyshka Date: Tue May 16 07:53:43 2017 -0700 arp: honour gratuitous ARP _replies_ When arp_accept is 1, gratuitous ARPs are supposed to override matching entries irrespective of whether they arrive during locktime. This was implemented in commit 56022a8fdd87 ("ipv4: arp: update neighbour address when a gratuitous arp is received and arp_accept is set") There is a glitch in the patch though. RFC 2002, section 4.6, "ARP, Proxy ARP, and Gratuitous ARP", defines gratuitous ARPs so that they can be either of Request or Reply type. Those Reply gratuitous ARPs can be triggered with standard tooling, for example, arping -A option does just that. This patch fixes the glitch, making both Request and Reply flavours of gratuitous ARPs to behave identically. As per RFC, if gratuitous ARPs are of Reply type, their Target Hardware Address field should also be set to the link-layer address to which this cache entry should be updated. The field is present in ARP over Ethernet but not in IEEE 1394. In this patch, I don't consider any broadcasted ARP replies as gratuitous if the field is not present, to conform the standard. It's not clear whether there is such a thing for IEEE 1394 as a gratuitous ARP reply; until it's cleared up, we will ignore such broadcasts. Note that they will still update existing ARP cache entries, assuming they arrive out of locktime time interval. Signed-off-by: Ihar Hrachyshka Signed-off-by: David S. Miller net/ipv4/arp.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) commit 8d7a10dd323993cc40bd37bce8bc570133b0c396 Author: Bjørn Mork Date: Wed May 17 16:30:50 2017 +0200 USB: serial: qcserial: add more Lenovo EM74xx device IDs In their infinite wisdom, and never ending quest for end user frustration, Lenovo has decided to use new USB device IDs for the wwan modules in their 2017 laptops. The actual hardware is still the Sierra Wireless EM7455 or EM7430, depending on region. Cc: Signed-off-by: Bjørn Mork Signed-off-by: Johan Hovold drivers/usb/serial/qcserial.c | 2 ++ 1 file changed, 2 insertions(+) commit 69c8ebf83213e6165b13d94ec599b861467ee2dc Author: Jan Kara Date: Tue May 16 12:22:22 2017 +0200 fuseblk: Fix warning in super_setup_bdi_name() Commit 5f7f7543f52e "fuse: Convert to separately allocated bdi" didn't properly handle fuseblk filesystem. When fuse_bdi_init() is called for that filesystem type, sb->s_bdi is already initialized (by set_bdev_super()) to point to block device's bdi and consequently super_setup_bdi_name() complains about this fact when reseting bdi to the private one. Fix the problem by properly dropping bdi reference in fuse_bdi_init() before creating a private bdi in super_setup_bdi_name(). Fixes: 5f7f7543f52e ("fuse: Convert to separately allocated bdi") Reported-by: Rakesh Pandit Tested-by: Rakesh Pandit Signed-off-by: Jan Kara Signed-off-by: Jens Axboe fs/fuse/inode.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit bca5238816939436d72ae6bab124c4b0641a3a99 Author: Ravikumar Kattekola Date: Wed May 17 06:51:38 2017 -0700 ARM: dts: dra7: Reduce cpu thermal shutdown temperature On dra7, as per TRM, the HW shutdown (TSHUT) temperature is hardcoded to 123C and cannot be modified by SW. This means when the temperature reaches 123C HW asserts TSHUT output which signals a warm reset. This reset is held until the temperature goes below the TSHUT low (105C). While in SW, the thermal driver continuously monitors current temperature and takes decisions based on whether it reached an alert or a critical point. The intention of setting a SW critical point is to prevent force reset by HW and instead do an orderly_poweroff(). But if the SW critical temperature is greater than or equal to that of HW then it defeats the purpose. To address this and let SW take action before HW does keep the SW critical temperature less than HW TSHUT value. The value for SW critical temperature was chosen as 120C just to ensure we give SW sometime before HW catches up. Document reference SPRUI30C – DRA75x, DRA74x Technical Reference Manual - November 2016 SPRUHZ6H - AM572x Technical Reference Manual - November 2016 Tested on: DRA75x PG 2.0 Rev H EVM Signed-off-by: Ravikumar Kattekola Signed-off-by: Tony Lindgren arch/arm/boot/dts/dra7.dtsi | 4 ++++ 1 file changed, 4 insertions(+) commit 7e1b9521f5a8356553f5e58b07952bf346632ea4 Author: Colin Ian King Date: Sat Mar 11 19:09:45 2017 +0000 dm cache: handle kmalloc failure allocating background_tracker struct Currently there is no kmalloc failure check on the allocation of the background_tracker struct in btracker_create(), and so a NULL return will lead to a NULL pointer dereference. Add a NULL check. Detected by CoverityScan, CID#1416587 ("Dereference null return value") Fixes: b29d4986d ("dm cache: significant rework to leverage dm-bio-prison-v2") Signed-off-by: Colin Ian King Signed-off-by: Mike Snitzer drivers/md/dm-cache-background-tracker.c | 5 +++++ 1 file changed, 5 insertions(+) commit 745b6e74704782488dd875292bc49e24d23e81fd Author: Arnd Bergmann Date: Thu May 11 13:35:51 2017 +0200 iommu/mediatek: Include linux/dma-mapping.h The mediatek iommu driver relied on an implicit include of dma-mapping.h, but for some reason that is no longer there in 4.12-rc1: drivers/iommu/mtk_iommu_v1.c: In function 'mtk_iommu_domain_finalise': drivers/iommu/mtk_iommu_v1.c:233:16: error: implicit declaration of function 'dma_zalloc_coherent'; did you mean 'debug_dma_alloc_coherent'? [-Werror=implicit-function-declaration] drivers/iommu/mtk_iommu_v1.c: In function 'mtk_iommu_domain_free': drivers/iommu/mtk_iommu_v1.c:265:2: error: implicit declaration of function 'dma_free_coherent'; did you mean 'debug_dma_free_coherent'? [-Werror=implicit-function-declaration] This adds an explicit #include to make it build again. Signed-off-by: Arnd Bergmann Fixes: 208480bb27 ('iommu: Remove trace-events include from iommu.h') Signed-off-by: Joerg Roedel drivers/iommu/mtk_iommu_v1.c | 1 + 1 file changed, 1 insertion(+) commit f73a7eee900e95404b61408a23a1df5c5811704c Author: KarimAllah Ahmed Date: Fri May 5 11:39:59 2017 -0700 iommu/vt-d: Flush the IOTLB to get rid of the initial kdump mappings Ever since commit 091d42e43d ("iommu/vt-d: Copy translation tables from old kernel") the kdump kernel copies the IOMMU context tables from the previous kernel. Each device mappings will be destroyed once the driver for the respective device takes over. This unfortunately breaks the workflow of mapping and unmapping a new context to the IOMMU. The mapping function assumes that either: 1) Unmapping did the proper IOMMU flushing and it only ever flush if the IOMMU unit supports caching invalid entries. 2) The system just booted and the initialization code took care of flushing all IOMMU caches. This assumption is not true for the kdump kernel since the context tables have been copied from the previous kernel and translations could have been cached ever since. So make sure to flush the IOTLB as well when we destroy these old copied mappings. Cc: Joerg Roedel Cc: David Woodhouse Cc: David Woodhouse Cc: Anthony Liguori Signed-off-by: KarimAllah Ahmed Acked-by: David Woodhouse Cc: stable@vger.kernel.org v4.2+ Fixes: 091d42e43d ("iommu/vt-d: Copy translation tables from old kernel") Signed-off-by: Joerg Roedel drivers/iommu/intel-iommu.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 1cc896ed61fa0441dffef726ff678fd82a9e6265 Author: Robin Murphy Date: Mon May 15 16:01:30 2017 +0100 iommu/dma: Don't touch invalid iova_domain members When __iommu_dma_map() and iommu_dma_free_iova() are called from iommu_dma_get_msi_page(), various iova_*() helpers are still invoked in the process, whcih is unwise since they access a different member of the union (the iova_domain) from that which was last written, and there's no guarantee that sensible values will result anyway. CLean up the code paths that are valid for an MSI cookie to ensure we only do iova_domain-specific things when we're actually dealing with one. Fixes: a44e6657585b ("iommu/dma: Clean up MSI IOVA allocation") Reported-by: Nate Watterson Tested-by: Shanker Donthineni Tested-by: Bharat Bhushan Signed-off-by: Robin Murphy Tested-by: Eric Auger Signed-off-by: Joerg Roedel drivers/iommu/dma-iommu.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) commit 5667c86acf021e6dcf02584408b4484a273ac68f Author: Rajkumar Manoharan Date: Sun May 14 21:41:55 2017 -0700 mac80211: strictly check mesh address extension mode Mesh forwarding path checks for address extension mode to fetch appropriate proxied address and MPP address. Existing condition that looks for 6 address format is not strict enough so that frames with improper values are processed and invalid entries are added into MPP table. Fix that by adding a stricter check before processing the packet. Per IEEE Std 802.11s-2011 spec. Table 7-6g1 lists address extension mode 0x3 as reserved one. And also Table Table 9-13 does not specify 0x3 as valid address field. Fixes: 9b395bc3be1c ("mac80211: verify that skb data is present") Signed-off-by: Rajkumar Manoharan Signed-off-by: Johannes Berg net/mac80211/rx.c | 3 ++- net/wireless/util.c | 10 ++++++---- 2 files changed, 8 insertions(+), 5 deletions(-) commit c0e7bb38c07cbd8269549ee0a0566021a3c729de Author: Christian Borntraeger Date: Mon May 15 14:11:03 2017 +0200 s390/kvm: do not rely on the ILC on kvm host protection fauls For most cases a protection exception in the host (e.g. copy on write or dirty tracking) on the sie instruction will indicate an instruction length of 4. Turns out that there are some corner cases (e.g. runtime instrumentation) where this is not necessarily true and the ILC is unpredictable. Let's replace our 4 byte rewind_pad with 3 byte nops to prepare for all possible ILCs. Signed-off-by: Christian Borntraeger Cc: stable@vger.kernel.org Signed-off-by: Martin Schwidefsky arch/s390/kernel/entry.S | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) commit 95d7c1f18bf8ac03b0fc48eac1f1b11f867765b8 Author: Christophe JAILLET Date: Sat May 13 13:40:20 2017 +0200 ARM: davinci: PM: Do not free useful resources in normal path in 'davinci_pm_init' It is wrong to iounmap resources in the normal path of davinci_pm_init() The 3 ioremap'ed fields of 'pm_config' can be accessed later on in other functions, so we should return 'success' instead of unrolling everything. Fixes: aa9aa1ec2df6 ("ARM: davinci: PM: rework init, remove platform device") Signed-off-by: Christophe JAILLET [nsekhar@ti.com: commit message and minor style fixes] Signed-off-by: Sekhar Nori arch/arm/mach-davinci/pm.c | 2 ++ 1 file changed, 2 insertions(+) commit 5120a266928a07231d198bb518f6fe73148786a3 Author: Johan Hovold Date: Wed May 10 18:18:30 2017 +0200 USB: host: xhci: use max-port define Use the new define for the maximum number of SuperSpeed ports instead of a constant when allocating xHCI root hubs. Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman drivers/usb/host/xhci-mem.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 93491ced3c87c94b12220dbac0527e1356702179 Author: Johan Hovold Date: Wed May 10 18:18:29 2017 +0200 USB: hub: fix SS max number of ports Add define for the maximum number of ports on a SuperSpeed hub as per USB 3.1 spec Table 10-5, and use it when verifying the retrieved hub descriptor. This specifically avoids benign attempts to update the DeviceRemovable mask for non-existing ports (should we get that far). Fixes: dbe79bbe9dcb ("USB 3.0 Hub Changes") Acked-by: Alan Stern Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman drivers/usb/core/hub.c | 8 +++++++- include/uapi/linux/usb/ch11.h | 3 +++ 2 files changed, 10 insertions(+), 1 deletion(-) commit bec444cd1c94c48df409a35ad4e5b143c245c3f7 Author: Johan Hovold Date: Wed May 10 18:18:28 2017 +0200 USB: hub: fix non-SS hub-descriptor handling Add missing sanity check on the non-SuperSpeed hub-descriptor length in order to avoid parsing and leaking two bytes of uninitialised slab data through sysfs removable-attributes (or a compound-device debug statement). Note that we only make sure that the DeviceRemovable field is always present (and specifically ignore the unused PortPwrCtrlMask field) in order to continue support any hubs with non-compliant descriptors. As a further safeguard, the descriptor buffer is also cleared. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable # 2.6.12 Signed-off-by: Johan Hovold Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman drivers/usb/core/hub.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) commit 2c25a2c818023df64463aac3288a9f969491e507 Author: Johan Hovold Date: Wed May 10 18:18:27 2017 +0200 USB: hub: fix SS hub-descriptor handling A SuperSpeed hub descriptor does not have any variable-length fields so bail out when reading a short descriptor. This avoids parsing and leaking two bytes of uninitialised slab data through sysfs removable-attributes. Fixes: dbe79bbe9dcb ("USB 3.0 Hub Changes") Cc: stable # 2.6.39 Cc: John Youn Acked-by: Alan Stern Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman drivers/usb/core/hub.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit ec963b412a54aac8e527708ecad06a6988a86fb4 Author: Johan Hovold Date: Wed May 10 18:18:26 2017 +0200 USB: usbip: fix nonconforming hub descriptor Fix up the root-hub descriptor to accommodate the variable-length DeviceRemovable and PortPwrCtrlMask fields, while marking all ports as removable (and leaving the reserved bit zero unset). Also add a build-time constraint on VHCI_HC_PORTS which must never be greater than USB_MAXCHILDREN (but this was only enforced through a KConfig constant). This specifically fixes the descriptor layout whenever VHCI_HC_PORTS is greater than seven (default is 8). Fixes: 04679b3489e0 ("Staging: USB/IP: add client driver") Cc: Takahiro Hirofuchi Cc: Valentina Manea Signed-off-by: Johan Hovold Acked-by: Shuah Khan Signed-off-by: Greg Kroah-Hartman drivers/usb/usbip/vhci_hcd.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit d81182ce30dbd497a1e7047d7fda2af040347790 Author: Johan Hovold Date: Wed May 10 18:18:25 2017 +0200 USB: gadget: dummy_hcd: fix hub-descriptor removable fields Flag the first and only port as removable while also leaving the remaining bits (including the reserved bit zero) unset in accordance with the specifications: "Within a byte, if no port exists for a given location, the bit field representing the port characteristics shall be 0." Also add a comment marking the legacy PortPwrCtrlMask field. Fixes: 1cd8fd2887e1 ("usb: gadget: dummy_hcd: add SuperSpeed support") Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: Tatyana Brokhman Signed-off-by: Johan Hovold Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman drivers/usb/gadget/udc/dummy_hcd.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 5383fae76b8224a8f0465be6ab9c7a645042951a Author: Markus Heiser Date: Sat May 13 15:49:17 2017 +0200 doc-rst: fixed kernel-doc directives in usb/typec.rst Even if this file is not yet included in any toctree, it is parsed by Sphinx since it is named '.rst'. This patch fixes the following two ERRORs from Sphinx build: Documentation/usb/typec.rst:116: ERROR: Error in "kernel-doc" directive: invalid option block. .. kernel-doc:: drivers/usb/typec/typec.c :functions: typec_register_cable typec_unregister_cable typec_register_plug typec_unregister_plug Documentation/usb/typec.rst:139: ERROR: Error in "kernel-doc" directive: invalid option block. .. kernel-doc:: drivers/usb/typec/typec.c :functions: typec_set_data_role typec_set_pwr_role typec_set_vconn_role typec_set_pwr_opmode Signed-off-by: Markus Heiser Signed-off-by: Greg Kroah-Hartman Documentation/usb/typec.rst | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit ef53b92ece675ed9778b50f4432e004683696d01 Author: Johan Hovold Date: Tue May 16 16:26:14 2017 +0200 USB: core: of: document reference taken by companion helper Document that the new companion-device lookup helper takes a reference to the companion device which needs to be dropped after use. Signed-off-by: Johan Hovold Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman drivers/usb/core/of.c | 3 +++ 1 file changed, 3 insertions(+) commit a7415477a20448bbb7d13765784c0b29249a176f Author: Johan Hovold Date: Tue May 16 16:26:13 2017 +0200 USB: ehci-platform: fix companion-device leak Make sure do drop the reference taken to the companion device during resume. Fixes: d4d75128b8fd ("usb: host: ehci-platform: fix usb 1.1 device is not connected in system resume") Cc: stable # 4.11 Signed-off-by: Johan Hovold Acked-by: Yoshihiro Shimoda Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman drivers/usb/host/ehci-platform.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 1f873d857b6c2fefb4dada952674aa01bcfb92bd Author: Chris Brandt Date: Thu Apr 27 12:12:02 2017 -0700 usb: r8a66597-hcd: select a different endpoint on timeout If multiple endpoints on a single device have pending IN URBs and one endpoint times out due to NAKs (perfectly legal), select a different endpoint URB to try. The existing code only checked to see another device address has pending URBs and ignores other IN endpoints on the current device address. This leads to endpoints never getting serviced if one endpoint is using NAK as a flow control method. Fixes: 5d3043586db4 ("usb: r8a66597-hcd: host controller driver for R8A6659") Signed-off-by: Chris Brandt Signed-off-by: Greg Kroah-Hartman drivers/usb/host/r8a66597-hcd.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit dd14a3e9b92ac6f0918054f9e3477438760a4fa6 Author: Chris Brandt Date: Thu Apr 27 12:12:49 2017 -0700 usb: r8a66597-hcd: decrease timeout The timeout for BULK packets was 300ms which is a long time if other endpoints or devices are waiting for their turn. Changing it to 50ms greatly increased the overall performance for multi-endpoint devices. Fixes: 5d3043586db4 ("usb: r8a66597-hcd: host controller driver for R8A6659") Signed-off-by: Chris Brandt Signed-off-by: Greg Kroah-Hartman drivers/usb/host/r8a66597-hcd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 61abce1312bf97eac62eef704260ce9a8f9b85f6 Author: Quentin Schulz Date: Mon May 15 10:36:17 2017 +0200 ASoC: atmel-classd: sync regcache when resuming The PM functions used in this driver are the ones defined in sounc/soc/soc-core.c. When suspending (using snd_soc_suspend), the regcache is marked dirty but is never synced on resume. Sync regcache on resume of Atmel ClassD device. Signed-off-by: Quentin Schulz Acked-by: Alexandre Belloni Acked-by: Nicolas Ferre Signed-off-by: Mark Brown sound/soc/atmel/atmel-classd.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit 90431eb49bff6d79814cbf0c96e13597ad53095c Author: Kuninori Morimoto Date: Tue May 16 01:51:41 2017 +0000 ASoC: rsnd: don't use PDTA bit for 24bit on SSI Current SSI uses PDTA bit which indicates data that Input/Output data are Right-Aligned. But, 24bit sound should be Left-Aligned in this HW. Because Linux is using Right-Aligned data, and HW uses Left-Aligned data, current 24bit data is missing lower 8bit. To fix this issue, this patch removes PDTA bit, and shift 8bit in necessary module Reported-by: Hiroyuki Yokoyama Signed-off-by: Kuninori Morimoto Tested-by: Hiroyuki Yokoyama Signed-off-by: Mark Brown sound/soc/sh/rcar/cmd.c | 1 + sound/soc/sh/rcar/core.c | 51 ++++++++++++++++++++++++++++++++++++++++++++++++ sound/soc/sh/rcar/gen.c | 1 + sound/soc/sh/rcar/rsnd.h | 2 ++ sound/soc/sh/rcar/src.c | 12 ++++++++++-- sound/soc/sh/rcar/ssi.c | 2 +- sound/soc/sh/rcar/ssiu.c | 3 ++- 7 files changed, 68 insertions(+), 4 deletions(-) commit 1a744d2eb76aaafb997fda004ae3ae62a1538f85 Author: Anton Bondarenko Date: Sun May 7 01:53:46 2017 +0200 usb: core: fix potential memory leak in error path during hcd creation Free memory allocated for address0_mutex if allocation of bandwidth_mutex failed. Fixes: feb26ac31a2a ("usb: core: hub: hub_port_init lock controller instead of bus") Signed-off-by: Anton Bondarenko Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman drivers/usb/core/hcd.c | 1 + 1 file changed, 1 insertion(+) commit dd5ca753fa92fb736b1395db892bd29f78e6d408 Author: Johan Hovold Date: Thu May 11 11:36:02 2017 +0200 USB: iowarrior: fix info ioctl on big-endian hosts Drop erroneous le16_to_cpu when returning the USB device speed which is already in host byte order. Found using sparse: warning: cast to restricted __le16 Fixes: 946b960d13c1 ("USB: add driver for iowarrior devices.") Cc: stable # 2.6.21 Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman drivers/usb/misc/iowarrior.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 63afd5cc78775018ea2dec4004428dafa5283e93 Author: Johan Hovold Date: Thu May 11 11:36:01 2017 +0200 USB: chaoskey: fix Alea quirk on big-endian hosts Add missing endianness conversion when applying the Alea timeout quirk. Found using sparse: warning: restricted __le16 degrades to integer Fixes: e4a886e811cd ("hwrng: chaoskey - Fix URB warning due to timeout on Alea") Cc: stable # 4.8 Cc: Bob Ham Cc: Herbert Xu Cc: Keith Packard Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman drivers/usb/misc/chaoskey.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7cdfe4ddea47dbc66306edf802fd2ef86a6c8867 Author: Jiri Slaby Date: Fri May 12 10:06:29 2017 +0200 sisusb_con: fix coccinelle warning After commit d705ff3818 (tty: vt, cleanup and document con_scroll), in the coccinelle output, we can see: drivers/usb/misc/sisusbvga/sisusb_con.c:852:8-9: WARNING: return of 0/1 in function 'sisusbcon_scroll_area' with return type bool Return true instead of 1 in the function returning bool which was intended to do in d705ff3818 but omitted. Signed-off-by: Jiri Slaby Fixes: d705ff3818 (tty: vt, cleanup and document con_scroll) Cc: Thomas Winischhofer Cc: Greg Kroah-Hartman Cc: linux-usb@vger.kernel.org Signed-off-by: Greg Kroah-Hartman drivers/usb/misc/sisusbvga/sisusb_con.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 41318a2b82f5d5fe1fb408f6d6e0b22aa557111d Author: Johan Hovold Date: Fri May 12 12:06:32 2017 +0200 uwb: fix device quirk on big-endian hosts Add missing endianness conversion when using the USB device-descriptor idProduct field to apply a hardware quirk. Fixes: 1ba47da52712 ("uwb: add the i1480 DFU driver") Cc: stable # 2.6.28 Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman drivers/uwb/i1480/dfu/usb.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 0bd193d62b4270a2a7a09da43ad1034c7ca5b3d3 Author: Maksim Salau Date: Sat May 13 23:49:26 2017 +0300 usb: misc: legousbtower: Fix memory leak get_version_reply is not freed if function returns with success. Fixes: 942a48730faf ("usb: misc: legousbtower: Fix buffers on stack") Reported-by: Heikki Krogerus Signed-off-by: Maksim Salau Signed-off-by: Greg Kroah-Hartman drivers/usb/misc/legousbtower.c | 1 + 1 file changed, 1 insertion(+) commit 2f964780c03b73de269b08d12aff96a9618d13f3 Author: Vamsi Krishna Samavedam Date: Tue May 16 14:38:08 2017 +0200 USB: core: replace %p with %pK Format specifier %p can leak kernel addresses while not valuing the kptr_restrict system settings. When kptr_restrict is set to (1), kernel pointers printed using the %pK format specifier will be replaced with Zeros. Debugging Note : &pK prints only Zeros as address. If you need actual address information, write 0 to kptr_restrict. echo 0 > /proc/sys/kernel/kptr_restrict [Found by poking around in a random vendor kernel tree, it would be nice if someone would actually send these types of patches upstream - gkh] Signed-off-by: Vamsi Krishna Samavedam Cc: stable Signed-off-by: Greg Kroah-Hartman drivers/usb/core/devio.c | 14 +++++++------- drivers/usb/core/hcd.c | 4 ++-- drivers/usb/core/urb.c | 2 +- 3 files changed, 10 insertions(+), 10 deletions(-) commit 628c2893d44876ddd11602400c70606ade62e129 Author: Alan Stern Date: Tue May 16 11:47:29 2017 -0400 USB: ene_usb6250: fix DMA to the stack The ene_usb6250 sub-driver in usb-storage does USB I/O to buffers on the stack, which doesn't work with vmapped stacks. This patch fixes the problem by allocating a separate 512-byte buffer at probe time and using it for all of the offending I/O operations. Signed-off-by: Alan Stern Reported-and-tested-by: Andreas Hartmann CC: Signed-off-by: Greg Kroah-Hartman drivers/usb/storage/ene_ub6250.c | 90 ++++++++++++++++++++++++---------------- 1 file changed, 55 insertions(+), 35 deletions(-) commit f3f6cc814f9cb61cfb738af2b126a8bf19e5ab4c Author: Christophe JAILLET Date: Sat May 13 13:40:05 2017 +0200 ARM: davinci: PM: Free resources in error handling path in 'davinci_pm_init' If 'sram_alloc' fails, we need to free already allocated resources. Fixes: aa9aa1ec2df6 ("ARM: davinci: PM: rework init, remove platform device") Signed-off-by: Christophe JAILLET Signed-off-by: Sekhar Nori arch/arm/mach-davinci/pm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 9b31071dd18af2078cd866e39718f51f89b31c89 Merge: 2ea659a 018047a Author: Greg Kroah-Hartman Date: Wed May 17 11:18:36 2017 +0200 Merge tag 'fixes-for-v4.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus Felipe writes: usb: fixes for v4.12-rc2 - New device ID for Intel Canonlake CPUs - fix for Isochronous performance regression on dwc3 - fix for out-of-bounds access on comp_desc on f_fs - fix for lost events on dwc3 in case of spurious interrupts commit 5f63424ab7daac840df2b12dd5bcc5b38d50f779 Author: Andrey Korolyov Date: Tue May 16 23:54:41 2017 +0300 USB: serial: ftdi_sio: add Olimex ARM-USB-TINY(H) PIDs This patch adds support for recognition of ARM-USB-TINY(H) devices which are almost identical to ARM-USB-OCD(H) but lacking separate barrel jack and serial console. By suggestion from Johan Hovold it is possible to replace ftdi_jtag_quirk with a bit more generic construction. Since all Olimex-ARM debuggers has exactly two ports, we could safely always use only second port within the debugger family. Signed-off-by: Andrey Korolyov Cc: stable Signed-off-by: Johan Hovold drivers/usb/serial/ftdi_sio.c | 8 ++++---- drivers/usb/serial/ftdi_sio_ids.h | 2 ++ 2 files changed, 6 insertions(+), 4 deletions(-) commit 83345d51a49a4b3f3b4a08a5db644dae438b0189 Author: Tin Huynh Date: Wed May 17 11:25:34 2017 +0700 i2c: xgene: Set ACPI_COMPANION_I2C With ACPI, i2c-core requires ACPI companion to be set in order for it to create slave device. This patch sets the ACPI companion accordingly. Signed-off-by: Tin Huynh Signed-off-by: Wolfram Sang drivers/i2c/busses/i2c-xgene-slimpro.c | 1 + 1 file changed, 1 insertion(+) commit bfb9956ab4d8242f4594b5f4bee534b935384fd9 Author: Michael Ellerman Date: Tue May 16 20:42:53 2017 +1000 powerpc/mm: Fix crash in page table dump with huge pages The page table dump code doesn't know about huge pages, so currently it crashes (or walks random memory, usually leading to a crash), if it finds a huge page. On Book3S we only see huge pages in the Linux page tables when we're using the P9 Radix MMU. Teaching the code to properly handle huge pages is a bit more involved, so for now just prevent the crash. Cc: stable@vger.kernel.org # v4.10+ Fixes: 8eb07b187000 ("powerpc/mm: Dump linux pagetables") Signed-off-by: Michael Ellerman arch/powerpc/mm/dump_linuxpagetables.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 2848e1d503d60955ff51ae9ec8d5eada6bd9ba6d Author: James Smart Date: Mon May 15 15:20:52 2017 -0700 scsi: lpfc: update version to 11.2.0.14 Change driver version to 11.2.0.14. Signed-off-by: Dick Kennedy Signed-off-by: James Smart Reviewed-by: Hannes Reinecke Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc_version.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ae9e28f36a6cca4e5760f4927b70b6c9e588db1a Author: James Smart Date: Mon May 15 15:20:51 2017 -0700 scsi: lpfc: Add MDS Diagnostic support. Added code to support Cisco MDS loopback diagnostic. The diagnostics run various loopbacks including one which loops-back frame through the driver. Signed-off-by: Dick Kennedy Signed-off-by: James Smart Reviewed-by: Hannes Reinecke Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc.h | 2 + drivers/scsi/lpfc/lpfc_els.c | 7 +++ drivers/scsi/lpfc/lpfc_hbadisc.c | 3 +- drivers/scsi/lpfc/lpfc_hw4.h | 15 ++++- drivers/scsi/lpfc/lpfc_init.c | 13 ++++ drivers/scsi/lpfc/lpfc_sli.c | 131 ++++++++++++++++++++++++++++++++++++--- 6 files changed, 161 insertions(+), 10 deletions(-) commit dc53a61852279f25909d99dad4638b4aee0b2d82 Author: James Smart Date: Mon May 15 15:20:50 2017 -0700 scsi: lpfc: Fix NVMEI's handling of NVMET's PRLI response attributes Code review of NVMEI's FC_PORT_ROLE_NVME_DISCOVERY looked wrong. Discussions with storage architecture team clarified NVMEI's audit of the PRLI response port roles. Following up discussion with code review showed a few minor corrections were required - especially in anticipation of NVME auto discovery. During PRLI, NVMEI should sent prli_init - which it it does. NVMET should send prli_tgt and prli_disc - which it does. When NVMEI receives a PRLI Response now, it audits the incoming target bits and stores the attributes in the corresponding NDLP. Later, when NVMEI registers the NVME rport, it uses the stored ndlp attributes to set the rport port_roles correctly. Signed-off-by: Dick Kennedy Signed-off-by: James Smart Reviewed-by: Hannes Reinecke Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc_disc.h | 1 + drivers/scsi/lpfc/lpfc_nportdisc.c | 6 ++++++ 2 files changed, 7 insertions(+) commit 64eb4dcb140a7c5547f6e965fb471b1b75c01108 Author: James Smart Date: Mon May 15 15:20:49 2017 -0700 scsi: lpfc: Cleanup entry_repost settings on SLI4 queues Too many work items being processed in IRQ context take a lot of CPU time and cause problems. With a recent change, we get out of the ISR after hitting entry_repost work items on a queue. However, the actual values for entry repost are still high. EQ is 128 and CQ is 128, this could translate into processing 128 * 128 (16384) work items under IRQ context. Set entry_repost in the actual queue creation routine now. Limit EQ repost to 8 and CQ repost to 64 to further limit the amount of time spent in the IRQ. Fix fof IRQ routines as well. Signed-off-by: Dick Kennedy Signed-off-by: James Smart Reviewed-by: Hannes Reinecke Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc_sli.c | 19 ++++++++----------- drivers/scsi/lpfc/lpfc_sli4.h | 6 ++++-- 2 files changed, 12 insertions(+), 13 deletions(-) commit 667a7662529bf0afb1d84a32ceb0da0a875a3b6c Author: James Smart Date: Mon May 15 15:20:48 2017 -0700 scsi: lpfc: Fix debugfs root inode "lpfc" not getting deleted on driver unload. When unloading and reloading the driver, the driver fails to recreate the lpfc root inode in the debugfs tree. The driver is incorrectly removing the lpfc root inode in lpfc_debugfs_terminate in the first driver instance that unloads and then sets the lpfc_debugfs_root global parameter to NULL. When the final driver instance unloads, the debugfs calls quietly ignore the remove on a NULL pointer. The bug is that the debugfs_remove call returns void so the driver doesn't know to correctly set the global parameter to NULL. Base the debugfs_remove of the lpfc_debugfs_root parameter on lpfc_debugfs_hba_count because this parameter tracks the fnX instance tracked per driver instance. Signed-off-by: Dick Kennedy Signed-off-by: James Smart Reviewed-by: Hannes Reinecke Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc_debugfs.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 82820f0cf19aa62e2608c2909bd44e7a68268ff5 Author: James Smart Date: Mon May 15 15:20:47 2017 -0700 scsi: lpfc: Fix NVME I+T not registering NVME as a supported FC4 type When the driver send the RPA command, it does not send supported FC4 Type NVME to the management server. Encode NVME (type x28) in the AttribEntry in the RPA command. Signed-off-by: Dick Kennedy Signed-off-by: James Smart Reviewed-by: Hannes Reinecke Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc_ct.c | 1 + 1 file changed, 1 insertion(+) commit a8cf5dfeb4d84248c0ad12386ae0cb36ee21589a Author: James Smart Date: Mon May 15 15:20:46 2017 -0700 scsi: lpfc: Added recovery logic for running out of NVMET IO context resources Previous logic would just drop the IO. Added logic to queue the IO to wait for an IO context resource from an IO thats already in progress. Signed-off-by: Dick Kennedy Signed-off-by: James Smart Reviewed-by: Hannes Reinecke Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc.h | 1 + drivers/scsi/lpfc/lpfc_attr.c | 6 ++ drivers/scsi/lpfc/lpfc_crtn.h | 2 + drivers/scsi/lpfc/lpfc_debugfs.c | 6 ++ drivers/scsi/lpfc/lpfc_init.c | 2 + drivers/scsi/lpfc/lpfc_nvmet.c | 138 +++++++++++++++++++++++++++++++++------ drivers/scsi/lpfc/lpfc_sli.c | 7 +- drivers/scsi/lpfc/lpfc_sli4.h | 6 +- 8 files changed, 144 insertions(+), 24 deletions(-) commit 6c621a2229b084da0d926967f84b059a10c26ede Author: James Smart Date: Mon May 15 15:20:45 2017 -0700 scsi: lpfc: Separate NVMET RQ buffer posting from IO resources SGL/iocbq/context Currently IO resources are mapped 1 to 1 with RQ buffers posted Added logic to separate RQE buffers from IO op resources (sgl/iocbq/context). During initialization, the driver will determine how many SGLs it will allocate for NVMET (based on what the firmware reports) and associate a NVMET IOCBq and NVMET context structure with each one. Now that hdr/data buffers are immediately reposted back to the RQ, 512 RQEs for each MRQ is sufficient. Also, since NVMET data buffers are now 128 bytes, lpfc_nvmet_mrq_post is not necessary anymore as we will always post the max (512) buffers per NVMET MRQ. Signed-off-by: Dick Kennedy Signed-off-by: James Smart Reviewed-by: Hannes Reinecke Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc.h | 11 +- drivers/scsi/lpfc/lpfc_attr.c | 11 -- drivers/scsi/lpfc/lpfc_crtn.h | 8 +- drivers/scsi/lpfc/lpfc_init.c | 92 ++------------- drivers/scsi/lpfc/lpfc_mem.c | 73 +----------- drivers/scsi/lpfc/lpfc_nvmet.c | 246 +++++++++++++++++++++++++++++++---------- drivers/scsi/lpfc/lpfc_nvmet.h | 1 + drivers/scsi/lpfc/lpfc_sli.c | 78 ++++++++++++- drivers/scsi/lpfc/lpfc_sli4.h | 4 +- 9 files changed, 291 insertions(+), 233 deletions(-) commit 3c603be9798758dde794daa622e0f7017dbff3a7 Author: James Smart Date: Mon May 15 15:20:44 2017 -0700 scsi: lpfc: Separate NVMET data buffer pool fir ELS/CT. Using 2048 byte buffer and onle 128 bytes is needed. Create nee LFPC_NVMET_DATA_BUF_SIZE define to use for NVMET RQ/MRQs. Signed-off-by: Dick Kennedy Signed-off-by: James Smart Reviewed-by: Hannes Reinecke Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc.h | 1 + drivers/scsi/lpfc/lpfc_crtn.h | 1 + drivers/scsi/lpfc/lpfc_hw4.h | 1 + drivers/scsi/lpfc/lpfc_init.c | 7 ++++++- drivers/scsi/lpfc/lpfc_mem.c | 33 ++++++++++++++++++++++++++------- drivers/scsi/lpfc/lpfc_sli.c | 19 +++++++++++++++---- 6 files changed, 50 insertions(+), 12 deletions(-) commit 7869da183a7cfc8a2189f6eddd3bc558be40d5e3 Author: James Smart Date: Mon May 15 15:20:43 2017 -0700 scsi: lpfc: Fix NMI watchdog assertions when running nvmet IOPS tests After running IOPS test for 30 second we get kernel:NMI watchdog: Watchdog detected hard LOCKUP on cpu 0 The driver is speend too much time in its ISR. In ISR EQ and CQ processing routines, if we hit the entry_repost numbers of EQE/CQEs just break out of the routine as opposed to hitting the doorbell with NOARM and continue processing. Signed-off-by: Dick Kennedy Signed-off-by: James Smart Reviewed-by: Hannes Reinecke Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc_debugfs.c | 30 +++++++++++++++--------------- drivers/scsi/lpfc/lpfc_sli.c | 16 ++++++---------- 2 files changed, 21 insertions(+), 25 deletions(-) commit 3120046a970aee08a0787fb6792590f1e0047f62 Author: James Smart Date: Mon May 15 15:20:42 2017 -0700 scsi: lpfc: Fix NVMEI driver not decrementing counter causing bad rport state. During driver boot, a latency in the NVMET driver side causes the incoming NVMEI PRLI to get rejected by the NVMET driver. When this happens, the NVMEI driver runs out of PRLI retries. Bouncing the link does not fix the situation. If the NVMEI driver decides, on PRLI completion failures, to retry the PRLI, always decrement the fc4_prli_sent counter. This allows the PRLI completion to resolve to UNMAPPED when NVMET rejects the PRLI. Signed-off-by: Dick Kennedy Signed-off-by: James Smart Reviewed-by: Hannes Reinecke Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc_els.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 61f3d4bf4f8f062cf6be143c9b7adbc3a017ea6e Author: James Smart Date: Mon May 15 15:20:41 2017 -0700 scsi: lpfc: Fix nvmet RQ resource needs for large block writes. Large block writes to the nvme target were failing because the default number of RQs posted was insufficient. Expand the NVMET RQs to 2048 RQEs and ensure a minimum of 512 RQEs are posted, no matter how many MRQs are configured. Signed-off-by: Dick Kennedy Signed-off-by: James Smart Reviewed-by: Hannes Reinecke Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc_attr.c | 6 +++--- drivers/scsi/lpfc/lpfc_init.c | 23 +++++++++++++------- drivers/scsi/lpfc/lpfc_nvmet.c | 2 +- drivers/scsi/lpfc/lpfc_nvmet.h | 1 + drivers/scsi/lpfc/lpfc_sli.c | 49 +++++++++--------------------------------- drivers/scsi/lpfc/lpfc_sli4.h | 2 +- 6 files changed, 31 insertions(+), 52 deletions(-) commit 547077a44b3b49f56c0f05c0b46c8c617dea591d Author: James Smart Date: Mon May 15 15:20:40 2017 -0700 scsi: lpfc: Adding additional stats counters for nvme. More debug messages added for nvme statistics. Signed-off-by: Dick Kennedy Signed-off-by: James Smart Reviewed-by: Hannes Reinecke Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc_attr.c | 24 ++++++++++++--------- drivers/scsi/lpfc/lpfc_debugfs.c | 27 +++++++++++++---------- drivers/scsi/lpfc/lpfc_nvmet.c | 46 ++++++++++++++++++++++++++++++---------- drivers/scsi/lpfc/lpfc_nvmet.h | 12 ++++++----- drivers/scsi/lpfc/lpfc_sli.c | 38 ++++++++++++++++++++++++++++----- drivers/scsi/lpfc/lpfc_sli4.h | 2 +- 6 files changed, 106 insertions(+), 43 deletions(-) commit 0c9c6a75141810acade82add4f4708959a5d3a1d Author: James Smart Date: Mon May 15 15:20:39 2017 -0700 scsi: lpfc: Fix system crash when port is reset. The driver panic when using the els_wq during port reset. Check for NULL els_wq before dereferencing. Signed-off-by: Dick Kennedy Signed-off-by: James Smart Reviewed-by: Hannes Reinecke Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc.h | 8 ++++++-- drivers/scsi/lpfc/lpfc_hbadisc.c | 6 +++--- 2 files changed, 9 insertions(+), 5 deletions(-) commit 845d9e8df2fa879e6494e786f290e1fd5560ac8c Author: James Smart Date: Mon May 15 15:20:38 2017 -0700 scsi: lpfc: Fix used-RPI accounting problem. With 255 vports created a link trasition can casue a crash. When going through discovery after a link bounce the driver is using rpis before the cmd FCOE_POST_HDR_TEMPLATES completes. By doing that the next rpi bumps the rpi range out of the boundary. The fix it to increment the next_rpi only when the FCOE_POST_HDR_TEMPLATE succeeds. Signed-off-by: Dick Kennedy Signed-off-by: James Smart Reviewed-by: Hannes Reinecke Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc_els.c | 3 ++- drivers/scsi/lpfc/lpfc_init.c | 24 +++++------------------- drivers/scsi/lpfc/lpfc_sli.c | 8 ++++++++ drivers/scsi/lpfc/lpfc_sli4.h | 1 + 4 files changed, 16 insertions(+), 20 deletions(-) commit dd6e1f71b785a6ac2511e2ddb86315f292873e59 Author: Gustavo A. R. Silva Date: Thu May 11 17:24:44 2017 -0500 scsi: libfc: fix incorrect variable assignment Previous assignment was causing the use of the uninitialized variable _explan_ inside fc_seq_ls_rjt() function, which in this particular case is being called by fc_seq_els_rsp_send(). [mkp: fixed typo] Addresses-Coverity-ID: 1398125 Signed-off-by: Gustavo A. R. Silva Reviewed-by: Ewan D. Milne Signed-off-by: Martin K. Petersen drivers/scsi/libfc/fc_rport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4fa8324461b824eaea9b6695464395710fe20c44 Author: Derek Basehore Date: Thu May 11 14:34:24 2017 +0200 scsi: sd: Ignore sync cache failures when not supported Some external hard drives don't support the sync command even though the hard drive has write cache enabled. In this case, upon suspend request, sync cache failures are ignored if the error code in the sense header is ILLEGAL_REQUEST. There's not much we can do for these drives, so we shouldn't fail to suspend for this error case. The drive may stay powered if that's the setup for the port it's plugged into. Signed-off-by: Derek Basehore Signed-off-by: Thierry Escande Reviewed-by: Ewan D. Milne Signed-off-by: Martin K. Petersen drivers/scsi/sd.c | 40 ++++++++++++++++++++++++++++------------ 1 file changed, 28 insertions(+), 12 deletions(-) commit 2579b8b0ece53248b815042f8662a4531acf120d Author: Dan Carpenter Date: Thu Apr 27 12:12:56 2017 +0300 drm/nouveau/fifo/gk104-: Silence a locking warning Presumably we can never actually hit this return, but static checkers complain that we should unlock before we return. Signed-off-by: Dan Carpenter Signed-off-by: Ben Skeggs drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 563ad2b640955a0da21aedce1aaa332c7d016dde Author: Christophe JAILLET Date: Mon May 8 14:30:43 2017 +0200 drm/nouveau/secboot: plug memory leak in ls_ucode_img_load_gr() error path The last goto looks spurious because it releases less resources than the previous one. Also free 'img->sig' if 'ls_ucode_img_build()' fails. Fixes: 9d896f3e41a6 ("drm/nouveau/secboot: abstract LS firmware loading functions") Signed-off-by: Christophe JAILLET Signed-off-by: Ben Skeggs drivers/gpu/drm/nouveau/nvkm/subdev/secboot/ls_ucode_gr.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 9a2eba337cacefc95b97c2726e3efdd435b3460e Author: Peter Ujfalusi Date: Mon May 15 12:04:31 2017 +0300 drm/nouveau: Fix drm poll_helper handling Commit cae9ff036eea effectively disabled the drm poll_helper by checking the wrong flag to see if the driver should enable the poll or not: mode_config.poll_enabled is only set to true by poll_init and it is not indicating if the poll is enabled or not. nouveau_display_create() will initialize the poll and going to disable it right away. After poll_init() the mode_config.poll_enabled will be true, but the poll itself is disabled. To avoid the race caused by calling the poll_enable() from different paths, this patch will enable the poll from one place, in the nouveau_display_hpd_work(). In case the pm_runtime is disabled we will enable the poll in nouveau_drm_load() once. Fixes: cae9ff036eea ("drm/nouveau: Don't enabling polling twice on runtime resume") Signed-off-by: Peter Ujfalusi Reviewed-by: Lyude Signed-off-by: Ben Skeggs drivers/gpu/drm/nouveau/nouveau_display.c | 6 ++---- drivers/gpu/drm/nouveau/nouveau_drm.c | 6 +++--- 2 files changed, 5 insertions(+), 7 deletions(-) commit 88ad60c23a394b2f8bf1e570c756f415435d1d35 Author: Thomas Petazzoni Date: Tue May 16 14:07:24 2017 +0200 i2c: mv64xxx: don't override deferred probing when getting irq There is no reason to use platform_get_irq() for non-DT probing and irq_of_parse_and_map() for DT probing. Indeed, platform_get_irq() works fine for both. In addition, using platform_get_irq() properly returns -EPROBE_DEFER when the interrupt controller is not yet available, so instead of inventing our own error code (-ENXIO), return the one provided by platform_get_irq(). Signed-off-by: Thomas Petazzoni Signed-off-by: Wolfram Sang drivers/i2c/busses/i2c-mv64xxx.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 0d83539092ddb1ab79b4d65bccb866bf07ea2ccd Author: Suman Anna Date: Tue May 9 18:58:24 2017 -0500 uio: fix incorrect memory leak cleanup Commit 75f0aef6220d ("uio: fix memory leak") has fixed up some memory leaks during the failure paths of the addition of uio attributes, but still is not correct entirely. A kobject_uevent() failure still needs a kobject_put() and the kobject container structure allocation failure before the kobject_init() doesn't need a kobject_put(). Fix this properly. Fixes: 75f0aef6220d ("uio: fix memory leak") Signed-off-by: Suman Anna Signed-off-by: Greg Kroah-Hartman drivers/uio/uio.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit a20cfc1cde76047657045fc5976834f57422a8c5 Author: Tobias Regnery Date: Tue May 9 13:52:02 2017 +0200 misc: pci_endpoint_test: select CRC32 There is the following link error with CONFIG_PCI_ENDPOINT_TEST=y and CONFIG_CRC32=m: drivers/built-in.o: In function 'pci_endpoint_test_ioctl': pci_endpoint_test.c:(.text+0xf1251): undefined reference to 'crc32_le' pci_endpoint_test.c:(.text+0xf1322): undefined reference to 'crc32_le' pci_endpoint_test.c:(.text+0xf13b2): undefined reference to 'crc32_le' pci_endpoint_test.c:(.text+0xf141e): undefined reference to 'crc32_le' Fix this by selecting CRC32 in the PCI_ENDPOINT_TEST kconfig entry. Fixes: 2c156ac71c6b ("misc: Add host side PCI driver for PCI test function device") Signed-off-by: Tobias Regnery Signed-off-by: Greg Kroah-Hartman drivers/misc/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 3e21f4af170bebf47c187c1ff8bf155583c9f3b1 Author: Willy Tarreau Date: Tue May 16 19:18:55 2017 +0200 char: lp: fix possible integer overflow in lp_setup() The lp_setup() code doesn't apply any bounds checking when passing "lp=none", and only in this case, resulting in an overflow of the parport_nr[] array. All versions in Git history are affected. Reported-By: Roee Hay Cc: Ben Hutchings Cc: stable@vger.kernel.org Signed-off-by: Willy Tarreau Signed-off-by: Greg Kroah-Hartman drivers/char/lp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit b23afd384801711ab6dbccd259cc14cb09a1dcaf Merge: 2b6b38b 6f61dd3 Author: Linus Torvalds Date: Tue May 16 13:29:07 2017 -0700 Merge tag 'pstore-v4.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull pstore fix from Kees Cook: "Fix bad EFI vars iterator usage" * tag 'pstore-v4.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: efi-pstore: Fix read iter after pstore API refactor commit 9512a16b0e1217bbef73d276a67c28b5fbb46512 Author: J. Bruce Fields Date: Tue May 16 15:57:42 2017 -0400 nfsd: Revert "nfsd: check for oversized NFSv2/v3 arguments" This reverts commit 51f567777799 "nfsd: check for oversized NFSv2/v3 arguments", which breaks support for NFSv3 ACLs. That patch was actually an earlier draft of a fix for the problem that was eventually fixed by e6838a29ecb "nfsd: check for oversized NFSv2/v3 arguments". But somehow I accidentally left this earlier draft in the branch that was part of my 2.12 pull request. Reported-by: Eryu Guan Cc: stable@vger.kernel.org Signed-off-by: J. Bruce Fields fs/nfsd/nfs3xdr.c | 23 ++++++----------------- fs/nfsd/nfsxdr.c | 13 +++---------- include/linux/sunrpc/svc.h | 3 ++- 3 files changed, 11 insertions(+), 28 deletions(-) commit 2432a3fb5cff026005aaad24e42226402f7fd0aa Author: Arnd Bergmann Date: Tue May 16 13:27:49 2017 +0200 mlx5e: add CONFIG_INET dependency We now reference the arp_tbl, which requires IPv4 support to be enabled in the kernel, otherwise we get a link error: drivers/net/built-in.o: In function `mlx5e_tc_update_neigh_used_value': (.text+0x16afec): undefined reference to `arp_tbl' drivers/net/built-in.o: In function `mlx5e_rep_neigh_init': en_rep.c:(.text+0x16c16d): undefined reference to `arp_tbl' drivers/net/built-in.o: In function `mlx5e_rep_netevent_event': en_rep.c:(.text+0x16cbb5): undefined reference to `arp_tbl' This adds a Kconfig dependency for it. Fixes: 232c001398ae ("net/mlx5e: Add support to neighbour update flow") Signed-off-by: Arnd Bergmann Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx5/core/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ea9a46e1c49251331dbfda19ced7114337966178 Author: Darrick J. Wong Date: Fri May 12 10:44:10 2017 -0700 xfs: only return detailed fsmap info if the caller has CAP_SYS_ADMIN There were a number of handwaving complaints that one could "possibly" use inode numbers and extent maps to fingerprint a filesystem hosting multiple containers and somehow use the information to guess at the contents of other containers and attack them. Despite the total lack of any demonstration that this is actually possible, it's easier to restrict access now and broaden it later, so use the rmapbt fsmap backends only if the caller has CAP_SYS_ADMIN. Unprivileged users will just have to make do with only getting the free space and static metadata placement information. Signed-off-by: Darrick J. Wong Reviewed-by: Carlos Maiolino fs/xfs/xfs_fsmap.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit b401ee0b85a53e89739ff68a5b1a0667d664afc9 Author: Paolo Bonzini Date: Tue Apr 18 12:41:18 2017 +0200 KVM: x86: lower default for halt_poll_ns In some fio benchmarks, halt_poll_ns=400000 caused CPU utilization to increase heavily even in cases where the performance improvement was small. In particular, bandwidth divided by CPU usage was as much as 60% lower. To some extent this is the expected effect of the patch, and the additional CPU utilization is only visible when running the benchmarks. However, halving the threshold also halves the extra CPU utilization (from +30-130% to +20-70%) and has no negative effect on performance. Signed-off-by: Paolo Bonzini Signed-off-by: Radim Krčmář arch/x86/include/asm/kvm_host.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 13840d38016203f0095cd547b90352812d24b787 Author: Mikulas Patocka Date: Sun Apr 30 17:32:28 2017 -0400 dm bufio: make the parameter "retain_bytes" unsigned long Change the type of the parameter "retain_bytes" from unsigned to unsigned long, so that on 64-bit machines the user can set more than 4GiB of data to be retained. Also, change the type of the variable "count" in the function "__evict_old_buffers" to unsigned long. The assignment "count = c->n_buffers[LIST_CLEAN] + c->n_buffers[LIST_DIRTY];" could result in unsigned long to unsigned overflow and that could result in buffers not being freed when they should. While at it, avoid division in get_retain_buffers(). Division is slow, we can change it to shift because we have precalculated the log2 of block size. Cc: stable@vger.kernel.org Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer drivers/md/dm-bufio.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) commit f6c5775ff0bfa62b072face6bf1d40f659f194b2 Author: David Ahern Date: Mon May 15 23:19:17 2017 -0700 net: Improve handling of failures on link and route dumps In general, rtnetlink dumps do not anticipate failure to dump a single object (e.g., link or route) on a single pass. As both route and link objects have grown via more attributes, that is no longer a given. netlink dumps can handle a failure if the dump function returns an error; specifically, netlink_dump adds the return code to the response if it is <= 0 so userspace is notified of the failure. The missing piece is the rtnetlink dump functions returning the error. Fix route and link dump functions to return the errors if no object is added to an skb (detected by skb->len != 0). IPv6 route dumps (rt6_dump_route) already return the error; this patch updates IPv4 and link dumps. Other dump functions may need to be ajusted as well. Reported-by: Jan Moskyto Matejka Signed-off-by: David Ahern Signed-off-by: David S. Miller net/core/rtnetlink.c | 36 ++++++++++++++++++++++++------------ net/ipv4/fib_frontend.c | 15 +++++++++++---- net/ipv4/fib_trie.c | 26 ++++++++++++++------------ 3 files changed, 49 insertions(+), 28 deletions(-) commit 19a0f7e37c0761a0a1cbf550705a6063c9675223 Author: Christoph Hellwig Date: Tue May 16 09:51:38 2017 +0300 net/smc: Add warning about remote memory exposure The driver explicitly bypasses APIs to register all memory once a connection is made, and thus allows remote access to memory. Signed-off-by: Christoph Hellwig Signed-off-by: Leon Romanovsky Acked-by: Ursula Braun Signed-off-by: David S. Miller net/smc/Kconfig | 4 ++++ 1 file changed, 4 insertions(+) commit 263eec9b2a82e8697d064709414914b5b10ac538 Author: Ursula Braun Date: Mon May 15 17:33:37 2017 +0200 smc: switch to usage of IB_PD_UNSAFE_GLOBAL_RKEY Currently, SMC enables remote access to physical memory when a user has successfully configured and established an SMC-connection until ten minutes after the last SMC connection is closed. Because this is considered a security risk, drivers are supposed to use IB_PD_UNSAFE_GLOBAL_RKEY in such a case. This patch changes the current SMC code to use IB_PD_UNSAFE_GLOBAL_RKEY. This improves user awareness, but does not remove the security risk itself. Signed-off-by: Ursula Braun Signed-off-by: David S. Miller net/smc/smc_clc.c | 4 ++-- net/smc/smc_core.c | 16 +++------------- net/smc/smc_core.h | 2 +- net/smc/smc_ib.c | 21 ++------------------- net/smc/smc_ib.h | 2 -- 5 files changed, 8 insertions(+), 37 deletions(-) commit 6f61dd3aa35179043f1fcdb0965c5d56278ab724 Author: Kees Cook Date: Fri May 12 14:52:34 2017 -0700 efi-pstore: Fix read iter after pstore API refactor During the internal pstore API refactoring, the EFI vars read entry was accidentally made to update a stack variable instead of the pstore private data pointer. This corrects the problem (and removes the now needless argument). Fixes: 125cc42baf8a ("pstore: Replace arguments for read() API") Signed-off-by: Kees Cook drivers/firmware/efi/efi-pstore.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) commit fc9d0cd9ca3f013663d79d9201d1df6c14f3ca10 Merge: 2ea659a 9fce894d Author: Wolfram Sang Date: Tue May 16 18:57:39 2017 +0200 Merge branch 'i2c-mux/for-current' of https://github.com/peda-r/i2c-mux into i2c/for-current Pull bugfixes from the i2c mux subsubsystem: This fixes an old bug in resource cleanup on failure in i2c-mux-reg and a new log spamming bug from this merge window in the i2c-mux core. commit bcfc7d33110b0f33069d74138eeb7ca9acbb3c85 Author: Thomas Winter Date: Tue May 16 10:14:44 2017 +1200 ipmr: vrf: Find VIFs using the actual device The skb->dev that is passed into ip_mr_input is the loX device for VRFs. When we lookup a vif for this dev, none is found as we do not create vifs for loopbacks. Instead lookup a vif for the actual device that the packet was received on, eg the vlan. Signed-off-by: Thomas Winter cc: David Ahern cc: Nikolay Aleksandrov cc: roopa Acked-by: David Ahern Signed-off-by: David S. Miller net/ipv4/ipmr.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) commit bafbb9c73241760023d8981191ddd30bb1c6dbac Author: Soheil Hassas Yeganeh Date: Mon May 15 17:05:47 2017 -0400 tcp: eliminate negative reordering in tcp_clean_rtx_queue tcp_ack() can call tcp_fragment() which may dededuct the value tp->fackets_out when MSS changes. When prior_fackets is larger than tp->fackets_out, tcp_clean_rtx_queue() can invoke tcp_update_reordering() with negative values. This results in absurd tp->reodering values higher than sysctl_tcp_max_reordering. Note that tcp_update_reordering indeeds sets tp->reordering to min(sysctl_tcp_max_reordering, metric), but because the comparison is signed, a negative metric always wins. Fixes: c7caf8d3ed7a ("[TCP]: Fix reord detection due to snd_una covered holes") Reported-by: Rebecca Isaacs Signed-off-by: Soheil Hassas Yeganeh Signed-off-by: Neal Cardwell Signed-off-by: Yuchung Cheng Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller net/ipv4/tcp_input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2b6b38b04c2e7fe1713104768048fe2cae89c38e Merge: bec6cd63 fb317002 Author: Linus Torvalds Date: Tue May 16 09:24:44 2017 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Martin Schwidefsky: - convert the debug feature to refcount_t - reduce the copy size for strncpy_from_user - 8 bug fixes * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/virtio: change virtio_feature_desc:features type to __le32 s390: convert debug_info.ref_count from atomic_t to refcount_t s390: move _text symbol to address higher than zero s390/qdio: increase string buffer size s390/ccwgroup: increase string buffer size s390/topology: let topology_mnest_limit() return unsigned char s390/uaccess: use sane length for __strncpy_from_user() s390/uprobes: fix compile for !KPROBES s390/ftrace: fix compile for !MODULES s390/cputime: fix incorrect system time commit 892d2a5f705723b2cb488bfb38bcbdcf83273184 Author: Zorro Lang Date: Mon May 15 08:40:02 2017 -0700 xfs: bad assertion for delalloc an extent that start at i_size By run fsstress long enough time enough in RHEL-7, I find an assertion failure (harder to reproduce on linux-4.11, but problem is still there): XFS: Assertion failed: (iflags & BMV_IF_DELALLOC) != 0, file: fs/xfs/xfs_bmap_util.c The assertion is in xfs_getbmap() funciton: if (map[i].br_startblock == DELAYSTARTBLOCK && --> map[i].br_startoff <= XFS_B_TO_FSB(mp, XFS_ISIZE(ip))) ASSERT((iflags & BMV_IF_DELALLOC) != 0); When map[i].br_startoff == XFS_B_TO_FSB(mp, XFS_ISIZE(ip)), the startoff is just at EOF. But we only need to make sure delalloc extents that are within EOF, not include EOF. Signed-off-by: Zorro Lang Reviewed-by: Brian Foster Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/xfs_bmap_util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6e747506dde195d3d05fe2bb8ef78aceba28a5e3 Author: Darrick J. Wong Date: Fri May 12 10:44:11 2017 -0700 xfs: fix warnings about unused stack variables Reduce stack usage and get rid of compiler warnings by eliminating unused variables. Signed-off-by: Darrick J. Wong Reviewed-by: Carlos Maiolino fs/xfs/libxfs/xfs_bmap.c | 2 -- 1 file changed, 2 deletions(-) commit 6eadbf4c8ba816c10d1c97bed9aa861d9fd17809 Author: Darrick J. Wong Date: Fri May 12 10:44:08 2017 -0700 xfs: BMAPX shouldn't barf on inline-format directories When we're fulfilling a BMAPX request, jump out early if the data fork is in local format. This prevents us from hitting a debugging check in bmapi_read and barfing errors back to userspace. The on-disk extent count check later isn't sufficient for IF_DELALLOC mode because da extents are in memory and not on disk. Signed-off-by: Darrick J. Wong Reviewed-by: Brian Foster Reviewed-by: Christoph Hellwig fs/xfs/xfs_bmap_util.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 0daaecacb83bc6b656a56393ab77a31c28139bc7 Author: Brian Foster Date: Fri May 12 10:44:08 2017 -0700 xfs: fix indlen accounting error on partial delalloc conversion The delalloc -> real block conversion path uses an incorrect calculation in the case where the middle part of a delalloc extent is being converted. This is documented as a rare situation because XFS generally attempts to maximize contiguity by converting as much of a delalloc extent as possible. If this situation does occur, the indlen reservation for the two new delalloc extents left behind by the conversion of the middle range is calculated and compared with the original reservation. If more blocks are required, the delta is allocated from the global block pool. This delta value can be characterized as the difference between the new total requirement (temp + temp2) and the currently available reservation minus those blocks that have already been allocated (startblockval(PREV.br_startblock) - allocated). The problem is that the current code does not account for previously allocated blocks correctly. It subtracts the current allocation count from the (new - old) delta rather than the old indlen reservation. This means that more indlen blocks than have been allocated end up stashed in the remaining extents and free space accounting is broken as a result. Fix up the calculation to subtract the allocated block count from the original extent indlen and thus correctly allocate the reservation delta based on the difference between the new total requirement and the unused blocks from the original reservation. Also remove a bogus assert that contradicts the fact that the new indlen reservation can be larger than the original indlen reservation. Signed-off-by: Brian Foster Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/libxfs/xfs_bmap.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit bec6cd63aa0abb0752e3d04daa36e26c08a49315 Merge: a95cfad eb77e6b Author: Linus Torvalds Date: Tue May 16 09:18:18 2017 -0700 Merge tag 'edac_fix_for_4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp Pull EDAC fix from Borislav Petkov: "A single amd64_edac fix correcting chip select sizes reporting on F17h" * tag 'edac_fix_for_4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp: EDAC, amd64: Fix reporting of Chip Select sizes on Fam17h commit c034640a32f8456018d9c8c83799ead683046b95 Author: Thomas Petazzoni Date: Tue May 16 14:06:12 2017 +0200 ata: libahci: properly propagate return value of platform_get_irq() When platform_get_irq() fails, it returns an error code, which libahci_platform and replaces it by -EINVAL. This commit fixes that by propagating the error code. It fixes the situation where platform_get_irq() returns -EPROBE_DEFER because the interrupt controller is not available yet, and generally looks like the right thing to do. We pay attention to not show the "no irq" message when we are in an EPROBE_DEFER situation, because the driver probing will be retried later on, once the interrupt controller becomes available to provide the interrupt. Signed-off-by: Thomas Petazzoni Reviewed-by: Hans de Goede Signed-off-by: Tejun Heo drivers/ata/libahci_platform.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 5dc63fdcc09f47fb226b8bc7d83a61feb787d817 Author: Arvind Yadav Date: Tue May 9 16:00:28 2017 +0530 ata: sata_rcar: Handle return value of clk_prepare_enable Here, Clock enable can failed. So adding an error check for clk_prepare_enable. tj: minor style updates Signed-off-by: Arvind Yadav Signed-off-by: Tejun Heo drivers/ata/sata_rcar.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) commit 8bfd174312629866efa535193d9e563768ff4307 Author: Sui Chen Date: Tue May 9 07:47:22 2017 -0500 ahci: Acer SA5-271 SSD Not Detected Fix (Correction in this resend: fixed function name acer_sa5_271_workaround; fixed the always-true condition in the function; fixed description.) On the Acer Switch Alpha 12 (model number: SA5-271), the internal SSD may not get detected because the port_map and CAP.nr_ports combination causes the driver to skip the port that is actually connected to the SSD. More specifically, either all SATA ports are identified as DUMMY, or all ports get ``link down'' and never get up again. This problem occurs occasionally. When this problem occurs, CAP may hold a value of 0xC734FF00 or 0xC734FF01 and port_map may hold a value of 0x00 or 0x01. When this problem does not occur, CAP holds a value of 0xC734FF02 and port_map may hold a value of 0x07. Overriding the CAP value to 0xC734FF02 and port_map to 0x7 significantly reduces the occurrence of this problem. Link: https://bugzilla.kernel.org/attachment.cgi?id=253091 Signed-off-by: Sui Chen Tested-by: Damian Ivanov Cc: stable@vger.kernel.org Signed-off-by: Tejun Heo drivers/ata/ahci.c | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) commit aff523fb82696f59b197ea79ea3652c216dbe4c0 Author: Tony Lindgren Date: Fri May 5 15:37:06 2017 -0700 memory: omap-gpmc: Fix debug output for access width The width needs to be configured in bytes with 1 meaning 8-bit access and 2 meaning 16-bit access. Cc: Peter Ujfalusi Acked-by: Roger Quadros Signed-off-by: Tony Lindgren drivers/memory/omap-gpmc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 56322e123235370f1449c7444e311cce857d12f5 Author: Adam Ford Date: Thu May 11 12:21:19 2017 -0500 ARM: dts: LogicPD Torpedo: Fix camera pin mux Fix commit 05c4ffc3a266 ("ARM: dts: LogicPD Torpedo: Add MT9P031 Support") In the previous commit, I indicated that the only testing was done by showing the camera showed up when probing. This patch fixes an incorrect pin muxing on cam_d0, cam_d1 and cam_d2. Signed-off-by: Adam Ford Signed-off-by: Tony Lindgren arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit f0b8dca8336b112d23be9fa9c0d38cc4eb733344 Author: Hans Verkuil Date: Tue May 16 08:10:07 2017 -0700 ARM: dts: omap4: enable CEC pin for Pandaboard A4 and ES The CEC pin was always pulled up, making it impossible to use it. Change to PIN_INPUT so it can be used by the new CEC support. Signed-off-by: Hans Verkuil Reviewed-by: Tomi Valkeinen arch/arm/boot/dts/omap4-panda-a4.dts | 2 +- arch/arm/boot/dts/omap4-panda-es.dts | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 910958b65cf638347e6c8f65d1f749d6a4cfb7e3 Author: Andreas Kemnade Date: Fri Apr 28 12:27:35 2017 +0200 ARM: dts: gta04: fix polarity of clocks for mcbsp4 The clock polarity setting of the mcbsp connected to the modem was wrong so almost only noise was received. With this patch it is also the same as it was on earlier non-dt kernels where it was working properly Signed-off-by: Andreas Kemnade Signed-off-by: Tony Lindgren arch/arm/boot/dts/omap3-gta04.dtsi | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 7c62de5f3fc92291decc0dac5f36949bdc3fb575 Author: Keerthy Date: Thu Apr 13 10:21:21 2017 +0530 ARM: dts: dra7: Add power hold and power controller properties to palmas Add power hold and power controller properties to palmas node. This is needed to shutdown pmic correctly on boards with powerhold set. Signed-off-by: Keerthy Signed-off-by: Tony Lindgren arch/arm/boot/dts/dra7-evm.dts | 2 ++ 1 file changed, 2 insertions(+) commit 6ceec6953efe7f371218082ddee1fe022a13e8ab Author: Alexandre Belloni Date: Tue May 16 16:54:53 2017 +0200 MAINTAINERS: update RTC mailing list The RTC subsystem mailing list is moving to vger. Signed-off-by: Alexandre Belloni MAINTAINERS | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit bff5baf8aa37a97293725a16c03f49872249c07e Author: Colin Ian King Date: Tue May 9 18:14:01 2017 +0100 btrfs: fix incorrect error return ret being passed to mapping_set_error The setting of return code ret should be based on the error code passed into function end_extent_writepage and not on ret. Thanks to Liu Bo for spotting this mistake in the original fix I submitted. Detected by CoverityScan, CID#1414312 ("Logically dead code") Fixes: 5dca6eea91653e ("Btrfs: mark mapping with error flag to report errors to userspace") Signed-off-by: Colin Ian King Reviewed-by: Liu Bo Signed-off-by: David Sterba fs/btrfs/extent_io.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8d91012528b3c95c159e6b6779e367421df9cbb5 Author: Jan Kara Date: Tue May 2 17:03:50 2017 +0200 btrfs: Make flush bios explicitely sync Commit b685d3d65ac7 "block: treat REQ_FUA and REQ_PREFLUSH as synchronous" removed REQ_SYNC flag from WRITE_{FUA|PREFLUSH|...} definitions. generic_make_request_checks() however strips REQ_FUA and REQ_PREFLUSH flags from a bio when the storage doesn't report volatile write cache and thus write effectively becomes asynchronous which can lead to performance regressions Fix the problem by making sure all bios which are synchronous are properly marked with REQ_SYNC. CC: David Sterba CC: linux-btrfs@vger.kernel.org Fixes: b685d3d65ac791406e0dfd8779cc9b3707fea5a3 Signed-off-by: Jan Kara Reviewed-by: Liu Bo Signed-off-by: David Sterba fs/btrfs/disk-io.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit 4751832da990a927c37526ae67b9226ea01eb99e Author: Qu Wenruo Date: Fri Apr 7 10:43:15 2017 +0800 btrfs: fiemap: Cache and merge fiemap extent before submit it to user [BUG] Cycle mount btrfs can cause fiemap to return different result. Like: # mount /dev/vdb5 /mnt/btrfs # dd if=/dev/zero bs=16K count=4 oflag=dsync of=/mnt/btrfs/file # xfs_io -c "fiemap -v" /mnt/btrfs/file /mnt/test/file: EXT: FILE-OFFSET BLOCK-RANGE TOTAL FLAGS 0: [0..127]: 25088..25215 128 0x1 # umount /mnt/btrfs # mount /dev/vdb5 /mnt/btrfs # xfs_io -c "fiemap -v" /mnt/btrfs/file /mnt/test/file: EXT: FILE-OFFSET BLOCK-RANGE TOTAL FLAGS 0: [0..31]: 25088..25119 32 0x0 1: [32..63]: 25120..25151 32 0x0 2: [64..95]: 25152..25183 32 0x0 3: [96..127]: 25184..25215 32 0x1 But after above fiemap, we get correct merged result if we call fiemap again. # xfs_io -c "fiemap -v" /mnt/btrfs/file /mnt/test/file: EXT: FILE-OFFSET BLOCK-RANGE TOTAL FLAGS 0: [0..127]: 25088..25215 128 0x1 [REASON] Btrfs will try to merge extent map when inserting new extent map. btrfs_fiemap(start=0 len=(u64)-1) |- extent_fiemap(start=0 len=(u64)-1) |- get_extent_skip_holes(start=0 len=64k) | |- btrfs_get_extent_fiemap(start=0 len=64k) | |- btrfs_get_extent(start=0 len=64k) | | Found on-disk (ino, EXTENT_DATA, 0) | |- add_extent_mapping() | |- Return (em->start=0, len=16k) | |- fiemap_fill_next_extent(logic=0 phys=X len=16k) | |- get_extent_skip_holes(start=0 len=64k) | |- btrfs_get_extent_fiemap(start=0 len=64k) | |- btrfs_get_extent(start=16k len=48k) | | Found on-disk (ino, EXTENT_DATA, 16k) | |- add_extent_mapping() | | |- try_merge_map() | | Merge with previous em start=0 len=16k | | resulting em start=0 len=32k | |- Return (em->start=0, len=32K) << Merged result |- Stripe off the unrelated range (0~16K) of return em |- fiemap_fill_next_extent(logic=16K phys=X+16K len=16K) ^^^ Causing split fiemap extent. And since in add_extent_mapping(), em is already merged, in next fiemap() call, we will get merged result. [FIX] Here we introduce a new structure, fiemap_cache, which records previous fiemap extent. And will always try to merge current fiemap_cache result before calling fiemap_fill_next_extent(). Only when we failed to merge current fiemap extent with cached one, we will call fiemap_fill_next_extent() to submit cached one. So by this method, we can merge all fiemap extents. It can also be done in fs/ioctl.c, however the problem is if fieinfo->fi_extents_max == 0, we have no space to cache previous fiemap extent. So I choose to merge it in btrfs. Signed-off-by: Qu Wenruo Reviewed-by: Liu Bo Reviewed-by: David Sterba Signed-off-by: David Sterba fs/btrfs/extent_io.c | 124 ++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 122 insertions(+), 2 deletions(-) commit 2c4569ca26986d18243f282dd727da27e9adae4c Author: Thomas Gleixner Date: Thu May 11 13:54:11 2017 +0200 genirq: Fix chained interrupt data ordering irq_set_chained_handler_and_data() sets up the chained interrupt and then stores the handler data. That's racy against an immediate interrupt which gets handled before the store of the handler data happened. The handler will dereference a NULL pointer and crash. Cure it by storing handler data before installing the chained handler. Reported-by: Borislav Petkov Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org kernel/irq/chip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b72d7451209a0bad4264f5f4cb389e7f71cc5ad4 Author: Arnd Bergmann Date: Tue May 16 13:30:05 2017 +0200 staging: fsl-dpaa2/eth: add ETHERNET dependency The new driver cannot link correctly when the netdevice infrastructure is disabled: ERROR: "netdev_info" [drivers/staging/fsl-dpaa2/ethernet/fsl-dpaa2-eth.ko] undefined! ERROR: "skb_to_sgvec" [drivers/staging/fsl-dpaa2/ethernet/fsl-dpaa2-eth.ko] undefined! ERROR: "napi_disable" [drivers/staging/fsl-dpaa2/ethernet/fsl-dpaa2-eth.ko] undefined! ERROR: "napi_schedule_prep" [drivers/staging/fsl-dpaa2/ethernet/fsl-dpaa2-eth.ko] undefined! ERROR: "__napi_schedule_irqoff" [drivers/staging/fsl-dpaa2/ethernet/fsl-dpaa2-eth.ko] undefined! ERROR: "netif_carrier_on" [drivers/staging/fsl-dpaa2/ethernet/fsl-dpaa2-eth.ko] undefined! This adds a dependency on NETDEVICES and ETHERNET. Fixes: 0352d1d85201 ("staging: fsl-dpaa2/eth: Add APIs for DPNI objects") Signed-off-by: Arnd Bergmann Signed-off-by: Greg Kroah-Hartman drivers/staging/fsl-dpaa2/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 50b7c322cfc8b44a36b1373dab2177db23e3282c Author: Rui Miguel Silva Date: Fri May 12 21:16:15 2017 +0100 staging: typec: fusb302: refactor resume retry mechanism The i2c functions need to test the pm_suspend state and do, if needed, some retry before i2c operations. This code was repeated 4x. To isolate this, create a new function to check suspend state and call it in every need place. As at it, move the error message from pr_err to dev_err. Signed-off-by: Rui Miguel Silva Acked-by: Yueyao Zhu Reviewed-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman drivers/staging/typec/fusb302/fusb302.c | 70 +++++++++++++++++---------------- 1 file changed, 36 insertions(+), 34 deletions(-) commit f0d39a179b9cd38c739acfc4f92720a0c79e1d66 Author: Rui Miguel Silva Date: Fri May 12 21:16:14 2017 +0100 staging: typec: fusb302: reset i2c_busy state in error Fix reset of i2c_busy flag if an error occurs during the i2c block read. Signed-off-by: Rui Miguel Silva Acked-by: Yueyao Zhu Reviewed-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman drivers/staging/typec/fusb302/fusb302.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 018047a1dba7636e1f7fdae2cc290a528991d648 Author: Pan Bian Date: Sun Apr 23 13:55:13 2017 +0800 usb: dwc3: keystone: check return value Function devm_clk_get() returns an ERR_PTR when it fails. However, in function kdwc3_probe(), its return value is not checked, which may result in a bad memory access bug. This patch fixes the bug. Signed-off-by: Pan Bian Signed-off-by: Felipe Balbi drivers/usb/dwc3/dwc3-keystone.c | 4 ++++ 1 file changed, 4 insertions(+) commit b7f73850bb4fac1e2209a4dd5e636d39be92f42c Author: William Wu Date: Tue Apr 25 17:45:48 2017 +0800 usb: gadget: f_fs: avoid out of bounds access on comp_desc Companion descriptor is only used for SuperSpeed endpoints, if the endpoints are HighSpeed or FullSpeed, the Companion descriptor will not allocated, so we can only access it if gadget is SuperSpeed. I can reproduce this issue on Rockchip platform rk3368 SoC which supports USB 2.0, and use functionfs for ADB. Kernel build with CONFIG_KASAN=y and CONFIG_SLUB_DEBUG=y report the following BUG: ================================================================== BUG: KASAN: slab-out-of-bounds in ffs_func_set_alt+0x224/0x3a0 at addr ffffffc0601f6509 Read of size 1 by task swapper/0/0 ============================================================================ BUG kmalloc-256 (Not tainted): kasan: bad access detected ---------------------------------------------------------------------------- Disabling lock debugging due to kernel taint INFO: Allocated in ffs_func_bind+0x52c/0x99c age=1275 cpu=0 pid=1 alloc_debug_processing+0x128/0x17c ___slab_alloc.constprop.58+0x50c/0x610 __slab_alloc.isra.55.constprop.57+0x24/0x34 __kmalloc+0xe0/0x250 ffs_func_bind+0x52c/0x99c usb_add_function+0xd8/0x1d4 configfs_composite_bind+0x48c/0x570 udc_bind_to_driver+0x6c/0x170 usb_udc_attach_driver+0xa4/0xd0 gadget_dev_desc_UDC_store+0xcc/0x118 configfs_write_file+0x1a0/0x1f8 __vfs_write+0x64/0x174 vfs_write+0xe4/0x200 SyS_write+0x68/0xc8 el0_svc_naked+0x24/0x28 INFO: Freed in inode_doinit_with_dentry+0x3f0/0x7c4 age=1275 cpu=7 pid=247 ... Call trace: [] dump_backtrace+0x0/0x230 [] show_stack+0x14/0x1c [] dump_stack+0xa0/0xc8 [] print_trailer+0x188/0x198 [] object_err+0x3c/0x4c [] kasan_report+0x324/0x4dc [] __asan_load1+0x24/0x50 [] ffs_func_set_alt+0x224/0x3a0 [] composite_setup+0xdcc/0x1ac8 [] android_setup+0x124/0x1a0 [] _setup+0x54/0x74 [] handle_ep0+0x3288/0x4390 [] dwc_otg_pcd_handle_out_ep_intr+0x14dc/0x2ae4 [] dwc_otg_pcd_handle_intr+0x1ec/0x298 [] dwc_otg_pcd_irq+0x10/0x20 [] handle_irq_event_percpu+0x124/0x3ac [] handle_irq_event+0x60/0xa0 [] handle_fasteoi_irq+0x10c/0x1d4 [] generic_handle_irq+0x30/0x40 [] __handle_domain_irq+0xac/0xdc [] gic_handle_irq+0x64/0xa4 ... Memory state around the buggy address: ffffffc0601f6400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffffc0601f6480: 00 00 00 00 00 00 00 00 00 00 06 fc fc fc fc fc >ffffffc0601f6500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffffffc0601f6580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffffc0601f6600: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 ================================================================== Signed-off-by: William Wu Signed-off-by: Felipe Balbi drivers/usb/gadget/function/f_fs.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 844cf8a9d51f1d1e116d0bb18c353a2a94c70e79 Author: Bogdan Mirea Date: Sun Apr 30 13:21:26 2017 +0300 usb: gadget: gserial: check if console kthread exists Check for bad pointer that may result because of kthread_create failure. This check is needed since the gserial setup callback function (gs_console_setup()) is only freeing the info->con_buf in case of kthread_create failure which will result into bad info->console_thread pointer. Without checking info->console_thread pointer validity in the gserial_console_exit() function, before calling kthread_stop(), the rmmod will generate Kernel Oops. Signed-off-by: Bogdan Mirea Signed-off-by: Felipe Balbi drivers/usb/gadget/function/u_serial.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d325a1de49d61ee11aca58a529571c91ecea7879 Author: Thinh Nguyen Date: Thu May 11 17:26:47 2017 -0700 usb: dwc3: gadget: Prevent losing events in event cache The dwc3 driver can overwite its previous events if its top-half IRQ handler (TH) gets invoked again before processing the events in the cache. We see this as a hang in the file transfer and the host will attempt to reset the device. TH gets the event count and deasserts the interrupt line by writing DWC3_GEVNTSIZ_INTMASK to DWC3_GEVNTSIZ. If there's a new event coming between reading the event count and interrupt deassertion, dwc3 will lose previous pending events. More generally, we will see 0 event count, which should not affect anything. This shouldn't be possible in the current dwc3 implementation. However, through testing and reading the PCIe trace, the TH occasionally still gets invoked one more time after HW interrupt deassertion. (With PCIe legacy interrupts, TH is called repeatedly as long as the interrupt line is asserted). We suspect that there is a small detection delay in the SW. To avoid this issue, Check DWC3_EVENT_PENDING flag to determine if the events are processed in the bottom-half IRQ handler. If not, return IRQ_HANDLED and don't process new event. Cc: stable@vger.kernel.org Signed-off-by: Thinh Nguyen Signed-off-by: Felipe Balbi drivers/usb/dwc3/gadget.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit f1d6826cae30e97e37a1f2481d7e1dc4faa09ce1 Author: Roger Quadros Date: Fri Apr 21 15:58:08 2017 +0300 usb: dwc3: gadget: Fix ISO transfer performance Commit 08a36b543803 ("usb: dwc3: gadget: simplify __dwc3_gadget_ep_queue()") caused a small change in the way ISO transfer is handled in the case when XferInProgress event happens on Isoc EP with an active transfer. This caused a performance degradation of 50%. e.g. using g_webcam on DUT and luvcview on host the video frame rate dropped from 16fps to 8fps @high-speed. Make the ISO transfer handling equivalent to that prior to that commit to get back the original ISO performance numbers. Fixes: 08a36b543803 ("usb: dwc3: gadget: simplify __dwc3_gadget_ep_queue()") Signed-off-by: Roger Quadros Signed-off-by: Felipe Balbi drivers/usb/dwc3/gadget.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) commit 682179592e48fa66056fbad1a86604be4992f885 Author: Heikki Krogerus Date: Fri Apr 1 17:13:13 2016 +0300 usb: dwc3: pci: add Intel Cannonlake PCI IDs Intel Cannonlake PCH has the same DWC3 than Intel Sunrisepoint. Add the new IDs to the supported devices. Signed-off-by: Heikki Krogerus Signed-off-by: Felipe Balbi drivers/usb/dwc3/dwc3-pci.c | 4 ++++ 1 file changed, 4 insertions(+) commit 0c428a6a9256fcd66817e12db32a50b405ed2e5c Author: Suzuki K Poulose Date: Tue May 16 10:34:55 2017 +0100 kvm: arm/arm64: Fix use after free of stage2 page table We yield the kvm->mmu_lock occassionaly while performing an operation (e.g, unmap or permission changes) on a large area of stage2 mappings. However this could possibly cause another thread to clear and free up the stage2 page tables while we were waiting for regaining the lock and thus the original thread could end up in accessing memory that was freed. This patch fixes the problem by making sure that the stage2 pagetable is still valid after we regain the lock. The fact that mmu_notifer->release() could be called twice (via __mmu_notifier_release and mmu_notifier_unregsister) enhances the possibility of hitting this race where there are two threads trying to unmap the entire guest shadow pages. While at it, cleanup the redudant checks around cond_resched_lock in stage2_wp_range(), as cond_resched_lock already does the same checks. Cc: Mark Rutland Cc: Radim Krčmář Cc: andreyknvl@google.com Cc: Paolo Bonzini Cc: stable@vger.kernel.org Acked-by: Marc Zyngier Signed-off-by: Suzuki K Poulose Reviewed-by: Christoffer Dall Signed-off-by: Christoffer Dall virt/kvm/arm/mmu.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) commit 2952a6070e07ebdd5896f1f5b861acad677caded Author: Suzuki K Poulose Date: Tue May 16 10:34:54 2017 +0100 kvm: arm/arm64: Force reading uncached stage2 PGD Make sure we don't use a cached value of the KVM stage2 PGD while resetting the PGD. Cc: Marc Zyngier Cc: stable@vger.kernel.org Signed-off-by: Suzuki K Poulose Reviewed-by: Christoffer Dall Signed-off-by: Christoffer Dall virt/kvm/arm/mmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit dbed87a9d3a857a86f602775b5845f5f6d9652b5 Author: Tobias Regnery Date: Mon Apr 24 12:05:42 2017 +0200 clk: meson: gxbb: fix build error without RESET_CONTROLLER With CONFIG_RESET_CONTROLLER=n we see the following link error in the meson gxbb clk driver: drivers/built-in.o: In function 'gxbb_aoclkc_probe': drivers/clk/meson/gxbb-aoclk.c:161: undefined reference to 'devm_reset_controller_register' Fix this by selecting the reset controller subsystem. Fixes: f8c11f79912d ("clk: meson: Add GXBB AO Clock and Reset controller driver") Signed-off-by: Tobias Regnery Acked-by: Neil Armstrong [narmstrong: Added fixes-by tag] Signed-off-by: Neil Armstrong drivers/clk/meson/Kconfig | 1 + 1 file changed, 1 insertion(+) commit c953d63548207a085abcb12a15fefc8a11ffdf0a Author: Gao Feng Date: Tue May 16 09:30:18 2017 +0800 ebtables: arpreply: Add the standard target sanity check The info->target comes from userspace and it would be used directly. So we need to add the sanity check to make sure it is a valid standard target, although the ebtables tool has already checked it. Kernel needs to validate anything coming from userspace. If the target is set as an evil value, it would break the ebtables and cause a panic. Because the non-standard target is treated as one offset. Now add one helper function ebt_invalid_target, and we would replace the macro INVALID_TARGET later. Signed-off-by: Gao Feng Signed-off-by: Pablo Neira Ayuso include/linux/netfilter_bridge/ebtables.h | 5 +++++ net/bridge/netfilter/ebt_arpreply.c | 3 +++ 2 files changed, 8 insertions(+) commit fa16b69f1299004b60b625f181143500a246e5cb Author: Takashi Iwai Date: Tue May 16 09:11:33 2017 +0200 ALSA: hda - No loopback on ALC299 codec ALC299 has no loopback mixer, but the driver still tries to add a beep control over the mixer NID which leads to the error at accessing it. This patch fixes it by properly declaring mixer_nid=0 for this codec. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=195775 Fixes: 28f1f9b26cee ("ALSA: hda/realtek - Add new codec ID ALC299") Cc: stable@vger.kernel.org Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 3 +++ 1 file changed, 3 insertions(+) commit 9a445bbb1607d9f14556a532453dd86d1b7e381e Author: Hiroyuki Yokoyama Date: Mon May 15 17:49:52 2017 +0900 dmaengine: usb-dmac: Fix DMAOR AE bit definition This patch fixes the register definition of AE (Address Error flag) bit. Fixes: 0c1c8ff32fa2 ("dmaengine: usb-dmac: Add Renesas USB DMA Controller (USB-DMAC) driver") Cc: # v4.1+ Signed-off-by: Hiroyuki Yokoyama [Shimoda: add Fixes and Cc tags in the commit log] Signed-off-by: Yoshihiro Shimoda Reviewed-by: Geert Uytterhoeven Signed-off-by: Vinod Koul drivers/dma/sh/usb-dmac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4ff83daa0200affe1894bd33d17bac404e3d78d4 Author: Nicholas Bellinger Date: Thu May 11 01:07:24 2017 -0700 target: Re-add check to reject control WRITEs with overflow data During v4.3 when the overflow/underflow check was relaxed by commit c72c525022: commit c72c5250224d475614a00c1d7e54a67f77cd3410 Author: Roland Dreier Date: Wed Jul 22 15:08:18 2015 -0700 target: allow underflow/overflow for PR OUT etc. commands to allow underflow/overflow for Windows compliance + FCP, a consequence was to allow control CDBs to process overflow data for iscsi-target with immediate data as well. As per Roland's original change, continue to allow underflow cases for control CDBs to make Windows compliance + FCP happy, but until overflow for control CDBs is supported tree-wide, explicitly reject all control WRITEs with overflow following pre v4.3.y logic. Reported-by: Bart Van Assche Cc: Roland Dreier Cc: # v4.3+ Signed-off-by: Nicholas Bellinger drivers/target/target_core_transport.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-) commit 75dbf2d36f6b122ad3c1070fe4bf95f71bbff321 Author: Bryant G. Ly Date: Wed May 10 14:35:47 2017 -0500 ibmvscsis: Fix the incorrect req_lim_delta The current code is not correctly calculating the req_lim_delta. We want to make sure vscsi->credit is always incremented when we do not send a response for the scsi op. Thus for the case where there is a successfully aborted task we need to make sure the vscsi->credit is incremented. v2 - Moves the original location of the vscsi->credit increment to a better spot. Since if we increment credit, the next command we send back will have increased req_lim_delta. But we probably shouldn't be doing that until the aborted cmd is actually released. Otherwise the client will think that it can send a new command, and we could find ourselves short of command elements. Not likely, but could happen. This patch depends on both: commit 25e78531268e ("ibmvscsis: Do not send aborted task response") commit 98883f1b5415 ("ibmvscsis: Clear left-over abort_cmd pointers") Signed-off-by: Bryant G. Ly Reviewed-by: Michael Cyr Cc: # v4.8+ Signed-off-by: Nicholas Bellinger drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) commit 98883f1b5415ea9dce60d5178877d15f4faa10b8 Author: Bryant G. Ly Date: Tue May 9 11:50:26 2017 -0500 ibmvscsis: Clear left-over abort_cmd pointers With the addition of ibmvscsis->abort_cmd pointer within commit 25e78531268e ("ibmvscsis: Do not send aborted task response"), make sure to explicitly NULL these pointers when clearing DELAY_SEND flag. Do this for two cases, when getting the new new ibmvscsis descriptor in ibmvscsis_get_free_cmd() and before posting the response completion in ibmvscsis_send_messages(). Signed-off-by: Bryant G. Ly Reviewed-by: Michael Cyr Cc: # v4.8+ Signed-off-by: Nicholas Bellinger drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 3 +++ 1 file changed, 3 insertions(+) commit d04c02f8aa96d82e4cbe783f85a820aae820e746 Author: Naveen N. Rao Date: Mon May 15 23:40:05 2017 +0530 powerpc/kprobes: Fix handling of instruction emulation on probe re-entry Commit 22d8b3dec214c ("powerpc/kprobes: Emulate instructions on kprobe handler re-entry") enabled emulating instructions on kprobe re-entry, rather than single-stepping always. However, we didn't update the single stepping code to only be run if the emulation fails. Also, we missed re-enabling preemption if the instruction emulation was successful. Fix those issues. Fixes: 22d8b3dec214c ("powerpc/kprobes: Emulate instructions on kprobe handler re-entry") Signed-off-by: Naveen N. Rao Signed-off-by: Michael Ellerman arch/powerpc/kernel/kprobes.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit bbb075ddf7d58762040ca413ad82e9974713def3 Author: Gautham R. Shenoy Date: Fri May 12 14:52:06 2017 +0530 powerpc/powernv: Set NAPSTATELOST after recovering paca on P9 DD1 Commit 17ed4c8f81da ("powerpc/powernv: Recover correct PACA on wakeup from a stop on P9 DD1") promises to set the NAPSTATELOST bit in paca after recovering the correct paca for the thread waking up from stop1 on DD1, so that the GPRs can be correctly restored on the stop exit path. However, it loads the value 1 into r3, but stores the value in r0 into NAPSTATELOST(r13). Fix this by correctly set the NAPSTATELOST bit in paca after recovering the paca on POWER9 DD1. Fixes: 17ed4c8f81da ("powerpc/powernv: Recover correct PACA on wakeup from a stop on P9 DD1") Signed-off-by: Gautham R. Shenoy Reviewed-by: Nicholas Piggin Signed-off-by: Michael Ellerman arch/powerpc/kernel/idle_book3s.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cde97f8492ac4425c4d0647a308e15e78cb4c218 Author: Michael Neuling Date: Mon May 8 17:16:27 2017 +1000 selftests/powerpc: Test TM and VMX register state Test that the VMX checkpointed register state is maintained when a VMX unavailable exception is taken during a transaction. Thanks to Breno Leitao and Gustavo Bueno Romero for the original test this is based heavily on. Signed-off-by: Michael Neuling Reviewed-by: Cyril Bur [mpe: Add to .gitignore, always build it 64-bit to fix build errors] Signed-off-by: Michael Ellerman tools/testing/selftests/powerpc/tm/.gitignore | 1 + tools/testing/selftests/powerpc/tm/Makefile | 4 +- .../testing/selftests/powerpc/tm/tm-vmx-unavail.c | 118 +++++++++++++++++++++ 3 files changed, 122 insertions(+), 1 deletion(-) commit a95cfad947d5f40cfbf9ad3019575aac1d8ac7a6 Merge: 1319a28 66f4bc8 Author: Linus Torvalds Date: Mon May 15 15:50:49 2017 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) Track alignment in BPF verifier so that legitimate programs won't be rejected on !CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS architectures. 2) Make tail calls work properly in arm64 BPF JIT, from Deniel Borkmann. 3) Make the configuration and semantics Generic XDP make more sense and don't allow both generic XDP and a driver specific instance to be active at the same time. Also from Daniel. 4) Don't crash on resume in xen-netfront, from Vitaly Kuznetsov. 5) Fix use-after-free in VRF driver, from Gao Feng. 6) Use netdev_alloc_skb_ip_align() to avoid unaligned IP headers in qca_spi driver, from Stefan Wahren. 7) Always run cleanup routines in BPF samples when we get SIGTERM, from Andy Gospodarek. 8) The mdio phy code should bring PHYs out of reset using the shared GPIO lines before invoking bus->reset(). From Florian Fainelli. 9) Some USB descriptor access endian fixes in various drivers from Johan Hovold. 10) Handle PAUSE advertisements properly in mlx5 driver, from Gal Pressman. 11) Fix reversed test in mlx5e_setup_tc(), from Saeed Mahameed. 12) Cure netdev leak in AF_PACKET when using timestamping via control messages. From Douglas Caetano dos Santos. 13) netcp doesn't support HWTSTAMP_FILTER_ALl, reject it. From Miroslav Lichvar. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (52 commits) ldmvsw: stop the clean timer at beginning of remove ldmvsw: unregistering netdev before disable hardware net: netcp: fix check of requested timestamping filter ipv6: avoid dad-failures for addresses with NODAD qed: Fix uninitialized data in aRFS infrastructure mdio: mux: fix device_node_continue.cocci warnings net/packet: fix missing net_device reference release net/mlx4_core: Use min3 to select number of MSI-X vectors macvlan: Fix performance issues with vlan tagged packets net: stmmac: use correct pointer when printing normal descriptor ring net/mlx5: Use underlay QPN from the root name space net/mlx5e: IPoIB, Only support regular RQ for now net/mlx5e: Fix setup TC ndo net/mlx5e: Fix ethtool pause support and advertise reporting net/mlx5e: Use the correct pause values for ethtool advertising vmxnet3: ensure that adapter is in proper state during force_close sfc: revert changes to NIC revision numbers net: ch9200: add missing USB-descriptor endianness conversions net: irda: irda-usb: fix firmware name on big-endian hosts net: dsa: mv88e6xxx: add default case to switch ... commit 1319a2856dfdd6b4613530e771fe108f00dfc661 Merge: 2ea659a 67b4c88 Author: Linus Torvalds Date: Mon May 15 15:27:02 2017 -0700 Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs fixes from Steve French: "A set of minor cifs fixes" * 'for-next' of git://git.samba.org/sfrench/cifs-2.6: [CIFS] Minor cleanup of xattr query function fs: cifs: transport: Use time_after for time comparison SMB2: Fix share type handling cifs: cifsacl: Use a temporary ops variable to reduce code length Don't delay freeing mids when blocked on slow socket write of request CIFS: silence lockdep splat in cifs_relock_file() commit b0804ed0cadd7e38d94d2f15cdcc0d9695818856 Author: Phil Elwell Date: Tue May 9 10:04:30 2017 +0100 ARM: dts: bcm283x: Reserve first page for firmware The Raspberry Pi startup stub files for multi-core BCM283X processors make the secondary CPUs spin until the corresponding mailbox is written. These stubs are loaded at physical address 0x00000xxx (as seen by the ARMs), but this page will be reused by the kernel unless it is explicitly reserved, causing the waiting cores to execute random code. Use the /memreserve/ Device Tree directive to mark the first page as off-limits to the kernel. See: https://github.com/raspberrypi/linux/issues/1989 Signed-off-by: Phil Elwell Signed-off-by: Eric Anholt Reviewed-by: Eric Anholt arch/arm/boot/dts/bcm283x.dtsi | 5 +++++ 1 file changed, 5 insertions(+) commit d3f7c35c1ab33e6aa035407fed38d9149858bed7 Merge: a00ebd1 2d4456c Author: Jens Axboe Date: Mon May 15 15:33:06 2017 -0600 Merge branch 'stable/for-jens-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen into for-linus Pull a single fix from Konrad. commit 2d4456c73a487abe53863e10641c2f73537edf5c Author: Gustavo A. R. Silva Date: Thu May 11 10:27:35 2017 -0500 block: xen-blkback: add null check to avoid null pointer dereference Add null check before calling xen_blkif_put() to avoid potential null pointer dereference. Addresses-Coverity-ID: 1350942 Cc: Juergen Gross Signed-off-by: Gustavo A. R. Silva Signed-off-by: Konrad Rzeszutek Wilk drivers/block/xen-blkback/xenbus.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit 66f4bc819d71bb600f1c879c9a7161de1cc725f8 Merge: ca9df7e 8b671f9 Author: David S. Miller Date: Mon May 15 15:36:09 2017 -0400 Merge branch 'ldmsw-fixes' Shannon Nelson says: ==================== ldmvsw: port removal stability Under heavy reboot stress testing we found a couple of timing issues when removing the device that could cause the kernel great heartburn, addressed by these two patches. ==================== Signed-off-by: David S. Miller commit 8b671f906c2debc4f2393438c4e7668936522e99 Author: Shannon Nelson Date: Mon May 15 10:51:08 2017 -0700 ldmvsw: stop the clean timer at beginning of remove Stop the clean timer earlier to be sure there's no asynchronous interference while stopping the port. Orabug: 25748241 Signed-off-by: Shannon Nelson Signed-off-by: David S. Miller drivers/net/ethernet/sun/ldmvsw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b18e5e86b44be0dca399d8e2383f97c8077392ce Author: Thomas Tai Date: Mon May 15 10:51:07 2017 -0700 ldmvsw: unregistering netdev before disable hardware When running LDom binding/unbinding test, kernel may panic in ldmvsw_open(). It is more likely that because we're removing the ldc connection before unregistering the netdev in vsw_port_remove(), we set up a window of time where one process could be removing the device while another trying to UP the device. This also sometimes causes vio handshake error due to opening a device without closing it completely. We should unregister the netdev before we disable the "hardware". Orabug: 25980913, 25925306 Signed-off-by: Thomas Tai Signed-off-by: Shannon Nelson Signed-off-by: David S. Miller drivers/net/ethernet/sun/ldmvsw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ca9df7ede41afd006d74fd6f09f36d909d0eaad7 Author: Miroslav Lichvar Date: Mon May 15 16:04:36 2017 +0200 net: netcp: fix check of requested timestamping filter The driver doesn't support timestamping of all received packets and should return error when trying to enable the HWTSTAMP_FILTER_ALL filter. Cc: WingMan Kwok Cc: Richard Cochran Signed-off-by: Miroslav Lichvar Acked-by: Richard Cochran Signed-off-by: David S. Miller drivers/net/ethernet/ti/netcp_ethss.c | 1 - 1 file changed, 1 deletion(-) commit f98e0eb68008aff9824d1c4dad7276c8bab83ca5 Author: Christoph Hellwig Date: Mon May 15 17:28:38 2017 +0200 dm mpath: multipath_clone_and_map must not return -EIO Since 412445ac ("dm: introduce a new DM_MAPIO_KILL return value"), the clone_and_map_rq methods must not return errno values, so fix it up to properly return DM_MAPIO_KILL, instead of the -EIO value that snuck in due to a conflict between two patches. Signed-off-by: Christoph Hellwig Signed-off-by: Mike Snitzer drivers/md/dm-mpath.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 18a482f5245cc875755090853e84283512b3e6bd Author: Christoph Hellwig Date: Mon May 15 17:28:37 2017 +0200 dm mpath: don't return -EIO from dm_report_EIO Instead just turn the macro into a helper for the warning message. This removes an unnecessary assignment and will allow the next commit to fix a place where -EIO is the wrong return value. Signed-off-by: Christoph Hellwig Signed-off-by: Mike Snitzer drivers/md/dm-mpath.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) commit ece0728037b15f4d31198f12b359104bcb5db4c8 Author: Christoph Hellwig Date: Mon May 15 17:28:36 2017 +0200 dm rq: add a missing break to map_request We don't want to bug when receiving a DM_MAPIO_KILL value.. Fixes: 412445ac ("dm: introduce a new DM_MAPIO_KILL return value") Signed-off-by: Christoph Hellwig Signed-off-by: Mike Snitzer drivers/md/dm-rq.c | 1 + 1 file changed, 1 insertion(+) commit 0377a07c7a035e0d033cd8b29f0cb15244c0916a Author: Joe Thornber Date: Mon May 15 09:45:40 2017 -0400 dm space map disk: fix some book keeping in the disk space map When decrementing the reference count for a block, the free count wasn't being updated if the reference count went to zero. Cc: stable@vger.kernel.org Signed-off-by: Joe Thornber Signed-off-by: Mike Snitzer drivers/md/persistent-data/dm-space-map-disk.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) commit 91bcdb92d39711d1adb40c26b653b7978d93eb98 Author: Joe Thornber Date: Mon May 15 09:43:05 2017 -0400 dm thin metadata: call precommit before saving the roots These calls were the wrong way round in __write_initial_superblock. Cc: stable@vger.kernel.org Signed-off-by: Joe Thornber Signed-off-by: Mike Snitzer drivers/md/dm-thin-metadata.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 42a928ced3a2f36934d9c4157fbd21178e3acff3 Merge: 66eb9f8 5085411 Author: David S. Miller Date: Mon May 15 14:38:04 2017 -0400 Merge tag 'mlx5-fixes-2017-05-12-V2' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== Mellanox, mlx5 fixes 2017-05-12 This series contains some mlx5 fixes for net. Please pull and let me know if there's any problem. For -stable: ("net/mlx5e: Fix ethtool pause support and advertise reporting") kernels >= 4.8 ("net/mlx5e: Use the correct pause values for ethtool advertising") kernels >= 4.8 v1->v2: Dropped statistics spinlock patch, it needs some extra work. ==================== Signed-off-by: David S. Miller commit 66eb9f86e50547ec2a8ff7a75997066a74ef584b Author: Mahesh Bandewar Date: Fri May 12 17:03:39 2017 -0700 ipv6: avoid dad-failures for addresses with NODAD Every address gets added with TENTATIVE flag even for the addresses with IFA_F_NODAD flag and dad-work is scheduled for them. During this DAD process we realize it's an address with NODAD and complete the process without sending any probe. However the TENTATIVE flags stays on the address for sometime enough to cause misinterpretation when we receive a NS. While processing NS, if the address has TENTATIVE flag, we mark it DADFAILED and endup with an address that was originally configured as NODAD with DADFAILED. We can't avoid scheduling dad_work for addresses with NODAD but we can avoid adding TENTATIVE flag to avoid this racy situation. Signed-off-by: Mahesh Bandewar Acked-by: David Ahern Signed-off-by: David S. Miller net/ipv6/addrconf.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit aa4ad88cfcd4ee45f527fb982140576711e3b501 Author: Mintz, Yuval Date: Sun May 14 12:21:23 2017 +0300 qed: Fix uninitialized data in aRFS infrastructure Current memset is using incorrect type of variable, causing the upper-half of the strucutre to be left uninitialized and causing: ethernet/qlogic/qed/qed_init_fw_funcs.c: In function 'qed_set_rfs_mode_disable': ethernet/qlogic/qed/qed_init_fw_funcs.c:993:3: error: '*((void *)&ramline+4)' is used uninitialized in this function [-Werror=uninitialized] Fixes: d51e4af5c209 ("qed: aRFS infrastructure support") Reported-by: Arnd Bergmann Signed-off-by: Yuval Mintz Reviewed-by: Arnd Bergmann Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_init_fw_funcs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8c977f5a856a7276450ddf3a7b57b4a8815b63f9 Author: Julia Lawall Date: Fri May 12 22:54:23 2017 +0800 mdio: mux: fix device_node_continue.cocci warnings Device node iterators put the previous value of the index variable, so an explicit put causes a double put. In particular, of_mdiobus_register can fail before doing anything interesting, so one could view it as a no-op from the reference count point of view. Generated by: scripts/coccinelle/iterators/device_node_continue.cocci CC: Jon Mason Signed-off-by: Julia Lawall Signed-off-by: Fengguang Wu Signed-off-by: David S. Miller drivers/net/phy/mdio-mux.c | 1 - 1 file changed, 1 deletion(-) commit d19b183cdc1fa3d70d6abe2a4c369e748cd7ebb8 Author: Douglas Caetano dos Santos Date: Fri May 12 15:19:15 2017 -0300 net/packet: fix missing net_device reference release When using a TX ring buffer, if an error occurs processing a control message (e.g. invalid message), the net_device reference is not released. Fixes c14ac9451c348 ("sock: enable timestamping using control messages") Signed-off-by: Douglas Caetano dos Santos Acked-by: Soheil Hassas Yeganeh Signed-off-by: David S. Miller net/packet/af_packet.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit 4762010f09ac0453f613df345c5281e7f2dec510 Author: yuval.shaia@oracle.com Date: Fri May 12 09:10:51 2017 +0300 net/mlx4_core: Use min3 to select number of MSI-X vectors Signed-off-by: Yuval Shaia Reviewed-by: Leon Romanovsky Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx4/main.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) commit 70957eaecc2e43308e403c80293bec3d59632412 Author: Vlad Yasevich Date: Thu May 11 11:09:52 2017 -0400 macvlan: Fix performance issues with vlan tagged packets Macvlan always turns on offload features that have sofware fallback (NETIF_GSO_SOFTWARE). This allows much higher guest-guest communications over macvtap. However, macvtap does not turn on these features for vlan tagged traffic. As a result, depending on the HW that mactap is configured on, the performance of guest-guest communication over a vlan is very inconsistent. If the HW supports TSO/UFO over vlans, then the performance will be fine. If not, the the performance will suffer greatly since the VM may continue using TSO/UFO, and will force the host segment the traffic and possibly overlow the macvtap queue. This patch adds the always on offloads to vlan_features. This makes sure that any vlan tagged traffic between 2 guest will not be segmented needlessly. Signed-off-by: Vladislav Yasevich Signed-off-by: David S. Miller drivers/net/macvlan.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 78a19cfdf37d19002c83c8790853c1cc10feccdc Author: Ganapatrao Kulkarni Date: Tue May 2 21:59:34 2017 +0530 arm64: perf: Ignore exclude_hv when kernel is running in HYP commit d98ecdaca296 ("arm64: perf: Count EL2 events if the kernel is running in HYP") returns -EINVAL when perf system call perf_event_open is called with exclude_hv != exclude_kernel. This change breaks applications on VHE enabled ARMv8.1 platforms. The issue was observed with HHVM application, which calls perf_event_open with exclude_hv = 1 and exclude_kernel = 0. There is no separate hypervisor privilege level when VHE is enabled, the host kernel runs at EL2. So when VHE is enabled, we should ignore exclude_hv from the application. This behaviour is consistent with PowerPC where the exclude_hv is ignored when the hypervisor is not present and with x86 where this flag is ignored. Signed-off-by: Ganapatrao Kulkarni [will: added comment to justify the behaviour of exclude_hv] Signed-off-by: Will Deacon Signed-off-by: Catalin Marinas arch/arm64/kernel/perf_event.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) commit 8df728e1ae614f592961e51f65d3e3212ede5a75 Author: Robin Murphy Date: Fri May 12 13:48:41 2017 +0100 arm64: Remove redundant mov from LL/SC cmpxchg The cmpxchg implementation introduced by commit c342f78217e8 ("arm64: cmpxchg: patch in lse instructions when supported by the CPU") performs an apparently redundant register move of [old] to [oldval] in the success case - it always uses the same register width as [oldval] was originally loaded with, and is only executed when [old] and [oldval] are known to be equal anyway. The only effect it seemingly does have is to take up a surprising amount of space in the kernel text, as removing it reveals: text data bss dec hex filename 12426658 1348614 4499749 18275021 116dacd vmlinux.o.new 12429238 1348614 4499749 18277601 116e4e1 vmlinux.o.old Reviewed-by: Will Deacon Signed-off-by: Robin Murphy Signed-off-by: Catalin Marinas arch/arm64/include/asm/atomic_ll_sc.h | 1 - 1 file changed, 1 deletion(-) commit 9fce894d03a98ec8e8e8106a964644633d2772ee Author: Peter Rosin Date: Mon May 15 09:03:50 2017 +0200 i2c: mux: only print failure message on error As is, a failure message is printed unconditionally, which is confusing. And noisy. Fixes: 8d4d159f25a7 ("i2c: mux: provide more info on failure in i2c_mux_add_adapter") Signed-off-by: Peter Rosin drivers/i2c/i2c-mux.c | 26 ++++++++++++++++---------- 1 file changed, 16 insertions(+), 10 deletions(-) commit a36d4637e4a06be067b8e327a0b1118bb2a73cb8 Author: Peter Rosin Date: Mon May 15 18:48:55 2017 +0200 i2c: mux: reg: rename label to indicate what it does That maintains sanity if it is ever called from some other spot, and also makes the label names coherent. Signed-off-by: Peter Rosin drivers/i2c/muxes/i2c-mux-reg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 68118e0e73aa3a6291c8b9eb1ee708e05f110cea Author: Peter Rosin Date: Sun May 7 07:16:30 2017 +0200 i2c: mux: reg: put away the parent i2c adapter on probe failure It is only prudent to let go of resources that are not used. Fixes: b3fdd32799d8 ("i2c: mux: Add register-based mux i2c-mux-reg") Signed-off-by: Peter Rosin drivers/i2c/muxes/i2c-mux-reg.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) commit 0780516a18f87e881e42ed815f189279b0a1743c Author: Paolo Bonzini Date: Thu May 11 13:23:29 2017 +0200 KVM: nVMX: fix EPT permissions as reported in exit qualification This fixes the new ept_access_test_read_only and ept_access_test_read_write testcases from vmx.flat. The problem is that gpte_access moves bits around to switch from EPT bit order (XWR) to ACC_*_MASK bit order (RWX). This results in an incorrect exit qualification. To fix this, make pt_access and pte_access operate on raw PTE values (only with NX flipped to mean "can execute") and call gpte_access at the end of the walk. This lets us use pte_access to compute the exit qualification with XWR bit order. Signed-off-by: Paolo Bonzini Reviewed-by: Xiao Guangrong Signed-off-by: Radim Krčmář arch/x86/kvm/paging_tmpl.h | 35 +++++++++++++++++++++-------------- 1 file changed, 21 insertions(+), 14 deletions(-) commit fce6ac4c0508b985d497e3d9c8eff28ec8a43182 Author: Wanpeng Li Date: Thu May 11 02:58:56 2017 -0700 KVM: VMX: Don't enable EPT A/D feature if EPT feature is disabled We can observe eptad kvm_intel module parameter is still Y even if ept is disabled which is weird. This patch will not enable EPT A/D feature if EPT feature is disabled. Cc: Paolo Bonzini Cc: Radim Krčmář Signed-off-by: Wanpeng Li Signed-off-by: Radim Krčmář arch/x86/kvm/vmx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a575813bfe4bc15aba511a5e91e61d242bff8b9d Author: Wanpeng Li Date: Thu May 11 02:58:55 2017 -0700 KVM: x86: Fix load damaged SSEx MXCSR register Reported by syzkaller: BUG: unable to handle kernel paging request at ffffffffc07f6a2e IP: report_bug+0x94/0x120 PGD 348e12067 P4D 348e12067 PUD 348e14067 PMD 3cbd84067 PTE 80000003f7e87161 Oops: 0003 [#1] SMP CPU: 2 PID: 7091 Comm: kvm_load_guest_ Tainted: G OE 4.11.0+ #8 task: ffff92fdfb525400 task.stack: ffffbda6c3d04000 RIP: 0010:report_bug+0x94/0x120 RSP: 0018:ffffbda6c3d07b20 EFLAGS: 00010202 do_trap+0x156/0x170 do_error_trap+0xa3/0x170 ? kvm_load_guest_fpu.part.175+0x12a/0x170 [kvm] ? mark_held_locks+0x79/0xa0 ? retint_kernel+0x10/0x10 ? trace_hardirqs_off_thunk+0x1a/0x1c do_invalid_op+0x20/0x30 invalid_op+0x1e/0x30 RIP: 0010:kvm_load_guest_fpu.part.175+0x12a/0x170 [kvm] ? kvm_load_guest_fpu.part.175+0x1c/0x170 [kvm] kvm_arch_vcpu_ioctl_run+0xed6/0x1b70 [kvm] kvm_vcpu_ioctl+0x384/0x780 [kvm] ? kvm_vcpu_ioctl+0x384/0x780 [kvm] ? sched_clock+0x13/0x20 ? __do_page_fault+0x2a0/0x550 do_vfs_ioctl+0xa4/0x700 ? up_read+0x1f/0x40 ? __do_page_fault+0x2a0/0x550 SyS_ioctl+0x79/0x90 entry_SYSCALL_64_fastpath+0x23/0xc2 SDM mentioned that "The MXCSR has several reserved bits, and attempting to write a 1 to any of these bits will cause a general-protection exception(#GP) to be generated". The syzkaller forks' testcase overrides xsave area w/ random values and steps on the reserved bits of MXCSR register. The damaged MXCSR register values of guest will be restored to SSEx MXCSR register before vmentry. This patch fixes it by catching userspace override MXCSR register reserved bits w/ random values and bails out immediately. Reported-by: Andrey Konovalov Reviewed-by: Paolo Bonzini Cc: Paolo Bonzini Cc: Radim Krčmář Cc: stable@vger.kernel.org Signed-off-by: Wanpeng Li Signed-off-by: Radim Krčmář arch/x86/kernel/fpu/init.c | 1 + arch/x86/kvm/x86.c | 9 +++++++-- 2 files changed, 8 insertions(+), 2 deletions(-) commit 4769886baf39b6a307eb8f9e39848823ca6c5939 Author: Dan Carpenter Date: Wed May 10 22:43:17 2017 +0300 kvm: nVMX: off by one in vmx_write_pml_buffer() There are PML_ENTITY_NUM elements in the pml_address[] array so the > should be >= or we write beyond the end of the array when we do: pml_address[vmcs12->guest_pml_index--] = gpa; Fixes: c5f983f6e845 ("nVMX: Implement emulated Page Modification Logging") Signed-off-by: Dan Carpenter Signed-off-by: Radim Krčmář arch/x86/kvm/vmx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 66c25f6e31766a9ec19c2bdc7f5f69f9c59bafd7 Author: Niklas Cassel Date: Mon May 15 10:56:06 2017 +0200 net: stmmac: use correct pointer when printing normal descriptor ring There are two pointers in sysfs_display_ring, one that increments if using normal dma descriptors, another if using extended dma descriptors. When printing the normal dma descriptors, the wrong pointer is used, thus the printed descriptor addresses are incorrect. Signed-off-by: Niklas Cassel Signed-off-by: David S. Miller drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 65acb891aaeb9294ebd06beb6138278b2331fec0 Merge: 2ea659a 76d837a Author: Radim Krčmář Date: Mon May 15 14:38:56 2017 +0200 Merge branch 'kvm-ppc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc - fix build failures with PR KVM configurations - fix a host crash that can occur on POWER9 with radix guests commit 9b619a8f08da9f61f166edbbe30ad05c359ec19e Author: Zhichao Huang Date: Thu May 11 13:46:12 2017 +0100 KVM: arm: rename pm_fake handler to trap_raz_wi pm_fake doesn't quite describe what the handler does (ignoring writes and returning 0 for reads). As we're about to use it (a lot) in a different context, rename it with a (admitedly cryptic) name that make sense for all users. Signed-off-by: Zhichao Huang Reviewed-by: Alex Bennee Acked-by: Christoffer Dall Acked-by: Marc Zyngier Signed-off-by: Alex Bennée Signed-off-by: Christoffer Dall arch/arm/kvm/coproc.c | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-) commit 661e6b02b5aa82db31897f36e96324b77450fd7a Author: Zhichao Huang Date: Thu May 11 13:46:11 2017 +0100 KVM: arm: plug potential guest hardware debug leakage Hardware debugging in guests is not intercepted currently, it means that a malicious guest can bring down the entire machine by writing to the debug registers. This patch enable trapping of all debug registers, preventing the guests to access the debug registers. This includes access to the debug mode(DBGDSCR) in the guest world all the time which could otherwise mess with the host state. Reads return 0 and writes are ignored (RAZ_WI). The result is the guest cannot detect any working hardware based debug support. As debug exceptions are still routed to the guest normal debug using software based breakpoints still works. To support debugging using hardware registers we need to implement a debug register aware world switch as well as special trapping for registers that may affect the host state. Cc: stable@vger.kernel.org Signed-off-by: Zhichao Huang Signed-off-by: Alex Bennée Reviewed-by: Christoffer Dall Signed-off-by: Christoffer Dall arch/arm/include/asm/kvm_coproc.h | 3 +- arch/arm/kvm/coproc.c | 77 ++++++++++++++++++++++++++++++--------- arch/arm/kvm/handle_exit.c | 4 +- arch/arm/kvm/hyp/switch.c | 4 +- 4 files changed, 66 insertions(+), 22 deletions(-) commit 2f720aac936dc7a301b757d3b197d86c333d59b8 Author: Matthew Auld Date: Fri May 12 10:14:23 2017 +0100 drm/i915: don't do allocate_va_range again on PIN_UPDATE If a vma is already bound to a ppgtt, we incorrectly call allocate_va_range again when doing a PIN_UPDATE, which will result in over accounting within our paging structures, such that when we do unbind something we don't actually destroy the structures and end up inadvertently recycling them. In reality this probably isn't too bad, but once we start touching PDEs and PDPEs for 64K/2M/1G pages this apparent recycling will manifest into lots of really, really subtle bugs. v2: Fix the testing of vma->flags for aliasing_ppgtt_bind_vma Fixes: ff685975d97f ("drm/i915: Move allocate_va_range to GTT") Signed-off-by: Matthew Auld Cc: Chris Wilson Cc: Joonas Lahtinen Reviewed-by: Chris Wilson Link: http://patchwork.freedesktop.org/patch/msgid/20170512091423.26085-1-chris@chris-wilson.co.uk (cherry picked from commit 1f23475c893a85c934143cd64865ebb9b6af383f) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_gem_gtt.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) commit 82f2b4aca8fd90476fc3fd1786d107163ab17201 Author: Ville Syrjälä Date: Thu May 4 21:15:30 2017 +0300 drm/i915: Fix rawclk readout for g4x Turns out our skills in decoding the CLKCFG register weren't good enough. On this particular elk the answer we got was 400 MHz when in reality the clock was running at 266 MHz, which then caused us to program a bogus AUX clock divider that caused all AUX communication to fail. Sadly the docs are now in bit heaven, so the fix will have to be based on empirical evidence. Using another elk machine I was able to frob the FSB frequency from the BIOS and see how it affects the CLKCFG register. The machine seesm to use a frequency of 266 MHz by default, and fortunately it still boot even with the 50% CPU overclock that we get when we bump the FSB up to 400 MHz. It turns out the actual FSB frequency and the register have no real link whatsoever. The register value is based on some straps or something, but fortunately those too can be configured from the BIOS on this board, although it doesn't seem to respect the settings 100%. In the end I was able to derive the following relationship: BIOS FSB / strap | CLKCFG ------------------------- 200 | 0x2 266 | 0x0 333 | 0x4 400 | 0x4 So only the 200 and 400 MHz cases actually match how we're currently decoding that register. But as the comment next to some of the defines says, we have been just guessing anyway. So let's fix things up so that at least the 266 MHz case will work correctly as that is actually the setting used by both the buggy machine and my test machine. The fact that 333 and 400 MHz BIOS settings result in the same register value is a little disappointing, as that means we can't tell them apart. However, according to the gmch datasheet for both elk and ctg 400 Mhz is not even a supported FSB frequency, so I'm going to make the assumption that we should decode it as 333 MHz instead. Cc: stable@vger.kernel.org Cc: Tomi Sarvela Reported-by: Tomi Sarvela Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=100926 Signed-off-by: Ville Syrjälä Link: http://patchwork.freedesktop.org/patch/msgid/20170504181530.6908-1-ville.syrjala@linux.intel.com Acked-by: Jani Nikula Tested-by: Tomi Sarvela (cherry picked from commit 6f38123ecaac446312a63523b68df84ceb5a06ed) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_reg.h | 10 +++++++--- drivers/gpu/drm/i915/intel_cdclk.c | 6 ++---- 2 files changed, 9 insertions(+), 7 deletions(-) commit 668e3b014afb66ab29e134bca7c258527273ac75 Author: Ville Syrjälä Date: Thu Apr 27 19:02:20 2017 +0300 drm/i915: Fix runtime PM for LPE audio Not calling pm_runtime_enable() means that runtime PM can't be enabled at all via sysfs. So we definitely need to call it from somewhere. Calling it from the driver seems like a bad idea because it would have to be paired with a pm_runtime_disable() at driver unload time, otherwise the core gets upset. Also if there's no LPE audio driver loaded then we couldn't runtime suspend i915 either. So it looks like a better plan is to call it from i915 when we register the platform device. That seems to match how pci generally does things. I cargo culted the pm_runtime_forbid() and pm_runtime_set_active() calls from pci as well. The exposed runtime PM API is massive an thorougly misleading, so I don't actually know if this is how you're supposed to use the API or not. But it seems to work. I can now runtime suspend i915 again with or without the LPE audio driver loaded, and reloading the LPE audio driver also seems to work. Note that powertop won't auto-tune runtime PM for platform devices, which is a little annoying. So I'm not sure that leaving runtime PM in "on" mode by default is the best choice here. But I've left it like that for now at least. Also remove the comment about there not being much benefit from LPE audio runtime PM. Not allowing runtime PM blocks i915 runtime PM, which will also block s0ix, and that could have a measurable impact on power consumption. Cc: stable@vger.kernel.org Cc: Takashi Iwai Cc: Pierre-Louis Bossart Fixes: 0b6b524f3915 ("ALSA: x86: Don't enable runtime PM as default") Signed-off-by: Ville Syrjälä Link: http://patchwork.freedesktop.org/patch/msgid/20170427160231.13337-2-ville.syrjala@linux.intel.com Reviewed-by: Takashi Iwai (cherry picked from commit 183c00350ccda86781f6695840e6c5f5b22efbd1) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_lpe_audio.c | 5 +++++ sound/x86/intel_hdmi_audio.c | 4 ---- 2 files changed, 5 insertions(+), 4 deletions(-) commit 9b5fed0daa2a9ea3355ef06bb9e87ce800e71df6 Author: Ander Conselvan de Oliveira Date: Fri Apr 28 11:02:22 2017 +0300 drm/i915/glk: Fix DSI "*ERROR* ULPS is still active" messages The sequence in glk_dsi_device_ready() enters ULPS then waits until it is *not* active to then disable it. The correct sequence according to the spec is to enter ULPS then wait until the GLK_ULPS_NOT_ACTIVE bit is zero, i.e., ULPS is active, and then disable ULPS. Fixing the condition gets rid of the following spurious error messages: [drm:glk_dsi_device_ready [i915]] *ERROR* ULPS is still active Fixes: 4644848369c0 ("drm/i915/glk: Add MIPIIO Enable/disable sequence") Cc: Deepak M Cc: Madhav Chauhan Cc: Jani Nikula Cc: Daniel Vetter Cc: Jani Nikula Cc: intel-gfx@lists.freedesktop.org Cc: Signed-off-by: Ander Conselvan de Oliveira Reviewed-by: Madhav Chauhan Link: http://patchwork.freedesktop.org/patch/msgid/20170428080222.6147-1-ander.conselvan.de.oliveira@intel.com (cherry picked from commit 3acbec03b3c51559d01c879e9564d9c9610fe8ce) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_dsi.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit 591054469b3eef34bc097c30fae8ededddf8d796 Author: Pablo Neira Ayuso Date: Mon May 15 11:17:34 2017 +0100 netfilter: nf_tables: revisit chain/object refcounting from elements Andreas reports that the following incremental update using our commit protocol doesn't work. # nft -f incremental-update.nft delete element ip filter client_to_any { 10.180.86.22 : goto CIn_1 } delete chain ip filter CIn_1 ... Error: Could not process rule: Device or resource busy The existing code is not well-integrated into the commit phase protocol, since element deletions do not result in refcount decrement from the preparation phase. This results in bogus EBUSY errors like the one above. Two new functions come with this patch: * nft_set_elem_activate() function is used from the abort path, to restore the set element refcounting on objects that occurred from the preparation phase. * nft_set_elem_deactivate() that is called from nft_del_setelem() to decrement set element refcounting on objects from the preparation phase in the commit protocol. The nft_data_uninit() has been renamed to nft_data_release() since this function does not uninitialize any data store in the data register, instead just releases the references to objects. Moreover, a new function nft_data_hold() has been introduced to be used from nft_set_elem_activate(). Reported-by: Andreas Schultz Signed-off-by: Pablo Neira Ayuso include/net/netfilter/nf_tables.h | 2 +- net/netfilter/nf_tables_api.c | 82 ++++++++++++++++++++++++++++++++++----- net/netfilter/nft_bitwise.c | 4 +- net/netfilter/nft_cmp.c | 2 +- net/netfilter/nft_immediate.c | 5 ++- net/netfilter/nft_range.c | 4 +- 6 files changed, 81 insertions(+), 18 deletions(-) commit 71df14b0ce094be46d105b5a3ededd83b8e779a0 Author: Pablo Neira Ayuso Date: Mon May 15 11:17:29 2017 +0100 netfilter: nf_tables: missing sanitization in data from userspace Do not assume userspace always sends us NFT_DATA_VALUE for bitwise and cmp expressions. Although NFT_DATA_VERDICT does not make any sense, it is still possible to handcraft a netlink message using this incorrect data type. Signed-off-by: Pablo Neira Ayuso net/netfilter/nft_bitwise.c | 19 ++++++++++++++----- net/netfilter/nft_cmp.c | 12 ++++++++++-- 2 files changed, 24 insertions(+), 7 deletions(-) commit fa803605eef39372e53d7813002d73a3fcf10c88 Author: Liping Zhang Date: Sun May 14 21:35:22 2017 +0800 netfilter: nf_tables: can't assume lock is acquired when dumping set elems When dumping the elements related to a specified set, we may invoke the nf_tables_dump_set with the NFNL_SUBSYS_NFTABLES lock not acquired. So we should use the proper rcu operation to avoid race condition, just like other nft dump operations. Signed-off-by: Liping Zhang Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_tables_api.c | 78 +++++++++++++++++++++++++++++++------------ net/netfilter/nft_set_hash.c | 2 +- 2 files changed, 57 insertions(+), 23 deletions(-) commit 87e94dbc210a720a34be5c1174faee5c84be963e Author: Eric Leblond Date: Thu May 11 18:56:38 2017 +0200 netfilter: synproxy: fix conntrackd interaction This patch fixes the creation of connection tracking entry from netlink when synproxy is used. It was missing the addition of the synproxy extension. This was causing kernel crashes when a conntrack entry created by conntrackd was used after the switch of traffic from active node to the passive node. Signed-off-by: Eric Leblond Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_conntrack_netlink.c | 4 ++++ 1 file changed, 4 insertions(+) commit 324318f0248c31be8a08984146e7e4dd7cdd091d Author: Willem de Bruijn Date: Tue May 9 16:17:37 2017 -0400 netfilter: xtables: zero padding in data_to_user When looking up an iptables rule, the iptables binary compares the aligned match and target data (XT_ALIGN). In some cases this can exceed the actual data size to include padding bytes. Before commit f77bc5b23fb1 ("iptables: use match, target and data copy_to_user helpers") the malloc()ed bytes were overwritten by the kernel with kzalloced contents, zeroing the padding and making the comparison succeed. After this patch, the kernel copies and clears only data, leaving the padding bytes undefined. Extend the clear operation from data size to aligned data size to include the padding bytes, if any. Padding bytes can be observed in both match and target, and the bug triggered, by issuing a rule with match icmp and target ACCEPT: iptables -t mangle -A INPUT -i lo -p icmp --icmp-type 1 -j ACCEPT iptables -t mangle -D INPUT -i lo -p icmp --icmp-type 1 -j ACCEPT Fixes: f77bc5b23fb1 ("iptables: use match, target and data copy_to_user helpers") Reported-by: Paul Moore Reported-by: Richard Guy Briggs Signed-off-by: Willem de Bruijn Signed-off-by: Pablo Neira Ayuso include/linux/netfilter/x_tables.h | 2 +- net/bridge/netfilter/ebtables.c | 9 ++++++--- net/netfilter/x_tables.c | 9 ++++++--- 3 files changed, 13 insertions(+), 7 deletions(-) commit ff1e4300cf69bebd7d61741475812ba13cc69e31 Merge: 9338d7b 3c5ab3f Author: Pablo Neira Ayuso Date: Mon May 15 12:50:12 2017 +0200 Merge tag 'ipvs-fixes-for-v4.12' of http://git.kernel.org/pub/scm/linux/kernel/git/horms/ipvs Simon Horman says: ==================== IPVS Fixes for v4.12 please consider this fix to IPVS for v4.12. * It is a fix from Julian Anastasov to only SNAT SNAT packet replies only for NATed connections My understanding is that this fix is appropriate for 4.9.25, 4.10.13, 4.11 as well as the nf tree. Julian has separately posted backports for other -stable kernels; please see: * [PATCH 3.2.88,3.4.113 -stable 1/3] ipvs: SNAT packet replies only for NATed connections * [PATCH 3.10.105,3.12.73,3.16.43,4.1.39 -stable 2/3] ipvs: SNAT packet replies only for NATed connections * [PATCH 4.4.65 -stable 3/3] ipvs: SNAT packet replies only for NATed connections ==================== Signed-off-by: Pablo Neira Ayuso commit 9338d7b4418e9996a7642867d8f6b482a6040ed6 Author: Liping Zhang Date: Sun May 7 22:01:56 2017 +0800 netfilter: nfnl_cthelper: reject del request if helper obj is in use We can still delete the ct helper even if it is in use, this will cause a use-after-free error. In more detail, I mean: # nfct helper add ssdp inet udp # iptables -t raw -A OUTPUT -p udp -j CT --helper ssdp # nfct helper delete ssdp //--> oops, succeed! BUG: unable to handle kernel paging request at 000026ca IP: 0x26ca [...] Call Trace: ? ipv4_helper+0x62/0x80 [nf_conntrack_ipv4] nf_hook_slow+0x21/0xb0 ip_output+0xe9/0x100 ? ip_fragment.constprop.54+0xc0/0xc0 ip_local_out+0x33/0x40 ip_send_skb+0x16/0x80 udp_send_skb+0x84/0x240 udp_sendmsg+0x35d/0xa50 So add reference count to fix this issue, if ct helper is used by others, reject the delete request. Apply this patch: # nfct helper delete ssdp nfct v1.4.3: netlink error: Device or resource busy Signed-off-by: Liping Zhang Signed-off-by: Pablo Neira Ayuso include/net/netfilter/nf_conntrack_helper.h | 2 ++ net/netfilter/nf_conntrack_helper.c | 6 ++++++ net/netfilter/nfnetlink_cthelper.c | 17 +++++++++++------ 3 files changed, 19 insertions(+), 6 deletions(-) commit d91fc59cd77c719f33eda65c194ad8f95a055190 Author: Liping Zhang Date: Sun May 7 22:01:55 2017 +0800 netfilter: introduce nf_conntrack_helper_put helper function And convert module_put invocation to nf_conntrack_helper_put, this is prepared for the followup patch, which will add a refcnt for cthelper, so we can reject the deleting request when cthelper is in use. Signed-off-by: Liping Zhang Signed-off-by: Pablo Neira Ayuso include/net/netfilter/nf_conntrack_helper.h | 2 ++ net/netfilter/nf_conntrack_helper.c | 6 ++++++ net/netfilter/nft_ct.c | 4 ++-- net/netfilter/xt_CT.c | 6 +++--- net/openvswitch/conntrack.c | 4 ++-- 5 files changed, 15 insertions(+), 7 deletions(-) commit d110a3942aca78d14929bc648aeb83ee0b245a61 Author: Liping Zhang Date: Sat May 6 20:28:02 2017 +0800 netfilter: don't setup nat info for confirmed ct We cannot setup nat info if the ct has been confirmed already, else, different cpu may race to handle the same ct. In extreme situation, we may hit the "BUG_ON(nf_nat_initialized(ct, maniptype))" in the nf_nat_setup_info. Also running the following commands will easily hit NF_CT_ASSERT in nf_conntrack_alter_reply: # nft flush ruleset # ping -c 2 -W 1 1.1.1.111 & # nft add table t # nft add chain t c {type nat hook postrouting priority 0 \;} # nft add rule t c snat to 4.5.6.7 WARNING: CPU: 1 PID: 10065 at net/netfilter/nf_conntrack_core.c:1472 nf_conntrack_alter_reply+0x9a/0x1a0 [nf_conntrack] [...] Call Trace: nf_nat_setup_info+0xad/0x840 [nf_nat] ? deactivate_slab+0x65d/0x6c0 nft_nat_eval+0xcd/0x100 [nft_nat] nft_do_chain+0xff/0x5d0 [nf_tables] ? mark_held_locks+0x6f/0xa0 ? __local_bh_enable_ip+0x70/0xa0 ? trace_hardirqs_on_caller+0x11f/0x190 ? ipt_do_table+0x310/0x610 ? trace_hardirqs_on+0xd/0x10 ? __local_bh_enable_ip+0x70/0xa0 ? ipt_do_table+0x32b/0x610 ? __lock_acquire+0x2ac/0x1580 ? ipt_do_table+0x32b/0x610 nft_nat_do_chain+0x65/0x80 [nft_chain_nat_ipv4] nf_nat_ipv4_fn+0x1ae/0x240 [nf_nat_ipv4] nf_nat_ipv4_out+0x4a/0xf0 [nf_nat_ipv4] nft_nat_ipv4_out+0x15/0x20 [nft_chain_nat_ipv4] nf_hook_slow+0x2c/0xf0 ip_output+0x154/0x270 So for the confirmed ct, just ignore it and return NF_ACCEPT. Fixes: 9a08ecfe74d7 ("netfilter: don't attach a nat extension by default") Signed-off-by: Liping Zhang Acked-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_nat_core.c | 4 ++++ 1 file changed, 4 insertions(+) commit ca6e8cdbe1865caf7b05483e1a242e72d9bc919f Author: Ian W MORRISON Date: Mon May 8 23:40:35 2017 +1000 staging: rtl8723bs: remove re-positioned call to kfree in os_dep/ioctl_cfg80211.c A re-positioned call to kfree() in drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c causes a segmentation error. This patch removed the kfree() call. Fixes 6557ddfec348 ("staging: rtl8723bs: Fix various errors in os_dep/ioctl_cfg80211.c") Signed-off-by: Ian W Morrison Reviewed-by: Hans de Goede Reviewed-by: Andy Shevchenko Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 1 - 1 file changed, 1 deletion(-) commit fb317002ab4419ae7e068bee6897f2d5745aa3b9 Author: Heiko Carstens Date: Tue May 9 12:50:53 2017 +0200 s390/virtio: change virtio_feature_desc:features type to __le32 The feature member of virtio_feature_desc contains little endian values, given that it contents will be converted with le32_to_cpu(). The "wrong" __u32 type leads to the sparse warnings below. In order to avoid them, use the correct __le32 type instead. drivers/s390/virtio/virtio_ccw.c:749:14: warning: cast to restricted __le32 drivers/s390/virtio/virtio_ccw.c:762:28: warning: cast to restricted __le32 Acked-by: Halil Pasic Acked-by: Cornelia Huck Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky drivers/s390/virtio/virtio_ccw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a2b7cbdd2559aff06cebc28a7150f81c307a90d3 Author: Matthias Kaehlcke Date: Wed Apr 19 11:39:20 2017 -0700 netfilter: ctnetlink: Make some parameters integer to avoid enum mismatch Not all parameters passed to ctnetlink_parse_tuple() and ctnetlink_exp_dump_tuple() match the enum type in the signatures of these functions. Since this is intended change the argument type of to be an unsigned integer value. Signed-off-by: Matthias Kaehlcke Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_conntrack_netlink.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit 6c0d706b563af732adb094c5bf807437e8963e84 Author: Suzuki K Poulose Date: Wed May 3 15:17:51 2017 +0100 kvm: arm/arm64: Fix race in resetting stage2 PGD In kvm_free_stage2_pgd() we check the stage2 PGD before holding the lock and proceed to take the lock if it is valid. And we unmap the page tables, followed by releasing the lock. We reset the PGD only after dropping this lock, which could cause a race condition where another thread waiting on or even holding the lock, could potentially see that the PGD is still valid and proceed to perform a stage2 operation and later encounter a NULL PGD. [223090.242280] Unable to handle kernel NULL pointer dereference at virtual address 00000040 [223090.262330] PC is at unmap_stage2_range+0x8c/0x428 [223090.262332] LR is at kvm_unmap_hva_handler+0x2c/0x3c [223090.262531] Call trace: [223090.262533] [] unmap_stage2_range+0x8c/0x428 [223090.262535] [] kvm_unmap_hva_handler+0x2c/0x3c [223090.262537] [] handle_hva_to_gpa+0xb0/0x104 [223090.262539] [] kvm_unmap_hva+0x5c/0xbc [223090.262543] [] kvm_mmu_notifier_invalidate_page+0x50/0x8c [223090.262547] [] __mmu_notifier_invalidate_page+0x5c/0x84 [223090.262551] [] try_to_unmap_one+0x1d0/0x4a0 [223090.262553] [] rmap_walk+0x1cc/0x2e0 [223090.262555] [] try_to_unmap+0x74/0xa4 [223090.262557] [] migrate_pages+0x31c/0x5ac [223090.262561] [] compact_zone+0x3fc/0x7ac [223090.262563] [] compact_zone_order+0x94/0xb0 [223090.262564] [] try_to_compact_pages+0x108/0x290 [223090.262569] [] __alloc_pages_direct_compact+0x70/0x1ac [223090.262571] [] __alloc_pages_nodemask+0x434/0x9f4 [223090.262572] [] alloc_pages_vma+0x230/0x254 [223090.262574] [] do_huge_pmd_anonymous_page+0x114/0x538 [223090.262576] [] handle_mm_fault+0xd40/0x17a4 [223090.262577] [] __get_user_pages+0x12c/0x36c [223090.262578] [] get_user_pages_unlocked+0xa4/0x1b8 [223090.262579] [] __gfn_to_pfn_memslot+0x280/0x31c [223090.262580] [] gfn_to_pfn_prot+0x4c/0x5c [223090.262582] [] kvm_handle_guest_abort+0x240/0x774 [223090.262584] [] handle_exit+0x11c/0x1ac [223090.262586] [] kvm_arch_vcpu_ioctl_run+0x31c/0x648 [223090.262587] [] kvm_vcpu_ioctl+0x378/0x768 [223090.262590] [] do_vfs_ioctl+0x324/0x5a4 [223090.262591] [] SyS_ioctl+0x90/0xa4 [223090.262595] [] el0_svc_naked+0x38/0x3c This patch moves the stage2 PGD manipulation under the lock. Reported-by: Alexander Graf Cc: Mark Rutland Cc: Marc Zyngier Cc: Paolo Bonzini Cc: Radim Krčmář Reviewed-by: Christoffer Dall Reviewed-by: Marc Zyngier Signed-off-by: Suzuki K Poulose Signed-off-by: Christoffer Dall virt/kvm/arm/mmu.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) commit 3d72e27a3af88b6f939aa87070c36304f713aa28 Merge: 2ea659a ae15790 Author: Jani Nikula Date: Mon May 15 13:03:30 2017 +0300 Merge tag 'gvt-fixes-2017-05-11' of https://github.com/01org/gvt-linux into drm-intel-fixes gvt-fixes-2017-05-11 - vGPU scheduler performance regression fix (Ping) - bypass in-context mmio restore (Chuanxiao) - one typo fix (Colin) Signed-off-by: Jani Nikula Link: http://patchwork.freedesktop.org/patch/msgid/20170511054736.swpcmnzdoqi75cnl@zhen-hp.sh.intel.com commit 6aeb75e6adfaed16e58780309613a578fe1ee90b Author: Johan Hovold Date: Thu May 11 11:41:21 2017 +0200 USB: serial: io_ti: fix div-by-zero in set_termios Fix a division-by-zero in set_termios when debugging is enabled and a high-enough speed has been requested so that the divisor value becomes zero. Instead of just fixing the offending debug statement, cap the baud rate at the base as a zero divisor value also appears to crash the firmware. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable # 2.6.12 Reviewed-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold drivers/usb/serial/io_ti.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 26cede343656c0bc2c33cdc783771282405c7fb2 Author: Johan Hovold Date: Thu May 11 11:41:20 2017 +0200 USB: serial: mct_u232: fix big-endian baud-rate handling Drop erroneous cpu_to_le32 when setting the baud rate, something which corrupted the divisor on big-endian hosts. Found using sparse: warning: incorrect type in argument 1 (different base types) expected unsigned int [unsigned] [usertype] val got restricted __le32 [usertype] Fixes: af2ac1a091bc ("USB: serial mct_usb232: move DMA buffers to heap") Cc: stable # 2.6.34 Reviewed-by: Greg Kroah-Hartman Acked-By: Pete Zaitcev Signed-off-by: Johan Hovold drivers/usb/serial/mct_u232.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ad0ccac76dcc92c3331f4c94c9fc54f8bf1ab20c Author: Johan Hovold Date: Thu May 11 11:41:19 2017 +0200 USB: serial: ir-usb: fix big-endian baud-rate debug printk Add missing endianness conversion when printing the supported baud rates. Found using sparse: warning: restricted __le16 degrades to integer Fixes: e0d795e4f36c ("usb: irda: cleanup on ir-usb module") Reviewed-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold drivers/usb/serial/ir-usb.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) commit 95d93e271d920dfda369d4740b1cc1061d41fe7f Author: Malcolm Priestley Date: Thu May 11 18:57:46 2017 +0100 staging: rtl8192e: GetTs Fix invalid TID 7 warning. TID 7 is a valid value for QoS IEEE 802.11e. The switch statement that follows states 7 is valid. Remove function IsACValid and use the default case to filter invalid TIDs. Signed-off-by: Malcolm Priestley Cc: Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8192e/rtl819x_TSProc.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) commit 90be652c9f157d44b9c2803f902a8839796c090d Author: Malcolm Priestley Date: Thu May 11 18:57:45 2017 +0100 staging: rtl8192e: rtl92e_get_eeprom_size Fix read size of EPROM_CMD. EPROM_CMD is 2 byte aligned on PCI map so calling with rtl92e_readl will return invalid data so use rtl92e_readw. The device is unable to select the right eeprom type. Signed-off-by: Malcolm Priestley Cc: Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 867510bde14e7b7fc6dd0f50b48f6753cfbd227a Author: Malcolm Priestley Date: Thu May 11 18:57:44 2017 +0100 staging: rtl8192e: fix 2 byte alignment of register BSSIDR. BSSIDR has two byte alignment on PCI ioremap correct the write by swapping to 16 bits first. This fixes a problem that the device associates fail because the filter is not set correctly. Signed-off-by: Malcolm Priestley Cc: Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit baabd567f87be05330faa5140f72a91960e7405a Author: Malcolm Priestley Date: Thu May 11 18:57:43 2017 +0100 staging: rtl8192e: rtl92e_fill_tx_desc fix write to mapped out memory. The driver attempts to alter memory that is mapped to PCI device. This is because tx_fwinfo_8190pci points to skb->data Move the pci_map_single to when completed buffer is ready to be mapped with psdec is empty to drop on mapping error. Signed-off-by: Malcolm Priestley Cc: Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) commit ff92b9e3c9f85fa442c430d70bf075499e1193b7 Author: Phil Elwell Date: Thu May 4 10:58:20 2017 +0100 staging: vc04_services: Fix bulk cache maintenance vchiq_arm supports transfers less than one page and at arbitrary alignment, using the dma-mapping API to perform its cache maintenance (even though the VPU drives the DMA hardware). Read (DMA_FROM_DEVICE) operations use cache invalidation for speed, falling back to clean+invalidate on partial cache lines, with writes (DMA_TO_DEVICE) using flushes. If a read transfer has ends which aren't page-aligned, performing cache maintenance as if they were whole pages can lead to memory corruption since the partial cache lines at the ends (and any cache lines before or after the transfer area) will be invalidated. This bug was masked until the disabling of the cache flush in flush_dcache_page(). Honouring the requested transfer start- and end-points prevents the corruption. Fixes: cf9caf192988 ("staging: vc04_services: Replace dmac_map_area with dmac_map_sg") Signed-off-by: Phil Elwell Cc: stable # 4.10 Reported-by: Stefan Wahren Tested-by: Stefan Wahren Signed-off-by: Greg Kroah-Hartman .../interface/vchiq_arm/vchiq_2835_arm.c | 31 +++++++++++++--------- 1 file changed, 19 insertions(+), 12 deletions(-) commit c21376631d6325590e53ac8720312d2b02494103 Author: Ian Chard Date: Wed May 10 10:20:59 2017 +0100 staging: ccree: remove extraneous spin_unlock_bh() in error handler An early error handler in send_request() tries to release a spinlock, but the lock isn't acquired until the loop below it is entered. Signed-off-by: Ian Chard Acked-by: Gilad Ben-Yossef Signed-off-by: Greg Kroah-Hartman drivers/staging/ccree/ssi_request_mgr.c | 1 - 1 file changed, 1 deletion(-) commit 41b80bb1db5c4c547cf187d1bc0c6c6feb7c14af Author: Arnd Bergmann Date: Wed Apr 19 19:48:07 2017 +0200 memory: atmel-ebi: mark PM ops as __maybe_unused We get a harmless warning without CONFIG_PM: drivers/memory/atmel-ebi.c:584:12: error: 'atmel_ebi_resume' defined but not used [-Werror=unused-function] Marking the function as __maybe_unused does the right thing here and drops it silently when unused. Fixes: a483fb10e5ea ("memory: atmel-ebi: Add PM ops") Signed-off-by: Arnd Bergmann Signed-off-by: Alexandre Belloni drivers/memory/atmel-ebi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f03d95f59026d14219230795ac4dcda8c09b5321 Author: Guru Das Srinagesh Date: Wed May 10 22:51:35 2017 -0700 staging: typec: Fix sparse warnings about incorrect types Fix the following sparse warnings about incorrect type usage: fusb302.c:1028:32: warning: incorrect type in argument 1 (different base types) fusb302.c:1028:32: expected unsigned short [unsigned] [usertype] header fusb302.c:1028:32: got restricted __le16 const [usertype] header fusb302.c:1484:32: warning: incorrect type in argument 1 (different base types) fusb302.c:1484:32: expected unsigned short [unsigned] [usertype] header fusb302.c:1484:32: got restricted __le16 [usertype] header Signed-off-by: Guru Das Srinagesh Reviewed-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman drivers/staging/typec/fusb302/fusb302.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 2c8e3f44f708a89a2c73a25a134af8c23998a2bc Author: Rui Miguel Silva Date: Fri May 12 21:16:13 2017 +0100 staging: typec: fusb302: do not free gpio from managed resource When allocating a gpio using the managed resource devm_, we can avoid freeing it manually. But even if we did it we should use devm_gpio_free. So, just remove the free of the gpio in the error path. Signed-off-by: Rui Miguel Silva Acked-by: Yueyao Zhu Reviewed-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman drivers/staging/typec/fusb302/fusb302.c | 2 -- 1 file changed, 2 deletions(-) commit 15d2bffdde6268883647c6112970f74d3e1af651 Author: Marc Zyngier Date: Tue May 2 14:30:41 2017 +0100 KVM: arm/arm64: vgic-v3: Use PREbits to infer the number of ICH_APxRn_EL2 registers The GICv3 documentation is extremely confusing, as it talks about the number of priorities represented by the ICH_APxRn_EL2 registers, while it should really talk about the number of preemption levels. This leads to a bug where we may access undefined ICH_APxRn_EL2 registers, since PREbits is allowed to be smaller than PRIbits. Thankfully, nobody seem to have taken this path so far... The fix is to use ICH_VTR_EL2.PREbits instead. Signed-off-by: Marc Zyngier Reviewed-by: Christoffer Dall Signed-off-by: Christoffer Dall virt/kvm/arm/hyp/vgic-v3-sr.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) commit 3d6e77ad1489650afa20da92bb589c8778baa8da Author: Marc Zyngier Date: Tue May 2 14:30:40 2017 +0100 KVM: arm/arm64: vgic-v3: Do not use Active+Pending state for a HW interrupt When an interrupt is injected with the HW bit set (indicating that deactivation should be propagated to the physical distributor), special care must be taken so that we never mark the corresponding LR with the Active+Pending state (as the pending state is kept in the physycal distributor). Cc: stable@vger.kernel.org Fixes: 59529f69f504 ("KVM: arm/arm64: vgic-new: Add GICv3 world switch backend") Signed-off-by: Marc Zyngier Reviewed-by: Christoffer Dall Signed-off-by: Christoffer Dall virt/kvm/arm/vgic/vgic-v3.c | 7 +++++++ 1 file changed, 7 insertions(+) commit ddf42d068f8802de122bb7efdfcb3179336053f1 Author: Marc Zyngier Date: Tue May 2 14:30:39 2017 +0100 KVM: arm/arm64: vgic-v2: Do not use Active+Pending state for a HW interrupt When an interrupt is injected with the HW bit set (indicating that deactivation should be propagated to the physical distributor), special care must be taken so that we never mark the corresponding LR with the Active+Pending state (as the pending state is kept in the physycal distributor). Cc: stable@vger.kernel.org Fixes: 140b086dd197 ("KVM: arm/arm64: vgic-new: Add GICv2 world switch backend") Signed-off-by: Marc Zyngier Reviewed-by: Christoffer Dall Signed-off-by: Christoffer Dall virt/kvm/arm/vgic/vgic-v2.c | 7 +++++++ 1 file changed, 7 insertions(+) commit f48e91e87e67b56bef63393d1a02c6e22c1d7078 Author: Michael Neuling Date: Mon May 8 17:16:26 2017 +1000 powerpc/tm: Fix FP and VMX register corruption In commit dc3106690b20 ("powerpc: tm: Always use fp_state and vr_state to store live registers"), a section of code was removed that copied the current state to checkpointed state. That code should not have been removed. When an FP (Floating Point) unavailable is taken inside a transaction, we need to abort the transaction. This is because at the time of the tbegin, the FP state is bogus so the state stored in the checkpointed registers is incorrect. To fix this, we treclaim (to get the checkpointed GPRs) and then copy the thread_struct FP live state into the checkpointed state. We then trecheckpoint so that the FP state is correctly restored into the CPU. The copying of the FP registers from live to checkpointed is what was missing. This simplifies the logic slightly from the original patch. tm_reclaim_thread() will now always write the checkpointed FP state. Either the checkpointed FP state will be written as part of the actual treclaim (in tm.S), or it'll be a copy of the live state. Which one we use is based on MSR[FP] from userspace. Similarly for VMX. Fixes: dc3106690b20 ("powerpc: tm: Always use fp_state and vr_state to store live registers") Cc: stable@vger.kernel.org # 4.9+ Signed-off-by: Michael Neuling Reviewed-by: cyrilbur@gmail.com Signed-off-by: Michael Ellerman arch/powerpc/kernel/process.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) commit 501ad27c67ed0b90df465f23d33e9aed64058a47 Author: Marc Zyngier Date: Tue May 2 14:30:38 2017 +0100 arm: KVM: Do not use stack-protector to compile HYP code We like living dangerously. Nothing explicitely forbids stack-protector to be used in the HYP code, while distributions routinely compile their kernel with it. We're just lucky that no code actually triggers the instrumentation. Let's not try our luck for much longer, and disable stack-protector for code living at HYP. Cc: stable@vger.kernel.org Signed-off-by: Marc Zyngier Acked-by: Christoffer Dall Signed-off-by: Christoffer Dall arch/arm/kvm/hyp/Makefile | 2 ++ 1 file changed, 2 insertions(+) commit 43e24e82f35291d4c1ca78877ce1b20d3aeb78f1 Author: Michael Ellerman Date: Wed May 10 16:57:49 2017 +1000 powerpc/modules: If mprofile-kernel is enabled add it to vermagic On powerpc we can build the kernel with two different ABIs for mcount(), which is used by ftrace. Kernels built with one ABI do not know how to load modules built with the other ABI. The new style ABI is called "mprofile-kernel", for want of a better name. Currently if we build a module using the old style ABI, and the kernel with mprofile-kernel, when we load the module we'll oops something like: # insmod autofs4-no-mprofile-kernel.ko ftrace-powerpc: Unexpected instruction f8810028 around bl _mcount ------------[ cut here ]------------ WARNING: CPU: 6 PID: 3759 at ../kernel/trace/ftrace.c:2024 ftrace_bug+0x2b8/0x3c0 CPU: 6 PID: 3759 Comm: insmod Not tainted 4.11.0-rc3-gcc-5.4.1-00017-g5a61ef74f269 #11 ... NIP [c0000000001eaa48] ftrace_bug+0x2b8/0x3c0 LR [c0000000001eaff8] ftrace_process_locs+0x4a8/0x590 Call Trace: alloc_pages_current+0xc4/0x1d0 (unreliable) ftrace_process_locs+0x4a8/0x590 load_module+0x1c8c/0x28f0 SyS_finit_module+0x110/0x140 system_call+0x38/0xfc ... ftrace failed to modify [] 0xd000000002a31024 actual: 35:65:00:48 We can avoid this by including in the vermagic whether the kernel/module was built with mprofile-kernel. Which results in: # insmod autofs4-pg.ko autofs4: version magic '4.11.0-rc3-gcc-5.4.1-00017-g5a61ef74f269 SMP mod_unload modversions ' should be '4.11.0-rc3-gcc-5.4.1-00017-g5a61ef74f269-dirty SMP mod_unload modversions mprofile-kernel' insmod: ERROR: could not insert module autofs4-pg.ko: Invalid module format Fixes: 8c50b72a3b4f ("powerpc/ftrace: Add Kconfig & Make glue for mprofile-kernel") Signed-off-by: Michael Ellerman Acked-by: Balbir Singh Acked-by: Jessica Yu Signed-off-by: Michael Ellerman arch/powerpc/include/asm/module.h | 4 ++++ 1 file changed, 4 insertions(+) commit cde13b5dad60471886a3bccb4f4134c647c4a9dc Author: Marc Zyngier Date: Tue May 2 14:30:37 2017 +0100 arm64: KVM: Do not use stack-protector to compile EL2 code We like living dangerously. Nothing explicitely forbids stack-protector to be used in the EL2 code, while distributions routinely compile their kernel with it. We're just lucky that no code actually triggers the instrumentation. Let's not try our luck for much longer, and disable stack-protector for code living at EL2. Cc: stable@vger.kernel.org Signed-off-by: Marc Zyngier Acked-by: Christoffer Dall Signed-off-by: Christoffer Dall arch/arm64/kvm/hyp/Makefile | 2 ++ 1 file changed, 2 insertions(+) commit 050161ea3268ad72d276bc2c327e9654048a82b2 Author: Guenter Roeck Date: Tue May 9 09:04:59 2017 -0700 staging: typec: tcpm: Fix Port Power Role field in PS_RDY messages PS_RDY messages sent during power swap sequences are expected to reflect the new power role. Signed-off-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman drivers/staging/typec/tcpm.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) commit 193a68011fdc002cc03d6e6edabf941251df5690 Author: Guenter Roeck Date: Tue May 9 09:04:58 2017 -0700 staging: typec: tcpm: Respond to Discover Identity commands If the lower level driver provided a list of VDOs in its configuration data, send it to the partner as response to a Discover Identity command if in device mode (UFP). Cc: Yueyao Zhu Originally-from: Puma Hsu Signed-off-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman drivers/staging/typec/pd_vdo.h | 4 +++- drivers/staging/typec/tcpm.c | 27 +++++++++++++++++++++++++++ drivers/staging/typec/tcpm.h | 3 +++ 3 files changed, 33 insertions(+), 1 deletion(-) commit 931693f973507b320ecbdccd0ac3e786ddaf795f Author: Guenter Roeck Date: Tue May 9 09:04:57 2017 -0700 staging: typec: tcpm: Set correct flags in PD request messages We do support USB PD communication, and devices supported by this driver typically use USB power for purposes other than USB communication. Originally-from: Puma Hsu Cc: Yueyao Zhu Signed-off-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman drivers/staging/typec/tcpm.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 5fec4b54d0bf6c3eeb176b624ce50d6aef4819c0 Author: Guenter Roeck Date: Tue May 9 09:04:56 2017 -0700 staging: typec: tcpm: Drop duplicate PD messages Per USB PD standard, we have to drop duplicate PD messages. We can not expect lower protocol layers to drop such messages, since lower layers don't know if a message was dropped somewhere else in the stack. Originally-from: Puma Hsu Cc: Yueyao Zhu Signed-off-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman drivers/staging/typec/pd.h | 10 ++++++++++ drivers/staging/typec/tcpm.c | 29 +++++++++++++++++++++++++++++ 2 files changed, 39 insertions(+) commit aac53ee4557947d778cb6a255c719e5c70963c42 Author: Yueyao Zhu Date: Tue May 9 09:04:55 2017 -0700 staging: typec: fusb302: Fix chip->vbus_present init value FUSB_REG_STATUS0 & FUSB_REG_STATUS0_VBUSOK = 0x40 & 0x80 is always zero. Fix the code to what it is intended to be: check the VBUSOK bit of the value read from address FUSB_REG_STATUS0. Reported-by: Dan Carpenter Cc: Guenter Roeck Signed-off-by: Yueyao Zhu Signed-off-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman drivers/staging/typec/fusb302/fusb302.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 227383f8c28ea9e53d958801790d0e2e8f985d08 Author: Javier Martinez Canillas Date: Tue May 9 09:04:54 2017 -0700 staging: typec: fusb302: Fix module autoload If the driver is built as a module, autoload won't work because the module alias information is not filled. So user-space can't match the registered device with the corresponding module. Export the OF and I2C device ID table entries as module aliases, using the MODULE_DEVICE_TABLE() macro. Before this patch: $ modinfo drivers/staging/typec/fusb302/fusb302.ko | grep alias $ After this patch: $ modinfo drivers/staging/typec/fusb302/fusb302.ko | grep alias alias: of:N*T*Cfcs,fusb302C* alias: of:N*T*Cfcs,fusb302 alias: i2c:typec_fusb302 Signed-off-by: Javier Martinez Canillas Signed-off-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman drivers/staging/typec/fusb302/fusb302.c | 2 ++ 1 file changed, 2 insertions(+) commit c6a9d3eaee508f53ec4f777035522565ed567692 Author: Olivier Leveque Date: Tue May 9 09:04:53 2017 -0700 staging: typec: tcpci: declare private structure as static This fixes a sparse warning regarding an undeclared symbol. Since the structure tcpci_tcpc_config is private to tcpci.c, it should be declared as static. Signed-off-by: Olivier Leveque Signed-off-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman drivers/staging/typec/tcpci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 84817ef091f378b3f9fc86b02efb48b3fc1a3428 Author: Gilad Ben-Yossef Date: Sun May 7 16:18:27 2017 +0300 staging: MAINTAINERS: add GBY as ccree maintainer I work for Arm on maintaining the TrustZone CryptoCell driver. Signed-off-by: Gilad Ben-Yossef Signed-off-by: Greg Kroah-Hartman MAINTAINERS | 8 ++++++++ 1 file changed, 8 insertions(+) commit 849ff8190eb9add34c376219b5ae319de83eeb32 Author: Yisheng Xie Date: Sat May 6 17:49:08 2017 +0800 staging/android/ion: remove useless document file After commit 9828282e33a0 ("staging: android: ion: Remove old platform support"), the document about devicetree of ion is no need anymore, so just remove it. Signed-off-by: Yisheng Xie Acked-by: Laura Abbott Signed-off-by: Greg Kroah-Hartman .../devicetree/bindings/staging/ion/hi6220-ion.txt | 31 ------------- MAINTAINERS | 1 - drivers/staging/android/ion/devicetree.txt | 51 ---------------------- 3 files changed, 83 deletions(-) commit f83914fdfcc3ecb62a5a83eeb609ff59a9c2052d Author: Johan Hovold Date: Fri May 12 14:34:37 2017 +0200 ALSA: usb-audio: fix Amanero Combo384 quirk on big-endian hosts Add missing endianness conversion when using the USB device-descriptor bcdDevice field when applying the Amanero Combo384 (endianness!) quirk. Fixes: 3eff682d765b ("ALSA: usb-audio: Support both DSD LE/BE Amanero firmware versions") Cc: Jussi Laako Signed-off-by: Johan Hovold Signed-off-by: Takashi Iwai sound/usb/quirks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 72d42504bd7faa6de1c1644b5e46652933e040a6 Author: Arnd Bergmann Date: Thu May 11 13:34:29 2017 +0200 ovl: select EXPORTFS We get a link error when EXPORTFS is not enabled: ERROR: "exportfs_encode_fh" [fs/overlayfs/overlay.ko] undefined! ERROR: "exportfs_decode_fh" [fs/overlayfs/overlay.ko] undefined! This adds a Kconfig 'select' statement for overlayfs, the same way that it is done for the other users of exportfs. Fixes: 3a1e819b4e80 ("ovl: store file handle of lower inode on copy up") Signed-off-by: Arnd Bergmann Signed-off-by: Miklos Szeredi fs/overlayfs/Kconfig | 1 + 1 file changed, 1 insertion(+) commit bb246681b3ed0967489a7401ad528c1aaa1a4c2e Author: Anthony Mallet Date: Fri May 5 17:30:16 2017 +0200 USB: serial: ftdi_sio: fix setting latency for unprivileged users Commit 557aaa7ffab6 ("ft232: support the ASYNC_LOW_LATENCY flag") enables unprivileged users to set the FTDI latency timer, but there was a logic flaw that skipped sending the corresponding USB control message to the device. Specifically, the device latency timer would not be updated until next open, something which was later also inadvertently broken by commit c19db4c9e49a ("USB: ftdi_sio: set device latency timeout at port probe"). A recent commit c6dce2626606 ("USB: serial: ftdi_sio: fix extreme low-latency setting") disabled the low-latency mode by default so we now need this fix to allow unprivileged users to again enable it. Signed-off-by: Anthony Mallet [johan: amend commit message] Fixes: 557aaa7ffab6 ("ft232: support the ASYNC_LOW_LATENCY flag") Fixes: c19db4c9e49a ("USB: ftdi_sio: set device latency timeout at port probe"). Cc: stable # 2.6.31 Signed-off-by: Johan Hovold drivers/usb/serial/ftdi_sio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8663effb24f9430394d3bf1ed2dac42a771421d1 Author: Steven Rostedt (VMware) Date: Fri Apr 14 08:48:09 2017 -0400 sched/core: Call __schedule() from do_idle() without enabling preemption I finally got around to creating trampolines for dynamically allocated ftrace_ops with using synchronize_rcu_tasks(). For users of the ftrace function hook callbacks, like perf, that allocate the ftrace_ops descriptor via kmalloc() and friends, ftrace was not able to optimize the functions being traced to use a trampoline because they would also need to be allocated dynamically. The problem is that they cannot be freed when CONFIG_PREEMPT is set, as there's no way to tell if a task was preempted on the trampoline. That was before Paul McKenney implemented synchronize_rcu_tasks() that would make sure all tasks (except idle) have scheduled out or have entered user space. While testing this, I triggered this bug: BUG: unable to handle kernel paging request at ffffffffa0230077 ... RIP: 0010:0xffffffffa0230077 ... Call Trace: schedule+0x5/0xe0 schedule_preempt_disabled+0x18/0x30 do_idle+0x172/0x220 What happened was that the idle task was preempted on the trampoline. As synchronize_rcu_tasks() ignores the idle thread, there's nothing that lets ftrace know that the idle task was preempted on a trampoline. The idle task shouldn't need to ever enable preemption. The idle task is simply a loop that calls schedule or places the cpu into idle mode. In fact, having preemption enabled is inefficient, because it can happen when idle is just about to call schedule anyway, which would cause schedule to be called twice. Once for when the interrupt came in and was returning back to normal context, and then again in the normal path that the idle loop is running in, which would be pointless, as it had already scheduled. The only reason schedule_preempt_disable() enables preemption is to be able to call sched_submit_work(), which requires preemption enabled. As this is a nop when the task is in the RUNNING state, and idle is always in the running state, there's no reason that idle needs to enable preemption. But that means it cannot use schedule_preempt_disable() as other callers of that function require calling sched_submit_work(). Adding a new function local to kernel/sched/ that allows idle to call the scheduler without enabling preemption, fixes the synchronize_rcu_tasks() issue, as well as removes the pointless spurious schedule calls caused by interrupts happening in the brief window where preemption is enabled just before it calls schedule. Reviewed: Thomas Gleixner Signed-off-by: Steven Rostedt (VMware) Signed-off-by: Peter Zijlstra (Intel) Acked-by: Paul E. McKenney Cc: Andrew Morton Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/20170414084809.3dacde2a@gandalf.local.home Signed-off-by: Ingo Molnar kernel/sched/core.c | 25 +++++++++++++++++++++++++ kernel/sched/idle.c | 2 +- kernel/sched/sched.h | 2 ++ 3 files changed, 28 insertions(+), 1 deletion(-) commit 40dd46048c155b8f0683f468c950a1c107f77a7c Author: Daniele Palmas Date: Wed May 3 10:28:54 2017 +0200 usb: serial: option: add Telit ME910 support This patch adds support for Telit ME910 PID 0x1100. Signed-off-by: Daniele Palmas Cc: stable Signed-off-by: Johan Hovold drivers/usb/serial/option.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 01630ab8543f21df30b0dca19087b85744f61aee Author: Marc Zyngier Date: Fri May 12 11:04:52 2017 +0100 ARM: KVM: Fix tracepoint generation after move to virt/kvm/arm/ Moving most of the shared code to virt/kvm/arm had for consequence that KVM/ARM doesn't build anymore, because the code that used to define the tracepoints is now somewhere else. Fix this by defining CREATE_TRACE_POINTS in coproc.c, and clean-up trace.h as well. Fixes: 35d2d5d490e2 ("KVM: arm/arm64: Move shared files to virt/kvm/arm") Reported-by: Arnd Bergmann Signed-off-by: Marc Zyngier Signed-off-by: Christoffer Dall arch/arm/kvm/coproc.c | 1 + arch/arm/kvm/trace.h | 8 ++++---- 2 files changed, 5 insertions(+), 4 deletions(-) commit 2e63309507c818e8b631a03f02c363031c007fb7 Author: Joe Thornber Date: Thu May 11 09:09:04 2017 -0400 dm cache policy smq: don't do any writebacks unless IDLE If there are no clean blocks to be demoted the writeback will be triggered at that point. Preemptively writing back can hurt high IO load scenarios. Signed-off-by: Joe Thornber Signed-off-by: Mike Snitzer drivers/md/dm-cache-policy-smq.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) commit 49b7f768900f4084a65c3689d955b2fceac39e53 Author: Joe Thornber Date: Thu May 11 09:07:16 2017 -0400 dm cache: simplify the IDLE vs BUSY state calculation Drop the MODERATE state since it wasn't buying us much. Also, in check_migrations(), prepare for the next commit ("dm cache policy smq: don't do any writebacks unless IDLE") by deferring to the policy to make the final decision on whether writebacks can be serviced. Signed-off-by: Joe Thornber Signed-off-by: Mike Snitzer drivers/md/dm-cache-target.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) commit 701e03e4e180f0cd97d4139a32e2b2d879d12da2 Author: Joe Thornber Date: Thu May 11 08:22:31 2017 -0400 dm cache: track all IO to the cache rather than just the origin device's IO IO tracking used to throttle writebacks when the origin device is busy. Even if all the IO is going to the fast device, writebacks can significantly degrade performance. So track all IO to gauge whether the cache is busy or not. Otherwise, synthetic IO tests (e.g. fio) that might send all IO to the fast device wouldn't cause writebacks to get throttled. Signed-off-by: Joe Thornber Signed-off-by: Mike Snitzer drivers/md/dm-cache-target.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) commit 6cf4cc8f8b3b7bc9e3c04a7eab44b985d50029fc Author: Joe Thornber Date: Thu May 11 07:48:18 2017 -0400 dm cache policy smq: stop preemptively demoting blocks It causes a lot of churn if the working set's size is close to the fast device's size. Signed-off-by: Joe Thornber Signed-off-by: Mike Snitzer drivers/md/dm-cache-policy-smq.c | 17 +++++------------ 1 file changed, 5 insertions(+), 12 deletions(-) commit 4d44ec5ab751be63c5d348f13294304d87baa8c3 Author: Joe Thornber Date: Thu May 11 05:11:06 2017 -0400 dm cache policy smq: put newly promoted entries at the top of the multiqueue This stops entries bouncing in and out of the cache quickly. Signed-off-by: Joe Thornber Signed-off-by: Mike Snitzer drivers/md/dm-cache-policy-smq.c | 1 + 1 file changed, 1 insertion(+) commit 78c45607b909fb384c47c134d89b39285a6a8b45 Author: Joe Thornber Date: Thu May 11 05:09:38 2017 -0400 dm cache policy smq: be more aggressive about triggering a writeback If there are no clean entries to demote we really want to writeback immediately. Signed-off-by: Joe Thornber Signed-off-by: Mike Snitzer drivers/md/dm-cache-policy-smq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a8cd1eba6135e086109e2b94bf96deb17456ede8 Author: Joe Thornber Date: Thu May 11 05:07:34 2017 -0400 dm cache policy smq: only demote entries in bottom half of the clean multiqueue Heavy IO load may mean there are very few clean blocks in the cache, and we risk demoting entries that get hit a lot. Signed-off-by: Joe Thornber Signed-off-by: Mike Snitzer drivers/md/dm-cache-policy-smq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 072792dcdfc8d5f91a26050e5665285f50afebf5 Author: Joe Thornber Date: Thu May 11 06:14:16 2017 -0400 dm cache: fix incorrect 'idle_time' reset in IO tracker Some bios have no payload (eg, a FLUSH), don't reset the idle_time when these come in. Signed-off-by: Joe Thornber Signed-off-by: Mike Snitzer drivers/md/dm-cache-target.c | 3 +++ 1 file changed, 3 insertions(+) commit e23c7f7d57831fdae444be9d507e67716ab601d4 Author: Arnd Bergmann Date: Thu May 11 13:37:47 2017 +0200 soc: imx: add PM dependency for IMX7_PM_DOMAINS The new pm domain driver causes a build failure when CONFIG_PM is not set: warning: (IMX7_PM_DOMAINS) selects PM_GENERIC_DOMAINS which has unmet direct dependencies (PM) drivers/base/power/domain_governor.c: In function 'default_suspend_ok': drivers/base/power/domain_governor.c:75:17: error: 'struct dev_pm_info' has no member named 'ignore_children' This adds a dependency to ensure that we don't attempt to build the driver without CONFIG_PM. Fixes: 03aa12629fc4 ("soc: imx: Add GPCv2 power gating driver") Signed-off-by: Arnd Bergmann Reviewed-by: Fabio Estevam Signed-off-by: Shawn Guo drivers/soc/imx/Kconfig | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit d8581c7c8be172dac156a19d261f988a72ce596f Author: Leonard Crestez Date: Fri May 5 14:00:17 2017 +0300 ARM: dts: imx6sx-sdb: Remove OPP override The board file for imx6sx-sdb overrides cpufreq operating points to use higher voltages. This is done because the board has a shared rail for VDD_ARM_IN and VDD_SOC_IN and when using LDO bypass the shared voltage needs to be a value suitable for both ARM and SOC. This only applies to LDO bypass mode, a feature not present in upstream. When LDOs are enabled the effect is to use higher voltages than necessary for no good reason. Setting these higher voltages can make some boards fail to boot with ugly semi-random crashes reminiscent of memory corruption. These failures only happen on board rev. C, rev. B is reported to still work. Signed-off-by: Leonard Crestez Fixes: 54183bd7f766 ("ARM: imx6sx-sdb: add revb board and make it default") Cc: stable@vger.kernel.org Signed-off-by: Shawn Guo arch/arm/boot/dts/imx6sx-sdb.dts | 17 ----------------- 1 file changed, 17 deletions(-) commit 2fe4bff3516924a37e083e3211364abe59db1161 Author: Fabio Estevam Date: Wed Apr 12 18:31:18 2017 -0300 ARM: dts: imx53-qsrb: Pulldown PMIC IRQ pin Currently the following errors are seen: [ 14.015056] mc13xxx 0-0008: Failed to read IRQ status: -6 [ 27.321093] mc13xxx 0-0008: Failed to read IRQ status: -6 [ 27.411681] mc13xxx 0-0008: Failed to read IRQ status: -6 [ 27.456281] mc13xxx 0-0008: Failed to read IRQ status: -6 [ 30.527106] mc13xxx 0-0008: Failed to read IRQ status: -6 [ 36.596900] mc13xxx 0-0008: Failed to read IRQ status: -6 Also when reading the interrupts via 'cat /proc/interrupts' the PMIC GPIO interrupt counter does not stop increasing. The reason for the storm of interrupts is that the PUS field of register IOMUXC_SW_PAD_CTL_PAD_CSI0_DAT5 is currently configured as: 10 : 100k pullup and the PMIC interrupt is being registered as IRQ_TYPE_LEVEL_HIGH type, which is the correct type as per the MC34708 datasheet. Use the default power on value for the IOMUX, which sets PUS field as: 00: 360k pull down This prevents the spurious PMIC interrupts from happening. Commit e1ffceb078c6 ("ARM: imx53: qsrb: fix PMIC interrupt level") correctly described the irq type as IRQ_TYPE_LEVEL_HIGH, but missed to update the IOMUX of the PMIC GPIO as pull down. Fixes: e1ffceb078c6 ("ARM: imx53: qsrb: fix PMIC interrupt level") Signed-off-by: Fabio Estevam Signed-off-by: Shawn Guo arch/arm/boot/dts/imx53-qsrb.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c54517196811b0561079833c147083ab2c9cc5e1 Author: Jacopo Mondi Date: Tue May 9 09:57:57 2017 +0200 iio: adc: max9611: Fix attribute measure unit The power and current "shunt-resistor" attribute's 'show' function displays the resistor value in milli-Ohms, while the ABI description specifies it should be displayed in Ohms. Fix it. Reported-by: Geert Uytterhoeven Signed-off-by: Jacopo Mondi Tested-by: Geert Uytterhoeven Signed-off-by: Jonathan Cameron drivers/iio/adc/max9611.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 5ba5b437efaa7a502eec393c045d3bf90c92c4e9 Author: Dan Carpenter Date: Wed May 10 08:51:09 2017 +0300 iio: adc: ti_am335x_adc: allocating too much in probe We should be allocating enough information for a tiadc_device struct which is about 400 bytes but instead we allocate enough for a second iio_dev struct which is over 2000 bytes. Fixes: fea89e2dfcea ("iio: adc: ti_am335x_adc: use variable names for sizeof() operator") Signed-off-by: Dan Carpenter Signed-off-by: Jonathan Cameron drivers/iio/adc/ti_am335x_adc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 90b4f30b6d15222a509dacf47f29efef2b22571e Author: Thomas Gleixner Date: Wed May 10 16:30:12 2017 +0200 hwmon: (coretemp) Handle frozen hotplug state correctly The recent conversion to the hotplug state machine missed that the original hotplug notifiers did not execute in the frozen state, which is used on suspend on resume. This does not matter on single socket machines, but on multi socket systems this breaks when the device for a non-boot socket is removed when the last CPU of that socket is brought offline. The device removal locks up the machine hard w/o any debug output. Prevent executing the hotplug callbacks when cpuhp_tasks_frozen is true. Thanks to Tommi for providing debug information patiently while I failed to spot the obvious. Fixes: e00ca5df37ad ("hwmon: (coretemp) Convert to hotplug state machine") Reported-by: Tommi Rantala Tested-by: Tommi Rantala Signed-off-by: Thomas Gleixner Signed-off-by: Guenter Roeck drivers/hwmon/coretemp.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) commit b2d3c270f9f2fb82518ac500a9849c3aaf503852 Author: Thomas Petazzoni Date: Fri May 5 11:57:50 2017 +0200 dmaengine: mv_xor_v2: set DMA mask to 40 bits The XORv2 engine on Armada 7K/8K can only access the first 40 bits of the physical address space, so the DMA mask must be set accordingly. Fixes: 19a340b1a820 ("dmaengine: mv_xor_v2: new driver") Cc: Signed-off-by: Thomas Petazzoni Signed-off-by: Vinod Koul drivers/dma/mv_xor_v2.c | 4 ++++ 1 file changed, 4 insertions(+) commit 9dd4f319bac25334a869d9276b19eac9e478fd33 Author: Thomas Petazzoni Date: Fri May 5 11:57:49 2017 +0200 dmaengine: mv_xor_v2: remove interrupt coalescing The current implementation of interrupt coalescing doesn't work, because it doesn't configure the coalescing timer, which is needed to make sure we get an interrupt at some point. As a fix for stable, we simply remove the interrupt coalescing functionality. It will be re-introduced properly in a future commit. Fixes: 19a340b1a820 ("dmaengine: mv_xor_v2: new driver") Cc: Signed-off-by: Thomas Petazzoni Signed-off-by: Vinod Koul drivers/dma/mv_xor_v2.c | 25 ------------------------- 1 file changed, 25 deletions(-) commit 44d5887a8bf1e86915c8ff647337cb138149da82 Author: Thomas Petazzoni Date: Fri May 5 11:57:48 2017 +0200 dmaengine: mv_xor_v2: fix tx_submit() implementation The mv_xor_v2_tx_submit() gets the next available HW descriptor by calling mv_xor_v2_get_desq_write_ptr(), which reads a HW register telling the next available HW descriptor. This was working fine when HW descriptors were issued for processing directly in tx_submit(). However, as part of the review process of the driver, a change was requested to move the actual kick-off of HW descriptors processing to ->issue_pending(). Due to this, reading the HW register to know the next available HW descriptor no longer works. So instead of using this HW register, we implemented a software index pointing to the next available HW descriptor. Fixes: 19a340b1a820 ("dmaengine: mv_xor_v2: new driver") Cc: Signed-off-by: Thomas Petazzoni Signed-off-by: Vinod Koul drivers/dma/mv_xor_v2.c | 22 +++++----------------- 1 file changed, 5 insertions(+), 17 deletions(-) commit ab2c5f0a77fe49bdb6e307b397496373cb47d2c2 Author: Hanna Hawa Date: Fri May 5 11:57:47 2017 +0200 dmaengine: mv_xor_v2: enable XOR engine after its configuration The engine was enabled prior to its configuration, which isn't correct. This patch relocates the activation of the XOR engine, to be after the configuration of the XOR engine. Fixes: 19a340b1a820 ("dmaengine: mv_xor_v2: new driver") Cc: Signed-off-by: Hanna Hawa Signed-off-by: Thomas Petazzoni Signed-off-by: Vinod Koul drivers/dma/mv_xor_v2.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit bc473da1ed726c975ad47f8d7d27631de11356d8 Author: Thomas Petazzoni Date: Fri May 5 11:57:46 2017 +0200 dmaengine: mv_xor_v2: do not use descriptors not acked by async_tx Descriptors that have not been acknowledged by the async_tx layer should not be re-used, so this commit adjusts the implementation of mv_xor_v2_prep_sw_desc() to skip descriptors for which async_tx_test_ack() is false. Fixes: 19a340b1a820 ("dmaengine: mv_xor_v2: new driver") Cc: Signed-off-by: Thomas Petazzoni Signed-off-by: Vinod Koul drivers/dma/mv_xor_v2.c | 32 ++++++++++++++++++++++---------- 1 file changed, 22 insertions(+), 10 deletions(-) commit 2aab4e18152cd30cb5d2f4c27629fc8a04aed979 Author: Thomas Petazzoni Date: Fri May 5 11:57:45 2017 +0200 dmaengine: mv_xor_v2: properly handle wrapping in the array of HW descriptors mv_xor_v2_tasklet() is looping over completed HW descriptors. Before the loop, it initializes 'next_pending_hw_desc' to the first HW descriptor to handle, and then the loop simply increments this point, without taking care of wrapping when we reach the last HW descriptor. The 'pending_ptr' index was being wrapped back to 0 at the end, but it wasn't used in each iteration of the loop to calculate next_pending_hw_desc. This commit fixes that, and makes next_pending_hw_desc a variable local to the loop itself. Fixes: 19a340b1a820 ("dmaengine: mv_xor_v2: new driver") Cc: Signed-off-by: Thomas Petazzoni Signed-off-by: Vinod Koul drivers/dma/mv_xor_v2.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) commit eb8df543e444492328f506adffc7dfe94111f1bd Author: Thomas Petazzoni Date: Fri May 5 11:57:44 2017 +0200 dmaengine: mv_xor_v2: handle mv_xor_v2_prep_sw_desc() error properly The mv_xor_v2_prep_sw_desc() is called from a few different places in the driver, but we never take into account the fact that it might return NULL. This commit fixes that, ensuring that we don't panic if there are no more descriptors available. Fixes: 19a340b1a820 ("dmaengine: mv_xor_v2: new driver") Cc: Signed-off-by: Thomas Petazzoni Signed-off-by: Vinod Koul drivers/dma/mv_xor_v2.c | 6 ++++++ 1 file changed, 6 insertions(+) commit be0408d74d9c95de1baf6c2563b6e6d1dfb17b88 Author: Arnd Bergmann Date: Thu May 11 14:12:29 2017 +0200 cpufreq: dbx500: add a Kconfig symbol Moving the cooling code into the cpufreq driver caused a possible build failure when the cpu_thermal helper code is a loadable module or disabled: drivers/cpufreq/dbx500-cpufreq.o: In function `dbx500_cpufreq_ready': dbx500-cpufreq.c:(.text.dbx500_cpufreq_ready+0x4): undefined reference to `cpufreq_cooling_register' This adds the same dependency that we have in other cpufreq drivers, forcing the driver to be disabled when we can't possibly link it. Fixes: 19678ffb9fd6 (cpufreq: dbx500: Manage cooling device from cpufreq driver) Signed-off-by: Arnd Bergmann Acked-by: Viresh Kumar Reviewed-by: Linus Walleij Signed-off-by: Rafael J. Wysocki drivers/cpufreq/Kconfig.arm | 9 +++++++++ drivers/cpufreq/Makefile | 2 +- 2 files changed, 10 insertions(+), 1 deletion(-) commit 0bae5fd3330be0517fba697e6b228601d421fade Author: Pushkar Jambhlekar Date: Thu May 11 10:31:24 2017 +0530 PM / hibernate: Declare variables as static Fixing sparse warnings: 'symbol not declared. Should it be static?' Signed-off-by: Pushkar Jambhlekar Signed-off-by: Rafael J. Wysocki kernel/power/snapshot.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 216c4e9db4c9d1d2a382b42880442dc632cd47d9 Author: Dan Carpenter Date: Wed May 10 22:40:06 2017 +0300 PowerCap: Fix an error code in powercap_register_zone() In the current code we accidentally return the successful result from idr_alloc() instead of a negative error pointer. The caller is looking for an error pointer and so it treats the returned value as a valid pointer. This one might be a bit serious because if it lets people get around the kernel's protection for remapping NULL. I'm not sure. Fixes: 75d2364ea0ca (PowerCap: Add class driver) Signed-off-by: Dan Carpenter Reviewed-by: Srinivas Pandruvada Signed-off-by: Rafael J. Wysocki drivers/powercap/powercap_sys.c | 1 + 1 file changed, 1 insertion(+) commit 508541146af18e43072e41a31aa62fac2b01aac1 Author: Yishai Hadas Date: Tue Apr 25 10:39:57 2017 +0300 net/mlx5: Use underlay QPN from the root name space Root flow table is dynamically changed by the underlying flow steering layer, and IPoIB/ULPs have no idea what will be the root flow table in the future, hence we need a dynamic infrastructure to move Underlay QPs with the root flow table. Fixes: b3ba51498bdd ("net/mlx5: Refactor create flow table method to accept underlay QP") Signed-off-by: Erez Shitrit Signed-off-by: Maor Gottlieb Signed-off-by: Yishai Hadas Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en.h | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_fs.c | 5 ++--- drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c | 9 +++----- drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.h | 3 ++- drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 25 +++++++++++++++++++---- drivers/net/ethernet/mellanox/mlx5/core/fs_core.h | 2 +- drivers/net/ethernet/mellanox/mlx5/core/ipoib.c | 7 +++++-- include/linux/mlx5/fs.h | 4 +++- 8 files changed, 38 insertions(+), 19 deletions(-) commit 5360fd473c23f18b42722cdb13a1c6ec7acd96ff Author: Saeed Mahameed Date: Thu May 4 17:53:32 2017 +0300 net/mlx5e: IPoIB, Only support regular RQ for now IPoIB doesn't support striding RQ at the moment, for this we need to explicitly choose non striding RQ in IPoIB init, even if the HW supports it. Fixes: 8f493ffd88ea ("net/mlx5e: IPoIB, RX steering RSS RQTs and TIRs") Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/ipoib.c | 4 ++++ 1 file changed, 4 insertions(+) commit 20b6a1c78280dbeb45214c463cf9cbccb3665146 Author: Saeed Mahameed Date: Tue May 9 16:40:46 2017 +0300 net/mlx5e: Fix setup TC ndo Fail-safe support patches introduced a trivial bug, setup tc callback is doing a wrong check of the netdevice state, the fix is simply to invert the condition. Fixes: 6f9485af4020 ("net/mlx5e: Fail safe tc setup") Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e3c19503712d6360239b19c14cded56dd63c40d7 Author: Gal Pressman Date: Wed Apr 19 14:35:15 2017 +0300 net/mlx5e: Fix ethtool pause support and advertise reporting Pause bit should set when RX pause is on, not TX pause. Also, setting Asym_Pause is incorrect, and should be turned off. Fixes: 665bc53969d7 ("net/mlx5e: Use new ethtool get/set link ksettings API") Signed-off-by: Gal Pressman Cc: kernel-team@fb.com Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit b383b544f2666d67446b951a9a97af239dafed5d Author: Gal Pressman Date: Mon Apr 3 15:11:22 2017 +0300 net/mlx5e: Use the correct pause values for ethtool advertising Query the operational pause from firmware (PFCC register) instead of always passing zeros. Fixes: 665bc53969d7 ("net/mlx5e: Use new ethtool get/set link ksettings API") Signed-off-by: Gal Pressman Cc: kernel-team@fb.com Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 14f814fbedd749992476bb365b454b2170b3b225 Author: Adam Thomson Date: Wed May 3 16:15:53 2017 +0100 ASoC: da7213: Fix incorrect usage of bitwise '&' operator for SRM check In the SRM lock check section of code the '&' bitwise operator is used as part of checking lock status. Functionally the code works as intended, but the conditional statement is a boolean comparison so should really use '&&' logical operator instead. This commit rectifies this discrepancy. Signed-off-by: Adam Thomson Signed-off-by: Mark Brown sound/soc/codecs/da7213.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fe0dfd6358a17c79bd7d6996af7512ba452a7059 Author: Yifeng Li Date: Thu May 4 01:34:14 2017 +0800 rt286: add Thinkpad Helix 2 to force_combo_jack_table Thinkpad Helix 2 is a tablet PC, the audio is powered by Core M broadwell-audio and rt286 codec. For all versions of Linux kernel, the stereo output doesn't work properly when earphones are plugged in, the sound was coming out from both channels even if the audio contains only the left or right channel. Furthermore, if a music recorded in stereo is played, the two channels cancle out each other out, as a result, no voice but only distorted background music can be heard, like a sound card with builtin a Karaoke sount effect. Apparently this tablet uses a combo jack with polarity incorrectly set by rt286 driver. This patch adds DMI information of Thinkpad Helix 2 to force_combo_jack_table[] and the issue is resolved. The microphone input doesn't work regardless to the presence of this patch and still needs help from other developers to investigate. This is my first patch to LKML directly, sorry for CC-ing too many people here. Link: https://bugzilla.kernel.org/show_bug.cgi?id=93841 Signed-off-by: Yifeng Li Signed-off-by: Mark Brown sound/soc/codecs/rt286.c | 7 +++++++ 1 file changed, 7 insertions(+) commit ab1b732d53c18f26f51cad49371be3244fe67504 Author: Vinod Koul Date: Thu May 4 14:09:10 2017 +0530 ASoC: Intel: Skylake: Move i915 registration to worker thread The i915 component framework expects the caller to be invoking snd_hdac_i915_init() from a thread context. Otherwise it results in lockups on drm side. So move the registering of component interface and probing of codecs on this bus to a worker thread. init_failed in skl structure is not used currently, so renamed to init_done and used to track the initialization done in worker thread. Reported-by: Imre Deak Signed-off-by: Vinod Koul Signed-off-by: Sodhi, VunnyX Signed-off-by: Subhransu S. Prusty Signed-off-by: Mark Brown sound/soc/intel/skylake/skl.c | 162 +++++++++++++++++++++++------------------- sound/soc/intel/skylake/skl.h | 4 +- 2 files changed, 91 insertions(+), 75 deletions(-) commit a27b49b8afd41d53ab2429ebb122b78a4201fa0d Author: Icenowy Zheng Date: Mon Apr 17 18:34:49 2017 +0800 ARM: sunxi: h3/h5: fix the compatible of R_CCU The R_CCU of H3/H5 currently wrongly used A64 R_CCU compatible. Fix it by changing it to the correct H3 compatible. Signed-off-by: Icenowy Zheng Signed-off-by: Maxime Ripard arch/arm/boot/dts/sunxi-h3-h5.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7ffc781ec46ef1e9aedb482f5f04425bd8bb2753 Author: Yong Deng Date: Fri May 5 18:31:57 2017 +0800 clk: sunxi-ng: v3s: Fix usb otg device reset bit V3S's usb otg device reset bit should be 24, not 23. Cc: stable@vger.kernel.org Signed-off-by: Yong Deng Reviewed-By: Icenowy Zheng Signed-off-by: Maxime Ripard drivers/clk/sunxi-ng/ccu-sun8i-v3s.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 38b8f823864707eb1cf331d2247608c419ed388c Author: Chen-Yu Tsai Date: Wed May 3 11:13:46 2017 +0800 clk: sunxi-ng: a31: Correct lcd1-ch1 clock register offset The register offset for the lcd1-ch1 clock was incorrectly pointing to the lcd0-ch1 clock. This resulted in the lcd0-ch1 clock being disabled when the clk core disables unused clocks. This then stops the simplefb HDMI output path. Reported-by: Bob Ham Fixes: c6e6c96d8fa6 ("clk: sunxi-ng: Add A31/A31s clocks") Cc: stable@vger.kernel.org # 4.9.x- Signed-off-by: Chen-Yu Tsai Signed-off-by: Maxime Ripard drivers/clk/sunxi-ng/ccu-sun6i-a31.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 31d848aa1d85530770f0bdf1b61a042335d340ad Author: Florian Fainelli Date: Wed Apr 19 09:58:23 2017 -0700 soc: bcm: brcmstb: Correctly match 7435 SoC Remove the duplicate brcm,bcm7425-sun-top-ctrl compatible string and replace it with brcm,bcm7435-sun-top-ctrl which was intended. Fixes: bd0faf08dc7f ("soc: bcm: brcmstb: Match additional compatible strings") Reported-by: Andreas Oberritter Acked-by: Gregory Fong Signed-off-by: Florian Fainelli drivers/soc/bcm/brcmstb/common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b155f05dc578299557447a6fd6545ebc72c1d19b Merge: 2ea659a 10b6c0c Author: Florian Fainelli Date: Sat May 13 20:26:09 2017 -0700 Merge tag 'bcm2835-dt-next-2017-03-30' into devicetree/fixes This pull request brings back bcm2835 DT fixups from Baruch Siach that got misplaced after a PR for 4.11 got rejected. Signed-off-by: Florian Fainelli commit f5705aa8cfed142d980ecac12bee0d81b756479e Author: Dan Williams Date: Sat May 13 16:31:05 2017 -0700 dax, xfs, ext4: compile out iomap-dax paths in the FS_DAX=n case Tetsuo reports: fs/built-in.o: In function `xfs_file_iomap_end': xfs_iomap.c:(.text+0xe0ef9): undefined reference to `put_dax' fs/built-in.o: In function `xfs_file_iomap_begin': xfs_iomap.c:(.text+0xe1a7f): undefined reference to `dax_get_by_host' make: *** [vmlinux] Error 1 $ grep DAX .config CONFIG_DAX=m # CONFIG_DEV_DAX is not set # CONFIG_FS_DAX is not set When FS_DAX=n we can/must throw away the dax code in filesystems. Implement 'fs_' versions of dax_get_by_host() and put_dax() that are nops in the FS_DAX=n case. Cc: Cc: Cc: Jan Kara Cc: "Theodore Ts'o" Cc: "Darrick J. Wong" Cc: Ross Zwisler Tested-by: Tony Luck Fixes: ef51042472f5 ("block, dax: move 'select DAX' from BLOCK to FS_DAX") Reported-by: Tetsuo Handa Signed-off-by: Dan Williams fs/ext2/inode.c | 4 ++-- fs/ext4/inode.c | 4 ++-- fs/xfs/xfs_iomap.c | 4 ++-- include/linux/dax.h | 34 +++++++++++++++++++++++++++------- 4 files changed, 33 insertions(+), 13 deletions(-) commit 967b08c25a091867b04261fa34addedc950256f1 Author: Rafael J. Wysocki Date: Sun May 14 02:23:12 2017 +0200 RTC: rtc-cmos: Fix wakeup from suspend-to-idle Commit eed4d47efe95 (ACPI / sleep: Ignore spurious SCI wakeups from suspend-to-idle) modified the core suspend-to-idle code to filter out spurious SCI interrupts received while suspended, which requires ACPI event source handlers to report wakeup events in a way that will trigger a wakeup from suspend to idle (or abort system suspends in progress, which is equivalent). That needs to be done in the rtc-cmos driver too, which was overlooked by the above commit, so do that now. Fixes: eed4d47efe95 (ACPI / sleep: Ignore spurious SCI wakeups from suspend-to-idle) Reported-by: David E. Box Signed-off-by: Rafael J. Wysocki drivers/rtc/rtc-cmos.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 60d4553bdc1a0099adb544e12cafd7bbc7f1d484 Author: Rafael J. Wysocki Date: Sun May 14 02:23:04 2017 +0200 PM / wakeup: Fix up wakeup_source_report_event() Commit 8a537ece3d94 (PM / wakeup: Integrate mechanism to abort transitions in progress) modified wakeup_source_report_event() and wakeup_source_activate() to make it possible to call pm_system_wakeup() from the latter if so indicated by the caller of the former (via a new function argument added by that commit), but it overlooked the fact that in some situations wakeup_source_report_event() is called to signal a "hard" event (ie. such that should abort a system suspend in progress) after pm_stay_awake() has been called for the same wakeup source object, in which case the pm_system_wakeup() will not trigger. To work around this issue, modify wakeup_source_activate() and wakeup_source_report_event() again so that pm_system_wakeup() is called by the latter directly (if its last argument is true), in which case the additional argument does not need to be passed to wakeup_source_activate() any more, so drop it from there. Fixes: 8a537ece3d94 (PM / wakeup: Integrate mechanism to abort transitions in progress) Reported-by: David E. Box Signed-off-by: Rafael J. Wysocki drivers/base/power/wakeup.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) commit 33fc30b470983e5b641a16cccc882f6777dd50ef Author: Rafael J. Wysocki Date: Sun May 14 02:06:03 2017 +0200 cpufreq: intel_pstate: Document the current behavior and user interface Add a document describing the current behavior and user space interface of the intel_pstate driver in the RST format and drop the existing outdated intel_pstate.txt document. Also update admin-guide/pm/cpufreq.rst with proper RST references to the new intel_pstate.rst document. Signed-off-by: Rafael J. Wysocki Documentation/admin-guide/pm/cpufreq.rst | 19 +- Documentation/admin-guide/pm/index.rst | 1 + Documentation/admin-guide/pm/intel_pstate.rst | 755 ++++++++++++++++++++++++++ Documentation/cpu-freq/intel-pstate.txt | 281 ---------- 4 files changed, 766 insertions(+), 290 deletions(-) commit 9d109081c261d87fc84e0cce245796796ae4c460 Author: Dan Williams Date: Sat May 13 16:18:21 2017 -0700 dax: fix false CONFIG_BLOCK dependency In the BLOCK=n case the dax core does not need to / must not emit the block-device-dax helpers. Otherwise it leads to compile errors. Cc: Arnd Bergmann Reported-by: Fabian Frederick Fixes: ef51042472f5 ("block, dax: move 'select DAX' from BLOCK to FS_DAX") Signed-off-by: Dan Williams drivers/dax/super.c | 2 ++ 1 file changed, 2 insertions(+) commit 3fd37226216620c1a468afa999739d5016fbc349 Author: Kirill Tkhai Date: Fri May 12 19:11:31 2017 +0300 pid_ns: Fix race between setns'ed fork() and zap_pid_ns_processes() Imagine we have a pid namespace and a task from its parent's pid_ns, which made setns() to the pid namespace. The task is doing fork(), while the pid namespace's child reaper is dying. We have the race between them: Task from parent pid_ns Child reaper copy_process() .. alloc_pid() .. .. zap_pid_ns_processes() .. disable_pid_allocation() .. read_lock(&tasklist_lock) .. iterate over pids in pid_ns .. kill tasks linked to pids .. read_unlock(&tasklist_lock) write_lock_irq(&tasklist_lock); .. attach_pid(p, PIDTYPE_PID); .. .. .. So, just created task p won't receive SIGKILL signal, and the pid namespace will be in contradictory state. Only manual kill will help there, but does the userspace care about this? I suppose, the most users just inject a task into a pid namespace and wait a SIGCHLD from it. The patch fixes the problem. It simply checks for (pid_ns->nr_hashed & PIDNS_HASH_ADDING) in copy_process(). We do it under the tasklist_lock, and can't skip PIDNS_HASH_ADDING as noted by Oleg: "zap_pid_ns_processes() does disable_pid_allocation() and then takes tasklist_lock to kill the whole namespace. Given that copy_process() checks PIDNS_HASH_ADDING under write_lock(tasklist) they can't race; if copy_process() takes this lock first, the new child will be killed, otherwise copy_process() can't miss the change in ->nr_hashed." If allocation is disabled, we just return -ENOMEM like it's made for such cases in alloc_pid(). v2: Do not move disable_pid_allocation(), do not introduce a new variable in copy_process() and simplify the patch as suggested by Oleg Nesterov. Account the problem with double irq enabling found by Eric W. Biederman. Fixes: c876ad768215 ("pidns: Stop pid allocation when init dies") Signed-off-by: Kirill Tkhai CC: Andrew Morton CC: Ingo Molnar CC: Peter Zijlstra CC: Oleg Nesterov CC: Mike Rapoport CC: Michal Hocko CC: Andy Lutomirski CC: "Eric W. Biederman" CC: Andrei Vagin CC: Cyrill Gorcunov CC: Serge Hallyn Cc: stable@vger.kernel.org Acked-by: Oleg Nesterov Signed-off-by: Eric W. Biederman kernel/fork.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit b9a985db98961ae1ba0be169f19df1c567e4ffe0 Author: Eric W. Biederman Date: Thu May 11 18:21:01 2017 -0500 pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes The code can potentially sleep for an indefinite amount of time in zap_pid_ns_processes triggering the hung task timeout, and increasing the system average. This is undesirable. Sleep with a task state of TASK_INTERRUPTIBLE instead of TASK_UNINTERRUPTIBLE to remove these undesirable side effects. Apparently under heavy load this has been allowing Chrome to trigger the hung time task timeout error and cause ChromeOS to reboot. Reported-by: Vovo Yang Reported-by: Guenter Roeck Tested-by: Guenter Roeck Fixes: 6347e9009104 ("pidns: guarantee that the pidns init will be the last pidns process reaped") Cc: stable@vger.kernel.org Signed-off-by: "Eric W. Biederman" kernel/pid_namespace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2ea659a9ef488125eb46da6eb571de5eae5c43f6 Author: Linus Torvalds Date: Sat May 13 13:19:49 2017 -0700 Linux 4.12-rc1 Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit cd636458904a04de2349c728323c5d2af1203bdf Merge: b53c4d5 3af9256 Author: Linus Torvalds Date: Sat May 13 10:25:05 2017 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull some more input subsystem updates from Dmitry Torokhov: "An updated xpad driver with a few more recognized device IDs, and a new psxpad-spi driver, allowing connecting Playstation 1 and 2 joypads via SPI bus" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: cros_ec_keyb - remove extraneous 'const' Input: add support for PlayStation 1/2 joypads connected via SPI Input: xpad - add USB IDs for Mad Catz Brawlstick and Razer Sabertooth Input: xpad - sync supported devices with xboxdrv Input: xpad - sort supported devices by USB ID commit b53c4d5eb7cda86f7bf495f52116ae43bdc9cf23 Merge: ec05901 7bccd12 Author: Linus Torvalds Date: Sat May 13 10:23:12 2017 -0700 Merge tag 'upstream-4.12-rc1' of git://git.infradead.org/linux-ubifs Pull UBI/UBIFS updates from Richard Weinberger: - new config option CONFIG_UBIFS_FS_SECURITY - minor improvements - random fixes * tag 'upstream-4.12-rc1' of git://git.infradead.org/linux-ubifs: ubi: Add debugfs file for tracking PEB state ubifs: Fix a typo in comment of ioctl2ubifs & ubifs2ioctl ubifs: Remove unnecessary assignment ubifs: Fix cut and paste error on sb type comparisons ubi: fastmap: Fix slab corruption ubifs: Add CONFIG_UBIFS_FS_SECURITY to disable/enable security labels ubi: Make mtd parameter readable ubi: Fix section mismatch commit ec059019b7e6ae3926a8e1dec02a62d64dd8c060 Merge: 1251704 ce45860 Author: Linus Torvalds Date: Sat May 13 10:20:02 2017 -0700 Merge branch 'for-linus-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml Pull UML fixes from Richard Weinberger: "No new stuff, just fixes" * 'for-linus-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml: um: Add missing NR_CPUS include um: Fix to call read_initrd after init_bootmem um: Include kbuild.h instead of duplicating its macros um: Fix PTRACE_POKEUSER on x86_64 um: Set number of CPUs um: Fix _print_addr() commit 1251704a631b62591ad1d1b6ead252e9e597d5f5 Merge: 0fcc3ab b340959 Author: Linus Torvalds Date: Sat May 13 09:49:35 2017 -0700 Merge branch 'akpm' (patches from Andrew) Merge misc fixes from Andrew Morton: "15 fixes" * emailed patches from Andrew Morton : mm, docs: update memory.stat description with workingset* entries mm: vmscan: scan until it finds eligible pages mm, thp: copying user pages must schedule on collapse dax: fix PMD data corruption when fault races with write dax: fix data corruption when fault races with write ext4: return to starting transaction in ext4_dax_huge_fault() mm: fix data corruption due to stale mmap reads dax: prevent invalidation of mapped DAX entries Tigran has moved mm, vmalloc: fix vmalloc users tracking properly mm/khugepaged: add missed tracepoint for collapse_huge_page_swapin gcov: support GCC 7.1 mm, vmstat: Remove spurious WARN() during zoneinfo print time: delete current_fs_time() hwpoison, memcg: forcibly uncharge LRU pages commit 67b4c889cc835a2a6e2ff4e20544a33e37e2875d Author: Steve French Date: Fri May 12 20:59:10 2017 -0500 [CIFS] Minor cleanup of xattr query function Some minor cleanup of cifs query xattr functions (will also make SMB3 xattr implementation cleaner as well). Signed-off-by: Steve French fs/cifs/cifsglob.h | 2 +- fs/cifs/cifsproto.h | 3 +-- fs/cifs/cifssmb.c | 4 +++- fs/cifs/inode.c | 3 +-- fs/cifs/xattr.c | 6 ++---- 5 files changed, 8 insertions(+), 10 deletions(-) commit 4328fea77ca30ef6af938ae3f263a3d055a9c0e6 Author: Karim Eshapa Date: Fri May 12 01:53:38 2017 +0200 fs: cifs: transport: Use time_after for time comparison Use time_after kernel macro for time comparison that has safety check. Signed-off-by: Karim Eshapa Signed-off-by: Steve French fs/cifs/transport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cd1230070ae1c12fd34cf6a557bfa81bf9311009 Author: Christophe JAILLET Date: Fri May 12 17:59:32 2017 +0200 SMB2: Fix share type handling In fs/cifs/smb2pdu.h, we have: #define SMB2_SHARE_TYPE_DISK 0x01 #define SMB2_SHARE_TYPE_PIPE 0x02 #define SMB2_SHARE_TYPE_PRINT 0x03 Knowing that, with the current code, the SMB2_SHARE_TYPE_PRINT case can never trigger and printer share would be interpreted as disk share. So, test the ShareType value for equality instead. Fixes: faaf946a7d5b ("CIFS: Add tree connect/disconnect capability for SMB2") Signed-off-by: Christophe JAILLET Acked-by: Aurelien Aptel Signed-off-by: Steve French fs/cifs/smb2pdu.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) commit ecdcf622eb74b52cebde1387a7a1852a787d8050 Author: Joe Perches via samba-technical Date: Sun May 7 01:31:47 2017 -0700 cifs: cifsacl: Use a temporary ops variable to reduce code length Create an ops variable to store tcon->ses->server->ops and cache indirections and reduce code size a trivial bit. $ size fs/cifs/cifsacl.o* text data bss dec hex filename 5338 136 8 5482 156a fs/cifs/cifsacl.o.new 5371 136 8 5515 158b fs/cifs/cifsacl.o.old Signed-off-by: Joe Perches Acked-by: Shirish Pargaonkar Signed-off-by: Steve French fs/cifs/cifsacl.c | 30 ++++++++++++++---------------- 1 file changed, 14 insertions(+), 16 deletions(-) commit b340959ea281dbac15344277094d0a294dbe8aca Author: Roman Gushchin Date: Fri May 12 15:47:09 2017 -0700 mm, docs: update memory.stat description with workingset* entries Commit 4b4cea91691d ("mm: vmscan: fix IO/refault regression in cache workingset transition") introduced three new entries in memory stat file: - workingset_refault - workingset_activate - workingset_nodereclaim This commit adds a corresponding description to the cgroup v2 docs. Link: http://lkml.kernel.org/r/1494530293-31236-1-git-send-email-guro@fb.com Signed-off-by: Roman Gushchin Cc: Johannes Weiner Cc: Michal Hocko Cc: Vladimir Davydov Cc: Tejun Heo Cc: Li Zefan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Documentation/cgroup-v2.txt | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit 791b48b642324c4e6bfef27f552aaebead81905f Author: Minchan Kim Date: Fri May 12 15:47:06 2017 -0700 mm: vmscan: scan until it finds eligible pages Although there are a ton of free swap and anonymous LRU page in elgible zones, OOM happened. balloon invoked oom-killer: gfp_mask=0x17080c0(GFP_KERNEL_ACCOUNT|__GFP_ZERO|__GFP_NOTRACK), nodemask=(null), order=0, oom_score_adj=0 CPU: 7 PID: 1138 Comm: balloon Not tainted 4.11.0-rc6-mm1-zram-00289-ge228d67e9677-dirty #17 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 Call Trace: oom_kill_process+0x21d/0x3f0 out_of_memory+0xd8/0x390 __alloc_pages_slowpath+0xbc1/0xc50 __alloc_pages_nodemask+0x1a5/0x1c0 pte_alloc_one+0x20/0x50 __pte_alloc+0x1e/0x110 __handle_mm_fault+0x919/0x960 handle_mm_fault+0x77/0x120 __do_page_fault+0x27a/0x550 trace_do_page_fault+0x43/0x150 do_async_page_fault+0x2c/0x90 async_page_fault+0x28/0x30 Mem-Info: active_anon:424716 inactive_anon:65314 isolated_anon:0 active_file:52 inactive_file:46 isolated_file:0 unevictable:0 dirty:27 writeback:0 unstable:0 slab_reclaimable:3967 slab_unreclaimable:4125 mapped:133 shmem:43 pagetables:1674 bounce:0 free:4637 free_pcp:225 free_cma:0 Node 0 active_anon:1698864kB inactive_anon:261256kB active_file:208kB inactive_file:184kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:532kB dirty:108kB writeback:0kB shmem:172kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no DMA free:7316kB min:32kB low:44kB high:56kB active_anon:8064kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB slab_reclaimable:464kB slab_unreclaimable:40kB kernel_stack:0kB pagetables:24kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 992 992 1952 DMA32 free:9088kB min:2048kB low:3064kB high:4080kB active_anon:952176kB inactive_anon:0kB active_file:36kB inactive_file:0kB unevictable:0kB writepending:88kB present:1032192kB managed:1019388kB mlocked:0kB slab_reclaimable:13532kB slab_unreclaimable:16460kB kernel_stack:3552kB pagetables:6672kB bounce:0kB free_pcp:56kB local_pcp:24kB free_cma:0kB lowmem_reserve[]: 0 0 0 959 Movable free:3644kB min:1980kB low:2960kB high:3940kB active_anon:738560kB inactive_anon:261340kB active_file:188kB inactive_file:640kB unevictable:0kB writepending:20kB present:1048444kB managed:1010816kB mlocked:0kB slab_reclaimable:0kB slab_unreclaimable:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:832kB local_pcp:60kB free_cma:0kB lowmem_reserve[]: 0 0 0 0 DMA: 1*4kB (E) 0*8kB 18*16kB (E) 10*32kB (E) 10*64kB (E) 9*128kB (ME) 8*256kB (E) 2*512kB (E) 2*1024kB (E) 0*2048kB 0*4096kB = 7524kB DMA32: 417*4kB (UMEH) 181*8kB (UMEH) 68*16kB (UMEH) 48*32kB (UMEH) 14*64kB (MH) 3*128kB (M) 1*256kB (H) 1*512kB (M) 2*1024kB (M) 0*2048kB 0*4096kB = 9836kB Movable: 1*4kB (M) 1*8kB (M) 1*16kB (M) 1*32kB (M) 0*64kB 1*128kB (M) 2*256kB (M) 4*512kB (M) 1*1024kB (M) 0*2048kB 0*4096kB = 3772kB 378 total pagecache pages 17 pages in swap cache Swap cache stats: add 17325, delete 17302, find 0/27 Free swap = 978940kB Total swap = 1048572kB 524157 pages RAM 0 pages HighMem/MovableOnly 12629 pages reserved 0 pages cma reserved 0 pages hwpoisoned [ pid ] uid tgid total_vm rss nr_ptes nr_pmds swapents oom_score_adj name [ 433] 0 433 4904 5 14 3 82 0 upstart-udev-br [ 438] 0 438 12371 5 27 3 191 -1000 systemd-udevd With investigation, skipping page of isolate_lru_pages makes reclaim void because it returns zero nr_taken easily so LRU shrinking is effectively nothing and just increases priority aggressively. Finally, OOM happens. The problem is that get_scan_count determines nr_to_scan with eligible zones so although priority drops to zero, it couldn't reclaim any pages if the LRU contains mostly ineligible pages. get_scan_count: size = lruvec_lru_size(lruvec, lru, sc->reclaim_idx); size = size >> sc->priority; Assumes sc->priority is 0 and LRU list is as follows. N-N-N-N-H-H-H-H-H-H-H-H-H-H-H-H-H-H-H-H (Ie, small eligible pages are in the head of LRU but others are almost ineligible pages) In that case, size becomes 4 so VM want to scan 4 pages but 4 pages from tail of the LRU are not eligible pages. If get_scan_count counts skipped pages, it doesn't reclaim any pages remained after scanning 4 pages so it ends up OOM happening. This patch makes isolate_lru_pages try to scan pages until it encounters eligible zones's pages. [akpm@linux-foundation.org: clean up mind-bending `for' statement. Tweak comment text] Fixes: 3db65812d688 ("Revert "mm, vmscan: account for skipped pages as a partial scan"") Link: http://lkml.kernel.org/r/1494457232-27401-1-git-send-email-minchan@kernel.org Signed-off-by: Minchan Kim Acked-by: Michal Hocko Acked-by: Johannes Weiner Cc: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/vmscan.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) commit 338a16ba154959b049458d4f507d60f694550b68 Author: David Rientjes Date: Fri May 12 15:47:03 2017 -0700 mm, thp: copying user pages must schedule on collapse We have encountered need_resched warnings in __collapse_huge_page_copy() while doing {clear,copy}_user_highpage() over HPAGE_PMD_NR source pages. mm->mmap_sem is held for write, but the iteration is well bounded. Reschedule as needed. Link: http://lkml.kernel.org/r/alpine.DEB.2.10.1705101426380.109808@chino.kir.corp.google.com Signed-off-by: David Rientjes Acked-by: Vlastimil Babka Cc: "Kirill A. Shutemov" Cc: Johannes Weiner Cc: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/khugepaged.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit 876f29460cbd4086b43475890c1bf2488fa11d40 Author: Ross Zwisler Date: Fri May 12 15:47:00 2017 -0700 dax: fix PMD data corruption when fault races with write This is based on a patch from Jan Kara that fixed the equivalent race in the DAX PTE fault path. Currently DAX PMD read fault can race with write(2) in the following way: CPU1 - write(2) CPU2 - read fault dax_iomap_pmd_fault() ->iomap_begin() - sees hole dax_iomap_rw() iomap_apply() ->iomap_begin - allocates blocks dax_iomap_actor() invalidate_inode_pages2_range() - there's nothing to invalidate grab_mapping_entry() - we add huge zero page to the radix tree and map it to page tables The result is that hole page is mapped into page tables (and thus zeros are seen in mmap) while file has data written in that place. Fix the problem by locking exception entry before mapping blocks for the fault. That way we are sure invalidate_inode_pages2_range() call for racing write will either block on entry lock waiting for the fault to finish (and unmap stale page tables after that) or read fault will see already allocated blocks by write(2). Fixes: 9f141d6ef6258 ("dax: Call ->iomap_begin without entry lock during dax fault") Link: http://lkml.kernel.org/r/20170510172700.18991-1-ross.zwisler@linux.intel.com Signed-off-by: Ross Zwisler Reviewed-by: Jan Kara Cc: Dan Williams Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/dax.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) commit 13e451fdc1af05568ea379d71c02a126295d2244 Author: Jan Kara Date: Fri May 12 15:46:57 2017 -0700 dax: fix data corruption when fault races with write Currently DAX read fault can race with write(2) in the following way: CPU1 - write(2) CPU2 - read fault dax_iomap_pte_fault() ->iomap_begin() - sees hole dax_iomap_rw() iomap_apply() ->iomap_begin - allocates blocks dax_iomap_actor() invalidate_inode_pages2_range() - there's nothing to invalidate grab_mapping_entry() - we add zero page in the radix tree and map it to page tables The result is that hole page is mapped into page tables (and thus zeros are seen in mmap) while file has data written in that place. Fix the problem by locking exception entry before mapping blocks for the fault. That way we are sure invalidate_inode_pages2_range() call for racing write will either block on entry lock waiting for the fault to finish (and unmap stale page tables after that) or read fault will see already allocated blocks by write(2). Fixes: 9f141d6ef6258a3a37a045842d9ba7e68f368956 Link: http://lkml.kernel.org/r/20170510085419.27601-5-jack@suse.cz Signed-off-by: Jan Kara Reviewed-by: Ross Zwisler Cc: Dan Williams Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/dax.c | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-) commit fb26a1cbed8c90025572d48bc9eabe59f7571e88 Author: Jan Kara Date: Fri May 12 15:46:54 2017 -0700 ext4: return to starting transaction in ext4_dax_huge_fault() DAX will return to locking exceptional entry before mapping blocks for a page fault to fix possible races with concurrent writes. To avoid lock inversion between exceptional entry lock and transaction start, start the transaction already in ext4_dax_huge_fault(). Fixes: 9f141d6ef6258a3a37a045842d9ba7e68f368956 Link: http://lkml.kernel.org/r/20170510085419.27601-4-jack@suse.cz Signed-off-by: Jan Kara Cc: Ross Zwisler Cc: Dan Williams Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/ext4/file.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) commit cd656375f94632d7b5af57bf67b7b5c0270c591c Author: Jan Kara Date: Fri May 12 15:46:50 2017 -0700 mm: fix data corruption due to stale mmap reads Currently, we didn't invalidate page tables during invalidate_inode_pages2() for DAX. That could result in e.g. 2MiB zero page being mapped into page tables while there were already underlying blocks allocated and thus data seen through mmap were different from data seen by read(2). The following sequence reproduces the problem: - open an mmap over a 2MiB hole - read from a 2MiB hole, faulting in a 2MiB zero page - write to the hole with write(3p). The write succeeds but we incorrectly leave the 2MiB zero page mapping intact. - via the mmap, read the data that was just written. Since the zero page mapping is still intact we read back zeroes instead of the new data. Fix the problem by unconditionally calling invalidate_inode_pages2_range() in dax_iomap_actor() for new block allocations and by properly invalidating page tables in invalidate_inode_pages2_range() for DAX mappings. Fixes: c6dcf52c23d2d3fb5235cec42d7dd3f786b87d55 Link: http://lkml.kernel.org/r/20170510085419.27601-3-jack@suse.cz Signed-off-by: Jan Kara Signed-off-by: Ross Zwisler Cc: Dan Williams Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/dax.c | 2 +- mm/truncate.c | 12 +++++++++++- 2 files changed, 12 insertions(+), 2 deletions(-) commit 4636e70bb0a8b871998b6841a2e4b205cf2bc863 Author: Ross Zwisler Date: Fri May 12 15:46:47 2017 -0700 dax: prevent invalidation of mapped DAX entries Patch series "mm,dax: Fix data corruption due to mmap inconsistency", v4. This series fixes data corruption that can happen for DAX mounts when page faults race with write(2) and as a result page tables get out of sync with block mappings in the filesystem and thus data seen through mmap is different from data seen through read(2). The series passes testing with t_mmap_stale test program from Ross and also other mmap related tests on DAX filesystem. This patch (of 4): dax_invalidate_mapping_entry() currently removes DAX exceptional entries only if they are clean and unlocked. This is done via: invalidate_mapping_pages() invalidate_exceptional_entry() dax_invalidate_mapping_entry() However, for page cache pages removed in invalidate_mapping_pages() there is an additional criteria which is that the page must not be mapped. This is noted in the comments above invalidate_mapping_pages() and is checked in invalidate_inode_page(). For DAX entries this means that we can can end up in a situation where a DAX exceptional entry, either a huge zero page or a regular DAX entry, could end up mapped but without an associated radix tree entry. This is inconsistent with the rest of the DAX code and with what happens in the page cache case. We aren't able to unmap the DAX exceptional entry because according to its comments invalidate_mapping_pages() isn't allowed to block, and unmap_mapping_range() takes a write lock on the mapping->i_mmap_rwsem. Since we essentially never have unmapped DAX entries to evict from the radix tree, just remove dax_invalidate_mapping_entry(). Fixes: c6dcf52c23d2 ("mm: Invalidate DAX radix tree entries only if appropriate") Link: http://lkml.kernel.org/r/20170510085419.27601-2-jack@suse.cz Signed-off-by: Ross Zwisler Signed-off-by: Jan Kara Reported-by: Jan Kara Cc: Dan Williams Cc: [4.10+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/dax.c | 29 ----------------------------- include/linux/dax.h | 1 - mm/truncate.c | 9 +++------ 3 files changed, 3 insertions(+), 36 deletions(-) commit cea582247a0aea78b4674c32833c10b8820fcdbe Author: Andrew Morton Date: Fri May 12 15:46:44 2017 -0700 Tigran has moved Cc: Tigran Aivazian Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Documentation/filesystems/bfs.txt | 2 +- MAINTAINERS | 2 +- arch/x86/kernel/cpu/microcode/amd.c | 2 +- arch/x86/kernel/cpu/microcode/core.c | 2 +- arch/x86/kernel/cpu/microcode/intel.c | 2 +- fs/bfs/inode.c | 4 ++-- 6 files changed, 7 insertions(+), 7 deletions(-) commit 8594a21cf7a8318baedbedc3fcd2967a17ddeec0 Author: Michal Hocko Date: Fri May 12 15:46:41 2017 -0700 mm, vmalloc: fix vmalloc users tracking properly Commit 1f5307b1e094 ("mm, vmalloc: properly track vmalloc users") has pulled asm/pgtable.h include dependency to linux/vmalloc.h and that turned out to be a bad idea for some architectures. E.g. m68k fails with In file included from arch/m68k/include/asm/pgtable_mm.h:145:0, from arch/m68k/include/asm/pgtable.h:4, from include/linux/vmalloc.h:9, from arch/m68k/kernel/module.c:9: arch/m68k/include/asm/mcf_pgtable.h: In function 'nocache_page': >> arch/m68k/include/asm/mcf_pgtable.h:339:43: error: 'init_mm' undeclared (first use in this function) #define pgd_offset_k(address) pgd_offset(&init_mm, address) as spotted by kernel build bot. nios2 fails for other reason In file included from include/asm-generic/io.h:767:0, from arch/nios2/include/asm/io.h:61, from include/linux/io.h:25, from arch/nios2/include/asm/pgtable.h:18, from include/linux/mm.h:70, from include/linux/pid_namespace.h:6, from include/linux/ptrace.h:9, from arch/nios2/include/uapi/asm/elf.h:23, from arch/nios2/include/asm/elf.h:22, from include/linux/elf.h:4, from include/linux/module.h:15, from init/main.c:16: include/linux/vmalloc.h: In function '__vmalloc_node_flags': include/linux/vmalloc.h:99:40: error: 'PAGE_KERNEL' undeclared (first use in this function); did you mean 'GFP_KERNEL'? which is due to the newly added #include , which on nios2 includes and thus and which again includes . Tweaking that around just turns out a bigger headache than necessary. This patch reverts 1f5307b1e094 and reimplements the original fix in a different way. __vmalloc_node_flags can stay static inline which will cover vmalloc* functions. We only have one external user (kvmalloc_node) and we can export __vmalloc_node_flags_caller and provide the caller directly. This is much simpler and it doesn't really need any games with header files. [akpm@linux-foundation.org: coding-style fixes] [mhocko@kernel.org: revert old comment] Link: http://lkml.kernel.org/r/20170509211054.GB16325@dhcp22.suse.cz Fixes: 1f5307b1e094 ("mm, vmalloc: properly track vmalloc users") Link: http://lkml.kernel.org/r/20170509153702.GR6481@dhcp22.suse.cz Signed-off-by: Michal Hocko Cc: Tobias Klauser Cc: Geert Uytterhoeven Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/vmalloc.h | 21 ++++++--------------- mm/util.c | 3 ++- mm/vmalloc.c | 19 ++++++++++++++++++- 3 files changed, 26 insertions(+), 17 deletions(-) commit 835152a25949dd5561819c2e3fcc4b2dd27f3e1e Author: SeongJae Park Date: Fri May 12 15:46:38 2017 -0700 mm/khugepaged: add missed tracepoint for collapse_huge_page_swapin One return case of `__collapse_huge_page_swapin()` does not invoke tracepoint while every other return case does. This commit adds a tracepoint invocation for the case. Link: http://lkml.kernel.org/r/20170507101813.30187-1-sj38.park@gmail.com Signed-off-by: SeongJae Park Cc: Kirill A. Shutemov Cc: Johannes Weiner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/khugepaged.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 05384213436ab690c46d9dfec706b80ef8d671ab Author: Martin Liska Date: Fri May 12 15:46:35 2017 -0700 gcov: support GCC 7.1 Starting from GCC 7.1, __gcov_exit is a new symbol expected to be implemented in a profiling runtime. [akpm@linux-foundation.org: coding-style fixes] [mliska@suse.cz: v2] Link: http://lkml.kernel.org/r/e63a3c59-0149-c97e-4084-20ca8f146b26@suse.cz Link: http://lkml.kernel.org/r/8c4084fa-3885-29fe-5fc4-0d4ca199c785@suse.cz Signed-off-by: Martin Liska Acked-by: Peter Oberparleiter Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/gcov/base.c | 6 ++++++ kernel/gcov/gcc_4_7.c | 4 +++- 2 files changed, 9 insertions(+), 1 deletion(-) commit 8d35bb310698c69d73073b26fc581f2e3f7f621d Author: Reza Arbab Date: Fri May 12 15:46:32 2017 -0700 mm, vmstat: Remove spurious WARN() during zoneinfo print After commit e2ecc8a79ed4 ("mm, vmstat: print non-populated zones in zoneinfo"), /proc/zoneinfo will show unpopulated zones. A memoryless node, having no populated zones at all, was previously ignored, but will now trigger the WARN() in is_zone_first_populated(). Remove this warning, as its only purpose was to warn of a situation that has since been enabled. Aside: The "per-node stats" are still printed under the first populated zone, but that's not necessarily the first stanza any more. I'm not sure which criteria is more important with regard to not breaking parsers, but it looks a little weird to the eye. Fixes: e2ecc8a79ed4 ("mm, vmstat: print node-based stats in zoneinfo file") Link: http://lkml.kernel.org/r/1493854905-10918-1-git-send-email-arbab@linux.vnet.ibm.com Signed-off-by: Reza Arbab Cc: David Rientjes Cc: Anshuman Khandual Cc: Vlastimil Babka Cc: Mel Gorman Cc: Johannes Weiner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/vmstat.c | 2 -- 1 file changed, 2 deletions(-) commit 572e0ca9b909339fbe017aaff1a225efb6db3b61 Author: Deepa Dinamani Date: Fri May 12 15:46:29 2017 -0700 time: delete current_fs_time() All uses of the current_fs_time() function have been replaced by other time interfaces. And, its use cases can be fulfilled by current_time() or ktime_get_* variants. Link: http://lkml.kernel.org/r/1491613030-11599-13-git-send-email-deepa.kernel@gmail.com Signed-off-by: Deepa Dinamani Reviewed-by: Arnd Bergmann Cc: John Stultz Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/fs.h | 1 - kernel/time/time.c | 14 -------------- 2 files changed, 15 deletions(-) commit 18365225f0440d09708ad9daade2ec11275c3df9 Author: Michal Hocko Date: Fri May 12 15:46:26 2017 -0700 hwpoison, memcg: forcibly uncharge LRU pages Laurent Dufour has noticed that hwpoinsoned pages are kept charged. In his particular case he has hit a bad_page("page still charged to cgroup") when onlining a hwpoison page. While this looks like something that shouldn't happen in the first place because onlining hwpages and returning them to the page allocator makes only little sense it shows a real problem. hwpoison pages do not get freed usually so we do not uncharge them (at least not since commit 0a31bc97c80c ("mm: memcontrol: rewrite uncharge API")). Each charge pins memcg (since e8ea14cc6ead ("mm: memcontrol: take a css reference for each charged page")) as well and so the mem_cgroup and the associated state will never go away. Fix this leak by forcibly uncharging a LRU hwpoisoned page in delete_from_lru_cache(). We also have to tweak uncharge_list because it cannot rely on zero ref count for these pages. [akpm@linux-foundation.org: coding-style fixes] Fixes: 0a31bc97c80c ("mm: memcontrol: rewrite uncharge API") Link: http://lkml.kernel.org/r/20170502185507.GB19165@dhcp22.suse.cz Signed-off-by: Michal Hocko Reported-by: Laurent Dufour Tested-by: Laurent Dufour Reviewed-by: Balbir Singh Reviewed-by: Naoya Horiguchi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/memcontrol.c | 2 +- mm/memory-failure.c | 7 +++++++ 2 files changed, 8 insertions(+), 1 deletion(-) commit 0fcc3ab23d7395f58e8ab0834e7913e2e4314a83 Merge: deac842 e84b83b Author: Linus Torvalds Date: Fri May 12 15:43:10 2017 -0700 Merge branch 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm fixes from Dan Williams: "Incremental fixes and a small feature addition on top of the main libnvdimm 4.12 pull request: - Geert noticed that tinyconfig was bloated by BLOCK selecting DAX. The size regression is fixed by moving all dax helpers into the dax-core and only specifying "select DAX" for FS_DAX and dax-capable drivers. He also asked for clarification of the NR_DEV_DAX config option which, on closer look, does not need to be a config option at all. Mike also throws in a DEV_DAX_PMEM fixup for good measure. - Ben's attention to detail on -stable patch submissions caught a case where the recent fixes to arch_copy_from_iter_pmem() missed a condition where we strand dirty data in the cache. This is tagged for -stable and will also be included in the rework of the pmem api to a proposed {memcpy,copy_user}_flushcache() interface for 4.13. - Vishal adds a feature that missed the initial pull due to pending review feedback. It allows the kernel to clear media errors when initializing a BTT (atomic sector update driver) instance on a pmem namespace. - Ross noticed that the dax_device + dax_operations conversion broke __dax_zero_page_range(). The nvdimm unit tests fail to check this path, but xfstests immediately trips over it. No excuse for missing this before submitting the 4.12 pull request. These all pass the nvdimm unit tests and an xfstests spot check. The set has received a build success notification from the kbuild robot" * 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: filesystem-dax: fix broken __dax_zero_page_range() conversion libnvdimm, btt: ensure that initializing metadata clears poison libnvdimm: add an atomic vs process context flag to rw_bytes x86, pmem: Fix cache flushing for iovec write < 8 bytes device-dax: kill NR_DEV_DAX block, dax: move "select DAX" from BLOCK to FS_DAX device-dax: Tell kbuild DEV_DAX_PMEM depends on DEV_DAX commit d82dd0e34d0347be201fd274dc84cd645dccc064 Author: Tomasz Majchrzak Date: Fri May 12 14:26:10 2017 +0200 raid1: prefer disk without bad blocks If an array consists of two drives and the first drive has the bad block, the read request to the region overlapping the bad block chooses the same disk (with bad block) as device to read from over and over and the request gets stuck. If the first disk only partially overlaps with bad block, it becomes a candidate ("best disk") for shorter range of sectors. The second disk is capable of reading the entire requested range and it is updated accordingly, however it is not recorded as a best device for the request. In the end the request is sent to the first disk to read entire range of sectors. It fails and is re-tried in a moment but with the same outcome. Actually it is quite likely scenario but it had little exposure in my test until commit 715d40b93b10 ("md/raid1: add failfast handling for reads.") removed preference for idle disk. Such scenario had been passing as second disk was always chosen when idle. Reset a candidate ("best disk") to read from if disk can read entire range. Do it only if other disk has already been chosen as a candidate for a smaller range. The head position / disk type logic will select the best disk to read from - it is fine as disk with bad block won't be considered for it. Signed-off-by: Tomasz Majchrzak Signed-off-by: Shaohua Li drivers/md/raid1.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit f369fdf4f661322b73f3307e9f3cd55fb3a20123 Author: Lv Zheng Date: Tue May 9 15:02:22 2017 +0800 Revert "ACPI / button: Remove lid_init_state=method mode" This reverts commit ecb10b694b72ca5ea51b3c90a71ff2a11963425a. The only expected ACPI control method lid device's usage model is 1. Listen to the lid notification, 2. Evaluate _LID after being notified by BIOS, 3. Suspend the system (if users configure to do so) after seeing "close". It's not ensured that BIOS will notify OS after boot/resume, and it's not ensured that BIOS will always generate "open" event upon opening the lid. But there are 2 wrong usage models: 1. When the lid device is responsible for suspend/resume the system, userspace requires to see "open" event to be paired with "close" after the system is resumed, or it will suspend the system again. 2. When an external monitor connects to the laptop attached docks, userspace requires to see "close" event after the system is resumed so that it can determine whether the internal display should remain dark and the external display should be lit on. After we made default kernel behavior to be suitable for usage model 1, users of usage model 2 start to report regressions for such behavior change. Reversion of button.lid_init_state=method doesn't actually reverts to old default behavior as doing so can enter a regression loop, but facilitates users to work the reported regressions around with button.lid_init_state=method. Fixes: ecb10b694b72 (ACPI / button: Remove lid_init_state=method mode) Cc: 4.11+ # 4.11+ Link: https://bugzilla.kernel.org/show_bug.cgi?id=195455 Link: https://bugzilla.redhat.com/show_bug.cgi?id=1430259 Tested-by: Steffen Weber Tested-by: Julian Wiedmann Reported-by: Joachim Frieben Signed-off-by: Lv Zheng Signed-off-by: Rafael J. Wysocki Documentation/acpi/acpi-lid.txt | 16 ++++++++++++---- drivers/acpi/button.c | 9 +++++++++ 2 files changed, 21 insertions(+), 4 deletions(-) commit bdce57e7ae9cac56cda958029104c752afaf0894 Author: Prarit Bhargava Date: Fri Mar 3 09:44:11 2017 -0500 tools/power/acpi: Add .gitignore file Add a .gitignore file so that git commands do not pick up the resulting binaries and directories. Signed-off-by: Prarit Bhargava Acked-by: Lv Zheng Signed-off-by: Rafael J. Wysocki tools/power/acpi/.gitignore | 4 ++++ 1 file changed, 4 insertions(+) commit deac8429d62ca19c1571853e2a18f60e760ee04c Merge: 6b402bd 31cbee6 Author: Linus Torvalds Date: Fri May 12 12:10:38 2017 -0700 Merge tag 'sound-fix-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "This contains a one-liner change that has a significant impact: disabling the build of OSS. It's been unmaintained for long time, and we'd like to drop the stuff. Finally, as the first step, stop the build. Let's see whether it works without much complaints. Other than that, there are two small fixes for HD-audio" * tag 'sound-fix-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: sound: Disable the build of OSS drivers ALSA: hda: Fix cpu lockup when stopping the cmd dmas ALSA: hda - Add mute led support for HP EliteBook 840 G3 commit 6b402bdfdbafce241cb6789ae38d94f45641078c Merge: 6a776e4 35f4f99 Author: Linus Torvalds Date: Fri May 12 12:02:21 2017 -0700 Merge tag 'for-v4.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull more power-supply updates from Sebastian Reichel: "The power-supply subsystem has a few more changes for the v4.12 merge window: - New battery driver for AXP20X and AXP22X PMICs - Improve max17042_battery for usage on x86 - Misc small cleanups & fixes" * tag 'for-v4.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: (34 commits) power: supply: cpcap-charger: Keep trickle charger bits disabled power: supply: cpcap-charger: Fix enable for 3.8V charge setting power: supply: cpcap-charger: Fix charge voltage configuration power: supply: cpcap-charger: Fix charger name power: supply: twl4030-charger: make twl4030_bci_property_is_writeable static power: supply: sbs-battery: Add alert callback mailmap: add Sebastian Reichel power: supply: avoid unused twl4030-madc.h power: supply: sbs-battery: Correct supply status with current draw power: supply: sbs-battery: Don't ignore the first external power change power: supply: pda_power: move from timer to delayed_work power: supply: max17042_battery: Add support for the SCOPE property power: supply: max17042_battery: Add support for the CHARGE_NOW property power: supply: max17042_battery: Add support for the CHARGE_FULL_DESIGN property power: supply: max17042_battery: mAh readings depend on r_sns value power: supply: max17042_battery: Add support for the VOLT_MIN property power: supply: max17042_battery: Add support for the TECHNOLOGY attribute power: supply: max17042_battery: Add external_power_changed callback power: supply: max17042_battery: Add support for the STATUS property power: supply: max17042_battery: Add default platform_data fallback data ... commit 6a776e47a045462a1df1a3a9592598259ffd614f Merge: a34ab10 cb15c81 Author: Linus Torvalds Date: Fri May 12 11:58:45 2017 -0700 Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux Pull thermal management updates from Zhang Rui: - Fix a problem where orderly_shutdown() is called for multiple times due to multiple critical overheating events raised in a short period by platform thermal driver. (Keerthy) - Introduce a backup thermal shutdown mechanism, which invokes kernel_power_off()/emergency_restart() directly, after orderly_shutdown() being issued for certain amount of time(specified via Kconfig). This is useful in certain conditions that userspace may be unable to power off the system in a clean manner and leaves the system in a critical state, like in the middle of driver probing phase. (Keerthy) - Introduce a new interface in thermal devfreq_cooling code so that the driver can provide more precise data regarding actual power to the thermal governor every time the power budget is calculated. (Lukasz Luba) - Introduce BCM 2835 soc thermal driver and northstar thermal driver, within a new sub-folder. (Rafał Miłecki) - Introduce DA9062/61 thermal driver. (Steve Twiss) - Remove non-DT booting on TI-SoC driver. Also add support to fetching coefficients from DT. (Keerthy) - Refactorf RCAR Gen3 thermal driver. (Niklas Söderlund) - Small fix on MTK and intel-soc-dts thermal driver. (Dawei Chien, Brian Bian) * 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux: (25 commits) thermal: core: Add a back up thermal shutdown mechanism thermal: core: Allow orderly_poweroff to be called only once Thermal: Intel SoC DTS: Change interrupt request behavior trace: thermal: add another parameter 'power' to the tracing function thermal: devfreq_cooling: add new interface for direct power read thermal: devfreq_cooling: refactor code and add get_voltage function thermal: mt8173: minor mtk_thermal.c cleanups thermal: bcm2835: move to the broadcom subdirectory thermal: broadcom: ns: specify myself as MODULE_AUTHOR thermal: da9062/61: Thermal junction temperature monitoring driver Documentation: devicetree: thermal: da9062/61 TJUNC temperature binding thermal: broadcom: add Northstar thermal driver dt-bindings: thermal: add support for Broadcom's Northstar thermal thermal: bcm2835: add thermal driver for bcm2835 SoC dt-bindings: Add thermal zone to bcm2835-thermal example thermal: rcar_gen3_thermal: add suspend and resume support thermal: rcar_gen3_thermal: store device match data in private structure thermal: rcar_gen3_thermal: enable hardware interrupts for trip points thermal: rcar_gen3_thermal: record and check number of TSCs found thermal: rcar_gen3_thermal: check that TSC exists before memory allocation ... commit a34ab101a9d27a2995142b47f9857fb46fcb072a Merge: bd1286f 7b8cd33 Author: Linus Torvalds Date: Fri May 12 11:48:26 2017 -0700 Merge tag 'drm-fixes-for-v4.12-rc1' of git://people.freedesktop.org/~airlied/linux Pull drm fixes from Dave Airlie: "AMD, nouveau, one i915, and one EDID fix for v4.12-rc1 Some fixes that it would be good to have in rc1. It contains the i915 quiet fix that you reported. It also has an amdgpu fixes pull, with lots of ongoing work on Vega10 which is new in this kernel and is preliminary support so may have a fair bit of movement. Otherwise a few non-Vega10 AMD fixes, one EDID fix and some nouveau regression fixers" * tag 'drm-fixes-for-v4.12-rc1' of git://people.freedesktop.org/~airlied/linux: (144 commits) drm/i915: Make vblank evade warnings optional drm/nouveau/therm: remove ineffective workarounds for alarm bugs drm/nouveau/tmr: avoid processing completed alarms when adding a new one drm/nouveau/tmr: fix corruption of the pending list when rescheduling an alarm drm/nouveau/tmr: handle races with hw when updating the next alarm time drm/nouveau/tmr: ack interrupt before processing alarms drm/nouveau/core: fix static checker warning drm/nouveau/fb/ram/gf100-: remove 0x10f200 read drm/nouveau/kms/nv50: skip core channel cursor update on position-only changes drm/nouveau/kms/nv50: fix source-rect-only plane updates drm/nouveau/kms/nv50: remove pointless argument to window atomic_check_acquire() drm/amd/powerplay: refine pwm1_enable callback functions for CI. drm/amd/powerplay: refine pwm1_enable callback functions for vi. drm/amd/powerplay: refine pwm1_enable callback functions for Vega10. drm/amdgpu: refine amdgpu pwm1_enable sysfs interface. drm/amdgpu: add amd fan ctrl mode enums. drm/amd/powerplay: add more smu message on Vega10. drm/amdgpu: fix dependency issue drm/amd: fix init order of sched job drm/amdgpu: add some additional vega10 pci ids ... commit bd1286f964041a2fe5eec8801a51bd79d905bd02 Merge: 0504532 984a9d4 Author: Linus Torvalds Date: Fri May 12 11:44:13 2017 -0700 Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending Pull SCSI target updates from Nicholas Bellinger: "Things were a lot more calm than previously expected. It's primarily fixes in various areas, with most of the new functionality centering around TCMU backend driver work that Xiubo Li has been driving. Here's the summary on the feature side: - Make T10-PI verify configurable for emulated (FILEIO + RD) backends (Dmitry Monakhov) - Allow target-core/TCMU pass-through to use in-kernel SPC-PR logic (Bryant Ly + MNC) - Add TCMU support for growing ring buffer size (Xiubo Li + MNC) - Add TCMU support for global block data pool (Xiubo Li + MNC) and on the bug-fix side: - Fix COMPARE_AND_WRITE non GOOD status handling for READ phase failures (Gary Guo + nab) - Fix iscsi-target hang with explicitly changing per NodeACL CmdSN number depth with concurrent login driven session reinstatement. (Gary Guo + nab) - Fix ibmvscsis fabric driver ABORT task handling (Bryant Ly) - Fix target-core/FILEIO zero length handling (Bart Van Assche) Also, there was an OOPs introduced with the WRITE_VERIFY changes that I ended up reverting at the last minute, because as not unusual Bart and I could not agree on the fix in time for -rc1. Since it's specific to a conformance test, it's been reverted for now. There is a separate patch in the queue to address the underlying control CDB write overflow regression in >= v4.3 separate from the WRITE_VERIFY revert here, that will be pushed post -rc1" * 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending: (30 commits) Revert "target: Fix VERIFY and WRITE VERIFY command parsing" IB/srpt: Avoid that aborting a command triggers a kernel warning IB/srpt: Fix abort handling target/fileio: Fix zero-length READ and WRITE handling ibmvscsis: Do not send aborted task response tcmu: fix module removal due to stuck thread target: Don't force session reset if queue_depth does not change iscsi-target: Set session_fall_back_to_erl0 when forcing reinstatement target: Fix compare_and_write_callback handling for non GOOD status tcmu: Recalculate the tcmu_cmd size to save cmd area memories tcmu: Add global data block pool support tcmu: Add dynamic growing data area feature support target: fixup error message in target_tg_pt_gp_tg_pt_gp_id_store() target: fixup error message in target_tg_pt_gp_alua_access_type_store() target/user: PGR Support target: Add WRITE_VERIFY_16 Documentation/target: add an example script to configure an iSCSI target target: Use kmalloc_array() in transport_kmap_data_sg() target: Use kmalloc_array() in compare_and_write_callback() target: Improve size determinations in two functions ... commit 050453295f808dd683b9a88f58a1b29540097394 Merge: e0c4a5f 4f757f3 Author: Linus Torvalds Date: Fri May 12 11:39:59 2017 -0700 Merge branch 'work.sane_pwd' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull misc vfs updates from Al Viro: "Making sure that something like a referral point won't end up as pwd or root. The main part is the last commit (fixing mntns_install()); that one fixes a hard-to-hit race. The fchdir() commit is making fchdir(2) a bit more robust - it should be impossible to get opened files (even O_PATH ones) for referral points in the first place, so the existing checks are OK, but checking the same thing as in chdir(2) is just as cheap. The path_init() commit removes a redundant check that shouldn't have been there in the first place" * 'work.sane_pwd' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: make sure that mntns_install() doesn't end up with referral for root path_init(): don't bother with checking MAY_EXEC for LOOKUP_ROOT make sure that fchdir() won't accept referral points, etc. commit e0c4a5fc750e22c6f8d5c1ab7cc18592b88852ab Merge: dfcb7b2 88b0193 Author: Linus Torvalds Date: Fri May 12 10:45:36 2017 -0700 Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf updates/fixes from Ingo Molnar: "Mostly tooling updates, but also two kernel fixes: a call chain handling robustness fix and an x86 PMU driver event definition fix" * 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/callchain: Force USER_DS when invoking perf_callchain_user() tools build: Fixup sched_getcpu feature test perf tests kmod-path: Don't fail if compressed modules aren't supported perf annotate: Fix AArch64 comment char perf tools: Fix spelling mistakes perf/x86: Fix Broadwell-EP DRAM RAPL events perf config: Refactor a duplicated code for obtaining config file name perf symbols: Allow user probes on versioned symbols perf symbols: Accept symbols starting at address 0 tools lib string: Adopt prefixcmp() from perf and subcmd perf units: Move parse_tag_value() to units.[ch] perf ui gtk: Move gtk .so name to the only place where it is used perf tools: Move HAS_BOOL define to where perl headers are used perf memswap: Split the byteswap memory range wrappers from util.[ch] perf tools: Move event prototypes from util.h to event.h perf buildid: Move prototypes from util.h to build-id.h commit dfcb7b2379ff90afb9231da040046f4b9eb1c895 Merge: 1b84fc1 f63d947 Author: Linus Torvalds Date: Fri May 12 10:43:25 2017 -0700 Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Ingo Molnar: "A single ARM Juno clocksource driver fix" * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: clocksource/arm_arch_timer: Fix arch_timer_mem_find_best_frame() commit 1b84fc1503f24862d45eafb2e63da72b714da3fa Merge: f1e0527 5ea30e4 Author: Linus Torvalds Date: Fri May 12 10:41:45 2017 -0700 Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull stackprotector fixlet from Ingo Molnar: "A single fix/enhancement to increase stackprotector canary randomness on 64-bit kernels with very little cost" * 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: stackprotector: Increase the per-task stack canary's random range from 32 bits to 64 bits on 64-bit platforms commit f1e0527d2db416dfdef9c55132fed7fa05910101 Merge: 5836e42 fb8fb46 Author: Linus Torvalds Date: Fri May 12 10:11:50 2017 -0700 Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "Misc fixes: - two boot crash fixes - unwinder fixes - kexec related kernel direct mappings enhancements/fixes - more Clang support quirks - minor cleanups - Documentation fixes" * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/intel_rdt: Fix a typo in Documentation x86/build: Don't add -maccumulate-outgoing-args w/o compiler support x86/boot/32: Fix UP boot on Quark and possibly other platforms x86/mm/32: Set the '__vmalloc_start_set' flag in initmem_init() x86/kexec/64: Use gbpages for identity mappings if available x86/mm: Add support for gbpages to kernel_ident_mapping_init() x86/boot: Declare error() as noreturn x86/mm/kaslr: Use the _ASM_MUL macro for multiplication to work around Clang incompatibility x86/mm: Fix boot crash caused by incorrect loop count calculation in sync_global_pgds() x86/asm: Don't use RBP as a temporary register in csum_partial_copy_generic() x86/microcode/AMD: Remove redundant NULL check on mc commit 5836e422e5ca6d36d552f700916436e01cbd2066 Merge: dc2a248 69861e0 Author: Linus Torvalds Date: Fri May 12 10:09:14 2017 -0700 Merge tag 'for-linus-4.12b-rc0c-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: "This contains two fixes for booting under Xen introduced during this merge window and two fixes for older problems, where one is just much more probable due to another merge window change" * tag 'for-linus-4.12b-rc0c-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen: adjust early dom0 p2m handling to xen hypervisor behavior x86/amd: don't set X86_BUG_SYSRET_SS_ATTRS when running under Xen xen/x86: Do not call xen_init_time_ops() until shared_info is initialized x86/xen: fix xsave capability setting commit dc2a24816637ff6c60f08c4245aba01c6e9b6a79 Merge: ac3c4aa 5a61ef7 Author: Linus Torvalds Date: Fri May 12 10:04:09 2017 -0700 Merge tag 'powerpc-4.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull more powerpc updates from Michael Ellerman: "The change to the Linux page table geometry was delayed for more testing with 16G pages, and there's the new CPU features stuff which just needed one more polish before going in. Plus a few changes from Scott which came in a bit late. And then various fixes, mostly minor. Summary highlights: - rework the Linux page table geometry to lower memory usage on 64-bit Book3S (IBM chips) using the Hash MMU. - support for a new device tree binding for discovering CPU features on future firmwares. - Freescale updates from Scott: "Includes a fix for a powerpc/next mm regression on 64e, a fix for a kernel hang on 64e when using a debugger inside a relocated kernel, a qman fix, and misc qe improvements." Thanks to: Christophe Leroy, Gavin Shan, Horia Geantă, LiuHailong, Nicholas Piggin, Roy Pledge, Scott Wood, Valentin Longchamp" * tag 'powerpc-4.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/64s: Support new device tree binding for discovering CPU features powerpc: Don't print cpu_spec->cpu_name if it's NULL of/fdt: introduce of_scan_flat_dt_subnodes and of_get_flat_dt_phandle powerpc/64s: Fix unnecessary machine check handler relocation branch powerpc/mm/book3s/64: Rework page table geometry for lower memory usage powerpc: Fix distclean with Makefile.postlink powerpc/64e: Don't place the stack beyond TASK_SIZE powerpc/powernv: Block PCI config access on BCM5718 during EEH recovery powerpc/8xx: Adding support of IRQ in MPC8xx GPIO soc/fsl/qbman: Disable IRQs for deferred QBMan work soc/fsl/qe: add EXPORT_SYMBOL for the 2 qe_tdm functions soc/fsl/qe: only apply QE_General4 workaround on affected SoCs soc/fsl/qe: round brg_freq to 1kHz granularity soc/fsl/qe: get rid of immrbar_virt_to_phys() net: ethernet: ucc_geth: fix MEM_PART_MURAM mode powerpc/64e: Fix hang when debugging programs with relocated kernel commit ac3c4aa248c5b5390c40fad1ceb0a15a53f57a36 Merge: 0ba1c19 3e44184 Author: Linus Torvalds Date: Fri May 12 09:56:30 2017 -0700 Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus Pull MIPS updates from James Hogan: "math-emu: - Add missing clearing of BLTZALL and BGEZALL emulation counters - Fix BC1EQZ and BC1NEZ condition handling - Fix BLEZL and BGTZL identification BPF: - Add JIT support for SKF_AD_HATYPE - Use unsigned access for unsigned SKB fields - Quit clobbering callee saved registers in JIT code - Fix multiple problems in JIT skb access helpers Loongson 3: - Select MIPS_L1_CACHE_SHIFT_6 Octeon: - Remove vestiges of CONFIG_CAVIUM_OCTEON_2ND_KERNEL - Remove unused L2C types and macros. - Remove unused SLI types and macros. - Fix compile error when USB is not enabled. - Octeon: Remove unused PCIERCX types and macros. - Octeon: Clean up platform code. SNI: - Remove recursive include of cpu-feature-overrides.h Sibyte: - Export symbol periph_rev to sb1250-mac network driver. - Fix Kconfig warning. Generic platform: - Enable Root FS on NFS in generic_defconfig SMP-MT: - Use CPU interrupt controller IPI IRQ domain support UASM: - Add support for LHU for uasm. - Remove needless ISA abstraction mm: - Add 48-bit VA space and 4-level page tables for 4K pages. PCI: - Add controllers before the specified head irqchip driver for MIPS CPU: - Replace magic 0x100 with IE_SW0 - Prepare for non-legacy IRQ domains - Introduce IPI IRQ domain support MAINTAINERS: - Update email-id of Rahul Bedarkar NET: - sb1250-mac: Add missing MODULE_LICENSE() CPUFREQ: - Loongson2: drop set_cpus_allowed_ptr() Misc: - Disable Werror when W= is set - Opt into HAVE_COPY_THREAD_TLS - Enable GENERIC_CPU_AUTOPROBE - Use common outgoing-CPU-notification code - Remove dead define of ST_OFF - Remove CONFIG_ARCH_HAS_ILOG2_U{32,64} - Stengthen IPI IRQ domain sanity check - Remove confusing else statement in __do_page_fault() - Don't unnecessarily include kmalloc.h into . - Delete unused definition of SMP_CACHE_SHIFT. - Delete redundant definition of SMP_CACHE_BYTES" * 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus: (39 commits) MIPS: Sibyte: Fix Kconfig warning. MIPS: Sibyte: Export symbol periph_rev to sb1250-mac network driver. NET: sb1250-mac: Add missing MODULE_LICENSE() MAINTAINERS: Update email-id of Rahul Bedarkar MIPS: Remove confusing else statement in __do_page_fault() MIPS: Stengthen IPI IRQ domain sanity check MIPS: smp-mt: Use CPU interrupt controller IPI IRQ domain support irqchip: mips-cpu: Introduce IPI IRQ domain support irqchip: mips-cpu: Prepare for non-legacy IRQ domains irqchip: mips-cpu: Replace magic 0x100 with IE_SW0 MIPS: Remove CONFIG_ARCH_HAS_ILOG2_U{32,64} MIPS: generic: Enable Root FS on NFS in generic_defconfig MIPS: mach-rm: Remove recursive include of cpu-feature-overrides.h MIPS: Opt into HAVE_COPY_THREAD_TLS CPUFREQ: Loongson2: drop set_cpus_allowed_ptr() MIPS: uasm: Remove needless ISA abstraction MIPS: Remove dead define of ST_OFF MIPS: Use common outgoing-CPU-notification code MIPS: math-emu: Fix BC1EQZ and BC1NEZ condition handling MIPS: r2-on-r6-emu: Clear BLTZALL and BGEZALL debugfs counters ... commit 0ba1c1950c320fcfdfe3dbc7470884e4a390083c Merge: 09d79d1 e118c3f Author: Linus Torvalds Date: Fri May 12 09:53:16 2017 -0700 Merge tag 'nios2-v4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/lftan/nios2 Pull nios2 updates from Ley Foon Tan: "nios2 fixes/enhancements and adding nios2 R2 support" * tag 'nios2-v4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/lftan/nios2: nios2: remove custom early console implementation nios2: use generic strncpy_from_user() and strnlen_user() nios2: Add CDX support nios2: Add BMX support nios2: Add NIOS2_ARCH_REVISION to select between R1 and R2 nios2: implement flush_dcache_mmap_lock/unlock nios2: enable earlycon support nios2: constify irq_domain_ops nios2: remove wrapper header for cmpxchg.h nios2: add .gitignore entries for auto-generated files commit 1c4d5f51a812a82de97beee24f48ed05c65ebda5 Author: Neil Horman Date: Fri May 12 12:00:01 2017 -0400 vmxnet3: ensure that adapter is in proper state during force_close There are several paths in vmxnet3, where settings changes cause the adapter to be brought down and back up (vmxnet3_set_ringparam among them). Should part of the reset operation fail, these paths call vmxnet3_force_close, which enables all napi instances prior to calling dev_close (with the expectation that vmxnet3_close will then properly disable them again). However, vmxnet3_force_close neglects to clear VMXNET3_STATE_BIT_QUIESCED prior to calling dev_close. As a result vmxnet3_quiesce_dev (called from vmxnet3_close), returns early, and leaves all the napi instances in a enabled state while the device itself is closed. If a device in this state is activated again, napi_enable will be called on already enabled napi_instances, leading to a BUG halt. The fix is to simply enausre that the QUIESCED bit is cleared in vmxnet3_force_close to allow quesence to be completed properly on close. Signed-off-by: Neil Horman CC: Shrikrishna Khare CC: "VMware, Inc." CC: "David S. Miller" Signed-off-by: David S. Miller drivers/net/vmxnet3/vmxnet3_drv.c | 5 +++++ 1 file changed, 5 insertions(+) commit 42e6cae1b35b186650f5abc7b24c20ab6986c5a0 Author: Bert Kenward Date: Fri May 12 17:18:50 2017 +0100 sfc: revert changes to NIC revision numbers The revision enum values (eg EFX_REV_HUNT_A0) form part of our API, and are included in ethtool. If these are inconsistent then ethtool will print garbage for a register dump (ethtool -d). Fixes: 5a6681e22c14 ("sfc: separate out SFC4000 ("Falcon") support into new sfc-falcon driver") Signed-off-by: Edward Cree Signed-off-by: David S. Miller drivers/net/ethernet/sfc/nic.h | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit b12ca80ca145cecadf841ba27cc061c510cd97ca Author: Johan Hovold Date: Fri May 12 12:13:26 2017 +0200 net: ch9200: add missing USB-descriptor endianness conversions Add the missing endianness conversions to a debug statement printing the USB device-descriptor idVendor and idProduct fields during probe. Signed-off-by: Johan Hovold Signed-off-by: David S. Miller drivers/net/usb/ch9200.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 75cf067953d5ee543b3bda90bbfcbee5e1f94ae8 Author: Johan Hovold Date: Fri May 12 12:11:13 2017 +0200 net: irda: irda-usb: fix firmware name on big-endian hosts Add missing endianness conversion when using the USB device-descriptor bcdDevice field to construct a firmware file name. Fixes: 8ef80aef118e ("[IRDA]: irda-usb.c: STIR421x cleanups") Cc: stable # 2.6.18 Cc: Nick Fedchik Signed-off-by: Johan Hovold Signed-off-by: David S. Miller drivers/net/irda/irda-usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9fc3e4dc67fde953fd26adb3cea8f92597810b64 Author: Gustavo A. R. Silva Date: Thu May 11 22:11:29 2017 -0500 net: dsa: mv88e6xxx: add default case to switch Add default case to switch in order to avoid any chance of using an uninitialized variable _low_, in case s->type does not match any of the listed case values. Addresses-Coverity-ID: 1398130 Suggested-by: Andrew Lunn Signed-off-by: Gustavo A. R. Silva Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx/chip.c | 3 +++ 1 file changed, 3 insertions(+) commit dbc2b5e9a09e9a6664679a667ff81cff6e5f2641 Author: Xin Long Date: Fri May 12 14:39:52 2017 +0800 sctp: fix src address selection if using secondary addresses for ipv6 Commit 0ca50d12fe46 ("sctp: fix src address selection if using secondary addresses") has fixed a src address selection issue when using secondary addresses for ipv4. Now sctp ipv6 also has the similar issue. When using a secondary address, sctp_v6_get_dst tries to choose the saddr which has the most same bits with the daddr by sctp_v6_addr_match_len. It may make some cases not work as expected. hostA: [1] fd21:356b:459a:cf10::11 (eth1) [2] fd21:356b:459a:cf20::11 (eth2) hostB: [a] fd21:356b:459a:cf30::2 (eth1) [b] fd21:356b:459a:cf40::2 (eth2) route from hostA to hostB: fd21:356b:459a:cf30::/64 dev eth1 metric 1024 mtu 1500 The expected path should be: fd21:356b:459a:cf10::11 <-> fd21:356b:459a:cf30::2 But addr[2] matches addr[a] more bits than addr[1] does, according to sctp_v6_addr_match_len. It causes the path to be: fd21:356b:459a:cf20::11 <-> fd21:356b:459a:cf30::2 This patch is to fix it with the same way as Marcelo's fix for sctp ipv4. As no ip_dev_find for ipv6, this patch is to use ipv6_chk_addr to check if the saddr is in a dev instead. Note that for backwards compatibility, it will still do the addr_match_len check here when no optimal is found. Reported-by: Patrick Talbert Signed-off-by: Xin Long Signed-off-by: David S. Miller net/sctp/ipv6.c | 46 +++++++++++++++++++++++++++++----------------- 1 file changed, 29 insertions(+), 17 deletions(-) commit 9459a04b6a5a09967eec94a1b66f0a74312819d9 Author: MaJun Date: Fri May 12 11:55:28 2017 +0800 irqchip/mbigen: Fix the clear register offset calculation The register array offset for clearing an interrupt is calculated by: offset = (hwirq - RESERVED_IRQ_PER_MBIGEN_CHIP) / 32; This is wrong because the clear register array includes the reserved interrupts. So the clear operation ends up in the wrong register. This went unnoticed so far, because the hardware clears the real bit through a timeout mechanism when the hardware is configured in debug mode. That debug mode was enabled on early generations of the hardware, so the problem was papered over. On newer hardware with updated firmware the debug mode was disabled, so the bits did not get cleared which causes the system to malfunction. Remove the subtraction of RESERVED_IRQ_PER_MBIGEN_CHIP, so the correct register is accessed. [ tglx: Rewrote changelog ] Fixes: a6c2f87b8820 ("irqchip/mbigen: Implement the mbigen irq chip operation functions") Signed-off-by: MaJun Signed-off-by: Hanjun Guo Acked-by: Marc Zyngier Cc: Kefeng Wang Cc: linuxarm@huawei.com Cc: Wei Yongjun Link: http://lkml.kernel.org/r/1494561328-39514-4-git-send-email-guohanjun@huawei.com Signed-off-by: Thomas Gleixner drivers/irqchip/irq-mbigen.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) commit ad7cc3c0c57d77b442db323056354d0e49833569 Author: Hanjun Guo Date: Fri May 12 11:55:27 2017 +0800 irqchip/mbigen: Fix potential NULL dereferencing platform_get_resource() may return NULL, add proper check to avoid potential NULL dereferencing. Signed-off-by: Hanjun Guo Acked-by: Marc Zyngier Cc: Kefeng Wang Cc: linuxarm@huawei.com Cc: Wei Yongjun Cc: MaJun Link: http://lkml.kernel.org/r/1494561328-39514-3-git-send-email-guohanjun@huawei.com Signed-off-by: Thomas Gleixner drivers/irqchip/irq-mbigen.c | 3 +++ 1 file changed, 3 insertions(+) commit 5ba9b0a14132d0b8d97affe909f324045a968d03 Author: Hanjun Guo Date: Fri May 12 11:55:26 2017 +0800 irqchip/mbigen: Fix memory mapping code Some mbigens share memory regions, and devm_ioremap_resource does not allow to share resources which will break the probe of mbigen, in opposition to devm_ioremap. This patch restores back usage of devm_ioremap function, but with proper error handling and logging. Fixes: 216646e4d82e ("irqchip/mbigen: Fix return value check in mbigen_device_probe()") Signed-off-by: Hanjun Guo Acked-by: Marc Zyngier Cc: Kefeng Wang Cc: linuxarm@huawei.com Cc: Wei Yongjun Cc: MaJun Link: http://lkml.kernel.org/r/1494561328-39514-2-git-send-email-guohanjun@huawei.com Signed-off-by: Thomas Gleixner drivers/irqchip/irq-mbigen.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 31cbee6a5611f07d2d66f55bb6f8648db5947e32 Author: Takashi Iwai Date: Thu May 11 11:14:45 2017 +0200 sound: Disable the build of OSS drivers OSS drivers are left as badly unmaintained, and now we're facing a problem to clean up the hackish set_fs() usage in their codes. Since most of drivers have been covered by ALSA, and the others are dead old and inactive, let's leave them RIP. This patch is the first step: disable the build of OSS drivers. We'll eventually drop the whole codes and clean up later. Note that sound/oss/dmasound is still kept, since it's a completely different implementation of OSS, and it doesn't suffer from set_fs() hack. Moreover, the build of ALSA is disabled on M68K by some reason, thus disabling it shall result in a regression. This one will be disabled / removed once when we add the support in ALSA side. Tested-by: Randy Dunlap Signed-off-by: Takashi Iwai sound/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 76d837a4c0f905f98088877d780169d7a14a6b29 Author: Paul Mackerras Date: Thu May 11 14:31:59 2017 +1000 KVM: PPC: Book3S PR: Don't include SPAPR TCE code on non-pseries platforms Commit e91aa8e6ecd5 ("KVM: PPC: Enable IOMMU_API for KVM_BOOK3S_64 permanently", 2017-03-22) enabled the SPAPR TCE code for all 64-bit Book 3S kernel configurations in order to simplify the code and reduce #ifdefs. However, 64-bit Book 3S PPC platforms other than pseries and powernv don't implement the necessary IOMMU callbacks, leading to build failures like the following (for a pasemi config): scripts/kconfig/conf --silentoldconfig Kconfig warning: (KVM_BOOK3S_64) selects SPAPR_TCE_IOMMU which has unmet direct dependencies (IOMMU_SUPPORT && (PPC_POWERNV || PPC_PSERIES)) ... CC [M] arch/powerpc/kvm/book3s_64_vio.o /home/paulus/kernel/kvm/arch/powerpc/kvm/book3s_64_vio.c: In function ‘kvmppc_clear_tce’: /home/paulus/kernel/kvm/arch/powerpc/kvm/book3s_64_vio.c:363:2: error: implicit declaration of function ‘iommu_tce_xchg’ [-Werror=implicit-function-declaration] iommu_tce_xchg(tbl, entry, &hpa, &dir); ^ To fix this, we make the inclusion of the SPAPR TCE support, and the code that uses it in book3s_vio.c and book3s_vio_hv.c, depend on the inclusion of support for the pseries and/or powernv platforms. This means that when running a 'pseries' guest on those platforms, the guest won't have in-kernel acceleration of the PAPR TCE hypercalls, but at least now they compile. Reviewed-by: Alexey Kardashevskiy Signed-off-by: Paul Mackerras arch/powerpc/kvm/Kconfig | 2 +- arch/powerpc/kvm/Makefile | 4 ++-- arch/powerpc/kvm/book3s_pr_papr.c | 36 +++++++++++++++++++++++++++--------- arch/powerpc/kvm/powerpc.c | 4 +++- 4 files changed, 33 insertions(+), 13 deletions(-) commit 5ddf0440a1a28f00f69ed2e093476bab3b60c2c3 Author: Song Liu Date: Thu May 11 17:03:44 2017 -0700 md/r5cache: handle sync with data in write back cache Currently, sync of raid456 array cannot make progress when hitting data in writeback r5cache. This patch fixes this issue by flushing cached data of the stripe before processing the sync request. This is achived by: 1. In handle_stripe(), do not set STRIPE_SYNCING if the stripe is in write back cache; 2. In r5c_try_caching_write(), handle the stripe in sync with write through; 3. In do_release_stripe(), make stripe in sync write out and send it to the state machine. Shaohua: explictly set STRIPE_HANDLE after write out completed Signed-off-by: Song Liu Signed-off-by: Shaohua Li drivers/md/raid5-cache.c | 8 +++++++- drivers/md/raid5.c | 21 +++++++++++++++------ 2 files changed, 22 insertions(+), 7 deletions(-) commit 70d466f760b351fe30b5f8c956354ddf29aa676b Author: Song Liu Date: Thu May 11 15:28:28 2017 -0700 md/r5cache: gracefully handle journal device errors for writeback mode For the raid456 with writeback cache, when journal device failed during normal operation, it is still possible to persist all data, as all pending data is still in stripe cache. However, it is necessary to handle journal failure gracefully. During journal failures, the following logic handles the graceful shutdown of journal: 1. raid5_error() marks the device as Faulty and schedules async work log->disable_writeback_work; 2. In disable_writeback_work (r5c_disable_writeback_async), the mddev is suspended, set to write through, and then resumed. mddev_suspend() flushes all cached stripes; 3. All cached stripes need to be flushed carefully to the RAID array. This patch fixes issues within the process above: 1. In r5c_update_on_rdev_error() schedule disable_writeback_work for journal failures; 2. In r5c_disable_writeback_async(), wait for MD_SB_CHANGE_PENDING, since raid5_error() updates superblock. 3. In handle_stripe(), allow stripes with data in journal (s.injournal > 0) to make progress during log_failed; 4. In delay_towrite(), if log failed only process data in the cache (skip new writes in dev->towrite); 5. In __get_priority_stripe(), process loprio_list during journal device failures. 6. In raid5_remove_disk(), wait for all cached stripes are flushed before calling log_exit(). Signed-off-by: Song Liu Signed-off-by: Shaohua Li drivers/md/raid5-cache.c | 11 +++++++++-- drivers/md/raid5-log.h | 3 ++- drivers/md/raid5.c | 29 +++++++++++++++++++++++------ 3 files changed, 34 insertions(+), 9 deletions(-) commit 67325e988faea735d663799b6d152b5f4254093c Author: Paul Mackerras Date: Thu May 11 11:33:30 2017 +1000 KVM: PPC: Book3S PR: Check copy_to/from_user return values The PR KVM implementation of the PAPR HPT hypercalls (H_ENTER etc.) access an image of the HPT in userspace memory using copy_from_user and copy_to_user. Recently, the declarations of those functions were annotated to indicate that the return value must be checked. Since this code doesn't currently check the return value, this causes compile warnings like the ones shown below, and since on PPC the default is to compile arch/powerpc with -Werror, this causes the build to fail. To fix this, we check the return values, and if non-zero, fail the hypercall being processed with a H_FUNCTION error return value. There is really no good error return value to use since PAPR didn't envisage the possibility that the hypervisor may not be able to access the guest's HPT, and H_FUNCTION (function not supported) seems as good as any. The typical compile warnings look like this: CC arch/powerpc/kvm/book3s_pr_papr.o /home/paulus/kernel/kvm/arch/powerpc/kvm/book3s_pr_papr.c: In function ‘kvmppc_h_pr_enter’: /home/paulus/kernel/kvm/arch/powerpc/kvm/book3s_pr_papr.c:53:2: error: ignoring return value of ‘copy_from_user’, declared with attribute warn_unused_result [-Werror=unused-result] copy_from_user(pteg, (void __user *)pteg_addr, sizeof(pteg)); ^ /home/paulus/kernel/kvm/arch/powerpc/kvm/book3s_pr_papr.c:74:2: error: ignoring return value of ‘copy_to_user’, declared with attribute warn_unused_result [-Werror=unused-result] copy_to_user((void __user *)pteg_addr, hpte, HPTE_SIZE); ^ ... etc. Signed-off-by: Paul Mackerras arch/powerpc/kvm/book3s_pr_papr.c | 34 ++++++++++++++++++++++++++-------- 1 file changed, 26 insertions(+), 8 deletions(-) commit acde25726bc6034b628febb8a4c6c0838736ccbf Author: Paul Mackerras Date: Wed May 10 16:39:41 2017 +1000 KVM: PPC: Book3S HV: Add radix checks in real-mode hypercall handlers POWER9 running a radix guest will take some hypervisor interrupts without going to real mode (turning off the MMU). This means that early hypercall handlers may now be called in virtual mode. Most of the handlers work just fine in both modes, but there are some that can crash the host if called in virtual mode, notably the TCE (IOMMU) hypercalls H_PUT_TCE, H_STUFF_TCE and H_PUT_TCE_INDIRECT. These already have both a real-mode and a virtual-mode version, so we arrange for the real-mode version to return H_TOO_HARD for radix guests, which will result in the virtual-mode version being called. The other hypercall which is sensitive to the MMU mode is H_RANDOM. It doesn't have a virtual-mode version, so this adds code to enable it to be called in either mode. An alternative solution was considered which would refuse to call any of the early hypercall handlers when doing a virtual-mode exit from a radix guest. However, the XICS-on-XIVE code depends on the XICS hypercalls being handled early even for virtual-mode exits, because the handlers need to be called before the XIVE vCPU state has been pulled off the hardware. Therefore that solution would have become quite invasive and complicated, and was rejected in favour of the simpler, though less elegant, solution presented here. Reviewed-by: David Gibson Tested-by: David Gibson Signed-off-by: Paul Mackerras arch/powerpc/kvm/book3s_64_vio_hv.c | 13 +++++++++++++ arch/powerpc/kvm/book3s_hv_builtin.c | 9 ++++++++- 2 files changed, 21 insertions(+), 1 deletion(-) commit 7b8cd3363e8a0e6b90a7067f75aaeaae61a7d612 Author: Ville Syrjälä Date: Sun May 7 20:12:52 2017 +0300 drm/i915: Make vblank evade warnings optional Add a new Kconfig option to enable/disable the extra warnings from the vblank evade code. For now we'll keep the warning about an actually missed vblank always enabled as that can have an actual user visible impact. But if we miss the deadline othrwise there's no real need to bother the user with that. We'll want these warnings enabled during development however so that we can catch regressions. Based on the reports it looks like this is still very easy to hit on SKL, so we have more work ahead of us to optimize the crtiical section further. Cc: Daniel Vetter Cc: Jani Nikula Cc: Dave Airlie Cc: Jens Axboe Cc: Linus Torvalds Cc: Maarten Lankhorst Reported-by: Jens Axboe Reported-by: Linus Torvalds Fixes: e1edbd44e23b ("drm/i915: Complain if we take too long under vblank evasion.") Signed-off-by: Ville Syrjälä Reviewed-by: Daniel Vetter Signed-off-by: Dave Airlie drivers/gpu/drm/i915/Kconfig.debug | 13 +++++++++++++ drivers/gpu/drm/i915/intel_sprite.c | 7 +++++-- 2 files changed, 18 insertions(+), 2 deletions(-) commit bb57d0411a41f525c88f0ca3cc29936e0b879a1b Merge: 7ec2723 e4311ee Author: Dave Airlie Date: Fri May 12 14:25:22 2017 +1000 Merge branch 'linux-4.12' of git://github.com/skeggsb/linux into drm-next Quite a few patches, but not much code changed: - Fixes regression from atomic when only the source rect of a plane changes (ie. xrandr --right-of) - Fixes another issue where atomic changed behaviour underneath us, potentially causing laggy cursor position updates - Fixes for a bunch of races in thermal code, which lead to random lockups for a lot of users * 'linux-4.12' of git://github.com/skeggsb/linux: drm/nouveau/therm: remove ineffective workarounds for alarm bugs drm/nouveau/tmr: avoid processing completed alarms when adding a new one drm/nouveau/tmr: fix corruption of the pending list when rescheduling an alarm drm/nouveau/tmr: handle races with hw when updating the next alarm time drm/nouveau/tmr: ack interrupt before processing alarms drm/nouveau/core: fix static checker warning drm/nouveau/fb/ram/gf100-: remove 0x10f200 read drm/nouveau/kms/nv50: skip core channel cursor update on position-only changes drm/nouveau/kms/nv50: fix source-rect-only plane updates drm/nouveau/kms/nv50: remove pointless argument to window atomic_check_acquire() commit 7ec27233e62b5efe795563896577de5340dc7473 Merge: bab1e2f afa3187 Author: Dave Airlie Date: Fri May 12 13:58:29 2017 +1000 Merge branch 'drm-next-4.12' of git://people.freedesktop.org/~agd5f/linux into drm-next Fixes for 4.12. This is a bit bigger than usual since it's 3 weeks worth of fixes and most of these changes are for vega10 which is new for 4.12 and still in a fair amount of flux. It looks like you missed my last pull request, so those patches are included here as well. Highlights: - Lots of vega10 fixes - Fix interruptable wait mixup - Fan control method fixes - Misc display fixes for radeon and amdgpu - Misc bug fixes * 'drm-next-4.12' of git://people.freedesktop.org/~agd5f/linux: (132 commits) drm/amd/powerplay: refine pwm1_enable callback functions for CI. drm/amd/powerplay: refine pwm1_enable callback functions for vi. drm/amd/powerplay: refine pwm1_enable callback functions for Vega10. drm/amdgpu: refine amdgpu pwm1_enable sysfs interface. drm/amdgpu: add amd fan ctrl mode enums. drm/amd/powerplay: add more smu message on Vega10. drm/amdgpu: fix dependency issue drm/amd: fix init order of sched job drm/amdgpu: add some additional vega10 pci ids drm/amdgpu/soc15: use atomfirmware for setting bios scratch for reset drm/amdgpu/atomfirmware: add function to update engine hang status drm/radeon: only warn once in radeon_ttm_bo_destroy if va list not empty drm/amdgpu: fix mutex list null pointer reference drm/amd/powerplay: fix bug sclk/mclk level can't be set on vega10. drm/amd/powerplay: Setup sw CTF to allow graceful exit when temperature exceeds maximum. drm/amd/powerplay: delete dead code in powerplay. drm/amdgpu: Use less generic enum definitions drm/amdgpu/gfx9: derive tile pipes from golden settings drm/amdgpu/gfx: drop max_gs_waves_per_vgt drm/amd/powerplay: disable engine spread spectrum feature on Vega10. ... commit bab1e2fe4b82a853076e6752a49a456244110f8b Merge: 09d79d1 e345da8 Author: Dave Airlie Date: Fri May 12 13:57:20 2017 +1000 Merge tag 'drm-misc-next-fixes-2017-05-05' of git://anongit.freedesktop.org/git/drm-misc into drm-next Core Changes: - Add quirk for LGD 764 panel to default 10bpc (Mario) Cc: Mario Kleiner * tag 'drm-misc-next-fixes-2017-05-05' of git://anongit.freedesktop.org/git/drm-misc: drm/edid: Add 10 bpc quirk for LGD 764 panel in HP zBook 17 G2 commit 48ae8484e9fc324b4968d33c585e54bc98e44d61 Author: Johannes Thumshirn Date: Wed May 10 09:53:40 2017 +0200 scsi: sg: don't return bogus Sg_requests If the list search in sg_get_rq_mark() fails to find a valid request, we return a bogus element. This then can later lead to a GPF in sg_remove_scat(). So don't return bogus Sg_requests in sg_get_rq_mark() but NULL in case the list search doesn't find a valid request. Signed-off-by: Johannes Thumshirn Reported-by: Andrey Konovalov Cc: Hannes Reinecke Cc: Christoph Hellwig Cc: Doug Gilbert Reviewed-by: Hannes Reinecke Acked-by: Doug Gilbert Signed-off-by: Martin K. Petersen drivers/scsi/sg.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit ed44fd7fd8a6785b73cfc6d44594c434e578d724 Author: Damien Le Moal Date: Mon May 8 15:48:19 2017 +0900 scsi: sd: Write lock zone for REQ_OP_WRITE_ZEROES For a zoned block device, sd_zbc_complete() handles zone write unlock on completion of a REQ_OP_WRITE_ZEROES command but the zone write locking is missing from sd_setup_write_zeroes_cmnd(). This patch fixes this problem by locking the target zone of a REQ_OP_WRITE_ZEROES request. Signed-off-by: Damien Le Moal Signed-off-by: Martin K. Petersen drivers/scsi/sd.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) commit 29f6ca6916e29fc46f1418885374d9ed50430687 Author: Damien Le Moal Date: Mon May 8 14:59:02 2017 +0900 scsi: sd: Unlock zone in case of error in sd_setup_write_same_cmnd() scsi_io_init() may fail, leaving a zone of a zoned block device locked. Fix this by properly unlocking the write same request target zone if scsi_io_init() fails. Signed-off-by: Damien Le Moal Signed-off-by: Martin K. Petersen drivers/scsi/sd.c | 4 ++++ 1 file changed, 4 insertions(+) commit df0c8d911abf6ba97b2c2fc3c5a12769e0b081a3 Author: Florian Fainelli Date: Thu May 11 11:24:16 2017 -0700 net: phy: Call bus->reset() after releasing PHYs from reset The API convention makes it that a given MDIO bus reset should be able to access PHY devices in its reset() callback and perform additional MDIO accesses in order to bring the bus and PHYs in a working state. Commit 69226896ad63 ("mdio_bus: Issue GPIO RESET to PHYs.") broke that contract by first calling bus->reset() and then release all PHYs from reset using their shared GPIO line, so restore the expected functionality here. Fixes: 69226896ad63 ("mdio_bus: Issue GPIO RESET to PHYs.") Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/phy/mdio_bus.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 6832a333ed4a7cc4fcb170c045d1d96d0976fdd4 Author: David S. Miller Date: Thu May 11 19:30:02 2017 -0700 bpf: Handle multiple variable additions into packet pointers in verifier. We must accumulate into reg->aux_off rather than use a plain assignment. Add a test for this situation to test_align. Reported-by: Alexei Starovoitov Signed-off-by: David S. Miller kernel/bpf/verifier.c | 2 +- tools/testing/selftests/bpf/test_align.c | 37 ++++++++++++++++++++++++++++++++ 2 files changed, 38 insertions(+), 1 deletion(-) commit 844cf763fba654436d3a4279b6a672c196cf1901 Author: Jon Paul Maloy Date: Thu May 11 20:28:15 2017 +0200 tipc: make macro tipc_wait_for_cond() smp safe The macro tipc_wait_for_cond() is embedding the macro sk_wait_event() to fulfil its task. The latter, in turn, is evaluating the stated condition outside the socket lock context. This is problematic if the condition is accessing non-trivial data structures which may be altered by incoming interrupts, as is the case with the cong_links() linked list, used by socket to keep track of the current set of congested links. We sometimes see crashes when this list is accessed by a condition function at the same time as a SOCK_WAKEUP interrupt is removing an element from the list. We fix this by expanding selected parts of sk_wait_event() into the outer macro, while ensuring that all evaluations of a given condition are performed under socket lock protection. Fixes: commit 365ad353c256 ("tipc: reduce risk of user starvation during link congestion") Reviewed-by: Parthasarathy Bhuvaragan Signed-off-by: Jon Maloy Signed-off-by: David S. Miller net/tipc/socket.c | 38 +++++++++++++++++++------------------- 1 file changed, 19 insertions(+), 19 deletions(-) commit ad990dbe6d3ac3af1f5f4484b1126b9fc601e98a Author: Andy Gospodarek Date: Thu May 11 15:52:30 2017 -0400 samples/bpf: run cleanup routines when receiving SIGTERM Shahid Habib noticed that when xdp1 was killed from a different console the xdp program was not cleaned-up properly in the kernel and it continued to forward traffic. Most of the applications in samples/bpf cleanup properly, but only when getting SIGINT. Since kill defaults to using SIGTERM, add support to cleanup when the application receives either SIGINT or SIGTERM. Signed-off-by: Andy Gospodarek Reported-by: Shahid Habib Acked-by: Alexei Starovoitov Acked-by: Daniel Borkmann Signed-off-by: David S. Miller samples/bpf/cookie_uid_helper_example.c | 4 +++- samples/bpf/offwaketime_user.c | 1 + samples/bpf/sampleip_user.c | 1 + samples/bpf/trace_event_user.c | 1 + samples/bpf/tracex2_user.c | 1 + samples/bpf/xdp1_user.c | 1 + samples/bpf/xdp_tx_iptunnel_user.c | 1 + 7 files changed, 9 insertions(+), 1 deletion(-) commit d2be3667f3769b3c60aa294ef7f2b03d1b16559c Author: Colin Ian King Date: Thu May 11 19:29:40 2017 +0100 ethernet: aquantia: remove redundant checks on error status The error status err is initialized as zero and then being checked several times to see if it is less than zero even when it has not been updated. It may seem that the err should be assigned to the return code of the call to the various *offload_en_set calls and then we check for failure, however, these functions are void and never actually return any status. Since these error checks are redundant we can remove these as well as err and the error exit label err_exit. Detected by CoverityScan, CID#1398313 and CID#1398306 ("Logically dead code") Signed-off-by: Colin Ian King Reviewed-by: Lino Sanfilippo Acked-by: Pavel Belous Signed-off-by: David S. Miller drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c | 13 +------------ drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c | 12 +----------- 2 files changed, 2 insertions(+), 23 deletions(-) commit 69a73e744db1a57175039e3d1e6ef3913e816eb8 Author: David S. Miller Date: Thu May 11 21:41:09 2017 -0400 bpf: Remove commented out debugging hack in test_align. Reported-by: Alexander Alemayhu Signed-off-by: David S. Miller tools/testing/selftests/bpf/test_align.c | 1 - 1 file changed, 1 deletion(-) commit 34e934b9f94552fe0274dda9849e194197eab8e6 Merge: d86b567 33c16bf Author: David S. Miller Date: Thu May 11 21:39:53 2017 -0400 Merge branch 'qlcnic-fixes' Manish Chopra says: ==================== qlcnic: Bug fix and update version This series has one fix and bumps up driver version. Please consider applying to "net" ==================== Signed-off-by: David S. Miller commit 33c16bfd5bc00bbb9823d25af46c496966e0ac0d Author: Chopra, Manish Date: Thu May 11 07:12:48 2017 -0700 qlcnic: Update version to 5.3.66 Bumping up the version as couple of fixes added after 5.3.65 Signed-off-by: Manish Chopra Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qlcnic/qlcnic.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit f9c3fe2f43343be7972226c2e736e7a68e383dc1 Author: Chopra, Manish Date: Thu May 11 07:12:47 2017 -0700 qlcnic: Fix link configuration with autoneg disabled Currently driver returns error on speed configurations for 83xx adapter's non XGBE ports, due to this link doesn't come up on the ports using 1000Base-T as a connector with autoneg disabled. This patch fixes this with initializing appropriate port type based on queried module/connector types from hardware before any speed/autoneg configuration. Signed-off-by: Manish Chopra Signed-off-by: David S. Miller .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | 34 ++++++++++++++++++++++ .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h | 1 + .../net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c | 3 ++ 3 files changed, 38 insertions(+) commit d86b5672b1adb98b4cdd6fbf0224bbfb03db6e2e Author: Vitaly Kuznetsov Date: Thu May 11 13:58:06 2017 +0200 xen-netfront: avoid crashing on resume after a failure in talk_to_netback() Unavoidable crashes in netfront_resume() and netback_changed() after a previous fail in talk_to_netback() (e.g. when we fail to read MAC from xenstore) were discovered. The failure path in talk_to_netback() does unregister/free for netdev but we don't reset drvdata and we try accessing it after resume. Fix the bug by removing the whole xen device completely with device_unregister(), this guarantees we won't have any calls into netfront after a failure. Signed-off-by: Vitaly Kuznetsov Signed-off-by: David S. Miller drivers/net/xen-netfront.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit cb395b2010879a8461aa1b1c37025769708c32cf Author: Eric Dumazet Date: Wed May 10 21:59:28 2017 -0700 net: sched: optimize class dumps In commit 59cc1f61f09c ("net: sched: convert qdisc linked list to hashtable") we missed the opportunity to considerably speed up tc_dump_tclass_root() if a qdisc handle is provided by user. Instead of iterating all the qdiscs, use qdisc_match_from_root() to directly get the one we look for. Signed-off-by: Eric Dumazet Cc: Jiri Kosina Cc: Jamal Hadi Salim Cc: Cong Wang Cc: Jiri Pirko Signed-off-by: David S. Miller net/sched/sch_api.c | 6 ++++++ 1 file changed, 6 insertions(+) commit b451e5d24ba6687c6f0e7319c727a709a1846c06 Author: Yuchung Cheng Date: Wed May 10 17:01:27 2017 -0700 tcp: avoid fragmenting peculiar skbs in SACK This patch fixes a bug in splitting an SKB during SACK processing. Specifically if an skb contains multiple packets and is only partially sacked in the higher sequences, tcp_match_sack_to_skb() splits the skb and marks the second fragment as SACKed. The current code further attempts rounding up the first fragment to MSS boundaries. But it misses a boundary condition when the rounded-up fragment size (pkt_len) is exactly skb size. Spliting such an skb is pointless and causses a kernel warning and aborts the SACK processing. This patch universally checks such over-split before calling tcp_fragment to prevent these unnecessary warnings. Fixes: adb92db857ee ("tcp: Make SACK code to split only at mss boundaries") Signed-off-by: Yuchung Cheng Signed-off-by: Eric Dumazet Signed-off-by: Soheil Hassas Yeganeh Acked-by: Neal Cardwell Signed-off-by: David S. Miller net/ipv4/tcp_input.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit f6ba8d33cfbb46df569972e64dbb5bb7e929bfd9 Author: Eric Dumazet Date: Thu May 11 15:24:41 2017 -0700 netem: fix skb_orphan_partial() I should have known that lowering skb->truesize was dangerous :/ In case packets are not leaving the host via a standard Ethernet device, but looped back to local sockets, bad things can happen, as reported by Michael Madsen ( https://bugzilla.kernel.org/show_bug.cgi?id=195713 ) So instead of tweaking skb->truesize, lets change skb->destructor and keep a reference on the owner socket via its sk_refcnt. Fixes: f2f872f9272a ("netem: Introduce skb_orphan_partial() helper") Signed-off-by: Eric Dumazet Reported-by: Michael Madsen Signed-off-by: David S. Miller net/core/sock.c | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-) commit 4e3c60ed2f594e4ec6bb81d71ef6993e60f740d8 Merge: 0a5539f d67b9cd Author: David S. Miller Date: Thu May 11 21:30:58 2017 -0400 Merge branch 'generic-xdp-followups' Daniel Borkmann says: ==================== Two generic xdp related follow-ups Two follow-ups for the generic XDP API, would be great if both could still be considered, since the XDP API is not frozen yet. For details please see individual patches. v1 -> v2: - Implemented feedback from Jakub Kicinski (reusing attribute on dump), thanks! - Rest as is. ==================== Signed-off-by: David S. Miller commit d67b9cd28c1d7f82c2e5e727731ea7c89b23a0a8 Author: Daniel Borkmann Date: Fri May 12 01:04:46 2017 +0200 xdp: refine xdp api with regards to generic xdp While working on the iproute2 generic XDP frontend, I noticed that as of right now it's possible to have native *and* generic XDP programs loaded both at the same time for the case when a driver supports native XDP. The intended model for generic XDP from b5cdae3291f7 ("net: Generic XDP") is, however, that only one out of the two can be present at once which is also indicated as such in the XDP netlink dump part. The main rationale for generic XDP is to ease accessibility (in case a driver does not yet have XDP support) and to generically provide a semantical model as an example for driver developers wanting to add XDP support. The generic XDP option for an XDP aware driver can still be useful for comparing and testing both implementations. However, it is not intended to have a second XDP processing stage or layer with exactly the same functionality of the first native stage. Only reason could be to have a partial fallback for future XDP features that are not supported yet in the native implementation and we probably also shouldn't strive for such fallback and instead encourage native feature support in the first place. Given there's currently no such fallback issue or use case, lets not go there yet if we don't need to. Therefore, change semantics for loading XDP and bail out if the user tries to load a generic XDP program when a native one is present and vice versa. Another alternative to bailing out would be to handle the transition from one flavor to another gracefully, but that would require to bring the device down, exchange both types of programs, and bring it up again in order to avoid a tiny window where a packet could hit both hooks. Given this complicates the logic for just a debugging feature in the native case, I went with the simpler variant. For the dump, remove IFLA_XDP_FLAGS that was added with b5cdae3291f7 and reuse IFLA_XDP_ATTACHED for indicating the mode. Dumping all or just a subset of flags that were used for loading the XDP prog is suboptimal in the long run since not all flags are useful for dumping and if we start to reuse the same flag definitions for load and dump, then we'll waste bit space. What we really just want is to dump the mode for now. Current IFLA_XDP_ATTACHED semantics are: nothing was installed (0), a program is running at the native driver layer (1). Thus, add a mode that says that a program is running at generic XDP layer (2). Applications will handle this fine in that older binaries will just indicate that something is attached at XDP layer, effectively this is similar to IFLA_XDP_FLAGS attr that we would have had modulo the redundancy. Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: David S. Miller include/linux/netdevice.h | 8 +++++-- include/uapi/linux/if_link.h | 7 ++++++ net/core/dev.c | 55 +++++++++++++++++++++++++++++--------------- net/core/rtnetlink.c | 40 +++++++++++++++----------------- 4 files changed, 67 insertions(+), 43 deletions(-) commit 0489df9a430e9607de8130a6bc4bf4c02f96eaf1 Author: Daniel Borkmann Date: Fri May 12 01:04:45 2017 +0200 xdp: add flag to enforce driver mode After commit b5cdae3291f7 ("net: Generic XDP") we automatically fall back to a generic XDP variant if the driver does not support native XDP. Allow for an option where the user can specify that always the native XDP variant should be selected and in case it's not supported by a driver, just bail out. Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: David S. Miller include/uapi/linux/if_link.h | 6 ++++-- net/core/dev.c | 2 ++ net/core/rtnetlink.c | 5 +++++ samples/bpf/xdp1_user.c | 8 ++++++-- samples/bpf/xdp_tx_iptunnel_user.c | 7 ++++++- 5 files changed, 23 insertions(+), 5 deletions(-) commit 3af9256150b3ecc597c5428711f87ce105d1d58e Author: Arnd Bergmann Date: Thu May 11 10:14:06 2017 -0700 Input: cros_ec_keyb - remove extraneous 'const' gcc-7 warns about 'const SIMPLE_DEV_PM_OPS', as that macro already contains a 'const' keyword: drivers/input/keyboard/cros_ec_keyb.c:663:14: error: duplicate 'const' declaration specifier [-Werror=duplicate-decl-specifier] static const SIMPLE_DEV_PM_OPS(cros_ec_keyb_pm_ops, NULL, cros_ec_keyb_resume); This removes the extra one. Fixes: 6af6dc2d2aa6 ("input: Add ChromeOS EC keyboard driver") Signed-off-by: Arnd Bergmann Signed-off-by: Dmitry Torokhov drivers/input/keyboard/cros_ec_keyb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e4311ee51d1e2676001b2d8fcefd92bdd79aad85 Author: Ben Skeggs Date: Thu May 11 17:33:39 2017 +1000 drm/nouveau/therm: remove ineffective workarounds for alarm bugs These were ineffective due to touching the list without the alarm lock, but should no longer be required. Signed-off-by: Ben Skeggs Cc: stable@vger.kernel.org drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/therm/fan.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/therm/fantog.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/therm/temp.c | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) commit 330bdf62fe6a6c5b99a647f7bf7157107c9348b3 Author: Ben Skeggs Date: Thu May 11 17:13:29 2017 +1000 drm/nouveau/tmr: avoid processing completed alarms when adding a new one The idea here was to avoid having to "manually" program the HW if there's a new earliest alarm. This was lazy and bad, as it leads to loads of fun races between inter-related callers (ie. therm). Turns out, it's not so difficult after all. Go figure ;) Signed-off-by: Ben Skeggs Cc: stable@vger.kernel.org drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) commit 9fc64667ee48c9a25e7dca1a6bcb6906fec5bcc5 Author: Ben Skeggs Date: Thu May 11 17:03:05 2017 +1000 drm/nouveau/tmr: fix corruption of the pending list when rescheduling an alarm At least therm/fantog "attempts" to work around this issue, which could lead to corruption of the pending alarm list. Fix it properly by not updating the timestamp without the lock held, or trying to add an already pending alarm to the pending alarm list.... Signed-off-by: Ben Skeggs Cc: stable@vger.kernel.org drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) commit 1b0f84380b10ee97f7d2dd191294de9017e94d1d Author: Ben Skeggs Date: Thu May 11 17:19:48 2017 +1000 drm/nouveau/tmr: handle races with hw when updating the next alarm time If the time to the next alarm is short enough, we could race with HW and end up with an ~4 second delay until it triggers. Fix this by checking again after we update HW. Signed-off-by: Ben Skeggs Cc: stable@vger.kernel.org drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c | 26 +++++++++++++++--------- 1 file changed, 16 insertions(+), 10 deletions(-) commit 3733bd8b407211739e72d051e5f30ad82a52c4bc Author: Ben Skeggs Date: Thu May 11 16:53:42 2017 +1000 drm/nouveau/tmr: ack interrupt before processing alarms Fixes a race where we can miss an alarm that triggers while we're already processing previous alarms. Signed-off-by: Ben Skeggs Cc: stable@vger.kernel.org drivers/gpu/drm/nouveau/nvkm/subdev/timer/nv04.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 89ed10a5721d569b053a8355c1a6bd812fed7c29 Author: Ben Skeggs Date: Thu May 4 17:29:03 2017 +1000 drm/nouveau/core: fix static checker warning object->engine cannot be NULL, it's either valid, or an error pointer. This particular condition shouldn't actually be possible, but just in case, we'll keep it. Reported-by: Dan Carpenter Signed-off-by: Ben Skeggs drivers/gpu/drm/nouveau/nvkm/core/object.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 80a92865f2113fe8bc268218b0c4156cfab4c9ac Author: Ben Skeggs Date: Tue Mar 28 11:46:37 2017 +1000 drm/nouveau/fb/ram/gf100-: remove 0x10f200 read This reg has moved on Pascal, and causes a bus fault. We never use the value anyway, so just remove the read. Signed-off-by: Ben Skeggs drivers/gpu/drm/nouveau/nvkm/subdev/fb/ramgf100.c | 1 - 1 file changed, 1 deletion(-) commit 23b245c04d0ef408087430dd4d1b214a5da1eb78 Author: Shaohua Li Date: Wed May 10 08:47:11 2017 -0700 md/raid1/10: avoid unnecessary locking If we add bios to block plugging list, locking is unnecessry, since the block unplug is guaranteed not to run at that time. Reviewed-by: NeilBrown Signed-off-by: Shaohua Li drivers/md/raid1.c | 7 +++---- drivers/md/raid10.c | 7 +++---- 2 files changed, 6 insertions(+), 8 deletions(-) commit e6db95799b1b870aae15682a6d0898df9e9dfb38 Author: Ben Skeggs Date: Mon May 1 16:53:40 2017 +1000 drm/nouveau/kms/nv50: skip core channel cursor update on position-only changes The DRM core used to only call prepare_fb/cleanup_fb() when a plane's framebuffer changed, which achieved the desired effect. It's apparently now up to the driver to decide on its own. Signed-off-by: Ben Skeggs Cc: stable@vger.kernel.org [4.11+] drivers/gpu/drm/nouveau/nv50_display.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) commit 36601c2b36e27435d9be33cfa092120ff69914eb Author: Ben Skeggs Date: Mon May 1 16:52:03 2017 +1000 drm/nouveau/kms/nv50: fix source-rect-only plane updates This "optimisation" (which was originally meant to skip updating cursor settings in the core channel on position-only updates) turned out to be pointless in the final design of the code before it was merged. Remove it completely, as it breaks other cases. Signed-off-by: Ben Skeggs Cc: stable@vger.kernel.org [4.10+] drivers/gpu/drm/nouveau/nv50_display.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) commit f42c5707f9344a2e30128cde5ca2a02775e58994 Author: Ben Skeggs Date: Mon May 1 16:59:29 2017 +1000 drm/nouveau/kms/nv50: remove pointless argument to window atomic_check_acquire() Signed-off-by: Ben Skeggs drivers/gpu/drm/nouveau/nv50_display.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) commit 0a5539f66133a02b24f9cc43da5b84b7e6f3f436 Author: David S. Miller Date: Thu May 11 12:00:50 2017 -0700 bpf: Provide a linux/types.h override for bpf selftests. We do not want to use the architecture's type.h header when building BPF programs which are always 64-bit. Signed-off-by: David S. Miller tools/testing/selftests/bpf/Makefile | 3 ++- tools/testing/selftests/bpf/include/uapi/linux/types.h | 6 ++++++ 2 files changed, 8 insertions(+), 1 deletion(-) commit 09d79d103371b1b7ea70ea7f9c05ac207ef22f5d Merge: e47b40a 25a0da7 Author: Linus Torvalds Date: Thu May 11 11:29:52 2017 -0700 Merge tag 'docs-4.12-2' of git://git.lwn.net/linux Pull more documentation updates from Jonathan Corbet: "Connect the newly RST-formatted documentation to the rest; this had to wait until the input pull was done. There's also a few small fixes that wandered in" * tag 'docs-4.12-2' of git://git.lwn.net/linux: doc: replace FTP URL to kernel.org with HTTPS one docs: update references to the device io book Documentation: earlycon: fix Marvell Armada 3700 UART name docs-rst: add input docs at main index and use kernel-figure commit e47b40a235e9552bc48e4c73c53854ce734da661 Merge: 4892c6f 0c2cf6d Author: Linus Torvalds Date: Thu May 11 11:27:54 2017 -0700 Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull more arm64 updates from Catalin Marinas: - Silence module allocation failures when CONFIG_ARM*_MODULE_PLTS is enabled. This requires a check for __GFP_NOWARN in alloc_vmap_area() - Improve/sanitise user tagged pointers handling in the kernel - Inline asm fixes/cleanups * tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: Silence first allocation with CONFIG_ARM64_MODULE_PLTS=y ARM: Silence first allocation with CONFIG_ARM_MODULE_PLTS=y mm: Silence vmap() allocation failures based on caller gfp_flags arm64: uaccess: suppress spurious clang warning arm64: atomic_lse: match asm register sizes arm64: armv8_deprecated: ensure extension of addr arm64: uaccess: ensure extension of access_ok() addr arm64: ensure extension of smp_store_release value arm64: xchg: hazard against entire exchange variable arm64: documentation: document tagged pointer stack constraints arm64: entry: improve data abort handling of tagged pointers arm64: hw_breakpoint: fix watchpoint matching for tagged pointers arm64: traps: fix userspace cache maintenance emulation on a tagged pointer commit 228b0324fe61781c8a6939032da644e677f6d01b Merge: d8b5411 18b3ad9 Author: David S. Miller Date: Thu May 11 14:19:10 2017 -0400 Merge branch 'bpf-pkt-ptr-align' David S. Miller says: ==================== bpf: Add alignment tracker to verifier. First we add the alignment tracking logic to the verifier. Next, we work on building up infrastructure to facilitate regression testing of this facility. Finally, we add the "test_align" test case. ==================== Signed-off-by: David S. Miller commit 18b3ad90b64e9893297357608abddd26170730eb Author: David S. Miller Date: Wed May 10 11:43:51 2017 -0700 bpf: Add verifier test case for alignment. Signed-off-by: David S. Miller Acked-by: Daniel Borkmann tools/testing/selftests/bpf/Makefile | 3 +- tools/testing/selftests/bpf/test_align.c | 417 +++++++++++++++++++++++++++++++ 2 files changed, 419 insertions(+), 1 deletion(-) commit 91045f5e5238a6d2ad21d41d7e86e2fa65f90d76 Author: David S. Miller Date: Wed May 10 11:42:48 2017 -0700 bpf: Add bpf_verify_program() to the library. This allows a test case to load a BPF program and unconditionally acquire the verifier log. It also allows specification of the strict alignment flag. Signed-off-by: David S. Miller Acked-by: Daniel Borkmann tools/lib/bpf/bpf.c | 22 ++++++++++++++++++++++ tools/lib/bpf/bpf.h | 4 ++++ 2 files changed, 26 insertions(+) commit e07b98d9bffe410019dfcf62c3428d4a96c56a2c Author: David S. Miller Date: Wed May 10 11:38:07 2017 -0700 bpf: Add strict alignment flag for BPF_PROG_LOAD. Add a new field, "prog_flags", and an initial flag value BPF_F_STRICT_ALIGNMENT. When set, the verifier will enforce strict pointer alignment regardless of the setting of CONFIG_EFFICIENT_UNALIGNED_ACCESS. The verifier, in this mode, will also use a fixed value of "2" in place of NET_IP_ALIGN. This facilitates test cases that will exercise and validate this part of the verifier even when run on architectures where alignment doesn't matter. Signed-off-by: David S. Miller Acked-by: Daniel Borkmann include/linux/bpf_verifier.h | 1 + include/uapi/linux/bpf.h | 8 ++++++++ kernel/bpf/syscall.c | 5 ++++- kernel/bpf/verifier.c | 23 +++++++++++++++++------ tools/build/feature/test-bpf.c | 1 + tools/include/uapi/linux/bpf.h | 11 +++++++++-- 6 files changed, 40 insertions(+), 9 deletions(-) commit c5fc9692d101d1318b0f53f9f691cd88ac029317 Author: David S. Miller Date: Wed May 10 11:25:17 2017 -0700 bpf: Do per-instruction state dumping in verifier when log_level > 1. If log_level > 1, do a state dump every instruction and emit it in a more compact way (without a leading newline). This will facilitate more sophisticated test cases which inspect the verifier log for register state. Signed-off-by: David S. Miller Acked-by: Daniel Borkmann kernel/bpf/verifier.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit d1174416747d790d750742d0514915deeed93acf Author: David S. Miller Date: Wed May 10 11:22:52 2017 -0700 bpf: Track alignment of register values in the verifier. Currently if we add only constant values to pointers we can fully validate the alignment, and properly check if we need to reject the program on !CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS architectures. However, once an unknown value is introduced we only allow byte sized memory accesses which is too restrictive. Add logic to track the known minimum alignment of register values, and propagate this state into registers containing pointers. The most common paradigm that makes use of this new logic is computing the transport header using the IP header length field. For example: struct ethhdr *ep = skb->data; struct iphdr *iph = (struct iphdr *) (ep + 1); struct tcphdr *th; ... n = iph->ihl; th = ((void *)iph + (n * 4)); port = th->dest; The existing code will reject the load of th->dest because it cannot validate that the alignment is at least 2 once "n * 4" is added the the packet pointer. In the new code, the register holding "n * 4" will have a reg->min_align value of 4, because any value multiplied by 4 will be at least 4 byte aligned. (actually, the eBPF code emitted by the compiler in this case is most likely to use a shift left by 2, but the end result is identical) At the critical addition: th = ((void *)iph + (n * 4)); The register holding 'th' will start with reg->off value of 14. The pointer addition will transform that reg into something that looks like: reg->aux_off = 14 reg->aux_off_align = 4 Next, the verifier will look at the th->dest load, and it will see a load offset of 2, and first check: if (reg->aux_off_align % size) which will pass because aux_off_align is 4. reg_off will be computed: reg_off = reg->off; ... reg_off += reg->aux_off; plus we have off==2, and it will thus check: if ((NET_IP_ALIGN + reg_off + off) % size != 0) which evaluates to: if ((NET_IP_ALIGN + 14 + 2) % size != 0) On strict alignment architectures, NET_IP_ALIGN is 2, thus: if ((2 + 14 + 2) % size != 0) which passes. These pointer transformations and checks work regardless of whether the constant offset or the variable with known alignment is added first to the pointer register. Signed-off-by: David S. Miller Acked-by: Daniel Borkmann include/linux/bpf_verifier.h | 3 ++ kernel/bpf/verifier.c | 108 +++++++++++++++++++++++++++++++++++-------- 2 files changed, 92 insertions(+), 19 deletions(-) commit 4892c6f72e4b335b162edadbefc5378cea4f0ee1 Merge: 55a1ab5 34bf129 Author: Linus Torvalds Date: Thu May 11 11:12:26 2017 -0700 Merge tag 'fbdev-v4.12' of git://github.com/bzolnier/linux Pull fbdev updates from Bartlomiej Zolnierkiewicz: "There is nothing really major here, just a couple of small bugfixes, improvements and cleanups. - fix handling of probing errors in omapfb (Arvind Yadav) - remove incorrect __exit markups in few drivers (Dmitry Torokhov) - fix boot time logo support for drivers using deferred probe (Takeshi Kihara) - fix DMA allocation size for ARM CLCD driver (Liam Beguin) - add support for specifying size via xenstore in xen-frontfb (Juergen Gross) - support for AUS mode in imxfb driver (Martin Kaiser) - fix buffer on stack usage in udlfb driver (Maksim Salau) - probe failure path fixup in sm501fb driver (Alexey Khoroshilov) - fix config dependency loop for stifb driver (Arnd Bergmann) - misc cleanups (Joe Perches, Christophe Leroy, Karim Eshapa, Pushkar Jambhlekar)" * tag 'fbdev-v4.12' of git://github.com/bzolnier/linux: fbdev: sti: don't select CONFIG_VT drivers/video/fbdev/omap/lcd_mipid.c: Use time comparison kernel macros sm501fb: don't return zero on failure path in sm501fb_start() video: fbdev: udlfb: Fix buffer on stack video: console: Remove reference to CONFIG_8xx dt-bindings: display: imx: entry for AUS mode video: fbdev: imxfb: support AUS mode drivers/video/fbdev: Fixing coding guidelines in acornfb.c xen, fbfront: add support for specifying size via xenstore video: ARM CLCD: fix dma allocation size drivers/video: Convert remaining uses of pr_warning to pr_warn video/logo: tidyup fb_logo_late_init initcall timing video: fbdev: i810: remove incorrect __exit markups video: fbdev: pmag-aa-fb: remove incorrect __exit markups video: fbdev: pmagb-b-fb: remove incorrect __exit markups video: fbdev: pmag-ba-fb: remove incorrect __exit markups omapfb: dss: Handle return errors in dss_init_ports() commit 55a1ab56c7981ab84373f372a4df75e3ee1535a7 Merge: 9786e34 ed6565e Author: Linus Torvalds Date: Thu May 11 11:01:56 2017 -0700 Merge branch 'for-linus' of git://git.kernel.dk/linux-block Pull block fixes from Jens Axboe: "A smaller collection of fixes that should go into -rc1. This contains: - A fix from Christoph, fixing a regression with the WRITE_SAME and partial completions. Caused a BUG() on ppc. - Fixup for __blk_mq_stop_hw_queues(), it should be static. From Colin. - Removal of dmesg error messages on elevator switching, when invoked from sysfs. From me. - Fix for blk-stat, using this_cpu_ptr() in a section only protected by rcu_read_lock(). This breaks when PREEMPT_RCU is enabled. From me. - Two fixes for BFQ from Paolo, one fixing a crash and one updating the documentation. - An error handling lightnvm memory leak, from Rakesh. - The previous blk-mq hot unplug lock reversal depends on the CPU hotplug rework that isn't in mainline yet. This caused a lockdep splat when people unplugged CPUs with blk-mq devices. From Wanpeng. - A regression fix for DIF/DIX on blk-mq. From Wen" * 'for-linus' of git://git.kernel.dk/linux-block: block: handle partial completions for special payload requests blk-mq: NVMe 512B/4K+T10 DIF/DIX format returns I/O error on dd with split op blk-stat: don't use this_cpu_ptr() in a preemptable section elevator: remove redundant warnings on IO scheduler switch block, bfq: stress that low_latency must be off to get max throughput block, bfq: use pointer entity->sched_data only if set nvme: lightnvm: fix memory leak blk-mq: make __blk_mq_stop_hw_queues static lightnvm: remove unused rq parameter of nvme_nvm_rqtocmd() to kill warning block/mq: fix potential deadlock during cpu hotplug commit 25a0da73f24c95d57381bedd9cd89e4929b1bfde Author: Michael Heimpold Date: Thu May 11 10:13:44 2017 +0200 doc: replace FTP URL to kernel.org with HTTPS one FTP services were shutdown some weeks ago, so the FTP URL does not work anymore. Fix this by replacing it with corresponding HTTPS URL. Signed-off-by: Michael Heimpold Signed-off-by: Jonathan Corbet Documentation/admin-guide/README.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9786e34e0a6055dbd1b46e16dfa791ac2b3da289 Merge: 791a9a6 a940288 Author: Linus Torvalds Date: Thu May 11 10:44:22 2017 -0700 Merge tag 'for-linus-20170510' of git://git.infradead.org/linux-mtd Pull MTD updates from Brian Norris: "NAND, from Boris: - some minor fixes/improvements on existing drivers (fsmc, gpio, ifc, davinci, brcmnand, omap) - a huge cleanup/rework of the denali driver accompanied with core fixes/improvements to simplify the driver code - a complete rewrite of the atmel driver to support new DT bindings make future evolution easier - the addition of per-vendor detection/initialization steps to avoid extending the nand_ids table with more extended-id entries SPI NOR, from Cyrille: - fixes in the hisi, intel and Mediatek SPI controller drivers - fixes to some SPI flash memories not supporting the Chip Erase command. - add support to some new memory parts (Winbond, Macronix, Micron, ESMT). - add new driver for the STM32 QSPI controller And a few fixes for Gemini and Versatile platforms on physmap-of" * tag 'for-linus-20170510' of git://git.infradead.org/linux-mtd: (100 commits) MAINTAINERS: Update NAND subsystem git repositories mtd: nand: gpio: update binding mtd: nand: add ooblayout for old hamming layout mtd: oxnas_nand: Allocating more than necessary in probe() dt-bindings: mtd: Document the STM32 QSPI bindings mtd: mtk-nor: set controller's address width according to nor flash mtd: spi-nor: add driver for STM32 quad spi flash controller mtd: nand: brcmnand: Check flash #WP pin status before nand erase/program mtd: nand: davinci: add comment on NAND subpage write status on keystone mtd: nand: omap2: Fix partition creation via cmdline mtdparts mtd: nand: NULL terminate a of_device_id table mtd: nand: Fix a couple error codes mtd: nand: allow drivers to request minimum alignment for passed buffer mtd: nand: allocate aligned buffers if NAND_OWN_BUFFERS is unset mtd: nand: denali: allow to override revision number mtd: nand: denali_dt: use pdev instead of ofdev for platform_device mtd: nand: denali_dt: remove dma-mask DT property mtd: nand: denali: support 64bit capable DMA engine mtd: nand: denali_dt: enable HW_ECC_FIXUP for Altera SOCFPGA variant mtd: nand: denali: support HW_ECC_FIXUP capability ... commit d8b54110ee944de522ccd3531191f39986ec20f9 Author: Daniel Borkmann Date: Thu May 11 01:53:15 2017 +0200 bpf, arm64: fix faulty emission of map access in tail calls Shubham was recently asking on netdev why in arm64 JIT we don't multiply the index for accessing the tail call map by 8. That led me into testing out arm64 JIT wrt tail calls and it turned out I got a NULL pointer dereference on the tail call. The buggy access is at: prog = array->ptrs[index]; if (prog == NULL) goto out; [...] 00000060: d2800e0a mov x10, #0x70 // #112 00000064: f86a682a ldr x10, [x1,x10] 00000068: f862694b ldr x11, [x10,x2] 0000006c: b40000ab cbz x11, 0x00000080 [...] The code triggering the crash is f862694b. x1 at the time contains the address of the bpf array, x10 offsetof(struct bpf_array, ptrs). Meaning, above we load the pointer to the program at map slot 0 into x10. x10 can then be NULL if the slot is not occupied, which we later on try to access with a user given offset in x2 that is the map index. Fix this by emitting the following instead: [...] 00000060: d2800e0a mov x10, #0x70 // #112 00000064: 8b0a002a add x10, x1, x10 00000068: d37df04b lsl x11, x2, #3 0000006c: f86b694b ldr x11, [x10,x11] 00000070: b40000ab cbz x11, 0x00000084 [...] This basically adds the offset to ptrs to the base address of the bpf array we got and we later on access the map with an index * 8 offset relative to that. The tail call map itself is basically one large area with meta data at the head followed by the array of prog pointers. This makes tail calls working again, tested on Cavium ThunderX ARMv8. Fixes: ddb55992b04d ("arm64: bpf: implement bpf_tail_call() helper") Reported-by: Shubham Bansal Signed-off-by: Daniel Borkmann Signed-off-by: David S. Miller arch/arm64/net/bpf_jit_comp.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 5b6cb43b4d625b04a4049d727a116edbfe5cf0f4 Author: Ivan Khoronzhuk Date: Wed May 10 10:28:05 2017 -0700 net: ethernet: ti: netcp_core: return error while dma channel open issue Fix error path while dma open channel issue. Also, no need to check output on NULL if it's never returned. Signed-off-by: Ivan Khoronzhuk Signed-off-by: David S. Miller drivers/net/ethernet/ti/netcp_core.c | 6 ++++-- drivers/soc/ti/knav_dma.c | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) commit dc319c4bbc1e297befba195d7ed22fc28b30df63 Merge: b601616 ebccc739 Author: David S. Miller Date: Thu May 11 12:37:49 2017 -0400 Merge branch 's390-net-fixes' Julian Wiedmann says: ==================== s390/net fixes some qeth fixes for -net, the OSM/OSN one being the most crucial. Please also queue these up for stable. ==================== Signed-off-by: David S. Miller commit ebccc7397e4a49ff64c8f44a54895de9d32fe742 Author: Ursula Braun Date: Wed May 10 19:07:54 2017 +0200 s390/qeth: add missing hash table initializations commit 5f78e29ceebf ("qeth: optimize IP handling in rx_mode callback") added new hash tables, but missed to initialize them. Fixes: 5f78e29ceebf ("qeth: optimize IP handling in rx_mode callback") Signed-off-by: Ursula Braun Reviewed-by: Julian Wiedmann Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller drivers/s390/net/qeth_l3_main.c | 2 ++ 1 file changed, 2 insertions(+) commit 25e2c341e7818a394da9abc403716278ee646014 Author: Julian Wiedmann Date: Wed May 10 19:07:53 2017 +0200 s390/qeth: avoid null pointer dereference on OSN Access card->dev only after checking whether's its valid. Signed-off-by: Julian Wiedmann Reviewed-by: Ursula Braun Signed-off-by: David S. Miller drivers/s390/net/qeth_l2_main.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit 2d2ebb3ed0c6acfb014f98e427298673a5d07b82 Author: Julian Wiedmann Date: Wed May 10 19:07:52 2017 +0200 s390/qeth: unbreak OSM and OSN support commit b4d72c08b358 ("qeth: bridgeport support - basic control") broke the support for OSM and OSN devices as follows: As OSM and OSN are L2 only, qeth_core_probe_device() does an early setup by loading the l2 discipline and calling qeth_l2_probe_device(). In this context, adding the l2-specific bridgeport sysfs attributes via qeth_l2_create_device_attributes() hits a BUG_ON in fs/sysfs/group.c, since the basic sysfs infrastructure for the device hasn't been established yet. Note that OSN actually has its own unique sysfs attributes (qeth_osn_devtype), so the additional attributes shouldn't be created at all. For OSM, add a new qeth_l2_devtype that contains all the common and l2-specific sysfs attributes. When qeth_core_probe_device() does early setup for OSM or OSN, assign the corresponding devtype so that the ccwgroup probe code creates the full set of sysfs attributes. This allows us to skip qeth_l2_create_device_attributes() in case of an early setup. Any device that can't do early setup will initially have only the generic sysfs attributes, and when it's probed later qeth_l2_probe_device() adds the l2-specific attributes. If an early-setup device is removed (by calling ccwgroup_ungroup()), device_unregister() will - using the devtype - delete the l2-specific attributes before qeth_l2_remove_device() is called. So make sure to not remove them twice. What complicates the issue is that qeth_l2_probe_device() and qeth_l2_remove_device() is also called on a device when its layer2 attribute changes (ie. its layer mode is switched). For early-setup devices this wouldn't work properly - we wouldn't remove the l2-specific attributes when switching to L3. But switching the layer mode doesn't actually make any sense; we already decided that the device can only operate in L2! So just refuse to switch the layer mode on such devices. Note that OSN doesn't have a layer2 attribute, so we only need to special-case OSM. Based on an initial patch by Ursula Braun. Fixes: b4d72c08b358 ("qeth: bridgeport support - basic control") Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller drivers/s390/net/qeth_core.h | 4 ++++ drivers/s390/net/qeth_core_main.c | 17 +++++++++-------- drivers/s390/net/qeth_core_sys.c | 22 ++++++++++++++-------- drivers/s390/net/qeth_l2.h | 2 ++ drivers/s390/net/qeth_l2_main.c | 17 +++++++++++++---- drivers/s390/net/qeth_l2_sys.c | 8 ++++++++ drivers/s390/net/qeth_l3_main.c | 1 + 7 files changed, 51 insertions(+), 20 deletions(-) commit 9111e7880ccf419548c7b0887df020b08eadb075 Author: Ursula Braun Date: Wed May 10 19:07:51 2017 +0200 s390/qeth: handle sysfs error during initialization When setting up the device from within the layer discipline's probe routine, creating the layer-specific sysfs attributes can fail. Report this error back to the caller, and handle it by releasing the layer discipline. Signed-off-by: Ursula Braun [jwi: updated commit msg, moved an OSN change to a subsequent patch] Signed-off-by: Julian Wiedmann Signed-off-by: David S. Miller drivers/s390/net/qeth_core_main.c | 4 +++- drivers/s390/net/qeth_core_sys.c | 2 ++ drivers/s390/net/qeth_l2_main.c | 5 ++++- drivers/s390/net/qeth_l3_main.c | 5 ++++- 4 files changed, 13 insertions(+), 3 deletions(-) commit b60161668199ac62011c024adc9e66713b9554e7 Author: Jon Mason Date: Wed May 10 11:20:27 2017 -0400 mdio: mux: Correct mdio_mux_init error path issues There is a potential unnecessary refcount decrement on error path of put_device(&pb->mii_bus->dev), as it is possible to avoid the of_mdio_find_bus() call if mux_bus is specified by the calling function. The same put_device() is not called in the error path if the devm_kzalloc of pb fails. This caused the variable used in the put_device() to be changed, as the pb pointer was obviously not set up. There is an unnecessary of_node_get() on child_bus_node if the of_mdiobus_register() is successful, as the for_each_available_child_of_node() automatically increments this. Thus the refcount on this node will always be +1 more than it should be. There is no of_node_put() on child_bus_node if the of_mdiobus_register() call fails. Finally, it is lacking devm_kfree() of pb in the error path. While this might not be technically necessary, it was present in other parts of the function. So, I am adding it where necessary to make it uniform. Signed-off-by: Jon Mason Fixes: f20e6657a875 ("mdio: mux: Enhanced MDIO mux framework for integrated multiplexers") Fixes: 0ca2997d1452 ("netdev/of/phy: Add MDIO bus multiplexer support.") Signed-off-by: David S. Miller drivers/net/phy/mdio-mux.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) commit 83eaddab4378db256d00d295bda6ca997cd13a52 Author: WANG Cong Date: Tue May 9 16:59:54 2017 -0700 ipv6/dccp: do not inherit ipv6_mc_list from parent Like commit 657831ffc38e ("dccp/tcp: do not inherit mc_list from parent") we should clear ipv6_mc_list etc. for IPv6 sockets too. Cc: Eric Dumazet Signed-off-by: Cong Wang Acked-by: Eric Dumazet Signed-off-by: David S. Miller net/dccp/ipv6.c | 6 ++++++ net/ipv6/tcp_ipv6.c | 2 ++ 2 files changed, 8 insertions(+) commit 0fe20fafd1791f993806d417048213ec57b81045 Author: Colin Ian King Date: Tue May 9 17:19:42 2017 +0100 netxen_nic: set rcode to the return status from the call to netxen_issue_cmd Currently rcode is being initialized to NX_RCODE_SUCCESS and later it is checked to see if it is not NX_RCODE_SUCCESS which is never true. It appears that there is an unintentional missing assignment of rcode from the return of the call to netxen_issue_cmd() that was dropped in an earlier fix, so add it in. Detected by CoverityScan, CID#401900 ("Logically dead code") Fixes: 2dcd5d95ad6b2 ("netxen_nic: fix cdrp race condition") Signed-off-by: Colin Ian King Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8d66c30b12ed3cb533696dea8b9a9eadd5da426a Author: Stefan Wahren Date: Tue May 9 15:40:38 2017 +0200 net: qca_spi: Fix alignment issues in rx path The qca_spi driver causes alignment issues on ARM devices. So fix this by using netdev_alloc_skb_ip_align(). Signed-off-by: Stefan Wahren Fixes: 291ab06ecf67 ("net: qualcomm: new Ethernet over SPI driver for QCA7000") Signed-off-by: David S. Miller drivers/net/ethernet/qualcomm/qca_spi.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit 1a4a5bf52a4adb477adb075e5afce925824ad132 Author: Gao Feng Date: Tue May 9 18:27:33 2017 +0800 driver: vrf: Fix one possible use-after-free issue The current codes only deal with the case that the skb is dropped, it may meet one use-after-free issue when NF_HOOK returns 0 that means the skb is stolen by one netfilter rule or hook. When one netfilter rule or hook stoles the skb and return NF_STOLEN, it means the skb is taken by the rule, and other modules should not touch this skb ever. Maybe the skb is queued or freed directly by the rule. Now uses the nf_hook instead of NF_HOOK to get the result of netfilter, and check the return value of nf_hook. Only when its value equals 1, it means the skb could go ahead. Or reset the skb as NULL. BTW, because vrf_rcv_finish is empty function, so needn't invoke it even though nf_hook returns 1. But we need to modify vrf_rcv_finish to deal with the NF_STOLEN case. There are two cases when skb is stolen. 1. The skb is stolen and freed directly. There is nothing we need to do, and vrf_rcv_finish isn't invoked. 2. The skb is queued and reinjected again. The vrf_rcv_finish would be invoked as okfn, so need to free the skb in it. Signed-off-by: Gao Feng Signed-off-by: David S. Miller drivers/net/vrf.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit a00ebd1cf12c378a1d4f7a1d6daf1d76c1eaad82 Author: Lars Ellenberg Date: Thu May 11 10:21:46 2017 +0200 drbd: fix request leak introduced by locking/atomic, kref: Kill kref_sub() When killing kref_sub(), the unconditional additional kref_get() was not properly paired with the necessary kref_put(), causing a leak of struct drbd_requests (~ 224 Bytes) per submitted bio, and breaking DRBD in general, as the destructor of those "drbd_requests" does more than just the mempoll_free(). Fixes: bdfafc4ffdd2 ("locking/atomic, kref: Kill kref_sub()") Signed-off-by: Lars Ellenberg Cc: stable@vger.kernel.org # v4.11 Signed-off-by: Jens Axboe drivers/block/drbd/drbd_req.c | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-) commit df3ed932394488e57e72dd0e73c224d1804fdc8f Author: Rob Herring Date: Thu May 11 10:15:10 2017 -0500 Partially Revert "of: fix sparse warnings in fdt, irq, reserved mem, and resolver code" A change to function pointers that was meant to address a sparse warning turned out to cause hundreds of new gcc-7 warnings: include/linux/of_irq.h:11:13: error: type qualifiers ignored on function return type [-Werror=ignored-qualifiers] drivers/of/of_reserved_mem.c: In function '__reserved_mem_init_node': drivers/of/of_reserved_mem.c:200:7: error: type qualifiers ignored on function return type [-Werror=ignored-qualifiers] int const (*initfn)(struct reserved_mem *rmem) = i->data; Turns out the sparse warnings were spurious and have been fixed in upstream sparse since 0.5.0 in commit "sparse: treat function pointers as pointers to const data". This partially reverts commit 17a70355ea576843a7ac851f1db26872a50b2850. Fixes: 17a70355ea57 ("of: fix sparse warnings in fdt, irq, reserved mem, and resolver code") Reported-by: Arnd Bergmann Signed-off-by: Rob Herring drivers/of/of_reserved_mem.c | 2 +- include/linux/of_irq.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit efc0c21c9ea786d6f019d7df7b4e3932f3578d90 Author: Elena Reshetova Date: Thu Mar 2 12:23:45 2017 +0100 s390: convert debug_info.ref_count from atomic_t to refcount_t refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova Signed-off-by: Hans Liljestrand Signed-off-by: Kees Cook Signed-off-by: David Windsor Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky arch/s390/include/asm/debug.h | 3 ++- arch/s390/kernel/debug.c | 8 ++++---- 2 files changed, 6 insertions(+), 5 deletions(-) commit ed6565e734249ef021d5c13ba34c167eb4e42f62 Author: Christoph Hellwig Date: Thu May 11 12:34:38 2017 +0200 block: handle partial completions for special payload requests SCSI devices can return short writes on Write Same just like for normal writes, so we need to handle this case for our special payload requests as well. Signed-off-by: Christoph Hellwig Reported-by: Abdul Haleem Tested-by: Abdul Haleem Signed-off-by: Jens Axboe block/blk-core.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) commit 69861e0a52f8733355ce246f0db15e1b240ad667 Author: Juergen Gross Date: Wed May 10 06:08:44 2017 +0200 xen: adjust early dom0 p2m handling to xen hypervisor behavior When booted as pv-guest the p2m list presented by the Xen is already mapped to virtual addresses. In dom0 case the hypervisor might make use of 2M- or 1G-pages for this mapping. Unfortunately while being properly aligned in virtual and machine address space, those pages might not be aligned properly in guest physical address space. So when trying to obtain the guest physical address of such a page pud_pfn() and pmd_pfn() must be avoided as those will mask away guest physical address bits not being zero in this special case. Signed-off-by: Juergen Gross Reviewed-by: Jan Beulich Signed-off-by: Juergen Gross arch/x86/xen/mmu_pv.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit def9331a12977770cc6132d79f8e6565871e8e38 Author: Juergen Gross Date: Thu Apr 27 07:01:20 2017 +0200 x86/amd: don't set X86_BUG_SYSRET_SS_ATTRS when running under Xen When running as Xen pv guest X86_BUG_SYSRET_SS_ATTRS must not be set on AMD cpus. This bug/feature bit is kind of special as it will be used very early when switching threads. Setting the bit and clearing it a little bit later leaves a critical window where things can go wrong. This time window has enlarged a little bit by using setup_clear_cpu_cap() instead of the hypervisor's set_cpu_features callback. It seems this larger window now makes it rather easy to hit the problem. The proper solution is to never set the bit in case of Xen. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Acked-by: Thomas Gleixner Signed-off-by: Juergen Gross arch/x86/kernel/cpu/amd.c | 5 +++-- arch/x86/xen/enlighten_pv.c | 1 - 2 files changed, 3 insertions(+), 3 deletions(-) commit 0c2cf6d9487cb90be6ad7fac66044dfa8e8e5243 Author: Florian Fainelli Date: Thu Apr 27 11:19:02 2017 -0700 arm64: Silence first allocation with CONFIG_ARM64_MODULE_PLTS=y When CONFIG_ARM64_MODULE_PLTS is enabled, the first allocation using the module space fails, because the module is too big, and then the module allocation is attempted from vmalloc space. Silence the first allocation failure in that case by setting __GFP_NOWARN. Reviewed-by: Ard Biesheuvel Acked-by: Will Deacon Signed-off-by: Florian Fainelli Signed-off-by: Catalin Marinas arch/arm64/kernel/module.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 75d24d968af8913f641c612930c96acc5399e427 Author: Florian Fainelli Date: Thu Apr 27 11:19:01 2017 -0700 ARM: Silence first allocation with CONFIG_ARM_MODULE_PLTS=y When CONFIG_ARM_MODULE_PLTS is enabled, the first allocation using the module space fails, because the module is too big, and then the module allocation is attempted from vmalloc space. Silence the first allocation failure in that case by setting __GFP_NOWARN. Acked-by: Russell King Signed-off-by: Florian Fainelli Signed-off-by: Catalin Marinas arch/arm/kernel/module.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) commit 03497d761c55438144fd63534d4223418fdfd345 Author: Florian Fainelli Date: Thu Apr 27 11:19:00 2017 -0700 mm: Silence vmap() allocation failures based on caller gfp_flags If the caller has set __GFP_NOWARN don't print the following message: vmap allocation for size 15736832 failed: use vmalloc= to increase size. This can happen with the ARM/Linux or ARM64/Linux module loader built with CONFIG_ARM{,64}_MODULE_PLTS=y which does a first attempt at loading a large module from module space, then falls back to vmalloc space. Acked-by: Michal Hocko Signed-off-by: Florian Fainelli Signed-off-by: Catalin Marinas mm/vmalloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e118c3fec9c0d8d2a96462c4c035305dc952e402 Author: Tobias Klauser Date: Thu May 11 11:40:16 2017 +0200 nios2: remove custom early console implementation As of commits d8f347ba35cf ("nios2: enable earlycon support"), 0dcc0542a006 ("serial: altera_jtaguart: add earlycon support") and 4d9d7d896d77 ("serial: altera_uart: add earlycon support"), the nios2 architecture and the altera_uart/altera_jtaguart drivers support earlycon. Thus, the custom early console implementation for nios2 is no longer necessary to get early boot messages. Remove it and rely fully on earlycon support. Signed-off-by: Tobias Klauser arch/nios2/include/asm/prom.h | 22 ------- arch/nios2/include/asm/setup.h | 2 - arch/nios2/kernel/Makefile | 1 - arch/nios2/kernel/early_printk.c | 121 --------------------------------------- arch/nios2/kernel/prom.c | 49 ---------------- arch/nios2/kernel/setup.c | 4 -- 6 files changed, 199 deletions(-) commit 0bb7a37f8d15e5fb5d21776875f9fbc74e10753a Author: Diego Elio Pettenò Date: Wed Apr 26 17:37:04 2017 +0100 HID: elecom: extend to fix the descriptor for DEFT trackballs The ELECOM DEFT trackballs report only five buttons, when the device actually has 8. Change the descriptor so that the HID driver can see all of them. For completeness and future reference, I included a side-by-side diff of the part of the descriptor that is being edited. Cc: Jiri Kosina Cc: Benjamin Tissoires Cc: Yuxuan Shui Signed-off-by: Diego Elio Pettenò Signed-off-by: Jiri Kosina drivers/hid/Kconfig | 6 +++-- drivers/hid/hid-core.c | 2 ++ drivers/hid/hid-elecom.c | 62 +++++++++++++++++++++++++++++++++++++++++------- drivers/hid/hid-ids.h | 2 ++ 4 files changed, 61 insertions(+), 11 deletions(-) commit 984a9d4c40bed351a92ed31f0723a710444295da Author: Nicholas Bellinger Date: Thu May 11 00:23:08 2017 -0700 Revert "target: Fix VERIFY and WRITE VERIFY command parsing" This reverts commit 0e2eb7d12eaa8e391bf5615d4271bb87a649caaa Author: Bart Van Assche Date: Thu Mar 30 10:12:39 2017 -0700 target: Fix VERIFY and WRITE VERIFY command parsing This patch broke existing behaviour for WRITE_VERIFY because it dropped the original SCF_SCSI_DATA_CDB assignment for bytchk = 0 so target_cmd_size_check() no longer rejected this case, allowing an overflow case to trigger an OOPs in iscsi-target. Since the short term and long term fixes are still being discussed, revert it for now since it's late in the merge window and try again in v4.13-rc1. Conflicts: drivers/target/target_core_sbc.c Signed-off-by: Nicholas Bellinger drivers/target/target_core_sbc.c | 74 ++++++---------------------------------- 1 file changed, 10 insertions(+), 64 deletions(-) commit e84b83b9ee2187817cf895471675f1ccdf64cd53 Author: Dan Williams Date: Wed May 10 19:38:13 2017 -0700 filesystem-dax: fix broken __dax_zero_page_range() conversion The conversion of __dax_zero_page_range() to 'struct dax_operations' caused it to frequently fail. The mistake was treating the @size parameter as a dax mapping length rather than just a length of the clear_pmem() operation. The dax mapping length is assumed to be hard coded as PAGE_SIZE. Without this fix any page unaligned zeroing request will trigger a -EINVAL return from bdev_dax_pgoff(). Cc: Jan Kara Cc: Christoph Hellwig Reported-by: Ross Zwisler Tested-by: Ross Zwisler Fixes: cccbce671582 ("filesystem-dax: convert to dax_direct_access()") Signed-off-by: Dan Williams fs/dax.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit b177fe85dd27de1ee4c29f59c4e82b3ea3b78784 Author: Vishal Verma Date: Wed May 10 15:01:31 2017 -0600 libnvdimm, btt: ensure that initializing metadata clears poison If we had badblocks/poison in the metadata area of a BTT, recreating the BTT would not clear the poison in all cases, notably the flog area. This is because rw_bytes will only clear errors if the request being sent down is 512B aligned and sized. Make sure that when writing the map and info blocks, the rw_bytes being sent are of the correct size/alignment. For the flog, instead of doing the smaller log_entry writes only, first do a 'wipe' of the entire area by writing zeroes in large enough chunks so that errors get cleared. Cc: Andy Rudoff Cc: Dan Williams Signed-off-by: Vishal Verma Signed-off-by: Dan Williams drivers/nvdimm/btt.c | 54 +++++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 47 insertions(+), 7 deletions(-) commit 3ae3d67ba705c754a3c91ac009f9ce73a0e7286a Author: Vishal Verma Date: Wed May 10 15:01:30 2017 -0600 libnvdimm: add an atomic vs process context flag to rw_bytes nsio_rw_bytes can clear media errors, but this cannot be done while we are in an atomic context due to locking within ACPI. From the BTT, ->rw_bytes may be called either from atomic or process context depending on whether the calls happen during initialization or during IO. During init, we want to ensure error clearing happens, and the flag marking process context allows nsio_rw_bytes to do that. When called during IO, we're in atomic context, and error clearing can be skipped. Cc: Dan Williams Signed-off-by: Vishal Verma Signed-off-by: Dan Williams drivers/nvdimm/blk.c | 3 ++- drivers/nvdimm/btt.c | 67 +++++++++++++++++++++++++---------------------- drivers/nvdimm/btt_devs.c | 2 +- drivers/nvdimm/claim.c | 6 +++-- drivers/nvdimm/nd.h | 1 + drivers/nvdimm/pfn_devs.c | 4 +-- include/linux/nd.h | 12 +++++---- 7 files changed, 53 insertions(+), 42 deletions(-) commit 791a9a666d1afe2603bcb2c6a4852d684e879252 Merge: 23ea3f62 3e18c63 Author: Linus Torvalds Date: Wed May 10 20:45:36 2017 -0700 Merge tag 'kbuild-uapi-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild UAPI updates from Masahiro Yamada: "Improvement of headers_install by Nicolas Dichtel. It has been long since the introduction of uapi directories, but the de-coupling of exported headers has not been completed. Headers listed in header-y are exported whether they exist in uapi directories or not. His work fixes this inconsistency. All (and only) headers under uapi directories are now exported. The asm-generic wrappers are still exceptions, but this is a big step forward" * tag 'kbuild-uapi-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: arch/include: remove empty Kbuild files uapi: export all arch specifics directories uapi: export all headers under uapi directories smc_diag.h: fix include from userland btrfs_tree.h: fix include from userland uapi: includes linux/types.h before exporting files Makefile.headersinst: remove destination-y option Makefile.headersinst: cleanup input files x86: stop exporting msr-index.h to userland nios2: put setup.h in uapi h8300: put bitsperlong.h in uapi commit 23ea3f62f3f90caaa7b4bf32690c341101228cca Merge: 593043d 9eb3c95 Author: Linus Torvalds Date: Wed May 10 20:41:43 2017 -0700 Merge tag 'kbuild-misc-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull misc Kbuild updates from Masahiro Yamada: - clean up builddeb script - use full path for KBUILD_IMAGE to fix rpm-pkg build - fix objdiff tool to ignore debug info * tag 'kbuild-misc-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: builddeb: fix typo builddeb: Update a few outdated and hardcoded strings deb-pkg: Remove the KBUILD_IMAGE workaround unicore32: Use full path in KBUILD_IMAGE definition sh: Use full path in KBUILD_IMAGE definition arc: Use full path in KBUILD_IMAGE definition arm: Use full path in KBUILD_IMAGE definition arm64: Use full path in KBUILD_IMAGE definition scripts: objdiff: Ignore debug info when comparing commit 593043d35ddff8ab033546c2a89bb1d4080d03e1 Merge: 556d994 f55813b Author: Linus Torvalds Date: Wed May 10 20:11:05 2017 -0700 Merge tag 'kbuild-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild updates from Masahiro Yamada: - improve Clang support - clean up various Makefiles - improve build log visibility (objtool, alpha, ia64) - improve compiler flag evaluation for better build performance - fix GCC version-dependent warning - fix genksyms * tag 'kbuild-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: (23 commits) kbuild: dtbinst: remove unnecessary __dtbs_install_prep target ia64: beatify build log for gate.so and gate-syms.o alpha: make short build log available for division routines alpha: merge build rules of division routines alpha: add $(src)/ rather than $(obj)/ to make source file path Makefile: evaluate LDFLAGS_BUILD_ID only once objtool: make it visible in make V=1 output kbuild: clang: add -no-integrated-as to KBUILD_[AC]FLAGS kbuild: Add support to generate LLVM assembly files kbuild: Add better clang cross build support kbuild: drop -Wno-unknown-warning-option from clang options kbuild: fix asm-offset generation to work with clang kbuild: consolidate redundant sed script ASM offset generation frv: Use OFFSET macro in DEF_*REG() kbuild: avoid conflict between -ffunction-sections and -pg on gcc-4.7 kbuild: Consolidate header generation from ASM offset information kbuild: use -Oz instead of -Os when using clang kbuild, LLVMLinux: Add -Werror to cc-option to support clang Kbuild: make designated_init attribute fatal kbuild: drop unneeded patterns '.*.orig' and '.*.rej' from distclean ... commit 556d994a75790dce8a9c6b35b94cff1d526b2e32 Merge: 291b38a 332e0d1 Author: Linus Torvalds Date: Wed May 10 19:37:14 2017 -0700 Merge tag 'rtc-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC updates from Alexandre Belloni: "RTC subsystem update: - Add OF device ID table for i2c drivers New RTC driver: - Motorola CPCAP PMIC RTC RTC driver updates: - cmos: fix IRQ selection - ds1307: Add ST m41t0 support - ds1374: fix watchdog configuration - sh: Add rza series support" * tag 'rtc-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: (33 commits) rtc: gemini: add return value validation rtc: snvs: fix an incorrect check of return value rtc: ds1374: wdt: Fix stop/start ioctl always returning -EINVAL rtc: ds1374: wdt: Fix issue with timeout scaling from secs to wdt ticks rtc: sh: mark PM functions as unused rtc: hid-sensor-time: remove some dead code rtc: m41t80: Add proper compatible for rv4162 rtc: ds1307: Add m41t0 to OF device ID table rtc: ds1307: support m41t0 variant rtc: cpcap: fix improper use of IRQ_NONE for request_threaded_irq rtc: cmos: Do not assume irq 8 for rtc when there are no legacy irqs x86: i8259: export legacy_pic symbol dt-bindings: rtc: document the rtc-sh bindings rtc: sh: add support for rza series rtc: cpcap: kfreeing devm allocated memory rtc: wm8350: Remove unused to_wm8350_from_rtc_dev rtc: cpcap: new rtc driver dt-bindings: Add vendor prefix for Motorola rtc: omap: mark PM methods as __maybe_unused rtc: omap: remove incorrect __exit markups ... commit 291b38a7565b41676cafd1b4052315a94d9c8977 Merge: b5a53b6 6192c41 Author: Linus Torvalds Date: Wed May 10 19:13:03 2017 -0700 Merge tag 'hwparam-20170420' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs Pull hw lockdown support from David Howells: "Annotation of module parameters that configure hardware resources including ioports, iomem addresses, irq lines and dma channels. This allows a future patch to prohibit the use of such module parameters to prevent that hardware from being abused to gain access to the running kernel image as part of locking the kernel down under UEFI secure boot conditions. Annotations are made by changing: module_param(n, t, p) module_param_named(n, v, t, p) module_param_array(n, t, m, p) to: module_param_hw(n, t, hwtype, p) module_param_hw_named(n, v, t, hwtype, p) module_param_hw_array(n, t, hwtype, m, p) where the module parameter refers to a hardware setting hwtype specifies the type of the resource being configured. This can be one of: ioport Module parameter configures an I/O port iomem Module parameter configures an I/O mem address ioport_or_iomem Module parameter could be either (runtime set) irq Module parameter configures an I/O port dma Module parameter configures a DMA channel dma_addr Module parameter configures a DMA buffer address other Module parameter configures some other value Note that the hwtype is compile checked, but not currently stored (the lockdown code probably won't require it). It is, however, there for future use. A bonus is that the hwtype can also be used for grepping. The intention is for the kernel to ignore or reject attempts to set annotated module parameters if lockdown is enabled. This applies to options passed on the boot command line, passed to insmod/modprobe or direct twiddling in /sys/module/ parameter files. The module initialisation then needs to handle the parameter not being set, by (1) giving an error, (2) probing for a value or (3) using a reasonable default. What I can't do is just reject a module out of hand because it may take a hardware setting in the module parameters. Some important modules, some ipmi stuff for instance, both probe for hardware and allow hardware to be manually specified; if the driver is aborts with any error, you don't get any ipmi hardware. Further, trying to do this entirely in the module initialisation code doesn't protect against sysfs twiddling. [!] Note that in and of itself, this series of patches should have no effect on the the size of the kernel or code execution - that is left to a patch in the next series to effect. It does mark annotated kernel parameters with a KERNEL_PARAM_FL_HWPARAM flag in an already existing field" * tag 'hwparam-20170420' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: (38 commits) Annotate hardware config module parameters in sound/pci/ Annotate hardware config module parameters in sound/oss/ Annotate hardware config module parameters in sound/isa/ Annotate hardware config module parameters in sound/drivers/ Annotate hardware config module parameters in fs/pstore/ Annotate hardware config module parameters in drivers/watchdog/ Annotate hardware config module parameters in drivers/video/ Annotate hardware config module parameters in drivers/tty/ Annotate hardware config module parameters in drivers/staging/vme/ Annotate hardware config module parameters in drivers/staging/speakup/ Annotate hardware config module parameters in drivers/staging/media/ Annotate hardware config module parameters in drivers/scsi/ Annotate hardware config module parameters in drivers/pcmcia/ Annotate hardware config module parameters in drivers/pci/hotplug/ Annotate hardware config module parameters in drivers/parport/ Annotate hardware config module parameters in drivers/net/wireless/ Annotate hardware config module parameters in drivers/net/wan/ Annotate hardware config module parameters in drivers/net/irda/ Annotate hardware config module parameters in drivers/net/hamradio/ Annotate hardware config module parameters in drivers/net/ethernet/ ... commit a9402889f41cc2db7a9b162990bef271be098ff0 Author: Boris Brezillon Date: Wed May 3 08:48:55 2017 +0200 MAINTAINERS: Update NAND subsystem git repositories NAND branches are now hosted on MTD repos, nand/next is on l2-mtd and nand/fixes will be on linux-mtd. Signed-off-by: Boris Brezillon [Brian: added branch names] Signed-off-by: Brian Norris MAINTAINERS | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 7db789d08cb23aeedb4d6392c2994ce387067021 Author: Christophe Leroy Date: Wed May 3 14:18:24 2017 +0200 mtd: nand: gpio: update binding This patch updates the binding documentation in accordance with commit 44dd182861f99 ("mtd: nand: gpio: make nCE GPIO optional") Signed-off-by: Christophe Leroy Reported-by: Brian Norris Acked-by: Rob Herring Signed-off-by: Brian Norris Documentation/devicetree/bindings/mtd/gpio-control-nand.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 8be193c7b1f44d3f4dcb27107df0831709c2deb1 Author: Tomohiro Yoshidomi Date: Sat May 6 13:00:31 2017 -0700 Input: add support for PlayStation 1/2 joypads connected via SPI PlayStation 1/2 joypads can be connected directly to the SPI interface. Signed-off-by: Tomohiro Yoshidomi Acked-by: David Herrmann Signed-off-by: Dmitry Torokhov drivers/input/joystick/Kconfig | 21 ++ drivers/input/joystick/Makefile | 1 + drivers/input/joystick/psxpad-spi.c | 401 ++++++++++++++++++++++++++++++++++++ 3 files changed, 423 insertions(+) commit b5a53b61a2890ec08f404f524c1c42aa86f09be4 Merge: c70422f 0119dc6 Author: Linus Torvalds Date: Wed May 10 13:38:18 2017 -0700 Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk updates from Stephen Boyd: "Sort of on the quieter side this time, which is probably due more to me not catching up as quickly on patch review than anything else. Overall it seems normal though, a few small changes to the core, mostly small non-critical fixes here and there as well as driver updates for new and existing hardware support. The biggest things are the TI clk driver rework to lay the groundwork for clkctrl support in the next merge window and the AmLogic audio/graphics clk support. Core: - clk_possible_parents debugfs file so we know which parents a clk could possibly have - Fix to make clk rate change notifiers stop on the first failure instead of continuing New Drivers: - Mediatek MT6797 SoCs - hi655x PMIC clks - AmLogic Meson SoC i2s and spdif audio clks and Mali graphics clks - Allwinner H5 SoCs and PRCM hardware Updates: - Nvidia Tegra T210 cleanups and non-critical fixes - TI OMAP cleanups in preparation for clkctrl support - trivial fixes like kcalloc(), devm_* conversions, and seq_puts() - ZTE zx296718 SoC VGA clks - Rockchip clk-ids, fixups, and rename of rk1108 to rv1108 - IDT VersaClock 5P49V5935 support - Renesas R-Car H3 and M3-W IMR clks and ES2.0 rev of R-Car H3 support" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (151 commits) clk: x86: pmc-atom: Checking for IS_ERR() instead of NULL clk: ti: divider: try to fix ti_clk_register_divider clk: mvebu: Use kcalloc() in two functions clk: mvebu: Use kcalloc() in of_cpu_clk_setup() clk: nomadik: Delete error messages for a failed memory allocation in two functions clk: nomadik: Use seq_puts() in nomadik_src_clk_show() clk: Improve a size determination in two functions clk: Replace four seq_printf() calls by seq_putc() clk: si5351: Delete an error message for a failed memory allocation in si5351_i2c_probe() clk: si5351: Use devm_kcalloc() in si5351_i2c_probe() clk: at91: Use kcalloc() in of_at91_clk_pll_get_characteristics() reset: mediatek: Add MT2701 ethsys reset controller include file clk: mediatek: add mt2701 ethernet reset clk: hi6220: Add the hi655x's pmic clock clk: ti: fix building without legacy omap3 clk: ti: fix linker error with !SOC_OMAP4 clk: hi3620: Fix a typo in one variable name clk: hi3620: Delete error messages for a failed memory allocation in two functions clk: hi3620: Use kcalloc() in hi3620_mmc_clk_init() clk: hisilicon: Delete error messages for failed memory allocations in hisi_clk_init() ... commit c70422f760c120480fee4de6c38804c72aa26bc1 Merge: 73ccb02 b26b78c Author: Linus Torvalds Date: Wed May 10 13:29:23 2017 -0700 Merge tag 'nfsd-4.12' of git://linux-nfs.org/~bfields/linux Pull nfsd updates from Bruce Fields: "Another RDMA update from Chuck Lever, and a bunch of miscellaneous bugfixes" * tag 'nfsd-4.12' of git://linux-nfs.org/~bfields/linux: (26 commits) nfsd: Fix up the "supattr_exclcreat" attributes nfsd: encoders mustn't use unitialized values in error cases nfsd: fix undefined behavior in nfsd4_layout_verify lockd: fix lockd shutdown race NFSv4: Fix callback server shutdown SUNRPC: Refactor svc_set_num_threads() NFSv4.x/callback: Create the callback service through svc_create_pooled lockd: remove redundant check on block svcrdma: Clean out old XDR encoders svcrdma: Remove the req_map cache svcrdma: Remove unused RDMA Write completion handler svcrdma: Reduce size of sge array in struct svc_rdma_op_ctxt svcrdma: Clean up RPC-over-RDMA backchannel reply processing svcrdma: Report Write/Reply chunk overruns svcrdma: Clean up RDMA_ERROR path svcrdma: Use rdma_rw API in RPC reply path svcrdma: Introduce local rdma_rw API helpers svcrdma: Clean up svc_rdma_get_inv_rkey() svcrdma: Add helper to save pages under I/O svcrdma: Eliminate RPCRDMA_SQ_DEPTH_MULT ... commit 73ccb023a2f25b72c4b95499ca24760588014614 Merge: f94c128 76b2a30 Author: Linus Torvalds Date: Wed May 10 13:03:38 2017 -0700 Merge tag 'nfs-for-4.12-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs Pull NFS client updates from Trond Myklebust: "Highlights include: Stable bugfixes: - Fix use after free in write error path - Use GFP_NOIO for two allocations in writeback - Fix a hang in OPEN related to server reboot - Check the result of nfs4_pnfs_ds_connect - Fix an rcu lock leak Features: - Removal of the unmaintained and unused OSD pNFS layout - Cleanup and removal of lots of unnecessary dprintk()s - Cleanup and removal of some memory failure paths now that GFP_NOFS is guaranteed to never fail. - Remove the v3-only data server limitation on pNFS/flexfiles Bugfixes: - RPC/RDMA connection handling bugfixes - Copy offload: fixes to ensure the copied data is COMMITed to disk. - Readdir: switch back to using the ->iterate VFS interface - File locking fixes from Ben Coddington - Various use-after-free and deadlock issues in pNFS - Write path bugfixes" * tag 'nfs-for-4.12-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: (89 commits) pNFS/flexfiles: Always attempt to call layoutstats when flexfiles is enabled NFSv4.1: Work around a Linux server bug... NFS append COMMIT after synchronous COPY NFSv4: Fix exclusive create attributes encoding NFSv4: Fix an rcu lock leak nfs: use kmap/kunmap directly NFS: always treat the invocation of nfs_getattr as cache hit when noac is on Fix nfs_client refcounting if kmalloc fails in nfs4_proc_exchange_id and nfs4_proc_async_renew NFSv4.1: RECLAIM_COMPLETE must handle NFS4ERR_CONN_NOT_BOUND_TO_SESSION pNFS: Fix NULL dereference in pnfs_generic_alloc_ds_commits pNFS: Fix a typo in pnfs_generic_alloc_ds_commits pNFS: Fix a deadlock when coalescing writes and returning the layout pNFS: Don't clear the layout return info if there are segments to return pNFS: Ensure we commit the layout if it has been invalidated pNFS: Don't send COMMITs to the DSes if the server invalidated our layout pNFS/flexfiles: Fix up the ff_layout_write_pagelist failure path pNFS: Ensure we check layout validity before marking it for return NFS4.1 handle interrupted slot reuse from ERR_DELAY NFSv4: check return value of xdr_inline_decode nfs/filelayout: fix NULL pointer dereference in fl_pnfs_update_layout() ... commit e84188852a7239d7a144af12f7e5dac8fa88600b Author: Arnd Bergmann Date: Wed May 10 21:05:16 2017 +0200 tee: add ARM_SMCCC dependency For the moment, the tee subsystem only makes sense in combination with the op-tee driver that depends on ARM_SMCCC, so let's hide the subsystem from users that can't select that. Suggested-by: Linus Torvalds Signed-off-by: Arnd Bergmann drivers/tee/Kconfig | 1 + 1 file changed, 1 insertion(+) commit e038d5515b4a0c0946f331f4eeaa538453a89c36 Merge: 6cde26f 14e21cb Author: Arnd Bergmann Date: Wed May 10 21:03:31 2017 +0200 Merge branch 'tee/initial-merge' into fixes This is a dependency for the following fix * tee/initial-merge: arm64: dt: hikey: Add optee node Documentation: tee subsystem and op-tee driver tee: add OP-TEE driver tee: generic TEE subsystem dt/bindings: add bindings for optee commit f94c128eefcce2e3448d543f13cd7d7b8aa660a5 Merge: c44b594 e3cd7f0 Author: Linus Torvalds Date: Wed May 10 11:40:36 2017 -0700 Merge tag 'metag-for-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/jhogan/metag Pull metag updates from James Hogan: "These patches primarily make some usercopy improvements (following on from the recent usercopy fixes): - reformat and simplify rapf copy loops - add 64-bit get_user support And fix a couple more uaccess issues, partily pointed out by Al: - fix access_ok() serious shortcomings - fix strncpy_from_user() address validation Also included is a trivial removal of a redundant increment" * tag 'metag-for-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/jhogan/metag: metag/mm: Drop pointless increment metag/uaccess: Check access_ok in strncpy_from_user metag/uaccess: Fix access_ok() metag/usercopy: Add 64-bit get_user support metag/usercopy: Simplify rapf loop fixup corner case metag/usercopy: Reformat rapf loop inline asm commit c44b59430393c38873fd933333d945f426857a59 Merge: 5ccd414 c8b0d72 Author: Linus Torvalds Date: Wed May 10 11:33:08 2017 -0700 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio updates from Michael Tsirkin: "Fixes, cleanups, performance A bunch of changes to virtio, most affecting virtio net. Also ptr_ring batched zeroing - first of batching enhancements that seems ready." * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: s390/virtio: change maintainership tools/virtio: fix spelling mistake: "wakeus" -> "wakeups" virtio_net: tidy a couple debug statements ptr_ring: support testing different batching sizes ringtest: support test specific parameters ptr_ring: batch ring zeroing virtio: virtio_driver doc virtio_net: don't reset twice on XDP on/off virtio_net: fix support for small rings virtio_net: reduce alignment for buffers virtio_net: rework mergeable buffer handling virtio_net: allow specifying context for rx virtio: allow extra context per descriptor tools/virtio: fix build breakage virtio: add context flag to find vqs virtio: wrap find_vqs ringtest: fix an assert statement commit b26b78cb726007533d81fdf90a62e915002ef5c8 Author: Trond Myklebust Date: Tue May 9 16:24:59 2017 -0400 nfsd: Fix up the "supattr_exclcreat" attributes If an NFSv4 client asks us for the supattr_exclcreat, then we must not return attributes that are unsupported by this minor version. Signed-off-by: Trond Myklebust Fixes: 75976de6556f ("NFSD: Return word2 bitmask if setting security..,") Cc: stable@vger.kernel.org Signed-off-by: J. Bruce Fields fs/nfsd/nfs4xdr.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit 5ccd414080822d5257c3569f4aeca74f63f4a257 Merge: 29250d3 36c344f Author: Linus Torvalds Date: Wed May 10 11:29:23 2017 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull more KVM updates from Paolo Bonzini: "ARM: - bugfixes - moved shared 32-bit/64-bit files to virt/kvm/arm - support for saving/restoring virtual ITS state to userspace PPC: - XIVE (eXternal Interrupt Virtualization Engine) support x86: - nVMX improvements, including emulated page modification logging (PML) which brings nice performance improvements on some workloads" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (45 commits) KVM: arm/arm64: vgic-its: Cleanup after failed ITT restore KVM: arm/arm64: Don't call map_resources when restoring ITS tables KVM: arm/arm64: Register ITS iodev when setting base address KVM: arm/arm64: Get rid of its->initialized field KVM: arm/arm64: Register iodevs when setting redist base and creating VCPUs KVM: arm/arm64: Slightly rework kvm_vgic_addr KVM: arm/arm64: Make vgic_v3_check_base more broadly usable KVM: arm/arm64: Refactor vgic_register_redist_iodevs KVM: Add kvm_vcpu_get_idx to get vcpu index in kvm->vcpus nVMX: Advertise PML to L1 hypervisor nVMX: Implement emulated Page Modification Logging kvm: x86: Add a hook for arch specific dirty logging emulation kvm: nVMX: Validate CR3 target count on nested VM-entry KVM: set no_llseek in stat_fops_per_vm KVM: arm/arm64: vgic: Rename kvm_vgic_vcpu_init to kvm_vgic_vcpu_enable KVM: arm/arm64: Clarification and relaxation to ITS save/restore ABI KVM: arm64: vgic-v3: KVM_DEV_ARM_VGIC_SAVE_PENDING_TABLES KVM: arm64: vgic-its: Fix pending table sync KVM: arm64: vgic-its: ITT save and restore KVM: arm64: vgic-its: Device table save/restore ... commit 29250d301b0c75ef142b51eebee6b7403cc79624 Merge: a2d9214 4dbbe2d Author: Linus Torvalds Date: Wed May 10 11:26:25 2017 -0700 Merge tag 'trace-v4.12-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fix from Steven Rostedt: "This is a trivial patch that changes a check for a cpumask from a NULL pointer to using cpumask_available(), which will do the check. This is because cpumasks when not allocated are always set, and clang complains about it" * tag 'trace-v4.12-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing: Use cpumask_available() to check if cpumask variable may be used commit f961e3f2acae94b727380c0b74e2d3954d0edf79 Author: J. Bruce Fields Date: Fri May 5 16:17:57 2017 -0400 nfsd: encoders mustn't use unitialized values in error cases In error cases, lgp->lg_layout_type may be out of bounds; so we shouldn't be using it until after the check of nfserr. This was seen to crash nfsd threads when the server receives a LAYOUTGET request with a large layout type. GETDEVICEINFO has the same problem. Reported-by: Ari Kauppi Reviewed-by: Christoph Hellwig Cc: stable@vger.kernel.org Signed-off-by: J. Bruce Fields fs/nfsd/nfs4xdr.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit a2d9214c730f54ff72c2940bcd7f22d1fccb26ec Merge: de4d195 414d06a Author: Linus Torvalds Date: Wed May 10 11:20:09 2017 -0700 Merge tag 'armsoc-tee' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull TEE driver infrastructure and OP-TEE drivers from Arnd Bergmann: "This introduces a generic TEE framework in the kernel, to handle trusted environemtns (security coprocessor or software implementations such as OP-TEE/TrustZone). I'm sending it separately from the other arm-soc driver changes to give it a little more visibility, once the subsystem is merged, we will likely keep this in the arm₋soc drivers branch or have the maintainers submit pull requests directly, depending on the patch volume. I have reviewed earlier versions in the past, and have reviewed the latest version in person during Linaro Connect BUD17. Here is my overall assessment of the subsystem: - There is clearly demand for this, both for the generic infrastructure and the specific OP-TEE implementation. - The code has gone through a large number of reviews, and the review comments have all been addressed, but the reviews were not coming up with serious issues any more and nobody volunteered to vouch for the quality. - The user space ioctl interface is sufficient to work with the OP-TEE driver, and it should in principle work with other TEE implementations that follow the GlobalPlatform[1] standards, but it might need to be extended in minor ways depending on specific requirements of future TEE implementations - The main downside of the API to me is how the user space is tied to the TEE implementation in hardware or firmware, but uses a generic way to communicate with it. This seems to be an inherent problem with what it is trying to do, and I could not come up with any better solution than what is implemented here. For a detailed history of the patch series, see https://lkml.org/lkml/2017/3/10/1277" * tag 'armsoc-tee' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: arm64: dt: hikey: Add optee node Documentation: tee subsystem and op-tee driver tee: add OP-TEE driver tee: generic TEE subsystem dt/bindings: add bindings for optee commit afa31879f0a62f769cdeeffc8cfec613da2bc482 Author: Rex Zhu Date: Fri May 5 17:53:18 2017 +0800 drm/amd/powerplay: refine pwm1_enable callback functions for CI. Use the new enums for setting and getting the fan control mode. Fixes problems due to previous inconsistencies between enums. Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/ci_dpm.c | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-) commit 2fde9ab218b7f8446c2428b7f9dad602afce8be6 Author: Rex Zhu Date: Fri May 5 16:50:36 2017 +0800 drm/amd/powerplay: refine pwm1_enable callback functions for vi. Use the new enums for setting and getting the fan control mode. Fixes problems due to previous inconsistencies between enums. Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 35 ++++++++++++---------- drivers/gpu/drm/amd/powerplay/hwmgr/smu7_thermal.c | 9 +++--- drivers/gpu/drm/amd/powerplay/hwmgr/smu7_thermal.h | 2 +- drivers/gpu/drm/amd/powerplay/inc/hwmgr.h | 1 + 4 files changed, 27 insertions(+), 20 deletions(-) commit 7522ffc41b73a3dd1f9d19164f033bd649c0404b Author: Rex Zhu Date: Fri May 5 17:44:32 2017 +0800 drm/amd/powerplay: refine pwm1_enable callback functions for Vega10. Use the new enums for setting and getting the fan control mode. Fixes problems due to previous inconsistencies between enums. Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c | 44 ++++++++++++---------- .../gpu/drm/amd/powerplay/hwmgr/vega10_thermal.h | 1 + 2 files changed, 25 insertions(+), 20 deletions(-) commit aad22ca4368082cdd1cff1c55d8607c94ea1a74b Author: Rex Zhu Date: Fri May 5 16:56:45 2017 +0800 drm/amdgpu: refine amdgpu pwm1_enable sysfs interface. Make the interface consistent. Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) commit 4f93f09e5c3e59e72aa1ae877b24ae0cacdfdfa8 Author: Rex Zhu Date: Fri May 5 17:37:20 2017 +0800 drm/amdgpu: add amd fan ctrl mode enums. Add common fan enums that can be used for both powerplay and dpm. Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/include/amd_shared.h | 6 ++++++ 1 file changed, 6 insertions(+) commit ded96c7389c2fdef174d3dbdc6e8c2822312c364 Author: Rex Zhu Date: Fri Apr 21 17:26:38 2017 +0800 drm/amd/powerplay: add more smu message on Vega10. Add some new SMU messages. Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/inc/vega10_ppsmc.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit de4d195308ad589626571dbe5789cebf9695a204 Merge: dc9edaa 20652ed6 Author: Linus Torvalds Date: Wed May 10 09:50:55 2017 -0700 Merge branch 'core-rcu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull RCU updates from Ingo Molnar: "The main changes are: - Debloat RCU headers - Parallelize SRCU callback handling (plus overlapping patches) - Improve the performance of Tree SRCU on a CPU-hotplug stress test - Documentation updates - Miscellaneous fixes" * 'core-rcu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (74 commits) rcu: Open-code the rcu_cblist_n_lazy_cbs() function rcu: Open-code the rcu_cblist_n_cbs() function rcu: Open-code the rcu_cblist_empty() function rcu: Separately compile large rcu_segcblist functions srcu: Debloat the header srcu: Adjust default auto-expediting holdoff srcu: Specify auto-expedite holdoff time srcu: Expedite first synchronize_srcu() when idle srcu: Expedited grace periods with reduced memory contention srcu: Make rcutorture writer stalls print SRCU GP state srcu: Exact tracking of srcu_data structures containing callbacks srcu: Make SRCU be built by default srcu: Fix Kconfig botch when SRCU not selected rcu: Make non-preemptive schedule be Tasks RCU quiescent state srcu: Expedite srcu_schedule_cbs_snp() callback invocation srcu: Parallelize callback handling kvm: Move srcu_struct fields to end of struct kvm rcu: Fix typo in PER_RCU_NODE_PERIOD header comment rcu: Use true/false in assignment to bool rcu: Use bool value directly ... commit 30514decb27d45b98599612cb5d3e6a20ba733a5 Author: Chunming Zhou Date: Tue May 9 13:39:40 2017 +0800 drm/amdgpu: fix dependency issue The problem is that executing the jobs in the right order doesn't give you the right result because consecutive jobs executed on the same engine are pipelined. In other words job B does it buffer read before job A has written it's result. Signed-off-by: Chunming Zhou Reviewed-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c | 2 ++ drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 4 ++++ drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 2 +- drivers/gpu/drm/amd/scheduler/gpu_scheduler.c | 17 +++++++++++++++++ drivers/gpu/drm/amd/scheduler/gpu_scheduler.h | 2 ++ 6 files changed, 27 insertions(+), 1 deletion(-) commit cb3696fdeca24d3a347a5225d934ce50c6edccba Author: Chunming Zhou Date: Tue May 9 15:34:07 2017 +0800 drm/amd: fix init order of sched job Need to increment after the fence check. Signed-off-by: Chunming Zhou Reviewed-by: Junwei Zhang Reviewed-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/scheduler/gpu_scheduler.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bb3338d3474e0329918fda9dae2c52751731eb58 Author: Song Liu Date: Mon May 8 17:39:24 2017 -0700 md/raid5-cache: in r5l_do_submit_io(), submit io->split_bio first In r5l_do_submit_io(), it is necessary to check io->split_bio before submit io->current_bio. This is because, endio of current_bio may free the whole IO unit, and thus change io->split_bio. Signed-off-by: Song Liu Signed-off-by: Shaohua Li drivers/md/raid5-cache.c | 28 +++++++++++++++++++--------- 1 file changed, 19 insertions(+), 9 deletions(-) commit dc9edaab90de9441cc28ac570b23b0d2bdba7879 Merge: 2e4ab93 46436eb Author: Linus Torvalds Date: Wed May 10 09:35:42 2017 -0700 Merge tag 'acpi-extra-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more ACPI updates from Rafael Wysocki: "These update the ACPICA code in the kernel to upstream revision 20170303 which adds a few minor fixes and improvements, update ACPI SoC drivers with new device IDs, platform-related information and similar, fix the register information in the xpower PMIC driver, introduce a concept of "always present" devices to the ACPI device enumeration code and use it to fix a problem with one platform, and fix a system resume issue related to power resources. Specifics: - Update the ACPICA code in the kernel to upstream revision 20170303 which includes: * Minor fixes and improvements in the core code (Bob Moore, Seunghun Han). * Debugger fixes (Colin Ian King, Lv Zheng). * Compiler/disassembler improvements (Bob Moore, David Box, Lv Zheng). * Build-related update (Lv Zheng). - Add new device IDs and platform-related information to the ACPI drivers for Intel (LPSS) and AMD (APD) SoCs (Hanjun Guo, Hans de Goede). - Make it possible to quirk ACPI-enumerated devices as "always present" on platforms where they are incorrectly reported as not present by the AML and add the INT0002 device ID to the list of "always present" devices (Hans de Goede). - Fix the register information in the xpower PMIC driver and add comments to map the registers to symbols used by AML to it (Hans de Goede). - Move the code turning off unused ACPI power resources during system resume to a point after all devices have been resumed to avoid issues with power resources that do not behave as expected (Hans de Goede)" * tag 'acpi-extra-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (22 commits) ACPI / power: Delay turning off unused power resources after suspend ACPI / PMIC: xpower: Fix power_table addresses ACPI / LPSS: Call pwm_add_table() for Bay Trail PWM device ACPICA: Update version to 20170303 ACPICA: iasl: add ASL conversion tool ACPICA: Local cache support: Allow small cache objects ACPICA: Disassembler: Do not unconditionally remove temporary names ACPICA: iasl: Fix IORT SMMU GSI disassembling ACPICA: Cleanup AML opcode definitions, no functional change ACPICA: Debugger: Add interpreter blocking mark for single-step mode ACPICA: debugger: fix memory leak on Pathname ACPICA: Update for automatic repair code for objects returned by evaluate_object ACPICA: Namespace: fix operand cache leak ACPICA: Fix several incorrect invocations of ACPICA return macro ACPICA: Fix a module for excessive debug output ACPICA: Update some function headers, no funtional change ACPICA: Disassembler: Enhance resource descriptor detection i2c: designware: Add ACPI HID for Hisilicon Hip07/08 I2C controller ACPI / APD: Add clock frequency for Hisilicon Hip07/08 I2C controller ACPI / bus: Add INT0002 to list of always-present devices ... commit 2e4ab937ec49a6616e7354ccf4b18e4373f5f8a3 Merge: b948abf 80449d8 Author: Linus Torvalds Date: Wed May 10 09:12:30 2017 -0700 Merge tag 'pm-extra-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull more power management updates from Rafael Wysocki: "These add new CPU IDs to a couple of drivers, fix a possible NULL pointer dereference in the cpuidle core, update DT-related things in the generic power domains framework and finally update the suspend/resume infrastructure to improve the handling of wakeups from suspend-to-idle. Specifics: - Add Intel Gemini Lake CPU IDs to the intel_idle and intel_rapl drivers (David Box). - Add a NULL pointer check to the cpuidle core to prevent it from crashing on platforms with incomplete cpuidle configuration (Fei Li). - Fix DT-related documentation in the generic power domains (genpd) framework and add a MAINTAINERS entry for DT-related material in genpd (Viresh Kumar). - Update the system suspend/resume infrastructure to improve the handling of aborts of suspend transitions in progress in the wakeup framework and rework the suspend-to-idle core loop to make it possible to filter out spurious wakeup events (specifically the ones coming from ACPI) without resuming all the way up to user space every time (Rafael Wysocki)" * tag 'pm-extra-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI / sleep: Ignore spurious SCI wakeups from suspend-to-idle PM / wakeup: Integrate mechanism to abort transitions in progress x86/intel_idle: add Gemini Lake support cpuidle: check dev before usage in cpuidle_use_deepest_state() powercap: intel_rapl: Add support for Gemini Lake PM / Domains: Add DT file to MAINTAINERS PM / Domains: Fix DT example commit b948abf53a381a0c681aadd612e2affba47f62bc Merge: a2e5ad4 65f2673 Author: Linus Torvalds Date: Wed May 10 09:03:48 2017 -0700 Merge branch 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs Pull overlayfs update from Miklos Szeredi: "The biggest part of this is making st_dev/st_ino on the overlay behave like a normal filesystem (i.e. st_ino doesn't change on copy up, st_dev is the same for all files and directories). Currently this only works if all layers are on the same filesystem, but future work will move the general case towards more sane behavior. There are also miscellaneous fixes, including fixes to handling append-only files. There's a small change in the VFS, but that only has an effect on overlayfs, since otherwise file->f_path.dentry->inode and file_inode(file) are always the same" * 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs: ovl: update documentation w.r.t. constant inode numbers ovl: persistent inode numbers for upper hardlinks ovl: merge getattr for dir and nondir ovl: constant st_ino/st_dev across copy up ovl: persistent inode number for directories ovl: set the ORIGIN type flag ovl: lookup non-dir copy-up-origin by file handle ovl: use an auxiliary var for overlay root entry ovl: store file handle of lower inode on copy up ovl: check if all layers are on the same fs ovl: do not set overlay.opaque on non-dir create ovl: check IS_APPEND() on real upper inode vfs: ftruncate check IS_APPEND() on real upper inode ovl: Use designated initializers ovl: lockdep annotate of nested stacked overlayfs inode lock commit a2e5ad45a9741068f357de4dbff50bb37c233e1b Merge: 26c5eaa 0b6e9ea Author: Linus Torvalds Date: Wed May 10 08:45:30 2017 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse Pull fuse updates from Miklos Szeredi: "Support for pid namespaces from Seth and refcount_t work from Elena" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: fuse: Add support for pid namespaces fuse: convert fuse_conn.count from atomic_t to refcount_t fuse: convert fuse_req.count from atomic_t to refcount_t fuse: convert fuse_file.count from atomic_t to refcount_t commit 26c5eaa1326e9703effd01e7cc3cc0d4ad4b3c19 Merge: 1176032 eeca958 Author: Linus Torvalds Date: Wed May 10 08:42:33 2017 -0700 Merge tag 'ceph-for-4.12-rc1' of git://github.com/ceph/ceph-client Pull ceph updates from Ilya Dryomov: "The two main items are support for disabling automatic rbd exclusive lock transfers from myself and the long awaited -ENOSPC handling series from Jeff. The former will allow rbd users to take advantage of exclusive lock's built-in blacklist/break-lock functionality while staying in control of who owns the lock. With the latter in place, we will abort filesystem writes on -ENOSPC instead of having them block indefinitely. Beyond that we've got the usual pile of filesystem fixes from Zheng, some refcount_t conversion patches from Elena and a patch for an ancient open() flags handling bug from Alexander" * tag 'ceph-for-4.12-rc1' of git://github.com/ceph/ceph-client: (31 commits) ceph: fix memory leak in __ceph_setxattr() ceph: fix file open flags on ppc64 ceph: choose readdir frag based on previous readdir reply rbd: exclusive map option rbd: return ResponseMessage result from rbd_handle_request_lock() rbd: kill rbd_is_lock_supported() rbd: support updating the lock cookie without releasing the lock rbd: store lock cookie rbd: ignore unlock errors rbd: fix error handling around rbd_init_disk() rbd: move rbd_unregister_watch() call into rbd_dev_image_release() rbd: move rbd_dev_destroy() call out of rbd_dev_image_release() ceph: when seeing write errors on an inode, switch to sync writes Revert "ceph: SetPageError() for writeback pages if writepages fails" ceph: handle epoch barriers in cap messages libceph: add an epoch_barrier field to struct ceph_osd_client libceph: abort already submitted but abortable requests when map or pool goes full libceph: allow requests to return immediately on full conditions if caller wishes libceph: remove req->r_replay_version ceph: make seeky readdir more efficient ... commit 1176032cb12bb89ad558a3e57e82f2f25b817eff Merge: 56868a4 9bcaaea Author: Linus Torvalds Date: Wed May 10 08:33:17 2017 -0700 Merge branch 'for-linus-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs Pull btrfs updates from Chris Mason: "This has fixes and cleanups Dave Sterba collected for the merge window. The biggest functional fixes are between btrfs raid5/6 and scrub, and raid5/6 and device replacement. Some of our pending qgroup fixes are included as well while I bash on the rest in testing. We also have the usual set of cleanups, including one that makes __btrfs_map_block() much more maintainable, and conversions from atomic_t to refcount_t" * 'for-linus-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs: (71 commits) btrfs: fix the gfp_mask for the reada_zones radix tree Btrfs: fix reported number of inode blocks Btrfs: send, fix file hole not being preserved due to inline extent Btrfs: fix extent map leak during fallocate error path Btrfs: fix incorrect space accounting after failure to insert inline extent Btrfs: fix invalid attempt to free reserved space on failure to cow range btrfs: Handle delalloc error correctly to avoid ordered extent hang btrfs: Fix metadata underflow caused by btrfs_reloc_clone_csum error btrfs: check if the device is flush capable btrfs: delete unused member nobarriers btrfs: scrub: Fix RAID56 recovery race condition btrfs: scrub: Introduce full stripe lock for RAID56 btrfs: Use ktime_get_real_ts for root ctime Btrfs: handle only applicable errors returned by btrfs_get_extent btrfs: qgroup: Fix qgroup corruption caused by inode_cache mount option btrfs: use q which is already obtained from bdev_get_queue Btrfs: switch to div64_u64 if with a u64 divisor Btrfs: update scrub_parity to use u64 stripe_len Btrfs: enable repair during read for raid56 profile btrfs: use clear_page where appropriate ... commit 09062ae1bb1c4a84e382560ff5059803d263a6c8 Author: Alex Deucher Date: Tue May 9 13:08:39 2017 -0400 drm/amdgpu: add some additional vega10 pci ids Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 2 ++ 1 file changed, 2 insertions(+) commit bfc181af3b3978e4b9619e3b46b1c4f7e5adb43a Author: Alex Deucher Date: Fri May 5 10:26:12 2017 -0400 drm/amdgpu/soc15: use atomfirmware for setting bios scratch for reset Need to use the atomfirmware interface rather than atombios since soc15 is atomfirmware based. Reviewed-by: Chunming Zhou Acked-by: Harry Wentland Acked-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/soc15.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit de70c6357be23261c18fcccfd2ad148512fedd28 Author: Alex Deucher Date: Fri May 5 10:21:36 2017 -0400 drm/amdgpu/atomfirmware: add function to update engine hang status Update the scratch reg for when the engine is hung. Reviewed-by: Chunming Zhou Acked-by: Harry Wentland Acked-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c | 13 +++++++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.h | 2 ++ 2 files changed, 15 insertions(+) commit 634b6a8a064576797120b74facf95ba79283b5d5 Author: Julien Isorce Date: Thu Apr 27 15:10:08 2017 +0100 drm/radeon: only warn once in radeon_ttm_bo_destroy if va list not empty Encountered a dozen of exact same backtraces when mesa's pb_cache_release_all_buffers is called after that a gpu reset failed. v2: Remove superfluous error message added in v1. bug: https://bugs.freedesktop.org/show_bug.cgi?id=96271 Signed-off-by: Julien Isorce Reviewed-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/radeon/radeon_object.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3e18c637fa3e2f6836a4034c80ca0a86be968efc Author: Nicolas Dichtel Date: Mon Mar 27 14:20:17 2017 +0200 arch/include: remove empty Kbuild files Signed-off-by: Nicolas Dichtel Signed-off-by: Masahiro Yamada arch/cris/include/arch-v10/arch/Kbuild | 1 - arch/cris/include/arch-v32/arch/Kbuild | 1 - arch/tile/include/arch/Kbuild | 1 - 3 files changed, 3 deletions(-) commit 61562f981e9284ff7dfb2769d89c750986a5f677 Author: Nicolas Dichtel Date: Mon Mar 27 14:20:16 2017 +0200 uapi: export all arch specifics directories This patch removes the need of subdir-y. Now all files/directories under arch//include/uapi/ are exported. The only change for userland is the layout of the command 'make headers_install_all': directories asm- are replaced by arch-/. Those new directories contains all files/directories of the specified arch. Note that only cris and tile have more directories than only asm: - arch-v[10|32] for cris; - arch for tile. Signed-off-by: Nicolas Dichtel Signed-off-by: Masahiro Yamada Documentation/kbuild/makefiles.txt | 15 +-------------- Makefile | 6 +++--- arch/cris/include/uapi/asm/Kbuild | 3 --- arch/tile/include/uapi/asm/Kbuild | 2 -- scripts/Makefile.headersinst | 3 +-- 5 files changed, 5 insertions(+), 24 deletions(-) commit fcc8487d477a3452a1d0ccbdd4c5e0e1e3cb8bed Author: Nicolas Dichtel Date: Mon Mar 27 14:20:15 2017 +0200 uapi: export all headers under uapi directories Regularly, when a new header is created in include/uapi/, the developer forgets to add it in the corresponding Kbuild file. This error is usually detected after the release is out. In fact, all headers under uapi directories should be exported, thus it's useless to have an exhaustive list. After this patch, the following files, which were not exported, are now exported (with make headers_install_all): asm-arc/kvm_para.h asm-arc/ucontext.h asm-blackfin/shmparam.h asm-blackfin/ucontext.h asm-c6x/shmparam.h asm-c6x/ucontext.h asm-cris/kvm_para.h asm-h8300/shmparam.h asm-h8300/ucontext.h asm-hexagon/shmparam.h asm-m32r/kvm_para.h asm-m68k/kvm_para.h asm-m68k/shmparam.h asm-metag/kvm_para.h asm-metag/shmparam.h asm-metag/ucontext.h asm-mips/hwcap.h asm-mips/reg.h asm-mips/ucontext.h asm-nios2/kvm_para.h asm-nios2/ucontext.h asm-openrisc/shmparam.h asm-parisc/kvm_para.h asm-powerpc/perf_regs.h asm-sh/kvm_para.h asm-sh/ucontext.h asm-tile/shmparam.h asm-unicore32/shmparam.h asm-unicore32/ucontext.h asm-x86/hwcap2.h asm-xtensa/kvm_para.h drm/armada_drm.h drm/etnaviv_drm.h drm/vgem_drm.h linux/aspeed-lpc-ctrl.h linux/auto_dev-ioctl.h linux/bcache.h linux/btrfs_tree.h linux/can/vxcan.h linux/cifs/cifs_mount.h linux/coresight-stm.h linux/cryptouser.h linux/fsmap.h linux/genwqe/genwqe_card.h linux/hash_info.h linux/kcm.h linux/kcov.h linux/kfd_ioctl.h linux/lightnvm.h linux/module.h linux/nbd-netlink.h linux/nilfs2_api.h linux/nilfs2_ondisk.h linux/nsfs.h linux/pr.h linux/qrtr.h linux/rpmsg.h linux/sched/types.h linux/sed-opal.h linux/smc.h linux/smc_diag.h linux/stm.h linux/switchtec_ioctl.h linux/vfio_ccw.h linux/wil6210_uapi.h rdma/bnxt_re-abi.h Note that I have removed from this list the files which are generated in every exported directories (like .install or .install.cmd). Thanks to Julien Floret for the tip to get all subdirs with a pure makefile command. For the record, note that exported files for asm directories are a mix of files listed by: - include/uapi/asm-generic/Kbuild.asm; - arch//include/uapi/asm/Kbuild; - arch//include/asm/Kbuild. Signed-off-by: Nicolas Dichtel Acked-by: Daniel Vetter Acked-by: Russell King Acked-by: Mark Salter Acked-by: Michael Ellerman (powerpc) Signed-off-by: Masahiro Yamada Documentation/kbuild/makefiles.txt | 66 ++-- arch/alpha/include/uapi/asm/Kbuild | 41 --- arch/arc/include/uapi/asm/Kbuild | 3 - arch/arm/include/uapi/asm/Kbuild | 17 - arch/arm64/include/uapi/asm/Kbuild | 18 - arch/blackfin/include/uapi/asm/Kbuild | 17 - arch/c6x/include/uapi/asm/Kbuild | 8 - arch/cris/include/uapi/arch-v10/arch/Kbuild | 5 - arch/cris/include/uapi/arch-v32/arch/Kbuild | 3 - arch/cris/include/uapi/asm/Kbuild | 43 +-- arch/frv/include/uapi/asm/Kbuild | 33 -- arch/h8300/include/uapi/asm/Kbuild | 28 -- arch/hexagon/include/asm/Kbuild | 3 - arch/hexagon/include/uapi/asm/Kbuild | 13 - arch/ia64/include/uapi/asm/Kbuild | 45 --- arch/m32r/include/uapi/asm/Kbuild | 31 -- arch/m68k/include/uapi/asm/Kbuild | 24 -- arch/metag/include/uapi/asm/Kbuild | 8 - arch/microblaze/include/uapi/asm/Kbuild | 32 -- arch/mips/include/uapi/asm/Kbuild | 37 --- arch/mn10300/include/uapi/asm/Kbuild | 32 -- arch/nios2/include/uapi/asm/Kbuild | 3 +- arch/openrisc/include/asm/Kbuild | 3 - arch/openrisc/include/uapi/asm/Kbuild | 8 - arch/parisc/include/uapi/asm/Kbuild | 28 -- arch/powerpc/include/uapi/asm/Kbuild | 45 --- arch/s390/include/uapi/asm/Kbuild | 46 --- arch/score/include/asm/Kbuild | 3 - arch/score/include/uapi/asm/Kbuild | 32 -- arch/sh/include/uapi/asm/Kbuild | 23 -- arch/sparc/include/uapi/asm/Kbuild | 48 --- arch/tile/include/asm/Kbuild | 3 - arch/tile/include/uapi/arch/Kbuild | 17 - arch/tile/include/uapi/asm/Kbuild | 19 +- arch/unicore32/include/uapi/asm/Kbuild | 6 - arch/x86/include/uapi/asm/Kbuild | 58 ---- arch/xtensa/include/uapi/asm/Kbuild | 23 -- include/Kbuild | 2 - include/asm-generic/Kbuild.asm | 1 - include/scsi/fc/Kbuild | 0 include/uapi/Kbuild | 15 - include/uapi/asm-generic/Kbuild | 36 -- include/uapi/asm-generic/Kbuild.asm | 76 ++--- include/uapi/drm/Kbuild | 23 -- include/uapi/linux/Kbuild | 494 +--------------------------- include/uapi/linux/android/Kbuild | 2 - include/uapi/linux/byteorder/Kbuild | 3 - include/uapi/linux/caif/Kbuild | 3 - include/uapi/linux/can/Kbuild | 6 - include/uapi/linux/dvb/Kbuild | 9 - include/uapi/linux/hdlc/Kbuild | 2 - include/uapi/linux/hsi/Kbuild | 2 - include/uapi/linux/iio/Kbuild | 3 - include/uapi/linux/isdn/Kbuild | 2 - include/uapi/linux/mmc/Kbuild | 2 - include/uapi/linux/netfilter/Kbuild | 89 ----- include/uapi/linux/netfilter/ipset/Kbuild | 5 - include/uapi/linux/netfilter_arp/Kbuild | 3 - include/uapi/linux/netfilter_bridge/Kbuild | 18 - include/uapi/linux/netfilter_ipv4/Kbuild | 10 - include/uapi/linux/netfilter_ipv6/Kbuild | 13 - include/uapi/linux/nfsd/Kbuild | 6 - include/uapi/linux/raid/Kbuild | 3 - include/uapi/linux/spi/Kbuild | 2 - include/uapi/linux/sunrpc/Kbuild | 2 - include/uapi/linux/tc_act/Kbuild | 16 - include/uapi/linux/tc_ematch/Kbuild | 5 - include/uapi/linux/usb/Kbuild | 12 - include/uapi/linux/wimax/Kbuild | 2 - include/uapi/misc/Kbuild | 2 - include/uapi/mtd/Kbuild | 6 - include/uapi/rdma/Kbuild | 20 -- include/uapi/rdma/hfi/Kbuild | 3 - include/uapi/scsi/Kbuild | 6 - include/uapi/scsi/fc/Kbuild | 5 - include/uapi/sound/Kbuild | 16 - include/uapi/video/Kbuild | 4 - include/uapi/xen/Kbuild | 5 - include/video/Kbuild | 0 scripts/Makefile.headersinst | 55 ++-- 80 files changed, 111 insertions(+), 1750 deletions(-) commit ea6819e1f2d6c30624ea067f4b3a50a3cca79d8a Author: Nicolas Dichtel Date: Mon Mar 27 14:20:14 2017 +0200 smc_diag.h: fix include from userland This patch prepares the uapi export by fixing the following error: .../linux/smc_diag.h:6:27: fatal error: rdma/ib_verbs.h: No such file or directory #include Signed-off-by: Nicolas Dichtel Signed-off-by: Masahiro Yamada include/rdma/ib_verbs.h | 3 +-- include/uapi/linux/smc_diag.h | 2 +- include/uapi/rdma/ib_user_verbs.h | 2 ++ 3 files changed, 4 insertions(+), 3 deletions(-) commit 3a4e7f56ca6cd66e69a159073584434b2e639c71 Author: Nicolas Dichtel Date: Mon Mar 27 14:20:12 2017 +0200 btrfs_tree.h: fix include from userland This patch prepares the uapi export by fixing the following errors: .../linux/btrfs_tree.h:283:2: error: #error "UUID items require BTRFS_UUID_SIZE == 16!" #error "UUID items require BTRFS_UUID_SIZE == 16!" .../linux/btrfs_tree.h:390:12: error: ‘BTRFS_UUID_SIZE’ undeclared here (not in a function) __u8 uuid[BTRFS_UUID_SIZE]; ^ .../linux/btrfs_tree.h:796:16: error: ‘BTRFS_DEV_STAT_VALUES_MAX’ undeclared here (not in a function) __le64 values[BTRFS_DEV_STAT_VALUES_MAX]; Signed-off-by: Nicolas Dichtel Signed-off-by: Masahiro Yamada include/uapi/linux/btrfs_tree.h | 1 + 1 file changed, 1 insertion(+) commit 9078b4eea119c13d633d45af0397c821a517b522 Author: Nicolas Dichtel Date: Mon Mar 27 14:20:11 2017 +0200 uapi: includes linux/types.h before exporting files Some files will be exported after a following patch. 0-day tests report the following warning/error: ./usr/include/linux/bcache.h:8: include of is preferred over ./usr/include/linux/bcache.h:11: found __[us]{8,16,32,64} type without #include ./usr/include/linux/qrtr.h:8: found __[us]{8,16,32,64} type without #include ./usr/include/linux/cryptouser.h:39: found __[us]{8,16,32,64} type without #include ./usr/include/linux/pr.h:14: found __[us]{8,16,32,64} type without #include ./usr/include/linux/btrfs_tree.h:337: found __[us]{8,16,32,64} type without #include ./usr/include/rdma/bnxt_re-abi.h:45: found __[us]{8,16,32,64} type without #include Signed-off-by: Nicolas Dichtel Signed-off-by: Masahiro Yamada include/uapi/linux/bcache.h | 2 +- include/uapi/linux/btrfs_tree.h | 2 ++ include/uapi/linux/cryptouser.h | 2 ++ include/uapi/linux/pr.h | 2 ++ include/uapi/linux/qrtr.h | 1 + include/uapi/rdma/bnxt_re-abi.h | 2 ++ 6 files changed, 10 insertions(+), 1 deletion(-) commit bd73a328cbb5731000bb3fd876189d9395c0cd61 Author: Nicolas Dichtel Date: Mon Mar 27 14:20:10 2017 +0200 Makefile.headersinst: remove destination-y option This option was added in commit c7bb349e7c25 ("kbuild: introduce destination-y for exported headers") but never used in-tree. Signed-off-by: Nicolas Dichtel Acked-by: Paul Bolle Signed-off-by: Masahiro Yamada Documentation/kbuild/makefiles.txt | 23 ++++------------------- scripts/Makefile.headersinst | 2 +- 2 files changed, 5 insertions(+), 20 deletions(-) commit 7c025b2afc96b4a3fddff1dc9fbe3685953e38b4 Author: Nicolas Dichtel Date: Mon Mar 27 14:20:09 2017 +0200 Makefile.headersinst: cleanup input files After the last three patches, all exported headers are under uapi/, thus input-files2 are not needed anymore. The side effect is that input-files1-name is exactly header-y. Note also that input-files3-name is genhdr-y. Signed-off-by: Nicolas Dichtel Signed-off-by: Masahiro Yamada scripts/Makefile.headersinst | 38 ++++++++++++++------------------------ 1 file changed, 14 insertions(+), 24 deletions(-) commit 25dc1d6cc3082aab293e5dad47623b550f7ddd2a Author: Nicolas Dichtel Date: Mon Mar 27 14:20:08 2017 +0200 x86: stop exporting msr-index.h to userland Even if this file was not in an uapi directory, it was exported because it was listed in the Kbuild file. Fixes: b72e7464e4cf ("x86/uapi: Do not export as part of the user API headers") Suggested-by: Borislav Petkov Signed-off-by: Nicolas Dichtel Acked-by: Ingo Molnar Acked-by: Thomas Gleixner Signed-off-by: Masahiro Yamada arch/x86/include/uapi/asm/Kbuild | 1 - 1 file changed, 1 deletion(-) commit 4f4ddad395b04c051fcf76687dd558228e605b6f Author: Nicolas Dichtel Date: Mon Mar 27 14:20:07 2017 +0200 nios2: put setup.h in uapi This header file is exported, but from a userland pov, it's just a wrapper to asm-generic/setup.h. Signed-off-by: Nicolas Dichtel Reviewed-by: Tobias Klauser Signed-off-by: Masahiro Yamada arch/nios2/include/uapi/asm/Kbuild | 1 + 1 file changed, 1 insertion(+) commit 37835671c43b82bdfed628a6a37284a117bda17d Author: Nicolas Dichtel Date: Mon Mar 27 14:20:06 2017 +0200 h8300: put bitsperlong.h in uapi This header file is exported, thus move it to uapi. Signed-off-by: Nicolas Dichtel Signed-off-by: Masahiro Yamada arch/h8300/include/asm/bitsperlong.h | 14 -------------- arch/h8300/include/uapi/asm/bitsperlong.h | 14 ++++++++++++++ 2 files changed, 14 insertions(+), 14 deletions(-) commit f36ea50ca0043e7b1204feaf1d2ba6bd68c08d36 Author: Wen Xiong Date: Wed May 10 08:54:11 2017 -0500 blk-mq: NVMe 512B/4K+T10 DIF/DIX format returns I/O error on dd with split op When formatting NVMe to 512B/4K + T10 DIf/DIX, dd with split op returns "Input/output error". Looks block layer split the bio after calling bio_integrity_prep(bio). This patch fixes the issue. Below is how we debug this issue: (1)format nvme to 4K block # size with type 2 DIF (2)dd with block size bigger than 1024k. oflag=direct dd: error writing '/dev/nvme0n1': Input/output error We added some debug code in nvme device driver. It showed us the first op and the second op have the same bi and pi address. This is not correct. 1st op: nvme0n1 Op:Wr slba 0x505 length 0x100, PI ctrl=0x1400, dsmgmt=0x0, AT=0x0 & RT=0x505 Guard 0x00b1, AT 0x0000, RT physical 0x00000505 RT virtual 0x00002828 2nd op: nvme0n1 Op:Wr slba 0x605 length 0x1, PI ctrl=0x1400, dsmgmt=0x0, AT=0x0 & RT=0x605 ==> This op fails and subsequent 5 retires.. Guard 0x00b1, AT 0x0000, RT physical 0x00000605 RT virtual 0x00002828 With the fix, It showed us both of the first op and the second op have correct bi and pi address. 1st op: nvme2n1 Op:Wr slba 0x505 length 0x100, PI ctrl=0x1400, dsmgmt=0x0, AT=0x0 & RT=0x505 Guard 0x5ccb, AT 0x0000, RT physical 0x00000505 RT virtual 0x00002828 2nd op: nvme2n1 Op:Wr slba 0x605 length 0x1, PI ctrl=0x1400, dsmgmt=0x0, AT=0x0 & RT=0x605 Guard 0xab4c, AT 0x0000, RT physical 0x00000605 RT virtual 0x00003028 Signed-off-by: Wen Xiong Signed-off-by: Jens Axboe block/blk-mq.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit d3738123986954ba3abbd96b595f5176b50c3f5d Author: Jens Axboe Date: Tue May 9 11:39:56 2017 -0600 blk-stat: don't use this_cpu_ptr() in a preemptable section If PREEMPT_RCU is enabled, rcu_read_lock() isn't strong enough for us to use this_cpu_ptr() in that section. Use the safer get/put_cpu_ptr() variants instead. Reported-by: Mike Galbraith Fixes: 34dbad5d26e2 ("blk-stat: convert to callback-based statistics reporting") Signed-off-by: Jens Axboe block/blk-stat.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) commit 340ff3216799a947fe0b07bed8f0409ffc716be9 Author: Jens Axboe Date: Wed May 10 07:40:04 2017 -0600 elevator: remove redundant warnings on IO scheduler switch We warn twice for switching to a scheduler, if that switch fails. As we also report the failure in the return value to the sysfs write, remove the dmesg induced failures. Keep the failure print for warning to switch to the kconfig selected IO scheduler, as we can't report errors for that in any other way. Signed-off-by: Jens Axboe block/elevator.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) commit 43c1b3d6e536b7b21ed329ae54280d8ba308ba92 Author: Paolo Valente Date: Tue May 9 12:54:23 2017 +0200 block, bfq: stress that low_latency must be off to get max throughput The introduction of the BFQ and Kyber I/O schedulers has triggered a new wave of I/O benchmarks. Unfortunately, comments and discussions on these benchmarks confirm that there is still little awareness that it is very hard to achieve, at the same time, a low latency and a high throughput. In particular, virtually all benchmarks measure throughput, or throughput-related figures of merit, but, for BFQ, they use the scheduler in its default configuration. This configuration is geared, instead, toward a low latency. This is evidently a sign that BFQ documentation is still too unclear on this important aspect. This commit addresses this issue by stressing how BFQ configuration must be (easily) changed if the only goal is maximum throughput. Signed-off-by: Paolo Valente Signed-off-by: Jens Axboe Documentation/block/bfq-iosched.txt | 17 ++++++++++++++++- block/bfq-iosched.c | 5 +++++ 2 files changed, 21 insertions(+), 1 deletion(-) commit a66c38a171ed25488debf80247a9e72e1026e82c Author: Paolo Valente Date: Tue May 9 11:37:27 2017 +0200 block, bfq: use pointer entity->sched_data only if set In the function __bfq_deactivate_entity, the pointer entity->sched_data could happen to be used before being properly initialized. This led to a NULL pointer dereference. This commit fixes this bug by just using this pointer only where it is safe to do so. Reported-by: Tom Harrison Tested-by: Tom Harrison Signed-off-by: Paolo Valente Signed-off-by: Jens Axboe block/bfq-wf2q.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) commit fba704b494fdc6816a039a66887274b4e5c00eeb Author: Rakesh Pandit Date: Tue May 9 08:48:25 2017 -0600 nvme: lightnvm: fix memory leak Free up kmalloc allocated memory if failure happens while handling L2P table transfer in nvme_nvm_get_l2p_tbl. Fixes: 8e79b5cb ("lightnvm: move block provisioning to targets") Signed-off-by: Rakesh Pandit Reviewed-by: Javier González Signed-off-by: Jens Axboe drivers/nvme/host/lightnvm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 6cde26fda11b3e7bcc17574c6a71e96ac40f2573 Merge: faec5ea d2718d1 Author: Arnd Bergmann Date: Wed May 10 15:36:43 2017 +0200 Merge tag 'mvebu-arm64-4.12-1' of git://git.infradead.org/linux-mvebu into fixes Merge "mvebu arm64 for 4.12" from Gregory CLEMENT: enable the Armada 37xx pinctrl driver * tag 'mvebu-arm64-4.12-1' of git://git.infradead.org/linux-mvebu: arm64: marvell: enable the Armada 37xx pinctrl driver commit faec5ea6cbbe1c88e0351c249130ad38d7bc71a9 Merge: 9dfe29d 6a68078 Author: Arnd Bergmann Date: Wed May 10 15:35:01 2017 +0200 Merge tag 'mvebu-dt64-4.12-3' of git://git.infradead.org/linux-mvebu into fixes Pull "mvebu dt64 for 4.12 (part 3)" from Gregory CLEMENT: pinctrl and GPIO description for Armada 37xx SoCs * tag 'mvebu-dt64-4.12-3' of git://git.infradead.org/linux-mvebu: ARM64: dts: marvell: armada37xx: add pinctrl definition ARM64: dts: marvell: Add pinctrl nodes for Armada 3700 commit 9dfe29d9d2b07ef3fe683d64f57ca06f03e17805 Merge: e942661 7b4ccb3 Author: Arnd Bergmann Date: Wed May 10 15:33:45 2017 +0200 Merge tag 'renesas-fixes-for-v4.12' of https://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas into fixes Pull "Renesas ARM Based SoC Fixes for v4.12" from Simon Horman: * Provide dummy rcar_rst_read_mode_pins() for compile-testing * tag 'renesas-fixes-for-v4.12' of https://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas: soc: renesas: Provide dummy rcar_rst_read_mode_pins() for compile-testing commit 960013762df0a214b57f2fce655422fb52bdfd2c Author: Jeeja KP Date: Wed May 10 11:51:58 2017 +0530 ALSA: hda: Fix cpu lockup when stopping the cmd dmas Using jiffies in hdac_wait_for_cmd_dmas() to determine when to time out when interrupts are off (snd_hdac_bus_stop_cmd_io()/spin_lock_irq()) causes hard lockup so unlock while waiting using jiffies. ---<-snip->--- <0>[ 1211.603046] NMI watchdog: Watchdog detected hard LOCKUP on cpu 3 <4>[ 1211.603047] Modules linked in: snd_hda_intel i915 vgem <4>[ 1211.603053] irq event stamp: 13366 <4>[ 1211.603053] hardirqs last enabled at (13365): ... <4>[ 1211.603059] Call Trace: <4>[ 1211.603059] ? delay_tsc+0x3d/0xc0 <4>[ 1211.603059] __delay+0xa/0x10 <4>[ 1211.603060] __const_udelay+0x31/0x40 <4>[ 1211.603060] snd_hdac_bus_stop_cmd_io+0x96/0xe0 [snd_hda_core] <4>[ 1211.603060] ? azx_dev_disconnect+0x20/0x20 [snd_hda_intel] <4>[ 1211.603061] snd_hdac_bus_stop_chip+0xb1/0x100 [snd_hda_core] <4>[ 1211.603061] azx_stop_chip+0x9/0x10 [snd_hda_codec] <4>[ 1211.603061] azx_suspend+0x72/0x220 [snd_hda_intel] <4>[ 1211.603061] pci_pm_suspend+0x71/0x140 <4>[ 1211.603062] dpm_run_callback+0x6f/0x330 <4>[ 1211.603062] ? pci_pm_freeze+0xe0/0xe0 <4>[ 1211.603062] __device_suspend+0xf9/0x370 <4>[ 1211.603062] ? dpm_watchdog_set+0x60/0x60 <4>[ 1211.603063] async_suspend+0x1a/0x90 <4>[ 1211.603063] async_run_entry_fn+0x34/0x160 <4>[ 1211.603063] process_one_work+0x1f4/0x6d0 <4>[ 1211.603063] ? process_one_work+0x16e/0x6d0 <4>[ 1211.603064] worker_thread+0x49/0x4a0 <4>[ 1211.603064] kthread+0x107/0x140 <4>[ 1211.603064] ? process_one_work+0x6d0/0x6d0 <4>[ 1211.603065] ? kthread_create_on_node+0x40/0x40 <4>[ 1211.603065] ret_from_fork+0x2e/0x40 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=100419 Fixes: 38b19ed7f81ec ("ALSA: hda: fix to wait for RIRB & CORB DMA to set") Reported-by: Marta Lofstedt Suggested-by: Takashi Iwai Signed-off-by: Jeeja KP Acked-by: Vinod Koul CC: stable # 4.7 Signed-off-by: Takashi Iwai sound/hda/hdac_controller.c | 4 ++++ 1 file changed, 4 insertions(+) commit 88b0193d9418c00340e45e0a913a0813bc6c8c96 Author: Will Deacon Date: Tue May 9 18:00:04 2017 +0100 perf/callchain: Force USER_DS when invoking perf_callchain_user() Perf can generate and record a user callchain in response to a synchronous request, such as a tracepoint firing. If this happens under set_fs(KERNEL_DS), then we can end up walking the user stack (and dereferencing/saving whatever we find there) without the protections usually afforded by checks such as access_ok. Rather than play whack-a-mole with each architecture's stack unwinding implementation, fix the root of the problem by ensuring that we force USER_DS when invoking perf_callchain_user from the perf core. Reported-by: Al Viro Signed-off-by: Will Deacon Acked-by: Peter Zijlstra Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Linus Torvalds Cc: Thomas Gleixner Signed-off-by: Ingo Molnar kernel/events/callchain.c | 6 ++++++ 1 file changed, 6 insertions(+) commit ae157902aea13926e9596d091cad6bd87b3be084 Author: Ping Gao Date: Wed Apr 19 14:02:31 2017 +0800 drm/i915/gvt: avoid unnecessary vgpu switch It's no need to switch vgpu if next vgpu is the same with current vgpu, otherwise it will make performance drop in some case. v2: correct the comments. Signed-off-by: Ping Gao Signed-off-by: Zhenyu Wang drivers/gpu/drm/i915/gvt/sched_policy.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit de1892b887eeb85ce458a93979c2108e6f329618 Author: Steve French Date: Thu May 4 07:54:04 2017 -0500 Don't delay freeing mids when blocked on slow socket write of request When processing responses, and in particular freeing mids (DeleteMidQEntry), which is very important since it also frees the associated buffers (cifs_buf_release), we can block a long time if (writes to) socket is slow due to low memory or networking issues. We can block in send (smb request) waiting for memory, and be blocked in processing responess (which could free memory if we let it) - since they both grab the server->srv_mutex. In practice, in the DeleteMidQEntry case - there is no reason we need to grab the srv_mutex so remove these around DeleteMidQEntry, and it allows us to free memory faster. Signed-off-by: Steve French Acked-by: Pavel Shilovsky fs/cifs/cifssmb.c | 7 ------- fs/cifs/smb2pdu.c | 7 ------- fs/cifs/transport.c | 2 -- 3 files changed, 16 deletions(-) commit 560d388950ceda5e7c7cdef7f3d9a8ff297bbf9d Author: Rabin Vincent Date: Wed May 3 17:17:21 2017 +0200 CIFS: silence lockdep splat in cifs_relock_file() cifs_relock_file() can perform a down_write() on the inode's lock_sem even though it was already performed in cifs_strict_readv(). Lockdep complains about this. AFAICS, there is no problem here, and lockdep just needs to be told that this nesting is OK. ============================================= [ INFO: possible recursive locking detected ] 4.11.0+ #20 Not tainted --------------------------------------------- cat/701 is trying to acquire lock: (&cifsi->lock_sem){++++.+}, at: cifs_reopen_file+0x7a7/0xc00 but task is already holding lock: (&cifsi->lock_sem){++++.+}, at: cifs_strict_readv+0x177/0x310 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&cifsi->lock_sem); lock(&cifsi->lock_sem); *** DEADLOCK *** May be due to missing lock nesting notation 1 lock held by cat/701: #0: (&cifsi->lock_sem){++++.+}, at: cifs_strict_readv+0x177/0x310 stack backtrace: CPU: 0 PID: 701 Comm: cat Not tainted 4.11.0+ #20 Call Trace: dump_stack+0x85/0xc2 __lock_acquire+0x17dd/0x2260 ? trace_hardirqs_on_thunk+0x1a/0x1c ? preempt_schedule_irq+0x6b/0x80 lock_acquire+0xcc/0x260 ? lock_acquire+0xcc/0x260 ? cifs_reopen_file+0x7a7/0xc00 down_read+0x2d/0x70 ? cifs_reopen_file+0x7a7/0xc00 cifs_reopen_file+0x7a7/0xc00 ? printk+0x43/0x4b cifs_readpage_worker+0x327/0x8a0 cifs_readpage+0x8c/0x2a0 generic_file_read_iter+0x692/0xd00 cifs_strict_readv+0x29f/0x310 generic_file_splice_read+0x11c/0x1c0 do_splice_to+0xa5/0xc0 splice_direct_to_actor+0xfa/0x350 ? generic_pipe_buf_nosteal+0x10/0x10 do_splice_direct+0xb5/0xe0 do_sendfile+0x278/0x3a0 SyS_sendfile64+0xc4/0xe0 entry_SYSCALL_64_fastpath+0x1f/0xbe Signed-off-by: Rabin Vincent Acked-by: Pavel Shilovsky Signed-off-by: Steve French fs/cifs/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 56868a460b83c0f93d339256a81064d89aadae8e Merge: 7fc22f4 acfead3 Author: Linus Torvalds Date: Tue May 9 15:56:58 2017 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide Pull IDE updates from David Miller: "Two small cleanups in the IDE layer" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide: ide: don't call memcpy with the same source and destination ide: use setup_timer commit 7fc22f45fef00b55d9517e340650b6a0368faff1 Merge: 50fb55d 3c7f6221 Author: Linus Torvalds Date: Tue May 9 15:48:29 2017 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc Pull sparc updates from David Miller: "sparc changes, including a bug fix for handling exceptions during bzero on some sparc64 cpus" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc: sparc64: fix fault handling in NGbzero.S and GENbzero.S sparc: use memdup_user_nul in sun4m LED driver sparc: Remove redundant tests in boot_flags_init(). commit 50fb55d88c999b3c17f93357a009b04d22eda4f7 Merge: 4879b7a 657831f Author: Linus Torvalds Date: Tue May 9 15:42:31 2017 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) Fix multiqueue in stmmac driver on PCI, from Andy Shevchenko. 2) cdc_ncm doesn't actually fully zero out the padding area is allocates on TX, from Jim Baxter. 3) Don't leak map addresses in BPF verifier, from Daniel Borkmann. 4) If we randomize TCP timestamps, we have to do it everywhere including SYN cookies. From Eric Dumazet. 5) Fix "ethtool -S" crash in aquantia driver, from Pavel Belous. 6) Fix allocation size for ntp filter bitmap in bnxt_en driver, from Dan Carpenter. 7) Add missing memory allocation return value check to DSA loop driver, from Christophe Jaillet. 8) Fix XDP leak on driver unload in qed driver, from Suddarsana Reddy Kalluru. 9) Don't inherit MC list from parent inet connection sockets, another syzkaller spotted gem. Fix from Eric Dumazet. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (43 commits) dccp/tcp: do not inherit mc_list from parent qede: Split PF/VF ndos. qed: Correct doorbell configuration for !4Kb pages qed: Tell QM the number of tasks qed: Fix VF removal sequence qede: Fix XDP memory leak on unload net/mlx4_core: Reduce harmless SRIOV error message to debug level net/mlx4_en: Avoid adding steering rules with invalid ring net/mlx4_en: Change the error print to debug print drivers: net: wimax: i2400m: i2400m-usb: Use time_after for time comparison DECnet: Use container_of() for embedded struct Revert "ipv4: restore rt->fi for reference counting" net: mdio-mux: bcm-iproc: call mdiobus_free() in error path net: ethernet: ti: cpsw: adjust cpsw fifos depth for fullduplex flow control ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf net: cdc_ncm: Fix TX zero padding stmmac: pci: split out common_default_data() helper stmmac: pci: RX queue routing configuration stmmac: pci: TX and RX queue priority configuration stmmac: pci: set default number of rx and tx queues ... commit 4879b7ae05431ebcd228a4ff25a81120b3d85891 Merge: ecc721a be13ec6 Author: Linus Torvalds Date: Tue May 9 15:40:28 2017 -0700 Merge tag 'dmaengine-4.12-rc1' of git://git.infradead.org/users/vkoul/slave-dma Pull dmaengine updates from Vinod Koul: "This time again a smaller update consisting of: - support for TI DA8xx dma controller and updates to the cppi driver - updates on bunch of drivers like xilinx, pl08x, stm32-dma, mv_xor, ioat, dmatest" * tag 'dmaengine-4.12-rc1' of git://git.infradead.org/users/vkoul/slave-dma: (35 commits) dmaengine: pl08x: remove lock documentation dmaengine: pl08x: fix pl08x_dma_chan_state documentation dmaengine: pl08x: Use the BIT() macro consistently dmaengine: pl080: Fix some missing kerneldoc dmaengine: pl080: Cut some unused defines dmaengine: dmatest: Add check for supported buffer count (sg_buffers) dmaengine: dmatest: Select DMA_ENGINE_RAID as its needed for the slave_sg test dmaengine: virt-dma: Convert to use list_for_each_entry_safe() dma-debug: use offset_in_page() macro dmaengine: mv_xor: use offset_in_page() macro dmaengine: dmatest: use offset_in_page() macro dmaengine: sun4i: fix invalid argument dmaengine: ioat: use setup_timer dmaengine: cppi41: Fix an Oops happening in cppi41_dma_probe() dmaengine: pl330: remove pdata based initialization dmaengine: cppi: fix build error due to bad variable dmaengine: imx-sdma: add 1ms delay to ensure SDMA channel is stopped dmaengine: cppi41: use managed functions devm_*() dmaengine: cppi41: fix cppi41_dma_tx_status() logic dmaengine: qcom_hidma: pause the channel on shutdown ... commit ecc721a72c121e8b641d68efd24a225abedb9a30 Merge: 28b4780 97512ce Author: Linus Torvalds Date: Tue May 9 15:34:20 2017 -0700 Merge tag 'pwm/for-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm Pull pwm updates from Thierry Reding: "Adds a new driver for the PWM controller found on MediaTek SoCs and extends support for the Atmel PWM controller to include the SAMA5D2. Some existing drivers have been migrated to the atomic API and a few others see miscellaneous improvements" * tag 'pwm/for-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm: pwm: tegra: Read PWM clock source rate in driver init pwm: pca9685: Fix GPIO-only operation pwm: mediatek: Don't explicitly set .owner pwm: tegra: Avoid potential overflow for short periods pwm: tegra: Add support to configure pin state in suspends/resume pwm: tegra: Add DT binding details to configure pin in suspends/resume pwm: tegra: Increase precision in PWM rate calculation pwm: tegra: Use DIV_ROUND_CLOSEST_ULL() instead of local implementation pwm: Add MediaTek PWM support dt-bindings: pwm: Add MediaTek PWM bindings pwm: atmel: Enable PWM on sama5d2 pwm: atmel: Switch to atomic PWM pwm: atmel-hlcdc: Implement the suspend/resume hooks pwm: atmel-hlcdc: Convert to the atomic PWM API commit 28b47809b2171a6cfbab839936b24280639c9f85 Merge: 4a1e31c 2c0248d Author: Linus Torvalds Date: Tue May 9 15:15:47 2017 -0700 Merge tag 'iommu-updates-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu Pull IOMMU updates from Joerg Roedel: - code optimizations for the Intel VT-d driver - ability to switch off a previously enabled Intel IOMMU - support for 'struct iommu_device' for OMAP, Rockchip and Mediatek IOMMUs - header optimizations for IOMMU core code headers and a few fixes that became necessary in other parts of the kernel because of that - ACPI/IORT updates and fixes - Exynos IOMMU optimizations - updates for the IOMMU dma-api code to bring it closer to use per-cpu iova caches - new command-line option to set default domain type allocated by the iommu core code - another command line option to allow the Intel IOMMU switched off in a tboot environment - ARM/SMMU: TLB sync optimisations for SMMUv2, Support for using an IDENTITY domain in conjunction with DMA ops, Support for SMR masking, Support for 16-bit ASIDs (was previously broken) - various other small fixes and improvements * tag 'iommu-updates-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: (63 commits) soc/qbman: Move dma-mapping.h include to qman_priv.h soc/qbman: Fix implicit header dependency now causing build fails iommu: Remove trace-events include from iommu.h iommu: Remove pci.h include from trace/events/iommu.h arm: dma-mapping: Don't override dma_ops in arch_setup_dma_ops() ACPI/IORT: Fix CONFIG_IOMMU_API dependency iommu/vt-d: Don't print the failure message when booting non-kdump kernel iommu: Move report_iommu_fault() to iommu.c iommu: Include device.h in iommu.h x86, iommu/vt-d: Add an option to disable Intel IOMMU force on iommu/arm-smmu: Return IOVA in iova_to_phys when SMMU is bypassed iommu/arm-smmu: Correct sid to mask iommu/amd: Fix incorrect error handling in amd_iommu_bind_pasid() iommu: Make iommu_bus_notifier return NOTIFY_DONE rather than error code omap3isp: Remove iommu_group related code iommu/omap: Add iommu-group support iommu/omap: Make use of 'struct iommu_device' iommu/omap: Store iommu_dev pointer in arch_data iommu/omap: Move data structures to omap-iommu.h iommu/omap: Drop legacy-style device support ... commit 46436eb2f9e6ab0770c14292296d133f8907f699 Merge: 8269c73 04434ab 753a448 2bde7c3 8ece1d8 Author: Rafael J. Wysocki Date: Tue May 9 23:23:02 2017 +0200 Merge branches 'acpi-soc', 'acpi-bus', 'acpi-pmic' and 'acpi-power' * acpi-soc: ACPI / LPSS: Call pwm_add_table() for Bay Trail PWM device i2c: designware: Add ACPI HID for Hisilicon Hip07/08 I2C controller ACPI / APD: Add clock frequency for Hisilicon Hip07/08 I2C controller * acpi-bus: ACPI / bus: Add INT0002 to list of always-present devices ACPI / bus: Introduce a list of ids for "always present" devices * acpi-pmic: ACPI / PMIC: xpower: Fix power_table addresses * acpi-power: ACPI / power: Delay turning off unused power resources after suspend commit 8269c734049cf4869c99d63c5d94774db37ca190 Merge: 08be881 bc5150e Author: Rafael J. Wysocki Date: Tue May 9 23:22:36 2017 +0200 Merge branch 'acpica' * acpica: ACPICA: Update version to 20170303 ACPICA: iasl: add ASL conversion tool ACPICA: Local cache support: Allow small cache objects ACPICA: Disassembler: Do not unconditionally remove temporary names ACPICA: iasl: Fix IORT SMMU GSI disassembling ACPICA: Cleanup AML opcode definitions, no functional change ACPICA: Debugger: Add interpreter blocking mark for single-step mode ACPICA: debugger: fix memory leak on Pathname ACPICA: Update for automatic repair code for objects returned by evaluate_object ACPICA: Namespace: fix operand cache leak ACPICA: Fix several incorrect invocations of ACPICA return macro ACPICA: Fix a module for excessive debug output ACPICA: Update some function headers, no funtional change ACPICA: Disassembler: Enhance resource descriptor detection ACPICA: Add non-linux host build support commit 80449d89d4d6d0af4d6d310597e0f4a3fe0c08a9 Merge: 08be881 5e68ebd 1b2e876 eed4d47 4486740 Author: Rafael J. Wysocki Date: Tue May 9 23:21:46 2017 +0200 Merge branches 'pm-domains', 'pm-cpuidle', 'pm-sleep' and 'powercap' * pm-domains: PM / Domains: Add DT file to MAINTAINERS PM / Domains: Fix DT example * pm-cpuidle: x86/intel_idle: add Gemini Lake support cpuidle: check dev before usage in cpuidle_use_deepest_state() * pm-sleep: ACPI / sleep: Ignore spurious SCI wakeups from suspend-to-idle PM / wakeup: Integrate mechanism to abort transitions in progress * powercap: powercap: intel_rapl: Add support for Gemini Lake commit b550a32e60a4941994b437a8d662432a486235a5 Author: Ari Kauppi Date: Fri May 5 16:07:55 2017 -0400 nfsd: fix undefined behavior in nfsd4_layout_verify UBSAN: Undefined behaviour in fs/nfsd/nfs4proc.c:1262:34 shift exponent 128 is too large for 32-bit type 'int' Depending on compiler+architecture, this may cause the check for layout_type to succeed for overly large values (which seems to be the case with amd64). The large value will be later used in de-referencing nfsd4_layout_ops for function pointers. Reported-by: Jani Tuovila Signed-off-by: Ari Kauppi [colin.king@canonical.com: use LAYOUT_TYPE_MAX instead of 32] Cc: stable@vger.kernel.org Reviewed-by: Dan Carpenter Reviewed-by: Christoph Hellwig Signed-off-by: J. Bruce Fields fs/nfsd/nfs4proc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 76b2a303384e1d6299c3a0249f0f0ce2f8f96017 Author: Trond Myklebust Date: Tue May 9 16:02:57 2017 -0400 pNFS/flexfiles: Always attempt to call layoutstats when flexfiles is enabled Layoutstats is always desirable when using the flexfiles driver, so we should enable it if that driver is being loaded. It is safe to do so, because even when the mount specifies NFSv4.1, we will turn it off if the server tells us it is unsupported. Signed-off-by: Trond Myklebust fs/nfs/flexfilelayout/flexfilelayout.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit f4b23de3dda1536590787c9e5c3d16b8738ab108 Author: Trond Myklebust Date: Tue May 9 15:47:15 2017 -0400 NFSv4.1: Work around a Linux server bug... It turns out the Linux server has a bug in its implementation of supattr_exclcreat; it returns the set of all attributes, whether or not they are supported by minor version 1. In order to avoid a regression, we therefore apply the supported_attrs as a mask on top of whatever the server sent us. Reported-by: Anna Schumaker Signed-off-by: Trond Myklebust fs/nfs/nfs4proc.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 0fe397f0c65d478eea3798ac361736fd91da7022 Author: Helmut Grohne Date: Wed May 3 11:51:46 2017 +0200 docs: update references to the device io book While converting the deviceiobook from DocBook to RST, dangling references were left behind. This commit updates all remaining references to the new location. SeongJae Park improved the ko_KR translation. Fixes: 8a8a602fdb83 ("docs: Convert the deviceio template to RST") Signed-off-by: Helmut Grohne Signed-off-by: SeongJae Park Signed-off-by: Jonathan Corbet Documentation/memory-barriers.txt | 4 ++-- Documentation/translations/ko_KR/memory-barriers.txt | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) commit f7c864e7ee5c3907d232838f1b4540612252a605 Author: Andre Przywara Date: Thu May 4 00:49:36 2017 +0100 Documentation: earlycon: fix Marvell Armada 3700 UART name The Marvell Armada 3700 UART uses "ar3700_uart" for its earlycon name. Adjust documentation to match the code. Signed-off-by: Andre Przywara Signed-off-by: Jonathan Corbet Documentation/admin-guide/kernel-parameters.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit aeb899af65d2d29039ce8f000bced39dd0dacad1 Author: Mauro Carvalho Chehab Date: Tue Apr 11 07:01:19 2017 -0300 docs-rst: add input docs at main index and use kernel-figure The input subsystem documentation got converted into ReST. Add it to the main documentation index and use kernel-figure for the two svg images there. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Documentation/index.rst | 1 + Documentation/input/ff.rst | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) commit 657831ffc38e30092a2d5f03d385d710eb88b09a Author: Eric Dumazet Date: Tue May 9 06:29:19 2017 -0700 dccp/tcp: do not inherit mc_list from parent syzkaller found a way to trigger double frees from ip_mc_drop_socket() It turns out that leave a copy of parent mc_list at accept() time, which is very bad. Very similar to commit 8b485ce69876 ("tcp: do not inherit fastopen_req from parent") Initial report from Pray3r, completed by Andrey one. Thanks a lot to them ! Signed-off-by: Eric Dumazet Reported-by: Pray3r Reported-by: Andrey Konovalov Tested-by: Andrey Konovalov Signed-off-by: David S. Miller net/ipv4/inet_connection_sock.c | 2 ++ 1 file changed, 2 insertions(+) commit 3c7f62212018b904ae17f5636ead18a4dca3a88f Author: Dave Aldridge Date: Tue May 9 02:57:35 2017 -0600 sparc64: fix fault handling in NGbzero.S and GENbzero.S When any of the functions contained in NGbzero.S and GENbzero.S vector through *bzero_from_clear_user, we may end up taking a fault when executing one of the store alternate address space instructions. If this happens, the exception handler does not restore the %asi register. This commit fixes the issue by introducing a new exception handler that ensures the %asi register is restored when a fault is handled. Orabug: 25577560 Signed-off-by: Dave Aldridge Reviewed-by: Rob Gardner Reviewed-by: Babu Moger Signed-off-by: David S. Miller arch/sparc/kernel/head_64.S | 6 ++++++ arch/sparc/lib/GENbzero.S | 2 +- arch/sparc/lib/NGbzero.S | 2 +- 3 files changed, 8 insertions(+), 2 deletions(-) commit aed74ea0a09d2e60e4b3fe45caf30f6365b6c9f3 Author: Geliang Tang Date: Sat May 6 23:40:20 2017 +0800 sparc: use memdup_user_nul in sun4m LED driver Use memdup_user_nul() helper instead of open-coding to simplify the code. Signed-off-by: Geliang Tang Signed-off-by: David S. Miller arch/sparc/kernel/led.c | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-) commit e942661130e7221d4aeac9804ff100e7516470f3 Merge: 6f92120 1c08036 Author: Arnd Bergmann Date: Tue May 9 21:14:47 2017 +0200 Merge tag 'v4.11-next-fixes' of https://github.com/mbgg/linux-mediatek into fixes Pull "DTS fixes" from Matthias Brugger: - mt8173: fix mmc parameters - set timer frequency explicitly and force the driver to set it * tag 'v4.11-next-fixes' of https://github.com/mbgg/linux-mediatek: ARM64: dts: mediatek: configure some fixed mmc parameters arm: dts: mt7623: add clock-frequency to the a7 timer node to mt7623.dtsi commit 6f92120892d94ef6c551da5aa2cf7bc9401c9903 Author: Arnd Bergmann Date: Fri Apr 21 23:55:28 2017 +0200 ARM: omap2+: make omap4_get_cpu1_ns_pa_addr declaration usable When CONFIG_PM is disabled, we get a build error: arch/arm/mach-omap2/omap-smp.c: In function 'omap4_smp_maybe_reset_cpu1': arch/arm/mach-omap2/omap-smp.c:309:20: error: implicit declaration of function 'omap4_get_cpu1_ns_pa_addr'; did you mean 'omap4_get_scu_base'? [-Werror=implicit-function-declaration] We need to fix this in multiple files, to ensure the declaration is visible, to actually build the function without CONFIG_PM, and to only call it when OMAP4 and/or OMAP5 are enabled. Fixes: 351b7c490700 ("ARM: omap2+: Revert omap-smp.c changes resetting CPU1 during boot") Signed-off-by: Arnd Bergmann Acked-by: Tony Lindgren arch/arm/mach-omap2/common.h | 3 ++- arch/arm/mach-omap2/omap-mpuss-lowpower.c | 10 +++++----- arch/arm/mach-omap2/omap-smp.c | 11 +++++++---- 3 files changed, 14 insertions(+), 10 deletions(-) commit 4a1e31c68e9f40be32838944931178b0d9ed9162 Merge: c6778ff cf4100d Author: Linus Torvalds Date: Tue May 9 10:10:15 2017 -0700 Merge tag 'arc-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc Pull ARC updates from Vineet Gupta: - AXS10x platform clk updates for I2S, PGU - add region based cache flush operation for ARCv2 cores - enforce PAE40 dependency on HIGHMEM - ptrace support for additional regs in ARCv2 cores - fix build failure in linux-next dut to a header include ordering change * tag 'arc-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc: Revert "ARCv2: Allow enabling PAE40 w/o HIGHMEM" ARC: mm: fix build failure in linux-next for UP builds ARCv2: ptrace: provide regset for accumulator/r30 regs elf: Add ARCv2 specific core note section ARCv2: mm: micro-optimize region flush generated code ARCv2: mm: Merge 2 updates to DC_CTRL for region flush ARCv2: mm: Implement cache region flush operations ARC: mm: Move full_page computation into cache version agnostic wrapper arc: axs10x: Fix ARC PGU default clock frequency arc: axs10x: Add DT bindings for I2S audio playback commit 8376efd31d3d7c44bd05be337adde023cc531fa1 Author: Ben Hutchings Date: Tue May 9 18:00:43 2017 +0100 x86, pmem: Fix cache flushing for iovec write < 8 bytes Commit 11e63f6d920d added cache flushing for unaligned writes from an iovec, covering the first and last cache line of a >= 8 byte write and the first cache line of a < 8 byte write. But an unaligned write of 2-7 bytes can still cover two cache lines, so make sure we flush both in that case. Cc: Fixes: 11e63f6d920d ("x86, pmem: fix broken __copy_user_nocache ...") Signed-off-by: Ben Hutchings Signed-off-by: Dan Williams arch/x86/include/asm/pmem.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c6778ff813d2ca3e3c8733c87dc8b6831a64578b Merge: 0ff4c01 3c0e3ab Author: Linus Torvalds Date: Tue May 9 10:07:33 2017 -0700 Merge tag 'armsoc-dt64' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM 64-bit DT updates from Olof Johansson: "Device-tree updates for arm64 platforms. Just as with 32-bit, a bunch of smaller changes, but also some new platforms that are worth mentioning: - Rockchip RK3399 platforms for Chromebooks, including Samsung Chromebook Plus (Kevin) - Orange Pi PC2 (Allwinner H5) - Freescale LS2088A and LS1088A SoCs - Expanded support for Nvidia Tegra186 (and Jetson TX2)" * tag 'armsoc-dt64' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (180 commits) arm64: dts: Add basic DT to support Spreadtrum's SP9860G arm64: dts: exynos: Use - instead of @ for DT OPP entries arm64: dts: exynos: Add support for s6e3hf2 panel device on TM2e board arm64: dts: juno: add information about L1 and L2 caches arm64: dts: juno: fix few unit address format warnings arm64: marvell: dts: enable the crypto engine on the Armada 8040 DB arm64: marvell: dts: enable the crypto engine on the Armada 7040 DB arm64: marvell: dts: add crypto engine description for 7k/8k arm64: dts: marvell: add sdhci support for Armada 7K/8K arm64: dts: marvell: add eMMC support for Armada 37xx arm64: dts: hisi: add pinctrl dtsi file for HiKey960 development board arm64: dts: hisi: add drive strength levels of the pins for Hi3660 SoC arm64: dts: hisi: enable the NIC and SAS for the hip07-d05 board arm64: dts: hisi: add SAS nodes for the hip07 SoC arm64: dts: hisi: add RoCE nodes for the hip07 SoC arm64: dts: hisi: add network related nodes for the hip07 SoC arm64: dts: hisi: add mbigen nodes for the hip07 SoC arm64: dts: rockchip: fix the memory size of PX5 Evaluation board arm64: dts: hisilicon: add dts files for hi3798cv200-poplar board dt-bindings: arm: hisilicon: add bindings for hi3798cv200 SoC and Poplar board ... commit 0ff4c01b279a590a2826ade9321ad8c7ca5a1b6c Merge: 0160e00 900a902 Author: Linus Torvalds Date: Tue May 9 10:04:17 2017 -0700 Merge tag 'armsoc-arm64' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC 64-bit changes from Olof Johansson: "Changes to platform code for 64-bit ARM platforms. Most of these are small changes to the one defconfig we use on arm64 (no per-platform configs there), to enable new drivers. There are also a few other changes. Broadcom sold off their 'Vulcan' design to Cavium, where it is now called ThunderX2. While we normally don't rename stuff based on marketing's whims, it seemed appropriate to bring in renames on a few things such as MAINTAINERS, etc" * tag 'armsoc-arm64' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: arm64: sunxi: always enable reset controller arm64: defconfig: enable the Safexcel crypto engine as a module arm64: configs: enable SDHCI driver for Xenon MAINTAINERS: Broadcom Vulcan is now Cavium ThunderX2 arm64: defconfig: add Allwinner USB PHY arm64: defconfig: enable MVPP2 arm64: defconfig: Enable video, DRM and LPASS drivers for Exynos5433 and Exynos7 arm64: exynos: Enable Exynos PMU and PM domains drivers arm64: only select PINCTRL for Allwinner platforms arm64: set CONFIG_MMC_BCM2835=y in defconfig arm64: defconfig: enable I2C_PXA arm64: defconfig: enable MVNETA ARM64: defconfig: enable the leds-pwm driver and default-on trigger arm64: defconfig: Enable SH Mobile I2C controller commit 0160e00ae8e987be8822745fb166aa76451c9bcc Merge: c81ee18 b6942b6 Author: Linus Torvalds Date: Tue May 9 10:01:15 2017 -0700 Merge tag 'armsoc-drivers' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC driver updates from Olof Johansson: "Driver updates for ARM SoCs: Reset subsystem, merged through arm-soc by tradition: - Make bool drivers explicitly non-modular - New support for i.MX7 and Arria10 reset controllers PATA driver for Palmchip BK371 (acked by Tejun) Power domain drivers for i.MX (GPC, GPCv2) - Moved out of mach-imx for GPC - Bunch of tweaks, fixes, etc PMC support for Tegra186 SoC detection support for Renesas RZ/G1H and RZ/G1N Move Tegra flow controller driver from mach directory to drivers/soc - (Power management / CPU power driver) Misc smaller tweaks for other platforms" * tag 'armsoc-drivers' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (60 commits) soc: pm-domain: Fix the mangled urls soc: renesas: rcar-sysc: Add support for R-Car H3 ES2.0 soc: renesas: rcar-sysc: Add support for fixing up power area tables soc: renesas: Register SoC device early soc: imx: gpc: add workaround for i.MX6QP to the GPC PD driver dt-bindings: imx-gpc: add i.MX6 QuadPlus compatible soc: imx: gpc: add defines for domain index soc: imx: Add GPCv2 power gating driver dt-bindings: Add GPCv2 power gating driver ARM/clk: move the ICST library to drivers/clk ARM: plat-versatile: remove stale clock header ARM: keystone: Drop PM domain support for k2g soc: ti: Add ti_sci_pm_domains driver dt-bindings: Add TI SCI PM Domains PM / Domains: Do not check if simple providers have phandle cells PM / Domains: Add generic data pointer to genpd data struct soc/tegra: Add initial flowctrl support for Tegra132/210 soc/tegra: flowctrl: Add basic platform driver soc/tegra: Move Tegra flowctrl driver ARM: tegra: Remove unnecessary inclusion of flowctrl header ... commit c81ee18e97e4e3162169a749eb7f2b79b3510c7a Merge: 85d6049 ad8618c Author: Linus Torvalds Date: Tue May 9 09:58:15 2017 -0700 Merge tag 'armsoc-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM: SoC defconfig updates from Olof Johansson: "We've traditionally kept defconfig updates in a separate branch, often to encourage submaintainers to handle those patches separately to avoid conflicts on the shared files. The amount of changes seem to be decreasing though, so we might rethink how we handle this going forward. There really isn't much to write about here. The bulk of changes here are enabling drivers for whatever platforms the hardware is found on (and multi-configs)" * tag 'armsoc-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (30 commits) multi_v7_defconfig: make Rockchip usb2-phy built-in ARM: omap2plus_defconfig: Enable droid 4 devices ARM: omap2plus_defconfig: Add QMI, ACM and PPP as loadable modules ARM: configs: aspeed: Add new drivers ARM: configs: aspeed: Update configs for BMC systems ARM: omap2plus_defconfig: Enable TI Ethernet PHY ARM: configs: Add new config fragment to change RAM start point ARM: configs: stm32: Add I2C support multi_v7_defconfig: make Rockchip DRM drivers built-in ARM: configs: stm32: Set CPU_V7M_NUM_IRQ to max value ARM: imx_v6_v7_defconfig: Select SMSC_PHY ARM: davinci_all_defconfig: convert to use libata PATA ARM: qcom_defconfig: Enable Qualcomm remoteproc and related drivers ARM: omap2plus_defconfig: enable ahci-dm816 module arm: set CONFIG_MMC_BCM2835=y in bcm2835_defconfig and multi_v7_defconfig ARM: bcm2835: Enable missing CMA settings for VC4 driver ARM: socfpga: updates for socfpga_defconfig ARM: imx_v6_v7_defconfig: Select hid-multitouchdriver ARM: imx_v6_v7_defconfig: Select max11801_ts touchscreen driver ARM: exynos_defconfig: Increase CONFIG_CMA_SIZE_MBYTES to 96 ... commit 85d604902eb28eaea4f9e0f3a655ae986fa4bd2e Merge: 8d648aa b9f34da Author: Linus Torvalds Date: Tue May 9 09:54:39 2017 -0700 Merge tag 'armsoc-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM Device-tree updates from Olof Johansson: "Device-tree continues to see lots of updates. The majority of patches here are smaller changes for new hardware on existing platforms, and there are a few larger changes worth pointing out. Major new platforms: - Gemini has been ported to DT, so a handful of "new" platforms moved over from board files - Rockchip RK3288 support for Tinkerboard and Phytec phyCORE-RK3288 SoM and RDK - A bunch of embedded platforms, several Linksys platforms, Synology DS116, - Motorola Droid4 (really old OMAP-based phone) support is added. Some refactorings, i.e. Allwinner H3/H5 support is commonalized. And lots of smaller changes, cleanups, etc. See shortlog for more description We're adding ability to cross-include DT files between arm and arm64, by creating appropriate links in the dt-include directory, and using arm/ and arm64/ as include prefixes. This will avoid other local hacks such as per-file links between the two arch trees (this broke for external mirroring of DT contents). Now they can just provide their own appropriate dt-include hierarcy per platform" * tag 'armsoc-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (349 commits) ARM: dts: exynos: Use - instead of @ for DT OPP entries arm: spear6xx: add DT description of the ADC on SPEAr600 arm: spear6xx: remove unneeded pinctrl properties in spear600-evb arm: spear6xx: switch spear600-evb to the new flash partition DT binding arm: spear6xx: fix spaces in spear600-evb.dts arm: spear6xx: use node labels in spear600-evb.dts arm: spear6xx: add labels to various nodes in spear600.dtsi ARM: dts: vexpress: fix few unit address format warnings ARM: dts: at91: sama5d3_xplained: not all ADC channels are available ARM: dts: at91: sama5d3_xplained: fix ADC vref ARM: dts: at91: add envelope detector mux to the Axentia TSE-850 ARM: dts: armada-38x: label USB and SATA nodes ARM: dts: imx6q-utilite-pro: add hpd gpio ARM: dts: imx6qp-sabresd: Set reg_arm regulator supply ARM: dts: imx6qdl-sabresd: Set LDO regulator supply ARM: dts: imx: add Gateworks Ventana GW5903 support ARM: dts: i.MX25: add AIPS control registers ARM: dts: imx7-colibri: add Carrier Board 3.3V/5V regulators ARM: dts: imx7-colibri: remove 1.8V fixed regulator ARM: dts: imx7-colibri: allow to disable Ethernet rail ... commit 8d648aad05811ccc07df22834de60a7bf8d9e0e6 Merge: e07e368 17e310b Author: Linus Torvalds Date: Tue May 9 09:49:36 2017 -0700 Merge tag 'armsoc-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull ARM SoC platform updates from Olof Johansson: "SoC platform changes (arch/arm/mach-*). This merge window, the bulk is for a few platforms: Gemini: - Legacy platform that Linus Walleij has converted to multiplatform and DT, so a handful of various tweaks there, removal of some old stale support, etc. Atmel AT91: - Fixup of various power management related pieces - Move of SoC detection to a drivers/soc driver instead ST Micro STM32: - New SoC support: STM32H743 TI platforms: - More driver support for Davinci (SATA in particular) - Removal of some old stale hwmod files (linkspace platform) Misc: - A couple of smaller patches for i.MX, sunxi, hisi" * tag 'armsoc-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (57 commits) ARM: davinci: Add clock for CPPI 4.1 DMA engine ARM: mxs: add support for I2SE Duckbill 2 boards MAINTAINERS: Update the Allwinner sunXi entry ARM: i.MX25: globally disable supervisor protect ARM: at91: move SoC detection to its own driver ARM: at91: pm: correct typo ARM: at91: pm: Remove at91_pm_set_standby ARM: at91: pm: Merge all at91sam9*_pm_init ARM: at91: pm: Tie the USB clock mask to the pmc ARM: at91: pm: Tie the memory controller type to the ramc id ARM: at91: pm: Workaround DDRSDRC self-refresh bug with LPDDR1 memories. ARM: at91: pm: Simplify at91rm9200_standby ARM: at91: pm: Use struct at91_pm_data in pm_suspend.S ARM: at91: pm: Move global variables into at91_pm_data ARM: at91: pm: Move at91_ramc_read/write to pm.c ARM: at91: pm: Cleanup headers MAINTAINERS: Add memory drivers to AT91 entry MAINTAINERS: Update AT91 entry ARM: davinci: add pata_bk3710 libata driver support ARM: OMAP2+: mark omap_init_rng as __init ... commit d135b8b5060ea91dd751ff172d179eb4eab1e966 Author: Mark Rutland Date: Wed May 3 16:09:38 2017 +0100 arm64: uaccess: suppress spurious clang warning Clang tries to warn when there's a mismatch between an operand's size, and the size of the register it is held in, as this may indicate a bug. Specifically, clang warns when the operand's type is less than 64 bits wide, and the register is used unqualified (i.e. %N rather than %xN or %wN). Unfortunately clang can generate these warnings for unreachable code. For example, for code like: do { \ typeof(*(ptr)) __v = (v); \ switch(sizeof(*(ptr))) { \ case 1: \ // assume __v is 1 byte wide \ asm ("{op}b %w0" : : "r" (v)); \ break; \ case 8: \ // assume __v is 8 bytes wide \ asm ("{op} %0" : : "r" (v)); \ break; \ } while (0) ... if op() were passed a char value and pointer to char, clang may produce a warning for the unreachable case where sizeof(*(ptr)) is 8. For the same reasons, clang produces warnings when __put_user_err() is used for types that are less than 64 bits wide. We could avoid this with a cast to a fixed-width type in each of the cases. However, GCC will then warn that pointer types are being cast to mismatched integer sizes (in unreachable paths). Another option would be to use the same union trickery as we do for __smp_store_release() and __smp_load_acquire(), but this is fairly invasive. Instead, this patch suppresses the clang warning by using an x modifier in the assembly for the 8 byte case of __put_user_err(). No additional work is necessary as the value has been cast to typeof(*(ptr)), so the compiler will have performed any necessary extension for the reachable case. For consistency, __get_user_err() is also updated to use the x modifier for its 8 byte case. Acked-by: Will Deacon Signed-off-by: Mark Rutland Reported-by: Matthias Kaehlcke Signed-off-by: Catalin Marinas arch/arm64/include/asm/uaccess.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 8997c93452d16aac11d3b0cc53940c94330273a4 Author: Mark Rutland Date: Wed May 3 16:09:37 2017 +0100 arm64: atomic_lse: match asm register sizes The LSE atomic code uses asm register variables to ensure that parameters are allocated in specific registers. In the majority of cases we specifically ask for an x register when using 64-bit values, but in a couple of cases we use a w regsiter for a 64-bit value. For asm register variables, the compiler only cares about the register index, with wN and xN having the same meaning. The compiler determines the register size to use based on the type of the variable. Thus, this inconsistency is merely confusing, and not harmful to code generation. For consistency, this patch updates those cases to use the x register alias. There should be no functional change as a result of this patch. Acked-by: Will Deacon Signed-off-by: Mark Rutland Signed-off-by: Catalin Marinas arch/arm64/include/asm/atomic_lse.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 55de49f9aa17b0b2b144dd2af587177b9aadf429 Author: Mark Rutland Date: Wed May 3 16:09:36 2017 +0100 arm64: armv8_deprecated: ensure extension of addr Our compat swp emulation holds the compat user address in an unsigned int, which it passes to __user_swpX_asm(). When a 32-bit value is passed in a register, the upper 32 bits of the register are unknown, and we must extend the value to 64 bits before we can use it as a base address. This patch casts the address to unsigned long to ensure it has been suitably extended, avoiding the potential issue, and silencing a related warning from clang. Fixes: bd35a4adc413 ("arm64: Port SWP/SWPB emulation support from arm") Cc: # 3.19.x- Acked-by: Will Deacon Signed-off-by: Mark Rutland Signed-off-by: Catalin Marinas arch/arm64/kernel/armv8_deprecated.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit a06040d7a791a9177581dcf7293941bd92400856 Author: Mark Rutland Date: Wed May 3 16:09:35 2017 +0100 arm64: uaccess: ensure extension of access_ok() addr Our access_ok() simply hands its arguments over to __range_ok(), which implicitly assummes that the addr parameter is 64 bits wide. This isn't necessarily true for compat code, which might pass down a 32-bit address parameter. In these cases, we don't have a guarantee that the address has been zero extended to 64 bits, and the upper bits of the register may contain unknown values, potentially resulting in a suprious failure. Avoid this by explicitly casting the addr parameter to an unsigned long (as is done on other architectures), ensuring that the parameter is widened appropriately. Fixes: 0aea86a2176c ("arm64: User access library functions") Cc: # 3.7.x- Acked-by: Will Deacon Signed-off-by: Mark Rutland Signed-off-by: Catalin Marinas arch/arm64/include/asm/uaccess.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 994870bead4ab19087a79492400a5478e2906196 Author: Mark Rutland Date: Wed May 3 16:09:34 2017 +0100 arm64: ensure extension of smp_store_release value When an inline assembly operand's type is narrower than the register it is allocated to, the least significant bits of the register (up to the operand type's width) are valid, and any other bits are permitted to contain any arbitrary value. This aligns with the AAPCS64 parameter passing rules. Our __smp_store_release() implementation does not account for this, and implicitly assumes that operands have been zero-extended to the width of the type being stored to. Thus, we may store unknown values to memory when the value type is narrower than the pointer type (e.g. when storing a char to a long). This patch fixes the issue by casting the value operand to the same width as the pointer operand in all cases, which ensures that the value is zero-extended as we expect. We use the same union trickery as __smp_load_acquire and {READ,WRITE}_ONCE() to avoid GCC complaining that pointers are potentially cast to narrower width integers in unreachable paths. A whitespace issue at the top of __smp_store_release() is also corrected. No changes are necessary for __smp_load_acquire(). Load instructions implicitly clear any upper bits of the register, and the compiler will only consider the least significant bits of the register as valid regardless. Fixes: 47933ad41a86 ("arch: Introduce smp_load_acquire(), smp_store_release()") Fixes: 878a84d5a8a1 ("arm64: add missing data types in smp_load_acquire/smp_store_release") Cc: # 3.14.x- Acked-by: Will Deacon Signed-off-by: Mark Rutland Cc: Matthias Kaehlcke Signed-off-by: Catalin Marinas arch/arm64/include/asm/barrier.h | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) commit fee960bed5e857eb126c4e56dd9ff85938356579 Author: Mark Rutland Date: Wed May 3 16:09:33 2017 +0100 arm64: xchg: hazard against entire exchange variable The inline assembly in __XCHG_CASE() uses a +Q constraint to hazard against other accesses to the memory location being exchanged. However, the pointer passed to the constraint is a u8 pointer, and thus the hazard only applies to the first byte of the location. GCC can take advantage of this, assuming that other portions of the location are unchanged, as demonstrated with the following test case: union u { unsigned long l; unsigned int i[2]; }; unsigned long update_char_hazard(union u *u) { unsigned int a, b; a = u->i[1]; asm ("str %1, %0" : "+Q" (*(char *)&u->l) : "r" (0UL)); b = u->i[1]; return a ^ b; } unsigned long update_long_hazard(union u *u) { unsigned int a, b; a = u->i[1]; asm ("str %1, %0" : "+Q" (*(long *)&u->l) : "r" (0UL)); b = u->i[1]; return a ^ b; } The linaro 15.08 GCC 5.1.1 toolchain compiles the above as follows when using -O2 or above: 0000000000000000 : 0: d2800001 mov x1, #0x0 // #0 4: f9000001 str x1, [x0] 8: d2800000 mov x0, #0x0 // #0 c: d65f03c0 ret 0000000000000010 : 10: b9400401 ldr w1, [x0,#4] 14: d2800002 mov x2, #0x0 // #0 18: f9000002 str x2, [x0] 1c: b9400400 ldr w0, [x0,#4] 20: 4a000020 eor w0, w1, w0 24: d65f03c0 ret This patch fixes the issue by passing an unsigned long pointer into the +Q constraint, as we do for our cmpxchg code. This may hazard against more than is necessary, but this is better than missing a necessary hazard. Fixes: 305d454aaa29 ("arm64: atomics: implement native {relaxed, acquire, release} atomics") Cc: # 4.4.x- Acked-by: Will Deacon Signed-off-by: Mark Rutland Signed-off-by: Catalin Marinas arch/arm64/include/asm/cmpxchg.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f0e421b1bf7af97f026e1bb8bfe4c5a7a8c08f42 Author: Kristina Martsenko Date: Wed May 3 16:37:48 2017 +0100 arm64: documentation: document tagged pointer stack constraints Some kernel features don't currently work if a task puts a non-zero address tag in its stack pointer, frame pointer, or frame record entries (FP, LR). For example, with a tagged stack pointer, the kernel can't deliver signals to the process, and the task is killed instead. As another example, with a tagged frame pointer or frame records, perf fails to generate call graphs or resolve symbols. For now, just document these limitations, instead of finding and fixing everything that doesn't work, as it's not known if anyone needs to use tags in these places anyway. In addition, as requested by Dave Martin, generalize the limitations into a general kernel address tag policy, and refactor tagged-pointers.txt to include it. Fixes: d50240a5f6ce ("arm64: mm: permit use of tagged pointers at EL0") Cc: # 3.12.x- Reviewed-by: Dave Martin Acked-by: Will Deacon Signed-off-by: Kristina Martsenko Signed-off-by: Catalin Marinas Documentation/arm64/tagged-pointers.txt | 62 +++++++++++++++++++++++++-------- 1 file changed, 47 insertions(+), 15 deletions(-) commit 1c0803652d82b9a62980886e019c9f70576028a5 Author: yong mao Date: Wed Mar 15 15:26:39 2017 +0800 ARM64: dts: mediatek: configure some fixed mmc parameters configure some fixed mmc parameters Signed-off-by: Yong Mao Signed-off-by: Chaotian Jing Signed-off-by: Matthias Brugger arch/arm64/boot/dts/mediatek/mt8173-evb.dts | 3 +++ 1 file changed, 3 insertions(+) commit 7e6c7fe95e3d0be80d0d05a2efde5c8fb97602ba Author: John Crispin Date: Wed Apr 26 17:25:50 2017 +0800 arm: dts: mt7623: add clock-frequency to the a7 timer node to mt7623.dtsi We need to tell the driver what the timers frequency is and that the core has not be configured by the bootrom. Not doing so makes the unit not boot. Signed-off-by: John Crispin Signed-off-by: Sean Wang Signed-off-by: Matthias Brugger arch/arm/boot/dts/mt7623.dtsi | 2 ++ 1 file changed, 2 insertions(+) commit 276e93279a630657fff4b086ba14c95955912dfa Author: Kristina Martsenko Date: Wed May 3 16:37:47 2017 +0100 arm64: entry: improve data abort handling of tagged pointers When handling a data abort from EL0, we currently zero the top byte of the faulting address, as we assume the address is a TTBR0 address, which may contain a non-zero address tag. However, the address may be a TTBR1 address, in which case we should not zero the top byte. This patch fixes that. The effect is that the full TTBR1 address is passed to the task's signal handler (or printed out in the kernel log). When handling a data abort from EL1, we leave the faulting address intact, as we assume it's either a TTBR1 address or a TTBR0 address with tag 0x00. This is true as far as I'm aware, we don't seem to access a tagged TTBR0 address anywhere in the kernel. Regardless, it's easy to forget about address tags, and code added in the future may not always remember to remove tags from addresses before accessing them. So add tag handling to the EL1 data abort handler as well. This also makes it consistent with the EL0 data abort handler. Fixes: d50240a5f6ce ("arm64: mm: permit use of tagged pointers at EL0") Cc: # 3.12.x- Reviewed-by: Dave Martin Acked-by: Will Deacon Signed-off-by: Kristina Martsenko Signed-off-by: Catalin Marinas arch/arm64/include/asm/asm-uaccess.h | 9 +++++++++ arch/arm64/kernel/entry.S | 5 +++-- 2 files changed, 12 insertions(+), 2 deletions(-) commit 7dcd9dd8cebe9fa626af7e2358d03a37041a70fb Author: Kristina Martsenko Date: Wed May 3 16:37:46 2017 +0100 arm64: hw_breakpoint: fix watchpoint matching for tagged pointers When we take a watchpoint exception, the address that triggered the watchpoint is found in FAR_EL1. We compare it to the address of each configured watchpoint to see which one was hit. The configured watchpoint addresses are untagged, while the address in FAR_EL1 will have an address tag if the data access was done using a tagged address. The tag needs to be removed to compare the address to the watchpoints. Currently we don't remove it, and as a result can report the wrong watchpoint as being hit (specifically, always either the highest TTBR0 watchpoint or lowest TTBR1 watchpoint). This patch removes the tag. Fixes: d50240a5f6ce ("arm64: mm: permit use of tagged pointers at EL0") Cc: # 3.12.x- Acked-by: Mark Rutland Acked-by: Will Deacon Signed-off-by: Kristina Martsenko Signed-off-by: Catalin Marinas arch/arm64/include/asm/uaccess.h | 6 +++--- arch/arm64/kernel/hw_breakpoint.c | 3 +++ 2 files changed, 6 insertions(+), 3 deletions(-) commit 81cddd65b5c82758ea5571a25e31ff6f1f89ff02 Author: Kristina Martsenko Date: Wed May 3 16:37:45 2017 +0100 arm64: traps: fix userspace cache maintenance emulation on a tagged pointer When we emulate userspace cache maintenance in the kernel, we can currently send the task a SIGSEGV even though the maintenance was done on a valid address. This happens if the address has a non-zero address tag, and happens to not be mapped in. When we get the address from a user register, we don't currently remove the address tag before performing cache maintenance on it. If the maintenance faults, we end up in either __do_page_fault, where find_vma can't find the VMA if the address has a tag, or in do_translation_fault, where the tagged address will appear to be above TASK_SIZE. In both cases, the address is not mapped in, and the task is sent a SIGSEGV. This patch removes the tag from the address before using it. With this patch, the fault is handled correctly, the address gets mapped in, and the cache maintenance succeeds. As a second bug, if cache maintenance (correctly) fails on an invalid tagged address, the address gets passed into arm64_notify_segfault, where find_vma fails to find the VMA due to the tag, and the wrong si_code may be sent as part of the siginfo_t of the segfault. With this patch, the correct si_code is sent. Fixes: 7dd01aef0557 ("arm64: trap userspace "dc cvau" cache operation on errata-affected core") Cc: # 4.8.x- Acked-by: Will Deacon Signed-off-by: Kristina Martsenko Signed-off-by: Catalin Marinas arch/arm64/kernel/traps.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit e07e368b27c3470765b70f71279d18992c7d9e03 Merge: 11fbf53 c58ab53 Author: Linus Torvalds Date: Tue May 9 09:20:16 2017 -0700 Merge tag 'armsoc-fixes-nc' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc Pull misc ARM SoC fixes from Olof Johansson: "ARM SoC non-urgent fixes for merge window Smaller patches that didn't seem to find a home in other branches, and low-priority fixes from late in the merge window. A number of these are MAINTAINER updates, it seems. Highlights: * Maintainers: - Remove Alexandre Courbot and Stephen Warren from Tegra maintainership, add Jon Hunter - Remove Stephen Warren and add Stefan Wahren to bcm2835 - Tweaks for file flagging for Marvell Dove * Fixes: - For two non-common-clk platform, handle clk_disable with NULL arg - Remove redundant Kconfig select for Oxnas" * tag 'armsoc-fixes-nc' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: ARM: mmp: let clk_disable() return immediately if clk is NULL ARM: w90x900: let clk_disable() return immediately if clk is NULL MAINTAINERS: Add file patterns for dove device tree bindings ARM: oxnas: remove redundant select CPU_V6K MAINTAINERS: tegra: Remove self as maintainer MAINTAINERS: tegra: Replace Stephen with Jon MAINTAINERS: Add Stefan Wahren to bcm2835. MAINTAINERS: remove swarren from bcm2835 MAINTAINERS: Add Jon Mason to BCM5301X maintainers commit 11fbf53d66ec302fe50b06bd7cb4863dbb98775a Merge: 339fbf6 6b46576 Author: Linus Torvalds Date: Tue May 9 09:12:53 2017 -0700 Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull misc vfs updates from Al Viro: "Assorted bits and pieces from various people. No common topic in this pile, sorry" * 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: fs/affs: add rename exchange fs/affs: add rename2 to prepare multiple methods Make stat/lstat/fstatat pass AT_NO_AUTOMOUNT to vfs_statx() fs: don't set *REFERENCED on single use objects fs: compat: Remove warning from COMPATIBLE_IOCTL remove pointless extern of atime_need_update_rcu() fs: completely ignore unknown open flags fs: add a VALID_OPEN_FLAGS fs: remove _submit_bh() fs: constify tree_descr arrays passed to simple_fill_super() fs: drop duplicate header percpu-rwsem.h fs/affs: bugfix: Write files greater than page size on OFS fs/affs: bugfix: enable writes on OFS disks fs/affs: remove node generation check fs/affs: import amigaffs.h fs/affs: bugfix: make symbolic links work again commit cf1e22891bee39f50e058bee0827086fd75a8717 Author: Dan Williams Date: Mon May 8 12:33:53 2017 -0700 device-dax: kill NR_DEV_DAX There is no point to ask how many device-dax instances the kernel should support. Since we are already using a dynamic major number, just allow the max number of minors by default and be done. This also fixes the fact that the proposed max for the NR_DEV_DAX range was larger than what could be supported by alloc_chrdev_region(). Fixes: ba09c01d2fa8 ("dax: convert to the cdev api") Reported-by: Geert Uytterhoeven Tested-by: Geert Uytterhoeven Signed-off-by: Dan Williams drivers/dax/Kconfig | 5 ----- drivers/dax/super.c | 11 +++-------- 2 files changed, 3 insertions(+), 13 deletions(-) commit 339fbf6796f8e74544091adbf511286768eaf93e Merge: 8ee74a9 5b47d59 Author: Linus Torvalds Date: Tue May 9 09:01:21 2017 -0700 Merge branch 'work.iov_iter' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs fix from Al Viro: "Braino fix for iov_iter_revert() misuse" * 'work.iov_iter' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: fix braino in generic_file_read_iter() commit 8ee74a91ac304ad2e9e794eb96ed76f0634dec40 Author: Linus Torvalds Date: Tue May 9 08:45:16 2017 -0700 proc: try to remove use of FOLL_FORCE entirely We fixed the bugs in it, but it's still an ugly interface, so let's see if anybody actually depends on it. It's entirely possible that nothing actually requires the whole "punch through read-only mappings" semantics. For example, gdb definitely uses the /proc//mem interface, but it looks like it mainly does it for regular reads of the target (that don't need FOLL_FORCE), and looking at the gdb source code seems to fall back on the traditional ptrace(PTRACE_POKEDATA) interface if it needs to. If this breaks something, I do have a (more complex) version that only enables FOLL_FORCE when somebody has PTRACE_ATTACH'ed to the target, like the comment here used to say ("Maybe we should limit FOLL_FORCE to actual ptrace users?"). Cc: Kees Cook Cc: Andy Lutomirski Cc: Eric Biederman Signed-off-by: Linus Torvalds fs/proc/base.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) commit e735da5ec09526f197f3d8dd837d9a00e45e72aa Merge: cf68017 be47c55 Author: David S. Miller Date: Tue May 9 11:24:24 2017 -0400 Merge branch 'qed-general-fixes' Yuval Mintz says: ==================== qed*: General fixes This series contain several fixes for qed and qede. - #1 [and ~#5] relate to XDP cleanups - #2 and #5 correct VF behavior - #3 and #4 fix and add missing configurations needed for RoCE & storage ==================== Signed-off-by: David S. Miller commit be47c5555778fa3354950731023deb034a9e445e Author: Mintz, Yuval Date: Tue May 9 15:07:51 2017 +0300 qede: Split PF/VF ndos. PFs and VFs share the same structure of NDOs today, and the VFs explicitly fails the ndo_xdp() callback stating it doesn't support XDP. This results in lots of: [qede_xdp:1032(enp131s2)]VFs don't support XDP ------------[ cut here ]------------ WARNING: CPU: 4 PID: 1426 at net/core/rtnetlink.c:1637 rtnl_dump_ifinfo+0x354/0x3c0 ... Call Trace: ? __alloc_skb+0x9b/0x1d0 netlink_dump+0x122/0x290 netlink_recvmsg+0x27d/0x430 sock_recvmsg+0x3d/0x50 ... As every dump request for the VF interface info would fail due to rtnl_xdp_fill() returning an error code. To resolve this, introduce a subset of the NDOs meant for the VF in a seperate structure and register that one instead for VFs, and omit the ndo_xdp initialization. Fixes: 40b8c45492ef ("qede: Prevent VFs from using XDP") Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qede/qede_filter.c | 5 ----- drivers/net/ethernet/qlogic/qede/qede_main.c | 22 +++++++++++++++++++++- 2 files changed, 21 insertions(+), 6 deletions(-) commit a82dadbce47395747824971db08a128130786fdc Author: Ram Amrani Date: Tue May 9 15:07:50 2017 +0300 qed: Correct doorbell configuration for !4Kb pages When configuring the doorbell DPI address, driver aligns the start address to 4KB [HW-pages] instead of host PAGE_SIZE. As a result, RoCE applications might receive addresses which are unaligned to pages [when PAGE_SIZE > 4KB], which is a security risk. Fixes: 51ff17251c9c ("qed: Add support for RoCE hw init") Signed-off-by: Ram Amrani Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c9f0523bb3d1e70fbfd3245842de855096194925 Author: Mintz, Yuval Date: Tue May 9 15:07:49 2017 +0300 qed: Tell QM the number of tasks Driver doesn't pass the number of tasks to the QM init logic which would cause back-pressure in scenarios requiring many tasks [E.g., using max MRs] and thus reduced performance. Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_cxt.c | 1 + 1 file changed, 1 insertion(+) commit 5f027d7a48aee110e5f66ef5f9e2d90d214cd06b Author: Mintz, Yuval Date: Tue May 9 15:07:48 2017 +0300 qed: Fix VF removal sequence After previos changes in HW-stop scheme, VFs stopped sending CLOSE messages to their PFs when they unload. Fixes: 1226337ad98f ("qed: Correct HW stop flow") Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 92c43eb41669d8edbbfa3db45e89d2edcc55e2de Author: Suddarsana Reddy Kalluru Date: Tue May 9 15:07:47 2017 +0300 qede: Fix XDP memory leak on unload When (re|un)loading, Tx-queues belonging to XDP would not get freed. Fixes: cb6aeb079294 ("qede: Add support for XDP_TX") Signed-off-by: Sudarsana Reddy Kalluru Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qede/qede_main.c | 3 +++ 1 file changed, 3 insertions(+) commit cf680179c111b1901e83bdd53997fb09dafff967 Merge: 4c19e2f 83bd511 Author: David S. Miller Date: Tue May 9 11:22:48 2017 -0400 Merge branch 'mlx4-misc-fixes' Tariq Toukan says: ==================== mlx4 misc fixes This patchset contains misc bug fixes from the team to the mlx4 Core and Eth drivers. Series generated against net commit: 32f1bc0f3d26 Revert "ipv4: restore rt->fi for reference counting" ==================== Signed-off-by: David S. Miller commit 83bd5118a119cabba47e194bba96641e303aadff Author: Jack Morgenstein Date: Tue May 9 14:45:24 2017 +0300 net/mlx4_core: Reduce harmless SRIOV error message to debug level Under SRIOV resource management, extra counters are allocated to VFs from a free pool. If that pool is empty, the ALLOC_RES command for a counter resource fails -- and this generates a misleading error message in the message log. Under SRIOV, each VF is allocated (i.e., guaranteed) 2 counters -- one counter per port. For ETH ports, the RoCE driver requests an additional counter (above the guaranteed counters). If that request fails, the VF RoCE driver simply uses the default (i.e., guaranteed) counter for that port. Thus, failing to allocate an additional counter does not constitute a problem, and the error message on the PF when this occurs should be reduced to debug level. Finally, to identify the situation that the reason for the failure is that no resources are available to grant to the VF, we modified the error returned by mlx4_grant_resource to -EDQUOT (Quota exceeded), which more accurately describes the error. Fixes: c3abb51bdb0e ("IB/mlx4: Add RoCE/IB dedicated counters") Signed-off-by: Jack Morgenstein Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx4/cmd.c | 14 +++++++++++--- drivers/net/ethernet/mellanox/mlx4/resource_tracker.c | 2 +- 2 files changed, 12 insertions(+), 4 deletions(-) commit 89c557687a32c294e9d25670a96e9287c09f2d5f Author: Talat Batheesh Date: Tue May 9 14:45:23 2017 +0300 net/mlx4_en: Avoid adding steering rules with invalid ring Inserting steering rules with illegal ring is an invalid operation, block it. Fixes: 820672812f82 ('net/mlx4_en: Manage flow steering rules with ethtool') Signed-off-by: Talat Batheesh Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 5 +++++ 1 file changed, 5 insertions(+) commit 505a9249c23988768983aaa0766ce54e0dbe037d Author: Kamal Heib Date: Tue May 9 14:45:22 2017 +0300 net/mlx4_en: Change the error print to debug print The error print within mlx4_en_calc_rx_buf() should be a debug print. Fixes: 51151a16a60f ('mlx4: allow order-0 memory allocations in RX path') Signed-off-by: Kamal Heib Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlx4/en_rx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit c8b0d7290657996a29f318b948d2397d30e70c36 Author: Christian Borntraeger Date: Thu Mar 2 17:08:23 2017 +0100 s390/virtio: change maintainership Halil is doing a lot more work in the virtio area on s390 than I do. Let's reflect the reality in the maintainers file. Signed-off-by: Christian Borntraeger Acked-by: Halil Pasic Acked-by: Cornelia Huck Signed-off-by: Michael S. Tsirkin MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 96fb20c343be46afca37d6c501d4cf13d58e110a Author: Colin Ian King Date: Sat Apr 29 23:14:21 2017 +0100 tools/virtio: fix spelling mistake: "wakeus" -> "wakeups" trivial fix to spelling mistake in an error message. Signed-off-by: Colin Ian King Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang tools/virtio/virtio_test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 56da5fd04e3d51d0d876c685b0107ca357b9fd9d Author: Dan Carpenter Date: Thu Apr 6 12:04:47 2017 +0300 virtio_net: tidy a couple debug statements We are printing a decimal value for truesize so we shouldn't use an "0x" prefix. Signed-off-by: Dan Carpenter Signed-off-by: Michael S. Tsirkin drivers/net/virtio_net.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 3008a206209fba670ab1da5590694a616b705efb Author: Michael S. Tsirkin Date: Fri Apr 7 08:45:32 2017 +0300 ptr_ring: support testing different batching sizes Use the param flag for that. Signed-off-by: Michael S. Tsirkin tools/virtio/ringtest/ptr_ring.c | 3 +++ 1 file changed, 3 insertions(+) commit a49795054a0b2034ac50a2a894864fdb353addb5 Author: Michael S. Tsirkin Date: Fri Apr 7 08:44:23 2017 +0300 ringtest: support test specific parameters Add a new flag for passing test-specific parameters. Signed-off-by: Michael S. Tsirkin tools/virtio/ringtest/main.c | 13 +++++++++++++ tools/virtio/ringtest/main.h | 2 ++ 2 files changed, 15 insertions(+) commit fb9de9704775d6190c204f4ddf8da4cfdac26be1 Author: Michael S. Tsirkin Date: Fri Apr 7 08:25:09 2017 +0300 ptr_ring: batch ring zeroing A known weakness in ptr_ring design is that it does not handle well the situation when ring is almost full: as entries are consumed they are immediately used again by the producer, so consumer and producer are writing to a shared cache line. To fix this, add batching to consume calls: as entries are consumed do not write NULL into the ring until we get a multiple (in current implementation 2x) of cache lines away from the producer. At that point, write them all out. We do the write out in the reverse order to keep producer from sharing cache with consumer for as long as possible. Writeout also triggers when ring wraps around - there's no special reason to do this but it helps keep the code a bit simpler. What should we do if getting away from producer by 2 cache lines would mean we are keeping the ring moe than half empty? Maybe we should reduce the batching in this case, current patch simply reduces the batching. Notes: - it is no longer true that a call to consume guarantees that the following call to produce will succeed. No users seem to assume that. - batching can also in theory reduce the signalling rate: users that would previously send interrups to the producer to wake it up after consuming each entry would now only need to do this once in a batch. Doing this would be easy by returning a flag to the caller. No users seem to do signalling on consume yet so this was not implemented yet. Signed-off-by: Michael S. Tsirkin Reviewed-by: Jesper Dangaard Brouer Acked-by: Jason Wang include/linux/ptr_ring.h | 63 +++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 54 insertions(+), 9 deletions(-) commit 9ea762a5ae45235eb3e5ec9c05c33cf37db78d70 Author: Cornelia Huck Date: Thu Mar 30 13:13:33 2017 +0200 virtio: virtio_driver doc Add comments for the virtio_driver members that were not documented. Signed-off-by: Cornelia Huck Signed-off-by: Michael S. Tsirkin include/linux/virtio.h | 4 ++++ 1 file changed, 4 insertions(+) commit 5f24df0945b3ce3be71602c2655f689d42a24181 Author: Michael S. Tsirkin Date: Wed Mar 29 23:12:23 2017 +0300 virtio_net: don't reset twice on XDP on/off We already do a reset once in remove_vq_common - there appears to be no point in doing another one when we add/remove XDP. Signed-off-by: Michael S. Tsirkin drivers/net/virtio_net.c | 1 - 1 file changed, 1 deletion(-) commit d85b758f72b05a774045545f24d70980e3e9aac4 Author: Michael S. Tsirkin Date: Thu Mar 9 02:21:21 2017 +0200 virtio_net: fix support for small rings When ring size is small (<32 entries) making buffers smaller means a full ring might not be able to hold enough buffers to fit a single large packet. Make sure a ring full of buffers is large enough to allow at least one packet of max size. Fixes: 2613af0ed18a ("virtio_net: migrate mergeable rx buffers to page frag allocators") Signed-off-by: Michael S. Tsirkin drivers/net/virtio_net.c | 30 ++++++++++++++++++++++++++---- 1 file changed, 26 insertions(+), 4 deletions(-) commit e377fcc8486d40867c6c217077ad0fa40977e060 Author: Michael S. Tsirkin Date: Mon Mar 6 22:21:35 2017 +0200 virtio_net: reduce alignment for buffers We don't need to align length to any particular value anymore. Aligning to L1 cache size probably sill makes sense to reduce false sharing. Signed-off-by: Michael S. Tsirkin drivers/net/virtio_net.c | 13 +------------ 1 file changed, 1 insertion(+), 12 deletions(-) commit 680557cf79f82623e2c4fd42733077d60a843513 Author: Michael S. Tsirkin Date: Mon Mar 6 21:29:47 2017 +0200 virtio_net: rework mergeable buffer handling Use the new _ctx virtio API to maintain true length for each buffer. Signed-off-by: Michael S. Tsirkin drivers/net/virtio_net.c | 89 +++++++++++++++++++++++------------------------- 1 file changed, 43 insertions(+), 46 deletions(-) commit d45b897b11eaf9847c4b9bc99a91279041b1bbf7 Author: Michael S. Tsirkin Date: Mon Mar 6 20:31:21 2017 +0200 virtio_net: allow specifying context for rx With mergeable buffers we never use s/g for rx, so allow specifying context in that case. Signed-off-by: Michael S. Tsirkin drivers/net/virtio_net.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) commit 5a61ef74f269f2573f48fa53607a8911216c3326 Author: Nicholas Piggin Date: Tue May 9 13:16:52 2017 +1000 powerpc/64s: Support new device tree binding for discovering CPU features The ibm,powerpc-cpu-features device tree binding describes CPU features with ASCII names and extensible compatibility, privilege, and enablement metadata that allows improved flexibility and compatibility with new hardware. The interface is described in detail in ibm,powerpc-cpu-features.txt in this patch. Currently this code is not enabled by default, and there are no released firmwares that provide the binding. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman .../bindings/powerpc/ibm,powerpc-cpu-features.txt | 248 +++++ arch/powerpc/Kconfig | 16 + arch/powerpc/include/asm/cpu_has_feature.h | 6 +- arch/powerpc/include/asm/cputable.h | 2 + arch/powerpc/include/asm/dt_cpu_ftrs.h | 26 + arch/powerpc/include/asm/reg.h | 1 + arch/powerpc/include/uapi/asm/cputable.h | 7 + arch/powerpc/kernel/Makefile | 1 + arch/powerpc/kernel/cputable.c | 37 +- arch/powerpc/kernel/dt_cpu_ftrs.c | 1031 ++++++++++++++++++++ arch/powerpc/kernel/prom.c | 29 +- arch/powerpc/kernel/setup_64.c | 10 +- 12 files changed, 1398 insertions(+), 16 deletions(-) commit 4c19e2f2a86f2281014c1e06785715ad9864c9cc Author: Karim Eshapa Date: Tue May 9 02:06:50 2017 +0200 drivers: net: wimax: i2400m: i2400m-usb: Use time_after for time comparison Use time_after() for time comparison with the new fix. Signed-off-by: Karim Eshapa Signed-off-by: David S. Miller drivers/net/wimax/i2400m/i2400m-usb.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f92ceb01c2cad7092af89c32dde5b14d4fdf8a09 Author: Kees Cook Date: Mon May 8 15:31:44 2017 -0700 DECnet: Use container_of() for embedded struct Instead of a direct cross-type cast, use conatiner_of() to locate the embedded structure, even in the face of future struct layout randomization. Signed-off-by: Kees Cook Signed-off-by: David S. Miller net/decnet/dn_neigh.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 75bda95048a4d2c5ff04036bd0181bc84085d8b2 Author: Nicholas Piggin Date: Tue May 9 13:17:08 2017 +1000 powerpc: Don't print cpu_spec->cpu_name if it's NULL Currently we assume that if the cpu_spec has a pvr_mask then it must also have a cpu_name. But that will change in a subsequent commit when we do CPU feature discovery via the device tree, so check explicitly if cpu_name is NULL. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman arch/powerpc/kernel/setup-common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ea47dd191d543f81e0912b5dc0471b48346b016e Author: Nicholas Piggin Date: Wed Apr 19 05:12:18 2017 +1000 of/fdt: introduce of_scan_flat_dt_subnodes and of_get_flat_dt_phandle Introduce primitives for FDT parsing. These will be used for powerpc cpufeatures node scanning, which has quite complex structure but should be processed early. Cc: devicetree@vger.kernel.org Acked-by: Rob Herring Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman drivers/of/fdt.c | 38 ++++++++++++++++++++++++++++++++++++++ include/linux/of_fdt.h | 6 ++++++ 2 files changed, 44 insertions(+) commit 0b382fb3d905e2754302cf9097ffca13afb8b73f Merge: 6102c00 61baf15 Author: Michael Ellerman Date: Tue May 9 22:54:35 2017 +1000 Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/scottwood/linux into next Freescale updates from Scott: "Includes a fix for a powerpc/next mm regression on 64e, a fix for a kernel hang on 64e when using a debugger inside a relocated kernel, a qman fix, and misc qe improvements." commit 36c344f3f1ffc0b1b20abd237b7401dc6687ee8f Merge: 03efce6 a2b19e6 Author: Paolo Bonzini Date: Tue May 9 12:51:49 2017 +0200 Merge tag 'kvm-arm-for-v4.12-round2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD Second round of KVM/ARM Changes for v4.12. Changes include: - A fix related to the 32-bit idmap stub - A fix to the bitmask used to deode the operands of an AArch32 CP instruction - We have moved the files shared between arch/arm/kvm and arch/arm64/kvm to virt/kvm/arm - We add support for saving/restoring the virtual ITS state to userspace commit a2b19e6e2d4bb662a64799541c144fd94f8fb024 Author: Christoffer Dall Date: Mon May 8 13:31:12 2017 +0200 KVM: arm/arm64: vgic-its: Cleanup after failed ITT restore When failing to restore the ITT for a DTE, we should remove the failed device entry from the list and free the object. We slightly refactor vgic_its_destroy to be able to reuse the now separate vgic_its_free_dte() function. Signed-off-by: Christoffer Dall Reviewed-by: Eric Auger virt/kvm/arm/vgic/vgic-its.c | 35 ++++++++++++++++++++++------------- 1 file changed, 22 insertions(+), 13 deletions(-) commit 67723c25ce7fc0bd4f1b0f4bcbee5f0d114516ca Author: Christoffer Dall Date: Mon May 8 14:43:45 2017 +0200 KVM: arm/arm64: Don't call map_resources when restoring ITS tables The only reason we called kvm_vgic_map_resources() when restoring the ITS tables was because we wanted to have the KVM iodevs registered in the KVM IO bus framework at the time when the ITS was restored such that a restored and active device can inject MSIs prior to otherwise calling kvm_vgic_map_resources() from the first run of a VCPU. Since we now register the KVM iodevs for the redestributors and ITS as soon as possible (when setting the base addresses), we no longer need this call and kvm_vgic_map_resources() is again called only when first running a VCPU. Signed-off-by: Christoffer Dall Reviewed-by: Eric Auger virt/kvm/arm/vgic/vgic-its.c | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) commit 30e1b684f0afd94745821f27ce1165226df02ba9 Author: Christoffer Dall Date: Mon May 8 13:14:57 2017 +0200 KVM: arm/arm64: Register ITS iodev when setting base address We have to register the ITS iodevice before running the VM, because in migration scenarios, we may be restoring a live device that wishes to inject MSIs before the VCPUs have started. All we need to register the ITS io device is the base address of the ITS, so we can simply register that when the base address of the ITS is set. [ Code to fix concurrency issues when setting the ITS base address and to fix the undef base address check written by Marc Zyngier ] Signed-off-by: Christoffer Dall Signed-off-by: Marc Zyngier Reviewed-by: Eric Auger virt/kvm/arm/vgic/vgic-its.c | 44 ++++++++++---------------------------------- virt/kvm/arm/vgic/vgic-v3.c | 8 -------- virt/kvm/arm/vgic/vgic.h | 1 - 3 files changed, 10 insertions(+), 43 deletions(-) commit 6cc40f273b30ef8f7b37f95cd2e6456d652808c0 Author: Marc Zyngier Date: Mon May 8 18:15:40 2017 +0100 KVM: arm/arm64: Get rid of its->initialized field The its->initialized doesn't bring much to the table, and creates unnecessary ordering between setting the address and initializing it (which amounts to exactly nothing). Let's kill it altogether, making KVM_DEV_ARM_VGIC_CTRL_INIT the no-op it deserves to be. Signed-off-by: Marc Zyngier Signed-off-by: Christoffer Dall Reviewed-by: Eric Auger include/kvm/arm_vgic.h | 1 - virt/kvm/arm/vgic/vgic-its.c | 7 +------ 2 files changed, 1 insertion(+), 7 deletions(-) commit 1aab6f468c10a1ec3977fb6f7bc12869174d516e Author: Christoffer Dall Date: Mon May 8 12:30:24 2017 +0200 KVM: arm/arm64: Register iodevs when setting redist base and creating VCPUs Instead of waiting with registering KVM iodevs until the first VCPU is run, we can actually create the iodevs when the redist base address is set. The only downside is that we must now also check if we need to do this for VCPUs which are created after creating the VGIC, because there is no enforced ordering between creating the VGIC (and setting its base addresses) and creating the VCPUs. Signed-off-by: Christoffer Dall Reviewed-by: Eric Auger include/kvm/arm_vgic.h | 1 + virt/kvm/arm/arm.c | 2 +- virt/kvm/arm/vgic/vgic-init.c | 21 ++++++++++++++++++ virt/kvm/arm/vgic/vgic-kvm-device.c | 7 +++++- virt/kvm/arm/vgic/vgic-mmio-v3.c | 43 +++++++++++++++++++++++++++++++++++-- virt/kvm/arm/vgic/vgic-v3.c | 6 ------ virt/kvm/arm/vgic/vgic.h | 3 ++- 7 files changed, 72 insertions(+), 11 deletions(-) commit 72030536ebf5e5e512771922efa472a80f2c969f Author: Christoffer Dall Date: Mon May 8 12:28:19 2017 +0200 KVM: arm/arm64: Slightly rework kvm_vgic_addr As we are about to handle setting the address for the redistributor base region separately from some of the other base addresses, let's rework this function to leave a little more room for being flexible in what each type of base address does. Signed-off-by: Christoffer Dall Reviewed-by: Eric Auger virt/kvm/arm/vgic/vgic-kvm-device.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) commit 9a746d75c06e2a68f27886d041c6e46df0aa86d8 Author: Christoffer Dall Date: Mon May 8 12:23:51 2017 +0200 KVM: arm/arm64: Make vgic_v3_check_base more broadly usable As we are about to fiddle with the IO device registration mechanism, let's be a little more careful when setting base addresses as early as possible. When setting a base address, we can check that there's address space enough for its scope and when the last of the two base addresses (dist and redist) get set, we can also check if the regions overlap at that time. This allows us to provide error messages to the user at time when trying to set the base address, as opposed to later when trying to run the VM. To do this, we make vgic_v3_check_base available in the core vgic-v3 code as well as in the other parts of the GICv3 code, namely the MMIO config code. We also return true for undefined base addresses so that the function can be used before all base addresses are set; all callers already check for uninitialized addresses before calling this function. Signed-off-by: Christoffer Dall Reviewed-by: Eric Auger virt/kvm/arm/vgic/vgic-v3.c | 19 +++++++++++++++---- virt/kvm/arm/vgic/vgic.h | 1 + 2 files changed, 16 insertions(+), 4 deletions(-) commit 7fadcd3a859b218fa27c399db0aa8d6d62ad84a9 Author: Christoffer Dall Date: Mon May 8 12:18:26 2017 +0200 KVM: arm/arm64: Refactor vgic_register_redist_iodevs Split out the function to register all the redistributor iodevs into a function that handles a single redistributor at a time in preparation for being able to call this per VCPU as these get created. Signed-off-by: Christoffer Dall Reviewed-by: Eric Auger virt/kvm/arm/vgic/vgic-mmio-v3.c | 108 ++++++++++++++++++++++++--------------- virt/kvm/arm/vgic/vgic-v3.c | 2 +- virt/kvm/arm/vgic/vgic.h | 2 +- 3 files changed, 68 insertions(+), 44 deletions(-) commit 497d72d80a789501501cccabdad6b145f9e31371 Author: Christoffer Dall Date: Mon May 8 20:38:40 2017 +0200 KVM: Add kvm_vcpu_get_idx to get vcpu index in kvm->vcpus There are occasional needs to use the index of vcpu in the kvm->vcpus array to map something related to a VCPU. For example, unlike the vcpu->vcpu_id, the vcpu index is guaranteed to not be sparse across all vcpus which is useful when allocating a memory area for each vcpu. Signed-off-by: Christoffer Dall Reviewed-by: Eric Auger include/linux/kvm_host.h | 11 +++++++++++ 1 file changed, 11 insertions(+) commit 03efce6f935f89f90a98997ceea514aeff47b6dc Author: Bandan Das Date: Fri May 5 15:25:15 2017 -0400 nVMX: Advertise PML to L1 hypervisor Advertise the PML bit in vmcs12 but don't try to enable it in hardware when running L2 since L0 is emulating it. Also, preserve L0's settings for PML since it may still want to log writes. Signed-off-by: Bandan Das Signed-off-by: Paolo Bonzini arch/x86/kvm/vmx.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) commit c5f983f6e8455bbff8b6b39f3ad470317fcd808e Author: Bandan Das Date: Fri May 5 15:25:14 2017 -0400 nVMX: Implement emulated Page Modification Logging With EPT A/D enabled, processor access to L2 guest paging structures will result in a write violation. When this happens, write the GUEST_PHYSICAL_ADDRESS to the pml buffer provided by L1 if the access is write and the dirty bit is being set. This patch also adds necessary checks during VMEntry if L1 has enabled PML. If the PML index overflows, we change the exit reason and run L1 to simulate a PML full event. Signed-off-by: Bandan Das Signed-off-by: Paolo Bonzini arch/x86/kvm/vmx.c | 81 ++++++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 79 insertions(+), 2 deletions(-) commit bab4165e2f031905bd0a2bb8b6ad65c5c8cfa870 Author: Bandan Das Date: Fri May 5 15:25:13 2017 -0400 kvm: x86: Add a hook for arch specific dirty logging emulation When KVM updates accessed/dirty bits, this hook can be used to invoke an arch specific function that implements/emulates dirty logging such as PML. Signed-off-by: Bandan Das Signed-off-by: Paolo Bonzini arch/x86/include/asm/kvm_host.h | 2 ++ arch/x86/kvm/mmu.c | 15 +++++++++++++++ arch/x86/kvm/mmu.h | 1 + arch/x86/kvm/paging_tmpl.h | 4 ++++ 4 files changed, 22 insertions(+) commit c7c2c709b60ed2d7e6e6871496f0e963cfad121f Author: Jim Mattson Date: Fri May 5 11:28:09 2017 -0700 kvm: nVMX: Validate CR3 target count on nested VM-entry According to the SDM, the CR3-target count must not be greater than 4. Future processors may support a different number of CR3-target values. Software should read the VMX capability MSR IA32_VMX_MISC to determine the number of values supported. Signed-off-by: Jim Mattson Signed-off-by: Paolo Bonzini arch/x86/kvm/vmx.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 4415b335282591e76762cd9e6dc60932a7595fc3 Merge: 3bed888 fb7dcf7 Author: Paolo Bonzini Date: Tue May 9 11:50:01 2017 +0200 Merge branch 'kvm-ppc-next' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc into HEAD The main thing here is a new implementation of the in-kernel XICS interrupt controller emulation for POWER9 machines, from Ben Herrenschmidt. POWER9 has a new interrupt controller called XIVE (eXternal Interrupt Virtualization Engine) which is able to deliver interrupts directly to guest virtual CPUs in hardware without hypervisor intervention. With this new code, the guest still sees the old XICS interface but performance is better because the XICS emulation in the host uses the XIVE directly rather than going through a XICS emulation in firmware. Conflicts: arch/powerpc/kernel/cpu_setup_power.S [cherry-picked fix] arch/powerpc/kvm/book3s_xive.c [include asm/debugfs.h] commit 3bed8888edc8f60d734c44fdcdb7c6abd5e2d02e Author: Geliang Tang Date: Sat May 6 23:37:19 2017 +0800 KVM: set no_llseek in stat_fops_per_vm In vm_stat_get_per_vm_fops and vcpu_stat_get_per_vm_fops, since we use nonseekable_open() to open, we should use no_llseek() to seek, not generic_file_llseek(). Signed-off-by: Geliang Tang Signed-off-by: Paolo Bonzini virt/kvm/kvm_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 6102c005a71b4a7a6433d43b887662fb0780746d Author: Nicholas Piggin Date: Thu May 4 20:41:12 2017 +1000 powerpc/64s: Fix unnecessary machine check handler relocation branch Similarly to commit 2563a70c3b ("powerpc/64s: Remove unnecessary relocation branch from idle handler"), the machine check handler has a BRANCH_TO from relocated to relocated code, which is unnecessary. It has also caused build errors with some toolchains: arch/powerpc/kernel/exceptions-64s.S: Assembler messages: arch/powerpc/kernel/exceptions-64s.S:395: Error: operand out of range (0xffffffffffff8280 is not between 0x0000000000000000 and 0x000000000000ffff) Fixes: 1945bc4549e5 ("powerpc/64s: Fix POWER9 machine check handler from stop state") Signed-off-by: Nicholas Piggin Reported-and-tested-by : Abdul Haleem Signed-off-by: Michael Ellerman arch/powerpc/kernel/exceptions-64s.S | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit ba95b5d0359609b4ec8010f77c40ab3c595a6ac6 Author: Michael Ellerman Date: Tue May 9 15:39:04 2017 +1000 powerpc/mm/book3s/64: Rework page table geometry for lower memory usage Recently in commit f6eedbba7a26 ("powerpc/mm/hash: Increase VA range to 128TB") we increased the virtual address space for user processes to 128TB by default, and up to 512TB if user space opts in. This obviously required expanding the range of the Linux page tables. For Book3s 64-bit using hash and with PAGE_SIZE=64K, we increased the PGD to 2^15 entries. This meant we could cover the full address range, while still being able to insert a 16G hugepage at the PGD level and a 16M hugepage in the PMD. The downside of that geometry is that it uses a lot of memory for the PGD, and in particular makes the PGD a 4-page allocation, which means it's much more likely to fail under memory pressure. Instead we can make the PMD larger, so that a single PUD entry maps 16G, allowing the 16G hugepages to sit at that level in the tree. We're then able to split the remaining bits between the PUG and PGD. We make the PGD slightly larger as that results in lower memory usage for typical programs. When THP is enabled the PMD actually doubles in size, to 2^11 entries, or 2^14 bytes, which is large but still < PAGE_SIZE. Signed-off-by: Michael Ellerman Reviewed-by: Balbir Singh Reviewed-by: Aneesh Kumar K.V arch/powerpc/include/asm/book3s/64/hash-64k.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 24e0bfbf63bac18495b0ad76115269f2158e9234 Author: Horia Geantă Date: Mon May 8 11:50:16 2017 +0300 powerpc: Fix distclean with Makefile.postlink Makefile.postlink always includes include/config/auto.conf, however this file is not present in a clean kernel tree, causing make to fail: $ git clone linuxppc.git $ cd linuxppc.git $ make distclean arch/powerpc/Makefile.postlink:10: include/config/auto.conf: No such file or directory make[1]: *** No rule to make target `include/config/auto.conf'. Stop. make: *** [vmlinuxclean] Error 2 Equally running 'make distclean; make distclean' will trip the error case. Change the inclusion such that file not being found does not trigger an error. Fixes: f188d0524d7e ("powerpc: Use the new post-link pass to check relocations") Reported-by: Mircea Pop Signed-off-by: Horia Geantă Tested-by: Justin M. Forbes Signed-off-by: Michael Ellerman arch/powerpc/Makefile.postlink | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 443c3a9e686aa44cf00c677498a6b715f9a43a45 Author: Christoffer Dall Date: Mon May 8 12:09:13 2017 +0200 KVM: arm/arm64: vgic: Rename kvm_vgic_vcpu_init to kvm_vgic_vcpu_enable This function really doesn't init anything, it enables the CPU interface, so name it as such, which gives us the name to use for actual init work later on. Signed-off-by: Christoffer Dall Reviewed-by: Eric Auger virt/kvm/arm/vgic/vgic-init.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) commit cb9d043469d216416d75efe05f3bce279bab2262 Author: Christoffer Dall Date: Mon May 8 09:31:53 2017 +0200 KVM: arm/arm64: Clarification and relaxation to ITS save/restore ABI Clarify what is meant by the save/restore ABI only supporting virtual physical interrupts. Relax the requirement of the order that the collection entries are written in and be clear that there is no particular ordering enforced. Some cosmetic changes in the capitalization of ID names to align with the GICv3 manual and remove the empty line in the bottom of the patch. Signed-off-by: Christoffer Dall Reviewed-by: Eric Auger Documentation/virtual/kvm/devices/arm-vgic-its.txt | 23 +++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) commit d04a4c76f71dd5335f8e499b59617382d84e2b8d Author: Heiko Carstens Date: Thu May 4 09:42:22 2017 +0200 s390: move _text symbol to address higher than zero The perf tool assumes that kernel symbols are never present at address zero. In fact it assumes if functions that map symbols to addresses return zero, that the symbol was not found. Given that s390's _text symbol historically is located at address zero this yields at least a couple of false errors and warnings in one of perf's test cases about not present symbols ("perf test 1"). To fix this simply move the _text symbol to address 0x200, just behind the initial psw and channel program located at the beginning of the kernel image. This is now hard coded within the linker script. I tried a nicer solution which moves the initial psw and channel program into an own section. However that would move the symbols within the "real" head.text section to different addresses, since the ".org" statements within head.S are relative to the head.text section. If there is a new section in front, everything else will be moved. Alternatively I could have adjusted all ".org" statements. But this current solution seems to be the easiest one, since nobody really cares where the _text symbol is actually located. Reported-by: Zvonko Kosic Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky arch/s390/kernel/vmlinux.lds.S | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 6423ef691c50568e56bb7e33a35bf9f8d6142d23 Author: Heiko Carstens Date: Thu May 4 13:39:18 2017 +0200 s390/qdio: increase string buffer size Avoid false positive warnings like this with gcc 7.1: drivers/s390/cio/qdio_debug.h:63:4: note: 'snprintf' output between 8 and 17 bytes into a destination of size 16 snprintf(debug_buffer, QDIO_DBF_LEN, text); and simply increase the size of the string buffer. Reviewed-by: Sebastian Ott Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky drivers/s390/cio/qdio_debug.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2685df6776b2c69967eaead48f694869f7dc91ca Author: Heiko Carstens Date: Thu May 4 13:35:33 2017 +0200 s390/ccwgroup: increase string buffer size Avoid false positive warnings like this with gcc 7.1: drivers/s390/cio/ccwgroup.c:41:21: warning: '%d' directive writing between 1 and 10 bytes into a region of size 4 sprintf(str, "cdev%d", i); and simply increase the size of the string buffer. Reviewed-by: Sebastian Ott Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky drivers/s390/cio/ccwgroup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 80ba38469aa28bbcfc7a31e5b41adfc42120465e Author: Heiko Carstens Date: Thu May 4 13:06:58 2017 +0200 s390/topology: let topology_mnest_limit() return unsigned char Fixes a couple of compile warnings with gcc 7.1.0 : arch/s390/kernel/sysinfo.c:578:20: note: directive argument in the range [-2147483648, 4] sprintf(link_to, "15_1_%d", topology_mnest_limit()); Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky arch/s390/include/asm/sysinfo.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f5c8b9601036869e162cb278aaafbf003dc4e5a0 Author: Heiko Carstens Date: Wed May 3 09:15:07 2017 +0200 s390/uaccess: use sane length for __strncpy_from_user() The average string that is copied from user space to kernel space is rather short. E.g. booting a system involves about 50.000 strncpy_from_user() calls where the NULL terminated string has an average size of 27 bytes. By default our s390 specific strncpy_from_user() implementation however copies up to 4096 bytes, which is a waste of cpu cycles and cache lines. Therefore reduce the default length to L1_CACHE_BYTES (256 bytes), which also reduces the average execution time of strncpy_from_user() by 30-40%. Alternatively we could have switched to the generic strncpy_from_user() implementation, however it turned out that that variant would be slower than the now optimized s390 variant. Reported-by: Al Viro Reported-by: Linus Torvalds Signed-off-by: Heiko Carstens Reviewed-by: Gerald Schaefer Signed-off-by: Martin Schwidefsky arch/s390/lib/uaccess.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit fb8fb46c56289b3f34b5d90a4ec65e9e4e4544a5 Author: Xiaochen Shen Date: Wed May 3 11:15:56 2017 +0800 x86/intel_rdt: Fix a typo in Documentation Example 3 contains a typo: "C0" in "# echo C0 > p0/cpus" is wrong because it specifies core 6-7 instead of wanted core 4-7. Correct this typo to avoid confusion. Signed-off-by: Xiaochen Shen Acked-by: Fenghua Yu Cc: vikas.shivappa@linux.intel.com Cc: tony.luck@intel.com Link: http://lkml.kernel.org/r/1493781356-24229-1-git-send-email-xiaochen.shen@intel.com Signed-off-by: Thomas Gleixner Documentation/x86/intel_rdt_ui.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f63d947c1673930bfc5f2f9bd1073a02c179a890 Author: Sudeep Holla Date: Mon May 8 13:32:27 2017 +0100 clocksource/arm_arch_timer: Fix arch_timer_mem_find_best_frame() arch_timer_mem_find_best_frame() looks through ARCH_TIMER_MEM_MAX_FRAMES frames even after finding matches to ensure the best frame is chosen, which means the variable frame will point to the last valid frame but not necessarily the best frame. On Juno, we get the following error as the wrong frame is returned as the best frame from arch_timer_mem_find_best_frame(): arch_timer: Unable to map frame @ 0x0000000000000000 arch_timer: Frame missing phys irq. Failed to initialize '/timer@2a810000': -22 Fix the issue by correctly returning the best frame from arch_timer_mem_find_best_frame(). Fixes: c389d701dfb7 ("clocksource: arm_arch_timer: split MMIO timer probing.") Signed-off-by: Sudeep Holla Acked-by: Mark Rutland Cc: Marc Zyngier Cc: Daniel Lezcano Cc: linux-arm-kernel@lists.infradead.org Link: http://lkml.kernel.org/r/1494246747-17267-1-git-send-email-sudeep.holla@arm.com Signed-off-by: Thomas Gleixner drivers/clocksource/arm_arch_timer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4a1bec4605838fd7872ec41677585e241e256785 Author: Nick Desaulniers Date: Mon May 8 20:29:46 2017 -0700 x86/build: Don't add -maccumulate-outgoing-args w/o compiler support Clang does not support this machine dependent option. Older versions of GCC (pre 3.0) may not support this option, added in 2000, but it's unlikely they can still compile a working kernel. Signed-off-by: Nick Desaulniers Reviewed-by: Josh Poimboeuf Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/20170509032946.20444-1-nick.desaulniers@gmail.com Signed-off-by: Ingo Molnar arch/x86/Makefile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit d2b6dc61a8dd3c429609b993778cb54e75a5c5f0 Author: Andy Lutomirski Date: Mon May 8 17:09:10 2017 -0700 x86/boot/32: Fix UP boot on Quark and possibly other platforms This partially reverts commit: 23b2a4ddebdd17f ("x86/boot/32: Defer resyncing initial_page_table until per-cpu is set up") That commit had one definite bug and one potential bug. The definite bug is that setup_per_cpu_areas() uses a differnet generic implementation on UP kernels, so initial_page_table never got resynced. This was fine for access to percpu data (it's in the identity map on UP), but it breaks other users of initial_page_table. The potential bug is that helpers like efi_init() would be called before the tables were synced. Avoid both problems by just syncing the page tables in setup_arch() *and* setup_per_cpu_areas(). Reported-by: Jan Kiszka Signed-off-by: Andy Lutomirski Cc: Andy Shevchenko Cc: Ard Biesheuvel Cc: Boris Ostrovsky Cc: Borislav Petkov Cc: Brian Gerst Cc: Denys Vlasenko Cc: Josh Poimboeuf Cc: Juergen Gross Cc: Linus Torvalds Cc: Matt Fleming Cc: Peter Zijlstra Cc: Thomas Garnier Cc: Thomas Gleixner Cc: linux-efi@vger.kernel.org Signed-off-by: Ingo Molnar arch/x86/kernel/setup.c | 15 +++++++++++++++ arch/x86/kernel/setup_percpu.c | 10 +++++----- 2 files changed, 20 insertions(+), 5 deletions(-) commit 861ce4a3244c21b0af64f880d5bfe5e6e2fb9e4a Author: Laura Abbott Date: Mon May 8 14:23:16 2017 -0700 x86/mm/32: Set the '__vmalloc_start_set' flag in initmem_init() '__vmalloc_start_set' currently only gets set in initmem_init() when !CONFIG_NEED_MULTIPLE_NODES. This breaks detection of vmalloc address with virt_addr_valid() with CONFIG_NEED_MULTIPLE_NODES=y, causing a kernel crash: [mm/usercopy] 517e1fbeb6: kernel BUG at arch/x86/mm/physaddr.c:78! Set '__vmalloc_start_set' appropriately for that case as well. Reported-by: kbuild test robot Signed-off-by: Laura Abbott Reviewed-by: Kees Cook Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Fixes: dc16ecf7fd1f ("x86-32: use specific __vmalloc_start_set flag in __virt_addr_valid") Link: http://lkml.kernel.org/r/1494278596-30373-1-git-send-email-labbott@redhat.com Signed-off-by: Ingo Molnar arch/x86/mm/numa_32.c | 1 + 1 file changed, 1 insertion(+) commit 29efc390b9462582ae95eb9a0b8cd17ab956afc0 Author: Shaohua Li Date: Sun May 7 17:36:24 2017 -0700 md/md0: optimize raid0 discard handling There are complaints that raid0 discard handling is slow. Currently we divide discard request into chunks and dispatch to underlayer disks. The block layer will do merge to form big requests. This causes a lot of request split/merge and uses significant CPU time. A simple idea is to calculate the range for each raid disk for an IO request and send a discard request to raid disks, which will avoid the split/merge completely. Previously Coly tried the approach, but the implementation was too complex because of raid0 zones. This patch always split bio in zone boundary and handle bio within one zone. It simplifies the implementation a lot. Reviewed-by: NeilBrown Acked-by: Coly Li Signed-off-by: Shaohua Li drivers/md/raid0.c | 116 ++++++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 102 insertions(+), 14 deletions(-) commit 2868b2513aa732a99ea4a0a6bf10dc93c1f3dac2 Merge: 00d9593 945f8f5 Author: Linus Torvalds Date: Mon May 8 20:43:30 2017 -0700 Merge tag 'linux-kselftest-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest updates from Shuah Khan: "This update consists of: - important fixes for build failures and clean target related warnings to address regressions introduced in commit 88baa78d1f31 ("selftests: remove duplicated all and clean target") - several minor spelling fixes in and log messages and comment blocks. - Enabling configs for better test coverage in ftrace, vm, and cpufreq tests. - .gitignore changes" * tag 'linux-kselftest-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: (26 commits) selftests: x86: add missing executables to .gitignore selftests: watchdog: accept multiple params on command line selftests: create cpufreq kconfig fragments selftests: x86: override clean in lib.mk to fix warnings selftests: sync: override clean in lib.mk to fix warnings selftests: splice: override clean in lib.mk to fix warnings selftests: gpio: fix clean target to remove all generated files and dirs selftests: add gpio generated files to .gitignore selftests: powerpc: override clean in lib.mk to fix warnings selftests: gpio: override clean in lib.mk to fix warnings selftests: futex: override clean in lib.mk to fix warnings selftests: lib.mk: define CLEAN macro to allow Makefiles to override clean selftests: splice: fix clean target to not remove default_file_splice_read.sh selftests: gpio: add config fragment for gpio-mockup selftests: breakpoints: allow to cross-compile for aarch64/arm64 selftests/Makefile: Add missed PHONY targets selftests/vm/run_vmtests: Fix wrong comment selftests/Makefile: Add missed closing `"` in comment selftests/vm/run_vmtests: Polish output text selftests/timers: fix spelling mistake: "Asynchronous" ... commit 00d959333513a41959d3b85ba3e35320ec8844e5 Merge: 3341713 77c0edd Author: Linus Torvalds Date: Mon May 8 20:36:38 2017 -0700 Merge tag 'trace-v4.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull more tracing updates from Steven Rostedt: "These are three simple changes. The first one is just a switch from using strcpy() to strlcpy(). Someone thought that it may cause an overflow bug, but since it only copies comms into a pre-allocated array of TASK_COMM_LEN, and no comm should ever be bigger than that, nor not end with a nul character, this change is more of a safety precaution than fixing anything that is actually broken. The other two changes are simply cleaning and optimizing some code" * tag 'trace-v4.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: ftrace: Simplify ftrace_match_record() even more ftrace: Remove an unneeded condition tracing: Use strlcpy() instead of strcpy() in __trace_find_cmdline() commit 3341713c67d5eae5c68bab30add97e9f9ecfafa5 Merge: 857f864 693dfd5 67cf362 Author: Linus Torvalds Date: Mon May 8 20:07:29 2017 -0700 Merge tags 'for-linus' and 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma Pull more rdma updates from Doug Ledford: "As mentioned in my first pull request, this is the subsequent pull requests I had. This is all I have, and in fact this cleans out the RDMA subsystem's entire patchworks queue of kernel changes that are ready to go (well, it did for the weekend anyway, a few new patches are in, but they'll be coming during the -rc cycle). The first tag contains a single patch that would have conflicted if taken from my tree or DaveM's tree as it needed our trees merged to come cleanly. The second tag contains the patch series from Intel plus three other stragllers that came in late last week. I took them because it allowed me to legitimately claim that the RDMA patchworks queue was, for a short time, 100% cleared of all waiting kernel patches, woohoo! :-). I have it under my for-next tag, so it did get 0day and linux- next over the end of last week, and linux-next did show one minor conflict. Summary: 'for-linus' tag: - mlx5/IPoIB fixup patch 'for-next' tag: - the hfi1 15 patch set that landed late - IPoIB get_link_ksettings which landed late because I asked for a respin - one late rxe change - one -rc worthy fix that's in early" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma: IB/mlx5: Enable IPoIB acceleration * tag 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma: rxe: expose num_possible_cpus() cnum_comp_vectors IB/rxe: Update caller's CRC for RXE_MEM_TYPE_DMA memory type IB/hfi1: Clean up on context initialization failure IB/hfi1: Fix an assign/ordering issue with shared context IDs IB/hfi1: Clean up context initialization IB/hfi1: Correctly clear the pkey IB/hfi1: Search shared contexts on the opened device, not all devices IB/hfi1: Remove atomic operations for SDMA_REQ_HAVE_AHG bit IB/hfi1: Use filedata rather than filepointer IB/hfi1: Name function prototype parameters IB/hfi1: Fix a subcontext memory leak IB/hfi1: Return an error on memory allocation failure IB/hfi1: Adjust default eager_buffer_size to 8MB IB/hfi1: Get rid of divide when setting the tx request header IB/hfi1: Fix yield logic in send engine IB/hfi1, IB/rdmavt: Move r_adefered to r_lock cache line IB/hfi1: Fix checks for Offline transient state IB/ipoib: add get_link_ksettings in ethtool commit 32f1bc0f3d262125169f9212aac306c638e34b54 Author: David S. Miller Date: Mon May 8 22:35:32 2017 -0400 Revert "ipv4: restore rt->fi for reference counting" This reverts commit 82486aa6f1b9bc8145e6d0fa2bc0b44307f3b875. As implemented, this causes dangling netdevice refs. Reported-by: Eric Dumazet Signed-off-by: David S. Miller include/net/route.h | 1 - net/ipv4/route.c | 18 +----------------- 2 files changed, 1 insertion(+), 18 deletions(-) commit b77b36cb7272ec5b9fb000e2ff18e947d9586a22 Author: Colin Ian King Date: Wed May 3 17:29:01 2017 +0100 scsi: pmcraid: remove redundant check to see if request_size is less than zero The 2nd check to see if request_size is less than zero is redundant because the first check takes error exit path on this condition. So, since it is redundant, remove it. Detected by CoverityScan, CID#146149 ("Logically Dead Code") Signed-off-by: Colin Ian King Reviewed-by: Tyrel Datwyler Signed-off-by: Martin K. Petersen drivers/scsi/pmcraid.c | 3 --- 1 file changed, 3 deletions(-) commit 019c0d66f66a8612bb867caf05e865a4766238a4 Author: Colin Ian King Date: Sat May 6 23:13:55 2017 +0100 scsi: lpfc: ensure els_wq is being checked before destroying it I believe there is a typo on the wq destroy of els_wq, currently the driver is checking if els_cq is not null and I think this should be a check on els_wq instead. Detected by CoverityScan, CID#1411629 ("Copy-paste error") Signed-off-by: Colin Ian King Acked-by: Dick Kennedy Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc_init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 07cc1ccfb84320582c9ac389a21cd81df82bc123 Author: Guenter Roeck Date: Fri May 5 16:31:47 2017 -0700 scsi: cxlflash: Select IRQ_POLL The driver now uses IRQ_POLL and needs to select it to avoid the following build error. ERROR: ".irq_poll_complete" [drivers/scsi/cxlflash/cxlflash.ko] undefined! ERROR: ".irq_poll_sched" [drivers/scsi/cxlflash/cxlflash.ko] undefined! ERROR: ".irq_poll_disable" [drivers/scsi/cxlflash/cxlflash.ko] undefined! ERROR: ".irq_poll_init" [drivers/scsi/cxlflash/cxlflash.ko] undefined! Fixes: cba06e6de403 ("scsi: cxlflash: Implement IRQ polling for RRQ processing") Signed-off-by: Guenter Roeck Acked-by: Matthew R. Ochs Signed-off-by: Martin K. Petersen drivers/scsi/cxlflash/Kconfig | 1 + 1 file changed, 1 insertion(+) commit cd22874fec8fbecd4999b55e67baf3d71775f6f3 Author: Kees Cook Date: Fri May 5 15:42:55 2017 -0700 scsi: qedf: Avoid reading past end of buffer Using memcpy() from a string that is shorter than the length copied means the destination buffer is being filled with arbitrary data from the kernel rodata segment. Instead, use strncpy() which will fill the trailing bytes with zeros. This was found with the future CONFIG_FORTIFY_SOURCE feature. Cc: Daniel Micay Signed-off-by: Kees Cook Acked-by: Chad Dupuis Signed-off-by: Martin K. Petersen drivers/scsi/qedf/qedf_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 857f8640147c9fb43f20e43cbca6452710e1ca5d Merge: 8f3207c 3146c8f Author: Linus Torvalds Date: Mon May 8 19:03:25 2017 -0700 Merge tag 'pci-v4.12-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI updates from Bjorn Helgaas: - add framework for supporting PCIe devices in Endpoint mode (Kishon Vijay Abraham I) - use non-postable PCI config space mappings when possible (Lorenzo Pieralisi) - clean up and unify mmap of PCI BARs (David Woodhouse) - export and unify Function Level Reset support (Christoph Hellwig) - avoid FLR for Intel 82579 NICs (Sasha Neftin) - add pci_request_irq() and pci_free_irq() helpers (Christoph Hellwig) - short-circuit config access failures for disconnected devices (Keith Busch) - remove D3 sleep delay when possible (Adrian Hunter) - freeze PME scan before suspending devices (Lukas Wunner) - stop disabling MSI/MSI-X in pci_device_shutdown() (Prarit Bhargava) - disable boot interrupt quirk for ASUS M2N-LR (Stefan Assmann) - add arch-specific alignment control to improve device passthrough by avoiding multiple BARs in a page (Yongji Xie) - add sysfs sriov_drivers_autoprobe to control VF driver binding (Bodong Wang) - allow slots below PCI-to-PCIe "reverse bridges" (Bjorn Helgaas) - fix crashes when unbinding host controllers that don't support removal (Brian Norris) - add driver for MicroSemi Switchtec management interface (Logan Gunthorpe) - add driver for Faraday Technology FTPCI100 host bridge (Linus Walleij) - add i.MX7D support (Andrey Smirnov) - use generic MSI support for Aardvark (Thomas Petazzoni) - make Rockchip driver modular (Brian Norris) - advertise 128-byte Read Completion Boundary support for Rockchip (Shawn Lin) - advertise PCI_EXP_LNKSTA_SLC for Rockchip root port (Shawn Lin) - convert atomic_t to refcount_t in HV driver (Elena Reshetova) - add CPU IRQ affinity in HV driver (K. Y. Srinivasan) - fix PCI bus removal in HV driver (Long Li) - add support for ThunderX2 DMA alias topology (Jayachandran C) - add ThunderX pass2.x 2nd node MCFG quirk (Tomasz Nowicki) - add ITE 8893 bridge DMA alias quirk (Jarod Wilson) - restrict Cavium ACS quirk only to CN81xx/CN83xx/CN88xx devices (Manish Jaggi) * tag 'pci-v4.12-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: (146 commits) PCI: Don't allow unbinding host controllers that aren't prepared ARM: DRA7: clockdomain: Change the CLKTRCTRL of CM_PCIE_CLKSTCTRL to SW_WKUP MAINTAINERS: Add PCI Endpoint maintainer Documentation: PCI: Add userguide for PCI endpoint test function tools: PCI: Add sample test script to invoke pcitest tools: PCI: Add a userspace tool to test PCI endpoint Documentation: misc-devices: Add Documentation for pci-endpoint-test driver misc: Add host side PCI driver for PCI test function device PCI: Add device IDs for DRA74x and DRA72x dt-bindings: PCI: dra7xx: Add DT bindings to enable unaligned access PCI: dwc: dra7xx: Workaround for errata id i870 dt-bindings: PCI: dra7xx: Add DT bindings for PCI dra7xx EP mode PCI: dwc: dra7xx: Add EP mode support PCI: dwc: dra7xx: Facilitate wrapper and MSI interrupts to be enabled independently dt-bindings: PCI: Add DT bindings for PCI designware EP mode PCI: dwc: designware: Add EP mode support Documentation: PCI: Add binding documentation for pci-test endpoint function ixgbe: Use pcie_flr() instead of duplicating it IB/hfi1: Use pcie_flr() instead of duplicating it PCI: imx6: Fix spelling mistake: "contol" -> "control" ... commit 0d2fc3b48ba0e267962c861c5258564c335dd1f2 Author: Dan Carpenter Date: Thu May 4 00:23:57 2017 +0300 scsi: qedf: Cleanup the type of io_log->op We store sc_cmd->cmnd[0] which is an unsigned char in io_log->op so this should also be unsigned char. The other thing is that this is displayed in the debugfs: seq_printf(s, "0x%02x:", io_log->op); Smatch complains that the formatting won't work for negative values so changing it to unsigned silences that warning as well. Signed-off-by: Dan Carpenter Acked-by: Chad Dupuis Signed-off-by: Martin K. Petersen drivers/scsi/qedf/qedf.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0d618cf4f24cebb822eaf57c27985266e4110176 Author: Dan Carpenter Date: Thu May 4 00:22:16 2017 +0300 scsi: lpfc: double lock typo in lpfc_ns_rsp() There is a double lock bug here so this will deadlock instead of unlocking. Fixes: 1c5b12f76301 ("Fix implicit logo and RSCN handling for NVMET") Signed-off-by: Dan Carpenter Reviewed-by: James Smart Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc_ct.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8f3207c7eab9d885cc64c778416537034a7d9c5b Merge: bf5f894 8e1c21f4 Author: Linus Torvalds Date: Mon May 8 18:49:23 2017 -0700 Merge tag 'tty-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial updates from Greg KH: "Here is the "big" TTY/Serial patch updates for 4.12-rc1 Not a lot of new things here, the normal number of serial driver updates and additions, tiny bugs fixed, and some core files split up to make future changes a bit easier for Nicolas's "tiny-tty" work. All of these have been in linux-next for a while" * tag 'tty-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (62 commits) serial: small Makefile reordering tty: split job control support into a file of its own tty: move baudrate handling code to a file of its own console: move console_init() out of tty_io.c serial: 8250_early: Add earlycon support for Palmchip UART tty: pl011: use "qdf2400_e44" as the earlycon name for QDF2400 E44 vt: make mouse selection of non-ASCII consistent vt: set mouse selection word-chars to gpm's default imx-serial: Reduce RX DMA startup latency when opening for reading serial: omap: suspend device on probe errors serial: omap: fix runtime-pm handling on unbind tty: serial: omap: add UPF_BOOT_AUTOCONF flag for DT init serial: samsung: Remove useless spinlock serial: samsung: Add missing checks for dma_map_single failure serial: samsung: Use right device for DMA-mapping calls serial: imx: setup DCEDTE early and ensure DCD and RI irqs to be off tty: fix comment typo s/repsonsible/responsible/ tty: amba-pl011: Fix spurious TX interrupts serial: xuartps: Enable clocks in the pm disable case also serial: core: Re-use struct uart_port {name} field ... commit 87ea6bdd8da88842a8247921f58ca495b4da79ef Author: Gustavo A. R. Silva Date: Wed May 3 14:17:55 2017 -0500 scsi: qedf: properly update arguments position in function call Properly update the position of the arguments in function call. Addresses-Coverity-ID: 1402010 Signed-off-by: Gustavo A. R. Silva Acked-by: Chad Dupuis Signed-off-by: Martin K. Petersen drivers/scsi/qedf/qedf_els.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7aa686d35598cbe58b3f7ce32e4ec17649190f3d Author: Bart Van Assche Date: Tue May 2 10:45:03 2017 -0700 scsi: scsi_lib: Add #include This patch avoids that when building with W=1 the compiler complains that __scsi_init_queue() has not been declared. See also commit d48777a633d6 ("scsi: remove __scsi_alloc_queue"). Signed-off-by: Bart Van Assche Cc: Christoph Hellwig Cc: Hannes Reinecke Cc: Johannes Thumshirn Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen drivers/scsi/scsi_lib.c | 1 + 1 file changed, 1 insertion(+) commit 7cc49bbd005a5447afafc285dd302cbb8065eb28 Author: Christoph Hellwig Date: Tue May 2 09:57:20 2017 +0200 scsi: MAINTAINERS: update OSD entries The open-osd domain doesn't exist anymore, and mails to the list lead to really annoying bounced that repeat every day. Also the primarydata address for Benny bounces, and while I have a new one for him he doesn't seem to be maintaining the OSD code any more. Which beggs the question: should we really leave the Supported status in MAINTAINERS given that the code is barely maintained? Signed-off-by: Christoph Hellwig Acked-by: Jeff Layton Acked-by: Boaz Harrosh Acked-by: Benny Halevy Signed-off-by: Martin K. Petersen MAINTAINERS | 4 ---- 1 file changed, 4 deletions(-) commit 4ff7adc8c7886bcf6e48f09c49d3f339f33d7e79 Author: Zhou Zhengping Date: Fri Apr 28 17:43:04 2017 +0800 scsi: Skip deleted devices in __scsi_device_lookup When a device is unplugged from a SCSI controller, if the scsi_device is still in use by application layer, it won't get released until users close it. In this case, scsi_device_remove just set the scsi_device's state to be SDEV_DEL. But if you plug the disk just before the old scsi_device is released, then there will be two scsi_device structures in scsi_host->__devices. When the next unplug event happens, some low-level drivers will check whether the scsi_device has been added to host (for example the MegaRAID SAS series controller) by calling scsi_device_lookup(call __scsi_device_lookup) in function megasas_aen_polling. __scsi_device_lookup will return the first scsi_device. Because its state is SDEV_DEL, the scsi_device_lookup will return NULL, making the low-level driver assume that the scsi_device has been removed, and won't call scsi_device_remove which will lead to hot swap failure. Signed-off-by: Zhou Zhengping Tested-by: Zeng Rujia Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=195607 Reviewed-by: Hannes Reinecke Signed-off-by: Martin K. Petersen drivers/scsi/scsi.c | 2 ++ 1 file changed, 2 insertions(+) commit 4492b739c9ccfaf828bd7c02dc779ec2a5e55ff4 Author: James Smart Date: Thu Apr 27 15:08:26 2017 -0700 scsi: lpfc: Fix panic on BFS configuration To select the appropriate shost template, the driver is issuing a mailbox command to retrieve the wwn. Turns out the sending of the command precedes the reset of the function. On SLI-4 adapters, this is inconsequential as the mailbox command location is specified by dma via the BMBX register. However, on SLI-3 adapters, the location of the mailbox command submission area changes. When the function is first powered on or reset, the cmd is submitted via PCI bar memory. Later the driver changes the function config to use host memory and DMA. The request to start a mailbox command is the same, a simple doorbell write, regardless of submission area. So.. if there has not been a boot driver run against the adapter, the mailbox command works as defaults are ok. But, if the boot driver has configured the card and, and if no platform pci function/slot reset occurs as the os starts, the mailbox command will fail. The SLI-3 device will use the stale boot driver dma location. This can cause PCI eeh errors. Fix is to reset the sli-3 function before sending the mailbox command, thus synchronizing the function/driver on mailbox location. Note: The fix uses routines that are typically invoked later in the call flow to reset the sli-3 device. The issue in using those routines is that the normal (non-fix) flow does additional initialization, namely the allocation of the pport structure. So, rather than significantly reworking the initialization flow so that the pport is alloc'd first, pointer checks are added to work around it. Checks are limited to the routines invoked by a sli-3 adapter (s3 routines) as this fix/early call is only invoked on a sli3 adapter. Nothing changes post the fix. Subsequent initialization, and another adapter reset, still occur - both on sli-3 and sli-4 adapters. Signed-off-by: Dick Kennedy Signed-off-by: James Smart Fixes: 96418b5e2c88 ("scsi: lpfc: Fix eh_deadline setting for sli3 adapters.") Cc: stable@vger.kernel.org # v4.11+ Reviewed-by: Ewan D. Milne Reviewed-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen drivers/scsi/lpfc/lpfc_crtn.h | 1 + drivers/scsi/lpfc/lpfc_init.c | 7 +++++++ drivers/scsi/lpfc/lpfc_sli.c | 19 ++++++++++++------- 3 files changed, 20 insertions(+), 7 deletions(-) commit c1061255031dea76ee9e082d081b88ac6d6c8265 Author: Hannes Reinecke Date: Thu Apr 27 16:25:03 2017 +0200 scsi: libfc: do not flood console with messages 'libfc: queue full ...' When the FCoE sending side becomes congested libfc tries to reduce the queue depth on the host; however due to the built-in lag before attempting to ramp down the queue depth _again_ the message log is flooded with the following message: libfc: queue full, reducing can_queue to 512 With this patch the message is printed only once (ie when it's actually changed). Signed-off-by: Hannes Reinecke Reviewed-by: Bart Van Assche Acked-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen drivers/scsi/libfc/fc_fcp.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) commit 4dbbe2d8e95c351157f292ece067f985c30c7b53 Author: Matthias Kaehlcke Date: Fri Apr 21 16:41:10 2017 -0700 tracing: Use cpumask_available() to check if cpumask variable may be used This fixes the following clang warning: kernel/trace/trace.c:3231:12: warning: address of array 'iter->started' will always evaluate to 'true' [-Wpointer-bool-conversion] if (iter->started) Link: http://lkml.kernel.org/r/20170421234110.117075-1-mka@chromium.org Signed-off-by: Matthias Kaehlcke Signed-off-by: Steven Rostedt (VMware) kernel/trace/trace.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit bf5f89463f5b3109a72ed13ca62b57e90213387d Merge: 2d3e486 4d2b5bc Author: Linus Torvalds Date: Mon May 8 18:17:56 2017 -0700 Merge branch 'akpm' (patches from Andrew) Merge more updates from Andrew Morton: - the rest of MM - various misc things - procfs updates - lib/ updates - checkpatch updates - kdump/kexec updates - add kvmalloc helpers, use them - time helper updates for Y2038 issues. We're almost ready to remove current_fs_time() but that awaits a btrfs merge. - add tracepoints to DAX * emailed patches from Andrew Morton : (114 commits) drivers/staging/ccree/ssi_hash.c: fix build with gcc-4.4.4 selftests/vm: add a test for virtual address range mapping dax: add tracepoint to dax_insert_mapping() dax: add tracepoint to dax_writeback_one() dax: add tracepoints to dax_writeback_mapping_range() dax: add tracepoints to dax_load_hole() dax: add tracepoints to dax_pfn_mkwrite() dax: add tracepoints to dax_iomap_pte_fault() mtd: nand: nandsim: convert to memalloc_noreclaim_*() treewide: convert PF_MEMALLOC manipulations to new helpers mm: introduce memalloc_noreclaim_{save,restore} mm: prevent potential recursive reclaim due to clearing PF_MEMALLOC mm/huge_memory.c: deposit a pgtable for DAX PMD faults when required mm/huge_memory.c: use zap_deposited_table() more time: delete CURRENT_TIME_SEC and CURRENT_TIME gfs2: replace CURRENT_TIME with current_time apparmorfs: replace CURRENT_TIME with current_time() lustre: replace CURRENT_TIME macro fs: ubifs: replace CURRENT_TIME_SEC with current_time fs: ufs: use ktime_get_real_ts64() for birthtime ... commit 4d2b5bcab53f1c76a86279339561c9a36109a93b Author: Andrew Morton Date: Mon May 8 16:00:22 2017 -0700 drivers/staging/ccree/ssi_hash.c: fix build with gcc-4.4.4 drivers/staging/ccree/ssi_hash.c:1990: error: unknown field 'template_ahash' specified in initializer drivers/staging/ccree/ssi_hash.c:1991: error: unknown field 'init' specified in initializer drivers/staging/ccree/ssi_hash.c:1991: warning: missing braces around initializer drivers/staging/ccree/ssi_hash.c:1991: warning: (near initialization for 'driver_hash[0]..template_ahash') drivers/staging/ccree/ssi_hash.c:1992: error: unknown field 'update' specified in initializer drivers/staging/ccree/ssi_hash.c:1992: warning: excess elements in union initializer drivers/staging/ccree/ssi_hash.c:1992: warning: (near initialization for 'driver_hash[0].') drivers/staging/ccree/ssi_hash.c:1993: error: unknown field 'final' specified in initializer drivers/staging/ccree/ssi_hash.c:1993: warning: excess elements in union initializer drivers/staging/ccree/ssi_hash.c:1993: warning: (near initialization for 'driver_hash[0].') ... gcc-4.4.4 has issues with anon union initializers. Work around this. Cc: Gilad Ben-Yossef Cc: Greg Kroah-Hartman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/staging/ccree/ssi_hash.c | 236 +++++++++++++++++++++------------------ 1 file changed, 126 insertions(+), 110 deletions(-) commit 4e5ce33ceb3250f564656588da4d47f3eca7d2af Author: Anshuman Khandual Date: Mon May 8 16:00:19 2017 -0700 selftests/vm: add a test for virtual address range mapping This verifies virtual address mapping below and above the 128TB range and makes sure that address returned are within the expected range depending upon the hint passed from the user space. Link: http://lkml.kernel.org/r/20170418095252.20533-1-khandual@linux.vnet.ibm.com Signed-off-by: Anshuman Khandual Cc: Michal Suchanek Cc: Aneesh Kumar K.V Cc: Shuah Khan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds tools/testing/selftests/vm/Makefile | 1 + tools/testing/selftests/vm/run_vmtests | 11 ++ tools/testing/selftests/vm/virtual_address_range.c | 122 +++++++++++++++++++++ 3 files changed, 134 insertions(+) commit b4440734583c3addf80558e8fde2b61e2d76328c Author: Ross Zwisler Date: Mon May 8 16:00:16 2017 -0700 dax: add tracepoint to dax_insert_mapping() Add a tracepoint to dax_insert_mapping(), following the same logging conventions as the rest of DAX. This tracepoint, along with the one in dax_load_hole(), lets us know how a DAX PTE fault was serviced. Here is an example DAX fault that inserts a PTE mapping: small-1126 [007] .... 145.451604: dax_pte_fault: dev 259:0 ino 0x1003 shared WRITE|ALLOW_RETRY|KILLABLE|USER address 0x10420000 pgoff 0x220 small-1126 [007] .... 145.452317: dax_insert_mapping: dev 259:0 ino 0x1003 shared write address 0x10420000 radix_entry 0x100006 small-1126 [007] .... 145.452399: dax_pte_fault_done: dev 259:0 ino 0x1003 shared WRITE|ALLOW_RETRY|KILLABLE|USER address 0x10420000 pgoff 0x220 MAJOR|NOPAGE Link: http://lkml.kernel.org/r/20170221195116.13278-7-ross.zwisler@linux.intel.com Signed-off-by: Ross Zwisler Reviewed-by: Jan Kara Cc: Alexander Viro Cc: Dan Williams Cc: Ingo Molnar Cc: Matthew Wilcox Cc: Steven Rostedt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/dax.c | 1 + include/trace/events/fs_dax.h | 30 ++++++++++++++++++++++++++++++ 2 files changed, 31 insertions(+) commit f9bc3a07539bc80b4da9ff2f5d6c13d5c7a4f073 Author: Ross Zwisler Date: Mon May 8 16:00:13 2017 -0700 dax: add tracepoint to dax_writeback_one() Add a tracepoint to dax_writeback_one(), following the same logging conventions as the rest of DAX. Here is an example range writeback which ends up flushing one PMD and one PTE: test-1265 [003] .... 496.615250: dax_writeback_range: dev 259:0 ino 0x1003 pgoff 0x0-0x7ffffffffffff test-1265 [003] .... 496.616263: dax_writeback_one: dev 259:0 ino 0x1003 pgoff 0x0 pglen 0x200 test-1265 [003] .... 496.616270: dax_writeback_one: dev 259:0 ino 0x1003 pgoff 0x305 pglen 0x1 test-1265 [003] .... 496.616272: dax_writeback_range_done: dev 259:0 ino 0x1003 pgoff 0x0-0x7ffffffffffff [akpm@linux-foundation.org: struct blk_dax_ctl has disappeared] Link: http://lkml.kernel.org/r/20170221195116.13278-6-ross.zwisler@linux.intel.com Signed-off-by: Ross Zwisler Reviewed-by: Jan Kara Cc: Alexander Viro Cc: Dan Williams Cc: Ingo Molnar Cc: Matthew Wilcox Cc: Steven Rostedt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/dax.c | 1 + include/trace/events/fs_dax.h | 24 ++++++++++++++++++++++++ 2 files changed, 25 insertions(+) commit d14a3f48a152b75a1e690d443f509c07c7b06c0e Author: Ross Zwisler Date: Mon May 8 16:00:10 2017 -0700 dax: add tracepoints to dax_writeback_mapping_range() Add tracepoints to dax_writeback_mapping_range(), following the same logging conventions as the rest of DAX. Here is an example writeback call: msync-1085 [006] .... 200.902565: dax_writeback_range: dev 259:0 ino 0x1003 pgoff 0x200-0x2ff msync-1085 [006] .... 200.902579: dax_writeback_range_done: dev 259:0 ino 0x1003 pgoff 0x200-0x2ff [ross.zwisler@linux.intel.com: fix regression in dax_writeback_mapping_range()] Link: http://lkml.kernel.org/r/20170314215358.31451-1-ross.zwisler@linux.intel.com Link: http://lkml.kernel.org/r/20170221195116.13278-5-ross.zwisler@linux.intel.com Signed-off-by: Ross Zwisler Reviewed-by: Jan Kara Cc: Alexander Viro Cc: Dan Williams Cc: Ingo Molnar Cc: Matthew Wilcox Cc: Steven Rostedt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/dax.c | 12 +++++++----- include/trace/events/fs_dax.h | 32 ++++++++++++++++++++++++++++++++ 2 files changed, 39 insertions(+), 5 deletions(-) commit 678c9fd0430a1431bd9901c76f41e04fcb3eac87 Author: Ross Zwisler Date: Mon May 8 16:00:07 2017 -0700 dax: add tracepoints to dax_load_hole() Add tracepoints to dax_load_hole(), following the same logging conventions as the rest of DAX. Here is the logging generated by a PTE read from a hole: read-1075 [002] .... 62.362108: dax_pte_fault: dev 259:0 ino 0x1003 shared ALLOW_RETRY|KILLABLE|USER address 0x10480000 pgoff 0x280 read-1075 [002] .... 62.362140: dax_load_hole: dev 259:0 ino 0x1003 shared ALLOW_RETRY|KILLABLE|USER address 0x10480000 pgoff 0x280 NOPAGE read-1075 [002] .... 62.362141: dax_pte_fault_done: dev 259:0 ino 0x1003 shared ALLOW_RETRY|KILLABLE|USER address 0x10480000 pgoff 0x280 NOPAGE Link: http://lkml.kernel.org/r/20170221195116.13278-4-ross.zwisler@linux.intel.com Signed-off-by: Ross Zwisler Reviewed-by: Jan Kara Cc: Alexander Viro Cc: Dan Williams Cc: Ingo Molnar Cc: Matthew Wilcox Cc: Steven Rostedt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/dax.c | 16 +++++++++++----- include/trace/events/fs_dax.h | 1 + 2 files changed, 12 insertions(+), 5 deletions(-) commit c3ff68d7d1e6a24b7ad76d00ee583929858d4001 Author: Ross Zwisler Date: Mon May 8 16:00:03 2017 -0700 dax: add tracepoints to dax_pfn_mkwrite() Add tracepoints to dax_pfn_mkwrite(), following the same logging conventions as the rest of DAX. Here is an example PTE fault followed by a pfn_mkwrite: small_aligned-1094 [002] .... 374.084998: dax_pte_fault: dev 259:0 ino 0x1003 shared WRITE|ALLOW_RETRY|KILLABLE|USER address 0x10400000 pgoff 0x200 small_aligned-1094 [002] .... 374.085145: dax_pte_fault_done: dev 259:0 ino 0x1003 shared WRITE|ALLOW_RETRY|KILLABLE|USER address 0x10400000 pgoff 0x200 MAJOR|NOPAGE small_aligned-1094 [002] .... 374.085165: dax_pfn_mkwrite: dev 259:0 ino 0x1003 shared WRITE|MKWRITE|ALLOW_RETRY|KILLABLE|USER address 0x10400000 pgoff 0x200 NOPAGE Link: http://lkml.kernel.org/r/20170221195116.13278-3-ross.zwisler@linux.intel.com Signed-off-by: Ross Zwisler Reviewed-by: Jan Kara Cc: Alexander Viro Cc: Dan Williams Cc: Ingo Molnar Cc: Matthew Wilcox Cc: Steven Rostedt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/dax.c | 3 +++ include/trace/events/fs_dax.h | 2 ++ 2 files changed, 5 insertions(+) commit a9c42b33ed80968dd160e3be48c7e84ccf171cf9 Author: Ross Zwisler Date: Mon May 8 16:00:00 2017 -0700 dax: add tracepoints to dax_iomap_pte_fault() Patch series "second round of tracepoints for DAX". This second round of DAX tracepoint patches adds tracing to the PTE fault path (dax_iomap_pte_fault(), dax_pfn_mkwrite(), dax_load_hole(), dax_insert_mapping()) and to the writeback path (dax_writeback_mapping_range(), dax_writeback_one()). The purpose of this tracing is to give us a high level view of what DAX is doing, whether faults are being serviced by PMDs or PTEs, and by real storage or by zero pages covering holes. I do have some patches nearly ready which also add tracing to grab_mapping_entry() and dax_insert_mapping_entry(). These are more targeted at logging how we are interacting with the radix tree, how we use empty entries for locking, whether we "downgrade" huge zero pages to 4k PTE sized allocations, etc. In the end it seemed to me that this might be too detailed to have as constantly present tracepoints, but if anyone sees value in having tracepoints like this in the DAX code permanently (Jan?), please let me know and I'll add those last two patches. All these tracepoints were done to be consistent with the style of the XFS tracepoints and with the existing DAX PMD tracepoints. This patch (of 6): Add tracepoints to dax_iomap_pte_fault(), following the same logging conventions as the rest of DAX. Here is an example fault that initially tries to be serviced by the PMD fault handler but which falls back to PTEs because the VMA isn't large enough to hold a PMD: small-1086 [005] .... 71.140014: xfs_filemap_huge_fault: dev 259:0 ino 0x1003 small-1086 [005] .... 71.140027: dax_pmd_fault: dev 259:0 ino 0x1003 shared WRITE|ALLOW_RETRY|KILLABLE|USER address 0x10420000 vm_start 0x10200000 vm_end 0x10500000 pgoff 0x220 max_pgoff 0x1400 small-1086 [005] .... 71.140028: dax_pmd_fault_done: dev 259:0 ino 0x1003 shared WRITE|ALLOW_RETRY|KILLABLE|USER address 0x10420000 vm_start 0x10200000 vm_end 0x10500000 pgoff 0x220 max_pgoff 0x1400 FALLBACK small-1086 [005] .... 71.140035: dax_pte_fault: dev 259:0 ino 0x1003 shared WRITE|ALLOW_RETRY|KILLABLE|USER address 0x10420000 pgoff 0x220 small-1086 [005] .... 71.140396: dax_pte_fault_done: dev 259:0 ino 0x1003 shared WRITE|ALLOW_RETRY|KILLABLE|USER address 0x10420000 pgoff 0x220 MAJOR|NOPAGE Link: http://lkml.kernel.org/r/20170221195116.13278-2-ross.zwisler@linux.intel.com Signed-off-by: Ross Zwisler Reviewed-by: Jan Kara Cc: Alexander Viro Cc: Dan Williams Cc: Ingo Molnar Cc: Matthew Wilcox Cc: Steven Rostedt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/dax.c | 15 +++++++++++---- include/trace/events/fs_dax.h | 41 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 52 insertions(+), 4 deletions(-) commit dcbe82149cc9d03dcdf7cd1a75d5541de7c14be1 Author: Vlastimil Babka Date: Mon May 8 15:59:57 2017 -0700 mtd: nand: nandsim: convert to memalloc_noreclaim_*() Nandsim has own functions set_memalloc() and clear_memalloc() for robust setting and clearing of PF_MEMALLOC. Replace them by the new generic helpers. No functional change. Link: http://lkml.kernel.org/r/20170405074700.29871-5-vbabka@suse.cz Signed-off-by: Vlastimil Babka Cc: Boris Brezillon Cc: Richard Weinberger Cc: Michal Hocko Cc: Mel Gorman Cc: Johannes Weiner Cc: Andrey Ryabinin Cc: Chris Leech Cc: "David S. Miller" Cc: Eric Dumazet Cc: Josef Bacik Cc: Lee Duncan Cc: Michal Hocko Cc: Adrian Hunter Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/mtd/nand/nandsim.c | 29 +++++++++-------------------- 1 file changed, 9 insertions(+), 20 deletions(-) commit f108304872b8d987ceab195174ba41153fb70bf6 Author: Vlastimil Babka Date: Mon May 8 15:59:53 2017 -0700 treewide: convert PF_MEMALLOC manipulations to new helpers We now have memalloc_noreclaim_{save,restore} helpers for robust setting and clearing of PF_MEMALLOC. Let's convert the code which was using the generic tsk_restore_flags(). No functional change. [vbabka@suse.cz: in net/core/sock.c the hunk is missing] Link: http://lkml.kernel.org/r/20170405074700.29871-4-vbabka@suse.cz Signed-off-by: Vlastimil Babka Acked-by: Michal Hocko Cc: Josef Bacik Cc: Lee Duncan Cc: Chris Leech Cc: "David S. Miller" Cc: Eric Dumazet Cc: Mel Gorman Cc: Johannes Weiner Cc: Andrey Ryabinin Cc: Boris Brezillon Cc: Michal Hocko Cc: Richard Weinberger Cc: Wouter Verhelst Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/block/nbd.c | 7 ++++--- drivers/scsi/iscsi_tcp.c | 7 ++++--- net/core/dev.c | 7 ++++--- net/core/sock.c | 7 ++++--- 4 files changed, 16 insertions(+), 12 deletions(-) commit 499118e966f1d2150bd66647c8932343c4e9a0b8 Author: Vlastimil Babka Date: Mon May 8 15:59:50 2017 -0700 mm: introduce memalloc_noreclaim_{save,restore} The previous patch ("mm: prevent potential recursive reclaim due to clearing PF_MEMALLOC") has shown that simply setting and clearing PF_MEMALLOC in current->flags can result in wrongly clearing a pre-existing PF_MEMALLOC flag and potentially lead to recursive reclaim. Let's introduce helpers that support proper nesting by saving the previous stat of the flag, similar to the existing memalloc_noio_* and memalloc_nofs_* helpers. Convert existing setting/clearing of PF_MEMALLOC within mm to the new helpers. There are no known issues with the converted code, but the change makes it more robust. Link: http://lkml.kernel.org/r/20170405074700.29871-3-vbabka@suse.cz Signed-off-by: Vlastimil Babka Suggested-by: Michal Hocko Acked-by: Michal Hocko Acked-by: Hillf Danton Cc: Mel Gorman Cc: Johannes Weiner Cc: Andrey Ryabinin Cc: Boris Brezillon Cc: Chris Leech Cc: "David S. Miller" Cc: Eric Dumazet Cc: Josef Bacik Cc: Lee Duncan Cc: Michal Hocko Cc: Richard Weinberger Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/sched/mm.h | 12 ++++++++++++ mm/page_alloc.c | 11 ++++++----- mm/vmscan.c | 17 +++++++++++------ 3 files changed, 29 insertions(+), 11 deletions(-) commit 62be1511b1db8066220b18b7d4da2e6b9fdc69fb Author: Vlastimil Babka Date: Mon May 8 15:59:46 2017 -0700 mm: prevent potential recursive reclaim due to clearing PF_MEMALLOC Patch series "more robust PF_MEMALLOC handling" This series aims to unify the setting and clearing of PF_MEMALLOC, which prevents recursive reclaim. There are some places that clear the flag unconditionally from current->flags, which may result in clearing a pre-existing flag. This already resulted in a bug report that Patch 1 fixes (without the new helpers, to make backporting easier). Patch 2 introduces the new helpers, modelled after existing memalloc_noio_* and memalloc_nofs_* helpers, and converts mm core to use them. Patches 3 and 4 convert non-mm code. This patch (of 4): __alloc_pages_direct_compact() sets PF_MEMALLOC to prevent deadlock during page migration by lock_page() (see the comment in __unmap_and_move()). Then it unconditionally clears the flag, which can clear a pre-existing PF_MEMALLOC flag and result in recursive reclaim. This was not a problem until commit a8161d1ed609 ("mm, page_alloc: restructure direct compaction handling in slowpath"), because direct compation was called only after direct reclaim, which was skipped when PF_MEMALLOC flag was set. Even now it's only a theoretical issue, as the new callsite of __alloc_pages_direct_compact() is reached only for costly orders and when gfp_pfmemalloc_allowed() is true, which means either __GFP_NOMEMALLOC is in gfp_flags or in_interrupt() is true. There is no such known context, but let's play it safe and make __alloc_pages_direct_compact() robust for cases where PF_MEMALLOC is already set. Fixes: a8161d1ed609 ("mm, page_alloc: restructure direct compaction handling in slowpath") Link: http://lkml.kernel.org/r/20170405074700.29871-2-vbabka@suse.cz Signed-off-by: Vlastimil Babka Reported-by: Andrey Ryabinin Acked-by: Michal Hocko Acked-by: Hillf Danton Cc: Mel Gorman Cc: Johannes Weiner Cc: Boris Brezillon Cc: Chris Leech Cc: "David S. Miller" Cc: Eric Dumazet Cc: Josef Bacik Cc: Lee Duncan Cc: Michal Hocko Cc: Richard Weinberger Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/page_alloc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 3b6521f53572d7fc1b40c93931948716a53a82ab Author: Oliver O'Halloran Date: Mon May 8 15:59:43 2017 -0700 mm/huge_memory.c: deposit a pgtable for DAX PMD faults when required Although all architectures use a deposited page table for THP on anonymous VMAs, some architectures (s390 and powerpc) require the deposited storage even for file backed VMAs due to quirks of their MMUs. This patch adds support for depositing a table in DAX PMD fault handling path for archs that require it. Other architectures should see no functional changes. Link: http://lkml.kernel.org/r/20170411174233.21902-3-oohall@gmail.com Signed-off-by: Oliver O'Halloran Cc: Reza Arbab Cc: Balbir Singh Cc: linux-nvdimm@ml01.01.org Cc: Oliver O'Halloran Cc: Aneesh Kumar K.V Cc: "Kirill A. Shutemov" Cc: Martin Schwidefsky Cc: Heiko Carstens Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/huge_memory.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) commit c14a6eb44d8a59337433961d181ca953fb20d083 Author: Oliver O'Halloran Date: Mon May 8 15:59:40 2017 -0700 mm/huge_memory.c: use zap_deposited_table() more Depending on the flags of the PMD being zapped there may or may not be a deposited pgtable to be freed. In two of the three cases this is open coded while the third uses the zap_deposited_table() helper. This patch converts the others to use the helper to clean things up a bit. Link: http://lkml.kernel.org/r/20170411174233.21902-2-oohall@gmail.com Cc: Reza Arbab Cc: Balbir Singh Cc: linux-nvdimm@ml01.01.org Cc: Oliver O'Halloran Cc: Aneesh Kumar K.V Cc: "Kirill A. Shutemov" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/huge_memory.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) commit bfe1c566453a0979c0b3cd3728d0de962272f034 Author: Deepa Dinamani Date: Mon May 8 15:59:37 2017 -0700 time: delete CURRENT_TIME_SEC and CURRENT_TIME All uses of CURRENT_TIME_SEC and CURRENT_TIME macros have been replaced by other time functions. These macros are also not y2038 safe. And, all their use cases can be fulfilled by y2038 safe ktime_get_* variants. Link: http://lkml.kernel.org/r/1491613030-11599-12-git-send-email-deepa.kernel@gmail.com Signed-off-by: Deepa Dinamani Reviewed-by: Arnd Bergmann Acked-by: John Stultz Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/time.h | 3 --- 1 file changed, 3 deletions(-) commit b32c8c7648d2fa6ed689fc688ed74baa22f12ca0 Author: Stephen Rothwell Date: Mon May 8 15:59:34 2017 -0700 gfs2: replace CURRENT_TIME with current_time Link: http://lkml.kernel.org/r/20170420161852.0492bc3f@canb.auug.org.au Signed-off-by: Stephen Rothwell Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/gfs2/bmap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 24d0d03c2edcd24906cf04fe4f41fa619f1fe632 Author: Deepa Dinamani Date: Mon May 8 15:59:31 2017 -0700 apparmorfs: replace CURRENT_TIME with current_time() CURRENT_TIME macro is not y2038 safe on 32 bit systems. The patch replaces all the uses of CURRENT_TIME by current_time(). This is also in preparation for the patch that transitions vfs timestamps to use 64 bit time and hence make them y2038 safe. current_time() is also planned to be transitioned to y2038 safe behavior along with this change. CURRENT_TIME macro will be deleted before merging the aforementioned change. Link: http://lkml.kernel.org/r/1491613030-11599-11-git-send-email-deepa.kernel@gmail.com Signed-off-by: Deepa Dinamani Acked-by: John Johansen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds security/apparmor/apparmorfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 47f38c539e9a42344ff5a664942075bd4df93876 Author: Deepa Dinamani Date: Mon May 8 15:59:28 2017 -0700 lustre: replace CURRENT_TIME macro CURRENT_TIME macro is not y2038 safe on 32 bit systems. The patch replaces all the uses of CURRENT_TIME by current_time() for filesystem times, and ktime_get_* functions for others. struct timespec is also not y2038 safe. Retain timespec for timestamp representation here as lustre uses it internally everywhere. These references will be changed to use struct timespec64 in a separate patch. This is also in preparation for the patch that transitions vfs timestamps to use 64 bit time and hence make them y2038 safe. current_time() is also planned to be transitioned to y2038 safe behavior along with this change. CURRENT_TIME macro will be deleted before merging the aforementioned change. Link: http://lkml.kernel.org/r/1491613030-11599-10-git-send-email-deepa.kernel@gmail.com Signed-off-by: Deepa Dinamani Cc: Oleg Drokin Cc: Andreas Dilger Cc: James Simmons Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/staging/lustre/lustre/llite/llite_lib.c | 6 +++--- drivers/staging/lustre/lustre/osc/osc_io.c | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) commit 607a11ad947794d0f4f2c0f73c654876d1abb9b1 Author: Deepa Dinamani Date: Mon May 8 15:59:25 2017 -0700 fs: ubifs: replace CURRENT_TIME_SEC with current_time CURRENT_TIME_SEC is not y2038 safe. current_time() will be transitioned to use 64 bit time along with vfs in a separate patch. There is no plan to transition CURRENT_TIME_SEC to use y2038 safe time interfaces. current_time() returns timestamps according to the granularities set in the inode's super_block. The granularity check to call current_fs_time() or CURRENT_TIME_SEC is not required. Use current_time() directly to update inode timestamp. Use timespec_trunc during file system creation, before the first inode is created. Link: http://lkml.kernel.org/r/1491613030-11599-9-git-send-email-deepa.kernel@gmail.com Signed-off-by: Deepa Dinamani Reviewed-by: Arnd Bergmann Cc: Richard Weinberger Cc: Artem Bityutskiy Cc: Adrian Hunter Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/ubifs/dir.c | 12 ++++++------ fs/ubifs/file.c | 12 ++++++------ fs/ubifs/ioctl.c | 2 +- fs/ubifs/misc.h | 10 ---------- fs/ubifs/sb.c | 14 ++++++++++---- fs/ubifs/xattr.c | 6 +++--- 6 files changed, 26 insertions(+), 30 deletions(-) commit a88e99e976582814cf73acd04134f52a620f3416 Author: Deepa Dinamani Date: Mon May 8 15:59:22 2017 -0700 fs: ufs: use ktime_get_real_ts64() for birthtime CURRENT_TIME is not y2038 safe. Replace it with ktime_get_real_ts64(). Inode time formats are already 64 bit long and accommodates time64_t. Link: http://lkml.kernel.org/r/1491613030-11599-6-git-send-email-deepa.kernel@gmail.com Signed-off-by: Deepa Dinamani Cc: Evgeniy Dushistov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/ufs/ialloc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 1134e091006a61d7ea4c33748b598972d1edc5c4 Author: Deepa Dinamani Date: Mon May 8 15:59:19 2017 -0700 fs: ceph: CURRENT_TIME with ktime_get_real_ts() CURRENT_TIME is not y2038 safe. The macro will be deleted and all the references to it will be replaced by ktime_get_* apis. struct timespec is also not y2038 safe. Retain timespec for timestamp representation here as ceph uses it internally everywhere. These references will be changed to use struct timespec64 in a separate patch. The current_fs_time() api is being changed to use vfs struct inode* as an argument instead of struct super_block*. Set the new mds client request r_stamp field using ktime_get_real_ts() instead of using current_fs_time(). Also, since r_stamp is used as mtime on the server, use timespec_trunc() to truncate the timestamp, using the right granularity from the superblock. This api will be transitioned to be y2038 safe along with vfs. Link: http://lkml.kernel.org/r/1491613030-11599-5-git-send-email-deepa.kernel@gmail.com Signed-off-by: Deepa Dinamani Reviewed-by: Arnd Bergmann M: Ilya Dryomov M: "Yan, Zheng" M: Sage Weil Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/block/rbd.c | 2 +- fs/ceph/mds_client.c | 4 +++- net/ceph/messenger.c | 6 ++++-- net/ceph/osd_client.c | 4 ++-- 4 files changed, 10 insertions(+), 6 deletions(-) commit e37fea58f771c2674709099a09ddafd058fef634 Author: Deepa Dinamani Date: Mon May 8 15:59:16 2017 -0700 fs: cifs: replace CURRENT_TIME by other appropriate apis CURRENT_TIME macro is not y2038 safe on 32 bit systems. The patch replaces all the uses of CURRENT_TIME by current_time() for filesystem times, and ktime_get_* functions for authentication timestamps and timezone calculations. This is also in preparation for the patch that transitions vfs timestamps to use 64 bit time and hence make them y2038 safe. CURRENT_TIME macro will be deleted before merging the aforementioned change. The inode timestamps read from the server are assumed to have correct granularity and range. The patch also assumes that the difference between server and client times lie in the range INT_MIN..INT_MAX. This is valid because this is the difference between current times between server and client, and the largest timezone difference is in the range of one day. All cifs timestamps currently use timespec representation internally. Authentication and timezone timestamps can also be transitioned into using timespec64 when all other timestamps for cifs is transitioned to use timespec64. Link: http://lkml.kernel.org/r/1491613030-11599-4-git-send-email-deepa.kernel@gmail.com Signed-off-by: Deepa Dinamani Reviewed-by: Arnd Bergmann Cc: Steve French Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/cifs/cifsencrypt.c | 4 +++- fs/cifs/cifssmb.c | 10 +++++----- fs/cifs/inode.c | 28 +++++++++++++++------------- 3 files changed, 23 insertions(+), 19 deletions(-) commit 51aad0aee5b70e26347e4d891d568518909f3452 Author: Deepa Dinamani Date: Mon May 8 15:59:13 2017 -0700 trace: make trace_hwlat timestamp y2038 safe struct timespec is not y2038 safe on 32 bit machines and needs to be replaced by struct timespec64 in order to represent times beyond year 2038 on such machines. Fix all the timestamp representation in struct trace_hwlat and all the corresponding implementations. Link: http://lkml.kernel.org/r/1491613030-11599-3-git-send-email-deepa.kernel@gmail.com Signed-off-by: Deepa Dinamani Acked-by: Steven Rostedt (VMware) Cc: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/trace/trace_entries.h | 6 +++--- kernel/trace/trace_hwlat.c | 14 +++++++------- kernel/trace/trace_output.c | 9 ++++----- 3 files changed, 14 insertions(+), 15 deletions(-) commit 48fbfe50f1d5fef51bac98d105d2a28df42a1205 Author: Deepa Dinamani Date: Mon May 8 15:59:10 2017 -0700 fs: f2fs: use ktime_get_real_seconds for sit_info times CURRENT_TIME_SEC is not y2038 safe. Replace use of CURRENT_TIME_SEC with ktime_get_real_seconds in segment timestamps used by GC algorithm including the segment mtime timestamps. Link: http://lkml.kernel.org/r/1491613030-11599-2-git-send-email-deepa.kernel@gmail.com Signed-off-by: Deepa Dinamani Reviewed-by: Arnd Bergmann Cc: Jaegeuk Kim Cc: Chao Yu Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/f2fs/segment.c | 2 +- fs/f2fs/segment.h | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-) commit 063246641d4a9e9de84a2466fbad50112faf88dc Author: Kees Cook Date: Mon May 8 15:59:05 2017 -0700 format-security: move static strings to const While examining output from trial builds with -Wformat-security enabled, many strings were found that should be defined as "const", or as a char array instead of char pointer. This makes some static analysis easier, by producing fewer false positives. As these are all trivial changes, it seemed best to put them all in a single patch rather than chopping them up per maintainer. Link: http://lkml.kernel.org/r/20170405214711.GA5711@beast Signed-off-by: Kees Cook Acked-by: Jes Sorensen [runner.c] Cc: Tony Lindgren Cc: Russell King Cc: "Maciej W. Rozycki" Cc: Ralf Baechle Cc: Arnd Bergmann Cc: Greg Kroah-Hartman Cc: "Rafael J. Wysocki" Cc: Viresh Kumar Cc: Daniel Vetter Cc: Jani Nikula Cc: Sean Paul Cc: David Airlie Cc: Yisen Zhuang Cc: Salil Mehta Cc: Thomas Bogendoerfer Cc: Jiri Slaby Cc: Patrice Chotard Cc: "David S. Miller" Cc: James Hogan Cc: Paul Burton Cc: Matt Redfearn Cc: Paolo Bonzini Cc: Ingo Molnar Cc: Rasmus Villemoes Cc: Mugunthan V N Cc: Felipe Balbi Cc: Jarod Wilson Cc: Florian Westphal Cc: Antonio Quartulli Cc: Dmitry Torokhov Cc: Kejian Yan Cc: Daode Huang Cc: Qianqian Xie Cc: Philippe Reynes Cc: Colin Ian King Cc: Eric Dumazet Cc: Christian Gromm Cc: Andrey Shvetsov Cc: Jason Litzinger Cc: WANG Cong Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/arm/mach-omap2/board-n8x0.c | 2 +- arch/mips/dec/prom/init.c | 6 +++--- arch/mips/kernel/traps.c | 4 ++-- drivers/char/dsp56k.c | 2 +- drivers/cpufreq/powernow-k8.c | 3 ++- drivers/gpu/drm/drm_fb_helper.c | 2 +- drivers/net/ethernet/amd/atarilance.c | 4 ++-- drivers/net/ethernet/amd/declance.c | 2 +- drivers/net/ethernet/amd/sun3lance.c | 3 ++- drivers/net/ethernet/cirrus/mac89x0.c | 2 +- drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.h | 2 +- drivers/net/ethernet/natsemi/sonic.h | 2 +- drivers/net/ethernet/toshiba/tc35815.c | 2 +- drivers/net/fddi/defxx.c | 2 +- drivers/net/hippi/rrunner.c | 3 ++- drivers/staging/most/mostcore/core.c | 2 +- drivers/tty/n_hdlc.c | 10 +++++----- drivers/tty/serial/st-asc.c | 2 +- net/decnet/af_decnet.c | 3 ++- 19 files changed, 31 insertions(+), 27 deletions(-) commit 929f9d285a212fde8703b2c0d540d3a79e93b2cd Author: SeongJae Park Date: Mon May 8 15:59:02 2017 -0700 Documentation/vm/transhuge.txt: fix trivial typos [akpm@linux-foundation.org: fixes per Randy] Link: http://lkml.kernel.org/r/20170405210259.2067-1-sj38.park@gmail.com Signed-off-by: SeongJae Park Cc: Jonathan Corbet Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Documentation/vm/transhuge.txt | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit c718a97514e4d77c97a35734b728aaf541a0621b Author: Tetsuo Handa Date: Mon May 8 15:58:59 2017 -0700 fs: semove set but not checked AOP_FLAG_UNINTERRUPTIBLE flag Commit afddba49d18f ("fs: introduce write_begin, write_end, and perform_write aops") introduced AOP_FLAG_UNINTERRUPTIBLE flag which was checked in pagecache_write_begin(), but that check was removed by 4e02ed4b4a2f ("fs: remove prepare_write/commit_write"). Between these two commits, commit d9414774dc0c ("cifs: Convert cifs to new aops.") added a check in cifs_write_begin(), but that check was soon removed by commit a98ee8c1c707 ("[CIFS] fix regression in cifs_write_begin/cifs_write_end"). Therefore, AOP_FLAG_UNINTERRUPTIBLE flag is checked nowhere. Let's remove this flag. This patch has no functionality changes. Link: http://lkml.kernel.org/r/1489294781-53494-1-git-send-email-penguin-kernel@I-love.SAKURA.ne.jp Signed-off-by: Tetsuo Handa Reviewed-by: Jeff Layton Reviewed-by: Christoph Hellwig Cc: Nick Piggin Cc: Al Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Documentation/filesystems/vfs.txt | 3 +-- fs/buffer.c | 13 +++++-------- fs/exofs/dir.c | 3 +-- fs/hfs/extent.c | 4 ++-- fs/hfsplus/extents.c | 5 ++--- fs/iomap.c | 13 +++---------- fs/namei.c | 2 +- include/linux/fs.h | 5 ++--- mm/filemap.c | 6 ------ 9 files changed, 17 insertions(+), 37 deletions(-) commit f44a2920c84af809883ecbbd08d47fb5fe47c8ad Author: Andi Kleen Date: Mon May 8 15:58:56 2017 -0700 include/linux/uaccess.h: remove expensive WARN_ON in pagefault_disabled_dec pagefault_disabled_dec is frequently used inline, and it has a WARN_ON for underflow that expands to about 6.5k of extra code. The warning doesn't seem to be that useful and worth so much code so remove it. If it was needed could make it depending on some debug kernel option. Saves ~6.5k in my kernel text data bss dec hex filename 9039417 5367568 11116544 25523529 1857549 vmlinux-before-pf 9032805 5367568 11116544 25516917 1855b75 vmlinux-pf Link: http://lkml.kernel.org/r/20170315021431.13107-8-andi@firstfloor.org Signed-off-by: Andi Kleen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/uaccess.h | 1 - 1 file changed, 1 deletion(-) commit 68b43744c1fb3f86238527a696c0dc5f2bd6ea1b Author: Andi Kleen Date: Mon May 8 15:58:53 2017 -0700 drivers/scsi/megaraid: remove expensive inline from megasas_return_cmd Remove an inline from a fairly big function that is used often. It's unlikely that calling or not calling it makes a lot of difference. Saves around 8k text in my kernel. text data bss dec hex filename 9047801 5367568 11116544 25531913 1859609 vmlinux-before-megasas 9039417 5367568 11116544 25523529 1857549 vmlinux-megasas Link: http://lkml.kernel.org/r/20170315021431.13107-7-andi@firstfloor.org Signed-off-by: Andi Kleen Cc: Kashyap Desai Cc: Sumit Saxena Cc: James Bottomley Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/scsi/megaraid/megaraid_sas_base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ec48c940da6cb96c4be6638d0f2efade24d5242a Author: Andi Kleen Date: Mon May 8 15:58:50 2017 -0700 kref: remove WARN_ON for NULL release functions The kref functions check for NULL release functions. This WARN_ON seems rather pointless. We will eventually release and then just crash nicely. It is also somewhat expensive because these functions are inlined in a lot of places. Removing the WARN_ONs saves around 2.3k in this kernel (likely more in others with more drivers) text data bss dec hex filename 9083992 5367600 11116544 25568136 1862388 vmlinux-before-load-avg 9070166 5367600 11116544 25554310 185ed86 vmlinux-load-avg Link: http://lkml.kernel.org/r/20170315021431.13107-5-andi@firstfloor.org Signed-off-by: Andi Kleen Acked-by: Greg Kroah-Hartman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/kref.h | 6 ------ 1 file changed, 6 deletions(-) commit e6ccbff0e90cf4bf012bf369dbdaf84c6faaedaa Author: Laura Abbott Date: Mon May 8 15:58:47 2017 -0700 treewide: decouple cacheflush.h and set_memory.h Now that all call sites, completely decouple cacheflush.h and set_memory.h [sfr@canb.auug.org.au: kprobes/x86: merge fix for set_memory.h decoupling] Link: http://lkml.kernel.org/r/20170418180903.10300fd3@canb.auug.org.au Link: http://lkml.kernel.org/r/1488920133-27229-17-git-send-email-labbott@redhat.com Signed-off-by: Laura Abbott Signed-off-by: Stephen Rothwell Acked-by: Catalin Marinas Acked-by: Mark Rutland Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/arm/include/asm/cacheflush.h | 1 - arch/arm64/include/asm/cacheflush.h | 1 - arch/s390/include/asm/Kbuild | 1 + arch/s390/include/asm/cacheflush.h | 8 -------- arch/x86/include/asm/cacheflush.h | 1 - arch/x86/kernel/kprobes/core.c | 1 + arch/x86/kernel/kprobes/opt.c | 1 + 7 files changed, 3 insertions(+), 11 deletions(-) commit 880d5a36efe7479287c36194bffdcd6d7a183bab Author: Andrew Morton Date: Mon May 8 15:58:44 2017 -0700 drivers/staging/media/atomisp/pci/atomisp2: use set_memory.h Cc: Laura Abbott Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/staging/media/atomisp/pci/atomisp2/hmm/hmm_bo.c | 3 ++- drivers/staging/media/atomisp/pci/atomisp2/hmm/hmm_dynamic_pool.c | 2 +- drivers/staging/media/atomisp/pci/atomisp2/hmm/hmm_reserved_pool.c | 3 ++- drivers/staging/media/atomisp/pci/atomisp2/mmu/isp_mmu.c | 5 ++++- 4 files changed, 9 insertions(+), 4 deletions(-) commit 8d5a1181f32f555f1182ba4da56d9db0ce2c60c9 Author: Laura Abbott Date: Mon May 8 15:58:41 2017 -0700 drivers/video/fbdev/vermilion/vermilion.c: use set_memory.h header set_memory_* functions have moved to set_memory.h. Switch to this explicitly. Link: http://lkml.kernel.org/r/1488920133-27229-16-git-send-email-labbott@redhat.com Signed-off-by: Laura Abbott Acked-by: Bartlomiej Zolnierkiewicz Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/video/fbdev/vermilion/vermilion.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 056d16b2141d66611437fa12c2016c1c99cd7e3d Author: Laura Abbott Date: Mon May 8 15:58:38 2017 -0700 drivers/misc/sram-exec.c: use set_memory.h header set_memory_* functions have moved to set_memory.h. Switch to this explicitly. Link: http://lkml.kernel.org/r/1488920133-27229-15-git-send-email-labbott@redhat.com Signed-off-by: Laura Abbott Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/misc/sram-exec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 7f80f513588dac3d9cbf886a3f2f6354d821695e Author: Laura Abbott Date: Mon May 8 15:58:35 2017 -0700 alsa: use set_memory.h header set_memory_* functions have moved to set_memory.h. Switch to this explicitly. Link: http://lkml.kernel.org/r/1488920133-27229-14-git-send-email-labbott@redhat.com Signed-off-by: Laura Abbott Acked-by: Takashi Iwai Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds sound/pci/hda/hda_intel.c | 2 +- sound/pci/intel8x0.c | 4 +++- sound/x86/intel_hdmi_audio.c | 2 +- 3 files changed, 5 insertions(+), 3 deletions(-) commit 50327ddfbc926e68da1958e4fac51f1106f5e730 Author: Laura Abbott Date: Mon May 8 15:58:32 2017 -0700 kernel/power/snapshot.c: use set_memory.h header set_memory_* functions have moved to set_memory.h. Switch to this explicitly. Link: http://lkml.kernel.org/r/1488920133-27229-13-git-send-email-labbott@redhat.com Signed-off-by: Laura Abbott Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/power/snapshot.c | 3 +++ 1 file changed, 3 insertions(+) commit bbca07c307166a753155e79a874d07023f4edd20 Author: Laura Abbott Date: Mon May 8 15:58:29 2017 -0700 kernel/module.c: use set_memory.h header set_memory_* functions have moved to set_memory.h. Switch to this explicitly. Link: http://lkml.kernel.org/r/1488920133-27229-12-git-send-email-labbott@redhat.com Signed-off-by: Laura Abbott Acked-by: Jessica Yu Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/module.c | 3 +++ 1 file changed, 3 insertions(+) commit 2d0bde57f3527ffac9279b4c8ba61060ba395b1a Author: Laura Abbott Date: Mon May 8 15:58:26 2017 -0700 include/linux/filter.h: use set_memory.h header set_memory_* functions have moved to set_memory.h. Switch to this explicitly. Link: http://lkml.kernel.org/r/1488920133-27229-11-git-send-email-labbott@redhat.com Signed-off-by: Laura Abbott Acked-by: Daniel Borkmann Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/filter.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 23f19a563b2f15d9bf391cb9d3c1829bee56a44b Author: Laura Abbott Date: Mon May 8 15:58:23 2017 -0700 drivers/watchdog/hpwdt.c: use set_memory.h header set_memory_* functions have moved to set_memory.h. Switch to this explicitly. Link: http://lkml.kernel.org/r/1488920133-27229-10-git-send-email-labbott@redhat.com Signed-off-by: Laura Abbott Acked-by: Guenter Roeck Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/watchdog/hpwdt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0c14dac9a411d20ca59e3b39724c1393f27635bc Author: Laura Abbott Date: Mon May 8 15:58:20 2017 -0700 drivers/hwtracing/intel_th/msu.c: use set_memory.h header set_memory_* functions have moved to set_memory.h. Switch to this explicitly. Link: http://lkml.kernel.org/r/1488920133-27229-9-git-send-email-labbott@redhat.com Signed-off-by: Laura Abbott Acked-by: Alexander Shishkin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/hwtracing/intel_th/msu.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit ed3ba07946631f5c3a091fb37b018f7570f242b1 Author: Laura Abbott Date: Mon May 8 15:58:17 2017 -0700 drm: use set_memory.h header set_memory_* functions have moved to set_memory.h. Switch to this explicitly. [akpm@linux-foundation.org: track drivers/gpu/drm/i915/i915_gem_gtt.c linux-next changes] Link: http://lkml.kernel.org/r/1488920133-27229-8-git-send-email-labbott@redhat.com Signed-off-by: Laura Abbott Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 3 +++ drivers/gpu/drm/gma500/gtt.c | 1 + drivers/gpu/drm/gma500/psb_drv.c | 1 + drivers/gpu/drm/i915/i915_gem_gtt.c | 2 ++ drivers/gpu/drm/radeon/radeon_gart.c | 3 +++ drivers/gpu/drm/ttm/ttm_page_alloc.c | 3 +++ drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 3 +++ drivers/gpu/drm/ttm/ttm_tt.c | 3 +++ 8 files changed, 19 insertions(+) commit e47036b45a3f02d35648d4683b9e26f26a60e231 Author: Laura Abbott Date: Mon May 8 15:58:14 2017 -0700 agp: use set_memory.h header set_memory_* functions have moved to set_memory.h. Switch to this explicitly. Link: http://lkml.kernel.org/r/1488920133-27229-7-git-send-email-labbott@redhat.com Signed-off-by: Laura Abbott Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/char/agp/amd-k7-agp.c | 1 + drivers/char/agp/ati-agp.c | 1 + drivers/char/agp/generic.c | 4 +++- drivers/char/agp/intel-gtt.c | 1 + drivers/char/agp/sworks-agp.c | 1 + 5 files changed, 7 insertions(+), 1 deletion(-) commit d11636511ed97ceda66a08ecff99f100e1107b76 Author: Laura Abbott Date: Mon May 8 15:58:11 2017 -0700 x86: use set_memory.h header set_memory_* functions have moved to set_memory.h. Switch to this explicitly. Link: http://lkml.kernel.org/r/1488920133-27229-6-git-send-email-labbott@redhat.com Signed-off-by: Laura Abbott Acked-by: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/x86/kernel/amd_gart_64.c | 2 +- arch/x86/kernel/cpu/amd.c | 2 +- arch/x86/kernel/cpu/bugs.c | 2 +- arch/x86/kernel/ftrace.c | 2 +- arch/x86/kernel/machine_kexec_32.c | 2 +- arch/x86/kernel/machine_kexec_64.c | 1 + arch/x86/mm/init.c | 2 +- arch/x86/mm/init_32.c | 2 +- arch/x86/mm/init_64.c | 2 +- arch/x86/mm/ioremap.c | 2 +- arch/x86/mm/pageattr.c | 1 + arch/x86/net/bpf_jit_comp.c | 1 + arch/x86/pci/pcbios.c | 2 +- arch/x86/platform/efi/efi.c | 2 +- arch/x86/realmode/init.c | 2 +- 15 files changed, 15 insertions(+), 12 deletions(-) commit e6c7c63001920a57f23c8f5d6f652bfc4bea327b Author: Laura Abbott Date: Mon May 8 15:58:08 2017 -0700 s390: use set_memory.h header set_memory_* functions have moved to set_memory.h. Switch to this explicitly Link: http://lkml.kernel.org/r/1488920133-27229-5-git-send-email-labbott@redhat.com Signed-off-by: Laura Abbott Acked-by: Heiko Carstens Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/s390/kernel/ftrace.c | 1 + arch/s390/kernel/kprobes.c | 2 +- arch/s390/kernel/machine_kexec.c | 1 + arch/s390/mm/init.c | 1 + arch/s390/mm/pageattr.c | 1 + arch/s390/mm/vmem.c | 1 + arch/s390/net/bpf_jit_comp.c | 1 + 7 files changed, 7 insertions(+), 1 deletion(-) commit d4bbc30bb059ec6bbb17edd3d3f98c5edeee7494 Author: Laura Abbott Date: Mon May 8 15:58:05 2017 -0700 arm64: use set_memory.h header The set_memory_* functions have moved to set_memory.h. Use that header explicitly. Link: http://lkml.kernel.org/r/1488920133-27229-4-git-send-email-labbott@redhat.com Signed-off-by: Laura Abbott Acked-by: Catalin Marinas Acked-by: Mark Rutland Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/arm64/mm/pageattr.c | 1 + arch/arm64/net/bpf_jit_comp.c | 1 + 2 files changed, 2 insertions(+) commit 74d86a70636a0a5eec76efcff24bee9681e01804 Author: Laura Abbott Date: Mon May 8 15:58:02 2017 -0700 arm: use set_memory.h header set_memory_* functions have moved to set_memory.h. Switch to this explicitly Link: http://lkml.kernel.org/r/1488920133-27229-3-git-send-email-labbott@redhat.com Signed-off-by: Laura Abbott Acked-by: Russell King Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/arm/kernel/ftrace.c | 1 + arch/arm/kernel/machine_kexec.c | 1 + arch/arm/mm/pageattr.c | 1 + arch/arm/net/bpf_jit_32.c | 1 + 4 files changed, 4 insertions(+) commit 299878bac326c890699c696ebba26f56fe93fc75 Author: Laura Abbott Date: Mon May 8 15:57:59 2017 -0700 treewide: move set_memory_* functions away from cacheflush.h Patch series "set_memory_* functions header refactor", v3. The set_memory_* APIs came out of a desire to have a better way to change memory attributes. Many of these attributes were linked to cache functionality so the prototypes were put in cacheflush.h. These days, the APIs have grown and have a much wider use than just cache APIs. To support this growth, split off set_memory_* and friends into a separate header file to avoid growing cacheflush.h for APIs that have nothing to do with caches. Link: http://lkml.kernel.org/r/1488920133-27229-2-git-send-email-labbott@redhat.com Signed-off-by: Laura Abbott Acked-by: Russell King Acked-by: Mark Rutland Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/arm/include/asm/cacheflush.h | 21 +-------- arch/arm/include/asm/set_memory.h | 32 ++++++++++++++ arch/arm64/include/asm/Kbuild | 1 + arch/arm64/include/asm/cacheflush.h | 5 +-- arch/s390/include/asm/cacheflush.h | 28 +----------- arch/s390/include/asm/set_memory.h | 31 +++++++++++++ arch/x86/include/asm/cacheflush.h | 86 +----------------------------------- arch/x86/include/asm/set_memory.h | 87 +++++++++++++++++++++++++++++++++++++ include/asm-generic/set_memory.h | 12 +++++ 9 files changed, 167 insertions(+), 136 deletions(-) commit 8ac1ed791401790968fd00ca63ca4fa814677199 Author: Joe Perches Date: Mon May 8 15:57:56 2017 -0700 treewide: spelling: correct diffrent[iate] and banlance typos Add these misspellings to scripts/spelling.txt too Link: http://lkml.kernel.org/r/962aace119675e5fe87be2a88ddac1a5486f8e60.1490931810.git.joe@perches.com Signed-off-by: Joe Perches Acked-by: Mauro Carvalho Chehab Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/media/dvb-frontends/drx39xyj/drx_dap_fasi.h | 2 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c | 2 +- drivers/net/ethernet/qlogic/qed/qed_int.c | 2 +- drivers/net/ethernet/qlogic/qed/qed_main.c | 2 +- drivers/net/ethernet/qlogic/qed/qed_sriov.c | 2 +- include/linux/mlx4/device.h | 2 +- scripts/spelling.txt | 3 +++ 7 files changed, 9 insertions(+), 6 deletions(-) commit 6e7c2b4dd36d8336f876c66a31d9b84616f3b2c4 Author: Masahiro Yamada Date: Mon May 8 15:57:53 2017 -0700 scripts/spelling.txt: add "intialise(d)" pattern and fix typo instances Fix typos and add the following to the scripts/spelling.txt: intialisation||initialisation intialised||initialised intialise||initialise This commit does not intend to change the British spelling itself. Link: http://lkml.kernel.org/r/1481573103-11329-18-git-send-email-yamada.masahiro@socionext.com Signed-off-by: Masahiro Yamada Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds certs/blacklist.c | 2 +- drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 8 ++++---- drivers/video/fbdev/intelfb/intelfbdrv.c | 2 +- fs/inode.c | 2 +- fs/xfs/xfs_log_recover.c | 2 +- scripts/spelling.txt | 3 +++ 6 files changed, 11 insertions(+), 8 deletions(-) commit ad61dd303a0f2439bb104349e2d2ec91a3010ce0 Author: Stephen Boyd Date: Mon May 8 15:57:50 2017 -0700 scripts/spelling.txt: add regsiter -> register spelling mistake This typo is quite common. Fix it and add it to the spelling file so that checkpatch catches it earlier. Link: http://lkml.kernel.org/r/20170317011131.6881-2-sboyd@codeaurora.org Signed-off-by: Stephen Boyd Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/arc/kernel/unwind.c | 2 +- arch/arm/kernel/kgdb.c | 2 +- arch/arm/mach-ixp4xx/common-pci.c | 4 ++-- arch/m68k/ifpsp060/src/ilsp.S | 2 +- arch/m68k/ifpsp060/src/isp.S | 2 +- arch/mips/cavium-octeon/executive/cvmx-helper-rgmii.c | 2 +- arch/mips/include/asm/octeon/cvmx-helper-rgmii.h | 2 +- arch/parisc/kernel/entry.S | 2 +- arch/powerpc/mm/icswx.c | 2 +- drivers/acpi/cppc_acpi.c | 2 +- drivers/clk/qcom/common.c | 2 +- drivers/cpufreq/sti-cpufreq.c | 4 ++-- drivers/infiniband/hw/hns/hns_roce_hw_v1.c | 2 +- drivers/infiniband/hw/hns/hns_roce_mr.c | 2 +- drivers/net/can/rcar/rcar_canfd.c | 2 +- drivers/net/ethernet/amd/amd8111e.h | 4 ++-- drivers/net/ethernet/atheros/atl1c/atl1c_hw.c | 2 +- drivers/net/ethernet/intel/igb/e1000_phy.c | 2 +- drivers/scsi/isci/registers.h | 4 ++-- drivers/scsi/mpt3sas/mpt3sas_base.h | 2 +- include/linux/bcma/bcma_driver_pci.h | 2 +- include/linux/ftrace.h | 2 +- include/uapi/linux/ipmi.h | 2 +- scripts/spelling.txt | 1 + sound/soc/soc-core.c | 2 +- 25 files changed, 29 insertions(+), 28 deletions(-) commit d1b7c9344b628f8bbb55a0775667f33b8eafac82 Author: Stephen Boyd Date: Mon May 8 15:57:47 2017 -0700 scripts/spelling.txt: add "memory" pattern and fix typos Fix typos and add the following to the scripts/spelling.txt: momery||memory Link: http://lkml.kernel.org/r/20170317011131.6881-1-sboyd@codeaurora.org Signed-off-by: Stephen Boyd Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/infiniband/hw/hns/hns_roce_hw_v1.c | 2 +- drivers/leds/leds-lp5521.c | 2 +- drivers/leds/leds-lp5523.c | 2 +- drivers/leds/leds-lp5562.c | 2 +- scripts/spelling.txt | 1 + 5 files changed, 5 insertions(+), 4 deletions(-) commit 19809c2da28aee5860ad9a2eff760730a0710df0 Author: Michal Hocko Date: Mon May 8 15:57:44 2017 -0700 mm, vmalloc: use __GFP_HIGHMEM implicitly __vmalloc* allows users to provide gfp flags for the underlying allocation. This API is quite popular $ git grep "=[[:space:]]__vmalloc\|return[[:space:]]*__vmalloc" | wc -l 77 The only problem is that many people are not aware that they really want to give __GFP_HIGHMEM along with other flags because there is really no reason to consume precious lowmemory on CONFIG_HIGHMEM systems for pages which are mapped to the kernel vmalloc space. About half of users don't use this flag, though. This signals that we make the API unnecessarily too complex. This patch simply uses __GFP_HIGHMEM implicitly when allocating pages to be mapped to the vmalloc space. Current users which add __GFP_HIGHMEM are simplified and drop the flag. Link: http://lkml.kernel.org/r/20170307141020.29107-1-mhocko@kernel.org Signed-off-by: Michal Hocko Reviewed-by: Matthew Wilcox Cc: Al Viro Cc: Vlastimil Babka Cc: David Rientjes Cc: Cristopher Lameter Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/parisc/kernel/module.c | 2 +- arch/x86/kernel/module.c | 2 +- drivers/block/drbd/drbd_bitmap.c | 2 +- drivers/gpu/drm/etnaviv/etnaviv_dump.c | 4 ++-- drivers/md/dm-bufio.c | 2 +- fs/btrfs/free-space-tree.c | 3 +-- fs/file.c | 2 +- fs/xfs/kmem.c | 2 +- include/drm/drm_mem_util.h | 9 +++------ kernel/bpf/core.c | 9 +++------ kernel/bpf/syscall.c | 3 +-- kernel/fork.c | 2 +- kernel/groups.c | 2 +- kernel/module.c | 2 +- mm/kasan/kasan.c | 2 +- mm/nommu.c | 3 +-- mm/util.c | 2 +- mm/vmalloc.c | 14 +++++++------- net/ceph/ceph_common.c | 2 +- net/netfilter/x_tables.c | 3 +-- 20 files changed, 31 insertions(+), 41 deletions(-) commit 54f180d3c181277457fb003dd9524c2aa1ef8160 Author: Huang Ying Date: Mon May 8 15:57:40 2017 -0700 mm, swap: use kvzalloc to allocate some swap data structures Now vzalloc() is used in swap code to allocate various data structures, such as swap cache, swap slots cache, cluster info, etc. Because the size may be too large on some system, so that normal kzalloc() may fail. But using kzalloc() has some advantages, for example, less memory fragmentation, less TLB pressure, etc. So change the data structure allocation in swap code to use kvzalloc() which will try kzalloc() firstly, and fallback to vzalloc() if kzalloc() failed. In general, although kmalloc() will reduce the number of high-order pages in short term, vmalloc() will cause more pain for memory fragmentation in the long term. And the swap data structure allocation that is changed in this patch is expected to be long term allocation. From Dave Hansen: "for example, we have a two-page data structure. vmalloc() takes two effectively random order-0 pages, probably from two different 2M pages and pins them. That "kills" two 2M pages. kmalloc(), allocating two *contiguous* pages, will not cross a 2M boundary. That means it will only "kill" the possibility of a single 2M page. More 2M pages == less fragmentation. The allocation in this patch occurs during swap on time, which is usually done during system boot, so usually we have high opportunity to allocate the contiguous pages successfully. The allocation for swap_map[] in struct swap_info_struct is not changed, because that is usually quite large and vmalloc_to_page() is used for it. That makes it a little harder to change. Link: http://lkml.kernel.org/r/20170407064911.25447-1-ying.huang@intel.com Signed-off-by: Huang Ying Acked-by: Tim Chen Acked-by: Michal Hocko Acked-by: Rik van Riel Cc: Dave Hansen Cc: Hugh Dickins Cc: Shaohua Li Cc: Minchan Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/swap_slots.c | 19 +++++++++++-------- mm/swap_state.c | 2 +- mm/swapfile.c | 10 ++++++---- 3 files changed, 18 insertions(+), 13 deletions(-) commit bc4e54f6e966e9ca35064cd60f91b1478c07a1b2 Author: Michal Hocko Date: Mon May 8 15:57:37 2017 -0700 drivers/md/bcache/super.c: use kvmalloc bcache_device_init uses kmalloc for small requests and vmalloc for those which are larger than 64 pages. This alone is a strange criterion. Moreover kmalloc can fallback to vmalloc on the failure. Let's simply use kvmalloc instead as it knows how to handle the fallback properly Link: http://lkml.kernel.org/r/20170306103327.2766-5-mhocko@kernel.org Signed-off-by: Michal Hocko Acked-by: Vlastimil Babka Cc: Kent Overstreet Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/md/bcache/super.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) commit d224e938189771dbd1e3b68ee8603a949bee76bb Author: Michal Hocko Date: Mon May 8 15:57:34 2017 -0700 drivers/md/dm-ioctl.c: use kvmalloc rather than opencoded variant copy_params uses kmalloc with vmalloc fallback. We already have a helper for that - kvmalloc. This caller requires GFP_NOIO semantic so it hasn't been converted with many others by previous patches. All we need to achieve this semantic is to use the scope memalloc_noio_{save,restore} around kvmalloc. Link: http://lkml.kernel.org/r/20170306103327.2766-4-mhocko@kernel.org Signed-off-by: Michal Hocko Acked-by: Vlastimil Babka Cc: Mikulas Patocka Cc: Mike Snitzer Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/md/dm-ioctl.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) commit da6bc57a8f02dd90d07071b4cd067f2de26c9192 Author: Michal Hocko Date: Mon May 8 15:57:31 2017 -0700 net: use kvmalloc with __GFP_REPEAT rather than open coded variant fq_alloc_node, alloc_netdev_mqs and netif_alloc* open code kmalloc with vmalloc fallback. Use the kvmalloc variant instead. Keep the __GFP_REPEAT flag based on explanation from Eric: "At the time, tests on the hardware I had in my labs showed that vmalloc() could deliver pages spread all over the memory and that was a small penalty (once memory is fragmented enough, not at boot time)" The way how the code is constructed means, however, that we prefer to go and hit the OOM killer before we fall back to the vmalloc for requests <=32kB (with 4kB pages) in the current code. This is rather disruptive for something that can be achived with the fallback. On the other hand __GFP_REPEAT doesn't have any useful semantic for these requests. So the effect of this patch is that requests which fit into 32kB will fall back to vmalloc easier now. Link: http://lkml.kernel.org/r/20170306103327.2766-3-mhocko@kernel.org Signed-off-by: Michal Hocko Acked-by: Vlastimil Babka Cc: Eric Dumazet Cc: David Miller Cc: Shakeel Butt Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds net/core/dev.c | 24 +++++++++--------------- net/sched/sch_fq.c | 12 +----------- 2 files changed, 10 insertions(+), 26 deletions(-) commit 752ade68cbd81d0321dfecc188f655a945551b25 Author: Michal Hocko Date: Mon May 8 15:57:27 2017 -0700 treewide: use kv[mz]alloc* rather than opencoded variants There are many code paths opencoding kvmalloc. Let's use the helper instead. The main difference to kvmalloc is that those users are usually not considering all the aspects of the memory allocator. E.g. allocation requests <= 32kB (with 4kB pages) are basically never failing and invoke OOM killer to satisfy the allocation. This sounds too disruptive for something that has a reasonable fallback - the vmalloc. On the other hand those requests might fallback to vmalloc even when the memory allocator would succeed after several more reclaim/compaction attempts previously. There is no guarantee something like that happens though. This patch converts many of those places to kv[mz]alloc* helpers because they are more conservative. Link: http://lkml.kernel.org/r/20170306103327.2766-2-mhocko@kernel.org Signed-off-by: Michal Hocko Reviewed-by: Boris Ostrovsky # Xen bits Acked-by: Kees Cook Acked-by: Vlastimil Babka Acked-by: Andreas Dilger # Lustre Acked-by: Christian Borntraeger # KVM/s390 Acked-by: Dan Williams # nvdim Acked-by: David Sterba # btrfs Acked-by: Ilya Dryomov # Ceph Acked-by: Tariq Toukan # mlx4 Acked-by: Leon Romanovsky # mlx5 Cc: Martin Schwidefsky Cc: Heiko Carstens Cc: Herbert Xu Cc: Anton Vorontsov Cc: Colin Cross Cc: Tony Luck Cc: "Rafael J. Wysocki" Cc: Ben Skeggs Cc: Kent Overstreet Cc: Santosh Raspatur Cc: Hariprasad S Cc: Yishai Hadas Cc: Oleg Drokin Cc: "Yan, Zheng" Cc: Alexander Viro Cc: Alexei Starovoitov Cc: Eric Dumazet Cc: David Miller Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/s390/kvm/kvm-s390.c | 10 ++----- crypto/lzo.c | 4 +-- drivers/acpi/apei/erst.c | 8 ++---- drivers/char/agp/generic.c | 8 +----- drivers/gpu/drm/nouveau/nouveau_gem.c | 4 +-- drivers/md/bcache/util.h | 12 ++------ drivers/net/ethernet/chelsio/cxgb3/cxgb3_defs.h | 3 -- drivers/net/ethernet/chelsio/cxgb3/cxgb3_offload.c | 29 +++---------------- drivers/net/ethernet/chelsio/cxgb3/l2t.c | 8 +----- drivers/net/ethernet/chelsio/cxgb3/l2t.h | 1 - drivers/net/ethernet/chelsio/cxgb4/clip_tbl.c | 12 ++++---- drivers/net/ethernet/chelsio/cxgb4/cxgb4.h | 3 -- drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c | 10 +++---- drivers/net/ethernet/chelsio/cxgb4/cxgb4_ethtool.c | 8 +++--- drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 31 ++++---------------- drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_u32.c | 14 ++++----- drivers/net/ethernet/chelsio/cxgb4/l2t.c | 2 +- drivers/net/ethernet/chelsio/cxgb4/sched.c | 12 ++++---- drivers/net/ethernet/mellanox/mlx4/en_tx.c | 9 ++---- drivers/net/ethernet/mellanox/mlx4/mr.c | 9 ++---- drivers/nvdimm/dimm_devs.c | 5 +--- .../staging/lustre/lnet/libcfs/linux/linux-mem.c | 11 +------- drivers/xen/evtchn.c | 14 +-------- fs/btrfs/ctree.c | 9 ++---- fs/btrfs/ioctl.c | 9 ++---- fs/btrfs/send.c | 27 ++++++------------ fs/ceph/file.c | 9 ++---- fs/select.c | 5 +--- fs/xattr.c | 27 ++++++------------ include/linux/mlx5/driver.h | 7 +---- include/linux/mm.h | 8 ++++++ lib/iov_iter.c | 5 +--- mm/frame_vector.c | 5 +--- net/ipv4/inet_hashtables.c | 6 +--- net/ipv4/tcp_metrics.c | 5 +--- net/mpls/af_mpls.c | 5 +--- net/netfilter/x_tables.c | 21 +++----------- net/netfilter/xt_recent.c | 5 +--- net/sched/sch_choke.c | 5 +--- net/sched/sch_fq_codel.c | 26 ++++------------- net/sched/sch_hhf.c | 33 ++++++---------------- net/sched/sch_netem.c | 6 +--- net/sched/sch_sfq.c | 6 +--- security/keys/keyctl.c | 22 ++++----------- 44 files changed, 128 insertions(+), 350 deletions(-) commit 81be3dee96346fbe08c31be5ef74f03f6b63cf68 Author: Michal Hocko Date: Mon May 8 15:57:24 2017 -0700 fs/xattr.c: zero out memory copied to userspace in getxattr getxattr uses vmalloc to allocate memory if kzalloc fails. This is filled by vfs_getxattr and then copied to the userspace. vmalloc, however, doesn't zero out the memory so if the specific implementation of the xattr handler is sloppy we can theoretically expose a kernel memory. There is no real sign this is really the case but let's make sure this will not happen and use vzalloc instead. Fixes: 779302e67835 ("fs/xattr.c:getxattr(): improve handling of allocation failures") Link: http://lkml.kernel.org/r/20170306103327.2766-1-mhocko@kernel.org Acked-by: Kees Cook Reported-by: Vlastimil Babka Signed-off-by: Michal Hocko Cc: [3.6+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/xattr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 847f716f9ec2c61f57690c871a307f1349d472d0 Author: Michal Hocko Date: Mon May 8 15:57:21 2017 -0700 net/ipv6/ila/ila_xlat.c: simplify a strange allocation pattern alloc_ila_locks seemed to c&p from alloc_bucket_locks allocation pattern which is quite unusual. The default allocation size is 320 * sizeof(spinlock_t) which is sub page unless lockdep is enabled when the performance benefit is really questionable and not worth the subtle code IMHO. Also note that the context when we call ila_init_net (modprobe or a task creating a net namespace) has to be properly configured. Let's just simplify the code and use kvmalloc helper which is a transparent way to use kmalloc with vmalloc fallback. Link: http://lkml.kernel.org/r/20170306103032.2540-5-mhocko@kernel.org Signed-off-by: Michal Hocko Acked-by: Vlastimil Babka Cc: Tom Herbert Cc: Eric Dumazet Cc: David Miller Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds net/ipv6/ila/ila_xlat.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) commit 43ca5bc4f72ed22e6e20feabdd3eab3c721d98cd Author: Michal Hocko Date: Mon May 8 15:57:18 2017 -0700 lib/rhashtable.c: simplify a strange allocation pattern alloc_bucket_locks allocation pattern is quite unusual. We are preferring vmalloc when CONFIG_NUMA is enabled. The rationale is that vmalloc will respect the memory policy of the current process and so the backing memory will get distributed over multiple nodes if the requester is configured properly. At least that is the intention, in reality rhastable is shrunk and expanded from a kernel worker so no mempolicy can be assumed. Let's just simplify the code and use kvmalloc helper, which is a transparent way to use kmalloc with vmalloc fallback, if the caller is allowed to block and use the flag otherwise. Link: http://lkml.kernel.org/r/20170306103032.2540-4-mhocko@kernel.org Signed-off-by: Michal Hocko Acked-by: Vlastimil Babka Cc: Tom Herbert Cc: Eric Dumazet Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds lib/rhashtable.c | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-) commit 6c5ab6511f718c3fb19bcc3f78a90b0e0b601675 Author: Michal Hocko Date: Mon May 8 15:57:15 2017 -0700 mm: support __GFP_REPEAT in kvmalloc_node for >32kB vhost code uses __GFP_REPEAT when allocating vhost_virtqueue resp. vhost_vsock because it would really like to prefer kmalloc to the vmalloc fallback - see 23cc5a991c7a ("vhost-net: extend device allocation to vmalloc") for more context. Michael Tsirkin has also noted: "__GFP_REPEAT overhead is during allocation time. Using vmalloc means all accesses are slowed down. Allocation is not on data path, accesses are." The similar applies to other vhost_kvzalloc users. Let's teach kvmalloc_node to handle __GFP_REPEAT properly. There are two things to be careful about. First we should prevent from the OOM killer and so have to involve __GFP_NORETRY by default and secondly override __GFP_REPEAT for !costly order requests as the __GFP_REPEAT is ignored for !costly orders. Supporting __GFP_REPEAT like semantic for !costly request is possible it would require changes in the page allocator. This is out of scope of this patch. This patch shouldn't introduce any functional change. Link: http://lkml.kernel.org/r/20170306103032.2540-3-mhocko@kernel.org Signed-off-by: Michal Hocko Acked-by: Vlastimil Babka Acked-by: Michael S. Tsirkin Cc: David Miller Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/vhost/net.c | 9 +++------ drivers/vhost/vhost.c | 15 +++------------ drivers/vhost/vsock.c | 9 +++------ mm/util.c | 18 +++++++++++++++--- 4 files changed, 24 insertions(+), 27 deletions(-) commit 1f5307b1e094bfffa83c65c40ac6e3415c108780 Author: Michal Hocko Date: Mon May 8 15:57:12 2017 -0700 mm, vmalloc: properly track vmalloc users __vmalloc_node_flags used to be static inline but this has changed by "mm: introduce kv[mz]alloc helpers" because kvmalloc_node needs to use it as well and the code is outside of the vmalloc proper. I haven't realized that changing this will lead to a subtle bug though. The function is responsible to track the caller as well. This caller is then printed by /proc/vmallocinfo. If __vmalloc_node_flags is not inline then we would get only direct users of __vmalloc_node_flags as callers (e.g. v[mz]alloc) which reduces usefulness of this debugging feature considerably. It simply doesn't help to see that the given range belongs to vmalloc as a caller: 0xffffc90002c79000-0xffffc90002c7d000 16384 vmalloc+0x16/0x18 pages=3 vmalloc N0=3 0xffffc90002c81000-0xffffc90002c85000 16384 vmalloc+0x16/0x18 pages=3 vmalloc N1=3 0xffffc90002c8d000-0xffffc90002c91000 16384 vmalloc+0x16/0x18 pages=3 vmalloc N1=3 0xffffc90002c95000-0xffffc90002c99000 16384 vmalloc+0x16/0x18 pages=3 vmalloc N1=3 We really want to catch the _caller_ of the vmalloc function. Fix this issue by making __vmalloc_node_flags static inline again. Link: http://lkml.kernel.org/r/20170502134657.12381-1-mhocko@kernel.org Signed-off-by: Michal Hocko Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/vmalloc.h | 19 +++++++++++++++++++ mm/vmalloc.c | 12 +----------- 2 files changed, 20 insertions(+), 11 deletions(-) commit a7c3e901a46ff54c016d040847eda598a9e3e653 Author: Michal Hocko Date: Mon May 8 15:57:09 2017 -0700 mm: introduce kv[mz]alloc helpers Patch series "kvmalloc", v5. There are many open coded kmalloc with vmalloc fallback instances in the tree. Most of them are not careful enough or simply do not care about the underlying semantic of the kmalloc/page allocator which means that a) some vmalloc fallbacks are basically unreachable because the kmalloc part will keep retrying until it succeeds b) the page allocator can invoke a really disruptive steps like the OOM killer to move forward which doesn't sound appropriate when we consider that the vmalloc fallback is available. As it can be seen implementing kvmalloc requires quite an intimate knowledge if the page allocator and the memory reclaim internals which strongly suggests that a helper should be implemented in the memory subsystem proper. Most callers, I could find, have been converted to use the helper instead. This is patch 6. There are some more relying on __GFP_REPEAT in the networking stack which I have converted as well and Eric Dumazet was not opposed [2] to convert them as well. [1] http://lkml.kernel.org/r/20170130094940.13546-1-mhocko@kernel.org [2] http://lkml.kernel.org/r/1485273626.16328.301.camel@edumazet-glaptop3.roam.corp.google.com This patch (of 9): Using kmalloc with the vmalloc fallback for larger allocations is a common pattern in the kernel code. Yet we do not have any common helper for that and so users have invented their own helpers. Some of them are really creative when doing so. Let's just add kv[mz]alloc and make sure it is implemented properly. This implementation makes sure to not make a large memory pressure for > PAGE_SZE requests (__GFP_NORETRY) and also to not warn about allocation failures. This also rules out the OOM killer as the vmalloc is a more approapriate fallback than a disruptive user visible action. This patch also changes some existing users and removes helpers which are specific for them. In some cases this is not possible (e.g. ext4_kvmalloc, libcfs_kvzalloc) because those seems to be broken and require GFP_NO{FS,IO} context which is not vmalloc compatible in general (note that the page table allocation is GFP_KERNEL). Those need to be fixed separately. While we are at it, document that __vmalloc{_node} about unsupported gfp mask because there seems to be a lot of confusion out there. kvmalloc_node will warn about GFP_KERNEL incompatible (which are not superset) flags to catch new abusers. Existing ones would have to die slowly. [sfr@canb.auug.org.au: f2fs fixup] Link: http://lkml.kernel.org/r/20170320163735.332e64b7@canb.auug.org.au Link: http://lkml.kernel.org/r/20170306103032.2540-2-mhocko@kernel.org Signed-off-by: Michal Hocko Signed-off-by: Stephen Rothwell Reviewed-by: Andreas Dilger [ext4 part] Acked-by: Vlastimil Babka Cc: John Hubbard Cc: David Miller Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/x86/kvm/lapic.c | 4 ++-- arch/x86/kvm/page_track.c | 4 ++-- arch/x86/kvm/x86.c | 4 ++-- drivers/md/dm-stats.c | 7 +----- fs/ext4/mballoc.c | 2 +- fs/ext4/super.c | 4 ++-- fs/f2fs/f2fs.h | 20 ----------------- fs/f2fs/file.c | 4 ++-- fs/f2fs/node.c | 6 +++--- fs/f2fs/segment.c | 14 ++++++------ fs/seq_file.c | 16 +------------- include/linux/kvm_host.h | 2 -- include/linux/mm.h | 14 ++++++++++++ include/linux/vmalloc.h | 1 + ipc/util.c | 7 +----- mm/nommu.c | 5 +++++ mm/util.c | 45 +++++++++++++++++++++++++++++++++++++++ mm/vmalloc.c | 9 +++++++- security/apparmor/apparmorfs.c | 2 +- security/apparmor/include/lib.h | 11 ---------- security/apparmor/lib.c | 30 -------------------------- security/apparmor/match.c | 2 +- security/apparmor/policy_unpack.c | 2 +- virt/kvm/kvm_main.c | 18 +++------------- 24 files changed, 103 insertions(+), 130 deletions(-) commit 60f3e00d25b44e3aa51846590d1e10f408466a83 Author: Davidlohr Bueso Date: Mon May 8 15:57:06 2017 -0700 sysv,ipc: cacheline align kern_ipc_perm Assign 'struct kern_ipc_perm' its own cacheline to avoid false sharing with sysv ipc calls. While the structure itself is rather read-mostly throughout the lifespan of ipc, the spinlock causes most of the invalidations. One example is commit 31a7c4746e9 ("ipc/sem.c: cacheline align the ipc spinlock for semaphores"). Therefore, extend this to all ipc. The effect of cacheline alignment on sems can be seen in sembench, which deals mostly with semtimedop wait/wakes is seen to improve raw throughput (worker loops) between 8 to 12% on a 24-core x86 with over 4 threads. Link: http://lkml.kernel.org/r/1486673582-6979-4-git-send-email-dave@stgolabs.net Signed-off-by: Davidlohr Bueso Cc: Manfred Spraul Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/ipc.h | 7 +++---- include/linux/sem.h | 3 +-- 2 files changed, 4 insertions(+), 6 deletions(-) commit f0cb88026f51a0d8c952cf5e09e1933ef10b50b4 Author: Davidlohr Bueso Date: Mon May 8 15:57:03 2017 -0700 ipc/shm: some shmat cleanups Clean up early flag and address some minutia. Link: http://lkml.kernel.org/r/1486673582-6979-3-git-send-email-dave@stgolabs.net Signed-off-by: Davidlohr Bueso Cc: Manfred Spraul Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds ipc/shm.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) commit 046aa1265f08d8400bd4b63171238c9daba15ec3 Author: Arnd Bergmann Date: Mon May 8 15:57:00 2017 -0700 initramfs: use vfs_stat/lstat directly sys_newlstat is a system call implementation that is meant for user space, and that copies kernel-internal data structure to the user format, which is not needed for in-kernel users. Further, as we rearrange the system call implementation so we can extend it with 64-bit time_t, the prototype for sys_newlstat changes. This changes the initramfs code to use vfs_lstat directly, to get it out of the way of the time_t changes, and make it slightly more efficient in the process. Along the same lines we also replace sys_stat and sys_stat64 with vfs_stat. Link: http://lkml.kernel.org/r/20170314214932.4052842-1-arnd@arndb.de Signed-off-by: Arnd Bergmann Cc: Alexander Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds init/do_mounts.h | 22 ++++------------------ init/initramfs.c | 12 ++++++------ 2 files changed, 10 insertions(+), 24 deletions(-) commit cff75e0b6fe835800f8e08a32d731119cd9e3b79 Author: Daniel Thompson Date: Mon May 8 15:56:57 2017 -0700 initramfs: provide a way to ignore image provided by bootloader Many "embedded" architectures provide CMDLINE_FORCE to allow the kernel to override the command line provided by an inflexible bootloader. However there is currrently no way for the kernel to override the initramfs image provided by the bootloader meaning there are still ways for bootloaders to make things difficult for us. Fix this by introducing INITRAMFS_FORCE which can prevent the kernel from loading the bootloader supplied image. We use CMDLINE_FORCE (and its friend CMDLINE_EXTEND) to imply that the system has an inflexible bootloader. This allow us to avoid presenting this config option to users of systems where inflexible bootloaders aren't usually a problem. Link: http://lkml.kernel.org/r/20170217121940.30126-1-daniel.thompson@linaro.org Signed-off-by: Daniel Thompson Cc: Al Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds init/initramfs.c | 2 +- usr/Kconfig | 10 ++++++++++ 2 files changed, 11 insertions(+), 1 deletion(-) commit da5e108b0288d390dae40f51c09bbb30358bf7a7 Author: Guenter Roeck Date: Mon May 8 15:56:54 2017 -0700 lib/zlib_inflate/inftrees.c: fix potential buffer overflow smatch says: WARNING: please, no spaces at the start of a line #30: FILE: lib/zlib_inflate/inftrees.c:112: + for (min = 1; min < MAXBITS; min++)$ total: 0 errors, 1 warnings, 8 lines checked NOTE: For some of the reported defects, checkpatch may be able to mechanically convert to the typical style using --fix or --fix-inplace. ./patches/zlib-inflate-fix-potential-buffer-overflow.patch has style problems, please review. NOTE: If any of the errors are false positives, please report them to the maintainer, see CHECKPATCH in MAINTAINERS. Please run checkpatch prior to sending patches Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds lib/zlib_inflate/inftrees.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f2ad37da805414e9385e7ca2961e1d0431df3799 Author: Dmitry Vyukov Date: Mon May 8 15:56:51 2017 -0700 lib/fault-inject.c: use correct check for interrupts in_interrupt() also returns true when bh is disabled in task context. That's not what fail_task() wants to check. Use the new in_task() predicate that does the right thing. Link: http://lkml.kernel.org/r/20170321091805.140676-1-dvyukov@google.com Signed-off-by: Dmitry Vyukov Reviewed-by: Akinobu Mita Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds lib/fault-inject.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f61e869d519c0c11a8d80a503cfdfb4897df855a Author: Dmitry Vyukov Date: Mon May 8 15:56:48 2017 -0700 kcov: simplify interrupt check in_interrupt() semantics are confusing and wrong for most users as it also returns true when bh is disabled. Thus we open coded a proper check for interrupts in __sanitizer_cov_trace_pc() with a lengthy explanatory comment. Use the new in_task() predicate instead. Link: http://lkml.kernel.org/r/20170321091026.139655-1-dvyukov@google.com Signed-off-by: Dmitry Vyukov Cc: Kefeng Wang Cc: James Morse Cc: Alexander Popov Cc: Andrey Konovalov Cc: Hillf Danton Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/kcov.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) commit 8c733420bdd5a6cc2d8540fb5aa32d1fbf3cb3ff Author: Zhang Xiao Date: Mon May 8 15:56:45 2017 -0700 taskstats: add e/u/stime for TGID command The elapsed time, user CPU time and system CPU time for the thread group status request are presently left at zero. Fill these in. [akpm@linux-foundation.org: run ktime_get_ns() a single time] [akpm@linux-foundation.org: include linux/sched/cputime.h for task_cputime()] Link: http://lkml.kernel.org/r/1488508424-12322-1-git-send-email-xiao.zhang@windriver.com Signed-off-by: Zhang Xiao Cc: Balbir Singh Cc: Oleg Nesterov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/taskstats.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) commit eaa0d190bfe1ed891b814a52712dcd852554cb08 Author: Kirill Tkhai Date: Mon May 8 15:56:41 2017 -0700 pidns: expose task pid_ns_for_children to userspace pid_ns_for_children set by a task is known only to the task itself, and it's impossible to identify it from outside. It's a big problem for checkpoint/restore software like CRIU, because it can't correctly handle tasks, that do setns(CLONE_NEWPID) in proccess of their work. This patch solves the problem, and it exposes pid_ns_for_children to ns directory in standard way with the name "pid_for_children": ~# ls /proc/5531/ns -l | grep pid lrwxrwxrwx 1 root root 0 Jan 14 16:38 pid -> pid:[4026531836] lrwxrwxrwx 1 root root 0 Jan 14 16:38 pid_for_children -> pid:[4026532286] Link: http://lkml.kernel.org/r/149201123914.6007.2187327078064239572.stgit@localhost.localdomain Signed-off-by: Kirill Tkhai Cc: Andrei Vagin Cc: Andreas Gruenbacher Cc: Kees Cook Cc: Michael Kerrisk Cc: Al Viro Cc: Oleg Nesterov Cc: Paul Moore Cc: Eric Biederman Cc: Andy Lutomirski Cc: Ingo Molnar Cc: Serge Hallyn Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/proc/namespaces.c | 1 + include/linux/proc_ns.h | 1 + kernel/pid_namespace.c | 34 ++++++++++++++++++++++++++++++++++ 3 files changed, 36 insertions(+) commit 25b14e92af1a563c7331466ca59188f88050bbf0 Author: Kirill Tkhai Date: Mon May 8 15:56:38 2017 -0700 ns: allow ns_entries to have custom symlink content Patch series "Expose task pid_ns_for_children to userspace". pid_ns_for_children set by a task is known only to the task itself, and it's impossible to identify it from outside. It's a big problem for checkpoint/restore software like CRIU, because it can't correctly handle tasks, that do setns(CLONE_NEWPID) in proccess of their work. If they have a custom pid_ns_for_children before dump, they must have the same ns after restore. Otherwise, restored task bumped into enviroment it does not expect. This patchset solves the problem. It exposes pid_ns_for_children to ns directory in standard way with the name "pid_for_children": ~# ls /proc/5531/ns -l | grep pid lrwxrwxrwx 1 root root 0 Jan 14 16:38 pid -> pid:[4026531836] lrwxrwxrwx 1 root root 0 Jan 14 16:38 pid_for_children -> pid:[4026532286] This patch (of 2): Make possible to have link content prefix yyy different from the link name xxx: $ readlink /proc/[pid]/ns/xxx yyy:[4026531838] This will be used in next patch. Link: http://lkml.kernel.org/r/149201120318.6007.7362655181033883000.stgit@localhost.localdomain Signed-off-by: Kirill Tkhai Reviewed-by: Cyrill Gorcunov Acked-by: Andrei Vagin Cc: Andreas Gruenbacher Cc: Kees Cook Cc: Michael Kerrisk Cc: Al Viro Cc: Oleg Nesterov Cc: Paul Moore Cc: Eric Biederman Cc: Andy Lutomirski Cc: Ingo Molnar Cc: Serge Hallyn Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/nsfs.c | 4 +++- include/linux/proc_ns.h | 1 + 2 files changed, 4 insertions(+), 1 deletion(-) commit 8896c23d2ef803f1883fea73117a435925c2b4c4 Author: Kirill Tkhai Date: Mon May 8 15:56:34 2017 -0700 pidns: disable pid allocation if pid_ns_prepare_proc() is failed in alloc_pid() alloc_pidmap() advances pid_namespace::last_pid. When first pid allocation fails, then next created process will have pid 2 and pid_ns_prepare_proc() won't be called. So, pid_namespace::proc_mnt will never be initialized (not to mention that there won't be a child reaper). I saw crash stack of such case on kernel 3.10: BUG: unable to handle kernel NULL pointer dereference at (null) IP: proc_flush_task+0x8f/0x1b0 Call Trace: release_task+0x3f/0x490 wait_consider_task.part.10+0x7ff/0xb00 do_wait+0x11f/0x280 SyS_wait4+0x7d/0x110 We may fix this by restore of last_pid in 0 or by prohibiting of futher allocations. Since there was a similar issue in Oleg Nesterov's commit 314a8ad0f18a ("pidns: fix free_pid() to handle the first fork failure"). and it was fixed via prohibiting allocation, let's follow this way, and do the same. Link: http://lkml.kernel.org/r/149201021004.4863.6762095011554287922.stgit@localhost.localdomain Signed-off-by: Kirill Tkhai Acked-by: Cyrill Gorcunov Cc: Andrei Vagin Cc: Andreas Gruenbacher Cc: Kees Cook Cc: Michael Kerrisk Cc: Al Viro Cc: Oleg Nesterov Cc: Paul Moore Cc: Eric Biederman Cc: Andy Lutomirski Cc: Ingo Molnar Cc: Serge Hallyn Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/pid.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 92019efc6cf2126edc482342446f1252d091081a Author: Hari Bathini Date: Mon May 8 15:56:31 2017 -0700 powerpc/fadump: update documentation about crashkernel parameter reuse As we are reusing crashkernel parameter instead of fadump_reserve_mem parameter to specify the memory to reserve for fadump's crash kernel, update the documentation accordingly. Link: http://lkml.kernel.org/r/149035347559.6881.14224829694291758581.stgit@hbathini.in.ibm.com Signed-off-by: Hari Bathini Acked-by: Michael Ellerman Cc: Fenghua Yu Cc: Tony Luck Cc: Dave Young Cc: Eric Biederman Cc: Mahesh Salgaonkar Cc: Vivek Goyal Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Documentation/powerpc/firmware-assisted-dump.txt | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) commit 11550dc0a00b793236e8dedcf1f489f4627ddf7e Author: Hari Bathini Date: Mon May 8 15:56:28 2017 -0700 powerpc/fadump: reuse crashkernel parameter for fadump memory reservation fadump supports specifying memory to reserve for fadump's crash kernel with fadump_reserve_mem kernel parameter. This parameter currently supports passing a fixed memory size, like fadump_reserve_mem= only. This patch aims to add support for other syntaxes like range-based memory size :[,:,:,...] which allows using the same parameter to boot the kernel with different system RAM sizes. As crashkernel parameter already supports the above mentioned syntaxes, this patch deprecates fadump_reserve_mem parameter and reuses crashkernel parameter instead, to specify memory for fadump's crash kernel memory reservation as well. If any offset is provided in crashkernel parameter, it will be ignored in case of fadump, as fadump reserves memory at end of RAM. Advantages using crashkernel parameter instead of fadump_reserve_mem parameter are one less kernel parameter overall, code reuse and support for multiple syntaxes to specify memory. Suggested-by: Dave Young Link: http://lkml.kernel.org/r/149035346749.6881.911095631212975718.stgit@hbathini.in.ibm.com Signed-off-by: Hari Bathini Reviewed-by: Mahesh Salgaonkar Acked-by: Michael Ellerman Cc: Fenghua Yu Cc: Tony Luck Cc: Dave Young Cc: Eric Biederman Cc: Vivek Goyal Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/powerpc/kernel/fadump.c | 23 ++++++++++------------- 1 file changed, 10 insertions(+), 13 deletions(-) commit 22bd0177bd08677a8888f4d1d8361b0326f9119b Author: Hari Bathini Date: Mon May 8 15:56:24 2017 -0700 powerpc/fadump: remove dependency with CONFIG_KEXEC Now that crashkernel parameter parsing and vmcoreinfo related code is moved under CONFIG_CRASH_CORE instead of CONFIG_KEXEC_CORE, remove dependency with CONFIG_KEXEC for CONFIG_FA_DUMP. While here, get rid of definitions of fadump_append_elf_note() & fadump_final_note() functions to reuse similar functions compiled under CONFIG_CRASH_CORE. Link: http://lkml.kernel.org/r/149035343956.6881.1536459326017709354.stgit@hbathini.in.ibm.com Signed-off-by: Hari Bathini Reviewed-by: Mahesh Salgaonkar Acked-by: Michael Ellerman Cc: Fenghua Yu Cc: Tony Luck Cc: Dave Young Cc: Eric Biederman Cc: Vivek Goyal Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/powerpc/Kconfig | 10 ++++++---- arch/powerpc/include/asm/fadump.h | 2 ++ arch/powerpc/kernel/crash.c | 2 -- arch/powerpc/kernel/fadump.c | 34 +++------------------------------- arch/powerpc/kernel/setup-common.c | 5 +++++ 5 files changed, 16 insertions(+), 37 deletions(-) commit 51dbd92520d4344fef78481b1bcbc3a7de32b69b Author: Hari Bathini Date: Mon May 8 15:56:21 2017 -0700 ia64: reuse append_elf_note() and final_note() functions Get rid of multiple definitions of append_elf_note() & final_note() functions. Reuse these functions compiled under CONFIG_CRASH_CORE Also, define Elf_Word and use it instead of generic u32 or the more specific Elf64_Word. Link: http://lkml.kernel.org/r/149035342324.6881.11667840929850361402.stgit@hbathini.in.ibm.com Signed-off-by: Hari Bathini Acked-by: Dave Young Acked-by: Tony Luck Cc: Fenghua Yu Cc: Eric Biederman Cc: Mahesh Salgaonkar Cc: Vivek Goyal Cc: Michael Ellerman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/ia64/kernel/crash.c | 22 ---------------------- include/linux/crash_core.h | 4 ++++ include/linux/elf.h | 2 ++ kernel/crash_core.c | 34 ++++++++++++++-------------------- kernel/kexec_core.c | 28 ---------------------------- 5 files changed, 20 insertions(+), 70 deletions(-) commit 692f66f26a4c19d73249736aa973c13a1521b387 Author: Hari Bathini Date: Mon May 8 15:56:18 2017 -0700 crash: move crashkernel parsing and vmcore related code under CONFIG_CRASH_CORE Patch series "kexec/fadump: remove dependency with CONFIG_KEXEC and reuse crashkernel parameter for fadump", v4. Traditionally, kdump is used to save vmcore in case of a crash. Some architectures like powerpc can save vmcore using architecture specific support instead of kexec/kdump mechanism. Such architecture specific support also needs to reserve memory, to be used by dump capture kernel. crashkernel parameter can be a reused, for memory reservation, by such architecture specific infrastructure. This patchset removes dependency with CONFIG_KEXEC for crashkernel parameter and vmcoreinfo related code as it can be reused without kexec support. Also, crashkernel parameter is reused instead of fadump_reserve_mem to reserve memory for fadump. The first patch moves crashkernel parameter parsing and vmcoreinfo related code under CONFIG_CRASH_CORE instead of CONFIG_KEXEC_CORE. The second patch reuses the definitions of append_elf_note() & final_note() functions under CONFIG_CRASH_CORE in IA64 arch code. The third patch removes dependency on CONFIG_KEXEC for firmware-assisted dump (fadump) in powerpc. The next patch reuses crashkernel parameter for reserving memory for fadump, instead of the fadump_reserve_mem parameter. This has the advantage of using all syntaxes crashkernel parameter supports, for fadump as well. The last patch updates fadump kernel documentation about use of crashkernel parameter. This patch (of 5): Traditionally, kdump is used to save vmcore in case of a crash. Some architectures like powerpc can save vmcore using architecture specific support instead of kexec/kdump mechanism. Such architecture specific support also needs to reserve memory, to be used by dump capture kernel. crashkernel parameter can be a reused, for memory reservation, by such architecture specific infrastructure. But currently, code related to vmcoreinfo and parsing of crashkernel parameter is built under CONFIG_KEXEC_CORE. This patch introduces CONFIG_CRASH_CORE and moves the above mentioned code under this config, allowing code reuse without dependency on CONFIG_KEXEC. There is no functional change with this patch. Link: http://lkml.kernel.org/r/149035338104.6881.4550894432615189948.stgit@hbathini.in.ibm.com Signed-off-by: Hari Bathini Acked-by: Dave Young Cc: Fenghua Yu Cc: Tony Luck Cc: Eric Biederman Cc: Mahesh Salgaonkar Cc: Vivek Goyal Cc: Michael Ellerman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/Kconfig | 4 + include/linux/crash_core.h | 65 +++++++ include/linux/kexec.h | 57 +----- include/linux/printk.h | 4 +- kernel/Makefile | 1 + kernel/crash_core.c | 445 +++++++++++++++++++++++++++++++++++++++++++++ kernel/kexec_core.c | 403 ---------------------------------------- kernel/ksysfs.c | 8 +- kernel/printk/printk.c | 6 +- 9 files changed, 531 insertions(+), 462 deletions(-) commit c311c797998c1e70eade463dd60b843da4f1a203 Author: Alexey Dobriyan Date: Mon May 8 15:56:15 2017 -0700 cpumask: make "nr_cpumask_bits" unsigned Bit searching functions accept "unsigned long" indices but "nr_cpumask_bits" is "int" which is signed, so inevitable sign extensions occur on x86_64. Those MOVSX are #1 MOVSX bloat by number of uses across whole kernel. Change "nr_cpumask_bits" to unsigned, this number can't be negative after all. It allows to do implicit zero-extension on x86_64 without MOVSX. Change signed comparisons into unsigned comparisons where necessary. Other uses looks fine because it is either argument passed to a function or comparison is already unsigned. Net win on allyesconfig type of kernel: ~2.8 KB (!) add/remove: 0/0 grow/shrink: 8/725 up/down: 93/-2926 (-2833) function old new delta xen_exit_mmap 691 735 +44 qstat_read 426 440 +14 __cpufreq_cooling_register 1678 1687 +9 trace_rb_cpu_prepare 447 455 +8 vermagic 54 60 +6 nfp_driver_version 54 60 +6 rcu_torture_stats_print 1147 1151 +4 find_next_push_cpu 267 269 +2 xen_irq_resume 961 960 -1 ... init_vp_index 946 906 -40 od_set_powersave_bias 328 281 -47 power_cpu_exit 193 139 -54 arch_show_interrupts 3538 3484 -54 select_idle_sibling 1558 1471 -87 Total: Before=158358910, After=158356077, chg -0.00% Same arguments apply to "nr_cpu_ids" but I haven't yet found enough courage to delve into this issue (and proper fix may require new type "cpu_t" which is whole separate story). Link: http://lkml.kernel.org/r/20170309205322.GA1728@avx2 Signed-off-by: Alexey Dobriyan Cc: Rusty Russell Cc: Heiko Carstens Cc: Martin Schwidefsky Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/mips/kernel/perf_event_mipsxx.c | 2 +- arch/s390/kernel/perf_cpum_sf.c | 2 +- include/linux/cpumask.h | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) commit 19659c59af52df22d1b85208a2c37b2d46290541 Author: Hoeun Ryu Date: Mon May 8 15:56:11 2017 -0700 fork: free vmapped stacks in cache when cpus are offline Using virtually mapped stack, kernel stacks are allocated via vmalloc. In the current implementation, two stacks per cpu can be cached when tasks are freed and the cached stacks are used again in task duplications. But the cached stacks may remain unfreed even when cpu are offline. By adding a cpu hotplug callback to free the cached stacks when a cpu goes offline, the pages of the cached stacks are not wasted. Link: http://lkml.kernel.org/r/1487076043-17802-1-git-send-email-hoeun.ryu@gmail.com Signed-off-by: Hoeun Ryu Reviewed-by: Thomas Gleixner Acked-by: Michal Hocko Cc: Ingo Molnar Cc: Andy Lutomirski Cc: Kees Cook Cc: "Eric W. Biederman" Cc: Oleg Nesterov Cc: Mateusz Guzik Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/fork.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) commit 7fe6a42e87ef20edd7faf1b2f4bf18d95922d1e4 Author: Kees Cook Date: Mon May 8 15:56:08 2017 -0700 reiserfs: use designated initializers Prepare to mark sensitive kernel structures for randomization by making sure they're using designated initializers. These were identified during allyesconfig builds of x86, arm, and arm64, with most initializer fixes extracted from grsecurity. Link: http://lkml.kernel.org/r/20170329210419.GA40066@beast Signed-off-by: Kees Cook Cc: Jan Kara Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/reiserfs/item_ops.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) commit f6950a735f29e782bc219ece22bb91d6e1ab7bbc Author: Joe Perches Date: Mon May 8 15:56:05 2017 -0700 checkpatch: improve the SUSPECT_CODE_INDENT test The current SUSPECT_CODE_INDENT test does not recognize several defective code style defects where code following a logical test is inappropriately indented. Before this patch, for code like: if (foo) bar(); checkpatch would not emit a warning. Improve the test to warn when code after a logical test has the same indentation as the logical test. Perform the same indentation test for "else" blocks too. Link: http://lkml.kernel.org/r/df2374b68c4a68af2b7ef08afe486584811f610a.1493683942.git.joe@perches.com Signed-off-by: Joe Perches Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds scripts/checkpatch.pl | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 74fd4f347bfc10c1b19a18d0760f220eed1b2023 Author: Joe Perches Date: Mon May 8 15:56:02 2017 -0700 checkpatch: improve the embedded function name test for patch contexts The current test works only for a single patch context as it is done in the foreach ($rawlines) loop that precedes the loop where the actual $context_function variable is used. Move the set of $context_function into the foreach (@lines) loop where it is useful for each patch context. Link: http://lkml.kernel.org/r/6c675a31c74fbfad4fc45b9f462303d60ca2a283.1493486091.git.joe@perches.com Signed-off-by: Joe Perches Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds scripts/checkpatch.pl | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) commit 75ad8c575a5ad105e2afc2051c68abceb9c65431 Author: Jerome Forissier Date: Mon May 8 15:56:00 2017 -0700 checkpatch: add --typedefsfile When using checkpatch on out-of-tree code, it may occur that some project-specific types are used, which will cause spurious warnings. Add the --typedefsfile option as a way to extend the known types and deal with this issue. This was developed for OP-TEE [1]. We run a Travis job on all pull requests [2], and checkpatch is part of that. The typical false warning we get on a regular basis is with some pointers to functions returning TEE_Result [3], which is a typedef from the GlobalPlatform APIs. We consider it is acceptable to use GP types in the OP-TEE core implementation, that's why this patch would be helpful for us. [1] https://github.com/OP-TEE/optee_os [2] https://travis-ci.org/OP-TEE/optee_os/builds [3] https://travis-ci.org/OP-TEE/optee_os/builds/193355335#L1733 Link: http://lkml.kernel.org/r/ba1124d6dfa599bb0dd1d8919dd45dd09ce541a4.1492702192.git.jerome.forissier@linaro.org Signed-off-by: Jerome Forissier Cc: Joe Perches Cc: Andy Whitcroft Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds scripts/checkpatch.pl | 52 ++++++++++++++++++++++++++++++++++----------------- 1 file changed, 35 insertions(+), 17 deletions(-) commit 1b4a2ed4c8773524cc7890c4cd57d58b39c049eb Author: Joe Perches Date: Mon May 8 15:55:57 2017 -0700 checkpatch: improve k.alloc with multiplication and sizeof test Find multi-line uses of k.alloc by using the $stat variable and not the $line variable. This can still --fix only the single line variant though. Link: http://lkml.kernel.org/r/3f4b23d37cd4c7d8628eefc25afe83ba8fb3ab55.1493167076.git.joe@perches.com Signed-off-by: Joe Perches Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds scripts/checkpatch.pl | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) commit e882dbfc248cf28d6afd6fc6d8db8be58a824158 Author: Wei Wang Date: Mon May 8 15:55:54 2017 -0700 checkpatch: special audit for revert commit line Currently checkpatch.pl does not recognize git's default commit revert message and will complain about the hash format. Add special audit for revert commit message line to fix it. Link: http://lkml.kernel.org/r/20170411191532.74381-1-wvw@google.com Signed-off-by: Wei Wang Acked-by: Joe Perches Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds scripts/checkpatch.pl | 1 + 1 file changed, 1 insertion(+) commit e4b7d3091def85336d838e38dea91be37bd4d1f5 Author: Joe Perches Date: Mon May 8 15:55:51 2017 -0700 checkpatch: clarify the EMBEDDED_FUNCTION_NAME message Try to make the conversion of embedded function names to "%s: ", __func__ a bit clearer. Add a bit more information to the comment describing the test too. Link: http://lkml.kernel.org/r/38f5d32f0aec1cd98cb9ceeedd6a736cc9a802db.1491759835.git.joe@perches.com Signed-off-by: Joe Perches Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds scripts/checkpatch.pl | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) commit e795556a581a849bf33b22521bf8ebc97ab899ea Author: Joe Perches Date: Mon May 8 15:55:48 2017 -0700 checkpatch: improve MULTISTATEMENT_MACRO_USE_DO_WHILE test The logic currrently misses macros that start with an if statement. e.g.: #define foo(bar) if (bar) baz; Add a test for macro content that starts with if Link: http://lkml.kernel.org/r/a9d41aafe1673889caf1a9850208fb7fd74107a0.1491783914.git.joe@perches.com Signed-off-by: Joe Perches Reported-by: Andreas Mohr Original-patch-by: Alfonso Lima Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds scripts/checkpatch.pl | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit d9190e4e1a057ad55027cbefd1d21f6eae93fe0e Author: Joe Perches Date: Mon May 8 15:55:45 2017 -0700 checkpatch: avoid suggesting struct definitions should be const Many structs are generally used const and there is a known list of these structs. struct definitions should not be generally be declared const. Add a test for the lack of an open brace immediately after the struct to avoid definitions. This avoids the false positive "struct foo should normally be const" message only when the open brace is on the same line as the definition. Link: http://lkml.kernel.org/r/0dce709150d712e66f1b90b03827634b53b28085.1491845946.git.joe@perches.com Signed-off-by: Joe Perches Cc: Arthur Brainville Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds scripts/checkpatch.pl | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit eb3a58de3ec4940fc6b2a9f810895d772a2a9794 Author: Joe Perches Date: Mon May 8 15:55:42 2017 -0700 checkpatch: allow space leading blank lines in email headers Allow a leading space and otherwise blank link in the email headers as it can be a line wrapped Spamassassin multiple line string or any other valid rfc 2822/5322 email header. The line with space causes checkpatch to erroneously think that it's in the content body, as opposed to headers and thus flag a mail header as an unwrapped long comment line. Link: http://lkml.kernel.org/r/d75a9f0b78b3488078429f4037d9fff3bdfa3b78.1490247180.git.joe@perches.com Signed-off-by: Joe Perches Reported-by: Darren Hart (VMware) Tested-by: Darren Hart (VMware) Reviewed-by: Darren Hart (VMware) Original-patch-by: John 'Warthog9' Hawley (VMware) Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds scripts/checkpatch.pl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 4dbed76f2429516b9519620dacdda6c750640e8d Author: Joe Perches Date: Mon May 8 15:55:39 2017 -0700 checkpatch: improve EMBEDDED_FUNCTION_NAME test The existing behavior relies on patch context to identify function declarations. Add the ability to find function declarations when there is an open brace in column 1. This finds function declarations only in specific single line forms where the function name is on a single line like: int foo(args...) { and int foo(args...) { It does not recognize function declarations like: int foo(int bar, int baz) { Link: http://lkml.kernel.org/r/738d74bbbe1a06b80f11ed504818107c68903095.1488155636.git.joe@perches.com Signed-off-by: Joe Perches Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds scripts/checkpatch.pl | 11 +++++++++++ 1 file changed, 11 insertions(+) commit 0b523769ebb9473c60df1b0f70615aa82ebac2c9 Author: Joe Perches Date: Mon May 8 15:55:36 2017 -0700 checkpatch: add ability to find bad uses of vsprintf %p extensions %pK was at least once misused at %pk in an out-of-tree module. This lead to some security concerns. Add the ability to track single and multiple line statements for misuses of %p. [akpm@linux-foundation.org: add helpful comment into lib/vsprintf.c] [akpm@linux-foundation.org: text tweak] Link: http://lkml.kernel.org/r/163a690510e636a23187c0dc9caa09ddac6d4cde.1488228427.git.joe@perches.com Signed-off-by: Joe Perches Acked-by: Kees Cook Acked-by: William Roberts Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds lib/vsprintf.c | 3 +++ scripts/checkpatch.pl | 26 ++++++++++++++++++++++++++ 2 files changed, 29 insertions(+) commit cd8618ab3df3ac6018cecb9dc626ff72c39eb503 Author: Ruslan Bilovol Date: Mon May 8 15:55:33 2017 -0700 checkpatch: remove obsolete CONFIG_EXPERIMENTAL checks Config EXPERIMENTAL has been removed from kernel in 2013 (see commit 3d374d09f16f: "final removal of CONFIG_EXPERIMENTAL"), there is no any reason to do these checks now. Link: http://lkml.kernel.org/r/1488234097-20119-1-git-send-email-ruslan.bilovol@gmail.com Signed-off-by: Ruslan Bilovol Acked-by: Kees Cook Acked-by: Joe Perches Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds scripts/checkpatch.pl | 13 ------------- 1 file changed, 13 deletions(-) commit 0cd5246bf8e61bb1f61a4bd1203573f8a9adf085 Author: Luis R. Rodriguez Date: Mon May 8 15:55:30 2017 -0700 firmware/Makefile: force recompilation if makefile changes If you modify the target asm we currently do not force the recompilation of the firmware files. The target asm is in the firmware/Makefile, peg this file as a dependency to require re-compilation of firmware targets when the asm changes. Link: http://lkml.kernel.org/r/20170123150727.4883-1-mcgrof@kernel.org Signed-off-by: Luis R. Rodriguez Cc: Masahiro Yamada Cc: Michal Marek Cc: Ming Lei Cc: Greg Kroah-Hartman Cc: Tom Gundersen Cc: David Woodhouse Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds firmware/Makefile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit e327fd7c86678ba22d2b7cd25f6ceef1ffe29c8a Author: Geert Uytterhoeven Date: Mon May 8 15:55:26 2017 -0700 lib: add module support to linked list sorting tests Extract the linked list sorting test code into its own source file, to allow to compile it either to a loadable module, or builtin into the kernel. Link: http://lkml.kernel.org/r/1488287219-15832-4-git-send-email-geert@linux-m68k.org Signed-off-by: Geert Uytterhoeven Reviewed-by: Andy Shevchenko Cc: Arnd Bergmann Cc: Paul Gortmaker Cc: Shuah Khan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds lib/Kconfig.debug | 7 +-- lib/Makefile | 1 + lib/list_sort.c | 149 -------------------------------------------------- lib/test_list_sort.c | 150 +++++++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 155 insertions(+), 152 deletions(-) commit 5c4e679898eabca844059743c05253cf33b90e94 Author: Geert Uytterhoeven Date: Mon May 8 15:55:23 2017 -0700 lib: add module support to array-based sort tests Allow to compile the array-based sort test code either to a loadable module, or builtin into the kernel. Link: http://lkml.kernel.org/r/1488287219-15832-3-git-send-email-geert@linux-m68k.org Signed-off-by: Geert Uytterhoeven Reviewed-by: Andy Shevchenko Cc: Arnd Bergmann Cc: Paul Gortmaker Cc: Shuah Khan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds lib/Kconfig.debug | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit ebd03a9aacc7d47a9d5dc7ed63adf594f9a0391c Author: Geert Uytterhoeven Date: Mon May 8 15:55:20 2017 -0700 Revert "lib/test_sort.c: make it explicitly non-modular" Patch series "lib: add module support to sort tests". This patch series allows to compile the array-based and linked list sort test code either to loadable modules, or builtin into the kernel. It's very valuable to have modular tests, so you can run them just by insmodding the test modules, instead of needing a separate kernel that runs them at boot. This patch (of 3): This reverts commit 8893f519330bb073a49c5b4676fce4be6f1be15d. It's very valuable to have modular tests, so you can run them just by insmodding the test modules, instead of needing a separate kernel that runs them at boot. Link: http://lkml.kernel.org/r/1488287219-15832-2-git-send-email-geert@linux-m68k.org Signed-off-by: Geert Uytterhoeven Reviewed-by: Andy Shevchenko Cc: Arnd Bergmann Cc: Paul Gortmaker Cc: Shuah Khan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds lib/test_sort.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) commit 8128a31eaadbcdfa37774bbd28f3f00bac69996a Author: Dan Carpenter Date: Mon May 8 15:55:17 2017 -0700 drivers/misc/c2port/c2port-duramar2150.c: checking for NULL instead of IS_ERR() c2port_device_register() never returns NULL, it uses error pointers. Link: http://lkml.kernel.org/r/20170412083321.GC3250@mwanda Fixes: 65131cd52b9e ("c2port: add c2port support for Eurotech Duramar 2150") Signed-off-by: Dan Carpenter Acked-by: Rodolfo Giometti Cc: Greg Kroah-Hartman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/misc/c2port/c2port-duramar2150.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 146180c052a00172f4dc08eaade836fd02f61fb5 Author: Dan Carpenter Date: Mon May 8 15:55:14 2017 -0700 drivers/misc/vmw_vmci/vmci_queue_pair.c: fix a couple integer overflow tests The "DIV_ROUND_UP(size, PAGE_SIZE)" operation can overflow if "size" is more than ULLONG_MAX - PAGE_SIZE. Link: http://lkml.kernel.org/r/20170322111950.GA11279@mwanda Signed-off-by: Dan Carpenter Cc: Jorgen Hansen Cc: Masahiro Yamada Cc: Michal Hocko Cc: Greg Kroah-Hartman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/misc/vmw_vmci/vmci_queue_pair.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) commit 780cbcf28781511d2cb235c375127265209796a8 Author: Tetsuo Handa Date: Mon May 8 15:55:11 2017 -0700 kernel/hung_task.c: defer showing held locks When I was running my testcase which may block hundreds of threads on fs locks, I got lockup due to output from debug_show_all_locks() added by commit b2d4c2edb2e4 ("locking/hung_task: Show all locks"). For example, if 1000 threads were blocked in TASK_UNINTERRUPTIBLE state and 500 out of 1000 threads hold some lock, debug_show_all_locks() from for_each_process_thread() loop will report locks held by 500 threads for 1000 times. This is a too much noise. In order to make sure rcu_lock_break() is called frequently, we should avoid calling debug_show_all_locks() from for_each_process_thread() loop because debug_show_all_locks() effectively calls for_each_process_thread() loop. Let's defer calling debug_show_all_locks() till before panic() or leaving for_each_process_thread() loop. Link: http://lkml.kernel.org/r/1489296834-60436-1-git-send-email-penguin-kernel@I-love.SAKURA.ne.jp Signed-off-by: Tetsuo Handa Reviewed-by: Vegard Nossum Cc: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/hung_task.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 31b8cc80776c1b5a17abda6e0bbb5c615b9d90e4 Author: Randy Dunlap Date: Mon May 8 15:55:08 2017 -0700 make help: add tools help target Add a top-level Makefile help target for Userspace tools. Also make each help "heading" end with a colon ':'. Link: http://lkml.kernel.org/r/55c986ff-3966-3e47-2984-7349da2cce51@infradead.org Signed-off-by: Randy Dunlap Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Makefile | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 7c30f352c852bae2715ad65ac4a38ca9af7d7696 Author: Matthias Kaehlcke Date: Mon May 8 15:55:05 2017 -0700 jiffies.h: declare jiffies and jiffies_64 with ____cacheline_aligned_in_smp jiffies_64 is defined in kernel/time/timer.c with ____cacheline_aligned_in_smp, however this macro is not part of the declaration of jiffies and jiffies_64 in jiffies.h. As a result clang generates the following warning: kernel/time/timer.c:57:26: error: section does not match previous declaration [-Werror,-Wsection] __visible u64 jiffies_64 __cacheline_aligned_in_smp = INITIAL_JIFFIES; ^ include/linux/cache.h:39:36: note: expanded from macro '__cacheline_aligned_in_smp' ^ include/linux/cache.h:34:4: note: expanded from macro '__cacheline_aligned' __section__(".data..cacheline_aligned"))) ^ include/linux/jiffies.h:77:12: note: previous attribute is here extern u64 __jiffy_data jiffies_64; ^ include/linux/jiffies.h:70:38: note: expanded from macro '__jiffy_data' Link: http://lkml.kernel.org/r/20170403190200.70273-1-mka@chromium.org Signed-off-by: Matthias Kaehlcke Cc: "Jason A . Donenfeld" Cc: Grant Grundler Cc: Michael Davidson Cc: Greg Hackmann Cc: Thomas Gleixner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/jiffies.h | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) commit 3d88936f35bc67f7bee2efd4eec69baf26c17a5a Author: Lorenzo Stoakes Date: Mon May 8 15:55:02 2017 -0700 drivers/virt/fsl_hypervisor.c: use get_user_pages_unlocked() Moving from get_user_pages() to get_user_pages_unlocked() simplifies the code and takes advantage of VM_FAULT_RETRY functionality when faulting in pages. Link: http://lkml.kernel.org/r/20161101194332.23961-1-lstoakes@gmail.com Signed-off-by: Lorenzo Stoakes Cc: Michal Hocko Cc: Paolo Bonzini Cc: Kumar Gala Cc: Mihai Caraman Cc: Greg KH Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/virt/fsl_hypervisor.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) commit 63259457a2eea54cc3b3a284b4bc7da52398a19a Author: Gao Feng Date: Mon May 8 15:54:58 2017 -0700 proc/sysctl: fix the int overflow for jiffies conversion do_proc_dointvec_jiffies_conv() uses LONG_MAX/HZ as the max value to avoid overflow. But actually the *valp is int type, so it still causes overflow. For example, echo 2147483647 > ./sys/net/ipv4/tcp_keepalive_time Then, cat ./sys/net/ipv4/tcp_keepalive_time The output is "-1", it is not expected. Now use INT_MAX/HZ as the max value instead LONG_MAX/HZ to fix it. Link: http://lkml.kernel.org/r/1490109532-9228-1-git-send-email-fgao@ikuai8.com Signed-off-by: Gao Feng Cc: Arnaldo Carvalho de Melo Cc: Ingo Molnar Cc: Alexey Dobriyan Cc: Eric Dumazet Cc: Josh Poimboeuf Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/sysctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f245e1c17a702964ad552878d01a10e53cf0e8e5 Author: Tobin C. Harding Date: Mon May 8 15:54:55 2017 -0700 fs/proc/inode.c: remove cast from memory allocation Coccinelle emits this warning: WARNING: casting value returned by memory allocation function to (struct proc_inode *) is useless. Remove unnecessary cast. Link: http://lkml.kernel.org/r/1487745720-16967-1-git-send-email-me@tobin.cc Signed-off-by: Tobin C. Harding Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/proc/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit baf6a9a1db5a40ebfa5d3e761428d3deb2cc3a3b Author: Vlastimil Babka Date: Mon May 8 15:54:52 2017 -0700 mm, compaction: finish whole pageblock to reduce fragmentation The main goal of direct compaction is to form a high-order page for allocation, but it should also help against long-term fragmentation when possible. Most lower-than-pageblock-order compactions are for non-movable allocations, which means that if we compact in a movable pageblock and terminate as soon as we create the high-order page, it's unlikely that the fallback heuristics will claim the whole block. Instead there might be a single unmovable page in a pageblock full of movable pages, and the next unmovable allocation might pick another pageblock and increase long-term fragmentation. To help against such scenarios, this patch changes the termination criteria for compaction so that the current pageblock is finished even though the high-order page already exists. Note that it might be possible that the high-order page formed elsewhere in the zone due to parallel activity, but this patch doesn't try to detect that. This is only done with sync compaction, because async compaction is limited to pageblock of the same migratetype, where it cannot result in a migratetype fallback. (Async compaction also eagerly skips order-aligned blocks where isolation fails, which is against the goal of migrating away as much of the pageblock as possible.) As a result of this patch, long-term memory fragmentation should be reduced. In testing based on 4.9 kernel with stress-highalloc from mmtests configured for order-4 GFP_KERNEL allocations, this patch has reduced the number of unmovable allocations falling back to movable pageblocks by 20%. The number Link: http://lkml.kernel.org/r/20170307131545.28577-9-vbabka@suse.cz Signed-off-by: Vlastimil Babka Acked-by: Mel Gorman Acked-by: Johannes Weiner Cc: Joonsoo Kim Cc: David Rientjes Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/compaction.c | 36 ++++++++++++++++++++++++++++++++++-- mm/internal.h | 1 + 2 files changed, 35 insertions(+), 2 deletions(-) commit 282722b0d258ec23fc79d80165418fee83f01736 Author: Vlastimil Babka Date: Mon May 8 15:54:49 2017 -0700 mm, compaction: restrict async compaction to pageblocks of same migratetype The migrate scanner in async compaction is currently limited to MIGRATE_MOVABLE pageblocks. This is a heuristic intended to reduce latency, based on the assumption that non-MOVABLE pageblocks are unlikely to contain movable pages. However, with the exception of THP's, most high-order allocations are not movable. Should the async compaction succeed, this increases the chance that the non-MOVABLE allocations will fallback to a MOVABLE pageblock, making the long-term fragmentation worse. This patch attempts to help the situation by changing async direct compaction so that the migrate scanner only scans the pageblocks of the requested migratetype. If it's a non-MOVABLE type and there are such pageblocks that do contain movable pages, chances are that the allocation can succeed within one of such pageblocks, removing the need for a fallback. If that fails, the subsequent sync attempt will ignore this restriction. In testing based on 4.9 kernel with stress-highalloc from mmtests configured for order-4 GFP_KERNEL allocations, this patch has reduced the number of unmovable allocations falling back to movable pageblocks by 30%. The number of movable allocations falling back is reduced by 12%. Link: http://lkml.kernel.org/r/20170307131545.28577-8-vbabka@suse.cz Signed-off-by: Vlastimil Babka Cc: Mel Gorman Cc: Johannes Weiner Cc: Joonsoo Kim Cc: David Rientjes Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/compaction.c | 11 +++++++++-- mm/page_alloc.c | 20 +++++++++++++------- 2 files changed, 22 insertions(+), 9 deletions(-) commit d39773a0622c267fef3f79e3b1f0e7bdbad8a1a8 Author: Vlastimil Babka Date: Mon May 8 15:54:46 2017 -0700 mm, compaction: add migratetype to compact_control Preparation patch. We are going to need migratetype at lower layers than compact_zone() and compact_finished(). Link: http://lkml.kernel.org/r/20170307131545.28577-7-vbabka@suse.cz Signed-off-by: Vlastimil Babka Acked-by: Mel Gorman Acked-by: Johannes Weiner Cc: Joonsoo Kim Cc: David Rientjes Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/compaction.c | 15 +++++++-------- mm/internal.h | 1 + 2 files changed, 8 insertions(+), 8 deletions(-) commit b682debd97153706ffbe2fe3f8ec30a7ee11f9e1 Author: Vlastimil Babka Date: Mon May 8 15:54:43 2017 -0700 mm, compaction: change migrate_async_suitable() to suitable_migration_source() Preparation for making the decisions more complex and depending on compact_control flags. No functional change. Link: http://lkml.kernel.org/r/20170307131545.28577-6-vbabka@suse.cz Signed-off-by: Vlastimil Babka Acked-by: Mel Gorman Acked-by: Johannes Weiner Cc: Joonsoo Kim Cc: David Rientjes Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/mmzone.h | 5 +++++ mm/compaction.c | 19 +++++++++++-------- 2 files changed, 16 insertions(+), 8 deletions(-) commit 02aa0cdd72483c6dd436ed24d1000f86e0038d28 Author: Vlastimil Babka Date: Mon May 8 15:54:40 2017 -0700 mm, page_alloc: count movable pages when stealing from pageblock When stealing pages from pageblock of a different migratetype, we count how many free pages were stolen, and change the pageblock's migratetype if more than half of the pageblock was free. This might be too conservative, as there might be other pages that are not free, but were allocated with the same migratetype as our allocation requested. While we cannot determine the migratetype of allocated pages precisely (at least without the page_owner functionality enabled), we can count pages that compaction would try to isolate for migration - those are either on LRU or __PageMovable(). The rest can be assumed to be MIGRATE_RECLAIMABLE or MIGRATE_UNMOVABLE, which we cannot easily distinguish. This counting can be done as part of free page stealing with little additional overhead. The page stealing code is changed so that it considers free pages plus pages of the "good" migratetype for the decision whether to change pageblock's migratetype. The result should be more accurate migratetype of pageblocks wrt the actual pages in the pageblocks, when stealing from semi-occupied pageblocks. This should help the efficiency of page grouping by mobility. In testing based on 4.9 kernel with stress-highalloc from mmtests configured for order-4 GFP_KERNEL allocations, this patch has reduced the number of unmovable allocations falling back to movable pageblocks by 47%. The number of movable allocations falling back to other pageblocks are increased by 55%, but these events don't cause permanent fragmentation, so the tradeoff should be positive. Later patches also offset the movable fallback increase to some extent. [akpm@linux-foundation.org: merge fix] Link: http://lkml.kernel.org/r/20170307131545.28577-5-vbabka@suse.cz Signed-off-by: Vlastimil Babka Acked-by: Mel Gorman Cc: Johannes Weiner Cc: Joonsoo Kim Cc: David Rientjes Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/page-isolation.h | 5 +-- mm/page_alloc.c | 74 +++++++++++++++++++++++++++++++++--------- mm/page_isolation.c | 5 +-- 3 files changed, 63 insertions(+), 21 deletions(-) commit 3bc48f96cf11ce8699e419d5e47ae0d456403274 Author: Vlastimil Babka Date: Mon May 8 15:54:37 2017 -0700 mm, page_alloc: split smallest stolen page in fallback The __rmqueue_fallback() function is called when there's no free page of requested migratetype, and we need to steal from a different one. There are various heuristics to make this event infrequent and reduce permanent fragmentation. The main one is to try stealing from a pageblock that has the most free pages, and possibly steal them all at once and convert the whole pageblock. Precise searching for such pageblock would be expensive, so instead the heuristics walks the free lists from MAX_ORDER down to requested order and assumes that the block with highest-order free page is likely to also have the most free pages in total. Chances are that together with the highest-order page, we steal also pages of lower orders from the same block. But then we still split the highest order page. This is wasteful and can contribute to fragmentation instead of avoiding it. This patch thus changes __rmqueue_fallback() to just steal the page(s) and put them on the freelist of the requested migratetype, and only report whether it was successful. Then we pick (and eventually split) the smallest page with __rmqueue_smallest(). This all happens under zone lock, so nobody can steal it from us in the process. This should reduce fragmentation due to fallbacks. At worst we are only stealing a single highest-order page and waste some cycles by moving it between lists and then removing it, but fallback is not exactly hot path so that should not be a concern. As a side benefit the patch removes some duplicate code by reusing __rmqueue_smallest(). [vbabka@suse.cz: fix endless loop in the modified __rmqueue()] Link: http://lkml.kernel.org/r/59d71b35-d556-4fc9-ee2e-1574259282fd@suse.cz Link: http://lkml.kernel.org/r/20170307131545.28577-4-vbabka@suse.cz Signed-off-by: Vlastimil Babka Acked-by: Mel Gorman Acked-by: Johannes Weiner Cc: Joonsoo Kim Cc: David Rientjes Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/page_alloc.c | 62 ++++++++++++++++++++++++++++++++++----------------------- 1 file changed, 37 insertions(+), 25 deletions(-) commit 228d7e33903040a0b9dd9a5ee9b3a49c538c0613 Author: Vlastimil Babka Date: Mon May 8 15:54:33 2017 -0700 mm, compaction: remove redundant watermark check in compact_finished() When detecting whether compaction has succeeded in forming a high-order page, __compact_finished() employs a watermark check, followed by an own search for a suitable page in the freelists. This is not ideal for two reasons: - The watermark check also searches high-order freelists, but has a less strict criteria wrt fallback. It's therefore redundant and waste of cycles. This was different in the past when high-order watermark check attempted to apply reserves to high-order pages. - The watermark check might actually fail due to lack of order-0 pages. Compaction can't help with that, so there's no point in continuing because of that. It's possible that high-order page still exists and it terminates. This patch therefore removes the watermark check. This should save some cycles and terminate compaction sooner in some cases. Link: http://lkml.kernel.org/r/20170307131545.28577-3-vbabka@suse.cz Signed-off-by: Vlastimil Babka Acked-by: Mel Gorman Acked-by: Johannes Weiner Cc: Joonsoo Kim Cc: David Rientjes Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/compaction.c | 8 -------- 1 file changed, 8 deletions(-) commit f25ba6dccc3bfe7e1524f4498a171be038507c45 Author: Vlastimil Babka Date: Mon May 8 15:54:30 2017 -0700 mm, compaction: reorder fields in struct compact_control Patch series "try to reduce fragmenting fallbacks", v3. Last year, Johannes Weiner has reported a regression in page mobility grouping [1] and while the exact cause was not found, I've come up with some ways to improve it by reducing the number of allocations falling back to different migratetype and causing permanent fragmentation. The series was tested with mmtests stress-highalloc modified to do GFP_KERNEL order-4 allocations, on 4.9 with "mm, vmscan: fix zone balance check in prepare_kswapd_sleep" (without that, kcompactd indeed wasn't woken up) on UMA machine with 4GB memory. There were 5 repeats of each run, as the extfrag stats are quite volatile (note the stats below are sums, not averages, as it was less perl hacking for me). Success rate are the same, already high due to the low allocation order used, so I'm not including them. Compaction stats: (the patches are stacked, and I haven't measured the non-functional-changes patches separately) patch 1 patch 2 patch 3 patch 4 patch 7 patch 8 Compaction stalls 22449 24680 24846 19765 22059 17480 Compaction success 12971 14836 14608 10475 11632 8757 Compaction failures 9477 9843 10238 9290 10426 8722 Page migrate success 3109022 3370438 3312164 1695105 1608435 2111379 Page migrate failure 911588 1149065 1028264 1112675 1077251 1026367 Compaction pages isolated 7242983 8015530 7782467 4629063 4402787 5377665 Compaction migrate scanned 980838938 987367943 957690188 917647238 947155598 1018922197 Compaction free scanned 557926893 598946443 602236894 594024490 541169699 763651731 Compaction cost 10243 10578 10304 8286 8398 9440 Compaction stats are mostly within noise until patch 4, which decreases the number of compactions, and migrations. Part of that could be due to more pageblocks marked as unmovable, and async compaction skipping those. This changes a bit with patch 7, but not so much. Patch 8 increases free scanner stats and migrations, which comes from the changed termination criteria. Interestingly number of compactions decreases - probably the fully compacted pageblock satisfies multiple subsequent allocations, so it amortizes. Next comes the extfrag tracepoint, where "fragmenting" means that an allocation had to fallback to a pageblock of another migratetype which wasn't fully free (which is almost all of the fallbacks). I have locally added another tracepoint for "Page steal" into steal_suitable_fallback() which triggers in situations where we are allowed to do move_freepages_block(). If we decide to also do set_pageblock_migratetype(), it's "Pages steal with pageblock" with break down for which allocation migratetype we are stealing and from which fallback migratetype. The last part "due to counting" comes from patch 4 and counts the events where the counting of movable pages allowed us to change pageblock's migratetype, while the number of free pages alone wouldn't be enough to cross the threshold. patch 1 patch 2 patch 3 patch 4 patch 7 patch 8 Page alloc extfrag event 10155066 8522968 10164959 15622080 13727068 13140319 Extfrag fragmenting 10149231 8517025 10159040 15616925 13721391 13134792 Extfrag fragmenting for unmovable 159504 168500 184177 97835 70625 56948 Extfrag fragmenting unmovable placed with movable 153613 163549 172693 91740 64099 50917 Extfrag fragmenting unmovable placed with reclaim. 5891 4951 11484 6095 6526 6031 Extfrag fragmenting for reclaimable 4738 4829 6345 4822 5640 5378 Extfrag fragmenting reclaimable placed with movable 1836 1902 1851 1579 1739 1760 Extfrag fragmenting reclaimable placed with unmov. 2902 2927 4494 3243 3901 3618 Extfrag fragmenting for movable 9984989 8343696 9968518 15514268 13645126 13072466 Pages steal 179954 192291 210880 123254 94545 81486 Pages steal with pageblock 22153 18943 20154 33562 29969 33444 Pages steal with pageblock for unmovable 14350 12858 13256 20660 19003 20852 Pages steal with pageblock for unmovable from mov. 12812 11402 11683 19072 17467 19298 Pages steal with pageblock for unmovable from recl. 1538 1456 1573 1588 1536 1554 Pages steal with pageblock for movable 7114 5489 5965 11787 10012 11493 Pages steal with pageblock for movable from unmov. 6885 5291 5541 11179 9525 10885 Pages steal with pageblock for movable from recl. 229 198 424 608 487 608 Pages steal with pageblock for reclaimable 689 596 933 1115 954 1099 Pages steal with pageblock for reclaimable from unmov. 273 219 537 658 547 667 Pages steal with pageblock for reclaimable from mov. 416 377 396 457 407 432 Pages steal with pageblock due to counting 11834 10075 7530 ... for unmovable 8993 7381 4616 ... for movable 2792 2653 2851 ... for reclaimable 49 41 63 What we can see is that "Extfrag fragmenting for unmovable" and "... placed with movable" drops with almost each patch, which is good as we are polluting less movable pageblocks with unmovable pages. The most significant change is patch 4 with movable page counting. On the other hand it increases "Extfrag fragmenting for movable" by 50%. "Pages steal" drops though, so these movable allocation fallbacks find only small free pages and are not allowed to steal whole pageblocks back. "Pages steal with pageblock" raises, because the patch increases the chances of pageblock migratetype changes to happen. This affects all migratetypes. The summary is that patch 4 is not a clear win wrt these stats, but I believe that the tradeoff it makes is a good one. There's less pollution of movable pageblocks by unmovable allocations. There's less stealing between pageblock, and those that remain have higher chance of changing migratetype also the pageblock itself, so it should more faithfully reflect the migratetype of the pages within the pageblock. The increase of movable allocations falling back to unmovable pageblock might look dramatic, but those allocations can be migrated by compaction when needed, and other patches in the series (7-9) improve that aspect. Patches 7 and 8 continue the trend of reduced unmovable fallbacks and also reduce the impact on movable fallbacks from patch 4. [1] https://www.spinics.net/lists/linux-mm/msg114237.html This patch (of 8): While currently there are (mostly by accident) no holes in struct compact_control (on x86_64), but we are going to add more bool flags, so place them all together to the end of the structure. While at it, just order all fields from largest to smallest. Link: http://lkml.kernel.org/r/20170307131545.28577-2-vbabka@suse.cz Signed-off-by: Vlastimil Babka Acked-by: Mel Gorman Acked-by: Johannes Weiner Cc: Joonsoo Kim Cc: David Rientjes Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/internal.h | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit e092693443b995c8e3a565a73b5fdb05f1260f9b Author: Olga Kornievskaia Date: Mon May 8 18:02:24 2017 -0400 NFS append COMMIT after synchronous COPY Instead of messing with the commit path which has been causing issues, add a COMMIT op after the COPY and ask for stable copies in the first space. It saves a round trip, since after the COPY, the client sends a COMMIT anyway. Signed-off-by: Olga Kornievskaia Signed-off-by: Trond Myklebust fs/nfs/internal.h | 1 - fs/nfs/nfs42proc.c | 21 +++++++++++++++------ fs/nfs/nfs42xdr.c | 22 ++++++++++++++++++++-- fs/nfs/write.c | 30 ------------------------------ include/linux/nfs_xdr.h | 1 + 5 files changed, 36 insertions(+), 39 deletions(-) commit efda760fe95ea15291853c8fa9235c32d319cd98 Author: J. Bruce Fields Date: Tue Mar 28 21:25:08 2017 -0400 lockd: fix lockd shutdown race As reported by David Jeffery: "a signal was sent to lockd while lockd was shutting down from a request to stop nfs. The signal causes lockd to call restart_grace() which puts the lockd_net structure on the grace list. If this signal is received at the wrong time, it will occur after lockd_down_net() has called locks_end_grace() but before lockd_down_net() stops the lockd thread. This leads to lockd putting the lockd_net structure back on the grace list, then exiting without anything removing it from the list." So, perform the final locks_end_grace() from the the lockd thread; this ensures it's serialized with respect to restart_grace(). Reported-by: David Jeffery Signed-off-by: J. Bruce Fields fs/lockd/svc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 922c60e89d52730050c6ccca218bff40cc8bcd8e Author: Jon Mason Date: Mon May 8 17:48:35 2017 -0400 net: mdio-mux: bcm-iproc: call mdiobus_free() in error path If an error is encountered in mdio_mux_init(), the error path will call mdiobus_free(). Since mdiobus_register() has been called prior to mdio_mux_init(), the bus->state will not be MDIOBUS_UNREGISTERED. This causes a BUG_ON() in mdiobus_free(). To correct this issue, add an error path for mdio_mux_init() which calls mdiobus_unregister() prior to mdiobus_free(). Signed-off-by: Jon Mason Fixes: 98bc865a1ec8 ("net: mdio-mux: Add MDIO mux driver for iProc SoCs") Acked-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/phy/mdio-mux-bcm-iproc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 5e78e465abcba4a21e5cc52bef41aa4b3361957d Author: Markus Elfring Date: Thu Aug 25 14:28:09 2016 +0200 xtensa: ISS: Use kmalloc_array() in simdisk_init() * A multiplication for the size determination of a memory allocation indicated that an array data structure should be processed. Thus use the corresponding function "kmalloc_array". This issue was detected by using the Coccinelle software. * Replace the specification of a data type by a pointer dereference to make the corresponding size determination a bit safer according to the Linux coding style convention. Signed-off-by: Markus Elfring Signed-off-by: Max Filippov arch/xtensa/platforms/iss/simdisk.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit acfead32f3f938e456d7d5e1a82c743d30b8b886 Author: Mikulas Patocka Date: Fri Apr 14 14:35:33 2017 -0400 ide: don't call memcpy with the same source and destination The parisc architecture recently reimplemented the memcpy function and their reimplementation crashed when source and destination overlapped. The crash happened in the function ide_complete_cmd where memcpy is called with the same source and destination pointer. According to the C specification, memcpy behavior is undefined if the source and destination range overlaps. This patches fixes the undefined behavior. Signed-off-by: Mikulas Patocka Reviewed-by: Bartlomiej Zolnierkiewicz Signed-off-by: David S. Miller drivers/ide/ide-io.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1a1df90ae195d9c676b6f313375f3e8f13752e13 Author: Geliang Tang Date: Sun Apr 9 09:41:32 2017 +0800 ide: use setup_timer Use setup_timer() instead of init_timer() to simplify the code. Signed-off-by: Geliang Tang Signed-off-by: David S. Miller drivers/ide/ide-probe.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 48f5bccc60675f8426a6159935e8636a1fd89f56 Author: Grygorii Strashko Date: Mon May 8 14:21:21 2017 -0500 net: ethernet: ti: cpsw: adjust cpsw fifos depth for fullduplex flow control When users set flow control using ethtool the bits are set properly in the CPGMAC_SL MACCONTROL register, but the FIFO depth in the respective Port n Maximum FIFO Blocks (Pn_MAX_BLKS) registers remains set to the minimum size reset value. When receive flow control is enabled on a port, the port's associated FIFO block allocation must be adjusted. The port RX allocation must increase to accommodate the flow control runout. The TRM recommends numbers of 5 or 6. Hence, apply required Port FIFO configuration to Pn_MAX_BLKS.Pn_TX_MAX_BLKS=0xF and Pn_MAX_BLKS.Pn_RX_MAX_BLKS=0x5 during interface initialization. Cc: Schuyler Patton Signed-off-by: Grygorii Strashko Signed-off-by: David S. Miller drivers/net/ethernet/ti/cpsw.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) commit 242d3a49a2a1a71d8eb9f953db1bcaa9d698ce00 Author: WANG Cong Date: Mon May 8 10:12:13 2017 -0700 ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf For each netns (except init_net), we initialize its null entry in 3 places: 1) The template itself, as we use kmemdup() 2) Code around dst_init_metrics() in ip6_route_net_init() 3) ip6_route_dev_notify(), which is supposed to initialize it after loopback registers Unfortunately the last one still happens in a wrong order because we expect to initialize net->ipv6.ip6_null_entry->rt6i_idev to net->loopback_dev's idev, thus we have to do that after we add idev to loopback. However, this notifier has priority == 0 same as ipv6_dev_notf, and ipv6_dev_notf is registered after ip6_route_dev_notifier so it is called actually after ip6_route_dev_notifier. This is similar to commit 2f460933f58e ("ipv6: initialize route null entry in addrconf_init()") which fixes init_net. Fix it by picking a smaller priority for ip6_route_dev_notifier. Also, we have to release the refcnt accordingly when unregistering loopback_dev because device exit functions are called before subsys exit functions. Acked-by: David Ahern Tested-by: David Ahern Signed-off-by: Cong Wang Signed-off-by: David S. Miller include/net/addrconf.h | 2 ++ net/ipv6/addrconf.c | 1 + net/ipv6/route.c | 13 +++++++++++-- 3 files changed, 14 insertions(+), 2 deletions(-) commit c32537d49faba69f5c2146f1ab6dbacf26bff133 Author: Markus Elfring Date: Sun May 7 21:24:51 2017 +0200 xtensa: Use seq_puts() in c_show() A string which did not contain a data format specification should be put into a sequence. Thus use the corresponding function "seq_puts". This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring Signed-off-by: Max Filippov arch/xtensa/kernel/setup.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 29cee56c0be46ad01e78af104a06223c65ee0c67 Merge: aeca3a7 6406c91 Author: David S. Miller Date: Mon May 8 16:02:23 2017 -0400 Merge tag 'mac80211-for-davem-2017-05-08' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 Johannes Berg says: ==================== A couple more fixes: * don't try to authenticate during reconfiguration, which causes drivers to get confused * fix a kernel-doc warning for a recently merged change * fix MU-MIMO group configuration (relevant only for monitor mode) * more rate flags fix: remove stray RX_ENC_FLAG_40MHZ * fix IBSS probe response allocation size ==================== Signed-off-by: David S. Miller commit aeca3a77b1e0ed06a095933b89c86aed007383eb Author: Jim Baxter Date: Mon May 8 13:49:57 2017 +0100 net: cdc_ncm: Fix TX zero padding The zero padding that is added to NTB's does not zero the memory correctly. This is because the skb_put modifies the value of skb_out->len which results in the memset command not setting any memory to zero as (ctx->tx_max - skb_out->len) == 0. I have resolved this by storing the size of the memory to be zeroed before the skb_put and using this in the memset call. Signed-off-by: Jim Baxter Reviewed-by: Bjørn Mork Signed-off-by: David S. Miller drivers/net/usb/cdc_ncm.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) commit 2d3e4866dea96b0506395b47bfefb234f2088dac Merge: 9c6ee01 2e5b0bd Author: Linus Torvalds Date: Mon May 8 12:37:56 2017 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull KVM updates from Paolo Bonzini: "ARM: - HYP mode stub supports kexec/kdump on 32-bit - improved PMU support - virtual interrupt controller performance improvements - support for userspace virtual interrupt controller (slower, but necessary for KVM on the weird Broadcom SoCs used by the Raspberry Pi 3) MIPS: - basic support for hardware virtualization (ImgTec P5600/P6600/I6400 and Cavium Octeon III) PPC: - in-kernel acceleration for VFIO s390: - support for guests without storage keys - adapter interruption suppression x86: - usual range of nVMX improvements, notably nested EPT support for accessed and dirty bits - emulation of CPL3 CPUID faulting generic: - first part of VCPU thread request API - kvm_stat improvements" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (227 commits) kvm: nVMX: Don't validate disabled secondary controls KVM: put back #ifndef CONFIG_S390 around kvm_vcpu_kick Revert "KVM: Support vCPU-based gfn->hva cache" tools/kvm: fix top level makefile KVM: x86: don't hold kvm->lock in KVM_SET_GSI_ROUTING KVM: Documentation: remove VM mmap documentation kvm: nVMX: Remove superfluous VMX instruction fault checks KVM: x86: fix emulation of RSM and IRET instructions KVM: mark requests that need synchronization KVM: return if kvm_vcpu_wake_up() did wake up the VCPU KVM: add explicit barrier to kvm_vcpu_kick KVM: perform a wake_up in kvm_make_all_cpus_request KVM: mark requests that do not need a wakeup KVM: remove #ifndef CONFIG_S390 around kvm_vcpu_wake_up KVM: x86: always use kvm_make_request instead of set_bit KVM: add kvm_{test,clear}_request to replace {test,clear}_bit s390: kvm: Cpu model support for msa6, msa7 and msa8 KVM: x86: remove irq disablement around KVM_SET_CLOCK/KVM_GET_CLOCK kvm: better MWAIT emulation for guests KVM: x86: virtualize cpuid faulting ... commit 9c6ee01ed5bb1ee489d580eaa60d7eb5a8ede336 Merge: d9dc089 c92a90a Author: Linus Torvalds Date: Mon May 8 12:32:00 2017 -0700 Merge branch 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm Pull ARM updates from Russell King: "Lots of little things this time: - allow modules to be autoloaded according to the HWCAP feature bits (used primarily for crypto modules) - split module core and init PLT sections, since the core code and init code could be placed far apart, and the PLT sections need to be local to the code block. - three patches from Chris Brandt to allow Cortex-A9 L2 cache optimisations to be disabled where a SoC didn't wire up the out of band signals. - NoMMU compliance fixes, avoiding corruption of vector table which is not being used at this point, and avoiding possible register state corruption when switching mode. - fixmap memory attribute compliance update. - remove unnecessary locking from update_sections_early() - ftrace fix for DEBUG_RODATA with !FRAME_POINTER" * 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm: ARM: 8672/1: mm: remove tasklist locking from update_sections_early() ARM: 8671/1: V7M: Preserve registers across switch from Thread to Handler mode ARM: 8670/1: V7M: Do not corrupt vector table around v7m_invalidate_l1 call ARM: 8668/1: ftrace: Fix dynamic ftrace with DEBUG_RODATA and !FRAME_POINTER ARM: 8667/3: Fix memory attribute inconsistencies when using fixmap ARM: 8663/1: wire up HWCAP/HWCAP2 feature bits to the CPU modalias ARM: 8666/1: mm: dump: Add domain to output ARM: 8662/1: module: split core and init PLT sections ARM: 8661/1: dts: r7s72100: add l2 cache ARM: 8660/1: shmobile: r7s72100: Enable L2 cache ARM: 8659/1: l2c: allow CA9 optimizations to be disabled commit d9dc089583ebf28d6f02b995e2d71c85965660f9 Merge: 70ef8f0 2a4e669 Author: Linus Torvalds Date: Mon May 8 12:29:46 2017 -0700 Merge tag 'xtensa-20170507' of git://github.com/jcmvbkbc/linux-xtensa Pull Xtensa updates from Max Filippov: - clearly mark references to spilled register locations with SPILL_SLOT macros - clean up xtensa ptrace: use generic tracehooks, move internal kernel definitions from uapi/asm to asm, make locally-used functions static, fix code style and alignment - use command line parameters passed to ISS as kernel command line. * tag 'xtensa-20170507' of git://github.com/jcmvbkbc/linux-xtensa: xtensa: clean up access to spilled registers locations xtensa: use generic tracehooks xtensa: move internal ptrace definitions from uapi/asm to asm xtensa: clean up xtensa/kernel/ptrace.c xtensa: drop unused fast_io_protect function xtensa: use ITLB_HIT_BIT instead of hardcoded number xtensa: ISS: update kernel command line in platform_setup xtensa: ISS: add argc/argv simcall definitions xtensa: ISS: cleanup setup.c commit 70ef8f0d37573079e093305214d0cc9eb71100f7 Merge: 677375c e9cdd30 Author: Linus Torvalds Date: Mon May 8 12:24:17 2017 -0700 Merge tag 'for-f2fs-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs Pull f2fs updates from Jaegeuk Kim: "In this round, we've focused on enhancing performance with regards to block allocation, GC, and discard/in-place-update IO controls. There are a bunch of clean-ups as well as minor bug fixes. Enhancements: - disable heap-based allocation by default - issue small-sized discard commands by default - change the policy of data hotness for logging - distinguish IOs in terms of size and wbc type - start SSR earlier to avoid foreground GC - enhance data structures managing discard commands - enhance in-place update flow - add some more fault injection routines - secure one more xattr entry Bug fixes: - calculate victim cost for GC correctly - remain correct victim segment number for GC - race condition in nid allocator and initializer - stale pointer produced by atomic_writes - fix missing REQ_SYNC for flush commands - handle missing errors in more corner cases" * tag 'for-f2fs-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (111 commits) f2fs: fix a mount fail for wrong next_scan_nid f2fs: enhance scalability of trace macro f2fs: relocate inode_{,un}lock in F2FS_IOC_SETFLAGS f2fs: Make flush bios explicitely sync f2fs: show available_nids in f2fs/status f2fs: flush dirty nats periodically f2fs: introduce CP_TRIMMED_FLAG to avoid unneeded discard f2fs: allow cpc->reason to indicate more than one reason f2fs: release cp and dnode lock before IPU f2fs: shrink size of struct discard_cmd f2fs: don't hold cmd_lock during waiting discard command f2fs: nullify fio->encrypted_page for each writes f2fs: sanity check segment count f2fs: introduce valid_ipu_blkaddr to clean up f2fs: lookup extent cache first under IPU scenario f2fs: reconstruct code to write a data page f2fs: introduce __wait_discard_cmd f2fs: introduce __issue_discard_cmd f2fs: enable small discard by default f2fs: delay awaking discard thread ... commit b210aeaedfc47ab8a86fbdcad46caf1e49cc0e37 Merge: 8ed508f 70fe443 Author: David S. Miller Date: Mon May 8 15:15:03 2017 -0400 Merge branch 'stmmac-pci-fix-crash-on-Intel-Galileo-Gen2' Andy Shevchenko says: ==================== stmmac: pci: Fix crash on Intel Galileo Gen2 Due to misconfiguration of PCI driver for Intel Quark the user will get a kernel crash: udhcpc: started, v1.26.2 stmmaceth 0000:00:14.6 eth0: device MAC address 98:4f:ee:05:ac:47 Generic PHY stmmac-a6:01: attached PHY driver [Generic PHY] (mii_bus:phy_addr=stmmac-a6:01, irq=-1) stmmaceth 0000:00:14.6 eth0: IEEE 1588-2008 Advanced Timestamp supported stmmaceth 0000:00:14.6 eth0: registered PTP clock IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready udhcpc: sending discover stmmaceth 0000:00:14.6 eth0: Link is Up - 100Mbps/Full - flow control off IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready BUG: unable to handle kernel NULL pointer dereference at (null) IP: stmmac_xmit+0xf1/0x1080 Fix this by adding necessary settings. P.S. I split fix to three patches according to what each of them adds. ==================== Tested-by: Jan Kiszka Signed-off-by: David S. Miller commit 70fe4432bb360207fba04b4137f330a7a109f7a6 Author: Andy Shevchenko Date: Mon May 8 17:14:22 2017 +0300 stmmac: pci: split out common_default_data() helper New helper is added in order to prevent misconfiguration happened for one of the platforms when configuration data is expanded. Signed-off-by: Andy Shevchenko Acked-by: Joao Pinto Signed-off-by: David S. Miller drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c | 52 ++++++++---------------- 1 file changed, 18 insertions(+), 34 deletions(-) commit efcd24147fa03817485dab9ff9d5542a0f28684b Author: Andy Shevchenko Date: Mon May 8 17:14:21 2017 +0300 stmmac: pci: RX queue routing configuration The commit abe80fdc6ee6 ("net: stmmac: RX queue routing configuration") missed Intel Quark configuration. Append it here. Fixes: abe80fdc6ee6 ("net: stmmac: RX queue routing configuration") Cc: Joao Pinto Signed-off-by: Andy Shevchenko Acked-by: Joao Pinto Signed-off-by: David S. Miller drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c | 3 +++ 1 file changed, 3 insertions(+) commit a1437e57af1c07ef01b921c4a1ab8efd5134b597 Author: Andy Shevchenko Date: Mon May 8 17:14:20 2017 +0300 stmmac: pci: TX and RX queue priority configuration The commit a8f5102af2a7 ("net: stmmac: TX and RX queue priority configuration") missed Intel Quark configuration. Append it here. Fixes: a8f5102af2a7 ("net: stmmac: TX and RX queue priority configuration") Cc: Joao Pinto Signed-off-by: Andy Shevchenko Acked-by: Joao Pinto Signed-off-by: David S. Miller drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c | 4 ++++ 1 file changed, 4 insertions(+) commit 05c5d0041972d3f3c6d881e94aa351f89a62eb2a Author: Andy Shevchenko Date: Mon May 8 17:14:19 2017 +0300 stmmac: pci: set default number of rx and tx queues The commit 26d6851fd24e ("net: stmmac: set default number of rx and tx queues in stmmac_pci") missed Intel Quark configuration. Append it here. Fixes: 26d6851fd24e ("net: stmmac: set default number of rx and tx queues in stmmac_pci") Cc: Joao Pinto Signed-off-by: Andy Shevchenko Acked-by: Joao Pinto Acked-by: Giuseppe Cavallaro Signed-off-by: David S. Miller drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c | 4 ++++ 1 file changed, 4 insertions(+) commit 8ed508fd4b84a38db63ddeee8ab6905f06cfa589 Author: Hangbin Liu Date: Mon May 8 17:57:13 2017 +0800 vti: check nla_put_* return value Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller net/ipv4/ip_vti.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) commit 0d0e57697f162da4aa218b5feafe614fb666db07 Author: Daniel Borkmann Date: Mon May 8 00:04:09 2017 +0200 bpf: don't let ldimm64 leak map addresses on unprivileged The patch fixes two things at once: 1) It checks the env->allow_ptr_leaks and only prints the map address to the log if we have the privileges to do so, otherwise it just dumps 0 as we would when kptr_restrict is enabled on %pK. Given the latter is off by default and not every distro sets it, I don't want to rely on this, hence the 0 by default for unprivileged. 2) Printing of ldimm64 in the verifier log is currently broken in that we don't print the full immediate, but only the 32 bit part of the first insn part for ldimm64. Thus, fix this up as well; it's okay to access, since we verified all ldimm64 earlier already (including just constants) through replace_map_fd_with_map_ptr(). Fixes: 1be7f75d1668 ("bpf: enable non-root eBPF programs") Fixes: cbd357008604 ("bpf: verifier (add ability to receive verification log)") Reported-by: Jann Horn Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: David S. Miller kernel/bpf/verifier.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) commit 871ff2ebe0af0d7f1050bfc8bce62fddea2b12ec Author: Geliang Tang Date: Sat May 6 23:42:22 2017 +0800 yam: use memdup_user Use memdup_user() helper instead of open-coding to simplify the code. Signed-off-by: Geliang Tang Signed-off-by: David S. Miller drivers/net/hamradio/yam.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) commit 294316a4af16cd5c355a80bd2dc7ea803b88f6ba Author: Geliang Tang Date: Sat May 6 23:42:16 2017 +0800 net/hippi/rrunner: use memdup_user Use memdup_user() helper instead of open-coding to simplify the code. Signed-off-by: Geliang Tang Signed-off-by: David S. Miller drivers/net/hippi/rrunner.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) commit 3bb4858fda1cac2ae677edb5134932af4c7f8ff8 Author: Ganesh Goudar Date: Sat May 6 14:25:06 2017 +0530 cxgb4: avoid disabling FEC by default Recent Chelsio firmware started using few port capablity bits to manage FEC and as driver was not aware of FEC changes those bits were zeroed, consequently disabling FEC. Avoid zeroing those bits and default to whatever the firmware tells us the Link is currently advertising. Signed-off-by: Ganesh Goudar Signed-off-by: David S. Miller drivers/net/ethernet/chelsio/cxgb4/cxgb4.h | 9 +++++++ drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 38 ++++++++++++++++++++++----- drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h | 6 ++--- 3 files changed, 43 insertions(+), 10 deletions(-) commit 8ce7aaaa9797f944ad2f50e5160c8a20a473aedf Author: Christophe Jaillet Date: Sat May 6 07:29:45 2017 +0200 net: dsa: loop: Check for memory allocation failure If 'devm_kzalloc' fails, a NULL pointer will be dereferenced. Return -ENOMEM instead, as done for some other memory allocation just a few lines above. Fixes: 98cd1552ea27 ("net: dsa: Mock-up driver") Signed-off-by: Christophe JAILLET Reviewed-by: Andrew Lunn Acked-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/dsa/dsa_loop.c | 3 +++ 1 file changed, 3 insertions(+) commit d62844a825e87da345e11639e98deb617ef11e08 Author: Hangbin Liu Date: Sat May 6 11:17:06 2017 +0800 bonding: check nla_put_be32 return value Signed-off-by: Hangbin Liu Signed-off-by: David S. Miller drivers/net/bonding/bond_netlink.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 7bccd12d27b7e358823feb5429731b8ee698b173 Author: Ben Shelton Date: Mon Mar 27 13:24:44 2017 -0500 ubi: Add debugfs file for tracking PEB state Add a file under debugfs to allow easy access to the erase count for each physical erase block on an UBI device. This is useful when debugging data integrity issues with UBIFS on NAND flash devices. Signed-off-by: Ben Shelton Signed-off-by: Zach Brown v2: * If ubi_io_is_bad eraseblk_count_seq_show just returns the err. * if ubi->lookuptbl returns null, its no longer treated as an error instead info for that block is not printeded * Removed check for UBI_MAX_ERASECOUNTER since it is impossible to hit * Removed block state from print, if a block is printed then it is good and if it is not printed, then it is bad. v3: * Remove errant ! symbol from if statement checking if erase count is valid. Signed-off-by: Richard Weinberger drivers/mtd/ubi/debug.c | 126 +++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 125 insertions(+), 1 deletion(-) commit 798868c021016c1ee1825a3fbf10ae64ecc64c8e Author: Rock Lee Date: Thu Apr 13 23:16:06 2017 -0700 ubifs: Fix a typo in comment of ioctl2ubifs & ubifs2ioctl Change 'convert' to 'converts' Change 'UBIFS' to 'UBIFS inode flags' Signed-off-by: Rock Lee Signed-off-by: Richard Weinberger fs/ubifs/ioctl.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 2a068daf57424b98b3c9de8da8bbf47ca360a618 Author: Stefan Agner Date: Sun Apr 16 19:22:43 2017 -0700 ubifs: Remove unnecessary assignment Assigning a value of a variable to itself is not useful. Signed-off-by: Stefan Agner Signed-off-by: Richard Weinberger fs/ubifs/recovery.c | 1 - 1 file changed, 1 deletion(-) commit 6a258f7d0fbd9f5e93099018741a7e64dd3a4578 Author: Colin Ian King Date: Sat Apr 8 00:22:03 2017 +0100 ubifs: Fix cut and paste error on sb type comparisons The check for the bad node type of sb->type is checking sa->type and not sb-type. This looks like a cut and paste error. Fix this. Detected by PVS-Studio, warning: V581 Signed-off-by: Colin Ian King Signed-off-by: Richard Weinberger fs/ubifs/debug.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 8a1435880f452430b41374d27ac4a33e7bd381ea Author: Rabin Vincent Date: Mon Apr 3 13:44:11 2017 +0200 ubi: fastmap: Fix slab corruption Booting with UBI fastmap and SLUB debugging enabled results in the following splats. The problem is that ubi_scan_fastmap() moves the fastmap blocks from the scan_ai (allocated in scan_fast()) to the ai allocated in ubi_attach(). This results in two problems: - When the scan_ai is freed, aebs which were allocated from its slab cache are still in use. - When the other ai is being destroyed in destroy_ai(), the arguments to kmem_cache_free() call are incorrect since aebs on its ->fastmap list were allocated with a slab cache from a differnt ai. Fix this by making a copy of the aebs in ubi_scan_fastmap() instead of moving them. ============================================================================= BUG ubi_aeb_slab_cache (Not tainted): Objects remaining in ubi_aeb_slab_cache on __kmem_cache_shutdown() ----------------------------------------------------------------------------- INFO: Slab 0xbfd2da3c objects=17 used=1 fp=0xb33d7748 flags=0x40000080 CPU: 1 PID: 118 Comm: ubiattach Tainted: G B 4.9.15 #3 [<80111910>] (unwind_backtrace) from [<8010d498>] (show_stack+0x18/0x1c) [<8010d498>] (show_stack) from [<804a3274>] (dump_stack+0xb4/0xe0) [<804a3274>] (dump_stack) from [<8026c47c>] (slab_err+0x78/0x88) [<8026c47c>] (slab_err) from [<802735bc>] (__kmem_cache_shutdown+0x180/0x3e0) [<802735bc>] (__kmem_cache_shutdown) from [<8024e13c>] (shutdown_cache+0x1c/0x60) [<8024e13c>] (shutdown_cache) from [<8024ed64>] (kmem_cache_destroy+0x19c/0x20c) [<8024ed64>] (kmem_cache_destroy) from [<8057cc14>] (destroy_ai+0x1dc/0x1e8) [<8057cc14>] (destroy_ai) from [<8057f04c>] (ubi_attach+0x3f4/0x450) [<8057f04c>] (ubi_attach) from [<8056fe70>] (ubi_attach_mtd_dev+0x60c/0xff8) [<8056fe70>] (ubi_attach_mtd_dev) from [<80571d78>] (ctrl_cdev_ioctl+0x110/0x2b8) [<80571d78>] (ctrl_cdev_ioctl) from [<8029c77c>] (do_vfs_ioctl+0xac/0xa00) [<8029c77c>] (do_vfs_ioctl) from [<8029d10c>] (SyS_ioctl+0x3c/0x64) [<8029d10c>] (SyS_ioctl) from [<80108860>] (ret_fast_syscall+0x0/0x1c) INFO: Object 0xb33d7e88 @offset=3720 INFO: Allocated in scan_peb+0x608/0x81c age=72 cpu=1 pid=118 kmem_cache_alloc+0x3b0/0x43c scan_peb+0x608/0x81c ubi_attach+0x124/0x450 ubi_attach_mtd_dev+0x60c/0xff8 ctrl_cdev_ioctl+0x110/0x2b8 do_vfs_ioctl+0xac/0xa00 SyS_ioctl+0x3c/0x64 ret_fast_syscall+0x0/0x1c kmem_cache_destroy ubi_aeb_slab_cache: Slab cache still has objects CPU: 1 PID: 118 Comm: ubiattach Tainted: G B 4.9.15 #3 [<80111910>] (unwind_backtrace) from [<8010d498>] (show_stack+0x18/0x1c) [<8010d498>] (show_stack) from [<804a3274>] (dump_stack+0xb4/0xe0) [<804a3274>] (dump_stack) from [<8024ed80>] (kmem_cache_destroy+0x1b8/0x20c) [<8024ed80>] (kmem_cache_destroy) from [<8057cc14>] (destroy_ai+0x1dc/0x1e8) [<8057cc14>] (destroy_ai) from [<8057f04c>] (ubi_attach+0x3f4/0x450) [<8057f04c>] (ubi_attach) from [<8056fe70>] (ubi_attach_mtd_dev+0x60c/0xff8) [<8056fe70>] (ubi_attach_mtd_dev) from [<80571d78>] (ctrl_cdev_ioctl+0x110/0x2b8) [<80571d78>] (ctrl_cdev_ioctl) from [<8029c77c>] (do_vfs_ioctl+0xac/0xa00) [<8029c77c>] (do_vfs_ioctl) from [<8029d10c>] (SyS_ioctl+0x3c/0x64) [<8029d10c>] (SyS_ioctl) from [<80108860>] (ret_fast_syscall+0x0/0x1c) cache_from_obj: Wrong slab cache. ubi_aeb_slab_cache but object is from ubi_aeb_slab_cache ------------[ cut here ]------------ WARNING: CPU: 1 PID: 118 at mm/slab.h:354 kmem_cache_free+0x39c/0x450 Modules linked in: CPU: 1 PID: 118 Comm: ubiattach Tainted: G B 4.9.15 #3 [<80111910>] (unwind_backtrace) from [<8010d498>] (show_stack+0x18/0x1c) [<8010d498>] (show_stack) from [<804a3274>] (dump_stack+0xb4/0xe0) [<804a3274>] (dump_stack) from [<80120e40>] (__warn+0xf4/0x10c) [<80120e40>] (__warn) from [<80120f20>] (warn_slowpath_null+0x28/0x30) [<80120f20>] (warn_slowpath_null) from [<80271fe0>] (kmem_cache_free+0x39c/0x450) [<80271fe0>] (kmem_cache_free) from [<8057cb88>] (destroy_ai+0x150/0x1e8) [<8057cb88>] (destroy_ai) from [<8057ef1c>] (ubi_attach+0x2c4/0x450) [<8057ef1c>] (ubi_attach) from [<8056fe70>] (ubi_attach_mtd_dev+0x60c/0xff8) [<8056fe70>] (ubi_attach_mtd_dev) from [<80571d78>] (ctrl_cdev_ioctl+0x110/0x2b8) [<80571d78>] (ctrl_cdev_ioctl) from [<8029c77c>] (do_vfs_ioctl+0xac/0xa00) [<8029c77c>] (do_vfs_ioctl) from [<8029d10c>] (SyS_ioctl+0x3c/0x64) [<8029d10c>] (SyS_ioctl) from [<80108860>] (ret_fast_syscall+0x0/0x1c) ---[ end trace 2bd8396277fd0a0b ]--- ============================================================================= BUG ubi_aeb_slab_cache (Tainted: G B W ): page slab pointer corrupt. ----------------------------------------------------------------------------- INFO: Allocated in scan_peb+0x608/0x81c age=104 cpu=1 pid=118 kmem_cache_alloc+0x3b0/0x43c scan_peb+0x608/0x81c ubi_attach+0x124/0x450 ubi_attach_mtd_dev+0x60c/0xff8 ctrl_cdev_ioctl+0x110/0x2b8 do_vfs_ioctl+0xac/0xa00 SyS_ioctl+0x3c/0x64 ret_fast_syscall+0x0/0x1c INFO: Slab 0xbfd2da3c objects=17 used=1 fp=0xb33d7748 flags=0x40000081 INFO: Object 0xb33d7e88 @offset=3720 fp=0xb33d7da0 Redzone b33d7e80: cc cc cc cc cc cc cc cc ........ Object b33d7e88: 02 00 00 00 01 00 00 00 00 f0 ff 7f ff ff ff ff ................ Object b33d7e98: 00 00 00 00 00 00 00 00 bd 16 00 00 00 00 00 00 ................ Object b33d7ea8: 00 01 00 00 00 02 00 00 00 00 00 00 00 00 00 00 ................ Redzone b33d7eb8: cc cc cc cc .... Padding b33d7f60: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ CPU: 1 PID: 118 Comm: ubiattach Tainted: G B W 4.9.15 #3 [<80111910>] (unwind_backtrace) from [<8010d498>] (show_stack+0x18/0x1c) [<8010d498>] (show_stack) from [<804a3274>] (dump_stack+0xb4/0xe0) [<804a3274>] (dump_stack) from [<80271770>] (free_debug_processing+0x320/0x3c4) [<80271770>] (free_debug_processing) from [<80271ad0>] (__slab_free+0x2bc/0x430) [<80271ad0>] (__slab_free) from [<80272024>] (kmem_cache_free+0x3e0/0x450) [<80272024>] (kmem_cache_free) from [<8057cb88>] (destroy_ai+0x150/0x1e8) [<8057cb88>] (destroy_ai) from [<8057ef1c>] (ubi_attach+0x2c4/0x450) [<8057ef1c>] (ubi_attach) from [<8056fe70>] (ubi_attach_mtd_dev+0x60c/0xff8) [<8056fe70>] (ubi_attach_mtd_dev) from [<80571d78>] (ctrl_cdev_ioctl+0x110/0x2b8) [<80571d78>] (ctrl_cdev_ioctl) from [<8029c77c>] (do_vfs_ioctl+0xac/0xa00) [<8029c77c>] (do_vfs_ioctl) from [<8029d10c>] (SyS_ioctl+0x3c/0x64) [<8029d10c>] (SyS_ioctl) from [<80108860>] (ret_fast_syscall+0x0/0x1c) FIX ubi_aeb_slab_cache: Object at 0xb33d7e88 not freed Signed-off-by: Rabin Vincent Signed-off-by: Richard Weinberger drivers/mtd/ubi/fastmap.c | 33 +++++++++++++++++++++++++++++---- 1 file changed, 29 insertions(+), 4 deletions(-) commit 8326c1eec2449f0e868f7b19a5fa7bfa0386ab48 Author: Hyunchul Lee Date: Fri Mar 3 16:44:03 2017 +0900 ubifs: Add CONFIG_UBIFS_FS_SECURITY to disable/enable security labels When write syscall is called, every time security label is searched to determine that file's privileges should be changed. If LSM(Linux Security Model) is not used, this is useless. So introduce CONFIG_UBIFS_SECURITY to disable security labels. it's default value is "y". Signed-off-by: Hyunchul Lee Signed-off-by: Richard Weinberger fs/ubifs/Kconfig | 13 +++++++++++++ fs/ubifs/ubifs.h | 14 ++++++++++++-- fs/ubifs/xattr.c | 6 ++++++ 3 files changed, 31 insertions(+), 2 deletions(-) commit 997d30cb7490eb1ac37a3fb02a222fabf1f25fa9 Author: Andy Shevchenko Date: Tue Jan 10 14:56:43 2017 +0200 ubi: Make mtd parameter readable Fix permissions to allow read mtd parameter back (only for owner). Signed-off-by: Andy Shevchenko Signed-off-by: Richard Weinberger drivers/mtd/ubi/build.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 435009d4064af72b283fdd47025cede4dfefc6d2 Author: Andy Shevchenko Date: Tue Jan 10 14:56:42 2017 +0200 ubi: Fix section mismatch WARNING: vmlinux.o(.text+0x1f2a80): Section mismatch in reference from the variable __param_ops_mtd to the function .init.text:ubi_mtd_param_parse() The function __param_ops_mtd() references the function __init ubi_mtd_param_parse(). This is often because __param_ops_mtd lacks a __init annotation or the annotation of ubi_mtd_param_parse is wrong. Cc: Richard Weinberger Signed-off-by: Andy Shevchenko Signed-off-by: Richard Weinberger drivers/mtd/ubi/build.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit ac45bd93a5035c2f39c9862b8b6ed692db0fdc87 Author: Dan Carpenter Date: Sat May 6 03:49:01 2017 +0300 bnxt_en: allocate enough space for ->ntp_fltr_bmap We have the number of longs, but we need to calculate the number of bytes required. Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.") Signed-off-by: Dan Carpenter Acked-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit df5303a8aa9a0a6934f4cea7427f1edf771f21c2 Author: Kees Cook Date: Fri May 5 15:34:34 2017 -0700 qlge: Avoid reading past end of buffer Using memcpy() from a string that is shorter than the length copied means the destination buffer is being filled with arbitrary data from the kernel rodata segment. Instead, use strncpy() which will fill the trailing bytes with zeros. This was found with the future CONFIG_FORTIFY_SOURCE feature. Cc: Daniel Micay Signed-off-by: Kees Cook Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qlge/qlge_dbg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 4dc69c1c1fff2f587f8e737e70b4a4e7565a5c94 Author: Kees Cook Date: Fri May 5 15:30:23 2017 -0700 bna: ethtool: Avoid reading past end of buffer Using memcpy() from a string that is shorter than the length copied means the destination buffer is being filled with arbitrary data from the kernel rodata segment. Instead, use strncpy() which will fill the trailing bytes with zeros. This was found with the future CONFIG_FORTIFY_SOURCE feature. Cc: Daniel Micay Signed-off-by: Kees Cook Signed-off-by: David S. Miller drivers/net/ethernet/brocade/bna/bnad_ethtool.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 9e4eb1ce472fbf7b007f23c88ec11c37265e401c Author: Kees Cook Date: Fri May 5 15:25:32 2017 -0700 bna: Avoid reading past end of buffer Using memcpy() from a string that is shorter than the length copied means the destination buffer is being filled with arbitrary data from the kernel rodata segment. Instead, use strncpy() which will fill the trailing bytes with zeros. This was found with the future CONFIG_FORTIFY_SOURCE feature. Cc: Daniel Micay Signed-off-by: Kees Cook Signed-off-by: David S. Miller drivers/net/ethernet/brocade/bna/bfa_ioc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 677375cef8cb7763ef620e007873117b9bad72a0 Merge: dd727da 6f9d696 Author: Linus Torvalds Date: Mon May 8 11:40:34 2017 -0700 Merge tag 'fscrypt_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/fscrypt Pull fscrypt updates from Ted Ts'o: "Only bug fixes and cleanups for this merge window" * tag 'fscrypt_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/fscrypt: fscrypt: correct collision claim for digested names MAINTAINERS: fscrypt: update mailing list, patchwork, and git ext4: clean up ext4_match() and callers f2fs: switch to using fscrypt_match_name() ext4: switch to using fscrypt_match_name() fscrypt: introduce helper function for filename matching fscrypt: avoid collisions when presenting long encrypted filenames f2fs: check entire encrypted bigname when finding a dentry ubifs: check for consistent encryption contexts in ubifs_lookup() f2fs: sync f2fs_lookup() with ext4_lookup() ext4: remove "nokey" check from ext4_lookup() fscrypt: fix context consistency check when key(s) unavailable fscrypt: Remove __packed from fscrypt_policy fscrypt: Move key structure and constants to uapi fscrypt: remove fscrypt_symlink_data_len() fscrypt: remove unnecessary checks for NULL operations commit 8403debeead8e8b296d7a7db2174af524695ab42 Author: Vlad Yasevich Date: Fri May 5 16:17:41 2017 -0400 vlan: Keep NETIF_F_HW_CSUM similar to other software devices Vlan devices, like all other software devices, enable NETIF_F_HW_CSUM feature. However, unlike all the othe other software devices, vlans will switch to using IP|IPV6_CSUM features, if the underlying devices uses them. In these situations, checksum offload features on the vlan device can't be controlled via ethtool. This patch makes vlans keep HW_CSUM feature if the underlying device supports checksum offloading. This makes vlan devices behave like other software devices, and restores control to the user. A side-effect is that some offload settings (typically UFO) may be enabled on the vlan device while being disabled on the HW. However, the GSO code will correctly process the packets. This actually results in slightly better raw throughput. Signed-off-by: Vladislav Yasevich Acked-by: Alexander Duyck Signed-off-by: David S. Miller net/8021q/vlan_dev.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) commit 1b1fc3fddabfb8739ef2c8f04e05a9858b42c1f7 Author: Wei Wang Date: Fri May 5 12:53:23 2017 -0700 tcp: make congestion control optionally skip slow start after idle Congestion control modules that want full control over congestion control behavior do not want the cwnd modifications controlled by the sysctl_tcp_slow_start_after_idle code path. So skip those code paths for CC modules that use the cong_control() API. As an example, those cwnd effects are not desired for the BBR congestion control algorithm. Fixes: c0402760f565 ("tcp: new CC hook to set sending rate with rate_sample in any CA state") Signed-off-by: Wei Wang Signed-off-by: Yuchung Cheng Signed-off-by: Neal Cardwell Signed-off-by: David S. Miller include/net/tcp.h | 4 +++- net/ipv4/tcp_output.c | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-) commit 82486aa6f1b9bc8145e6d0fa2bc0b44307f3b875 Author: WANG Cong Date: Thu May 4 14:54:17 2017 -0700 ipv4: restore rt->fi for reference counting IPv4 dst could use fi->fib_metrics to store metrics but fib_info itself is refcnt'ed, so without taking a refcnt fi and fi->fib_metrics could be freed while dst metrics still points to it. This triggers use-after-free as reported by Andrey twice. This patch reverts commit 2860583fe840 ("ipv4: Kill rt->fi") to restore this reference counting. It is a quick fix for -net and -stable, for -net-next, as Eric suggested, we can consider doing reference counting for metrics itself instead of relying on fib_info. IPv6 is very different, it copies or steals the metrics from mx6_config in fib6_commit_metrics() so probably doesn't need a refcnt. Decnet has already done the refcnt'ing, see dn_fib_semantic_match(). Fixes: 2860583fe840 ("ipv4: Kill rt->fi") Reported-by: Andrey Konovalov Tested-by: Andrey Konovalov Signed-off-by: Cong Wang Acked-by: Eric Dumazet Signed-off-by: David S. Miller include/net/route.h | 1 + net/ipv4/route.c | 18 +++++++++++++++++- 2 files changed, 18 insertions(+), 1 deletion(-) commit dd727dad37297f497dc69ac00182abf9651e7b6c Merge: 13e0988 17f423b Author: Linus Torvalds Date: Mon May 8 11:30:05 2017 -0700 Merge tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 updates from Ted Ts'o: - add GETFSMAP support - some performance improvements for very large file systems and for random write workloads into a preallocated file - bug fixes and cleanups. * tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: jbd2: cleanup write flags handling from jbd2_write_superblock() ext4: mark superblock writes synchronous for nobarrier mounts ext4: inherit encryption xattr before other xattrs ext4: replace BUG_ON with WARN_ONCE in ext4_end_bio() ext4: avoid unnecessary transaction stalls during writeback ext4: preload block group descriptors ext4: make ext4_shutdown() static ext4: support GETFSMAP ioctls vfs: add common GETFSMAP ioctl definitions ext4: evict inline data when writing to memory map ext4: remove ext4_xattr_check_entry() ext4: rename ext4_xattr_check_names() to ext4_xattr_check_entries() ext4: merge ext4_xattr_list() into ext4_listxattr() ext4: constify static data that is never modified ext4: trim return value and 'dir' argument from ext4_insert_dentry() jbd2: fix dbench4 performance regression for 'nobarrier' mounts jbd2: Fix lockdep splat with generic/270 test mm: retry writepages() on ENOMEM when doing an data integrity writeback commit ef51042472f55b325fd7f2b26a2e29fd89757234 Author: Dan Williams Date: Mon May 8 10:55:27 2017 -0700 block, dax: move "select DAX" from BLOCK to FS_DAX For configurations that do not enable DAX filesystems or drivers, do not require the DAX core to be built. Given that the 'direct_access' method has been removed from 'block_device_operations', we can also go ahead and remove the block-related dax helper functions from fs/block_dev.c to drivers/dax/super.c. This keeps dax details out of the block layer and lets the DAX core be built as a module in the FS_DAX=n case. Filesystems need to include dax.h to call bdev_dax_supported(). Cc: linux-xfs@vger.kernel.org Cc: Jens Axboe Cc: "Theodore Ts'o" Cc: Matthew Wilcox Cc: Alexander Viro Cc: "Darrick J. Wong" Cc: Ross Zwisler Reviewed-by: Jan Kara Reported-by: Geert Uytterhoeven Signed-off-by: Dan Williams block/Kconfig | 1 - drivers/dax/super.c | 70 ++++++++++++++++++++++++++++++++++++++++++++++++++ fs/Kconfig | 1 + fs/block_dev.c | 66 ----------------------------------------------- fs/ext2/super.c | 1 + fs/ext4/super.c | 1 + fs/xfs/xfs_super.c | 1 + include/linux/blkdev.h | 2 -- include/linux/dax.h | 30 ++++++++++++++++++++-- 9 files changed, 102 insertions(+), 71 deletions(-) commit 74d71a01abef37f71d914f2105a4cb8712a2beb8 Author: Mike Galbraith Date: Sat May 6 06:14:43 2017 +0200 device-dax: Tell kbuild DEV_DAX_PMEM depends on DEV_DAX ERROR: "devm_create_dev_dax" [drivers/dax/dax_pmem.ko] undefined! ERROR: "alloc_dax_region" [drivers/dax/dax_pmem.ko] undefined! ERROR: "dax_region_put" [drivers/dax/dax_pmem.ko] undefined! Signed-off-by: Mike Galbraith Signed-off-by: Dan Williams drivers/dax/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5b47d59af68a8735e4637bacedcb4baf6f47c73f Author: Al Viro Date: Mon May 8 13:54:47 2017 -0400 fix braino in generic_file_read_iter() Wrong sign of iov_iter_revert() argument. Unfortunately, slipped through the testing, since most of the time we don't do anything to the iterator afterwards and potential oops on walking the iter->iov too far backwards is too infrequent to be easily triggered. Add a sanity check in iov_iter_revert() to catch bugs like this one; fortunately, the same braino hadn't happened in other callers, but we'd better have a warning if such thing crops up. Signed-off-by: Al Viro lib/iov_iter.c | 2 ++ mm/filemap.c | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) commit 2214c260c72b0bd94e6c1c19bf451686212025d3 Author: Artur Paszkiewicz Date: Mon May 8 11:56:55 2017 +0200 md: don't return -EAGAIN in md_allow_write for external metadata arrays This essentially reverts commit b5470dc5fc18 ("md: resolve external metadata handling deadlock in md_allow_write") with some adjustments. Since commit 6791875e2e53 ("md: make reconfig_mutex optional for writes to md sysfs files.") changing array_state to 'active' does not use mddev_lock() and will not cause a deadlock with md_allow_write(). This revert simplifies userspace tools that write to sysfs attributes like "stripe_cache_size" or "consistency_policy" because it removes the need for special handling for external metadata arrays, checking for EAGAIN and retrying the write. Signed-off-by: Artur Paszkiewicz Signed-off-by: Shaohua Li drivers/md/md.c | 20 ++++++++------------ drivers/md/md.h | 2 +- drivers/md/raid1.c | 9 +++------ drivers/md/raid5.c | 12 +++--------- 4 files changed, 15 insertions(+), 28 deletions(-) commit 3013c4983eb15f4ce8958e81922cdfd80f771d3e Author: Pavel Belous Date: Thu May 4 23:10:56 2017 +0300 aquantia: Fix "ethtool -S" crash when adapter down. This patch fixes the crash that happens when driver tries to collect statistics from already released "aq_vec" object. If adapter is in "down" state we still allow user to see statistics from HW. V2: fixed braces around "aq_vec_free". Fixes: 97bde5c4f909 ("net: ethernet: aquantia: Support for NIC-specific code") Signed-off-by: Pavel Belous Tested-by: David Arcari Signed-off-by: David S. Miller drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit ebd768579552a10682c2cbdfa657779dea62a01d Author: Colin Ian King Date: Mon May 8 11:44:40 2017 +0100 blk-mq: make __blk_mq_stop_hw_queues static Making __blk_mq_stop_hw_queues static fixes sparse warning: block/blk-mq.c:6: warning: symbol '__blk_mq_stop_hw_queues' was not declared. Should it be static? Fixes: 2719aa217e0d0 ("blk-mq: don't use sync workqueue flushing from drivers") Signed-off-by: Colin Ian King Signed-off-by: Jens Axboe block/blk-mq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 28cf22d0ba283deccc30b71de5f34d222cf9aa4c Author: Trond Myklebust Date: Sat May 6 12:19:11 2017 -0400 NFSv4: Fix exclusive create attributes encoding When using NFS4_CREATE_EXCLUSIVE4_1 mode, the client will overestimate the amount of space that it needs for the attributes because it does so before checking whether or not the server supports a given attribute. Fix by checking the attribute mask earlier. Signed-off-by: Trond Myklebust fs/nfs/nfs4xdr.c | 75 ++++++++++++++++++++++++++------------------------------ 1 file changed, 35 insertions(+), 40 deletions(-) commit 2e84611b3f4fa50e1f4c12f2966fcc7fb955d944 Author: Trond Myklebust Date: Fri May 5 13:02:42 2017 -0400 NFSv4: Fix an rcu lock leak The intention in the original patch was to release the lock when we put the inode, however something got screwed up. Reported-by: Jason Yan Fixes: 7b410d9ce460f ("pNFS: Delay getting the layout header in..") Cc: stable@vger.kernel.org # v4.10+ Signed-off-by: Trond Myklebust fs/nfs/callback_proc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 280771252c1bae0947215c59fb9ea6a8d9f8399d Author: Eric Auger Date: Mon Jan 9 16:28:27 2017 +0100 KVM: arm64: vgic-v3: KVM_DEV_ARM_VGIC_SAVE_PENDING_TABLES This patch adds a new attribute to GICV3 KVM device KVM_DEV_ARM_VGIC_GRP_CTRL group. This allows userspace to flush all GICR pending tables into guest RAM. Signed-off-by: Eric Auger Reviewed-by: Christoffer Dall Acked-by: Marc Zyngier arch/arm/include/uapi/asm/kvm.h | 1 + arch/arm64/include/uapi/asm/kvm.h | 1 + virt/kvm/arm/vgic/vgic-kvm-device.c | 20 +++++++++++++++ virt/kvm/arm/vgic/vgic-v3.c | 51 +++++++++++++++++++++++++++++++++++++ virt/kvm/arm/vgic/vgic.h | 1 + 5 files changed, 74 insertions(+) commit ccb1d791ab9e9d45be15a779e6a42fc661309af1 Author: Eric Auger Date: Wed Apr 12 14:13:27 2017 +0200 KVM: arm64: vgic-its: Fix pending table sync In its_sync_lpi_pending_table() we currently ignore the target_vcpu of the LPIs. We sync the pending bit found in the vcpu pending table even if the LPI is not targeting it. Also in vgic_its_cmd_handle_invall() we are supposed to read the config table data for the LPIs associated to the collection ID. At the moment we refresh all LPI config information. This patch passes a vpcu to vgic_copy_lpi_list() so that this latter returns a snapshot of the LPIs targeting this CPU and only those. Signed-off-by: Eric Auger Reviewed-by: Christoffer Dall Acked-by: Marc Zyngier virt/kvm/arm/vgic/vgic-its.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) commit eff484e0298da5a4d18ca82f5454c557fd942af5 Author: Eric Auger Date: Wed May 3 17:38:01 2017 +0200 KVM: arm64: vgic-its: ITT save and restore Implement routines to save and restore device ITT and their interrupt table entries (ITE). Signed-off-by: Eric Auger Reviewed-by: Christoffer Dall virt/kvm/arm/vgic/vgic-its.c | 116 +++++++++++++++++++++++++++++++++++++++++-- virt/kvm/arm/vgic/vgic.h | 4 ++ 2 files changed, 117 insertions(+), 3 deletions(-) commit 57a9a117154c93539e33161dd318e6aeb8c04efa Author: Eric Auger Date: Mon Jan 9 16:27:07 2017 +0100 KVM: arm64: vgic-its: Device table save/restore This patch saves the device table entries into guest RAM. Both flat table and 2 stage tables are supported. DeviceId indexing is used. For each device listed in the device table, we also save the translation table using the vgic_its_save/restore_itt routines. Those functions will be implemented in a subsequent patch. On restore, devices are re-allocated and their itt are re-built. Signed-off-by: Eric Auger Reviewed-by: Christoffer Dall virt/kvm/arm/vgic/vgic-its.c | 194 +++++++++++++++++++++++++++++++++++++++++-- virt/kvm/arm/vgic/vgic.h | 10 +++ 2 files changed, 199 insertions(+), 5 deletions(-) commit dceff7025851405412e1a180ddd0cf79c7cbc1d8 Author: Eric Auger Date: Tue Jan 31 14:36:14 2017 +0100 KVM: arm64: vgic-its: vgic_its_check_id returns the entry's GPA As vgic_its_check_id() computes the device/collection entry's GPA, let's return it so that new callers can retrieve it easily. Signed-off-by: Eric Auger Acked-by: Christoffer Dall Acked-by: Marc Zyngier virt/kvm/arm/vgic/vgic-its.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit ea1ad53e1e31a32dcbeae61b8d3d01cccedcffc5 Author: Eric Auger Date: Mon Jan 9 16:19:41 2017 +0100 KVM: arm64: vgic-its: Collection table save/restore The save path copies the collection entries into guest RAM at the GPA specified in the BASER register. This obviously requires the BASER to be set. The last written element is a dummy collection table entry. We do not index by collection ID as the collection entry can fit into 8 bytes while containing the collection ID. On restore path we re-allocate the collection objects. Signed-off-by: Eric Auger Reviewed-by: Christoffer Dall Reviewed-by: Marc Zyngier virt/kvm/arm/vgic/vgic-its.c | 100 ++++++++++++++++++++++++++++++++++++++++++- virt/kvm/arm/vgic/vgic.h | 9 ++++ 2 files changed, 107 insertions(+), 2 deletions(-) commit 920a7a8fa92ae0ec73c4f6d6f15c01f86017f20d Author: Eric Auger Date: Wed Feb 8 05:20:04 2017 +0100 KVM: arm64: vgic-its: Add infrastructure for table lookup Add a generic scan_its_table() helper whose role consists in scanning a contiguous table located in guest RAM and applying a callback on each entry. Entries can be handled as linked lists since the callback may return an id offset to the next entry and also indicate whether the entry is the last one. Helper functions also are added to compute the device/event ID offset to the next DTE/ITE. compute_next_devid_offset, compute_next_eventid_offset and scan_table will become static in subsequent patches Signed-off-by: Eric Auger Reviewed-by: Christoffer Dall Reviewed-by: Marc Zyngier virt/kvm/arm/vgic/vgic-its.c | 92 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 92 insertions(+) commit 528297f560add8b7cac2f401d6aeb5bb3d1ef345 Author: Eric Auger Date: Sun Dec 25 18:57:54 2016 +0100 KVM: arm64: vgic-its: vgic_its_alloc_ite/device Add two new helpers to allocate an its ite and an its device. This will avoid duplication on restore path. Signed-off-by: Eric Auger Reviewed-by: Christoffer Dall Reviewed-by: Marc Zyngier virt/kvm/arm/vgic/vgic-its.c | 68 ++++++++++++++++++++++++++++++-------------- 1 file changed, 47 insertions(+), 21 deletions(-) commit 3b65808f4b2914db175a048097956d59ec609e04 Author: Eric Auger Date: Sat Dec 24 18:48:04 2016 +0100 KVM: arm64: vgic-its: KVM_DEV_ARM_ITS_SAVE/RESTORE_TABLES Introduce new attributes in KVM_DEV_ARM_VGIC_GRP_CTRL group: - KVM_DEV_ARM_ITS_SAVE_TABLES: saves the ITS tables into guest RAM - KVM_DEV_ARM_ITS_RESTORE_TABLES: restores them into VGIC internal structures. We hold the vcpus lock during the save and restore to make sure no vcpu is running. At this stage the functionality is not yet implemented. Only the skeleton is put in place. Signed-off-by: Eric Auger [Given we will move the iodev register until setting the base addr] Reviewed-by: Christoffer Dall arch/arm/include/uapi/asm/kvm.h | 4 +- arch/arm64/include/uapi/asm/kvm.h | 4 +- virt/kvm/arm/vgic/vgic-its.c | 107 ++++++++++++++++++++++++++++++++++++-- 3 files changed, 109 insertions(+), 6 deletions(-) commit 06bd5359549d7a0a2759a08f07e3d13a7acc9ecc Author: Eric Auger Date: Thu May 4 11:36:32 2017 +0200 KVM: arm64: vgic-its: Read config and pending bit in add_lpi() When creating the lpi we now ask the redistributor what is the state of the LPI (priority, enabled, pending). Signed-off-by: Eric Auger Reviewed-by: Marc Zyngier Reviewed-by: Christoffer Dall virt/kvm/arm/vgic/vgic-its.c | 35 ++++++++++++++++++++++++----------- 1 file changed, 24 insertions(+), 11 deletions(-) commit 44de9d683847ba6dbac290bb8c9f1b773cbda746 Author: Eric Auger Date: Thu May 4 11:19:52 2017 +0200 KVM: arm64: vgic-v3: vgic_v3_lpi_sync_pending_status this new helper synchronizes the irq pending_latch with the LPI pending bit status found in rdist pending table. As the status is consumed, we reset the bit in pending table. As we need the PENDBASER_ADDRESS() in vgic-v3, let's move its definition in the irqchip header. We restore the full length of the field, ie [51:16]. Same for PROPBASER_ADDRESS with full field length of [51:12]. Signed-off-by: Eric Auger Reviewed-by: Marc Zyngier Reviewed-by: Christoffer Dall include/linux/irqchip/arm-gic-v3.h | 2 ++ virt/kvm/arm/vgic/vgic-its.c | 6 ++---- virt/kvm/arm/vgic/vgic-v3.c | 44 ++++++++++++++++++++++++++++++++++++++ virt/kvm/arm/vgic/vgic.h | 1 + 4 files changed, 49 insertions(+), 4 deletions(-) commit 07a3e9a7b8d2c5b0fa59b281f4480711bea8fa2b Author: Eric Auger Date: Thu Feb 2 14:37:33 2017 +0100 KVM: arm64: vgic-its: Check the device id matches TYPER DEVBITS range On MAPD we currently check the device id can be stored in the device table. Let's first check it can be encoded within the range defined by TYPER DEVBITS. Also check the collection ID belongs to the 16 bit range as GITS_TYPER CIL field equals to 0. Signed-off-by: Eric Auger Reviewed-by: Christoffer Dall Reviewed-by: Marc Zyngier virt/kvm/arm/vgic/vgic-its.c | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) commit 7333cefe7b147320debcc64ea41220bdd1dca723 Author: Eric Auger Date: Thu Feb 2 13:45:45 2017 +0100 KVM: arm64: vgic-its: Interpret MAPD ITT_addr field Up to now the MAPD ITT_addr had been ignored. We will need it for save/restore. Let's record it in the its_device struct. Signed-off-by: Eric Auger Reviewed-by: Christoffer Dall Reviewed-by: Marc Zyngier virt/kvm/arm/vgic/vgic-its.c | 4 ++++ 1 file changed, 4 insertions(+) commit 0d44cdb631ef53ea75be056886cf0541311e48df Author: Eric Auger Date: Thu Dec 22 18:14:14 2016 +0100 KVM: arm64: vgic-its: Interpret MAPD Size field and check related errors Up to now the MAPD's ITT size field has been ignored. It encodes the number of eventid bit minus 1. It should be used to check the eventid when a MAPTI command is issued on a device. Let's store the number of eventid bits in the its_device and do the check on MAPTI. Also make sure the ITT size field does not exceed the GITS_TYPER IDBITS field. Signed-off-by: Eric Auger Reviewed-by: Christoffer Dall Reviewed-by: Marc Zyngier include/linux/irqchip/arm-gic-v3.h | 2 ++ virt/kvm/arm/vgic/vgic-its.c | 15 ++++++++++++++- 2 files changed, 16 insertions(+), 1 deletion(-) commit ab01c6bdacc43c41c6b326889f4358f5afc38bf9 Author: Eric Auger Date: Thu Mar 23 15:14:00 2017 +0100 KVM: arm64: vgic-its: Implement vgic_mmio_uaccess_write_its_iidr The GITS_IIDR revision field is used to encode the migration ABI revision. So we need to restore it to check the table layout is readable by the destination. By writing the IIDR, userspace thus forces the ABI revision to be used and this must be less than or equal to the max revision KVM supports. Signed-off-by: Eric Auger Reviewed-by: Christoffer Dall include/linux/irqchip/arm-gic-v3.h | 5 +++++ virt/kvm/arm/vgic/vgic-its.c | 23 ++++++++++++++++++++--- 2 files changed, 25 insertions(+), 3 deletions(-) commit 71afe470e20db133b30730cfa856e5d6854312e9 Author: Eric Auger Date: Thu Apr 13 09:06:20 2017 +0200 KVM: arm64: vgic-its: Introduce migration ABI infrastructure We plan to support different migration ABIs, ie. characterizing the ITS table layout format in guest RAM. For example, a new ABI will be needed if vLPIs get supported for nested use case. So let's introduce an array of supported ABIs (at the moment a single ABI is supported though). The following characteristics are foreseen to vary with the ABI: size of table entries, save/restore operation, the way abi settings are applied. By default the MAX_ABI_REV is applied on its creation. In subsequent patches we will introduce a way for the userspace to change the ABI in use. The entry sizes now are set according to the ABI version and not hardcoded anymore. Signed-off-by: Eric Auger Reviewed-by: Christoffer Dall include/kvm/arm_vgic.h | 3 ++ include/linux/irqchip/arm-gic-v3.h | 5 ++ virt/kvm/arm/vgic/vgic-its.c | 93 ++++++++++++++++++++++++++++++++++++-- 3 files changed, 97 insertions(+), 4 deletions(-) commit 0979bfa69421279459b4516542503f1d577d2ec5 Author: Eric Auger Date: Wed Jan 4 11:58:41 2017 +0100 KVM: arm64: vgic-its: Implement vgic_mmio_uaccess_write_its_creadr GITS_CREADR needs to be restored so let's implement the associated uaccess_write_its callback. The write only is allowed if the its is disabled. Signed-off-by: Eric Auger Acked-by: Marc Zyngier Reviewed-by: Christoffer Dall virt/kvm/arm/vgic/vgic-its.c | 42 ++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 40 insertions(+), 2 deletions(-) commit 8331c23c28e8b7f70cb5c25366160d900ab127d7 Author: Eric Auger Date: Tue Dec 20 09:33:13 2016 +0100 KVM: arm64: vgic-its: Implement vgic_its_has_attr_regs and attr_regs_access This patch implements vgic_its_has_attr_regs and vgic_its_attr_regs_access upon the MMIO framework. VGIC ITS KVM device KVM_DEV_ARM_VGIC_GRP_ITS_REGS group becomes functional. At least GITS_CREADR and GITS_IIDR require to differentiate a guest write action from a user access. As such let's introduce a new uaccess_its_write vgic_register_region callback. Signed-off-by: Eric Auger Reviewed-by: Christoffer Dall Reviewed-by: Marc Zyngier virt/kvm/arm/vgic/vgic-its.c | 79 +++++++++++++++++++++++++++++++++++++++++-- virt/kvm/arm/vgic/vgic-mmio.h | 9 +++-- 2 files changed, 84 insertions(+), 4 deletions(-) commit dfc99f85c0a554b2885824654b1fc235bc4f9be9 Author: Eric Auger Date: Thu Mar 23 11:51:52 2017 +0100 KVM: arm/arm64: vgic: expose (un)lock_all_vcpus We need to use those helpers in vgic-its.c so let's expose them in the private vgic header. Signed-off-by: Eric Auger Acked-by: Marc Zyngier Acked-by: Christoffer Dall virt/kvm/arm/vgic/vgic-kvm-device.c | 4 ++-- virt/kvm/arm/vgic/vgic.h | 3 +++ 2 files changed, 5 insertions(+), 2 deletions(-) commit 876ae234cb5e908c12c60562295cd633eac687bb Author: Eric Auger Date: Tue Dec 20 01:36:35 2016 -0500 KVM: arm64: vgic-its: KVM_DEV_ARM_VGIC_GRP_ITS_REGS group The ITS KVM device exposes a new KVM_DEV_ARM_VGIC_GRP_ITS_REGS group which allows the userspace to save/restore ITS registers. At this stage the get/set/has operations are not yet implemented. Signed-off-by: Eric Auger Reviewed-by: Andre Przywara Reviewed-by: Christoffer Dall Acked-by: Marc Zyngier arch/arm/include/uapi/asm/kvm.h | 1 + arch/arm64/include/uapi/asm/kvm.h | 1 + virt/kvm/arm/vgic/vgic-its.c | 36 +++++++++++++++++++++++++++++++++++- 3 files changed, 37 insertions(+), 1 deletion(-) commit 4b7171ac564786247a49eedc59d3060bddf2377c Author: Eric Auger Date: Tue Dec 20 09:20:00 2016 +0100 arm/arm64: vgic: turn vgic_find_mmio_region into public We plan to use vgic_find_mmio_region in vgic-its.c so let's turn it into a public function. Also let's take the opportunity to rename the region parameter into regions to emphasize this latter is an array of regions. Signed-off-by: Eric Auger Reviewed-by: Andre Przywara Acked-by: Marc Zyngier Acked-by: Christoffer Dall virt/kvm/arm/vgic/vgic-mmio.c | 11 +++++------ virt/kvm/arm/vgic/vgic-mmio.h | 5 +++++ 2 files changed, 10 insertions(+), 6 deletions(-) commit 9ce91c7234ff477c805c3dec7cf54716193c7a48 Author: Eric Auger Date: Wed Feb 8 06:09:29 2017 +0100 KVM: arm/arm64: vgic-its: rename itte into ite The actual abbreviation for the interrupt translation table entry is ITE. Let's rename all itte instances by ite. Signed-off-by: Eric Auger Acked-by: Marc Zyngier Acked-by: Christoffer Dall virt/kvm/arm/vgic/vgic-its.c | 148 +++++++++++++++++++++---------------------- 1 file changed, 74 insertions(+), 74 deletions(-) commit 100e62983ef3a012e62e0e7116035529a286c1ec Author: Eric Auger Date: Fri Apr 14 10:18:12 2017 +0200 KVM: arm/arm64: Add GICV3 pending table save API documentation Add description for how to save GICV3 LPI pending bit into guest RAM pending tables. Signed-off-by: Eric Auger Acked-by: Christoffer Dall Acked-by: Marc Zyngier Documentation/virtual/kvm/devices/arm-vgic-v3.txt | 6 ++++++ 1 file changed, 6 insertions(+) commit de2a0910795d44d6534e0fe83c571c1bbbe05808 Author: Eric Auger Date: Mon Jan 9 14:59:24 2017 +0100 KVM: arm/arm64: Add ITS save/restore API documentation Add description for how to access ITS registers and how to save/restore ITS tables into/from memory. Reviewed-by: Christoffer Dall Signed-off-by: Eric Auger Documentation/virtual/kvm/devices/arm-vgic-its.txt | 120 +++++++++++++++++++++ 1 file changed, 120 insertions(+) commit 6406c91943a0f29b6e8786921aaa038663e08055 Author: Johannes Berg Date: Tue May 2 09:33:40 2017 +0200 cfg80211: fix multi scheduled scan kernel-doc Replace @results_wk with @report_results, which was missed in an earlier patch between revisions thereof. Fixes: b34939b98369 ("cfg80211: add request id to cfg80211_sched_scan_*() api") Signed-off-by: Johannes Berg Acked-by: Arend van Spriel Signed-off-by: Johannes Berg include/net/cfg80211.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3c5ab3f395d66a9e4e937fcfdf6ebc63894f028b Author: Julian Anastasov Date: Sat Apr 29 20:33:09 2017 +0300 ipvs: SNAT packet replies only for NATed connections We do not check if packet from real server is for NAT connection before performing SNAT. This causes problems for setups that use DR/TUN and allow local clients to access the real server directly, for example: - local client in director creates IPVS-DR/TUN connection CIP->VIP and the request packets are routed to RIP. Talks are finished but IPVS connection is not expired yet. - second local client creates non-IPVS connection CIP->RIP with same reply tuple RIP->CIP and when replies are received on LOCAL_IN we wrongly assign them for the first client connection because RIP->CIP matches the reply direction. As result, IPVS SNATs replies for non-IPVS connections. The problem is more visible to local UDP clients but in rare cases it can happen also for TCP or remote clients when the real server sends the reply traffic via the director. So, better to be more precise for the reply traffic. As replies are not expected for DR/TUN connections, better to not touch them. Reported-by: Nick Moriarty Tested-by: Nick Moriarty Signed-off-by: Julian Anastasov Signed-off-by: Simon Horman net/netfilter/ipvs/ip_vs_core.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) commit f1f3e9e2a50a70de908f9dfe0d870e9cdc67e042 Author: Johannes Berg Date: Thu Apr 27 13:19:04 2017 +0200 mac80211: fix IBSS presp allocation size When VHT IBSS support was added, the size of the extra elements wasn't considered in ieee80211_ibss_build_presp(), which makes it possible that it would overrun the allocated buffer. Fix it by allocating the necessary space. Fixes: abcff6ef01f9 ("mac80211: add VHT support for IBSS") Reported-by: Shaul Triebitz Signed-off-by: Johannes Berg net/mac80211/ibss.c | 2 ++ 1 file changed, 2 insertions(+) commit 4954601f821bb5afd4dd59b57bf801adf4924bbd Author: Johannes Berg Date: Thu Apr 27 09:13:38 2017 +0200 nl80211: correctly validate MU-MIMO groups Since groups 0 and 63 are invalid, we should check for those bits. Note that the 802.11 spec specifies the *bit* order, but the CPU doesn't care about bit order since it can't address bits, so it's always treating BIT(0) as the lowest bit within a byte. Reported-by: Jan Fuchs Signed-off-by: Johannes Berg net/wireless/nl80211.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit f8860ce836f2d502b07ef99559707fe55d90f5bc Author: Luca Coelho Date: Tue May 2 17:56:21 2017 +0300 mac80211: bail out from prep_connection() if a reconfig is ongoing If ieee80211_hw_restart() is called during authentication, the authentication process will continue, causing the driver to be called in a wrong state. This ultimately causes an oops in the iwlwifi driver (at least). This fixes bugzilla 195299 partly. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=195299 Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg net/mac80211/mlme.c | 4 ++++ 1 file changed, 4 insertions(+) commit 7f1e614113ffe75f5ea7c99f641bf1b56f85be03 Author: Ley Foon Tan Date: Mon May 8 17:14:14 2017 +0800 nios2: use generic strncpy_from_user() and strnlen_user() This change enables the generic strncpy_from_user() and strnlen_user() Signed-off-by: Ley Foon Tan arch/nios2/Kconfig | 2 ++ arch/nios2/include/asm/uaccess.h | 7 +++++-- arch/nios2/mm/uaccess.c | 33 --------------------------------- 3 files changed, 7 insertions(+), 35 deletions(-) commit 2f242bf45370b8ea44f209b22c3c90984655a102 Author: Johannes Berg Date: Fri May 5 11:53:19 2017 +0200 mac80211: properly remove RX_ENC_FLAG_40MHZ Somehow I missed this in my RX rate cleanup series, causing some drivers to not report correct bandwidth since this flag isn't used by mac80211 anymore. Fix this, and make hwsim also report higher bandwidths appropriately. Signed-off-by: Johannes Berg drivers/net/wireless/ath/ath9k/ar9003_mac.c | 2 +- drivers/net/wireless/ath/ath9k/mac.c | 4 ++-- drivers/net/wireless/intel/iwlegacy/4965-mac.c | 4 +++- drivers/net/wireless/intel/iwlwifi/dvm/rx.c | 4 +++- drivers/net/wireless/mac80211_hwsim.c | 8 +++++++- include/net/mac80211.h | 2 -- 6 files changed, 16 insertions(+), 8 deletions(-) commit edebea98777d7090ea14bdce2e38e6798557729d Author: Marek Vasut Date: Wed Apr 19 13:19:02 2017 +0200 nios2: Add CDX support Add support for the CDX Code Density Extensions present in Nios II R2 . This introduces new 16bit instruction set to improve code density while retaining support for the 32bit Nios II R2 instructions. Signed-off-by: Marek Vasut Cc: Ley Foon Tan arch/nios2/Makefile | 1 + arch/nios2/include/asm/cpuinfo.h | 1 + arch/nios2/kernel/cpuinfo.c | 10 ++++++++-- arch/nios2/platform/Kconfig.platform | 9 +++++++++ 4 files changed, 19 insertions(+), 2 deletions(-) commit 23460839b983d5d8d47fe90f341599f66523dd81 Author: Marek Vasut Date: Wed Apr 19 13:19:01 2017 +0200 nios2: Add BMX support Add support for the BMX Bit Manipulation Extensions present in Nios II R2 . This introduces three new instructions, EXTRACT, INSERT and MERGE. Signed-off-by: Marek Vasut Cc: Ley Foon Tan arch/nios2/Makefile | 1 + arch/nios2/include/asm/cpuinfo.h | 1 + arch/nios2/kernel/cpuinfo.c | 10 ++++++++-- arch/nios2/platform/Kconfig.platform | 9 +++++++++ 4 files changed, 19 insertions(+), 2 deletions(-) commit a89988a6e00c5a099ee23619cd91dc8dc7ec9328 Author: Marek Vasut Date: Wed Apr 19 13:19:00 2017 +0200 nios2: Add NIOS2_ARCH_REVISION to select between R1 and R2 Allow user to select between Nios2 R1 and R2. Since R1 and R2 are not binary compatible, we cannot have a single kernel binary and there is no point in having DT property for discerning these two. Signed-off-by: Marek Vasut Cc: Ley Foon Tan arch/nios2/Makefile | 3 +++ arch/nios2/kernel/cpuinfo.c | 2 ++ arch/nios2/platform/Kconfig.platform | 8 ++++++++ 3 files changed, 13 insertions(+) commit 4b40c1c092a932b5b5ab8154235080f02ae19a34 Author: Julien Beraud Date: Wed Apr 5 15:03:44 2017 +0800 nios2: implement flush_dcache_mmap_lock/unlock Use spin_lock/unlock_irq instead of doing nothing. This fixes corruptions of the vma_interval_tree causing the kernel to be stuck in an infinite loop in vma_interval_tree_foreach. Signed-off-by: Julien Beraud Acked-by: Ley Foon Tan arch/nios2/include/asm/cacheflush.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 44a4ed42576da5f3387005a1667cb3e7aedfd687 Author: Tobias Klauser Date: Sun Apr 2 20:09:04 2017 -0700 nios2: enable earlycon support Enable generic earlycon support for nios2. This e.g. allows to use a 8250/16650 UART as earlycon. In order to get the earlycon, we just need to call parse_early_param() in early_init_devtree() as soon as the device tree is initially scanned. By adding an stdout-path property to the dts (done in this patch for 10m50_devboard), the earlycon can be used. In order to provide early printk support, we need to provide a dummy implementation of early_console_write(), so that arch/nios2/kernel/early_printk.c can still be compiled if neither SERIAL_ALTERA_JTAGUART_CONSOLE nor SERIAL_ALTERA_UART_CONSOLE is selected. As soon as the altera_uart and altera_jtaguart support earlycon, the entire file can be removed. Tested-by: Guenter Roeck Signed-off-by: Tobias Klauser Acked-by: Ley Foon Tan arch/nios2/Kconfig.debug | 1 - arch/nios2/boot/dts/10m50_devboard.dts | 3 ++- arch/nios2/kernel/early_printk.c | 7 +++++-- arch/nios2/kernel/setup.c | 2 ++ 4 files changed, 9 insertions(+), 4 deletions(-) commit 57ac76ed6c0daf02c520e09e0af421f02ee2de8b Author: Tobias Klauser Date: Sun Apr 2 20:08:52 2017 -0700 nios2: constify irq_domain_ops struct irq_domain_ops is not modified, so it can be made const. Signed-off-by: Tobias Klauser Acked-by: Ley Foon Tan arch/nios2/kernel/irq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f679b311f0683be352cb73b28d7108eed79ef795 Author: Tobias Klauser Date: Sun Apr 2 20:08:40 2017 -0700 nios2: remove wrapper header for cmpxchg.h Since commit 713e9b802e21 ("nios2: Switch to generic __xchg()") asm/cmpxchg.h for nios2 is merely including asm-generic/cmpxchg.h. Thus, the wrapper can be omitted and the generic header can be used directly. Signed-off-by: Tobias Klauser Acked-by: Ley Foon Tan arch/nios2/include/asm/Kbuild | 1 + arch/nios2/include/asm/cmpxchg.h | 14 -------------- 2 files changed, 1 insertion(+), 14 deletions(-) commit 6852aa0263cdc4d43ab8e23735e6e0973cadeb63 Author: Tobias Klauser Date: Sun Apr 2 20:08:29 2017 -0700 nios2: add .gitignore entries for auto-generated files Add .gitignore entries for nios2 specific files generated during the build process. Signed-off-by: Tobias Klauser Acked-by: Ley Foon Tan arch/nios2/boot/.gitignore | 2 ++ arch/nios2/kernel/.gitignore | 1 + 2 files changed, 3 insertions(+) commit c3123d6adb715de12fb366a55c1dedc6aabd94b0 Author: Florin Tudorache Date: Fri May 5 19:40:06 2017 +0000 ALSA: hda - Add mute led support for HP EliteBook 840 G3 Signed-off-by: Florin Tudorache Signed-off-by: Takashi Iwai sound/pci/hda/patch_conexant.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 2345ab1df8a9aa3cdca942142b48eb141faeb1c3 Author: Chuanxiao Dong Date: Mon May 8 09:27:39 2017 +0800 drm/i915/gvt: not to restore in-context mmio Needn't to restore the in-context MMIO when SCHEDULE_OUT. Sometimes with restoring the in-context MMIO, some GPU hang can be observed. So remove the in-context MMIO restore Signed-off-by: Chuanxiao Dong Signed-off-by: Zhenyu Wang drivers/gpu/drm/i915/gvt/render.c | 3 +++ 1 file changed, 3 insertions(+) commit 2c1497bbc8fdee897341ab48ee9c9209b421b8c0 Author: Ilan Tayari Date: Mon May 8 10:30:18 2017 +0300 xfrm: Fix NETDEV_DOWN with IPSec offload Upon NETDEV_DOWN event, all xfrm_state objects which are bound to the device are flushed. The condition for this is wrong, though, testing dev->hw_features instead of dev->features. If a device has non-user-modifiable NETIF_F_HW_ESP, then its xfrm_state objects are not flushed, causing a crash later on after the device is deleted. Check dev->features instead of dev->hw_features. Fixes: d77e38e612a0 ("xfrm: Add an IPsec hardware offloading API") Signed-off-by: Ilan Tayari Signed-off-by: Steffen Klassert net/xfrm/xfrm_device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8638100c52bb7782462b14aad102a4aaf0c7094c Author: Xunlei Pang Date: Thu May 4 09:42:51 2017 +0800 x86/kexec/64: Use gbpages for identity mappings if available Kexec sets up all identity mappings before booting into the new kernel, and this will cause extra memory consumption for paging structures which is quite considerable on modern machines with huge memory sizes. E.g. on a 32TB machine that is kdumping, it could waste around 128MB (around 4MB/TB) from the reserved memory after kexec sets all the identity mappings using the current 2MB page. Add to that the memory needed for the loaded kdump kernel, initramfs, etc., and it causes a kexec syscall -NOMEM failure. As a result, we had to enlarge reserved memory via "crashkernel=X" to work around this problem. This causes some trouble for distributions that use policies to evaluate the proper "crashkernel=X" value for users. So enable gbpages for kexec mappings. Signed-off-by: Xunlei Pang Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Brian Gerst Cc: Dave Young Cc: Denys Vlasenko Cc: Eric Biederman Cc: H. Peter Anvin Cc: Josh Poimboeuf Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Yinghai Lu Cc: akpm@linux-foundation.org Cc: kexec@lists.infradead.org Link: http://lkml.kernel.org/r/1493862171-8799-2-git-send-email-xlpang@redhat.com Signed-off-by: Ingo Molnar arch/x86/kernel/machine_kexec_64.c | 4 ++++ 1 file changed, 4 insertions(+) commit 66aad4fdf2bf0af29c7decb4433dc5ec6c7c5451 Author: Xunlei Pang Date: Thu May 4 09:42:50 2017 +0800 x86/mm: Add support for gbpages to kernel_ident_mapping_init() Kernel identity mappings on x86-64 kernels are created in two ways: by the early x86 boot code, or by kernel_ident_mapping_init(). Native kernels (which is the dominant usecase) use the former, but the kexec and the hibernation code uses kernel_ident_mapping_init(). There's a subtle difference between these two ways of how identity mappings are created, the current kernel_ident_mapping_init() code creates identity mappings always using 2MB page(PMD level) - while the native kernel boot path also utilizes gbpages where available. This difference is suboptimal both for performance and for memory usage: kernel_ident_mapping_init() needs to allocate pages for the page tables when creating the new identity mappings. This patch adds 1GB page(PUD level) support to kernel_ident_mapping_init() to address these concerns. The primary advantage would be better TLB coverage/performance, because we'd utilize 1GB TLBs instead of 2MB ones. It is also useful for machines with large number of memory to save paging structure allocations(around 4MB/TB using 2MB page) when setting identity mappings for all the memory, after using 1GB page it will consume only 8KB/TB. ( Note that this change alone does not activate gbpages in kexec, we are doing that in a separate patch. ) Signed-off-by: Xunlei Pang Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Brian Gerst Cc: Dave Young Cc: Denys Vlasenko Cc: Eric Biederman Cc: H. Peter Anvin Cc: Josh Poimboeuf Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Yinghai Lu Cc: akpm@linux-foundation.org Cc: kexec@lists.infradead.org Link: http://lkml.kernel.org/r/1493862171-8799-1-git-send-email-xlpang@redhat.com Signed-off-by: Ingo Molnar arch/x86/boot/compressed/pagetable.c | 2 +- arch/x86/include/asm/init.h | 3 ++- arch/x86/kernel/machine_kexec_64.c | 2 +- arch/x86/mm/ident_map.c | 14 +++++++++++++- arch/x86/power/hibernate_64.c | 2 +- 5 files changed, 18 insertions(+), 5 deletions(-) commit d90c902449a7561f1b1d58ba5a0d11728ce8b0b2 Author: Steffen Klassert Date: Fri May 5 07:40:42 2017 +0200 af_key: Fix slab-out-of-bounds in pfkey_compile_policy. The sadb_x_sec_len is stored in the unit 'byte divided by eight'. So we have to multiply this value by eight before we can do size checks. Otherwise we may get a slab-out-of-bounds when we memcpy the user sec_ctx. Fixes: df71837d502 ("[LSM-IPSec]: Security association restriction.") Reported-by: Andrey Konovalov Tested-by: Andrey Konovalov Signed-off-by: Steffen Klassert net/key/af_key.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 629b1b2e0e6c8285fdc21624af60e8190fa4417e Author: Geert Uytterhoeven Date: Sun May 7 16:14:44 2017 +0200 lightnvm: remove unused rq parameter of nvme_nvm_rqtocmd() to kill warning With gcc 4.1.2: drivers/nvme/host/lightnvm.c: In function ‘nvme_nvm_submit_io’: drivers/nvme/host/lightnvm.c:498: warning: ‘rq’ is used uninitialized in this function Indeed, since commit 2e13f33a2464fc3a ("lightnvm: create cmd before allocating request"), the request is passed to nvme_nvm_rqtocmd() before it is allocated. Fortunately, as of commit 91276162de9476b8 ("lightnvm: refactor end_io functions for sync"), nvme_nvm_rqtocmd () no longer uses the passed request, so this warning is a false positive. Drop the unused parameter to clean up the code and kill the warning. Fixes: 2e13f33a2464fc3a ("lightnvm: create cmd before allocating request") Fixes: 91276162de9476b8 ("lightnvm: refactor end_io functions for sync") Signed-off-by: Geert Uytterhoeven Signed-off-by: Jens Axboe drivers/nvme/host/lightnvm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 51d638b1f56a0bfd9219800620994794a1a2b219 Author: Wanpeng Li Date: Sun May 7 00:14:22 2017 -0700 block/mq: fix potential deadlock during cpu hotplug This can be triggered by hot-unplug one cpu. ====================================================== [ INFO: possible circular locking dependency detected ] 4.11.0+ #17 Not tainted ------------------------------------------------------- step_after_susp/2640 is trying to acquire lock: (all_q_mutex){+.+...}, at: [] blk_mq_queue_reinit_work+0x18/0x110 but task is already holding lock: (cpu_hotplug.lock){+.+.+.}, at: [] cpu_hotplug_begin+0x7f/0xe0 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (cpu_hotplug.lock){+.+.+.}: lock_acquire+0x11c/0x230 __mutex_lock+0x92/0x990 mutex_lock_nested+0x1b/0x20 get_online_cpus+0x64/0x80 blk_mq_init_allocated_queue+0x3a0/0x4e0 blk_mq_init_queue+0x3a/0x60 loop_add+0xe5/0x280 loop_init+0x124/0x177 do_one_initcall+0x53/0x1c0 kernel_init_freeable+0x1e3/0x27f kernel_init+0xe/0x100 ret_from_fork+0x31/0x40 -> #0 (all_q_mutex){+.+...}: __lock_acquire+0x189a/0x18a0 lock_acquire+0x11c/0x230 __mutex_lock+0x92/0x990 mutex_lock_nested+0x1b/0x20 blk_mq_queue_reinit_work+0x18/0x110 blk_mq_queue_reinit_dead+0x1c/0x20 cpuhp_invoke_callback+0x1f2/0x810 cpuhp_down_callbacks+0x42/0x80 _cpu_down+0xb2/0xe0 freeze_secondary_cpus+0xb6/0x390 suspend_devices_and_enter+0x3b3/0xa40 pm_suspend+0x129/0x490 state_store+0x82/0xf0 kobj_attr_store+0xf/0x20 sysfs_kf_write+0x45/0x60 kernfs_fop_write+0x135/0x1c0 __vfs_write+0x37/0x160 vfs_write+0xcd/0x1d0 SyS_write+0x58/0xc0 do_syscall_64+0x8f/0x710 return_from_SYSCALL_64+0x0/0x7a other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(cpu_hotplug.lock); lock(all_q_mutex); lock(cpu_hotplug.lock); lock(all_q_mutex); *** DEADLOCK *** 8 locks held by step_after_susp/2640: #0: (sb_writers#6){.+.+.+}, at: [] vfs_write+0x1ad/0x1d0 #1: (&of->mutex){+.+.+.}, at: [] kernfs_fop_write+0x101/0x1c0 #2: (s_active#166){.+.+.+}, at: [] kernfs_fop_write+0x109/0x1c0 #3: (pm_mutex){+.+...}, at: [] pm_suspend+0x21d/0x490 #4: (acpi_scan_lock){+.+.+.}, at: [] acpi_scan_lock_acquire+0x17/0x20 #5: (cpu_add_remove_lock){+.+.+.}, at: [] freeze_secondary_cpus+0x27/0x390 #6: (cpu_hotplug.dep_map){++++++}, at: [] cpu_hotplug_begin+0x5/0xe0 #7: (cpu_hotplug.lock){+.+.+.}, at: [] cpu_hotplug_begin+0x7f/0xe0 stack backtrace: CPU: 3 PID: 2640 Comm: step_after_susp Not tainted 4.11.0+ #17 Hardware name: Dell Inc. OptiPlex 7040/0JCTF8, BIOS 1.4.9 09/12/2016 Call Trace: dump_stack+0x99/0xce print_circular_bug+0x1fa/0x270 __lock_acquire+0x189a/0x18a0 lock_acquire+0x11c/0x230 ? lock_acquire+0x11c/0x230 ? blk_mq_queue_reinit_work+0x18/0x110 ? blk_mq_queue_reinit_work+0x18/0x110 __mutex_lock+0x92/0x990 ? blk_mq_queue_reinit_work+0x18/0x110 ? kmem_cache_free+0x2cb/0x330 ? anon_transport_class_unregister+0x20/0x20 ? blk_mq_queue_reinit_work+0x110/0x110 mutex_lock_nested+0x1b/0x20 ? mutex_lock_nested+0x1b/0x20 blk_mq_queue_reinit_work+0x18/0x110 blk_mq_queue_reinit_dead+0x1c/0x20 cpuhp_invoke_callback+0x1f2/0x810 ? __flow_cache_shrink+0x160/0x160 cpuhp_down_callbacks+0x42/0x80 _cpu_down+0xb2/0xe0 freeze_secondary_cpus+0xb6/0x390 suspend_devices_and_enter+0x3b3/0xa40 ? rcu_read_lock_sched_held+0x79/0x80 pm_suspend+0x129/0x490 state_store+0x82/0xf0 kobj_attr_store+0xf/0x20 sysfs_kf_write+0x45/0x60 kernfs_fop_write+0x135/0x1c0 __vfs_write+0x37/0x160 ? rcu_read_lock_sched_held+0x79/0x80 ? rcu_sync_lockdep_assert+0x2f/0x60 ? __sb_start_write+0xd9/0x1c0 ? vfs_write+0x1ad/0x1d0 vfs_write+0xcd/0x1d0 SyS_write+0x58/0xc0 ? rcu_read_lock_sched_held+0x79/0x80 do_syscall_64+0x8f/0x710 ? trace_hardirqs_on_thunk+0x1a/0x1c entry_SYSCALL64_slow_path+0x25/0x25 The cpu hotplug path will hold cpu_hotplug.lock and then reinit all exiting queues for blk mq w/ all_q_mutex, however, blk_mq_init_allocated_queue() will contend these two locks in the inversion order. This is due to commit eabe06595d62 (blk/mq: Cure cpu hotplug lock inversion), it fixes a cpu hotplug lock inversion issue because of hotplug rework, however the hotplug rework is still work-in-progress and lives in a -tip branch and mainline cannot yet trigger that splat. The commit breaks the linus's tree in the merge window, so this patch reverts the lock order and avoids to splat linus's tree. Cc: Jens Axboe Cc: Peter Zijlstra (Intel) Cc: Thomas Gleixner Signed-off-by: Wanpeng Li Signed-off-by: Jens Axboe block/blk-mq.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit bd2c52d733f126ff75f99c537a27655b2db07e28 Author: Bart Van Assche Date: Thu May 4 15:50:54 2017 -0700 IB/srpt: Avoid that aborting a command triggers a kernel warning Avoid that the following warning is triggered: WARNING: CPU: 10 PID: 166 at ../drivers/infiniband/ulp/srpt/ib_srpt.c:2674 srpt_release_cmd+0x139/0x140 [ib_srpt] CPU: 10 PID: 166 Comm: kworker/u24:8 Not tainted 4.9.4-1-default #1 Workqueue: tmr-fileio target_tmr_work [target_core_mod] Call Trace: [] dump_stack+0x63/0x83 [] __warn+0xcb/0xf0 [] warn_slowpath_null+0x1d/0x20 [] srpt_release_cmd+0x139/0x140 [ib_srpt] [] target_release_cmd_kref+0xb7/0x120 [target_core_mod] [] target_put_sess_cmd+0x2f/0x60 [target_core_mod] [] core_tmr_lun_reset+0x340/0x790 [target_core_mod] [] target_tmr_work+0xe6/0x140 [target_core_mod] [] process_one_work+0x1f3/0x4d0 [] worker_thread+0x48/0x4e0 [] ? process_one_work+0x4d0/0x4d0 [] kthread+0xca/0xe0 [] ? kthread_park+0x60/0x60 [] ret_from_fork+0x25/0x30 Signed-off-by: Bart Van Assche Reviewed-by: Hannes Reinecke Cc: Doug Ledford Cc: Christoph Hellwig Cc: David Disseldorp Signed-off-by: Nicholas Bellinger drivers/infiniband/ulp/srpt/ib_srpt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 55d694275f41a1c0eef4ef49044ff29bc3999490 Author: Bart Van Assche Date: Thu May 4 15:50:53 2017 -0700 IB/srpt: Fix abort handling Let the target core check the CMD_T_ABORTED flag instead of the SRP target driver. Hence remove the transport_check_aborted_status() call. Since state == SRPT_STATE_CMD_RSP_SENT is something that really should not happen, do not try to recover if srpt_queue_response() is called for an I/O context that is in that state. This patch is a bug fix because the srpt_abort_cmd() call is misplaced - if that function is called from srpt_queue_response() it should either be called before the command state is changed or after the response has been sent. Signed-off-by: Bart Van Assche Reviewed-by: Hannes Reinecke Cc: Doug Ledford Cc: Christoph Hellwig Cc: Andy Grover Cc: David Disseldorp Signed-off-by: Nicholas Bellinger drivers/infiniband/ulp/srpt/ib_srpt.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) commit 59ac9c078141b8fd0186c0b18660a1b2c24e724e Author: Bart Van Assche Date: Thu May 4 15:50:47 2017 -0700 target/fileio: Fix zero-length READ and WRITE handling This patch fixes zero-length READ and WRITE handling in target/FILEIO, which was broken a long time back by: Since: commit d81cb44726f050d7cf1be4afd9cb45d153b52066 Author: Paolo Bonzini Date: Mon Sep 17 16:36:11 2012 -0700 target: go through normal processing for all zero-length commands which moved zero-length READ and WRITE completion out of target-core, to doing submission into backend driver code. To address this, go ahead and invoke target_complete_cmd() for any non negative return value in fd_do_rw(). Signed-off-by: Bart Van Assche Reviewed-by: Hannes Reinecke Reviewed-by: Christoph Hellwig Cc: Andy Grover Cc: David Disseldorp Cc: # v3.7+ Signed-off-by: Nicholas Bellinger drivers/target/target_core_file.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit f55813b4d8bfc9f35fda87bc1e21b7f26835fc5c Author: Masahiro Yamada Date: Thu May 4 10:14:57 2017 +0900 kbuild: dtbinst: remove unnecessary __dtbs_install_prep target Since commit 5399eb9b3908 ("dtbsinstall: don't move target directory out of the way"), the target __dtbs_install_prep is invoked just for creating the install directory, but all the necessary directories are automatically created by: cmd_dtb_install = mkdir -p $(2); cp $< $(2) Signed-off-by: Masahiro Yamada scripts/Makefile.dtbinst | 8 -------- 1 file changed, 8 deletions(-) commit 4706aa075662fe3cad29c3f49b50878de53f4f3b Author: Benjamin Valentin Date: Sun May 7 14:49:09 2017 -0700 Input: xpad - add USB IDs for Mad Catz Brawlstick and Razer Sabertooth Add USB IDs for two more Xbox 360 controllers. I found them in the pull requests for the xboxdrv userspace driver, which seems abandoned. Thanks to psychogony and mkaito for reporting the IDs there! Signed-off-by: Benjamin Valentin Reviewed-by: Cameron Gutman Signed-off-by: Dmitry Torokhov drivers/input/joystick/xpad.c | 2 ++ 1 file changed, 2 insertions(+) commit 44bc722593201da43862b7200ee0b98155410b07 Author: Benjamin Valentin Date: Sun May 7 14:48:14 2017 -0700 Input: xpad - sync supported devices with xboxdrv The userspace xboxdrv driver [0] contains some USB IDs unknown to the kernel driver. I have created a simple script [1] to extract the missing devices and add them to xpad. A quick google search confirmed that all the new devices called Fightstick/pad are Arcade-type devices [2] where the MAP_TRIGGERS_TO_BUTTONS option should apply. There are some similar devices in the existing device table where this flag is not set, but I did refrain from changing those. [0] https://github.com/xboxdrv/xboxdrv/blob/stable/src/xpad_device.cpp [1] http://codepad.org/CHV98BNH [2] https://www.google.com/search?q=SFxT+Fightstick+Pro&tbm=isch Signed-off-by: Benjamin Valentin Reviewed-by: Cameron Gutman Signed-off-by: Dmitry Torokhov drivers/input/joystick/xpad.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit 873cb582738fde338ecaeaca594560cde2ba42c3 Author: Benjamin Valentin Date: Sun May 7 14:45:08 2017 -0700 Input: xpad - sort supported devices by USB ID Some entries in the table of supported devices are out of order. To not create a mess when adding new ones using a script, sort them first. Signed-off-by: Benjamin Valentin Reviewed-by: Cameron Gutman Signed-off-by: Dmitry Torokhov drivers/input/joystick/xpad.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 1c005f9c129201121ef90bde57c374a4403ccfa6 Author: Javier Martinez Canillas Date: Fri Apr 28 00:22:15 2017 -0400 MAINTAINERS: Remove Javier Martinez Canillas as reviewer for Exynos I left Samsung and lost access to most Exynos hardware and documentation. Also, I likely won't be able to keep an eye on the platform anymore in the short term so remove myself as a reviewer for Exynos. Signed-off-by: Javier Martinez Canillas Signed-off-by: Krzysztof Kozlowski MAINTAINERS | 1 - 1 file changed, 1 deletion(-) commit 2a4e669dd611855d89d938063c10f44cb67ce65d Merge: 062b1c1 fbe22d2 Author: Max Filippov Date: Sun May 7 10:39:03 2017 -0700 Merge branch 'xtensa-sim-params' into xtensa-fixes commit f35327f16b0cbe51d47a366aaf5dd9a3d4fac01b Author: Eduardo Molinas Date: Mon May 1 18:45:59 2017 -0400 iio: adc: sun4i-gpadc-iio: Fix module autoload when OF devices are registered If the driver is built as a module, it won't be autloaded if the devices are registered via OF code because the OF device table entries are not exported as aliases Before the patch: $ modinfo drivers/iio/adc/sun4i-gpadc-iio.ko | grep alias alias: platform:sun6i-a31-gpadc-iio alias: platform:sun5i-a13-gpadc-iio alias: platform:sun4i-a10-gpadc-iio After the patch: $ modinfo drivers/iio/adc/sun4i-gpadc-iio.ko | grep alias alias: of:N*T*Callwinner,sun8i-a33-thsC* alias: of:N*T*Callwinner,sun8i-a33-ths alias: platform:sun6i-a31-gpadc-iio alias: platform:sun5i-a13-gpadc-iio alias: platform:sun4i-a10-gpadc-iio Signed-off-by: Eduardo Molinas Signed-off-by: Jonathan Cameron drivers/iio/adc/sun4i-gpadc-iio.c | 1 + 1 file changed, 1 insertion(+) commit f83e36e0a372c012a31d57e9d3e69d29a158264e Author: Eduardo Molinas Date: Mon May 1 18:45:58 2017 -0400 iio: adc: sun4i-gpadc-iio: Fix module autoload when PLATFORM devices are registered If the driver is built as a module, it won't be autloaded if the devices are registered via PLATFORM code because the PLATFORM device table entries are not exported as aliases Before the patch: $ modinfo drivers/iio/adc/sun4i-gpadc-iio.ko | grep alias $ After the patch: $ modinfo drivers/iio/adc/sun4i-gpadc-iio.ko | grep alias alias: platform:sun6i-a31-gpadc-iio alias: platform:sun5i-a13-gpadc-iio alias: platform:sun4i-a10-gpadc-iio Signed-off-by: Eduardo Molinas Acked-by: Chen-Yu Tsai Signed-off-by: Jonathan Cameron drivers/iio/adc/sun4i-gpadc-iio.c | 1 + 1 file changed, 1 insertion(+) commit 9122b54f266ddee09654fe3fbc503c1a60f4a01c Author: Matt Ranostay Date: Thu May 4 17:32:19 2017 -0700 iio: proximity: as3935: fix iio_trigger_poll issue Using iio_trigger_poll() can oops when multiple interrupts happen before the first is handled. Use iio_trigger_poll_chained() instead and use the timestamp when processed, since it will be in theory be 2 ms max latency. Fixes: 24ddb0e4bba4 ("iio: Add AS3935 lightning sensor support") Cc: stable@vger.kernel.org Signed-off-by: Matt Ranostay Signed-off-by: Jonathan Cameron drivers/iio/proximity/as3935.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 60854a12d281e2fa25662fa32ac8022bbff17432 Author: Kees Cook Date: Fri May 5 21:51:16 2017 -0700 x86/boot: Declare error() as noreturn The compressed boot function error() is used to halt execution, but it wasn't marked with "noreturn". This fixes that in preparation for supporting kernel FORTIFY_SOURCE, which uses the noreturn annotation on panic, and calls error(). GCC would warn about a noreturn function calling a non-noreturn function: arch/x86/boot/compressed/misc.c: In function ‘fortify_panic’: arch/x86/boot/compressed/misc.c:416:1: warning: ‘noreturn’ function does return } ^ Signed-off-by: Kees Cook Cc: Daniel Micay Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: H. Peter Anvin Link: http://lkml.kernel.org/r/20170506045116.GA2879@beast Signed-off-by: Ingo Molnar arch/x86/boot/compressed/error.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 13e0988140374123bead1dd27c287354cb95108e Author: Max Filippov Date: Sat May 6 15:39:25 2017 -0700 docs: complete bumping minimal GNU Make version to 3.81 Commit 37d69ee30808 ("docs: bump minimal GNU Make version to 3.81") changes one entry of GNU make version in the changes.rst, there's still one more entry saying that one need version 3.80. Fix that. Signed-off-by: Max Filippov Signed-off-by: Linus Torvalds Documentation/process/changes.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fe7a719b30dfdb4d55680461954b99b257ebe671 Merge: d484467 85435d7 Author: Linus Torvalds Date: Sat May 6 11:51:46 2017 -0700 Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6 Pull cifs fixes from Steve French: "Various fixes for stable for CIFS/SMB3 especially for better interoperability for SMB3 to Macs. It also includes Pavel's improvements to SMB3 async i/o support (which is much faster now)" * 'for-next' of git://git.samba.org/sfrench/cifs-2.6: CIFS: add misssing SFM mapping for doublequote SMB3: Work around mount failure when using SMB3 dialect to Macs cifs: fix CIFS_IOC_GET_MNT_INFO oops CIFS: fix mapping of SFM_SPACE and SFM_PERIOD CIFS: fix oplock break deadlocks cifs: fix CIFS_ENUMERATE_SNAPSHOTS oops cifs: fix leak in FSCTL_ENUM_SNAPS response handling Set unicode flag on cifs echo request to avoid Mac error CIFS: Add asynchronous write support through kernel AIO CIFS: Add asynchronous read support through kernel AIO CIFS: Add asynchronous context to support kernel AIO cifs: fix IPv6 link local, with scope id, address parsing cifs: small underflow in cnvrtDosUnixTm() commit d484467c860dab3e17893d23b2238e1f581460fa Merge: 044f1da 161f55e Author: Linus Torvalds Date: Sat May 6 11:46:16 2017 -0700 Merge tag 'xfs-4.12-merge-7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs updates from Darrick Wong: "Here are the XFS changes for 4.12. The big new feature for this release is the new space mapping ioctl that we've been discussing since LSF2016, but other than that most of the patches are larger bug fixes, memory corruption prevention, and other cleanups. Summary: - various code cleanups - introduce GETFSMAP ioctl - various refactoring - avoid dio reads past eof - fix memory corruption and other errors with fragmented directory blocks - fix accidental userspace memory corruptions - publish fs uuid in superblock - make fstrim terminatable - fix race between quotaoff and in-core inode creation - avoid use-after-free when finishing up w/ buffer heads - reserve enough space to handle bmap tree resizing during cow remap" * tag 'xfs-4.12-merge-7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (53 commits) xfs: fix use-after-free in xfs_finish_page_writeback xfs: reserve enough blocks to handle btree splits when remapping xfs: wait on new inodes during quotaoff dquot release xfs: update ag iterator to support wait on new inodes xfs: support ability to wait on new inodes xfs: publish UUID in struct super_block xfs: Allow user to kill fstrim process xfs: better log intent item refcount checking xfs: fix up quotacheck buffer list error handling xfs: remove xfs_trans_ail_delete_bulk xfs: don't use bool values in trace buffers xfs: fix getfsmap userspace memory corruption while setting OF_LAST xfs: fix __user annotations for xfs_ioc_getfsmap xfs: corruption needs to respect endianess too! xfs: use NULL instead of 0 to initialize a pointer in xfs_ioc_getfsmap xfs: use NULL instead of 0 to initialize a pointer in xfs_getfsmap xfs: simplify validation of the unwritten extent bit xfs: remove unused values from xfs_exntst_t xfs: remove the unused XFS_MAXLINK_1 define xfs: more do_div cleanups ... commit 044f1daaaaf7c86bc4fcf433848b7baae236946b Merge: d557d1b daaadb3 Author: Linus Torvalds Date: Sat May 6 11:25:08 2017 -0700 Merge branch 'for-linus' of git://git.kernel.dk/linux-block Pull block fixes and updates from Jens Axboe: "Some fixes and followup features/changes that should go in, in this merge window. This contains: - Two fixes for lightnvm from Javier, fixing problems in the new code merge previously in this merge window. - A fix from Jan for the backing device changes, fixing an issue in NFS that causes a failure to mount on certain setups. - A change from Christoph, cleaning up the blk-mq init and exit request paths. - Remove elevator_change(), which is now unused. From Bart. - A fix for queue operation invocation on a dead queue, from Bart. - A series fixing up mtip32xx for blk-mq scheduling, removing a bandaid we previously had in place for this. From me. - A regression fix for this series, fixing a case where we wait on workqueue flushing from an invalid (non-blocking) context. From me. - A fix/optimization from Ming, ensuring that we don't both quiesce and freeze a queue at the same time. - A fix from Peter on lock ordering for CPU hotplug. Not a real problem right now, but will be once the CPU hotplug rework goes in. - A series from Omar, cleaning up out blk-mq debugfs support, and adding support for exporting info from schedulers in debugfs as well. This is really useful in debugging stalls or livelocks. From Omar" * 'for-linus' of git://git.kernel.dk/linux-block: (28 commits) mq-deadline: add debugfs attributes kyber: add debugfs attributes blk-mq-debugfs: allow schedulers to register debugfs attributes blk-mq: untangle debugfs and sysfs blk-mq: move debugfs declarations to a separate header file blk-mq: Do not invoke queue operations on a dead queue blk-mq-debugfs: get rid of a bunch of boilerplate blk-mq-debugfs: rename hw queue directories from to hctx blk-mq-debugfs: don't open code strstrip() blk-mq-debugfs: error on long write to queue "state" file blk-mq-debugfs: clean up flag definitions blk-mq-debugfs: separate flags with | nfs: Fix bdi handling for cloned superblocks block/mq: Cure cpu hotplug lock inversion lightnvm: fix bad back free on error path lightnvm: create cmd before allocating request blk-mq: don't use sync workqueue flushing from drivers mtip32xx: convert internal commands to regular block infrastructure mtip32xx: cleanup internal tag assumptions block: don't call blk_mq_quiesce_queue() after queue is frozen ... commit d557d1b58b3546bab2c5bc2d624c5709840e6b10 Author: Greg Kroah-Hartman Date: Thu May 4 15:51:03 2017 -0700 refcount: change EXPORT_SYMBOL markings Now that kref is using the refcount apis, the _GPL markings are getting exported to places that it previously wasn't. Now kref.h is GPLv2 licensed, so any non-GPL code using it better be talking to some lawyers, but changing api markings isn't considered "nice", so let's fix this up. Signed-off-by: Greg Kroah-Hartman Signed-off-by: Linus Torvalds lib/refcount.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) commit 37d69ee30808110bd8336d65af3f999a7a475e1d Author: Masahiro Yamada Date: Sun May 7 00:39:17 2017 +0900 docs: bump minimal GNU Make version to 3.81 Since 2014, you can't successfully build kernels with GNU Make version 3.80. Example errors: $ git describe v4.11 $ make --version | head -1 GNU Make 3.80 $ make defconfig HOSTCC scripts/basic/fixdep scripts/Makefile.host:135: *** missing separator. Stop. make: *** [defconfig] Error 2 $ make ARCH=arm64 help arch/arm64/Makefile:43: *** unterminated call to function `warning': missing `)'. Stop. $ make help >/dev/null ./Documentation/Makefile.sphinx:25: Extraneous text after `else' directive ./Documentation/Makefile.sphinx:31: *** only one `else' per conditional. Stop. make: *** [help] Error 2 The first breakage was introduced by commit c8589d1e9e01 ("kbuild: handle multi-objs dependency appropriately"). Since then (i.e. v3.18), GNU Make 3.80 has not been able to compile the kernel, but nobody has ever complained aboutt (or noticed) it. Even GNU Make 3.81 is more than 10 years old. It would not hurt to match the documentation with reality instead of fixing makefiles. Signed-off-by: Masahiro Yamada Signed-off-by: Linus Torvalds Documentation/process/changes.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 394e4f5d5834b610ee032cceb20a1b1f45b01d28 Author: Linus Torvalds Date: Sat May 6 10:27:13 2017 -0700 initramfs: avoid "label at end of compound statement" error Commit 17a9be317475 ("initramfs: Always do fput() and load modules after rootfs populate") introduced an error for the CONFIG_BLK_DEV_RAM=y case, because even though the code looks fine, the compiler really wants a statement after a label, or you'll get complaints: init/initramfs.c: In function 'populate_rootfs': init/initramfs.c:644:2: error: label at end of compound statement That commit moved the subsequent statements to outside the compound statement, leaving the label without any associated statements. Reported-by: Jörg Otte Fixes: 17a9be317475 ("initramfs: Always do fput() and load modules after rootfs populate") Cc: Al Viro Cc: Stafford Horne Cc: stable@vger.kernel.org # if 17a9be317475 gets backported Signed-off-by: Linus Torvalds init/initramfs.c | 1 + 1 file changed, 1 insertion(+) commit cb15c81a0c1c1f7829b9809a209ecacc77f5aa63 Merge: bb4d5e3 e4cb5bb Author: Zhang Rui Date: Sat May 6 19:31:19 2017 +0800 Merge branch 'thermal-soc' into next commit e4cb5bb286af409d814e4d13c650a736769b854b Merge: 39da7c5 05d7839 Author: Zhang Rui Date: Sat May 6 19:30:53 2017 +0800 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal into thermal-soc commit 25e78531268e9240fc594ce76587601b873d37c9 Author: Bryant G. Ly Date: Fri May 5 14:17:15 2017 -0500 ibmvscsis: Do not send aborted task response The driver is sending a response to the actual scsi op that was aborted by an abort task TM, while LIO is sending a response to the abort task TM. ibmvscsis_tgt does not send the response to the client until release_cmd time. The reason for this was because if we did it at queue_status time, then the client would be free to reuse the tag for that command, but we're still using the tag until the command is released at release_cmd time, so we chose to delay sending the response until then. That then caused this issue, because release_cmd is always called, even if queue_status is not. SCSI spec says that the initiator that sends the abort task TM NEVER gets a response to the aborted op and with the current code it will send a response. Thus this fix will remove that response if the CMD_T_ABORTED && !CMD_T_TAS. Another case with a small timing window is the case where if LIO sends a TMR_DOES_NOT_EXIST, and the release_cmd callback is called for the TMR Abort cmd before the release_cmd for the (attemped) aborted cmd, then we need to ensure that we send the response for the (attempted) abort cmd to the client before we send the response for the TMR Abort cmd. Cc: # v4.8+ Signed-off-by: Bryant G. Ly Signed-off-by: Michael Cyr Signed-off-by: Nicholas Bellinger drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 114 ++++++++++++++++++++++++------- drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.h | 2 + 2 files changed, 91 insertions(+), 25 deletions(-) commit 3ef2bc099d1cce09e2844467e2ced98e1a44609d Merge: 2eecf3a 17a7035 Author: Linus Torvalds Date: Fri May 5 19:33:07 2017 -0700 Merge tag 'devicetree-for-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull DeviceTree updates from Rob Herring: - fix sparse warnings in drivers/of/ - add more overlay unittests - update dtc to v1.4.4-8-g756ffc4f52f6. This adds more checks on dts files such as unit-address formatting and stricter character sets for node and property names - add a common DT modalias function - move trivial-devices.txt up and out of i2c dir - ARM NVIC interrupt controller binding - vendor prefixes for Sensirion, Dioo, Nordic, ROHM - correct some binding file locations * tag 'devicetree-for-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (24 commits) of: fix sparse warnings in fdt, irq, reserved mem, and resolver code of: fix sparse warning in of_pci_range_parser_one of: fix sparse warnings in of_find_next_cache_node of/unittest: Missing unlocks on error of: fix uninitialized variable warning for overlay test of: fix unittest build without CONFIG_OF_OVERLAY of: Add unit tests for applying overlays of: per-file dtc compiler flags fpga: region: add missing DT documentation for config complete timeout of: Add vendor prefix for ROHM Semiconductor of: fix "/cpus" reference leak in of_numa_parse_cpu_nodes() of: Add vendor prefix for Nordic Semiconductor dt-bindings: arm,nvic: Binding for ARM NVIC interrupt controller on Cortex-M dtc: update warning settings for new bus and node/property name checks scripts/dtc: Update to upstream version v1.4.4-8-g756ffc4f52f6 scripts/dtc: automate getting dtc version and log in update script of: Add function for generating a DT modalias with a newline of: fix of_device_get_modalias returned length when truncating buffers Documentation: devicetree: move trivial-devices out of I2C realm dt-bindings: add vendor prefix for Dioo .. commit 2eecf3a49f1ff24c6116c954dd74e83f227fc716 Merge: 53ef7d0 10add84e Author: Linus Torvalds Date: Fri May 5 19:31:06 2017 -0700 Merge tag 'for-4.12/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mike Snitzer: - DM cache metadata fixes to short-circuit operations that require the metadata not be in 'fail_io' mode. Otherwise crashes are possible. - a DM cache fix to address the inability to adapt to continuous IO that happened to also reflect a changing working set (which required old blocks be demoted before the new working set could be promoted) - a DM cache smq policy cleanup that fell out from reviewing the above - fix the Kconfig help text for CONFIG_DM_INTEGRITY * tag 'for-4.12/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm cache metadata: fail operations if fail_io mode has been established dm integrity: improve the Kconfig help text for DM_INTEGRITY dm cache policy smq: cleanup free_target_met() and clean_target_met() dm cache policy smq: allow demotions to happen even during continuous IO commit 53ef7d0e208fa38c3f63d287e0c3ab174f1e1235 Merge: c6a677c 7361636 Author: Linus Torvalds Date: Fri May 5 18:49:20 2017 -0700 Merge tag 'libnvdimm-for-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm updates from Dan Williams: "The bulk of this has been in multiple -next releases. There were a few late breaking fixes and small features that got added in the last couple days, but the whole set has received a build success notification from the kbuild robot. Change summary: - Region media error reporting: A libnvdimm region device is the parent to one or more namespaces. To date, media errors have been reported via the "badblocks" attribute attached to pmem block devices for namespaces in "raw" or "memory" mode. Given that namespaces can be in "device-dax" or "btt-sector" mode this new interface reports media errors generically, i.e. independent of namespace modes or state. This subsequently allows userspace tooling to craft "ACPI 6.1 Section 9.20.7.6 Function Index 4 - Clear Uncorrectable Error" requests and submit them via the ioctl path for NVDIMM root bus devices. - Introduce 'struct dax_device' and 'struct dax_operations': Prompted by a request from Linus and feedback from Christoph this allows for dax capable drivers to publish their own custom dax operations. This fixes the broken assumption that all dax operations are related to a persistent memory device, and makes it easier for other architectures and platforms to add customized persistent memory support. - 'libnvdimm' core updates: A new "deep_flush" sysfs attribute is available for storage appliance applications to manually trigger memory controllers to drain write-pending buffers that would otherwise be flushed automatically by the platform ADR (asynchronous-DRAM-refresh) mechanism at a power loss event. Support for "locked" DIMMs is included to prevent namespaces from surfacing when the namespace label data area is locked. Finally, fixes for various reported deadlocks and crashes, also tagged for -stable. - ACPI / nfit driver updates: General updates of the nfit driver to add DSM command overrides, ACPI 6.1 health state flags support, DSM payload debug available by default, and various fixes. Acknowledgements that came after the branch was pushed: - commmit 565851c972b5 "device-dax: fix sysfs attribute deadlock": Tested-by: Yi Zhang - commit 23f498448362 "libnvdimm: rework region badblocks clearing" Tested-by: Toshi Kani " * tag 'libnvdimm-for-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: (52 commits) libnvdimm, pfn: fix 'npfns' vs section alignment libnvdimm: handle locked label storage areas libnvdimm: convert NDD_ flags to use bitops, introduce NDD_LOCKED brd: fix uninitialized use of brd->dax_dev block, dax: use correct format string in bdev_dax_supported device-dax: fix sysfs attribute deadlock libnvdimm: restore "libnvdimm: band aid btt vs clear poison locking" libnvdimm: fix nvdimm_bus_lock() vs device_lock() ordering libnvdimm: rework region badblocks clearing acpi, nfit: kill ACPI_NFIT_DEBUG libnvdimm: fix clear length of nvdimm_forget_poison() libnvdimm, pmem: fix a NULL pointer BUG in nd_pmem_notify libnvdimm, region: sysfs trigger for nvdimm_flush() libnvdimm: fix phys_addr for nvdimm_clear_poison x86, dax, pmem: remove indirection around memcpy_from_pmem() block: remove block_device_operations ->direct_access() block, dax: convert bdev_dax_supported() to dax_direct_access() filesystem-dax: convert to dax_direct_access() Revert "block: use DAX for partition table reads" ext2, ext4, xfs: retrieve dax_device for iomap operations ... commit c6a677c6f37bb7abc85ba7e3465e82b9f7eb1d91 Merge: e87d51a 1127005 Author: Linus Torvalds Date: Fri May 5 18:16:23 2017 -0700 Merge tag 'staging-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging/IIO updates from Greg KH: "Here is the big staging tree update for 4.12-rc1. It's a big one, adding about 350k new lines of crap^Wcode, mostly all in a big dump of media drivers from Intel. But there's other new drivers in here as well, yet-another-wifi driver, new IIO drivers, and a new crypto accelerator. We also deleted a bunch of stuff, mostly in patch cleanups, but also the Android ION code has shrunk a lot, and the Android low memory killer driver was finally deleted, much to the celebration of the -mm developers. All of these have been in linux-next with a few build issues that will show up when you merge to your tree" Merge conflicts in the new rtl8723bs driver (due to the wifi changes this merge window) handled as per linux-next, courtesy of Stephen Rothwell. * tag 'staging-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (1182 commits) staging: fsl-mc/dpio: add cpu <--> LE conversion for dpaa2_fd staging: ks7010: remove line continuations in quoted strings staging: vt6656: use tabs instead of spaces staging: android: ion: Fix unnecessary initialization of static variable staging: media: atomisp: fix range checking on clk_num staging: media: atomisp: fix misspelled word in comment staging: media: atomisp: kmap() can't fail staging: atomisp: remove #ifdef for runtime PM functions staging: atomisp: satm include directory is gone atomisp: remove some more unused files atomisp: remove hmm_load/store/clear indirections atomisp: kill off mmgr_free atomisp: clean up the hmm init/cleanup indirections atomisp: handle allocation calls before init in the hmm layer staging: fsl-dpaa2/eth: Add maintainer for Ethernet driver staging: fsl-dpaa2/eth: Add TODO file staging: fsl-dpaa2/eth: Add trace points staging: fsl-dpaa2/eth: Add driver specific stats staging: fsl-dpaa2/eth: Add ethtool support staging: fsl-dpaa2/eth: Add Freescale DPAA2 Ethernet driver ... commit e87d51ac61f88ae44fe14b34abe08566032d726b Merge: bdc713b 3622d3e Author: Linus Torvalds Date: Fri May 5 17:34:57 2017 -0700 Merge tag 'media/v4.12-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: "Media updates for v4.12-rc1: - new driver to support mediatek jpeg in hardware codec - rc-lirc, s5p-cec and st-cec staging drivers got promoted - hardware histogram support for vsp1 driver - added Virtual Media Controller driver, to make easier to test the media controller - added a new CEC driver (rainshadow-cec) - removed two staging LIRC drivers for obscure hardware that are too obsolete - added support for Intel SR300 Depth camera - some improvements at CEC and RC core - lots of driver cleanups, improvements all over the tree With this series, we're finally getting rid of the LIRC staging driver. There's just one left (lirc_zilog), with require more care, as part of its functionality (IR RX) is already provided by another driver. Work in progress to convert it on the proper way" * tag 'media/v4.12-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (304 commits) [media] ov2640: print error if devm_*_optional*() fails [media] atmel-isc: Fix the static checker warning [media] ov2640: add support for MEDIA_BUS_FMT_YVYU8_2X8 and MEDIA_BUS_FMT_VYUY8_2X8 [media] ov2640: fix vflip control [media] ov2640: fix duplicate width+height returning from ov2640_select_win() [media] ov2640: add missing write to size change preamble [media] ov2640: add information about DSP register 0xc7 [media] ov2640: improve banding filter register definitions/documentation [media] ov2640: fix init sequence alignment [media] ov2640: make GPIOLIB an optional dependency [media] xc5000: fix spelling mistake: "calibration" [media] vidioc-queryctrl.rst: fix menu/int menu references [media] media-entity: only call dev_dbg_obj if mdev is not NULL [media] pixfmt-meta-vsp1-hgo.rst: remove spurious '-' [media] mtk-vcodec: avoid warnings because of empty macros [media] coda: bump maximum number of internal framebuffers to 17 [media] media: mtk-vcodec: remove informative log [media] subdev-formats.rst: remove spurious '-' [media] dw2102: limit messages to buffer size [media] ttusb2: limit messages to buffer size ... commit bdc713bf5674bc6a881bd05c85e2a0f811b409b3 Merge: 1062ae4 8676df5 Author: Linus Torvalds Date: Fri May 5 17:30:44 2017 -0700 Merge tag 'drm-coc-for-v4.12-rc1' of git://people.freedesktop.org/~airlied/linux Pull drm CoC pointer from Dave Airlie: "Small supplementary pull request. I didn't want anyone saying we snuck this in in a the middle of a big pile of changes, so here is a clearly separate pull request documenting the code of conduct introduced for freedesktop.org and how it relates to dri-devel community" * tag 'drm-coc-for-v4.12-rc1' of git://people.freedesktop.org/~airlied/linux: drm: Document code of conduct commit 1062ae4982cabbf60f89b4e069fbb7def7edc8f7 Merge: 1a5fb64 644b493 Author: Linus Torvalds Date: Fri May 5 17:18:44 2017 -0700 Merge tag 'drm-forgot-about-tegra-for-v4.12-rc1' of git://people.freedesktop.org/~airlied/linux Pull drm tegra updates from Dave Airlie: "I missed a pull request from Thierry, this stuff has been in linux-next for a while anyways. It does contain a branch from the iommu tree, but Thierry said it should be fine" * tag 'drm-forgot-about-tegra-for-v4.12-rc1' of git://people.freedesktop.org/~airlied/linux: gpu: host1x: Fix host1x driver shutdown gpu: host1x: Support module reset gpu: host1x: Sort includes alphabetically drm/tegra: Add VIC support dt-bindings: Add bindings for the Tegra VIC drm/tegra: Add falcon helper library drm/tegra: Add Tegra DRM allocation API drm/tegra: Add tiling FB modifiers drm/tegra: Don't leak kernel pointer to userspace drm/tegra: Protect IOMMU operations by mutex drm/tegra: Enable IOVA API when IOMMU support is enabled gpu: host1x: Add IOMMU support gpu: host1x: Fix potential out-of-bounds access iommu/iova: Fix compile error with CONFIG_IOMMU_IOVA=m iommu: Add dummy implementations for !IOMMU_IOVA MAINTAINERS: Add related headers to IOMMU section iommu/iova: Consolidate code for adding new node to iovad domain rbtree commit db2c2a9798d266fd1d7c950b3937793b05533bf4 Author: Pixel Ding Date: Tue Apr 25 16:47:42 2017 +0800 drm/amdgpu: fix mutex list null pointer reference Fix NULL pointer reference. Signed-off-by: Pixel Ding Signed-off-by: Xiangliang Yu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 7b52db39a4c27c0020ff953a4bb0aa8bbe55e4a2 Author: Rex Zhu Date: Thu May 4 13:32:01 2017 +0800 drm/amd/powerplay: fix bug sclk/mclk level can't be set on vega10. Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c | 61 +++++++++++----------- 1 file changed, 31 insertions(+), 30 deletions(-) commit 5784d5cca66b362e3588c189eada757cf664ae6c Author: Rex Zhu Date: Thu May 4 14:51:31 2017 +0800 drm/amd/powerplay: Setup sw CTF to allow graceful exit when temperature exceeds maximum. cherry-pick from amd windows driver. Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher .../gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c | 73 +++++++++++++--------- 1 file changed, 45 insertions(+), 28 deletions(-) commit 652bd0c3441d861402bf7347088c846b6799c5b8 Author: Rex Zhu Date: Wed May 3 15:38:58 2017 +0800 drm/amd/powerplay: delete dead code in powerplay. Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 28 ------------------------ drivers/gpu/drm/amd/powerplay/inc/hwmgr.h | 2 -- 2 files changed, 30 deletions(-) commit af8baf1518d8b3d086ac6d11d8f6acd57e9cab99 Author: Guenter Roeck Date: Wed May 3 23:49:18 2017 -0700 drm/amdgpu: Use less generic enum definitions alpha:allmodconfig fails to build as follows. drivers/gpu/drm/amd/amdgpu/amdgpu.h:1006:2: error: expected identifier before '(' token drivers/gpu/drm/amd/amdgpu/amdgpu.h:1011:28: error: 'NGG_BUF_MAX' undeclared here The problem is not really the enum definition of NGG_BUF_MAX but PARAM, which happens to be defined differently for alpha and a couple of other architectures. Use less generic defines for NGG enums to solve the problem. Fixes: bce23e00f3369 ("drm/amdgpu: add NGG parameters") Cc: Christian König Cc: Alex Deucher Signed-off-by: Guenter Roeck Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu.h | 8 ++++---- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 16 ++++++++-------- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 28 ++++++++++++++-------------- 3 files changed, 26 insertions(+), 26 deletions(-) commit ad7d0ff3e79a100a24b66e8908a45402c20c3685 Author: Alex Deucher Date: Tue May 2 16:15:06 2017 -0400 drm/amdgpu/gfx9: derive tile pipes from golden settings rather than hardcoding it. Acked-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit f47b77b4e4baeb7922b5652ae7040d4d5de684a7 Author: Alex Deucher Date: Tue May 2 15:49:36 2017 -0400 drm/amdgpu/gfx: drop max_gs_waves_per_vgt We already have this info: max_gs_threads. Drop the duplicate. Reviewed-by: Junwei Zhang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 - drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 1 - 3 files changed, 1 insertion(+), 3 deletions(-) commit 327fce0c0d265b14be575bfe21a98c7c0dd932d8 Author: Rex Zhu Date: Thu May 4 11:07:02 2017 +0800 drm/amd/powerplay: disable engine spread spectrum feature on Vega10. Vega10 atomfirmware do not have ASIC_InternalSS_Info table so disable this feature by default in driver. Signed-off-by: Rex Zhu Reviewed-by: Ken Wang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit b4a33e325c58579a2017d3b1c1a1227f78ae52cd Author: Rex Zhu Date: Wed May 3 12:48:52 2017 +0800 drm/amd/powerplay: clean up code in vega10_smumgr.c 1. fix typo in print message info. 2. fix block comments's coding style. Signed-off-by: Rex Zhu Signed-off-by: Alex Deucher .../gpu/drm/amd/powerplay/smumgr/vega10_smumgr.c | 101 +++++++++------------ 1 file changed, 45 insertions(+), 56 deletions(-) commit 236763d340d6190c56554caee61c2bd5cfdf5217 Author: Monk Liu Date: Mon May 1 16:15:31 2017 +0800 drm/amdgpu:fix waiting on dirty fence if bo->shadow is NULL (race issue:BO shadow was just released and gpu-reset kick in but BO hasn't yet) recover_vram_from_shadow won't set @next, so the following "fence=next" will wrongly use a fence pointer which may already dirty. fixing it by set next to NULL prior to recover_vram_from_shadow Signed-off-by: Monk Liu Reviewed-by: Chunming Zhou Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 ++ 1 file changed, 2 insertions(+) commit 1d1a2cd58f05da1167c04394292aef9fbcf29bff Author: Monk Liu Date: Thu Apr 27 17:14:57 2017 +0800 drm/amdgpu:PTE flag should be 64 bit width otherwise we'll lost the high 32 bit for pte, which lead to incorrect MTYPE for vega10. Signed-off-by: Monk Liu Reviewed-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0dca7047512cb31e7a08a677a69fa7d47959dbf8 Author: Rex Zhu Date: Fri Apr 28 13:49:50 2017 +0800 drm/amd/powerplay: correct LoadLineResistance value in pptable. this value is used by avfs to adjust inversion voltage. Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/hwmgr/vega10_powertune.c | 4 ++-- drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) commit b7a1f0e3cca40044952901e659939133e7cd1efe Author: Rex Zhu Date: Tue May 2 14:30:39 2017 +0800 drm/amd/powerplay: Allow duplicate enteries in pptable. This is a valid configuration. Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 56a2f08c418ec01d46851683ee0463a2d8a2504d Author: Rex Zhu Date: Tue May 2 17:11:29 2017 +0800 drm/amd/powerplay: set fan target temperature by msg on vega10. SMU not support FanTargetTemperature in pptable, so send msg instand. Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c | 5 +++++ 1 file changed, 5 insertions(+) commit 05ee3215110303b3ffacfb44fdae59a151799e89 Author: Rex Zhu Date: Tue May 2 16:51:49 2017 +0800 drm/amd/powerplay: set soc floor voltage on boot on vega10. Send the VBIOS bootup VDDC as a SOC floor voltage to SMU before populating the PPTABLE. After DPM is enabled, This floor voltage will be removed. This will prevent SMC from going to Vmin upon receiving PPTable causing a violation. Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/hwmgr/ppatomfwctrl.c | 28 ++++++++++++++++++++++ drivers/gpu/drm/amd/powerplay/hwmgr/ppatomfwctrl.h | 15 ++++++++++++ drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c | 25 +++++++++++++++++++ drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.h | 3 +++ 4 files changed, 71 insertions(+) commit ef181f268e0e8d868f353b764799d96d6a8a2d86 Author: Rex Zhu Date: Tue May 2 16:01:00 2017 +0800 drm/amd/powerplay: refine code in vega10_smumgr.c 1. return error code instand of -1. 2. print msg info if send msg failed Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher .../gpu/drm/amd/powerplay/smumgr/vega10_smumgr.c | 78 +++++++++++----------- 1 file changed, 39 insertions(+), 39 deletions(-) commit d86ab9cff8b936aadde444d0e263a8db5ff0349b Author: Juri Lelli Date: Wed May 3 14:30:48 2017 +0100 cpufreq: schedutil: use now as reference when aggregating shared policy requests Currently, sugov_next_freq_shared() uses last_freq_update_time as a reference to decide when to start considering CPU contributions as stale. However, since last_freq_update_time is set by the last CPU that issued a frequency transition, this might cause problems in certain cases. In practice, the detection of stale utilization values fails whenever the CPU with such values was the last to update the policy. For example (and please note again that the SCHED_CPUFREQ_RT flag is not the problem here, but only the detection of after how much time that flag has to be considered stale), suppose a policy with 2 CPUs: CPU0 | CPU1 | | RT task scheduled | SCHED_CPUFREQ_RT is set | CPU1->last_update = now | freq transition to max | last_freq_update_time = now | more than TICK_NSEC nsecs | a small CFS wakes up | CPU0->last_update = now1 | delta_ns(CPU0) < TICK_NSEC* | CPU0's util is considered | delta_ns(CPU1) = | last_freq_update_time - | CPU1->last_update = 0 | < TICK_NSEC | CPU1 is still considered | CPU1->SCHED_CPUFREQ_RT is set | we stay at max (until CPU1 | exits from idle) | * delta_ns is actually negative as now1 > last_freq_update_time While last_freq_update_time is a sensible reference for rate limiting, it doesn't seem to be useful for working around stale CPU states. Fix the problem by always considering now (time) as the reference for deciding when CPUs have stale contributions. Signed-off-by: Juri Lelli Acked-by: Vincent Guittot Acked-by: Viresh Kumar Signed-off-by: Rafael J. Wysocki kernel/sched/cpufreq_schedutil.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit eed4d47efe9508b855b09754cf6de4325d8a2f0d Author: Rafael J. Wysocki Date: Wed Apr 26 23:23:03 2017 +0200 ACPI / sleep: Ignore spurious SCI wakeups from suspend-to-idle The ACPI SCI (System Control Interrupt) is set up as a wakeup IRQ during suspend-to-idle transitions and, consequently, any events signaled through it wake up the system from that state. However, on some systems some of the events signaled via the ACPI SCI while suspended to idle should not cause the system to wake up. In fact, quite often they should just be discarded. Arguably, systems should not resume entirely on such events, but in order to decide which events really should cause the system to resume and which are spurious, it is necessary to resume up to the point when ACPI SCIs are actually handled and processed, which is after executing dpm_resume_noirq() in the system resume path. For this reasons, add a loop around freeze_enter() in which the platforms can process events signaled via multiplexed IRQ lines like the ACPI SCI and add suspend-to-idle hooks that can be used for this purpose to struct platform_freeze_ops. In the ACPI case, the ->wake hook is used for checking if the SCI has triggered while suspended and deferring the interrupt-induced system wakeup until the events signaled through it are actually processed sufficiently to decide whether or not the system should resume. In turn, the ->sync hook allows all of the relevant event queues to be flushed so as to prevent events from being missed due to race conditions. In addition to that, some ACPI code processing wakeup events needs to be modified to use the "hard" version of wakeup triggers, so that it will cause a system resume to happen on device-induced wakeup events even if the "soft" mechanism to prevent the system from suspending is not enabled (that also helps to catch device-induced wakeup events occurring during suspend transitions in progress). Signed-off-by: Rafael J. Wysocki drivers/acpi/battery.c | 2 +- drivers/acpi/button.c | 5 +++-- drivers/acpi/device_pm.c | 3 ++- drivers/acpi/sleep.c | 28 ++++++++++++++++++++++++++++ drivers/base/power/main.c | 5 ----- drivers/base/power/wakeup.c | 18 ++++++++++++------ include/linux/suspend.h | 7 +++++-- kernel/power/process.c | 2 +- kernel/power/suspend.c | 29 +++++++++++++++++++++++++---- 9 files changed, 77 insertions(+), 22 deletions(-) commit 8a537ece3d946227e4afa81eae0e43fa47439c7d Author: Rafael J. Wysocki Date: Wed Apr 26 23:22:09 2017 +0200 PM / wakeup: Integrate mechanism to abort transitions in progress The system wakeup framework is not very consistent with respect to the way it handles suspend-to-idle and generally wakeup events occurring during transitions to system low-power states. First off, system transitions in progress are aborted by the event reporting helpers like pm_wakeup_event() only if the wakeup_count sysfs attribute is in use (as documented), but there are cases in which system-wide transitions should be aborted even if that is not the case. For example, a wakeup signal from a designated wakeup device during system-wide PM transition, it should cause the transition to be aborted right away. Moreover, there is a freeze_wake() call in wakeup_source_activate(), but that really is only effective after suspend_freeze_state has been set to FREEZE_STATE_ENTER by freeze_enter(). However, it is very unlikely that wakeup_source_activate() will ever be called at that time, as it could only be triggered by a IRQF_NO_SUSPEND interrupt handler, so wakeups from suspend-to-idle don't really occur in wakeup_source_activate(). At the same time there is a way to abort a system suspend in progress (or wake up the system from suspend-to-idle), which is by calling pm_system_wakeup(), but in turn that doesn't cause any wakeup source objects to be activated, so it will not be covered by wakeup source statistics and will not prevent the system from suspending again immediately (in case autosleep is used, for example). Consequently, if anyone wants to abort system transitions in progress and allow the wakeup_count mechanism to work, they need to use both pm_system_wakeup() and pm_wakeup_event(), say, at the same time which is awkward. For the above reasons, make it possible to trigger pm_system_wakeup() from within wakeup_source_activate() and provide a new pm_wakeup_hard_event() helper to do so within the wakeup framework. Signed-off-by: Rafael J. Wysocki drivers/base/power/wakeup.c | 36 ++++++++++++++++++------------------ include/linux/pm_wakeup.h | 25 +++++++++++++++++++++---- 2 files changed, 39 insertions(+), 22 deletions(-) commit cf4100d1cddcd243f80ac2af2e4c4273919ff225 Author: Alexey Brodkin Date: Fri May 5 23:20:29 2017 +0300 Revert "ARCv2: Allow enabling PAE40 w/o HIGHMEM" This reverts commit 7cab91b87dd8eeee5911ec34be8bb0288ebba18b. Now when we have a real hardware platform with PAE40 enabled (here I mean axs103 with firmware v1.2) and 1 Gb of DDR mapped to 0x1_a000_0000-0x1_ffff_ffff we're really targeting memory above 4Gb when PAE40 is enabled. This in its turn requires HIGHMEM to be enabled otherwise user won't see any difference with enabling PAE in kernel configuration as only lowmem will be used anyways. Signed-off-by: Alexey Brodkin Signed-off-by: Vineet Gupta arch/arc/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 1a5fb64fee203f9f5a9274c67ddbb821a29f723f Merge: aeced66 ed17545 Author: Linus Torvalds Date: Fri May 5 13:40:20 2017 -0700 Merge tag 'gfs2-4.12.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull GFS2 updates from Bob Peterson: "We've got ten GFS2 patches for this merge window. - Andreas Gruenbacher wrote a patch to replace the deprecated call to rhashtable_walk_init with rhashtable_walk_enter. - Andreas also wrote a patch to eliminate redundant code in two of our debugfs sequence files. - Andreas also cleaned up the rhashtable key ugliness Linus pointed out during this cycle, following Linus's suggestions. - Andreas also wrote a patch to take advantage of his new function rhashtable_lookup_get_insert_fast. This makes glock lookup faster and more bullet-proof. - Andreas also wrote a patch to revert a patch in the evict path that caused occasional deadlocks, and is no longer needed. - Andrew Price wrote a patch to re-enable fallocate for the rindex system file to enable gfs2_grow to grow properly on secondary file system grow operations. - I wrote a patch to initialize an inode number field to make certain kernel trace points more understandable. - I also wrote a patch that makes GFS2 file system "withdraw" work more like it should by ignoring operations after a withdraw that would formerly cause a BUG() and kernel panic. - I also reworked the entire truncate/delete algorithm, scrapping the old recursive algorithm in favor of a new non-recursive algorithm. This was done for performance: This way, GFS2 no longer needs to lock multiple resource groups while doing truncates and deletes of files that cross multiple resource group boundaries, allowing for better parallelism. It also solves a problem whereby deleting large files would request a large chunk of kernel memory, which resulted in a get_page_from_freelist warning. - Due to a regression found during testing, I added a new patch to correct 'GFS2: Prevent BUG from occurring when normal Withdraws occur'." * tag 'gfs2-4.12.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: GFS2: Allow glocks to be unlocked after withdraw GFS2: Non-recursive delete gfs2: Re-enable fallocate for the rindex Revert "GFS2: Wait for iopen glock dequeues" gfs2: Switch to rhashtable_lookup_get_insert_fast GFS2: Temporarily zero i_no_addr when creating a dinode gfs2: Don't pack struct lm_lockname gfs2: Deduplicate gfs2_{glocks,glstats}_open gfs2: Replace rhashtable_walk_init with rhashtable_walk_enter GFS2: Prevent BUG from occurring when normal Withdraws occur commit aeced66196460a04644538f4985192ce6be6acc0 Merge: 414975e 2f713b5 Author: Linus Torvalds Date: Fri May 5 13:36:10 2017 -0700 Merge tag 'for-linus-4.12-ofs-1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux Pull orangefs updates from Mike Marshall: "Orangefs cleanups, fixes and statx support. Some cleanups: - remove unused get_fsid_from_ino - fix bounds check for listxattr - clean up oversize xattr validation - do not set getattr_time on orangefs_lookup - return from orangefs_devreq_read quickly if possible - do not wait for timeout if umounting - handle zero size write in debugfs Bug fixes: - do not check possibly stale size on truncate - ensure the userspace component is unmounted if mount fails - total reimplementation of dir.c New feature: - implement statx The new implementation of dir.c is kind of a big deal, all new code. It has been posted to fs-devel during the previous rc period, we didn't get much review or feedback from there, but it has been reviewed very heavily here, so much so that we have two entire versions of the reimplementation. Not only does the new implementation fix some xfstests, but it passes all the new tests we made here that involve seeking and rewinding and giant directories and long file names. The new dir code has three patches itself: - skip forward to the next directory entry if seek is short - invalidate stored directory on seek - count directory pieces correctly" * tag 'for-linus-4.12-ofs-1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux: orangefs: count directory pieces correctly orangefs: invalidate stored directory on seek orangefs: skip forward to the next directory entry if seek is short orangefs: handle zero size write in debugfs orangefs: do not wait for timeout if umounting orangefs: return from orangefs_devreq_read quickly if possible orangefs: ensure the userspace component is unmounted if mount fails orangefs: do not check possibly stale size on truncate orangefs: implement statx orangefs: remove ORANGEFS_READDIR macros orangefs: support very large directories orangefs: support llseek on directories orangefs: rewrite readdir to fix several bugs orangefs: do not set getattr_time on orangefs_lookup orangefs: clean up oversize xattr validation orangefs: fix bounds check for listxattr orangefs: remove unused get_fsid_from_ino commit 414975eb7644aa57781679ffc1e63d670b3a1031 Merge: 58017a3 dcfd9b21 Author: Linus Torvalds Date: Fri May 5 13:33:38 2017 -0700 Merge tag 'befs-v4.12-rc1' of git://github.com/luisbg/linux-befs Pull befs fix from Luis de Bethencourt: "One fix from Fabian Frederick making the nfs client still work after a cache drop" * tag 'befs-v4.12-rc1' of git://github.com/luisbg/linux-befs: befs: make export work with cold dcache commit 58017a3e284059186fa0dc16730e9f2ef336da61 Merge: ab182e6 17a9be3 Author: Linus Torvalds Date: Fri May 5 13:30:11 2017 -0700 Merge tag 'initramfs-fix-4.12-rc1' of git://github.com/stffrdhrn/linux Pull initramfs fix from Stafford Horne: "This is a fix for an issue that has caused 4.11 to not boot on OpenRISC. I should have caught this during the 4.11 cycle but I had been busy on testing some other series of patches. I would have considered pushing it though a different path but Al Viro suggested submitting directly to you. Also, its just one as I havent really got anything else ready on my queue for 4.12. Summary: - Ensure fput() flush is done even for builtin initramfs" * tag 'initramfs-fix-4.12-rc1' of git://github.com/stffrdhrn/linux: initramfs: Always do fput() and load modules after rootfs populate commit 6b4657667ba06cd2e07206c65e630acdf248bfd1 Author: Fabian Frederick Date: Fri May 5 20:52:07 2017 +0200 fs/affs: add rename exchange Process RENAME_EXCHANGE in affs_rename2() adding static affs_xrename() based on affs_rename(). We remove headers from respective directories then affect bh to other inode directory entries for swapping. Signed-off-by: Fabian Frederick Signed-off-by: Al Viro fs/affs/namei.c | 58 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 57 insertions(+), 1 deletion(-) commit c6184028a75cf63036267089741ec7ef975ebc27 Author: Fabian Frederick Date: Fri May 5 20:51:42 2017 +0200 fs/affs: add rename2 to prepare multiple methods Currently AFFS only supports RENAME_NOREPLACE. This patch isolates that method to a static function to prepare RENAME_EXCHANGE addition. Signed-off-by: Fabian Frederick Signed-off-by: Al Viro fs/affs/affs.h | 2 +- fs/affs/dir.c | 2 +- fs/affs/namei.c | 25 ++++++++++++++++--------- 3 files changed, 18 insertions(+), 11 deletions(-) commit ed17545d01e4a40086f1622c88ce64cc0241cfc2 Author: Bob Peterson Date: Fri May 5 09:43:02 2017 -0500 GFS2: Allow glocks to be unlocked after withdraw This bug fixes a regression introduced by patch 0d1c7ae9d8. The intent of the patch was to stop promoting glocks after a file system is withdrawn due to a variety of errors, because doing so results in a BUG(). (You should be able to unmount after a withdraw rather than having the kernel panic.) Unfortunately, it also stopped demotions, so glocks could not be unlocked after withdraw, which means the unmount would hang. This patch allows function do_xmote to demote locks to an unlocked state after a withdraw, but not promote them. Signed-off-by: Bob Peterson fs/gfs2/glock.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 161f55efba5ddccc690139fae9373cafc3447a97 Author: Eryu Guan Date: Tue May 2 13:54:47 2017 -0700 xfs: fix use-after-free in xfs_finish_page_writeback Commit 28b783e47ad7 ("xfs: bufferhead chains are invalid after end_page_writeback") fixed one use-after-free issue by pre-calculating the loop conditionals before calling bh->b_end_io() in the end_io processing loop, but it assigned 'next' pointer before checking end offset boundary & breaking the loop, at which point the bh might be freed already, and caused use-after-free. This is caught by KASAN when running fstests generic/127 on sub-page block size XFS. [ 2517.244502] run fstests generic/127 at 2017-04-27 07:30:50 [ 2747.868840] ================================================================== [ 2747.876949] BUG: KASAN: use-after-free in xfs_destroy_ioend+0x3d3/0x4e0 [xfs] at addr ffff8801395ae698 ... [ 2747.918245] Call Trace: [ 2747.920975] dump_stack+0x63/0x84 [ 2747.924673] kasan_object_err+0x21/0x70 [ 2747.928950] kasan_report+0x271/0x530 [ 2747.933064] ? xfs_destroy_ioend+0x3d3/0x4e0 [xfs] [ 2747.938409] ? end_page_writeback+0xce/0x110 [ 2747.943171] __asan_report_load8_noabort+0x19/0x20 [ 2747.948545] xfs_destroy_ioend+0x3d3/0x4e0 [xfs] [ 2747.953724] xfs_end_io+0x1af/0x2b0 [xfs] [ 2747.958197] process_one_work+0x5ff/0x1000 [ 2747.962766] worker_thread+0xe4/0x10e0 [ 2747.966946] kthread+0x2d3/0x3d0 [ 2747.970546] ? process_one_work+0x1000/0x1000 [ 2747.975405] ? kthread_create_on_node+0xc0/0xc0 [ 2747.980457] ? syscall_return_slowpath+0xe6/0x140 [ 2747.985706] ? do_page_fault+0x30/0x80 [ 2747.989887] ret_from_fork+0x2c/0x40 [ 2747.993874] Object at ffff8801395ae690, in cache buffer_head size: 104 [ 2748.001155] Allocated: [ 2748.003782] PID = 8327 [ 2748.006411] save_stack_trace+0x1b/0x20 [ 2748.010688] save_stack+0x46/0xd0 [ 2748.014383] kasan_kmalloc+0xad/0xe0 [ 2748.018370] kasan_slab_alloc+0x12/0x20 [ 2748.022648] kmem_cache_alloc+0xb8/0x1b0 [ 2748.027024] alloc_buffer_head+0x22/0xc0 [ 2748.031399] alloc_page_buffers+0xd1/0x250 [ 2748.035968] create_empty_buffers+0x30/0x410 [ 2748.040730] create_page_buffers+0x120/0x1b0 [ 2748.045493] __block_write_begin_int+0x17a/0x1800 [ 2748.050740] iomap_write_begin+0x100/0x2f0 [ 2748.055308] iomap_zero_range_actor+0x253/0x5c0 [ 2748.060362] iomap_apply+0x157/0x270 [ 2748.064347] iomap_zero_range+0x5a/0x80 [ 2748.068624] iomap_truncate_page+0x6b/0xa0 [ 2748.073227] xfs_setattr_size+0x1f7/0xa10 [xfs] [ 2748.078312] xfs_vn_setattr_size+0x68/0x140 [xfs] [ 2748.083589] xfs_file_fallocate+0x4ac/0x820 [xfs] [ 2748.088838] vfs_fallocate+0x2cf/0x780 [ 2748.093021] SyS_fallocate+0x48/0x80 [ 2748.097006] do_syscall_64+0x18a/0x430 [ 2748.101186] return_from_SYSCALL_64+0x0/0x6a [ 2748.105948] Freed: [ 2748.108189] PID = 8327 [ 2748.110816] save_stack_trace+0x1b/0x20 [ 2748.115093] save_stack+0x46/0xd0 [ 2748.118788] kasan_slab_free+0x73/0xc0 [ 2748.122969] kmem_cache_free+0x7a/0x200 [ 2748.127247] free_buffer_head+0x41/0x80 [ 2748.131524] try_to_free_buffers+0x178/0x250 [ 2748.136316] xfs_vm_releasepage+0x2e9/0x3d0 [xfs] [ 2748.141563] try_to_release_page+0x100/0x180 [ 2748.146325] invalidate_inode_pages2_range+0x7da/0xcf0 [ 2748.152087] xfs_shift_file_space+0x37d/0x6e0 [xfs] [ 2748.157557] xfs_collapse_file_space+0x49/0x120 [xfs] [ 2748.163223] xfs_file_fallocate+0x2a7/0x820 [xfs] [ 2748.168462] vfs_fallocate+0x2cf/0x780 [ 2748.172642] SyS_fallocate+0x48/0x80 [ 2748.176629] do_syscall_64+0x18a/0x430 [ 2748.180810] return_from_SYSCALL_64+0x0/0x6a Fixed it by checking on offset against end & breaking out first, dereference bh only if there're still bufferheads to process. Signed-off-by: Eryu Guan Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/xfs_aops.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit ab182e67ec99ea0c8d7435a32a4a1ed9bb02559a Merge: 7246f60 92f66f8 Author: Linus Torvalds Date: Fri May 5 12:11:37 2017 -0700 Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 updates from Catalin Marinas: - kdump support, including two necessary memblock additions: memblock_clear_nomap() and memblock_cap_memory_range() - ARMv8.3 HWCAP bits for JavaScript conversion instructions, complex numbers and weaker release consistency - arm64 ACPI platform MSI support - arm perf updates: ACPI PMU support, L3 cache PMU in some Qualcomm SoCs, Cortex-A53 L2 cache events and DTLB refills, MAINTAINERS update for DT perf bindings - architected timer errata framework (the arch/arm64 changes only) - support for DMA_ATTR_FORCE_CONTIGUOUS in the arm64 iommu DMA API - arm64 KVM refactoring to use common system register definitions - remove support for ASID-tagged VIVT I-cache (no ARMv8 implementation using it and deprecated in the architecture) together with some I-cache handling clean-up - PE/COFF EFI header clean-up/hardening - define BUG() instruction without CONFIG_BUG * tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (92 commits) arm64: Fix the DMA mmap and get_sgtable API with DMA_ATTR_FORCE_CONTIGUOUS arm64: Print DT machine model in setup_machine_fdt() arm64: pmu: Wire-up Cortex A53 L2 cache events and DTLB refills arm64: module: split core and init PLT sections arm64: pmuv3: handle pmuv3+ arm64: Add CNTFRQ_EL0 trap handler arm64: Silence spurious kbuild warning on menuconfig arm64: pmuv3: use arm_pmu ACPI framework arm64: pmuv3: handle !PMUv3 when probing drivers/perf: arm_pmu: add ACPI framework arm64: add function to get a cpu's MADT GICC table drivers/perf: arm_pmu: split out platform device probe logic drivers/perf: arm_pmu: move irq request/free into probe drivers/perf: arm_pmu: split cpu-local irq request/free drivers/perf: arm_pmu: rename irq request/free functions drivers/perf: arm_pmu: handle no platform_device drivers/perf: arm_pmu: simplify cpu_pmu_request_irqs() drivers/perf: arm_pmu: factor out pmu registration drivers/perf: arm_pmu: fold init into alloc drivers/perf: arm_pmu: define armpmu_init_fn ... commit 868a65307d3015064db2a6fb2d6e451293e3047f Author: Vineet Gupta Date: Fri May 5 11:59:41 2017 -0700 ARC: mm: fix build failure in linux-next for UP builds kisskb build service reported ARC defconfig build failures in linux-next | arch/arc/include/asm/mmu.h:75:21: error: 'NR_CPUS' undeclared here (not in a function) | make[3]: *** [arch/arc/mm/ioremap.o] Error 1 | make[2]: *** [arch/arc/mm] Error 2 | make[1]: *** [arch/arc] Error 2 which I bisected to a subtle side-effect of a totally benign mm patch ("mm, vmalloc: properly track vmalloc users") which caused a header include chain deviation - asm/mmu.h using NR_CPUS before including linux/threads.h Fix that by adding the dependnet header and while it at fix a related header to include linux headers aheads of asm headers as sometimes that slso triggers such issues ! Reported-by: noreply@ellerman.id.au Signed-off-by: Vineet Gupta arch/arc/include/asm/mmu.h | 4 ++++ arch/arc/include/asm/pgtable.h | 6 +++--- 2 files changed, 7 insertions(+), 3 deletions(-) commit 2c041afc5af93a47b8bae2b1190a7b6ed028b706 Author: Rakesh Pandit Date: Fri May 5 14:28:23 2017 +0300 net: alx: handle pci_alloc_irq_vectors return correctly It was introduced while switching to pci_alloc_irq_vectors recently and fixes: [ 60.527052] alx 0000:03:00.0 enp3s0: Enabling MSI-X interrupts failed! [ 60.529323] BUG: unable to handle kernel NULL pointer dereference at 00000000000000b8 [ 60.531589] IP: alx_alloc_napis+0xe6/0x1e0 [alx] [ 60.533831] PGD 0 [ 60.533833] P4D 0 [ 60.540559] Oops: 0002 [#1] SMP [ 60.542759] Modules linked in: ebtables ip6table_filter ip6_tables..... [ 60.549990] drm_kms_helper drm crc32c_intel alx serio_raw mdio wmi video i2c_hid uas usb_storage [ 60.551404] CPU: 0 PID: 999 Comm: NetworkManager Not tainted 4.11.0+ #1 [ 60.552813] Hardware name: Acer Predator G9-591/Mustang_SLS, BIOS V1.10 03/03/2016 [ 60.554219] task: ffff8804ae833c00 task.stack: ffffc90003eec000 [ 60.555383] RIP: 0010:alx_alloc_napis+0xe6/0x1e0 [alx] [ 60.556615] RSP: 0018:ffffc90003eef660 EFLAGS: 00010286 [ 60.557787] RAX: ffff8804962835a0 RBX: ffff8804aee8a8c0 RCX: 0000000000000000 [ 60.558987] RDX: 0000000000000060 RSI: 0000000000000000 RDI: ffff880496283600 [ 60.559979] RBP: ffffc90003eef688 R08: ffff8804c1c1e7e0 R09: ffff8804962835a0 [ 60.560978] R10: ffff8804962835a0 R11: 0000000000000102 R12: 0000000000000000 [ 60.561974] R13: 0000000000000000 R14: ffff8804aee8aaf0 R15: ffffffffa0052ea0 [ 60.562974] FS: 00007f1cecbc9940(0000) GS:ffff8804c1c00000(0000) knlGS:0000000000000000 [ 60.564003] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 60.564884] CR2: 00000000000000b8 CR3: 0000000496025000 CR4: 00000000003406f0 [ 60.565782] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 60.566676] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 60.567560] Call Trace: [ 60.568500] __alx_open+0xa2/0x570 [alx] [ 60.569355] ? notifier_call_chain+0x4a/0x70 [ 60.570144] alx_open+0x17/0x20 [alx] [ 60.570909] __dev_open+0xc6/0x140 [ 60.571682] ? _raw_spin_unlock_bh+0x1a/0x20 [ 60.572469] __dev_change_flags+0x9d/0x160 [ 60.573252] dev_change_flags+0x29/0x60 [ 60.574070] do_setlink+0x32e/0xc90 [ 60.574815] ? ttwu_do_activate+0x77/0x80 [ 60.575544] ? drm_fb_helper_dirty.isra.17+0xc7/0xe0 [drm_kms_helper] [ 60.576273] ? drm_fb_helper_cfb_imageblit+0x30/0x40 [drm_kms_helper] [ 60.577004] ? bit_putcs+0x2f7/0x560 [ 60.577729] ? nla_parse+0x35/0x140 [ 60.578518] rtnl_newlink+0x7d3/0x900 [ 60.579280] ? security_capset+0x30/0x80 [ 60.580029] ? ns_capable_common+0x68/0x80 [ 60.580747] ? ns_capable+0x13/0x20 [ 60.581453] rtnetlink_rcv_msg+0xee/0x220 [ 60.582198] ? rtnl_newlink+0x900/0x900 [ 60.582909] netlink_rcv_skb+0xe7/0x120 [ 60.583601] rtnetlink_rcv+0x28/0x30 [ 60.584303] netlink_unicast+0x18c/0x220 [ 60.585002] netlink_sendmsg+0x2ba/0x3b0 [ 60.585703] sock_sendmsg+0x38/0x50 [ 60.586436] ___sys_sendmsg+0x2b6/0x2d0 [ 60.587123] ? lockref_put_or_lock+0x5e/0x80 [ 60.587822] ? dput+0x155/0x1d0 [ 60.588518] ? mntput+0x24/0x40 [ 60.589215] __sys_sendmsg+0x54/0x90 [ 60.589907] ? __sys_sendmsg+0x54/0x90 [ 60.590627] SyS_sendmsg+0x12/0x20 [ 60.591333] entry_SYSCALL_64_fastpath+0x1a/0xa5 [ 60.592021] RIP: 0033:0x7f1ceb44e3b0 [ 60.592697] RSP: 002b:00007fffd7f0a2d0 EFLAGS: 00000293 ORIG_RAX: 000000000000002e [ 60.593385] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f1ceb44e3b0 [ 60.594107] RDX: 0000000000000000 RSI: 00007fffd7f0a380 RDI: 000000000000000c [ 60.594798] RBP: 00007fffd7f0a800 R08: 0000000000000000 R09: 0000000000000000 [ 60.595502] R10: 0000564ffbae6e20 R11: 0000000000000293 R12: 0000000000000001 [ 60.596200] R13: 0000000000000002 R14: 0000000000000010 R15: 00007fffd7f0a4d0 [ 60.596899] Code: ed 85 c9 0f 8f ec 00 00 00 48 8b 3d 9d 97 1a e2 ba 50 00 00 00 be c0 80 40 01 4c 8b a3 30 02 00 00 e8 ff e5 1d e1 48 85 c0 74 a3 <49> 89 84 24 b8 00 00 00 48 8b 93 30 02 00 00 48 8b 4b 08 48 89 [ 60.597642] RIP: alx_alloc_napis+0xe6/0x1e0 [alx] RSP: ffffc90003eef660 [ 60.598427] CR2: 00000000000000b8 Fixes: f3297f68 ("net: alx: switch to pci_alloc_irq_vectors") Signed-off-by: Rakesh Pandit Signed-off-by: David S. Miller drivers/net/ethernet/atheros/alx/main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 10add84e276432d9dd8044679a1028dd4084117e Author: Mike Snitzer Date: Fri May 5 14:40:13 2017 -0400 dm cache metadata: fail operations if fail_io mode has been established Otherwise it is possible to trigger crashes due to the metadata being inaccessible yet these methods don't safely account for that possibility without these checks. Cc: stable@vger.kernel.org Reported-by: Mikulas Patocka Signed-off-by: Mike Snitzer drivers/md/dm-cache-metadata.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) commit 7246f60068840847bdcf595be5f0b5ca632736e0 Merge: e579dde 700b7ead Author: Linus Torvalds Date: Fri May 5 11:36:44 2017 -0700 Merge tag 'powerpc-4.12-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc updates from Michael Ellerman: "Highlights include: - Larger virtual address space on 64-bit server CPUs. By default we use a 128TB virtual address space, but a process can request access to the full 512TB by passing a hint to mmap(). - Support for the new Power9 "XIVE" interrupt controller. - TLB flushing optimisations for the radix MMU on Power9. - Support for CAPI cards on Power9, using the "Coherent Accelerator Interface Architecture 2.0". - The ability to configure the mmap randomisation limits at build and runtime. - Several small fixes and cleanups to the kprobes code, as well as support for KPROBES_ON_FTRACE. - Major improvements to handling of system reset interrupts, correctly treating them as NMIs, giving them a dedicated stack and using a new hypervisor call to trigger them, all of which should aid debugging and robustness. - Many fixes and other minor enhancements. Thanks to: Alastair D'Silva, Alexey Kardashevskiy, Alistair Popple, Andrew Donnellan, Aneesh Kumar K.V, Anshuman Khandual, Anton Blanchard, Balbir Singh, Ben Hutchings, Benjamin Herrenschmidt, Bhupesh Sharma, Chris Packham, Christian Zigotzky, Christophe Leroy, Christophe Lombard, Daniel Axtens, David Gibson, Gautham R. Shenoy, Gavin Shan, Geert Uytterhoeven, Guilherme G. Piccoli, Hamish Martin, Hari Bathini, Kees Cook, Laurent Dufour, Madhavan Srinivasan, Mahesh J Salgaonkar, Mahesh Salgaonkar, Masami Hiramatsu, Matt Brown, Matthew R. Ochs, Michael Neuling, Naveen N. Rao, Nicholas Piggin, Oliver O'Halloran, Pan Xinhui, Paul Mackerras, Rashmica Gupta, Russell Currey, Sukadev Bhattiprolu, Thadeu Lima de Souza Cascardo, Tobin C. Harding, Tyrel Datwyler, Uma Krishnan, Vaibhav Jain, Vipin K Parashar, Yang Shi" * tag 'powerpc-4.12-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (214 commits) powerpc/64s: Power9 has no LPCR[VRMASD] field so don't set it powerpc/powernv: Fix TCE kill on NVLink2 powerpc/mm/radix: Drop support for CPUs without lockless tlbie powerpc/book3s/mce: Move add_taint() later in virtual mode powerpc/sysfs: Move #ifdef CONFIG_HOTPLUG_CPU out of the function body powerpc/smp: Document irq enable/disable after migrating IRQs powerpc/mpc52xx: Don't select user-visible RTAS_PROC powerpc/powernv: Document cxl dependency on special case in pnv_eeh_reset() powerpc/eeh: Clean up and document event handling functions powerpc/eeh: Avoid use after free in eeh_handle_special_event() cxl: Mask slice error interrupts after first occurrence cxl: Route eeh events to all drivers in cxl_pci_error_detected() cxl: Force context lock during EEH flow powerpc/64: Allow CONFIG_RELOCATABLE if COMPILE_TEST powerpc/xmon: Teach xmon oops about radix vectors powerpc/mm/hash: Fix off-by-one in comment about kernel contexts ids powerpc/pseries: Enable VFIO powerpc/powernv: Fix iommu table size calculation hook for small tables powerpc/powernv: Check kzalloc() return value in pnv_pci_table_alloc powerpc: Add arch/powerpc/tools directory ... commit e579dde654fc2c6b0d3e4b77a9a4b2d2405c510e Merge: af82455 d66bb16 Author: Linus Torvalds Date: Fri May 5 11:08:43 2017 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace Pull namespace updates from Eric Biederman: "This is a set of small fixes that were mostly stumbled over during more significant development. This proc fix and the fix to posix-timers are the most significant of the lot. There is a lot of good development going on but unfortunately it didn't quite make the merge window" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: proc: Fix unbalanced hard link numbers signal: Make kill_proc_info static rlimit: Properly call security_task_setrlimit signal: Remove unused definition of sig_user_definied ia64: Remove unused IA64_TASK_SIGHAND_OFFSET and IA64_SIGHAND_SIGLOCK_OFFSET ipc: Remove unused declaration of recompute_msgmni posix-timers: Correct sanity check in posix_cpu_nsleep sysctl: Remove dead register_sysctl_root commit 0795bf8357c1887e2a95e6e4f5b89d0896a0d929 Author: Fabian Frederick Date: Wed May 3 20:52:21 2017 +0200 nfs: use kmap/kunmap directly This patch removes useless nfs_readdir_get_array() and nfs_readdir_release_array() as suggested by Trond Myklebust nfs_readdir() calls nfs_revalidate_mapping() before readdir_search_pagecache() , nfs_do_filldir(), uncached_readdir() so mapping should be correct. While kmap() can't fail, all subsequent error checks were removed as well as unused labels. Signed-off-by: Fabian Frederick Signed-off-by: Trond Myklebust fs/nfs/dir.c | 67 +++++++++++------------------------------------------------- 1 file changed, 12 insertions(+), 55 deletions(-) commit 59b86d85a7a30ba56289cdac83cd66a7dd2adebf Author: Hou Tao Date: Fri Apr 28 18:35:19 2017 +0800 NFS: always treat the invocation of nfs_getattr as cache hit when noac is on When using 'ls -l' to display a large directory, if noac option is used, in function nfs_getattr() nfs_need_revalidate_inode() will always be true for NFSv3 and the nfs_entry cache of the directory will be flushed. The flush will lead to a fully reread of the directory entries from server. To prevent the unnecessary RPCs, we need to check whether or not the noac option is used, and always report the invocation of nfs_getattr() as cache hit instead cache miss when it's on. Signed-off-by: Hou Tao Signed-off-by: Trond Myklebust fs/nfs/inode.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 5c737cb29977896eb0f373d3adbcdea73b815808 Author: Dave Wysochanski Date: Thu Apr 27 10:45:15 2017 -0400 Fix nfs_client refcounting if kmalloc fails in nfs4_proc_exchange_id and nfs4_proc_async_renew If memory allocation fails for the callback data, we need to put the nfs_client or we end up with an elevated refcount. Signed-off-by: Dave Wysochanski Signed-off-by: Trond Myklebust fs/nfs/nfs4proc.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 0048fdd06614a4ea088f9fcad11511956b795698 Author: Trond Myklebust Date: Thu May 4 13:44:04 2017 -0400 NFSv4.1: RECLAIM_COMPLETE must handle NFS4ERR_CONN_NOT_BOUND_TO_SESSION If the server returns NFS4ERR_CONN_NOT_BOUND_TO_SESSION because we are trunking, then RECLAIM_COMPLETE must handle that by calling nfs4_schedule_session_recovery() and then retrying. Reported-by: Chuck Lever Signed-off-by: Trond Myklebust Tested-by: Chuck Lever fs/nfs/nfs4proc.c | 7 ++++++- fs/nfs/nfs4state.c | 10 +++++++--- 2 files changed, 13 insertions(+), 4 deletions(-) commit 84b114b98452c431299d99c135f751659e517acb Author: Eric Dumazet Date: Fri May 5 06:56:54 2017 -0700 tcp: randomize timestamps on syncookies Whole point of randomization was to hide server uptime, but an attacker can simply start a syn flood and TCP generates 'old style' timestamps, directly revealing server jiffies value. Also, TSval sent by the server to a particular remote address vary depending on syncookies being sent or not, potentially triggering PAWS drops for innocent clients. Lets implement proper randomization, including for SYNcookies. Also we do not need to export sysctl_tcp_timestamps, since it is not used from a module. In v2, I added Florian feedback and contribution, adding tsoff to tcp_get_cookie_sock(). v3 removed one unused variable in tcp_v4_connect() as Florian spotted. Fixes: 95a22caee396c ("tcp: randomize tcp timestamp offsets for each connection") Signed-off-by: Eric Dumazet Reviewed-by: Florian Westphal Tested-by: Florian Westphal Cc: Yuchung Cheng Signed-off-by: David S. Miller include/net/secure_seq.h | 10 ++++++---- include/net/tcp.h | 5 +++-- net/core/secure_seq.c | 31 +++++++++++++++++++------------ net/ipv4/syncookies.c | 12 ++++++++++-- net/ipv4/tcp_input.c | 8 +++----- net/ipv4/tcp_ipv4.c | 32 +++++++++++++++++++------------- net/ipv6/syncookies.c | 10 +++++++++- net/ipv6/tcp_ipv6.c | 32 +++++++++++++++++++------------- 8 files changed, 88 insertions(+), 52 deletions(-) commit 34bf129a7f068e3108dbb051b4b05674e2a270e7 Author: Arnd Bergmann Date: Fri May 5 17:25:12 2017 +0200 fbdev: sti: don't select CONFIG_VT While working on another build error, I ran into several variations of this dependency loop: subsection "Kconfig recursive dependency limitations" drivers/input/Kconfig:8: symbol INPUT is selected by VT For a resolution refer to Documentation/kbuild/kconfig-language.txt subsection "Kconfig recursive dependency limitations" drivers/tty/Kconfig:12: symbol VT is selected by FB_STI For a resolution refer to Documentation/kbuild/kconfig-language.txt subsection "Kconfig recursive dependency limitations" drivers/video/fbdev/Kconfig:677: symbol FB_STI depends on FB For a resolution refer to Documentation/kbuild/kconfig-language.txt subsection "Kconfig recursive dependency limitations" drivers/video/fbdev/Kconfig:5: symbol FB is selected by DRM_KMS_FB_HELPER For a resolution refer to Documentation/kbuild/kconfig-language.txt subsection "Kconfig recursive dependency limitations" drivers/gpu/drm/Kconfig:72: symbol DRM_KMS_FB_HELPER is selected by DRM_KMS_CMA_HELPER For a resolution refer to Documentation/kbuild/kconfig-language.txt subsection "Kconfig recursive dependency limitations" drivers/gpu/drm/Kconfig:137: symbol DRM_KMS_CMA_HELPER is selected by DRM_HDLCD For a resolution refer to Documentation/kbuild/kconfig-language.txt subsection "Kconfig recursive dependency limitations" drivers/gpu/drm/arm/Kconfig:6: symbol DRM_HDLCD depends on OF For a resolution refer to Documentation/kbuild/kconfig-language.txt subsection "Kconfig recursive dependency limitations" drivers/of/Kconfig:4: symbol OF is selected by X86_INTEL_CE For a resolution refer to Documentation/kbuild/kconfig-language.txt subsection "Kconfig recursive dependency limitations" arch/x86/Kconfig:523: symbol X86_INTEL_CE depends on X86_IO_APIC For a resolution refer to Documentation/kbuild/kconfig-language.txt subsection "Kconfig recursive dependency limitations" arch/x86/Kconfig:1011: symbol X86_IO_APIC depends on X86_LOCAL_APIC For a resolution refer to Documentation/kbuild/kconfig-language.txt subsection "Kconfig recursive dependency limitations" arch/x86/Kconfig:1005: symbol X86_LOCAL_APIC depends on X86_UP_APIC For a resolution refer to Documentation/kbuild/kconfig-language.txt subsection "Kconfig recursive dependency limitations" arch/x86/Kconfig:980: symbol X86_UP_APIC depends on PCI_MSI For a resolution refer to Documentation/kbuild/kconfig-language.txt subsection "Kconfig recursive dependency limitations" drivers/pci/Kconfig:11: symbol PCI_MSI is selected by AMD_IOMMU For a resolution refer to Documentation/kbuild/kconfig-language.txt subsection "Kconfig recursive dependency limitations" drivers/iommu/Kconfig:106: symbol AMD_IOMMU depends on IOMMU_SUPPORT For a resolution refer to Documentation/kbuild/kconfig-language.txt subsection "Kconfig recursive dependency limitations" drivers/iommu/Kconfig:5: symbol IOMMU_SUPPORT is selected by DRM_ETNAVIV For a resolution refer to Documentation/kbuild/kconfig-language.txt subsection "Kconfig recursive dependency limitations" drivers/gpu/drm/etnaviv/Kconfig:2: symbol DRM_ETNAVIV depends on THERMAL For a resolution refer to Documentation/kbuild/kconfig-language.txt subsection "Kconfig recursive dependency limitations" drivers/thermal/Kconfig:5: symbol THERMAL is selected by ACPI_VIDEO For a resolution refer to Documentation/kbuild/kconfig-language.txt subsection "Kconfig recursive dependency limitations" drivers/acpi/Kconfig:183: symbol ACPI_VIDEO is selected by INPUT This doesn't currently show up as I fixed the 'THERMAL' part of it, but I noticed that the FB_STI dependency should not be there but was introduced by slightly incorrect bug-fix patch that tried to fix a link error. Instead of selecting 'VT' to make us enter the drivers/video/console directory at compile-time, it's sufficient to build the drivers/video/console/sticore.c file by adding its directory to when CONFIG_FB_STI is enabled. Alternatively, we could move the sticore code to another directory that is always built when we have at STI_CONSOLE or FB_STI enabled. Fixes: 17085a934592 ("parisc: stifb: should depend on STI_CONSOLE") Signed-off-by: Arnd Bergmann Cc: Helge Deller Cc: "James E.J. Bottomley" Cc: Alexander Beregalov Signed-off-by: Bartlomiej Zolnierkiewicz drivers/video/Makefile | 1 + drivers/video/fbdev/Kconfig | 2 -- 2 files changed, 1 insertion(+), 2 deletions(-) commit 9051247dcf9ecee156d2ddac39a4f1ca591f8428 Author: Tobias Klauser Date: Fri May 5 16:36:53 2017 +0200 bridge: netlink: account for IFLA_BRPORT_{B, M}CAST_FLOOD size and policy The attribute sizes for IFLA_BRPORT_MCAST_FLOOD and IFLA_BRPORT_BCAST_FLOOD weren't accounted for in br_port_info_size() when they were added. Do so now and also add the corresponding policy entries: Cc: Nikolay Aleksandrov Cc: Mike Manning Fixes: b6cb5ac8331b ("net: bridge: add per-port multicast flood flag") Fixes: 99f906e9ad7b ("bridge: add per-port broadcast flood flag") Signed-off-by: Tobias Klauser Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller net/bridge/br_netlink.c | 4 ++++ 1 file changed, 4 insertions(+) commit 657314b7a5d16961e7e0ecdae4a59d28123e74c0 Author: Lucas Stach Date: Fri Apr 28 17:30:52 2017 +0200 drm/etnaviv: don't put fence in case of submit failure If we bail out of the submit before actually adding the cmdstream to the kernel ring there is no valid fence to put. Make sure to skip the fence_put in that case. Signed-off-by: Lucas Stach drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 85435d7a15294f9f7ef23469e6aaf7c5dfcc54f0 Author: Björn Jacke Date: Fri May 5 04:36:16 2017 +0200 CIFS: add misssing SFM mapping for doublequote SFM is mapping doublequote to 0xF020 Without this patch creating files with doublequote fails to Windows/Mac Signed-off-by: Bjoern Jacke Signed-off-by: Steve French CC: stable fs/cifs/cifs_unicode.c | 6 ++++++ fs/cifs/cifs_unicode.h | 1 + 2 files changed, 7 insertions(+) commit f4b65b9563216b3e01a5cc844c3ba68901d9b195 Author: Che-Liang Chiou Date: Fri Apr 7 10:12:36 2017 +0200 HID: magicmouse: Set multi-touch keybits for Magic Mouse The driver emits multi-touch events for Magic Trackpad as well as Magic Mouse, but it does not set keybits that are related to multi-touch event for Magic Mouse; so set these keybits. The keybits that are not set cause trouble because user programs often probe these keybits for self-configuration and thus they cannot operate properly if the keybits are not set. One of such troubles is that libevdev will not be able to emit correct touch count, causing gestures library failed to do fling stop. Signed-off-by: Che-Liang Chiou Signed-off-by: Thierry Escande Signed-off-by: Jiri Kosina drivers/hid/hid-magicmouse.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) commit 2ac97f0f6654da14312d125005c77a6010e0ea38 Author: Jason Gerecke Date: Tue Apr 25 11:29:56 2017 -0700 HID: wacom: Have wacom_tpc_irq guard against possible NULL dereference The following Smatch complaint was generated in response to commit 2a6cdbd ("HID: wacom: Introduce new 'touch_input' device"): drivers/hid/wacom_wac.c:1586 wacom_tpc_irq() error: we previously assumed 'wacom->touch_input' could be null (see line 1577) The 'touch_input' and 'pen_input' variables point to the 'struct input_dev' used for relaying touch and pen events to userspace, respectively. If a device does not have a touch interface or pen interface, the associated input variable is NULL. The 'wacom_tpc_irq()' function is responsible for forwarding input reports to a more-specific IRQ handler function. An unknown report could theoretically be mistaken as e.g. a touch report on a device which does not have a touch interface. This can be prevented by only calling the pen/touch functions are called when the pen/touch pointers are valid. Fixes: 2a6cdbd ("HID: wacom: Introduce new 'touch_input' device") Signed-off-by: Jason Gerecke Reviewed-by: Ping Cheng Cc: stable@vger.kernel.org Signed-off-by: Jiri Kosina drivers/hid/wacom_wac.c | 45 +++++++++++++++++++++++---------------------- 1 file changed, 23 insertions(+), 22 deletions(-) commit bb4d5e38decf3f3c6bf170d19603949abb4d4b99 Merge: a6128f4 ef1d87e Author: Zhang Rui Date: Fri May 5 20:30:09 2017 +0800 Merge branch 'backup-thermal-shutdown' into next commit a6128f47f7940d8388ca7c8623fbe24e52f8fae6 Merge: 771ffa1 68b2440 Author: Zhang Rui Date: Fri May 5 20:30:03 2017 +0800 Merge branches 'thermal-core' and 'thermal-intel' into next commit 92f66f84d9695d07adf9bc987bbcce4bf9b8e87c Author: Catalin Marinas Date: Tue Apr 25 15:42:31 2017 +0100 arm64: Fix the DMA mmap and get_sgtable API with DMA_ATTR_FORCE_CONTIGUOUS While honouring the DMA_ATTR_FORCE_CONTIGUOUS on arm64 (commit 44176bb38fa4: "arm64: Add support for DMA_ATTR_FORCE_CONTIGUOUS to IOMMU"), the existing uses of dma_mmap_attrs() and dma_get_sgtable() have been broken by passing a physically contiguous vm_struct with an invalid pages pointer through the common iommu API. Since the coherent allocation with DMA_ATTR_FORCE_CONTIGUOUS uses CMA, this patch simply reuses the existing swiotlb logic for mmap and get_sgtable. Note that the current implementation of get_sgtable (both swiotlb and iommu) is broken if dma_declare_coherent_memory() is used since such memory does not have a corresponding struct page. To be addressed in a subsequent patch. Fixes: 44176bb38fa4 ("arm64: Add support for DMA_ATTR_FORCE_CONTIGUOUS to IOMMU") Reported-by: Andrzej Hajda Cc: Geert Uytterhoeven Acked-by: Robin Murphy Tested-by: Andrzej Hajda Reviewed-by: Andrzej Hajda Signed-off-by: Catalin Marinas arch/arm64/mm/dma-mapping.c | 65 ++++++++++++++++++++++++++++++++++----------- 1 file changed, 49 insertions(+), 16 deletions(-) commit dcfd9b215b89d72c1053a717571d52bf96cc64f8 Author: Fabian Frederick Date: Tue Mar 28 20:16:46 2017 +0200 befs: make export work with cold dcache based on commit b3b42c0deaa1 ("fs/affs: make export work with cold dcache") This adds get_parent function so that nfs client can still work after cache drop (Tested on NFS v4 with echo 3 > /proc/sys/vm/drop_caches) Signed-off-by: Fabian Frederick Signed-off-by: Luis de Bethencourt fs/befs/linuxvfs.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) commit 7f48d0b48cba2ddc03d09353ba4ef6ae680da520 Author: Colin Ian King Date: Tue Apr 25 10:05:12 2017 +0100 drm/i915/gvt: fix typo: "supporte" -> "support" trivial fix to typo in WARN_ONCE message Signed-off-by: Colin Ian King Signed-off-by: Zhenyu Wang drivers/gpu/drm/i915/gvt/handlers.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 65f2673832d4647f6d46783d8d745d2b15d090c4 Author: Amir Goldstein Date: Tue Apr 25 17:28:31 2017 +0300 ovl: update documentation w.r.t. constant inode numbers Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi Documentation/filesystems/overlayfs.txt | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit 5b6c9053fb38a66fd5c6177fcf5022b24767811a Author: Amir Goldstein Date: Mon Apr 24 19:54:13 2017 +0300 ovl: persistent inode numbers for upper hardlinks An upper type non directory dentry that is a copy up target should have a reference to its lower copy up origin. There are three ways for an upper type dentry to be instantiated: 1. A lower type dentry that is being copied up 2. An entry that is found in upper dir by ovl_lookup() 3. A negative dentry is hardlinked to an upper type dentry In the first case, the lower reference is set before copy up. In the second case, the lower reference is found by ovl_lookup(). In the last case of hardlinked upper dentry, it is not easy to update the lower reference of the negative dentry. Instead, drop the newly hardlinked negative dentry from dcache and let the next access call ovl_lookup() to find its lower reference. This makes sure that the inode number reported by stat(2) after the hardlink is created is the same inode number that will be reported by stat(2) after mount cycle, which is the inode number of the lower copy up origin of the hardlink source. NOTE that this does not fix breaking of lower hardlinks on copy up, but only fixes the case of lower nlink == 1, whose upper copy up inode is hardlinked in upper dir. Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi fs/overlayfs/dir.c | 3 +++ 1 file changed, 3 insertions(+) commit 5b712091a3a3904b0ae8311e18e6b540a070d464 Author: Miklos Szeredi Date: Fri May 5 11:38:58 2017 +0200 ovl: merge getattr for dir and nondir Signed-off-by: Miklos Szeredi fs/overlayfs/dir.c | 61 +----------------------------------------------- fs/overlayfs/inode.c | 31 ++++++++++++++++++++---- fs/overlayfs/overlayfs.h | 2 ++ 3 files changed, 30 insertions(+), 64 deletions(-) commit 72b608f08528458334218a809d66ea94d924c378 Author: Amir Goldstein Date: Mon Apr 24 00:25:49 2017 +0300 ovl: constant st_ino/st_dev across copy up When all layers are on the same underlying filesystem, let stat(2) return st_dev/st_ino values of the copy up origin inode if it is known. This results in constant st_ino/st_dev representation of files in an overlay mount before and after copy up. When the underlying filesystem support NFS exportfs, the result is also persistent st_ino/st_dev representation before and after mount cycle. Lower hardlinks are broken on copy up to different upper files, so we cannot use the lower origin st_ino for those different files, even for the same fs case. When all overlay layers are on the same fs, use overlay st_dev for non-dirs to get the correct result from du -x. Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi fs/overlayfs/inode.c | 39 ++++++++++++++++++++++++++++++++++++++- 1 file changed, 38 insertions(+), 1 deletion(-) commit b7a807dc2010334e62e0afd89d6f7a8913eb14ff Author: Amir Goldstein Date: Mon Apr 24 09:37:28 2017 +0300 ovl: persistent inode number for directories stat(2) on overlay directories reports the overlay temp inode number, which is constant across copy up, but is not persistent. When all layers are on the same fs, report the copy up origin inode number for directories. This inode number is persistent, unique across the overlay mount and constant across copy up. Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi fs/overlayfs/dir.c | 37 +++++++++++++++++++++++++++++++++---- 1 file changed, 33 insertions(+), 4 deletions(-) commit 595485033db2c24178257698254fd4182fdb4123 Author: Amir Goldstein Date: Sun Apr 23 23:12:34 2017 +0300 ovl: set the ORIGIN type flag For directory entries, non zero oe->numlower implies OVL_TYPE_MERGE. Define a new type flag OVL_TYPE_ORIGIN to indicate that an entry holds a reference to its lower copy up origin. For directory entries ORIGIN := MERGE && UPPER. For non-dir entries ORIGIN means that a lower type dentry has been recently copied up or that we were able to find the copy up origin from overlay.origin xattr. Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi fs/overlayfs/overlayfs.h | 2 ++ fs/overlayfs/util.c | 10 ++++++---- 2 files changed, 8 insertions(+), 4 deletions(-) commit a9d019573e881472aa62f093fa599ad68cd0fc1e Author: Amir Goldstein Date: Sun Apr 30 14:46:31 2017 +0300 ovl: lookup non-dir copy-up-origin by file handle If overlay.origin xattr is found on a non-dir upper inode try to get lower dentry by calling exportfs_decode_fh(). On failure to lookup by file handle to lower layer, do not lookup the copy up origin by name, because the lower found by name could be another file in case the upper file was renamed. Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi fs/overlayfs/namei.c | 132 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 132 insertions(+) commit c22205d0584bc65cfc9a65db0e15a9b69f5cdf64 Author: Amir Goldstein Date: Wed Apr 26 23:40:52 2017 +0300 ovl: use an auxiliary var for overlay root entry Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi fs/overlayfs/namei.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) commit 3a1e819b4e80216e00ef6a4dfe67fa142450c5e1 Author: Amir Goldstein Date: Thu Mar 30 15:22:16 2017 +0300 ovl: store file handle of lower inode on copy up Sometimes it is interesting to know if an upper file is pure upper or a copy up target, and if it is a copy up target, it may be interesting to find the copy up origin. This will be used to preserve lower inode numbers across copy up. Store the lower inode file handle in upper inode extended attribute overlay.origin on copy up to use it later for these cases. Store the lower filesystem uuid along side the file handle, so we can validate that we are looking for the origin file in the original fs. If lower fs does not support NFS export ops store a zero sized xattr so we can always use the overlay.origin xattr to distinguish between a copy up and a pure upper inode. Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi fs/overlayfs/copy_up.c | 82 ++++++++++++++++++++++++++++++++++++++++++++++++ fs/overlayfs/overlayfs.h | 36 +++++++++++++++++++++ 2 files changed, 118 insertions(+) commit 7bcd74b98d7bac3e5149894caaf72de6989af7f0 Author: Amir Goldstein Date: Wed Mar 22 08:42:21 2017 -0400 ovl: check if all layers are on the same fs Some features can only work when all layers are on the same fs. Test this condition during mount time, so features can check them later. Add helper ovl_same_sb() to return the common super block in case all layers are on the same fs. Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi fs/overlayfs/overlayfs.h | 1 + fs/overlayfs/ovl_entry.h | 2 ++ fs/overlayfs/super.c | 8 ++++++++ fs/overlayfs/util.c | 7 +++++++ 4 files changed, 18 insertions(+) commit d162809f85b4f54ef075517ffa2f3d02e55d5a53 Author: Boris Ostrovsky Date: Wed May 3 16:20:51 2017 -0400 xen/x86: Do not call xen_init_time_ops() until shared_info is initialized Routines that are set by xen_init_time_ops() use shared_info's pvclock_vcpu_time_info area. This area is not properly available until shared_info is mapped in xen_setup_shared_info(). This became especially problematic due to commit dd759d93f4dd ("x86/timers: Add simple udelay calibration") where we end up reading tsc_to_system_mul from xen_dummy_shared_info (i.e. getting zero value) and then trying to divide by it in pvclock_tsc_khz(). Signed-off-by: Boris Ostrovsky Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross arch/x86/xen/enlighten_pv.c | 9 +++++++-- arch/x86/xen/time.c | 2 +- 2 files changed, 8 insertions(+), 3 deletions(-) commit 40f4ac0b510dbf9f00668ded5474290940616d09 Author: Juergen Gross Date: Tue Apr 25 08:47:40 2017 +0200 x86/xen: fix xsave capability setting Commit 690b7f10b4f9f ("x86/xen: use capabilities instead of fake cpuid values for xsave") introduced a regression as it tried to make use of the fixup feature before it being available. Fall back to the old variant testing via cpuid(). Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross arch/x86/xen/enlighten_pv.c | 32 +++++++++----------------------- 1 file changed, 9 insertions(+), 23 deletions(-) commit 2e5b0bd9cc6172edef502dfae28ae790f74a882e Author: Jim Mattson Date: Thu May 4 11:51:58 2017 -0700 kvm: nVMX: Don't validate disabled secondary controls According to the SDM, if the "activate secondary controls" primary processor-based VM-execution control is 0, no checks are performed on the secondary processor-based VM-execution controls. Signed-off-by: Jim Mattson Signed-off-by: Paolo Bonzini arch/x86/kvm/vmx.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit ef1d87e06ab4d3f9a95f02517ecc50902dc233a7 Author: Keerthy Date: Tue Apr 18 09:59:59 2017 +0530 thermal: core: Add a back up thermal shutdown mechanism orderly_poweroff is triggered when a graceful shutdown of system is desired. This may be used in many critical states of the kernel such as when subsystems detects conditions such as critical temperature conditions. However, in certain conditions in system boot up sequences like those in the middle of driver probes being initiated, userspace will be unable to power off the system in a clean manner and leaves the system in a critical state. In cases like these, the /sbin/poweroff will return success (having forked off to attempt powering off the system. However, the system overall will fail to completely poweroff (since other modules will be probed) and the system is still functional with no userspace (since that would have shut itself off). However, there is no clean way of detecting such failure of userspace powering off the system. In such scenarios, it is necessary for a backup workqueue to be able to force a shutdown of the system when orderly shutdown is not successful after a configurable time period. Reported-by: Nishanth Menon Signed-off-by: Keerthy Acked-by: Eduardo Valentin Signed-off-by: Zhang Rui Documentation/thermal/sysfs-api.txt | 21 +++++++++++++++ drivers/thermal/Kconfig | 17 ++++++++++++ drivers/thermal/thermal_core.c | 53 +++++++++++++++++++++++++++++++++++++ 3 files changed, 91 insertions(+) commit e441fd68663e298e99a99e215e0144a0eda6250d Author: Keerthy Date: Tue Apr 18 09:59:58 2017 +0530 thermal: core: Allow orderly_poweroff to be called only once thermal_zone_device_check --> thermal_zone_device_update --> handle_thermal_trip --> handle_critical_trips --> orderly_poweroff The above sequence happens every 250/500 mS based on the configuration. The orderly_poweroff function is getting called every 250/500 mS. With a full fledged file system it takes at least 5-10 Seconds to power off gracefully. In that period due to the thermal_zone_device_check triggering periodically the thermal work queues bombard with orderly_poweroff calls multiple times eventually leading to failures in gracefully powering off the system. Make sure that orderly_poweroff is called only once. Signed-off-by: Keerthy Acked-by: Eduardo Valentin Signed-off-by: Zhang Rui drivers/thermal/thermal_core.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) commit 68b2440b2a4beaa393d8ed97ac619fd1c94a549e Author: Brian Bian Date: Wed Apr 12 14:07:17 2017 -0700 Thermal: Intel SoC DTS: Change interrupt request behavior The interrupt request call in Intel SoC DTS driver may fail if there is no underlying BIOS support. However, the user space thermal daemon can still use the thermal zones created by the SoC DTS driver in polling mode, therefore, instead of bailing out on interrupt request failures, it is better just to log a warning message and continue the init process. Signed-off-by: Brian Bian Signed-off-by: Zhang Rui drivers/thermal/intel_soc_dts_thermal.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 771ffa14ead18887bed400c09f4bde5bca5bf342 Author: Lukasz Luba Date: Thu May 4 12:34:33 2017 +0100 trace: thermal: add another parameter 'power' to the tracing function This patch adds another parameter to the trace function: trace_thermal_power_devfreq_get_power(). In case when we call directly driver's code for the real power, we do not have static/dynamic_power values. Instead we get total power in the '*power' value. The 'static_power' and 'dynamic_power' are set to 0. Therefore, we have to trace that '*power' value in this scenario. CC: Steven Rostedt CC: Ingo Molnar CC: Zhang Rui CC: Eduardo Valentin Acked-by: Javi Merino Signed-off-by: Lukasz Luba drivers/thermal/devfreq_cooling.c | 2 +- include/trace/events/thermal.h | 11 +++++++---- 2 files changed, 8 insertions(+), 5 deletions(-) commit 2be83da85a64773efaa407639de81bd1377f880e Author: Lukasz Luba Date: Thu May 4 12:34:32 2017 +0100 thermal: devfreq_cooling: add new interface for direct power read This patch introduces a new interface for device drivers connected to devfreq_cooling in the thermal framework: get_real_power(). Some devices have more sophisticated methods (like power counters) to approximate the actual power that they use. In the previous implementation we had a pre-calculated power table which was then scaled by 'utilization' ('busy_time' and 'total_time' taken from devfreq 'last_status'). With this new interface the driver can provide more precise data regarding actual power to the thermal governor every time the power budget is calculated. We then use this value and calculate the real resource utilization scaling factor. Reviewed-by: Chris Diamand Acked-by: Javi Merino Signed-off-by: Lukasz Luba drivers/thermal/devfreq_cooling.c | 105 +++++++++++++++++++++++++++++--------- include/linux/devfreq_cooling.h | 19 +++++++ 2 files changed, 101 insertions(+), 23 deletions(-) commit e34cab4cd1f98b4daed5bc98fe727e63f8dbf4e4 Author: Lukasz Luba Date: Thu May 4 12:34:31 2017 +0100 thermal: devfreq_cooling: refactor code and add get_voltage function Move the code which gets the voltage for a given frequency. This code will be resused in few places. Acked-by: Javi Merino Signed-off-by: Lukasz Luba drivers/thermal/devfreq_cooling.c | 45 ++++++++++++++++++++++++--------------- 1 file changed, 28 insertions(+), 17 deletions(-) commit 17a9be31747535184f2af156b1f080ec4c92a952 Author: Stafford Horne Date: Thu May 4 21:15:56 2017 +0900 initramfs: Always do fput() and load modules after rootfs populate In OpenRISC we do not have a bootloader passed initrd, but the built in initramfs does contain the /init and other binaries, including modules. The previous commit 08865514805d2 ("initramfs: finish fput() before accessing any binary from initramfs") made a change to only call fput() if the bootloader initrd was available, this caused intermittent crashes for OpenRISC. This patch changes the fput() to happen unconditionally if any rootfs is loaded. Also, I added some comments to make it a bit more clear why we call unpack_to_rootfs() multiple times. Fixes: 08865514805d2 ("initramfs: finish fput() before accessing any binary from initramfs") Cc: stable@vger.kernel.org Cc: Lokesh Vutla Cc: Al Viro Acked-by: Al Viro Signed-off-by: Stafford Horne init/initramfs.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) commit 736163671bcb163fc82600b46c83dfa89d532d95 Merge: d5483fe 1ef97fe Author: Dan Williams Date: Thu May 4 23:38:43 2017 -0700 Merge branch 'for-4.12/dax' into libnvdimm-for-next commit 121843eb02a6e2fa30aefab64bfe183c97230c75 Author: Matthias Kaehlcke Date: Mon May 1 15:47:41 2017 -0700 x86/mm/kaslr: Use the _ASM_MUL macro for multiplication to work around Clang incompatibility The constraint "rm" allows the compiler to put mix_const into memory. When the input operand is a memory location then MUL needs an operand size suffix, since Clang can't infer the multiplication width from the operand. Add and use the _ASM_MUL macro which determines the operand size and resolves to the NUL instruction with the corresponding suffix. This fixes the following error when building with clang: CC arch/x86/lib/kaslr.o /tmp/kaslr-dfe1ad.s: Assembler messages: /tmp/kaslr-dfe1ad.s:182: Error: no instruction mnemonic suffix given and no register operands; can't size instruction Signed-off-by: Matthias Kaehlcke Cc: Grant Grundler Cc: Greg Hackmann Cc: Kees Cook Cc: Linus Torvalds Cc: Michael Davidson Cc: Peter Zijlstra Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/20170501224741.133938-1-mka@chromium.org Signed-off-by: Ingo Molnar arch/x86/include/asm/asm.h | 1 + arch/x86/lib/kaslr.c | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) commit 61baf15555129f69720334f232b153890895ef71 Author: Scott Wood Date: Fri May 5 01:22:06 2017 -0500 powerpc/64e: Don't place the stack beyond TASK_SIZE Commit f4ea6dcb08ea ("powerpc/mm: Enable mappings above 128TB") increased the task size on book3s, and introduced a mechanism to dynamically control whether a task uses these larger addresses. While the change to the task size itself was ifdef-protected to only apply on book3s, the change to STACK_TOP_USER64 was not. On book3e, this had the effect of trying to use addresses up to 128TiB for the stack despite a 64TiB task size limit -- which broke 64-bit userspace producing the following errors: Starting init: /sbin/init exists but couldn't execute it (error -14) Starting init: /bin/sh exists but couldn't execute it (error -14) Kernel panic - not syncing: No working init found. Try passing init= option to kernel. See Linux Documentation/admin-guide/init.rst for guidance. Fixes: f4ea6dcb08ea ("powerpc/mm: Enable mappings above 128TB") Cc: Aneesh Kumar K.V Signed-off-by: Scott Wood arch/powerpc/include/asm/processor.h | 5 +++++ 1 file changed, 5 insertions(+) commit fc5f9d5f151c9fff21d3d1d2907b888a5aec3ff7 Author: Baoquan He Date: Thu May 4 10:25:47 2017 +0800 x86/mm: Fix boot crash caused by incorrect loop count calculation in sync_global_pgds() Jeff Moyer reported that on his system with two memory regions 0~64G and 1T~1T+192G, and kernel option "memmap=192G!1024G" added, enabling KASLR will make the system hang intermittently during boot. While adding 'nokaslr' won't. The back trace is: Oops: 0000 [#1] SMP RIP: memcpy_erms() [ .... ] Call Trace: pmem_rw_page() bdev_read_page() do_mpage_readpage() mpage_readpages() blkdev_readpages() __do_page_cache_readahead() force_page_cache_readahead() page_cache_sync_readahead() generic_file_read_iter() blkdev_read_iter() __vfs_read() vfs_read() SyS_read() entry_SYSCALL_64_fastpath() This crash happens because the for loop count calculation in sync_global_pgds() is not correct. When a mapping area crosses PGD entries, we should calculate the starting address of region which next PGD covers and assign it to next for loop count, but not add PGDIR_SIZE directly. The old code works right only if the mapping area is an exact multiple of PGDIR_SIZE, otherwize the end region could be skipped so that it can't be synchronized to all other processes from kernel PGD init_mm.pgd. In Jeff's system, emulated pmem area [1024G, 1216G) is smaller than PGDIR_SIZE. While 'nokaslr' works because PAGE_OFFSET is 1T aligned, it makes this area be mapped inside one PGD entry. With KASLR enabled, this area could cross two PGD entries, then the next PGD entry won't be synced to all other processes. That is why we saw empty PGD. Fix it. Reported-by: Jeff Moyer Signed-off-by: Baoquan He Cc: Andrew Morton Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Brian Gerst Cc: Dan Williams Cc: Dave Hansen Cc: Dave Young Cc: Denys Vlasenko Cc: H. Peter Anvin Cc: Jinbum Park Cc: Josh Poimboeuf Cc: Kees Cook Cc: Kirill A. Shutemov Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Garnier Cc: Thomas Gleixner Cc: Yasuaki Ishimatsu Cc: Yinghai Lu Link: http://lkml.kernel.org/r/1493864747-8506-1-git-send-email-bhe@redhat.com Signed-off-by: Ingo Molnar arch/x86/mm/init_64.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 415812f2d6b856d33ede9bf4a2b95575dbbb3d4e Merge: 42fc6c6 d3b5d35 Author: Ingo Molnar Date: Fri May 5 08:20:52 2017 +0200 Merge branch 'linus' into x86/urgent, to pick up dependent commits We are going to fix a bug introduced by a more recent commit, so refresh the tree. Signed-off-by: Ingo Molnar commit 5ea30e4e58040cfd6434c2f33dc3ea76e2c15b05 Author: Daniel Micay Date: Thu May 4 09:32:09 2017 -0400 stackprotector: Increase the per-task stack canary's random range from 32 bits to 64 bits on 64-bit platforms The stack canary is an 'unsigned long' and should be fully initialized to random data rather than only 32 bits of random data. Signed-off-by: Daniel Micay Acked-by: Arjan van de Ven Acked-by: Rik van Riel Acked-by: Kees Cook Cc: Arjan van Ven Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: kernel-hardening@lists.openwall.com Cc: stable@vger.kernel.org Link: http://lkml.kernel.org/r/20170504133209.3053-1-danielmicay@gmail.com Signed-off-by: Ingo Molnar kernel/fork.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 42fc6c6cb1662ba2fa727dd01c9473c63be4e3b6 Author: Josh Poimboeuf Date: Thu May 4 09:51:40 2017 -0500 x86/asm: Don't use RBP as a temporary register in csum_partial_copy_generic() Andrey Konovalov reported the following warning while fuzzing the kernel with syzkaller: WARNING: kernel stack regs at ffff8800686869f8 in a.out:4933 has bad 'bp' value c3fc855a10167ec0 The unwinder dump revealed that RBP had a bad value when an interrupt occurred in csum_partial_copy_generic(). That function saves RBP on the stack and then overwrites it, using it as a scratch register. That's problematic because it breaks stack traces if an interrupt occurs in the middle of the function. Replace the usage of RBP with another callee-saved register (R15) so stack traces are no longer affected. Reported-by: Andrey Konovalov Tested-by: Andrey Konovalov Signed-off-by: Josh Poimboeuf Cc: Cong Wang Cc: David S . Miller Cc: Dmitry Vyukov Cc: Eric Dumazet Cc: Kostya Serebryany Cc: Linus Torvalds Cc: Marcelo Ricardo Leitner Cc: Neil Horman Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Vlad Yasevich Cc: linux-sctp@vger.kernel.org Cc: netdev Cc: syzkaller Link: http://lkml.kernel.org/r/4b03a961efda5ec9bfe46b7b9c9ad72d1efad343.1493909486.git.jpoimboe@redhat.com Signed-off-by: Ingo Molnar arch/x86/lib/csum-copy_64.S | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit d906d8af28e524bfa62c49cb2315f6ccdb910938 Author: Mike Christie Date: Tue May 2 23:57:05 2017 -0500 tcmu: fix module removal due to stuck thread We need to do a kthread_should_stop to check when kthread_stop has been called. This was a regression added in b6df4b79a5514a9c6c53533436704129ef45bf76 tcmu: Add global data block pool support so not sure if you wanted to merge it in with that patch or what. Signed-off-by: Mike Christie Signed-off-by: Nicholas Bellinger drivers/target/target_core_user.c | 3 +++ 1 file changed, 3 insertions(+) commit 46861cdd80e1a862dc65d10833a1450861fabef7 Author: Nicholas Bellinger Date: Tue Apr 25 13:52:45 2017 -0700 target: Don't force session reset if queue_depth does not change Keeping in the idempotent nature of target_core_fabric_configfs.c, if a queue_depth value is set and it's the same as the existing value, don't attempt to force session reinstatement. Reported-by: Raghu Krishnamurthy Cc: Raghu Krishnamurthy Tested-by: Gary Guo Cc: Gary Guo Signed-off-by: Nicholas Bellinger drivers/target/target_core_tpg.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 197b806ae5db60c6f609d74da04ddb62ea5e1b00 Author: Nicholas Bellinger Date: Tue Apr 25 10:55:12 2017 -0700 iscsi-target: Set session_fall_back_to_erl0 when forcing reinstatement While testing modification of per se_node_acl queue_depth forcing session reinstatement via lio_target_nacl_cmdsn_depth_store() -> core_tpg_set_initiator_node_queue_depth(), a hung task bug triggered when changing cmdsn_depth invoked session reinstatement while an iscsi login was already waiting for session reinstatement to complete. This can happen when an outstanding se_cmd descriptor is taking a long time to complete, and session reinstatement from iscsi login or cmdsn_depth change occurs concurrently. To address this bug, explicitly set session_fall_back_to_erl0 = 1 when forcing session reinstatement, so session reinstatement is not attempted if an active session is already being shutdown. This patch has been tested with two scenarios. The first when iscsi login is blocked waiting for iscsi session reinstatement to complete followed by queue_depth change via configfs, and second when queue_depth change via configfs us blocked followed by a iscsi login driven session reinstatement. Note this patch depends on commit d36ad77f702 to handle multiple sessions per se_node_acl when changing cmdsn_depth, and for pre v4.5 kernels will need to be included for stable as well. Reported-by: Gary Guo Tested-by: Gary Guo Cc: Gary Guo Cc: # v4.1+ Signed-off-by: Nicholas Bellinger drivers/target/iscsi/iscsi_target.c | 1 + drivers/target/iscsi/iscsi_target_configfs.c | 1 + drivers/target/iscsi/iscsi_target_login.c | 1 + 3 files changed, 3 insertions(+) commit a71a5dc7f833943998e97ca8fa6a4c708a0ed1a9 Author: Nicholas Bellinger Date: Tue Apr 11 16:24:16 2017 -0700 target: Fix compare_and_write_callback handling for non GOOD status Following the bugfix for handling non SAM_STAT_GOOD COMPARE_AND_WRITE status during COMMIT phase in commit 9b2792c3da1, the same bug exists for the READ phase as well. This would manifest first as a lost SCSI response, and eventual hung task during fabric driver logout or re-login, as existing shutdown logic waited for the COMPARE_AND_WRITE se_cmd->cmd_kref to reach zero. To address this bug, compare_and_write_callback() has been changed to set post_ret = 1 and return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE as necessary to signal failure status. Reported-by: Bill Borsari Cc: Bill Borsari Tested-by: Gary Guo Cc: Gary Guo Cc: # v4.1+ Signed-off-by: Nicholas Bellinger drivers/target/target_core_sbc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit d5483feda85a8f39ee2e940e279547c686aac30c Author: Dan Williams Date: Thu May 4 19:54:42 2017 -0700 libnvdimm, pfn: fix 'npfns' vs section alignment Fix failures to create namespaces due to the vmem_altmap not advertising enough free space to store the memmap. WARNING: CPU: 15 PID: 8022 at arch/x86/mm/init_64.c:656 arch_add_memory+0xde/0xf0 [..] Call Trace: dump_stack+0x63/0x83 __warn+0xcb/0xf0 warn_slowpath_null+0x1d/0x20 arch_add_memory+0xde/0xf0 devm_memremap_pages+0x244/0x440 pmem_attach_disk+0x37e/0x490 [nd_pmem] nd_pmem_probe+0x7e/0xa0 [nd_pmem] nvdimm_bus_probe+0x71/0x120 [libnvdimm] driver_probe_device+0x2bb/0x460 bind_store+0x114/0x160 drv_attr_store+0x25/0x30 In commit 658922e57b84 "libnvdimm, pfn: fix memmap reservation sizing" we arranged for the capacity to be allocated, but failed to also update the 'npfns' parameter. This leads to cases where there is enough capacity reserved to hold all the allocated sections, but vmemmap_populate_hugepages() still encounters -ENOMEM from altmap_alloc_block_buf(). This fix is a stop-gap until we can teach the core memory hotplug implementation to permit sub-section hotplug. Cc: Fixes: 658922e57b84 ("libnvdimm, pfn: fix memmap reservation sizing") Reported-by: Anisha Allada Signed-off-by: Dan Williams drivers/nvdimm/pfn_devs.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit af82455f7dbd9dc20244d80d033721b30d22c065 Merge: 0be7517 2a76f89 Author: Linus Torvalds Date: Thu May 4 19:07:10 2017 -0700 Merge tag 'char-misc-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver updates from Greg KH: "Here is the big set of new char/misc driver drivers and features for 4.12-rc1. There's lots of new drivers added this time around, new firmware drivers from Google, more auxdisplay drivers, extcon drivers, fpga drivers, and a bunch of other driver updates. Nothing major, except if you happen to have the hardware for these drivers, and then you will be happy :) All of these have been in linux-next for a while with no reported issues" * tag 'char-misc-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (136 commits) firmware: google memconsole: Fix return value check in platform_memconsole_init() firmware: Google VPD: Fix return value check in vpd_platform_init() goldfish_pipe: fix build warning about using too much stack. goldfish_pipe: An implementation of more parallel pipe fpga fr br: update supported version numbers fpga: region: release FPGA region reference in error path fpga altera-hps2fpga: disable/unprepare clock on error in alt_fpga_bridge_probe() mei: drop the TODO from samples firmware: Google VPD sysfs driver firmware: Google VPD: import lib_vpd source files misc: lkdtm: Add volatile to intentional NULL pointer reference eeprom: idt_89hpesx: Add OF device ID table misc: ds1682: Add OF device ID table misc: tsl2550: Add OF device ID table w1: Remove unneeded use of assert() and remove w1_log.h w1: Use kernel common min() implementation uio_mf624: Align memory regions to page size and set correct offsets uio_mf624: Refactor memory info initialization uio: Allow handling of non page-aligned memory regions hangcheck-timer: Fix typo in comment ... commit 8676df503092dcdd757b1120fab03bfbce0ae1e7 Author: Daniel Vetter Date: Tue Apr 18 12:10:57 2017 +0200 drm: Document code of conduct freedesktop.org has adopted a formal&enforced code of conduct: https://www.fooishbar.org/blog/fdo-contributor-covenant/ https://www.freedesktop.org/wiki/CodeOfConduct/ Besides formalizing things a bit more I don't think this changes anything for us, we've already peer-enforced respectful and constructive interactions since a long time. But it's good to document things properly. v2: Drop confusing note from commit message and clarify the grammer (Chris, Alex and others). Cc: Daniel Stone Cc: Keith Packard Cc: tfheen@err.no Signed-off-by: Daniel Vetter Reviewed-by: Daniel Stone Reviewed-by: Sumit Semwal Acked-by: Archit Taneja Reviewed-by: Martin Peres Acked-by: Thierry Reding Acked-by: Jani Nikula Acked-by: Vincent Abriou Acked-by: Neil Armstrong Reviewed-by: Maarten Lankhorst Acked-by: Brian Starkey Acked-by: Rob Clark Reviewed-by: David Herrmann Acked-by: Sean Paul Reviewed-by: Harry Wentland Reviewed-by: Eric Anholt Acked-by: Alex Deucher Acked-by: Gustavo Padovan Acked-by: Michel Dänzer Acked-by: Laurent Pinchart Acked-by: Sumit Semwal Acked-by: Keith Packard Acked-by: Gabriel Krisman Bertazi Acked-by: Adam Jackson Signed-off-by: Dave Airlie Documentation/gpu/introduction.rst | 11 +++++++++++ 1 file changed, 11 insertions(+) commit 644b4930bf7e2adeffbe842e1097f7933c6a9158 Merge: 8b03d1e b0d36da Author: Dave Airlie Date: Fri May 5 11:47:01 2017 +1000 Merge tag 'drm/tegra/for-4.12-rc1' of git://anongit.freedesktop.org/tegra/linux into drm-next drm/tegra: Changes for v4.12-rc1 This contains various fixes to the host1x driver as well as a plug for a leak of kernel pointers to userspace. A fairly big addition this time around is the Video Image Composer (VIC) support that can be used to accelerate some 2D and image compositing operations. Furthermore the driver now supports FB modifiers, so we no longer rely on a custom IOCTL to set those. Finally this contains a few preparatory patches for Tegra186 support which unfortunately didn't quite make it this time, but will hopefully be ready for v4.13. * tag 'drm/tegra/for-4.12-rc1' of git://anongit.freedesktop.org/tegra/linux: gpu: host1x: Fix host1x driver shutdown gpu: host1x: Support module reset gpu: host1x: Sort includes alphabetically drm/tegra: Add VIC support dt-bindings: Add bindings for the Tegra VIC drm/tegra: Add falcon helper library drm/tegra: Add Tegra DRM allocation API drm/tegra: Add tiling FB modifiers drm/tegra: Don't leak kernel pointer to userspace drm/tegra: Protect IOMMU operations by mutex drm/tegra: Enable IOVA API when IOMMU support is enabled gpu: host1x: Add IOMMU support gpu: host1x: Fix potential out-of-bounds access iommu/iova: Fix compile error with CONFIG_IOMMU_IOVA=m iommu: Add dummy implementations for !IOMMU_IOVA MAINTAINERS: Add related headers to IOMMU section iommu/iova: Consolidate code for adding new node to iovad domain rbtree commit 0be75179df5e20306528800fc7c6a504b12b97db Merge: 8f28472 523aa35 Author: Linus Torvalds Date: Thu May 4 18:27:46 2017 -0700 Merge tag 'driver-core-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core Pull driver core updates from Greg KH: "Very tiny pull request for 4.12-rc1 for the driver core this time around. There are some documentation fixes, an eventpoll.h fixup to make it easier for the libc developers to take our header files directly, and some very minor driver core fixes and changes. All have been in linux-next for a very long time with no reported issues" * tag 'driver-core-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: Revert "kref: double kref_put() in my_data_handler()" driver core: don't initialize 'parent' in device_add() drivers: base: dma-mapping: use nth_page helper Documentation/ABI: add information about cpu_capacity debugfs: set no_llseek in DEFINE_DEBUGFS_ATTRIBUTE eventpoll.h: add missing epoll event masks eventpoll.h: fix epoll event masks commit 8f28472a739e8e39adc6e64ee5b460df039f0e4f Merge: 4ac4d58 c034a43 Author: Linus Torvalds Date: Thu May 4 18:03:51 2017 -0700 Merge tag 'usb-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB updates from Greg KH: "Here is the big USB patchset for 4.12-rc1. Lots of good stuff here, after many many many attempts, the kernel finally has a working typeC interface, many thanks to Heikki and Guenter and others who have taken the time to get this merged. It wasn't an easy path for them at all. There's also a staging driver that uses this new api, which is why it's coming in through this tree. Along with that, there's the usual huge number of changes for gadget drivers, xhci, and other stuff. Johan also finally refactored pretty much every driver that was looking at USB endpoints to do it in a common way, which will help prevent any "badly-formed" devices from causing problems in drivers. That too wasn't a simple task. All of these have been in linux-next for a while with no reported issues" * tag 'usb-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (263 commits) staging: typec: Fairchild FUSB302 Type-c chip driver staging: typec: Type-C Port Controller Interface driver (tcpci) staging: typec: USB Type-C Port Manager (tcpm) usb: host: xhci: remove #ifdef around PM functions usb: musb: don't mark of_dev_auxdata as initdata usb: misc: legousbtower: Fix buffers on stack USB: Revert "cdc-wdm: fix "out-of-sync" due to missing notifications" usb: Make sure usb/phy/of gets built-in USB: storage: e-mail update in drivers/usb/storage/unusual_devs.h usb: host: xhci: print correct command ring address usb: host: xhci: delete sp_dma_buffers for scratchpad usb: host: xhci: using correct specification chapter reference for DCBAAP xhci: switch to pci_alloc_irq_vectors usb: host: xhci-plat: set resume_quirk() for R-Car controllers usb: host: xhci-plat: add resume_quirk() usb: host: xhci-plat: enable clk in resume timing usb: host: plat: Enable xHCI plat runtime PM USB: serial: ftdi_sio: add device ID for Microsemi/Arrow SF2PLUS Dev Kit USB: serial: constify static arrays usb: fix some references for /proc/bus/usb ... commit 9bcaaea7418d09691f1ffab5c49aacafe3eef9d0 Author: Chris Mason Date: Thu May 4 16:08:08 2017 -0700 btrfs: fix the gfp_mask for the reada_zones radix tree Commits cc8385b59e17 and 7ef70b4d9987a7 added preallocation for the reada radix trees and also switched them over to GFP_KERNEL for the default gfp mask. Since we're doing radix tree insertions under spinlocks, we need to make sure the mask doesn't allow sleeping. This fix keeps the radix preallocation but switches back to the original gfp_mask. Reported-by: Filipe Manana Signed-off-by: Chris Mason fs/btrfs/disk-io.c | 2 +- fs/btrfs/volumes.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit deccf497d804a4c5fca2dbfad2f104675a6f9102 Author: David Howells Date: Thu May 4 23:30:16 2017 +0100 Make stat/lstat/fstatat pass AT_NO_AUTOMOUNT to vfs_statx() stat/lstat/fstatat need to pass AT_NO_AUTOMOUNT to vfs_statx() as the pre-statx code didn't set LOOKUP_AUTOMOUNT, even though fstatat() accepted the AT_NO_AUTOMOUNT flag. Fixes: a528d35e8bfc ("statx: Add a system call to make enhanced file info available") Reported-by: Ian Kent Signed-off-by: David Howells Tested-by: Ian Kent cc: stable@vger.kernel.org Signed-off-by: Al Viro include/linux/fs.h | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit 67cf3623e097706b0ca03bf79bf28d60c39591eb Author: Sagi Grimberg Date: Thu May 4 16:23:07 2017 +0300 rxe: expose num_possible_cpus() cnum_comp_vectors They're completely logical, so don't impose an artificial limitation. Signed-off-by: Sagi Grimberg Reviewed-by: Leon Romanovsky Acked-by: Moni Shoua Signed-off-by: Doug Ledford drivers/infiniband/sw/rxe/rxe_param.h | 1 - drivers/infiniband/sw/rxe/rxe_verbs.c | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) commit af5df5fb59ee01e78fd334c3d6202d9e7bcfddd3 Author: Leon Romanovsky Date: Thu May 4 15:36:07 2017 +0300 IB/rxe: Update caller's CRC for RXE_MEM_TYPE_DMA memory type Callers of rxe_mem_copy() provide pointer to store updated CRC value. That pointer was supposed to be updated, but the commit cee2688e3cd6 ("IB/rxe: Offload CRC calculation when possible") mistakenly removed that assignment for RXE_MEM_TYPE_DMA memory type. The code worked because there are no actual callers with RXE_MEM_TYPE_DMA, who are interested in returned value of crcp. The one caller in read_reply(), who uses the returned crcp didn't set RXE_MEM_TYPE_DMA as mem->type. Fixes: cee2688e3cd6 ("IB/rxe: Offload CRC calculation when possible") Reported-by: Andrew Boyer Signed-off-by: Leon Romanovsky Acked-by: Moni Shoua Reviewed-by: Andrew Boyer Reviewed-by: Sagi Grimberg Signed-off-by: Doug Ledford drivers/infiniband/sw/rxe/rxe_mr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 62239fc6e5545b2e59f83dfbc5db231a81f37a45 Author: Michael J. Ruhl Date: Thu May 4 05:15:21 2017 -0700 IB/hfi1: Clean up on context initialization failure The error path for context initialization is not consistent. Cleanup all resources on failure. Removed unused variable user_event_mask. Add the _BASE_FAILED bit to the event flags so that a base context can notify waiting sub contexts that they cannot continue. Running out of sub contexts is an EBUSY result, not EINVAL. Reviewed-by: Mike Marciniszyn Signed-off-by: Michael J. Ruhl Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/file_ops.c | 62 +++++++++++++++++++------------ drivers/infiniband/hw/hfi1/hfi.h | 16 +++----- drivers/infiniband/hw/hfi1/init.c | 10 ++--- drivers/infiniband/hw/hfi1/user_exp_rcv.c | 31 +++++++++------- drivers/infiniband/hw/hfi1/user_sdma.c | 61 +++++++++++++++--------------- 5 files changed, 95 insertions(+), 85 deletions(-) commit 8737ce95c463c6d8c4307ab3d6858cbf71cd4fc8 Author: Michael J. Ruhl Date: Thu May 4 05:15:15 2017 -0700 IB/hfi1: Fix an assign/ordering issue with shared context IDs The current algorithm for generating sub-context IDs is FILO. If the contexts are not closed in that order, the uniqueness of the ID will be compromised. I.e. logging the creation/deletion of context IDs with an application that assigns and closes in a FIFO order reveals: cache_id: assign: uctxt: 3 sub_ctxt: 0 cache_id: assign: uctxt: 3 sub_ctxt: 1 cache_id: assign: uctxt: 3 sub_ctxt: 2 cache_id: close: uctxt: 3 sub_ctxt: 0 cache_id: assign: uctxt: 3 sub_ctxt: 2 <<< The sub_ctxt ID 2 is reused incorrectly. Update the sub-context ID assign algorithm to use a bitmask of in_use contexts. The new algorithm will allow the contexts to be closed in any order, and will only re-use unused contexts. Size subctxt and subctxt_cnt to match the user API size. Reviewed-by: Mike Marciniszyn Signed-off-by: Michael J. Ruhl Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/driver.c | 2 +- drivers/infiniband/hw/hfi1/file_ops.c | 51 +++++++++++++++++++++------------- drivers/infiniband/hw/hfi1/hfi.h | 8 +++--- drivers/infiniband/hw/hfi1/init.c | 3 +- drivers/infiniband/hw/hfi1/intr.c | 3 +- drivers/infiniband/hw/hfi1/user_sdma.h | 2 +- 6 files changed, 41 insertions(+), 28 deletions(-) commit 9b60d2cbe07486658a32d4ed2fff7085c44bae7a Author: Michael J. Ruhl Date: Thu May 4 05:15:09 2017 -0700 IB/hfi1: Clean up context initialization Context initialization mixes base context init with sub context init. This is bad because contexts can be reused, and on reuse, reinit things that should not re-initialized. Normalize comments and function names to refer to base context and sub context (not main, shared or slaves). Separate the base context initialization from sub context initialization. hfi1_init_ctxt() cannot return an error so changed to a void and remove error message. Reviewed-by: Mike Marciniszyn Signed-off-by: Michael J. Ruhl Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/chip.c | 3 +- drivers/infiniband/hw/hfi1/chip.h | 2 +- drivers/infiniband/hw/hfi1/file_ops.c | 179 +++++++++++++++--------------- drivers/infiniband/hw/hfi1/hfi.h | 13 +-- drivers/infiniband/hw/hfi1/init.c | 10 +- drivers/infiniband/hw/hfi1/trace_ctxts.h | 17 ++- drivers/infiniband/hw/hfi1/user_exp_rcv.c | 84 +++++++------- drivers/infiniband/hw/hfi1/user_exp_rcv.h | 3 +- drivers/infiniband/hw/hfi1/vnic_main.c | 6 +- 9 files changed, 159 insertions(+), 158 deletions(-) commit 637a9a7febf8b48d2ac1916f34d639aa81998a8a Author: Michael J. Ruhl Date: Thu May 4 05:15:03 2017 -0700 IB/hfi1: Correctly clear the pkey In the close path the context is removed from the device array, and then the clear pkey function is called. The pkey function trys to get the context from the device array, but because it was removed the clearing does not occur. Rework pkey clear function to work as expected. Update the function variable to reflect the correct size and name of the hw_context. Reviewed-by: Mike Marciniszyn Signed-off-by: Michael J. Ruhl Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/chip.c | 34 ++++++++++++++-------------------- drivers/infiniband/hw/hfi1/chip.h | 2 +- drivers/infiniband/hw/hfi1/file_ops.c | 2 +- drivers/infiniband/hw/hfi1/vnic_main.c | 2 +- 4 files changed, 17 insertions(+), 23 deletions(-) commit 5fbded483c699823a7cca001a5c27ddc4d73370f Author: Michael J. Ruhl Date: Thu May 4 05:14:57 2017 -0700 IB/hfi1: Search shared contexts on the opened device, not all devices The search for available shared contexts walks each registered hfi1 device. This search is too broad because other devices may not be on the same fabric, and using its contexts could cause unexpected behavior. Removed walking the list of devices, limiting the search to the opened device. With the device walk removed, the hfi1_devdata (dd) is not available. Added it to the hfi1_filedata for reference. With this change, hfi1_count_units() was rendered obsolete and was removed. Reviewed-by: Mike Marciniszyn Signed-off-by: Michael J. Ruhl Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/driver.c | 36 ---------- drivers/infiniband/hw/hfi1/file_ops.c | 122 +++++++++++++--------------------- drivers/infiniband/hw/hfi1/hfi.h | 2 +- 3 files changed, 49 insertions(+), 111 deletions(-) commit 780a4c16aaacba3746a20d9138a5b1f467035ffc Author: Sebastian Sanchez Date: Thu May 4 05:14:51 2017 -0700 IB/hfi1: Remove atomic operations for SDMA_REQ_HAVE_AHG bit The AHG index is only accessed in the request call from user space, so there's no need for atomic semantics. Replace atomic operations for SDMA_REQ_HAVE_AHG bit with a test of the AHG index. Reviewed-by: Mike Marciniszyn Signed-off-by: Sebastian Sanchez Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/user_sdma.c | 22 ++++++++-------------- 1 file changed, 8 insertions(+), 14 deletions(-) commit 5042cddfd058a2db419ba7aaadc866e8dccca06c Author: Michael J. Ruhl Date: Thu May 4 05:14:45 2017 -0700 IB/hfi1: Use filedata rather than filepointer Since almost all functions that use the hfi1_filedata get the pointer from the file pointer, simplify by only passing the hfi1_filedata pointer. Reviewed-by: Dennis Dalessandro Reviewed-by: Ira Weiny Signed-off-by: Michael J. Ruhl Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/file_ops.c | 68 +++++++++++++++---------------- drivers/infiniband/hw/hfi1/user_exp_rcv.c | 45 +++++++++----------- drivers/infiniband/hw/hfi1/user_exp_rcv.h | 11 +++-- drivers/infiniband/hw/hfi1/user_sdma.c | 14 +++---- drivers/infiniband/hw/hfi1/user_sdma.h | 9 ++-- 5 files changed, 72 insertions(+), 75 deletions(-) commit f4cd876529194b2d3f653c645ba203688e9e4ba3 Author: Michael J. Ruhl Date: Thu May 4 05:14:39 2017 -0700 IB/hfi1: Name function prototype parameters To improve the readability of function prototypes, give the parameters names. Reviewed-by: Dennis Dalessandro Signed-off-by: Michael J. Ruhl Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/chip.c | 8 ++-- drivers/infiniband/hw/hfi1/chip.h | 6 ++- drivers/infiniband/hw/hfi1/driver.c | 4 +- drivers/infiniband/hw/hfi1/file_ops.c | 54 ++++++++++++----------- drivers/infiniband/hw/hfi1/hfi.h | 72 ++++++++++++++++--------------- drivers/infiniband/hw/hfi1/init.c | 2 +- drivers/infiniband/hw/hfi1/user_exp_rcv.c | 30 +++++++------ drivers/infiniband/hw/hfi1/user_exp_rcv.h | 12 +++--- drivers/infiniband/hw/hfi1/user_sdma.c | 62 +++++++++++++------------- drivers/infiniband/hw/hfi1/user_sdma.h | 13 +++--- 10 files changed, 143 insertions(+), 120 deletions(-) commit 224d71f910102c966cdcd782c97e096d5e26e4da Author: Michael J. Ruhl Date: Thu May 4 05:14:34 2017 -0700 IB/hfi1: Fix a subcontext memory leak The only context that frees user_exp_rcv data structures is the last context closed (from a sub-context set). This leaks the allocations from the other sub-contexts. Separate the common frees from the specific frees and call them at the appropriate time. Using KEDR to check for memory leaks we get: Before test: [leak_check] Possible leaks: 25 After test: [leak_check] Possible leaks: 31 (6 leaked data structures) After patch applied (before and after test have the same value) [leak_check] Possible leaks: 25 Each leak is 192 + 13440 + 6720 = 20352 bytes per sub-context. Cc: stable@vger.kernel.org Reviewed-by: Mike Marciniszyn Signed-off-by: Michael J. Ruhl Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/file_ops.c | 5 ++++- drivers/infiniband/hw/hfi1/user_exp_rcv.c | 32 +++++++++++++++++-------------- drivers/infiniband/hw/hfi1/user_exp_rcv.h | 1 + 3 files changed, 23 insertions(+), 15 deletions(-) commit 94679061dcdddbafcf24e3bfb526e54dedcc2f2f Author: Michael J. Ruhl Date: Thu May 4 05:14:28 2017 -0700 IB/hfi1: Return an error on memory allocation failure If the eager buffer allocation fails, it is necessary to return an error code. Cc: stable@vger.kernel.org Reviewed-by: Mike Marciniszyn Signed-off-by: Michael J. Ruhl Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/init.c | 1 + 1 file changed, 1 insertion(+) commit 9746fa439c63893195c7f285728617ab874b8bbd Author: Tymoteusz Kielan Date: Thu May 4 05:14:22 2017 -0700 IB/hfi1: Adjust default eager_buffer_size to 8MB Performance analysis shows benefits for PSM2 in increasing eager buffer size from 2MB to 8MB. The change has neutral impact on verbs. Make change to the module parameter's default value. Allocation ring down was verified to work with the larger buffer size. Reviewed-by: Tadeusz Struk Reviewed-by: Mike Marciniszyn Reviewed-by: Dennis Dalessandro Signed-off-by: Tymoteusz Kielan Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/init.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit ade6f8af52f5187e6af6f774cff43e0bc60902e4 Author: Sebastian Sanchez Date: Thu May 4 05:14:16 2017 -0700 IB/hfi1: Get rid of divide when setting the tx request header Div instructions show costly in profiles when the tx request header is set. Using right shift instead of a divide operation reduces the cycles spent in the function that sets the tx request header as shown in the profile. Use right shift operation instead. Profile before change: 43.24% 009 | |--23.41%-- user_sdma_send_pkts | | | |--99.90%-- hfi1_user_sdma_process_requestAfter: Profile after change: 45.75% 009 | |--14.81%-- user_sdma_send_pkts | | | |--99.95%-- hfi1_user_sdma_process_request Reviewed-by: Mike Marciniszyn Signed-off-by: Sebastian Sanchez Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/user_sdma.c | 34 +++++++++++++++++----------------- 1 file changed, 17 insertions(+), 17 deletions(-) commit dd1ed1081750a1ce4daeeb53a0ae91af599ecdad Author: Mike Marciniszyn Date: Thu May 4 05:14:10 2017 -0700 IB/hfi1: Fix yield logic in send engine When there are many RC QPs and an RDMA READ request is sent, timeouts occur on the requester side because of fairness among RC QPs on their relative SDMA engine on the responder side. This also hits write and send, but to a lesser extent. Complicating the issue is that the current code checks if workqueue is congested before scheduling other QPs, however, this check is based on the number of active entries in the workqueue, which was found to be too big to for workqueue_congested() to be effective. Fix by reducing the number of active entries as revealed by experimentation from the default of num_sdma to HFI1_MAX_ACTIVE_WORKQUEUE_ENTRIES. Retry counts were monitored to determine the correct value. Tracing to investigate any future issues is also added. Reviewed-by: Mike Marciniszyn Signed-off-by: Sebastian Sanchez Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/init.c | 3 +- drivers/infiniband/hw/hfi1/ruc.c | 80 ++++++++++++++++++++++------------- drivers/infiniband/hw/hfi1/trace_tx.h | 34 +++++++++++++++ drivers/infiniband/hw/hfi1/verbs.h | 4 ++ 4 files changed, 90 insertions(+), 31 deletions(-) commit 688f21c0be9e3ddd6c5b2241daeb9fe978c0e081 Author: Mike Marciniszyn Date: Thu May 4 05:14:04 2017 -0700 IB/hfi1, IB/rdmavt: Move r_adefered to r_lock cache line This field is causing excessive cache line bouncing. There are spare bytes in the r_lock cache line so the best approach is to make an rvt QP field and remove from the hfi1 priv field. Signed-off-by: Sebastian Sanchez Signed-off-by: Mike Marciniszyn Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/qp.c | 4 +--- drivers/infiniband/hw/hfi1/rc.c | 13 ++++--------- drivers/infiniband/hw/hfi1/verbs.h | 1 - include/rdma/rdmavt_qp.h | 1 + 4 files changed, 6 insertions(+), 13 deletions(-) commit 02d1008bcf41c7eada7882df673ae3794f7bfea8 Author: Jakub Byczkowski Date: Thu May 4 05:13:58 2017 -0700 IB/hfi1: Fix checks for Offline transient state In goto_offline() function pstate is masked by 0xff when compared to PLS_OFFLINE state. Mask should be 0xf0, since upper 4 bits specify the "major" state. Reviewed-by: Dennis Dalessandro Reviewed-by: Easwar Hariharan Signed-off-by: Jakub Byczkowski Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/chip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0d7e2d2166f6b0b7d1959ca858052a15feb574cc Author: Zhu Yanjun Date: Thu May 4 01:24:51 2017 -0400 IB/ipoib: add get_link_ksettings in ethtool In order to let the bonding driver report the correct speed of the underlaying interfaces, when they are IPoIB, the ethtool function get_link_ksettings() in the IPoIB driver is implemented. Cc: Joe Jin Cc: Junxiao Bi Suggested-by: Håkon Bugge Signed-off-by: Zhu Yanjun Signed-off-by: Doug Ledford drivers/infiniband/ulp/ipoib/ipoib_ethtool.c | 59 ++++++++++++++++++++++++++++ include/uapi/linux/ethtool.h | 1 + 2 files changed, 60 insertions(+) commit 332e0d13d3c7d1e4394a513585a3d3b15a0030b8 Author: Pan Bian Date: Sun Apr 23 20:48:07 2017 +0800 rtc: gemini: add return value validation Function devm_ioremap() will return a NULL pointer if it fails to remap IO address, and its return value should be validated before it is used. However, in function gemini_rtc_probe(), its return value is not checked. This may result in bad memory access bugs on future access, e.g. calling the function gemini_rtc_read_time(). Signed-off-by: Pan Bian Acked-by: Hans Ulli Kroll Signed-off-by: Alexandre Belloni drivers/rtc/rtc-gemini.c | 2 ++ 1 file changed, 2 insertions(+) commit 758929005f06f954b7e1c87a1c9fdb44157b228f Author: Pan Bian Date: Sun Apr 23 13:43:24 2017 +0800 rtc: snvs: fix an incorrect check of return value Function devm_regmap_init_mmio() returns an ERR_PTR on error. However, in function snvs_rtc_probe() its return value is checked against NULL. This patch fixes it by checking the return value with IS_ERR(). Signed-off-by: Pan Bian Signed-off-by: Alexandre Belloni drivers/rtc/rtc-snvs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9d62ed96511823fa9c2ac7a819d7b4be22a9a6de Author: Dan Williams Date: Thu May 4 11:47:22 2017 -0700 libnvdimm: handle locked label storage areas Per the latest version of the "NVDIMM DSM Interface Example" [1], the label data retrieval routine can report a "locked" status. In this case all regions associated with that DIMM are disabled until the label area is unlocked. Provide generic libnvdimm enabling for NVDIMMs with label data area locking capabilities. [1]: http://pmem.io/documents/ Signed-off-by: Dan Williams drivers/acpi/nfit/core.c | 21 ++++++++++++++++++--- drivers/nvdimm/dimm.c | 2 ++ drivers/nvdimm/dimm_devs.c | 8 ++++++-- drivers/nvdimm/namespace_devs.c | 17 ++++++++++++----- include/uapi/linux/ndctl.h | 1 + 5 files changed, 39 insertions(+), 10 deletions(-) commit 8f078b38dd382710884ce7abd31a1935c440e6f8 Author: Dan Williams Date: Thu May 4 14:01:24 2017 -0700 libnvdimm: convert NDD_ flags to use bitops, introduce NDD_LOCKED This is a preparation patch for handling locked nvdimm label regions, a new concept as introduced by the latest DSM document on pmem.io [1]. A future patch will leverage nvdimm_set_locked() at DIMM probe time to flag regions that can not be enabled. There should be no functional difference resulting from this change. [1]: http://pmem.io/documents/NVDIMM_DSM_Interface_Example-V1.3.pdf Signed-off-by: Dan Williams drivers/acpi/nfit/core.c | 4 ++-- drivers/nvdimm/dimm_devs.c | 11 +++++++++-- drivers/nvdimm/namespace_devs.c | 2 +- drivers/nvdimm/nd.h | 1 + drivers/nvdimm/region_devs.c | 4 ++-- include/linux/libnvdimm.h | 6 ++++-- 6 files changed, 19 insertions(+), 9 deletions(-) commit 3d05f3aed5d721c2c77d20288c29ab26c6193ed5 Author: Julia Cartwright Date: Fri Apr 28 12:41:02 2017 -0500 md/raid5: make use of spin_lock_irq over local_irq_disable + spin_lock On mainline, there is no functional difference, just less code, and symmetric lock/unlock paths. On PREEMPT_RT builds, this fixes the following warning, seen by Alexander GQ Gerasiov, due to the sleeping nature of spinlocks. BUG: sleeping function called from invalid context at kernel/locking/rtmutex.c:993 in_atomic(): 0, irqs_disabled(): 1, pid: 58, name: kworker/u12:1 CPU: 5 PID: 58 Comm: kworker/u12:1 Tainted: G W 4.9.20-rt16-stand6-686 #1 Hardware name: Supermicro SYS-5027R-WRF/X9SRW-F, BIOS 3.2a 10/28/2015 Workqueue: writeback wb_workfn (flush-253:0) Call Trace: dump_stack+0x47/0x68 ? migrate_enable+0x4a/0xf0 ___might_sleep+0x101/0x180 rt_spin_lock+0x17/0x40 add_stripe_bio+0x4e3/0x6c0 [raid456] ? preempt_count_add+0x42/0xb0 raid5_make_request+0x737/0xdd0 [raid456] Reported-by: Alexander GQ Gerasiov Tested-by: Alexander GQ Gerasiov Signed-off-by: Julia Cartwright Signed-off-by: Shaohua Li drivers/md/raid5.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) commit 693dfd5a3f19efc44acf3a57217c0480e414f8ee Author: Erez Shitrit Date: Thu Apr 27 17:01:34 2017 +0300 IB/mlx5: Enable IPoIB acceleration Enable mlx5 IPoIB acceleration by declaring mlx5_ib_{alloc,free}_rdma_netdev and assigning the mlx5 IPoIB rdma_netdev callbacks. In addition, this patch brings in sync mlx5's IPoIB parts for net and IB trees. As a precaution, we disabled IPoIB acceleration by default (in the mlx5_core Kconfig file). Signed-off-by: Saeed Mahameed Signed-off-by: Erez Shitrit Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/hw/mlx5/main.c | 22 +++++++++++++ drivers/net/ethernet/mellanox/mlx5/core/Kconfig | 2 +- drivers/net/ethernet/mellanox/mlx5/core/ipoib.c | 44 +++++++++++++++---------- drivers/net/ethernet/mellanox/mlx5/core/ipoib.h | 2 ++ include/linux/mlx5/driver.h | 19 +++++++++++ 5 files changed, 70 insertions(+), 19 deletions(-) commit 4ac4d584886a4f47f8ff3bca0f32ff9a2987d3e5 Merge: 8d5e72d 842be75 Author: Linus Torvalds Date: Thu May 4 12:26:43 2017 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Pull networking fixes from David Miller: 1) The wireless rate info fix from Johannes Berg. 2) When a RAW socket is in hdrincl mode, we need to make sure that the user provided at least a minimally sized ipv4/ipv6 header. Fix from Alexander Potapenko. 3) We must emit IFLA_PHYS_PORT_NAME netlink attributes using nla_put_string() so that it is NULL terminated. 4) Fix a bug in TCP fastopen handling, wherein child sockets erroneously inherit the fastopen_req from the parent, and later can end up derefencing freed memory or doing a double free. From Eric Dumazet. 5) Don't clear out netdev stats at close time in tg3 driver, from YueHaibing. 6) Fix refcount leak in xt_CT, from Gao Feng. 7) In nft_set_bitmap() don't leak dummy elements, from Liping Zhang. 8) Fix deadlock due to taking the expectation lock twice, also from Liping Zhang. 9) Make xt_socket work again with ipv6, from Peter Tirsek. 10) Don't allow IPV6 to be used with IPVS if ipv6.disable=1, from Paolo Abeni. 11) Make the BPF loader more flexible wrt. changes to the bpf MAP entry layout. From Jesper Dangaard Brouer. 12) Fix ethtool reported device name in aquantia driver, from Pavel Belous. 13) Fix build failures due to the compile time size test not working in netfilter conntrack. From Geert Uytterhoeven. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (52 commits) cfg80211: make RATE_INFO_BW_20 the default ipv6: initialize route null entry in addrconf_init() qede: Fix possible misconfiguration of advertised autoneg value. qed: Fix overriding of supported autoneg value. qed*: Fix possible overflow for status block id field. rtnetlink: NUL-terminate IFLA_PHYS_PORT_NAME string netvsc: make sure napi enabled before vmbus_open aquantia: Fix driver name reported by ethtool ipv4, ipv6: ensure raw socket message is big enough to hold an IP header net/sched: remove redundant null check on head tcp: do not inherit fastopen_req from parent forcedeth: remove unnecessary carrier status check ibmvnic: Move queue restarting in ibmvnic_tx_complete ibmvnic: Record SKB RX queue during poll ibmvnic: Continue skb processing after skb completion error ibmvnic: Check for driver reset first in ibmvnic_xmit ibmvnic: Wait for any pending scrqs entries at driver close ibmvnic: Clean up tx pools when closing ibmvnic: Whitespace correction in release_rx_pools ibmvnic: Delete napi's when releasing driver resources ... commit 8d5e72dfdf0fa29a21143fd72746c6f43295ce9f Merge: 2bd8040 e7731da Author: Linus Torvalds Date: Thu May 4 12:19:44 2017 -0700 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI updates from James Bottomley: "This update includes the usual round of major driver updates (hisi_sas, ufs, fnic, cxlflash, be2iscsi, ipr, stex). There's also the usual amount of cosmetic and spelling stuff" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (155 commits) scsi: qla4xxx: fix spelling mistake: "Tempalate" -> "Template" scsi: stex: make S6flag static scsi: mac_esp: fix to pass correct device identity to free_irq() scsi: aacraid: pci_alloc_consistent() failures on ARM64 scsi: ufs: make ufshcd_get_lists_status() register operation obvious scsi: ufs: use MASK_EE_STATUS scsi: mac_esp: Replace bogus memory barrier with spinlock scsi: fcoe: make fcoe_e_d_tov and fcoe_r_a_tov static scsi: sd_zbc: Do not write lock zones for reset scsi: sd_zbc: Remove superfluous assignments scsi: sd: sd_zbc: Rename sd_zbc_setup_write_cmnd scsi: Improve scsi_get_sense_info_fld scsi: sd: Cleanup sd_done sense data handling scsi: sd: Improve sd_completed_bytes scsi: sd: Fix function descriptions scsi: mpt3sas: remove redundant wmb scsi: mpt: Move scsi_remove_host() out of mptscsih_remove_host() scsi: sg: reset 'res_in_use' after unlinking reserved array scsi: mvumi: remove code handling zero scsi_sg_count(scmd) case scsi: fusion: fix spelling mistake: "Persistancy" -> "Persistency" ... commit 2bd80401743568ced7d303b008ae5298ce77e695 Merge: 99a7583 b86c86a Author: Linus Torvalds Date: Thu May 4 12:05:32 2017 -0700 Merge tag 'gpio-v4.12-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio Pull GPIO updates from Linus Walleij: "This is the bulk of GPIO changes for the v4.12 kernel cycle. Core changes: - Return NULL from gpiod_get_optional() when GPIOLIB is disabled. This was a much discussed change. It affects use cases where people write drivers that might or might not be using GPIO resources. I have decided that this is the lesser evil right now. - Make gpiod_count() behave consistently across different hardware descriptions. - Fix the syntax around open drain/open source to not infer active high/low semantics. New drivers: - A new single-register fixed-direction framework driver for hardware that have lines controlled by a single register that just work in one direction (out or in), including IRQ support. - Support the Fintek F71889A GPIO SuperIO controller. - Support the National NI 169445 MMIO GPIO. - Support for the X-Gene derivative of the DWC GPIO controller - Support for the Rohm BD9571MWV-M PMIC GPIO controller. - Refactor the Gemini GPIO driver to a generic Faraday FTGPIO driver and replace both the Gemini and the Moxa ART custom drivers with this driver. Driver improvements: - A whole slew of drivers have their spinlocks chaned to raw spinlocks as they provide irqchips, and thus we are progressing on realtime compliance. - Use devm_irq_alloc_descs() in a slew of drivers, getting managed resources. - Support for the embedded PWM controller inside the MVEBU driver. - Debounce, open source and open drain support for the Aspeed driver. - Misc smaller fixes like spelling and syntax and whatnot" * tag 'gpio-v4.12-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: (77 commits) gpio: f7188x: Add a missing break gpio: omap: return error if requested debounce time is not possible gpio: Add ROHM BD9571MWV-M PMIC GPIO driver gpio: gpio-wcove: fix GPIO IRQ status mask gpio: DT bindings, move tca9554 from pcf857x to pca953x gpio: move tca9554 from pcf857x to pca953x gpio: arizona: Correct check whether the pin is an input gpio: Add XRA1403 DTS binding documentation dt-bindings: add exar to vendor prefixes list gpio: gpio-wcove: fix irq pending status bit width gpio: dwapb: use dwapb_read instead of readl_relaxed gpio: aspeed: Add open-source and open-drain support gpio: aspeed: Add debounce support gpio: aspeed: dt: Add optional clocks property gpio: aspeed: dt: Fix description alignment in bindings document gpio: mvebu: Add limited PWM support gpio: Use unsigned int for interrupt numbers gpio: f7188x: Add F71889A GPIO support. gpio: core: Decouple open drain/source flag with active low/high gpio: arizona: Correct handling for reading input GPIOs ... commit 17a70355ea576843a7ac851f1db26872a50b2850 Author: Rob Herring Date: Thu May 4 12:56:12 2017 -0500 of: fix sparse warnings in fdt, irq, reserved mem, and resolver code sparse generates the following warnings in drivers/of/: ../drivers/of/fdt.c:63:36: warning: cast to restricted __be32 ../drivers/of/fdt.c:68:33: warning: cast to restricted __be32 ../drivers/of/irq.c:105:88: warning: incorrect type in initializer (different base types) ../drivers/of/irq.c:105:88: expected restricted __be32 ../drivers/of/irq.c:105:88: got int ../drivers/of/irq.c:526:35: warning: incorrect type in assignment (different modifiers) ../drivers/of/irq.c:526:35: expected int ( *const [usertype] irq_init_cb )( ... ) ../drivers/of/irq.c:526:35: got void const *const data ../drivers/of/of_reserved_mem.c:200:50: warning: incorrect type in initializer (different modifiers) ../drivers/of/of_reserved_mem.c:200:50: expected int ( *[usertype] initfn )( ... ) ../drivers/of/of_reserved_mem.c:200:50: got void const *const data ../drivers/of/resolver.c:95:42: warning: incorrect type in assignment (different base types) ../drivers/of/resolver.c:95:42: expected unsigned int [unsigned] [usertype] ../drivers/of/resolver.c:95:42: got restricted __be32 [usertype] All these are harmless type mismatches fixed by adjusting the types. Signed-off-by: Rob Herring drivers/of/fdt.c | 4 ++-- drivers/of/irq.c | 2 +- drivers/of/of_reserved_mem.c | 2 +- drivers/of/resolver.c | 2 +- include/linux/of_irq.h | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) commit 99a7583de5ffd5cd82c407aad32bcbdeea09155b Merge: c336bf8 6df97f8 Author: Linus Torvalds Date: Thu May 4 11:56:59 2017 -0700 Merge tag 'platform-drivers-x86-v4.12-1' of git://git.infradead.org/linux-platform-drivers-x86 Pull x86 platform-drivers update from Darren Hart: "This represents a significantly larger and more complex set of changes than those of prior merge windows. In particular, we had several changes with dependencies on other subsystems which we felt were best managed through merges of immutable branches, including one each from input, i2c, and leds. Two patches for the watchdog subsystem are included after discussion with Wim and Guenter following a collision in linux-next (this should be resolved and you should only see these two appear in this pull request). These are called out in the "External" section below. Summary of changes: - significant further cleanup of fujitsu-laptop and hp-wmi - new model support for ideapad, asus, silead, and xiaomi - new hotkeys for thinkpad and models using intel-vbtn - dell keyboard backlight improvements - build and dependency improvements - intel * ipc fixes, cleanups, and api updates - single isolated fixes noted below External: - watchdog: iTCO_wdt: Add PMC specific noreboot update api - watchdog: iTCO_wdt: cleanup set/unset no_reboot_bit functions - Merge branch 'ib/4.10-sparse-keymap-managed' - Merge branch 'i2c/for-INT33FE' - Merge branch 'linux-leds/dell-laptop-changes-for-4.12' platform/x86: - Add Intel Cherry Trail ACPI INT33FE device driver - remove sparse_keymap_free() calls - Make SILEAD_DMI depend on TOUCHSCREEN_SILEAD asus-wmi: - try to set als by default - fix cpufv sysfs file permission acer-wmi: - setup accelerometer when ACPI device was found ideapad-laptop: - Add IdeaPad V310-15ISK to no_hw_rfkill - Add IdeaPad 310-15IKB to no_hw_rfkill intel_pmc_ipc: - use gcr mem base for S0ix counter read - Fix iTCO_wdt GCS memory mapping failure - Add pmc gcr read/write/update api's - fix gcr offset dell-laptop: - Add keyboard backlight timeout AC settings - Handle return error form dell_get_intensity. - Protect kbd_state against races - Refactor kbd_led_triggers_store() hp-wireless: - reuse module_acpi_driver - add Xiaomi's hardware id to the supported list intel-vbtn: - add volume up and down INT33FE: - add i2c dependency hp-wmi: - Cleanup exit paths - Do not shadow errors in sysfs show functions - Use DEVICE_ATTR_(RO|RW) helper macros - Refactor dock and tablet state fetchers - Cleanup wireless get_(hw|sw)state functions - Refactor redundant HPWMI_READ functions - Standardize enum usage for constants - Cleanup local variable declarations - Do not shadow error values - Fix detection for dock and tablet mode - Fix error value for hp_wmi_tablet_state fujitsu-laptop: - simplify error handling in acpi_fujitsu_laptop_add() - do not log LED registration failures - switch to managed LED class devices - reorganize LED-related code - refactor LED registration - select LEDS_CLASS - remove redundant fields from struct fujitsu_bl - account for backlight power when determining brightness - do not log set_lcd_level() failures in bl_update_status() - ignore errors when setting backlight power - make disable_brightness_adjust a boolean - clean up use_alt_lcd_levels handling - sync brightness in set_lcd_level() - simplify set_lcd_level() - merge set_lcd_level_alt() into set_lcd_level() - switch to a managed backlight device - only handle backlight when appropriate - update debug message logged by call_fext_func() - rename call_fext_func() arguments - simplify call_fext_func() - clean up local variables in call_fext_func() - remove keycode fields from struct fujitsu_bl - model-dependent sparse keymap overrides - use a sparse keymap for hotkey event generation - switch to a managed hotkey input device - refactor hotkey input device setup - use a sparse keymap for brightness key events - switch to a managed backlight input device - refactor backlight input device setup - remove pf_device field from struct fujitsu_bl - only register platform device if FUJ02E3 is present - add and remove platform device in separate functions - simplify platform device attribute definitions - remove backlight-related attributes from the platform device - cleanup error labels in fujitsu_init() - only register backlight device if FUJ02B1 is present - sync backlight power status in acpi_fujitsu_laptop_add() - register backlight device in a separate function - simplify brightness key event generation logic - decrease indentation in acpi_fujitsu_bl_notify() intel-hid: - Add missing ->thaw callback - do not set parents of input devices explicitly - remove redundant set_bit() call - use devm_input_allocate_device() for HID events input device - make intel_hid_set_enable() take a boolean argument - simplify enabling/disabling HID events silead_dmi: - Add touchscreen info for Surftab Wintron 7.0 - Abort early if DMI does not match - Do not treat all devices as i2c_clients - Add entry for Insyde 7W tablets - Constify properties arrays intel_scu_ipc: - Introduce intel_scu_ipc_raw_command() - Introduce SCU_DEVICE() macro - Remove redundant subarch check - Rearrange init sequence - Platform data is mandatory asus-nb-wmi: - Add wapf4 quirk for the X302UA dell-*: - Call new led hw_changed API on kbd brightness change - Add a generic dell-laptop notifier chain eeepc-laptop: - Skip unknown key messages 0x50 0x51 thinkpad_acpi: - add mapping for new hotkeys - guard generic hotkey case" * tag 'platform-drivers-x86-v4.12-1' of git://git.infradead.org/linux-platform-drivers-x86: (108 commits) platform/x86: Make SILEAD_DMI depend on TOUCHSCREEN_SILEAD platform/x86: asus-wmi: try to set als by default platform/x86: asus-wmi: fix cpufv sysfs file permission platform/x86: acer-wmi: setup accelerometer when ACPI device was found platform/x86: ideapad-laptop: Add IdeaPad V310-15ISK to no_hw_rfkill platform/x86: intel_pmc_ipc: use gcr mem base for S0ix counter read platform/x86: intel_pmc_ipc: Fix iTCO_wdt GCS memory mapping failure watchdog: iTCO_wdt: Add PMC specific noreboot update api watchdog: iTCO_wdt: cleanup set/unset no_reboot_bit functions platform/x86: intel_pmc_ipc: Add pmc gcr read/write/update api's platform/x86: intel_pmc_ipc: fix gcr offset platform/x86: dell-laptop: Add keyboard backlight timeout AC settings platform/x86: dell-laptop: Handle return error form dell_get_intensity. platform/x86: hp-wireless: reuse module_acpi_driver platform/x86: intel-vbtn: add volume up and down platform/x86: INT33FE: add i2c dependency platform/x86: hp-wmi: Cleanup exit paths platform/x86: hp-wmi: Do not shadow errors in sysfs show functions platform/x86: hp-wmi: Use DEVICE_ATTR_(RO|RW) helper macros platform/x86: hp-wmi: Refactor dock and tablet state fetchers ... commit c336bf8e658122eeab63afe0bfcb6360a381a79c Merge: a964807 7cb671e Author: Linus Torvalds Date: Thu May 4 11:53:24 2017 -0700 Merge tag 'vfio-v4.12-rc1' of git://github.com/awilliam/linux-vfio Pull VFIO updates from Alex Williamson: - Updates for SPAPR IOMMU backend including compatibility test and memory allocation check (Alexey Kardashevskiy) - Updates for type1 IOMMU backend to remove asynchronous locked page accounting and remove redundancy (Alex Williamson) * tag 'vfio-v4.12-rc1' of git://github.com/awilliam/linux-vfio: vfio/type1: Reduce repetitive calls in vfio_pin_pages_remote() vfio/type1: Prune vfio_pin_page_external() vfio/type1: Remove locked page accounting workqueue vfio/spapr_tce: Check kzalloc() return when preregistering memory vfio/powerpc/spapr_tce: Enforce IOMMU type compatibility check commit 2f713b5c7d2a90baba6c88174c81fb9a96bfde21 Author: Martin Brandenburg Date: Thu May 4 13:16:04 2017 -0400 orangefs: count directory pieces correctly A large directory full of differently sized file names triggered this. Most directories, even very large directories with shorter names, would be lucky enough to fit in one server response. Signed-off-by: Martin Brandenburg Signed-off-by: Mike Marshall fs/orangefs/dir.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 942835d68f6e16f2673c70791dc963c548681cb4 Author: Martin Brandenburg Date: Tue May 2 12:15:11 2017 -0400 orangefs: invalidate stored directory on seek If an application seeks to a position before the point which has been read, it must want updates which have been made to the directory. So delete the copy stored in the kernel so it will be fetched again. Signed-off-by: Martin Brandenburg Signed-off-by: Mike Marshall fs/orangefs/dir.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) commit bf15ba7c1f9ad000d062968f931e80234db84a24 Author: Martin Brandenburg Date: Tue May 2 12:15:10 2017 -0400 orangefs: skip forward to the next directory entry if seek is short If userspace seeks to a position in the stream which is not correct, it would have returned EIO because the data in the buffer at that offset would be incorrect. This and the userspace daemon returning a corrupt directory are indistinguishable. Now if the data does not look right, skip forward to the next chunk and try again. The motivation is that if the directory changes, an application may seek to a position that was valid and no longer is valid. It is not yet possible for a directory to change. Signed-off-by: Martin Brandenburg Signed-off-by: Mike Marshall fs/orangefs/dir.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) commit a96480723c287c502b02659f4b347aecaa651ea1 Merge: a1be8ed 3dbd820 Author: Linus Torvalds Date: Thu May 4 11:37:09 2017 -0700 Merge tag 'for-linus-4.12b-rc0b-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen updates from Juergen Gross: "Xen fixes and featrues for 4.12. The main changes are: - enable building the kernel with Xen support but without enabling paravirtualized mode (Vitaly Kuznetsov) - add a new 9pfs xen frontend driver (Stefano Stabellini) - simplify Xen's cpuid handling by making use of cpu capabilities (Juergen Gross) - add/modify some headers for new Xen paravirtualized devices (Oleksandr Andrushchenko) - EFI reset_system support under Xen (Julien Grall) - and the usual cleanups and corrections" * tag 'for-linus-4.12b-rc0b-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: (57 commits) xen: Move xen_have_vector_callback definition to enlighten.c xen: Implement EFI reset_system callback arm/xen: Consolidate calls to shutdown hypercall in a single helper xen: Export xen_reboot xen/x86: Call xen_smp_intr_init_pv() on BSP xen: Revert commits da72ff5bfcb0 and 72a9b186292d xen/pvh: Do not fill kernel's e820 map in init_pvh_bootparams() xen/scsifront: use offset_in_page() macro xen/arm,arm64: rename __generic_dma_ops to xen_get_dma_ops xen/arm,arm64: fix xen_dma_ops after 815dd18 "Consolidate get_dma_ops..." xen/9pfs: select CONFIG_XEN_XENBUS_FRONTEND x86/cpu: remove hypervisor specific set_cpu_features vmware: set cpu capabilities during platform initialization x86/xen: use capabilities instead of fake cpuid values for xsave x86/xen: use capabilities instead of fake cpuid values for x2apic x86/xen: use capabilities instead of fake cpuid values for mwait x86/xen: use capabilities instead of fake cpuid values for acpi x86/xen: use capabilities instead of fake cpuid values for acc x86/xen: use capabilities instead of fake cpuid values for mtrr x86/xen: use capabilities instead of fake cpuid values for aperf ... commit eb3100365791b06242b8bb5c3c2854ba41dabfbc Author: Rob Herring Date: Thu May 4 12:34:30 2017 -0500 of: fix sparse warning in of_pci_range_parser_one sparse gives the following warning for 'pci_space': ../drivers/of/address.c:266:26: warning: incorrect type in assignment (different base types) ../drivers/of/address.c:266:26: expected unsigned int [unsigned] [usertype] pci_space ../drivers/of/address.c:266:26: got restricted __be32 const [usertype] It appears that pci_space is only ever accessed on powerpc, so the endian swap is often not needed. Cc: stable@vger.kernel.org Signed-off-by: Rob Herring drivers/of/address.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 91d967497f11dbb5038c7b84bc30dae684ae5ffb Author: Rob Herring Date: Thu May 4 12:30:07 2017 -0500 of: fix sparse warnings in of_find_next_cache_node sparse gives a warning that 'handle' is not a __be32: ../drivers/of/base.c:2261:61: warning: incorrect type in argument 1 (different base types) ../drivers/of/base.c:2261:61: expected restricted __be32 const [usertype] *p ../drivers/of/base.c:2261:61: got unsigned int const [usertype] *[assigned] handle We could just change the type, but the code can be improved by using of_parse_phandle instead of open coding it with of_get_property and of_find_node_by_phandle. Signed-off-by: Rob Herring drivers/of/base.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) commit cefec668868be847ac3733c927ccd527c305b529 Merge: 12c1c2fd 1e6e7ea Author: Ingo Molnar Date: Thu May 4 19:43:39 2017 +0200 Merge tag 'perf-urgent-for-mingo-4.12-20170504' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/urgent fixes from Arnaldo Carvalho de Melo: User visible changes: - Fix AArch64 objdump disasm comment char in 'perf annotate' (Kim Phillips) - Fix documentation spelling mistakes (Kim Phillips) - Don't fail 'perf test kmod-path' if compressed modules aren't supported (Kim Phillips) Infrastructure changes: - Fix sched_getcpu() feature test when included in test-all.c redefining _GNU_SOURCE (Arnaldo Carvalho de Melo) Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit 842be75c77cb72ee546a2b19da9c285fb3ded660 Author: Johannes Berg Date: Thu May 4 08:42:30 2017 +0200 cfg80211: make RATE_INFO_BW_20 the default Due to the way I did the RX bitrate conversions in mac80211 with spatch, going setting flags to setting the value, many drivers now don't set the bandwidth value for 20 MHz, since with the flags it wasn't necessary to (there was no 20 MHz flag, only the others.) Rather than go through and try to fix up all the drivers, instead renumber the enum so that 20 MHz, which is the typical bandwidth, actually has the value 0, making those drivers all work again. If VHT was hit used with a driver not reporting it, e.g. iwlmvm, this manifested in hitting the bandwidth warning in cfg80211_calculate_bitrate_vht(). Reported-by: Linus Torvalds Tested-by: Jens Axboe Signed-off-by: Johannes Berg Signed-off-by: David S. Miller include/net/cfg80211.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2f460933f58eee3393aba64f0f6d14acb08d1724 Author: WANG Cong Date: Wed May 3 22:07:31 2017 -0700 ipv6: initialize route null entry in addrconf_init() Andrey reported a crash on init_net.ipv6.ip6_null_entry->rt6i_idev since it is always NULL. This is clearly wrong, we have code to initialize it to loopback_dev, unfortunately the order is still not correct. loopback_dev is registered very early during boot, we lose a chance to re-initialize it in notifier. addrconf_init() is called after ip6_route_init(), which means we have no chance to correct it. Fix it by moving this initialization explicitly after ipv6_add_dev(init_net.loopback_dev) in addrconf_init(). Reported-by: Andrey Konovalov Signed-off-by: Cong Wang Tested-by: Andrey Konovalov Signed-off-by: David S. Miller include/net/ip6_route.h | 1 + net/ipv6/addrconf.c | 2 ++ net/ipv6/route.c | 26 +++++++++++++++----------- 3 files changed, 18 insertions(+), 11 deletions(-) commit 15981952e8d04fa3349cd8db10f46ab3273ff398 Merge: 77ef033 161adb0 Author: David S. Miller Date: Thu May 4 12:31:03 2017 -0400 Merge branch 'qed-fixes' Sudarsana Reddy Kalluru says: ==================== qed*: Bug fix series. The series contains minor bug fixes for qed/qede drivers. Please consider applying it to 'net' branch. ==================== Signed-off-by: David S. Miller commit 161adb046b9119d480f2547db20fc3e9ce7cbf59 Author: sudarsana.kalluru@cavium.com Date: Thu May 4 08:15:05 2017 -0700 qede: Fix possible misconfiguration of advertised autoneg value. Fail the configuration of advertised speed-autoneg value if the config update is not supported. Signed-off-by: Sudarsana Reddy Kalluru Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qede/qede_ethtool.c | 5 +++++ 1 file changed, 5 insertions(+) commit 34f9199ce7b7e5c641b96e928bd60e086bf7f278 Author: sudarsana.kalluru@cavium.com Date: Thu May 4 08:15:04 2017 -0700 qed: Fix overriding of supported autoneg value. Driver currently uses advertised-autoneg value to populate the supported-autoneg field. When advertised field is updated, user gets the same value for supported field. Supported-autoneg value need to be populated from the link capabilities value returned by the MFW. Signed-off-by: Sudarsana Reddy Kalluru Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_dev.c | 3 +++ drivers/net/ethernet/qlogic/qed/qed_main.c | 6 +++++- drivers/net/ethernet/qlogic/qed/qed_mcp.h | 1 + 3 files changed, 9 insertions(+), 1 deletion(-) commit f870a3c6727db5fcfeaa42d099f75872e4b17553 Author: sudarsana.kalluru@cavium.com Date: Thu May 4 08:15:03 2017 -0700 qed*: Fix possible overflow for status block id field. Value for status block id could be more than 256 in 100G mode, need to update its data type from u8 to u16. Signed-off-by: Sudarsana Reddy Kalluru Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_dev.c | 8 ++++---- drivers/net/ethernet/qlogic/qed/qed_dev_api.h | 4 ++-- drivers/net/ethernet/qlogic/qed/qed_main.c | 2 +- drivers/net/ethernet/qlogic/qede/qede_ethtool.c | 5 ++--- include/linux/qed/qed_if.h | 2 +- 5 files changed, 10 insertions(+), 11 deletions(-) commit 8756cd1ded1af222fda4470b08ba547f5625e656 Author: Dan Carpenter Date: Wed May 3 22:49:50 2017 +0300 of/unittest: Missing unlocks on error Static checkers complain that we should unlock before returning. Which is true. Signed-off-by: Dan Carpenter Reviewed-by: Frank Rowand Signed-off-by: Rob Herring drivers/of/unittest.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 2c0248d68880fc0e783af1048b3367ee5d4412f0 Merge: d5bf739 fd8e2d4 c9d9f23 6f66ea0 bdf9592 26b37b9 8e12188 73dbd4a 290d638 Author: Joerg Roedel Date: Thu May 4 18:06:17 2017 +0200 Merge branches 'arm/exynos', 'arm/omap', 'arm/rockchip', 'arm/mediatek', 'arm/smmu', 'arm/core', 'x86/vt-d', 'x86/amd' and 'core' into next commit 290d638e04e7b94ff34d2f5e9426e7ce617e9a59 Author: Paul Gortmaker Date: Tue May 2 18:21:12 2017 -0400 soc/qbman: Move dma-mapping.h include to qman_priv.h With the include there it fixes all build failures in this directory caused by commit 461a6946b1f9. Fixes: 461a6946b1f9 ("iommu: Remove pci.h include from trace/events/iommu.h") Signed-off-by: Joerg Roedel drivers/soc/fsl/qbman/qman_portal.c | 2 -- drivers/soc/fsl/qbman/qman_priv.h | 1 + 2 files changed, 1 insertion(+), 2 deletions(-) commit 35f4f99ccbc1ccf3a1f1157a5f2f14d6a7d1848f Author: Tony Lindgren Date: Wed May 3 17:15:32 2017 -0700 power: supply: cpcap-charger: Keep trickle charger bits disabled Android does not seem to set the trickle charger bits, and these seem to be only used by the bootloader when bringing up a completely discharged battery. So let's keep the trickle charging bits disabled and avoid misconfiguring the hardware. Fixes: 0c9888e3c192 ("power: supply: cpcap-charger: Add minimal CPCAP PMIC battery charger") Cc: Marcel Partap Cc: Michael Scott Signed-off-by: Tony Lindgren Signed-off-by: Sebastian Reichel drivers/power/supply/cpcap-charger.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 6ffa8ace7092a5414d5d387c54a66118eb90482b Author: Tony Lindgren Date: Wed May 3 17:15:31 2017 -0700 power: supply: cpcap-charger: Fix enable for 3.8V charge setting Zero is a valid register value for for 3.8V charging. Fixes: 0c9888e3c192 ("power: supply: cpcap-charger: Add minimal CPCAP PMIC battery charger") Cc: Marcel Partap Cc: Michael Scott Signed-off-by: Tony Lindgren Signed-off-by: Sebastian Reichel drivers/power/supply/cpcap-charger.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3ae5f06681fc0e9ce6a0ac4f909aa7695e1f3228 Author: Tony Lindgren Date: Wed May 3 17:15:30 2017 -0700 power: supply: cpcap-charger: Fix charge voltage configuration We have the charge voltage wrong, it should be 4.35V instead of 4.2V. This will cause the battery to never get fully charged. I noticed this when looking at the Andoid kernel battery and charger status for a fully charged battery: POWER_SUPPLY_VOLTAGE_NOW=4351000 Also the battery on droid 4 says "4.35, 1735/1785mAh (min/typ), 6.6/6.8 Wh (min/typ)". Presumably the 4.35 on the battery is the charge voltage. And finally, on Android the CPCAP CRM register is set to 0x03b5 where the b is the charge voltage. Let's fix the charge voltage define and update the charge configuration to use the 4.35V setting. Fixes: 0c9888e3c192 ("power: supply: cpcap-charger: Add minimal CPCAP PMIC battery charger") Cc: Marcel Partap Cc: Michael Scott Signed-off-by: Tony Lindgren Signed-off-by: Sebastian Reichel drivers/power/supply/cpcap-charger.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 4f700a5285dc8f9dde4ad02542bc42fe9f97cfcf Author: Tony Lindgren Date: Wed May 3 17:15:29 2017 -0700 power: supply: cpcap-charger: Fix charger name I noticed we have a different name from what Android is using. Let's not break the /sys/class/power user space interface here and use the same naming as Android has. On Android we have the following for droid 4: $ ls /sys/class/power_supply/ ac battery usb So let's use the usb naming here for charger too. Fixes: 0c9888e3c192 ("power: supply: cpcap-charger: Add minimal CPCAP PMIC battery charger") Cc: Marcel Partap Cc: Michael Scott Signed-off-by: Tony Lindgren Signed-off-by: Sebastian Reichel drivers/power/supply/cpcap-charger.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6f9d696f016f5b42f6c6e8c9f723f8d3380e5903 Author: Eric Biggers Date: Mon May 1 11:43:32 2017 -0700 fscrypt: correct collision claim for digested names As I noted on the mailing list, it's easier than I originally thought to create intentional collisions in the digested names. Unfortunately it's not too easy to solve this, so for now just fix the comment to not lie. Signed-off-by: Eric Biggers Signed-off-by: Theodore Ts'o include/linux/fscrypt_supp.h | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-) commit 90fce086ed59caefa457dffd587b00caeab9116d Author: Eric Biggers Date: Wed Apr 26 16:43:00 2017 -0700 MAINTAINERS: fscrypt: update mailing list, patchwork, and git Now that there has been a dedicated mailing list, patchwork project, and git repository set up for filesystem encryption, update the MAINTAINERS file accordingly. Signed-off-by: Eric Biggers Signed-off-by: Theodore Ts'o MAINTAINERS | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit d9b9f8d5a88cb7881d9f1c2b7e9de9a3fe1dc9e2 Author: Eric Biggers Date: Mon Apr 24 10:00:13 2017 -0700 ext4: clean up ext4_match() and callers When ext4 encryption was originally merged, we were encrypting the user-specified filename in ext4_match(), introducing a lot of additional complexity into ext4_match() and its callers. This has since been changed to encrypt the filename earlier, so we can remove the gunk that's no longer needed. This more or less reverts ext4_search_dir() and ext4_find_dest_de() to the way they were in the v4.0 kernel. Signed-off-by: Eric Biggers Signed-off-by: Theodore Ts'o fs/ext4/namei.c | 81 ++++++++++++++++++--------------------------------------- 1 file changed, 25 insertions(+), 56 deletions(-) commit 1f73d491779047e81fff047c4613e84d5d76ddae Author: Eric Biggers Date: Mon Apr 24 10:00:12 2017 -0700 f2fs: switch to using fscrypt_match_name() Switch f2fs directory searches to use the fscrypt_match_name() helper function. There should be no functional change. Signed-off-by: Eric Biggers Acked-by: Jaegeuk Kim Signed-off-by: Theodore Ts'o fs/f2fs/dir.c | 28 ++++------------------------ 1 file changed, 4 insertions(+), 24 deletions(-) commit 067d1023b6beeded688500d417e40e16981437e0 Author: Eric Biggers Date: Mon Apr 24 10:00:11 2017 -0700 ext4: switch to using fscrypt_match_name() Switch ext4 directory searches to use the fscrypt_match_name() helper function. There should be no functional change. Signed-off-by: Eric Biggers Signed-off-by: Theodore Ts'o fs/ext4/namei.c | 22 +++++----------------- 1 file changed, 5 insertions(+), 17 deletions(-) commit 17159420a6c18bb3515ff85598b5ccf1a572763d Author: Eric Biggers Date: Mon Apr 24 10:00:10 2017 -0700 fscrypt: introduce helper function for filename matching Introduce a helper function fscrypt_match_name() which tests whether a fscrypt_name matches a directory entry. Also clean up the magic numbers and document things properly. Signed-off-by: Eric Biggers Signed-off-by: Theodore Ts'o fs/crypto/fname.c | 90 ++++++++++++++++++++++++++++++++--------- fs/crypto/fscrypt_private.h | 2 - include/linux/fscrypt_notsupp.h | 9 +++++ include/linux/fscrypt_supp.h | 78 +++++++++++++++++++++++++++++++++++ 4 files changed, 157 insertions(+), 22 deletions(-) commit 6b06cdee81d68a8a829ad8e8d0f31d6836744af9 Author: Eric Biggers Date: Mon Apr 24 10:00:09 2017 -0700 fscrypt: avoid collisions when presenting long encrypted filenames When accessing an encrypted directory without the key, userspace must operate on filenames derived from the ciphertext names, which contain arbitrary bytes. Since we must support filenames as long as NAME_MAX, we can't always just base64-encode the ciphertext, since that may make it too long. Currently, this is solved by presenting long names in an abbreviated form containing any needed filesystem-specific hashes (e.g. to identify a directory block), then the last 16 bytes of ciphertext. This needs to be sufficient to identify the actual name on lookup. However, there is a bug. It seems to have been assumed that due to the use of a CBC (ciphertext block chaining)-based encryption mode, the last 16 bytes (i.e. the AES block size) of ciphertext would depend on the full plaintext, preventing collisions. However, we actually use CBC with ciphertext stealing (CTS), which handles the last two blocks specially, causing them to appear "flipped". Thus, it's actually the second-to-last block which depends on the full plaintext. This caused long filenames that differ only near the end of their plaintexts to, when observed without the key, point to the wrong inode and be undeletable. For example, with ext4: # echo pass | e4crypt add_key -p 16 edir/ # seq -f "edir/abcdefghijklmnopqrstuvwxyz012345%.0f" 100000 | xargs touch # find edir/ -type f | xargs stat -c %i | sort | uniq | wc -l 100000 # sync # echo 3 > /proc/sys/vm/drop_caches # keyctl new_session # find edir/ -type f | xargs stat -c %i | sort | uniq | wc -l 2004 # rm -rf edir/ rm: cannot remove 'edir/_A7nNFi3rhkEQlJ6P,hdzluhODKOeWx5V': Structure needs cleaning ... To fix this, when presenting long encrypted filenames, encode the second-to-last block of ciphertext rather than the last 16 bytes. Although it would be nice to solve this without depending on a specific encryption mode, that would mean doing a cryptographic hash like SHA-256 which would be much less efficient. This way is sufficient for now, and it's still compatible with encryption modes like HEH which are strong pseudorandom permutations. Also, changing the presented names is still allowed at any time because they are only provided to allow applications to do things like delete encrypted directories. They're not designed to be used to persistently identify files --- which would be hard to do anyway, given that they're encrypted after all. For ease of backports, this patch only makes the minimal fix to both ext4 and f2fs. It leaves ubifs as-is, since ubifs doesn't compare the ciphertext block yet. Follow-on patches will clean things up properly and make the filesystems use a shared helper function. Fixes: 5de0b4d0cd15 ("ext4 crypto: simplify and speed up filename encryption") Reported-by: Gwendal Grignou Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Signed-off-by: Theodore Ts'o fs/crypto/fname.c | 2 +- fs/ext4/namei.c | 4 ++-- fs/f2fs/dir.c | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) commit 6332cd32c8290a80e929fc044dc5bdba77396e33 Author: Jaegeuk Kim Date: Mon Apr 24 10:00:08 2017 -0700 f2fs: check entire encrypted bigname when finding a dentry If user has no key under an encrypted dir, fscrypt gives digested dentries. Previously, when looking up a dentry, f2fs only checks its hash value with first 4 bytes of the digested dentry, which didn't handle hash collisions fully. This patch enhances to check entire dentry bytes likewise ext4. Eric reported how to reproduce this issue by: # seq -f "edir/abcdefghijklmnopqrstuvwxyz012345%.0f" 100000 | xargs touch # find edir -type f | xargs stat -c %i | sort | uniq | wc -l 100000 # sync # echo 3 > /proc/sys/vm/drop_caches # keyctl new_session # find edir -type f | xargs stat -c %i | sort | uniq | wc -l 99999 Cc: Reported-by: Eric Biggers Signed-off-by: Jaegeuk Kim (fixed f2fs_dentry_hash() to work even when the hash is 0) Signed-off-by: Eric Biggers Signed-off-by: Theodore Ts'o fs/f2fs/dir.c | 37 +++++++++++++++++++++---------------- fs/f2fs/f2fs.h | 3 ++- fs/f2fs/hash.c | 7 ++++++- fs/f2fs/inline.c | 4 ++-- 4 files changed, 31 insertions(+), 20 deletions(-) commit 413d5a9edbb45eec4dbb1904fe689b561ea5d143 Author: Eric Biggers Date: Fri Apr 7 10:58:40 2017 -0700 ubifs: check for consistent encryption contexts in ubifs_lookup() As ext4 and f2fs do, ubifs should check for consistent encryption contexts during ->lookup() in an encrypted directory. This protects certain users of filesystem encryption against certain types of offline attacks. Signed-off-by: Eric Biggers Signed-off-by: Theodore Ts'o fs/ubifs/dir.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit faac7fd97e0827f959c9d376399b91b37364a567 Author: Eric Biggers Date: Fri Apr 7 10:58:39 2017 -0700 f2fs: sync f2fs_lookup() with ext4_lookup() As for ext4, now that fscrypt_has_permitted_context() correctly handles the case where we have the key for the parent directory but not the child, f2fs_lookup() no longer has to work around it. Also add the same warning message that ext4 uses. Signed-off-by: Eric Biggers Signed-off-by: Theodore Ts'o fs/f2fs/namei.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 8c68084bff7a852252cf91985fa8111ae4673f91 Author: Eric Biggers Date: Fri Apr 7 10:58:38 2017 -0700 ext4: remove "nokey" check from ext4_lookup() Now that fscrypt_has_permitted_context() correctly handles the case where we have the key for the parent directory but not the child, we don't need to try to work around this in ext4_lookup(). Signed-off-by: Eric Biggers Signed-off-by: Theodore Ts'o fs/ext4/namei.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) commit 272f98f6846277378e1758a49a49d7bf39343c02 Author: Eric Biggers Date: Fri Apr 7 10:58:37 2017 -0700 fscrypt: fix context consistency check when key(s) unavailable To mitigate some types of offline attacks, filesystem encryption is designed to enforce that all files in an encrypted directory tree use the same encryption policy (i.e. the same encryption context excluding the nonce). However, the fscrypt_has_permitted_context() function which enforces this relies on comparing struct fscrypt_info's, which are only available when we have the encryption keys. This can cause two incorrect behaviors: 1. If we have the parent directory's key but not the child's key, or vice versa, then fscrypt_has_permitted_context() returned false, causing applications to see EPERM or ENOKEY. This is incorrect if the encryption contexts are in fact consistent. Although we'd normally have either both keys or neither key in that case since the master_key_descriptors would be the same, this is not guaranteed because keys can be added or removed from keyrings at any time. 2. If we have neither the parent's key nor the child's key, then fscrypt_has_permitted_context() returned true, causing applications to see no error (or else an error for some other reason). This is incorrect if the encryption contexts are in fact inconsistent, since in that case we should deny access. To fix this, retrieve and compare the fscrypt_contexts if we are unable to set up both fscrypt_infos. While this slightly hurts performance when accessing an encrypted directory tree without the key, this isn't a case we really need to be optimizing for; access *with* the key is much more important. Furthermore, the performance hit is barely noticeable given that we are already retrieving the fscrypt_context and doing two keyring searches in fscrypt_get_encryption_info(). If we ever actually wanted to optimize this case we might start by caching the fscrypt_contexts. Cc: stable@vger.kernel.org # 4.0+ Signed-off-by: Eric Biggers Signed-off-by: Theodore Ts'o fs/crypto/policy.c | 87 ++++++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 68 insertions(+), 19 deletions(-) commit 77ef033b687c3e030017c94a29bf6ea3aaaef678 Author: Michal Schmidt Date: Thu May 4 16:48:58 2017 +0200 rtnetlink: NUL-terminate IFLA_PHYS_PORT_NAME string IFLA_PHYS_PORT_NAME is a string attribute, so terminate it with \0. Otherwise libnl3 fails to validate netlink messages with this attribute. "ip -detail a" assumes too that the attribute is NUL-terminated when printing it. It often was, due to padding. I noticed this as libvirtd failing to start on a system with sfc driver after upgrading it to Linux 4.11, i.e. when sfc added support for phys_port_name. Signed-off-by: Michal Schmidt Signed-off-by: David S. Miller net/core/rtnetlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2be0f2644598ee4b8ea0ed6a32913e1ce0212c9c Author: stephen hemminger Date: Wed May 3 16:59:21 2017 -0700 netvsc: make sure napi enabled before vmbus_open This fixes a race where vmbus callback for new packet arriving could occur before NAPI is initialized. Signed-off-by: Stephen Hemminger Signed-off-by: David S. Miller drivers/net/hyperv/netvsc.c | 8 +++++--- drivers/net/hyperv/rndis_filter.c | 2 +- 2 files changed, 6 insertions(+), 4 deletions(-) commit 5900eca1ac3bcb03cd0da1c9a5504f1fbfe9b5bc Author: Pavel Belous Date: Wed May 3 21:17:44 2017 +0300 aquantia: Fix driver name reported by ethtool V2: using "aquantia" subsystem tag. The command "ethtool -i ethX" should display driver name (driver: atlantic) instead vendor name (driver: aquantia). Signed-off-by: Pavel Belous Signed-off-by: David S. Miller drivers/net/ethernet/aquantia/atlantic/aq_cfg.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 86f4c90a1c5c1493f07f2d12c1079f5bf01936f2 Author: Alexander Potapenko Date: Wed May 3 17:06:58 2017 +0200 ipv4, ipv6: ensure raw socket message is big enough to hold an IP header raw_send_hdrinc() and rawv6_send_hdrinc() expect that the buffer copied from the userspace contains the IPv4/IPv6 header, so if too few bytes are copied, parts of the header may remain uninitialized. This bug has been detected with KMSAN. For the record, the KMSAN report: ================================================================== BUG: KMSAN: use of unitialized memory in nf_ct_frag6_gather+0xf5a/0x44a0 inter: 0 CPU: 0 PID: 1036 Comm: probe Not tainted 4.11.0-rc5+ #2455 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:16 dump_stack+0x143/0x1b0 lib/dump_stack.c:52 kmsan_report+0x16b/0x1e0 mm/kmsan/kmsan.c:1078 __kmsan_warning_32+0x5c/0xa0 mm/kmsan/kmsan_instr.c:510 nf_ct_frag6_gather+0xf5a/0x44a0 net/ipv6/netfilter/nf_conntrack_reasm.c:577 ipv6_defrag+0x1d9/0x280 net/ipv6/netfilter/nf_defrag_ipv6_hooks.c:68 nf_hook_entry_hookfn ./include/linux/netfilter.h:102 nf_hook_slow+0x13f/0x3c0 net/netfilter/core.c:310 nf_hook ./include/linux/netfilter.h:212 NF_HOOK ./include/linux/netfilter.h:255 rawv6_send_hdrinc net/ipv6/raw.c:673 rawv6_sendmsg+0x2fcb/0x41a0 net/ipv6/raw.c:919 inet_sendmsg+0x3f8/0x6d0 net/ipv4/af_inet.c:762 sock_sendmsg_nosec net/socket.c:633 sock_sendmsg net/socket.c:643 SYSC_sendto+0x6a5/0x7c0 net/socket.c:1696 SyS_sendto+0xbc/0xe0 net/socket.c:1664 do_syscall_64+0x72/0xa0 arch/x86/entry/common.c:285 entry_SYSCALL64_slow_path+0x25/0x25 arch/x86/entry/entry_64.S:246 RIP: 0033:0x436e03 RSP: 002b:00007ffce48baf38 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00000000004002b0 RCX: 0000000000436e03 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007ffce48baf90 R08: 00007ffce48baf50 R09: 000000000000001c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000401790 R14: 0000000000401820 R15: 0000000000000000 origin: 00000000d9400053 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:362 kmsan_internal_poison_shadow+0xb1/0x1a0 mm/kmsan/kmsan.c:257 kmsan_poison_shadow+0x6d/0xc0 mm/kmsan/kmsan.c:270 slab_alloc_node mm/slub.c:2735 __kmalloc_node_track_caller+0x1f4/0x390 mm/slub.c:4341 __kmalloc_reserve net/core/skbuff.c:138 __alloc_skb+0x2cd/0x740 net/core/skbuff.c:231 alloc_skb ./include/linux/skbuff.h:933 alloc_skb_with_frags+0x209/0xbc0 net/core/skbuff.c:4678 sock_alloc_send_pskb+0x9ff/0xe00 net/core/sock.c:1903 sock_alloc_send_skb+0xe4/0x100 net/core/sock.c:1920 rawv6_send_hdrinc net/ipv6/raw.c:638 rawv6_sendmsg+0x2918/0x41a0 net/ipv6/raw.c:919 inet_sendmsg+0x3f8/0x6d0 net/ipv4/af_inet.c:762 sock_sendmsg_nosec net/socket.c:633 sock_sendmsg net/socket.c:643 SYSC_sendto+0x6a5/0x7c0 net/socket.c:1696 SyS_sendto+0xbc/0xe0 net/socket.c:1664 do_syscall_64+0x72/0xa0 arch/x86/entry/common.c:285 return_from_SYSCALL_64+0x0/0x6a arch/x86/entry/entry_64.S:246 ================================================================== , triggered by the following syscalls: socket(PF_INET6, SOCK_RAW, IPPROTO_RAW) = 3 sendto(3, NULL, 0, 0, {sa_family=AF_INET6, sin6_port=htons(0), inet_pton(AF_INET6, "ff00::", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, 28) = -1 EPERM A similar report is triggered in net/ipv4/raw.c if we use a PF_INET socket instead of a PF_INET6 one. Signed-off-by: Alexander Potapenko Signed-off-by: David S. Miller net/ipv4/raw.c | 3 +++ net/ipv6/raw.c | 2 ++ 2 files changed, 5 insertions(+) commit 17f423b5160767a8ec43b0602767e5f4d3ecd083 Author: Jan Kara Date: Thu May 4 11:01:31 2017 -0400 jbd2: cleanup write flags handling from jbd2_write_superblock() Currently jbd2_write_superblock() silently adds REQ_SYNC to flags with which journal superblock is written. Make this explicit by making flags passed down to jbd2_write_superblock() contain REQ_SYNC. CC: linux-ext4@vger.kernel.org Signed-off-by: Jan Kara Signed-off-by: Theodore Ts'o fs/jbd2/journal.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) commit 985538eee06f169bb13c7ecb1a7fcdeb700b05c7 Author: Colin Ian King Date: Wed May 3 14:50:40 2017 +0100 net/sched: remove redundant null check on head head is previously null checked and so the 2nd null check on head is redundant and therefore can be removed. Detected by CoverityScan, CID#1399505 ("Logically dead code") Signed-off-by: Colin Ian King Acked-by: Jiri Pirko Signed-off-by: David S. Miller net/sched/cls_matchall.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 8b485ce69876c65db12ed390e7f9c0d2a64eff2c Author: Eric Dumazet Date: Wed May 3 06:39:31 2017 -0700 tcp: do not inherit fastopen_req from parent Under fuzzer stress, it is possible that a child gets a non NULL fastopen_req pointer from its parent at accept() time, when/if parent morphs from listener to active session. We need to make sure this can not happen, by clearing the field after socket cloning. BUG: Double free or freeing an invalid pointer Unexpected shadow byte: 0xFB CPU: 3 PID: 20933 Comm: syz-executor3 Not tainted 4.11.0+ #306 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:16 [inline] dump_stack+0x292/0x395 lib/dump_stack.c:52 kasan_object_err+0x1c/0x70 mm/kasan/report.c:164 kasan_report_double_free+0x5c/0x70 mm/kasan/report.c:185 kasan_slab_free+0x9d/0xc0 mm/kasan/kasan.c:580 slab_free_hook mm/slub.c:1357 [inline] slab_free_freelist_hook mm/slub.c:1379 [inline] slab_free mm/slub.c:2961 [inline] kfree+0xe8/0x2b0 mm/slub.c:3882 tcp_free_fastopen_req net/ipv4/tcp.c:1077 [inline] tcp_disconnect+0xc15/0x13e0 net/ipv4/tcp.c:2328 inet_child_forget+0xb8/0x600 net/ipv4/inet_connection_sock.c:898 inet_csk_reqsk_queue_add+0x1e7/0x250 net/ipv4/inet_connection_sock.c:928 tcp_get_cookie_sock+0x21a/0x510 net/ipv4/syncookies.c:217 cookie_v4_check+0x1a19/0x28b0 net/ipv4/syncookies.c:384 tcp_v4_cookie_check net/ipv4/tcp_ipv4.c:1384 [inline] tcp_v4_do_rcv+0x731/0x940 net/ipv4/tcp_ipv4.c:1421 tcp_v4_rcv+0x2dc0/0x31c0 net/ipv4/tcp_ipv4.c:1715 ip_local_deliver_finish+0x4cc/0xc20 net/ipv4/ip_input.c:216 NF_HOOK include/linux/netfilter.h:257 [inline] ip_local_deliver+0x1ce/0x700 net/ipv4/ip_input.c:257 dst_input include/net/dst.h:492 [inline] ip_rcv_finish+0xb1d/0x20b0 net/ipv4/ip_input.c:396 NF_HOOK include/linux/netfilter.h:257 [inline] ip_rcv+0xd8c/0x19c0 net/ipv4/ip_input.c:487 __netif_receive_skb_core+0x1ad1/0x3400 net/core/dev.c:4210 __netif_receive_skb+0x2a/0x1a0 net/core/dev.c:4248 process_backlog+0xe5/0x6c0 net/core/dev.c:4868 napi_poll net/core/dev.c:5270 [inline] net_rx_action+0xe70/0x18e0 net/core/dev.c:5335 __do_softirq+0x2fb/0xb99 kernel/softirq.c:284 do_softirq_own_stack+0x1c/0x30 arch/x86/entry/entry_64.S:899 do_softirq.part.17+0x1e8/0x230 kernel/softirq.c:328 do_softirq kernel/softirq.c:176 [inline] __local_bh_enable_ip+0x1cf/0x1e0 kernel/softirq.c:181 local_bh_enable include/linux/bottom_half.h:31 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:931 [inline] ip_finish_output2+0x9ab/0x15e0 net/ipv4/ip_output.c:230 ip_finish_output+0xa35/0xdf0 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:246 [inline] ip_output+0x1f6/0x7b0 net/ipv4/ip_output.c:404 dst_output include/net/dst.h:486 [inline] ip_local_out+0x95/0x160 net/ipv4/ip_output.c:124 ip_queue_xmit+0x9a8/0x1a10 net/ipv4/ip_output.c:503 tcp_transmit_skb+0x1ade/0x3470 net/ipv4/tcp_output.c:1057 tcp_write_xmit+0x79e/0x55b0 net/ipv4/tcp_output.c:2265 __tcp_push_pending_frames+0xfa/0x3a0 net/ipv4/tcp_output.c:2450 tcp_push+0x4ee/0x780 net/ipv4/tcp.c:683 tcp_sendmsg+0x128d/0x39b0 net/ipv4/tcp.c:1342 inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:762 sock_sendmsg_nosec net/socket.c:633 [inline] sock_sendmsg+0xca/0x110 net/socket.c:643 SYSC_sendto+0x660/0x810 net/socket.c:1696 SyS_sendto+0x40/0x50 net/socket.c:1664 entry_SYSCALL_64_fastpath+0x1f/0xbe RIP: 0033:0x446059 RSP: 002b:00007faa6761fb58 EFLAGS: 00000282 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000017 RCX: 0000000000446059 RDX: 0000000000000001 RSI: 0000000020ba3fcd RDI: 0000000000000017 RBP: 00000000006e40a0 R08: 0000000020ba4ff0 R09: 0000000000000010 R10: 0000000020000000 R11: 0000000000000282 R12: 0000000000708150 R13: 0000000000000000 R14: 00007faa676209c0 R15: 00007faa67620700 Object at ffff88003b5bbcb8, in cache kmalloc-64 size: 64 Allocated: PID = 20909 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59 save_stack+0x43/0xd0 mm/kasan/kasan.c:513 set_track mm/kasan/kasan.c:525 [inline] kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:616 kmem_cache_alloc_trace+0x82/0x270 mm/slub.c:2745 kmalloc include/linux/slab.h:490 [inline] kzalloc include/linux/slab.h:663 [inline] tcp_sendmsg_fastopen net/ipv4/tcp.c:1094 [inline] tcp_sendmsg+0x221a/0x39b0 net/ipv4/tcp.c:1139 inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:762 sock_sendmsg_nosec net/socket.c:633 [inline] sock_sendmsg+0xca/0x110 net/socket.c:643 SYSC_sendto+0x660/0x810 net/socket.c:1696 SyS_sendto+0x40/0x50 net/socket.c:1664 entry_SYSCALL_64_fastpath+0x1f/0xbe Freed: PID = 20909 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59 save_stack+0x43/0xd0 mm/kasan/kasan.c:513 set_track mm/kasan/kasan.c:525 [inline] kasan_slab_free+0x73/0xc0 mm/kasan/kasan.c:589 slab_free_hook mm/slub.c:1357 [inline] slab_free_freelist_hook mm/slub.c:1379 [inline] slab_free mm/slub.c:2961 [inline] kfree+0xe8/0x2b0 mm/slub.c:3882 tcp_free_fastopen_req net/ipv4/tcp.c:1077 [inline] tcp_disconnect+0xc15/0x13e0 net/ipv4/tcp.c:2328 __inet_stream_connect+0x20c/0xf90 net/ipv4/af_inet.c:593 tcp_sendmsg_fastopen net/ipv4/tcp.c:1111 [inline] tcp_sendmsg+0x23a8/0x39b0 net/ipv4/tcp.c:1139 inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:762 sock_sendmsg_nosec net/socket.c:633 [inline] sock_sendmsg+0xca/0x110 net/socket.c:643 SYSC_sendto+0x660/0x810 net/socket.c:1696 SyS_sendto+0x40/0x50 net/socket.c:1664 entry_SYSCALL_64_fastpath+0x1f/0xbe Fixes: e994b2f0fb92 ("tcp: do not lock listener to process SYN packets") Fixes: 7db92362d2fe ("tcp: fix potential double free issue for fastopen_req") Signed-off-by: Eric Dumazet Reported-by: Andrey Konovalov Acked-by: Wei Wang Signed-off-by: David S. Miller net/ipv4/tcp_minisocks.c | 1 + 1 file changed, 1 insertion(+) commit 7ab84db64f119e03b2c42ed919dfee7d6cf0dc3c Author: Mike Snitzer Date: Thu May 4 10:32:07 2017 -0400 dm integrity: improve the Kconfig help text for DM_INTEGRITY Signed-off-by: Mike Snitzer Signed-off-by: Milan Broz drivers/md/Kconfig | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) commit 00473374b72a6e5aba01af083f0d5100f3151210 Author: Jan Kara Date: Thu May 4 10:58:03 2017 -0400 ext4: mark superblock writes synchronous for nobarrier mounts Commit b685d3d65ac7 "block: treat REQ_FUA and REQ_PREFLUSH as synchronous" removed REQ_SYNC flag from WRITE_FUA implementation. generic_make_request_checks() however strips REQ_FUA flag from a bio when the storage doesn't report volatile write cache and thus write effectively becomes asynchronous which can lead to performance regressions. This affects superblock writes for ext4. Fix the problem by marking superblock writes always as synchronous. Fixes: b685d3d65ac791406e0dfd8779cc9b3707fea5a3 CC: linux-ext4@vger.kernel.org Signed-off-by: Jan Kara Signed-off-by: Theodore Ts'o fs/ext4/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5d826b7b98a66c890920d690d101bf54d220ea92 Author: Zhu Yanjun Date: Wed May 3 00:43:42 2017 -0400 forcedeth: remove unnecessary carrier status check Since netif_carrier_on() will do nothing if device's carrier is already on, so it's unnecessary to do carrier status check. It's the same for netif_carrier_off(). Signed-off-by: Zhu Yanjun Signed-off-by: David S. Miller drivers/net/ethernet/nvidia/forcedeth.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 50730eb367147dc96394d25b3f55c33595663b6f Author: Sebastian Reichel Date: Wed May 3 11:33:57 2017 +0100 power: supply: twl4030-charger: make twl4030_bci_property_is_writeable static The function twl4030_bci_property_is_writeable can be made static as it does not need to be in global scope. Signed-off-by: Colin Ian King Tested-by: "H. Nikolaus Schaller" Signed-off-by: Sebastian Reichel drivers/power/supply/twl4030_charger.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 97dfb20309e0ad4fa22deb5bc5ed85604d5014ef Author: Mike Snitzer Date: Thu May 4 10:04:18 2017 -0400 dm cache policy smq: cleanup free_target_met() and clean_target_met() Depending on the passed @idle arg, there may be no need to calculate 'nr_free' or 'nr_clean' respectively in free_target_met() and clean_target_met(). Signed-off-by: Mike Snitzer drivers/md/dm-cache-policy-smq.c | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) commit ce1d64e84dbea98d41deaf5db0fe91fd729ad2cd Author: Joe Thornber Date: Wed May 3 12:01:27 2017 -0400 dm cache policy smq: allow demotions to happen even during continuous IO dm-cache's smq policy tries hard to do it's work during the idle periods when there is no IO. But if there are no idle periods (eg, a long fio run) we still need to allow some demotions and promotions to occur. To achieve this, pass @idle=true to queue_promotion()'s free_target_met() call so that free_target_met() doesn't short-circuit the possibility of demotion simply because it isn't an idle period. Fixes: b29d4986d0 ("dm cache: significant rework to leverage dm-bio-prison-v2") Reported-by: John Harrigan Signed-off-by: Joe Thornber Signed-off-by: Mike Snitzer drivers/md/dm-cache-policy-smq.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit daaadb3e9453ab89c2e113a2d1df8e19e30944cc Author: Omar Sandoval Date: Thu May 4 00:31:34 2017 -0700 mq-deadline: add debugfs attributes Expose the fifo lists, cached next requests, batching state, and dispatch list. It'd also be possible to add the sorted lists, but there aren't already seq_file helpers for rbtrees. Signed-off-by: Omar Sandoval Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe block/blk-mq-debugfs.c | 9 +++- block/blk-mq-debugfs.h | 1 + block/mq-deadline.c | 123 +++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 131 insertions(+), 2 deletions(-) commit 16b738f651c83a01db057e5db02ec4b830af9130 Author: Omar Sandoval Date: Thu May 4 00:31:33 2017 -0700 kyber: add debugfs attributes Expose the domain token pools, asynchronous sbitmap depth, domain request lists, and batching state. Signed-off-by: Omar Sandoval Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe block/blk-mq-debugfs.c | 3 +- block/blk-mq-debugfs.h | 2 + block/kyber-iosched.c | 130 +++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 134 insertions(+), 1 deletion(-) commit d332ce091813d11a46144354baa72b755833392f Author: Omar Sandoval Date: Thu May 4 08:24:40 2017 -0600 blk-mq-debugfs: allow schedulers to register debugfs attributes This provides the infrastructure for schedulers to expose their internal state through debugfs. We add a list of queue attributes and a list of hctx attributes to struct elevator_type and wire them up when switching schedulers. Signed-off-by: Omar Sandoval Reviewed-by: Hannes Reinecke Add missing seq_file.h header in blk-mq-debugfs.h Signed-off-by: Jens Axboe block/blk-mq-debugfs.c | 74 ++++++++++++++++++++++++++++++++++++++++++------ block/blk-mq-debugfs.h | 37 ++++++++++++++++++++++++ block/blk-mq-sched.c | 24 ++++++++++------ include/linux/blk-mq.h | 1 + include/linux/blkdev.h | 1 + include/linux/elevator.h | 7 +++++ 6 files changed, 127 insertions(+), 17 deletions(-) commit 9c1051aacde828073dbbab5e8e59c0fc802efa9a Author: Omar Sandoval Date: Thu May 4 08:17:21 2017 -0600 blk-mq: untangle debugfs and sysfs Originally, I tied debugfs registration/unregistration together with sysfs. There's no reason to do this, and it's getting in the way of letting schedulers define their own debugfs attributes. Instead, tie the debugfs registration to the lifetime of the structures themselves. The saner lifetimes mean we can also get rid of the extra mq directory and move everything one level up. I.e., nvme0n1/mq/hctx0/tags is now just nvme0n1/hctx0/tags. Signed-off-by: Omar Sandoval Signed-off-by: Jens Axboe block/blk-core.c | 9 +--- block/blk-mq-debugfs.c | 110 ++++++++++++++++++++++++++++--------------------- block/blk-mq-debugfs.h | 21 ++++++++-- block/blk-mq-sysfs.c | 11 ----- block/blk-mq.c | 7 ++++ block/blk-sysfs.c | 2 + include/linux/blk-mq.h | 4 ++ include/linux/blkdev.h | 1 - 8 files changed, 94 insertions(+), 71 deletions(-) commit d173a25165c124442182f6b21d0c2ec381a0eebe Author: Omar Sandoval Date: Thu May 4 00:31:30 2017 -0700 blk-mq: move debugfs declarations to a separate header file Preparation for adding more declarations. Signed-off-by: Omar Sandoval Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe block/blk-core.c | 1 + block/blk-mq-debugfs.c | 1 + block/blk-mq-debugfs.h | 29 +++++++++++++++++++++++++++++ block/blk-mq-sysfs.c | 1 + block/blk-mq.h | 28 ---------------------------- block/blk-sysfs.c | 1 + 6 files changed, 33 insertions(+), 28 deletions(-) commit 18d4d7d0571f5acc9de638ea3a33e8064deaceca Author: Bart Van Assche Date: Thu May 4 00:31:29 2017 -0700 blk-mq: Do not invoke queue operations on a dead queue In commit e869b5462f83 ("blk-mq: Unregister debugfs attributes earlier"), we shuffled the debugfs cleanup around so that the "state" attribute was removed before we freed the blk-mq data structures. However, later changes are going to undo that, so we need to explicitly disallow running a dead queue. [Omar: rebased and updated commit message] Signed-off-by: Omar Sandoval Signed-off-by: Bart Van Assche Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe block/blk-mq-debugfs.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit f57de23ac9019ea84c548a1637d5562ef07a8f7e Author: Omar Sandoval Date: Thu May 4 00:31:28 2017 -0700 blk-mq-debugfs: get rid of a bunch of boilerplate A large part of blk-mq-debugfs.c is file_operations and seq_file boilerplate. This sucks as is but will suck even more when schedulers can define their own debugfs entries. Factor it all out into a single blk_mq_debugfs_fops which multiplexes as needed. We store the request_queue, blk_mq_hw_ctx, or blk_mq_ctx in the parent directory dentry, which is kind of hacky, but it works. Signed-off-by: Omar Sandoval Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe block/blk-mq-debugfs.c | 464 +++++++++++++++---------------------------------- 1 file changed, 136 insertions(+), 328 deletions(-) commit 88aabbd7e7ace77fb3fbf06d22dd3cc0bfc0ca79 Author: Omar Sandoval Date: Thu May 4 00:31:27 2017 -0700 blk-mq-debugfs: rename hw queue directories from to hctx It's not clear what these numbered directories represent unless you consult the code. We're about to get rid of the intermediate "mq" directory, so these would be even more confusing without that context. Signed-off-by: Omar Sandoval Signed-off-by: Jens Axboe block/blk-mq-debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 71b90511cb170dd3e13b640cc1a453b2dd92e023 Author: Omar Sandoval Date: Thu May 4 00:31:26 2017 -0700 blk-mq-debugfs: don't open code strstrip() Slightly more readable, plus we also strip leading spaces. Signed-off-by: Omar Sandoval Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe block/blk-mq-debugfs.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) commit c7e4145ae11b45931f117aa64c26be6cf58302df Author: Omar Sandoval Date: Thu May 4 00:31:25 2017 -0700 blk-mq-debugfs: error on long write to queue "state" file blk_queue_flags_store() currently truncates and returns a short write if the operation being written is too long. This can give us weird results, like here: $ echo "run bar" echo: write error: invalid argument $ dmesg [ 1103.075435] blk_queue_flags_store: unsupported operation bar. Use either 'run' or 'start' Instead, return an error if the user does this. While we're here, make the argument names consistent with everywhere else in this file. Signed-off-by: Omar Sandoval Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe block/blk-mq-debugfs.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) commit 1a435111f8eb30b370e3891caebb1d1ca61f41ec Author: Omar Sandoval Date: Thu May 4 00:31:24 2017 -0700 blk-mq-debugfs: clean up flag definitions Make sure the spelled out flag names match the definition. This also adds a missing hctx state, BLK_MQ_S_START_ON_RUN, and a missing cmd_flag, __REQ_NOUNMAP. Signed-off-by: Omar Sandoval Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe block/blk-mq-debugfs.c | 201 ++++++++++++++++++++++++++----------------------- 1 file changed, 108 insertions(+), 93 deletions(-) commit bec03d6b92264bb2a06cc3d6f2da5815f0585107 Author: Omar Sandoval Date: Thu May 4 00:31:23 2017 -0700 blk-mq-debugfs: separate flags with | This reads more naturally than spaces. Signed-off-by: Omar Sandoval Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe block/blk-mq-debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9052c7cf492d8c52c556f9536c4a9483fbfe4d73 Author: Jan Kara Date: Thu May 4 09:02:42 2017 +0200 nfs: Fix bdi handling for cloned superblocks In commit 0d3b12584972 "nfs: Convert to separately allocated bdi" I have wrongly cloned bdi reference in nfs_clone_super(). Further inspection has shown that originally the code was actually allocating a new bdi (in ->clone_server callback) which was later registered in nfs_fs_mount_common() and used for sb->s_bdi in nfs_initialise_sb(). This could later result in bdi for the original superblock not getting unregistered when that superblock got shutdown (as the cloned sb still held bdi reference) and later when a new superblock was created under the same anonymous device number, a clash in sysfs has happened on bdi registration: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 10284 at /linux-next/fs/sysfs/dir.c:31 sysfs_warn_dup+0x64/0x74 sysfs: cannot create duplicate filename '/devices/virtual/bdi/0:32' Modules linked in: axp20x_usb_power gpio_axp209 nvmem_sunxi_sid sun4i_dma sun4i_ss virt_dma CPU: 1 PID: 10284 Comm: mount.nfs Not tainted 4.11.0-rc4+ #14 Hardware name: Allwinner sun7i (A20) Family [] (unwind_backtrace) from [] (show_stack+0x10/0x14) [] (show_stack) from [] (dump_stack+0x78/0x8c) [] (dump_stack) from [] (__warn+0xe8/0x100) [] (__warn) from [] (warn_slowpath_fmt+0x38/0x48) [] (warn_slowpath_fmt) from [] (sysfs_warn_dup+0x64/0x74) [] (sysfs_warn_dup) from [] (sysfs_create_dir_ns+0x84/0x94) [] (sysfs_create_dir_ns) from [] (kobject_add_internal+0x9c/0x2ec) [] (kobject_add_internal) from [] (kobject_add+0x48/0x98) [] (kobject_add) from [] (device_add+0xe4/0x5a0) [] (device_add) from [] (device_create_groups_vargs+0xac/0xbc) [] (device_create_groups_vargs) from [] (device_create_vargs+0x20/0x28) [] (device_create_vargs) from [] (bdi_register_va+0x44/0xfc) [] (bdi_register_va) from [] (super_setup_bdi_name+0x48/0xa4) [] (super_setup_bdi_name) from [] (nfs_fill_super+0x1a4/0x204) [] (nfs_fill_super) from [] (nfs_fs_mount_common+0x140/0x1e8) [] (nfs_fs_mount_common) from [] (nfs4_remote_mount+0x50/0x58) [] (nfs4_remote_mount) from [] (mount_fs+0x14/0xa4) [] (mount_fs) from [] (vfs_kern_mount+0x54/0x128) [] (vfs_kern_mount) from [] (nfs_do_root_mount+0x80/0xa0) [] (nfs_do_root_mount) from [] (nfs4_try_mount+0x28/0x3c) [] (nfs4_try_mount) from [] (nfs_fs_mount+0x2cc/0x8c4) [] (nfs_fs_mount) from [] (mount_fs+0x14/0xa4) [] (mount_fs) from [] (vfs_kern_mount+0x54/0x128) [] (vfs_kern_mount) from [] (do_mount+0x158/0xc7c) [] (do_mount) from [] (SyS_mount+0x8c/0xb4) [] (SyS_mount) from [] (ret_fast_syscall+0x0/0x3c) Fix the problem by always creating new bdi for a superblock as we used to do. Reported-and-tested-by: Corentin Labbe Fixes: 0d3b12584972ce5781179ad3f15cca3cdb5cae05 Signed-off-by: Jan Kara Signed-off-by: Jens Axboe fs/nfs/internal.h | 6 +++--- fs/nfs/super.c | 28 ++++++++++------------------ 2 files changed, 13 insertions(+), 21 deletions(-) commit eabe06595d62cfa9278e2cd012df614bc68a7042 Author: Peter Zijlstra Date: Thu May 4 15:05:26 2017 +0200 block/mq: Cure cpu hotplug lock inversion By poking at /debug/sched_features I triggered the following splat: [] ====================================================== [] WARNING: possible circular locking dependency detected [] 4.11.0-00873-g964c8b7-dirty #694 Not tainted [] ------------------------------------------------------ [] bash/2109 is trying to acquire lock: [] (cpu_hotplug_lock.rw_sem){++++++}, at: [] static_key_slow_dec+0x1b/0x50 [] [] but task is already holding lock: [] (&sb->s_type->i_mutex_key#4){+++++.}, at: [] sched_feat_write+0x86/0x170 [] [] which lock already depends on the new lock. [] [] [] the existing dependency chain (in reverse order) is: [] [] -> #2 (&sb->s_type->i_mutex_key#4){+++++.}: [] lock_acquire+0x100/0x210 [] down_write+0x28/0x60 [] start_creating+0x5e/0xf0 [] debugfs_create_dir+0x13/0x110 [] blk_mq_debugfs_register+0x21/0x70 [] blk_mq_register_dev+0x64/0xd0 [] blk_register_queue+0x6a/0x170 [] device_add_disk+0x22d/0x440 [] loop_add+0x1f3/0x280 [] loop_init+0x104/0x142 [] do_one_initcall+0x43/0x180 [] kernel_init_freeable+0x1de/0x266 [] kernel_init+0xe/0x100 [] ret_from_fork+0x31/0x40 [] [] -> #1 (all_q_mutex){+.+.+.}: [] lock_acquire+0x100/0x210 [] __mutex_lock+0x6c/0x960 [] mutex_lock_nested+0x1b/0x20 [] blk_mq_init_allocated_queue+0x37c/0x4e0 [] blk_mq_init_queue+0x3a/0x60 [] loop_add+0xe5/0x280 [] loop_init+0x104/0x142 [] do_one_initcall+0x43/0x180 [] kernel_init_freeable+0x1de/0x266 [] kernel_init+0xe/0x100 [] ret_from_fork+0x31/0x40 [] *** DEADLOCK *** [] [] 3 locks held by bash/2109: [] #0: (sb_writers#11){.+.+.+}, at: [] vfs_write+0x17d/0x1a0 [] #1: (debugfs_srcu){......}, at: [] full_proxy_write+0x5d/0xd0 [] #2: (&sb->s_type->i_mutex_key#4){+++++.}, at: [] sched_feat_write+0x86/0x170 [] [] stack backtrace: [] CPU: 9 PID: 2109 Comm: bash Not tainted 4.11.0-00873-g964c8b7-dirty #694 [] Hardware name: Intel Corporation S2600GZ/S2600GZ, BIOS SE5C600.86B.02.02.0002.122320131210 12/23/2013 [] Call Trace: [] lock_acquire+0x100/0x210 [] get_online_cpus+0x2a/0x90 [] static_key_slow_dec+0x1b/0x50 [] static_key_disable+0x20/0x30 [] sched_feat_write+0x131/0x170 [] full_proxy_write+0x97/0xd0 [] __vfs_write+0x28/0x120 [] vfs_write+0xb5/0x1a0 [] SyS_write+0x49/0xa0 [] entry_SYSCALL_64_fastpath+0x23/0xc2 This is because of the cpu hotplug lock rework. Break the chain at #1 by reversing the lock acquisition order. This way i_mutex_key#4 no longer depends on cpu_hotplug_lock and things are good. Cc: Jens Axboe Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Jens Axboe block/blk-mq.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 507f7d68fe5c24973dcd6e48f011bdfbd2197f01 Author: Javier González Date: Wed May 3 11:19:05 2017 +0200 lightnvm: fix bad back free on error path Free memory correctly when an allocation fails on a loop and we free backwards previously successful allocations. Signed-off-by: Javier González Reviewed-by: Matias Bjørling Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe drivers/lightnvm/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 2e13f33a2464fc3aa7783022a90309cabeca8935 Author: Javier González Date: Wed May 3 11:19:04 2017 +0200 lightnvm: create cmd before allocating request Create nvme command before allocating a request using nvme_alloc_request, which uses the command direction. Up until now, the command has been zeroized, so all commands have been allocated as a read operation. Signed-off-by: Javier González Reviewed-by: Matias Bjørling Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe drivers/nvme/host/lightnvm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 1e6e7eae8a3a66f5fee4f44ef165ffcf31f0c40e Author: Arnaldo Carvalho de Melo Date: Thu May 4 10:30:40 2017 -0300 tools build: Fixup sched_getcpu feature test We have tools/build/feature/test-all.c to speed up feature testing, doing all tests at once, but then all tests in this file should normally pass. That is not the case with the sched-getcpu one, that wasn't passing when included from test-all.c because it needs to have _GNU_SOURCE defined before including sched.h, but _GNU_SOURCE is defined by a header included from another feature test included earlier in test-all.d, test-libpython.c, resulting in: $ cat /tmp/build/perf/feature/test-all.make.output In file included from test-all.c:121:0: test-sched_getcpu.c:1:0: error: "_GNU_SOURCE" redefined [-Werror] #define _GNU_SOURCE In file included from /usr/include/python2.7/pyconfig.h:6:0, from /usr/include/python2.7/Python.h:8, from test-libpython.c:1, from test-all.c:13: /usr/include/python2.7/pyconfig-64.h:1177:0: note: this is the location of the previous definition #define _GNU_SOURCE 1 cc1: all warnings being treated as errors Which would trigger testing the tests individually, when that _GNU_SOURCE redefinition would not take place, and the whole process would continue, just slower... Fix it. Cc: Adrian Hunter Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Fixes: 120010cb1eea ("tools build: Add test for sched_getcpu()") Link: http://lkml.kernel.org/n/tip-3qp1it69xsc4w8gnuu1e9ayh@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/build/feature/test-sched_getcpu.c | 2 ++ 1 file changed, 2 insertions(+) commit 0266c894b51c41d3161adb90e3c15eda3e90a7be Author: Paolo Bonzini Date: Thu May 4 15:14:13 2017 +0200 KVM: put back #ifndef CONFIG_S390 around kvm_vcpu_kick The #ifndef was removed in 75aaafb79f73516b69d5639ad30a72d72e75c8b4, but it was also protecting smp_send_reschedule() in kvm_vcpu_kick(). Acked-by: Cornelia Huck Signed-off-by: Radim Krčmář Signed-off-by: Paolo Bonzini virt/kvm/kvm_main.c | 2 ++ 1 file changed, 2 insertions(+) commit 805b151a1afd24414706a7f6ae275fbb9649be74 Author: Kim Phillips Date: Wed May 3 13:14:02 2017 +0100 perf tests kmod-path: Don't fail if compressed modules aren't supported __kmod_path__parse() uses is_supported_compression() to determine and parse out compressed module file extensions. On systems without zlib, this test fails and __kmod_path__parse() continues to strcmp "ko" with "gz". Don't do this on those systems. Signed-off-by: Kim Phillips Cc: Alexander Shishkin Cc: Jiri Olsa Cc: Peter Zijlstra Fixes: 3c8a67f50a1e ("perf tools: Add kmod_path__parse function") Link: http://lkml.kernel.org/r/20170503131402.c66e314460026c80cd787b34@arm.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/tests/kmod-path.c | 2 ++ 1 file changed, 2 insertions(+) commit d1f7b0234ec7743899321aaaba379b2f5f9d0500 Author: Kim Phillips Date: Wed May 3 13:13:56 2017 +0100 perf annotate: Fix AArch64 comment char The commit 0fcb1da4aba "perf annotate: AArch64 support" blindly copied the comment character from the original: https://lkml.org/lkml/2016/5/19/461 whereas that same commit shows objdump output utilizing the C++ style "//" as the comment delimeter. Since '/' doesn't occur elsewhere in objdump output, we retain the single character check, but fix it to be '/'. Signed-off-by: Kim Phillips Cc: Alexander Shishkin Cc: Chris Riyder Cc: Peter Zijlstra Fixes: 0fcb1da4aba6 ("perf annotate: AArch64 support") Link: http://lkml.kernel.org/r/20170503131356.be88f977094fb3fa0f49b99d@arm.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/arch/arm64/annotate/instructions.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1291927a490832a9bbd0158a5d3c05c25a3c7159 Author: Kim Phillips Date: Wed May 3 13:13:50 2017 +0100 perf tools: Fix spelling mistakes Mostly in the documentation. Signed-off-by: Kim Phillips Cc: Alexander Shishkin Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/20170503131350.cebeecd8bd0f2968417626ab@arm.com [ Fix spelling of "parameter" in one of the spell-checked lines ] Signed-off-by: Arnaldo Carvalho de Melo tools/perf/Documentation/perf-c2c.txt | 4 ++-- tools/perf/Documentation/perf-record.txt | 2 +- tools/perf/Documentation/perf-report.txt | 6 +++--- tools/perf/Documentation/perf.data-file-format.txt | 4 ++-- tools/perf/Documentation/tips.txt | 2 +- tools/perf/util/event.h | 2 +- 6 files changed, 10 insertions(+), 10 deletions(-) commit 538c08f4c89580fc644e2bc64e0a4b86c925da4e Author: Moritz Fischer Date: Mon Apr 24 15:05:12 2017 -0700 rtc: ds1374: wdt: Fix stop/start ioctl always returning -EINVAL The WDIOC_SETOPTIONS case in the watchdog ioctl would alwayss falls through to the -EINVAL case. This is wrong since thew watchdog does actually get stopped or started correctly. Fixes: 920f91e50c5b ("drivers/rtc/rtc-ds1374.c: add watchdog support") Signed-off-by: Moritz Fischer Signed-off-by: Alexandre Belloni drivers/rtc/rtc-ds1374.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 453d0744f6c6ca3f9749b8c57c2e85b5b9f52514 Author: Moritz Fischer Date: Mon Apr 24 15:05:11 2017 -0700 rtc: ds1374: wdt: Fix issue with timeout scaling from secs to wdt ticks The issue is that the internal counter that triggers the watchdog reset is actually running at 4096 Hz instead of 1Hz, therefore the value given by userland (in sec) needs to be multiplied by 4096 to get the correct behavior. Fixes: 920f91e50c5b ("drivers/rtc/rtc-ds1374.c: add watchdog support") Signed-off-by: Moritz Fischer Signed-off-by: Alexandre Belloni drivers/rtc/rtc-ds1374.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 35d2d5d490e2dc98ec07f899577b2a5451f413e8 Author: Christoffer Dall Date: Thu May 4 13:54:17 2017 +0200 KVM: arm/arm64: Move shared files to virt/kvm/arm For some time now we have been having a lot of shared functionality between the arm and arm64 KVM support in arch/arm, which not only required a horrible inter-arch reference from the Makefile in arch/arm64/kvm, but also created confusion for newcomers to the code base, as was recently seen on the mailing list. Further, it causes confusion for things like cscope, which needs special attention to index specific shared files for arm64 from the arm tree. Move the shared files into virt/kvm/arm and move the trace points along with it. When moving the tracepoints we have to modify the way the vgic creates definitions of the trace points, so we take the chance to include the VGIC tracepoints in its very own special vgic trace.h file. Signed-off-by: Christoffer Dall arch/arm/kvm/Makefile | 7 +- arch/arm/kvm/arm.c | 1480 ---------------------------------- arch/arm/kvm/mmio.c | 217 ----- arch/arm/kvm/mmu.c | 1958 --------------------------------------------- arch/arm/kvm/perf.c | 68 -- arch/arm/kvm/psci.c | 332 -------- arch/arm/kvm/trace.h | 247 ------ arch/arm64/kvm/Makefile | 5 +- virt/kvm/arm/arm.c | 1480 ++++++++++++++++++++++++++++++++++ virt/kvm/arm/mmio.c | 217 +++++ virt/kvm/arm/mmu.c | 1958 +++++++++++++++++++++++++++++++++++++++++++++ virt/kvm/arm/perf.c | 68 ++ virt/kvm/arm/psci.c | 332 ++++++++ virt/kvm/arm/trace.h | 246 +++++- virt/kvm/arm/vgic/trace.h | 37 + virt/kvm/arm/vgic/vgic.c | 2 +- 16 files changed, 4335 insertions(+), 4319 deletions(-) commit be13ec668d043e5313985014d34735ec6ede074a Merge: b7b0201 e8bb467 Author: Vinod Koul Date: Thu May 4 16:08:52 2017 +0530 Merge branch 'topic/pl330' into for-linus commit b7b0201a6743c4d9b634da68ad8bb94db28b8e69 Merge: 3378e7a db6a3d0 Author: Vinod Koul Date: Thu May 4 16:08:21 2017 +0530 Merge branch 'topic/xilinx' into for-linus commit 3378e7a49fda9537d48953cd41cf7836c472ba2f Merge: dd2b9ff dc7c733 Author: Vinod Koul Date: Thu May 4 16:08:10 2017 +0530 Merge branch 'topic/qcom' into for-linus commit dd2b9ff8a9f992b4c85842e8b7c0b6f08f9e7e7c Merge: f23514b 417cb97 Author: Vinod Koul Date: Thu May 4 16:07:59 2017 +0530 Merge branch 'topic/pl08x' into for-linus commit 417cb972537af7994b9123c226a35aac26369f9d Author: Vinod Koul Date: Mon Apr 3 09:04:28 2017 +0530 dmaengine: pl08x: remove lock documentation lock variable in pl08x_dma_chan_state no longer exists so remove it Signed-off-by: Vinod Koul drivers/dma/amba-pl08x.c | 1 - 1 file changed, 1 deletion(-) commit 8ee1bdc5a46cf818e2192c11bc1294a7dbad36c8 Author: Vinod Koul Date: Mon Apr 3 09:02:36 2017 +0530 dmaengine: pl08x: fix pl08x_dma_chan_state documentation Documentation for pl08x_dma_chan_state mentions it as struct whereas it is a enum, so fix that Signed-off-by: Vinod Koul drivers/dma/amba-pl08x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ded091fee6806b7120f475d89c151d611758a395 Author: Linus Walleij Date: Sun Apr 2 16:50:53 2017 +0200 dmaengine: pl08x: Use the BIT() macro consistently This makes the driver shift bits with BIT() which is used on other places in the driver. Signed-off-by: Linus Walleij Signed-off-by: Vinod Koul drivers/dma/amba-pl08x.c | 10 +++++----- include/linux/amba/pl080.h | 40 ++++++++++++++++++++-------------------- 2 files changed, 25 insertions(+), 25 deletions(-) commit da7cbd2098a7c943ac919297d896682222a306dc Author: Linus Walleij Date: Sun Apr 2 16:50:44 2017 +0200 dmaengine: pl080: Fix some missing kerneldoc Two elements of the physical channel description was missing. Signed-off-by: Linus Walleij Signed-off-by: Vinod Koul drivers/dma/amba-pl08x.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 44f0aeec203738bf34f4b7e16b745c8c71fe0f06 Author: Linus Walleij Date: Sun Apr 2 16:50:33 2017 +0200 dmaengine: pl080: Cut some unused defines There is no in-kernel code using these indexed register defines, and their offsets are clearly defined right below. Cut them. Signed-off-by: Linus Walleij Signed-off-by: Vinod Koul include/linux/amba/pl080.h | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) commit f23514b1017905c2798224fa07e236471b9ed1e7 Merge: fbfb8e1 eda6f4e Author: Vinod Koul Date: Thu May 4 16:03:05 2017 +0530 Merge branch 'topic/cppi' into for-linus commit eeca958dce0a9231d1969f86196653eb50fcc9b3 Author: Luis Henriques Date: Fri Apr 28 11:14:04 2017 +0100 ceph: fix memory leak in __ceph_setxattr() The ceph_inode_xattr needs to be released when removing an xattr. Easily reproducible running the 'generic/020' test from xfstests or simply by doing: attr -s attr0 -V 0 /mnt/test && attr -r attr0 /mnt/test While there, also fix the error path. Here's the kmemleak splat: unreferenced object 0xffff88001f86fbc0 (size 64): comm "attr", pid 244, jiffies 4294904246 (age 98.464s) hex dump (first 32 bytes): 40 fa 86 1f 00 88 ff ff 80 32 38 1f 00 88 ff ff @........28..... 00 01 00 00 00 00 ad de 00 02 00 00 00 00 ad de ................ backtrace: [] kmemleak_alloc+0x49/0xa0 [] kmem_cache_alloc+0x9b/0xf0 [] __ceph_setxattr+0x17e/0x820 [] ceph_set_xattr_handler+0x37/0x40 [] __vfs_removexattr+0x4b/0x60 [] vfs_removexattr+0x77/0xd0 [] removexattr+0x41/0x60 [] path_removexattr+0x75/0xa0 [] SyS_lremovexattr+0xb/0x10 [] entry_SYSCALL_64_fastpath+0x13/0x94 [] 0xffffffffffffffff Cc: stable@vger.kernel.org Signed-off-by: Luis Henriques Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov fs/ceph/xattr.c | 3 +++ 1 file changed, 3 insertions(+) commit f775ff7d89f33fc9ba63f6f70df3bcc98c2d9828 Author: Alexander Graf Date: Thu Apr 27 18:34:00 2017 +0200 ceph: fix file open flags on ppc64 The file open flags (O_foo) are platform specific and should never go out to an interface that is not local to the system. Unfortunately these flags have leaked out onto the wire in the cephfs implementation. That lead to bogus flags getting transmitted on ppc64. This patch converts the kernel view of flags to the ceph view of file open flags. Fixes: 124e68e74 ("ceph: file operations") Signed-off-by: Alexander Graf Reviewed-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov fs/ceph/file.c | 34 +++++++++++++++++++++++++++++++++- include/linux/ceph/ceph_fs.h | 12 ++++++++++++ 2 files changed, 45 insertions(+), 1 deletion(-) commit b50c2de51e611da90cf3cf04c058f7e9bbe79e93 Author: Yan, Zheng Date: Mon Apr 24 11:56:50 2017 +0800 ceph: choose readdir frag based on previous readdir reply The dirfragtree is lazily updated, it's not always accurate. Infinite loops happens in following circumstance. - client send request to read frag A - frag A has been fragmented into frag B and C. So mds fills the reply with contents of frag B - client wants to read next frag C. ceph_choose_frag(frag value of C) return frag A. The fix is using previous readdir reply to calculate next readdir frag when possible. Signed-off-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov fs/ceph/dir.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) commit e010dd0ada619ed6d3411de7371fba12c1baa48b Author: Ilya Dryomov Date: Thu Apr 13 12:17:39 2017 +0200 rbd: exclusive map option Support disabling automatic exclusive lock transfers to allow users to be in charge of which node should own the lock while being able to reuse exclusive lock's built-in blacklist/break-lock functionality. Signed-off-by: Ilya Dryomov Reviewed-by: Jason Dillaman drivers/block/rbd.c | 83 ++++++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 73 insertions(+), 10 deletions(-) commit 3b77faa0495abd07e94119681be8cc66af5e0a3b Author: Ilya Dryomov Date: Thu Apr 13 12:17:39 2017 +0200 rbd: return ResponseMessage result from rbd_handle_request_lock() Right now it's just 0, but "no automatic exclusive lock transfers" mode code will need -EROFS. Signed-off-by: Ilya Dryomov Reviewed-by: Jason Dillaman drivers/block/rbd.c | 40 ++++++++++++++++++++++++++-------------- 1 file changed, 26 insertions(+), 14 deletions(-) commit f9bebd580360c141b5fdbede9cc13a4caf23cd1a Author: Ilya Dryomov Date: Thu Apr 13 12:17:39 2017 +0200 rbd: kill rbd_is_lock_supported() Currently the exclusive lock is acquired only if the mapping is writable, i.e. an image HEAD mapped in rw mode. This means that we don't acquire the lock for executing a read from a snapshot or an image HEAD mapped in ro mode, even if lock_on_read is set. This is somewhat weird and inconsistent with "no automatic exclusive lock transfers" mode, where the lock is acquired unconditionally. Signed-off-by: Ilya Dryomov Reviewed-by: Jason Dillaman drivers/block/rbd.c | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) commit 14bb211d324d6c8140167bd6b2b8a80757348a2f Author: Ilya Dryomov Date: Thu Apr 13 12:17:38 2017 +0200 rbd: support updating the lock cookie without releasing the lock As we no longer release the lock before potentially raising BLACKLISTED in rbd_reregister_watch(), the "either locked or blacklisted" assert in rbd_queue_workfn() needs to go: we can be both locked and blacklisted at that point now. Signed-off-by: Ilya Dryomov Reviewed-by: Jason Dillaman drivers/block/rbd.c | 66 ++++++++++++++++++++++-------------- include/linux/ceph/cls_lock_client.h | 5 +++ net/ceph/cls_lock_client.c | 51 ++++++++++++++++++++++++++++ 3 files changed, 97 insertions(+), 25 deletions(-) commit cbbfb0ff115159847121afe9c7553bd5c86f6062 Author: Ilya Dryomov Date: Thu Apr 13 12:17:38 2017 +0200 rbd: store lock cookie In preparation for supporting set_cookie method (or rather set_cookie fallback for older OSDs), store the lock cookie on lock and use it on unlock instead of recalculating from rbd_dev->watch_cookie. Signed-off-by: Ilya Dryomov Reviewed-by: Jason Dillaman drivers/block/rbd.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) commit bbead745d96cfd51aaa332bdeab300862c7a8061 Author: Ilya Dryomov Date: Thu Apr 13 12:17:38 2017 +0200 rbd: ignore unlock errors Currently the lock_state is set to UNLOCKED (preventing further I/O), but RELEASED_LOCK notification isn't sent. Be consistent with userspace and treat ceph_cls_unlock() errors as the image is unlocked. Signed-off-by: Ilya Dryomov Reviewed-by: Jason Dillaman drivers/block/rbd.c | 32 ++++++++++++++------------------ 1 file changed, 14 insertions(+), 18 deletions(-) commit 5769ed0cb12dcd135251e546863196cec0b58e34 Author: Ilya Dryomov Date: Thu Apr 13 12:17:38 2017 +0200 rbd: fix error handling around rbd_init_disk() add_disk() takes an extra reference on disk->queue, which is put in put_disk() -> disk_release(). Avoiding blk_cleanup_queue() (which also puts the queue) until add_disk() sets GENHD_FL_UP works for the queue itself, but leaks various queue internals. Conditioning tag_set freeing on GENHD_FL_UP is wrong too: all error paths after rbd_init_disk() leak the tag_set. Move the final "announce" steps out of rbd_dev_device_setup() so that it can be unwound like any other function. Leave "announce" steps to do_rbd_add/remove(). Signed-off-by: Ilya Dryomov Reviewed-by: Jason Dillaman drivers/block/rbd.c | 87 +++++++++++++++++++++++++++-------------------------- 1 file changed, 44 insertions(+), 43 deletions(-) commit fd22aef8b47cfc068448df65c1183698b0abd815 Author: Ilya Dryomov Date: Thu Apr 13 12:17:37 2017 +0200 rbd: move rbd_unregister_watch() call into rbd_dev_image_release() rbd_dev->disk tear down vs rbd_watch_cb() race shouldn't be a problem anymore thanks to EXISTS and REMOVING checks in rbd_dev_update_size(). A similar race could occur on "rbd map", see commit 811c66887746 ("rbd: fix rbd map vs notify races"). Signed-off-by: Ilya Dryomov Reviewed-by: Jason Dillaman drivers/block/rbd.c | 18 +++--------------- 1 file changed, 3 insertions(+), 15 deletions(-) commit 8b679ec5257eeb3d73b71a613cad2769f21c86ad Author: Ilya Dryomov Date: Thu Apr 13 12:17:37 2017 +0200 rbd: move rbd_dev_destroy() call out of rbd_dev_image_release() ... to simplify error handling in do_rbd_add(). Signed-off-by: Ilya Dryomov Reviewed-by: Jason Dillaman drivers/block/rbd.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 26544c623e741ac6445f8b1ae369ee32ae1794ad Author: Jeff Layton Date: Tue Apr 4 08:39:46 2017 -0400 ceph: when seeing write errors on an inode, switch to sync writes Currently, we don't have a real feedback mechanism in place for when we start seeing buffered writeback errors. If writeback is failing, there is nothing that prevents an application from continuing to dirty pages that aren't being cleaned. In the event that we're seeing write errors of any sort occur on an inode, have the callback set a flag to force further writes to be synchronous. When the next write succeeds, clear the flag to allow buffered writeback to continue. Since this is just a hint to the write submission mechanism, we only take the i_ceph_lock when a lockless check shows that the flag needs to be changed. Signed-off-by: Jeff Layton Reviewed-by: "Yan, Zheng” Signed-off-by: Ilya Dryomov fs/ceph/addr.c | 6 +++++- fs/ceph/file.c | 31 ++++++++++++++++++------------- fs/ceph/super.h | 26 ++++++++++++++++++++++++++ 3 files changed, 49 insertions(+), 14 deletions(-) commit 6fc1fe5e4cfc8939ee59a570b087946042a30140 Author: Jeff Layton Date: Tue Apr 4 08:39:44 2017 -0400 Revert "ceph: SetPageError() for writeback pages if writepages fails" This reverts commit b109eec6f4332bd517e2f41e207037c4b9065094. If I'm filling up a filesystem with this sort of command: $ dd if=/dev/urandom of=/mnt/cephfs/fillfile bs=2M oflag=sync ...then I'll eventually get back EIO on a write. Further calls will give us ENOSPC. I'm not sure what prompted this change, but I don't think it's what we want to do. If writepages failed, we will have already set the mapping error appropriately, and that's what gets reported by fsync() or close(). __filemap_fdatawait_range however, does this: wait_on_page_writeback(page); if (TestClearPageError(page)) ret = -EIO; ...and that -EIO ends up trumping the mapping's error if one exists. When writepages fails, we only want to set the error in the mapping, and not flag the individual pages. Signed-off-by: Jeff Layton Reviewed-by: "Yan, Zheng” Signed-off-by: Ilya Dryomov fs/ceph/addr.c | 3 --- 1 file changed, 3 deletions(-) commit 92475f05bdb6daefce3f55f46551153e7ed05f45 Author: Jeff Layton Date: Thu Apr 13 11:07:04 2017 -0400 ceph: handle epoch barriers in cap messages Have the client store and update the osdc epoch_barrier when a cap message comes in with one. When sending cap messages, send the epoch barrier as well. This allows clients to inform servers that their released caps may not be used until a particular OSD map epoch. Signed-off-by: Jeff Layton Reviewed-by: "Yan, Zheng” Signed-off-by: Ilya Dryomov fs/ceph/caps.c | 21 ++++++++++++++++----- fs/ceph/mds_client.c | 20 ++++++++++++++++++++ fs/ceph/mds_client.h | 7 +++++-- 3 files changed, 41 insertions(+), 7 deletions(-) commit 58eb7932ae4d671d2a2377a1779eda96a2789b11 Author: Jeff Layton Date: Tue Apr 18 09:21:16 2017 -0400 libceph: add an epoch_barrier field to struct ceph_osd_client Cephfs can get cap update requests that contain a new epoch barrier in them. When that happens we want to pause all OSD traffic until the right map epoch arrives. Add an epoch_barrier field to ceph_osd_client that is protected by the osdc->lock rwsem. When the barrier is set, and the current OSD map epoch is below that, pause the request target when submitting the request or when revisiting it. Add a way for upper layers (cephfs) to update the epoch_barrier as well. If we get a new map, compare the new epoch against the barrier before kicking requests and request another map if the map epoch is still lower than the one we want. If we get a map with a full pool, or at quota condition, then set the barrier to the current epoch value. Signed-off-by: Jeff Layton Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov include/linux/ceph/osd_client.h | 2 ++ net/ceph/debugfs.c | 3 +- net/ceph/osd_client.c | 79 +++++++++++++++++++++++++++++++++++++---- 3 files changed, 76 insertions(+), 8 deletions(-) commit fc36d0a42c19870e57a542c2dd0972185584d407 Author: Jeff Layton Date: Tue Apr 4 08:39:39 2017 -0400 libceph: abort already submitted but abortable requests when map or pool goes full When a Ceph volume hits capacity, a flag is set in the OSD map to indicate that, and a new map is sprayed around the cluster. With cephfs we want it to shut down any abortable requests that are in progress with an -ENOSPC error as they'd just hang otherwise. Add a new ceph_osdc_abort_on_full helper function to handle this. It will first check whether there is an out-of-space condition in the cluster and then walk the tree and abort any request that has r_abort_on_full set with a -ENOSPC error. Call this new function directly whenever we get a new OSD map. Signed-off-by: Jeff Layton Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov net/ceph/osd_client.c | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) commit a1f4020aab10a6bddb2d061c960ebe52cdfa30b5 Author: Jeff Layton Date: Tue Apr 4 08:39:37 2017 -0400 libceph: allow requests to return immediately on full conditions if caller wishes Usually, when the osd map is flagged as full or the pool is at quota, write requests just hang. This is not what we want for cephfs, where it would be better to simply report -ENOSPC back to userland instead of stalling. If the caller knows that it will want an immediate error return instead of blocking on a full or at-quota error condition then allow it to set a flag to request that behavior. Set that flag in ceph_osdc_new_request (since ceph.ko is the only caller), and on any other write request from ceph.ko. A later patch will deal with requests that were submitted before the new map showing the full condition came in. Signed-off-by: Jeff Layton Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov fs/ceph/addr.c | 1 + fs/ceph/file.c | 1 + include/linux/ceph/osd_client.h | 1 + net/ceph/osd_client.c | 7 +++++++ 4 files changed, 10 insertions(+) commit aa26d662b9d44e7f5b0d109e892e537a23471863 Author: Jeff Layton Date: Tue Apr 4 08:39:36 2017 -0400 libceph: remove req->r_replay_version Nothing uses this anymore with the removal of the ack vs. commit code. Remove the field and just encode zeroes into place in the request encoding. Signed-off-by: Jeff Layton Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov include/linux/ceph/osd_client.h | 1 - net/ceph/debugfs.c | 4 +--- net/ceph/osd_client.c | 7 ++++--- 3 files changed, 5 insertions(+), 7 deletions(-) commit 79162547b76e4979b21ef80c9629ada94a51a59b Author: Yan, Zheng Date: Wed Apr 5 12:54:05 2017 -0400 ceph: make seeky readdir more efficient Current cephfs client uses string to indicate start position of readdir. The string is last entry of previous readdir reply. This approach does not work for seeky readdir because we can not easily convert the new postion to a string. For seeky readdir, mds needs to return dentries from the beginning. Client keeps retrying if the reply does not contain the dentry it wants. In current version of ceph, mds sorts CDentry in its cache in hash order. Client also uses dentry hash to compose dir postion. For seeky readdir, if client passes the hash part of dir postion to mds. mds can avoid replying useless dentries. Signed-off-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov fs/ceph/dir.c | 4 ++++ fs/ceph/inode.c | 17 ++++++++++++----- fs/ceph/mds_client.c | 1 + fs/ceph/mds_client.h | 3 ++- include/linux/ceph/ceph_fs.h | 2 ++ 5 files changed, 21 insertions(+), 6 deletions(-) commit 2827528da003ad207930f0d1af5faf3e482d6393 Author: Yan, Zheng Date: Tue Mar 28 17:56:29 2017 +0800 ceph: close stopped mds' session If a mds has stopped, close its session and clean up its session requests/caps. The process is similar to handling SESSION_CLOSE initiated by mds. Signed-off-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov fs/ceph/mds_client.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) commit 0a07fc8cd01b6838d999a5eacaa99fe90b8f768b Author: Yan, Zheng Date: Wed Mar 29 15:30:24 2017 +0800 ceph: fix potential use-after-free __unregister_session() free the session if it drops the last reference. We should grab an extra reference if we want to use session after __unregister_session(). Signed-off-by: "Yan, Zheng" Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov fs/ceph/mds_client.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) commit 76201b6354bb3aa31c7ba2bd42b9cbb8dda71c44 Author: Yan, Zheng Date: Tue Mar 28 17:04:13 2017 +0800 ceph: allow connecting to mds whose rank >= mdsmap::m_max_mds mdsmap::m_max_mds is the expected count of active mds. It's not the max rank of active mds. User can decrease mdsmap::m_max_mds, but does not stop mds whose rank >= mdsmap::m_max_mds. Signed-off-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov fs/ceph/debugfs.c | 21 ++++++++++----------- fs/ceph/mds_client.c | 10 +++++----- fs/ceph/mdsmap.c | 44 +++++++++++++++++++++++++++++++++++++------- include/linux/ceph/mdsmap.h | 7 ++++--- 4 files changed, 56 insertions(+), 26 deletions(-) commit 8242c9f35ae77ca21e6cf79827787789a988f44c Author: Yan, Zheng Date: Sat Mar 25 17:28:10 2017 +0800 ceph: fix wrong check in ceph_renew_caps() Signed-off-by: "Yan, Zheng" Signed-off-by: Ilya Dryomov fs/ceph/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0e1a5ee6577e43e5be55369d398107080b360941 Author: Elena Reshetova Date: Fri Mar 17 14:10:29 2017 +0200 libceph: convert ceph_pagelist.refcnt from atomic_t to refcount_t refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova Signed-off-by: Hans Liljestrand Signed-off-by: Kees Cook Signed-off-by: David Windsor Signed-off-by: Ilya Dryomov fs/ceph/mds_client.c | 2 +- include/linux/ceph/pagelist.h | 6 +++--- net/ceph/pagelist.c | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) commit 02113a0f14e20bd8e675d7cec16db6eaaf2b2380 Author: Elena Reshetova Date: Fri Mar 17 14:10:28 2017 +0200 libceph: convert ceph_osd.o_ref from atomic_t to refcount_t refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova Signed-off-by: Hans Liljestrand Signed-off-by: Kees Cook Signed-off-by: David Windsor Signed-off-by: Ilya Dryomov include/linux/ceph/osd_client.h | 3 ++- net/ceph/osd_client.c | 16 ++++++++-------- 2 files changed, 10 insertions(+), 9 deletions(-) commit 06dfa96399a9a3280dd81e47f8696aa89f1783e7 Author: Elena Reshetova Date: Fri Mar 17 14:10:27 2017 +0200 libceph: convert ceph_snap_context.nref from atomic_t to refcount_t refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova Signed-off-by: Hans Liljestrand Signed-off-by: Kees Cook Signed-off-by: David Windsor Signed-off-by: Ilya Dryomov include/linux/ceph/libceph.h | 3 ++- net/ceph/snapshot.c | 6 +++--- 2 files changed, 5 insertions(+), 4 deletions(-) commit 805692d0e0f7dec42b5e05fb8b2a5c172f66a3c2 Author: Elena Reshetova Date: Fri Mar 3 11:15:07 2017 +0200 ceph: convert ceph_cap_snap.nref from atomic_t to refcount_t refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova Signed-off-by: Hans Liljestrand Signed-off-by: Kees Cook Signed-off-by: David Windsor Signed-off-by: Ilya Dryomov fs/ceph/caps.c | 4 ++-- fs/ceph/snap.c | 2 +- fs/ceph/super.h | 5 +++-- 3 files changed, 6 insertions(+), 5 deletions(-) commit 3997c01d260ed00d712b051fdab022a08719441e Author: Elena Reshetova Date: Fri Mar 3 11:15:06 2017 +0200 ceph: convert ceph_mds_session.s_ref from atomic_t to refcount_t refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova Signed-off-by: Hans Liljestrand Signed-off-by: Kees Cook Signed-off-by: David Windsor Signed-off-by: Ilya Dryomov fs/ceph/mds_client.c | 18 +++++++++--------- fs/ceph/mds_client.h | 5 +++-- 2 files changed, 12 insertions(+), 11 deletions(-) commit d6a3408a77807037872892c2a2034180fcc08d12 Author: Ilya Dryomov Date: Fri Mar 3 18:16:07 2017 +0100 libceph: supported_features module parameter Add a readonly, exported to sysfs module parameter so that userspace can generate meaningful error messages. It's a bit funky, but there is no other libceph-specific place. Signed-off-by: Ilya Dryomov net/ceph/ceph_common.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit 74da4a0f574d11ed60dbe50a1e5e942e20476590 Author: Ilya Dryomov Date: Fri Mar 3 18:16:07 2017 +0100 libceph, ceph: always advertise all supported features No reason to hide CephFS-specific features in the rbd case. Recent feature bits mix RADOS and CephFS-specific stuff together anyway. Signed-off-by: Ilya Dryomov drivers/block/rbd.c | 2 +- fs/ceph/super.c | 7 +------ include/linux/ceph/ceph_features.h | 4 ++++ include/linux/ceph/libceph.h | 5 +---- net/ceph/ceph_common.c | 16 ++++++---------- 5 files changed, 13 insertions(+), 21 deletions(-) commit ce4586063f1af780b1c6b7e344907e6f9c1ba59a Author: Richard Weinberger Date: Thu May 4 08:15:10 2017 +0200 um: Add missing NR_CPUS include We need linux/threads.h for that variable. Fixes: 8bba077066d6d0 ("um: Set number of CPUs") Signed-off-by: Richard Weinberger arch/um/os-Linux/skas/process.c | 1 + 1 file changed, 1 insertion(+) commit 9b3eb54106cf6acd03f07cf0ab01c13676a226c2 Author: Sabrina Dubroca Date: Wed May 3 16:43:19 2017 +0200 xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY When CONFIG_XFRM_SUB_POLICY=y, xfrm_dst stores a copy of the flowi for that dst. Unfortunately, the code that allocates and fills this copy doesn't care about what type of flowi (flowi, flowi4, flowi6) gets passed. In multiple code paths (from raw_sendmsg, from TCP when replying to a FIN, in vxlan, geneve, and gre), the flowi that gets passed to xfrm is actually an on-stack flowi4, so we end up reading stuff from the stack past the end of the flowi4 struct. Since xfrm_dst->origin isn't used anywhere following commit ca116922afa8 ("xfrm: Eliminate "fl" and "pol" args to xfrm_bundle_ok()."), just get rid of it. xfrm_dst->partner isn't used either, so get rid of that too. Fixes: 9d6ec938019c ("ipv4: Use flowi4 in public route lookup interfaces.") Signed-off-by: Sabrina Dubroca Signed-off-by: Steffen Klassert include/net/xfrm.h | 10 ---------- net/xfrm/xfrm_policy.c | 47 ----------------------------------------------- 2 files changed, 57 deletions(-) commit 0e78a87306a6f55b1c7bbafad1de62c3975953ca Author: Steffen Klassert Date: Wed May 3 08:44:27 2017 +0200 esp4: Fix udpencap for local TCP packets. Locally generated TCP packets are usually cloned, so we do skb_cow_data() on this packets. After that we need to reload the pointer to the esp header. On udpencap this header has an offset to skb_transport_header, so take this offset into account. Fixes: 67d349ed603 ("net/esp4: Fix invalid esph pointer crash") Fixes: fca11ebde3f0 ("esp4: Reorganize esp_output") Reported-by: Don Bowman Signed-off-by: Steffen Klassert net/ipv4/esp4.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 7db0a6efdc3e990cdfd4b24820d010e9eb7890ad Author: Steve French Date: Wed May 3 21:12:20 2017 -0500 SMB3: Work around mount failure when using SMB3 dialect to Macs Macs send the maximum buffer size in response on ioctl to validate negotiate security information, which causes us to fail the mount as the response buffer is larger than the expected response. Changed ioctl response processing to allow for padding of validate negotiate ioctl response and limit the maximum response size to maximum buffer size. Signed-off-by: Steve French CC: Stable fs/cifs/smb2pdu.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) commit 77c0eddeeeee14bf0fb0c0bb97e782981bbcf084 Author: Steven Rostedt (VMware) Date: Wed May 3 11:41:44 2017 -0400 ftrace: Simplify ftrace_match_record() even more Dan Carpenter sent a patch to remove a check in ftrace_match_record() because the logic of the code made the check redundant. I looked deeper into the code, and made the following logic table, with the three variables and the result of the original code. modname mod_matches exclude_mod result ------- ----------- ----------- ------ 0 0 0 return 0 0 0 1 func_match 0 1 * < cannot exist > 1 0 0 return 0 1 0 1 func_match 1 1 0 func_match 1 1 1 return 0 Notice that when mod_matches == exclude mod, the result is always to return 0, and when mod_matches != exclude_mod, then the result is to test the function. This means we only need test if mod_matches is equal to exclude_mod. Cc: Dan Carpenter Signed-off-by: Steven Rostedt (VMware) kernel/trace/ftrace.c | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-) commit 31805c90521ea75dfa3d016fc94f581da6a40fee Author: Dan Carpenter Date: Fri Mar 31 18:21:30 2017 +0300 ftrace: Remove an unneeded condition We know that "mod_matches" is true here so there is no need to check again. Link: http://lkml.kernel.org/r/20170331152130.GA4947@mwanda Signed-off-by: Dan Carpenter Signed-off-by: Steven Rostedt (VMware) kernel/trace/ftrace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e09e28671cda63e6308b31798b997639120e2a21 Author: Amey Telawane Date: Wed May 3 15:41:14 2017 +0530 tracing: Use strlcpy() instead of strcpy() in __trace_find_cmdline() Strcpy is inherently not safe, and strlcpy() should be used instead. __trace_find_cmdline() uses strcpy() because the comms saved must have a terminating nul character, but it doesn't hurt to add the extra protection of using strlcpy() instead of strcpy(). Link: http://lkml.kernel.org/r/1493806274-13936-1-git-send-email-amit.pundir@linaro.org Signed-off-by: Amey Telawane [AmitP: Cherry-picked this commit from CodeAurora kernel/msm-3.10 https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=2161ae9a70b12cf18ac8e5952a20161ffbccb477] Signed-off-by: Amit Pundir [ Updated change log and removed the "- 1" from len parameter ] Signed-off-by: Steven Rostedt (VMware) kernel/trace/trace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a1be8edda4fe1f0a75007f26000a51436800869d Merge: 4c17468 1758618 Author: Linus Torvalds Date: Wed May 3 19:12:27 2017 -0700 Merge tag 'modules-for-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux Pull modules updates from Jessica Yu: - Minor code cleanups - Fix section alignment for .init_array * tag 'modules-for-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux: kallsyms: Use bounded strnchr() when parsing string module: Unify the return value type of try_module_get module: set .init_array alignment to 8 commit e9cdd307704b5a8f685fa3fff4403691fbf64f97 Author: Yunlei He Date: Wed Apr 26 15:56:52 2017 +0800 f2fs: fix a mount fail for wrong next_scan_nid -write_checkpoint -do_checkpoint -next_free_nid <--- something wrong with next free nid -f2fs_fill_super -build_node_manager -build_free_nids -get_current_nat_page -__get_meta_page <--- attempt to access beyond end of device Signed-off-by: Yunlei He Signed-off-by: Jaegeuk Kim fs/f2fs/node.c | 3 +++ 1 file changed, 3 insertions(+) commit baaabbb72b0960d6d5220b77f206116aa54771de Author: Chao Yu Date: Thu May 4 09:35:43 2017 +0800 f2fs: enhance scalability of trace macro Use __print_flags in show_bio_op_flags and show_cpreason instead of __print_symbolic, it enables tracer function traverses and shows all bits in the flag. Additionally, add missing REQ_FUA into F2FS_OP_FLAGS. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim include/trace/events/f2fs.h | 30 ++++++++++++++---------------- 1 file changed, 14 insertions(+), 16 deletions(-) commit 4c174688ee92805aa5df6e06e5b625a3286e415c Merge: 9c35baf 73a757e Author: Linus Torvalds Date: Wed May 3 18:41:21 2017 -0700 Merge tag 'trace-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing updates from Steven Rostedt: "New features for this release: - Pretty much a full rewrite of the processing of function plugins. i.e. echo do_IRQ:stacktrace > set_ftrace_filter - The rewrite was needed to add plugins to be unique to tracing instances. i.e. mkdir instance/foo; cd instances/foo; echo do_IRQ:stacktrace > set_ftrace_filter The old way was written very hacky. This removes a lot of those hacks. - New "function-fork" tracing option. When set, pids in the set_ftrace_pid will have their children added when the processes with their pids listed in the set_ftrace_pid file forks. - Exposure of "maxactive" for kretprobe in kprobe_events - Allow for builtin init functions to be traced by the function tracer (via the kernel command line). Module init function tracing will come in the next release. - Added more selftests, and have selftests also test in an instance" * tag 'trace-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: (60 commits) ring-buffer: Return reader page back into existing ring buffer selftests: ftrace: Allow some event trigger tests to run in an instance selftests: ftrace: Have some basic tests run in a tracing instance too selftests: ftrace: Have event tests also run in an tracing instance selftests: ftrace: Make func_event_triggers and func_traceonoff_triggers tests do instances selftests: ftrace: Allow some tests to be run in a tracing instance tracing/ftrace: Allow for instances to trigger their own stacktrace probes tracing/ftrace: Allow for the traceonoff probe be unique to instances tracing/ftrace: Enable snapshot function trigger to work with instances tracing/ftrace: Allow instances to have their own function probes tracing/ftrace: Add a better way to pass data via the probe functions ftrace: Dynamically create the probe ftrace_ops for the trace_array tracing: Pass the trace_array into ftrace_probe_ops functions tracing: Have the trace_array hold the list of registered func probes ftrace: If the hash for a probe fails to update then free what was initialized ftrace: Have the function probes call their own function ftrace: Have each function probe use its own ftrace_ops ftrace: Have unregister_ftrace_function_probe_func() return a value ftrace: Add helper function ftrace_hash_move_and_update_ops() ftrace: Remove data field from ftrace_func_probe structure ... commit 9c35baf6cee9a5745d55de6f9995916dde642517 Merge: dd23f27 cf39bf5 Author: Linus Torvalds Date: Wed May 3 18:29:28 2017 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk Pull printk updates from Petr Mladek: - There is a situation when early console is not deregistered because the preferred one matches a wrong entry. It caused messages to appear twice. This is the 2nd attempt to fix it. The first one was wrong, see the commit c6c7d83b9c9e ('Revert "console: don't prefer first registered if DT specifies stdout-path"'). The fix is coupled with some small code clean up. Well, the console registration code would deserve a big one. We need to think about it. - Do not lose information about the preemtive context when the console semaphore is re-taken. - Do not block CPU hotplug when someone else is already pushing messages to the console. * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk: printk: fix double printing with earlycon printk: rename selected_console -> preferred_console printk: fix name/type/scope of preferred_console var printk: Correctly handle preemption in console_unlock() printk: use console_trylock() in console_cpu_notify() commit c374ed27c93698c794f99c5d41d9ad3062c4c207 Author: Gavin Shan Date: Wed Apr 19 14:46:24 2017 +1000 powerpc/powernv: Block PCI config access on BCM5718 during EEH recovery Similar to what is done in commit b6541db13952 ("powerpc/eeh: Block PCI config access upon frozen PE"), we need block PCI config access for BCM5719 when recovering frozen error on them. Otherwise, an unexpected recursive fenced PHB error is observed. 0001:06:00.0 Ethernet controller: Broadcom Corporation \ NetXtreme BCM5718 Gigabit Ethernet PCIe (rev 10) 0001:06:00.1 Ethernet controller: Broadcom Corporation \ NetXtreme BCM5718 Gigabit Ethernet PCIe (rev 10) Signed-off-by: Gavin Shan Signed-off-by: Michael Ellerman arch/powerpc/platforms/powernv/eeh-powernv.c | 3 +++ 1 file changed, 3 insertions(+) commit dd23f273d9a765d7f092c1bb0d1cd7aaf668077e Merge: 1684096 b193859 Author: Linus Torvalds Date: Wed May 3 17:55:59 2017 -0700 Merge branch 'akpm' (patches from Andrew) Merge misc updates from Andrew Morton: - a few misc things - most of MM - KASAN updates * emailed patches from Andrew Morton : (102 commits) kasan: separate report parts by empty lines kasan: improve double-free report format kasan: print page description after stacks kasan: improve slab object description kasan: change report header kasan: simplify address description logic kasan: change allocation and freeing stack traces headers kasan: unify report headers kasan: introduce helper functions for determining bug type mm: hwpoison: call shake_page() after try_to_unmap() for mlocked page mm: hwpoison: call shake_page() unconditionally mm/swapfile.c: fix swap space leak in error path of swap_free_entries() mm/gup.c: fix access_ok() argument type mm/truncate: avoid pointless cleancache_invalidate_inode() calls. mm/truncate: bail out early from invalidate_inode_pages2_range() if mapping is empty fs/block_dev: always invalidate cleancache in invalidate_bdev() fs: fix data invalidation in the cleancache during direct IO zram: reduce load operation in page_same_filled zram: use zram_free_page instead of open-coded zram: introduce zram data accessor ... commit d8a6e505d6bba2250852fbc1c1c86fe68aaf9af3 Author: David Disseldorp Date: Thu May 4 00:41:13 2017 +0200 cifs: fix CIFS_IOC_GET_MNT_INFO oops An open directory may have a NULL private_data pointer prior to readdir. Fixes: 0de1f4c6f6c0 ("Add way to query server fs info for smb3") Cc: stable@vger.kernel.org Signed-off-by: David Disseldorp Signed-off-by: Steve French fs/cifs/ioctl.c | 2 ++ 1 file changed, 2 insertions(+) commit b704e70b7cf48f9b67c07d585168e102dfa30bb4 Author: Björn Jacke Date: Wed May 3 23:47:44 2017 +0200 CIFS: fix mapping of SFM_SPACE and SFM_PERIOD - trailing space maps to 0xF028 - trailing period maps to 0xF029 This fix corrects the mapping of file names which have a trailing character that would otherwise be illegal (period or space) but is allowed by POSIX. Signed-off-by: Bjoern Jacke CC: Stable Signed-off-by: Steve French fs/cifs/cifs_unicode.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit b19385993623c1a18a686b6b271cd24d5aa96f52 Author: Andrey Konovalov Date: Wed May 3 14:56:50 2017 -0700 kasan: separate report parts by empty lines Makes the report easier to read. Link: http://lkml.kernel.org/r/20170302134851.101218-10-andreyknvl@google.com Signed-off-by: Andrey Konovalov Acked-by: Dmitry Vyukov Cc: Andrey Ryabinin Cc: Alexander Potapenko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/kasan/report.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 5ab6d91ac998158d04f9563335aa5f1409eda971 Author: Andrey Konovalov Date: Wed May 3 14:56:47 2017 -0700 kasan: improve double-free report format Changes double-free report header from BUG: Double free or freeing an invalid pointer Unexpected shadow byte: 0xFB to BUG: KASAN: double-free or invalid-free in kmalloc_oob_left+0xe5/0xef This makes a bug uniquely identifiable by the first report line. To account for removing of the unexpected shadow value, print shadow bytes at the end of the report as in reports for other kinds of bugs. Link: http://lkml.kernel.org/r/20170302134851.101218-9-andreyknvl@google.com Signed-off-by: Andrey Konovalov Acked-by: Dmitry Vyukov Cc: Andrey Ryabinin Cc: Alexander Potapenko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/kasan/kasan.c | 3 ++- mm/kasan/kasan.h | 2 +- mm/kasan/report.c | 30 ++++++++++++++---------------- 3 files changed, 17 insertions(+), 18 deletions(-) commit 430a05f91d6051705a6ddbe207735ca62e39bb80 Author: Andrey Konovalov Date: Wed May 3 14:56:44 2017 -0700 kasan: print page description after stacks Moves page description after the stacks since it's less important. Link: http://lkml.kernel.org/r/20170302134851.101218-8-andreyknvl@google.com Signed-off-by: Andrey Konovalov Acked-by: Dmitry Vyukov Cc: Andrey Ryabinin Cc: Alexander Potapenko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/kasan/report.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) commit 0c06f1f86c87b1eb93420effe0c0457b30911360 Author: Andrey Konovalov Date: Wed May 3 14:56:41 2017 -0700 kasan: improve slab object description Changes slab object description from: Object at ffff880068388540, in cache kmalloc-128 size: 128 to: The buggy address belongs to the object at ffff880068388540 which belongs to the cache kmalloc-128 of size 128 The buggy address is located 123 bytes inside of 128-byte region [ffff880068388540, ffff8800683885c0) Makes it more explanatory and adds information about relative offset of the accessed address to the start of the object. Link: http://lkml.kernel.org/r/20170302134851.101218-7-andreyknvl@google.com Signed-off-by: Andrey Konovalov Acked-by: Dmitry Vyukov Cc: Andrey Ryabinin Cc: Alexander Potapenko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/kasan/report.c | 53 ++++++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 42 insertions(+), 11 deletions(-) commit 7f0a84c23b1dede3e76a7b2ebbde45a506252005 Author: Andrey Konovalov Date: Wed May 3 14:56:38 2017 -0700 kasan: change report header Change report header format from: BUG: KASAN: use-after-free in unwind_get_return_address+0x28a/0x2c0 at addr ffff880069437950 Read of size 8 by task insmod/3925 to: BUG: KASAN: use-after-free in unwind_get_return_address+0x28a/0x2c0 Read of size 8 at addr ffff880069437950 by task insmod/3925 The exact access address is not usually important, so move it to the second line. This also makes the header look visually balanced. Link: http://lkml.kernel.org/r/20170302134851.101218-6-andreyknvl@google.com Signed-off-by: Andrey Konovalov Acked-by: Dmitry Vyukov Cc: Andrey Ryabinin Cc: Alexander Potapenko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/kasan/report.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit db429f16e0b472292000fd53b63ebd7221a9856e Author: Andrey Konovalov Date: Wed May 3 14:56:34 2017 -0700 kasan: simplify address description logic Simplify logic for describing a memory address. Add addr_to_page() helper function. Makes the code easier to follow. Link: http://lkml.kernel.org/r/20170302134851.101218-5-andreyknvl@google.com Signed-off-by: Andrey Konovalov Acked-by: Dmitry Vyukov Cc: Andrey Ryabinin Cc: Alexander Potapenko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/kasan/report.c | 37 +++++++++++++++++++++---------------- 1 file changed, 21 insertions(+), 16 deletions(-) commit b6b72f4919c121bee5890732e0b8de2ab99c8dbc Author: Andrey Konovalov Date: Wed May 3 14:56:31 2017 -0700 kasan: change allocation and freeing stack traces headers Change stack traces headers from: Allocated: PID = 42 to: Allocated by task 42: Makes the report one line shorter and look better. Link: http://lkml.kernel.org/r/20170302134851.101218-4-andreyknvl@google.com Signed-off-by: Andrey Konovalov Acked-by: Dmitry Vyukov Cc: Andrey Ryabinin Cc: Alexander Potapenko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/kasan/report.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) commit 7d418f7b0d3407b93ec70f3b380cc5beafa1fa68 Author: Andrey Konovalov Date: Wed May 3 14:56:28 2017 -0700 kasan: unify report headers Unify KASAN report header format for different kinds of bad memory accesses. Makes the code simpler. Link: http://lkml.kernel.org/r/20170302134851.101218-3-andreyknvl@google.com Signed-off-by: Andrey Konovalov Acked-by: Dmitry Vyukov Cc: Andrey Ryabinin Cc: Alexander Potapenko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/kasan/report.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) commit 5e82cd120382ad7bbcc82298e34a034538b4384c Author: Andrey Konovalov Date: Wed May 3 14:56:25 2017 -0700 kasan: introduce helper functions for determining bug type Patch series "kasan: improve error reports", v2. This patchset improves KASAN reports by making them easier to read and a little more detailed. Also improves mm/kasan/report.c readability. Effectively changes a use-after-free report to: ================================================================== BUG: KASAN: use-after-free in kmalloc_uaf+0xaa/0xb6 [test_kasan] Write of size 1 at addr ffff88006aa59da8 by task insmod/3951 CPU: 1 PID: 3951 Comm: insmod Tainted: G B 4.10.0+ #84 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: dump_stack+0x292/0x398 print_address_description+0x73/0x280 kasan_report.part.2+0x207/0x2f0 __asan_report_store1_noabort+0x2c/0x30 kmalloc_uaf+0xaa/0xb6 [test_kasan] kmalloc_tests_init+0x4f/0xa48 [test_kasan] do_one_initcall+0xf3/0x390 do_init_module+0x215/0x5d0 load_module+0x54de/0x82b0 SYSC_init_module+0x3be/0x430 SyS_init_module+0x9/0x10 entry_SYSCALL_64_fastpath+0x1f/0xc2 RIP: 0033:0x7f22cfd0b9da RSP: 002b:00007ffe69118a78 EFLAGS: 00000206 ORIG_RAX: 00000000000000af RAX: ffffffffffffffda RBX: 0000555671242090 RCX: 00007f22cfd0b9da RDX: 00007f22cffcaf88 RSI: 000000000004df7e RDI: 00007f22d0399000 RBP: 00007f22cffcaf88 R08: 0000000000000003 R09: 0000000000000000 R10: 00007f22cfd07d0a R11: 0000000000000206 R12: 0000555671243190 R13: 000000000001fe81 R14: 0000000000000000 R15: 0000000000000004 Allocated by task 3951: save_stack_trace+0x16/0x20 save_stack+0x43/0xd0 kasan_kmalloc+0xad/0xe0 kmem_cache_alloc_trace+0x82/0x270 kmalloc_uaf+0x56/0xb6 [test_kasan] kmalloc_tests_init+0x4f/0xa48 [test_kasan] do_one_initcall+0xf3/0x390 do_init_module+0x215/0x5d0 load_module+0x54de/0x82b0 SYSC_init_module+0x3be/0x430 SyS_init_module+0x9/0x10 entry_SYSCALL_64_fastpath+0x1f/0xc2 Freed by task 3951: save_stack_trace+0x16/0x20 save_stack+0x43/0xd0 kasan_slab_free+0x72/0xc0 kfree+0xe8/0x2b0 kmalloc_uaf+0x85/0xb6 [test_kasan] kmalloc_tests_init+0x4f/0xa48 [test_kasan] do_one_initcall+0xf3/0x390 do_init_module+0x215/0x5d0 load_module+0x54de/0x82b0 SYSC_init_module+0x3be/0x430 SyS_init_module+0x9/0x10 entry_SYSCALL_64_fastpath+0x1f/0xc The buggy address belongs to the object at ffff88006aa59da0 which belongs to the cache kmalloc-16 of size 16 The buggy address is located 8 bytes inside of 16-byte region [ffff88006aa59da0, ffff88006aa59db0) The buggy address belongs to the page: page:ffffea0001aa9640 count:1 mapcount:0 mapping: (null) index:0x0 flags: 0x100000000000100(slab) raw: 0100000000000100 0000000000000000 0000000000000000 0000000180800080 raw: ffffea0001abe380 0000000700000007 ffff88006c401b40 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88006aa59c80: 00 00 fc fc 00 00 fc fc 00 00 fc fc 00 00 fc fc ffff88006aa59d00: 00 00 fc fc 00 00 fc fc 00 00 fc fc 00 00 fc fc >ffff88006aa59d80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc ^ ffff88006aa59e00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc ffff88006aa59e80: fb fb fc fc 00 00 fc fc 00 00 fc fc 00 00 fc fc ================================================================== from: ================================================================== BUG: KASAN: use-after-free in kmalloc_uaf+0xaa/0xb6 [test_kasan] at addr ffff88006c4dcb28 Write of size 1 by task insmod/3984 CPU: 1 PID: 3984 Comm: insmod Tainted: G B 4.10.0+ #83 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: dump_stack+0x292/0x398 kasan_object_err+0x1c/0x70 kasan_report.part.1+0x20e/0x4e0 __asan_report_store1_noabort+0x2c/0x30 kmalloc_uaf+0xaa/0xb6 [test_kasan] kmalloc_tests_init+0x4f/0xa48 [test_kasan] do_one_initcall+0xf3/0x390 do_init_module+0x215/0x5d0 load_module+0x54de/0x82b0 SYSC_init_module+0x3be/0x430 SyS_init_module+0x9/0x10 entry_SYSCALL_64_fastpath+0x1f/0xc2 RIP: 0033:0x7feca0f779da RSP: 002b:00007ffdfeae5218 EFLAGS: 00000206 ORIG_RAX: 00000000000000af RAX: ffffffffffffffda RBX: 000055a064c13090 RCX: 00007feca0f779da RDX: 00007feca1236f88 RSI: 000000000004df7e RDI: 00007feca1605000 RBP: 00007feca1236f88 R08: 0000000000000003 R09: 0000000000000000 R10: 00007feca0f73d0a R11: 0000000000000206 R12: 000055a064c14190 R13: 000000000001fe81 R14: 0000000000000000 R15: 0000000000000004 Object at ffff88006c4dcb20, in cache kmalloc-16 size: 16 Allocated: PID = 3984 save_stack_trace+0x16/0x20 save_stack+0x43/0xd0 kasan_kmalloc+0xad/0xe0 kmem_cache_alloc_trace+0x82/0x270 kmalloc_uaf+0x56/0xb6 [test_kasan] kmalloc_tests_init+0x4f/0xa48 [test_kasan] do_one_initcall+0xf3/0x390 do_init_module+0x215/0x5d0 load_module+0x54de/0x82b0 SYSC_init_module+0x3be/0x430 SyS_init_module+0x9/0x10 entry_SYSCALL_64_fastpath+0x1f/0xc2 Freed: PID = 3984 save_stack_trace+0x16/0x20 save_stack+0x43/0xd0 kasan_slab_free+0x73/0xc0 kfree+0xe8/0x2b0 kmalloc_uaf+0x85/0xb6 [test_kasan] kmalloc_tests_init+0x4f/0xa48 [test_kasan] do_one_initcall+0xf3/0x390 do_init_module+0x215/0x5d0 load_module+0x54de/0x82b0 SYSC_init_module+0x3be/0x430 SyS_init_module+0x9/0x10 entry_SYSCALL_64_fastpath+0x1f/0xc2 Memory state around the buggy address: ffff88006c4dca00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc ffff88006c4dca80: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc >ffff88006c4dcb00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc ^ ffff88006c4dcb80: fb fb fc fc 00 00 fc fc fb fb fc fc fb fb fc fc ffff88006c4dcc00: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc ================================================================== This patch (of 9): Introduce get_shadow_bug_type() function, which determines bug type based on the shadow value for a particular kernel address. Introduce get_wild_bug_type() function, which determines bug type for addresses which don't have a corresponding shadow value. Link: http://lkml.kernel.org/r/20170302134851.101218-2-andreyknvl@google.com Signed-off-by: Andrey Konovalov Acked-by: Dmitry Vyukov Cc: Andrey Ryabinin Cc: Alexander Potapenko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/kasan/report.c | 40 ++++++++++++++++++++++++++++++---------- 1 file changed, 30 insertions(+), 10 deletions(-) commit 286c469a988fbaf68e3a97ddf1e6c245c1446968 Author: Naoya Horiguchi Date: Wed May 3 14:56:22 2017 -0700 mm: hwpoison: call shake_page() after try_to_unmap() for mlocked page Memory error handler calls try_to_unmap() for error pages in various states. If the error page is a mlocked page, error handling could fail with "still referenced by 1 users" message. This is because the page is linked to and stays in lru cache after the following call chain. try_to_unmap_one page_remove_rmap clear_page_mlock putback_lru_page lru_cache_add memory_failure() calls shake_page() to hanlde the similar issue, but current code doesn't cover because shake_page() is called only before try_to_unmap(). So this patches adds shake_page(). Fixes: 23a003bfd23ea9ea0b7756b920e51f64b284b468 ("mm/madvise: pass return code of memory_failure() to userspace") Link: http://lkml.kernel.org/r/20170417055948.GM31394@yexl-desktop Link: http://lkml.kernel.org/r/1493197841-23986-3-git-send-email-n-horiguchi@ah.jp.nec.com Signed-off-by: Naoya Horiguchi Reported-by: kernel test robot Cc: Xiaolong Ye Cc: Chen Gong Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/memory-failure.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 8bcb74de764aaa261d6af3ce5ac723e435f00ff4 Author: Naoya Horiguchi Date: Wed May 3 14:56:19 2017 -0700 mm: hwpoison: call shake_page() unconditionally shake_page() is called before going into core error handling code in order to ensure that the error page is flushed from lru_cache lists where pages stay during transferring among LRU lists. But currently it's not fully functional because when the page is linked to lru_cache by calling activate_page(), its PageLRU flag is set and shake_page() is skipped. The result is to fail error handling with "still referenced by 1 users" message. When the page is linked to lru_cache by isolate_lru_page(), its PageLRU is clear, so that's fine. This patch makes shake_page() unconditionally called to avoild the failure. Fixes: 23a003bfd23ea9ea0b7756b920e51f64b284b468 ("mm/madvise: pass return code of memory_failure() to userspace") Link: http://lkml.kernel.org/r/20170417055948.GM31394@yexl-desktop Link: http://lkml.kernel.org/r/1493197841-23986-2-git-send-email-n-horiguchi@ah.jp.nec.com Signed-off-by: Naoya Horiguchi Reported-by: kernel test robot Cc: Xiaolong Ye Cc: Chen Gong Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/hwpoison-inject.c | 3 +-- mm/memory-failure.c | 27 +++++++++++---------------- 2 files changed, 12 insertions(+), 18 deletions(-) commit 0ccfece6ed507738c0e7e4414c3688b78d4e3756 Author: Huang Ying Date: Wed May 3 14:56:16 2017 -0700 mm/swapfile.c: fix swap space leak in error path of swap_free_entries() In swapcache_free_entries(), if swap_info_get_cont() returns NULL, something wrong occurs for the swap entry. But we should still continue to free the following swap entries in the array instead of skip them to avoid swap space leak. This is just problem in error path, where system may be in an inconsistent state, but it is still good to fix it. Link: http://lkml.kernel.org/r/20170421124739.24534-1-ying.huang@intel.com Signed-off-by: "Huang, Ying" Acked-by: Tim Chen Cc: Rik van Riel Cc: Hugh Dickins Cc: Shaohua Li Cc: Minchan Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/swapfile.c | 2 -- 1 file changed, 2 deletions(-) commit aa2369f11ff77317b9af388ae3527f1b85981e0d Author: Arnd Bergmann Date: Wed May 3 14:56:12 2017 -0700 mm/gup.c: fix access_ok() argument type MIPS just got changed to only accept a pointer argument for access_ok(), causing one warning in drivers/scsi/pmcraid.c. I tried changing x86 the same way and found the same warning in __get_user_pages_fast() and nowhere else in the kernel during randconfig testing: mm/gup.c: In function '__get_user_pages_fast': mm/gup.c:1578:6: error: passing argument 1 of '__chk_range_not_ok' makes pointer from integer without a cast [-Werror=int-conversion] It would probably be a good idea to enforce type-safety in general, so let's change this file to not cause a warning if we do that. I don't know why the warning did not appear on MIPS. Fixes: 2667f50e8b81 ("mm: introduce a general RCU get_user_pages_fast()") Link: http://lkml.kernel.org/r/20170421162659.3314521-1-arnd@arndb.de Signed-off-by: Arnd Bergmann Cc: Alexander Viro Acked-by: Ingo Molnar Cc: Michal Hocko Cc: "Kirill A. Shutemov" Cc: Lorenzo Stoakes Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/gup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 34ccb69ea27ab25efc31a67c227ac85f93e0dc81 Author: Andrey Ryabinin Date: Wed May 3 14:56:09 2017 -0700 mm/truncate: avoid pointless cleancache_invalidate_inode() calls. cleancache_invalidate_inode() called truncate_inode_pages_range() and invalidate_inode_pages2_range() twice - on entry and on exit. It's stupid and waste of time. It's enough to call it once at exit. Link: http://lkml.kernel.org/r/20170424164135.22350-5-aryabinin@virtuozzo.com Signed-off-by: Andrey Ryabinin Reviewed-by: Jan Kara Acked-by: Konrad Rzeszutek Wilk Cc: Alexander Viro Cc: Ross Zwisler Cc: Jens Axboe Cc: Johannes Weiner Cc: Alexey Kuznetsov Cc: Christoph Hellwig Cc: Nikolay Borisov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/truncate.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) commit 32691f0fbe41a52eee811496205dc4828991b399 Author: Andrey Ryabinin Date: Wed May 3 14:56:06 2017 -0700 mm/truncate: bail out early from invalidate_inode_pages2_range() if mapping is empty If mapping is empty (both ->nrpages and ->nrexceptional is zero) we can avoid pointless lookups in empty radix tree and bail out immediately after cleancache invalidation. Link: http://lkml.kernel.org/r/20170424164135.22350-4-aryabinin@virtuozzo.com Signed-off-by: Andrey Ryabinin Reviewed-by: Jan Kara Acked-by: Konrad Rzeszutek Wilk Cc: Alexander Viro Cc: Ross Zwisler Cc: Jens Axboe Cc: Johannes Weiner Cc: Alexey Kuznetsov Cc: Christoph Hellwig Cc: Nikolay Borisov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/truncate.c | 3 +++ 1 file changed, 3 insertions(+) commit a5f6a6a9c72eac38a7fadd1a038532bc8516337c Author: Andrey Ryabinin Date: Wed May 3 14:56:02 2017 -0700 fs/block_dev: always invalidate cleancache in invalidate_bdev() invalidate_bdev() calls cleancache_invalidate_inode() iff ->nrpages != 0 which doen't make any sense. Make sure that invalidate_bdev() always calls cleancache_invalidate_inode() regardless of mapping->nrpages value. Fixes: c515e1fd361c ("mm/fs: add hooks to support cleancache") Link: http://lkml.kernel.org/r/20170424164135.22350-3-aryabinin@virtuozzo.com Signed-off-by: Andrey Ryabinin Reviewed-by: Jan Kara Acked-by: Konrad Rzeszutek Wilk Cc: Alexander Viro Cc: Ross Zwisler Cc: Jens Axboe Cc: Johannes Weiner Cc: Alexey Kuznetsov Cc: Christoph Hellwig Cc: Nikolay Borisov Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/block_dev.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) commit 55635ba76ef91f26b418702ace5e6287eb727f6a Author: Andrey Ryabinin Date: Wed May 3 14:55:59 2017 -0700 fs: fix data invalidation in the cleancache during direct IO Patch series "Properly invalidate data in the cleancache", v2. We've noticed that after direct IO write, buffered read sometimes gets stale data which is coming from the cleancache. The reason for this is that some direct write hooks call call invalidate_inode_pages2[_range]() conditionally iff mapping->nrpages is not zero, so we may not invalidate data in the cleancache. Another odd thing is that we check only for ->nrpages and don't check for ->nrexceptional, but invalidate_inode_pages2[_range] also invalidates exceptional entries as well. So we invalidate exceptional entries only if ->nrpages != 0? This doesn't feel right. - Patch 1 fixes direct IO writes by removing ->nrpages check. - Patch 2 fixes similar case in invalidate_bdev(). Note: I only fixed conditional cleancache_invalidate_inode() here. Do we also need to add ->nrexceptional check in into invalidate_bdev()? - Patches 3-4: some optimizations. This patch (of 4): Some direct IO write fs hooks call invalidate_inode_pages2[_range]() conditionally iff mapping->nrpages is not zero. This can't be right, because invalidate_inode_pages2[_range]() also invalidate data in the cleancache via cleancache_invalidate_inode() call. So if page cache is empty but there is some data in the cleancache, buffered read after direct IO write would get stale data from the cleancache. Also it doesn't feel right to check only for ->nrpages because invalidate_inode_pages2[_range] invalidates exceptional entries as well. Fix this by calling invalidate_inode_pages2[_range]() regardless of nrpages state. Note: nfs,cifs,9p doesn't need similar fix because the never call cleancache_get_page() (nor directly, nor via mpage_readpage[s]()), so they are not affected by this bug. Fixes: c515e1fd361c ("mm/fs: add hooks to support cleancache") Link: http://lkml.kernel.org/r/20170424164135.22350-2-aryabinin@virtuozzo.com Signed-off-by: Andrey Ryabinin Reviewed-by: Jan Kara Acked-by: Konrad Rzeszutek Wilk Cc: Alexander Viro Cc: Ross Zwisler Cc: Jens Axboe Cc: Johannes Weiner Cc: Alexey Kuznetsov Cc: Christoph Hellwig Cc: Nikolay Borisov Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/iomap.c | 18 ++++++++---------- mm/filemap.c | 26 +++++++++++--------------- 2 files changed, 19 insertions(+), 25 deletions(-) commit f0fe9984656604ea8effd5ff82709ff8ce1f954b Author: Sangwoo Park Date: Wed May 3 14:55:56 2017 -0700 zram: reduce load operation in page_same_filled In page_same_filled function, all elements in the page is compared with next index value. The current comparison routine compares the (i)th and (i+1)th values of the page. In this case, two load operaions occur for each comparison. But if we store first value of the page stores at 'val' variable and using it to compare with others, the load opearation is reduced. It reduce load operation per page by up to 64times. Link: http://lkml.kernel.org/r/1488428104-7257-1-git-send-email-sangwoo2.park@lge.com Signed-off-by: Sangwoo Park Reviewed-by: Sergey Senozhatsky Acked-by: Minchan Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/block/zram/zram_drv.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit 302128dce142d780417aa548bfd7ef4dfb89fa80 Author: Minchan Kim Date: Wed May 3 14:55:53 2017 -0700 zram: use zram_free_page instead of open-coded The zram_free_page already handles NULL handle case and same page so use it to reduce error probability. (Acutaully, I made a mistake when I handled same page feature) Link: http://lkml.kernel.org/r/1492052365-16169-7-git-send-email-minchan@kernel.org Signed-off-by: Minchan Kim Cc: Hannes Reinecke Cc: Johannes Thumshirn Cc: Sergey Senozhatsky Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/block/zram/zram_drv.c | 17 +++-------------- 1 file changed, 3 insertions(+), 14 deletions(-) commit 643ae61d0f41c48aa7179921fe15ba4b4d8ddfec Author: Minchan Kim Date: Wed May 3 14:55:50 2017 -0700 zram: introduce zram data accessor With element, sometime I got confused handle and element access. It might be my bad but I think it's time to introduce accessor to prevent future idiot like me. This patch is just clean-up patch so it shouldn't change any behavior. Link: http://lkml.kernel.org/r/1492052365-16169-6-git-send-email-minchan@kernel.org Signed-off-by: Minchan Kim Reviewed-by: Sergey Senozhatsky Cc: Hannes Reinecke Cc: Johannes Thumshirn Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/block/zram/zram_drv.c | 33 ++++++++++++++++++++++----------- 1 file changed, 22 insertions(+), 11 deletions(-) commit beb6602cf87abee547b2692031185111f625153a Author: Minchan Kim Date: Wed May 3 14:55:47 2017 -0700 zram: remove zram_meta structure It's redundant now. Instead, remove it and use zram structure directly. Link: http://lkml.kernel.org/r/1492052365-16169-5-git-send-email-minchan@kernel.org Signed-off-by: Minchan Kim Cc: Hannes Reinecke Cc: Johannes Thumshirn Cc: Sergey Senozhatsky Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/block/zram/zram_drv.c | 189 +++++++++++++++++------------------------- drivers/block/zram/zram_drv.h | 6 +- 2 files changed, 78 insertions(+), 117 deletions(-) commit 86c49814d449ebc51c7d455ac8e3d17b9fa702eb Author: Minchan Kim Date: Wed May 3 14:55:44 2017 -0700 zram: use zram_slot_lock instead of raw bit_spin_lock op With this clean-up phase, I want to use zram's wrapper function to lock table access which is more consistent with other zram's functions. Link: http://lkml.kernel.org/r/1492052365-16169-4-git-send-email-minchan@kernel.org Signed-off-by: Minchan Kim Reviewed-by: Sergey Senozhatsky Cc: Hannes Reinecke Cc: Johannes Thumshirn Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/block/zram/zram_drv.c | 41 +++++++++++++++++++++++++++-------------- 1 file changed, 27 insertions(+), 14 deletions(-) commit 1f7319c7427503abe2d365683588827b80f5714e Author: Minchan Kim Date: Wed May 3 14:55:41 2017 -0700 zram: partial IO refactoring For architecture(PAGE_SIZE > 4K), zram have supported partial IO. However, the mixed code for handling normal/partial IO is too mess, error-prone to modify IO handler functions with upcoming feature so this patch aims for cleaning up zram's IO handling functions. Link: http://lkml.kernel.org/r/1492052365-16169-3-git-send-email-minchan@kernel.org Signed-off-by: Minchan Kim Cc: Hannes Reinecke Cc: Johannes Thumshirn Cc: Sergey Senozhatsky Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/block/zram/zram_drv.c | 337 +++++++++++++++++++++++------------------- 1 file changed, 184 insertions(+), 153 deletions(-) commit e86942c7b6c1e1dd5e539f3bf3cfb63799163048 Author: Minchan Kim Date: Wed May 3 14:55:38 2017 -0700 zram: handle multiple pages attached bio's bvec Patch series "zram clean up", v2. This patchset aims to clean up zram . [1] clean up multiple pages's bvec handling. [2] clean up partial IO handling [3-6] clean up zram via using accessor and removing pointless structure. With [2-6] applied, we can get a few hundred bytes as well as huge readibility enhance. x86: 708 byte save add/remove: 1/1 grow/shrink: 0/11 up/down: 478/-1186 (-708) function old new delta zram_special_page_read - 478 +478 zram_reset_device 317 314 -3 mem_used_max_store 131 128 -3 compact_store 96 93 -3 mm_stat_show 203 197 -6 zram_add 719 712 -7 zram_slot_free_notify 229 214 -15 zram_make_request 819 803 -16 zram_meta_free 128 111 -17 zram_free_page 180 151 -29 disksize_store 432 361 -71 zram_decompress_page.isra 504 - -504 zram_bvec_rw 2592 2080 -512 Total: Before=25350773, After=25350065, chg -0.00% ppc64: 231 byte save add/remove: 2/0 grow/shrink: 1/9 up/down: 681/-912 (-231) function old new delta zram_special_page_read - 480 +480 zram_slot_lock - 200 +200 vermagic 39 40 +1 mm_stat_show 256 248 -8 zram_meta_free 200 184 -16 zram_add 944 912 -32 zram_free_page 348 308 -40 disksize_store 572 492 -80 zram_decompress_page 664 564 -100 zram_slot_free_notify 292 160 -132 zram_make_request 1132 1000 -132 zram_bvec_rw 2768 2396 -372 Total: Before=17565825, After=17565594, chg -0.00% This patch (of 6): Johannes Thumshirn reported system goes the panic when using NVMe over Fabrics loopback target with zram. The reason is zram expects each bvec in bio contains a single page but nvme can attach a huge bulk of pages attached to the bio's bvec so that zram's index arithmetic could be wrong so that out-of-bound access makes system panic. [1] in mainline solved solved the problem by limiting max_sectors with SECTORS_PER_PAGE but it makes zram slow because bio should split with each pages so this patch makes zram aware of multiple pages in a bvec so it could solve without any regression(ie, bio split). [1] 0bc315381fe9, zram: set physical queue limits to avoid array out of bounds accesses Link: http://lkml.kernel.org/r/20170413134057.GA27499@bbox Signed-off-by: Minchan Kim Reported-by: Johannes Thumshirn Tested-by: Johannes Thumshirn Reviewed-by: Johannes Thumshirn Reviewed-by: Sergey Senozhatsky Cc: Hannes Reinecke Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/block/zram/zram_drv.c | 40 +++++++++++----------------------------- 1 file changed, 11 insertions(+), 29 deletions(-) commit 0f7896f12b6a3dae3ffccbebe8c954d954350f3d Author: Tetsuo Handa Date: Wed May 3 14:55:34 2017 -0700 mm, page_alloc: remove debug_guardpage_minorder() test in warn_alloc() Commit c0a32fc5a2e4 ("mm: more intensive memory corruption debugging") changed to check debug_guardpage_minorder() > 0 when reporting allocation failures. The reasoning was When we use guard page to debug memory corruption, it shrinks available pages to 1/2, 1/4, 1/8 and so on, depending on parameter value. In such case memory allocation failures can be common and printing errors can flood dmesg. If somebody debug corruption, allocation failures are not the things he/she is interested about. but this is misguided. Allocation requests with __GFP_NOWARN flag by definition do not cause flooding of allocation failure messages. Allocation requests with __GFP_NORETRY flag likely also have __GFP_NOWARN flag. Costly allocation requests likely also have __GFP_NOWARN flag. Allocation requests without __GFP_DIRECT_RECLAIM flag likely also have __GFP_NOWARN flag or __GFP_HIGH flag. Non-costly allocation requests with __GFP_DIRECT_RECLAIM flag basically retry forever due to the "too small to fail" memory-allocation rule. Therefore, as a whole, shrinking available pages by debug_guardpage_minorder= kernel boot parameter might cause flooding of OOM killer messages but unlikely causes flooding of allocation failure messages. Let's remove debug_guardpage_minorder() > 0 check which would likely be pointless. Link: http://lkml.kernel.org/r/1491910035-4231-1-git-send-email-penguin-kernel@I-love.SAKURA.ne.jp Signed-off-by: Tetsuo Handa Acked-by: Michal Hocko Cc: Stanislaw Gruszka Cc: Mel Gorman Cc: Andrea Arcangeli Cc: "Rafael J . Wysocki" Cc: Christoph Lameter Cc: Pekka Enberg Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/page_alloc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 82a2481e8e2832a19869a7e826e2e7b44420493e Author: Anshuman Khandual Date: Wed May 3 14:55:31 2017 -0700 mm/memory-failure.c: add page flag description in error paths It helps to provide page flag description along with the raw value in error paths during soft offline process. From sample experiments Before the patch: soft offline: 0x6100: migration failed 1, type 3ffff800008018 soft offline: 0x7400: migration failed 1, type 3ffff800008018 After the patch: soft offline: 0x5900: migration failed 1, type 3ffff800008018 (uptodate|dirty|head) soft offline: 0x6c00: migration failed 1, type 3ffff800008018 (uptodate|dirty|head) Link: http://lkml.kernel.org/r/20170409023829.10788-1-khandual@linux.vnet.ibm.com Signed-off-by: Anshuman Khandual Acked-by: Naoya Horiguchi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/memory-failure.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) commit 5e451be75ca51dd45a77a6409a30a0de39dc15c8 Author: Anshuman Khandual Date: Wed May 3 14:55:28 2017 -0700 mm/madvise: move up the behavior parameter validation madvise_behavior_valid() should be called before acting upon the behavior parameter. Hence move up the function. This also includes MADV_SOFT_OFFLINE and MADV_HWPOISON options as valid behavior parameter for the system call madvise(). Link: http://lkml.kernel.org/r/20170418052844.24891-1-khandual@linux.vnet.ibm.com Signed-off-by: Anshuman Khandual Acked-by: David Rientjes Acked-by: Naoya Horiguchi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/madvise.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) commit 97167a7681e9a587ee75955bcbbf27e90f0883b9 Author: Anshuman Khandual Date: Wed May 3 14:55:25 2017 -0700 mm/madvise.c: clean up MADV_SOFT_OFFLINE and MADV_HWPOISON This cleans up handling MADV_SOFT_OFFLINE and MADV_HWPOISON called through madvise() system call. * madvise_memory_failure() was misleading to accommodate handling of both memory_failure() as well as soft_offline_page() functions. Basically it handles memory error injection from user space which can go either way as memory failure or soft offline. Renamed as madvise_inject_error() instead. * Renamed struct page pointer 'p' to 'page'. * pr_info() was essentially printing PFN value but it said 'page' which was misleading. Made the process virtual address explicit. Before the patch: Soft offlining page 0x15e3e at 0x3fff8c230000 Soft offlining page 0x1f3 at 0x3fffa0da0000 Soft offlining page 0x744 at 0x3fff7d200000 Soft offlining page 0x1634d at 0x3fff95e20000 Soft offlining page 0x16349 at 0x3fff95e30000 Soft offlining page 0x1d6 at 0x3fff9e8b0000 Soft offlining page 0x5f3 at 0x3fff91bd0000 Injecting memory failure for page 0x15c8b at 0x3fff83280000 Injecting memory failure for page 0x16190 at 0x3fff83290000 Injecting memory failure for page 0x740 at 0x3fff9a2e0000 Injecting memory failure for page 0x741 at 0x3fff9a2f0000 After the patch: Soft offlining pfn 0x1484e at process virtual address 0x3fff883c0000 Soft offlining pfn 0x1484f at process virtual address 0x3fff883d0000 Soft offlining pfn 0x14850 at process virtual address 0x3fff883e0000 Soft offlining pfn 0x14851 at process virtual address 0x3fff883f0000 Soft offlining pfn 0x14852 at process virtual address 0x3fff88400000 Soft offlining pfn 0x14853 at process virtual address 0x3fff88410000 Soft offlining pfn 0x14854 at process virtual address 0x3fff88420000 Soft offlining pfn 0x1521c at process virtual address 0x3fff6bc70000 Injecting memory failure for pfn 0x10fcf at process virtual address 0x3fff86310000 Injecting memory failure for pfn 0x10fd0 at process virtual address 0x3fff86320000 Injecting memory failure for pfn 0x10fd1 at process virtual address 0x3fff86330000 Injecting memory failure for pfn 0x10fd2 at process virtual address 0x3fff86340000 Injecting memory failure for pfn 0x10fd3 at process virtual address 0x3fff86350000 Injecting memory failure for pfn 0x10fd4 at process virtual address 0x3fff86360000 Injecting memory failure for pfn 0x10fd5 at process virtual address 0x3fff86370000 Link: http://lkml.kernel.org/r/20170410084701.11248-1-khandual@linux.vnet.ibm.com Signed-off-by: Anshuman Khandual Reviewed-by: Naoya Horiguchi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/madvise.c | 34 ++++++++++++++++++++-------------- 1 file changed, 20 insertions(+), 14 deletions(-) commit 70bc0dc578b3f3aafefc4f5e874bdd378680acca Author: Mike Kravetz Date: Wed May 3 14:55:22 2017 -0700 Documentation: vm, add hugetlbfs reservation overview Adding a brief overview of hugetlbfs reservation design and implementation as an aid to those making code modifications in this area. Link: http://lkml.kernel.org/r/1491586995-13085-1-git-send-email-mike.kravetz@oracle.com Signed-off-by: Mike Kravetz Acked-by: Hillf Danton Cc: Jonathan Corbet Cc: Michal Hocko Cc: Randy Dunlap Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Documentation/vm/00-INDEX | 2 + Documentation/vm/hugetlbfs_reserv.txt | 529 ++++++++++++++++++++++++++++++++++ 2 files changed, 531 insertions(+) commit df6b7499806bffd233e6dd0465901827b0b385b8 Author: Huang Ying Date: Wed May 3 14:55:19 2017 -0700 mm, swap: remove unused function prototype This is a code cleanup patch, no functionality changes. There are 2 unused function prototype in swap.h, they are removed. Link: http://lkml.kernel.org/r/20170405071017.23677-1-ying.huang@intel.com Signed-off-by: "Huang, Ying" Cc: Tim Chen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/swap.h | 3 --- 1 file changed, 3 deletions(-) commit ccda7f4360be86b87497c50d1f58aab3fd85a9a5 Author: Johannes Weiner Date: Wed May 3 14:55:16 2017 -0700 mm: memcontrol: use node page state naming scheme for memcg The memory controllers stat function names are awkwardly long and arbitrarily different from the zone and node stat functions. The current interface is named: mem_cgroup_read_stat() mem_cgroup_update_stat() mem_cgroup_inc_stat() mem_cgroup_dec_stat() mem_cgroup_update_page_stat() mem_cgroup_inc_page_stat() mem_cgroup_dec_page_stat() This patch renames it to match the corresponding node stat functions: memcg_page_state() [node_page_state()] mod_memcg_state() [mod_node_state()] inc_memcg_state() [inc_node_state()] dec_memcg_state() [dec_node_state()] mod_memcg_page_state() [mod_node_page_state()] inc_memcg_page_state() [inc_node_page_state()] dec_memcg_page_state() [dec_node_page_state()] Link: http://lkml.kernel.org/r/20170404220148.28338-4-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Vladimir Davydov Acked-by: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/memcontrol.h | 73 +++++++++++++++++++++++----------------------- mm/memcontrol.c | 38 ++++++++++++------------ mm/page-writeback.c | 10 +++---- mm/rmap.c | 4 +-- mm/vmscan.c | 5 ++-- mm/workingset.c | 6 ++-- 6 files changed, 68 insertions(+), 68 deletions(-) commit 71cd31135d4cf030a057ed7079a75a40c0a4a796 Author: Johannes Weiner Date: Wed May 3 14:55:13 2017 -0700 mm: memcontrol: re-use node VM page state enum The current duplication is a high-maintenance mess, and it's painful to add new items or query memcg state from the rest of the VM. This increases the size of the stat array marginally, but we should aim to track all these stats on a per-cgroup level anyway. Link: http://lkml.kernel.org/r/20170404220148.28338-3-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Vladimir Davydov Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/memcontrol.h | 100 +++++++++++++++------------------ mm/memcontrol.c | 135 +++++++++++++++++++++++---------------------- mm/page-writeback.c | 10 ++-- mm/rmap.c | 4 +- mm/vmscan.c | 5 +- mm/workingset.c | 7 +-- 6 files changed, 123 insertions(+), 138 deletions(-) commit df0e53d0619e83b465e363c088bf4eeb2848273b Author: Johannes Weiner Date: Wed May 3 14:55:10 2017 -0700 mm: memcontrol: re-use global VM event enum The current duplication is a high-maintenance mess, and it's painful to add new items. This increases the size of the event array, but we'll eventually want most of the VM events tracked on a per-cgroup basis anyway. Link: http://lkml.kernel.org/r/20170404220148.28338-2-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Vladimir Davydov Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/memcontrol.h | 45 ++++++++++++--------------------------- mm/memcontrol.c | 53 ++++++++++++++++++++++++---------------------- 2 files changed, 42 insertions(+), 56 deletions(-) commit 31176c781508e4e35b1cc4ae2f0a5abd1f4ea689 Author: Johannes Weiner Date: Wed May 3 14:55:07 2017 -0700 mm: memcontrol: clean up memory.events counting function We only ever count single events, drop the @nr parameter. Rename the function accordingly. Remove low-information kerneldoc. Link: http://lkml.kernel.org/r/20170404220148.28338-1-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Vladimir Davydov Acked-by: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/memcontrol.h | 18 +++++------------- mm/memcontrol.c | 8 ++++---- mm/vmscan.c | 2 +- 3 files changed, 10 insertions(+), 18 deletions(-) commit 2a2e48854d704214dac7546e87ae0e4daa0e61a0 Author: Johannes Weiner Date: Wed May 3 14:55:03 2017 -0700 mm: vmscan: fix IO/refault regression in cache workingset transition Since commit 59dc76b0d4df ("mm: vmscan: reduce size of inactive file list") we noticed bigger IO spikes during changes in cache access patterns. The patch in question shrunk the inactive list size to leave more room for the current workingset in the presence of streaming IO. However, workingset transitions that previously happened on the inactive list are now pushed out of memory and incur more refaults to complete. This patch disables active list protection when refaults are being observed. This accelerates workingset transitions, and allows more of the new set to establish itself from memory, without eating into the ability to protect the established workingset during stable periods. The workloads that were measurably affected for us were hit pretty bad by it, with refault/majfault rates doubling and tripling during cache transitions, and the machines sustaining half-hour periods of 100% IO utilization, where they'd previously have sub-minute peaks at 60-90%. Stateful services that handle user data tend to be more conservative with kernel upgrades. As a result we hit most page cache issues with some delay, as was the case here. The severity seemed to warrant a stable tag. Fixes: 59dc76b0d4df ("mm: vmscan: reduce size of inactive file list") Link: http://lkml.kernel.org/r/20170404220052.27593-1-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Cc: Rik van Riel Cc: Mel Gorman Cc: Michal Hocko Cc: Vladimir Davydov Cc: [4.7+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/memcontrol.h | 64 +++++++++++++++++++++++++++++-- include/linux/mmzone.h | 2 + mm/memcontrol.c | 24 ++++-------- mm/vmscan.c | 94 ++++++++++++++++++++++++++++++++++++---------- mm/workingset.c | 7 +++- 5 files changed, 150 insertions(+), 41 deletions(-) commit 20ac28933c49433e0f064314de3618129b54a22e Author: Anshuman Khandual Date: Wed May 3 14:55:00 2017 -0700 mm/mmap: replace SHM_HUGE_MASK with MAP_HUGE_MASK inside mmap_pgoff Commit 091d0d55b286 ("shm: fix null pointer deref when userspace specifies invalid hugepage size") had replaced MAP_HUGE_MASK with SHM_HUGE_MASK. Though both of them contain the same numeric value of 0x3f, MAP_HUGE_MASK flag sounds more appropriate than the other one in the context. Hence change it back. Link: http://lkml.kernel.org/r/20170404045635.616-1-khandual@linux.vnet.ibm.com Signed-off-by: Anshuman Khandual Reviewed-by: Matthew Wilcox Acked-by: Balbir Singh Acked-by: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/mmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d75da004c708c9fca7b53f7da293a295522414d9 Author: Michal Hocko Date: Wed May 3 14:54:57 2017 -0700 oom: improve oom disable handling Tetsuo has reported that sysrq triggered OOM killer will print a misleading information when no tasks are selected: sysrq: SysRq : Manual OOM execution Out of memory: Kill process 4468 ((agetty)) score 0 or sacrifice child Killed process 4468 ((agetty)) total-vm:43704kB, anon-rss:1760kB, file-rss:0kB, shmem-rss:0kB sysrq: SysRq : Manual OOM execution Out of memory: Kill process 4469 (systemd-cgroups) score 0 or sacrifice child Killed process 4469 (systemd-cgroups) total-vm:10704kB, anon-rss:120kB, file-rss:0kB, shmem-rss:0kB sysrq: SysRq : Manual OOM execution sysrq: OOM request ignored because killer is disabled sysrq: SysRq : Manual OOM execution sysrq: OOM request ignored because killer is disabled sysrq: SysRq : Manual OOM execution sysrq: OOM request ignored because killer is disabled The real reason is that there are no eligible tasks for the OOM killer to select but since commit 7c5f64f84483 ("mm: oom: deduplicate victim selection code for memcg and global oom") the semantic of out_of_memory has changed without updating moom_callback. This patch updates moom_callback to tell that no task was eligible which is the case for both oom killer disabled and no eligible tasks. In order to help distinguish first case from the second add printk to both oom_killer_{enable,disable}. This information is useful on its own because it might help debugging potential memory allocation failures. Fixes: 7c5f64f84483 ("mm: oom: deduplicate victim selection code for memcg and global oom") Link: http://lkml.kernel.org/r/20170404134705.6361-1-mhocko@kernel.org Signed-off-by: Michal Hocko Reported-by: Tetsuo Handa Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds drivers/tty/sysrq.c | 2 +- mm/oom_kill.c | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) commit b6ad19763dce4a08bdcd5140a97aa1f94aed3671 Author: Mike Rapoport Date: Wed May 3 14:54:54 2017 -0700 userfaultfd: selftest: combine all cases into a single executable Currently, selftest for userfaultfd is compiled three times: for anonymous, shared and hugetlb memory. Let's combine all the cases into a single executable which will have a command line option for selection of the test type. Link: http://lkml.kernel.org/r/1490869741-5913-1-git-send-email-rppt@linux.vnet.ibm.com Signed-off-by: Mike Rapoport Reviewed-by: Mike Kravetz Cc: Andrea Arcangeli Cc: Shuah Khan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds tools/testing/selftests/vm/Makefile | 11 +- tools/testing/selftests/vm/run_vmtests | 6 +- tools/testing/selftests/vm/userfaultfd.c | 207 +++++++++++++++++-------------- 3 files changed, 116 insertions(+), 108 deletions(-) commit ac2e8e40acf4c73e0ad1addca34b186d855565d7 Author: Hao Lee Date: Wed May 3 14:54:51 2017 -0700 mm: fix spelling error Fix variable name error in comments. No code changes. Link: http://lkml.kernel.org/r/20170403161655.5081-1-haolee.swjtu@gmail.com Signed-off-by: Hao Lee Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/gfp.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 9b7a814327a314c56c0e68654c76d99bd2938084 Author: Tim Chen Date: Wed May 3 14:54:48 2017 -0700 mm/swap_slots.c: add warning if swap slots cache failed to initialize Add a warning diagnostics to user if we failed to allocate swap slots cache and use it. [akpm@linux-foundation.org: use WARN_ONCE return value, fix grammar in message] Link: http://lkml.kernel.org/r/20170328234827.GA10107@linux.intel.com Signed-off-by: Tim Chen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/swap_slots.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 9927e3887642b976d9b391cd77d71388aa521e54 Author: Pushkar Jambhlekar Date: Wed May 3 14:54:45 2017 -0700 include/linux/migrate.h: add arg names to prototype It is preferred, and the rest of migrate.h gets it right. Link: http://lkml.kernel.org/r/1490336009-8024-1-git-send-email-pushkar.iit@gmail.com Signed-off-by: Pushkar Jambhlekar Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/migrate.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit bd33ef3681359343863f2290aded182b0441edee Author: Vinayak Menon Date: Wed May 3 14:54:42 2017 -0700 mm: enable page poisoning early at boot On SPARSEMEM systems page poisoning is enabled after buddy is up, because of the dependency on page extension init. This causes the pages released by free_all_bootmem not to be poisoned. This either delays or misses the identification of some issues because the pages have to undergo another cycle of alloc-free-alloc for any corruption to be detected. Enable page poisoning early by getting rid of the PAGE_EXT_DEBUG_POISON flag. Since all the free pages will now be poisoned, the flag need not be verified before checking the poison during an alloc. [vinmenon@codeaurora.org: fix Kconfig] Link: http://lkml.kernel.org/r/1490878002-14423-1-git-send-email-vinmenon@codeaurora.org Link: http://lkml.kernel.org/r/1490358246-11001-1-git-send-email-vinmenon@codeaurora.org Signed-off-by: Vinayak Menon Acked-by: Laura Abbott Tested-by: Laura Abbott Cc: Joonsoo Kim Cc: Michal Hocko Cc: Akinobu Mita Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/mm.h | 1 - mm/Kconfig.debug | 1 - mm/page_alloc.c | 13 +++------ mm/page_ext.c | 13 ++------- mm/page_poison.c | 77 +++++++++--------------------------------------------- 5 files changed, 17 insertions(+), 88 deletions(-) commit 2872bb2d0a4952ffb721e703555cb73d40b2c2f0 Author: Huang Ying Date: Wed May 3 14:54:39 2017 -0700 mm, swap: avoid lock swap_avail_lock when held cluster lock Cluster lock is used to protect the swap_cluster_info and corresponding elements in swap_info_struct->swap_map[]. But it is found that now in scan_swap_map_slots(), swap_avail_lock may be acquired when cluster lock is held. This does no good except making the locking more complex and improving the potential locking contention, because the swap_info_struct->lock is used to protect the data structure operated in the code already. Fix this via moving the corresponding operations in scan_swap_map_slots() out of cluster lock. Link: http://lkml.kernel.org/r/20170317064635.12792-3-ying.huang@intel.com Signed-off-by: "Huang, Ying" Acked-by: Tim Chen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/swapfile.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 0ef017d117d79eb765cb490a8d7e323752a13f4a Author: Huang Ying Date: Wed May 3 14:54:36 2017 -0700 mm, swap: improve readability via make spin_lock/unlock balanced This is just a cleanup patch, no functionality change. In cluster_list_add_tail(), spin_lock_nested() is used to lock the cluster, while unlock_cluster() is used to unlock the cluster. To improve the code readability, use spin_unlock() directly to unlock the cluster. Link: http://lkml.kernel.org/r/20170317064635.12792-2-ying.huang@intel.com Signed-off-by: "Huang, Ying" Acked-by: Tim Chen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/swapfile.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9c1cc2e4f25c14dc1a2d98e98808aefef24abaf4 Author: Huang Ying Date: Wed May 3 14:54:33 2017 -0700 mm, swap: fix comment in __read_swap_cache_async Commit cbab0e4eec29 ("swap: avoid read_swap_cache_async() race to deadlock while waiting on discard I/O completion") fixed a deadlock in read_swap_cache_async(). Because at that time, in swap allocation path, a swap entry may be set as SWAP_HAS_CACHE, then wait for discarding to complete before the page for the swap entry is added to the swap cache. But in commit 815c2c543d3a ("swap: make swap discard async"), the discarding for swap become asynchronous, waiting for discarding to complete will be done before the swap entry is set as SWAP_HAS_CACHE. So the comments in code is incorrect now. This patch fixes the comments. The cond_resched() added in the commit cbab0e4eec29 is not necessary now too. But if we added some sleep in swap allocation path in the future, there may be some hard to debug/reproduce deadlock bug. So it is kept. Link: http://lkml.kernel.org/r/20170317064635.12792-1-ying.huang@intel.com Signed-off-by: "Huang, Ying" Acked-by: Rafael Aquini Cc: Shaohua Li Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/swap_state.c | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) commit 83612a948d3bd2e71b110d7e8735661621bd23d9 Author: Minchan Kim Date: Wed May 3 14:54:30 2017 -0700 mm: remove SWAP_[SUCCESS|AGAIN|FAIL] There is no user for it. Remove it. [minchan@kernel.org: use false instead of SWAP_FAIL] Link: http://lkml.kernel.org/r/20170316053313.GA19241@bbox Link: http://lkml.kernel.org/r/1489555493-14659-11-git-send-email-minchan@kernel.org Signed-off-by: Minchan Kim Cc: Anshuman Khandual Cc: Hillf Danton Cc: Johannes Weiner Cc: Kirill A. Shutemov Cc: Michal Hocko Cc: Naoya Horiguchi Cc: Vlastimil Babka Cc: Sergey Senozhatsky Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/rmap.h | 7 ------- mm/rmap.c | 2 +- 2 files changed, 1 insertion(+), 8 deletions(-) commit e4b82222712ed15813d35204c91429883d27d1d9 Author: Minchan Kim Date: Wed May 3 14:54:27 2017 -0700 mm: make rmap_one boolean function rmap_one's return value controls whether rmap_work should contine to scan other ptes or not so it's target for changing to boolean. Return true if the scan should be continued. Otherwise, return false to stop the scanning. This patch makes rmap_one's return value to boolean. Link: http://lkml.kernel.org/r/1489555493-14659-10-git-send-email-minchan@kernel.org Signed-off-by: Minchan Kim Cc: Anshuman Khandual Cc: Hillf Danton Cc: Johannes Weiner Cc: Kirill A. Shutemov Cc: Michal Hocko Cc: Naoya Horiguchi Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/rmap.h | 6 +++++- mm/ksm.c | 2 +- mm/migrate.c | 4 ++-- mm/page_idle.c | 4 ++-- mm/rmap.c | 30 +++++++++++++++--------------- 5 files changed, 25 insertions(+), 21 deletions(-) commit 1df631ae19819cff343d316eda42eca32d3de7fc Author: Minchan Kim Date: Wed May 3 14:54:23 2017 -0700 mm: make rmap_walk() return void There is no user of the return value from rmap_walk() and friends so this patch makes them void-returning functions. Link: http://lkml.kernel.org/r/1489555493-14659-9-git-send-email-minchan@kernel.org Signed-off-by: Minchan Kim Cc: Anshuman Khandual Cc: Hillf Danton Cc: Johannes Weiner Cc: Kirill A. Shutemov Cc: Michal Hocko Cc: Naoya Horiguchi Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/ksm.h | 5 ++--- include/linux/rmap.h | 4 ++-- mm/ksm.c | 16 ++++++---------- mm/rmap.c | 32 +++++++++++++------------------- 4 files changed, 23 insertions(+), 34 deletions(-) commit 666e5a406c3ed562e7b3ceff8b631b6067bdaead Author: Minchan Kim Date: Wed May 3 14:54:20 2017 -0700 mm: make ttu's return boolean try_to_unmap() returns SWAP_SUCCESS or SWAP_FAIL so it's suitable for boolean return. This patch changes it. Link: http://lkml.kernel.org/r/1489555493-14659-8-git-send-email-minchan@kernel.org Signed-off-by: Minchan Kim Cc: Naoya Horiguchi Cc: Anshuman Khandual Cc: Hillf Danton Cc: Johannes Weiner Cc: Kirill A. Shutemov Cc: Michal Hocko Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/rmap.h | 4 ++-- mm/huge_memory.c | 6 +++--- mm/memory-failure.c | 26 ++++++++++++-------------- mm/rmap.c | 8 +++----- mm/vmscan.c | 7 +------ 5 files changed, 21 insertions(+), 30 deletions(-) commit 33fc80e2574737e6e21eecc4c1d7942370a2c752 Author: Minchan Kim Date: Wed May 3 14:54:17 2017 -0700 mm: remove SWAP_AGAIN in ttu In 2002, [1] introduced SWAP_AGAIN. At that time, try_to_unmap_one used spin_trylock(&mm->page_table_lock) so it's really easy to contend and fail to hold a lock so SWAP_AGAIN to keep LRU status makes sense. However, now we changed it to mutex-based lock and be able to block without skip pte so there is few of small window to return SWAP_AGAIN so remove SWAP_AGAIN and just return SWAP_FAIL. [1] c48c43e, minimal rmap Link: http://lkml.kernel.org/r/1489555493-14659-7-git-send-email-minchan@kernel.org Signed-off-by: Minchan Kim Cc: Anshuman Khandual Cc: Hillf Danton Cc: Johannes Weiner Cc: Kirill A. Shutemov Cc: Michal Hocko Cc: Naoya Horiguchi Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/rmap.c | 11 +++-------- mm/vmscan.c | 2 -- 2 files changed, 3 insertions(+), 10 deletions(-) commit ad6b67041a45497261617d7a28b15159b202cb5a Author: Minchan Kim Date: Wed May 3 14:54:13 2017 -0700 mm: remove SWAP_MLOCK in ttu ttu doesn't need to return SWAP_MLOCK. Instead, just return SWAP_FAIL because it means the page is not-swappable so it should move to another LRU list(active or unevictable). putback friends will move it to right list depending on the page's LRU flag. Link: http://lkml.kernel.org/r/1489555493-14659-6-git-send-email-minchan@kernel.org Signed-off-by: Minchan Kim Cc: Anshuman Khandual Cc: Hillf Danton Cc: Johannes Weiner Cc: Kirill A. Shutemov Cc: Michal Hocko Cc: Naoya Horiguchi Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/rmap.h | 1 - mm/rmap.c | 3 +-- mm/vmscan.c | 20 +++++++------------- 3 files changed, 8 insertions(+), 16 deletions(-) commit 192d7232569ab61ded40c8be691b12832bc6bcd1 Author: Minchan Kim Date: Wed May 3 14:54:10 2017 -0700 mm: make try_to_munlock() return void try_to_munlock returns SWAP_MLOCK if the one of VMAs mapped the page has VM_LOCKED flag. In that time, VM set PG_mlocked to the page if the page is not pte-mapped THP which cannot be mlocked, either. With that, __munlock_isolated_page can use PageMlocked to check whether try_to_munlock is successful or not without relying on try_to_munlock's retval. It helps to make try_to_unmap/try_to_unmap_one simple with upcoming patches. [minchan@kernel.org: remove PG_Mlocked VM_BUG_ON check] Link: http://lkml.kernel.org/r/20170411025615.GA6545@bbox Link: http://lkml.kernel.org/r/1489555493-14659-5-git-send-email-minchan@kernel.org Signed-off-by: Minchan Kim Acked-by: Kirill A. Shutemov Acked-by: Vlastimil Babka Cc: Anshuman Khandual Cc: Hillf Danton Cc: Johannes Weiner Cc: Michal Hocko Cc: Naoya Horiguchi Cc: Sasha Levin Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/rmap.h | 2 +- mm/mlock.c | 6 ++---- mm/rmap.c | 16 ++++------------ 3 files changed, 7 insertions(+), 17 deletions(-) commit 22ffb33f4620b502799877d4186502bfe20621ea Author: Minchan Kim Date: Wed May 3 14:54:07 2017 -0700 mm: remove SWAP_MLOCK check for SWAP_SUCCESS in ttu If the page is mapped and rescue in try_to_unmap_one, the page_mapcount() of a page cannot be zero, so the page_mapcount check in try_to_unmap is enough to return SWAP_SUCCESS. IOW, SWAP_MLOCK check is redundant so remove it. Link: http://lkml.kernel.org/r/1489555493-14659-4-git-send-email-minchan@kernel.org Signed-off-by: Minchan Kim Cc: Anshuman Khandual Cc: Hillf Danton Cc: Johannes Weiner Cc: Kirill A. Shutemov Cc: Michal Hocko Cc: Naoya Horiguchi Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/rmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 18863d3a3f593f47b075b9f53ebf9228dc76cf72 Author: Minchan Kim Date: Wed May 3 14:54:04 2017 -0700 mm: remove SWAP_DIRTY in ttu If we found lazyfree page is dirty, try_to_unmap_one can just SetPageSwapBakced in there like PG_mlocked page and just return with SWAP_FAIL which is very natural because the page is not swappable right now so that vmscan can activate it. There is no point to introduce new return value SWAP_DIRTY in try_to_unmap at the moment. Link: http://lkml.kernel.org/r/1489555493-14659-3-git-send-email-minchan@kernel.org Signed-off-by: Minchan Kim Acked-by: Hillf Danton Acked-by: Kirill A. Shutemov Cc: Anshuman Khandual Cc: Johannes Weiner Cc: Michal Hocko Cc: Naoya Horiguchi Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/rmap.h | 1 - mm/rmap.c | 4 ++-- mm/vmscan.c | 3 --- 3 files changed, 2 insertions(+), 6 deletions(-) commit c24f386c60b2269d532a23e70939ed8ce55d7005 Author: Minchan Kim Date: Wed May 3 14:54:00 2017 -0700 mm: remove unncessary ret in page_referenced Nobody uses ret variable. Remove it. Link: http://lkml.kernel.org/r/1489555493-14659-2-git-send-email-minchan@kernel.org Signed-off-by: Minchan Kim Acked-by: Hillf Danton Acked-by: Kirill A. Shutemov Cc: Johannes Weiner Cc: Michal Hocko Cc: Kirill A. Shutemov Cc: Anshuman Khandual Cc: Vlastimil Babka Cc: Naoya Horiguchi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/rmap.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit d6622f6365dbf31e9534a440daecdb9b04804aa4 Author: Yisheng Xie Date: Wed May 3 14:53:57 2017 -0700 mm/vmscan: more restrictive condition for retry in do_try_to_free_pages By reviewing code, I find that when enter do_try_to_free_pages, the may_thrash is always clear, and it will retry shrink zones to tap cgroup's reserves memory by setting may_thrash when the former shrink_zones reclaim nothing. However, when memcg is disabled or on legacy hierarchy, or there do not have any memcg protected by low limit, it should not do this useless retry at all, for we do not have any cgroup's reserves memory to tap, and we have already done hard work but made no progress, which as Michal pointed out in former version, we are trying hard to control the retry logical of page alloctor, and the current additional round of reclaim is just lame. Therefore, to avoid this unneeded retrying and make code more readable, we remove the may_thrash field in scan_control, instead, introduce memcg_low_reclaim and memcg_low_skipped, and only retry when memcg_low_skipped, by setting memcg_low_reclaim. [xieyisheng1@huawei.com: remove may_thrash field, introduce mem_cgroup_reclaim] Link: http://lkml.kernel.org/r/1490191893-5923-1-git-send-email-ysxie@foxmail.com Link: http://lkml.kernel.org/r/1490191893-5923-1-git-send-email-ysxie@foxmail.com Signed-off-by: Yisheng Xie Acked-by: Michal Hocko Suggested-by: Johannes Weiner Suggested-by: Michal Hocko Suggested-by: Shakeel Butt Reviewed-by: Shakeel Butt Acked-by: Johannes Weiner Cc: Mel Gorman Cc: Vlastimil Babka Cc: Rik van Riel Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/vmscan.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) commit 1ef36db2a96f23ac0a278d498072ef7193c8b8f2 Author: Yisheng Xie Date: Wed May 3 14:53:54 2017 -0700 mm/compaction: ignore block suitable after check large free page By reviewing code, I find that if the migrate target is a large free page and we ignore suitable, it may splite large target free page into smaller block which is not good for defrag. So move the ignore block suitable after check large free page. As Vlastimil pointed out in RFC version that this patch is just based on logical analyses which might be better for future-proofing the function and it is most likely won't have any visible effect right now, for direct compaction shouldn't have to be called if there's a >=pageblock_order page already available. Link: http://lkml.kernel.org/r/1489490743-5364-1-git-send-email-xieyisheng1@huawei.com Signed-off-by: Yisheng Xie Cc: Vlastimil Babka Cc: Michal Hocko Cc: Mel Gorman Cc: Joonsoo Kim Cc: David Rientjes Cc: Minchan Kim Cc: Hanjun Guo Cc: Xishi Qiu Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/compaction.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 60a7a88dbb9fc9adcca78a10a3ecf36966b5a45c Author: Wei Yang Date: Wed May 3 14:53:51 2017 -0700 mm/sparse: refine usemap_size() a little The current implementation calculates usemap_size in two steps: * calculate number of bytes to cover these bits * calculate number of "unsigned long" to cover these bytes It would be more clear by: * calculate number of "unsigned long" to cover these bits * multiple it with sizeof(unsigned long) This patch refine usemap_size() a little to make it more easy to understand. Link: http://lkml.kernel.org/r/20170310043713.96871-1-richard.weiyang@gmail.com Signed-off-by: Wei Yang Cc: Tejun Heo Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/sparse.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) commit 822519634142cb66614514ac8ee9221868f764bb Author: Johannes Weiner Date: Wed May 3 14:53:48 2017 -0700 mm: page_alloc: __GFP_NOWARN shouldn't suppress stall warnings __GFP_NOWARN, which is usually added to avoid warnings from callsites that expect to fail and have fallbacks, currently also suppresses allocation stall warnings. These trigger when an allocation is stuck inside the allocator for 10 seconds or longer. But there is no class of allocations that can get legitimately stuck in the allocator for this long. This always indicates a problem. Always emit stall warnings. Restrict __GFP_NOWARN to alloc failures. Link: http://lkml.kernel.org/r/20170125181150.GA16398@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Minchan Kim Cc: Michal Hocko Cc: Tetsuo Handa Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/page_alloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e716f2eb24defb33b82be763a3ed9a618a210cee Author: Mel Gorman Date: Wed May 3 14:53:45 2017 -0700 mm, vmscan: prevent kswapd sleeping prematurely due to mismatched classzone_idx kswapd is woken to reclaim a node based on a failed allocation request from any eligible zone. Once reclaiming in balance_pgdat(), it will continue reclaiming until there is an eligible zone available for the zone it was woken for. kswapd tracks what zone it was recently woken for in pgdat->kswapd_classzone_idx. If it has not been woken recently, this zone will be 0. However, the decision on whether to sleep is made on kswapd_classzone_idx which is 0 without a recent wakeup request and that classzone does not account for lowmem reserves. This allows kswapd to sleep when a low small zone such as ZONE_DMA is balanced for a GFP_DMA request even if a stream of allocations cannot use that zone. While kswapd may be woken again shortly in the near future there are two consequences -- the pgdat bits that control congestion are cleared prematurely and direct reclaim is more likely as kswapd slept prematurely. This patch flips kswapd_classzone_idx to default to MAX_NR_ZONES (an invalid index) when there has been no recent wakeups. If there are no wakeups, it'll decide whether to sleep based on the highest possible zone available (MAX_NR_ZONES - 1). It then becomes critical that the "pgdat balanced" decisions during reclaim and when deciding to sleep are the same. If there is a mismatch, kswapd can stay awake continually trying to balance tiny zones. simoop was used to evaluate it again. Two of the preparation patches regressed the workload so they are included as the second set of results. Otherwise this patch looks artifically excellent 4.11.0-rc1 4.11.0-rc1 4.11.0-rc1 vanilla clear-v2 keepawake-v2 Amean p50-Read 21670074.18 ( 0.00%) 19786774.76 ( 8.69%) 22668332.52 ( -4.61%) Amean p95-Read 25456267.64 ( 0.00%) 24101956.27 ( 5.32%) 26738688.00 ( -5.04%) Amean p99-Read 29369064.73 ( 0.00%) 27691872.71 ( 5.71%) 30991404.52 ( -5.52%) Amean p50-Write 1390.30 ( 0.00%) 1011.91 ( 27.22%) 924.91 ( 33.47%) Amean p95-Write 412901.57 ( 0.00%) 34874.98 ( 91.55%) 1362.62 ( 99.67%) Amean p99-Write 6668722.09 ( 0.00%) 575449.60 ( 91.37%) 16854.04 ( 99.75%) Amean p50-Allocation 78714.31 ( 0.00%) 84246.26 ( -7.03%) 74729.74 ( 5.06%) Amean p95-Allocation 175533.51 ( 0.00%) 400058.43 (-127.91%) 101609.74 ( 42.11%) Amean p99-Allocation 247003.02 ( 0.00%) 10905600.00 (-4315.17%) 125765.57 ( 49.08%) With this patch on top, write and allocation latencies are massively improved. The read latencies are slightly impaired but it's worth noting that this is mostly due to the IO scheduler and not directly related to reclaim. The vmstats are a bit of a mix but the relevant ones are as follows; 4.10.0-rc7 4.10.0-rc7 4.10.0-rc7 mmots-20170209 clear-v1r25keepawake-v1r25 Swap Ins 0 0 0 Swap Outs 0 608 0 Direct pages scanned 6910672 3132699 6357298 Kswapd pages scanned 57036946 82488665 56986286 Kswapd pages reclaimed 55993488 63474329 55939113 Direct pages reclaimed 6905990 2964843 6352115 Kswapd efficiency 98% 76% 98% Kswapd velocity 12494.375 17597.507 12488.065 Direct efficiency 99% 94% 99% Direct velocity 1513.835 668.306 1393.148 Page writes by reclaim 0.000 4410243.000 0.000 Page writes file 0 4409635 0 Page writes anon 0 608 0 Page reclaim immediate 1036792 14175203 1042571 4.11.0-rc1 4.11.0-rc1 4.11.0-rc1 vanilla clear-v2 keepawake-v2 Swap Ins 0 12 0 Swap Outs 0 838 0 Direct pages scanned 6579706 3237270 6256811 Kswapd pages scanned 61853702 79961486 54837791 Kswapd pages reclaimed 60768764 60755788 53849586 Direct pages reclaimed 6579055 2987453 6256151 Kswapd efficiency 98% 75% 98% Page writes by reclaim 0.000 4389496.000 0.000 Page writes file 0 4388658 0 Page writes anon 0 838 0 Page reclaim immediate 1073573 14473009 982507 Swap-outs are equivalent to baseline. Direct reclaim is reduced but not eliminated. It's worth noting that there are two periods of direct reclaim for this workload. The first is when it switches from preparing the files for the actual test itself. It's a lot of file IO followed by a lot of allocs that reclaims heavily for a brief window. While direct reclaim is lower with clear-v2, it is due to kswapd scanning aggressively and trying to reclaim the world which is not the right thing to do. With the patches applied, there is still direct reclaim but the phase change from "creating work files" to starting multiple threads that allocate a lot of anonymous memory faster than kswapd can reclaim. Scanning/reclaim efficiency is restored by this patch. Page writes from reclaim context are back at 0 which is ideal. Pages immediately reclaimed after IO completes is slightly improved but it is expected this will vary slightly. On UMA, there is almost no change so this is not expected to be a universal win. [mgorman@suse.de: fix ->kswapd_classzone_idx initialization] Link: http://lkml.kernel.org/r/20170406174538.5msrznj6nt6qpbx5@suse.de Link: http://lkml.kernel.org/r/20170309075657.25121-4-mgorman@techsingularity.net Signed-off-by: Mel Gorman Acked-by: Vlastimil Babka Acked-by: Michal Hocko Cc: Hillf Danton Cc: Johannes Weiner Cc: Shantanu Goel Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/memory_hotplug.c | 6 ++- mm/vmscan.c | 120 +++++++++++++++++++++++++++++----------------------- 2 files changed, 71 insertions(+), 55 deletions(-) commit 631b6e083ec328f7203f466ba839d296aee70c36 Author: Mel Gorman Date: Wed May 3 14:53:41 2017 -0700 mm, vmscan: only clear pgdat congested/dirty/writeback state when balanced A pgdat tracks if recent reclaim encountered too many dirty, writeback or congested pages. The flags control whether kswapd writes pages back from reclaim context, tags pages for immediate reclaim when IO completes, whether processes block on wait_iff_congested and whether kswapd blocks when too many pages marked for immediate reclaim are encountered. The state is cleared in a check function with side-effects. With the patch "mm, vmscan: fix zone balance check in prepare_kswapd_sleep", the timing of when the bits get cleared changed. Due to the way the check works, it'll clear the bits if ZONE_DMA is balanced for a GFP_DMA allocation because it does not account for lowmem reserves properly. For the simoop workload, kswapd is not stalling when it should due to the premature clearing, writing pages from reclaim context like crazy and generally being unhelpful. This patch resets the pgdat bits related to page reclaim only when kswapd is going to sleep. The comparison with simoop is then 4.11.0-rc1 4.11.0-rc1 4.11.0-rc1 vanilla fixcheck-v2 clear-v2 Amean p50-Read 21670074.18 ( 0.00%) 20464344.18 ( 5.56%) 19786774.76 ( 8.69%) Amean p95-Read 25456267.64 ( 0.00%) 25721423.64 ( -1.04%) 24101956.27 ( 5.32%) Amean p99-Read 29369064.73 ( 0.00%) 30174230.76 ( -2.74%) 27691872.71 ( 5.71%) Amean p50-Write 1390.30 ( 0.00%) 1395.28 ( -0.36%) 1011.91 ( 27.22%) Amean p95-Write 412901.57 ( 0.00%) 37737.74 ( 90.86%) 34874.98 ( 91.55%) Amean p99-Write 6668722.09 ( 0.00%) 666489.04 ( 90.01%) 575449.60 ( 91.37%) Amean p50-Allocation 78714.31 ( 0.00%) 86286.22 ( -9.62%) 84246.26 ( -7.03%) Amean p95-Allocation 175533.51 ( 0.00%) 351812.27 (-100.42%) 400058.43 (-127.91%) Amean p99-Allocation 247003.02 ( 0.00%) 6291171.56 (-2447.00%) 10905600.00 (-4315.17%) Read latency is improved, write latency is mostly improved but allocation latency is regressed. kswapd is still reclaiming inefficiently, pages are being written back from writeback context and a host of other issues. However, given the change, it needed to be spelled out why the side-effect was moved. Link: http://lkml.kernel.org/r/20170309075657.25121-3-mgorman@techsingularity.net Signed-off-by: Mel Gorman Acked-by: Vlastimil Babka Cc: Hillf Danton Cc: Johannes Weiner Cc: Shantanu Goel Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/vmscan.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) commit 333b0a459c0e1b4faa3127ec6209a4d984408b95 Author: Shantanu Goel Date: Wed May 3 14:53:38 2017 -0700 mm, vmscan: fix zone balance check in prepare_kswapd_sleep Patch series "Reduce amount of time kswapd sleeps prematurely", v2. The series is unusual in that the first patch fixes one problem and introduces other issues that are noted in the changelog. Patch 2 makes a minor modification that is worth considering on its own but leaves the kernel in a state where it behaves badly. It's not until patch 3 that there is an improvement against baseline. This was mostly motivated by examining Chris Mason's "simoop" benchmark which puts the VM under similar pressure to HADOOP. It has been reported that the benchmark has regressed severely during the last number of releases. While I cannot reproduce all the same problems Chris experienced due to hardware limitations, there was a number of problems on a 2-socket machine with a single disk. simoop latencies 4.11.0-rc1 4.11.0-rc1 vanilla keepawake-v2 Amean p50-Read 21670074.18 ( 0.00%) 22668332.52 ( -4.61%) Amean p95-Read 25456267.64 ( 0.00%) 26738688.00 ( -5.04%) Amean p99-Read 29369064.73 ( 0.00%) 30991404.52 ( -5.52%) Amean p50-Write 1390.30 ( 0.00%) 924.91 ( 33.47%) Amean p95-Write 412901.57 ( 0.00%) 1362.62 ( 99.67%) Amean p99-Write 6668722.09 ( 0.00%) 16854.04 ( 99.75%) Amean p50-Allocation 78714.31 ( 0.00%) 74729.74 ( 5.06%) Amean p95-Allocation 175533.51 ( 0.00%) 101609.74 ( 42.11%) Amean p99-Allocation 247003.02 ( 0.00%) 125765.57 ( 49.08%) These are latencies. Read/write are threads reading fixed-size random blocks from a simulated database. The allocation latency is mmaping and faulting regions of memory. The p50, 95 and p99 reports the worst latencies for 50% of the samples, 95% and 99% respectively. For example, the report indicates that while the test was running 99% of writes completed 99.75% faster. It's worth noting that on a UMA machine that no difference in performance with simoop was observed so milage will vary. It's noted that there is a slight impact to read latencies but it's mostly due to IO scheduler decisions and offset by the large reduction in other latencies. This patch (of 3): The check in prepare_kswapd_sleep needs to match the one in balance_pgdat since the latter will return as soon as any one of the zones in the classzone is above the watermark. This is specially important for higher order allocations since balance_pgdat will typically reset the order to zero relying on compaction to create the higher order pages. Without this patch, prepare_kswapd_sleep fails to wake up kcompactd since the zone balance check fails. It was first reported against 4.9.7 that kswapd is failing to wake up kcompactd due to a mismatch in the zone balance check between balance_pgdat() and prepare_kswapd_sleep(). balance_pgdat() returns as soon as a single zone satisfies the allocation but prepare_kswapd_sleep() requires all zones to do +the same. This causes prepare_kswapd_sleep() to never succeed except in the order == 0 case and consequently, wakeup_kcompactd() is never called. For the machine that originally motivated this patch, the state of compaction from /proc/vmstat looked this way after a day and a half +of uptime: compact_migrate_scanned 240496 compact_free_scanned 76238632 compact_isolated 123472 compact_stall 1791 compact_fail 29 compact_success 1762 compact_daemon_wake 0 After applying the patch and about 10 hours of uptime the state looks like this: compact_migrate_scanned 59927299 compact_free_scanned 2021075136 compact_isolated 640926 compact_stall 4 compact_fail 2 compact_success 2 compact_daemon_wake 5160 Further notes from Mel that motivated him to pick this patch up and resend it; It was observed for the simoop workload (pressures the VM similar to HADOOP) that kswapd was failing to keep ahead of direct reclaim. The investigation noted that there was a need to rationalise kswapd decisions to reclaim with kswapd decisions to sleep. With this patch on a 2-socket box, there was a 49% reduction in direct reclaim scanning. However, the impact otherwise is extremely negative. Kswapd reclaim efficiency dropped from 98% to 76%. simoop has three latency-related metrics for read, write and allocation (an anonymous mmap and fault). 4.11.0-rc1 4.11.0-rc1 vanilla fixcheck-v2 Amean p50-Read 21670074.18 ( 0.00%) 20464344.18 ( 5.56%) Amean p95-Read 25456267.64 ( 0.00%) 25721423.64 ( -1.04%) Amean p99-Read 29369064.73 ( 0.00%) 30174230.76 ( -2.74%) Amean p50-Write 1390.30 ( 0.00%) 1395.28 ( -0.36%) Amean p95-Write 412901.57 ( 0.00%) 37737.74 ( 90.86%) Amean p99-Write 6668722.09 ( 0.00%) 666489.04 ( 90.01%) Amean p50-Allocation 78714.31 ( 0.00%) 86286.22 ( -9.62%) Amean p95-Allocation 175533.51 ( 0.00%) 351812.27 (-100.42%) Amean p99-Allocation 247003.02 ( 0.00%) 6291171.56 (-2447.00%) Of greater concern is that the patch causes swapping and page writes from kswapd context rose from 0 pages to 4189753 pages during the hour the workload ran for. By and large, the patch has very bad behaviour but easily missed as the impact on a UMA machine is negligible. This patch is included with the data in case a bisection leads to this area. This patch is also a pre-requisite for the rest of the series. Link: http://lkml.kernel.org/r/20170309075657.25121-2-mgorman@techsingularity.net Signed-off-by: Shantanu Goel Signed-off-by: Mel Gorman Acked-by: Hillf Danton Acked-by: Vlastimil Babka Cc: Johannes Weiner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/vmscan.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) commit 2948be5acf7d798991b127ceda6eea13e52c597f Author: Minchan Kim Date: Wed May 3 14:53:35 2017 -0700 mm: do not use double negation for testing page flags With the discussion[1], I found it seems there are every PageFlags functions return bool at this moment so we don't need double negation any more. Although it's not a problem to keep it, it makes future users confused to use double negation for them, too. Remove such possibility. [1] https://marc.info/?l=linux-kernel&m=148881578820434 Frankly sepaking, I like every PageFlags to return bool instead of int. It will make it clear. AFAIR, Chen Gang had tried it but don't know why it was not merged at that time. http://lkml.kernel.org/r/1469336184-1904-1-git-send-email-chengang@emindsoft.com.cn Link: http://lkml.kernel.org/r/1488868597-32222-1-git-send-email-minchan@kernel.org Signed-off-by: Minchan Kim Acked-by: Johannes Weiner Acked-by: Vlastimil Babka Acked-by: Michal Hocko Cc: Kirill A. Shutemov Cc: Chen Gang Cc: Anshuman Khandual Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/khugepaged.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 056b9d8a76924df02011f3941c4f53ace8d6c32a Author: Kees Cook Date: Wed May 3 14:53:32 2017 -0700 mm: remove rodata_test_data export, add pr_fmt Since commit 3ad38ceb2769 ("x86/mm: Remove CONFIG_DEBUG_NX_TEST"), nothing is using the exported rodata_test_data variable, so drop the export. This additionally updates the pr_fmt to avoid redundant strings and adjusts some whitespace. Link: http://lkml.kernel.org/r/20170307005313.GA85809@beast Signed-off-by: Kees Cook Cc: Jinbum Park Cc: Arjan van de Ven Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/rodata_test.h | 1 - mm/rodata_test.c | 17 +++++++++-------- 2 files changed, 9 insertions(+), 9 deletions(-) commit 9ab2594febb468964a4c00f8023ec22073ca8716 Author: Matthew Wilcox Date: Wed May 3 14:53:29 2017 -0700 mm: tighten up the fault path a little The round_up() macro generates a couple of unnecessary instructions in this usage: 48cd: 49 8b 47 50 mov 0x50(%r15),%rax 48d1: 48 83 e8 01 sub $0x1,%rax 48d5: 48 0d ff 0f 00 00 or $0xfff,%rax 48db: 48 83 c0 01 add $0x1,%rax 48df: 48 c1 f8 0c sar $0xc,%rax 48e3: 48 39 c3 cmp %rax,%rbx 48e6: 72 2e jb 4916 If we change round_up() to ((x) + __round_mask(x, y)) & ~__round_mask(x, y) then GCC can see through it and remove the mask (because that would be dead code given the subsequent shift): 48cd: 49 8b 47 50 mov 0x50(%r15),%rax 48d1: 48 05 ff 0f 00 00 add $0xfff,%rax 48d7: 48 c1 e8 0c shr $0xc,%rax 48db: 48 39 c3 cmp %rax,%rbx 48de: 72 2e jb 490e But that's problematic because we'd evaluate 'y' twice. Converting round_up into an inline function prevents it from being used in other definitions. The easiest thing to do is just change these three usages of round_up to use DIV_ROUND_UP. Also add an unlikely() because GCC's heuristic is wrong in this case. Link: http://lkml.kernel.org/r/20170207192812.5281-1-willy@infradead.org Signed-off-by: Matthew Wilcox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/filemap.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) commit eb52da3f48f5b1ddceb7e8d4725b6c88204aa2c4 Author: Michal Hocko Date: Wed May 3 14:53:26 2017 -0700 jbd2: make the whole kjournald2 kthread NOFS safe kjournald2 is central to the transaction commit processing. As such any potential allocation from this kernel thread has to be GFP_NOFS. Make sure to mark the whole kernel thread GFP_NOFS by the memalloc_nofs_save. [akpm@linux-foundation.org: coding-style fixes] Link: http://lkml.kernel.org/r/20170306131408.9828-8-mhocko@kernel.org Signed-off-by: Michal Hocko Suggested-by: Jan Kara Reviewed-by: Jan Kara Cc: Dave Chinner Cc: Theodore Ts'o Cc: Chris Mason Cc: David Sterba Cc: Brian Foster Cc: Darrick J. Wong Cc: Nikolay Borisov Cc: Peter Zijlstra Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/jbd2/journal.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit 81378da64de6d33d0c200885f1de431c9a3e5ccd Author: Michal Hocko Date: Wed May 3 14:53:22 2017 -0700 jbd2: mark the transaction context with the scope GFP_NOFS context now that we have memalloc_nofs_{save,restore} api we can mark the whole transaction context as implicitly GFP_NOFS. All allocations will automatically inherit GFP_NOFS this way. This means that we do not have to mark any of those requests with GFP_NOFS and moreover all the ext4_kv[mz]alloc(GFP_NOFS) are also safe now because even the hardcoded GFP_KERNEL allocations deep inside the vmalloc will be NOFS now. [akpm@linux-foundation.org: tweak comments] Link: http://lkml.kernel.org/r/20170306131408.9828-7-mhocko@kernel.org Signed-off-by: Michal Hocko Reviewed-by: Jan Kara Cc: Dave Chinner Cc: Theodore Ts'o Cc: Chris Mason Cc: David Sterba Cc: Brian Foster Cc: Darrick J. Wong Cc: Nikolay Borisov Cc: Peter Zijlstra Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/jbd2/transaction.c | 12 ++++++++++++ include/linux/jbd2.h | 2 ++ 2 files changed, 14 insertions(+) commit 9ba1fb2c602a6f2323e3a08ec8e7a8e33bf335f4 Author: Michal Hocko Date: Wed May 3 14:53:19 2017 -0700 xfs: use memalloc_nofs_{save,restore} instead of memalloc_noio* kmem_zalloc_large and _xfs_buf_map_pages use memalloc_noio_{save,restore} API to prevent from reclaim recursion into the fs because vmalloc can invoke unconditional GFP_KERNEL allocations and these functions might be called from the NOFS contexts. The memalloc_noio_save will enforce GFP_NOIO context which is even weaker than GFP_NOFS and that seems to be unnecessary. Let's use memalloc_nofs_{save,restore} instead as it should provide exactly what we need here - implicit GFP_NOFS context. Link: http://lkml.kernel.org/r/20170306131408.9828-6-mhocko@kernel.org Signed-off-by: Michal Hocko Reviewed-by: Brian Foster Reviewed-by: Darrick J. Wong Acked-by: Vlastimil Babka Cc: Dave Chinner Cc: Theodore Ts'o Cc: Chris Mason Cc: David Sterba Cc: Jan Kara Cc: Nikolay Borisov Cc: Peter Zijlstra Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/xfs/kmem.c | 12 ++++++------ fs/xfs/xfs_buf.c | 8 ++++---- 2 files changed, 10 insertions(+), 10 deletions(-) commit 7dea19f9ee636cb244109a4dba426bbb3e5304b7 Author: Michal Hocko Date: Wed May 3 14:53:15 2017 -0700 mm: introduce memalloc_nofs_{save,restore} API GFP_NOFS context is used for the following 5 reasons currently: - to prevent from deadlocks when the lock held by the allocation context would be needed during the memory reclaim - to prevent from stack overflows during the reclaim because the allocation is performed from a deep context already - to prevent lockups when the allocation context depends on other reclaimers to make a forward progress indirectly - just in case because this would be safe from the fs POV - silence lockdep false positives Unfortunately overuse of this allocation context brings some problems to the MM. Memory reclaim is much weaker (especially during heavy FS metadata workloads), OOM killer cannot be invoked because the MM layer doesn't have enough information about how much memory is freeable by the FS layer. In many cases it is far from clear why the weaker context is even used and so it might be used unnecessarily. We would like to get rid of those as much as possible. One way to do that is to use the flag in scopes rather than isolated cases. Such a scope is declared when really necessary, tracked per task and all the allocation requests from within the context will simply inherit the GFP_NOFS semantic. Not only this is easier to understand and maintain because there are much less problematic contexts than specific allocation requests, this also helps code paths where FS layer interacts with other layers (e.g. crypto, security modules, MM etc...) and there is no easy way to convey the allocation context between the layers. Introduce memalloc_nofs_{save,restore} API to control the scope of GFP_NOFS allocation context. This is basically copying memalloc_noio_{save,restore} API we have for other restricted allocation context GFP_NOIO. The PF_MEMALLOC_NOFS flag already exists and it is just an alias for PF_FSTRANS which has been xfs specific until recently. There are no more PF_FSTRANS users anymore so let's just drop it. PF_MEMALLOC_NOFS is now checked in the MM layer and drops __GFP_FS implicitly same as PF_MEMALLOC_NOIO drops __GFP_IO. memalloc_noio_flags is renamed to current_gfp_context because it now cares about both PF_MEMALLOC_NOFS and PF_MEMALLOC_NOIO contexts. Xfs code paths preserve their semantic. kmem_flags_convert() doesn't need to evaluate the flag anymore. This patch shouldn't introduce any functional changes. Let's hope that filesystems will drop direct GFP_NOFS (resp. ~__GFP_FS) usage as much as possible and only use a properly documented memalloc_nofs_{save,restore} checkpoints where they are appropriate. [akpm@linux-foundation.org: fix comment typo, reflow comment] Link: http://lkml.kernel.org/r/20170306131408.9828-5-mhocko@kernel.org Signed-off-by: Michal Hocko Acked-by: Vlastimil Babka Cc: Dave Chinner Cc: Theodore Ts'o Cc: Chris Mason Cc: David Sterba Cc: Jan Kara Cc: Brian Foster Cc: Darrick J. Wong Cc: Nikolay Borisov Cc: Peter Zijlstra Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/xfs/kmem.h | 2 +- include/linux/gfp.h | 8 ++++++++ include/linux/sched.h | 8 +++----- include/linux/sched/mm.h | 26 +++++++++++++++++++++++--- kernel/locking/lockdep.c | 6 +++--- mm/page_alloc.c | 10 ++++++---- mm/vmscan.c | 6 +++--- 7 files changed, 47 insertions(+), 19 deletions(-) commit 9070733b4efac4bf17f299a81b01c15e206f9ff5 Author: Michal Hocko Date: Wed May 3 14:53:12 2017 -0700 xfs: abstract PF_FSTRANS to PF_MEMALLOC_NOFS xfs has defined PF_FSTRANS to declare a scope GFP_NOFS semantic quite some time ago. We would like to make this concept more generic and use it for other filesystems as well. Let's start by giving the flag a more generic name PF_MEMALLOC_NOFS which is in line with an exiting PF_MEMALLOC_NOIO already used for the same purpose for GFP_NOIO contexts. Replace all PF_FSTRANS usage from the xfs code in the first step before we introduce a full API for it as xfs uses the flag directly anyway. This patch doesn't introduce any functional change. Link: http://lkml.kernel.org/r/20170306131408.9828-4-mhocko@kernel.org Signed-off-by: Michal Hocko Reviewed-by: Darrick J. Wong Reviewed-by: Brian Foster Acked-by: Vlastimil Babka Cc: Dave Chinner Cc: Theodore Ts'o Cc: Chris Mason Cc: David Sterba Cc: Jan Kara Cc: Nikolay Borisov Cc: Peter Zijlstra Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/xfs/kmem.c | 4 ++-- fs/xfs/kmem.h | 2 +- fs/xfs/libxfs/xfs_btree.c | 2 +- fs/xfs/xfs_aops.c | 6 +++--- fs/xfs/xfs_trans.c | 12 ++++++------ include/linux/sched.h | 2 ++ 6 files changed, 15 insertions(+), 13 deletions(-) commit 7e7844226f1053236b6f6d5d122a06509fb14fd9 Author: Michal Hocko Date: Wed May 3 14:53:09 2017 -0700 lockdep: allow to disable reclaim lockup detection The current implementation of the reclaim lockup detection can lead to false positives and those even happen and usually lead to tweak the code to silence the lockdep by using GFP_NOFS even though the context can use __GFP_FS just fine. See http://lkml.kernel.org/r/20160512080321.GA18496@dastard as an example. ================================= [ INFO: inconsistent lock state ] 4.5.0-rc2+ #4 Tainted: G O --------------------------------- inconsistent {RECLAIM_FS-ON-R} -> {IN-RECLAIM_FS-W} usage. kswapd0/543 [HC0[0]:SC0[0]:HE1:SE1] takes: (&xfs_nondir_ilock_class){++++-+}, at: xfs_ilock+0x177/0x200 [xfs] {RECLAIM_FS-ON-R} state was registered at: mark_held_locks+0x79/0xa0 lockdep_trace_alloc+0xb3/0x100 kmem_cache_alloc+0x33/0x230 kmem_zone_alloc+0x81/0x120 [xfs] xfs_refcountbt_init_cursor+0x3e/0xa0 [xfs] __xfs_refcount_find_shared+0x75/0x580 [xfs] xfs_refcount_find_shared+0x84/0xb0 [xfs] xfs_getbmap+0x608/0x8c0 [xfs] xfs_vn_fiemap+0xab/0xc0 [xfs] do_vfs_ioctl+0x498/0x670 SyS_ioctl+0x79/0x90 entry_SYSCALL_64_fastpath+0x12/0x6f CPU0 ---- lock(&xfs_nondir_ilock_class); lock(&xfs_nondir_ilock_class); *** DEADLOCK *** 3 locks held by kswapd0/543: stack backtrace: CPU: 0 PID: 543 Comm: kswapd0 Tainted: G O 4.5.0-rc2+ #4 Call Trace: lock_acquire+0xd8/0x1e0 down_write_nested+0x5e/0xc0 xfs_ilock+0x177/0x200 [xfs] xfs_reflink_cancel_cow_range+0x150/0x300 [xfs] xfs_fs_evict_inode+0xdc/0x1e0 [xfs] evict+0xc5/0x190 dispose_list+0x39/0x60 prune_icache_sb+0x4b/0x60 super_cache_scan+0x14f/0x1a0 shrink_slab.part.63.constprop.79+0x1e9/0x4e0 shrink_zone+0x15e/0x170 kswapd+0x4f1/0xa80 kthread+0xf2/0x110 ret_from_fork+0x3f/0x70 To quote Dave: "Ignoring whether reflink should be doing anything or not, that's a "xfs_refcountbt_init_cursor() gets called both outside and inside transactions" lockdep false positive case. The problem here is lockdep has seen this allocation from within a transaction, hence a GFP_NOFS allocation, and now it's seeing it in a GFP_KERNEL context. Also note that we have an active reference to this inode. So, because the reclaim annotations overload the interrupt level detections and it's seen the inode ilock been taken in reclaim ("interrupt") context, this triggers a reclaim context warning where it thinks it is unsafe to do this allocation in GFP_KERNEL context holding the inode ilock..." This sounds like a fundamental problem of the reclaim lock detection. It is really impossible to annotate such a special usecase IMHO unless the reclaim lockup detection is reworked completely. Until then it is much better to provide a way to add "I know what I am doing flag" and mark problematic places. This would prevent from abusing GFP_NOFS flag which has a runtime effect even on configurations which have lockdep disabled. Introduce __GFP_NOLOCKDEP flag which tells the lockdep gfp tracking to skip the current allocation request. While we are at it also make sure that the radix tree doesn't accidentaly override tags stored in the upper part of the gfp_mask. Link: http://lkml.kernel.org/r/20170306131408.9828-3-mhocko@kernel.org Signed-off-by: Michal Hocko Suggested-by: Peter Zijlstra Acked-by: Peter Zijlstra (Intel) Acked-by: Vlastimil Babka Cc: Dave Chinner Cc: Theodore Ts'o Cc: Chris Mason Cc: David Sterba Cc: Jan Kara Cc: Brian Foster Cc: Darrick J. Wong Cc: Nikolay Borisov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/gfp.h | 10 +++++++++- kernel/locking/lockdep.c | 4 ++++ lib/radix-tree.c | 2 ++ 3 files changed, 15 insertions(+), 1 deletion(-) commit 6d7225f0cc1a1fc32cf5dd01b4ab4b8a34c7cdb4 Author: Nikolay Borisov Date: Wed May 3 14:53:05 2017 -0700 lockdep: teach lockdep about memalloc_noio_save Patch series "scope GFP_NOFS api", v5. This patch (of 7): Commit 21caf2fc1931 ("mm: teach mm by current context info to not do I/O during memory allocation") added the memalloc_noio_(save|restore) functions to enable people to modify the MM behavior by disabling I/O during memory allocation. This was further extended in commit 934f3072c17c ("mm: clear __GFP_FS when PF_MEMALLOC_NOIO is set"). memalloc_noio_* functions prevent allocation paths recursing back into the filesystem without explicitly changing the flags for every allocation site. However, lockdep hasn't been keeping up with the changes and it entirely misses handling the memalloc_noio adjustments. Instead, it is left to the callers of __lockdep_trace_alloc to call the function after they have shaven the respective GFP flags which can lead to false positives: ================================= [ INFO: inconsistent lock state ] 4.10.0-nbor #134 Not tainted --------------------------------- inconsistent {IN-RECLAIM_FS-W} -> {RECLAIM_FS-ON-W} usage. fsstress/3365 [HC0[0]:SC0[0]:HE1:SE1] takes: (&xfs_nondir_ilock_class){++++?.}, at: xfs_ilock+0x141/0x230 {IN-RECLAIM_FS-W} state was registered at: __lock_acquire+0x62a/0x17c0 lock_acquire+0xc5/0x220 down_write_nested+0x4f/0x90 xfs_ilock+0x141/0x230 xfs_reclaim_inode+0x12a/0x320 xfs_reclaim_inodes_ag+0x2c8/0x4e0 xfs_reclaim_inodes_nr+0x33/0x40 xfs_fs_free_cached_objects+0x19/0x20 super_cache_scan+0x191/0x1a0 shrink_slab+0x26f/0x5f0 shrink_node+0xf9/0x2f0 kswapd+0x356/0x920 kthread+0x10c/0x140 ret_from_fork+0x31/0x40 irq event stamp: 173777 hardirqs last enabled at (173777): __local_bh_enable_ip+0x70/0xc0 hardirqs last disabled at (173775): __local_bh_enable_ip+0x37/0xc0 softirqs last enabled at (173776): _xfs_buf_find+0x67a/0xb70 softirqs last disabled at (173774): _xfs_buf_find+0x5db/0xb70 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&xfs_nondir_ilock_class); lock(&xfs_nondir_ilock_class); *** DEADLOCK *** 4 locks held by fsstress/3365: #0: (sb_writers#10){++++++}, at: mnt_want_write+0x24/0x50 #1: (&sb->s_type->i_mutex_key#12){++++++}, at: vfs_setxattr+0x6f/0xb0 #2: (sb_internal#2){++++++}, at: xfs_trans_alloc+0xfc/0x140 #3: (&xfs_nondir_ilock_class){++++?.}, at: xfs_ilock+0x141/0x230 stack backtrace: CPU: 0 PID: 3365 Comm: fsstress Not tainted 4.10.0-nbor #134 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 Call Trace: kmem_cache_alloc_node_trace+0x3a/0x2c0 vm_map_ram+0x2a1/0x510 _xfs_buf_map_pages+0x77/0x140 xfs_buf_get_map+0x185/0x2a0 xfs_attr_rmtval_set+0x233/0x430 xfs_attr_leaf_addname+0x2d2/0x500 xfs_attr_set+0x214/0x420 xfs_xattr_set+0x59/0xb0 __vfs_setxattr+0x76/0xa0 __vfs_setxattr_noperm+0x5e/0xf0 vfs_setxattr+0xae/0xb0 setxattr+0x15e/0x1a0 path_setxattr+0x8f/0xc0 SyS_lsetxattr+0x11/0x20 entry_SYSCALL_64_fastpath+0x23/0xc6 Let's fix this by making lockdep explicitly do the shaving of respective GFP flags. Fixes: 934f3072c17c ("mm: clear __GFP_FS when PF_MEMALLOC_NOIO is set") Link: http://lkml.kernel.org/r/20170306131408.9828-2-mhocko@kernel.org Signed-off-by: Nikolay Borisov Signed-off-by: Michal Hocko Acked-by: Peter Zijlstra (Intel) Cc: Dave Chinner Cc: Theodore Ts'o Cc: Chris Mason Cc: David Sterba Cc: Jan Kara Cc: Brian Foster Cc: Darrick J. Wong Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds kernel/locking/lockdep.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 7dfb8bf3b9caef4049bee51d2c22e1c3a311d483 Author: David Rientjes Date: Wed May 3 14:53:02 2017 -0700 mm, vmstat: suppress pcp stats for unpopulated zones in zoneinfo After "mm, vmstat: print non-populated zones in zoneinfo", /proc/zoneinfo will show unpopulated zones. The per-cpu pageset statistics are not relevant for unpopulated zones and can be potentially lengthy, so supress them when they are not interesting. Also moves lowmem reserve protection information above pcp stats since it is relevant for all zones per vm.lowmem_reserve_ratio. Link: http://lkml.kernel.org/r/alpine.DEB.2.10.1703061400500.46428@chino.kir.corp.google.com Signed-off-by: David Rientjes Cc: Anshuman Khandual Cc: Vlastimil Babka Cc: Mel Gorman Cc: Johannes Weiner Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/vmstat.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) commit b2bd8598195f1b2a72130592125ac6b4218988a2 Author: David Rientjes Date: Wed May 3 14:52:59 2017 -0700 mm, vmstat: print non-populated zones in zoneinfo Initscripts can use the information (protection levels) from /proc/zoneinfo to configure vm.lowmem_reserve_ratio at boot. vm.lowmem_reserve_ratio is an array of ratios for each configured zone on the system. If a zone is not populated on an arch, /proc/zoneinfo suppresses its output. This results in there not being a 1:1 mapping between the set of zones emitted by /proc/zoneinfo and the zones configured by vm.lowmem_reserve_ratio. This patch shows statistics for non-populated zones in /proc/zoneinfo. The zones exist and hold a spot in the vm.lowmem_reserve_ratio array. Without this patch, it is not possible to determine which index in the array controls which zone if one or more zones on the system are not populated. Remaining users of walk_zones_in_node() are unchanged. Files such as /proc/pagetypeinfo require certain zone data to be initialized properly for display, which is not done for unpopulated zones. Link: http://lkml.kernel.org/r/alpine.DEB.2.10.1703031451310.98023@chino.kir.corp.google.com Signed-off-by: David Rientjes Reviewed-by: Anshuman Khandual Cc: Vlastimil Babka Cc: Mel Gorman Cc: Johannes Weiner Cc: Michal Hocko Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/vmstat.c | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-) commit bbf9ce9719b5c64eac7f8483d1da6e8a3d4f98f5 Author: Xishi Qiu Date: Wed May 3 14:52:55 2017 -0700 mm: use is_migrate_isolate_page() to simplify the code Use is_migrate_isolate_page() to simplify the code, no functional changes. Link: http://lkml.kernel.org/r/58B94FB1.8020802@huawei.com Signed-off-by: Xishi Qiu Acked-by: Michal Hocko Cc: Vlastimil Babka Cc: Mel Gorman Cc: Minchan Kim Cc: Joonsoo Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/page_isolation.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit a6ffdc07847e74cc244c02ab6d0351a4a5d77281 Author: Xishi Qiu Date: Wed May 3 14:52:52 2017 -0700 mm: use is_migrate_highatomic() to simplify the code Introduce two helpers, is_migrate_highatomic() and is_migrate_highatomic_page(). Simplify the code, no functional changes. [akpm@linux-foundation.org: use static inlines rather than macros, per mhocko] Link: http://lkml.kernel.org/r/58B94F15.6060606@huawei.com Signed-off-by: Xishi Qiu Acked-by: Michal Hocko Cc: Vlastimil Babka Cc: Mel Gorman Cc: Minchan Kim Cc: Joonsoo Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/mmzone.h | 2 +- mm/internal.h | 10 ++++++++++ mm/page_alloc.c | 14 ++++++-------- 3 files changed, 17 insertions(+), 9 deletions(-) commit 322b8afe4a65906c133102532e63a278775cc5f0 Author: Huang Ying Date: Wed May 3 14:52:49 2017 -0700 mm, swap: Fix a race in free_swap_and_cache() Before using cluster lock in free_swap_and_cache(), the swap_info_struct->lock will be held during freeing the swap entry and acquiring page lock, so the page swap count will not change when testing page information later. But after using cluster lock, the cluster lock (or swap_info_struct->lock) will be held only during freeing the swap entry. So before acquiring the page lock, the page swap count may be changed in another thread. If the page swap count is not 0, we should not delete the page from the swap cache. This is fixed via checking page swap count again after acquiring the page lock. I found the race when I review the code, so I didn't trigger the race via a test program. If the race occurs for an anonymous page shared by multiple processes via fork, multiple pages will be allocated and swapped in from the swap device for the previously shared one page. That is, the user-visible runtime effect is more memory will be used and the access latency for the page will be higher, that is, the performance regression. Link: http://lkml.kernel.org/r/20170301143905.12846-1-ying.huang@intel.com Signed-off-by: "Huang, Ying" Cc: Hugh Dickins Cc: Shaohua Li Cc: Minchan Kim Cc: Rik van Riel Cc: Tim Chen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/swapfile.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-) commit 9a4caf1e9fa4864ce21ba9584a2c336bfbc72740 Author: Johannes Weiner Date: Wed May 3 14:52:45 2017 -0700 mm: memcontrol: provide shmem statistics Cgroups currently don't report how much shmem they use, which can be useful data to have, in particular since shmem is included in the cache/file item while being reclaimed like anonymous memory. Add a counter to track shmem pages during charging and uncharging. Link: http://lkml.kernel.org/r/20170221164343.32252-1-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Reported-by: Chris Down Cc: Michal Hocko Cc: Vladimir Davydov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Documentation/cgroup-v2.txt | 5 +++++ include/linux/memcontrol.h | 1 + mm/memcontrol.c | 28 ++++++++++++++++++++-------- 3 files changed, 26 insertions(+), 8 deletions(-) commit cf8496ea8020792ea32d0fbec0c140d8de93011a Author: Shaohua Li Date: Wed May 3 14:52:42 2017 -0700 proc: show MADV_FREE pages info in smaps Show MADV_FREE pages info of each vma in smaps. The interface is for diganose or monitoring purpose, userspace could use it to understand what happens in the application. Since userspace could dirty MADV_FREE pages without notice from kernel, this interface is the only place we can get accurate accounting info about MADV_FREE pages. [mhocko@kernel.org: update Documentation/filesystems/proc.txt] Link: http://lkml.kernel.org/r/89efde633559de1ec07444f2ef0f4963a97a2ce8.1487965799.git.shli@fb.com Signed-off-by: Shaohua Li Acked-by: Johannes Weiner Acked-by: Minchan Kim Acked-by: Michal Hocko Acked-by: Hillf Danton Cc: Hugh Dickins Cc: Rik van Riel Cc: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Documentation/filesystems/proc.txt | 6 ++++++ fs/proc/task_mmu.c | 8 +++++++- 2 files changed, 13 insertions(+), 1 deletion(-) commit 93e06c7a645343d222c9a838834a51042eebbbf7 Author: Shaohua Li Date: Wed May 3 14:52:39 2017 -0700 mm: enable MADV_FREE for swapless system Now MADV_FREE pages can be easily reclaimed even for swapless system. We can safely enable MADV_FREE for all systems. Link: http://lkml.kernel.org/r/155648585589300bfae1d45078e7aebb3d988b87.1487965799.git.shli@fb.com Signed-off-by: Shaohua Li Acked-by: Johannes Weiner Acked-by: Michal Hocko Acked-by: Hillf Danton Acked-by: Minchan Kim Cc: Hugh Dickins Cc: Rik van Riel Cc: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/madvise.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) commit eb94a8784427b28479f871b5d4121c547808d0fc Author: Minchan Kim Date: Wed May 3 14:52:36 2017 -0700 mm: fix lazyfree BUG_ON check in try_to_unmap_one() If a page is swapbacked, it means it should be in swapcache in try_to_unmap_one's path. If a page is !swapbacked, it mean it shouldn't be in swapcache in try_to_unmap_one's path. Check both two cases all at once and if it fails, warn and return SWAP_FAIL. Such bug never mean we should shut down the kernel. [minchan@kernel.org: do not use VM_WARN_ON_ONCE as if condition[ Link: http://lkml.kernel.org/r/20170309060226.GB854@bbox Link: http://lkml.kernel.org/r/20170307055551.GC29458@bbox Signed-off-by: Minchan Kim Suggested-by: Johannes Weiner Acked-by: Michal Hocko Acked-by: Johannes Weiner Cc: Shaohua Li Cc: Hillf Danton Cc: Hugh Dickins Cc: Rik van Riel Cc: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/rmap.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 802a3a92ad7ac0b9be9df229dee530a1f0a8039b Author: Shaohua Li Date: Wed May 3 14:52:32 2017 -0700 mm: reclaim MADV_FREE pages When memory pressure is high, we free MADV_FREE pages. If the pages are not dirty in pte, the pages could be freed immediately. Otherwise we can't reclaim them. We put the pages back to anonumous LRU list (by setting SwapBacked flag) and the pages will be reclaimed in normal swapout way. We use normal page reclaim policy. Since MADV_FREE pages are put into inactive file list, such pages and inactive file pages are reclaimed according to their age. This is expected, because we don't want to reclaim too many MADV_FREE pages before used once pages. Based on Minchan's original patch [minchan@kernel.org: clean up lazyfree page handling] Link: http://lkml.kernel.org/r/20170303025237.GB3503@bbox Link: http://lkml.kernel.org/r/14b8eb1d3f6bf6cc492833f183ac8c304e560484.1487965799.git.shli@fb.com Signed-off-by: Shaohua Li Signed-off-by: Minchan Kim Acked-by: Minchan Kim Acked-by: Michal Hocko Acked-by: Johannes Weiner Acked-by: Hillf Danton Cc: Hugh Dickins Cc: Rik van Riel Cc: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/rmap.h | 2 +- mm/huge_memory.c | 2 ++ mm/madvise.c | 1 + mm/rmap.c | 46 ++++++++++++++++++++-------------------------- mm/vmscan.c | 34 ++++++++++++++++++++++------------ 5 files changed, 46 insertions(+), 39 deletions(-) commit f7ad2a6cb9f7c4040004bedee84a70a9b985583e Author: Shaohua Li Date: Wed May 3 14:52:29 2017 -0700 mm: move MADV_FREE pages into LRU_INACTIVE_FILE list madv()'s MADV_FREE indicate pages are 'lazyfree'. They are still anonymous pages, but they can be freed without pageout. To distinguish these from normal anonymous pages, we clear their SwapBacked flag. MADV_FREE pages could be freed without pageout, so they pretty much like used once file pages. For such pages, we'd like to reclaim them once there is memory pressure. Also it might be unfair reclaiming MADV_FREE pages always before used once file pages and we definitively want to reclaim the pages before other anonymous and file pages. To speed up MADV_FREE pages reclaim, we put the pages into LRU_INACTIVE_FILE list. The rationale is LRU_INACTIVE_FILE list is tiny nowadays and should be full of used once file pages. Reclaiming MADV_FREE pages will not have much interfere of anonymous and active file pages. And the inactive file pages and MADV_FREE pages will be reclaimed according to their age, so we don't reclaim too many MADV_FREE pages too. Putting the MADV_FREE pages into LRU_INACTIVE_FILE_LIST also means we can reclaim the pages without swap support. This idea is suggested by Johannes. This patch doesn't move MADV_FREE pages to LRU_INACTIVE_FILE list yet to avoid bisect failure, next patch will do it. The patch is based on Minchan's original patch. [akpm@linux-foundation.org: coding-style fixes] Link: http://lkml.kernel.org/r/2f87063c1e9354677b7618c647abde77b07561e5.1487965799.git.shli@fb.com Signed-off-by: Shaohua Li Suggested-by: Johannes Weiner Acked-by: Johannes Weiner Acked-by: Minchan Kim Acked-by: Michal Hocko Acked-by: Hillf Danton Cc: Hugh Dickins Cc: Rik van Riel Cc: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/swap.h | 2 +- include/linux/vm_event_item.h | 2 +- mm/huge_memory.c | 3 --- mm/madvise.c | 2 -- mm/swap.c | 49 ++++++++++++++++++++++++------------------- mm/vmstat.c | 1 + 6 files changed, 31 insertions(+), 28 deletions(-) commit d44d363f65780f2ac2ec672164555af54896d40d Author: Shaohua Li Date: Wed May 3 14:52:26 2017 -0700 mm: don't assume anonymous pages have SwapBacked flag There are a few places the code assumes anonymous pages should have SwapBacked flag set. MADV_FREE pages are anonymous pages but we are going to add them to LRU_INACTIVE_FILE list and clear SwapBacked flag for them. The assumption doesn't hold any more, so fix them. Link: http://lkml.kernel.org/r/3945232c0df3dd6c4ef001976f35a95f18dcb407.1487965799.git.shli@fb.com Signed-off-by: Shaohua Li Acked-by: Johannes Weiner Acked-by: Hillf Danton Cc: Michal Hocko Cc: Minchan Kim Cc: Hugh Dickins Cc: Rik van Riel Cc: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/huge_memory.c | 1 - mm/khugepaged.c | 8 +++----- mm/migrate.c | 3 ++- mm/rmap.c | 3 ++- 4 files changed, 7 insertions(+), 8 deletions(-) commit a128ca71fb29ed4444b80f38a0148b468826e19b Author: Shaohua Li Date: Wed May 3 14:52:22 2017 -0700 mm: delete unnecessary TTU_* flags Patch series "mm: fix some MADV_FREE issues", v5. We are trying to use MADV_FREE in jemalloc. Several issues are found. Without solving the issues, jemalloc can't use the MADV_FREE feature. - Doesn't support system without swap enabled. Because if swap is off, we can't or can't efficiently age anonymous pages. And since MADV_FREE pages are mixed with other anonymous pages, we can't reclaim MADV_FREE pages. In current implementation, MADV_FREE will fallback to MADV_DONTNEED without swap enabled. But in our environment, a lot of machines don't enable swap. This will prevent our setup using MADV_FREE. - Increases memory pressure. page reclaim bias file pages reclaim against anonymous pages. This doesn't make sense for MADV_FREE pages, because those pages could be freed easily and refilled with very slight penality. Even page reclaim doesn't bias file pages, there is still an issue, because MADV_FREE pages and other anonymous pages are mixed together. To reclaim a MADV_FREE page, we probably must scan a lot of other anonymous pages, which is inefficient. In our test, we usually see oom with MADV_FREE enabled and nothing without it. - Accounting. There are two accounting problems. We don't have a global accounting. If the system is abnormal, we don't know if it's a problem from MADV_FREE side. The other problem is RSS accounting. MADV_FREE pages are accounted as normal anon pages and reclaimed lazily, so application's RSS becomes bigger. This confuses our workloads. We have monitoring daemon running and if it finds applications' RSS becomes abnormal, the daemon will kill the applications even kernel can reclaim the memory easily. To address the first the two issues, we can either put MADV_FREE pages into a separate LRU list (Minchan's previous patches and V1 patches), or put them into LRU_INACTIVE_FILE list (suggested by Johannes). The patchset use the second idea. The reason is LRU_INACTIVE_FILE list is tiny nowadays and should be full of used once file pages. So we can still efficiently reclaim MADV_FREE pages there without interference with other anon and active file pages. Putting the pages into inactive file list also has an advantage which allows page reclaim to prioritize MADV_FREE pages and used once file pages. MADV_FREE pages are put into the lru list and clear SwapBacked flag, so PageAnon(page) && !PageSwapBacked(page) will indicate a MADV_FREE pages. These pages will directly freed without pageout if they are clean, otherwise normal swap will reclaim them. For the third issue, the previous post adds global accounting and a separate RSS count for MADV_FREE pages. The problem is we never get accurate accounting for MADV_FREE pages. The pages are mapped to userspace, can be dirtied without notice from kernel side. To get accurate accounting, we could write protect the page, but then there is extra page fault overhead, which people don't want to pay. Jemalloc guys have concerns about the inaccurate accounting, so this post drops the accounting patches temporarily. The info exported to /proc/pid/smaps for MADV_FREE pages are kept, which is the only place we can get accurate accounting right now. This patch (of 6): Johannes pointed out TTU_LZFREE is unnecessary. It's true because we always have the flag set if we want to do an unmap. For cases we don't do an unmap, the TTU_LZFREE part of code should never run. Also the TTU_UNMAP is unnecessary. If no other flags set (for example, TTU_MIGRATION), an unmap is implied. The patch includes Johannes's cleanup and dead TTU_ACTION macro removal code Link: http://lkml.kernel.org/r/4be3ea1bc56b26fd98a54d0a6f70bec63f6d8980.1487965799.git.shli@fb.com Signed-off-by: Shaohua Li Suggested-by: Johannes Weiner Acked-by: Johannes Weiner Acked-by: Minchan Kim Acked-by: Hillf Danton Acked-by: Michal Hocko Cc: Hugh Dickins Cc: Rik van Riel Cc: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/rmap.h | 22 +++++++++------------- mm/memory-failure.c | 2 +- mm/rmap.c | 2 +- mm/vmscan.c | 11 ++++------- 4 files changed, 15 insertions(+), 22 deletions(-) commit 0a372d09cca6a71610af6a353617dbb90facde76 Author: Geliang Tang Date: Wed May 3 14:52:19 2017 -0700 mm/page-writeback.c: use setup_deferrable_timer Use setup_deferrable_timer() instead of init_timer_deferrable() to simplify the code. Link: http://lkml.kernel.org/r/e8e3d4280a34facbc007346f31df833cec28801e.1488070291.git.geliangtang@gmail.com Signed-off-by: Geliang Tang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/page-writeback.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 491d79ae778f24dbf65f1f2178d4744d940d4093 Author: Johannes Weiner Date: Wed May 3 14:52:16 2017 -0700 mm: remove unnecessary back-off function when retrying page reclaim The backoff mechanism is not needed. If we have MAX_RECLAIM_RETRIES loops without progress, we'll OOM anyway; backing off might cut one or two iterations off that in the rare OOM case. If we have intermittent success reclaiming a few pages, the backoff function gets reset also, and so is of little help in these scenarios. We might want a backoff function for when there IS progress, but not enough to be satisfactory. But this isn't that. Remove it. Link: http://lkml.kernel.org/r/20170228214007.5621-10-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Hillf Danton Acked-by: Michal Hocko Cc: Jia He Cc: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/page_alloc.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) commit 3db65812d68883d1acfd20a9f2bc2cd13a7cd5c5 Author: Johannes Weiner Date: Wed May 3 14:52:13 2017 -0700 Revert "mm, vmscan: account for skipped pages as a partial scan" This reverts commit d7f05528eedb047efe2288cff777676b028747b6. Now that reclaimability of a node is no longer based on the ratio between pages scanned and theoretically reclaimable pages, we can remove accounting tricks for pages skipped due to zone constraints. Link: http://lkml.kernel.org/r/20170228214007.5621-9-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Hillf Danton Acked-by: Michal Hocko Cc: Jia He Cc: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/vmscan.c | 22 ++++------------------ 1 file changed, 4 insertions(+), 18 deletions(-) commit c822f6223d03c2c5b026a21da09c6b6d523258cd Author: Johannes Weiner Date: Wed May 3 14:52:10 2017 -0700 mm: delete NR_PAGES_SCANNED and pgdat_reclaimable() NR_PAGES_SCANNED counts number of pages scanned since the last page free event in the allocator. This was used primarily to measure the reclaimability of zones and nodes, and determine when reclaim should give up on them. In that role, it has been replaced in the preceding patches by a different mechanism. Being implemented as an efficient vmstat counter, it was automatically exported to userspace as well. It's however unlikely that anyone outside the kernel is using this counter in any meaningful way. Remove the counter and the unused pgdat_reclaimable(). Link: http://lkml.kernel.org/r/20170228214007.5621-8-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Hillf Danton Acked-by: Michal Hocko Cc: Jia He Cc: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/mmzone.h | 1 - mm/internal.h | 1 - mm/page_alloc.c | 11 ----------- mm/vmscan.c | 9 --------- mm/vmstat.c | 22 +++------------------- 5 files changed, 3 insertions(+), 41 deletions(-) commit 688035f729dcd9a98152c827338805a061f5c6fa Author: Johannes Weiner Date: Wed May 3 14:52:07 2017 -0700 mm: don't avoid high-priority reclaim on memcg limit reclaim Commit 246e87a93934 ("memcg: fix get_scan_count() for small targets") sought to avoid high reclaim priorities for memcg by forcing it to scan a minimum amount of pages when lru_pages >> priority yielded nothing. This was done at a time when reclaim decisions like dirty throttling were tied to the priority level. Nowadays, the only meaningful thing still tied to priority dropping below DEF_PRIORITY - 2 is gating whether laptop_mode=1 is generally allowed to write. But that is from an era where direct reclaim was still allowed to call ->writepage, and kswapd nowadays avoids writes until it's scanned every clean page in the system. Potential changes to how quick sc->may_writepage could trigger are of little concern. Remove the force_scan stuff, as well as the ugly multi-pass target calculation that it necessitated. Link: http://lkml.kernel.org/r/20170228214007.5621-7-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Hillf Danton Acked-by: Michal Hocko Cc: Jia He Cc: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/vmscan.c | 94 ++++++++++++++++++++++++------------------------------------- 1 file changed, 37 insertions(+), 57 deletions(-) commit a2d7f8e461881394167bafb616112a96f5f567d0 Author: Johannes Weiner Date: Wed May 3 14:52:03 2017 -0700 mm: don't avoid high-priority reclaim on unreclaimable nodes Commit 246e87a93934 ("memcg: fix get_scan_count() for small targets") sought to avoid high reclaim priorities for kswapd by forcing it to scan a minimum amount of pages when lru_pages >> priority yielded nothing. Commit b95a2f2d486d ("mm: vmscan: convert global reclaim to per-memcg LRU lists"), due to switching global reclaim to a round-robin scheme over all cgroups, had to restrict this forceful behavior to unreclaimable zones in order to prevent massive overreclaim with many cgroups. The latter patch effectively neutered the behavior completely for all but extreme memory pressure. But in those situations we might as well drop the reclaimers to lower priority levels. Remove the check. Link: http://lkml.kernel.org/r/20170228214007.5621-6-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Hillf Danton Acked-by: Michal Hocko Cc: Jia He Cc: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/vmscan.c | 19 +++++-------------- 1 file changed, 5 insertions(+), 14 deletions(-) commit 15038d0de9eca33f66bc1fed4243914906e04de4 Author: Johannes Weiner Date: Wed May 3 14:52:00 2017 -0700 mm: remove unnecessary reclaimability check from NUMA balancing target NUMA balancing already checks the watermarks of the target node to decide whether it's a suitable balancing target. Whether the node is reclaimable or not is irrelevant when we don't intend to reclaim. Link: http://lkml.kernel.org/r/20170228214007.5621-5-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Hillf Danton Acked-by: Michal Hocko Cc: Jia He Cc: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/migrate.c | 3 --- 1 file changed, 3 deletions(-) commit 047d72c30eedcb953222810f1e7dcaae663aa452 Author: Johannes Weiner Date: Wed May 3 14:51:57 2017 -0700 mm: remove seemingly spurious reclaimability check from laptop_mode gating Commit 1d82de618ddd ("mm, vmscan: make kswapd reclaim in terms of nodes") allowed laptop_mode=1 to start writing not just when the priority drops to DEF_PRIORITY - 2 but also when the node is unreclaimable. That appears to be a spurious change in this patch as I doubt the series was tested with laptop_mode, and neither is that particular change mentioned in the changelog. Remove it, it's still recent. Link: http://lkml.kernel.org/r/20170228214007.5621-4-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Hillf Danton Acked-by: Mel Gorman Acked-by: Michal Hocko Cc: Jia He Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/vmscan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d450abd81b081d45adb12f303a07dd44b15eb1bc Author: Johannes Weiner Date: Wed May 3 14:51:54 2017 -0700 mm: fix check for reclaimable pages in PF_MEMALLOC reclaim throttling PF_MEMALLOC direct reclaimers get throttled on a node when the sum of all free pages in each zone fall below half the min watermark. During the summation, we want to exclude zones that don't have reclaimables. Checking the same pgdat over and over again doesn't make sense. Fixes: 599d0c954f91 ("mm, vmscan: move LRU lists to node") Link: http://lkml.kernel.org/r/20170228214007.5621-3-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Acked-by: Hillf Danton Acked-by: Michal Hocko Cc: Jia He Cc: Mel Gorman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/vmscan.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit c73322d098e4b6f5f0f0fa1330bf57e218775539 Author: Johannes Weiner Date: Wed May 3 14:51:51 2017 -0700 mm: fix 100% CPU kswapd busyloop on unreclaimable nodes Patch series "mm: kswapd spinning on unreclaimable nodes - fixes and cleanups". Jia reported a scenario in which the kswapd of a node indefinitely spins at 100% CPU usage. We have seen similar cases at Facebook. The kernel's current method of judging its ability to reclaim a node (or whether to back off and sleep) is based on the amount of scanned pages in proportion to the amount of reclaimable pages. In Jia's and our scenarios, there are no reclaimable pages in the node, however, and the condition for backing off is never met. Kswapd busyloops in an attempt to restore the watermarks while having nothing to work with. This series reworks the definition of an unreclaimable node based not on scanning but on whether kswapd is able to actually reclaim pages in MAX_RECLAIM_RETRIES (16) consecutive runs. This is the same criteria the page allocator uses for giving up on direct reclaim and invoking the OOM killer. If it cannot free any pages, kswapd will go to sleep and leave further attempts to direct reclaim invocations, which will either make progress and re-enable kswapd, or invoke the OOM killer. Patch #1 fixes the immediate problem Jia reported, the remainder are smaller fixlets, cleanups, and overall phasing out of the old method. Patch #6 is the odd one out. It's a nice cleanup to get_scan_count(), and directly related to #5, but in itself not relevant to the series. If the whole series is too ambitious for 4.11, I would consider the first three patches fixes, the rest cleanups. This patch (of 9): Jia He reports a problem with kswapd spinning at 100% CPU when requesting more hugepages than memory available in the system: $ echo 4000 >/proc/sys/vm/nr_hugepages top - 13:42:59 up 3:37, 1 user, load average: 1.09, 1.03, 1.01 Tasks: 1 total, 1 running, 0 sleeping, 0 stopped, 0 zombie %Cpu(s): 0.0 us, 12.5 sy, 0.0 ni, 85.5 id, 2.0 wa, 0.0 hi, 0.0 si, 0.0 st KiB Mem: 31371520 total, 30915136 used, 456384 free, 320 buffers KiB Swap: 6284224 total, 115712 used, 6168512 free. 48192 cached Mem PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 76 root 20 0 0 0 0 R 100.0 0.000 217:17.29 kswapd3 At that time, there are no reclaimable pages left in the node, but as kswapd fails to restore the high watermarks it refuses to go to sleep. Kswapd needs to back away from nodes that fail to balance. Up until commit 1d82de618ddd ("mm, vmscan: make kswapd reclaim in terms of nodes") kswapd had such a mechanism. It considered zones whose theoretically reclaimable pages it had reclaimed six times over as unreclaimable and backed away from them. This guard was erroneously removed as the patch changed the definition of a balanced node. However, simply restoring this code wouldn't help in the case reported here: there *are* no reclaimable pages that could be scanned until the threshold is met. Kswapd would stay awake anyway. Introduce a new and much simpler way of backing off. If kswapd runs through MAX_RECLAIM_RETRIES (16) cycles without reclaiming a single page, make it back off from the node. This is the same number of shots direct reclaim takes before declaring OOM. Kswapd will go to sleep on that node until a direct reclaimer manages to reclaim some pages, thus proving the node reclaimable again. [hannes@cmpxchg.org: check kswapd failure against the cumulative nr_reclaimed count] Link: http://lkml.kernel.org/r/20170306162410.GB2090@cmpxchg.org [shakeelb@google.com: fix condition for throttle_direct_reclaim] Link: http://lkml.kernel.org/r/20170314183228.20152-1-shakeelb@google.com Link: http://lkml.kernel.org/r/20170228214007.5621-2-hannes@cmpxchg.org Signed-off-by: Johannes Weiner Signed-off-by: Shakeel Butt Reported-by: Jia He Tested-by: Jia He Acked-by: Michal Hocko Acked-by: Hillf Danton Acked-by: Minchan Kim Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds include/linux/mmzone.h | 2 ++ mm/internal.h | 6 ++++++ mm/page_alloc.c | 9 ++------- mm/vmscan.c | 47 ++++++++++++++++++++++++++++++++--------------- mm/vmstat.c | 2 +- 5 files changed, 43 insertions(+), 23 deletions(-) commit a87c75fbcc8dc8466be6c4b18a45bcaf315883ab Author: Greg Thelen Date: Wed May 3 14:51:47 2017 -0700 slab: avoid IPIs when creating kmem caches Each slab kmem cache has per cpu array caches. The array caches are created when the kmem_cache is created, either via kmem_cache_create() or lazily when the first object is allocated in context of a kmem enabled memcg. Array caches are replaced by writing to /proc/slabinfo. Array caches are protected by holding slab_mutex or disabling interrupts. Array cache allocation and replacement is done by __do_tune_cpucache() which holds slab_mutex and calls kick_all_cpus_sync() to interrupt all remote processors which confirms there are no references to the old array caches. IPIs are needed when replacing array caches. But when creating a new array cache, there's no need to send IPIs because there cannot be any references to the new cache. Outside of memcg kmem accounting these IPIs occur at boot time, so they're not a problem. But with memcg kmem accounting each container can create kmem caches, so the IPIs are wasteful. Avoid unnecessary IPIs when creating array caches. Test which reports the IPI count of allocating slab in 10000 memcg: import os def ipi_count(): with open("/proc/interrupts") as f: for l in f: if 'Function call interrupts' in l: return int(l.split()[1]) def echo(val, path): with open(path, "w") as f: f.write(val) n = 10000 os.chdir("/mnt/cgroup/memory") pid = str(os.getpid()) a = ipi_count() for i in range(n): os.mkdir(str(i)) echo("1G\n", "%d/memory.limit_in_bytes" % i) echo("1G\n", "%d/memory.kmem.limit_in_bytes" % i) echo(pid, "%d/cgroup.procs" % i) open("/tmp/x", "w").close() os.unlink("/tmp/x") b = ipi_count() print "%d loops: %d => %d (+%d ipis)" % (n, a, b, b-a) echo(pid, "cgroup.procs") for i in range(n): os.rmdir(str(i)) patched: 10000 loops: 1069 => 1170 (+101 ipis) unpatched: 10000 loops: 1192 => 48933 (+47741 ipis) Link: http://lkml.kernel.org/r/20170416214544.109476-1-gthelen@google.com Signed-off-by: Greg Thelen Acked-by: Joonsoo Kim Acked-by: David Rientjes Cc: Christoph Lameter Cc: Pekka Enberg Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds mm/slab.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit d47736fafe779f0843e2d766f76832dec5b672d9 Author: Geliang Tang Date: Wed May 3 14:51:44 2017 -0700 fs/ocfs2/cluster: use offset_in_page() macro Use offset_in_page() macro instead of open-coding. Link: http://lkml.kernel.org/r/4dbc77ccaaed98b183cf4dba58a4fa325fd65048.1492758503.git.geliangtang@gmail.com Signed-off-by: Geliang Tang Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Joseph Qi Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/ocfs2/cluster/tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 33496c3c3d7b88dcbe5e55aa01288b05646c6aca Author: Junxiao Bi Date: Wed May 3 14:51:41 2017 -0700 ocfs2: o2hb: revert hb threshold to keep compatible Configfs is the interface for ocfs2-tools to set configure to kernel and $configfs_dir/cluster/$clustername/heartbeat/dead_threshold is the one used to configure heartbeat dead threshold. Kernel has a default value of it but user can set O2CB_HEARTBEAT_THRESHOLD in /etc/sysconfig/o2cb to override it. Commit 45b997737a80 ("ocfs2/cluster: use per-attribute show and store methods") changed heartbeat dead threshold name while ocfs2-tools did not, so ocfs2-tools won't set this configurable and the default value is always used. So revert it. Fixes: 45b997737a80 ("ocfs2/cluster: use per-attribute show and store methods") Link: http://lkml.kernel.org/r/1490665245-15374-1-git-send-email-junxiao.bi@oracle.com Signed-off-by: Junxiao Bi Acked-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/ocfs2/cluster/heartbeat.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 667b8a37f34b39f752f59f4808762bd5c7688a71 Author: Geliang Tang Date: Wed May 3 14:51:38 2017 -0700 fs/ocfs2/cluster: use setup_timer Use setup_timer() instead of init_timer() to simplify the code. Link: http://lkml.kernel.org/r/5e75bf07beb91e092d5aa36c36769949a480456a.1489060564.git.geliangtang@gmail.com Signed-off-by: Geliang Tang Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds fs/ocfs2/cluster/tcp.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit accce8e7e8b769ec2430bc0f4a8a2b23c68c1837 Author: Masahiro Yamada Date: Wed May 3 14:51:35 2017 -0700 blackfin: bf609: let clk_disable() return immediately if clk is NULL In many of clk_disable() implementations, it is a no-op for a NULL pointer input, but this is one of the exceptions. Making it treewide consistent will allow clock consumers to call clk_disable() without NULL pointer check. Link: http://lkml.kernel.org/r/1490692624-11931-4-git-send-email-yamada.masahiro@socionext.com Signed-off-by: Masahiro Yamada Cc: Stephen Boyd Cc: Ralf Baechle Cc: Michael Turquette Cc: Steven Miao Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds arch/blackfin/mach-bf609/clock.c | 3 +++ 1 file changed, 3 insertions(+) commit 672934d2470133b94df26dd3e4e3f26fbd74ff11 Author: Colin Ian King Date: Wed May 3 14:51:32 2017 -0700 scripts/spelling.txt: add several more common spelling mistakes Here are some of the more common spelling mistakes that I've found while fixing up spelling mistakes in kernel error message text. They probably should be added to this list so we don't keep on seeing them appearing again. Link: http://lkml.kernel.org/r/20170421122534.5378-1-colin.king@canonical.com Signed-off-by: Colin Ian King Acked-by: Kees Cook Cc: Masahiro Yamada Cc: Joe Perches Cc: Stephen Boyd Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds scripts/spelling.txt | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) commit 6a5cd60ba84723c3f6cdb8dbe26a1dc9e26a0a02 Author: Pankaj Gupta Date: Wed May 3 14:51:28 2017 -0700 lib/dma-debug.c: make locking work for RT Interrupt enable/disabled with spinlock is not a valid operation for RT as it can make executing tasks sleep from a non-sleepable context. So convert it to spin_lock_irq[save, restore]. Link: http://lkml.kernel.org/r/1492065666-3816-1-git-send-email-pagupta@redhat.com Signed-off-by: Pankaj Gupta Cc: Ingo Molnar Cc: Niklas Söderlund Cc: Vinod Koul Cc: Andy Lutomirski Cc: Ville Syrjl Cc: Miles Chen Cc: Marcelo Tosatti Cc: Joerg Roedel Cc: Stanislaw Gruszka Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds lib/dma-debug.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) commit a72d4b97bb83c92a25d3eb21cc36b9bf94077c60 Author: Chao Yu Date: Wed May 3 23:59:13 2017 +0800 f2fs: relocate inode_{,un}lock in F2FS_IOC_SETFLAGS This patch expands cover region of inode->i_rwsem to keep setting flag atomically. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/file.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 3adc5fcb7edf5f8dfe8d37dcb50ba6b30077c905 Author: Jan Kara Date: Tue May 2 17:03:47 2017 +0200 f2fs: Make flush bios explicitely sync Commit b685d3d65ac7 "block: treat REQ_FUA and REQ_PREFLUSH as synchronous" removed REQ_SYNC flag from WRITE_{FUA|PREFLUSH|...} definitions. generic_make_request_checks() however strips REQ_FUA and REQ_PREFLUSH flags from a bio when the storage doesn't report volatile write cache and thus write effectively becomes asynchronous which can lead to performance regressions. Fix the problem by making sure all bios which are synchronous are properly marked with REQ_SYNC. Fixes: b685d3d65ac791406e0dfd8779cc9b3707fea5a3 Cc: stable@vger.kernel.org # 4.9+ CC: Jaegeuk Kim CC: linux-f2fs-devel@lists.sourceforge.net Signed-off-by: Jan Kara Acked-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/data.c | 2 +- fs/f2fs/segment.c | 2 +- fs/f2fs/super.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) commit 5b4236e17cc1bd9fa14b2b0c7a4ae632d41f2e20 Author: Masami Hiramatsu Date: Thu Apr 27 12:15:10 2017 +0900 um: Fix to call read_initrd after init_bootmem Since read_initrd() invokes alloc_bootmem() for allocating memory to load initrd image, it must be called after init_bootmem. This makes read_initrd() called directly from setup_arch() after init_bootmem() and mem_total_pages(). Cc: Fixes: b63236972e1 ("um: Setup physical memory in setup_arch()") Signed-off-by: Masami Hiramatsu Signed-off-by: Richard Weinberger arch/um/kernel/initrd.c | 4 +--- arch/um/kernel/um_arch.c | 6 ++++++ 2 files changed, 7 insertions(+), 3 deletions(-) commit 601b7b9147455a4d8d80d04f0e5a1eb222301bbe Author: Matthias Kaehlcke Date: Mon Apr 3 12:54:58 2017 -0700 um: Include kbuild.h instead of duplicating its macros Signed-off-by: Matthias Kaehlcke Reviewed-by: Masahiro Yamada Signed-off-by: Richard Weinberger arch/x86/um/shared/sysdep/kernel-offsets.h | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) commit 9abc74a22d85ab29cef9896a2582a530da7e79bf Author: Richard Weinberger Date: Sat Apr 1 00:41:57 2017 +0200 um: Fix PTRACE_POKEUSER on x86_64 This is broken since ever but sadly nobody noticed. Recent versions of GDB set DR_CONTROL unconditionally and UML dies due to a heap corruption. It turns out that the PTRACE_POKEUSER was copy&pasted from i386 and assumes that addresses are 4 bytes long. Fix that by using 8 as address size in the calculation. Cc: Reported-by: jie cao Signed-off-by: Richard Weinberger arch/x86/um/ptrace_64.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8bba077066d6d0a135b7be1970691522075bf905 Author: Nikola Kotur Date: Thu Mar 2 14:16:40 2017 +0100 um: Set number of CPUs Define NR_CPUS required by the timer subsystem. Fixes this make warning: scripts/kconfig/conf --oldconfig arch/x86/um/Kconfig kernel/time/Kconfig:155:warning: range is invalid Signed-off-by: Nikola Kotur Signed-off-by: Richard Weinberger arch/um/Kconfig.common | 5 +++++ arch/um/os-Linux/skas/process.c | 3 --- 2 files changed, 5 insertions(+), 3 deletions(-) commit ecb6c7435f25d6a11fa9d14f407d00286f9642b9 Author: Richard Weinberger Date: Sun Dec 25 23:11:05 2016 +0100 um: Fix _print_addr() Recent changes to printk() broke UML's stack trace output. Kill the root of the problem by using a single printk() statement. Signed-off-by: Richard Weinberger arch/um/kernel/sysrq.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit fe0be23e68200573de027de9b8cc2b27e7fce35e Author: Darrick J. Wong Date: Wed Apr 12 12:26:07 2017 -0700 xfs: reserve enough blocks to handle btree splits when remapping In xfs_reflink_end_cow, we erroneously reserve only enough blocks to handle adding 1 extent. This is problematic if we fragment free space, have to do CoW, and then have to perform multiple bmap btree expansions. Furthermore, the BUI recovery routine doesn't reserve /any/ blocks to handle btree splits, so log recovery fails after our first error causes the filesystem to go down. Therefore, refactor the transaction block reservation macros until we have a macro that works for our deferred (re)mapping activities, and fix both problems by using that macro. With 1k blocks we can hit this fairly often in g/187 if the scratch fs is big enough. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig fs/xfs/libxfs/xfs_trans_space.h | 23 +++++++++++++++++------ fs/xfs/xfs_bmap_item.c | 5 ++++- fs/xfs/xfs_reflink.c | 18 ++++++++++++++++-- 3 files changed, 37 insertions(+), 9 deletions(-) commit 1684096b1ed813f621fb6cbd06e72235c1c2a0ca Merge: 16a12fa 24b43c9 Author: Linus Torvalds Date: Wed May 3 12:45:55 2017 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma Pull rdma updates from Doug Ledford: "More exchaustive description of primary updates in this release: - Lots of driver fixes and misc fixes across the board. - I had to base on a net-next tree because the IPoIB Accelorator patches needed it. Unfortunately, it was known to Mellanox that there would need to be an IPoIB accelorator patch to the net tree (which left some functions turned off by an #ifdef construct to avoid warnings about defined but unused functions), then one to the RDMA tree, then a fixup that went back and re-enabled the functions in the net tree and enabled their use in the rdma tree Also, a sparse fix was sent to the net tree after I did my pull, and the fixup patch conflicts quite directly with that sparse fix, so I'm going to submit the fixup patch towards the end of the merge window by itself and based upon your master branch at the time. - Two separate rounds of hfi1 fixes, one that got dropped from last release because it came in just a day or two before the end of the merge window and then the one from this release cycle. Of note is that I now have a third series that just landed from Intel yesterday. It is not included in this pull request, but I may submit it by the end of the week. I'll talk to Intel about improving the timing of thier submissions for my workflow. - Changes to our idr usage in the RDMA subsystem that will tie into our cgroup management and also into the upcoming changes for the RDMA kernel<->userspace API. - Addition of support for a netdev to be tied to an RDMA device at the core level - Addition of the VNIC driver from Intel. While IPoIB provides IP over InfiniBand (and *only* IP, no lower layer protocol headers are allowed or supported), the VNIC driver presents a virtual Ethernet device with support for things like varying Ethertypes, VLANs, priorities and other features of Ethernet. The virtual devices are centrally managed by the OPA fabric manager, making this (for the time being) a strictly OPA specific feature. - Improvements to the On-Demand Paging support in the RDMA subsystem. - Addition of three significant OPA changes. While we added OPA support some time ago (via the hfi1 driver), the RDMA subsystem has so far glossed over the areas where OPA and InfiniBand differ. With this release we are starting to add support for the OPA extensions into the RDMA core in the following area: Extended port information for OPA is now supported, extended Address Handle attributes for OPA are now supported, and extended SA Queries to get OPA specific subnet information is now supported. Concise summary from the tag: - idr usage and locking changes - build fix for hns - ipoib debug path record file fix - hfi1 updates - core RDMA netdev addition - Intel VNIC driver addition - Enhanced accelerators for IPoIB addition - Debug cleanups in cxgb3/4 - Trivial cleanups from SF Markus Elfring - Misc rxe fixes from Mellanox - Misc ipoib fixes from Mellanox - Lots of mlx4/mlx5 changes from Mellanox - Misc fixes across the RDMA subsystem - ODP paging fixes and improvements - qedr updates - hfi1 updates - OPA port info patches - OPA AH patches - OPA SA Query patches" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma: (191 commits) infiniband: avoid dereferencing uninitialized dst on error path IB/SA: Add OPA addr header IB/mlx5: Add port_xmit_wait to counter registers read IB/ocrdma: fix out of bounds access to local buffer IB/mlx4: Fix incorrect order of formal and actual parameters IB/mlx4: Change flush logic so it adheres to the variable name mlx5: Fix mlx5_ib_map_mr_sg mr length IB/rxe: Don't clamp residual length to mtu IB/SA: Add support to query OPA path records IB/SA: Add OPA path record type IB/SA: Split struct sa_path_rec based on IB and ROCE specific fields IB/SA: Introduce path record specific types IB/SA: Rename ib_sa_path_rec to sa_path_rec IB/CM: Add braces when using sizeof IB/core: Define 'opa' rdma_ah_attr type IB/core: Define 'ib' and 'roce' rdma_ah_attr types IB/core: Use rdma_ah_attr accessor functions IB/core: Add accessor functions for rdma_ah_attr fields IB/PVRDMA: Rename ib_ah_attr related functions IB/mthca: Rename to_ib_ah_attr to to_rdma_ah_attr ... commit 16a12fa9aed176444fc795b09e796be41902bb08 Merge: d25e436 0337966 Author: Linus Torvalds Date: Wed May 3 12:38:20 2017 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input subsystem updates from Dmitry Torokhov: - a big update from Mauro converting input documentation to ReST format - Synaptics PS/2 is now aware of SMBus companion devices, which means that we can now use native RMI4 protocol to handle touchpads, instead of relying on legacy PS/2 mode. - we removed support from BMA180 accelerometer from input devices as it is now handled properly by IIO - update to TSC2007 to corretcly report pressure - other miscellaneous driver fixes. * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (152 commits) Input: ar1021_i2c - use BIT to check for a bit Input: twl4030-pwrbutton - use input_set_capability() helper Input: twl4030-pwrbutton - use correct device for irq request Input: ar1021_i2c - enable touch mode during open Input: add uinput documentation dt-bindings: input: add bindings document for ar1021_i2c driver dt-bindings: input: rotary-encoder: fix typo Input: xen-kbdfront - add module parameter for setting resolution ARM: pxa/raumfeld: fix compile error in rotary controller resources Input: xpad - do not suggest writing to Dominic Input: xpad - don't use literal blocks inside footnotes Input: xpad - note that usb/devices is now at /sys/kernel/debug/ Input: docs - freshen up introduction Input: docs - split input docs into kernel- and user-facing Input: docs - note that MT-A protocol is obsolete Input: docs - update joystick documentation a bit Input: docs - remove disclaimer/GPL notice Input: fix "Game console" heading level in joystick documentation Input: rotary-encoder - remove references to platform data from docs Input: move documentation for Amiga CD32 ... commit d25e436c4b68db2895185b24ad1f22499c2f87b0 Merge: a90f0e9 282ec0e Author: Linus Torvalds Date: Wed May 3 12:31:39 2017 -0700 Merge tag 'spi-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi updates from Mark Brown: "There's quite a lot of small driver specific fixes and enhancements in this release but the main activity has been around the loopback and spidev test drivers which is good to see as it should hopefully help improve the quality of all the drivers as people start to make use of the new code: - Additional tests in the loopback test driver for vmalloc() compatibility and around delays together with fixes for existing tests. - Support for testing continuous data transfer for use in soak testing. - Device property support for board info platforms. - Support for registering empty sets of devices via board info (useful when writing code to enumerate hardware automatically)" * tag 'spi-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (52 commits) spi: cadence: Allow for GPIO pins to be used as chipselects spi-imx: Implements handling of the SPI_READY mode flag. spi: tegra: fix spelling mistake: "trasfer" -> "transfer" spi: spi-ti-qspi: Use bounce buffer if read buffer is not DMA'ble spi: Add can_dma like interface for spi_flash_read spi: dw: Disable clock after unregistering the host spi: double time out tolerance spi: atmel: add deepest PM support to SAMA5D2 spi: atmel: factorize reusable code for SPI controller init spi: orion: add LSB support spi: pl022: don't use uninitialized variable spi: loopback-test: fix spelling mistake: "minimam" -> "minimum" spi: dynamycally allocated message initialization spi: spi-ti-qspi: Remove unused dma_dev variable spi: omap2-mcspi: poll OMAP2_MCSPI_CHSTAT_RXS for PIO transfer spi: spi-ti-qspi: Use dma_engine wrapper for dma memcpy call spi: spidev_test: add option to continuously transfer data spi: loopback-test: fix potential integer overflow on multiple spi: sun6i: update max transfer size reported spi: pl022: Document property values ... commit a90f0e9ebb88ba7b0efea4e7d9defc0c2b96f712 Merge: 14b7307 ae53b5d Author: Linus Torvalds Date: Wed May 3 12:27:53 2017 -0700 Merge tag 'regulator-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator updates from Mark Brown: "Quite a lot going on with the regulator API for this release, much more in the core than in the drivers for a change: - Fixes for voltage change propagation through dumb power switches. - A notification when regulators are enabled. - A new settling time property for regulators where the time taken to move to a new voltage is not related to the size of the change. - Some reorganization of the Arizona drivers in preparation for sharing the code with the next generation devices they've been integrated with. - Support for newer Freescale chips in the Anatop regulator. - A new driver for voltage controlled regulators to cope with some exciting ChromeOS hardware designs. - Support for Rohm BD9571MWV-M and TI TPS65132" * tag 'regulator-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (51 commits) regulator: Add ROHM BD9571MWV-M PMIC regulator driver regulator: arizona-ldo1: Factor out generic initialization regulator: arizona-ldo1: Make arizona_ldo1 independent of struct arizona regulator: arizona-ldo1: Move pdata into a separate structure regulator: arizona-micsupp: Factor out generic initialization regulator: arizona-micsupp: Make arizona_micsupp independent of struct arizona regulator: arizona-micsupp: Move pdata into a separate structure regulator: arizona: Split KConfig options for LDO1 and MICSUPP regulators regulator: anatop: make regulator name property required regulator: tps65023: Fix inverted core enable logic. regulator: anatop: make sure regulator name is properly defined regulator: core: Allow dummy regulators for supplies regulator: core: Only propagate voltage changes to if it can change voltages regulator: vctrl: Fix out of bounds array access for vctrl->vtable regulator: tps65132: fix platform_no_drv_owner.cocci warnings regulator: tps65132: Fix off-by-one for .max_register setting regulator: anatop: set default voltage selector for pcie regulator: tps65132: add device-tree binding regulator: tps65132: add regulator driver for TI TPS65132 regulator: anatop: remove unneeded name field of struct anatop_regulator ... commit 14b730723aac9cf3ba0a74e830491e9a43bfc80a Merge: d26f552 889ef45 Author: Linus Torvalds Date: Wed May 3 12:18:47 2017 -0700 Merge branch 'i2c/for-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c updates from Wilfram Sang: "I2C has the following updates for you: - an immutable cross-subsystem branch fixing PMIC access on Intel Baytrail - bigger driver updates to the designware, meson, exynos5 drivers - new i2c_acpi_new_device() function to create devices from ACPI - struct i2c_driver has now a flag 'disable_i2c_core_irq_mapping' to allow custom IRQ mapping in case the default does not fit - mux subsystem centralized error messages in its core - new driver for ltc4306 i2c mux - usual set of small updates" * 'i2c/for-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (44 commits) i2c: thunderx: Enable HWMON class probing i2c: rcar: clarify PM handling with more comments i2c: rcar: fix resume by always initializing registers before transfer i2c: tegra: fix spelling mistake: "contoller" -> "controller" i2c: exynos5: use core helper to get driver data i2c: exynos5: de-duplicate error logs on clock setup i2c: exynos5: simplify clock frequency handling i2c: exynos5: simplify timings calculation i2c: designware-baytrail: fix potential null pointer dereference on dev i2c: designware: Get selected speed mode sda-hold-time via ACPI [media] cx231xx: stop double error reporting i2c: core: Allow drivers to disable i2c-core irq mapping i2c: core: Add new i2c_acpi_new_device helper function i2c: core: Allow getting ACPI info by index i2c: img-scb: use setup_timer i2c: i2c-scmi: add a MS HID i2c: mux: ltc4306: LTC4306 and LTC4305 I2C multiplexer/switch dt-bindings: i2c: mux: ltc4306: Add dt-bindings for I2C multiplexer/switch i2c: mux: reg: stop double error reporting i2c: mux: pinctrl: stop double error reporting ... commit d26f552ebbfb0f2c7fe712f457a038d60ed73daa Merge: e897f26 ab6241a Author: Linus Torvalds Date: Wed May 3 12:16:25 2017 -0700 Merge tag 'mfd-next-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD updates from Lee Jones: "New Drivers: - Freescale MXS Low Resolution ADC - Freescale i.MX23/i.MX28 LRADC touchscreen - Motorola CPCAP Power Button - TI LMU (Lighting Management Unit) - Atmel SMC (Static Memory Controller) New Device Support: - Add support for X-Powers AXP803 to axp20x - Add support for Dialog Semi DA9061 to da9062-core - Add support for Intel Cougar Mountain to lpc_ich - Add support for Intel Gemini Lake to lpc_ich New Functionality: - Add Device Tree support; wm831x-*, axp20x, ti-lmu, da9062, sun4i-gpadc - Add IRQ sense support; motorola-cpcap - Add ACPI support; cros_ec - Add Reset support; altera-a10sr - Add ADC support; axp20x - Add AC Power support; axp20x - Add Runtime PM support; atmel-ebi, exynos-lpass - Add Battery Power Supply support; axp20x - Add Clock support; exynos-lpass, hi655x-pmic Fix-ups: - Implicitly specify required headers; motorola-cpcap, intel_soc_pmic_bxtwc - Add .remove() method; stm32-timers, exynos-lpass - Remove unused code; intel_soc_pmic_core, intel-lpss-acpi, ipaq-micro, atmel-smc, menelaus - Rename variables for clarity; axp20x - Convert pr_warning() to pr_warn(); db8500-prcmu, sta2x11-mfd, twl4030-power - Improve formatting; arizona-core, axp20x - Use raw_spinlock_*() variants; asic3, t7l66xb, tc6393xb - Simplify/refactor code; arizona-core, atmel-ebi - Improve error checking; intel_soc_pmic_core Bug Fixes: - Ensure OMAP3630/3730 boards can successfully reboot; twl4030-power - Correct max-register value; stm32-timers - Extend timeout to account for clock stretching; cros_ec_spi - Use correct IRQ trigger type; motorola-cpcap - Fix bad use of IRQ sense register; motorola-cpcap - Logic error "||" should be "&&"; mxs-lradc-ts" * tag 'mfd-next-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (79 commits) input: touchscreen: mxs-lradc: || vs && typos dt-bindings: Add AXP803's regulator info mfd: axp20x: Support AXP803 variant dt-bindings: Add device tree binding for X-Powers AXP803 PMIC dt-bindings: Make AXP20X compatible strings one per line mfd: intel_soc_pmic_core: Fix unchecked return value mfd: menelaus: Remove obsolete local_irq_disable() and local_irq_enable() mfd: omap-usb-tll: Configure ULPIAUTOIDLE mfd: omap-usb-tll: Fix inverted bit use for USB TLL mode mfd: palmas: Fixed spelling mistake in error message mfd: lpc_ich: Add support for Intel Gemini Lake SoC mfd: hi655x: Add the clock cell to provide WiFi and Bluetooth mfd: intel_soc_pmic: Fix a mess with compilation units mfd: exynos-lpass: Add runtime PM support mfd: exynos-lpass: Add missing remove() function mfd: exynos-lpass: Add support for clocks mfd: exynos-lpass: Remove pad retention control iio: adc: add support for X-Powers AXP20X and AXP22X PMICs ADCs mfd: cpcap: Fix bad use of IRQ sense register mfd: cpcap: Use ack_invert interrupts ... commit e897f267c51812bfecec45771a2d835c1a2bdacf Merge: 221656e e739c5b Author: Linus Torvalds Date: Wed May 3 12:11:44 2017 -0700 Merge tag 'backlight-next-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight Pull backlight update from Lee Jones: "New Arctic Sand ARC2C0608 LED Backlight driver" * tag 'backlight-next-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight: backlight: Add support for Arctic Sand LED backlight driver chips dt-bindings: backlight: arcxcnn: Supply bindings for Arctic Sand backlight commit 221656e7c4ce342b99c31eca96c1cbb6d1dce45f Merge: 2f34c12 a5c3b32 Author: Linus Torvalds Date: Wed May 3 11:58:59 2017 -0700 Merge tag 'sound-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound updates from Takashi Iwai: "It was a relatively calm development cycle, and no scaring changes are seen in both core and driver sides. Here are some highlights: ASoC: - A new API for hooking up jacks more generically and easily - Card longname is set based on DMI for a unique UCM profile - Lots of Intel driver fixes: Atom, Broxton, Skylake and newer chips - New drivers for Cirrus CS35L35, DIO DIO2125, Everest ES7132, HiSilicon hi6210, Maxim MAX98927, MT2701 systems with WM8960, Nuvoton NAU8824, Odroid systems, ST STM32 SAI controllers and x86 systems with DA7213 HD-audio: - Many new quirks to support headset for various devices (mostly ASUS ones) as usual - Support for dual codecs on some Gigabyte mobos and Lenovo laptop - Improvement on PCM position reporting for Skylake and newer FireWire: - New drivers for MOTU and RME Fireface series - Updates for Digidesign Digi00x and TASCAM series - Support for tracepoints Others: - USB-audio: improved support for quirk_alias option - Cleanups, constification allover the places" * tag 'sound-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (299 commits) ASoC: codec: wm8960: Relax bit clock computation when using PLL ASoC: codec: wm9860: avoid maybe-uninitialized warning ASoC: nau8824: leave Class D gain at chip default ASoC: nau8824: rename controls to match DAPM controls ASoC: Intel: Skylake: Return negative error code ASoC: Intel: Skylake: Fix unused variable warning ASoC: Intel: Skylake: fix uninitialized pointer use ASoC: sti: Fix error handling if of_clk_get() fails ASoC: cs4271: configure reset GPIO as output ASoC: dwc: Disallow building designware_pcm as a module ALSA: ali5451: fix spelling mistake in "ali_capture_preapre" ASoC: stm32: add SAI driver ASoC: stm32: add bindings for SAI ASoC: Intel: Skylake: Add loadable module support on KBL platform ASoC: Intel: Skylake: Modify load_lib_ipc arguments for a nowait version ASoC: Intel: Skylake: Register dsp_fw_ops for kabylake ASoC: Intel: Skylake: Modify arguments to reuse module transfer function ASoC: Intel: Skylake: Commonize library load ASoC: Intel: Skylake: Move sst common initialization to a helper function ASoC: nau8824: new driver ... commit 2f34c1231bfc9f2550f934acb268ac7315fb3837 Merge: a3719f3 8b03d1e Author: Linus Torvalds Date: Wed May 3 11:44:24 2017 -0700 Merge tag 'drm-for-v4.12' of git://people.freedesktop.org/~airlied/linux Pull drm u pdates from Dave Airlie: "This is the main drm pull request for v4.12. Apart from two fixes pulls, everything should have been in drm-next for at least 2 weeks. The biggest thing in here is AMD released the public headers for their upcoming VEGA GPUs. These as always are quite a sizeable chunk of header files. They've also added initial non-display support for those GPUs, though they aren't available in production yet. Otherwise it's pretty much normal. New bridge drivers: - megachips-stdpxxxx-ge-b850v3-fw LVDS->DP++ - generic LVDS bridge support. Core: - Displayport link train failure reporting to userspace - debugfs interface cleaned up - subsystem TODO in kerneldoc now - Extended fbdev support (flipping and vblank wait) - drm_platform removed - EDP CRC support in helper - HF-VSDB SCDC support in EDID parser - Lots of code cleanups and header extraction - Thunderbolt external GPU awareness - Atomic helper improvements - Documentation improvements panel: - Sitronix and Samsung new panel support amdgpu: - Preliminary vega10 support - Multi-level page table support - GPU sensor support for userspace - PRT support for sparse buffers - SR-IOV improvements - Non-contig VRAM CPU mapping i915: - Atomic modesetting enabled by default on Gen5+ - LSPCON improvements - Atomic state handling for cdclk - GPU reset improvements - In-kernel unit tests - Geminilake improvements and color manager support - Designware i2c fixes - vblank evasion improvements - Hotplug safe connector iterators - GVT scheduler QoS support - GVT Kabylake support nouveau: - Acceleration support for Pascal (GP10x). - Rearchitecture of code handling proprietary signed firmware - Fix GTX 970 with odd MMU configuration - GP10B support - GP107 acceleration support vmwgfx: - Atomic modesetting support for vmwgfx omapdrm: - Support for render nodes - Refactor omapdss code - Fix some probe ordering issues - Fix too dark RGB565 rendering sunxi: - prelim rework for multiple pipes. mali-dp: - Color management support - Plane scaling - Power management improvements imx-drm: - Prefetch Resolve Engine/Gasket on i.MX6QP - Deferred plane disabling - Separate alpha support mediatek: - Mediatek SoC MT2701 support rcar-du: - Gen3 HDMI support msm: - 4k support for newer chips - OPP bindings for gpu - prep work for per-process pagetables vc4: - HDMI audio support - fixes qxl: - minor fixes. dw-hdmi: - PHY improvements - CSC fixes - Amlogic GX SoC support" * tag 'drm-for-v4.12' of git://people.freedesktop.org/~airlied/linux: (1778 commits) drm/nouveau/fb/gf100-: Fix 32 bit wraparound in new ram detection drm/nouveau/secboot/gm20b: fix the error return code in gm20b_secboot_tegra_read_wpr() drm/nouveau/kms: Increase max retries in scanout position queries. drm/nouveau/bios/bitP: check that table is long enough for optional pointers drm/nouveau/fifo/nv40: no ctxsw for pre-nv44 mpeg engine drm: mali-dp: use div_u64 for expensive 64-bit divisions drm/i915: Confirm the request is still active before adding it to the await drm/i915: Avoid busy-spinning on VLV_GLTC_PW_STATUS mmio drm/i915/selftests: Allocate inode/file dynamically drm/i915: Fix system hang with EI UP masked on Haswell drm/i915: checking for NULL instead of IS_ERR() in mock selftests drm/i915: Perform link quality check unconditionally during long pulse drm/i915: Fix use after free in lpe_audio_platdev_destroy() drm/i915: Use the right mapping_gfp_mask for final shmem allocation drm/i915: Make legacy cursor updates more unsynced drm/i915: Apply a cond_resched() to the saturated signaler drm/i915: Park the signaler before sleeping drm: mali-dp: Check the mclk rate and allow up/down scaling drm: mali-dp: Enable image enhancement when scaling drm: mali-dp: Add plane upscaling support ... commit a3719f34fdb664ffcfaec2160ef20fca7becf2ee Merge: 5133cd7 61a9298 Author: Linus Torvalds Date: Wed May 3 11:35:47 2017 -0700 Merge branch 'generic' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull quota, reiserfs, udf and ext2 updates from Jan Kara: "The branch contains changes to quota code so that it does not modify persistent flags in inode->i_flags (it was the only place in kernel doing that) and handle it inside filesystem's quotaon/off handlers instead. The branch also contains two UDF cleanups, a couple of reiserfs fixes and one fix for ext2 quota locking" * 'generic' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: ext4: Improve comments in ext4_quota_{on|off}() udf: use kmap_atomic for memcpy copying udf: use octal for permissions quota: Remove dquot_quotactl_ops reiserfs: Remove i_attrs_to_sd_attrs() reiserfs: Remove useless setting of i_flags jfs: Remove jfs_get_inode_flags() ext2: Remove ext2_get_inode_flags() ext4: Remove ext4_get_inode_flags() quota: Stop setting IMMUTABLE and NOATIME flags on quota files jfs: Set flags on quota files directly ext2: Set flags on quota files directly reiserfs: Set flags on quota files directly ext4: Set flags on quota files directly reiserfs: Protect dquot_writeback_dquots() by s_umount semaphore reiserfs: Make cancel_old_flush() reliable ext2: Call dquot_writeback_dquots() with s_umount held reiserfs: avoid a -Wmaybe-uninitialized warning commit 1ef97fe4f8abd3317d5c3c860f990e02c2633959 Author: Gerald Schaefer Date: Wed May 3 14:56:02 2017 +0200 brd: fix uninitialized use of brd->dax_dev commit 1647b9b9 "brd: add dax_operations support" introduced the allocation and freeing of a dax_device, but the allocated dax_device is not stored into the brd_device, so brd_del_one() will eventually operate on an uninitialized brd->dax_dev. Fix this by storing the allocated dax_device to brd->dax_dev. Signed-off-by: Gerald Schaefer Signed-off-by: Dan Williams drivers/block/brd.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) commit 65c02a556bc4f374e9002ded1ea11a0263da7b63 Author: Vineet Gupta Date: Wed May 3 11:21:31 2017 -0700 ARCv2: ptrace: provide regset for accumulator/r30 regs Signed-off-by: Vineet Gupta arch/arc/include/uapi/asm/elf.h | 1 + arch/arc/include/uapi/asm/ptrace.h | 5 +++ arch/arc/kernel/ptrace.c | 62 ++++++++++++++++++++++++++++++++++++-- 3 files changed, 65 insertions(+), 3 deletions(-) commit 991c7ed6acca506983c42d51965da8b8f3677682 Author: Vineet Gupta Date: Wed May 3 11:20:15 2017 -0700 elf: Add ARCv2 specific core note section Signed-off-by: Vineet Gupta include/uapi/linux/elf.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5133cd7518758211e827481e7d5053333bb926f0 Merge: 7b66f13 4ff33aa Author: Linus Torvalds Date: Wed May 3 11:05:15 2017 -0700 Merge branch 'fsnotify' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull fsnotify updates from Jan Kara: "The branch contains mainly a rework of fsnotify infrastructure fixing a shortcoming that we have waited for response to fanotify permission events with SRCU read lock held and when the process consuming events was slow to respond the kernel has stalled. It also contains several cleanups of unnecessary indirections in fsnotify framework and a bugfix from Amir fixing leakage of kernel internal errno to userspace" * 'fsnotify' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: (37 commits) fanotify: don't expose EOPENSTALE to userspace fsnotify: remove a stray unlock fsnotify: Move ->free_mark callback to fsnotify_ops fsnotify: Add group pointer in fsnotify_init_mark() fsnotify: Drop inode_mark.c fsnotify: Remove fsnotify_find_{inode|vfsmount}_mark() fsnotify: Remove fsnotify_detach_group_marks() fsnotify: Rename fsnotify_clear_marks_by_group_flags() fsnotify: Inline fsnotify_clear_{inode|vfsmount}_mark_group() fsnotify: Remove fsnotify_recalc_{inode|vfsmount}_mask() fsnotify: Remove fsnotify_set_mark_{,ignored_}mask_locked() fanotify: Release SRCU lock when waiting for userspace response fsnotify: Pass fsnotify_iter_info into handle_event handler fsnotify: Provide framework for dropping SRCU lock in ->handle_event fsnotify: Remove special handling of mark destruction on group shutdown fsnotify: Detach mark from object list when last reference is dropped fsnotify: Move queueing of mark for destruction into fsnotify_put_mark() inotify: Do not drop mark reference under idr_lock fsnotify: Free fsnotify_mark_connector when there is no mark attached fsnotify: Lock object list with connector lock ... commit 2719aa217e0d025dbfce74ac777815776ccec072 Author: Jens Axboe Date: Wed May 3 11:08:14 2017 -0600 blk-mq: don't use sync workqueue flushing from drivers A previous commit introduced the sync flush, which we need from internal callers like blk_mq_quiesce_queue(). However, we also call the stop helpers from drivers, particularly from ->queue_rq() when we have to stop processing for a bit. We can't block from those locations, and we don't have to guarantee that we're fully flushed. Fixes: 9f993737906b ("blk-mq: unify hctx delayed_run_work and run_work") Reviewed-by: Bart Van Assche Signed-off-by: Jens Axboe block/blk-mq.c | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) commit 7b66f13207e60e7c550af730986e77e38a0c69a3 Merge: d35a878 412445a Author: Linus Torvalds Date: Wed May 3 10:34:03 2017 -0700 Merge tag 'for-4.12/dm-post-merge-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull additional device mapper updates from Mike Snitzer: "Here are some changes from Christoph that needed to be rebased ontop of changes that were already merged into the device mapper tree. In addition, these changes depend on the 'for-4.12/block' changes that you've already merged. - Cleanups to request-based DM and DM multipath from Christoph that prepare for his block core error code type checking improvements" * tag 'for-4.12/dm-post-merge-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm: introduce a new DM_MAPIO_KILL return value dm rq: change ->rq_end_io calling conventions dm mpath: merge do_end_io into multipath_end_io commit d35a878ae1c50977b55e352fd46e36e35add72a0 Merge: e502187 390020a Author: Linus Torvalds Date: Wed May 3 10:31:20 2017 -0700 Merge tag 'for-4.12/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper updates from Mike Snitzer: - A major update for DM cache that reduces the latency for deciding whether blocks should migrate to/from the cache. The bio-prison-v2 interface supports this improvement by enabling direct dispatch of work to workqueues rather than having to delay the actual work dispatch to the DM cache core. So the dm-cache policies are much more nimble by being able to drive IO as they see fit. One immediate benefit from the improved latency is a cache that should be much more adaptive to changing workloads. - Add a new DM integrity target that emulates a block device that has additional per-sector tags that can be used for storing integrity information. - Add a new authenticated encryption feature to the DM crypt target that builds on the capabilities provided by the DM integrity target. - Add MD interface for switching the raid4/5/6 journal mode and update the DM raid target to use it to enable aid4/5/6 journal write-back support. - Switch the DM verity target over to using the asynchronous hash crypto API (this helps work better with architectures that have access to off-CPU algorithm providers, which should reduce CPU utilization). - Various request-based DM and DM multipath fixes and improvements from Bart and Christoph. - A DM thinp target fix for a bio structure leak that occurs for each discard IFF discard passdown is enabled. - A fix for a possible deadlock in DM bufio and a fix to re-check the new buffer allocation watermark in the face of competing admin changes to the 'max_cache_size_bytes' tunable. - A couple DM core cleanups. * tag 'for-4.12/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: (50 commits) dm bufio: check new buffer allocation watermark every 30 seconds dm bufio: avoid a possible ABBA deadlock dm mpath: make it easier to detect unintended I/O request flushes dm mpath: cleanup QUEUE_IF_NO_PATH bit manipulation by introducing assign_bit() dm mpath: micro-optimize the hot path relative to MPATHF_QUEUE_IF_NO_PATH dm: introduce enum dm_queue_mode to cleanup related code dm mpath: verify __pg_init_all_paths locking assumptions at runtime dm: verify suspend_locking assumptions at runtime dm block manager: remove an unused argument from dm_block_manager_create() dm rq: check blk_mq_register_dev() return value in dm_mq_init_request_queue() dm mpath: delay requeuing while path initialization is in progress dm mpath: avoid that path removal can trigger an infinite loop dm mpath: split and rename activate_path() to prepare for its expanded use dm ioctl: prevent stack leak in dm ioctl call dm integrity: use previously calculated log2 of sectors_per_block dm integrity: use hex2bin instead of open-coded variant dm crypt: replace custom implementation of hex2bin() dm crypt: remove obsolete references to per-CPU state dm verity: switch to using asynchronous hash crypto API dm crypt: use WQ_HIGHPRI for the IO and crypt workqueues ... commit 12c1c2fd780a9a5581105fcb6f251466cf35af2a Merge: 33b88e7 4341ec6 Author: Ingo Molnar Date: Wed May 3 19:28:27 2017 +0200 Merge tag 'perf-core-for-mingo-4.12-20170503' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent Pull perf/core improvements and fixes from Arnaldo Carvalho de Melo: Fixes: - Support setting probes in versioned user space symbols, such as pthread_create@@GLIBC_2.1, picking the default one, more work needed to make it possible to set it on the other versions, as the 'perf probe' syntax already uses @ for other purposes. (Paul Clarke) - Do not special case address zero as an error for routines that return addresses (symbol lookup), instead use the return as the success/error indication and pass a pointer to return the address, fixing 'perf test vmlinux' (the one that compares address between vmlinux and kallsyms) on s/390, where the '_text' address is equal to zero (Arnaldo Carvalho de Melo) Infrastructure changes: - More header sanitization, moving stuff out of util.h into more appropriate headers and objects and sometimes creating new ones (Arnaldo Carvalho de Melo) - Refactor a duplicated code for obtaining config file name (Taeung Song) Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit e5021876c91dc3894b2174cca8fa797f8e29e7b9 Merge: 46f0537 e265eb3a Author: Linus Torvalds Date: Wed May 3 10:05:38 2017 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md Pull MD updates from Shaohua Li: - Add Partial Parity Log (ppl) feature found in Intel IMSM raid array by Artur Paszkiewicz. This feature is another way to close RAID5 writehole. The Linux implementation is also available for normal RAID5 array if specific superblock bit is set. - A number of md-cluser fixes and enabling md-cluster array resize from Guoqing Jiang - A bunch of patches from Ming Lei and Neil Brown to rewrite MD bio handling related code. Now MD doesn't directly access bio bvec, bi_phys_segments and uses modern bio API for bio split. - Improve RAID5 IO pattern to improve performance for hard disk based RAID5/6 from me. - Several patches from Song Liu to speed up raid5-cache recovery and allow raid5 cache feature disabling in runtime. - Fix a performance regression in raid1 resync from Xiao Ni. - Other cleanup and fixes from various people. * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md: (84 commits) md/raid10: skip spare disk as 'first' disk md/raid1: Use a new variable to count flighting sync requests md: clear WantReplacement once disk is removed md/raid1/10: remove unused queue md: handle read-only member devices better. md/raid10: wait up frozen array in handle_write_completed uapi: fix linux/raid/md_p.h userspace compilation error md-cluster: Fix a memleak in an error handling path md: support disabling of create-on-open semantics. md: allow creation of mdNNN arrays via md_mod/parameters/new_array raid5-ppl: use a single mempool for ppl_io_unit and header_page md/raid0: fix up bio splitting. md/linear: improve bio splitting. md/raid5: make chunk_aligned_read() split bios more cleanly. md/raid10: simplify handle_read_error() md/raid10: simplify the splitting of requests. md/raid1: factor out flush_bio_list() md/raid1: simplify handle_read_error(). Revert "block: introduce bio_copy_data_partial" md/raid1: simplify alloc_behind_master_bio() ... commit 5b0ef73c9d19517467e0cb36158164bf097fe148 Author: Jaegeuk Kim Date: Mon May 1 18:13:03 2017 -0700 f2fs: show available_nids in f2fs/status This patch adds an entry in f2fs/status to show # of available nids. Signed-off-by: Jaegeuk Kim fs/f2fs/debug.c | 5 +++-- fs/f2fs/f2fs.h | 3 ++- 2 files changed, 5 insertions(+), 3 deletions(-) commit 1c0f4bf5c3df13da4090a602c377f7d7a3708ce8 Author: Jaegeuk Kim Date: Mon May 1 18:09:44 2017 -0700 f2fs: flush dirty nats periodically This patch flushes dirty nats in order to acquire available nids by writing checkpoint. Otherwise, we can have no chance to get freed nids. Signed-off-by: Jaegeuk Kim fs/f2fs/segment.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1f43e2ad7bff54f7c82a084a57e5c90da0d3f4d9 Author: Chao Yu Date: Fri Apr 28 13:56:08 2017 +0800 f2fs: introduce CP_TRIMMED_FLAG to avoid unneeded discard Introduce CP_TRIMMED_FLAG to indicate all invalid block were trimmed before umount, so once we do mount with image which contain the flag, we don't record invalid blocks as undiscard one, when fstrim is being triggered, we can avoid issuing redundant discard commands. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/checkpoint.c | 3 +++ fs/f2fs/f2fs.h | 1 + fs/f2fs/segment.c | 28 ++++++++++++++++++++-------- fs/f2fs/super.c | 7 +++++++ include/linux/f2fs_fs.h | 1 + include/trace/events/f2fs.h | 4 +++- 6 files changed, 35 insertions(+), 9 deletions(-) commit c473f1a9658b6c23d576136d5a49b1c731ef1767 Author: Chao Yu Date: Thu Apr 27 20:40:39 2017 +0800 f2fs: allow cpc->reason to indicate more than one reason Change to use different bits of cpc->reason to indicate different status, so cpc->reason can indicate more than one reason. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/checkpoint.c | 14 +++++++------- fs/f2fs/f2fs.h | 16 +++++++--------- fs/f2fs/segment.c | 8 ++++---- 3 files changed, 18 insertions(+), 20 deletions(-) commit 279d6df20c94079d35e012f1602d40c42632e8f3 Author: Hou Pengyang Date: Thu Apr 27 00:17:21 2017 +0800 f2fs: release cp and dnode lock before IPU We don't need to rewrite the page under cp_rwsem and dnode locks. Signed-off-by: Hou Pengyang Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/data.c | 39 ++++++++++++++++++++++++--------------- fs/f2fs/f2fs.h | 2 +- fs/f2fs/gc.c | 1 + fs/f2fs/segment.c | 1 + 4 files changed, 27 insertions(+), 16 deletions(-) commit 945f8f5f863321de0dc5c13b3d446d4dbf41531e Author: Shuah Khan Date: Tue May 2 11:00:22 2017 -0600 selftests: x86: add missing executables to .gitignore Executables that are common for both x86_32 and x86_64 are missing from .gitignore. Add them. Signed-off-by: Shuah Khan tools/testing/selftests/x86/.gitignore | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit c296cfe26bdd86de6eeefde57d333174ed9574d0 Author: Fred Isaman Date: Tue May 2 16:53:36 2017 -0400 pNFS: Fix NULL dereference in pnfs_generic_alloc_ds_commits Signed-off-by: Fred Isaman Signed-off-by: Trond Myklebust fs/nfs/pnfs_nfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 46f0537b1ecf672052007c97f102a7e6bf0791e4 Merge: 0302e28 48d0e02 Author: Linus Torvalds Date: Wed May 3 09:21:59 2017 -0700 Merge branch 'stable-4.12' of git://git.infradead.org/users/pcmoore/audit Pull audit updates from Paul Moore: "Fourteen audit patches for v4.12 that span the full range of fixes, new features, and internal cleanups. We have a patches to move to 64-bit timestamps, convert refcounts from atomic_t to refcount_t, track PIDs using the pid struct instead of pid_t, convert our own private audit buffer cache to a standard kmem_cache, log kernel module names when they are unloaded, and normalize the NETFILTER_PKT to make the userspace folks happier. From a fixes perspective, the most important is likely the auditd connection tracking RCU fix; it was a rather brain dead bug that I'll take the blame for, but thankfully it didn't seem to affect many people (only one report). I think the patch subject lines and commit descriptions do a pretty good job of explaining the details and why the changes are important so I'll point you there instead of duplicating it here; as usual, if you have any questions you know where to find us. We also manage to take out more code than we put in this time, that always makes me happy :)" * 'stable-4.12' of git://git.infradead.org/users/pcmoore/audit: audit: fix the RCU locking for the auditd_connection structure audit: use kmem_cache to manage the audit_buffer cache audit: Use timespec64 to represent audit timestamps audit: store the auditd PID as a pid struct instead of pid_t audit: kernel generated netlink traffic should have a portid of 0 audit: combine audit_receive() and audit_receive_skb() audit: convert audit_watch.count from atomic_t to refcount_t audit: convert audit_tree.count from atomic_t to refcount_t audit: normalize NETFILTER_PKT netfilter: use consistent ipv4 network offset in xt_AUDIT audit: log module name on delete_module audit: remove unnecessary semicolon in audit_watch_handle_event() audit: remove unnecessary semicolon in audit_mark_handle_event() audit: remove unnecessary semicolon in audit_field_valid() commit 0302e28dee643932ee7b3c112ebccdbb9f8ec32c Merge: 89c9fea 8979b02 Author: Linus Torvalds Date: Wed May 3 08:50:52 2017 -0700 Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security Pull security subsystem updates from James Morris: "Highlights: IMA: - provide ">" and "<" operators for fowner/uid/euid rules KEYS: - add a system blacklist keyring - add KEYCTL_RESTRICT_KEYRING, exposes keyring link restriction functionality to userland via keyctl() LSM: - harden LSM API with __ro_after_init - add prlmit security hook, implement for SELinux - revive security_task_alloc hook TPM: - implement contextual TPM command 'spaces'" * 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (98 commits) tpm: Fix reference count to main device tpm_tis: convert to using locality callbacks tpm: fix handling of the TPM 2.0 event logs tpm_crb: remove a cruft constant keys: select CONFIG_CRYPTO when selecting DH / KDF apparmor: Make path_max parameter readonly apparmor: fix parameters so that the permission test is bypassed at boot apparmor: fix invalid reference to index variable of iterator line 836 apparmor: use SHASH_DESC_ON_STACK security/apparmor/lsm.c: set debug messages apparmor: fix boolreturn.cocci warnings Smack: Use GFP_KERNEL for smk_netlbl_mls(). smack: fix double free in smack_parse_opts_str() KEYS: add SP800-56A KDF support for DH KEYS: Keyring asymmetric key restrict method with chaining KEYS: Restrict asymmetric key linkage using a specific keychain KEYS: Add a lookup_restriction function for the asymmetric key type KEYS: Add KEYCTL_RESTRICT_KEYRING KEYS: Consistent ordering for __key_link_begin and restrict check KEYS: Add an optional lookup_restriction hook to key_type ... commit 563f40019d16e5299e9edd3eac37846760637076 Author: Josef Bacik Date: Tue Apr 18 16:04:17 2017 -0400 fs: don't set *REFERENCED on single use objects By default we set DCACHE_REFERENCED and I_REFERENCED on any dentry or inode we create. This is problematic as this means that it takes two trips through the LRU for any of these objects to be reclaimed, regardless of their actual lifetime. With enough pressure from these caches we can easily evict our working set from page cache with single use objects. So instead only set *REFERENCED if we've already been added to the LRU list. This means that we've been touched since the first time we were accessed, and so more likely to need to hang out in cache. To illustrate this issue I wrote the following scripts https://github.com/josefbacik/debug-scripts/tree/master/cache-pressure on my test box. It is a single socket 4 core CPU with 16gib of RAM and I tested on an Intel 2tib NVME drive. The cache-pressure.sh script creates a new file system and creates 2 6.5gib files in order to take up 13gib of the 16gib of ram with pagecache. Then it runs a test program that reads these 2 files in a loop, and keeps track of how often it has to read bytes for each loop. On an ideal system with no pressure we should have to read 0 bytes indefinitely. The second thing this script does is start a fs_mark job that creates a ton of 0 length files, putting pressure on the system with slab only allocations. On exit the script prints out how many bytes were read by the read-file program. The results are as follows Without patch: /mnt/btrfs-test/reads/file1: total read during loops 27262988288 /mnt/btrfs-test/reads/file2: total read during loops 27262976000 With patch: /mnt/btrfs-test/reads/file2: total read during loops 18640457728 /mnt/btrfs-test/reads/file1: total read during loops 9565376512 This patch results in a 50% reduction of the amount of pages evicted from our working set. Signed-off-by: Josef Bacik Signed-off-by: Al Viro fs/dcache.c | 4 ++-- fs/inode.c | 3 ++- 2 files changed, 4 insertions(+), 3 deletions(-) commit f411af6822182f84834c4881b825dd40534e7fe8 Merge: 4d89ac2 7c3e7de Author: David S. Miller Date: Wed May 3 11:33:06 2017 -0400 Merge branch 'ibmvnic-Updated-reset-handler-andcode-fixes' Nathan Fontenot says: ==================== ibmvnic: Updated reset handler and code fixes This set of patches multiple code fixes and a new rest handler for the ibmvnic driver. In order to implement the new reset handler for the ibmvnic driver resource initialization needed to be moved to its own routine, a state variable is introduced to replace the various is_* flags in the driver, and a new routine to handle the assorted reasons the driver can be reset. v4 updates: Patch 3/11: Corrected trailing whitespace Patch 7/11: Corrected trailing whitespace v3 updates: Patch 10/11: Correct patch subject line to be a description of the patch. v2 updates: Patch 11/11: Use __netif_subqueue_stopped() instead of netif_subqueue_stopped() to avoid possible use of an un-initialized skb variable. ==================== Signed-off-by: David S. Miller commit 7c3e7de3f3a94fa34731f302e2f6606c9adc0f38 Author: Nathan Fontenot Date: Wed May 3 14:05:25 2017 -0400 ibmvnic: Move queue restarting in ibmvnic_tx_complete Restart of the subqueue should occur outside of the loop processing any tx buffers instead of doing this in the middle of the loop. Signed-off-by: Nathan Fontenot Signed-off-by: David S. Miller drivers/net/ethernet/ibm/ibmvnic.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-) commit 94ca305fd85cd052050b19b1762eb14eaa8cdd6a Author: Thomas Falcon Date: Wed May 3 14:05:20 2017 -0400 ibmvnic: Record SKB RX queue during poll Map each RX SKB to the RX queue associated with the driver's RX SCRQ. This should improve the RX CPU load balancing issues seen by the performance team. Signed-off-by: Thomas Falcon Signed-off-by: David S. Miller drivers/net/ethernet/ibm/ibmvnic.c | 1 + 1 file changed, 1 insertion(+) commit ca05e31674b20904ff86464e475604f1de445365 Author: Nathan Fontenot Date: Wed May 3 14:05:14 2017 -0400 ibmvnic: Continue skb processing after skb completion error There is not a need to stop processing skbs if we encounter a skb that has a receive completion error. Signed-off-by: Nathan Fontenot Signed-off-by: David S. Miller drivers/net/ethernet/ibm/ibmvnic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 161b8a813877fb7d3deba6b3bd2731d4f4a75c5e Author: Nathan Fontenot Date: Wed May 3 14:05:08 2017 -0400 ibmvnic: Check for driver reset first in ibmvnic_xmit Move the check for the driver resetting to the first thing in ibmvnic_xmit(). Signed-off-by: Nathan Fontenot Signed-off-by: David S. Miller drivers/net/ethernet/ibm/ibmvnic.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 46293b940fede04f90aab18d4bfecc5bd942cf3a Author: Nathan Fontenot Date: Wed May 3 14:05:02 2017 -0400 ibmvnic: Wait for any pending scrqs entries at driver close When closing the ibmvnic driver we need to wait for any pending sub crq entries to ensure they are handled. Signed-off-by: Nathan Fontenot Signed-off-by: David S. Miller drivers/net/ethernet/ibm/ibmvnic.c | 47 ++++++++++++++++++++++---------------- 1 file changed, 27 insertions(+), 20 deletions(-) commit b41b83e9a784576b2bcc33bce447f7ce78fb265d Author: Nathan Fontenot Date: Wed May 3 14:04:56 2017 -0400 ibmvnic: Clean up tx pools when closing When closing the ibmvnic driver, most notably during the reset path, the tx pools need to be cleaned to ensure there are no hanging skbs that need to be free'ed. The need for this was found during debugging a loss of network traffic after handling a driver reset. The underlying cause was some skbs in the tx pool that were never free'ed. As a result the upper network layers never tried a re-send since it believed the driver still had the skb. Signed-off-by: Nathan Fontenot Signed-off-by: David S. Miller drivers/net/ethernet/ibm/ibmvnic.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) commit e0ebe942f42952fb23bb0596f8775e50bed0b341 Author: Nathan Fontenot Date: Wed May 3 14:04:50 2017 -0400 ibmvnic: Whitespace correction in release_rx_pools Signed-off-by: Nathan Fontenot Signed-off-by: David S. Miller drivers/net/ethernet/ibm/ibmvnic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c7bac00b4056ab951c377aff99bb91b81890c727 Author: Nathan Fontenot Date: Wed May 3 14:04:44 2017 -0400 ibmvnic: Delete napi's when releasing driver resources The napi structs allocated at drivier initializatio need to be free'ed when releasing the drivers resources. Signed-off-by: Nathan Fontenot Signed-off-by: David S. Miller drivers/net/ethernet/ibm/ibmvnic.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit ed651a10875f13135a5f59c1bae4d51b377b3925 Author: Nathan Fontenot Date: Wed May 3 14:04:38 2017 -0400 ibmvnic: Updated reset handling The ibmvnic driver has multiple handlers for resetting the driver depending on the reason the reset is needed (failover, lpm, fatal erors,...). All of the reset handlers do essentially the same thing, this patch moves this work to a common reset handler. By doing this we also allow the driver to better handle situations where we can get a reset while handling a reset. The updated reset handling works by adding a reset work item to the list of resets and then scheduling work to perform the reset. This step is necessary because we can receive a reset in interrupt context and we want to handle the reset out of interrupt context. Signed-off-by: Nathan Fontenot Signed-off-by: David S. Miller drivers/net/ethernet/ibm/ibmvnic.c | 413 +++++++++++++++++++++++-------------- drivers/net/ethernet/ibm/ibmvnic.h | 19 +- 2 files changed, 275 insertions(+), 157 deletions(-) commit 90c8014c2be5e5805d972341b40221da4309d564 Author: Nathan Fontenot Date: Wed May 3 14:04:32 2017 -0400 ibmvnic: Replace is_closed with state field Replace the is_closed flag in the ibmvnic adapter strcut with a more comprehensive state field that tracks the current state of the driver. Signed-off-by: Nathan Fontenot Signed-off-by: David S. Miller drivers/net/ethernet/ibm/ibmvnic.c | 20 +++++++++++++------- drivers/net/ethernet/ibm/ibmvnic.h | 12 ++++++++++-- 2 files changed, 23 insertions(+), 9 deletions(-) commit bfc32f297337e86bbf16512ea27dd50dadd5959e Author: Nathan Fontenot Date: Wed May 3 14:04:26 2017 -0400 ibmvnic: Move resource initialization to its own routine Move all of the calls to initialize resources for the driver to a separate routine. Signed-off-by: Nathan Fontenot Signed-off-by: David S. Miller drivers/net/ethernet/ibm/ibmvnic.c | 71 +++++++++++++++++++++----------------- 1 file changed, 39 insertions(+), 32 deletions(-) commit 8c64415cc1f5794c02b95dee10084fa8a4ee3cfe Author: David S. Miller Date: Wed May 3 08:28:48 2017 -0700 sparc: Remove redundant tests in boot_flags_init(). The test: *commands && *commands == ' ' is equivalent to: *commands == ' ' Reported-by: David Binderman Signed-off-by: David S. Miller arch/sparc/kernel/setup_32.c | 2 +- arch/sparc/kernel/setup_64.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) commit 3998e6b87d4258a70df358296d6f1c7234012bfe Author: Rabin Vincent Date: Wed May 3 17:54:01 2017 +0200 CIFS: fix oplock break deadlocks When the final cifsFileInfo_put() is called from cifsiod and an oplock break work is queued, lockdep complains loudly: ============================================= [ INFO: possible recursive locking detected ] 4.11.0+ #21 Not tainted --------------------------------------------- kworker/0:2/78 is trying to acquire lock: ("cifsiod"){++++.+}, at: flush_work+0x215/0x350 but task is already holding lock: ("cifsiod"){++++.+}, at: process_one_work+0x255/0x8e0 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock("cifsiod"); lock("cifsiod"); *** DEADLOCK *** May be due to missing lock nesting notation 2 locks held by kworker/0:2/78: #0: ("cifsiod"){++++.+}, at: process_one_work+0x255/0x8e0 #1: ((&wdata->work)){+.+...}, at: process_one_work+0x255/0x8e0 stack backtrace: CPU: 0 PID: 78 Comm: kworker/0:2 Not tainted 4.11.0+ #21 Workqueue: cifsiod cifs_writev_complete Call Trace: dump_stack+0x85/0xc2 __lock_acquire+0x17dd/0x2260 ? match_held_lock+0x20/0x2b0 ? trace_hardirqs_off_caller+0x86/0x130 ? mark_lock+0xa6/0x920 lock_acquire+0xcc/0x260 ? lock_acquire+0xcc/0x260 ? flush_work+0x215/0x350 flush_work+0x236/0x350 ? flush_work+0x215/0x350 ? destroy_worker+0x170/0x170 __cancel_work_timer+0x17d/0x210 ? ___preempt_schedule+0x16/0x18 cancel_work_sync+0x10/0x20 cifsFileInfo_put+0x338/0x7f0 cifs_writedata_release+0x2a/0x40 ? cifs_writedata_release+0x2a/0x40 cifs_writev_complete+0x29d/0x850 ? preempt_count_sub+0x18/0xd0 process_one_work+0x304/0x8e0 worker_thread+0x9b/0x6a0 kthread+0x1b2/0x200 ? process_one_work+0x8e0/0x8e0 ? kthread_create_on_node+0x40/0x40 ret_from_fork+0x31/0x40 This is a real warning. Since the oplock is queued on the same workqueue this can deadlock if there is only one worker thread active for the workqueue (which will be the case during memory pressure when the rescuer thread is handling it). Furthermore, there is at least one other kind of hang possible due to the oplock break handling if there is only worker. (This can be reproduced without introducing memory pressure by having passing 1 for the max_active parameter of cifsiod.) cifs_oplock_break() can wait indefintely in the filemap_fdatawait() while the cifs_writev_complete() work is blocked: sysrq: SysRq : Show Blocked State task PC stack pid father kworker/0:1 D 0 16 2 0x00000000 Workqueue: cifsiod cifs_oplock_break Call Trace: __schedule+0x562/0xf40 ? mark_held_locks+0x4a/0xb0 schedule+0x57/0xe0 io_schedule+0x21/0x50 wait_on_page_bit+0x143/0x190 ? add_to_page_cache_lru+0x150/0x150 __filemap_fdatawait_range+0x134/0x190 ? do_writepages+0x51/0x70 filemap_fdatawait_range+0x14/0x30 filemap_fdatawait+0x3b/0x40 cifs_oplock_break+0x651/0x710 ? preempt_count_sub+0x18/0xd0 process_one_work+0x304/0x8e0 worker_thread+0x9b/0x6a0 kthread+0x1b2/0x200 ? process_one_work+0x8e0/0x8e0 ? kthread_create_on_node+0x40/0x40 ret_from_fork+0x31/0x40 dd D 0 683 171 0x00000000 Call Trace: __schedule+0x562/0xf40 ? mark_held_locks+0x29/0xb0 schedule+0x57/0xe0 io_schedule+0x21/0x50 wait_on_page_bit+0x143/0x190 ? add_to_page_cache_lru+0x150/0x150 __filemap_fdatawait_range+0x134/0x190 ? do_writepages+0x51/0x70 filemap_fdatawait_range+0x14/0x30 filemap_fdatawait+0x3b/0x40 filemap_write_and_wait+0x4e/0x70 cifs_flush+0x6a/0xb0 filp_close+0x52/0xa0 __close_fd+0xdc/0x150 SyS_close+0x33/0x60 entry_SYSCALL_64_fastpath+0x1f/0xbe Showing all locks held in the system: 2 locks held by kworker/0:1/16: #0: ("cifsiod"){.+.+.+}, at: process_one_work+0x255/0x8e0 #1: ((&cfile->oplock_break)){+.+.+.}, at: process_one_work+0x255/0x8e0 Showing busy workqueues and worker pools: workqueue cifsiod: flags=0xc pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/1 in-flight: 16:cifs_oplock_break delayed: cifs_writev_complete, cifs_echo_request pool 0: cpus=0 node=0 flags=0x0 nice=0 hung=0s workers=3 idle: 750 3 Fix these problems by creating a a new workqueue (with a rescuer) for the oplock break work. Signed-off-by: Rabin Vincent Signed-off-by: Steve French CC: Stable fs/cifs/cifsfs.c | 15 +++++++++++++-- fs/cifs/cifsglob.h | 1 + fs/cifs/misc.c | 2 +- fs/cifs/smb2misc.c | 5 +++-- 4 files changed, 18 insertions(+), 5 deletions(-) commit 6026685de33b0db5b2b6b0e9b41b3a1a3261033c Author: David Disseldorp Date: Wed May 3 17:39:08 2017 +0200 cifs: fix CIFS_ENUMERATE_SNAPSHOTS oops As with 618763958b22, an open directory may have a NULL private_data pointer prior to readdir. CIFS_ENUMERATE_SNAPSHOTS must check for this before dereference. Fixes: 834170c85978 ("Enable previous version support") Signed-off-by: David Disseldorp CC: Stable Signed-off-by: Steve French fs/cifs/ioctl.c | 2 ++ 1 file changed, 2 insertions(+) commit 0e5c795592930d51fd30d53a2e7b73cba022a29b Author: David Disseldorp Date: Wed May 3 17:39:09 2017 +0200 cifs: fix leak in FSCTL_ENUM_SNAPS response handling The server may respond with success, and an output buffer less than sizeof(struct smb_snapshot_array) in length. Do not leak the output buffer in this case. Fixes: 834170c85978 ("Enable previous version support") Signed-off-by: David Disseldorp CC: Stable Signed-off-by: Steve French fs/cifs/smb2ops.c | 1 + 1 file changed, 1 insertion(+) commit 4e335d9e7ddbcf83d03e7fbe65797ebed2272c18 Author: Paolo Bonzini Date: Tue May 2 16:20:18 2017 +0200 Revert "KVM: Support vCPU-based gfn->hva cache" This reverts commit bbd6411513aa8ef3ea02abab61318daf87c1af1e. I've been sitting on this revert for too long and it unfortunately missed 4.11. It's also the reason why I haven't merged ring-based dirty tracking for 4.12. Using kvm_vcpu_memslots in kvm_gfn_to_hva_cache_init and kvm_vcpu_write_guest_offset_cached means that the MSR value can now be used to access SMRAM, simply by making it point to an SMRAM physical address. This is problematic because it lets the guest OS overwrite memory that it shouldn't be able to touch. Cc: stable@vger.kernel.org Fixes: bbd6411513aa8ef3ea02abab61318daf87c1af1e Signed-off-by: Paolo Bonzini arch/x86/kvm/lapic.c | 22 ++++++++++++---------- arch/x86/kvm/x86.c | 41 +++++++++++++++++++++-------------------- include/linux/kvm_host.h | 16 ++++++++-------- virt/kvm/kvm_main.c | 34 +++++++++++++++++----------------- 4 files changed, 58 insertions(+), 55 deletions(-) commit ee5f7d79a80550179b258417442b7bdbccaf476a Author: Justin M. Forbes Date: Tue Apr 11 10:34:35 2017 -0500 tools/kvm: fix top level makefile The top level tools/Makefile includes kvm_stat as a target in help, but the actual target is missing. Signed-off-by: Justin M. Forbes Signed-off-by: Paolo Bonzini tools/Makefile | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit eb77e6b80f3bed262c7773236f0fb84649fd3091 Author: Yazen Ghannam Date: Thu Apr 27 12:11:54 2017 -0500 EDAC, amd64: Fix reporting of Chip Select sizes on Fam17h The wrong index into the csbases/csmasks arrays was being passed to the function to compute the chip select sizes, which resulted in the wrong size being computed. Address that so that the correct values are computed and printed. Also, redo how we calculate the number of pages in a CS row. Reported-by: Benjamin Bennett Signed-off-by: Yazen Ghannam Cc: # 4.10.x Cc: linux-edac Link: http://lkml.kernel.org/r/1493313114-11260-1-git-send-email-Yazen.Ghannam@amd.com [ Remove unneeded integer math comment, minor cleanups. ] Signed-off-by: Borislav Petkov drivers/edac/amd64_edac.c | 40 +++++++++++++++++++--------------------- 1 file changed, 19 insertions(+), 21 deletions(-) commit 4d89ac2dd559b343dad30a294fb11e0237d697d8 Merge: ab71632 9744a6f Author: David S. Miller Date: Wed May 3 10:11:26 2017 -0400 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf Pablo Neira Ayuso says: ==================== Netfilter/IPVS/OVS fixes for net The following patchset contains a rather large batch of Netfilter, IPVS and OVS fixes for your net tree. This includes fixes for ctnetlink, the userspace conntrack helper infrastructure, conntrack OVS support, ebtables DNAT target, several leaks in error path among other. More specifically, they are: 1) Fix reference count leak in the CT target error path, from Gao Feng. 2) Remove conntrack entry clashing with a matching expectation, patch from Jarno Rajahalme. 3) Fix bogus EEXIST when registering two different userspace helpers, from Liping Zhang. 4) Don't leak dummy elements in the new bitmap set type in nf_tables, from Liping Zhang. 5) Get rid of module autoload from conntrack update path in ctnetlink, we don't need autoload at this late stage and it is happening with rcu read lock held which is not good. From Liping Zhang. 6) Fix deadlock due to double-acquire of the expect_lock from conntrack update path, this fixes a bug that was introduced when the central spinlock got removed. Again from Liping Zhang. 7) Safe ct->status update from ctnetlink path, from Liping. The expect_lock protection that was selected when the central spinlock was removed was not really protecting anything at all. 8) Protect sequence adjustment under ct->lock. 9) Missing socket match with IPv6, from Peter Tirsek. 10) Adjust skb->pkt_type of DNAT'ed frames from ebtables, from Linus Luessing. 11) Don't give up on evaluating the expression on new entries added via dynset expression in nf_tables, from Liping Zhang. 12) Use skb_checksum() when mangling icmpv6 in IPv6 NAT as this deals with non-linear skbuffs. 13) Don't allow IPv6 service in IPVS if no IPv6 support is available, from Paolo Abeni. 14) Missing mutex release in error path of xt_find_table_lock(), from Dan Carpenter. 15) Update maintainers files, Netfilter section. Add Florian to the file, refer to nftables.org and change project status from Supported to Maintained. 16) Bail out on mismatching extensions in element updates in nf_tables. ==================== Signed-off-by: David S. Miller commit 6f63503c8af569fcd60bb27dfe740d13be0030f6 Author: Jens Axboe Date: Tue May 2 09:56:00 2017 -0600 mtip32xx: convert internal commands to regular block infrastructure Get rid of the private end_io handlers and data, and just use the regular block IO path for these requests. This removes a lot of redundant code. Signed-off-by: Jens Axboe drivers/block/mtip32xx/mtip32xx.c | 198 ++++++-------------------------------- drivers/block/mtip32xx/mtip32xx.h | 10 -- 2 files changed, 30 insertions(+), 178 deletions(-) commit 994ff079e8f6399e1f8cd43141da0f79ce7a179a Author: Jens Axboe Date: Tue May 2 09:53:04 2017 -0600 mtip32xx: cleanup internal tag assumptions We don't decode the internal tag to the proper group or tag indx. This works fine because we have hard wired it as 0 for now, but could break if we get rid of that. Signed-off-by: Jens Axboe drivers/block/mtip32xx/mtip32xx.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) commit ab71632c457269a6f3ec5a233c7a83682ae27019 Author: Geert Uytterhoeven Date: Wed May 3 14:18:43 2017 +0200 netfilter: conntrack: Force inlining of build check to prevent build failure If gcc (e.g. 4.1.2) decides not to inline total_extension_size(), the build will fail with: net/built-in.o: In function `nf_conntrack_init_start': (.text+0x9baf6): undefined reference to `__compiletime_assert_1893' or ERROR: "__compiletime_assert_1893" [net/netfilter/nf_conntrack.ko] undefined! Fix this by forcing inlining of total_extension_size(). Fixes: b3a5db109e0670d6 ("netfilter: conntrack: use u8 for extension sizes again") Signed-off-by: Geert Uytterhoeven Acked-by: Arnd Bergmann Acked-by: Florian Westphal Signed-off-by: David S. Miller net/netfilter/nf_conntrack_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 86f8e247b960d6cf4cad8b65162e73301c5a58ec Author: Geert Uytterhoeven Date: Wed May 3 13:31:04 2017 +0200 test_bpf: Use ULL suffix for 64-bit constants On 32-bit: lib/test_bpf.c:4772: warning: integer constant is too large for ‘unsigned long’ type lib/test_bpf.c:4772: warning: integer constant is too large for ‘unsigned long’ type lib/test_bpf.c:4773: warning: integer constant is too large for ‘unsigned long’ type lib/test_bpf.c:4773: warning: integer constant is too large for ‘unsigned long’ type lib/test_bpf.c:4787: warning: integer constant is too large for ‘unsigned long’ type lib/test_bpf.c:4787: warning: integer constant is too large for ‘unsigned long’ type lib/test_bpf.c:4801: warning: integer constant is too large for ‘unsigned long’ type lib/test_bpf.c:4801: warning: integer constant is too large for ‘unsigned long’ type lib/test_bpf.c:4802: warning: integer constant is too large for ‘unsigned long’ type lib/test_bpf.c:4802: warning: integer constant is too large for ‘unsigned long’ type On 32-bit systems, "long" is only 32-bit. Replace the "UL" suffix by "ULL" to fix this. Fixes: 85f68fe898320575 ("bpf, arm64: implement jiting of BPF_XADD") Signed-off-by: Geert Uytterhoeven Acked-by: Daniel Borkmann Signed-off-by: David S. Miller lib/test_bpf.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 4c54dc0277d0d55a9248c43aebd31858f926a056 Author: Daniele Palmas Date: Wed May 3 10:30:11 2017 +0200 net: usb: qmi_wwan: add Telit ME910 support This patch adds support for Telit ME910 PID 0x1100. Signed-off-by: Daniele Palmas Acked-by: Bjørn Mork Signed-off-by: David S. Miller drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+) commit 37a7fdf2892be124545ddaf99b85de576121476c Author: YueHaibing Date: Wed May 3 15:51:32 2017 +0800 tg3: don't clear stats while tg3_close Now tg3 NIC's stats will be cleared after ifdown/ifup. bond_get_stats traverse its salves to get statistics,cumulative the increment.If a tg3 NIC is added to bonding as a slave,ifdown/ifup will cause bonding's stats become tremendous value (ex.1638.3 PiB) because of negative increment. Fixes: 92feeabf3f67 ("tg3: Save stats across chip resets") Signed-off-by: YueHaibing Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/tg3.c | 4 ---- 1 file changed, 4 deletions(-) commit 1c2dd16add7ebd7fc6a47f21a42f502cfed5ec2f Author: Alexei Starovoitov Date: Tue May 2 21:14:43 2017 -0700 selftests/bpf: get rid of -D__x86_64__ -D__x86_64__ workaround was used to make /usr/include/features.h to follow expected path through the system include headers. This is not portable. Instead define dummy stubs.h which is used by 'clang -target bpf' Fixes: 6882804c916b ("selftests/bpf: add a test for overlapping packet range checks") Signed-off-by: Alexei Starovoitov Signed-off-by: David S. Miller tools/testing/selftests/bpf/Makefile | 4 ++-- tools/testing/selftests/bpf/gnu/stubs.h | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) commit 6ead18fb18c8182a81d70f24942f9547e56a35d2 Author: Yonghong Song Date: Tue May 2 19:58:14 2017 -0700 selftests/bpf: add a test case to check verifier pointer arithmetic With clang/llvm 4.0+, the test case is able to generate the following pattern: .... 440: (b7) r1 = 15 441: (05) goto pc+73 515: (79) r6 = *(u64 *)(r10 -152) 516: (bf) r7 = r10 517: (07) r7 += -112 518: (bf) r2 = r7 519: (0f) r2 += r1 520: (71) r1 = *(u8 *)(r8 +0) 521: (73) *(u8 *)(r2 +45) = r1 .... commit 332270fdc8b6 ("bpf: enhance verifier to understand stack pointer arithmetic") improved verifier to handle such a pattern. This patch adds a C test case to actually generate such a pattern. A dummy tracepoint interface is used to load the program into the kernel. Signed-off-by: Yonghong Song Acked-by: Martin KaFai Lau Acked-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov Signed-off-by: David S. Miller tools/testing/selftests/bpf/Makefile | 2 +- tools/testing/selftests/bpf/test_progs.c | 16 ++ tools/testing/selftests/bpf/test_tcp_estats.c | 258 ++++++++++++++++++++++++++ 3 files changed, 275 insertions(+), 1 deletion(-) commit 4d463c4dbc5c1c5d73e488d52faeec05570443a0 Author: Daniel Borkmann Date: Wed May 3 00:39:17 2017 +0200 xdp: use common helper for netlink extended ack reporting Small follow-up to d74a32acd59a ("xdp: use netlink extended ACK reporting") in order to let drivers all use the same NL_SET_ERR_MSG_MOD() helper macro for reporting. This also ensures that we consistently add the driver's prefix for dumping the report in user space to indicate that the error message is driver specific and not coming from core code. Furthermore, NL_SET_ERR_MSG_MOD() now reuses NL_SET_ERR_MSG() and thus makes all macros check the pointer as suggested. References: https://www.spinics.net/lists/netdev/msg433267.html Signed-off-by: Daniel Borkmann Acked-by: Jakub Kicinski Reviewed-by: Johannes Berg Signed-off-by: David S. Miller drivers/net/ethernet/netronome/nfp/nfp_net_common.c | 4 ++-- drivers/net/virtio_net.c | 8 ++++---- include/linux/netlink.h | 19 ++++++++----------- 3 files changed, 14 insertions(+), 17 deletions(-) commit 6d717134a1a6e1b34a7d0d70e953037bc2642046 Author: David Ahern Date: Tue May 2 14:43:44 2017 -0700 net: ipv6: Do not duplicate DAD on link up Andrey reported a warning triggered by the rcu code: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 5911 at lib/debugobjects.c:289 debug_print_object+0x175/0x210 ODEBUG: activate active (active state 1) object type: rcu_head hint: (null) Modules linked in: CPU: 1 PID: 5911 Comm: a.out Not tainted 4.11.0-rc8+ #271 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:16 dump_stack+0x192/0x22d lib/dump_stack.c:52 __warn+0x19f/0x1e0 kernel/panic.c:549 warn_slowpath_fmt+0xe0/0x120 kernel/panic.c:564 debug_print_object+0x175/0x210 lib/debugobjects.c:286 debug_object_activate+0x574/0x7e0 lib/debugobjects.c:442 debug_rcu_head_queue kernel/rcu/rcu.h:75 __call_rcu.constprop.76+0xff/0x9c0 kernel/rcu/tree.c:3229 call_rcu_sched+0x12/0x20 kernel/rcu/tree.c:3288 rt6_rcu_free net/ipv6/ip6_fib.c:158 rt6_release+0x1ea/0x290 net/ipv6/ip6_fib.c:188 fib6_del_route net/ipv6/ip6_fib.c:1461 fib6_del+0xa42/0xdc0 net/ipv6/ip6_fib.c:1500 __ip6_del_rt+0x100/0x160 net/ipv6/route.c:2174 ip6_del_rt+0x140/0x1b0 net/ipv6/route.c:2187 __ipv6_ifa_notify+0x269/0x780 net/ipv6/addrconf.c:5520 addrconf_ifdown+0xe60/0x1a20 net/ipv6/addrconf.c:3672 ... Andrey's reproducer program runs in a very tight loop, calling 'unshare -n' and then spawning 2 sets of 14 threads running random ioctl calls. The relevant networking sequence: 1. New network namespace created via unshare -n - ip6tnl0 device is created in down state 2. address added to ip6tnl0 - equivalent to ip -6 addr add dev ip6tnl0 fd00::bb/1 - DAD is started on the address and when it completes the host route is inserted into the FIB 3. ip6tnl0 is brought up - the new fixup_permanent_addr function restarts DAD on the address 4. exit namespace - teardown / cleanup sequence starts - once in a blue moon, lo teardown appears to happen BEFORE teardown of ip6tunl0 + down on 'lo' removes the host route from the FIB since the dst->dev for the route is loobback + host route added to rcu callback list * rcu callback has not run yet, so rt is NOT on the gc list so it has NOT been marked obsolete 5. in parallel to 4. worker_thread runs addrconf_dad_completed - DAD on the address on ip6tnl0 completes - calls ipv6_ifa_notify which inserts the host route All of that happens very quickly. The result is that a host route that has been deleted from the IPv6 FIB and added to the RCU list is re-inserted into the FIB. The exit namespace eventually gets to cleaning up ip6tnl0 which removes the host route from the FIB again, calls the rcu function for cleanup -- and triggers the double rcu trace. The root cause is duplicate DAD on the address -- steps 2 and 3. Arguably, DAD should not be started in step 2. The interface is in the down state, so it can not really send out requests for the address which makes starting DAD pointless. Since the second DAD was introduced by a recent change, seems appropriate to use it for the Fixes tag and have the fixup function only start DAD for addresses in the PREDAD state which occurs in addrconf_ifdown if the address is retained. Big thanks to Andrey for isolating a reliable reproducer for this problem. Fixes: f1705ec197e7 ("net: ipv6: Make address flushing on ifdown optional") Reported-by: Andrey Konovalov Signed-off-by: David Ahern Tested-by: Andrey Konovalov Signed-off-by: David S. Miller net/ipv6/addrconf.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit f6fec61eb555e47e87234e8915ad726ba6c2d3f8 Author: David Cai Date: Tue May 2 20:59:14 2017 +0000 smsc911x: Adding support for Micochip LAN9250 Ethernet controller Adding support for Microchip LAN9250 Ethernet controller. Signed-off-by: David Cai Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/ethernet/smsc/smsc911x.c | 49 ++++++++++++++++++++++-------------- drivers/net/ethernet/smsc/smsc911x.h | 19 ++++++++++++++ 2 files changed, 49 insertions(+), 19 deletions(-) commit 8b8e3ad0c840f64a5de2c292cba33976571b9b73 Merge: 89c9fea 9178b4c Author: David S. Miller Date: Wed May 3 09:30:25 2017 -0400 Merge branch 'sample-bpf-loader-fixes' Jesper Dangaard Brouer says: ==================== Improve bpf ELF-loader under samples/bpf This series improves and fixes bpf ELF loader and programs under samples/bpf. The bpf_load.c created some hard to debug issues when the struct (bpf_map_def) used in the ELF maps section format changed in commit fb30d4b71214 ("bpf: Add tests for map-in-map"). This was hotfixed in commit 409526bea3c3 ("samples/bpf: bpf_load.c detect and abort if ELF maps section size is wrong") by detecting the issue and aborting the program. In most situations the bpf-loader should be able to handle these kind of changes to the struct size. This patch series aim to do proper backward and forward compabilility handling when loading ELF files. This series also adjust the callback that was introduced in commit 9fd63d05f3e8 ("bpf: Allow bpf sample programs (*_user.c) to change bpf_map_def") to use the new bpf_map_data structure, before more users start to use this callback. Hoping these changes can make the merge window, as above mentioned commits have not been merged yet, and it would be good to avoid users hitting these issues. ==================== Acked-by: Daniel Borkmann Signed-off-by: David S. Miller commit 9178b4c17d1b8b21738771d53d999c990e69f538 Author: Jesper Dangaard Brouer Date: Tue May 2 14:32:06 2017 +0200 samples/bpf: export map_data[] for more info on maps Giving *_user.c side tools access to map_data[] provides easier access to information on the maps being loaded. Still provide the guarantee that the order maps are being defined in inside the _kern.c file corresponds with the order in the array. Now user tools are not blind, but can inspect and verify the maps that got loaded from the ELF binary. Signed-off-by: Jesper Dangaard Brouer Signed-off-by: David S. Miller samples/bpf/bpf_load.h | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 6979bcc731f9680824a85a9efc43f36d01cec1b2 Author: Jesper Dangaard Brouer Date: Tue May 2 14:32:01 2017 +0200 samples/bpf: load_bpf.c make callback fixup more flexible Do this change before others start to use this callback. Change map_perf_test_user.c which seems to be the only user. This patch extends capabilities of commit 9fd63d05f3e8 ("bpf: Allow bpf sample programs (*_user.c) to change bpf_map_def"). Give fixup callback access to struct bpf_map_data, instead of only stuct bpf_map_def. This add flexibility to allow userspace to reassign the map file descriptor. This is very useful when wanting to share maps between several bpf programs. Signed-off-by: Jesper Dangaard Brouer Signed-off-by: David S. Miller samples/bpf/bpf_load.c | 17 ++++++++--------- samples/bpf/bpf_load.h | 10 ++++++++-- samples/bpf/map_perf_test_user.c | 14 +++++++------- 3 files changed, 23 insertions(+), 18 deletions(-) commit 156450d9d964447adfb44a231c634d2f5609d110 Author: Jesper Dangaard Brouer Date: Tue May 2 14:31:56 2017 +0200 samples/bpf: make bpf_load.c code compatible with ELF maps section changes This patch does proper parsing of the ELF "maps" section, in-order to be both backwards and forwards compatible with changes to the map definition struct bpf_map_def, which gets compiled into the ELF file. The assumption is that new features with value zero, means that they are not in-use. For backward compatibility where loading an ELF file with a smaller struct bpf_map_def, only copy objects ELF size, leaving rest of loaders struct zero. For forward compatibility where ELF file have a larger struct bpf_map_def, only copy loaders own struct size and verify that rest of the larger struct is zero, assuming this means the newer feature was not activated, thus it should be safe for this older loader to load this newer ELF file. Fixes: fb30d4b71214 ("bpf: Add tests for map-in-map") Fixes: 409526bea3c3 ("samples/bpf: bpf_load.c detect and abort if ELF maps section size is wrong") Signed-off-by: Jesper Dangaard Brouer Acked-by: Alexei Starovoitov Signed-off-by: David S. Miller samples/bpf/bpf_load.c | 224 ++++++++++++++++++++++++++++++++++--------------- 1 file changed, 155 insertions(+), 69 deletions(-) commit 55de170382a92d6da6fc9f23efc21eb2f3d25126 Author: Jesper Dangaard Brouer Date: Tue May 2 14:31:50 2017 +0200 samples/bpf: adjust rlimit RLIMIT_MEMLOCK for traceex2, tracex3 and tracex4 Needed to adjust max locked memory RLIMIT_MEMLOCK for testing these bpf samples as these are using more and larger maps than can fit in distro default 64Kbytes limit. Signed-off-by: Jesper Dangaard Brouer Signed-off-by: David S. Miller samples/bpf/tracex2_user.c | 7 +++++++ samples/bpf/tracex3_user.c | 7 +++++++ samples/bpf/tracex4_user.c | 8 ++++++++ 3 files changed, 22 insertions(+) commit 33b88e708e7dfa58dc896da2a98f5719d2eb315c Author: Vince Weaver Date: Tue May 2 14:08:50 2017 -0400 perf/x86: Fix Broadwell-EP DRAM RAPL events It appears as though the Broadwell-EP DRAM units share the special units quirk with Haswell-EP/KNL. Without this patch, you get really high results (a single DRAM using 20W of power). The powercap driver in drivers/powercap/intel_rapl.c already has this change. Signed-off-by: Vince Weaver Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Jiri Olsa Cc: Kan Liang Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Stephane Eranian Cc: Stephane Eranian Cc: Thomas Gleixner Cc: linux-kernel@vger.kernel.org Cc: Signed-off-by: Ingo Molnar arch/x86/events/intel/rapl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ee320b33b4a316e22612ad6409517fc647f2a37c Author: Arnd Bergmann Date: Fri Apr 28 11:44:11 2017 +0200 of: fix uninitialized variable warning for overlay test gcc warns that an empty device tree would cause undefined behavior: drivers/of/unittest.c: In function 'of_unittest': drivers/of/unittest.c:2199:25: warning: 'last_sibling' may be used uninitialized in this function [-Wmaybe-uninitialized] This adds an initialization of the variable to zero, which we handle correctly. Fixes: 81d0848fc8d2 ("of: Add unit tests for applying overlays") Signed-off-by: Arnd Bergmann Signed-off-by: Rob Herring drivers/of/unittest.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 700b7eadd5625d22b8235fb21259b3d7d564c000 Author: Nicholas Piggin Date: Wed Apr 19 05:12:17 2017 +1000 powerpc/64s: Power9 has no LPCR[VRMASD] field so don't set it Power9/ISAv3 has no VRMASD field in LPCR, we shouldn't be setting reserved bits, so don't set them on Power9. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman arch/powerpc/kernel/cpu_setup_power.S | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) commit 6b3d12a948d27977816a15eb48409a298902a548 Author: Alistair Popple Date: Wed May 3 13:24:08 2017 +1000 powerpc/powernv: Fix TCE kill on NVLink2 Commit 616badd2fb49 ("powerpc/powernv: Use OPAL call for TCE kill on NVLink2") forced all TCE kills to go via the OPAL call for NVLink2. However the PHB3 implementation of TCE kill was still being called directly from some functions which in some circumstances caused a machine check. This patch adds an equivalent IODA2 version of the function which uses the correct invalidation method depending on PHB model and changes all external callers to use it instead. Fixes: 616badd2fb49 ("powerpc/powernv: Use OPAL call for TCE kill on NVLink2") Cc: stable@vger.kernel.org # v4.11+ Signed-off-by: Alistair Popple Signed-off-by: Michael Ellerman arch/powerpc/platforms/powernv/npu-dma.c | 8 ++++---- arch/powerpc/platforms/powernv/pci-ioda.c | 10 +++++++++- arch/powerpc/platforms/powernv/pci.h | 2 +- 3 files changed, 14 insertions(+), 6 deletions(-) commit 3c9ac2bcc35453141f82461c71ed109ded152a6a Author: Michael Ellerman Date: Tue May 2 21:00:14 2017 +1000 powerpc/mm/radix: Drop support for CPUs without lockless tlbie Currently the radix TLB code includes support for CPUs that do *not* have MMU_FTR_LOCKLESS_TLBIE. On those CPUs we are required to take a global spinlock before issuing a tlbie. Radix can only be built for 64-bit Book3s CPUs, and of those, only POWER4, 970, Cell and PA6T do not have MMU_FTR_LOCKLESS_TLBIE. Although it's possible to build a kernel with Radix support that can also boot on those CPUs, we happen to know that in reality none of those CPUs support the Radix MMU, so the code can never actually run on those CPUs. So remove the native_tlbie_lock in the Radix TLB code. Note that there is another lock of the same name in the hash code, which is unaffected by this patch. Reviewed-by: Nicholas Piggin Signed-off-by: Michael Ellerman arch/powerpc/mm/tlb-radix.c | 45 +++++++-------------------------------------- 1 file changed, 7 insertions(+), 38 deletions(-) commit 9744a6fcefcb4d56501d69adb04c24559d353cad Author: Pablo Neira Ayuso Date: Mon May 1 12:58:50 2017 +0200 netfilter: nf_tables: check if same extensions are set when adding elements If no NLM_F_EXCL is set and the element already exists in the set, make sure that both elements have the same extensions. Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_tables_api.c | 5 +++++ 1 file changed, 5 insertions(+) commit e3cd7f013bac3105d44b8bd5a90359989d45b5a5 Author: James Hogan Date: Wed May 3 09:54:20 2017 +0100 metag/mm: Drop pointless increment The increment of entry in the loop in mmu_init for meta1 is redundant as it isn't used again, so drop it. Reported-by: David Binderman Signed-off-by: James Hogan arch/metag/mm/mmu-meta1.c | 1 - 1 file changed, 1 deletion(-) commit 4512c7bccb7794fb6d6ff37ae449154413bd4963 Author: Paul Gortmaker Date: Tue May 2 18:21:12 2017 -0400 soc/qbman: Fix implicit header dependency now causing build fails In commit 461a6946b1f9 ("iommu: Remove pci.h include from trace/events/iommu.h") that header shuffle uncovered an implicit include in this driver, manifesting as: CC drivers/soc/fsl/qbman/qman_portal.o drivers/soc/fsl/qbman/qman_portal.c: In function 'qman_portal_probe': drivers/soc/fsl/qbman/qman_portal.c:299:2: error: implicit declaration of function 'dma_set_mask' drivers/soc/fsl/qbman/qman_portal.c:299:2: error: implicit declaration of function 'DMA_BIT_MASK' if (dma_set_mask(dev, DMA_BIT_MASK(40))) { ^ on the corenet32_smp_defconfig (and 64 bit respectively.) The above commit was singled out via git bisect. The header it was implictly relying on getting was dma-mapping.h - so we explicitly add it here. Fixes: 461a6946b1f9 ("iommu: Remove pci.h include from trace/events/iommu.h") Cc: Joerg Roedel Cc: Scott Wood Cc: linuxppc-dev@lists.ozlabs.org Signed-off-by: Paul Gortmaker Signed-off-by: Joerg Roedel drivers/soc/fsl/qbman/qman_portal.c | 2 ++ 1 file changed, 2 insertions(+) commit db55947dd2d09cd3e6f722d1205934fec793ee63 Author: Heiko Carstens Date: Tue May 2 13:20:11 2017 +0200 s390/uprobes: fix compile for !KPROBES Fix the following compile error(s) if CONFIG_KPROBES is disabled: arch/s390/kernel/uprobes.c:79:14: error: implicit declaration of function 'probe_get_fixup_type' arch/s390/kernel/uprobes.c:87:14: error: 'FIXUP_PSW_NORMAL' undeclared (first use in this function) Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky arch/s390/include/asm/dis.h | 2 ++ arch/s390/include/asm/kprobes.h | 20 ++++++++++---------- arch/s390/lib/probes.c | 1 + 3 files changed, 13 insertions(+), 10 deletions(-) commit 085b6ba0f7971d18fc3078b25e8309e9e75659cb Author: Heiko Carstens Date: Tue May 2 12:38:57 2017 +0200 s390/ftrace: fix compile for !MODULES Fix this compile error if CONFIG_MODULES is disabled: arch/s390/built-in.o: In function `ftrace_plt_init': arch/s390/kernel/ftrace.o:(.init.text+0x34cc): undefined reference to `module_alloc' Reported-by: Rob Landley Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky arch/s390/kernel/ftrace.c | 4 ++++ 1 file changed, 4 insertions(+) commit 07a63cbe8bcb6ba72fb989dcab1ec55ec6c36c7e Author: Martin Schwidefsky Date: Tue May 2 13:36:00 2017 +0200 s390/cputime: fix incorrect system time git commit c5328901aa1db134 "[S390] entry[64].S improvements" removed the update of the exit_timer lowcore field from the critical section cleanup of the .Lsysc_restore/.Lsysc_done and .Lio_restore/.Lio_done blocks. If the PSW is updated by the critical section cleanup to point to user space again, the interrupt entry code will do a vtime calculation after the cleanup completed with an exit_timer value which has *not* been updated. Due to this incorrect system time deltas are calculated. If an interrupt occured with an old PSW between .Lsysc_restore/.Lsysc_done or .Lio_restore/.Lio_done update __LC_EXIT_TIMER with the system entry time of the interrupt. Cc: stable@vger.kernel.org # 3.3+ Tested-by: Christian Borntraeger Signed-off-by: Martin Schwidefsky arch/s390/kernel/entry.S | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) commit 028d5bf161d11b6cab9f2d0ad076cccd1d8495bc Author: Masahiro Yamada Date: Wed Apr 12 08:36:32 2017 +0900 ia64: beatify build log for gate.so and gate-syms.o Currently, the object path is not aligned in the build log: LDS arch/ia64/kernel/gate.lds AS arch/ia64/kernel/gate.o GATE arch/ia64/kernel/gate.so AS arch/ia64/kernel/gate-data.o Signed-off-by: Masahiro Yamada arch/ia64/kernel/Makefile.gate | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 20652ed6e44f4963281b65209b917be86ac6765b Merge: b5fe223 933dfbd Author: Ingo Molnar Date: Wed May 3 08:00:14 2017 +0200 Merge branch 'for-mingo' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu into core/rcu Pull RCU fixes from Paul E. McKenney: "This series adds a pair of commits that move function definitions from include/linux/rcu_segcblist.h to new kernel/rcu/rcu_segcblist.h and kernel/rcu/rcu_segcblist.c files, thus greatly decreasing the size of the externally visible include/linux/rcu_segcblist.h file." Signed-off-by: Ingo Molnar commit 3eec0291830e4c28d09f73bab247f3b59172022b Author: Masahiro Yamada Date: Sun Sep 11 16:42:16 2016 +0900 alpha: make short build log available for division routines This enables the Kbuild standard log style as follows: AS arch/alpha/lib/__divlu.o AS arch/alpha/lib/__divqu.o AS arch/alpha/lib/__remlu.o AS arch/alpha/lib/__remqu.o Signed-off-by: Masahiro Yamada arch/alpha/lib/Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit e19a4e3f1bffe45b8e2ea67fcfb0c9c88278c4cc Author: Masahiro Yamada Date: Sun Sep 11 16:42:15 2016 +0900 alpha: merge build rules of division routines These four objects are generated by the same build rule, with different compile options. The build rules can be merged. Signed-off-by: Masahiro Yamada arch/alpha/lib/Makefile | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) commit 5ed78e5523fd9ba77b8444d380d54da1f88c53fc Author: Masahiro Yamada Date: Sun Sep 11 16:42:14 2016 +0900 alpha: add $(src)/ rather than $(obj)/ to make source file path $(ev6-y)divide.S is a source file, not a build-time generated file. So, it should be prefixed with $(src)/ rather than $(obj)/. Signed-off-by: Masahiro Yamada arch/alpha/lib/Makefile | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 3dbd8204af48d0da442f11ad39aa778a5fd462bf Author: Boris Ostrovsky Date: Tue May 2 13:23:06 2017 -0400 xen: Move xen_have_vector_callback definition to enlighten.c Commit 84d582d236dc ("xen: Revert commits da72ff5bfcb0 and 72a9b186292d") defined xen_have_vector_callback in enlighten_hvm.c. Since guest-type-neutral code refers to this variable this causes build failures when CONFIG_XEN_PVHVM is not defined. Moving xen_have_vector_callback definition to enlighten.c resolves this issue. Signed-off-by: Boris Ostrovsky Reported-by: Randy Dunlap Acked-by: Randy Dunlap Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross arch/x86/xen/enlighten.c | 3 +++ arch/x86/xen/enlighten_hvm.c | 3 --- 2 files changed, 3 insertions(+), 3 deletions(-) commit d93b0ac01a9ce276ec39644be47001873d3d183c Author: Mahesh Salgaonkar Date: Tue Apr 18 22:08:17 2017 +0530 powerpc/book3s/mce: Move add_taint() later in virtual mode machine_check_early() gets called in real mode. The very first time when add_taint() is called, it prints a warning which ends up calling opal call (that uses OPAL_CALL wrapper) for writing it to console. If we get a very first machine check while we are in opal we are doomed. OPAL_CALL overwrites the PACASAVEDMSR in r13 and in this case when we are done with MCE handling the original opal call will use this new MSR on it's way back to opal_return. This usually leads to unexpected behaviour or the kernel to panic. Instead move the add_taint() call later in the virtual mode where it is safe to call. This is broken with current FW level. We got lucky so far for not getting very first MCE hit while in OPAL. But easily reproducible on Mambo. Fixes: 27ea2c420cad ("powerpc: Set the correct kernel taint on machine check errors.") Cc: stable@vger.kernel.org # v4.2+ Signed-off-by: Mahesh Salgaonkar Signed-off-by: Michael Ellerman arch/powerpc/kernel/mce.c | 2 ++ arch/powerpc/kernel/traps.c | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) commit 3f2290e1b5192fdfa74f012220a8d90067beb076 Author: Michael Ellerman Date: Mon Apr 24 20:46:59 2017 +1000 powerpc/sysfs: Move #ifdef CONFIG_HOTPLUG_CPU out of the function body The entire body of unregister_cpu_online() is inside an #ifdef CONFIG_HOTPLUG_CPU block. This is ugly and means we create an empty function when hotplug is disabled for no reason. Instead move the #ifdef out of the function body and define the function to be NULL in the else case. This means we'll pass NULL to cpuhp_setup_state(), but that's fine because it accepts NULL to mean there is no teardown callback, which is exactly what we want. Signed-off-by: Michael Ellerman arch/powerpc/kernel/sysfs.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 687b8f24f14db842c8c3f8cb8b24c9a29b691db8 Author: Michael Ellerman Date: Wed Feb 15 20:49:54 2017 +1100 powerpc/smp: Document irq enable/disable after migrating IRQs This code was until recently completely undocumented and even now the comment is not very verbose. We've already had one patch sent to remove the IRQ enable/disable because it's "paradoxical and unnecessary". So document it thoroughly to save anyone else from puzzling over it. Signed-off-by: Michael Ellerman arch/powerpc/kernel/smp.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit 0cc68bfad45b47167c9d99cf560b505983ebd012 Author: Michael Ellerman Date: Fri Feb 17 17:31:22 2017 +1100 powerpc/mpc52xx: Don't select user-visible RTAS_PROC Otherwise we might select it when its dependenices aren't enabled, leading to a build break. It's default y anyway, so will be on unless someone disables it manually. Signed-off-by: Michael Ellerman arch/powerpc/platforms/52xx/Kconfig | 1 - 1 file changed, 1 deletion(-) commit b7da1230532984fc00962b2c8be94acc87655707 Author: Andrew Donnellan Date: Fri Jul 22 17:16:35 2016 +1000 powerpc/powernv: Document cxl dependency on special case in pnv_eeh_reset() pnv_eeh_reset() has special handling for PEs whose primary bus is the root bus or the bus immediately underneath the root port. The cxl bi-modal card support added in b0b5e5918ad1 ("cxl: Add cxl_check_and_switch_mode() API to switch bi-modal cards") relies on this behaviour when hot-resetting the CAPI adapter following a mode switch. Document this in pnv_eeh_reset() so we don't accidentally break it. Suggested-by: Gavin Shan Signed-off-by: Andrew Donnellan Reviewed-by: Gavin Shan Signed-off-by: Michael Ellerman arch/powerpc/platforms/powernv/eeh-powernv.c | 7 +++++++ 1 file changed, 7 insertions(+) commit bd74370b8657fc6fdab7b0d5024d011985183809 Author: Rabin Vincent Date: Sun Apr 30 18:16:00 2017 +0200 Makefile: evaluate LDFLAGS_BUILD_ID only once Evaluate LDFLAGS_BUILD_ID (which involves invoking the compiler) only once instead of over and over. This provides a ~20% reduction in null build time with x86 allnoconfig: $ make allnoconfig && make -j8 $ perf stat -r5 -e sched:sched_process_exec make -j8 - 2 119 sched:sched_process_exec + 1 878 sched:sched_process_exec - 1,238817018 seconds time elapsed + 0,971020553 seconds time elapsed Signed-off-by: Rabin Vincent Signed-off-by: Masahiro Yamada Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e8a3118e1f5cbe0c26704419390bf074689b349f Author: Jiri Slaby Date: Fri Apr 21 17:16:20 2017 +0200 objtool: make it visible in make V=1 output It is currently impossible to see what is going on with objtool when building, so call echo-cmd to see the actions: gcc -Wp,-MD,arch/x86/entry/.entry_64.o.d -nostdinc -isystem ... ./tools/objtool/objtool check "arch/x86/entry/entry_64.o"; Signed-off-by: Jiri Slaby Cc: Michal Marek Cc: linux-kbuild@vger.kernel.org Cc: Josh Poimboeuf Signed-off-by: Masahiro Yamada scripts/Makefile.build | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 9a744b92da6eacea33dec1e9280fd324736bfe81 Author: Chao Yu Date: Wed Apr 26 17:39:55 2017 +0800 f2fs: shrink size of struct discard_cmd In order to shrink size of struct discard_cmd, change variable type of @state in struct discard_cmd from int to unsigned char. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/f2fs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ec9895add2c519681c45a8599262d1d9b4986349 Author: Chao Yu Date: Wed Apr 26 17:39:54 2017 +0800 f2fs: don't hold cmd_lock during waiting discard command Previously, with protection of cmd_lock, we will wait for end io of discard command which potentially may lead long latency, making worse concurrency. So, in this patch, we try to add reference into discard entry to prevent the entry being released by other thread, then we can avoid holding global cmd_lock during waiting discard to finish. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/f2fs.h | 1 + fs/f2fs/segment.c | 25 ++++++++++++++++++++----- 2 files changed, 21 insertions(+), 5 deletions(-) commit 4d9780781304af0a57b6e369ce353f7bd2fb5e52 Author: Jaegeuk Kim Date: Wed Apr 26 11:11:12 2017 -0700 f2fs: nullify fio->encrypted_page for each writes This makes sure each write request has nullified encrypted_page pointer. Signed-off-by: Jaegeuk Kim fs/f2fs/segment.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b9dd46188edc2f0d1f37328637860bb65a771124 Author: Jin Qian Date: Tue Apr 25 16:28:48 2017 -0700 f2fs: sanity check segment count F2FS uses 4 bytes to represent block address. As a result, supported size of disk is 16 TB and it equals to 16 * 1024 * 1024 / 2 segments. Signed-off-by: Jin Qian Signed-off-by: Jaegeuk Kim fs/f2fs/super.c | 7 +++++++ include/linux/f2fs_fs.h | 6 ++++++ 2 files changed, 13 insertions(+) commit a817737e87d506ea7b3983d287b4578c99922d85 Author: Jaegeuk Kim Date: Mon Apr 24 15:20:16 2017 -0700 f2fs: introduce valid_ipu_blkaddr to clean up This patch introduces valid_ipu_blkaddr to clean up checking block address for inplace-update. Signed-off-by: Jaegeuk Kim fs/f2fs/data.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) commit e959c8f543e11dadf7f6923427fb3acb452a0de6 Author: Hou Pengyang Date: Tue Apr 25 12:45:13 2017 +0000 f2fs: lookup extent cache first under IPU scenario If a page is cold, NOT atomit written and need_ipu now, there is a high probability that IPU should be adapted. For IPU, we try to check extent tree to get the block index first, instead of reading the dnode page, where may lead to an useless dnode IO, since no need to update the dnode index for IPU. Signed-off-by: Hou Pengyang Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/data.c | 16 ++++++++++++++-- fs/f2fs/gc.c | 1 + fs/f2fs/segment.c | 1 + 3 files changed, 16 insertions(+), 2 deletions(-) commit 7eab0c0df8d1a8c460f7d660d3ffd06fd448e590 Author: Hou Pengyang Date: Tue Apr 25 12:45:12 2017 +0000 f2fs: reconstruct code to write a data page This patch introduces encrypt_one_page which encrypts one data page before submit_bio, and change the use of need_inplace_update. Signed-off-by: Hou Pengyang Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/data.c | 81 ++++++++++++++++++++++++++++++++++--------------------- fs/f2fs/file.c | 4 +-- fs/f2fs/segment.h | 6 +---- 3 files changed, 54 insertions(+), 37 deletions(-) commit 63a94fa1d79dfbb94a2c923f8810e3b45b27570e Author: Chao Yu Date: Tue Apr 25 20:21:38 2017 +0800 f2fs: introduce __wait_discard_cmd Just cleanup, no logic change. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/segment.c | 40 ++++++++++++++++++---------------------- 1 file changed, 18 insertions(+), 22 deletions(-) commit bd5b07383a9057f9b6aefad6c784af95ffde8a67 Author: Chao Yu Date: Tue Apr 25 20:21:37 2017 +0800 f2fs: introduce __issue_discard_cmd Just cleanup, no logic change. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/segment.c | 63 ++++++++++++++++++++++++++----------------------------- 1 file changed, 30 insertions(+), 33 deletions(-) commit fe25cc347959b1efd18ee150165416aa6ed0ecdd Author: Xiubo Li Date: Tue May 2 15:54:29 2017 +0800 tcmu: Recalculate the tcmu_cmd size to save cmd area memories For the "struct tcmu_cmd_entry" in cmd area, the minimum size will be sizeof(struct tcmu_cmd_entry) == 112 Bytes. And it could fill about (sizeof(struct rsp) - sizeof(struct req)) / sizeof(struct iovec) == 68 / 16 ~= 4 data regions(iov[4]) by default. For most tcmu_cmds, the data block indexes allocated from the data area will be continuous. And for the continuous blocks they will be merged into the same region using only one iovec. For the current code, it will always allocates the same number of iovecs with blocks for each tcmu_cmd, and it will wastes much memories. For example, when the block size is 4K and the DATA_OUT buffer size is 64K, and the regions needed is less than 5(on my environment is almost 99.7%). The current code will allocate about 16 iovecs, and there will be (16 - 4) * sizeof(struct iovec) = 192 Bytes cmd area memories wasted. Here adds two helpers to calculate the base size and full size of the tcmu_cmd. And will recalculate them again when it make sure how many iovs is needed before insert it to cmd area. Signed-off-by: Xiubo Li Acked-by: Mike Christie Signed-off-by: Nicholas Bellinger drivers/target/target_core_user.c | 52 ++++++++++++++++++++++++++++++--------- 1 file changed, 41 insertions(+), 11 deletions(-) commit 726bd223105c04f7bf5eacdc2540819c301061f7 Author: Christophe Leroy Date: Mon May 1 09:38:13 2017 +0200 powerpc/8xx: Adding support of IRQ in MPC8xx GPIO This patch allows the use of IRQ to notify the change of GPIO status on MPC8xx CPM IO ports. This then allows to associate IRQs to GPIOs in the Device Tree. Ex: CPM1_PIO_C: gpio-controller@960 { #gpio-cells = <2>; compatible = "fsl,cpm1-pario-bank-c"; reg = <0x960 0x10>; fsl,cpm1-gpio-irq-mask = <0x0fff>; interrupts = <1 2 6 9 10 11 14 15 23 24 26 31>; interrupt-parent = <&CPM_PIC>; gpio-controller; }; The property 'fsl,cpm1-gpio-irq-mask' defines which of the 16 GPIOs have the associated interrupts defined in the 'interrupts' property. Signed-off-by: Christophe Leroy Signed-off-by: Scott Wood .../devicetree/bindings/soc/fsl/cpm_qe/gpio.txt | 21 +++++++++++++++++- arch/powerpc/include/asm/cpm1.h | 2 ++ arch/powerpc/sysdev/cpm1.c | 25 ++++++++++++++++++++++ 3 files changed, 47 insertions(+), 1 deletion(-) commit 89c9fea3c8034cdb2fd745f551cde0b507fd6893 Merge: 76f1948 6fbc879 Author: Linus Torvalds Date: Tue May 2 19:09:35 2017 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial Pull trivial tree updates from Jiri Kosina. * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial: tty: fix comment for __tty_alloc_driver() init/main: properly align the multi-line comment init/main: Fix double "the" in comment Fix dead URLs to ftp.kernel.org drivers: Clean up duplicated email address treewide: Fix typo in xml/driver-api/basics.xml tools/testing/selftests/powerpc: remove redundant CFLAGS in Makefile: "-Wall -O2 -Wall" -> "-O2 -Wall" selftests/timers: Spelling s/privledges/privileges/ HID: picoLCD: Spelling s/REPORT_WRTIE_MEMORY/REPORT_WRITE_MEMORY/ net: phy: dp83848: Fix Typo UBI: Fix typos Documentation: ftrace.txt: Correct nice value of 120 priority net: fec: Fix typo in error msg and comment treewide: Fix typos in printk commit 6a623e07694437ad09f382a13f76cffc32239a7f Author: Alexander Couzens Date: Tue May 2 12:19:00 2017 +0200 mtd: nand: add ooblayout for old hamming layout The old 1-bit hamming layout requires ECC data to be placed at a fixed offset, and not necessarily at the end of the OOB area. Add this old layout back in order to fix legacy setups. Fixes: 41b207a70d3a ("mtd: nand: implement the default mtd_ooblayout_ops") Cc: Signed-off-by: Alexander Couzens Acked-by: Boris Brezillon Signed-off-by: Brian Norris drivers/mtd/nand/nand_base.c | 70 +++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 69 insertions(+), 1 deletion(-) commit 76f1948a79b26d5f57a5ee9941876b745c6baaea Merge: 7af4c72 a084160 Author: Linus Torvalds Date: Tue May 2 18:24:16 2017 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/livepatching Pull livepatch updates from Jiri Kosina: - a per-task consistency model is being added for architectures that support reliable stack dumping (extending this, currently rather trivial set, is currently in the works). This extends the nature of the types of patches that can be applied by live patching infrastructure. The code stems from the design proposal made [1] back in November 2014. It's a hybrid of SUSE's kGraft and RH's kpatch, combining advantages of both: it uses kGraft's per-task consistency and syscall barrier switching combined with kpatch's stack trace switching. There are also a number of fallback options which make it quite flexible. Most of the heavy lifting done by Josh Poimboeuf with help from Miroslav Benes and Petr Mladek [1] https://lkml.kernel.org/r/20141107140458.GA21774@suse.cz - module load time patch optimization from Zhou Chengming - a few assorted small fixes * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/livepatching: livepatch: add missing printk newlines livepatch: Cancel transition a safe way for immediate patches livepatch: Reduce the time of finding module symbols livepatch: make klp_mutex proper part of API livepatch: allow removal of a disabled patch livepatch: add /proc//patch_state livepatch: change to a per-task consistency model livepatch: store function sizes livepatch: use kstrtobool() in enabled_store() livepatch: move patching functions into patch.c livepatch: remove unnecessary object loaded check livepatch: separate enabled and patched states livepatch/s390: add TIF_PATCH_PENDING thread flag livepatch/s390: reorganize TIF thread flag bits livepatch/powerpc: add TIF_PATCH_PENDING thread flag livepatch/x86: add TIF_PATCH_PENDING thread flag livepatch: create temporary klp_update_patch_state() stub x86/entry: define _TIF_ALLWORK_MASK flags explicitly stacktrace/x86: add function for detecting reliable stack traces commit 7af4c727c7b6104f94f2ffc3d0899e75a9cc1e55 Merge: 68fed41 4d6ca22 Author: Linus Torvalds Date: Tue May 2 18:07:04 2017 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid Pull HID subsystem updates from Jiri Kosina: - The need for HID_QUIRK_NO_INIT_REPORTS per-device quirk has been growing dramatically during past years, so the time has come to switch over the default, and perform the pro-active reading only in cases where it's really needed (multitouch, wacom). The only place where this behavior is (in some form) preserved is hiddev so that we don't introduce userspace-visible change of behavior. From Benjamin Tissoires - HID++ support for power_supply / baterry reporting. From Benjamin Tissoires and Bastien Nocera - Vast improvements / rework of DS3 and DS4 in Sony driver. From Roderick Colenbrander - Improvment (in terms of getting closer to the Microsoft's interpretation of slightly ambiguous specification) of logical range interpretation in case null-state is set in the rdesc. From Valtteri Heikkilä and Tomasz Kramkowski - A lot of newly supported device IDs and small assorted fixes * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: (71 commits) HID: usbhid: Add HID_QUIRK_NOGET for Aten CS-1758 KVM switch HID: asus: support backlight on USB keyboards HID: wacom: Move wacom_remote_irq and wacom_remote_status_irq HID: wacom: generic: sync pad events only for actual packets HID: sony: remove redundant check for -ve err HID: sony: Make sure to unregister sensors on failure HID: sony: Make DS4 bt poll interval adjustable HID: sony: Set proper bit flags on DS4 output report HID: sony: DS4 use brighter LED colors HID: sony: Improve navigation controller axis/button mapping HID: sony: Use DS3 MAC address as unique identifier on USB HID: logitech-hidpp: add a sysfs file to tell we support power_supply HID: logitech-hidpp: enable HID++ 1.0 battery reporting HID: logitech-hidpp: add support for battery status for the K750 HID: logitech-hidpp: battery: provide CAPACITY_LEVEL HID: logitech-hidpp: rename battery level into capacity HID: logitech-hidpp: battery: provide ONLINE property HID: logitech-hidpp: notify battery on connect HID: logitech-hidpp: return an error if the queried feature is not present HID: logitech-hidpp: create the battery for all types of HID++ devices ... commit 68fed41e0ff6c0332520a0d70ac05be2a7d9130e Merge: be580e7 1aa2faf Author: Linus Torvalds Date: Tue May 2 17:59:33 2017 -0700 Merge tag 'pinctrl-v4.12-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control updates from Linus Walleij: "This is the bulk of pin control changes for the v4.12 cycle. The extra week before the merge window actually resulted in some of the type of fixes that usually arrive after the merge window already starting to trickle in from eager developers using -next, I'm impressed. I have recruited a Samsung subsubsystem maintainer (Krzysztof) to deal with the onset of Samsung patches. It works great. Apart from that it is a boring round, just incremental updates and fixes all over the place, no serious core changes or anything exciting like that. The most pleasing to see is Julia Cartwrights work to audit the irqchip-providing drivers for realtime locking compliance. It's one of those "I should really get around to looking into that" things that have been on my TODO list since forever. Summary: Core changes: - add bi-directional and output-enable pin configurations to the generic bindings and generic pin controlling core. New drivers or subdrivers: - Armada 37xx SoC pin controller and GPIO support. - Axis ARTPEC-6 SoC pin controller support. - AllWinner A64 R_PIO controller support, and opening up the AllWinner sunxi driver for ARM64 use. - Rockchip RK3328 support. - Renesas R-Car H3 ES2.0 support. - STM32F469 support in the STM32 driver. - Aspeed G4 and G5 pin controller support. Improvements: - a whole slew of realtime improvements to drivers implementing irqchips: BCM, AMD, SiRF, sunxi, rockchip. - switch meson driver to get the GPIO ranges from the device tree. - input schmitt trigger support on the Rockchip driver. - enable the sunxi (AllWinner) driver to also be used on ARM64 silicon. - name the Qualcomm QDF2xxx GPIO lines. - support GMMR GPIO regions on the Intel Cherryview. This fixes a serialization problem on these platforms. - pad retention support for the Samsung Exynos 5433. - handle suspend-to-ram in the AT91-pio4 driver. - pin configuration support in the Aspeed driver. Cleanups: - the final name of Rockchip RK1108 was RV1108 so rename the driver and variables to stay consistent" * tag 'pinctrl-v4.12-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (80 commits) pinctrl: mediatek: Add missing pinctrl bindings for mt7623 pinctrl: artpec6: Fix return value check in artpec6_pmx_probe() pinctrl: artpec6: Remove .owner field for driver pinctrl: tegra: xusb: Silence sparse warnings ARM: at91/at91-pinctrl documentation: fix spelling mistake: "contoller" -> "controller" pinctrl: make artpec6 explicitly non-modular pinctrl: aspeed: g5: Add pinconf support pinctrl: aspeed: g4: Add pinconf support pinctrl: aspeed: Add core pinconf support pinctrl: aspeed: Document pinconf in devicetree bindings pinctrl: Add st,stm32f469-pinctrl compatible to stm32-pinctrl pinctrl: stm32: Add STM32F469 MCU support Documentation: dt: Remove ngpios from stm32-pinctrl binding pinctrl: stm32: replace device_initcall() with arch_initcall() pinctrl: stm32: add possibility to use gpio-ranges to declare bank range pinctrl: armada-37xx: Add gpio support pinctrl: armada-37xx: Add pin controller support for Armada 37xx pinctrl: dt-bindings: Add documentation for Armada 37xx pin controllers pinctrl: core: Make pinctrl_init_controller() static pinctrl: generic: Add bi-directional and output-enable ... commit be580e7522eecfcf31c70abdf6fa0ae77b2e293b Merge: 8d65b08 a627f02 Author: Linus Torvalds Date: Tue May 2 17:34:32 2017 -0700 Merge tag 'mmc-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC updates from Ulf Hansson: "MMC core: - Continue to re-factor code to prepare for eMMC CMDQ and blkmq support - Introduce queue semantics to prepare for eMMC CMDQ and blkmq support - Add helper functions to manage temporary enable/disable of eMMC CMDQ - Improve wait-busy detection for SDIO MMC host: - cavium: Add driver to support Cavium controllers - cavium: Extend Cavium driver to support Octeon and ThunderX SOCs - bcm2835: Add new driver for Broadcom BCM2835 controller - sdhci-xenon: Add driver to support Marvell Xenon SDHCI controller - sdhci-tegra: Add support for the Tegra186 variant - sdhci-of-esdhc: Support for UHS-I SD cards - sdhci-of-esdhc: Support for eMMC HS200 cards - sdhci-cadence: Add eMMC HS400 enhanced strobe support - sdhci-esdhc-imx: Reset tuning circuit when needed - sdhci-pci: Modernize and clean-up some PM related code - sdhci-pci: Avoid re-tuning at runtime PM for some Intel devices - sdhci-pci|acpi: Use aggressive PM for some Intel BYT controllers - sdhci: Re-factoring and modernizations - sdhci: Optimize delay loops - sdhci: Improve register dump print format - sdhci: Add support for the Command Queue Engine - meson-gx: Various improvements and clean-ups - meson-gx: Add support for CMD23 - meson-gx: Basic tuning support to avoid CRC errors - s3cmci: Enable probing via DT - mediatek: Improve tuning support for eMMC HS200 and HS400 mode - tmio: Improve DMA support - tmio: Use correct response for CMD12 - dw_mmc: Minor improvements and clean-ups" * tag 'mmc-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (148 commits) mmc: sdhci-of-esdhc: limit SD clock for ls1012a/ls1046a mmc: sdhci-of-esdhc: poll ESDHC_CLOCK_STABLE bit with udelay mmc: sdhci-xenon: Fix default value of LOGIC_TIMING_ADJUST for eMMC5.0 PHY mmc: sdhci-xenon: Fix the work flow in xenon_remove(). MIPS: Octeon: cavium_octeon_defconfig: Enable Octeon MMC mmc: sdhci-xenon: Remove redundant dev_err call in get_dt_pad_ctrl_data() mmc: cavium: Use module_pci_driver to simplify the code mmc: cavium: Add MMC support for Octeon SOCs. mmc: cavium: Fix detection of block or byte addressing. mmc: core: Export API to allow hosts to get the card address mmc: sdio: Fix sdio wait busy implement limitation mmc: sdhci-esdhc-imx: reset tuning circuit when power on mmc card clk: apn806: fix spelling mistake: "mising" -> "missing" mmc: sdhci-of-esdhc: add delay between tuning cycles mmc: sdhci: Control the delay between tuning commands mmc: sdhci-of-esdhc: add tuning support mmc: sdhci-of-esdhc: add support for signal voltage switch mmc: sdhci-of-esdhc: add peripheral clock support mmc: sdhci-pci: Allow for 3 bytes from Intel DSM mmc: cavium: Fix a shift wrapping bug ... commit f734a31083324b8f4f24b2c5cba178c7459db309 Author: Vineet Gupta Date: Tue May 2 16:23:57 2017 -0700 ARCv2: mm: micro-optimize region flush generated code DC_CTRL.RGN_OP is 3 bits wide, however only 1 bit is used in current programming model (0: flush, 1: invalidate) The current code targetting 3 bits leads to additional 8 byte AND operation which can be elided given that only 1 bit is ever set by software and/or looked at by hardware before ------ | 80b63324 <__dma_cache_wback_inv_l1>: | 80b63324: clri r3 | 80b63328: lr r2,[dc_ctrl] | 80b6332c: and r2,r2,0xfffff1ff <--- 8 bytes insn | 80b63334: or r2,r2,576 | 80b63338: sr r2,[dc_ctrl] | ... | ... | 80b63360 <__dma_cache_inv_l1>: | 80b63360: clri r3 | 80b63364: lr r2,[dc_ctrl] | 80b63368: and r2,r2,0xfffff1ff <--- 8 bytes insn | 80b63370: bset_s r2,r2,0x9 | 80b63372: sr r2,[dc_ctrl] | ... | ... | 80b6338c <__dma_cache_wback_l1>: | 80b6338c: clri r3 | 80b63390: lr r2,[dc_ctrl] | 80b63394: and r2,r2,0xfffff1ff <--- 8 bytes insn | 80b6339c: sr r2,[dc_ctrl] after (AND elided totally in 2 cases, replaced with 2 byte BCLR in 3rd) ----- | 80b63324 <__dma_cache_wback_inv_l1>: | 80b63324: clri r3 | 80b63328: lr r2,[dc_ctrl] | 80b6332c: or r2,r2,576 | 80b63330: sr r2,[dc_ctrl] | ... | ... | 80b63358 <__dma_cache_inv_l1>: | 80b63358: clri r3 | 80b6335c: lr r2,[dc_ctrl] | 80b63360: bset_s r2,r2,0x9 | 80b63362: sr r2,[dc_ctrl] | ... | ... | 80b6337c <__dma_cache_wback_l1>: | 80b6337c: clri r3 | 80b63380: lr r2,[dc_ctrl] | 80b63384: bclr_s r2,r2,0x9 | 80b63386: sr r2,[dc_ctrl] Signed-off-by: Vineet Gupta arch/arc/include/asm/cache.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8d65b08debc7e62b2c6032d7fe7389d895b92cbc Merge: 5a0387a 5d15af6 Author: Linus Torvalds Date: Tue May 2 16:40:27 2017 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next Pull networking updates from David Millar: "Here are some highlights from the 2065 networking commits that happened this development cycle: 1) XDP support for IXGBE (John Fastabend) and thunderx (Sunil Kowuri) 2) Add a generic XDP driver, so that anyone can test XDP even if they lack a networking device whose driver has explicit XDP support (me). 3) Sparc64 now has an eBPF JIT too (me) 4) Add a BPF program testing framework via BPF_PROG_TEST_RUN (Alexei Starovoitov) 5) Make netfitler network namespace teardown less expensive (Florian Westphal) 6) Add symmetric hashing support to nft_hash (Laura Garcia Liebana) 7) Implement NAPI and GRO in netvsc driver (Stephen Hemminger) 8) Support TC flower offload statistics in mlxsw (Arkadi Sharshevsky) 9) Multiqueue support in stmmac driver (Joao Pinto) 10) Remove TCP timewait recycling, it never really could possibly work well in the real world and timestamp randomization really zaps any hint of usability this feature had (Soheil Hassas Yeganeh) 11) Support level3 vs level4 ECMP route hashing in ipv4 (Nikolay Aleksandrov) 12) Add socket busy poll support to epoll (Sridhar Samudrala) 13) Netlink extended ACK support (Johannes Berg, Pablo Neira Ayuso, and several others) 14) IPSEC hw offload infrastructure (Steffen Klassert)" * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (2065 commits) tipc: refactor function tipc_sk_recv_stream() tipc: refactor function tipc_sk_recvmsg() net: thunderx: Optimize page recycling for XDP net: thunderx: Support for XDP header adjustment net: thunderx: Add support for XDP_TX net: thunderx: Add support for XDP_DROP net: thunderx: Add basic XDP support net: thunderx: Cleanup receive buffer allocation net: thunderx: Optimize CQE_TX handling net: thunderx: Optimize RBDR descriptor handling net: thunderx: Support for page recycling ipx: call ipxitf_put() in ioctl error path net: sched: add helpers to handle extended actions qed*: Fix issues in the ptp filter config implementation. qede: Fix concurrency issue in PTP Tx path processing. stmmac: Add support for SIMATIC IOT2000 platform net: hns: fix ethtool_get_strings overflow in hns driver tcp: fix wraparound issue in tcp_lp bpf, arm64: fix jit branch offset related to ldimm64 bpf, arm64: implement jiting of BPF_XADD ... commit ee40bd1e0c3fb83d810f258952692ffdebc14726 Author: Vineet Gupta Date: Tue May 2 15:28:12 2017 -0700 ARCv2: mm: Merge 2 updates to DC_CTRL for region flush Region Flush has a weird programming model. 1. Flush or Invalidate is selected by DC_CTRL.RGN_OP 2 Flush-n-Invalidate is done by DC_CTRL.IM Given the code structuring before, case #2 above was generating two seperate updates to DC_CTRL which was pointless. | 80a342b0 <__dma_cache_wback_inv_l1>: | 80a342b0: clri r4 | 80a342b4: lr r2,[dc_ctrl] | 80a342b8: bset_s r2,r2,0x6 | 80a342ba: sr r2,[dc_ctrl] <-- FIRST | | 80a342be: bmskn r3,r0,0x5 | | 80a342c2: lr r2,[dc_ctrl] | 80a342c6: and r2,r2,0xfffff1ff | 80a342ce: bset_s r2,r2,0x9 | 80a342d0: sr r2,[dc_ctrl] <-- SECOND | | 80a342d4: add_s r1,r1,0x3f | 80a342d6: bmsk_s r0,r0,0x5 | 80a342d8: add_s r0,r0,r1 | 80a342da: add_s r0,r0,r3 | 80a342dc: sr r0,[78] | 80a342e0: sr r3,[77] |... |... So move setting of DC_CTRL.RGN_OP into __before_dc_op() and combine with any other update. | 80b63324 <__dma_cache_wback_inv_l1>: | 80b63324: clri r3 | 80b63328: lr r2,[dc_ctrl] | 80b6332c: and r2,r2,0xfffff1ff | 80b63334: or r2,r2,576 | 80b63338: sr r2,[dc_ctrl] | | 80b6333c: add_s r1,r1,0x3f | 80b6333e: bmskn r2,r0,0x5 | 80b63342: add_s r0,r0,r1 | 80b63344: sr r0,[78] | 80b63348: sr r2,[77] Signed-off-by: Vineet Gupta arch/arc/mm/cache.c | 46 ++++++++++++++++++++++++++++++++-------------- 1 file changed, 32 insertions(+), 14 deletions(-) commit 0d77117fc5c0333d024a183d6790167bb90c3b62 Author: Vineet Gupta Date: Fri Aug 29 10:55:15 2014 +0530 ARCv2: mm: Implement cache region flush operations These are more efficient than the per-line ops Signed-off-by: Vineet Gupta arch/arc/include/asm/cache.h | 6 ++++ arch/arc/mm/cache.c | 68 ++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 74 insertions(+) commit b98e1995e4fa9030474a61ed0dbc033464fe5ea0 Author: Dan Carpenter Date: Tue Apr 25 12:19:49 2017 +0300 mtd: oxnas_nand: Allocating more than necessary in probe() We only need to allocate sizeof(struct oxnas_nand_ctrl) which is 192 bytes and not sizeof(struct nand_chip) which is a much larger 3056 bytes. Fixes: 668592492409 ("mtd: nand: Add OX820 NAND Support") Signed-off-by: Dan Carpenter Acked-by: Neil Armstrong Acked-by: Boris Brezillon Signed-off-by: Brian Norris drivers/mtd/nand/oxnas_nand.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5a0387a8a8efb90ae7fea1e2e5c62de3efa74691 Merge: 204f144 929562b Author: Linus Torvalds Date: Tue May 2 15:53:46 2017 -0700 Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto updates from Herbert Xu: "Here is the crypto update for 4.12: API: - Add batch registration for acomp/scomp - Change acomp testing to non-unique compressed result - Extend algorithm name limit to 128 bytes - Require setkey before accept(2) in algif_aead Algorithms: - Add support for deflate rfc1950 (zlib) Drivers: - Add accelerated crct10dif for powerpc - Add crc32 in stm32 - Add sha384/sha512 in ccp - Add 3des/gcm(aes) for v5 devices in ccp - Add Queue Interface (QI) backend support in caam - Add new Exynos RNG driver - Add ThunderX ZIP driver - Add driver for hardware random generator on MT7623 SoC" * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (101 commits) crypto: stm32 - Fix OF module alias information crypto: algif_aead - Require setkey before accept(2) crypto: scomp - add support for deflate rfc1950 (zlib) crypto: scomp - allow registration of multiple scomps crypto: ccp - Change ISR handler method for a v5 CCP crypto: ccp - Change ISR handler method for a v3 CCP crypto: crypto4xx - rename ce_ring_contol to ce_ring_control crypto: testmgr - Allow ecb(cipher_null) in FIPS mode Revert "crypto: arm64/sha - Add constant operand modifier to ASM_EXPORT" crypto: ccp - Disable interrupts early on unload crypto: ccp - Use only the relevant interrupt bits hwrng: mtk - Add driver for hardware random generator on MT7623 SoC dt-bindings: hwrng: Add Mediatek hardware random generator bindings crypto: crct10dif-vpmsum - Fix missing preempt_disable() crypto: testmgr - replace compression known answer test crypto: acomp - allow registration of multiple acomps hwrng: n2 - Use devm_kcalloc() in n2rng_probe() crypto: chcr - Fix error handling related to 'chcr_alloc_shash' padata: get_next is never NULL crypto: exynos - Add new Exynos RNG driver ... commit 7d3d162bbd515070dfa4f422778276aa28f114d4 Author: Vineet Gupta Date: Mon Jan 23 19:32:23 2017 -0800 ARC: mm: Move full_page computation into cache version agnostic wrapper This reduces code duplication in each of cache version specific handlers Signed-off-by: Vineet Gupta arch/arc/mm/cache.c | 25 ++++++++++++------------- 1 file changed, 12 insertions(+), 13 deletions(-) commit 4341ec6b3db4c3e903d6c44958722918baec1e59 Author: Taeung Song Date: Wed Apr 26 21:21:02 2017 +0900 perf config: Refactor a duplicated code for obtaining config file name We were doing the same sequence to figure out what is the config pathname to use, fix it by doing it before those two uses. Signed-off-by: Taeung Song Cc: Jiri Olsa Cc: Namhyung Kim Link: http://lkml.kernel.org/r/1493209268-5543-2-git-send-email-treeze.taeung@gmail.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-config.c | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) commit d80406453ad4a69932dc17a617d5b7bc7ae80b8f Author: Paul Clarke Date: Tue Apr 25 13:15:49 2017 -0500 perf symbols: Allow user probes on versioned symbols Symbol versioning, as in glibc, results in symbols being defined as: @[@] (Note that "@@" identifies a default symbol, if the symbol name is repeated.) perf is currently unable to deal with this, and is unable to create user probes at such symbols: -- $ nm /lib/powerpc64le-linux-gnu/libpthread.so.0 | grep pthread_create 0000000000008d30 t __pthread_create_2_1 0000000000008d30 T pthread_create@@GLIBC_2.17 $ /usr/bin/sudo perf probe -v -x /lib/powerpc64le-linux-gnu/libpthread.so.0 pthread_create probe-definition(0): pthread_create symbol:pthread_create file:(null) line:0 offset:0 return:0 lazy:(null) 0 arguments Open Debuginfo file: /usr/lib/debug/lib/powerpc64le-linux-gnu/libpthread-2.19.so Try to find probe point from debuginfo. Probe point 'pthread_create' not found. Error: Failed to add events. Reason: No such file or directory (Code: -2) -- One is not able to specify the fully versioned symbol, either, due to syntactic conflicts with other uses of "@" by perf: -- $ /usr/bin/sudo perf probe -v -x /lib/powerpc64le-linux-gnu/libpthread.so.0 pthread_create@@GLIBC_2.17 probe-definition(0): pthread_create@@GLIBC_2.17 Semantic error :SRC@SRC is not allowed. 0 arguments Error: Command Parse Error. Reason: Invalid argument (Code: -22) -- This patch ignores versioning for default symbols, thus allowing probes to be created for these symbols: -- $ /usr/bin/sudo ./perf probe -x /lib/powerpc64le-linux-gnu/libpthread.so.0 pthread_create Added new event: probe_libpthread:pthread_create (on pthread_create in /lib/powerpc64le-linux-gnu/libpthread-2.19.so) You can now use it in all perf tools, such as: perf record -e probe_libpthread:pthread_create -aR sleep 1 $ /usr/bin/sudo ./perf record -e probe_libpthread:pthread_create -aR ./test 2 [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.052 MB perf.data (2 samples) ] $ /usr/bin/sudo ./perf script test 2915 [000] 19124.260729: probe_libpthread:pthread_create: (3fff99248d38) test 2916 [000] 19124.260962: probe_libpthread:pthread_create: (3fff99248d38) $ /usr/bin/sudo ./perf probe --del=probe_libpthread:pthread_create Removed event: probe_libpthread:pthread_create -- Committer note: Change the variable storing the result of strlen() to 'int', to fix the build on debian:experimental-x-mipsel, fedora:24-x-ARC-uClibc, ubuntu:16.04-x-arm, etc: util/symbol.c: In function 'symbol__match_symbol_name': util/symbol.c:422:11: error: comparison between signed and unsigned integer expressions [-Werror=sign-compare] if (len < versioning - name) ^ Signed-off-by: Paul A. Clarke Tested-by: Arnaldo Carvalho de Melo Acked-by: Masami Hiramatsu Cc: David Ahern Link: http://lkml.kernel.org/r/c2b18d9c-17f8-9285-4868-f58b6359ccac@us.ibm.com Signed-off-by: Arnaldo Carvalho de Melo tools/perf/arch/powerpc/util/sym-handling.c | 12 ++++++ tools/perf/util/map.c | 5 --- tools/perf/util/map.h | 5 ++- tools/perf/util/symbol.c | 61 +++++++++++++++++++++++------ tools/perf/util/symbol.h | 11 ++++++ 5 files changed, 74 insertions(+), 20 deletions(-) commit b843f62ad942f3879c2d7acd27b44f931c609685 Author: Arnaldo Carvalho de Melo Date: Thu Apr 27 21:21:09 2017 -0300 perf symbols: Accept symbols starting at address 0 That is the case of _text on s390, and we have some functions that return an address, using address zero to report problems, oops. This would lead the symbol loading routines to not use "_text" as the reference relocation symbol, or the first symbol for the kernel, but use instead "_stext", that is at the same address on x86_64 and others, but not on s390: [acme@localhost perf-4.11.0-rc6]$ head -15 /proc/kallsyms 0000000000000000 T _text 0000000000000418 t iplstart 0000000000000800 T start 000000000000080a t .base 000000000000082e t .sk8x8 0000000000000834 t .gotr 0000000000000842 t .cmd 0000000000000846 t .parm 000000000000084a t .lowcase 0000000000010000 T startup 0000000000010010 T startup_kdump 0000000000010214 t startup_kdump_relocated 0000000000011000 T startup_continue 00000000000112a0 T _ehead 0000000000100000 T _stext [acme@localhost perf-4.11.0-rc6]$ Which in turn would make 'perf test vmlinux' to fail because it wouldn't find the symbols before "_stext" in kallsyms. Fix it by using the return value only for errors and storing the address, when the symbol is successfully found, in a provided pointer arg. Before this patch: After: [acme@localhost perf-4.11.0-rc6]$ tools/perf/perf test -v 1 1: vmlinux symtab matches kallsyms : --- start --- test child forked, pid 40693 Looking at the vmlinux_path (8 entries long) Using /usr/lib/debug/lib/modules/3.10.0-654.el7.s390x/vmlinux for symbols ERR : 0: _text not on kallsyms ERR : 0x418: iplstart not on kallsyms ERR : 0x800: start not on kallsyms ERR : 0x80a: .base not on kallsyms ERR : 0x82e: .sk8x8 not on kallsyms ERR : 0x834: .gotr not on kallsyms ERR : 0x842: .cmd not on kallsyms ERR : 0x846: .parm not on kallsyms ERR : 0x84a: .lowcase not on kallsyms ERR : 0x10000: startup not on kallsyms ERR : 0x10010: startup_kdump not on kallsyms ERR : 0x10214: startup_kdump_relocated not on kallsyms ERR : 0x11000: startup_continue not on kallsyms ERR : 0x112a0: _ehead not on kallsyms test child finished with -1 ---- end ---- vmlinux symtab matches kallsyms: FAILED! [acme@localhost perf-4.11.0-rc6]$ After: [acme@localhost perf-4.11.0-rc6]$ tools/perf/perf test -v 1 1: vmlinux symtab matches kallsyms : --- start --- test child forked, pid 47160 test child finished with 0 ---- end ---- vmlinux symtab matches kallsyms: Ok [acme@localhost perf-4.11.0-rc6]$ Reported-by: Michael Petlan Cc: Adrian Hunter Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: http://lkml.kernel.org/n/tip-9x9bwgd3btwdk1u51xie93fz@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-buildid-cache.c | 13 ++++++++----- tools/perf/util/event.c | 9 +++++---- tools/perf/util/event.h | 4 ++-- tools/perf/util/machine.c | 28 +++++++++++++++++----------- tools/perf/util/symbol.c | 11 +++++------ 5 files changed, 37 insertions(+), 28 deletions(-) commit 5a08b04f637921e44ba767c07c74b0535504ab71 Author: Michael S. Tsirkin Date: Tue Feb 7 06:15:13 2017 +0200 virtio: allow extra context per descriptor Allow extra context per descriptor. To avoid slow down for data path, this disables use of indirect descriptors for this vq. Signed-off-by: Michael S. Tsirkin drivers/virtio/virtio_ring.c | 70 ++++++++++++++++++++++++++++++++++++-------- include/linux/virtio.h | 9 ++++++ 2 files changed, 66 insertions(+), 13 deletions(-) commit 0a12ae4024a5167c30444d722b0cbafbdb5f4b57 Author: Sekhar Nori Date: Mon Apr 17 16:42:15 2017 +0530 tools/virtio: fix build breakage Previous commit ("virtio: add context flag to find vqs") added a new 'context' flag to vring_new_virtqueue(), but the corresponding API in tools/virtio/ is not updated causing build errors due to conflicting declarations. Bring code in tools/virtio in sync with that in kernel. I have used 'false' for the value of the new boolean 'context' flag as that seems to be the best way to preserve existing behavior. Tested with: $ make -C tools/virtio clean all ARCH=x86 Signed-off-by: Sekhar Nori Signed-off-by: Michael S. Tsirkin tools/virtio/linux/virtio.h | 1 + tools/virtio/virtio_test.c | 2 +- tools/virtio/vringh_test.c | 7 ++++--- 3 files changed, 6 insertions(+), 4 deletions(-) commit f94682dde5ed23eed13533a37dfce942e60ade4e Author: Michael S. Tsirkin Date: Mon Mar 6 18:32:29 2017 +0200 virtio: add context flag to find vqs Allows maintaining extra context per vq. For ease of use, passing in NULL is legal and disables the feature for all vqs. Includes fixes by Christian for s390, acked by Cornelia. Signed-off-by: Christian Borntraeger Acked-by: Cornelia Huck Signed-off-by: Michael S. Tsirkin drivers/misc/mic/vop/vop_main.c | 9 ++++++--- drivers/remoteproc/remoteproc_virtio.c | 10 ++++++---- drivers/s390/virtio/kvm_virtio.c | 8 +++++--- drivers/s390/virtio/virtio_ccw.c | 7 ++++--- drivers/virtio/virtio_mmio.c | 8 +++++--- drivers/virtio/virtio_pci_common.c | 17 +++++++++++------ drivers/virtio/virtio_pci_common.h | 4 +++- drivers/virtio/virtio_pci_legacy.c | 4 +++- drivers/virtio/virtio_pci_modern.c | 12 ++++++++---- drivers/virtio/virtio_ring.c | 7 +++++-- include/linux/virtio_config.h | 18 +++++++++++++++--- include/linux/virtio_ring.h | 3 +++ 12 files changed, 74 insertions(+), 33 deletions(-) commit 9b2bbdb227588455afcc3b03475fa9b0a35d83af Author: Michael S. Tsirkin Date: Mon Mar 6 18:19:39 2017 +0200 virtio: wrap find_vqs We are going to add more parameters to find_vqs, let's wrap the call so we don't need to tweak all drivers every time. Signed-off-by: Michael S. Tsirkin drivers/block/virtio_blk.c | 3 +-- drivers/char/virtio_console.c | 6 +++--- drivers/crypto/virtio/virtio_crypto_core.c | 3 +-- drivers/gpu/drm/virtio/virtgpu_kms.c | 3 +-- drivers/net/caif/caif_virtio.c | 3 +-- drivers/net/virtio_net.c | 3 +-- drivers/rpmsg/virtio_rpmsg_bus.c | 2 +- drivers/scsi/virtio_scsi.c | 3 +-- drivers/virtio/virtio_balloon.c | 3 +-- drivers/virtio/virtio_input.c | 3 +-- include/linux/virtio_config.h | 9 +++++++++ net/vmw_vsock/virtio_transport.c | 6 +++--- 12 files changed, 24 insertions(+), 23 deletions(-) commit 4f6d9bfc882450631251052756ed84658ec88a70 Author: Dan Carpenter Date: Sat Apr 15 22:22:14 2017 +0300 ringtest: fix an assert statement There is an || vs && typo so the assert can never be triggered. Signed-off-by: Dan Carpenter Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang tools/virtio/ringtest/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3a158a62da0673db918b53ac1440845a5b64fd90 Author: James Hogan Date: Tue May 2 19:41:06 2017 +0100 metag/uaccess: Check access_ok in strncpy_from_user The metag implementation of strncpy_from_user() doesn't validate the src pointer, which could allow reading of arbitrary kernel memory. Add a short access_ok() check to prevent that. Its still possible for it to read across the user/kernel boundary, but it will invariably reach a NUL character after only 9 bytes, leaking only a static kernel address being loaded into D0Re0 at the beginning of __start, which is acceptable for the immediate fix. Reported-by: Al Viro Signed-off-by: James Hogan Cc: linux-metag@vger.kernel.org Cc: stable@vger.kernel.org arch/metag/include/asm/uaccess.h | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) commit 26c9cb668c7fbf9830516b75d8bee70b699ed449 Author: Steve French Date: Tue May 2 13:35:20 2017 -0500 Set unicode flag on cifs echo request to avoid Mac error Mac requires the unicode flag to be set for cifs, even for the smb echo request (which doesn't have strings). Without this Mac rejects the periodic echo requests (when mounting with cifs) that we use to check if server is down Signed-off-by: Steve French CC: Stable fs/cifs/cifssmb.c | 3 +++ 1 file changed, 3 insertions(+) commit c610c4b619e53494d9c512fa0333e28c732e976f Author: Pavel Shilovsky Date: Tue Apr 25 11:52:31 2017 -0700 CIFS: Add asynchronous write support through kernel AIO This patch adds support to process write calls passed by io_submit() asynchronously. It based on the previously introduced async context that allows to process i/o responses in a separate thread and return the caller immediately for asynchronous calls. This improves writing performance of single threaded applications with increasing of i/o queue depth size. Signed-off-by: Pavel Shilovsky Signed-off-by: Steve French fs/cifs/cifsglob.h | 2 + fs/cifs/file.c | 188 ++++++++++++++++++++++++++++++++++++++--------------- 2 files changed, 139 insertions(+), 51 deletions(-) commit 6685c5e2d1acae8e7d3b63b1a205f58420ce7150 Author: Pavel Shilovsky Date: Tue Apr 25 11:52:30 2017 -0700 CIFS: Add asynchronous read support through kernel AIO This patch adds support to process read calls passed by io_submit() asynchronously. It based on the previously introduced async context that allows to process i/o responses in a separate thread and return the caller immediately for asynchronous calls. This improves reading performance of single threaded applications with increasing of i/o queue depth size. Signed-off-by: Pavel Shilovsky Signed-off-by: Steve French fs/cifs/cifsglob.h | 1 + fs/cifs/file.c | 169 ++++++++++++++++++++++++++++++++++++++++------------- 2 files changed, 131 insertions(+), 39 deletions(-) commit ccf7f4088af2dd6733bfcbc40b488e2484345ae5 Author: Pavel Shilovsky Date: Tue Apr 25 11:52:29 2017 -0700 CIFS: Add asynchronous context to support kernel AIO Currently the code doesn't recognize asynchronous calls passed by io_submit() and processes all calls synchronously. This is not what kernel AIO expects. This patch introduces a new async context that keeps track of all issued i/o requests and moves a response collecting procedure to a separate thread. This allows to return to a caller immediately for async calls and call iocb->ki_complete() once all requests are completed. For sync calls the current thread simply waits until all requests are completed. Signed-off-by: Pavel Shilovsky Signed-off-by: Steve French fs/cifs/cifsglob.h | 16 +++++++ fs/cifs/cifsproto.h | 3 ++ fs/cifs/misc.c | 120 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 139 insertions(+) commit 29bb3158cf6a5ad7b3521d1229552f375107a58c Author: Daniel N Pettersson Date: Thu Apr 27 11:32:36 2017 +0200 cifs: fix IPv6 link local, with scope id, address parsing When the IP address is gotten from the UNC, use only the address part of the UNC. Else all after the percent sign in an IPv6 link local address is interpreted as a scope id. This includes the slash and share name. A scope id is expected to be an integer and any trailing characters makes the conversion to integer fail. Example of mount command that fails: mount -i -t cifs //fe80::6a05:caff:fe3e:8ffc%2/test /mnt/t -o sec=none Signed-off-by: Daniel N Pettersson Signed-off-by: Steve French fs/cifs/connect.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) commit 564277eceeca01e02b1ef3e141cfb939184601b4 Author: Dan Carpenter Date: Mon May 1 21:43:43 2017 +0300 cifs: small underflow in cnvrtDosUnixTm() January is month 1. There is no zero-th month. If someone passes a zero month then it means we read from one space before the start of the total_days_of_prev_months[] array. We may as well also be strict about days as well. Fixes: 1bd5bbcb6531 ("[CIFS] Legacy time handling for Win9x and OS/2 part 1") Signed-off-by: Dan Carpenter Signed-off-by: Steve French fs/cifs/netmisc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 5d15af6778b8e4ed1fd41b040283af278e7a9a72 Merge: b0e9227 ec8a09f Author: David S. Miller Date: Tue May 2 15:56:54 2017 -0400 Merge branch 'tipc-refactor-socket-receive-functions' Jon Maloy says: ==================== tipc: refactor socket receive functions We try to make the functions tipc_sk_recvmsg() and tipc_sk_recvstream() more readable. ==================== Signed-off-by: David S. Miller commit ec8a09fbbeff252c80daf62c7a78342003dddf9c Author: Jon Paul Maloy Date: Tue May 2 18:16:54 2017 +0200 tipc: refactor function tipc_sk_recv_stream() We try to make this function more readable by improving variable names and comments, using more stack variables, and doing some smaller changes to the logics. We also rename the function to make it consistent with naming conventions used elsewhere in the code. Reviewed-by: Parthasarathy Bhuvaragan Signed-off-by: Jon Maloy Signed-off-by: David S. Miller net/tipc/socket.c | 155 +++++++++++++++++++++++++----------------------------- 1 file changed, 71 insertions(+), 84 deletions(-) commit e9f8b10101c6da3ab000a2fb17162374c9bd2c69 Author: Jon Paul Maloy Date: Tue May 2 18:16:53 2017 +0200 tipc: refactor function tipc_sk_recvmsg() We try to make this function more readable by improving variable names and comments, plus some minor changes to the logics. Reviewed-by: Parthasarathy Bhuvaragan Signed-off-by: Jon Maloy Signed-off-by: David S. Miller net/tipc/socket.c | 109 +++++++++++++++++++++++++----------------------------- 1 file changed, 50 insertions(+), 59 deletions(-) commit b0e92279d3ec3656152c4dfa1c8b28fa40ca66d7 Merge: ee0d8d8 7732253 Author: David S. Miller Date: Tue May 2 15:41:23 2017 -0400 Merge branch 'thunderx-xdp' Sunil Goutham says: ==================== net: thunderx: Adds XDP support This patch series adds support for XDP to ThunderX NIC driver which is used on CN88xx, CN81xx and CN83xx platforms. Patches 1-4 are performance improvement and cleanup patches which are done keeping XDP performance bottlenecks in view. Rest of the patches adds actual XDP support. ==================== Signed-off-by: David S. Miller commit 773225388dae15e72790d6f573e2e70e96292b6b Author: Sunil Goutham Date: Tue May 2 18:36:58 2017 +0530 net: thunderx: Optimize page recycling for XDP Driver follows a method of taking one extra reference on the page for recycling which is fine in usual packet path where each 64KB page is segmented into multiple receive buffers. But in XDP mode since there is just one receive buffer per page taking extra page reference itself becomes big bottleneck consuming ~50% of CPU cycles due to atomic operations. This patch adds a internal ref count in pgcache for each page and additional page references are taken in a batch instead of just one at a time. Internal i.e 'pgcache->ref_count' and page's i.e 'page->_refcount' counters are compared to check page's recyclability. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller drivers/net/ethernet/cavium/thunder/nicvf_queues.c | 57 +++++++++++++++++++--- drivers/net/ethernet/cavium/thunder/nicvf_queues.h | 1 + 2 files changed, 51 insertions(+), 7 deletions(-) commit e3d06ff9ec9400b93bacf8fa92f3985c9412e282 Author: Sunil Goutham Date: Tue May 2 18:36:57 2017 +0530 net: thunderx: Support for XDP header adjustment When in XDP mode reserve XDP_PACKET_HEADROOM bytes at the start of receive buffer for XDP program to modify headers and adjust packet start. Additional code changes done to handle such packets. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller drivers/net/ethernet/cavium/thunder/nicvf_main.c | 63 ++++++++++++++++------ drivers/net/ethernet/cavium/thunder/nicvf_queues.c | 9 +++- 2 files changed, 55 insertions(+), 17 deletions(-) commit 16f2bccda75da48888772c4829a468be620c5d79 Author: Sunil Goutham Date: Tue May 2 18:36:56 2017 +0530 net: thunderx: Add support for XDP_TX Adds support for XDP_TX i.e transmits packet out of the XDP TX queue mapped to the corresponding Rx queue on which packet is received. Since SQ for XDP TX will be used only on a single cpu i.e SQ description creation and freeing, using atomic free count is not necessary and will become a bottleneck. Hence added a separate 'xdp_free_cnt' used for SQs designated for XDP to track descriptor free count. Changes also include - A new entry 'xdp_page' is added to save transmitted packet's page pointer for later cleanup. - XDP Tx SQ's doorbell is ringed once per NAPI instance. - Retrieving designated SQ for packets being sent out by stack via 'nicvf_xmit'. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller drivers/net/ethernet/cavium/thunder/nicvf_main.c | 63 ++++++++--- drivers/net/ethernet/cavium/thunder/nicvf_queues.c | 117 ++++++++++++++++++--- drivers/net/ethernet/cavium/thunder/nicvf_queues.h | 7 ++ 3 files changed, 160 insertions(+), 27 deletions(-) commit c56d91ce38d54c0c0dd8d0e4c6a9e0cfa557152f Author: Sunil Goutham Date: Tue May 2 18:36:55 2017 +0530 net: thunderx: Add support for XDP_DROP Adds support for XDP_DROP. Also since in XDP mode there is just a single buffer per page, made changes to recycle DMA mapping info as well along with pages. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller drivers/net/ethernet/cavium/thunder/nicvf_main.c | 23 ++++++- drivers/net/ethernet/cavium/thunder/nicvf_queues.c | 77 ++++++++++++++++------ drivers/net/ethernet/cavium/thunder/nicvf_queues.h | 4 +- 3 files changed, 79 insertions(+), 25 deletions(-) commit 05c773f52b96ef3fbc7d9bfa21caadc6247ef7a8 Author: Sunil Goutham Date: Tue May 2 18:36:54 2017 +0530 net: thunderx: Add basic XDP support Adds basic XDP support i.e attaching a BPF program to an interface. Also takes care of allocating separate Tx queues for XDP path and for network stack packet transmission. This patch doesn't support handling of any of the XDP actions, all are treated as XDP_PASS i.e packets will be handed over to the network stack. Changes also involve allocating one receive buffer per page in XDP mode and multiple in normal mode i.e when no BPF program is attached. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller drivers/net/ethernet/cavium/thunder/nic.h | 6 +- .../net/ethernet/cavium/thunder/nicvf_ethtool.c | 26 +++- drivers/net/ethernet/cavium/thunder/nicvf_main.c | 162 ++++++++++++++++++++- drivers/net/ethernet/cavium/thunder/nicvf_queues.c | 15 +- drivers/net/ethernet/cavium/thunder/nicvf_queues.h | 9 ++ 5 files changed, 199 insertions(+), 19 deletions(-) commit 927987f39f116db477fcd74ced2a2aea940e585c Author: Sunil Goutham Date: Tue May 2 18:36:53 2017 +0530 net: thunderx: Cleanup receive buffer allocation Get rid of unnecessary double pointer references and type casting in receive buffer allocation code. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller drivers/net/ethernet/cavium/thunder/nicvf_queues.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) commit 0dada88b8cd74569abc3dda50f1b268a5868f6f2 Author: Sunil Goutham Date: Tue May 2 18:36:52 2017 +0530 net: thunderx: Optimize CQE_TX handling Optimized CQE handling with below changes - Feeing descriptors back to SQ in bulk i.e once per NAPI instance instead for every CQE_TX, this will reduce number of atomic updates to 'sq->free_cnt'. - Checking errors in CQE_TX and CQE_RX before calling appropriate fn()s to update error stats i.e reduce branching. Also removed debug messages in packet handling path which otherwise causes issues if DEBUG is enabled. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller drivers/net/ethernet/cavium/thunder/nicvf_main.c | 44 +++++++++++----------- drivers/net/ethernet/cavium/thunder/nicvf_queues.c | 5 --- 2 files changed, 21 insertions(+), 28 deletions(-) commit 5e848e4c5d77438e126c97702ec3bea477f550a9 Author: Sunil Goutham Date: Tue May 2 18:36:51 2017 +0530 net: thunderx: Optimize RBDR descriptor handling Receive buffer's physical address or iova will anyway not go beyond 49bits, since it is the max supported HW address. As per perf, updating bitfields i.e buf_addr:42 in RBDR descriptor entry consumes lots of cpu cycles, hence changed it to a 64bit field with alignment requirements taken care of. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller drivers/net/ethernet/cavium/thunder/nicvf_queues.c | 8 ++++---- drivers/net/ethernet/cavium/thunder/q_struct.h | 10 +--------- 2 files changed, 5 insertions(+), 13 deletions(-) commit 5836b4429777bf57ca8fc02b154263aa54d97508 Author: Sunil Goutham Date: Tue May 2 18:36:50 2017 +0530 net: thunderx: Support for page recycling Adds support for page recycling for allocating receive buffers to reduce cost of refilling RBDR ring. Also got rid of using compound pages when pagesize is 4K, only order-0 pages now. Only page is recycled, DMA mappings still needs to be done for every receive buffer allocated due to following constraints - Cannot have just one receive buffer per 64KB page. - There is just one buffer ring shared across 8 Rx queues, so buffers of same page can go to any Rx queue. - HW gives buffer address where packet has been DMA'ed and not the index into buffer ring. This makes it not possible to resue DMA mapping info. So unfortunately have to go through costly mapping route for every buffer. Signed-off-by: Sunil Goutham Signed-off-by: David S. Miller drivers/net/ethernet/cavium/thunder/nic.h | 4 +- .../net/ethernet/cavium/thunder/nicvf_ethtool.c | 3 +- drivers/net/ethernet/cavium/thunder/nicvf_queues.c | 121 ++++++++++++++++++--- drivers/net/ethernet/cavium/thunder/nicvf_queues.h | 11 ++ 4 files changed, 119 insertions(+), 20 deletions(-) commit ee0d8d8482345ff97a75a7d747efc309f13b0d80 Author: Dan Carpenter Date: Tue May 2 13:58:53 2017 +0300 ipx: call ipxitf_put() in ioctl error path We should call ipxitf_put() if the copy_to_user() fails. Reported-by: 李强 Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller net/ipx/af_ipx.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 9da3242e6a83b6f315aa9c394c939da8e4ad7774 Author: Jiri Pirko Date: Tue May 2 10:12:00 2017 +0200 net: sched: add helpers to handle extended actions Jump is now the only one using value action opcode. This is going to change soon. So introduce helpers to work with this. Convert TC_ACT_JUMP. This also fixes the TC_ACT_JUMP check, which is incorrectly done as a bit check, not a value check. Fixes: e0ee84ded796 ("net sched actions: Complete the JUMPX opcode") Signed-off-by: Jiri Pirko Acked-by: Jamal Hadi Salim Signed-off-by: David S. Miller include/uapi/linux/pkt_cls.h | 15 ++++++++++++++- net/sched/act_api.c | 2 +- 2 files changed, 15 insertions(+), 2 deletions(-) commit 5657f89abb2d8966ac7678b84e3c020b93f340f4 Merge: 212c7fd 8d3f87d Author: David S. Miller Date: Tue May 2 15:33:02 2017 -0400 Merge branch 'qed-PTP-fixes' Sudarsana Reddy Kalluru says: ==================== qed*: PTP bug fixes. The series addresses couple of issues in the PTP implementation. ==================== Signed-off-by: David S. Miller commit 8d3f87d8cd0a16c58ae7e4410938528866c1c0db Author: sudarsana.kalluru@cavium.com Date: Tue May 2 01:11:03 2017 -0700 qed*: Fix issues in the ptp filter config implementation. PTP hardware filter configuration performed by the driver for a given user requested config is not correct for some of the PTP modes. Following changes are needed for PTP config-filter implementation. 1. NIG_REG_TX_PTP_EN register - Bits 0/1/2 respectively enables TimeSync/"V1 frame format support"/"V2 frame format support" on the TX side. Set the associated bits based on the user request. 2. ptp4l application fails to operate in Peer Delay mode. Following changes are needed to fix this, a. Driver should enable (set to 0) DA #1-related bits for IPv4, IPv6 and MAC destination addresses in these registers: NIG_REG_TX_LLH_PTP_RULE_MASK NIG_REG_LLH_PTP_RULE_MASK b. NIG_REG_LLH_PTP_PARAM_MASK/NIG_REG_TX_LLH_PTP_PARAM_MASK should be set to 0x0 in all modes. Signed-off-by: Sudarsana Reddy Kalluru Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_ptp.c | 84 ++++++++++++++++++----------- drivers/net/ethernet/qlogic/qede/qede_ptp.c | 34 +++++++++--- include/linux/qed/qed_eth_if.h | 23 +++++--- 3 files changed, 98 insertions(+), 43 deletions(-) commit 461eec12012c29b66525c270208d30be8f6da8e7 Author: sudarsana.kalluru@cavium.com Date: Tue May 2 01:11:02 2017 -0700 qede: Fix concurrency issue in PTP Tx path processing. PTP Tx timestamping data structures are not protected against the concurrent access in the Tx paths. Protecting the same using atomic bit locks. Signed-off-by: Sudarsana Reddy Kalluru Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qede/qede.h | 5 +++-- drivers/net/ethernet/qlogic/qede/qede_ptp.c | 4 ++++ 2 files changed, 7 insertions(+), 2 deletions(-) commit 212c7fd614377fef4415d94856a59e9f484aa439 Author: Jan Kiszka Date: Tue May 2 09:58:00 2017 +0200 stmmac: Add support for SIMATIC IOT2000 platform The IOT2000 is industrial controller platform, derived from the Intel Galileo Gen2 board. The variant IOT2020 comes with one LAN port, the IOT2040 has two of them. They can be told apart based on the board asset tag in the DMI table. Based on patch by Sascha Weisenberger. Signed-off-by: Jan Kiszka Signed-off-by: Sascha Weisenberger Reviewed-by: Andy Shevchenko Signed-off-by: David S. Miller drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c | 26 +++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) commit 412b65d15a7f8a93794653968308fc100f2aa87c Author: Timmy Li Date: Tue May 2 10:46:52 2017 +0800 net: hns: fix ethtool_get_strings overflow in hns driver hns_get_sset_count() returns HNS_NET_STATS_CNT and the data space allocated is not enough for ethtool_get_strings(), which will cause random memory corruption. When SLAB and DEBUG_SLAB are both enabled, memory corruptions like the the following can be observed without this patch: [ 43.115200] Slab corruption (Not tainted): Acpi-ParseExt start=ffff801fb0b69030, len=80 [ 43.115206] Redzone: 0x9f911029d006462/0x5f78745f31657070. [ 43.115208] Last user: [<5f7272655f746b70>](0x5f7272655f746b70) [ 43.115214] 010: 70 70 65 31 5f 74 78 5f 70 6b 74 00 6b 6b 6b 6b ppe1_tx_pkt.kkkk [ 43.115217] 030: 70 70 65 31 5f 74 78 5f 70 6b 74 5f 6f 6b 00 6b ppe1_tx_pkt_ok.k [ 43.115218] Next obj: start=ffff801fb0b69098, len=80 [ 43.115220] Redzone: 0x706d655f6f666966/0x9f911029d74e35b. [ 43.115229] Last user: [](acpi_os_release_object+0x28/0x38) [ 43.115231] 000: 74 79 00 6b 6b 6b 6b 6b 70 70 65 31 5f 74 78 5f ty.kkkkkppe1_tx_ [ 43.115232] 010: 70 6b 74 5f 65 72 72 5f 63 73 75 6d 5f 66 61 69 pkt_err_csum_fai Signed-off-by: Timmy Li Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c | 2 +- drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c | 2 +- drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c | 2 +- drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) commit a9f11f963a546fea9144f6a6d1a307e814a387e7 Author: Eric Dumazet Date: Mon May 1 15:29:48 2017 -0700 tcp: fix wraparound issue in tcp_lp Be careful when comparing tcp_time_stamp to some u32 quantity, otherwise result can be surprising. Fixes: 7c106d7e782b ("[TCP]: TCP Low Priority congestion control") Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller net/ipv4/tcp_lp.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit ddc665a4bb4b728b4e6ecec8db1b64efa9184b9c Author: Daniel Borkmann Date: Tue May 2 20:34:54 2017 +0200 bpf, arm64: fix jit branch offset related to ldimm64 When the instruction right before the branch destination is a 64 bit load immediate, we currently calculate the wrong jump offset in the ctx->offset[] array as we only account one instruction slot for the 64 bit load immediate although it uses two BPF instructions. Fix it up by setting the offset into the right slot after we incremented the index. Before (ldimm64 test 1): [...] 00000020: 52800007 mov w7, #0x0 // #0 00000024: d2800060 mov x0, #0x3 // #3 00000028: d2800041 mov x1, #0x2 // #2 0000002c: eb01001f cmp x0, x1 00000030: 54ffff82 b.cs 0x00000020 00000034: d29fffe7 mov x7, #0xffff // #65535 00000038: f2bfffe7 movk x7, #0xffff, lsl #16 0000003c: f2dfffe7 movk x7, #0xffff, lsl #32 00000040: f2ffffe7 movk x7, #0xffff, lsl #48 00000044: d29dddc7 mov x7, #0xeeee // #61166 00000048: f2bdddc7 movk x7, #0xeeee, lsl #16 0000004c: f2ddddc7 movk x7, #0xeeee, lsl #32 00000050: f2fdddc7 movk x7, #0xeeee, lsl #48 [...] After (ldimm64 test 1): [...] 00000020: 52800007 mov w7, #0x0 // #0 00000024: d2800060 mov x0, #0x3 // #3 00000028: d2800041 mov x1, #0x2 // #2 0000002c: eb01001f cmp x0, x1 00000030: 540000a2 b.cs 0x00000044 00000034: d29fffe7 mov x7, #0xffff // #65535 00000038: f2bfffe7 movk x7, #0xffff, lsl #16 0000003c: f2dfffe7 movk x7, #0xffff, lsl #32 00000040: f2ffffe7 movk x7, #0xffff, lsl #48 00000044: d29dddc7 mov x7, #0xeeee // #61166 00000048: f2bdddc7 movk x7, #0xeeee, lsl #16 0000004c: f2ddddc7 movk x7, #0xeeee, lsl #32 00000050: f2fdddc7 movk x7, #0xeeee, lsl #48 [...] Also, add a couple of test cases to make sure JITs pass this test. Tested on Cavium ThunderX ARMv8. The added test cases all pass after the fix. Fixes: 8eee539ddea0 ("arm64: bpf: fix out-of-bounds read in bpf2a64_offset()") Reported-by: David S. Miller Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Cc: Xi Wang Signed-off-by: David S. Miller arch/arm64/net/bpf_jit_comp.c | 8 ++++---- lib/test_bpf.c | 45 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 49 insertions(+), 4 deletions(-) commit 85f68fe89832057584a9e66e1e7e53d53e50faff Author: Daniel Borkmann Date: Mon May 1 02:57:20 2017 +0200 bpf, arm64: implement jiting of BPF_XADD This work adds BPF_XADD for BPF_W/BPF_DW to the arm64 JIT and therefore completes JITing of all BPF instructions, meaning we can thus also remove the 'notyet' label and do not need to fall back to the interpreter when BPF_XADD is used in a program! This now also brings arm64 JIT in line with x86_64, s390x, ppc64, sparc64, where all current eBPF features are supported. BPF_W example from test_bpf: .u.insns_int = { BPF_ALU32_IMM(BPF_MOV, R0, 0x12), BPF_ST_MEM(BPF_W, R10, -40, 0x10), BPF_STX_XADD(BPF_W, R10, R0, -40), BPF_LDX_MEM(BPF_W, R0, R10, -40), BPF_EXIT_INSN(), }, [...] 00000020: 52800247 mov w7, #0x12 // #18 00000024: 928004eb mov x11, #0xffffffffffffffd8 // #-40 00000028: d280020a mov x10, #0x10 // #16 0000002c: b82b6b2a str w10, [x25,x11] // start of xadd mapping: 00000030: 928004ea mov x10, #0xffffffffffffffd8 // #-40 00000034: 8b19014a add x10, x10, x25 00000038: f9800151 prfm pstl1strm, [x10] 0000003c: 885f7d4b ldxr w11, [x10] 00000040: 0b07016b add w11, w11, w7 00000044: 880b7d4b stxr w11, w11, [x10] 00000048: 35ffffab cbnz w11, 0x0000003c // end of xadd mapping: [...] BPF_DW example from test_bpf: .u.insns_int = { BPF_ALU32_IMM(BPF_MOV, R0, 0x12), BPF_ST_MEM(BPF_DW, R10, -40, 0x10), BPF_STX_XADD(BPF_DW, R10, R0, -40), BPF_LDX_MEM(BPF_DW, R0, R10, -40), BPF_EXIT_INSN(), }, [...] 00000020: 52800247 mov w7, #0x12 // #18 00000024: 928004eb mov x11, #0xffffffffffffffd8 // #-40 00000028: d280020a mov x10, #0x10 // #16 0000002c: f82b6b2a str x10, [x25,x11] // start of xadd mapping: 00000030: 928004ea mov x10, #0xffffffffffffffd8 // #-40 00000034: 8b19014a add x10, x10, x25 00000038: f9800151 prfm pstl1strm, [x10] 0000003c: c85f7d4b ldxr x11, [x10] 00000040: 8b07016b add x11, x11, x7 00000044: c80b7d4b stxr w11, x11, [x10] 00000048: 35ffffab cbnz w11, 0x0000003c // end of xadd mapping: [...] Tested on Cavium ThunderX ARMv8, test suite results after the patch: No JIT: [ 3751.855362] test_bpf: Summary: 311 PASSED, 0 FAILED, [0/303 JIT'ed] With JIT: [ 3573.759527] test_bpf: Summary: 311 PASSED, 0 FAILED, [303/303 JIT'ed] Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: David S. Miller arch/arm64/include/asm/insn.h | 30 ++++++++++++ arch/arm64/kernel/insn.c | 106 ++++++++++++++++++++++++++++++++++++++++++ arch/arm64/net/bpf_jit.h | 19 ++++++++ arch/arm64/net/bpf_jit_comp.c | 16 +++++-- lib/test_bpf.c | 105 +++++++++++++++++++++++++++++++++++++++++ 5 files changed, 271 insertions(+), 5 deletions(-) commit 204f144c9fcac355843412b6ba1150086488a208 Merge: da7b66f 801b25f Author: Linus Torvalds Date: Tue May 2 11:54:26 2017 -0700 Merge branch 'work.compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull fs/compat.c cleanups from Al Viro: "More moving of compat syscalls from fs/compat.c to fs/*.c where the native counterparts live. And death to compat_sys_getdents64() - the only architecture that used to need it was ia64, and _that_ has lost biarch support quite a few years ago" * 'work.compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: fs/compat.c: trim unused includes move compat_rw_copy_check_uvector() over to fs/read_write.c fhandle: move compat syscalls from compat.c open: move compat syscalls from compat.c stat: move compat syscalls from compat.c fcntl: move compat syscalls from compat.c readdir: move compat syscalls from compat.c statfs: move compat syscalls from compat.c utimes: move compat syscalls from compat.c move compat select-related syscalls to fs/select.c Remove compat_sys_getdents64() commit da7b66ffb2815800440d9e1649282a27c805304f Merge: 5b13475 13c0f52 Author: Linus Torvalds Date: Tue May 2 11:38:06 2017 -0700 Merge branch 'work.splice' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull splice updates from Al Viro: "These actually missed the last cycle; the branch itself is from last December" * 'work.splice' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: make nr_pages calculation in default_file_splice_read() a bit less ugly splice/tee/vmsplice: validate flags splice_pipe_desc: kill ->flags remove spd_release_page() commit 5b13475a5e12c49c24422ba1bd9998521dec1d4e Merge: 6fd4e7f a6a5993 Author: Linus Torvalds Date: Tue May 2 11:18:50 2017 -0700 Merge branch 'work.iov_iter' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull iov_iter updates from Al Viro: "Cleanups that sat in -next + -stable fodder that has just missed 4.11. There's more iov_iter work in my local tree, but I'd prefer to push the stuff that had been in -next first" * 'work.iov_iter' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: iov_iter: don't revert iov buffer if csum error generic_file_read_iter(): make use of iov_iter_revert() generic_file_direct_write(): make use of iov_iter_revert() orangefs: use iov_iter_revert() sctp: switch to copy_from_iter_full() net/9p: switch to copy_from_iter_full() switch memcpy_from_msg() to copy_from_iter_full() rds: make use of iov_iter_revert() commit 6fd4e7f7744bd7859ca3cae19c4613252ebb6bff Merge: 5958cc4 a6f74e8 Author: Linus Torvalds Date: Tue May 2 11:16:29 2017 -0700 Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6 Pull CIFS fixes from Steve French: "Three cifs/smb3 fixes - including two for stable" * 'for-next' of git://git.samba.org/sfrench/cifs-2.6: cifs: don't check for failure from mempool_alloc() Do not return number of bytes written for ioctl CIFS_IOC_COPYCHUNK_FILE Fix match_prepath() commit 8a8b56638bcac4e64cccc88bf95a0f9f4b19a2fb Author: James Hogan Date: Fri Apr 28 10:50:26 2017 +0100 metag/uaccess: Fix access_ok() The __user_bad() macro used by access_ok() has a few corner cases noticed by Al Viro where it doesn't behave correctly: - The kernel range check has off by 1 errors which permit access to the first and last byte of the kernel mapped range. - The kernel range check ends at LINCORE_BASE rather than META_MEMORY_LIMIT, which is ineffective when the kernel is in global space (an extremely uncommon configuration). There are a couple of other shortcomings here too: - Access to the whole of the other address space is permitted (i.e. the global half of the address space when the kernel is in local space). This isn't ideal as it could theoretically still contain privileged mappings set up by the bootloader. - The size argument is unused, permitting user copies which start on valid pages at the end of the user address range and cross the boundary into the kernel address space (e.g. addr = 0x3ffffff0, size > 0x10). It isn't very convenient to add size checks when disallowing certain regions, and it seems far safer to be sure and explicit about what userland is able to access, so invert the logic to allow certain regions instead, and fix the off by 1 errors and missing size checks. This also allows the get_fs() == KERNEL_DS check to be more easily optimised into the user address range case. We now have 3 such allowed regions: - The user address range (incorporating the get_fs() == KERNEL_DS check). - NULL (some kernel code expects this to work, and we'll always catch the fault anyway). - The core code memory region. Fixes: 373cd784d0fc ("metag: Memory handling") Reported-by: Al Viro Signed-off-by: James Hogan Cc: linux-metag@vger.kernel.org Cc: stable@vger.kernel.org arch/metag/include/asm/uaccess.h | 40 ++++++++++++++++++++++++---------------- 1 file changed, 24 insertions(+), 16 deletions(-) commit 5958cc49ed2961a059d92ae55afeeaba64a783a0 Merge: 2575be8 517e1fb Author: Linus Torvalds Date: Tue May 2 10:45:15 2017 -0700 Merge tag 'usercopy-v4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardened usercopy updates from Kees Cook: "A couple hardened usercopy changes: - drop now unneeded is_vmalloc_or_module() check (Laura Abbott) - use enum instead of literals for stack frame API (Sahara)" * tag 'usercopy-v4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: mm/usercopy: Drop extra is_vmalloc_or_module() check usercopy: Move enum for arch_within_stack_frames() commit 2575be8ad32f9910d7e7c118e73f529b8d5b8b7b Merge: c58d405 3a7d2fd Author: Linus Torvalds Date: Tue May 2 10:35:45 2017 -0700 Merge tag 'pstore-v4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull pstore updates from Kees Cook: "This has a large internal refactoring along with several smaller fixes. - constify compression structures; Bhumika Goyal - restore powerpc dumping; Ankit Kumar - fix more bugs in the rarely exercises module unloading logic - reorganize filesystem locking to fix problems noticed by lockdep - refactor internal pstore APIs to make development and review easier: - improve error reporting - add kernel-doc structure and function comments - avoid insane argument passing by using a common record structure" * tag 'pstore-v4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: (23 commits) pstore: Solve lockdep warning by moving inode locks pstore: Fix flags to enable dumps on powerpc pstore: Remove unused vmalloc.h in pmsg pstore: simplify write_user_compat() pstore: Remove write_buf() callback pstore: Replace arguments for write_buf_user() API pstore: Replace arguments for write_buf() API pstore: Replace arguments for erase() API pstore: Do not duplicate record metadata pstore: Allocate records on heap instead of stack pstore: Pass record contents instead of copying pstore: Always allocate buffer for decompression pstore: Replace arguments for write() API pstore: Replace arguments for read() API pstore: Switch pstore_mkfile to pass record pstore: Move record decompression to function pstore: Extract common arguments into structure pstore: Add kernel-doc for struct pstore_info pstore: Improve register_pstore() error reporting pstore: Avoid race in module unloading ... commit 7a148c2fcff83309748bfaafe121aa85b724624f Author: Ming Lei Date: Tue May 2 07:28:02 2017 +0800 block: don't call blk_mq_quiesce_queue() after queue is frozen After queue is frozen, no request in this queue can be in use at all, so there can't be any .queue_rq() running on this queue. It isn't necessary to call blk_mq_quiesce_queue() any more, so remove it in both elevator_switch_mq() and blk_mq_update_nr_requests(). Cc: Bart Van Assche Signed-off-by: Ming Lei Fixed up the description a bit. Signed-off-by: Jens Axboe block/blk-mq.c | 2 -- block/elevator.c | 3 --- 2 files changed, 5 deletions(-) commit c58d4055c054fc6dc72f1be8bc71bd6fff209e48 Merge: ceb198b 9bb0e9c Author: Linus Torvalds Date: Tue May 2 10:21:17 2017 -0700 Merge tag 'docs-4.12' of git://git.lwn.net/linux Pull documentation update from Jonathan Corbet: "A reasonably busy cycle for documentation this time around. There is a new guide for user-space API documents, rather sparsely populated at the moment, but it's a start. Markus improved the infrastructure for converting diagrams. Mauro has converted much of the USB documentation over to RST. Plus the usual set of fixes, improvements, and tweaks. There's a bit more than the usual amount of reaching out of Documentation/ to fix comments elsewhere in the tree; I have acks for those where I could get them" * tag 'docs-4.12' of git://git.lwn.net/linux: (74 commits) docs: Fix a couple typos docs: Fix a spelling error in vfio-mediated-device.txt docs: Fix a spelling error in ioctl-number.txt MAINTAINERS: update file entry for HSI subsystem Documentation: allow installing man pages to a user defined directory Doc/PM: Sync with intel_powerclamp code behavior zr364xx.rst: usb/devices is now at /sys/kernel/debug/ usb.rst: move documentation from proc_usb_info.txt to USB ReST book convert philips.txt to ReST and add to media docs docs-rst: usb: update old usbfs-related documentation arm: Documentation: update a path name docs: process/4.Coding.rst: Fix a couple of document refs docs-rst: fix usb cross-references usb: gadget.h: be consistent at kernel doc macros usb: composite.h: fix two warnings when building docs usb: get rid of some ReST doc build errors usb.rst: get rid of some Sphinx errors usb/URB.txt: convert to ReST and update it usb/persist.txt: convert to ReST and add to driver-api book usb/hotplug.txt: convert to ReST and add to driver-api book ... commit 43b9176faae1543d1a190db8eb098a8284d364f3 Author: Shaoyun Liu Date: Fri Apr 28 16:14:59 2017 -0400 drm/amdgpu: Reserve 0-2 invalidation reg sets for none-amdgpu usages Firmware used reg set 2 for tlb invalidation. AMDGPU can start from reg set 3 to avoid the conflict. AMDKFD will use the reg set 0 or 1 when necesary. Signed-off-by: Shaoyun Liu Reviewws-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fca4ce697f304e5d1f739399d97cbfb2b918fa7f Author: Alex Deucher Date: Mon Apr 17 17:34:42 2017 -0400 drm/amdgpu/gfx9: add additional MQD initialization Need to properly set the ROQ space setting. Reviewed-by: monk liu Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 5 +++++ 1 file changed, 5 insertions(+) commit 0274a9c55614a5c89dd04bca376dbe252f5ea334 Author: Alex Deucher Date: Mon Apr 17 17:30:27 2017 -0400 drm/amdgpu/gfx9: fix typo in mpd init Using the wrong macro for soc15 register access. Reviewed-by: monk liu Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 42ce22439fdbbdb4d95d2979056ed5b075dd8403 Author: Alex Deucher Date: Mon May 1 16:20:42 2017 -0400 drm/amdgpu/gfx9: use actual gpu num se setting for ngg allocation Rather than using a hardcoded value. Reviewed-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 80112bffb0ed50257165f673aa73301a4458cd95 Author: Alex Deucher Date: Tue Apr 18 11:32:15 2017 -0400 drm/amdgpu: update revision id settings for BR/ST Add new RIDs. Acked-by: Christian König Acked-by: Alex Xie Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit ceb198bb007b84ead867e87a71ffe715c4412b15 Merge: b68e7e9 f6ab4d5 Author: Linus Torvalds Date: Tue May 2 10:10:52 2017 -0700 Merge tag 'm68k-for-v4.12-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k updates from Geert Uytterhoeven: - more kernel message modernizations and cleanups - Mac and Nubus improvements and cleanups. * tag 'm68k-for-v4.12-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: nubus: Add MVC and VSC video card definitions nubus: Clean up whitespace nubus: Clean up printk calls nubus: Fix nubus_rewinddir m68k/mac: Clarify IOP message alloc/free confusion m68k/mac: Adopt platform_device_register_simple() m68k/mac: Modernize printing of kernel messages m68k/mac: IOP - Modernize printing of kernel messages commit b68e7e952f24527de62f4768b1cead91f92f5f6e Merge: d3b5d35 d0790fb Author: Linus Torvalds Date: Tue May 2 09:50:09 2017 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Martin Schwidefsky: - three merges for KVM/s390 with changes for vfio-ccw and cpacf. The patches are included in the KVM tree as well, let git sort it out. - add the new 'trng' random number generator - provide the secure key verification API for the pkey interface - introduce the z13 cpu counters to perf - add a new system call to set up the guarded storage facility - simplify TASK_SIZE and arch_get_unmapped_area - export the raw STSI data related to CPU topology to user space - ... and the usual churn of bug-fixes and cleanups. * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (74 commits) s390/crypt: use the correct module alias for paes_s390. s390/cpacf: Introduce kma instruction s390/cpacf: query instructions use unique parameters for compatibility with KMA s390/trng: Introduce s390 TRNG device driver. s390/crypto: Provide s390 specific arch random functionality. s390/crypto: Add new subfunctions to the cpacf PRNO function. s390/crypto: Renaming PPNO to PRNO. s390/pageattr: avoid unnecessary page table splitting s390/mm: simplify arch_get_unmapped_area[_topdown] s390/mm: make TASK_SIZE independent from the number of page table levels s390/gs: add regset for the guarded storage broadcast control block s390/kvm: Add use_cmma field to mm_context_t s390/kvm: Add PGSTE manipulation functions vfio: ccw: improve error handling for vfio_ccw_mdev_remove vfio: ccw: remove unnecessary NULL checks of a pointer s390/spinlock: remove compare and delay instruction s390/spinlock: use atomic primitives for spinlocks s390/cpumf: simplify detection of guest samples s390/pci: remove forward declaration s390/pci: increase the PCI_NR_FUNCTIONS default ... commit 0337966d121ebebf73a1c346123e8112796e684e Merge: 7c5bb4a 8a038b8 Author: Dmitry Torokhov Date: Tue May 2 09:48:26 2017 -0700 Merge branch 'next' into for-linus Prepare input updates for 4.12 merge window. commit 1dbdcc810928a2c1acdd0bbfce9495f63610a0d1 Author: Timur Tabi Date: Mon May 1 14:23:04 2017 -0500 selftests: watchdog: accept multiple params on command line Watchdog drivers are not required to retain programming information, such as timeouts, after the watchdog device is closed. Therefore, the watchdog test should be able to perform multiple actions after opening the watchdog device. For example, to set the timeout to 10s and ping every 5s: watchdog-test -t 10 -p 5 -e Also, display the periodic decimal point only if the keep-alive call succeeds. Signed-off-by: Timur Tabi Reviewed-by: Guenter Roeck Signed-off-by: Shuah Khan tools/testing/selftests/watchdog/watchdog-test.c | 61 +++++++++++++----------- 1 file changed, 34 insertions(+), 27 deletions(-) commit 5f0114832a6eca70ee7563ba99b8e32da68f944b Author: Trond Myklebust Date: Mon May 1 17:35:58 2017 -0400 pNFS: Fix a typo in pnfs_generic_alloc_ds_commits If the layout segment is invalid, we want to just resend the remaining writes. Signed-off-by: Trond Myklebust fs/nfs/pnfs_nfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 61f454e30c18a28924e96be12592c0d5e24bcc81 Author: Trond Myklebust Date: Mon May 1 17:06:56 2017 -0400 pNFS: Fix a deadlock when coalescing writes and returning the layout Consider the following deadlock: Process P1 Process P2 Process P3 ========== ========== ========== lock_page(page) lseg = pnfs_update_layout(inode) lo = NFS_I(inode)->layout pnfs_error_mark_layout_for_return(lo) lock_page(page) lseg = pnfs_update_layout(inode) In this scenario, - P1 has declared the layout to be in error, but P2 holds a reference to a layout segment on that inode, so the layoutreturn is deferred. - P2 is waiting for a page lock held by P3. - P3 is asking for a new layout segment, but is blocked waiting for the layoutreturn. The fix is to ensure that pnfs_error_mark_layout_for_return() does not set the NFS_LAYOUT_RETURN flag, which blocks P3. Instead, we allow the latter to call LAYOUTGET so that it can make progress and unblock P2. Signed-off-by: Trond Myklebust fs/nfs/pnfs.c | 2 -- 1 file changed, 2 deletions(-) commit 5466d21411baf413c838d9a197f6734e94910a65 Author: Trond Myklebust Date: Mon May 1 17:03:44 2017 -0400 pNFS: Don't clear the layout return info if there are segments to return In pnfs_clear_layoutreturn_info, ensure that we don't clear the layout return info if there are new segments queued for return due to, for instance, a race between a LAYOUTRETURN and a failed I/O attempt. Signed-off-by: Trond Myklebust fs/nfs/pnfs.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 933dfbd7c437bbbf65caae785dfa105fbfaa8485 Author: Paul E. McKenney Date: Tue May 2 08:48:33 2017 -0700 rcu: Open-code the rcu_cblist_n_lazy_cbs() function Because the rcu_cblist_n_lazy_cbs() just samples the ->len_lazy counter, and because the rcu_cblist structure is quite straightforward, it makes sense to open-code rcu_cblist_n_lazy_cbs(p) as p->len_lazy, cutting out a level of indirection. This commit makes this change. Reported-by: Ingo Molnar Signed-off-by: Paul E. McKenney Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Linus Torvalds kernel/rcu/rcu_segcblist.h | 6 ------ kernel/rcu/tree.c | 2 +- kernel/rcu/tree_plugin.h | 2 +- kernel/rcu/tree_trace.c | 2 +- 4 files changed, 3 insertions(+), 9 deletions(-) commit 4b27f20b40a23f03df682eb1f69e9dc3da7d3b93 Author: Paul E. McKenney Date: Tue May 2 08:45:25 2017 -0700 rcu: Open-code the rcu_cblist_n_cbs() function Because the rcu_cblist_n_cbs() just samples the ->len counter, and because the rcu_cblist structure is quite straightforward, it makes sense to open-code rcu_cblist_n_cbs(p) as p->len, cutting out a level of indirection. This commit makes this change. Reported-by: Ingo Molnar Signed-off-by: Paul E. McKenney Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Linus Torvalds kernel/rcu/rcu_segcblist.h | 6 ------ kernel/rcu/tree.c | 9 ++++----- kernel/rcu/tree_plugin.h | 2 +- kernel/rcu/tree_trace.c | 2 +- 4 files changed, 6 insertions(+), 13 deletions(-) commit a481649e1c2a4900450e967165524282bbdf91e0 Merge: 4e9c3a6 586f852 Author: David S. Miller Date: Tue May 2 11:46:29 2017 -0400 Merge branch 'bpf-test-prog-fixes' I say: ==================== Fix some bpf program testing framework bugs This series fixes two issue: 1) Accidental user pointer dereference in bpf_test_finish() 2) The packet data given to the test programs is not aligned correctly The first issue is fixed simply because we have a kernel side copy of the datastructure in question already. And the second bug is a simple matter of applying NET_IP_ALIGN where needed. ==================== Signed-off-by: David S. Miller commit 586f8525979ad9574bf61637fd58c98d5077f29d Author: David Miller Date: Tue May 2 11:36:45 2017 -0400 bpf: Align packet data properly in program testing framework. Make sure we apply NET_IP_ALIGN when reserving headroom for SKB and XDP test runs, just like a real driver would. Signed-off-by: David S. Miller Acked-by: Daniel Borkmann net/bpf/test_run.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 78e5227237cae9172dd50c3ebb08d4fb31530676 Author: David Miller Date: Tue May 2 11:36:33 2017 -0400 bpf: Do not dereference user pointer in bpf_test_finish(). Instead, pass the kattr in which has a kernel side copy of this data structure from userspace already. Fix based upon a suggestion from Alexei Starovoitov. Signed-off-by: David S. Miller Acked-by: Daniel Borkmann net/bpf/test_run.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 8ef0f37efb7863a04b1e4102d42b7c0b1a59d40f Author: Paul E. McKenney Date: Tue May 2 08:18:40 2017 -0700 rcu: Open-code the rcu_cblist_empty() function Because the rcu_cblist_empty() just samples the ->head pointer, and because the rcu_cblist structure is quite straightforward, it makes sense to open-code rcu_cblist_empty(p) as !p->head, cutting out a level of indirection. This commit makes this change. Reported-by: Ingo Molnar Signed-off-by: Paul E. McKenney Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Linus Torvalds kernel/rcu/rcu_segcblist.h | 8 +------- kernel/rcu/tree.c | 9 ++++----- kernel/rcu/tree_plugin.h | 4 ++-- 3 files changed, 7 insertions(+), 14 deletions(-) commit 4e9c3a667135799d50f2778a8a8dae2ca13aafd0 Author: David S. Miller Date: Tue May 2 07:52:01 2017 -0700 selftests: bpf: Use bpf_endian.h in test_xdp.c This fixes the testcase on big-endian. Signed-off-by: David S. Miller tools/testing/selftests/bpf/test_xdp.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) commit 24b43c99647bf9be4995e6a6c9c3a923c147770a Author: Paolo Abeni Date: Tue May 2 16:03:58 2017 +0200 infiniband: avoid dereferencing uninitialized dst on error path With commit eea40b8f624f ("infiniband: call ipv6 route lookup via the stub interface"), if the route lookup fails due to ipv6 being disabled, the dst variable is left untouched, and the following dst_release() may access uninitialized memory. Since ipv6_dst_lookup() always sets dst to NULL in case of lookup failure with ipv6 enabled, fix the above just returning the error code if the lookup fails. Fixes: eea40b8f624 ("infiniband: call ipv6 route lookup via the stub interface") Reported-by: Sabrina Dubroca Signed-off-by: Paolo Abeni Reviewed-by: Sabrina Dubroca Signed-off-by: Doug Ledford drivers/infiniband/core/addr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 98059b98619d093366462ff0a4e1258e946accb9 Author: Paul E. McKenney Date: Tue May 2 06:30:12 2017 -0700 rcu: Separately compile large rcu_segcblist functions This commit creates a new kernel/rcu/rcu_segcblist.c file that contains non-trivial segcblist functions. Trivial functions remain as static inline functions in kernel/rcu/rcu_segcblist.h Reported-by: Linus Torvalds Signed-off-by: Paul E. McKenney Cc: Peter Zijlstra Cc: Thomas Gleixner init/Kconfig | 3 + kernel/rcu/Makefile | 1 + kernel/rcu/rcu_segcblist.c | 505 ++++++++++++++++++++++++++++++++++++++++++ kernel/rcu/rcu_segcblist.h | 533 +++------------------------------------------ 4 files changed, 544 insertions(+), 498 deletions(-) commit 48d0e023af9799cd7220335baf8e3ba61eeafbeb Author: Paul Moore Date: Tue May 2 10:16:05 2017 -0400 audit: fix the RCU locking for the auditd_connection structure Cong Wang correctly pointed out that the RCU read locking of the auditd_connection struct was wrong, this patch correct this by adopting a more traditional, and correct RCU locking model. This patch is heavily based on an earlier prototype by Cong Wang. Cc: # 4.11.x- Reported-by: Cong Wang Signed-off-by: Cong Wang Signed-off-by: Paul Moore kernel/audit.c | 157 ++++++++++++++++++++++++++++++++++++--------------------- 1 file changed, 100 insertions(+), 57 deletions(-) commit 8cc96382d9a7fe1746286670dd5140c3b12638ae Author: Paul Moore Date: Tue May 2 10:16:05 2017 -0400 audit: use kmem_cache to manage the audit_buffer cache The audit subsystem implemented its own buffer cache mechanism which is a bit silly these days when we could use the kmem_cache construct. Some credit is due to Florian Westphal for originally proposing that we remove the audit cache implementation in favor of simple kmalloc()/kfree() calls, but I would rather have a dedicated slab cache to ease debugging and future stats/performance work. Cc: Florian Westphal Reviewed-by: Richard Guy Briggs Signed-off-by: Paul Moore kernel/audit.c | 66 +++++++++++++++------------------------------------------- 1 file changed, 17 insertions(+), 49 deletions(-) commit 2115bb250f260089743e26decfb5f271ba71ca37 Author: Deepa Dinamani Date: Tue May 2 10:16:05 2017 -0400 audit: Use timespec64 to represent audit timestamps struct timespec is not y2038 safe. Audit timestamps are recorded in string format into an audit buffer for a given context. These mark the entry timestamps for the syscalls. Use y2038 safe struct timespec64 to represent the times. The log strings can handle this transition as strings can hold upto 1024 characters. Signed-off-by: Deepa Dinamani Reviewed-by: Arnd Bergmann Acked-by: Paul Moore Acked-by: Richard Guy Briggs Signed-off-by: Paul Moore include/linux/audit.h | 4 ++-- kernel/audit.c | 10 +++++----- kernel/audit.h | 2 +- kernel/auditsc.c | 6 +++--- 4 files changed, 11 insertions(+), 11 deletions(-) commit b6c7c115c2ce679ac536f0adf0ff518fcd939196 Author: Paul Moore Date: Tue May 2 10:16:05 2017 -0400 audit: store the auditd PID as a pid struct instead of pid_t This is arguably the right thing to do, and will make it easier when we start supporting multiple audit daemons in different namespaces. Signed-off-by: Paul Moore kernel/audit.c | 84 +++++++++++++++++++++++++++++++++++++++------------------- kernel/audit.h | 2 +- 2 files changed, 58 insertions(+), 28 deletions(-) commit 45a0642b4d021a2f50d5db9c191b5bfe60bfa1c7 Author: Paul Moore Date: Tue May 2 10:16:05 2017 -0400 audit: kernel generated netlink traffic should have a portid of 0 We were setting the portid incorrectly in the netlink message headers, fix that to always be 0 (nlmsg_pid = 0). Signed-off-by: Paul Moore Reviewed-by: Richard Guy Briggs include/linux/audit.h | 3 +-- kernel/audit.c | 23 ++++++----------------- kernel/audit.h | 3 +-- kernel/auditfilter.c | 14 ++++++-------- 4 files changed, 14 insertions(+), 29 deletions(-) commit a9d1620877748375cf60b43ef3fa5f61ab6d9f24 Author: Paul Moore Date: Tue May 2 10:16:05 2017 -0400 audit: combine audit_receive() and audit_receive_skb() There is no reason to have both of these functions, combine the two. Signed-off-by: Paul Moore Reviewed-by: Richard Guy Briggs kernel/audit.c | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) commit bd120ded6a6af61ad342a8a95b36b64bd1e2f9e6 Author: Elena Reshetova Date: Tue May 2 10:16:05 2017 -0400 audit: convert audit_watch.count from atomic_t to refcount_t refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova Signed-off-by: Hans Liljestrand Signed-off-by: Kees Cook Signed-off-by: David Windsor [PM: fix subject line, add #include] Signed-off-by: Paul Moore kernel/audit_watch.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 9d2378f8c8f1a3fcfab681fd90c139d90dca7b69 Author: Elena Reshetova Date: Tue May 2 10:16:04 2017 -0400 audit: convert audit_tree.count from atomic_t to refcount_t refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova Signed-off-by: Hans Liljestrand Signed-off-by: Kees Cook Signed-off-by: David Windsor [PM: fix subject line, add #include] Signed-off-by: Paul Moore kernel/audit_tree.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 2173c519d5e912a6e2934bb04255fcd36c1591c8 Author: Richard Guy Briggs Date: Tue May 2 10:16:04 2017 -0400 audit: normalize NETFILTER_PKT Eliminate flipping in and out of message fields, dropping fields in the process. Sample raw message format IPv4 UDP: type=NETFILTER_PKT msg=audit(1487874761.386:228): mark=0xae8a2732 saddr=127.0.0.1 daddr=127.0.0.1 proto=17^] Sample raw message format IPv6 ICMP6: type=NETFILTER_PKT msg=audit(1487874761.381:227): mark=0x223894b7 saddr=::1 daddr=::1 proto=58^] Issue: https://github.com/linux-audit/audit-kernel/issues/11 Test case: https://github.com/linux-audit/audit-testsuite/issues/43 Signed-off-by: Richard Guy Briggs Signed-off-by: Paul Moore net/netfilter/xt_AUDIT.c | 124 +++++++++++------------------------------------ 1 file changed, 27 insertions(+), 97 deletions(-) commit 0cb88b6ff054ccfa30e0fd7f7b42ee9f088db432 Author: Richard Guy Briggs Date: Tue May 2 10:16:04 2017 -0400 netfilter: use consistent ipv4 network offset in xt_AUDIT Even though the skb->data pointer has been moved from the link layer header to the network layer header, use the same method to calculate the offset in ipv4 and ipv6 routines. Signed-off-by: Richard Guy Briggs [PM: munged subject line] Signed-off-by: Paul Moore net/netfilter/xt_AUDIT.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f6276ac95bde4312251535904af32b1de9d54949 Author: Richard Guy Briggs Date: Tue May 2 10:16:04 2017 -0400 audit: log module name on delete_module When a sysadmin wishes to monitor module unloading with a syscall rule such as: -a always,exit -F arch=x86_64 -S delete_module -F key=mod-unload the SYSCALL record doesn't tell us what module was requested for unloading. Use the new KERN_MODULE auxiliary record to record it. The SYSCALL record result code will list the return code. See: https://github.com/linux-audit/audit-kernel/issues/37 https://github.com/linux-audit/audit-kernel/issues/7 https://github.com/linux-audit/audit-kernel/wiki/RFE-Module-Load-Record-Format Signed-off-by: Richard Guy Briggs Acked-by: Jessica Yu Signed-off-by: Paul Moore kernel/module.c | 2 ++ 1 file changed, 2 insertions(+) commit 9aab4f4ea7a4ca80ec3e0269ce2eb71a24f6fef9 Author: Nicholas Mc Guire Date: Tue May 2 10:16:04 2017 -0400 audit: remove unnecessary semicolon in audit_watch_handle_event() The excess ; after the closing parenthesis is just code-noise it has no and can be removed. Signed-off-by: Nicholas Mc Guire [PM: tweaked subject line] Signed-off-by: Paul Moore kernel/audit_watch.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b5239fba69949a44290d4af517fc1c2eff3e36f6 Author: Nicholas Mc Guire Date: Tue May 2 10:16:04 2017 -0400 audit: remove unnecessary semicolon in audit_mark_handle_event() The excess ; after the closing parenthesis is just code-noise it has no and can be removed. Signed-off-by: Nicholas Mc Guire [PM: tweaked subject line] Signed-off-by: Paul Moore kernel/audit_fsnotify.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b7a84deaf8d1b0e62b437a290a40d6380975f126 Author: Nicholas Mc Guire Date: Tue May 2 10:16:03 2017 -0400 audit: remove unnecessary semicolon in audit_field_valid() The excess ; after the closing parenthesis is just code-noise it has no and can be removed. Signed-off-by: Nicholas Mc Guire [PM: tweak subject line] Signed-off-by: Paul Moore kernel/auditfilter.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit d6296d39e90c9075bc2fc15f1e86dac44930d4b5 Author: Christoph Hellwig Date: Mon May 1 10:19:08 2017 -0600 blk-mq: update ->init_request and ->exit_request prototypes Remove the request_idx parameter, which can't be used safely now that we support I/O schedulers with blk-mq. Except for a superflous check in mtip32xx it was unused anyway. Also pass the tag_set instead of just the driver data - this allows drivers to avoid some code duplication in a follow on cleanup. Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe block/blk-mq.c | 18 +++++------------- drivers/block/loop.c | 5 ++--- drivers/block/mtip32xx/mtip32xx.c | 20 ++++++-------------- drivers/block/nbd.c | 7 +++---- drivers/block/rbd.c | 5 ++--- drivers/block/virtio_blk.c | 7 +++---- drivers/md/dm-rq.c | 7 +++---- drivers/mtd/ubi/block.c | 7 +++---- drivers/nvme/host/fc.c | 20 +++++++++----------- drivers/nvme/host/pci.c | 15 +++++++-------- drivers/nvme/host/rdma.c | 28 ++++++++++++++-------------- drivers/nvme/target/loop.c | 17 +++++++++-------- drivers/scsi/scsi_lib.c | 13 ++++++------- include/linux/blk-mq.h | 4 ++-- 14 files changed, 74 insertions(+), 99 deletions(-) commit a800ce8ba53da88571872cbccb0e2fff8e374752 Author: Jens Axboe Date: Thu Apr 27 16:46:02 2017 -0600 Revert "mtip32xx: pass BLK_MQ_F_NO_SCHED" This reverts commit 4981d04dd8f1ab19e2cce008da556d7f099b6e68. The driver has been converted to using the proper infrastructure for issuing internal commands. This means it's now safe to use with the scheduling infrastruture, so we can now revert the change that turned off scheduling for mtip32xx. Reviewed-by: Ming Lei Reviewed-by: Christoph Hellwig Tested-by: Ming Lei Signed-off-by: Jens Axboe drivers/block/mtip32xx/mtip32xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9f2779bff2f178496fb00b89797734ee245d2c93 Author: Jens Axboe Date: Fri Apr 28 08:53:01 2017 -0600 blk-mq-sched: remove hack that bypasses scheduler for reserved requests We have update the troublesome driver (mtip32xx) to deal with this appropriately. So kill the hack that bypassed scheduler allocation and insertion for reserved requests. Reviewed-by: Ming Lei Reviewed-by: Christoph Hellwig Tested-by: Ming Lei Signed-off-by: Jens Axboe block/blk-mq-sched.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) commit 3f5e6a35774cd6bb4fd6b32edb4efd2a3f90e4dd Author: Jens Axboe Date: Fri Apr 28 10:45:08 2017 -0600 mtip32xx: convert internal command issue to block IO path The driver special cases certain things for command issue, depending on whether it's an internal command or not. Make the internal commands use the regular infrastructure for issuing IO. Since this is an 8-group souped up AHCI variant, we have to deal with NCQ vs non-queueable commands. Do this from the queue_rq handler, by backing off unless the drive is idle. Reviewed-by: Christoph Hellwig Tested-by: Ming Lei Signed-off-by: Jens Axboe drivers/block/mtip32xx/mtip32xx.c | 103 +++++++++++++++++++++++++++----------- 1 file changed, 73 insertions(+), 30 deletions(-) commit baed548a98397f57a71d61917177f7d42ab17881 Author: Jens Axboe Date: Fri Apr 28 07:54:06 2017 -0600 mtip32xx: abstract out "are any commands active" helper This is a prep patch for backoff in ->queue_rq() for non-ncq commands. Reviewed-by: Bart Van Assche Reviewed-by: Christoph Hellwig Tested-by: Ming Lei Signed-off-by: Jens Axboe drivers/block/mtip32xx/mtip32xx.c | 28 ++++++++++++++++++---------- 1 file changed, 18 insertions(+), 10 deletions(-) commit 8afdd94c74e416de74a8ee61d79e4bf93466420b Author: Jens Axboe Date: Thu Apr 27 16:32:41 2017 -0600 mtip32xx: kill atomic argument to mtip_quiesce_io() All callers now pass in GFP_KERNEL, get rid of the argument. Reviewed-by: Bart Van Assche Reviewed-by: Christoph Hellwig Tested-by: Ming Lei Signed-off-by: Jens Axboe drivers/block/mtip32xx/mtip32xx.c | 20 +++++--------------- 1 file changed, 5 insertions(+), 15 deletions(-) commit 0f6422a2c57c6afcf66ead903dc3fa6641184aa4 Author: Jens Axboe Date: Thu Apr 27 16:29:26 2017 -0600 mtip32xx: get rid of 'atomic' argument to mtip_exec_internal_command() All callers can safely block. Kill the atomic/block argument, and remove the argument from all callers. Reviewed-by: Bart Van Assche Reviewed-by: Christoph Hellwig Tested-by: Ming Lei Signed-off-by: Jens Axboe drivers/block/mtip32xx/mtip32xx.c | 148 +++++++++++--------------------------- 1 file changed, 43 insertions(+), 105 deletions(-) commit c0332694903a37cf8ecdc9102d5c9e09cf8643d0 Author: Bart Van Assche Date: Mon May 1 08:58:49 2017 -0700 block: Remove elevator_change() Since commit 84253394927c ("remove the mg_disk driver") removed the only caller of elevator_change(), also remove the elevator_change() function itself. Signed-off-by: Bart Van Assche Cc: Christoph Hellwig Cc: Markus Trippelsdorf Signed-off-by: Jens Axboe block/elevator.c | 13 ------------- include/linux/elevator.h | 1 - 2 files changed, 14 deletions(-) commit b5d60989c6f7501af72cb65893c02621dd16fd84 Author: Jakub Kicinski Date: Mon May 1 15:53:43 2017 -0700 xdp: fix parameter kdoc for extack Fix kdoc parameter spelling from extact to extack. Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller net/core/dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit eb6211d3606971a957fea28f7532687f9d0f93f2 Author: Daniel Borkmann Date: Tue May 2 00:47:09 2017 +0200 bpf, samples: fix build warning in cookie_uid_helper_example Fix the following warnings triggered by 51570a5ab2b7 ("A Sample of using socket cookie and uid for traffic monitoring"): In file included from /home/foo/net-next/samples/bpf/cookie_uid_helper_example.c:54:0: /home/foo/net-next/samples/bpf/cookie_uid_helper_example.c: In function 'prog_load': /home/foo/net-next/samples/bpf/cookie_uid_helper_example.c:119:27: warning: overflow in implicit constant conversion [-Woverflow] -32 + offsetof(struct stats, uid)), ^ /home/foo/net-next/samples/bpf/libbpf.h:135:12: note: in definition of macro 'BPF_STX_MEM' .off = OFF, \ ^ /home/foo/net-next/samples/bpf/cookie_uid_helper_example.c:121:27: warning: overflow in implicit constant conversion [-Woverflow] -32 + offsetof(struct stats, packets), 1), ^ /home/foo/net-next/samples/bpf/libbpf.h:155:12: note: in definition of macro 'BPF_ST_MEM' .off = OFF, \ ^ /home/foo/net-next/samples/bpf/cookie_uid_helper_example.c:129:27: warning: overflow in implicit constant conversion [-Woverflow] -32 + offsetof(struct stats, bytes)), ^ /home/foo/net-next/samples/bpf/libbpf.h:135:12: note: in definition of macro 'BPF_STX_MEM' .off = OFF, \ ^ HOSTLD /home/foo/net-next/samples/bpf/per_socket_stats_example Fixes: 51570a5ab2b7 ("A Sample of using socket cookie and uid for traffic monitoring") Signed-off-by: Daniel Borkmann Signed-off-by: David S. Miller samples/bpf/cookie_uid_helper_example.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 45753c5f315749711b935a2506ee5c10eef5c23d Author: Ingo Molnar Date: Tue May 2 10:31:18 2017 +0200 srcu: Debloat the header Linus noticed that the has huge inline functions which should not be inline at all. As a first step in cleaning this up, move them all to kernel/rcu/ and only keep an absolute minimum of data type defines in the header: before: -rw-r--r-- 1 mingo mingo 22284 May 2 10:25 include/linux/rcu_segcblist.h after: -rw-r--r-- 1 mingo mingo 3180 May 2 10:22 include/linux/rcu_segcblist.h More can be done, such as uninlining the large functions, which inlining is unjustified even if it's an RCU internal matter. Reported-by: Linus Torvalds Cc: Paul E. McKenney Cc: Peter Zijlstra Cc: Thomas Gleixner Signed-off-by: Ingo Molnar Signed-off-by: Paul E. McKenney include/linux/rcu_segcblist.h | 628 +--------------------------------------- kernel/rcu/rcu_segcblist.h | 645 ++++++++++++++++++++++++++++++++++++++++++ kernel/rcu/srcutiny.c | 1 + kernel/rcu/srcutree.c | 1 + kernel/rcu/tree.h | 3 +- 5 files changed, 652 insertions(+), 626 deletions(-) commit 5c0aea0e8d98e38858fbb3a09870ed8487a01da2 Author: David Hildenbrand Date: Fri Apr 28 17:06:20 2017 +0200 KVM: x86: don't hold kvm->lock in KVM_SET_GSI_ROUTING We needed the lock to avoid racing with creation of the irqchip on x86. As kvm_set_irq_routing() calls srcu_synchronize_expedited(), this lock might be held for a longer time. Let's introduce an arch specific callback to check if we can actually add irq routes. For x86, all we have to do is check if we have an irqchip in the kernel. We don't need kvm->lock at that point as the irqchip is marked as inititalized only when actually fully created. Reported-by: Steve Rutherford Reviewed-by: Radim Krčmář Fixes: 1df6ddede10a ("KVM: x86: race between KVM_SET_GSI_ROUTING and KVM_CREATE_IRQCHIP") Signed-off-by: David Hildenbrand Signed-off-by: Paolo Bonzini arch/x86/include/asm/kvm_host.h | 1 - arch/x86/kvm/irq.h | 2 +- arch/x86/kvm/irq_comm.c | 15 +++++++++------ arch/x86/kvm/x86.c | 11 +---------- include/linux/kvm_host.h | 1 + virt/kvm/irqchip.c | 5 +++++ virt/kvm/kvm_main.c | 5 ++--- 7 files changed, 19 insertions(+), 21 deletions(-) commit c0b64978f09195e00d6649ca0ad0242a80e6e99a Author: Russell Currey Date: Wed Apr 19 17:39:27 2017 +1000 powerpc/eeh: Clean up and document event handling functions Remove unnecessary tags in eeh_handle_normal_event(), and add function comments for eeh_handle_normal_event() and eeh_handle_special_event(). The only functional difference is that in the case of a PE reaching the maximum number of failures, rather than one message telling you of this and suggesting you reseat the device, there are two separate messages. Suggested-by: Alexey Kardashevskiy Signed-off-by: Russell Currey Reviewed-by: Andrew Donnellan Reviewed-by: Gavin Shan Signed-off-by: Michael Ellerman arch/powerpc/kernel/eeh_driver.c | 36 ++++++++++++++++++++++++------------ 1 file changed, 24 insertions(+), 12 deletions(-) commit daeba2956f32f91f3493788ff6ee02fb1b2f02fa Author: Russell Currey Date: Wed Apr 19 17:39:26 2017 +1000 powerpc/eeh: Avoid use after free in eeh_handle_special_event() eeh_handle_special_event() is called when an EEH event is detected but can't be narrowed down to a specific PE. This function looks through every PE to find one in an erroneous state, then calls the regular event handler eeh_handle_normal_event() once it knows which PE has an error. However, if eeh_handle_normal_event() found that the PE cannot possibly be recovered, it will free it, rendering the passed PE stale. This leads to a use after free in eeh_handle_special_event() as it attempts to clear the "recovering" state on the PE after eeh_handle_normal_event() returns. Thus, make sure the PE is valid when attempting to clear state in eeh_handle_special_event(). Fixes: 8a6b1bc70dbb ("powerpc/eeh: EEH core to handle special event") Cc: stable@vger.kernel.org # v3.11+ Reported-by: Alexey Kardashevskiy Signed-off-by: Russell Currey Reviewed-by: Gavin Shan Signed-off-by: Michael Ellerman arch/powerpc/kernel/eeh_driver.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) commit a715626a8e904e7226915d1bc4885317ea9da141 Author: Alastair D'Silva Date: Mon May 1 10:53:31 2017 +1000 cxl: Mask slice error interrupts after first occurrence In some situations, a faulty AFU slice may create an interrupt storm of slice errors, rendering the machine unusable. Since these interrupts are informational only, present the interrupt once, then mask it off to prevent it from being retriggered until the AFU is reset. Signed-off-by: Alastair D'Silva Reviewed-by: Andrew Donnellan Reviewed-by: Vaibhav Jain Acked-by: Frederic Barrat Signed-off-by: Michael Ellerman drivers/misc/cxl/cxl.h | 18 ++++++++++++++++++ drivers/misc/cxl/native.c | 19 +++++++++++++++++-- 2 files changed, 35 insertions(+), 2 deletions(-) commit 4f58f0bf155e87dda31a3088b1e107fa9dd79f0e Author: Vaibhav Jain Date: Thu Apr 27 10:58:22 2017 +0530 cxl: Route eeh events to all drivers in cxl_pci_error_detected() Fix a boundary condition where in some cases an eeh event that results in card reset isn't passed on to a driver attached to the virtual PCI device associated with a slice. This will happen in case when a slice attached device driver returns a value other than PCI_ERS_RESULT_NEED_RESET from the eeh error_detected() callback. This would result in an early return from cxl_pci_error_detected() and other drivers attached to other AFUs on the card wont be notified. The patch fixes this by making sure that all slice attached device-drivers are notified and the return values from error_detected() callback are aggregated in a scheme where request for 'disconnect' trumps all and 'none' trumps 'need_reset'. Fixes: 9e8df8a21963 ("cxl: EEH support") Cc: stable@vger.kernel.org # v4.3+ Signed-off-by: Vaibhav Jain Reviewed-by: Andrew Donnellan Acked-by: Frederic Barrat Signed-off-by: Michael Ellerman drivers/misc/cxl/pci.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) commit ea9a26d117cf0637c71d3e0076f4a124bf5859df Author: Vaibhav Jain Date: Thu Apr 27 10:53:25 2017 +0530 cxl: Force context lock during EEH flow During an eeh event when the cxl card is fenced and card sysfs attr perst_reloads_same_image is set following warning message is seen in the kernel logs: Adapter context unlocked with 0 active contexts ------------[ cut here ]------------ WARNING: CPU: 12 PID: 627 at ../drivers/misc/cxl/main.c:325 cxl_adapter_context_unlock+0x60/0x80 [cxl] Even though this warning is harmless, it clutters the kernel log during an eeh event. This warning is triggered as the EEH callback cxl_pci_error_detected doesn't obtain a context-lock before forcibly detaching all active context and when context-lock is released during call to cxl_configure_adapter from cxl_pci_slot_reset, a warning in cxl_adapter_context_unlock is triggered. To fix this warning, we acquire the adapter context-lock via cxl_adapter_context_lock() in the eeh callback cxl_pci_error_detected() once all the virtual AFU PHBs are notified and their contexts detached. The context-lock is released in cxl_pci_slot_reset() after the adapter is successfully reconfigured and before the we call the slot_reset callback on slice attached device-drivers. Fixes: 70b565bbdb91 ("cxl: Prevent adapter reset if an active context exists") Cc: stable@vger.kernel.org # v4.9+ Reported-by: Andrew Donnellan Signed-off-by: Vaibhav Jain Acked-by: Frederic Barrat Reviewed-by: Matthew R. Ochs Tested-by: Uma Krishnan Signed-off-by: Michael Ellerman drivers/misc/cxl/pci.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) commit 5c9cfda13dc503f4b25b486a57974e0414adb6f1 Author: Karim Eshapa Date: Tue May 2 13:47:54 2017 +0200 drivers/video/fbdev/omap/lcd_mipid.c: Use time comparison kernel macros Use time_before_eq time comparison defind kernel macro that has safety check. Signed-off-by: Karim Eshapa Cc: Tomi Valkeinen Signed-off-by: Bartlomiej Zolnierkiewicz drivers/video/fbdev/omap/lcd_mipid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit dc85e9a87420613b3129d5cc5ecd79c58351c546 Author: Alexey Khoroshilov Date: Tue May 2 13:47:53 2017 +0200 sm501fb: don't return zero on failure path in sm501fb_start() If fbmem iomemory mapping failed, sm501fb_start() breaks off initialization, deallocates resources, but returns zero. As a result, double deallocation can happen in sm501fb_stop(). Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov Cc: Tomi Valkeinen Signed-off-by: Bartlomiej Zolnierkiewicz drivers/video/fbdev/sm501fb.c | 1 + 1 file changed, 1 insertion(+) commit 45f580c42e5c125d55dbd8099750a1998de3d917 Author: Maksim Salau Date: Tue May 2 13:47:53 2017 +0200 video: fbdev: udlfb: Fix buffer on stack Allocate buffers on HEAP instead of STACK for local array that is to be sent using usb_control_msg(). Signed-off-by: Maksim Salau Cc: Bernie Thompson Cc: Geert Uytterhoeven Signed-off-by: Bartlomiej Zolnierkiewicz drivers/video/fbdev/udlfb.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) commit e371fd7607999fabbd955b4d22c8e912594a7997 Author: Julien Grall Date: Mon Apr 24 18:58:39 2017 +0100 xen: Implement EFI reset_system callback When rebooting DOM0 with ACPI on ARM64, the kernel is crashing with the stack trace [1]. This is happening because when EFI runtimes are enabled, the reset code (see machine_restart) will first try to use EFI restart method. However, the EFI restart code is expecting the reset_system callback to be always set. This is not the case for Xen and will lead to crash. The EFI restart helper is used in multiple places and some of them don't not have fallback (see machine_power_off). So implement reset_system callback as a call to xen_reboot when using EFI Xen. [ 36.999270] reboot: Restarting system [ 37.002921] Internal error: Attempting to execute userspace memory: 86000004 [#1] PREEMPT SMP [ 37.011460] Modules linked in: [ 37.014598] CPU: 0 PID: 1 Comm: systemd-shutdow Not tainted 4.11.0-rc1-00003-g1e248b60a39b-dirty #506 [ 37.023903] Hardware name: (null) (DT) [ 37.027734] task: ffff800902068000 task.stack: ffff800902064000 [ 37.033739] PC is at 0x0 [ 37.036359] LR is at efi_reboot+0x94/0xd0 [ 37.040438] pc : [<0000000000000000>] lr : [] pstate: 404001c5 [ 37.047920] sp : ffff800902067cf0 [ 37.051314] x29: ffff800902067cf0 x28: ffff800902068000 [ 37.056709] x27: ffff000008992000 x26: 000000000000008e [ 37.062104] x25: 0000000000000123 x24: 0000000000000015 [ 37.067499] x23: 0000000000000000 x22: ffff000008e6e250 [ 37.072894] x21: ffff000008e6e000 x20: 0000000000000000 [ 37.078289] x19: ffff000008e5d4c8 x18: 0000000000000010 [ 37.083684] x17: 0000ffffa7c27470 x16: 00000000deadbeef [ 37.089079] x15: 0000000000000006 x14: ffff000088f42bef [ 37.094474] x13: ffff000008f42bfd x12: ffff000008e706c0 [ 37.099870] x11: ffff000008e70000 x10: 0000000005f5e0ff [ 37.105265] x9 : ffff800902067a50 x8 : 6974726174736552 [ 37.110660] x7 : ffff000008cc6fb8 x6 : ffff000008cc6fb0 [ 37.116055] x5 : ffff000008c97dd8 x4 : 0000000000000000 [ 37.121453] x3 : 0000000000000000 x2 : 0000000000000000 [ 37.126845] x1 : 0000000000000000 x0 : 0000000000000000 [ 37.132239] [ 37.133808] Process systemd-shutdow (pid: 1, stack limit = 0xffff800902064000) [ 37.141118] Stack: (0xffff800902067cf0 to 0xffff800902068000) [ 37.146949] 7ce0: ffff800902067d40 ffff000008085334 [ 37.154869] 7d00: 0000000000000000 ffff000008f3b000 ffff800902067d40 ffff0000080852e0 [ 37.162787] 7d20: ffff000008cc6fb0 ffff000008cc6fb8 ffff000008c7f580 ffff000008c97dd8 [ 37.170706] 7d40: ffff800902067d60 ffff0000080e2c2c 0000000000000000 0000000001234567 [ 37.178624] 7d60: ffff800902067d80 ffff0000080e2ee8 0000000000000000 ffff0000080e2df4 [ 37.186544] 7d80: 0000000000000000 ffff0000080830f0 0000000000000000 00008008ff1c1000 [ 37.194462] 7da0: ffffffffffffffff 0000ffffa7c4b1cc 0000000000000000 0000000000000024 [ 37.202380] 7dc0: ffff800902067dd0 0000000000000005 0000fffff24743c8 0000000000000004 [ 37.210299] 7de0: 0000fffff2475f03 0000000000000010 0000fffff2474418 0000000000000005 [ 37.218218] 7e00: 0000fffff2474578 000000000000000a 0000aaaad6b722c0 0000000000000001 [ 37.226136] 7e20: 0000000000000123 0000000000000038 ffff800902067e50 ffff0000081e7294 [ 37.234055] 7e40: ffff800902067e60 ffff0000081e935c ffff800902067e60 ffff0000081e9388 [ 37.241973] 7e60: ffff800902067eb0 ffff0000081ea388 0000000000000000 00008008ff1c1000 [ 37.249892] 7e80: ffffffffffffffff 0000ffffa7c4a79c 0000000000000000 ffff000000020000 [ 37.257810] 7ea0: 0000010000000004 0000000000000000 0000000000000000 ffff0000080830f0 [ 37.265729] 7ec0: fffffffffee1dead 0000000028121969 0000000001234567 0000000000000000 [ 37.273651] 7ee0: ffffffffffffffff 8080000000800000 0000800000008080 feffa9a9d4ff2d66 [ 37.281567] 7f00: 000000000000008e feffa9a9d5b60e0f 7f7fffffffff7f7f 0101010101010101 [ 37.289485] 7f20: 0000000000000010 0000000000000008 000000000000003a 0000ffffa7ccf588 [ 37.297404] 7f40: 0000aaaad6b87d00 0000ffffa7c4b1b0 0000fffff2474be0 0000aaaad6b88000 [ 37.305326] 7f60: 0000fffff2474fb0 0000000001234567 0000000000000000 0000000000000000 [ 37.313240] 7f80: 0000000000000000 0000000000000001 0000aaaad6b70d4d 0000000000000000 [ 37.321159] 7fa0: 0000000000000001 0000fffff2474ea0 0000aaaad6b5e2e0 0000fffff2474e80 [ 37.329078] 7fc0: 0000ffffa7c4b1cc 0000000000000000 fffffffffee1dead 000000000000008e [ 37.336997] 7fe0: 0000000000000000 0000000000000000 9ce839cffee77eab fafdbf9f7ed57f2f [ 37.344911] Call trace: [ 37.347437] Exception stack(0xffff800902067b20 to 0xffff800902067c50) [ 37.353970] 7b20: ffff000008e5d4c8 0001000000000000 0000000080f82000 0000000000000000 [ 37.361883] 7b40: ffff800902067b60 ffff000008e17000 ffff000008f44c68 00000001081081b4 [ 37.369802] 7b60: ffff800902067bf0 ffff000008108478 0000000000000000 ffff000008c235b0 [ 37.377721] 7b80: ffff800902067ce0 0000000000000000 0000000000000000 0000000000000015 [ 37.385643] 7ba0: 0000000000000123 000000000000008e ffff000008992000 ffff800902068000 [ 37.393557] 7bc0: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 37.401477] 7be0: 0000000000000000 ffff000008c97dd8 ffff000008cc6fb0 ffff000008cc6fb8 [ 37.409396] 7c00: 6974726174736552 ffff800902067a50 0000000005f5e0ff ffff000008e70000 [ 37.417318] 7c20: ffff000008e706c0 ffff000008f42bfd ffff000088f42bef 0000000000000006 [ 37.425234] 7c40: 00000000deadbeef 0000ffffa7c27470 [ 37.430190] [< (null)>] (null) [ 37.434982] [] machine_restart+0x6c/0x70 [ 37.440550] [] kernel_restart+0x6c/0x78 [ 37.446030] [] SyS_reboot+0x130/0x228 [ 37.451337] [] el0_svc_naked+0x24/0x28 [ 37.456737] Code: bad PC value [ 37.459891] ---[ end trace 76e2fc17e050aecd ]--- Signed-off-by: Julien Grall -- Cc: Boris Ostrovsky Cc: Juergen Gross Cc: Thomas Gleixner Cc: Ingo Molnar Cc: "H. Peter Anvin" Cc: x86@kernel.org The x86 code has theoritically a similar issue, altought EFI does not seem to be the preferred method. I have only built test it on x86. This should also probably be fixed in stable tree. Changes in v2: - Implement xen_efi_reset_system using xen_reboot - Move xen_efi_reset_system in drivers/xen/efi.c Signed-off-by: Juergen Gross arch/arm/xen/efi.c | 2 +- arch/x86/xen/efi.c | 2 +- drivers/xen/efi.c | 18 ++++++++++++++++++ include/xen/xen-ops.h | 3 +++ 4 files changed, 23 insertions(+), 2 deletions(-) commit fa12a870a9d594ba458242a04a4d17a76fc816a4 Author: Julien Grall Date: Mon Apr 24 18:58:38 2017 +0100 arm/xen: Consolidate calls to shutdown hypercall in a single helper Signed-off-by: Julien Grall Signed-off-by: Juergen Gross arch/arm/xen/enlighten.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) commit 5d9404e1185de8d508cd042761306495f727d7eb Author: Julien Grall Date: Mon Apr 24 18:58:37 2017 +0100 xen: Export xen_reboot The helper xen_reboot will be called by the EFI code in a later patch. Note that the ARM version does not yet exist and will be added in a later patch too. Signed-off-by: Julien Grall Signed-off-by: Juergen Gross arch/x86/xen/xen-ops.h | 1 - include/xen/xen-ops.h | 2 ++ 2 files changed, 2 insertions(+), 1 deletion(-) commit f31b969217b42df605b2e0e64aa6b3e03e781a4f Author: Boris Ostrovsky Date: Wed Apr 26 09:42:48 2017 -0400 xen/x86: Call xen_smp_intr_init_pv() on BSP Recent code rework that split handling ov PV, HVM and PVH guests into separate files missed calling xen_smp_intr_init_pv() on CPU0. Add this call. Signed-off-by: Boris Ostrovsky Reported-by: Sander Eikelenboom Signed-off-by: Juergen Gross arch/x86/xen/smp_pv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 84d582d236dc1f9085e741affc72e9ba061a67c2 Author: Boris Ostrovsky Date: Mon Apr 24 15:04:53 2017 -0400 xen: Revert commits da72ff5bfcb0 and 72a9b186292d Recent discussion (http://marc.info/?l=xen-devel&m=149192184523741) established that commit 72a9b186292d ("xen: Remove event channel notification through Xen PCI platform device") (and thus commit da72ff5bfcb0 ("partially revert "xen: Remove event channel notification through Xen PCI platform device"")) are unnecessary and, in fact, prevent HVM guests from booting on Xen releases prior to 4.0 Therefore we revert both of those commits. The summary of that discussion is below: Here is the brief summary of the current situation: Before the offending commit (72a9b186292): 1) INTx does not work because of the reset_watches path. 2) The reset_watches path is only taken if you have Xen > 4.0 3) The Linux Kernel by default will use vector inject if the hypervisor support. So even INTx does not work no body running the kernel with Xen > 4.0 would notice. Unless he explicitly disabled this feature either in the kernel or in Xen (and this can only be disabled by modifying the code, not user-supported way to do it). After the offending commit (+ partial revert): 1) INTx is no longer support for HVM (only for PV guests). 2) Any HVM guest The kernel will not boot on Xen < 4.0 which does not have vector injection support. Since the only other mode supported is INTx which. So based on this summary, I think before commit (72a9b186292) we were in much better position from a user point of view. Signed-off-by: Boris Ostrovsky Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross arch/x86/include/asm/xen/events.h | 11 +++++++++++ arch/x86/pci/xen.c | 2 +- arch/x86/xen/enlighten_hvm.c | 12 ++++++++---- arch/x86/xen/smp_hvm.c | 5 +++++ arch/x86/xen/time.c | 8 ++++++++ drivers/xen/events/events_base.c | 25 +++++++++++++++++-------- drivers/xen/platform-pci.c | 14 ++++---------- 7 files changed, 54 insertions(+), 23 deletions(-) commit 5f6a1614fab801834e32b420b60acdc27acfcdec Author: Boris Ostrovsky Date: Fri Apr 21 11:13:14 2017 -0400 xen/pvh: Do not fill kernel's e820 map in init_pvh_bootparams() e820 map is updated with information from the zeropage (i.e. pvh_bootparams) by default_machine_specific_memory_setup(). With the way things are done now, we end up with a duplicated e820 map. Signed-off-by: Boris Ostrovsky Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross arch/x86/xen/enlighten_pvh.c | 20 ++++++-------------- 1 file changed, 6 insertions(+), 14 deletions(-) commit 6483e3135a693548874429db901c0544d3a9b4cd Author: Geliang Tang Date: Sat Apr 22 09:21:13 2017 +0800 xen/scsifront: use offset_in_page() macro Use offset_in_page() macro instead of open-coding. Signed-off-by: Geliang Tang Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross drivers/scsi/xen-scsifront.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d5ff5061c35448525fcb38950f06af6b9ae12c04 Author: Stefano Stabellini Date: Thu Apr 13 14:04:22 2017 -0700 xen/arm,arm64: rename __generic_dma_ops to xen_get_dma_ops Now that __generic_dma_ops is a xen specific function, rename it to xen_get_dma_ops. Change all the call sites appropriately. Signed-off-by: Stefano Stabellini Reviewed-by: Boris Ostrovsky Acked-by: Konrad Rzeszutek Wilk CC: linux@armlinux.org.uk CC: catalin.marinas@arm.com CC: will.deacon@arm.com CC: boris.ostrovsky@oracle.com CC: jgross@suse.com CC: Julien Grall drivers/xen/swiotlb-xen.c | 8 ++++---- include/xen/arm/page-coherent.h | 20 ++++++++++---------- 2 files changed, 14 insertions(+), 14 deletions(-) commit e058632670b709145730a134acc3f83f392f7aa7 Author: Stefano Stabellini Date: Thu Apr 13 14:04:21 2017 -0700 xen/arm,arm64: fix xen_dma_ops after 815dd18 "Consolidate get_dma_ops..." The following commit: commit 815dd18788fe0d41899f51b91d0560279cf16b0d Author: Bart Van Assche Date: Fri Jan 20 13:04:04 2017 -0800 treewide: Consolidate get_dma_ops() implementations rearranges get_dma_ops in a way that xen_dma_ops are not returned when running on Xen anymore, dev->dma_ops is returned instead (see arch/arm/include/asm/dma-mapping.h:get_arch_dma_ops and include/linux/dma-mapping.h:get_dma_ops). Fix the problem by storing dev->dma_ops in dev_archdata, and setting dev->dma_ops to xen_dma_ops. This way, xen_dma_ops is returned naturally by get_dma_ops. The Xen code can retrieve the original dev->dma_ops from dev_archdata when needed. It also allows us to remove __generic_dma_ops from common headers. Signed-off-by: Stefano Stabellini Tested-by: Julien Grall Suggested-by: Catalin Marinas Reviewed-by: Catalin Marinas Cc: [4.11+] CC: linux@armlinux.org.uk CC: catalin.marinas@arm.com CC: will.deacon@arm.com CC: boris.ostrovsky@oracle.com CC: jgross@suse.com CC: Julien Grall arch/arm/include/asm/device.h | 3 +++ arch/arm/include/asm/dma-mapping.h | 12 +----------- arch/arm/mm/dma-mapping.c | 7 +++++++ arch/arm64/include/asm/device.h | 3 +++ arch/arm64/include/asm/dma-mapping.h | 13 +------------ arch/arm64/mm/dma-mapping.c | 7 +++++++ include/xen/arm/page-coherent.h | 8 ++++++++ 7 files changed, 30 insertions(+), 23 deletions(-) commit 4a806016223c6df131280c82f1ed69c820b6a9ff Author: Arnd Bergmann Date: Wed Apr 19 19:06:39 2017 +0200 xen/9pfs: select CONFIG_XEN_XENBUS_FRONTEND All Xen frontends need to select this symbol to avoid a link error: net/built-in.o: In function `p9_trans_xen_init': :(.text+0x149e9c): undefined reference to `__xenbus_register_frontend' Fixes: d4b40a02f837 ("xen/9pfs: build 9pfs Xen transport driver") Signed-off-by: Arnd Bergmann Reviewed-by: Stefano Stabellini net/9p/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 65f9d65443b5512f74248a3eb56731fbb0b337b8 Author: Juergen Gross Date: Thu Apr 13 09:42:03 2017 +0200 x86/cpu: remove hypervisor specific set_cpu_features There is no user of x86_hyper->set_cpu_features() any more. Remove it. Cc: Thomas Gleixner Cc: Ingo Molnar Cc: "H. Peter Anvin" Cc: x86@kernel.org Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross arch/x86/include/asm/hypervisor.h | 5 ----- arch/x86/kernel/cpu/common.c | 1 - arch/x86/kernel/cpu/hypervisor.c | 8 -------- 3 files changed, 14 deletions(-) commit d40342a2ac035444897e5952ea72a50440a2a028 Author: Juergen Gross Date: Thu Apr 13 09:37:20 2017 +0200 vmware: set cpu capabilities during platform initialization There is no need to set the same capabilities for each cpu individually. This can be done for all cpus in platform initialization. Cc: Alok Kataria Cc: Thomas Gleixner Cc: Ingo Molnar Cc: "H. Peter Anvin" Cc: x86@kernel.org Cc: virtualization@lists.linux-foundation.org Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Acked-by: Alok Kataria Signed-off-by: Juergen Gross arch/x86/kernel/cpu/vmware.c | 39 ++++++++++++++++++++------------------- 1 file changed, 20 insertions(+), 19 deletions(-) commit 6807cf65f5ba6f2902ab64355d71506b9c14a9dd Author: Juergen Gross Date: Wed Apr 12 15:12:09 2017 +0200 x86/xen: use capabilities instead of fake cpuid values for xsave When running as pv domain xen_cpuid() is being used instead of native_cpuid(). In xen_cpuid() the xsave feature availability is indicated by special casing the related cpuid leaf. Instead of delivering fake cpuid values set or clear the cpu capability bits for xsave instead. Signed-off-by: Juergen Gross Reviewed-by: Andrew Cooper Signed-off-by: Juergen Gross arch/x86/xen/enlighten_pv.c | 53 +++++++++++++++++++++++++-------------------- 1 file changed, 30 insertions(+), 23 deletions(-) commit e657fccb799b970bd1f152e22e13f20e0de7adb5 Author: Juergen Gross Date: Wed Apr 12 12:45:57 2017 +0200 x86/xen: use capabilities instead of fake cpuid values for x2apic When running as pv domain xen_cpuid() is being used instead of native_cpuid(). In xen_cpuid() the x2apic feature is indicated as not being present by special casing the related cpuid leaf. Instead of delivering fake cpuid values clear the cpu capability bit for x2apic instead. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross arch/x86/xen/enlighten_pv.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit ea01598b4bc453ed513e9d482a43c14557042ec9 Author: Juergen Gross Date: Wed Apr 12 12:37:00 2017 +0200 x86/xen: use capabilities instead of fake cpuid values for mwait When running as pv domain xen_cpuid() is being used instead of native_cpuid(). In xen_cpuid() the mwait feature is indicated to be present or not by special casing the related cpuid leaf. Instead of delivering fake cpuid values use the cpu capability bit for mwait instead. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross arch/x86/xen/enlighten_pv.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) commit b778d6bf63e0a07ceb2258ce9bd996dbaaa11bfa Author: Juergen Gross Date: Wed Apr 12 09:27:47 2017 +0200 x86/xen: use capabilities instead of fake cpuid values for acpi When running as pv domain xen_cpuid() is being used instead of native_cpuid(). In xen_cpuid() the acpi feature is indicated as not being present by special casing the related cpuid leaf in case we are not the initial domain. Instead of delivering fake cpuid values clear the cpu capability bit for acpi instead. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross arch/x86/xen/enlighten_pv.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) commit aa1071562937d1b66b07db48e3dbafe136027f01 Author: Juergen Gross Date: Wed Apr 12 09:24:01 2017 +0200 x86/xen: use capabilities instead of fake cpuid values for acc When running as pv domain xen_cpuid() is being used instead of native_cpuid(). In xen_cpuid() the acc feature (thermal monitoring) is indicated as not being present by special casing the related cpuid leaf. Instead of delivering fake cpuid values clear the cpu capability bit for acc instead. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross arch/x86/xen/enlighten_pv.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 88f3256f21d958d0773bf93523ad12d2ddaf3006 Author: Juergen Gross Date: Wed Apr 12 09:21:05 2017 +0200 x86/xen: use capabilities instead of fake cpuid values for mtrr When running as pv domain xen_cpuid() is being used instead of native_cpuid(). In xen_cpuid() the mtrr feature is indicated as not being present by special casing the related cpuid leaf. Instead of delivering fake cpuid values clear the cpu capability bit for mtrr instead. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross arch/x86/xen/enlighten_pv.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit fd9145fd270c7d152853219b8b44210026fa3c02 Author: Juergen Gross Date: Wed Apr 12 08:27:07 2017 +0200 x86/xen: use capabilities instead of fake cpuid values for aperf When running as pv domain xen_cpuid() is being used instead of native_cpuid(). In xen_cpuid() the aperf/mperf feature is indicated as not being present by special casing the related cpuid leaf. Instead of delivering fake cpuid values clear the cpu capability bit for aperf/mperf instead. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross arch/x86/xen/enlighten_pv.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) commit 3ee99df333a0ac57c3bd8155dfa56fc275668f88 Author: Juergen Gross Date: Wed Apr 12 08:20:29 2017 +0200 x86/xen: don't indicate DCA support in pv domains Xen doesn't support DCA (direct cache access) for pv domains. Clear the corresponding capability indicator. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross arch/x86/xen/enlighten_pv.c | 1 + 1 file changed, 1 insertion(+) commit 0808e80cb760de2733c0527d2090ed2205a1eef8 Author: Juergen Gross Date: Thu Apr 13 08:55:41 2017 +0200 xen: set cpu capabilities from xen_start_kernel() There is no need to set the same capabilities for each cpu individually. This can easily be done for all cpus when starting the kernel. Signed-off-by: Juergen Gross Reviewed-by: Boris Ostrovsky Signed-off-by: Juergen Gross arch/x86/xen/enlighten_pv.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit 31d47266c6e599d76e84c9809f9ea2735d9cda5b Author: Stefano Stabellini Date: Thu Apr 13 10:57:56 2017 -0700 xen/9pfs: initialize len to 0 to detect xenbus_read errors In order to use "len" to check for xenbus_read errors properly, we need to initialize len to 0 before passing it to xenbus_read. CC: dan.carpenter@oracle.com CC: jgross@suse.com CC: boris.ostrovsky@oracle.com CC: Eric Van Hensbergen CC: Ron Minnich CC: Latchesar Ionkov CC: v9fs-developer@lists.sourceforge.net Signed-off-by: Stefano Stabellini Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross net/9p/trans_xen.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 29985b09613ba106a1ed0496988636d288600515 Author: Juergen Gross Date: Tue Apr 11 18:14:26 2017 +0200 xen,kdump: handle pv domain in paddr_vmcoreinfo_note() For kdump to work correctly it needs the physical address of vmcoreinfo_note. When running as dom0 this means the virtual address has to be translated to the related machine address. paddr_vmcoreinfo_note() is meant to do the translation via __pa_symbol() only, but being attributed "weak" it can be replaced easily in Xen case. Signed-off-by: Juergen Gross Tested-by: Petr Tesarik Reviewed-by: Boris Ostrovsky Reviewed-by: Daniel Kiper Signed-off-by: Juergen Gross arch/x86/xen/mmu_pv.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit 8945c08e2b148be926b5f1aa653b2021a127e905 Author: Oleksandr Andrushchenko Date: Mon Apr 10 09:25:29 2017 +0300 xen/displif: add ABI for para-virtual display This is the ABI for the two halves of a para-virtualized display driver. This protocol aims to provide a unified protocol which fits more sophisticated use-cases than a framebuffer device can handle. At the moment basic functionality is supported with the intention to extend: o multiple dynamically allocated/destroyed framebuffers o buffers of arbitrary sizes o better configuration options including multiple display support Note: existing fbif can be used together with displif running at the same time, e.g. on Linux one provides framebuffer and another DRM/KMS Future extensions to the existing protocol may include: o allow display/connector cloning o allow allocating objects other than display buffers o add planes/overlays support o support scaling o support rotation Note, that this protocol doesn't use ring macros for bi-directional exchange (PV calls/9pfs) bacause: o it statically defines the use of a single page for the ring buffer o it uses direct memory access to ring's contents w/o memory copying o re-uses the same idea that kbdif/fbif use which for this use-case seems to be appropriate ================================================== Rationale for introducing this protocol instead of using the existing fbif: ================================================== 1. In/out event sizes o fbif - 40 octets o displif - 40 octets This is only the initial version of the displif protocol which means that there could be requests which will not fit (WRT introducing some GPU related functionality later on). In that case we cannot alter fbif sizes as we need to be backward compatible an will be forced to handle those apart of fbif. 2. Shared page Displif doesn't use anything like struct xenfb_page, but DEFINE_RING_TYPES(xen_displif, struct xendispl_req, struct xendispl_resp) which is a better and more common way. Output events use a shared page which only has in_cons and in_prod and all the rest is used for incoming events. Here struct xenfb_page could probably be used as is despite the fact that it only has a half of a page for incoming events which is only 50 events. (consider something like 60Hz display) 3. Amount of changes. fbif only provides XENFB_TYPE_UPDATE and XENFB_TYPE_RESIZE events, so it looks like it is easier to get fb support into displif than vice versa. displif at the moment has 6 requests and 1 event, multiple connector support, etc. Signed-off-by: Oleksandr Grytsov Signed-off-by: Oleksandr Andrushchenko Acked-by: Juergen Gross Signed-off-by: Juergen Gross include/xen/interface/io/displif.h | 854 +++++++++++++++++++++++++++++++++++++ 1 file changed, 854 insertions(+) commit 2843531fb6ca74a960d6dd2b7fda0717f60bf2e9 Author: Oleksandr Andrushchenko Date: Mon Apr 10 09:25:28 2017 +0300 xen/sndif: add sound-device ABI Add ABI for the two halves of a para-virtualized sound driver to communicate with each other. The ABI allows implementing audio playback and capture as well as volume control and possibility to mute/unmute audio sources. Note: depending on the use-case backend can expose more sound cards and PCM devices/streams than the underlying HW physically has by employing SW mixers, configuring virtual sound streams, channels etc. Thus, allowing fine tunned configurations per frontend. Signed-off-by: Oleksandr Andrushchenko Signed-off-by: Oleksandr Grytsov Signed-off-by: Oleksandr Dmytryshyn Signed-off-by: Iurii Konovalenko Acked-by: Juergen Gross Signed-off-by: Juergen Gross include/xen/interface/io/sndif.h | 793 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 793 insertions(+) commit f9ebfc22cc15c06ba61563c885f40a4bc07cccea Author: Oleksandr Andrushchenko Date: Mon Apr 10 09:25:27 2017 +0300 xen/kbdif: add multi-touch support Multi-touch fields re-use the page that is used by the other features which means that you can interleave multi-touch, motion, and key events. Signed-off-by: Oleksandr Andrushchenko Acked-by: Juergen Gross Signed-off-by: Juergen Gross include/xen/interface/io/kbdif.h | 210 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 210 insertions(+) commit 8ec9dd0e69cfaab05649ed7ab3838eb4eea96081 Author: Oleksandr Andrushchenko Date: Mon Apr 10 09:25:26 2017 +0300 xen/kbdif: update protocol description The patch clarifies the protocol that is used by the PV keyboard drivers. Signed-off-by: Oleksandr Andrushchenko Acked-by: Juergen Gross Signed-off-by: Juergen Gross include/xen/interface/io/kbdif.h | 248 ++++++++++++++++++++++++++++++++++----- 1 file changed, 221 insertions(+), 27 deletions(-) commit 7f25483a88291ed6b2cbe761ee2a30a69674b131 Author: Stefano Stabellini Date: Wed Apr 5 12:04:01 2017 -0700 xen/9pfs: build 9pfs Xen transport driver This patch adds a Kconfig option and Makefile support for building the 9pfs Xen driver. CC: groug@kaod.org CC: boris.ostrovsky@oracle.com CC: jgross@suse.com CC: Eric Van Hensbergen CC: Ron Minnich CC: Latchesar Ionkov CC: v9fs-developer@lists.sourceforge.net Signed-off-by: Stefano Stabellini Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross net/9p/Kconfig | 8 ++++++++ net/9p/Makefile | 4 ++++ 2 files changed, 12 insertions(+) commit f66c72bea1293786b9916894019f96bcd729505b Author: Stefano Stabellini Date: Wed Apr 5 12:04:00 2017 -0700 xen/9pfs: receive responses Upon receiving a notification from the backend, schedule the p9_xen_response work_struct. p9_xen_response checks if any responses are available, if so, it reads them one by one, calling p9_client_cb to send them up to the 9p layer (p9_client_cb completes the request). Handle the ring following the Xen 9pfs specification. CC: groug@kaod.org CC: jgross@suse.com CC: Eric Van Hensbergen CC: Ron Minnich CC: Latchesar Ionkov CC: v9fs-developer@lists.sourceforge.net Signed-off-by: Stefano Stabellini Reviewed-by: Boris Ostrovsky Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross net/9p/trans_xen.c | 56 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) commit f023f18ddf41dda487241d1514075b1136eb8101 Author: Stefano Stabellini Date: Wed Apr 5 12:03:59 2017 -0700 xen/9pfs: send requests to the backend Implement struct p9_trans_module create and close functions by looking at the available Xen 9pfs frontend-backend connections. We don't expect many frontend-backend connections, thus walking a list is OK. Send requests to the backend by copying each request to one of the available rings (each frontend-backend connection comes with multiple rings). Handle the ring and notifications following the 9pfs specification. If there are not enough free bytes on the ring for the request, wait on the wait_queue: the backend will send a notification after consuming more requests. CC: groug@kaod.org CC: jgross@suse.com CC: Eric Van Hensbergen CC: Ron Minnich CC: Latchesar Ionkov CC: v9fs-developer@lists.sourceforge.net Signed-off-by: Stefano Stabellini Reviewed-by: Boris Ostrovsky Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross net/9p/trans_xen.c | 87 ++++++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 85 insertions(+), 2 deletions(-) commit 71ebd71921e451f0f942ddfe85d01e31ddc6eb88 Author: Stefano Stabellini Date: Wed Apr 5 12:03:58 2017 -0700 xen/9pfs: connect to the backend Implement functions to handle the xenbus handshake. Upon connection, allocate the rings according to the protocol specification. Initialize a work_struct and a wait_queue. The work_struct will be used to schedule work upon receiving an event channel notification from the backend. The wait_queue will be used to wait when the ring is full and we need to send a new request. CC: groug@kaod.org CC: boris.ostrovsky@oracle.com CC: jgross@suse.com CC: Eric Van Hensbergen CC: Ron Minnich CC: Latchesar Ionkov CC: v9fs-developer@lists.sourceforge.net Signed-off-by: Stefano Stabellini Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross net/9p/trans_xen.c | 281 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 281 insertions(+) commit 868eb122739a588f2cd873308b9ff1f00849b8fd Author: Stefano Stabellini Date: Wed Apr 5 12:03:57 2017 -0700 xen/9pfs: introduce Xen 9pfs transport driver Introduce the Xen 9pfs transport driver: add struct xenbus_driver to register as a xenbus driver and add struct p9_trans_module to register as v9fs driver. All functions are empty stubs for now. CC: groug@kaod.org CC: jgross@suse.com CC: Eric Van Hensbergen CC: Ron Minnich CC: Latchesar Ionkov CC: v9fs-developer@lists.sourceforge.net Signed-off-by: Stefano Stabellini Reviewed-by: Boris Ostrovsky Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross net/9p/trans_xen.c | 125 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 125 insertions(+) commit 04c40dfc8d7965e722b6e99352e2bfc2f5637359 Author: Stefano Stabellini Date: Wed Apr 5 12:03:56 2017 -0700 xen: introduce the header file for the Xen 9pfs transport protocol It uses the new ring.h macros to declare rings and interfaces. CC: konrad.wilk@oracle.com CC: boris.ostrovsky@oracle.com CC: jgross@suse.com CC: groug@kaod.org Signed-off-by: Stefano Stabellini Acked-by: Juergen Gross Signed-off-by: Juergen Gross include/xen/interface/io/9pfs.h | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) commit 564f7dfde24a405d877168f150ae5d29d3ad99c7 Author: Stefano Stabellini Date: Wed Apr 5 12:03:55 2017 -0700 xen: import new ring macros in ring.h Sync the ring.h file with upstream Xen, to introduce the new ring macros. They will be used by the Xen transport for 9pfs. CC: konrad.wilk@oracle.com CC: boris.ostrovsky@oracle.com CC: jgross@suse.com CC: groug@kaod.org Signed-off-by: Stefano Stabellini Acked-by: Juergen Gross Signed-off-by: Juergen Gross include/xen/interface/io/ring.h | 143 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 143 insertions(+) commit ab1570a427551be2d3eeb30b09834ba01c6109eb Author: Juergen Gross Date: Tue Mar 28 11:02:08 2017 +0200 x86/xen: remove unused static function from smp_pv.c xen_call_function_interrupt() isn't used in smp_pv.c. Remove it. Signed-off-by: Juergen Gross arch/x86/xen/smp_pv.c | 10 ---------- 1 file changed, 10 deletions(-) commit 8cb6de390096b2ff337cbcf30c9484dd8cf83029 Author: Vitaly Kuznetsov Date: Tue Mar 14 18:35:56 2017 +0100 x86/xen: rename some PV-only functions in smp_pv.c After code split between PV and HVM some functions in xen_smp_ops have xen_pv_ prefix and some only xen_ which makes them look like they're common for both PV and HVM while they're not. Rename all the rest to have xen_pv_ prefix. Signed-off-by: Vitaly Kuznetsov Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross arch/x86/xen/smp_pv.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) commit 33af746985699001c1122c2d5e9dbece28f18272 Author: Vitaly Kuznetsov Date: Tue Mar 14 18:35:55 2017 +0100 x86/xen: enable PVHVM-only builds Now everything is in place and we can move PV-only code under CONFIG_XEN_PV. CONFIG_XEN_PV_SMP is created to support the change. Signed-off-by: Vitaly Kuznetsov Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross arch/x86/xen/Kconfig | 4 ++++ arch/x86/xen/Makefile | 9 +++++---- 2 files changed, 9 insertions(+), 4 deletions(-) commit 16624390816c4c40df3d777b34665d3fd01e693d Author: Vitaly Kuznetsov Date: Tue Mar 14 18:35:54 2017 +0100 xen: create xen_create/destroy_contiguous_region() stubs for PVHVM only builds xen_create_contiguous_region()/xen_create_contiguous_region() are PV-only, they both contain xen_feature(XENFEAT_auto_translated_physmap) check and bail in the very beginning. Signed-off-by: Vitaly Kuznetsov Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross include/xen/xen-ops.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+) commit 4fee9ad84e9648a3cb07586501d283d3aef9f923 Author: Vitaly Kuznetsov Date: Tue Mar 14 18:35:53 2017 +0100 xen/balloon: decorate PV-only parts with #ifdef CONFIG_XEN_PV Balloon driver uses several PV-only concepts (xen_start_info, xen_extra_mem,..) and it seems the simpliest solution to make HVM-only build happy is to decorate these parts with #ifdefs. Signed-off-by: Vitaly Kuznetsov Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross drivers/xen/balloon.c | 30 ++++++++++++++++++++---------- 1 file changed, 20 insertions(+), 10 deletions(-) commit 3d4ebdb26f6f3573d68d7957f66a89e9401fc4b1 Author: Vitaly Kuznetsov Date: Tue Mar 14 18:35:52 2017 +0100 x86/xen: create stubs for HVM-only builds in page.h __pfn_to_mfn() is only used from PV code (mmu_pv.c, p2m.c) and from page.h where all functions calling it check for xen_feature(XENFEAT_auto_translated_physmap) first so we can replace it with any stub to make build happy. set_foreign_p2m_mapping()/clear_foreign_p2m_mapping() are used from grant-table.c but only if !xen_feature(XENFEAT_auto_translated_physmap). Signed-off-by: Vitaly Kuznetsov Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross arch/x86/include/asm/xen/page.h | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) commit c504b2f1061972e1e9f2a3fcbbb1d6fbcce5ed26 Author: Vitaly Kuznetsov Date: Tue Mar 14 18:35:51 2017 +0100 x86/xen: define startup_xen for XEN PV only startup_xen references PV-only code, decorate it with #ifdef CONFIG_XEN_PV to make PV-free builds possible. Signed-off-by: Vitaly Kuznetsov Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross arch/x86/xen/xen-head.S | 4 ++++ 1 file changed, 4 insertions(+) commit 50a1062d61a62421f3181ce3e594a330f8a15cff Author: Vitaly Kuznetsov Date: Tue Mar 14 18:35:50 2017 +0100 x86/xen: put setup.c, pmu.c and apic.c under CONFIG_XEN_PV xen_pmu_init/finish() functions are used in suspend.c and enlighten.c, add stubs for now. Signed-off-by: Vitaly Kuznetsov Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross arch/x86/xen/Kconfig | 2 +- arch/x86/xen/Makefile | 6 +++--- arch/x86/xen/pmu.h | 5 +++++ 3 files changed, 9 insertions(+), 4 deletions(-) commit 9963236d7c753cf89be2e0366af185e51f150c79 Author: Vitaly Kuznetsov Date: Tue Mar 14 18:35:49 2017 +0100 x86/xen: split suspend.c for PV and PVHVM guests Slit the code in suspend.c into suspend_pv.c and suspend_hvm.c. Signed-off-by: Vitaly Kuznetsov Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross arch/x86/xen/Makefile | 3 ++- arch/x86/xen/suspend.c | 54 ---------------------------------------------- arch/x86/xen/suspend_hvm.c | 22 +++++++++++++++++++ arch/x86/xen/suspend_pv.c | 46 +++++++++++++++++++++++++++++++++++++++ arch/x86/xen/xen-ops.h | 13 +++++++++++ 5 files changed, 83 insertions(+), 55 deletions(-) commit 7e0563dea9c4e62297846359186c597e7231912d Author: Vitaly Kuznetsov Date: Tue Apr 4 14:48:17 2017 +0200 x86/xen: split off mmu_pv.c Basically, mmu.c is renamed to mmu_pv.c and some code moved out to common mmu.c. Signed-off-by: Vitaly Kuznetsov Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross arch/x86/xen/Makefile | 4 +- arch/x86/xen/mmu.c | 2784 +------------------------------------------------ arch/x86/xen/mmu_pv.c | 2717 +++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 2756 insertions(+), 2749 deletions(-) commit feef87ebfde295ff29a8a57ce47c933db7e79b05 Author: Vitaly Kuznetsov Date: Tue Mar 14 18:35:47 2017 +0100 x86/xen: split off mmu_hvm.c Move PVHVM related code to mmu_hvm.c. Signed-off-by: Vitaly Kuznetsov Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross arch/x86/xen/Makefile | 2 +- arch/x86/xen/mmu.c | 74 ---------------------------------------------- arch/x86/xen/mmu_hvm.c | 79 ++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 80 insertions(+), 75 deletions(-) commit 83b96794e0ea97ca7e05b15e31d31dac71d3fc2a Author: Vitaly Kuznetsov Date: Tue Mar 14 18:35:46 2017 +0100 x86/xen: split off smp_pv.c Basically, smp.c is renamed to smp_pv.c and some code moved out to common smp.c. struct xen_common_irq delcaration ended up in smp.h. Signed-off-by: Vitaly Kuznetsov Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross arch/x86/xen/Makefile | 2 +- arch/x86/xen/smp.c | 488 +----------------------------------------------- arch/x86/xen/smp.h | 5 + arch/x86/xen/smp_pv.c | 500 ++++++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 509 insertions(+), 486 deletions(-) commit a52482d9355e25ab7bb3cb190ffe26364db09b3e Author: Vitaly Kuznetsov Date: Tue Mar 14 18:35:45 2017 +0100 x86/xen: split off smp_hvm.c Move PVHVM related code to smp_hvm.c. Drop 'static' qualifier from xen_smp_send_reschedule(), xen_smp_send_call_function_ipi(), xen_smp_send_call_function_single_ipi(), these functions will be moved to common smp code when smp_pv.c is split. Signed-off-by: Vitaly Kuznetsov Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross arch/x86/xen/Kconfig | 4 ++++ arch/x86/xen/Makefile | 1 + arch/x86/xen/smp.c | 57 +++---------------------------------------------- arch/x86/xen/smp.h | 3 +++ arch/x86/xen/smp_hvm.c | 58 ++++++++++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 69 insertions(+), 54 deletions(-) commit aa1c84e8ca7f6f881514b109b9a2468db148045c Author: Vitaly Kuznetsov Date: Tue Mar 14 18:35:44 2017 +0100 x86/xen: split xen_cpu_die() Split xen_cpu_die() into xen_pv_cpu_die() and xen_hvm_cpu_die() to support further splitting of smp.c. Signed-off-by: Vitaly Kuznetsov Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross arch/x86/xen/smp.c | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) commit a2d1078a35f9a38ae888aa6147e4ca32666154a1 Author: Vitaly Kuznetsov Date: Tue Mar 14 18:35:43 2017 +0100 x86/xen: split xen_smp_prepare_boot_cpu() Split xen_smp_prepare_boot_cpu() into xen_pv_smp_prepare_boot_cpu() and xen_hvm_smp_prepare_boot_cpu() to support further splitting of smp.c. Signed-off-by: Vitaly Kuznetsov Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross arch/x86/xen/smp.c | 49 ++++++++++++++++++++++++++++++------------------- 1 file changed, 30 insertions(+), 19 deletions(-) commit 04e95761faae743f50a04aab47b9dc457c82063f Author: Vitaly Kuznetsov Date: Tue Mar 14 18:35:42 2017 +0100 x86/xen: split xen_smp_intr_init()/xen_smp_intr_free() xen_smp_intr_init() and xen_smp_intr_free() have PV-specific code and as a praparatory change to splitting smp.c we need to split these fucntions. Create xen_smp_intr_init_pv()/xen_smp_intr_free_pv(). Signed-off-by: Vitaly Kuznetsov Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross arch/x86/xen/enlighten_pv.c | 9 +++++++++ arch/x86/xen/smp.c | 29 ++++++++++++++++++----------- arch/x86/xen/smp.h | 8 ++++++++ 3 files changed, 35 insertions(+), 11 deletions(-) commit e1dab14cf68d1e03950135969af3faf322f0db04 Author: Vitaly Kuznetsov Date: Tue Mar 14 18:35:41 2017 +0100 x86/xen: split off enlighten_pv.c Basically, enlighten.c is renamed to enlighten_pv.c and some code moved out to common enlighten.c. Signed-off-by: Vitaly Kuznetsov Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross arch/x86/xen/Makefile | 4 +- arch/x86/xen/enlighten.c | 1646 ++----------------------------------------- arch/x86/xen/enlighten_pv.c | 1512 +++++++++++++++++++++++++++++++++++++++ 3 files changed, 1586 insertions(+), 1576 deletions(-) commit 98f2a47a002139ce677d3062d334af8b6e36e25c Author: Vitaly Kuznetsov Date: Tue Mar 14 18:35:40 2017 +0100 x86/xen: split off enlighten_hvm.c Move PVHVM related code to enlighten_hvm.c. Three functions: xen_cpuhp_setup(), xen_reboot(), xen_emergency_restart() are shared, drop static qualifier from them. These functions will go to common code once it is split from enlighten.c. Signed-off-by: Vitaly Kuznetsov Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross arch/x86/xen/Makefile | 1 + arch/x86/xen/enlighten.c | 212 +----------------------------------------- arch/x86/xen/enlighten_hvm.c | 213 +++++++++++++++++++++++++++++++++++++++++++ arch/x86/xen/xen-ops.h | 8 ++ 4 files changed, 227 insertions(+), 207 deletions(-) commit 4d6ca227c768b50b05cf183974b40abe444e9d0c Merge: 800f3eef af22a61 Author: Jiri Kosina Date: Tue May 2 11:02:41 2017 +0200 Merge branch 'for-4.12/asus' into for-linus commit 800f3eef8ebc1264e9c135bfa892c8ae41fa4792 Merge: 18fc216 040fc00 Author: Jiri Kosina Date: Tue May 2 11:02:24 2017 +0200 Merge branch 'for-4.12/sony' into for-linus commit 18fc2163b8a410d4d36b8f44658580731c0afaa1 Merge: d529a4a c846fe9 ac34b97 c3883fe 733aca9 d3d9adf 9547837 a4bf6153 e9d0a26 07e88a3 959d973 149f6f6 Author: Jiri Kosina Date: Tue May 2 11:01:10 2017 +0200 Merge branches 'for-4.11/upstream-fixes', 'for-4.12/accutouch', 'for-4.12/cp2112', 'for-4.12/hid-core-null-state-handling', 'for-4.12/hiddev', 'for-4.12/i2c-hid', 'for-4.12/innomedia', 'for-4.12/logitech-hidpp-battery-power-supply', 'for-4.12/multitouch', 'for-4.12/nti', 'for-4.12/upstream' and 'for-4.12/wacom' into for-linus commit 481d66325dfc2a6b4f5e729b64ad144383b63fad Author: Vitaly Kuznetsov Date: Tue Mar 14 18:35:39 2017 +0100 x86/xen: split off enlighten_pvh.c Create enlighten_pvh.c by splitting off PVH related code from enlighten.c, put it under CONFIG_XEN_PVH. Signed-off-by: Vitaly Kuznetsov Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross arch/x86/xen/Makefile | 2 + arch/x86/xen/enlighten.c | 108 ---------------------------------------- arch/x86/xen/enlighten_pvh.c | 114 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 116 insertions(+), 108 deletions(-) commit 5e57f1d607d1cc0f54611162525ca6436e17e8b7 Author: Vitaly Kuznetsov Date: Tue Mar 14 18:35:38 2017 +0100 x86/xen: add CONFIG_XEN_PV to Kconfig All code to support Xen PV will get under this new option. For the beginning, check for it in the common code. Signed-off-by: Vitaly Kuznetsov Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross arch/x86/kernel/cpu/hypervisor.c | 4 +++- arch/x86/kernel/process_64.c | 2 +- arch/x86/xen/Kconfig | 23 ++++++++++++++++++----- 3 files changed, 22 insertions(+), 7 deletions(-) commit 52519f2af020b6b53b4e0cbb8cff71058ed434cd Author: Vitaly Kuznetsov Date: Tue Mar 14 18:35:37 2017 +0100 x86/xen: globalize have_vcpu_info_placement have_vcpu_info_placement applies to both PV and HVM and as we're going to split the code we need to make it global. Rename to xen_have_vcpu_info_placement. Signed-off-by: Vitaly Kuznetsov Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross arch/x86/xen/enlighten.c | 12 ++++++------ arch/x86/xen/xen-ops.h | 2 ++ 2 files changed, 8 insertions(+), 6 deletions(-) commit 0991d22d5e7fad3ea4f504a1eb0ccb4707135f64 Author: Vitaly Kuznetsov Date: Tue Mar 14 18:35:36 2017 +0100 x86/xen: separate PV and HVM hypervisors As a preparation to splitting the code we need to untangle it: x86_hyper_xen -> x86_hyper_xen_hvm and x86_hyper_xen_pv xen_platform() -> xen_platform_hvm() and xen_platform_pv() xen_cpu_up_prepare() -> xen_cpu_up_prepare_pv() and xen_cpu_up_prepare_hvm() xen_cpu_dead() -> xen_cpu_dead_pv() and xen_cpu_dead_pv_hvm() Add two parameters to xen_cpuhp_setup() to pass proper cpu_up_prepare and cpu_dead hooks. xen_set_cpu_features() is now PV-only so the redundant xen_pv_domain() check can be dropped. Signed-off-by: Vitaly Kuznetsov Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross arch/x86/include/asm/hypervisor.h | 3 +- arch/x86/kernel/cpu/hypervisor.c | 3 +- arch/x86/xen/enlighten.c | 114 +++++++++++++++++++++++++------------- 3 files changed, 79 insertions(+), 41 deletions(-) commit e345da82bd6bdfa8492f80b3ce4370acfd868d95 Author: Mario Kleiner Date: Fri Apr 21 17:05:08 2017 +0200 drm/edid: Add 10 bpc quirk for LGD 764 panel in HP zBook 17 G2 The builtin eDP panel in the HP zBook 17 G2 supports 10 bpc, as advertised by the Laptops product specs and verified via injecting a fixed edid + photometer measurements, but edid reports unknown depth, so drivers fall back to 6 bpc. Add a quirk to get the full 10 bpc. Cc: stable@vger.kernel.org Signed-off-by: Mario Kleiner Acked-by: Harry Wentland Signed-off-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/1492787108-23959-1-git-send-email-mario.kleiner.de@gmail.com drivers/gpu/drm/drm_edid.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit c667186f1c01ca8970c785888868b7ffd74e51ee Author: Marc Zyngier Date: Thu Apr 27 19:06:48 2017 +0100 arm64: KVM: Fix decoding of Rt/Rt2 when trapping AArch32 CP accesses Our 32bit CP14/15 handling inherited some of the ARMv7 code for handling the trapped system registers, completely missing the fact that the fields for Rt and Rt2 are now 5 bit wide, and not 4... Let's fix it, and provide an accessor for the most common Rt case. Cc: stable@vger.kernel.org Reviewed-by: Christoffer Dall Signed-off-by: Marc Zyngier Signed-off-by: Christoffer Dall arch/arm64/include/asm/kvm_emulate.h | 6 ++++++ arch/arm64/kvm/sys_regs.c | 8 ++++---- 2 files changed, 10 insertions(+), 4 deletions(-) commit d3b5d35290d729a2518af00feca867385a1b08fa Merge: aa2a4b65 7138970 Author: Linus Torvalds Date: Mon May 1 23:54:56 2017 -0700 Merge branch 'x86-mm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 mm updates from Ingo Molnar: "The main x86 MM changes in this cycle were: - continued native kernel PCID support preparation patches to the TLB flushing code (Andy Lutomirski) - various fixes related to 32-bit compat syscall returning address over 4Gb in applications, launched from 64-bit binaries - motivated by C/R frameworks such as Virtuozzo. (Dmitry Safonov) - continued Intel 5-level paging enablement: in particular the conversion of x86 GUP to the generic GUP code. (Kirill A. Shutemov) - x86/mpx ABI corner case fixes/enhancements (Joerg Roedel) - ... plus misc updates, fixes and cleanups" * 'x86-mm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (62 commits) mm, zone_device: Replace {get, put}_zone_device_page() with a single reference to fix pmem crash x86/mm: Fix flush_tlb_page() on Xen x86/mm: Make flush_tlb_mm_range() more predictable x86/mm: Remove flush_tlb() and flush_tlb_current_task() x86/vm86/32: Switch to flush_tlb_mm_range() in mark_screen_rdonly() x86/mm/64: Fix crash in remove_pagetable() Revert "x86/mm/gup: Switch GUP to the generic get_user_page_fast() implementation" x86/boot/e820: Remove a redundant self assignment x86/mm: Fix dump pagetables for 4 levels of page tables x86/mpx, selftests: Only check bounds-vs-shadow when we keep shadow x86/mpx: Correctly report do_mpx_bt_fault() failures to user-space Revert "x86/mm/numa: Remove numa_nodemask_from_meminfo()" x86/espfix: Add support for 5-level paging x86/kasan: Extend KASAN to support 5-level paging x86/mm: Add basic defines/helpers for CONFIG_X86_5LEVEL=y x86/paravirt: Add 5-level support to the paravirt code x86/mm: Define virtual memory map for 5-level paging x86/asm: Remove __VIRTUAL_MASK_SHIFT==47 assert x86/boot: Detect 5-level paging support x86/mm/numa: Remove numa_nodemask_from_meminfo() ... commit a5c3b32a1146e44f6b38fdfdfffc27842953420c Merge: d7dc450 20d5c84 Author: Takashi Iwai Date: Tue May 2 08:25:25 2017 +0200 Merge tag 'asoc-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Updates for v4.12 A quiet release for the core, but lots of new drivers this time around: - A new, generalized, API for hooking up jacks which makes it easier to write generic machine drivers for simple cases. - Continuing fixes for issues with the x86 CPU drivers. - New drivers for Cirrus CS35L35, DIO DIO2125, Everest ES7132, HiSilicon hi6210, Maxim MAX98927, MT2701 systems with WM8960, Nuvoton NAU8824, Odroid systems, ST STM32 SAI controllers and x86 systems with DA7213 commit d7dc450d5a7162de96edbed6b1792240c2f3a55f Merge: d4a2fbc 0997e37 Author: Takashi Iwai Date: Tue May 2 08:24:42 2017 +0200 Merge branch 'for-next' into for-linus For 4.12 merge. commit aa2a4b6569d5b10491b606a86e574dff3852597a Merge: d19458a 90b2043 Author: Linus Torvalds Date: Mon May 1 23:08:46 2017 -0700 Merge branch 'x86-vdso-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 vdso updates from Ingo Molnar: "Add support for vDSO acceleration of the "Hyper-V TSC page", to speed up clock reading on Hyper-V guests" * 'x86-vdso-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/vdso: Add VCLOCK_HVCLOCK vDSO clock read method x86/hyperv: Move TSC reading method to asm/mshyperv.h x86/hyperv: Implement hv_get_tsc_page() commit d19458a4ead14da70c4c852659ccb0234ecd769e Merge: 888411b d4d9699 Author: Linus Torvalds Date: Mon May 1 23:05:12 2017 -0700 Merge branch 'x86-platform-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 platform updates from Ingo Molnar: "Most of the commits are continued SGI UV4 hardware-enablement changes, plus there's also new Bluetooth support for the Intel Edison platform" * 'x86-platform-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/platform/intel-mid: Enable Bluetooth support on Intel Edison x86/platform/uv/BAU: Implement uv4_wait_completion with read_status x86/platform/uv/BAU: Add wait_completion to bau_operations x86/platform/uv/BAU: Add status mmr location fields to bau_control x86/platform/uv/BAU: Cleanup bau_operations declaration and instances x86/platform/uv/BAU: Add payload descriptor qualifier x86/platform/uv/BAU: Add uv_bau_version enumerated constants commit 888411be09739443271d254c9d8c1f5188c05509 Merge: 7d6a31c c0edbd4 Author: Linus Torvalds Date: Mon May 1 23:03:17 2017 -0700 Merge branch 'x86-irq-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 irq update from Ingo Molnar: "A single commit that micro-optimizes an IRQ vectors code path in the CPU offlining code" * 'x86-irq-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/irq: Optimize free vector check in the CPU offline path commit 7d6a31c394722c914c61292b457e1999c8bef5ea Merge: 2cc12e2 1b32627 Author: Linus Torvalds Date: Mon May 1 23:00:21 2017 -0700 Merge branch 'x86-debug-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 debug updates from Ingo Molnar: "The biggest update is the addition of USB3 debug port based early-console. Greg was fine with the USB changes and with the routing of these patches: https://www.spinics.net/lists/linux-usb/msg155093.html" * 'x86-debug-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: usb/doc: Add document for USB3 debug port usage usb/serial: Add DBC debug device support to usb_debug x86/earlyprintk: Add support for earlyprintk via USB3 debug port usb/early: Add driver for xhci debug capability x86/timers: Add simple udelay calibration commit b6df4b79a5514a9c6c53533436704129ef45bf76 Author: Xiubo Li Date: Tue May 2 11:38:06 2017 +0800 tcmu: Add global data block pool support For each target there will be one ring, when the target number grows larger and larger, it could eventually runs out of the system memories. In this patch for each target ring, currently for the cmd area the size will be fixed to 8MB and for the data area the size will grow from 0 to max 256K * PAGE_SIZE(1G for 4K page size). For all the targets' data areas, they will get empty blocks from the "global data block pool", which has limited to 512K * PAGE_SIZE(2G for 4K page size) for now. When the "global data block pool" has been used up, then any target could wake up the unmap thread routine to shrink other targets' data area memories. And the unmap thread routine will always try to truncate the ring vma from the last using block offset. When user space has touched the data blocks out of tcmu_cmd iov[], the tcmu_page_fault() will try to return one zeroed blocks. Here we move the timeout's tcmu_handle_completions() into unmap thread routine, that's to say when the timeout fired, it will only do the tcmu_check_expired_cmd() and then wake up the unmap thread to do the completions() and then try to shrink its idle memories. Then the cmdr_lock could be a mutex and could simplify this patch because the unmap_mapping_range() or zap_* may go to sleep. Signed-off-by: Xiubo Li Signed-off-by: Jianfei Hu Acked-by: Mike Christie Signed-off-by: Nicholas Bellinger drivers/target/target_core_user.c | 464 +++++++++++++++++++++++++++----------- 1 file changed, 336 insertions(+), 128 deletions(-) commit 141685a39151aea95eb56562d2953e919c6c73da Author: Xiubo Li Date: Tue May 2 11:38:05 2017 +0800 tcmu: Add dynamic growing data area feature support Currently for the TCMU, the ring buffer size is fixed to 64K cmd area + 1M data area, and this will be bottlenecks for high iops. The struct tcmu_cmd_entry {} size is fixed about 112 bytes with iovec[N] & N <= 4, and the size of struct iovec is about 16 bytes. If N == 0, the ratio will be sizeof(cmd entry) : sizeof(datas) == 112Bytes : (N * 4096)Bytes = 28 : 0, no data area is need. If 0 < N <=4, the ratio will be sizeof(cmd entry) : sizeof(datas) == 112Bytes : (N * 4096)Bytes = 28 : (N * 1024), so the max will be 28 : 1024. If N > 4, the sizeof(cmd entry) will be [(N - 4) *16 + 112] bytes, and its corresponding data size will be [N * 4096], so the ratio of sizeof(cmd entry) : sizeof(datas) == [(N - 4) * 16 + 112)Bytes : (N * 4096)Bytes == 4/1024 - 12/(N * 1024), so the max is about 4 : 1024. When N is bigger, the ratio will be smaller. As the initial patch, we will set the cmd area size to 2M, and the cmd area size to 32M. The TCMU will dynamically grows the data area from 0 to max 32M size as needed. The cmd area memory will be allocated through vmalloc(), and the data area's blocks will be allocated individually later when needed. The allocated data area block memory will be managed via radix tree. For now the bitmap still be the most efficient way to search and manage the block index, this could be update later. Signed-off-by: Xiubo Li Signed-off-by: Jianfei Hu Acked-by: Mike Christie Signed-off-by: Nicholas Bellinger drivers/target/target_core_user.c | 338 ++++++++++++++++++++++++++------------ 1 file changed, 237 insertions(+), 101 deletions(-) commit 2cc12e2e8cb65aec9a95a3d3de4d70e7b6b8c881 Merge: 66acd7f 0ccecd9 Author: Linus Torvalds Date: Mon May 1 22:34:52 2017 -0700 Merge branch 'x86-cleanups-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cleanups from Ingo Molnar: "A handful of small cleanups" * 'x86-cleanups-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/irq: Remove a redundant #ifdef directive x86/smp: Remove the redundant #ifdef CONFIG_SMP directive x86/smp: Reduce code duplication x86/pci-calgary: Use setup_timer() instead of open coding it. commit 66acd7fc9415bc05482b829e7de4073c1072b1de Merge: 3fb9268 2c4fd1a Author: Linus Torvalds Date: Mon May 1 22:33:43 2017 -0700 Merge branch 'x86-build-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 build update from Ingo Molnar: "A single CLang support related fix" * 'x86-build-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/kbuild: Use cc-option to enable -falign-{jumps/loops} commit 3d035237a57777b7672eb116133da01493b607c1 Author: Hannes Reinecke Date: Fri Apr 28 10:04:04 2017 +0200 target: fixup error message in target_tg_pt_gp_tg_pt_gp_id_store() When setting up an ALUA target port group with an invalid ID the error message kstrtoul() returned -22 for tg_pt_gp_id is displayed, which is not really helpful. Convert it to something sane. And while we're at it, join the messages onto a single line. Signed-by: Hannes Reinecke Reviewed-by: Bart van Assche Signed-off-by: Nicholas Bellinger drivers/target/target_core_configfs.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit c0dcafd8c52e0c36588d4d14c2ef4288830bc461 Author: Hannes Reinecke Date: Fri Apr 28 10:03:38 2017 +0200 target: fixup error message in target_tg_pt_gp_alua_access_type_store() When setting up a target the error message: Unable to do set ##_name ALUA state on non valid tg_pt_gp ID: 0 is displayed. Apparently concatenation doesn't work in a string; one should be using implicit string concatenation here. Signed-off-by: Hannes Reinecke Reviewed-by: Bart van Assche Signed-off-by: Nicholas Bellinger drivers/target/target_core_configfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4ec5bf0ea83930b96addf6b78225bf0355459d7f Author: Bryant G. Ly Date: Fri Apr 21 20:40:50 2017 -0500 target/user: PGR Support This adds initial PGR support for just TCMU, since tcmu doesn't have the necessary IT_NEXUS info to process PGR in userspace, so have those commands be processed in kernel. HA support is not available yet, we will work on it if this patch is acceptable. Signed-off-by: Bryant G. Ly Signed-off-by: Nicholas Bellinger drivers/target/target_core_configfs.c | 10 ++++----- drivers/target/target_core_device.c | 38 +++++++++++++++++++++++++++++++++++ drivers/target/target_core_pr.c | 2 +- drivers/target/target_core_pscsi.c | 3 ++- include/target/target_core_backend.h | 1 + 5 files changed, 47 insertions(+), 7 deletions(-) commit c2d26f18dcbc84799457852292c66967ff6626f1 Author: Bryant G. Ly Date: Tue Apr 18 14:10:05 2017 -0500 target: Add WRITE_VERIFY_16 This patch addresses clients who needs write_verify_16 for large volume groups such as AIX. Signed-off-by: Bryant G. Ly Signed-off-by: Nicholas Bellinger drivers/target/target_core_sbc.c | 2 ++ include/scsi/scsi_proto.h | 1 + 2 files changed, 3 insertions(+) commit 38d454f0b5fab60d76eed5dcdfc7823d43d087ab Author: Christophe Vu-Brugier Date: Wed Apr 12 21:59:08 2017 +0200 Documentation/target: add an example script to configure an iSCSI target The script illustrates how to interact with configfs to create a very simple LIO iSCSI target with a file or block device backstore. The script can serve as a starting point for people that cannot use targetcli because Python is not available on their machine. Signed-off-by: Christophe Vu-Brugier Signed-off-by: Vincent Donnefort Signed-off-by: Nicholas Bellinger Documentation/target/target-export-device | 80 +++++++++++++++++++++++++++++++ 1 file changed, 80 insertions(+) commit df6751f3401f86d87158279850aa9bedeef2d504 Author: Markus Elfring Date: Sun Apr 9 21:07:14 2017 +0200 target: Use kmalloc_array() in transport_kmap_data_sg() A multiplication for the size determination of a memory allocation indicated that an array data structure should be processed. Thus use the corresponding function "kmalloc_array". This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring Signed-off-by: Nicholas Bellinger drivers/target/target_core_transport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f318aef55fed0968af42ceef3976ee7cd858d845 Author: Markus Elfring Date: Sun Apr 9 20:25:11 2017 +0200 target: Use kmalloc_array() in compare_and_write_callback() * A multiplication for the size determination of a memory allocation indicated that an array data structure should be processed. Thus use the corresponding function "kmalloc_array". This issue was detected by using the Coccinelle software. * Replace the specification of a data structure by a pointer dereference to make the corresponding size determination a bit safer according to the Linux coding style convention. Signed-off-by: Markus Elfring Signed-off-by: Nicholas Bellinger drivers/target/target_core_sbc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 5d68fb72d3780555752bcf2526f759f953e08bc3 Author: Markus Elfring Date: Sun Apr 9 20:15:12 2017 +0200 target: Improve size determinations in two functions Replace the specification of two data structures by pointer dereferences as the parameter for the operator "sizeof" to make the corresponding size determinations a bit safer according to the Linux coding style convention. Signed-off-by: Markus Elfring Signed-off-by: Nicholas Bellinger drivers/target/target_core_rd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit fbc4040bf67b10ee66097c9603550773a3bc5c06 Author: Markus Elfring Date: Sun Apr 9 19:20:26 2017 +0200 target: Delete error messages for failed memory allocations The script "checkpatch.pl" pointed information out like the following. WARNING: Possible unnecessary 'out of memory' message Thus remove such statements here. Link: http://events.linuxfoundation.org/sites/events/files/slides/LCJ16-Refactor_Strings-WSang_0.pdf Signed-off-by: Markus Elfring Signed-off-by: Nicholas Bellinger drivers/target/target_core_rd.c | 23 +++++------------------ 1 file changed, 5 insertions(+), 18 deletions(-) commit 55ec409202ff347d22673d90e01a159d3bd6d9cd Author: Markus Elfring Date: Sun Apr 9 19:02:38 2017 +0200 target: Use kcalloc() in two functions * Multiplications for the size determination of memory allocations indicated that array data structures should be processed. Thus use the corresponding function "kcalloc". This issue was detected by using the Coccinelle software. * Replace the specification of data structures by pointer dereferences to make the corresponding size determination a bit safer according to the Linux coding style convention. Signed-off-by: Markus Elfring Signed-off-by: Nicholas Bellinger drivers/target/target_core_rd.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 3829f38169aaf38c764afba852e320d8f3b006de Author: Markus Elfring Date: Sun Apr 9 16:00:39 2017 +0200 iscsi-target: Improve size determinations in four functions Replace the specification of four data structures by pointer dereferences as the parameter for the operator "sizeof" to make the corresponding size determinations a bit safer according to the Linux coding style convention. Signed-off-by: Markus Elfring Signed-off-by: Nicholas Bellinger drivers/target/iscsi/iscsi_target.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) commit c46e22f10612d91fb2cceef232e9d73c34be212a Author: Markus Elfring Date: Sun Apr 9 15:34:50 2017 +0200 iscsi-target: Delete error messages for failed memory allocations The script "checkpatch.pl" pointed information out like the following. WARNING: Possible unnecessary 'out of memory' message Thus remove such statements here. Link: http://events.linuxfoundation.org/sites/events/files/slides/LCJ16-Refactor_Strings-WSang_0.pdf Signed-off-by: Markus Elfring Signed-off-by: Nicholas Bellinger drivers/target/iscsi/iscsi_target.c | 37 ++++++++++--------------------------- 1 file changed, 10 insertions(+), 27 deletions(-) commit f1725110324d97d841609fd0b3536eb3ead77086 Author: Markus Elfring Date: Sun Apr 9 15:06:00 2017 +0200 iscsi-target: Use kcalloc() in iscsit_allocate_iovecs() * A multiplication for the size determination of a memory allocation indicated that an array data structure should be processed. Thus use the corresponding function "kcalloc". This issue was detected by using the Coccinelle software. * Replace the specification of a data structure by a pointer dereference to make the corresponding size determination a bit safer according to the Linux coding style convention. Signed-off-by: Markus Elfring Signed-off-by: Nicholas Bellinger drivers/target/iscsi/iscsi_target.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 056e8924a072d22007275dfb8b247bb814765b67 Author: Dmitry Monakhov Date: Fri Mar 31 19:53:36 2017 +0400 tcm: make pi data verification configurable Currently ramdisk and fileio always perform PI verification before and after backend IO. This approach is not very flexible. Because some one may want to postpone this work to other layers in IO stack. For example if we want to test blk_integrity_profile testcase: https://github.com/dmonakhov/xfstests/commit/dee408c868861d6b6871dbb3381facee7effdbe4 Signed-off-by: Dmitry Monakhov Signed-off-by: Nicholas Bellinger drivers/target/target_core_configfs.c | 34 ++++++++++++++++++++++++++++++++++ drivers/target/target_core_file.c | 6 ++++-- drivers/target/target_core_rd.c | 17 +++++++++-------- include/target/target_core_base.h | 1 + 4 files changed, 48 insertions(+), 10 deletions(-) commit f11b55d13563e9428c88c873f4f03a6bef11ec0a Author: Dmitry Monakhov Date: Fri Mar 31 19:53:35 2017 +0400 tcm_fileio: Prevent information leak for short reads If we failed to read data from backing file (probably because some one truncate file under us), we must zerofill cmd's data, otherwise it will be returned as is. Most likely cmd's data are unitialized pages from page cache. This result in information leak. (Change BUG_ON into -EINVAL se_cmd failure - nab) testcase: https://github.com/dmonakhov/xfstests/commit/e11a1b7b907ca67b1be51a1594025600767366d5 Signed-off-by: Dmitry Monakhov Signed-off-by: Nicholas Bellinger drivers/target/target_core_file.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) commit 0e2eb7d12eaa8e391bf5615d4271bb87a649caaa Author: Bart Van Assche Date: Thu Mar 30 10:12:39 2017 -0700 target: Fix VERIFY and WRITE VERIFY command parsing Use the value of the BYTCHK field to determine the size of the Data-Out buffer. For VERIFY, honor the VRPROTECT, DPO and FUA fields. This patch avoids that LIO complains about a mismatch between the expected transfer length and the SCSI CDB length if the value of the BYTCHK field is 0. Signed-off-by: Bart Van Assche Cc: Max Lohrmann Cc: Signed-off-by: Nicholas Bellinger drivers/target/target_core_sbc.c | 71 +++++++++++++++++++++++++++++++++++----- 1 file changed, 62 insertions(+), 9 deletions(-) commit d65e655706e4827fb061daff399e07806b1223ad Author: Zhu Lingshan Date: Wed Mar 8 14:31:34 2017 +0800 target/pr: update PR out action code table This commit updated persistent revervation out service action code table in SPC-5 for development. Signed-off-by: Zhu Lingshan Signed-off-by: Nicholas Bellinger drivers/target/target_core_pr.h | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 5981c245a890db6a6e16fb6d3838cc9fc9fdf0ff Author: Elena Reshetova Date: Mon Mar 6 16:21:11 2017 +0200 target/iblock: convert iblock_req.pending from atomic_t to refcount_t refcount_t type and corresponding API should be used instead of atomic_t when the variable is used as a reference counter. This allows to avoid accidental refcounter overflows that might lead to use-after-free situations. Signed-off-by: Elena Reshetova Signed-off-by: Hans Liljestrand Signed-off-by: Kees Cook Signed-off-by: David Windsor Signed-off-by: Nicholas Bellinger drivers/target/target_core_iblock.c | 12 ++++++------ drivers/target/target_core_iblock.h | 3 ++- 2 files changed, 8 insertions(+), 7 deletions(-) commit 3fb9268e43e7ab62adb5c6ddec58d3cb4767bd9a Merge: 12ca7c8 262fa73 Author: Linus Torvalds Date: Mon May 1 22:07:51 2017 -0700 Merge branch 'x86-asm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 asm updates from Ingo Molnar: "The main changes in this cycle were: - unwinder fixes and enhancements - improve ftrace interaction with the unwinder - optimize the code footprint of WARN() and related debugging constructs - ... plus misc updates, cleanups and fixes" * 'x86-asm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (24 commits) x86/unwind: Dump all stacks in unwind_dump() x86/unwind: Silence more entry-code related warnings x86/ftrace: Fix ebp in ftrace_regs_caller that screws up unwinder x86/unwind: Remove unused 'sp' parameter in unwind_dump() x86/unwind: Prepend hex mask value with '0x' in unwind_dump() x86/unwind: Properly zero-pad 32-bit values in unwind_dump() x86/unwind: Ensure stack pointer is aligned debug: Avoid setting BUGFLAG_WARNING twice x86/unwind: Silence entry-related warnings x86/unwind: Read stack return address in update_stack_state() x86/unwind: Move common code into update_stack_state() debug: Fix __bug_table[] in arch linker scripts debug: Add _ONCE() logic to report_bug() x86/debug: Define BUG() again for !CONFIG_BUG x86/debug: Implement __WARN() using UD0 x86/ftrace: Use Makefile logic instead of #ifdef for compiling ftrace_*.o x86/ftrace: Add -mfentry support to x86_32 with DYNAMIC_FTRACE set x86/ftrace: Clean up ftrace_regs_caller x86/ftrace: Add stack frame pointer to ftrace_caller x86/ftrace: Move the ftrace specific code out of entry_32.S ... commit aa1dca3bd96bfd0ddf6871fc1844bd12ccce50f1 Author: Eric Biggers Date: Tue May 2 00:49:54 2017 -0400 ext4: inherit encryption xattr before other xattrs When using both encryption and SELinux (or another feature that requires an xattr per file) on a filesystem with 256-byte inodes, each file's xattrs usually spill into an external xattr block. Currently, the xattrs are inherited in the order ACL, security, then encryption. Therefore, if spillage occurs, the encryption xattr will always end up in the external block. This is not ideal because the encryption xattrs contain a nonce, so they will always be unique and will prevent the external xattr blocks from being deduplicated. To improve the situation, change the inheritance order to encryption, ACL, then security. This gives the encryption xattr a better chance to be stored in-inode, allowing the other xattr(s) to be deduplicated. Note that it may be better for userspace to format the filesystem with 512-byte inodes in this case. However, it's not the default. Signed-off-by: Eric Biggers Signed-off-by: Theodore Ts'o fs/ext4/ialloc.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) commit 12ca7c8db30d36e0ba1d00d17fc8c85f9ebfdf47 Merge: a52bbaf 5ba039a Author: Linus Torvalds Date: Mon May 1 21:41:07 2017 -0700 Merge branch 'x86-apic-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 apic updates from Ingo Molnar: "Two small cleanups" * 'x86-apic-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/apic: Fix a comment in init_apic_mappings() x86/apic: Remove the SET_APIC_ID(x) macro commit a52bbaf4a3b81e07430a91ee37ea76557c2c02ed Merge: 16b7629 4797b7d Author: Linus Torvalds Date: Mon May 1 21:15:50 2017 -0700 Merge branch 'x86-cpu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cpu updates from Ingo Molnar: "The biggest changes are an extension of the Intel RDT code to extend it with Intel Memory Bandwidth Allocation CPU support: MBA allows bandwidth allocation between cores, while CBM (already upstream) allows CPU cache partitioning. There's also misc smaller fixes and updates" * 'x86-cpu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (23 commits) x86/intel_rdt: Return error for incorrect resource names in schemata x86/intel_rdt: Trim whitespace while parsing schemata input x86/intel_rdt: Fix padding when resource is enabled via mount x86/intel_rdt: Get rid of anon union x86/cpu: Keep model defines sorted by model number x86/intel_rdt/mba: Add schemata file support for MBA x86/intel_rdt: Make schemata file parsers resource specific x86/intel_rdt/mba: Add info directory files for Memory Bandwidth Allocation x86/intel_rdt: Make information files resource specific x86/intel_rdt/mba: Add primary support for Memory Bandwidth Allocation (MBA) x86/intel_rdt/mba: Memory bandwith allocation feature detect x86/intel_rdt: Add resource specific msr update function x86/intel_rdt: Move CBM specific data into a struct x86/intel_rdt: Cleanup namespace to support multiple resource types Documentation, x86: Intel Memory bandwidth allocation x86/intel_rdt: Organize code properly x86/intel_rdt: Init padding only if a device exists x86/intel_rdt: Add cpus_list rdtgroup file x86/intel_rdt: Cleanup kernel-doc x86/intel_rdt: Update schemata read to show data in tabular format ... commit 16b76293c5c81e6345323d7aef41b26e8390f62d Merge: 3dee9fb da63b6b Author: Linus Torvalds Date: Mon May 1 20:51:12 2017 -0700 Merge branch 'x86-boot-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 boot updates from Ingo Molnar: "The biggest changes in this cycle were: - reworking of the e820 code: separate in-kernel and boot-ABI data structures and apply a whole range of cleanups to the kernel side. No change in functionality. - enable KASLR by default: it's used by all major distros and it's out of the experimental stage as well. - ... misc fixes and cleanups" * 'x86-boot-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (63 commits) x86/KASLR: Fix kexec kernel boot crash when KASLR randomization fails x86/reboot: Turn off KVM when halting a CPU x86/boot: Fix BSS corruption/overwrite bug in early x86 kernel startup x86: Enable KASLR by default boot/param: Move next_arg() function to lib/cmdline.c for later reuse x86/boot: Fix Sparse warning by including required header file x86/boot/64: Rename start_cpu() x86/xen: Update e820 table handling to the new core x86 E820 code x86/boot: Fix pr_debug() API braindamage xen, x86/headers: Add dependency to x86/boot/e820: Simplify e820__update_table() x86/boot/e820: Separate the E820 ABI structures from the in-kernel structures x86/boot/e820: Fix and clean up e820_type switch() statements x86/boot/e820: Rename the remaining E820 APIs to the e820__*() prefix x86/boot/e820: Remove unnecessary #include's x86/boot/e820: Rename e820_mark_nosave_regions() to e820__register_nosave_regions() x86/boot/e820: Rename e820_reserve_resources*() to e820__reserve_resources*() x86/boot/e820: Use bool in query APIs x86/boot/e820: Document e820__reserve_setup_data() x86/boot/e820: Clean up __e820__update_table() et al ... commit e3bf4c61da801c7967d0efff0c3f6b22d2c0e544 Author: David S. Miller Date: Mon May 1 20:26:02 2017 -0700 sparc64: Fix BPF JIT wrt. branches and ldimm64 instructions. Like other JITs, sparc64 maintains an array of instruction offsets but stores the entries off by one. This is done because jumps to the exit block are indexed to one past the last BPF instruction. So if we size the array by the program length, we need to record the previous instruction in order to stay within the array bounds. This is explained in ARM JIT commit 8eee539ddea0 ("arm64: bpf: fix out-of-bounds read in bpf2a64_offset()"). But this scheme requires a little bit of careful handling when the instruction before the branch destination is a 64-bit load immediate. It takes up 2 BPF instruction slots. Therefore, we have to fill in the array entry for the second half of the 64-bit load immediate instruction rather than for the one for the beginning of that instruction. Fixes: 7a12b5031c6b ("sparc64: Add eBPF JIT.") Signed-off-by: David S. Miller arch/sparc/net/bpf_jit_comp_64.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 3dee9fb2a4ced89a13a4d4b72b0b7360b701e566 Merge: 7c8c03b c6a9583 Author: Linus Torvalds Date: Mon May 1 20:48:33 2017 -0700 Merge branch 'ras-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull RAS updates from Ingo Molnar: "The main changes in this cycle were: - add the 'Corrected Errors Collector' kernel feature which collect and monitor correctable errors statistics and will preemptively (soft-)offline physical pages that have a suspiciously high error count. - handle MCE errors during kexec() more gracefully - factor out and deprecate the /dev/mcelog driver - ... plus misc fixes and cleanpus" * 'ras-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/mce: Check MCi_STATUS[MISCV] for usable addr on Intel only ACPI/APEI: Use setup_deferrable_timer() x86/mce: Update notifier priority check x86/mce: Enable PPIN for Knights Landing/Mill x86/mce: Do not register notifiers with invalid prio x86/mce: Factor out and deprecate the /dev/mcelog driver RAS: Add a Corrected Errors Collector x86/mce: Rename mce_log to mce_log_buffer x86/mce: Rename mce_log()'s argument x86/mce: Init some CPU features early x86/mce: Handle broadcasted MCE gracefully with kexec commit 7c8c03bfc7b9f5211d8a69eab7fee99c9fb4f449 Merge: 6dc2cce fd76479 Author: Linus Torvalds Date: Mon May 1 20:23:17 2017 -0700 Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf updates from Ingo Molnar: "The main changes in this cycle were: Kernel side changes: - Kprobes and uprobes changes: - Make their trampolines read-only while they are used - Make UPROBES_EVENTS default-y which is the distro practice - Apply misc fixes and robustization to probe point insertion. - add support for AMD IOMMU events - extend hw events on Intel Goldmont CPUs - ... plus misc fixes and updates. Tooling side changes: - support s390 jump instructions in perf annotate (Christian Borntraeger) - vendor hardware events updates (Andi Kleen) - add argument support for SDT events in powerpc (Ravi Bangoria) - beautify the statx syscall arguments in 'perf trace' (Arnaldo Carvalho de Melo) - handle inline functions in callchains (Jin Yao) - enable sorting by srcline as key (Milian Wolff) - add 'brstackinsn' field in 'perf script' to reuse the x86 instruction decoder used in the Intel PT code to study hot paths to samples (Andi Kleen) - add PERF_RECORD_NAMESPACES so that the kernel can record information required to associate samples to namespaces, helping in container problem characterization. (Hari Bathini) - allow sorting by symbol_size in 'perf report' and 'perf top' (Charles Baylis) - in perf stat, make system wide (-a) the default option if no target was specified and one of following conditions is met: - no workload specified (current behaviour) - a workload is specified but all requested events are system wide ones, like uncore ones. (Jiri Olsa) - ... plus lots of other updates, enhancements, cleanups and fixes" * 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (235 commits) perf tools: Fix the code to strip command name tools arch x86: Sync cpufeatures.h tools arch: Sync arch/x86/lib/memcpy_64.S with the kernel tools: Update asm-generic/mman-common.h copy from the kernel perf tools: Use just forward declarations for struct thread where possible perf tools: Add the right header to obtain PERF_ALIGN() perf tools: Remove poll.h and wait.h from util.h perf tools: Remove string.h, unistd.h and sys/stat.h from util.h perf tools: Remove stale prototypes from builtin.h perf tools: Remove string.h from util.h perf tools: Remove sys/ioctl.h from util.h perf tools: Remove a few more needless includes from util.h perf tools: Include sys/param.h where needed perf callchain: Move callchain specific routines from util.[ch] perf tools: Add compress.h for the *_decompress_to_file() headers perf mem: Fix display of data source snoop indication perf debug: Move dump_stack() and sighandler_dump_stack() to debug.h perf kvm: Make function only used by 'perf kvm' static perf tools: Move timestamp routines from util.h to time-utils.h perf tools: Move units conversion/formatting routines to separate object ... commit 6dc2cce9321198172cd96f955a5fc798a4cc35a6 Merge: 207fb8c f3e4559 Author: Linus Torvalds Date: Mon May 1 19:57:58 2017 -0700 Merge branch 'x86-process-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pul x86/process updates from Ingo Molnar: "The main change in this cycle was to add the ARCH_[GET|SET]_CPUID prctl() ABI extension to control the availability of the CPUID instruction, analogously to the existing PR_GET|SET_TSC ABI that controls RDTSC. Motivation: the 'rr' user-space record-and-replay execution debugger would like to trap and emulate the CPUID instruction - which instruction is normally unprivileged. Trapping CPUID is possible on IvyBridge and later Intel CPUs - expose this hardware capability" * 'x86-process-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/syscalls/32: Ignore arch_prctl for other architectures um/arch_prctl: Fix fallout from x86 arch_prctl() rework x86/arch_prctl: Add ARCH_[GET|SET]_CPUID x86/cpufeature: Detect CPUID faulting support x86/syscalls/32: Wire up arch_prctl on x86-32 x86/arch_prctl: Add do_arch_prctl_common() x86/arch_prctl/64: Rename do_arch_prctl() to do_arch_prctl_64() x86/arch_prctl/64: Use SYSCALL_DEFINE2 to define sys_arch_prctl() x86/arch_prctl: Rename 'code' argument to 'option' x86/msr: Rename MISC_FEATURE_ENABLES to MISC_FEATURES_ENABLES x86/process: Optimize TIF_NOTSC switch x86/process: Correct and optimize TIF_BLOCKSTEP switch x86/process: Optimize TIF checks in __switch_to_xtra() commit 207fb8c3049cdc31de20ca9f91d0ae319125eb62 Merge: 3527d3e 59cd42c Author: Linus Torvalds Date: Mon May 1 19:36:00 2017 -0700 Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking updates from Ingo Molnar: "The main changes in this cycle were: - a big round of FUTEX_UNLOCK_PI improvements, fixes, cleanups and general restructuring - lockdep updates such as new checks for lock_downgrade() - introduce the new atomic_try_cmpxchg() locking API and use it to optimize refcount code generation - ... plus misc fixes, updates and cleanups" * 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (38 commits) MAINTAINERS: Add FUTEX SUBSYSTEM futex: Clarify mark_wake_futex memory barrier usage futex: Fix small (and harmless looking) inconsistencies futex: Avoid freeing an active timer rtmutex: Plug preempt count leak in rt_mutex_futex_unlock() rtmutex: Fix more prio comparisons rtmutex: Fix PI chain order integrity sched,tracing: Update trace_sched_pi_setprio() sched/rtmutex: Refactor rt_mutex_setprio() rtmutex: Clean up sched/deadline/rtmutex: Dont miss the dl_runtime/dl_period update sched/rtmutex/deadline: Fix a PI crash for deadline tasks rtmutex: Deboost before waking up the top waiter locking/ww-mutex: Limit stress test to 2 seconds locking/atomic: Fix atomic_try_cmpxchg() semantics lockdep: Fix per-cpu static objects futex: Drop hb->lock before enqueueing on the rtmutex futex: Futex_unlock_pi() determinism futex: Rework futex_lock_pi() to use rt_mutex_*_proxy_lock() futex,rt_mutex: Restructure rt_mutex_finish_proxy_lock() ... commit 3527d3e9514f013f361fba29fd71858d9361049d Merge: 3711c94 21173d0 Author: Linus Torvalds Date: Mon May 1 19:12:53 2017 -0700 Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler updates from Ingo Molnar: "The main changes in this cycle were: - another round of rq-clock handling debugging, robustization and fixes - PELT accounting improvements - CPU hotplug related ->cpus_allowed affinity handling fixes all around the tree - ... plus misc fixes, cleanups and updates" * 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (35 commits) sched/x86: Update reschedule warning text crypto: N2 - Replace racy task affinity logic cpufreq/sparc-us2e: Replace racy task affinity logic cpufreq/sparc-us3: Replace racy task affinity logic cpufreq/sh: Replace racy task affinity logic cpufreq/ia64: Replace racy task affinity logic ACPI/processor: Replace racy task affinity logic ACPI/processor: Fix error handling in __acpi_processor_start() sparc/sysfs: Replace racy task affinity logic powerpc/smp: Replace open coded task affinity logic ia64/sn/hwperf: Replace racy task affinity logic ia64/salinfo: Replace racy task affinity logic workqueue: Provide work_on_cpu_safe() ia64/topology: Remove cpus_allowed manipulation sched/fair: Move the PELT constants into a generated header sched/fair: Increase PELT accuracy for small tasks sched/fair: Fix comments sched/Documentation: Add 'sched-pelt' tool sched/fair: Fix corner case in __accumulate_sum() sched/core: Remove 'task' parameter and rename tsk_restore_flags() to current_restore_flags() ... commit 3711c94fd6593318146348c940d81040acf9e877 Merge: 174ddfd 197dece Author: Linus Torvalds Date: Mon May 1 18:20:03 2017 -0700 Merge branch 'efi-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull EFI updates from Ingo Molnar: "The main changes in this cycle were: - move BGRT handling to drivers/acpi so it can be shared between x86 and ARM - bring the EFI stub's initrd and FDT allocation logic in line with the latest changes to the arm64 boot protocol - improvements and fixes to the EFI stub's command line parsing routines - randomize the virtual mapping of the UEFI runtime services on ARM/arm64 - ... and other misc enhancements, cleanups and fixes" * 'efi-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: efi/libstub/arm: Don't use TASK_SIZE when randomizing the RT space ef/libstub/arm/arm64: Randomize the base of the UEFI rt services region efi/libstub/arm/arm64: Disable debug prints on 'quiet' cmdline arg efi/libstub: Unify command line param parsing efi/libstub: Fix harmless command line parsing bug efi/arm32-stub: Allow boot-time allocations in the vmlinux region x86/efi: Clean up a minor mistake in comment efi/pstore: Return error code (if any) from efi_pstore_write() efi/bgrt: Enable ACPI BGRT handling on arm64 x86/efi/bgrt: Move efi-bgrt handling out of arch/x86 efi/arm-stub: Round up FDT allocation to mapping size efi/arm-stub: Correct FDT and initrd allocation rules for arm64 commit 4ca41cb2ae09bfd9f84f053b8b9966e1bb8accc4 Author: Ludovic Barre Date: Thu Apr 13 19:15:56 2017 +0200 dt-bindings: mtd: Document the STM32 QSPI bindings This patch adds documentation of device tree bindings for the STM32 QSPI controller. Signed-off-by: Ludovic Barre Acked-by: Rob Herring Signed-off-by: Brian Norris .../devicetree/bindings/mtd/stm32-quadspi.txt | 43 ++++++++++++++++++++++ 1 file changed, 43 insertions(+) commit 47228ca57e845d3d9196eb4e232b7cf6217a9beb Merge: 57e363b 8abe904 Author: Brian Norris Date: Mon May 1 17:08:10 2017 -0700 Merge tag 'spi-nor/for-4.12-v2' of git://github.com/spi-nor/linux into MTD From Cyrille: """ This pull request contains the following notable changes: - fixes in the hisi SPI controller driver. - fixes in the intel SPI controller driver. - fixes in the Mediatek SPI controller driver. - fixes to some SPI flash memories not supported the Chip Erase command. - add support to some new memory parts (Winbond, Macronix, Micron, ESMT). - add new driver for the STM32 QSPI controller. """ commit 174ddfd5dfbfc2d91a45332f809977050ac3fdc5 Merge: 3cb6653 b94bf59 Author: Linus Torvalds Date: Mon May 1 16:15:18 2017 -0700 Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer updates from Thomas Gleixner: "The timer departement delivers: - more year 2038 rework - a massive rework of the arm achitected timer - preparatory patches to allow NTP correction of clock event devices to avoid early expiry - the usual pile of fixes and enhancements all over the place" * 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (91 commits) timer/sysclt: Restrict timer migration sysctl values to 0 and 1 arm64/arch_timer: Mark errata handlers as __maybe_unused Clocksource/mips-gic: Remove redundant non devicetree init MIPS/Malta: Probe gic-timer via devicetree clocksource: Use GENMASK_ULL in definition of CLOCKSOURCE_MASK acpi/arm64: Add SBSA Generic Watchdog support in GTDT driver clocksource: arm_arch_timer: add GTDT support for memory-mapped timer acpi/arm64: Add memory-mapped timer support in GTDT driver clocksource: arm_arch_timer: simplify ACPI support code. acpi/arm64: Add GTDT table parse driver clocksource: arm_arch_timer: split MMIO timer probing. clocksource: arm_arch_timer: add structs to describe MMIO timer clocksource: arm_arch_timer: move arch_timer_needs_of_probing into DT init call clocksource: arm_arch_timer: refactor arch_timer_needs_probing clocksource: arm_arch_timer: split dt-only rate handling x86/uv/time: Set ->min_delta_ticks and ->max_delta_ticks unicore32/time: Set ->min_delta_ticks and ->max_delta_ticks um/time: Set ->min_delta_ticks and ->max_delta_ticks tile/time: Set ->min_delta_ticks and ->max_delta_ticks score/time: Set ->min_delta_ticks and ->max_delta_ticks ... commit 3cb6653552ddd0b5670a445032ecb9f162e950ff Merge: 2dbf3d5 216646e Author: Linus Torvalds Date: Mon May 1 15:46:13 2017 -0700 Merge branch 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq updates from Thomas Gleixner: "Nothing exciting from the irq side for this merge window: - a new driver for a Mediatek SoC - ACPI support for ARM GICV3 - support for shared nested interrupts - the usual pile of fixes and updates all over te place" * 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (28 commits) irqchip/mbigen: Fix return value check in mbigen_device_probe() irqchip/mips-gic: Replace static map with dynamic irqchip/mips-gic: Remove device IRQ domain irqchip/mips-gic: Separate IPI reservation & usage tracking genirq: Use irqd_get_trigger_type to compare the trigger type for shared IRQs genirq: Use cpumask_available() for check of cpumask variable cpumask: Add helper cpumask_available() irqchip/irq-imx-gpcv2: Clear OF_POPULATED flag irqchip/atmel-aic5: Handle suspend to RAM irqchip: Add Mediatek mtk-cirq driver dt-bindings: mtk-cirq: Add binding document irqchip/gic-v3-its: Add IORT hook for platform MSI support irqchip/mbigen: Add ACPI support irqchip/mbigen: Introduce mbigen_of_create_domain() irqchip/mbigen: Drop module owner platform-msi: Make platform_msi_create_device_domain() ACPI aware irqchip/gicv3-its: platform-msi: Scan MADT to create platform msi domain irqchip/gicv3-its: platform-msi: Refactor its_pmsi_init() to prepare for ACPI irqchip/gicv3-its: platform-msi: Refactor its_pmsi_prepare() irqchip/gic-v3-its: Keep the include header files in alphabetic order ... commit 412445acb6cad4cef026daae37c4765fb9942c60 Author: Christoph Hellwig Date: Wed Apr 26 09:40:39 2017 +0200 dm: introduce a new DM_MAPIO_KILL return value This untangles the DM_MAPIO_* values returned from ->clone_and_map_rq from the error codes used by the block layer. Signed-off-by: Christoph Hellwig Signed-off-by: Mike Snitzer drivers/md/dm-rq.c | 12 +++++------- drivers/md/dm-target.c | 2 +- include/linux/device-mapper.h | 1 + 3 files changed, 7 insertions(+), 8 deletions(-) commit 7ed8578a96ad98231d8bf6388f776e034673e18a Author: Christoph Hellwig Date: Wed Apr 26 09:40:37 2017 +0200 dm rq: change ->rq_end_io calling conventions Instead of returning either a DM_ENDIO_* constant or an error code, add a new DM_ENDIO_DONE value that means keep errno as is. This allows us to easily keep the existing error code in case where we can't push back, and it also preparares for the new block level status codes with strict type checking. Signed-off-by: Christoph Hellwig Signed-off-by: Mike Snitzer drivers/md/dm-mpath.c | 13 +++++++++---- drivers/md/dm-rq.c | 17 ++++++++++------- include/linux/device-mapper.h | 1 + 3 files changed, 20 insertions(+), 11 deletions(-) commit b79f10eefd4bc450a595b93c75e3a9d159ac3885 Author: Christoph Hellwig Date: Wed Apr 26 09:40:36 2017 +0200 dm mpath: merge do_end_io into multipath_end_io This simplifies the I/O completion path a bit. Signed-off-by: Christoph Hellwig Signed-off-by: Mike Snitzer drivers/md/dm-mpath.c | 51 +++++++++++++++++---------------------------------- 1 file changed, 17 insertions(+), 34 deletions(-) commit 7e25a7606147bfe29a7421ff2cb332b07d3cee3a Merge: 9438b3e 390020a Author: Mike Snitzer Date: Mon May 1 18:18:04 2017 -0400 Merge branch 'dm-4.12' into dm-4.12-post-merge commit 2dbf3d5c32bf905c2575e5759f2ab6262ec9c6c5 Merge: a25fb85 01e7bc2 Author: Linus Torvalds Date: Mon May 1 15:02:19 2017 -0700 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/egtvedt/linux-avr32 Pull AVR32 removal from Hans-Christian Noren Egtvedt: "This will remove support for AVR32 architecture from the kernel and clean away the most obvious architecture related parts. Removing dead code in drivers is the next step" Notes from previous discussion about this: "The AVR32 architecture is not keeping up with the development of the kernel, and since it shares so much of the drivers with Atmel ARM SoC, it is starting to hinder these drivers to develop swiftly. Also, all AVR32 AP7 SoC processors are end of lifed from Atmel (now Microchip). Finally, the GCC toolchain is stuck at version 4.2.x, and has not received any patches since the last release from Atmel; 4.2.4-atmel.1.1.3.avr32linux.1. When building kernel v4.10, this toolchain is no longer able to properly link the network stack. Haavard and I have came to the conclusion that we feel keeping AVR32 on life support offers more obstacles for Atmel ARMs, than it gives joy to AVR32 users. I also suspect there are very few AVR32 users left today, if anybody at all" That discussion was acked by Andy Shevchenko, Boris Brezillon, Nicolas Ferre, and Haavard Skinnemoen. * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/egtvedt/linux-avr32: mm: remove AVR32 arch special handling in mm/Kconfig lib: remove check for AVR32 arch in test_user_copy lib: remove AVR32 entry in Kconfig.debug compile with frame pointers scripts: remove AVR32 support from checkstack.pl docs: remove all references to AVR32 architecture avr32: remove support for AVR32 architecture commit a25fb8508c1b80dce742dbeaa4d75a1e9f2c5617 Author: Sergei Trofimovich Date: Mon May 1 11:51:55 2017 -0700 ia64: fix module loading for gcc-5.4 Starting from gcc-5.4+ gcc generates MLX instructions in more cases to refer local symbols: https://gcc.gnu.org/PR60465 That caused ia64 module loader to choke on such instructions: fuse: invalid slot number 1 for IMM64 The Linux kernel used to handle only case where relocation pointed to slot=2 instruction in the bundle. That limitation was fixed in linux by commit 9c184a073bfd ("[IA64] Fix 2.6 kernel for the new ia64 assembler") See http://sources.redhat.com/bugzilla/show_bug.cgi?id=1433 This change lifts the slot=2 restriction from the kernel module loader. Tested on 'fuse' and 'btrfs' kernel modules. Cc: Markus Elfring Cc: H J Lu Cc: Fenghua Yu Cc: Andrew Morton Bug: https://bugs.gentoo.org/601014 Tested-by: Émeric MASCHINO Signed-off-by: Sergei Trofimovich Signed-off-by: Tony Luck Signed-off-by: Linus Torvalds arch/ia64/kernel/module.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 5db6db0d400edd8bec274e34960cfa22838e1df5 Merge: 5fab100 2fefc97 Author: Linus Torvalds Date: Mon May 1 14:41:04 2017 -0700 Merge branch 'work.uaccess' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull uaccess unification updates from Al Viro: "This is the uaccess unification pile. It's _not_ the end of uaccess work, but the next batch of that will go into the next cycle. This one mostly takes copy_from_user() and friends out of arch/* and gets the zero-padding behaviour in sync for all architectures. Dealing with the nocache/writethrough mess is for the next cycle; fortunately, that's x86-only. Same for cleanups in iov_iter.c (I am sold on access_ok() in there, BTW; just not in this pile), same for reducing __copy_... callsites, strn*... stuff, etc. - there will be a pile about as large as this one in the next merge window. This one sat in -next for weeks. -3KLoC" * 'work.uaccess' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (96 commits) HAVE_ARCH_HARDENED_USERCOPY is unconditional now CONFIG_ARCH_HAS_RAW_COPY_USER is unconditional now m32r: switch to RAW_COPY_USER hexagon: switch to RAW_COPY_USER microblaze: switch to RAW_COPY_USER get rid of padding, switch to RAW_COPY_USER ia64: get rid of copy_in_user() ia64: sanitize __access_ok() ia64: get rid of 'segment' argument of __do_{get,put}_user() ia64: get rid of 'segment' argument of __{get,put}_user_check() ia64: add extable.h powerpc: get rid of zeroing, switch to RAW_COPY_USER esas2r: don't open-code memdup_user() alpha: fix stack smashing in old_adjtimex(2) don't open-code kernel_setsockopt() mips: switch to RAW_COPY_USER mips: get rid of tail-zeroing in primitives mips: make copy_from_user() zero tail explicitly mips: clean and reorder the forest of macros... mips: consolidate __invoke_... wrappers ... commit 5fab10041b4389b61de7e7a49893190bae686241 Merge: 08be881 e481747 Author: Linus Torvalds Date: Mon May 1 14:18:05 2017 -0700 Merge tag 'devprop-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull generic device properties framework updates from Rafael Wysocki: "These add support for the ports and endpoints concepts, based on the existing DT support for them, to the generic device properties framework and update the ACPI _DSD properties code to recognize ports and endpoints accordingly. Specifics: - Extend the ACPI _DSD properties code and the generic device properties framework to support the concept of remote endponts (Mika Westerberg, Sakari Ailus). - Document the support for ports and endpoints in _DSD properties and extend the generic device properties framework to make it more suitable for the handling of ports and endpoints (Sakari Ailus)" * tag 'devprop-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: device property: Read strings using string array reading functions device property: fwnode_property_read_string_array() returns nr of strings device property: Fix reading pset strings using array access functions device property: fwnode_property_read_string_array() may return -EILSEQ ACPI / DSD: Document references, ports and endpoints device property: Add fwnode_get_next_parent() device property: Add support for fwnode endpoints device property: Make dev_fwnode() public of: Add of_fwnode_handle() to convert device nodes to fwnode_handle device property: Add fwnode_handle_get() device property: Add support for remote endpoints ACPI / property: Add support for remote endpoints device property: Add fwnode_get_named_child_node() ACPI / property: Add fwnode_get_next_child_node() device property: Add fwnode_get_parent() ACPI / property: Add possiblity to retrieve parent firmware node commit 1b2e87687d3f951a66900cab6f1583d94099d2f7 Author: David E. Box Date: Sat Apr 22 23:06:25 2017 -0700 x86/intel_idle: add Gemini Lake support Gemini Lake uses the same C-states as Broxton and also uses the IRTL MSR's to determine maximum C-state latency. Signed-off-by: David E. Box Acked-by: Len Brown Signed-off-by: Rafael J. Wysocki drivers/idle/intel_idle.c | 2 ++ 1 file changed, 2 insertions(+) commit 41dc750ea67f317c0deedde713d1728425524ef2 Author: Li, Fei Date: Thu Apr 27 01:47:25 2017 +0000 cpuidle: check dev before usage in cpuidle_use_deepest_state() In case of there is no cpuidle devices registered, dev will be null, and panic will be triggered like below; In this patch, add checking of dev before usage, like that done in cpuidle_idle_call. Panic without fix: [ 184.961328] BUG: unable to handle kernel NULL pointer dereference at (null) [ 184.961328] IP: cpuidle_use_deepest_state+0x30/0x60 ... [ 184.961328] play_idle+0x8d/0x210 [ 184.961328] ? __schedule+0x359/0x8e0 [ 184.961328] ? _raw_spin_unlock_irqrestore+0x28/0x50 [ 184.961328] ? kthread_queue_delayed_work+0x41/0x80 [ 184.961328] clamp_idle_injection_func+0x64/0x1e0 Fixes: bb8313b603eb8 (cpuidle: Allow enforcing deepest idle state selection) Signed-off-by: Li, Fei Tested-by: Shi, Feng Reviewed-by: Andy Shevchenko Cc: 4.10+ # 4.10+ Signed-off-by: Rafael J. Wysocki drivers/cpuidle/cpuidle.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 08be881064da126b8df4b96b0b3e2e307969a4a1 Merge: 0e285e9 52e70c8 Author: Linus Torvalds Date: Mon May 1 14:13:28 2017 -0700 Merge tag 'acpi-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI updates from Rafael Wysocki: "These are some device enumeration code changes, updates of the AC and battery drivers to help them avoid attaching to devices that cannot be handled by them, new operation region driver for the Intel CHT Whiskey Cove PMIC, new sysfs entries for CPPC performance capabilities, a new _REV quirk blacklist entry and a couple of assorted minor fixes and cleanups. Specifics: - Update the core device enumeration code to make it more internally consistent and robust and drop the force_remove sysfs attribute that could be used to tell it to ignore errors on device hot-removal which was dangerous in general and no real and still relevant use cases for it could be found (Rafael Wysocki, Michal Hocko). - Make the core device enumeration code use _PXM to associate platform devices created by it with specific NUMA nodes (Shanker Donthineni). - Extend the CPPC library by adding more sysfs entries for performance capabilities to it and making it use the lowest nonlinear performance parameter (Prashanth Prakash). - Make the CPU online more consistent with CPU initialization in the ACPI processor driver (Prashanth Prakash). - Update the AC and battery drivers to help them avoid attaching to devices that cannot be handled by them and update the axp288_charger power supply driver to work correctly on ACPI systems without the INT3496 device (Hans de Goede). - Add an ACPI operation region driver for the Intel CHT Whiskey Cove PMIC and update the xpower operation region driver to work without IIO which isn't really necessary for it to work (Hans de Goede). - Add a new entry for Dell Inspiron 7537 to the _REV quirk blacklist (Kai Heng Feng). - Make the code in the ACPI video driver easier to follow by adding symbols and comments to it (Dmitry Frank). - Update ACPI documentation and drop a function that has no users from the tables-handling code (Cao jin, Baoquan He)" * tag 'acpi-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI / PMIC: Stop xpower OPRegion handler relying on IIO ACPI / PMIC: Add opregion driver for Intel CHT Whiskey Cove PMIC ACPI / scan: Avoid enumerating devices more than once ACPI / scan: Apply default enumeration to devices with ACPI drivers power: supply: axp288_charger: Only wait for INT3496 device if present ACPI / AC: Add a blacklist with PMIC ACPI HIDs with a native charger driver ACPI / battery: Add a blacklist with PMIC ACPI HIDs with a native battery driver ACPI / battery: Fix acpi_battery_exit on acpi_battery_init_async errors ACPI / utils: Add new acpi_dev_present helper ACPI / video: add comments about subtle cases ACPI / video: get rid of magic numbers and use enum instead ACPI / doc: linuxized-acpica.txt: fix typos ACPI / blacklist: add _REV quirk for Dell Inspiron 7537 ACPI / tables: Drop acpi_parse_entries() which is not used ACPI / CPPC: add sysfs entries for CPPC perf capabilities ACPI / CPPC: Read lowest nonlinear perf in cppc_get_perf_caps() ACPI / platform: Update platform device NUMA node based on _PXM method ACPI / Processor: Drop setup_max_cpus check from acpi_processor_add() ACPI / scan: Drop support for force_remove commit 8ece1d83346bcc431090d59a2184276192189cdd Author: Hans de Goede Date: Sun Apr 30 22:54:16 2017 +0200 ACPI / power: Delay turning off unused power resources after suspend Commit 660b1113e0f3 (ACPI / PM: Fix consistency check for power resources during resume) introduced a check for ACPI power resources which have been turned on by the BIOS during suspend and turns these back off again. This is causing problems on a Dell Venue Pro 11 7130 (i5-4300Y) it causes the following messages to show up in dmesg: [ 131.014605] ACPI: Waking up from system sleep state S3 [ 131.150271] acpi LNXPOWER:07: Turning OFF [ 131.150323] acpi LNXPOWER:06: Turning OFF [ 131.150911] acpi LNXPOWER:00: Turning OFF [ 131.169014] ACPI : EC: interrupt unblocked [ 131.181811] xhci_hcd 0000:00:14.0: System wakeup disabled by ACPI [ 133.535728] pci_raw_set_power_state: 76 callbacks suppressed [ 133.535735] iwlwifi 0000:01:00.0: Refused to change power state, currently in D3 [ 133.597672] PM: noirq resume of devices complete after 2428.891 msecs Followed by a bunch of iwlwifi errors later on and the pcie device dropping from the bus (acpiphp thinks it has been unplugged). Disabling the turning off of unused power resources fixes this. Instead of adding a quirk for this system, this commit fixes this by moving the disabling of unused power resources to later in the resume sequence when the iwlwifi card has been moved out of D3 so the ref_count for its power resource no longer is 0. This new behavior seems to match the intend of the original commit which commit-msg says: "(... which means that no devices are going to need them any time soon) and we should turn them off". This also avoids power resources which we need when bringing devices out of D3 from getting bounced off and then back on again. Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki drivers/acpi/power.c | 10 ++++++++++ drivers/acpi/sleep.c | 1 + drivers/acpi/sleep.h | 1 + 3 files changed, 12 insertions(+) commit 0e285e90887bcb248178d55960e1276188c657c9 Merge: 9410091 a1d2fcf Author: Linus Torvalds Date: Mon May 1 14:09:46 2017 -0700 Merge tag 'pm-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management updates from Rafael Wysocki: "This time the majority of changes go to the cpufreq subsystem (and to the intel_pstate driver in particular) and there are some updates in the generic power domains framework, cpuidle, tools and a couple of other places. One thing worth mentioning is that the intel_pstate's sysfs interface has been reworked to be more consistent with the general expectations of the cpufreq core and less confusing, hopefully for the better. Also, we have a new cpufreq driver for Tegra186 and new hardware support in intel_pstata and the Mediatek cpufreq driver. Apart from that, the AnalyzeSuspend utility for system suspend profiling gets a companion called AnalyzeBoot for the analogous profiling of system boot and they both go into one place under tools/power/pm-graph/. The rest is mostly fixes, cleanups and code reorganization. Specifics: - Rework the intel_pstate driver's sysfs interface to make it more straightforward and more intuitive (Rafael Wysocki). - Make intel_pstate support all processors which advertise HWP (hardware-managed P-states) to the kernel in all operation modes and make it use the load-based P-state selection algorithm on a wider range of systems in the active mode (Rafael Wysocki). - Add cpufreq driver for Tegra186 (Mikko Perttunen). - Add support for Gemini Lake SoCs to intel_pstate (David Box). - Add support for MT8176 and MT817x to the Mediatek cpufreq driver and clean up that driver a bit (Daniel Kurtz). - Clean up intel_pstate and optimize it slightly (Rafael Wysocki). - Update the schedutil cpufreq governor, mostly to fix a couple of issues with it related to specific workloads, and rework its sysfs tunable and initialization a bit (Rafael Wysocki, Viresh Kumar). - Fix minor issues in the imx6q, dbx500 and qoriq cpufreq drivers (Christophe Jaillet, Irina Tirdea, Leonard Crestez, Viresh Kumar, YuanTian Tang). - Add file patterns for cpufreq DT bindings to MAINTAINERS (Geert Uytterhoeven). - Add support for "always on" power domains to the genpd (generic power domains) framework and clean up that code somewhat (Ulf Hansson, Lina Iyer, Viresh Kumar). - Fix minor issues in the powernv cpuidle driver and clean it up (Anton Blanchard, Gautham Shenoy). - Move the AnalyzeSuspend utility under tools/power/pm-graph/ and add an analogous boot-profiling utility called AnalyzeBoot to it (Todd Brandt). - Add rk3328 support to the rockchip-io AVS (Adaptive Voltage Scaling) driver (David Wu). - Fix minor issues in the cpuidle core, the intel_pstate_tracer utility, the devfreq framework and the PM core documentation (Chanwoo Choi, Doug Smythies, Johan Hovold, Marcin Nowakowski)" * tag 'pm-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (56 commits) PM / runtime: Document autosuspend-helper side effects PM / runtime: Fix autosuspend documentation tools: power: pm-graph: Package makefile and man pages tools: power: pm-graph: AnalyzeBoot v2.0 tools: power: pm-graph: AnalyzeSuspend v4.6 cpufreq: Add Tegra186 cpufreq driver cpufreq: imx6q: Fix error handling code cpufreq: imx6q: Set max suspend_freq to avoid changes during suspend cpufreq: imx6q: Fix handling EPROBE_DEFER from regulator cpuidle: powernv: Avoid a branch in the core snooze_loop() loop cpuidle: powernv: Don't continually set thread priority in snooze_loop() cpuidle: powernv: Don't bounce between low and very low thread priority cpuidle: cpuidle-cps: remove unused variable tools/power/x86/intel_pstate_tracer: Adjust directory ownership cpufreq: schedutil: Use policy-dependent transition delays cpufreq: schedutil: Reduce frequencies slower PM / devfreq: Move struct devfreq_governor to devfreq directory PM / Domains: Ignore domain-idle-states that are not compatible cpufreq: intel_pstate: Add support for Gemini Lake powernv-cpuidle: Validate DT property array size ... commit e265eb3a30543a237b2ebc4e0422ac82e55b07e4 Merge: 85724ed b506335 Author: Shaohua Li Date: Mon May 1 14:09:21 2017 -0700 Merge branch 'md-next' into md-linus commit 9410091dd5b4097819fcbb6d63987c51f62c85fd Merge: ad1490b 310b481 Author: Linus Torvalds Date: Mon May 1 13:52:24 2017 -0700 Merge branch 'for-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup updates from Tejun Heo: "Nothing major. Two notable fixes are Li's second stab at fixing the long-standing race condition in the mount path and suppression of spurious warning from cgroup_get(). All other changes are trivial" * 'for-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup: mark cgroup_get() with __maybe_unused cgroup: avoid attaching a cgroup root to two different superblocks, take 2 cgroup: fix spurious warnings on cgroup_is_dead() from cgroup_sk_alloc() cgroup: move cgroup_subsys_state parent field for cache locality cpuset: Remove cpuset_update_active_cpus()'s parameter. cgroup: switch to BUG_ON() cgroup: drop duplicate header nsproxy.h kernel: convert css_set.refcount from atomic_t to refcount_t kernel: convert cgroup_namespace.count from atomic_t to refcount_t commit ad1490bcd2484a24f5b8d7ae18368b739f3e1e19 Merge: e69bbe7 c30fb26 Author: Linus Torvalds Date: Mon May 1 13:49:27 2017 -0700 Merge branch 'for-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue update from Tejun Heo: "One trivial patch to use setup_deferrable_timer() instead of open-coding the initialization" * 'for-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: use setup_deferrable_timer commit 57e363b8c45b6626b012f6ce39a2f70adf6b49fc Merge: da4b1ca 9d2ee0a Author: Brian Norris Date: Mon May 1 13:36:44 2017 -0700 Merge tag 'nand/for-4.12' of github.com:linux-nand/linux into MTD From Boris: """ This pull request contains: - some minor fixes/improvements on existing drivers (fsmc, gpio, ifc, davinci, brcmnand, omap) - a huge cleanup/rework of the denali driver accompanied with core fixes/improvements to simplify the driver code - a complete rewrite of the atmel driver to support new DT bindings make future evolution easier - the addition of per-vendor detection/initialization steps to avoid extending the nand_ids table with more extended-id entries """ commit 87f0faadc68534668802a85ae670435bc90830b3 Author: Doug Ledford Date: Mon May 1 16:35:59 2017 -0400 IB/SA: Add OPA addr header When importing the patch 57520751445b (IB/SA: Add OPA path record type), a new header file should have been added to the repo as part of the patch. However, as the patch didn't apply cleanly using git am, I instead used patch manually, and followed that up with git add -u, which misses new files. This adds the new file back in. Fixes: 57520751445b (IB/SA: Add OPA path record type) Signed-off-by: Doug Ledford include/rdma/opa_addr.h | 79 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 79 insertions(+) commit e69bbe75de8ee0e732b8c009197f1a97e804d43c Merge: 85724ed 63ccc19 Author: Linus Torvalds Date: Mon May 1 13:34:49 2017 -0700 Merge branch 'for-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata Pull libata updates from Tejun Heo: "The biggest core change is removal of SCT WRITE SAME support, which never worked properly. Other than that, trivial updates in core code and specific embedded driver updates" * 'for-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata: libata: remove SCT WRITE SAME support libata: reject passthrough WRITE SAME requests dt-bindings: ata: add DT bindings for ahci-dm816 SATA controller ata: ahci: add support for DaVinci DM816 SATA controller pata: remove the at91 driver libata: make ata_sg_clean static over again libata: use setup_deferrable_timer ata: allow subsystem to be used on m32r and s390 archs Delete redundant return value check of platform_get_resource() ata: constify of_device_id structures commit 48e75b430670ebdbb00ba008e1d3690f61ab9824 Author: Florian Westphal Date: Mon May 1 22:18:01 2017 +0200 rhashtable: compact struct rhashtable_params By using smaller datatypes this (rather large) struct shrinks considerably (80 -> 48 bytes on x86_64). As this is embedded in other structs, this also rerduces size of several others, e.g. cls_fl_head or nft_hash. Signed-off-by: Florian Westphal Signed-off-by: David S. Miller include/linux/rhashtable.h | 18 +++++++++--------- lib/rhashtable.c | 2 +- 2 files changed, 10 insertions(+), 10 deletions(-) commit 67fd38973513c341c84654ae2f819089b840a39b Author: Arnd Bergmann Date: Thu Apr 27 16:30:41 2017 +0200 block, dax: use correct format string in bdev_dax_supported The new message has an incorrect format string, causing a warning in some configurations: fs/block_dev.c: In function 'bdev_dax_supported': fs/block_dev.c:779:5: error: format '%d' expects argument of type 'int', but argument 2 has type 'long int' [-Werror=format=] "error: dax access failed (%d)", len); This changes it to use the correct %ld instead of %d. Fixes: 2093f2e9dfec ("block, dax: convert bdev_dax_supported() to dax_direct_access()") Signed-off-by: Arnd Bergmann Signed-off-by: Dan Williams fs/block_dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 565851c972b50612f3a4542e26879ffb3e906fc2 Author: Dan Williams Date: Sun Apr 30 06:57:01 2017 -0700 device-dax: fix sysfs attribute deadlock Usage of device_lock() for dax_region attributes is unnecessary and deadlock prone. It's unnecessary because the order of registration / un-registration guarantees that drvdata is always valid. It's deadlock prone because it sets up this situation: ndctl D 0 2170 2082 0x00000000 Call Trace: __schedule+0x31f/0x980 schedule+0x3d/0x90 schedule_preempt_disabled+0x15/0x20 __mutex_lock+0x402/0x980 ? __mutex_lock+0x158/0x980 ? align_show+0x2b/0x80 [dax] ? kernfs_seq_start+0x2f/0x90 mutex_lock_nested+0x1b/0x20 align_show+0x2b/0x80 [dax] dev_attr_show+0x20/0x50 ndctl D 0 2186 2079 0x00000000 Call Trace: __schedule+0x31f/0x980 schedule+0x3d/0x90 __kernfs_remove+0x1f6/0x340 ? kernfs_remove_by_name_ns+0x45/0xa0 ? remove_wait_queue+0x70/0x70 kernfs_remove_by_name_ns+0x45/0xa0 remove_files.isra.1+0x35/0x70 sysfs_remove_group+0x44/0x90 sysfs_remove_groups+0x2e/0x50 dax_region_unregister+0x25/0x40 [dax] devm_action_release+0xf/0x20 release_nodes+0x16d/0x2b0 devres_release_all+0x3c/0x60 device_release_driver_internal+0x17d/0x220 device_release_driver+0x12/0x20 unbind_store+0x112/0x160 ndctl/2170 is trying to acquire the device_lock() to read an attribute, and ndctl/2186 is holding the device_lock() while trying to drain all active attribute readers. Thanks to Yi Zhang for the reproduction script. Fixes: d7fe1a67f658 ("dax: add region 'id', 'size', and 'align' attributes") Cc: Reported-by: Yi Zhang Signed-off-by: Dan Williams drivers/dax/dax.c | 40 ++++++++++++---------------------------- 1 file changed, 12 insertions(+), 28 deletions(-) commit 85724edecbdc19f53ed4b902fc3a32e4d1b61c9b Merge: 477d7ca 28c5fe9 Author: Linus Torvalds Date: Mon May 1 13:12:49 2017 -0700 Merge tag 'leds_for_4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds Pull LED updates from Jacek Anaszewski: "New drivers: - add LED support for MT6323 PMIC - add LED support for Motorola CPCAP PMIC New features and improvements: - add LED trigger for all CPUs aggregated which is useful on tiny boards with more CPU cores than LED pins - add OF variants of LED registering functions as a preparation for adding generic support for Device Tree parsing - dell-led improvements and cleanups, followed by moving it to the x86 platform driver subsystem which is a more appropriate place for it - extend pca9532 Device Tree support by adding the LEDs 'default-state' property - extend pca963x Device Tree support by adding nxp,inverted-out property for inverting the polarity of the output - remove ACPI support for lp3952 since it relied on a non-official ACPI IDs" * tag 'leds_for_4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds: leds: pca9532: Extend pca9532 device tree support leds: cpcap: new driver mfd: cpcap: Add missing include dependencies leds: lp3952: Use 'if (ret)' pattern leds: lp3952: Remove ACPI support for lp3952 leds: mt6323: Fix an off by one bug in probe dt-bindings: leds: Add document bindings for leds-mt6323 leds: Add LED support for MT6323 PMIC leds: gpio: use OF variant of LED registering function leds: core: add OF variants of LED registering functions platform/x86: dell-wmi-led: fix coding style issues dell-led: move driver to drivers/platform/x86/dell-wmi-led.c dell-led: remove code related to mic mute LED platform/x86: dell-laptop: import dell_micmute_led_set() from drivers/leds/dell-led.c ALSA: hda - rename dell_led_set_func to dell_micmute_led_set_func ALSA: hda - use dell_micmute_led_set() instead of dell_app_wmi_led_set() dell-led: remove GUID check from dell_micmute_led_set() leds/trigger/cpu: Add LED trigger for all CPUs aggregated commit 477d7caeede0e3a933368440fc877b12c25dbb6d Merge: 6fb41cb cb710ab Author: Linus Torvalds Date: Mon May 1 13:10:03 2017 -0700 Merge branch 'mailbox-for-next' of git://git.linaro.org/landing-teams/working/fujitsu/integration Pull mailbox updates from Jassi Brar: - new driver for Broadcom FlexRM controller - constify data structures of callback functions in some drivers - a few bug fixes uncovered by multi-threaded use of mailbox channels in blocking mode * 'mailbox-for-next' of git://git.linaro.org/landing-teams/working/fujitsu/integration: mailbox: handle empty message in tx_tick mailbox: skip complete wait event if timer expired mailbox: always wait in mbox_send_message for blocking Tx mode mailbox: Remove depends on COMPILE_TEST for BCM_FLEXRM_MBOX mailbox: check ->last_tx_done for NULL in case of timer-based polling dt-bindings: Add DT bindings info for FlexRM ring manager mailbox: Add driver for Broadcom FlexRM ring manager dt-bindings: mailbox: Update doc with NSP PDC/mailbox support mailbox: bcm-pdc: Add Northstar Plus support to PDC driver mailbox: constify mbox_chan_ops structures commit 6fb41cbd7d82f7b9e41db6245f6a46c84ca3083e Merge: 5c6ba7d 2c1175c Author: Linus Torvalds Date: Mon May 1 13:07:02 2017 -0700 Merge tag 'for-linux-4.12' of git://github.com/cminyard/linux-ipmi Pull IPMI updates from Corey Minyard: "A few fixes of things in the IPMI area, the watchdog would have issues at panic time cause by a recently introduced change, a problem with device numbering, one possible panic in the I2C driver (destined for stable). Nothing earth-shattering, but some things that need to go in" * tag 'for-linux-4.12' of git://github.com/cminyard/linux-ipmi: ipmi/watchdog: fix wdog hang on panic waiting for ipmi response ipmi_si: use smi_num for init_name ipmi: bt-bmc: Add ast2500 compatible string ACPI / IPMI: change warning to debug on timeout ACPI / IPMI: allow ACPI_IPMI with IPMI_SSIF ipmi_ssif: use setup_timer ipmi: Fix kernel panic at ipmi_ssif_thread() commit 5c6ba7d53274b5e8b13ecbc727d8eb1ea4a2bcdc Merge: 7f2ebde 3026050 Author: Linus Torvalds Date: Mon May 1 13:04:39 2017 -0700 Merge tag 'hsi-for-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi Pull HSI fix from Sebastian Reichel: "Fix double free fix in ssi-protocol" * tag 'hsi-for-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi: HSI: ssi_protocol: double free in ssip_pn_xmit() commit 7f2ebde737c933d75718a1fca933af4e9d53006b Merge: cdbfbba 6c38166 Author: Linus Torvalds Date: Mon May 1 13:02:00 2017 -0700 Merge tag 'for-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull power supply and reset updates from Sebastian Reichel: "New drivers: - gemini-poweroff - cpcap-charger (for Motorola Droid 4) - battery-lego-ev3 (for LEGO Mindstorms EV3) New chip/feature support: - bq24190-charger: add runtime PM support - bq24190-charger: add bq24192i support - register masking for syscon-poweroff ... and misc small fixes & cleanups * tag 'for-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: (29 commits) power: supply: bq24190_charger: Use new extcon_register_notifier_all() power: supply: bq24190_charger: Longer delay while polling reset flag power: supply: bq24190_charger: Uniform pm_runtime_get() failure handling power: supply: bq24190_charger: Clean up extcon code power: supply: bq24190_charger: Limit over/under voltage fault logging power: supply: New driver for LEGO MINDSTORMS EV3 battery dt-bindings: power: supply: New bindings for LEGO MINDSTORMS EV3 battery power: supply: tps65217: remove debug messages for function calls power: supply: ltc2941-battery-gauge: Add OF device ID table power: supply: ltc2941-battery-gauge: Add vendor to compatibles in binding power: supply: charger-manager: simplify return statements power: supply: lp8788: prevent out of bounds array access power: supply: cpcap-charger: Add minimal CPCAP PMIC battery charger power: supply: bq24190_charger: Use extcon to determine ilimit, 5v boost power: supply: bq24190_charger: Add support for bq24192i power: supply: bq24190_charger: Use i2c-core irq-mapping code power: bq24190_charger: mark PM functions as __maybe_unused power: supply: sbs-charger: simplified bool function power: supply: ab8500: Replaced spaces with tabs in indent power: supply: bq25890: Use gpiod_get() ... commit e06422c43968916dc945018fd9220f60866470b1 Author: David S. Miller Date: Mon May 1 12:58:21 2017 -0700 bpf: Include bpf_endian.h in test_progs.c too. Signed-off-by: David S. Miller tools/testing/selftests/bpf/test_progs.c | 1 + 1 file changed, 1 insertion(+) commit a0841609f658c77f066af9c61a2e13143564fcb4 Merge: 77f8f39 e679af6 Author: Jiri Kosina Date: Mon May 1 21:49:28 2017 +0200 Merge branches 'for-4.12/upstream' and 'for-4.12/klp-hybrid-consistency-model' into for-linus commit bc1bafbbe9b3558d7789ff151ef4f185b6ad21f3 Author: David S. Miller Date: Mon May 1 12:43:49 2017 -0700 bpf: Move endianness BPF helpers out of bpf_util.h We do not want to include things like stdio.h and friends into eBPF program builds. bpf_util.h is for host compiled programs, so eBPF C-code helpers don't really belong there. Add a new bpf_endian.h as a quick fix for this for now. Signed-off-by: David S. Miller tools/testing/selftests/bpf/bpf_endian.h | 23 +++++++++++++++++++++++ tools/testing/selftests/bpf/bpf_util.h | 19 ------------------- tools/testing/selftests/bpf/test_l4lb.c | 2 +- tools/testing/selftests/bpf/test_pkt_access.c | 2 +- 4 files changed, 25 insertions(+), 21 deletions(-) commit 8a038b83e012097a7ac6cfb9f6c5fac1da8fad6e Author: Martin Kepplinger Date: Mon May 1 10:13:47 2017 -0700 Input: ar1021_i2c - use BIT to check for a bit The MSB for the first byte of touch data transmission is always 1. Make it a little more obvious we're testing this bit by using BIT(7). Signed-off-by: Martin Kepplinger Signed-off-by: Dmitry Torokhov drivers/input/touchscreen/ar1021_i2c.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 310b4816a5d8082416b4ab83e5a7b3cb92883a4d Author: Tejun Heo Date: Mon May 1 15:24:14 2017 -0400 cgroup: mark cgroup_get() with __maybe_unused a590b90d472f ("cgroup: fix spurious warnings on cgroup_is_dead() from cgroup_sk_alloc()") converted most cgroup_get() usages to cgroup_get_live() leaving cgroup_sk_alloc() the sole user of cgroup_get(). When !CONFIG_SOCK_CGROUP_DATA, this ends up triggering unused warning for cgroup_get(). Silence the warning by adding __maybe_unused to cgroup_get(). Reported-by: Stephen Rothwell Link: http://lkml.kernel.org/r/20170501145340.17e8ef86@canb.auug.org.au Signed-off-by: Tejun Heo kernel/cgroup/cgroup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b506335e5d2b4ec687dde392a3bdbf7601778f1d Author: Shaohua Li Date: Mon May 1 12:15:07 2017 -0700 md/raid10: skip spare disk as 'first' disk Commit 6f287ca(md/raid10: reset the 'first' at the end of loop) ignores a case in reshape, the first rdev could be a spare disk, which shouldn't be accounted as the first disk since it doesn't include the offset info. Fix: 6f287ca(md/raid10: reset the 'first' at the end of loop) Cc: Guoqing Jiang Cc: NeilBrown Signed-off-by: Shaohua Li drivers/md/raid10.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 390020ad2af9ca04844c4f3b1f299ad8746d84c8 Author: Mikulas Patocka Date: Sun Apr 30 17:34:53 2017 -0400 dm bufio: check new buffer allocation watermark every 30 seconds dm-bufio checks a watermark when it allocates a new buffer in __bufio_new(). However, it doesn't check the watermark when the user changes /sys/module/dm_bufio/parameters/max_cache_size_bytes. This may result in a problem - if the watermark is high enough so that all possible buffers are allocated and if the user lowers the value of "max_cache_size_bytes", the watermark will never be checked against the new value because no new buffer would be allocated. To fix this, change __evict_old_buffers() so that it checks the watermark. __evict_old_buffers() is called every 30 seconds, so if the user reduces "max_cache_size_bytes", dm-bufio will react to this change within 30 seconds and decrease memory consumption. Depends-on: 1b0fb5a5b2 ("dm bufio: avoid a possible ABBA deadlock") Cc: stable@vger.kernel.org Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer drivers/md/dm-bufio.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 1b0fb5a5b2dc0dddcfa575060441a7176ba7ac37 Author: Mikulas Patocka Date: Sun Apr 30 17:33:26 2017 -0400 dm bufio: avoid a possible ABBA deadlock __get_memory_limit() tests if dm_bufio_cache_size changed and calls __cache_size_refresh() if it did. It takes dm_bufio_clients_lock while it already holds the client lock. However, lock ordering is violated because in cleanup_old_buffers() dm_bufio_clients_lock is taken before the client lock. This results in a possible deadlock and lockdep engine warning. Fix this deadlock by changing mutex_lock() to mutex_trylock(). If the lock can't be taken, it will be re-checked next time when a new buffer is allocated. Also add "unlikely" to the if condition, so that the optimizer assumes that the condition is false. Cc: stable@vger.kernel.org Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer drivers/md/dm-bufio.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 5b8481fa42ac58484d633b558579e302aead64c1 Author: David S. Miller Date: Mon May 1 15:10:20 2017 -0400 ipv6: Need to export ipv6_push_frag_opts for tunneling now. Since that change also made the nfrag function not necessary for exports, remove it. Fixes: 89a23c8b528b ("ip6_tunnel: Fix missing tunnel encapsulation limit option") Signed-off-by: David S. Miller net/ipv6/exthdrs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 133bea04ff6fd715d8140edca9d6c7337249571b Author: Tim Wright Date: Mon May 1 17:30:08 2017 +0100 IB/mlx5: Add port_xmit_wait to counter registers read Add port_xmit_wait to the error counters read by mlx5_ib_process_mad to ensure sysfs port counter provides correct value for PortXmitWait. Otherwise the sysfs port_xmit_wait file always contains zero. The previous MAD_IFC implementation populated this counter, but it was removed during the migration to PPCNT for error counters (32-bit only). Signed-off-by: Tim Wright Signed-off-by: Doug Ledford drivers/infiniband/hw/mlx5/mad.c | 2 ++ include/linux/mlx5/mlx5_ifc.h | 4 +++- 2 files changed, 5 insertions(+), 1 deletion(-) commit 062d0f22a30c39840ea49b72cfcfc1aa4cc538fa Author: Michael Mera Date: Mon May 1 15:41:16 2017 +0900 IB/ocrdma: fix out of bounds access to local buffer In write to debugfs file 'resource_stats' the local buffer 'tmp_str' is written at index 'count-1' where 'count' is the size of the write, so potentially 0. This patch filters odd values for the write size/position to avoid this type of problem. Signed-off-by: Michael Mera Reviewed-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/hw/ocrdma/ocrdma_stats.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b03ee4ca0cec348c84dccf08aaec2454c4d236c2 Author: Håkon Bugge Date: Fri Apr 28 13:06:54 2017 +0200 IB/mlx4: Fix incorrect order of formal and actual parameters The last two actual parameters when calling id_map_find_by_sl_id() from id_map_get() are swapped. However, the same formal parameters to id_map_get() have them swapped as well, inverting the effect of the first error. This commit improves readability, but makes no functional change to the code. Signed-off-by: Håkon Bugge Reviewed-by: Wengang Wang Reviewed-by: Knut Omang Acked-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/hw/mlx4/cm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 898782883501798284a10d1467b11dd2a48270cf Author: Håkon Bugge Date: Fri Apr 28 13:06:53 2017 +0200 IB/mlx4: Change flush logic so it adheres to the variable name Change and simplify the code to match the variable name. This commit improves readability but makes no functional change to the code. Signed-off-by: Håkon Bugge Suggested-by: Wengang Wang Reviewed-by: Wengang Wang Reviewed-by: Knut Omang Acked-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/hw/mlx4/cm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit aaf1be31b2ef1e51f3802373a7c6ca07605e51d1 Merge: 152afb9 931d182 Author: David S. Miller Date: Mon May 1 15:03:14 2017 -0400 Merge branch 'dsa-mv88e6xxx-802.1s-and-88E6390-VTU' Vivien Didelot says: ==================== net: dsa: mv88e6xxx: 802.1s and 88E6390 VTU This patch series adds support for the VLAN Table Unit (a.k.a. the VTU) to the 88E6390 family of Marvell Ethernet switch chips. The plumbing for the per VLAN Spanning Tree support is added as a side effect of the necessary refactoring. The patchset is split up so that no duplication of code is introduced. With this patchset applied, the mv88e6xxx driver has 2 new function pointers for the VTU GetNext and VTU Load/Purge operations (with 3 implementations), both handling programmation of 802.1q and 802.1s. On a ZII Rev C board (featuring 2 88E6390X chips) with all ports bridged together, we obtain the following hardware VLAN configuration: # cat /sys/class/net/br0/bridge/vlan_filtering 1 # cat /sys/class/net/br0/bridge/default_pvid 42 # bridge vlan add dev lan3 vid 666 # bridge vlan show port vlan ids lan1 42 PVID Egress Untagged lan1 42 PVID Egress Untagged lan2 42 PVID Egress Untagged lan2 42 PVID Egress Untagged lan3 42 PVID Egress Untagged 666 lan3 42 PVID Egress Untagged 666 lan4 42 PVID Egress Untagged lan4 42 PVID Egress Untagged lan5 42 PVID Egress Untagged lan5 42 PVID Egress Untagged lan6 42 PVID Egress Untagged lan6 42 PVID Egress Untagged lan7 42 PVID Egress Untagged lan7 42 PVID Egress Untagged lan8 42 PVID Egress Untagged lan8 42 PVID Egress Untagged br0 42 PVID Egress Untagged Below are the technical details for the different implementations. All switch families have up to 3 dedicated VTU Data registers used to program 802.1q and 802.1s, both using 2-bit values. On 88E6185 and 88E6352 families, port membership and state are adjacent, while the 88E6390 family share the same bits: Bits 88E6185/88E6352 88E6390 ----- ----------------- -------------------------- 0-1 Port 0 membership Port 0 membership or state 2-3 Port 0 state Port 1 membership or state 4-5 Port 1 membership Port 2 membership or state 6-7 Port 1 state Port 3 membership or state 8-9 Port 2 membership Port 4 membership or state 10-11 Port 2 state Port 5 membership or state ... ... ... The 88E6185 family programs all ports membership and state in a single VTU GetNext or Load/Purge operation. The 88E6352 family introduced an indirect Spanning Tree Unit table (a.k.a. STU) which requires additional STU GetNext and Load/Purge operations to read and write the ports state bits. The 88E6390 family also has an STU and requires data bits to be accessed before and after every single VTU or STU operation. Finally, the 88E6390 family introduced a 13th bit for the VLAN ID, which must be taken care of regardless the VTU operating mode. This means that iterating over the VTU now starts or ends with value 8191, not 4095. Patch 1 adds a max_vid field to the chip info structure. Patch 2 adds 802.1q and 802.1s data to the generic VTU entry structure. Patches 3 to 10 move helpers to a dedicated file (later made static). Patches 11 and 12 abstract handling of the STU behind VTU operations. Patches 13 and 14 add the new function pointers for VTU operations. Patches 15 and 18 polish the VTU code and add VTU support for 88E6390. Changes in v2: - add Reviewed-by tags - fix comments in 8/18 ==================== Signed-off-by: David S. Miller commit 931d18223998c5360b960d1ce247579f6152ad8f Author: Vivien Didelot Date: Mon May 1 14:05:27 2017 -0400 net: dsa: mv88e6xxx: add VTU support for 88E6390 The 6390 family of chips use only 2 of the 3 VTU Data registers to pack the MemberTag and PortState VLAN data. This means that they must be written or read before or after each VTU/STU operations. Implement this variant to add support for VTU with such chips. These chips have a 13th bit for the VID thus set their max_vid to 8191. Signed-off-by: Vivien Didelot Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx/chip.c | 18 +++++ drivers/net/dsa/mv88e6xxx/global1.h | 4 ++ drivers/net/dsa/mv88e6xxx/global1_vtu.c | 124 ++++++++++++++++++++++++++++++++ 3 files changed, 146 insertions(+) commit 1ac758648b574d3d01a648fc7018fc8b0bb7454a Author: Vivien Didelot Date: Mon May 1 14:05:26 2017 -0400 net: dsa: mv88e6xxx: support the VTU Page bit Newer chips such as the 88E6390 have a VTU Page bit in the VTU VID register to specify a 13th bit for the VID. This can be used to support 8K VLANs. When dumping the whole VTU, all VID bits must be set to one, including this VTU Page bit. Add support for VID greater than 4095. Signed-off-by: Vivien Didelot Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx/global1_vtu.c | 7 +++++++ drivers/net/dsa/mv88e6xxx/mv88e6xxx.h | 1 + 2 files changed, 8 insertions(+) commit 567aa59a8b055bb5853bc7e5d5f8ac191216c9c7 Author: Vivien Didelot Date: Mon May 1 14:05:25 2017 -0400 net: dsa: mv88e6xxx: simplify VTU entry getter Make the code which fetches or initializes a new VTU entry more concise. This allows us the get rid of the old underscore prefix naming. Signed-off-by: Vivien Didelot Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx/chip.c | 62 ++++++++++++++++------------------------ 1 file changed, 24 insertions(+), 38 deletions(-) commit bf7d71c0451776143cdbd9a42a5bcbd6478da3c8 Author: Vivien Didelot Date: Mon May 1 14:05:24 2017 -0400 net: dsa: mv88e6xxx: make VTU helpers static Now that we have chip operations for VTU accesses, mark all helpers from global1_vtu.c as static. Only the various implementations of the GetNext, LoadPurge and Flush operations need to be exposed. Signed-off-by: Vivien Didelot Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx/global1.h | 24 ----------------- drivers/net/dsa/mv88e6xxx/global1_vtu.c | 48 ++++++++++++++++----------------- 2 files changed, 24 insertions(+), 48 deletions(-) commit 0ad5daf6ba80af4a8d72b4284079357c4e3b9e4a Author: Vivien Didelot Date: Mon May 1 14:05:23 2017 -0400 net: dsa: mv88e6xxx: add VTU Load/Purge operation Add a new vtu_loadpurge operation to the chip info structure to differ the various implementations of the VTU accesses. Now that the STU handling is abstracted behind VTU operations, kill the obsolete MV88E6XXX_FLAG_STU flag. Signed-off-by: Vivien Didelot Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx/chip.c | 80 +++++++++++++-------------------- drivers/net/dsa/mv88e6xxx/global1.h | 4 ++ drivers/net/dsa/mv88e6xxx/global1_vtu.c | 66 +++++++++++++++++++++++++++ drivers/net/dsa/mv88e6xxx/mv88e6xxx.h | 10 +---- 4 files changed, 103 insertions(+), 57 deletions(-) commit f1394b78a602bae124a9b8473465ba48f4a5d5b2 Author: Vivien Didelot Date: Mon May 1 14:05:22 2017 -0400 net: dsa: mv88e6xxx: add VTU GetNext operation Add a new vtu_getnext operation to the chip info structure to differ the various implementations of the VTU accesses. Signed-off-by: Vivien Didelot Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx/chip.c | 82 ++++++++++++++------------------- drivers/net/dsa/mv88e6xxx/global1.h | 4 ++ drivers/net/dsa/mv88e6xxx/global1_vtu.c | 57 +++++++++++++++++++++++ drivers/net/dsa/mv88e6xxx/mv88e6xxx.h | 4 ++ 4 files changed, 99 insertions(+), 48 deletions(-) commit 021e64ff7676ad5183c1845d4b316df20175702a Author: Vivien Didelot Date: Mon May 1 14:05:21 2017 -0400 net: dsa: mv88e6xxx: load STU entry with VTU entry Now that the code writes both VTU and STU data when loading a VTU entry, load the corresponding STU entry at the same time. This allows us to get rid of the STU management in the _mv88e6xxx_vtu_new helper and thus remove the separate implementations of STU Load/Purge and STU GetNext, as well as the unused family checks. Signed-off-by: Vivien Didelot Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx/chip.c | 108 ++------------------------------------- 1 file changed, 4 insertions(+), 104 deletions(-) commit ef6fcea37f014ec54a0a9f7eaecc78cdb6ffc71e Author: Vivien Didelot Date: Mon May 1 14:05:20 2017 -0400 net: dsa: mv88e6xxx: get STU entry on VTU GetNext Now that the code reads both VTU and STU data on VTU GetNext operation, fetch the STU entry data of a VTU entry at the same time. The STU data bits are masked with the VTU data bits and they are now all read at the same time a VTU GetNext operation is issued. Signed-off-by: Vivien Didelot Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx/chip.c | 2 +- drivers/net/dsa/mv88e6xxx/global1.h | 2 ++ drivers/net/dsa/mv88e6xxx/global1_vtu.c | 22 ++++++++++++++++++++++ 3 files changed, 25 insertions(+), 1 deletion(-) commit 66a8e1f93319b8e3f5b6e81c06a2534c1491157c Author: Vivien Didelot Date: Mon May 1 14:05:19 2017 -0400 net: dsa: mv88e6xxx: move STU GetNext operation Extract the generic portion of code to issue an STU GetNext operation, which will be used in other implementations. Signed-off-by: Vivien Didelot Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx/chip.c | 14 +------------- drivers/net/dsa/mv88e6xxx/global1.h | 2 ++ drivers/net/dsa/mv88e6xxx/global1_vtu.c | 20 ++++++++++++++++++++ 3 files changed, 23 insertions(+), 13 deletions(-) commit c499a64f349d063d8cdb40c0b96e84c35bbc414c Author: Vivien Didelot Date: Mon May 1 14:05:18 2017 -0400 net: dsa: mv88e6xxx: move VTU Data accessors The code to access the VTU Data registers currently only supports the 88E6185 family and alike: 2-bit membership adjacent to 2-bit port state. Even though the 88E6352 family introduced an indirect table to program the VLAN Spanning Tree states, the usage of the VTU Data registers remains the same regardless the VTU or STU operation. Now that the mv88e6xxx_vtu_entry structure contains both port membership and states data, factorize the code to access them in global1_vtu.c. Signed-off-by: Vivien Didelot Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx/chip.c | 88 +++------------------------------ drivers/net/dsa/mv88e6xxx/global1.h | 4 ++ drivers/net/dsa/mv88e6xxx/global1_vtu.c | 61 +++++++++++++++++++++++ 3 files changed, 72 insertions(+), 81 deletions(-) commit f169e5ee5f29f81c1c8d647fa6fb5387ee793131 Author: Vivien Didelot Date: Mon May 1 14:05:17 2017 -0400 net: dsa: mv88e6xxx: move generic VTU GetNext Even though every switch model has a different way to access the VTU Data bits, the base implementation of the VTU GetNext operation remains the same: wait, write the first VID to iterate from, start the operation, and read the next VID. Move this generic implementation into global1_vtu.c and abstract the handling of the start VID (similarly to the ATU GetNext implementation), before introducing a new chip operation for specific chips. Signed-off-by: Vivien Didelot Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx/chip.c | 31 ++----------------------------- drivers/net/dsa/mv88e6xxx/global1.h | 2 ++ drivers/net/dsa/mv88e6xxx/global1_vtu.c | 29 +++++++++++++++++++++++++++++ 3 files changed, 33 insertions(+), 29 deletions(-) commit 3afb4bde6fe8f2d43b2153cc2672d07477729cca Author: Vivien Didelot Date: Mon May 1 14:05:16 2017 -0400 net: dsa: mv88e6xxx: move VTU VID accessors Add helpers to access the VTU VID register in the global1_vtu.c file. At the same time, move mv88e6xxx_g1_vtu_vid_write at the beginning of _mv88e6xxx_vtu_loadpurge, which adds no functional changes but makes future patches simpler. Signed-off-by: Vivien Didelot Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx/chip.c | 57 +++++++++++++-------------------- drivers/net/dsa/mv88e6xxx/global1.h | 4 +++ drivers/net/dsa/mv88e6xxx/global1_vtu.c | 29 +++++++++++++++++ 3 files changed, 56 insertions(+), 34 deletions(-) commit d2ca1ea18db6a90475b983e65e8435632fe3d57e Author: Vivien Didelot Date: Mon May 1 14:05:15 2017 -0400 net: dsa: mv88e6xxx: move VTU SID accessors Add helpers to access the VTU SID register in the global1_vtu.c file. Signed-off-by: Vivien Didelot Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx/chip.c | 21 ++++++++------------- drivers/net/dsa/mv88e6xxx/global1.h | 4 ++++ drivers/net/dsa/mv88e6xxx/global1_vtu.c | 25 +++++++++++++++++++++++++ 3 files changed, 37 insertions(+), 13 deletions(-) commit 8ee51f6b4f0819fd3d6a4143222be796779cf501 Author: Vivien Didelot Date: Mon May 1 14:05:14 2017 -0400 net: dsa: mv88e6xxx: move VTU FID accessors Add helpers to access the VTU FID register in the global1_vtu.c file. Signed-off-by: Vivien Didelot Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx/chip.c | 7 ++----- drivers/net/dsa/mv88e6xxx/global1.h | 4 ++++ drivers/net/dsa/mv88e6xxx/global1_vtu.c | 25 +++++++++++++++++++++++++ 3 files changed, 31 insertions(+), 5 deletions(-) commit b486d7c95cc8336aa91813a156f9385439bde2fc Author: Vivien Didelot Date: Mon May 1 14:05:13 2017 -0400 net: dsa: mv88e6xxx: move VTU flush Move the VTU flush operation to global1_vtu.c and call it from a mv88e6xxx_vtu_setup helper, similarly to the ATU and PVT setup. Signed-off-by: Vivien Didelot Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx/chip.c | 28 ++++++++++++---------------- drivers/net/dsa/mv88e6xxx/global1.h | 1 + drivers/net/dsa/mv88e6xxx/global1_vtu.c | 13 +++++++++++++ 3 files changed, 26 insertions(+), 16 deletions(-) commit 332aa5ccc82005de9441c1b65ca546488c7f8730 Author: Vivien Didelot Date: Mon May 1 14:05:12 2017 -0400 net: dsa: mv88e6xxx: move VTU Operation accessors Move the helper functions to access the Global 1 VTU Operation register to a new global1_vtu.c file, and get rid of the old underscore prefix naming convention. This file will be extended will all VTU/STU related code. Signed-off-by: Vivien Didelot Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx/Makefile | 1 + drivers/net/dsa/mv88e6xxx/chip.c | 39 +++++++++------------------------ drivers/net/dsa/mv88e6xxx/global1.h | 3 +++ drivers/net/dsa/mv88e6xxx/global1_vtu.c | 33 ++++++++++++++++++++++++++++ 4 files changed, 47 insertions(+), 29 deletions(-) commit bd00e053ae29d3215a9085b5c0add7298bbc417c Author: Vivien Didelot Date: Mon May 1 14:05:11 2017 -0400 net: dsa: mv88e6xxx: split VTU entry data member VLAN aware Marvell chips can program 802.1Q VLAN membership as well as 802.1s per VLAN Spanning Tree state using the same 3 VTU Data registers. Some chips such as 88E6185 use different Data registers offsets for ports state and membership, and program them in a single operation. Other chips such as 88E6352 use the same register layout but program them in distinct operations (an indirect table is used for 802.1s.) Newer chips such as 88E6390 use the same offsets for both state and membership in distinct operations, thus require multiple data accesses. To correctly abstract this, split the "data" structure member of mv88e6xxx_vtu_entry in two "state" and "member" members, before adding VTU support for newer chips. Signed-off-by: Vivien Didelot Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx/chip.c | 21 +++++++++++---------- drivers/net/dsa/mv88e6xxx/mv88e6xxx.h | 3 ++- 2 files changed, 13 insertions(+), 11 deletions(-) commit 3cf3c8469f70d18f8bbcdf8361e62812ebc571cd Author: Vivien Didelot Date: Mon May 1 14:05:10 2017 -0400 net: dsa: mv88e6xxx: add max VID to info Some chips don't have a VLAN Table Unit, most of them do have a 4K table, some others as the 88E6390 family has a 13th bit for the VID. Add a new max_vid member to the info structure, used to check the presence of a VTU as well as the value used to iterate from in VTU GetNext operations. This makes the MV88E6XXX_FLAG_VTU obsolete, thus remove it. Signed-off-by: Vivien Didelot Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller drivers/net/dsa/mv88e6xxx/chip.c | 38 ++++++++++++++++++++++++++--------- drivers/net/dsa/mv88e6xxx/mv88e6xxx.h | 13 ++---------- 2 files changed, 31 insertions(+), 20 deletions(-) commit 152afb9b45a8af4a93699a15925c392a28182a26 Author: Ilan Tayari Date: Sun Apr 30 16:51:19 2017 +0300 xfrm: Indicate xfrm_state offload errors Current code silently ignores driver errors when configuring IPSec offload xfrm_state, and falls back to host-based crypto. Fail the xfrm_state creation if the driver has an error, because the NIC offloading was explicitly requested by the user program. This will communicate back to the user that there was an error. Fixes: d77e38e612a0 ("xfrm: Add an IPsec hardware offloading API") Signed-off-by: Ilan Tayari Signed-off-by: David S. Miller net/xfrm/xfrm_user.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit 67d349ed603d5ce4a6f1722b1736e2bcef0e8690 Author: Ilan Tayari Date: Sun Apr 30 16:34:38 2017 +0300 net/esp4: Fix invalid esph pointer crash Both esp_output and esp_xmit take a pointer to the ESP header and place it in esp_info struct prior to calling esp_output_head. Inside esp_output_head, the call to esp_output_udp_encap makes sure to update the pointer if it gets invalid. However, if esp_output_head itself calls skb_cow_data, the pointer is not updated and stays invalid, causing a crash after esp_output_head returns. Update the pointer if it becomes invalid in esp_output_head Fixes: fca11ebde3f0 ("esp4: Reorganize esp_output") Signed-off-by: Ilan Tayari Signed-off-by: David S. Miller net/ipv4/esp4.c | 1 + 1 file changed, 1 insertion(+) commit 0a49f2c31c3efbeb0de3e4b5598764887f629be2 Author: Sagi Grimberg Date: Sun Apr 23 14:31:42 2017 +0300 mlx5: Fix mlx5_ib_map_mr_sg mr length In case we got an initial sg_offset, we need to account for it in the mr length. Cc: stable@vger.kernel.org Fixes: ff2ba9936591 ("IB/core: Add passing an offset into the SG to ib_map_mr_sg") Signed-off-by: Sagi Grimberg Tested-by: Israel Rukshin Signed-off-by: Doug Ledford drivers/infiniband/hw/mlx5/mr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 89a23c8b528bd2c89f3981573d6cd7d23840c8a6 Author: Craig Gallek Date: Wed Apr 26 14:37:45 2017 -0400 ip6_tunnel: Fix missing tunnel encapsulation limit option The IPv6 tunneling code tries to insert IPV6_TLV_TNL_ENCAP_LIMIT and IPV6_TLV_PADN options when an encapsulation limit is defined (the default is a limit of 4). An MTU adjustment is done to account for these options as well. However, the options are never present in the generated packets. The issue appears to be a subtlety between IPV6_DSTOPTS and IPV6_RTHDRDSTOPTS defined in RFC 3542. When the IPIP tunnel driver was written, the encap limit options were included as IPV6_RTHDRDSTOPTS in dst0opt of struct ipv6_txoptions. Later, ipv6_push_nfrags_opts was (correctly) updated to require IPV6_RTHDR options when IPV6_RTHDRDSTOPTS are to be used. This caused the options to no longer be included in v6 encapsulated packets. The fix is to use IPV6_DSTOPTS (in dst1opt of struct ipv6_txoptions) instead. IPV6_DSTOPTS do not have the additional IPV6_RTHDR requirement. Fixes: 1df64a8569c7: ("[IPV6]: Add ip6ip6 tunnel driver.") Fixes: 333fad5364d6: ("[IPV6]: Support several new sockopt / ancillary data in Advanced API (RFC3542)") Signed-off-by: Craig Gallek Signed-off-by: David S. Miller net/ipv6/ip6_tunnel.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit cdbfbba98c151886a8e74116fbd8ba14e8200cb4 Merge: 89d1cf8 09d9d82 Author: Linus Torvalds Date: Mon May 1 11:50:57 2017 -0700 Merge tag 'hwmon-for-linus-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon updates from Guenter Roeck: - removed twl4030-madc driver - added ASPEED PWM/fan driver - various minor improvements and fixes in several drivers * tag 'hwmon-for-linus-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (36 commits) hwmon: (twl4030-madc) drop driver hwmon: (tmp103) Use SIMPLE_DEV_PM_OPS helper macro hwmon: (adt7475) set start bit in probe hwmon: (ina209) Handled signed registers hwmon: (lm87) Add OF device ID table hwmon: (lm87) Remove unused I2C devices driver_data drivers: hwmon: Support for ASPEED PWM/Fan tach Documentation: dt-bindings: Document bindings for ASPEED AST2400/AST2500 PWM and Fan tach controller device driver hwmon: (lm87) Allow channel data to be set from dts file Documentation: dtb: lm87: Add hwmon binding documentation hwmon: (ads7828) Accept optional parameters from device tree hwmon: (dell-smm) Add Dell XPS 15 9560 into DMI list hwmon: Constify str parameter of hwmon_ops->read_string dt: Add vendor prefix for Sensirion hwmon: (tmp421) Add OF device ID table hwmon: (tmp103) Add OF device ID table hwmon: (tmp102) Add OF device ID table hwmon: (stts751) Add OF device ID table hwmon: (ucd9200) Add OF device ID table hwmon: (ucd9000) Add OF device ID table ... commit a6a5993243550b09f620941dea741b7421fdf79c Author: Ding Tianhong Date: Sat Apr 29 10:38:48 2017 +0800 iov_iter: don't revert iov buffer if csum error The patch 327868212381 (make skb_copy_datagram_msg() et.al. preserve ->msg_iter on error) will revert the iov buffer if copy to iter failed, but it didn't copy any datagram if the skb_checksum_complete error, so no need to revert any data at this place. v2: Sabrina notice that return -EFAULT when checksum error is not correct here, it would confuse the caller about the return value, so fix it. Fixes: 327868212381 ("make skb_copy_datagram_msg() et.al. preserve->msg_iter on error") Cc: stable@vger.kernel.org # v4.11 Signed-off-by: Ding Tianhong Acked-by: Al Viro Signed-off-by: Wei Yongjun Signed-off-by: Al Viro net/core/datagram.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) commit 8b03d1ed2c43a2ba5ef3381322ee4515b97381bf Merge: 73ba2d5 271393b Author: Dave Airlie Date: Tue May 2 04:46:01 2017 +1000 Merge branch 'linux-4.12' of git://github.com/skeggsb/linux into drm-next Some nouveau regression fixes. * 'linux-4.12' of git://github.com/skeggsb/linux: drm/nouveau/fb/gf100-: Fix 32 bit wraparound in new ram detection drm/nouveau/secboot/gm20b: fix the error return code in gm20b_secboot_tegra_read_wpr() drm/nouveau/kms: Increase max retries in scanout position queries. drm/nouveau/bios/bitP: check that table is long enough for optional pointers drm/nouveau/fifo/nv40: no ctxsw for pre-nv44 mpeg engine commit d52418502e288b5c7e9e2e6cf1de5f1d3d79d2e1 Author: Johannes Thumshirn Date: Thu Apr 6 14:49:44 2017 +0200 IB/rxe: Don't clamp residual length to mtu When reading a RDMA WRITE FIRST packet we copy the DMA length from the RDMA header into the qp->resp.resid variable for later use. Later in check_rkey() we clamp it to the MTU if the packet is an RDMA WRITE packet and has a residual length bigger than the MTU. Later in write_data_in() we subtract the payload of the packet from the residual length. If the packet happens to have a payload of exactly the MTU size we end up with a residual length of 0 despite the packet not being the last in the conversation. When the next packet in the conversation arrives, we don't have any residual length left and thus set the QP into an error state. This broke NVMe over Fabrics functionality over rdma_rxe.ko The patch was verified using the following test. # echo eth0 > /sys/module/rdma_rxe/parameters/add # nvme connect -t rdma -a 192.168.155.101 -s 1023 -n nvmf-test # mkfs.xfs -fK /dev/nvme0n1 meta-data=/dev/nvme0n1 isize=256 agcount=4, agsize=65536 blks = sectsz=4096 attr=2, projid32bit=1 = crc=0 finobt=0, sparse=0 data = bsize=4096 blocks=262144, imaxpct=25 = sunit=0 swidth=0 blks naming =version 2 bsize=4096 ascii-ci=0 ftype=1 log =internal log bsize=4096 blocks=2560, version=2 = sectsz=4096 sunit=1 blks, lazy-count=1 realtime =none extsz=4096 blocks=0, rtextents=0 # mount /dev/nvme0n1 /tmp/ [ 148.923263] XFS (nvme0n1): Mounting V4 Filesystem [ 148.961196] XFS (nvme0n1): Ending clean mount # dd if=/dev/urandom of=test.bin bs=1M count=128 128+0 records in 128+0 records out 134217728 bytes (134 MB, 128 MiB) copied, 0.437991 s, 306 MB/s # sha256sum test.bin cde42941f045efa8c4f0f157ab6f29741753cdd8d1cff93a6b03649d83c4129a test.bin # cp test.bin /tmp/ sha256sum /tmp/test.bin cde42941f045efa8c4f0f157ab6f29741753cdd8d1cff93a6b03649d83c4129a /tmp/test.bin Signed-off-by: Johannes Thumshirn Cc: Hannes Reinecke Cc: Sagi Grimberg Cc: Max Gurtovoy Acked-by: Moni Shoua Signed-off-by: Doug Ledford drivers/infiniband/sw/rxe/rxe_resp.c | 2 -- 1 file changed, 2 deletions(-) commit 4c33bd1926ccbfad362d22208c23cc045c5c82af Author: Dasaratharaman Chandramouli Date: Thu Apr 27 19:06:02 2017 -0400 IB/SA: Add support to query OPA path records When the bit 26 of capmask2 field in OPA classport info query is set, SA will query for OPA path records instead of querying for IB path records. Note that OPA path records can only be queried by kernel ULPs. Userspace clients continue to query IB path records. Reviewed-by: Don Hiatt Reviewed-by: Ira Weiny Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Doug Ledford drivers/infiniband/core/cma.c | 6 +- drivers/infiniband/core/sa_query.c | 274 ++++++++++++++++++++++++++++-- drivers/infiniband/ulp/ipoib/ipoib_main.c | 5 +- drivers/infiniband/ulp/srp/ib_srp.c | 6 +- include/rdma/ib_mad.h | 13 ++ 5 files changed, 285 insertions(+), 19 deletions(-) commit 57520751445b837c20a8e658e3dae3a7e7ddf45c Author: Dasaratharaman Chandramouli Date: Thu Apr 27 19:06:01 2017 -0400 IB/SA: Add OPA path record type Add opa_sa_path_rec to sa_path_rec data structure. The 'type' field in sa_path_rec identifies the type of the path record. Reviewed-by: Don Hiatt Reviewed-by: Ira Weiny Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Doug Ledford drivers/infiniband/core/cm.c | 34 ++++++--- drivers/infiniband/core/sa_query.c | 4 +- drivers/infiniband/core/ucma.c | 22 +++++- drivers/infiniband/core/uverbs_marshall.c | 40 ++++++++-- drivers/infiniband/ulp/ipoib/ipoib_fs.c | 2 +- drivers/infiniband/ulp/ipoib/ipoib_main.c | 14 ++-- drivers/infiniband/ulp/srp/ib_srp.c | 2 +- include/rdma/ib_sa.h | 121 +++++++++++++++++++++++++++--- 8 files changed, 197 insertions(+), 42 deletions(-) commit 9fdca4da4d8c83caefb9f2fd897d6a7bc355dfe6 Author: Dasaratharaman Chandramouli Date: Thu Apr 27 19:06:00 2017 -0400 IB/SA: Split struct sa_path_rec based on IB and ROCE specific fields sa_path_rec now contains a union of sa_path_rec_ib and sa_path_rec_roce based on the type of the path record. Note that fields applicable to path record type ROCE v1 and ROCE v2 fall under sa_path_rec_roce. Accessor functions are added to these fields so the caller doesn't have to know the type. Reviewed-by: Don Hiatt Reviewed-by: Ira Weiny Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Doug Ledford drivers/infiniband/core/cm.c | 62 +++++++------ drivers/infiniband/core/cma.c | 22 +++-- drivers/infiniband/core/sa_query.c | 39 +++++--- drivers/infiniband/core/uverbs_marshall.c | 20 ++-- drivers/infiniband/ulp/ipoib/ipoib_fs.c | 6 +- drivers/infiniband/ulp/ipoib/ipoib_main.c | 11 ++- drivers/infiniband/ulp/srp/ib_srp.c | 7 +- include/rdma/ib_sa.h | 147 +++++++++++++++++++++++++++--- 8 files changed, 230 insertions(+), 84 deletions(-) commit dfa834e1d97e24c7d6b7c5b102728d69d6361501 Author: Dasaratharaman Chandramouli Date: Thu Apr 27 19:05:59 2017 -0400 IB/SA: Introduce path record specific types struct sa_path_rec has a gid_type field. This patch introduces a more generic path record specific type 'rec_type' which is either IB, ROCE v1 or ROCE v2. The patch also provides conversion functions to get a gid type from a path record type and vice versa Reviewed-by: Don Hiatt Reviewed-by: Ira Weiny Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Doug Ledford drivers/infiniband/core/cm.c | 15 +++++++++++--- drivers/infiniband/core/cma.c | 16 +++++++++------ drivers/infiniband/core/sa_query.c | 14 ++++++++----- drivers/infiniband/core/uverbs_marshall.c | 2 +- include/rdma/ib_sa.h | 33 ++++++++++++++++++++++++++++++- 5 files changed, 64 insertions(+), 16 deletions(-) commit c2f8fc4ec4400901e5561d4815deca19f395deb6 Author: Dasaratharaman Chandramouli Date: Thu Apr 27 19:05:58 2017 -0400 IB/SA: Rename ib_sa_path_rec to sa_path_rec Rename ib_sa_path_rec to a more generic sa_path_rec. This is part of extending ib_sa to also support OPA path records in addition to the IB defined path records. Reviewed-by: Don Hiatt Reviewed-by: Ira Weiny Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Doug Ledford drivers/infiniband/core/cm.c | 20 ++++++++++---------- drivers/infiniband/core/cma.c | 8 ++++---- drivers/infiniband/core/sa_query.c | 20 ++++++++++---------- drivers/infiniband/core/ucm.c | 6 +++--- drivers/infiniband/core/ucma.c | 2 +- drivers/infiniband/core/uverbs_marshall.c | 4 ++-- drivers/infiniband/ulp/ipoib/ipoib.h | 2 +- drivers/infiniband/ulp/ipoib/ipoib_cm.c | 6 +++--- drivers/infiniband/ulp/ipoib/ipoib_main.c | 2 +- drivers/infiniband/ulp/srp/ib_srp.c | 2 +- drivers/infiniband/ulp/srp/ib_srp.h | 2 +- include/rdma/ib_cm.h | 14 +++++++------- include/rdma/ib_marshall.h | 4 ++-- include/rdma/ib_sa.h | 14 +++++++------- include/rdma/rdma_cm.h | 2 +- include/rdma/rdma_cm_ib.h | 2 +- 16 files changed, 55 insertions(+), 55 deletions(-) commit 82ffc226483cad8780c25c754da5d0013c88ff8c Author: Dasaratharaman Chandramouli Date: Thu Apr 27 19:05:57 2017 -0400 IB/CM: Add braces when using sizeof This patch adds braces around parameters to sizeof as called out by checkpatch Reviewed-by: Don Hiatt Reviewed-by: Ira Weiny Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Doug Ledford drivers/infiniband/core/cm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 89d1cf89c88f4684a51bd1f3e3aff0ae32572292 Merge: 08c521a f8d5549 Author: Linus Torvalds Date: Mon May 1 11:36:00 2017 -0700 Merge tag 'edac_for_4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp Pull EDAC updates from Borislav Petkov: - an EDAC driver for Cavium ThunderX RAS IP (Sergey Temerkhanov) - removal of DRAM error reporting through PCI SERR NMI (Borislav Petkov) - misc small fixes (Jan Glauber, Thor Thayer) * tag 'edac_for_4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp: EDAC, ghes: Do not enable it by default EDAC: Rename report status accessors EDAC: Delete edac_stub.c EDAC: Update Kconfig help text EDAC: Remove EDAC_MM_EDAC EDAC: Issue tracepoint only when it is defined ACPI/extlog: Add EDAC dependency EDAC: Move edac_op_state to edac_mc.c EDAC: Remove edac_err_assert EDAC: Get rid of edac_handlers x86/nmi, EDAC: Get rid of DRAM error reporting thru PCI SERR NMI EDAC, highbank: Align Makefile directives EDAC, thunderx: Remove unused code EDAC, thunderx: Change LMC index calculation EDAC, altera: Fix peripheral warnings for Cyclone5 EDAC, thunderx: Fix L2C MCI interrupt disable EDAC, thunderx: Add Cavium ThunderX EDAC driver commit f9ed236c2aed30eef4b2c8025973631714655301 Merge: d5066c4 71653eb Author: David S. Miller Date: Mon May 1 14:34:46 2017 -0400 Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next Johan Hedberg says: ==================== pull request: bluetooth-next 2017-04-30 Here's one last batch of Bluetooth patches in the bluetooth-next tree targeting the 4.12 kernel. - Remove custom ECDH implementation and use new KPP API instead - Add protocol checks to hci_ldisc - Add module license to HCI UART Nokia H4+ driver - Minor fix for 32bit user space - 64 bit kernel combination Please let me know if there are any issues pulling. Thanks. ==================== Signed-off-by: David S. Miller commit 64b4646eaf3dab4cc7b3040d10d565a83654446f Author: Dasaratharaman Chandramouli Date: Sat Apr 29 14:41:30 2017 -0400 IB/core: Define 'opa' rdma_ah_attr type OPA ah_attr types allows core components to specify attributes that may be specific to opa devices. For instance, opa type ah_attr provides 32 bit lids enabling larger OPA fabric sizes. Reviewed-by: Ira Weiny Reviewed-by: Don Hiatt Reviewed-by: Sean Hefty Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Doug Ledford include/rdma/ib_verbs.h | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) commit 44c58487d51a0dc43d96f1dc864f0461ec6a346a Author: Dasaratharaman Chandramouli Date: Sat Apr 29 14:41:29 2017 -0400 IB/core: Define 'ib' and 'roce' rdma_ah_attr types rdma_ah_attr can now be either ib or roce allowing core components to use one type or the other and also to define attributes unique to a specific type. struct ib_ah is also initialized with the type when its first created. This ensures that calls such as modify_ah dont modify the type of the address handle attribute. Reviewed-by: Ira Weiny Reviewed-by: Don Hiatt Reviewed-by: Sean Hefty Reviewed-by: Niranjana Vishwanathapura Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Doug Ledford drivers/infiniband/core/cm.c | 4 +- drivers/infiniband/core/multicast.c | 1 + drivers/infiniband/core/sa_query.c | 5 ++- drivers/infiniband/core/user_mad.c | 2 + drivers/infiniband/core/uverbs_cmd.c | 5 +++ drivers/infiniband/core/verbs.c | 13 ++++-- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 13 +++--- drivers/infiniband/hw/hfi1/verbs.c | 4 ++ drivers/infiniband/hw/hns/hns_roce_hw_v1.c | 2 +- drivers/infiniband/hw/mlx4/ah.c | 25 +++++------ drivers/infiniband/hw/mlx4/mad.c | 2 + drivers/infiniband/hw/mlx4/qp.c | 16 +++---- drivers/infiniband/hw/mlx5/ah.c | 22 +++++----- drivers/infiniband/hw/mlx5/qp.c | 7 +-- drivers/infiniband/hw/mthca/mthca_av.c | 1 + drivers/infiniband/hw/mthca/mthca_mad.c | 1 + drivers/infiniband/hw/mthca/mthca_qp.c | 1 + drivers/infiniband/hw/ocrdma/ocrdma.h | 2 +- drivers/infiniband/hw/ocrdma/ocrdma_ah.c | 6 ++- drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 1 + drivers/infiniband/hw/qedr/qedr_cm.c | 2 +- drivers/infiniband/hw/qedr/verbs.c | 1 + drivers/infiniband/hw/qib/qib_verbs.c | 2 + drivers/infiniband/hw/vmw_pvrdma/pvrdma_misc.c | 5 ++- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 9 ++-- drivers/infiniband/sw/rxe/rxe_av.c | 1 + drivers/infiniband/sw/rxe/rxe_verbs.c | 1 + drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 1 + drivers/infiniband/ulp/opa_vnic/opa_vnic_vema.c | 1 + include/rdma/ib_verbs.h | 58 ++++++++++++++++++++----- net/smc/smc_ib.c | 3 +- 31 files changed, 141 insertions(+), 76 deletions(-) commit d8966fcd4c25708c3a76ea7619644218373df639 Author: Dasaratharaman Chandramouli Date: Sat Apr 29 14:41:28 2017 -0400 IB/core: Use rdma_ah_attr accessor functions Modify core and driver components to use accessor functions introduced to access individual fields of rdma_ah_attr Reviewed-by: Ira Weiny Reviewed-by: Don Hiatt Reviewed-by: Sean Hefty Reviewed-by: Niranjana Vishwanathapura Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Doug Ledford drivers/infiniband/core/cm.c | 10 +- drivers/infiniband/core/cma.c | 3 +- drivers/infiniband/core/mad.c | 21 ++-- drivers/infiniband/core/mad_rmpp.c | 2 +- drivers/infiniband/core/multicast.c | 20 ++-- drivers/infiniband/core/sa_query.c | 40 ++++--- drivers/infiniband/core/user_mad.c | 32 +++--- drivers/infiniband/core/uverbs_cmd.c | 144 +++++++++++++----------- drivers/infiniband/core/uverbs_marshall.c | 25 ++-- drivers/infiniband/core/verbs.c | 45 ++++---- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 77 +++++++------ drivers/infiniband/hw/hfi1/driver.c | 4 +- drivers/infiniband/hw/hfi1/mad.c | 4 +- drivers/infiniband/hw/hfi1/qp.c | 12 +- drivers/infiniband/hw/hfi1/rc.c | 24 ++-- drivers/infiniband/hw/hfi1/ruc.c | 82 ++++++++------ drivers/infiniband/hw/hfi1/uc.c | 6 +- drivers/infiniband/hw/hfi1/ud.c | 51 +++++---- drivers/infiniband/hw/hfi1/verbs.c | 20 ++-- drivers/infiniband/hw/hfi1/verbs.h | 2 +- drivers/infiniband/hw/hns/hns_roce_ah.c | 57 ++++++---- drivers/infiniband/hw/hns/hns_roce_hw_v1.c | 115 ++++++++++--------- drivers/infiniband/hw/mlx4/ah.c | 115 +++++++++++-------- drivers/infiniband/hw/mlx4/mad.c | 43 ++++--- drivers/infiniband/hw/mlx4/mcg.c | 2 +- drivers/infiniband/hw/mlx4/qp.c | 92 +++++++-------- drivers/infiniband/hw/mlx5/ah.c | 54 +++++---- drivers/infiniband/hw/mlx5/qp.c | 86 +++++++------- drivers/infiniband/hw/mthca/mthca_av.c | 64 ++++++----- drivers/infiniband/hw/mthca/mthca_mad.c | 6 +- drivers/infiniband/hw/mthca/mthca_qp.c | 84 ++++++++------ drivers/infiniband/hw/ocrdma/ocrdma.h | 2 +- drivers/infiniband/hw/ocrdma/ocrdma_ah.c | 54 +++++---- drivers/infiniband/hw/ocrdma/ocrdma_hw.c | 21 ++-- drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 38 +++---- drivers/infiniband/hw/qedr/qedr.h | 11 +- drivers/infiniband/hw/qedr/qedr_cm.c | 15 +-- drivers/infiniband/hw/qedr/qedr_cm.h | 2 +- drivers/infiniband/hw/qedr/verbs.c | 44 ++++---- drivers/infiniband/hw/qib/qib_mad.c | 5 +- drivers/infiniband/hw/qib/qib_qp.c | 2 +- drivers/infiniband/hw/qib/qib_rc.c | 21 ++-- drivers/infiniband/hw/qib/qib_ruc.c | 72 +++++++----- drivers/infiniband/hw/qib/qib_uc.c | 6 +- drivers/infiniband/hw/qib/qib_ud.c | 53 +++++---- drivers/infiniband/hw/qib/qib_verbs.c | 12 +- drivers/infiniband/hw/qib/qib_verbs.h | 2 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_misc.c | 32 +++--- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 27 +++-- drivers/infiniband/sw/rdmavt/ah.c | 29 ++--- drivers/infiniband/sw/rdmavt/qp.c | 12 +- drivers/infiniband/sw/rxe/rxe_av.c | 24 ++-- drivers/infiniband/sw/rxe/rxe_qp.c | 12 +- drivers/infiniband/sw/rxe/rxe_verbs.c | 6 +- drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 59 +++++----- drivers/infiniband/ulp/opa_vnic/opa_vnic_vema.c | 10 +- net/smc/smc_ib.c | 8 +- 57 files changed, 1040 insertions(+), 881 deletions(-) commit 2224c47ace2387610f8cff0c562db2c6e63df026 Author: Dasaratharaman Chandramouli Date: Sat Apr 29 14:41:27 2017 -0400 IB/core: Add accessor functions for rdma_ah_attr fields These accessor functions are supposed to be used to get and set individual fields of struct rdma_ah_attr Reviewed-by: Ira Weiny Reviewed-by: Don Hiatt Reviewed-by: Sean Hefty Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Doug Ledford include/rdma/ib_verbs.h | 121 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 121 insertions(+) commit f988653a6b050bc4f24618222161681bf502b11c Author: Dasaratharaman Chandramouli Date: Sat Apr 29 14:41:26 2017 -0400 IB/PVRDMA: Rename ib_ah_attr related functions Functions pvrdma_ah_attr_to_ib and ib_ah_attr_to_pvrdma have been renamed so they are in sync wit the rename of the ib_ah_attr structure Reviewed-by: Ira Weiny Reviewed-by: Don Hiatt Reviewed-by: Sean Hefty Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Doug Ledford drivers/infiniband/hw/vmw_pvrdma/pvrdma.h | 8 ++++---- drivers/infiniband/hw/vmw_pvrdma/pvrdma_misc.c | 8 ++++---- drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c | 8 ++++---- 3 files changed, 12 insertions(+), 12 deletions(-) commit 766b7f6cf0c0bc3a74403074b78c1a2f26cb3fd1 Author: Dasaratharaman Chandramouli Date: Sat Apr 29 14:41:25 2017 -0400 IB/mthca: Rename to_ib_ah_attr to to_rdma_ah_attr local function to_ib_ah_attr is renamed so it in sync with the rename of the ib_ah_attr structure Reviewed-by: Ira Weiny Reviewed-by: Don Hiatt Reviewed-by: Sean Hefty Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Doug Ledford drivers/infiniband/hw/mthca/mthca_qp.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 38349389fece9dc1509f43791e086009a1b79db4 Author: Dasaratharaman Chandramouli Date: Sat Apr 29 14:41:24 2017 -0400 IB/mlx5: Rename to_ib_ah_attr to to_rdma_ah_attr local function to_ib_ah_attr is renamed so it in sync with the rename of the ib_ah_attr structure Reviewed-by: Ira Weiny Reviewed-by: Don Hiatt Reviewed-by: Sean Hefty Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Doug Ledford drivers/infiniband/hw/mlx5/qp.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 71d53ab47ee6e1f54f98e03f28ee36353f8c7f31 Author: Dasaratharaman Chandramouli Date: Sat Apr 29 14:41:23 2017 -0400 IB/mlx4: Rename to_ib_ah_attr to to_rdma_ah_attr local function to_ib_ah_attr is renamed so it in sync with the rename of the ib_ah_attr structure Reviewed-by: Ira Weiny Reviewed-by: Don Hiatt Reviewed-by: Sean Hefty Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Doug Ledford drivers/infiniband/hw/mlx4/qp.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 365231593409fb79b11dd9bfcc27a29090bf9de6 Author: Dasaratharaman Chandramouli Date: Sat Apr 29 14:41:22 2017 -0400 IB/core: Rename ib_destroy_ah to rdma_destroy_ah Rename ib_destroy_ah to rdma_destroy_ah so its in sync with the rename of the ib address handle attribute Reviewed-by: Ira Weiny Reviewed-by: Don Hiatt Reviewed-by: Sean Hefty Reviewed-by: Niranjana Vishwanathapura Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Doug Ledford drivers/infiniband/core/agent.c | 4 ++-- drivers/infiniband/core/cm.c | 6 +++--- drivers/infiniband/core/mad_rmpp.c | 10 +++++----- drivers/infiniband/core/sa_query.c | 2 +- drivers/infiniband/core/user_mad.c | 4 ++-- drivers/infiniband/core/uverbs_cmd.c | 2 +- drivers/infiniband/core/uverbs_std_types.c | 2 +- drivers/infiniband/core/verbs.c | 4 ++-- drivers/infiniband/hw/mlx4/mad.c | 24 ++++++++++++------------ drivers/infiniband/hw/mthca/mthca_mad.c | 4 ++-- drivers/infiniband/hw/qib/qib_mad.c | 2 +- drivers/infiniband/sw/rdmavt/mad.c | 2 +- drivers/infiniband/ulp/ipoib/ipoib_ib.c | 2 +- drivers/infiniband/ulp/opa_vnic/opa_vnic_vema.c | 6 +++--- drivers/infiniband/ulp/srpt/ib_srpt.c | 4 ++-- include/rdma/ib_verbs.h | 4 ++-- 16 files changed, 41 insertions(+), 41 deletions(-) commit bfbfd661c9ea2cceb5bb4de8b280ac8a37cf68c2 Author: Dasaratharaman Chandramouli Date: Sat Apr 29 14:41:21 2017 -0400 IB/core: Rename ib_query_ah to rdma_query_ah Rename ib_query_ah to rdma_query_ah so its in sync with the rename of the ib address handle attribute Reviewed-by: Ira Weiny Reviewed-by: Don Hiatt Reviewed-by: Sean Hefty Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Doug Ledford drivers/infiniband/core/mad.c | 2 +- drivers/infiniband/core/mad_rmpp.c | 2 +- drivers/infiniband/core/verbs.c | 4 ++-- drivers/infiniband/hw/mlx4/mcg.c | 2 +- include/rdma/ib_verbs.h | 4 ++-- 5 files changed, 7 insertions(+), 7 deletions(-) commit 67b985b6c75530bd3dccd55d61d2c9027ab2ca38 Author: Dasaratharaman Chandramouli Date: Sat Apr 29 14:41:20 2017 -0400 IB/core: Rename ib_modify_ah to rdma_modify_ah Rename ib_modify_ah to rdma_modify_ah so its in sync with the rename of the ib address handle attribute Reviewed-by: Ira Weiny Reviewed-by: Don Hiatt Reviewed-by: Sean Hefty Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Doug Ledford drivers/infiniband/core/verbs.c | 4 ++-- include/rdma/ib_verbs.h | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) commit 0a18cfe4f6d7dba135a04dc18633006ba5b51646 Author: Dasaratharaman Chandramouli Date: Sat Apr 29 14:41:19 2017 -0400 IB/core: Rename ib_create_ah to rdma_create_ah Rename ib_create_ah to rdma_create_ah so its in sync with the rename of the ib address handle attribute Reviewed-by: Ira Weiny Reviewed-by: Don Hiatt Reviewed-by: Sean Hefty Reviewed-by: Niranjana Vishwanathapura Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Doug Ledford drivers/infiniband/core/cm.c | 2 +- drivers/infiniband/core/sa_query.c | 2 +- drivers/infiniband/core/user_mad.c | 2 +- drivers/infiniband/core/verbs.c | 6 +++--- drivers/infiniband/hw/hfi1/verbs.c | 2 +- drivers/infiniband/hw/mlx4/mad.c | 8 ++++---- drivers/infiniband/hw/mthca/mthca_mad.c | 4 ++-- drivers/infiniband/hw/qib/qib_verbs.c | 2 +- drivers/infiniband/ulp/ipoib/ipoib_ib.c | 2 +- drivers/infiniband/ulp/opa_vnic/opa_vnic_vema.c | 2 +- include/rdma/ib_verbs.h | 4 ++-- 11 files changed, 18 insertions(+), 18 deletions(-) commit 90898850ec4e7b3ba0f9a35cc7169ff19ff367a6 Author: Dasaratharaman Chandramouli Date: Sat Apr 29 14:41:18 2017 -0400 IB/core: Rename struct ib_ah_attr to rdma_ah_attr This patch simply renames struct ib_ah_attr to rdma_ah_attr as these fields specify attributes that are not necessarily specific to IB. Reviewed-by: Ira Weiny Reviewed-by: Don Hiatt Reviewed-by: Niranjana Vishwanathapura Reviewed-by: Sean Hefty Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Doug Ledford drivers/infiniband/core/cm.c | 2 +- drivers/infiniband/core/mad.c | 2 +- drivers/infiniband/core/mad_rmpp.c | 2 +- drivers/infiniband/core/multicast.c | 2 +- drivers/infiniband/core/sa_query.c | 5 +++-- drivers/infiniband/core/user_mad.c | 4 ++-- drivers/infiniband/core/uverbs_cmd.c | 2 +- drivers/infiniband/core/uverbs_marshall.c | 2 +- drivers/infiniband/core/verbs.c | 12 ++++++------ drivers/infiniband/hw/bnxt_re/ib_verbs.c | 6 +++--- drivers/infiniband/hw/bnxt_re/ib_verbs.h | 6 +++--- drivers/infiniband/hw/cxgb3/iwch_provider.c | 2 +- drivers/infiniband/hw/cxgb4/provider.c | 2 +- drivers/infiniband/hw/hfi1/ud.c | 4 ++-- drivers/infiniband/hw/hfi1/verbs.c | 8 ++++---- drivers/infiniband/hw/hfi1/verbs.h | 2 +- drivers/infiniband/hw/hns/hns_roce_ah.c | 5 +++-- drivers/infiniband/hw/hns/hns_roce_device.h | 5 +++-- drivers/infiniband/hw/i40iw/i40iw_verbs.c | 2 +- drivers/infiniband/hw/mlx4/ah.c | 10 ++++++---- drivers/infiniband/hw/mlx4/mad.c | 10 +++++----- drivers/infiniband/hw/mlx4/mcg.c | 4 ++-- drivers/infiniband/hw/mlx4/mlx4_ib.h | 6 +++--- drivers/infiniband/hw/mlx4/qp.c | 8 +++++--- drivers/infiniband/hw/mlx5/ah.c | 6 +++--- drivers/infiniband/hw/mlx5/mlx5_ib.h | 4 ++-- drivers/infiniband/hw/mlx5/qp.c | 7 ++++--- drivers/infiniband/hw/mthca/mthca_av.c | 4 ++-- drivers/infiniband/hw/mthca/mthca_dev.h | 4 ++-- drivers/infiniband/hw/mthca/mthca_mad.c | 2 +- drivers/infiniband/hw/mthca/mthca_provider.c | 2 +- drivers/infiniband/hw/mthca/mthca_qp.c | 7 ++++--- drivers/infiniband/hw/nes/nes_verbs.c | 3 ++- drivers/infiniband/hw/ocrdma/ocrdma.h | 2 +- drivers/infiniband/hw/ocrdma/ocrdma_ah.c | 8 ++++---- drivers/infiniband/hw/ocrdma/ocrdma_ah.h | 6 +++--- drivers/infiniband/hw/ocrdma/ocrdma_hw.c | 2 +- drivers/infiniband/hw/qedr/qedr.h | 4 ++-- drivers/infiniband/hw/qedr/qedr_cm.c | 2 +- drivers/infiniband/hw/qedr/verbs.c | 2 +- drivers/infiniband/hw/qedr/verbs.h | 2 +- drivers/infiniband/hw/qib/qib_ud.c | 4 ++-- drivers/infiniband/hw/qib/qib_verbs.c | 6 +++--- drivers/infiniband/hw/qib/qib_verbs.h | 2 +- drivers/infiniband/hw/usnic/usnic_ib_verbs.c | 2 +- drivers/infiniband/hw/usnic/usnic_ib_verbs.h | 2 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma.h | 4 ++-- drivers/infiniband/hw/vmw_pvrdma/pvrdma_misc.c | 4 ++-- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +- drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.h | 2 +- drivers/infiniband/sw/rdmavt/ah.c | 8 ++++---- drivers/infiniband/sw/rdmavt/ah.h | 6 +++--- drivers/infiniband/sw/rxe/rxe_av.c | 8 ++++---- drivers/infiniband/sw/rxe/rxe_loc.h | 8 ++++---- drivers/infiniband/sw/rxe/rxe_verbs.c | 9 +++++---- drivers/infiniband/ulp/ipoib/ipoib.h | 2 +- drivers/infiniband/ulp/ipoib/ipoib_ib.c | 2 +- drivers/infiniband/ulp/ipoib/ipoib_main.c | 2 +- drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 2 +- drivers/infiniband/ulp/opa_vnic/opa_vnic_vema.c | 2 +- include/rdma/ib_marshall.h | 2 +- include/rdma/ib_sa.h | 4 ++-- include/rdma/ib_verbs.h | 22 +++++++++++----------- include/rdma/rdma_cm.h | 2 +- include/rdma/rdma_vt.h | 8 ++++---- include/rdma/rdmavt_qp.h | 4 ++-- 66 files changed, 155 insertions(+), 144 deletions(-) commit eca7ddf965e0d6b0b1e4e6dea207f2015b65d367 Author: Dasaratharaman Chandramouli Date: Sat Apr 29 14:41:17 2017 -0400 IB/rxe: Initialize ib_ah_attr during query_ah Zero out ib_ah_attr before calling query_ah. Set ah_flags appropriately. Reviewed-by: Ira Weiny Reviewed-by: Don Hiatt Reviewed-by: Sean Hefty Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Doug Ledford drivers/infiniband/sw/rxe/rxe_av.c | 1 + drivers/infiniband/sw/rxe/rxe_verbs.c | 1 + 2 files changed, 2 insertions(+) commit 4ba66093bdc6316cd2fe48e74a54bfc29599322f Author: Dasaratharaman Chandramouli Date: Sat Apr 29 14:41:16 2017 -0400 IB/core: Check for global flag when using ah_attr Read/write grh fields of the ah_attr only if the ah_flags field has the IB_AH_GRH bit enabled Reviewed-by: Ira Weiny Reviewed-by: Don Hiatt Reviewed-by: Sean Hefty Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Doug Ledford drivers/infiniband/core/uverbs_cmd.c | 80 +++++++++++++++++++------------ drivers/infiniband/core/uverbs_marshall.c | 12 +++-- 2 files changed, 57 insertions(+), 35 deletions(-) commit cf0b9395d084c0710a10e3e4ee8d6b4c87dfcd2d Author: Dasaratharaman Chandramouli Date: Sat Apr 29 14:41:15 2017 -0400 IB/core: Add braces when using sizeof This patch adds braces around parameters to sizeof as called out by checkpatch Reviewed-by: Don Hiatt Reviewed-by: Ira Weiny Reviewed-by: Sean Hefty Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Doug Ledford drivers/infiniband/core/uverbs_marshall.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cfd519358f50e55d304eaf6539ebb07bdc3ac813 Author: Dasaratharaman Chandramouli Date: Sat Apr 29 14:41:14 2017 -0400 IB/IPoIB: Remove 'else' when the 'if' has a return. This patch fixes a checkpatch issue related to not having to use an 'else' if the 'if' path returns from the function. Reviewed-by: Ira Weiny Reviewed-by: Don Hiatt Reviewed-by: Sean Hefty Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Doug Ledford drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) commit bef4211a7205e14c5355e51275846877cba82a04 Author: Dasaratharaman Chandramouli Date: Sat Apr 29 14:41:13 2017 -0400 IB/ocrdma: Add identifier names to function definitions Address a checkpatch issue on missing identifier names on function definitions. Reviewed-by: Ira Weiny Reviewed-by: Don Hiatt Reviewed-by: Sean Hefty Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Doug Ledford drivers/infiniband/hw/ocrdma/ocrdma_ah.h | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 08c521a2011ff492490aa9ed6cc574be4235ce2b Merge: 6947529 b06e13c Author: Linus Torvalds Date: Mon May 1 11:22:35 2017 -0700 Merge branch 'for-4.12/post-merge' of git://git.kernel.dk/linux-block Pull second round of block layer updates from Jens Axboe: - Further fixups to the NVMe APST code, from Andy. - Various fixes for (mostly) nvme-fc, from Christoph and James. - NVMe scsi fixes from Jon and Christoph. * 'for-4.12/post-merge' of git://git.kernel.dk/linux-block: (39 commits) nvme-scsi: remove nvme_trans_security_protocol nvme-lightnvm: add missing endianess conversion in nvme_nvm_end_io nvme-scsi: Consider LBA format in IO splitting calculation nvme-fc: avoid memory corruption caused by calling nvmf_free_options() twice lpfc: Fix memory corruption of the lpfc_ncmd->list pointers nvme: Add nvme_core.force_apst to ignore the NO_APST quirk nvme: Display raw APST configuration via DYNAMIC_DEBUG nvme: Fix APST comment lpfc revison 11.2.0.12 Fix Express lane queue creation. Update ABORT processing for NVMET. Fix implicit logo and RSCN handling for NVMET Add Fabric assigned WWN support. Fix max_sgl_segments settings for NVME / NVMET Fix crash after issuing lip reset Fix driver load issues when MRQ=8 Remove hba lock from NVMET issue WQE. Fix nvme initiator handling when not enabled. Fix driver usage of 128B WQEs when WQ_CREATE is V1. Fix driver unload/reload operation. ... commit 0119dc6132d2110df8f3545bd0ffe29aa0752d6b Author: Dan Carpenter Date: Sat Apr 22 13:43:33 2017 +0300 clk: x86: pmc-atom: Checking for IS_ERR() instead of NULL clkdev_hw_create() returns NULLs on error, it doesn't return error pointers. Fixes: 41ee7caf59e1 ("clk: x86: add "mclk" alias for Baytrail/Cherrytrail") Signed-off-by: Dan Carpenter Acked-by: Pierre-Louis Bossart Signed-off-by: Stephen Boyd drivers/clk/x86/clk-pmc-atom.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit d5066c467ee3b8eb8716e776584b3953a0bb218a Author: Liam Beguin Date: Mon May 1 11:02:01 2017 -0400 switchdev: documentation: fix whitespace issues Figure 1 is full of whitespaces; fix it Signed-off-by: Liam Beguin Signed-off-by: Sylvain Lemieux Acked-by: Ivan Vecera Signed-off-by: David S. Miller Documentation/networking/switchdev.txt | 70 +++++++++++++++++----------------- 1 file changed, 35 insertions(+), 35 deletions(-) commit 694752922b12bd318aa80191bd9d8c3dcfb39055 Merge: a351e9b 9438b3e Author: Linus Torvalds Date: Mon May 1 10:39:57 2017 -0700 Merge branch 'for-4.12/block' of git://git.kernel.dk/linux-block Pull block layer updates from Jens Axboe: - Add BFQ IO scheduler under the new blk-mq scheduling framework. BFQ was initially a fork of CFQ, but subsequently changed to implement fairness based on B-WF2Q+, a modified variant of WF2Q. BFQ is meant to be used on desktop type single drives, providing good fairness. From Paolo. - Add Kyber IO scheduler. This is a full multiqueue aware scheduler, using a scalable token based algorithm that throttles IO based on live completion IO stats, similary to blk-wbt. From Omar. - A series from Jan, moving users to separately allocated backing devices. This continues the work of separating backing device life times, solving various problems with hot removal. - A series of updates for lightnvm, mostly from Javier. Includes a 'pblk' target that exposes an open channel SSD as a physical block device. - A series of fixes and improvements for nbd from Josef. - A series from Omar, removing queue sharing between devices on mostly legacy drivers. This helps us clean up other bits, if we know that a queue only has a single device backing. This has been overdue for more than a decade. - Fixes for the blk-stats, and improvements to unify the stats and user windows. This both improves blk-wbt, and enables other users to register a need to receive IO stats for a device. From Omar. - blk-throttle improvements from Shaohua. This provides a scalable framework for implementing scalable priotization - particularly for blk-mq, but applicable to any type of block device. The interface is marked experimental for now. - Bucketized IO stats for IO polling from Stephen Bates. This improves efficiency of polled workloads in the presence of mixed block size IO. - A few fixes for opal, from Scott. - A few pulls for NVMe, including a lot of fixes for NVMe-over-fabrics. From a variety of folks, mostly Sagi and James Smart. - A series from Bart, improving our exposed info and capabilities from the blk-mq debugfs support. - A series from Christoph, cleaning up how handle WRITE_ZEROES. - A series from Christoph, cleaning up the block layer handling of how we track errors in a request. On top of being a nice cleanup, it also shrinks the size of struct request a bit. - Removal of mg_disk and hd (sorry Linus) by Christoph. The former was never used by platforms, and the latter has outlived it's usefulness. - Various little bug fixes and cleanups from a wide variety of folks. * 'for-4.12/block' of git://git.kernel.dk/linux-block: (329 commits) block: hide badblocks attribute by default blk-mq: unify hctx delay_work and run_work block: add kblock_mod_delayed_work_on() blk-mq: unify hctx delayed_run_work and run_work nbd: fix use after free on module unload MAINTAINERS: bfq: Add Paolo as maintainer for the BFQ I/O scheduler blk-mq-sched: alloate reserved tags out of normal pool mtip32xx: use runtime tag to initialize command header scsi: Implement blk_mq_ops.show_rq() blk-mq: Add blk_mq_ops.show_rq() blk-mq: Show operation, cmd_flags and rq_flags names blk-mq: Make blk_flags_show() callers append a newline character blk-mq: Move the "state" debugfs attribute one level down blk-mq: Unregister debugfs attributes earlier blk-mq: Only unregister hctxs for which registration succeeded blk-mq-debugfs: Rename functions for registering and unregistering the mq directory blk-mq: Let blk_mq_debugfs_register() look up the queue name blk-mq: Register /queue/mq after having registered /queue ide-pm: always pass 0 error to ide_complete_rq in ide_do_devset ide-pm: always pass 0 error to __blk_end_request_all .. commit 062b1c19b879e7831cbceb599ab1d758f87eda40 Author: Max Filippov Date: Tue Jan 27 01:15:10 2015 +0300 xtensa: clean up access to spilled registers locations Define macros SPILL_SLOT* that return a reference to the stack location of the spill slot for specific register and use them instead of opencoded address calculations. Signed-off-by: Max Filippov arch/xtensa/include/asm/processor.h | 15 +++++++++++++++ arch/xtensa/kernel/process.c | 8 ++++---- arch/xtensa/kernel/signal.c | 10 +++++----- arch/xtensa/kernel/stacktrace.c | 35 ++++++++--------------------------- 4 files changed, 32 insertions(+), 36 deletions(-) commit a3e9af95f794d000debc2a5ba3186ba85a6e115f Author: Dan Williams Date: Mon May 1 10:00:02 2017 -0700 libnvdimm: restore "libnvdimm: band aid btt vs clear poison locking" This continues the 4.11 status quo of disabling of error clearing from the BTT I/O path. Toshi found that even though we have eliminated all the libnvdimm sources of sleeping-while-atomic triggers, we still have sleeping operations that will occur in the path to send the ACPI DSM to the DIMM to clear the error: BUG: sleeping function called from invalid context at mm/slab.h:432 in_atomic(): 1, irqs_disabled(): 0, pid: 13353, name: dd Call Trace: dump_stack+0x86/0xc3 ___might_sleep+0x17d/0x250 __might_sleep+0x4a/0x80 __kmalloc+0x1c0/0x2e0 acpi_os_allocate_zeroed+0x2d/0x2f acpi_evaluate_object+0x59/0x3b1 acpi_evaluate_dsm+0xbd/0x10c acpi_nfit_ctl+0x1ef/0x7c0 [nfit] ? nsio_rw_bytes+0x152/0x280 nvdimm_clear_poison+0x77/0x140 nsio_rw_bytes+0x18f/0x280 btt_write_pg+0x1d4/0x3d0 [nd_btt] btt_make_request+0x119/0x2d0 [nd_btt] A solution for tracking and handling media errors natively in the BTT is needed. Cc: Jeff Moyer Cc: Dave Jiang Cc: Vishal Verma Reported-by: Toshi Kani Signed-off-by: Dan Williams drivers/nvdimm/claim.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) commit 61e29ec1c96f67605217c2a80441a75ff906db62 Author: Sebastian Reichel Date: Fri Apr 28 10:27:37 2017 -0700 Input: twl4030-pwrbutton - use input_set_capability() helper Cleanup driver slightly by using input_set_capability() instead of manually setting the required bits. Signed-off-by: Sebastian Reichel Signed-off-by: Dmitry Torokhov drivers/input/misc/twl4030-pwrbutton.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 3071e9dd6cd3f2290d770117330f2c8b2e9a97e4 Author: Sebastian Reichel Date: Fri Apr 28 10:25:51 2017 -0700 Input: twl4030-pwrbutton - use correct device for irq request The interrupt should be requested for the platform device and not for the input device. Fixes: 7f9ce649d267 ("Input: twl4030-pwrbutton - simplify driver using devm_*") Signed-off-by: Sebastian Reichel Signed-off-by: Dmitry Torokhov drivers/input/misc/twl4030-pwrbutton.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e55057e82ad413603fd45eac3b83b80acde780e1 Author: Martin Kepplinger Date: Fri Apr 28 09:58:12 2017 -0700 Input: ar1021_i2c - enable touch mode during open The device could as well be in command mode, in which this driver cannot handle the device. When opening the device, let's make sure the device will be in the mode we expect it to be for this driver. Signed-off-by: Martin Kepplinger Signed-off-by: Dmitry Torokhov drivers/input/touchscreen/ar1021_i2c.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) commit b1e455260c9187b16dd4ebc428b817ebac322043 Author: Ido Schimmel Date: Sun Apr 30 19:47:14 2017 +0300 mlxsw: spectrum_router: Simplify VRF enslavement When a netdev is enslaved to a VRF master, its router interface (RIF) needs to be destroyed (if exists) and a new one created using the corresponding virtual router (VR). >From the driver's perspective, the above is equivalent to an inetaddr event sent for this netdev. Therefore, when a port netdev (or its uppers) are enslaved to a VRF master, call the same function that would've been called had a NETDEV_UP was sent for this netdev in the inetaddr notification chain. This patch also fixes a bug when a LAG netdev with an existing RIF is enslaved to a VRF. Before this patch, each LAG port would drop the reference on the RIF, but would re-join the same one (in the wrong VR) soon after. With this patch, the corresponding RIF is first destroyed and a new one is created using the correct VR. Fixes: 7179eb5acd59 ("mlxsw: spectrum_router: Add support for VRFs") Signed-off-by: Ido Schimmel Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 77 +++------------ drivers/net/ethernet/mellanox/mlxsw/spectrum.h | 10 +- .../net/ethernet/mellanox/mlxsw/spectrum_router.c | 107 +++++++++------------ 3 files changed, 63 insertions(+), 131 deletions(-) commit cedf90c0cc1250cfb95905b61dc36b37ec9d5395 Merge: 07ff2ed 0a0ab1d Author: David S. Miller Date: Mon May 1 11:47:10 2017 -0400 Merge tag 'mlx5-updates-2017-04-30' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux mlx5-updates-2017-04-30 Or says: ================ mlx5 neigh update This series (whose code name is 'neigh update') from Hadar, enhances the mlx5 TC IP tunnel offloads to deal with changes to tunnel destination neighbours used in offloaded flows which involved encapsulation. In order to keep track on the validity state of such neighbours, we register a netevent notifier callback and act on NEIGH_UPDATE events: if a neighbour becomes valid, offload the related flows to HW (the other way around when neigh becomes invalid) and similarly when a neigh mac addresses changes. Since this traffic is offloaded from the host OS, the neighbour for the IP tunnel destination can mistakenly become STALE and deleted by the kernel since its 'used' value wasn't changed. To address that, we proactively update the neighbour 'used' value every DELAY_PROBE_TIME seconds, using time stamps generated by the existing driver code for HW flow counters. We use the DELAY_PROBE_TIME_UPDATE event to adjust the frequency of the updates. Prior to the core of the series, there's a patch from Saeed that introduces an extendable vport representor implementation scheme. It provides a separation between the eswitch to the netdev related aspects of the representors. We would like to thank Ido Schimmel and Ilya Lesokhin for their coaching && advice through the long design and review cycles while we struggled to understand and (hopefully correctly) implement the locking around the different driver flows(..) . - Or. ================= Misc Updates: From Tariq: Some small performance and trivial code optimization for mlx5 netdev driver - Optimize poll ICOSQ completion queue - Use prefetchw when a write is to follow - Use u8 as ownership type in mlx5e_get_cqe() From Eran: - Disable LRO by default on specific setups From Eli: - Small cleanup for E-Switch to avoid redundant allocation Signed-off-by: David S. Miller commit 07ff2ed03bb874a5bb97361a5a07ee28f1afa574 Author: Mintz, Yuval Date: Sun Apr 30 12:14:44 2017 +0300 qed: Prevent warning without CONFIG_RFS_ACCEL After removing the PTP related initialization from slowpath start, the remaining PTT entry is required only in case CONFIG_RFS_ACCEL is set. Otherwise, it leads to a warning due to it being unused. Fixes: d179bd1699fc ("qed: Acquire/release ptt_ptp lock when enabling/disabling PTP") Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_main.c | 2 ++ 1 file changed, 2 insertions(+) commit a6e8ab8e729065f716790fb9429f53393f72d7b4 Merge: 332270f 20b1bd9 Author: David S. Miller Date: Mon May 1 11:42:16 2017 -0400 Merge branch 'qed-RoCE-fixes' Yuval Mintz says: ==================== qed: RoCE related pseudo-fixes This series contains multiple small corrections to the RoCE logic in qed plus some debug information and inter-module parameter meant to prevent issues further along. - #1, #6 Share information with protocol driver [either new or filling missing bits in existing API]. - #2, #3 correct error flows in qed. - #4 add debug related information. - #5 fixes a minor issue in the HW configuration. ==================== Signed-off-by: David S. Miller commit 20b1bd96e9f4feeffc9206284df3c6a4438e9ca8 Author: Ram Amrani Date: Sun Apr 30 11:49:10 2017 +0300 qed: output the DPM status and WID count Output to the RDMA driver whether DPM mode is enabled or disabled in the HW and if so what is the number of WIDs it supports Signed-off-by: Ram Amrani Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed.h | 1 + drivers/net/ethernet/qlogic/qed/qed_dev.c | 4 +++- drivers/net/ethernet/qlogic/qed/qed_roce.c | 4 ++++ include/linux/qed/qed_roce_if.h | 2 ++ 4 files changed, 10 insertions(+), 1 deletion(-) commit 107392b75ffc96a2418d5382e52b08c598575e1b Author: Ram Amrani Date: Sun Apr 30 11:49:09 2017 +0300 qed: align DPI configuration to HW requirements When calculating doorbell BAR partitioning round up the number of CPUs to the nearest power of 2 so the size of the DPI (per user section) configured in the hardware will be stored properly and not truncated. Signed-off-by: Ram Amrani Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed.h | 1 + drivers/net/ethernet/qlogic/qed/qed_dev.c | 12 +++++------- 2 files changed, 6 insertions(+), 7 deletions(-) commit e015d58b44a93a3fd89ed910d68659dfdc57237c Author: Ram Amrani Date: Sun Apr 30 11:49:08 2017 +0300 qed: verify RoCE resource bitmaps are released Add mechanism to verify RoCE resources are released prior to freeing the bitmaps. If this is not the case, print what resources were not released. Signed-off-by: Ram Amrani Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_roce.c | 105 +++++++++++++++++++++-------- drivers/net/ethernet/qlogic/qed/qed_roce.h | 2 + 2 files changed, 80 insertions(+), 27 deletions(-) commit 105361943d3036f00f70a6621983b98673839591 Author: Ram Amrani Date: Sun Apr 30 11:49:07 2017 +0300 qed: add error handling flow to TID deregistratin posting failure If the posting of the ramrod for the purpose of TID deregistration fails, abort the deregistration operation without using the FW's return code. Signed-off-by: Ram Amrani Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_roce.c | 2 ++ 1 file changed, 2 insertions(+) commit ba0154e96449a5be3360d3a07bc4b6d476e2667e Author: Ram Amrani Date: Sun Apr 30 11:49:06 2017 +0300 qed: remove unused SQ error state The internal RoCE SQE QP state isn't being used. Instead we mark the QP as in regular error state. Signed-off-by: Ram Amrani Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_roce.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 793ea8a9c7b4b4383348a717cb5c86c1bbdba30a Author: Ram Amrani Date: Sun Apr 30 11:49:05 2017 +0300 qed: configure the RoCE max message size Signed-off-by: Ram Amrani Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_roce.c | 2 ++ 1 file changed, 2 insertions(+) commit 332270fdc8b6fba07d059a9ad44df9e1a2ad4529 Author: Yonghong Song Date: Sat Apr 29 22:52:42 2017 -0700 bpf: enhance verifier to understand stack pointer arithmetic llvm 4.0 and above generates the code like below: .... 440: (b7) r1 = 15 441: (05) goto pc+73 515: (79) r6 = *(u64 *)(r10 -152) 516: (bf) r7 = r10 517: (07) r7 += -112 518: (bf) r2 = r7 519: (0f) r2 += r1 520: (71) r1 = *(u8 *)(r8 +0) 521: (73) *(u8 *)(r2 +45) = r1 .... and the verifier complains "R2 invalid mem access 'inv'" for insn #521. This is because verifier marks register r2 as unknown value after #519 where r2 is a stack pointer and r1 holds a constant value. Teach verifier to recognize "stack_ptr + imm" and "stack_ptr + reg with const val" as valid stack_ptr with new offset. Signed-off-by: Yonghong Song Acked-by: Martin KaFai Lau Acked-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov Signed-off-by: David S. Miller kernel/bpf/verifier.c | 11 +++++++++++ tools/testing/selftests/bpf/test_verifier.c | 18 ++++++++++++------ 2 files changed, 23 insertions(+), 6 deletions(-) commit 452bae0aede774f87bf56c28b6dd50b72c78986c Author: Dan Williams Date: Fri Apr 28 22:05:14 2017 -0700 libnvdimm: fix nvdimm_bus_lock() vs device_lock() ordering A debug patch to turn the standard device_lock() into something that lockdep can analyze yielded the following: ====================================================== [ INFO: possible circular locking dependency detected ] 4.11.0-rc4+ #106 Tainted: G O ------------------------------------------------------- lt-libndctl/1898 is trying to acquire lock: (&dev->nvdimm_mutex/3){+.+.+.}, at: [] nd_attach_ndns+0x178/0x1b0 [libnvdimm] but task is already holding lock: (&nvdimm_bus->reconfig_mutex){+.+.+.}, at: [] nvdimm_bus_lock+0x21/0x30 [libnvdimm] which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&nvdimm_bus->reconfig_mutex){+.+.+.}: lock_acquire+0xf6/0x1f0 __mutex_lock+0x88/0x980 mutex_lock_nested+0x1b/0x20 nvdimm_bus_lock+0x21/0x30 [libnvdimm] nvdimm_namespace_capacity+0x1b/0x40 [libnvdimm] nvdimm_namespace_common_probe+0x230/0x510 [libnvdimm] nd_pmem_probe+0x14/0x180 [nd_pmem] nvdimm_bus_probe+0xa9/0x260 [libnvdimm] -> #0 (&dev->nvdimm_mutex/3){+.+.+.}: __lock_acquire+0x1107/0x1280 lock_acquire+0xf6/0x1f0 __mutex_lock+0x88/0x980 mutex_lock_nested+0x1b/0x20 nd_attach_ndns+0x178/0x1b0 [libnvdimm] nd_namespace_store+0x308/0x3c0 [libnvdimm] namespace_store+0x87/0x220 [libnvdimm] In this case '&dev->nvdimm_mutex/3' mirrors '&dev->mutex'. Fix this by replacing the use of device_lock() with nvdimm_bus_lock() to protect nd_{attach,detach}_ndns() operations. Cc: Fixes: 8c2f7e8658df ("libnvdimm: infrastructure for btt devices") Reported-by: Yi Zhang Signed-off-by: Dan Williams drivers/nvdimm/btt_devs.c | 2 +- drivers/nvdimm/claim.c | 23 +++++++++++++++-------- drivers/nvdimm/dax_devs.c | 2 +- drivers/nvdimm/pfn_devs.c | 2 +- 4 files changed, 18 insertions(+), 11 deletions(-) commit 98da65d5e32583d89a1b1c760293b601816a98d3 Author: Michel Dänzer Date: Fri Apr 28 16:32:43 2017 -0400 Revert "drm/amdgpu: Refactor flip into prepare submit and submit. (v3)" This reverts commit cb341a319f7e66f879d69af929c3dadfc1a8f31e. The purpose of the refactor was for amdgpu_crtc_prepare/submit_flip to be used by the DC code, but that's no longer the case. Reviewed-by: Christian König Signed-off-by: Michel Dänzer Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 138 ++++++---------------------- drivers/gpu/drm/amd/amdgpu/amdgpu_mode.h | 15 --- 2 files changed, 29 insertions(+), 124 deletions(-) commit 2faf26575350e49c1e242b7a464e9302f78b9b15 Author: Karim Eshapa Date: Mon May 1 15:58:08 2017 +0200 benet: Use time_before_eq for time comparison Use time_before_eq for time comparison more safe and dealing with timer wrapping to be future-proof. Signed-off-by: Karim Eshapa Signed-off-by: David S. Miller drivers/net/ethernet/emulex/benet/be_main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 1a7fca63cd405fc77a9c9ce9291792f2a7d222a4 Author: Benjamin LaHaise Date: Mon May 1 09:58:40 2017 -0400 flower: check unused bits in MPLS fields Since several of the the netlink attributes used to configure the flower classifier's MPLS TC, BOS and Label fields have additional bits which are unused, check those bits to ensure that they are actually 0 as suggested by Jamal. Signed-off-by: Benjamin LaHaise Cc: David Miller Cc: Jamal Hadi Salim Cc: Simon Horman Cc: Jakub Kicinski Cc: Jiri Pirko Signed-off-by: David S. Miller net/sched/cls_flower.c | 32 ++++++++++++++++++++++---------- 1 file changed, 22 insertions(+), 10 deletions(-) commit a01aa920b8e39069bb7ab352ce45f127238f1d26 Merge: edd7f4e 8eeef23 Author: David S. Miller Date: Mon May 1 10:46:50 2017 -0400 Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next Pablo Neira Ayuso says: ==================== Netfilter/IPVS updates for net-next The following patchset contains Netfilter updates for your net-next tree. A large bunch of code cleanups, simplify the conntrack extension codebase, get rid of the fake conntrack object, speed up netns by selective synchronize_net() calls. More specifically, they are: 1) Check for ct->status bit instead of using nfct_nat() from IPVS and Netfilter codebase, patch from Florian Westphal. 2) Use kcalloc() wherever possible in the IPVS code, from Varsha Rao. 3) Simplify FTP IPVS helper module registration path, from Arushi Singhal. 4) Introduce nft_is_base_chain() helper function. 5) Enforce expectation limit from userspace conntrack helper, from Gao Feng. 6) Add nf_ct_remove_expect() helper function, from Gao Feng. 7) NAT mangle helper function return boolean, from Gao Feng. 8) ctnetlink_alloc_expect() should only work for conntrack with helpers, from Gao Feng. 9) Add nfnl_msg_type() helper function to nfnetlink to build the netlink message type. 10) Get rid of unnecessary cast on void, from simran singhal. 11) Use seq_puts()/seq_putc() instead of seq_printf() where possible, also from simran singhal. 12) Use list_prev_entry() from nf_tables, from simran signhal. 13) Remove unnecessary & on pointer function in the Netfilter and IPVS code. 14) Remove obsolete comment on set of rules per CPU in ip6_tables, no longer true. From Arushi Singhal. 15) Remove duplicated nf_conntrack_l4proto_udplite4, from Gao Feng. 16) Remove unnecessary nested rcu_read_lock() in __nf_nat_decode_session(). Code running from hooks are already guaranteed to run under RCU read side. 17) Remove deadcode in nf_tables_getobj(), from Aaron Conole. 18) Remove double assignment in nf_ct_l4proto_pernet_unregister_one(), also from Aaron. 19) Get rid of unsed __ip_set_get_netlink(), from Aaron Conole. 20) Don't propagate NF_DROP error to userspace via ctnetlink in __nf_nat_alloc_null_binding() function, from Gao Feng. 21) Revisit nf_ct_deliver_cached_events() to remove unnecessary checks, from Gao Feng. 22) Kill the fake untracked conntrack objects, use ctinfo instead to annotate a conntrack object is untracked, from Florian Westphal. 23) Remove nf_ct_is_untracked(), now obsolete since we have no conntrack template anymore, from Florian. 24) Add event mask support to nft_ct, also from Florian. 25) Move nf_conn_help structure to include/net/netfilter/nf_conntrack_helper.h. 26) Add a fixed 32 bytes scratchpad area for conntrack helpers. Thus, we don't deal with variable conntrack extensions anymore. Make sure userspace conntrack helper doesn't go over that size. Remove variable size ct extension infrastructure now this code got no more clients. From Florian Westphal. 27) Restore offset and length of nf_ct_ext structure to 8 bytes now that wraparound is not possible any longer, also from Florian. 28) Allow to get rid of unassured flows under stress in conntrack, this applies to DCCP, SCTP and TCP protocols, from Florian. 29) Shrink size of nf_conntrack_ecache structure, from Florian. 30) Use TCP_MAX_WSCALE instead of hardcoded 14 in TCP tracker, from Gao Feng. 31) Register SYNPROXY hooks on demand, from Florian Westphal. 32) Use pernet hook whenever possible, instead of global hook registration, from Florian Westphal. 33) Pass hook structure to ebt_register_table() to consolidate some infrastructure code, from Florian Westphal. 34) Use consume_skb() and return NF_STOLEN, instead of NF_DROP in the SYNPROXY code, to make sure device stats are not fooled, patch from Gao Feng. 35) Remove NF_CT_EXT_F_PREALLOC this kills quite some code that we don't need anymore if we just select a fixed size instead of expensive runtime time calculation of this. From Florian. 36) Constify nf_ct_extend_register() and nf_ct_extend_unregister(), from Florian. 37) Simplify nf_ct_ext_add(), this kills nf_ct_ext_create(), from Florian. 38) Attach NAT extension on-demand from masquerade and pptp helper path, from Florian. 39) Get rid of useless ip_vs_set_state_timeout(), from Aaron Conole. 40) Speed up netns by selective calls of synchronize_net(), from Florian Westphal. 41) Silence stack size warning gcc in 32-bit arch in snmp helper, from Florian. 42) Inconditionally call nf_ct_ext_destroy(), even if we have no extensions, to deal with the NF_NAT_MANIP_SRC case. Patch from Liping Zhang. ==================== Signed-off-by: David S. Miller commit 8abe904dc82772bf1635fcc5765433c672f0a875 Author: Guochun Mao Date: Wed Apr 5 16:37:42 2017 +0800 mtd: mtk-nor: set controller's address width according to nor flash When nor's size larger than 16MByte, nor's address width maybe set to 3 or 4, and controller should change address width according to nor's setting. Signed-off-by: Guochun Mao Signed-off-by: Cyrille Pitchen drivers/mtd/spi-nor/mtk-quadspi.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) commit 0d43d7ab277a048c4b1455ee00030933e1bd5fa3 Author: Ludovic Barre Date: Thu Apr 13 19:15:57 2017 +0200 mtd: spi-nor: add driver for STM32 quad spi flash controller The quadspi is a specialized communication interface targeting single, dual or quad SPI Flash memories. It can operate in any of the following modes: -indirect mode: all the operations are performed using the quadspi registers -read memory-mapped mode: the external Flash memory is mapped to the microcontroller address space and is seen by the system as if it was an internal memory Signed-off-by: Ludovic Barre Reviewed-by: Marek Vasut Signed-off-by: Cyrille Pitchen drivers/mtd/spi-nor/Kconfig | 7 + drivers/mtd/spi-nor/Makefile | 1 + drivers/mtd/spi-nor/stm32-quadspi.c | 693 ++++++++++++++++++++++++++++++++++++ 3 files changed, 701 insertions(+) commit edd7f4efa8111efc279582290acc4d54d405748a Merge: d74a32a f76254a Author: David S. Miller Date: Mon May 1 10:42:38 2017 -0400 Merge branch 'bpf-samples-skb_mode-bug-fixes' Jesper Dangaard Brouer says: ==================== samples/bpf: two bug fixes to XDP_FLAGS_SKB_MODE attaching Two small bugfixes for: commit 3993f2cb983b ("samples/bpf: Add support for SKB_MODE to xdp1 and xdp_tx_iptunnel") ==================== Signed-off-by: David S. Miller commit f76254a845a661ccdb9fa246ee72197f90a8d3dd Author: Jesper Dangaard Brouer Date: Mon May 1 11:26:20 2017 +0200 samples/bpf: fix XDP_FLAGS_SKB_MODE detach for xdp_tx_iptunnel The xdp_tx_iptunnel program can be terminated in two ways, after N-seconds or via Ctrl-C SIGINT. The SIGINT code path does not handle detatching the correct XDP program, in-case the program was attached with XDP_FLAGS_SKB_MODE. Fix this by storing the XDP flags as a global variable, which is available for the SIGINT handler function. Fixes: 3993f2cb983b ("samples/bpf: Add support for SKB_MODE to xdp1 and xdp_tx_iptunnel") Signed-off-by: Jesper Dangaard Brouer Acked-by: Daniel Borkmann Reviewed-by: Andy Gospodarek Signed-off-by: David S. Miller samples/bpf/xdp_tx_iptunnel_user.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 6387d0111ca4740b69a082a92fc373185af11133 Author: Jesper Dangaard Brouer Date: Mon May 1 11:26:15 2017 +0200 samples/bpf: fix SKB_MODE flag to be a 32-bit unsigned int The kernel side of XDP_FLAGS_SKB_MODE is unsigned, and the rtnetlink IFLA_XDP_FLAGS is defined as NLA_U32. Thus, userspace programs under samples/bpf/ should use the correct type. Fixes: 3993f2cb983b ("samples/bpf: Add support for SKB_MODE to xdp1 and xdp_tx_iptunnel") Signed-off-by: Jesper Dangaard Brouer Acked-by: Daniel Borkmann Reviewed-by: Andy Gospodarek Signed-off-by: David S. Miller samples/bpf/bpf_load.c | 3 ++- samples/bpf/bpf_load.h | 2 +- samples/bpf/xdp1_user.c | 8 ++++---- samples/bpf/xdp_tx_iptunnel_user.c | 8 ++++---- 4 files changed, 11 insertions(+), 10 deletions(-) commit d74a32acd59a8ccd8e209af3f4cf533e0359d355 Merge: 7333362 9861ce0 Author: David S. Miller Date: Mon May 1 10:35:48 2017 -0400 Merge branch 'xdp-netlink-ext-ack' Jakub Kicinski says: ==================== xdp: use netlink extended ACK reporting This series is an attempt to make XDP more user friendly by enabling exploiting the recently added netlink extended ACK reporting to carry messages to user space. David Ahern's iproute2 ext ack patches for ip link are sufficient to show the errors like this: Error: nfp: MTU too large w/ XDP enabled Where the message is coming directly from the driver. There could still be a bit of a leap for a complete novice from the message above to the right settings, but it's a big improvement over the standard "Invalid argument" message. v1/non-rfc: - add a separate macro in patch 1; - add KBUILD_MODNAME as part of the message (Daniel); - don't print the error to logs in patch 1. ==================== Signed-off-by: David S. Miller commit 9861ce039c2a4ff3e50eb7c679dadc15a8469e3f Author: Jakub Kicinski Date: Sun Apr 30 21:46:48 2017 -0700 virtio_net: make use of extended ack message reporting Try to carry error messages to the user via the netlink extended ack message attribute. Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller drivers/net/virtio_net.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) commit d957c0f711aaeaac6bbffd82098737ac10b7985d Author: Jakub Kicinski Date: Sun Apr 30 21:46:47 2017 -0700 nfp: make use of extended ack message reporting Try to carry error messages to the user via the netlink extended ack message attribute. Signed-off-by: Jakub Kicinski Acked-by: Daniel Borkmann Signed-off-by: David S. Miller drivers/net/ethernet/netronome/nfp/nfp_net.h | 3 ++- .../net/ethernet/netronome/nfp/nfp_net_common.c | 22 +++++++++++++--------- .../net/ethernet/netronome/nfp/nfp_net_ethtool.c | 4 ++-- 3 files changed, 17 insertions(+), 12 deletions(-) commit ddf9f970764f4390aba767e77fddaaced4a6760d Author: Jakub Kicinski Date: Sun Apr 30 21:46:46 2017 -0700 xdp: propagate extended ack to XDP setup Drivers usually have a number of restrictions for running XDP - most common being buffer sizes, LRO and number of rings. Even though some drivers try to be helpful and print error messages experience shows that users don't often consult kernel logs on netlink errors. Try to use the new extended ack mechanism to carry the message back to user space. Signed-off-by: Jakub Kicinski Acked-by: Daniel Borkmann Signed-off-by: David S. Miller include/linux/netdevice.h | 10 ++++++++-- net/core/dev.c | 5 ++++- net/core/rtnetlink.c | 13 ++++++++----- 3 files changed, 20 insertions(+), 8 deletions(-) commit 45d9b378e85f1b00ac047626827c68589168936c Author: Jakub Kicinski Date: Sun Apr 30 21:46:45 2017 -0700 netlink: add NULL-friendly helper for setting extended ACK message As we propagate extended ack reporting throughout various paths in the kernel it may be that the same function is called with the extended ack parameter passed as NULL. One place where that happens is in drivers which have a centralized reconfiguration function called both from ndos and from ethtool_ops. Add a new helper for setting the error message in such conditions. Existing helper is left as is to encourage propagating the ext act fully wherever possible. It also makes it clear in the code which messages may be lost due to ext ack being NULL. Signed-off-by: Jakub Kicinski Acked-by: Daniel Borkmann Signed-off-by: David S. Miller include/linux/netlink.h | 8 ++++++++ 1 file changed, 8 insertions(+) commit 73a757e63114dfd765f1c5d1ff7e994f123d0234 Author: Steven Rostedt (VMware) Date: Mon May 1 09:35:09 2017 -0400 ring-buffer: Return reader page back into existing ring buffer When reading the ring buffer for consuming, it is optimized for splice, where a page is taken out of the ring buffer (zero copy) and sent to the reading consumer. When the read is finished with the page, it calls ring_buffer_free_read_page(), which simply frees the page. The next time the reader needs to get a page from the ring buffer, it must call ring_buffer_alloc_read_page() which allocates and initializes a reader page for the ring buffer to be swapped into the ring buffer for a new filled page for the reader. The problem is that there's no reason to actually free the page when it is passed back to the ring buffer. It can hold it off and reuse it for the next iteration. This completely removes the interaction with the page_alloc mechanism. Using the trace-cmd utility to record all events (causing trace-cmd to require reading lots of pages from the ring buffer, and calling ring_buffer_alloc/free_read_page() several times), and also assigning a stack trace trigger to the mm_page_alloc event, we can see how many times the ring_buffer_alloc_read_page() needed to allocate a page for the ring buffer. Before this change: # trace-cmd record -e all -e mem_page_alloc -R stacktrace sleep 1 # trace-cmd report |grep ring_buffer_alloc_read_page | wc -l 9968 After this change: # trace-cmd record -e all -e mem_page_alloc -R stacktrace sleep 1 # trace-cmd report |grep ring_buffer_alloc_read_page | wc -l 4 Signed-off-by: Steven Rostedt (VMware) include/linux/ring_buffer.h | 2 +- kernel/trace/ring_buffer.c | 40 +++++++++++++++++++++++++++++++++--- kernel/trace/ring_buffer_benchmark.c | 2 +- kernel/trace/trace.c | 17 ++++++++++----- 4 files changed, 51 insertions(+), 10 deletions(-) commit f984409a00e7d9aa40af64d7c9619e5de3d980bf Author: Max Filippov Date: Mon Mar 16 14:40:14 2015 +0300 xtensa: use generic tracehooks Use tracehook_report_syscall_{entry,exit} instead of a local copy of it in do_syscall_trace. Allow tracehook to cancel syscall by returning invalid syscall number to the system_call function. Signed-off-by: Max Filippov arch/xtensa/kernel/entry.S | 3 ++- arch/xtensa/kernel/ptrace.c | 38 ++++++++++++-------------------------- 2 files changed, 14 insertions(+), 27 deletions(-) commit 0700ed072feffd65212e6a03840d19c4988d6820 Author: Max Filippov Date: Tue Jan 27 00:43:14 2015 +0300 xtensa: move internal ptrace definitions from uapi/asm to asm Stack frame layout diagram, kernel stack size and exception_handlers offsets are used by the kernel and are not supposed to be accessible to userspace. Move these definitions from uapi/asm/ptrace.h to asm/ptrace.h Signed-off-by: Max Filippov arch/xtensa/include/asm/ptrace.h | 39 ++++++++++++++++++++++++++++++++++ arch/xtensa/include/uapi/asm/ptrace.h | 40 ----------------------------------- 2 files changed, 39 insertions(+), 40 deletions(-) commit 1b47a683a04a93ad32786a23b7f88990b980346a Author: Max Filippov Date: Tue Jan 27 03:12:50 2015 +0300 xtensa: clean up xtensa/kernel/ptrace.c - make locally-used functions static; - drop meaningless comments and commented out code; - fix code style and alignment. Signed-off-by: Max Filippov arch/xtensa/kernel/ptrace.c | 144 ++++++++++++++++++++++---------------------- 1 file changed, 71 insertions(+), 73 deletions(-) commit d9c7710db90c0069ca5eebc060d4571aabea8f74 Author: Max Filippov Date: Tue Jan 27 00:27:05 2015 +0300 xtensa: drop unused fast_io_protect function fast_io_protect is not used anywhere, drop its definition. Signed-off-by: Max Filippov arch/xtensa/kernel/coprocessor.S | 24 ------------------------ 1 file changed, 24 deletions(-) commit cda3b01368391b48728b7edbbac0ca873b514367 Author: Phil Reid Date: Mon May 1 16:49:58 2017 +0800 power: supply: sbs-battery: Add alert callback To simplify the sbs-manager code and notification of battery removal use the i2c alert callback to notify the sbs-battery driver that an event has occurred. Signed-off-by: Phil Reid Signed-off-by: Sebastian Reichel drivers/power/supply/sbs-battery.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) commit cad87f097ca2d56093145c4becd487f5c186a612 Author: Sebastian Reichel Date: Mon May 1 13:55:25 2017 +0200 mailmap: add Sebastian Reichel Add two entries to map to my primary kernel address. Signed-off-by: Sebastian Reichel .mailmap | 2 ++ 1 file changed, 2 insertions(+) commit bfb8c6e495b9fc14c315e0f1550394b2137035b4 Merge: a351e9b cf8178f Author: Ingo Molnar Date: Mon May 1 13:40:23 2017 +0200 Merge branch 'x86/microcode' into x86/urgent, to pick up cleanup Signed-off-by: Ingo Molnar commit e9574c14fd11ba254633342ff8ea58664c2938e1 Author: Sebastian Reichel Date: Thu Apr 27 17:30:07 2017 +0200 power: supply: avoid unused twl4030-madc.h Avoid inclusion of unused twl4030-madc.h. This will allow twl4030-madc.h to be merged into the iio driver. Signed-off-by: Sebastian Reichel drivers/power/supply/rx51_battery.c | 1 - drivers/power/supply/twl4030_madc_battery.c | 1 - 2 files changed, 2 deletions(-) commit 7f93e1fa032bb5ee19b868b9649bc98c82553003 Author: Paul Kocialkowski Date: Tue Apr 25 17:09:05 2017 +0200 power: supply: sbs-battery: Correct supply status with current draw The status reported directly by the battery controller is not always reliable and should be corrected based on the current draw information. This implements such a correction with a dedicated function, called where the supply status is retrieved. Signed-off-by: Paul Kocialkowski Signed-off-by: Sebastian Reichel drivers/power/supply/sbs-battery.c | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) commit 4df2cce4722d35eb35bb9371e7c9a600a84558f9 Author: Paul Kocialkowski Date: Tue Apr 25 17:09:04 2017 +0200 power: supply: sbs-battery: Don't ignore the first external power change A mechanism to ignore the first external power change notification was put in place years ago to ignore the power_supply_register notification. However, this doesn't apply to the current situation anymore, as the first notification is always the result of a legitimate power change. This removes this deprecated mechanism, which puts back the driver's state machine to a sane state (an ignored first notification previously caused a charging/discharging status inversion). Signed-off-by: Paul Kocialkowski Signed-off-by: Sebastian Reichel drivers/power/supply/sbs-battery.c | 10 ---------- 1 file changed, 10 deletions(-) commit 633e8799ddc09431be2744c4a1efdbda13af2b0b Author: Michael Trimarchi Date: Tue Apr 25 15:18:05 2017 +0200 power: supply: pda_power: move from timer to delayed_work This changed is needed to avoid locking problem during boot as shown: <5>[ 8.824096] Registering SWP/SWPB emulation handler <6>[ 8.977294] clock: disabling unused clocks to save power <3>[ 9.108154] BUG: sleeping function called from invalid context at kernel_albert/kernel/mutex.c:269 <3>[ 9.122894] in_atomic(): 1, irqs_disabled(): 0, pid: 1, name: swapper/0 <4>[ 9.130249] 3 locks held by swapper/0/1: <4>[ 9.134613] #0: (&__lockdep_no_validate__){......}, at: [] __driver_attach+0x58/0xa8 <4>[ 9.144500] #1: (&__lockdep_no_validate__){......}, at: [] __driver_attach+0x68/0xa8 <4>[ 9.154357] #2: (&polling_timer){......}, at: [] run_timer_softirq+0x108/0x3ec <4>[ 9.163726] Backtrace: <4>[ 9.166473] [] (dump_backtrace+0x0/0x114) from [] (dump_stack+0x20/0x24) <4>[ 9.175811] r6:00203230 r5:0000010d r4:d782e000 r3:60000113 <4>[ 9.182250] [] (dump_stack+0x0/0x24) from [] (__might_sleep+0x10c/0x128) <4>[ 9.191650] [] (__might_sleep+0x0/0x128) from [] (mutex_lock_nested+0x34/0x36c) <4>[ 9.201660] r5:c02d5350 r4:d79a0c64 <4>[ 9.205688] [] (mutex_lock_nested+0x0/0x36c) from [] (regulator_set_current_limit+0x30/0x118) <4>[ 9.217071] [] (regulator_set_current_limit+0x0/0x118) from [] (update_charger+0x84/0xc4) <4>[ 9.228027] r7:d782fb20 r6:00000101 r5:c1767e94 r4:00000000 <4>[ 9.234436] [] (update_charger+0x0/0xc4) from [] (psy_changed+0x20/0x48) <4>[ 9.243804] r5:d782e000 r4:c1767e94 <4>[ 9.247802] [] (psy_changed+0x0/0x48) from [] (polling_timer_func+0x84/0xb8) <4>[ 9.257537] r4:c1767e94 r3:00000002 <4>[ 9.261566] [] (polling_timer_func+0x0/0xb8) from [] (run_timer_softirq+0x17c/0x3ec) <4>[ 9.272033] r4:c1767eb0 r3:00000000 <4>[ 9.276062] [] (run_timer_softirq+0x0/0x3ec) from [] (__do_softirq+0xf0/0x298) <4>[ 9.286010] [] (__do_softirq+0x0/0x298) from [] (irq_exit+0x98/0xa0) <4>[ 9.295013] [] (irq_exit+0x0/0xa0) from [] (handle_IRQ+0x60/0xc0) <4>[ 9.303680] r4:c1194e98 r3:c00bc778 <4>[ 9.307708] [] (handle_IRQ+0x0/0xc0) from [] (gic_handle_irq+0x34/0x68) <4>[ 9.316955] r8:000ac383 r7:d782fc3c r6:d782fc08 r5:c11936c4 r4:e0802100 <4>[ 9.324310] r3:c026ba48 <4>[ 9.327301] [] (gic_handle_irq+0x0/0x68) from [] (__irq_svc+0x40/0x74) <4>[ 9.336456] Exception stack(0xd782fc08 to 0xd782fc50) <4>[ 9.342041] fc00: d6e30e6c ac383627 00000000 ac383417 ea19c000 ea200000 <4>[ 9.351104] fc20: beffffff 00000667 000ac383 d6e30670 d6e3066c d782fc94 d782fbe8 d782fc50 <4>[ 9.360168] fc40: c026ba48 c001d1f0 00000113 ffffffff Fixes: b2998049cfae ("[BATTERY] pda_power platform driver") Signed-off-by: Michael Trimarchi Signed-off-by: Anthony Brandon Signed-off-by: Sebastian Reichel drivers/power/supply/pda_power.c | 49 ++++++++++++++++++++++------------------ 1 file changed, 27 insertions(+), 22 deletions(-) commit adb69a3c4524693a32ba72533ee6d7a52e54989e Author: Hans de Goede Date: Fri Apr 14 20:32:58 2017 +0200 power: supply: max17042_battery: Add support for the SCOPE property Add support for the SCOPE property, always return SCOPE_SYSTEM, as the max170xx is used for the main battery on all known systems with a max170xx. Signed-off-by: Hans de Goede Reviewed-by: Krzysztof Kozlowski Signed-off-by: Sebastian Reichel drivers/power/supply/max17042_battery.c | 4 ++++ 1 file changed, 4 insertions(+) commit 6d6b61eafca94146cedf7709974a7423df16a6f1 Author: Hans de Goede Date: Fri Apr 14 20:32:57 2017 +0200 power: supply: max17042_battery: Add support for the CHARGE_NOW property At least upower prefers the more precise charge_now sysfs value over capacity and the max17042 has the info, so lets export it. Signed-off-by: Hans de Goede Reviewed-by: Krzysztof Kozlowski Signed-off-by: Sebastian Reichel drivers/power/supply/max17042_battery.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 2e015412a320e49aab4beaeb6262e93fdc0a42f2 Author: Hans de Goede Date: Fri Apr 14 20:32:56 2017 +0200 power: supply: max17042_battery: Add support for the CHARGE_FULL_DESIGN property The info is there, lets export it as a property. Signed-off-by: Hans de Goede Reviewed-by: Krzysztof Kozlowski Signed-off-by: Sebastian Reichel drivers/power/supply/max17042_battery.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit d7d15fc67791c0e255f36345d02441c1716c2a1f Author: Hans de Goede Date: Fri Apr 14 20:32:55 2017 +0200 power: supply: max17042_battery: mAh readings depend on r_sns value The PROP_CHARGE_FULL code was hardcoded for the default sense resistor of 0.010 Ohm, make it use r_sns which contains the actual sense resistor value in micro-Ohms instead. Signed-off-by: Hans de Goede Reviewed-by: Krzysztof Kozlowski Signed-off-by: Sebastian Reichel drivers/power/supply/max17042_battery.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 7bfc9397ff9690fbb0da44e1a0aeab953cb73b77 Author: Hans de Goede Date: Fri Apr 14 20:32:54 2017 +0200 power: supply: max17042_battery: Add support for the VOLT_MIN property The info is there, so lets export it, like we already do for VOLT_MAX. Signed-off-by: Hans de Goede Reviewed-by: Krzysztof Kozlowski Signed-off-by: Sebastian Reichel drivers/power/supply/max17042_battery.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit ef7fcdaebfce56bd7f1ac3b916b5d587a3666f10 Author: Hans de Goede Date: Fri Apr 14 20:32:53 2017 +0200 power: supply: max17042_battery: Add support for the TECHNOLOGY attribute The max17042 is intended for Li-Ion or Li-Po batteries, add a TECHNOLOGY attribute to reflect this. Note this is hardcoded to Li-Ion as there is no way to tell the difference, and Lithium-Ion Polymer batteries are a sub-family of Lithium-Ion so Li-Ion technically is correct for both. Using Li-Ion for both is already done by many drivers and is much better then not providing any technology info at all. Suggested-by: Wolfgang Wiedmeyer Signed-off-by: Hans de Goede Reviewed-by: Krzysztof Kozlowski Signed-off-by: Sebastian Reichel drivers/power/supply/max17042_battery.c | 4 ++++ 1 file changed, 4 insertions(+) commit dcdddda8fdd23048f2eaf54a18a33e9f225d8fb6 Author: Hans de Goede Date: Fri Apr 14 20:32:52 2017 +0200 power: supply: max17042_battery: Add external_power_changed callback If our supplier changes status, chances are we've changed status too, let any listeners know about this. Signed-off-by: Hans de Goede Reviewed-by: Krzysztof Kozlowski Signed-off-by: Sebastian Reichel drivers/power/supply/max17042_battery.c | 6 ++++++ 1 file changed, 6 insertions(+) commit a9df22c00d7c2c9c2944c62f1b819de6c214660f Author: Hans de Goede Date: Fri Apr 14 20:32:51 2017 +0200 power: supply: max17042_battery: Add support for the STATUS property Userspace prefers the driver having a status property over having to guess itself. Specifically this will properly make the GNOME3 UI (and likely others) properly show discharging / charging / full status, instead of always showing discharging as status. Note that in the case there is no charger driver supplying the max17042, then a status of unknown will get returned. At least upower treats this the same as not having a status attribute, so in this case nothing changes from a userspace pov. Signed-off-by: Hans de Goede Reviewed-by: Krzysztof Kozlowski Signed-off-by: Sebastian Reichel drivers/power/supply/max17042_battery.c | 46 +++++++++++++++++++++++++++++++++ include/linux/power/max17042_battery.h | 3 +++ 2 files changed, 49 insertions(+) commit 917362135b8a5c0680acf08807e9fc6179eb6c79 Author: Hans de Goede Date: Fri Apr 14 20:32:49 2017 +0200 power: supply: max17042_battery: Add default platform_data fallback data Some x86 machines use a max17047 fuel-gauge and x86 might be missing platform_data if not provided by SFI. This commit adds default platform_data as fallback option so that the driver can work on boards where no platform_data is provided. Since not all boards have a thermistor hooked up, set temp_min to 0 and change the health checks from temp <= temp_min to temp < temp_min to not trigger on such boards (where temp reads 0). Signed-off-by: Hans de Goede Reviewed-by: Krzysztof Kozlowski Signed-off-by: Sebastian Reichel drivers/power/supply/max17042_battery.c | 60 +++++++++++++++++++++++++++++---- include/linux/power/max17042_battery.h | 6 +++- 2 files changed, 58 insertions(+), 8 deletions(-) commit 2814913c3136b41084a896c90062bd9b87672dff Author: Hans de Goede Date: Fri Apr 14 20:32:48 2017 +0200 power: supply: max17047_battery: The temp alert values are 8-bit 2's complement The temp alert values are 8-bit 2's complement, so sign-extend them before reporting them back to the caller. Signed-off-by: Hans de Goede Reviewed-by: Krzysztof Kozlowski Signed-off-by: Sebastian Reichel drivers/power/supply/max17042_battery.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit c67c06939ee4a24fcad1235dd9632153533fdd4d Author: Hans de Goede Date: Fri Apr 14 20:32:47 2017 +0200 power: supply: max17042_battery: Use sign_extend32 instead of DIY code Use sign_extend32 to sign-extend variables where necessary instead of DIY code. Signed-off-by: Hans de Goede Reviewed-by: Krzysztof Kozlowski Signed-off-by: Sebastian Reichel drivers/power/supply/max17042_battery.c | 24 +++--------------------- 1 file changed, 3 insertions(+), 21 deletions(-) commit 7f232af35620fe68746cb3da582062de965b286c Author: Colin Ian King Date: Sat Apr 29 22:56:49 2017 +0100 power: supply: ab8500_charger: spelling: "prechage" -> "precharge" trivial fix to spelling mistake in dev_error message. Signed-off-by: Colin Ian King Signed-off-by: Sebastian Reichel drivers/power/supply/ab8500_charger.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fbfb8e1dcea0508f203535a92faea7a3ddf24558 Author: Stefan Roese Date: Thu Apr 27 14:21:41 2017 +0200 dmaengine: dmatest: Add check for supported buffer count (sg_buffers) When using dmatest with sg_buffers=128 I stumbled upon the problem, that the "map_cnt" variable of "struct dmaengine_unmap_data" was set to 0. "map_cnt" is an "u8" variable, resulting in an overrun when its value is set to src_cnt + dst_cnt, to twice the sg_buffer value. This patch adds a small check to dmatest, so that this confusing error is detected and the test is aborted. Signed-off-by: Stefan Roese Cc: Kedareswara rao Appana Cc: Vinod Koul Signed-off-by: Vinod Koul drivers/dma/dmatest.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 58532e66261e8cee52ac0abbe33c502b6e76f380 Author: Stefan Roese Date: Thu Apr 27 14:21:40 2017 +0200 dmaengine: dmatest: Select DMA_ENGINE_RAID as its needed for the slave_sg test To enable usage of multiple SG buffers via the sg_buffers= module parameter, lets select DMA_ENGINE_RAID via Kconfig when DMATEST is configured. Otherwise the dmatest will "BUG" when more than 1 buffer (total of 2 for src + dst) is configured via sg_buffers. Signed-off-by: Stefan Roese Cc: Kedareswara rao Appana Cc: Vinod Koul Signed-off-by: Vinod Koul drivers/dma/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 6254a6a94489c4be717f757bec7d3a372cba1b6e Author: Arnd Bergmann Date: Thu Apr 27 21:11:48 2017 +0200 power: supply: axp20x_usb_power: add IIO dependency When CONFIG_IIO=m and the axp20x_usb_power driver is built-in, we get a link time error: drivers/power/built-in.o: In function `axp20x_usb_power_get_property': undefined reference to `iio_read_channel_processed' drivers/power/built-in.o: In function `axp20x_usb_power_probe': undefined reference to `devm_iio_channel_get' undefined reference to `devm_iio_channel_get' This adds the same dependency that we already have for the AC power driver to the USB power driver. For consistency, I'm also moving the two closer together in the Kconfig file. Fixes: 33863c938caa ("power: supply: axp20x_usb_power: use IIO channels when available") Signed-off-by: Arnd Bergmann Signed-off-by: Sebastian Reichel drivers/power/supply/Kconfig | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) commit 8b20839988f1ed5e534b270f3776709b640dc7e0 Author: Pan Bian Date: Mon Apr 24 16:22:08 2017 +0800 power: supply: isp1704: Fix unchecked return value of devm_kzalloc Function devm_kzalloc() will return a NULL pointer. However, in function isp1704_charger_probe(), the return value of devm_kzalloc() is directly used without validation. This may result in a bad memory access bug. Fixes: 34a109610e2a ("isp1704_charger: Add DT support") Signed-off-by: Pan Bian Reviewed-by: Pali Rohár Signed-off-by: Sebastian Reichel drivers/power/supply/isp1704_charger.c | 4 ++++ 1 file changed, 4 insertions(+) commit 756e142a4b3b25aac44eaa54ded125fce0e8fcc7 Author: Rahul Bedarkar Date: Fri Apr 21 16:37:57 2017 +0530 power: supply: generic-adc-battery: use SIMPLE_DEV_PM_OPS helper macro Replace ifdefs with SIMPLE_DEV_PM_OPS helper macro. Signed-off-by: Rahul Bedarkar Signed-off-by: Sebastian Reichel drivers/power/supply/generic-adc-battery.c | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-) commit bb8fe8ea0067083e0452d5c67a4ab70ad72cc52f Author: Ryosuke Saito Date: Fri Apr 21 12:13:17 2017 +0900 power: supply: sbs-battery: fix the sbs interrupt request Since we use the default primary handler for the irq, IRQF_ONESHOT must be set. Otherwise the request fails and the following errors are displayed: genirq: Threaded irq requested with handler=NULL and !ONESHOT for irq 129 sbs-battery 0-000b: Failed to request irq: -22 Signed-off-by: Ryosuke Saito Signed-off-by: Sebastian Reichel drivers/power/supply/sbs-battery.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 46c202b5f25fb6fbd4af60ded133fa745b3601b3 Author: Quentin Schulz Date: Tue Apr 18 09:34:17 2017 +0200 power: supply: add battery driver for AXP20X and AXP22X PMICs The X-Powers AXP20X and AXP22X PMICs can have a battery as power supply. This patch adds the battery power supply driver to get various data from the PMIC, such as the battery status (charging, discharging, full, dead), current max limit, current current, battery capacity (in percentage), voltage max and min limits, current voltage and battery capacity (in Ah). This battery driver uses the AXP20X/AXP22X ADC driver as PMIC data provider. Signed-off-by: Quentin Schulz Acked-by: Jonathan Cameron Acked-by: Maxime Ripard Acked-by: Chen-Yu Tsai Signed-off-by: Sebastian Reichel drivers/power/supply/Kconfig | 12 + drivers/power/supply/Makefile | 1 + drivers/power/supply/axp20x_battery.c | 502 ++++++++++++++++++++++++++++++++++ 3 files changed, 515 insertions(+) commit 7221675c70d147f2ae6f044697dff046f3805224 Author: Quentin Schulz Date: Tue Apr 18 09:34:16 2017 +0200 dt-bindings: power: supply: add AXP20X/AXP22X battery DT binding The X-Powers AXP20X and AXP22X PMICs can have a battery as power supply. This patch adds the DT binding documentation for the battery power supply which gets various data from the PMIC, such as the battery status (charging, discharging, full, dead), current max limit, current current, battery capacity (in percentage), voltage max and min limits, current voltage and battery capacity (in Ah). Signed-off-by: Quentin Schulz Acked-by: Chen-Yu Tsai Acked-by: Maxime Ripard Acked-by: Rob Herring Acked-by: Chen-Yu Tsai Signed-off-by: Sebastian Reichel .../bindings/power/supply/axp20x_battery.txt | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) commit 1eb2869b3c90f4e7971515ddbe92f9e0d18827f5 Author: Liam Breck Date: Sun Apr 16 16:06:26 2017 -0700 power: supply: bq24190_charger: Deprecate battery class and replicate its features in charger The driver was registering two classes, bq24190-battery & -charger. Because the power supply framework cannot surface features from multiple drivers in a single class, a fuel gauge driver would create a third class, which some power management utilities cannot see. Deprecate the -battery class for future removal and replicate its features in -charger. Set /sys/class...-charger/online = pg_stat && !batfet_disable. If device_property "omit-battery-class" is set, don't register -battery. Cc: Tony Lindgren Cc: Hans de Goede Signed-off-by: Liam Breck Reviewed-by: Hans de Goede Signed-off-by: Sebastian Reichel drivers/power/supply/bq24190_charger.c | 146 +++++++++++++++++++++++++-------- 1 file changed, 111 insertions(+), 35 deletions(-) commit 2848e039c562a5278cd2ebc5b005c0f1a381b34e Author: Hans de Goede Date: Sun Apr 16 17:30:31 2017 +0200 power: supply: Make power_supply_am_i_supplied return -ENODEV if there are no suppliers It is sensible to assume that the hardware actually always has a way of charging the battery so when power_supply_am_i_supplied does not find any suppliers, that does not mean that there are none, but simply that no power_supply-drivers are registered / bound for any suppliers for the supply calling power_supply_am_i_supplied. At which point a fuel-gauge driver calling power_supply_am_i_supplied() cannot determine whether the battery is being charged or not. Allow a caller of power_supply_am_i_supplied to differentiate between there not being any suppliers, vs no suppliers being online by returning -ENODEV if there are no suppliers matching supplied_to / supplied_from, which allows fuel-gauge drivers to return POWER_SUPPLY_STATUS_UNKNOWN rather then POWER_SUPPLY_STATUS_DISCHARGING if there are no suppliers. Signed-off-by: Hans de Goede Reviewed-by: Krzysztof Kozlowski Signed-off-by: Sebastian Reichel drivers/power/supply/power_supply_core.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) commit 8eeef2350453aa012d846457eb6ecd012a35d99b Author: Liping Zhang Date: Sat Apr 29 21:59:49 2017 +0800 netfilter: nf_ct_ext: invoke destroy even when ext is not attached For NF_NAT_MANIP_SRC, we will insert the ct to the nat_bysource_table, then remove it from the nat_bysource_table via nat_extend->destroy. But now, the nat extension is attached on demand, so if the nat extension is not attached, we will not be notified when the ct is destroyed, i.e. we may fail to remove ct from the nat_bysource_table. So just keep it simple, even if the extension is not attached, we will still invoke the related ext->destroy. And this will also preserve the flexibility for the future extension. Fixes: 9a08ecfe74d7 ("netfilter: don't attach a nat extension by default") Signed-off-by: Liping Zhang Signed-off-by: Pablo Neira Ayuso include/net/netfilter/nf_conntrack_extend.h | 7 +------ net/netfilter/nf_conntrack_extend.c | 8 ++------ 2 files changed, 3 insertions(+), 12 deletions(-) commit d1908ca8dcb1a045cf0626be4513a28933f46d5e Merge: 0e72f55 fb90e8d Author: Pablo Neira Ayuso Date: Mon May 1 11:45:47 2017 +0200 Merge tag 'ipvs3-for-v4.12' of http://git.kernel.org/pub/scm/linux/kernel/git/horms/ipvs-next Simon Horman says: ==================== Third Round of IPVS Updates for v4.12 please consider these enhancements to IPVS for v4.12. If it is too late for v4.12 then please consider them for v4.13. * Remove unused function * Correct comparison of unsigned value ==================== Signed-off-by: Pablo Neira Ayuso commit 0e72f55f3510e722e725c54678800e99853faa3b Author: Florian Westphal Date: Thu Apr 27 16:39:43 2017 +0200 netfilter: snmp: avoid stack size warning net/ipv4/netfilter/nf_nat_snmp_basic.c:1158:1: warning: the frame size of 1160 bytes is larger than 1024 bytes Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/ipv4/netfilter/nf_nat_snmp_basic.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 19a2ee69c20255157738402b6fdbcf5d708dad80 Author: H. Nikolaus Schaller Date: Fri Apr 14 21:29:38 2017 +0200 power: supply: twl4030-charger: don't check if battery is present We can't assume that the battery is or stays present after probing on devices with replaceable battery. On some devices (e.g. GTA04 or OpenPanodra) it can be removed and even be hot swapped by the user while device continues to operate through external AC or USB power (as long as system power consumption remains below ca. 500mA as provided by USB). Under certain conditions it is possible to boot without battery. So it makes no sense to check for this situation during probe and make the charger driver (and its status reports) completely non-operational if the battery can be inserted later. Tested on: GTA04 and OpenPandora. Signed-off-by: H. Nikolaus Schaller Signed-off-by: Sebastian Reichel drivers/power/supply/twl4030_charger.c | 36 ---------------------------------- 1 file changed, 36 deletions(-) commit 3fb319c2cdcd10f775f4d4a05a7d12fa1a5679c1 Author: H. Nikolaus Schaller Date: Fri Apr 14 20:25:56 2017 +0200 power: supply: twl4030-charger: add writable INPUT_CURRENT_LIMIT property Currently, the twl4030 charger defines its own max_current by directly creating sysfs nodes. It should use the input_current_limit property which is e.g. used by the bq24257 driver. This patch adds the input_current_property with the same semantics as the max_current property. The code to manage the max_current property is removed by a separate patch. Signed-off-by: H. Nikolaus Schaller Signed-off-by: Sebastian Reichel drivers/power/supply/twl4030_charger.c | 59 ++++++++++++++++++++++++++++++++++ 1 file changed, 59 insertions(+) commit 6cf62a3b97e78ba41d31390e59a1ddc98a9e3622 Author: Hans de Goede Date: Fri Apr 14 18:52:33 2017 +0200 power: supply: bq24190_charger: Add disable-reset device-property Allow platform-code to disable the reset on probe and suspend/resume by setting a "disable-reset" boolean device property on the device. There are several reasons why the platform-code may want to disable the reset on probe and suspend/resume: 1) Resetting the charger should never be necessary it should always have sane values programmed. If it is running with invalid values while we are not running (system turned off or suspended) there is a big problem as that may lead to overcharging the battery. 2) The reset in suspend() is meant to put the charger back into default mode, but this is not necessary and not a good idea. If the charger has been programmed with a higher max charge_current / charge_voltage then putting it back in default-mode will reset those to the safe power-on defaults, leading to slower charging, or charging to a lower voltage (and thus not using the full capacity) while suspended which is undesirable. Reprogramming the max charge_current / charge_voltage after the reset will not help here as that will put the charger back in host mode and start the i2c watchdog if the host then does not do anything for 40s (iow if we're suspended for more then 40s) the watchdog expires resetting the device to default-mode, including resetting all the registers to there safe power-on defaults. So the only way to keep using custom charge settings while suspending is to keep the charger in its normal running state with the i2c watchdog disabled. This is fine as the charger will still automatically switch from constant current to constant voltage and stop charging when the battery is full. 3) Besides never being necessary resetting the charger also causes problems on systems where the charge voltage limit is set higher then the reset value, if this is the case and the charger is reset while charging and the battery voltage is between the 2 voltages, then about half the time the charger gets confused and claims to be charging (REG08 contains 0x64) but in reality the charger has decoupled itself from VBUS (Q1 off) and is drawing 0A from VBUS, leaving the system running from the battery. This last problem is happening on a GPD-win mini PC with a bq24292i charger chip combined with a max17047 fuel-gauge and a LiHV battery. I've checked and TI does not list any errata for the bq24292i which could explain this (there are no errata at all). Cc: Liam Breck Cc: Tony Lindgren Signed-off-by: Hans de Goede Acked-by: Liam Breck Signed-off-by: Sebastian Reichel drivers/power/supply/bq24190_charger.c | 3 +++ 1 file changed, 3 insertions(+) commit 039b40ee5854dc733cf786fee4a88e240a012115 Author: Florian Westphal Date: Mon Apr 24 15:37:41 2017 +0200 netfilter: nf_queue: only call synchronize_net twice if nf_queue is active nf_unregister_net_hook(s) can avoid a second call to synchronize_net, provided there is no nfqueue active in that net namespace (which is the common case). This also gets rid of the extra arg to nf_queue_nf_hook_drop(), normally this gets called during netns cleanup so no packets should be queued. For the rare case of base chain being unregistered or module removal while nfqueue is in use the extra hiccup due to the packet drops isn't a big deal. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso include/net/netfilter/nf_queue.h | 3 +-- net/netfilter/core.c | 21 ++++++++++++--------- net/netfilter/nf_internals.h | 2 +- net/netfilter/nf_queue.c | 7 +++++-- net/netfilter/nfnetlink_queue.c | 18 ++++++++---------- 5 files changed, 27 insertions(+), 24 deletions(-) commit c83fa19603bdaeef17b815713dbbe3230c8a34ee Author: Florian Westphal Date: Tue Apr 25 10:24:03 2017 +0200 netfilter: nf_log: don't call synchronize_rcu in nf_log_unset nf_log_unregister() (which is what gets called in the logger backends module exit paths) does a (required, module is removed) synchronize_rcu(). But nf_log_unset() is only called from pernet exit handlers. It doesn't free any memory so there appears to be no need to call synchronize_rcu. v2: Liping Zhang points out that nf_log_unregister() needs to be called after pernet unregister, else rmmod would become unsafe. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_log.c | 1 - net/netfilter/nfnetlink_log.c | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) commit 933bd83ed60e80ebb1aeb64a2f7cd3190d2312e2 Author: Florian Westphal Date: Mon Apr 24 15:37:39 2017 +0200 netfilter: batch synchronize_net calls during hook unregister synchronize_net is expensive and slows down netns cleanup a lot. We have two APIs to unregister a hook: nf_unregister_net_hook (which calls synchronize_net()) and nf_unregister_net_hooks (calls nf_unregister_net_hook in a loop) Make nf_unregister_net_hook a wapper around new helper __nf_unregister_net_hook, which unlinks the hook but does not free it. Then, we can call that helper in nf_unregister_net_hooks and then call synchronize_net() only once. Andrey Konovalov reports this change improves syzkaller fuzzing speed at least twice. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/netfilter/core.c | 46 ++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 40 insertions(+), 6 deletions(-) commit 084a275e4c9477c432b05e872c3a297eab41638a Author: Nicholas Piggin Date: Wed Oct 19 14:16:00 2016 +1100 powerpc/64: Allow CONFIG_RELOCATABLE if COMPILE_TEST This was a hack we added to work around the allmodconfig build breaking, see commit fb43e8477ed9 ("powerpc: Disable RELOCATABLE for COMPILE_TEST with PPC64"). Since we merged the thin archives support in commit 43c9127d94d6 ("powerpc: Add option to use thin archives") this hasn't been necessary, so remove it. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman arch/powerpc/Kconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 8915bcd68b2547c819b8a2a33c098121af9accb2 Author: Michael Neuling Date: Thu Mar 16 14:04:40 2017 +1100 powerpc/xmon: Teach xmon oops about radix vectors Currently if we take an oops caused by an 0x380 or 0x480 exception, we get a print which assumes SLB problems. With radix, these vectors have different meanings. This patch updates the oops message to reflect these different meanings. Signed-off-by: Michael Neuling Signed-off-by: Michael Ellerman arch/powerpc/xmon/xmon.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) commit 01e7bc241d4cf8176cfc77ccd13988dc6f0414c4 Author: Hans-Christian Noren Egtvedt Date: Sun Apr 9 10:51:58 2017 +0200 mm: remove AVR32 arch special handling in mm/Kconfig AVR32 architecture has been removed from the Linux kernel sources, hence clean up the special handling setting two quicklists by default in mm/Kconfig. Signed-off-by: Hans-Christian Noren Egtvedt mm/Kconfig | 1 - 1 file changed, 1 deletion(-) commit cddbfbd448344dbfa0581307b0c4705e940b0743 Author: Hans-Christian Noren Egtvedt Date: Mon May 1 09:33:20 2017 +0200 lib: remove check for AVR32 arch in test_user_copy The AVR32 architecture support has been removed from the Linux kernel, hence remove all the check for this architecture in test_user_copy.c. Signed-off-by: Hans-Christian Noren Egtvedt lib/test_user_copy.c | 1 - 1 file changed, 1 deletion(-) commit 695c1208e0e497d4f0a0ef7a4bac0bd1e3de0f74 Author: Hans-Christian Noren Egtvedt Date: Sun Apr 9 10:45:27 2017 +0200 lib: remove AVR32 entry in Kconfig.debug compile with frame pointers AVR32 architecture has been removed from the Linux kernel sources, hence clean up the architecture related symbols in lib/Kconfig.debug. Signed-off-by: Hans-Christian Noren Egtvedt lib/Kconfig.debug | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1e06d1f8727ed615888937fcce23a31b40959708 Author: Hans-Christian Noren Egtvedt Date: Sun Feb 26 13:19:06 2017 +0100 scripts: remove AVR32 support from checkstack.pl The AVR32 architecture support has been removed from the kernel, hence remove the related bits from checkstack.pl script. Signed-off-by: Hans-Christian Noren Egtvedt Signed-off-by: Håvard Skinnemoen Signed-off-by: Nicolas Ferre Acked-by: Andy Shevchenko Acked-by: Boris Brezillon scripts/checkstack.pl | 5 ----- 1 file changed, 5 deletions(-) commit c0c74acbb60bdcba480777f1eb41d07461773312 Author: Hans-Christian Noren Egtvedt Date: Sun Feb 26 13:17:39 2017 +0100 docs: remove all references to AVR32 architecture The AVR32 architecture support has been removed from the Linux kernel, hence remove all references to it from Documentation. Signed-off-by: Hans-Christian Noren Egtvedt Signed-off-by: Håvard Skinnemoen Signed-off-by: Nicolas Ferre Acked-by: Andy Shevchenko Acked-by: Boris Brezillon Documentation/admin-guide/README.rst | 2 +- Documentation/admin-guide/kernel-parameters.rst | 1 - Documentation/admin-guide/kernel-parameters.txt | 3 +-- Documentation/features/core/BPF-JIT/arch-support.txt | 1 - Documentation/features/core/generic-idle-thread/arch-support.txt | 1 - Documentation/features/core/jump-labels/arch-support.txt | 1 - Documentation/features/core/tracehook/arch-support.txt | 1 - Documentation/features/debug/KASAN/arch-support.txt | 1 - Documentation/features/debug/gcov-profile-all/arch-support.txt | 1 - Documentation/features/debug/kgdb/arch-support.txt | 1 - Documentation/features/debug/kprobes-on-ftrace/arch-support.txt | 1 - Documentation/features/debug/kprobes/arch-support.txt | 1 - Documentation/features/debug/kretprobes/arch-support.txt | 1 - Documentation/features/debug/optprobes/arch-support.txt | 1 - Documentation/features/debug/stackprotector/arch-support.txt | 1 - Documentation/features/debug/uprobes/arch-support.txt | 1 - Documentation/features/debug/user-ret-profiler/arch-support.txt | 1 - Documentation/features/io/dma-api-debug/arch-support.txt | 1 - Documentation/features/io/dma-contiguous/arch-support.txt | 1 - Documentation/features/io/sg-chain/arch-support.txt | 1 - Documentation/features/lib/strncasecmp/arch-support.txt | 1 - Documentation/features/locking/cmpxchg-local/arch-support.txt | 1 - Documentation/features/locking/lockdep/arch-support.txt | 1 - Documentation/features/locking/queued-rwlocks/arch-support.txt | 1 - Documentation/features/locking/queued-spinlocks/arch-support.txt | 1 - Documentation/features/locking/rwsem-optimized/arch-support.txt | 1 - Documentation/features/perf/kprobes-event/arch-support.txt | 1 - Documentation/features/perf/perf-regs/arch-support.txt | 1 - Documentation/features/perf/perf-stackdump/arch-support.txt | 1 - Documentation/features/sched/numa-balancing/arch-support.txt | 1 - Documentation/features/seccomp/seccomp-filter/arch-support.txt | 1 - Documentation/features/time/arch-tick-broadcast/arch-support.txt | 1 - Documentation/features/time/clockevents/arch-support.txt | 1 - Documentation/features/time/context-tracking/arch-support.txt | 1 - Documentation/features/time/irq-time-acct/arch-support.txt | 1 - Documentation/features/time/modern-timekeeping/arch-support.txt | 1 - Documentation/features/time/virt-cpuacct/arch-support.txt | 1 - Documentation/features/vm/ELF-ASLR/arch-support.txt | 1 - Documentation/features/vm/PG_uncached/arch-support.txt | 1 - Documentation/features/vm/THP/arch-support.txt | 1 - Documentation/features/vm/TLB/arch-support.txt | 1 - Documentation/features/vm/huge-vmap/arch-support.txt | 1 - Documentation/features/vm/ioremap_prot/arch-support.txt | 1 - Documentation/features/vm/numa-memblock/arch-support.txt | 1 - Documentation/features/vm/pte_special/arch-support.txt | 1 - Documentation/media/v4l-drivers/soc-camera.rst | 2 +- 46 files changed, 3 insertions(+), 47 deletions(-) commit 26202873bb51fafdaa51be3e8de7aab9beb49f70 Author: Hans-Christian Noren Egtvedt Date: Sun Feb 26 12:56:39 2017 +0100 avr32: remove support for AVR32 architecture This patch drops support for AVR32 architecture from the Linux kernel. The AVR32 architecture is not keeping up with the development of the kernel, and since it shares so much of the drivers with Atmel ARM SoC, it is starting to hinder these drivers to develop swiftly. Also, all AVR32 AP7 SoC processors are end of lifed from Atmel (now Microchip). Finally, the GCC toolchain is stuck at version 4.2.x, and has not received any patches since the last release from Atmel; 4.2.4-atmel.1.1.3.avr32linux.1. When building kernel v4.10, this toolchain is no longer able to properly link the network stack. Haavard and I have came to the conclusion that we feel keeping AVR32 on life support offers more obstacles for Atmel ARMs, than it gives joy to AVR32 users. I also suspect there are very few AVR32 users left today, if anybody at all. Signed-off-by: Hans-Christian Noren Egtvedt Signed-off-by: Håvard Skinnemoen Signed-off-by: Nicolas Ferre Acked-by: Andy Shevchenko Acked-by: Boris Brezillon CREDITS | 8 + MAINTAINERS | 15 - arch/avr32/Kconfig | 288 --- arch/avr32/Kconfig.debug | 9 - arch/avr32/Makefile | 84 - arch/avr32/boards/atngw100/Kconfig | 65 - arch/avr32/boards/atngw100/Kconfig_mrmt | 80 - arch/avr32/boards/atngw100/Makefile | 3 - arch/avr32/boards/atngw100/evklcd10x.c | 178 -- arch/avr32/boards/atngw100/flash.c | 98 - arch/avr32/boards/atngw100/mrmt.c | 382 ---- arch/avr32/boards/atngw100/setup.c | 324 --- arch/avr32/boards/atstk1000/Kconfig | 109 - arch/avr32/boards/atstk1000/Makefile | 5 - arch/avr32/boards/atstk1000/atstk1000.h | 17 - arch/avr32/boards/atstk1000/atstk1002.c | 330 --- arch/avr32/boards/atstk1000/atstk1003.c | 162 -- arch/avr32/boards/atstk1000/atstk1004.c | 164 -- arch/avr32/boards/atstk1000/flash.c | 98 - arch/avr32/boards/atstk1000/setup.c | 127 -- arch/avr32/boards/favr-32/Kconfig | 22 - arch/avr32/boards/favr-32/Makefile | 1 - arch/avr32/boards/favr-32/flash.c | 98 - arch/avr32/boards/favr-32/setup.c | 366 --- arch/avr32/boards/hammerhead/Kconfig | 43 - arch/avr32/boards/hammerhead/Makefile | 1 - arch/avr32/boards/hammerhead/flash.c | 381 ---- arch/avr32/boards/hammerhead/flash.h | 6 - arch/avr32/boards/hammerhead/setup.c | 247 -- arch/avr32/boards/merisc/Kconfig | 5 - arch/avr32/boards/merisc/Makefile | 1 - arch/avr32/boards/merisc/display.c | 65 - arch/avr32/boards/merisc/flash.c | 139 -- arch/avr32/boards/merisc/merisc.h | 18 - arch/avr32/boards/merisc/merisc_sysfs.c | 64 - arch/avr32/boards/merisc/setup.c | 305 --- arch/avr32/boards/mimc200/Makefile | 1 - arch/avr32/boards/mimc200/flash.c | 143 -- arch/avr32/boards/mimc200/setup.c | 236 -- arch/avr32/boot/images/.gitignore | 4 - arch/avr32/boot/images/Makefile | 57 - arch/avr32/boot/u-boot/Makefile | 3 - arch/avr32/boot/u-boot/empty.S | 1 - arch/avr32/boot/u-boot/head.S | 83 - arch/avr32/configs/atngw100_defconfig | 142 -- arch/avr32/configs/atngw100_evklcd100_defconfig | 158 -- arch/avr32/configs/atngw100_evklcd101_defconfig | 157 -- arch/avr32/configs/atngw100_mrmt_defconfig | 136 -- arch/avr32/configs/atngw100mkii_defconfig | 144 -- .../avr32/configs/atngw100mkii_evklcd100_defconfig | 161 -- .../avr32/configs/atngw100mkii_evklcd101_defconfig | 160 -- arch/avr32/configs/atstk1002_defconfig | 157 -- arch/avr32/configs/atstk1003_defconfig | 137 -- arch/avr32/configs/atstk1004_defconfig | 135 -- arch/avr32/configs/atstk1006_defconfig | 160 -- arch/avr32/configs/favr-32_defconfig | 143 -- arch/avr32/configs/hammerhead_defconfig | 145 -- arch/avr32/configs/merisc_defconfig | 115 - arch/avr32/configs/mimc200_defconfig | 114 - arch/avr32/include/asm/Kbuild | 23 - arch/avr32/include/asm/addrspace.h | 43 - arch/avr32/include/asm/asm-offsets.h | 1 - arch/avr32/include/asm/asm.h | 102 - arch/avr32/include/asm/atomic.h | 243 -- arch/avr32/include/asm/barrier.h | 22 - arch/avr32/include/asm/bitops.h | 314 --- arch/avr32/include/asm/bug.h | 78 - arch/avr32/include/asm/bugs.h | 15 - arch/avr32/include/asm/cache.h | 38 - arch/avr32/include/asm/cacheflush.h | 132 -- arch/avr32/include/asm/checksum.h | 150 -- arch/avr32/include/asm/cmpxchg.h | 115 - arch/avr32/include/asm/current.h | 15 - arch/avr32/include/asm/dma-mapping.h | 14 - arch/avr32/include/asm/dma.h | 8 - arch/avr32/include/asm/elf.h | 105 - arch/avr32/include/asm/fb.h | 21 - arch/avr32/include/asm/ftrace.h | 1 - arch/avr32/include/asm/gpio.h | 6 - arch/avr32/include/asm/hardirq.h | 6 - arch/avr32/include/asm/hw_irq.h | 9 - arch/avr32/include/asm/io.h | 329 --- arch/avr32/include/asm/irq.h | 24 - arch/avr32/include/asm/irqflags.h | 61 - arch/avr32/include/asm/kdebug.h | 12 - arch/avr32/include/asm/kmap_types.h | 10 - arch/avr32/include/asm/kprobes.h | 54 - arch/avr32/include/asm/linkage.h | 7 - arch/avr32/include/asm/mmu.h | 10 - arch/avr32/include/asm/mmu_context.h | 150 -- arch/avr32/include/asm/module.h | 26 - arch/avr32/include/asm/ocd.h | 543 ----- arch/avr32/include/asm/page.h | 104 - arch/avr32/include/asm/pci.h | 8 - arch/avr32/include/asm/pgalloc.h | 102 - arch/avr32/include/asm/pgtable-2level.h | 48 - arch/avr32/include/asm/pgtable.h | 347 --- arch/avr32/include/asm/processor.h | 166 -- arch/avr32/include/asm/ptrace.h | 45 - arch/avr32/include/asm/serial.h | 13 - arch/avr32/include/asm/setup.h | 144 -- arch/avr32/include/asm/shmparam.h | 6 - arch/avr32/include/asm/signal.h | 31 - arch/avr32/include/asm/string.h | 17 - arch/avr32/include/asm/switch_to.h | 49 - arch/avr32/include/asm/syscalls.h | 21 - arch/avr32/include/asm/sysreg.h | 291 --- arch/avr32/include/asm/termios.h | 23 - arch/avr32/include/asm/thread_info.h | 103 - arch/avr32/include/asm/timex.h | 39 - arch/avr32/include/asm/tlb.h | 32 - arch/avr32/include/asm/tlbflush.h | 32 - arch/avr32/include/asm/traps.h | 23 - arch/avr32/include/asm/types.h | 19 - arch/avr32/include/asm/uaccess.h | 337 --- arch/avr32/include/asm/ucontext.h | 12 - arch/avr32/include/asm/unaligned.h | 21 - arch/avr32/include/asm/unistd.h | 44 - arch/avr32/include/asm/user.h | 65 - arch/avr32/include/uapi/asm/Kbuild | 36 - arch/avr32/include/uapi/asm/auxvec.h | 4 - arch/avr32/include/uapi/asm/byteorder.h | 9 - arch/avr32/include/uapi/asm/cachectl.h | 11 - arch/avr32/include/uapi/asm/msgbuf.h | 31 - arch/avr32/include/uapi/asm/posix_types.h | 37 - arch/avr32/include/uapi/asm/ptrace.h | 126 -- arch/avr32/include/uapi/asm/sembuf.h | 25 - arch/avr32/include/uapi/asm/setup.h | 16 - arch/avr32/include/uapi/asm/shmbuf.h | 42 - arch/avr32/include/uapi/asm/sigcontext.h | 34 - arch/avr32/include/uapi/asm/signal.h | 121 - arch/avr32/include/uapi/asm/socket.h | 95 - arch/avr32/include/uapi/asm/sockios.h | 13 - arch/avr32/include/uapi/asm/stat.h | 79 - arch/avr32/include/uapi/asm/swab.h | 35 - arch/avr32/include/uapi/asm/termbits.h | 196 -- arch/avr32/include/uapi/asm/termios.h | 49 - arch/avr32/include/uapi/asm/types.h | 13 - arch/avr32/include/uapi/asm/unistd.h | 347 --- arch/avr32/kernel/.gitignore | 1 - arch/avr32/kernel/Makefile | 15 - arch/avr32/kernel/asm-offsets.c | 24 - arch/avr32/kernel/avr32_ksyms.c | 70 - arch/avr32/kernel/cpu.c | 410 ---- arch/avr32/kernel/entry-avr32b.S | 877 -------- arch/avr32/kernel/head.S | 22 - arch/avr32/kernel/irq.c | 28 - arch/avr32/kernel/kprobes.c | 267 --- arch/avr32/kernel/module.c | 291 --- arch/avr32/kernel/nmi_debug.c | 83 - arch/avr32/kernel/ocd.c | 167 -- arch/avr32/kernel/process.c | 358 --- arch/avr32/kernel/ptrace.c | 357 --- arch/avr32/kernel/setup.c | 609 ----- arch/avr32/kernel/signal.c | 288 --- arch/avr32/kernel/stacktrace.c | 56 - arch/avr32/kernel/switch_to.S | 35 - arch/avr32/kernel/syscall-stubs.S | 153 -- arch/avr32/kernel/syscall_table.S | 347 --- arch/avr32/kernel/time.c | 161 -- arch/avr32/kernel/traps.c | 262 --- arch/avr32/kernel/vmlinux.lds.S | 89 - arch/avr32/lib/Makefile | 11 - arch/avr32/lib/__avr32_asr64.S | 31 - arch/avr32/lib/__avr32_lsl64.S | 31 - arch/avr32/lib/__avr32_lsr64.S | 31 - arch/avr32/lib/clear_user.S | 76 - arch/avr32/lib/copy_user.S | 119 - arch/avr32/lib/csum_partial.S | 47 - arch/avr32/lib/csum_partial_copy_generic.S | 99 - arch/avr32/lib/delay.c | 57 - arch/avr32/lib/findbit.S | 185 -- arch/avr32/lib/io-readsb.S | 49 - arch/avr32/lib/io-readsl.S | 24 - arch/avr32/lib/io-readsw.S | 43 - arch/avr32/lib/io-writesb.S | 52 - arch/avr32/lib/io-writesl.S | 20 - arch/avr32/lib/io-writesw.S | 38 - arch/avr32/lib/memcpy.S | 72 - arch/avr32/lib/memset.S | 72 - arch/avr32/lib/strncpy_from_user.S | 60 - arch/avr32/lib/strnlen_user.S | 67 - arch/avr32/mach-at32ap/Kconfig | 31 - arch/avr32/mach-at32ap/Makefile | 8 - arch/avr32/mach-at32ap/at32ap700x.c | 2368 -------------------- arch/avr32/mach-at32ap/clock.c | 334 --- arch/avr32/mach-at32ap/clock.h | 35 - arch/avr32/mach-at32ap/extint.c | 271 --- arch/avr32/mach-at32ap/hmatrix.c | 88 - arch/avr32/mach-at32ap/hsmc.c | 282 --- arch/avr32/mach-at32ap/hsmc.h | 127 -- arch/avr32/mach-at32ap/include/mach/at32ap700x.h | 245 -- arch/avr32/mach-at32ap/include/mach/board.h | 115 - arch/avr32/mach-at32ap/include/mach/chip.h | 19 - arch/avr32/mach-at32ap/include/mach/cpu.h | 23 - arch/avr32/mach-at32ap/include/mach/gpio.h | 45 - arch/avr32/mach-at32ap/include/mach/hmatrix.h | 55 - arch/avr32/mach-at32ap/include/mach/init.h | 18 - arch/avr32/mach-at32ap/include/mach/io.h | 38 - arch/avr32/mach-at32ap/include/mach/irq.h | 14 - arch/avr32/mach-at32ap/include/mach/pm.h | 27 - arch/avr32/mach-at32ap/include/mach/portmux.h | 30 - arch/avr32/mach-at32ap/include/mach/smc.h | 113 - arch/avr32/mach-at32ap/include/mach/sram.h | 30 - arch/avr32/mach-at32ap/intc.c | 200 -- arch/avr32/mach-at32ap/intc.h | 329 --- arch/avr32/mach-at32ap/pdc.c | 47 - arch/avr32/mach-at32ap/pio.c | 470 ---- arch/avr32/mach-at32ap/pio.h | 180 -- arch/avr32/mach-at32ap/pm-at32ap700x.S | 167 -- arch/avr32/mach-at32ap/pm.c | 243 -- arch/avr32/mach-at32ap/pm.h | 112 - arch/avr32/mach-at32ap/sdramc.h | 76 - arch/avr32/mm/Makefile | 6 - arch/avr32/mm/cache.c | 163 -- arch/avr32/mm/clear_page.S | 25 - arch/avr32/mm/copy_page.S | 28 - arch/avr32/mm/dma-coherent.c | 202 -- arch/avr32/mm/fault.c | 268 --- arch/avr32/mm/init.c | 125 -- arch/avr32/mm/ioremap.c | 93 - arch/avr32/mm/tlb.c | 375 ---- arch/avr32/oprofile/Makefile | 8 - arch/avr32/oprofile/backtrace.c | 81 - arch/avr32/oprofile/op_model_avr32.c | 236 -- include/uapi/linux/elf-em.h | 1 - 226 files changed, 8 insertions(+), 27045 deletions(-) commit 71389703839ebe9cb426c72d5f0bd549592e583c Author: Dan Williams Date: Fri Apr 28 10:23:37 2017 -0700 mm, zone_device: Replace {get, put}_zone_device_page() with a single reference to fix pmem crash The x86 conversion to the generic GUP code included a small change which causes crashes and data corruption in the pmem code - not good. The root cause is that the /dev/pmem driver code implicitly relies on the x86 get_user_pages() implementation doing a get_page() on the page refcount, because get_page() does a get_zone_device_page() which properly refcounts pmem's separate page struct arrays that are not present in the regular page struct structures. (The pmem driver does this because it can cover huge memory areas.) But the x86 conversion to the generic GUP code changed the get_page() to page_cache_get_speculative() which is faster but doesn't do the get_zone_device_page() call the pmem code relies on. One way to solve the regression would be to change the generic GUP code to use get_page(), but that would slow things down a bit and punish other generic-GUP using architectures for an x86-ism they did not care about. (Arguably the pmem driver was probably not working reliably for them: but nvdimm is an Intel feature, so non-x86 exposure is probably still limited.) So restructure the pmem code's interface with the MM instead: get rid of the get/put_zone_device_page() distinction, integrate put_zone_device_page() into __put_page() and and restructure the pmem completion-wait and teardown machinery: Kirill points out that the calls to {get,put}_dev_pagemap() can be removed from the mm fast path if we take a single get_dev_pagemap() reference to signify that the page is alive and use the final put of the page to drop that reference. This does require some care to make sure that any waits for the percpu_ref to drop to zero occur *after* devm_memremap_page_release(), since it now maintains its own elevated reference. This speeds up things while also making the pmem refcounting more robust going forward. Suggested-by: Kirill Shutemov Tested-by: Kirill Shutemov Signed-off-by: Dan Williams Reviewed-by: Logan Gunthorpe Cc: Andrew Morton Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Brian Gerst Cc: Denys Vlasenko Cc: H. Peter Anvin Cc: Josh Poimboeuf Cc: Jérôme Glisse Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-mm@kvack.org Link: http://lkml.kernel.org/r/149339998297.24933.1129582806028305912.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Ingo Molnar drivers/dax/pmem.c | 2 +- drivers/nvdimm/pmem.c | 13 +++++++++++-- include/linux/mm.h | 14 -------------- kernel/memremap.c | 22 +++++++++------------- mm/swap.c | 10 ++++++++++ 5 files changed, 31 insertions(+), 30 deletions(-) commit 733336262b28d383cf72eba2287f1132deea4f47 Author: Abhishek Shah Date: Sun Apr 30 11:04:21 2017 +0530 net: phy: Allow BCM5481x PHYs to setup internal TX/RX clock delay This patch allows users to enable/disable internal TX and/or RX clock delay for BCM5481x series PHYs so as to satisfy RGMII timing specifications. On a particular platform, whether TX and/or RX clock delay is required depends on how PHY connected to the MAC IP. This requirement can be specified through "phy-mode" property in the platform device tree. Signed-off-by: Abhishek Shah Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller drivers/net/phy/broadcom.c | 69 ++++++++++++++++++++++------------------------ 1 file changed, 33 insertions(+), 36 deletions(-) commit d832565032280bae2cbff4fdb4d2c793de60d5be Author: Colin Ian King Date: Sat Apr 29 22:38:57 2017 +0100 net: sunhme: fix spelling mistakes: "ParityErro" -> "ParityError" trivial fix to spelling mistakes in printk message. Signed-off-by: Colin Ian King Signed-off-by: David S. Miller drivers/net/ethernet/sun/sunhme.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9b70de6d0266888b3743f03802502e43131043c8 Author: Scott Wood Date: Fri Apr 28 19:17:41 2017 -0500 bnx2x: Align RX buffers The bnx2x driver is not providing proper alignment on the receive buffers it passes to build_skb(), causing skb_shared_info to be misaligned. skb_shared_info contains an atomic, and while PPC normally supports unaligned accesses, it does not support unaligned atomics. Aligning the size of rx buffers will ensure that page_frag_alloc() returns aligned addresses. This can be reproduced on PPC by setting the network MTU to 1450 (or other non-multiple-of-4) and then generating sufficient inbound network traffic (one or two large "wget"s usually does it), producing the following oops: Unable to handle kernel paging request for unaligned access at address 0xc00000ffc43af656 Faulting instruction address: 0xc00000000080ef8c Oops: Kernel access of bad area, sig: 7 [#1] SMP NR_CPUS=2048 NUMA PowerNV Modules linked in: vmx_crypto powernv_rng rng_core powernv_op_panel leds_powernv led_class nfsd ip_tables x_tables autofs4 xfs lpfc bnx2x mdio libcrc32c crc_t10dif crct10dif_generic crct10dif_common CPU: 104 PID: 0 Comm: swapper/104 Not tainted 4.11.0-rc8-00088-g4c761da #2 task: c00000ffd4892400 task.stack: c00000ffd4920000 NIP: c00000000080ef8c LR: c00000000080eee8 CTR: c0000000001f8320 REGS: c00000ffffc33710 TRAP: 0600 Not tainted (4.11.0-rc8-00088-g4c761da) MSR: 9000000000009033 CR: 24082042 XER: 00000000 CFAR: c00000000080eea0 DAR: c00000ffc43af656 DSISR: 00000000 SOFTE: 1 GPR00: c000000000907f64 c00000ffffc33990 c000000000dd3b00 c00000ffcaf22100 GPR04: c00000ffcaf22e00 0000000000000000 0000000000000000 0000000000000000 GPR08: 0000000000b80008 c00000ffc43af636 c00000ffc43af656 0000000000000000 GPR12: c0000000001f6f00 c00000000fe1a000 000000000000049f 000000000000c51f GPR16: 00000000ffffef33 0000000000000000 0000000000008a43 0000000000000001 GPR20: c00000ffc58a90c0 0000000000000000 000000000000dd86 0000000000000000 GPR24: c000007fd0ed10c0 00000000ffffffff 0000000000000158 000000000000014a GPR28: c00000ffc43af010 c00000ffc9144000 c00000ffcaf22e00 c00000ffcaf22100 NIP [c00000000080ef8c] __skb_clone+0xdc/0x140 LR [c00000000080eee8] __skb_clone+0x38/0x140 Call Trace: [c00000ffffc33990] [c00000000080fb74] skb_clone+0x74/0x110 (unreliable) [c00000ffffc339c0] [c000000000907f64] packet_rcv+0x144/0x510 [c00000ffffc33a40] [c000000000827b64] __netif_receive_skb_core+0x5b4/0xd80 [c00000ffffc33b00] [c00000000082b2bc] netif_receive_skb_internal+0x2c/0xc0 [c00000ffffc33b40] [c00000000082c49c] napi_gro_receive+0x11c/0x260 [c00000ffffc33b80] [d000000066483d68] bnx2x_poll+0xcf8/0x17b0 [bnx2x] [c00000ffffc33d00] [c00000000082babc] net_rx_action+0x31c/0x480 [c00000ffffc33e10] [c0000000000d5a44] __do_softirq+0x164/0x3d0 [c00000ffffc33f00] [c0000000000d60a8] irq_exit+0x108/0x120 [c00000ffffc33f20] [c000000000015b98] __do_irq+0x98/0x200 [c00000ffffc33f90] [c000000000027f14] call_do_irq+0x14/0x24 [c00000ffd4923a90] [c000000000015d94] do_IRQ+0x94/0x110 [c00000ffd4923ae0] [c000000000008d90] hardware_interrupt_common+0x150/0x160 Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 1 + 1 file changed, 1 insertion(+) commit 58073b32b0f716cbd894d503ab2408db9d48aed6 Author: Arkadi Sharshevsky Date: Fri Apr 28 22:39:07 2017 +0300 net: bridge: Fix improper taking over HW learned FDB Commit 7e26bf45e4cb ("net: bridge: allow SW learn to take over HW fdb entries") added the ability to "take over an entry which was previously learned via HW when it shows up from a SW port". However, if an entry was learned via HW and then a control packet (e.g., ARP request) was trapped to the CPU, the bridge driver will update the entry and remove the externally learned flag, although the entry is still present in HW. Instead, only clear the externally learned flag in case of roaming. Fixes: 7e26bf45e4cb ("net: bridge: allow SW learn to take over HW fdb entries") Signed-off-by: Ido Schimmel Signed-off-by: Arkadi Sharashevsky Cc: Nikolay Aleksandrov Acked-by: Nikolay Aleksandrov Signed-off-by: David S. Miller net/bridge/br_fdb.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) commit ba3f571d5dde27fc4ae83aabe2c06ff08087af49 Author: WANG Cong Date: Fri Apr 28 10:04:29 2017 -0700 ipv4: get rid of ip_ra_lock After commit 1215e51edad1 ("ipv4: fix a deadlock in ip_ra_control") we always take RTNL lock for ip_ra_control() which is the only place we update the list ip_ra_chain, so the ip_ra_lock is no longer needed. As Eric points out, BH does not need to disable either, RCU readers don't care. Signed-off-by: Cong Wang Acked-by: Hannes Frederic Sowa Acked-by: Eric Dumazet Signed-off-by: David S. Miller net/ipv4/ip_sockglue.c | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) commit 5010e948420ea1cff85f6c2f64ec7a011aea3d07 Author: Jesper Dangaard Brouer Date: Fri Apr 28 16:25:04 2017 +0200 samples/bpf: bpf_load.c detect and abort if ELF maps section size is wrong The struct bpf_map_def was extended in commit fb30d4b71214 ("bpf: Add tests for map-in-map") with member unsigned int inner_map_idx. This changed the size of the maps section in the generated ELF _kern.o files. Unfortunately the loader in bpf_load.c does not detect or handle this. Thus, older _kern.o files became incompatible, and caused hard-to-debug errors where the syscall validation rejected BPF_MAP_CREATE request. This patch only detect the situation and aborts load_bpf_file(). It also add code comments warning people that read this loader for inspiration for these pitfalls. Fixes: fb30d4b71214 ("bpf: Add tests for map-in-map") Signed-off-by: Jesper Dangaard Brouer Acked-by: Alexei Starovoitov Signed-off-by: David S. Miller samples/bpf/bpf_load.c | 40 +++++++++++++++++++++++++++++++--------- 1 file changed, 31 insertions(+), 9 deletions(-) commit 39f37095990a39a0ee24f7621d06e9a6da6cd815 Author: Dan Carpenter Date: Fri Apr 28 16:03:48 2017 +0300 lwtunnel: fix error path in lwtunnel_fill_encap() We recently added a check to see if nla_nest_start() fails. There are two issues with that. First, if it fails then I don't think we should call nla_nest_cancel(). Second, it's slightly convoluted but the current code returns success but we should return -EMSGSIZE instead. Fixes: a50fe0ffd76f ("lwtunnel: check return value of nla_nest_start") Signed-off-by: Dan Carpenter Acked-by: David Ahern Signed-off-by: David S. Miller net/core/lwtunnel.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 77041e89ce3d4efb9e2364b6d27e97d4bbca74fc Author: Dan Carpenter Date: Fri Apr 28 15:57:15 2017 +0300 liquidio: silence a locking static checker warning Presumably we never hit this return, but static checkers complain that we need to unlock so we may as well fix that. Signed-off-by: Dan Carpenter Acked-by: Felix Manlunas Signed-off-by: David S. Miller drivers/net/ethernet/cavium/liquidio/octeon_mailbox.c | 1 + 1 file changed, 1 insertion(+) commit 66117a9d9a8ca948680d6554769ef9e88f936954 Author: Dan Carpenter Date: Fri Apr 28 15:56:09 2017 +0300 qed: Unlock on error in qed_vf_pf_acquire() My static checker complains that we're holding a mutex on this error path. Let's goto exit instead of returning directly. Fixes: b0bccb69eba3 ("qed: Change locking scheme for VF channel") Signed-off-by: Dan Carpenter Acked-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_vf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1c942c941d3e209fb8729d0c0f6322d55b5e0444 Merge: ba1d82e 804ffe5 Author: David S. Miller Date: Sun Apr 30 22:39:25 2017 -0400 Merge branch 'hns-deferred-probe' lipeng says: ==================== net: hns: bug fix for HNS driver This patchset add support defered dsaf probe when mdio and mbigen module is not insmod. For more details, please refer to individual patch. change log: V4 - > V5: 1. Float on net-next; 2. Delete patch "net: hns: fixed bug that skb used after kfree" from this patchset; V3 -> V4: 1. Delete redundant commit message; 2. Add Reviewed-by: Matthias Brugger ; V2 -> V3: 1. Check return value when platform_get_irq in hns_rcb_get_cfg; V1 -> V2: 1. Return appropriate errno in hns_mac_register_phy; ==================== Signed-off-by: David S. Miller commit 804ffe5c6197fc2696681c597ce096d93eb24af5 Author: lipeng Date: Fri Apr 28 14:49:47 2017 +0800 net: hns: support deferred probe when no mdio In the hip06 and hip07 SoCs, phy connect to mdio bus.The mdio module is probed with module_init, and, as such, is not guaranteed to probe before the HNS driver. So we need to support deferred probe. We check for probe deferral in the mac init, so we not init DSAF when there is no mdio, and free all resource, to later learn that we need to defer the probe. Signed-off-by: lipeng Reviewed-by: Yisen Zhuang Reviewed-by: Matthias Brugger Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 39 +++++++++++++++++++---- 1 file changed, 33 insertions(+), 6 deletions(-) commit 2fdd6bafe37db6b417c9609271db4ea5a92550c0 Author: lipeng Date: Fri Apr 28 14:49:46 2017 +0800 net: hns: support deferred probe when can not obtain irq In the hip06 and hip07 SoCs, the interrupt lines from the DSAF controllers are connected to mbigen hw module. The mbigen module is probed with module_init, and, as such, is not guaranteed to probe before the HNS driver. So we need to support deferred probe. Signed-off-by: lipeng Reviewed-by: Yisen Zhuang Reviewed-by: Matthias Brugger Signed-off-by: David S. Miller drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c | 4 +++- drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c | 8 +++++++- drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.h | 2 +- 3 files changed, 11 insertions(+), 3 deletions(-) commit ba1d82e681781d86de5938ffc3dbba482b45ec85 Merge: 1d11e73 dbf637f Author: David S. Miller Date: Sun Apr 30 22:37:01 2017 -0400 Merge branch 'nfp-XDP_TX-optimizations' Jakub Kicinski says: ==================== nfp: optimize XDP TX and small fixes This series optimizes the nfp XDP TX performance a little bit. I run quick tests on an Intel(R) Xeon(R) CPU E5-2630 v4 @ 2.20GHz. Single core/queue performance for both touch and drop and touch and forward is above 20Mpps @64B packets, drop being 2Mpps faster. I think this is max for a single queue on the low power NFPs. There are also a few minor fixes included for code in net-next. ==================== Signed-off-by: David S. Miller commit dbf637ff3995bc134187bf64b390feab6125173c Author: Jakub Kicinski Date: Thu Apr 27 21:06:20 2017 -0700 nfp: provide 256 bytes of XDP headroom in all configurations For legacy reasons NFP FW may be compiled to DMA packets to a constant offset into the buffer and use the space before it for metadata. This ensures that packets data always start at a certain offset regardless of the amount of preceding metadata. If rx offset is set to 0 there may still be up to 64 bytes of metadata but metadata will start at the beginning of the buffer, instead of: data_start_offset = rx_offset - meta_len Even though we make the buffers larger to accommodate up to 64 bytes of metadata, if there is only N bytes of metadata, we will end up with N bytes of headroom and 64 - N bytes of tailroom. Therefore we can't rely on that space for XDP headroom. Make sure we always allocate full 256 bytes. This, unfortunately, means we can't fit the headroom on an u8 any more. Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller drivers/net/ethernet/netronome/nfp/nfp_net.h | 4 ++-- drivers/net/ethernet/netronome/nfp/nfp_net_common.c | 13 +------------ 2 files changed, 3 insertions(+), 14 deletions(-) commit 85cb207ee34134313acbfb948ae8a7d65f1f19e9 Author: Jakub Kicinski Date: Thu Apr 27 21:06:19 2017 -0700 nfp: don't completely refuse to work with old flashes Right now the required Service Process ABI version is still tied to max ID of known commands. For new NSP commands we are adding we are checking if NSP version is recent enough on command-by-command basis. The driver doesn't have to force the device to have the very latest flash, anything newer than 0.8 should do. Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit d38df0d364c3a154065109eb855f8d15ecd0fae2 Author: Jakub Kicinski Date: Thu Apr 27 21:06:18 2017 -0700 nfp: avoid reading TX queue indexes from the device Reading TX queue indexes from the device memory on each interrupt is expensive. It's doubly expensive with XDP running since we have two TX rings to check there. If the software indexes indicate that the TX queue is completely empty, however, we don't need to look at the device completion index at all. The queuing CPU is doing a wmb() before kicking the device TX so we should be safe to assume on the CPU handling the completions will never see old value of the software copy of the index. Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller drivers/net/ethernet/netronome/nfp/nfp_net_common.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 92e68195ebe914ae8b34cfb92148385a50454806 Author: Jakub Kicinski Date: Thu Apr 27 21:06:17 2017 -0700 nfp: do simple XDP TX buffer recycling On the RX path we follow the "drop if allocation of replacement buffer fails" rule. With XDP we extended that to the TX action, so if XDP prog returned TX but allocation of replacement RX buffer failed, we will drop the packet. To improve our XDP TX performance extend the idea of rings being always full to XDP TX rings. Pre-fill the XDP TX rings with RX buffers, and when XDP prog returns TX action swap the RX buffer with the next buffer from the TX ring. XDP TX complete will no longer free the buffers but let them sit on the TX ring and wait for swap with RX buffer, instead. Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller drivers/net/ethernet/netronome/nfp/nfp_net.h | 2 + .../net/ethernet/netronome/nfp/nfp_net_common.c | 140 ++++++++++++--------- 2 files changed, 85 insertions(+), 57 deletions(-) commit d78005a50f306edb000f0994f0470f151915cf90 Author: Jakub Kicinski Date: Thu Apr 27 21:06:16 2017 -0700 nfp: drop rx_ring param from buffer allocation We will soon allocate RX buffers for caching on XDP TX rings. The rx_ring parameter passed to nfp_net_rx_alloc_one() is not actually used, remove it. Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller drivers/net/ethernet/netronome/nfp/nfp_net_common.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) commit 46c505188b788c050d28174c6e726835e057bb28 Author: Jakub Kicinski Date: Thu Apr 27 21:06:15 2017 -0700 nfp: replace -ENOTSUPP with -EOPNOTSUPP As Or points out in commit 423b3aecf290 ("net/mlx4: Change ENOTSUPP to EOPNOTSUPP"), ENOTSUPP is NFS specific error. Replace it with EOPNOTSUPP. Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller drivers/net/ethernet/netronome/nfp/nfp_bpf_jit.c | 24 +++++++++++----------- .../net/ethernet/netronome/nfp/nfp_net_common.c | 4 ++-- .../net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 +- .../net/ethernet/netronome/nfp/nfp_net_offload.c | 12 +++++------ 4 files changed, 21 insertions(+), 21 deletions(-) commit 1d11e732e7d501c4a231f0b32cf8b81990592689 Author: Willem de Bruijn Date: Thu Apr 27 20:37:58 2017 -0400 virtio-net: use netif_tx_napi_add for tx napi Avoid hashing the tx napi struct into napi_hash[], which is used for busy polling receive queues. Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller drivers/net/virtio_net.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit b5082df8019ac47ff1e6b6454480e39d0223fc46 Author: David Howells Date: Thu Apr 27 22:40:23 2017 +0100 net: Initialise init_net.count to 1 Initialise init_net.count to 1 for its pointer from init_nsproxy lest someone tries to do a get_net() and a put_net() in a process in which current->ns_proxy->net_ns points to the initial network namespace. Signed-off-by: David Howells Signed-off-by: David S. Miller net/core/net_namespace.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 5e0740c445e6ae4026f5e52456ff8d0be9725183 Author: Girish Moodalbail Date: Thu Apr 27 14:11:53 2017 -0700 geneve: fix incorrect setting of UDP checksum flag Creating a geneve link with 'udpcsum' set results in a creation of link for which UDP checksum will NOT be computed on outbound packets, as can be seen below. 11: gen0: mtu 1500 qdisc noop state DOWN link/ether c2:85:27:b6:b4:15 brd ff:ff:ff:ff:ff:ff promiscuity 0 geneve id 200 remote 192.168.13.1 dstport 6081 noudpcsum Similarly, creating a link with 'noudpcsum' set results in a creation of link for which UDP checksum will be computed on outbound packets. Fixes: 9b4437a5b870 ("geneve: Unify LWT and netdev handling.") Signed-off-by: Girish Moodalbail Acked-by: Pravin B Shelar Acked-by: Lance Richardson Signed-off-by: David S. Miller drivers/net/geneve.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c4879789b1fd9764df4465e80096b31d9466de0b Merge: 90a1bb9 baf4d78 Author: David S. Miller Date: Sun Apr 30 22:30:13 2017 -0400 Merge branch 'vxlan-disabled-ipv6' Jiri Benc says: ==================== vxlan: do not error out on disabled IPv6 This patchset fixes a bug with metadata based tunnels when booted with ipv6.disable=1. ==================== Signed-off-by: David S. Miller commit baf4d7860771287f30fbe9b6b2dc18b04361439d Author: Jiri Benc Date: Thu Apr 27 21:24:36 2017 +0200 vxlan: do not output confusing error message The message "Cannot bind port X, err=Y" creates only confusion. In metadata based mode, failure of IPv6 socket creation is okay if IPv6 is disabled and no error message should be printed. But when IPv6 tunnel was requested, such failure is fatal. The vxlan_socket_create does not know when the error is harmless and when it's not. Instead of passing such information down to vxlan_socket_create, remove the message completely. It's not useful. We propagate the error code up to the user space and the port number comes from the user space. There's nothing in the message that the process creating vxlan interface does not know. Signed-off-by: Jiri Benc Signed-off-by: David S. Miller drivers/net/vxlan.c | 2 -- 1 file changed, 2 deletions(-) commit d074bf9600443403aa24fbc12c1f18eadc90f5aa Author: Jiri Benc Date: Thu Apr 27 21:24:35 2017 +0200 vxlan: correctly handle ipv6.disable module parameter When IPv6 is compiled but disabled at runtime, __vxlan_sock_add returns -EAFNOSUPPORT. For metadata based tunnels, this causes failure of the whole operation of bringing up the tunnel. Ignore failure of IPv6 socket creation for metadata based tunnels caused by IPv6 not being available. Fixes: b1be00a6c39f ("vxlan: support both IPv4 and IPv6 sockets in a single vxlan device") Signed-off-by: Jiri Benc Signed-off-by: David S. Miller drivers/net/vxlan.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) commit 90a1bb98167c75b65e2a0527ef9200d172be3442 Author: Andy Shevchenko Date: Thu Apr 27 16:37:01 2017 +0300 bnx2x: Get rid of useless temporary variable Replace pattern int status; ... status = func(...); return status; by return func(...); No functional change intented. Signed-off-by: Andy Shevchenko Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) commit b77f016726bded1fe3abb10272343d39df6b50f1 Author: Andy Shevchenko Date: Thu Apr 27 16:37:00 2017 +0300 bnx2x: Reuse bnx2x_null_format_ver() Reuse bnx2x_null_format_ver() in functions where it's appropriated instead of open coded variant. Signed-off-by: Andy Shevchenko Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-) commit 55b218c12c1d03c6f415f6d3ce929741b15b2dd3 Author: Andy Shevchenko Date: Thu Apr 27 16:36:59 2017 +0300 bnx2x: Replace custom scnprintf() Use scnprintf() when printing version instead of custom open coded variants. Signed-off-by: Andy Shevchenko Acked-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c | 79 +++--------------------- 1 file changed, 9 insertions(+), 70 deletions(-) commit 4750c7be5bcf2b2a6e0217d44499364ba67adec9 Merge: 5d4e344 c2701b3 Author: David S. Miller Date: Sun Apr 30 22:25:59 2017 -0400 Merge tag 'linux-can-next-for-4.12-20170427' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next Marc Kleine-Budde says: ==================== pull-request: can-next 2017-04-25 this is a pull request of 1 patch for net-next/master. This patch by Oliver Hartkopp fixes the build of the broad cast manager with CONFIG_PROC_FS disabled. ==================== Signed-off-by: David S. Miller commit 5d4e3443287b28a6e9c3436adbadba2497880bd1 Author: Chenbo Feng Date: Wed Apr 26 16:41:23 2017 -0700 bpf: Fix inaccurate helper function description The description inside uapi/linux/bpf.h about bpf_get_socket_uid helper function is no longer valid. It returns overflowuid rather than 0 when failed. Signed-off-by: Chenbo Feng Acked-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: David S. Miller include/uapi/linux/bpf.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit d68be71ea14d609a5f31534003319be5db422595 Author: Davide Caratti Date: Wed Apr 26 19:07:35 2017 +0200 tcp: fix access to sk->sk_state in tcp_poll() avoid direct access to sk->sk_state when tcp_poll() is called on a socket using active TCP fastopen with deferred connect. Use local variable 'state', which stores the result of sk_state_load(), like it was done in commit 00fd38d938db ("tcp: ensure proper barriers in lockless contexts"). Fixes: 19f6d3f3c842 ("net/tcp-fastopen: Add new API support") Signed-off-by: Davide Caratti Acked-by: Wei Wang Signed-off-by: David S. Miller net/ipv4/tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d1f496fd8f34a40458d0eda6be0655926559e546 Author: Eric Dumazet Date: Wed Apr 26 09:09:23 2017 -0700 bpf: restore skb->sk before pskb_trim() call While testing a fix [1] in ___pskb_trim(), addressing the WARN_ON_ONCE() in skb_try_coalesce() reported by Andrey, I found that we had an skb with skb->sk set but no skb->destructor. This invalidated heuristic found in commit 158f323b9868 ("net: adjust skb->truesize in pskb_expand_head()") and in cited patch. Considering the BUG_ON(skb->sk) we have in skb_orphan(), we should restrain the temporary setting to a minimal section. [1] https://patchwork.ozlabs.org/patch/755570/ net: adjust skb->truesize in ___pskb_trim() Fixes: 8f917bba0042 ("bpf: pass sk to helper functions") Signed-off-by: Eric Dumazet Cc: Willem de Bruijn Cc: Andrey Konovalov Acked-by: Daniel Borkmann Acked-by: Alexei Starovoitov Acked-by: Willem de Bruijn Signed-off-by: David S. Miller net/core/filter.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ae3696c167cc04d32634c4af82f43b446c5176b0 Author: Alexandre Belloni Date: Wed Apr 26 12:06:28 2017 +0200 net: macb: fix phy interrupt parsing Since 83a77e9ec415, the phydev irq is explicitly set to PHY_POLL when there is no pdata. It doesn't work on DT enabled platforms because the phydev irq is already set by libphy before. Fixes: 83a77e9ec415 ("net: macb: Added PCI wrapper for Platform Driver.") Signed-off-by: Alexandre Belloni Acked-by: Nicolas Ferre Signed-off-by: David S. Miller drivers/net/ethernet/cadence/macb.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) commit 72d622b42258a0ed0b6e8c0f40d7628de935d058 Author: Theodore Ts'o Date: Sun Apr 30 20:08:05 2017 -0400 ext4: replace BUG_ON with WARN_ONCE in ext4_end_bio() Add fallback code and a WARN_ONCE() call instead of a BUG_ON() in the ext4_end_bio() function. Signed-off-by: Theodore Ts'o fs/ext4/page-io.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) commit dddbd6ac8f25b2d61e3e1c7134e3b3e1b9cd8670 Author: Jan Kara Date: Sun Apr 30 18:29:10 2017 -0400 ext4: avoid unnecessary transaction stalls during writeback Currently ext4_writepages() submits all pages with transaction started. When no page needs block allocation or extent conversion we can submit all dirty pages in the inode while holding a single transaction handle and when device is congested this can take significant amount of time. Thus ext4_writepages() can block transaction commits for extended periods of time. Take for example a simple benchmark simulating PostgreSQL database (pgioperf in mmtest). The benchmark runs 16 processes doing random reads from a huge file, one process doing random writes to the huge file, and one process doing sequential writes to a small files and frequently running fsync. With unpatched kernel transaction commits take on average ~18s with standard deviation of ~41s, top 5 commit times are: 274.466639s, 126.467347s, 86.992429s, 34.351563s, 31.517653s. After this patch transaction commits take on average 0.1s with standard deviation of 0.15s, top 5 commit times are: 0.563792s, 0.519980s, 0.509841s, 0.471700s, 0.469899s [ Modified so we use an explicit do_map flag instead of relying on io_end not being allocated, the since io_end->inode is needed for I/O error handling. -- tytso ] Signed-off-by: Jan Kara Signed-off-by: Theodore Ts'o fs/ext4/inode.c | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) commit 09d9d82745801ca69c00f91f89c8f047b586e8cc Author: Sebastian Reichel Date: Thu Apr 27 17:30:06 2017 +0200 hwmon: (twl4030-madc) drop driver This driver is no longer needed: * It has no mainline users * It has no DT support and OMAP is DT only * iio-hwmon can be used for madc, which also works with DT Signed-off-by: Sebastian Reichel Acked-by: Guenter Roeck Signed-off-by: Guenter Roeck drivers/hwmon/Kconfig | 10 ---- drivers/hwmon/Makefile | 1 - drivers/hwmon/twl4030-madc-hwmon.c | 118 ------------------------------------- 3 files changed, 129 deletions(-) commit 8dd5b698c27948503e0ceb6f824c18178e509098 Merge: 5b36d8f 3dfc3eb Author: David S. Miller Date: Sun Apr 30 11:33:37 2017 -0400 Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/next-queue Jeff Kirsher says: ==================== 40GbE Intel Wired LAN Driver Updates 2017-04-30 This series contains updates to i40e and i40evf only. Jake provides majority of the changes in this series, starting with the renaming of a flag to avoid confusion. Then renamed a variable to a more meaningful name to clarify what is actually being done and to reduce confusion. Amortizes the wait time when initializing or disabling lots of VFs by using i40e_reset_all_vfs() and i40e_vsi_stop_rings_no_wait(). Cleaned up a unnecessary delay since pci_disable_sriov() already has its own delay, so need to add a additional delay when removing VFs. Avoid using the same name flags for both vsi->state and pf->state, to make code review easier and assist future work to use the correct state field when checking bits. Use DECLARE_BITMAP() to ensure that we always allocate enough space for flags. Replace hw_disabled_flags with the new _AUTO_DISABLED flags, which are more readable because we are not setting an *_ENABLED flag to disable the feature. Alex corrects a oversight where we were not reprogramming the ports after a reset, which was causing us to lose all of the receive tunnel offloads. Arnd Bergmann moves the declaration of a local variable to avoid a warning seen on architectures with larger pages about an unused variable. ==================== Signed-off-by: David S. Miller commit 5b36d8f5e514c60a23d8f57d8e1eb5089d41bb09 Merge: c08bac0 68fe1d5 Author: David S. Miller Date: Sun Apr 30 11:30:13 2017 -0400 Merge branch '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/next-queue Jeff Kirsher says: ==================== 1GbE Intel Wired LAN Driver Updates 2017-04-30 This series contains updates to e1000e only. Jarod Wilson fixes an issue where the workaround for 82574 & 82583 is needed for i218 as well, so set the appropriate flags. Sasha adds support for the upcoming new i219 devices for the client platform (CannonLake), which includes the support for 38.4MHz frequency to support PTP on CannonLake. ==================== Signed-off-by: David S. Miller commit 71653eb64bcca6110c42aadfd50b8d54d3a88079 Author: Marcel Holtmann Date: Sun Apr 30 06:51:41 2017 -0700 Bluetooth: Add selftest for ECDH key generation Since the ECDH key generation takes a different path, it needs to be tested as well. For this generate the public debug key from the private debug key and compare both. This also moves the seeding of the private key into the SMP calling code to allow for easier re-use of the ECDH key generation helper. Signed-off-by: Marcel Holtmann Signed-off-by: Johan Hedberg net/bluetooth/ecdh_helper.c | 3 --- net/bluetooth/smp.c | 38 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 38 insertions(+), 3 deletions(-) commit f958315358bc37aede49dc3cd7e27e037994ae84 Author: Marcel Holtmann Date: Sun Apr 30 06:51:40 2017 -0700 Bluetooth: zero kpp input for key generation When generating new ECDH keys with kpp, the shared secret input needs to be set to NULL. Fix this by including kpp_request_set_input call. Fixes: 58771c1c ("Bluetooth: convert smp and selftest to crypto kpp API") Signed-off-by: Marcel Holtmann Signed-off-by: Johan Hedberg net/bluetooth/ecdh_helper.c | 1 + 1 file changed, 1 insertion(+) commit ae53b5dbafc9713359696a9cff7e25f2aeaafada Merge: 81bc8e3 a9bbb45 Author: Mark Brown Date: Sun Apr 30 22:17:44 2017 +0900 Merge remote-tracking branch 'regulator/topic/vctrl' into regulator-next commit 81bc8e386f394961b22cb0758c78cee8e0905233 Merge: 0603b37 264b88c c6182ac d6c1dc3 43594dd c635df4 Author: Mark Brown Date: Sun Apr 30 22:17:36 2017 +0900 Merge remote-tracking branches 'regulator/topic/notifier', 'regulator/topic/pfuze100', 'regulator/topic/settle', 'regulator/topic/tps65132' and 'regulator/topic/twl6030' into regulator-next commit 0603b37e1ea097f597aa405f6a91933dbbd58bec Merge: 59e4c63 f7d37bc 2f3c578 4549368 45a8617 c314341 Author: Mark Brown Date: Sun Apr 30 22:17:31 2017 +0900 Merge remote-tracking branches 'regulator/topic/helpers', 'regulator/topic/hi655x', 'regulator/topic/lm363x', 'regulator/topic/ltc3589' and 'regulator/topic/ltc3676' into regulator-next commit 59e4c636df102c914b03696df11ec5d988af5df1 Merge: bde1e61 0e69c2e af367af e85c5a1 5339c34 Author: Mark Brown Date: Sun Apr 30 22:17:25 2017 +0900 Merge remote-tracking branches 'regulator/topic/anatop', 'regulator/topic/arizona', 'regulator/topic/bd9571mvw-m' and 'regulator/topic/const' into regulator-next commit bde1e61b8e18a0654be78576ab2b0bdfeb5ca05d Merge: 6a8007c c93609a Author: Mark Brown Date: Sun Apr 30 22:17:23 2017 +0900 Merge remote-tracking branch 'regulator/topic/core' into regulator-next commit 6a8007c83a7bc5ccfa02b425f7463dab3dce686a Merge: 5a7ad11 0c08aaf 75f8811 c90722b Author: Mark Brown Date: Sun Apr 30 22:17:18 2017 +0900 Merge remote-tracking branches 'regulator/fix/isl9305', 'regulator/fix/rk808' and 'regulator/fix/tps65023' into regulator-linus commit 20d5c84bef067b7e804a163e2abca16c47125bad Merge: 258ced9 82bab88 5cf015d 870e0dd Author: Mark Brown Date: Sun Apr 30 22:16:48 2017 +0900 Merge remote-tracking branches 'asoc/topic/wm8960', 'asoc/topic/wm8978' and 'asoc/topic/zte-tdm' into asoc-next commit 258ced9d083f364572a4ecfdb6cdd188eff883af Merge: 7b7b384 ea22a26 c12c1aa fe3a980 fd9f069 b3bbef4 Author: Mark Brown Date: Sun Apr 30 22:16:41 2017 +0900 Merge remote-tracking branches 'asoc/topic/uda1380', 'asoc/topic/unregister', 'asoc/topic/ux500', 'asoc/topic/wm5100' and 'asoc/topic/wm8903' into asoc-next commit 7b7b3849577932830bf17b59988ebcc67537c042 Merge: 65fd525 bf3c6ef a03faba d7766aa 0636e8b 8405265 Author: Mark Brown Date: Sun Apr 30 22:16:37 2017 +0900 Merge remote-tracking branches 'asoc/topic/tegra', 'asoc/topic/tlv320aic23', 'asoc/topic/topology', 'asoc/topic/twl6040' and 'asoc/topic/txx9' into asoc-next commit 65fd5252b40c68177946001edf2078bbbefa2c83 Merge: ae17a14 9abe464 65ed0a8 3e086ed 9e85438 12dc0f3 Author: Mark Brown Date: Sun Apr 30 22:16:31 2017 +0900 Merge remote-tracking branches 'asoc/topic/sta529', 'asoc/topic/sti', 'asoc/topic/stm', 'asoc/topic/sunxi' and 'asoc/topic/tas2552' into asoc-next commit ae17a14f14079d1e23f8b9824d6bafce6af9fa3e Merge: fc180c0 aba611f 570c70a d27f3b4 adbdba3 71c314d Author: Mark Brown Date: Sun Apr 30 22:16:26 2017 +0900 Merge remote-tracking branches 'asoc/topic/samsung', 'asoc/topic/sgtl5000', 'asoc/topic/simple', 'asoc/topic/sirf' and 'asoc/topic/ssm4567' into asoc-next commit fc180c0eafd9c55237b84101853f87746ffc92cd Merge: 757fc30 f49efce 7952b4b 9ba2da5 7b87463 Author: Mark Brown Date: Sun Apr 30 22:16:21 2017 +0900 Merge remote-tracking branches 'asoc/topic/rockchip', 'asoc/topic/rt5514', 'asoc/topic/rt5645' and 'asoc/topic/rt5677' into asoc-next commit 757fc30a1a9711ac00d958d4c3386dd904bc1295 Merge: ccf9fc8 c869ce5 2261cf1 943b731 97c52eb Author: Mark Brown Date: Sun Apr 30 22:16:18 2017 +0900 Merge remote-tracking branches 'asoc/topic/nau8824', 'asoc/topic/omap', 'asoc/topic/pxa' and 'asoc/topic/qcom' into asoc-next commit ccf9fc86d63cbb5c46e96748f1937ce528f49ad2 Merge: 50946b2 56af0e4 7c0c200 362c594 babd658 Author: Mark Brown Date: Sun Apr 30 22:16:04 2017 +0900 Merge remote-tracking branches 'asoc/topic/max9878', 'asoc/topic/max98927', 'asoc/topic/mtk' and 'asoc/topic/nau8540' into asoc-next commit 50946b2aecf747e68a50eefa78f1ff9e009a6c0a Merge: 0f57c12 23aaf4c e6d56d2 8f7206d Author: Mark Brown Date: Sun Apr 30 22:16:01 2017 +0900 Merge remote-tracking branches 'asoc/topic/fsl-ssi', 'asoc/topic/hi6220' and 'asoc/topic/imx' into asoc-next commit 0f57c12ab467494f66c9d616358703ae8a5098d6 Merge: 99dd3c5 59c15fc 404785f 5ace37b 24dbd9e f2a3ee0 Author: Mark Brown Date: Sun Apr 30 22:15:55 2017 +0900 Merge remote-tracking branches 'asoc/topic/es7134', 'asoc/topic/es8328', 'asoc/topic/fsl', 'asoc/topic/fsl-asrc' and 'asoc/topic/fsl-esai' into asoc-next commit 99dd3c53f6a0350f17234baff728144cc981a8b7 Merge: 2f42a77 06bdf38 13023ff 8f42c23 ea2a2ad c9afc18 Author: Mark Brown Date: Sun Apr 30 22:15:50 2017 +0900 Merge remote-tracking branches 'asoc/topic/cs35l35', 'asoc/topic/cs53l30', 'asoc/topic/da7213', 'asoc/topic/dio2125' and 'asoc/topic/dwc' into asoc-next commit 2f42a776612d1c23b8b91d8a7074842ebe5e3b9a Merge: cce9b27 51a2c94 4898b61 e54fde6 381ca1d Author: Mark Brown Date: Sun Apr 30 22:15:45 2017 +0900 Merge remote-tracking branches 'asoc/topic/adsp', 'asoc/topic/ak4613', 'asoc/topic/au1761' and 'asoc/topic/blackfin' into asoc-next commit cce9b271e5e05ba43ce9332652ef309b9e44c87a Merge: 245e302 97c415a Author: Mark Brown Date: Sun Apr 30 22:15:43 2017 +0900 Merge remote-tracking branch 'asoc/topic/rt5665' into asoc-next commit 245e302a4d17d70f223882f6fbd2c4cb35059ca9 Merge: 0c2964c e8dffe6 Author: Mark Brown Date: Sun Apr 30 22:15:42 2017 +0900 Merge remote-tracking branch 'asoc/topic/rcar' into asoc-next commit 0c2964cb38ef9dc44c11db7516bab00c1967e52e Merge: d872f04 081dc8a Author: Mark Brown Date: Sun Apr 30 22:15:41 2017 +0900 Merge remote-tracking branch 'asoc/topic/intel' into asoc-next commit d872f04606eec35de3bc4e409e186d01dacdd3d6 Merge: 9dfc539 991454e Author: Mark Brown Date: Sun Apr 30 22:15:40 2017 +0900 Merge remote-tracking branch 'asoc/topic/core' into asoc-next commit 9dfc53942d04875c4b2fd1706f5abf93957e7106 Merge: d0a906d 49b2e27 Author: Mark Brown Date: Sun Apr 30 22:15:37 2017 +0900 Merge remote-tracking branch 'asoc/fix/cs4271' into asoc-linus commit d0a906d3a1b4eedee4114f2e5f7842fbb462ae55 Merge: ec7f984 fc99d23 Author: Mark Brown Date: Sun Apr 30 22:15:36 2017 +0900 Merge remote-tracking branch 'asoc/fix/rcar' into asoc-linus commit ec7f9844ef90ee3ac18194f24fa478577dcfc4ae Merge: 5a7ad11 dc9617c Author: Mark Brown Date: Sun Apr 30 22:15:35 2017 +0900 Merge tag 'asoc-fix-v4.11-rc7' into asoc-linus ASoC: Fixes for v4.11 A few last minute fixes for v4.11, the STI fix is relatively large but driver specific and has been cooking in -next for a little while now: - A fix from Takashi for some suspend/resume related crashes in the Intel drivers. - A fix from Mousumi Jana for issues with incorrectly created enumeration controls generated from topology files which could cause problems for userspace. - Fixes from Arnaud Pouliquen for some crashes due to races with the interrupt handler in the STI driver. # gpg: Signature made Wed 26 Apr 2017 00:27:33 KST # gpg: using RSA key ADE668AA675718B59FE29FEA24D68B725D5487D0 # gpg: issuer "broonie@kernel.org" # gpg: key 0D9EACE2CD7BEEBC: no public key for trusted key - skipped # gpg: key 0D9EACE2CD7BEEBC marked as ultimately trusted # gpg: key CCB0A420AF88CD16: no public key for trusted key - skipped # gpg: key CCB0A420AF88CD16 marked as ultimately trusted # gpg: key 162614E316005C11: no public key for trusted key - skipped # gpg: key 162614E316005C11 marked as ultimately trusted # gpg: key A730C53A5621E907: no public key for trusted key - skipped # gpg: key A730C53A5621E907 marked as ultimately trusted # gpg: key 276568D75C6153AD: no public key for trusted key - skipped # gpg: key 276568D75C6153AD marked as ultimately trusted # gpg: Good signature from "Mark Brown " [ultimate] # gpg: aka "Mark Brown " [ultimate] # gpg: aka "Mark Brown " [ultimate] # gpg: aka "Mark Brown " [ultimate] # gpg: aka "Mark Brown " [ultimate] # gpg: aka "Mark Brown " [ultimate] commit 82bab88910ee358305a2f31ab30dad59f1b6421c Author: Daniel Baluta Date: Wed Apr 26 16:09:52 2017 +0300 ASoC: codec: wm8960: Relax bit clock computation when using PLL Bitclk is derived from sysclk using bclk_divs. Sysclk can be derived in two ways: (1) directly from MLCK (2) MCLK via PLL Commit 3c01b9ee2ab9d0d ("ASoC: codec: wm8960: Relax bit clock computation") relaxed bitclk computation when sysclk is directly derived from MCLK. Lets do the same thing when sysclk is derived via PLL. Signed-off-by: Daniel Baluta Signed-off-by: Mark Brown sound/soc/codecs/wm8960.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) commit 66772eda0edbfbbbe7767a6b5d07e09dae84403d Author: Daniel Baluta Date: Wed Apr 26 16:09:51 2017 +0300 ASoC: codec: wm9860: avoid maybe-uninitialized warning The new PLL configuration code triggers a harmless warning: sound/soc/codecs/wm8960.c: In function 'wm8960_configure_clocking': sound/soc/codecs/wm8960.c:735:3: error: 'best_freq_out' may be used uninitialized in this function [-Werror=maybe-uninitialized] wm8960_set_pll(codec, freq_in, best_freq_out); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ sound/soc/codecs/wm8960.c:699:12: note: 'best_freq_out' was declared here Fix this by reworking the code such that: 1) When there is no PLL freq available return -EINVAL and make sure *bclk_idx, *dac_idx, *sysclk_idx are initialized with invalid values. 2) When there is a PLL freq available initialize *bclk_idx, *dac_idx and *sysclk_idx with correct values and immediately return the freq available. Fixes: 84fdc00d519f ("ASoC: codec: wm9860: Refactor PLL out freq search") Fixes: 303e8954af8d ("ASoC: codec: wm8960: Stop when a matching PLL freq is found") Suggested-by: Arnd Bergmann Signed-off-by: Daniel Baluta Acked-by: Arnd Bergmann Signed-off-by: Mark Brown sound/soc/codecs/wm8960.c | 26 +++++++++----------------- 1 file changed, 9 insertions(+), 17 deletions(-) commit 0a0ab1d2cc5d5e68191488235074b5b30d793bb7 Author: Eli Cohen Date: Tue Feb 28 16:52:21 2017 -0600 net/mlx5: E-Switch, Avoid redundant memory allocation struct esw_mc_addr is a small struct that can be part of struct mlx5_eswitch. Define it as a field and not as a pointer and save the kzalloc call and then error flow handling. Signed-off-by: Eli Cohen Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 20 ++------------------ drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 9 ++++++++- 2 files changed, 10 insertions(+), 19 deletions(-) commit 0f6e4cf67411631be7f010fdb5c2d82c0c8705c0 Author: Eran Ben Elisha Date: Wed Apr 26 13:42:04 2017 +0300 net/mlx5e: Disable HW LRO when PCI is slower than link on striding RQ We will activate the HW LRO only on servers with PCI BW > MAX LINK BW, or when PCI BW > 16Gbps. On other cases we do not want LRO by default as LRO sessions might get timeout and add redundant software overhead. Tested: ethtool -k | grep large-receive-offload On systems with and without the limitations. Signed-off-by: Eran Ben Elisha Cc: kernel-team@fb.com Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) commit b1b03bded1ee8b88ad85055a15d5f62ab6ddde44 Author: Tariq Toukan Date: Mon Apr 3 10:48:30 2017 +0300 net/mlx5e: Use u8 as ownership type in mlx5e_get_cqe() CQE ownership indication is as small as a single bit. Use u8 to speedup the comparison. Signed-off-by: Tariq Toukan Cc: kernel-team@fb.com Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit ad78af9b88f3d12134d6406468e7798e65c385c0 Author: Tariq Toukan Date: Wed Feb 15 17:05:39 2017 +0200 net/mlx5e: Use prefetchw when a write is to follow "prefetchw()" prefetches the cacheline for write. Use it for skb->data, as soon we'll be copying the packet header there. Performance: Single-stream packet-rate tested with pktgen. Packets are dropped in tc level to zoom into driver data-path. Larger gain is expected for smaller packets, as less time is spent on handling SKB fragments, making the path shorter and the improvement more significant. --------------------------------------------- packet size | before | after | gain | 64B | 4,113,306 | 4,778,720 | 16% | 1024B | 3,633,819 | 3,950,593 | 8.7% | Signed-off-by: Tariq Toukan Cc: kernel-team@fb.com Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1f5b1e47ee08f6c623db599b6c23ce7c20b79458 Author: Tariq Toukan Date: Wed Mar 29 11:46:10 2017 +0300 net/mlx5e: Optimize poll ICOSQ completion queue UMR operations are more frequent and important. Check them first, and add a compiler branch predictor hint. According to current design, ICOSQ CQ can contain at most one pending CQE per napi. Poll function is optimized accordingly. Performance: Single-stream packet-rate tested with pktgen. Packets are dropped in tc level to zoom into driver data-path. Larger gain is expected for larger packet sizes, as BW is higher and UMR posts are more frequent. --------------------------------------------- packet size | before | after | gain | 64B | 4,092,370 | 4,113,306 | 0.5% | 1024B | 3,421,435 | 3,633,819 | 6.2% | Signed-off-by: Tariq Toukan Cc: kernel-team@fb.com Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c | 62 ++++++++++++----------- 1 file changed, 33 insertions(+), 29 deletions(-) commit a2fa1fe5ad13e7f11b82291fc08bdc654fac741e Author: Hadar Hen Zion Date: Tue Feb 14 11:20:24 2017 +0200 net/mlx5e: Act on delay probe time updates The user can change delay_first_probe_time parameter through sysctl. Listen to NETEVENT_DELAY_PROBE_TIME_UPDATE notifications and update the intervals for updating the neighbours 'used' value periodic task and for flow HW counters query periodic task. Both of the intervals will be update only in case the new delay prob time value is lower the current interval. Since the driver saves only one min interval value and not per device, the users will be able to set lower interval value for updating neighbour 'used' value periodic task but they won't be able to schedule a higher interval for this periodic task. The used interval for scheduling neighbour 'used' value periodic task is the minimal delay prob time parameter ever seen by the driver. Signed-off-by: Hadar Hen Zion Reviewed-by: Or Gerlitz Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 39 ++++++++++++++++++++++++ 1 file changed, 39 insertions(+) commit f6dfb4c3f2161c23ab2939dd1b5f133dcdf147c6 Author: Hadar Hen Zion Date: Fri Feb 24 12:16:33 2017 +0200 net/mlx5e: Update neighbour 'used' state using HW flow rules counters When IP tunnel encapsulation rules are offloaded, the kernel can't see the traffic of the offloaded flow. The neighbour for the IP tunnel destination of the offloaded flow can mistakenly become STALE and deleted by the kernel since its 'used' value wasn't changed. To make sure that a neighbour which is used by the HW won't become STALE, we proactively update the neighbour 'used' value every DELAY_PROBE_TIME period, when packets were matched and counted by the HW for one of the tunnel encap flows related to this neighbour. The periodic task that updates the used neighbours is scheduled when a tunnel encap rule is successfully offloaded into HW and keeps re-scheduling itself as long as the representor's neighbours list isn't empty. Add, remove, lookup and status change operations done over the representor's neighbours list or the neighbour hash entry encaps list are all serialized by RTNL lock. Signed-off-by: Hadar Hen Zion Reviewed-by: Or Gerlitz Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 52 +++++++++++++++++++ drivers/net/ethernet/mellanox/mlx5/core/en_rep.h | 11 ++++ drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 58 ++++++++++++++++++++++ drivers/net/ethernet/mellanox/mlx5/core/en_tc.h | 3 ++ drivers/net/ethernet/mellanox/mlx5/core/fs_core.h | 5 ++ .../net/ethernet/mellanox/mlx5/core/fs_counters.c | 24 ++++++++- include/linux/mlx5/driver.h | 1 + 7 files changed, 152 insertions(+), 2 deletions(-) commit 232c001398ae8406dc0daf07b14e6ec9a5562719 Author: Hadar Hen Zion Date: Mon Mar 20 12:56:47 2017 +0200 net/mlx5e: Add support to neighbour update flow In order to offload TC encap rules, the driver does a lookup for the IP tunnel neighbour according to the output device and the destination IP given by the user. To keep tracking after the validity state of such neighbours, we keep the neighbours information (pair of device pointer and destination IP) in a hash table maintained at the relevant egress representor and register to get NETEVENT_NEIGH_UPDATE events. When getting neighbour update netevent, we search for a match among the cached neighbours entries used for encapsulation. In case the neighbour isn't valid, we can't offload the flow into the HW. We cache the flow (requested matching and actions) in the driver and offload the rule later, when the neighbour is resolved and becomes valid. When a flow is only cached in the driver and not offloaded into HW yet, we use EAGAIN return value to mark it internally, the TC ndo still returns success. Listen to kernel neighbour update netevents to trace relevant neighbours validity state: 1. If a neighbour becomes valid, offload the related rules to HW. 2. If the neighbour becomes invalid, remove the related rules from HW. 3. If the neighbour mac address was changed, update the encap header. Remove all the offloaded rules using the old encap header from the HW and insert new rules to HW with updated encap header. Access to the neighbors hash table is protected by RTNL lock of its caller or by the table's spinlock. Details of the locking/synchronization among the different actions applied on the neighbour table: Add/remove operations - protected by RTNL lock of its caller (all TC commands are protected by RTNL lock). Add and remove operations are initiated only when the user inserts/removes a TC rule into/from the driver. Lookup/remove operations - since the lookup operation is done from netevent notifier block, RTNL lock can't be used (atomic context). Use the table's spin lock to protect lookups from TC user removal operation. bh is used since netevent can be called from a softirq context. Lookup/add operations - The hash table access functions are taking care of the protection between lookup and add operations. When adding/removing encap headers and rules to/from the HW, RTNL lock is used. It can happen when: 1. The user inserts/removes a TC rule into/from the driver (TC commands are protected by RTNL lock of it's caller). 2. The driver gets neighbour notification event, which reports about neighbour validity status change. Before adding/removing encap headers and rules to/from the HW, RTNL lock is taken. A neighbour hash table entry should be freed when its encap list is empty. Since The neighbour update netevent notification schedules a neighbour update work that uses the neighbour hash entry, it can't be freed unconditionally when the encap list becomes empty during TC delete rule flow. Use reference count to protect from freeing neighbour hash table entry while it's still in use. When the user asks to unregister a netdvice used by one of the neigbours, neighbour removal notification is received. Then we take a reference on the neighbour and don't free it until the relevant encap entries (and flows) are marked as invalid (not offloaded) and removed from HW. As long as the encap entry is still valid (checked under RTNL lock) we can safely access the neighbour device saved on mlx5e_neigh struct. Signed-off-by: Hadar Hen Zion Reviewed-by: Or Gerlitz Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 230 +++++++++++++++++++++- drivers/net/ethernet/mellanox/mlx5/core/en_rep.h | 38 +++- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 202 +++++++++++++++---- drivers/net/ethernet/mellanox/mlx5/core/en_tc.h | 6 + drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 1 + 5 files changed, 434 insertions(+), 43 deletions(-) commit 37b498ff238549b30c9e70d4e45f522fd53b8994 Author: Hadar Hen Zion Date: Thu Feb 2 16:43:35 2017 +0200 net/mlx5e: Add neighbour hash table to the representors Add hash table to the representors which is to be used by the next patch to save neighbours information in the driver. In order to offload IP tunnel encapsulation rules, the driver must find the tunnel dst neighbour according to the output device and the destination address given by the user. The next patch will cache the neighbors information in the driver to allow support in neigh update flow for tunnel encap rules. The neighbour entries are also saved in a list so we easily iterate over them when querying statistics in order to provide 'used' feedback to the kernel neighbour NUD core. Signed-off-by: Hadar Hen Zion Reviewed-by: Or Gerlitz Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 107 +++++++++++++++++++++-- drivers/net/ethernet/mellanox/mlx5/core/en_rep.h | 30 +++++++ 2 files changed, 129 insertions(+), 8 deletions(-) commit 033354d501862ca1f58caa1e5c5775712e1bff17 Author: Hadar Hen Zion Date: Thu Feb 2 16:14:21 2017 +0200 net/mlx5e: Read neigh parameters with proper locking The nud_state and hardware address fields are protected by the neighbour lock, we should acquire it before accessing those parameters. Use this lock to avoid inconsistency between the neighbour validity state and it's hardware address. Signed-off-by: Hadar Hen Zion Reviewed-by: Or Gerlitz Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) commit 0b67a38fe699ee60c56d193d33c9c7392cabaea7 Author: Hadar Hen Zion Date: Tue Feb 14 14:03:45 2017 +0200 net/mlx5e: Use flag to properly monitor a flow rule offloading state Instead of relaying on the 'flow->rule' pointer value which can be valid or invalid (in case the FW returns an error while trying to offload the rule), monitor the rule state using a flag. In downstream patch which adds support to IP tunneling neigh update flow, a TC rule could be cached in the driver and not offloaded into the HW. In this case, the flow handle pointer stays NULL. Check the offloaded flag to properly deal with rules which are currently not offloaded when querying rule statistics. This patch doesn't add any new functionality. Signed-off-by: Hadar Hen Zion Reviewed-by: Or Gerlitz Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 1a8552bd81af5f4f19b26ac58e8c85866d4f7de8 Author: Hadar Hen Zion Date: Thu Feb 2 15:01:02 2017 +0200 net/mlx5e: Remove output device parameter from create encap header helpers definition Passing output device parameter to the helper functions that deal with creation of encapsulation headers is redundant. Output device parameter can be defined inside those helpers, no need to pass it. Refactor the code by removing the parameter from the function signature. This patch doesn't change any functionality. Signed-off-by: Hadar Hen Zion Reviewed-by: Or Gerlitz Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 29 ++++++++++++------------- 1 file changed, 14 insertions(+), 15 deletions(-) commit c1ae11521b1e87523553ddd3c1aa88be3d710c96 Author: Or Gerlitz Date: Tue Apr 25 16:19:26 2017 +0300 net/mlx5e: Move the encap entry structure from the eswitch header The encap entry structure isn't manipulated by the eswitch code, hence it can/needs to be removed from the eswitch header. Do that, and change it to have mlx5e_ prefix. This patch doesn't change any functionality. Signed-off-by: Or Gerlitz Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_rep.h | 13 +++++++++++++ drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 11 +++++------ drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 13 ------------- 3 files changed, 18 insertions(+), 19 deletions(-) commit 45247bf2985edd983bb241dfa71f0c17713c8e7b Author: Or Gerlitz Date: Tue Apr 25 15:30:08 2017 +0300 net/mlx5: Remove encap entry pointer from the eswitch flow attributes Encap wise, the tc eswitch flow attribute struct needs to have only the encap ID which is programmed later to the HW and none of the higher level encap params, fix that. This patch doesn't change any functionality. Signed-off-by: Or Gerlitz Signed-off-by: Saeed Mahameed drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 29 ++++++++++++---------- drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 2 +- .../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 2 +- 3 files changed, 18 insertions(+), 15 deletions(-) commit 1d447a39142e0eaf8526fcb37699e6b8cce5eaa8 Author: Saeed Mahameed Date: Mon Apr 24 12:36:42 2017 +0300 net/mlx5e: Extendable vport representor netdev private data Make representor netdev private data extendable by adding new struct "mlx5e_rep_priv" and use it as the rep netdev private data struct instead of directly pointing to mlx5_eswitch_rep. Added new en_rep.h header file to contain all representor related definitions and prototypes, and moved all representor specific logic into en_rep.c. Needed for downstream patches to extend representor functionality to support neighbour update. Signed-off-by: Saeed Mahameed Reviewed-by: Or Gerlitz drivers/net/ethernet/mellanox/mlx5/core/en.h | 20 --- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 77 +++------- drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 176 ++++++++++++++++------ drivers/net/ethernet/mellanox/mlx5/core/en_rep.h | 55 +++++++ drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 4 +- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 22 ++- 6 files changed, 224 insertions(+), 130 deletions(-) commit c869ce5aaf8f470c8cf32638e7cd498f57118fa5 Author: John Hsu Date: Thu Apr 27 11:22:50 2017 +0800 ASoC: nau8824: leave Class D gain at chip default Remove initial configuration of Class D gain for 1R and 2L. Leave them at the chip default. Signed-off-by: John Hsu Signed-off-by: John Hsu Signed-off-by: Mark Brown sound/soc/codecs/nau8824.c | 6 ------ 1 file changed, 6 deletions(-) commit 25535f7e0b418fe8b2251008cfcb05d272c2e8e0 Author: John Hsu Date: Thu Apr 27 11:15:37 2017 +0800 ASoC: nau8824: rename controls to match DAPM controls Rename the name of kcontrols to match up the DAPM widget controls. Signed-off-by: John Hsu Signed-off-by: John Hsu Signed-off-by: Mark Brown sound/soc/codecs/nau8824.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) commit 081dc8ab46df85382658822e951ea79be87382b0 Author: Guneshwor Singh Date: Thu Apr 27 12:21:22 2017 +0530 ASoC: Intel: Skylake: Return negative error code skl_tplg_add_pipe() returned EEXIST instead of negative EEXIST, so fix that and handle the return value as well. Signed-off-by: Guneshwor Singh Signed-off-by: Vinod Koul Reviewed-by: Takashi Sakamoto Signed-off-by: Mark Brown sound/soc/intel/skylake/skl-topology.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) commit 9ed4aefe6f5f7e1dfe6abe8b15cfc8c48963b6c0 Author: Vinod Koul Date: Thu Apr 27 12:21:21 2017 +0530 ASoC: Intel: Skylake: Fix unused variable warning With compiler option W=1, we have one more warning in the driver for 'set but unused variable', so remove the unused variable to fix it. sound/soc/intel/skylake/skl-pcm.c: In function ‘skl_platform_open’: sound/soc/intel/skylake/skl-pcm.c:954:26: warning: variable ‘runtime’ set but not used [-Wunused-but-set-variable] struct snd_pcm_runtime *runtime; Signed-off-by: Vinod Koul Reviewed-by: Takashi Sakamoto Signed-off-by: Mark Brown sound/soc/intel/skylake/skl-pcm.c | 2 -- 1 file changed, 2 deletions(-) commit 351d74e4d7eacaab2ed0092b855355d5e2907117 Author: Arnd Bergmann Date: Thu Apr 27 12:59:58 2017 +0200 ASoC: Intel: Skylake: fix uninitialized pointer use The error handling in bxt_sst_dsp_init() got changed in a way that it now derefences an uninitialized pointer when printing a warning about the device not being found: sound/soc/intel/skylake/bxt-sst.c: In function 'bxt_sst_dsp_init': sound/soc/intel/skylake/bxt-sst.c:567:14: error: 'skl' may be used uninitialized in this function [-Werror=maybe-uninitialized] As we do have a valid device pointer available at the call site, let's use that instead. Fixes: 9fe9c7119283 ("ASoC: Intel: Skylake: Move sst common initialization to a helper function") Signed-off-by: Arnd Bergmann Reviewed-by: Takashi Sakamoto Signed-off-by: Mark Brown sound/soc/intel/skylake/bxt-sst.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 65ed0a8d1f24abd79be149253025de8949321900 Author: Dan Carpenter Date: Fri Apr 28 16:22:10 2017 +0300 ASoC: sti: Fix error handling if of_clk_get() fails We intended to return here. The current code has a static checker warning because we set "ret" but don't use it. Fixes: 76c2145ded6b ("ASoC: sti: Add CPU DAI driver for playback") Signed-off-by: Dan Carpenter Acked-by: Arnaud POULIQUEN Signed-off-by: Mark Brown sound/soc/sti/uniperif_player.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 49b2e27ab9f66b0a22c21980ad8118a4038324ae Author: Alexander Sverdlin Date: Sat Apr 29 12:19:33 2017 +0200 ASoC: cs4271: configure reset GPIO as output During reset "refactoring" the output configuration was lost. This commit repairs sound on EDB93XX boards. Fixes: 9a397f4 ("ASoC: cs4271: add regulator consumer support") Signed-off-by: Alexander Sverdlin Signed-off-by: Mark Brown Cc: # 4.6+ sound/soc/codecs/cs4271.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c9afc1834e8132783772d73007706d3ae3848483 Author: Jose Abreu Date: Fri Apr 28 10:55:25 2017 +0100 ASoC: dwc: Disallow building designware_pcm as a module Designware PCM is an extension to Designware I2S and they are dependent on each other. For this reason, make Designware PCM a boolean which will compile with Desigwnare I2S module. The name of the module is not changed but the name of the files need to be changed. Also, without this commit we get errors when probbing designware_i2s module because of unspecified license: designware_pcm: module license 'unspecified' taints kernel. Disabling lock debugging due to kernel taint designware_pcm: Unknown symbol __rcu_read_lock (err 0) designware_pcm: Unknown symbol devm_snd_soc_register_platform (err 0) designware_pcm: Unknown symbol synchronize_rcu (err 0) designware_pcm: Unknown symbol __rcu_read_unlock (err 0) designware_pcm: Unknown symbol snd_soc_set_runtime_hwparams (err 0) So, this is really needed as a fix. Fixes: 79361b2b98b7 ("ASoC: dwc: Add PIO PCM extension") Signed-off-by: Lubomir Rintel Signed-off-by: Jose Abreu Signed-off-by: Mark Brown sound/soc/dwc/Kconfig | 4 +- sound/soc/dwc/Makefile | 6 +- sound/soc/dwc/designware_i2s.c | 753 ----------------------------------------- sound/soc/dwc/designware_pcm.c | 284 ---------------- sound/soc/dwc/dwc-i2s.c | 753 +++++++++++++++++++++++++++++++++++++++++ sound/soc/dwc/dwc-pcm.c | 281 +++++++++++++++ 6 files changed, 1039 insertions(+), 1042 deletions(-) commit 68fe1d5da548aab2b6b1c28a9137248d6ccfcc43 Author: Sasha Neftin Date: Thu Apr 6 10:27:03 2017 +0300 e1000e: Add Support for 38.4MHZ frequency Add support for 38.4MHz frequency is required for PTP on CannonLake. SYSTIM frequency adjustment attributes for TIMINCA are get/set dependent on the hardware clock frequency for a different types of adapters. 38.4MHz frequency supported by CannonLake and active once time synchronisation mechanism was enabled Changed abbreviation from Hz to HZ to be compliant checkpatch code style Signed-off-by: Sasha Neftin Reviewed-by: Raanan Avargil Reviewed-by: Dima Ruinskiy Tested-by: Aaron Brown Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/e1000e/e1000.h | 28 +++++++++-------- drivers/net/ethernet/intel/e1000e/netdev.c | 49 +++++++++++++++++++----------- 2 files changed, 48 insertions(+), 29 deletions(-) commit c8744f44aeaee1caf5d6595e9351702253260088 Author: Sasha Neftin Date: Thu Apr 6 10:26:47 2017 +0300 e1000e: Add Support for CannonLake The propagation of CannonLake mac type to driver functionality Signed-off-by: Sasha Neftin Reviewed-by: Raanan Avargil Reviewed-by: Dima Ruinskiy Tested-by: Aaron Brown Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/e1000e/ethtool.c | 10 ++-- drivers/net/ethernet/intel/e1000e/ich8lan.c | 82 +++++++++++++++-------------- drivers/net/ethernet/intel/e1000e/netdev.c | 29 +++++----- drivers/net/ethernet/intel/e1000e/ptp.c | 4 +- 4 files changed, 63 insertions(+), 62 deletions(-) commit 3a3173b9c37aa1f07f8a71021114ee29a5712acb Author: Sasha Neftin Date: Thu Apr 6 10:26:32 2017 +0300 e1000e: Initial Support for CannonLake i219 (6) and i219 (7) are the next LOM generations that will be available on the nextIntel Client platform (CannonLake) This patch provides the initial support for these devices Signed-off-by: Sasha Neftin Reviewed-by: Raanan Avargil Reviewed-by: Dima Ruinskiy Tested-by: Aaron Brown Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/e1000e/e1000.h | 4 +++- drivers/net/ethernet/intel/e1000e/hw.h | 5 +++++ drivers/net/ethernet/intel/e1000e/ich8lan.c | 20 ++++++++++++++++++++ drivers/net/ethernet/intel/e1000e/netdev.c | 5 +++++ 4 files changed, 33 insertions(+), 1 deletion(-) commit 10ed1e0bd144b5c3a92ca0c8fd06eb80b80649e5 Author: Jarod Wilson Date: Tue Jul 26 14:25:35 2016 -0400 e1000e: fix PTP on e1000_pch_lpt variants I've got reports that the Intel I-218V NIC in Intel NUC5i5RYH systems used as a PTP slave experiences random ~10 hour clock jumps, which are resolved if the same workaround for the 82574 and 82583 is employed, so set the appropriate flag2 in e1000_pch_lpt_info too. Reported-by: Rupesh Patel Signed-off-by: Jarod Wilson Tested-by: Aaron Brown Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/e1000e/ich8lan.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 3dfc3eb581645bc503c7940861f494a0d75615da Author: Arnd Bergmann Date: Wed Apr 19 19:29:48 2017 +0200 i40evf: hide unused variable On architectures with larger pages, we get a warning about an unused variable: drivers/net/ethernet/intel/i40evf/i40evf_main.c: In function 'i40evf_configure_rx': drivers/net/ethernet/intel/i40evf/i40evf_main.c:690:21: error: unused variable 'netdev' [-Werror=unused-variable] This moves the declaration into the #ifdef to avoid the warning. Fixes: dab86afdbbd1 ("i40e/i40evf: Change the way we limit the maximum frame size for Rx") Signed-off-by: Arnd Bergmann Acked-by: Jacob Keller Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/i40evf/i40evf_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 283aeafe6bf06af48068478eaf332f7a227e9af4 Author: Jacob Keller Date: Wed Apr 19 09:25:59 2017 -0400 i40evf: allocate queues before we setup the interrupts and q_vectors This matches the ordering of how we free stuff during reset and remove. It also makes logical sense because we set the interrupts based on the number of queues. Currently this doesn't really matter in practice. However a future patch moves the assignment of num_active_queues into i40evf_alloc_queues, which is required by i40evf_set_interrupt_capability. Signed-off-by: Jacob Keller Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/i40evf/i40evf_main.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) commit 707636c6481696c3b73209c9a7f8c482f0748373 Author: Jacob Keller Date: Wed Apr 19 09:25:58 2017 -0400 i40evf: remove I40E_FLAG_FDIR_ATR_ENABLED The flag used by the common code and PF code is I40E_FLAG_FD_ATR_ENABLED, not *FDIR*. It turns out none of the txrx code actually shared with the VF driver actually checks the ATR flag. This is made even more obvious by the typo in the VF header file. Let's just remove the flag from the VF driver since it's not needed. Signed-off-by: Jacob Keller Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/i40evf/i40evf.h | 1 - 1 file changed, 1 deletion(-) commit 47994c119a36e28e1779efabc92d6ab5329a6f75 Author: Jacob Keller Date: Wed Apr 19 09:25:57 2017 -0400 i40e: remove hw_disabled_flags in favor of using separate flag bits The hw_disabled_flags field was added as a way of signifying that a feature was automatically or temporarily disabled. However, we actually only use this for FDir features. Replace its use with new _AUTO_DISABLED flags instead. This is more readable, because you aren't setting an *_ENABLED flag to *disable* the feature. Additionally, clean up a few areas where we used these bits. First, we don't really need to set the auto-disable flag for ATR if we're fully disabling the feature via ethtool. Second, we should always clear the auto-disable bits in case they somehow got set when the feature was disabled. However, avoid displaying a message that we've re-enabled the feature. Third, we shouldn't be re-enabling ATR in the SB ntuple add flow, because it might have been disabled due to space constraints. Instead, we should just wait for the fdir_check_and_reenable to be called by the watchdog. Overall, this change allows us to simplify some code by removing an extra field we didn't need, and the result should make it more clear as to what we're actually doing with these flags. Signed-off-by: Jacob Keller Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/i40e/i40e.h | 9 +---- drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 6 +-- drivers/net/ethernet/intel/i40e/i40e_main.c | 53 +++++++++++++------------- drivers/net/ethernet/intel/i40e/i40e_txrx.c | 22 ++++------- 4 files changed, 38 insertions(+), 52 deletions(-) commit 789f38ca70e0b2848472aaf5f278aa3deabd4a4e Author: Jacob Keller Date: Wed Apr 19 09:25:56 2017 -0400 i40evf: remove needless min_t() on num_online_cpus()*2 We already set pairs to the value of adapter->num_active_queues. This value is limited by vsi_res->num_queue_pairs and num_online_cpus(). This means that pairs by definition is already smaller than num_online_cpus()*2, so we don't even need to bother with this check. Lets just remove it and update the comment. Signed-off-by: Jacob Keller Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/i40evf/i40evf_main.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 0da36b9774cc24bac4bff446edf49f31aa98a282 Author: Jacob Keller Date: Wed Apr 19 09:25:55 2017 -0400 i40e: use DECLARE_BITMAP for state fields Instead of assuming our flags fit within an unsigned long, use DECLARE_BITMAP which will ensure that we always allocate enough space. Additionally, use __I40E_STATE_SIZE__ markers as the last element of the enumeration so that the size of the BITMAP is compile-time assigned rather than programmer-time assigned. This ensures that potential future flag additions do not actually overrun the array. This is especially important as 32bit systems would only have 32bit longs instead of 64bit longs as we generally have assumed in the prior code. This change also removes a dereference of the state fields throughout the code, so it does have a bit of code churn. The conversions were automated using sed replacements with an alternation s/&(vsi->back|vsi|pf)->state/\1->state/ s/&adapter->vsi.state/adapter->vsi.state/ For debugfs, we modify the printing so that we can display chunks of the state value on new lines. This ensures that we can print the entire set of state values. Additionally, we now print them as 08lx to ensure that they display nicely. Signed-off-by: Jacob Keller Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/i40e/i40e.h | 8 +- drivers/net/ethernet/intel/i40e/i40e_client.c | 16 +- drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 13 +- drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 42 ++-- drivers/net/ethernet/intel/i40e/i40e_main.c | 233 ++++++++++----------- drivers/net/ethernet/intel/i40e/i40e_ptp.c | 4 +- drivers/net/ethernet/intel/i40e/i40e_txrx.c | 14 +- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 18 +- drivers/net/ethernet/intel/i40evf/i40e_txrx.c | 8 +- drivers/net/ethernet/intel/i40evf/i40evf.h | 4 +- drivers/net/ethernet/intel/i40evf/i40evf_main.c | 10 +- 11 files changed, 189 insertions(+), 181 deletions(-) commit d19cb64b9222a93498c9dc8447503bfa87863d99 Author: Jacob Keller Date: Fri Apr 21 13:38:05 2017 -0700 i40e: separate PF and VSI state flags Avoid using the same named flags for both vsi->state and pf->state. This makes code review easier, as it is more likely that future authors will use the correct state field when checking bits. Previous commits already found issues with at least one check, and possibly others may be incorrect. This reduces confusion as it is more clear what each flag represents, and which flags are valid for which state field. Signed-off-by: Jacob Keller Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/i40e/i40e.h | 12 ++++- drivers/net/ethernet/intel/i40e/i40e_client.c | 4 +- drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 4 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 66 ++++++++++++------------- drivers/net/ethernet/intel/i40e/i40e_txrx.c | 8 +-- drivers/net/ethernet/intel/i40evf/i40e_txrx.c | 8 +-- drivers/net/ethernet/intel/i40evf/i40evf.h | 7 ++- drivers/net/ethernet/intel/i40evf/i40evf_main.c | 10 ++-- 8 files changed, 64 insertions(+), 55 deletions(-) commit 2318b4018a9c2773a13f4fdac64d5519679fc171 Author: Jacob Keller Date: Wed Apr 19 09:25:53 2017 -0400 i40e: remove unnecessary msleep() delay in i40e_free_vfs The delay was added because of a desire to ensure that the VF driver can finish up removing. However, pci_disable_sriov already has its own ssleep() call that will sleep for an entire second, so there is no reason to add extra delay on top of this by using msleep here. In practice, an msleep() won't have a huge impact on timing but there is no real value in keeping it, so lets just simplify the code and remove it. Signed-off-by: Jacob Keller Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 2 -- drivers/net/ethernet/intel/i40evf/i40evf_main.c | 2 +- 3 files changed, 2 insertions(+), 4 deletions(-) commit 707d088af33043642692d4522225cb9ca638e7ee Author: Jacob Keller Date: Wed Apr 19 09:25:52 2017 -0400 i40e: amortize wait time when disabling lots of VFs Just as we do in i40e_reset_all_vfs, save some time when freeing VFs by amortizing the wait time for stopping queues. We can use i40e_vsi_stop_rings_no_wait() to begin the process of stopping all the VF rings at once. Then, once we've started the process on each VF we can begin waiting for the VFs to stop. This helps reduce the total wait time by a large factor. Signed-off-by: Jacob Keller Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) commit 1f190d9369487c1edfaea4d892231a62ea8206cc Author: Alexander Duyck Date: Wed Apr 19 09:25:51 2017 -0400 i40e: Reprogram port offloads after reset This patch corrects a major oversight in that we were not reprogramming the ports after a reset. As a result we completely lost all of the Rx tunnel offloads on receive including Rx checksum, RSS on inner headers, and ATR. The fix for this is pretty standard as all we needed to do is reset the filter bits to pending for all active filters and schedule the sync event. Signed-off-by: Alexander Duyck Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/i40e/i40e_main.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) commit 27826fd5d357d38b5cf834f9adcc70e6c2254d69 Author: Jacob Keller Date: Wed Apr 19 09:25:50 2017 -0400 i40e: rename index to port to avoid confusion The .index field of i40e_udp_port_config represents the udp port number. Rename this variable to port so that it is more obvious. Signed-off-by: Jacob Keller Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/i40e/i40e.h | 2 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) commit 1b48437028603ec51d5a1eb276c941c866375a3e Author: Jacob Keller Date: Thu Apr 13 04:45:55 2017 -0400 i40e: make use of i40e_reset_all_vfs when initializing new VFs When allocating a large number of VFs, the driver previously used i40e_reset_vf in a sequence. Just as when performing a normal reset, this accumulates a large amount of delay for handling all of the VFs in sequence. This delay is mainly due to a hardware requirement to wait after initiating a reset on the VF. We recently added a new function, i40e_reset_all_vfs() which can be used to amortize the delay time, by first triggering all VF resets, then waiting once, and finally cleaning up and allocating the VFs. This is almost as good as truly running the resets in parallel. In order to avoid sending a spurious reset message to a client interface, we have a check to see whether we've assigned pf->num_alloc_vfs yet. This was originally intended as a way to distinguish the "initialization" case from the regular reset case. Unfortunately, this means that we can't directly use i40e_reset_all_vfs yet. Lets avoid this check of pf->num_alloc_vfs by replacing it with a proper VSI state bit which we can use instead. This makes the intention much clearer and allows us to re-use the i40e_reset_all_vfs function directly. Change-ID: I694279b37eb6b5a91b6670182d0c15d10244fd6e Signed-off-by: Jacob Keller Reviewed-by: Mitch Williams Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 10 +++++++--- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h | 1 + 2 files changed, 8 insertions(+), 3 deletions(-) commit 6322e63c35d68eac9c4a5ed59ea1c6d1e2746892 Author: Jacob Keller Date: Thu Apr 13 04:45:54 2017 -0400 i40e: properly spell I40E_VF_STATE_* flags These flags represent the state of the VF at various times. Do not spell them as _STAT_ which can be confusing to readers who may think these refer to statistics. Change-ID: I6bc092cd472e8276896a1fd7498aced2084312df Signed-off-by: Jacob Keller Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 2 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 98 +++++++++++----------- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h | 14 ++-- 4 files changed, 58 insertions(+), 58 deletions(-) commit 2d6f1da168e1d62c47f7d50135ac4cbd8411dcb1 Author: Dean Jenkins Date: Fri Apr 28 13:57:26 2017 +0100 Bluetooth: hci_ldisc: Add protocol check to hci_uart_tx_wakeup() Before attempting to schedule a work-item onto hu->write_work in hci_uart_tx_wakeup(), check that the Data Link protocol layer is still bound to the HCI UART driver. Failure to perform this protocol check causes a race condition between the work queue hu->write_work running hci_uart_write_work() and the Data Link protocol layer being unbound (closed) in hci_uart_tty_close(). Note hci_uart_tty_close() does have a "cancel_work_sync(&hu->write_work)" but it is ineffective because it cannot prevent work-items being added to hu->write_work after cancel_work_sync() has run. Therefore, add a check for HCI_UART_PROTO_READY into hci_uart_tx_wakeup() which prevents scheduling of the work queue when HCI_UART_PROTO_READY is in the clear state. However, note a small race condition remains because the hci_uart_tx_wakeup() thread can run in parallel with the hci_uart_tty_close() thread so it is possible that a schedule of hu->write_work can occur when HCI_UART_PROTO_READY is cleared. A complete solution needs locking of the threads which is implemented in a future commit. Signed-off-by: Dean Jenkins Signed-off-by: Marcel Holtmann drivers/bluetooth/hci_ldisc.c | 3 +++ 1 file changed, 3 insertions(+) commit 048e1bd3a27fbeb84ccdff52e165370c1339a193 Author: Dean Jenkins Date: Fri Apr 28 13:57:25 2017 +0100 Bluetooth: hci_ldisc: Add protocol check to hci_uart_dequeue() Before attempting to dequeue a Data Link protocol encapsulated message, check that the Data Link protocol is still bound to the HCI UART driver. This makes the code consistent with the usage of the other proto function pointers. Therefore, add a check for HCI_UART_PROTO_READY into hci_uart_dequeue() and return NULL if the Data Link protocol is not bound. This is needed for robustness as there is a scheduling race condition. hci_uart_write_work() is scheduled to run via work queue hu->write_work from hci_uart_tx_wakeup(). Therefore, there is a delay between scheduling hci_uart_write_work() to run and hci_uart_dequeue() running whereby the Data Link protocol layer could become unbound during the scheduling delay. In this case, without the check, the call to the unbound Data Link protocol layer dequeue function can crash. It is noted that hci_uart_tty_close() has a "cancel_work_sync(&hu->write_work)" statement but this only reduces the window of the race condition because it is possible for a new work-item to be added to work queue hu->write_work after the call to cancel_work_sync(). For example, Data Link layer retransmissions can be added to the work queue after the cancel_work_sync() has finished. Signed-off-by: Dean Jenkins Signed-off-by: Marcel Holtmann drivers/bluetooth/hci_ldisc.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit ab00f89fdff61975fa52a61608080ea7b8d8e800 Author: Dean Jenkins Date: Fri Apr 28 13:57:24 2017 +0100 Bluetooth: hci_ldisc: Add protocol check to hci_uart_send_frame() Before attempting to send a HCI message, check that the Data Link protocol is still bound to the HCI UART driver. This makes the code consistent with the usage of the other proto function pointers. Therefore, add a check for HCI_UART_PROTO_READY into hci_uart_send_frame() and return -EUNATCH if the Data Link protocol is not bound. This also allows hci_send_frame() to report the error of an unbound Data Link protocol layer. Therefore, it assists with diagnostics into why HCI messages are being sent when the Data Link protocol is not bound and avoids potential crashes. Signed-off-by: Dean Jenkins Signed-off-by: Marcel Holtmann drivers/bluetooth/hci_ldisc.c | 3 +++ 1 file changed, 3 insertions(+) commit 377a6eac58e3492fbf74fed0a5e40ee90ed73f8e Author: Frédéric Danis Date: Fri Apr 28 13:26:11 2017 +0200 Bluetooth: Add module license for HCI UART Nokia H4+ Fix the following error preventing to load Nokia H4+ module: kernel: [ 826.461619] hci_nokia: module license 'unspecified' taints kernel. kernel: [ 826.461629] Disabling lock debugging due to kernel taint kernel: [ 826.461836] hci_nokia: Unknown symbol gpiod_get_value_cansleep (err 0) kernel: [ 826.461876] hci_nokia: Unknown symbol devm_kmalloc (err 0) kernel: [ 826.461908] hci_nokia: Unknown symbol gpiod_set_value (err 0) kernel: [ 826.461937] hci_nokia: Unknown symbol serdev_device_set_baudrate (err 0) kernel: [ 826.461994] hci_nokia: Unknown symbol gpiod_set_value_cansleep (err 0) kernel: [ 826.462021] hci_nokia: Unknown symbol hci_uart_tx_wakeup (err 0) kernel: [ 826.462043] hci_nokia: Unknown symbol serdev_device_set_flow_control (err 0) kernel: [ 826.462064] hci_nokia: Unknown symbol gpiod_to_irq (err 0) kernel: [ 826.462085] hci_nokia: Unknown symbol serdev_device_open (err 0) kernel: [ 826.462106] hci_nokia: Unknown symbol gpiod_get_value (err 0) kernel: [ 826.462150] hci_nokia: Unknown symbol clk_prepare (err 0) kernel: [ 826.462182] hci_nokia: Unknown symbol pm_runtime_enable (err 0) kernel: [ 826.462204] hci_nokia: Unknown symbol h4_recv_buf (err 0) kernel: [ 826.462246] hci_nokia: Unknown symbol serdev_device_write_flush (err 0) kernel: [ 826.462268] hci_nokia: Unknown symbol serdev_device_get_tiocm (err 0) kernel: [ 826.462298] hci_nokia: Unknown symbol driver_unregister (err 0) kernel: [ 826.462318] hci_nokia: Unknown symbol serdev_device_wait_until_sent (err 0) kernel: [ 826.462347] hci_nokia: Unknown symbol __serdev_device_driver_register (err 0) kernel: [ 826.462384] hci_nokia: Unknown symbol serdev_device_set_tiocm (err 0) kernel: [ 826.462417] hci_nokia: Unknown symbol clk_get_rate (err 0) kernel: [ 826.462454] hci_nokia: Unknown symbol __pm_runtime_resume (err 0) kernel: [ 826.462486] hci_nokia: Unknown symbol serdev_device_close (err 0) kernel: [ 826.462524] hci_nokia: Unknown symbol cancel_work_sync (err 0) kernel: [ 826.462546] hci_nokia: Unknown symbol btbcm_set_bdaddr (err 0) kernel: [ 826.462567] hci_nokia: Unknown symbol clk_disable (err 0) kernel: [ 826.462610] hci_nokia: Unknown symbol __pm_runtime_disable (err 0) kernel: [ 826.462632] hci_nokia: Unknown symbol hci_uart_register_device (err 0) kernel: [ 826.462653] hci_nokia: Unknown symbol clk_enable (err 0) kernel: [ 826.462675] hci_nokia: Unknown symbol __pm_runtime_idle (err 0) kernel: [ 826.462700] hci_nokia: Unknown symbol clk_unprepare (err 0) Signed-off-by: Frédéric Danis Acked-by: Sebastian Reichel Signed-off-by: Marcel Holtmann drivers/bluetooth/hci_nokia.c | 7 +++++++ 1 file changed, 7 insertions(+) commit ab89f0bdd63a3721f7cd3f064f39fc4ac7ca14d4 Author: Szymon Janc Date: Mon Apr 24 18:25:04 2017 -0700 Bluetooth: Fix user channel for 32bit userspace on 64bit kernel Running 32bit userspace on 64bit kernel results in MSG_CMSG_COMPAT being defined as 0x80000000. This results in sendmsg failure if used from 32bit userspace running on 64bit kernel. Fix this by accounting for MSG_CMSG_COMPAT in flags check in hci_sock_sendmsg. Signed-off-by: Szymon Janc Signed-off-by: Marko Kiiskila Signed-off-by: Marcel Holtmann Cc: stable@vger.kernel.org net/bluetooth/hci_sock.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 763d9a302ab18da0a0078c9788ed6566d0c974e3 Author: Salvatore Benedetto Date: Tue Apr 25 16:59:47 2017 +0100 Bluetooth: allocate data for kpp on heap Bluetooth would crash when computing ECDH keys with kpp if VMAP_STACK is enabled. Fix by allocating data passed to kpp on heap. Fixes: 58771c1c ("Bluetooth: convert smp and selftest to crypto kpp API") Signed-off-by: Salvatore Benedetto Signed-off-by: Marcel Holtmann net/bluetooth/ecdh_helper.c | 22 ++++++++++++++++------ net/bluetooth/selftest.c | 22 +++++++++++++++++----- 2 files changed, 33 insertions(+), 11 deletions(-) commit 216646e4d82e847791f0ba66c439dedd36cb119f Author: Wei Yongjun Date: Thu Apr 27 15:21:13 2017 +0000 irqchip/mbigen: Fix return value check in mbigen_device_probe() In case of error, the function devm_ioremap() returns NULL pointer not ERR_PTR(). Use devm_ioremap_resource() instead of devm_ioremap() to fix the IS_ERR() test issue. Fixes: 76e1f77f9c26 ("irqchip/mbigen: Introduce mbigen_of_create_domain()") Signed-off-by: Wei Yongjun Cc: Marc Zyngier Cc: Kefeng Wang Cc: Jason Cooper Link: http://lkml.kernel.org/r/20170427152113.31147-1-weiyj.lk@gmail.com Signed-off-by: Thomas Gleixner drivers/irqchip/irq-mbigen.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit e21c7316d8ddcf1fd679591d1427e937999a7cf5 Author: Roy Pledge Date: Mon Apr 17 16:55:19 2017 -0400 soc/fsl/qbman: Disable IRQs for deferred QBMan work Work for Congestion State Notifications (CSCN) and Message Ring (MR) handling is handled via the workqueue mechanism. This requires the driver to disable those IRQs before scheduling the work and re-enabling it once the work is completed so that the interrupt doesn't continually fire. Signed-off-by: Roy Pledge Signed-off-by: Scott Wood drivers/soc/fsl/qbman/qman.c | 5 +++++ 1 file changed, 5 insertions(+) commit 4ba251626ff1ac3447f9a05ecfcec7f85b6c8a91 Author: Valentin Longchamp Date: Fri Feb 17 11:29:47 2017 +0100 soc/fsl/qe: add EXPORT_SYMBOL for the 2 qe_tdm functions This allows to build the fsl_ucc_hdlc driver as a module. Signed-off-by: Valentin Longchamp Signed-off-by: Scott Wood drivers/soc/fsl/qe/qe_tdm.c | 2 ++ 1 file changed, 2 insertions(+) commit e5c5c8d23fef2a976afe724f30e34da31be09769 Author: Valentin Longchamp Date: Fri Feb 17 11:29:46 2017 +0100 soc/fsl/qe: only apply QE_General4 workaround on affected SoCs The QE_General4 workaround is only valid for the MPC832x and MPC836x SoCs. The other SoCs that embed a QUICC engine are not affected by this hardware bug and thus can use the computed divisors (this was successfully tested on the T1040). Similalry to what was done in commit 8ce795cb0c6b ("i2c: mpc: assign the correct prescaler from SVR") in order to avoid changes in the device tree nodes of the QE (with maybe a variant of the compatible property), the PVR reg is read out to find out if the workaround must be applied or not. Signed-off-by: Valentin Longchamp Signed-off-by: Scott Wood drivers/soc/fsl/qe/qe.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 2ccf80b7566cc035d903dd0ac5d7ebd25c2c1060 Author: Valentin Longchamp Date: Fri Feb 17 11:29:45 2017 +0100 soc/fsl/qe: round brg_freq to 1kHz granularity Because of integer computation rounding in u-boot (that sets the QE brg-frequency DTS prop), the clk value is 99999999 Hz even though it is 100 MHz. When setting brg clks that are exact divisors of 100 MHz, this small differnce plays a role and can result in lower clks to be output (for instance 20 MHz - divide by 5 - results in 16.666 MHz - divide by 6). This patch fixes that by "forcing" the brg_clk to the nearest kHz when the difference is below 2 integer rounding errors (i.e. 4). Signed-off-by: Valentin Longchamp Signed-off-by: Scott Wood drivers/soc/fsl/qe/qe.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) commit b54ea82f01282253c85eb7e2fd2b6c96f7a027d8 Author: Christophe Leroy Date: Tue Feb 7 10:05:11 2017 +0100 soc/fsl/qe: get rid of immrbar_virt_to_phys() immrbar_virt_to_phys() is not used anymore Signed-off-by: Christophe Leroy Acked-by: Li Yang Signed-off-by: Scott Wood drivers/soc/fsl/qe/qe.c | 4 +--- include/soc/fsl/qe/immap_qe.h | 19 ------------------- 2 files changed, 1 insertion(+), 22 deletions(-) commit 8b8642af15ed14b9a7a34d3401afbcc274533e13 Author: Christophe Leroy Date: Tue Feb 7 10:05:09 2017 +0100 net: ethernet: ucc_geth: fix MEM_PART_MURAM mode Since commit 5093bb965a163 ("powerpc/QE: switch to the cpm_muram implementation"), muram area is not part of immrbar mapping anymore so immrbar_virt_to_phys() is not usable anymore. Fixes: 5093bb965a163 ("powerpc/QE: switch to the cpm_muram implementation") Signed-off-by: Christophe Leroy Acked-by: David S. Miller Acked-by: Li Yang Signed-off-by: Scott Wood drivers/net/ethernet/freescale/ucc_geth.c | 8 +++----- include/soc/fsl/qe/qe.h | 1 + 2 files changed, 4 insertions(+), 5 deletions(-) commit 0997e378be1d888a5d093eeee55f842cdfe55ebe Author: Colin Ian King Date: Sat Apr 29 22:52:55 2017 +0100 ALSA: ali5451: fix spelling mistake in "ali_capture_preapre" trivial fix to spelling mistake in dev_warn message, "ali_capture_preapre" should be "ali_capture_prepare" Signed-off-by: Colin Ian King Signed-off-by: Takashi Iwai sound/pci/ali5451/ali5451.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fd615f69a18a9d4aa5ef02a1dc83f319f75da8e7 Author: LiuHailong Date: Tue Feb 7 10:35:52 2017 +0800 powerpc/64e: Fix hang when debugging programs with relocated kernel Debug interrupts can be taken during interrupt entry, since interrupt entry does not automatically turn them off. The kernel will check whether the faulting instruction is between [interrupt_base_book3e, __end_interrupts], and if so clear MSR[DE] and return. However, when the kernel is built with CONFIG_RELOCATABLE, it can't use LOAD_REG_IMMEDIATE(r14,interrupt_base_book3e) and LOAD_REG_IMMEDIATE(r15,__end_interrupts), as they ignore relocation. Thus, if the kernel is actually running at a different address than it was built at, the address comparison will fail, and the exception entry code will hang at kernel_dbg_exc. r2(toc) is also not usable here, as r2 still holds data from the interrupted context, so LOAD_REG_ADDR() doesn't work either. So we use the *name@got* to get the EV of two labels directly. Test programs test.c shows as follows: int main(int argc, char *argv[]) { if (access("/proc/sys/kernel/perf_event_paranoid", F_OK) == -1) printf("Kernel doesn't have perf_event support\n"); } Steps to reproduce the bug, for example: 1) ./gdb ./test 2) (gdb) b access 3) (gdb) r 4) (gdb) s Signed-off-by: Liu Hailong Signed-off-by: Jiang Xuexin Reviewed-by: Jiang Biao Reviewed-by: Liu Song Reviewed-by: Huang Jian [scottwood: cleaned up commit message, and specified bad behavior as a hang rather than an oops to correspond to mainline kernel behavior] Fixes: 1cb6e0649248 ("powerpc/book3e: support CONFIG_RELOCATABLE") Cc: # 4.4.x- Signed-off-by: Scott Wood arch/powerpc/kernel/exceptions-64e.S | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit 960e6994ad9cf10ddd4d3680a2d6cf5159c93a83 Author: Joe Richey Date: Thu Apr 6 16:14:28 2017 -0700 fscrypt: Remove __packed from fscrypt_policy This commit removes __packed from fscrypt_policy as it does not contain any implicit padding and does not refer to an on-disk structure. Even though this is a change to a UAPI file, no users will be broken as the structure doesn't change. Signed-off-by: Joe Richey Signed-off-by: Theodore Ts'o include/uapi/linux/fs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9c8268def6127a9d9888b822a74becb80dfeab6f Author: Joe Richey Date: Thu Apr 6 16:14:05 2017 -0700 fscrypt: Move key structure and constants to uapi This commit exposes the necessary constants and structures for a userspace program to pass filesystem encryption keys into the keyring. The fscrypt_key structure was already part of the kernel ABI, this change just makes it so programs no longer have to redeclare these structures (like e4crypt in e2fsprogs currently does). Note that we do not expose the other FS_*_KEY_SIZE constants as they are not necessary. Only XTS is supported for contents_encryption_mode, so currently FS_MAX_KEY_SIZE bytes of key material must always be passed to the kernel. This commit also removes __packed from fscrypt_key as it does not contain any implicit padding and does not refer to an on-disk structure. Signed-off-by: Joe Richey Signed-off-by: Theodore Ts'o fs/crypto/fscrypt_private.h | 11 ----------- include/uapi/linux/fs.h | 13 +++++++++++++ 2 files changed, 13 insertions(+), 11 deletions(-) commit 4bfd036221c0bf75a0f475b05e22f7be9abc3101 Author: Eric Biggers Date: Tue Apr 4 14:43:34 2017 -0700 fscrypt: remove fscrypt_symlink_data_len() fscrypt_symlink_data_len() is never called and can be removed. Signed-off-by: Eric Biggers Reviewed-by: Richard Weinberger Signed-off-by: Theodore Ts'o include/linux/fscrypt_common.h | 11 ----------- 1 file changed, 11 deletions(-) commit cd39e4bac11125bc32ba6101b1ceb46ef773f4b6 Author: Eric Biggers Date: Tue Apr 4 14:39:41 2017 -0700 fscrypt: remove unnecessary checks for NULL operations The functions in fs/crypto/*.c are only called by filesystems configured with encryption support. Since the ->get_context(), ->set_context(), and ->empty_dir() operations are always provided in that case (and must be, otherwise there would be no way to get/set encryption policies, or in the case of ->get_context() even access encrypted files at all), there is no need to check for these operations being NULL and we can remove these unneeded checks. Signed-off-by: Eric Biggers Reviewed-by: Richard Weinberger Signed-off-by: Theodore Ts'o fs/crypto/keyinfo.c | 3 --- fs/crypto/policy.c | 11 +---------- 2 files changed, 1 insertion(+), 13 deletions(-) commit 85c8f176a6111ecde9c158109989dbd445a0e59a Author: Andrew Perepechko Date: Sun Apr 30 00:46:35 2017 -0400 ext4: preload block group descriptors With enabled meta_bg option block group descriptors reading IO is not sequential and requires optimization. Signed-off-by: Andrew Perepechko Signed-off-by: Theodore Ts'o fs/ext4/super.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 1a20a63084be8fc5b0c1191231dfd311f7fc2afa Author: Eric Biggers Date: Sun Apr 30 00:40:44 2017 -0400 ext4: make ext4_shutdown() static Make the ext4_shutdown() function static, as suggested by running sparse ('make C=2 fs/ext4/'). This was the only such warning in fs/ext4/. Signed-off-by: Eric Biggers Signed-off-by: Theodore Ts'o fs/ext4/ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0c9ec4beecac94cb450c8abb2ac8b7e8a79240ea Author: Darrick J. Wong Date: Sun Apr 30 00:36:53 2017 -0400 ext4: support GETFSMAP ioctls Support the GETFSMAP ioctls so that we can use the xfs free space management tools to probe ext4 as well. Note that this is a partial implementation -- we only report fixed-location metadata and free space; everything else is reported as "unknown". Signed-off-by: Darrick J. Wong Signed-off-by: Theodore Ts'o fs/ext4/Makefile | 10 +- fs/ext4/fsmap.c | 722 ++++++++++++++++++++++++++++++++++++++++++++ fs/ext4/fsmap.h | 69 +++++ fs/ext4/ioctl.c | 90 ++++++ fs/ext4/mballoc.c | 49 +++ fs/ext4/mballoc.h | 17 ++ fs/ext4/super.c | 1 + include/trace/events/ext4.h | 74 +++++ 8 files changed, 1027 insertions(+), 5 deletions(-) commit d0649f0416feb616d34d15e541716cb8a555e899 Author: Darrick J. Wong Date: Sun Apr 30 00:35:34 2017 -0400 vfs: add common GETFSMAP ioctl definitions Add the GETFSMAP headers to the VFS kernel headers Signed-off-by: Darrick J. Wong Signed-off-by: Theodore Ts'o include/uapi/linux/fsmap.h | 112 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 112 insertions(+) commit 7b4cc9787fe35b3ee2dfb1c35e22eafc32e00c33 Author: Eric Biggers Date: Sun Apr 30 00:10:50 2017 -0400 ext4: evict inline data when writing to memory map Currently the case of writing via mmap to a file with inline data is not handled. This is maybe a rare case since it requires a writable memory map of a very small file, but it is trivial to trigger with on inline_data filesystem, and it causes the 'BUG_ON(ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA));' in ext4_writepages() to be hit: mkfs.ext4 -O inline_data /dev/vdb mount /dev/vdb /mnt xfs_io -f /mnt/file \ -c 'pwrite 0 1' \ -c 'mmap -w 0 1m' \ -c 'mwrite 0 1' \ -c 'fsync' kernel BUG at fs/ext4/inode.c:2723! invalid opcode: 0000 [#1] SMP CPU: 1 PID: 2532 Comm: xfs_io Not tainted 4.11.0-rc1-xfstests-00301-g071d9acf3d1f #633 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-20170228_101828-anatol 04/01/2014 task: ffff88003d3a8040 task.stack: ffffc90000300000 RIP: 0010:ext4_writepages+0xc89/0xf8a RSP: 0018:ffffc90000303ca0 EFLAGS: 00010283 RAX: 0000028410000000 RBX: ffff8800383fa3b0 RCX: ffffffff812afcdc RDX: 00000a9d00000246 RSI: ffffffff81e660e0 RDI: 0000000000000246 RBP: ffffc90000303dc0 R08: 0000000000000002 R09: 869618e8f99b4fa5 R10: 00000000852287a2 R11: 00000000a03b49f4 R12: ffff88003808e698 R13: 0000000000000000 R14: 7fffffffffffffff R15: 7fffffffffffffff FS: 00007fd3e53094c0(0000) GS:ffff88003e400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fd3e4c51000 CR3: 000000003d554000 CR4: 00000000003406e0 Call Trace: ? _raw_spin_unlock+0x27/0x2a ? kvm_clock_read+0x1e/0x20 do_writepages+0x23/0x2c ? do_writepages+0x23/0x2c __filemap_fdatawrite_range+0x80/0x87 filemap_write_and_wait_range+0x67/0x8c ext4_sync_file+0x20e/0x472 vfs_fsync_range+0x8e/0x9f ? syscall_trace_enter+0x25b/0x2d0 vfs_fsync+0x1c/0x1e do_fsync+0x31/0x4a SyS_fsync+0x10/0x14 do_syscall_64+0x69/0x131 entry_SYSCALL64_slow_path+0x25/0x25 We could try to be smart and keep the inline data in this case, or at least support delayed allocation when allocating the block, but these solutions would be more complicated and don't seem worthwhile given how rare this case seems to be. So just fix the bug by calling ext4_convert_inline_data() when we're asked to make a page writable, so that any inline data gets evicted, with the block allocated immediately. Reported-by: Nick Alcock Cc: stable@vger.kernel.org Reviewed-by: Andreas Dilger Signed-off-by: Eric Biggers Signed-off-by: Theodore Ts'o fs/ext4/inode.c | 5 +++++ 1 file changed, 5 insertions(+) commit 6ba644b9fd8ce243687139dbd8ca918ad4b09f61 Author: Eric Biggers Date: Sun Apr 30 00:01:02 2017 -0400 ext4: remove ext4_xattr_check_entry() ext4_xattr_check_entry() was redundant with validation of the full xattr entries list in ext4_xattr_check_entries(), which all callers also did. ext4_xattr_check_entry() also didn't actually do correct validation; specifically, it never checked that the value doesn't overlap the xattr names, nor did it account for padding when checking whether the xattr value overflows the available space. So remove it to eliminate any potential confusion. Signed-off-by: Eric Biggers Reviewed-by: Jan Kara Signed-off-by: Theodore Ts'o fs/ext4/xattr.c | 30 ++++++------------------------ 1 file changed, 6 insertions(+), 24 deletions(-) commit 2c4f9923374843384cfd3a2edc0f02c19a7a29e2 Author: Eric Biggers Date: Sat Apr 29 23:56:52 2017 -0400 ext4: rename ext4_xattr_check_names() to ext4_xattr_check_entries() ext4_xattr_check_names() actually validates both the xattr names and values, not just the names. So rename it to ext4_xattr_check_entries() to avoid confusion. Signed-off-by: Eric Biggers Reviewed-by: Jan Kara Signed-off-by: Theodore Ts'o fs/ext4/xattr.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit ba7ea1d8f45383cb88858057e9bf60cd8cf3b898 Author: Eric Biggers Date: Sat Apr 29 23:53:17 2017 -0400 ext4: merge ext4_xattr_list() into ext4_listxattr() There's no difference between ext4_xattr_list() and ext4_listxattr(), so merge them together and just have ext4_listxattr(). Some years ago they took different arguments, but that's no longer the case. Signed-off-by: Eric Biggers Reviewed-by: Jan Kara Signed-off-by: Theodore Ts'o fs/ext4/xattr.c | 21 +++++---------------- 1 file changed, 5 insertions(+), 16 deletions(-) commit d60061867303aa2fee516e9a34efc15e78d975a9 Author: Eric Biggers Date: Sat Apr 29 23:47:50 2017 -0400 ext4: constify static data that is never modified Constify static data in ext4 that is never (intentionally) modified so that it is placed in .rodata and benefits from memory protection. Signed-off-by: Eric Biggers Signed-off-by: Theodore Ts'o fs/ext4/ext4.h | 4 ++-- fs/ext4/mballoc.c | 2 +- fs/ext4/super.c | 5 +++-- fs/ext4/sysfs.c | 8 ++++---- fs/ext4/xattr.c | 2 +- 5 files changed, 11 insertions(+), 10 deletions(-) commit 1bc0af600b011dbbf9bbf39664b858ea2e365729 Author: Eric Biggers Date: Sat Apr 29 23:27:26 2017 -0400 ext4: trim return value and 'dir' argument from ext4_insert_dentry() In the initial implementation of ext4 encryption, the filename was encrypted in ext4_insert_dentry(), which could fail and also required access to the 'dir' inode. Since then ext4 filename encryption has been changed to encrypt the filename earlier, so we can revert the additions to ext4_insert_dentry(). Signed-off-by: Eric Biggers Signed-off-by: Theodore Ts'o fs/ext4/ext4.h | 9 ++++----- fs/ext4/inline.c | 2 +- fs/ext4/namei.c | 17 ++++++----------- 3 files changed, 11 insertions(+), 17 deletions(-) commit c08bac03d2894113bdb114e66e6ada009defb120 Merge: 4c042a8 e60ae00 Author: David S. Miller Date: Sat Apr 29 23:16:20 2017 -0400 Merge branch '10GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/next-queue Jeff Kirsher says: ==================== 10GbE Intel Wired LAN Driver Updates 2017-04-29 This series contains updates to ixgbe and ixgbevf only, most notable is the addition of XDP support to our 10GbE drivers. Paul fixes ixgbe to acquire the PHY semaphore before accessing PHY registers when issuing a device reset. John adds XDP support (yeah!) for ixgbe. Emil fixes an issue by flushing the MACVLAN filters on VF reset to avoid conflicts with other VFs that may end up using the same MAC address. Also fixed a bug where ethtool -S displayed some empty fields for ixgbevf because it was using ixgbe_stats instead ixgbevf_stats for IXGBEVF_QUEUE_STATS_LEN. Tony adds the ability to specify a zero MAC address in order to clear the VF's MAC address from the RAR table. Also adds support for a new 1000Base-T device based on x550EM_X MAC type. Fixed an issue where the RSS key specified by the user would be over-written with a pre-existing value, so change the rss_key to a pointer so we can check to see if the key has a value set before attempting to set it. Fixed the logic for mailbox support for getting RETA and RSS values, which are only supported by 82599 and x540 devices. v2: fixed up patches #2 and #3 based on feedback from Jakub and to address build issues when page sizes are larger than 4k ==================== Signed-off-by: David S. Miller commit e60ae00361bf4e5ef08cde5a30f131cf287ffe30 Author: Tony Nguyen Date: Thu Apr 13 07:26:07 2017 -0700 ixgbevf: Check for RSS key before setting value The RSS key is being repopulated every time the interface is brought up regardless of whether there is an existing value. If the user sets the RSS key and the interface is brought up (e.g. reset), the user specified RSS key will be overwritten. This patch changes the rss_key to a pointer so we can check to see if the key has been populated and preserve it accordingly. Signed-off-by: Tony Nguyen Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/ixgbevf/ethtool.c | 3 ++- drivers/net/ethernet/intel/ixgbevf/ixgbevf.h | 2 +- drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 33 +++++++++++++++++++++-- 3 files changed, 34 insertions(+), 4 deletions(-) commit 82fb670c5fdd5662c406871a6c21ebd55ba68e45 Author: Tony Nguyen Date: Thu Apr 13 07:26:06 2017 -0700 ixgbevf: Fix errors in retrieving RETA and RSS from PF Mailbox support for getting RETA and RSS is available for only 82599 and x540; a previous patch reversed the logic and these adapters were returning not supported. Also, the NACK check in ixgbevf_get_rss_key_locked() was checking for the command IXGBE_VF_GET_RETA instead of IXGBE_VF_GET_RSS_KEY. This patch corrects both issues by correcting the logic and checking for the right command. Signed-off-by: Tony Nguyen Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/ixgbevf/vf.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 3dfbfc7ebb959d68b35d5ca3b7499cc73dc57261 Author: Tony Nguyen Date: Thu Apr 13 07:26:05 2017 -0700 ixgbe: Check for RSS key before setting value The RSS key is being repopulated every time the interface is brought up regardless of whether there is an existing value. If the user sets the RSS key and the interface is brought up (e.g. reset), the user specified RSS key will be overwritten. This patch changes the rss_key to a pointer so we can check to see if the key has been populated and preserve it accordingly. Signed-off-by: Tony Nguyen Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/ixgbe/ixgbe.h | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 4 +--- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 30 ++++++++++++++++++++++-- drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 2 +- 4 files changed, 31 insertions(+), 7 deletions(-) commit 8dc963e1cd245e67d6a9ffb8447fc88fb6eaa370 Author: Paul Greenwalt Date: Thu Apr 13 08:07:07 2017 -0400 ixgbe: Add 1000Base-T device based on X550EM_X MAC Add support for new 1000Base-T device based on X550EM_X MAC type. All PHY operations are disabled as the PHY is controlled by FW. Signed-off-by: Paul Greenwalt Tested-by: Krishneil Singh Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/ixgbe/ixgbe.h | 2 ++ drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 2 ++ drivers/net/ethernet/intel/ixgbe/ixgbe_type.h | 1 + drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c | 45 ++++++++++++++++++++++++++- 4 files changed, 49 insertions(+), 1 deletion(-) commit 27bdc44cdb2a8d96322d5978895eaae881fb8c2d Author: Tony Nguyen Date: Wed Apr 12 13:35:22 2017 -0700 ixgbe: Allow setting zero MAC address for VF Currently, there is no logic that allows a VF's MAC address to be removed from the RAR table. Allow the user to specify a zero MAC address in order to clear the VF's MAC address from the RAR table. This functionality is also utilized by libvirt when removing VFs. Signed-off-by: Tony Nguyen Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 28 +++++++++++++++++--------- 1 file changed, 18 insertions(+), 10 deletions(-) commit f87fc44770f54ff1b54d44ae9cec11f10efeca02 Author: Emil Tantilov Date: Thu Mar 30 20:49:02 2017 -0700 ixgbevf: fix size of queue stats length IXGBEVF_QUEUE_STATS_LEN is based on ixgebvf_stats, not ixgbe_stats. This change fixes a bug where ethtool -S displayed some empty fields. Signed-off-by: Emil Tantilov Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/ixgbevf/ethtool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e251ecf75226d5ff772df1ef170b8b981308dc68 Author: Emil Tantilov Date: Tue Mar 28 11:27:54 2017 -0700 ixgbe: clean macvlan MAC filter table on VF reset Flush the macvlan filters on VF reset to avoid conflict with other VFs that may end up using the same MAC address. The main change here is the call to ixgbe_set_vf_macvlan() with index 0. Moved ixgbe_set_vf_macvlan() in front of ixgbe_vf_reset_event() to avoid adding a prototype. Reported-by: Sritej Kanakadandi Sritej Rama Signed-off-by: Emil Tantilov Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 105 +++++++++++++------------ 1 file changed, 53 insertions(+), 52 deletions(-) commit 7379f97a4fce3c1aa3b80a85cb8440453bf30411 Author: John Fastabend Date: Tue Mar 28 09:47:03 2017 -0700 ixgbe: delay tail write to every 'n' packets Current XDP implementation hits the tail on every XDP_TX return code. This patch changes driver behavior to only hit the tail after packet processing is complete. With this patch I can run XDP drop programs @ 14+Mpps and XDP_TX programs are at ~13.5Mpps. Signed-off-by: John Fastabend Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 28 ++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-) commit 33fdc82f08835de4c39a00657742f5b11db00d32 Author: John Fastabend Date: Mon Apr 24 03:30:18 2017 -0700 ixgbe: add support for XDP_TX action A couple design choices were made here. First I use a new ring pointer structure xdp_ring[] in the adapter struct instead of pushing the newly allocated XDP TX rings into the tx_ring[] structure. This means we have to duplicate loops around rings in places we want to initialize both TX rings and XDP rings. But by making it explicit it is obvious when we are using XDP rings and when we are using TX rings. Further we don't have to do ring arithmatic which is error prone. As a proof point for doing this my first patches used only a single ring structure and introduced bugs in FCoE code and macvlan code paths. Second I am aware this is not the most optimized version of this code possible. I want to get baseline support in using the most readable format possible and then once this series is included I will optimize the TX path in another series of patches. Signed-off-by: John Fastabend Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/ixgbe/ixgbe.h | 19 +- drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 25 ++ drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c | 75 +++++- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 282 +++++++++++++++++++---- 4 files changed, 348 insertions(+), 53 deletions(-) commit 9247080816297de4e31abb684939c0e53e3a8a67 Author: John Fastabend Date: Mon Apr 24 03:30:17 2017 -0700 ixgbe: add XDP support for pass and drop actions Basic XDP drop support for ixgbe. Uses READ_ONCE/xchg semantics on XDP programs instead of RCU primitives as suggested by Daniel Borkmann and Alex Duyck. v2: fix the build issues seen w/ XDP when page sizes are larger than 4K and made minor fixes based on feedback from Jakub Kicinski Signed-off-by: John Fastabend Acked-by: Alexander Duyck Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/ixgbe/ixgbe.h | 4 +- drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 4 +- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 169 +++++++++++++++++++---- 3 files changed, 148 insertions(+), 29 deletions(-) commit 5052b069acf73866d00077d8bc49983c3ee903e5 Author: Jan Kara Date: Sat Apr 29 21:07:30 2017 -0400 jbd2: fix dbench4 performance regression for 'nobarrier' mounts Commit b685d3d65ac7 "block: treat REQ_FUA and REQ_PREFLUSH as synchronous" removed REQ_SYNC flag from WRITE_FUA implementation. Since JBD2 strips REQ_FUA and REQ_FLUSH flags from submitted IO when the filesystem is mounted with nobarrier mount option, journal superblock writes ended up being async writes after this patch and that caused heavy performance regression for dbench4 benchmark with high number of processes. In my test setup with HP RAID array with non-volatile write cache and 32 GB ram, dbench4 runs with 8 processes regressed by ~25%. Fix the problem by making sure journal superblock writes are always treated as synchronous since they generally block progress of the journalling machinery and thus the whole filesystem. Fixes: b685d3d65ac791406e0dfd8779cc9b3707fea5a3 CC: stable@vger.kernel.org Signed-off-by: Jan Kara Signed-off-by: Theodore Ts'o fs/jbd2/journal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c52c47e4b4fbe4284602fc2ccbfc4a4d8dc05b49 Author: Jan Kara Date: Sat Apr 29 20:12:16 2017 -0400 jbd2: Fix lockdep splat with generic/270 test I've hit a lockdep splat with generic/270 test complaining that: 3216.fsstress.b/3533 is trying to acquire lock: (jbd2_handle){++++..}, at: [] jbd2_log_wait_commit+0x0/0x150 but task is already holding lock: (jbd2_handle){++++..}, at: [] start_this_handle+0x35b/0x850 The underlying problem is that jbd2_journal_force_commit_nested() (called from ext4_should_retry_alloc()) may get called while a transaction handle is started. In such case it takes care to not wait for commit of the running transaction (which would deadlock) but only for a commit of a transaction that is already committing (which is safe as that doesn't wait for any filesystem locks). In fact there are also other callers of jbd2_log_wait_commit() that take care to pass tid of a transaction that is already committing and for those cases, the lockdep instrumentation is too restrictive and leading to false positive reports. Fix the problem by calling jbd2_might_wait_for_commit() from jbd2_log_wait_commit() only if the transaction isn't already committing. Fixes: 1eaa566d368b214d99cbb973647c1b0b8102a9ae Signed-off-by: Jan Kara Signed-off-by: Theodore Ts'o fs/jbd2/journal.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) commit 23f4984483623cf8621246004228f08fcabf51e4 Author: Dan Williams Date: Sat Apr 29 15:24:03 2017 -0700 libnvdimm: rework region badblocks clearing Toshi noticed that the new support for a region-level badblocks missed the case where errors are cleared due to BTT I/O. An initial attempt to fix this ran into a "sleeping while atomic" warning due to taking the nvdimm_bus_lock() in the BTT I/O path to satisfy the locking requirements of __nvdimm_bus_badblocks_clear(). However, that lock is not needed since we are not acting on any data that is subject to change under that lock. The badblocks instance has its own internal lock to handle mutations of the error list. So, in order to make it clear that we are just acting on region devices, rename __nvdimm_bus_badblocks_clear() to nvdimm_clear_badblocks_regions(). Eliminate the lock and consolidate all support routines for the new nvdimm_account_cleared_poison() in drivers/nvdimm/bus.c. Finally, to the opportunity to cleanup to some unnecessary casts, make the calling convention of nvdimm_clear_badblocks_regions() clearer by replacing struct resource with the minimal struct clear_badblocks_context, and use the DEVICE_ATTR macro. Cc: Dave Jiang Cc: Vishal Verma Reported-by: Toshi Kani Signed-off-by: Dan Williams drivers/nvdimm/bus.c | 76 +++++++++++++++++++++++++++++++------------- drivers/nvdimm/region.c | 25 --------------- drivers/nvdimm/region_devs.c | 15 +++------ include/linux/libnvdimm.h | 3 -- 4 files changed, 59 insertions(+), 60 deletions(-) commit 9280cdd6fe5b8287a726d24cc1d558b96c8491d7 Author: Mark Charlebois Date: Fri Apr 28 15:15:12 2017 -0700 fs: compat: Remove warning from COMPATIBLE_IOCTL cmd in COMPATIBLE_IOCTL is always a u32, so cast it so there isn't a warning about an overflow in XFORM. From: Mark Charlebois Signed-off-by: Mark Charlebois Signed-off-by: Behan Webster Signed-off-by: Matthias Kaehlcke Acked-by: Arnd Bergmann Signed-off-by: Al Viro fs/compat_ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0b33540f9d751b565c270d23a077ee6d9fc9e1d5 Author: Al Viro Date: Sat Apr 29 17:42:25 2017 -0400 remove pointless extern of atime_need_update_rcu() Signed-off-by: Al Viro fs/internal.h | 2 -- 1 file changed, 2 deletions(-) commit 929562b144783b9212625305eadcbbd800809643 Author: Wei Yongjun Date: Tue Apr 25 14:35:42 2017 +0000 crypto: stm32 - Fix OF module alias information The module alias information passed to MODULE_DEVICE_TABLE() should use stm32_dt_ids instead of undefined sti_dt_ids. Fixes: b51dbe90912a ("crypto: stm32 - Support for STM32 CRC32 crypto module") Signed-off-by: Wei Yongjun Signed-off-by: Herbert Xu drivers/crypto/stm32/stm32_crc32.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1f18b82c3437a398562e748c22fcd2f71c2e230c Author: Trond Myklebust Date: Sat Apr 29 10:10:17 2017 -0400 pNFS: Ensure we commit the layout if it has been invalidated If the layout is being invalidated on the server, then we must invoke nfs_commit_inode() to ensure any commits to the DS get cleared out. Signed-off-by: Trond Myklebust fs/nfs/nfs42proc.c | 1 + fs/nfs/nfs4proc.c | 1 + fs/nfs/pnfs.c | 3 +++ 3 files changed, 5 insertions(+) commit 722f0b891198ab1f5f7b020e32c989a517ed0577 Author: Trond Myklebust Date: Sat Apr 29 10:27:18 2017 -0400 pNFS: Don't send COMMITs to the DSes if the server invalidated our layout If the layout was invalidated, then assume we should requeue all the pending writes for the DS in question. Signed-off-by: Trond Myklebust fs/nfs/pnfs_nfs.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 271393ba6e2ac384a14e581d34d5d72c5953e3c6 Author: Mario Kleiner Date: Sat Apr 29 06:11:30 2017 +0200 drm/nouveau/fb/gf100-: Fix 32 bit wraparound in new ram detection A missing u64 cast causes a 32-Bit wraparound from 4096 MiB to 0 MiB and therefore total 0 MiB VRAM detected if card has 4096 Mib per FBP. Signed-off-by: Mario Kleiner Reviewed-by: Karol Herbst Signed-off-by: Ben Skeggs drivers/gpu/drm/nouveau/nvkm/subdev/fb/ramgf100.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 48907c23ea3307a6b6368698c1e786152cd45588 Author: Wei Yongjun Date: Tue Apr 25 14:36:42 2017 +0000 drm/nouveau/secboot/gm20b: fix the error return code in gm20b_secboot_tegra_read_wpr() The error return code PTR_ERR(mc) is always 0 since mc is equal to 0 in this error handling case. Signed-off-by: Wei Yongjun Signed-off-by: Ben Skeggs drivers/gpu/drm/nouveau/nvkm/subdev/secboot/gm20b.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 60b95d709525e3ce1c51e1fc93175dcd1755d345 Author: Mario Kleiner Date: Mon Apr 24 01:59:34 2017 +0200 drm/nouveau/kms: Increase max retries in scanout position queries. So far we only allowed for 1 retry and just failed the query - and thereby high precision vblank timestamping - if we did not get a reasonable result, as such a failure wasn't considered all too horrible. There are a few NVidia gpu models out there which may need a bit more than 1 retry to get a successful query result under some conditions. Since Linux 4.4 the update code for vblank counter and timestamp in drm_update_vblank_count() changed so that the implementation assumes that high precision vblank timestamping of a kms driver either consistently succeeds or consistently fails for a given video mode and encoder/connector combo. Iow. switching from success to fail or vice versa on a modeset or connector change is ok, but spurious temporary failure for a given setup can confuse the core code and potentially cause bad miscounting of vblanks and confusion or hangs in userspace clients which rely on vblank stuff, e.g., desktop compositors. Therefore change the max retry count to a larger number - more than any gpu so far is known to need to succeed, but still low enough so that these queries which do also happen in vblank interrupt are still fast enough to be not disastrously long if something would go badly wrong with them. As such sporadic retries only happen seldom even on affected gpu's, this could mean a vblank irq could take a few dozen microseconds longer every few hours of uptime -- better than a desktop compositor randomly hanging every couple of hours or days of uptime in a hard to reproduce manner. Signed-off-by: Mario Kleiner Signed-off-by: Ben Skeggs drivers/gpu/drm/nouveau/nouveau_display.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a7cb78bab3671dbad08e5b2f5fd83a6dbda90fe5 Author: Ben Skeggs Date: Tue Apr 11 08:25:22 2017 +1000 drm/nouveau/bios/bitP: check that table is long enough for optional pointers Fixes OOB VBIOS accesses on some boards. Signed-off-by: Ben Skeggs drivers/gpu/drm/nouveau/nvkm/subdev/bios/boost.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/bios/cstep.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/bios/fan.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/bios/power_budget.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/bios/vpstate.c | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) commit eef4988ab4c1a99e88e535502a67763a78d51515 Author: Ilia Mirkin Date: Mon Apr 3 22:46:14 2017 -0400 drm/nouveau/fifo/nv40: no ctxsw for pre-nv44 mpeg engine Signed-off-by: Ilia Mirkin drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv40.c | 2 ++ 1 file changed, 2 insertions(+) commit 1519fccb34371594f6a629bfad69605bc6f9dde3 Author: Pablo Neira Ayuso Date: Fri Apr 28 16:54:37 2017 +0200 netfilter: update MAINTAINERS file Several updates on the MAINTAINERS section for Netfilter: 1) Add Florian Westphal, he's been part of the coreteam since October 2012. He's been dedicating tireless efforts to improve the Netfilter codebase, fix bugs and push ongoing new developments ever since. 2) Add http://www.nftables.org/ URL, currently pointing to http://www.netfilter.org. 3) Update project status from Supported to Maintained. Signed-off-by: Pablo Neira Ayuso Acked-by: Florian Westphal MAINTAINERS | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 37f8aa16da8e9239092429e7a6dadf352897a92d Author: Trond Myklebust Date: Sat Apr 29 00:02:37 2017 -0400 pNFS/flexfiles: Fix up the ff_layout_write_pagelist failure path If the attempt to write through pNFS fails, we need to use the same failure semantics as for the read path: If the FF_FLAGS_NO_IO_THRU_MDS flag is set or we have sufficient valid DSes, then we must retry through pNFS Fixes: d67ae825a59d ("pnfs/flexfiles: Add the FlexFile Layout Driver") Signed-off-by: Trond Myklebust fs/nfs/flexfilelayout/flexfilelayout.c | 11 ++++++++--- fs/nfs/pnfs.c | 14 +++++++++++++- 2 files changed, 21 insertions(+), 4 deletions(-) commit d66bb1607e2d8d384e53f3d93db5c18483c8c4f7 Author: Takashi Iwai Date: Fri Apr 28 15:00:15 2017 +0200 proc: Fix unbalanced hard link numbers proc_create_mount_point() forgot to increase the parent's nlink, and it resulted in unbalanced hard link numbers, e.g. /proc/fs shows one less than expected. Fixes: eb6d38d5427b ("proc: Allow creating permanently empty directories...") Cc: stable@vger.kernel.org Reported-by: Tristan Ye Signed-off-by: Takashi Iwai Signed-off-by: Eric W. Biederman fs/proc/generic.c | 1 + 1 file changed, 1 insertion(+) commit 6133406be1aabfb041f024109efc41756970800e Author: Paul Greenwalt Date: Mon Mar 13 05:47:56 2017 -0400 ixgbe: Acquire PHY semaphore before device reset A recent firmware change fixed an issue to acquire the PHY semaphore before accessing PHY registers. This led to a case where SW can issue a device reset clearing the MDIO registers. This patch makes SW acquire the PHY semaphore before issuing a device reset. Signed-off-by: Paul Greenwalt Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher drivers/net/ethernet/intel/ixgbe/ixgbe_x540.c | 8 ++++++++ drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c | 8 ++++++++ 2 files changed, 16 insertions(+) commit 2196f2716292c39b35c86f5238ed16a8978f9ad4 Author: Dasaratharaman Chandramouli Date: Fri Apr 28 19:20:26 2017 -0400 IB/SA: Add support to query opa classport info. For OPA devices, SA will query the OPA classport info instead of the IB defined classport info. opa classport info exposes additional information and capabilities that are specific to OPA devices. Reviewed-by: Ira Weiny Reviewed-by: Don Hiatt Reviewed-by: Dennis Dalessandro Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Doug Ledford drivers/infiniband/core/sa_query.c | 182 ++++++++++++++++++++++++++++++++----- include/rdma/ib_sa.h | 1 + 2 files changed, 158 insertions(+), 25 deletions(-) commit 7699a6a36b82f22cb0b355c6411531abedf12964 Author: Dan Williams Date: Fri Apr 28 13:54:30 2017 -0700 acpi, nfit: kill ACPI_NFIT_DEBUG Inevitably when one actually needs to debug a DSM issue it's on a distribution kernel that has CONFIG_ACPI_NFIT_DEBUG=n. The config symbol was only there to avoid the compile error due to the missing fallback for print_hex_dump_debug in the CONFIG_DYNAMIC_DEBUG=n case. That was fixed with commit cdf17449af1d "hexdump: do not print debug dumps for !CONFIG_DEBUG", so the config symbol can just be dropped. Cc: Joe Perches Signed-off-by: Dan Williams drivers/acpi/nfit/Kconfig | 12 ------------ drivers/acpi/nfit/core.c | 21 ++++++++------------- 2 files changed, 8 insertions(+), 25 deletions(-) commit 8d13c0290655b883df9083a2a0af0d782bc38aef Author: Toshi Kani Date: Thu Apr 27 16:57:05 2017 -0600 libnvdimm: fix clear length of nvdimm_forget_poison() ND_CMD_CLEAR_ERROR command returns 'clear_err.cleared', the length of error actually cleared, which may be smaller than its requested 'len'. Change nvdimm_clear_poison() to call nvdimm_forget_poison() with 'clear_err.cleared' when this value is valid. Cc: Fixes: e046114af5fc ("libnvdimm: clear the internal poison_list when clearing badblocks") Cc: Dave Jiang Cc: Vishal Verma Signed-off-by: Toshi Kani Signed-off-by: Dan Williams drivers/nvdimm/bus.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 6df97f85611cafc3ba9c093931a5fa3bc7dea897 Author: Darren Hart (VMware) Date: Fri Apr 28 09:36:28 2017 -0700 platform/x86: Make SILEAD_DMI depend on TOUCHSCREEN_SILEAD SILEAD_DMI provides platform specific data for the TOUCHSCREEN_SILEAD driver. Make this explicitly clear in the Kconfig depends. Remove INPUT as this is implied by TOUCHSCREEN_SILEAD. Signed-off-by: Darren Hart (VMware) Cc: Hans de Goede Cc: Andy Shevchenko Cc: Jean Delvare Reviewed-by: Dmitry Torokhov drivers/platform/x86/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 208480bb273e15f42711bd47f70dc0fbfa2570b8 Author: Joerg Roedel Date: Wed Apr 26 15:49:57 2017 +0200 iommu: Remove trace-events include from iommu.h It is not needed there anymore. All places needing it are fixed. Signed-off-by: Joerg Roedel drivers/media/platform/mtk-vpu/mtk_vpu.c | 1 + include/linux/iommu.h | 2 -- 2 files changed, 1 insertion(+), 2 deletions(-) commit 461a6946b1f93f6720577fb06aa78e8cbd9291c9 Author: Joerg Roedel Date: Wed Apr 26 15:46:20 2017 +0200 iommu: Remove pci.h include from trace/events/iommu.h The include file does not need any PCI specifics, so remove that include. Also fix the places that relied on it. Signed-off-by: Joerg Roedel arch/arm64/mm/dma-mapping.c | 1 + drivers/infiniband/hw/qedr/main.c | 1 + drivers/iommu/fsl_pamu.h | 1 + drivers/iommu/rockchip-iommu.c | 1 + drivers/iommu/tegra-smmu.c | 1 + include/linux/dma-iommu.h | 1 + include/trace/events/iommu.h | 1 - 7 files changed, 6 insertions(+), 1 deletion(-) commit aa4656d9a4292018c9746dbad1dad5488e575232 Author: Dasaratharaman Chandramouli Date: Fri Apr 28 17:47:10 2017 -0400 IB/core: Move opa_class_port_info definition to header file Both opa_vnic and the hfi driver use the same opa_classport_info definition. We will also have ib_sa capable of querying opa class port info and would need this definition. Move it to ib_mad.h for everyone to use. Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/mad.c | 25 ------------------------- drivers/infiniband/ulp/opa_vnic/opa_vnic_vema.c | 25 ------------------------- include/rdma/ib_mad.h | 25 +++++++++++++++++++++++++ 3 files changed, 25 insertions(+), 50 deletions(-) commit 63ccc191649eb0f14a761074291551d0d2f85389 Author: Christoph Hellwig Date: Tue Apr 25 14:26:52 2017 +0200 libata: remove SCT WRITE SAME support This was already disabled a while ago because it caused I/O errors, and it's severly getting into the way of the discard / write zeroes rework. Signed-off-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Signed-off-by: Tejun Heo drivers/ata/libata-scsi.c | 132 ++++++++++------------------------------------ include/linux/ata.h | 5 -- 2 files changed, 29 insertions(+), 108 deletions(-) commit 26b37b946a5c2658dbc37dd5d6df40aaa9685d70 Author: Laurent Pinchart Date: Fri May 15 02:00:02 2015 +0300 arm: dma-mapping: Don't override dma_ops in arch_setup_dma_ops() The arch_setup_dma_ops() function is in charge of setting dma_ops with a call to set_dma_ops(). set_dma_ops() is also called from - highbank and mvebu bus notifiers - dmabounce (to be replaced with swiotlb) - arm_iommu_attach_device (arm_iommu_attach_device is itself called from IOMMU and bus master device drivers) To allow the arch_setup_dma_ops() call to be moved from device add time to device probe time we must ensure that dma_ops already setup by any of the above callers will not be overriden. Aftering replacing dmabounce with swiotlb, converting IOMMU drivers to of_xlate and taking care of highbank and mvebu, the workaround should be removed. Signed-off-by: Sricharan R Signed-off-by: Laurent Pinchart Tested-by: Ralph Sennhauser Signed-off-by: Joerg Roedel arch/arm/mm/dma-mapping.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit c6ade20f5e50e188d20b711a618b20dd1d50457e Author: Christoph Hellwig Date: Tue Apr 25 13:39:54 2017 +0200 libata: reject passthrough WRITE SAME requests The WRITE SAME to TRIM translation rewrites the DATA OUT buffer. While the SCSI code accomodates for this by passing a read-writable buffer userspace applications don't cater for this behavior. In fact it can be used to rewrite e.g. a readonly file through mmap and should be considered as a security fix. Signed-off-by: Christoph Hellwig Cc: stable@vger.kernel.org Reviewed-by: Martin K. Petersen Signed-off-by: Tejun Heo drivers/ata/libata-scsi.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit 9732adc5d6520238223df16630f1f8cad2269317 Author: Zefan Li Date: Wed Apr 19 10:15:59 2017 +0800 cgroup: avoid attaching a cgroup root to two different superblocks, take 2 Commit bfb0b80db5f9 ("cgroup: avoid attaching a cgroup root to two different superblocks") is broken. Now we try to fix the race by delaying the initialization of cgroup root refcnt until a superblock has been allocated. Reported-by: Dmitry Vyukov Reported-by: Andrei Vagin Tested-by: Andrei Vagin Signed-off-by: Zefan Li Signed-off-by: Tejun Heo kernel/cgroup/cgroup-internal.h | 2 +- kernel/cgroup/cgroup-v1.c | 16 +++++++++++++++- kernel/cgroup/cgroup.c | 8 ++++---- 3 files changed, 20 insertions(+), 6 deletions(-) commit d49f2dedf33b8e7752ec66ac2b3b5bf4d7210943 Author: Lorenzo Pieralisi Date: Fri Apr 28 16:59:49 2017 +0100 ACPI/IORT: Fix CONFIG_IOMMU_API dependency The IOMMU probe deferral IORT rework had to add code in iort_iommu_configure() and iort_iommu_xlate() that requires the IOMMU_API to be selected in order to compile and work. Stub out the pieces of code that depend on CONFIG_IOMMU_API to be selected to prevent compilation failures such as: drivers/acpi/arm64/iort.c: In function 'iort_iommu_xlate': drivers/acpi/arm64/iort.c:647:22: error: 'struct iommu_fwspec' has no member named 'ops' by wrapping the code in static inline functions that provide a NOP implementation when CONFIG_IOMMU_API is not selected. Signed-off-by: Lorenzo Pieralisi Reported-by: Arnd Bergmann Cc: Arnd Bergmann Cc: Will Deacon Cc: Catalin Marinas Cc: Robin Murphy Cc: Joerg Roedel Cc: Sricharan R Signed-off-by: Joerg Roedel drivers/acpi/arm64/iort.c | 44 ++++++++++++++++++++++++++++++++++---------- 1 file changed, 34 insertions(+), 10 deletions(-) commit 4486740da2e1cb307f58e0e62f94c92ec7c101a1 Author: David E. Box Date: Sun Apr 23 07:15:20 2017 -0700 powercap: intel_rapl: Add support for Gemini Lake Gemini Lake RAPL support is similar to Goldmont. Signed-off-by: David E. Box Acked-by: Pan, Jacob jun Signed-off-by: Rafael J. Wysocki drivers/powercap/intel_rapl.c | 1 + 1 file changed, 1 insertion(+) commit 8e12188400668046870087fc278404a11c853061 Author: Qiuxu Zhuo Date: Fri Apr 28 01:16:15 2017 +0800 iommu/vt-d: Don't print the failure message when booting non-kdump kernel When booting a new non-kdump kernel, we have below failure message: [ 0.004000] DMAR-IR: IRQ remapping was enabled on dmar2 but we are not in kdump mode [ 0.004000] DMAR-IR: Failed to copy IR table for dmar2 from previous kernel [ 0.004000] DMAR-IR: IRQ remapping was enabled on dmar1 but we are not in kdump mode [ 0.004000] DMAR-IR: Failed to copy IR table for dmar1 from previous kernel [ 0.004000] DMAR-IR: IRQ remapping was enabled on dmar0 but we are not in kdump mode [ 0.004000] DMAR-IR: Failed to copy IR table for dmar0 from previous kernel [ 0.004000] DMAR-IR: IRQ remapping was enabled on dmar3 but we are not in kdump mode [ 0.004000] DMAR-IR: Failed to copy IR table for dmar3 from previous kernel For non-kdump case, we no need to copy IR table from previous kernel so it's nonthing actually failed. To be less alarming or misleading, do not print "DMAR-IR: Failed to copy IR table for dmar[0-9] from previous kernel" messages when booting non-kdump kernel. Signed-off-by: Qiuxu Zhuo Signed-off-by: Joerg Roedel drivers/iommu/intel_irq_remapping.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) commit c81a1a74037f61c578f6b8218b079aa434e300b4 Author: Michel Dänzer Date: Fri Apr 28 17:28:14 2017 +0900 drm/amdgpu: Make amdgpu_bo_reserve use uninterruptible waits for cleanup Some of these paths probably cannot be interrupted by a signal anyway. Those that can would fail to clean up things if they actually got interrupted. Reviewed-by: Christian König Signed-off-by: Michel Dänzer Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_sa.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 2 +- drivers/gpu/drm/amd/amdgpu/dce_v10_0.c | 6 +++--- drivers/gpu/drm/amd/amdgpu/dce_v11_0.c | 6 +++--- drivers/gpu/drm/amd/amdgpu/dce_v6_0.c | 6 +++--- drivers/gpu/drm/amd/amdgpu/dce_v8_0.c | 6 +++--- drivers/gpu/drm/amd/amdgpu/dce_virtual.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 6 +++--- drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 10 +++++----- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 8 ++++---- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 8 ++++---- 16 files changed, 36 insertions(+), 36 deletions(-) commit 8b9242eddd51f17b8306d6c96172fd68ef1106c6 Author: Rex Zhu Date: Thu Apr 27 15:48:56 2017 +0800 drm/amd/powerplay: implement stop dpm task for vega10. Add functions to disable dpm for S3/S4. Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher Reviewed-by: Huang Rui Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c | 97 ++++++++++++++++++++++ .../gpu/drm/amd/powerplay/hwmgr/vega10_powertune.c | 23 +++++ .../gpu/drm/amd/powerplay/hwmgr/vega10_powertune.h | 1 + .../gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c | 2 +- .../gpu/drm/amd/powerplay/hwmgr/vega10_thermal.h | 1 + 5 files changed, 123 insertions(+), 1 deletion(-) commit f8dc9476d9fe25b982e642a733967d7b5fbe5ae3 Author: Rex Zhu Date: Fri Apr 28 12:54:26 2017 +0800 drm/amd/powerplay: complete disable_smc_firmware_ctf_tasks. Disable ctf in eventmgr to fix S3/S4 support. Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher Reviewed-by: Huang Rui Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/eventmgr/eventsubchains.c | 2 +- drivers/gpu/drm/amd/powerplay/eventmgr/eventtasks.c | 5 +++++ drivers/gpu/drm/amd/powerplay/eventmgr/eventtasks.h | 1 + 3 files changed, 7 insertions(+), 1 deletion(-) commit 1dfc41d44c20dc3efbd0139d7f991d13c6daa875 Author: Rex Zhu Date: Thu Apr 27 15:46:35 2017 +0800 drm/amd/powerplay: add disable_smc_ctf callback in hwmgr. export disablesmcctf to eventmgr. need to disable temperature alert when s3/s4. otherwise, when resume back,enable temperature alert will fail. Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher Reviewed-by: Huang Rui Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/hwmgr/hardwaremanager.c | 10 ++++++++++ drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 1 + drivers/gpu/drm/amd/powerplay/inc/hardwaremanager.h | 2 +- drivers/gpu/drm/amd/powerplay/inc/hwmgr.h | 1 + 4 files changed, 13 insertions(+), 1 deletion(-) commit 10e709cb296c98424c03408d23e3addeddcd4088 Author: Chunming Zhou Date: Thu Apr 27 15:13:52 2017 +0800 drm/amdgpu: fix deadlock of reservation between cs and gpu reset v2 the case could happen when gpu reset: 1. when gpu reset, cs can be continue until sw queue is full, then push job will wait with holding pd reservation. 2. gpu_reset routine will also need pd reservation to restore page table from their shadow. 3. cs is waiting for gpu_reset complete, but gpu reset is waiting for cs releases reservation. v2: handle amdgpu_cs_submit error path. Signed-off-by: Chunming Zhou Reviewed-by: Christian König Reviewed-by: Junwei Zhang Reviewed-by: Monk Liu Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 ++++ 1 file changed, 4 insertions(+) commit 44eb8c1b33619abc35cba0266ff497c843bd108d Author: Junwei Zhang Date: Thu Apr 27 16:27:43 2017 +0800 drm/amdgpu: bump version for exporting gpu info for gfx9 Signed-off-by: Junwei Zhang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 408bfe7c3c5d036947b509356f494dc6b46025ff Author: Junwei Zhang Date: Thu Apr 27 11:12:07 2017 +0800 drm/amdgpu: export more gpu info for gfx9 v2: 64-bit aligned for gpu info v3: squash in wave_front_fix Signed-off-by: Ken Wang Signed-off-by: Junwei Zhang Reviewed-by: Alex Deucher Reviewed-by: Qiang Yu Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu.h | 4 ++++ drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 11 +++++++++++ drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 +++ include/uapi/drm/amdgpu_drm.h | 19 +++++++++++++++++++ 4 files changed, 37 insertions(+) commit 2c55b16bf0e1492ba662d884c81d324538cafce1 Author: Christian König Date: Thu Apr 27 17:13:39 2017 +0200 drm/amdgpu: remove unused and mostly unimplemented CGS functions v2 Those functions are all unused and some not even implemented. v2: keep cgs_get_pci_resource, it is used by the ACP driver. Signed-off-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 198 ----------------------- drivers/gpu/drm/amd/include/cgs_common.h | 270 ------------------------------- 2 files changed, 468 deletions(-) commit 00c4855ef874e41d6b9f9b19d1d1e04bc70f0b31 Author: Rex Zhu Date: Fri Apr 21 18:52:12 2017 +0800 drm/amd/powerplay: refine set pcie dpm default table on vega10. Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c | 22 +--------------------- 1 file changed, 1 insertion(+), 21 deletions(-) commit 97782cc93f4440ba2bc111b8c84644b304c56676 Author: Rex Zhu Date: Fri Apr 21 18:33:05 2017 +0800 drm/amd/powerplay: disable cks by default on vega10. run gpu test auto reboot when enable cks right now. Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit effa290caa9fa23d13b4531fcf55142a107a3b2a Author: Rex Zhu Date: Fri Apr 21 17:26:07 2017 +0800 drm/amd/powerplay: correct UlvOffsetVid on Vega10. Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 12d39245f6bea9dfddc29d75225a1d5ffc290186 Author: Alex Xie Date: Tue Apr 25 17:09:24 2017 -0400 drm/amdgpu: Fix use of interruptible waiting There is no good mechanism to handle the corresponding error. When signal interrupt happens, unpin is not called. As a result, inside AMDGPU, the statistic of pin size will be wrong. Signed-off-by: Alex Xie Reviewed-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cca7ecb32b5920f05bb940cbe01dde19c0125620 Author: Alex Xie Date: Wed Apr 26 13:31:01 2017 -0400 drm/amdgpu: Fix use of interruptible waiting Either in cgs functions or for callers of cgs functions: 1. The signal interrupt can affect the expected behaviour 2. There is no good mechanism to handle the corresponding error 3. There is no chance of deadlock in these single BO waiting 4. There is no clear benefit for interruptible waiting 5. Future caller of these functions might have same issue. Signed-off-by: Alex Xie Reviewed-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit a6bef67e2abae4f19de8fb4ec34acb1df8156a75 Author: Chunming Zhou Date: Mon Apr 24 17:39:00 2017 +0800 drm/amdgpu: fix NULL pointer error [ 141.420491] BUG: unable to handle kernel NULL pointer dereference at 0000000000000030 [ 141.420532] IP: [] fence_remove_callback+0x11/0x60 [ 141.420563] PGD 20a030067 [ 141.420575] PUD 2088ca067 [ 141.420587] PMD 0 [ 141.420599] Oops: 0000 [#1] SMP [ 141.420612] Modules linked in: amdgpu(OE) ttm(OE) drm_kms_helper(E) drm(E) i2c_algo_bit(E) fb_sys_fops(E) syscopyarea(E) sysfillrect(E) sysimgblt(E) rpcsec_gss_krb5(E) nfsv4(E) nfs(E) fscache(E) eeepc_wmi(E) asus_wmi(E) sparse_keymap(E) snd_hda_codec_realtek(E) video(E) snd_hda_codec_generic(E) snd_hda_codec_hdmi(E) snd_hda_intel(E) joydev(E) snd_hda_codec(E) snd_seq_midi(E) snd_seq_midi_event(E) snd_hda_core(E) snd_hwdep(E) snd_rawmidi(E) snd_pcm(E) kvm(E) irqbypass(E) crct10dif_pclmul(E) snd_seq(E) crc32_pclmul(E) ghash_clmulni_intel(E) snd_seq_device(E) snd_timer(E) aesni_intel(E) aes_x86_64(E) lrw(E) gf128mul(E) glue_helper(E) ablk_helper(E) cryptd(E) snd(E) soundcore(E) serio_raw(E) shpchp(E) i2c_piix4(E) i2c_designware_platform(E) 8250_dw(E) i2c_designware_core(E) mac_hid(E) binfmt_misc(E) [ 141.420948] nfsd(E) auth_rpcgss(E) nfs_acl(E) lockd(E) grace(E) sunrpc(E) parport_pc(E) ppdev(E) lp(E) parport(E) autofs4(E) hid_generic(E) usbhid(E) hid(E) psmouse(E) r8169(E) ahci(E) mii(E) libahci(E) wmi(E) [ 141.421042] CPU: 14 PID: 223 Comm: kworker/14:2 Tainted: G OE 4.9.0-custom #4 [ 141.421074] Hardware name: System manufacturer System Product Name/PRIME B350-PLUS, BIOS 0606 04/06/2017 [ 141.421146] Workqueue: events amd_sched_job_timedout [amdgpu] [ 141.421169] task: ffff88020b03ba80 task.stack: ffffc900016f4000 [ 141.421193] RIP: 0010:[] [] fence_remove_callback+0x11/0x60 [ 141.421229] RSP: 0018:ffffc900016f7d30 EFLAGS: 00010202 [ 141.421250] RAX: ffff8801c049fc00 RBX: ffff8801d4d8dc00 RCX: 0000000000000000 [ 141.421278] RDX: 0000000000000001 RSI: ffff8801c049fcc0 RDI: 0000000000000000 [ 141.421307] RBP: ffffc900016f7d48 R08: 0000000000000000 R09: 0000000000000000 [ 141.421334] R10: 00000020ed512a30 R11: 0000000000000001 R12: 0000000000000000 [ 141.421362] R13: ffff880209ba4ba0 R14: ffff880209ba4c58 R15: ffff8801c055cc60 [ 141.421390] FS: 0000000000000000(0000) GS:ffff88021ef80000(0000) knlGS:0000000000000000 [ 141.421421] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 141.421443] CR2: 0000000000000030 CR3: 000000020b554000 CR4: 00000000003406e0 [ 141.421471] Stack: [ 141.421480] ffff8801d4d8dc00 ffff880209ba4c48 ffff880209ba4ba0 ffffc900016f7d78 [ 141.421513] ffffffffa0697920 ffff880209ba0000 0000000000000000 ffff880209ba2770 [ 141.421549] ffff880209ba4b08 ffffc900016f7df0 ffffffffa05ce2ae ffffffffa0509eb7 [ 141.421583] Call Trace: [ 141.421628] [] amd_sched_hw_job_reset+0x50/0xb0 [amdgpu] [ 141.421676] [] amdgpu_gpu_reset+0x8e/0x690 [amdgpu] [ 141.421712] [] ? drm_printk+0x97/0xa0 [drm] [ 141.421770] [] amdgpu_job_timedout+0x46/0x50 [amdgpu] [ 141.421829] [] amd_sched_job_timedout+0x17/0x20 [amdgpu] [ 141.421859] [] process_one_work+0x153/0x3f0 [ 141.421884] [] worker_thread+0x12b/0x4b0 [ 141.421907] [] ? rescuer_thread+0x350/0x350 [ 141.421931] [] kthread+0xd3/0xf0 [ 141.421951] [] ? kthread_park+0x60/0x60 [ 141.421975] [] ret_from_fork+0x25/0x30 [ 141.421996] Code: ac 81 e8 a3 1f b0 ff 48 c7 c0 ea ff ff ff e9 48 ff ff ff 0f 1f 80 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 55 41 54 49 89 fc 53 <48> 8b 7f 30 48 89 f3 e8 73 7c 26 00 48 8b 13 48 39 d3 41 0f 95 [ 141.422156] RIP [] fence_remove_callback+0x11/0x60 [ 141.422183] RSP [ 141.422197] CR2: 0000000000000030 [ 141.433483] ---[ end trace bc0949bf7ddd6d4b ]--- if the job is reset twice, then the parent could be NULL. Signed-off-by: Chunming Zhou Reviewed-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/scheduler/gpu_scheduler.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 82521316395a37a2ec1d7e396c055f3c7de9d93b Author: Roger.He Date: Fri Apr 21 13:08:43 2017 +0800 drm/amdgpu: validate shadow before restoring from it Reviewed-by: Chunming Zhou Reviewed-by: Christian König Signed-off-by: Roger.He Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 12 ++++++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 21 +++++++++++++++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_object.h | 1 + 3 files changed, 34 insertions(+) commit 4a9ed1009b8b01409bdda899c0ff0d7fd2c6d094 Author: Alex Xie Date: Mon Apr 24 15:33:16 2017 -0400 drm/amdgpu: Fix use of interruptible waiting 1. The signal interrupt can affect the expected behaviour. 2. There is no good mechanism to handle the corresponding error. When signal interrupt happens, unpin is not called. As a result, inside AMDGPU, the statistic of pin size will be wrong. Signed-off-by: Alex Xie Reviewed-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_benchmark.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit d159f26caaa91c88e9078c69fd159be9cec3a005 Author: Alex Xie Date: Mon Apr 24 15:26:57 2017 -0400 drm/amdgpu: Real return value can be over-written when clean up Signed-off-by: Alex Xie Reviewed-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_benchmark.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit f3aa745eedc851742f6d6574ee2322c021b8f33c Author: Alex Xie Date: Mon Apr 24 14:27:00 2017 -0400 drm/amdgpu: Fix use of interruptible waiting 1. The signal interrupt can affect the expected behaviour. 2. There is no good mechanism to handle the corresponding error. Signed-off-by: Alex Xie Reviewed-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1d28479776fe932c32bda2366501fb2408557397 Author: Alex Xie Date: Mon Apr 24 13:53:04 2017 -0400 drm/amdgpu: Fix use of interruptible waiting 1. The signal interrupt can affect the expected behaviour. 2. There is no good mechanism to handle the corresponding error. Signed-off-by: Alex Xie Reviewed-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7a6901d7d7e49ad50d477cd8f8ef79d079b5c6c5 Author: Alex Xie Date: Mon Apr 24 13:52:41 2017 -0400 drm/amdgpu: Fix use of interruptible waiting 1. The signal interrupt can affect the expected behaviour. 2. There is no mechanism to handle the corresponding error. Signed-off-by: Alex Xie Reviewed-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 8ab25b4f51ffd2f859afaffa191d50a1eda4128f Author: Alex Xie Date: Mon Apr 24 13:30:43 2017 -0400 drm/amdgpu: Fix use of interruptible waiting If amdgpu_bo_reserve function is interrupted by signal, amdgpu_bo_kunmap function is not called. Signed-off-by: Alex Xie Reviewed-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e6b9a6c84b936e61f1ccff779494f3bd38775503 Author: Mario Kleiner Date: Mon Apr 24 01:33:09 2017 +0200 drm/radeon: Make display watermark calculations more accurate Avoid big roundoff errors in scanline/hactive durations for high pixel clocks, especially for >= 500 Mhz, and thereby program more accurate display fifo watermarks. This is a port of the corresponding amdgpu patch. Implemented for DCE 4,6,8. Tested on Evergreen/DCE-4 with Radeon HD-5770. Signed-off-by: Mario Kleiner Cc: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/radeon/cik.c | 10 +++++----- drivers/gpu/drm/radeon/evergreen.c | 10 +++++----- drivers/gpu/drm/radeon/si.c | 10 +++++----- 3 files changed, 15 insertions(+), 15 deletions(-) commit ae45bbc2ba8f92b5a773fece6f5792f497c89282 Author: Mario Kleiner Date: Mon Apr 24 01:33:08 2017 +0200 drm/radeon: Avoid overflows/divide-by-zero in latency_watermark calculations. At dot clocks > approx. 250 Mhz, some of these calcs will overflow and cause miscalculation of latency watermarks, and for some overflows also divide-by-zero driver crash. Make calcs more overflow resistant. This is a direct port of the corresponding patch from amdgpu-kms, copy-paste for cik from dce-8 and si from dce-6, with a slightly simpler variant for evergreen dce-4/5. Only tested on DCE-4 evergreen with a Radeon HD-5770. Signed-off-by: Mario Kleiner Cc: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/radeon/cik.c | 19 +++---------------- drivers/gpu/drm/radeon/evergreen.c | 8 +------- drivers/gpu/drm/radeon/si.c | 19 +++---------------- 3 files changed, 7 insertions(+), 39 deletions(-) commit effaf848b957fbf72a3b6a1ad87f5e031eda0b75 Author: Mario Kleiner Date: Mon Apr 24 01:02:46 2017 +0200 drm/amdgpu: Add missing lb_vblank_lead_lines setup to DCE-6 path. This apparently got lost when implementing the new DCE-6 support and would cause failures in pageflip scheduling and timestamping. Signed-off-by: Mario Kleiner Cc: Alex Deucher Cc: stable@vger.kernel.org Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/dce_v6_0.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 2f2429c38eddbc4f988589099fd86bb6bb65b7e4 Author: Pan Bian Date: Mon Apr 24 16:45:51 2017 +0800 drm/radeon: check return value of radeon_fence_emit Function radeon_fence_emit() returns -ENOMEM if there is no enough memory. And in this case, function radeon_ring_unlock_undo() rather than function radeon_ring_unlock_commit() should be called. However, in function radeon_test_create_and_emit_fence(), the return value of radeon_fence_emit() is ignored. This patch adds the check. Reviewed-by: Christian König Signed-off-by: Pan Bian Signed-off-by: Alex Deucher drivers/gpu/drm/radeon/radeon_test.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit c346fb74fb646352018800375c327ac35880b7e0 Author: Pan Bian Date: Mon Apr 24 16:38:05 2017 +0800 drm/radeon: check return value of radeon_ring_lock Function radeon_ring_lock() returns an errno on failure, and its return value should be validated. However, in functions r420_cp_errata_init() and r420_cp_errata_fini(), its return value is not checked. This patch adds the checks. Reviewed-by: Christian König Signed-off-by: Pan Bian Signed-off-by: Alex Deucher drivers/gpu/drm/radeon/r420.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 91faed9ee150fb07b5b0e6601b96219a6c74301f Author: Frank Min Date: Mon Apr 17 11:19:45 2017 +0800 drm/amdgpu/soc15: enable UVD code path for sriov Enable UVD block for SRIOV. Signed-off-by: Frank Min Signed-off-by: Xiangliang Yu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/soc15.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 6fa336a777712fac9da763d3df348fcfc96633f8 Author: Frank Min Date: Mon Apr 17 11:51:44 2017 +0800 drm/amdgpu/uvd7: add UVD hw init sequences for sriov Add UVD hw init. Signed-off-by: Frank Min Signed-off-by: Xiangliang Yu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/uvd_v7_0.c | 101 +++++++++++++++++++--------------- 1 file changed, 56 insertions(+), 45 deletions(-) commit beb2ced51b70a6cbccd8676b450e282fecf65565 Author: Frank Min Date: Mon Apr 17 11:45:35 2017 +0800 drm/amdgpu/uvd7: add uvd doorbell initialization for sriov Add UVD doorbell for SRIOV. Signed-off-by: Frank Min Signed-off-by: Xiangliang Yu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/uvd_v7_0.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) commit 247ac95141740157bd86d29819ff46e7ab396113 Author: Frank Min Date: Mon Apr 17 11:28:12 2017 +0800 drm/amdgpu/uvd7: add sriov uvd initialization sequences Add UVD initialization for SRIOV. Signed-off-by: Frank Min Signed-off-by: Xiangliang Yu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/uvd_v7_0.c | 246 ++++++++++++++++++++++++++++++++++ 1 file changed, 246 insertions(+) commit 7006dde2ef6110b11a76b0f972950d6da0ff3d6c Author: Xiangliang Yu Date: Fri Apr 21 16:21:41 2017 +0800 drm/amdgpu/vce4: replaced with virt_alloc_mm_table Used virt_alloc_mm_table function to allocate MM table memory. Signed-off-by: Xiangliang Yu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/vce_v4_0.c | 20 +++----------------- 1 file changed, 3 insertions(+), 17 deletions(-) commit 904cd3891dd390b109c8146974b47fca78b97c98 Author: Xiangliang Yu Date: Fri Apr 21 15:40:25 2017 +0800 drm/amdgpu/virt: add two functions for MM table Add two functions to allocate & free MM table memory. Signed-off-by: Xiangliang Yu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 46 ++++++++++++++++++++++++++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h | 2 ++ 2 files changed, 48 insertions(+) commit a92f5ec0c1341466bbfe98e1abc3cf5427ba4a67 Author: Frank Min Date: Sun Apr 16 13:37:07 2017 +0800 drm/amdgpu/vce4: move mm table constructions functions into mmsch header file Move mm table construction functions into mmsch header file so that UVD can reuse it. Signed-off-by: Frank Min Signed-off-by: Xiangliang Yu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/mmsch_v1_0.h | 57 +++++++++++++ drivers/gpu/drm/amd/amdgpu/vce_v4_0.c | 143 ++++++++++---------------------- 2 files changed, 103 insertions(+), 97 deletions(-) commit b53b8cdac621da0a4bac5f83e0004dd9b74a9160 Author: Daniel Wang Date: Wed Apr 19 16:09:08 2017 +0800 drm/amdgpu/vce4: fix a PSP loading VCE issue Fixed PSP loading issue for sriov. Signed-off-by: Daniel Wang Signed-off-by: Xiangliang Yu Acked-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/vce_v4_0.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) commit e993ca4f3b18a649e20db387f09649694043b3d4 Author: Daniel Wang Date: Thu Apr 20 11:45:09 2017 +0800 drm/amdgpu/psp: skip loading SDMA/RLCG under SRIOV VF Now GPU hypervisor will load SDMA and RLCG ucode, so skip it in guest. Signed-off-by: Daniel Wang Signed-off-by: Xiangliang Yu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 51687759be93fbc553f2727e86be25c38126ba93 Author: Chunming Zhou Date: Mon Apr 24 17:09:15 2017 +0800 drm/amdgpu: fix gpu reset crash [ 413.687439] BUG: unable to handle kernel NULL pointer dereference at 0000000000000548 [ 413.687479] IP: [] to_live_kthread+0x5/0x60 [ 413.687507] PGD 1efd12067 [ 413.687519] PUD 1efd11067 [ 413.687531] PMD 0 [ 413.687543] Oops: 0000 [#1] SMP [ 413.687557] Modules linked in: amdgpu(OE) ttm(OE) drm_kms_helper(E) drm(E) i2c_algo_bit(E) fb_sys_fops(E) syscopyarea(E) sysfillrect(E) sysimgblt(E) rpcsec_gss_krb5(E) nfsv4(E) nfs(E) fscache(E) snd_hda_codec_realtek(E) snd_hda_codec_generic(E) snd_hda_codec_hdmi(E) snd_hda_intel(E) eeepc_wmi(E) snd_hda_codec(E) asus_wmi(E) snd_hda_core(E) sparse_keymap(E) snd_hwdep(E) video(E) snd_pcm(E) snd_seq_midi(E) joydev(E) snd_seq_midi_event(E) snd_rawmidi(E) snd_seq(E) snd_seq_device(E) snd_timer(E) kvm(E) irqbypass(E) crct10dif_pclmul(E) snd(E) crc32_pclmul(E) ghash_clmulni_intel(E) soundcore(E) aesni_intel(E) aes_x86_64(E) lrw(E) gf128mul(E) glue_helper(E) ablk_helper(E) cryptd(E) shpchp(E) serio_raw(E) i2c_piix4(E) 8250_dw(E) i2c_designware_platform(E) i2c_designware_core(E) mac_hid(E) binfmt_misc(E) [ 413.687894] parport_pc(E) ppdev(E) lp(E) parport(E) nfsd(E) auth_rpcgss(E) nfs_acl(E) lockd(E) grace(E) sunrpc(E) autofs4(E) hid_generic(E) usbhid(E) hid(E) psmouse(E) ahci(E) r8169(E) mii(E) libahci(E) wmi(E) [ 413.687989] CPU: 13 PID: 1134 Comm: kworker/13:2 Tainted: G OE 4.9.0-custom #4 [ 413.688019] Hardware name: System manufacturer System Product Name/PRIME B350-PLUS, BIOS 0606 04/06/2017 [ 413.688089] Workqueue: events amd_sched_job_timedout [amdgpu] [ 413.688116] task: ffff88020f9657c0 task.stack: ffffc90001a88000 [ 413.688139] RIP: 0010:[] [] to_live_kthread+0x5/0x60 [ 413.688171] RSP: 0018:ffffc90001a8bd60 EFLAGS: 00010282 [ 413.688191] RAX: ffff88020f0073f8 RBX: ffff88020f000000 RCX: 0000000000000000 [ 413.688217] RDX: 0000000000000001 RSI: ffff88020f9670c0 RDI: 0000000000000000 [ 413.688243] RBP: ffffc90001a8bd78 R08: 0000000000000000 R09: 0000000000001000 [ 413.688269] R10: 0000006051b11a82 R11: 0000000000000001 R12: 0000000000000000 [ 413.688295] R13: ffff88020f002770 R14: ffff88020f004838 R15: ffff8801b23c2c60 [ 413.688321] FS: 0000000000000000(0000) GS:ffff88021ef40000(0000) knlGS:0000000000000000 [ 413.688352] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 413.688373] CR2: 0000000000000548 CR3: 00000001efd0f000 CR4: 00000000003406e0 [ 413.688399] Stack: [ 413.688407] ffffffff8109b304 ffff88020f000000 0000000000000070 ffffc90001a8bdf0 [ 413.688439] ffffffffa05ce29d ffffffffa052feb7 ffffffffa07b5820 ffffc90001a8bda0 [ 413.688470] ffffffff00000018 ffff8801bb88f060 0000000001a8bdb8 ffff88021ef59280 [ 413.688502] Call Trace: [ 413.688514] [] ? kthread_park+0x14/0x60 [ 413.688555] [] amdgpu_gpu_reset+0x7d/0x670 [amdgpu] [ 413.688589] [] ? drm_printk+0x97/0xa0 [drm] [ 413.688643] [] amdgpu_job_timedout+0x46/0x50 [amdgpu] [ 413.688700] [] amd_sched_job_timedout+0x17/0x20 [amdgpu] [ 413.688727] [] process_one_work+0x153/0x3f0 [ 413.688751] [] worker_thread+0x12b/0x4b0 [ 413.688773] [] ? do_syscall_64+0x6e/0x180 [ 413.688795] [] ? rescuer_thread+0x350/0x350 [ 413.688818] [] ? do_syscall_64+0x6e/0x180 [ 413.688839] [] kthread+0xd3/0xf0 [ 413.688858] [] ? kthread_park+0x60/0x60 [ 413.688881] [] ret_from_fork+0x25/0x30 [ 413.688901] Code: 25 40 d3 00 00 48 8b 80 48 05 00 00 48 89 e5 5d 48 8b 40 c8 48 c1 e8 02 83 e0 01 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 <48> 8b b7 48 05 00 00 55 48 89 e5 48 85 f6 74 31 8b 97 f8 18 00 [ 413.689045] RIP [] to_live_kthread+0x5/0x60 [ 413.689064] RSP [ 413.689076] CR2: 0000000000000548 [ 413.697985] ---[ end trace 0a314a64821f84e9 ]--- The root cause is some ring doesn't have scheduler, like KIQ ring Reviewed-by: Christian König Signed-off-by: Chunming Zhou Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 6c98d31ee83ddd351e89d5e2002e678fdaf9d2af Author: Chunming Zhou Date: Fri Apr 21 17:58:42 2017 +0800 drm/amdgpu: fix no-vmid job [ 132.036658] amdgpu 0000:22:00.0: VM IB without ID [ 132.036709] [drm:amdgpu_job_run [amdgpu]] *ERROR* Error scheduling IBs (-22) [ 132.036755] [drm:amd_sched_main [amdgpu]] *ERROR* Failed to run job! root cause is fence is signaled during sync transfer. Signed-off-by: Chunming Zhou Reviewed-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 23d2e5049c080abda50810d21c8be20b5d65d191 Author: Roger.He Date: Fri Apr 21 14:24:26 2017 +0800 drm/amdgpu: fix indent Reviewed-by: Alex Deucher Signed-off-by: Roger.He Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 34 +++++++++++++++--------------- 1 file changed, 17 insertions(+), 17 deletions(-) commit 55ed8caf14fdfecf300d35cfe2e04b670b0191c1 Author: Chunming Zhou Date: Fri Apr 21 16:40:00 2017 +0800 drm/amdgpu: increase gtt size to 3GB by default v2 v2: address Alex's comment, add AMDGPU_DEFAULT_GTT_SIZE_MB. Signed-off-by: Chunming Zhou Reviewed-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 + drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c | 3 ++- drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c | 3 ++- drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c | 3 ++- drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 3 ++- 5 files changed, 9 insertions(+), 4 deletions(-) commit 5a0f3b5f6d798637b0af5d6d3ab3eb02063e0317 Author: Christian König Date: Fri Apr 21 10:05:56 2017 +0200 drm/amdgpu: fix VM clearing in amdgpu_gem_object_close We need to check if the VM is swapped out before trying to update it. Fixes: 23e0563e48f7 ("drm/amdgpu: clear freed mappings immediately when BO may be freed") Signed-off-by: Christian König Reviewed-by: Nicolai Hähnle Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 68 ++++++++++++++++++--------------- 1 file changed, 37 insertions(+), 31 deletions(-) commit 05a72a2864c2b27471e9f5365448563c78f9b114 Author: Chunming Zhou Date: Thu Apr 13 16:16:51 2017 +0800 drm/amdgpu: add gtt print like vram when dump mm table V2 Signed-off-by: Chunming Zhou Reviewed-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_gtt_mgr.c | 9 +++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 10 +++++++++- 2 files changed, 18 insertions(+), 1 deletion(-) commit 4fcae787866915161f22d627328fa8d2e13d215b Author: Christian König Date: Thu Apr 20 12:11:47 2017 +0200 drm/amdgpu: fix amdgpu_ttm_bo_eviction_valuable BOs not mapped into the GART are always valuable for an eviction. Otherwise we don't correctly swap them out on VRAM evictions during memory pressure. Signed-off-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) commit 4bae05e196c518c2c95022fbdbee551bbc6893a5 Author: Rex Zhu Date: Thu Apr 20 16:33:23 2017 +0800 drm/amd/powerplay: Fix AVFS param. Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit afc0255c9a5ecede2f235f4d117c2913059aa3c3 Author: Rex Zhu Date: Wed Apr 19 16:00:21 2017 +0800 drm/amd/powerplay: enable clock stretch feature on Vega10. Correctly calculate CKSVidOffset Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) commit 2d5f5f949680bc02bd5f98ee9ec6d08f67e9ca4c Author: Rex Zhu Date: Thu Apr 20 16:38:36 2017 +0800 drm/amd/powerplay: enable pcie dpm on Vega10. Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit d475ce6296d702c16c96790a390ad7b4616f18b4 Author: Rex Zhu Date: Wed Apr 12 17:52:07 2017 +0800 drm/amd/powerplay: allocate fb for avfs fuse table on vega10. Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher .../gpu/drm/amd/powerplay/smumgr/vega10_smumgr.c | 36 ++++++++++++++++++++++ .../gpu/drm/amd/powerplay/smumgr/vega10_smumgr.h | 1 + 2 files changed, 37 insertions(+) commit 67131aa525d22fe21904bfd463520e98b5d67566 Author: Rex Zhu Date: Wed Apr 12 17:32:35 2017 +0800 drm/amd/powerplay: enable AGM logging while dpm disabled. Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c | 2 -- drivers/gpu/drm/amd/powerplay/smumgr/vega10_smumgr.c | 3 ++- 2 files changed, 2 insertions(+), 3 deletions(-) commit 42f72d0b3754a7ecf1208f90cef45ba89a89f2e7 Author: Huang Rui Date: Thu Apr 20 15:25:39 2017 +0800 drm/amd/powerplay: add error message to remind user updating firmware Signed-off-by: Huang Rui Reviewed-by: Evan Quan Reviewed-by: Edward O'Callaghan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/smumgr/vega10_smumgr.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 7ad87b96962a01830b0751d11a389b4039eb4460 Author: Alex Deucher Date: Mon Apr 24 13:51:52 2017 -0400 Revert "drm/amd/amdgpu: Set VCE/UVD off during late init" This leads to hangs on init. This reverts commit d1aff8ec49c3ece05cee9b6e63d44e96a420b068. drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 4 ---- 1 file changed, 4 deletions(-) commit d0766e981b36608f9fe9b29985d4cd696099c3f8 Author: Zhang, Jerry Date: Wed Apr 19 09:53:29 2017 +0800 drm/amdgpu: PRT support for gfx9 (v3) Fix PRT handling on gfx9 v2: unify PRT bit for all ASICs v3: move PRT flag checking in amdgpu_vm_bo_split_mapping() Signed-off-by: Junwei Zhang Acked-by: David Zhou Reviewed-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 ++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 3 ++- 2 files changed, 8 insertions(+), 1 deletion(-) commit fc6aa33da4b1043ad1b337d051770993418256d2 Author: Christian König Date: Wed Apr 19 14:41:19 2017 +0200 drm/amdgpu: fix amdgpu_vm_clear_freed v2 Use amdgpu_vm_bo_update_mapping() instead of amdgpu_vm_bo_split_mapping() here. We don't want any flags set in the cleared areas and splitting shouldn't be necessary. v2: fix typo in commit message Signed-off-by: Christian König Reviewed-by: Alex Deucher Reviewed-by: Junwei Zhang Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit e3c5e9826d60630236de105c05e7a58f12c45ab5 Author: Trigger Huang Date: Mon Apr 17 08:50:18 2017 -0400 drm/amdgpu: Destroy psp ring in hw_fini Fix issue that PSP initialization will fail if reload amdgpu module. That's because the PSP ring must be destroyed to be ready for the next time PSP initialization. Changes in v2: - Move psp_ring_destroy before all BOs free (suggested by Ray Huang). Changes in v3: - Check firmware load type, if it is not PSP, we should do nothing in fw_fini(), and of course will not destroy PSP ring too (suggested by Ray Huang). Signed-off-by: Trigger Huang Reviewed-by: Xiangliang Yu Reviewed-by: Huang Rui Acked-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 9 +++++++-- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h | 3 +++ drivers/gpu/drm/amd/amdgpu/psp_v3_1.c | 27 +++++++++++++++++++++++++++ drivers/gpu/drm/amd/amdgpu/psp_v3_1.h | 2 ++ 4 files changed, 39 insertions(+), 2 deletions(-) commit e0b2f8cff15b2d20a427c381247a8ff6bb28d21e Author: Evan Quan Date: Wed Apr 12 17:34:26 2017 +0800 drm/amdgpu: update smu9 driver interface Updated interface between the driver and the SMU controller. Signed-off-by: Evan Quan Signed-off-by: Alex Deucher Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/inc/smu9_driver_if.h | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) commit 775f55f1b5b65c6cfc52555d9a8b80de5429d21b Author: Tom St Denis Date: Wed Apr 19 11:03:04 2017 -0400 drm/amd/amdgpu: Print out ring name in dev_info So it's more obvious which rings are using which INV engines. Signed-off-by: Tom St Denis Reviewed-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 2bde7c32b1db162692f05c6be066b5bcd3d9fdbe Author: Hans de Goede Date: Fri Apr 21 13:48:08 2017 +0200 ACPI / PMIC: xpower: Fix power_table addresses The power table addresses should be contiguous, but there was a hole where 0x34 was missing. On most devices this is not a problem as addresses above 0x34 are used for the BUC# convertors which are not used in the DSDTs I've access to but after the BUC# convertors there is a field named GPI1 in the DSTDs, which does get used in some cases and ended up turning BUC6 on and off due to the wrong addresses, resulting in turning the entire device off (or causing it to reboot). Removing the hole in the addresses fixes this, fixing one of my Bay Trail tablets turning off while booting the mainline kernel. While at it add comments with the field names used in the DSDTs to make it easier to compare the register and bits used at each address with the datasheet. Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Signed-off-by: Rafael J. Wysocki drivers/acpi/pmic/intel_pmic_xpower.c | 50 +++++++++++++++++------------------ 1 file changed, 25 insertions(+), 25 deletions(-) commit e182e234c8658c0880401052fd364b1a1a59b03d Author: Tom St Denis Date: Wed Apr 19 09:02:41 2017 -0400 drm/amd/amdgpu: Change comp GFXv9 ring name to remove space umr expects the ring name to be a complete word. This also makes it consistent with GFXv7/8. Signed-off-by: Tom St Denis Reviewed-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 15ff510bbfd7170fa5af8924fe0503f4d116e7d2 Author: Tom St Denis Date: Wed Apr 19 09:01:42 2017 -0400 drm/amd/amdgpu: Change comp GFXv6 ring name to remove space umr expects the ring name to be a complete word. This also makes it consistent with GFXv7/8. Signed-off-by: Tom St Denis Reviewed-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1c4ecf48cfee8e138c6483bafd1425628a413315 Author: Trigger Huang Date: Mon Apr 17 10:56:02 2017 -0400 drm/amdgpu: Fix module unload hang by KIQ on Vega10 Apply commit 4e683cb2644f ("drm/amdgpu: Fix module unload hang by KIQ IRQ set")to vega10 V2: delete reduant kiq irq funcs type check (suggested by Rex.Zhu) Signed-off-by: Trigger Huang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) commit 7ef69843def65bdbf69a5be784e6a9e080f22ef6 Author: Rex Zhu Date: Tue Apr 18 19:21:44 2017 +0800 drm/amdgpu: fix memory clock can't switch on CI. if we set only lowest mclk level enabled, when we enable uvd dpm during boot time, mclk will be fixed in the lowest level. the mclk switch will fail if try to enable other level of mclk at this time. so set all mclk levels enabled. Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/ci_dpm.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit fb82afab134ab71b3b52224b6da12daea8662c28 Author: Xiangliang Yu Date: Fri Apr 14 17:43:02 2017 +0800 drm/amdgpu/gfx9: bypass clockgating setting For SRIOV doesn't need clockgating, bypass it. Signed-off-by: Xiangliang Yu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 +++ 1 file changed, 3 insertions(+) commit 98c24b24dfef209eb8bb164550e1567c7ba82c52 Author: Xiangliang Yu Date: Fri Apr 14 17:40:57 2017 +0800 drm/amdgpu/mmhub_v1: bypass clockgating setting For SRIOV doesn't need CG, so bypass it. Signed-off-by: Xiangliang Yu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c | 3 +++ 1 file changed, 3 insertions(+) commit 8972e5d26996e3f04e1cf29b7d7edd3ec5614bf2 Author: Christian König Date: Mon Mar 6 13:34:57 2017 +0100 drm/amdgpu: fix coding style and printing in amdgpu_doorbell_init Based on commit "drm/radeon: remove useless and potentially wrong message". The size of the info printing is incorrect and the PCI subsystems prints the same info on boot anyway. Signed-off-by: Christian König Reviewed-by: Edward O'Callaghan Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) commit ee73164a0d8d2fd98f666a5dd35da1d9a19ec009 Author: Pixel Ding Date: Thu Feb 23 11:10:33 2017 +0800 drm/amdgpu/virt: don't check VALID bit for FLR completion message The interrupt after FLR is missed sometimes due to hardware reason, so guest driver get the notification of FLR completion via polling message. Then host doesn't write VALID bit to avoid sending interrupt, otherwise the completion will be handled twice. So there's a valid message without VALID bit for FLR completion, driver should handle it without checking. Signed-off-by: Pixel Ding Reviewed-by: Xiangliang Yu Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/mxgpu_vi.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit ad2fed9ad5907c35e132e43420a0e47ab22350f0 Author: Junwei Zhang Date: Thu Feb 23 11:01:40 2017 +0800 drm/amdgpu: fix double_offchip_lds_buf for gfx v6 Was incorrect for SI. Signed-off-by: Junwei Zhang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2211a787dee798131a4774ee7df9aa758ebe07aa Author: Rex Zhu Date: Mon Apr 17 20:46:29 2017 +0800 drm/amd/powerplay: delete dead functions in vega10. Vega10 does not support AVFS BTC, remove function. Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c | 30 ++-------------------- .../gpu/drm/amd/powerplay/smumgr/vega10_smumgr.c | 9 ------- .../gpu/drm/amd/powerplay/smumgr/vega10_smumgr.h | 1 - 3 files changed, 2 insertions(+), 38 deletions(-) commit 4bdcc4ea3ac11eddacbadd43128e1aba0122700b Author: Rex Zhu Date: Mon Apr 17 19:44:23 2017 +0800 drm/amd/amdgpu: coding style refine in sdma_v4_0.c Replace 8 spaces with tabs. correct {} braces, etc. Signed-off-by: Rex Zhu Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 151 ++++++++++++++++----------------- 1 file changed, 75 insertions(+), 76 deletions(-) commit 79690b84db904669256fe3ef66dd175ce201817d Author: Rex Zhu Date: Mon Apr 17 18:46:57 2017 +0800 drm/amdgpu: Remove redundant itermediate return val in sdma_v4_0.c Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) commit aef1ba58f5c60ec2de38258cb76db7842ccb6e1b Author: Huang Rui Date: Mon Apr 17 15:32:52 2017 +0800 drm/ttm: cleanup unuse ret value The ret must be 0 here, otherwise, the function will return after init_mem_type. Signed-off-by: Huang Rui Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/ttm/ttm_bo.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit b3124dfcce8147e1340a06952f32443dc7e102b1 Author: Huang Rui Date: Fri Apr 14 10:50:03 2017 +0800 drm/amdgpu: fix to print incorrect wptr address Signed-off-by: Huang Rui Reviewed-by: Michel Dänzer Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 03161a6ecb7576492bb37e9bfc68a0330fc6a41d Author: Huang Rui Date: Thu Apr 13 16:12:26 2017 +0800 drm/amdgpu: fix dead lock if any ip block resume failed in s3 Driver must free the console lock whether driver resuming successful or not. Otherwise, fb_console will be always waiting for the lock and then cause system stuck. [ 244.405541] INFO: task kworker/0:0:4 blocked for more than 120 seconds. [ 244.405543] Tainted: G OE 4.9.0-custom #1 [ 244.405544] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 244.405541] INFO: task kworker/0:0:4 blocked for more than 120 seconds. [ 244.405543] Tainted: G OE 4.9.0-custom #1 [ 244.405544] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 244.405550] kworker/0:0 D 0 4 2 0x00080000 [ 244.405559] Workqueue: events console_callback [ 244.405564] ffff88045a2cfc00 0000000000000000 ffff880462b75940 ffffffff81c0e500 [ 244.405568] ffff880476419280 ffffc900018f7c90 ffffffff817dcf62 000000000000003c [ 244.405572] 0000000100000000 0000000000000002 ffff880462b75940 ffff880462b75940 [ 244.405573] Call Trace: [ 244.405580] [] ? __schedule+0x222/0x6a0 [ 244.405584] [] schedule+0x36/0x80 [ 244.405588] [] schedule_timeout+0x1fc/0x390 [ 244.405592] [] __down_common+0xa5/0xf8 [ 244.405598] [] ? put_prev_entity+0x48/0x710 [ 244.405601] [] __down+0x1d/0x1f [ 244.405606] [] down+0x41/0x50 [ 244.405611] [] console_lock+0x1a/0x40 [ 244.405614] [] console_callback+0x13/0x160 [ 244.405617] [] ? __schedule+0x22a/0x6a0 [ 244.405623] [] process_one_work+0x153/0x3f0 [ 244.405628] [] worker_thread+0x12b/0x4b0 [ 244.405633] [] ? rescuer_thread+0x350/0x350 [ 244.405637] [] kthread+0xd3/0xf0 [ 244.405641] [] ? kthread_park+0x60/0x60 [ 244.405645] [] ? kthread_park+0x60/0x60 [ 244.405649] [] ret_from_fork+0x25/0x30 Signed-off-by: Huang Rui Reviewed-by: Michel Dänzer Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 26 +++++++++++--------------- 1 file changed, 11 insertions(+), 15 deletions(-) commit 8f12bbe6d94a51f3ae314c27cc7b9b315adfe383 Author: Christian König Date: Tue Apr 11 19:20:20 2017 +0200 drm/radeon: force the UVD DPB into VRAM as well Seems to be mandatory for WMV playback. Bugs: https://bugs.freedesktop.org/show_bug.cgi?id=100510 Signed-off-by: Christian König Acked-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/radeon/radeon_cs.c | 10 ++++++---- drivers/gpu/drm/radeon/radeon_uvd.c | 2 +- 2 files changed, 7 insertions(+), 5 deletions(-) commit 203eb0cb0eab990347e646c89a7134e60713133a Author: Alex Deucher Date: Mon Apr 10 15:36:32 2017 -0400 drm/amdgpu: bump version number to note race fix and new fence functionality fixed in: "drm/amdgpu:fix race condition" Reviewed-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 080b24ebdf230c80fe63e64633c0d52aca5d1a8e Author: Alex Deucher Date: Mon Apr 10 15:32:43 2017 -0400 drm/amdgpu: fix spelling in header comment Reviewed-by: Christian König Signed-off-by: Alex Deucher include/uapi/drm/amdgpu_drm.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5f1bcf511f6e5f54fffa6365286af1e88b18f54c Author: Christian König Date: Fri Apr 7 17:43:19 2017 +0200 drm/amdgpu: trace vm hub during flush as well v2 Trace on which hub we are doing the flush. v2: fix typo in commit message Signed-off-by: Christian König Reviewed-by: Alex Deucher Reviewed-by: Andres Rodriguez Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h | 20 ++++++++++++-------- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 2 +- 2 files changed, 13 insertions(+), 9 deletions(-) commit c5296d1401fb01ceb3a3cf781cc572b1847953c6 Author: Christian König Date: Fri Apr 7 15:31:13 2017 +0200 drm/amdgpu: trace the vmhub in grab_id as well Trace on which VMHUB we assigned an VMID. Signed-off-by: Christian König Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_trace.h | 17 ++++++++++------- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 2 +- 2 files changed, 11 insertions(+), 8 deletions(-) commit 87c910d806295df26069d0325f517ed72ce29d32 Author: Christian König Date: Thu Mar 30 16:56:20 2017 +0200 drm/amdgpu: allow concurrent VM flushes Enable concurrent VM flushes for Vega10. Signed-off-by: Christian König Acked-by: Alex Deucher Reviewed-by: Andres Rodriguez Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 50 +++++++++++++++++++--------------- 1 file changed, 28 insertions(+), 22 deletions(-) commit 4789c463cb04d725170406873caaec5208c99eb9 Author: Christian König Date: Fri Mar 31 11:03:50 2017 +0200 drm/amdgpu: assign VM invalidation engine manually v2 For Vega10 we have 18 VM invalidation engines for each VMHUB. Start to assign them manually to the rings. v2: add a BUG_ON if we use to many engines Signed-off-by: Christian König Reviewed-by: Alex Deucher Reviewed-by: Andres Rodriguez Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 1 + drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 16 ++++++++++++++++ drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/uvd_v7_0.c | 4 ++-- drivers/gpu/drm/amd/amdgpu/vce_v4_0.c | 2 +- 6 files changed, 22 insertions(+), 5 deletions(-) commit 2e81984988adf8de92b7d3a14ba0fe8310d0bcf8 Author: Christian König Date: Thu Mar 30 16:50:47 2017 +0200 drm/amdgpu: invalidate only the currently needed VMHUB v2 Drop invalidating both hubs from each engine. v2: don't use hardcoded values Signed-off-by: Christian König Reviewed-by: Alex Deucher Reviewed-by: Andres Rodriguez Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 3 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 36 +++++------ drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 60 +++++++++--------- drivers/gpu/drm/amd/amdgpu/uvd_v7_0.c | 111 +++++++++++++++------------------ drivers/gpu/drm/amd/amdgpu/vce_v4_0.c | 57 ++++++++--------- 5 files changed, 119 insertions(+), 148 deletions(-) commit 7645670decdb677e2f415ff91609d31e5d4777d8 Author: Christian König Date: Thu Apr 6 17:52:39 2017 +0200 drm/amdgpu: split VMID management by VMHUB This way GFX and MM won't fight for VMIDs any more. Initially disabled since we need to stop flushing all HUBS at the same time as well. Signed-off-by: Christian König Reviewed-by: Andres Rodriguez Acked-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 1 - drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 82 ++++++++++++++++++------------ drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 15 ++++-- drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 3 +- 10 files changed, 69 insertions(+), 45 deletions(-) commit 4f618e737fafed22302d4b660eecfe1dce971b0f Author: Christian König Date: Thu Apr 6 15:18:21 2017 +0200 drm/amdgpu: drop VMID per ring tracking David suggested this a long time ago, instead of checking each ring just walk over all the VMIDs in reverse LRU order. Signed-off-by: Christian König Reviewed-by: Andres Rodriguez Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 17 +++-------------- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 3 --- 2 files changed, 3 insertions(+), 17 deletions(-) commit 0eeb68b390377148e31f000db1c533a9a49bf950 Author: Christian König Date: Thu Mar 30 14:49:50 2017 +0200 drm/amdgpu: add VMHUB to ring association Add the info which ring belonging to which VMHUB. Signed-off-by: Christian König Reviewed-by: Alex Deucher Reviewed-by: Andres Rodriguez Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 1 + drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 +++ drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 1 + drivers/gpu/drm/amd/amdgpu/uvd_v7_0.c | 2 ++ drivers/gpu/drm/amd/amdgpu/vce_v4_0.c | 1 + 5 files changed, 8 insertions(+) commit 0381631299e54128be5180d0a169b06cd3ce1ba6 Author: Frank Min Date: Thu Apr 6 14:46:50 2017 +0800 drm/amdgpu/vce4: enable ring & ib test for sriov Now VCE block can work for SRIOV, enable ring & ib test. Signed-off-by: Frank Min Acked-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 8 -------- 1 file changed, 8 deletions(-) commit a2f537e03b678887fdd8d0810b03ecad01ba5d36 Author: Xiangliang Yu Date: Thu Apr 6 14:43:48 2017 +0800 drm/amdgpu/vce4: workaround VCE ring test slow issue Add VCE ring test slow workaround for SRIOV. Signed-off-by: Frank Min Signed-off-by: Xiangliang Yu Acked-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) commit 71f2af890a337dec5a792846a9db36943651e4d0 Author: Frank Min Date: Fri Apr 7 10:38:52 2017 +0800 drm/amdgpu/vce4: update VCE initialization sequence for SRIOV Update the initialization sequence of VCE to make VCE work. Signed-off-by: Frank Min Acked-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/vce_v4_0.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) commit bc108ec78e2af5c7a5f6ef27e264b8093bd60e3b Author: Trigger Huang Date: Tue Apr 11 01:56:36 2017 -0400 drm/amdgpu: Fix firmware UCODE_ID_STORAGE issue (v2) In Tonga's virtualization environment, for firmware UCODE_ID_STORAGE, there is no actual firmware data, but we still need alloc a BO and tell the BO's mc address to HW, or world switch will hang on VFs. v2: fix coding style (Alex) Signed-off-by: Trigger Huang Reviewed-by: Xiangliang Yu Reviewed-by: Monk Liu Acked-by: Huang Rui Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) commit cbcbea982af59d0a4c40dacfb6ff164a533fd1d9 Author: Huang Rui Date: Tue Apr 11 09:24:56 2017 +0800 drm/amdgpu: fix to add buffer funcs check This patch fixes the case when buffer funcs is empty and bo evict is executing. It must double check buffer funcs, otherwise, a NULL pointer dereference kernel panic will be encountered. BUG: unable to handle kernel NULL pointer dereference at 00000000000001a4 IP: [] amdgpu_evict_flags+0x3d/0xf0 [amdgpu] PGD 0 Oops: 0000 [#1] SMP Modules linked in: amdgpu(OE) ttm drm_kms_helper drm i2c_algo_bit fb_sys_fops syscopyarea sysfillrect sysimgblt fmem(OE) physmem_drv(OE) rpcsec_gss_krb5 nfsv4 nfs fscache intel_rapl x86_pkg_temp_thermal intel_powerclamp snd_hda_codec_realtek snd_hda_codec_hdmi snd_hda_codec_generic kvm_intel snd_hda_intel snd_hda_codec kvm snd_hda_core joydev eeepc_wmi asus_wmi sparse_keymap snd_hwdep snd_pcm irqbypass crct10dif_pclmul snd_seq_midi snd_seq_midi_event snd_rawmidi snd_seq crc32_pclmul snd_seq_device ghash_clmulni_intel aesni_intel aes_x86_64 snd_timer lrw gf128mul mei_me snd glue_helper ablk_helper cryptd tpm_infineon mei lpc_ich serio_raw soundcore shpchp mac_hid nfsd auth_rpcgss nfs_acl lockd grace coretemp sunrpc parport_pc ppdev lp parport autofs4 hid_generic mxm_wmi r8169 usbhid ahci psmouse libahci nvme mii hid nvme_core wmi video CPU: 3 PID: 1627 Comm: kworker/u8:17 Tainted: G OE 4.9.0-custom #1 Hardware name: ASUS All Series/Z87-A, BIOS 1802 01/28/2014 Workqueue: events_unbound async_run_entry_fn task: ffff88021e7057c0 task.stack: ffffc9000262c000 RIP: 0010:[] [] amdgpu_evict_flags+0x3d/0xf0 [amdgpu] RSP: 0018:ffffc9000262fb30 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88021e8a5858 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffffc9000262fb58 RDI: ffff88021e8a5800 RBP: ffffc9000262fb48 R08: 0000000000000000 R09: ffff88021e8a5814 R10: 000000001def8f01 R11: ffff88021def8c80 R12: ffffc9000262fb58 R13: ffff88021d2b1990 R14: 0000000000000000 R15: ffff88021e8a5858 FS: 0000000000000000(0000) GS:ffff88022ed80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000001a4 CR3: 0000000001c07000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Signed-off-by: Huang Rui Reviewed-by: Ken Wang Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 692bb1ac038a0b736c2b6e9bba41ac2da38e16cf Author: Huang Rui Date: Mon Apr 10 09:29:13 2017 +0800 drm/amdgpu: fix to clear ASIC INIT COMPLETE bit on resuming phase ASIC_INIT_COMPLETE bit must be cleared during S3 resuming phase, because VBIOS will check the bit to decide if execute ASIC_Init posting via kernel driver. Signed-off-by: Huang Rui Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 6 ++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c | 7 +++++++ 2 files changed, 13 insertions(+) commit b4de2c5aab2d5cd84c2a648d825b0e48ca426e27 Author: Huang Rui Date: Mon Apr 10 15:29:42 2017 +0800 drm/amdgpu: do not free fence buf when driver probes. Fence buf needs to be used on suspend/resume phase. Signed-off-by: Huang Rui Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 4573f0f21d6c40a9426d0418646d87bbf77d6ab5 Author: Huang Rui Date: Mon Apr 10 14:40:51 2017 +0800 drm/amd/powerplay: fix suspend error on DPM disabled Don't fail if DPM is disabled. Signed-off-by: Huang Rui Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/amd_powerplay.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 04434ab5120a362c11ae6e6cf196fc6a98c3365d Author: Hans de Goede Date: Fri Apr 21 09:35:07 2017 +0200 ACPI / LPSS: Call pwm_add_table() for Bay Trail PWM device On Bay Trail systems with a Crystal Cove PMIC the Crystal Cove's PWM is used to control the backlight brightness. On systems without one, the Crystal Cove SoC's PWM is used and we need to call pwm_add_table() so that the i915 driver can find the pwm for controlling the backlight. Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki drivers/acpi/acpi_lpss.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) commit 5e68ebd0ac4842977c127160f9ecf1a0099f502f Author: Viresh Kumar Date: Tue Apr 25 12:52:10 2017 +0530 PM / Domains: Add DT file to MAINTAINERS Add the power_domain.txt DT file to MAINTAINERS, otherwise get_maintainers.pl doesn't pick the right set of maintainers for changes to the DT file. Signed-off-by: Viresh Kumar Acked-by: Ulf Hansson Signed-off-by: Rafael J. Wysocki MAINTAINERS | 1 + 1 file changed, 1 insertion(+) commit e841cfc9ff530d37617e589490caac59a1d94200 Author: Viresh Kumar Date: Tue Apr 25 12:48:21 2017 +0530 PM / Domains: Fix DT example The power-domain provider's #power-domain-cells field is set to 0 and yet the children is using an index to point the power domain. Fix it by removing the index field. Fixes: 70bb510e4279 (dt/bindings / PM/Domains: Update binding for PM domain idle states) Signed-off-by: Viresh Kumar Acked-by: Ulf Hansson Acked-by: Rob Herring Signed-off-by: Rafael J. Wysocki Documentation/devicetree/bindings/power/power_domain.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 52e70c8af7e5d04e3fe431066f0530a17a8147c2 Merge: 168f4a6 8494206 2cff319 592c809 bf4f5bf Author: Rafael J. Wysocki Date: Fri Apr 28 23:18:22 2017 +0200 Merge branches 'acpi-power', 'acpi-blacklist', 'acpi-video' and 'acpi-doc' * acpi-power: power: supply: axp288_charger: Only wait for INT3496 device if present ACPI / AC: Add a blacklist with PMIC ACPI HIDs with a native charger driver ACPI / battery: Add a blacklist with PMIC ACPI HIDs with a native battery driver ACPI / battery: Fix acpi_battery_exit on acpi_battery_init_async errors ACPI / utils: Add new acpi_dev_present helper * acpi-blacklist: ACPI / blacklist: add _REV quirk for Dell Inspiron 7537 * acpi-video: ACPI / video: add comments about subtle cases ACPI / video: get rid of magic numbers and use enum instead * acpi-doc: ACPI / doc: linuxized-acpica.txt: fix typos commit 5d4dd65b1e98ff640c3bdb546a169e397805831e Author: Arnd Bergmann Date: Fri Apr 28 11:44:12 2017 +0200 of: fix unittest build without CONFIG_OF_OVERLAY We get a link error when the new tests are used by overlays are not: drivers/of/built-in.o: In function `unflatten_device_tree': (.init.text+0x967): undefined reference to `unittest_unflatten_overlay_base' This makes the #ifdef check match the symbols that lead to building the unittest_unflatten_overlay_base function. Fixes: 81d0848fc8d2 ("of: Add unit tests for applying overlays") Signed-off-by: Arnd Bergmann Reviewed-by: Frank Rowand Tested-by: Frank Rowand Signed-off-by: Rob Herring drivers/of/of_private.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 168f4a6950daabe1b9ee3845d70220dda8205c94 Merge: 131b3a8 35b6873 2c74d84 2e5a7f7 Author: Rafael J. Wysocki Date: Fri Apr 28 23:17:55 2017 +0200 Merge branches 'acpi-processor', 'acpi-cppc' and 'acpi-pmic' * acpi-processor: ACPI / Processor: Drop setup_max_cpus check from acpi_processor_add() * acpi-cppc: ACPI / CPPC: add sysfs entries for CPPC perf capabilities ACPI / CPPC: Read lowest nonlinear perf in cppc_get_perf_caps() * acpi-pmic: ACPI / PMIC: Stop xpower OPRegion handler relying on IIO ACPI / PMIC: Add opregion driver for Intel CHT Whiskey Cove PMIC commit 131b3a8db237dc3dc12b098e1dbf2be3b8de3c27 Merge: 5a7ad11 c381fc3 f49c3f9 79f97c3 Author: Rafael J. Wysocki Date: Fri Apr 28 23:17:36 2017 +0200 Merge branches 'acpi-scan', 'acpi-tables' and 'acpi-platform' * acpi-scan: ACPI / scan: Avoid enumerating devices more than once ACPI / scan: Apply default enumeration to devices with ACPI drivers ACPI / scan: Drop support for force_remove * acpi-tables: ACPI / tables: Drop acpi_parse_entries() which is not used * acpi-platform: ACPI / platform: Update platform device NUMA node based on _PXM method commit a1d2fcfd80bef6cdc5675dcabe25587010720bdb Merge: 060d0fb 2244037 Author: Rafael J. Wysocki Date: Fri Apr 28 23:15:52 2017 +0200 Merge branch 'pm-tools' * pm-tools: tools: power: pm-graph: Package makefile and man pages tools: power: pm-graph: AnalyzeBoot v2.0 tools: power: pm-graph: AnalyzeSuspend v4.6 tools/power/x86/intel_pstate_tracer: Adjust directory ownership commit 060d0fbb437a83610268ff9863aa4a88c537dd7e Merge: 0807ee0 0baa91c bafdcde b539cc8 7db36b1 58b11f6 Author: Rafael J. Wysocki Date: Fri Apr 28 23:15:34 2017 +0200 Merge branches 'pm-cpuidle', 'pm-core', 'pm-domains', 'pm-avs' and 'pm-devfreq' * pm-cpuidle: cpuidle: powernv: Avoid a branch in the core snooze_loop() loop cpuidle: powernv: Don't continually set thread priority in snooze_loop() cpuidle: powernv: Don't bounce between low and very low thread priority cpuidle: cpuidle-cps: remove unused variable powernv-cpuidle: Validate DT property array size * pm-core: PM / runtime: Document autosuspend-helper side effects PM / runtime: Fix autosuspend documentation * pm-domains: PM / Domains: Ignore domain-idle-states that are not compatible PM / Domains: Don't warn about IRQ safe device for an always on PM domain PM / Domains: Respect errors from genpd's ->power_off() callback PM / Domains: Enable users of genpd to specify always on PM domains PM / Domains: Clean up code validating genpd's status PM / Domain: remove conditional from error case * pm-avs: PM / AVS: rockchip-io: add io selectors and supplies for rk3328 * pm-devfreq: PM / devfreq: Move struct devfreq_governor to devfreq directory commit 0807ee0f525470482ecb002c45abcceed37e24e5 Merge: 5a7ad11 2addac7 Author: Rafael J. Wysocki Date: Fri Apr 28 23:14:00 2017 +0200 Merge branch 'pm-cpufreq' * pm-cpufreq: (37 commits) cpufreq: Add Tegra186 cpufreq driver cpufreq: imx6q: Fix error handling code cpufreq: imx6q: Set max suspend_freq to avoid changes during suspend cpufreq: imx6q: Fix handling EPROBE_DEFER from regulator cpufreq: schedutil: Use policy-dependent transition delays cpufreq: schedutil: Reduce frequencies slower cpufreq: intel_pstate: Add support for Gemini Lake cpufreq: intel_pstate: Eliminate intel_pstate_get_min_max() cpufreq: intel_pstate: Do not walk policy->cpus cpufreq: intel_pstate: Introduce pid_in_use() cpufreq: intel_pstate: Drop struct cpu_defaults cpufreq: intel_pstate: Move cpu_defaults definitions cpufreq: intel_pstate: Add update_util callback to pstate_funcs cpufreq: intel_pstate: Use different utilization update callbacks cpufreq: intel_pstate: Modify check in intel_pstate_update_status() cpufreq: intel_pstate: Drop driver_registered variable cpufreq: intel_pstate: Skip unnecessary PID resets on init cpufreq: intel_pstate: Set HWP sampling interval once cpufreq: intel_pstate: Clean up intel_pstate_busy_pid_reset() cpufreq: intel_pstate: Fold intel_pstate_reset_all_pid() into the caller ... commit 2addac72afb304fa5aa57dbdd12659a8fd52d105 Merge: 2dee4b0 1b72e7f Author: Rafael J. Wysocki Date: Fri Apr 28 23:13:33 2017 +0200 Merge schedutil governor updates for v4.12. commit 2dee4b0e0b83c9d045d6cfe168d6798ead3fe33c Merge: 939dc6f 630e575 Author: Rafael J. Wysocki Date: Fri Apr 28 23:13:04 2017 +0200 Merge intel_pstate driver updates for v4.12. commit 60e22cffb53804e5331df4fa3892dacb6f57eb7a Author: Max Filippov Date: Wed Mar 29 19:53:49 2017 -0700 xtensa: use ITLB_HIT_BIT instead of hardcoded number There is ITLB_HIT_BIT macro, no need to use 0x8 to check for TLB hit. Signed-off-by: Max Filippov arch/xtensa/kernel/setup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit d7b1eeb2ca039d04f1a1fcb241920cb112b4b52a Author: Monk Liu Date: Fri Apr 7 18:39:07 2017 +0800 drm/amdgpu:fix race condition sequence is protected by spinlock so don't access sequence in paramter seq when invoking this function. ~0 means to get the latest sequence number and 0 means none to get. Change-Id: Ib7a03f3cf5594deeb4ad333cc59b47a6bddfd1ad Signed-off-by: Monk Liu Reviewed-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 3 +++ include/uapi/drm/amdgpu_drm.h | 5 ++++- 2 files changed, 7 insertions(+), 1 deletion(-) commit 5e78835abdabc303ba980f50e9f71039e7689cc9 Author: Tom St Denis Date: Fri Apr 7 07:53:53 2017 -0400 drm/amd/amdgpu: Port gfx9 driver over to new read/write macros Signed-off-by: Tom St Denis Acked-by: Christian König Reviewed-by: Chunming Zhou Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 406 +++++++++++++++++----------------- 1 file changed, 203 insertions(+), 203 deletions(-) commit b1bb8c0118b3b9d44a6a31ea5242bdd9ed040a9b Author: Tom St Denis Date: Fri Apr 7 07:53:31 2017 -0400 drm/amd/amdgpu: Introduce new read/write macros for SOC15 Signed-off-by: Tom St Denis Reviewed-by: Christian König Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu.h | 3 --- drivers/gpu/drm/amd/amdgpu/soc15_common.h | 20 +++++++++++++++++++- 2 files changed, 19 insertions(+), 4 deletions(-) commit 93ea9b9f7cec596adac13b944a122e4c69de18a4 Author: Huang Rui Date: Thu Mar 23 11:20:25 2017 +0800 drm/amdgpu: add hw_start and non-psp firmware loading into resume Rework in order to properly support suspend. Signed-off-by: Huang Rui Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) commit be70bbda3fb9a1b876ed80e2ebc292203eb0ffec Author: Huang Rui Date: Tue Mar 21 18:36:57 2017 +0800 drm/amdgpu: split psp ring init function Rework in order to properly support suspend. Signed-off-by: Huang Rui Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 115 ++++++++++++++++++++------------ drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h | 3 + drivers/gpu/drm/amd/amdgpu/psp_v3_1.c | 11 ++- drivers/gpu/drm/amd/amdgpu/psp_v3_1.h | 2 + 4 files changed, 87 insertions(+), 44 deletions(-) commit f5cfef98f736f9aa42e9ad41e67b5abd96b77835 Author: Huang Rui Date: Tue Mar 21 18:02:04 2017 +0800 drm/amdgpu: split psp asd function Rework in order to properly support suspend. Signed-off-by: Huang Rui Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 45 ++++++++++++++++----------------- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h | 5 +++- 2 files changed, 26 insertions(+), 24 deletions(-) commit 2b0c3aee2172451e9f982b25f3fdf59a1b687dc3 Author: Huang Rui Date: Wed Mar 22 10:16:05 2017 +0800 drm/amdgpu: use private memory to store psp firmware data Rework in order to properly support suspend. Signed-off-by: Huang Rui Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 28 ++++++------------- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h | 1 - drivers/gpu/drm/amd/amdgpu/psp_v3_1.c | 48 ++++++--------------------------- 3 files changed, 16 insertions(+), 61 deletions(-) commit 53a5cf57d819f12b2de365aa3137c9175a032608 Author: Huang Rui Date: Tue Mar 21 16:51:00 2017 +0800 drm/amdgpu: add psp firmware private memory Needed for proper suspend support. Signed-off-by: Huang Rui Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 23 +++++++++++++++++++---- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h | 6 ++++++ 2 files changed, 25 insertions(+), 4 deletions(-) commit 6f2b1fcccb6dad1d68c0955144af3ad56bacb25c Author: Huang Rui Date: Tue Mar 21 16:18:11 2017 +0800 drm/amdgpu: split psp tmr init function Rework in order to properly support suspend. Signed-off-by: Huang Rui Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-) commit 6524e494a8acf1a281f349e6f726918d41b5a8de Author: Rex Zhu Date: Fri Apr 7 14:56:58 2017 +0800 drm/amd/powerplay: align with VBIOS to support new AVFS structure Align the driver with the latest vbios structures. Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher drivers/gpu/drm/amd/powerplay/hwmgr/ppatomfwctrl.c | 21 ++--- drivers/gpu/drm/amd/powerplay/hwmgr/ppatomfwctrl.h | 24 +++--- drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c | 91 ++++++++++++---------- 3 files changed, 68 insertions(+), 68 deletions(-) commit bc5150ef3331167f08adc9fd5c1f947bd5fdd1ff Author: Bob Moore Date: Wed Apr 26 16:20:17 2017 +0800 ACPICA: Update version to 20170303 ACPICA commit db13f9ffbdf16c0b4fb92d051c14c7b96f379f3f ACPICA commit c55bb526ac9233fe4abc5ea923e136354ce7779c Version 20170224. Version 20170303. Link: https://github.com/acpica/acpica/commit/db13f9ff Link: https://github.com/acpica/acpica/commit/c55bb526 Signed-off-by: Bob Moore Signed-off-by: Lv Zheng Signed-off-by: Rafael J. Wysocki include/acpi/acpixf.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9cf7adeca1f307b578021f227119495eecb1a510 Author: Bob Moore Date: Fri Apr 28 08:53:22 2017 +0800 ACPICA: iasl: add ASL conversion tool ACPICA commit c04d310039d3e0ed1cb62876fe7e596fbc75ab01 ACPICA commit a65c1df7e6b4bad8e37df822018c40c6c446add9 The key feature of this utility is that the original comments within the input ASL files are preserved during the conversion process, and included within the converted ASL+ file -- thus creating a transparent conversion of existing ASL files to ASL+ (ASL 2.0) This patch is an automatic generation of the ASL converter commit, Linux kernel isn't affected by the functionality provided in this commit, but requires the linuxized changes to support future ACPICA release automation. Link: https://github.com/acpica/acpica/commit/c04d3100 Link: https://github.com/acpica/acpica/commit/a65c1df7 Signed-off-by: Bob Moore Signed-off-by: Jung-uk Kim Signed-off-by: Lv Zheng Signed-off-by: Rafael J. Wysocki drivers/acpi/acpica/acconvert.h | 144 ++++++++++++++++++++++++++++++++++++++++ drivers/acpi/acpica/acglobal.h | 53 +++++++++++++++ drivers/acpi/acpica/aclocal.h | 99 ++++++++++++++++++++++----- drivers/acpi/acpica/acmacros.h | 35 ++++++++++ drivers/acpi/acpica/acopcode.h | 2 + drivers/acpi/acpica/amlcode.h | 4 +- drivers/acpi/acpica/psargs.c | 23 +++++++ drivers/acpi/acpica/psloop.c | 32 +++++++++ drivers/acpi/acpica/psobject.c | 38 +++++++++++ drivers/acpi/acpica/psopcode.c | 5 +- drivers/acpi/acpica/psopinfo.c | 2 +- drivers/acpi/acpica/pstree.c | 7 ++ drivers/acpi/acpica/psutils.c | 11 +++ drivers/acpi/acpica/utalloc.c | 50 ++++++++++++++ drivers/acpi/acpica/utdebug.c | 1 + include/acpi/acconfig.h | 1 + include/acpi/actbl2.h | 1 + 17 files changed, 490 insertions(+), 18 deletions(-) commit 2c1175c2e8e5487233cabde358a19577562ac83e Author: Robert Lippert Date: Thu Apr 20 16:49:47 2017 -0700 ipmi/watchdog: fix wdog hang on panic waiting for ipmi response Commit c49c097610fe ("ipmi: Don't call receive handler in the panic context") means that the panic_recv_free is not called during a panic and the atomic count does not drop to 0. Fix this by only expecting one decrement of the atomic variable which comes from panic_smi_free. Signed-off-by: Robert Lippert Signed-off-by: Corey Minyard drivers/char/ipmi/ipmi_watchdog.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 73ba2d5c2bd4ecfec8fe37f20e962889b8a4c972 Merge: 53cecf1 88326ef Author: Dave Airlie Date: Sat Apr 29 05:50:27 2017 +1000 Merge tag 'drm-intel-next-fixes-2017-04-27' of git://anongit.freedesktop.org/git/drm-intel into drm-next drm/i915 and gvt fixes for drm-next/v4.12 * tag 'drm-intel-next-fixes-2017-04-27' of git://anongit.freedesktop.org/git/drm-intel: drm/i915: Confirm the request is still active before adding it to the await drm/i915: Avoid busy-spinning on VLV_GLTC_PW_STATUS mmio drm/i915/selftests: Allocate inode/file dynamically drm/i915: Fix system hang with EI UP masked on Haswell drm/i915: checking for NULL instead of IS_ERR() in mock selftests drm/i915: Perform link quality check unconditionally during long pulse drm/i915: Fix use after free in lpe_audio_platdev_destroy() drm/i915: Use the right mapping_gfp_mask for final shmem allocation drm/i915: Make legacy cursor updates more unsynced drm/i915: Apply a cond_resched() to the saturated signaler drm/i915: Park the signaler before sleeping drm/i915/gvt: fix a bounds check in ring_id_to_context_switch_event() drm/i915/gvt: Fix PTE write flush for taking runtime pm properly drm/i915/gvt: remove some debug messages in scheduler timer handler drm/i915/gvt: add mmio init for virtual display drm/i915/gvt: use directly assignment for structure copying drm/i915/gvt: remove redundant ring id check which cause significant CPU misprediction drm/i915/gvt: remove redundant platform check for mocs load/restore drm/i915/gvt: Align render mmio list to cacheline drm/i915/gvt: cleanup some too chatty scheduler message commit 53cecf1b0e301a881d0096568b58982d7474a8ae Merge: 97643d7 7a9d200 Author: Dave Airlie Date: Sat Apr 29 05:49:54 2017 +1000 Merge branch 'drm-vmwgfx-next' of git://people.freedesktop.org/~syeh/repos_linux into drm-next trivial patch. * 'drm-vmwgfx-next' of git://people.freedesktop.org/~syeh/repos_linux: drm/vmwgfx: Convert macro to octal representation commit 97643d75b053cd2aa7b23a93a474ed3690e34384 Merge: 6b14627 763656d Author: Dave Airlie Date: Sat Apr 29 05:48:45 2017 +1000 Merge branch 'for-upstream/mali-dp' of git://linux-arm.org/linux-ld into drm-next Latest updates on Mali DP, adding support for colour management, plane scaling and power management. (these have been in -next for a while). * 'for-upstream/mali-dp' of git://linux-arm.org/linux-ld: drm: mali-dp: use div_u64 for expensive 64-bit divisions drm: mali-dp: Check the mclk rate and allow up/down scaling drm: mali-dp: Enable image enhancement when scaling drm: mali-dp: Add plane upscaling support drm/mali-dp: Add core_id file to the sysfs interface drm: mali-dp: Add CTM support drm: mali-dp: enable gamma support drm: mali-dp: add malidp_crtc_state struct drm: mali-dp: add custom reset hook for planes drm: mali-dp: remove unused variable drm: mali-dp: add atomic_print_state for planes drm: mali-dp: Enable power management for the device. drm: mali-dp: Update the state of all planes before re-enabling active CRTCs. commit 4c042a80c1776477d8f13d0b214809a2eaedf01d Merge: cd5487fb f3515b5 Author: David S. Miller Date: Fri Apr 28 15:48:16 2017 -0400 Merge branch 'bpf-misc-next' Daniel Borkmann says: ==================== Misc BPF updates This set cleans up ldimm64 leftovers from early eBPF days and adds couple of test cases related to this to the verifier test suite. It also cleans up the kallsyms spinlock (had same patch also in queue) by relaxing it through switching to _bh variant. It fixes up test_progs in relation to htons/ntohs and adds accessor macros for the percpu tests in test_maps. ==================== Signed-off-by: David S. Miller commit f3515b5d0b718cceae9e67802cfa20d5e6f9b567 Author: Daniel Borkmann Date: Thu Apr 27 01:39:35 2017 +0200 bpf: provide a generic macro for percpu values for selftests To overcome bugs as described and fixed in 89087c456fb5 ("bpf: Fix values type used in test_maps"), provide a generic BPF_DECLARE_PERCPU() and bpf_percpu() accessor macro for all percpu map values used in tests. Declaring variables works as follows (also works for structs): BPF_DECLARE_PERCPU(uint32_t, my_value); They can then be accessed normally as uint32_t type through: bpf_percpu(my_value, ) For example: bpf_percpu(my_value, 0)++; Implicitly, we make sure that the passed type is allocated and aligned by gcc at least on a 8-byte boundary, so that it works together with the map lookup/update syscall for percpu maps. We use it as a usage example in test_maps, so that others are free to adapt this into their code when necessary. Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: David S. Miller tools/testing/selftests/bpf/bpf_util.h | 7 +++++++ tools/testing/selftests/bpf/test_maps.c | 37 ++++++++++++++++++--------------- 2 files changed, 27 insertions(+), 17 deletions(-) commit 43bcf707ccdc79ee63edb953fcf72e6dc244cfa1 Author: Daniel Borkmann Date: Thu Apr 27 01:39:34 2017 +0200 bpf: fix _htons occurences in test_progs Dave reported that on sparc test_progs generates buggy swapped eth->h_proto protocol comparisons: 10: (15) if r3 == 0xdd86 goto pc+9 R0=imm2,min_value=2,max_value=2 R1=pkt(id=0,off=0,r=14) R2=pkt_end R3=inv R4=pkt(id=0,off=14,r=14) R5=inv56 R10=fp This is due to the unconditional ... #define htons __builtin_bswap16 #define ntohs __builtin_bswap16 ... in test_progs that causes this. Make use of asm/byteorder.h and use __constant_htons() where possible and only perform the bswap16 when on little endian in non-constant case. Fixes: 6882804c916b ("selftests/bpf: add a test for overlapping packet range checks") Fixes: 37821613626e ("selftests/bpf: add l4 load balancer test based on sched_cls") Reported-by: David S. Miller Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: David S. Miller tools/testing/selftests/bpf/bpf_util.h | 19 +++++++++++++++++++ tools/testing/selftests/bpf/test_l4lb.c | 11 +++++------ tools/testing/selftests/bpf/test_pkt_access.c | 6 +++--- tools/testing/selftests/bpf/test_progs.c | 10 ++++------ 4 files changed, 31 insertions(+), 15 deletions(-) commit d24f7c7fb91d94556936f2511035d1f123b449f4 Author: Hannes Frederic Sowa Date: Thu Apr 27 01:39:33 2017 +0200 bpf: bpf_lock on kallsysms doesn't need to be irqsave Hannes rightfully spotted that the bpf_lock doesn't need to be irqsave variant. We never perform any such updates where this would be necessary (neither right now nor in future), therefore relax this further. Signed-off-by: Hannes Frederic Sowa Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: David S. Miller kernel/bpf/core.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) commit 728a853a44a0f01111883f95216e980722474c07 Author: Daniel Borkmann Date: Thu Apr 27 01:39:32 2017 +0200 bpf: add various test cases to verifier selftests Add several test cases around ldimm64, fp arithmetic and direct packet access. Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: David S. Miller tools/testing/selftests/bpf/test_verifier.c | 137 ++++++++++++++++++++++++++++ 1 file changed, 137 insertions(+) commit 7e56fbd27b4bd6ab7d641f45bf23d2af654412f6 Author: Daniel Borkmann Date: Thu Apr 27 01:39:31 2017 +0200 bpf, x86_64/arm64: remove old ldimm64 artifacts from jits For both cases, the verifier is already rejecting such invalid formed instructions. Thus, remove these artifacts from old times and align it with ppc64, sparc64 and s390x JITs that don't have them in the first place. Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: David S. Miller arch/arm64/net/bpf_jit_comp.c | 9 --------- arch/x86/net/bpf_jit_comp.c | 7 ------- 2 files changed, 16 deletions(-) commit b2518c78ce76896f0f8f7940bf02104b227e1709 Author: Toshi Kani Date: Tue Apr 25 17:04:13 2017 -0600 libnvdimm, pmem: fix a NULL pointer BUG in nd_pmem_notify The following BUG was observed when nd_pmem_notify() was called for a BTT device. The use of a pmem_device pointer is not valid with BTT. BUG: unable to handle kernel NULL pointer dereference at 0000000000000030 IP: nd_pmem_notify+0x30/0xf0 [nd_pmem] Call Trace: nd_device_notify+0x40/0x50 child_notify+0x10/0x20 device_for_each_child+0x50/0x90 nd_region_notify+0x20/0x30 nd_device_notify+0x40/0x50 nvdimm_region_notify+0x27/0x30 acpi_nfit_scrub+0x341/0x590 [nfit] process_one_work+0x197/0x450 worker_thread+0x4e/0x4a0 kthread+0x109/0x140 Fix nd_pmem_notify() by setting nd_region and badblocks pointers properly for BTT. Cc: Cc: Vishal Verma Fixes: 719994660c24 ("libnvdimm: async notification support") Signed-off-by: Toshi Kani Signed-off-by: Dan Williams drivers/nvdimm/pmem.c | 37 +++++++++++++++++++++++++------------ 1 file changed, 25 insertions(+), 12 deletions(-) commit ab630891ce0eb83dc6c37971b35b228fc9e225ca Author: Dan Williams Date: Fri Apr 21 13:28:12 2017 -0700 libnvdimm, region: sysfs trigger for nvdimm_flush() The nvdimm_flush() mechanism helps to reduce the impact of an ADR (asynchronous-dimm-refresh) failure. The ADR mechanism handles flushing platform WPQ (write-pending-queue) buffers when power is removed. The nvdimm_flush() mechanism performs that same function on-demand. When a pmem namespace is associated with a block device, an nvdimm_flush() is triggered with every block-layer REQ_FUA, or REQ_FLUSH request. These requests are typically associated with filesystem metadata updates. However, when a namespace is in device-dax mode, userspace (think database metadata) needs another path to perform the same flushing. In other words this is not required to make data persistent, but in the case of metadata it allows for a smaller failure domain in the unlikely event of an ADR failure. The new 'deep_flush' attribute is visible when the individual DIMMs backing a given interleave-set are described by platform firmware. In ACPI terms this is "NVDIMM Region Mapping Structures" and associated "Flush Hint Address Structures". Reads return "1" if the region supports triggering WPQ flushes on all DIMMs. Reads return "0" the flush operation is a platform nop, and in that case the attribute is read-only. Why sysfs and not an ioctl? An ioctl requires establishing a new ioctl function number space for device-dax. Given that this would be called on a device-dax fd an application could be forgiven for accidentally calling this on a filesystem-dax fd. Placing this interface in libnvdimm sysfs removes that potential for collision with a filesystem ioctl, and it keeps ioctls out of the generic device-dax implementation. Cc: Jeff Moyer Cc: Masayoshi Mizuma Signed-off-by: Dan Williams drivers/nvdimm/region_devs.c | 41 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) commit cd5487fb9485934dfa0ad9d6b52c4da8e38318e6 Merge: cec3819 e892d2d Author: David S. Miller Date: Fri Apr 28 15:43:24 2017 -0400 Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next Steffen Klassert says: ==================== pull request (net-next): ipsec-next 2017-04-28 Just one patch to fix a misplaced spin_unlock_bh in an error path. Please pull or let me know if there are problems. ==================== Signed-off-by: David S. Miller commit a590b90d472f2c176c140576ee3ab44df7f67839 Author: Tejun Heo Date: Fri Apr 28 15:14:55 2017 -0400 cgroup: fix spurious warnings on cgroup_is_dead() from cgroup_sk_alloc() cgroup_get() expected to be called only on live cgroups and triggers warning on a dead cgroup; however, cgroup_sk_alloc() may be called while cloning a socket which is left in an empty and removed cgroup and thus may legitimately duplicate its reference on a dead cgroup. This currently triggers the following warning spuriously. WARNING: CPU: 14 PID: 0 at kernel/cgroup.c:490 cgroup_get+0x55/0x60 ... [] __warn+0xd3/0xf0 [] warn_slowpath_null+0x1e/0x20 [] cgroup_get+0x55/0x60 [] cgroup_sk_alloc+0x51/0xe0 [] sk_clone_lock+0x2db/0x390 [] inet_csk_clone_lock+0x16/0xc0 [] tcp_create_openreq_child+0x23/0x4b0 [] tcp_v6_syn_recv_sock+0x91/0x670 [] tcp_check_req+0x3a6/0x4e0 [] tcp_v6_rcv+0x693/0xa00 [] ip6_input_finish+0x59/0x3e0 [] ip6_input+0x32/0xb0 [] ip6_rcv_finish+0x57/0xa0 [] ipv6_rcv+0x318/0x4d0 [] __netif_receive_skb_core+0x2d7/0x9a0 [] __netif_receive_skb+0x16/0x70 [] netif_receive_skb_internal+0x23/0x80 [] napi_gro_frags+0x208/0x270 [] mlx4_en_process_rx_cq+0x74c/0xf40 [] mlx4_en_poll_rx_cq+0x30/0x90 [] net_rx_action+0x210/0x350 [] __do_softirq+0x106/0x2c7 [] irq_exit+0x9d/0xa0 [] do_IRQ+0x54/0xd0 [] common_interrupt+0x7f/0x7f [] cpuidle_enter+0x17/0x20 [] cpu_startup_entry+0x2a9/0x2f0 [] start_secondary+0xf1/0x100 This patch renames the existing cgroup_get() with the dead cgroup warning to cgroup_get_live() after cgroup_kn_lock_live() and introduces the new cgroup_get() which doesn't check whether the cgroup is live or dead. All existing cgroup_get() users except for cgroup_sk_alloc() are converted to use cgroup_get_live(). Fixes: d979a39d7242 ("cgroup: duplicate cgroup reference when cloning sockets") Cc: stable@vger.kernel.org # v4.5+ Cc: Johannes Weiner Reported-by: Chris Mason Signed-off-by: Tejun Heo kernel/cgroup/cgroup.c | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) commit e9b615186805e2c18a0ac76aca62c1543ecfdbb8 Author: Oleksij Rempel Date: Fri Apr 28 16:19:49 2017 +0200 platform/x86: asus-wmi: try to set als by default some laptops, for example ASUS UX330UAK, have brocken als_get function but working als_set funktion. In this case, ALS will stay turned off. Method (WMNB, 3, Serialized) { ... If (Local0 == 0x53545344) { ... If (IIA0 == 0x00050001) { If (!ALSP) { Return (0x02) } Local0 = (GALS & 0x10) <<<---- bug, should be: (GALS () & 0x10) If (Local0) { Return (0x00050001) } Else { Return (0x00050000) } } ..... If (Local0 == 0x53564544) { ... If (IIA0 == 0x00050001) { Return (ALSC (IIA1)) } ...... Method (GALS, 0, NotSerialized) { Local0 = Zero Local0 |= 0x20 If (ALAE) { Local0 |= 0x10 } Local1 = 0x0A Local1 <<= 0x08 Local0 |= Local1 Return (Local0) } Since it works without problems on Windows I assume ASUS WMI driver for Win never trying to get ALS state, and instead it is setting it by default to ON. This patch will do the same. Turn ALS on by default. Signed-off-by: Oleksij Rempel Signed-off-by: Andy Shevchenko drivers/platform/x86/asus-nb-wmi.c | 13 +++++++++++++ drivers/platform/x86/asus-wmi.c | 12 ++++++++++++ drivers/platform/x86/asus-wmi.h | 1 + 3 files changed, 26 insertions(+) commit a8fe342856e5bce71a43201eb2870bd059483d2f Author: Jérémy Lefaure Date: Fri Apr 21 22:19:45 2017 -0400 platform/x86: asus-wmi: fix cpufv sysfs file permission The cpufv sysfs file is defined as readable by anyone even if the attribute does not have a show function. The result of every read is an IO error. This file should be write only. Signed-off-by: Jérémy Lefaure Signed-off-by: Andy Shevchenko drivers/platform/x86/asus-wmi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit f9ac89f5ad613b462339e845aeb8494646fd9be2 Author: Lee, Chun-Yi Date: Fri Apr 28 16:23:59 2017 +0800 platform/x86: acer-wmi: setup accelerometer when ACPI device was found The 98d610c3739a patch was introduced since v4.11-rc1 that it causes that the accelerometer input device will not be created on workable machines because the HID string comparing logic is wrong. And, the patch doesn't prevent that the accelerometer input device be created on the machines that have no BST0001. That's because the acpi_get_devices() returns success even it didn't find any match device. This patch fixed the HID string comparing logic of BST0001 device. And, it also makes sure that the acpi_get_devices() returns acpi_handle for BST0001. Fixes: 98d610c3739a ("acer-wmi: setup accelerometer when machine has appropriate notify event") Reference: https://bugzilla.kernel.org/show_bug.cgi?id=193761 Reported-by: Samuel Sieb Signed-off-by: "Lee, Chun-Yi" Signed-off-by: Andy Shevchenko drivers/platform/x86/acer-wmi.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) commit ccc7179f4d9467947c94f4302d61cd5143842fcd Author: Andy Shevchenko Date: Tue Feb 21 20:53:48 2017 +0100 platform/x86: ideapad-laptop: Add IdeaPad V310-15ISK to no_hw_rfkill Like other Lenovo models the IdeaPad V310-15ISK does not have an hw rfkill switch. This results in hard-blocked radios after boot, resulting in always blocked radios rendering them unusable. Add the IdeaPad V310-15ISK to the no_hw_rfkill DMI list and allows using the built-in radios. Signed-off-by: Andy Shevchenko drivers/platform/x86/ideapad-laptop.c | 7 +++++++ 1 file changed, 7 insertions(+) commit 62a7b9c859d09af860c71cfbea4381061975ca72 Author: Kuppuswamy Sathyanarayanan Date: Sun Apr 9 15:00:21 2017 -0700 platform/x86: intel_pmc_ipc: use gcr mem base for S0ix counter read To maintain the uniformity in accessing GCR registers, this patch modifies the S0ix counter read function to use GCR address base instead of ipc address base. Signed-off-by: Kuppuswamy Sathyanarayanan Reviewed-by: Rajneesh Bhardwaj Tested-by: Shanth Murthy Signed-off-by: Andy Shevchenko arch/x86/include/asm/intel_pmc_ipc.h | 2 ++ drivers/platform/x86/intel_pmc_ipc.c | 10 +++------- 2 files changed, 5 insertions(+), 7 deletions(-) commit 9d855d468dc655d10be6cb52e36aa0bbfa6f515d Author: Kuppuswamy Sathyanarayanan Date: Sun Apr 9 15:00:20 2017 -0700 platform/x86: intel_pmc_ipc: Fix iTCO_wdt GCS memory mapping failure iTCO_wdt driver need access to PMC_CFG GCR register to modify the noreboot setting. Currently, this is done by passing PMC_CFG reg address as memory resource to watchdog driver and allowing it directly modify the PMC_CFG register. But currently PMC driver also has requirement to memory map the entire GCR register space in this driver. This causes mem request failure in watchdog driver. So this patch fixes this issue by adding API to update noreboot flag and passes them to watchdog driver via platform data. Signed-off-by: Kuppuswamy Sathyanarayanan Signed-off-by: Andy Shevchenko drivers/platform/x86/intel_pmc_ipc.c | 29 +++++++++++++++++------------ 1 file changed, 17 insertions(+), 12 deletions(-) commit 140c91b26ebc48d80c6ac3ef06953b17d7fb3785 Author: Kuppuswamy Sathyanarayanan Date: Sun Apr 9 15:00:19 2017 -0700 watchdog: iTCO_wdt: Add PMC specific noreboot update api In some SoCs, setting noreboot bit needs modification to PMC GC registers. But not all PMC drivers allow other drivers to memory map their GC region. This could create mem request conflict in watchdog driver. So this patch adds facility to allow PMC drivers to pass noreboot update function to watchdog drivers via platform data. Signed-off-by: Kuppuswamy Sathyanarayanan Acked-by: Guenter Roeck Signed-off-by: Andy Shevchenko drivers/watchdog/iTCO_wdt.c | 25 ++++++++++++++++++------- include/linux/platform_data/itco_wdt.h | 4 ++++ 2 files changed, 22 insertions(+), 7 deletions(-) commit f583a884afecb16fcb8200ebb9956ea369aff57f Author: Kuppuswamy Sathyanarayanan Date: Sun Apr 9 15:00:18 2017 -0700 watchdog: iTCO_wdt: cleanup set/unset no_reboot_bit functions iTCO_wdt no_reboot_bit set/unset functions has lot of common code between them. So merging these two functions into a single update function would remove these unnecessary code duplications. This patch fixes this issue by creating a no_reboot_bit update function to handle both set/unset functions. Also checking for iTCO version every time you make no_reboot_bit set/unset call is inefficient and makes the code look complex. This can be improved by performing this check once during device probe and selecting the appropriate no_reboot_bit update function. This patch fixes this issue by splitting the update function into multiple helper functions. Signed-off-by: Kuppuswamy Sathyanarayanan Reviewed-by: Guenter Roeck Signed-off-by: Andy Shevchenko drivers/watchdog/iTCO_wdt.c | 83 +++++++++++++++++++++++++++------------------ 1 file changed, 50 insertions(+), 33 deletions(-) commit 496702068597ff29092e724301f77b91864454b3 Author: Kuppuswamy Sathyanarayanan Date: Sun Apr 9 15:00:17 2017 -0700 platform/x86: intel_pmc_ipc: Add pmc gcr read/write/update api's This patch adds API's to read/write/update PMC GC registers. PMC dependent devices like iTCO_wdt, Telemetry has requirement to acces GCR registers. These API's can be used for this purpose. Signed-off-by: Kuppuswamy Sathyanarayanan Signed-off-by: Andy Shevchenko arch/x86/include/asm/intel_pmc_ipc.h | 21 +++++++ drivers/platform/x86/intel_pmc_ipc.c | 115 +++++++++++++++++++++++++++++++++++ 2 files changed, 136 insertions(+) commit e6749c89b4b0acaeddf4909eb75b7f6c8a4c15b2 Author: Kuppuswamy Sathyanarayanan Date: Sun Apr 9 15:00:16 2017 -0700 platform/x86: intel_pmc_ipc: fix gcr offset According to Broxton APL spec, PMC MIMO resources for Global Control Registers(GCR) are located at 4K(0x1000) offset from IPC base address. In this driver, PLAT_RESOURCE_GCR_OFFSET macro defines the offset of GCR region base address from IPC base address and its current value of 0x1008 is incorrect because it points to location for PMC_CFG register and not the GCR base address itself. GCR Base = IPC1 Base + 0x1000. This patch fixes this offset issue. Signed-off-by: Kuppuswamy Sathyanarayanan Signed-off-by: Andy Shevchenko drivers/platform/x86/intel_pmc_ipc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9216e0dcb5533a999d544d0af8661118e0588e1d Author: Pali Rohár Date: Sun Apr 23 21:40:47 2017 +0200 platform/x86: dell-laptop: Add keyboard backlight timeout AC settings When changing keyboard backlight state on new Dell laptops, firmware expects a new timeout AC value filled in Set New State SMBIOS call. Without it any change of keyboard backlight state on new Dell laptops fails. And user can see following error message in dmesg: dell_laptop: Setting old previous keyboard state failed leds dell::kbd_backlight: Setting an LED's brightness failed (-6) This patch adds support for retrieving current timeout AC values and also updating them. Current timeout value in sysfs is displayed based on current AC status, like current display brightness value. Detection if Dell laptop supports or not new timeout AC settings is done by checking existence of Keyboard Backlight with AC SMBIOS token (0x0451). Signed-off-by: Pali Rohár Acked-by: Mario Limonciello Tested-by: Arcadiy Ivanov [andy: fixed merge conflict with defined constants] Signed-off-by: Andy Shevchenko drivers/platform/x86/dell-laptop.c | 59 ++++++++++++++++++++++++++++++++++---- 1 file changed, 53 insertions(+), 6 deletions(-) commit 90a864b965e452ee2a15ed7b13f47142aeb4a40b Author: Arvind Yadav Date: Thu Mar 9 11:19:56 2017 +0530 platform/x86: dell-laptop: Handle return error form dell_get_intensity. Here, This patch is to handle a return error from dell_get_intensity. This change is done using Coccinelle. Signed-off-by: Arvind Yadav Acked-by: Pali Rohár Signed-off-by: Andy Shevchenko drivers/platform/x86/dell-laptop.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 0b8dba15e909990e275631fa57255e74bbc766fc Author: Andy Shevchenko Date: Wed Apr 19 22:27:31 2017 +0300 platform/x86: hp-wireless: reuse module_acpi_driver There is a macro to register and unregister modules in simple cases, Let's use it and clean up the driver. Cc: Alex Hung Signed-off-by: Andy Shevchenko Reviewed-by: Darren Hart (VMware) drivers/platform/x86/hp-wireless.c | 19 +------------------ 1 file changed, 1 insertion(+), 18 deletions(-) commit cec381919818a9a0cb85600b3c82404bdd38cf36 Merge: 2d2ab65 b34939b Author: David S. Miller Date: Fri Apr 28 14:41:15 2017 -0400 Merge tag 'mac80211-next-for-davem-2017-04-28' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next Johannes Berg says: ==================== Another set of patches for -next: * API support for concurrent scheduled scan requests * API changes for roaming reporting * BSS max idle support in mac80211 * API changes for TX status reporting in mac80211 * API changes for RX rate reporting in mac80211 * rewrite monitor logic to prepare for BPF filters * bugfix for rare devices without 2.4 GHz support * a bugfix for recent DFS changes * some further cleanups The API changes are actually at a nice time, since it's typically quiet just before the merge window, and trees can be synchronized easily during it. ==================== Signed-off-by: David S. Miller commit bcb85c887647c0f096b51ac2ee391ea792b14b9e Author: Jann Horn Date: Mon Apr 24 11:16:49 2017 +0200 KVM: Documentation: remove VM mmap documentation Since commit 80f5b5e700fa9c ("KVM: remove vm mmap method"), the VM mmap handler is gone. Remove the corresponding documentation. Signed-off-by: Jann Horn Signed-off-by: Paolo Bonzini Documentation/virtual/kvm/api.txt | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) commit 3417f3528a2c7f8824cad7f0c35425961e98886b Author: Arnd Bergmann Date: Wed Apr 19 19:44:55 2017 +0200 clk: ti: divider: try to fix ti_clk_register_divider Commit 6c0afb503937 ("clk: ti: convert to use proper register definition for all accesses") converted all register accesses in the TI clk driver to use a proper struct instead of a void pointer casted struct that fits into a u32. Unfortunately, it missed a conversion here in the didivder code, leading to a compiler warning like so: drivers/clk/ti/divider.c: In function 'ti_clk_register_divider': drivers/clk/ti/divider.c:460:8: error: 'reg' may be used uninitialized in this function [-Werror=maybe-uninitialized] Treating a 'u32' variable as a structure leads to a stack overflow here, and the register address we pass down is never initialized. Convert this part of the code as well so things work properly. Fixes: 6c0afb503937 ("clk: ti: convert to use proper register definition for all accesses") Signed-off-by: Arnd Bergmann [sboyd@codeaurora.org: Fixed fixes tag, rewrote commit message, s/reg_setup/reg/] Signed-off-by: Stephen Boyd drivers/clk/ti/divider.c | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-) commit 94d595c56077fd8b0f61701e03fd4b3dc8c62038 Author: Dasaratharaman Chandramouli Date: Mon Mar 20 19:38:09 2017 -0400 IB/core: Add rdma_cap_opa_ah to expose opa address handles rdma_cap_opa_ah(..) enables core components to check if the corresponding port supports OPA extended addressing. Reviewed-by: Ira Weiny Reviewed-by: Don Hiatt Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Doug Ledford include/rdma/ib_verbs.h | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) commit ee1c60b1bff8f258fa530def3459726f8e922caf Author: Dasaratharaman Chandramouli Date: Mon Mar 20 19:38:08 2017 -0400 IB/SA: Modify SA to implicitly cache Class Port info SA will query and cache class port info as part of its initialization. SA will also invalidate and refresh the cache based on specific events. Callers such as IPoIB and CM can query the SA to get the classportinfo information. Apart from making the caller code much simpler, this change puts the onus on the SA to query and maintain classportinfo much like how it maitains the address handle to the SM. Reviewed-by: Ira Weiny Reviewed-by: Don Hiatt Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Doug Ledford drivers/infiniband/core/cma.c | 76 ++--------- drivers/infiniband/core/sa_query.c | 175 +++++++++++++++++-------- drivers/infiniband/ulp/ipoib/ipoib.h | 1 - drivers/infiniband/ulp/ipoib/ipoib_main.c | 71 ---------- drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 9 +- include/rdma/ib_sa.h | 12 +- 6 files changed, 137 insertions(+), 207 deletions(-) commit cb8637660ae8e4a1e240692582472bbac708da88 Author: Dasaratharaman Chandramouli Date: Mon Mar 20 19:38:07 2017 -0400 IB/SA: Move functions update_sm_ah() and ib_sa_event() Moving these will facilitate changes to these in the next patchs. This is strictly a move and there are no changes to the functions in any way. Reviewed-by: Don Hiatt Reviewed-by: Ira Weiny Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Doug Ledford drivers/infiniband/core/sa_query.c | 172 ++++++++++++++++++------------------- 1 file changed, 86 insertions(+), 86 deletions(-) commit 680562b56939c8730c1beba9da2cf184c88a437e Author: Dasaratharaman Chandramouli Date: Mon Mar 20 19:38:06 2017 -0400 IB/SA: Remove unwanted braces This fixes a checkpatch issue. The fix is needed so that some of these functions can be moved around in the forthcoming patches Reviewed-by: Don Hiatt Reviewed-by: Ira Weiny Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Doug Ledford drivers/infiniband/core/sa_query.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit dbb6c91fd8e0f32ff892cf72782f3650df2be811 Author: Dasaratharaman Chandramouli Date: Mon Mar 20 19:38:05 2017 -0400 IB/SA: Add braces when using sizeof This fixes a checkpatch issue. The fix is needed so that some of these functions can be moved around in the forthcoming patches Reviewed-by: Don Hiatt Reviewed-by: Ira Weiny Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Doug Ledford drivers/infiniband/core/sa_query.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit f96a318714496c01c6d3cecea06500f69e5c7edc Author: Dasaratharaman Chandramouli Date: Mon Mar 20 19:38:04 2017 -0400 IB/SA: Fix lines longer than 80 columns This fixes a checkpatch issue. The fix is needed so that some of these functions can be moved around in the forthcoming patches Reviewed-by: Don Hiatt Reviewed-by: Ira Weiny Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Doug Ledford drivers/infiniband/core/sa_query.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) commit 4608e4c8f2417a5a2985da9890710033c434c387 Author: Dennis Dalessandro Date: Sun Apr 9 10:17:30 2017 -0700 IB/hfi1: Use bool in process_ecn The process_ecn intends to return a bool value. However it is doing so incorrectly by ANDing the fecn mask. The fecn bit is bit 31. Bool is not a native data type and is up to the compiler to implement how it sees fit. It is conceivable that this upper bit gets washed out. Fix by converting to a bool properly. Cc: stable@vger.kernel.org Fixes: Commit fd2b562edca6 ("IB/hfi1: Pull FECN/BECN processing to a common place") Reviewed-by: Mike Marciniszyn Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/hfi.h | 2 +- drivers/infiniband/hw/hfi1/rc.c | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) commit 12220267645cb7d1f3f699218e0098629e932e1f Author: Ira Weiny Date: Sun Apr 9 10:17:24 2017 -0700 IB/hfi: Protect against writable mmap The device/port status is not intended to be changed from user space. Prevent a user from mapping them as write or execute. Reviewed-by: Dennis Dalessandro Signed-off-by: Ira Weiny Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/file_ops.c | 4 ++++ 1 file changed, 4 insertions(+) commit ee495ada5c5681e66c20e9927fa35252bdf7fba0 Author: Dennis Dalessandro Date: Sun Apr 9 10:17:18 2017 -0700 IB/hfi1: Fix unbalanced braces around else Add missing braces around else blocks in a few places to make checkpatch happy. Fixes: 7724105686e7 ("IB/hfi1: add driver files") Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/chip.c | 4 ++-- drivers/infiniband/hw/hfi1/init.c | 6 ++++-- 2 files changed, 6 insertions(+), 4 deletions(-) commit 08af5916b3b0ace9c97e5bf5d89122a0c7aa5c58 Author: Dennis Dalessandro Date: Sun Apr 9 10:17:12 2017 -0700 IB/hfi1: Convert %Lx to %llx According to checkpatch %Lx is not standard C so remove it and use the suggested %llx. Fixes: 7724105686e7 ("IB/hfi1: add driver files") Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/pcie.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a498fbcd8714e21b2c4016ddd04b62d4ac501b18 Author: Dennis Dalessandro Date: Sun Apr 9 10:17:06 2017 -0700 IB/hfi1: Fix misspelling in comment Checkpatch flagged a misspelled word. Fix it. Fixes: 8764522e5251 ("staging/rdma/hfi1: Unexpected link up pkey values are not an error") Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/chip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 53526500f301bfc2cde0cd6cf734ebce5020d6b7 Author: Neel Desai Date: Sun Apr 9 10:16:59 2017 -0700 IB/hfi1: Permanently enable P_Key checking in HFI Ingress and egress port P_Key checking should always be performed for HFIs. This patch will enable ingress and egress P_Key checking when the port is initialized and will ignore the P_Key information sent by the FM in the port info structure which is meant to be used only by the switch. Reviewed-by: Easwar Hariharan Reviewed-by: Dennis Dalessandro Signed-off-by: Neel Desai Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/init.c | 3 +++ drivers/infiniband/hw/hfi1/mad.c | 10 ---------- 2 files changed, 3 insertions(+), 10 deletions(-) commit 98b9ee2002a836acacd34df8df92184b83049df3 Author: Stuart Summers Date: Sun Apr 9 10:16:53 2017 -0700 IB/hfi1: Cache neighbor secure data after link up Secure data is transferred across the link during verify cap. This includes Neighbor Guid, Type, and Port Number. This transfer is not guaranteed to complete until the 8051 firmware has completed processing of the state_complete frame. Move the consumption of this data from verify cap handling to link up handling to ensure the data is finalized. Additionally, do not notify the SM that the link is up until after this data is actually available. Reviewed-by: Ira Weiny Reviewed-by: Easwar Hariharan Reviewed-by: Mike Marciniszyn Signed-off-by: Stuart Summers Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/chip.c | 27 +-------------------------- drivers/infiniband/hw/hfi1/hfi.h | 11 ++++++++++- drivers/infiniband/hw/hfi1/intr.c | 27 ++++++++++++++++----------- 3 files changed, 27 insertions(+), 38 deletions(-) commit 03e80e9a5738a6a93b9120dc2f068d11283d65c9 Author: Neel Desai Date: Sun Apr 9 10:16:47 2017 -0700 IB/hfi1: Adjust high temperature warning for QSFP cable When we receive a QSFP_HIGH_TEMP_ALARM or QSFP_HIGH_TEMP_WARNING interrupt, print a "QSFP cable temperature too high" message. Reviewed-by: Easwar Hariharan Reviewed-by: Dennis Dalessandro Signed-off-by: Neel Desai Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/chip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 22546b741af8355cd2e16739b6af4a8f17081839 Author: Tadeusz Struk Date: Fri Apr 28 10:40:02 2017 -0700 IB/hfi1: Fix softlockup issue Soft lockups can occur because the mad processing on different CPUs acquire the spin lock dc8051_lock: [534552.835870] [] ? read_dev_port_cntr.isra.37+0x23/0x160 [hfi1] [534552.835880] [] read_dev_cntr+0x4f/0x60 [hfi1] [534552.835893] [] pma_get_opa_portstatus+0x64d/0x8c0 [hfi1] [534552.835904] [] hfi1_process_mad+0x48d/0x18c0 [hfi1] [534552.835908] [] ? __slab_free+0x81/0x2f0 [534552.835936] [] ? ib_mad_recv_done+0x21e/0xa30 [ib_core] [534552.835939] [] ? __kmalloc+0x1f3/0x240 [534552.835947] [] ib_mad_recv_done+0x2cb/0xa30 [ib_core] [534552.835955] [] __ib_process_cq+0x55/0xd0 [ib_core] [534552.835962] [] ib_cq_poll_work+0x20/0x60 [ib_core] [534552.835964] [] process_one_work+0x17b/0x470 [534552.835966] [] worker_thread+0x126/0x410 [534552.835969] [] ? rescuer_thread+0x460/0x460 [534552.835971] [] kthread+0xcf/0xe0 [534552.835974] [] ? kthread_create_on_node+0x140/0x140 [534552.835977] [] ret_from_fork+0x58/0x90 [534552.835980] [] ? kthread_create_on_node+0x140/0x140 This issue is made worse when the 8051 is busy and the reads take longer. Fix by using a non-spinning lock procure. Reviewed-by: Michael J. Ruhl Reviewed-by: Mike Marciszyn Signed-off-by: Tadeusz Struk Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/chip.c | 86 +++++++++++++++++++++++---------------- drivers/infiniband/hw/hfi1/hfi.h | 7 ++-- drivers/infiniband/hw/hfi1/init.c | 2 +- 3 files changed, 57 insertions(+), 38 deletions(-) commit b6eac931b9bb2bce4db7032c35b41e5e34ec22a5 Author: Mike Marciniszyn Date: Sun Apr 9 10:16:35 2017 -0700 IB/hfi1: Prevent kernel QP post send hard lockups The driver progress routines can call cond_resched() when a timeslice is exhausted and irqs are enabled. If the ULP had been holding a spin lock without disabling irqs and the post send directly called the progress routine, the cond_resched() could yield allowing another thread from the same ULP to deadlock on that same lock. Correct by replacing the current hfi1_do_send() calldown with a unique one for post send and adding an argument to hfi1_do_send() to indicate that the send engine is running in a thread. If the routine is not running in a thread, avoid calling cond_resched(). CC: # 4.7.x- Fixes: Commit 831464ce4b74 ("IB/hfi1: Don't call cond_resched in atomic mode when sending packets") Reviewed-by: Dennis Dalessandro Signed-off-by: Mike Marciniszyn Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/ruc.c | 26 ++++++++++++++++---------- drivers/infiniband/hw/hfi1/verbs.c | 4 ++-- drivers/infiniband/hw/hfi1/verbs.h | 6 ++++-- 3 files changed, 22 insertions(+), 14 deletions(-) commit 3d591099a0a2b45a50913130f0599ab838002fc3 Author: Don Hiatt Date: Sun Apr 9 10:16:28 2017 -0700 IB/hfi1: Use defines from common headers Move FECN and BECN related defines to common header files Reviewed-by: Dennis Dalessandro Signed-off-by: Don Hiatt Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/common.h | 6 ------ drivers/infiniband/hw/hfi1/driver.c | 8 ++++---- drivers/infiniband/hw/hfi1/hfi.h | 4 ++-- drivers/infiniband/hw/hfi1/rc.c | 2 +- drivers/infiniband/hw/hfi1/ruc.c | 2 +- drivers/infiniband/hw/hfi1/trace_ibhdrs.h | 8 ++++---- drivers/infiniband/hw/hfi1/ud.c | 2 +- include/rdma/ib_hdrs.h | 6 ++++++ 8 files changed, 19 insertions(+), 19 deletions(-) commit cb42705792d809b108c76f1c97665382dc89531e Author: Don Hiatt Date: Sun Apr 9 10:16:22 2017 -0700 IB/hfi1: Add functions to parse 9B headers These inline functions improve code readability by enabling callers to read specific fields from the header without knowledge of byte offsets. Reviewed-by: Dennis Dalessandro Signed-off-by: Don Hiatt Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/driver.c | 13 ++++---- drivers/infiniband/hw/hfi1/hfi.h | 3 +- drivers/infiniband/hw/hfi1/rc.c | 14 ++++----- drivers/infiniband/hw/hfi1/ruc.c | 24 +++++++-------- drivers/infiniband/hw/hfi1/trace.c | 5 ++-- drivers/infiniband/hw/hfi1/uc.c | 8 ++--- drivers/infiniband/hw/hfi1/ud.c | 14 ++++----- drivers/infiniband/hw/hfi1/verbs.c | 8 ++--- include/rdma/ib_hdrs.h | 60 +++++++++++++++++++++++++++++++++++++ 9 files changed, 102 insertions(+), 47 deletions(-) commit aad559c21d7b536444701cb798100d33ff027f70 Author: Dasaratharaman Chandramouli Date: Sun Apr 9 10:16:15 2017 -0700 IB/hfi1: Rename hdr2sc to hfi1_9B_get_sc5 The function really returned the 5-bit sc value from the header and rhf. hdr2sc didn't quite describe what it did. Reviewed-by: Dennis Dalessandro Reviewed-by: Don Hiatt Signed-off-by: Dasaratharaman Chandramouli Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/driver.c | 7 ++++--- drivers/infiniband/hw/hfi1/hfi.h | 2 +- drivers/infiniband/hw/hfi1/ud.c | 2 +- drivers/infiniband/hw/hfi1/verbs.c | 2 +- 4 files changed, 7 insertions(+), 6 deletions(-) commit 3ca4fbc84a17b5c4f6c675e60ec5d3470019a83a Author: Sebastian Sanchez Date: Sun Apr 9 10:16:09 2017 -0700 IB/hfi1: Return SC2VL mappings to FM with VL15 instead of ILLEGAL_VL VL15 in the SC2VL table is used to indicate an invalid SC for the FM, however, internally the driver remaps SCs from VL15 to ILLEGAL_VL to prevent error counts. This mapping confuses the FM when performing a sweep, making it return a table mismatch error. Have SMA convert ILLEGAL_VL to VL15 entries for the SC2VL table queries. Reviewed-by: Michael J. Ruhl Signed-off-by: Sebastian Sanchez Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/mad.c | 41 ++++++++++++++++++++++++---------------- 1 file changed, 25 insertions(+), 16 deletions(-) commit db730894f4f7e7afcaf31d17679ed58b4f781500 Author: Michael J. Ruhl Date: Sun Apr 9 10:16:03 2017 -0700 IB/hfi1: Validate the TID count before using it Improve the safety of the code by validating the user supplied tidcnt before use. Reviewed-by: Mitko Haralanov Reviewed-by: Dennis Dalessandro Signed-off-by: Michael J. Ruhl Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/user_exp_rcv.c | 3 +++ 1 file changed, 3 insertions(+) commit aad9ff97ddd774f03f5e055ade2b2d27a9c82ddb Author: Michael J. Ruhl Date: Sun Apr 9 10:15:57 2017 -0700 IB/rdmavt/hfi1/qib: Use the MGID and MLID for multicast addressing The Infiniband spec defines "A multicast address is defined by a MGID and a MLID" (section 10.5). The current code only uses the MGID for identifying multicast groups. Update the driver to be compliant with this definition. Reviewed-by: Ira Weiny Reviewed-by: Dasaratharaman Chandramouli Signed-off-by: Michael J. Ruhl Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/verbs.c | 2 +- drivers/infiniband/hw/qib/qib_verbs.c | 2 +- drivers/infiniband/sw/rdmavt/mcast.c | 61 +++++++++++++++++++++++++---------- include/rdma/rdma_vt.h | 3 +- include/rdma/rdmavt_qp.h | 7 +++- 5 files changed, 54 insertions(+), 21 deletions(-) commit 8561eae60ff9417a50fa1fb2b83ae950dc5c1e21 Author: Michael J. Ruhl Date: Sun Apr 9 10:15:51 2017 -0700 IB/core: For multicast functions, verify that LIDs are multicast LIDs The Infiniband spec defines "A multicast address is defined by a MGID and a MLID" (section 10.5). Currently the MLID value is not validated. Add check to verify that the MLID value is in the correct address range. Fixes: 0c33aeedb2cf ("[IB] Add checks to multicast attach and detach") Cc: stable@vger.kernel.org Reviewed-by: Ira Weiny Reviewed-by: Dasaratharaman Chandramouli Signed-off-by: Michael J. Ruhl Signed-off-by: Dennis Dalessandro Reviewed-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/core/verbs.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 72fb70f5a34e7d1b095671cb2a5ad665db7c2312 Author: Michael J. Ruhl Date: Sun Apr 9 10:15:44 2017 -0700 IB/hfi1: Correct MulticastMask/CollectiveMask info to SMA output The FM uses the values of MulticastMask and CollectiveMask to determine the number of bits for net masks. The current values of 0 and 0 are incorrect. The values should be 4 and 1. Updated the necessary code to reflect the specified values. Reviewed-by: Sebastian Sanchez Signed-off-by: Michael J. Ruhl Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/common.h | 9 +++++++++ drivers/infiniband/hw/hfi1/mad.c | 5 +++++ 2 files changed, 14 insertions(+) commit 20c7840a77ddcb2ed2fbd66e8197db2868495751 Author: Michael J. Ruhl Date: Sun Apr 9 10:15:32 2017 -0700 IB/core: If the MGID/MLID pair is not on the list return an error A list of MGID/MLID pairs is built when doing a multicast attach. When the multicast detach is called, the list is searched, and regardless of the search outcome, the driver detach is called. If an MGID/MLID pair is not on the list, driver detach should not be called, and an error should be returned. Calling the driver without removing an MGID/MLID pair from the list can leave the core and driver out of sync. Fixes: f4e401562c11 ("IB/uverbs: track multicast group membership for userspace QPs") Cc: stable@vger.kernel.org Reviewed-by: Ira Weiny Reviewed-by: Leon Romanovsky Signed-off-by: Michael J. Ruhl Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/core/uverbs_cmd.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) commit 2443c6cc92ed8d01f942d389f9d6aff5e00f99f0 Author: Geliang Tang Date: Sat Apr 22 09:34:51 2017 +0800 IB/qib: use setup_timer Use setup_timer() instead of init_timer() to simplify the code. Signed-off-by: Geliang Tang Signed-off-by: Doug Ledford drivers/infiniband/hw/qib/qib_iba6120.c | 10 ++++------ drivers/infiniband/hw/qib/qib_iba7220.c | 5 ++--- drivers/infiniband/hw/qib/qib_iba7322.c | 10 ++++------ drivers/infiniband/hw/qib/qib_init.c | 15 ++++++--------- 4 files changed, 16 insertions(+), 24 deletions(-) commit 79d9df5618d4dce3d7fefc88feb4b2e60897fd4a Author: Geliang Tang Date: Sat Apr 22 09:32:55 2017 +0800 IB/nes: use setup_timer Use setup_timer() instead of init_timer() to simplify the code. Signed-off-by: Geliang Tang Signed-off-by: Doug Ledford drivers/infiniband/hw/nes/nes_hw.c | 5 ++--- drivers/infiniband/hw/nes/nes_mgt.c | 5 ++--- drivers/infiniband/hw/nes/nes_verbs.c | 5 ++--- 3 files changed, 6 insertions(+), 9 deletions(-) commit 96ff2c11c5e8f22f88ecb2fd18e8c0546e3936ed Author: Geliang Tang Date: Sat Apr 22 09:32:54 2017 +0800 IB/i40iw: use setup_timer Use setup_timer() instead of init_timer() to simplify the code. Signed-off-by: Geliang Tang Signed-off-by: Doug Ledford drivers/infiniband/hw/i40iw/i40iw_cm.c | 5 ++--- drivers/infiniband/hw/i40iw/i40iw_utils.c | 10 ++++------ 2 files changed, 6 insertions(+), 9 deletions(-) commit 1e0729348fdc1f0ecb1838a66da5592f6a6647f2 Author: Leon Romanovsky Date: Sat Apr 22 17:28:52 2017 +0300 IB/nes: Fix incorrect type in assignment Fix mismatch between types, wqe_words are in le32 format, while opcode in CPU format. The following sparse warnings are helped to find it: drivers/infiniband/hw/nes/nes_hw.c:3058:24: warning: incorrect type in assignment (different base types) drivers/infiniband/hw/nes/nes_hw.c:3058:24: expected unsigned int [unsigned] [assigned] [usertype] opcode drivers/infiniband/hw/nes/nes_hw.c:3058:24: got restricted __le32 CC: Faisal Latif Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/hw/nes/nes_hw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 313e16d5afaf000bd3f7a80e328890f963a10366 Author: Leon Romanovsky Date: Sat Apr 22 17:28:51 2017 +0300 IB/usnic: Simplify the code to balance loc/unlock calls Simplify code in find_free_vf_and_create_qp_grp() to avoid sparse error regarding call to unlock in the block other than lock was called. drivers/infiniband/hw/usnic/usnic_ib_verbs.c:206:9: warning: context imbalance in 'find_free_vf_and_create_qp_grp' - different lock contexts for basic block CC: Christian Benvenuti Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/hw/usnic/usnic_ib_verbs.c | 45 ++++++++++++++-------------- 1 file changed, 23 insertions(+), 22 deletions(-) commit f5029e752b0d8e4de81f9dfb7752c04ae1eecc69 Author: Leon Romanovsky Date: Sat Apr 22 17:28:50 2017 +0300 Ib/usnic: Explicitly include usnic headers Sparse tool complains about undeclared symbols in usnic_ib_verbs.c and usnic_ib_sysfs.c This is caused by lack of direct include of appropriate usnic_ib_verbs.h and usnic_ib_sysfs.h, where all these functions were declared. Simple include eliminates 30 warnings similar to the below one: drivers/infiniband/hw/usnic/usnic_ib_sysfs.c:304:6: warning: symbol 'usnic_ib_sysfs_unregister_usdev' was not declared. Should it be static? CC: Christian Benvenuti Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/hw/usnic/usnic_ib_sysfs.c | 1 + drivers/infiniband/hw/usnic/usnic_ib_verbs.c | 1 + 2 files changed, 2 insertions(+) commit 218271adca2a3033d6ac9e3a71dcf81d5543afc6 Author: Leon Romanovsky Date: Sat Apr 22 17:28:49 2017 +0300 Ib/core: Mark local uverbs_std_types functions to be static Functions declared in uverbs_std_types.c are local to that file, but they lack static declarations. This produces a lot of sparse warnings, like the one below: drivers/infiniband/core/uverbs_std_types.c:41:5: warning: symbol 'uverbs_free_ah' was not declared. Should it be static? So mark them as static. CC: Matan Barak Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/core/uverbs_std_types.c | 48 +++++++++++++++--------------- 1 file changed, 24 insertions(+), 24 deletions(-) commit 9ef63f31ad0ba28c68c8367e5b1cbba720fec597 Author: Pan Bian Date: Sun Apr 23 17:09:11 2017 +0800 iw_cxgb4: check return value of alloc_skb Function alloc_skb() will return a NULL pointer when there is no enough memory. However, the return value of alloc_skb() is directly used without validation in function send_fw_pass_open_req(). This patches checks the return value of alloc_skb() against NULL. Signed-off-by: Pan Bian Signed-off-by: Doug Ledford drivers/infiniband/hw/cxgb4/cm.c | 2 ++ 1 file changed, 2 insertions(+) commit 27b0b83233ced9e6b7448875a40382f7384daccd Author: Colin Ian King Date: Mon Apr 24 10:26:42 2017 +0100 IB/rxe: fix typo: "algorithmi" -> "algorithm" trivial fix to typo in pr_err message Signed-off-by: Colin Ian King Signed-off-by: Doug Ledford drivers/infiniband/sw/rxe/rxe_verbs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bdebfccd0ea6fc00c5ea8c832401111958bd24cf Author: Trond Myklebust Date: Thu Apr 27 15:30:00 2017 -0400 pNFS: Ensure we check layout validity before marking it for return pnfs_error_mark_layout_for_return needs to check that the layout is valid before calling pnfs_set_plh_return_info(). Signed-off-by: Trond Myklebust fs/nfs/pnfs.c | 4 ++++ 1 file changed, 4 insertions(+) commit 88bd4f862943205183c2fc20bbba103c71e9990b Author: Olga Kornievskaia Date: Wed Apr 26 14:21:22 2017 -0400 NFS4.1 handle interrupted slot reuse from ERR_DELAY If the RPC slot was interrupted and server replied to the next operation on the "reused" slot with ERR_DELAY, don't clear out the "interrupted" flag until we properly recover. Signed-off-by: Olga Kornievskaia Signed-off-by: Trond Myklebust fs/nfs/nfs4proc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 4edabfd7d0f7d39eeda8ffac76d9e884c22951d9 Author: Pan Bian Date: Sun Apr 23 14:49:41 2017 +0800 NFSv4: check return value of xdr_inline_decode Function xdr_inline_decode() will return a NULL pointer if the input buffer does not have long enough buffer to decode nbytes of data. However, in function decode_op_map(), the return value of xdr_inline_decode() is not validated before it is used. This patch adds a check to the return value of xdr_inline_decode(). Signed-off-by: Pan Bian Signed-off-by: Trond Myklebust fs/nfs/nfs4xdr.c | 2 ++ 1 file changed, 2 insertions(+) commit 209aa2308365387bc03905b7b4bb36c52ea1e696 Author: Artem Savkov Date: Fri Apr 21 21:35:51 2017 +0200 nfs/filelayout: fix NULL pointer dereference in fl_pnfs_update_layout() Calling pnfs_put_lset on an IS_ERR pointer results in a NULL pointer dereference like the one below. At the same time the check of retvalue of filelayout_check_deviceid() sets lseg to error, but does not free it before that. [ 3000.636161] BUG: unable to handle kernel NULL pointer dereference at 000000000000003c [ 3000.636970] IP: pnfs_put_lseg+0x29/0x100 [nfsv4] [ 3000.637420] PGD 4f23b067 [ 3000.637421] PUD 4a0f4067 [ 3000.637679] PMD 0 [ 3000.637937] [ 3000.638287] Oops: 0000 [#1] SMP [ 3000.638591] Modules linked in: nfs_layout_nfsv41_files nfsv3 nfnetlink_queue nfnetlink_log nfnetlink bluetooth rfkill rpcsec_gss_krb5 nfsv4 nfs fscache binfmt_misc arc4 md4 nls_utf8 cifs ccm dns_resolver rpcrdma ib_isert iscsi_target_mod ib_iser rdma_cm iw_cm libiscsi scsi_transport_iscsi ib_srpt target_core_mod ib_srp scsi_transport_srp ib_ipoib ib_ucm ib_uverbs ib_umad ib_cm ib_core nls_koi8_u nls_cp932 ts_kmp nf_conntrack_ipv4 nf_defrag_ipv4 nf_conntrack crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcspkr virtio_balloon ppdev virtio_rng parport_pc i2c_piix4 parport acpi_cpufreq nfsd auth_rpcgss nfs_acl lockd grace sunrpc xfs libcrc32c ata_generic pata_acpi virtio_blk virtio_net cirrus drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops crc32c_intel ata_piix ttm libata drm serio_raw [ 3000.645245] i2c_core virtio_pci virtio_ring virtio floppy dm_mirror dm_region_hash dm_log dm_mod [last unloaded: xt_u32] [ 3000.646360] CPU: 1 PID: 26402 Comm: date Not tainted 4.11.0-rc7.1.el7.test.x86_64 #1 [ 3000.647092] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 3000.647638] task: ffff8800415ada00 task.stack: ffffc90000ff0000 [ 3000.648207] RIP: 0010:pnfs_put_lseg+0x29/0x100 [nfsv4] [ 3000.648696] RSP: 0018:ffffc90000ff39b8 EFLAGS: 00010246 [ 3000.649193] RAX: 0000000000000000 RBX: fffffffffffffff4 RCX: 00000000000d43be [ 3000.649859] RDX: 00000000000d43bd RSI: 0000000000000000 RDI: fffffffffffffff4 [ 3000.650530] RBP: ffffc90000ff39d8 R08: 000000000001e320 R09: ffffffffa05c35ce [ 3000.651203] R10: ffff88007fd1e320 R11: ffffea0001283d80 R12: 0000000001400040 [ 3000.651875] R13: ffff88004f77d9f0 R14: ffffc90000ff3cd8 R15: ffff8800417ade00 [ 3000.652546] FS: 00007fac4d5cd740(0000) GS:ffff88007fd00000(0000) knlGS:0000000000000000 [ 3000.653304] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3000.653849] CR2: 000000000000003c CR3: 000000004f080000 CR4: 00000000000406e0 [ 3000.654527] Call Trace: [ 3000.654771] fl_pnfs_update_layout.constprop.20+0x10c/0x150 [nfs_layout_nfsv41_files] [ 3000.655505] filelayout_pg_init_write+0x21d/0x270 [nfs_layout_nfsv41_files] [ 3000.656195] __nfs_pageio_add_request+0x11c/0x490 [nfs] [ 3000.656698] nfs_pageio_add_request+0xac/0x260 [nfs] [ 3000.657180] nfs_do_writepage+0x109/0x2e0 [nfs] [ 3000.657616] nfs_writepages_callback+0x16/0x30 [nfs] [ 3000.658096] write_cache_pages+0x26f/0x510 [ 3000.658495] ? nfs_do_writepage+0x2e0/0x2e0 [nfs] [ 3000.658946] ? _raw_spin_unlock_bh+0x1e/0x20 [ 3000.659357] ? wb_wakeup_delayed+0x5f/0x70 [ 3000.659748] ? __mark_inode_dirty+0x2eb/0x360 [ 3000.660170] nfs_writepages+0x84/0xd0 [nfs] [ 3000.660575] ? nfs_updatepage+0x571/0xb70 [nfs] [ 3000.661012] do_writepages+0x1e/0x30 [ 3000.661358] __filemap_fdatawrite_range+0xc6/0x100 [ 3000.661819] filemap_write_and_wait_range+0x41/0x90 [ 3000.662292] nfs_file_fsync+0x34/0x1f0 [nfs] [ 3000.662704] vfs_fsync_range+0x3d/0xb0 [ 3000.663065] vfs_fsync+0x1c/0x20 [ 3000.663385] nfs4_file_flush+0x57/0x80 [nfsv4] [ 3000.663813] filp_close+0x2f/0x70 [ 3000.664132] __close_fd+0x9a/0xc0 [ 3000.664453] SyS_close+0x23/0x50 [ 3000.664785] do_syscall_64+0x67/0x180 [ 3000.665162] entry_SYSCALL64_slow_path+0x25/0x25 [ 3000.665600] RIP: 0033:0x7fac4d0e1e90 [ 3000.665946] RSP: 002b:00007ffd54e90c88 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 3000.666679] RAX: ffffffffffffffda RBX: 00007fac4d3b5400 RCX: 00007fac4d0e1e90 [ 3000.667349] RDX: 0000000000000000 RSI: 00007fac4d5d9000 RDI: 0000000000000001 [ 3000.668031] RBP: 0000000000000000 R08: 00007fac4d3b6a00 R09: 00007fac4d5cd740 [ 3000.668709] R10: 00007ffd54e909e0 R11: 0000000000000246 R12: 0000000000000000 [ 3000.669385] R13: 00007fac4d3b5e80 R14: 0000000000000000 R15: 0000000000000000 [ 3000.670061] Code: 00 00 66 66 66 66 90 55 48 85 ff 48 89 e5 41 56 41 55 41 54 53 48 89 fb 0f 84 97 00 00 00 f6 05 16 8f bc ff 10 0f 85 a6 00 00 00 <4c> 8b 63 48 48 8d 7b 38 49 8b 84 24 90 00 00 00 4c 8d a8 88 00 [ 3000.671831] RIP: pnfs_put_lseg+0x29/0x100 [nfsv4] RSP: ffffc90000ff39b8 [ 3000.672462] CR2: 000000000000003c Signed-off-by: Artem Savkov Signed-off-by: Trond Myklebust fs/nfs/filelayout/filelayout.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit f0bb2d44ca26b7090dc7bade8877b77005f07dfc Author: Dan Carpenter Date: Thu Apr 27 12:14:20 2017 +0300 IB/rdmavt: restore IRQs on error path in rvt_create_ah() We need to call spin_unlock_irqrestore() instead of vanilla spin_unlock() on this error path. Fixes: 119a8e708d16 ("IB/rdmavt: Add AH to rdmavt") Signed-off-by: Dan Carpenter Reviewed-by: Leon Romanovsky Acked-by: Dennis Dalessandro Signed-off-by: Doug Ledford drivers/infiniband/sw/rdmavt/ah.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit eea40b8f624f25cbc02d55f2d93203f60cee9341 Author: Paolo Abeni Date: Fri Apr 28 11:20:01 2017 +0200 infiniband: call ipv6 route lookup via the stub interface The infiniband address handle can be triggered to resolve an ipv6 address in response to MAD packets, regardless of the ipv6 module being disabled via the kernel command line argument. That will cause a call into the ipv6 routing code, which is not initialized, and a conseguent oops. This commit addresses the above issue replacing the direct lookup call with an indirect one via the ipv6 stub, which is properly initialized according to the ipv6 status (e.g. if ipv6 is disabled, the routing lookup fails gracefully) Cc: stable@vger.kernel.org # 3.12+ Signed-off-by: Paolo Abeni Signed-off-by: Doug Ledford drivers/infiniband/core/addr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit b6acd71fefc92d13ac9a0f117101d1aab1102d18 Author: Amrani, Ram Date: Thu Apr 27 13:35:35 2017 +0300 RDMA/qedr: add support for send+invalidate in poll CQ Split the poll responder CQ into two functions. Add support for send+invalidate in poll CQ. Signed-off-by: Ram Amrani Signed-off-by: Doug Ledford drivers/infiniband/hw/qedr/qedr.h | 3 +- drivers/infiniband/hw/qedr/verbs.c | 98 ++++++++++++++++++++++++-------------- 2 files changed, 63 insertions(+), 38 deletions(-) commit 4dd72636c9e5a17b0d788ab1d8cc10ae25c69ea3 Author: Amrani, Ram Date: Thu Apr 27 13:35:34 2017 +0300 RDMA/qedr: destroy CQ only after HW releases it Wait for all relevant CNQ interrupts before freeing the CQ. Don't invoke completion handlers for a destroyed CQ. Signed-off-by: Ram Amrani Signed-off-by: Doug Ledford drivers/infiniband/hw/qedr/main.c | 11 +++++-- drivers/infiniband/hw/qedr/qedr.h | 2 ++ drivers/infiniband/hw/qedr/verbs.c | 64 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 75 insertions(+), 2 deletions(-) commit 942b3b2c41196a24283dea3d87c83d2c4da99874 Author: Amrani, Ram Date: Thu Apr 27 13:35:33 2017 +0300 RDMA/qedr: enhance destroy flow for GSI QP Avoid attempting to release irrelevant (and unused) resources for GSI QP. Signed-off-by: Ram Amrani Signed-off-by: Doug Ledford drivers/infiniband/hw/qedr/verbs.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) commit f92faaba11d862ad91139486db24f801aeabd68c Author: Amrani, Ram Date: Thu Apr 27 13:35:32 2017 +0300 RDMA/qedr: properly check atomic capabilities After checking the path upwards towards root complex, actualy check root complex atomic_req capability, and not our own NIC. Verify that the PCIe device control register's atomic egress block is cleared in the path. Verify that the PCIe version is at least 2. Signed-off-by: Ram Amrani Signed-off-by: Doug Ledford drivers/infiniband/hw/qedr/main.c | 77 +++++++++++++++++++++++---------------- include/uapi/linux/pci_regs.h | 1 + 2 files changed, 47 insertions(+), 31 deletions(-) commit 08c4cf51e30f0a6977fa4be8d97f3e34d7fede0b Author: Amrani, Ram Date: Thu Apr 27 13:35:31 2017 +0300 RDMA/qedr: reset access control when registering a MR Signed-off-by: Ram Amrani Signed-off-by: Doug Ledford drivers/infiniband/hw/qedr/verbs.c | 2 ++ 1 file changed, 2 insertions(+) commit 2f9a0bec659700554744338bf780841f641cec40 Author: Geert Uytterhoeven Date: Thu Apr 27 14:33:05 2017 +0200 arm64: Print DT machine model in setup_machine_fdt() On arm32, the machine model specified in the device tree is printed during boot-up, courtesy of of_flat_dt_match_machine(). On arm64, of_flat_dt_match_machine() is not called, and the machine model information is not available from the kernel log. Print the machine model to make it easier to derive the machine model from an arbitrary kernel boot log. Acked-by: Will Deacon Signed-off-by: Geert Uytterhoeven Signed-off-by: Catalin Marinas arch/arm64/kernel/setup.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit 11270059e8d0b6f80801fac910c4ef751ca05c4c Author: Horia Geantă Date: Fri Apr 28 17:38:58 2017 +0300 staging: fsl-mc/dpio: add cpu <--> LE conversion for dpaa2_fd While dpaa2_fd.simple structure fields are marked __leXX, corresponding cpu_to_leXX / leXX_to_cpu conversions are missing. While here, fix dpaa2_fd_{get,set}_bpid such that BMT, IVP bits sharing the 16-bit field with BPID are not affected. Fixes: d3269bdc7ebc ("bus: fsl-mc: dpio: add frame descriptor and scatter/gather APIs") Signed-off-by: Horia Geantă Signed-off-by: Greg Kroah-Hartman drivers/staging/fsl-mc/include/dpaa2-fd.h | 45 ++++++++++++++++--------------- 1 file changed, 24 insertions(+), 21 deletions(-) commit ec4d9227d79a6f0d1cedbbb8f023c92779c16551 Author: Ilia Sergachev Date: Fri Apr 28 17:30:55 2017 +0200 staging: ks7010: remove line continuations in quoted strings Checkpatch emits WARNING: Avoid line continuations in quoted strings. Remove line continuations - split strings using quotes. Signed-off-by: Ilia Sergachev Signed-off-by: Greg Kroah-Hartman drivers/staging/ks7010/ks_hostif.c | 30 ++++++++++++++++++++++++------ 1 file changed, 24 insertions(+), 6 deletions(-) commit 3146c8f4de9b0858794a902f273aec13f168596e Merge: ef1b5da a5f40e8 Author: Bjorn Helgaas Date: Fri Apr 28 10:38:13 2017 -0500 Merge branch 'pci/remove' into next * pci/remove: PCI: Don't allow unbinding host controllers that aren't prepared commit a5f40e8098fe6d983fdb3beb7b50a8067c136141 Author: Brian Norris Date: Thu Apr 20 15:36:25 2017 -0500 PCI: Don't allow unbinding host controllers that aren't prepared Many PCI host controller drivers aren't prepared to have their devices unbound from them forcefully (e.g., through /sys/...//unbind), as they don't provide any driver .remove callback, where they'd detach the root bus, release resources, etc. Keeping the driver built in (i.e., not a loadable module) is not enough; and providing no .remove callback just means we don't do any teardown. To rule out the possibility of unbinding a device via sysfs, we need to set the ".suppress_bind_attrs" field. I found the suspect drivers via the following search: git grep -l platform_driver $(git grep -L -e '\.remove' -e suppress_bind_attrs drivers/pci/) Then I inspected them to ensure that (a) they set up a PCI bus in their probe() and (b) they don't have a remove() callback for undoing the setup Suggested-by: Bjorn Helgaas Signed-off-by: Brian Norris Signed-off-by: Bjorn Helgaas drivers/pci/dwc/pci-imx6.c | 1 + drivers/pci/dwc/pci-layerscape.c | 1 + drivers/pci/dwc/pcie-armada8k.c | 1 + drivers/pci/dwc/pcie-artpec6.c | 1 + drivers/pci/dwc/pcie-designware-plat.c | 1 + drivers/pci/dwc/pcie-hisi.c | 2 ++ drivers/pci/dwc/pcie-spear13xx.c | 1 + drivers/pci/host/pci-ftpci100.c | 1 + drivers/pci/host/pci-host-generic.c | 1 + drivers/pci/host/pci-thunder-ecam.c | 1 + drivers/pci/host/pci-thunder-pem.c | 1 + drivers/pci/host/pci-versatile.c | 1 + drivers/pci/host/pci-xgene.c | 1 + 13 files changed, 14 insertions(+) commit ef1b5dad5a386885998d11eb45ca7fd183079965 Merge: 889e4dd 63af8f7 Author: Bjorn Helgaas Date: Fri Apr 28 10:36:12 2017 -0500 Merge branch 'pci/virtualization' into next * pci/virtualization: ixgbe: Use pcie_flr() instead of duplicating it IB/hfi1: Use pcie_flr() instead of duplicating it PCI: Call pcie_flr() from reset_chelsio_generic_dev() PCI: Call pcie_flr() from reset_intel_82599_sfp_virtfn() PCI: Export pcie_flr() PCI: Add sysfs sriov_drivers_autoprobe to control VF driver binding PCI: Avoid FLR for Intel 82579 NICs Conflicts: include/linux/pci.h commit 889e4dd916a1f4dc7f9e6220fed26d811e39ca71 Merge: 78f0983 d9c102d Author: Bjorn Helgaas Date: Fri Apr 28 10:34:34 2017 -0500 Merge branch 'pci/resource-mmap' into next * pci/resource-mmap: ia64: Use generic pci_mmap_resource_range() ia64: Remove redundant checks for WC in pci_mmap_page_range() ia64: Remove redundant valid_mmap_phys_addr_range() from pci_mmap_page_range() PCI: Add I/O BAR support to generic pci_mmap_resource_range() x86/PCI: Use generic pci_mmap_resource_range() unicore32/PCI: Use generic pci_mmap_resource_range() sh/PCI: Use generic pci_mmap_resource_range() parisc: Use generic pci_mmap_resource_range() mn10300/PCI: Use generic pci_mmap_resource_range() MIPS: PCI: Use generic pci_mmap_resource_range() cris/PCI: Use generic pci_mmap_resource_range() ARM/PCI: Use generic pci_mmap_resource_range() PCI: Add pci_mmap_resource_range() and use it for ARM64 PCI: Add BAR index argument to pci_mmap_page_range() PCI: Use BAR index in sysfs attr->private instead of resource pointer PCI: Add arch_can_pci_mmap_io() on architectures which can mmap() I/O space PCI: Move multiple declarations of pci_mmap_page_range() to PCI: Add arch_can_pci_mmap_wc() macro xtensa/PCI: Do not mmap PCI BARs to userspace as write-through PCI: Only allow WC mmap on prefetchable resources PCI: Fix another sanity check bug in /proc/pci mmap PCI: Fix pci_mmap_fits() for HAVE_PCI_RESOURCE_TO_USER platforms commit 78f098383a7abb1eb9dfd45346773fe80a65f05a Merge: acc886e e3adec7 Author: Bjorn Helgaas Date: Fri Apr 28 10:34:29 2017 -0500 Merge branch 'pci/resource' into next * pci/resource: PCI: Don't resize resources when realigning all devices in system PCI: Don't reassign resources that are already aligned PCI: Factor pci_reassigndev_resource_alignment() powerpc/powernv: Override pcibios_default_alignment() to force PCI devices to be page aligned PCI: Add pcibios_default_alignment() for arch-specific alignment control PCI: Fix calculation of bridge window's size and alignment PCI: Ignore requested alignment for IOV BARs PCI: Make PCI_ROM_ADDRESS_MASK a 32-bit constant commit acc886ec934980a45ae8962dbe88e221a40c77a2 Merge: c6a7a77 ea00353 Author: Bjorn Helgaas Date: Fri Apr 28 10:34:24 2017 -0500 Merge branch 'pci/pm' into next * pci/pm: PCI: Freeze PME scan before suspending devices PCI/PM: Don't sleep at all when d3_delay or d3cold_delay is zero commit c6a7a77cc4e62a2d9011f282ba69ffcafa7efdcc Merge: 94f543b 4bb6669 Author: Bjorn Helgaas Date: Fri Apr 28 10:34:19 2017 -0500 Merge branch 'pci/msi' into next * pci/msi: PCI/MSI: Use dev_printk() when possible of/pci: Remove unused MSI controller helpers PCI: mvebu: Remove useless MSI enabling code PCI: aardvark: Move to MSI handling using generic MSI support PCI/MSI: Make pci_msi_shutdown() and pci_msix_shutdown() static PCI/MSI: Stop disabling MSI/MSI-X in pci_device_shutdown() commit 94f543b276e99ca311903f1b9fac2db6d1f020d7 Merge: 13108c6 de5bbdd Author: Bjorn Helgaas Date: Fri Apr 28 10:34:14 2017 -0500 Merge branch 'pci/misc' into next * pci/misc: PCI: Change pci_host_common_probe() visibility PCI: Fix typo pci_cfg_access_lock() comment PCI: Include pci.h for struct pci_ops definition commit 13108c625b1db803b7b24702360a735fd764622f Merge: 0b0ee66 c4e649b Author: Bjorn Helgaas Date: Fri Apr 28 10:34:10 2017 -0500 Merge branch 'pci/irq' into next * pci/irq: PCI: Disable boot interrupt quirk for ASUS M2N-LR nvme/pci: Switch to pci_request_irq() PCI/irq: Add pci_request_irq() and pci_free_irq() helpers genirq: Return the IRQ name from free_irq() genirq: Fix indentation in remove_irq() commit 0b0ee66c4f4debaaf2f07662ad20a6e89b568c1e Merge: 27e9967 bc636ee Author: Bjorn Helgaas Date: Fri Apr 28 10:34:05 2017 -0500 Merge branch 'pci/ioremap' into next * pci/ioremap: PCI: versatile: Update PCI config space remap function PCI: keystone-dw: Update PCI config space remap function PCI: layerscape: Update PCI config space remap function PCI: hisi: Update PCI config space remap function PCI: tegra: Update PCI config space remap function PCI: xgene: Update PCI config space remap function PCI: armada8k: Update PCI config space remap function PCI: designware: Update PCI config space remap function PCI: iproc-platform: Update PCI config space remap function PCI: qcom: Update PCI config space remap function PCI: rockchip: Update PCI config space remap function PCI: spear13xx: Update PCI config space remap function PCI: xilinx-nwl: Update PCI config space remap function PCI: xilinx: Update PCI config space remap function PCI: ECAM: Map config region with pci_remap_cfgspace() PCI: Implement devm_pci_remap_cfgspace() devres: fix devm_ioremap_*() offset parameter kerneldoc description ARM: Implement pci_remap_cfgspace() interface ARM64: Implement pci_remap_cfgspace() interface linux/io.h: Add pci_remap_cfgspace() interface PCI: Remove __weak tag from pci_remap_iospace() commit 27e99676f0f15692d2b70efb8e697d9cf7091362 Merge: f503ee4 fce5d57 Author: Bjorn Helgaas Date: Fri Apr 28 10:34:00 2017 -0500 Merge branch 'pci/iommu' into next * pci/iommu: PCI: Add bridge DMA alias quirk for ITE 8893 bridge commit f503ee4cbef9c5459d9e176542e4d0e0ed3915f6 Merge: d060c6f 9b70ae4 Author: Bjorn Helgaas Date: Fri Apr 28 10:33:55 2017 -0500 Merge branch 'pci/enumeration' into next * pci/enumeration: PCI: Include PCI-to-PCIe bridges as "Downstream Ports" PCI: Improve __pci_read_base() robustness PCI: Short-circuit pci_device_is_present() for disconnected devices PCI/MSI: Skip disabling disconnected devices PCI: Don't attempt config access to disconnected devices PCI: Add device disconnected state PCI: Export PCI device config accessors commit d060c6fcef972e6a8d0898c55f1b7b6da89a6744 Merge: 1154768 52eabba Author: Bjorn Helgaas Date: Fri Apr 28 10:33:41 2017 -0500 Merge branch 'pci/switchtec' into next * pci/switchtec: switchtec: Add IOCTLs to the Switchtec driver switchtec: Add sysfs attributes to the Switchtec driver switchtec: Add user interface documentation MicroSemi Switchtec management interface driver Conflicts: drivers/pci/Kconfig commit 1154768ad342cc3ad295340130c1fad6869effa9 Merge: 9577367 cd18374 Author: Bjorn Helgaas Date: Fri Apr 28 10:33:15 2017 -0500 Merge branch 'pci/host-thunder' into next * pci/host-thunder: PCI/ACPI: Add ThunderX pass2.x 2nd node MCFG quirk PCI/ACPI: Tidy up MCFG quirk whitespace PCI: Avoid generating invalid ThunderX2 DMA aliases PCI: Add device flag PCI_DEV_FLAGS_BRIDGE_XLATE_ROOT PCI: Apply Cavium ACS quirk only to CN81xx/CN83xx/CN88xx devices commit 95773672830d49ed6202bfa47cbb752823c96593 Merge: 443b1b0 b0308c5 Author: Bjorn Helgaas Date: Fri Apr 28 10:33:10 2017 -0500 Merge branch 'pci/host-rockchip' into next * pci/host-rockchip: PCI: rockchip: Modularize PCI: Export pci_remap_iospace() and pci_unmap_iospace() PCI: rockchip: Add remove() support PCI: rockchip: Set PCI_EXP_LNKSTA_SLC in the Root Port PCI: rockchip: Advertise 128-byte Read Completion Boundary support PCI: rockchip: Make 'return 0' more obvious in probe() PCI: rockchip: Unindent rockchip_pcie_set_power_limit() PCI: rockchip: Handle regulator_get_current_limit() failure correctly commit 443b1b06717275a10f4b36fb6330c85b7f37281f Merge: 24c53a6 b8e82c1 Author: Bjorn Helgaas Date: Fri Apr 28 10:33:05 2017 -0500 Merge branch 'pci/host-mvebu' into next * pci/host-mvebu: PCI: mvebu: Avoid changing the SCC bit in the Link Status register commit 24c53a66bd687a186f55f0845c08a6d073864798 Merge: 7284a62 e584b06c Author: Bjorn Helgaas Date: Fri Apr 28 10:33:00 2017 -0500 Merge branch 'pci/host-iproc' into next * pci/host-iproc: PCI: iproc: Add PCI_DOMAIN dependency to PCI Kconfig commit 7284a62dfd7066919bf9a7318f6dbc7b51a092db Merge: 4940421 7221547 Author: Bjorn Helgaas Date: Fri Apr 28 10:32:54 2017 -0500 Merge branch 'pci/host-imx6' into next * pci/host-imx6: PCI: imx6: Fix spelling mistake: "contol" -> "control" PCI: imx6: Do not switch speed if Gen2 is disabled PCI: imx6: Do not wait for speed change on i.MX7 PCI: imx6: Allow probe deferral by reset GPIO PCI: imx6: Add code to support i.MX7D commit 4940421013672aafdc8c372c17b5ddf63423c805 Merge: 66aa51c 24196f0 Author: Bjorn Helgaas Date: Fri Apr 28 10:32:50 2017 -0500 Merge branch 'pci/host-hv' into next * pci/host-hv: PCI: hv: Convert hv_pci_dev.refs from atomic_t to refcount_t PCI: hv: Allocate interrupt descriptors with GFP_ATOMIC PCI: hv: Specify CPU_AFFINITY_ALL for MSI affinity when >= 32 CPUs PCI: hv: Lock PCI bus on device eject PCI: hv: Properly handle PCI bus remove commit 66aa51ce8bbf285a9dc58ac2abbf2ec6a8a91a5c Merge: 9b2707c d3c68e0 Author: Bjorn Helgaas Date: Fri Apr 28 10:32:44 2017 -0500 Merge branch 'pci/host-faraday' into next * pci/host-faraday: PCI: faraday: Add Faraday Technology FTPCI100 PCI Host Bridge driver PCI: Add DT bindings for Faraday Technology PCI Host Bridge commit 9b2707ca56f98d1184857384ebecd23e1f06c807 Merge: c1ae3cf 2c949ce Author: Bjorn Helgaas Date: Fri Apr 28 10:32:33 2017 -0500 Merge branch 'pci/host-designware' into next * pci/host-designware: ARM: DRA7: clockdomain: Change the CLKTRCTRL of CM_PCIE_CLKSTCTRL to SW_WKUP MAINTAINERS: Add PCI Endpoint maintainer Documentation: PCI: Add userguide for PCI endpoint test function tools: PCI: Add sample test script to invoke pcitest tools: PCI: Add a userspace tool to test PCI endpoint Documentation: misc-devices: Add Documentation for pci-endpoint-test driver misc: Add host side PCI driver for PCI test function device PCI: Add device IDs for DRA74x and DRA72x dt-bindings: PCI: dra7xx: Add DT bindings to enable unaligned access PCI: dwc: dra7xx: Workaround for errata id i870 dt-bindings: PCI: dra7xx: Add DT bindings for PCI dra7xx EP mode PCI: dwc: dra7xx: Add EP mode support PCI: dwc: dra7xx: Facilitate wrapper and MSI interrupts to be enabled independently dt-bindings: PCI: Add DT bindings for PCI designware EP mode PCI: dwc: designware: Add EP mode support Documentation: PCI: Add binding documentation for pci-test endpoint function PCI: endpoint: functions: Add an EP function to test PCI Documentation: PCI: Add specification for the *PCI test* function device PCI: endpoint: Create configfs entry for EPC device and EPF driver Documentation: PCI: Guide to use PCI endpoint configfs PCI: endpoint: Introduce configfs entry for configuring EP functions Documentation: PCI: Guide to use PCI Endpoint Core Layer PCI: endpoint: Add EP core layer to enable EP controller and EP functions PCI: dwc: dra7xx: Push request_irq() call to the bottom of probe PCI: dwc: designware: Move _unroll configurations to a separate function PCI: dwc: all: Modify dbi accessors to access data of 4/2/1 bytes PCI: dwc: all: Modify dbi accessors to take dbi_base as argument PCI: dwc: artpec6: Populate cpu_addr_fixup ops PCI: dwc: dra7xx: Populate cpu_addr_fixup ops PCI: dwc: designware: Add new *ops* for CPU addr fixup PCI: dwc: Fix uninitialized variable in dw_handle_msi_irq() PCI: dwc: Unindent dw_handle_msi_irq() loop PCI: dwc: Fix dw_pcie_ops NULL pointer dereference PCI: dwc: Select PCI_HOST_COMMON for hisi PCI: thunder-pem: Fix legacy firmware PEM-specific resources PCI: thunder-pem: Add legacy firmware support for Cavium ThunderX host controller PCI: thunder-pem: Use Cavium assigned hardware ID for ThunderX host controller PCI: iproc: Save host bridge window resource in struct iproc_pcie PCI/ASPM: Always set link->downstream to avoid NULL dereference on remove PCI: Prevent VPD access for QLogic ISP2722 PCI: exynos: Initialize elbi_base even when using PHY framework commit 2c949ce38f4e81d7487f165fa3b8f77d74a2a6c4 Author: Kishon Vijay Abraham I Date: Mon Mar 27 15:15:20 2017 +0530 ARM: DRA7: clockdomain: Change the CLKTRCTRL of CM_PCIE_CLKSTCTRL to SW_WKUP The PCIe programming sequence in TRM suggests CLKSTCTRL of PCIe should be set to SW_WKUP. There are no issues when CLKSTCTRL is set to HW_AUTO in RC mode. However in EP mode, the host system is not able to access the MEMSPACE and setting the CLKSTCTRL to SW_WKUP fixes it. Acked-by: Tony Lindgren Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Bjorn Helgaas arch/arm/mach-omap2/clockdomains7xx_data.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f60b15b831b01973c71b54e82a258376f7593427 Author: Kishon Vijay Abraham I Date: Mon Mar 27 15:15:19 2017 +0530 MAINTAINERS: Add PCI Endpoint maintainer Add maintainer for the newly introduced PCI Endpoint framework. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Bjorn Helgaas MAINTAINERS | 9 +++++++++ 1 file changed, 9 insertions(+) commit 16263d9e1dedb30ddca51d684f306cdc4294e705 Author: Kishon Vijay Abraham I Date: Mon Mar 27 15:15:18 2017 +0530 Documentation: PCI: Add userguide for PCI endpoint test function Add documentation to help users use pci-epf-test function driver and pci_endpoint_test host driver for testing PCI. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Bjorn Helgaas Documentation/PCI/00-INDEX | 2 + Documentation/PCI/endpoint/pci-test-howto.txt | 179 ++++++++++++++++++++++++++ 2 files changed, 181 insertions(+) commit 62cb0eff82d8c64b79d3cf46a995306551beeaf3 Author: Kishon Vijay Abraham I Date: Mon Mar 27 15:15:17 2017 +0530 tools: PCI: Add sample test script to invoke pcitest Add a simple test script that invokes the pcitest userspace tool to perform all the PCI endpoint tests (BAR tests, interrupt tests, read tests, write tests and copy tests). Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Bjorn Helgaas tools/pci/pcitest.sh | 56 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) commit 3f2ed813483452e3f8de56ec40c97c432c16dbf1 Author: Kishon Vijay Abraham I Date: Mon Mar 27 15:15:16 2017 +0530 tools: PCI: Add a userspace tool to test PCI endpoint Add a userspace tool to invoke the ioctls exposed by the PCI endpoint test driver to perform various PCI tests. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Bjorn Helgaas tools/pci/pcitest.c | 186 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 186 insertions(+) commit 0cfb512e4acc7049d36478221f55bf6053bd81a6 Author: Kishon Vijay Abraham I Date: Mon Mar 27 15:15:15 2017 +0530 Documentation: misc-devices: Add Documentation for pci-endpoint-test driver Add Documentation for pci-endpoint-test driver. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Bjorn Helgaas Documentation/misc-devices/pci-endpoint-test.txt | 35 ++++++++++++++++++++++++ 1 file changed, 35 insertions(+) commit 2c156ac71c6b2518f3d589190f2a8872a8764faf Author: Kishon Vijay Abraham I Date: Mon Mar 27 15:15:14 2017 +0530 misc: Add host side PCI driver for PCI test function device Add PCI endpoint test driver that can verify base address register, legacy interrupt/MSI interrupt and read/write/copy buffers between host and device. The corresponding pci-epf-test function driver should be used on the EP side. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Bjorn Helgaas drivers/misc/Kconfig | 7 + drivers/misc/Makefile | 1 + drivers/misc/pci_endpoint_test.c | 534 +++++++++++++++++++++++++++++++++++++++ include/uapi/linux/Kbuild | 1 + include/uapi/linux/pcitest.h | 19 ++ 5 files changed, 562 insertions(+) commit 984c307878f8924d743c419c79fdebbc19f1285e Author: Kishon Vijay Abraham I Date: Mon Mar 27 15:15:13 2017 +0530 PCI: Add device IDs for DRA74x and DRA72x Add device IDs for DRA74x and DRA72x devices. These devices have configurable PCI endpoint. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Bjorn Helgaas include/linux/pci_ids.h | 2 ++ 1 file changed, 2 insertions(+) commit 66abca1d9db24e9e0b0d031d9b246e440e26fdae Author: Kishon Vijay Abraham I Date: Mon Mar 27 15:15:12 2017 +0530 dt-bindings: PCI: dra7xx: Add DT bindings to enable unaligned access Update device tree binding documentation of TI's dra7xx PCI controller to include property for enabling unaligned mem access. Signed-off-by: Kishon Vijay Abraham I Acked-by: Rob Herring Signed-off-by: Bjorn Helgaas Documentation/devicetree/bindings/pci/ti-pci.txt | 5 +++++ 1 file changed, 5 insertions(+) commit f7a2757f6cd0aa4e1075188a3a0081a583fcee24 Author: Kishon Vijay Abraham I Date: Mon Mar 27 15:15:11 2017 +0530 PCI: dwc: dra7xx: Workaround for errata id i870 According to errata i870, access to the PCIe slave port that are not 32-bit aligned will result in incorrect mapping to TLP Address and Byte enable fields. Accessing non 32-bit aligned data causes incorrect data in the target buffer if memcpy is used. Implement the workaround for this errata here. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Bjorn Helgaas drivers/pci/dwc/pci-dra7xx.c | 49 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) commit 40cc72e2b51f61956f965510ceba35bddb0c373f Author: Kishon Vijay Abraham I Date: Mon Mar 27 15:15:09 2017 +0530 dt-bindings: PCI: dra7xx: Add DT bindings for PCI dra7xx EP mode Add device tree binding documentation for PCI dra7xx EP mode. Acked-by: Rob Herring Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Bjorn Helgaas Documentation/devicetree/bindings/pci/ti-pci.txt | 37 +++++++++++++++++++----- 1 file changed, 30 insertions(+), 7 deletions(-) commit 608793e27b3313b2385af557c95d8e4207126670 Author: Kishon Vijay Abraham I Date: Mon Mar 27 15:15:08 2017 +0530 PCI: dwc: dra7xx: Add EP mode support The PCIe controller integrated in dra7xx SoCs is capable of operating in endpoint mode. Add endpoint mode support to dra7xx driver. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Bjorn Helgaas drivers/pci/dwc/Kconfig | 31 +++++- drivers/pci/dwc/Makefile | 4 +- drivers/pci/dwc/pci-dra7xx.c | 197 +++++++++++++++++++++++++++++++++++--- drivers/pci/dwc/pcie-designware.h | 7 ++ 4 files changed, 221 insertions(+), 18 deletions(-) commit 5ffd90a035a273068a8bbef74a01ae923b80110b Author: Kishon Vijay Abraham I Date: Mon Mar 27 15:15:07 2017 +0530 PCI: dwc: dra7xx: Facilitate wrapper and MSI interrupts to be enabled independently No functional change. Split dra7xx_pcie_enable_interrupts() into dra7xx_pcie_enable_wrapper_interrupts() and dra7xx_pcie_enable_msi_interrupts() so that wrapper interrupts and MSI interrupts can be enabled independently. This is in preparation for adding EP mode support to dra7xx driver since EP mode doesn't have to enable msi_interrupts. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Bjorn Helgaas drivers/pci/dwc/pci-dra7xx.c | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) commit b12befecd7de905a05053eb6a266e3b97528c6d4 Author: Kishon Vijay Abraham I Date: Mon Mar 27 15:15:06 2017 +0530 dt-bindings: PCI: Add DT bindings for PCI designware EP mode Add device tree binding documentation for PCI designware EP mode. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Bjorn Helgaas Acked-by: Rob Herring .../devicetree/bindings/pci/designware-pcie.txt | 26 +++++++++++++++------- 1 file changed, 18 insertions(+), 8 deletions(-) commit f8aed6ec624fb436877a1a552393fd22510a5ff7 Author: Kishon Vijay Abraham I Date: Mon Mar 27 15:15:05 2017 +0530 PCI: dwc: designware: Add EP mode support Add endpoint mode support to designware driver. This uses the EP Core layer introduced recently to add endpoint mode support. *Any* function driver can now use this designware device in order to achieve the EP functionality. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Bjorn Helgaas drivers/pci/dwc/Kconfig | 5 + drivers/pci/dwc/Makefile | 1 + drivers/pci/dwc/pcie-designware-ep.c | 342 +++++++++++++++++++++++++++++++++++ drivers/pci/dwc/pcie-designware.c | 125 +++++++++++++ drivers/pci/dwc/pcie-designware.h | 105 +++++++++++ 5 files changed, 578 insertions(+) commit 13570533813cf111bb49954392cca0c2c409e775 Author: Kishon Vijay Abraham I Date: Mon Mar 27 15:15:04 2017 +0530 Documentation: PCI: Add binding documentation for pci-test endpoint function Add binding documentation for pci-test endpoint function that helps in adding and configuring pci-test endpoint function. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Bjorn Helgaas Documentation/PCI/00-INDEX | 2 ++ .../PCI/endpoint/function/binding/pci-test.txt | 17 +++++++++++++++++ 2 files changed, 19 insertions(+) commit e20c8a517f259cb4d258e10b0cd5d4b30d4167a0 Author: Brian Foster Date: Wed Apr 26 08:30:40 2017 -0700 xfs: wait on new inodes during quotaoff dquot release The quotaoff operation has a race with inode allocation that results in a livelock. An inode allocation that occurs before the quota status flags are updated acquires the appropriate dquots for the inode via xfs_qm_vop_dqalloc(). It then inserts the XFS_INEW inode into the perag radix tree, sometime later attaches the dquots to the inode and finally clears the XFS_INEW flag. Quotaoff expects to release the dquots from all inodes in the filesystem via xfs_qm_dqrele_all_inodes(). This invokes the AG inode iterator, which skips inodes in the XFS_INEW state because they are not fully constructed. If the scan occurs after dquots have been attached to an inode, but before XFS_INEW is cleared, the newly allocated inode will continue to hold a reference to the applicable dquots. When quotaoff invokes xfs_qm_dqpurge_all(), the reference count of those dquot(s) remain elevated and the dqpurge scan spins indefinitely. To address this problem, update the xfs_qm_dqrele_all_inodes() scan to wait on inodes marked on the XFS_INEW state. We wait on the inodes explicitly rather than skip and retry to avoid continuous retry loops due to a parallel inode allocation workload. Since quotaoff updates the quota state flags and uses a synchronous transaction before the dqrele scan, and dquots are attached to inodes after radix tree insertion iff quota is enabled, one INEW waiting pass through the AG guarantees that the scan has processed all inodes that could possibly hold dquot references. Reported-by: Eryu Guan Signed-off-by: Brian Foster Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/xfs_qm_syscalls.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit ae2c4ac2dd39b23a87ddb14ceddc3f2872c6aef5 Author: Brian Foster Date: Wed Apr 26 08:30:39 2017 -0700 xfs: update ag iterator to support wait on new inodes The AG inode iterator currently skips new inodes as such inodes are inserted into the inode radix tree before they are fully constructed. Certain contexts require the ability to wait on the construction of new inodes, however. The fs-wide dquot release from the quotaoff sequence is an example of this. Update the AG inode iterator to support the ability to wait on inodes flagged with XFS_INEW upon request. Create a new xfs_inode_ag_iterator_flags() interface and support a set of iteration flags to modify the iteration behavior. When the XFS_AGITER_INEW_WAIT flag is set, include XFS_INEW flags in the radix tree inode lookup and wait on them before the callback is executed. Signed-off-by: Brian Foster Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/xfs_icache.c | 53 +++++++++++++++++++++++++++++++++++++++++++++-------- fs/xfs/xfs_icache.h | 8 ++++++++ 2 files changed, 53 insertions(+), 8 deletions(-) commit 756baca27fff3ecaeab9dbc7a5ee35a1d7bc0c7f Author: Brian Foster Date: Wed Apr 26 08:30:39 2017 -0700 xfs: support ability to wait on new inodes Inodes that are inserted into the perag tree but still under construction are flagged with the XFS_INEW bit. Most contexts either skip such inodes when they are encountered or have the ability to handle them. The runtime quotaoff sequence introduces a context that must wait for construction of such inodes to correctly ensure that all dquots in the fs are released. In anticipation of this, support the ability to wait on new inodes. Wake the appropriate bit when XFS_INEW is cleared. Signed-off-by: Brian Foster Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/xfs_icache.c | 5 ++++- fs/xfs/xfs_inode.h | 4 +++- 2 files changed, 7 insertions(+), 2 deletions(-) commit 8f720d9f892e0e223dab8400f03130bc208c72e7 Author: Amir Goldstein Date: Fri Apr 28 08:10:53 2017 -0700 xfs: publish UUID in struct super_block Copy the uuid of the filesystem to struct super_block s_uuid field, as several other filesystems already do. Copy regardless of the nouuid mount option, because other filesystems also do not guaranty uniqueness of the s_uuid field in super_block struct. Signed-off-by: Amir Goldstein Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/xfs_mount.c | 4 ++++ 1 file changed, 4 insertions(+) commit 9438b3e080beccf6022138ea62192d55cc7dc4ed Author: Dan Williams Date: Thu Apr 27 14:46:26 2017 -0700 block: hide badblocks attribute by default Commit 99e6608c9e74 "block: Add badblock management for gendisks" allowed for drivers like pmem and software-raid to advertise a list of bad media areas. However, it inadvertently added a 'badblocks' to all block devices. Lets clean this up by having the 'badblocks' attribute not be visible when the driver has not populated a 'struct badblocks' instance in the gendisk. Cc: Jens Axboe Cc: Christoph Hellwig Cc: Martin K. Petersen Reported-by: Vishal Verma Signed-off-by: Dan Williams Tested-by: Vishal Verma Signed-off-by: Jens Axboe block/genhd.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit f5337346cd8fe1b105f319b4b7fb06fe25c54480 Author: Florian Fainelli Date: Thu Apr 20 12:05:45 2017 -0700 arm64: pmu: Wire-up Cortex A53 L2 cache events and DTLB refills Add missing L2 cache events: read/write accesses and misses, as well as the DTLB refills. Acked-by: Will Deacon Signed-off-by: Florian Fainelli Signed-off-by: Catalin Marinas arch/arm64/kernel/perf_event.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 1a41dbce0dedc2dbf136060f686e0c43d903b612 Merge: 7dde07e 1442f6f Author: Pablo Neira Ayuso Date: Fri Apr 28 16:22:11 2017 +0200 Merge tag 'ipvs-fixes-for-v4.11' of http://git.kernel.org/pub/scm/linux/kernel/git/horms/ipvs Simon Horman says: ==================== IPVS Fixes for v4.11 I would also like it considered for stable. * Explicitly forbid ipv6 service/dest creation if ipv6 mod is disabled to avoid oops caused by IPVS accesing IPv6 routing code in such circumstances. ==================== Signed-off-by: Pablo Neira Ayuso commit 2d2ab658d2debcb4c0e29c9e6f18e5683f3077bf Author: Herbert Xu Date: Fri Apr 28 14:10:48 2017 +0800 rhashtable: Do not lower max_elems when max_size is zero The commit 6d684e54690c ("rhashtable: Cap total number of entries to 2^31") breaks rhashtable users that do not set max_size. This is because when max_size is zero max_elems is also incorrectly set to zero instead of 2^31. This patch fixes it by only lowering max_elems when max_size is not zero. Fixes: 6d684e54690c ("rhashtable: Cap total number of entries to 2^31") Reported-by: Florian Fainelli Reported-by: kernel test robot Signed-off-by: Herbert Xu Signed-off-by: David S. Miller lib/rhashtable.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) commit 21c6e939a9f6bb06fe616a87defec0f92a7c3df0 Author: Jens Axboe Date: Mon Apr 10 09:54:56 2017 -0600 blk-mq: unify hctx delay_work and run_work The only difference between ->run_work and ->delay_work, is that the latter is used to defer running a queue. This is done by marking the queue stopped, and scheduling ->delay_work to run sometime in the future. While the queue is stopped, direct runs or runs through ->run_work will not run the queue. If we combine the handlers, then we need to handle two things: 1) If a delayed/stopped run is scheduled, then we should not run the queue before that has been completed. 2) If a queue is delayed/stopped, the handler needs to restart the queue. Normally a run of a queue with the stopped bit set would be a no-op. Case 1 is handled by modifying a currently pending queue run to the deadline set by the caller of blk_mq_delay_queue(). Subsequent attempts to queue a queue run will find the work item already pending, and direct runs will see a stopped queue as before. Case 2 is handled by adding a new bit, BLK_MQ_S_START_ON_RUN, that tells the work handler that it should clear a stopped queue and run the handler. Reviewed-by: Bart Van Assche Signed-off-by: Jens Axboe block/blk-core.c | 4 +--- block/blk-mq.c | 34 ++++++++++++++++++++++------------ include/linux/blk-mq.h | 3 +-- 3 files changed, 24 insertions(+), 17 deletions(-) commit 818cd1cbaa7b00bbc35452a76bebc681a65f1912 Author: Jens Axboe Date: Mon Apr 10 09:54:55 2017 -0600 block: add kblock_mod_delayed_work_on() This modifies (or adds, if not currently pending) an existing delayed work item. Reviewed-by: Christoph Hellwig Reviewed-by: Bart Van Assche Signed-off-by: Jens Axboe block/blk-core.c | 7 +++++++ include/linux/blkdev.h | 1 + 2 files changed, 8 insertions(+) commit 9f993737906b30d7b2454a38637d1f70ffd60f2f Author: Jens Axboe Date: Mon Apr 10 09:54:54 2017 -0600 blk-mq: unify hctx delayed_run_work and run_work They serve the exact same purpose. Get rid of the non-delayed work variant, and just run it without delay for the normal case. Reviewed-by: Christoph Hellwig Reviewed-by: Bart Van Assche Reviewed-by: Ming Lei Signed-off-by: Jens Axboe block/blk-core.c | 2 +- block/blk-mq.c | 27 ++++++--------------------- include/linux/blk-mq.h | 3 +-- 3 files changed, 8 insertions(+), 24 deletions(-) commit 6a680783aaadd168557eec695374929ac066536f Author: Gregory CLEMENT Date: Wed Dec 14 17:43:48 2016 +0100 ARM64: dts: marvell: armada37xx: add pinctrl definition Start to populate the device tree of the Armada 37xx with the pincontrol configuration used on the board providing a dts. Signed-off-by: Gregory CLEMENT arch/arm64/boot/dts/marvell/armada-3720-db.dts | 8 +++++++ arch/arm64/boot/dts/marvell/armada-37xx.dtsi | 31 ++++++++++++++++++++++++++ 2 files changed, 39 insertions(+) commit afda007feda5cfe7463f3281dfeee703a5dc7ca3 Author: Gregory CLEMENT Date: Wed Apr 5 17:18:07 2017 +0200 ARM64: dts: marvell: Add pinctrl nodes for Armada 3700 Add the nodes for the two pin controller present in the Armada 37xx SoCs. Initially the node was named gpio1 using the same name that for the register range in the datasheet. However renaming it pinctr_nb (nb for North Bridge) makes more sens. Signed-off-by: Gregory CLEMENT arch/arm64/boot/dts/marvell/armada-37xx.dtsi | 42 ++++++++++++++++++++++++++-- 1 file changed, 39 insertions(+), 3 deletions(-) commit 60ae36ad0340b1ba88530d6a5e141455dd3afd81 Author: Josef Bacik Date: Fri Apr 28 09:49:19 2017 -0400 nbd: fix use after free on module unload list_for_each_entry() isn't super safe if we're freeing the objects while we traverse the list. Also don't bother taking the extra reference, the module refcounting stuff will save us from having anybody messing with the device while we're trying to unload. Reported-by: Ming Lei Signed-off-by: Josef Bacik Signed-off-by: Jens Axboe drivers/block/nbd.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 80a2ea9f85850f1cdae814be03b4a16c3d3abc00 Author: Theodore Ts'o Date: Fri Apr 28 09:51:54 2017 -0400 mm: retry writepages() on ENOMEM when doing an data integrity writeback Currently, file system's writepages() function must not fail with an ENOMEM, since if they do, it's possible for buffered data to be lost. This is because on a data integrity writeback writepages() gets called but once, and if it returns ENOMEM, if you're lucky the error will get reflected back to the userspace process calling fsync(). If you aren't lucky, the user is unmounting the file system, and the dirty pages will simply be lost. For this reason, file system code generally will use GFP_NOFS, and in some cases, will retry the allocation in a loop, on the theory that "kernel livelocks are temporary; data loss is forever". Unfortunately, this can indeed cause livelocks, since inside the writepages() call, the file system is holding various mutexes, and these mutexes may prevent the OOM killer from killing its targetted victim if it is also holding on to those mutexes. A better solution would be to allow writepages() to call the memory allocator with flags that give greater latitude to the allocator to fail, and then release its locks and return ENOMEM, and in the case of background writeback, the writes can be retried at a later time. In the case of data-integrity writeback retry after waiting a brief amount of time. Signed-off-by: Theodore Ts'o mm/page-writeback.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) commit 7dde07e9c53617549d67dd3e1d791496d0d3868e Author: Dan Carpenter Date: Fri Apr 28 15:57:56 2017 +0300 netfilter: x_tables: unlock on error in xt_find_table_lock() According to my static checker we should unlock here before the return. That seems reasonable to me as well. Fixes" b9e69e127397 ("netfilter: xtables: don't hook tables by default") Signed-off-by: Dan Carpenter Acked-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/netfilter/x_tables.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit bf290f8f98b1a22fe131fa517ef66efb846cf849 Author: Ulf Hansson Date: Fri Apr 28 12:10:36 2017 +0200 MAINTAINERS: bfq: Add Paolo as maintainer for the BFQ I/O scheduler Seems like this was forgotten in the bfq-series from Paolo. Let's do it now so people don't miss out involving Paolo for any future changes or when reporting bugs. Signed-off-by: Ulf Hansson Signed-off-by: Jens Axboe MAINTAINERS | 8 ++++++++ 1 file changed, 8 insertions(+) commit a6f74e80f271b19ea709cbda55e8eb67e9ffccf2 Author: NeilBrown Date: Mon Apr 10 12:08:53 2017 +1000 cifs: don't check for failure from mempool_alloc() mempool_alloc() cannot fail if the gfp flags allow it to sleep, and both GFP_FS allows for sleeping. So these tests of the return value from mempool_alloc() cannot be needed. Signed-off-by: NeilBrown Signed-off-by: Steve French fs/cifs/misc.c | 14 +++++--------- fs/cifs/smb2transport.c | 30 +++++++++++++----------------- fs/cifs/transport.c | 32 ++++++++++++++------------------ 3 files changed, 32 insertions(+), 44 deletions(-) commit 7d0c234fd2e1c9ca3fa032696c0c58b1b74a9e0b Author: Sachin Prabhu Date: Wed Apr 26 17:10:17 2017 +0100 Do not return number of bytes written for ioctl CIFS_IOC_COPYCHUNK_FILE commit 620d8745b35d ("Introduce cifs_copy_file_range()") changes the behaviour of the cifs ioctl call CIFS_IOC_COPYCHUNK_FILE. In case of successful writes, it now returns the number of bytes written. This return value is treated as an error by the xfstest cifs/001. Depending on the errno set at that time, this may or may not result in the test failing. The patch fixes this by setting the return value to 0 in case of successful writes. Fixes: commit 620d8745b35d ("Introduce cifs_copy_file_range()") Reported-by: Eryu Guan Signed-off-by: Sachin Prabhu Acked-by: Pavel Shilovsky Cc: stable@vger.kernel.org Signed-off-by: Steve French fs/cifs/ioctl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit cd8c42968ee651b69e00f8661caff32b0086e82d Author: Sachin Prabhu Date: Wed Apr 26 14:05:46 2017 +0100 Fix match_prepath() Incorrect return value for shares not using the prefix path means that we will never match superblocks for these shares. Fixes: commit c1d8b24d1819 ("Compare prepaths when comparing superblocks") Cc: stable@vger.kernel.org Signed-off-by: Sachin Prabhu Reviewed-by: Pavel Shilovsky Signed-off-by: Steve French fs/cifs/connect.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) commit a627f025eb0534052ff451427c16750b3530634c Author: yangbo lu Date: Thu Apr 20 14:58:29 2017 +0800 mmc: sdhci-of-esdhc: limit SD clock for ls1012a/ls1046a The ls1046a datasheet specified that the max SD clock frequency for eSDHC SDR104/HS200 was 167MHz, and the ls1012a datasheet specified it's 125MHz for ls1012a. So this patch is to add the limitation. Signed-off-by: Yangbo Lu Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-of-esdhc.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) commit b34939b9836950d261610132853311054b507247 Author: Arend Van Spriel Date: Fri Apr 28 13:40:28 2017 +0100 cfg80211: add request id to cfg80211_sched_scan_*() api Have proper request id filled in the SCHED_SCAN_RESULTS and SCHED_SCAN_STOPPED notifications toward user-space by having the driver provide it through the api. Reviewed-by: Hante Meuleman Reviewed-by: Pieter-Paul Giesberts Reviewed-by: Franky Lin Signed-off-by: Arend van Spriel Signed-off-by: Johannes Berg drivers/net/wireless/ath/ath6kl/cfg80211.c | 2 +- drivers/net/wireless/ath/ath6kl/wmi.c | 2 +- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 4 +- drivers/net/wireless/marvell/mwifiex/cfg80211.c | 6 +-- drivers/net/wireless/marvell/mwifiex/main.c | 2 +- drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c | 2 +- drivers/net/wireless/marvell/mwifiex/sta_event.c | 2 +- drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 2 +- include/net/cfg80211.h | 11 ++-- net/mac80211/pm.c | 2 +- net/mac80211/scan.c | 4 +- net/mac80211/util.c | 2 +- net/wireless/core.c | 2 +- net/wireless/core.h | 4 +- net/wireless/scan.c | 63 +++++++++++----------- net/wireless/trace.h | 26 ++++++--- 16 files changed, 77 insertions(+), 59 deletions(-) commit b1711c17c2633a1deb2e67589bf497afa7681e92 Author: Juan Antonio Pedreira Martos Date: Fri Apr 28 13:25:37 2017 +0200 staging: vt6656: use tabs instead of spaces Fix a checkpatch error: CODE_INDENT (code indent should use tabs where possible). Signed-off-by: Juan Antonio Pedreira Martos Signed-off-by: Greg Kroah-Hartman drivers/staging/vt6656/rxtx.c | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-) commit 817bf56ae7f005fdbba2ca90788806ef3fefea9b Author: Fabrizio Perria Date: Fri Apr 28 08:05:30 2017 -0400 staging: android: ion: Fix unnecessary initialization of static variable Fix checkpatch warning: removed unnecessary initialization of static variable "heap_id" to 0 in source file "ioc.c". Signed-off-by: Fabrizio Perria Signed-off-by: Greg Kroah-Hartman drivers/staging/android/ion/ion.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6eeabd8b2b8a2a495cbdec754b9ddc9c4f811fa8 Author: Colin Ian King Date: Fri Apr 14 15:25:40 2017 +0100 staging: media: atomisp: fix range checking on clk_num The range checking on clk_num is incorrect; fix these so that invalid clk_num values are detected correctly. Detected by static analysis with by PVS-Studio Signed-off-by: Colin Ian King Signed-off-by: Greg Kroah-Hartman drivers/staging/media/atomisp/platform/clock/vlv2_plat_clock.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 8ed78a154ec463a0f72f2421b93750aef9692cab Author: Luis Oliveira Date: Wed Apr 19 13:44:28 2017 +0100 staging: media: atomisp: fix misspelled word in comment This fix "overrided", the correct past tense form of "override" is "overridden". Signed-off-by: Luis Oliveira Signed-off-by: Greg Kroah-Hartman drivers/staging/media/atomisp/i2c/ov2680.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 5b686ccd2ea6351473537ad1baf19252fbbceade Author: Fabian Frederick Date: Fri Apr 28 13:10:39 2017 +0100 staging: media: atomisp: kmap() can't fail There's no need to check kmap() return value because it won't fail. If it's highmem mapping, it will receive virtual address or a new one; if it's lowmem, all kernel pages are already being mapped. (Thanks to Jan Kara for explanations) Signed-off-by: Fabian Frederick Signed-off-by: Alan Cox Signed-off-by: Greg Kroah-Hartman drivers/staging/media/atomisp/pci/atomisp2/hmm/hmm.c | 19 ++----------------- 1 file changed, 2 insertions(+), 17 deletions(-) commit 5795a9a5fed75a729444f9d83fab597ec131d282 Author: Arnd Bergmann Date: Fri Apr 28 13:10:31 2017 +0100 staging: atomisp: remove #ifdef for runtime PM functions The runtime power management functions are called from the reset handler even if CONFIG_PM is disabled, leading to a link error: drivers/staging/built-in.o: In function `atomisp_reset': (.text+0x4cd1c): undefined reference to `atomisp_runtime_suspend' drivers/staging/built-in.o: In function `atomisp_reset': (.text+0x4cd3a): undefined reference to `atomisp_mrfld_power_down' drivers/staging/built-in.o: In function `atomisp_reset': (.text+0x4cd58): undefined reference to `atomisp_mrfld_power_up' drivers/staging/built-in.o: In function `atomisp_reset': (.text+0x4cd77): undefined reference to `atomisp_runtime_resume' Removing the #ifdef around the PM functions avoids the problem, and lets us simplify it further. The __maybe_unused annotation is needed to ensure the compiler can silently drop the unused callbacks. Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2") Signed-off-by: Arnd Bergmann Signed-off-by: Alan Cox Signed-off-by: Greg Kroah-Hartman drivers/staging/media/atomisp/pci/atomisp2/atomisp_v4l2.c | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) commit 5162e1ae0c58dcf98ae322a92d60360142d0ae00 Author: Arnd Bergmann Date: Fri Apr 28 13:10:23 2017 +0100 staging: atomisp: satm include directory is gone After the satm kernel was removed, we should no longer add the directory to the search path. This was found with a 'make W=1' warning: cc1: error: drivers/staging/media/atomisp/pci/atomisp2/css2400/isp/kernels/satm/: No such file or directory [-Werror=missing-include-dirs] Fixes: 184f8e0981ef ("atomisp: remove satm kernel") Signed-off-by: Arnd Bergmann Signed-off-by: Alan Cox Signed-off-by: Greg Kroah-Hartman drivers/staging/media/atomisp/pci/atomisp2/Makefile | 1 - 1 file changed, 1 deletion(-) commit 31d677a9cab0cf532b21c8896f4906b96423c07b Author: Alan Cox Date: Fri Apr 28 13:10:13 2017 +0100 atomisp: remove some more unused files The extra list contains some which are used and some which are not. At this point I think we can safely remove those that are simply not used. Signed-off-by: Alan Cox Signed-off-by: Greg Kroah-Hartman .../staging/media/atomisp/pci/atomisp2/Makefile | 11 - .../media/atomisp/pci/atomisp2/hmm/hmm_bo_dev.c | 333 --------------------- .../media/atomisp/pci/atomisp2/hrt/device_access.c | 116 ------- .../media/atomisp/pci/atomisp2/hrt/memory_access.c | 103 ------- 4 files changed, 563 deletions(-) commit 08674e986293c36dcb078702009760291bec4f2c Author: Alan Cox Date: Fri Apr 28 13:10:01 2017 +0100 atomisp: remove hmm_load/store/clear indirections We have a layer of un-needed wrapping here that can go. In addition there are some functions that don't exist and one that isn't used which can also go. Signed-off-by: Alan Cox Signed-off-by: Greg Kroah-Hartman .../media/atomisp/pci/atomisp2/atomisp_cmd.c | 4 ++-- .../media/atomisp/pci/atomisp2/atomisp_fops.c | 4 ++-- .../pci/atomisp2/css2400/ia_css_memory_access.c | 15 ++++++------ .../atomisp/pci/atomisp2/hrt/hive_isp_css_mm_hrt.c | 27 ---------------------- .../atomisp/pci/atomisp2/hrt/hive_isp_css_mm_hrt.h | 20 ---------------- .../media/atomisp/pci/atomisp2/hrt/memory_access.c | 6 ++--- 6 files changed, 15 insertions(+), 61 deletions(-) commit f5a6ddaad4f49292b93a6c34825590a72391d0ab Author: Alan Cox Date: Fri Apr 28 13:09:46 2017 +0100 atomisp: kill off mmgr_free This is just another wrapper layer around hmm_free that servers no purpose in this driver. Signed-off-by: Alan Cox Signed-off-by: Greg Kroah-Hartman drivers/staging/media/atomisp/pci/atomisp2/atomisp_acc.c | 6 +++--- .../pci/atomisp2/css2400/base/refcount/src/refcount.c | 8 ++++---- .../hive_isp_css_include/memory_access/memory_access.h | 10 ++-------- .../atomisp/pci/atomisp2/css2400/ia_css_memory_access.c | 6 ------ .../css2400/isp/kernels/sdis/sdis_1.0/ia_css_sdis.host.c | 2 +- .../css2400/isp/kernels/sdis/sdis_2/ia_css_sdis2.host.c | 2 +- .../pci/atomisp2/css2400/runtime/binary/src/binary.c | 2 +- .../pci/atomisp2/css2400/runtime/frame/src/frame.c | 2 +- .../atomisp2/css2400/runtime/isp_param/src/isp_param.c | 2 +- .../pci/atomisp2/css2400/runtime/rmgr/src/rmgr_vbuf.c | 6 +++--- .../pci/atomisp2/css2400/runtime/spctrl/src/spctrl.c | 6 +++--- .../staging/media/atomisp/pci/atomisp2/css2400/sh_css.c | 4 ++-- .../media/atomisp/pci/atomisp2/css2400/sh_css_params.c | 16 ++++++++-------- .../media/atomisp/pci/atomisp2/hrt/memory_access.c | 7 ------- 14 files changed, 30 insertions(+), 49 deletions(-) commit b83cc378dfc46a06efecd14d2e5c687a2ac335d2 Author: Alan Cox Date: Fri Apr 28 13:09:33 2017 +0100 atomisp: clean up the hmm init/cleanup indirections We don't need any of these indirections as we only support one MMU type. Start by getting rid of the init/clear/free ones. The init ordering check we already pushed down in a previous patch. The allocation side is more complicated so leave it for now. Signed-off-by: Alan Cox Signed-off-by: Greg Kroah-Hartman .../media/atomisp/pci/atomisp2/atomisp_v4l2.c | 6 ++--- .../pci/atomisp2/css2400/ia_css_memory_access.c | 2 +- .../staging/media/atomisp/pci/atomisp2/hmm/hmm.c | 4 ++-- .../atomisp/pci/atomisp2/hrt/hive_isp_css_mm_hrt.c | 26 ---------------------- .../atomisp/pci/atomisp2/hrt/hive_isp_css_mm_hrt.h | 5 ----- .../media/atomisp/pci/atomisp2/hrt/memory_access.c | 4 ++-- 6 files changed, 8 insertions(+), 39 deletions(-) commit ec58cbed3f8879ae9d9447f49ff3cd57f315f5d8 Author: Alan Cox Date: Fri Apr 28 13:09:23 2017 +0100 atomisp: handle allocation calls before init in the hmm layer Currently the code handles this in the abstraction above. We want to remove that abstraction so begin by pushing down the sanity check. Unfortunately at this point we can't simply fix the init order. Signed-off-by: Alan Cox Signed-off-by: Greg Kroah-Hartman drivers/staging/media/atomisp/pci/atomisp2/hmm/hmm.c | 5 +++++ 1 file changed, 5 insertions(+) commit 92ac903a9c5f2f2b20b12c094fdcd1aaa3ff3410 Author: Ioana Radulescu Date: Fri Apr 28 04:50:34 2017 -0500 staging: fsl-dpaa2/eth: Add maintainer for Ethernet driver Signed-off-by: Ioana Radulescu Signed-off-by: Greg Kroah-Hartman MAINTAINERS | 6 ++++++ 1 file changed, 6 insertions(+) commit 4704b4df3241f6f2900f9875943456b2b0c5ccb4 Author: Ioana Radulescu Date: Fri Apr 28 04:50:33 2017 -0500 staging: fsl-dpaa2/eth: Add TODO file Add a list of TODO items for the Ethernet driver Signed-off-by: Ioana Radulescu Signed-off-by: Greg Kroah-Hartman drivers/staging/fsl-dpaa2/ethernet/TODO | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) commit 5636187b60823616a8d0ecb4f379438dae1aa511 Author: Ioana Radulescu Date: Fri Apr 28 04:50:32 2017 -0500 staging: fsl-dpaa2/eth: Add trace points Add trace events in significant places of the data path. Useful for debuggging. Signed-off-by: Ioana Radulescu Signed-off-by: Greg Kroah-Hartman drivers/staging/fsl-dpaa2/ethernet/Makefile | 3 + .../staging/fsl-dpaa2/ethernet/dpaa2-eth-trace.h | 185 +++++++++++++++++++++ drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c | 21 +++ drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.h | 2 + 4 files changed, 211 insertions(+) commit 85047abd06a2249ea8ab5cf839a3a5f83d94c79c Author: Ioana Radulescu Date: Fri Apr 28 04:50:31 2017 -0500 staging: fsl-dpaa2/eth: Add driver specific stats Add custom statistics to be reported via ethtool -S. These include driver specific per-cpu statistics as well as queue and channel counters. Signed-off-by: Ioana Radulescu Signed-off-by: Greg Kroah-Hartman drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c | 42 ++++++++++++++++++- drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.h | 36 ++++++++++++++++ drivers/staging/fsl-dpaa2/ethernet/dpaa2-ethtool.c | 49 +++++++++++++++++++++- 3 files changed, 123 insertions(+), 4 deletions(-) commit 341967401e449845db532af72b67487f9cb79867 Author: Ioana Radulescu Date: Fri Apr 28 04:50:30 2017 -0500 staging: fsl-dpaa2/eth: Add ethtool support Add support for several ethtool operations: show hardware statistics, get/set link settings, get hash configuration. Signed-off-by: Ioana Radulescu Signed-off-by: Bogdan Hamciuc Signed-off-by: Greg Kroah-Hartman drivers/staging/fsl-dpaa2/ethernet/Makefile | 2 +- drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c | 6 + drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.h | 6 + drivers/staging/fsl-dpaa2/ethernet/dpaa2-ethtool.c | 234 +++++++++++++++++++++ 4 files changed, 247 insertions(+), 1 deletion(-) commit 6e2387e8f19ed5f7ea47dec74675f256188f0b1f Author: Ioana Radulescu Date: Fri Apr 28 04:50:29 2017 -0500 staging: fsl-dpaa2/eth: Add Freescale DPAA2 Ethernet driver Introduce the DPAA2 Ethernet driver, which manages Datapath Network Interface (DPNI) objects discovered on the MC bus. In addition to DPNIs, the Ethernet driver uses several other MC objects to build a network interface abstraction: buffer pools (DPBPs), I/O Portals (DPIOs) and concentrators (DPCONs). A more detailed description of the driver can be found in the associated README file. Signed-off-by: Ioana Radulescu Signed-off-by: Bogdan Hamciuc Signed-off-by: Greg Kroah-Hartman drivers/staging/fsl-dpaa2/ethernet/Makefile | 2 +- drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c | 2455 ++++++++++++++++++++++++ drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.h | 304 +++ 3 files changed, 2760 insertions(+), 1 deletion(-) commit 0352d1d852017953a5bdc5d735e3b9ff24fe63bd Author: Ioana Radulescu Date: Fri Apr 28 04:50:28 2017 -0500 staging: fsl-dpaa2/eth: Add APIs for DPNI objects Add the command build/parse APIs for operating on DPNI objects through the DPAA2 Management Complex. Signed-off-by: Ioana Radulescu Signed-off-by: Greg Kroah-Hartman drivers/staging/Kconfig | 2 + drivers/staging/Makefile | 1 + drivers/staging/fsl-dpaa2/Kconfig | 17 + drivers/staging/fsl-dpaa2/Makefile | 5 + drivers/staging/fsl-dpaa2/ethernet/Makefile | 7 + drivers/staging/fsl-dpaa2/ethernet/dpkg.h | 176 +++ drivers/staging/fsl-dpaa2/ethernet/dpni-cmd.h | 541 +++++++++ drivers/staging/fsl-dpaa2/ethernet/dpni.c | 1595 +++++++++++++++++++++++++ drivers/staging/fsl-dpaa2/ethernet/dpni.h | 832 +++++++++++++ drivers/staging/fsl-dpaa2/ethernet/net.h | 480 ++++++++ 10 files changed, 3656 insertions(+) commit 9425f00e6225b289995e5b7f00f41fa1d5316835 Author: Ioana Radulescu Date: Fri Apr 28 04:50:27 2017 -0500 staging: fsl-dpaa2/eth: Add Ethernet driver overview document Add a README file describing the driver architecture, components and I/O interface. Signed-off-by: Ioana Radulescu Signed-off-by: Greg Kroah-Hartman drivers/staging/fsl-dpaa2/ethernet/README | 186 ++++++++++++++++++++++++++++++ 1 file changed, 186 insertions(+) commit 24999f3338efd42873ca8c5537b86fca456d2330 Author: Ioana Radulescu Date: Fri Apr 28 04:50:26 2017 -0500 staging: fsl-mc: bus: add DPCON object APIs This patch adds the command building/parsing wrapper functions for the DPCON object. The binary interface version is v3.2. A DPCON (DataPath Concentrator) is an aggregator object that allows ingress frames from multiple hardware queues to be seen as coming from a single source, from the CPU point of view. Signed-off-by: Ioana Radulescu Signed-off-by: Ioana Ciornei Signed-off-by: Stuart Yoder Signed-off-by: Greg Kroah-Hartman drivers/staging/fsl-mc/bus/Makefile | 3 +- drivers/staging/fsl-mc/bus/dpcon-cmd.h | 69 ++++--- drivers/staging/fsl-mc/bus/dpcon.c | 317 +++++++++++++++++++++++++++++++++ drivers/staging/fsl-mc/include/dpcon.h | 115 ++++++++++++ 4 files changed, 480 insertions(+), 24 deletions(-) commit c96d886d7b2efaba804a125e95c0f599a4c9974e Author: Horia Geantă Date: Sat Apr 22 09:44:49 2017 +0300 staging: fsl-mc: bus: dpio: fix alter FQ state command When checking the response verb, the valid bit should be masked out, since its value flips depending on what Response Register (RR0 /RR1) it's been read from. Fixes: 321eecb06bfb ("bus: fsl-mc: dpio: add QBMan portal APIs for DPAA2") Signed-off-by: Horia Geantă Signed-off-by: Greg Kroah-Hartman drivers/staging/fsl-mc/bus/dpio/qbman-portal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit add2e1e585875b42ac745c05bf0e7f029ee31ea2 Author: Michael Ellerman Date: Fri Apr 28 21:57:22 2017 +1000 powerpc/mm/hash: Fix off-by-one in comment about kernel contexts ids Michal Suchánek noticed a comment in book3s/64/mmu-hash.h about the context ids we use for the kernel was inconsistent with the code and other comments in the same file. It should read 1-4 not 1-5. While we're touching it, update "address" to "addresses" which makes more sense as it's referring to more than one address below. Reported-by: Michal Suchánek Signed-off-by: Michael Ellerman arch/powerpc/include/asm/book3s/64/mmu-hash.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b6e1f6adce8068620f728f717f90f4899b5ac83f Author: Alexey Kardashevskiy Date: Fri Mar 24 17:37:21 2017 +1100 powerpc/pseries: Enable VFIO This enables VFIO on pseries host in order to allow VFIO in nested guest under PR KVM or DPDK in a HV guest. This adds support of the VFIO_SPAPR_TCE_IOMMU type. This adds exchange() callback to allow TCE updates by the SPAPR TCE IOMMU driver in VFIO. This initializes DMA32 window parameters in iommu_table_group as as this does not implement VFIO_SPAPR_TCE_v2_IOMMU and VFIO_SPAPR_TCE_IOMMU just reuses the existing DMA32 window. Signed-off-by: Alexey Kardashevskiy Reviewed-by: David Gibson Signed-off-by: Michael Ellerman arch/powerpc/platforms/pseries/iommu.c | 40 ++++++++++++++++++++++++++++++++-- 1 file changed, 38 insertions(+), 2 deletions(-) commit e49a6a2173346d316c0e65d054a3cda89d57cb53 Author: Alexey Kardashevskiy Date: Thu Apr 13 17:05:27 2017 +1000 powerpc/powernv: Fix iommu table size calculation hook for small tables When the userspace requests a small TCE table (which takes less than the system page size) and more than 1 TCE level, the existing code returns a single page size which is a bug as each additional TCE level requires at least one page and this is what pnv_pci_ioda2_table_alloc_pages() does. And we end up seeing WARN_ON(!ret && ((*ptbl)->it_allocated_size != table_size)) in drivers/vfio/vfio_iommu_spapr_tce.c. This replaces incorrect _ALIGN_UP() (which aligns zero up to zero) with max_t() to fix the bug. Besides removing WARN_ON(), there should be no other changes in behaviour. Signed-off-by: Alexey Kardashevskiy Signed-off-by: Michael Ellerman arch/powerpc/platforms/powernv/pci-ioda.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 82eae1afbbdcaf2d716f88025736dc2d6f7afbf0 Author: Alexey Kardashevskiy Date: Mon Mar 27 19:27:37 2017 +1100 powerpc/powernv: Check kzalloc() return value in pnv_pci_table_alloc pnv_pci_table_alloc() ignores possible failure from kzalloc_node(), this adds a check. There are 2 callers of pnv_pci_table_alloc(), one already checks for tbl!=NULL, this adds WARN_ON() to the other path which only happens during boot time in IODA1 and not expected to fail. Signed-off-by: Alexey Kardashevskiy Signed-off-by: Michael Ellerman arch/powerpc/platforms/powernv/pci-ioda.c | 3 +++ arch/powerpc/platforms/powernv/pci.c | 3 +++ 2 files changed, 6 insertions(+) commit b71c9ffb140556004caf7ba27083f9d90ae8d14b Author: Nicholas Piggin Date: Sat Nov 26 14:26:10 2016 +1100 powerpc: Add arch/powerpc/tools directory Move a couple of existing scripts under there. Remove scripts directory: a script is a tool, a tool is not a script. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman arch/powerpc/Makefile | 2 +- arch/powerpc/Makefile.postlink | 2 +- arch/powerpc/relocs_check.sh | 61 ----------------------- arch/powerpc/scripts/gcc-check-mprofile-kernel.sh | 23 --------- arch/powerpc/tools/gcc-check-mprofile-kernel.sh | 23 +++++++++ arch/powerpc/tools/relocs_check.sh | 61 +++++++++++++++++++++++ 6 files changed, 86 insertions(+), 86 deletions(-) commit f188d0524d7e09f7ec801df9761dc1d898b1a1c0 Author: Nicholas Piggin Date: Sat Nov 26 14:26:09 2016 +1100 powerpc: Use the new post-link pass to check relocations Currently powerpc has to introduce a dependency on its default build target zImage in order to run a relocation check pass over the linked vmlinux. This is deficient because the check is not run if the plain vmlinux target is built, or if one of the other boot targets is built. Switch to using the kbuild post-link pass, added in commit fbe6e37dab97 ("kbuild: add arch specific post-link Makefile") in order to run this check. In future powerpc will use this to do more complicated operations, but initially using it for something simple is a good first step. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman arch/powerpc/Makefile | 11 ----------- arch/powerpc/Makefile.postlink | 34 ++++++++++++++++++++++++++++++++++ 2 files changed, 34 insertions(+), 11 deletions(-) commit 1cd6ed7c2e35a716dcf1347c33f58a7ce7d1414f Author: Nicholas Piggin Date: Tue Dec 20 04:30:11 2016 +1000 powerpc/xmon: Wait for secondaries before IPI'ing on system reset An externally triggered system reset (e.g., via QEMU nmi command, or pseries reset button) can cause system reset interrupts on all CPUs. In case this causes xmon to be entered, it is undesirable for the primary (first) CPU into xmon to trigger an NMI IPI to others, because this may cause a nested system reset interrupt. So spin for a time waiting for secondaries to join xmon before performing the NMI IPI, similarly to what the crash dump code does. Signed-off-by: Nicholas Piggin [mpe: Only do it when we come in from system reset, not via sysrq etc.] Signed-off-by: Michael Ellerman arch/powerpc/xmon/xmon.c | 36 +++++++++++++++++++++++++++--------- 1 file changed, 27 insertions(+), 9 deletions(-) commit 102c05e8dc4f75a573437e2ce50b2559f3db8d5e Author: Nicholas Piggin Date: Tue Dec 20 04:30:10 2016 +1000 powerpc/pseries: Implement NMI IPI with H_SIGNAL_SYS_RESET Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman arch/powerpc/platforms/pseries/ras.c | 4 ++++ arch/powerpc/platforms/pseries/smp.c | 23 ++++++++++++++++++++++- 2 files changed, 26 insertions(+), 1 deletion(-) commit c64af6458e2e2ddf86aff559837d3925fbf9cbb5 Author: Nicholas Piggin Date: Tue Dec 20 04:30:09 2016 +1000 powerpc: Add struct smp_ops_t.cause_nmi_ipi operation Have the NMI IPI code use this op when the platform defines it. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman arch/powerpc/include/asm/smp.h | 1 + arch/powerpc/kernel/smp.c | 3 +++ arch/powerpc/platforms/85xx/smp.c | 1 + arch/powerpc/platforms/86xx/mpc86xx_smp.c | 1 + arch/powerpc/platforms/chrp/smp.c | 1 + arch/powerpc/platforms/powermac/smp.c | 1 + arch/powerpc/platforms/powernv/smp.c | 1 + arch/powerpc/platforms/pseries/smp.c | 1 + 8 files changed, 10 insertions(+) commit ddd703ca06ede1b2d01ed1b0cb8d4315ab808099 Author: Nicholas Piggin Date: Tue Dec 20 04:30:08 2016 +1000 powerpc: Add NMI IPI infrastructure Add a simple NMI IPI system that handles concurrency and reentrancy. The platform does not have to implement a true non-maskable interrupt, the default is to simply use the debugger break IPI message. This has now been co-opted for a general IPI message, and users (debugger and crash) have been reimplemented on top of the NMI system. Signed-off-by: Nicholas Piggin [mpe: Incorporate incremental fixes from Nick] Signed-off-by: Michael Ellerman arch/powerpc/Kconfig | 5 + arch/powerpc/include/asm/smp.h | 14 +- arch/powerpc/kernel/smp.c | 243 +++++++++++++++++++++++++++----- arch/powerpc/platforms/cell/interrupt.c | 2 +- arch/powerpc/platforms/ps3/smp.c | 4 +- 5 files changed, 226 insertions(+), 42 deletions(-) commit 2b4f3ac5642672595ef6f71d1572b32475e94863 Author: Nicholas Piggin Date: Tue Dec 20 04:30:07 2016 +1000 powerpc: Mark system reset as an NMI with nmi_enter/exit() System reset is a non-maskable interrupt from Linux's point of view (occurs under local_irq_disable()), so it should use nmi_enter/exit. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman arch/powerpc/kernel/traps.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit b1ee8a3de5790777f325416ad97340428d8ae25f Author: Nicholas Piggin Date: Tue Dec 20 04:30:06 2016 +1000 powerpc/64s: Dedicated system reset interrupt stack The system reset interrupt is used for crash/debug situations, so it is desirable to have as little impact on the normal state of the system as possible. Currently it uses the current kernel stack to process the exception. This stores into the stack which may be involved with the crash. The stack pointer may be corrupted, or it may have overflowed. Avoid or minimise these problems by creating a dedicated NMI stack for the system reset interrupt to use. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman arch/powerpc/include/asm/exception-64s.h | 13 +++++++++++++ arch/powerpc/include/asm/paca.h | 3 ++- arch/powerpc/kernel/asm-offsets.c | 1 + arch/powerpc/kernel/exceptions-64s.S | 8 +++++--- arch/powerpc/kernel/setup_64.c | 5 +++++ arch/powerpc/xmon/xmon.c | 1 + 6 files changed, 27 insertions(+), 4 deletions(-) commit c4f3b52ce7b16824befb16ab3d045c891b08b7db Author: Nicholas Piggin Date: Tue Dec 20 04:30:05 2016 +1000 powerpc/64s: Disallow system reset vs system reset reentrancy In preparation for using a dedicated stack for system reset interrupts, prevent a nested system reset from recovering, in order to simplify code that is called in crash/debug path. This allows a system reset interrupt to just use the base stack pointer. Keep an in_nmi nesting counter similarly to the in_mce counter. Consider the interrrupt non-recoverable if it is taken inside another system reset. Interrupt nesting could be allowed similarly to MCE, but system reset is a special case that's not for normal operation, so simplicity wins until there is requirement for nested system reset interrupts. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman arch/powerpc/include/asm/exception-64s.h | 6 ++++++ arch/powerpc/include/asm/paca.h | 5 ++++- arch/powerpc/kernel/asm-offsets.c | 1 + arch/powerpc/kernel/exceptions-64s.S | 37 +++++++++++++++++++++++++++----- arch/powerpc/kernel/traps.c | 8 ++++++- arch/powerpc/xmon/xmon.c | 1 + 6 files changed, 51 insertions(+), 7 deletions(-) commit a3d96f70c14773d0928c6a54fd278138f0868572 Author: Nicholas Piggin Date: Tue Dec 20 04:30:04 2016 +1000 powerpc/64s: Fix system reset vs general interrupt reentrancy The system reset interrupt can occur when MSR_EE=0, and it currently uses the PACA_EXGEN save area. Some PACA_EXGEN interrupts have a window where MSR_RI=1 and MSR_EE=0 when the save area is still in use. A system reset interrupt in this window can lead to undetected corruption when the save area gets overwritten. This patch introduces PACA_EXNMI save area for system reset exceptions, which closes this corruption window. It's also helpful to retain the EXGEN state for debugging situations, even if not considering the recoverability aspect. This patch also moves the PACA_EXMC area down to a less frequently used part of the paca with the new save area. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman arch/powerpc/include/asm/exception-64s.h | 14 +++++++------- arch/powerpc/include/asm/paca.h | 6 +++++- arch/powerpc/kernel/asm-offsets.c | 1 + arch/powerpc/kernel/exceptions-64s.S | 9 ++++++--- 4 files changed, 19 insertions(+), 11 deletions(-) commit a4087a4d38981bef3de7dd814493df202919cd2e Author: Nicholas Piggin Date: Tue Dec 20 04:30:03 2016 +1000 powerpc/64s: Exception macro for stack frame and initial register save This code is common to a few exceptions, and another user will be added. This causes a trivial change to generated code: - 604: std r9,416(r1) - 608: mfspr r11,314 - 60c: std r11,368(r1) - 610: mfspr r12,315 + 604: mfspr r11,314 + 608: mfspr r12,315 + 60c: std r9,416(r1) + 610: std r11,368(r1) machine_check_powernv_early could also use this, but that requires non trivial changes to generated code, so that's for another patch. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman arch/powerpc/include/asm/exception-64s.h | 16 ++++++++++------ arch/powerpc/kernel/exceptions-64s.S | 13 ++++--------- 2 files changed, 14 insertions(+), 15 deletions(-) commit 83a980f7f4769c0673f0f966350d1db26993a193 Author: Nicholas Piggin Date: Tue Dec 20 04:30:02 2016 +1000 powerpc/64s: Add exception macro that does not enable RI Subsequent patches will add more non-RI variant exceptions, so create a macro for it rather than open-code it. This does not change generated instructions. Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman arch/powerpc/include/asm/exception-64s.h | 15 +++++++++++++++ arch/powerpc/kernel/exceptions-64s.S | 17 ++++------------- 2 files changed, 19 insertions(+), 13 deletions(-) commit 6e83985b0f6e30b928eee26eb41d276814a698aa Author: Nicholas Piggin Date: Mon Mar 20 16:31:49 2017 +1000 powerpc/cbe: Do not process external or decremeter interrupts from sreset Cell will wake from low power state at the system reset interrupt, with the event encoded in SRR1, rather than waking at the interrupt vector that corresponds to that event. The system reset handler for this platform decodes SRR1 event reason and calls the interrupt handler to process it directly from the system reset handlre. A subsequent change will treat the system reset interrupt as a Linux NMI with its own per-CPU stack, and this will no longer work. Remove the external and decrementer handlers from the system reset handler. - The external exception remains raised and will fire again at the EE interrupt vector when system reset returns. - The decrementer is set to 1 so it will be raised again and fire when the system reset returns. It is possible to branch to an idle handler from the system reset interrupt (like POWER does), then restore a normal stack and restore this optimisation. But simplicity wins for now. Tested-by: Michael Ellerman Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman arch/powerpc/platforms/cell/pervasive.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) commit 461e96a3374892d551fe270a975f33836c7f7d72 Author: Nicholas Piggin Date: Mon Mar 20 16:31:48 2017 +1000 powerpc/pasemi: Do not process external or decrementer interrupts from sreset PA Semi will wake from low power state at the system reset interrupt, with the event encoded in SRR1, rather than waking at the interrupt vector that corresponds to that event. The system reset handler for this platform decodes SRR1 event reason and calls the interrupt handler to process it directly from the system reset handlre. A subsequent change will treat the system reset interrupt as a Linux NMI with its own per-CPU stack, and this will no longer work. Remove the external and decrementer handlers from the system reset handler. - The external exception remains raised and will fire again at the EE interrupt vector when system reset returns. - The decrementer is set to 1 so it will be raised again and fire when the system reset returns. It is possible to branch to an idle handler from the system reset interrupt (like POWER does), then restore a normal stack and restore this optimisation. But simplicity wins for now. Tested-by: Christian Zigotzky Signed-off-by: Nicholas Piggin Signed-off-by: Michael Ellerman arch/powerpc/platforms/pasemi/idle.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) commit e145ac451eb68b51e0ede4c131bd5a539fb675b6 Author: yangbo lu Date: Wed Apr 26 10:45:49 2017 +0800 mmc: sdhci-of-esdhc: poll ESDHC_CLOCK_STABLE bit with udelay The loop to poll ESDHC_CLOCK_STABLE bit with mdelay would waste time because the time to stabilize is much less than 1 ms. This patch is to use udelay instead to avoid time wasting. Signed-off-by: Yangbo Lu Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-of-esdhc.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) commit 7ecb36442d12f197310a336a0e963badd238f35e Author: Kenneth Hsu Date: Sun Apr 23 10:37:02 2017 -0700 staging: rtl8723bs: declare private function as static This fixes a sparse warning regarding an undeclared symbol. Since the function is private to rtw_recv.c, it should be declared as static. Signed-off-by: Kenneth Hsu Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8723bs/core/rtw_recv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit a04b9b47ae587e088439495f31ca740d92191a75 Author: Hu Ziji Date: Fri Apr 28 10:35:15 2017 +0800 mmc: sdhci-xenon: Fix default value of LOGIC_TIMING_ADJUST for eMMC5.0 PHY The default value of LOGIC_TIMING_ADJUST register in eMMC 5.0 PHY is different from that in eMMC 5.1 PHY. Set the specific value for that register in eMMC 5.0 PHY. Signed-off-by: Hu Ziji Reported-by: Jisheng Zhang Tested-by: Jisheng Zhang Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-xenon-phy.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit 4cc59dffa9cb579613776cad5b777236210496d8 Author: Hu Ziji Date: Fri Apr 28 10:34:59 2017 +0800 mmc: sdhci-xenon: Fix the work flow in xenon_remove(). sdhci_remove_host() might execute SOFT_RESET_ALL. Inside xenon_remove(), Xenon SDHC should be enabled during sdhci_remove_host(). Move xenon_sdhc_unprepare after sdhci_remove_host() such that Xenon SDHC is disabled after sdhci_remove_host() completes. Signed-off-by: Hu Ziji Reported-by: Jisheng Zhang Tested-by: Jisheng Zhang Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-xenon.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit b58f45c8fc301fe83ee28cad3e64686c19e78f1c Author: Johan Hovold Date: Wed Apr 26 12:23:04 2017 +0200 staging: gdm724x: gdm_mux: fix use-after-free on module unload Make sure to deregister the USB driver before releasing the tty driver to avoid use-after-free in the USB disconnect callback where the tty devices are deregistered. Fixes: 61e121047645 ("staging: gdm7240: adding LTE USB driver") Cc: stable # 3.12 Cc: Won Kang Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman drivers/staging/gdm724x/gdm_mux.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit ea82fc151c5c092afb08a72289252c359ac88f45 Author: Bingyu Zhou Date: Wed Apr 19 19:47:41 2017 +0800 staging: rtl8723bs: Fix assignment in if condition in os_dep/sdio_intf.c ERROR: do not use assignment in if condition Detected by scripts/checkpatch.pl -f Signed-off-by: Bingyu Zhou Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8723bs/os_dep/sdio_intf.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) commit 3292bae3b4b6ca392a3f40fcb8135ed9b55206ed Author: Ian Chard Date: Fri Apr 28 10:04:58 2017 +0100 staging: rtl8188eu: embedded function name style fixes Replace a couple of function names embedded in trace messages with __func__. One of them had a typo anyway. Signed-off-by: Ian Chard Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8188eu/core/rtw_cmd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 784047eb2d3405a35087af70cba46170c5576b25 Author: Dan Carpenter Date: Sat Apr 22 13:47:23 2017 +0300 staging: rtl8188eu: prevent an underflow in rtw_check_beacon_data() The "len" could be as low as -14 so we should check for negatives. Fixes: 9a7fe54ddc3a ("staging: r8188eu: Add source files for new driver - part 1") Signed-off-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8188eu/core/rtw_ap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e38a017bf080d47376db340e94b9c2ffc47eb9b4 Author: Avraham Stern Date: Wed Apr 26 10:58:47 2017 +0300 mac80211: Add support for BSS max idle period element Parse the BSS max idle period element and set the BSS configuration accordingly so the driver can use this information to configure the max idle period and to use protected management frames for keep alive when required. The BSS max idle period element is defined in IEEE802.11-2016, section 9.4.2.79 Signed-off-by: Avraham Stern Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg include/linux/ieee80211.h | 28 +++++++++++++++++++++++++++- include/net/mac80211.h | 14 +++++++++++++- net/mac80211/ieee80211_i.h | 1 + net/mac80211/mlme.c | 14 +++++++++++++- net/mac80211/util.c | 9 +++++++++ 5 files changed, 63 insertions(+), 3 deletions(-) commit 29ce6ecbb83c9185d76e3a7c340c9702d2a54961 Author: Avraham Stern Date: Wed Apr 26 10:58:49 2017 +0300 cfg80211: unify cfg80211_roamed() and cfg80211_roamed_bss() cfg80211_roamed() and cfg80211_roamed_bss() take the same arguments except that cfg80211_roamed() requires the BSSID and cfg80211_roamed_bss() requires the bss entry. Unify the two functions by using a struct for driver initiated roaming information so that either the BSSID or the bss entry can be passed as an argument to the unified function. Signed-off-by: Avraham Stern [modified the ath6k, brcm80211, rndis and wlan-ng drivers accordingly] Signed-off-by: Luca Coelho [modify brcmfmac to remove the useless cast, spotted by Arend] Signed-off-by: Johannes Berg drivers/net/wireless/ath/ath6kl/cfg80211.c | 10 ++- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 13 +++- drivers/net/wireless/rndis_wlan.c | 19 +++-- drivers/staging/wlan-ng/cfg80211.c | 7 +- include/net/cfg80211.h | 58 +++++++------- net/wireless/core.h | 12 +-- net/wireless/nl80211.c | 18 +++-- net/wireless/nl80211.h | 5 +- net/wireless/sme.c | 90 +++++++++------------- net/wireless/util.c | 4 +- 10 files changed, 115 insertions(+), 121 deletions(-) commit 21a8e9dd52b64f0170bad208293ef8c30c3c1403 Author: Mohammed Shafi Shajakhan Date: Thu Apr 27 12:45:38 2017 +0530 mac80211: Fix possible sband related NULL pointer de-reference Existing API 'ieee80211_get_sdata_band' returns default 2 GHz band even if the channel context configuration is NULL. This crashes for chipsets which support 5 Ghz alone when it tries to access members of 'sband'. Channel context configuration can be NULL in multivif case and when channel switch is in progress (or) when it fails. Fix this by replacing the API 'ieee80211_get_sdata_band' with 'ieee80211_get_sband' which returns a NULL pointer for sband when the channel configuration is NULL. An example scenario is as below: In multivif mode (AP + STA) with drivers like ath10k, when we do a channel switch in the AP vif (which has a number of clients connected) and a STA vif which is connected to some other AP, when the channel switch in AP vif fails, while the STA vifs tries to connect to the other AP, there is a window where the channel context is NULL/invalid and this results in a crash while the clients connected to the AP vif tries to reconnect and this race is very similar to the one investigated by Michal in https://patchwork.kernel.org/patch/3788161/ and this does happens with hardware that supports 5Ghz alone after long hours of testing with continuous channel switch on the AP vif ieee80211 phy0: channel context reservation cannot be finalized because some interfaces aren't switching wlan0: failed to finalize CSA, disconnecting wlan0-1: deauthenticating from 8c:fd:f0:01:54:9c by local choice (Reason: 3=DEAUTH_LEAVING) WARNING: CPU: 1 PID: 19032 at net/mac80211/ieee80211_i.h:1013 sta_info_alloc+0x374/0x3fc [mac80211] [] (sta_info_alloc [mac80211]) [] (ieee80211_add_station [mac80211])) [] (nl80211_new_station [cfg80211]) Unable to handle kernel NULL pointer dereference at virtual address 00000014 pgd = d5f4c000 Internal error: Oops: 17 [#1] PREEMPT SMP ARM PC is at sta_info_alloc+0x380/0x3fc [mac80211] LR is at sta_info_alloc+0x37c/0x3fc [mac80211] [] (sta_info_alloc [mac80211]) [] (ieee80211_add_station [mac80211]) [] (nl80211_new_station [cfg80211])) Cc: Michal Kazior Signed-off-by: Mohammed Shafi Shajakhan Signed-off-by: Johannes Berg net/mac80211/cfg.c | 30 +++++++++++++++++------------- net/mac80211/ibss.c | 6 +++++- net/mac80211/ieee80211_i.h | 36 +++++++++++++++++++++--------------- net/mac80211/mesh.c | 29 ++++++++++++++++++++--------- net/mac80211/mesh_plink.c | 37 ++++++++++++++++++++++++++----------- net/mac80211/mlme.c | 14 ++++++++++++-- net/mac80211/rate.c | 4 +++- net/mac80211/sta_info.c | 13 +++++++++---- net/mac80211/tdls.c | 29 +++++++++++++++++++---------- net/mac80211/tx.c | 5 ++++- net/mac80211/util.c | 6 +++--- 11 files changed, 139 insertions(+), 70 deletions(-) commit f78d76699fe73d6a5faf344b327e7a54bfb1b1de Author: Colin Ian King Date: Fri Apr 21 17:19:31 2017 +0100 staging: rtl8192u: fix spelling mistake in variable name *attentuation Fix the spelling of a bunch of variables, from *attentuation to *attenuation. No functional change. Signed-off-by: Colin Ian King Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8192u/r8192U.h | 8 ++--- drivers/staging/rtl8192u/r8192U_core.c | 10 +++--- drivers/staging/rtl8192u/r8192U_dm.c | 56 +++++++++++++++++----------------- drivers/staging/rtl8192u/r819xU_phy.c | 34 ++++++++++----------- 4 files changed, 54 insertions(+), 54 deletions(-) commit 86d7726dd14c4a30d30aaa94a30c7e3c6b5c0805 Author: Jakub Jedelsky Date: Tue Apr 11 10:19:08 2017 +0200 staging: rtl8192u: fix incorrect assignments Fixing warnings found by sparse on rtl8192u/ieee80211. drivers/staging/rtl8192u/ieee80211//ieee80211_rx.c:1318:45: warning: incorrect type in assignment (different base types) drivers/staging/rtl8192u/ieee80211//ieee80211_rx.c:1318:45: expected unsigned short [unsigned] [usertype] len drivers/staging/rtl8192u/ieee80211//ieee80211_rx.c:1318:45: got restricted __be16 [usertype] drivers/staging/rtl8192u/ieee80211//ieee80211_rx.c:1481:40: warning: incorrect type in assignment (different base types) drivers/staging/rtl8192u/ieee80211//ieee80211_rx.c:1481:40: expected restricted __le16 drivers/staging/rtl8192u/ieee80211//ieee80211_rx.c:1481:40: got int drivers/staging/rtl8192u/ieee80211//ieee80211_rx.c:1483:40: warning: incorrect type in assignment (different base types) drivers/staging/rtl8192u/ieee80211//ieee80211_rx.c:1483:40: expected restricted __le16 drivers/staging/rtl8192u/ieee80211//ieee80211_rx.c:1483:40: got int drivers/staging/rtl8192u/ieee80211//ieee80211_rx.c:1487:45: warning: incorrect type in assignment (different base types) drivers/staging/rtl8192u/ieee80211//ieee80211_rx.c:1487:45: expected restricted __le16 drivers/staging/rtl8192u/ieee80211//ieee80211_rx.c:1487:45: gotunsigned short [unsigned] [usertype] Signed-off-by: Jakub Jedelsky Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) commit b13f6683ed4f42b2b4bed86ca2dec4ba478af47c Merge: 096ff2d e5afdf9 Author: Michael Ellerman Date: Fri Apr 28 20:19:37 2017 +1000 Merge branch 'topic/ppc-kvm' into next Merge the topic branch we were sharing with kvm-ppc, Paul has also merged it. commit 785185f4a3cf024c778312ec4a1f34126319d890 Author: kbuild test robot Date: Sun Apr 23 12:26:23 2017 +0300 staging: ccree: fix ifnullfree.cocci warnings drivers/staging/ccree/ssi_hash.c:317:2-7: WARNING: NULL check before freeing functions like kfree, debugfs_remove, debugfs_remove_recursive or usb_free_urb is not needed. Maybe consider reorganizing relevant code to avoid passing NULL values. drivers/staging/ccree/ssi_hash.c:320:2-7: WARNING: NULL check before freeing functions like kfree, debugfs_remove, debugfs_remove_recursive or usb_free_urb is not needed. Maybe consider reorganizing relevant code to avoid passing NULL values. drivers/staging/ccree/ssi_hash.c:323:2-7: WARNING: NULL check before freeing functions like kfree, debugfs_remove, debugfs_remove_recursive or usb_free_urb is not needed. Maybe consider reorganizing relevant code to avoid passing NULL values. drivers/staging/ccree/ssi_hash.c:373:2-7: WARNING: NULL check before freeing functions like kfree, debugfs_remove, debugfs_remove_recursive or usb_free_urb is not needed. Maybe consider reorganizing relevant code to avoid passing NULL values. drivers/staging/ccree/ssi_hash.c:375:2-7: WARNING: NULL check before freeing functions like kfree, debugfs_remove, debugfs_remove_recursive or usb_free_urb is not needed. Maybe consider reorganizing relevant code to avoid passing NULL values. drivers/staging/ccree/ssi_hash.c:377:2-7: WARNING: NULL check before freeing functions like kfree, debugfs_remove, debugfs_remove_recursive or usb_free_urb is not needed. Maybe consider reorganizing relevant code to avoid passing NULL values. drivers/staging/ccree/ssi_hash.c:379:3-8: WARNING: NULL check before freeing functions like kfree, debugfs_remove, debugfs_remove_recursive or usb_free_urb is not needed. Maybe consider reorganizing relevant code to avoid passing NULL values. drivers/staging/ccree/ssi_hash.c:381:2-7: WARNING: NULL check before freeing functions like kfree, debugfs_remove, debugfs_remove_recursive or usb_free_urb is not needed. Maybe consider reorganizing relevant code to avoid passing NULL values. drivers/staging/ccree/ssi_hash.c:383:2-7: WARNING: NULL check before freeing functions like kfree, debugfs_remove, debugfs_remove_recursive or usb_free_urb is not needed. Maybe consider reorganizing relevant code to avoid passing NULL values. NULL check before some freeing functions is not needed. Based on checkpatch warning "kfree(NULL) is safe this check is probably not required" and kfreeaddr.cocci by Julia Lawall. Generated by: scripts/coccinelle/free/ifnullfree.cocci Signed-off-by: Gilad Ben-Yossef Signed-off-by: Fengguang Wu Signed-off-by: Greg Kroah-Hartman drivers/staging/ccree/ssi_hash.c | 27 +++++++++------------------ 1 file changed, 9 insertions(+), 18 deletions(-) commit eba44af3c325d16678a6dbff975ab9dfc6369187 Author: kbuild test robot Date: Sun Apr 23 12:26:22 2017 +0300 staging: ccree: fix ifnullfree.cocci warnings drivers/staging/ccree/ssi_buffer_mgr.c:530:3-19: WARNING: NULL check before freeing functions like kfree, debugfs_remove, debugfs_remove_recursive or usb_free_urb is not needed. Maybe consider reorganizing relevant code to avoid passing NULL values. NULL check before some freeing functions is not needed. Based on checkpatch warning "kfree(NULL) is safe this check is probably not required" and kfreeaddr.cocci by Julia Lawall. Generated by: scripts/coccinelle/free/ifnullfree.cocci Signed-off-by: Gilad Ben-Yossef Signed-off-by: Fengguang Wu Signed-off-by: Greg Kroah-Hartman drivers/staging/ccree/ssi_buffer_mgr.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 9cbd7dca45993cfe56357a75bf054b0b25860cca Author: kbuild test robot Date: Sun Apr 23 12:26:21 2017 +0300 staging: ccree: fix array_size.cocci warnings drivers/staging/ccree/ssi_sysfs.c:319:34-35: WARNING: Use ARRAY_SIZE drivers/staging/ccree/ssi_sysfs.c:429:34-35: WARNING: Use ARRAY_SIZE Use ARRAY_SIZE instead of dividing sizeof array with sizeof an element Semantic patch information: This makes an effort to find cases where ARRAY_SIZE can be used such as where there is a division of sizeof the array by the sizeof its first element or by any indexed element or the element type. It replaces the division of the two sizeofs by ARRAY_SIZE. Generated by: scripts/coccinelle/misc/array_size.cocci Signed-off-by: Gilad Ben-Yossef Signed-off-by: Fengguang Wu Signed-off-by: Greg Kroah-Hartman drivers/staging/ccree/ssi_sysfs.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit 401c31130ae68d2b65f8ba0892c8238c68138e03 Author: kbuild test robot Date: Sun Apr 23 12:26:20 2017 +0300 staging: ccree: fix semicolon.cocci warnings drivers/staging/ccree/ssi_request_mgr.c:623:3-4: Unneeded semicolon Remove unneeded semicolon. Generated by: scripts/coccinelle/misc/semicolon.cocci Signed-off-by: Gilad Ben-Yossef Signed-off-by: Fengguang Wu Signed-off-by: Greg Kroah-Hartman drivers/staging/ccree/ssi_request_mgr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 65d4c8a76b8ae7ece1eb6ed4c40f2f6fa35c29c0 Author: kbuild test robot Date: Sun Apr 23 12:26:19 2017 +0300 staging: ccree: fix platform_no_drv_owner.cocci warnings drivers/staging/ccree/ssi_driver.c:484:6-11: No need to set .owner here. The core will do it. Remove .owner field if calls are used which set it automatically Generated by: scripts/coccinelle/api/platform_no_drv_owner.cocci Signed-off-by: Gilad Ben-Yossef Signed-off-by: Fengguang Wu Signed-off-by: Greg Kroah-Hartman drivers/staging/ccree/ssi_driver.c | 1 - 1 file changed, 1 deletion(-) commit abb5f0c6026816f4f8e4b68d4d4dc329c239cf36 Author: Gilad Ben-Yossef Date: Sun Apr 23 12:26:18 2017 +0300 staging: ccree: remove useless NULL test of field Remove kbuild test robot reported NULL check for a struct field address. Signed-off-by: Gilad Ben-Yossef Reported-by: kbuild test robot Signed-off-by: Greg Kroah-Hartman drivers/staging/ccree/ssi_buffer_mgr.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit a35f1eb4622a22d28ee8bc7ad53ba448b8f219bd Author: Gilad Ben-Yossef Date: Sun Apr 23 12:26:16 2017 +0300 staging: ccree: add DT bindings for Arm CryptoCell This adds DT bindings for the Arm TrustZone CryptoCell cryptographic accelerator IP. Signed-off-by: Gilad Ben-Yossef Signed-off-by: Greg Kroah-Hartman .../devicetree/bindings/crypto/arm-cryptocell.txt | 27 ++++++++++++++++++++++ 1 file changed, 27 insertions(+) commit 27e1b65aceef7b051bcfa74e1020f82a2210ed95 Author: Gilad Ben-Yossef Date: Sun Apr 23 12:26:15 2017 +0300 staging: ccree: add TODO list Add TODO list for moving out of staging tree for ccree crypto driver Signed-off-by: Gilad Ben-Yossef Signed-off-by: Greg Kroah-Hartman drivers/staging/ccree/TODO | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) commit 1660998033e1f180768b58b0f037da9292d1adda Author: Gilad Ben-Yossef Date: Sun Apr 23 12:26:14 2017 +0300 staging: ccree: add FIPS support Add FIPS mode support to CryptoCell driver Signed-off-by: Gilad Ben-Yossef Signed-off-by: Greg Kroah-Hartman drivers/staging/ccree/Kconfig | 9 + drivers/staging/ccree/Makefile | 1 + drivers/staging/ccree/ssi_aead.c | 6 + drivers/staging/ccree/ssi_cipher.c | 52 + drivers/staging/ccree/ssi_driver.c | 19 +- drivers/staging/ccree/ssi_driver.h | 2 + drivers/staging/ccree/ssi_fips.c | 65 ++ drivers/staging/ccree/ssi_fips.h | 70 ++ drivers/staging/ccree/ssi_fips_data.h | 315 ++++++ drivers/staging/ccree/ssi_fips_ext.c | 96 ++ drivers/staging/ccree/ssi_fips_ll.c | 1681 +++++++++++++++++++++++++++++++ drivers/staging/ccree/ssi_fips_local.c | 369 +++++++ drivers/staging/ccree/ssi_fips_local.h | 77 ++ drivers/staging/ccree/ssi_hash.c | 21 +- drivers/staging/ccree/ssi_request_mgr.c | 2 + 15 files changed, 2783 insertions(+), 2 deletions(-) commit fe0a1951b36d28391e8ec5f7297e7288b72e7aca Author: Gilad Ben-Yossef Date: Sun Apr 23 12:26:13 2017 +0300 staging: ccree: add AEAD support Add CryptoCell AEAD support Signed-off-by: Gilad Ben-Yossef Signed-off-by: Greg Kroah-Hartman drivers/staging/ccree/Kconfig | 1 + drivers/staging/ccree/Makefile | 2 +- drivers/staging/ccree/cc_crypto_ctx.h | 21 + drivers/staging/ccree/ssi_aead.c | 2826 ++++++++++++++++++++++++++++++++ drivers/staging/ccree/ssi_aead.h | 120 ++ drivers/staging/ccree/ssi_buffer_mgr.c | 899 ++++++++++ drivers/staging/ccree/ssi_buffer_mgr.h | 4 + drivers/staging/ccree/ssi_driver.c | 11 + drivers/staging/ccree/ssi_driver.h | 4 + 9 files changed, 3887 insertions(+), 1 deletion(-) commit a4d826b94a634e7319c212d8ab1d8cbcf783d0f2 Author: Gilad Ben-Yossef Date: Sun Apr 23 12:26:12 2017 +0300 staging: ccree: add IV generation support Add CryptoCell IV hardware generation support. This patch adds the needed support to drive the HW but does not expose the ability via the kernel crypto API yet. Signed-off-by: Gilad Ben-Yossef Signed-off-by: Greg Kroah-Hartman drivers/staging/ccree/Makefile | 2 +- drivers/staging/ccree/ssi_buffer_mgr.c | 2 + drivers/staging/ccree/ssi_cipher.c | 11 ++ drivers/staging/ccree/ssi_cipher.h | 1 + drivers/staging/ccree/ssi_driver.c | 9 + drivers/staging/ccree/ssi_driver.h | 7 + drivers/staging/ccree/ssi_ivgen.c | 301 ++++++++++++++++++++++++++++++++ drivers/staging/ccree/ssi_ivgen.h | 72 ++++++++ drivers/staging/ccree/ssi_pm.c | 2 + drivers/staging/ccree/ssi_request_mgr.c | 33 +++- 10 files changed, 438 insertions(+), 2 deletions(-) commit 302ef8ebb4b2ca10b06268c2ef5fbc4d1f061a51 Author: Gilad Ben-Yossef Date: Sun Apr 23 12:26:11 2017 +0300 staging: ccree: add skcipher support Add CryptoCell skcipher support Signed-off-by: Gilad Ben-Yossef Signed-off-by: Greg Kroah-Hartman drivers/staging/ccree/Kconfig | 8 + drivers/staging/ccree/Makefile | 2 +- drivers/staging/ccree/cc_crypto_ctx.h | 21 + drivers/staging/ccree/ssi_buffer_mgr.c | 147 ++++ drivers/staging/ccree/ssi_buffer_mgr.h | 16 + drivers/staging/ccree/ssi_cipher.c | 1440 ++++++++++++++++++++++++++++++++ drivers/staging/ccree/ssi_cipher.h | 88 ++ drivers/staging/ccree/ssi_driver.c | 14 + drivers/staging/ccree/ssi_driver.h | 30 + 9 files changed, 1765 insertions(+), 1 deletion(-) commit 50cfbbb7e627b868f3cf6882d2a9210bb8428737 Author: Gilad Ben-Yossef Date: Sun Apr 23 12:26:10 2017 +0300 staging: ccree: add ahash support Add CryptoCell async. hash and HMAC support. Signed-off-by: Gilad Ben-Yossef Signed-off-by: Greg Kroah-Hartman drivers/staging/ccree/Kconfig | 6 + drivers/staging/ccree/Makefile | 2 +- drivers/staging/ccree/cc_crypto_ctx.h | 22 + drivers/staging/ccree/hash_defs.h | 78 + drivers/staging/ccree/ssi_buffer_mgr.c | 311 +++- drivers/staging/ccree/ssi_buffer_mgr.h | 6 + drivers/staging/ccree/ssi_driver.c | 11 +- drivers/staging/ccree/ssi_driver.h | 4 +- drivers/staging/ccree/ssi_hash.c | 2732 ++++++++++++++++++++++++++++++++ drivers/staging/ccree/ssi_hash.h | 101 ++ drivers/staging/ccree/ssi_pm.c | 4 + 11 files changed, 3263 insertions(+), 14 deletions(-) commit abefd6741d540fc624e73a2a3bdef2397bcbd064 Author: Gilad Ben-Yossef Date: Sun Apr 23 12:26:09 2017 +0300 staging: ccree: introduce CryptoCell HW driver Introduce basic low level Arm TrustZone CryptoCell HW support. This first patch doesn't actually register any Crypto API transformations, these will follow up in the next patch. This first revision supports the CC 712 REE component. Signed-off-by: Gilad Ben-Yossef Signed-off-by: Greg Kroah-Hartman drivers/staging/Kconfig | 2 + drivers/staging/Makefile | 1 + drivers/staging/ccree/Kconfig | 19 + drivers/staging/ccree/Makefile | 2 + drivers/staging/ccree/cc_bitops.h | 62 +++ drivers/staging/ccree/cc_crypto_ctx.h | 235 ++++++++++ drivers/staging/ccree/cc_hal.h | 30 ++ drivers/staging/ccree/cc_hw_queue_defs.h | 603 +++++++++++++++++++++++++ drivers/staging/ccree/cc_lli_defs.h | 57 +++ drivers/staging/ccree/cc_pal_log.h | 188 ++++++++ drivers/staging/ccree/cc_pal_log_plat.h | 33 ++ drivers/staging/ccree/cc_pal_types.h | 97 ++++ drivers/staging/ccree/cc_pal_types_plat.h | 29 ++ drivers/staging/ccree/cc_regs.h | 106 +++++ drivers/staging/ccree/dx_crys_kernel.h | 180 ++++++++ drivers/staging/ccree/dx_env.h | 224 ++++++++++ drivers/staging/ccree/dx_host.h | 155 +++++++ drivers/staging/ccree/dx_reg_base_host.h | 34 ++ drivers/staging/ccree/dx_reg_common.h | 26 ++ drivers/staging/ccree/hw_queue_defs_plat.h | 43 ++ drivers/staging/ccree/ssi_buffer_mgr.c | 537 +++++++++++++++++++++++ drivers/staging/ccree/ssi_buffer_mgr.h | 79 ++++ drivers/staging/ccree/ssi_config.h | 61 +++ drivers/staging/ccree/ssi_driver.c | 499 +++++++++++++++++++++ drivers/staging/ccree/ssi_driver.h | 183 ++++++++ drivers/staging/ccree/ssi_pm.c | 144 ++++++ drivers/staging/ccree/ssi_pm.h | 46 ++ drivers/staging/ccree/ssi_pm_ext.c | 60 +++ drivers/staging/ccree/ssi_pm_ext.h | 33 ++ drivers/staging/ccree/ssi_request_mgr.c | 680 +++++++++++++++++++++++++++++ drivers/staging/ccree/ssi_request_mgr.h | 60 +++ drivers/staging/ccree/ssi_sram_mgr.c | 138 ++++++ drivers/staging/ccree/ssi_sram_mgr.h | 80 ++++ drivers/staging/ccree/ssi_sysfs.c | 440 +++++++++++++++++++ drivers/staging/ccree/ssi_sysfs.h | 54 +++ 35 files changed, 5220 insertions(+) commit f55a6d457b215e5a382d6001a166ae2089fc81b6 Author: Arnd Bergmann Date: Fri Apr 21 22:59:16 2017 +0200 staging: rtl8723bs: rework debug configuration handling I ran into this warning during randconfig testing: drivers/staging/rtl8723bs/os_dep/rtw_proc.c: In function 'rtw_adapter_proc_deinit': drivers/staging/rtl8723bs/os_dep/rtw_proc.c:738:25: error: unused variable 'drv_proc' [-Werror=unused-variable] drivers/staging/rtl8723bs/os_dep/rtw_proc.c: In function 'rtw_adapter_proc_replace': drivers/staging/rtl8723bs/os_dep/rtw_proc.c:762:25: error: unused variable 'drv_proc' [-Werror=unused-variable] The problem is that the code procfs code gets built even when CONFIG_PROC_FS is disabled, but some functions are turned into empty stubs then. This is easily addressed by adding an #ifdef around the definition of the CONFIG_PROC_DEBUG macro. However, I could not bear looking at the macro name that clashes with the Kconfig name space, so I also renamed it to simply PROC_DEBUG, along with the other rtl8723bs specific CONFIG_DEBUG_* macros that I renamed the same way. This is consistent with how we handle the same checks in the non-staging rtlwifi driver. As the code path for !CONFIG_PROC_DEBUG had not been tested properly, it turned out to be incorrect and requires adding 'static inline' annotations for the stub handlers, and moving some variables around. Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver") Signed-off-by: Arnd Bergmann Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8723bs/core/rtw_cmd.c | 2 ++ drivers/staging/rtl8723bs/core/rtw_debug.c | 11 +++----- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 6 ++--- drivers/staging/rtl8723bs/hal/rtl8723b_cmd.c | 4 +-- drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c | 12 ++++++--- drivers/staging/rtl8723bs/include/autoconf.h | 16 +++++++----- drivers/staging/rtl8723bs/include/rtw_debug.h | 12 ++++----- drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 32 +++++++++++------------ drivers/staging/rtl8723bs/os_dep/ioctl_linux.c | 6 ++--- drivers/staging/rtl8723bs/os_dep/rtw_proc.c | 4 +-- drivers/staging/rtl8723bs/os_dep/rtw_proc.h | 16 ++++++------ 11 files changed, 62 insertions(+), 59 deletions(-) commit c45112e467ab0a5dbc13f36b0420518e1ee9c072 Author: Arnd Bergmann Date: Wed Apr 19 19:16:26 2017 +0200 staging: rtl8723bs: fix empty-body warning The newly added driver causes lots of warnings like drivers/staging/rtl8723bs/core/rtw_recv.c: In function 'validate_recv_frame': drivers/staging/rtl8723bs/core/rtw_recv.c:1602:4: error: suggest braces around empty body in an 'else' statement [-Werror=empty-body] DBG_COUNTER(adapter->rx_logs.core_rx_pre_data_handled); drivers/staging/rtl8723bs/core/rtw_xmit.c: In function 'update_attrib': drivers/staging/rtl8723bs/core/rtw_xmit.c:726:3: error: suggest braces around empty body in an 'else' statement [-Werror=empty-body] DBG_COUNTER(padapter->tx_logs.core_tx_upd_attrib_unknown); drivers/staging/rtl8723bs/hal/HalPhyRf.c: In function 'ODM_TXPowerTrackingCallback_ThermalMeter': drivers/staging/rtl8723bs/hal/HalPhyRf.c:146:4: error: suggest braces around empty body in an 'if' statement [-Werror=empty-body] drivers/staging/rtl8723bs/hal/HalPhyRf.c:529:6: error: suggest braces around empty body in an 'if' statement [-Werror=empty-body] drivers/staging/rtl8723bs/hal/HalPhyRf.c:559:6: error: suggest braces around empty body in an 'if' statement [-Werror=empty-body] When DBG_COUNTER() etc is defined as a non-empty macro, we get the intended behavior and no warning. Using no_printk() for printing helper functions as the added advantage of compile-time checking format strings Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver") Signed-off-by: Arnd Bergmann Signed-off-by: Greg Kroah-Hartman drivers/staging/rtl8723bs/hal/HalBtcOutSrc.h | 9 +++++---- drivers/staging/rtl8723bs/hal/odm_debug.h | 15 ++++++++------- drivers/staging/rtl8723bs/include/rtw_debug.h | 2 +- 3 files changed, 14 insertions(+), 12 deletions(-) commit b40f7808a0edcb63aeb619b37b7b870cc5bb8c39 Author: Christophe Colin Date: Sun Apr 23 21:55:25 2017 +0200 staging: fbtft: fix open parentheses alignment Modify the code indentations to fix the checkpatch issues. Signed-off-by: Christophe Colin Signed-off-by: Greg Kroah-Hartman drivers/staging/fbtft/fbtft-sysfs.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit 0c8f4650eaef96794fe5d581e73968ad3050323f Author: Dhananjay Balan Date: Mon Apr 24 15:15:53 2017 +0200 staging: olpc_dcon: style fixes removes hardcoded function name and uses __func__ to print info. Signed-off-by: Dhananjay Balan Signed-off-by: Greg Kroah-Hartman drivers/staging/olpc_dcon/olpc_dcon.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 1442f6f7c1b77de1c508318164a527e240c24a4d Author: Paolo Abeni Date: Thu Apr 20 11:44:16 2017 +0200 ipvs: explicitly forbid ipv6 service/dest creation if ipv6 mod is disabled When creating a new ipvs service, ipv6 addresses are always accepted if CONFIG_IP_VS_IPV6 is enabled. On dest creation the address family is not explicitly checked. This allows the user-space to configure ipvs services even if the system is booted with ipv6.disable=1. On specific configuration, ipvs can try to call ipv6 routing code at setup time, causing the kernel to oops due to fib6_rules_ops being NULL. This change addresses the issue adding a check for the ipv6 module being enabled while validating ipv6 service operations and adding the same validation for dest operations. According to git history, this issue is apparently present since the introduction of ipv6 support, and the oops can be triggered since commit 09571c7ae30865ad ("IPVS: Add function to determine if IPv6 address is local") Fixes: 09571c7ae30865ad ("IPVS: Add function to determine if IPv6 address is local") Signed-off-by: Paolo Abeni Acked-by: Julian Anastasov Signed-off-by: Simon Horman net/netfilter/ipvs/ip_vs_ctl.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) commit 17475c50bea854ba4e0da8198b98d921be2285cb Author: Ian Chard Date: Thu Apr 27 09:28:06 2017 +0100 staging: wlan-ng: break long line in p80211req.c Fix a style warning for a line over 80 characters long. Signed-off-by: Ian Chard Signed-off-by: Greg Kroah-Hartman drivers/staging/wlan-ng/p80211req.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 05c0cf88bec588a7cb34de569acd871ceef26760 Author: Malcolm Priestley Date: Sat Apr 22 11:14:58 2017 +0100 staging: vt6656: use off stack for in buffer USB transfers. Since 4.9 mandated USB buffers to be heap allocated. This causes the driver to fail. Create buffer for USB transfers. Signed-off-by: Malcolm Priestley Cc: # v4.9+ Signed-off-by: Greg Kroah-Hartman drivers/staging/vt6656/usbpipe.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) commit 12ecd24ef93277e4e5feaf27b0b18f2d3828bc5e Author: Malcolm Priestley Date: Sat Apr 22 11:14:57 2017 +0100 staging: vt6656: use off stack for out buffer USB transfers. Since 4.9 mandated USB buffers be heap allocated this causes the driver to fail. Since there is a wide range of buffer sizes use kmemdup to create allocated buffer. Signed-off-by: Malcolm Priestley Cc: # v4.9+ Signed-off-by: Greg Kroah-Hartman drivers/staging/vt6656/usbpipe.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) commit 00916cfc61779a80e378f431d668a4508421b330 Author: Chewie Lin Date: Wed Apr 19 00:58:35 2017 -0700 drivers:staging:vt6656: remove usb_device_reset in main_usb.c: Removed the usb_device_reset(), replace with call to usb_reset_device() directly. Plus it removes the confusing function name and addressed the checkpatch warning. This change also swaps string in the dev_warn() call with __func__ argument to "vt6656_probe" instead of literal string "usb_reset_device". WARNING: Prefer using "%s", __func__ to embedded function names #417: FILE: main_usb.c:417: + "usb_device_reset fail status=%d\n", status); total: 0 errors, 1 warnings, 1058 lines checked And after fix: main_usb.c has no obvious style problems and is ready for submission. Signed-off-by: Chewie Lin Signed-off-by: Greg Kroah-Hartman drivers/staging/vt6656/main_usb.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) commit 9e96652756ad647b7bcc03cb99ffc9756d7b5f93 Author: Pan Bian Date: Sun Apr 23 19:53:58 2017 +0800 staging: wilc1000: fix unchecked return value Function dev_alloc_skb() will return a NULL pointer if there is no enough memory. However, in function WILC_WFI_mon_xmit(), its return value is used without validation. This may result in a bad memory access bug. This patch fixes the bug. Signed-off-by: Pan Bian Signed-off-by: Greg Kroah-Hartman drivers/staging/wilc1000/linux_mon.c | 2 ++ 1 file changed, 2 insertions(+) commit fb90e8dedb465bd06512f718b139ed8680d26dbe Author: Aaron Conole Date: Wed Apr 12 16:38:12 2017 -0400 ipvs: change comparison on sync_refresh_period The sync_refresh_period variable is unsigned, so it can never be < 0. Signed-off-by: Aaron Conole Signed-off-by: Simon Horman net/netfilter/ipvs/ip_vs_sync.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 65ba101ebc3b80500882b6bf3502823e24a99f90 Author: Aaron Conole Date: Mon Apr 10 15:50:44 2017 -0400 ipvs: remove unused function ip_vs_set_state_timeout There are no in-tree callers of this function and it isn't exported. Signed-off-by: Aaron Conole Signed-off-by: Simon Horman include/net/ip_vs.h | 2 -- net/netfilter/ipvs/ip_vs_proto.c | 22 ---------------------- 2 files changed, 24 deletions(-) commit 3c2bf0bd08123f3497bd3e84bd9088c937b0cb40 Author: Sameer Wadgaonkar Date: Tue Apr 18 16:55:25 2017 -0400 staging: unisys: visorhba: fix s-Par to boot with option CONFIG_VMAP_STACK set to y The root issue is that we are not allowed to have items on the stack being passed to "DMA" like operations. In this case we have a vmcall and an inline completion of scsi command. This patch fixes the issue by moving the variables on stack in do_scsi_nolinuxstat() to heap memory. Signed-off-by: Sameer Wadgaonkar Signed-off-by: David Kershner Signed-off-by: Greg Kroah-Hartman drivers/staging/unisys/visorhba/visorhba_main.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit bb1fb8ac399f75fccf3da5c7430a40bb0e5f01c8 Author: Sameer Wadgaonkar Date: Tue Apr 18 16:55:24 2017 -0400 staging: unisys: visorbus: fix s-Par to boot with option CONFIG_VMAP_STACK set to y The root issue is that we are not allowed to have items on the stack being passed to "DMA" like operations. In this case we have vmcall operation that was using parameters from the stack. This patch fixes the issue by moving the variables on stack in issue_vmcall_io_controlvm_addr() to vmcall_controlvm_addr struct. Signed-off-by: Sameer Wadgaonkar Signed-off-by: David Kershner Signed-off-by: Greg Kroah-Hartman drivers/staging/unisys/visorbus/visorchipset.c | 33 +++++++++++++++----------- 1 file changed, 19 insertions(+), 14 deletions(-) commit 372b9f22763915ea32d19f6397f6292d2667e2bf Author: David Kershner Date: Tue Apr 18 16:55:23 2017 -0400 staging: unisys: visorbus: remove POSTCODE from visorchipset_init Remove POSTCODEs from visorchipset_init and replace them with dev_err when needed. Since there are no more POSTCODEs in the code, we can get rid of the data in the header file as well. Signed-off-by: David Kershner Reviewed-by: Tim Sell Signed-off-by: Greg Kroah-Hartman drivers/staging/unisys/visorbus/visorchipset.c | 4 +- drivers/staging/unisys/visorbus/vmcallinterface.h | 104 ---------------------- 2 files changed, 1 insertion(+), 107 deletions(-) commit 0f7453af972be6532b56d056cc91e7310a8094fb Author: David Kershner Date: Tue Apr 18 16:55:22 2017 -0400 staging: unisys: visorbus: remove postcodes in setup_crash_devices_work_queue Replace postcodes with dev_err in the function setup_crash_device_work_queue. Signed-off-by: David Kershner Reviewed-by: Tim Sell Signed-off-by: Greg Kroah-Hartman drivers/staging/unisys/visorbus/visorchipset.c | 33 +++++++++++--------------- 1 file changed, 14 insertions(+), 19 deletions(-) commit d9b89ef189a876a37032b8cc1fea4a80018d371d Author: David Kershner Date: Tue Apr 18 16:55:21 2017 -0400 staging: unisys: visorbus: refactor setup_crash_devices_work_queue The if statement was sending us down the happy path with the error path in the else. This can be simplified by having the if be the error and just falling through with the good path. Signed-off-by: David Kershner Reviewed-by: Tim Sell Signed-off-by: Greg Kroah-Hartman drivers/staging/unisys/visorbus/visorchipset.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) commit 03662df8114fa74cbd4e993c7e0ca1360db603a3 Author: David Kershner Date: Tue Apr 18 16:55:20 2017 -0400 staging: unisys: visorbus: get rid of POSTCODES in my_device_changestate Replace POSTCODEs with dev_err in the function my_device_changestate. Signed-off-by: David Kershner Reviewed-by: Tim Sell Signed-off-by: Greg Kroah-Hartman drivers/staging/unisys/visorbus/visorchipset.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) commit a8c26e4bc219ded38cc59a9bbfcfee6c2abb666f Author: David Kershner Date: Tue Apr 18 16:55:19 2017 -0400 staging: unisys: visorbus: remove POSTCODE from my_device_create Replace the POSTCODEs with dev_err in my_device_create. Signed-off-by: David Kershner Reviewed-by: Tim Sell Signed-off-by: Greg Kroah-Hartman drivers/staging/unisys/visorbus/visorchipset.c | 24 +++++++++--------------- 1 file changed, 9 insertions(+), 15 deletions(-) commit 71a0265d2781c19d2f25520bc6a8f54e0224c692 Author: David Kershner Date: Tue Apr 18 16:55:18 2017 -0400 staging: unisys: visorbus: remove POSTCODE from bus_configure Remove the POSTCODE logging from bus_configure, replace it with an error message if we fail dumping the errno. Signed-off-by: David Kershner Reviewed-by: Tim Sell Signed-off-by: Greg Kroah-Hartman drivers/staging/unisys/visorbus/visorchipset.c | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) commit 055bc9093b3feb50378665f71236fdeca620f814 Author: David Kershner Date: Tue Apr 18 16:55:17 2017 -0400 staging: unisys: visorbus: remove POSTCODEs from bus_create Removed the POSTCODEs from the function bus_create. Signed-off-by: David Kershner Reviewed-by: Tim Sell Signed-off-by: Greg Kroah-Hartman drivers/staging/unisys/visorbus/visorchipset.c | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) commit 35301b87628df68a554d63b4baa864644008a97c Author: David Kershner Date: Tue Apr 18 16:55:16 2017 -0400 staging: unisys: visorbus: get rid of POSTCODEs in save_crash_msg Replace POSTCODES in save_crash_msg with dev_err handling. Signed-off-by: David Kershner Reviewed-by: Tim Sell Signed-off-by: Greg Kroah-Hartman drivers/staging/unisys/visorbus/visorchipset.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) commit 804aab3be13915ce72da8000ad00694ae90f7bf2 Author: David Kershner Date: Tue Apr 18 16:55:15 2017 -0400 staging: unisys: visorbus: remove postcodes in visorbus_init Remove the POSTCODES in visorbus_init. Since there are no more POSTCODES in visorbus_main.c we can remove the reference to the vmcallinterface header file. No need for vmcallinterface in visorbus_main.c Signed-off-by: David Kershner Reviewed-by: Tim Sell Signed-off-by: Greg Kroah-Hartman drivers/staging/unisys/visorbus/visorbus_main.c | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) commit 81aaca2f5de6f4b72a15e2fbb19fa7e4fff329e4 Author: David Kershner Date: Tue Apr 18 16:55:14 2017 -0400 staging: unisys: visorbus: remove noisy postcode from visorchipset_exit The postcodes in visorchipset_exit were not displaying errors, they can just be removed. Signed-off-by: David Kershner Reviewed-by: Tim Sell Signed-off-by: Greg Kroah-Hartman drivers/staging/unisys/visorbus/visorchipset.c | 4 ---- 1 file changed, 4 deletions(-) commit 5e259c4b0667edb1c3d24d9f698465e496d2c569 Author: David Kershner Date: Tue Apr 18 16:55:13 2017 -0400 staging: unisys: visorbus: remove noisy postcode in bus_destroy Since kzalloc will display error the postcode becomes redundant, it can be removed. Signed-off-by: David Kershner Reviewed-by: Tim Sell Signed-off-by: Greg Kroah-Hartman drivers/staging/unisys/visorbus/visorchipset.c | 3 --- 1 file changed, 3 deletions(-) commit 646c7eb5d207538a8b655a40f4bbc27a56c1bb73 Author: David Kershner Date: Tue Apr 18 16:55:12 2017 -0400 staging: unisys: visorbus: remove noisy postcodes Get rid of postcodes from visorbus_main.c that are just informational. They were not logging errors, we don't need to replace them with anything. Signed-off-by: David Kershner Reviewed-by: Tim Sell Signed-off-by: Greg Kroah-Hartman drivers/staging/unisys/visorbus/visorbus_main.c | 21 ++------------------- 1 file changed, 2 insertions(+), 19 deletions(-) commit 450333f10a074517c167a129b92496a070ada0d4 Author: David Kershner Date: Tue Apr 18 16:55:11 2017 -0400 staging: unisys: visorbus: remove POSTCODE in create_bus_instance Remove postcodes from create_bus_instance. If there is an error log it with dev_err. Signed-off-by: David Kershner Reviewed-by: Tim Sell Signed-off-by: Greg Kroah-Hartman drivers/staging/unisys/visorbus/visorbus_main.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) commit 402a343a24f5ed6fb9f88255d5b916be2fa3b32e Author: David Kershner Date: Tue Apr 18 16:55:10 2017 -0400 staging: unisys: visorbus: remove POSTCODE from chispet_init Get rid of the postcodes from the function chipset_init. They were being noisy, so don't replace them with errors. Signed-off-by: David Kershner Reviewed-by: Tim Sell Signed-off-by: Greg Kroah-Hartman drivers/staging/unisys/visorbus/visorchipset.c | 2 -- 1 file changed, 2 deletions(-) commit ebdc1b883352b4db8d28afc9af3e5d2f81b2e4ff Author: David Kershner Date: Tue Apr 18 16:55:09 2017 -0400 staging: unisys: visorbus: remove POSTCODE from create_visor_device Remove POSTCODES from create_visor_device, when we fail log an error with dev_err. Signed-off-by: David Kershner Reviewed-by: Tim Sell Signed-off-by: Greg Kroah-Hartman drivers/staging/unisys/visorbus/visorbus_main.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) commit 8c8c975f37b2097cd23b7394fff0192c073b808f Author: David Kershner Date: Tue Apr 18 16:55:08 2017 -0400 staging: unisys: visorbus: remove NORETRY Allow retry when allocating memory. Signed-off-by: David Kershner Reviewed-by: Tim Sell Signed-off-by: Greg Kroah-Hartman drivers/staging/unisys/visorbus/visorchipset.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 9b2cae6decb94a222190a2096f1188af5ed68554 Author: David Kershner Date: Tue Apr 18 16:55:07 2017 -0400 staging: unisys: visorbus: handle visorchannel_write errors in code Catch and report back errors when visorchannel_write fails. Signed-off-by: David Kershner Reviewed-by: Tim Sell Signed-off-by: Greg Kroah-Hartman drivers/staging/unisys/visorbus/visorchannel.c | 35 ++++++++++++-------------- 1 file changed, 16 insertions(+), 19 deletions(-) commit 04dbc09b255ec0be67e6b0f7bf114675ac143cd9 Author: David Kershner Date: Tue Apr 18 16:55:06 2017 -0400 staging: unisys: visorbus: add timeout to controlvm_periodic_work Limit the amount that gets pulled from the queue on each try so we don't get stuck in an infinite loop if something has gone wrong with the s-Par firmware. Signed-off-by: David Kershner Reviewed-by: Tim Sell Signed-off-by: Greg Kroah-Hartman drivers/staging/unisys/visorbus/visorchipset.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit d02bde9d37bc00376727a2b422ee95323bbcd6d6 Author: David Kershner Date: Tue Apr 18 16:55:05 2017 -0400 staging: unisys: visorbus: update comment Comment was outdated and did not reflect what was actually happening. Update the comment to reflect reality. Signed-off-by: David Kershner Reviewed-by: Tim Sell Signed-off-by: Greg Kroah-Hartman drivers/staging/unisys/visorbus/visorchipset.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) commit 027b03e7171857cf017ad1f338525738be8a25ca Author: David Kershner Date: Tue Apr 18 16:55:04 2017 -0400 staging: unisys: visorbus: fixed indentation Moved the brace to the left to fix the indentation issue. Signed-off-by: David Kershner Reviewed-by: Tim Sell Signed-off-by: Greg Kroah-Hartman drivers/staging/unisys/visorbus/visorchipset.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c1d28da7a2d28bfb18bd9aa12afaeee7c2cf6d11 Author: David Kershner Date: Tue Apr 18 16:55:03 2017 -0400 staging; unisys: visorbus: replace uint32 with int Shouldn't use uint32 in the kernel, it can be replaced with int here. Signed-off-by: David Kershner Reviewed-by: Tim Sell Signed-off-by: Greg Kroah-Hartman drivers/staging/unisys/visorbus/visorchipset.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 54149b4c1458ec9a70788f66fe0f02790639f216 Author: David Kershner Date: Tue Apr 18 16:55:02 2017 -0400 staging: unisys: visornic: remove keyword inline from function Functions in c files don't need to be inlined, get rid of the keyword. Signed-off-by: David Kershner Reviewed-by: Tim Sell Signed-off-by: Greg Kroah-Hartman drivers/staging/unisys/visornic/visornic_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4c0e65f83a933ec86b0c22c973e1a0363b30a176 Author: David Kershner Date: Tue Apr 18 16:55:01 2017 -0400 staging: unisys: visorbus: combine response functions into a single one There are several different controlvm response functions, consolidate them to one so we can simplify error handling. Signed-off-by: David Kershner Reviewed-by: Tim Sell Signed-off-by: Greg Kroah-Hartman drivers/staging/unisys/visorbus/visorchipset.c | 53 +++++++++++--------------- 1 file changed, 22 insertions(+), 31 deletions(-) commit 0743ce5904684ba5ea995e7a675cf1ede674d084 Author: Tobin C. Harding Date: Thu Apr 27 11:25:27 2017 +1000 staging: ks7010: fix enumeration tags Driver header declares enumeration types without tags. Using informative tags makes the code easier to understand and eliminates the need to comment the enum. Add tags to enumeration types. Signed-off-by: Tobin C. Harding Signed-off-by: Greg Kroah-Hartman drivers/staging/ks7010/ks_hostif.h | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) commit f730fb19dd5fca3ccf1af9e80e4455c76bf46f28 Author: Tobin C. Harding Date: Thu Apr 27 11:25:26 2017 +1000 staging: ks7010: add enum multicast_filter_type Driver uses preprocessor directives to define multicast filter constants. These can be defined using an enumeration type. Doing so adds to the readability and gives the assists the compiler. Add enumeration type multicast_filter_type to replace preprocessor defined constants. Signed-off-by: Tobin C. Harding Signed-off-by: Greg Kroah-Hartman drivers/staging/ks7010/ks_hostif.h | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit 72f78682da2af5fa57f89f39d4c789123288274d Author: Tobin C. Harding Date: Thu Apr 27 11:25:25 2017 +1000 staging: ks7010: clean up macro ps_confirm_wait_inc Macro includes commented out code. Removing dead code line enables braces to be removed. Macro is easier to read if the code is clean. Clean up macro ps_confirm_wait_inc. Signed-off-by: Tobin C. Harding Signed-off-by: Greg Kroah-Hartman drivers/staging/ks7010/ks_hostif.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit e04f2ec6c3266336784919d719b12ab67edaa74a Author: Tobin C. Harding Date: Thu Apr 27 11:25:24 2017 +1000 staging: ks7010: continue from loop on unmatched mac Inside loop, code block is guarded with an 'if' statement. Instead of guarding the block we can invert the 'if' statement conditional and continue the loop. Doing so allows subsequent code indentation to be reduced and aids the readability of the code. Invert 'if' statement conditional, continue loop if new conditional evaluates to true. Reduce subsequent code indentation level. Do not change program logic. Signed-off-by: Tobin C. Harding Signed-off-by: Greg Kroah-Hartman drivers/staging/ks7010/ks_hostif.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit 2b0d92b265324cfe42839a23cb46677bb0112c2c Author: Tobin C. Harding Date: Thu Apr 27 11:25:23 2017 +1000 staging: ks7010: remove cast from netdev_priv() The returned pointer from netdev_priv() (void *) does not need to be cast. Remove unnecessary cast of void * returned by netdev_priv(). Signed-off-by: Tobin C. Harding Signed-off-by: Greg Kroah-Hartman drivers/staging/ks7010/ks_wlan_net.c | 184 ++++++++++++----------------------- 1 file changed, 64 insertions(+), 120 deletions(-) commit 8fb8e05ccafaa0e09fd93d9bffd0b4037cc36317 Author: Tobin C. Harding Date: Thu Apr 27 11:25:22 2017 +1000 staging: ks7010: make abbreviation mgmt uniform Driver currently uses abbreviations 'mgt' and 'mngmt' for 'management'. Also 'power' is sometimes abbreviated to 'pow' and other times not. It makes the code easier to read and easier to modify if one abbreviation is used throughout the driver. 'mgmt' is widely accepted as an abbreviation of 'management'. 'power' can be spelled out in full, the extra two characters aids readability without an excessive cost. Make abbreviation of 'management' uniform across the driver, function names, preprocessor defined constants, and enumeration types. Signed-off-by: Tobin C. Harding Signed-off-by: Greg Kroah-Hartman drivers/staging/ks7010/ks7010_sdio.c | 4 ++-- drivers/staging/ks7010/ks_hostif.c | 32 +++++++++++++------------- drivers/staging/ks7010/ks_hostif.h | 17 +++++++------- drivers/staging/ks7010/ks_wlan.h | 2 +- drivers/staging/ks7010/ks_wlan_net.c | 44 ++++++++++++++++++------------------ 5 files changed, 49 insertions(+), 50 deletions(-) commit 27476f01d311ebbb4847f32f8258f2be25d8aea6 Author: Tobin C. Harding Date: Thu Apr 27 11:25:21 2017 +1000 staging: ks7010: fix checkpatch LINE_SPACING Checkpatch emits CHECK: Please don't use multiple blank lines. Remove multiple blank lines. Signed-off-by: Tobin C. Harding Signed-off-by: Greg Kroah-Hartman drivers/staging/ks7010/ks_hostif.c | 1 - 1 file changed, 1 deletion(-) commit 63c31af3e5efa8ebe0aaa60de183fb94989420f8 Author: Tobin C. Harding Date: Thu Apr 27 11:25:20 2017 +1000 staging: ks7010: add enum sleep_mode_type Driver uses preprocessor directives to define SLP_ASLEEP and SLP_ACTIVE. These can be defined using an enumeration type. Doing so adds to the readability and gives the usual compiler benefits of having an enum. Functions that currently accept integer types can now use the new enumeration type, further aiding readability. Add enumeration type sleep_mode_type. Update code that handles sleep mode to use the new enumeration type. Signed-off-by: Tobin C. Harding Signed-off-by: Greg Kroah-Hartman drivers/staging/ks7010/ks_hostif.c | 7 ++++--- drivers/staging/ks7010/ks_hostif.h | 8 +++++--- 2 files changed, 9 insertions(+), 6 deletions(-) commit 0e24eb8abf93a2e80ecbe97419d2d1fe089a7386 Author: Tobin C. Harding Date: Thu Apr 27 11:25:19 2017 +1000 staging: ks7010: abstract connection status Host interface connection status is handled using a 32 bit type. Top byte is used as for FORCE_DISCONNECT status, low bits are used for connect/disconnect status. Driver masks and checks integers to ascertain status. If functions are defined to do the masking and equality check then the details of how the status integer is used are abstracted away. This makes the code easier to read. Also future updates to the status handling will be easier because the code is in one place. Driver currently uses the CONNECT_STATUS and DISCONNECT_STATUS as values, as apposed to opaque values. Because of this driver code checks for equality with CONNECT_STATUS and DISCONNECT_STATUS as apposed to negating a single check (ie 'foo != CONNECT_STATUS). In order to maintain the current functionality we define two separate functions is_connect_status() and is_disconnect_status(). Add functions to abstract the status integer check. Update all sites that do the check manually to use the newly defined functions. Signed-off-by: Tobin C. Harding Signed-off-by: Greg Kroah-Hartman drivers/staging/ks7010/ks7010_sdio.c | 2 +- drivers/staging/ks7010/ks_hostif.c | 24 ++++++++++++------------ drivers/staging/ks7010/ks_wlan.h | 2 ++ drivers/staging/ks7010/ks_wlan_net.c | 27 ++++++++++++++++++++++++--- 4 files changed, 39 insertions(+), 16 deletions(-) commit 11ce16da7b0f5335c7622ccc7c8151a387b44853 Author: Tobin C. Harding Date: Thu Apr 27 11:25:18 2017 +1000 staging: ks7010: add hostif_generic_request() Driver contains duplicate code. Host interface has numerous request functions which allocate memory for a request header. Each request header is different but all contain, as the first member, a hostif_hdr structure. This structure has size and event members which need to be set. By defining a helper function to allocate the memory and set the initial hostif_hdr members code duplication is reduced. Add function to allocate memory for a host interface request. Set 'size' and 'event' members. Remove duplicate code using newly defined function. Signed-off-by: Tobin C. Harding Signed-off-by: Greg Kroah-Hartman drivers/staging/ks7010/ks_hostif.c | 173 ++++++++++++------------------------- 1 file changed, 57 insertions(+), 116 deletions(-) commit 95e72fba95fd1d9b9ef3ab080aafe1076f42a10a Author: Tobin C. Harding Date: Thu Apr 27 11:25:17 2017 +1000 staging: ks7010: clean memory allocation Memory allocation code contains unneeded debug statements, failed kmalloc() calls typically do not require a debug message. Introduction of a local 'size' variable allows kmalloc() call to be marginally cleaner, still uses magic numbers but these require a more substantial fix. Moving the magic numbers onto a single line opens the way for further refactoring. Clean memory allocation code, remove debug statements. Signed-off-by: Tobin C. Harding Signed-off-by: Greg Kroah-Hartman drivers/staging/ks7010/ks_hostif.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) commit 8215fc607f50c516ceeb47fac046c3e4ea7acc4e Author: Tobin C. Harding Date: Thu Apr 27 11:25:16 2017 +1000 staging: ks7010: remove duplicate code Current switch statement has duplicate code in branches. This code can be put after the switch statement so as to remove the duplication. Move code to after switch statement, remove duplicate code. Make error branch return so as not to execute the moved code block. Do not change the program logic. Signed-off-by: Tobin C. Harding Signed-off-by: Greg Kroah-Hartman drivers/staging/ks7010/ks_hostif.c | 34 ++++++++++++---------------------- 1 file changed, 12 insertions(+), 22 deletions(-) commit 08484ef41927a52fbd0d46c5cd19a65535d768ea Author: Tobin C. Harding Date: Thu Apr 27 11:25:15 2017 +1000 staging: ks7010: remove magic numbers Driver includes magic numbers. Defining constants or using existing constants aids the readability of the code. Magic number '12' is used for two ethernet addresses (6 bytes each). ETH_ALEN is already defined within the kernel to 6. We can us the expression '2 * ETH_ALEN' to make this code explicit. Magic number '20' refers to the data size, in bytes, of a struct ether_hdr (described in eap_packet.h). We can define a constant for this purpose, making the code explicit and easier to read. Define constant. Remove magic numbers, using newly defined constant and/or expression using existing kernel constant. Signed-off-by: Tobin C. Harding Signed-off-by: Greg Kroah-Hartman drivers/staging/ks7010/eap_packet.h | 2 ++ drivers/staging/ks7010/ks_hostif.c | 25 ++++++++++++++++--------- 2 files changed, 18 insertions(+), 9 deletions(-) commit 8cd1dbe1db97ad74c5265e09c3490eeb7986f623 Author: Tobin C. Harding Date: Thu Apr 27 11:25:14 2017 +1000 staging: ks7010: move skb null check near allocation Currently, after allocating an sk_buff, driver fills the sk_buff within code block guarded by a NULL check on the sk_buff. If a NULL check is done immediately after the allocation, and code returns on error, then the subsequent code need not be guarded and the level of indentation may be reduced. This aids the readability of the code and makes explicit the error path. Check for NULL directly after allocating the sk_buff, return if allocation fails. Reduce indentation of subsequent code. Do not change the program logic. Signed-off-by: Tobin C. Harding Signed-off-by: Greg Kroah-Hartman drivers/staging/ks7010/ks_hostif.c | 80 ++++++++++++++++++++------------------ 1 file changed, 42 insertions(+), 38 deletions(-) commit 69f3fecc49cabaadf4839dda4227427fc15b4c7e Author: Tobin C. Harding Date: Thu Apr 27 11:25:13 2017 +1000 staging: ks7010: remove unused local variable eap_key Code declares and assigns to a local variable that is never used, it can be safely removed. Remove unused local variable. Signed-off-by: Tobin C. Harding Signed-off-by: Greg Kroah-Hartman drivers/staging/ks7010/ks_hostif.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) commit 208c66f2fb3d9cd398386785aae116753a27e8c4 Author: Tobin C. Harding Date: Thu Apr 27 11:25:12 2017 +1000 staging: ks7010: remove unnecessary address check Currently source and destination ethernet addresses are checked twice, once in hostif_data_indication() and then again in hostif_data_indication_wpa(). The second of these functions is called from the first right after the address check is done. This check is a duplicate and is unnecessary. Remove unnecessary duplicate address check. Signed-off-by: Tobin C. Harding Signed-off-by: Greg Kroah-Hartman drivers/staging/ks7010/ks_hostif.c | 4 ---- 1 file changed, 4 deletions(-) commit 6d27f590112f356310a853f3b7dc6843cd72f786 Author: Valentin Vidic Date: Wed Apr 26 12:48:31 2017 +0200 staging: lustre: remove void function return All statements removed from the end of void functions as reported by checkpatch. Signed-off-by: Valentin Vidic Signed-off-by: Greg Kroah-Hartman drivers/staging/lustre/lustre/lmv/lmv_obd.c | 1 - drivers/staging/lustre/lustre/lmv/lproc_lmv.c | 1 - drivers/staging/lustre/lustre/lov/lov_obd.c | 1 - 3 files changed, 3 deletions(-) commit 6c707d4febfb7bcc9628a38bc8e2d9b690486414 Author: Paolo Cretaro Date: Tue Apr 25 22:14:29 2017 +0200 staging: android: ion: Remove whitespace before quoted newline Fix checkpatch.pl warning about unnecessary whitespace before a quoted newline. Signed-off-by: Paolo Cretaro Signed-off-by: Greg Kroah-Hartman drivers/staging/android/ion/ion_chunk_heap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c034a43e72dda58e4a184d71f5502ef356e04453 Author: Yueyao Zhu Date: Thu Apr 27 14:09:58 2017 -0700 staging: typec: Fairchild FUSB302 Type-c chip driver Fairchild FUSB302 Type-C chip driver that works with Type-C Port Controller Manager to provide USB PD and USB Type-C functionalities. Signed-off-by: Yueyao Zhu Signed-off-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman drivers/staging/typec/Kconfig | 2 + drivers/staging/typec/Makefile | 1 + drivers/staging/typec/fusb302/Kconfig | 7 + drivers/staging/typec/fusb302/Makefile | 1 + drivers/staging/typec/fusb302/TODO | 6 + drivers/staging/typec/fusb302/fusb302.c | 1815 +++++++++++++++++++++++++++ drivers/staging/typec/fusb302/fusb302_reg.h | 186 +++ 7 files changed, 2018 insertions(+) commit 74e656d6b0551999194b5ab1e45ff8b1e82b898e Author: Guenter Roeck Date: Thu Apr 27 14:09:57 2017 -0700 staging: typec: Type-C Port Controller Interface driver (tcpci) The port controller interface driver interconnects the Type-C Port Manager with a Type-C Port Controller Interface (TCPCI) compliant port controller. Signed-off-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman drivers/staging/typec/Kconfig | 11 + drivers/staging/typec/Makefile | 1 + drivers/staging/typec/TODO | 3 + drivers/staging/typec/tcpci.c | 526 +++++++++++++++++++++++++++++++++++++++++ drivers/staging/typec/tcpci.h | 133 +++++++++++ 5 files changed, 674 insertions(+) commit f0690a25a140b853b1842fa80faf828601bb47e8 Author: Guenter Roeck Date: Thu Apr 27 14:09:56 2017 -0700 staging: typec: USB Type-C Port Manager (tcpm) This driver implements the USB Type-C Power Delivery state machine for both source and sink ports. Alternate mode support is not fully implemented. The driver attaches to the USB Type-C class code implemented in the following patches. usb: typec: add driver for Intel Whiskey Cove PMIC USB Type-C PHY usb: USB Type-C connector class This driver only implements the state machine. Lower level drivers are responsible for - Reporting VBUS status and activating VBUS - Setting CC lines and providing CC line status - Setting line polarity - Activating and deactivating VCONN - Setting the current limit - Activating and deactivating PD message transfers - Sending and receiving PD messages The driver provides both a functional API as well as callbacks for lower level drivers. Signed-off-by: Guenter Roeck Signed-off-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman drivers/staging/Kconfig | 2 + drivers/staging/Makefile | 2 +- drivers/staging/typec/Kconfig | 11 + drivers/staging/typec/Makefile | 1 + drivers/staging/typec/TODO | 12 + drivers/staging/typec/pd.h | 281 ++++ drivers/staging/typec/pd_bdo.h | 31 + drivers/staging/typec/pd_vdo.h | 249 +++ drivers/staging/typec/tcpm.c | 3465 ++++++++++++++++++++++++++++++++++++++++ drivers/staging/typec/tcpm.h | 150 ++ 10 files changed, 4203 insertions(+), 1 deletion(-) commit 5fe49a9d11644f4aa9034c7eedbcfc6e52373e10 Author: Felix Fietkau Date: Wed Apr 26 17:11:37 2017 +0200 mac80211: add ieee80211_tx_status_ext This allows the driver to pass in struct ieee80211_tx_status directly. Make ieee80211_tx_status_noskb a wrapper around it. As with ieee80211_tx_status_noskb, there is no _ni variant of this call, because it probably won't be needed. Even if the driver won't provide any extra status info other than what's in struct ieee80211_tx_info already, it can optimize status reporting this way by passing in the station pointer. Signed-off-by: Felix Fietkau [use C99 initializers] Signed-off-by: Johannes Berg include/net/mac80211.h | 31 +++++++++++++++++++-- net/mac80211/status.c | 74 +++++++++++++++++++++++++++++++------------------- 2 files changed, 74 insertions(+), 31 deletions(-) commit eefebd3164604a19744dca3df08e050999031d74 Author: Felix Fietkau Date: Wed Apr 26 17:11:36 2017 +0200 mac80211: move ieee80211_tx_status_noskb below ieee80211_tx_status Makes further cleanups more readable Signed-off-by: Felix Fietkau Signed-off-by: Johannes Berg net/mac80211/status.c | 116 +++++++++++++++++++++++++------------------------- 1 file changed, 58 insertions(+), 58 deletions(-) commit 18fb84d986b398c59be6729f38f1c4bbbe8c4e9a Author: Felix Fietkau Date: Wed Apr 26 17:11:35 2017 +0200 mac80211: make rate control tx status API more extensible Rename .tx_status_noskb to .tx_status_ext and pass a new on-stack struct ieee80211_tx_status instead of struct ieee80211_tx_info. This struct can be used to pass extra information, e.g. for dynamic tx power control Signed-off-by: Felix Fietkau Signed-off-by: Johannes Berg include/net/mac80211.h | 20 +++++++++++++---- net/mac80211/rate.c | 22 +++++++++++++++++++ net/mac80211/rate.h | 44 +++----------------------------------- net/mac80211/rc80211_minstrel.c | 6 +++--- net/mac80211/rc80211_minstrel_ht.c | 10 ++++----- net/mac80211/status.c | 11 ++++++++-- 6 files changed, 58 insertions(+), 55 deletions(-) commit dcba665b1f4a5e986f22ac4230d536341d3ea5da Author: Johannes Berg Date: Wed Apr 26 14:51:20 2017 +0200 mac80211: use bitfield macros for encoded rate Instead of hand-coding the bit manipulations, use the bitfield macros to generate the code for the encoded bitrate. Signed-off-by: Johannes Berg net/mac80211/sta_info.c | 26 +++++++++++++----------- net/mac80211/sta_info.h | 54 ++++++++++++++++++++++++++++++++----------------- 2 files changed, 50 insertions(+), 30 deletions(-) commit 8613c94815fcdd358638a22fed50c3f172042aa2 Author: Johannes Berg Date: Wed Apr 26 13:51:41 2017 +0200 mac80211: rename ieee80211_rx_status::vht_nss to just nss This field will need to be used again for HE, so rename it now. Again, mostly done with this spatch: @@ expression status; @@ -status->vht_nss +status->nss @@ expression status; @@ -status.vht_nss +status.nss Signed-off-by: Johannes Berg drivers/net/wireless/ath/ath10k/htt_rx.c | 6 +++--- drivers/net/wireless/intel/iwlwifi/mvm/rx.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 2 +- drivers/net/wireless/mac80211_hwsim.c | 2 +- drivers/net/wireless/realtek/rtlwifi/rtl8821ae/trx.c | 2 +- include/net/mac80211.h | 4 ++-- net/mac80211/rx.c | 8 ++++---- net/mac80211/sta_info.h | 2 +- net/mac80211/util.c | 4 ++-- 9 files changed, 16 insertions(+), 16 deletions(-) commit da6a4352e7c867f81d7336f6517e819b3cce06bf Author: Johannes Berg Date: Wed Apr 26 12:14:59 2017 +0200 mac80211: separate encoding/bandwidth from flags We currently use a lot of flags that are mutually incompatible, separate this out into actual encoding and bandwidth enum values. Much of this again done with spatch, with manual post-editing, mostly to add the switch statements and get rid of the conversions. @@ expression status; @@ -status->enc_flags |= RX_ENC_FLAG_80MHZ +status->bw = RATE_INFO_BW_80 @@ expression status; @@ -status->enc_flags |= RX_ENC_FLAG_40MHZ +status->bw = RATE_INFO_BW_40 @@ expression status; @@ -status->enc_flags |= RX_ENC_FLAG_20MHZ +status->bw = RATE_INFO_BW_20 @@ expression status; @@ -status->enc_flags |= RX_ENC_FLAG_160MHZ +status->bw = RATE_INFO_BW_160 @@ expression status; @@ -status->enc_flags |= RX_ENC_FLAG_5MHZ +status->bw = RATE_INFO_BW_5 @@ expression status; @@ -status->enc_flags |= RX_ENC_FLAG_10MHZ +status->bw = RATE_INFO_BW_10 @@ expression status; @@ -status->enc_flags |= RX_ENC_FLAG_VHT +status->encoding = RX_ENC_VHT @@ expression status; @@ -status->enc_flags |= RX_ENC_FLAG_HT +status->encoding = RX_ENC_HT @@ expression status; @@ -status.enc_flags |= RX_ENC_FLAG_VHT +status.encoding = RX_ENC_VHT @@ expression status; @@ -status.enc_flags |= RX_ENC_FLAG_HT +status.encoding = RX_ENC_HT @@ expression status; @@ -(status->enc_flags & RX_ENC_FLAG_HT) +(status->encoding == RX_ENC_HT) @@ expression status; @@ -(status->enc_flags & RX_ENC_FLAG_VHT) +(status->encoding == RX_ENC_VHT) @@ expression status; @@ -(status->enc_flags & RX_ENC_FLAG_5MHZ) +(status->bw == RATE_INFO_BW_5) @@ expression status; @@ -(status->enc_flags & RX_ENC_FLAG_10MHZ) +(status->bw == RATE_INFO_BW_10) @@ expression status; @@ -(status->enc_flags & RX_ENC_FLAG_40MHZ) +(status->bw == RATE_INFO_BW_40) @@ expression status; @@ -(status->enc_flags & RX_ENC_FLAG_80MHZ) +(status->bw == RATE_INFO_BW_80) @@ expression status; @@ -(status->enc_flags & RX_ENC_FLAG_160MHZ) +(status->bw == RATE_INFO_BW_160) Signed-off-by: Johannes Berg drivers/net/wireless/ath/ath10k/htt_rx.c | 32 ++++++------- drivers/net/wireless/ath/ath5k/base.c | 4 +- drivers/net/wireless/ath/ath9k/ar9003_mac.c | 1 + drivers/net/wireless/ath/ath9k/common.c | 8 ++-- drivers/net/wireless/ath/ath9k/debug_sta.c | 2 +- drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 3 +- drivers/net/wireless/ath/ath9k/mac.c | 1 + drivers/net/wireless/ath/ath9k/mac.h | 2 + drivers/net/wireless/ath/ath9k/recv.c | 4 +- drivers/net/wireless/ath/carl9170/rx.c | 4 +- .../wireless/broadcom/brcm80211/brcmsmac/main.c | 4 +- drivers/net/wireless/intel/iwlegacy/4965-mac.c | 2 +- drivers/net/wireless/intel/iwlwifi/dvm/rx.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/rx.c | 10 ++-- drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 10 ++-- drivers/net/wireless/mac80211_hwsim.c | 4 +- drivers/net/wireless/marvell/mwl8k.c | 12 ++--- drivers/net/wireless/mediatek/mt7601u/mac.c | 4 +- drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 2 +- drivers/net/wireless/ralink/rt2x00/rt2x00dev.c | 4 +- drivers/net/wireless/ralink/rt2x00/rt2x00queue.h | 2 + .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 8 ++-- .../net/wireless/realtek/rtlwifi/rtl8188ee/trx.c | 4 +- .../net/wireless/realtek/rtlwifi/rtl8192ce/trx.c | 4 +- .../net/wireless/realtek/rtlwifi/rtl8192cu/trx.c | 8 ++-- .../net/wireless/realtek/rtlwifi/rtl8192de/trx.c | 4 +- .../net/wireless/realtek/rtlwifi/rtl8192ee/trx.c | 4 +- .../net/wireless/realtek/rtlwifi/rtl8192se/trx.c | 4 +- .../net/wireless/realtek/rtlwifi/rtl8723ae/trx.c | 4 +- .../net/wireless/realtek/rtlwifi/rtl8723be/trx.c | 4 +- .../net/wireless/realtek/rtlwifi/rtl8821ae/trx.c | 8 ++-- drivers/net/wireless/st/cw1200/txrx.c | 2 +- drivers/net/wireless/ti/wlcore/rx.c | 2 +- include/net/mac80211.h | 37 +++++++-------- net/mac80211/ibss.c | 4 +- net/mac80211/ieee80211_i.h | 4 +- net/mac80211/rx.c | 55 +++++++++++++--------- net/mac80211/scan.c | 8 ++-- net/mac80211/sta_info.h | 29 +++++------- net/mac80211/util.c | 43 +++++++++-------- 40 files changed, 182 insertions(+), 171 deletions(-) commit 7fdd69c5af2160236e97668bc1fb7d70855c66ae Author: Johannes Berg Date: Wed Apr 26 11:13:00 2017 +0200 mac80211: clean up rate encoding bits in RX status In preparation for adding support for HE rates, clean up the driver report encoding for rate/bandwidth reporting on RX frames. Much of this patch was done with the following spatch: @@ expression status; @@ -status->flag & (RX_FLAG_HT | RX_FLAG_VHT) +status->enc_flags & (RX_ENC_FLAG_HT | RX_ENC_FLAG_VHT) @@ assignment operator op; expression status; @@ -status->flag op RX_FLAG_SHORTPRE +status->enc_flags op RX_ENC_FLAG_SHORTPRE @@ expression status; @@ -status->flag & RX_FLAG_SHORTPRE +status->enc_flags & RX_ENC_FLAG_SHORTPRE @@ assignment operator op; expression status; @@ -status->flag op RX_FLAG_HT +status->enc_flags op RX_ENC_FLAG_HT @@ expression status; @@ -status->flag & RX_FLAG_HT +status->enc_flags & RX_ENC_FLAG_HT @@ assignment operator op; expression status; @@ -status->flag op RX_FLAG_40MHZ +status->enc_flags op RX_ENC_FLAG_40MHZ @@ expression status; @@ -status->flag & RX_FLAG_40MHZ +status->enc_flags & RX_ENC_FLAG_40MHZ @@ assignment operator op; expression status; @@ -status->flag op RX_FLAG_SHORT_GI +status->enc_flags op RX_ENC_FLAG_SHORT_GI @@ expression status; @@ -status->flag & RX_FLAG_SHORT_GI +status->enc_flags & RX_ENC_FLAG_SHORT_GI @@ assignment operator op; expression status; @@ -status->flag op RX_FLAG_HT_GF +status->enc_flags op RX_ENC_FLAG_HT_GF @@ expression status; @@ -status->flag & RX_FLAG_HT_GF +status->enc_flags & RX_ENC_FLAG_HT_GF @@ assignment operator op; expression status; @@ -status->flag op RX_FLAG_VHT +status->enc_flags op RX_ENC_FLAG_VHT @@ expression status; @@ -status->flag & RX_FLAG_VHT +status->enc_flags & RX_ENC_FLAG_VHT @@ assignment operator op; expression status; @@ -status->flag op RX_FLAG_STBC_MASK +status->enc_flags op RX_ENC_FLAG_STBC_MASK @@ expression status; @@ -status->flag & RX_FLAG_STBC_MASK +status->enc_flags & RX_ENC_FLAG_STBC_MASK @@ assignment operator op; expression status; @@ -status->flag op RX_FLAG_LDPC +status->enc_flags op RX_ENC_FLAG_LDPC @@ expression status; @@ -status->flag & RX_FLAG_LDPC +status->enc_flags & RX_ENC_FLAG_LDPC @@ assignment operator op; expression status; @@ -status->flag op RX_FLAG_10MHZ +status->enc_flags op RX_ENC_FLAG_10MHZ @@ expression status; @@ -status->flag & RX_FLAG_10MHZ +status->enc_flags & RX_ENC_FLAG_10MHZ @@ assignment operator op; expression status; @@ -status->flag op RX_FLAG_5MHZ +status->enc_flags op RX_ENC_FLAG_5MHZ @@ expression status; @@ -status->flag & RX_FLAG_5MHZ +status->enc_flags & RX_ENC_FLAG_5MHZ @@ assignment operator op; expression status; @@ -status->vht_flag op RX_VHT_FLAG_80MHZ +status->enc_flags op RX_ENC_FLAG_80MHZ @@ expression status; @@ -status->vht_flag & RX_VHT_FLAG_80MHZ +status->enc_flags & RX_ENC_FLAG_80MHZ @@ assignment operator op; expression status; @@ -status->vht_flag op RX_VHT_FLAG_160MHZ +status->enc_flags op RX_ENC_FLAG_160MHZ @@ expression status; @@ -status->vht_flag & RX_VHT_FLAG_160MHZ +status->enc_flags & RX_ENC_FLAG_160MHZ @@ assignment operator op; expression status; @@ -status->vht_flag op RX_VHT_FLAG_BF +status->enc_flags op RX_ENC_FLAG_BF @@ expression status; @@ -status->vht_flag & RX_VHT_FLAG_BF +status->enc_flags & RX_ENC_FLAG_BF @@ assignment operator op; expression status, STBC; @@ -status->flag op STBC << RX_FLAG_STBC_SHIFT +status->enc_flags op STBC << RX_ENC_FLAG_STBC_SHIFT @@ assignment operator op; expression status; @@ -status.flag op RX_FLAG_SHORTPRE +status.enc_flags op RX_ENC_FLAG_SHORTPRE @@ expression status; @@ -status.flag & RX_FLAG_SHORTPRE +status.enc_flags & RX_ENC_FLAG_SHORTPRE @@ assignment operator op; expression status; @@ -status.flag op RX_FLAG_HT +status.enc_flags op RX_ENC_FLAG_HT @@ expression status; @@ -status.flag & RX_FLAG_HT +status.enc_flags & RX_ENC_FLAG_HT @@ assignment operator op; expression status; @@ -status.flag op RX_FLAG_40MHZ +status.enc_flags op RX_ENC_FLAG_40MHZ @@ expression status; @@ -status.flag & RX_FLAG_40MHZ +status.enc_flags & RX_ENC_FLAG_40MHZ @@ assignment operator op; expression status; @@ -status.flag op RX_FLAG_SHORT_GI +status.enc_flags op RX_ENC_FLAG_SHORT_GI @@ expression status; @@ -status.flag & RX_FLAG_SHORT_GI +status.enc_flags & RX_ENC_FLAG_SHORT_GI @@ assignment operator op; expression status; @@ -status.flag op RX_FLAG_HT_GF +status.enc_flags op RX_ENC_FLAG_HT_GF @@ expression status; @@ -status.flag & RX_FLAG_HT_GF +status.enc_flags & RX_ENC_FLAG_HT_GF @@ assignment operator op; expression status; @@ -status.flag op RX_FLAG_VHT +status.enc_flags op RX_ENC_FLAG_VHT @@ expression status; @@ -status.flag & RX_FLAG_VHT +status.enc_flags & RX_ENC_FLAG_VHT @@ assignment operator op; expression status; @@ -status.flag op RX_FLAG_STBC_MASK +status.enc_flags op RX_ENC_FLAG_STBC_MASK @@ expression status; @@ -status.flag & RX_FLAG_STBC_MASK +status.enc_flags & RX_ENC_FLAG_STBC_MASK @@ assignment operator op; expression status; @@ -status.flag op RX_FLAG_LDPC +status.enc_flags op RX_ENC_FLAG_LDPC @@ expression status; @@ -status.flag & RX_FLAG_LDPC +status.enc_flags & RX_ENC_FLAG_LDPC @@ assignment operator op; expression status; @@ -status.flag op RX_FLAG_10MHZ +status.enc_flags op RX_ENC_FLAG_10MHZ @@ expression status; @@ -status.flag & RX_FLAG_10MHZ +status.enc_flags & RX_ENC_FLAG_10MHZ @@ assignment operator op; expression status; @@ -status.flag op RX_FLAG_5MHZ +status.enc_flags op RX_ENC_FLAG_5MHZ @@ expression status; @@ -status.flag & RX_FLAG_5MHZ +status.enc_flags & RX_ENC_FLAG_5MHZ @@ assignment operator op; expression status; @@ -status.vht_flag op RX_VHT_FLAG_80MHZ +status.enc_flags op RX_ENC_FLAG_80MHZ @@ expression status; @@ -status.vht_flag & RX_VHT_FLAG_80MHZ +status.enc_flags & RX_ENC_FLAG_80MHZ @@ assignment operator op; expression status; @@ -status.vht_flag op RX_VHT_FLAG_160MHZ +status.enc_flags op RX_ENC_FLAG_160MHZ @@ expression status; @@ -status.vht_flag & RX_VHT_FLAG_160MHZ +status.enc_flags & RX_ENC_FLAG_160MHZ @@ assignment operator op; expression status; @@ -status.vht_flag op RX_VHT_FLAG_BF +status.enc_flags op RX_ENC_FLAG_BF @@ expression status; @@ -status.vht_flag & RX_VHT_FLAG_BF +status.enc_flags & RX_ENC_FLAG_BF @@ assignment operator op; expression status, STBC; @@ -status.flag op STBC << RX_FLAG_STBC_SHIFT +status.enc_flags op STBC << RX_ENC_FLAG_STBC_SHIFT @@ @@ -RX_FLAG_STBC_SHIFT +RX_ENC_FLAG_STBC_SHIFT Signed-off-by: Johannes Berg drivers/net/wireless/ath/ath10k/htt_rx.c | 46 ++++----- drivers/net/wireless/ath/ath5k/base.c | 6 +- drivers/net/wireless/ath/ath9k/ar9003_mac.c | 6 +- drivers/net/wireless/ath/ath9k/common.c | 9 +- drivers/net/wireless/ath/ath9k/debug_sta.c | 6 +- drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 6 +- drivers/net/wireless/ath/ath9k/mac.c | 14 +-- drivers/net/wireless/ath/ath9k/mac.h | 2 +- drivers/net/wireless/ath/ath9k/recv.c | 8 +- drivers/net/wireless/ath/carl9170/rx.c | 8 +- drivers/net/wireless/ath/wcn36xx/txrx.c | 2 +- drivers/net/wireless/broadcom/b43/xmit.c | 2 +- .../wireless/broadcom/brcm80211/brcmsmac/main.c | 10 +- drivers/net/wireless/intel/iwlegacy/3945.c | 2 +- drivers/net/wireless/intel/iwlegacy/4965-mac.c | 8 +- drivers/net/wireless/intel/iwlwifi/dvm/rx.c | 10 +- drivers/net/wireless/intel/iwlwifi/mvm/rx.c | 24 ++--- drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 24 ++--- drivers/net/wireless/intersil/p54/txrx.c | 2 +- drivers/net/wireless/mac80211_hwsim.c | 8 +- drivers/net/wireless/marvell/mwl8k.c | 16 +-- drivers/net/wireless/mediatek/mt7601u/mac.c | 12 +-- drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 4 +- drivers/net/wireless/ralink/rt2x00/rt2x00dev.c | 3 +- drivers/net/wireless/ralink/rt2x00/rt2x00queue.h | 1 + drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 2 +- drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 2 +- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 10 +- .../net/wireless/realtek/rtlwifi/rtl8188ee/trx.c | 4 +- .../net/wireless/realtek/rtlwifi/rtl8192ce/trx.c | 4 +- .../net/wireless/realtek/rtlwifi/rtl8192cu/trx.c | 8 +- .../net/wireless/realtek/rtlwifi/rtl8192de/trx.c | 4 +- .../net/wireless/realtek/rtlwifi/rtl8192ee/trx.c | 4 +- .../net/wireless/realtek/rtlwifi/rtl8192se/trx.c | 4 +- .../net/wireless/realtek/rtlwifi/rtl8723ae/trx.c | 4 +- .../net/wireless/realtek/rtlwifi/rtl8723be/trx.c | 4 +- .../net/wireless/realtek/rtlwifi/rtl8821ae/trx.c | 10 +- drivers/net/wireless/st/cw1200/txrx.c | 2 +- drivers/net/wireless/ti/wl1251/rx.c | 2 +- drivers/net/wireless/ti/wlcore/rx.c | 2 +- include/net/mac80211.h | 108 ++++++++++----------- net/mac80211/ibss.c | 4 +- net/mac80211/ieee80211_i.h | 2 +- net/mac80211/rx.c | 58 +++++------ net/mac80211/scan.c | 8 +- net/mac80211/sta_info.h | 16 +-- net/mac80211/util.c | 22 ++--- 47 files changed, 261 insertions(+), 262 deletions(-) commit b86c86aa9805b25ee70071d084e618b2c40641b5 Author: Dan Carpenter Date: Wed Apr 26 22:08:15 2017 +0300 gpio: f7188x: Add a missing break A break statement was obviously intended here. Fixes: d69843e416d3 ("gpio: f7188x: Add F71889A GPIO support.") Signed-off-by: Dan Carpenter Signed-off-by: Linus Walleij drivers/gpio/gpio-f7188x.c | 1 + 1 file changed, 1 insertion(+) commit 7b4ccb3c466f62bbf2f4dd5d6a143d945a6f3051 Author: Geert Uytterhoeven Date: Tue Apr 25 19:36:25 2017 +0200 soc: renesas: Provide dummy rcar_rst_read_mode_pins() for compile-testing If the R-Car RST driver is not included, compile-testing R-Car clock drivers fails with a link error: undefined reference to `rcar_rst_read_mode_pins' To fix this, provide a dummy version. Use the exact same test logic as in drivers/soc/renesas/Makefile, as there is no Kconfig symbol (yet) to control compilation of the R-Car RST driver. Fixes: 527c02f66d263d2e ("soc: renesas: Add R-Car RST driver") Signed-off-by: Geert Uytterhoeven Signed-off-by: Simon Horman include/linux/soc/renesas/rcar-rst.h | 5 +++++ 1 file changed, 5 insertions(+) commit 1aa2faf52f76d49669f6613b9521618ab2bc63b2 Author: Sean Wang Date: Wed Apr 26 17:25:45 2017 +0800 pinctrl: mediatek: Add missing pinctrl bindings for mt7623 Add missing pinctrl binding these which would be used in devicetree related files. Signed-off-by: Sean Wang Signed-off-by: Linus Walleij include/dt-bindings/pinctrl/mt7623-pinfunc.h | 30 ++++++++++++++++++++++++---- 1 file changed, 26 insertions(+), 4 deletions(-) commit 83977443938122baeed28dc9f078db3da9855f7c Author: David Rivshin Date: Mon Apr 24 18:56:50 2017 -0400 gpio: omap: return error if requested debounce time is not possible omap_gpio_debounce() does not validate that the requested debounce is within a range it can handle. Instead it lets the register value wrap silently, and always returns success. This can lead to all sorts of unexpected behavior, such as gpio_keys asking for a too-long debounce, but getting a very short debounce in practice. Fix this by returning -EINVAL if the requested value does not fit into the register field. If there is no debounce clock available at all, return -ENOTSUPP. Fixes: e85ec6c3047b ("gpio: omap: fix omap2_set_gpio_debounce") Cc: # 4.3+ Signed-off-by: David Rivshin Acked-by: Grygorii Strashko Signed-off-by: Linus Walleij drivers/gpio/gpio-omap.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) commit 9384793036afb7529c1c564e839ef4356271d68e Author: Marek Vasut Date: Tue Apr 25 20:32:09 2017 +0200 gpio: Add ROHM BD9571MWV-M PMIC GPIO driver Add driver for the GPIO block in the ROHM BD9571MWV-W MFD PMIC. This block is pretty trivial and supports setting GPIO direction as Input/Output and in case of Output, supports setting value. Signed-off-by: Marek Vasut Cc: linux-gpio@vger.kernel.org Cc: Geert Uytterhoeven Cc: Linus Walleij Reviewed-by: Linus Walleij Signed-off-by: Linus Walleij drivers/gpio/Kconfig | 11 ++++ drivers/gpio/Makefile | 1 + drivers/gpio/gpio-bd9571mwv.c | 144 ++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 156 insertions(+) commit c312c2c333b88145b3073cf5acd8362af3f0cc6e Author: Wei Yongjun Date: Tue Apr 25 11:29:30 2017 +0000 pinctrl: artpec6: Fix return value check in artpec6_pmx_probe() In case of error, the function pinctrl_register() returns ERR_PTR() not NULL. The NULL test in the return value check should be replaced with IS_ERR(). Signed-off-by: Wei Yongjun Acked-by: Jesper Nilsson Signed-off-by: Linus Walleij drivers/pinctrl/pinctrl-artpec6.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 881ebd229f4a5ea88f269c1225245e50db9ba303 Author: Kuppuswamy Sathyanarayanan Date: Mon Apr 24 12:15:04 2017 -0700 gpio: gpio-wcove: fix GPIO IRQ status mask According to Whiskey Cove PMIC spec, bit 7 of GPIOIRQ0_REG belongs to battery IO. So we should skip this bit when checking for GPIO IRQ pending status. Otherwise, wcove_gpio_irq_handler() might go into the infinite loop until IRQ "pending" status becomes 0. This patch fixes this issue. Signed-off-by: Kuppuswamy Sathyanarayanan Acked-by: Mika Westerberg Acked-by: Andy Shevchenko Signed-off-by: Linus Walleij drivers/gpio/gpio-wcove.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit da63b6b20077469bd6bd96e07991ce145fc4fbc4 Author: Baoquan He Date: Thu Apr 27 15:42:20 2017 +0800 x86/KASLR: Fix kexec kernel boot crash when KASLR randomization fails Dave found that a kdump kernel with KASLR enabled will reset to the BIOS immediately if physical randomization failed to find a new position for the kernel. A kernel with the 'nokaslr' option works in this case. The reason is that KASLR will install a new page table for the identity mapping, while it missed building it for the original kernel location if KASLR physical randomization fails. This only happens in the kexec/kdump kernel, because the identity mapping has been built for kexec/kdump in the 1st kernel for the whole memory by calling init_pgtable(). Here if physical randomizaiton fails, it won't build the identity mapping for the original area of the kernel but change to a new page table '_pgtable'. Then the kernel will triple fault immediately caused by no identity mappings. The normal kernel won't see this bug, because it comes here via startup_32() and CR3 will be set to _pgtable already. In startup_32() the identity mapping is built for the 0~4G area. In KASLR we just append to the existing area instead of entirely overwriting it for on-demand identity mapping building. So the identity mapping for the original area of kernel is still there. To fix it we just switch to the new identity mapping page table when physical KASLR succeeds. Otherwise we keep the old page table unchanged just like "nokaslr" does. Signed-off-by: Baoquan He Signed-off-by: Dave Young Acked-by: Kees Cook Cc: Borislav Petkov Cc: Dave Jiang Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Garnier Cc: Thomas Gleixner Cc: Yinghai Lu Link: http://lkml.kernel.org/r/1493278940-5885-1-git-send-email-bhe@redhat.com Signed-off-by: Ingo Molnar arch/x86/boot/compressed/kaslr.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) commit 3a7d2fd16c57a1ef47dc2891171514231c9c7c6e Author: Kees Cook Date: Thu Apr 27 15:53:21 2017 -0700 pstore: Solve lockdep warning by moving inode locks Lockdep complains about a possible deadlock between mount and unlink (which is technically impossible), but fixing this improves possible future multiple-backend support, and keeps locking in the right order. The lockdep warning could be triggered by unlinking a file in the pstore filesystem: -> #1 (&sb->s_type->i_mutex_key#14){++++++}: lock_acquire+0xc9/0x220 down_write+0x3f/0x70 pstore_mkfile+0x1f4/0x460 pstore_get_records+0x17a/0x320 pstore_fill_super+0xa4/0xc0 mount_single+0x89/0xb0 pstore_mount+0x13/0x20 mount_fs+0xf/0x90 vfs_kern_mount+0x66/0x170 do_mount+0x190/0xd50 SyS_mount+0x90/0xd0 entry_SYSCALL_64_fastpath+0x1c/0xb1 -> #0 (&psinfo->read_mutex){+.+.+.}: __lock_acquire+0x1ac0/0x1bb0 lock_acquire+0xc9/0x220 __mutex_lock+0x6e/0x990 mutex_lock_nested+0x16/0x20 pstore_unlink+0x3f/0xa0 vfs_unlink+0xb5/0x190 do_unlinkat+0x24c/0x2a0 SyS_unlinkat+0x16/0x30 entry_SYSCALL_64_fastpath+0x1c/0xb1 Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&sb->s_type->i_mutex_key#14); lock(&psinfo->read_mutex); lock(&sb->s_type->i_mutex_key#14); lock(&psinfo->read_mutex); Reported-by: Marta Lofstedt Reported-by: Chris Wilson Signed-off-by: Kees Cook Acked-by: Namhyung Kim fs/pstore/inode.c | 37 +++++++++++++++++++++++++++---------- fs/pstore/internal.h | 5 ++++- fs/pstore/platform.c | 10 +++++----- 3 files changed, 36 insertions(+), 16 deletions(-) commit a37c45cd82e62a361706b9688a984a3a63957321 Author: Michael Davidson Date: Tue Apr 25 15:47:35 2017 -0700 kbuild: clang: add -no-integrated-as to KBUILD_[AC]FLAGS The Linux Kernel relies on GCC's acceptance of inline assembly as an opaque object which will not have any validation performed on the content. The current behaviour in LLVM is to perform validation of the contents by means of parsing the input if the MC layer can handle it. Disable clangs integrated assembler and use the GNU assembler instead. Wording-mostly-from: Saleem Abdulrasool Signed-off-by: Michael Davidson Signed-off-by: Matthias Kaehlcke Signed-off-by: Masahiro Yamada Makefile | 2 ++ 1 file changed, 2 insertions(+) commit 81d0848fc8d2058c4cc645d971435c889869433b Author: Frank Rowand Date: Tue Apr 25 17:09:54 2017 -0700 of: Add unit tests for applying overlays Existing overlay unit tests examine individual pieces of the overlay code. The new tests target the entire process of applying an overlay. Signed-off-by: Frank Rowand Signed-off-by: Rob Herring drivers/of/fdt.c | 14 +- drivers/of/of_private.h | 12 + drivers/of/unittest-data/Makefile | 17 +- drivers/of/unittest-data/overlay.dts | 53 ++++ drivers/of/unittest-data/overlay_bad_phandle.dts | 20 ++ drivers/of/unittest-data/overlay_base.dts | 80 ++++++ drivers/of/unittest.c | 317 +++++++++++++++++++++++ 7 files changed, 505 insertions(+), 8 deletions(-) commit 331f741679564720a49ccf355012e1a8a45686ec Author: Frank Rowand Date: Tue Apr 25 17:09:53 2017 -0700 of: per-file dtc compiler flags The dtc compiler version that adds initial support was available in 4.11-rc1. Add the ability to set an additional dtc compiler flag is needed by overlays. Signed-off-by: Frank Rowand Acked-by: Masahiro Yamada Signed-off-by: Rob Herring scripts/Makefile.lib | 2 ++ 1 file changed, 2 insertions(+) commit fb7dcf723dd2cb1d5d8f2f49c3023130938848e3 Merge: db4b0df 5af5099 Author: Paul Mackerras Date: Fri Apr 28 08:23:16 2017 +1000 Merge remote-tracking branch 'remotes/powerpc/topic/xive' into kvm-ppc-next This merges in the powerpc topic/xive branch to bring in the code for the in-kernel XICS interrupt controller emulation to use the new XIVE (eXternal Interrupt Virtualization Engine) hardware in the POWER9 chip directly, rather than via a XICS emulation in firmware. Signed-off-by: Paul Mackerras commit db4b0dfab7b016f5514442046d86a9727ee87f12 Author: Denis Kirjanov Date: Wed Mar 29 06:55:37 2017 -0400 KVM: PPC: Book3S HV: Avoid preemptibility warning in module initialization With CONFIG_DEBUG_PREEMPT, get_paca() produces the following warning in kvmppc_book3s_init_hv() since it calls debug_smp_processor_id(). There is no real issue with the xics_phys field. If paca->kvm_hstate.xics_phys is non-zero on one cpu, it will be non-zero on them all. Therefore this is not fixing any actual problem, just the warning. [ 138.521188] BUG: using smp_processor_id() in preemptible [00000000] code: modprobe/5596 [ 138.521308] caller is .kvmppc_book3s_init_hv+0x184/0x350 [kvm_hv] [ 138.521404] CPU: 5 PID: 5596 Comm: modprobe Not tainted 4.11.0-rc3-00022-gc7e790c #1 [ 138.521509] Call Trace: [ 138.521563] [c0000007d018b810] [c0000000023eef10] .dump_stack+0xe4/0x150 (unreliable) [ 138.521694] [c0000007d018b8a0] [c000000001f6ec04] .check_preemption_disabled+0x134/0x150 [ 138.521829] [c0000007d018b940] [d00000000a010274] .kvmppc_book3s_init_hv+0x184/0x350 [kvm_hv] [ 138.521963] [c0000007d018ba00] [c00000000191d5cc] .do_one_initcall+0x5c/0x1c0 [ 138.522082] [c0000007d018bad0] [c0000000023e9494] .do_init_module+0x84/0x240 [ 138.522201] [c0000007d018bb70] [c000000001aade18] .load_module+0x1f68/0x2a10 [ 138.522319] [c0000007d018bd20] [c000000001aaeb30] .SyS_finit_module+0xc0/0xf0 [ 138.522439] [c0000007d018be30] [c00000000191baec] system_call+0x38/0xfc Signed-off-by: Denis Kirjanov Signed-off-by: Paul Mackerras arch/powerpc/kvm/book3s_hv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ed6473ddc704a2005b9900ca08e236ebb2d8540a Author: Trond Myklebust Date: Wed Apr 26 11:55:27 2017 -0400 NFSv4: Fix callback server shutdown We want to use kthread_stop() in order to ensure the threads are shut down before we tear down the nfs_callback_info in nfs_callback_down. Tested-and-reviewed-by: Kinglong Mee Reported-by: Kinglong Mee Fixes: bb6aeba736ba9 ("NFSv4.x: Switch to using svc_set_num_threads()...") Signed-off-by: Trond Myklebust Signed-off-by: J. Bruce Fields fs/nfs/callback.c | 24 ++++++++++++++++-------- include/linux/sunrpc/svc.h | 1 + net/sunrpc/svc.c | 38 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 55 insertions(+), 8 deletions(-) commit 9e0d87680d689f1758185851c3da6eafb16e71e1 Author: Trond Myklebust Date: Wed Apr 26 11:55:26 2017 -0400 SUNRPC: Refactor svc_set_num_threads() Refactor to separate out the functions of starting and stopping threads so that they can be used in other helpers. Signed-off-by: Trond Myklebust Tested-and-reviewed-by: Kinglong Mee Signed-off-by: J. Bruce Fields net/sunrpc/svc.c | 96 ++++++++++++++++++++++++++++++++++---------------------- 1 file changed, 58 insertions(+), 38 deletions(-) commit df807fffaabde625fa9adb82e3e5b88cdaa5709a Author: Kinglong Mee Date: Thu Apr 27 11:13:38 2017 +0800 NFSv4.x/callback: Create the callback service through svc_create_pooled As the comments for svc_set_num_threads() said, " Destroying threads relies on the service threads filling in rqstp->rq_task, which only the nfs ones do. Assumes the serv has been created using svc_create_pooled()." If creating service through svc_create(), the svc_pool_map_put() will be called in svc_destroy(), but the pool map isn't used. So that, the reference of pool map will be drop, the next using of pool map will get a zero npools. [ 137.992130] divide error: 0000 [#1] SMP [ 137.992148] Modules linked in: nfsd(E) nfsv4 nfs fscache fuse tun bridge stp llc ip_set nfnetlink vmw_vsock_vmci_transport vsock snd_seq_midi snd_seq_midi_event vmw_balloon coretemp crct10dif_pclmul crc32_pclmul ppdev ghash_clmulni_intel intel_rapl_perf joydev snd_ens1371 gameport snd_ac97_codec ac97_bus snd_seq snd_pcm snd_rawmidi snd_timer snd_seq_device snd soundcore parport_pc parport nfit acpi_cpufreq tpm_tis tpm_tis_core tpm vmw_vmci i2c_piix4 shpchp auth_rpcgss nfs_acl lockd(E) grace sunrpc(E) xfs libcrc32c vmwgfx drm_kms_helper ttm crc32c_intel drm e1000 mptspi scsi_transport_spi serio_raw mptscsih mptbase ata_generic pata_acpi [last unloaded: nfsd] [ 137.992336] CPU: 0 PID: 4514 Comm: rpc.nfsd Tainted: G E 4.11.0-rc8+ #536 [ 137.992777] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/02/2015 [ 137.993757] task: ffff955984101d00 task.stack: ffff9873c2604000 [ 137.994231] RIP: 0010:svc_pool_for_cpu+0x2b/0x80 [sunrpc] [ 137.994768] RSP: 0018:ffff9873c2607c18 EFLAGS: 00010246 [ 137.995227] RAX: 0000000000000000 RBX: ffff95598376f000 RCX: 0000000000000002 [ 137.995673] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9559944aec00 [ 137.996156] RBP: ffff9873c2607c18 R08: ffff9559944aec28 R09: 0000000000000000 [ 137.996609] R10: 0000000001080002 R11: 0000000000000000 R12: ffff95598376f010 [ 137.997063] R13: ffff95598376f018 R14: ffff9559944aec28 R15: ffff9559944aec00 [ 137.997584] FS: 00007f755529eb40(0000) GS:ffff9559bb600000(0000) knlGS:0000000000000000 [ 137.998048] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 137.998548] CR2: 000055f3aecd9660 CR3: 0000000084290000 CR4: 00000000001406f0 [ 137.999052] Call Trace: [ 137.999517] svc_xprt_do_enqueue+0xef/0x260 [sunrpc] [ 138.000028] svc_xprt_received+0x47/0x90 [sunrpc] [ 138.000487] svc_add_new_perm_xprt+0x76/0x90 [sunrpc] [ 138.000981] svc_addsock+0x14b/0x200 [sunrpc] [ 138.001424] ? recalc_sigpending+0x1b/0x50 [ 138.001860] ? __getnstimeofday64+0x41/0xd0 [ 138.002346] ? do_gettimeofday+0x29/0x90 [ 138.002779] write_ports+0x255/0x2c0 [nfsd] [ 138.003202] ? _copy_from_user+0x4e/0x80 [ 138.003676] ? write_recoverydir+0x100/0x100 [nfsd] [ 138.004098] nfsctl_transaction_write+0x48/0x80 [nfsd] [ 138.004544] __vfs_write+0x37/0x160 [ 138.004982] ? selinux_file_permission+0xd7/0x110 [ 138.005401] ? security_file_permission+0x3b/0xc0 [ 138.005865] vfs_write+0xb5/0x1a0 [ 138.006267] SyS_write+0x55/0xc0 [ 138.006654] entry_SYSCALL_64_fastpath+0x1a/0xa9 [ 138.007071] RIP: 0033:0x7f7554b9dc30 [ 138.007437] RSP: 002b:00007ffc9f92c788 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 138.007807] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f7554b9dc30 [ 138.008168] RDX: 0000000000000002 RSI: 00005640cd536640 RDI: 0000000000000003 [ 138.008573] RBP: 00007ffc9f92c780 R08: 0000000000000001 R09: 0000000000000002 [ 138.008918] R10: 0000000000000064 R11: 0000000000000246 R12: 0000000000000004 [ 138.009254] R13: 00005640cdbf77a0 R14: 00005640cdbf7720 R15: 00007ffc9f92c238 [ 138.009610] Code: 0f 1f 44 00 00 48 8b 87 98 00 00 00 55 48 89 e5 48 83 78 08 00 74 10 8b 05 07 42 02 00 83 f8 01 74 40 83 f8 02 74 19 31 c0 31 d2 b7 88 00 00 00 5d 89 d0 48 c1 e0 07 48 03 87 90 00 00 00 c3 [ 138.010664] RIP: svc_pool_for_cpu+0x2b/0x80 [sunrpc] RSP: ffff9873c2607c18 [ 138.011061] ---[ end trace b3468224cafa7d11 ]--- Signed-off-by: Kinglong Mee Signed-off-by: J. Bruce Fields fs/nfs/callback.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9bb0e9cb04c82d6bf0e72f3207307d621083b801 Author: Stan Drozd Date: Fri Apr 21 13:16:03 2017 +0200 docs: Fix a couple typos This commit gets rid of some minor errors in Documentation/: * cputopology.txt: drawes -> drawers * debugging-via-ohci1394.txt: remove an unnecessary line break * static-keys: statemnts -> statements * zorro.txt: busses -> buses Signed-off-by: Stan Drozd Signed-off-by: Jonathan Corbet Documentation/cputopology.txt | 2 +- Documentation/debugging-via-ohci1394.txt | 4 ++-- Documentation/static-keys.txt | 2 +- Documentation/zorro.txt | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) commit 1c4f128ed1cbadcfcb3c2d654b39268d592f716f Author: Stan Drozd Date: Fri Apr 21 13:07:10 2017 +0200 docs: Fix a spelling error in vfio-mediated-device.txt This commit fixes a repeated "the" in vfio-mediated-device.txt and reflows the paragraph. Signed-off-by: Stan Drozd Signed-off-by: Jonathan Corbet Documentation/vfio-mediated-device.txt | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit e884dbcb3c8cc829ca434248ea0aeb5c4198eef3 Author: Stan Drozd Date: Fri Apr 21 12:58:52 2017 +0200 docs: Fix a spelling error in ioctl-number.txt This commit fixes a misspelled header name in the ioctl numbers list Signed-off-by: Stan Drozd Signed-off-by: Jonathan Corbet Documentation/ioctl/ioctl-number.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 83e676c90134106106c251a13dff3209ae46f8ed Author: Tobias Klauser Date: Fri Apr 21 15:59:04 2017 +0200 MAINTAINERS: update file entry for HSI subsystem The HSI documentation was moved into Documentation/driver-api/hsi.rst in commit 5e995786850e ("docs: split up serial-interfaces.rst"). Update the corresponding file entry in MAINTAINERS. Signed-off-by: Tobias Klauser Signed-off-by: Jonathan Corbet MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 041939c1ec54208b42f5cd819209173d52a29d34 Author: Ankit Kumar Date: Thu Apr 27 17:03:13 2017 +0530 pstore: Fix flags to enable dumps on powerpc After commit c950fd6f201a kernel registers pstore write based on flag set. Pstore write for powerpc is broken as flags(PSTORE_FLAGS_DMESG) is not set for powerpc architecture. On panic, kernel doesn't write message to /fs/pstore/dmesg*(Entry doesn't gets created at all). This patch enables pstore write for powerpc architecture by setting PSTORE_FLAGS_DMESG flag. Fixes: c950fd6f201a ("pstore: Split pstore fragile flags") Cc: stable@vger.kernel.org # v4.9+ Signed-off-by: Ankit Kumar Signed-off-by: Kees Cook arch/powerpc/kernel/nvram_64.c | 1 + 1 file changed, 1 insertion(+) commit 3509d048c8a813a8f903ffd5f8dc5ca66e3d8716 Author: Geliang Tang Date: Thu Mar 23 21:15:13 2017 +0800 pstore: Remove unused vmalloc.h in pmsg Since the vmalloc code has been removed from write_pmsg() in the commit "5bf6d1b pstore/pmsg: drop bounce buffer", remove the unused header vmalloc.h. Signed-off-by: Geliang Tang Signed-off-by: Kees Cook fs/pstore/pmsg.c | 1 - 1 file changed, 1 deletion(-) commit e221c1f0fe2590042b4f8c3a8ccccd8e7bed2c31 Merge: 899dc83 47d272f Author: David S. Miller Date: Thu Apr 27 17:15:54 2017 -0400 Merge tag 'wireless-drivers-next-for-davem-2017-04-27' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next Kalle Valo says: ==================== wireless-drivers-next patches for 4.12 Few remaining patches for 4.12 submitted during the last week. Major changes: iwlwifi * the firmware for 7265D and 3168 NICs is frozen at version 29 * more support for the upcoming A000 series ==================== Signed-off-by: David S. Miller commit bce19f9d232b71c4eef9ca7d0947035bbb922cef Merge: c2a9c7a a7e3b97 Author: Chris Mason Date: Thu Apr 27 14:13:09 2017 -0700 Merge branch 'for-chris-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/fdmanana/linux into for-linus-4.12 commit 86331f39a5935b092d3ea59446d416563ed05d16 Author: Bart Van Assche Date: Thu Apr 27 10:11:26 2017 -0700 dm mpath: make it easier to detect unintended I/O request flushes I/O errors triggered by multipathd incorrectly not enabling the no-flush flag for DM_DEVICE_SUSPEND or DM_DEVICE_RESUME are hard to debug. Add more logging to make it easier to debug this. Signed-off-by: Bart Van Assche Reviewed-by: Hannes Reinecke Signed-off-by: Mike Snitzer drivers/md/dm-mpath.c | 25 +++++++++++++++++++++---- drivers/md/dm.c | 2 ++ 2 files changed, 23 insertions(+), 4 deletions(-) commit 9a8ac3ae682e8760afebab71556a9a8d1b18f906 Author: Bart Van Assche Date: Thu Apr 27 10:11:25 2017 -0700 dm mpath: cleanup QUEUE_IF_NO_PATH bit manipulation by introducing assign_bit() No functional change but makes the code easier to read. Signed-off-by: Bart Van Assche Reviewed-by: Hannes Reinecke Signed-off-by: Mike Snitzer drivers/md/dm-mpath.c | 36 +++++++++++++++--------------------- 1 file changed, 15 insertions(+), 21 deletions(-) commit ca5beb76c32af33e5be4e01c85c8bd5a067c4543 Author: Bart Van Assche Date: Thu Apr 27 10:11:24 2017 -0700 dm mpath: micro-optimize the hot path relative to MPATHF_QUEUE_IF_NO_PATH Instead of checking MPATHF_QUEUE_IF_NO_PATH, MPATHF_SAVED_QUEUE_IF_NO_PATH and the no_flush flag to decide whether or not to push back a request (or bio) if there are no paths available, only clear MPATHF_QUEUE_IF_NO_PATH in queue_if_no_path() if no_flush has not been set. The result is that only a single bit has to be tested in the hot path to decide whether or not a request must be pushed back and also that m->lock does not have to be taken in the hot path. Signed-off-by: Bart Van Assche Reviewed-by: Hannes Reinecke Signed-off-by: Mike Snitzer drivers/md/dm-mpath.c | 70 ++++++++------------------------------------------- 1 file changed, 11 insertions(+), 59 deletions(-) commit 7e0d574f2683a2346c978613a72ff07afc89b17a Author: Bart Van Assche Date: Thu Apr 27 10:11:23 2017 -0700 dm: introduce enum dm_queue_mode to cleanup related code Introduce an enumeration type for the queue mode. This patch does not change any functionality but makes the DM code easier to read. Signed-off-by: Bart Van Assche Reviewed-by: Hannes Reinecke Signed-off-by: Mike Snitzer drivers/md/dm-core.h | 2 +- drivers/md/dm-ioctl.c | 2 +- drivers/md/dm-mpath.c | 5 ++++- drivers/md/dm-table.c | 14 +++++++------- drivers/md/dm.c | 11 +++++++---- drivers/md/dm.h | 8 ++++---- include/linux/device-mapper.h | 14 ++++++++------ 7 files changed, 32 insertions(+), 24 deletions(-) commit b194679fac3067e785f432109c69759aa75b038c Author: Bart Van Assche Date: Thu Apr 27 10:11:22 2017 -0700 dm mpath: verify __pg_init_all_paths locking assumptions at runtime Verify at runtime that __pg_init_all_paths() is called with multipath.lock held if lockdep is enabled. Signed-off-by: Bart Van Assche Reviewed-by: Hannes Reinecke Signed-off-by: Mike Snitzer drivers/md/dm-mpath.c | 2 ++ 1 file changed, 2 insertions(+) commit 1ea0654e46eb62acc379000be2f16350101ebf85 Author: Bart Van Assche Date: Thu Apr 27 10:11:21 2017 -0700 dm: verify suspend_locking assumptions at runtime Ensure that the assumptions about the caller holding suspend_lock are checked at runtime if lockdep is enabled. Signed-off-by: Bart Van Assche Reviewed-by: Hannes Reinecke Signed-off-by: Mike Snitzer drivers/md/dm-table.c | 4 ++++ drivers/md/dm.c | 6 ++++-- 2 files changed, 8 insertions(+), 2 deletions(-) commit 73cbca6a637eb88738ea5a5cd6a611bbbca8ac19 Author: Bart Van Assche Date: Thu Apr 27 10:11:20 2017 -0700 dm block manager: remove an unused argument from dm_block_manager_create() The 'cache_size' argument of dm_block_manager_create() has never been used. Remove it along with the definitions of the constants passed as the 'cache_size' argument. Signed-off-by: Bart Van Assche Reviewed-by: Hannes Reinecke Signed-off-by: Mike Snitzer drivers/md/dm-cache-metadata.c | 3 --- drivers/md/dm-era-target.c | 2 -- drivers/md/dm-thin-metadata.c | 2 -- drivers/md/persistent-data/dm-block-manager.c | 1 - drivers/md/persistent-data/dm-block-manager.h | 2 +- 5 files changed, 1 insertion(+), 9 deletions(-) commit 23a601248958fa4142d49294352fe8d1fdf3e509 Author: Bart Van Assche Date: Thu Apr 27 10:11:19 2017 -0700 dm rq: check blk_mq_register_dev() return value in dm_mq_init_request_queue() Otherwise the request-based DM blk-mq request_queue will be put into service without being properly exported via sysfs. Cc: stable@vger.kernel.org Signed-off-by: Bart Van Assche Reviewed-by: Hannes Reinecke Cc: Christoph Hellwig Signed-off-by: Mike Snitzer drivers/md/dm-rq.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit c1d7ecf7ca11d0edd3085262c8597203440d056c Author: Bart Van Assche Date: Thu Apr 27 10:11:16 2017 -0700 dm mpath: delay requeuing while path initialization is in progress Requeuing a request immediately while path initialization is ongoing causes high CPU usage, something that is undesired. Hence delay requeuing while path initialization is in progress. Signed-off-by: Bart Van Assche Reviewed-by: Hannes Reinecke Cc: Christoph Hellwig Cc: Signed-off-by: Mike Snitzer drivers/md/dm-mpath.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) commit 7083abbbfc4fa706ff72d27d33a5214881979336 Author: Bart Van Assche Date: Thu Apr 27 10:11:15 2017 -0700 dm mpath: avoid that path removal can trigger an infinite loop If blk_get_request() fails, check whether the failure is due to a path being removed. If that is the case, fail the path by triggering a call to fail_path(). This avoids that the following scenario can be encountered while removing paths: * CPU usage of a kworker thread jumps to 100%. * Removing the DM device becomes impossible. Delay requeueing if blk_get_request() returns -EBUSY or -EWOULDBLOCK, and the queue is not dying, because in these cases immediate requeuing is inappropriate. Signed-off-by: Bart Van Assche Cc: Hannes Reinecke Cc: Christoph Hellwig Cc: Signed-off-by: Mike Snitzer drivers/md/dm-mpath.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) commit 43ac9b84a399bc10210a2d9f4e0778b7c6059c07 Author: Xiao Ni Date: Thu Apr 27 16:28:49 2017 +0800 md/raid1: Use a new variable to count flighting sync requests In new barrier codes, raise_barrier waits if conf->nr_pending[idx] is not zero. After all the conditions are true, the resync request can go on be handled. But it adds conf->nr_pending[idx] again. The next resync request hit the same bucket idx need to wait the resync request which is submitted before. The performance of resync/recovery is degraded. So we should use a new variable to count sync requests which are in flight. I did a simple test: 1. Without the patch, create a raid1 with two disks. The resync speed: Device: rrqm/s wrqm/s r/s w/s rMB/s wMB/s avgrq-sz avgqu-sz await r_await w_await svctm %util sdb 0.00 0.00 166.00 0.00 10.38 0.00 128.00 0.03 0.20 0.20 0.00 0.19 3.20 sdc 0.00 0.00 0.00 166.00 0.00 10.38 128.00 0.96 5.77 0.00 5.77 5.75 95.50 2. With the patch, the result is: sdb 2214.00 0.00 766.00 0.00 185.69 0.00 496.46 2.80 3.66 3.66 0.00 1.03 79.10 sdc 0.00 2205.00 0.00 769.00 0.00 186.44 496.52 5.25 6.84 0.00 6.84 1.30 100.10 Suggested-by: Shaohua Li Signed-off-by: Xiao Ni Acked-by: Coly Li Signed-off-by: Shaohua Li drivers/md/raid1.c | 7 ++++--- drivers/md/raid1.h | 1 + 2 files changed, 5 insertions(+), 3 deletions(-) commit 89bfce763e43fa4897e0d3af6b29ed909df64cfd Author: Bart Van Assche Date: Thu Apr 27 10:11:14 2017 -0700 dm mpath: split and rename activate_path() to prepare for its expanded use activate_path() is renamed to activate_path_work() which now calls activate_or_offline_path(). activate_or_offline_path() will be used by the next commit. Signed-off-by: Bart Van Assche Cc: Hannes Reinecke Cc: Christoph Hellwig Cc: Signed-off-by: Mike Snitzer drivers/md/dm-mpath.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) commit 899dc833f09e5dae3288e6908d6eea1759b2eb50 Merge: 26d31ac d179bd1 Author: David S. Miller Date: Thu Apr 27 16:51:35 2017 -0400 Merge branch 'qed-ptp-enhancements' Sudarsana Reddy Kalluru says: ==================== qed*: PTP enhancements. The patch series contains set of enhancements for qed/qede ptp implementation. Patches (1)-(3) adds resource locking implementation to allow PTP functionality only on the first detected ethernet PF of the port. The change is required as the adapter currently supports only one instance of the PTP client on a given port. Patch (4) removes the un-needed header file. Patch (5) moves the ptt-lock get/release logic to the ptp specific code. Please consider applying this series to "net-next" branch. ==================== Signed-off-by: David S. Miller commit d179bd1699fccd9d5b9bc38470bab7343a441ea0 Author: sudarsana.kalluru@cavium.com Date: Wed Apr 26 09:00:53 2017 -0700 qed: Acquire/release ptt_ptp lock when enabling/disabling PTP. Move the code for acquiring/releasing ptt_ptp lock to ptp specific implementations i.e., ptp_enable()/disable() respectively. Signed-off-by: Sudarsana Reddy Kalluru Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed.h | 7 +++++-- drivers/net/ethernet/qlogic/qed/qed_main.c | 12 ------------ drivers/net/ethernet/qlogic/qed/qed_ptp.c | 15 ++++++++++++++- 3 files changed, 19 insertions(+), 15 deletions(-) commit 6a3ff0db13110fad9ecaf9554e0a1f93c5d7b774 Author: sudarsana.kalluru@cavium.com Date: Wed Apr 26 09:00:52 2017 -0700 qed: Remove the un-needed ptp header file. The patch deletes the qed_ptp.h file which is not required. Signed-off-by: Sudarsana Reddy Kalluru Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_ptp.c | 1 - drivers/net/ethernet/qlogic/qed/qed_ptp.h | 47 ------------------------------- 2 files changed, 48 deletions(-) commit 035744975aecf9b8e02920d93027a432c51062d1 Author: sudarsana.kalluru@cavium.com Date: Wed Apr 26 09:00:51 2017 -0700 qede: Add support for PTP resource locking. The patch adds necessary changes to the driver to use qed resource locking functionality. Currently the ptp initialization is spread between driver probe/open implementations, associated APIs are qede_ptp_register_phc()/qede_ptp_start(). Clubbed this functionality into single API qed_ptp_enable() to simplify the usage of qed resource locking implementation. The new API will be invoked in the probe path. Similarly the ptp clean-up code is moved to qede_ptp_disable() which gets invoked in the driver unload path. Signed-off-by: Sudarsana Reddy Kalluru Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qede/qede_main.c | 18 +--- drivers/net/ethernet/qlogic/qede/qede_ptp.c | 150 +++++++++++++-------------- drivers/net/ethernet/qlogic/qede/qede_ptp.h | 6 +- 3 files changed, 75 insertions(+), 99 deletions(-) commit db82f70e4c3e0901ba1e5c0eecbd913133261985 Author: sudarsana.kalluru@cavium.com Date: Wed Apr 26 09:00:50 2017 -0700 qed: Add support for PTP resource locking. The patch adds support for per-port resource lock in favour of PTP. PTP module acquires/releases the MFW resource lock while enabling/ disabling the PTP on the interface. The PF instance which has the ownership of this resource lock will get the exclusive access to the PTP clock functionality on the port. Signed-off-by: Sudarsana Reddy Kalluru Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed.h | 1 + drivers/net/ethernet/qlogic/qed/qed_dev.c | 14 +++++ drivers/net/ethernet/qlogic/qed/qed_mcp.h | 4 ++ drivers/net/ethernet/qlogic/qed/qed_ptp.c | 87 +++++++++++++++++++++++++++++++ 4 files changed, 106 insertions(+) commit f470f22cfa3d42f357ed404a06ec77aa09ddb05b Author: sudarsana.kalluru@cavium.com Date: Wed Apr 26 09:00:49 2017 -0700 qed: Add support for MFW resource locking. The patch adds API for default initialization of the MFW resource locking. Signed-off-by: Sudarsana Reddy Kalluru Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_dev.c | 12 ++---------- drivers/net/ethernet/qlogic/qed/qed_mcp.c | 30 ++++++++++++++++++++++++++++++ drivers/net/ethernet/qlogic/qed/qed_mcp.h | 18 +++++++++++++++++- 3 files changed, 49 insertions(+), 11 deletions(-) commit 97681f9b086ac4009ed914fdc56b0ebbfafe8b3d Author: Toshi Kani Date: Tue Apr 25 15:16:51 2017 -0600 libnvdimm: fix phys_addr for nvdimm_clear_poison nvdimm_clear_poison() expects a physical address, not an offset. Fix nsio_rw_bytes() to call nvdimm_clear_poison() with a physical address. Signed-off-by: Toshi Kani Cc: Dave Jiang Cc: Vishal Verma Reviewed-by: Vishal Verma Signed-off-by: Dan Williams drivers/nvdimm/claim.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 26d31ac11fa47a0ee8dc4c64136ea34feda57e3e Author: David Ahern Date: Wed Apr 26 07:58:22 2017 -0700 net: vrf: Do not allow looback to be moved to a VRF Moving the loopback into a VRF breaks networking for the default VRF. Since the VRF device is the loopback for VRF domains, there is no reason to move the loopback. Given the repercussions, block attempts to set lo into a VRF. Signed-off-by: David Ahern Reviewed-by: Greg Rose Signed-off-by: David S. Miller drivers/net/vrf.c | 6 ++++++ 1 file changed, 6 insertions(+) commit adeb45cbb5057731ce9c47aad93756135d7947bf Author: Wei Yongjun Date: Wed Apr 26 14:03:50 2017 +0000 fib_rules: fix error return code Fix to return error code -EINVAL from the error handling case instead of 0, as done elsewhere in this function. Fixes: 622ec2c9d524 ("net: core: add UID to flows, rules, and routes") Signed-off-by: Wei Yongjun Signed-off-by: David S. Miller net/core/fib_rules.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 99f906e9ad7b6e79ffeda30f45906a8448b9d6a2 Author: Mike Manning Date: Wed Apr 26 14:48:09 2017 +0100 bridge: add per-port broadcast flood flag Support for l2 multicast flood control was added in commit b6cb5ac8331b ("net: bridge: add per-port multicast flood flag"). It allows broadcast as it was introduced specifically for unknown multicast flood control. But as broadcast is a special case of multicast, this may also need to be disabled. For this purpose, introduce a flag to disable the flooding of received l2 broadcasts. This approach is backwards compatible and provides flexibility in filtering for the desired packet types. Cc: Nikolay Aleksandrov Signed-off-by: Mike Manning Reviewed-by: Nikolay Aleksandrov Signed-off-by: David S. Miller include/linux/if_bridge.h | 1 + include/uapi/linux/if_link.h | 1 + net/bridge/br_forward.c | 24 +++++++++++++++++------- net/bridge/br_if.c | 2 +- net/bridge/br_netlink.c | 3 +++ net/bridge/br_sysfs_if.c | 2 ++ 6 files changed, 25 insertions(+), 8 deletions(-) commit 06b4fc520d21b7a6327983d64373505859672e91 Author: Gao Feng Date: Wed Apr 26 19:04:04 2017 +0800 net: fib: Decrease one unnecessary rt cache flush in fib_disable_ip The func fib_flush already flushes the rt cache if necessary, so it is not necessary to invoke rt_cache_flush again in fib_disable_ip. Signed-off-by: Gao Feng Signed-off-by: David S. Miller net/ipv4/fib_frontend.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 1514dc857f8ebbeb44da09236efa133ed6e15615 Author: Guillaume Nault Date: Wed Apr 26 11:54:47 2017 +0200 l2tp: remove useless device duplication test in l2tp_eth_create() There's no need to verify that cfg->ifname is unique at this point. register_netdev() will return -EEXIST if asked to create a device with a name that's alrealy in use. Signed-off-by: Guillaume Nault Signed-off-by: David S. Miller net/l2tp/l2tp_eth.c | 6 ------ 1 file changed, 6 deletions(-) commit 0575c86b5dd596253bdfc0365b570d67b1a12523 Author: Zhang Shengju Date: Wed Apr 26 17:49:38 2017 +0800 net: remove unnecessary carrier status check Since netif_carrier_on() will do nothing if device's carrier is already on, so it's unnecessary to do carrier status check. It's the same for netif_carrier_off(). Signed-off-by: Zhang Shengju Signed-off-by: David S. Miller net/core/dev.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) commit 8ecbc40ada116f2f7d6b61cd646802c87b7c5c7d Author: Zhang Shengju Date: Wed Apr 26 11:05:12 2017 +0800 net: update comment for netif_dormant() function This patch updates the comment for netif_dormant() function to reflect the intended usage. Signed-off-by: Zhang Shengju Signed-off-by: David S. Miller include/linux/netdevice.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 900a9020af7a023f9b64c919fddf8a7486108962 Author: Arnd Bergmann Date: Tue Apr 18 15:55:51 2017 +0200 arm64: sunxi: always enable reset controller The sunxi clk driver causes a link error when the reset controller subsystem is disabled: drivers/clk/built-in.o: In function `sun4i_ve_clk_setup': :(.init.text+0xd040): undefined reference to `reset_controller_register' drivers/clk/built-in.o: In function `sun4i_a10_display_init': :(.init.text+0xe5e0): undefined reference to `reset_controller_register' drivers/clk/built-in.o: In function `sunxi_usb_clk_setup': :(.init.text+0x10074): undefined reference to `reset_controller_register' We already force it to be enabled on arm32 and some other arm64 platforms, but not on arm64/sunxi. This adds the respective Kconfig statements to also select it here. Signed-off-by: Arnd Bergmann Acked-by: Maxime Ripard arch/arm64/Kconfig.platforms | 2 ++ 1 file changed, 2 insertions(+) commit 3c0e3abd5ee59acbcbd5d8fc624eaf63f6e7b53c Author: Orson Zhai Date: Fri Apr 21 11:47:20 2017 +0800 arm64: dts: Add basic DT to support Spreadtrum's SP9860G SC9860G is a 8 cores of A53 SoC with 4G LTE support SoC from Spreadtrum. According to regular hierarchy of sprd dts, whale2.dtsi contains SoC peripherals IP nodes, sc9860.dtsi contains stuff related to ARM core stuff and sp9860g dts is for the board level. Signed-off-by: Orson Zhai Signed-off-by: Chunyan Zhang Reviewed-by: Mathieu Poirier Signed-off-by: Arnd Bergmann arch/arm64/boot/dts/sprd/Makefile | 3 +- arch/arm64/boot/dts/sprd/sc9860.dtsi | 569 ++++++++++++++++++++++++++++++ arch/arm64/boot/dts/sprd/sp9860g-1h10.dts | 56 +++ arch/arm64/boot/dts/sprd/whale2.dtsi | 71 ++++ 4 files changed, 698 insertions(+), 1 deletion(-) commit b6942b68f85ed3161c91741791ec6f1779574919 Merge: d12523f 7574f67 Author: Arnd Bergmann Date: Thu Apr 27 21:49:14 2017 +0200 Merge branch 'for_4.12/soc-pmdomain-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/ssantosh/linux-keystone into next/drivers Pull "Keystone mangled URLs fixed" from Santosh Shilimkar * 'for_4.12/soc-pmdomain-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/ssantosh/linux-keystone: soc: pm-domain: Fix the mangled urls commit b9f34da74e1c4b5f2574333277cd8d8f53bad056 Merge: 6d14b5a 6a611d1 Author: Arnd Bergmann Date: Thu Apr 27 21:47:50 2017 +0200 Merge tag 'samsung-dt-4.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into next/dt Pull "Fix DTC warnings in Exynos ARMv7 Device Tree sources." from Krzysztof Kozłowski: * tag 'samsung-dt-4.12-2' of git://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: ARM: dts: exynos: Use - instead of @ for DT OPP entries commit 052bc8fc8f6de1d015ed7714a77ad65c9d9b2e4f Merge: ae706be 684c581 Author: Arnd Bergmann Date: Thu Apr 27 21:45:13 2017 +0200 Merge tag 'samsung-dt64-4.12-3' of git://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into next/dt64 Pull "Second update of Samsung DeviceTree ARM64 for v4.12" from Krzysztof Kozłowski: - Fix DTC warnings in Exynos ARM64 Device Tree sources. - Add panel node to TM2E board. * tag 'samsung-dt64-4.12-3' of git://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: arm64: dts: exynos: Use - instead of @ for DT OPP entries arm64: dts: exynos: Add support for s6e3hf2 panel device on TM2e board commit ae706bebd6a172a6adf9f63d1a77b8ed49e998a6 Merge: d0815df f9936c4 Author: Arnd Bergmann Date: Thu Apr 27 21:43:42 2017 +0200 Merge tag 'juno-fixes-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into next/dt64 Pull "ARMv8 Juno DT fixes for v4.12" from Sudeep Holla: 1. Couple of fixes to remove device tree warnings introduced with recently added checks in DTC 2. Add information about L1 and L2 caches to Juno device trees as CCSIDR-based cacheinfo probing is now removed * tag 'juno-fixes-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: arm64: dts: juno: add information about L1 and L2 caches arm64: dts: juno: fix few unit address format warnings arm64: dts: juno: fix PCI bus dtc warnings commit 6d14b5a0baa3f8e987a27762c60a2c7a7b31288c Merge: 28a59b6 e6a7efa Author: Arnd Bergmann Date: Thu Apr 27 21:40:15 2017 +0200 Merge tag 'vexpress-dt-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into next/dt Pull "ARMv7 VExpress DT fix for v4.12" from Sudeep Holla: A single fix to remove device tree warnings introduced with recently added checks in DTC * tag 'vexpress-dt-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: ARM: dts: vexpress: fix few unit address format warnings commit 36b5a5152119cd08760067ca31d8577de993c490 Author: Jose Abreu Date: Wed Feb 22 18:19:35 2017 +0000 arc: axs10x: Fix ARC PGU default clock frequency Default clock frequency for ARC PGU does not match any existing HDMI mode, instead the default value matches a DVI mode. Change the clock frequency to 74.25MHz so that it matches HDMI mode 1280x720@60Hz Signed-off-by: Jose Abreu Cc: Carlos Palminha Cc: Alexey Brodkin Cc: Rob Herring Cc: Vineet Gupta Cc: devicetree@vger.kernel.org Cc: linux-snps-arc@lists.infradead.org Cc: linux-kernel@vger.kernel.org Acked-by: Alexey Brodkin Signed-off-by: Vineet Gupta arch/arc/boot/dts/axs10x_mb.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c8581984ffd917736ab3630c0f07bb5b218411e3 Author: Jose Abreu Date: Wed Feb 22 18:19:34 2017 +0000 arc: axs10x: Add DT bindings for I2S audio playback This patch adds the necessary DT bindings to get HDMI audio output in ARC AXS10x SDP. The bindings for I2S controller were added as well as the bindings for simple audio card. Signed-off-by: Jose Abreu Cc: Carlos Palminha Cc: Alexey Brodkin Cc: Rob Herring Cc: Vineet Gupta Cc: devicetree@vger.kernel.org Cc: linux-snps-arc@lists.infradead.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Vineet Gupta arch/arc/boot/dts/axs10x_mb.dtsi | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) commit 4617f564c06117c7d1b611be49521a4430042287 Author: Adrian Salido Date: Thu Apr 27 10:32:55 2017 -0700 dm ioctl: prevent stack leak in dm ioctl call When calling a dm ioctl that doesn't process any data (IOCTL_FLAGS_NO_PARAMS), the contents of the data field in struct dm_ioctl are left initialized. Current code is incorrectly extending the size of data copied back to user, causing the contents of kernel stack to be leaked to user. Fix by only copying contents before data and allow the functions processing the ioctl to override. Cc: stable@vger.kernel.org Signed-off-by: Adrian Salido Reviewed-by: Alasdair G Kergon Signed-off-by: Mike Snitzer drivers/md/dm-ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3c3781951c9a155a56e5eed567349118374cc315 Author: Lukas Czerner Date: Thu Apr 27 08:59:36 2017 -0700 xfs: Allow user to kill fstrim process fstrim can take really long time on big, slow device or on file system with a lots of allocation groups. Currently there is no way for the user to cancell the operation. This patch makes it possible for the user to kill fstrim pocess by adding the check for fatal_signal_pending() in xfs_trim_extents(). Signed-off-by: Lukas Czerner Reported-by: Zdenek Kabelac Reviewed-by: Eric Sandeen Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/xfs_discard.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) commit b06e13c38dbd5a03e945ce711f6909c91888f507 Merge: c35e30b 7569b90 Author: Jens Axboe Date: Thu Apr 27 11:33:01 2017 -0600 Merge branch 'nvme-4.12' of git://git.infradead.org/nvme into for-4.12/post-merge Christoph writes: "A couple more updates for 4.12. The biggest pile is fc and lpfc updates from James, but there are various small fixes and cleanups as well." Fixes up a few merge issues, and also a warning in lpfc_nvmet_rcv_unsol_abort() if CONFIG_NVME_TARGET_FC isn't enabled. Signed-off-by: Jens Axboe commit 3993f2cb983b2100409851f7b2abb21d685ea19c Author: David Ahern Date: Thu Apr 27 09:11:13 2017 -0700 samples/bpf: Add support for SKB_MODE to xdp1 and xdp_tx_iptunnel Add option to xdp1 and xdp_tx_iptunnel to insert xdp program in SKB_MODE: - update set_link_xdp_fd to take a flags argument that is added to the RTM_SETLINK message - Add -S option to xdp1 and xdp_tx_iptunnel user code. When passed in XDP_FLAGS_SKB_MODE is set in the flags arg passed to set_link_xdp_fd Signed-off-by: David Ahern Acked-by: Alexei Starovoitov Signed-off-by: David S. Miller samples/bpf/bpf_load.c | 19 +++++++++++++++--- samples/bpf/bpf_load.h | 2 +- samples/bpf/xdp1_user.c | 40 ++++++++++++++++++++++++++++++-------- samples/bpf/xdp_tx_iptunnel_user.c | 13 +++++++++---- 4 files changed, 58 insertions(+), 16 deletions(-) commit 63af8f7a8293b94787763c933abfd21ba852807f Author: Christoph Hellwig Date: Fri Apr 14 21:11:28 2017 +0200 ixgbe: Use pcie_flr() instead of duplicating it Signed-off-by: Christoph Hellwig Signed-off-by: Bjorn Helgaas Acked-by: Jeff Kirsher drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 16 ++-------------- 1 file changed, 2 insertions(+), 14 deletions(-) commit 84ff1bcc2e25f1ddf5b350c4fa718ca01fdd88e9 Author: Mikulas Patocka Date: Wed Apr 26 18:39:47 2017 -0400 dm integrity: use previously calculated log2 of sectors_per_block The log2 of sectors_per_block was already calculated, so we don't have to use the ilog2 function. Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer drivers/md/dm-integrity.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 6625d903253eb6f003849823e22d7b8de5bfb5b2 Author: Mikulas Patocka Date: Thu Apr 27 11:49:33 2017 -0400 dm integrity: use hex2bin instead of open-coded variant Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer drivers/md/dm-integrity.c | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) commit e944e03e336f7ffa02aabc71291933d93dcd077c Author: Andy Shevchenko Date: Thu Apr 27 16:52:04 2017 +0300 dm crypt: replace custom implementation of hex2bin() There is no need to have a duplication of the generic library, i.e. hex2bin(). Replace the open coded variant. Signed-off-by: Andy Shevchenko Tested-by: Milan Broz Signed-off-by: Mike Snitzer drivers/md/dm-crypt.c | 27 ++------------------------- 1 file changed, 2 insertions(+), 25 deletions(-) commit 6d684e54690caef45cf14051ddeb7c71beeb681b Author: Herbert Xu Date: Thu Apr 27 13:44:51 2017 +0800 rhashtable: Cap total number of entries to 2^31 When max_size is not set or if it set to a sufficiently large value, the nelems counter can overflow. This would cause havoc with the automatic shrinking as it would then attempt to fit a huge number of entries into a tiny hash table. This patch fixes this by adding max_elems to struct rhashtable to cap the number of elements. This is set to 2^31 as nelems is not a precise count. This is sufficiently smaller than UINT_MAX that it should be safe. When max_size is set max_elems will be lowered to at most twice max_size as is the status quo. Signed-off-by: Herbert Xu Signed-off-by: David S. Miller include/linux/rhashtable.h | 5 +++-- lib/rhashtable.c | 5 +++++ 2 files changed, 8 insertions(+), 2 deletions(-) commit 4b726e81dab2cefefd2c1cb00e3074ac0eec4b15 Author: Eric Dumazet Date: Wed Apr 26 21:10:55 2017 -0700 tcp: tcp_rack_reo_timeout() must update tp->tcp_mstamp I wrongly assumed tp->tcp_mstamp was up to date at the time tcp_rack_reo_timeout() was called. It is not true, since we only update tcp->tcp_mstamp when receiving a packet (as initially done in commit 69e996c58a35 ("tcp: add tp->tcp_mstamp field") tcp_rack_reo_timeout() being called by a timer and not an incoming packet, we need to refresh tp->tcp_mstamp Fixes: 7c1c7308592f ("tcp: do not pass timestamp to tcp_rack_detect_loss()") Signed-off-by: Eric Dumazet Cc: Soheil Hassas Yeganeh Cc: Neal Cardwell Cc: Yuchung Cheng Acked-by: Soheil Hassas Yeganeh Acked-by: Neal Cardwell Signed-off-by: David S. Miller net/ipv4/tcp_recovery.c | 1 + 1 file changed, 1 insertion(+) commit b5fe223a4bd0217a657ff084e48752c367a8a55f Author: Paul E. McKenney Date: Thu Apr 27 07:52:35 2017 -0700 srcu: Adjust default auto-expediting holdoff The default value for the kernel boot parameter srcutree.exp_holdoff is 50 microseconds, which is too long for good Tree SRCU performance (compared to Classic SRCU) on the workloads tested by Mike Galbraith. This commit therefore sets the default value to 25 microseconds, which shows excellent results in Mike's testing. Reported-by: Mike Galbraith Signed-off-by: Paul E. McKenney Tested-by: Mike Galbraith kernel/rcu/srcutree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c24a7be2110ddac2ab75abcded76c62dccb6b1f0 Merge: 70f3aac 1edb632 Author: Paolo Bonzini Date: Thu Apr 27 17:33:14 2017 +0200 Merge tag 'kvm-arm-for-v4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/ARM Changes for v4.12. Changes include: - Using the common sysreg definitions between KVM and arm64 - Improved hyp-stub implementation with support for kexec and kdump on the 32-bit side - Proper PMU exception handling - Performance improvements of our GIC handling - Support for irqchip in userspace with in-kernel arch-timers and PMU support - A fix for a race condition in our PSCI code Conflicts: Documentation/virtual/kvm/api.txt include/uapi/linux/kvm.h commit 275292d3a3d62670b1b13484707b74e5239b4bb0 Author: Matt Ranostay Date: Thu Apr 27 00:52:32 2017 -0700 iio: proximity: as3935: fix AS3935_INT mask AS3935 interrupt mask has been incorrect so valid lightning events would never trigger an buffer event. Also noise interrupt should be BIT(0). Fixes: 24ddb0e4bba4 ("iio: Add AS3935 lightning sensor support") CC: stable@vger.kernel.org Signed-off-by: Matt Ranostay Signed-off-by: Jonathan Cameron drivers/iio/proximity/as3935.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 70f3aac964ae2bc9a0a1d5d65a62e258591ade18 Author: Jim Mattson Date: Wed Apr 26 08:53:46 2017 -0700 kvm: nVMX: Remove superfluous VMX instruction fault checks According to the Intel SDM, "Certain exceptions have priority over VM exits. These include invalid-opcode exceptions, faults based on privilege level*, and general-protection exceptions that are based on checking I/O permission bits in the task-state segment (TSS)." There is no need to check for faulting conditions that the hardware has already checked. * These include faults generated by attempts to execute, in virtual-8086 mode, privileged instructions that are not recognized in that mode. Signed-off-by: Jim Mattson Signed-off-by: Paolo Bonzini arch/x86/kvm/vmx.c | 57 ++++++++++++++---------------------------------------- 1 file changed, 14 insertions(+), 43 deletions(-) commit 6ed071f051e12cf7baa1b69d3becb8f232fdfb7b Author: Ladi Prosek Date: Tue Apr 25 16:42:44 2017 +0200 KVM: x86: fix emulation of RSM and IRET instructions On AMD, the effect of set_nmi_mask called by emulate_iret_real and em_rsm on hflags is reverted later on in x86_emulate_instruction where hflags are overwritten with ctxt->emul_flags (the kvm_set_hflags call). This manifests as a hang when rebooting Windows VMs with QEMU, OVMF, and >1 vcpu. Instead of trying to merge ctxt->emul_flags into vcpu->arch.hflags after an instruction is emulated, this commit deletes emul_flags altogether and makes the emulator access vcpu->arch.hflags using two new accessors. This way all changes, on the emulator side as well as in functions called from the emulator and accessing vcpu state with emul_to_vcpu, are preserved. More details on the bug and its manifestation with Windows and OVMF: It's a KVM bug in the interaction between SMI/SMM and NMI, specific to AMD. I believe that the SMM part explains why we started seeing this only with OVMF. KVM masks and unmasks NMI when entering and leaving SMM. When KVM emulates the RSM instruction in em_rsm, the set_nmi_mask call doesn't stick because later on in x86_emulate_instruction we overwrite arch.hflags with ctxt->emul_flags, effectively reverting the effect of the set_nmi_mask call. The AMD-specific hflag of interest here is HF_NMI_MASK. When rebooting the system, Windows sends an NMI IPI to all but the current cpu to shut them down. Only after all of them are parked in HLT will the initiating cpu finish the restart. If NMI is masked, other cpus never get the memo and the initiating cpu spins forever, waiting for hal!HalpInterruptProcessorsStarted to drop. That's the symptom we observe. Fixes: a584539b24b8 ("KVM: x86: pass the whole hflags field to emulator and back") Signed-off-by: Ladi Prosek Signed-off-by: Paolo Bonzini arch/x86/include/asm/kvm_emulate.h | 4 +++- arch/x86/kvm/emulate.c | 16 +++++++++------- arch/x86/kvm/x86.c | 15 ++++++++++++--- 3 files changed, 24 insertions(+), 11 deletions(-) commit 83896c68fd32895ba4ff685c4df9d1e794dfb4fe Author: Naresh Kamboju Date: Wed Apr 26 15:39:37 2017 +0530 selftests: create cpufreq kconfig fragments For the better test coverage of cpufreq driver code these extra configurations are needed. Enable cpufreq governors and stats. Signed-off-by: Naresh Kamboju Acked-by: Viresh Kumar Signed-off-by: Shuah Khan tools/testing/selftests/cpufreq/config | 15 +++++++++++++++ 1 file changed, 15 insertions(+) commit eebed11a3d6b013054b130665b48620a969062e9 Author: Shuah Khan Date: Fri Apr 21 16:26:16 2017 -0600 selftests: x86: override clean in lib.mk to fix warnings Add override with EXTRA_CLEAN for lib.mk clean to fix the following warnings from clean target run. Makefile:44: warning: overriding recipe for target 'clean' ../lib.mk:55: warning: ignoring old recipe for target 'clean' Signed-off-by: Shuah Khan tools/testing/selftests/x86/Makefile | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 8ab02e0962bf91126797fefb9775dd1ffa54d29d Author: Shuah Khan Date: Fri Apr 21 16:25:25 2017 -0600 selftests: sync: override clean in lib.mk to fix warnings Add override with EXTRA_CLEAN for lib.mk clean to fix the following warnings from clean target run. Makefile:24: warning: overriding recipe for target 'clean' ../lib.mk:55: warning: ignoring old recipe for target 'clean' Signed-off-by: Shuah Khan tools/testing/selftests/sync/Makefile | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit de0c6742ffd89b48970fefc8ccf9f5ac43ba17c6 Author: Shuah Khan Date: Fri Apr 21 16:24:09 2017 -0600 selftests: splice: override clean in lib.mk to fix warnings Add override with EXTRA_CLEAN for lib.mk clean to fix the following warnings from clean target run. Makefile:8: warning: overriding recipe for target 'clean' ../lib.mk:55: warning: ignoring old recipe for target 'clean' Signed-off-by: Shuah Khan tools/testing/selftests/splice/Makefile | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 339318080b028fe347c279672da63c1cd5e52044 Author: Jens Axboe Date: Thu Apr 27 07:45:46 2017 -0600 blk-mq-sched: alloate reserved tags out of normal pool At least one driver, mtip32xx, has a hard coded dependency on the value of the reserved tag used for internal commands. While that should really be fixed up, for now let's ensure that we just bypass the scheduler tags an allocation marked as reserved. They are used for house keeping or error handling, so we can safely ignore them in the scheduler. Tested-by: Ming Lei Signed-off-by: Jens Axboe block/blk-mq-sched.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit a4e84aae8139aca9fbfbced1f45c51ca81b57488 Author: Ming Lei Date: Thu Apr 27 07:45:18 2017 -0600 mtip32xx: use runtime tag to initialize command header mtip32xx supposes that 'request_idx' passed to .init_request() is tag of the request, and use that as request's tag to initialize command header. After MQ IO scheduler is in, request tag assigned isn't same with the request index anymore, so cause strange hardware failure on mtip32xx, even whole system panic is triggered. This patch fixes the issue by initializing command header via request's real tag. Signed-off-by: Ming Lei Signed-off-by: Jens Axboe drivers/block/mtip32xx/mtip32xx.c | 36 ++++++++++++++++++++++++------------ 1 file changed, 24 insertions(+), 12 deletions(-) commit 7a97cec26b94c909f4cbad2dc3186af3e457a522 Author: Paolo Bonzini Date: Thu Apr 27 14:33:43 2017 +0200 KVM: mark requests that need synchronization kvm_make_all_requests() provides a synchronization that waits until all kicked VCPUs have acknowledged the kick. This is important for KVM_REQ_MMU_RELOAD as it prevents freeing while lockless paging is underway. This patch adds the synchronization property into all requests that are currently being used with kvm_make_all_requests() in order to preserve the current behavior and only introduce a new framework. Removing it from requests where it is not necessary is left for future patches. Signed-off-by: Radim Krčmář Signed-off-by: Paolo Bonzini arch/arm/include/asm/kvm_host.h | 2 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/x86/include/asm/kvm_host.h | 6 +++--- include/linux/kvm_host.h | 9 +++++---- virt/kvm/kvm_main.c | 25 ++++++++++++++++++++++--- 5 files changed, 32 insertions(+), 12 deletions(-) commit 096ff2ddba83bf022d593a3096d683e57c4befb0 Author: Naveen N. Rao Date: Tue Apr 25 19:25:54 2017 +0530 powerpc/ftrace/64: Split further based on -mprofile-kernel Split ftrace_64.S further retaining the core ftrace 64-bit aspects in ftrace_64.S and moving ftrace_caller() and ftrace_graph_caller() into separate files based on -mprofile-kernel. The livepatch routines are all now contained within the mprofile file. Signed-off-by: Naveen N. Rao Signed-off-by: Michael Ellerman arch/powerpc/kernel/trace/Makefile | 5 + arch/powerpc/kernel/trace/ftrace_64.S | 306 +------------------------ arch/powerpc/kernel/trace/ftrace_64_mprofile.S | 272 ++++++++++++++++++++++ arch/powerpc/kernel/trace/ftrace_64_pg.S | 68 ++++++ 4 files changed, 346 insertions(+), 305 deletions(-) commit 7853f9c029ac9134df42ea9e0d6bc600180f268d Author: Naveen N. Rao Date: Tue Apr 25 19:25:53 2017 +0530 powerpc: Split ftrace bits into a separate file entry_*.S now includes a lot more than just kernel entry/exit code. As a first step at cleaning this up, let's split out the ftrace bits into separate files. Also move all related tracing code into a new trace/ subdirectory. No functional changes. Suggested-by: Michael Ellerman Signed-off-by: Naveen N. Rao Signed-off-by: Michael Ellerman arch/powerpc/kernel/Makefile | 9 +- arch/powerpc/kernel/entry_32.S | 107 ------ arch/powerpc/kernel/entry_64.S | 378 ------------------- arch/powerpc/kernel/ftrace.c | 620 -------------------------------- arch/powerpc/kernel/trace/Makefile | 24 ++ arch/powerpc/kernel/trace/ftrace.c | 620 ++++++++++++++++++++++++++++++++ arch/powerpc/kernel/trace/ftrace_32.S | 118 ++++++ arch/powerpc/kernel/trace/ftrace_64.S | 389 ++++++++++++++++++++ arch/powerpc/kernel/trace/trace_clock.c | 15 + arch/powerpc/kernel/trace_clock.c | 15 - 10 files changed, 1167 insertions(+), 1128 deletions(-) commit 2505820f7ce2da2ef4ca5bd02fc239df0ba87c9f Author: Christophe Leroy Date: Tue Apr 18 08:20:15 2017 +0200 powerpc/mm: Rename table dump file name Page table dump debugfs file is named 'kernel_page_tables' on all other architectures implementing it, while is is named 'kernel_pagetables' on powerpc. This patch renames it. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman arch/powerpc/mm/dump_linuxpagetables.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 78a18dbf0104641662d6c28e6832cc24776ba2bc Author: Christophe Leroy Date: Thu Apr 13 14:41:40 2017 +0200 powerpc/mm: On PPC32, display 32 bits addresses in page table dump Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman arch/powerpc/mm/dump_linuxpagetables.c | 5 +++++ 1 file changed, 5 insertions(+) commit fd893fe56a1307d348fe5c077eb9b654288ce0c5 Author: Christophe Leroy Date: Fri Apr 14 07:45:16 2017 +0200 powerpc/mm: Fix missing page attributes in page table dump On some targets, _PAGE_RW is 0 and this is _PAGE_RO which is used. There is also _PAGE_SHARED that is missing. Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman arch/powerpc/include/asm/book3s/64/pgtable.h | 1 + arch/powerpc/mm/dump_linuxpagetables.c | 9 +++++++++ 2 files changed, 10 insertions(+) commit 6c01bbd2cf8cbc1906818b402b10bca2283c4e7e Author: Christophe Leroy Date: Tue Apr 18 08:20:13 2017 +0200 powerpc/mm: Fix page table dump build on PPC32 On PPC32 (eg. mpc885_ads_defconfig), page table dump compilation fails as follows. This is because the memory layout is slightly different on PPC32. This patch adapts it. arch/powerpc/mm/dump_linuxpagetables.c: In function 'walk_pagetables': arch/powerpc/mm/dump_linuxpagetables.c:369:10: error: 'KERN_VIRT_START' undeclared (first use in this function) ... Fixes: 8eb07b187000d ("powerpc/mm: Dump linux pagetables") Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman arch/powerpc/mm/dump_linuxpagetables.c | 59 +++++++++++++++++++++++++++------- 1 file changed, 48 insertions(+), 11 deletions(-) commit a5998fcb92552a18713b6aa5c146aa400e4d75ee Author: Aneesh Kumar K.V Date: Wed Apr 26 21:38:17 2017 +1000 powerpc/mm/radix: Optimise tlbiel flush all case _tlbiel_pid() is called with a ric (Radix Invalidation Control) argument of either RIC_FLUSH_TLB or RIC_FLUSH_ALL. RIC_FLUSH_ALL says to invalidate the entire TLB and the Page Walk Cache (PWC). To flush the whole TLB, we have to iterate over each set (congruence class) of the TLB. Currently we do that and pass RIC_FLUSH_ALL each time. That is not incorrect but it means we flush the PWC 128 times, when once would suffice. Fix it by doing the first flush with the ric value we're passed, and then if it was RIC_FLUSH_ALL, we downgrade it to RIC_FLUSH_TLB, because we know we have just flushed the PWC and don't need to do it again. Signed-off-by: Aneesh Kumar K.V [mpe: Split out of combined patch, tweak logic, rewrite change log] Signed-off-by: Michael Ellerman arch/powerpc/mm/tlb-radix.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) commit cf4f08bed876fbc50e64da92d2e1cfdf7653ddb2 Author: Aneesh Kumar K.V Date: Wed Apr 26 21:38:30 2017 +1000 powerpc/mm/radix: Optimise Page Walk Cache flush Currently we implement flushing of the page walk cache (PWC) by calling _tlbiel_pid() with a RIC (Radix Invalidation Control) value of 1 which says to only flush the PWC. But _tlbiel_pid() loops over each set (congruence class) of the TLB, which is not necessary when we're just flushing the PWC. In fact the set argument is ignored for a PWC flush, so essentially we're just flushing the PWC 127 extra times for no benefit. Fix it by adding tlbiel_pwc() which just does a single flush of the PWC. Signed-off-by: Aneesh Kumar K.V [mpe: Split out of combined patch, drop _ in name, rewrite change log] Signed-off-by: Michael Ellerman arch/powerpc/mm/tlb-radix.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) commit 178f02ffafafc59d4d4b135242e5cc1515743680 Author: Radim Krčmář Date: Wed Apr 26 22:32:26 2017 +0200 KVM: return if kvm_vcpu_wake_up() did wake up the VCPU No need to kick a VCPU that we have just woken up. Signed-off-by: Radim Krčmář Reviewed-by: Andrew Jones Signed-off-by: Paolo Bonzini include/linux/kvm_host.h | 2 +- virt/kvm/kvm_main.c | 12 ++++++++---- 2 files changed, 9 insertions(+), 5 deletions(-) commit cde9af6e79046e12cd08d161139b1d5e57e9fbac Author: Andrew Jones Date: Wed Apr 26 22:32:24 2017 +0200 KVM: add explicit barrier to kvm_vcpu_kick kvm_vcpu_kick() must issue a general memory barrier prior to reading vcpu->mode in order to ensure correctness of the mutual-exclusion memory barrier pattern used with vcpu->requests. While the cmpxchg called from kvm_vcpu_kick(): kvm_vcpu_kick kvm_arch_vcpu_should_kick kvm_vcpu_exiting_guest_mode cmpxchg implies general memory barriers before and after the operation, that implication is only valid when cmpxchg succeeds. We need an explicit barrier for when it fails, otherwise a VCPU thread on its entry path that reads zero for vcpu->requests does not exclude the possibility the requesting thread sees !IN_GUEST_MODE when it reads vcpu->mode. kvm_make_all_cpus_request already had a barrier, so we remove it, as now it would be redundant. Signed-off-by: Andrew Jones Signed-off-by: Paolo Bonzini arch/x86/kvm/x86.c | 2 +- include/linux/kvm_host.h | 6 ++++++ virt/kvm/kvm_main.c | 3 --- 3 files changed, 7 insertions(+), 4 deletions(-) commit f8d5549df25e3961d6bd2ae36d3e0b08614660d9 Author: Borislav Petkov Date: Wed Apr 26 12:22:08 2017 +0200 EDAC, ghes: Do not enable it by default Leave it to the user to decide whether to enable this or not. Otherwise, platform-specific drivers won't initialize (currently, EDAC supports only a single platform driver loaded). Signed-off-by: Borislav Petkov drivers/edac/Kconfig | 1 - 1 file changed, 1 deletion(-) commit 6c6e8360b34d59d2f687a1649e61173742dbc891 Author: Radim Krčmář Date: Wed Apr 26 22:32:23 2017 +0200 KVM: perform a wake_up in kvm_make_all_cpus_request We want to have kvm_make_all_cpus_request() to be an optmized version of kvm_for_each_vcpu(i, vcpu, kvm) { kvm_make_request(vcpu, request); kvm_vcpu_kick(vcpu); } and kvm_vcpu_kick() wakes up the target vcpu. We know which requests do not need the wake up and use it to optimize the loop. Thanks to that, this patch doesn't change the behavior of current users (the all don't need the wake up) and only prepares for future where the wake up is going to be needed. I think that most requests do not need the wake up, so we would flip the bit then. Later on, kvm_make_request() will take care of kicking too, using this bit to make the decision whether to kick or not. Signed-off-by: Radim Krčmář Reviewed-by: Andrew Jones Signed-off-by: Paolo Bonzini virt/kvm/kvm_main.c | 3 +++ 1 file changed, 3 insertions(+) commit 930f7fd6da77ed9476a538345513460fd304aaf5 Author: Radim Krčmář Date: Wed Apr 26 22:32:22 2017 +0200 KVM: mark requests that do not need a wakeup Some operations must ensure that the guest is not running with stale data, but if the guest is halted, then the update can wait until another event happens. kvm_make_all_requests() currently doesn't wake up, so we can mark all requests used with it. First 8 bits were arbitrarily reserved for request numbers. Most uses of requests have the request type as a constant, so a compiler will optimize the '&'. An alternative would be to have an inline function that would return whether the request needs a wake-up or not, but I like this one better even though it might produce worse assembly. Signed-off-by: Radim Krčmář Reviewed-by: Andrew Jones Reviewed-by: Cornelia Huck Signed-off-by: Paolo Bonzini arch/arm/include/asm/kvm_host.h | 2 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/x86/include/asm/kvm_host.h | 6 +++--- include/linux/kvm_host.h | 12 +++++++----- 4 files changed, 12 insertions(+), 10 deletions(-) commit 75aaafb79f73516b69d5639ad30a72d72e75c8b4 Author: Radim Krčmář Date: Wed Apr 26 22:32:21 2017 +0200 KVM: remove #ifndef CONFIG_S390 around kvm_vcpu_wake_up The #ifndef was protecting a missing halt_wakeup stat, but that is no longer necessary. Acked-by: Christian Borntraeger Signed-off-by: Radim Krčmář Reviewed-by: Cornelia Huck Signed-off-by: Paolo Bonzini virt/kvm/kvm_main.c | 2 -- 1 file changed, 2 deletions(-) commit 1bd2009e7334a9900c88f7016207619d2f86f884 Author: Radim Krčmář Date: Wed Apr 26 22:32:20 2017 +0200 KVM: x86: always use kvm_make_request instead of set_bit Reviewed-by: David Hildenbrand Signed-off-by: Radim Krčmář Reviewed-by: Andrew Jones Signed-off-by: Paolo Bonzini arch/x86/kvm/x86.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) commit 72875d8a4d92f6f37e051be522b2252fd49bd50e Author: Radim Krčmář Date: Wed Apr 26 22:32:19 2017 +0200 KVM: add kvm_{test,clear}_request to replace {test,clear}_bit Users were expected to use kvm_check_request() for testing and clearing, but request have expanded their use since then and some users want to only test or do a faster clear. Make sure that requests are not directly accessed with bit operations. Reviewed-by: Christian Borntraeger Signed-off-by: Radim Krčmář Reviewed-by: Andrew Jones Reviewed-by: Cornelia Huck Signed-off-by: Paolo Bonzini arch/mips/kvm/emulate.c | 2 +- arch/powerpc/kvm/book3s_pr.c | 2 +- arch/powerpc/kvm/book3s_pr_papr.c | 2 +- arch/powerpc/kvm/booke.c | 4 ++-- arch/powerpc/kvm/powerpc.c | 2 +- arch/s390/kvm/kvm-s390.c | 2 +- arch/x86/kvm/vmx.c | 2 +- arch/x86/kvm/x86.c | 8 ++++---- include/linux/kvm_host.h | 14 ++++++++++++-- 9 files changed, 24 insertions(+), 14 deletions(-) commit cf9bdd35779e36a5bfc23ec292d6e1c23435878d Merge: e891a32 e000b8e Author: Paolo Bonzini Date: Thu Apr 27 14:11:07 2017 +0200 Merge tag 'kvm-s390-next-4.12-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD KVM: s390: MSA8 feature for guests - Detect all function codes for KMA and export the features for use in the cpu model commit 5af50993850a48ba749b122173d789ea90976c72 Author: Benjamin Herrenschmidt Date: Wed Apr 5 17:54:56 2017 +1000 KVM: PPC: Book3S HV: Native usage of the XIVE interrupt controller This patch makes KVM capable of using the XIVE interrupt controller to provide the standard PAPR "XICS" style hypercalls. It is necessary for proper operations when the host uses XIVE natively. This has been lightly tested on an actual system, including PCI pass-through with a TG3 device. Signed-off-by: Benjamin Herrenschmidt [mpe: Cleanup pr_xxx(), unsplit pr_xxx() strings, etc., fix build failures by adding KVM_XIVE which depends on KVM_XICS and XIVE, and adding empty stubs for the kvm_xive_xxx() routines, fixup subject, integrate fixes from Paul for building PR=y HV=n] Signed-off-by: Michael Ellerman arch/powerpc/include/asm/kvm_book3s_asm.h | 2 + arch/powerpc/include/asm/kvm_host.h | 28 +- arch/powerpc/include/asm/kvm_ppc.h | 74 ++ arch/powerpc/include/asm/xive.h | 9 +- arch/powerpc/kernel/asm-offsets.c | 10 + arch/powerpc/kvm/Kconfig | 5 + arch/powerpc/kvm/Makefile | 4 +- arch/powerpc/kvm/book3s.c | 75 +- arch/powerpc/kvm/book3s_hv.c | 51 +- arch/powerpc/kvm/book3s_hv_builtin.c | 103 ++ arch/powerpc/kvm/book3s_hv_rm_xics.c | 10 +- arch/powerpc/kvm/book3s_hv_rm_xive.c | 47 + arch/powerpc/kvm/book3s_hv_rmhandlers.S | 62 +- arch/powerpc/kvm/book3s_rtas.c | 21 +- arch/powerpc/kvm/book3s_xics.c | 35 +- arch/powerpc/kvm/book3s_xics.h | 7 + arch/powerpc/kvm/book3s_xive.c | 1893 +++++++++++++++++++++++++++++ arch/powerpc/kvm/book3s_xive.h | 256 ++++ arch/powerpc/kvm/book3s_xive_template.c | 503 ++++++++ arch/powerpc/kvm/irq.h | 1 + arch/powerpc/kvm/powerpc.c | 17 +- arch/powerpc/platforms/powernv/opal.c | 1 + arch/powerpc/sysdev/xive/common.c | 142 ++- arch/powerpc/sysdev/xive/native.c | 86 +- include/linux/kvm_host.h | 1 - virt/kvm/kvm_main.c | 4 - 26 files changed, 3358 insertions(+), 89 deletions(-) commit ab6241ae07c3c698543b565e4ea41995a29a3f62 Author: Dan Carpenter Date: Thu Apr 27 00:04:31 2017 +0300 input: touchscreen: mxs-lradc: || vs && typos These tests are meaningless as is because "adapt" can't possibly be both less than 1 and greater than 32. Fixes: d81ca730e3e4 ("input: touchscreen: mxs-lradc: Add support for touchscreen") Signed-off-by: Dan Carpenter Acked-by: Dmitry Torokhov Signed-off-by: Lee Jones drivers/input/touchscreen/mxs-lradc-ts.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit d096ae4bb0fa3116fdd4941c65fc577f76ad453c Author: Icenowy Zheng Date: Mon Apr 17 19:57:42 2017 +0800 dt-bindings: Add AXP803's regulator info AXP803 have the most regulators in currently supported AXP PMICs. Add info for the regulators in the dt-bindings document. Signed-off-by: Icenowy Zheng Acked-by: Rob Herring Signed-off-by: Lee Jones Documentation/devicetree/bindings/mfd/axp20x.txt | 27 ++++++++++++++++++++++++ 1 file changed, 27 insertions(+) commit 1578353e05cd23b10a9e5e8d1626e5bd0849d873 Author: Icenowy Zheng Date: Mon Apr 17 19:57:40 2017 +0800 mfd: axp20x: Support AXP803 variant AXP803 is a new PMIC chip produced by X-Powers, usually paired with A64 via RSB bus. The PMIC itself is like AXP288, but with RSB support and dedicated VBUS and ACIN. Add support for it in the axp20x mfd driver. Currently only power key function is supported. Signed-off-by: Icenowy Zheng Signed-off-by: Lee Jones drivers/mfd/axp20x-rsb.c | 1 + drivers/mfd/axp20x.c | 79 ++++++++++++++++++++++++++++++++++++++++++++++ include/linux/mfd/axp20x.h | 40 ++++++++++++++++++++++- 3 files changed, 119 insertions(+), 1 deletion(-) commit 19b465e9560c5fb415f1d1159ae8a580b731436b Author: Icenowy Zheng Date: Mon Apr 17 19:57:39 2017 +0800 dt-bindings: Add device tree binding for X-Powers AXP803 PMIC AXP803 is a PMIC produced by Shenzhen X-Powers, with either I2C or RSB bus. Add a compatible for it. Signed-off-by: Icenowy Zheng Acked-by: Chen-Yu Tsai Acked-by: Rob Herring Signed-off-by: Lee Jones Documentation/devicetree/bindings/mfd/axp20x.txt | 2 ++ 1 file changed, 2 insertions(+) commit 7366709c5ab72841bd6f74b0cf3fab5ca368ac23 Author: Icenowy Zheng Date: Mon Apr 17 19:57:38 2017 +0800 dt-bindings: Make AXP20X compatible strings one per line In the binding documentation of AXP20X mfd, the compatible strings used to be listed for three per line, which leads to some mess when trying to add AXP803 compatible string (as we have already AXP806 and AXP809 compatibles, which is after AXP803 in ascending order). Make the compatible strings one per line, so that inserting a new compatible string will be directly a new line. Signed-off-by: Icenowy Zheng Signed-off-by: Lee Jones Documentation/devicetree/bindings/mfd/axp20x.txt | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit db43b8d04d7a9fa0ac18db6de2c4741dcefbcc0b Author: Pan Bian Date: Sun Apr 23 20:29:24 2017 +0800 mfd: intel_soc_pmic_core: Fix unchecked return value unction devm_regmap_init_i2c() returns an ERR_PTR on errors, and its return value should be checked before it is dereferenced. However, in function intel_soc_pmic_i2c_probe(), the return value of function devm_regmap_init_i2c() is used without validation. This patch fixes it. Signed-off-by: Pan Bian Signed-off-by: Lee Jones drivers/mfd/intel_soc_pmic_core.c | 3 +++ 1 file changed, 3 insertions(+) commit d1f4f01a994b13e7cc3d682b816de7fc7e3463d9 Author: Martin Kepplinger Date: Mon Apr 10 11:37:18 2017 +0200 mfd: menelaus: Remove obsolete local_irq_disable() and local_irq_enable() Since commit e6229bec25be ("rtc: make rtc_update_irq callable with irqs enabled") rtc_update_irq() is callable with irqs enabled, see the rtc drivers. So update this accordingly. Signed-off-by: Martin Kepplinger Acked-by: Aaro Koskinen Signed-off-by: Lee Jones drivers/mfd/menelaus.c | 4 ---- 1 file changed, 4 deletions(-) commit 76d3341b63a2ba173e7163c48918ec45934df98b Author: Tony Lindgren Date: Sat Apr 15 10:05:09 2017 -0700 mfd: omap-usb-tll: Configure ULPIAUTOIDLE The idle mode needs to be only disabled for UTMIAUTOIDLE while ULPIAUTOIDLE can be enabled. This matches the TLL_CHANNEL_CONF_i register configuration for ehci-tll in the Motorola Linux kernel tree for Wrigley 3G LTE modem on droid 4 and the modem still stays responsive. Signed-off-by: Tony Lindgren Acked-by: Roger Quadros Signed-off-by: Lee Jones drivers/mfd/omap-usb-tll.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 8b8a84c54aff4256d592dc18346c65ecf6811b45 Author: Tony Lindgren Date: Sat Apr 15 10:05:08 2017 -0700 mfd: omap-usb-tll: Fix inverted bit use for USB TLL mode Commit 16fa3dc75c22 ("mfd: omap-usb-tll: HOST TLL platform driver") added support for USB TLL, but uses OMAP_TLL_CHANNEL_CONF_ULPINOBITSTUFF bit the wrong way. The comments in the code are correct, but the inverted use of OMAP_TLL_CHANNEL_CONF_ULPINOBITSTUFF causes the register to be enabled instead of disabled unlike what the comments say. Without this change the Wrigley 3G LTE modem on droid 4 EHCI bus can be only pinged few times before it stops responding. Fixes: 16fa3dc75c22 ("mfd: omap-usb-tll: HOST TLL platform driver") Signed-off-by: Tony Lindgren Acked-by: Roger Quadros Signed-off-by: Lee Jones drivers/mfd/omap-usb-tll.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b5b086abe08cb88533cf2c14f7d8b22636657e28 Author: Willis Monroe Date: Tue Apr 11 09:10:06 2017 -0700 mfd: palmas: Fixed spelling mistake in error message Fixed a small spelling mistake ("updat" -> "update") in an error message. Signed-off-by: Willis Monroe Signed-off-by: Lee Jones drivers/mfd/palmas.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a6450cb0388ee58659be5a54a7bfe5bff09532c7 Author: Mika Westerberg Date: Mon Apr 10 13:28:45 2017 +0300 mfd: lpc_ich: Add support for Intel Gemini Lake SoC Like Intel Apollo Lake, Gemini Lake exposes the serial SPI flash device BAR through hidden P2SB PCI device. We use the same mechanism than Apollo Lake to read the BAR and pass it to the driver. Signed-off-by: Mika Westerberg Signed-off-by: Lee Jones drivers/mfd/lpc_ich.c | 6 ++++++ 1 file changed, 6 insertions(+) commit ac03fec1d7d889192cce35edac6fef6026a4d6a1 Author: Daniel Lezcano Date: Fri Mar 17 08:58:50 2017 +0100 mfd: hi655x: Add the clock cell to provide WiFi and Bluetooth The hi655x is a PMIC with regulator but also provides a clock for the WiFi and the bluetooth which is missing in the current implementation. Add the clock cell so it can be used in the next patch via the dts. Signed-off-by: Daniel Lezcano Signed-off-by: Lee Jones drivers/mfd/hi655x-pmic.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit b5238b41858229b2dcb684cd71d81f4c6d6311c0 Author: Andy Shevchenko Date: Tue Apr 4 15:38:56 2017 +0300 mfd: intel_soc_pmic: Fix a mess with compilation units Crystal Cove and Whiskey Cove are two different PMICs which are installed on Intel Atom SoC based platforms. Moreover there are two independent drivers that by some reason were supposed (*) to get into one kernel module. Fix the mess by clarifying Kconfig option for Crystal Cove and split Whiskey Cove out of it. (*) It looks like the configuration was never tested with INTEL_SOC_PMIC=n. The line in Makefile is actually wrong. Cc: "Rafael J. Wysocki" (supporter:ACPI) Acked-by: Linus Walleij Acked-by: Zhang Rui Signed-off-by: Andy Shevchenko Signed-off-by: Lee Jones drivers/acpi/Kconfig | 2 +- drivers/gpio/Kconfig | 2 +- drivers/mfd/Kconfig | 15 +++++++++++++-- drivers/mfd/Makefile | 2 +- drivers/platform/x86/Kconfig | 2 +- drivers/thermal/Kconfig | 2 +- 6 files changed, 18 insertions(+), 7 deletions(-) commit 90f447170c6f283a80a729ff92aabecdb2206cbe Author: Marek Szyprowski Date: Thu Mar 23 09:03:27 2017 +0100 mfd: exynos-lpass: Add runtime PM support Convert exisitng lpass-suspend/resume callbacks into runtime PM callbacks. This way Exynos LPASS driver will be ready for use with power domains enabled. LPASS will be runtime resumed/suspended as a result of its child devices runtime PM transitions. Signed-off-by: Marek Szyprowski Acked-by: Krzysztof Kozlowski Acked-by: Sylwester Nawrocki Signed-off-by: Lee Jones drivers/mfd/exynos-lpass.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) commit cb710ab1d8a23f68ff8f45aedf3e552bb90e70de Author: Sudeep Holla Date: Tue Mar 21 11:30:16 2017 +0000 mailbox: handle empty message in tx_tick We already check if the message is empty before calling the client tx_done callback. Calling completion on a wait event is also invalid if the message is empty. This patch moves the existing empty message check earlier. Fixes: 2b6d83e2b8b7 ("mailbox: Introduce framework for mailbox") Signed-off-by: Sudeep Holla Signed-off-by: Jassi Brar drivers/mailbox/mailbox.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) commit cc6eeaa3029a6dbcb4ad41b1f92876483bd88965 Author: Sudeep Holla Date: Tue Mar 21 11:30:15 2017 +0000 mailbox: skip complete wait event if timer expired If a wait_for_completion_timeout() call returns due to a timeout, complete() can get called after returning from the wait which is incorrect and can cause subsequent transmissions on a channel to fail. Since the wait_for_completion_timeout() sees the completion variable is non-zero caused by the erroneous/spurious complete() call, and it immediately returns without waiting for the time as expected by the client. This patch fixes the issue by skipping complete() call for the timer expiry. Fixes: 2b6d83e2b8b7 ("mailbox: Introduce framework for mailbox") Reported-by: Alexey Klimov Signed-off-by: Sudeep Holla Signed-off-by: Jassi Brar drivers/mailbox/mailbox.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit c61b781ee084e69855477d23dd33e7e6caad652c Author: Sudeep Holla Date: Tue Mar 21 11:30:14 2017 +0000 mailbox: always wait in mbox_send_message for blocking Tx mode There exists a race when msg_submit return immediately as there was an active request being processed which may have completed just before it's checked again in mbox_send_message. This will result in return to the caller without waiting in mbox_send_message even when it's blocking Tx. This patch fixes the issue by waiting for the completion always if Tx is in blocking mode. Fixes: 2b6d83e2b8b7 ("mailbox: Introduce framework for mailbox") Reported-by: Alexey Klimov Signed-off-by: Sudeep Holla Reviewed-by: Alexey Klimov Signed-off-by: Jassi Brar drivers/mailbox/mailbox.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 207c6e36f122ebb1164d611c9f34f128313f47d5 Author: Joerg Roedel Date: Wed Apr 26 15:39:28 2017 +0200 iommu: Move report_iommu_fault() to iommu.c The function is in no fast-path, there is no need for it to be static inline in a header file. This also removes the need to include iommu trace-points in iommu.h. Signed-off-by: Joerg Roedel drivers/iommu/iommu.c | 42 ++++++++++++++++++++++++++++++++++++++++++ include/linux/iommu.h | 41 ++--------------------------------------- 2 files changed, 44 insertions(+), 39 deletions(-) commit e8245c1b1a3bb8474f91c69ccd13637d3589bb2c Author: Joerg Roedel Date: Wed Apr 26 15:34:06 2017 +0200 iommu: Include device.h in iommu.h We make use of 'struct device' in iommu.h, so include device.h to make it available explicitly. Re-order the other headers while at it. Signed-off-by: Joerg Roedel include/linux/iommu.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 629e014bb8349fcf7c1e4df19a842652ece1c945 Author: Christoph Hellwig Date: Thu Apr 27 09:42:25 2017 +0200 fs: completely ignore unknown open flags Currently we just stash anything we got into file->f_flags, and the report it in fcntl(F_GETFD). This patch just clears out all unknown flags so that we don't pass them to the fs or report them. Signed-off-by: Christoph Hellwig Signed-off-by: Al Viro fs/open.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 80f18379a7c350c011d30332658aa15fe49a8fa5 Author: Christoph Hellwig Date: Thu Apr 27 09:42:24 2017 +0200 fs: add a VALID_OPEN_FLAGS Add a central define for all valid open flags, and use it in the uniqueness check. Signed-off-by: Christoph Hellwig Signed-off-by: Al Viro fs/fcntl.c | 14 ++++---------- include/linux/fcntl.h | 6 ++++++ 2 files changed, 10 insertions(+), 10 deletions(-) commit c414df12bdf7a3e730512ed3971e9d90a494cfa9 Author: Marek Szyprowski Date: Thu Mar 23 09:03:26 2017 +0100 mfd: exynos-lpass: Add missing remove() function Disable device on driver remove and release allocated regmap. Signed-off-by: Marek Szyprowski Reviewed-by: Krzysztof Kozlowski Acked-by: Sylwester Nawrocki Acked-for-MFD-by: Lee Jones Signed-off-by: Lee Jones drivers/mfd/exynos-lpass.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit 8f1be5bd14e8faf5a1255a32621601bb11a96232 Author: Marek Szyprowski Date: Thu Mar 23 09:03:25 2017 +0100 mfd: exynos-lpass: Add support for clocks Exynos LPASS requires some clocks to be enabled to make any access to its registers. This patch adds code for handling such clocks. For current set of registers it is enough to keep sfr0_ctrl clock enabled. Till now it worked only because those clocks were enabled by bootloader and driver probe() happened before they were disabled by clock core because of lack of users. Handling those clocks is also needed to make it possible to enable support for audio power domain. This patch requires adding sfr0_ctrl clock to device tree. Signed-off-by: Marek Szyprowski Reviewed-by: Krzysztof Kozlowski Acked-by: Sylwester Nawrocki Acked-by: Rob Herring Acked-for-MFD-by: Lee Jones Signed-off-by: Lee Jones .../devicetree/bindings/mfd/samsung,exynos5433-lpass.txt | 6 ++++++ drivers/mfd/exynos-lpass.c | 10 ++++++++++ 2 files changed, 16 insertions(+) commit addebf1588ab812b891651ef5fba194659f71ea5 Author: Marek Szyprowski Date: Thu Mar 23 09:03:24 2017 +0100 mfd: exynos-lpass: Remove pad retention control Pad retention should be controlled from pin control driver, so remove it from Exynos LPASS driver. After this change, no more access to PMU regmap is needed, so remove also the code for handling PMU regmap. Signed-off-by: Marek Szyprowski Acked-by: Krzysztof Kozlowski Acked-by: Sylwester Nawrocki Acked-by: Rob Herring Acked-for-MFD-by: Lee Jones Signed-off-by: Lee Jones .../devicetree/bindings/mfd/samsung,exynos5433-lpass.txt | 2 -- drivers/mfd/exynos-lpass.c | 16 ---------------- include/linux/mfd/syscon/exynos5-pmu.h | 3 --- 3 files changed, 21 deletions(-) commit 0e34d5de961d5a8a84cf77878ca871c6e8104620 Author: Quentin Schulz Date: Tue Apr 4 08:34:41 2017 +0200 iio: adc: add support for X-Powers AXP20X and AXP22X PMICs ADCs The X-Powers AXP20X and AXP22X PMICs have multiple ADCs. They expose the battery voltage, battery charge and discharge currents, AC-in and VBUS voltages and currents, 2 GPIOs muxable in ADC mode and PMIC temperature. This adds support for most of AXP20X and AXP22X ADCs. Signed-off-by: Quentin Schulz Acked-by: Maxime Ripard Acked-by: Chen-Yu Tsai Reviewed-by: Jonathan Cameron Signed-off-by: Lee Jones drivers/iio/adc/Kconfig | 10 + drivers/iio/adc/Makefile | 1 + drivers/iio/adc/axp20x_adc.c | 617 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 628 insertions(+) commit be269180c9335c257a2763c3fd3a44e65c90c1f0 Author: Tony Lindgren Date: Mon Apr 3 20:15:56 2017 -0700 mfd: cpcap: Fix bad use of IRQ sense register The cpcap INTS registers are for getting the value of the line, not for configuring the type. Fixes: 56e1d40d3bea ("mfd: cpcap: Add minimal support") Reviewed-By: Sebastian Reichel Tested-by: Sebastian Reichel Signed-off-by: Tony Lindgren Signed-off-by: Lee Jones drivers/mfd/motorola-cpcap.c | 1 - 1 file changed, 1 deletion(-) commit 5a88d4120029601a0868e20774382d312952d3b5 Author: Tony Lindgren Date: Mon Apr 3 20:15:55 2017 -0700 mfd: cpcap: Use ack_invert interrupts We should use ack_invert as the int_read_and_clear() in the Motorola kernel tree does "ireg_val & ~mreg_val" before writing to the mask register. Fixes: 56e1d40d3bea ("mfd: cpcap: Add minimal support") Tested-by: Sebastian Reichel Signed-off-by: Tony Lindgren Signed-off-by: Lee Jones drivers/mfd/motorola-cpcap.c | 3 +++ 1 file changed, 3 insertions(+) commit ac89473213c602b98172d92e40f5e78032b1aba0 Author: Tony Lindgren Date: Mon Apr 3 20:15:54 2017 -0700 mfd: cpcap: Fix interrupt to use level interrupt I made a mistake assuming the device tree configuration for interrupt triggering was somehow passed to the SPI device but it's not. In the Motorola Linux kernel tree CPCAP PMIC is configured as a rising edge triggered interrupt, but then then it's interrupt handler keeps looping until the GPIO line goes down. So the CPCAP interrupt is clearly a level interrupt and not an edge interrupt. Earlier when I tried to configure it as level interrupt using the device tree, I did not account that the triggering only gets passed to the SPI core and it also needs to be specified in the CPCAP driver when we do devm_regmap_add_irq_chip(). Fixes: 56e1d40d3bea ("mfd: cpcap: Add minimal support") Signed-off-by: Tony Lindgren Acked-by: Charles Keepax Signed-off-by: Lee Jones drivers/mfd/motorola-cpcap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4d5db2a3a207451a8b11802c4d5f45a8931d996c Author: Quentin Schulz Date: Wed Apr 5 11:06:28 2017 +0200 dt-bindings: input: touschcreen: Remove sun4i documentation This patch removes the sun4i touchscreen controller binding documentation since it has been merged with the sun4i GPADC binding documentation. Signed-off-by: Quentin Schulz Acked-by: Rob Herring Acked-by: Dmitry Torokhov Signed-off-by: Lee Jones .../bindings/input/touchscreen/sun4i.txt | 38 ---------------------- 1 file changed, 38 deletions(-) commit fe37c4b98173ec4b82d3b225d4a7c4d40f77f304 Author: Quentin Schulz Date: Wed Apr 5 11:06:27 2017 +0200 dt-bindings: mfd: Add A33 GPADC binding This patch adds documentation for the A33 GPADC binding. Signed-off-by: Quentin Schulz Acked-by: Rob Herring Signed-off-by: Lee Jones .../devicetree/bindings/mfd/sun4i-gpadc.txt | 59 ++++++++++++++++++++++ 1 file changed, 59 insertions(+) commit b4aeceb694a3ba353c0531f3b075642905c6b523 Author: Quentin Schulz Date: Wed Apr 5 10:10:55 2017 +0200 mfd: axp20x: Add MFD cells for AXP20X and AXP22X battery driver The X-Powers AXP20X and AXP22X PMICs can have a battery as power supply. This patch adds the AXP20X/AXP22X battery driver to the MFD cells of the AXP209, AXP221 and AXP223 MFD. Signed-off-by: Quentin Schulz Acked-by: Chen-Yu Tsai Signed-off-by: Lee Jones drivers/mfd/axp20x.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit 656211b1dfb9e0b68d4e634931432e29a6facf46 Author: Steve Twiss Date: Mon Apr 3 15:46:40 2017 +0100 mfd: Add support for DA9061 MFD support for DA9061 is provided as part of the DA9062 device driver. The registers header file adds two new chip variant IDs defined in DA9061 and DA9062 hardware. The core header file adds new software enumerations for listing the valid DA9061 IRQs and a da9062_compatible_types enumeration for distinguishing between DA9061/62 devices in software. The core source code adds a new .compatible of_device_id entry. This is extended from DA9062 to support both "dlg,da9061" and "dlg,da9062". The .data entry now holds a reference to the enumerated device type. A new regmap_irq_chip model is added for DA9061 and this supports the new list of regmap_irq entries. A new mfd_cell da9061_devs[] array lists the new sub system components for DA9061. Support is added for a new DA9061 regmap_config which lists the correct readable, writable and volatile ranges for this chip. The probe function uses the device tree compatible string to switch on the da9062_compatible_types and configure the correct mfd cells, irq chip and regmap config. Kconfig is updated to reflect support for DA9061 and DA9062 PMICs. Signed-off-by: Steve Twiss Signed-off-by: Lee Jones drivers/mfd/Kconfig | 5 +- drivers/mfd/da9062-core.c | 427 +++++++++++++++++++++++++++++++++-- include/linux/mfd/da9062/core.h | 29 ++- include/linux/mfd/da9062/registers.h | 5 +- 4 files changed, 443 insertions(+), 23 deletions(-) commit e1569fb64e5efb31b835ac8e76bf1c18313da8e5 Author: Steve Twiss Date: Tue Mar 28 15:43:31 2017 +0100 dt-bindings: mfd: DA9062/61 MFD binding Extend existing DA9062 binding information to include the DA9061 PMIC for MFD core and regulators. Add a da9062-onkey link to the existing onkey binding file. Add a da9062-thermal link to the new temperature monitoring binding file. Delete the da9062-watchdog section and replace it with a link to the new DA9061/62 binding information file. Acked-by: Rob Herring Signed-off-by: Steve Twiss Signed-off-by: Lee Jones Documentation/devicetree/bindings/mfd/da9062.txt | 49 +++++++++++++++++------- 1 file changed, 36 insertions(+), 13 deletions(-) commit b97eef5d77b53662b06603c1b18e21968029c925 Author: Hugues Fruchet Date: Fri Mar 31 10:12:39 2017 +0200 mfd: stmpe: Fix bit clearing on STMPE1600 GPIO bits clearing on pins assigned to STMPE1600 had no effects due to missing "clear registers" settings within stmpe1600_regs[]. STMPE1600 does not have dedicated "clear registers", but single "set/clear registers", hence stmpe1600_regs[] "clear registers" (STMPE_IDX_GPCR_XXX) must be set to same value as "set registers" (STMPE_IDX_GPSR_XXX), ie STMPE1600_REG_GPSR_XXX. Signed-off-by: Hugues Fruchet Reviewed-by: Patrice Chotard Signed-off-by: Lee Jones drivers/mfd/stmpe.c | 2 ++ 1 file changed, 2 insertions(+) commit b4ccc4d2e82f7c7f8304f44544bdefcd16234582 Author: Kuppuswamy Sathyanarayanan Date: Thu Mar 30 16:35:40 2017 -0700 mfd: bxtwc: Remove unnecessary i2c_addr checks in ipc calls In the following code block, BXTWC_DEVICE1_ADDR value is already fixed and hence there no need to check for if (!i2c_addr) in every ipc read/write calls. Even if this check is required it can be moved to probe function. i2c_addr = BXTWC_DEVICE1_ADDR; if (!i2c_addr) { dev_err(pmic->dev, "I2C address not set\n"); return -EINVAL; } This patch remove this extra check and adds some NULL parameter checks. Signed-off-by: Kuppuswamy Sathyanarayanan Signed-off-by: Lee Jones drivers/mfd/intel_soc_pmic_bxtwc.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-) commit 4407319d8fff93308c2afe40e7c2a7dc564ec122 Author: Boris Brezillon Date: Thu Mar 16 09:30:34 2017 +0100 memory: atmel-ebi: Add PM ops Add a ->resume() hook to make sure the EBI dev configs are correctly restored when resuming the platform. Signed-off-by: Boris Brezillon Acked-by: Nicolas Ferre Signed-off-by: Lee Jones drivers/memory/atmel-ebi.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) commit aaa572b945876619ebd114d5a456d1250f267b9a Author: Boris Brezillon Date: Thu Mar 16 09:30:33 2017 +0100 memory: atmel-ebi: Add missing ->numcs assignment ebid->numcs is never assigned, set it to numcs after allocating the EBI dev object. Signed-off-by: Boris Brezillon Acked-by: Nicolas Ferre Signed-off-by: Lee Jones drivers/memory/atmel-ebi.c | 1 + 1 file changed, 1 insertion(+) commit 9453fa4694156108d37bb2d03658286ce85ca4f0 Author: Boris Brezillon Date: Thu Mar 16 09:30:32 2017 +0100 memory: atmel-ebi: Change naming scheme The EBI block is not only available on at91 SoCs, but also on avr32 ones. Change the structure and function prefixes from at91_ebi to atmel_ebi to match this fact and make the prefix and driver name consistent. Signed-off-by: Boris Brezillon Acked-by: Nicolas Ferre Signed-off-by: Lee Jones drivers/memory/atmel-ebi.c | 120 ++++++++++++++++++++++----------------------- 1 file changed, 60 insertions(+), 60 deletions(-) commit 0d69080d9e01d5d60f1887def2080ce3f66f5856 Author: Boris Brezillon Date: Thu Mar 16 09:30:31 2017 +0100 mfd: syscon: atmel-smc: Remove unused helpers/macros All macros prefixed with AT91[SAM9]_SMC have been replaced by equivalent definitions prefixed with ATMEL_SMC, and the at91sam9_smc_xxxx() helpers are no longer used. Drop these definitions before someone starts using them again. Signed-off-by: Boris Brezillon Acked-by: Nicolas Ferre Signed-off-by: Lee Jones include/linux/mfd/syscon/atmel-smc.h | 152 ----------------------------------- 1 file changed, 152 deletions(-) commit d9f81dad161f3f0b339a65e0e6ac5db898119027 Author: Boris Brezillon Date: Thu Mar 16 09:30:30 2017 +0100 memory: atmel-ebi: Stop using reg_field objects for simple things Turn the ->ebi_csa reg field into a simple offset that can be used with with the matrix regmap. Using reg fields was overkill for this use case. Signed-off-by: Boris Brezillon Acked-by: Nicolas Ferre Signed-off-by: Lee Jones drivers/memory/atmel-ebi.c | 55 +++++++++++----------------------------------- 1 file changed, 13 insertions(+), 42 deletions(-) commit 8eb8c7d844b9da6301542627eaaae28f4d20cb75 Author: Boris Brezillon Date: Thu Mar 16 09:30:29 2017 +0100 memory: atmel-ebi: Simplify SMC config code New helpers/macros have been to atmel-smc.h introduced to simplify SMC regs manipulation. Rework the code to use those helpers, and simplify the ->xlate_config(), ->get_config() and ->apply_config() implementations. SMC configs are now stored in a struct atmel_smc_cs_conf object that directly contains registers values, which should help implementing ->suspend()/->resume() hooks. We can also get rid of those regmap fields (and the associated ->init() hook) which are not longer needed thanks to the atmel_[h]smc_cs_conf_{apply,get}() helpers. Signed-off-by: Boris Brezillon Acked-by: Nicolas Ferre Signed-off-by: Lee Jones drivers/memory/Kconfig | 1 + drivers/memory/atmel-ebi.c | 430 +++++++++++++-------------------------------- 2 files changed, 128 insertions(+), 303 deletions(-) commit fe9d7cb22ef3a26a74e49730c0efdbdae4b17d4b Author: Boris Brezillon Date: Thu Mar 16 09:30:28 2017 +0100 mfd: syscon: atmel-smc: Add new helpers to ease SMC regs manipulation These new helpers + macro definitions are meant to replace the old ones which are unpractical to use. Note that the macros and function prefixes have been intentionally changed to ATMEL_[H]SMC_XX and atmel_[h]smc_ to reflect the fact that this IP is also embedded in avr32 SoCs (and not only in at91 ones). Signed-off-by: Boris Brezillon Acked-by: Nicolas Ferre Signed-off-by: Lee Jones drivers/mfd/Kconfig | 4 + drivers/mfd/Makefile | 1 + drivers/mfd/atmel-smc.c | 314 +++++++++++++++++++++++++++++++++++ include/linux/mfd/syscon/atmel-smc.h | 87 ++++++++++ 4 files changed, 406 insertions(+) commit 119d53d44cb0da2e3140106a9e359fc53bd6d837 Author: Belen Sarabia Date: Sat Mar 25 19:26:47 2017 +0100 mfd: ipaq-micro: Delete redundant return value check of platform_get_resource() devm_ioremap_resource does checks on the resource. No need to duplicate this in the driver. Signed-off-by: Belén Sarabia Signed-off-by: Lee Jones drivers/mfd/ipaq-micro.c | 3 --- 1 file changed, 3 deletions(-) commit 85fdaf8eb9bbec1f0f8a52fd5d85659d60738816 Author: Keerthy Date: Thu Nov 10 10:39:18 2016 +0530 mfd: palmas: Reset the POWERHOLD mux during power off POWERHOLD signal has higher priority over the DEV_ON bit. So power off will not happen if the POWERHOLD is held high. Hence reset the MUX to GPIO_7 mode to release the POWERHOLD and the DEV_ON bit to take effect to power off the PMIC. PMIC Power off happens in dire situations like thermal shutdown so irrespective of the POWERHOLD setting go ahead and turn off the powerhold. Currently poweroff is broken on boards that have powerhold enabled. This fixes poweroff on those boards. Signed-off-by: Keerthy Signed-off-by: Lee Jones drivers/mfd/palmas.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) commit f5139c27e734bf8458c0afc60ef86e45517e1126 Author: Julia Cartwright Date: Tue Mar 21 17:43:06 2017 -0500 mfd: tc6393xb: Make use of raw_spinlock variants The tc6393xb mfd driver currently implements an irq_chip for handling interrupts; due to how irq_chip handling is done, it's necessary for the irq_chip methods to be invoked from hardirq context, even on a a real-time kernel. Because the spinlock_t type becomes a "sleeping" spinlock w/ RT kernels, it is not suitable to be used with irq_chips. A quick audit of the operations under the lock reveal that they do only minimal, bounded work, and are therefore safe to do under a raw spinlock. Signed-off-by: Julia Cartwright Signed-off-by: Lee Jones drivers/mfd/tc6393xb.c | 52 +++++++++++++++++++++++++------------------------- 1 file changed, 26 insertions(+), 26 deletions(-) commit 9fe8c2dfe165f18873042d25ef430e18c97b1dae Author: Julia Cartwright Date: Tue Mar 21 17:43:05 2017 -0500 mfd: t7l66xb: Make use of raw_spinlock variants The t7l66xb mfd driver currently implements an irq_chip for handling interrupts; due to how irq_chip handling is done, it's necessary for the irq_chip methods to be invoked from hardirq context, even on a a real-time kernel. Because the spinlock_t type becomes a "sleeping" spinlock w/ RT kernels, it is not suitable to be used with irq_chips. A quick audit of the operations under the lock reveal that they do only minimal, bounded work, and are therefore safe to do under a raw spinlock. Signed-off-by: Julia Cartwright Signed-off-by: Lee Jones drivers/mfd/t7l66xb.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) commit 93ad4471912029f7519c23da56538a5d54552124 Author: Julia Cartwright Date: Tue Mar 21 17:43:04 2017 -0500 mfd: asic3: Make use of raw_spinlock variants The asic3 mfd driver currently implements an irq_chip for handling interrupts; due to how irq_chip handling is done, it's necessary for the irq_chip methods to be invoked from hardirq context, even on a a real-time kernel. Because the spinlock_t type becomes a "sleeping" spinlock w/ RT kernels, it is not suitable to be used with irq_chips. A quick audit of the operations under the lock reveal that they do only minimal, bounded work, and are therefore safe to do under a raw spinlock. Signed-off-by: Julia Cartwright Signed-off-by: Lee Jones drivers/mfd/asic3.c | 56 ++++++++++++++++++++++++++--------------------------- 1 file changed, 28 insertions(+), 28 deletions(-) commit 0c227c51b98c03c6e7fb4f342f930cf576292064 Author: Andy Shevchenko Date: Fri Mar 17 17:37:15 2017 +0200 mfd: intel_soc_pmic_bxtwc: Rename header to follow c-file For better understanding of relationship between headers and modules rename: intel_bxtwc.h -> intel_soc_pmic_bxtwc.h While here, remove file name from the file itself. Signed-off-by: Andy Shevchenko Signed-off-by: Lee Jones drivers/mfd/intel_soc_pmic_bxtwc.c | 2 +- include/linux/mfd/intel_bxtwc.h | 67 -------------------------------- include/linux/mfd/intel_soc_pmic_bxtwc.h | 67 ++++++++++++++++++++++++++++++++ 3 files changed, 68 insertions(+), 68 deletions(-) commit f1e34ad849ad78770af067fd8e409e61b018f9d0 Author: Andy Shevchenko Date: Fri Mar 17 17:37:14 2017 +0200 mfd: intel_soc_pmic_bxtwc: Move inclusion to c-file There is no need to include intel_soc_pmic.h into header which doesn't require it. Signed-off-by: Andy Shevchenko Signed-off-by: Lee Jones drivers/mfd/intel_soc_pmic_bxtwc.c | 1 + include/linux/mfd/intel_bxtwc.h | 2 -- 2 files changed, 1 insertion(+), 2 deletions(-) commit ef84f885e03763c963dbb5d36389d33ce50576f2 Author: Charles Keepax Date: Wed Mar 15 14:58:38 2017 +0000 mfd: arizona: Refactor arizona_poll_reg Currently, we specify the timeout in terms of the number of polls but it is more clear from a user of the functions perspective to specify the timeout directly in milliseconds, as such update the function to these new semantics. Additionally, arizona_poll_reg essentially hard-codes regmap_read_poll_timeout, update the implementation to use regmap_read_poll_timeout. We still keep arizona_poll_reg around as regmap_read_poll_timeout is a macro so rather than expand this for each caller keep it wrapped in arizona_poll_reg. Whilst we are doing this make the timeouts a little more generous as the previous system had a bit more slack as it was done as a delay per iteration of the loop whereas regmap_read_poll_timeout compares ktime's. Signed-off-by: Charles Keepax Signed-off-by: Lee Jones drivers/mfd/arizona-core.c | 36 ++++++++++++++++-------------------- 1 file changed, 16 insertions(+), 20 deletions(-) commit f9657b8f75473ce0488c750677bfef46751dd5e1 Author: Charles Keepax Date: Wed Mar 15 14:58:37 2017 +0000 mfd: arizona: Display register addresses in hex Register addresses are normally displayed in hex throughout the Arizona driver. Update the arizona_poll_reg function to follow this convention. Signed-off-by: Charles Keepax Signed-off-by: Lee Jones drivers/mfd/arizona-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit de4ea10ad7bd86445875bab25596016544f827ca Author: Charles Keepax Date: Wed Mar 15 14:58:36 2017 +0000 mfd: arizona: Remove duplicate set of ret variable arizona_poll_reg already returns ETIMEDOUT if we don't see the expected register changes before the time out, so remove pointless local setting of ETIMEDOUT. Signed-off-by: Charles Keepax Signed-off-by: Lee Jones drivers/mfd/arizona-core.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) commit 81d30eda98fd8e29a6e002f6938cb746f75ca14f Author: Joe Perches Date: Thu Feb 16 23:11:36 2017 -0800 mfd: Convert remaining uses of pr_warning to pr_warn To enable eventual removal of pr_warning This makes pr_warn use consistent for drivers/mfd Prior to this patch, there were 4 uses of pr_warning and 9 uses of pr_warn in drivers/mfd Signed-off-by: Joe Perches Signed-off-by: Lee Jones drivers/mfd/db8500-prcmu.c | 2 +- drivers/mfd/sta2x11-mfd.c | 4 ++-- drivers/mfd/twl4030-power.c | 7 ++----- 3 files changed, 5 insertions(+), 8 deletions(-) commit 040fc9b1df118016bf5410d21feb72e9371aeb11 Author: Sean Wang Date: Mon Mar 20 14:47:27 2017 +0800 mfd: mt6397: Align the placement at which the mfd_cell of LED is defined Align the placement as which the mfd_cell of LED is defined as the other members done on the structure. Signed-off-by: Sean Wang Signed-off-by: Lee Jones drivers/mfd/mt6397-core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 74772a300a2af09a1a94d5658e586f670bdca402 Author: Sean Wang Date: Mon Mar 20 14:47:25 2017 +0800 dt-bindings: mfd: Add the description for LED as the sub module This patch adds description for LED as the sub-module on MT6397/MT6323 multifunction device. Signed-off-by: Sean Wang Signed-off-by: Lee Jones Documentation/devicetree/bindings/mfd/mt6397.txt | 1 + 1 file changed, 1 insertion(+) commit 976023701d1f1fda5e19983f38113bd67e881f64 Author: Quentin Schulz Date: Mon Mar 20 09:16:53 2017 +0100 mfd: axp20x: Add CHRG_CTRL1/2/3 to writeable regs for AXP20X/AXP22X The CHRG_CTRL1 and CHRG_CTRL2 registers are made for controlling different battery charging settings such as the constant current charge value. The AXP22X also have a third register CHRG_CTRL3 which has settings for battery charging too. This adds the CHRG_CTRL1, CHRG_CTRL2 and CHRG_CTRL3 registers to the list of writeable registers for AXP20X and AXP22X PMICs. Signed-off-by: Quentin Schulz Acked-by: Maxime Ripard Acked-by: Chen-Yu Tsai Signed-off-by: Lee Jones drivers/mfd/axp20x.c | 2 ++ 1 file changed, 2 insertions(+) commit 95c4f5319817a158c5d9bc8057a366c4758a0dc7 Author: Quentin Schulz Date: Mon Mar 20 09:16:48 2017 +0100 mfd: axp20x: Add AC power supply cells for AXP22X PMICs The X-Powers AXP20X and AXP22X PMICs expose the status of AC power supply. This adds the AC power supply driver to the MFD cells of the AXP22X PMICs. Signed-off-by: Quentin Schulz Acked-by: Maxime Ripard Acked-By: Sebastian Reichel Acked-by: Chen-Yu Tsai Signed-off-by: Lee Jones drivers/mfd/axp20x.c | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 4d5e5c34a04d2e73f74fd7eae7018ddfba841fc1 Author: Quentin Schulz Date: Mon Mar 20 09:16:47 2017 +0100 mfd: axp20x: Add ADC cells for AXP20X and AXP22X PMICs This adds the AXP20X/AXP22x ADCs driver to the mfd cells of the AXP209, AXP221 and AXP223 MFD. Signed-off-by: Quentin Schulz Acked-by: Maxime Ripard Acked-by: Chen-Yu Tsai Signed-off-by: Lee Jones drivers/mfd/axp20x.c | 6 ++++++ 1 file changed, 6 insertions(+) commit ed7311f0d089553f39ff3e1e2d9f55f94324c42f Author: Quentin Schulz Date: Mon Mar 20 09:16:45 2017 +0100 mfd: axp20x: Correct name of temperature data ADC registers The registers 0x56 and 0x57 of AXP22X PMIC store the value of the internal temperature of the PMIC. This patch modifies the name of these registers from AXP22X_PMIC_ADC_H/L to AXP22X_PMIC_TEMP_H/L so their purpose is clearer. Signed-off-by: Quentin Schulz Acked-by: Chen-Yu Tsai Acked-by: Maxime Ripard Signed-off-by: Lee Jones drivers/mfd/axp20x.c | 2 +- include/linux/mfd/axp20x.h | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) commit 0ec69542aa7362f7c939c9a33c6f50850d68f7eb Author: Andrew F. Davis Date: Wed Mar 15 12:05:34 2017 -0500 mfd: tps65912: Fix variable name for SPI remove The SPI interface is mostly a copy/paste from the I2C interface with some minor renaming for consistency. "Client" is an I2C specific term that was left in the SPI remove path, rename this here. Signed-off-by: Andrew F. Davis Signed-off-by: Lee Jones drivers/mfd/tps65912-spi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 66da627e0cf4e06817e78a6641e39372e20a30f7 Author: Thor Thayer Date: Wed Feb 22 11:10:15 2017 -0600 dt-bindings: mfd: Add Altera Arria10 SR Reset Controller bindings This patch adds documentation for the Altera A10-SR Reset Controller DT bindings. Signed-off-by: Thor Thayer Acked-by: Rob Herring Signed-off-by: Lee Jones Documentation/devicetree/bindings/mfd/altera-a10sr.txt | 11 +++++++++++ 1 file changed, 11 insertions(+) commit dd47e97244709aab3edda281e0876c0b86bbe07c Author: Thor Thayer Date: Wed Feb 22 11:10:18 2017 -0600 mfd: altr_a10sr: Add Arria10 DevKit Reset Controller Add Peripheral PHY Reset Controller to the Arria10 Development Kit System Resource Chip's MFD. Signed-off-by: Thor Thayer Signed-off-by: Lee Jones drivers/mfd/altera-a10sr.c | 4 ++++ 1 file changed, 4 insertions(+) commit 8fafcd99bde2db25022a10f3d35759395a7e3d3c Author: Andy Shevchenko Date: Mon Mar 13 19:53:01 2017 +0200 mfd: intel-lpss: Remove left over variable After commit 028af5941dd8 ("mfd: intel-lpss: Pass SDA hold time to I2C host controller driver") the driver still has a non-used variable. Remove it here. Signed-off-by: Andy Shevchenko Acked-by: Mika Westerberg Signed-off-by: Lee Jones drivers/mfd/intel-lpss-acpi.c | 4 ---- 1 file changed, 4 deletions(-) commit ca691f7118087a652e4d6c83a30f5ed6d5acbf14 Author: Doug Anderson Date: Wed Mar 1 12:58:32 2017 +0100 mfd: cros ec: spi: Increase wait time to 200ms This is a sucky change to bump up the time we'll wait for the EC. Why is it sucky? If 200ms for a transfer is a common thing it will have a massively bad impact on keyboard responsiveness. It still seems like a good idea to do this, though, because we have a gas gauge that claims that in an extreme case it could stretch the i2c clock for 144ms. It's not a common case so it shouldn't affect responsiveness, but it can happen. It's much better to have a single slow keyboard response than to start returning errors when we don't have to. In newer EC designs we should probably implement a virtual battery to respond to the kernel to insulate the kernel from these types of issues. Signed-off-by: Doug Anderson Signed-off-by: Enric Balletbo i Serra Signed-off-by: Lee Jones drivers/mfd/cros_ec_spi.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) commit d5aa11bfe9cebb4a3912b11748fd84aa15454229 Author: Milo Kim Date: Tue Feb 28 15:45:15 2017 +0900 mfd: Add TI LMU driver TI LMU (Lighting Management Unit) driver supports lighting devices below. LM3532, LM3631, LM3632, LM3633, LM3695 and LM3697. LMU devices have common features. - I2C interface for accessing device registers - Hardware enable pin control - Backlight brightness control - Notifier for hardware fault monitoring - Regulators for LCD display bias It contains fault monitor, backlight, LED and regulator driver. LMU fault monitor ----------------- LM3633 and LM3697 provide hardware monitoring feature. It enables open or short circuit detection. After monitoring is done, each device should be re-initialized. Notifier is used for this case. Separate patch for 'ti-lmu-fault-monitor' will be sent later. Backlight --------- It's handled by TI LMU backlight consolidated driver and chip dependent data. Separate patchset will be sent later. LED indicator ------------- LM3633 has 6 indicator LEDs. Programmable dimming pattern is also supported. Separate patch for 'leds-lm3633' will be sent later. Regulator --------- LM3631 has 5 regulators for the display bias. LM3632 supports 3 regulators. One consolidated driver enables it. The lm363x regulator driver is already upstreamed. Signed-off-by: Milo Kim Tested-by: Tony Lindgren Signed-off-by: Lee Jones drivers/mfd/Kconfig | 12 ++ drivers/mfd/Makefile | 2 + drivers/mfd/ti-lmu.c | 259 +++++++++++++++++++++++++++++++++ include/linux/mfd/ti-lmu-register.h | 280 ++++++++++++++++++++++++++++++++++++ include/linux/mfd/ti-lmu.h | 87 +++++++++++ 5 files changed, 640 insertions(+) commit 287cce719d85311f61d1b6b7f7b0d93f7907cd46 Author: Milo Kim Date: Tue Feb 28 15:45:14 2017 +0900 dt-bindings: mfd: Add TI LMU device binding information This patch describes overall binding for TI LMU MFD devices. Signed-off-by: Milo Kim Acked-by: Rob Herring Acked-by: Tony Lindgren Signed-off-by: Lee Jones Documentation/devicetree/bindings/mfd/ti-lmu.txt | 243 +++++++++++++++++++++++ 1 file changed, 243 insertions(+) commit c0369698e6455c734a772e3acb09cff9a0c8ed9f Author: Rask Ingemann Lambertsen Date: Wed Feb 22 20:42:02 2017 +0100 mfd: axp20x: Add support for dts property "xpowers,master-mode" commit b101829a029a ("mfd: axp20x: Fix AXP806 access errors on cold boot") was intended to fix the case where a board uses an AXP806 in slave mode, but the boot loader leaves it in master mode for lack of AXP806 support. But now the driver breaks on boards where the PMIC is operating in master mode. This patch lets the driver use the new device tree property "xpowers,master-mode" to set the correct operating mode for the board. Fixes: 8824ee857348 ("mfd: axp20x: Add support for AXP806 PMIC") Signed-off-by: Rask Ingemann Lambertsen Signed-off-by: Lee Jones drivers/mfd/axp20x.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) commit 8461cf20d17e0090e9236b73d25b31be4f7fadc5 Author: Rask Ingemann Lambertsen Date: Wed Feb 22 20:41:02 2017 +0100 dt-bindings: mfd: axp20x: Add "xpowers,master-mode" property for AXP806 PMICs commit b101829a029a ("mfd: axp20x: Fix AXP806 access errors on cold boot") was intended to fix the case where a board uses an AXP806 in slave mode, but the boot loader leaves it in master mode for lack of AXP806 support. But now the driver breaks on boards where the PMIC is operating in master mode. To let the device tree describe which mode of operation is needed, this patch introduces a new property "xpowers,master-mode". Fixes: 204ae2963e10 ("mfd: axp20x: Add bindings for AXP806 PMIC") Signed-off-by: Rask Ingemann Lambertsen Acked-by: Chen-Yu Tsai Signed-off-by: Lee Jones Documentation/devicetree/bindings/mfd/axp20x.txt | 3 +++ 1 file changed, 3 insertions(+) commit 159ee7578a7453f3496268950a78a507cf7ac379 Author: Andy Shevchenko Date: Tue Feb 21 13:09:14 2017 +0200 mfd: intel_soc_pmic_core: Remove unnecessary function Since commit 845c877009cf ("i2c / ACPI: Assign IRQ for devices that have GpioInt automatically") I2C core assigns interrupt line to I2C slave devices with regarding to GpioInt() resources. There is no need to repeat this in the driver. Signed-off-by: Andy Shevchenko Signed-off-by: Lee Jones drivers/mfd/intel_soc_pmic_core.c | 26 +------------------------- 1 file changed, 1 insertion(+), 25 deletions(-) commit ae6816ba0f594edb194d108cfa0dedceb59fb0ff Author: Fabrice Gasnier Date: Wed Feb 15 09:04:32 2017 +0100 mfd: stm32-timers: Fix max register STM32 timers register bank size is 0x400. Fix regmap max_register. Signed-off-by: Fabrice Gasnier Acked-by: Benjamin Gaignard Signed-off-by: Lee Jones drivers/mfd/stm32-timers.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 118f6523793d99b3634455e9721836ea5e0592b9 Author: Borislav Petkov Date: Thu Feb 2 21:59:35 2017 +0100 mfd: rtsx: Convert forgotten dev_info() statement to pcr_dbg() It is a debugging statement so make it be issued only then. No functionality change. Signed-off-by: Borislav Petkov Signed-off-by: Lee Jones drivers/mfd/rtsx_pcr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ad48ed0c5763dc08931407e455dff5acdbe96e81 Author: Adam Ford Date: Sun Jan 29 06:40:15 2017 -0600 mfd: twl4030-power: Fix pmic for boards that need vmmc1 on reboot At least two different omap3630/3730 boards booting from MMC1 fail to reboot if the "ti,twl4030-power-idle-osc-off" or "ti,twl4030-power-idle" compatible flags are set. This patch will keep the vmmc1 powered up during reboot allowing the bootloader to load. Signed-off-by: Adam Ford Signed-off-by: Lee Jones drivers/mfd/twl4030-power.c | 1 + 1 file changed, 1 insertion(+) commit f8b7ce67070ae6fe643e1319174ffe02e2e51cf7 Author: Fabrice Gasnier Date: Wed Feb 1 17:41:46 2017 +0100 mfd: stm32-timers: Fix driver removal Add missing of_platform_depopulate() upon driver removal. Signed-off-by: Fabrice Gasnier Signed-off-by: Lee Jones drivers/mfd/stm32-timers.c | 8 ++++++++ 1 file changed, 8 insertions(+) commit f36c1f62700ef9b2e913339e3b9e0d5ef8c618b0 Author: Priyalee Kushwaha Date: Fri Feb 3 18:05:43 2017 +0000 mfd: lpc_ich: Add PCI ID for Intel Cougar Mountain SoC This patches adds the first minimal support to the upstream Linux tree. Signed-off-by: Priyalee Kushwaha Signed-off-by: Alan Cox Signed-off-by: Lee Jones drivers/mfd/lpc_ich.c | 6 ++++++ 1 file changed, 6 insertions(+) commit e04653a9dcf4d98defe2149c885382e5cc72082f Author: Archana Patni Date: Wed Feb 1 17:22:03 2017 +0100 mfd: cros_ec: Add ACPI GPE handler for LID0 devices This patch installs an ACPI GPE handler for LID0 ACPI device to indicate ACPI core that this GPE should stay enabled for lid to work in suspend to idle path. Signed-off-by: Archana Patni Signed-off-by: Thierry Escande Signed-off-by: Lee Jones drivers/mfd/Makefile | 4 +- drivers/mfd/cros_ec.c | 15 ++++-- drivers/mfd/cros_ec_acpi_gpe.c | 103 +++++++++++++++++++++++++++++++++++++++++ include/linux/mfd/cros_ec.h | 18 +++++++ 4 files changed, 136 insertions(+), 4 deletions(-) commit 18973ceb89d5022992e5707e2b0a268ddc39b7e0 Merge: 9f7c7ce b2d4764 6d99971 4f9ab0c f7f6c06 e1d7eb0 Author: Lee Jones Date: Thu Apr 27 09:24:41 2017 +0100 Merge branches 'ib-mfd-gpio-4.12', 'ib-mfd-iio-input-4.12', 'ib-mfd-input-4.12', 'ib-mfd-leds-4.12', 'ib-mfd-phy-4.12' and 'ib-mfd-pinctrl-samsung-4.12' into ibs-for-mfd-merged commit c2701b370e6b4d0022043691b5ac7adad015e4fc Author: Oliver Hartkopp Date: Wed Apr 26 20:14:34 2017 +0200 can: fix CAN BCM build with CONFIG_PROC_FS disabled The introduced namespace support moved the BCM variables for procfs into a per-net data structure. This leads to a build failure with disabled procfs: on x86_64: when CONFIG_PROC_FS is not enabled: ../net/can/bcm.c:1541:14: error: 'struct netns_can' has no member named 'bcmproc_dir' ../net/can/bcm.c:1601:14: error: 'struct netns_can' has no member named 'bcmproc_dir' ../net/can/bcm.c:1696:11: error: 'struct netns_can' has no member named 'bcmproc_dir' ../net/can/bcm.c:1707:15: error: 'struct netns_can' has no member named 'bcmproc_dir' http://marc.info/?l=linux-can&m=149321842526524&w=2 Reported-by: Randy Dunlap Signed-off-by: Oliver Hartkopp Signed-off-by: Marc Kleine-Budde net/can/bcm.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) commit 7569b90a228ed7dfdc1f92f2c98d7a1b041f22eb Author: Christoph Hellwig Date: Tue Apr 25 18:56:44 2017 +0200 nvme-scsi: remove nvme_trans_security_protocol This function just returns the same error code and sense data as the default statement in the switch in the caller. Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch drivers/nvme/host/scsi.c | 13 ------------- 1 file changed, 13 deletions(-) commit 96fd20cf3f1620d699db43cd08745f1e57e1072a Merge: d160a72 22607d6 Author: Ingo Molnar Date: Thu Apr 27 07:41:37 2017 +0200 Merge branch 'rcu/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu into core/rcu Pull RCU updates from Paul E. McKenney: "This series greatly reduces the performance degradation of Tree SRCU on a CPU-hotplug stress test. The effect was not subtle: Mike Galbraith measured Classic SRCU at 55 seconds and Tree SRCU at more than 16 -minutes- for this test. Mike collected ftrace data that showed that Classic SRCU was auto-expediting invocations of synchronize_srcu() that found SRCU completely idle. This series therefore adds this auto-expedite capability to Tree SRCU, bringing the performance shortfall to less than ten seconds, which is a great improvement over the initial shortfall of 15 minutes." Signed-off-by: Ingo Molnar commit d0790fb6e5bc5a6bb923de9c2be7fc210d6b689b Merge: 284c43e 152c1c8 Author: Martin Schwidefsky Date: Thu Apr 27 07:29:40 2017 +0200 Merge branch 's390forkvm' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into features Pull cpacf changes for KVM from Jason Herne: Add query support for the KMA instruction. commit 020c2833dbc76b4069c9a9886b71511052d160df Author: Eric Biggers Date: Sat Mar 25 21:02:18 2017 -0700 fs: remove _submit_bh() _submit_bh() allowed submitting a buffer_head for I/O using custom bio_flags. It used to be used by jbd to set BIO_SNAP_STABLE, introduced by commit 713685111774 ("mm: make snapshotting pages for stable writes a per-bio operation"). However, the code and flag has since been removed and no _submit_bh() users remain. These days, bio_flags are mostly used internally by the block layer to track the state of bio's. As such, it doesn't really make sense for filesystems to use them instead of op_flags when wanting special behavior for block requests. Therefore, remove _submit_bh() and trim the bio_flags argument from submit_bh_wbc(). Cc: Darrick J. Wong Signed-off-by: Eric Biggers Signed-off-by: Al Viro fs/buffer.c | 19 +++++-------------- include/linux/buffer_head.h | 2 -- 2 files changed, 5 insertions(+), 16 deletions(-) commit cda37124f4e95ad5ccb11394a5802b0972668b32 Author: Eric Biggers Date: Sat Mar 25 21:15:37 2017 -0700 fs: constify tree_descr arrays passed to simple_fill_super() simple_fill_super() is passed an array of tree_descr structures which describe the files to create in the filesystem's root directory. Since these arrays are never modified intentionally, they should be 'const' so that they are placed in .rodata and benefit from memory protection. This patch updates the function signature and all users, and also constifies tree_descr.name. Signed-off-by: Eric Biggers Signed-off-by: Al Viro drivers/infiniband/hw/qib/qib_fs.c | 2 +- drivers/xen/xenfs/super.c | 4 ++-- fs/binfmt_misc.c | 2 +- fs/debugfs/inode.c | 2 +- fs/fuse/control.c | 2 +- fs/libfs.c | 2 +- fs/nfsd/nfsctl.c | 2 +- fs/tracefs/inode.c | 2 +- include/linux/fs.h | 5 +++-- kernel/bpf/inode.c | 2 +- security/inode.c | 2 +- security/selinux/selinuxfs.c | 4 ++-- security/smack/smackfs.c | 2 +- 13 files changed, 17 insertions(+), 16 deletions(-) commit a0c111b49bbe11c3970bc668600e3b61fbbb7fca Author: Geliang Tang Date: Sun Apr 9 09:32:14 2017 +0800 fs: drop duplicate header percpu-rwsem.h Drop duplicate header percpu-rwsem.h from linux/fs.h. Signed-off-by: Geliang Tang Signed-off-by: Al Viro include/linux/fs.h | 1 - 1 file changed, 1 deletion(-) commit a80f2d2224544f708b50091b18753f4b530f70c1 Author: Fabian Frederick Date: Mon Apr 24 22:13:10 2017 +0200 fs/affs: bugfix: Write files greater than page size on OFS Previous AFFS patch fixed OFS write operations but unveiled another bug: files greater than 4KB are being created with a wrong size resulting in errors like the following: dd if=/dev/zero of=file bs=4097 count=1 cp file /mnt/affs/ cp: error writing '/mnt/affs/file': Bad address Signed-off-by: Fabian Frederick Signed-off-by: Al Viro fs/affs/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 077e073e8f9ebc6bdd3f3f0324b16db07147a232 Author: Fabian Frederick Date: Mon Apr 24 22:12:57 2017 +0200 fs/affs: bugfix: enable writes on OFS disks We called unconditionally affs_bread_ino() with create 0 resulting in "error (device ...): get_block(): strange block request 0" when trying to write on AFFS OFS format. This patch adds create parameter to that function. 0 for affs_readpage_ofs() 1 for affs_write_begin_ofs() Bug was found here: https://bugzilla.kernel.org/show_bug.cgi?id=114961 Signed-off-by: Fabian Frederick Signed-off-by: Al Viro fs/affs/file.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit a9d6cfb70f71e3d7fb4fe90db40f965e7096bdab Author: Fabian Frederick Date: Sat Apr 15 08:55:11 2017 +0200 fs/affs: remove node generation check node generation has to be stored on disk. AFAICS we won't be able to manage it on AFFS. This patch removes relevant check in affs_nfs_get_inode() Signed-off-by: Fabian Frederick Signed-off-by: Al Viro fs/affs/namei.c | 5 ----- 1 file changed, 5 deletions(-) commit d2d58e0e0d6c750941147e505f4263239427e359 Author: Fabian Frederick Date: Sat Apr 15 08:54:56 2017 +0200 fs/affs: import amigaffs.h Have that file in global include/linux is not needed. Signed-off-by: Fabian Frederick Signed-off-by: Al Viro fs/affs/affs.h | 2 +- fs/affs/amigaffs.h | 144 +++++++++++++++++++++++++++++++++++++++++++++++ include/linux/amigaffs.h | 144 ----------------------------------------------- 3 files changed, 145 insertions(+), 145 deletions(-) commit f1bf90724de652efdf493ea877ee050e7e6091c4 Author: Fabian Frederick Date: Sat Apr 15 08:54:36 2017 +0200 fs/affs: bugfix: make symbolic links work again AFFS symbolic links were broken since kernel 2.6.29 Problem was bisected to the following commit ebd09abbd969 ("vfs: ensure page symlinks are NUL-terminated") commit 035146851cfa ("vfs: introduce helper function to safely NUL-terminate symlinks") AFFS wasn't setting inode size when reading symbolic link from disk or creating a new one. Result was zero allocation in pagecache. ln -s file symlink ls -lrt file symlink -> This patch adds inode isize information on inode get and symbolic link addition. Signed-off-by: Fabian Frederick Signed-off-by: Al Viro fs/affs/inode.c | 1 + fs/affs/namei.c | 1 + 2 files changed, 2 insertions(+) commit b1513c35317c106a1588f3ab32f6888f0e2afd71 Merge: 78a57b4 f832460 Author: David S. Miller Date: Wed Apr 26 22:39:08 2017 -0400 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net Signed-off-by: David S. Miller commit 22607d66bbc3e81140d3bcf08894f4378eb36428 Author: Paul E. McKenney Date: Tue Apr 25 14:03:11 2017 -0700 srcu: Specify auto-expedite holdoff time On small systems, in the absence of readers, expedited SRCU grace periods can complete in less than a microsecond. This means that an eight-CPU system can have all CPUs doing synchronize_srcu() in a tight loop and almost always expedite. This might actually be desirable in some situations, but in general it is a good way to needlessly burn CPU cycles. And in those situations where it is desirable, your friend is the function synchronize_srcu_expedited(). For other situations, this commit adds a kernel parameter that specifies a holdoff between completing the last SRCU grace period and auto-expediting the next. If the next grace period starts before the holdoff expires, auto-expediting is disabled. The holdoff is 50 microseconds by default, and can be tuned to the desired number of nanoseconds. A value of zero disables auto-expediting. Signed-off-by: Paul E. McKenney Tested-by: Mike Galbraith Documentation/admin-guide/kernel-parameters.txt | 8 ++++++++ include/linux/srcutree.h | 1 + kernel/rcu/srcutree.c | 18 +++++++++++++++++- 3 files changed, 26 insertions(+), 1 deletion(-) commit 2da4b2a7fd8de52c44fa83c59f00d38a0d90caae Author: Paul E. McKenney Date: Tue Apr 25 11:34:40 2017 -0700 srcu: Expedite first synchronize_srcu() when idle Classic SRCU in effect expedites the first synchronize_srcu() when SRCU is idle, and Mike Galbraith demonstrated that some use cases do in fact rely on this behavior. In particular, Mike showed that Steven Rostedt's hotplug stress script takes 55 seconds with Classic SRCU and more than 16 -minutes- when running Tree SRCU. Assuming that each Tree SRCU's call to synchronize_srcu() takes four milliseconds, this implies that Steven's test invokes synchronize_srcu() in isolation, but more than once per 200 microseconds. Mike used ftrace to demonstrate that the time between successive calls to synchronize_srcu() ranged from 118 to 342 microseconds, with one outlier at 80 milliseconds. This data clearly indicates that Tree SRCU needs to expedite the first invocation of synchronize_srcu() during an SRCU idle period. This commit therefor introduces a srcu_might_be_idle() function that probabilistically checks whether or not SRCU is idle. This function is used by synchronize_rcu() as an additional criterion in deciding whether or not to expedite. (Hat trick to Peter Zijlstra for his earlier suggestion that this might in fact be a problem. Which for all I know might have motivated Mike to look into it.) Reported-by: Mike Galbraith Signed-off-by: Paul E. McKenney Tested-by: Mike Galbraith kernel/rcu/srcutree.c | 59 ++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 58 insertions(+), 1 deletion(-) commit 1e9a038b7fe9a8c10ef1238f4e695d5fbe0dd594 Author: Paul E. McKenney Date: Mon Apr 24 16:02:09 2017 -0700 srcu: Expedited grace periods with reduced memory contention Commit f60d231a87c5 ("srcu: Crude control of expedited grace periods") introduced a per-srcu_struct atomic counter to track outstanding requests for grace periods. This works, but represents a memory-contention bottleneck. This commit therefore uses the srcu_node combining tree to remove this bottleneck. This commit adds new ->srcu_gp_seq_needed_exp fields to the srcu_data, srcu_node, and srcu_struct structures, which track the farthest-in-the-future grace period that must be expedited, which in turn requires that all nearer-term grace periods also be expedited. Requests for expediting start with the srcu_data structure, run up through the srcu_node tree, and end at the srcu_struct structure. Note that it may be necessary to expedite a grace period that just now started, and this is handled by a new srcu_funnel_exp_start() function, which is invoked when the grace period itself is already in its way, but when that grace period was not marked as expedited. A new srcu_get_delay() function returns zero if there is at least one expedited SRCU grace period in flight, or SRCU_INTERVAL otherwise. This function is used to calculate delays: Normal grace periods are allowed to extend in order to cover more requests with a given grace-period computation, which decreases per-request overhead. Signed-off-by: Paul E. McKenney Tested-by: Mike Galbraith include/linux/srcutree.h | 4 +- kernel/rcu/srcutree.c | 135 +++++++++++++++++++++++++++++++++-------------- 2 files changed, 98 insertions(+), 41 deletions(-) commit e7731da36f107e87b0ea137265ebcc991972e14c Author: Colin Ian King Date: Tue Apr 25 22:37:10 2017 +0100 scsi: qla4xxx: fix spelling mistake: "Tempalate" -> "Template" trivial fix to spelling mistake in DEBUG2 debug message Signed-off-by: Colin Ian King Acked-by: Manish Rangankar Signed-off-by: Martin K. Petersen drivers/scsi/qla4xxx/ql4_init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9385c5be5ce03d023a1cd860376aed7fd1f3a5b3 Author: Colin Ian King Date: Tue Apr 25 18:36:19 2017 +0100 scsi: stex: make S6flag static This module specific flag can be made static as it does not need to be in global scope. Signed-off-by: Colin Ian King Acked-by: Charles Chiou Signed-off-by: Martin K. Petersen drivers/scsi/stex.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c0e3a6acdebc5b98c65a379460df1b4b2fe6c0d3 Author: Wei Yongjun Date: Wed Apr 26 15:43:59 2017 +1000 scsi: mac_esp: fix to pass correct device identity to free_irq() free_irq() expects the same device identity that was passed to corresponding request_irq(), otherwise the IRQ is not freed. Signed-off-by: Wei Yongjun Signed-off-by: Finn Thain Signed-off-by: Martin K. Petersen drivers/scsi/mac_esp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c8e8ab1e4c1e0879f21e39504bf7fc01c0b5865f Author: Bob Moore Date: Wed Apr 26 16:19:10 2017 +0800 ACPICA: Local cache support: Allow small cache objects ACPICA commit 9c54b8bbd483421ef2fef5225c00f1655b4a491c Remove apparently arbitrary restriction on the size of the cache objects to 16 (in acpi_os_create_cache). Now, the input object size must be simply non-zero. Link: https://github.com/acpica/acpica/commit/9c54b8bb Signed-off-by: Bob Moore Signed-off-by: Lv Zheng Signed-off-by: Rafael J. Wysocki drivers/acpi/acpica/utcache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bee900db6d4d9822d8ce6b44f77d23a3c0aa3131 Author: David E. Box Date: Wed Apr 26 16:18:55 2017 +0800 ACPICA: Disassembler: Do not unconditionally remove temporary names ACPICA commit c46f496df41e53a368f877f88b70bdfc9bd6fdbe Change the Switch disassembly code to check if the conversion can be done before removing temporary (_T_x) names. Prevents invalid disassembly of AML created by older compilers (circa 2005). Link: https://github.com/acpica/acpica/commit/c46f496d Link: https://bugs.acpica.org/show_bug.cgi?id=1358 Link: https://bugs.acpica.org/show_bug.cgi?id=1360 Reported-by: racerrehabman@gmail.com Signed-off-by: David E. Box Signed-off-by: Bob Moore Signed-off-by: Lv Zheng Signed-off-by: Rafael J. Wysocki drivers/acpi/acpica/aclocal.h | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit bb1e23e66e6237ff7a1824b37366540a89149c33 Author: Lv Zheng Date: Wed Apr 26 16:18:49 2017 +0800 ACPICA: iasl: Fix IORT SMMU GSI disassembling ACPICA commit 637b88de24a78c20478728d9d66632b06fcaa5bf If the IORT template is compiled and then iort.aml binary disassembled to iort.dsl, SMMUv1 node lists incorrect offset for SMMU_Nsg_cfg_irpt Interrupt: [0ECh 0236 8] SMMU_Nsg_irpt Interrupt : 0000000000000000 [0ECh 0236 8] SMMU_Nsg_cfg_irpt Interrupt : 0000000000000000 This is because iasl hasn't implemented SMMU GSI decoding yet. This patch fixes this issue by preparing structures for decoding IORT SMMU GSI. ACPICA BZ 1340, reported by Alexei Fedorov, fixed by Lv Zheng. Link: https://github.com/acpica/acpica/commit/637b88de Link: https://bugs.acpica.org/show_bug.cgi?id=1340 Reported-by: Alexei Fedorov Signed-off-by: Lv Zheng Signed-off-by: Bob Moore Signed-off-by: Rafael J. Wysocki include/acpi/actbl2.h | 9 +++++++++ 1 file changed, 9 insertions(+) commit 9ff5a21a50301ef16aeb2e3937867de7eb0af030 Author: Bob Moore Date: Wed Apr 26 16:18:40 2017 +0800 ACPICA: Cleanup AML opcode definitions, no functional change ACPICA commit ec969d38fef3be95358e65f0dd071b5f2c045b6b This change is a cleanup and further standardization of the AML opcode defines in amlcode.h Improves the readability and maintainability of the source code. Link: https://github.com/acpica/acpica/commit/ec969d38 Signed-off-by: Bob Moore Signed-off-by: Lv Zheng Signed-off-by: Rafael J. Wysocki drivers/acpi/acpica/amlcode.h | 97 ++++++++++++++++++----------------------- drivers/acpi/acpica/dbxface.c | 2 +- drivers/acpi/acpica/dscontrol.c | 2 +- drivers/acpi/acpica/dsmthdat.c | 3 +- drivers/acpi/acpica/dsobject.c | 15 ++++--- drivers/acpi/acpica/dsopcode.c | 4 +- drivers/acpi/acpica/dsutils.c | 8 ++-- drivers/acpi/acpica/dswexec.c | 2 +- drivers/acpi/acpica/dswload2.c | 2 +- drivers/acpi/acpica/exmisc.c | 16 +++---- drivers/acpi/acpica/exnames.c | 4 +- drivers/acpi/acpica/exoparg1.c | 17 ++++---- drivers/acpi/acpica/exoparg2.c | 4 +- drivers/acpi/acpica/exoparg6.c | 16 +++---- drivers/acpi/acpica/exresolv.c | 3 +- drivers/acpi/acpica/exstore.c | 5 ++- drivers/acpi/acpica/exstoren.c | 2 +- drivers/acpi/acpica/nsaccess.c | 2 +- drivers/acpi/acpica/nsutils.c | 6 +-- drivers/acpi/acpica/psargs.c | 6 +-- drivers/acpi/acpica/psloop.c | 2 +- drivers/acpi/acpica/psopcode.c | 10 ++--- drivers/acpi/acpica/psparse.c | 6 +-- drivers/acpi/acpica/pstree.c | 2 +- 24 files changed, 114 insertions(+), 122 deletions(-) commit 069f9bf454a61d6fafa415dc2a8713938196d650 Author: Lv Zheng Date: Wed Apr 26 16:18:33 2017 +0800 ACPICA: Debugger: Add interpreter blocking mark for single-step mode ACPICA commit 91af5d18cd40b35f9d5568fb95fc403ff12474e5 When the single-step mode is used, evaluation is actually split by the single-step command prompts, so this patch correctly marks the evaluation segment with interpreter lock release/acquire. This in return fixes an issue that in the single-step command prompt, commands requiring to hold the namespace lock (ex. namespace) cannot be executed. ACPICA BZ 1362, fixed by Lv Zheng. Link: https://github.com/acpica/acpica/commit/91af5d18 Link: https://bugs.acpica.org/show_bug.cgi?id=1362 Signed-off-by: Lv Zheng Signed-off-by: Bob Moore Signed-off-by: Rafael J. Wysocki drivers/acpi/acpica/dbxface.c | 3 +++ 1 file changed, 3 insertions(+) commit 1f67ef69941e252d5a3558426338a84acce73d89 Author: Colin Ian King Date: Wed Apr 26 16:18:25 2017 +0800 ACPICA: debugger: fix memory leak on Pathname ACPICA commit 1db14dc88f308119634d77ab9dcb6586b9fe4777 On the error return path when acpi_get_object_info fails the allocated pathname is not free'd leading to a memory leak. Free pathname to fix this. Link: https://github.com/acpica/acpica/commit/1db14dc8 Signed-off-by: Colin Ian King Signed-off-by: Bob Moore Signed-off-by: Lv Zheng Signed-off-by: Rafael J. Wysocki drivers/acpi/acpica/dbmethod.c | 1 + 1 file changed, 1 insertion(+) commit ed7f8bc91a8df96662b21accc9a5abe2c292014a Author: Bob Moore Date: Wed Apr 26 16:18:16 2017 +0800 ACPICA: Update for automatic repair code for objects returned by evaluate_object ACPICA commit 6b58810b9aad7358fbf1a0f4057fefa8d29838d3 This change fixes two instances where the repair code made an incorrect assumption about how reference counts are assigned to package objects. Resolves issues where a warning was issued about a "large reference count" -- which usually indicates an attempt to delete an object that has previously been poisoned and released into the object cache. Link: https://github.com/acpica/acpica/commit/6b58810b Signed-off-by: Bob Moore Signed-off-by: Lv Zheng Signed-off-by: Rafael J. Wysocki drivers/acpi/acpica/nsrepair.c | 16 +++------------- drivers/acpi/acpica/nsrepair2.c | 6 +----- 2 files changed, 4 insertions(+), 18 deletions(-) commit 3b2d69114fefa474fca542e51119036dceb4aa6f Author: Seunghun Han Date: Wed Apr 26 16:18:08 2017 +0800 ACPICA: Namespace: fix operand cache leak ACPICA commit a23325b2e583556eae88ed3f764e457786bf4df6 I found some ACPI operand cache leaks in ACPI early abort cases. Boot log of ACPI operand cache leak is as follows: >[ 0.174332] ACPI: Added _OSI(Module Device) >[ 0.175504] ACPI: Added _OSI(Processor Device) >[ 0.176010] ACPI: Added _OSI(3.0 _SCP Extensions) >[ 0.177032] ACPI: Added _OSI(Processor Aggregator Device) >[ 0.178284] ACPI: SCI (IRQ16705) allocation failed >[ 0.179352] ACPI Exception: AE_NOT_ACQUIRED, Unable to install System Control Interrupt handler (20160930/evevent-131) >[ 0.180008] ACPI: Unable to start the ACPI Interpreter >[ 0.181125] ACPI Error: Could not remove SCI handler (20160930/evmisc-281) >[ 0.184068] kmem_cache_destroy Acpi-Operand: Slab cache still has objects >[ 0.185358] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.10.0-rc3 #2 >[ 0.186820] Hardware name: innotek gmb_h virtual_box/virtual_box, BIOS virtual_box 12/01/2006 >[ 0.188000] Call Trace: >[ 0.188000] ? dump_stack+0x5c/0x7d >[ 0.188000] ? kmem_cache_destroy+0x224/0x230 >[ 0.188000] ? acpi_sleep_proc_init+0x22/0x22 >[ 0.188000] ? acpi_os_delete_cache+0xa/0xd >[ 0.188000] ? acpi_ut_delete_caches+0x3f/0x7b >[ 0.188000] ? acpi_terminate+0x5/0xf >[ 0.188000] ? acpi_init+0x288/0x32e >[ 0.188000] ? __class_create+0x4c/0x80 >[ 0.188000] ? video_setup+0x7a/0x7a >[ 0.188000] ? do_one_initcall+0x4e/0x1b0 >[ 0.188000] ? kernel_init_freeable+0x194/0x21a >[ 0.188000] ? rest_init+0x80/0x80 >[ 0.188000] ? kernel_init+0xa/0x100 >[ 0.188000] ? ret_from_fork+0x25/0x30 When early abort is occurred due to invalid ACPI information, Linux kernel terminates ACPI by calling acpi_terminate() function. The function calls acpi_ns_terminate() function to delete namespace data and ACPI operand cache (acpi_gbl_module_code_list). But the deletion code in acpi_ns_terminate() function is wrapped in ACPI_EXEC_APP definition, therefore the code is only executed when the definition exists. If the define doesn't exist, ACPI operand cache (acpi_gbl_module_code_list) is leaked, and stack dump is shown in kernel log. This causes a security threat because the old kernel (<= 4.9) shows memory locations of kernel functions in stack dump, therefore kernel ASLR can be neutralized. To fix ACPI operand leak for enhancing security, I made a patch which removes the ACPI_EXEC_APP define in acpi_ns_terminate() function for executing the deletion code unconditionally. Link: https://github.com/acpica/acpica/commit/a23325b2 Signed-off-by: Seunghun Han Signed-off-by: Lv Zheng Signed-off-by: Bob Moore Signed-off-by: Rafael J. Wysocki drivers/acpi/acpica/nsutils.c | 23 +++++++++-------------- 1 file changed, 9 insertions(+), 14 deletions(-) commit 2e337c72a3c24f0cf9bf639dc93de0f887d56dba Author: Bob Moore Date: Wed Apr 26 16:18:02 2017 +0800 ACPICA: Fix several incorrect invocations of ACPICA return macro ACPICA commit 521bedc49b42e59116de1b54dcd95d30d36cac90 Not needed since there is no function tracing for the validation function in hwvalid.c Link: https://github.com/acpica/acpica/commit/521bedc4 Signed-off-by: Bob Moore Signed-off-by: Lv Zheng Signed-off-by: Rafael J. Wysocki drivers/acpi/acpica/hwvalid.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 1b8f77aa0deca22a995a4bdd65914aa24bda0386 Author: Bob Moore Date: Wed Apr 26 16:17:56 2017 +0800 ACPICA: Fix a module for excessive debug output ACPICA commit 5ecc479f62a57ab1e9d25ec3b0b84682fdf8a543 hwvalid.c - no trace needed for validate I/O function. Link: https://github.com/acpica/acpica/commit/5ecc479f Signed-off-by: Bob Moore Signed-off-by: Lv Zheng Signed-off-by: Rafael J. Wysocki drivers/acpi/acpica/hwvalid.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) commit a20286249e4120c7997353ff8980248302c653b5 Author: Bob Moore Date: Wed Apr 26 16:17:50 2017 +0800 ACPICA: Update some function headers, no funtional change ACPICA commit 57c1b2d3e2f9ff7f465b0f08bfb38294101fe0b3 utxferror, update function headers. Link: https://github.com/acpica/acpica/commit/57c1b2d3 Signed-off-by: Bob Moore Signed-off-by: Lv Zheng Signed-off-by: Rafael J. Wysocki drivers/acpi/acpica/utxferror.c | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) commit da28e1955d7fc228870f437693cfae8ce486ad9f Author: Bob Moore Date: Wed Apr 26 16:17:43 2017 +0800 ACPICA: Disassembler: Enhance resource descriptor detection ACPICA commit ba5020b2dbe1538e4ccd7ac2dfd8843a690c007f This change enhances the detection of resource descriptors within a buffer object. For the end_tag opcode, the second byte is defined to be either a checksum or zero. All known ASL compilers insert a zero for this byte. The disassembler now ensures this byte is zero before deciding that a buffer should be disassembled to a resource descriptor. This helps eliminate incorrect decisions when attempting to disassemble a buffer to a resource descriptor. Link: https://github.com/acpica/acpica/commit/ba5020b2 Signed-off-by: Bob Moore Signed-off-by: Lv Zheng Signed-off-by: Rafael J. Wysocki drivers/acpi/acpica/utresrc.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit f481973d5efdb63b7c6ca6b0ecd2b8462556a461 Author: Mahesh Rajashekhara Date: Wed Apr 5 16:14:16 2017 +0530 scsi: aacraid: pci_alloc_consistent() failures on ARM64 There were pci_alloc_consistent() failures on ARM64 platform. Use dma_alloc_coherent() with GFP_KERNEL flag DMA memory allocations. Signed-off-by: Mahesh Rajashekhara [hch: tweaked indentation, removed memsets] Signed-off-by: Christoph Hellwig Acked-by: Dave Carroll Signed-off-by: Martin K. Petersen drivers/scsi/aacraid/aachba.c | 13 ++++++------- drivers/scsi/aacraid/commctrl.c | 6 ++++-- drivers/scsi/aacraid/comminit.c | 3 +-- drivers/scsi/aacraid/commsup.c | 20 +++++++++++--------- drivers/scsi/aacraid/linit.c | 8 ++++---- drivers/scsi/aacraid/rx.c | 16 +++++++++------- 6 files changed, 35 insertions(+), 31 deletions(-) commit 0de0e198bc7191a0e46cf71f66fec4d07ca91396 Author: Dan Williams Date: Tue Apr 25 12:58:31 2017 -0700 ACPI / sysfs: fix acpi_get_table() leak / acpi-sysfs denial of service Reading an ACPI table through the /sys/firmware/acpi/tables interface more than 65,536 times leads to the following log message: ACPI Error: Table ffff88033595eaa8, Validation count is zero after increment (20170119/tbutils-423) ...and the table being unavailable until the next reboot. Add the missing acpi_put_table() so the table ->validation_count is decremented after each read. Reported-by: Anush Seetharaman Fixes: 174cc7187e6f "ACPICA: Tables: Back port acpi_get_table_with_size() ..." Signed-off-by: Dan Williams Cc: 4.10+ # 4.10+ Signed-off-by: Rafael J. Wysocki drivers/acpi/sysfs.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 6cf161150d815da0ee8cff158b185bc33dca3a34 Author: Tomohiro Kusumi Date: Wed Apr 26 20:28:58 2017 +0300 scsi: ufs: make ufshcd_get_lists_status() register operation obvious It could be just cmp 0xe instead of >>1 and cmp 0x7, with readable code. Signed-off-by: Tomohiro Kusumi Reviewed-by: Subhash Jadavani Signed-off-by: Martin K. Petersen drivers/scsi/ufs/ufshcd.c | 11 +---------- drivers/scsi/ufs/ufshci.h | 4 ++++ 2 files changed, 5 insertions(+), 10 deletions(-) commit d7e2ddd5e502c93dc29114cf6de5fba339b28e4d Author: Tomohiro Kusumi Date: Thu Apr 20 15:01:44 2017 +0300 scsi: ufs: use MASK_EE_STATUS MASK_EE_STATUS added by 66ec6d59 was unused, but it seems to have been defined to do this. Signed-off-by: Tomohiro Kusumi Reviewed-by: Subhash Jadavani Signed-off-by: Martin K. Petersen drivers/scsi/ufs/ufshcd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 58dd8abfad028633d36e2ba81109bd62f6e6e215 Author: Hanjun Guo Date: Sat Apr 22 11:23:44 2017 +0800 i2c: designware: Add ACPI HID for Hisilicon Hip07/08 I2C controller Add ACPI HID HISI02A1 and HISI02A2 for Hisilicon Hip07/08, which have different clock frequency. Signed-off-by: Hanjun Guo Acked-by: Jarkko Nikula Signed-off-by: Rafael J. Wysocki drivers/i2c/busses/i2c-designware-platdrv.c | 2 ++ 1 file changed, 2 insertions(+) commit 6e14cf361a0cf3bbe0026557427a7eb2f64d3157 Author: Hanjun Guo Date: Sat Apr 22 11:23:43 2017 +0800 ACPI / APD: Add clock frequency for Hisilicon Hip07/08 I2C controller I2C clock frequency of Designware ip for Hisilicon Hip07 is 200M, but 250M for Hip08, use two ACPI IDs to differentiate them. Signed-off-by: Hanjun Guo Reviewed-by: Kefeng Wang Signed-off-by: Rafael J. Wysocki drivers/acpi/acpi_apd.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit 753a448c27a0238dc1db58cd6954e8ef511a97e1 Author: Hans de Goede Date: Fri Apr 21 12:47:41 2017 +0200 ACPI / bus: Add INT0002 to list of always-present devices The INT0002 device is necessary to clear wakeup interrupt sources on Cherry Trail devices, without it we get nobody cared IRQ msgs and some systems don't properly resume at all without it. Signed-off-by: Hans de Goede Signed-off-by: Rafael J. Wysocki drivers/acpi/x86/utils.c | 5 +++++ 1 file changed, 5 insertions(+) commit b7ecf663c75eed1e764f57281f9508c49c18516e Author: Hans de Goede Date: Fri Apr 21 12:47:40 2017 +0200 ACPI / bus: Introduce a list of ids for "always present" devices Several Bay / Cherry Trail devices (all of which ship with Windows 10) hide the LPSS PWM controller in ACPI, typically the _STA method looks like this: Method (_STA, 0, NotSerialized) // _STA: Status { If (OSID == One) { Return (Zero) } Return (0x0F) } Where OSID is some dark magic seen in all Cherry Trail ACPI tables making the machine behave differently depending on which OS it *thinks* it is booting, this gets set in a number of ways which we cannot control, on some newer machines it simple hardcoded to "One" aka win10. This causes the PWM controller to get hidden, which means Linux cannot control the backlight level on cht based tablets / laptops. Since loading the driver for this does no harm (the only in kernel user of it is the i915 driver, which will only uses it when it needs it), this commit makes acpi_bus_get_status() always set status to ACPI_STA_DEFAULT for the LPSS PWM device, fixing the lack of backlight control. Signed-off-by: Hans de Goede [ rjw: Rename the new file to utils.c ] Signed-off-by: Rafael J. Wysocki drivers/acpi/Makefile | 1 + drivers/acpi/bus.c | 5 +++ drivers/acpi/x86/utils.c | 85 ++++++++++++++++++++++++++++++++++++++++++++++++ include/acpi/acpi_bus.h | 9 +++++ 4 files changed, 100 insertions(+) commit bfd20f1cc85010d2f2d77e544da05cd8c149ba9b Author: Shaohua Li Date: Wed Apr 26 09:18:35 2017 -0700 x86, iommu/vt-d: Add an option to disable Intel IOMMU force on IOMMU harms performance signficantly when we run very fast networking workloads. It's 40GB networking doing XDP test. Software overhead is almost unaware, but it's the IOTLB miss (based on our analysis) which kills the performance. We observed the same performance issue even with software passthrough (identity mapping), only the hardware passthrough survives. The pps with iommu (with software passthrough) is only about ~30% of that without it. This is a limitation in hardware based on our observation, so we'd like to disable the IOMMU force on, but we do want to use TBOOT and we can sacrifice the DMA security bought by IOMMU. I must admit I know nothing about TBOOT, but TBOOT guys (cc-ed) think not eabling IOMMU is totally ok. So introduce a new boot option to disable the force on. It's kind of silly we need to run into intel_iommu_init even without force on, but we need to disable TBOOT PMR registers. For system without the boot option, nothing is changed. Signed-off-by: Shaohua Li Signed-off-by: Joerg Roedel Documentation/admin-guide/kernel-parameters.txt | 9 +++++++++ arch/x86/kernel/tboot.c | 3 +++ drivers/iommu/intel-iommu.c | 18 ++++++++++++++++++ include/linux/dma_remapping.h | 1 + 4 files changed, 31 insertions(+) commit e5f2e0671e7ffb0723c5d96684d8fa1ea2403074 Author: Luca Coelho Date: Wed Apr 26 10:58:54 2017 +0300 mac80211: make multicast variable a bool in ieee80211_accept_frame() The multicast variable in the ieee80211_accept_frame() function is treated as a boolean, but defined as int. Fix that. Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg net/mac80211/rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4a199068230bd8074f2e39025a2216390ea5b829 Author: Johannes Berg Date: Wed Apr 26 10:58:53 2017 +0300 mac80211: disentangle iflist_mtx and chanctx_mtx At least on iwlwifi, sometimes lockdep complains that we can lock chanctx_mtx -> mvm.mutex -> iflist_mtx (due to iterate_interfaces) and iflist_mtx -> chanctx_mtx Remove the latter dependency in mac80211 by using the RTNL that we already hold in one case, and can relatively easily achieve in the other case. Signed-off-by: Johannes Berg net/mac80211/cfg.c | 6 +----- net/mac80211/main.c | 2 ++ net/mac80211/util.c | 9 ++++++--- 3 files changed, 9 insertions(+), 8 deletions(-) commit cf147085fdda044622973a12e4e06f1c753ab677 Author: Emmanuel Grumbach Date: Wed Apr 26 10:58:51 2017 +0300 mac80211: don't parse encrypted management frames in ieee80211_frame_acked ieee80211_frame_acked is called when a frame is acked by the peer. In case this is a management frame, we check if this an SMPS frame, in which case we can update our antenna configuration. When we parse the management frame we look at the category in case it is an action frame. That byte sits after the IV in case the frame was encrypted. This means that if the frame was encrypted, we basically look at the IV instead of looking at the category. It is then theorically possible that we think that an SMPS action frame was acked where really we had another frame that was encrypted. Since the only management frame whose ack needs to be tracked is the SMPS action frame, and that frame is not a robust management frame, it will never be encrypted. The easiest way to fix this problem is then to not look at frames that were encrypted. Signed-off-by: Emmanuel Grumbach Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg net/mac80211/status.c | 1 + 1 file changed, 1 insertion(+) commit f6601e176c8b01bc545959c091778343a8c66951 Author: Johannes Berg Date: Wed Apr 26 10:58:52 2017 +0300 ieee80211: fix kernel-doc parsing errors Some of the enum definitions are unnamed but there's still an attempt at documenting them - that doesn't work. Name them to make that work. Signed-off-by: Johannes Berg include/linux/ieee80211.h | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 2ead3235fd7128347a60a3942b3e2048834d62aa Author: Luca Coelho Date: Wed Apr 26 10:58:48 2017 +0300 ieee80211: add FT-802.1X AKM suite selector Add the definition for FT-8021.1X AKM selector as defined in IEEE Std 802.11-2016, table 9-133. Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg include/linux/ieee80211.h | 1 + 1 file changed, 1 insertion(+) commit 1cbf41dbacb6c8decdf8d838bbf5ca5b448a269f Author: Luca Coelho Date: Wed Apr 26 10:58:46 2017 +0300 ieee80211: add SUITE_B AKM selectors Add the definitions for SUITE_B and SUITE_B_192 AKM selectors as defined in IEEE802.11REVmc_D5.0, table 9-132. Signed-off-by: Luca Coelho Signed-off-by: Johannes Berg include/linux/ieee80211.h | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-) commit 3a3ecf1d5971b1f272124b445ef2d6b6ad3074fd Author: Arend Van Spriel Date: Fri Apr 21 13:05:02 2017 +0100 cfg80211: add request id parameter to .sched_scan_stop() signature For multiple scheduled scan support the driver needs to know which scheduled scan request is being stopped. Pass the request id in the .sched_scan_stop() callback. Reviewed-by: Hante Meuleman Reviewed-by: Pieter-Paul Giesberts Reviewed-by: Franky Lin Signed-off-by: Arend van Spriel Signed-off-by: Johannes Berg drivers/net/wireless/ath/ath6kl/cfg80211.c | 2 +- .../net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 6 +++--- drivers/net/wireless/marvell/mwifiex/cfg80211.c | 2 +- include/net/cfg80211.h | 15 ++++++++------- net/mac80211/cfg.c | 3 ++- net/wireless/rdev-ops.h | 6 +++--- net/wireless/scan.c | 2 +- net/wireless/trace.h | 10 +++++----- 8 files changed, 24 insertions(+), 22 deletions(-) commit 3007e3529ce1efd9c370a7b81633e45f730ae35b Author: Arend Van Spriel Date: Fri Apr 21 13:05:01 2017 +0100 nl80211: add support for BSSIDs in scheduled scan matchsets This patch allows for the scheduled scan request to specify matchsets for specific BSSIDs. Reviewed-by: Hante Meuleman Reviewed-by: Pieter-Paul Giesberts Reviewed-by: Franky Lin Signed-off-by: Arend van Spriel [docs, netlink policy fix] Signed-off-by: Johannes Berg include/net/cfg80211.h | 6 +++++- include/uapi/linux/nl80211.h | 4 ++++ net/wireless/nl80211.c | 40 ++++++++++++++++++++++++++++++---------- 3 files changed, 39 insertions(+), 11 deletions(-) commit ca986ad9bcd3893c8b0b4cc2cafcc8cf1554409c Author: Arend Van Spriel Date: Fri Apr 21 13:05:00 2017 +0100 nl80211: allow multiple active scheduled scan requests This patch implements the idea to have multiple scheduled scan requests running concurrently. It mainly illustrates how to deal with the incoming request from user-space in terms of backward compatibility. In order to use multiple scheduled scans user-space needs to provide a flag attribute NL80211_ATTR_SCHED_SCAN_MULTI to indicate support. If not the request is treated as a legacy scan. Drivers currently supporting scheduled scan are now indicating they support a single scheduled scan request. This obsoletes WIPHY_FLAG_SUPPORTS_SCHED_SCAN. Reviewed-by: Hante Meuleman Reviewed-by: Pieter-Paul Giesberts Reviewed-by: Franky Lin Signed-off-by: Arend van Spriel [clean up netlink destroy path to avoid allocations, code cleanups] Signed-off-by: Johannes Berg drivers/net/wireless/ath/ath6kl/cfg80211.c | 2 +- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 2 +- drivers/net/wireless/marvell/mwifiex/cfg80211.c | 2 +- drivers/net/wireless/ti/wlcore/main.c | 2 +- include/net/cfg80211.h | 9 +- include/uapi/linux/nl80211.h | 12 ++- net/wireless/core.c | 29 +++--- net/wireless/core.h | 11 +- net/wireless/nl80211.c | 63 ++++++++--- net/wireless/rdev-ops.h | 2 +- net/wireless/scan.c | 115 +++++++++++++++++---- net/wireless/trace.h | 18 ++-- 13 files changed, 205 insertions(+), 64 deletions(-) commit ab81007a7b519d72f3c26d753a9fe1ffd27edc20 Author: Johannes Berg Date: Wed Apr 26 07:43:41 2017 +0200 cfg80211: simplify netlink socket owner interface deletion There's no need to allocate a portid structure and then, for each of those, walk the interfaces - we can just add a flag to each interface and walk those directly. Due to padding in the struct, we can even do it without any memory cost, and it even simplifies the code. Signed-off-by: Johannes Berg include/net/cfg80211.h | 6 ++++-- net/wireless/core.c | 26 ++++---------------------- net/wireless/core.h | 8 -------- net/wireless/nl80211.c | 22 +++++----------------- 4 files changed, 13 insertions(+), 49 deletions(-) commit 0eebd005dd07c162e6af053be0ab440dd766b1d5 Author: Bart Van Assche Date: Wed Apr 26 13:47:57 2017 -0700 scsi: Implement blk_mq_ops.show_rq() Show the SCSI CDB for pending SCSI commands in /sys/kernel/debug/block/*/mq/*/dispatch and */rq_list. An example of how SCSI commands are displayed by this code: ffff8801703245c0 {.op=READ, .cmd_flags=META PRIO, .rq_flags=DONTPREP IO_STAT STATS, .tag=14, .internal_tag=-1, .cmd=Read(10) 28 00 2a 81 1b 30 00 00 08 00} Signed-off-by: Bart Van Assche Reviewed-by: Omar Sandoval Cc: Martin K. Petersen Cc: James Bottomley Cc: Hannes Reinecke Cc: Signed-off-by: Jens Axboe drivers/scsi/Makefile | 1 + drivers/scsi/scsi_debugfs.c | 13 +++++++++++++ drivers/scsi/scsi_debugfs.h | 4 ++++ drivers/scsi/scsi_lib.c | 4 ++++ 4 files changed, 22 insertions(+) commit 2836ee4b1acbe7b396219d0677426885f14cd792 Author: Bart Van Assche Date: Wed Apr 26 13:47:56 2017 -0700 blk-mq: Add blk_mq_ops.show_rq() This new callback function will be used in the next patch to show more information about SCSI requests. Signed-off-by: Bart Van Assche Reviewed-by: Omar Sandoval Cc: Hannes Reinecke Signed-off-by: Jens Axboe block/blk-mq-debugfs.c | 6 +++++- include/linux/blk-mq.h | 8 ++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) commit 8658dca8bd5666f50e02400f844079e520641d8c Author: Bart Van Assche Date: Wed Apr 26 13:47:55 2017 -0700 blk-mq: Show operation, cmd_flags and rq_flags names Show the operation name, .cmd_flags and .rq_flags as names instead of numbers. Signed-off-by: Bart Van Assche Reviewed-by: Omar Sandoval Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe block/blk-mq-debugfs.c | 72 +++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 69 insertions(+), 3 deletions(-) commit fd07dc81850e8bf26046bf7ccd7430211c9c5910 Author: Bart Van Assche Date: Wed Apr 26 13:47:54 2017 -0700 blk-mq: Make blk_flags_show() callers append a newline character This patch does not change any functionality but makes it possible to produce a single line of output with multiple flag-to-name translations. Signed-off-by: Bart Van Assche Reviewed-by: Omar Sandoval Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe block/blk-mq-debugfs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 65ca1ca32ca359e9d75a6fd293128d188dfc0d8a Author: Bart Van Assche Date: Wed Apr 26 13:47:53 2017 -0700 blk-mq: Move the "state" debugfs attribute one level down Move the "state" attribute from the top level to the "mq" directory as requested by Omar. Signed-off-by: Bart Van Assche Reviewed-by: Omar Sandoval Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe block/blk-mq-debugfs.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) commit e869b5462f83bcc771a3301fa7c8de47ed8c74f5 Author: Bart Van Assche Date: Wed Apr 26 13:47:52 2017 -0700 blk-mq: Unregister debugfs attributes earlier We currently call blk_mq_free_queue() from blk_cleanup_queue() before we unregister the debugfs attributes for that queue in blk_release_queue(). This leaves a window open during which accessing most of the mq debugfs attributes would cause a use-after-free. Additionally, the "state" attribute allows running the queue, which we should not do after the queue has entered the "dead" state. Fix both cases by unregistering the debugfs attributes before freeing queue resources starts. Signed-off-by: Bart Van Assche Reviewed-by: Hannes Reinecke Reviewed-by: Omar Sandoval Signed-off-by: Jens Axboe block/blk-core.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit f05d1ba7871a2c20ca9ebb303aac89c9296d1f58 Author: Bart Van Assche Date: Wed Apr 26 13:47:51 2017 -0700 blk-mq: Only unregister hctxs for which registration succeeded Hctx unregistration involves calling kobject_del(). kobject_del() must not be called if kobject_add() has not been called. Hence in the error path only unregister hctxs for which registration succeeded. Signed-off-by: Bart Van Assche Cc: Omar Sandoval Cc: Hannes Reinecke Signed-off-by: Jens Axboe block/blk-mq-sysfs.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) commit 62d6c9496a2bded5262ac9f675b27facb3cd4ce8 Author: Bart Van Assche Date: Wed Apr 26 13:47:50 2017 -0700 blk-mq-debugfs: Rename functions for registering and unregistering the mq directory Since the blk_mq_debugfs_*register_hctxs() functions register and unregister all attributes under the "mq" directory, rename these into blk_mq_debugfs_*register_mq(). Signed-off-by: Bart Van Assche Reviewed-by: Hannes Reinecke Reviewed-by: Omar Sandoval Signed-off-by: Jens Axboe block/blk-mq-debugfs.c | 8 ++++---- block/blk-mq-sysfs.c | 6 +++--- block/blk-mq.h | 8 ++++---- 3 files changed, 11 insertions(+), 11 deletions(-) commit 4c9e4019f1880bea7ae6e9603d14c2ed0f1c4e23 Author: Bart Van Assche Date: Wed Apr 26 13:47:49 2017 -0700 blk-mq: Let blk_mq_debugfs_register() look up the queue name A later patch will move the call of blk_mq_debugfs_register() to a function to which the queue name is not passed as an argument. To avoid having to add a 'name' argument to multiple callers, let blk_mq_debugfs_register() look up the queue name. Signed-off-by: Bart Van Assche Reviewed-by: Omar Sandoval Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe block/blk-mq-debugfs.c | 5 +++-- block/blk-mq-sysfs.c | 2 +- block/blk-mq.h | 5 ++--- 3 files changed, 6 insertions(+), 6 deletions(-) commit 2d0364c8c1a97a1d44760895a982221c06af0f35 Author: Bart Van Assche Date: Wed Apr 26 13:47:48 2017 -0700 blk-mq: Register /queue/mq after having registered /queue A later patch in this series will modify blk_mq_debugfs_register() such that it uses q->kobj.parent to determine the name of a request queue. Hence make sure that that pointer is initialized before blk_mq_debugfs_register() is called. To avoid lock inversion, protect sysfs / debugfs registration with the queue sysfs_lock instead of the global mutex all_q_mutex. Signed-off-by: Bart Van Assche Reviewed-by: Hannes Reinecke Reviewed-by: Omar Sandoval Signed-off-by: Jens Axboe block/blk-mq-sysfs.c | 35 ++++++++++++++++++++++++++++------- block/blk-mq.h | 1 + block/blk-sysfs.c | 6 +++--- 3 files changed, 32 insertions(+), 10 deletions(-) commit d852ed98f62e0d44f594adb850b3d6cedb5c9292 Author: Arnd Bergmann Date: Fri Apr 21 23:42:54 2017 +0200 usb: host: xhci: remove #ifdef around PM functions The #ifdef is slightly wrong as it doesn't cover the xhci_priv_resume_quirk() function, causing a harmless warning: drivers/usb/host/xhci-plat.c:58:12: error: 'xhci_priv_resume_quirk' defined but not used [-Werror=unused-function] static int xhci_priv_resume_quirk(struct usb_hcd *hcd) A simpler way to do this correctly is to use __maybe_unused annotations that let the compiler silently drop the functions when there is no reference. Fixes: b0c69b4bace3 ("usb: host: plat: Enable xHCI plat runtime PM") Signed-off-by: Arnd Bergmann Signed-off-by: Greg Kroah-Hartman drivers/usb/host/xhci-plat.c | 12 ++++-------- drivers/usb/host/xhci.h | 5 ----- 2 files changed, 4 insertions(+), 13 deletions(-) commit 2a76f89fa58c769241cfc21f2614705591519ae3 Author: Wei Yongjun Date: Tue Apr 25 03:11:48 2017 +0000 firmware: google memconsole: Fix return value check in platform_memconsole_init() In case of error, the function platform_device_register_simple() returns ERR_PTR() and never returns NULL. The NULL test in the return value check should be replaced with IS_ERR(). Fixes: d384d6f43d1e ("firmware: google memconsole: Add coreboot support") Signed-off-by: Wei Yongjun Signed-off-by: Greg Kroah-Hartman drivers/firmware/google/memconsole-coreboot.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 856c634dd204581710157d539a37b7340fb60894 Author: Wei Yongjun Date: Wed Apr 26 13:42:52 2017 +0000 firmware: Google VPD: Fix return value check in vpd_platform_init() In case of error, the function platform_device_register_simple() returns ERR_PTR() and never returns NULL. The NULL test in the return value check should be replaced with IS_ERR(). Fixes: 049a59db34eb ("firmware: Google VPD sysfs driver") Signed-off-by: Wei Yongjun Signed-off-by: Greg Kroah-Hartman drivers/firmware/google/vpd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 78a57b482aa53b040fbc2b2ef0208b54f004161b Author: Willem de Bruijn Date: Tue Apr 25 15:59:17 2017 -0400 virtio-net: on tx, only call napi_disable if tx napi is on As of tx napi, device down (`ip link set dev $dev down`) hangs unless tx napi is enabled. Else napi_enable is not called, so napi_disable will spin on test_and_set_bit NAPI_STATE_SCHED. Only call napi_disable if tx napi is enabled. Fixes: 5a719c2552ca ("virtio-net: transmit napi") Reported-by: Jason Wang Signed-off-by: Willem de Bruijn Acked-by: Michael S. Tsirkin Acked-by: Jason Wang Signed-off-by: David S. Miller drivers/net/virtio_net.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) commit 96395cbbc7e94cbbe4f76cf64cf122fabc19123d Author: Arnaldo Carvalho de Melo Date: Wed Apr 26 15:49:21 2017 -0300 tools lib string: Adopt prefixcmp() from perf and subcmd Both had copies originating from git.git, move those to tools/lib/string.c, getting both tools/lib/subcmd/ and tools/perf/ to use it. Cc: Adrian Hunter Cc: David Ahern Cc: Jiri Olsa Cc: Josh Poimboeuf Cc: Namhyung Kim Cc: Wang Nan Link: http://lkml.kernel.org/n/tip-uidwtticro1qhttzd2rkrkg1@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/include/linux/string.h | 2 ++ tools/lib/string.c | 9 +++++++++ tools/lib/subcmd/help.c | 1 + tools/lib/subcmd/parse-options.c | 1 + tools/lib/subcmd/subcmd-util.h | 9 --------- tools/perf/util/strbuf.c | 9 --------- tools/perf/util/util.h | 2 -- 7 files changed, 13 insertions(+), 20 deletions(-) commit 1f7fe5d492a4f3f7ed74b8e15548ced38f5a59be Merge: 4c5e7a2 1bb3c73 Author: David S. Miller Date: Wed Apr 26 14:49:16 2017 -0400 Merge branch 'ibmvnic-Move-sub-crq-init-out-of-interrupt-context' Nathan Fontenot says: ==================== ibmvnic: Move sub crq init out of interrupt context The sub crqs are currently intialized in interrupt context when handling a crq response fromn the vios server. There is no reason they must be initialized there. Moving the initialization of the sub crqs to the ibmvnic_init routine allows us to do the initialization outside of interrupt context and make all of the allocations with GFP_KERNEL instead of GFP_ATOMIC. ==================== Signed-off-by: David S. Miller commit 1bb3c739ad2c0030792cd527f30865accc50c460 Author: Nathan Fontenot Date: Tue Apr 25 15:01:10 2017 -0400 ibmvnic: Move initialization of sub crqs to ibmvnic_init The sub crq structures are initialized in interrupt context while handling the response to crqs when negotiating capabilities for the driver. The sub crqs do not need to be initialized at this point and can be moved to being done from ibmvnic_init. Moving the init of the sub crqs to ibmvnic_init also allows use to allocate the memory with GFP_KERNEL instead of GFP_ATOMIC. Signed-off-by: Nathan Fontenot Signed-off-by: David S. Miller drivers/net/ethernet/ibm/ibmvnic.c | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) commit d346b9bc4f652ddaf29b2d80ec7fc75d3b07124e Author: Nathan Fontenot Date: Tue Apr 25 15:01:04 2017 -0400 ibmvnic: Split initialization of scrqs to its own routine Split the sending of capability request crqs and the initialization of sub crqs into their own routines. This is a first step to moving the allocation of sub-crqs out of interrupt context. Signed-off-by: Nathan Fontenot Signed-off-by: David S. Miller drivers/net/ethernet/ibm/ibmvnic.c | 101 ++++++++++++++++++++----------------- 1 file changed, 54 insertions(+), 47 deletions(-) commit 4c5e7a2c0501bd531aad1d0378c589a92cb3cc31 Author: Florian Fainelli Date: Tue Apr 25 11:33:03 2017 -0700 dt-bindings: mdio: Clarify binding document The described GPIO reset property is applicable to *all* child PHYs. If we have one reset line per PHY present on the MDIO bus, these automatically become properties of the child PHY nodes. Finally, indicate how the RESET pulse width must be defined, which is the maximum value of all individual PHYs RESET pulse widths determined by reading their datasheets. Fixes: 69226896ad63 ("mdio_bus: Issue GPIO RESET to PHYs.") Signed-off-by: Florian Fainelli Reviewed-by: Roger Quadros Signed-off-by: David S. Miller Documentation/devicetree/bindings/net/mdio.txt | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) commit 4629498336e48516f5a03ee2788701f1d3f20168 Merge: 038a3e8 645f4c6 Author: David S. Miller Date: Wed Apr 26 14:44:39 2017 -0400 Merge branch 'tcp-do-not-use-tcp_time_stamp-for-rcv-autotuning' Eric Dumazet says: ==================== tcp: do not use tcp_time_stamp for rcv autotuning Some devices or linux distributions use HZ=100 or HZ=250 TCP receive buffer autotuning has poor behavior caused by this choice. Since autotuning happens after 4 ms or 10 ms, short distance flows get their receive buffer tuned to a very high value, but after an initial period where it was frozen to (too small) initial value. With BBR (or other CC allowing to increase BDP), we are willing to increase tcp_rmem[2], but this receive autotuning defect is a blocker for hosts dealing with gazillions of TCP flows in the data centers, since many of them have inflated RCVBUF. Risk of OOM is too high. Note that TSO autodefer, tcp cubic, and TCP TS options (RFC 7323) also suffer from our dependency to jiffies (via tcp_time_stamp). We have ongoing efforts to improve all that in the future. ==================== Signed-off-by: David S. Miller commit 645f4c6f2ebd040688cc2a5f626ffc909e66ccf2 Author: Eric Dumazet Date: Tue Apr 25 10:15:41 2017 -0700 tcp: switch rcv_rtt_est and rcvq_space to high resolution timestamps Some devices or distributions use HZ=100 or HZ=250 TCP receive buffer autotuning has poor behavior caused by this choice. Since autotuning happens after 4 ms or 10 ms, short distance flows get their receive buffer tuned to a very high value, but after an initial period where it was frozen to (too small) initial value. With tp->tcp_mstamp introduction, we can switch to high resolution timestamps almost for free (at the expense of 8 additional bytes per TCP structure) Note that some TCP stacks use usec TCP timestamps where this patch makes even more sense : Many TCP flows have < 500 usec RTT. Hopefully this finer TS option can be standardized soon. Tested: HZ=100 kernel ./netperf -H lpaa24 -t TCP_RR -l 1000 -- -r 10000,10000 & Peer without patch : lpaa24:~# ss -tmi dst lpaa23 ... skmem:(r0,rb8388608,...) rcv_rtt:10 rcv_space:3210000 minrtt:0.017 Peer with the patch : lpaa23:~# ss -tmi dst lpaa24 ... skmem:(r0,rb428800,...) rcv_rtt:0.069 rcv_space:30000 minrtt:0.017 We can see saner RCVBUF, and more precise rcv_rtt information. Signed-off-by: Eric Dumazet Acked-by: Soheil Hassas Yeganeh Acked-by: Neal Cardwell Signed-off-by: David S. Miller include/linux/tcp.h | 12 ++++++------ net/ipv4/tcp.c | 2 +- net/ipv4/tcp_input.c | 28 +++++++++++++++++----------- 3 files changed, 24 insertions(+), 18 deletions(-) commit a6db50b81e3f20b2b692bbddd35d9484057eae9d Author: Eric Dumazet Date: Tue Apr 25 10:15:40 2017 -0700 tcp: remove ack_time from struct tcp_sacktag_state It is no longer needed, everything uses tp->tcp_mstamp instead. Signed-off-by: Eric Dumazet Acked-by: Soheil Hassas Yeganeh Acked-by: Neal Cardwell Signed-off-by: David S. Miller net/ipv4/tcp_input.c | 4 ---- 1 file changed, 4 deletions(-) commit 7e0ca8a4c19c5fbaa802ffd609f5f9ab9249af5d Author: Eric Dumazet Date: Tue Apr 25 10:15:39 2017 -0700 tcp: use tp->tcp_mstamp in tcp_clean_rtx_queue() Following patch will remove ack_time from struct tcp_sacktag_state Same info is now found in tp->tcp_mstamp Signed-off-by: Eric Dumazet Acked-by: Soheil Hassas Yeganeh Acked-by: Neal Cardwell Signed-off-by: David S. Miller net/ipv4/tcp_input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d2329f102d846214e449941289c7009e16be01a0 Author: Eric Dumazet Date: Tue Apr 25 10:15:38 2017 -0700 tcp: do not pass timestamp to tcp_rack_advance() No longer needed, since tp->tcp_mstamp holds the information. This is needed to remove sack_state.ack_time in a following patch. Signed-off-by: Eric Dumazet Acked-by: Soheil Hassas Yeganeh Acked-by: Neal Cardwell Signed-off-by: David S. Miller include/net/tcp.h | 3 +-- net/ipv4/tcp_input.c | 6 ++---- net/ipv4/tcp_recovery.c | 5 ++--- 3 files changed, 5 insertions(+), 9 deletions(-) commit 88d5c65098e5d15f2cea81f90bb6ecc167e1aa3b Author: Eric Dumazet Date: Tue Apr 25 10:15:37 2017 -0700 tcp: do not pass timestamp to tcp_rate_gen() No longer needed, since tp->tcp_mstamp holds the information. This is needed to remove sack_state.ack_time in a following patch. Signed-off-by: Eric Dumazet Acked-by: Soheil Hassas Yeganeh Acked-by: Neal Cardwell Signed-off-by: David S. Miller include/net/tcp.h | 2 +- net/ipv4/tcp_input.c | 3 +-- net/ipv4/tcp_rate.c | 7 ++++--- 3 files changed, 6 insertions(+), 6 deletions(-) commit 1317a9d69f5fa0f5417237772f55a4aac49f7921 Author: Eric Dumazet Date: Tue Apr 25 10:15:36 2017 -0700 tcp: do not pass timestamp to tcp_fastretrans_alert() Not used anymore now tp->tcp_mstamp holds the information. This is needed to remove sack_state.ack_time in a following patch. Signed-off-by: Eric Dumazet Acked-by: Soheil Hassas Yeganeh Acked-by: Neal Cardwell Signed-off-by: David S. Miller net/ipv4/tcp_input.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) commit efab8f85826afbbfe4b0ca9208e006aabbd2df3a Author: Eric Dumazet Date: Tue Apr 25 10:15:35 2017 -0700 tcp: do not pass timestamp to tcp_rack_identify_loss() Not used anymore now tp->tcp_mstamp holds the information. Signed-off-by: Eric Dumazet Acked-by: Soheil Hassas Yeganeh Acked-by: Neal Cardwell Signed-off-by: David S. Miller net/ipv4/tcp_input.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) commit 128eda86bebeacefb0fcc64cab0155aa76857c92 Author: Eric Dumazet Date: Tue Apr 25 10:15:34 2017 -0700 tcp: do not pass timestamp to tcp_rack_mark_lost() This is no longer used, since tcp_rack_detect_loss() takes the timestamp from tp->tcp_mstamp Signed-off-by: Eric Dumazet Acked-by: Soheil Hassas Yeganeh Acked-by: Neal Cardwell Signed-off-by: David S. Miller include/net/tcp.h | 2 +- net/ipv4/tcp_input.c | 2 +- net/ipv4/tcp_recovery.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) commit 7c1c7308592f0f261836a96e37b7835ffd10d85b Author: Eric Dumazet Date: Tue Apr 25 10:15:33 2017 -0700 tcp: do not pass timestamp to tcp_rack_detect_loss() We can use tp->tcp_mstamp as it contains a recent timestamp. This removes a call to skb_mstamp_get() from tcp_rack_reo_timeout() Signed-off-by: Eric Dumazet Acked-by: Soheil Hassas Yeganeh Acked-by: Neal Cardwell Signed-off-by: David S. Miller net/ipv4/tcp_recovery.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) commit 69e996c58a35db9ca79b3f021a15bcd22202e1c0 Author: Eric Dumazet Date: Tue Apr 25 10:15:32 2017 -0700 tcp: add tp->tcp_mstamp field We want to use precise timestamps in TCP stack, but we do not want to call possibly expensive kernel time services too often. tp->tcp_mstamp is guaranteed to be updated once per incoming packet. We will use it in the following patches, removing specific skb_mstamp_get() calls, and removing ack_time from struct tcp_sacktag_state. Signed-off-by: Eric Dumazet Acked-by: Soheil Hassas Yeganeh Acked-by: Neal Cardwell Signed-off-by: David S. Miller include/linux/tcp.h | 1 + net/ipv4/tcp_input.c | 3 +++ 2 files changed, 4 insertions(+) commit 3caeafce5392a8eba7b36d0d097d403cacc66e2d Author: Arnaldo Carvalho de Melo Date: Wed Apr 26 15:40:31 2017 -0300 perf units: Move parse_tag_value() to units.[ch] Its basically to do units handling, so move to a more appropriately named object. Cc: Adrian Hunter Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: http://lkml.kernel.org/n/tip-90ob9vfepui24l8l2makhd9u@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/units.c | 29 +++++++++++++++++++++++++++++ tools/perf/util/units.h | 7 +++++++ tools/perf/util/util.c | 27 --------------------------- tools/perf/util/util.h | 7 ------- 4 files changed, 36 insertions(+), 34 deletions(-) commit 038a3e858de4e3ddf42c330a22b7efcddbc0a81a Author: Florian Westphal Date: Tue Apr 25 11:41:34 2017 +0200 rhashtable: remove insecure_max_entries param no users in the tree, insecure_max_entries is always set to ht->p.max_size * 2 in rhtashtable_init(). Replace only spot that uses it with a ht->p.max_size check. Signed-off-by: Florian Westphal Signed-off-by: David S. Miller include/linux/rhashtable.h | 6 ++---- lib/rhashtable.c | 6 ------ 2 files changed, 2 insertions(+), 10 deletions(-) commit 907bfcd8d8a616ca794ba187f6bf1b0e12b3a8dd Author: Dan Carpenter Date: Fri Apr 14 22:11:53 2017 +0300 orangefs: handle zero size write in debugfs If we write zero bytes to this debugfs file, then it will cause an underflow when we do copy_from_user(buf, ubuf, count - 1). Debugfs can normally only be written to by root so the impact of this is low. Signed-off-by: Dan Carpenter Signed-off-by: Mike Marshall fs/orangefs/orangefs-debugfs.c | 3 +++ 1 file changed, 3 insertions(+) commit b5a9d61eebdd0016ccb383b25a5c3d04977a6549 Author: Martin Brandenburg Date: Tue Apr 25 15:38:07 2017 -0400 orangefs: do not wait for timeout if umounting When the computer is turned off, all the processes are killed and then all the filesystems are umounted. OrangeFS should not wait for the userspace daemon to come back in that case. This only works for plain umount(2). To actually take advantage of this interactively, `umount -f' is needed; otherwise umount will issue a statfs first, which will wait for the userspace daemon to come back. Signed-off-by: Martin Brandenburg Signed-off-by: Mike Marshall fs/orangefs/waitqueue.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit b7a57ccab891584d00ae03dce1176b2d4cbe08e7 Author: Martin Brandenburg Date: Tue Apr 25 15:38:06 2017 -0400 orangefs: return from orangefs_devreq_read quickly if possible It is not necessary to take the lock and search through the request list if the list is empty. Signed-off-by: Martin Brandenburg Signed-off-by: Mike Marshall fs/orangefs/devorangefs-req.c | 4 ++++ 1 file changed, 4 insertions(+) commit 9d286b0d8207a70d7e0ffbd5be864ff7a62de05a Author: Martin Brandenburg Date: Tue Apr 25 15:38:05 2017 -0400 orangefs: ensure the userspace component is unmounted if mount fails If the mount is aborted after userspace has been asked to mount, userspace must be told to unmount. Ordinarily orangefs_kill_sb does the unmount. However it cannot be called if the superblock has not been set up. This is a very narrow window. The NULL fs_id is not unmounted. Signed-off-by: Martin Brandenburg Signed-off-by: Mike Marshall fs/orangefs/orangefs-utils.c | 35 ----------------------------------- fs/orangefs/super.c | 28 +++++++++++++++++++++++++++- 2 files changed, 27 insertions(+), 36 deletions(-) commit 53950ef541675df48c219a8d665111a0e68dfc2f Author: Martin Brandenburg Date: Tue Apr 25 15:38:04 2017 -0400 orangefs: do not check possibly stale size on truncate Let the server figure this out because our size might be out of date or not present. The bug was that xfs_io -f -t -c "pread -v 0 100" /mnt/foo echo "Test" > /mnt/foo xfs_io -f -t -c "pread -v 0 100" /mnt/foo fails because the second truncate did not happen if nothing had requested the size after the write in echo. Thus i_size was zero (not present) and the orangefs_setattr though i_size was zero and there was nothing to do. Signed-off-by: Martin Brandenburg Cc: stable@vger.kernel.org Signed-off-by: Mike Marshall fs/orangefs/inode.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 68a24a6cc4a6025e111c282186a2506281d79b4b Author: Martin Brandenburg Date: Tue Apr 25 15:38:03 2017 -0400 orangefs: implement statx Fortunately OrangeFS has had a getattr request mask for a long time. The server basically has two difficulty levels for attributes. Fetching any attribute except size requires communicating with the metadata server for that handle. Since all the attributes are right there, it makes sense to return them all. Fetching the size requires communicating with every I/O server (that the file is distributed across). Therefore if asked for anything except size, get everything except size, and if asked for size, get everything. Signed-off-by: Martin Brandenburg Signed-off-by: Mike Marshall fs/orangefs/file.c | 6 +++-- fs/orangefs/inode.c | 16 +++++++---- fs/orangefs/namei.c | 3 +++ fs/orangefs/orangefs-kernel.h | 4 ++- fs/orangefs/orangefs-utils.c | 63 +++++++++++++++++++++++++++++-------------- 5 files changed, 64 insertions(+), 28 deletions(-) commit 7b796ae37092ef520641b3a96c211c1cc67a0346 Author: Martin Brandenburg Date: Tue Apr 25 15:38:02 2017 -0400 orangefs: remove ORANGEFS_READDIR macros They are clones of the ORANGEFS_ITERATE macros in use elsewhere. Delete ORANGEFS_ITERATE_NEXT which is a hack previously used by readdir. Signed-off-by: Martin Brandenburg Signed-off-by: Mike Marshall fs/orangefs/dir.c | 8 ++++---- fs/orangefs/protocol.h | 9 ++------- 2 files changed, 6 insertions(+), 11 deletions(-) commit 480e3e532e31666a18520a7964bb4095d7a16b9a Author: Martin Brandenburg Date: Tue Apr 25 15:38:01 2017 -0400 orangefs: support very large directories This works by maintaining a linked list of pages which the directory has been read into rather than one giant fixed-size buffer. This replaces code which limits the total directory size to the total amount that could be returned in one server request. Since filenames are usually considerably shorter than the maximum, the old code could usually handle several server requests before running out of space. Signed-off-by: Martin Brandenburg Signed-off-by: Mike Marshall fs/orangefs/dir.c | 273 ++++++++++++++++++++++++++++++++++++------------------ 1 file changed, 185 insertions(+), 88 deletions(-) commit 72f66b8329310b810dc9b70b08af728812d2e6c1 Author: Martin Brandenburg Date: Tue Apr 25 15:38:00 2017 -0400 orangefs: support llseek on directories This and the previous commit fix xfstests generic/257. Signed-off-by: Martin Brandenburg Signed-off-by: Mike Marshall fs/orangefs/dir.c | 50 ++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 36 insertions(+), 14 deletions(-) commit 382f4581e67f57209c7aa67e39f26ba076306a2e Author: Martin Brandenburg Date: Tue Apr 25 15:37:59 2017 -0400 orangefs: rewrite readdir to fix several bugs In the past, readdir assumed that the user buffer will be large enough that all entries from the server will fit. If this was not true, entries would be skipped. Since it works now, request 512 entries rather than 96 per server operation. Signed-off-by: Martin Brandenburg Signed-off-by: Mike Marshall fs/orangefs/dir.c | 528 ++++++++++++++------------------------- fs/orangefs/downcall.h | 16 +- fs/orangefs/orangefs-dev-proto.h | 7 +- 3 files changed, 197 insertions(+), 354 deletions(-) commit 17930b252cd6f31163c259eaa99dd8aa630fb9ba Author: Martin Brandenburg Date: Tue Apr 25 15:37:58 2017 -0400 orangefs: do not set getattr_time on orangefs_lookup Since orangefs_lookup calls orangefs_iget which calls orangefs_inode_getattr, getattr_time will get set. Signed-off-by: Martin Brandenburg Cc: stable@vger.kernel.org Signed-off-by: Mike Marshall fs/orangefs/namei.c | 2 -- 1 file changed, 2 deletions(-) commit e675c5ec51fe2554719a7b6bcdbef0a770f2c19b Author: Martin Brandenburg Date: Tue Apr 25 15:37:57 2017 -0400 orangefs: clean up oversize xattr validation Also don't check flags as this has been validated by the VFS already. Fix an off-by-one error in the max size checking. Stop logging just because userspace wants to write attributes which do not fit. This and the previous commit fix xfstests generic/020. Signed-off-by: Martin Brandenburg Cc: stable@vger.kernel.org Signed-off-by: Mike Marshall fs/orangefs/xattr.c | 24 +++++++----------------- 1 file changed, 7 insertions(+), 17 deletions(-) commit a956af337b9ff25822d9ce1a59c6ed0c09fc14b9 Author: Martin Brandenburg Date: Tue Apr 25 15:37:56 2017 -0400 orangefs: fix bounds check for listxattr Signed-off-by: Martin Brandenburg Cc: stable@vger.kernel.org Signed-off-by: Mike Marshall fs/orangefs/xattr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 418ce3eb66885e409eb3fef5c19bd037435241c5 Author: Martin Brandenburg Date: Tue Apr 25 15:37:55 2017 -0400 orangefs: remove unused get_fsid_from_ino Signed-off-by: Martin Brandenburg Signed-off-by: Mike Marshall fs/orangefs/orangefs-kernel.h | 5 ----- 1 file changed, 5 deletions(-) commit 5068b52f732157385d9dccd205bc4043da3a3cce Author: Arnaldo Carvalho de Melo Date: Wed Apr 26 15:31:57 2017 -0300 perf ui gtk: Move gtk .so name to the only place where it is used No need to pollute util.h with this. Cc: Jiri Olsa Cc: Namhyung Kim Link: http://lkml.kernel.org/n/tip-kec0chbdtgrd71o3oi2kz2zt@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/ui/setup.c | 3 +++ tools/perf/util/util.h | 2 -- 2 files changed, 3 insertions(+), 2 deletions(-) commit 7de96c3e759e49b1d176722ed26c14c057bac34f Author: Arnaldo Carvalho de Melo Date: Wed Apr 26 15:27:52 2017 -0300 perf tools: Move HAS_BOOL define to where perl headers are used This is a perl specific hack, so move it from util.h to where perl headers are used. Cc: Adrian Hunter Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: http://lkml.kernel.org/n/tip-4igctbinuom2sr6g4b03jqht@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/scripting-engines/trace-event-perl.c | 4 +++- tools/perf/util/util.h | 1 - 2 files changed, 3 insertions(+), 2 deletions(-) commit 7f6733c3c648ddd6cf459c1b80ad388a95452955 Author: Paul E. McKenney Date: Tue Apr 18 17:17:35 2017 -0700 srcu: Make rcutorture writer stalls print SRCU GP state In the past, SRCU was simple enough that there was little point in making the rcutorture writer stall messages print the SRCU grace-period number state. With the advent of Tree SRCU, this has changed. This commit therefore makes Classic, Tiny, and Tree SRCU report this state to rcutorture as needed. Signed-off-by: Paul E. McKenney Tested-by: Mike Galbraith include/linux/srcuclassic.h | 14 ++++++++++++++ include/linux/srcutiny.h | 12 ++++++++++++ include/linux/srcutree.h | 4 ++++ kernel/rcu/rcutorture.c | 8 +++++--- kernel/rcu/srcutree.c | 13 +++++++++++++ kernel/rcu/tree.c | 12 ++++-------- 6 files changed, 52 insertions(+), 11 deletions(-) commit c7e88067c1ae89e7bcbed070fb2c4e30bc39b51f Author: Paul E. McKenney Date: Tue Apr 18 16:01:46 2017 -0700 srcu: Exact tracking of srcu_data structures containing callbacks The current Tree SRCU implementation schedules a workqueue for every srcu_data covered by a given leaf srcu_node structure having callbacks, even if only one of those srcu_data structures actually contains callbacks. This is clearly inefficient for workloads that don't feature callbacks everywhere all the time. This commit therefore adds an array of masks that are used by the leaf srcu_node structures to track exactly which srcu_data structures contain callbacks. Signed-off-by: Paul E. McKenney Tested-by: Mike Galbraith include/linux/srcutree.h | 4 ++++ kernel/rcu/srcutree.c | 29 +++++++++++++++++++++++------ 2 files changed, 27 insertions(+), 6 deletions(-) commit c373fff7bd252ec36e8a895c58a584088f1d38bc Author: Trond Myklebust Date: Wed Apr 26 12:26:22 2017 -0400 NFSv4: Don't special case "launder" If the client receives a fatal server error from nfs_pageio_add_request(), then we should always truncate the page on which the error occurred. Signed-off-by: Trond Myklebust fs/nfs/file.c | 2 +- fs/nfs/write.c | 27 +++++++++++---------------- include/linux/nfs_fs.h | 14 +------------- 3 files changed, 13 insertions(+), 30 deletions(-) commit 54551d85ad48b5b5f5735b9b76c147096828b626 Author: Trond Myklebust Date: Wed Apr 26 12:21:49 2017 -0400 NFS: Add a few more fatal I/O errors to nfs_error_is_fatal() EACCES, EDQUOT, EFBIG and ESTALE are all fatal errors as far as NFS I/O is concerned. They need to be reported back to the application. Signed-off-by: Trond Myklebust fs/nfs/internal.h | 4 ++++ 1 file changed, 4 insertions(+) commit 763656d30b3d220a52e4b2bd1fc174a4cd6c0f43 Author: Arnd Bergmann Date: Tue Apr 25 21:56:53 2017 +0200 drm: mali-dp: use div_u64 for expensive 64-bit divisions On 32-bit machines, we can't divide 64-bit integers: drivers/gpu/drm/arm/malidp_crtc.o: In function `malidp_crtc_atomic_check': malidp_crtc.c:(.text.malidp_crtc_atomic_check+0x3c0): undefined reference to `__aeabi_uldivmod' malidp_crtc.c:(.text.malidp_crtc_atomic_check+0x3dc): undefined reference to `__aeabi_uldivmod' This calls the div_u64 function explicitly instead. Fixes: 4cea4e9f6690 ("drm: mali-dp: Add plane upscaling support") Signed-off-by: Arnd Bergmann drivers/gpu/drm/arm/malidp_crtc.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) commit 2fefc97b2180518bac923fba3f79fdca1f41dc15 Author: Al Viro Date: Wed Apr 5 19:17:18 2017 -0400 HAVE_ARCH_HARDENED_USERCOPY is unconditional now Signed-off-by: Al Viro arch/arm/Kconfig | 1 - arch/arm64/Kconfig | 1 - arch/ia64/Kconfig | 1 - arch/mips/Kconfig | 1 - arch/parisc/Kconfig | 1 - arch/powerpc/Kconfig | 1 - arch/s390/Kconfig | 1 - arch/sparc/Kconfig | 1 - arch/x86/Kconfig | 1 - security/Kconfig | 9 --------- 10 files changed, 18 deletions(-) commit 701cac61d0250912b89cbc28589969530179099a Author: Al Viro Date: Wed Apr 5 19:15:53 2017 -0400 CONFIG_ARCH_HAS_RAW_COPY_USER is unconditional now all architectures converted Signed-off-by: Al Viro arch/Kconfig | 3 --- arch/alpha/Kconfig | 1 - arch/arc/Kconfig | 1 - arch/arm/Kconfig | 1 - arch/arm64/Kconfig | 1 - arch/avr32/Kconfig | 1 - arch/blackfin/Kconfig | 1 - arch/c6x/Kconfig | 1 - arch/cris/Kconfig | 1 - arch/frv/Kconfig | 1 - arch/h8300/Kconfig | 1 - arch/hexagon/Kconfig | 1 - arch/ia64/Kconfig | 1 - arch/m32r/Kconfig | 1 - arch/m68k/Kconfig | 1 - arch/metag/Kconfig | 1 - arch/microblaze/Kconfig | 1 - arch/mips/Kconfig | 1 - arch/mn10300/Kconfig | 1 - arch/nios2/Kconfig | 1 - arch/openrisc/Kconfig | 1 - arch/parisc/Kconfig | 1 - arch/powerpc/Kconfig | 1 - arch/s390/Kconfig | 1 - arch/score/Kconfig | 1 - arch/sh/Kconfig | 1 - arch/sparc/Kconfig | 1 - arch/tile/Kconfig | 1 - arch/um/Kconfig.common | 1 - arch/unicore32/Kconfig | 1 - arch/x86/Kconfig | 1 - arch/xtensa/Kconfig | 1 - include/asm-generic/uaccess.h | 41 ----------------------------------------- include/linux/uaccess.h | 7 ++----- lib/Makefile | 4 +--- 35 files changed, 3 insertions(+), 83 deletions(-) commit eea86b637a15bc4d4bd518b11330ac96baa6b73d Merge: bf7af0c ec022681 e13909a 4de5b63 92430da e5c1540 50e9ab9 86944ee 0c7e9a8 48f666c 33ab2da ac4691f b3622d3 9a67734 29be02e 840db3f d491afb 2260ea8 19dbf70 de51d6c ab89866 f64fd18 3448890 3709600 dc14253 f98f48e 31af2f3 23504ba a668ce3 2ef59f2 beba3a2 7d4914d Author: Al Viro Date: Wed Apr 26 12:06:59 2017 -0400 Merge branches 'uaccess.alpha', 'uaccess.arc', 'uaccess.arm', 'uaccess.arm64', 'uaccess.avr32', 'uaccess.bfin', 'uaccess.c6x', 'uaccess.cris', 'uaccess.frv', 'uaccess.h8300', 'uaccess.hexagon', 'uaccess.ia64', 'uaccess.m32r', 'uaccess.m68k', 'uaccess.metag', 'uaccess.microblaze', 'uaccess.mips', 'uaccess.mn10300', 'uaccess.nios2', 'uaccess.openrisc', 'uaccess.parisc', 'uaccess.powerpc', 'uaccess.s390', 'uaccess.score', 'uaccess.sh', 'uaccess.sparc', 'uaccess.tile', 'uaccess.um', 'uaccess.unicore32', 'uaccess.x86' and 'uaccess.xtensa' into work.uaccess commit 9a677341cd8de01a9eaf2c24a4b735939e507943 Author: Al Viro Date: Tue Mar 21 12:02:25 2017 -0400 m32r: switch to RAW_COPY_USER Signed-off-by: Al Viro arch/m32r/Kconfig | 1 + arch/m32r/include/asm/uaccess.h | 98 +++-------------------------------------- arch/m32r/kernel/m32r_ksyms.c | 2 - arch/m32r/lib/usercopy.c | 22 --------- 4 files changed, 8 insertions(+), 115 deletions(-) commit 3e086edfe0c73daaabd929b926bbe26536272d9a Author: olivier moysan Date: Mon Apr 10 17:19:56 2017 +0200 ASoC: stm32: add SAI driver This patch implements SAI ASoC driver for STM32. Signed-off-by: olivier moysan Signed-off-by: Mark Brown sound/soc/Kconfig | 1 + sound/soc/Makefile | 1 + sound/soc/stm/Kconfig | 8 + sound/soc/stm/Makefile | 6 + sound/soc/stm/stm32_sai.c | 115 ++++++ sound/soc/stm/stm32_sai.h | 200 ++++++++++ sound/soc/stm/stm32_sai_sub.c | 884 ++++++++++++++++++++++++++++++++++++++++++ 7 files changed, 1215 insertions(+) commit b45c4f117b002a902e8b9f52eaf542e3e82c36a8 Author: olivier moysan Date: Mon Apr 10 17:19:55 2017 +0200 ASoC: stm32: add bindings for SAI This patch adds documentation of device tree bindings for the STM32 SAI ASoC driver. Signed-off-by: olivier moysan Signed-off-by: Mark Brown .../devicetree/bindings/sound/st,stm32-sai.txt | 89 ++++++++++++++++++++++ 1 file changed, 89 insertions(+) commit a7e3b975a0f9296162b72ac6ab7fad9631a07630 Author: Filipe Manana Date: Mon Apr 3 10:45:46 2017 +0100 Btrfs: fix reported number of inode blocks Currently when there are buffered writes that were not yet flushed and they fall within allocated ranges of the file (that is, not in holes or beyond eof assuming there are no prealloc extents beyond eof), btrfs simply reports an incorrect number of used blocks through the stat(2) system call (or any of its variants), regardless of mount options or inode flags (compress, compress-force, nodatacow). This is because the number of blocks used that is reported is based on the current number of bytes in the vfs inode plus the number of dealloc bytes in the btrfs inode. The later covers bytes that both fall within allocated regions of the file and holes. Example scenarios where the number of reported blocks is wrong while the buffered writes are not flushed: $ mkfs.btrfs -f /dev/sdc $ mount /dev/sdc /mnt/sdc $ xfs_io -f -c "pwrite -S 0xaa 0 64K" /mnt/sdc/foo1 wrote 65536/65536 bytes at offset 0 64 KiB, 16 ops; 0.0000 sec (259.336 MiB/sec and 66390.0415 ops/sec) $ sync $ xfs_io -c "pwrite -S 0xbb 0 64K" /mnt/sdc/foo1 wrote 65536/65536 bytes at offset 0 64 KiB, 16 ops; 0.0000 sec (192.308 MiB/sec and 49230.7692 ops/sec) # The following should have reported 64K... $ du -h /mnt/sdc/foo1 128K /mnt/sdc/foo1 $ sync # After flushing the buffered write, it now reports the correct value. $ du -h /mnt/sdc/foo1 64K /mnt/sdc/foo1 $ xfs_io -f -c "falloc -k 0 128K" -c "pwrite -S 0xaa 0 64K" /mnt/sdc/foo2 wrote 65536/65536 bytes at offset 0 64 KiB, 16 ops; 0.0000 sec (520.833 MiB/sec and 133333.3333 ops/sec) $ sync $ xfs_io -c "pwrite -S 0xbb 64K 64K" /mnt/sdc/foo2 wrote 65536/65536 bytes at offset 65536 64 KiB, 16 ops; 0.0000 sec (260.417 MiB/sec and 66666.6667 ops/sec) # The following should have reported 128K... $ du -h /mnt/sdc/foo2 192K /mnt/sdc/foo2 $ sync # After flushing the buffered write, it now reports the correct value. $ du -h /mnt/sdc/foo2 128K /mnt/sdc/foo2 So the number of used file blocks is simply incorrect, unlike in other filesystems such as ext4 and xfs for example, but only while the buffered writes are not flushed. Fix this by tracking the number of delalloc bytes that fall within holes and beyond eof of a file, and use instead this new counter when reporting the number of used blocks for an inode. Another different problem that exists is that the delalloc bytes counter is reset when writeback starts (by clearing the EXTENT_DEALLOC flag from the respective range in the inode's iotree) and the vfs inode's bytes counter is only incremented when writeback finishes (through insert_reserved_file_extent()). Therefore while writeback is ongoing we simply report a wrong number of blocks used by an inode if the write operation covers a range previously unallocated. While this change does not fix this problem, it does minimizes it a lot by shortening that time window, as the new dealloc bytes counter (new_delalloc_bytes) is only decremented when writeback finishes right before updating the vfs inode's bytes counter. Fully fixing this second problem is not trivial and will be addressed later by a different patch. Signed-off-by: Filipe Manana fs/btrfs/btrfs_inode.h | 7 ++++++ fs/btrfs/extent_io.h | 1 + fs/btrfs/file.c | 62 ++++++++++++++++++++++++++++++++++++++++++---- fs/btrfs/inode.c | 67 ++++++++++++++++++++++++++++++++++++++++---------- 4 files changed, 119 insertions(+), 18 deletions(-) commit e1cbfd7bf6dabdac561c75d08357571f44040a45 Author: Filipe Manana Date: Tue Apr 4 20:31:00 2017 +0100 Btrfs: send, fix file hole not being preserved due to inline extent Normally we don't have inline extents followed by regular extents, but there's currently at least one harmless case where this happens. For example, when the page size is 4Kb and compression is enabled: $ mkfs.btrfs -f /dev/sdb $ mount -o compress /dev/sdb /mnt $ xfs_io -f -c "pwrite -S 0xaa 0 4K" -c "fsync" /mnt/foobar $ xfs_io -c "pwrite -S 0xbb 8K 4K" -c "fsync" /mnt/foobar In this case we get a compressed inline extent, representing 4Kb of data, followed by a hole extent and then a regular data extent. The inline extent was not expanded/converted to a regular extent exactly because it represents 4Kb of data. This does not cause any apparent problem (such as the issue solved by commit e1699d2d7bf6 ("btrfs: add missing memset while reading compressed inline extents")) except trigger an unexpected case in the incremental send code path that makes us issue an operation to write a hole when it's not needed, resulting in more writes at the receiver and wasting space at the receiver. So teach the incremental send code to deal with this particular case. The issue can be currently triggered by running fstests btrfs/137 with compression enabled (MOUNT_OPTIONS="-o compress" ./check btrfs/137). Signed-off-by: Filipe Manana Reviewed-by: Liu Bo fs/btrfs/send.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) commit be2d253cc98244765323a7c94cc1ac5cd5a17072 Author: Filipe Manana Date: Mon Apr 3 15:57:17 2017 +0100 Btrfs: fix extent map leak during fallocate error path If the call to btrfs_qgroup_reserve_data() failed, we were leaking an extent map structure. The failure can happen either due to an -ENOMEM condition or, when quotas are enabled, due to -EDQUOT for example. Signed-off-by: Filipe Manana Reviewed-by: David Sterba fs/btrfs/file.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 1c81ba237bcecad9bc885a1ddcf02d725ea38482 Author: Filipe Manana Date: Wed Mar 8 16:43:49 2017 +0000 Btrfs: fix incorrect space accounting after failure to insert inline extent When using compression, if we fail to insert an inline extent we incorrectly end up attempting to free the reserved data space twice, once through extent_clear_unlock_delalloc(), because we pass it the flag EXTENT_DO_ACCOUNTING, and once through a direct call to btrfs_free_reserved_data_space_noquota(). This results in a trace like the following: [ 834.576240] ------------[ cut here ]------------ [ 834.576825] WARNING: CPU: 2 PID: 486 at fs/btrfs/extent-tree.c:4316 btrfs_free_reserved_data_space_noquota+0x60/0x9f [btrfs] [ 834.579501] Modules linked in: btrfs crc32c_generic xor raid6_pq ppdev i2c_piix4 acpi_cpufreq psmouse tpm_tis parport_pc pcspkr serio_raw tpm_tis_core sg parport evdev i2c_core tpm button loop autofs4 ext4 crc16 jbd2 mbcache sr_mod cdrom sd_mod ata_generic virtio_scsi ata_piix virtio_pci libata virtio_ring virtio scsi_mod e1000 floppy [last unloaded: btrfs] [ 834.592116] CPU: 2 PID: 486 Comm: kworker/u32:4 Not tainted 4.10.0-rc8-btrfs-next-37+ #2 [ 834.593316] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.1-0-gb3ef39f-prebuilt.qemu-project.org 04/01/2014 [ 834.595273] Workqueue: btrfs-delalloc btrfs_delalloc_helper [btrfs] [ 834.596103] Call Trace: [ 834.596103] dump_stack+0x67/0x90 [ 834.596103] __warn+0xc2/0xdd [ 834.596103] warn_slowpath_null+0x1d/0x1f [ 834.596103] btrfs_free_reserved_data_space_noquota+0x60/0x9f [btrfs] [ 834.596103] compress_file_range.constprop.42+0x2fa/0x3fc [btrfs] [ 834.596103] ? submit_compressed_extents+0x3a7/0x3a7 [btrfs] [ 834.596103] async_cow_start+0x32/0x4d [btrfs] [ 834.596103] btrfs_scrubparity_helper+0x187/0x3e7 [btrfs] [ 834.596103] btrfs_delalloc_helper+0xe/0x10 [btrfs] [ 834.596103] process_one_work+0x273/0x4e4 [ 834.596103] worker_thread+0x1eb/0x2ca [ 834.596103] ? rescuer_thread+0x2b6/0x2b6 [ 834.596103] kthread+0x100/0x108 [ 834.596103] ? __list_del_entry+0x22/0x22 [ 834.596103] ret_from_fork+0x2e/0x40 [ 834.611656] ---[ end trace 719902fe6bdef08f ]--- So fix this by not calling directly btrfs_free_reserved_data_space_noquota() if an error happened. Signed-off-by: Filipe Manana fs/btrfs/inode.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit a315e68f6e8b3006c29482dbfc4d928f098c449c Author: Filipe Manana Date: Mon Mar 6 23:04:20 2017 +0000 Btrfs: fix invalid attempt to free reserved space on failure to cow range When attempting to COW a file range (we are starting writeback and doing COW), if we manage to reserve an extent for the range we will write into but fail after reserving it and before creating the respective ordered extent, we end up in an error path where we attempt to decrement the data space's bytes_may_use counter after we already did it while reserving the extent, leading to a warning/trace like the following: [ 847.621524] ------------[ cut here ]------------ [ 847.625441] WARNING: CPU: 5 PID: 4905 at fs/btrfs/extent-tree.c:4316 btrfs_free_reserved_data_space_noquota+0x60/0x9f [btrfs] [ 847.633704] Modules linked in: btrfs crc32c_generic xor raid6_pq acpi_cpufreq i2c_piix4 ppdev psmouse tpm_tis serio_raw pcspkr parport_pc tpm_tis_core i2c_core sg [ 847.644616] CPU: 5 PID: 4905 Comm: xfs_io Not tainted 4.10.0-rc8-btrfs-next-37+ #2 [ 847.648601] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.1-0-gb3ef39f-prebuilt.qemu-project.org 04/01/2014 [ 847.648601] Call Trace: [ 847.648601] dump_stack+0x67/0x90 [ 847.648601] __warn+0xc2/0xdd [ 847.648601] warn_slowpath_null+0x1d/0x1f [ 847.648601] btrfs_free_reserved_data_space_noquota+0x60/0x9f [btrfs] [ 847.648601] btrfs_clear_bit_hook+0x140/0x258 [btrfs] [ 847.648601] clear_state_bit+0x87/0x128 [btrfs] [ 847.648601] __clear_extent_bit+0x222/0x2b7 [btrfs] [ 847.648601] clear_extent_bit+0x17/0x19 [btrfs] [ 847.648601] extent_clear_unlock_delalloc+0x3b/0x6b [btrfs] [ 847.648601] cow_file_range.isra.39+0x387/0x39a [btrfs] [ 847.648601] run_delalloc_nocow+0x4d7/0x70e [btrfs] [ 847.648601] ? arch_local_irq_save+0x9/0xc [ 847.648601] run_delalloc_range+0xa7/0x2b5 [btrfs] [ 847.648601] writepage_delalloc.isra.31+0xb9/0x15c [btrfs] [ 847.648601] __extent_writepage+0x249/0x2e8 [btrfs] [ 847.648601] extent_write_cache_pages.constprop.33+0x28b/0x36c [btrfs] [ 847.648601] ? arch_local_irq_save+0x9/0xc [ 847.648601] ? mark_lock+0x24/0x201 [ 847.648601] extent_writepages+0x4b/0x5c [btrfs] [ 847.648601] ? btrfs_writepage_start_hook+0xed/0xed [btrfs] [ 847.648601] btrfs_writepages+0x28/0x2a [btrfs] [ 847.648601] do_writepages+0x23/0x2c [ 847.648601] __filemap_fdatawrite_range+0x5a/0x61 [ 847.648601] filemap_fdatawrite_range+0x13/0x15 [ 847.648601] btrfs_fdatawrite_range+0x20/0x46 [btrfs] [ 847.648601] start_ordered_ops+0x19/0x23 [btrfs] [ 847.648601] btrfs_sync_file+0x136/0x42c [btrfs] [ 847.648601] vfs_fsync_range+0x8c/0x9e [ 847.648601] vfs_fsync+0x1c/0x1e [ 847.648601] do_fsync+0x31/0x4a [ 847.648601] SyS_fsync+0x10/0x14 [ 847.648601] entry_SYSCALL_64_fastpath+0x18/0xad [ 847.648601] RIP: 0033:0x7f5b05200800 [ 847.648601] RSP: 002b:00007ffe204f71c8 EFLAGS: 00000246 ORIG_RAX: 000000000000004a [ 847.648601] RAX: ffffffffffffffda RBX: ffffffff8109637b RCX: 00007f5b05200800 [ 847.648601] RDX: 00000000008bd0a0 RSI: 00000000008bd2e0 RDI: 0000000000000003 [ 847.648601] RBP: ffffc90001d67f98 R08: 000000000000ffff R09: 000000000000001f [ 847.648601] R10: 00000000000001f6 R11: 0000000000000246 R12: 0000000000000046 [ 847.648601] R13: ffffc90001d67f78 R14: 00007f5b054be740 R15: 00007f5b054be740 [ 847.648601] ? trace_hardirqs_off_caller+0x3f/0xaa [ 847.685787] ---[ end trace 2a4a3e15382508e8 ]--- So fix this by not attempting to decrement the data space info's bytes_may_use counter if we already reserved the extent and an error happened before creating the ordered extent. We are already correctly freeing the reserved extent if an error happens, so there's no additional measure needed. Signed-off-by: Filipe Manana Reviewed-by: Liu Bo fs/btrfs/extent_io.h | 4 +++- fs/btrfs/inode.c | 59 +++++++++++++++++++++++++++++++++++++--------------- 2 files changed, 45 insertions(+), 18 deletions(-) commit 524272607e882d04e6d1a70d41fcbed819445ab9 Author: Qu Wenruo Date: Wed Mar 8 10:25:52 2017 +0800 btrfs: Handle delalloc error correctly to avoid ordered extent hang [BUG] If run_delalloc_range() returns error and there is already some ordered extents created, btrfs will be hanged with the following backtrace: Call Trace: __schedule+0x2d4/0xae0 schedule+0x3d/0x90 btrfs_start_ordered_extent+0x160/0x200 [btrfs] ? wake_atomic_t_function+0x60/0x60 btrfs_run_ordered_extent_work+0x25/0x40 [btrfs] btrfs_scrubparity_helper+0x1c1/0x620 [btrfs] btrfs_flush_delalloc_helper+0xe/0x10 [btrfs] process_one_work+0x2af/0x720 ? process_one_work+0x22b/0x720 worker_thread+0x4b/0x4f0 kthread+0x10f/0x150 ? process_one_work+0x720/0x720 ? kthread_create_on_node+0x40/0x40 ret_from_fork+0x2e/0x40 [CAUSE] |<------------------ delalloc range --------------------------->| | OE 1 | OE 2 | ... | OE n | |<>| |<---------- cleanup range --------->| || \_=> First page handled by end_extent_writepage() in __extent_writepage() The problem is caused by error handler of run_delalloc_range(), which doesn't handle any created ordered extents, leaving them waiting on btrfs_finish_ordered_io() to finish. However after run_delalloc_range() returns error, __extent_writepage() won't submit bio, so btrfs_writepage_end_io_hook() won't be triggered except the first page, and btrfs_finish_ordered_io() won't be triggered for created ordered extents either. So OE 2~n will hang forever, and if OE 1 is larger than one page, it will also hang. [FIX] Introduce btrfs_cleanup_ordered_extents() function to cleanup created ordered extents and finish them manually. The function is based on existing btrfs_endio_direct_write_update_ordered() function, and modify it to act just like btrfs_writepage_endio_hook() but handles specified range other than one page. After fix, delalloc error will be handled like: |<------------------ delalloc range --------------------------->| | OE 1 | OE 2 | ... | OE n | |<>|<-------- ----------->|<------ old error handler --------->| || || || \_=> Cleaned up by cleanup_ordered_extents() \_=> First page handled by end_extent_writepage() in __extent_writepage() Signed-off-by: Qu Wenruo Reviewed-by: Filipe Manana Reviewed-by: Liu Bo Signed-off-by: Filipe Manana fs/btrfs/inode.c | 63 ++++++++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 48 insertions(+), 15 deletions(-) commit 4dbd80fb9176f23c78cecd0a8285001cd2066425 Author: Qu Wenruo Date: Wed Mar 8 10:25:51 2017 +0800 btrfs: Fix metadata underflow caused by btrfs_reloc_clone_csum error [BUG] When btrfs_reloc_clone_csum() reports error, it can underflow metadata and leads to kernel assertion on outstanding extents in run_delalloc_nocow() and cow_file_range(). BTRFS info (device vdb5): relocating block group 12582912 flags data BTRFS info (device vdb5): found 1 extents assertion failed: inode->outstanding_extents >= num_extents, file: fs/btrfs//extent-tree.c, line: 5858 Currently, due to another bug blocking ordered extents, the bug is only reproducible under certain block group layout and using error injection. a) Create one data block group with one 4K extent in it. To avoid the bug that hangs btrfs due to ordered extent which never finishes b) Make btrfs_reloc_clone_csum() always fail c) Relocate that block group [CAUSE] run_delalloc_nocow() and cow_file_range() handles error from btrfs_reloc_clone_csum() wrongly: (The ascii chart shows a more generic case of this bug other than the bug mentioned above) |<------------------ delalloc range --------------------------->| | OE 1 | OE 2 | ... | OE n | |<----------- cleanup range --------------->| |<----------- ----------->| \/ btrfs_finish_ordered_io() range So error handler, which calls extent_clear_unlock_delalloc() with EXTENT_DELALLOC and EXTENT_DO_ACCOUNT bits, and btrfs_finish_ordered_io() will both cover OE n, and free its metadata, causing metadata under flow. [Fix] The fix is to ensure after calling btrfs_add_ordered_extent(), we only call error handler after increasing the iteration offset, so that cleanup range won't cover any created ordered extent. |<------------------ delalloc range --------------------------->| | OE 1 | OE 2 | ... | OE n | |<----------- ----------->|<---------- cleanup range --------->| \/ btrfs_finish_ordered_io() range Signed-off-by: Qu Wenruo Reviewed-by: Filipe Manana Reviewed-by: Liu Bo fs/btrfs/inode.c | 51 +++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 39 insertions(+), 12 deletions(-) commit 282ec0ea65dab88fda51b5b9b649958ae42f4ac0 Merge: d8f5207 c687c46 251831b Author: Mark Brown Date: Wed Apr 26 15:58:22 2017 +0100 Merge remote-tracking branches 'spi/topic/ti-qspi' and 'spi/topic/xlp' into spi-next commit d8f520727f769164fa6ff0ad4a4d965336966999 Merge: fbdd1b2 91b46346 9006a7b 3288d5c bfca761 905e0b5 Author: Mark Brown Date: Wed Apr 26 15:58:16 2017 +0100 Merge remote-tracking branches 'spi/topic/spidev', 'spi/topic/spidev-test', 'spi/topic/sunxi', 'spi/topic/tegra' and 'spi/topic/test' into spi-next commit fbdd1b2affbd56f51aaa2a32073410133ca247f2 Merge: a2d5eda e542f7e 8126135 1017f42 3c85871 68c97b9 Author: Mark Brown Date: Wed Apr 26 15:58:10 2017 +0100 Merge remote-tracking branches 'spi/topic/loopback', 'spi/topic/omap2-mcspi', 'spi/topic/orion', 'spi/topic/pl022' and 'spi/topic/sc18is602' into spi-next commit a2d5eda07224680cb711677eff014ea15d809aae Merge: 2536374 f974cf5 500a32a fbad6c2 f72efa7 a5b0443 Author: Mark Brown Date: Wed Apr 26 15:58:04 2017 +0100 Merge remote-tracking branches 'spi/topic/devprop', 'spi/topic/fsl', 'spi/topic/fsl-dspi', 'spi/topic/imx' and 'spi/topic/lantiq' into spi-next commit 2536374352ab112e5ea2ef8ce0cfa0e9cfa63112 Merge: 42b1ead e538007 7ab2463 b42a33b 1234e83 Author: Mark Brown Date: Wed Apr 26 15:57:59 2017 +0100 Merge remote-tracking branches 'spi/topic/atmel', 'spi/topic/bcm63xx', 'spi/topic/cadence' and 'spi/topic/davinci' into spi-next commit 42b1eadf4ead6e7d68f47cd985daa244823c96d3 Merge: fbf3d36 833bfad Author: Mark Brown Date: Wed Apr 26 15:57:58 2017 +0100 Merge remote-tracking branch 'spi/topic/core' into spi-next commit fbf3d36cb4c960b27b9c2e391d24127c5ec17a3a Merge: 5a7ad11 400c18e ad2fca0 849794c Author: Mark Brown Date: Wed Apr 26 15:57:52 2017 +0100 Merge remote-tracking branches 'spi/fix/dw', 'spi/fix/lantiq' and 'spi/fix/pl022' into spi-linus commit 284c43e6af415515865d2900d18d1382979c777c Author: Harald Freudenberger Date: Wed Apr 26 13:56:41 2017 +0200 s390/crypt: use the correct module alias for paes_s390. For automatic module loading (e.g. as it is used with cryptsetup) an alias "paes" for the paes_s390 kernel module is needed. Correct the paes_s390 module alias from "aes-all" to "paes". Signed-off-by: Harald Freudenberger Signed-off-by: Martin Schwidefsky arch/s390/crypto/paes_s390.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b6726009af555129c57dfbbf80a1fcf4d5a36ba0 Author: Sodhi, VunnyX Date: Tue Apr 25 12:18:24 2017 +0530 ASoC: Intel: Skylake: Add loadable module support on KBL platform Kabylake platform expects modules in a library manifest. After loading base firmware library manifest is loaded using load library IPC. This is followed by module load using load multiple modules IPC. Signed-off-by: Sodhi, VunnyX Signed-off-by: G Kranthi Signed-off-by: Subhransu S. Prusty Acked-by: Vinod Koul Signed-off-by: Mark Brown sound/soc/intel/skylake/skl-sst-ipc.c | 2 ++ sound/soc/intel/skylake/skl-sst.c | 64 +++++++++++++++++++++++++++++++---- 2 files changed, 60 insertions(+), 6 deletions(-) commit 100e7f396ddf9abd76d5ec93f689be00187512f9 Author: Subhransu S. Prusty Date: Tue Apr 25 12:18:23 2017 +0530 ASoC: Intel: Skylake: Modify load_lib_ipc arguments for a nowait version Kabylake uses code loader dma and wait on notification instead of ipc reply for load library ipc status. So modify the argument of skl_sst_ipc_load_library to check on flag to wait for ipc reply. Signed-off-by: Subhransu S. Prusty Acked-by: Vinod Koul Signed-off-by: Mark Brown sound/soc/intel/skylake/bxt-sst.c | 2 +- sound/soc/intel/skylake/skl-sst-ipc.c | 8 ++++++-- sound/soc/intel/skylake/skl-sst-ipc.h | 2 +- 3 files changed, 8 insertions(+), 4 deletions(-) commit 89b0d8a5bae91cb8ef23b1834c97d1db367f2db6 Author: Subhransu S. Prusty Date: Tue Apr 25 12:18:22 2017 +0530 ASoC: Intel: Skylake: Register dsp_fw_ops for kabylake For audio kabylake is same as skylake except the module load approach. This patch registers different dsp_fw_ops for kabylake and next patch adds the module load support for kabylake. Signed-off-by: Subhransu S. Prusty Acked-by: Vinod Koul Signed-off-by: Mark Brown sound/soc/intel/skylake/skl-messages.c | 2 +- sound/soc/intel/skylake/skl-sst-dsp.h | 3 +++ sound/soc/intel/skylake/skl-sst.c | 30 ++++++++++++++++++++++++++++++ 3 files changed, 34 insertions(+), 1 deletion(-) commit 4e0277d226b578be99cf8899fd1442bf11873d12 Author: G Kranthi Date: Tue Apr 25 12:18:21 2017 +0530 ASoC: Intel: Skylake: Modify arguments to reuse module transfer function Kabylake also uses code loader dma for module load and library load. skl_transfer_module can be reused. Modify the arguments to include library index to be passed to lib load ipc and module/lib check to use correct ipc for lib/module load. Signed-off-by: G Kranthi Signed-off-by: Subhransu S. Prusty Acked-by: Vinod Koul Signed-off-by: Mark Brown sound/soc/intel/skylake/skl-sst.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) commit ebe8907687c052b36839b5f9ed09005db4fbe83c Author: Subhransu S. Prusty Date: Tue Apr 25 12:18:20 2017 +0530 ASoC: Intel: Skylake: Commonize library load request firmware, strip extended manifest and release library changes are common to kabylake and APL. So move these common code to utils to be reused in later patches for kabylake library load. Signed-off-by: Subhransu S. Prusty Acked-by: Vinod Koul Signed-off-by: Mark Brown sound/soc/intel/skylake/bxt-sst.c | 38 ++++------------------------- sound/soc/intel/skylake/skl-sst-dsp.h | 7 +++++- sound/soc/intel/skylake/skl-sst-utils.c | 43 +++++++++++++++++++++++++++++++++ 3 files changed, 54 insertions(+), 34 deletions(-) commit 9fe9c71192832a1c63fb94120cb6c2541aca694f Author: G Kranthi Date: Tue Apr 25 12:18:19 2017 +0530 ASoC: Intel: Skylake: Move sst common initialization to a helper function Some skl sst context are not dependent of platform and initializing them independently for each platform can lead to errors. So optimize by moving them to a helper function and platform specific init code can call this. Signed-off-by: G Kranthi Signed-off-by: Subhransu S. Prusty Acked-by: Vinod Koul Signed-off-by: Mark Brown sound/soc/intel/skylake/bxt-sst.c | 28 +++++-------------------- sound/soc/intel/skylake/skl-sst-dsp.h | 3 +++ sound/soc/intel/skylake/skl-sst-utils.c | 37 +++++++++++++++++++++++++++++++++ sound/soc/intel/skylake/skl-sst.c | 32 ++++++---------------------- 4 files changed, 51 insertions(+), 49 deletions(-) commit dfeabded04962ed2de9dca489de228801df25de6 Author: John Hsu Date: Thu Apr 20 17:25:11 2017 +0800 ASoC: nau8824: new driver Add driver for NAU88L24. Signed-off-by: John Hsu Signed-off-by: John Hsu Signed-off-by: Mark Brown .../devicetree/bindings/sound/nau8824.txt | 88 + sound/soc/codecs/Kconfig | 5 + sound/soc/codecs/Makefile | 2 + sound/soc/codecs/nau8824.c | 1837 ++++++++++++++++++++ sound/soc/codecs/nau8824.h | 466 +++++ 5 files changed, 2398 insertions(+) commit a5bf5fc060b0095ebd6f1886da8ec482697176fa Author: Wei Yongjun Date: Tue Apr 25 03:30:04 2017 +0000 pinctrl: artpec6: Remove .owner field for driver Remove .owner field if calls are used which set it automatically. Generated by: scripts/coccinelle/api/platform_no_drv_owner.cocci Signed-off-by: Wei Yongjun Signed-off-by: Linus Walleij drivers/pinctrl/pinctrl-artpec6.c | 1 - 1 file changed, 1 deletion(-) commit b42a33bd93fe0b2438511b1c7c00cfd47e17841b Author: Moritz Fischer Date: Tue Apr 25 11:30:14 2017 -0700 spi: cadence: Allow for GPIO pins to be used as chipselects This adds support for using GPIOs for chipselects as described by the default dt-bindings. Signed-off-by: Moritz Fischer Signed-off-by: Mark Brown drivers/spi/spi-cadence.c | 65 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 65 insertions(+) commit 1608fd1ca3b9357ea20ffc3a8ad2d1e4b78301a6 Author: Christoph Hellwig Date: Wed Apr 26 09:34:22 2017 +0200 ide-pm: always pass 0 error to ide_complete_rq in ide_do_devset The caller only looks at the scsi_request result field anyway. Signed-off-by: Christoph Hellwig Reviewed-by: Bartlomiej Zolnierkiewicz Signed-off-by: Jens Axboe drivers/ide/ide-devsets.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ce210e92238e976143c07a2d19d18c8919cb16a1 Author: Christoph Hellwig Date: Wed Apr 26 09:34:21 2017 +0200 ide-pm: always pass 0 error to __blk_end_request_all ide_pm_execute_rq exectures a PM request synchronously, and in the failure case where it calls __blk_end_request_all it never checks the error field passed to the end_io callback, so don't bother setting it. Signed-off-by: Christoph Hellwig Reviewed-by: Bartlomiej Zolnierkiewicz Signed-off-by: Jens Axboe drivers/ide/ide-pm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d188b90c48e418e102a1f42872b13dfe386ab6a7 Author: Christoph Hellwig Date: Wed Apr 26 09:34:20 2017 +0200 scsi_transport_sas: always pass 0 error to blk_end_request_all The SAS transport queues are only used by bsg, and bsg always looks at the scsi_request results and never add the error passed in the end_io callback. Signed-off-by: Christoph Hellwig Signed-off-by: Jens Axboe drivers/scsi/scsi_transport_sas.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 88326ef05b262f681d837ecf65db10a7edb609f1 Author: Chris Wilson Date: Sat Apr 22 09:15:37 2017 +0100 drm/i915: Confirm the request is still active before adding it to the await Although we do check the completion-status of the request before actually adding a wait on it (either to its submit fence or its completion dma-fence), we currently do not check before adding it to the dependency lists. In fact, without checking for a completed request we may try to use the signaler after it has been retired and its dependency tree freed: [ 60.044057] BUG: KASAN: use-after-free in __list_add_valid+0x1d/0xd0 at addr ffff880348c9e6a0 [ 60.044118] Read of size 8 by task gem_exec_fence/530 [ 60.044164] CPU: 1 PID: 530 Comm: gem_exec_fence Tainted: G E 4.11.0-rc7+ #46 [ 60.044226] Hardware name: ��������������������������������� ���������������������������������/���������������������������������, BIOS RYBDWi35.86A.0246.2 [ 60.044290] Call Trace: [ 60.044337] dump_stack+0x4d/0x6a [ 60.044383] kasan_object_err+0x21/0x70 [ 60.044435] kasan_report+0x225/0x4e0 [ 60.044488] ? __list_add_valid+0x1d/0xd0 [ 60.044534] ? kasan_kmalloc+0xad/0xe0 [ 60.044587] __asan_load8+0x5e/0x70 [ 60.044639] __list_add_valid+0x1d/0xd0 [ 60.044788] __i915_priotree_add_dependency+0x67/0x130 [i915] [ 60.044895] i915_gem_request_await_request+0xa8/0x370 [i915] [ 60.044974] i915_gem_request_await_dma_fence+0x129/0x140 [i915] [ 60.045049] i915_gem_do_execbuffer.isra.37+0xb0a/0x26b0 [i915] [ 60.045077] ? save_stack+0xb1/0xd0 [ 60.045105] ? save_stack_trace+0x1b/0x20 [ 60.045132] ? save_stack+0x46/0xd0 [ 60.045158] ? kasan_kmalloc+0xad/0xe0 [ 60.045184] ? __kmalloc+0xd8/0x670 [ 60.045229] ? drm_ioctl+0x359/0x640 [drm] [ 60.045256] ? SyS_ioctl+0x41/0x70 [ 60.045330] ? i915_vma_move_to_active+0x540/0x540 [i915] [ 60.045360] ? tty_insert_flip_string_flags+0xa1/0xf0 [ 60.045387] ? tty_flip_buffer_push+0x63/0x70 [ 60.045414] ? remove_wait_queue+0xa9/0xc0 [ 60.045441] ? kasan_unpoison_shadow+0x35/0x50 [ 60.045467] ? kasan_kmalloc+0xad/0xe0 [ 60.045494] ? kasan_check_write+0x14/0x20 [ 60.045568] i915_gem_execbuffer2+0xdb/0x2a0 [i915] [ 60.045616] drm_ioctl+0x359/0x640 [drm] [ 60.045705] ? i915_gem_execbuffer+0x5a0/0x5a0 [i915] [ 60.045751] ? drm_version+0x150/0x150 [drm] [ 60.045778] ? compat_start_thread+0x60/0x60 [ 60.045805] ? plist_del+0xda/0x1a0 [ 60.045833] do_vfs_ioctl+0x12e/0x910 [ 60.045860] ? ioctl_preallocate+0x130/0x130 [ 60.045886] ? pci_mmcfg_check_reserved+0xc0/0xc0 [ 60.045913] ? vfs_write+0x196/0x240 [ 60.045939] ? __fget_light+0xa7/0xc0 [ 60.045965] SyS_ioctl+0x41/0x70 [ 60.045991] entry_SYSCALL_64_fastpath+0x17/0x98 [ 60.046017] RIP: 0033:0x7feb2baefc47 [ 60.046042] RSP: 002b:00007fff56d28e58 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 60.046075] RAX: ffffffffffffffda RBX: 00007fff56d290a8 RCX: 00007feb2baefc47 [ 60.046102] RDX: 00007fff56d29050 RSI: 00000000c0406469 RDI: 0000000000000003 [ 60.046129] RBP: 00007fff56d29050 R08: 000055ecc4cd27d0 R09: 00007feb2bda8600 [ 60.046154] R10: 0000000000000073 R11: 0000000000000246 R12: 00000000c0406469 [ 60.046177] R13: 0000000000000003 R14: 000000000000000f R15: 0000000000000099 [ 60.046203] Object at ffff880348c9e680, in cache i915_dependency size: 64 [ 60.046225] Allocated: [ 60.046246] PID = 530 [ 60.046269] save_stack_trace+0x1b/0x20 [ 60.046292] save_stack+0x46/0xd0 [ 60.046318] kasan_kmalloc+0xad/0xe0 [ 60.046343] kasan_slab_alloc+0x12/0x20 [ 60.046368] kmem_cache_alloc+0xab/0x650 [ 60.046445] i915_gem_request_await_request+0x88/0x370 [i915] [ 60.046559] i915_gem_request_await_dma_fence+0x129/0x140 [i915] [ 60.046705] i915_gem_do_execbuffer.isra.37+0xb0a/0x26b0 [i915] [ 60.046849] i915_gem_execbuffer2+0xdb/0x2a0 [i915] [ 60.046936] drm_ioctl+0x359/0x640 [drm] [ 60.046987] do_vfs_ioctl+0x12e/0x910 [ 60.047038] SyS_ioctl+0x41/0x70 [ 60.047090] entry_SYSCALL_64_fastpath+0x17/0x98 [ 60.047139] Freed: [ 60.047179] PID = 530 [ 60.047223] save_stack_trace+0x1b/0x20 [ 60.047269] save_stack+0x46/0xd0 [ 60.047317] kasan_slab_free+0x72/0xc0 [ 60.047366] kmem_cache_free+0x39/0x160 [ 60.047512] i915_gem_request_retire+0x83f/0x930 [i915] [ 60.047657] i915_gem_request_alloc+0x166/0x600 [i915] [ 60.047799] i915_gem_do_execbuffer.isra.37+0xad8/0x26b0 [i915] [ 60.047897] i915_gem_execbuffer2+0xdb/0x2a0 [i915] [ 60.047942] drm_ioctl+0x359/0x640 [drm] [ 60.047968] do_vfs_ioctl+0x12e/0x910 [ 60.047993] SyS_ioctl+0x41/0x70 [ 60.048019] entry_SYSCALL_64_fastpath+0x17/0x98 [ 60.048044] Memory state around the buggy address: [ 60.048066] ffff880348c9e580: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 60.048105] ffff880348c9e600: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 60.048138] >ffff880348c9e680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 60.048170] ^ [ 60.048191] ffff880348c9e700: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 60.048225] ffff880348c9e780: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc Note to hit the use-after-free requires us to be passed back a request via a fence-array, that is from explicit fencing accumulated into a sync-file fence-array. Fixes: 52e542090701 ("drm/i915/scheduler: Record all dependencies upon request construction") Testcase: igt/gem_exec_fence/expired-history Signed-off-by: Chris Wilson Reviewed-by: Michał Winiarski Reviewed-by: Joonas Lahtinen Cc: Tvrtko Ursulin Link: http://patchwork.freedesktop.org/patch/msgid/20170422081537.6468-1-chris@chris-wilson.co.uk (cherry picked from commit ade0b0c965f59176daddbef9c4717354034f9bce) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_gem_request.c | 3 +++ 1 file changed, 3 insertions(+) commit 96dabe99cae8a1b5fc645f213eeac928541d3899 Author: Chris Wilson Date: Fri Apr 21 14:58:15 2017 +0100 drm/i915: Avoid busy-spinning on VLV_GLTC_PW_STATUS mmio The busy-spin, as the first stage of intel_wait_for_register(), is currently under suspicion for causing: [ 62.034926] NMI watchdog: Watchdog detected hard LOCKUP on cpu 1 [ 62.034928] Modules linked in: i2c_dev i915 intel_gtt drm_kms_helper prime_numbers [ 62.034932] CPU: 1 PID: 183 Comm: kworker/1:2 Not tainted 4.11.0-rc7+ #471 [ 62.034933] Hardware name: / , BIOS PYBSWCEL.86A.0027.2015.0507.1758 05/07/2015 [ 62.034934] Workqueue: pm pm_runtime_work [ 62.034936] task: ffff880275a04ec0 task.stack: ffffc900002d8000 [ 62.034936] RIP: 0010:__intel_wait_for_register_fw+0x77/0x1a0 [i915] [ 62.034937] RSP: 0018:ffffc900002dbc38 EFLAGS: 00000082 [ 62.034939] RAX: ffffc90003530094 RBX: 0000000000130094 RCX: 0000000000000001 [ 62.034940] RDX: 00000000000000a1 RSI: ffff88027fd15e58 RDI: 0000000000000000 [ 62.034941] RBP: ffffc900002dbc78 R08: 0000000000000002 R09: 0000000000000000 [ 62.034942] R10: ffffc900002dbc18 R11: ffff880276429dd0 R12: ffff8802707c0000 [ 62.034943] R13: 00000000000000a0 R14: 0000000000000000 R15: 00000000fffefc10 [ 62.034945] FS: 0000000000000000(0000) GS:ffff88027fd00000(0000) knlGS:0000000000000000 [ 62.034945] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 62.034947] CR2: 00007ffd3cd98ff8 CR3: 0000000274c19000 CR4: 00000000001006e0 [ 62.034947] Call Trace: [ 62.034948] intel_wait_for_register+0x77/0x140 [i915] [ 62.034949] vlv_suspend_complete+0x23/0x5b0 [i915] [ 62.034950] intel_runtime_suspend+0x16c/0x2a0 [i915] [ 62.034950] pci_pm_runtime_suspend+0x50/0x180 [ 62.034951] ? pci_pm_runtime_resume+0xa0/0xa0 [ 62.034952] __rpm_callback+0xc5/0x210 [ 62.034953] rpm_callback+0x1f/0x80 [ 62.034953] ? pci_pm_runtime_resume+0xa0/0xa0 [ 62.034954] rpm_suspend+0x118/0x580 [ 62.034955] pm_runtime_work+0x64/0x90 [ 62.034956] process_one_work+0x1bb/0x3e0 [ 62.034956] worker_thread+0x46/0x4f0 [ 62.034957] ? __schedule+0x18b/0x610 [ 62.034958] kthread+0xff/0x140 [ 62.034958] ? process_one_work+0x3e0/0x3e0 [ 62.034959] ? kthread_create_on_node+ and related hard lockups in CI for byt and bsw. Note this effectively reverts commits 41ce405e6894 and b27366958869 ("drm/i915: Convert wait_for(I915_READ(reg)) to intel_wait_for_register()") v2: Convert bool allow into a u32 mask for clarity and repeat the comment on vlv rc6 timing to justify the 3ms timeout used for the wait (Ville) Fixes: 41ce405e6894 ("drm/i915: Convert wait_for(I915_READ(reg)) to intel_wait_for_register()") Fixes: b27366958869 ("drm/i915: Convert wait_for(I915_READ(reg)) to intel_wait_for_register()") Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=100718 Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Cc: Ville Syrjälä Cc: Tomi Sarvela Reviewed-by: Ville Syrjälä Link: http://patchwork.freedesktop.org/patch/msgid/20170421135815.11897-1-chris@chris-wilson.co.uk Tested-by: Tomi Sarvela (cherry picked from commit 3dd14c04d77d7d702de5aa7157df4cc9417329f3) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_drv.c | 46 +++++++++++++++++++++-------------------- 1 file changed, 24 insertions(+), 22 deletions(-) commit b162d47e142581bfae356d9474856c972c40adbe Author: Chris Wilson Date: Wed Apr 19 10:41:17 2017 +0100 drm/i915/selftests: Allocate inode/file dynamically Avoid having too large a stack by creating the fake struct inode/file on the heap instead. drivers/gpu/drm/i915/selftests/mock_drm.c: In function 'mock_file': drivers/gpu/drm/i915/selftests/mock_drm.c:46:1: error: the frame size of 1328 bytes is larger than 1280 bytes [-Werror=frame-larger-than=] drivers/gpu/drm/i915/selftests/mock_drm.c: In function 'mock_file_free': drivers/gpu/drm/i915/selftests/mock_drm.c:54:1: error: the frame size of 1312 bytes is larger than 1280 bytes [-Werror=frame-larger-than=] Reported-by: Arnd Bergmann Fixes: 66d9cb5d805a ("drm/i915: Mock the GEM device for self-testing") Signed-off-by: Chris Wilson Cc: Joonas Lahtinen Cc: Tvrtko Ursulin Cc: Matthew Auld Cc: Arnd Bergmann Acked-by: Arnd Bergmann Link: http://patchwork.freedesktop.org/patch/msgid/20170419094143.16922-2-chris@chris-wilson.co.uk Reviewed-by: Joonas Lahtinen (cherry picked from commit 2310b3c952c5dc56c2e08f71b907b8e23ab3270d) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/selftests/mock_drm.c | 45 ++++++++++++++++++++++--------- 1 file changed, 32 insertions(+), 13 deletions(-) commit acf2dc2266b99be9103b5c35acbb8f9fe923bf3d Author: Mika Kuoppala Date: Thu Apr 13 14:15:27 2017 +0300 drm/i915: Fix system hang with EI UP masked on Haswell Previously with commit a9c1f90c8e17 ("drm/i915: Don't mask EI UP interrupt on IVB|SNB") certain, seemingly unrelated bit (GEN6_PM_RP_UP_EI_EXPIRED) was needed to be unmasked for IVB and SNB in order to prevent system hang with chained batchbuffers. Our CI was seeing incomplete results with tests that used chained batches and it was found out that HSW needs to have this same bit unmasked to reliably survive chained batches. Always unmask GEN6_PM_RP_UP_EI_EXPIRED on Haswell to prevent system hang with batch chaining. Testcase: igt/gem_exec_fence/nb-await-default Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=100672 Cc: Chris Wilson Cc: stable@vger.kernel.org Signed-off-by: Mika Kuoppala Acked-by: Chris Wilson Link: http://patchwork.freedesktop.org/patch/msgid/1492082127-29007-1-git-send-email-mika.kuoppala@intel.com (cherry picked from commit 3396a273851c14634b98bb27be37508b06df94f4) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_irq.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 5af9e672b84f006695b820f791f2eceecca59bbc Author: Dan Carpenter Date: Thu Apr 13 22:52:17 2017 +0300 drm/i915: checking for NULL instead of IS_ERR() in mock selftests i915_gem_request_alloc() uses error pointers. It never returns NULLs. Fixes: 0daf0113cff6 ("drm/i915: Mock infrastructure for request emission") Signed-off-by: Dan Carpenter Link: http://patchwork.freedesktop.org/patch/msgid/20170413195217.GA26108@mwanda Reviewed-by: Chris Wilson Signed-off-by: Chris Wilson (cherry picked from commit be02f7556447a0dee672acb5e462f03377b98ae8) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/selftests/mock_request.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit dea655939837034f04992cef480162949b7cc19f Author: Ville Syrjälä Date: Wed Apr 12 22:30:17 2017 +0300 drm/i915: Perform link quality check unconditionally during long pulse Apparently some DP sinks are a little nuts and cause HPD to drop intermittently during modesets. This happens eg. on an ASUS PB287Q. In oder to recover from this we can't really use the previous connector status to determine if the link needs retraining, so let's just ignore that piece of information and do the retrain unconditionally. We do of course still check whether the link is supposed to be running or not. To actually get read out the EDID and update things properly we also need to nuke the goto out added by commit 7d23e3c37bb3 ("drm/i915: Cleaning up intel_dp_hpd_pulse"). I'm actually not sure why that was there. Perhaps to avoid an EDID read if the connector status didn't appear to change, but that sort of thing is quite racy and would have failed anyway if we failed to keep up with the hotplugs (if we missed the HPD down in between two HPD ups). And now that we take this codepath unconditionally we definitely need to drop the goto as otherwise we would never do the EDID read. v2: Drop the goto that made us skip EDID reads entirely. Doh! v3: Rebase due to locking changes s/apparely/apparently/ in the comment (Chris) Cc: stable@vger.kernel.org Cc: Manasi Navare Cc: Palmer Dabbelt Reported-by: Palmer Dabbelt Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=99766 References: https://lists.freedesktop.org/archives/intel-gfx/2017-February/119779.html Signed-off-by: Ville Syrjälä Reviewed-by: Chris Wilson Link: http://patchwork.freedesktop.org/patch/msgid/20170412193017.21029-1-ville.syrjala@linux.intel.com (cherry picked from commit 1a36147bb93921651f7fbd7a6e522da6c349081b) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_dp.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) commit dde7b00e4c85db74a4ae02ec31752cc8be3c75f1 Author: Chris Wilson Date: Wed Apr 12 09:02:51 2017 +0100 drm/i915: Fix use after free in lpe_audio_platdev_destroy() [31908.547136] BUG: KASAN: use-after-free in intel_lpe_audio_teardown+0x78/0xb0 [i915] at addr ffff8801f7788358 [31908.547297] Read of size 8 by task drv_selftest/3781 [31908.547405] CPU: 0 PID: 3781 Comm: drv_selftest Tainted: G BU W 4.10.0+ #451 [31908.547553] Hardware name: / , BIOS PYBSWCEL.86A.0027.2015.0507.1758 05/07/2015 [31908.547682] Call Trace: [31908.547772] dump_stack+0x68/0x9f [31908.547857] kasan_object_err+0x1c/0x70 [31908.547947] kasan_report_error+0x1f1/0x4f0 [31908.548038] ? kfree+0xaa/0x170 [31908.548121] kasan_report+0x34/0x40 [31908.548211] ? klist_children_get+0x20/0x30 [31908.548472] ? intel_lpe_audio_teardown+0x78/0xb0 [i915] [31908.548567] __asan_load8+0x5e/0x70 [31908.548824] intel_lpe_audio_teardown+0x78/0xb0 [i915] [31908.549080] intel_audio_deinit+0x28/0x80 [i915] [31908.549315] i915_driver_unload+0xe4/0x360 [i915] [31908.549551] ? i915_driver_load+0x1d70/0x1d70 [i915] [31908.549651] ? trace_hardirqs_on+0xd/0x10 [31908.549885] i915_pci_remove+0x23/0x30 [i915] [31908.549978] pci_device_remove+0x5c/0x100 [31908.550069] device_release_driver_internal+0x1db/0x2e0 [31908.550165] driver_detach+0x68/0xc0 [31908.550256] bus_remove_driver+0x8b/0x150 [31908.550346] driver_unregister+0x3e/0x60 [31908.550439] pci_unregister_driver+0x1d/0x110 [31908.550531] ? find_module_all+0x7a/0xa0 [31908.550791] i915_exit+0x1a/0x87 [i915] [31908.550881] SyS_delete_module+0x264/0x2c0 [31908.550971] ? free_module+0x430/0x430 [31908.551064] ? trace_hardirqs_off_caller+0x16/0x110 [31908.551159] ? trace_hardirqs_on_caller+0x16/0x280 [31908.551256] ? trace_hardirqs_on_thunk+0x1a/0x1c [31908.551350] entry_SYSCALL_64_fastpath+0x1c/0xb1 [31908.551440] RIP: 0033:0x7f1d67312ec7 [31908.551520] RSP: 002b:00007ffebe34e888 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 [31908.551650] RAX: ffffffffffffffda RBX: ffffffff811123f6 RCX: 00007f1d67312ec7 [31908.551743] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 0000560d0af476b8 [31908.551837] RBP: ffff880233d87f98 R08: 0000000000000000 R09: 00007ffebe34e8b8 [31908.551930] R10: 00007f1d68adf8c0 R11: 0000000000000206 R12: 0000000000000000 [31908.552023] R13: 0000560d0af46440 R14: 0000000000000034 R15: 00007ffebe34d860 [31908.552121] ? trace_hardirqs_off_caller+0x16/0x110 [31908.552217] Object at ffff8801f7788000, in cache kmalloc-2048 size: 2048 [31908.552306] Allocated: [31908.552377] PID = 3781 [31908.552456] save_stack_trace+0x16/0x20 [31908.552539] kasan_kmalloc+0xee/0x190 [31908.552627] __kmalloc+0xdb/0x1b0 [31908.552713] platform_device_alloc+0x27/0x90 [31908.552804] platform_device_register_full+0x36/0x220 [31908.553066] intel_lpe_audio_init+0x41e/0x570 [i915] [31908.553320] intel_audio_init+0xd/0x40 [i915] [31908.553552] i915_driver_load+0x13f5/0x1d70 [i915] [31908.553788] i915_pci_probe+0x65/0xe0 [i915] [31908.553881] pci_device_probe+0xda/0x140 [31908.553969] driver_probe_device+0x400/0x660 [31908.554058] __driver_attach+0x11c/0x120 [31908.554147] bus_for_each_dev+0xe6/0x150 [31908.554237] driver_attach+0x26/0x30 [31908.554325] bus_add_driver+0x26b/0x3b0 [31908.554412] driver_register+0xce/0x190 [31908.554502] __pci_register_driver+0xaf/0xc0 [31908.554589] 0xffffffffa0550063 [31908.554675] do_one_initcall+0x8b/0x1e0 [31908.554764] do_init_module+0x102/0x325 [31908.554852] load_module+0x3aad/0x45e0 [31908.554944] SyS_finit_module+0x169/0x1a0 [31908.555033] entry_SYSCALL_64_fastpath+0x1c/0xb1 [31908.555119] Freed: [31908.555188] PID = 3781 [31908.555266] save_stack_trace+0x16/0x20 [31908.555349] kasan_slab_free+0xb0/0x180 [31908.555436] kfree+0xaa/0x170 [31908.555520] platform_device_release+0x76/0x80 [31908.555610] device_release+0x45/0xe0 [31908.555698] kobject_put+0x11f/0x260 [31908.555785] put_device+0x12/0x20 [31908.555871] platform_device_unregister+0x1b/0x20 [31908.556135] intel_lpe_audio_teardown+0x5c/0xb0 [i915] [31908.556390] intel_audio_deinit+0x28/0x80 [i915] [31908.556622] i915_driver_unload+0xe4/0x360 [i915] [31908.556858] i915_pci_remove+0x23/0x30 [i915] [31908.556948] pci_device_remove+0x5c/0x100 [31908.557037] device_release_driver_internal+0x1db/0x2e0 [31908.557129] driver_detach+0x68/0xc0 [31908.557217] bus_remove_driver+0x8b/0x150 [31908.557304] driver_unregister+0x3e/0x60 [31908.557394] pci_unregister_driver+0x1d/0x110 [31908.557653] i915_exit+0x1a/0x87 [i915] [31908.557741] SyS_delete_module+0x264/0x2c0 [31908.557834] entry_SYSCALL_64_fastpath+0x1c/0xb1 [31908.557919] Memory state around the buggy address: [31908.558005] ffff8801f7788200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [31908.558127] ffff8801f7788280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [31908.558255] >ffff8801f7788300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [31908.558374] ^ [31908.558467] ffff8801f7788380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [31908.558595] ffff8801f7788400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb v2: Just leak the memory (8 bytes) as freeing it ourselves is not safe, and we need to coordinate a proper fix in platform_device itself. Fixes: eef57324d926 ("drm/i915: setup bridge for HDMI LPE audio driver") Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=99952 Signed-off-by: Chris Wilson Cc: Pierre-Louis Bossart Cc: Jerome Anand Cc: Jani Nikula Cc: Takashi Iwai Link: http://patchwork.freedesktop.org/patch/msgid/20170412080251.30648-1-chris@chris-wilson.co.uk Reviewed-by: Takashi Iwai Reviewed-by: Ville Syrjälä (cherry picked from commit 48ae80741da4b8a26b6df0f765713912bc7cc480) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_lpe_audio.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit 45b21cfeb22087795f0b49397fbe529efeb99baf Author: Michael Ellerman Date: Wed Apr 26 17:32:38 2017 +1000 powerpc/powernv: Fix oops on P9 DD1 in cause_ipi() Recently we merged the native xive support for Power9, and then separately some reworks for doorbell IPI support. In isolation both series were OK, but the merged result had a bug in one case. On P9 DD1 we use pnv_p9_dd1_cause_ipi() which tries to use doorbells, and then falls back to the interrupt controller. However the fallback is implemented by calling icp_ops->cause_ipi. But now that xive support is merged we might be using xive, in which case icp_ops is not initialised, it's a xics specific structure. This leads to an oops such as: Unable to handle kernel paging request for data at address 0x00000028 Oops: Kernel access of bad area, sig: 11 [#1] NIP pnv_p9_dd1_cause_ipi+0x74/0xe0 LR smp_muxed_ipi_message_pass+0x54/0x70 To fix it, rather than using icp_ops which might be NULL, have both xics and xive set smp_ops->cause_ipi, and then in the powernv code we save that as ic_cause_ipi before overriding smp_ops->cause_ipi. For paranoia add a WARN_ON() to check if somehow smp_ops->cause_ipi is NULL. Fixes: b866cc2199d6 ("powerpc: Change the doorbell IPI calling convention") Tested-by: Gautham R. Shenoy Signed-off-by: Michael Ellerman arch/powerpc/platforms/powernv/smp.c | 12 ++++++++---- arch/powerpc/sysdev/xics/xics-common.c | 3 +++ 2 files changed, 11 insertions(+), 4 deletions(-) commit bdb57b8dca8e77f85c4cd9aecabd0591e6b26b2d Author: Chris Wilson Date: Wed Apr 5 23:15:14 2017 +0100 drm/i915: Use the right mapping_gfp_mask for final shmem allocation Many sightings report the greater prevalence of allocation failures. This is all due to the incorrect use of mapping_gfp_constraint(), so remove it in favour of just querying the mapping_gfp_mask() which are the exact gfp_t we wanted in the first place. We still do expect a higher chance of reporting ENOMEM, as that is the intention of using __GFP_NORETRY -- to fail rather than oom after having reclaimed from our bo caches, and having done a direct|kswapd reclaim pass. Reported-by: Jason Ekstrand Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=100594 Fixes: 24f8e00a8a2e ("drm/i915: Prefer to report ENOMEM rather than incur the oom for gfx allocations") Signed-off-by: Chris Wilson Cc: Joonas Lahtinen Cc: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/20170405221514.23251-1-chris@chris-wilson.co.uk Reviewed-by: Joonas Lahtinen (cherry picked from commit b268d9fe0f10544f5f7a1b7015e2b97075e6215d) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/i915_gem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 440df938b482801c62722cc9460ee55b9a4bd847 Author: Ville Syrjälä Date: Wed Mar 29 17:21:23 2017 +0300 drm/i915: Make legacy cursor updates more unsynced We're clearing the legacy_cursor_update flag before calling drm_atomic_helper_setup_commit() which means the helper will wait for the flip to complete before cleaning up the framebuffers. That's not what we want for the legacy cursor, so let's clear the flag after setting up the commit. Also toss in a FIXME about solving these problems in a nicer way using the fabled vblank workers. v2: Also unsync with legacy page flips Cc: Maarten Lankhorst Cc: Daniel Vetter Cc: Uwe Kleine-König Cc: Rafael Ristovski Fixes: a5509abda48e ("drm/i915: Fix legacy cursor vs. watermarks for ILK-BDW") Signed-off-by: Ville Syrjälä Link: http://patchwork.freedesktop.org/patch/msgid/20170329142123.5923-1-ville.syrjala@linux.intel.com Reviewed-by: Maarten Lankhorst (cherry picked from commit 895203044067af64400cedbc055898bcec98d102) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_display.c | 31 ++++++++++++++++++++----------- 1 file changed, 20 insertions(+), 11 deletions(-) commit d445aaaac0879a4c4400bf59f20465ba3e8445f1 Author: Chris Wilson Date: Tue Apr 4 13:05:31 2017 +0100 drm/i915: Apply a cond_resched() to the saturated signaler If the engine is continually completing nops, we can saturate the signaler and keep it working indefinitely. This angers the NMI watchdog! A good example is to disable semaphores on snb and run igt/gem_exec_nop - the parallel, multi-engine workloads are more than sufficient to hog the CPU, preventing the system from even processing ICMP echo replies. v2: Tvrtko dug into cond_resched() on x86 and found that it only depended upon preempt_count and not tif_need_resched() - which means that we would always call schedule() at that point. Fixes: c81d46138da6 ("drm/i915: Convert trace-irq to the breadcrumb waiter") Signed-off-by: Chris Wilson Cc: Mika Kuoppala Cc: Tvrtko Ursulin Link: http://patchwork.freedesktop.org/patch/msgid/20170404120531.10737-1-chris@chris-wilson.co.uk Reviewed-by: Tvrtko Ursulin (cherry picked from commit a7980a640cbd339aa80f406d1786a275a2c320bc) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_breadcrumbs.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) commit 1676a2b35cd5a548da17d1106fb0d4d238c0d191 Author: Chris Wilson Date: Mon Apr 3 11:51:24 2017 +0100 drm/i915: Park the signaler before sleeping If the signal to park arrives before we sleep, then we need to check kthread_should_park() before sleeping to avoid missing the signal. Otherwise, if the signal arrives whilst we are processing completed requests, we will reset the current->state back to TASK_INTERRUPTIBLE and so miss the wakeup. Fixes: fe3288b5da2c ("drm/i915: Park the breadcrumbs signaler across a GPU reset") Signed-off-by: Chris Wilson Cc: Mika Kuoppala Cc: Tvrtko Ursulin Link: http://patchwork.freedesktop.org/patch/msgid/20170403105124.8969-1-chris@chris-wilson.co.uk Reviewed-by: Tvrtko Ursulin (cherry picked from commit b1becb88268beb72df6495e35d3d76c138d215bb) Signed-off-by: Jani Nikula drivers/gpu/drm/i915/intel_breadcrumbs.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit ca2958f14c4706d5dced95f4f7dfe2bdd1b268de Author: Steven Rostedt (VMware) Date: Thu Apr 20 14:20:19 2017 -0400 selftests: ftrace: Allow some event trigger tests to run in an instance Some of the event triggers can run fine in an instance. Have them tested in one as well. The ones that still need work are the snapshot, stacktrace and traceon/off triggers, as they don't currently pass a handle to the trace_array they are attached to. But that can be for a future project. Acked-by: Masami Hiramatsu Acked-by: Namhyung Kim Signed-off-by: Steven Rostedt (VMware) tools/testing/selftests/ftrace/test.d/trigger/trigger-eventonoff.tc | 1 + tools/testing/selftests/ftrace/test.d/trigger/trigger-filter.tc | 1 + tools/testing/selftests/ftrace/test.d/trigger/trigger-hist-mod.tc | 1 + tools/testing/selftests/ftrace/test.d/trigger/trigger-hist.tc | 1 + tools/testing/selftests/ftrace/test.d/trigger/trigger-multihist.tc | 1 + 5 files changed, 5 insertions(+) commit 03c201759e9726ca6abaf8cabac936fd62c2543f Author: Steven Rostedt (VMware) Date: Thu Apr 20 13:44:32 2017 -0400 selftests: ftrace: Have some basic tests run in a tracing instance too Some of the basic ftrace selftests should also be run in an instance. These test a quick case of running all tracers in the available_tracers file within the instance. The other is testing the clock used for the instance. Acked-by: Masami Hiramatsu Acked-by: Namhyung Kim Signed-off-by: Steven Rostedt (VMware) tools/testing/selftests/ftrace/test.d/00basic/basic2.tc | 1 + tools/testing/selftests/ftrace/test.d/00basic/basic3.tc | 1 + 2 files changed, 2 insertions(+) commit 35df6a894e5b282f725743a8cb9dd7ed8d63e320 Author: Steven Rostedt (VMware) Date: Thu Apr 20 13:39:40 2017 -0400 selftests: ftrace: Have event tests also run in an tracing instance The ftrace selftests of events: event-enable, event-pid, and subsystem-enable can all be run inside an instance. Change their tests to do both a toplevel run an an instance run. Acked-by: Masami Hiramatsu Acked-by: Namhyung Kim Signed-off-by: Steven Rostedt (VMware) tools/testing/selftests/ftrace/test.d/event/event-enable.tc | 1 + tools/testing/selftests/ftrace/test.d/event/event-pid.tc | 1 + tools/testing/selftests/ftrace/test.d/event/subsystem-enable.tc | 1 + 3 files changed, 3 insertions(+) commit 6df0fee3e8ab6a612a971c5f837e61149448eae8 Author: Steven Rostedt (VMware) Date: Thu Apr 20 13:32:56 2017 -0400 selftests: ftrace: Make func_event_triggers and func_traceonoff_triggers tests do instances Both the func_event_triggers and func_traceonoff_triggers tests can be performed in both the toplevel instance as well as for individual instances. Have their tests run in both cases. Acked-by: Masami Hiramatsu Acked-by: Namhyung Kim Signed-off-by: Steven Rostedt (VMware) tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc | 1 + tools/testing/selftests/ftrace/test.d/ftrace/func_traceonoff_triggers.tc | 1 + 2 files changed, 2 insertions(+) commit b5b77be812de78265e794523bf4e969fadf581be Author: Steven Rostedt (VMware) Date: Thu Apr 20 12:53:18 2017 -0400 selftests: ftrace: Allow some tests to be run in a tracing instance An tracing instance has several of the same capabilities as the top level instance, but may be implemented slightly different. Instead of just writing tests that duplicat the same test cases of the top level instance, allow a test to be written for both the top level as well as for an instance. If a test case can be run in both the top level as well as in an tracing instance directory, then it should add a tag "# flags: instance" in the header of the test file. Then after all tests have run, any test that has an instance flag set, will run again within a tracing instance. Link: http://lkml.kernel.org/r/20170421233850.1d0e9e05@gandalf.local.home Cc: Shuah Khan Acked-by: Namhyung Kim Acked-by: Masami Hiramatsu Signed-off-by: Steven Rostedt (VMware) tools/testing/selftests/ftrace/ftracetest | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) commit 4a99f3c83dc493c8ea84693d78cd792839c8aa64 Author: Amir Goldstein Date: Mon Apr 24 22:26:40 2017 +0300 ovl: do not set overlay.opaque on non-dir create The optimization for opaque dir create was wrongly being applied also to non-dir create. Fixes: 97c684cc9110 ("ovl: create directories inside merged parent opaque") Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi Cc: # v4.10 fs/overlayfs/dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e000b8e0968dd7bfa09c444607ce1e48e57aafd3 Author: Jason J. Herne Date: Mon Mar 20 09:57:42 2017 -0400 s390: kvm: Cpu model support for msa6, msa7 and msa8 msa6 and msa7 require no changes. msa8 adds kma instruction and feature area. Signed-off-by: Jason J. Herne Reviewed-by: Christian Borntraeger Signed-off-by: Christian Borntraeger Documentation/virtual/kvm/devices/vm.txt | 3 ++- arch/s390/include/uapi/asm/kvm.h | 3 ++- arch/s390/kvm/kvm-s390.c | 4 ++++ arch/s390/tools/gen_facilities.c | 1 + tools/arch/s390/include/uapi/asm/kvm.h | 3 ++- 5 files changed, 11 insertions(+), 3 deletions(-) commit 0850e9219bd0d8fc337adb88c350b878f0dcbaa7 Merge: 730cd63 152c1c8 Author: Christian Borntraeger Date: Wed Apr 26 14:18:20 2017 +0200 Merge branch 's390forkvm' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux commit 152c1c8d60ebedce8cc912c12f9be9ceca6c6671 Author: Jason J. Herne Date: Thu Feb 2 08:25:19 2017 -0500 s390/cpacf: Introduce kma instruction Provide a kma instruction definition for use by callers of __cpacf_query. Signed-off-by: Jason J. Herne Reviewed-by: Christian Borntraeger Signed-off-by: Christian Borntraeger arch/s390/include/asm/cpacf.h | 1 + 1 file changed, 1 insertion(+) commit b112a2df28e6b5238ae4e68821ddd706a476d28c Author: Jason J. Herne Date: Tue Feb 21 09:00:54 2017 -0500 s390/cpacf: query instructions use unique parameters for compatibility with KMA The new KMA instruction requires unique parameters. Update __cpacf_query to generate a compatible assembler instruction. Signed-off-by: Jason J. Herne Acked-by: Harald Freudenberger Signed-off-by: Christian Borntraeger arch/s390/include/asm/cpacf.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit bbcb478e3fefa5d9acff6a5311073fae0809a9c3 Author: Harald Freudenberger Date: Fri Feb 24 09:10:05 2017 +0100 s390/trng: Introduce s390 TRNG device driver. This patch introduces a new device driver s390-trng for the s390 platform which exploits the new PRNO TRNG cpacf subfunction. The true-random-number-generator is accessible from userspace, by default visible as /dev/trng. The driver also registers at the kernel build-in hwrng API to feed the hwrng with fresh entropy data. This generic device driver for hardware random data is visible from userspace as /dev/hwrng. Signed-off-by: Harald Freudenberger Signed-off-by: Martin Schwidefsky drivers/char/hw_random/Kconfig | 14 ++ drivers/char/hw_random/Makefile | 1 + drivers/char/hw_random/s390-trng.c | 268 +++++++++++++++++++++++++++++++++++++ 3 files changed, 283 insertions(+) commit 4c637cd8de43416c1b1eef6113e7aa06abacf18d Author: Harald Freudenberger Date: Fri Mar 17 10:46:31 2017 +0100 s390/crypto: Provide s390 specific arch random functionality. This patch introduces s390 specific arch random functionality. There exists a generic kernel API for arch specific random number implementation (see include/linux/random.h). Here comes the header file and a very small static code part implementing the arch_random_* API based on the TRNG subfunction coming with the reworked PRNG instruction. The arch random implementation hooks into the kernel initialization and checks for availability of the TRNG function. In accordance to the arch random API all functions return false if the TRNG is not available. Otherwise the new high quality entropy source provides fresh random on each invocation. The s390 arch random feature build is controlled via CONFIG_ARCH_RANDOM. This config option located in arch/s390/Kconfig is enabled by default and appears as entry "s390 architectural random number generation API" in the submenu "Processor type and features" for s390 builds. Signed-off-by: Harald Freudenberger Signed-off-by: Martin Schwidefsky arch/s390/Kbuild | 2 +- arch/s390/Kconfig | 15 +++++++++ arch/s390/crypto/Makefile | 1 + arch/s390/crypto/arch_random.c | 31 +++++++++++++++++ arch/s390/include/asm/archrandom.h | 69 ++++++++++++++++++++++++++++++++++++++ 5 files changed, 117 insertions(+), 1 deletion(-) commit f75fa65d70e2423a03c1b7391bfca410d554b1c5 Author: Harald Freudenberger Date: Tue Feb 28 08:59:22 2017 +0100 s390/crypto: Add new subfunctions to the cpacf PRNO function. There is a new TRNG extension in the subcodes for the cpacf PRNO function. This patch introduces new defines and a new cpacf_trng inline function to provide these new features for other kernel code parts. Signed-off-by: Harald Freudenberger Signed-off-by: Martin Schwidefsky arch/s390/include/asm/cpacf.h | 31 +++++++++++++++++++++++++++++-- 1 file changed, 29 insertions(+), 2 deletions(-) commit 985a9d20daa67e1983910fcf6e4f348ce8eed086 Author: Harald Freudenberger Date: Fri Feb 24 10:11:54 2017 +0100 s390/crypto: Renaming PPNO to PRNO. The PPNO (Perform Pseudorandom Number Operation) instruction has been renamed to PRNO (Perform Random Number Operation). To avoid confusion and conflicts with future extensions with this instruction (like e.g. provide a true random number generator) this patch renames all occurences in cpacf.h and adjusts the only exploiter code which is the prng device driver and one line in the s390 kvm feature check. Signed-off-by: Harald Freudenberger Signed-off-by: Martin Schwidefsky arch/s390/crypto/prng.c | 42 +++++++++++++++++++++--------------------- arch/s390/include/asm/cpacf.h | 20 ++++++++++---------- arch/s390/kvm/kvm-s390.c | 2 +- 3 files changed, 32 insertions(+), 32 deletions(-) commit 1366def38b6ab574dd0dbf95e308c7d115e73796 Author: Heiko Carstens Date: Mon Apr 24 15:27:35 2017 +0200 s390/pageattr: avoid unnecessary page table splitting The kernel page table splitting code will split page tables even for features the CPU does not support. E.g. a CPU may not support the NX feature. In order to avoid this, remove those bits from the flags parameter that correlate with unsupported CPU features within __set_memory(). In addition add an early exit if the flags parameter does not have any bits set afterwards. Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky arch/s390/mm/pageattr.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) commit 24af6c4e4e0f6e9803bec8dca0f7748afbb2bbf0 Author: Ard Biesheuvel Date: Tue Feb 21 22:12:57 2017 +0000 arm64: module: split core and init PLT sections The arm64 module PLT code allocates all PLT entries in a single core section, since the overhead of having a separate init PLT section is not justified by the small number of PLT entries usually required for init code. However, the core and init module regions are allocated independently, and there is a corner case where the core region may be allocated from the VMALLOC region if the dedicated module region is exhausted, but the init region, being much smaller, can still be allocated from the module region. This leads to relocation failures if the distance between those regions exceeds 128 MB. (In fact, this corner case is highly unlikely to occur on arm64, but the issue has been observed on ARM, whose module region is much smaller). So split the core and init PLT regions, and name the latter ".init.plt" so it gets allocated along with (and sufficiently close to) the .init sections that it serves. Also, given that init PLT entries may need to be emitted for branches that target the core module, modify the logic that disregards defined symbols to only disregard symbols that are defined in the same section as the relocated branch instruction. Since there may now be two PLT entries associated with each entry in the symbol table, we can no longer hijack the symbol::st_size fields to record the addresses of PLT entries as we emit them for zero-addend relocations. So instead, perform an explicit comparison to check for duplicate entries. Signed-off-by: Ard Biesheuvel Signed-off-by: Catalin Marinas arch/arm64/include/asm/module.h | 9 +++- arch/arm64/kernel/module-plts.c | 108 +++++++++++++++++++++++----------------- arch/arm64/kernel/module.c | 2 +- arch/arm64/kernel/module.lds | 1 + 4 files changed, 72 insertions(+), 48 deletions(-) commit 47d272f0f9887343f4e4d31bb22910b141b96654 Merge: 9cc4b7c 2910849 Author: Kalle Valo Date: Wed Apr 26 14:21:00 2017 +0300 Merge tag 'iwlwifi-next-for-kalle-2017-04-26' of git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next One more pull-request intended for 4.12. These are the changes: * The firmware for 7265D and 3168 NICs is frozen at version 29; * Sari continues working heavily on support for A000 series; * A bunch of fixes; * Some cleanups here and there; commit bdf95923086fb359ccb44c815724c3ace1611c90 Author: Sunil Goutham Date: Tue Apr 25 15:27:52 2017 +0530 iommu/arm-smmu: Return IOVA in iova_to_phys when SMMU is bypassed For software initiated address translation, when domain type is IOMMU_DOMAIN_IDENTITY i.e SMMU is bypassed, mimic HW behavior i.e return the same IOVA as translated address. This patch is an extension to Will Deacon's patchset "Implement SMMU passthrough using the default domain". Signed-off-by: Sunil Goutham Acked-by: Will Deacon Signed-off-by: Joerg Roedel drivers/iommu/arm-smmu-v3.c | 3 +++ drivers/iommu/arm-smmu.c | 3 +++ 2 files changed, 6 insertions(+) commit d2718d1365f7fce624fd7ed163f60532f92ed016 Author: Gregory CLEMENT Date: Wed Apr 5 17:18:03 2017 +0200 arm64: marvell: enable the Armada 37xx pinctrl driver This commit makes sure the driver for the Armada 37xx pin controller is enabled. Signed-off-by: Gregory CLEMENT arch/arm64/Kconfig.platforms | 5 +++++ 1 file changed, 5 insertions(+) commit ca169cc2f9e1f8ed9c867b197a49d6dd05e5436d Author: Kailang Yang Date: Tue Apr 25 16:17:40 2017 +0800 ALSA: hda/realtek - Add Dual Codecs support for Lenovo P520/420 Lenovo P520/420 build with two codecs. ALC233 for front panel. ALC662 for rear panel. This patch will rename capture name for slove conflicts. And create a card longname for UCM profile. Signed-off-by: Kailang Yang Signed-off-by: Takashi Iwai sound/pci/hda/patch_realtek.c | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) commit c92a90a5060a84e4a180af6b60aa0fb3a5e46c64 Merge: 6d80594 11ce4b3 Author: Russell King Date: Wed Apr 26 10:59:49 2017 +0100 Merge branches 'fixes' and 'misc' into for-next commit 11ce4b33aedc65198d7bc9669344ebca5ee36a41 Author: Grygorii Strashko Date: Tue Apr 25 21:20:52 2017 +0100 ARM: 8672/1: mm: remove tasklist locking from update_sections_early() The below backtrace can be observed on -rt kernel with CONFIG_DEBUG_MODULE_RONX (4.9 kernel CONFIG_DEBUG_RODATA) option enabled: BUG: sleeping function called from invalid context at kernel/locking/rtmutex.c:993 in_atomic(): 1, irqs_disabled(): 128, pid: 14, name: migration/0 1 lock held by migration/0/14: #0: (tasklist_lock){+.+...}, at: [] update_sections_early+0x24/0xdc irq event stamp: 38 hardirqs last enabled at (37): [] _raw_spin_unlock_irq+0x24/0x68 hardirqs last disabled at (38): [] multi_cpu_stop+0xd8/0x138 softirqs last enabled at (0): [] copy_process.part.5+0x238/0x1b64 softirqs last disabled at (0): [< (null)>] (null) Preemption disabled at: [] cpu_stopper_thread+0x80/0x10c CPU: 0 PID: 14 Comm: migration/0 Not tainted 4.9.21-rt16-02220-g49e319c #15 Hardware name: Generic DRA74X (Flattened Device Tree) [] (unwind_backtrace) from [] (show_stack+0x10/0x14) [] (show_stack) from [] (dump_stack+0xa8/0xd4) [] (dump_stack) from [] (___might_sleep+0x1bc/0x2ac) [] (___might_sleep) from [] (__rt_spin_lock+0x1c/0x30) [] (__rt_spin_lock) from [] (rt_read_lock+0x54/0x68) [] (rt_read_lock) from [] (update_sections_early+0x24/0xdc) [] (update_sections_early) from [] (__fix_kernmem_perms+0x10/0x1c) [] (__fix_kernmem_perms) from [] (multi_cpu_stop+0x100/0x138) [] (multi_cpu_stop) from [] (cpu_stopper_thread+0x88/0x10c) [] (cpu_stopper_thread) from [] (smpboot_thread_fn+0x174/0x31c) [] (smpboot_thread_fn) from [] (kthread+0xf0/0x108) [] (kthread) from [] (ret_from_fork+0x14/0x3c) Freeing unused kernel memory: 1024K (c0d00000 - c0e00000) The stop_machine() is called with cpus = NULL from fix_kernmem_perms() and mark_rodata_ro() which means only one CPU will execute update_sections_early() while all other CPUs will spin and wait. Hence, it's safe to remove tasklist locking from update_sections_early(). As part of this change also mark functions which are local to this module as static. Signed-off-by: Grygorii Strashko Acked-by: Laura Abbott Acked-by: Kees Cook Signed-off-by: Russell King arch/arm/mm/init.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) commit b70cd406d7fe9976962d621d8c60d324eb47d284 Author: Vladimir Murzin Date: Mon Apr 24 10:41:53 2017 +0100 ARM: 8671/1: V7M: Preserve registers across switch from Thread to Handler mode According to ARMv7 ARM, when exception is taken content of r0-r3, r12 is unknown (see ExceptionTaken() pseudocode). Even though existent implementations keep these register unchanged, preserve them to be in line with architecture. Reported-by: Dobromir Stefanov Signed-off-by: Vladimir Murzin Signed-off-by: Russell King arch/arm/mm/proc-v7m.S | 2 ++ 1 file changed, 2 insertions(+) commit 6d80594936914e798b1b54b3bfe4bd68d8418966 Author: Vladimir Murzin Date: Mon Apr 24 10:40:48 2017 +0100 ARM: 8670/1: V7M: Do not corrupt vector table around v7m_invalidate_l1 call We save/restore registers around v7m_invalidate_l1 to address pointed by r12, which is vector table, so the first eight entries are overwritten with a garbage. We already have stack setup at that stage, so use it to save/restore register. Fixes: 6a8146f420be ("ARM: 8609/1: V7M: Add support for the Cortex-M7 processor") Cc: Signed-off-by: Vladimir Murzin Signed-off-by: Russell King arch/arm/mm/proc-v7m.S | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit f563dab41733c0e73202a8a5977b441715dc9946 Author: Greg Kroah-Hartman Date: Wed Apr 26 11:43:39 2017 +0200 goldfish_pipe: fix build warning about using too much stack. The new goldfish_pipe code used too much stack space in the transfer_max_buffers() call. As the function is serialized with a lock, let's make the buffer static to not use the stack for the large buffer. Reported-by: kbuild test robot Cc: Yurii Zubrytskyi Cc: Jin Qian Signed-off-by: Greg Kroah-Hartman drivers/platform/goldfish/goldfish_pipe.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 726ea1a8ea96b2bba34ee2073b58f0770800701c Author: Jin Qian Date: Thu Apr 20 16:05:11 2017 +0200 goldfish_pipe: An implementation of more parallel pipe This is a driver code for a redesigned android pipe. Currently it works for x86 and x64 emulators with the following performance results: ADB push to /dev/null, Ubuntu, 400 MB file, times are for (1 / 10 / 100) parallel adb commands x86 adb push: (4.4s / 11.5s / 2m10s) -> (2.8s / 6s / 51s) x64 adb push: (7s / 15s / (too long, 6m+) -> (2.7s / 6.2s / 52s) ADB pull and push to /data/ have the same %% of speedup More importantly, I don't see any signs of slowdowns when run in parallel with Antutu benchmark, so it is definitely making much better job at multithreading. Signed-off-by: Yurii Zubrytskyi Signed-off-by: Jin Qian Signed-off-by: Greg Kroah-Hartman drivers/platform/goldfish/goldfish_pipe.c | 970 ++++++++++++++++++++---------- 1 file changed, 641 insertions(+), 329 deletions(-) commit dd17cc7bf8b9447f5612c3887b84a88eeb5e3dff Author: Matthew Gerlach Date: Mon Apr 24 16:34:22 2017 -0500 fpga fr br: update supported version numbers The value in the version register of the altera freeze bridge controller changed from the beta value of 2 to the value of 0xad000003 in the official release of the IP. This patch supports the old and new version numbers, and the driver's probe function will fail if neither of the supported versions is found. Signed-off-by: Matthew Gerlach Reviewed-by: Moritz Fischer Signed-off-by: Alan Tull Signed-off-by: Greg Kroah-Hartman drivers/fpga/altera-freeze-bridge.c | 30 +++++++++++++++++++----------- 1 file changed, 19 insertions(+), 11 deletions(-) commit e73bbf64907c88d3bb811756fc25548131524035 Author: Tobias Klauser Date: Mon Apr 24 16:34:21 2017 -0500 fpga: region: release FPGA region reference in error path If fpga_region_get_manager() fails in fpga_region_program_fpga(), a reference to the fpga_manager instance previously acquired through fpga_region_get() is retained. Make sure to properly release it in the error case by using a separate jump label which will call fpga_region_put() in before returning. Signed-off-by: Tobias Klauser Acked-by: Moritz Fischer Signed-off-by: Alan Tull Signed-off-by: Greg Kroah-Hartman drivers/fpga/fpga-region.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit d721f9bbe6a7d9543f560053f8be5237e7db18e9 Author: Tobias Klauser Date: Mon Apr 24 16:34:20 2017 -0500 fpga altera-hps2fpga: disable/unprepare clock on error in alt_fpga_bridge_probe() If either _alt_hps2fpga_enable_set() or fpga_bridge_register() fail in alt_fpga_bridge_probe(), the clock remains enabled and prepared. Also, in the error path for _alt_hps2fpga_enable_set() a call to fpga_bridge_unregister() is made even though the bridge was not registered yet. Remove the unnecessary call to fpga_bridge_unregister() and call clk_disable_unprepare() in both error paths in order to make sure the clock gets properly disabled and unprepared. Signed-off-by: Tobias Klauser Acked-by: Moritz Fischer Signed-off-by: Alan Tull Signed-off-by: Greg Kroah-Hartman drivers/fpga/altera-hps2fpga.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) commit 139752a210544dd02bac5c21322751de300ece93 Author: Tomas Winkler Date: Thu Apr 20 09:49:03 2017 +0300 mei: drop the TODO from samples The TODO file is not relevant anymore and it's just a leftover from the time the driver was in the staging tree. Signed-off-by: Tomas Winkler Reviewed-by: Alexander Usyskin Signed-off-by: Greg Kroah-Hartman samples/mei/TODO | 2 -- 1 file changed, 2 deletions(-) commit 9f41ebfb7e395650f001c2f711833ef1a37ac0d4 Author: Arnd Bergmann Date: Tue Apr 25 22:04:53 2017 +0200 usb: musb: don't mark of_dev_auxdata as initdata The probe function is not __init since it can be called for deferred probing or when unbinding/rebinding the device, and therefore it must not reference objects in __initdata, as pointed out by this link time warning: WARNING: drivers/usb/musb/da8xx.o(.text+0x9d4): Section mismatch in reference from the function da8xx_probe() to the (unknown reference) .init.data:(unknown) This removes the annotation. Reported-by: Olof's autobuilder Fixes: d6299b6efbf6 ("usb: musb: Add support of CPPI 4.1 DMA controller to DA8xx") Signed-off-by: Arnd Bergmann Signed-off-by: Greg Kroah-Hartman drivers/usb/musb/da8xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 942a48730faf149ccbf3e12ac718aee120bb3529 Author: Maksim Salau Date: Tue Apr 25 22:49:21 2017 +0300 usb: misc: legousbtower: Fix buffers on stack Allocate buffers on HEAP instead of STACK for local structures that are to be received using usb_control_msg(). Signed-off-by: Maksim Salau Tested-by: Alfredo Rafael Vicente Boix ; Cc: stable Signed-off-by: Greg Kroah-Hartman drivers/usb/misc/legousbtower.c | 37 +++++++++++++++++++++++++++---------- 1 file changed, 27 insertions(+), 10 deletions(-) commit f8a77153b0cb6eef34f16670df678dae49ce3776 Merge: ab6eb21 c821ee6 Author: Jani Nikula Date: Wed Apr 26 12:19:55 2017 +0300 Merge tag 'gvt-next-fixes-2017-04-20' of https://github.com/01org/gvt-linux into drm-intel-next-fixes gvt-next-fixes-2017-04-20 - some code optimization from Changbin - debug message cleanup after QoS merge - misc fixes for display mmio init, reset vgpu warning, etc. Signed-off-by: Jani Nikula commit 9cc4b7cb86cbcc6330a3faa8cd65268cd2d3c227 Author: James Hughes Date: Tue Apr 25 10:15:06 2017 +0100 brcmfmac: Make skb header writable before use The driver was making changes to the skb_header without ensuring it was writable (i.e. uncloned). This patch also removes some boiler plate header size checking/adjustment code as that is also handled by the skb_cow_header function used to make header writable. Signed-off-by: James Hughes Acked-by: Arend van Spriel Signed-off-by: Kalle Valo .../net/wireless/broadcom/brcm80211/brcmfmac/core.c | 19 +++++-------------- 1 file changed, 5 insertions(+), 14 deletions(-) commit 455a1eb4654c24560eb9dfc634f29cba3d87601e Author: James Hughes Date: Mon Apr 24 12:40:50 2017 +0100 brcmfmac: Ensure pointer correctly set if skb data location changes The incoming skb header may be resized if header space is insufficient, which might change the data adddress in the skb. Ensure that a cached pointer to that data is correctly set by moving assignment to after any possible changes. Signed-off-by: James Hughes Acked-by: Arend van Spriel Signed-off-by: Kalle Valo drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 9dc7efd3978aa67ae598129d2a3f240b390ce508 Author: Pan Bian Date: Mon Apr 24 08:40:28 2017 +0800 rndis_wlan: add return value validation Function create_singlethread_workqueue() will return a NULL pointer if there is no enough memory, and its return value should be validated before using. However, in function rndis_wlan_bind(), its return value is not checked. This may cause NULL dereference bugs. This patch fixes it. Signed-off-by: Pan Bian Signed-off-by: Kalle Valo drivers/net/wireless/rndis_wlan.c | 4 ++++ 1 file changed, 4 insertions(+) commit dc3f89c38a8406554ffeffa370aad086a9c5e9de Author: Pan Bian Date: Sun Apr 23 21:19:38 2017 +0800 libertas: check return value of alloc_workqueue Function alloc_workqueue() will return a NULL pointer if there is no enough memory, and its return value should be validated before using. However, in function if_spi_probe(), its return value is not checked. This may result in a NULL dereference bug. This patch fixes the bug. Signed-off-by: Pan Bian Signed-off-by: Kalle Valo drivers/net/wireless/marvell/libertas/if_spi.c | 5 +++++ 1 file changed, 5 insertions(+) commit 5fb01e91daf84ad1e50edfcf63116ecbe31e7ba7 Author: Pan Bian Date: Sun Apr 23 15:00:23 2017 +0800 mt7601u: check return value of alloc_skb Function alloc_skb() will return a NULL pointer if there is no enough memory. However, in function mt7601u_mcu_msg_alloc(), its return value is not validated before it is used. This patch fixes it. Signed-off-by: Pan Bian Acked-by: Jakub Kicinski Signed-off-by: Kalle Valo drivers/net/wireless/mediatek/mt7601u/mcu.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) commit 2f6ae79cb04bb7f9b4be3f1c32b6fda35bf976bc Author: Maksim Salau Date: Sat Apr 22 20:03:06 2017 +0300 orinoco_usb: Fix buffer on stack Allocate buffer on HEAP instead of STACK for a local variable that is to be sent using usb_control_msg(). Signed-off-by: Maksim Salau Signed-off-by: Kalle Valo drivers/net/wireless/intersil/orinoco/orinoco_usb.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) commit bea35f90dbb13c08389993847019b44047862952 Author: Colin Ian King Date: Sat Apr 22 14:21:49 2017 +0100 orinoco: fix spelling mistake: "Registerred" -> "Registered" trivial fix to spelling mistake in dbg_dbg message Signed-off-by: Colin Ian King Signed-off-by: Kalle Valo drivers/net/wireless/intersil/orinoco/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 46cfa2148e7371c537efff1a1c693e58f523089d Author: Larry Finger Date: Sun Apr 16 19:32:07 2017 -0500 rtlwifi: rtl8821ae: setup 8812ae RFE according to device type Current channel switch implementation sets 8812ae RFE reg value assuming that device always has type 2. Extend possible RFE types set and write corresponding reg values. Source for new code is http://dlcdnet.asus.com/pub/ASUS/wireless/PCE-AC51/DR_PCE_AC51_20232801152016.zip Signed-off-by: Maxim Samoylov Signed-off-by: Larry Finger Cc: Stable Cc: Yan-Hsuan Chuang Cc: Pkshih Cc: Birming Chiu Cc: Shaofu Cc: Steven Ting Signed-off-by: Kalle Valo .../net/wireless/realtek/rtlwifi/rtl8821ae/phy.c | 122 ++++++++++++++++++--- .../net/wireless/realtek/rtlwifi/rtl8821ae/reg.h | 1 + 2 files changed, 107 insertions(+), 16 deletions(-) commit d529a4ad91efcf68b65440c6555895fd7ad5a08e Author: Vasilis Liaskovitis Date: Tue Apr 25 10:26:44 2017 +0200 HID: usbhid: Add HID_QUIRK_NOGET for Aten CS-1758 KVM switch Like other switches, the Aten CS-1758 KVM switch needs a quirk to avoid spewing errors: [12599018.071059] usb 5-2: input irq status -75 received [12599018.079053] usb 5-2: input irq status -75 received Signed-off-by: Vasilis Liaskovitis Signed-off-by: Jiri Kosina drivers/hid/hid-ids.h | 1 + drivers/hid/usbhid/hid-quirks.c | 1 + 2 files changed, 2 insertions(+) commit dbd68d8e84c606673ebbcf15862f8c155fa92326 Author: Andy Lutomirski Date: Sat Apr 22 00:01:22 2017 -0700 x86/mm: Fix flush_tlb_page() on Xen flush_tlb_page() passes a bogus range to flush_tlb_others() and expects the latter to fix it up. native_flush_tlb_others() has the fixup but Xen's version doesn't. Move the fixup to flush_tlb_others(). AFAICS the only real effect is that, without this fix, Xen would flush everything instead of just the one page on remote vCPUs in when flush_tlb_page() was called. Signed-off-by: Andy Lutomirski Reviewed-by: Boris Ostrovsky Cc: Andrew Morton Cc: Borislav Petkov Cc: Brian Gerst Cc: Dave Hansen Cc: Denys Vlasenko Cc: H. Peter Anvin Cc: Josh Poimboeuf Cc: Juergen Gross Cc: Konrad Rzeszutek Wilk Cc: Linus Torvalds Cc: Michal Hocko Cc: Nadav Amit Cc: Peter Zijlstra Cc: Rik van Riel Cc: Thomas Gleixner Fixes: e7b52ffd45a6 ("x86/flush_tlb: try flush_tlb_single one by one in flush_tlb_range") Link: http://lkml.kernel.org/r/10ed0e4dfea64daef10b87fb85df1746999b4dba.1492844372.git.luto@kernel.org Signed-off-by: Ingo Molnar arch/x86/mm/tlb.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit ce27374fabf553153c3f53efcaa9bfab9216bd8c Author: Andy Lutomirski Date: Sat Apr 22 00:01:21 2017 -0700 x86/mm: Make flush_tlb_mm_range() more predictable I'm about to rewrite the function almost completely, but first I want to get a functional change out of the way. Currently, if flush_tlb_mm_range() does not flush the local TLB at all, it will never do individual page flushes on remote CPUs. This seems to be an accident, and preserving it will be awkward. Let's change it first so that any regressions in the rewrite will be easier to bisect and so that the rewrite can attempt to change no visible behavior at all. The fix is simple: we can simply avoid short-circuiting the calculation of base_pages_to_flush. As a side effect, this also eliminates a potential corner case: if tlb_single_page_flush_ceiling == TLB_FLUSH_ALL, flush_tlb_mm_range() could have ended up flushing the entire address space one page at a time. Signed-off-by: Andy Lutomirski Acked-by: Dave Hansen Cc: Andrew Morton Cc: Borislav Petkov Cc: Brian Gerst Cc: Denys Vlasenko Cc: H. Peter Anvin Cc: Josh Poimboeuf Cc: Linus Torvalds Cc: Michal Hocko Cc: Nadav Amit Cc: Peter Zijlstra Cc: Rik van Riel Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/4b29b771d9975aad7154c314534fec235618175a.1492844372.git.luto@kernel.org Signed-off-by: Ingo Molnar arch/x86/mm/tlb.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) commit 29961b59a51f8c6838a26a45e871a7ed6771809b Author: Andy Lutomirski Date: Sat Apr 22 00:01:20 2017 -0700 x86/mm: Remove flush_tlb() and flush_tlb_current_task() I was trying to figure out what how flush_tlb_current_task() would possibly work correctly if current->mm != current->active_mm, but I realized I could spare myself the effort: it has no callers except the unused flush_tlb() macro. Signed-off-by: Andy Lutomirski Cc: Andrew Morton Cc: Borislav Petkov Cc: Brian Gerst Cc: Dave Hansen Cc: Denys Vlasenko Cc: H. Peter Anvin Cc: Josh Poimboeuf Cc: Linus Torvalds Cc: Michal Hocko Cc: Nadav Amit Cc: Peter Zijlstra Cc: Rik van Riel Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/e52d64c11690f85e9f1d69d7b48cc2269cd2e94b.1492844372.git.luto@kernel.org Signed-off-by: Ingo Molnar arch/x86/include/asm/tlbflush.h | 9 --------- arch/x86/mm/tlb.c | 17 ----------------- 2 files changed, 26 deletions(-) commit 9ccee2373f0658f234727700e619df097ba57023 Author: Andy Lutomirski Date: Sat Apr 22 00:01:19 2017 -0700 x86/vm86/32: Switch to flush_tlb_mm_range() in mark_screen_rdonly() mark_screen_rdonly() is the last remaining caller of flush_tlb(). flush_tlb_mm_range() is potentially faster and isn't obsolete. Compile-tested only because I don't know whether software that uses this mechanism even exists. Signed-off-by: Andy Lutomirski Cc: Andrew Morton Cc: Borislav Petkov Cc: Brian Gerst Cc: Dave Hansen Cc: Denys Vlasenko Cc: H. Peter Anvin Cc: Josh Poimboeuf Cc: Linus Torvalds Cc: Michal Hocko Cc: Nadav Amit Cc: Peter Zijlstra Cc: Rik van Riel Cc: Sasha Levin Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/791a644076fc3577ba7f7b7cafd643cc089baa7d.1492844372.git.luto@kernel.org Signed-off-by: Ingo Molnar arch/x86/kernel/vm86_32.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9a08ecfe74d7796ddc92ec312d3b7eaeba5a7c22 Author: Florian Westphal Date: Thu Apr 20 10:11:35 2017 +0200 netfilter: don't attach a nat extension by default nowadays the NAT extension only stores the interface index (used to purge connections that got masqueraded when interface goes down) and pptp nat information. Previous patches moved nf_ct_nat_ext_add to those places that need it. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso include/net/netfilter/nf_nat.h | 2 +- net/ipv4/netfilter/nf_nat_l3proto_ipv4.c | 4 +--- net/ipv6/netfilter/nf_nat_l3proto_ipv6.c | 4 +--- net/netfilter/nf_nat_core.c | 6 ------ 4 files changed, 3 insertions(+), 13 deletions(-) commit 2fe7c321ab54d391dffb98911f5fb5cd315d6526 Author: Florian Westphal Date: Thu Apr 20 10:11:34 2017 +0200 netfilter: pptp: attach nat extension when needed make sure nat extension gets added if the master conntrack is subject to NAT. This will be required once the nat core stops adding it by default. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/ipv4/netfilter/nf_nat_pptp.c | 25 +++++++++++++++++++++---- net/netfilter/nf_conntrack_pptp.c | 12 ++++++++++-- 2 files changed, 31 insertions(+), 6 deletions(-) commit ff459018d7cb13e43ee2f857949c26b235ccd9a5 Author: Florian Westphal Date: Thu Apr 20 10:11:33 2017 +0200 netfilter: masquerade: attach nat extension if not present Currently the nat extension is always attached as soon as nat module is loaded. However, most NAT uses do not need the nat extension anymore. Prepare to remove the add-nat-by-default by making those places that need it attach it if its not present yet. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/ipv4/netfilter/nf_nat_masquerade_ipv4.c | 5 +++-- net/ipv6/netfilter/nf_nat_masquerade_ipv6.c | 5 ++++- 2 files changed, 7 insertions(+), 3 deletions(-) commit 22d4536d2c836f74421d01d534b3117223a822a0 Author: Florian Westphal Date: Thu Apr 20 09:54:24 2017 +0200 netfilter: conntrack: handle initial extension alloc via krealloc krealloc(NULL, ..) is same as kmalloc(), so we can avoid special-casing the initial allocation after the prealloc removal (we had to use ->alloc_len as the initial allocation size). This also means we do not zero the preallocated memory anymore; only offsets[]. Existing code makes sure the new (used) extension space gets zeroed out. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_conntrack_extend.c | 51 +++++++++++-------------------------- 1 file changed, 15 insertions(+), 36 deletions(-) commit 23f671a1b56a4493075ab7263c78c526ac12a592 Author: Florian Westphal Date: Thu Apr 20 09:54:23 2017 +0200 netfilter: conntrack: mark extension structs as const Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso include/net/netfilter/nf_conntrack_extend.h | 4 ++-- net/netfilter/nf_conntrack_acct.c | 2 +- net/netfilter/nf_conntrack_ecache.c | 2 +- net/netfilter/nf_conntrack_extend.c | 4 ++-- net/netfilter/nf_conntrack_helper.c | 2 +- net/netfilter/nf_conntrack_labels.c | 2 +- net/netfilter/nf_conntrack_seqadj.c | 2 +- net/netfilter/nf_conntrack_timeout.c | 2 +- net/netfilter/nf_conntrack_timestamp.c | 2 +- 9 files changed, 11 insertions(+), 11 deletions(-) commit 54044b1f0204da158a6a395bd02b63bb02ffff98 Author: Florian Westphal Date: Thu Apr 20 09:54:22 2017 +0200 netfilter: conntrack: remove prealloc support It was used by the nat extension, but since commit 7c9664351980 ("netfilter: move nat hlist_head to nf_conn") its only needed for connections that use MASQUERADE target or a nat helper. Also it seems a lot easier to preallocate a fixed size instead. With default settings, conntrack first adds ecache extension (sysctl defaults to 1), so we get 40(ct extension header) + 24 (ecache) == 64 byte on x86_64 for initial allocation. Followup patches can constify the extension structs and avoid the initial zeroing of the entire extension area. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso include/net/netfilter/nf_conntrack_extend.h | 6 ---- net/netfilter/nf_conntrack_extend.c | 49 +++-------------------------- net/netfilter/nf_nat_core.c | 1 - 3 files changed, 4 insertions(+), 52 deletions(-) commit 495dcb56d09ddb63afe30e799af41876c3f061cc Author: Gao Feng Date: Thu Apr 20 14:01:45 2017 +0800 netfilter: SYNPROXY: Return NF_STOLEN instead of NF_DROP during handshaking Current SYNPROXY codes return NF_DROP during normal TCP handshaking, it is not friendly to caller. Because the nf_hook_slow would treat the NF_DROP as an error, and return -EPERM. As a result, it may cause the top caller think it meets one error. For example, the following codes are from cfv_rx_poll() err = netif_receive_skb(skb); if (unlikely(err)) { ++cfv->ndev->stats.rx_dropped; } else { ++cfv->ndev->stats.rx_packets; cfv->ndev->stats.rx_bytes += skb_len; } When SYNPROXY returns NF_DROP, then netif_receive_skb returns -EPERM. As a result, the cfv driver would treat it as an error, and increase the rx_dropped counter. So use NF_STOLEN instead of NF_DROP now because there is no error happened indeed, and free the skb directly. Signed-off-by: Gao Feng Signed-off-by: Pablo Neira Ayuso net/ipv4/netfilter/ipt_SYNPROXY.c | 21 ++++++++++++++------- net/ipv6/netfilter/ip6t_SYNPROXY.c | 20 ++++++++++++++------ 2 files changed, 28 insertions(+), 13 deletions(-) commit aee12a0a3727e16fb837367c4755cb6daaf45109 Author: Florian Westphal Date: Thu Apr 20 00:45:48 2017 +0200 ebtables: remove nf_hook_register usage Similar to ip_register_table, pass nf_hook_ops to ebt_register_table(). This allows to handle hook registration also via pernet_ops and allows us to avoid use of legacy register_hook api. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso include/linux/netfilter_bridge/ebtables.h | 6 ++- net/bridge/netfilter/ebtable_broute.c | 4 +- net/bridge/netfilter/ebtable_filter.c | 15 ++------ net/bridge/netfilter/ebtable_nat.c | 15 ++------ net/bridge/netfilter/ebtables.c | 61 +++++++++++++++++++------------ 5 files changed, 50 insertions(+), 51 deletions(-) commit 1a0ed0ad4812a59a19f3bdb237601389214d1ed1 Author: Florian Westphal Date: Thu Apr 20 00:42:07 2017 +0200 netfilter: decnet: only register hooks in init namespace looks like decnet isn't namespacified in first place, so restrict hook registration to the initial namespace. Prepares for eventual removal of legacy nf_register_hook() api. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/decnet/netfilter/dn_rtmsg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit efe41606184ef33efde1d708eaf7d0fad9e06694 Author: Florian Westphal Date: Wed Apr 19 18:25:22 2017 +0200 ipvs: convert to use pernet nf_hook api nf_(un)register_hooks has to maintain an internal hook list to add/remove those hooks from net namespaces as they are added/deleted. ipvs already uses pernet_ops, so we can switch to the (more recent) pernet hook api instead. Compile tested only. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/netfilter/ipvs/ip_vs_core.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) commit 1fefe14725c7cc7c720f9f8af2bc3bef13fd7d39 Author: Florian Westphal Date: Wed Apr 19 18:14:04 2017 +0200 netfilter: synproxy: only register hooks when needed Defer registration of the synproxy hooks until the first SYNPROXY rule is added. Also means we only register hooks in namespaces that need it. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso include/net/netfilter/nf_conntrack_synproxy.h | 2 + net/ipv4/netfilter/ipt_SYNPROXY.c | 73 ++++++++++++++------------- net/ipv6/netfilter/ip6t_SYNPROXY.c | 73 ++++++++++++++------------- 3 files changed, 80 insertions(+), 68 deletions(-) commit e6ab9c4d437764c7fb728d428dc9e717cdb183d0 Author: Kirill A. Shutemov Date: Tue Apr 25 12:25:57 2017 +0300 x86/mm/64: Fix crash in remove_pagetable() remove_pagetable() does page walk using p*d_page_vaddr() plus cast. It's not canonical approach -- we usually use p*d_offset() for that. It works fine as long as all page table levels are present. We broke the invariant by introducing folded p4d page table level. As result, remove_pagetable() interprets PMD as PUD and it leads to crash: BUG: unable to handle kernel paging request at ffff880300000000 IP: memchr_inv+0x60/0x110 PGD 317d067 P4D 317d067 PUD 3180067 PMD 33f102067 PTE 8000000300000060 Let's fix this by using p*d_offset() instead of p*d_page_vaddr() for page walk. Reported-by: Dan Williams Tested-by: Dan Williams Signed-off-by: Kirill A. Shutemov Cc: Andy Lutomirski Cc: Dave Hansen Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-mm@kvack.org Fixes: f2a6a7050109 ("x86: Convert the rest of the code to support p4d_t") Link: http://lkml.kernel.org/r/20170425092557.21852-1-kirill.shutemov@linux.intel.com Signed-off-by: Ingo Molnar arch/x86/mm/init_64.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 35fa70dfd6e6f270d7aabb3470855208b11ac9fb Author: Dan Carpenter Date: Thu Apr 20 13:26:18 2017 +0300 iio: adc: Max9611: checking for ERR_PTR instead of NULL in probe devm_iio_device_alloc() doesn't return ERR_PTRs, it returns NULLs. Fixes: 69780a3bbc0b ("iio: adc: Add Maxim max9611 ADC driver") Signed-off-by: Dan Carpenter Signed-off-by: Jonathan Cameron drivers/iio/adc/max9611.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 262fa734a0023a43391f9bd4a4099487b8393f35 Author: Josh Poimboeuf Date: Tue Apr 25 20:48:52 2017 -0500 x86/unwind: Dump all stacks in unwind_dump() Currently unwind_dump() dumps only the most recently accessed stack. But it has a few issues. In some cases, 'first_sp' can get out of sync with 'stack_info', causing unwind_dump() to start from the wrong address, flood the printk buffer, and eventually read a bad address. In other cases, dumping only the most recently accessed stack doesn't give enough data to diagnose the error. Fix both issues by dumping *all* stacks involved in the trace, not just the last one. Signed-off-by: Josh Poimboeuf Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Brian Gerst Cc: Denys Vlasenko Cc: H. Peter Anvin Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Fixes: 8b5e99f02264 ("x86/unwind: Dump stack data on warnings") Link: http://lkml.kernel.org/r/016d6a9810d7d1bfc87ef8c0e6ee041c6744c909.1493171120.git.jpoimboe@redhat.com Signed-off-by: Ingo Molnar arch/x86/kernel/unwind_frame.c | 34 +++++++++++++++++++++------------- 1 file changed, 21 insertions(+), 13 deletions(-) commit b0d50c7b5d807ce6f7ba58e42b260e92bd7d88fb Author: Josh Poimboeuf Date: Tue Apr 25 20:48:51 2017 -0500 x86/unwind: Silence more entry-code related warnings Borislav Petkov reported the following unwinder warning: WARNING: kernel stack regs at ffffc9000024fea8 in udevadm:92 has bad 'bp' value 00007fffc4614d30 unwind stack type:0 next_sp: (null) mask:0x6 graph_idx:0 ffffc9000024fea8: 000055a6100e9b38 (0x55a6100e9b38) ffffc9000024feb0: 000055a6100e9b35 (0x55a6100e9b35) ffffc9000024feb8: 000055a6100e9f68 (0x55a6100e9f68) ffffc9000024fec0: 000055a6100e9f50 (0x55a6100e9f50) ffffc9000024fec8: 00007fffc4614d30 (0x7fffc4614d30) ffffc9000024fed0: 000055a6100eaf50 (0x55a6100eaf50) ffffc9000024fed8: 0000000000000000 ... ffffc9000024fee0: 0000000000000100 (0x100) ffffc9000024fee8: ffff8801187df488 (0xffff8801187df488) ffffc9000024fef0: 00007ffffffff000 (0x7ffffffff000) ffffc9000024fef8: 0000000000000000 ... ffffc9000024ff10: ffffc9000024fe98 (0xffffc9000024fe98) ffffc9000024ff18: 00007fffc4614d00 (0x7fffc4614d00) ffffc9000024ff20: ffffffffffffff10 (0xffffffffffffff10) ffffc9000024ff28: ffffffff811c6c1f (SyS_newlstat+0xf/0x10) ffffc9000024ff30: 0000000000000010 (0x10) ffffc9000024ff38: 0000000000000296 (0x296) ffffc9000024ff40: ffffc9000024ff50 (0xffffc9000024ff50) ffffc9000024ff48: 0000000000000018 (0x18) ffffc9000024ff50: ffffffff816b2e6a (entry_SYSCALL_64_fastpath+0x18/0xa8) ... It unwinded from an interrupt which came in right after entry code called into a C syscall handler, before it had a chance to set up the frame pointer, so regs->bp still had its user space value. Add a check to silence warnings in such a case, where an interrupt has occurred and regs->sp is almost at the end of the stack. Reported-by: Borislav Petkov Tested-by: Borislav Petkov Signed-off-by: Josh Poimboeuf Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Brian Gerst Cc: Denys Vlasenko Cc: H. Peter Anvin Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Fixes: c32c47c68a0a ("x86/unwind: Warn on bad frame pointer") Link: http://lkml.kernel.org/r/c695f0d0d4c2cfe6542b90e2d0520e11eb901eb5.1493171120.git.jpoimboe@redhat.com Signed-off-by: Ingo Molnar arch/x86/kernel/unwind_frame.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) commit 6272c0de13abf1480f701d38288f28a11b4301c4 Author: Matt Ranostay Date: Fri Apr 14 16:38:19 2017 -0700 iio: proximity: as3935: recalibrate RCO after resume According to the datasheet the RCO must be recalibrated on every power-on-reset. Also remove mutex locking in the calibration function since callers other than the probe function (which doesn't need it) will have a lock. Fixes: 24ddb0e4bba4 ("iio: Add AS3935 lightning sensor support") Cc: George McCollister Signed-off-by: Matt Ranostay Signed-off-by: Jonathan Cameron drivers/iio/proximity/as3935.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 83c4919058459c32138a1ebe35f72b7013a9ddbc Author: Michael Ellerman Date: Wed Apr 26 15:57:19 2017 +1000 powerpc/powernv: Fix missing attr initialisation in opal_export_attrs() In opal_export_attrs() we dynamically allocate some bin_attributes. They're allocated with kmalloc() and although we initialise most of the fields, we don't initialise write() or mmap(), and in particular we don't initialise the lockdep related fields in the embedded struct attribute. This leads to a lockdep warning at boot: BUG: key c0000000f11906d8 not in .data! WARNING: CPU: 0 PID: 1 at ../kernel/locking/lockdep.c:3136 lockdep_init_map+0x28c/0x2a0 ... Call Trace: lockdep_init_map+0x288/0x2a0 (unreliable) __kernfs_create_file+0x8c/0x170 sysfs_add_file_mode_ns+0xc8/0x240 __machine_initcall_powernv_opal_init+0x60c/0x684 do_one_initcall+0x60/0x1c0 kernel_init_freeable+0x2f4/0x3d4 kernel_init+0x24/0x160 ret_from_kernel_thread+0x5c/0xb0 Fix it by kzalloc'ing the attr, which fixes the uninitialised write() and mmap(), and calling sysfs_bin_attr_init() on it to initialise the lockdep fields. Fixes: 11fe909d2362 ("powerpc/powernv: Add OPAL exports attributes to sysfs") Signed-off-by: Michael Ellerman arch/powerpc/platforms/powernv/opal.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit b409946b2a3c1ddcde75e5f35a77e03f4d354be0 Author: Michael Ellerman Date: Tue Apr 25 20:49:24 2017 +1000 powerpc/mm: Fix possible out-of-bounds shift in arch_mmap_rnd() The recent patch to add runtime configuration of the ASLR limits added a bug in arch_mmap_rnd() where we may shift an integer (32-bits) by up to 33 bits, leading to undefined behaviour. In practice it exhibits as every process seg faulting instantly, presumably because the rnd value hasn't been restricited by the modulus at all. We didn't notice because it only happens under certain kernel configurations and if the number of bits is actually set to a large value. Fix it by switching to unsigned long. Fixes: 9fea59bd7ca5 ("powerpc/mm: Add support for runtime configuration of ASLR limits") Reported-by: Balbir Singh Reviewed-by: Kees Cook Signed-off-by: Michael Ellerman arch/powerpc/mm/mmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fdb980fb17c6a474614dd984b500418a2811d9e7 Author: Andy Shevchenko Date: Tue Apr 25 22:36:38 2017 +0300 dmaengine: virt-dma: Convert to use list_for_each_entry_safe() Use list_for_each_entry_safe() instead of open coding variants. Signed-off-by: Andy Shevchenko Signed-off-by: Vinod Koul drivers/dma/virt-dma.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) commit 8bf8f2e8c786f37991bd27332c75edcc524d2232 Author: Nicholas Piggin Date: Wed Apr 19 05:12:16 2017 +1000 powerpc/64s: Revert setting of LPCR[LPES] on POWER9 The XIVE enablement patches included a change to set the LPES (Logical Partitioning Environment Selector) bit (bit # 3) in LPCR (Logical Partitioning Control Register) on POWER9 hosts. This bit sets external interrupts to guest delivery mode, which uses SRR0/1. The host's EE interrupt handler is written to expect HSRR0/1 (for earlier CPUs). This should be fine because XIVE is configured not to deliver EEs to the host (Hypervisor Virtulization Interrupt is used instead) so the EE handler should never be executed. However a bug in interrupt controller code, hardware, or odd configuration of a simulator could result in the host getting an EE incorrectly. Keeping the EE delivery mode matching the host EE handler prevents strange crashes due to using the wrong exception registers. KVM will configure the LPCR to set LPES prior to running a guest so that EEs are delivered to the guest using SRR0/1. Fixes: 08a1e650cc ("powerpc: Fixup LPCR:PECE and HEIC setting on POWER9") Signed-off-by: Nicholas Piggin [mpe: Massage change log to avoid referring to LPES0 which is now renamed LPES] Signed-off-by: Michael Ellerman arch/powerpc/kernel/cpu_setup_power.S | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 35a2442189015bf540197906e745c7b7c100f28c Merge: bb3393d 2be1fce Author: Trond Myklebust Date: Tue Apr 25 18:42:48 2017 -0400 Merge tag 'nfs-rdma-4.12-1' of git://git.linux-nfs.org/projects/anna/nfs-rdma NFS: NFS over RDMA Client Side Changes New Features: - Break RDMA connections after a connection timeout - Support for unloading the underlying device driver Bugfixes and cleanups: - Mark the receive workqueue as "read-mostly" - Silence warnings caused by ENOBUFS - Update a comment in xdr_init_decode_pages() - Remove rpcrdma_buffer->rb_pool. commit e56efe9322c5bec9ad4f301c8102fcd630694b4c Author: Colin Ian King Date: Sat Apr 8 18:09:59 2017 +0100 lockd: remove redundant check on block A null check followed by a return is being performed already, so block is always non-null at the second check on block, hence we can remove this redundant null-check (Detected by PVS-Studio). Also re-work comment to clean up a check-patch warning. Signed-off-by: Colin Ian King Signed-off-by: J. Bruce Fields fs/lockd/svclock.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) commit dadf3e435debb85dfcf28c157012047153a21a97 Author: Chuck Lever Date: Sun Apr 9 13:07:21 2017 -0400 svcrdma: Clean out old XDR encoders Clean up: These have been replaced and are no longer used. Signed-off-by: Chuck Lever Reviewed-by: Sagi Grimberg Signed-off-by: J. Bruce Fields include/linux/sunrpc/svc_rdma.h | 4 -- net/sunrpc/xprtrdma/svc_rdma_marshal.c | 70 ---------------------------------- 2 files changed, 74 deletions(-) commit 2cf32924c68a22783e6f630e1b5345a80aa1a376 Author: Chuck Lever Date: Sun Apr 9 13:07:13 2017 -0400 svcrdma: Remove the req_map cache req_maps are no longer used by the send path and can thus be removed. Signed-off-by: Chuck Lever Reviewed-by: Sagi Grimberg Signed-off-by: J. Bruce Fields include/linux/sunrpc/svc_rdma.h | 34 +------------ net/sunrpc/xprtrdma/svc_rdma_sendto.c | 68 -------------------------- net/sunrpc/xprtrdma/svc_rdma_transport.c | 84 -------------------------------- 3 files changed, 1 insertion(+), 185 deletions(-) commit 68cc4636bbbca89b9fedcf46d8b6bee444fc5e4e Author: Chuck Lever Date: Sun Apr 9 13:07:05 2017 -0400 svcrdma: Remove unused RDMA Write completion handler Clean up. All RDMA Write completions are now handled by svc_rdma_wc_write_ctx. Signed-off-by: Chuck Lever Signed-off-by: J. Bruce Fields include/linux/sunrpc/svc_rdma.h | 1 - net/sunrpc/xprtrdma/svc_rdma_transport.c | 18 ------------------ 2 files changed, 19 deletions(-) commit ded8d19641a605232ab48f5d27f542648beba3cc Author: Chuck Lever Date: Sun Apr 9 13:06:57 2017 -0400 svcrdma: Reduce size of sge array in struct svc_rdma_op_ctxt The sge array in struct svc_rdma_op_ctxt is no longer used for sending RDMA Write WRs. It need only accommodate the construction of Send and Receive WRs. The maximum inline size is the largest payload it needs to handle now. Signed-off-by: Chuck Lever Reviewed-by: Sagi Grimberg Signed-off-by: J. Bruce Fields include/linux/sunrpc/svc_rdma.h | 9 +++++++-- net/sunrpc/xprtrdma/svc_rdma.c | 6 +++--- 2 files changed, 10 insertions(+), 5 deletions(-) commit f5821c76b2c9c2fb98b276c0bf6a101bfe9050a3 Author: Chuck Lever Date: Sun Apr 9 13:06:49 2017 -0400 svcrdma: Clean up RPC-over-RDMA backchannel reply processing Replace C structure-based XDR decoding with pointer arithmetic. Pointer arithmetic is considered more portable. Signed-off-by: Chuck Lever Signed-off-by: J. Bruce Fields include/linux/sunrpc/svc_rdma.h | 2 +- net/sunrpc/xprtrdma/svc_rdma_backchannel.c | 18 ++++++++++++++---- net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 27 +++++++++++++++------------ 3 files changed, 30 insertions(+), 17 deletions(-) commit 4757d90b15d851b9986bfca745eacc176359c13d Author: Chuck Lever Date: Sun Apr 9 13:06:41 2017 -0400 svcrdma: Report Write/Reply chunk overruns Observed at Connectathon 2017. If a client has underestimated the size of a Write or Reply chunk, the Linux server writes as much payload data as it can, then it recognizes there was a problem and closes the connection without sending the transport header. This creates a couple of problems: <> The client never receives indication of the server-side failure, so it continues to retransmit the bad RPC. Forward progress on the transport is blocked. <> The reply payload pages are not moved out of the svc_rqst, thus they can be released by the RPC server before the RDMA Writes have completed. The new rdma_rw-ized helpers return a distinct error code when a Write/Reply chunk overrun occurs, so it's now easy for the caller (svc_rdma_sendto) to recognize this case. Instead of dropping the connection, post an RDMA_ERROR message. The client now sees an RDMA_ERROR and can properly terminate the RPC transaction. As part of the new logic, set up the same delayed release for these payload pages as would have occurred in the normal case. Signed-off-by: Chuck Lever Reviewed-by: Sagi Grimberg Signed-off-by: J. Bruce Fields net/sunrpc/xprtrdma/svc_rdma_sendto.c | 58 +++++++++++++++++++++++++++++++++-- 1 file changed, 56 insertions(+), 2 deletions(-) commit 6b19cc5ca2f78ebc88f5d39ba6a94197bb392fcc Author: Chuck Lever Date: Sun Apr 9 13:06:33 2017 -0400 svcrdma: Clean up RDMA_ERROR path Now that svc_rdma_sendto has been renovated, svc_rdma_send_error can be refactored to reduce code duplication and remove C structure- based XDR encoding. It is also relocated to the source file that contains its only caller. This is a refactoring change only. Signed-off-by: Chuck Lever Reviewed-by: Sagi Grimberg Signed-off-by: J. Bruce Fields include/linux/sunrpc/rpc_rdma.h | 3 ++ include/linux/sunrpc/svc_rdma.h | 5 ---- net/sunrpc/xprtrdma/svc_rdma_marshal.c | 19 ------------ net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 52 ++++++++++++++++++++++++++++++++- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 43 --------------------------- 5 files changed, 54 insertions(+), 68 deletions(-) commit 9a6a180b7867ceceeeab88a6f011bac23174b939 Author: Chuck Lever Date: Sun Apr 9 13:06:25 2017 -0400 svcrdma: Use rdma_rw API in RPC reply path The current svcrdma sendto code path posts one RDMA Write WR at a time. Each of these Writes typically carries a small number of pages (for instance, up to 30 pages for mlx4 devices). That means a 1MB NFS READ reply requires 9 ib_post_send() calls for the Write WRs, and one for the Send WR carrying the actual RPC Reply message. Instead, use the new rdma_rw API. The details of Write WR chain construction and memory registration are taken care of in the RDMA core. svcrdma can focus on the details of the RPC-over-RDMA protocol. This gives three main benefits: 1. All Write WRs for one RDMA segment are posted in a single chain. As few as one ib_post_send() for each Write chunk. 2. The Write path can now use FRWR to register the Write buffers. If the device's maximum page list depth is large, this means a single Write WR is needed for each RPC's Write chunk data. 3. The new code introduces support for RPCs that carry both a Write list and a Reply chunk. This combination can be used for an NFSv4 READ where the data payload is large, and thus is removed from the Payload Stream, but the Payload Stream is still larger than the inline threshold. Signed-off-by: Chuck Lever Signed-off-by: J. Bruce Fields include/linux/sunrpc/svc_rdma.h | 1 - net/sunrpc/xprtrdma/svc_rdma_backchannel.c | 6 +- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 696 ++++++++++++++--------------- net/sunrpc/xprtrdma/svc_rdma_transport.c | 2 + 4 files changed, 350 insertions(+), 355 deletions(-) commit f13193f50b64e2e0c87706b838d6b9895626a892 Author: Chuck Lever Date: Sun Apr 9 13:06:16 2017 -0400 svcrdma: Introduce local rdma_rw API helpers The plan is to replace the local bespoke code that constructs and posts RDMA Read and Write Work Requests with calls to the rdma_rw API. This shares code with other RDMA-enabled ULPs that manages the gory details of buffer registration and posting Work Requests. Some design notes: o The structure of RPC-over-RDMA transport headers is flexible, allowing multiple segments per Reply with arbitrary alignment, each with a unique R_key. Write and Send WRs continue to be built and posted in separate code paths. However, one whole chunk (with one or more RDMA segments apiece) gets exactly one ib_post_send and one work completion. o svc_xprt reference counting is modified, since a chain of rdma_rw_ctx structs generates one completion, no matter how many Write WRs are posted. o The current code builds the transport header as it is construct- ing Write WRs. I've replaced that with marshaling of transport header data items in a separate step. This is because the exact structure of client-provided segments may not align with the components of the server's reply xdr_buf, or the pages in the page list. Thus parts of each client-provided segment may be written at different points in the send path. Signed-off-by: Chuck Lever Signed-off-by: J. Bruce Fields include/linux/sunrpc/svc_rdma.h | 11 + net/sunrpc/Kconfig | 1 + net/sunrpc/xprtrdma/Makefile | 2 +- net/sunrpc/xprtrdma/svc_rdma_rw.c | 512 +++++++++++++++++++++++++++++++ net/sunrpc/xprtrdma/svc_rdma_transport.c | 4 + 5 files changed, 529 insertions(+), 1 deletion(-) commit c238c4c034f857d12d7efbf9934d96b8bb68fbc7 Author: Chuck Lever Date: Sun Apr 9 13:06:08 2017 -0400 svcrdma: Clean up svc_rdma_get_inv_rkey() Replace C structure-based XDR decoding with more portable code that instead uses pointer arithmetic. This is a refactoring change only. Signed-off-by: Chuck Lever Signed-off-by: J. Bruce Fields net/sunrpc/xprtrdma/svc_rdma_sendto.c | 39 +++++++++++++++-------------------- 1 file changed, 17 insertions(+), 22 deletions(-) commit c55ab0707b2817046ad48d6c87a6b764119a2458 Author: Chuck Lever Date: Sun Apr 9 13:06:00 2017 -0400 svcrdma: Add helper to save pages under I/O Clean up: extract the logic to save pages under I/O into a helper to add a big documenting comment without adding clutter in the send path. This is a refactoring change only. Signed-off-by: Chuck Lever Reviewed-by: Sagi Grimberg Reviewed-by: Christoph Hellwig Signed-off-by: J. Bruce Fields net/sunrpc/xprtrdma/svc_rdma_sendto.c | 31 ++++++++++++++++++------------- 1 file changed, 18 insertions(+), 13 deletions(-) commit b623589dbacbc786c2fffc85113a1dc1a331e2ca Author: Chuck Lever Date: Sun Apr 9 13:05:52 2017 -0400 svcrdma: Eliminate RPCRDMA_SQ_DEPTH_MULT The Send Queue depth is temporarily reduced to 1 SQE per credit. The new rdma_rw API does an internal computation, during QP creation, to increase the depth of the Send Queue to handle RDMA Read and Write operations. This change has to come before the NFSD code paths are updated to use the rdma_rw API. Without this patch, rdma_rw_init_qp() increases the size of the SQ too much, resulting in memory allocation failures during QP creation. Signed-off-by: Chuck Lever Reviewed-by: Christoph Hellwig Signed-off-by: J. Bruce Fields include/linux/sunrpc/svc_rdma.h | 1 - net/sunrpc/xprtrdma/svc_rdma.c | 2 -- net/sunrpc/xprtrdma/svc_rdma_transport.c | 2 +- 3 files changed, 1 insertion(+), 4 deletions(-) commit 6e6092ca305ad785c605d7e313727aad96c228a5 Author: Chuck Lever Date: Sun Apr 9 13:05:44 2017 -0400 svcrdma: Add svc_rdma_map_reply_hdr() Introduce a helper to DMA-map a reply's transport header before sending it. This will in part replace the map vector cache. Signed-off-by: Chuck Lever Reviewed-by: Christoph Hellwig Signed-off-by: J. Bruce Fields include/linux/sunrpc/svc_rdma.h | 3 ++ net/sunrpc/xprtrdma/svc_rdma_backchannel.c | 36 ++++++------------ net/sunrpc/xprtrdma/svc_rdma_sendto.c | 61 +++++++++++++++++++++++------- 3 files changed, 62 insertions(+), 38 deletions(-) commit 17f5f7f506aaca985b95df7ef7fc2ff49c36a8e9 Author: Chuck Lever Date: Sun Apr 9 13:05:36 2017 -0400 svcrdma: Move send_wr to svc_rdma_op_ctxt Clean up: Move the ib_send_wr off the stack, and move common code to post a Send Work Request into a helper. This is a refactoring change only. Signed-off-by: Chuck Lever Signed-off-by: J. Bruce Fields include/linux/sunrpc/svc_rdma.h | 4 ++ net/sunrpc/xprtrdma/svc_rdma_backchannel.c | 11 +---- net/sunrpc/xprtrdma/svc_rdma_sendto.c | 64 ++++++++++++++++++------------ 3 files changed, 44 insertions(+), 35 deletions(-) commit 99bbf6ecc694dfe0b026e15359c5aa2a60b97a93 Author: NeilBrown Date: Wed Mar 15 12:40:44 2017 +1100 NFS: don't try to cross a mountpount when there isn't one there. consider the sequence of commands: mkdir -p /import/nfs /import/bind /import/etc mount --bind / /import/bind mount --make-private /import/bind mount --bind /import/etc /import/bind/etc exportfs -o rw,no_root_squash,crossmnt,async,no_subtree_check localhost:/ mount -o vers=4 localhost:/ /import/nfs ls -l /import/nfs/etc You would not expect this to report a stale file handle. Yet it does. The manipulations under /import/bind cause the dentry for /etc to get the DCACHE_MOUNTED flag set, even though nothing is mounted on /etc. This causes nfsd to call nfsd_cross_mnt() even though there is no mountpoint. So an upcall to mountd for "/etc" is performed. The 'crossmnt' flag on the export of / causes mountd to report that /etc is exported as it is a descendant of /. It assumes the kernel wouldn't ask about something that wasn't a mountpoint. The filehandle returned identifies the filesystem and the inode number of /etc. When this filehandle is presented to rpc.mountd, via "nfsd.fh", the inode cannot be found associated with any name in /etc/exports, or with any mountpoint listed by getmntent(). So rpc.mountd says the filehandle doesn't exist. Hence ESTALE. This is fixed by teaching nfsd not to trust DCACHE_MOUNTED too much. It is just a hint, not a guarantee. Change nfsd_mountpoint() to return '1' for a certain mountpoint, '2' for a possible mountpoint, and 0 otherwise. Then change nfsd_crossmnt() to check if follow_down() actually found a mountpount and, if not, to avoid performing a lookup if the location is not known to certainly require an export-point. Signed-off-by: NeilBrown Signed-off-by: J. Bruce Fields fs/nfsd/vfs.c | 24 ++++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) commit 2f10fdcb6a1c5f26246339d3b606131fae483c44 Author: NeilBrown Date: Thu Mar 23 16:57:36 2017 +0800 nfsd4: remove pointless strdup_if_nonnull kstrdup() already checks for NULL. (Brought to our attention by Jason Yann noticing (from sparse output) that it should have been declared static.) Signed-off-by: NeilBrown Reported-by: Jason Yan Signed-off-by: J. Bruce Fields fs/nfsd/nfs4state.c | 25 ++++++------------------- 1 file changed, 6 insertions(+), 19 deletions(-) commit 16719199a43f0740113041fb34a0854b1d7f2111 Author: Dmitry V. Levin Date: Wed Mar 1 03:12:03 2017 +0300 uapi: fix linux/nfsd/cld.h userspace compilation errors Include and consistently use types it provides to fix the following linux/nfsd/cld.h userspace compilation errors: /usr/include/linux/nfsd/cld.h:40:2: error: unknown type name 'uint16_t' uint16_t cn_len; /* length of cm_id */ /usr/include/linux/nfsd/cld.h:46:2: error: unknown type name 'uint8_t' uint8_t cm_vers; /* upcall version */ /usr/include/linux/nfsd/cld.h:47:2: error: unknown type name 'uint8_t' uint8_t cm_cmd; /* upcall command */ /usr/include/linux/nfsd/cld.h:48:2: error: unknown type name 'int16_t' int16_t cm_status; /* return code */ /usr/include/linux/nfsd/cld.h:49:2: error: unknown type name 'uint32_t' uint32_t cm_xid; /* transaction id */ /usr/include/linux/nfsd/cld.h:51:3: error: unknown type name 'int64_t' int64_t cm_gracetime; /* grace period start time */ Signed-off-by: Dmitry V. Levin Signed-off-by: J. Bruce Fields include/uapi/linux/nfsd/cld.h | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) commit 51f567777799c9d85a778302b9eb61cf15214a98 Author: J. Bruce Fields Date: Thu Apr 6 22:36:31 2017 -0400 nfsd: check for oversized NFSv2/v3 arguments A client can append random data to the end of an NFSv2 or NFSv3 RPC call without our complaining; we'll just stop parsing at the end of the expected data and ignore the rest. Encoded arguments and replies are stored together in an array of pages, and if a call is too large it could leave inadequate space for the reply. This is normally OK because NFS RPC's typically have either short arguments and long replies (like READ) or long arguments and short replies (like WRITE). But a client that sends an incorrectly long reply can violate those assumptions. This was observed to cause crashes. So, insist that the argument not be any longer than we expect. Also, several operations increment rq_next_page in the decode routine before checking the argument size, which can leave rq_next_page pointing well past the end of the page array, causing trouble later in svc_free_pages. As followup we may also want to rewrite the encoding routines to check more carefully that they aren't running off the end of the page array. Reported-by: Tuomas Haanpää Reported-by: Ari Kauppi Cc: stable@vger.kernel.org Signed-off-by: J. Bruce Fields fs/nfsd/nfs3xdr.c | 23 +++++++++++++++++------ fs/nfsd/nfsxdr.c | 13 ++++++++++--- include/linux/sunrpc/svc.h | 3 +-- 3 files changed, 28 insertions(+), 11 deletions(-) commit d618ebaf0aa83d175658aea5291e0c459d471d39 Author: Chao Yu Date: Tue Apr 25 00:21:35 2017 +0800 f2fs: enable small discard by default This patch start to enable 4K granularity small discard by default when realtime discard is on, so, in seriously fragmented space, small size discard can be issued in time to avoid useless storage space occupying of invalid filesystem's data, then performance of flash storage can be recovered. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/f2fs.h | 4 ++-- fs/f2fs/segment.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) commit 34e159da418be46986456daf21a339932f349b63 Author: Chao Yu Date: Tue Apr 25 00:21:34 2017 +0800 f2fs: delay awaking discard thread It's better to delay awaking discard thread while queuing discard commands in checkpoint, it will help to give more chances for merging big and small discard. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/segment.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 66a82d1fc7e058b28189fe068f2a5efd9abc719a Author: Yunlei He Date: Sat Apr 22 18:06:26 2017 +0800 f2fs: seperate read nat page from nat_tree_lock This patch seperate nat page read io from nat_tree_lock. -lock_page -get_node_info() -current_nat_addr ...... -> write_checkpoint -get_meta_page Because we lock node page, we can make sure no other threads modify this nid concurrently. So we just obtain current_nat_addr under nat_tree_lock, node info is always same in both nat pack. Signed-off-by: Yunlei He Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/node.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) commit d3bb910c15d75ee3340311c64a1c05985bb663a3 Author: Sheng Yong Date: Sat Apr 22 10:39:20 2017 +0800 f2fs: fix multiple f2fs_add_link() having same name for inline dentry Commit 88c5c13a5027 (f2fs: fix multiple f2fs_add_link() calls having same name) does not cover the scenario where inline dentry is enabled. In that case, F2FS_I(dir)->task will be NULL, and __f2fs_add_link will lookup dentries one more time. This patch fixes it by moving the assigment of current task to a upper level to cover both normal and inline dentry. Cc: Fixes: 88c5c13a5027 (f2fs: fix multiple f2fs_add_link() calls having same name) Signed-off-by: Sheng Yong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/dir.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) commit 7acedaf5c4355f812cfef883ac28bf15f7d9205e Author: Eric Dumazet Date: Tue Apr 25 11:36:52 2017 -0700 net: move xdp_prog field in RX cache lines (struct net_device, xdp_prog) field should be moved in RX cache lines, reducing latencies when a single packet is received on idle host, since netif_elide_gro() needs it. Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller include/linux/netdevice.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit bb3393d5b3594a6f9c2e670ec59a2bb8daf92ccc Author: Trond Myklebust Date: Tue Apr 25 16:25:06 2017 -0400 NFSv3: nfs3_nlm_alloc_call should be declared static Fix compiler warnings. Signed-off-by: Trond Myklebust fs/nfs/nfs3proc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 6abccd1bfee49e491095772fd5aa9e96d915ae52 Author: Dan Williams Date: Fri Jan 13 14:14:23 2017 -0800 x86, dax, pmem: remove indirection around memcpy_from_pmem() memcpy_from_pmem() maps directly to memcpy_mcsafe(). The wrapper serves no real benefit aside from affording a more generic function name than the x86-specific 'mcsafe'. However this would not be the first time that x86 terminology leaked into the global namespace. For lack of better name, just use memcpy_mcsafe() directly. This conversion also catches a place where we should have been using plain memcpy, acpi_nfit_blk_single_io(). Cc: Cc: Jan Kara Cc: Jeff Moyer Cc: Ingo Molnar Cc: Christoph Hellwig Cc: "H. Peter Anvin" Cc: Thomas Gleixner Cc: Matthew Wilcox Cc: Ross Zwisler Acked-by: Tony Luck Signed-off-by: Dan Williams arch/x86/include/asm/pmem.h | 5 ----- arch/x86/include/asm/string_64.h | 1 + drivers/acpi/nfit/core.c | 3 +-- drivers/nvdimm/claim.c | 2 +- drivers/nvdimm/pmem.c | 2 +- include/linux/pmem.h | 23 ----------------------- include/linux/string.h | 8 ++++++++ 7 files changed, 12 insertions(+), 32 deletions(-) commit d4b29fd78ea6fc2be219be3af1a992149b4ff0f6 Author: Dan Williams Date: Fri Jan 27 17:22:03 2017 -0800 block: remove block_device_operations ->direct_access() Now that all the producers and consumers of dax interfaces have been converted to using dax_operations on a dax_device, remove the block device direct_access enabling. Signed-off-by: Dan Williams arch/powerpc/sysdev/axonram.c | 23 ++++------------------ drivers/block/brd.c | 15 --------------- drivers/md/dm.c | 13 ------------- drivers/nvdimm/pmem.c | 10 ---------- drivers/s390/block/dcssblk.c | 16 --------------- fs/block_dev.c | 45 ------------------------------------------- include/linux/blkdev.h | 17 ---------------- 7 files changed, 4 insertions(+), 135 deletions(-) commit 2093f2e9dfec98e561c83e807910267bcbd8bb7b Author: Dan Williams Date: Sat Apr 1 16:02:38 2017 -0700 block, dax: convert bdev_dax_supported() to dax_direct_access() Kill of the final user of bdev_direct_access() and struct blk_dax_ctl. Signed-off-by: Dan Williams fs/block_dev.c | 48 ++++++++++++++++++++++++++++-------------------- 1 file changed, 28 insertions(+), 20 deletions(-) commit cccbce67158290537cc671cbd4c1564876485a65 Author: Dan Williams Date: Fri Jan 27 13:31:42 2017 -0800 filesystem-dax: convert to dax_direct_access() Now that a dax_device is plumbed through all dax-capable drivers we can switch from block_device_operations to dax_operations for invoking ->direct_access. This also lets us kill off some usages of struct blk_dax_ctl on the way to its eventual removal. Suggested-by: Christoph Hellwig Signed-off-by: Dan Williams fs/dax.c | 277 +++++++++++++++++++++++++++++----------------------- fs/iomap.c | 3 +- include/linux/dax.h | 6 +- 3 files changed, 162 insertions(+), 124 deletions(-) commit a41fe02b6bba853a29c864d00fd161bbe6cfc715 Author: Dan Williams Date: Fri Jan 27 14:13:15 2017 -0800 Revert "block: use DAX for partition table reads" commit d1a5f2b4d8a1 ("block: use DAX for partition table reads") was part of a stalled effort to allow dax mappings of block devices. Since then the device-dax mechanism has filled the role of dax-mapping static device ranges. Now that we are moving ->direct_access() from a block_device operation to a dax_inode operation we would need block devices to map and carry their own dax_inode reference. Unless / until we decide to revive dax mapping of raw block devices through the dax_inode scheme, there is no need to carry read_dax_sector(). Its removal in turn allows for the removal of bdev_direct_access() and should have been included in commit 223757016837 ("block_dev: remove DAX leftovers"). Cc: Jeff Moyer Signed-off-by: Dan Williams block/partition-generic.c | 17 ++--------------- fs/dax.c | 20 -------------------- include/linux/dax.h | 6 ------ 3 files changed, 2 insertions(+), 41 deletions(-) commit fa5d932c323e8e0d9b24b3517997d15b36d1607d Author: Dan Williams Date: Fri Jan 27 12:04:59 2017 -0800 ext2, ext4, xfs: retrieve dax_device for iomap operations In preparation for converting fs/dax.c to use dax_direct_access() instead of bdev_direct_access(), add the plumbing to retrieve the dax_device associated with a given block_device. Signed-off-by: Dan Williams fs/ext2/inode.c | 9 ++++++++- fs/ext4/inode.c | 9 ++++++++- fs/xfs/xfs_iomap.c | 10 ++++++++++ include/linux/iomap.h | 1 + 4 files changed, 27 insertions(+), 2 deletions(-) commit 817bf40265459578abc36c6bd53e27775b5c7ec4 Author: Dan Williams Date: Wed Apr 12 13:37:44 2017 -0700 dm: teach dm-targets to use a dax_device + dax_operations Arrange for dm to lookup the dax services available from member devices. Update the dax-capable targets, linear and stripe, to route dax operations to the underlying device. Changes the target-internal ->direct_access() method to more closely align with the dax_operations ->direct_access() calling convention. Cc: Toshi Kani Reviewed-by: Mike Snitzer Signed-off-by: Dan Williams drivers/md/dm-linear.c | 27 +++++++++++++-------------- drivers/md/dm-snap.c | 6 +++--- drivers/md/dm-stripe.c | 29 ++++++++++++++--------------- drivers/md/dm-target.c | 6 +++--- drivers/md/dm.c | 16 ++++++---------- include/linux/device-mapper.h | 7 ++++--- 6 files changed, 43 insertions(+), 48 deletions(-) commit 2be1fce95e5b017dd7d23ca039d58cbefd0221e6 Author: Chuck Lever Date: Tue Apr 11 13:24:07 2017 -0400 xprtrdma: Remove rpcrdma_buffer::rb_pool Since commit 1e465fd4ff47 ("xprtrdma: Replace send and receive arrays"), this field is no longer used. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/xprt_rdma.h | 1 - 1 file changed, 1 deletion(-) commit 7ecce75fc3c52590950bc5e68eac0f00e50e8ce4 Author: Chuck Lever Date: Tue Apr 11 13:23:59 2017 -0400 sunrpc: Fix xdr_init_decode_pages() documenting comment Clean up. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xdr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0031e47c76ec5ce5b4f64f2750a535a36040c82b Author: Chuck Lever Date: Tue Apr 11 13:23:51 2017 -0400 xprtrdma: Squelch ENOBUFS warnings When ro_map is out of buffers, that's not a permanent error, so don't report a problem. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/rpc_rdma.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit 7d7fa9b5509649ee1732fde0c643bea53f8db364 Author: Chuck Lever Date: Tue Apr 11 13:23:43 2017 -0400 xprtrdma: Annotate receive workqueue Micro-optimize the receive workqueue by marking it's anchor "read- mostly." Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/verbs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 56a6bd154ddd60f7d01d6c0a5c272c1224d16b46 Author: Chuck Lever Date: Tue Apr 11 13:23:34 2017 -0400 xprtrdma: Revert commit d0f36c46deea Device removal is now adequately supported. Pinning the underlying device driver to prevent removal while an NFS mount is active is no longer necessary. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/verbs.c | 33 +++++++-------------------------- 1 file changed, 7 insertions(+), 26 deletions(-) commit a9b0e381caa965bc9b00dad1e593c502f48f8c3d Author: Chuck Lever Date: Tue Apr 11 13:23:26 2017 -0400 xprtrdma: Restore transport after device removal After a device removal, enable the transport connect worker to restore normal operation if there is another device with connectivity to the server. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/verbs.c | 48 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) commit 1890896b4e01e3858db71fa55a8edf85e15f9946 Author: Chuck Lever Date: Tue Apr 11 13:23:18 2017 -0400 xprtrdma: Refactor rpcrdma_ep_connect I'm about to add another arm to if (ep->rep_connected != 0) It will be cleaner to use a switch statement here. We'll be looking for a couple of specific errnos, or "anything else," basically to sort out the difference between a normal reconnect and recovery from device removal. This is a refactoring change only. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/verbs.c | 109 +++++++++++++++++++++++++------------------- 1 file changed, 63 insertions(+), 46 deletions(-) commit bebd031866caa404c522e91bb6fd0c69be04c707 Author: Chuck Lever Date: Tue Apr 11 13:23:10 2017 -0400 xprtrdma: Support unplugging an HCA from under an NFS mount The device driver for the underlying physical device associated with an RPC-over-RDMA transport can be removed while RPC-over-RDMA transports are still in use (ie, while NFS filesystems are still mounted and active). The IB core performs a connection event upcall to request that consumers free all RDMA resources associated with a transport. There may be pending RPCs when this occurs. Care must be taken to release associated resources without leaving references that can trigger a subsequent crash if a signal or soft timeout occurs. We rely on the caller of the transport's ->close method to ensure that the previous RPC task has invoked xprt_release but the transport remains write-locked. A DEVICE_REMOVE upcall forces a disconnect then sleeps. When ->close is invoked, it destroys the transport's H/W resources, then wakes the upcall, which completes and allows the core driver unload to continue. BugLink: https://bugzilla.linux-nfs.org/show_bug.cgi?id=266 Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/transport.c | 29 +++++++++++++--- net/sunrpc/xprtrdma/verbs.c | 74 ++++++++++++++++++++++++++++++++++++++--- net/sunrpc/xprtrdma/xprt_rdma.h | 7 ++++ 3 files changed, 101 insertions(+), 9 deletions(-) commit 91a10c52975a8c89e146a4f740e64cd147ba8e8a Author: Chuck Lever Date: Tue Apr 11 13:23:02 2017 -0400 xprtrdma: Use same device when mapping or syncing DMA buffers When the underlying device driver is reloaded, ia->ri_device will be replaced. All cached copies of that device pointer have to be updated as well. Commit 54cbd6b0c6b9 ("xprtrdma: Delay DMA mapping Send and Receive buffers") added the rg_device field to each regbuf. As part of handling a device removal, rpcrdma_dma_unmap_regbuf is invoked on all regbufs for a transport. Simply calling rpcrdma_dma_map_regbuf for each Receive buffer after the driver has been reloaded should reinitialize rg_device correctly for every case except rpcrdma_wc_receive, which still uses rpcrdma_rep::rr_device. Ensure the same device that was used to map a Receive buffer is also used to sync it in rpcrdma_wc_receive by using rg_device there instead of rr_device. This is the only use of rr_device, so it can be removed. The use of regbufs in the send path is also updated, for completeness. Fixes: 54cbd6b0c6b9 ("xprtrdma: Delay DMA mapping Send and ... ") Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/rpc_rdma.c | 4 ++-- net/sunrpc/xprtrdma/verbs.c | 12 ++++++------ net/sunrpc/xprtrdma/xprt_rdma.h | 7 ++++++- 3 files changed, 14 insertions(+), 9 deletions(-) commit fff09594edf5e9b8595a2cefdc07e54b70f81729 Author: Chuck Lever Date: Tue Apr 11 13:22:54 2017 -0400 xprtrdma: Refactor rpcrdma_ia_open() In order to unload a device driver and reload it, xprtrdma will need to close a transport's interface adapter, and then call rpcrdma_ia_open again, possibly finding a different interface adapter. Make rpcrdma_ia_open safe to call on the same transport multiple times. This is a refactoring change only. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/transport.c | 6 +++--- net/sunrpc/xprtrdma/verbs.c | 46 ++++++++++++++++++++--------------------- net/sunrpc/xprtrdma/xprt_rdma.h | 7 ++++++- 3 files changed, 32 insertions(+), 27 deletions(-) commit 33849792cbcdae2b04819cfb09fe3dca0a84a11e Author: Chuck Lever Date: Tue Apr 11 13:22:46 2017 -0400 xprtrdma: Detect unreachable NFS/RDMA servers more reliably Current NFS clients rely on connection loss to determine when to retransmit. In particular, for protocols like NFSv4, clients no longer rely on RPC timeouts to drive retransmission: NFSv4 servers are required to terminate a connection when they need a client to retransmit pending RPCs. When a server is no longer reachable, either because it has crashed or because the network path has broken, the server cannot actively terminate a connection. Thus NFS clients depend on transport-level keepalive to determine when a connection must be replaced and pending RPCs retransmitted. However, RDMA RC connections do not have a native keepalive mechanism. If an NFS/RDMA server crashes after a client has sent RPCs successfully (an RC ACK has been received for all OTW RDMA requests), there is no way for the client to know the connection is moribund. In addition, new RDMA requests are subject to the RPC-over-RDMA credit limit. If the client has consumed all granted credits with NFS traffic, it is not allowed to send another RDMA request until the server replies. Thus it has no way to send a true keepalive when the workload has already consumed all credits with pending RPCs. To address this, forcibly disconnect a transport when an RPC times out. This prevents moribund connections from stopping the detection of failover or other configuration changes on the server. Note that even if the connection is still good, retransmitting any RPC will trigger a disconnect thanks to this logic in xprt_rdma_send_request: /* Must suppress retransmit to maintain credits */ if (req->rl_connect_cookie == xprt->connect_cookie) goto drop_connection; req->rl_connect_cookie = xprt->connect_cookie; Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/transport.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) commit e2a4f4fbefc5e5b7b4435f73711b7be94f780584 Author: Chuck Lever Date: Tue Apr 11 13:22:38 2017 -0400 sunrpc: Export xprt_force_disconnect() xprt_force_disconnect() is already invoked from the socket transport. I want to invoke xprt_force_disconnect() from the RPC-over-RDMA transport, which is a separate module from sunrpc.ko. Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprt.c | 1 + 1 file changed, 1 insertion(+) commit 9378b274e1eb6925db315e345f48850d2d5d9789 Author: Chuck Lever Date: Tue Apr 11 13:22:29 2017 -0400 xprtrdma: Cancel refresh worker during buffer shutdown Trying to create MRs while the transport is being torn down can cause a crash. Fixes: e2ac236c0b65 ("xprtrdma: Allocate MRs on demand") Signed-off-by: Chuck Lever Signed-off-by: Anna Schumaker net/sunrpc/xprtrdma/verbs.c | 1 + 1 file changed, 1 insertion(+) commit 86f917adea2dc0ef440a248601e48154dc48e6d0 Author: Eric Biggers Date: Thu Mar 30 22:18:48 2017 -0700 dm crypt: remove obsolete references to per-CPU state dm-crypt used to use separate crypto transforms for each CPU, but this is no longer the case. To avoid confusion, fix up obsolete comments and rename setup_essiv_cpu(). Signed-off-by: Eric Biggers Signed-off-by: Mike Snitzer drivers/md/dm-crypt.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) commit 291084951825e1efca081926b10bf3ff7e872476 Author: Sara Sharon Date: Sun Jan 8 16:45:46 2017 +0200 iwlwifi: adjust NVM parsing APIs for new a000 method In a000 devices we will get all nvm data from the firmware, and can save most of the parsing. Export two APIs that op mode will still use. Adjust API of init_sbands to be independent of NVM file structure so it can be used by op mode as well. Signed-off-by: Sara Sharon Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | 32 +++++++++------------- drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h | 16 ++++++++++- 2 files changed, 28 insertions(+), 20 deletions(-) commit d8a130b02d0caa9a8f0c14db11d84320ffc62c57 Author: Johannes Berg Date: Mon Mar 6 15:49:00 2017 +0100 iwlwifi: pcie: apply no-reclaim logic only to group 0 When applying no-reclaim logic to commands other than the group zero for legacy commands, commands such as 0x1c (TX_CMD in group 0) can't be used in any other group. Fix that by applying this logic only for group 0 - it's not and should never be needed for any other groups. Reported-by: Sharon Dvir Reported-by: Shaul Triebitz Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit f99a6abe59e096cc2c753e667c19f22022e3bef4 Author: Sara Sharon Date: Sun Mar 5 18:35:02 2017 +0200 iwlwifi: mvm: memset binding before setting values The changes in commit 9415af7f306b ("iwlwifi: mvm: support new binding API") assigned values that were later memset to 0. Move the memset earlier. Fixes: 9415af7f306b ("iwlwifi: mvm: support new binding API") Signed-off-by: Sara Sharon Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/mvm/binding.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit a1a5787730455609473fb5a9d86eee05af347a3b Author: Sara Sharon Date: Sun Mar 5 11:38:58 2017 +0200 iwlwifi: rename wait_for_tx_queues_empty Rename current wait_tx_queue_empty to wait_tx_queues_empty since it waits for multiple queues (up to 32). Next patch will add a wait for single TX queue which is needed for gen2 to be scalable for 512. Signed-off-by: Sara Sharon Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/dvm/lib.c | 2 +- drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c | 2 +- drivers/net/wireless/intel/iwlwifi/iwl-trans.h | 8 ++++---- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 4 ++-- drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 14 +++++++------- drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 2 +- 6 files changed, 16 insertions(+), 16 deletions(-) commit e982bc2ca87fc5e663c85356c65fb66d2ab50843 Author: Sara Sharon Date: Thu Feb 23 14:19:45 2017 +0200 iwlwifi: move to 512 queues Avoid using the old define since it will enlarge necessary structs for previous HW. Signed-off-by: Sara Sharon Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/iwl-a000.c | 2 +- drivers/net/wireless/intel/iwlwifi/iwl-config.h | 2 +- drivers/net/wireless/intel/iwlwifi/iwl-trans.h | 2 ++ drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 2 +- drivers/net/wireless/intel/iwlwifi/pcie/internal.h | 6 +++--- 5 files changed, 8 insertions(+), 6 deletions(-) commit ced19f26968dc5cbcf870ae6856f8d7b789a7016 Author: Sara Sharon Date: Mon Feb 6 19:09:32 2017 +0200 iwlwifi: mvm: support station type API Support change to ADD_STA API to support station types. Each station is assigned its type. This simplifies FW handling of the broadcast and multicast stations: * broadcast station is identified by its type and not the mac address. * multicast queue is no longer treated differently. The opening and closing of it is done by referring to its station. There is no need to specify it in the MAC command. * When disabling TX to all station driver can disable the traffic on multicast station, so FW doesn't have to do it. Change is backward compatible. Change the order of adding and removing the stations according to FW requirements. Signed-off-by: Sara Sharon Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/iwl-fw-file.h | 2 + .../net/wireless/intel/iwlwifi/mvm/fw-api-mac.h | 5 +- .../net/wireless/intel/iwlwifi/mvm/fw-api-sta.h | 24 ++++++- drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | 6 +- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 31 +++++--- drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 84 +++++++++++++++++++--- drivers/net/wireless/intel/iwlwifi/mvm/sta.h | 7 +- 7 files changed, 132 insertions(+), 27 deletions(-) commit ff4143ccff314b22f03666c1d8eccd4de967df2c Author: Steven J. Hill Date: Mon Apr 24 13:41:58 2017 -0500 MIPS: Octeon: cavium_octeon_defconfig: Enable Octeon MMC Enable the Octeon MMC driver in the defconfig. Signed-off-by: Steven J. Hill Acked-by: Ralf Baechle Signed-off-by: Ulf Hansson arch/mips/configs/cavium_octeon_defconfig | 5 +++++ 1 file changed, 5 insertions(+) commit 34e10860ae8dc8ab675ba84529c280ff922855e3 Author: Sara Sharon Date: Thu Feb 23 13:15:07 2017 +0200 iwlwifi: mvm: remove references to queue_info in new TX path Most of the fields aren't needed in new TX path. Enlarging the struct to 512 queues will consume a lot of memory. Remove all references to the struct in the new TX path. Move mac80211 queue mapping outside, since it will be needed per queue for TVQM mode. Add warning in paths that shouldn't be hit. Signed-off-by: Sara Sharon Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 4 +- drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 4 +- drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 96 +++++++++++++++----------- drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 5 +- drivers/net/wireless/intel/iwlwifi/mvm/utils.c | 58 +++++++++------- 5 files changed, 96 insertions(+), 71 deletions(-) commit b9410b186f7129bde5dd5b20475105f17fedb452 Author: Liad Kaufman Date: Tue Feb 28 17:15:47 2017 +0200 iwlwifi: gen2: support nmi triggering from host For gen2 there is a new register. Signed-off-by: Liad Kaufman Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/iwl-io.c | 3 +++ drivers/net/wireless/intel/iwlwifi/iwl-prph.h | 1 + 2 files changed, 4 insertions(+) commit 06a1e85e66bac2b65b4953124b4f1b2c4aebb39f Author: Johannes Berg Date: Tue Feb 28 22:45:25 2017 +0100 iwlwifi: remove module loading failure message When CONFIG_DEBUG_TEST_DRIVER_REMOVE is set, iwlwifi crashes when the opmode module cannot be loaded, due to completing the completion before using drv->dev, which can then already be freed. Fix this by removing the (fairly useless) message. Moving the completion later causes a deadlock instead, so that's not an option. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 53d515ec677a1903bb507b81dc12ae6922846c1b Author: Johannes Berg Date: Tue Feb 28 16:44:16 2017 +0100 iwlwifi: don't leak memory on allocation failure If we fail to allocate the small chunk of memory for the pieces of the firmware file, we leak the whole firmware image instead... Since the allocation failure is really unlikely, just bail out at that point instead. Remove the error message at the label since we now (and actually have been) use it for various reasons. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) commit b0fa818e6c5f48bfbc3dfe1317754390b88446c1 Author: Johannes Berg Date: Tue Feb 28 16:42:10 2017 +0100 iwlwifi: pcie: remove superfluous trans->dev assignment This struct member is already assigned in the previous call to iwl_trans_alloc(), so assigning the same value again is superfluous - remove it. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 1 - 1 file changed, 1 deletion(-) commit 0fc9bf7add0f2d1a370c688dabc9846ad187c044 Author: Sara Sharon Date: Wed Feb 22 12:08:19 2017 +0200 iwlwifi: mvm: use defines instead of variables for shared dwell times Most of the dwells are constant across different scan types. Use defines instead of depending on scan type. This is needed as preparation to having different scan type per band. Signed-off-by: Sara Sharon Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 55 ++++++++++----------------- 1 file changed, 20 insertions(+), 35 deletions(-) commit e609474c890d72823c6d3e3e636871a3ed8f453c Author: Sara Sharon Date: Thu Feb 23 22:42:01 2017 +0200 iwlwifi: mvm: remove color definition We use the full station field as sta_id, and never use the color. FW are about to clean the color out, so those defines are incorrect now (and were redundant before). Signed-off-by: Sara Sharon Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/mvm/fw-api-sta.h | 14 -------------- 1 file changed, 14 deletions(-) commit 6862fcee2feb3c5334239377160d463aee3da932 Author: Sara Sharon Date: Wed Feb 22 19:34:17 2017 +0200 iwlwifi: mvm: move internally to use bigger INVALID_TXQ We can't use IEEE80211_INVAL_HW_QUEUE to mark a queue as invalid since 255 will be a valid value for a TVQM queue index. Use IWL_MVM_INVALID_QUEUE instead for accessing txq_id. reserved_queue can stay a u8 since reserved_queue is not used when TVQM is enabled. Signed-off-by: Sara Sharon Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 2 ++ drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 12 ++++++------ drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 6 +++--- drivers/net/wireless/intel/iwlwifi/mvm/utils.c | 2 +- 5 files changed, 13 insertions(+), 11 deletions(-) commit 127f60bfa98f30f7f47ae362b9807f0d223cbcc2 Author: Johannes Berg Date: Thu Apr 13 15:50:27 2017 +0200 mac80211: rewrite monitor mode delivery logic The monitor mode delivery logic makes it hard to add any kind of filtering in an efficient way, because the monitor SKB is created first and then passed to all interfaces. Rewrite the logic to create the monitor SKB the first time it's actually needed, and then keep delivering it. Signed-off-by: Johannes Berg net/mac80211/rx.c | 151 +++++++++++++++++++++++++++++++++--------------------- 1 file changed, 92 insertions(+), 59 deletions(-) commit cd50ac0f31d111cf6c2a7b953a67703d5522ef55 Author: Vasanthakumar Thiagarajan Date: Tue Apr 18 17:39:19 2017 +0530 cfg80211: Fix dfs state propagation for non-DFS center channel When part of a bigger bandwidth (160 MHz) channel falls in DFS channel range it is possible that the center frequency may not necessarily be a radar channel. Remove the sanity check on channel flag for IEEE80211_CHAN_RADAR in regulatory_propagate_dfs_state(), this should fix the dfs state propagation for non-DFS center freq which has DFS channels in it's bandwidth, should also fix unnecessary WARN_ON() spam in regulatory_propagate_dfs_state(). Fixes: 8976672736d6 ("cfg80211: Share Channel DFS state across wiphys of same DFS domain") Reported-by: Johannes Berg Signed-off-by: Vasanthakumar Thiagarajan Signed-off-by: Johannes Berg net/wireless/reg.c | 3 --- 1 file changed, 3 deletions(-) commit cc47dd684ee04f9f49f081002a74ef1ba9d14cc8 Author: Jason Gunthorpe Date: Thu Apr 6 16:33:14 2017 -0600 IB/vmw_pvrdma: Spare annotate imm_data imm_data is copied directly from the ib_send_wr and ib_wc which have it marked as __be32, copy that mark into the uapi structures as well. Signed-off-by: Jason Gunthorpe Tested-by: Adit Ranadive Acked-by: Adit Ranadive Signed-off-by: Doug Ledford include/uapi/rdma/vmw_pvrdma-abi.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit a6598813a4c5bad76322bee2323dc549e7d7180d Author: Trond Myklebust Date: Tue Apr 25 12:06:00 2017 -0400 NFS: Don't write back further requests if there is a pending write error If the server has already returned a fatal write error that the user has not yet received on this file, then don't write back the other pages. Instead, act as if they have been sent, and have returned with the same error. Signed-off-by: Trond Myklebust fs/nfs/write.c | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-) commit 6aeafd05eca9bc8ab6b03d7e56d09ffd18190f44 Author: Trond Myklebust Date: Tue Apr 25 11:26:53 2017 -0400 pNFS: Fix use after free issues in pnfs_do_read() The assumption should be that if the caller returns PNFS_ATTEMPTED, then hdr has been consumed, and so we should not be testing hdr->task.tk_status. If the caller returns PNFS_TRY_AGAIN, then we need to recoalesce and free hdr. Signed-off-by: Trond Myklebust fs/nfs/pnfs.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) commit db570d7deafb47ee635981f403a6531844c18ba5 Author: Artemy Kovalyov Date: Wed Apr 5 09:23:59 2017 +0300 IB/mlx5: Add ODP support to MW Internally MW implemented as KLM MKey and filled by userspace UMR postsends. Handle pagefault trigered by operations on this MKeys. Signed-off-by: Artemy Kovalyov Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/hw/mlx5/mlx5_ib.h | 1 + drivers/infiniband/hw/mlx5/mr.c | 1 + drivers/infiniband/hw/mlx5/odp.c | 161 +++++++++++++++++++++++++---------- 3 files changed, 120 insertions(+), 43 deletions(-) commit 1b7dbc26fcb4822787d6a183d78384a866508d2f Author: Artemy Kovalyov Date: Wed Apr 5 09:23:58 2017 +0300 IB/mlx5: Extract page fault code To make page fault handling code more flexible split pagefault_single_data_segment() function. Keep MR resolution in pagefault_single_data_segment() and move actual updates into pagefault_single_mr(). Signed-off-by: Artemy Kovalyov Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/hw/mlx5/odp.c | 203 ++++++++++++++++++++------------------- 1 file changed, 104 insertions(+), 99 deletions(-) commit 0008b84ea9afe6ec255c09044e8090cb76babc80 Author: Artemy Kovalyov Date: Wed Apr 5 09:23:57 2017 +0300 IB/umem: Add support to huge ODP Add IB_ACCESS_HUGETLB ib_reg_mr flag. Hugetlb region registered with this flag will use single translation entry per huge page. Signed-off-by: Artemy Kovalyov Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/core/umem.c | 2 +- drivers/infiniband/core/umem_odp.c | 19 +++++++++++++++++-- include/rdma/ib_umem_odp.h | 6 ++++-- include/rdma/ib_verbs.h | 1 + 4 files changed, 23 insertions(+), 5 deletions(-) commit b2ac91885b9f137fd7ed35593a72bcee9e049ba8 Author: Artemy Kovalyov Date: Wed Apr 5 09:23:56 2017 +0300 IB/mlx5: Add contiguous ODP support Currenlty ODP supports only regular MMU pages. Add ODP support for regions consisting of physically contiguous chunks of arbitrary order (huge pages for instance) to improve performance. Signed-off-by: Artemy Kovalyov Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/hw/mlx5/mem.c | 9 ++++----- drivers/infiniband/hw/mlx5/odp.c | 28 +++++++++++++++------------- 2 files changed, 19 insertions(+), 18 deletions(-) commit 403cd12e2cf759ead5cbdcb62bf9872b9618d400 Author: Artemy Kovalyov Date: Wed Apr 5 09:23:55 2017 +0300 IB/umem: Add contiguous ODP support Currenlty ODP supports only regular MMU pages. Add ODP support for regions consisting of physically contiguous chunks of arbitrary order (huge pages for instance) to improve performance. Signed-off-by: Artemy Kovalyov Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/core/umem_odp.c | 50 +++++++++++++++++++++++--------------- include/rdma/ib_umem.h | 4 +-- 2 files changed, 33 insertions(+), 21 deletions(-) commit 4df4a5bac3264efa0595b52b2a9cd5274b32f0d4 Author: Artemy Kovalyov Date: Wed Apr 5 09:23:54 2017 +0300 IB/mlx5: Decrease verbosity level of ODP errors Decrease verbosity level of ODP error flows messages to debug level. Remove one redundant print since debug level message already exists in this flow. Fixes: d9aaed838765 ('{net,IB}/mlx5: Refactor page fault handling') Signed-off-by: Artemy Kovalyov Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/hw/mlx5/odp.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) commit 523791d7c5eb4533ded3ba3de3517431243c0de5 Author: Artemy Kovalyov Date: Wed Apr 5 09:23:53 2017 +0300 IB/mlx5: Fix implicit MR GC When implicit MR's leaf MKey becomes unused, i.e. when it's last page being released my MMU invalidation it is marked as "dying" and scheduled for release by garbage collector. Currentle consequent page fault may remove "dying" flag. Treat leaf MKey as non-existent once it was scheduled to removal by GC. Fixes: 81713d3788d2 ('IB/mlx5: Add implicit MR support') Signed-off-by: Artemy Kovalyov Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/hw/mlx5/odp.c | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) commit 438b228e03740957d94198417d28a6ebea6672ed Author: Artemy Kovalyov Date: Wed Apr 5 09:23:52 2017 +0300 IB/mlx5: Fix UMR size calculation Translation table updates of large UMR may require multiple post send operations. The last operations can be in various lengths, but current code set them to be the same length. Fixes: 7d0cc6edcc70 ('IB/mlx5: Add MR cache for large UMR regions') Signed-off-by: Artemy Kovalyov Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/hw/mlx5/mr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit bd174fc2ca63f1c833a09f930796d789fb1f5361 Author: Artemy Kovalyov Date: Wed Apr 5 09:23:51 2017 +0300 IB/mlx5: Fix function updating xlt emergency path In memory shortage path we fall back to use spare buffer. mlx5_ib_update_xlt() called from ib_uverbs_reg_mr when ibmr.ucontext not initialized yet. Scenario how to test it: 1. trigger memory exhaustion so __get_free_pages(GFP_KERNEL, 4) will fail 2. register MR 3. there should be no kernel oops Fixes: 7d0cc6edcc70 ('IB/mlx5: Add MR cache for large UMR regions') Signed-off-by: Artemy Kovalyov Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/hw/mlx5/mr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 3e7e1193e28a1428e857f3f44870ec2dbd615e6a Author: Artemy Kovalyov Date: Wed Apr 5 09:23:50 2017 +0300 IB: Replace ib_umem page_size by page_shift Size of pages are held by struct ib_umem in page_size field. It is better to store it as an exponent, because page size by nature is always power-of-two and used as a factor, divisor or ilog2's argument. The conversion of page_size to be page_shift allows to have portable code and avoid following error while compiling on ARM: ERROR: "__aeabi_uldivmod" [drivers/infiniband/core/ib_core.ko] undefined! CC: Selvin Xavier CC: Steve Wise CC: Lijun Ou CC: Shiraz Saleem CC: Adit Ranadive CC: Dennis Dalessandro CC: Ram Amrani Signed-off-by: Artemy Kovalyov Signed-off-by: Leon Romanovsky Acked-by: Ram Amrani Acked-by: Shiraz Saleem Acked-by: Selvin Xavier Acked-by: Selvin Xavier Acked-by: Adit Ranadive Signed-off-by: Doug Ledford drivers/infiniband/core/umem.c | 15 ++++++--------- drivers/infiniband/core/umem_odp.c | 12 ++++++------ drivers/infiniband/hw/bnxt_re/ib_verbs.c | 12 ++++++------ drivers/infiniband/hw/cxgb3/iwch_provider.c | 4 ++-- drivers/infiniband/hw/cxgb4/mem.c | 4 ++-- drivers/infiniband/hw/hns/hns_roce_cq.c | 3 +-- drivers/infiniband/hw/hns/hns_roce_mr.c | 9 +++++---- drivers/infiniband/hw/hns/hns_roce_qp.c | 3 +-- drivers/infiniband/hw/i40iw/i40iw_verbs.c | 10 +++++----- drivers/infiniband/hw/mlx4/cq.c | 2 +- drivers/infiniband/hw/mlx4/mr.c | 6 +++--- drivers/infiniband/hw/mlx4/qp.c | 2 +- drivers/infiniband/hw/mlx4/srq.c | 2 +- drivers/infiniband/hw/mlx5/mem.c | 4 ++-- drivers/infiniband/hw/mlx5/odp.c | 2 +- drivers/infiniband/hw/mthca/mthca_provider.c | 5 ++--- drivers/infiniband/hw/nes/nes_verbs.c | 4 ++-- drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 15 ++++++--------- drivers/infiniband/hw/qedr/verbs.c | 8 ++++---- drivers/infiniband/hw/vmw_pvrdma/pvrdma_misc.c | 2 +- drivers/infiniband/sw/rdmavt/mr.c | 8 ++++---- drivers/infiniband/sw/rxe/rxe_mr.c | 8 +++----- include/rdma/ib_umem.h | 4 ++-- 23 files changed, 67 insertions(+), 77 deletions(-) commit e2af3fabedbfc84fcecc7337cd4f0f031a51fa63 Author: Sara Sharon Date: Wed Feb 22 19:35:10 2017 +0200 iwlwifi: mvm: map cab_queue to different txq_id cab_queue can now get bigger than u8, since in TVQM we will support 512 queues.. Support it by maintaining internal mapping between the actual number and mac80211 queue (IWL_MVM_DQA_GCAST_QUEUE). For pre-a000 the internal queue will be the same as the mac80211 queue. Signed-off-by: Sara Sharon Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | 5 +++++ drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 2 ++ drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 4 ++-- drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 2 ++ 4 files changed, 11 insertions(+), 2 deletions(-) commit d4a7e708978af611a9c3a972bd4b7f877022f98b Author: Haim Dreyfuss Date: Thu Feb 2 14:49:50 2017 +0200 iwlwifi: mvm: Ignore wifi mcc update in the driver while associated Wifi mcc (mobile country code) update is forbidden while associated. Currently, FW prevents these updates and the driver is unaware to this logic. From now on, the FW sends every wifi mcc update to the driver. The driver in his turn needs to decide whether to ignore it or not, depends on the association state. Signed-off-by: Haim Dreyfuss Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 1 + drivers/net/wireless/intel/iwlwifi/mvm/nvm.c | 9 ++++++-- drivers/net/wireless/intel/iwlwifi/mvm/utils.c | 29 ++++++++++++++++++++++++++ 3 files changed, 37 insertions(+), 2 deletions(-) commit 396952ee9f1bf77720cef4a15f1e3be3425430e9 Author: Sara Sharon Date: Wed Feb 22 19:40:55 2017 +0200 iwlwifi: mvm: don't reserve queue in TVQM mode The reserved queue is never used, save the trouble. Signed-off-by: Sara Sharon Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 6 +++++- drivers/net/wireless/intel/iwlwifi/mvm/utils.c | 7 ++++--- 2 files changed, 9 insertions(+), 4 deletions(-) commit c9be849d37f1ec3bea8591f63b33bd2cb1a4bafe Author: Liad Kaufman Date: Wed Feb 22 14:39:10 2017 +0200 iwlwifi: pcie: support debug applying on a000 hw Allow configuring debug destination on a000 HW. Signed-off-by: Liad Kaufman Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info.c | 4 ++++ drivers/net/wireless/intel/iwlwifi/pcie/internal.h | 1 + drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 2 +- 3 files changed, 6 insertions(+), 1 deletion(-) commit 7daa7624e3adeba0955141d95eef9d66c78e945f Author: Johannes Berg Date: Fri Feb 24 12:02:22 2017 +0100 iwlwifi: mvm: avoid variable shadowing Remove an extra variable 'queue' that already exists. Also, since there are no code paths that use 'queue' without intializing it, remove the unnecessary zero initialization. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) commit 21c433a74b6b94538d01ea18d66195018136efd6 Author: Christoph Hellwig Date: Tue Apr 25 14:36:19 2017 -0500 IB/hfi1: Use pcie_flr() instead of duplicating it Tested-by: Jakub Byczkowski Signed-off-by: Christoph Hellwig Signed-off-by: Bjorn Helgaas Acked-by: Doug Ledford drivers/infiniband/hw/hfi1/chip.c | 4 ++-- drivers/infiniband/hw/hfi1/hfi.h | 1 - drivers/infiniband/hw/hfi1/pcie.c | 30 ------------------------------ 3 files changed, 2 insertions(+), 33 deletions(-) commit 5311a2476ef3e7ea4bc32d4f5f9ed118be624194 Author: Dor Shaish Date: Mon Feb 20 16:05:57 2017 +0200 iwlwifi: mvm: freeze 7265D and 3168 on API version 29 iwl7265D and iwl3168 are frozen on API version 29. Set the MAX API allowed level to 29 from now on. Signed-off-by: Dor Shaish Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/iwl-7000.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 8d2216be285135c7281e09dc07738b62782fad9c Author: Zhu Yanjun Date: Fri Mar 31 23:42:55 2017 -0400 IB/core: change the return type to void The function ib_unregister_mad_agent always returns zero. And this returned value is not checked. As such, chane the return type to void. CC: Joe Jin CC: Junxiao Bi Signed-off-by: Zhu Yanjun Reviewed-by: Yuval Shaia Reviewed-by: Hal Rosenstock Signed-off-by: Doug Ledford drivers/infiniband/core/mad.c | 3 +-- include/rdma/ib_mad.h | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) commit 2c15b73ab47a7e15722cab48cb64da29df234412 Author: Selvin Xavier Date: Tue Apr 4 01:30:38 2017 -0700 MAINTAINERS: Update ocrdma module status Since ocrdma driver is not going to be updated with any new development activity, except for critical bug fixes reported by partners or customers, changing the module status to "Odd Fixes". Also, updating the web page info and the maintainers email addresses. Signed-off-by: Selvin Xavier Signed-off-by: Doug Ledford MAINTAINERS | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit e8ea95af879e1c2bdf160e9bfd1c8db013454421 Author: Ira Weiny Date: Fri Mar 31 13:04:51 2017 -0400 IB/hfi: Fix up comments in engine mapping Fix off by 1 error in comments documenting the sdma and send context mappings. Signed-off-by: Ira Weiny Signed-off-by: Doug Ledford drivers/infiniband/hw/hfi1/pio.h | 26 +++++++++++----------- drivers/infiniband/hw/hfi1/sdma.h | 46 +++++++++++++++++++-------------------- 2 files changed, 36 insertions(+), 36 deletions(-) commit 3d35d32d1fd9e2595e737f8c7e7d21e3489b6482 Author: Geert Uytterhoeven Date: Sun Mar 12 14:16:53 2017 +0100 MAINTAINERS: Add file patterns for infiniband device tree bindings Submitters of device tree binding documentation may forget to CC the subsystem maintainer if this is missing. Signed-off-by: Geert Uytterhoeven Cc: Doug Ledford Cc: Sean Hefty Cc: Hal Rosenstock Cc: linux-rdma@vger.kernel.org Acked-by: Doug Ledford Signed-off-by: Doug Ledford MAINTAINERS | 1 + 1 file changed, 1 insertion(+) commit 4f7f4dcfff2c19debbcdbcc861c325610a15e0c5 Author: Vlad Tsyrklevich Date: Fri Mar 24 15:55:17 2017 -0400 infiniband/uverbs: Fix integer overflows The 'num_sge' variable is verfied to be smaller than the 'sge_count' variable; however, since both are user-controlled it's possible to cause an integer overflow for the kmalloc multiply on 32-bit platforms (num_sge and sge_count are both defined u32). By crafting an input that causes a smaller-than-expected allocation it's possible to write controlled data out-of-bounds. Signed-off-by: Vlad Tsyrklevich Signed-off-by: Doug Ledford drivers/infiniband/core/uverbs_cmd.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) commit 5b0ff9a00755d4d9c209033a77f1ed8f3186fe5c Author: Arnd Bergmann Date: Fri Mar 24 23:02:48 2017 +0100 infiniband: hns: avoid gcc-7.0.1 warning for uninitialized data hns_roce_v1_cq_set_ci() calls roce_set_bit() on an uninitialized field, which will then change only a few of its bits, causing a warning with the latest gcc: infiniband/hw/hns/hns_roce_hw_v1.c: In function 'hns_roce_v1_cq_set_ci': infiniband/hw/hns/hns_roce_hw_v1.c:1854:23: error: 'doorbell[1]' is used uninitialized in this function [-Werror=uninitialized] roce_set_bit(doorbell[1], ROCEE_DB_OTHERS_H_ROCEE_DB_OTH_HW_SYNS_S, 1); The code is actually correct since we always set all bits of the port_vlan field, but gcc correctly points out that the first access does contain uninitialized data. This initializes the field to zero first before setting the individual bits. Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver") Signed-off-by: Arnd Bergmann Signed-off-by: Doug Ledford drivers/infiniband/hw/hns/hns_roce_hw_v1.c | 1 + 1 file changed, 1 insertion(+) commit 7221547e55b7929e4d46983f6f3ca15f36ee4dac Author: Colin Ian King Date: Fri Apr 21 08:02:30 2017 +0100 PCI: imx6: Fix spelling mistake: "contol" -> "control" Trivial fix to spelling mistake in dev_err message Signed-off-by: Colin Ian King Signed-off-by: Bjorn Helgaas Acked-by: Richard Zhu drivers/pci/dwc/pci-imx6.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit f06ee95ce6b0b09c30e9344ca736d00d068c435c Author: Dhananjay Balan Date: Mon Apr 24 15:54:05 2017 +0200 staging: most: aim-sound style fixess Replace hardcoded function name with __func__ Signed-off-by: Dhananjay Balan Signed-off-by: Greg Kroah-Hartman drivers/staging/most/aim-sound/sound.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit aa3a13dfe9c562ce7076c2952bcca66894d464ae Author: Paolo Cretaro Date: Sat Apr 22 00:47:59 2017 +0200 staging: android: ion: Replace spaces with tabs for indentation Fix checkpatch ERRORs: code indent should use tabs where possible. Signed-off-by: Paolo Cretaro Signed-off-by: Greg Kroah-Hartman drivers/staging/android/ion/ion_cma_heap.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 98521b3869f8d6b4b9d2fdad8a56059e819ae002 Author: Arnaldo Carvalho de Melo Date: Tue Apr 25 15:45:35 2017 -0300 perf memswap: Split the byteswap memory range wrappers from util.[ch] Just one more step into splitting util.[ch] to reduce the includes hell. Cc: Adrian Hunter Cc: David Ahern Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: http://lkml.kernel.org/n/tip-navarr9mijkgwgbzu464dwam@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/Build | 1 + tools/perf/util/header.c | 1 + tools/perf/util/intel-pt.c | 1 + tools/perf/util/memswap.c | 24 ++++++++++++++++++++++++ tools/perf/util/memswap.h | 7 +++++++ tools/perf/util/session.c | 1 + tools/perf/util/util.c | 22 ---------------------- tools/perf/util/util.h | 3 --- 8 files changed, 35 insertions(+), 25 deletions(-) commit be223d577578c38c09f5dc9dd1fda8b5f0c91320 Author: Okash Khawaja Date: Sat Apr 22 09:00:28 2017 +0100 staging: speakup: add send_xchar and tiocmset methods This adds two methods to spk_synth struct: send_xchar and tiocmset, and creates serial implementation for each of them. It takes existing code in apollo, audptr and spkout which already fits the behaviour of send_xchar and tiocmset. In follow-up patches there will be TTY-based implementations of these methods. Then migrating the synths to TTY will include repointing these methods to their TTY implementations Rest of the changes simply make use of serial implementation of these two functions. Signed-off-by: Okash Khawaja Reviewed-by: Samuel Thibault Signed-off-by: Greg Kroah-Hartman drivers/staging/speakup/serialio.c | 23 +++++++++++++++++++++++ drivers/staging/speakup/speakup_apollo.c | 5 ++--- drivers/staging/speakup/speakup_audptr.c | 9 +-------- drivers/staging/speakup/speakup_spkout.c | 9 +-------- drivers/staging/speakup/spk_types.h | 2 ++ 5 files changed, 29 insertions(+), 19 deletions(-) commit a455178e59f2b3591840cc543cf637424bd572d7 Author: Pan Bian Date: Sun Apr 23 17:52:55 2017 +0800 staging: comedi: addi_apci_3xxx: check return value Function pci_ioremap_bar() will return a NULL pointer if there is no enough memory. However, in function apci3xxx_auto_attach(), the return value of function pci_ioremap_bar() is not validated. This may result in NULL dereference in following access to dev->mmio. This patch fixes the bug. Signed-off-by: Pan Bian Reviewed-by: Ian Abbott Signed-off-by: Greg Kroah-Hartman drivers/staging/comedi/drivers/addi_apci_3xxx.c | 2 ++ 1 file changed, 2 insertions(+) commit 255364f7b8a0fee3fb642b3e1521e943dd67bfb3 Author: Ian Abbott Date: Thu Apr 20 19:05:14 2017 +0100 staging: comedi: support vm_access_process for mmap'd buffer If a process that has mmap'd a COMEDI buffer is being run under a debugger such as GDB, the buffer contents are inaccessible from the debugger. Support the `access()` VM operation to allow the buffer contents to be accessed by another process. Signed-off-by: Ian Abbott Signed-off-by: Greg Kroah-Hartman drivers/staging/comedi/comedi_buf.c | 24 ++++++++++++++++++++++++ drivers/staging/comedi/comedi_fops.c | 15 +++++++++++++++ drivers/staging/comedi/comedi_internal.h | 2 ++ 3 files changed, 41 insertions(+) commit 5ab8c689f7c0c97e98b8014b7f0ede386bef5aaf Author: Arnaldo Carvalho de Melo Date: Tue Apr 25 15:30:47 2017 -0300 perf tools: Move event prototypes from util.h to event.h More needs to be done to have the actual functions and variables in a smaller .c file that can then be included in the python binding, avoiding dragging more stuff into it. Link: http://lkml.kernel.org/n/tip-uecxz7cqkssouj7tlxrkqpl4@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-c2c.c | 1 + tools/perf/builtin-top.c | 2 +- tools/perf/builtin-trace.c | 1 + tools/perf/perf.c | 1 + tools/perf/tests/hists_cumulate.c | 1 + tools/perf/tests/hists_filter.c | 1 + tools/perf/tests/hists_output.c | 1 + tools/perf/util/event.c | 1 + tools/perf/util/event.h | 8 ++++++++ tools/perf/util/evsel.c | 1 + tools/perf/util/util.h | 8 -------- 11 files changed, 17 insertions(+), 9 deletions(-) commit 50b6778c44e426d7ef7ae30e06314f511faf383a Author: Petr Mladek Date: Mon Oct 17 17:39:32 2016 +0200 IB/fmr_pool: Convert the cleanup thread into kthread worker API Kthreads are currently implemented as an infinite loop. Each has its own variant of checks for terminating, freezing, awakening. In many cases it is unclear to say in which state it is and sometimes it is done a wrong way. The plan is to convert kthreads into kthread_worker or workqueues API. It allows to split the functionality into separate operations. It helps to make a better structure. Also it defines a clean state where no locks are taken, IRQs blocked, the kthread might sleep or even be safely migrated. The kthread worker API is useful when we want to have a dedicated single thread for the work. It helps to make sure that it is available when needed. Also it allows a better control, e.g. define a scheduling priority. This patch converts the frm_pool kthread into the kthread worker API because I am not sure how busy the thread is. It is well possible that it does not need a dedicated kthread and workqueues would be perfectly fine. Well, the conversion between kthread worker API and workqueues is pretty trivial. The patch moves one iteration from the kthread into the work function. It is queued only when there is a pending work. Therefore we do not need to compare flush_ser and req_ser at the beginning. On the contrary, the same work could be queued only once at a time. Therefore it has to re-queue itself if some requests are pending. Otherwise, wake_up_process() is replaced by queuing the work. Important: The change is only compile tested. I did not find an easy way how to check it in a real life. Signed-off-by: Petr Mladek TO: Doug Ledford CC: Sean Hefty CC: Hal Rosenstock CC: linux-rdma@vger.kernel.org Signed-off-by: Doug Ledford drivers/infiniband/core/fmr_pool.c | 49 +++++++++++++++----------------------- 1 file changed, 19 insertions(+), 30 deletions(-) commit 4d6f28591fe415fc5233e9148c66a1b81ad17425 Author: Yuval Shaia Date: Tue Mar 14 16:01:57 2017 +0200 {net,IB}/{rxe,usnic}: Utilize generic mac to eui32 function This logic seems to be duplicated in (at least) three separate files. Move it to one place so code can be re-use. Signed-off-by: Yuval Shaia Reviewed-by: Leon Romanovsky drivers/infiniband/hw/usnic/usnic_common_util.h | 11 +++------- drivers/infiniband/sw/rxe/rxe.c | 4 +++- drivers/infiniband/sw/rxe/rxe_loc.h | 2 -- drivers/infiniband/sw/rxe/rxe_net.c | 28 ------------------------- drivers/infiniband/sw/rxe/rxe_verbs.c | 4 +++- include/net/addrconf.h | 22 +++++++++++++++---- 6 files changed, 27 insertions(+), 44 deletions(-) commit a7c81326ca3af41cdd5ab9a65d5d5880df66e84c Author: Yuval Shaia Date: Wed Mar 1 22:09:09 2017 +0200 IB/usnic: Remove unused functions Signed-off-by: Yuval Shaia Reviewed-by: Leon Romanovsky Signed-off-by: Doug Ledford drivers/infiniband/hw/usnic/usnic_common_util.h | 29 ------------------------- 1 file changed, 29 deletions(-) commit 05a24b9b7fe6ad58315044d11f343cc6e36073af Author: Colin Ian King Date: Thu Feb 23 11:22:53 2017 +0000 IB/iser: fix spelling mistake: "unexepected" -> "unexpected" trivial fix to spelling mistake in iser_err error message Signed-off-by: Colin Ian King Reviewed-by: Max Gurtovoy Acked-by: Sagi Grimberg Signed-off-by: Doug Ledford drivers/infiniband/ulp/iser/iser_initiator.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e821303c428eedcc20746224d590b11c7000a7e5 Author: Ganesh Goudar Date: Thu Feb 23 12:31:43 2017 +0530 iw_cxgb4: Use dsgl by default Enable the use of dsgl by default and determine whether dsgl is supported from lld info. Signed-off-by: Steve Wise Signed-off-by: Bharat Potnuri Signed-off-by: Ganesh Goudar Signed-off-by: Doug Ledford drivers/infiniband/hw/cxgb4/mem.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 19445816996d1a89682c37685fe95959631d9f32 Author: Bjørn Mork Date: Fri Apr 21 10:01:29 2017 +0200 USB: Revert "cdc-wdm: fix "out-of-sync" due to missing notifications" This reverts commit 833415a3e781 ("cdc-wdm: fix "out-of-sync" due to missing notifications") There have been several reports of wdm_read returning unexpected EIO errors with QMI devices using the qmi_wwan driver. The reporters confirm that reverting prevents these errors. I have been unable to reproduce the bug myself, and have no explanation to offer either. But reverting is the safe choice here, given that the commit was an attempt to work around a firmware problem. Living with a firmware problem is still better than adding driver bugs. Reported-by: Kasper Holtze Reported-by: Aleksander Morgado Reported-by: Daniele Palmas Cc: # v4.9+ Fixes: 833415a3e781 ("cdc-wdm: fix "out-of-sync" due to missing notifications") Signed-off-by: Bjørn Mork Acked-by: Oliver Neukum Signed-off-by: Greg Kroah-Hartman drivers/usb/class/cdc-wdm.c | 103 ++------------------------------------------ 1 file changed, 4 insertions(+), 99 deletions(-) commit 3d6159640da9c9175d1ca42f151fc1a14caded59 Author: Alexey Brodkin Date: Thu Apr 13 15:33:34 2017 +0300 usb: Make sure usb/phy/of gets built-in DWC3 driver uses of_usb_get_phy_mode() which is implemented in drivers/usb/phy/of.c and in bare minimal configuration it might not be pulled in kernel binary. In case of ARC or ARM this could be easily reproduced with "allnodefconfig" +CONFIG_USB=m +CONFIG_USB_DWC3=m. On building all ends-up with: ---------------------->8------------------ Kernel: arch/arm/boot/Image is ready Kernel: arch/arm/boot/zImage is ready Building modules, stage 2. MODPOST 5 modules ERROR: "of_usb_get_phy_mode" [drivers/usb/dwc3/dwc3.ko] undefined! make[1]: *** [__modpost] Error 1 make: *** [modules] Error 2 ---------------------->8------------------ Signed-off-by: Alexey Brodkin Cc: Greg Kroah-Hartman Cc: Masahiro Yamada Cc: Geert Uytterhoeven Cc: Nicolas Pitre Cc: Thomas Gleixner Cc: Felipe Balbi Cc: Felix Fietkau Cc: Jeremy Kerr Cc: linux-snps-arc@lists.infradead.org Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman drivers/Makefile | 1 + 1 file changed, 1 insertion(+) commit 1022ccdb1f7e13a13c5ab115c60fbbea70d7e291 Author: Phillip Potter Date: Thu Apr 20 20:53:48 2017 +0100 USB: storage: e-mail update in drivers/usb/storage/unusual_devs.h Updates the e-mail address of Phillip Potter, updater of the Nokia 6288 entry in drivers/usb/storage/unusual_devs.h Signed-off-by: Phillip Potter Signed-off-by: Greg Kroah-Hartman drivers/usb/storage/unusual_devs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 25d9baa47505ead1bcae7334991363c3bbfa1831 Author: Christoph Hellwig Date: Fri Apr 21 08:26:57 2017 +0200 nvme-lightnvm: add missing endianess conversion in nvme_nvm_end_io Found by sparse. Signed-off-by: Christoph Hellwig Reviewed-by: Matias Bjørling drivers/nvme/host/lightnvm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 7fad1fd46ccf3ee283052e948cf91edd0cd9b1c7 Author: Jon Derrick Date: Mon Apr 24 18:02:43 2017 -0600 nvme-scsi: Consider LBA format in IO splitting calculation The current command submission code uses a sector-based value when considering the maximum number of blocks per command. With a 4k-formatted namespace and a command exceeding max hardware limits, this calculation doesn't split IOs which should be split and fails in the nvme layer. This patch fixes that calculation and enables IO splitting in these circumstances. Signed-off-by: Jon Derrick Reviewed-by: Jens Axboe Signed-off-by: Christoph Hellwig drivers/nvme/host/scsi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 374cb8610ac15737acb65ca0293c21dc2205662b Author: Doug Ledford Date: Tue Apr 25 14:00:59 2017 -0400 RDMA/bnxt_re: Use IS_ERR_OR_NULL where appropriate Constructs such as if (ptr && !IS_ERR(ptr)) can be shorted to just !IS_ERR_OR_NULL(ptr) instead. Make substitutions in the bnxt_re driver where appropriate. Signed-off-by: Doug Ledford drivers/infiniband/hw/bnxt_re/ib_verbs.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit de41447aac034c4acc8d9d1ddbdcb7ce4e8a3f6f Author: Ewan D. Milne Date: Mon Apr 24 13:24:16 2017 -0400 nvme-fc: avoid memory corruption caused by calling nvmf_free_options() twice Do not call nvmf_free_options() from the nvme_fc_ctlr destructor if nvme_fc_create_ctrl() returns an error, because nvmf_create_ctrl() frees the options when an error is returned. Signed-off-by: Ewan D. Milne Signed-off-by: Christoph Hellwig drivers/nvme/host/fc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit bbe3012b73b592dfe5f4340a14373840f51887b6 Author: James Smart Date: Fri Apr 21 17:49:08 2017 -0700 lpfc: Fix memory corruption of the lpfc_ncmd->list pointers lpfc was changing the private pointer that is set/maintained by the nvme_fc transport. This caused two issues: a) the transport, on teardown may erroneous attempt to free whatever address was set; and b) lfpc uses any value set in lpfc_nvme_fcp_abort() and assumes its a valid io request. Correct issue by properly defining a context structure for lpfc. Lpfc also updated to clear the private context structure on io completion. Since this bug caused scrutiny of the way lpfc moves local request structures between lists, also cleaned up list_del()'s to list_del_inits()'s. This is a nvme-specific bug. The patch was cut against the linux-block tree, for-4.12/block tree. It should be pulled in through that tree. Signed-off-by: Dick Kennedy Signed-off-by: James Smart Signed-off-by: Christoph Hellwig drivers/scsi/lpfc/lpfc_nvme.c | 17 +++++++++++------ drivers/scsi/lpfc/lpfc_nvme.h | 4 ++++ 2 files changed, 15 insertions(+), 6 deletions(-) commit 5e1fc7c5ba00599ccd7096eef3e9fd3362c1230f Author: Wei Yongjun Date: Tue Apr 25 11:36:50 2017 +0000 drivers: net: xgene-v2: Fix error return code in xge_mdio_config() Fix to return error code -ENODEV from the no PHY found error handling case instead of 0, as done elsewhere in this function. Signed-off-by: Wei Yongjun Signed-off-by: David S. Miller drivers/net/ethernet/apm/xgene-v2/mdio.c | 1 + 1 file changed, 1 insertion(+) commit ebbd1dfb2620fb95e1d850286c80068766222276 Author: Colin Ian King Date: Fri Feb 17 15:35:22 2017 +0000 RDMA/bnxt_re: remove redundant initialization of rc to zero rc is initialized to zero but is then updated by calls to bnxt_qplib_free_fast_reg_page_list and/or bnxt_qpliob_free_mrw so the initialization is redundant and can be removed. Detected with CoverityScan, CID#1408448 ("Unused Value") Signed-off-by: Colin Ian King Reviewed-by: Laurence Oberman Signed-off-by: Doug Ledford drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit b5cdae3291f7be7a34e75affe4c0ec1f7f328b64 Author: David S. Miller Date: Tue Apr 18 15:36:58 2017 -0400 net: Generic XDP This provides a generic SKB based non-optimized XDP path which is used if either the driver lacks a specific XDP implementation, or the user requests it via a new IFLA_XDP_FLAGS value named XDP_FLAGS_SKB_MODE. It is arguable that perhaps I should have required something like this as part of the initial XDP feature merge. I believe this is critical for two reasons: 1) Accessibility. More people can play with XDP with less dependencies. Yes I know we have XDP support in virtio_net, but that just creates another depedency for learning how to use this facility. I wrote this to make life easier for the XDP newbies. 2) As a model for what the expected semantics are. If there is a pure generic core implementation, it serves as a semantic example for driver folks adding XDP support. One thing I have not tried to address here is the issue of XDP_PACKET_HEADROOM, thanks to Daniel for spotting that. It seems incredibly expensive to do a skb_cow(skb, XDP_PACKET_HEADROOM) or whatever even if the XDP program doesn't try to push headers at all. I think we really need the verifier to somehow propagate whether certain XDP helpers are used or not. v5: - Handle both negative and positive offset after running prog - Fix mac length in XDP_TX case (Alexei) - Use rcu_dereference_protected() in free_netdev (kbuild test robot) v4: - Fix MAC header adjustmnet before calling prog (David Ahern) - Disable LRO when generic XDP is installed (Michael Chan) - Bypass qdisc et al. on XDP_TX and record the event (Alexei) - Do not perform generic XDP on reinjected packets (DaveM) v3: - Make sure XDP program sees packet at MAC header, push back MAC header if we do XDP_TX. (Alexei) - Elide GRO when generic XDP is in use. (Alexei) - Add XDP_FLAG_SKB_MODE flag which the user can use to request generic XDP even if the driver has an XDP implementation. (Alexei) - Report whether SKB mode is in use in rtnl_xdp_fill() via XDP_FLAGS attribute. (Daniel) v2: - Add some "fall through" comments in switch statements based upon feedback from Andrew Lunn - Use RCU for generic xdp_prog, thanks to Johannes Berg. Tested-by: Andy Gospodarek Tested-by: Jesper Dangaard Brouer Tested-by: David Ahern Signed-off-by: David S. Miller include/linux/netdevice.h | 8 +++ include/uapi/linux/if_link.h | 4 +- net/core/dev.c | 155 +++++++++++++++++++++++++++++++++++++++++-- net/core/gro_cells.c | 2 +- net/core/rtnetlink.c | 40 ++++++----- 5 files changed, 187 insertions(+), 22 deletions(-) commit 4da2b1eb230ba4ad19b58984dc52e05b1073df5f Author: Finn Thain Date: Sun Apr 2 17:08:05 2017 +1000 scsi: mac_esp: Replace bogus memory barrier with spinlock Commit da244654c66e ("[SCSI] mac_esp: fix for quadras with two esp chips") added mac_scsi_esp_intr() to handle the IRQ lines from a pair of on-board ESP chips (a normal shared IRQ did not work). Proper mutual exclusion was missing from that patch. This patch fixes race conditions between comparison and assignment of esp_chips[] pointers. Signed-off-by: Finn Thain Reviewed-by: Michael Schmitz Signed-off-by: Martin K. Petersen drivers/scsi/mac_esp.c | 33 +++++++++++++++++++++++---------- 1 file changed, 23 insertions(+), 10 deletions(-) commit 62d57f20ff6d9715c5d7605c5b6b1a2e6f4fbbd8 Author: Colin Ian King Date: Mon Apr 24 18:04:18 2017 +0100 scsi: fcoe: make fcoe_e_d_tov and fcoe_r_a_tov static These module parameter variables don't need global scope, make them static Signed-off-by: Colin Ian King Acked-by: Johannes Thumshirn Signed-off-by: Martin K. Petersen drivers/scsi/fcoe/fcoe.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 868ed5a5b73f7cc18432ffe6e8d8addd395e91a1 Author: Damien Le Moal Date: Mon Apr 24 16:51:15 2017 +0900 scsi: sd_zbc: Do not write lock zones for reset Resetting a zone write pointer is equivalent to discarding sectors: after a reset, the zone sectors will contain zeros (or the format pattern). So there is no need for mutual exclusion between a zone reset and write. Similarly to discard, make it the responsability of the user to properly synchronize between reset and write (as is done now for discard and write). Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Signed-off-by: Martin K. Petersen drivers/scsi/sd_zbc.c | 42 ++++++++++++++++-------------------------- 1 file changed, 16 insertions(+), 26 deletions(-) commit f70532406aa4193e484b1e3c4d7d613f39257a44 Author: Bart Van Assche Date: Mon Apr 24 16:51:14 2017 +0900 scsi: sd_zbc: Remove superfluous assignments A value is assigned to the variable 'capacity' in sd_zbc_read_zones() but that value is never used. Hence remove the variable 'capacity'. [Damien: There is no need to initialize to 0 the variable 'ret' in sd_zbc_read_zones()] Signed-off-by: Bart Van Assche Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Signed-off-by: Martin K. Petersen drivers/scsi/sd_zbc.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit a90dfdc2dea1ce8ab87e3949c3c6bab3c1e36137 Author: Damien Le Moal Date: Mon Apr 24 16:51:13 2017 +0900 scsi: sd: sd_zbc: Rename sd_zbc_setup_write_cmnd Rename sd_zbc_setup_write_cmnd() to sd_zbc_write_lock_zone() to be clear about what the function actually does. To be consistent, also rename sd_zbc_cancel_write_cmnd() to sd_zbc_write_unlock_zone(). No functional change is introduced by this patch. Signed-off-by: Damien Le Moal Reviewed-by: Bart Van Assche Reviewed-by: Christoph Hellwig Signed-off-by: Martin K. Petersen drivers/scsi/sd.c | 6 +++--- drivers/scsi/sd.h | 8 ++++---- drivers/scsi/sd_zbc.c | 12 ++++-------- 3 files changed, 11 insertions(+), 15 deletions(-) commit 2908769c35fbd3de7b874b60b95ba81546e3c920 Author: Damien Le Moal Date: Mon Apr 24 16:51:12 2017 +0900 scsi: Improve scsi_get_sense_info_fld Use get_unaligned_be32 and get_unaligned_be64 to obtain values from the sense buffer instead of open coding the operations. Also change the function return value to a bool and fix the function signature declaration to remove spaces triggering checkpatch warnings. No functional change is introduced by this patch. Signed-off-by: Damien Le Moal Reviewed-by: Bart Van Assche Reviewed-by: Christoph Hellwig Signed-off-by: Martin K. Petersen drivers/scsi/scsi_error.c | 38 +++++++++++++++----------------------- include/scsi/scsi_eh.h | 4 ++-- 2 files changed, 17 insertions(+), 25 deletions(-) commit d227ec267ff4fa91ac2db9965d5392cf825be511 Author: Christoph Hellwig Date: Mon Apr 24 19:05:12 2017 -0400 scsi: sd: Cleanup sd_done sense data handling Use a switch for the sense key, and remove two pointless variables that are only used once. [mkp: Added UNMAP comment and removed good_bytes based on comment from Damien] Signed-off-by: Christoph Hellwig Signed-off-by: Martin K. Petersen drivers/scsi/sd.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) commit 5136a4fd5832af12ec5e5961c52a27a524a0a9d9 Author: Wei Yongjun Date: Tue Apr 25 16:15:30 2017 +0000 lightnvm: fix possible memory leak in pblk_bb_discovery() 'blks' is malloced in pblk_bb_discovery() and should be freed before leaving from the nvm_get_tgt_bb_tbl() error handling cases, otherwise it will cause memory leak. Also skip assign blks to rlun->bb_list when error. Fixes: a4bd217b4326 ("lightnvm: physical block device (pblk) target") Signed-off-by: Wei Yongjun Reviewed-by: Javier González Signed-off-by: Jens Axboe drivers/lightnvm/pblk-init.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit c4cf1acdb186436b88cc9aeaf08322bc49fec183 Author: Darrick J. Wong Date: Thu Apr 20 15:09:05 2017 -0700 xfs: better log intent item refcount checking Use ASSERTs on the log intent item refcounts so that we fail noisily if anyone tries to double-free the item. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig fs/xfs/xfs_bmap_item.c | 1 + fs/xfs/xfs_extfree_item.c | 1 + fs/xfs/xfs_refcount_item.c | 1 + fs/xfs/xfs_rmap_item.c | 1 + 4 files changed, 4 insertions(+) commit 20e8a063786050083fe05b4f45be338c60b49126 Author: Brian Foster Date: Fri Apr 21 12:40:44 2017 -0700 xfs: fix up quotacheck buffer list error handling The quotacheck error handling of the delwri buffer list assumes the resident buffers are locked and doesn't clear the _XBF_DELWRI_Q flag on the buffers that are dequeued. This can lead to assert failures on buffer release and possibly other locking problems. Move this code to a delwri queue cancel helper function to encapsulate the logic required to properly release buffers from a delwri queue. Update the helper to clear the delwri queue flag and call it from quotacheck. Signed-off-by: Brian Foster Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/xfs_buf.c | 24 ++++++++++++++++++++++++ fs/xfs/xfs_buf.h | 1 + fs/xfs/xfs_qm.c | 7 +------ 3 files changed, 26 insertions(+), 6 deletions(-) commit 27af1bbf524459962d1477a38ac6e0b7f79aaecc Author: Christoph Hellwig Date: Fri Apr 21 11:24:42 2017 -0700 xfs: remove xfs_trans_ail_delete_bulk xfs_iflush_done uses an on-stack variable length array to pass the log items to be deleted to xfs_trans_ail_delete_bulk. On-stack VLAs are a nasty gcc extension that can lead to unbounded stack allocations, but fortunately we can easily avoid them by simply open coding xfs_trans_ail_delete_bulk in xfs_iflush_done, which is the only caller of it except for the single-item xfs_trans_ail_delete. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/xfs_inode_item.c | 29 +++++++++++--------- fs/xfs/xfs_trans_ail.c | 71 ++++++++++++++++++++++++------------------------- fs/xfs/xfs_trans_priv.h | 15 +++-------- 3 files changed, 55 insertions(+), 60 deletions(-) commit 3f88a15ae0f15f8dec3b10a55d02d1c1defa73c6 Author: Christoph Hellwig Date: Fri Apr 21 11:24:42 2017 -0700 xfs: don't use bool values in trace buffers Using bool values produces sparse warnings of this form: fs/xfs/./xfs_trace.h:2252:1: warning: odd constant _Bool cast (ffffffffffffffff becomes 1) fs/xfs/./xfs_trace.h:2252:1: warning: odd constant _Bool cast (ffffffffffffffff becomes 1) fs/xfs/./xfs_trace.h:2278:1: warning: odd constant _Bool cast (ffffffffffffffff becomes 1) fs/xfs/./xfs_trace.h:2278:1: warning: odd constant _Bool cast (ffffffffffffffff becomes 1) fs/xfs/./xfs_trace.h:2307:1: warning: odd constant _Bool cast (ffffffffffffffff becomes 1) Just use a char instead to fix those up. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/xfs_trace.h | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 12e4a381c5cefa4bf54547cb51d98241a54e29f3 Author: Darrick J. Wong Date: Sun Apr 23 10:45:21 2017 -0700 xfs: fix getfsmap userspace memory corruption while setting OF_LAST At the end of a getfsmap call, we will set FMR_OF_LAST in the last struct fsmap that was handed in by userspace if we've truly run out of space mapping record (as opposed to simply running out of space in the user array). Unfortunately, fmh_entries is the wrong check for whether or not we've filled out anything in the user array because the ioctl provides that fmh_count==0 sets fmh_entries without filling out the user array. Therefore we end up writing things into user memory areas that we weren't given, and kaboom. Since Christoph amended the getfsmap structure to track the number of fsmap entries we've actually filled out, use that as part of deciding if we have to set the OF_LAST flag. Signed-off-by: Darrick J. Wong Reviewed-by: Christoph Hellwig fs/xfs/xfs_ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9d17e14cc052ecebb572d4546c7deeddc0c6e040 Author: Christoph Hellwig Date: Fri Apr 21 11:24:41 2017 -0700 xfs: fix __user annotations for xfs_ioc_getfsmap By passing the whole fsmap_head structure and an index we can get the user point annotations right for the embedded variable sized array in struct fsmap_head. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong [darrick: change idx to unsigned int] Signed-off-by: Darrick J. Wong fs/xfs/xfs_ioctl.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) commit e2a641922a3592b5ea226624d5abeb13eb49622c Author: Christoph Hellwig Date: Fri Apr 21 11:24:40 2017 -0700 xfs: corruption needs to respect endianess too! At least if we want to be able to recognize the pattern. Add a missing byte swap to the corruption injection case in xlog_sync. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/xfs_log.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit ef2b67ecf8ddbcb30f98f7ce6876872fb3e925f6 Author: Christoph Hellwig Date: Fri Apr 21 11:24:40 2017 -0700 xfs: use NULL instead of 0 to initialize a pointer in xfs_ioc_getfsmap Found by sparse. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/xfs_ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fad5656b2247244c9fe4f30d63e4c190c5725840 Author: Christoph Hellwig Date: Fri Apr 21 11:24:39 2017 -0700 xfs: use NULL instead of 0 to initialize a pointer in xfs_getfsmap Found by sparse. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/xfs_fsmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 0c1d9e4a61590c2a4d657d1deddd1674f1565097 Author: Christoph Hellwig Date: Thu Apr 20 09:42:48 2017 -0700 xfs: simplify validation of the unwritten extent bit XFS only supports the unwritten extent bit in the data fork, and only if the file system has a version 5 superblock or the unwritten extent feature bit. We currently have two routines that validate the invariant: xfs_check_nostate_extents which return -EFSCORRUPTED when it's not met, and xfs_validate_extent that triggers and assert in debug build. Both of them iterate over all extents of an inode fork when called, which isn't very efficient. This patch instead adds a new helper that verifies the invariant one extent at a time, and calls it from the places where we iterate over all extents to converted them from or two the in-memory format. The callers then return -EFSCORRUPTED when reading invalid extents from disk, or trigger an assert when writing them to disk. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/libxfs/xfs_bmap.c | 16 +------- fs/xfs/libxfs/xfs_bmap.h | 2 - fs/xfs/libxfs/xfs_bmap_btree.c | 26 ------------ fs/xfs/libxfs/xfs_bmap_btree.h | 21 ++++++---- fs/xfs/libxfs/xfs_format.h | 8 ---- fs/xfs/libxfs/xfs_inode_fork.c | 90 ++++++++++++------------------------------ 6 files changed, 41 insertions(+), 122 deletions(-) commit 37f7f9bbf3b914e94f81426f6f59a3f97f4dc562 Author: Christoph Hellwig Date: Wed Apr 19 15:19:49 2017 -0700 xfs: remove unused values from xfs_exntst_t We only ever use the normal and unwritten states. And the actual ondisk format (this enum isn't despite being in xfs_format.h) only has space for the unwritten bit anyway. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/libxfs/xfs_format.h | 1 - 1 file changed, 1 deletion(-) commit 895e9bfc9e36c8e39ea4d2129dc2cbde1aafec99 Author: Christoph Hellwig Date: Wed Apr 19 15:19:45 2017 -0700 xfs: remove the unused XFS_MAXLINK_1 define Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/libxfs/xfs_format.h | 2 -- 1 file changed, 2 deletions(-) commit 4f1adf3373f072246c14119b2aa6dfb4d6510a43 Author: Eric Sandeen Date: Wed Apr 19 15:19:32 2017 -0700 xfs: more do_div cleanups On some architectures do_div does the pointer compare trick to make sure that we've sent it an unsigned 64-bit number. (Why unsigned? I don't know.) Fix up the few places that squawk about this; in xfs_bmap_wants_extents() we just used a bare int64_t so change that to unsigned. In xfs_adjust_extent_unmap_boundaries() all we wanted was the mod, and we have an xfs-specific function to handle that w/o side effects, which includes proper casting for do_div. In xfs_daddr_to_ag[b]no, we were using the wrong type anyway; XFS_BB_TO_FSBT returns a block in the filesystem, so use xfs_rfsblock_t not xfs_daddr_t, and gain the unsignedness from that type as a bonus. Signed-off-by: Eric Sandeen Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/libxfs/xfs_bmap.c | 2 +- fs/xfs/xfs_bmap_util.c | 5 +---- fs/xfs/xfs_mount.h | 4 ++-- 3 files changed, 4 insertions(+), 7 deletions(-) commit 90115407c5847828d82af9bc139f690600a36219 Author: Eric Sandeen Date: Wed Apr 19 12:55:57 2017 -0700 xfs: remove use of do_div with 32-bit dividend in quota The kbuild test robot caught this; in debug code we have another caller of do_div with a 32-bit dividend (j) which is caught now that we are using the kernel-supplied do_div. None of the values used here are 64-bit; just use simple division. Signed-off-by: Eric Sandeen Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/xfs_qm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 42bf9dba40086e3d18dc29eb379f13df219d3f22 Author: Hou Tao Date: Fri Apr 14 11:43:27 2017 -0700 xfs: remove the trailing newline used in the fmt parameter of TP_printk The trailing newlines wil lead to extra newlines in the trace file which looks like the following output, so remove them. >kworker/4:1H-1508 [004] .... 47879.101608: xfs_discard_extent: dev 8:0 > >kworker/u16:2-238 [004] .... 47879.101725: xfs_extent_busy_clear: dev 8:0 Signed-off-by: Hou Tao Reviewed-by: Darrick J. Wong [darrick: fix the getfsmap tracepoints too] Signed-off-by: Darrick J. Wong fs/xfs/xfs_trace.h | 29 +++++++++++++++-------------- 1 file changed, 15 insertions(+), 14 deletions(-) commit cb52ee334a45ae6c78a3999e4b473c43ddc528f4 Author: Brian Foster Date: Thu Apr 20 08:06:47 2017 -0700 xfs: prevent multi-fsb dir readahead from reading random blocks Directory block readahead uses a complex iteration mechanism to map between high-level directory blocks and underlying physical extents. This mechanism attempts to traverse the higher-level dir blocks in a manner that handles multi-fsb directory blocks and simultaneously maintains a reference to the corresponding physical blocks. This logic doesn't handle certain (discontiguous) physical extent layouts correctly with multi-fsb directory blocks. For example, consider the case of a 4k FSB filesystem with a 2 FSB (8k) directory block size and a directory with the following extent layout: EXT: FILE-OFFSET BLOCK-RANGE AG AG-OFFSET TOTAL 0: [0..7]: 88..95 0 (88..95) 8 1: [8..15]: 80..87 0 (80..87) 8 2: [16..39]: 168..191 0 (168..191) 24 3: [40..63]: 5242952..5242975 1 (72..95) 24 Directory block 0 spans physical extents 0 and 1, dirblk 1 lies entirely within extent 2 and dirblk 2 spans extents 2 and 3. Because extent 2 is larger than the directory block size, the readahead code erroneously assumes the block is contiguous and issues a readahead based on the physical mapping of the first fsb of the dirblk. This results in read verifier failure and a spurious corruption or crc failure, depending on the filesystem format. Further, the subsequent readahead code responsible for walking through the physical table doesn't correctly advance the physical block reference for dirblk 2. Instead of advancing two physical filesystem blocks, the first iteration of the loop advances 1 block (correctly), but the subsequent iteration advances 2 more physical blocks because the next physical extent (extent 3, above) happens to cover more than dirblk 2. At this point, the higher-level directory block walking is completely off the rails of the actual physical layout of the directory for the respective mapping table. Update the contiguous dirblock logic to consider the current offset in the physical extent to avoid issuing directory readahead to unrelated blocks. Also, update the mapping table advancing code to consider the current offset within the current dirblock to avoid advancing the mapping reference too far beyond the dirblock. Signed-off-by: Brian Foster Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/xfs_dir2_readdir.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit 023cc840b40fad95c6fe26fff1d380a8c9d45939 Author: Eric Sandeen Date: Thu Apr 13 15:15:47 2017 -0700 xfs: handle array index overrun in xfs_dir2_leaf_readbuf() Carlos had a case where "find" seemed to start spinning forever and never return. This was on a filesystem with non-default multi-fsb (8k) directory blocks, and a fragmented directory with extents like this: 0:[0,133646,2,0] 1:[2,195888,1,0] 2:[3,195890,1,0] 3:[4,195892,1,0] 4:[5,195894,1,0] 5:[6,195896,1,0] 6:[7,195898,1,0] 7:[8,195900,1,0] 8:[9,195902,1,0] 9:[10,195908,1,0] 10:[11,195910,1,0] 11:[12,195912,1,0] 12:[13,195914,1,0] ... i.e. the first extent is a contiguous 2-fsb dir block, but after that it is fragmented into 1 block extents. At the top of the readdir path, we allocate a mapping array which (for this filesystem geometry) can hold 10 extents; see the assignment to map_info->map_size. During readdir, we are therefore able to map extents 0 through 9 above into the array for readahead purposes. If we count by 2, we see that the last mapped index (9) is the first block of a 2-fsb directory block. At the end of xfs_dir2_leaf_readbuf() we have 2 loops to fill more readahead; the outer loop assumes one full dir block is processed each loop iteration, and an inner loop that ensures that this is so by advancing to the next extent until a full directory block is mapped. The problem is that this inner loop may step past the last extent in the mapping array as it tries to reach the end of the directory block. This will read garbage for the extent length, and as a result the loop control variable 'j' may become corrupted and never fail the loop conditional. The number of valid mappings we have in our array is stored in map->map_valid, so stop this inner loop based on that limit. There is an ASSERT at the top of the outer loop for this same condition, but we never made it out of the inner loop, so the ASSERT never fired. Huge appreciation for Carlos for debugging and isolating the problem. Debugged-and-analyzed-by: Carlos Maiolino Signed-off-by: Eric Sandeen Tested-by: Carlos Maiolino Reviewed-by: Carlos Maiolino Reviewed-by: Bill O'Donnell Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/xfs_dir2_readdir.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) commit a008c31c7ef9a4106dbadf21b3bcb7e89826a5d7 Author: Chandan Rajendra Date: Wed Apr 12 11:03:20 2017 -0700 iomap_dio_rw: Prevent reading file data beyond iomap_dio->i_size On a ppc64 machine executing overlayfs/019 with xfs as the lower and upper filesystem causes the following call trace, WARNING: CPU: 2 PID: 8034 at /root/repos/linux/fs/iomap.c:765 .iomap_dio_actor+0xcc/0x420 Modules linked in: CPU: 2 PID: 8034 Comm: fsstress Tainted: G L 4.11.0-rc5-next-20170405 #100 task: c000000631314880 task.stack: c0000003915d4000 NIP: c00000000035a72c LR: c00000000035a6f4 CTR: c00000000035a660 REGS: c0000003915d7570 TRAP: 0700 Tainted: G L (4.11.0-rc5-next-20170405) MSR: 800000000282b032 CR: 24004284 XER: 00000000 CFAR: c0000000006f7190 SOFTE: 1 GPR00: c00000000035a6f4 c0000003915d77f0 c0000000015a3f00 000000007c22f600 GPR04: 000000000022d000 0000000000002600 c0000003b2d56360 c0000003915d7960 GPR08: c0000003915d7cd0 0000000000000002 0000000000002600 c000000000521cc0 GPR12: 0000000024004284 c00000000fd80a00 000000004b04ae64 ffffffffffffffff GPR16: 000000001000ca70 0000000000000000 c0000003b2d56380 c00000000153d2b8 GPR20: 0000000000000010 c0000003bc87bac8 0000000000223000 000000000022f5ff GPR24: c0000003b2d56360 000000000000000c 0000000000002600 000000000022d000 GPR28: 0000000000000000 c0000003915d7960 c0000003b2d56360 00000000000001ff NIP [c00000000035a72c] .iomap_dio_actor+0xcc/0x420 LR [c00000000035a6f4] .iomap_dio_actor+0x94/0x420 Call Trace: [c0000003915d77f0] [c00000000035a6f4] .iomap_dio_actor+0x94/0x420 (unreliable) [c0000003915d78f0] [c00000000035b9f4] .iomap_apply+0xf4/0x1f0 [c0000003915d79d0] [c00000000035c320] .iomap_dio_rw+0x230/0x420 [c0000003915d7ae0] [c000000000512a14] .xfs_file_dio_aio_read+0x84/0x160 [c0000003915d7b80] [c000000000512d24] .xfs_file_read_iter+0x104/0x130 [c0000003915d7c10] [c0000000002d6234] .__vfs_read+0x114/0x1a0 [c0000003915d7cf0] [c0000000002d7a8c] .vfs_read+0xac/0x1a0 [c0000003915d7d90] [c0000000002d96b8] .SyS_read+0x58/0x100 [c0000003915d7e30] [c00000000000b8e0] system_call+0x38/0xfc Instruction dump: 78630020 7f831b78 7ffc07b4 7c7ce039 40820360 a13d0018 2f890003 419e0288 2f890004 419e00a0 2f890001 419e02a8 <0fe00000> 3b80fffb 38210100 7f83e378 The above problem can also be recreated on a regular xfs filesystem using the command, $ fsstress -d /mnt -l 1000 -n 1000 -p 1000 The reason for the call trace is, 1. When 'reserving' blocks for delayed allocation , XFS reserves more blocks (i.e. past file's current EOF) than required. This is done because XFS assumes that userspace might write more data and hence 'reserving' more blocks might lead to the file's new data being stored contiguously on disk. 2. The in-memory 'struct xfs_bmbt_irec' mapping the file's last extent would then cover the prealloc-ed EOF blocks in addition to the regular blocks. 3. When flushing the dirty blocks to disk, we only flush data till the file's EOF. But before writing out the dirty data, we allocate blocks on the disk for holding the file's new data. This allocation includes the blocks that are part of the 'prealloc EOF blocks'. 4. Later, when the last reference to the inode is being closed, XFS frees the unused 'prealloc EOF blocks' in xfs_inactive(). In step 3 above, When allocating space on disk for the delayed allocation range, the space allocator might sometimes allocate less blocks than required. If such an allocation ends right at the current EOF of the file, We will not be able to clear the "delayed allocation" flag for the 'prealloc EOF blocks', since we won't have dirty buffer heads associated with that range of the file. In such a situation if a Direct I/O read operation is performed on file range [X, Y] (where X < EOF and Y > EOF), we flush dirty data in the range [X, Y] and invalidate page cache for that range (Refer to iomap_dio_rw()). Later for performing the Direct I/O read, XFS obtains the extent items (which are still cached in memory) for the file range. When doing so we are not supposed to get an extent item with IOMAP_DELALLOC flag set, since the previous "flush" operation should have converted any delayed allocation data in the range [X, Y]. Hence we end up hitting a WARN_ON_ONCE(1) statement in iomap_dio_actor(). This commit fixes the bug by preventing the read operation from going beyond iomap_dio->i_size. Reported-by: Santhosh G Signed-off-by: Chandan Rajendra Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/iomap.c | 3 +++ 1 file changed, 3 insertions(+) commit 7590632a33ef2d264665576d3d54e50f906fa758 Author: Christoph Hellwig Date: Tue Apr 11 16:45:57 2017 -0700 xfs: remove bmap block allocation retries Now that reflink operations don't set the firstblock value we don't need the workarounds for non-NULL firstblock values without a prior allocation. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/libxfs/xfs_bmap.c | 29 ----------------------------- fs/xfs/libxfs/xfs_bmap_btree.c | 17 ----------------- 2 files changed, 46 deletions(-) commit bf8eadbacb24e321c99bbdd901589942712810d1 Author: Christoph Hellwig Date: Tue Apr 11 16:45:56 2017 -0700 xfs: remove xfs_bmap_remap_alloc The main thing that xfs_bmap_remap_alloc does is fixing the AGFL, similar to what we do in the space allocator. But the reflink code doesn't touch the allocation btree unlike the normal space allocator, so we couldn't care less about the state of the AGFL. So remove xfs_bmap_remap_alloc and just handle the di_nblocks update in the caller. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/libxfs/xfs_bmap.c | 60 ++---------------------------------------------- fs/xfs/xfs_trace.h | 25 -------------------- 2 files changed, 2 insertions(+), 83 deletions(-) commit 6ebd5a4413e2afd1b1129135e1cf4a84092550e2 Author: Christoph Hellwig Date: Tue Apr 11 16:45:55 2017 -0700 xfs: introduce xfs_bmapi_remap Add a new helper to be used for reflink extent list additions instead of funneling them through xfs_bmapi_write and overloading the firstblock member in struct xfs_bmalloca and struct xfs_alloc_args. With some small changes to xfs_bmap_remap_alloc this also means we do not need a xfs_bmalloca structure for this case at all. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/libxfs/xfs_bmap.c | 157 +++++++++++++++++++++++++++++++++-------------- 1 file changed, 112 insertions(+), 45 deletions(-) commit 6d04558f9fa9d16c4aba7243030f22ef0c1bbf32 Author: Christoph Hellwig Date: Tue Apr 11 16:45:54 2017 -0700 xfs: pass individual arguments to xfs_bmap_add_extent_hole_real For the reflink case we'd much rather pass the required arguments than faking up a struct xfs_bmalloca. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/libxfs/xfs_bmap.c | 123 ++++++++++++++++++++++++----------------------- 1 file changed, 64 insertions(+), 59 deletions(-) commit 39e07daa46e34c724ad33f903d166a0a62c20900 Author: Christoph Hellwig Date: Tue Apr 11 16:45:53 2017 -0700 xfs: remove attr fork handling in xfs_bmap_finish_one We never do COW operations for the attr fork, so don't pretend we handle them. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/libxfs/xfs_bmap.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) commit 52813fb13ff90bd9c39a93446cbf1103c290b6e9 Author: Christoph Hellwig Date: Tue Apr 11 16:45:52 2017 -0700 xfs: fix integer truncation in xfs_bmap_remap_alloc bno should be a xfs_fsblock_t, which is 64-bit wides instead of a xfs_aglock_t, which truncates the value to 32 bits. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong fs/xfs/libxfs/xfs_bmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e5bc9c3c5432f5531a58e6fdd9f6c6587f2137b3 Author: Guoqing Jiang Date: Mon Apr 24 15:58:04 2017 +0800 md: clear WantReplacement once disk is removed We can clear 'WantReplacement' flag directly no matter it's replacement existed or not since the semantic is same as before. Also since the disk is removed from array, then it is straightforward to remove 'WantReplacement' flag and the comments in raid10/5 can be removed as well. Signed-off-by: Guoqing Jiang Signed-off-by: Shaohua Li drivers/md/raid1.c | 6 +++--- drivers/md/raid10.c | 8 ++------ drivers/md/raid5.c | 9 +++------ 3 files changed, 8 insertions(+), 15 deletions(-) commit 2f7878c06e2d227aa5c405ddde356403b83e3509 Author: Wei Yongjun Date: Tue Apr 25 07:07:18 2017 +0000 qed: fix invalid use of sizeof in qed_alloc_qm_data() sizeof() when applied to a pointer typed expression gives the size of the pointer, not that of the pointed data. Fixes: b5a9ee7cf3be ("qed: Revise QM configuration") Signed-off-by: Wei Yongjun Acked-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8fe45924387be6b5c1be59a7eb330790c61d5d10 Author: Teng Qin Date: Mon Apr 24 19:00:37 2017 -0700 bpf: map_get_next_key to return first key on NULL When iterating through a map, we need to find a key that does not exist in the map so map_get_next_key will give us the first key of the map. This often requires a lot of guessing in production systems. This patch makes map_get_next_key return the first key when the key pointer in the parameter is NULL. Signed-off-by: Teng Qin Signed-off-by: Alexei Starovoitov Acked-by: Daniel Borkmann Signed-off-by: David S. Miller include/trace/events/bpf.h | 10 +++++++--- kernel/bpf/arraymap.c | 2 +- kernel/bpf/hashtab.c | 9 +++++---- kernel/bpf/syscall.c | 20 ++++++++++++-------- tools/testing/selftests/bpf/test_maps.c | 29 +++++++++++++++++++++++++---- 5 files changed, 50 insertions(+), 20 deletions(-) commit 472ecf084a7687347f79720c83881c07407bfd8b Author: Mike Maloney Date: Mon Apr 24 21:29:11 2017 -0400 selftests/net: Fix broken test case in psock_fanout The error return falue form sock_fanout_open is -1, not zero. One test case was checking for 0 instead of -1. Tested: Built and tested in clean client. Signed-off-by: Mike Maloney Signed-off-by: David S. Miller tools/testing/selftests/net/psock_fanout.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 799dbe3e1ce312801cf8755a45bbdd6557560ec4 Author: Ivan Khoronzhuk Date: Mon Apr 24 23:54:06 2017 +0300 net: ethernet: ti: netcp_core: remove unused compl queue mapping This code is unused and probably was unintentionally left while moving completion queue mapping in submit function. Signed-off-by: Ivan Khoronzhuk Signed-off-by: David S. Miller drivers/net/ethernet/ti/netcp_core.c | 4 ---- 1 file changed, 4 deletions(-) commit 51c6bd7cbe0366b642d8ac90d98739c39ab091a9 Author: Shuah Khan Date: Fri Apr 21 18:01:51 2017 -0600 selftests: gpio: fix clean target to remove all generated files and dirs gpio test creates executables, object files, and include directory under selftests directory. Enhance clean target to remove all files it generates. Signed-off-by: Shuah Khan tools/testing/selftests/gpio/Makefile | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) commit 26d5ad3b96cf9c2a161c8e685e427966c91c587b Author: Shuah Khan Date: Fri Apr 21 18:00:39 2017 -0600 selftests: add gpio generated files to .gitignore gpio test generates files in selftests directory. Add them to .gitignore. Signed-off-by: Shuah Khan tools/testing/selftests/.gitignore | 4 ++++ 1 file changed, 4 insertions(+) commit c1a9f80e048cd0fc492e8a49dcb952317d0e97ce Merge: 3678427 eaf3c0c Author: David S. Miller Date: Tue Apr 25 11:49:33 2017 -0400 Merge branch 'qed-vf-tunnel' Manish Chopra says: ==================== qed/qede: VF tunnelling support With this series VFs can run vxlan/geneve/gre tunnels over it. Please consider applying this series to "net-next" ==================== Signed-off-by: David S. Miller commit eaf3c0c6b4e307e5c7e6cbeb8c5a17be7feee249 Author: Chopra, Manish Date: Mon Apr 24 10:00:49 2017 -0700 qed - VF tunnelling support [VXLAN/GENEVE/GRE] This patch adds hardware channel APIs support between VF and PF for tunnelling configuration for the VFs. According to that configuration VFs can run VXLAN/GENEVE/GRE tunnels over it with tunnel features offloaded. Using these APIs VF can also request for UDP ports configuration to the PF, although PF and it's child VFs share the same port. Signed-off-by: Manish Chopra Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed.h | 1 + drivers/net/ethernet/qlogic/qed/qed_dev.c | 15 +- drivers/net/ethernet/qlogic/qed/qed_l2.c | 3 - drivers/net/ethernet/qlogic/qed/qed_main.c | 8 + drivers/net/ethernet/qlogic/qed/qed_sp_commands.c | 3 + drivers/net/ethernet/qlogic/qed/qed_sriov.c | 217 ++++++++++++++++++++++ drivers/net/ethernet/qlogic/qed/qed_vf.c | 149 +++++++++++++++ drivers/net/ethernet/qlogic/qed/qed_vf.h | 54 ++++++ 8 files changed, 446 insertions(+), 4 deletions(-) commit 97379f15c21e7ae27eb1ecf84adcace42c960c87 Author: Chopra, Manish Date: Mon Apr 24 10:00:48 2017 -0700 qed/qede: Add UDP ports in bulletin board This patch adds support for UDP ports in bulletin board to notify UDP ports change to the VFs Signed-off-by: Manish Chopra Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_l2.c | 19 +++++++++++++++++++ drivers/net/ethernet/qlogic/qed/qed_sriov.c | 23 +++++++++++++++++++++++ drivers/net/ethernet/qlogic/qed/qed_sriov.h | 9 +++++++++ drivers/net/ethernet/qlogic/qed/qed_vf.c | 16 ++++++++++++++++ drivers/net/ethernet/qlogic/qed/qed_vf.h | 4 +++- drivers/net/ethernet/qlogic/qede/qede.h | 1 + drivers/net/ethernet/qlogic/qede/qede_filter.c | 11 +++++++++++ drivers/net/ethernet/qlogic/qede/qede_main.c | 1 + include/linux/qed/qed_eth_if.h | 1 + 9 files changed, 84 insertions(+), 1 deletion(-) commit 327a2b750c486c8e8f390dcff888881ad54d2f23 Author: Chopra, Manish Date: Mon Apr 24 10:00:47 2017 -0700 qede: Configure UDP ports in local context. This patch configures UDP ports locally instead of configuring them in deferred context which would be helpful in synchronizing UDP ports configuration for VFs which will be enabled in further patches. Signed-off-by: Manish Chopra Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qede/qede.h | 2 - drivers/net/ethernet/qlogic/qede/qede_filter.c | 67 ++++++++++++++++++++------ drivers/net/ethernet/qlogic/qede/qede_main.c | 19 -------- 3 files changed, 52 insertions(+), 36 deletions(-) commit 369bfd4ec77f1668e48d395e95849d29fccaa4c3 Author: Chopra, Manish Date: Mon Apr 24 10:00:46 2017 -0700 qede: Disable tunnel offloads for non offloaded UDP ports This patch disables tunnel offloads via ndo_features_check() if given UDP port is not offloaded to hardware. This in turn allows to run multiple tunnel interfaces using different UDP ports. Signed-off-by: Manish Chopra Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qede/qede_fp.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) commit 19489c7f0d9040ed2ffc23747e14af95dba479d2 Author: Chopra, Manish Date: Mon Apr 24 10:00:45 2017 -0700 qed/qede: Enable tunnel offloads based on hw configuration This patch enables tunnel feature offloads based on hw configuration at initialization time instead of enabling them always. Signed-off-by: Manish Chopra Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_main.c | 15 +++++++++++ drivers/net/ethernet/qlogic/qede/qede_filter.c | 6 +++++ drivers/net/ethernet/qlogic/qede/qede_main.c | 36 ++++++++++++++++++-------- include/linux/qed/qed_if.h | 5 ++++ 4 files changed, 51 insertions(+), 11 deletions(-) commit 1996843012629825e4a2c339fedef1f7eade87bc Author: Chopra, Manish Date: Mon Apr 24 10:00:44 2017 -0700 qed: refactor tunnelling - API/Structs This patch changes the tunnel APIs to use per tunnel info instead of using bitmasks for all tunnels and also uses single struct to hold the data to prepare multiple variant of tunnel configuration ramrods to be sent to the hardware. Signed-off-by: Manish Chopra Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed.h | 30 +- drivers/net/ethernet/qlogic/qed/qed_dev.c | 2 +- drivers/net/ethernet/qlogic/qed/qed_dev_api.h | 2 +- drivers/net/ethernet/qlogic/qed/qed_l2.c | 15 +- drivers/net/ethernet/qlogic/qed/qed_main.c | 24 +- drivers/net/ethernet/qlogic/qed/qed_sp.h | 4 +- drivers/net/ethernet/qlogic/qed/qed_sp_commands.c | 327 +++++++++++----------- 7 files changed, 207 insertions(+), 197 deletions(-) commit 337f1e366c75ec88d9bbae59c0703d4289458b29 Author: Shuah Khan Date: Fri Apr 21 16:22:10 2017 -0600 selftests: powerpc: override clean in lib.mk to fix warnings Add override for lib.mk clean to fix the following warnings from clean target run. Makefile:63: warning: overriding recipe for target 'clean' ../lib.mk:55: warning: ignoring old recipe for target 'clean' Signed-off-by: Shuah Khan tools/testing/selftests/powerpc/Makefile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 6dd89010ff3620d60fc9d604218791641d06831c Author: Shuah Khan Date: Fri Apr 21 16:19:50 2017 -0600 selftests: gpio: override clean in lib.mk to fix warnings Add override for lib.mk clean to fix the following warnings from clean target run. Makefile:11: warning: overriding recipe for target 'clean' ../lib.mk:55: warning: ignoring old recipe for target 'clean' Signed-off-by: Shuah Khan tools/testing/selftests/gpio/Makefile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit b1c0f540c8e6944a8cae1bcbab60068fb7b40734 Author: Shuah Khan Date: Fri Apr 21 16:12:22 2017 -0600 selftests: futex: override clean in lib.mk to fix warnings Add override for lib.mk clean to fix the following warnings from clean target run. Makefile:36: warning: overriding recipe for target 'clean' ../lib.mk:55: warning: ignoring old recipe for target 'clean' Signed-off-by: Shuah Khan tools/testing/selftests/futex/Makefile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit df6438f9a726c8f803e03708c83928e439fd5e2f Author: Shuah Khan Date: Fri Apr 21 16:07:51 2017 -0600 selftests: lib.mk: define CLEAN macro to allow Makefiles to override clean Define CLEAN macro to allow Makefiles to override common clean target in lib.mk. This will help fix the following failures: warning: overriding recipe for target 'clean' ../lib.mk:55: warning: ignoring old recipe for target 'clean' Fixes: 88baa78d1f31 ("selftests: remove duplicated all and clean target") Signed-off-by: Shuah Khan Acked-by: Michael Ellerman tools/testing/selftests/lib.mk | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) commit 8edd210d9b121681f7e69dc087ae80d7043008e9 Author: Shuah Khan Date: Fri Apr 21 15:35:31 2017 -0600 selftests: splice: fix clean target to not remove default_file_splice_read.sh splice clean target removes the shell script default_file_splice_read.sh that runs the splice test. Fix it to not remove this file. Signed-off-by: Shuah Khan tools/testing/selftests/splice/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 36784277c59bdfce8b90233c85e957ae4ee702fc Merge: e0ee84d a485c2b Author: David S. Miller Date: Tue Apr 25 11:41:57 2017 -0400 Merge branch 'l2tpeth-info' Guillaume Nault says: ==================== l2tp: add informations about l2tpeth interfaces in /sys Patch #1 lets userspace retrieve the naming scheme of an l2tpeth interface, using /sys/class/net//name_assign_type. Patch #2 adds the DEVTYPE field in /sys/class/net//uevent so that userspace can reliably know if a device is an l2tpeth interface. ==================== Signed-off-by: David S. Miller commit a485c2b877619935f7346146791f0d22f5da723a Author: Guillaume Nault Date: Mon Apr 24 14:16:07 2017 +0200 l2tp: define "l2tpeth" device type Export type of l2tpeth interfaces to userspace (/sys/class/net//uevent). Signed-off-by: Guillaume Nault Acked-by: James Chapman Signed-off-by: David S. Miller net/l2tp/l2tp_eth.c | 5 +++++ 1 file changed, 5 insertions(+) commit c39855febc0e7332db389fd4017ab163589b1b20 Author: Guillaume Nault Date: Mon Apr 24 14:16:06 2017 +0200 l2tp: set name_assign_type for devices created by l2tp_eth.c Export naming scheme used when creating l2tpeth interfaces (/sys/class/net//name_assign_type). This let userspace know if the device's name has been generated automatically or defined manually. Signed-off-by: Guillaume Nault Acked-by: James Chapman Signed-off-by: David S. Miller net/l2tp/l2tp_eth.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 12dc0f3b1ee599d3951698a2927c584700840b03 Author: Fabio Estevam Date: Mon Apr 24 21:43:49 2017 -0300 ASoC: tas2552: Propagate the error code in suspend/resume tas2552_suspend() and tas2552_resume() currently always return success, even though they may fail. Fix this behaviour by always propagating the error code. Signed-off-by: Fabio Estevam Reviewed-by: Dan Murphy Signed-off-by: Mark Brown sound/soc/codecs/tas2552.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit cb67d7651676e8c8f2e40587ef591da057806c57 Author: Pierre-Louis Bossart Date: Mon Apr 24 16:34:33 2017 -0500 ASoC: bytcr_rt5640: log quirk configuration errors Now that quirks can be overridden with a module parameter, log errors so that non-sensical quirks introduced by mistake are identified. Signed-off-by: Pierre-Louis Bossart Signed-off-by: Mark Brown sound/soc/intel/boards/bytcr_rt5640.c | 100 +++++++++++++++++++++++++--------- 1 file changed, 75 insertions(+), 25 deletions(-) commit 0b2c9f88b94cd40f6a27641f0bac02a7ba185e39 Author: Takashi Iwai Date: Mon Apr 24 23:34:30 2017 +0200 ASoC: bytcr_rt5640: Fix a typo and quirk parameter type The previous patch for adding the quirk module option had a typo in its info print, which results in a weird output. Also, the parameter type should be rather unsigned int instead of signed int. Fixes: 9f2cf73ed65b ("ASoC: bytcr_rt5640: Allow quirk set via module option") Reported-by: Pierre-Louis Bossart Signed-off-by: Takashi Iwai Signed-off-by: Mark Brown sound/soc/intel/boards/bytcr_rt5640.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit e85c5a153fe237f261838fc9638c28f19e0f27c1 Author: Marek Vasut Date: Mon Apr 24 17:21:30 2017 +0200 regulator: Add ROHM BD9571MWV-M PMIC regulator driver Add driver for the regulator block in the ROHM BD9571MWV-W MFD PMIC. This block supports three voltage monitors, VD18, VD25, VD33 for the 1V8, 2V5, 3V3 voltage rails and a single voltage regulator for the DVFS rail. Signed-off-by: Marek Vasut Signed-off-by: Mark Brown drivers/regulator/Kconfig | 11 ++ drivers/regulator/Makefile | 1 + drivers/regulator/bd9571mwv-regulator.c | 178 ++++++++++++++++++++++++++++++++ 3 files changed, 190 insertions(+) commit f72efa7e690ab5c4068ccba31c4da032bc45c29c Author: Leif Middelschulte Date: Sun Apr 23 21:19:58 2017 +0200 spi-imx: Implements handling of the SPI_READY mode flag. This patch implements consideration of the SPI_READY mode flag as defined in spi.h. It extends the device tree bindings to support the values defined by the reference manual for the DRCTL field. Thus supporting edge-triggered and level-triggered bursts. Signed-off-by: Leif Middelschulte Signed-off-by: Mark Brown .../devicetree/bindings/spi/fsl-imx-cspi.txt | 7 +++++++ drivers/spi/spi-imx.c | 20 ++++++++++++++++++-- 2 files changed, 25 insertions(+), 2 deletions(-) commit af367afafb5ba7ae26defd35e4ba42cfe157ef72 Author: Richard Fitzgerald Date: Tue Apr 18 11:43:54 2017 +0100 regulator: arizona-ldo1: Factor out generic initialization In preparation for sharing this driver with Madera codecs, factor out the parts of initialization that aren't dependent on struct arizona. Signed-off-by: Richard Fitzgerald Signed-off-by: Mark Brown drivers/regulator/arizona-ldo1.c | 114 ++++++++++++++++++++++----------------- 1 file changed, 66 insertions(+), 48 deletions(-) commit 80a55f41aef4ee808f53f1a356491d7eaeefdd3c Author: Richard Fitzgerald Date: Tue Apr 18 11:43:53 2017 +0100 regulator: arizona-ldo1: Make arizona_ldo1 independent of struct arizona In preparation for supporting Madera codecs, remove the dependency on struct arizona in the regulator callbacks and struct arizona_ldo1. Signed-off-by: Richard Fitzgerald Signed-off-by: Mark Brown drivers/regulator/arizona-ldo1.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit aaa84e6a0399df374634c42590e644a698fcc3ff Author: Richard Fitzgerald Date: Tue Apr 18 11:43:52 2017 +0100 regulator: arizona-ldo1: Move pdata into a separate structure In preparation for sharing this driver with Madera, move the pdata for the LDO1 regulator out of struct arizona_pdata into a dedicated pdata struct for this driver. As a result the code in arizona_ldo1_of_get_pdata() can be made independent of struct arizona. This patch also updates the definition of struct arizona_pdata and the use of this pdata in mach-crag6410-module.c Signed-off-by: Richard Fitzgerald Acked-by: Krzysztof Kozlowski Acked-by: Lee Jones Signed-off-by: Mark Brown arch/arm/mach-s3c64xx/mach-crag6410-module.c | 8 ++++-- drivers/regulator/arizona-ldo1.c | 39 +++++++++++++++------------- include/linux/mfd/arizona/pdata.h | 4 +-- include/linux/regulator/arizona-ldo1.h | 24 +++++++++++++++++ 4 files changed, 53 insertions(+), 22 deletions(-) commit 7d8d14b51921cbfe082a796e55c22d0c1dd8fc26 Author: Richard Fitzgerald Date: Tue Apr 18 11:43:51 2017 +0100 regulator: arizona-micsupp: Factor out generic initialization In preparation for sharing this driver with Madera codecs, factor out the parts of initialization that aren't dependent on struct arizona. Signed-off-by: Richard Fitzgerald Signed-off-by: Mark Brown drivers/regulator/arizona-micsupp.c | 82 +++++++++++++++++++++---------------- 1 file changed, 46 insertions(+), 36 deletions(-) commit e165983e5102c953d68bd935048e95567564e438 Author: Richard Fitzgerald Date: Tue Apr 18 11:43:50 2017 +0100 regulator: arizona-micsupp: Make arizona_micsupp independent of struct arizona In preparation for supporting Madera codecs, remove the dependency on struct arizona in the regulator callbacks and struct arizona_micsupp. Signed-off-by: Richard Fitzgerald Signed-off-by: Mark Brown drivers/regulator/arizona-micsupp.c | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-) commit 22161f3eb65dc29434325736c4d780908fe3bf6a Author: Richard Fitzgerald Date: Tue Apr 18 11:43:49 2017 +0100 regulator: arizona-micsupp: Move pdata into a separate structure In preparation for sharing this driver with Madera, move the pdata for the micsupp regulator out of struct arizona_pdata into a dedicated pdata struct for this driver. As a result the code in arizona_micsupp_of_get_pdata() can be made independent of struct arizona. This patch also updates the definition of struct arizona_pdata and the use of this pdata in mach-crag6410-module.c Signed-off-by: Richard Fitzgerald Acked-by: Lee Jones Signed-off-by: Mark Brown MAINTAINERS | 1 + drivers/regulator/arizona-micsupp.c | 21 +++++++++++---------- include/linux/mfd/arizona/pdata.h | 3 ++- include/linux/regulator/arizona-micsupp.h | 21 +++++++++++++++++++++ 4 files changed, 35 insertions(+), 11 deletions(-) commit 7e6425968bf742b9772aa5bae1250158c9312e31 Author: Richard Fitzgerald Date: Tue Apr 18 11:43:48 2017 +0100 regulator: arizona: Split KConfig options for LDO1 and MICSUPP regulators The CS47L24 Arizona codec and most Madera codecs do not have a LDO1 regulator. Split the LDO1 and MICSUPP regulators into separate KConfig options so the LDO1 is only built into the kernel if needed. Signed-off-by: Richard Fitzgerald Signed-off-by: Mark Brown drivers/regulator/Kconfig | 14 +++++++++++--- drivers/regulator/Makefile | 3 ++- 2 files changed, 13 insertions(+), 4 deletions(-) commit 9095bf25ea08135a5b74875dd0e3eeaddc4218a0 Merge: cdf4275 c1ae3cf Author: Mark Brown Date: Tue Apr 25 16:35:35 2017 +0100 Merge tag 'v4.11-rc1' into regulator-arizona Linux 4.11-rc1 commit e0ee84ded79623ac063a4e817367d61ab7650b6c Author: Jamal Hadi Salim Date: Sun Apr 23 13:17:28 2017 -0400 net sched actions: Complete the JUMPX opcode per discussion at netconf/netdev: When we have an action that is capable of branching (example a policer), we can achieve a continuation of the action graph by programming a "continue" where we find an exact replica of the same filter rule with a lower priority and the remainder of the action graph. When you have 100s of thousands of filters which require such a feature it gets very inefficient to do two lookups. This patch completes a leftover feature of action codes. Its time has come. Example below where a user labels packets with a different skbmark on ingress of a port depending on whether they have/not exceeded the configured rate. This mark is then used to make further decisions on some egress port. #rate control, very low so we can easily see the effect sudo $TC actions add action police rate 1kbit burst 90k \ conform-exceed pipe/jump 2 index 10 # skbedit index 11 will be used if the user conforms sudo $TC actions add action skbedit mark 11 ok index 11 # skbedit index 12 will be used if the user does not conform sudo $TC actions add action skbedit mark 12 ok index 12 #lets bind the user .. sudo $TC filter add dev $ETH parent ffff: protocol ip prio 8 u32 \ match ip dst 127.0.0.8/32 flowid 1:10 \ action police index 10 \ action skbedit index 11 \ action skbedit index 12 #run a ping -f and see what happens.. # jhs@foobar:~$ sudo $TC -s filter ls dev $ETH parent ffff: protocol ip filter pref 8 u32 filter pref 8 u32 fh 800: ht divisor 1 filter pref 8 u32 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:10 (rule hit 2800 success 1005) match 7f000008/ffffffff at 16 (success 1005 ) action order 1: police 0xa rate 1Kbit burst 23440b mtu 2Kb action pipe/jump 2 overhead 0b ref 2 bind 1 installed 207 sec used 122 sec Action statistics: Sent 84420 bytes 1005 pkt (dropped 0, overlimits 721 requeues 0) backlog 0b 0p requeues 0 action order 2: skbedit mark 11 pass index 11 ref 2 bind 1 installed 204 sec used 122 sec Action statistics: Sent 60564 bytes 721 pkt (dropped 0, overlimits 0 requeues 0) backlog 0b 0p requeues 0 action order 3: skbedit mark 12 pass index 12 ref 2 bind 1 installed 201 sec used 122 sec Action statistics: Sent 23856 bytes 284 pkt (dropped 0, overlimits 0 requeues 0) backlog 0b 0p requeues 0 Not bad, about 28% non-conforming packets.. Signed-off-by: Jamal Hadi Salim Signed-off-by: David S. Miller net/sched/act_api.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) commit b3230e80a6d115d2eb50fe3f4794ad04d84766de Author: Trond Myklebust Date: Tue Apr 25 10:56:19 2017 -0400 pNFS: Ensure we check layout segment validity in the pg_init() callback If we have a layout segment cached in pgio->pg_lseg, we should check it for validity before reusing it in a new RPC request. Otherwise, if we recoalesce, we can end up looping forever. Signed-off-by: Trond Myklebust fs/nfs/filelayout/filelayout.c | 2 ++ fs/nfs/flexfilelayout/flexfilelayout.c | 2 ++ fs/nfs/pnfs.c | 13 +++++++++++++ fs/nfs/pnfs.h | 1 + 4 files changed, 18 insertions(+) commit 45a6f3bca64ac8f462a275f351dcc3f032073d92 Merge: 3133822 b655f0e Author: David S. Miller Date: Tue Apr 25 10:52:47 2017 -0400 Merge tag 'linux-can-next-for-4.12-20170425' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next Marc Kleine-Budde says: ==================== pull-request: can-next 2017-04-25 this is a pull request of 21 patches for net-next/master. There are 4 patches by Stephane Grosjean for the PEAK PCAN-PCIe FD CAN-FD boards. The next 7 patches are by Mario Huettel, which add support for M_CAN IP version >= v3.1.x to the m_can driver. A patch by Remigiusz Kołłątaj adds support for the Microchip CAN BUS Analyzer. 8 patches by Oliver Hartkopp complete the initial CAN network namespace support. Wei Yongjun's patch for the ti_hecc driver fixes the return value check in the probe function. ==================== Signed-off-by: David S. Miller commit 6db81643fe41f51cf9f6fd10558b8b323d9198ba Author: Arnaldo Carvalho de Melo Date: Tue Apr 25 11:45:59 2017 -0300 perf buildid: Move prototypes from util.h to build-id.h Where they belong. Link: http://lkml.kernel.org/n/tip-94m3dziejxgo7k0488q3mqjm@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/tests/sdt.c | 1 - tools/perf/util/build-id.h | 4 ++++ tools/perf/util/util.h | 3 --- 3 files changed, 4 insertions(+), 4 deletions(-) commit 3133822f5ac13b04c2ca46f27cfe74606bbd4a6d Author: Florian Westphal Date: Thu Apr 20 18:08:15 2017 +0200 ipvlan: use pernet operations and restrict l3s hooks to master netns commit 4fbae7d83c98c30efc ("ipvlan: Introduce l3s mode") added registration of netfilter hooks via nf_register_hooks(). This API provides the illusion of 'global' netfilter hooks by placing the hooks in all current and future network namespaces. In case of ipvlan the hook appears to be only needed in the namespace that contains the ipvlan master device (i.e., usually init_net), so placing them in all namespaces is not needed. This switches ipvlan driver to pernet operations, and then only registers hooks in namespaces where a ipvlan master device is set to l3s mode. Extra care has to be taken when the master device is moved to another namespace, as we might have to 'move' the netfilter hooks too. This is done by storing the namespace the ipvlan port was created in. On REGISTER event, do (un)register operations in the old/new namespaces. This will also allow removal of the nf_register_hooks() in a future patch. Cc: Mahesh Bandewar Signed-off-by: Florian Westphal Signed-off-by: David S. Miller drivers/net/ipvlan/ipvlan.h | 2 + drivers/net/ipvlan/ipvlan_main.c | 83 ++++++++++++++++++++++++++++++++-------- 2 files changed, 70 insertions(+), 15 deletions(-) commit faa9a08397f5034efad75b06879ac0ead83bd714 Author: Mark Rutland Date: Tue Apr 25 12:08:50 2017 +0100 arm64: pmuv3: handle pmuv3+ Commit f1b36dcb5c316c27 ("arm64: pmuv3: handle !PMUv3 when probing") is a little too restrictive, and prevents the use of of backwards compatible PMUv3 extenstions, which have a PMUver value other than 1. For instance, ARMv8.1 PMU extensions (as implemented by ThunderX2) are reported with PMUver value 4. Per the usual ID register principles, at least 0x1-0x7 imply a PMUv3-compatible PMU. It's not currently clear whether 0x8-0xe imply the same. For the time being, treat the value as signed, and with 0x1-0x7 treated as meaning PMUv3 is implemented. This may be relaxed by future patches. Reported-by: Jayachandran C Tested-by: Jayachandran C Acked-by: Will Deacon Signed-off-by: Mark Rutland Signed-off-by: Catalin Marinas arch/arm64/kernel/perf_event.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 4ff33aafd32e084f5ee7faa54ba06e95f8b1b8af Author: Amir Goldstein Date: Tue Apr 25 14:29:35 2017 +0300 fanotify: don't expose EOPENSTALE to userspace When delivering an event to userspace for a file on an NFS share, if the file is deleted on server side before user reads the event, user will not get the event. If the event queue contained several events, the stale event is quietly dropped and read() returns to user with events read so far in the buffer. If the event queue contains a single stale event or if the stale event is a permission event, read() returns to user with the kernel internal error code 518 (EOPENSTALE), which is not a POSIX error code. Check the internal return value -EOPENSTALE in fanotify_read(), just the same as it is checked in path_openat() and drop the event in the cases that it is not already dropped. This is a reproducer from Marko Rauhamaa: Just take the example program listed under "man fanotify" ("fantest") and follow these steps: ============================================================== NFS Server NFS Client(1) NFS Client(2) ============================================================== # echo foo >/nfsshare/bar.txt # cat /nfsshare/bar.txt foo # ./fantest /nfsshare Press enter key to terminate. Listening for events. # rm -f /nfsshare/bar.txt # cat /nfsshare/bar.txt read: Unknown error 518 cat: /nfsshare/bar.txt: Operation not permitted ============================================================== where NFS Client (1) and (2) are two terminal sessions on a single NFS Client machine. Reported-by: Marko Rauhamaa Tested-by: Marko Rauhamaa Cc: Cc: Signed-off-by: Amir Goldstein Signed-off-by: Jan Kara fs/notify/fanotify/fanotify_user.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) commit e2ef147686751f1a08143bb7b3bda629cceb9369 Author: Sharon Dvir Date: Tue Feb 21 11:12:12 2017 +0200 iwlwifi: mvm: handle possible BIOS bug In iwl_mvm_sar_get_ewrd_table() In case of a BIOS bug, n_profiles might be 0 thus we need to return an error value. Found by Klocwork. Signed-off-by: Sharon Dvir Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 3287bb1088d5470b2057ad3fefb9f3dae586515f Author: Mordechai Goodstein Date: Sun Feb 12 12:20:52 2017 +0200 iwlwifi: mvm: scan: avoid "big" prints Delete the scanned channel results. No need in it we get it any way when logging. The print only clogs up the ftrace print buffer. Signed-off-by: Mordechai Goodstein Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 31 ++++----------------------- 1 file changed, 4 insertions(+), 27 deletions(-) commit 6323f474902e372623d73486c1ad30eb40d6604f Author: Peng Fan Date: Fri Apr 21 17:03:36 2017 +0800 iommu/arm-smmu: Correct sid to mask From code "SMR mask 0x%x out of range for SMMU", so, we need to use mask, not sid. Signed-off-by: Peng Fan Cc: Will Deacon Cc: Robin Murphy Acked-by: Will Deacon Signed-off-by: Joerg Roedel drivers/iommu/arm-smmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9d2ee0a60b8bd9bef2a0082c533736d6a7b39873 Author: Kamal Dasu Date: Fri Mar 3 16:16:53 2017 -0500 mtd: nand: brcmnand: Check flash #WP pin status before nand erase/program On brcmnand controller v6.x and v7.x, the #WP pin is controlled through the NAND_WP bit in CS_SELECT register. The driver currently assumes that toggling the #WP pin is instantaneously enabling/disabling write-protection, but it actually takes some time to propagate the new state to the internal NAND chip logic. This behavior is sometime causing data corruptions when an erase/program operation is executed before write-protection has really been disabled. Fixes: 27c5b17cd1b1 ("mtd: nand: add NAND driver "library" for Broadcom STB NAND controller") Signed-off-by: Kamal Dasu Signed-off-by: Boris Brezillon drivers/mtd/nand/brcmnand/brcmnand.c | 61 ++++++++++++++++++++++++++++++++++-- 1 file changed, 58 insertions(+), 3 deletions(-) commit 65a2c1caa70f71690dcb5afd8fc6afe67fcde599 Author: Sekhar Nori Date: Thu Mar 30 20:09:30 2017 +0530 mtd: nand: davinci: add comment on NAND subpage write status on keystone Add a comment clarifying that NAND subpage write on keystone works, but is not being enabled in the interest of backward compatibility. Signed-off-by: Sekhar Nori Signed-off-by: Boris Brezillon drivers/mtd/nand/davinci_nand.c | 11 +++++++++++ 1 file changed, 11 insertions(+) commit 2d283ede59869159f4bb84ae689258c5caffce54 Author: Roger Quadros Date: Thu Mar 30 10:37:50 2017 +0300 mtd: nand: omap2: Fix partition creation via cmdline mtdparts commit c9711ec5250b ("mtd: nand: omap: Clean up device tree support") caused the parent device name to be changed from "omap2-nand.0" to ".nand" (e.g. 30000000.nand on omap3 platforms). This caused mtd->name to be changed as well. This breaks partition creation via mtdparts passed by u-boot as it uses "omap2-nand.0" for the mtd-id. Fix this by explicitly setting the mtd->name to "omap2-nand." if it isn't already set by nand_set_flash_node(). CS number is the NAND controller instance ID. Fixes: c9711ec5250b ("mtd: nand: omap: Clean up device tree support") Cc: # 4.7+ Reported-by: Leto Enrico Reported-by: Adam Ford Suggested-by: Boris Brezillon Tested-by: Adam Ford Signed-off-by: Roger Quadros Signed-off-by: Boris Brezillon drivers/mtd/nand/omap2.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit 038e8ad6eb720d0b362183f1c30470c1e0797e39 Author: Christophe Jaillet Date: Tue Apr 11 07:22:52 2017 +0200 mtd: nand: NULL terminate a of_device_id table of_device_id tables should be NULL terminated. Fixes: 07b23e3db9ed ("mtd: nand: Cleanup/rework the atmel_nand driver") Signed-off-by: Christophe JAILLET Signed-off-by: Boris Brezillon drivers/mtd/nand/atmel/nand-controller.c | 1 + 1 file changed, 1 insertion(+) commit 70106ddaf31150a57dc00b3d7d5167f693b521ef Author: Dan Carpenter Date: Tue Apr 4 11:15:46 2017 +0300 mtd: nand: Fix a couple error codes We accidentally return 1 on error instead of proper error codes. Fixes: 07b23e3db9ed ("mtd: nand: Cleanup/rework the atmel_nand driver") Signed-off-by: Dan Carpenter Signed-off-by: Boris Brezillon drivers/mtd/nand/atmel/nand-controller.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 477544c62a84d3bacd9f90ba75ffc16c04d78071 Author: Masahiro Yamada Date: Thu Mar 30 17:15:05 2017 +0900 mtd: nand: allow drivers to request minimum alignment for passed buffer In some cases, nand_do_{read,write}_ops is passed with unaligned ops->datbuf. Drivers using DMA will be unhappy about unaligned buffer. The new struct member, buf_align, represents the minimum alignment the driver require for the buffer. If the buffer passed from the upper MTD layer does not have enough alignment, nand_do_*_ops will use bufpoi. Signed-off-by: Masahiro Yamada Signed-off-by: Boris Brezillon drivers/mtd/nand/nand_base.c | 10 ++++++++-- include/linux/mtd/nand.h | 2 ++ 2 files changed, 10 insertions(+), 2 deletions(-) commit 3deb9979c7319bc7846d1aac528a9db85162960a Author: Masahiro Yamada Date: Thu Mar 30 17:15:04 2017 +0900 mtd: nand: allocate aligned buffers if NAND_OWN_BUFFERS is unset Some NAND controllers are using DMA engine requiring a specific buffer alignment. The core provides no guarantee on the nand_buffers pointers, which forces some drivers to allocate their own buffers and pass the NAND_OWN_BUFFERS flag. Rework the nand_buffers allocation logic to allocate each buffer independently. This should make most NAND controllers/DMA engine happy, and allow us to get rid of these custom buf allocation in NAND controller drivers. Signed-off-by: Masahiro Yamada Signed-off-by: Boris Brezillon drivers/mtd/nand/nand_base.c | 41 ++++++++++++++++++++++++++++++++--------- 1 file changed, 32 insertions(+), 9 deletions(-) commit e7beeeec854c40c28caa53bd84fdf26e9e459f06 Author: Masahiro Yamada Date: Thu Mar 30 15:45:57 2017 +0900 mtd: nand: denali: allow to override revision number Commit 271707b1d817 ("mtd: nand: denali: max_banks calculation changed in revision 5.1") added a revision check to support the new max_banks encoding. Its git-log states "The encoding of max_banks changed in Denali revision 5.1". There are exceptional cases, for example, the revision register on some UniPhier SoCs says the IP is 5.0 but the max_banks is encoded in the new format. This IP updates the resister specification from time to time (often breaking the backward compatibility), but the revision number is not incremented correctly. The max_banks is not only the case that needs revision checking. Let's allow to override an incorrect revision number. Signed-off-by: Masahiro Yamada Signed-off-by: Boris Brezillon drivers/mtd/nand/denali.c | 23 +++++++++++++---------- drivers/mtd/nand/denali.h | 3 +-- drivers/mtd/nand/denali_dt.c | 5 ++++- 3 files changed, 18 insertions(+), 13 deletions(-) commit 3f5c35819fc37d5f35680a55327c940b6e8fad41 Author: Masahiro Yamada Date: Thu Mar 30 15:45:56 2017 +0900 mtd: nand: denali_dt: use pdev instead of ofdev for platform_device "pdev" is much more often used to point a platform_device, so this will help the driver code look consistent across the kernel. While we are here, fix "line over 80 characters" coding style violations. Signed-off-by: Masahiro Yamada Signed-off-by: Boris Brezillon drivers/mtd/nand/denali_dt.c | 32 +++++++++++++++++--------------- 1 file changed, 17 insertions(+), 15 deletions(-) commit 60d920d32ca40660e382cf9ccbc236599a49e607 Author: Masahiro Yamada Date: Thu Mar 30 15:45:55 2017 +0900 mtd: nand: denali_dt: remove dma-mask DT property The driver sets appropriate DMA mask. Delete the "dma-mask" DT property. See [1] for negative comments for this binding. [1] https://lkml.org/lkml/2016/2/8/57 Signed-off-by: Masahiro Yamada Acked-by: Rob Herring Signed-off-by: Boris Brezillon Documentation/devicetree/bindings/mtd/denali-nand.txt | 2 -- drivers/mtd/nand/denali_dt.c | 9 --------- 2 files changed, 11 deletions(-) commit 210a2c876fe02c9440569c9282af43e7a85562e3 Author: Masahiro Yamada Date: Thu Mar 30 15:45:54 2017 +0900 mtd: nand: denali: support 64bit capable DMA engine The current driver only supports the DMA engine up to 32 bit physical address, but there also exists 64 bit capable DMA engine for this IP. The data DMA setup sequence is completely different, so I added the 64 bit DMA code as a new function denali_setup_dma64(). The 32 bit one has been renamed to denali_setup_dma32(). Signed-off-by: Masahiro Yamada Signed-off-by: Boris Brezillon drivers/mtd/nand/denali.c | 39 +++++++++++++++++++++++++++++++++++---- drivers/mtd/nand/denali.h | 1 + 2 files changed, 36 insertions(+), 4 deletions(-) commit a56609c4c3f34de76d905e39160511b3c53310ac Author: Masahiro Yamada Date: Thu Mar 30 15:45:53 2017 +0900 mtd: nand: denali_dt: enable HW_ECC_FIXUP for Altera SOCFPGA variant There are various customizable parameters, so several variants for this IP. A generic compatible like "denali,denali-nand-dt" is useless. Moreover, there are multiple things wrong with this string. (Refer to Rob's comment [1]) The "denali,denali-nand-dt" was added by Altera for the SOCFPGA port. Replace it with a more specific string "altr,socfpga-denali-nand". There are no users (in upstream) of the old compatible string. The Denali IP on SOCFPGA incorporates the hardware ECC fixup engine. So, this capability should be associated with the compatible. [1] https://lkml.org/lkml/2016/12/1/450 Signed-off-by: Masahiro Yamada Acked-by: Rob Herring Signed-off-by: Boris Brezillon Documentation/devicetree/bindings/mtd/denali-nand.txt | 5 +++-- drivers/mtd/nand/denali_dt.c | 14 ++++++++++---- 2 files changed, 13 insertions(+), 6 deletions(-) commit 24715c749b2ff5545f0316e7ad8b65026f9e9612 Author: Masahiro Yamada Date: Thu Mar 30 15:45:52 2017 +0900 mtd: nand: denali: support HW_ECC_FIXUP capability Some old versions of the Denali IP (perhaps used only for Intel?) detects ECC errors and provides correct data via a register, but does not touch the transferred data. So, the software must fixup the data in the buffer according to the provided ECC correction information. Newer versions perform ECC correction before transferring the data. No more software intervention is needed. The ECC_ERROR_ADDRESS and ECC_CORRECTION_INFO registers were deprecated. Instead, the number of corrected bit-flips are reported via the ECC_COR_INFO register. When an uncorrectable ECC error happens, a status flag is set to the INTR_STATUS and ECC_COR_INFO registers. As is often the case with this IP, the register view of INTR_STATUS had broken compatibility. For older versions (SW ECC fixup): bit 0: ECC_TRANSACTION_DONE bit 1: ECC_ERR For newer versions (HW ECC fixup): bit 0: ECC_UNCOR_ERR bit 1: Reserved Due to this difference, the irq_mask must be fixed too. The existing handle_ecc() has been renamed to denali_sw_ecc_fixup() for clarification. What is unfortunate with this feature is we can not know the total number of corrected/uncorrected errors in a page. The register ECC_COR_INFO reports the maximum of per-sector bitflips. This is useful for ->read_page return value, but ecc_stats.{corrected,failed} increments may not be precise. Signed-off-by: Masahiro Yamada Signed-off-by: Boris Brezillon drivers/mtd/nand/denali.c | 52 ++++++++++++++++++++++++++++++++++++++++------- drivers/mtd/nand/denali.h | 14 +++++++++++-- 2 files changed, 57 insertions(+), 9 deletions(-) commit d29109be2e8d4a102d8304d7b8bb0d6dfe5e1d27 Author: Masahiro Yamada Date: Thu Mar 30 15:45:51 2017 +0900 mtd: nand: denali: fix erased page checking This part is wrong in multiple ways: [1] is_erased() is called against "buf" twice, so the OOB area is not checked at all. The second call should check chip->oob_poi. [2] This code block is nested by double "if (check_erase_page)". The inner one is redundant. [3] The ECC_ERROR_ADDRESS register reports which sector(s) had uncorrectable ECC errors. It is pointless to check the whole page if only one sector contains errors. [4] Unfortunately, the Denali ECC correction engine has already manipulated the data buffer before it decides the bitflips are uncorrectable. That is, not all of the data are 0xFF after an erased page is processed by the ECC engine. The current is_erased() helper could report false-positive ECC errors. Actually, a certain mount of bitflips are allowed in an erased page. The core framework provides nand_check_erased_ecc_chunk() that takes the threshold into account. Let's use this. This commit reworks the code to solve those problems. Please note the erased page checking is implemented as a separate helper function instead of embedding it in the loop in handle_ecc(). The reason is that OOB data are needed for the erased page checking, but the controller can not start a new transaction until all ECC error information is read out from the registers. Signed-off-by: Masahiro Yamada Signed-off-by: Boris Brezillon drivers/mtd/nand/denali.c | 77 ++++++++++++++++++++++++++++++----------------- 1 file changed, 50 insertions(+), 27 deletions(-) commit 20d48595f8857c9b7e0d31d9734ebe18d63faea1 Author: Masahiro Yamada Date: Thu Mar 30 15:45:50 2017 +0900 mtd: nand: denali: fix bitflips calculation in handle_ecc() This function is wrong in multiple ways: [1] Counting corrected bytes instead of corrected bits. The following code is counting the number of corrected _bytes_. /* correct the ECC error */ buf[offset] ^= err_cor_value; mtd->ecc_stats.corrected++; bitflips++; What the core framework expects is the number of corrected _bits_. They can be different if multiple bitflips occur within one byte. [2] total number of errors instead of max of per-sector errors The core framework expects that corrected errors are counted per sector, then the max value should be taken. The current code simply iterates over the whole page, i.e. counts the total number of correction in the page. This means "too many bitflips" is triggered earlier than it should be, i.e. the NAND device is worn out sooner. Besides those bugs, this function is unreadable due to the deep nesting. Notice the whole code in this function is wrapped in if (irq_status & INTR__ECC_ERR), so this conditional can be moved out of the function. Also, use shorter names for local variables. Re-work the function to fix all the issues. Signed-off-by: Masahiro Yamada Signed-off-by: Boris Brezillon drivers/mtd/nand/denali.c | 141 +++++++++++++++++++++++----------------------- 1 file changed, 71 insertions(+), 70 deletions(-) commit 8927ad394b0653329184863e3d44958f67705e84 Author: Masahiro Yamada Date: Thu Mar 30 15:45:49 2017 +0900 mtd: nand: denali: remove meaningless pipeline read-ahead operation The pipeline read-ahead function of the Denali IP enables continuous reading from the device; while data is being read out by a CPU, the controller maintains additional commands for streaming data from the device. This will reduce the latency of the second page or later. This feature is obviously no help for per-page accessors of Linux NAND driver interface. In the current implementation, the pipeline command is issued to load a single page, then data are read out immediately. The use of the pipeline operation is not adding any advantage, but just adding complexity to the code. Remove. Signed-off-by: Masahiro Yamada Signed-off-by: Boris Brezillon drivers/mtd/nand/denali.c | 42 +++--------------------------------------- 1 file changed, 3 insertions(+), 39 deletions(-) commit 8aabdf376f2baafbaaceeee1f3f7f7dca70f8e0b Author: Masahiro Yamada Date: Thu Mar 30 15:45:48 2017 +0900 mtd: nand: denali: allow to override mtd->name from label DT property Commit 28309572aac4 ("mtd: name the mtd device with an optional label property") allow us to identify a chip in a user-friendly way. If nand_set_flash_node() picks up the "label" from DT, let's respect it. Otherwise, let it fallback to the current name "denali-nand". Signed-off-by: Masahiro Yamada Suggested-by: Boris Brezillon Signed-off-by: Boris Brezillon drivers/mtd/nand/denali.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 07604686e808cd93d352172806a7828860f048f5 Author: Masahiro Yamada Date: Thu Mar 30 15:45:47 2017 +0900 mtd: nand: relax ecc.read_page() return value for uncorrectable ECC The comment for ecc.read_page() requires that it should return "0 if bitflips uncorrectable". Actually, drivers could return positive values when uncorrectable bitflips occur. For example, nand_read_page_swecc() is the case. If ecc.correct() returns -EBADMSG for the first ECC sector, and a positive value for the second one, nand_read_page_swecc() returns a positive max_bitflips and increments ecc_stats.failed for the same page. The requirement can be relaxed by tweaking nand_do_read_ops(). Move the max_bitflips calculation below the retry. Signed-off-by: Masahiro Yamada Suggested-by: Boris Brezillon Signed-off-by: Boris Brezillon drivers/mtd/nand/nand_base.c | 3 +-- include/linux/mtd/nand.h | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) commit f107d7a43923a83d837b3ea3c7b7de58cd014bbd Author: Boris Brezillon Date: Thu Mar 16 09:02:42 2017 +0100 mtd: nand: Remove unused chip->write_page() hook The last/only user of the chip->write_page() hook (the Atmel NAND controller driver) has been reworked and is no longer specifying a custom ->write_page() implementation. Drop this hook before someone else start abusing it. Signed-off-by: Boris Brezillon Reviewed-by: Masahiro Yamada drivers/mtd/nand/nand_base.c | 12 +++++------- include/linux/mtd/nand.h | 4 ---- 2 files changed, 5 insertions(+), 11 deletions(-) commit 82d0bf3417bd4a8f98b54da72d80c19d3d227800 Author: Boris Brezillon Date: Thu Mar 16 09:02:41 2017 +0100 mtd: nand: atmel: Document the new DT bindings The old NAND bindings were not exactly describing the hardware topology and were preventing definitions of several NAND chips under the same NAND controller. New bindings address these limitations and should be preferred over the old ones for new SoCs/boards. Old bindings are still supported for backward compatibility but are marked deprecated in the doc. Signed-off-by: Boris Brezillon Reviewed-by: Nicolas Ferre Acked-by: Rob Herring .../devicetree/bindings/mtd/atmel-nand.txt | 107 ++++++++++++++++++++- 1 file changed, 106 insertions(+), 1 deletion(-) commit f88fc122cc34c2545dec9562eaab121494e401ef Author: Boris Brezillon Date: Thu Mar 16 09:02:40 2017 +0100 mtd: nand: Cleanup/rework the atmel_nand driver This is a complete rewrite of the driver whose main purpose is to support the new DT representation where the NAND controller node is now really visible in the DT and appears under the EBI bus. With this new representation, we can add other devices under the EBI bus without risking pinmuxing conflicts (the NAND controller is under the EBI bus logic and as such, share some of its pins with other devices connected on this bus). Even though the goal of this rework was not necessarily to add new features, the new driver has been designed with this in mind. With a clearer separation between the different blocks and different IP revisions, adding new functionalities should be easier (we already have plans to support SMC timing configuration so that we no longer have to rely on the configuration done by the bootloader/bootstrap). Also note that we no longer have a custom ->cmdfunc() implementation, which means we can now benefit from new features added in the core implementation for free (support for new NAND operations for example). The last thing that we gain with this rework is support for multi-chips and multi-dies chips, thanks to the clean NAND controller <-> NAND devices representation. During this transition we also dropped support for AVR32 SoCs which should soon disappear from mainline (removal of the AVR32 arch is planned for 4.12). This new driver has been tested on several platforms (at91sam9261, at91sam9g45, at91sam9x5, sama5d3 and sama5d4) to make sure it did not introduce regressions, and it's worth mentioning that old bindings are still supported (which partly explain the positive diffstat). Signed-off-by: Boris Brezillon Acked-by: Nicolas Ferre MAINTAINERS | 2 +- drivers/mtd/nand/Kconfig | 6 +- drivers/mtd/nand/Makefile | 2 +- drivers/mtd/nand/atmel/Makefile | 4 + drivers/mtd/nand/atmel/nand-controller.c | 2196 ++++++++++++++++++++++++++ drivers/mtd/nand/atmel/pmecc.c | 1020 ++++++++++++ drivers/mtd/nand/atmel/pmecc.h | 73 + drivers/mtd/nand/atmel_nand.c | 2479 ------------------------------ drivers/mtd/nand/atmel_nand_ecc.h | 163 -- drivers/mtd/nand/atmel_nand_nfc.h | 103 -- 10 files changed, 3298 insertions(+), 2750 deletions(-) commit e3df1e4b51e5e54637355db7d732fedf271530e7 Author: Sharon Dvir Date: Tue Feb 21 10:41:31 2017 +0200 iwlwifi: mvm: check if returned value is NULL While freeing inactive queue, check mvmsta to be valid before dereferencing it. Found by Klocwork. Signed-off-by: Sharon Dvir Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 2 ++ 1 file changed, 2 insertions(+) commit 8d9e29972836b75eb74f533594999500a4c7cc19 Author: Maarten Maathuis Date: Mon Apr 24 23:35:21 2017 +0200 platform/x86: intel-vbtn: add volume up and down Tested on HP Elite X2 1012 G1. Matches event report of Lenovo Helix 2 (https://www.spinics.net/lists/ibm-acpi-devel/msg03982.html). Signed-off-by: Maarten Maathuis [andy: fixed indentation of comments and massaged title of the change] Signed-off-by: Andy Shevchenko drivers/platform/x86/intel-vbtn.c | 4 ++++ 1 file changed, 4 insertions(+) commit 8c5f47b15c5c1537c000e3a4c92c82c5bbf521a4 Author: Johannes Berg Date: Mon Feb 20 17:47:04 2017 +0100 iwlwifi: mvm: make iwl_run_unified_mvm_ucode() static There's no need to have iwl_run_unified_mvm_ucode() be exposed to other parts of the code since the logic to pick it over the normal code in iwl_run_init_mvm_ucode() can just be done in that function itself. Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 155 ++++++++++++++------------- drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 1 - drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 5 +- 3 files changed, 80 insertions(+), 81 deletions(-) commit 77e409455f4171e24e95774cc80419f68b07af2f Author: Sara Sharon Date: Wed Jan 11 11:58:38 2017 +0200 iwlwifi: mvm: support new rate flags Rates were changed to adapt to HE. Change is backward compatible. Signed-off-by: Sara Sharon Signed-off-by: Luca Coelho drivers/net/wireless/intel/iwlwifi/mvm/fw-api-rs.h | 28 +++++++++++++++++----- drivers/net/wireless/intel/iwlwifi/mvm/rs.c | 11 ++++----- drivers/net/wireless/intel/iwlwifi/mvm/rx.c | 4 ++-- drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 4 ++-- 4 files changed, 31 insertions(+), 16 deletions(-) commit 9b11c7912d00d0e5fe0d7f8973b77dac4f69d3df Author: Martin Schwidefsky Date: Mon Apr 24 18:14:48 2017 +0200 s390/mm: simplify arch_get_unmapped_area[_topdown] With TASK_SIZE now reflecting the maximum size of the address space for a process the code for arch_get_unmapped_area[_topdown] can be simplified. Just let the logic pick a suitable address and deal with the page table upgrade after the address has been selected. Signed-off-by: Martin Schwidefsky arch/s390/mm/mmap.c | 89 +++++++++++++++++++---------------------------------- 1 file changed, 32 insertions(+), 57 deletions(-) commit 3622d3e77ecef090b5111e3c5423313f11711dfa Author: Mauro Carvalho Chehab Date: Wed Apr 19 09:58:22 2017 -0300 [media] ov2640: print error if devm_*_optional*() fails devm_gpiod_get_optional() can return -ENOSYS if GPIOLIB is disabled, causing probe to fail. Warn the user if this happens. Acked-by: Sakari Ailus Acked-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab drivers/media/i2c/ov2640.c | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) commit 9dd2ab609eef736d5639e0de1bcc2e71e714b28e Author: Dave Johnson Date: Mon Apr 24 09:11:24 2017 -0400 netfilter: Wrong icmp6 checksum for ICMPV6_TIME_EXCEED in reverse SNATv6 path When recalculating the outer ICMPv6 checksum for a reverse path NATv6 such as ICMPV6_TIME_EXCEED nf_nat_icmpv6_reply_translation() was accessing data beyond the headlen of the skb for non-linear skb. This resulted in incorrect ICMPv6 checksum as garbage data was used. Patch replaces csum_partial() with skb_checksum() which supports non-linear skbs similar to nf_nat_icmp_reply_translation() from ipv4. Signed-off-by: Dave Johnson Signed-off-by: Pablo Neira Ayuso net/ipv6/netfilter/nf_nat_l3proto_ipv6.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 277a292835c196894ef895d5e1fd6170bb916f55 Author: Liping Zhang Date: Sun Apr 23 18:29:30 2017 +0800 netfilter: nft_dynset: continue to next expr if _OP_ADD succeeded Currently, after adding the following nft rules: # nft add set x target1 { type ipv4_addr \; flags timeout \;} # nft add rule x y set add ip daddr timeout 1d @target1 counter the counters will always be zero despite of the elements are added to the dynamic set "target1" or not, as we will break the nft expr traversal unconditionally: # nft list ruleset ... set target1 { ... elements = { 8.8.8.8 expires 23h59m53s} } chain output { ... set add ip daddr timeout 1d @target1 counter packets 0 bytes 0 ^ ^ ... } Since we add the elements to the set successfully, we should continue to the next expression. Additionally, if elements are added to "flow table" successfully, we will _always_ continue to the next expr, even if the operation is _OP_ADD. So it's better to keep them to be consistent. Fixes: 22fe54d5fefc ("netfilter: nf_tables: add support for dynamic set updates") Reported-by: Robert White Signed-off-by: Liping Zhang Signed-off-by: Pablo Neira Ayuso net/netfilter/nft_dynset.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) commit cf3cb246e277d98987aa8d62ef2730dbee2f5fa7 Author: Linus Lüssing Date: Wed Apr 19 21:47:33 2017 +0200 bridge: ebtables: fix reception of frames DNAT-ed to bridge device/port When trying to redirect bridged frames to the bridge device itself or a bridge port (brouting) via the dnat target then this currently fails: The ethernet destination of the frame is dnat'ed to the MAC address of the bridge device or port just fine. However, the IP code drops it in the beginning of ip_input.c/ip_rcv() as the dnat target left the skb->pkt_type as PACKET_OTHERHOST. Fixing this by resetting skb->pkt_type to an appropriate type after dnat'ing. Signed-off-by: Linus Lüssing Signed-off-by: Pablo Neira Ayuso net/bridge/netfilter/ebt_dnat.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) commit e739c5bb20bebb74028d9262255dc1e470b60fcf Author: Olimpiu Dejeu Date: Tue Mar 21 12:58:48 2017 -0400 backlight: Add support for Arctic Sand LED backlight driver chips This driver provides support for the Arctic Sand arc2c0608 chip, and provides a framework to support future devices. Signed-off-by: Olimpiu Dejeu Reviewed-by: Daniel Thompson Signed-off-by: Lee Jones drivers/video/backlight/Kconfig | 7 + drivers/video/backlight/Makefile | 1 + drivers/video/backlight/arcxcnn_bl.c | 419 +++++++++++++++++++++++++++++++++++ 3 files changed, 427 insertions(+) commit ce9d22573d85341c987f997461ac712e4dbe47b1 Author: Olimpiu Dejeu Date: Tue Mar 21 12:58:47 2017 -0400 dt-bindings: backlight: arcxcnn: Supply bindings for Arctic Sand backlight Signed-off-by: Olimpiu Dejeu Acked-by: Rob Herring Acked-by: Daniel Thompson Signed-off-by: Lee Jones .../bindings/leds/backlight/arcxcnn_bl.txt | 33 ++++++++++++++++++++++ 1 file changed, 33 insertions(+) commit b655f0e96d4061eac42dea2dccd37a3348d1f3f3 Author: Wei Yongjun Date: Tue Apr 25 06:44:05 2017 +0000 can: ti_hecc: fix return value check in ti_hecc_probe() In case of error, the function devm_ioremap_resource() returns ERR_PTR() and never returns NULL. The NULL test in the return value check should be replaced with IS_ERR(). Fixes: dabf54dd1c63 ("can: ti_hecc: Convert TI HECC driver to DT only driver") Signed-off-by: Wei Yongjun Signed-off-by: Marc Kleine-Budde drivers/net/can/ti_hecc.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit e6e267b08fb5fe02311b54498a2545b7aad9f1bb Author: Wei Yongjun Date: Tue Apr 25 06:34:46 2017 +0000 mmc: sdhci-xenon: Remove redundant dev_err call in get_dt_pad_ctrl_data() There is a error message within devm_ioremap_resource already, so remove the dev_err call to avoid redundant error message. Signed-off-by: Wei Yongjun Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-xenon-phy.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) commit 5e64ebc1c242523b491b5b5e5eba59243bb970cb Author: Oliver Hartkopp Date: Tue Apr 25 08:19:45 2017 +0200 can: enable module auto loading for virtual CAN interfaces Autoload the vcan module when a vcan instance is to be created by 'ip link add type vcan' Signed-off-by: Oliver Hartkopp Signed-off-by: Marc Kleine-Budde drivers/net/can/vcan.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit a8f820a380a2a06fc4fe1a54159067958f800929 Author: Oliver Hartkopp Date: Tue Apr 25 08:19:44 2017 +0200 can: add Virtual CAN Tunnel driver (vxcan) Similar to the virtual ethernet driver veth, vxcan implements a local CAN traffic tunnel between two virtual CAN network devices. See Kconfig entry for details. Signed-off-by: Oliver Hartkopp Signed-off-by: Marc Kleine-Budde drivers/net/can/Kconfig | 18 +++ drivers/net/can/Makefile | 1 + drivers/net/can/vxcan.c | 316 +++++++++++++++++++++++++++++++++++++++++ include/uapi/linux/can/vxcan.h | 12 ++ 4 files changed, 347 insertions(+) commit 1ef83310b81551079af992c4cbb5e089dd1397be Author: Oliver Hartkopp Date: Tue Apr 25 08:19:43 2017 +0200 can: network namespace support for CAN gateway The CAN gateway was not implemented as per-net in the initial network namespace support by Mario Kicherer (8e8cda6d737d). This patch enables the CAN gateway to be used in different namespaces. Signed-off-by: Oliver Hartkopp Signed-off-by: Marc Kleine-Budde include/net/netns/can.h | 3 +++ net/can/gw.c | 72 ++++++++++++++++++++++++++++++------------------- 2 files changed, 47 insertions(+), 28 deletions(-) commit 384317ef4187f59a1cb7a6163444d757340b3bb4 Author: Oliver Hartkopp Date: Tue Apr 25 08:19:42 2017 +0200 can: network namespace support for CAN_BCM protocol The CAN_BCM protocol and its procfs entries were not implemented as per-net in the initial network namespace support by Mario Kicherer (8e8cda6d737d). This patch adds the missing per-net functionality for the CAN BCM. Signed-off-by: Oliver Hartkopp Signed-off-by: Marc Kleine-Budde include/net/netns/can.h | 1 + net/can/bcm.c | 90 +++++++++++++++++++++++++++++++------------------ 2 files changed, 58 insertions(+), 33 deletions(-) commit cb5635a3677679666e4e81ecbb209d32f13dedcd Author: Oliver Hartkopp Date: Tue Apr 25 08:19:41 2017 +0200 can: complete initial namespace support The statistics and its proc output was not implemented as per-net in the initial network namespace support by Mario Kicherer (8e8cda6d737d). This patch adds the missing per-net statistics for the CAN subsystem. Signed-off-by: Oliver Hartkopp Signed-off-by: Marc Kleine-Budde include/linux/can/core.h | 4 +- include/net/netns/can.h | 5 ++ net/can/af_can.c | 71 +++++++++++++----------- net/can/af_can.h | 5 -- net/can/proc.c | 141 +++++++++++++++++++++++++---------------------- 5 files changed, 121 insertions(+), 105 deletions(-) commit f2e72f43e7686720ddc5112fab2f5f71f47dc5e6 Author: Oliver Hartkopp Date: Tue Apr 25 08:19:40 2017 +0200 can: remove obsolete definitions can_rx_alldev_list is a per-net data structure now. Remove it's definition here and can_rx_dev_list too. Signed-off-by: Oliver Hartkopp Signed-off-by: Marc Kleine-Budde net/can/af_can.h | 4 ---- 1 file changed, 4 deletions(-) commit 48452c169d5ddfdbff4af556016dd9e1f47d762b Author: Oliver Hartkopp Date: Tue Apr 25 08:19:39 2017 +0200 can: remove obsolete pernet_operations definitions The namespace support for the CAN subsystem does not need any additional memory. So when ".size = 0" there's no extra memory allocated by the system. And therefore ".id" is obsolete too. Signed-off-by: Oliver Hartkopp Signed-off-by: Marc Kleine-Budde net/can/af_can.c | 4 ---- 1 file changed, 4 deletions(-) commit a7bbd28f04ce4df26f07e96c4a743d529da99348 Author: Oliver Hartkopp Date: Tue Apr 25 08:19:38 2017 +0200 can: fix memory leak in initial namespace support The can_rx_alldev_list is a per-net data structure now and allocated in can_pernet_init(). Make sure the memory is free'd in can_pernet_exit() too. Signed-off-by: Oliver Hartkopp Signed-off-by: Marc Kleine-Budde net/can/af_can.c | 2 ++ 1 file changed, 2 insertions(+) commit 51f3baad7de943780ce0c17bd7975df567dd6e14 Author: Remigiusz Kołłątaj Date: Fri Apr 14 20:32:28 2017 +0200 can: mcba_usb: Add support for Microchip CAN BUS Analyzer SocketCAN driver for Microchip CAN BUS Analyzer (http://www.microchip.com/development-tools/) Changes in v4: - possible memory leak fixed in mcba_usb_write_bulk_callback - LED support added - failure handling in mcba_usb_probe improved - C99 initializers for structs on stack Changes in v3: - improved/simplified CAN ID conversion - functions for transmission of skb and cmd separated - fixed/improved netif_stop_queue handling - style/cosmetic corrections Changes in v2: - Termination handling reimplemented to fit new netlink API (IFLA_CAN_TERMINATION) - Bitrate handling reimplemented to fit new netlink API (IFLA_CAN_BITRATE) - CAN ID conversion refactored (changed from macro to inline functions) - CAN DLC handling using get_can_dlc() - Endianness handling for can_speed introduced - Debugging removed - Redundant error prints removed - Style/cosmetic corrections (i.e. macro names, redefs, inits etc.) Signed-off-by: Remigiusz Kołłątaj Signed-off-by: Marc Kleine-Budde drivers/net/can/usb/Kconfig | 6 + drivers/net/can/usb/Makefile | 1 + drivers/net/can/usb/mcba_usb.c | 904 +++++++++++++++++++++++++++++++++++++++++ 3 files changed, 911 insertions(+) commit 10c1c3975a6663375b38e67949722ba029201395 Author: Mario Huettel Date: Sat Apr 8 14:10:15 2017 +0200 can: m_can: Enable TX FIFO Handling for M_CAN IP version >= v3.1.x * Added defines for TX Event FIFO Element * Adapted ndo_start_xmit function. For versions >= v3.1.x it uses the TX FIFO to optimize the data throughput. It stores the echo skb at the same index as in the M_CAN's TX FIFO. The frame's message marker is set to this index. This message marker is received in the TX Event FIFO after the message was successfully transmitted. It is used to echo the correct echo skb back to the network stack. * Added m_can_echo_tx_event function. It reads all received message markers in the TX Event FIFO and loops back the corresponding echo skbs. * ISR checks for new TX Event Entry interrupt for version >= 3.1.x. Signed-off-by: Mario Huettel Reviewed-by: Oliver Hartkopp Tested-by: Quentin Schulz Signed-off-by: Marc Kleine-Budde drivers/net/can/m_can/m_can.c | 188 +++++++++++++++++++++++++++++++++++------- 1 file changed, 159 insertions(+), 29 deletions(-) commit 428479e4714ce786629a009c66b4340a3ba651ce Author: Mario Huettel Date: Sat Apr 8 14:10:14 2017 +0200 can: m_can: Configuration for TX and TX event FIFOs * TX/TX Event FIFO sizes are configured for version >= v3.1.x Signed-off-by: Mario Huettel Tested-by: Quentin Schulz Signed-off-by: Marc Kleine-Budde drivers/net/can/m_can/m_can.c | 39 ++++++++++++++++++++++++++++++++++----- 1 file changed, 34 insertions(+), 5 deletions(-) commit b03cfc5bb0e11f88988e5da2805867e468d03ca1 Author: Mario Huettel Date: Sat Apr 8 14:10:13 2017 +0200 can: m_can: Enable M_CAN version dependent initialization This patch adapts the initialization of the M_CAN. So it can be used with all versions >= 3.0.x. Changes: * Added version element to m_can_priv structure to hold M_CAN version. * Renamed bittiming structs for version 3.0.x * Added new bittiming structs for version >= 3.1.x * Function alloc_m_can_dev takes 2 new arguments. The TX FIFO size and the base address of the module. * Chip configuration for CAN_CTRLMODE_LOOPBACK is changed: Enabled CCCR_MON bit. In combination with TEST_LBCK it activates the internal loopback mode. Leaving CCCR_MON '0' results in external loopback mode. * Clocks are temporarily enabled by platform_propbe function in order to allow read access to the Core Release register and the Control Register. Registers are used to detect M_CAN version and optional Non-ISO Feature. Initialization of M_CAN for version >= 3.1.x: * TX FIFO of M_CAN is used to transmit frames. The driver does not need to stop the tx queue after each frame sent. * Initialization of TX Event FIFO is added. * NON-ISO is fixed for all M_CAN versions < 3.2.x. Version 3.2.x _can_ have the NISO (Non-ISO) bit which can switch the mode of the M_CAN to Non-ISO mode. This bit does not have to be writeable. Therefore it is checked. If it is writable Non-ISO support is added to the controllers supported CAN modes. New Functions: * Function to check the Core Release version. The read value determines the behaviour of the driver. * Function to check if the NISO bit for version >= 3.2.x is implemented. Signed-off-by: Mario Huettel Reviewed-by: Oliver Hartkopp Tested-by: Quentin Schulz Signed-off-by: Marc Kleine-Budde drivers/net/can/m_can/m_can.c | 340 +++++++++++++++++++++++++++++++++--------- 1 file changed, 269 insertions(+), 71 deletions(-) commit 5e1bd15a3767b2962595698e849ab59936ce6c33 Author: Mario Huettel Date: Sat Apr 8 14:10:12 2017 +0200 can: m_can: Updated register defines to newest version * Updated register defines to newest M_CAN version (v3.2.1). * Changed defines in the whole code. Signed-off-by: Mario Huettel Reviewed-by: Oliver Hartkopp Tested-by: Quentin Schulz Signed-off-by: Marc Kleine-Budde drivers/net/can/m_can/m_can.c | 190 +++++++++++++++++++++++++++--------------- 1 file changed, 125 insertions(+), 65 deletions(-) commit ee8c3f6f75671c9172133636aebabf14dbc80066 Author: Mario Huettel Date: Sat Apr 8 14:10:11 2017 +0200 can: m_can: Removed virtual address from print The virtual address of the device was printed. I removed it because it leaks internal information. Signed-off-by: Mario Huettel Tested-by: Quentin Schulz Signed-off-by: Marc Kleine-Budde drivers/net/can/m_can/m_can.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 8f265895df44148135ee545f406de76d669dbfd9 Author: Mario Huettel Date: Sat Apr 8 14:10:10 2017 +0200 can: m_can: Removed initialization of FIFO water marks FIFO water marks disabled because the driver doesn't handle water mark events. Signed-off-by: Mario Huettel Reviewed-by: Oliver Hartkopp Tested-by: Quentin Schulz Signed-off-by: Marc Kleine-Budde drivers/net/can/m_can/m_can.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 52973810b54bb569fa3baf14d0ff9bfa3e0f68f9 Author: Mario Huettel Date: Sat Apr 8 14:10:09 2017 +0200 can: m_can: Disabled Interrupt Line 1 * Disabled interrupt line 1. The driver didn't use it. Signed-off-by: Mario Huettel Tested-by: Quentin Schulz Signed-off-by: Marc Kleine-Budde drivers/net/can/m_can/m_can.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 8ac8321e4a7981312348413b9ec314fd93d71a0c Author: Stephane Grosjean Date: Thu Jan 19 16:31:07 2017 +0100 can: peak: add support for PEAK PCAN-PCIe FD CAN-FD boards This patch adds the support of the PCAN-PCI Express FD boards made by PEAK-System, for computers using the PCI Express slot. The PCAN-PCI Express FD has one or two CAN FD channels, depending on the model. A galvanic isolation of the CAN ports protects the electronics of the card and the respective computer against disturbances of up to 500 Volts. The PCAN-PCI Express FD can be operated with ambient temperatures in a range of -40 to +85 °C. Such boards run an extented version of the CAN-FD IP running into USB CAN-FD interfaces from PEAK-System, so this patch adds several new commands and their corresponding data types to the PEAK CAN-FD common definitions header file too. Signed-off-by: Stephane Grosjean Signed-off-by: Marc Kleine-Budde drivers/net/can/Kconfig | 1 + drivers/net/can/Makefile | 1 + drivers/net/can/peak_canfd/Kconfig | 13 + drivers/net/can/peak_canfd/Makefile | 5 + drivers/net/can/peak_canfd/peak_canfd.c | 801 ++++++++++++++++++++++++ drivers/net/can/peak_canfd/peak_canfd_user.h | 55 ++ drivers/net/can/peak_canfd/peak_pciefd_main.c | 842 ++++++++++++++++++++++++++ include/linux/can/dev/peak_canfd.h | 65 ++ 8 files changed, 1783 insertions(+) commit c3df7c5755ee1a53cd56a4efcf3426334ab9eea4 Author: Stephane Grosjean Date: Thu Jan 19 16:31:06 2017 +0100 can: peak: move header file to new can common subdir The CAN-FD IP from PEAK-System runs into several kinds of PC CAN-FD interfaces. Up to now, only the USB CAN-FD adapters were supported by the Kernel. In order to prepare the adding of some new non-USB CAN-FD interfaces, this patch moves - and rename - the IP definitions file from its private (usb) sub-directory into a - newly created - CAN specific one. Signed-off-by: Stephane Grosjean Signed-off-by: Marc Kleine-Budde drivers/net/can/usb/peak_usb/pcan_ucan.h | 243 ----------------------------- drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 2 +- include/linux/can/dev/peak_canfd.h | 243 +++++++++++++++++++++++++++++ 3 files changed, 244 insertions(+), 244 deletions(-) commit 113ab88b2b689b431904e1d753e20390529ed204 Author: Stephane Grosjean Date: Thu Jan 19 16:31:05 2017 +0100 can: peak: fix usage of const qualifier in pointers args Fixes the usage of the const qualifier in the memory pointer arguments of the declared inline functions. By changing the line containing "const", this patch also changes the name of the arg into a more usual one. Signed-off-by: Stephane Grosjean Signed-off-by: Marc Kleine-Budde drivers/net/can/usb/peak_usb/pcan_ucan.h | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) commit 81c5e13d90db1eb1bf326e5b1f6293a0d85e966d Author: Stephane Grosjean Date: Thu Jan 19 16:31:04 2017 +0100 can: peak: fix usage of usb specific data type This patch fixes the wrong usage of a specific USB data type into a common header file. This common header file is intended to define the common data types and values that define access to the PEAK-System CAN-FD IP, whatever the PC interface is. Signed-off-by: Stephane Grosjean Signed-off-by: Marc Kleine-Budde drivers/net/can/usb/peak_usb/pcan_ucan.h | 5 ++--- drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 23 ++++++++++++----------- 2 files changed, 14 insertions(+), 14 deletions(-) commit dfc28b110d4f42953147204bc627b3c64205ed19 Author: Wei Yongjun Date: Tue Apr 25 03:14:09 2017 +0000 mmc: cavium: Use module_pci_driver to simplify the code Use the module_pci_driver() macro to make the code simpler by eliminating module_init and module_exit calls. Signed-off-by: Wei Yongjun Acked-by: Jan Glauber Signed-off-by: Ulf Hansson drivers/mmc/host/cavium-thunderx.c | 13 +------------ 1 file changed, 1 insertion(+), 12 deletions(-) commit ee71d16d22bb268c1f6a64ef6d3654ace5f1e8c7 Author: Martin Schwidefsky Date: Thu Apr 20 14:43:51 2017 +0200 s390/mm: make TASK_SIZE independent from the number of page table levels The TASK_SIZE for a process should be maximum possible size of the address space, 2GB for a 31-bit process and 8PB for a 64-bit process. The number of page table levels required for a given memory layout is a consequence of the mapped memory areas and their location. Signed-off-by: Martin Schwidefsky arch/s390/include/asm/mman.h | 4 ---- arch/s390/include/asm/processor.h | 9 +++++---- arch/s390/kvm/kvm-s390.c | 4 ++-- arch/s390/mm/gmap.c | 2 +- arch/s390/mm/gup.c | 2 +- arch/s390/mm/mmap.c | 31 ++++++++++++------------------- arch/s390/mm/pgalloc.c | 2 -- 7 files changed, 21 insertions(+), 33 deletions(-) commit 543b334d145e59d4379ccdde312bc30c470b1087 Author: Jean Delvare Date: Mon Apr 24 22:07:10 2017 -0600 virtio_blk: Fix English description of VIRTIO_BLK_SCSI Signed-off-by: Jean Delvare Fixes: 97b50a654d5d ("virtio_blk: make SCSI passthrough support configurable") Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe drivers/block/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c35e30b4727b390ce7a6dd7ead31335320c2b83e Author: Andy Lutomirski Date: Fri Apr 21 16:19:24 2017 -0700 nvme: Add nvme_core.force_apst to ignore the NO_APST quirk We're probably going to be stuck quirking APST off on an over-broad range of devices for 4.11. Let's make it easy to override the quirk for testing. Signed-off-by: Andy Lutomirski Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe drivers/nvme/host/core.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) commit fb0dc3993b537e12ce63511d535ff86efff13c8f Author: Andy Lutomirski Date: Fri Apr 21 16:19:23 2017 -0700 nvme: Display raw APST configuration via DYNAMIC_DEBUG Debugging APST is currently a bit of a pain. This gives optional simple log messages that describe the APST state. The easiest way to use this is probably with the nvme_core.dyndbg=+p module parameter. Signed-off-by: Andy Lutomirski Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe drivers/nvme/host/core.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) commit 76e4ad09a30cfb589eb436ad067f4abecb82cc04 Author: Andy Lutomirski Date: Fri Apr 21 16:19:22 2017 -0700 nvme: Fix APST comment There was a typo in the description of the timeout heuristic. Signed-off-by: Andy Lutomirski Reviewed-by: Christoph Hellwig Signed-off-by: Jens Axboe drivers/nvme/host/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d9fd363a6cbfae24ffaa00ac6fd3ce8e271acaf1 Merge: a44f53f 8f9cedc Author: Jens Axboe Date: Mon Apr 24 22:03:14 2017 -0600 Merge branch 'master' into for-4.12/post-merge commit 86a5df1495cce7ed7357af0a3e1f439867ed1c64 Merge: 14933dc bdb12e0 Author: David S. Miller Date: Mon Apr 24 23:55:20 2017 -0400 Merge branch 'virtio-net-tx-napi' Willem de Bruijn says: ==================== virtio-net tx napi Add napi for virtio-net transmit completion processing. Changes: v2 -> v3: - convert __netif_tx_trylock to __netif_tx_lock on tx napi poll ensure that the handler always cleans, to avoid deadlock - unconditionally clean in start_xmit avoid adding an unnecessary "if (use_napi)" branch - remove virtqueue_disable_cb in patch 5/5 a noop in the common event_idx based loop - document affinity_hint_set constraint v1 -> v2: - disable by default - disable unless affinity_hint_set because cache misses add up to a third higher cycle cost, e.g., in TCP_RR tests. This is not limited to the patch that enables tx completion cleaning in rx napi. - use trylock to avoid contention between tx and rx napi - keep interrupts masked during xmit_more (new patch 5/5) this improves cycles especially for multi UDP_STREAM, which does not benefit from cleaning tx completions on rx napi. - move free_old_xmit_skbs (new patch 3/5) to avoid forward declaration not changed: - deduplicate virnet_poll_tx and virtnet_poll_txclean they look similar, but have differ too much to make it worthwhile. - delay netif_wake_subqueue for more than 2 + MAX_SKB_FRAGS evaluated, but made no difference - patch 1/5 RFC -> v1: - dropped vhost interrupt moderation patch: not needed and likely expensive at light load - remove tx napi weight - always clean all tx completions - use boolean to toggle tx-napi, instead - only clean tx in rx if tx-napi is enabled - then clean tx before rx - fix: add missing braces in virtnet_freeze_down - testing: add 4KB TCP_RR + UDP test results Based on previous patchsets by Jason Wang: [RFC V7 PATCH 0/7] enable tx interrupts for virtio-net http://lkml.iu.edu/hypermail/linux/kernel/1505.3/00245.html Before commit b0c39dbdc204 ("virtio_net: don't free buffers in xmit ring") the virtio-net driver would free transmitted packets on transmission of new packets in ndo_start_xmit and, to catch the edge case when no new packet is sent, also in a timer at 10HZ. A timer can cause long stalls. VIRTIO_F_NOTIFY_ON_EMPTY avoids stalls due to low free descriptor count. It does not address a stalls due to low socket SO_SNDBUF. Increasing timer frequency decreases that stall time, but increases interrupt rate and, thus, cycle count. Currently, with no timer, packets are freed only at ndo_start_xmit. Latency of consume_skb is now unbounded. To avoid a deadlock if a sock reaches SO_SNDBUF, packets are orphaned on tx. This breaks TCP small queues. Reenable TCP small queues by removing the orphan. Instead of using a timer, convert the driver to regular tx napi. This does not have the unresolved stall issue and does not have any frequency to tune. By keeping interrupts enabled by default, napi increases tx interrupt rate. VIRTIO_F_EVENT_IDX avoids sending an interrupt if one is already unacknowledged, so makes this more feasible today. Combine that with an optimization that brings interrupt rate back in line with the existing version for most workloads: Tx completion cleaning on rx interrupts elides most explicit tx interrupts by relying on the fact that many rx interrupts fire. Tested by running {1, 10, 100} {TCP, UDP} STREAM, RR, 4K_RR benchmarks from a guest to a server on the host, on an x86_64 Haswell. The guest runs 4 vCPUs pinned to 4 cores. vhost and the test server are pinned to a core each. All results are the median of 5 runs, with variance well < 10%. Used neper (github.com/google/neper) as test process. Napi increases single stream throughput, but increases cycle cost. The optimizations bring this down. The previous patchset saw a regression with UDP_STREAM, which does not benefit from cleaning tx interrupts in rx napi. This regression is now gone for 10x, 100x. Remaining difference is higher 1x TCP_STREAM, lower 1x UDP_STREAM. The latest results are with process, rx napi and tx napi affine to the same core. All numbers are lower than the previous patchset. upstream napi TCP_STREAM: 1x: Mbps 27816 39805 Gcycles 274 285 10x: Mbps 42947 42531 Gcycles 300 296 100x: Mbps 31830 28042 Gcycles 279 269 TCP_RR Latency (us): 1x: p50 21 21 p99 27 27 Gcycles 180 167 10x: p50 40 39 p99 52 52 Gcycles 214 211 100x: p50 281 241 p99 411 337 Gcycles 218 226 TCP_RR 4K: 1x: p50 28 29 p99 34 36 Gcycles 177 167 10x: p50 70 71 p99 85 134 Gcycles 213 214 100x: p50 442 611 p99 802 785 Gcycles 237 216 UDP_STREAM: 1x: Mbps 29468 26800 Gcycles 284 293 10x: Mbps 29891 29978 Gcycles 285 312 100x: Mbps 30269 30304 Gcycles 318 316 UDP_RR: 1x: p50 19 19 p99 23 23 Gcycles 180 173 10x: p50 35 40 p99 54 64 Gcycles 245 237 100x: p50 234 286 p99 484 473 Gcycles 224 214 Note that GSO is enabled, so 4K RR still translates to one packet per request. Lower throughput at 100x vs 10x can be (at least in part) explained by looking at bytes per packet sent (nstat). It likely also explains the lower throughput of 1x for some variants. upstream: N=1 bytes/pkt=16581 N=10 bytes/pkt=61513 N=100 bytes/pkt=51558 at_rx: N=1 bytes/pkt=65204 N=10 bytes/pkt=65148 N=100 bytes/pkt=56840 ==================== Acked-by: Michael S. Tsirkin commit bdb12e0d2ffc84a0248788cdf6cfbff86ee34602 Author: Willem de Bruijn Date: Mon Apr 24 13:49:30 2017 -0400 virtio-net: keep tx interrupts disabled unless kick Tx napi mode increases the rate of transmit interrupts. Suppress some by masking interrupts while more packets are expected. The interrupts will be reenabled before the last packet is sent. This optimization reduces the througput drop with tx napi for unidirectional flows such as UDP_STREAM that do not benefit from cleaning tx completions in the the receive napi handler. Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller drivers/net/virtio_net.c | 3 +++ 1 file changed, 3 insertions(+) commit 7b0411ef4aa69c9256d6a2c289d0a2b320414633 Author: Willem de Bruijn Date: Mon Apr 24 13:49:29 2017 -0400 virtio-net: clean tx descriptors from rx napi Amortize the cost of virtual interrupts by doing both rx and tx work on reception of a receive interrupt if tx napi is enabled. With VIRTIO_F_EVENT_IDX, this suppresses most explicit tx completion interrupts for bidirectional workloads. Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller drivers/net/virtio_net.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) commit ea7735d97ba9064c448664429e249991ccd8aa77 Author: Willem de Bruijn Date: Mon Apr 24 13:49:28 2017 -0400 virtio-net: move free_old_xmit_skbs An upcoming patch will call free_old_xmit_skbs indirectly from virtnet_poll. Move the function above this to avoid having to introduce a forward declaration. This is a pure move: no code changes. Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller drivers/net/virtio_net.c | 60 ++++++++++++++++++++++++------------------------ 1 file changed, 30 insertions(+), 30 deletions(-) commit b92f1e6751a6aaaf0b1e05128661ce0f23ed3695 Author: Willem de Bruijn Date: Mon Apr 24 13:49:27 2017 -0400 virtio-net: transmit napi Convert virtio-net to a standard napi tx completion path. This enables better TCP pacing using TCP small queues and increases single stream throughput. The virtio-net driver currently cleans tx descriptors on transmission of new packets in ndo_start_xmit. Latency depends on new traffic, so is unbounded. To avoid deadlock when a socket reaches its snd limit, packets are orphaned on tranmission. This breaks socket backpressure, including TSQ. Napi increases the number of interrupts generated compared to the current model, which keeps interrupts disabled as long as the ring has enough free descriptors. Keep tx napi optional and disabled for now. Follow-on patches will reduce the interrupt cost. Signed-off-by: Willem de Bruijn Signed-off-by: Jason Wang Signed-off-by: David S. Miller drivers/net/virtio_net.c | 76 ++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 67 insertions(+), 9 deletions(-) commit e4e8452a4ab304913c4b4242ba06bc4624f14a84 Author: Willem de Bruijn Date: Mon Apr 24 13:49:26 2017 -0400 virtio-net: napi helper functions Prepare virtio-net for tx napi by converting existing napi code to use helper functions. This also deduplicates some logic. Signed-off-by: Willem de Bruijn Signed-off-by: Jason Wang Signed-off-by: David S. Miller drivers/net/virtio_net.c | 65 ++++++++++++++++++++++++++---------------------- 1 file changed, 35 insertions(+), 30 deletions(-) commit 14933dc8d9964e46f1d5bd2a4dfe3d3be8e420e0 Author: David S. Miller Date: Mon Apr 24 19:42:34 2017 -0700 sparc64: Improve 64-bit constant loading in eBPF JIT. Doing a full 64-bit decomposition is really stupid especially for simple values like 0 and -1. But if we are going to optimize this, go all the way and try for all 2 and 3 instruction sequences not requiring a temporary register as well. First we do the easy cases where it's a zero or sign extended 32-bit number (sethi+or, sethi+xor, respectively). Then we try to find a range of set bits we can load simply then shift up into place, in various ways. Then we try negating the constant and see if we can do a simple sequence using that with a xor at the end. (f.e. the range of set bits can't be loaded simply, but for the negated value it can) The final optimized strategy involves 4 instructions sequences not needing a temporary register. Otherwise we sadly fully decompose using a temp.. Example, from ALU64_XOR_K: 0x0000ffffffff0000 ^ 0x0 = 0x0000ffffffff0000: 0000000000000000 : 0: 9d e3 bf 50 save %sp, -176, %sp 4: 01 00 00 00 nop 8: 90 10 00 18 mov %i0, %o0 c: 13 3f ff ff sethi %hi(0xfffffc00), %o1 10: 92 12 63 ff or %o1, 0x3ff, %o1 ! ffffffff 14: 93 2a 70 10 sllx %o1, 0x10, %o1 18: 15 3f ff ff sethi %hi(0xfffffc00), %o2 1c: 94 12 a3 ff or %o2, 0x3ff, %o2 ! ffffffff 20: 95 2a b0 10 sllx %o2, 0x10, %o2 24: 92 1a 60 00 xor %o1, 0, %o1 28: 12 e2 40 8a cxbe %o1, %o2, 38 2c: 9a 10 20 02 mov 2, %o5 30: 10 60 00 03 b,pn %xcc, 3c 34: 01 00 00 00 nop 38: 9a 10 20 01 mov 1, %o5 ! 1 3c: 81 c7 e0 08 ret 40: 91 eb 40 00 restore %o5, %g0, %o0 Signed-off-by: David S. Miller arch/sparc/net/bpf_jit_comp_64.c | 249 ++++++++++++++++++++++++++++++++++++++- 1 file changed, 245 insertions(+), 4 deletions(-) commit 58771c1cb0023fdd744e76d6cad7716dc4f579ee Author: Salvatore Benedetto Date: Mon Apr 24 13:13:20 2017 +0100 Bluetooth: convert smp and selftest to crypto kpp API * Convert both smp and selftest to crypto kpp API * Remove module ecc as no more required * Add ecdh_helper functions for wrapping kpp async calls This patch has been tested *only* with selftest, which is called on module loading. Signed-off-by: Salvatore Benedetto Signed-off-by: Marcel Holtmann net/bluetooth/Kconfig | 1 + net/bluetooth/Makefile | 2 +- net/bluetooth/ecc.c | 816 -------------------------------------------- net/bluetooth/ecc.h | 54 --- net/bluetooth/ecdh_helper.c | 223 ++++++++++++ net/bluetooth/ecdh_helper.h | 27 ++ net/bluetooth/selftest.c | 6 +- net/bluetooth/smp.c | 8 +- 8 files changed, 259 insertions(+), 878 deletions(-) commit ac4691fac8ad9bbb72268b6e4c73a168e670a196 Author: Al Viro Date: Tue Mar 28 01:28:09 2017 -0400 hexagon: switch to RAW_COPY_USER Signed-off-by: Al Viro arch/hexagon/Kconfig | 1 + arch/hexagon/include/asm/uaccess.h | 23 ++++++++++------------- arch/hexagon/kernel/hexagon_ksyms.c | 4 ++-- arch/hexagon/mm/copy_from_user.S | 2 +- arch/hexagon/mm/copy_to_user.S | 2 +- 5 files changed, 15 insertions(+), 17 deletions(-) commit aea415b1d10ea25779a100da639b3e3989080971 Author: Marcos Paulo de Souza Date: Mon Apr 24 16:19:49 2017 -0700 Input: add uinput documentation Add description of uinput module with a few examples. Signed-off-by: Marcos Paulo de Souza Signed-off-by: Dmitry Torokhov Documentation/input/input_uapi.rst | 1 + Documentation/input/uinput.rst | 245 +++++++++++++++++++++++++++++++++++++ 2 files changed, 246 insertions(+) commit 433db3e260bc8134d4a46ddf20b3668937e12556 Author: Vinícius Tinti Date: Mon Apr 24 13:04:58 2017 -0700 kbuild: Add support to generate LLVM assembly files Add rules to kbuild in order to generate LLVM assembly files with the .ll extension when using clang. # from c code make CC=clang kernel/pid.ll Signed-off-by: Vinícius Tinti Signed-off-by: Behan Webster Signed-off-by: Matthias Kaehlcke Signed-off-by: Masahiro Yamada .gitignore | 1 + Makefile | 5 +++++ scripts/Makefile.build | 8 ++++++++ 3 files changed, 14 insertions(+) commit 9eb3c95896a337256489124857157f49616d2c6b Author: Andrew Donnellan Date: Mon Apr 24 14:07:41 2017 +0300 builddeb: fix typo Signed-off-by: Andrew Donnellan Signed-off-by: Riku Voipio Signed-off-by: Masahiro Yamada scripts/package/builddeb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1d349923857d7b4e1892d48b7c4e00ebaf635df9 Author: Riku Voipio Date: Mon Apr 24 14:07:40 2017 +0300 builddeb: Update a few outdated and hardcoded strings The builddeb script has some hardcoded references to Linux version 2.6 which is ancient. Drop Provides as the virtual packages provided are not useful anymore. Leave the Provides for linux-kernel-headers, as someone might still be referring to it. While at it, updated copyright date and drop Standards-Version: since the package isn't Debian Standards compliant anyways. Cc: Timo Sigurdsson Signed-off-by: Riku Voipio Signed-off-by: Masahiro Yamada scripts/package/builddeb | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) commit bc042fdfbb92b5b13421316b4548e2d6e98eed37 Author: Dan Williams Date: Mon Apr 24 15:43:05 2017 -0700 libnvdimm, region: fix flush hint detection crash In the case where a dimm does not have any associated flush hints the ndrd->flush_wpq array may be uninitialized leading to crashes with the following signature: BUG: unable to handle kernel NULL pointer dereference at 0000000000000010 IP: region_visible+0x10f/0x160 [libnvdimm] Call Trace: internal_create_group+0xbe/0x2f0 sysfs_create_groups+0x40/0x80 device_add+0x2d8/0x650 nd_async_device_register+0x12/0x40 [libnvdimm] async_run_entry_fn+0x39/0x170 process_one_work+0x212/0x6c0 ? process_one_work+0x197/0x6c0 worker_thread+0x4e/0x4a0 kthread+0x10c/0x140 ? process_one_work+0x6c0/0x6c0 ? kthread_create_on_node+0x60/0x60 ret_from_fork+0x31/0x40 Cc: Reviewed-by: Jeff Moyer Fixes: f284a4f23752 ("libnvdimm: introduce nvdimm_flush() and nvdimm_has_flush()") Signed-off-by: Dan Williams drivers/nvdimm/region_devs.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) commit 6eadc61224666dcc79763dc21749b5f809d82140 Author: Damien Le Moal Date: Mon Apr 24 16:51:10 2017 +0900 scsi: sd: Improve sd_completed_bytes Re-shuffle the code to be more efficient by not initializing variables upfront (i.e. do it only when necessary). Also replace the do_div calls with calls to sectors_to_logical(). No functional change is introduced by this patch. [mkp: bytes_to_logical()] Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Signed-off-by: Martin K. Petersen drivers/scsi/sd.c | 51 +++++++++++++++++++++++++++------------------------ drivers/scsi/sd.h | 5 +++++ 2 files changed, 32 insertions(+), 24 deletions(-) commit e3a724edeec3836ed44675a6587a6db7b6b68dbe Author: David S. Miller Date: Mon Apr 24 15:56:21 2017 -0700 sparc64: Support cbcond instructions in eBPF JIT. cbcond combines a compare with a branch into a single instruction. The limitations are: 1) Only newer chips support it 2) For immediate compares we are limited to 5-bit signed immediate values 3) The branch displacement is limited to 10-bit signed 4) We cannot use it for JSET Also, cbcond (unlike all other sparc control transfers) lacks a delay slot. Currently we don't have a useful instruction we can push into the delay slot of normal branches. So using cbcond pretty much always increases code density, and is therefore a win. Signed-off-by: David S. Miller arch/sparc/net/bpf_jit_comp_64.c | 238 ++++++++++++++++++++++++++++++--------- 1 file changed, 184 insertions(+), 54 deletions(-) commit 7529fbb0080d67bc45a3cdad91574cdd0f8a31cf Author: Damien Le Moal Date: Mon Apr 24 16:51:09 2017 +0900 scsi: sd: Fix function descriptions Fix argument names and description of function documentation comments. No functional change is introduced by this patch. [mkp: verbify] Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Signed-off-by: Martin K. Petersen drivers/scsi/sd.c | 29 ++++++++++++++--------------- 1 file changed, 14 insertions(+), 15 deletions(-) commit b1391a5bf83a593bbe92d1f9bddaf563be5c7c9d Author: Sinan Kaya Date: Fri Apr 7 15:06:18 2017 -0400 scsi: mpt3sas: remove redundant wmb Due to relaxed ordering requirements on multiple architectures, drivers are required to use wmb/rmb/mb combinations when they need to guarantee observability between the memory and the HW. The mpt3sas driver is already using wmb() for this purpose. However, it issues a writel following wmb(). writel() function on arm/arm64 arhictectures have an embedded wmb() call inside. This results in unnecessary performance loss and code duplication. writel already guarantees ordering for both cpu and bus. we don't need additional wmb() Signed-off-by: Sinan Kaya Acked-by: Sreekanth Reddy Reviewed-by: Brian King Signed-off-by: Martin K. Petersen drivers/scsi/mpt3sas/mpt3sas_base.c | 2 -- 1 file changed, 2 deletions(-) commit cfd2aff711aa9de301258d322a0b5a3c64010220 Author: Hannes Reinecke Date: Mon Apr 24 11:22:32 2017 +0200 scsi: mpt: Move scsi_remove_host() out of mptscsih_remove_host() Commit c5ce0abeb628 ("scsi: sas: move scsi_remove_host call...") moved the call to scsi_remove_host() into sas_remove_host(), but forgot to modify the mpt drivers. Fixes: c5ce0abeb628 ("scsi: sas: move scsi_remove_host call into sas_remove_host") Signed-off-by: Hannes Reinecke Reviewed-by: Christoph Hellwig Signed-off-by: Martin K. Petersen drivers/message/fusion/mptfc.c | 7 ++++++- drivers/message/fusion/mptscsih.c | 2 -- drivers/message/fusion/mptspi.c | 10 +++++++++- 3 files changed, 15 insertions(+), 4 deletions(-) commit e791ce27c3f6a1d3c746fd6a8f8e36c9540ec6f9 Author: Hannes Reinecke Date: Mon Apr 24 10:26:36 2017 +0200 scsi: sg: reset 'res_in_use' after unlinking reserved array Once the reserved page array is unused we can reset the 'res_in_use' state; here we can do a lazy update without holding the mutex as we only need to check against concurrent access, not concurrent release. [mkp: checkpatch] Fixes: 1bc0eb044615 ("scsi: sg: protect accesses to 'reserved' page array") Signed-off-by: Hannes Reinecke Reviewed-by: Johannes Thumshirn Reviewed-by: Christoph Hellwig Signed-off-by: Martin K. Petersen drivers/scsi/sg.c | 2 ++ 1 file changed, 2 insertions(+) commit 4bd13a077172a1a509115993ebe2082f327f1609 Author: Alexey Khoroshilov Date: Mon Apr 24 02:01:00 2017 +0300 scsi: mvumi: remove code handling zero scsi_sg_count(scmd) case As Christoph Hellwig noted, SCSI commands that transfer data always have a SG entry. The patch removes dead code in mvumi_make_sgl(), mvumi_complete_cmd() and mvumi_timed_out() that handle zero scsi_sg_count(scmd) case. Also the patch adds pci_unmap_sg() on failure path in mvumi_make_sgl(). Signed-off-by: Alexey Khoroshilov Reviewed-by: Christoph Hellwig Signed-off-by: Martin K. Petersen drivers/scsi/mvumi.c | 85 ++++++++++++++++------------------------------------ 1 file changed, 26 insertions(+), 59 deletions(-) commit 6b8accea1b03da5f03e6dcd589f7024c4f4ee445 Author: Colin Ian King Date: Sat Apr 22 14:02:02 2017 +0100 scsi: fusion: fix spelling mistake: "Persistancy" -> "Persistency" trivial fix to spelling mistake Signed-off-by: Colin Ian King Signed-off-by: Martin K. Petersen drivers/message/fusion/mptbase.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit edb88cef0570914375d461107759cf0d6d677ed5 Author: Arnd Bergmann Date: Sat Apr 22 00:02:31 2017 +0200 scsi: pmcraid: use normal copy_from_user As pointed out by Al Viro for my previous series, the driver has no need to call access_ok() and __copy_from_user()/__copy_to_user(). Changing it to regular copy_from_user()/copy_to_user() simplifies the code without any real downsides, making it less error-prone at best. This patch by itself also addresses the warning about the access_ok() macro on MIPS, but both fixes improve the code, so ideally we apply them both. Signed-off-by: Arnd Bergmann Reviewed-by: Christoph Hellwig Signed-off-by: Martin K. Petersen drivers/scsi/pmcraid.c | 40 +++++++--------------------------------- 1 file changed, 7 insertions(+), 33 deletions(-) commit 144b139c96200c51248b8701a1ef4a6bebd3dc8c Author: Arnd Bergmann Date: Thu Apr 20 19:54:48 2017 +0200 scsi: pmcraid: fix minor sparse warnings pmcraid_minor is only used in this one file and should be 'static' as suggested by sparse: drivers/scsi/pmcraid.c:80:1: warning: symbol 'pmcraid_minor' was not declared. Should it be static? In Linux coding style, a literal '0' integer should not be used to represent a NULL pointer: drivers/scsi/pmcraid.c:348:29: warning: Using plain integer as NULL pointer drivers/scsi/pmcraid.c:4824:49: warning: Using plain integer as NULL pointer Signed-off-by: Arnd Bergmann Reviewed-by: Christoph Hellwig Signed-off-by: Martin K. Petersen drivers/scsi/pmcraid.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 45c80be614b094459f2c699353080e4f8059f610 Author: Arnd Bergmann Date: Thu Apr 20 19:54:47 2017 +0200 scsi: pmcraid: fix endianess sparse annotations The use of le32_to_cpu() etc in this driver looks completely arbitrary. It may have made sense at some point, but it is not applied consistently, so this driver presumably won't work on big-endian kernel builds. Unfortunately it's unclear whether the type names or the calls to le32_to_cpu() are the correct ones. I'm taking educated guesses here and assume that most of the __le32 and __le16 annotations are correct, adding the conversion helpers whereever we access those fields. The exceptions are the 'fw_version' field that is always accessed as big-endian, so I'm changing the type here, and the 'hrrq' values that are accessed as little-endian, so I'm changing those the other way. None of these changes should have any effect on little-endian architectures like x86, but it addresses the sparse warnings. Signed-off-by: Arnd Bergmann Reviewed-by: Christoph Hellwig Signed-off-by: Martin K. Petersen drivers/scsi/pmcraid.c | 95 +++++++++++++++++++++++++------------------------- drivers/scsi/pmcraid.h | 8 ++--- 2 files changed, 51 insertions(+), 52 deletions(-) commit 3397623b370494fd7e0bca62b7578051482d058d Author: Arnd Bergmann Date: Thu Apr 20 19:54:45 2017 +0200 scsi: pmcraid: use __iomem pointers for ioctl argument kernelci.org reports a new compile warning for old code in the pmcraid driver: arch/mips/include/asm/uaccess.h:138:21: warning: passing argument 1 of '__access_ok' makes pointer from integer without a cast [-Wint-conversion] The warning got introduced by a cleanup to the access_ok() helper that requires the argument to be a pointer, where the old version silently accepts 'unsigned long' arguments as it still does on most other architectures. The new behavior in MIPS however seems absolutely sensible, and so far I could only find one other file with the same issue, so the best solution seems to be to clean up the pmcraid driver. This makes the driver consistently use 'void __iomem *' pointers for passing around the address of the user space ioctl arguments, which gets rid of the kernelci warning as well as several sparse warnings. Fixes: f0a955f4eeec ("mips: sanitize __access_ok()") Cc: Alexander Viro Signed-off-by: Arnd Bergmann Signed-off-by: Martin K. Petersen drivers/scsi/pmcraid.c | 44 ++++++++++++++++---------------------------- 1 file changed, 16 insertions(+), 28 deletions(-) commit 91402608641823fdfd8e18042f20c1a449108514 Author: Christoph Hellwig Date: Sun Apr 23 10:33:23 2017 +0200 scsi: pmcraid: fix lock imbalance in pmcraid_reset_reload() sparse found a bug that has always been present since the driver was merged: drivers/scsi/pmcraid.c:2353:12: warning: context imbalance in 'pmcraid_reset_reload' - different lock contexts for basic block Fix this by using a common unlock goto label, and also reduce the indentation level in the function. Signed-off-by: Christoph Hellwig Reported-by: Arnd Bergmann Signed-off-by: Martin K. Petersen drivers/scsi/pmcraid.c | 59 ++++++++++++++++++++++++-------------------------- 1 file changed, 28 insertions(+), 31 deletions(-) commit fd7647979a3948dae4fc6f25dbbdf9ba269bed78 Merge: e720c19 9d43f5e Author: Ingo Molnar Date: Mon Apr 24 23:31:35 2017 +0200 Merge tag 'perf-core-for-mingo-4.12-20170424' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/core Pull perf/core improvements and fixes from Arnaldo Carvalho de Melo: User visible changes: - Fix display of data source snoop indication in 'perf mem' (Andi Kleen) - Fix the code to strip command name from /proc/PID/stat (Jiri Olsa) Infrastructure changes: - Continue the disentanglement of headers, specially util.h (Arnaldo Carvalho de Melo) - Synchronize some header files with the kernel (Arnaldo Carvalho de Melo) Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Ingo Molnar commit 8979b02aaf1d6de8d52cc143aa4da961ed32e5a2 Author: Stefan Berger Date: Mon Apr 17 21:58:26 2017 -0400 tpm: Fix reference count to main device The main device is currently not properly released due to one additional reference to the 'devs' device which is only released in case of a TPM 2. So, also get the additional reference only in case of a TPM2. Fixes: fdc915f7f719 ("tpm: expose spaces via a device link /dev/tpmrm") Signed-off-by: Stefan Berger Reviewed-by: Jarkko Sakkinen Tested-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen drivers/char/tpm/tpm-chip.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit e6aef069b6e97790cb127d5eeb86ae9ff0b7b0e3 Author: Jerry Snitselaar Date: Mon Mar 27 08:46:04 2017 -0700 tpm_tis: convert to using locality callbacks This patch converts tpm_tis to use of the new tpm class ops request_locality, and relinquish_locality. With the move to using the callbacks, release_locality is changed so that we now release the locality even if there is no request pending. This required some changes to the tpm_tis_core_init code path to make sure locality is requested when needed: - tpm2_probe code path will end up calling request/release through callbacks, so request_locality prior to tpm2_probe not needed. - probe_itpm makes calls to tpm_tis_send_data which no longer calls request_locality, so add request_locality prior to tpm_tis_send_data calls. Also drop release_locality call in middleof probe_itpm, and keep locality until release_locality called at end of probe_itpm. Cc: Peter Huewe Cc: Jarkko Sakkinen Cc: Jason Gunthorpe Cc: Marcel Selhorst Signed-off-by: Jerry Snitselaar Reviewed-by: Jarkko Sakkinen Tested-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen drivers/char/tpm/tpm_tis_core.c | 34 ++++++++-------------------------- 1 file changed, 8 insertions(+), 26 deletions(-) commit fd5c78694f3f1c875e293de7a641ba8a3d60d00d Author: Petr Vandrovec Date: Wed Mar 29 00:43:30 2017 -0700 tpm: fix handling of the TPM 2.0 event logs When TPM2 log has entries with more than 3 digests, or with digests not listed in the log header, log gets misparsed, eventually leading to kernel complaint that code tried to vmalloc 512MB of memory (I have no idea what would happen on bigger system). So code should not parse only first 3 digests: both event header and event itself are already in memory, so we can parse any number of digests, as long as we do not try to parse whole memory when given count of 0xFFFFFFFF. So this change: * Rejects event entry with more digests than log header describes. Digest types should be unique, and all should be described in log header, so there cannot be more digests in the event than in the header. * Reject event entry with digest that is not described in the log header. In theory code could hardcode information about digest IDs already assigned by TCG, but if firmware authors cannot get event log format right, why should anyone believe that they got event log content right. Cc: stable@vger.kernel.org Fixes: 4d23cc323cdb ("tpm: add securityfs support for TPM 2.0 firmware event log") Signed-off-by: Petr Vandrovec Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen drivers/char/tpm/tpm2_eventlog.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) commit 3b395d67d9d6c20d142f6a1618c44577d3d79347 Author: Jarkko Sakkinen Date: Wed Apr 5 14:07:24 2017 +0300 tpm_crb: remove a cruft constant Remove a useless constant that slipped through me when I did the code review. This commit fixes the issue. Cc: Jiandi An Fixes: 69c558de63c7 ("tpm/tpm_crb: Enable TPM CRB interface for ARM64") Signed-off-by: Jarkko Sakkinen drivers/char/tpm/tpm_crb.c | 3 +-- include/acpi/actbl2.h | 2 -- 2 files changed, 1 insertion(+), 4 deletions(-) commit 7574f67eb457bbd053e5addae665c187f309668b Author: Santosh Shilimkar Date: Mon Apr 24 14:17:35 2017 -0700 soc: pm-domain: Fix the mangled urls Signed-off-by: Santosh Shilimkar drivers/soc/ti/ti_sci_pm_domains.c | 2 +- include/dt-bindings/genpd/k2g.h | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) commit 17586188276980ff10d1244a35aeb31ae199705e Author: Naveen N. Rao Date: Sun Apr 23 22:53:43 2017 +0530 kallsyms: Use bounded strnchr() when parsing string When parsing for the format, we use strchr() to look for the separator, when we know that the module name can't be longer than MODULE_NAME_LEN. Enforce the same using strnchr(). Signed-off-by: Naveen N. Rao Reviewed-by: Masami Hiramatsu Signed-off-by: Jessica Yu kernel/module.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c4e649b09f55595e6df6da5465a5b3cfc93557c1 Author: Stefan Assmann Date: Wed Apr 19 09:22:45 2017 +0200 PCI: Disable boot interrupt quirk for ASUS M2N-LR The ASUS M2N-LR should not trigger boot interrupt quirks although it carries an Intel 6702PXH. On this board the boot interrupt quirks cause incorrect IRQ assignments and should be disabled. Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=43074 Tested-by: Solomon Peachy Signed-off-by: Stefan Assmann Signed-off-by: Bjorn Helgaas drivers/pci/quirks.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) commit 0e43d1009d64afcc57bfb5155f1a36c395fac178 Merge: e390b55 dfc5be0 Author: David S. Miller Date: Mon Apr 24 16:20:20 2017 -0400 Merge branch 'bpf-misc-cleanups' Alexander Alemayhu says: ==================== Misc BPF cleanup while looking into making the Makefile in samples/bpf better handle O= I saw several warnings when running `make clean && make samples/bpf/`. This series reduces those warnings. ==================== Signed-off-by: David S. Miller commit dfc5be0dc0f83e70919a8ec59c122709a30f791e Author: Alexander Alemayhu Date: Mon Apr 24 15:31:08 2017 +0200 samples/bpf: check before defining offsetof Fixes the following warning samples/bpf/test_lru_dist.c:28:0: warning: "offsetof" redefined #define offsetof(TYPE, MEMBER) ((size_t)&((TYPE *)0)->MEMBER) In file included from ./tools/lib/bpf/bpf.h:25:0, from samples/bpf/libbpf.h:5, from samples/bpf/test_lru_dist.c:24: /usr/lib/gcc/x86_64-redhat-linux/6.3.1/include/stddef.h:417:0: note: this is the location of the previous definition #define offsetof(TYPE, MEMBER) __builtin_offsetof (TYPE, MEMBER) Signed-off-by: Alexander Alemayhu Acked-by: Daniel Borkmann Signed-off-by: David S. Miller samples/bpf/test_lru_dist.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) commit 4784726f69ffa3e076d502a5885d753ccb24a82d Author: Alexander Alemayhu Date: Mon Apr 24 15:31:07 2017 +0200 samples/bpf: add static to function with no prototype Fixes the following warning samples/bpf/cookie_uid_helper_example.c: At top level: samples/bpf/cookie_uid_helper_example.c:276:6: warning: no previous prototype for ‘finish’ [-Wmissing-prototypes] void finish(int ret) ^~~~~~ HOSTLD samples/bpf/per_socket_stats_example Signed-off-by: Alexander Alemayhu Acked-by: Daniel Borkmann Signed-off-by: David S. Miller samples/bpf/cookie_uid_helper_example.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 69b6a7f743d3dac773f9a4c7b1786164ae329490 Author: Alexander Alemayhu Date: Mon Apr 24 15:31:06 2017 +0200 samples/bpf: add -Wno-unknown-warning-option to clang I was initially going to remove '-Wno-address-of-packed-member' because I thought it was not supposed to be there but Daniel suggested using '-Wno-unknown-warning-option'. This silences several warnings similiar to the one below warning: unknown warning option '-Wno-address-of-packed-member' [-Wunknown-warning-option] 1 warning generated. clang -nostdinc -isystem /usr/lib/gcc/x86_64-redhat-linux/6.3.1/include -I./arch/x86/include -I./arch/x86/include/generated/uapi -I./arch/x86/include/generated -I./include -I./arch/x86/include/uapi -I./include/uapi -I./include/generated/uapi -include ./include/linux/kconfig.h \ -D__KERNEL__ -D__ASM_SYSREG_H -Wno-unused-value -Wno-pointer-sign \ -Wno-compare-distinct-pointer-types \ -Wno-gnu-variable-sized-type-not-at-end \ -Wno-address-of-packed-member -Wno-tautological-compare \ -O2 -emit-llvm -c samples/bpf/xdp_tx_iptunnel_kern.c -o -| llc -march=bpf -filetype=obj -o samples/bpf/xdp_tx_iptunnel_kern.o $ clang --version clang version 3.9.1 (tags/RELEASE_391/final) Target: x86_64-unknown-linux-gnu Thread model: posix InstalledDir: /usr/bin Signed-off-by: Alexander Alemayhu Acked-by: Daniel Borkmann Signed-off-by: David S. Miller samples/bpf/Makefile | 1 + 1 file changed, 1 insertion(+) commit e390b55d5aefe2b51569068b2a505d19d72afbf1 Author: Daniel Borkmann Date: Mon Apr 24 22:14:35 2017 +0200 bpf: make bpf_xdp_adjust_head support mandatory Now that also the last in-tree user of the xdp_adjust_head bit has been removed, we can remove the flag from struct bpf_prog altogether. This, at the same time, also makes sure that any future driver for XDP comes with bpf_xdp_adjust_head() support right away. A rejection based on this flag would also mean that tail calls couldn't be used with such driver as per c2002f983767 ("bpf: fix checking xdp_adjust_head on tail calls") fix, thus lets not allow for it in the first place. Signed-off-by: Daniel Borkmann Acked-by: Alexei Starovoitov Signed-off-by: David S. Miller include/linux/filter.h | 3 +-- kernel/bpf/verifier.c | 3 --- 2 files changed, 1 insertion(+), 5 deletions(-) commit 4086d3f61b6573f65ddc13fc375c0c7b0ac482a0 Author: Hou Pengyang Date: Fri Apr 21 12:41:48 2017 +0000 f2fs: skip encrypted inode in ASYNC IPU policy Async request may be throttled in block layer, so page for async may keep WRITE_BACK for a long time. For encrytped inode, we need wait on page writeback no matter if the device supports BDI_CAP_STABLE_WRITES. This may result in a higher waiting page writeback time for async encrypted inode page. This patch skips IPU for encrypted inode's updating write. Signed-off-by: Hou Pengyang Signed-off-by: Jaegeuk Kim fs/f2fs/segment.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit a788189305df9fa617e5e26dc0914d80d981cd57 Author: Jaegeuk Kim Date: Thu Apr 20 13:51:57 2017 -0700 f2fs: fix out-of free segments This patch also reverts d0db7703ac1 ("f2fs: do SSR in higher priority"). This patch fixes out of free segments caused by many small file creation by 1) mkfs -s 1 2G 2) mount 3) untar - preoduce 60000 small files burstly 4) sync - flush node pages - flush imeta Here, when we do f2fs_balance_fs, we missed # of imeta blocks, resulting in skipping to check has_not_enough_free_secs. Another test is done by 1) mkfs -s 12 2G 2) mount 3) untar - preoduce 60000 small files burstly 4) sync - flush node pages - flush imeta In this case, this patch also fixes wrong block allocation under large section size. Reported-by: William Brana Cc: Signed-off-by: Jaegeuk Kim fs/f2fs/data.c | 3 ++- fs/f2fs/inode.c | 3 ++- fs/f2fs/segment.c | 26 +++++++++++++++++++++----- 3 files changed, 25 insertions(+), 7 deletions(-) commit 29fa6c567855eb92d21122162029c5709892106b Author: Jaegeuk Kim Date: Wed Apr 19 17:36:38 2017 -0700 f2fs: add parentheses for macro variables more This patch adds parentheses for macro variables more in include/linux/f2fs_fs.h. Signed-off-by: Jaegeuk Kim include/linux/f2fs_fs.h | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit d66450e77350d47ac865a56fec4a62dfcc7756ae Author: Arnd Bergmann Date: Wed Apr 19 19:38:33 2017 +0200 f2fs: improve definition of statistic macros With a recent addition of f2fs_lookup_extent_tree(), we get a warning about the use of empty macros: fs/f2fs/extent_cache.c: In function 'f2fs_lookup_extent_tree': fs/f2fs/extent_cache.c:358:32: error: suggest braces around empty body in an 'else' statement [-Werror=empty-body] stat_inc_rbtree_node_hit(sbi); A good way to avoid the warning and make the code more robust is to define all no-op macros as 'do { } while (0)'. Fixes: 54c2258cd63a ("f2fs: extract rb-tree operation infrastructure") Signed-off-by: Arnd Bergmann Reivewed-by: Chao Yu Signed-off-by: Jaegeuk Kim fs/f2fs/f2fs.h | 58 +++++++++++++++++++++++++++++----------------------------- 1 file changed, 29 insertions(+), 29 deletions(-) commit 91ec701a553cb3de470fd471c6fefe3ad1125455 Author: Pan Bian Date: Sun Apr 23 20:04:04 2017 +0800 qlcnic: fix unchecked return value Function pci_find_ext_capability() may return 0, which is an invalid address. In function qlcnic_sriov_virtid_fn(), its return value is used without validation. This may result in invalid memory access bugs. This patch fixes the bug. Signed-off-by: Pan Bian Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c | 2 ++ 1 file changed, 2 insertions(+) commit d579324998a39fa6e13edea2f06506840df9b729 Author: Jaegeuk Kim Date: Tue Apr 18 15:03:15 2017 -0700 f2fs: assign allocation hint for warm/cold data This patch gives slower device region to warm/cold data area more eagerly. Signed-off-by: Jaegeuk Kim fs/f2fs/gc.c | 5 +++++ 1 file changed, 5 insertions(+) commit d07efb507779171bd670e8a12f283a3e245cde08 Author: Jaegeuk Kim Date: Tue Apr 18 13:47:25 2017 -0700 f2fs: fix _IOW usage This patch fixes wrong _IOW usage. Signed-off-by: Jaegeuk Kim fs/f2fs/f2fs.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit e066b83c9b40f3a6951fb693ef0943fa1dfc40c2 Author: Jaegeuk Kim Date: Thu Apr 13 15:17:00 2017 -0700 f2fs: add ioctl to flush data from faster device to cold area This patch adds an ioctl to flush data in faster device to cold area. User can give device number and number of segments to move. It doesn't move it if there is only one device. The parameter looks like: struct f2fs_flush_device { u32 dev_num; /* device number to flush */ u32 segments; /* # of segments to flush */ }; Signed-off-by: Jaegeuk Kim fs/f2fs/f2fs.h | 11 +++++++-- fs/f2fs/file.c | 69 +++++++++++++++++++++++++++++++++++++++++++++++++++++-- fs/f2fs/gc.c | 42 ++++++++++++++++++++++----------- fs/f2fs/segment.c | 14 +++++++---- fs/f2fs/segment.h | 7 +++++- 5 files changed, 120 insertions(+), 23 deletions(-) commit 2a39e7aa8a98f777f0732ca7125b6c9668791760 Author: Pan Bian Date: Sun Apr 23 17:38:35 2017 +0800 wan: pc300too: abort path on failure In function pc300_pci_init_one(), on the ioremap error path, function pc300_pci_remove_one() is called to free the allocated memory. However, the path is not terminated, and the freed memory will be used later, resulting in use-after-free bugs. This path fixes the bug. Signed-off-by: Pan Bian Signed-off-by: David S. Miller drivers/net/wan/pc300too.c | 1 + 1 file changed, 1 insertion(+) commit 78302fd405769c9a9379e9adda119d533dce2eed Author: Pan Bian Date: Sun Apr 23 15:09:19 2017 +0800 tipc: check return value of nlmsg_new Function nlmsg_new() will return a NULL pointer if there is no enough memory, and its return value should be checked before it is used. However, in function tipc_nl_node_get_monitor(), the validation of the return value of function nlmsg_new() is missed. This patch fixes the bug. Signed-off-by: Pan Bian Signed-off-by: David S. Miller net/tipc/node.c | 2 ++ 1 file changed, 2 insertions(+) commit a50fe0ffd76fbd17af36209a16caf0b8ad901fef Author: Pan Bian Date: Sun Apr 23 14:28:37 2017 +0800 lwtunnel: check return value of nla_nest_start Function nla_nest_start() may return a NULL pointer on error. However, in function lwtunnel_fill_encap(), the return value of nla_nest_start() is not validated before it is used. This patch checks the return value of nla_nest_start() against NULL. Signed-off-by: Pan Bian Signed-off-by: David S. Miller net/core/lwtunnel.c | 2 ++ 1 file changed, 2 insertions(+) commit 01d95843335c6d7bb7d100c0083165f489c6e50b Author: Steven J. Hill Date: Mon Apr 24 13:41:57 2017 -0500 mmc: cavium: Add MMC support for Octeon SOCs. Add platform driver for Octeon SOCs. Signed-off-by: Steven J. Hill Signed-off-by: David Daney Signed-off-by: Ulf Hansson drivers/mmc/host/Kconfig | 10 ++ drivers/mmc/host/Makefile | 2 + drivers/mmc/host/cavium-octeon.c | 351 +++++++++++++++++++++++++++++++++++++++ 3 files changed, 363 insertions(+) commit dceb9781dcad8b9bdb88b9f7c06b2e47f5ad789e Author: Steven J. Hill Date: Mon Apr 24 13:41:56 2017 -0500 mmc: cavium: Fix detection of block or byte addressing. Use the mmc_card_is_blockaddr() function to properly detect if the card uses byte or block addressing. Signed-off-by: Steven J. Hill Acked-by: David Daney Signed-off-by: Ulf Hansson drivers/mmc/host/cavium.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 33e6d74d65c358270f00d228877178964aab84b3 Author: Ulf Hansson Date: Mon Apr 24 13:41:55 2017 -0500 mmc: core: Export API to allow hosts to get the card address Some hosts controllers, like Cavium, needs to know whether the card operates in byte- or block-address mode. Therefore export a new API, mmc_card_is_blockaddr(), which provides this information. Signed-off-by: Ulf Hansson Signed-off-by: Steven J. Hill Acked-by: David Daney drivers/mmc/core/core.c | 6 ++++++ include/linux/mmc/card.h | 2 ++ 2 files changed, 8 insertions(+) commit f328c76e568d13c9fee21b5cf7411c96285f0f89 Author: jiajie.hao@mediatek.com Date: Sun Apr 23 17:38:27 2017 +0800 mmc: sdio: Fix sdio wait busy implement limitation The host may issue an I/O abort by writing to the CCCR at any time during I/O read operation via CMD52. And host may need suspend transcation during write busy stage in SDIO suspend/resume scenario. >From other side, a card may accept CMD52 during data transfer phase. Previous implement would block issuing above command in busy stage. It cause function driver can't implement as proper way and has no opportunity to do some coverage in error case via I/O abort etc. We need bypass some necessary operation during busy check stage. Signed-off-by: Jiajie Hao Signed-off-by: Ulf Hansson drivers/mmc/core/core.c | 4 +++- drivers/mmc/core/sdio_ops.h | 10 ++++++++-- 2 files changed, 11 insertions(+), 3 deletions(-) commit d9370424c9482d0ca2722627309c6f6bae131d97 Author: Haibo Chen Date: Tue Apr 18 18:05:31 2017 +0800 mmc: sdhci-esdhc-imx: reset tuning circuit when power on mmc card USDHC tuning circuit should be reset before every time card enumeration or re-enumeration. SD3.0 card need tuning. For SDR104 card, when system suspend in standby mode, and then resume back, the IO timing is still SDR104(tuned) which may result in card re-enumeration fail in low card speed(400khz) for some cards. And we did meet the issue that in certain probability, SDR104 card meet mmc command CRC/Timeout error when send CMD2 during mmc bus resume. This patch reset the tuning circuit when the ios timing is MMC_TIMING_LEGACY/MMC_TIMING_MMC_HS/MMC_TIMING_SD_HS, which means both mmc_power_up() and mmc_power_off() will reset the tuning circuit. Signed-off-by: Haibo Chen Acked-by: Dong Aisheng Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-esdhc-imx.c | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) commit a82d12b8d5a626e30d2f15627079abdaa2e77c05 Author: Colin Ian King Date: Tue Apr 11 14:37:43 2017 +0100 clk: apn806: fix spelling mistake: "mising" -> "missing" trivial fix to spelling mistake in dev_warn message Signed-off-by: Colin Ian King Acked-by: Stephen Boyd Signed-off-by: Ulf Hansson drivers/clk/mvebu/ap806-system-controller.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6b236f37b0fa88fac93e6782fd25cbf9907e5048 Author: yangbo lu Date: Thu Apr 20 16:14:44 2017 +0800 mmc: sdhci-of-esdhc: add delay between tuning cycles It's observed that eSDHC needed delay between tuning cycles for HS200 successful tuning. This patch is to set 1ms delay for that. Signed-off-by: Yangbo Lu Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-of-esdhc.c | 1 + 1 file changed, 1 insertion(+) commit 83b600b8de0e83661a8f40091a7966fac052a21b Author: Adrian Hunter Date: Thu Apr 20 16:14:43 2017 +0800 mmc: sdhci: Control the delay between tuning commands The delay between tuning commands for SD cards is not part of the specification. A driver that needs it probably needs it for eMMC too, whereas most drivers would probably like to set it to 0. Make it a host member (host->tuning_delay) that defaults to the existing behaviour. Drivers can set it to zero to eliminate the delay, or set it to a positive value to always have a delay. Signed-off-by: Adrian Hunter Signed-off-by: Yangbo Lu Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci.c | 11 ++++++++--- drivers/mmc/host/sdhci.h | 2 ++ 2 files changed, 10 insertions(+), 3 deletions(-) commit ba49cbd0936e12eac245c0fb420a291e8505f639 Author: yangbo lu Date: Thu Apr 20 16:14:42 2017 +0800 mmc: sdhci-of-esdhc: add tuning support eSDHC uses tuning block for tuning procedure. So the tuning block control register must be configured properly before tuning. Signed-off-by: Yangbo Lu Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-esdhc.h | 5 +++++ drivers/mmc/host/sdhci-of-esdhc.c | 20 ++++++++++++++++++++ 2 files changed, 25 insertions(+) commit ea35645a3c66a74af92d3bbb4eb131220fc3e58a Author: yangbo lu Date: Thu Apr 20 16:14:41 2017 +0800 mmc: sdhci-of-esdhc: add support for signal voltage switch eSDHC supports signal voltage switch from 3.3v to 1.8v by eSDHC_PROCTL[VOLT_SEL] bit. This bit changes the value of output signal SDHC_VS, and there must be a control circuit out of eSDHC to change the signal voltage according to SDHC_VS output signal. Signed-off-by: Yangbo Lu Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-esdhc.h | 1 + drivers/mmc/host/sdhci-of-esdhc.c | 74 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 75 insertions(+) commit 19c3a0ef65adf090cb592dfe3e575f40322c88d8 Author: yangbo lu Date: Thu Apr 20 16:14:40 2017 +0800 mmc: sdhci-of-esdhc: add peripheral clock support eSDHC could select peripheral clock or platform clock as clock source by the PCS bit of eSDHC Control Register, and this bit couldn't be reset by software reset for all. In default, the platform clock is used. But we have to use peripheral clock since it has a higher frequency to support eMMC HS200 mode and SD UHS-I mode. This patch is to add peripheral clock support and use it instead of platform clock if it's declared in eSDHC dts node. Signed-off-by: Yangbo Lu Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-esdhc.h | 1 + drivers/mmc/host/sdhci-of-esdhc.c | 73 +++++++++++++++++++++++++++++++++++++-- 2 files changed, 72 insertions(+), 2 deletions(-) commit a72016a44703476bdb3567a13695938566e8f413 Author: Adrian Hunter Date: Wed Apr 19 15:48:55 2017 +0300 mmc: sdhci-pci: Allow for 3 bytes from Intel DSM The DSM used by some Intel controllers can return a 3 byte package. Allow for that by using memcpy to copy the bytes. Signed-off-by: Adrian Hunter Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-pci-core.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) commit 3fcc78340f3a9bef2be7ad54258b06e1f177d3fd Author: Dan Carpenter Date: Thu Apr 13 22:47:48 2017 +0300 mmc: cavium: Fix a shift wrapping bug "dat" is a u64 and "shift" starts as 54 so this is a shift wrapping bug. Signed-off-by: Dan Carpenter Signed-off-by: Ulf Hansson drivers/mmc/host/cavium.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fe79018aa4c3af7d74e48b9a9b117da9fb6cf353 Author: Jan Glauber Date: Thu Apr 13 14:10:51 2017 +0200 mmc: cavium: Check pointer before de-reference Add a pointer check to prevent this smatch warning: drivers/mmc/host/cavium.c:803 cvm_mmc_request() error: we previously assumed 'cmd->data' could be null (see line 782) This is a theoretical fix because MMC_CMD_ADTC seems to imply that cmd->data is not null. Nevertheless checking cmd->data before using it improves readability. Signed-off-by: Jan Glauber Signed-off-by: Ulf Hansson drivers/mmc/host/cavium.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit c34d1579de4665d9613691bc37aebb7ca86d535d Author: Jan Glauber Date: Thu Apr 13 14:10:50 2017 +0200 mmc: cavium: Remove redundant pointer check Remove redundant mmc->card check reported by smatch: drivers/mmc/host/cavium.c:694 cvm_mmc_dma_request() warn: variable dereferenced before check 'mmc->card' (see line 675) Signed-off-by: Jan Glauber Signed-off-by: Ulf Hansson drivers/mmc/host/cavium.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 79ed05e329c34c68ab2a87f729e666fcf208fdad Author: Heiner Kallweit Date: Fri Apr 7 21:22:44 2017 +0200 mmc: meson-gx: add support for descriptor chain mode So far a bounce buffer is used to serialize the scatterlist(s). This overhead can be avoided by switching to descriptor chain mode. As result the performance is drastically improved. On a Odroid-C2 with a 128 GB eMMC module raw reads reach 140 MB/s. Prerequisite for descriptor chain mode is that all scatterlist buffers are 8 byte aligned for 64-bit DMA. That's not always the case, at least the brcmfmac SDIO WiFi driver is known to cause problems. Therefore, for each request, check upfront whether all scatterlist buffers are 8 byte aligned and fall back to bounce buffer mode if that's not the case. Signed-off-by: Heiner Kallweit Signed-off-by: Ulf Hansson drivers/mmc/host/meson-gx-mmc.c | 172 ++++++++++++++++++++++++++++++++++++---- 1 file changed, 156 insertions(+), 16 deletions(-) commit 0b6ed71c3e95abf6cd1dbfc53919defdce3449f5 Author: Heiner Kallweit Date: Tue Apr 4 21:11:17 2017 +0200 mmc: meson-gx: add basic tuning for rx clock phase This patch adds basic tuning which changes the rx clock phase only until a working setting is found. On a Odroid C2 with 128GB eMMC card and 200 MHz MMC clock only 180° rx clock phase make the system boot w/o CRC errors. With other MMC devices / clock speeds this might be different, therefore don't change the driver config in general. When retuning skip the currently active parameter set. This avoids the current problematic config to be chosen again if it causes CRC errors just occasionally. Signed-off-by: Heiner Kallweit Signed-off-by: Ulf Hansson drivers/mmc/host/meson-gx-mmc.c | 49 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) commit c08bcb6c90068d8eacffdb8b5f77916de5481a72 Author: Heiner Kallweit Date: Tue Apr 4 21:03:22 2017 +0200 mmc: meson-gx: introduce struct meson_tuning_params Introduce struct meson_tuning_params for storing the clock phase configurations. There's no functional change because tx and rx clock phase were implicitely set to CLK_PHASE_0 before. Signed-off-by: Heiner Kallweit Signed-off-by: Ulf Hansson drivers/mmc/host/meson-gx-mmc.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) commit 06c9ccb78e68e2e9b69e736fc0a39fb13be49b74 Author: Winkler, Tomas Date: Sun Apr 2 23:56:03 2017 +0300 mmc: core: add proper be32 annotation Annotate big endian values correctly and make sparse happy. In mmc_app_send_scr remove scr function parameter as it was updating card->raw_scr anyway. Signed-off-by: Tomas Winkler Signed-off-by: Ulf Hansson drivers/mmc/core/mmc_ops.c | 8 ++++---- drivers/mmc/core/sd.c | 4 ++-- drivers/mmc/core/sd_ops.c | 19 +++++++++---------- drivers/mmc/core/sd_ops.h | 2 +- 4 files changed, 16 insertions(+), 17 deletions(-) commit 861183f115cd80db7efebf5516f4e7a424c13abd Author: Piotr Sroka Date: Tue Apr 11 12:13:38 2017 +0100 mmc: sdhci-cadence: add parsing sdhci properties Add calling sdhci_get_of_property function to parse sdhci properties. Signed-off-by: Piotr Sroka Acked-by: Adrian Hunter Reviewed-by: Masahiro Yamada Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-cadence.c | 2 ++ 1 file changed, 2 insertions(+) commit ec5ab8933772c87f24ad62a4a602fe8949f423c2 Author: Dan Carpenter Date: Mon Apr 10 16:54:17 2017 +0300 mmc: host: omap_hsmmc: checking for NULL instead of IS_ERR() devm_pinctrl_get() returns error pointers, it never returns NULL. Fixes: 455e5cd6f736 ("mmc: omap_hsmmc: Pin remux workaround to support SDIO interrupt on AM335x") Signed-off-by: Dan Carpenter Reviewed-by: Kishon Vijay Abraham I Signed-off-by: Ulf Hansson drivers/mmc/host/omap_hsmmc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 511fc93d2ceb71d92071bdc950c4959ed3ac741b Author: Hu Ziji Date: Thu Mar 30 17:23:02 2017 +0200 MAINTAINERS: add entry for Marvell Xenon MMC Host Controller drivers Add maintainer entry for Marvell Xenon eMMC/SD/SDIO Host Controller drivers. Signed-off-by: Hu Ziji Signed-off-by: Gregory CLEMENT Signed-off-by: Ulf Hansson MAINTAINERS | 7 +++++++ 1 file changed, 7 insertions(+) commit 298269c602b54dd56e1424cb8e706fc30bc7d489 Author: Hu Ziji Date: Thu Mar 30 17:23:01 2017 +0200 mmc: sdhci-xenon: Add SoC PHY PAD voltage control Some SoCs have PHY PAD outside Xenon IP. PHY PAD voltage should match signalling voltage in use. Add generic SoC PHY PAD voltage control interface. Implement Aramda-3700 SoC PHY PAD voltage control. Signed-off-by: Hu Ziji Tested-by: Russell King Signed-off-by: Gregory CLEMENT Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-xenon-phy.c | 110 ++++++++++++++++++++++++++++++++++++- drivers/mmc/host/sdhci-xenon.c | 2 + drivers/mmc/host/sdhci-xenon.h | 2 + 3 files changed, 113 insertions(+), 1 deletion(-) commit 06c8b667ff5b984ac3aa901c4928e4a427987a56 Author: Hu Ziji Date: Thu Mar 30 17:23:00 2017 +0200 mmc: sdhci-xenon: Add support to PHYs of Marvell Xenon SDHC Marvell Xenon eMMC/SD/SDIO Host Controller contains PHY. Multiple types of PHYs are supported. Add support to multiple types of PHYs init and configuration. Add register definitions of PHYs. Xenon PHY cannot fit in kernel common PHY framework. Xenon SDHC PHY register is a part of Xenon SDHC register set. Besides, MMC initialization has to call several PHY functions to complete timing setting. Those PHY setting functions have to access SDHC registers and know current MMC setting, such as bus width, clock frequency and speed mode. As a result, implement Xenon PHY in MMC host directory. Signed-off-by: Hu Ziji Signed-off-by: Gregory CLEMENT Signed-off-by: Ulf Hansson drivers/mmc/host/Makefile | 2 +- drivers/mmc/host/sdhci-xenon-phy.c | 727 +++++++++++++++++++++++++++++++++++++ drivers/mmc/host/sdhci-xenon.c | 9 +- drivers/mmc/host/sdhci-xenon.h | 39 ++ 4 files changed, 774 insertions(+), 3 deletions(-) commit 3a3748dba881ed23ba8465dd6d66a267af89cdc0 Author: Hu Ziji Date: Thu Mar 30 17:22:59 2017 +0200 mmc: sdhci-xenon: Add Marvell Xenon SDHC core functionality Add Xenon eMMC/SD/SDIO host controller core functionality. Add Xenon specific initialization process. Add Xenon specific mmc_host_ops APIs. Add Xenon specific register definitions. Add CONFIG_MMC_SDHCI_XENON support in drivers/mmc/host/Kconfig. Marvell Xenon SDHC conforms to SD Physical Layer Specification Version 3.01 and is designed according to the guidelines provided in the SD Host Controller Standard Specification Version 3.00. Signed-off-by: Hu Ziji Signed-off-by: Gregory CLEMENT Signed-off-by: Ulf Hansson drivers/mmc/host/Kconfig | 8 + drivers/mmc/host/Makefile | 3 + drivers/mmc/host/sdhci-xenon.c | 541 +++++++++++++++++++++++++++++++++++++++++ drivers/mmc/host/sdhci-xenon.h | 60 +++++ 4 files changed, 612 insertions(+) commit 66c659cf5cda6f21c0f7832b735c180a9f99a790 Author: Hu Ziji Date: Thu Mar 30 17:22:58 2017 +0200 dt: bindings: Add bindings for Marvell Xenon SD Host Controller Marvell Xenon SDHC can support eMMC/SD/SDIO. Add Xenon-specific properties. Also add properties for Xenon PHY setting. Signed-off-by: Hu Ziji Signed-off-by: Gregory CLEMENT Acked-by: Rob Herring Signed-off-by: Ulf Hansson .../bindings/mmc/marvell,xenon-sdhci.txt | 170 +++++++++++++++++++++ 1 file changed, 170 insertions(+) commit 2f05b6ab5fa7f279015c70f625ec5c532781eb2b Author: Hu Ziji Date: Thu Mar 30 17:22:57 2017 +0200 mmc: sdhci: Export sdhci_enable_sdio_irq() from sdhci.c Export sdhci_enable_sdio_irq() from sdhci.c. Thus vendor SDHC driver can implement its specific SDIO irq control. Signed-off-by: Hu Ziji Signed-off-by: Gregory CLEMENT Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci.c | 3 ++- drivers/mmc/host/sdhci.h | 1 + 2 files changed, 3 insertions(+), 1 deletion(-) commit c376ea9e46215fbfa09b371f79c821fa5a51f26e Author: Hu Ziji Date: Thu Mar 30 17:22:56 2017 +0200 mmc: sdhci: Export sdhci_start_signal_voltage_switch() in sdhci.c Export sdhci_start_signal_voltage_switch() from sdhci.c. Thus vendor sdhci driver can implement its own signal voltage switch routine. Signed-off-by: Hu Ziji Signed-off-by: Gregory CLEMENT Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci.c | 5 +++-- drivers/mmc/host/sdhci.h | 2 ++ 2 files changed, 5 insertions(+), 2 deletions(-) commit 6a6d4ceb7be0c72b2190f4b6b9d5d8982957fc04 Author: Hu Ziji Date: Thu Mar 30 17:22:55 2017 +0200 mmc: sdhci: Export sdhci_set_ios() from sdhci.c Export sdhci_set_ios() in sdhci.c. Thus vendor sdhci driver can implement its own set_ios() routine. Signed-off-by: Hu Ziji Signed-off-by: Gregory CLEMENT Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci.c | 3 ++- drivers/mmc/host/sdhci.h | 1 + 2 files changed, 3 insertions(+), 1 deletion(-) commit b92a3bcc7c3ca4ee8d228f033de32aefff3c74a4 Author: Gregory CLEMENT Date: Thu Mar 30 17:22:54 2017 +0200 clk: apn806: Turn the eMMC clock as optional for dts backwards compatible First version of the binding didn't have the eMMC clock. This patch allows to not registering the eMMC clock if it is not present in the device tree. Then the device tree can be backwards compatible. Suggested-by: Stephen Boyd Signed-off-by: Gregory CLEMENT Signed-off-by: Ulf Hansson drivers/clk/mvebu/ap806-system-controller.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) commit a8309cedcdce94fc6e36d49d0bf8e75d5813ebc6 Author: Konstantin Porotchkin Date: Thu Mar 30 17:22:53 2017 +0200 clk: apn806: Add eMMC clock to system controller driver Add fixed clock of 400MHz to system controller driver. This clock is used as SD/eMMC clock source. Signed-off-by: Konstantin Porotchkin Reviewed-by: Omri Itach Reviewed-by: Hanna Hawa [fixed up conflicts, added error handling --rmk] Signed-off-by: Russell King Acked-by: Stephen Boyd Signed-off-by: Gregory CLEMENT Signed-off-by: Ulf Hansson arch/arm64/boot/dts/marvell/armada-ap806.dtsi | 3 ++- drivers/clk/mvebu/ap806-system-controller.c | 15 ++++++++++++++- 2 files changed, 16 insertions(+), 2 deletions(-) commit 25fc846503738c3d4ca886cfee4b4ff4415d0cec Author: Jan Glauber Date: Thu Mar 30 17:31:28 2017 +0200 MAINTAINERS: Add entry for Cavium MMC driver Signed-off-by: Jan Glauber Signed-off-by: David Daney Signed-off-by: Steven J. Hill Signed-off-by: Ulf Hansson MAINTAINERS | 8 ++++++++ 1 file changed, 8 insertions(+) commit 4ce944074e5e2cb7ee48ff36608d65d0bc9c7647 Author: Jan Glauber Date: Thu Mar 30 17:31:27 2017 +0200 mmc: cavium: Support DDR mode for eMMC devices Add support for switching to DDR mode for eMMC devices. Signed-off-by: Jan Glauber Signed-off-by: Ulf Hansson drivers/mmc/host/cavium.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) commit cd76e5c565e82af62f708120068ec5d226d98c95 Author: Jan Glauber Date: Thu Mar 30 17:31:26 2017 +0200 mmc: cavium: Add scatter-gather DMA support Add Support for the scatter-gather DMA available in the ThunderX MMC units. Up to 16 DMA requests can be processed together. Signed-off-by: Jan Glauber Signed-off-by: Ulf Hansson drivers/mmc/host/cavium-thunderx.c | 5 +- drivers/mmc/host/cavium.c | 104 +++++++++++++++++++++++++++++++++++-- drivers/mmc/host/cavium.h | 28 +++++++--- 3 files changed, 127 insertions(+), 10 deletions(-) commit 166bac38c3c569508e695aca99fdc2def2ae2198 Author: Jan Glauber Date: Thu Mar 30 17:31:25 2017 +0200 mmc: cavium: Add MMC PCI driver for ThunderX SOCs Add a platform driver for ThunderX ARM SOCs. Signed-off-by: Jan Glauber Signed-off-by: Ulf Hansson drivers/mmc/host/Kconfig | 11 +++ drivers/mmc/host/Makefile | 2 + drivers/mmc/host/cavium-thunderx.c | 195 +++++++++++++++++++++++++++++++++++++ drivers/mmc/host/cavium.h | 7 ++ 4 files changed, 215 insertions(+) commit ba3869ff32e4a671b0f9baa73900f9e2bfeb0414 Author: Jan Glauber Date: Thu Mar 30 17:31:24 2017 +0200 mmc: cavium: Add core MMC driver for Cavium SOCs This core driver will be used by a MIPS platform driver or by an ARM64 PCI driver. The core driver implements the mmc_host_ops and slot probe & remove functions. Callbacks are provided to allow platform specific interrupt enable and bus locking. The host controller supports: - up to 4 slots that can contain sd-cards or eMMC chips - 1, 4 and 8 bit bus width - SDR and DDR - transfers up to 52 Mhz (might be less when multiple slots are used) - DMA read/write - multi-block read/write (but not stream mode) Voltage is limited to 3.3v and shared for all slots (vmmc and vmmcq). A global lock for all MMC devices is required because the host controller is shared. Signed-off-by: Jan Glauber Signed-off-by: David Daney Signed-off-by: Steven J. Hill Signed-off-by: Ulf Hansson drivers/mmc/host/cavium.c | 982 ++++++++++++++++++++++++++++++++++++++++++++++ drivers/mmc/host/cavium.h | 192 +++++++++ 2 files changed, 1174 insertions(+) commit dc5aee3f9f454c35d4e092873b103dc791119e0e Author: Jan Glauber Date: Thu Mar 30 17:31:23 2017 +0200 dt-bindings: mmc: Add Cavium SOCs MMC bindings Add description of Cavium Octeon and ThunderX SOC device tree bindings. CC: Ulf Hansson CC: Rob Herring CC: Mark Rutland CC: devicetree@vger.kernel.org Signed-off-by: Jan Glauber Signed-off-by: David Daney Signed-off-by: Steven J. Hill Acked-by: Rob Herring Signed-off-by: Ulf Hansson .../devicetree/bindings/mmc/cavium-mmc.txt | 57 ++++++++++++++++++++++ 1 file changed, 57 insertions(+) commit 67b8360acc0d717c46af3008fc10dcc5c91f7745 Author: Linus Walleij Date: Tue Mar 28 10:40:31 2017 +0200 mmc: core: refactor mmc_request_done() We have this construction: if (a && b && !c) finalize; else block; finalize; Which is equivalent by boolean logic to: if (!a || !b || c) block; finalize; Which is simpler code. Reviewed-by: Bartlomiej Zolnierkiewicz Signed-off-by: Linus Walleij Signed-off-by: Ulf Hansson drivers/mmc/core/core.c | 27 ++++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-) commit 0e72f95bf329dea7985f0f4ac81cc888e8b79797 Author: Linus Walleij Date: Tue Mar 28 10:40:30 2017 +0200 mmc: core: refactor asynchronous request finalization mmc_wait_for_data_req_done() is called in exactly one place, and having it spread out is making things hard to oversee. Factor this function into mmc_finalize_areq(). Reviewed-by: Bartlomiej Zolnierkiewicz Signed-off-by: Linus Walleij Signed-off-by: Ulf Hansson drivers/mmc/core/core.c | 86 +++++++++++++++++++------------------------------ 1 file changed, 33 insertions(+), 53 deletions(-) commit 5744d50d2d9e7efdae4b5d13cd71f49256ada6ba Author: Linus Walleij Date: Tue Mar 28 10:40:29 2017 +0200 mmc: core: move some code in mmc_start_areq() "previous" is a better name for the variable storing the previous asynchronous request, better than the opaque name "data" atleast. We see that we assign the return status to the returned variable on all code paths, so we might as well just do that immediately after calling mmc_finalize_areq(). Reviewed-by: Bartlomiej Zolnierkiewicz Signed-off-by: Linus Walleij Signed-off-by: Ulf Hansson drivers/mmc/core/core.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) commit f34bdd2f7e2881090f566a2f93b0d8e1189091e0 Author: Adrian Hunter Date: Mon Mar 13 14:36:43 2017 +0200 mmc: core: Factor out mrq preparation from mmc_start_request() In preparation to reuse the code for CQE support. Signed-off-by: Adrian Hunter Reviewed-by: Linus Walleij Signed-off-by: Ulf Hansson drivers/mmc/core/core.c | 40 +++++++++++++++++++++++++++------------- 1 file changed, 27 insertions(+), 13 deletions(-) commit 4b67e63faaa21eab225bc3827a9d06e6ae54bdc7 Author: Adrian Hunter Date: Mon Mar 13 14:36:42 2017 +0200 mmc: core: Factor out debug prints from mmc_start_request() In preparation to reuse the code for CQE support. Signed-off-by: Adrian Hunter Reviewed-by: Linus Walleij Signed-off-by: Ulf Hansson drivers/mmc/core/core.c | 33 ++++++++++++++++++++------------- 1 file changed, 20 insertions(+), 13 deletions(-) commit ca5717f7ceef3c0aa76e2f77acb95ec3a93470c8 Author: Adrian Hunter Date: Mon Mar 13 14:36:41 2017 +0200 mmc: block: Factor out data preparation Factor out data preparation into a separate function mmc_blk_data_prep() which can be re-used for command queuing. Signed-off-by: Adrian Hunter Reviewed-by: Linus Walleij Signed-off-by: Ulf Hansson drivers/mmc/core/block.c | 151 +++++++++++++++++++++++++---------------------- 1 file changed, 82 insertions(+), 69 deletions(-) commit 9cb38f7a2d0aab5730ac18117ab2f5c9e3d4a826 Author: Adrian Hunter Date: Mon Mar 13 14:36:40 2017 +0200 mmc: block: Change mmc_apply_rel_rw() to get block address from the request mmc_apply_rel_rw() will be used by Software Command Queuing also. In that case the command argument is not the block address so change mmc_apply_rel_rw() to get block address from the request. Signed-off-by: Adrian Hunter Reviewed-by: Linus Walleij Signed-off-by: Ulf Hansson drivers/mmc/core/block.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 025e3d5fe157e8a12ed4ab59d0e147046c87cbd9 Author: Adrian Hunter Date: Mon Mar 13 14:36:39 2017 +0200 mmc: block: Disable Command Queue while RPMB is used RPMB does not allow Command Queue commands. Disable and re-enable the Command Queue when switching. Note that the driver only switches partitions when the queue is empty. Signed-off-by: Adrian Hunter Reviewed-by: Harjani Ritesh Reviewed-by: Linus Walleij Signed-off-by: Ulf Hansson drivers/mmc/core/block.c | 46 ++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 38 insertions(+), 8 deletions(-) commit 9d4579a85c84340044b10ffa6cd576397f59dc93 Author: Adrian Hunter Date: Mon Mar 13 14:36:38 2017 +0200 mmc: mmc_test: Disable Command Queue while mmc_test is used Normal read and write commands may not be used while the command queue is enabled. Disable the Command Queue when mmc_test is probed and re-enable it when it is removed. Signed-off-by: Adrian Hunter Reviewed-by: Harjani Ritesh Reviewed-by: Linus Walleij Signed-off-by: Ulf Hansson drivers/mmc/core/mmc.c | 7 +++++++ drivers/mmc/core/mmc_test.c | 14 ++++++++++++++ include/linux/mmc/card.h | 2 ++ 3 files changed, 23 insertions(+) commit b658af718465cd1e8011c8da281befdfc2debefd Author: Adrian Hunter Date: Mon Mar 13 14:36:37 2017 +0200 mmc: mmc: Add functions to enable / disable the Command Queue Add helper functions to enable or disable the Command Queue. Signed-off-by: Adrian Hunter Reviewed-by: Linus Walleij Signed-off-by: Ulf Hansson Documentation/mmc/mmc-dev-attrs.txt | 1 + drivers/mmc/core/mmc.c | 2 ++ drivers/mmc/core/mmc_ops.c | 28 ++++++++++++++++++++++++++++ drivers/mmc/core/mmc_ops.h | 2 ++ include/linux/mmc/card.h | 1 + 5 files changed, 34 insertions(+) commit 7b410d074b253a44624497a18e73f666a9574f37 Author: Adrian Hunter Date: Mon Mar 13 14:36:36 2017 +0200 mmc: queue: Share mmc request array between partitions eMMC can have multiple internal partitions that are represented as separate disks / queues. However switching between partitions is only done when the queue is empty. Consequently the array of mmc requests that are queued can be shared between partitions saving memory. Keep a pointer to the mmc request queue on the card, and use that instead of allocating a new one for each partition. Signed-off-by: Adrian Hunter Reviewed-by: Linus Walleij Signed-off-by: Ulf Hansson drivers/mmc/core/block.c | 11 ++- drivers/mmc/core/queue.c | 234 ++++++++++++++++++++++++++++------------------- drivers/mmc/core/queue.h | 2 + include/linux/mmc/card.h | 5 + 4 files changed, 156 insertions(+), 96 deletions(-) commit cdf8a6fb48882651049e468e6b16956fb83db86c Author: Adrian Hunter Date: Mon Mar 13 14:36:35 2017 +0200 mmc: block: Introduce queue semantics Change from viewing the requests in progress as 'current' and 'previous', to viewing them as a queue. The current request is allocated to the first free slot. The presence of incomplete requests is determined from the count (mq->qcnt) of entries in the queue. Non-read-write requests (i.e. discards and flushes) are not added to the queue at all and require no special handling. Also no special handling is needed for the MMC_BLK_NEW_REQUEST case. As well as allowing an arbitrarily sized queue, the queue thread function is significantly simpler. Signed-off-by: Adrian Hunter Reviewed-by: Linus Walleij Signed-off-by: Ulf Hansson drivers/mmc/core/block.c | 66 ++++++++++++++++++++++++++---------------- drivers/mmc/core/queue.c | 75 ++++++++++++++++++++++++++++++------------------ drivers/mmc/core/queue.h | 10 +++++-- 3 files changed, 95 insertions(+), 56 deletions(-) commit 8ddfe07e18c9c82f7567d3cfbd68d8b59764d015 Author: Adrian Hunter Date: Mon Mar 13 14:36:34 2017 +0200 mmc: block: Use local var for mqrq_cur A subsequent patch will remove 'mq->mqrq_cur'. Prepare for that by assigning it to a local variable. Signed-off-by: Adrian Hunter Reviewed-by: Linus Walleij Signed-off-by: Ulf Hansson drivers/mmc/core/block.c | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-) commit e584e07502131fb13e5879f3f2077c29377b08eb Author: Sergio Prado Date: Fri Mar 31 20:50:56 2017 -0300 mmc: host: s3cmci: allow probing from device tree Allows configuring Samsung S3C24XX MMC/SD/SDIO controller using a device tree. Signed-off-by: Sergio Prado [Arnd: fix broken conditional expression] Signed-off-by: Arnd Bergmann Signed-off-by: Ulf Hansson drivers/mmc/host/s3cmci.c | 257 +++++++++++++++++++++++----------------------- 1 file changed, 126 insertions(+), 131 deletions(-) commit d5cc7c80bafca02e9150a2af5ccab1aa0aa8be20 Author: Sergio Prado Date: Fri Mar 31 20:50:55 2017 -0300 dt-bindings: mmc: add DT binding for S3C24XX MMC/SD/SDIO controller Adds the device tree bindings description for Samsung S3C24XX MMC/SD/SDIO controller, used as a connectivity interface with external MMC, SD and SDIO storage mediums. Acked-by: Rob Herring Signed-off-by: Sergio Prado Signed-off-by: Ulf Hansson .../devicetree/bindings/mmc/samsung,s3cmci.txt | 42 ++++++++++++++++++++++ 1 file changed, 42 insertions(+) commit c2c49a2e2bf3758ac429c5ac9941a855b75b5e22 Author: Azhar Shaikh Date: Wed Mar 29 11:16:33 2017 -0700 mmc: sdhci-pci: Set MMC_CAP_AGGRESSIVE_PM for BYT-related Intel controllers Set MMC_CAP_AGGRESSIVE_PM for BYT-related Intel SD card controllers. Signed-off-by: Azhar Shaikh Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-pci-core.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit d3e974074f66a258c9fea12defb9ce1914ef4e4c Author: Azhar Shaikh Date: Wed Mar 29 11:16:32 2017 -0700 mmc: sdhci-acpi: Set MMC_CAP_AGGRESSIVE_PM for BYT-related Intel controllers Set MMC_CAP_AGGRESSIVE_PM for BYT-related Intel SD card controllers. Signed-off-by: Azhar Shaikh Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-acpi.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) commit 75c7fd96d0e51e8d652767e910a79aad67fe9826 Author: Heiner Kallweit Date: Mon Mar 27 22:02:32 2017 +0200 mmc: meson-gx: factor out setting response configuration bits Factor out setting the response configuration bits thus further reducing complexity of function meson_mmc_start_cmd. Signed-off-by: Heiner Kallweit Reviewed-by: Kevin Hilman Signed-off-by: Ulf Hansson drivers/mmc/host/meson-gx-mmc.c | 32 ++++++++++++++++++-------------- 1 file changed, 18 insertions(+), 14 deletions(-) commit 3d03f6a99a8de552e094445dde341ca4b4d4326a Author: Heiner Kallweit Date: Mon Mar 27 21:57:11 2017 +0200 mmc: meson-gx: factor out setting block size Factor out setting the block size. This also contributes to reducing complexity of function meson_mmc_start_cmd. Signed-off-by: Heiner Kallweit Reviewed-by: Kevin Hilman Signed-off-by: Ulf Hansson drivers/mmc/host/meson-gx-mmc.c | 42 ++++++++++++++++++++++++++--------------- 1 file changed, 27 insertions(+), 15 deletions(-) commit edf985790659503eedd5736ba89ad7e9fd754cf0 Author: Piotr Sroka Date: Tue Mar 21 14:33:26 2017 +0000 mmc: sdhci-cadence: refactor probe function Use added dev variable for devm_clk_get. Signed-off-by: Piotr Sroka Reviewed-by: Masahiro Yamada Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-cadence.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a89c472d8b55c5afc4c79e6e3d1338730034eb01 Author: Piotr Sroka Date: Tue Mar 21 14:33:11 2017 +0000 mmc: sdhci-cadence: Update PHY delay configuration DTS properties are used instead of fixed data because PHY settings can be different for different chips/boards. Signed-off-by: Piotr Sroka Reviewed-by: Masahiro Yamada Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-cadence.c | 53 ++++++++++++++++++++++++++++++++++------ 1 file changed, 46 insertions(+), 7 deletions(-) commit 6f4b0919020a482e41af4e715efaa79f45f6cde6 Author: Piotr Sroka Date: Tue Mar 21 14:33:01 2017 +0000 dt-bindings: mmc: add description of PHY delays for sdhci-cadence DTS properties are used instead of fixed data because PHY settings can be different for different chips/boards. Add description of new DLL PHY delays. Signed-off-by: Piotr Sroka Reviewed-by: Masahiro Yamada Acked-by: Rob Herring Signed-off-by: Ulf Hansson .../devicetree/bindings/mmc/sdhci-cadence.txt | 48 ++++++++++++++++++++++ 1 file changed, 48 insertions(+) commit a0f8243229ed071c8da0ea7cedc1b7bf1b1515da Author: Piotr Sroka Date: Tue Mar 21 14:32:16 2017 +0000 mmc: sdhci-cadence: Fix writing PHY delay Add polling for ACK to be sure that data are written to PHY register. Signed-off-by: Piotr Sroka Reviewed-by: Masahiro Yamada Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-cadence.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) commit bf3240bada0211b4a555d75f027181c8432b2d20 Author: Stefan Wahren Date: Sat Mar 25 13:17:00 2017 +0000 mmc: bcm2835: Fix possible NULL ptr dereference in bcm2835_request This fixes a NULL pointer dereference in case of a MMC request with a set block count command and no data. Reported-by: Dan Carpenter Signed-off-by: Stefan Wahren Tested-by: Peter Robinson Reviewed-by: Jaehoon Chung Signed-off-by: Ulf Hansson drivers/mmc/host/bcm2835.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit feeef096a770d288c943c1759785bd9d4f9247b7 Author: Heiner Kallweit Date: Sun Mar 26 20:45:56 2017 +0200 mmc: use new core function mmc_get_dma_dir Use new core function mmc_get_dma_dir(). Signed-off-by: Heiner Kallweit Signed-off-by: Ulf Hansson drivers/mmc/host/android-goldfish.c | 10 ++-------- drivers/mmc/host/atmel-mci.c | 30 +++++++++++------------------- drivers/mmc/host/davinci_mmc.c | 14 ++++---------- drivers/mmc/host/dw_mmc.c | 14 +++----------- drivers/mmc/host/jz4740_mmc.c | 9 ++------- drivers/mmc/host/mmc_spi.c | 5 +---- drivers/mmc/host/mmci.c | 20 ++++++++------------ drivers/mmc/host/moxart-mmc.c | 8 +++----- drivers/mmc/host/mtk-sd.c | 8 ++------ drivers/mmc/host/mvsdio.c | 11 +++++------ drivers/mmc/host/omap_hsmmc.c | 17 ++++------------- drivers/mmc/host/s3cmci.c | 4 ++-- drivers/mmc/host/sdhci.c | 9 +++------ drivers/mmc/host/sunxi-mmc.c | 14 +++----------- 14 files changed, 53 insertions(+), 120 deletions(-) commit 6335d68349a85382cc55a5260d5bfda85f8e24a8 Author: Heiner Kallweit Date: Sun Mar 26 20:41:32 2017 +0200 mmc: core: add mmc_get_dma_dir Add function for determining DMA direction to core. Signed-off-by: Heiner Kallweit Reviewed-by: Shawn Lin Signed-off-by: Ulf Hansson include/linux/mmc/host.h | 6 ++++++ 1 file changed, 6 insertions(+) commit e5e4a3eb131f79af49f48a741807318c32f29427 Author: Heiner Kallweit Date: Sat Mar 25 11:28:13 2017 +0100 mmc: meson-gx: add CMD23 mode CMD23 mode (use "set block count" command before transferring multiple data blocks) typically is more performant as host / card know upfront how many data blocks to expect. Therefore add support for this mode to the driver. Signed-off-by: Heiner Kallweit Reviewed-by: Kevin Hilman Signed-off-by: Ulf Hansson drivers/mmc/host/meson-gx-mmc.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) commit 4eee86c3d825109ed91555a553fbdb927592f009 Author: Heiner Kallweit Date: Sat Mar 25 11:26:18 2017 +0100 mmc: meson-gx: switch to dynamic timeout values Currently we use a fixed timeout of 4s for all data transfers. Switch to dynamic timeout values by making use of data->timeout_ns. Signed-off-by: Heiner Kallweit Reviewed-by: Kevin Hilman Signed-off-by: Ulf Hansson drivers/mmc/host/meson-gx-mmc.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) commit f016c67629c818ca6a39f4d6e35d85d9e930eacc Author: Heiner Kallweit Date: Sat Mar 25 11:24:41 2017 +0100 mmc: meson-gx: use per port interrupt names So far the driver name is used as interrupt description, therefore in /proc/interrupts it's not possible to tell which interrupt belongs to which port. Change this by switching to NULL what causes the default (device name) to be used. In our case that's the DT node name. Signed-off-by: Heiner Kallweit Reviewed-by: Kevin Hilman Signed-off-by: Ulf Hansson drivers/mmc/host/meson-gx-mmc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1231e7eb62224235bb92a2a39cb35c89afd474af Author: Heiner Kallweit Date: Sat Mar 25 11:23:24 2017 +0100 mmc: meson-gx: use bitfield macros Use GENMASK consistently for all bit masks and switch to using the bitfield macros FIELD_GET and FIELD_PREP. This hides parts of the complexity of dealing with bit fields. Signed-off-by: Heiner Kallweit Reviewed-by: Kevin Hilman Signed-off-by: Ulf Hansson drivers/mmc/host/meson-gx-mmc.c | 94 ++++++++++++++++++----------------------- 1 file changed, 40 insertions(+), 54 deletions(-) commit 8cc35289227c5cbb8811048519c1703e2137d421 Author: Shawn Lin Date: Fri Mar 24 15:50:12 2017 +0800 mmc: sdhci: clarify the get_timeout_clock callback Currently the get_timeout_clock callback doesn't clearly have a statement that it needs the variant drivers to return the timeout clock rate in kHz if the SDHCI_TIMEOUT_CLK_UNIT isn't present, otherwise the variant drivers should return it in MHz. It's also very likely that further variant drivers which are going to use this callback will be confused by this situation. Given the fact that moderm sdhci variant hosts are very prone to get the timeout clock from common clock framework (actually the only three users did that), it's more natural to return the value in Hz and we make an explicit comment there. Then we put the unit conversion inside the sdhci core. Thus will improve the code and prevent further misuses. Reported-by: Anssi Hannula Signed-off-by: Shawn Lin Acked-by: Masahiro Yamada Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-cadence.c | 4 ++-- drivers/mmc/host/sdhci-of-arasan.c | 17 +---------------- drivers/mmc/host/sdhci.c | 16 +++++++++------- drivers/mmc/host/sdhci.h | 1 + 4 files changed, 13 insertions(+), 25 deletions(-) commit bd675698e8eece61c02a5e436e6d5d5ac1180e46 Author: Icenowy Zheng Date: Thu Mar 16 21:29:03 2017 +0800 mmc: sunxi: change controller error info to debug level The controller's errors are usually normal (for example, for MMC or SDIO cards, some errors are expected to happen; and for boards without a dedicated card detect pin the error info will even flood console and hide other normal messages) and hard to understand. Change their print level to debug, thus it won't be shown to generic users. Signed-off-by: Icenowy Zheng Acked-by: Maxime Ripard Signed-off-by: Ulf Hansson drivers/mmc/host/sunxi-mmc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit a744c6fe13beef87cd541f1dcaffe97f2af0c908 Author: Heiner Kallweit Date: Wed Mar 22 22:34:01 2017 +0100 mmc: meson-gx: simplify setting timeout configuration parameters We don't need variable cmd_cfg_timeout, so remove it and simplify the code a little. Signed-off-by: Heiner Kallweit Signed-off-by: Ulf Hansson Reviewed-by: Kevin Hilman drivers/mmc/host/meson-gx-mmc.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) commit 2c8d96a46dfd45b724465e53a5a9542bcb78cfce Author: Heiner Kallweit Date: Wed Mar 22 22:33:53 2017 +0100 mmc: meson-gx: improve setting data->bytes_xfered Centralize setting data->bytes_xfered in one place and make sure that the number of transfererd bytes is set only if we receive the end-of-chain interrupt and there was no error. Signed-off-by: Heiner Kallweit Signed-off-by: Ulf Hansson Reviewed-by: Kevin Hilman drivers/mmc/host/meson-gx-mmc.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) commit 1f8066d90739ebfdf70a5debbc5fed22fdd17465 Author: Heiner Kallweit Date: Wed Mar 22 22:33:50 2017 +0100 mmc: meson-gx: improve response reading Response reading can be slightly improved by doing it in just one place. Signed-off-by: Heiner Kallweit Signed-off-by: Ulf Hansson Reviewed-by: Kevin Hilman drivers/mmc/host/meson-gx-mmc.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit a322febe37432443b8d0adb0b630a9f91961152c Author: Heiner Kallweit Date: Wed Mar 22 22:33:47 2017 +0100 mmc: meson-gx: improve variable usage in meson_mmc_start_cmd Simplify the code by using two variables instead of a struct sd_emmc_desc. Signed-off-by: Heiner Kallweit Signed-off-by: Ulf Hansson Reviewed-by: Kevin Hilman drivers/mmc/host/meson-gx-mmc.c | 55 ++++++++++++++++++----------------------- 1 file changed, 24 insertions(+), 31 deletions(-) commit 00412ddc4ae929419a64bc9766205aac0467e664 Author: Heiner Kallweit Date: Wed Mar 22 22:33:44 2017 +0100 mmc: meson-gx: replace cmd->data in meson_mmc_start_cmd Replace cmd->data with a local variable to simplify code a little. Signed-off-by: Heiner Kallweit Signed-off-by: Ulf Hansson Reviewed-by: Kevin Hilman drivers/mmc/host/meson-gx-mmc.c | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) commit ec31e53c2aab68b93381b194f70626f082bbc9d0 Author: Heiner Kallweit Date: Wed Mar 22 22:18:37 2017 +0100 mmc: meson-gx: remove unneeded configuration bit resets The variables holding the configuration bits are zero-initialized. So we can remove all bit resets. Signed-off-by: Heiner Kallweit Signed-off-by: Ulf Hansson Reviewed-by: Kevin Hilman drivers/mmc/host/meson-gx-mmc.c | 5 ----- 1 file changed, 5 deletions(-) commit 1ede5cb88a29bba1aad1b68965c5fc8e00b20ed9 Author: yong mao Date: Wed Mar 15 15:26:40 2017 +0800 mmc: mediatek: Use data tune for CMD line tune If we don't select a set of better parameters for our emmc host, It may easily occur CMD response CRC error. And also it may cause cannot boot up issue. Fot getting a set of better parameters, our emmc host supports data tune mechanism.Therefore, our emmc driver also should change to use data tune for CMD line. Because our emmc host use the different clock source to sample the CMD signal between HS200 and HS400 mode, the parameters are also different between these two modes. Separate cmd internal delay for HS200/HS400 mode. This change can fix "System can not boot up" issue. Signed-off-by: Yong Mao Signed-off-by: Chaotian Jing Signed-off-by: Ulf Hansson drivers/mmc/host/mtk-sd.c | 168 +++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 152 insertions(+), 16 deletions(-) commit 50fde5637b6b66555036bd815c01e0aa38d38859 Author: yong mao Date: Wed Mar 15 15:26:38 2017 +0800 mmc: dt-bindings: update Mediatek MMC bindings Add description for mediatek,hs200-cmd-int-delay Add description for mediatek,hs400-cmd-int-delay Add description for mediatek,hs400-cmd-resp-sel-rising Signed-off-by: Yong Mao Acked-by: Rob Herring Signed-off-by: Ulf Hansson Documentation/devicetree/bindings/mmc/mtk-sd.txt | 12 ++++++++++++ 1 file changed, 12 insertions(+) commit 7aceaf566e1d6f7bf29516d680ee883697909cc7 Author: Heiner Kallweit Date: Wed Mar 22 21:59:29 2017 +0100 mmc: sdio: improve mmc_io_rw_extended Improve mmc_io_rw_extended a little: - using DIV_ROUND_UP achieves the same but is better readable - simplify code by using sg_set_buf - simplify one statement by using -= operator Signed-off-by: Heiner Kallweit Signed-off-by: Ulf Hansson drivers/mmc/core/sdio_ops.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) commit 474e25e15f508889d4f8c672ab54323743ee595b Author: Chris Brandt Date: Wed Mar 22 10:42:09 2017 -0400 mmc: sh_mmcif: Document r7s72100 DT bindings Signed-off-by: Chris Brandt Reviewed-by: Geert Uytterhoeven Reviewed-by: Simon Horman Acked-by: Rob Herring Signed-off-by: Ulf Hansson Documentation/devicetree/bindings/mmc/renesas,mmcif.txt | 8 ++++++++ 1 file changed, 8 insertions(+) commit 43b0b361b0170030603cf76f70b099f3323edcf3 Author: Masaharu Hayakawa Date: Fri Mar 17 10:04:50 2017 +0100 mmc: tmio: always get number of taps Current code gets number of taps only once and keeps the value. This is not correct, we need to obtain it every time before executing tuning, so remove the outer if-block. Signed-off-by: Masaharu Hayakawa [wsa: extracted from a larger patch and reworded commit message] Signed-off-by: Wolfram Sang Reviewed-by: Simon Horman Signed-off-by: Ulf Hansson drivers/mmc/host/tmio_mmc_pio.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) commit 5f07ef8f603ace496ca8c20eef446c5ae7a10474 Author: Wolfram Sang Date: Thu Mar 16 11:56:02 2017 +0100 mmc: tmio: always unmap DMA before waiting for interrupt In the (maybe academical) case, we don't get a DATAEND interrupt after DMA completed, we will wait endlessly for the completion to complete. This is not bad per se, since we have a more generic completion tracking a timeout. In that rare case, however, the DMA buffer will not get unmapped and we have a leak. Reorder the code, so unmapping will always take place. Signed-off-by: Wolfram Sang Signed-off-by: Ulf Hansson drivers/mmc/host/tmio_mmc_dma.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) commit 48d685a2ec2bc5852cf117b558dce9e90da36601 Author: Adrian Hunter Date: Mon Mar 20 19:50:53 2017 +0200 mmc: sdhci-pci: Move a function to avoid later forward declaration Move a function to avoid having to forward declare it in a subsequent patch. Signed-off-by: Adrian Hunter Signed-off-by: Ulf Hansson Tested-by: Ludovic Desroches drivers/mmc/host/sdhci-pci-core.c | 76 +++++++++++++++++++-------------------- 1 file changed, 38 insertions(+), 38 deletions(-) commit 966d696a622b47663ae866df08d54a4a1d3ec39c Author: Adrian Hunter Date: Mon Mar 20 19:50:52 2017 +0200 mmc: sdhci-pci: Add runtime suspend/resume callbacks Add runtime suspend/resume callbacks to match suspend/resume callbacks. Signed-off-by: Adrian Hunter Signed-off-by: Ulf Hansson Tested-by: Ludovic Desroches drivers/mmc/host/sdhci-pci-core.c | 98 +++++++++++++++++++++++---------------- drivers/mmc/host/sdhci-pci.h | 4 ++ 2 files changed, 62 insertions(+), 40 deletions(-) commit 30cf2803b268f2bcce91fbaa19cee6d04b14bd86 Author: Adrian Hunter Date: Mon Mar 20 19:50:51 2017 +0200 mmc: sdhci-pci: Let suspend/resume callbacks replace default callbacks The suspend / resume callbacks lack the flexibility to allow a device to specify a different function entirely. Change them around so that device functions are called directly and they in turn can call the default implementations if needed. Signed-off-by: Adrian Hunter Signed-off-by: Ulf Hansson Tested-by: Ludovic Desroches drivers/mmc/host/sdhci-pci-core.c | 170 ++++++++++++++++++++--------------- drivers/mmc/host/sdhci-pci-o2micro.c | 2 +- drivers/mmc/host/sdhci-pci.h | 4 + 3 files changed, 104 insertions(+), 72 deletions(-) commit b7813f0fe9535cd9536102b9ac663a669f9be131 Author: Adrian Hunter Date: Mon Mar 20 19:50:50 2017 +0200 mmc: sdhci-pci: Conditionally compile pm sleep functions It is confusing to have some parts of suspend / resume under conditional compilation and some parts not. Use conditional compilation everywhere. Signed-off-by: Adrian Hunter Signed-off-by: Ulf Hansson Tested-by: Ludovic Desroches drivers/mmc/host/sdhci-pci-core.c | 10 ++++++++++ drivers/mmc/host/sdhci-pci-o2micro.c | 2 ++ drivers/mmc/host/sdhci-pci.h | 2 ++ 3 files changed, 14 insertions(+) commit 1cb0a58ec70402bab49bdb4c5d152e82fd82200e Author: Adrian Hunter Date: Mon Mar 20 19:50:49 2017 +0200 mmc: sdhci-pci: Do not use suspend/resume callbacks with runtime pm Do not use suspend/resume callbacks with runtime pm. It doesn't make sense and isn't being used, so remove. Signed-off-by: Adrian Hunter Signed-off-by: Ulf Hansson Tested-by: Ludovic Desroches drivers/mmc/host/sdhci-pci-core.c | 12 ------------ 1 file changed, 12 deletions(-) commit 61c951dedce6aa4dbc5456730233c30ac0d30d5d Author: Adrian Hunter Date: Mon Mar 20 19:50:48 2017 +0200 mmc: sdhci-pci: Let devices define how to add the host SDHCI provides more flexibility than simply calling sdhci_add_host(). Make that available by allowing devices to specify their own ->add_host() function. Signed-off-by: Adrian Hunter Signed-off-by: Ulf Hansson Tested-by: Ludovic Desroches drivers/mmc/host/sdhci-pci-core.c | 5 ++++- drivers/mmc/host/sdhci-pci.h | 1 + 2 files changed, 5 insertions(+), 1 deletion(-) commit f12e39dbf3e6eb521435085712addc131d803bfd Author: Adrian Hunter Date: Mon Mar 20 19:50:47 2017 +0200 mmc: sdhci: Add CQE support Add an interrupt hook and helper functions for enabling, disabling and delivering interrupts to a CQE. Signed-off-by: Adrian Hunter Signed-off-by: Ulf Hansson Tested-by: Ludovic Desroches drivers/mmc/host/sdhci.c | 130 +++++++++++++++++++++++++++++++++++++++++++++-- drivers/mmc/host/sdhci.h | 19 +++++++ 2 files changed, 146 insertions(+), 3 deletions(-) commit f5c1ab821b96419261e7676efb1a355e9d735faf Author: Adrian Hunter Date: Mon Mar 20 19:50:46 2017 +0200 mmc: sdhci: Factor out sdhci_set_default_irqs Factor out sdhci_set_default_irqs(). Signed-off-by: Adrian Hunter Signed-off-by: Ulf Hansson Tested-by: Ludovic Desroches drivers/mmc/host/sdhci.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) commit 4180ffa81779551a25772efae1128ac5a9689536 Author: Adrian Hunter Date: Mon Mar 20 19:50:45 2017 +0200 mmc: sdhci: Add sdhci_cleanup_host Add sdhci_cleanup_host() to cleanup __sdhci_add_host(). Signed-off-by: Adrian Hunter Signed-off-by: Ulf Hansson Tested-by: Ludovic Desroches drivers/mmc/host/sdhci.c | 37 ++++++++++++++++++++++++++----------- drivers/mmc/host/sdhci.h | 1 + 2 files changed, 27 insertions(+), 11 deletions(-) commit 15becf68b86741be282880196f1e5155b1a9a033 Author: Adrian Hunter Date: Mon Mar 20 19:50:44 2017 +0200 mmc: sdhci: Get rid of 'extern' in header file Get rid of unnecessary 'extern' in header file. Signed-off-by: Adrian Hunter Signed-off-by: Ulf Hansson Tested-by: Ludovic Desroches drivers/mmc/host/sdhci.h | 32 +++++++++++++++----------------- 1 file changed, 15 insertions(+), 17 deletions(-) commit d28981727dccd0e1e867deceaa709bc89f1a5ebc Author: Adrian Hunter Date: Mon Mar 20 19:50:43 2017 +0200 mmc: sdhci: Export sdhci_dumpregs Export sdhci_dumpregs so that it can be called by drivers. Signed-off-by: Adrian Hunter Signed-off-by: Ulf Hansson Tested-by: Ludovic Desroches drivers/mmc/host/sdhci.c | 3 ++- drivers/mmc/host/sdhci.h | 2 ++ 2 files changed, 4 insertions(+), 1 deletion(-) commit 85ad90e2f819a5c7f5d1005da32660eff7680abf Author: Adrian Hunter Date: Mon Mar 20 19:50:42 2017 +0200 mmc: sdhci: Improve register dump print format Ensure all prints start with the mmc host name, and the text all lines up. Signed-off-by: Adrian Hunter Signed-off-by: Ulf Hansson Tested-by: Ludovic Desroches drivers/mmc/host/sdhci.c | 104 ++++++++++++++++++++++++----------------------- 1 file changed, 53 insertions(+), 51 deletions(-) commit c71024de98f4b596112be9c2698b2d8000382a5a Author: Adrian Hunter Date: Mon Mar 20 19:50:41 2017 +0200 mmc: sdhci: Use sdhci_readl() not readl() in sdhci_dumpregs() Use sdhci io wrappers consistently. Signed-off-by: Adrian Hunter Signed-off-by: Ulf Hansson Tested-by: Ludovic Desroches drivers/mmc/host/sdhci.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) commit 7962302fc3f5b3b31523b518a2dc47849fb7bd06 Author: Adrian Hunter Date: Mon Mar 20 19:50:40 2017 +0200 mmc: sdhci: Add response register to register dump Add response register to register dump. Signed-off-by: Adrian Hunter Signed-off-by: Ulf Hansson Tested-by: Ludovic Desroches drivers/mmc/host/sdhci.c | 7 +++++++ 1 file changed, 7 insertions(+) commit f421865d5b4ce57013040fb1700edceb43a14b42 Author: Adrian Hunter Date: Mon Mar 20 19:50:39 2017 +0200 mmc: sdhci: Improve debug print format Ensure all debug prints start with the mmc host name. Signed-off-by: Adrian Hunter Signed-off-by: Ulf Hansson Tested-by: Ludovic Desroches drivers/mmc/host/sdhci.c | 28 ++++++++++++---------------- 1 file changed, 12 insertions(+), 16 deletions(-) commit 2a85ef25bee6910f4de510c5b574c81e87f38b05 Author: Adrian Hunter Date: Mon Mar 20 19:50:38 2017 +0200 mmc: sdhci: Reduce spin lock usage in sdhci_execute_tuning Tuning execution is already synchronized with respect to other host operations by upper layers "claiming" the host, which also takes care of runtime pm. There can be no requests in progress. Retain the spin lock usage only for ensuring that sending tuning commands is synchronized with respect to the interrupt handler. Signed-off-by: Adrian Hunter Signed-off-by: Ulf Hansson Tested-by: Ludovic Desroches drivers/mmc/host/sdhci.c | 36 ++++++++++++++---------------------- 1 file changed, 14 insertions(+), 22 deletions(-) commit d1e4f74f911daee4d69b5fd0c81902f7d37de579 Author: Adrian Hunter Date: Mon Mar 20 19:50:37 2017 +0200 mmc: sdhci: Do not use spin lock in set_ios paths The spin lock is not necessary in set_ios. Anything that is racing with changes to the I/O state is already broken. The mmc core already provides synchronization via "claiming" the host. So remove spin_lock and friends from sdhci_set_ios and related callbacks. Signed-off-by: Adrian Hunter Signed-off-by: Ulf Hansson Tested-by: Ludovic Desroches drivers/mmc/host/sdhci-msm.c | 8 -------- drivers/mmc/host/sdhci-of-arasan.c | 6 ------ drivers/mmc/host/sdhci-of-at91.c | 2 -- drivers/mmc/host/sdhci-pci-core.c | 4 ---- drivers/mmc/host/sdhci-pxav3.c | 5 +---- drivers/mmc/host/sdhci-s3c.c | 4 ---- drivers/mmc/host/sdhci.c | 9 --------- 7 files changed, 1 insertion(+), 37 deletions(-) commit 0c62e6752d0c769aae41bfade6258e5f9aedbe2d Author: Adrian Hunter Date: Mon Mar 20 19:50:36 2017 +0200 mmc: sdhci: Remove ->select_drive_strength() callback Drivers can use the host operation directly, so remove this now unused callback. Signed-off-by: Adrian Hunter Signed-off-by: Ulf Hansson Tested-by: Ludovic Desroches drivers/mmc/host/sdhci-pci-core.c | 20 -------------------- drivers/mmc/host/sdhci-pci.h | 4 ---- drivers/mmc/host/sdhci.c | 14 -------------- drivers/mmc/host/sdhci.h | 4 ---- 4 files changed, 42 deletions(-) commit 51ced59cc02e0d08f61772c888480b9b1749cef1 Author: Adrian Hunter Date: Mon Mar 20 19:50:35 2017 +0200 mmc: sdhci-pci: Use ACPI DSM to get driver strength for some Intel devices Make use of an Intel ACPI _DSM that provides eMMC driver strength. Signed-off-by: Adrian Hunter Signed-off-by: Ulf Hansson Tested-by: Ludovic Desroches drivers/mmc/host/sdhci-pci-core.c | 77 +++++++-------------------------------- drivers/mmc/host/sdhci-pci-data.c | 3 -- 2 files changed, 14 insertions(+), 66 deletions(-) commit c959a6b00ff589c652373e27bced5a700bd450f2 Author: Adrian Hunter Date: Mon Mar 20 19:50:34 2017 +0200 mmc: sdhci-pci: Don't re-tune with runtime pm for some Intel devices Make use of an Intel ACPI _DSM that indicates if re-tuning is needed after D3. Signed-off-by: Adrian Hunter Signed-off-by: Ulf Hansson Tested-by: Ludovic Desroches drivers/mmc/host/sdhci-pci-core.c | 90 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 90 insertions(+) commit ac9f67b5800b9a96987ec602a34dd256a92ac7ca Author: Adrian Hunter Date: Mon Mar 20 19:50:33 2017 +0200 mmc: sdhci-pci: Let devices define their own private data Let devices define their own private data to facilitate device-specific operations. The size of the private structure is specified in the sdhci_pci_fixes structure, then sdhci_pci_probe_slot() will allocate extra space for it, and sdhci_pci_priv() can be used to get a reference to it. Signed-off-by: Adrian Hunter Signed-off-by: Ulf Hansson Tested-by: Ludovic Desroches drivers/mmc/host/sdhci-pci-core.c | 3 ++- drivers/mmc/host/sdhci-pci.h | 7 +++++++ 2 files changed, 9 insertions(+), 1 deletion(-) commit d38dcad4e7b48f3d68d5d058f8f4f52a99862e6e Author: Adrian Hunter Date: Mon Mar 20 19:50:32 2017 +0200 mmc: sdhci: Let drivers decide whether to use mmc_retune_needed() with pm Devices might save and restore tuning values so that re-tuning might not be needed after a pm transition. Let drivers decide by pushing the mmc_retune_needed() logic down to them. Signed-off-by: Adrian Hunter Signed-off-by: Ulf Hansson Tested-by: Ludovic Desroches drivers/mmc/host/sdhci-acpi.c | 12 ++++++++++-- drivers/mmc/host/sdhci-brcmstb.c | 3 +++ drivers/mmc/host/sdhci-esdhc-imx.c | 6 ++++++ drivers/mmc/host/sdhci-of-arasan.c | 3 +++ drivers/mmc/host/sdhci-of-at91.c | 3 +++ drivers/mmc/host/sdhci-of-esdhc.c | 3 +++ drivers/mmc/host/sdhci-pci-core.c | 22 ++++++++++++++++++---- drivers/mmc/host/sdhci-pci.h | 2 ++ drivers/mmc/host/sdhci-pltfm.c | 3 +++ drivers/mmc/host/sdhci-pxav3.c | 5 +++++ drivers/mmc/host/sdhci-s3c.c | 6 ++++++ drivers/mmc/host/sdhci-sirf.c | 3 +++ drivers/mmc/host/sdhci-spear.c | 3 +++ drivers/mmc/host/sdhci-st.c | 6 +++++- drivers/mmc/host/sdhci.c | 4 ---- 15 files changed, 73 insertions(+), 11 deletions(-) commit 5a436cc0af6202265de0d2d2d35f1b4fd85caf3b Author: Adrian Hunter Date: Mon Mar 20 19:50:31 2017 +0200 mmc: sdhci: Optimize delay loops The delay loops for reset and clock enable always take at least 1 ms because they use mdelay(1). However they can take a lot less time e.g. less than 50us. Use ktime and reduce the delay to 10 microseconds per loop. Signed-off-by: Adrian Hunter Signed-off-by: Ulf Hansson Tested-by: Ludovic Desroches drivers/mmc/host/sdhci.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) commit 660fc733bd7436f4fa1a351376493e635514ed64 Author: Eric Anholt Date: Wed Mar 8 10:19:03 2017 +0100 mmc: bcm2835: Add new driver for the sdhost controller. The 2835 has two SD controllers: The Arasan sdhci controller (supported by the iproc driver) and a custom sdhost controller. This patch adds a driver for the latter. The sdhci controller supports both sdcard and sdio. The sdhost controller supports the sdcard only, but has better performance. Also note that the rpi3 has sdio wifi, so driving the sdcard with the sdhost controller allows to use the sdhci controller for wifi support. The configuration is done by devicetree via pin muxing. Both SD controller are available on the same pins (2 pin groups = pin 22 to 27 + pin 48 to 53). So it's possible to use both SD controllers at the same time with different pin groups. The code was originally written by Phil Elwell in the downstream Rasbperry Pi tree. In preparation for the upstream merge it was cleaned up and the code base was moderized by Eric Anholt, Stefan Wahren and Gerd Hoffmann. Signed-off-by: Eric Anholt Signed-off-by: Stefan Wahren Signed-off-by: Gerd Hoffmann Signed-off-by: Ulf Hansson drivers/mmc/host/Kconfig | 14 + drivers/mmc/host/Makefile | 1 + drivers/mmc/host/bcm2835.c | 1465 ++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 1480 insertions(+) commit ebdb4d8e0d2577bd8e1d0d54e1c2e9445bdc90e6 Author: Eric Anholt Date: Wed Mar 8 10:19:01 2017 +0100 dt-bindings: Add binding for brcm,bcm2835-sdhost. This is the other SD controller on the platform, which can be swapped to the role of SD card host using pin muxing. Signed-off-by: Eric Anholt Signed-off-by: Gerd Hoffmann Acked-by: Rob Herring Signed-off-by: Ulf Hansson .../bindings/mmc/brcm,bcm2835-sdhost.txt | 23 ++++++++++++++++++++++ 1 file changed, 23 insertions(+) commit 8e11b284eaa86863f700216e4d3c87e7d7b3f44c Author: tcharding Date: Wed Mar 15 19:48:04 2017 +1100 mmc: core: simplify return code File contains multiple functions doing variations on the same thing, sdio_readb(), sdio_writeb()f, sdio_readw(), sdio_writew() etc. Although the functions have very similar logic the code is laid out in a variety of ways. This makes it overly complicated to read. There is a already a nice clean chunk of code, if we use this format for all instances then we will have cleaned up the code, reduced the line count and lessened the cognitive load required while reading. Less lines equals less bugs. Pick the most simple and clear code flow and change all functions to be the same. Signed-off-by: Tobin C. Harding Signed-off-by: Ulf Hansson drivers/mmc/core/sdio_io.c | 42 +++++++++++++----------------------------- 1 file changed, 13 insertions(+), 29 deletions(-) commit 9b980d950e5bcdce6dbc15a9c00ff960beeea28b Author: tcharding Date: Wed Mar 15 19:48:03 2017 +1100 mmc: core: guard dereference of optional parameter Various functions take as parameter an optional pointer. Pointer should be guarded with non-NULL check before dereferencing. Add non-NULL check before dereference of pointer. Signed-off-by: Tobin C. Harding Signed-off-by: Ulf Hansson drivers/mmc/core/sdio_io.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) commit ce473d5b49d6ef76d35e6d00daa8c5a8fed85943 Author: Michał Zegan Date: Tue Mar 14 21:05:20 2017 +0100 mmc: meson-gx: fix error path when driver initialization fails before enabling clocks This patch fixes the case where meson_mmc_probe function fails before core_clk is enabled. Originally, that would result in a try to disable the core clock, and if it was not already enabled, it would result in a kernel warning. This issue is similar to the one with div_clk. Fix it by introducing another error path used only between successfully enabling the core clock, and successfully enabling the div clock. That would ensure that core clock is disabled only if it was enabled before. Signed-off-by: Michał Zegan Signed-off-by: Ulf Hansson drivers/mmc/host/meson-gx-mmc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit e8ce6742f809bcb1bbc8d9ce27d72ee1de7a551a Author: Thierry Reding Date: Tue Mar 14 20:01:52 2017 +0100 dt-bindings: mmc: tegra: Document Tegra186 compatible string The SDHCI controller found on Tegra186 in very similar to the controller found on earlier generations of Tegra. Signed-off-by: Thierry Reding Signed-off-by: Ulf Hansson Documentation/devicetree/bindings/mmc/nvidia,tegra20-sdhci.txt | 1 + 1 file changed, 1 insertion(+) commit 4166b3036e930fab7328688d26770a20752e76f0 Author: Thierry Reding Date: Tue Mar 14 20:01:51 2017 +0100 dt-bindings: mmc: tegra: Reformat compatible string list The list of compatible strings is somewhat difficult to read and extend. Reformat it into a list to make it more easily extensible. While at it, also remove the "plus one of the above" clause because it isn't actually valid. Signed-off-by: Thierry Reding Signed-off-by: Ulf Hansson .../devicetree/bindings/mmc/nvidia,tegra20-sdhci.txt | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) commit 9449659d66e2ce03069e89212f5000925058a533 Author: Jisheng Zhang Date: Fri Mar 10 11:17:33 2017 +0800 mmc: sdhci-st: remove unnecessary platform_set_drvdata() call sdhci_pltfm_init() has already set the platform drvdata for us, remove the unnecessary platform_set_drvdata() call. Signed-off-by: Jisheng Zhang Acked-by: Patrice Chotard Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-st.c | 2 -- 1 file changed, 2 deletions(-) commit 0092faf5a871db6b6d730bf54c0ad28575edfb6a Author: Jisheng Zhang Date: Fri Mar 10 11:17:32 2017 +0800 mmc: sdhci-pxav2: remove unnecessary platform_set_drvdata() call sdhci_pltfm_init() has already set the platform drvdata for us, remove the unnecessary platform_set_drvdata() call. Signed-off-by: Jisheng Zhang Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-pxav2.c | 2 -- 1 file changed, 2 deletions(-) commit d36f47c54b297f22b766d31422b2044b08473924 Author: Jisheng Zhang Date: Fri Mar 10 11:17:31 2017 +0800 mmc: sdhci-pxav3: remove unnecessary platform_set_drvdata() call sdhci_pltfm_init() has already set the platform drvdata for us, remove the unnecessary platform_set_drvdata() call. Signed-off-by: Jisheng Zhang Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-pxav3.c | 2 -- 1 file changed, 2 deletions(-) commit d12990f9900f49e7f834b0d2cf6ccebcf4cb698f Author: Piotr Sroka Date: Mon Mar 6 08:28:41 2017 +0000 mmc: sdhci-cadence: add HS400 enhanced strobe support Add support for HS400ES mode to Cadence SDHCI driver. Signed-off-by: Piotr Sroka Reviewed-by: Masahiro Yamada Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-cadence.c | 57 +++++++++++++++++++++++++++++++++++----- 1 file changed, 50 insertions(+), 7 deletions(-) commit 4346b7c7941d4f98214af01d04850c91a706322e Author: Thierry Reding Date: Wed Mar 8 20:00:40 2017 +0100 mmc: tegra: Add Tegra186 support The SDHCI controller found on NVIDIA Tegra186 SoCs is very similar to the one on prior generations of Tegra and can be supported by the same driver. Acked-by: Adrian Hunter Signed-off-by: Thierry Reding Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-tegra.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) commit 20567be9d2e64c3f8302ae66d9ca69899d1c5e8a Author: Thierry Reding Date: Wed Mar 8 20:00:39 2017 +0100 mmc: tegra: Support module reset The device tree binding for the SDHCI controller found on Tegra SoCs specifies that a reset control can be provided by the device tree. No code was ever added to support the module reset, which can cause the driver to try and access registers from a module that's in reset. On most Tegra SoC generations doing so would cause a hang. Note that it's unlikely to see this happen because on most platforms these resets will have been deasserted by the bootloader. However the portability can be improved by making sure the driver deasserts the reset before accessing any registers. Since resets are synchronous on Tegra SoCs, the platform driver needs to implement a custom ->remove() callback now to make sure the clock is disabled after the reset is asserted. Acked-by: Adrian Hunter Signed-off-by: Thierry Reding Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-tegra.c | 43 +++++++++++++++++++++++++++++++++++++++++- 1 file changed, 42 insertions(+), 1 deletion(-) commit a01fc2a295af6418d665d8f9c18af6017a929065 Author: Michał Zegan Date: Sat Feb 18 18:06:47 2017 +0100 mmc: meson-gx: remove mmc host on device removal The mmc host was added in meson_mmc_probe, but never removed in meson_mmc_remove. Fix that by removing the host before deallocating other resources. Signed-off-by: Michał Zegan Tested-by: Michał Zegan Acked-by: Kevin Hilman Signed-off-by: Ulf Hansson drivers/mmc/host/meson-gx-mmc.c | 2 ++ 1 file changed, 2 insertions(+) commit eb7c00e1461124ad0e85f1a9a3954d7164809c13 Author: Wolfram Sang Date: Tue Mar 14 11:09:19 2017 +0100 mmc: host: tmio: fill in response from auto cmd12 After we received the dataend interrupt, R1 response register carries the value from the automatically generated stop command. Report that info back to the MMC block layer, so we will be notified in case of e.g. ECC errors which happened during the last transfer. Reviewed-by: Simon Horman Tested-by: Yoshihiro Shimoda Signed-off-by: Wolfram Sang Signed-off-by: Ulf Hansson drivers/mmc/host/tmio_mmc_pio.c | 3 +++ 1 file changed, 3 insertions(+) commit 022f731e03d190d0e4f52f2b1bd90fae0eadd56d Author: Wolfram Sang Date: Tue Mar 14 11:09:18 2017 +0100 mmc: host: tmio: don't BUG on unsupported stop commands Halting the kernel on an unsupported stop command seems overkill, report the error and say what we already did (due to autocmd12) instead. Reviewed-by: Simon Horman Signed-off-by: Wolfram Sang Signed-off-by: Ulf Hansson drivers/mmc/host/tmio_mmc_pio.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit d8acd16c84c32a65a291e8f16ba4cb3b6d182e30 Author: Wolfram Sang Date: Tue Mar 14 11:09:17 2017 +0100 mmc: host: tmio: fix minor typos in comments Making sure we match the actual register names. Reviewed-by: Simon Horman Signed-off-by: Wolfram Sang Signed-off-by: Ulf Hansson drivers/mmc/host/tmio_mmc.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit 9afcbf4a6f1995f3b47088764eaef7b56154beb9 Author: Wolfram Sang Date: Tue Mar 14 11:09:16 2017 +0100 mmc: host: tmio: use defines for CTL_STOP_INTERNAL_ACTION values Reviewed-by: Simon Horman Signed-off-by: Wolfram Sang Signed-off-by: Ulf Hansson drivers/mmc/host/tmio_mmc.h | 4 ++++ drivers/mmc/host/tmio_mmc_pio.c | 6 +++--- 2 files changed, 7 insertions(+), 3 deletions(-) commit 52ad9a8e854ca13151f4af8140297f73d49e318a Author: Wolfram Sang Date: Fri Feb 17 19:22:41 2017 +0100 mmc: tmio: ensure end of DMA and SD access are in sync The current code assumes that DMA is finished before SD access end is flagged. Thus, it schedules the 'dma_complete' tasklet in the SD card interrupt routine when DATAEND is set. The assumption is not safe, though. Even by mounting an SD card, it can be seen that sometimes DMA complete is first, sometimes DATAEND. It seems they are usually close enough timewise to not cause problems. However, a customer reported that with CMD53 sometimes things really break apart. As a result, the BSP has a patch which introduces flags for both events and makes sure both flags are set before scheduling the tasklet. The customer accepted the patch, yet it doesn't seem a proper upstream solution to me. This patch refactors the code to replace the tasklet with already existing and more lightweight mechanisms. First of all, we set the callback in a DMA descriptor to automatically get notified when DMA is done. In the callback, we then use a completion to make sure the SD access has already ended. Then, we proceed as before. Signed-off-by: Wolfram Sang Signed-off-by: Ulf Hansson drivers/mmc/host/tmio_mmc.h | 2 +- drivers/mmc/host/tmio_mmc_dma.c | 58 ++++++++++++++++++++++++----------------- drivers/mmc/host/tmio_mmc_pio.c | 4 +-- 3 files changed, 37 insertions(+), 27 deletions(-) commit 21b22284619bbb201775c125af53f2834eb91674 Author: Alexey Khoroshilov Date: Sat Feb 11 01:54:46 2017 +0300 mmc: sdhci-pxav2: add error handling of clk_prepare_enable() There is no check if clk_prepare_enable() succeed in sdhci_pxav2_probe(). Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson drivers/mmc/host/sdhci-pxav2.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) commit bb11eff1f1820b9f3bf6578af18b3d18094e7f54 Author: Heiner Kallweit Date: Sat Mar 4 13:37:46 2017 +0100 mmc: meson-gx: replace magic timeout numbers with constants Replace timeout magic numbers with proper constants. Signed-off-by: Heiner Kallweit Acked-by: Kevin Hilman Tested-by: Kevin Hilman Signed-off-by: Ulf Hansson drivers/mmc/host/meson-gx-mmc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 7cdcc480e4c32b0480233adb196a573ef538a6b6 Author: Heiner Kallweit Date: Sat Mar 4 13:36:45 2017 +0100 mmc: meson-gx: remove member mrq from struct meson_host Struct mmc_command includes a reference to the related mmc_request. Therefore we don't have to store mrq separately in struct meson_host. And we can remove some now unneeded WARN_ON's. Signed-off-by: Heiner Kallweit Acked-by: Kevin Hilman Tested-by: Kevin Hilman Signed-off-by: Ulf Hansson drivers/mmc/host/meson-gx-mmc.c | 24 +++--------------------- 1 file changed, 3 insertions(+), 21 deletions(-) commit c01d1219ace5768c18eb33f28d06937819f65b13 Author: Heiner Kallweit Date: Sat Mar 4 13:35:13 2017 +0100 mmc: meson-gx: improve initial configuration Config values which are not changed during runtime we can set in the probe function already. The block size setting is overwritten later in meson_mmc_start_cmd anyway if needed, so it doesn't harm if we remove this setting in meson_mmc_set_ios. In addition write config register only if configuration changed. Don't change the location of clock initialization as in an earlier version of the patch, this change causes a hang. This issue was reported and fix suggested by: Helmut Klein Signed-off-by: Heiner Kallweit Acked-by: Kevin Hilman Tested-by: Kevin Hilman Signed-off-by: Ulf Hansson drivers/mmc/host/meson-gx-mmc.c | 29 +++++++++++++++++------------ 1 file changed, 17 insertions(+), 12 deletions(-) commit 7b9ebad38fe64644714826966c9a164d90d1c408 Author: Heiner Kallweit Date: Sat Mar 4 13:26:24 2017 +0100 mmc: meson-gx: remove unneeded devm_kstrdup in meson_mmc_clk_init CLK core does a deep copy of init.name, therefore it's fully ok to provide a local variable. Signed-off-by: Heiner Kallweit Acked-by: Kevin Hilman Tested-by: Kevin Hilman Signed-off-by: Ulf Hansson drivers/mmc/host/meson-gx-mmc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cac3a47855c24bf060e58977473747ef3de7dedf Author: Heiner Kallweit Date: Sat Mar 4 13:25:14 2017 +0100 mmc: meson-gx: fix error path in meson_mmc_clk_init / meson_mmc_probe The condition should be "if (ret)" as the disable/unprepare is supposed to be executed if the previous command fails. In addition adjust the error path in probe to properly deal with the case that cfg_div_clk can be registered successfully but enable/prepare fails. In this case we shouldn't call clk_disable_unprepare. Reported-by: Michał Zegan Signed-off-by: Heiner Kallweit Acked-by: Kevin Hilman Tested-by: Kevin Hilman Signed-off-by: Ulf Hansson drivers/mmc/host/meson-gx-mmc.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) commit e9883ef228e5c128d34143ae87c97f555f79620c Author: Heiner Kallweit Date: Sat Mar 4 13:24:09 2017 +0100 mmc: meson-gx: remove member parent_mux from struct meson_host Member mux_parent isn't used outside meson_mmc_clk_init. So remove it and replace it with a local variable in meson_mmc_clk_init. Signed-off-by: Heiner Kallweit Acked-by: Kevin Hilman Tested-by: Kevin Hilman Signed-off-by: Ulf Hansson drivers/mmc/host/meson-gx-mmc.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) commit 7558c11378dd0ff1525a0cca5180804f6428af20 Author: Heiner Kallweit Date: Sat Mar 4 13:22:57 2017 +0100 mmc: meson-gx: remove unneeded variable in meson_mmc_clk_init Because the DT requires a fixed number of mux parent clocks, variable mux_parent_count can be replaced with constant MUX_CLK_NUM_PARENTS, so remove it. Signed-off-by: Heiner Kallweit Acked-by: Kevin Hilman Tested-by: Kevin Hilman Signed-off-by: Ulf Hansson drivers/mmc/host/meson-gx-mmc.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) commit 9a1da4df8502dd658db850650137d401b1fe123d Author: Heiner Kallweit Date: Sat Mar 4 13:21:54 2017 +0100 mmc: meson-gx: remove unused members irq, ocr_mask from struct meson_host Member ocr_mask is never used and member irq we can replace with a local variable in meson_mmc_probe. So let's remove both members. Signed-off-by: Heiner Kallweit Acked-by: Kevin Hilman Tested-by: Kevin Hilman Signed-off-by: Ulf Hansson drivers/mmc/host/meson-gx-mmc.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) commit 3d6c991b3dc9b632de5623adf980ecec399008f3 Author: Heiner Kallweit Date: Sat Mar 4 13:20:44 2017 +0100 mmc: meson-gx: make two functions return void The return value of meson_mmc_request_done and meson_mmc_read_resp isn't used, so make both functions return void. Signed-off-by: Heiner Kallweit Acked-by: Kevin Hilman Tested-by: Kevin Hilman Signed-off-by: Ulf Hansson drivers/mmc/host/meson-gx-mmc.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) commit 94d765bbfb1910ef8db5699d19907a0756a99d03 Author: Heiner Kallweit Date: Sat Mar 4 13:19:23 2017 +0100 mmc: meson-gx: simplify bounce buffer setting in meson_mmc_start_cmd Core ensures that there are no commands with cmd->data being set and nothing to transfer. And we don't have to reset bit CMD_CFG_DATA_NUM because cmd_cfg was zero-initialized and this bit isn't set. Signed-off-by: Heiner Kallweit Acked-by: Kevin Hilman Tested-by: Kevin Hilman Signed-off-by: Ulf Hansson drivers/mmc/host/meson-gx-mmc.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) commit bc2dcc1a2a5e3e796b71f742d6d241ba0523739b Author: Shawn Lin Date: Fri Feb 17 10:59:52 2017 +0800 mmc: dw_mmc: improve dw_mci_reset a bit Too much condition iteration makes the code less readable. Slightly improve it. Signed-off-by: Shawn Lin Signed-off-by: Jaehoon Chung Signed-off-by: Ulf Hansson drivers/mmc/host/dw_mmc.c | 38 ++++++++++++++++++++------------------ 1 file changed, 20 insertions(+), 18 deletions(-) commit 4dba18defb4c7bbea8af85913cd2dc506178389a Author: Shawn Lin Date: Fri Feb 17 10:59:44 2017 +0800 mmc: dw_mmc: move mci_send_cmd forward to avoid declaration No functional change intended. Signed-off-by: Shawn Lin Signed-off-by: Jaehoon Chung Signed-off-by: Ulf Hansson drivers/mmc/host/dw_mmc.c | 81 +++++++++++++++++++++++------------------------ 1 file changed, 40 insertions(+), 41 deletions(-) commit 132b3b6aa61864ef9f4fa21e88f2e9dab6caeec3 Author: Shawn Lin Date: Fri Feb 17 10:59:35 2017 +0800 mmc: dw_mmc: remove declaration of dw_mci_card_busy No need to declar it there, remove it. Signed-off-by: Shawn Lin Signed-off-by: Jaehoon Chung Signed-off-by: Ulf Hansson drivers/mmc/host/dw_mmc.c | 2 -- 1 file changed, 2 deletions(-) commit 671fa142fc034b0fb5c067afe8f0bbc64979f074 Author: Shawn Lin Date: Fri Feb 17 10:56:42 2017 +0800 mmc: dw_mmc: move dw_mci_get_cd forward to avoid declaration No functional change intended. Signed-off-by: Shawn Lin Signed-off-by: Jaehoon Chung Signed-off-by: Ulf Hansson drivers/mmc/host/dw_mmc.c | 83 +++++++++++++++++++++++------------------------ 1 file changed, 41 insertions(+), 42 deletions(-) commit 8e6db1f65510d57d666fe4d414550bb357c11e0e Author: Shawn Lin Date: Fri Feb 17 10:56:41 2017 +0800 mmc: dw_mmc: move dw_mci_ctrl_reset forward to avoid declaration No functional change intended. Signed-off-by: Shawn Lin Signed-off-by: Jaehoon Chung Signed-off-by: Ulf Hansson drivers/mmc/host/dw_mmc.c | 42 ++++++++++++++++++++---------------------- 1 file changed, 20 insertions(+), 22 deletions(-) commit 4e7392b2ac6ed95b4ccacdec2f2e9e8e00c929c4 Author: Shawn Lin Date: Fri Feb 17 10:56:40 2017 +0800 mmc: dw_mmc: move dw_mci_reset forward to avoid declaration No functional change intended. Signed-off-by: Shawn Lin Signed-off-by: Jaehoon Chung Signed-off-by: Ulf Hansson drivers/mmc/host/dw_mmc.c | 131 +++++++++++++++++++++++----------------------- 1 file changed, 65 insertions(+), 66 deletions(-) commit b6d2d81c5c2de6b3c69da3be9b2044dd008dbe45 Author: Shawn Lin Date: Fri Feb 17 10:56:39 2017 +0800 mmc: dw_mmc: improve the timeout polling code Just use the readl_poll_timeout{_atomic} to avold open coding them. Signed-off-by: Shawn Lin Signed-off-by: Jaehoon Chung Signed-off-by: Ulf Hansson drivers/mmc/host/dw_mmc.c | 92 ++++++++++++++++++++--------------------------- 1 file changed, 39 insertions(+), 53 deletions(-) commit d1ac3ff008fb9a48f91fc15920b4c8db24c0f03e Author: Gilad Ben-Yossef Date: Sun Feb 19 14:46:07 2017 +0200 dm verity: switch to using asynchronous hash crypto API Use of the synchronous digest API limits dm-verity to using pure CPU based algorithm providers and rules out the use of off CPU algorithm providers which are normally asynchronous by nature, potentially freeing CPU cycles. This can reduce performance per Watt in situations such as during boot time when a lot of concurrent file accesses are made to the protected volume. Signed-off-by: Gilad Ben-Yossef CC: Eric Biggers CC: Ondrej Mosnáček Tested-by: Milan Broz Signed-off-by: Mike Snitzer drivers/md/dm-verity-fec.c | 4 +- drivers/md/dm-verity-target.c | 201 +++++++++++++++++++++++++++++------------- drivers/md/dm-verity.h | 23 +++-- 3 files changed, 157 insertions(+), 71 deletions(-) commit a1b89132dc4f61071bdeaab92ea958e0953380a1 Author: Tim Murray Date: Fri Apr 21 11:11:36 2017 +0200 dm crypt: use WQ_HIGHPRI for the IO and crypt workqueues Running dm-crypt with workqueues at the standard priority results in IO competing for CPU time with standard user apps, which can lead to pipeline bubbles and seriously degraded performance. Move to using WQ_HIGHPRI workqueues to protect against that. Signed-off-by: Tim Murray Signed-off-by: Enric Balletbo i Serra Signed-off-by: Mike Snitzer drivers/md/dm-crypt.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit c82feeec9a014b72c4ffea36648cfb6f81cc1b73 Author: Ondrej Kozina Date: Mon Apr 24 14:21:53 2017 +0200 dm crypt: rewrite (wipe) key in crypto layer using random data The message "key wipe" used to wipe real key stored in crypto layer by rewriting it with zeroes. Since commit 28856a9 ("crypto: xts - consolidate sanity check for keys") this no longer works in FIPS mode for XTS. While running in FIPS mode the crypto key part has to differ from the tweak key. Fixes: 28856a9 ("crypto: xts - consolidate sanity check for keys") Cc: stable@vger.kernel.org Signed-off-by: Ondrej Kozina Signed-off-by: Mike Snitzer drivers/md/dm-crypt.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 06eb061f48594aa369f6e852b352410298b317a8 Author: Bart Van Assche Date: Fri Apr 7 16:50:44 2017 -0700 dm mpath: requeue after a small delay if blk_get_request() fails If blk_get_request() returns ENODEV then multipath_clone_and_map() causes a request to be requeued immediately. This can cause a kworker thread to spend 100% of the CPU time of a single core in __blk_mq_run_hw_queue() and also can cause device removal to never finish. Avoid this by only requeuing after a delay if blk_get_request() fails. Additionally, reduce the requeue delay. Cc: stable@vger.kernel.org # 4.9+ Signed-off-by: Bart Van Assche Signed-off-by: Mike Snitzer drivers/md/dm-mpath.c | 5 ++--- drivers/md/dm-rq.c | 2 +- 2 files changed, 3 insertions(+), 4 deletions(-) commit 117aceb030307dcd431fdcff87ce988d3016c34a Author: Somasundaram Krishnasamy Date: Fri Apr 7 12:14:55 2017 -0700 dm era: save spacemap metadata root after the pre-commit When committing era metadata to disk, it doesn't always save the latest spacemap metadata root in superblock. Due to this, metadata is getting corrupted sometimes when reopening the device. The correct order of update should be, pre-commit (shadows spacemap root), save the spacemap root (newly shadowed block) to in-core superblock and then the final commit. Cc: stable@vger.kernel.org Signed-off-by: Somasundaram Krishnasamy Signed-off-by: Mike Snitzer drivers/md/dm-era-target.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 948f581a53b704b984aa20df009f0a2b4cf7f907 Author: Dennis Yang Date: Tue Apr 18 15:27:06 2017 +0800 dm thin: fix a memory leak when passing discard bio down dm-thin does not free the discard_parent bio after all chained sub bios finished. The following kmemleak report could be observed after pool with discard_passdown option processes discard bios in linux v4.11-rc7. To fix this, we drop the discard_parent bio reference when its endio (passdown_endio) called. unreferenced object 0xffff8803d6b29700 (size 256): comm "kworker/u8:0", pid 30349, jiffies 4379504020 (age 143002.776s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01 00 00 00 00 00 00 f0 00 00 00 00 00 00 00 00 ................ backtrace: [] kmemleak_alloc+0x49/0xa0 [] kmem_cache_alloc+0xb4/0x100 [] mempool_alloc_slab+0x10/0x20 [] mempool_alloc+0x55/0x150 [] bio_alloc_bioset+0xb9/0x260 [] process_prepared_discard_passdown_pt1+0x40/0x1c0 [dm_thin_pool] [] break_up_discard_bio+0x1a9/0x200 [dm_thin_pool] [] process_discard_cell_passdown+0x24/0x40 [dm_thin_pool] [] process_discard_bio+0xdd/0xf0 [dm_thin_pool] [] do_worker+0xa76/0xd50 [dm_thin_pool] [] process_one_work+0x139/0x370 [] worker_thread+0x61/0x450 [] kthread+0xd6/0xf0 [] ret_from_fork+0x3f/0x70 [] 0xffffffffffffffff Cc: stable@vger.kernel.org Signed-off-by: Dennis Yang Signed-off-by: Mike Snitzer drivers/md/dm-thin.c | 1 + 1 file changed, 1 insertion(+) commit bc636ee94501aedef744f96c57bb2e29cf21aa39 Author: Lorenzo Pieralisi Date: Wed Apr 19 17:49:10 2017 +0100 PCI: versatile: Update PCI config space remap function PCI configuration space should be mapped with a memory region type that generates on the CPU host bus non-posted write transations. Update the driver to use the devm_ioremap_nopost* interface to make sure the correct memory mappings for PCI configuration space are used. Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Cc: Rob Herring drivers/pci/host/pci-versatile.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 89874a1a6e64b6be8e442b1d52a447e2b730ebbd Author: Lorenzo Pieralisi Date: Wed Apr 19 17:49:09 2017 +0100 PCI: keystone-dw: Update PCI config space remap function PCI configuration space should be mapped with a memory region type that generates on the CPU host bus non-posted write transations. Update the driver to use the devm_pci_remap_cfg* interface to make sure the correct memory mappings for PCI configuration space are used. Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Cc: Murali Karicheri drivers/pci/dwc/pci-keystone-dw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 01bd489dba01bcc58b23c669b437330039639c75 Author: Lorenzo Pieralisi Date: Wed Apr 19 17:49:08 2017 +0100 PCI: layerscape: Update PCI config space remap function PCI configuration space should be mapped with a memory region type that generates on the CPU host bus non-posted write transations. Update the driver to use the devm_pci_remap_cfg* interface to make sure the correct memory mappings for PCI configuration space are used. Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Cc: Mingkai Hu Cc: Minghuan Lian Cc: Roy Zang drivers/pci/dwc/pci-layerscape.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e313a447e73527ef99bd54bc58071956970ca491 Author: Lorenzo Pieralisi Date: Wed Apr 19 17:49:07 2017 +0100 PCI: hisi: Update PCI config space remap function PCI configuration space should be mapped with a memory region type that generates on the CPU host bus non-posted write transations. Update the driver to use the devm_pci_remap_cfg* interface to make sure the correct memory mappings for PCI configuration space are used. Signed-off-by: Lorenzo Pieralisi Signed-off-by: Gabriele Paoloni Signed-off-by: Bjorn Helgaas Cc: Zhou Wang drivers/pci/dwc/pcie-hisi.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit 3e02dc439b2bcb9911abb1632029a15590ba3b97 Author: Lorenzo Pieralisi Date: Wed Apr 19 17:49:06 2017 +0100 PCI: tegra: Update PCI config space remap function PCI configuration space should be mapped with a memory region type that generates on the CPU host bus non-posted write transations. Update the driver to use correct memory mapping attributes to map config space regions to enforce configuration space non-posted writes behaviour. Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Cc: Thierry Reding drivers/pci/host/pci-tegra.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 26b758f775a368653b9ecb3f7c06b9ec34ccb1be Author: Lorenzo Pieralisi Date: Wed Apr 19 17:49:05 2017 +0100 PCI: xgene: Update PCI config space remap function PCI configuration space should be mapped with a memory region type that generates on the CPU host bus non-posted write transations. Update the driver to use the devm_pci_remap_cfg* interface to make sure the correct memory mappings for PCI configuration space are used. Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Cc: Tanmay Inamdar drivers/pci/host/pci-xgene.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 53dfa17dfed84fe1adf00a4ff817789737ead410 Author: Lorenzo Pieralisi Date: Wed Apr 19 17:49:04 2017 +0100 PCI: armada8k: Update PCI config space remap function PCI configuration space should be mapped with a memory region type that generates on the CPU host bus non-posted write transations. Update the driver to use the devm_pci_remap_cfg* interface to make sure the correct memory mappings for PCI configuration space are used. Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Cc: Thomas Petazzoni drivers/pci/dwc/pcie-armada8k.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cc7b0d495589e03607a925a60a3c969debbc4746 Author: Lorenzo Pieralisi Date: Wed Apr 19 17:49:03 2017 +0100 PCI: designware: Update PCI config space remap function PCI configuration space should be mapped with a memory region type that generates on the CPU host bus non-posted write transations. Update the driver to use the devm_pci_remap_cfg* interface to make sure the correct memory mappings for PCI configuration space are used. Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Cc: Jingoo Han Cc: Joao Pinto drivers/pci/dwc/pcie-designware-host.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) commit 868564da658b58ab8864124428fa8fff970bf2bd Author: Lorenzo Pieralisi Date: Wed Apr 19 17:49:02 2017 +0100 PCI: iproc-platform: Update PCI config space remap function PCI configuration space should be mapped with a memory region type that generates on the CPU host bus non-posted write transations. Update the driver to use the devm_pci_remap_cfg* interface to make sure the correct memory mappings for PCI configuration space are used. Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Cc: Ray Jui Cc: Jon Mason drivers/pci/host/pcie-iproc-platform.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 10c736f784cb0dad0dce6ce938878a754676bc89 Author: Lorenzo Pieralisi Date: Wed Apr 19 17:49:01 2017 +0100 PCI: qcom: Update PCI config space remap function PCI configuration space should be mapped with a memory region type that generates on the CPU host bus non-posted write transations. Update the driver to use the devm_pci_remap_cfg* interface to make sure the correct memory mappings for PCI configuration space are used. Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Cc: Stanimir Varbanov drivers/pci/dwc/pcie-qcom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 995b76e48fe3cba4820ca42b4e0726cc5715a952 Author: Lorenzo Pieralisi Date: Wed Apr 19 17:49:00 2017 +0100 PCI: rockchip: Update PCI config space remap function PCI configuration space should be mapped with a memory region type that generates on the CPU host bus non-posted write transations. Update the driver to use the devm_pci_remap_cfg* interface to make sure the correct memory mappings for PCI configuration space are used. Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Cc: Wenrui Li Cc: Shawn Lin drivers/pci/host/pcie-rockchip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 05043c89ef067ec3c067e89afad8c98974e7a234 Author: Lorenzo Pieralisi Date: Wed Apr 19 17:48:59 2017 +0100 PCI: spear13xx: Update PCI config space remap function PCI configuration space should be mapped with a memory region type that generate on the CPU host bus non-posted write transations. Update the driver to use the devm_pci_remap_cfg* interface to make sure the correct memory mappings for PCI configuration space are used. Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Cc: Pratyush Anand drivers/pci/dwc/pcie-spear13xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit cd00f084ed1d501c8cb391c6d98b4f31b2a9a3e2 Author: Lorenzo Pieralisi Date: Wed Apr 19 17:48:58 2017 +0100 PCI: xilinx-nwl: Update PCI config space remap function PCI configuration space should be mapped with a memory region type that generates on the CPU host bus non-posted write transations. Update the driver to use the devm_pci_remap_cfg* interface to make sure the correct memory mappings for PCI configuration space are used. Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Cc: Bharat Kumar Gogada Cc: Michal Simek drivers/pci/host/pcie-xilinx-nwl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit eb21f9e82009b8bce01aa242f15c1acbebbd76e2 Author: Lorenzo Pieralisi Date: Wed Apr 19 17:48:57 2017 +0100 PCI: xilinx: Update PCI config space remap function PCI configuration space should be mapped with a memory region type that generates on the CPU host bus non-posted write transations. Update the driver to use the devm_pci_remap_cfg* interface to make sure the correct memory mappings for PCI configuration space are used. Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Cc: Bharat Kumar Gogada Cc: Michal Simek drivers/pci/host/pcie-xilinx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 053497cec7daecd50313190786872191586ff68c Author: Lorenzo Pieralisi Date: Wed Apr 19 17:48:56 2017 +0100 PCI: ECAM: Map config region with pci_remap_cfgspace() The current ECAM kernel implementation uses ioremap() to map the ECAM configuration space memory region; this is not safe in that on some architectures the ioremap interface provides mappings that allow posted write transactions. This, as highlighted in the PCIe specifications (4.0 - Rev0.3, "Ordering Considerations for the Enhanced Configuration Address Mechanism"), can create ordering issues for software because posted writes transactions on the CPU host bus are non posted in the PCI express fabric. Update the ioremap() interface to use pci_remap_cfgspace() whose mapping attributes guarantee that non-posted writes transactions are issued for memory writes within the ECAM memory mapped address region. Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Cc: Jayachandran C drivers/pci/ecam.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 490cb6ddb17df5ef5f5eb33c9a34f3033b31c204 Author: Lorenzo Pieralisi Date: Wed Apr 19 17:48:55 2017 +0100 PCI: Implement devm_pci_remap_cfgspace() The introduction of the pci_remap_cfgspace() interface allows PCI host controller drivers to map PCI config space through a dedicated kernel interface. Current PCI host controller drivers use the devm_ioremap_*() devres interfaces to map PCI configuration space regions so in order to update them to the new pci_remap_cfgspace() mapping interface a new set of devres interfaces should be implemented so that PCI host controller drivers can make use of them. Introduce two new functions in the PCI kernel layer and Devres documentation: - devm_pci_remap_cfgspace() - devm_pci_remap_cfg_resource() so that PCI host controller drivers can make use of them to map PCI configuration space regions. Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Cc: Jonathan Corbet Documentation/driver-model/devres.txt | 6 ++- drivers/pci/pci.c | 82 +++++++++++++++++++++++++++++++++++ include/linux/pci.h | 5 +++ 3 files changed, 91 insertions(+), 2 deletions(-) commit 6524754eff305760d0b31dac468e78057a56f47e Author: Lorenzo Pieralisi Date: Wed Apr 19 17:48:54 2017 +0100 devres: fix devm_ioremap_*() offset parameter kerneldoc description The offset parameter in the devres devm_ioremap_*() functions kerneldoc entries is erroneously defined as BUS offset whereas it is actually a resource address. Since it is actually misleading, fix the devres devm_ioremap_* offset parameter kerneldoc entry by replacing BUS offset with a more suitable description (ie Resource address). Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Cc: Tejun Heo lib/devres.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) commit b9cdbe6e39351f0ba6cc0c5bc218443f0898e123 Author: Lorenzo Pieralisi Date: Wed Apr 19 17:48:53 2017 +0100 ARM: Implement pci_remap_cfgspace() interface The PCI bus specification (rev 3.0, 3.2.5 "Transaction Ordering and Posting") defines rules for PCI configuration space transactions ordering and posting, that state that configuration writes have to be non-posted transactions. Current ioremap interface on ARM provides mapping functions that provide "bufferable" writes transactions (ie ioremap uses MT_DEVICE memory type) aka posted writes, so PCI host controller drivers have no arch interface to remap PCI configuration space with memory attributes that comply with the PCI specifications for configuration space. Implement an ARM specific pci_remap_cfgspace() interface that allows to map PCI config memory regions with MT_UNCACHED memory type (ie strongly ordered - non-posted writes), providing a remap function that complies with PCI specifications for config space transactions. Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Cc: Arnd Bergmann Cc: Russell King arch/arm/include/asm/io.h | 10 ++++++++++ arch/arm/mm/ioremap.c | 7 +++++++ arch/arm/mm/nommu.c | 12 ++++++++++++ 3 files changed, 29 insertions(+) commit f1e209b7f80288a711268af9054a04d3f6900a6b Author: Lorenzo Pieralisi Date: Wed Apr 19 17:48:52 2017 +0100 ARM64: Implement pci_remap_cfgspace() interface The PCI bus specification (rev 3.0, 3.2.5 "Transaction Ordering and Posting") defines rules for PCI configuration space transactions ordering and posting, that state that configuration writes are non-posted transactions. This rule is reinforced by the ARM v8 architecture reference manual (issue A.k, Early Write Acknowledgment) that explicitly recommends that No Early Write Acknowledgment attribute should be used to map PCI configuration (write) transactions. Current ioremap interface on ARM64 implements mapping functions where the Early Write Acknowledgment hint is enabled, so they cannot be used to map PCI configuration space in a PCI specs compliant way. Implement an ARM64 specific pci_remap_cfgspace() interface that allows to map PCI config region with nGnRnE attributes, providing a remap function that complies with PCI specifications and the ARMv8 architecture reference manual recommendations. Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Acked-by: Catalin Marinas Cc: Will Deacon arch/arm64/include/asm/io.h | 10 ++++++++++ 1 file changed, 10 insertions(+) commit 7d1fedb6e96a960aa91e4ff70714c3fb09195a5a Author: Vinothkumar Raja Date: Thu Apr 6 22:09:38 2017 -0400 dm btree: fix for dm_btree_find_lowest_key() dm_btree_find_lowest_key() is giving incorrect results. find_key() traverses the btree correctly for finding the highest key, but there is an error in the way it traverses the btree for retrieving the lowest key. dm_btree_find_lowest_key() fetches the first key of the rightmost block of the btree instead of fetching the first key from the leftmost block. Fix this by conditionally passing the correct parameter to value64() based on the @find_highest flag. Cc: stable@vger.kernel.org Signed-off-by: Erez Zadok Signed-off-by: Vinothkumar Raja Signed-off-by: Nidhi Panpalia Signed-off-by: Mike Snitzer drivers/md/persistent-data/dm-btree.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) commit 09d36071cfbc1fec9c93a30704b687829ee5efef Merge: 0d688a0 90fdc56 Author: David S. Miller Date: Mon Apr 24 14:35:45 2017 -0400 Merge branch 'nfp-dma-adjust_head-fixes' Jakub Kicinski says: ==================== nfp: DMA flags, adjust head and fixes This series takes advantage of Alex's DMA_ATTR_SKIP_CPU_SYNC to make XDP packet modifications "correct" from DMA API point of view. It also allows us to parse the metadata before we run XDP at no additional DMA sync cost. That way we can get rid of the metadata memcpy, and remove the last upstream user of bpf_prog->xdp_adjust_head. David's patch adds a way to read capabilities from the management firmware. There are also two net-next fixes. Patch 4 which fixes what seems to be a result of a botched rebase on my part. Patch 5 corrects locking when state of ethernet ports is being refreshed. v3: move the sync from alloc func to the actual give to hw func v2: sync rx buffers before giving them to the card (Alex) ==================== Signed-off-by: David S. Miller commit 90fdc561b08ce292f1d39a62f70012f150583b98 Author: Jakub Kicinski Date: Sat Apr 22 20:17:56 2017 -0700 nfp: remove the refresh of all ports optimization The code refreshing the eth port state was trying to update state of all ports of the card. Unfortunately to safely walk the port list we would have to hold the port lock, which we can't due to lock ordering constraints against rtnl. Make the per-port sync refresh and async refresh of all ports completely separate routines. Fixes: 172f638c93dd ("nfp: add port state refresh") Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller drivers/net/ethernet/netronome/nfp/nfp_net.h | 3 +- .../net/ethernet/netronome/nfp/nfp_net_ethtool.c | 13 +++-- drivers/net/ethernet/netronome/nfp/nfp_net_main.c | 67 +++++++++++++++------- 3 files changed, 58 insertions(+), 25 deletions(-) commit ee200a7377fb6ce5ea6d631af0905883f0dca6d2 Author: Jakub Kicinski Date: Sat Apr 22 20:17:55 2017 -0700 nfp: fix free list buffer size reporting XDP headroom should not be included in free list buffer size. Fixes: 6fe0c3b43804 ("nfp: add support for xdp_adjust_head()") Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller drivers/net/ethernet/netronome/nfp/nfp_net_common.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) commit 010e2f9cc5b0a9cb730e3238b06dbad54a577816 Author: David Brunecz Date: Sat Apr 22 20:17:54 2017 -0700 nfp: add NSP routine to get static information Retrieve identifying information from the NSP. For now it only contains versions of firmware subcomponents. Signed-off-by: David Brunecz Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller drivers/net/ethernet/netronome/nfp/Makefile | 1 + drivers/net/ethernet/netronome/nfp/nfp_main.c | 7 ++ drivers/net/ethernet/netronome/nfp/nfpcore/nfp.h | 1 + .../net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c | 7 ++ .../net/ethernet/netronome/nfp/nfpcore/nfp_nsp.h | 24 ++++++ .../ethernet/netronome/nfp/nfpcore/nfp_nsp_cmds.c | 89 ++++++++++++++++++++++ 6 files changed, 129 insertions(+) commit e524a6a9cdc979a45da7532645786469a48de2e3 Author: Jakub Kicinski Date: Sat Apr 22 20:17:53 2017 -0700 nfp: parse metadata prepend before XDP runs Calling memcpy to shift metadata out of the way for XDP to run seems like an overkill. The most common metadata contents are 8 bytes containing type and flow hash. Simply parse the metadata before we run XDP. Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller drivers/net/ethernet/netronome/nfp/nfp_net.h | 6 ++ .../net/ethernet/netronome/nfp/nfp_net_common.c | 67 +++++++++++----------- 2 files changed, 40 insertions(+), 33 deletions(-) commit 5cd4fbeab21b89e08df4590b2020f2e5f60c0d19 Author: Jakub Kicinski Date: Sat Apr 22 20:17:52 2017 -0700 nfp: make use of the DMA_ATTR_SKIP_CPU_SYNC attr DMA unmap may destroy changes CPU made to the buffer. To make XDP run correctly on non-x86 platforms we should use the DMA_ATTR_SKIP_CPU_SYNC attribute. Thanks to using the attribute we can now push the sync operation to the common code path from XDP handler. A little bit of variable name reshuffling is required to bring the code back to readable state. Signed-off-by: Jakub Kicinski Signed-off-by: David S. Miller .../net/ethernet/netronome/nfp/nfp_net_common.c | 53 ++++++++++++++-------- 1 file changed, 35 insertions(+), 18 deletions(-) commit e36215d87f301f9567c8c99fd34e6c3521a94ddf Author: Matthias Kaehlcke Date: Mon Apr 17 11:05:03 2017 -0700 dm ioctl: remove double parentheses The extra pair of parantheses is not needed and causes clang to generate warnings about the DM_DEV_CREATE_CMD comparison in validate_params(). Also remove another double parentheses that doesn't cause a warning. Signed-off-by: Matthias Kaehlcke Signed-off-by: Mike Snitzer drivers/md/dm-ioctl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 0d688a0d337628ded9bb05c99f35fac7424af4f8 Merge: 3ec21b6 a577d8f Author: David S. Miller Date: Mon Apr 24 14:30:47 2017 -0400 Merge branch 'cls_flower-MPLS' Benjamin LaHaise says: ==================== flower: add MPLS matching support This patch series adds support for parsing MPLS flows in the flow dissector and the flower classifier. Each of the MPLS TTL, BOS, TC and Label fields can be used for matching. v2: incorporate style feedback, move #defines to linux/include/mpls.h Note: this omits Jiri's request to remove tabs between the type and field names in struct declarations. This would be inconsistent with numerous other struct definitions. ==================== Signed-off-by: David S. Miller commit a577d8f793ff2fd514915686079e3c09bcf0df11 Author: Benjamin LaHaise Date: Sat Apr 22 16:52:47 2017 -0400 cls_flower: add support for matching MPLS fields (v2) Add support to the tc flower classifier to match based on fields in MPLS labels (TTL, Bottom of Stack, TC field, Label). Signed-off-by: Benjamin LaHaise Signed-off-by: Benjamin LaHaise Reviewed-by: Jakub Kicinski Cc: "David S. Miller" Cc: Simon Horman Cc: Jamal Hadi Salim Cc: Cong Wang Cc: Jiri Pirko Cc: Eric Dumazet Cc: Hadar Hen Zion Cc: Gao Feng Acked-by: Jiri Pirko Signed-off-by: David S. Miller include/uapi/linux/pkt_cls.h | 5 +++ net/sched/cls_flower.c | 74 ++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 79 insertions(+) commit 029c1ecbb2429cf08c7bd2de81e929f81feea914 Author: Benjamin LaHaise Date: Sat Apr 22 16:52:46 2017 -0400 flow_dissector: add mpls support (v2) Add support for parsing MPLS flows to the flow dissector in preparation for adding MPLS match support to cls_flower. Signed-off-by: Benjamin LaHaise Signed-off-by: Benjamin LaHaise Reviewed-by: Jakub Kicinski Cc: "David S. Miller" Cc: Simon Horman Cc: Jamal Hadi Salim Cc: Cong Wang Cc: Jiri Pirko Cc: Eric Dumazet Cc: Hadar Hen Zion Cc: Gao Feng Acked-by: Jiri Pirko Signed-off-by: David S. Miller include/linux/mpls.h | 5 +++++ include/net/flow_dissector.h | 8 ++++++++ net/core/flow_dissector.c | 25 ++++++++++++++++++++++--- 3 files changed, 35 insertions(+), 3 deletions(-) commit 3ec21b6580792c9890e265a46488afbe7dabc5d6 Merge: bc95cd8 59450f8 Author: David S. Miller Date: Mon Apr 24 14:27:18 2017 -0400 Merge branch 'tcp-fastopen-middlebox-fixes' Wei Wang says: ==================== net/tcp_fastopen: Fix for various TFO firewall issues Currently there are still some firewall issues in the middlebox which make the middlebox drop packets silently for TFO sockets. This kind of issue is hard to be detected by the end client. This patch series tries to detect such issues in the kernel and disable TFO temporarily. More details about the issues and the fixes are included in the following patches. ==================== Signed-off-by: David S. Miller commit 59450f8d83cb6743178c7996a6c6fc78ff3e6db9 Author: Wei Wang Date: Thu Apr 20 14:45:48 2017 -0700 net/tcp_fastopen: Remove mss check in tcp_write_timeout() Christoph Paasch from Apple found another firewall issue for TFO: After successful 3WHS using TFO, server and client starts to exchange data. Afterwards, a 10s idle time occurs on this connection. After that, firewall starts to drop every packet on this connection. The fix for this issue is to extend existing firewall blackhole detection logic in tcp_write_timeout() by removing the mss check. Signed-off-by: Wei Wang Acked-by: Yuchung Cheng Acked-by: Neal Cardwell Signed-off-by: David S. Miller net/ipv4/tcp_timer.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) commit 46c2fa39877ed70415ee2b1acfb9129e956f6de4 Author: Wei Wang Date: Thu Apr 20 14:45:47 2017 -0700 net/tcp_fastopen: Add snmp counter for blackhole detection This counter records the number of times the firewall blackhole issue is detected and active TFO is disabled. Signed-off-by: Wei Wang Acked-by: Yuchung Cheng Acked-by: Neal Cardwell Signed-off-by: David S. Miller include/net/tcp.h | 2 +- include/uapi/linux/snmp.h | 1 + net/ipv4/proc.c | 1 + net/ipv4/tcp_fastopen.c | 5 +++-- net/ipv4/tcp_input.c | 4 ++-- 5 files changed, 8 insertions(+), 5 deletions(-) commit cf1ef3f0719b4dcb74810ed507e2a2540f9811b4 Author: Wei Wang Date: Thu Apr 20 14:45:46 2017 -0700 net/tcp_fastopen: Disable active side TFO in certain scenarios Middlebox firewall issues can potentially cause server's data being blackholed after a successful 3WHS using TFO. Following are the related reports from Apple: https://www.nanog.org/sites/default/files/Paasch_Network_Support.pdf Slide 31 identifies an issue where the client ACK to the server's data sent during a TFO'd handshake is dropped. C ---> syn-data ---> S C <--- syn/ack ----- S C (accept & write) C <---- data ------- S C ----- ACK -> X S [retry and timeout] https://www.ietf.org/proceedings/94/slides/slides-94-tcpm-13.pdf Slide 5 shows a similar situation that the server's data gets dropped after 3WHS. C ---- syn-data ---> S C <--- syn/ack ----- S C ---- ack --------> S S (accept & write) C? X <- data ------ S [retry and timeout] This is the worst failure b/c the client can not detect such behavior to mitigate the situation (such as disabling TFO). Failing to proceed, the application (e.g., SSL library) may simply timeout and retry with TFO again, and the process repeats indefinitely. The proposed solution is to disable active TFO globally under the following circumstances: 1. client side TFO socket detects out of order FIN 2. client side TFO socket receives out of order RST We disable active side TFO globally for 1hr at first. Then if it happens again, we disable it for 2h, then 4h, 8h, ... And we reset the timeout to 1hr if a client side TFO sockets not opened on loopback has successfully received data segs from server. And we examine this condition during close(). The rational behind it is that when such firewall issue happens, application running on the client should eventually close the socket as it is not able to get the data it is expecting. Or application running on the server should close the socket as it is not able to receive any response from client. In both cases, out of order FIN or RST will get received on the client given that the firewall will not block them as no data are in those frames. And we want to disable active TFO globally as it helps if the middle box is very close to the client and most of the connections are likely to fail. Also, add a debug sysctl: tcp_fastopen_blackhole_detect_timeout_sec: the initial timeout to use when firewall blackhole issue happens. This can be set and read. When setting it to 0, it means to disable the active disable logic. Signed-off-by: Wei Wang Acked-by: Yuchung Cheng Acked-by: Neal Cardwell Signed-off-by: David S. Miller Documentation/networking/ip-sysctl.txt | 8 +++ include/linux/tcp.h | 1 + include/net/tcp.h | 6 ++ net/ipv4/sysctl_net_ipv4.c | 21 +++++++ net/ipv4/tcp.c | 1 + net/ipv4/tcp_fastopen.c | 101 +++++++++++++++++++++++++++++++++ net/ipv4/tcp_input.c | 23 ++++++-- net/ipv4/tcp_ipv4.c | 3 + 8 files changed, 160 insertions(+), 4 deletions(-) commit 684c581f10f5e21976d9dcd85a190f37ddc843dd Author: Viresh Kumar Date: Thu Apr 20 16:25:07 2017 +0530 arm64: dts: exynos: Use - instead of @ for DT OPP entries Compiling the DT file with W=1, DTC warns like follows: Warning (unit_address_vs_reg): Node /opp_table0/opp@1000000000 has a unit name, but no reg property Fix this by replacing '@' with '-' as the OPP nodes will never have a "reg" property. Reported-by: Krzysztof Kozlowski Reported-by: Masahiro Yamada Suggested-by: Mark Rutland Signed-off-by: Viresh Kumar Reviewed-by: Chanwoo Choi Reviewed-by: Krzysztof Kozlowski Acked-by: Rob Herring [k.kozlowski: Split patch per ARM and ARM64] Signed-off-by: Krzysztof Kozlowski arch/arm64/boot/dts/exynos/exynos5433-bus.dtsi | 48 ++++++++++++------------- arch/arm64/boot/dts/exynos/exynos5433.dtsi | 50 +++++++++++++------------- 2 files changed, 49 insertions(+), 49 deletions(-) commit bc95cd8e8b2fc779b96ed4d7a2608c6a0e8dc240 Merge: 58c4c6a 8bf3198 Author: David S. Miller Date: Mon Apr 24 14:11:10 2017 -0400 Merge tag 'mlx5-updates-2017-04-22' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5-updates-2017-04-22 Sparse and compiler warnings fixes from Stephen Hemminger. From Roi Dayan and Or Gerlitz, Add devlink and mlx5 support for controlling E-Switch encapsulation mode, this knob will enable HW support for applying encapsulation/decapsulation to VF traffic as part of SRIOV e-switch offloading. ==================== Signed-off-by: David S. Miller commit 58c4c6a3f7cb3a142674ba34e7e67e2d585b9787 Author: David Ahern Date: Sat Apr 22 09:33:16 2017 -0700 net: add rcu locking when changing early demux systemd-sysctl is triggering a suspicious RCU usage message when net.ipv4.tcp_early_demux or net.ipv4.udp_early_demux is changed via a sysctl config file: [ 33.896184] =============================== [ 33.899558] [ ERR: suspicious RCU usage. ] [ 33.900624] 4.11.0-rc7+ #104 Not tainted [ 33.901698] ------------------------------- [ 33.903059] /home/dsa/kernel-2.git/net/ipv4/sysctl_net_ipv4.c:305 suspicious rcu_dereference_check() usage! [ 33.905724] other info that might help us debug this: [ 33.907656] rcu_scheduler_active = 2, debug_locks = 0 [ 33.909288] 1 lock held by systemd-sysctl/143: [ 33.910373] #0: (sb_writers#5){.+.+.+}, at: [] file_start_write+0x45/0x48 [ 33.912407] stack backtrace: [ 33.914018] CPU: 0 PID: 143 Comm: systemd-sysctl Not tainted 4.11.0-rc7+ #104 [ 33.915631] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014 [ 33.917870] Call Trace: [ 33.918431] dump_stack+0x81/0xb6 [ 33.919241] lockdep_rcu_suspicious+0x10f/0x118 [ 33.920263] proc_configure_early_demux+0x65/0x10a [ 33.921391] proc_udp_early_demux+0x3a/0x41 add rcu locking to proc_configure_early_demux. Fixes: dddb64bcb3461 ("net: Add sysctl to toggle early demux for tcp and udp") Signed-off-by: David Ahern Signed-off-by: David S. Miller net/ipv4/sysctl_net_ipv4.c | 3 +++ 1 file changed, 3 insertions(+) commit 6bd3d1929246bb0cf4f3bd6e25a0ba442b0de845 Author: Peter Tirsek Date: Tue Apr 18 12:39:58 2017 -0500 netfilter: xt_socket: Fix broken IPv6 handling Commit 834184b1f3a4 ("netfilter: defrag: only register defrag functionality if needed") used the outdated XT_SOCKET_HAVE_IPV6 macro which was removed earlier in commit 8db4c5be88f6 ("netfilter: move socket lookup infrastructure to nf_socket_ipv{4,6}.c"). With that macro never being defined, the xt_socket match emits an "Unknown family 10" warning when used with IPv6: WARNING: CPU: 0 PID: 1377 at net/netfilter/xt_socket.c:160 socket_mt_enable_defrag+0x47/0x50 [xt_socket] Unknown family 10 Modules linked in: xt_socket nf_socket_ipv4 nf_socket_ipv6 nf_defrag_ipv4 [...] CPU: 0 PID: 1377 Comm: ip6tables-resto Not tainted 4.10.10 #1 Hardware name: [...] Call Trace: ? __warn+0xe7/0x100 ? socket_mt_enable_defrag+0x47/0x50 [xt_socket] ? socket_mt_enable_defrag+0x47/0x50 [xt_socket] ? warn_slowpath_fmt+0x39/0x40 ? socket_mt_enable_defrag+0x47/0x50 [xt_socket] ? socket_mt_v2_check+0x12/0x40 [xt_socket] ? xt_check_match+0x6b/0x1a0 [x_tables] ? xt_find_match+0x93/0xd0 [x_tables] ? xt_request_find_match+0x20/0x80 [x_tables] ? translate_table+0x48e/0x870 [ip6_tables] ? translate_table+0x577/0x870 [ip6_tables] ? walk_component+0x3a/0x200 ? kmalloc_order+0x1d/0x50 ? do_ip6t_set_ctl+0x181/0x490 [ip6_tables] ? filename_lookup+0xa5/0x120 ? nf_setsockopt+0x3a/0x60 ? ipv6_setsockopt+0xb0/0xc0 ? sock_common_setsockopt+0x23/0x30 ? SyS_socketcall+0x41d/0x630 ? vfs_read+0xfa/0x120 ? do_fast_syscall_32+0x7a/0x110 ? entry_SYSENTER_32+0x47/0x71 This patch brings the conditional back in line with how the rest of the file handles IPv6. Fixes: 834184b1f3a4 ("netfilter: defrag: only register defrag functionality if needed") Signed-off-by: Peter Tirsek Acked-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso net/netfilter/xt_socket.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 64f3967c7aacbfa1f0614cdb1a23e3f7e76eb61b Author: Liping Zhang Date: Mon Apr 17 21:18:58 2017 +0800 netfilter: ctnetlink: acquire ct->lock before operating nf_ct_seqadj We should acquire the ct->lock before accessing or modifying the nf_ct_seqadj, as another CPU may modify the nf_ct_seqadj at the same time during its packet proccessing. Signed-off-by: Liping Zhang Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_conntrack_netlink.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) commit 53b56da83d7899de375a9de153fd7f5397de85e6 Author: Liping Zhang Date: Mon Apr 17 21:18:57 2017 +0800 netfilter: ctnetlink: make it safer when updating ct->status After converting to use rcu for conntrack hash, one CPU may update the ct->status via ctnetlink, while another CPU may process the packets and update the ct->status. So the non-atomic operation "ct->status |= status;" via ctnetlink becomes unsafe, and this may clear the IPS_DYING_BIT bit set by another CPU unexpectedly. For example: CPU0 CPU1 ctnetlink_change_status __nf_conntrack_find_get old = ct->status nf_ct_gc_expired - nf_ct_kill - test_and_set_bit(IPS_DYING_BIT new = old | status; - ct->status = new; <-- oops, _DYING_ is cleared! Now using a series of atomic bit operation to solve the above issue. Also note, user shouldn't set IPS_TEMPLATE, IPS_SEQ_ADJUST directly, so make these two bits be unchangable too. If we set the IPS_TEMPLATE_BIT, ct will be freed by nf_ct_tmpl_free, but actually it is alloced by nf_conntrack_alloc. If we set the IPS_SEQ_ADJUST_BIT, this may cause the NULL pointer deference, as the nfct_seqadj(ct) maybe NULL. Last, add some comments to describe the logic change due to the commit a963d710f367 ("netfilter: ctnetlink: Fix regression in CTA_STATUS processing"), which makes me feel a little confusing. Fixes: 76507f69c44e ("[NETFILTER]: nf_conntrack: use RCU for conntrack hash") Signed-off-by: Liping Zhang Signed-off-by: Pablo Neira Ayuso include/uapi/linux/netfilter/nf_conntrack_common.h | 13 ++++++--- net/netfilter/nf_conntrack_netlink.c | 33 ++++++++++++++++------ 2 files changed, 33 insertions(+), 13 deletions(-) commit 88be4c09d9008f9ff337cbf48c5d0f06c8f872e7 Author: Liping Zhang Date: Mon Apr 17 21:18:56 2017 +0800 netfilter: ctnetlink: fix deadlock due to acquire _expect_lock twice Currently, ctnetlink_change_conntrack is always protected by _expect_lock, but this will cause a deadlock when deleting the helper from a conntrack, as the _expect_lock will be acquired again by nf_ct_remove_expectations: CPU0 ---- lock(nf_conntrack_expect_lock); lock(nf_conntrack_expect_lock); *** DEADLOCK *** May be due to missing lock nesting notation 2 locks held by lt-conntrack_gr/12853: #0: (&table[i].mutex){+.+.+.}, at: [] nfnetlink_rcv_msg+0x399/0x6a9 [nfnetlink] #1: (nf_conntrack_expect_lock){+.....}, at: [] ctnetlink_new_conntrack+0x17f/0x408 [nf_conntrack_netlink] Call Trace: dump_stack+0x85/0xc2 __lock_acquire+0x1608/0x1680 ? ctnetlink_parse_tuple_proto+0x10f/0x1c0 [nf_conntrack_netlink] lock_acquire+0x100/0x1f0 ? nf_ct_remove_expectations+0x32/0x90 [nf_conntrack] _raw_spin_lock_bh+0x3f/0x50 ? nf_ct_remove_expectations+0x32/0x90 [nf_conntrack] nf_ct_remove_expectations+0x32/0x90 [nf_conntrack] ctnetlink_change_helper+0xc6/0x190 [nf_conntrack_netlink] ctnetlink_new_conntrack+0x1b2/0x408 [nf_conntrack_netlink] nfnetlink_rcv_msg+0x60a/0x6a9 [nfnetlink] ? nfnetlink_rcv_msg+0x1b9/0x6a9 [nfnetlink] ? nfnetlink_bind+0x1a0/0x1a0 [nfnetlink] netlink_rcv_skb+0xa4/0xc0 nfnetlink_rcv+0x87/0x770 [nfnetlink] Since the operations are unrelated to nf_ct_expect, so we can drop the _expect_lock. Also note, after removing the _expect_lock protection, another CPU may invoke nf_conntrack_helper_unregister, so we should use rcu_read_lock to protect __nf_conntrack_helper_find invoked by ctnetlink_change_helper. Fixes: ca7433df3a67 ("netfilter: conntrack: seperate expect locking from nf_conntrack_lock") Signed-off-by: Liping Zhang Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_conntrack_netlink.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) commit 14e567615679a9999ce6bf4f23d6c9e00f03e00e Author: Liping Zhang Date: Mon Apr 17 21:18:55 2017 +0800 netfilter: ctnetlink: drop the incorrect cthelper module request First, when creating a new ct, we will invoke request_module to try to load the related inkernel cthelper. So there's no need to call the request_module again when updating the ct helpinfo. Second, ctnetlink_change_helper may be called with rcu_read_lock held, i.e. rcu_read_lock -> nfqnl_recv_verdict -> nfqnl_ct_parse -> ctnetlink_glue_parse -> ctnetlink_glue_parse_ct -> ctnetlink_change_helper. But the request_module invocation may sleep, so we can't call it with the rcu_read_lock held. Remove it now. Signed-off-by: Liping Zhang Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_conntrack_netlink.c | 17 +---------------- 1 file changed, 1 insertion(+), 16 deletions(-) commit ad0cb27ce99ccffcfd4e0b08ea2ee01f440e8eac Merge: 11a9ec4 d160b74 Author: David S. Miller Date: Mon Apr 24 14:05:40 2017 -0400 Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next Johan Hedberg says: ==================== pull request: bluetooth-next 2017-04-22 Here are some more Bluetooth patches (and one 802.15.4 patch) in the bluetooth-next tree targeting the 4.12 kernel. Most of them are pure fixes. Please let me know if there are any issues pulling. Thanks. ==================== Signed-off-by: David S. Miller commit 54a5f9d9abab639039eb7288bdc26c9c67f4e79b Author: Liping Zhang Date: Sat Apr 15 23:37:36 2017 +0800 netfilter: nft_set_bitmap: free dummy elements when destroy the set We forget to free dummy elements when deleting the set. So when I was running nft-test.py, I saw many kmemleak warnings: kmemleak: 1344 new suspected memory leaks ... # cat /sys/kernel/debug/kmemleak unreferenced object 0xffff8800631345c8 (size 32): comm "nft", pid 9075, jiffies 4295743309 (age 1354.815s) hex dump (first 32 bytes): f8 63 13 63 00 88 ff ff 88 79 13 63 00 88 ff ff .c.c.....y.c.... 04 0c 00 00 00 00 00 00 00 00 00 00 08 03 00 00 ................ backtrace: [] kmemleak_alloc+0x4a/0xa0 [] __kmalloc+0x164/0x310 [] nft_set_elem_init+0x3d/0x1b0 [nf_tables] [] nft_add_set_elem+0x45a/0x8c0 [nf_tables] [] nf_tables_newsetelem+0x105/0x1d0 [nf_tables] [] nfnetlink_rcv+0x414/0x770 [nfnetlink] [] netlink_unicast+0x1f6/0x310 [] netlink_sendmsg+0x306/0x3b0 ... Fixes: e920dde516088 ("netfilter: nft_set_bitmap: keep a list of dummy elements") Signed-off-by: Liping Zhang Signed-off-by: Pablo Neira Ayuso net/netfilter/nft_set_bitmap.c | 5 +++++ 1 file changed, 5 insertions(+) commit 66e5a6b18bd09d0431e97cd3c162e76c5c2aebba Author: Liping Zhang Date: Sat Apr 15 19:27:42 2017 +0800 netfilter: nf_ct_helper: permit cthelpers with different names via nfnetlink cthelpers added via nfnetlink may have the same tuple, i.e. except for the l3proto and l4proto, other fields are all zero. So even with the different names, we will also fail to add them: # nfct helper add ssdp inet udp # nfct helper add tftp inet udp nfct v1.4.3: netlink error: File exists So in order to avoid unpredictable behaviour, we should: 1. cthelpers can be selected by nft ct helper obj or xt_CT target, so report error if duplicated { name, l3proto, l4proto } tuple exist. 2. cthelpers can be selected by nf_ct_tuple_src_mask_cmp when nf_ct_auto_assign_helper is enabled, so also report error if duplicated { l3proto, l4proto, src-port } tuple exist. Also note, if the cthelper is added from userspace, then the src-port will always be zero, it's invalid for nf_ct_auto_assign_helper, so there's no need to check the second point listed above. Fixes: 893e093c786c ("netfilter: nf_ct_helper: bail out on duplicated helpers") Signed-off-by: Liping Zhang Signed-off-by: Pablo Neira Ayuso net/netfilter/nf_conntrack_helper.c | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-) commit cf5d70918877c6a6655dc1e92e2ebb661ce904fd Author: Jarno Rajahalme Date: Fri Apr 14 14:26:38 2017 -0700 openvswitch: Delete conntrack entry clashing with an expectation. Conntrack helpers do not check for a potentially clashing conntrack entry when creating a new expectation. Also, nf_conntrack_in() will check expectations (via init_conntrack()) only if a conntrack entry can not be found. The expectation for a packet which also matches an existing conntrack entry will not be removed by conntrack, and is currently handled inconsistently by OVS, as OVS expects the expectation to be removed when the connection tracking entry matching that expectation is confirmed. It should be noted that normally an IP stack would not allow reuse of a 5-tuple of an old (possibly lingering) connection for a new data connection, so this is somewhat unlikely corner case. However, it is possible that a misbehaving source could cause conntrack entries be created that could then interfere with new related connections. Fix this in the OVS module by deleting the clashing conntrack entry after an expectation has been matched. This causes the following nf_conntrack_in() call also find the expectation and remove it when creating the new conntrack entry, as well as the forthcoming reply direction packets to match the new related connection instead of the old clashing conntrack entry. Fixes: 7f8a436eaa2c ("openvswitch: Add conntrack action") Reported-by: Yang Song Signed-off-by: Jarno Rajahalme Acked-by: Joe Stringer Signed-off-by: Pablo Neira Ayuso net/openvswitch/conntrack.c | 30 +++++++++++++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-) commit 470acf55a021713869b9bcc967268ac90c8a0fac Author: Gao Feng Date: Fri Apr 14 10:00:08 2017 +0800 netfilter: xt_CT: fix refcnt leak on error path There are two cases which causes refcnt leak. 1. When nf_ct_timeout_ext_add failed in xt_ct_set_timeout, it should free the timeout refcnt. Now goto the err_put_timeout error handler instead of going ahead. 2. When the time policy is not found, we should call module_put. Otherwise, the related cthelper module cannot be removed anymore. It is easy to reproduce by typing the following command: # iptables -t raw -A OUTPUT -p tcp -j CT --helper ftp --timeout xxx Signed-off-by: Gao Feng Signed-off-by: Liping Zhang Signed-off-by: Pablo Neira Ayuso net/netfilter/xt_CT.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) commit 11a9ec43302fc8d7fca0dc26b75234c20ff4c464 Author: Colin Ian King Date: Sat Apr 22 13:22:01 2017 +0100 net: netcp: fix spelling mistake: "memomry" -> "memory" Trivial fix to spelling mistake in dev_err message and rejoin line. Signed-off-by: Colin Ian King Signed-off-by: David S. Miller drivers/net/ethernet/ti/netcp_ethss.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) commit 4cc17bcf7f39088b5b68e3689f1653184c7e7ad4 Author: Geliang Tang Date: Sat Apr 22 09:21:10 2017 +0800 net: atheros: atl1: use offset_in_page() macro Use offset_in_page() macro instead of open-coding. Signed-off-by: Geliang Tang Signed-off-by: David S. Miller drivers/net/ethernet/atheros/atlx/atl1.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) commit 4dd42b94b4d25c0f99ee9ba0748dd315653b6a34 Merge: 1206455 9e54e32 Author: David S. Miller Date: Mon Apr 24 13:54:48 2017 -0400 Merge branch 'bnxt_en-misc-next' Michael Chan says: ==================== bnxt_en: Updates for net-next. Miscellaneous updates include passing DCBX RoCE VLAN priority to firmware, checking one more new firmware flag before allowing DCBX to run on the host, adding 100Gbps speed support, adding check to disallow speed settings on Multi-host NICs, and a minor fix for reporting VF attributes. ==================== Signed-off-by: David S. Miller commit 9e54e322ded40f424dcb5a13508e2556919ce12a Author: Deepak Khungar Date: Fri Apr 21 20:11:26 2017 -0400 bnxt_en: Restrict a PF in Multi-Host mode from changing port PHY configuration This change restricts the PF in multi-host mode from setting any port level PHY configuration. The settings are controlled by firmware in Multi-Host mode. Signed-off-by: Deepak Khungar Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 13 +++++++++---- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 4 +++- 2 files changed, 12 insertions(+), 5 deletions(-) commit 7d63818a35851cf00867248d5ab50a8fe8df5943 Author: Michael Chan Date: Fri Apr 21 20:11:25 2017 -0400 bnxt_en: Check the FW_LLDP_AGENT flag before allowing DCBX host agent. Check the additional flag in bnxt_hwrm_func_qcfg() before allowing DCBX to be done in host mode. Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) commit 38a21b34aacd4db7b7b74c61afae42ea6718448d Author: Deepak Khungar Date: Fri Apr 21 20:11:24 2017 -0400 bnxt_en: Add 100G link speed reporting for BCM57454 ASIC in ethtool Added support for 100G link speed reporting for Broadcom BCM57454 ASIC in ethtool command. Signed-off-by: Deepak Khungar Signed-off-by: Ray Jui Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt.c | 5 +++-- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 2 ++ drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 14 +++++++++++++- 3 files changed, 18 insertions(+), 3 deletions(-) commit f0249056eaf2b9a17b2b76a6e099e9b7877e187d Author: Michael Chan Date: Fri Apr 21 20:11:23 2017 -0400 bnxt_en: Fix VF attributes reporting. The .ndo_get_vf_config() is returning the wrong qos attribute. Fix the code that checks and reports the qos and spoofchk attributes. The BNXT_VF_QOS and BNXT_VF_LINK_UP flags should not be set by default during init. time. Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) commit a82fba8dbfb522bd19b1644bf599135680fd0122 Author: Michael Chan Date: Fri Apr 21 20:11:22 2017 -0400 bnxt_en: Pass DCB RoCE app priority to firmware. When the driver gets the RoCE app priority set/delete call through DCBNL, the driver will send the information to the firmware to set up the priority VLAN tag for RDMA traffic. [ New version using the common ETH_P_IBOE constant in if_ether.h ] Signed-off-by: Michael Chan Signed-off-by: David S. Miller drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c | 108 +++++++++++++++++++++++++- drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.h | 1 + 2 files changed, 108 insertions(+), 1 deletion(-) commit 120645513f55a4ac5543120d9e79925d30a0156f Author: Jarno Rajahalme Date: Fri Apr 21 16:48:06 2017 -0700 openvswitch: Add eventmask support to CT action. Add a new optional conntrack action attribute OVS_CT_ATTR_EVENTMASK, which can be used in conjunction with the commit flag (OVS_CT_ATTR_COMMIT) to set the mask of bits specifying which conntrack events (IPCT_*) should be delivered via the Netfilter netlink multicast groups. Default behavior depends on the system configuration, but typically a lot of events are delivered. This can be very chatty for the NFNLGRP_CONNTRACK_UPDATE group, even if only some types of events are of interest. Netfilter core init_conntrack() adds the event cache extension, so we only need to set the ctmask value. However, if the system is configured without support for events, the setting will be skipped due to extension not being found. Signed-off-by: Jarno Rajahalme Reviewed-by: Greg Rose Acked-by: Joe Stringer Signed-off-by: David S. Miller include/uapi/linux/openvswitch.h | 12 ++++++++++++ net/openvswitch/conntrack.c | 27 +++++++++++++++++++++++++++ 2 files changed, 39 insertions(+) commit abd0a4f2b41812e9ba334945e256909e3d28da57 Author: Jarno Rajahalme Date: Fri Apr 21 16:48:05 2017 -0700 openvswitch: Typo fix. Fix typo in a comment. Signed-off-by: Jarno Rajahalme Acked-by: Greg Rose Signed-off-by: David S. Miller net/openvswitch/conntrack.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fd9f069d876d6a96eb0f731b1e293145352d5f4f Author: Colin Ian King Date: Sat Apr 22 13:28:42 2017 +0100 ASoC: wm5100: fix spelling mistake: "micropone" -> "microphone" Trivial fix to spelling mistake in dev_err message Signed-off-by: Colin Ian King Acked-by: Linus Walleij Acked-by: Charles Keepax Signed-off-by: Mark Brown sound/soc/codecs/wm5100.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 9f2cf73ed65b598514e4858ca3d602710718ab93 Author: Takashi Iwai Date: Sun Apr 23 09:22:56 2017 +0200 ASoC: bytcr_rt5640: Allow quirk set via module option The bytcr-rt5640 driver has a few quirk setups depending on the board, where the quirk value is set by DMI matching. When you have a new device to add the support, you often experience to try the different quirk by trial-and-error. Or, you may have a development model that still has no proper DMI string. In either case, you'd need to compile the driver at each time. This patch introduces a module option to override the quirk value on the fly. User can boot like snd-soc-sst-bytcr-rt5640.quirk=0x4004 to override the default value without recompilation. It's a raw value, so user needs to check the source code for the meaning of each bit. Signed-off-by: Takashi Iwai Acked-by: Pierre-Louis Bossart Signed-off-by: Mark Brown sound/soc/intel/boards/bytcr_rt5640.c | 9 +++++++++ 1 file changed, 9 insertions(+) commit 861886d338f7dd802be972e770a695bba62f397a Author: Takashi Iwai Date: Mon Apr 24 08:54:42 2017 +0200 ASoC: Call snd_soc_set_dmi_name() unconditionally Since recently UCM can pick up a configuration specific to the board via card longname field, and we introduced a helper function snd_soc_set_dmi_name() for that. So far, it was used only in one place (sound/soc/intel/boards/broadwell.c), but it should be more widely applied. This patch puts a big hammer for that: it lets snd_soc_register_card() calling snd_soc_set_dmi_name() unconditionally, so that all x86 devices get the better longname string. This would have no impact for other systems without DMI support, as snd_soc_set_dmi_name() is no-op on them. Signed-off-by: Takashi Iwai Acked-by: Liam Girdwood Acked-by: Vinod Koul Signed-off-by: Mark Brown sound/soc/intel/boards/broadwell.c | 3 --- sound/soc/soc-core.c | 3 +++ 2 files changed, 3 insertions(+), 3 deletions(-) commit 1f5a4535db41bd2bb8d1a15f098cb2921d6c1317 Author: Takashi Iwai Date: Mon Apr 24 08:54:41 2017 +0200 ASoC: Provide a dummy wrapper of snd_soc_set_dmi_name() For systems without DMI, it makes no sense to have the code. Signed-off-by: Takashi Iwai Acked-by: Liam Girdwood Acked-by: Vinod Koul Signed-off-by: Mark Brown include/sound/soc.h | 8 ++++++++ sound/soc/soc-core.c | 2 ++ 2 files changed, 10 insertions(+) commit 8f7206d69ab8c8fb8620566338d54c4b9b80477a Author: Fabio Estevam Date: Sun Apr 23 20:20:33 2017 -0300 ASoC: imx-wm8962: Remove global variables Currently the following variables are global: - card_priv, sample_rate and sample_format ,which is not a good idea as it prevents the usage of multiple instances. Make sample_rate and sample_format part of the imx_priv structure and allocate imx_priv via the standard devm_kzalloc() mechanism inside the probe function. Signed-off-by: Fabio Estevam Signed-off-by: Mark Brown sound/soc/fsl/imx-wm8962.c | 31 +++++++++++++++++++------------ 1 file changed, 19 insertions(+), 12 deletions(-) commit bfca76185d9bd5b3de562bf5023e5d3dddaa9dce Author: Colin Ian King Date: Sun Apr 23 18:14:36 2017 +0100 spi: tegra: fix spelling mistake: "trasfer" -> "transfer" trivial fix to spelling mistake in dbg_err messages Signed-off-by: Colin Ian King Signed-off-by: Mark Brown drivers/spi/spi-tegra114.c | 2 +- drivers/spi/spi-tegra20-sflash.c | 2 +- drivers/spi/spi-tegra20-slink.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) commit cd183740480f045600aa1fa38fe70809b5498f05 Author: Tomasz Nowicki Date: Wed Mar 29 14:16:13 2017 +0200 PCI/ACPI: Add ThunderX pass2.x 2nd node MCFG quirk Currently SoCs pass2.x do not emulate EA headers for ACPI boot method at all. However, for pass2.x some devices (like EDAC) advertise incorrect base addresses in their BARs which results in driver probe failure during resource request. Since all problematic blocks are on 2nd NUMA node under domain 10 add necessary quirk entry to obtain BAR addresses correction using EA header emulation. Fixes: 44f22bd91e88 ("PCI: Add MCFG quirks for Cavium ThunderX pass2.x host controller") Signed-off-by: Tomasz Nowicki Signed-off-by: Bjorn Helgaas Acked-by: Robert Richter CC: stable@vger.kernel.org # v4.10+ drivers/acpi/pci_mcfg.c | 1 + 1 file changed, 1 insertion(+) commit 6df3d9e2af9cd68a84b26733191dd800070f2c4d Merge: 6a32a44 7f5b030 Author: David S. Miller Date: Mon Apr 24 12:52:15 2017 -0400 Merge branch 'ibmvnic-updates-and-fixes' Nathan Fontenot says: ==================== ibmvnic: Additional updates and bug fixes This set of patches is an additional set of updates and bug fixes to the ibmvnic driver which applies on top of the previous set of updates sent out on 4/19. ==================== Signed-off-by: David S. Miller commit 7f5b030830fecc4a2a235804a15b395720b48a24 Author: Thomas Falcon Date: Fri Apr 21 15:39:16 2017 -0400 ibmvnic: Free skb's in cases of failure in transmit When an error is encountered during transmit we need to free the skb instead of returning TX_BUSY. Signed-off-by: Thomas Falcon Signed-off-by: David S. Miller drivers/net/ethernet/ibm/ibmvnic.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) commit 3ca1993264503957f81f3846598b16601b1e9457 Author: Nathan Fontenot Date: Fri Apr 21 15:39:10 2017 -0400 ibmvnic: Validate napi exist before disabling them Validate that the napi structs exist before trying to disable them at driver close. Signed-off-by: Nathan Fontenot Signed-off-by: David S. Miller drivers/net/ethernet/ibm/ibmvnic.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) commit 53da09e92910f675ebb93921007428a3c2a024fb Author: Nathan Fontenot Date: Fri Apr 21 15:39:04 2017 -0400 ibmvnic: Add set_link_state routine for setting adapter link state Create a common routine for setting the link state for the vnic adapter. This update moves the sending of the crq and waiting for the link state response to a common place. The new routine also adds handling of resending the crq in cases of getting a partial success response. Signed-off-by: Nathan Fontenot Signed-off-by: David S. Miller drivers/net/ethernet/ibm/ibmvnic.c | 71 ++++++++++++++++++++++++++++++-------- drivers/net/ethernet/ibm/ibmvnic.h | 1 + 2 files changed, 58 insertions(+), 14 deletions(-) commit 5d5e84eb7276d30a21257515a83b34d1ef77f99b Author: Nathan Fontenot Date: Fri Apr 21 15:38:58 2017 -0400 ibmvnic: Move initialization of the stats token to ibmvnic_open We should be initializing the stats token in the same place we initialize the other resources for the driver. Signed-off-by: Nathan Fontenot Signed-off-by: David S. Miller drivers/net/ethernet/ibm/ibmvnic.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) commit 2f9de9bac625ae08e9ea132e8dc08cfbe9fb67d2 Author: Nathan Fontenot Date: Fri Apr 21 15:38:52 2017 -0400 ibmvnic: Only retrieve error info if present When handling a fatal error in the driver, there can be additional error information provided by the vios. This information is not always present, so only retrieve the additional error information when present. Signed-off-by: Nathan Fontenot Signed-off-by: David S. Miller drivers/net/ethernet/ibm/ibmvnic.c | 71 +++++++++++++++++++++++++++----------- 1 file changed, 51 insertions(+), 20 deletions(-) commit 6052d5e2a1961b59dd942b52d3bf2b395d023644 Author: Murilo Fossa Vicentini Date: Fri Apr 21 15:38:46 2017 -0400 ibmvnic: Insert header on VLAN tagged received frame This patch addresses a modification in the PAPR+ specification which now defines a previously reserved value for vNIC capabilities. It indicates whether the system firmware performs a VLAN header stripping on all VLAN tagged received frames, in case it does, the behavior expected is for the ibmvnic driver to be responsible for inserting the VLAN header. Reported-by: Manvanthara B. Puttashankar Signed-off-by: Murilo Fossa Vicentini Signed-off-by: David S. Miller drivers/net/ethernet/ibm/ibmvnic.c | 21 ++++++++++++++++++++- drivers/net/ethernet/ibm/ibmvnic.h | 2 ++ 2 files changed, 22 insertions(+), 1 deletion(-) commit 7f3c6e6b905018d07228fe0f43f0ef1359e7196d Author: Thomas Falcon Date: Fri Apr 21 15:38:40 2017 -0400 ibmvnic: Set real number of rx queues Along with 5 TX queues, 5 RX queues are allocated at the beginning of device probe. However, only the real number of TX queues is set. Configure the real number of RX queues as well. Signed-off-by: Thomas Falcon Signed-off-by: David S. Miller drivers/net/ethernet/ibm/ibmvnic.c | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-) commit 6a32a44d1e3d10c79abd9ef59ee34b46e00f242b Merge: 6922689 28be04f Author: David S. Miller Date: Mon Apr 24 12:46:28 2017 -0400 Merge branch 'packet-fanout-unique-id' Mike Maloney says: ==================== packet: Add option to create new fanout group with unique id. Fanout uses a per net global namespace. A process that intends to create a new fanout group can accidentally join an existing group. It is not possible to detect this. Add a socket option to specify on the first call to setsockopt(..., PACKET_FANOUT, ...) to ensure that a new group is created. Also add tests. ==================== Signed-off-by: David S. Miller commit 28be04f5c1c95bdf5614af19f7faf7d4fb781fa6 Author: Mike Maloney Date: Fri Apr 21 10:56:12 2017 -0400 selftests/net: add tests for PACKET_FANOUT_FLAG_UNIQUEID Create two groups with PACKET_FANOUT_FLAG_UNIQUEID, add a socket to one. Ensure that the groups can only be joined if all options are consistent with the original except for this flag. Signed-off-by: Mike Maloney Acked-by: Willem de Bruijn Signed-off-by: David S. Miller tools/testing/selftests/net/psock_fanout.c | 95 ++++++++++++++++++++++++++---- 1 file changed, 84 insertions(+), 11 deletions(-) commit 4a69a864209e9ab436d4a58e8028ac96cc873d15 Author: Mike Maloney Date: Fri Apr 21 10:56:11 2017 -0400 packet: add PACKET_FANOUT_FLAG_UNIQUEID to assign new fanout group id. Fanout uses a per net global namespace. A process that intends to create a new fanout group can accidentally join an existing group. It is not possible to detect this. Add socket option PACKET_FANOUT_FLAG_UNIQUEID. When specified the supplied fanout group id must be set to 0, and the kernel chooses an id that is not already in use. This is an ephemeral flag so that other sockets can be added to this group using setsockopt, but NOT specifying this flag. The current getsockopt(..., PACKET_FANOUT, ...) can be used to retrieve the new group id. We assume that there are not a lot of fanout groups and that this is not a high frequency call. The method assigns ids starting at zero and increases until it finds an unused id. It keeps track of the last assigned id, and uses it as a starting point to find new ids. Signed-off-by: Mike Maloney Acked-by: Willem de Bruijn Signed-off-by: David S. Miller include/uapi/linux/if_packet.h | 1 + net/packet/af_packet.c | 44 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 45 insertions(+) commit 2e7a721714b9cdca539da78a0eb1f59dbe4020ac Author: Mike Maloney Date: Fri Apr 21 10:56:10 2017 -0400 selftests/net: cleanup unused parameter in psock_fanout sock_fanout_open no longer sets the size of packet_socket ring, so stop passing the parameter. Signed-off-by: Mike Maloney Acked-by: Willem de Bruijn Signed-off-by: David S. Miller tools/testing/selftests/net/psock_fanout.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) commit 9d43f5e8df6804ae271407500af9062e9278167a Author: Jiri Olsa Date: Thu Apr 20 11:24:30 2017 +0200 perf tools: Fix the code to strip command name Recent commit broke command name strip in perf_event__get_comm_ids function. It replaced left to right search for '\n' with rtrim, which actually does right to left search. It occasionally caught earlier '\n' and kept trash in the command name. Keeping the ltrim, but moving back the left to right '\n' search instead of the rtrim. Signed-off-by: Jiri Olsa Acked-by: Taeung Song Cc: David Ahern Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Yao Jin Fixes: bdd97ca63faa ("perf tools: Refactor the code to strip command name with {l,r}trim()") Link: http://lkml.kernel.org/r/20170420092430.29657-1-jolsa@kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/event.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) commit fb7b75619641d778c2b778748ca5cdf2718cc024 Author: Arnaldo Carvalho de Melo Date: Mon Apr 24 12:19:08 2017 -0300 tools arch x86: Sync cpufeatures.h To catch changes made in: 90218ac77d05 ("x86/cpufeature: Detect CPUID faulting support") No changes needed in the tools using this file at this time. Cc: Kyle Huey Cc: Thomas Gleixner Link: http://lkml.kernel.org/n/tip-qiqsj5qg2ljbsbfre2zaf9v4@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/arch/x86/include/asm/cpufeatures.h | 1 + 1 file changed, 1 insertion(+) commit e883d09c9eb2ffddfd057c17e6a0cef446ec8c9b Author: Arnaldo Carvalho de Melo Date: Mon Apr 24 11:58:54 2017 -0300 tools arch: Sync arch/x86/lib/memcpy_64.S with the kernel Just a minor fix done in: Fixes: 26a37ab319a2 ("x86/mce: Fix copy/paste error in exception table entries") Cc: Tony Luck Link: http://lkml.kernel.org/n/tip-ni9jzdd5yxlail6pq8cuexw2@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/arch/x86/lib/memcpy_64.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 04ec75e0befbc60ff473ca1a593cad7501729526 Author: Arnaldo Carvalho de Melo Date: Tue Oct 25 17:02:11 2016 -0300 tools: Update asm-generic/mman-common.h copy from the kernel To get the changes in the commit Fixes: 3209f68b3ca4 ("statx: Include a mask for stx_attributes in struct statx") Silencing this perf build warning: Warning: tools/include/uapi/linux/stat.h differs from kernel No need to change the statx syscall beautifiers in 'perf trace' at this time. Cc: Adrian Hunter Cc: Al Viro Cc: David Ahern Cc: David Howells Cc: Jiri Olsa Cc: Namhyung Kim Cc: Wang Nan Link: http://lkml.kernel.org/n/tip-y8bgiyzuvura62lffvh1zbg9@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/include/uapi/linux/stat.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) commit e7ff8920e62f0188e77b1dc5dc5d9a7322c342d7 Author: Arnaldo Carvalho de Melo Date: Wed Apr 19 21:34:35 2017 -0300 perf tools: Use just forward declarations for struct thread where possible Removing various instances of unnecessary includes, reducing the maze of header dependencies. Link: http://lkml.kernel.org/n/tip-hwu6eyuok9pc57alookyzmsf@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/arch/arm/util/unwind-libdw.c | 1 + tools/perf/arch/x86/util/unwind-libdw.c | 1 + tools/perf/builtin-c2c.c | 1 + tools/perf/builtin-inject.c | 1 + tools/perf/builtin-mem.c | 1 + tools/perf/builtin-timechart.c | 1 + tools/perf/ui/browsers/hists.c | 1 + tools/perf/ui/stdio/hist.c | 1 + tools/perf/util/build-id.c | 1 + tools/perf/util/hist.c | 1 + tools/perf/util/session.c | 1 + tools/perf/util/session.h | 3 +-- tools/perf/util/sort.c | 1 + tools/perf/util/sort.h | 3 ++- tools/perf/util/unwind-libdw.h | 6 ++++-- 15 files changed, 19 insertions(+), 5 deletions(-) commit e8b3ae40151e94e30a82c2cf8efa5ab4f99c8abf Author: Arnaldo Carvalho de Melo Date: Wed Apr 19 21:33:07 2017 -0300 perf tools: Add the right header to obtain PERF_ALIGN() The util/event.h header needs PERF_ALIGN(), but wasn't including linux/kernel.h, where it is defined, instead it was getting it by luck by including map.h, which it doesn't need at all. Fix it by including the right header. Link: http://lkml.kernel.org/n/tip-nf3t9blzm5ncoxsczi8oy9mx@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/event.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 4208735d8de58f1cbc2e0009d87514ce06681e5a Author: Arnaldo Carvalho de Melo Date: Wed Apr 19 19:06:30 2017 -0300 perf tools: Remove poll.h and wait.h from util.h Not needed in this header, added to the places that need poll(), wait() and a few other prototypes. Link: http://lkml.kernel.org/n/tip-i39c7b6xmo1vwd9wxp6fmkl0@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/arch/x86/tests/intel-cqm.c | 1 + tools/perf/builtin-ftrace.c | 1 + tools/perf/builtin-kvm.c | 1 + tools/perf/builtin-record.c | 2 ++ tools/perf/builtin-stat.c | 1 + tools/perf/builtin-trace.c | 1 + tools/perf/tests/builtin-test.c | 1 + tools/perf/tests/event-times.c | 1 + tools/perf/util/debug.c | 1 + tools/perf/util/help-unknown-cmd.c | 1 + tools/perf/util/llvm-utils.c | 1 + tools/perf/util/util.h | 2 -- 12 files changed, 12 insertions(+), 2 deletions(-) commit 7a8ef4c4b5fd5c578da4dadbcb1c5da650426c74 Author: Arnaldo Carvalho de Melo Date: Wed Apr 19 20:57:47 2017 -0300 perf tools: Remove string.h, unistd.h and sys/stat.h from util.h Not needed in this header, added to the places that need FILE, putchar(), access() and a few other prototypes. Link: http://lkml.kernel.org/n/tip-xxtdsl6nsna82j7puwbdjqhs@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/lib/subcmd/help.h | 1 + tools/perf/arch/arm/util/cs-etm.c | 1 + tools/perf/arch/arm64/util/dwarf-regs.c | 1 + tools/perf/builtin-help.c | 4 ++++ tools/perf/builtin-mem.c | 3 +++ tools/perf/builtin-report.c | 3 +++ tools/perf/builtin-script.c | 3 +++ tools/perf/builtin-stat.c | 3 +++ tools/perf/builtin-version.c | 3 ++- tools/perf/perf.c | 3 +++ tools/perf/tests/attr.c | 3 +++ tools/perf/tests/bpf.c | 2 ++ tools/perf/tests/parse-events.c | 3 +++ tools/perf/util/build-id.c | 2 ++ tools/perf/util/color.h | 2 ++ tools/perf/util/config.c | 3 +++ tools/perf/util/dso.c | 3 +++ tools/perf/util/event.c | 3 +++ tools/perf/util/header.c | 3 +++ tools/perf/util/machine.c | 3 +++ tools/perf/util/pmu.c | 1 + tools/perf/util/probe-file.c | 3 +++ tools/perf/util/strlist.c | 1 + tools/perf/util/util.c | 1 + tools/perf/util/util.h | 3 --- 25 files changed, 57 insertions(+), 4 deletions(-) commit a3b70b3bb34296a63b43614f13991111eccbb44a Author: Arnaldo Carvalho de Melo Date: Wed Apr 19 20:46:41 2017 -0300 perf tools: Remove stale prototypes from builtin.h Some, like prune_packed_objects() are clearly git specific, others don't have implementations and some are used in just one place, make them static. Link: http://lkml.kernel.org/n/tip-faj3c5dnttf3hurv4pujut8n@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin.h | 4 ---- tools/perf/perf.c | 2 +- 2 files changed, 1 insertion(+), 5 deletions(-) commit 72f7c4d22ccf7c7e78aa80ea3285e77404b31913 Author: Arnaldo Carvalho de Melo Date: Wed Apr 19 19:06:30 2017 -0300 perf tools: Remove string.h from util.h Not needed in this header, added to the places that need strdup, strcmp and a few other prototypes. Link: http://lkml.kernel.org/n/tip-t24yy85xnlv55kyosrum2ubs@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/comm.c | 1 + tools/perf/util/namespaces.c | 1 + tools/perf/util/util.h | 1 - tools/perf/util/xyarray.c | 2 ++ 4 files changed, 4 insertions(+), 1 deletion(-) commit 86a5e0c2028899465a129d87f60fe4018c5ae839 Author: Arnaldo Carvalho de Melo Date: Wed Apr 19 19:03:14 2017 -0300 perf tools: Remove sys/ioctl.h from util.h Not needed in this header, added to the places that need 'struct winsize' and the ioctl defines. Link: http://lkml.kernel.org/n/tip-2pznlli3146y4242otlcm70m@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/evlist.c | 1 + tools/perf/util/evsel.c | 1 + tools/perf/util/parse-events.c | 1 + tools/perf/util/top.h | 2 +- tools/perf/util/util.h | 1 - 5 files changed, 4 insertions(+), 2 deletions(-) commit bf6733432dd8d92ffd687d6ce014a37923ba8105 Author: Arnaldo Carvalho de Melo Date: Wed Apr 19 18:58:26 2017 -0300 perf tools: Remove a few more needless includes from util.h Link: http://lkml.kernel.org/n/tip-sb2zu21d6h42e5qnsrtl6wuu@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/util.h | 4 ---- 1 file changed, 4 deletions(-) commit 391e42060098a743a87380ed02bf4c8126742b04 Author: Arnaldo Carvalho de Melo Date: Wed Apr 19 18:51:14 2017 -0300 perf tools: Include sys/param.h where needed As it is going away from util.h, where it is not needed. This is mostly for things like MAXPATHLEN, MAX() and MIN(), these later two probably should go away in favor of its kernel sources replacements. Link: http://lkml.kernel.org/n/tip-z1666f3fl3fqobxvjr5o2r39@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-c2c.c | 1 + tools/perf/builtin-script.c | 1 + tools/perf/tests/attr.c | 1 + tools/perf/tests/code-reading.c | 1 + tools/perf/util/config.c | 1 + tools/perf/util/header.c | 1 + tools/perf/util/hist.c | 1 + tools/perf/util/parse-events.c | 1 + tools/perf/util/util.h | 1 - 9 files changed, 8 insertions(+), 1 deletion(-) commit 56e2e05644a9494e8ba3165182dcdf43d40cc6a2 Author: Arnaldo Carvalho de Melo Date: Wed Apr 19 18:38:33 2017 -0300 perf callchain: Move callchain specific routines from util.[ch] Where they belong, no point in leaving those in the generic "util" files. Link: http://lkml.kernel.org/n/tip-ljx3iiip1hlfa7a7apjem7ph@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/callchain.c | 103 +++++++++++++++++++++++++++++++++++++++++++ tools/perf/util/python.c | 13 ++++++ tools/perf/util/util.c | 104 -------------------------------------------- tools/perf/util/util.h | 4 -- 4 files changed, 116 insertions(+), 108 deletions(-) commit 69226896ad636b94f6d2e55d75ff21a29c4de83b Author: Roger Quadros Date: Fri Apr 21 16:15:38 2017 +0300 mdio_bus: Issue GPIO RESET to PHYs. Some boards [1] leave the PHYs at an invalid state during system power-up or reset thus causing unreliability issues with the PHY which manifests as PHY not being detected or link not functional. To fix this, these PHYs need to be RESET via a GPIO connected to the PHY's RESET pin. Some boards have a single GPIO controlling the PHY RESET pin of all PHYs on the bus whereas some others have separate GPIOs controlling individual PHY RESETs. In both cases, the RESET de-assertion cannot be done in the PHY driver as the PHY will not probe till its reset is de-asserted. So do the RESET de-assertion in the MDIO bus driver. [1] - am572x-idk, am571x-idk, a437x-idk Signed-off-by: Roger Quadros Signed-off-by: David S. Miller Documentation/devicetree/bindings/net/mdio.txt | 33 ++++++++++++++++++ drivers/net/phy/mdio_bus.c | 47 ++++++++++++++++++++++++++ drivers/of/of_mdio.c | 7 ++++ include/linux/phy.h | 7 ++++ 4 files changed, 94 insertions(+) commit 15769ff8b6d560a358761598aad5fc413ce2251b Merge: ac2291c 82dfb54 Author: David S. Miller Date: Mon Apr 24 12:35:57 2017 -0400 Merge branch 'VSOCK-add-vsockmon' Stefan Hajnoczi says: ==================== VSOCK: vsockmon virtual device to monitor AF_VSOCK sockets. v5: * Change vsock_deliver_tap() API to avoid unnecessary skb creation [Jorgen] * Fix skb leak when no taps are registered [Jorgen] * s/cpu_to_le16(pkt->hdr.op)/le16_to_cpu(pkt->hdr.op)/ [Michael] * Add af_vsock_tap.c and vsockmon.[ch] to MAINTAINERS * checkpatch.pl and sparse fixes v4: * Add explicit reserved padding field to struct af_vsockmon_hdr and drop __attribute__((packed)) [Michael, DaveM] * Call synchronize_net() before module_put() [Michael] v3: * Hook virtio_transport.c (guest driver), not just drivers/vhost/vsock.c (host driver) * Fix DEFAULT_MTU macro definition [Zhu Yanjun] * Rename af_vsockmon_hdr->t field ->transport for clarity * Update .ndo_get_stats64() return type since it has changed * Include missing header in af_vsock_tap.c This is a continuation of Gerard Garcia's work on the vsockmon packet capture interface for AF_VSOCK. Packet capture is an essential feature for network communication. Gerard began addressing this feature gap in his Google Summer of Code 2016 project. I have cleaned up, rebased, and retested the v2 series he posted previously. The design follows the nlmon packet capture interface closely. This is because vsock has the same problem as netlink: there is no netdev on which packets can be captured. The nlmon driver is a synthetic netdev purely for the purpose of enabling packet capture. We follow the same approach here with vsockmon. See include/uapi/linux/vsockmon.h in this series for details on the packet layout. How to try it: 1. Build tcpdump with vsockmon patches: $ git clone -b vsock https://github.com/stefanha/libpcap $ (cd libcap && ./configure && make) $ git clone -b vsock https://github.com/stefanha/tcpdump $ (cd tcpdump && ./configure && make) 2. Build nc-vsock (a netcat-like tool): $ git clone https://github.com/stefanha/nc-vsock $ (cd nc-vsock && make) 3. Launch a virtual machine: # modprobe vhost_vsock # qemu-system-x86_64 -M accel=kvm -m 1024 -cpu host \ -drive if=virtio,file=test.img,format=raw \ -device vhost-vsock-pci,guest-cid=3 (Assumes guest is running a kernel with this patch) 4. Capture AF_VSOCK traffic in guest and/or host: # modprobe vsockmon # ip link add type vsockmon # ip link set vsockmon0 up # tcpdump -i vsockmon0 -vvv 5. Communicate! (host)$ nc-vsock -l 1234 (guest)$ nc-vsock 2 1234 ==================== Signed-off-by: David S. Miller commit 82dfb540aeb277d945bf646ff780493b8a520d8a Author: Gerard Garcia Date: Fri Apr 21 10:10:46 2017 +0100 VSOCK: Add virtio vsock vsockmon hooks The virtio drivers deal with struct virtio_vsock_pkt. Add virtio_transport_deliver_tap_pkt(pkt) for handing packets to the vsockmon device. We call virtio_transport_deliver_tap_pkt(pkt) from net/vmw_vsock/virtio_transport.c and drivers/vhost/vsock.c instead of common code. This is because the drivers may drop packets before handing them to common code - we still want to capture them. Signed-off-by: Gerard Garcia Signed-off-by: Stefan Hajnoczi Reviewed-by: Jorgen Hansen Signed-off-by: David S. Miller drivers/vhost/vsock.c | 8 +++++ include/linux/virtio_vsock.h | 1 + net/vmw_vsock/virtio_transport.c | 3 ++ net/vmw_vsock/virtio_transport_common.c | 64 +++++++++++++++++++++++++++++++++ 4 files changed, 76 insertions(+) commit 0b2e66448ba20eb30ea62345d6beb9ee2a1ce06b Author: Gerard Garcia Date: Fri Apr 21 10:10:45 2017 +0100 VSOCK: Add vsockmon device Add vsockmon virtual network device that receives packets from the vsock transports and exposes them to user space. Based on the nlmon device. Signed-off-by: Gerard Garcia Signed-off-by: Stefan Hajnoczi Signed-off-by: David S. Miller MAINTAINERS | 2 + drivers/net/Kconfig | 8 ++ drivers/net/Makefile | 1 + drivers/net/vsockmon.c | 170 ++++++++++++++++++++++++++++++++++++++++++ include/uapi/linux/Kbuild | 1 + include/uapi/linux/vsockmon.h | 60 +++++++++++++++ 6 files changed, 242 insertions(+) commit 531b374834c891ae2abf800693074df35a7d1a36 Author: Gerard Garcia Date: Fri Apr 21 10:10:44 2017 +0100 VSOCK: Add vsockmon tap functions Add tap functions that can be used by the vsock transports to deliver packets to vsockmon virtual network devices. Signed-off-by: Gerard Garcia Signed-off-by: Stefan Hajnoczi Reviewed-by: Jorgen Hansen Signed-off-by: David S. Miller MAINTAINERS | 1 + include/net/af_vsock.h | 13 +++++ include/uapi/linux/if_arp.h | 1 + net/vmw_vsock/Makefile | 2 +- net/vmw_vsock/af_vsock_tap.c | 114 +++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 130 insertions(+), 1 deletion(-) commit 02101cb3f5a269c006c5b93f3c603dc31e473859 Author: Thierry Reding Date: Mon Apr 24 13:56:49 2017 +0200 pinctrl: tegra: xusb: Silence sparse warnings Commit 53d2a715c240 ("phy: Add Tegra XUSB pad controller support") added a new driver for the XUSB pad controller that implements a more flexible devicetree binding. In order to preserve backwards compatibility the old driver can be probed if the obsolete bindings are detected. In order to hide the legacy code, these prototypes were defined in a header private to the new driver. This has the disadvantage of making the sparse code checker complain about the missing declarations when compiling the old driver and suggesting to make the functions static. Avoid these sparse warnings by adding local prototype declarations into the compatibility driver. Signed-off-by: Thierry Reding Signed-off-by: Linus Walleij drivers/pinctrl/tegra/pinctrl-tegra-xusb.c | 4 ++++ 1 file changed, 4 insertions(+) commit e41f3207be87a0f6aa4f3fe8246414e2e89fe464 Merge: 5e55352 5f4c8ca Author: Linus Walleij Date: Mon Apr 24 18:34:49 2017 +0200 Merge tag 'sh-pfc-for-v4.12-tag3' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into devel pinctrl: sh-pfc: Updates for v4.12 (take three) - Miscellaneous fixes for R-Car M2-W and R-Car E2. commit 5e5535213f69c84a8d5b3df75964539c3549c6b5 Author: Colin Ian King Date: Fri Apr 21 13:07:13 2017 +0100 ARM: at91/at91-pinctrl documentation: fix spelling mistake: "contoller" -> "controller" trivial fix to spelling mistake in documentation Signed-off-by: Colin Ian King Acked-by: Nicolas Ferre Signed-off-by: Linus Walleij Documentation/devicetree/bindings/pinctrl/atmel,at91-pinctrl.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit fa2f60ffa0e0a33406ef9538635a57ac499965ae Author: Anders Darander Date: Fri Apr 21 14:46:31 2017 +0200 gpio: DT bindings, move tca9554 from pcf857x to pca953x The TCA9554 is similar to the PCA9554. Update the DT binding docs. Signed-off-by: Anders Darander Signed-off-by: Linus Walleij Documentation/devicetree/bindings/gpio/gpio-pca953x.txt | 1 + Documentation/devicetree/bindings/gpio/gpio-pcf857x.txt | 1 - 2 files changed, 1 insertion(+), 1 deletion(-) commit 1b9a0c25065c174134494d1ca91f4da8430e6902 Author: Anders Darander Date: Fri Apr 21 14:46:30 2017 +0200 gpio: move tca9554 from pcf857x to pca953x The TCA9554 doesn't work with the pcf857x driver, trying to change the direction gives a NAK bailout error. TCA9554 is similar to the PCA9554, thus change the driver. Signed-off-by: Anders Darander Signed-off-by: Linus Walleij drivers/gpio/Kconfig | 2 +- drivers/gpio/gpio-pca953x.c | 1 + drivers/gpio/gpio-pcf857x.c | 2 -- 3 files changed, 2 insertions(+), 3 deletions(-) commit ac2291ce1f17a99c052378927f2d3bcd6b0045a6 Merge: 970cf1d a059783 Author: David S. Miller Date: Mon Apr 24 12:25:01 2017 -0400 Merge tag 'wireless-drivers-next-for-davem-2017-04-21' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next Kalle Valo says: ==================== wireless-drivers-next patches for 4.12 Quite a lot of patches for rtlwifi and iwlwifi this time, but changes also for other active wireless drivers. Major changes: ath9k * add support for Dell Wireless 1601 PCI device * add debugfs file to manually override noise floor ath10k * bump up FW API to 6 for a new QCA6174 firmware branch wil6210 * support 8 kB RX buffers iwlwifi * work to support A000 devices continues * add support for FW API 30 * add Geographical and Dynamic Specific Absorption Rate (SAR) support * support a few new PCI device IDs rtlwifi * work on adding Bluetooth coexistance support, not finished yet ==================== Signed-off-by: David S. Miller commit 970cf1d2a6c89e9fe8d94b118a76d071de7e543a Merge: 9b53816 49632b58 Author: David S. Miller Date: Mon Apr 24 12:20:05 2017 -0400 Merge branch 'qed-dcb-enhancements' Sudarsana Reddy Kalluru says: ==================== qed*: Dcbx/dcbnl enhancements. The series has set of enhancements for dcbx/dcbnl implementation of qed/qede drivers. - Patches (1) & (3) capture the sematic and debug changes. - Patch (2) adds the driver support for populating RoCEv2 dcb data. - Patch (4) adds the required support for reading/configuring the IEEE selection field (SF). - Patch (5) adds the support for configuring the static dcbx mode. Please consider applying this to 'net-next' branch. ==================== Signed-off-by: David S. Miller commit 49632b5822ea2af0e9531f8d20dcd5fb786093a9 Author: sudarsana.kalluru@cavium.com Date: Thu Apr 20 22:31:20 2017 -0700 qed: Add support for static dcbx. The patch adds driver support for static/local dcbx mode. In this mode adapter brings up the dcbx link with locally configured parameters instead of performing the dcbx negotiation with the peer. The feature is useful when peer device/switch doesn't support dcbx. Signed-off-by: Sudarsana Reddy Kalluru Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_dcbx.c | 24 +++++++++++++++++++----- include/linux/qed/qed_if.h | 1 + 2 files changed, 20 insertions(+), 5 deletions(-) commit 05a79f925d7494a7a9a72d25943a3541b1c54066 Author: sudarsana.kalluru@cavium.com Date: Thu Apr 20 22:31:19 2017 -0700 qed: Support dcbnl IEEE selector field. Signed-off-by: Sudarsana Reddy Kalluru Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_dcbx.c | 53 ++++++++++++++++++++++----- drivers/net/ethernet/qlogic/qede/qede_dcbnl.c | 5 +++ 2 files changed, 49 insertions(+), 9 deletions(-) commit dfbeb85f2fe6093ac7deb5dd40f4fd6c75b9fc78 Author: sudarsana.kalluru@cavium.com Date: Thu Apr 20 22:31:18 2017 -0700 qed: Add additional DCBx debug messages. Signed-off-by: Sudarsana Reddy Kalluru Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_dcbx.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) commit 449ad505e9d2f420b7bf590a708c101ff587593e Author: sudarsana.kalluru@cavium.com Date: Thu Apr 20 22:31:17 2017 -0700 qed: Separate RoCE DCBx support for V2. In the older firmware there was no distinction between RoCE and RoCEv2 whereas the newer firmware (8.15.3.0) allows us to configure each independently. Driver need to populate the RoCEv2 data in its specific structure. Signed-off-by: Sudarsana Reddy Kalluru Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_dcbx.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) commit 270837b399f7ab7602f473fa514fe1138b308ec0 Author: sudarsana.kalluru@cavium.com Date: Thu Apr 20 22:31:16 2017 -0700 qed: Cleanup DCBx unnecessary parameters. Signed-off-by: Sudarsana Reddy Kalluru Signed-off-by: Yuval Mintz Signed-off-by: David S. Miller drivers/net/ethernet/qlogic/qed/qed_dcbx.c | 38 ++++++++++++------------------ drivers/net/ethernet/qlogic/qed/qed_dcbx.h | 2 +- drivers/net/ethernet/qlogic/qed/qed_dev.c | 2 +- 3 files changed, 17 insertions(+), 25 deletions(-) commit 9119fedddb5b630eec3f3e39c4e382d9f60cca07 Author: Mikulas Patocka Date: Wed Apr 19 10:52:54 2017 -0400 dm: remove dummy dm_table definition This dummy structure definition was required for RCU macros, but it isn't required anymore, so delete it. The dummy definition confuses the crash tool, see: https://www.redhat.com/archives/dm-devel/2017-April/msg00197.html Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer drivers/md/dm-ioctl.c | 8 -------- 1 file changed, 8 deletions(-) commit 583fe7474c05ee5523e14ef791ea59604cd846dc Author: Mikulas Patocka Date: Tue Apr 18 16:51:54 2017 -0400 dm crypt: fix large block integrity support Previously, dm-crypt could use blocks composed of multiple 512b sectors but it created integrity profile for each 512b sector (it padded it with zeroes). Fix dm-crypt so that the integrity profile is sent for each block not each sector. The user must use the same block size in the DM crypt and integrity targets. Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer drivers/md/dm-crypt.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) commit 9d609f85b7eb96697ae22ad1d47a3a3920174ba8 Author: Mikulas Patocka Date: Tue Apr 18 16:51:52 2017 -0400 dm integrity: support larger block sizes The DM integrity block size can now be 512, 1k, 2k or 4k. Using larger blocks reduces metadata handling overhead. The block size can be configured at table load time using the "block_size:" option; where is expressed in bytes (defult is still 512 bytes). It is safe to use larger block sizes with DM integrity, because the DM integrity journal makes sure that the whole block is updated atomically even if the underlying device doesn't support atomic writes of that size (e.g. 4k block ontop of a 512b device). Depends-on: 2859323e ("block: fix blk_integrity_register to use template's interval_exp if not 0") Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer Documentation/device-mapper/dm-integrity.txt | 5 + drivers/md/dm-integrity.c | 219 +++++++++++++++++++++------ 2 files changed, 179 insertions(+), 45 deletions(-) commit 56b67a4f292f14548f4046979d46d07bcf8ba971 Author: Mikulas Patocka Date: Tue Apr 18 16:51:50 2017 -0400 dm integrity: various small changes and cleanups Some coding style changes. Fix a bug that the array test_tag has insufficient size if the digest size of internal has is bigger than the tag size. The function __fls is undefined for zero argument, this patch fixes undefined behavior if the user sets zero interleave_sectors. Fix the limit of optional arguments to 8. Don't allocate crypt_data on the stack to avoid a BUG with debug kernel. Rename all optional argument names to have underscores rather than dashes. Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer Documentation/device-mapper/dm-integrity.txt | 20 ++--- drivers/md/dm-integrity.c | 116 ++++++++++++++------------- 2 files changed, 72 insertions(+), 64 deletions(-) commit e2460f2a4bc740fae9e23f14d653cf53e90b3f9a Author: Mikulas Patocka Date: Tue Apr 18 16:51:48 2017 -0400 dm: mark targets that pass integrity data A dm-crypt on dm-integrity device incorrectly advertises an integrity profile on the DM crypt device. It can be seen in the files "/sys/block/dm-*/integrity/*" that both dm-integrity and dm-crypt target advertise the integrity profile. That is incorrect, only the dm-integrity target should advertise the integrity profile. A general problem in DM is that if we have a DM device that depends on another device with an integrity profile, the upper device will always advertise the integrity profile, even when the target driver doesn't support handling integrity data. Most targets don't support integrity data, so we provide a whitelist of targets that support it (linear, delay and striped). The targets that support passing integrity data to the lower device are marked with the flag DM_TARGET_PASSES_INTEGRITY. The DM core will now advertise integrity data on a DM device only if all the targets support the integrity data. Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer drivers/md/dm-delay.c | 1 + drivers/md/dm-linear.c | 1 + drivers/md/dm-stripe.c | 1 + drivers/md/dm-table.c | 7 +++++++ drivers/md/dm.c | 16 +++++++++++++--- include/linux/device-mapper.h | 6 ++++++ 6 files changed, 29 insertions(+), 3 deletions(-) commit 3c12016910061c2a19d985fba7f7dec19d6a3a09 Author: Mikulas Patocka Date: Tue Apr 18 16:51:46 2017 -0400 dm table: replace while loops with for loops Also remove some unnecessary use of uninitialized_var(). Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer drivers/md/dm-table.c | 63 ++++++++++++++++++++++++++------------------------- 1 file changed, 32 insertions(+), 31 deletions(-) commit 9b5381637e2baecf14433452d349ca44db72e9e5 Merge: e2989ee 55c05dd Author: David S. Miller Date: Mon Apr 24 11:53:53 2017 -0400 Merge branch '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/next-queue Jeff Kirsher says: ==================== 1GbE Intel Wired LAN Driver Updates 2017-04-20 This series contains updates to e1000, e1000e, igb/vf and ixgb. Tobias Klauser cleans up e1000, ixgb and igbvf from having a local function or structure for netdev stats. Bernd Faust fixes an issue for 82579 devices, where the clock frequency was being incorrectly set for these devices. These devices only support 96MHz, so make sure they are set to use only that. Yury Kylulin extends the work Jake and Alex did for ixgbe in MAC filter handling into the igb driver. Kim Tatt Chuah enables igb to wake up by packet and to read the necessary Wake Up Status (WUS) and Wake Up Packet Memory (WUPM) registers. ==================== Signed-off-by: David S. Miller commit d160a727c40e7175aa642137910a3fda46262fc8 Author: Paul E. McKenney Date: Sun Apr 23 12:50:59 2017 -0700 srcu: Make SRCU be built by default SRCU is optional, and included only if there is a "select SRCU" in effect. However, we now have Tiny SRCU, so this commit defaults CONFIG_SRCU=y. Reported-by: kbuild test robot Signed-off-by: Paul E. McKenney init/Kconfig | 1 + 1 file changed, 1 insertion(+) commit 611f0afee0e87eb6d184e7f58aa20d18d291d169 Author: Arnaldo Carvalho de Melo Date: Wed Apr 19 16:29:38 2017 -0300 perf tools: Add compress.h for the *_decompress_to_file() headers Out of util.h, the implementations were already in separate files, that are built conditionally. Link: http://lkml.kernel.org/n/tip-0ur7szxsb59f8758kfe63prb@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/compress.h | 12 ++++++++++++ tools/perf/util/dso.c | 1 + tools/perf/util/lzma.c | 1 + tools/perf/util/util.h | 8 -------- tools/perf/util/zlib.c | 1 + 5 files changed, 15 insertions(+), 8 deletions(-) commit 166ebdd2442660e7f942d657fc5e629000e58ec3 Author: Andi Kleen Date: Wed Apr 19 10:49:40 2017 -0700 perf mem: Fix display of data source snoop indication 'perf mem report' doesn't display the data source snoop indication correctly. In the kernel API the definition is: #define PERF_MEM_SNOOP_NONE 0x02 /* no snoop */ #define PERF_MEM_SNOOP_HIT 0x04 /* snoop hit */ #define PERF_MEM_SNOOP_MISS 0x08 /* snoop miss */ but the table used by the perf tools exchanged "Hit" and "Miss": "None", "Miss", "Hit", Fix the table in perf. Signed-off-by: Andi Kleen Cc: Jiri Olsa Cc: Stephane Eranian Link: http://lkml.kernel.org/r/20170419174940.13641-1-andi@firstfloor.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/mem-events.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 8c2b7cac78e17886e8089389a570a290c9b5ca67 Author: Arnaldo Carvalho de Melo Date: Wed Apr 19 16:21:59 2017 -0300 perf debug: Move dump_stack() and sighandler_dump_stack() to debug.h Two more out of util.h. Link: http://lkml.kernel.org/n/tip-polkuxm1cpr06lbgue5pyqum@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/util/debug.c | 32 +++++++++++++++++++++++++++++++- tools/perf/util/debug.h | 3 +++ tools/perf/util/util.c | 31 ------------------------------- tools/perf/util/util.h | 3 --- 4 files changed, 34 insertions(+), 35 deletions(-) commit bb8c16db43e48f2012c3ae8c7d682f834c5986d9 Author: Arnaldo Carvalho de Melo Date: Wed Apr 19 16:15:13 2017 -0300 perf kvm: Make function only used by 'perf kvm' static No need to have this polluting util.h, it was polluted enough already. Link: http://lkml.kernel.org/n/tip-wfdidqlwbvi5y0s61kv6z2gn@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo tools/perf/builtin-kvm.c | 14 ++++++++++++++ tools/perf/util/util.c | 14 -------------- tools/perf/util/util.h | 1 - 3 files changed, 14 insertions(+), 15 deletions(-) commit 61a929870d1ce9c7ac34644bfd5aa9a8bf67818c Author: Jan Kara Date: Mon Apr 24 16:49:16 2017 +0200 ext4: Improve comments in ext4_quota_{on|off}() Improve comments in ext4_quota_{on|off}() to explain that returning success despite ext4_journal_start() failing is deliberate. Signed-off-by: Jan Kara fs/ext4/super.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) commit f4edce1afd537327012189c1481ad66260b195ff Author: Dan Carpenter Date: Fri Apr 21 13:52:20 2017 +0300 fsnotify: remove a stray unlock We recently shifted this code around, so we're no longer holding the lock on this path. Fixes: 755b5bc681eb ("fsnotify: Remove indirection from mark list addition") Signed-off-by: Dan Carpenter Signed-off-by: Jan Kara fs/notify/mark.c | 1 - 1 file changed, 1 deletion(-) commit 4726a2c37199f1a982e9a943a23c73530d891e66 Author: Paul Gortmaker Date: Wed Apr 19 15:59:05 2017 -0400 pinctrl: make artpec6 explicitly non-modular The Kconfig currently controlling compilation of this code is: drivers/pinctrl/Kconfig:config PINCTRL_ARTPEC6 drivers/pinctrl/Kconfig: bool "Axis ARTPEC-6 pin controller driver" ...meaning that it currently is not being built as a module by anyone. Lets remove the modular code that is essentially orphaned, so that when reading the driver there is no doubt it is builtin-only. Also note that MODULE_DEVICE_TABLE is a no-op for non-modular code. We also delete the MODULE_LICENSE tag etc. since all that information is already contained at the top of the file in the comments. Cc: Lars Persson Cc: Niklas Cassel Cc: linux-arm-kernel@axis.com Cc: linux-gpio@vger.kernel.org Signed-off-by: Paul Gortmaker Acked-by: Jesper Nilsson Signed-off-by: Linus Walleij drivers/pinctrl/pinctrl-artpec6.c | 12 ------------ 1 file changed, 12 deletions(-) commit 5c26eac43a0b708083ebd99e0ba57c9b268cef84 Author: Fabian Frederick Date: Sun Apr 23 20:58:34 2017 +0200 udf: use kmap_atomic for memcpy copying Use temporary mapping for memory copying operations. To avoid any sleeping problem, mark_inode_dirty(inode) was moved after kunmap() in udf_adinicb_readpage() down_write(&iinfo->i_data_sem) set before kmap_atomic() in udf_expand_file_adinicb() Signed-off-by: Fabian Frederick Signed-off-by: Jan Kara fs/udf/file.c | 10 +++++----- fs/udf/inode.c | 8 ++++---- 2 files changed, 9 insertions(+), 9 deletions(-) commit 6ff6b2b32924d53519948e270cb9f5549408c039 Author: Fabian Frederick Date: Sun Apr 23 20:58:15 2017 +0200 udf: use octal for permissions According to commit f90774e1fd27 ("checkpatch: look for symbolic permissions and suggest octal instead") Signed-off-by: Fabian Frederick Signed-off-by: Jan Kara fs/udf/inode.c | 14 +++++++------- fs/udf/namei.c | 2 +- 2 files changed, 8 insertions(+), 8 deletions(-) commit 9765ad134a00a01cbcc69c78ff6defbfad209bc5 Author: David Gibson Date: Wed Apr 19 16:38:26 2017 +1000 powerpc/mm: Ensure IRQs are off in switch_mm() powerpc expects IRQs to already be (soft) disabled when switch_mm() is called, as made clear in the commit message of 9c1e105238c4 ("powerpc: Allow perf_counters to access user memory at interrupt time"). Aside from any race conditions that might exist between switch_mm() and an IRQ, there is also an unconditional hard_irq_disable() in switch_slb(). If that isn't followed at some point by an IRQ enable then interrupts will remain disabled until we return to userspace. It is true that when switch_mm() is called from the scheduler IRQs are off, but not when it's called by use_mm(). Looking closer we see that last year in commit f98db6013c55 ("sched/core: Add switch_mm_irqs_off() and use it in the scheduler") this was made more explicit by the addition of switch_mm_irqs_off() which is now called by the scheduler, vs switch_mm() which is used by use_mm(). Arguably it is a bug in use_mm() to call switch_mm() in a different context than it expects, but fixing that will take time. This was discovered recently when vhost started throwing warnings such as: BUG: sleeping function called from invalid context at kernel/mutex.c:578 in_atomic(): 0, irqs_disabled(): 1, pid: 10768, name: vhost-10760 no locks held by vhost-10760/10768. irq event stamp: 10 hardirqs last enabled at (9): _raw_spin_unlock_irq+0x40/0x80 hardirqs last disabled at (10): switch_slb+0x2e4/0x490 softirqs last enabled at (0): copy_process+0x5e8/0x1260 softirqs last disabled at (0): (null) Call Trace: show_stack+0x88/0x390 (unreliable) dump_stack+0x30/0x44 __might_sleep+0x1c4/0x2d0 mutex_lock_nested+0x74/0x5c0 cgroup_attach_task_all+0x5c/0x180 vhost_attach_cgroups_work+0x58/0x80 [vhost] vhost_worker+0x24c/0x3d0 [vhost] kthread+0xec/0x100 ret_from_kernel_thread+0x5c/0xd4 Prior to commit 04b96e5528ca ("vhost: lockless enqueuing") (Aug 2016) the vhost_worker() would do a spin_unlock_irq() not long after calling use_mm(), which had the effect of reenabling IRQs. Since that commit removed the locking in vhost_worker() the body of the vhost_worker() loop now runs with interrupts off causing the warnings. This patch addresses the problem by making the powerpc code mirror the x86 code, ie. we disable interrupts in switch_mm(), and optimise the scheduler case by defining switch_mm_irqs_off(). Cc: stable@vger.kernel.org # v4.7+ Signed-off-by: David Gibson [mpe: Flesh out/rewrite change log, add stable] Signed-off-by: Michael Ellerman arch/powerpc/include/asm/mmu_context.h | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) commit e76ca27790a514590af782f83f6eae49e0ccf8c9 Author: Tyrel Datwyler Date: Mon Apr 17 20:24:39 2017 -0400 powerpc/sysfs: Fix reference leak of cpu device_nodes present at boot For CPUs present at boot each logical CPU acquires a reference to the associated device node of the core. This happens in register_cpu() which is called by topology_init(). The result of this is that we end up with a reference held by each thread of the core. However, these references are never freed if the CPU core is DLPAR removed. This patch fixes the reference leaks by acquiring and releasing the references in the CPU hotplug callbacks un/register_cpu_online(). With this patch symmetric reference counting is observed with both CPUs present at boot, and those DLPAR added after boot. Fixes: f86e4718f24b ("driver/core: cpu: initialize of_node in cpu's device struture") Cc: stable@vger.kernel.org # v3.12+ Signed-off-by: Tyrel Datwyler Signed-off-by: Michael Ellerman arch/powerpc/kernel/sysfs.c | 6 ++++++ 1 file changed, 6 insertions(+) commit 68baf692c435339e6295cb470ea5545cbc28160e Author: Tyrel Datwyler Date: Mon Apr 17 20:21:40 2017 -0400 powerpc/pseries: Fix of_node_put() underflow during DLPAR remove Historically struct device_node references were tracked using a kref embedded as a struct field. Commit 75b57ecf9d1d ("of: Make device nodes kobjects so they show up in sysfs") (Mar 2014) refactored device_nodes to be kobjects such that the device tree could by more simply exposed to userspace using sysfs. Commit 0829f6d1f69e ("of: device_node kobject lifecycle fixes") (Mar 2014) followed up these changes to better control the kobject lifecycle and in particular the referecne counting via of_node_get(), of_node_put(), and of_node_init(). A result of this second commit was that it introduced an of_node_put() call when a dynamic node is detached, in of_node_remove(), that removes the initial kobj reference created by of_node_init(). Traditionally as the original dynamic device node user the pseries code had assumed responsibilty for releasing this final reference in its platform specific DLPAR detach code. This patch fixes a refcount underflow introduced by commit 0829f6d1f6, and recently exposed by the upstreaming of the recount API. Messages like the following are no longer seen in the kernel log with this patch following DLPAR remove operations of cpus and pci devices. rpadlpar_io: slot PHB 72 removed refcount_t: underflow; use-after-free. ------------[ cut here ]------------ WARNING: CPU: 5 PID: 3335 at lib/refcount.c:128 refcount_sub_and_test+0xf4/0x110 Fixes: 0829f6d1f69e ("of: device_node kobject lifecycle fixes") Cc: stable@vger.kernel.org # v3.15+ Signed-off-by: Tyrel Datwyler [mpe: Make change log commit references more verbose] Signed-off-by: Michael Ellerman arch/powerpc/platforms/pseries/dlpar.c | 1 - 1 file changed, 1 deletion(-) commit 856736466806ceb72c7402eb0f06bea8f5b83c5a Author: Michael Ellerman Date: Mon Apr 24 10:35:14 2017 +1000 powerpc/xmon: Deindent the SLB dumping logic Currently the code that dumps SLB entries uses a double-nested if. This means the actual dumping logic is a bit squashed. Deindent it by using continue. Signed-off-by: Michael Ellerman Reviewed-by: Rashmica Gupta Signed-off-by: Michael Ellerman arch/powerpc/xmon/xmon.c | 39 ++++++++++++++++++++++----------------- 1 file changed, 22 insertions(+), 17 deletions(-) commit 9fc849144c80091252551a4897782ed5321d654a Merge: 9a914aa 24bd909 Author: Michael Ellerman Date: Tue Apr 25 00:24:04 2017 +1000 Merge branch 'topic/kprobes' into next Although most of these kprobes patches are powerpc specific, there's a couple that touch generic code (with Acks). At the moment there's one conflict with acme's tree, but it's not too bad. Still just in case some other conflicts show up, we've put these in a topic branch so another tree could merge some or all of it if necessary. commit 64c6a71126fdeb2d60e193b93e24ea5ffa9c40ba Author: Charles Keepax Date: Wed Apr 19 10:30:44 2017 +0100 gpio: arizona: Correct check whether the pin is an input The logic to check if the pin is an input or output whilst testing if we need to read the register value from the hardware or not is currently inverted. Remove the erroneous not from the if statement. Fixes: 11598d174050 ("gpio: arizona: Correct handling for reading input GPIOs") Signed-off-by: Charles Keepax Signed-off-by: Linus Walleij drivers/gpio/gpio-arizona.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 42fcb203e3a8682c41b6a22d2b3fd1457b407fb9 Author: Nandor Han Date: Thu Apr 13 13:27:50 2017 +0300 gpio: Add XRA1403 DTS binding documentation Add the XRA1403 DTS binding documentation. Signed-off-by: Nandor Han Acked-by: Rob Herring Signed-off-by: Linus Walleij .../devicetree/bindings/gpio/gpio-xra1403.txt | 46 ++++++++++++++++++++++ 1 file changed, 46 insertions(+) commit 39c382a3109400f5abb5adc2040510e75f93b4cb Author: Rahul Bedarkar Date: Sun Apr 23 19:40:51 2017 +0530 hwmon: (tmp103) Use SIMPLE_DEV_PM_OPS helper macro Replace ifdefs with SIMPLE_DEV_PM_OPS helper macro. Signed-off-by: Rahul Bedarkar Acked-by: Heiko Schocher Signed-off-by: Guenter Roeck drivers/hwmon/tmp103.c | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-) commit 7b7df5204d6fd6316495e6becfbc6277bf1371cc Author: Nandor Han Date: Thu Apr 13 13:27:48 2017 +0300 dt-bindings: add exar to vendor prefixes list Add Exar Corporation to vendors list. Signed-off-by: Nandor Han Acked-by: Rob Herring Signed-off-by: Linus Walleij Documentation/devicetree/bindings/vendor-prefixes.txt | 1 + 1 file changed, 1 insertion(+) commit 7c2d176fe3f8dce632b948f79c7e89916ffe2c70 Author: Kuppuswamy Sathyanarayanan Date: Fri Apr 14 10:29:25 2017 -0700 gpio: gpio-wcove: fix irq pending status bit width Whiskey cove PMIC has three GPIO banks with total number of 13 GPIO pins. But when checking for the pending status, for_each_set_bit() uses bit width of 7 and hence it only checks the status for first 7 GPIO pins missing to check/clear the status of rest of the GPIO pins. This patch fixes this issue. Signed-off-by: Kuppuswamy Sathyanarayanan Signed-off-by: Linus Walleij drivers/gpio/gpio-wcove.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit e57d05520f9c89cf7616fc8c65dafb1ceb7a4c63 Author: Geliang Tang Date: Sat Apr 22 09:18:05 2017 +0800 dma-debug: use offset_in_page() macro Use offset_in_page() macro instead of open-coding. Signed-off-by: Geliang Tang Signed-off-by: Vinod Koul lib/dma-debug.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit b70e52cacb3bff1cc6fae36a89e0fa9d33fe31a7 Author: Geliang Tang Date: Sat Apr 22 09:18:04 2017 +0800 dmaengine: mv_xor: use offset_in_page() macro Use offset_in_page() macro instead of open-coding. Signed-off-by: Geliang Tang Signed-off-by: Vinod Koul drivers/dma/mv_xor.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit f62e5f613e124911b955e4a804a5fceb37c82993 Author: Geliang Tang Date: Sat Apr 22 09:18:03 2017 +0800 dmaengine: dmatest: use offset_in_page() macro Use offset_in_page() macro instead of open-coding. Signed-off-by: Geliang Tang Signed-off-by: Vinod Koul drivers/dma/dmatest.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) commit 5664aa1c9ef59895eee1af15e36140d09d20714d Author: Jisheng Zhang Date: Thu Apr 13 17:46:39 2017 +0800 gpio: dwapb: use dwapb_read instead of readl_relaxed Commit 67809b974a07 ("GPIO: gpio-dwapb: Change readl&writel to dwapb_read&dwapb_write") missed this readl_relaxed() usage, I'm not sure the reason, maybe for performance reason? But if we do care the performance, we could use the relaxed io in dwapb_read and dwapb_write. Signed-off-by: Jisheng Zhang Signed-off-by: Linus Walleij drivers/gpio/gpio-dwapb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit d0639d39fe977608a60e45fb51e25c17661a7ec0 Author: Andrew Jeffery Date: Fri Apr 7 22:27:13 2017 +0930 pinctrl: aspeed: g5: Add pinconf support Testing for pinctrl-aspeed-g5 was performed on an AST2500EVB system, using the strategy outlined in the commit message for the change to the Aspeed pinctrl core. Signed-off-by: Andrew Jeffery Signed-off-by: Linus Walleij drivers/pinctrl/aspeed/pinctrl-aspeed-g5.c | 153 ++++++++++++++++++++++++++++- 1 file changed, 152 insertions(+), 1 deletion(-) commit 47b50b3743cd6a9c2a90372181cfc9ee5b10186d Author: Andrew Jeffery Date: Fri Apr 7 22:27:12 2017 +0930 pinctrl: aspeed: g4: Add pinconf support Testing for pinctrl-aspeed-g4 was performed on an OpenPOWER Palmetto system, using the strategy outlined in the commit message for the change to the Aspeed pinctrl core. Signed-off-by: Andrew Jeffery Signed-off-by: Linus Walleij drivers/pinctrl/aspeed/pinctrl-aspeed-g4.c | 117 ++++++++++++++++++++++++++++- 1 file changed, 116 insertions(+), 1 deletion(-) commit 7f354fd13877aae8abcd7b5a389cc85e3d2e4ed1 Author: Andrew Jeffery Date: Fri Apr 7 22:27:11 2017 +0930 pinctrl: aspeed: Add core pinconf support Several pinconf parameters have a fairly straight-forward mapping onto the Aspeed pin controller. These include management of pull-down bias, drive-strength, and some debounce configuration. Pin biasing largely is managed on a per-GPIO-bank basis, aside from the ADC and RMII/RGMII pins. As the bias configuration for each pin in a bank maps onto a single per-bank bit, configuration tables will be introduced to describe the ranges of pins and the supported pinconf parameter. The use of tables also helps with the sparse support of pinconf properties, and the fact that not all GPIO banks support biasing or drive-strength configuration. Further, as the pin controller uses a consistent approach for bias and drive strength configuration at the register level, a second table is defined for looking up the the bit-state required to enable or query the provided configuration. Testing for pinctrl-aspeed-g4 was performed on an OpenPOWER Palmetto system, and pinctrl-aspeed-g5 on an AST2500EVB as well as under QEMU. The test method was to set the appropriate bits via devmem and verify the result through the controller's pinconf-pins debugfs file. This simultaneously validates the get() path and half of the set() path. The remainder of the set() path was validated by configuring a handful of pins via the devicetree with the supported pinconf properties and verifying the appropriate registers were touched. Signed-off-by: Andrew Jeffery Signed-off-by: Linus Walleij drivers/pinctrl/aspeed/pinctrl-aspeed.c | 211 ++++++++++++++++++++++++++++++++ drivers/pinctrl/aspeed/pinctrl-aspeed.h | 28 +++++ 2 files changed, 239 insertions(+) commit c3bafe017c3bd3f68c21637ce4b78963edf56ec5 Author: Andrew Jeffery Date: Fri Apr 7 22:29:02 2017 +0930 gpio: aspeed: Add open-source and open-drain support As per the datasheet, manage the IO and value states to implement open-source/open-drain, but do this by falling back to gpiolib's emulation. This commit simply makes the behaviour explicit for clarity, rather than relying on the implicit return of -ENOTSUPP to trigger the emulation. Signed-off-by: Andrew Jeffery Signed-off-by: Linus Walleij drivers/gpio/gpio-aspeed.c | 4 ++++ 1 file changed, 4 insertions(+) commit 5ae4cb94b3133d00857bb2909dae779782db40cb Author: Andrew Jeffery Date: Fri Apr 7 22:29:01 2017 +0930 gpio: aspeed: Add debounce support Each GPIO in the Aspeed GPIO controller can choose one of four input debounce states: to disable debouncing for an input, or select from one of three programmable debounce timer values. Each GPIO in a four-bank-set is assigned one bit in each of two debounce configuration registers dedicated to the set, and selects a debounce state by configuring the two bits to select one of the four options. The limitation on debounce timer values is managed by mapping offsets onto a configured timer value and keeping count of the number of users a timer has. Timer values are configured on a first-come-first-served basis. A small twist in the hardware design is that the debounce configuration register numbering is reversed with respect to the binary representation of the debounce timer of interest (i.e. debounce register 1 represents bit 1, and debounce register 2 represents bit 0 of the timer numbering). Tested on an AST2500EVB with additional inspection under QEMU's romulus-bmc machine. Signed-off-by: Andrew Jeffery Signed-off-by: Linus Walleij drivers/gpio/gpio-aspeed.c | 281 ++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 276 insertions(+), 5 deletions(-) commit 9d7163f5167fa60e71071ab6dcb60da0f7230beb Author: Andrew Jeffery Date: Fri Apr 7 22:29:00 2017 +0930 gpio: aspeed: dt: Add optional clocks property We need a reference to the HPLL to calculate debounce cycles. If the clocks property is not supplied in the GPIO node then the consumer should deny any debounce requests. Signed-off-by: Andrew Jeffery Acked-by: Rob Herring Signed-off-by: Linus Walleij Documentation/devicetree/bindings/gpio/gpio-aspeed.txt | 1 + 1 file changed, 1 insertion(+) commit cea956551f1f0edb2d64a0320785705e400ae5f1 Author: Andrew Jeffery Date: Fri Apr 7 22:28:59 2017 +0930 gpio: aspeed: dt: Fix description alignment in bindings document Signed-off-by: Andrew Jeffery Acked-by: Rob Herring Signed-off-by: Linus Walleij Documentation/devicetree/bindings/gpio/gpio-aspeed.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 6de2185bc70781efd8ec26ff45329b57288d1880 Author: Andrew Jeffery Date: Fri Apr 7 22:27:10 2017 +0930 pinctrl: aspeed: Document pinconf in devicetree bindings Signed-off-by: Andrew Jeffery Acked-by: Rob Herring Acked-by: Joel Stanley Signed-off-by: Linus Walleij .../devicetree/bindings/pinctrl/pinctrl-aspeed.txt | 40 +++++++++++++++++----- 1 file changed, 31 insertions(+), 9 deletions(-) commit 94bfc9be6de327318a12e3174d3075db6c8079b4 Author: Alexandre TORGUE Date: Fri Apr 7 14:43:02 2017 +0200 pinctrl: Add st,stm32f469-pinctrl compatible to stm32-pinctrl Add new compatible for stm32f469 MCU. Signed-off-by: Alexandre TORGUE Acked-by: Rob Herring Signed-off-by: Linus Walleij Documentation/devicetree/bindings/pinctrl/st,stm32-pinctrl.txt | 1 + 1 file changed, 1 insertion(+) commit c2e7f82d336a451ebb904b8bf9a5a558cf16c39b Author: Mihail Atanassov Date: Mon Feb 13 15:09:01 2017 +0000 drm: mali-dp: Check the mclk rate and allow up/down scaling When downscaling, mclk needs to be sufficiently higher than pxlclk in order to be able to fetch the higher-resolution data and produce output pixels. When not scaling, or when upscaling, mclk can be equal to pxlclk. Since the driver doesn't control mclk, just ensure that the requirement is satisfied with the current clock rate. Signed-off-by: Mihail Atanassov Signed-off-by: Liviu Dudau drivers/gpu/drm/arm/malidp_crtc.c | 23 ++++++------- drivers/gpu/drm/arm/malidp_hw.c | 70 +++++++++++++++++++++++++++++++++++++++ drivers/gpu/drm/arm/malidp_hw.h | 4 +++ 3 files changed, 85 insertions(+), 12 deletions(-) commit 0274e6a0ba9a4994a449fcd3483ef530027e152f Author: Mihail Atanassov Date: Mon Feb 6 12:20:56 2017 +0000 drm: mali-dp: Enable image enhancement when scaling Apply image enhacement when we are upscaling by a factor of 2 or more in either direction. Signed-off-by: Mihail Atanassov Signed-off-by: Liviu Dudau drivers/gpu/drm/arm/malidp_crtc.c | 7 ++++++- drivers/gpu/drm/arm/malidp_drv.c | 3 +++ drivers/gpu/drm/arm/malidp_hw.h | 20 ++++++++++++++++++++ drivers/gpu/drm/arm/malidp_regs.h | 13 +++++++++++++ 4 files changed, 42 insertions(+), 1 deletion(-) commit 28ce675b74742cae1c815970347267b45dc73a8a Author: Mihail Atanassov Date: Mon Feb 13 15:14:05 2017 +0000 drm: mali-dp: Add plane upscaling support Enable the scaling engine for upscaling a single plane using the polyphase scaler. No image enhancement support or downscaling yet*, and composition result scaling is not implemented. * Downscaling a plane requires mclk > pxlclk. Signed-off-by: Mihail Atanassov Signed-off-by: Liviu Dudau drivers/gpu/drm/arm/malidp_crtc.c | 80 +++++++++++++++++++++ drivers/gpu/drm/arm/malidp_drv.c | 47 ++++++++++++ drivers/gpu/drm/arm/malidp_drv.h | 3 + drivers/gpu/drm/arm/malidp_hw.c | 140 ++++++++++++++++++++++++++++++++++++ drivers/gpu/drm/arm/malidp_hw.h | 45 ++++++++++++ drivers/gpu/drm/arm/malidp_planes.c | 73 ++++++++++++++----- drivers/gpu/drm/arm/malidp_regs.h | 36 ++++++++++ 7 files changed, 407 insertions(+), 17 deletions(-) commit ca028dbb1836f5a0529a6e5536ee2b2d7027b825 Author: Alexandre TORGUE Date: Fri Apr 7 14:43:01 2017 +0200 pinctrl: stm32: Add STM32F469 MCU support This patch which adds STM32F469 pinctrl and GPIO support, relies on the generic STM32 pinctrl driver. Signed-off-by: Alexandre TORGUE Signed-off-by: Linus Walleij drivers/pinctrl/stm32/Kconfig | 6 + drivers/pinctrl/stm32/Makefile | 1 + drivers/pinctrl/stm32/pinctrl-stm32f469.c | 1578 +++++++++++++++++++++++++++++ 3 files changed, 1585 insertions(+) commit 269fcf3666a34cf741257238b5f89903ed8ba710 Author: Alexandre TORGUE Date: Fri Apr 7 14:42:59 2017 +0200 Documentation: dt: Remove ngpios from stm32-pinctrl binding Remove "ngpios" bindings definition as it is no more used in stm32 pinctrl driver. Signed-off-by: Alexandre TORGUE Acked-by: Rob Herring Signed-off-by: Linus Walleij Documentation/devicetree/bindings/pinctrl/st,stm32-pinctrl.txt | 2 -- 1 file changed, 2 deletions(-) commit 4a4e5f6f77e5d7a0a8930a36082dc9cc966ec514 Author: Alexandre TORGUE Date: Fri Apr 7 17:10:09 2017 +0200 pinctrl: stm32: replace device_initcall() with arch_initcall() Pinctrl has to be registered earlier. Mainly to register bank irqdomain earlier as other devices could use interrupts from those irqdomain. Signed-off-by: Alexandre TORGUE Signed-off-by: Linus Walleij drivers/pinctrl/stm32/pinctrl-stm32f429.c | 6 +++++- drivers/pinctrl/stm32/pinctrl-stm32f746.c | 7 ++++++- drivers/pinctrl/stm32/pinctrl-stm32h743.c | 6 +++++- 3 files changed, 16 insertions(+), 3 deletions(-) commit 1dc9d289154bd8751b5a2b69698a819742026ce4 Author: Alexandre TORGUE Date: Fri Apr 7 14:42:58 2017 +0200 pinctrl: stm32: add possibility to use gpio-ranges to declare bank range Use device tree entries to declare gpio range. It will allow to use no contiguous gpio bank and holes inside a bank. Signed-off-by: Alexandre TORGUE Signed-off-by: Linus Walleij drivers/pinctrl/stm32/pinctrl-stm32.c | 115 +++++++++++++++++++--------------- 1 file changed, 65 insertions(+), 50 deletions(-) commit 5715092a458c1ac5f7befc1a3dd7660ccfcebcf1 Author: Gregory CLEMENT Date: Wed Apr 5 17:18:05 2017 +0200 pinctrl: armada-37xx: Add gpio support GPIO management is pretty simple and is part of the same IP than the pin controller for the Armada 37xx SoCs. This patch adds the GPIO support to the pinctrl-armada-37xx.c file, it also allows sharing common functions between the gpiolib and the pinctrl drivers. Signed-off-by: Gregory CLEMENT Signed-off-by: Linus Walleij drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 128 +++++++++++++++++++++++++--- 1 file changed, 114 insertions(+), 14 deletions(-) commit 9842119a238bfb92cbab63258dabb54f0e7b111b Author: Marc Zyngier Date: Mon Apr 24 09:04:03 2017 +0100 arm64: Add CNTFRQ_EL0 trap handler We now trap accesses to CNTVCT_EL0 when the counter is broken enough to require the kernel to mediate the access. But it turns out that some existing userspace (such as OpenMPI) do probe for the counter frequency, leading to an UNDEF exception as CNTVCT_EL0 and CNTFRQ_EL0 share the same control bit. The fix is to handle the exception the same way we do for CNTVCT_EL0. Fixes: a86bd139f2ae ("arm64: arch_timer: Enable CNTVCT_EL0 trap if workaround is enabled") Reported-by: Hanjun Guo Tested-by: Hanjun Guo Reviewed-by: Hanjun Guo Signed-off-by: Marc Zyngier Signed-off-by: Catalin Marinas arch/arm64/include/asm/esr.h | 4 ++++ arch/arm64/kernel/traps.c | 14 ++++++++++++++ 2 files changed, 18 insertions(+) commit 6fbc8798d9461c0ff22fab9fbaddde13de815941 Author: Thadeu Lima de Souza Cascardo Date: Tue Apr 4 05:56:32 2017 -0300 tty: fix comment for __tty_alloc_driver() Signed-off-by: Thadeu Lima de Souza Cascardo Signed-off-by: Jiri Kosina drivers/tty/tty_io.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 1b3b3b49b9961401331a1b496db5bec5c7b41ae6 Author: Viresh Kumar Date: Thu Mar 23 17:00:05 2017 +0530 init/main: properly align the multi-line comment Add a tab before it to follow standard practices. Also add the missing full stop '.'. Signed-off-by: Viresh Kumar Signed-off-by: Jiri Kosina init/main.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) commit 6623f1c6150c09ce946c8e27a4c814d64919495b Author: Viresh Kumar Date: Thu Mar 23 17:00:04 2017 +0530 init/main: Fix double "the" in comment s/the\ the/the Signed-off-by: Viresh Kumar Signed-off-by: Jiri Kosina init/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 73dbd4a4230216b6a5540a362edceae0c9b4876b Author: Pan Bian Date: Sun Apr 23 18:23:21 2017 +0800 iommu/amd: Fix incorrect error handling in amd_iommu_bind_pasid() In function amd_iommu_bind_pasid(), the control flow jumps to label out_free when pasid_state->mm and mm is NULL. And mmput(mm) is called. In function mmput(mm), mm is referenced without validation. This will result in a NULL dereference bug. This patch fixes the bug. Signed-off-by: Pan Bian Fixes: f0aac63b873b ('iommu/amd: Don't hold a reference to mm_struct') Signed-off-by: Joerg Roedel drivers/iommu/amd_iommu_v2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 2a2a251f110576b1d89efbd0662677d7e7db21a8 Author: Stephan Mueller Date: Mon Apr 24 11:15:23 2017 +0200 crypto: algif_aead - Require setkey before accept(2) Some cipher implementations will crash if you try to use them without calling setkey first. This patch adds a check so that the accept(2) call will fail with -ENOKEY if setkey hasn't been done on the socket yet. Fixes: 400c40cf78da ("crypto: algif - add AEAD support") Cc: Signed-off-by: Stephan Mueller Signed-off-by: Herbert Xu crypto/algif_aead.c | 157 +++++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 149 insertions(+), 8 deletions(-) commit a368f43d6e3a001e684e9191a27df384fbff12f5 Author: Giovanni Cabiddu Date: Fri Apr 21 21:54:30 2017 +0100 crypto: scomp - add support for deflate rfc1950 (zlib) Add scomp backend for zlib-deflate compression algorithm. This backend outputs data using the format defined in rfc1950 (raw deflate surrounded by zlib header and footer). Signed-off-by: Giovanni Cabiddu Signed-off-by: Herbert Xu crypto/deflate.c | 61 ++++++++++++++++++++++++++++++++------------- crypto/testmgr.c | 10 ++++++++ crypto/testmgr.h | 75 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 129 insertions(+), 17 deletions(-) commit 3de4f5e1a5dbe1a36d1e8a08ee1978f44c4b739b Author: Giovanni Cabiddu Date: Fri Apr 21 21:54:29 2017 +0100 crypto: scomp - allow registration of multiple scomps Add crypto_register_scomps and crypto_unregister_scomps to allow the registration of multiple implementations with one call. Signed-off-by: Giovanni Cabiddu Signed-off-by: Herbert Xu crypto/scompress.c | 29 +++++++++++++++++++++++++++++ include/crypto/internal/scompress.h | 3 +++ 2 files changed, 32 insertions(+) commit 6263b51eb3190d30351360fd168959af7e3a49a9 Author: Gary R Hook Date: Fri Apr 21 10:50:14 2017 -0500 crypto: ccp - Change ISR handler method for a v5 CCP The CCP has the ability to perform several operations simultaneously, but only one interrupt. When implemented as a PCI device and using MSI-X/MSI interrupts, use a tasklet model to service interrupts.